D37519.id113768.diff
No OneTemporary
Actions

Size

58 KB

Referenced Files

None

Subscribers

None

D37519.id113768.diff
View Options

	diff --git a/sys/fs/nfs/nfs_commonport.c.vnetmnt b/sys/fs/nfs/nfs_commonport.c
	--- a/sys/fs/nfs/nfs_commonport.c.vnetmnt
	+++ b/sys/fs/nfs/nfs_commonport.c
	@@ -61,7 +61,6 @@
	extern void (nfsd_call_recall)(struct vnode , int, struct ucred *,
	struct thread *);
	extern int nfsrv_useacl;
	-struct mount nfsv4root_mnt;
	int newnfs_numnfsd = 0;
	struct nfsstatsv1 nfsstatsv1;
	int nfs_numnfscbd = 0;
	diff --git a/sys/fs/nfs/nfs_commonsubs.c.vnet b/sys/fs/nfs/nfs_commonsubs.c
	--- a/sys/fs/nfs/nfs_commonsubs.c.vnet
	+++ b/sys/fs/nfs/nfs_commonsubs.c
	@@ -3931,7 +3931,7 @@
	cr->cr_uid = cr->cr_ruid = cr->cr_svuid = nidp->nid_uid;
	crsetgroups(cr, nidp->nid_ngroup, grps);
	cr->cr_rgid = cr->cr_svgid = cr->cr_groups[0];
	- cr->cr_prison = &prison0;
	+ cr->cr_prison = curthread->td_ucred->cr_prison;
	prison_hold(cr->cr_prison);
	#ifdef MAC
	mac_cred_associate_nfsd(cr);
	diff --git a/sys/fs/nfs/nfsdport.h.vnetdcl b/sys/fs/nfs/nfsdport.h
	--- a/sys/fs/nfs/nfsdport.h.vnetdcl
	+++ b/sys/fs/nfs/nfsdport.h
	@@ -92,7 +92,7 @@
	bcmp(&(f1)->fh_fid, &(f2)->fh_fid, sizeof(struct fid)) == 0)

	#define NFSLOCKHASH(f) \
	- (&nfslockhash[nfsrv_hashfh(f) % nfsrv_lockhashsize])
	+ (&VNET(nfslockhash)[nfsrv_hashfh(f) % nfsrv_lockhashsize])

	#define NFSFPVNODE(f) ((f)->f_vnode)
	#define NFSFPCRED(f) ((f)->f_cred)
	diff --git a/sys/fs/nfs/nfsrvstate.h.vnetdcl b/sys/fs/nfs/nfsrvstate.h
	--- a/sys/fs/nfs/nfsrvstate.h.vnetdcl
	+++ b/sys/fs/nfs/nfsrvstate.h
	@@ -58,7 +58,7 @@
	TAILQ_HEAD(nfsuserhashhead, nfsusrgrp);

	#define NFSCLIENTHASH(id) \
	- (&nfsclienthash[(id).lval[1] % nfsrv_clienthashsize])
	+ (&VNET(nfsclienthash)[(id).lval[1] % nfsrv_clienthashsize])
	#define NFSSTATEHASH(clp, id) \
	(&((clp)->lc_stateid[(id).other[2] % nfsrv_statehashsize]))
	#define NFSUSERHASH(id) \
	@@ -77,7 +77,7 @@
	struct nfssessionhashhead list;
	};
	#define NFSSESSIONHASH(f) \
	- (&nfssessionhash[nfsrv_hashsessionid(f) % nfsrv_sessionhashsize])
	+ (&VNET(nfssessionhash)[nfsrv_hashsessionid(f) % nfsrv_sessionhashsize])

	struct nfslayouthash {
	struct mtx mtx;
	diff --git a/sys/fs/nfsserver/nfs_fha_new.c.vnetdcl b/sys/fs/nfsserver/nfs_fha_new.c
	--- a/sys/fs/nfsserver/nfs_fha_new.c.vnetdcl
	+++ b/sys/fs/nfsserver/nfs_fha_new.c
	@@ -61,8 +61,9 @@
	SYSCTL_DECL(_vfs_nfsd);

	extern int newnfs_nfsv3_procid[];
	-extern SVCPOOL *nfsrvd_pool;

	+VNET_DECLARE(SVCPOOL *, nfsrvd_pool);
	+
	SYSINIT(nfs_fhanew, SI_SUB_ROOT_CONF, SI_ORDER_ANY, fhanew_init, NULL);
	SYSUNINIT(nfs_fhanew, SI_SUB_ROOT_CONF, SI_ORDER_ANY, fhanew_uninit, NULL);

	@@ -79,7 +80,7 @@
	snprintf(softc->server_name, sizeof(softc->server_name),
	FHANEW_SERVER_NAME);

	- softc->pool = &nfsrvd_pool;
	+ softc->pool = &VNET(nfsrvd_pool);

	/*
	* Initialize the sysctl context list for the fha module.
	diff --git a/sys/fs/nfsserver/nfs_nfsdcache.c.vnetdcl b/sys/fs/nfsserver/nfs_nfsdcache.c
	--- a/sys/fs/nfsserver/nfs_nfsdcache.c.vnetdcl
	+++ b/sys/fs/nfsserver/nfs_nfsdcache.c
	@@ -162,10 +162,13 @@

	extern struct nfsstatsv1 nfsstatsv1;
	extern struct mtx nfsrc_udpmtx;
	-extern struct nfsrchash_bucket nfsrchash_table[NFSRVCACHE_HASHSIZE];
	-extern struct nfsrchash_bucket nfsrcahash_table[NFSRVCACHE_HASHSIZE];
	-int nfsrc_floodlevel = NFSRVCACHE_FLOODLEVEL, nfsrc_tcpsavedreplies = 0;

	+VNET_DECLARE(struct nfsrchash_bucket, nfsrchash_table[NFSRVCACHE_HASHSIZE]);
	+VNET_DECLARE(struct nfsrchash_bucket, nfsrcahash_table[NFSRVCACHE_HASHSIZE]);
	+
	+VNET_DEFINE(int, nfsrc_floodlevel) = NFSRVCACHE_FLOODLEVEL;
	+VNET_DEFINE(int, nfsrc_tcpsavedreplies) = 0;
	+
	SYSCTL_DECL(_vfs_nfsd);

	static u_int nfsrc_tcphighwater = 0;
	@@ -180,8 +183,8 @@
	return (error);
	if (newhighwater < 0)
	return (EINVAL);
	- if (newhighwater >= nfsrc_floodlevel)
	- nfsrc_floodlevel = newhighwater + newhighwater / 5;
	+ if (newhighwater >= VNET(nfsrc_floodlevel))
	+ VNET(nfsrc_floodlevel) = newhighwater + newhighwater / 5;
	nfsrc_tcphighwater = newhighwater;
	return (0);
	}
	@@ -202,9 +205,9 @@
	&nfsrc_tcpnonidempotent, 0,
	"Enable the DRC for NFS over TCP");

	-static int nfsrc_udpcachesize = 0;
	-static TAILQ_HEAD(, nfsrvcache) nfsrvudplru;
	-static struct nfsrvhashhead nfsrvudphashtbl[NFSRVCACHE_HASHSIZE];
	+VNET_DEFINE_STATIC(int, nfsrc_udpcachesize) = 0;
	+VNET_DEFINE_STATIC(TAILQ_HEAD(, nfsrvcache), nfsrvudplru);
	+VNET_DEFINE_STATIC(struct nfsrvhashhead, nfsrvudphashtbl[NFSRVCACHE_HASHSIZE]);

	/*
	* and the reverse mapping from generic to Version 2 procedure numbers
	@@ -236,10 +239,10 @@

	#define nfsrc_hash(xid) (((xid) + ((xid) >> 24)) % NFSRVCACHE_HASHSIZE)
	#define NFSRCUDPHASH(xid) \
	- (&nfsrvudphashtbl[nfsrc_hash(xid)])
	+ (&VNET(nfsrvudphashtbl)[nfsrc_hash(xid)])
	#define NFSRCHASH(xid) \
	- (&nfsrchash_table[nfsrc_hash(xid)].tbl)
	-#define NFSRCAHASH(xid) (&nfsrcahash_table[nfsrc_hash(xid)])
	+ (&VNET(nfsrchash_table)[nfsrc_hash(xid)].tbl)
	+#define NFSRCAHASH(xid) (&VNET(nfsrcahash_table)[nfsrc_hash(xid)])
	#define TRUE 1
	#define FALSE 0
	#define NFSRVCACHE_CHECKLEN 100
	@@ -295,7 +298,7 @@

	if ((rp->rc_flag & RC_UDP) != 0)
	return (&nfsrc_udpmtx);
	- return (&nfsrchash_table[nfsrc_hash(rp->rc_xid)].mtx);
	+ return (&VNET(nfsrchash_table)[nfsrc_hash(rp->rc_xid)].mtx);
	}

	/*
	@@ -305,21 +308,21 @@
	nfsrvd_initcache(void)
	{
	int i;
	- static int inited = 0;

	- if (inited)
	- return;
	- inited = 1;
	for (i = 0; i < NFSRVCACHE_HASHSIZE; i++) {
	- LIST_INIT(&nfsrvudphashtbl[i]);
	- LIST_INIT(&nfsrchash_table[i].tbl);
	- LIST_INIT(&nfsrcahash_table[i].tbl);
	+ mtx_init(&VNET(nfsrchash_table)[i].mtx, "nfsrtc", NULL,
	+ MTX_DEF);
	+ mtx_init(&VNET(nfsrcahash_table)[i].mtx, "nfsrtca", NULL,
	+ MTX_DEF);
	}
	- TAILQ_INIT(&nfsrvudplru);
	- nfsrc_tcpsavedreplies = 0;
	- nfsrc_udpcachesize = 0;
	- nfsstatsv1.srvcache_tcppeak = 0;
	- nfsstatsv1.srvcache_size = 0;
	+ for (i = 0; i < NFSRVCACHE_HASHSIZE; i++) {
	+ LIST_INIT(&VNET(nfsrvudphashtbl)[i]);
	+ LIST_INIT(&VNET(nfsrchash_table)[i].tbl);
	+ LIST_INIT(&VNET(nfsrcahash_table)[i].tbl);
	+ }
	+ TAILQ_INIT(&VNET(nfsrvudplru));
	+ VNET(nfsrc_tcpsavedreplies) = 0;
	+ VNET(nfsrc_udpcachesize) = 0;
	}

	/*
	@@ -392,8 +395,8 @@
	if (rp->rc_flag == 0)
	panic("nfs udp cache0");
	rp->rc_flag \|= RC_LOCKED;
	- TAILQ_REMOVE(&nfsrvudplru, rp, rc_lru);
	- TAILQ_INSERT_TAIL(&nfsrvudplru, rp, rc_lru);
	+ TAILQ_REMOVE(&VNET(nfsrvudplru), rp, rc_lru);
	+ TAILQ_INSERT_TAIL(&VNET(nfsrvudplru), rp, rc_lru);
	if (rp->rc_flag & RC_INPROG) {
	nfsstatsv1.srvcache_inproghits++;
	mtx_unlock(mutex);
	@@ -427,7 +430,7 @@
	}
	nfsstatsv1.srvcache_misses++;
	atomic_add_int(&nfsstatsv1.srvcache_size, 1);
	- nfsrc_udpcachesize++;
	+ VNET(nfsrc_udpcachesize)++;

	newrp->rc_flag \|= RC_INPROG;
	saddr = NFSSOCKADDR(nd->nd_nam, struct sockaddr_in *);
	@@ -440,7 +443,7 @@
	newrp->rc_flag \|= RC_INETIPV6;
	}
	LIST_INSERT_HEAD(hp, newrp, rc_hash);
	- TAILQ_INSERT_TAIL(&nfsrvudplru, newrp, rc_lru);
	+ TAILQ_INSERT_TAIL(&VNET(nfsrvudplru), newrp, rc_lru);
	mtx_unlock(mutex);
	nd->nd_rp = newrp;
	ret = RC_DOIT;
	@@ -472,8 +475,8 @@
	panic("nfsrvd_updatecache not inprog");
	rp->rc_flag &= ~RC_INPROG;
	if (rp->rc_flag & RC_UDP) {
	- TAILQ_REMOVE(&nfsrvudplru, rp, rc_lru);
	- TAILQ_INSERT_TAIL(&nfsrvudplru, rp, rc_lru);
	+ TAILQ_REMOVE(&VNET(nfsrvudplru), rp, rc_lru);
	+ TAILQ_INSERT_TAIL(&VNET(nfsrvudplru), rp, rc_lru);
	}

	/*
	@@ -503,7 +506,7 @@
	(rp->rc_refcnt > 0 \|\|
	((nd->nd_flag & ND_SAVEREPLY) && (rp->rc_flag & RC_UDP)) \|\|
	((nd->nd_flag & ND_SAVEREPLY) && !(rp->rc_flag & RC_UDP) &&
	- nfsrc_tcpsavedreplies <= nfsrc_floodlevel &&
	+ VNET(nfsrc_tcpsavedreplies) <= VNET(nfsrc_floodlevel) &&
	nfsrc_tcpnonidempotent))) {
	if (rp->rc_refcnt > 0) {
	if (!(rp->rc_flag & RC_NFSV4))
	@@ -517,11 +520,11 @@
	mtx_unlock(mutex);
	} else {
	if (!(rp->rc_flag & RC_UDP)) {
	- atomic_add_int(&nfsrc_tcpsavedreplies, 1);
	- if (nfsrc_tcpsavedreplies >
	+ atomic_add_int(&VNET(nfsrc_tcpsavedreplies), 1);
	+ if (VNET(nfsrc_tcpsavedreplies) >
	nfsstatsv1.srvcache_tcppeak)
	nfsstatsv1.srvcache_tcppeak =
	- nfsrc_tcpsavedreplies;
	+ VNET(nfsrc_tcpsavedreplies);
	}
	mtx_unlock(mutex);
	m = m_copym(nd->nd_mreq, 0, M_COPYALL, M_WAITOK);
	@@ -785,8 +788,8 @@

	LIST_REMOVE(rp, rc_hash);
	if (rp->rc_flag & RC_UDP) {
	- TAILQ_REMOVE(&nfsrvudplru, rp, rc_lru);
	- nfsrc_udpcachesize--;
	+ TAILQ_REMOVE(&VNET(nfsrvudplru), rp, rc_lru);
	+ VNET(nfsrc_udpcachesize)--;
	} else if (rp->rc_acked != RC_NO_SEQ) {
	hbp = NFSRCAHASH(rp->rc_sockref);
	mtx_lock(&hbp->mtx);
	@@ -798,7 +801,7 @@
	if (rp->rc_flag & RC_REPMBUF) {
	m_freem(rp->rc_reply);
	if (!(rp->rc_flag & RC_UDP))
	- atomic_add_int(&nfsrc_tcpsavedreplies, -1);
	+ atomic_add_int(&VNET(nfsrc_tcpsavedreplies), -1);
	}
	free(rp, M_NFSRVCACHE);
	atomic_add_int(&nfsstatsv1.srvcache_size, -1);
	@@ -814,20 +817,20 @@
	int i;

	for (i = 0; i < NFSRVCACHE_HASHSIZE; i++) {
	- mtx_lock(&nfsrchash_table[i].mtx);
	- LIST_FOREACH_SAFE(rp, &nfsrchash_table[i].tbl, rc_hash, nextrp)
	+ mtx_lock(&VNET(nfsrchash_table)[i].mtx);
	+ LIST_FOREACH_SAFE(rp, &VNET(nfsrchash_table)[i].tbl, rc_hash, nextrp)
	nfsrc_freecache(rp);
	- mtx_unlock(&nfsrchash_table[i].mtx);
	+ mtx_unlock(&VNET(nfsrchash_table)[i].mtx);
	}
	mtx_lock(&nfsrc_udpmtx);
	for (i = 0; i < NFSRVCACHE_HASHSIZE; i++) {
	- LIST_FOREACH_SAFE(rp, &nfsrvudphashtbl[i], rc_hash, nextrp) {
	+ LIST_FOREACH_SAFE(rp, &VNET(nfsrvudphashtbl)[i], rc_hash, nextrp) {
	nfsrc_freecache(rp);
	}
	}
	nfsstatsv1.srvcache_size = 0;
	mtx_unlock(&nfsrc_udpmtx);
	- nfsrc_tcpsavedreplies = 0;
	+ VNET(nfsrc_tcpsavedreplies) = 0;
	}

	#define HISTSIZE 16
	@@ -864,25 +867,25 @@
	if (atomic_cmpset_acq_int(&onethread, 0, 1) == 0)
	return;
	if (NFSD_MONOSEC != udp_lasttrim \|\|
	- nfsrc_udpcachesize >= (nfsrc_udphighwater +
	+ VNET(nfsrc_udpcachesize) >= (nfsrc_udphighwater +
	nfsrc_udphighwater / 2)) {
	mtx_lock(&nfsrc_udpmtx);
	udp_lasttrim = NFSD_MONOSEC;
	- TAILQ_FOREACH_SAFE(rp, &nfsrvudplru, rc_lru, nextrp) {
	+ TAILQ_FOREACH_SAFE(rp, &VNET(nfsrvudplru), rc_lru, nextrp) {
	if (!(rp->rc_flag & (RC_INPROG\|RC_LOCKED\|RC_WANTED))
	&& rp->rc_refcnt == 0
	&& ((rp->rc_flag & RC_REFCNT) \|\|
	udp_lasttrim > rp->rc_timestamp \|\|
	- nfsrc_udpcachesize > nfsrc_udphighwater))
	+ VNET(nfsrc_udpcachesize) > nfsrc_udphighwater))
	nfsrc_freecache(rp);
	}
	mtx_unlock(&nfsrc_udpmtx);
	}
	if (NFSD_MONOSEC != tcp_lasttrim \|\|
	- nfsrc_tcpsavedreplies >= nfsrc_tcphighwater) {
	+ VNET(nfsrc_tcpsavedreplies) >= nfsrc_tcphighwater) {
	force = nfsrc_tcphighwater / 4;
	if (force > 0 &&
	- nfsrc_tcpsavedreplies + force >= nfsrc_tcphighwater) {
	+ VNET(nfsrc_tcpsavedreplies) + force >= nfsrc_tcphighwater) {
	for (i = 0; i < HISTSIZE; i++)
	time_histo[i] = 0;
	i = 0;
	@@ -901,8 +904,8 @@
	tto = nfsrc_tcptimeout;
	tcp_lasttrim = NFSD_MONOSEC;
	for (; i <= lastslot; i++) {
	- mtx_lock(&nfsrchash_table[i].mtx);
	- LIST_FOREACH_SAFE(rp, &nfsrchash_table[i].tbl, rc_hash,
	+ mtx_lock(&VNET(nfsrchash_table)[i].mtx);
	+ LIST_FOREACH_SAFE(rp, &VNET(nfsrchash_table)[i].tbl, rc_hash,
	nextrp) {
	if (!(rp->rc_flag &
	(RC_INPROG\|RC_LOCKED\|RC_WANTED))
	@@ -932,7 +935,7 @@
	time_histo[j]++;
	}
	}
	- mtx_unlock(&nfsrchash_table[i].mtx);
	+ mtx_unlock(&VNET(nfsrchash_table)[i].mtx);
	}
	if (force) {
	/*
	@@ -951,8 +954,8 @@
	k = 1;
	thisstamp = tcp_lasttrim + k;
	for (i = 0; i < NFSRVCACHE_HASHSIZE; i++) {
	- mtx_lock(&nfsrchash_table[i].mtx);
	- LIST_FOREACH_SAFE(rp, &nfsrchash_table[i].tbl,
	+ mtx_lock(&VNET(nfsrchash_table)[i].mtx);
	+ LIST_FOREACH_SAFE(rp, &VNET(nfsrchash_table)[i].tbl,
	rc_hash, nextrp) {
	if (!(rp->rc_flag &
	(RC_INPROG\|RC_LOCKED\|RC_WANTED))
	@@ -962,7 +965,7 @@
	rp->rc_acked == RC_ACK))
	nfsrc_freecache(rp);
	}
	- mtx_unlock(&nfsrchash_table[i].mtx);
	+ mtx_unlock(&VNET(nfsrchash_table)[i].mtx);
	}
	}
	}
	diff --git a/sys/fs/nfsserver/nfs_nfsdkrpc.c.vnetdcl b/sys/fs/nfsserver/nfs_nfsdkrpc.c
	--- a/sys/fs/nfsserver/nfs_nfsdkrpc.c.vnetdcl
	+++ b/sys/fs/nfsserver/nfs_nfsdkrpc.c
	@@ -42,6 +42,8 @@

	#include <fs/nfs/nfsport.h>

	+#include <net/vnet.h>
	+
	#include <rpc/rpc.h>
	#include <rpc/rpcsec_gss.h>
	#include <rpc/rpcsec_tls.h>
	@@ -52,7 +54,6 @@

	NFSDLOCKMUTEX;
	NFSV4ROOTLOCKMUTEX;
	-struct nfsv4lock nfsd_suspend_lock;
	char *nfsrv_zeropnfsdat = NULL;

	/*
	@@ -85,8 +86,6 @@

	SYSCTL_DECL(_vfs_nfsd);

	-SVCPOOL *nfsrvd_pool;
	-
	static int nfs_privport = 0;
	SYSCTL_INT(_vfs_nfsd, OID_AUTO, nfs_privport, CTLFLAG_RWTUN,
	&nfs_privport, 0,
	@@ -105,12 +104,19 @@

	extern u_long sb_max_adj;
	extern int newnfs_numnfsd;
	-extern struct proc *nfsd_master_proc;
	extern time_t nfsdev_time;
	extern int nfsrv_writerpc[NFS_NPROCS];
	extern volatile int nfsrv_devidcnt;
	extern struct nfsv4_opflag nfsv4_opflag[NFSV42_NOPS];

	+VNET_DECLARE(struct proc *, nfsd_master_proc);
	+
	+VNET_DEFINE(SVCPOOL *, nfsrvd_pool);
	+VNET_DEFINE(int, nfsrv_numnfsd) = 0;
	+VNET_DEFINE(struct nfsv4lock, nfsd_suspend_lock);
	+
	+VNET_DEFINE_STATIC(bool, nfsrvd_inited) = false;
	+
	/*
	* NFS server system calls
	*/
	@@ -125,6 +131,7 @@
	u_int maxlen;
	#endif

	+ CURVNET_SET(TD_TO_VNET(curthread));
	memset(&nd, 0, sizeof(nd));
	if (rqst->rq_vers == NFS_VER2) {
	if (rqst->rq_proc > NFSV2PROC_STATFS \|\|
	@@ -261,9 +268,9 @@
	* nfsv4root exports by nfsvno_v4rootexport().
	*/
	NFSLOCKV4ROOTMUTEX();
	- nfsv4_lock(&nfsd_suspend_lock, 0, NULL, NFSV4ROOTLOCKMUTEXPTR,
	+ nfsv4_lock(&VNET(nfsd_suspend_lock), 0, NULL, NFSV4ROOTLOCKMUTEXPTR,
	NULL);
	- nfsv4_getref(&nfsd_suspend_lock, NULL, NFSV4ROOTLOCKMUTEXPTR,
	+ nfsv4_getref(&VNET(nfsd_suspend_lock), NULL, NFSV4ROOTLOCKMUTEXPTR,
	NULL);
	NFSUNLOCKV4ROOTMUTEX();

	@@ -271,7 +278,7 @@
	nd.nd_repstat = nfsvno_v4rootexport(&nd);
	if (nd.nd_repstat != 0) {
	NFSLOCKV4ROOTMUTEX();
	- nfsv4_relref(&nfsd_suspend_lock);
	+ nfsv4_relref(&VNET(nfsd_suspend_lock));
	NFSUNLOCKV4ROOTMUTEX();
	svcerr_weakauth(rqst);
	svc_freereq(rqst);
	@@ -287,7 +294,7 @@
	#endif
	cacherep = nfs_proc(&nd, rqst->rq_xid, xprt, &rp);
	NFSLOCKV4ROOTMUTEX();
	- nfsv4_relref(&nfsd_suspend_lock);
	+ nfsv4_relref(&VNET(nfsd_suspend_lock));
	NFSUNLOCKV4ROOTMUTEX();
	} else {
	NFSMGET(nd.nd_mreq);
	@@ -327,6 +334,7 @@
	svc_freereq(rqst);

	out:
	+ CURVNET_RESTORE();
	ast_kclear(curthread);
	NFSEXITCODE(0);
	}
	@@ -467,9 +475,9 @@
	* unexpectedly.
	*/
	if (so->so_type == SOCK_DGRAM)
	- xprt = svc_dg_create(nfsrvd_pool, so, 0, 0);
	+ xprt = svc_dg_create(VNET(nfsrvd_pool), so, 0, 0);
	else
	- xprt = svc_vc_create(nfsrvd_pool, so, 0, 0);
	+ xprt = svc_vc_create(VNET(nfsrvd_pool), so, 0, 0);
	if (xprt) {
	fp->f_ops = &badfileops;
	fp->f_data = NULL;
	@@ -518,13 +526,15 @@
	* use.
	*/
	NFSD_LOCK();
	- if (newnfs_numnfsd == 0) {
	+ if (VNET(nfsrv_numnfsd) == 0) {
	+ nfsrvd_init(0);
	nfsdev_time = time_second;
	p = td->td_proc;
	PROC_LOCK(p);
	p->p_flag2 \|= P2_AST_SU;
	PROC_UNLOCK(p);
	- newnfs_numnfsd++;
	+ newnfs_numnfsd++; /* Total num for all vnets. */
	+ VNET(nfsrv_numnfsd)++; /* Num for this vnet. */

	NFSD_UNLOCK();
	error = nfsrv_createdevids(args, td);
	@@ -546,8 +556,8 @@
	"nfsd: can't register svc name\n");
	}

	- nfsrvd_pool->sp_minthreads = args->minthreads;
	- nfsrvd_pool->sp_maxthreads = args->maxthreads;
	+ VNET(nfsrvd_pool)->sp_minthreads = args->minthreads;
	+ VNET(nfsrvd_pool)->sp_maxthreads = args->maxthreads;

	/*
	* If this is a pNFS service, make Getattr do a
	@@ -558,7 +568,7 @@
	nfsv4_opflag[NFSV4OP_GETATTR].modifyfs = 1;
	}

	- svc_run(nfsrvd_pool);
	+ svc_run(VNET(nfsrvd_pool));

	/* Reset Getattr to not do a vn_start_write(). */
	nfsrv_writerpc[NFSPROC_GETATTR] = 0;
	@@ -572,6 +582,7 @@
	}
	NFSD_LOCK();
	newnfs_numnfsd--;
	+ VNET(nfsrv_numnfsd)--;
	nfsrvd_init(1);
	PROC_LOCK(p);
	p->p_flag2 &= ~P2_AST_SU;
	@@ -596,21 +607,28 @@
	NFSD_LOCK_ASSERT();

	if (terminating) {
	- nfsd_master_proc = NULL;
	+ VNET(nfsd_master_proc) = NULL;
	NFSD_UNLOCK();
	nfsrv_freealllayoutsanddevids();
	nfsrv_freeallbackchannel_xprts();
	- svcpool_close(nfsrvd_pool);
	+ svcpool_close(VNET(nfsrvd_pool));
	free(nfsrv_zeropnfsdat, M_TEMP);
	nfsrv_zeropnfsdat = NULL;
	NFSD_LOCK();
	} else {
	+ /* Initialize per-vnet globals once per vnet. */
	+ if (VNET(nfsrvd_inited))
	+ return;
	+ VNET(nfsrvd_inited) = true;
	NFSD_UNLOCK();
	- nfsrvd_pool = svcpool_create("nfsd",
	+ nfsrvd_initcache();
	+ nfsd_init();
	+ nfsd_mntinit();
	+ VNET(nfsrvd_pool) = svcpool_create("nfsd",
	SYSCTL_STATIC_CHILDREN(_vfs_nfsd));
	- nfsrvd_pool->sp_rcache = NULL;
	- nfsrvd_pool->sp_assign = fhanew_assign;
	- nfsrvd_pool->sp_done = fhanew_nd_complete;
	+ VNET(nfsrvd_pool)->sp_rcache = NULL;
	+ VNET(nfsrvd_pool)->sp_assign = fhanew_assign;
	+ VNET(nfsrvd_pool)->sp_done = fhanew_nd_complete;
	NFSD_LOCK();
	}
	}
	diff --git a/sys/fs/nfsserver/nfs_nfsdport.c.vnet b/sys/fs/nfsserver/nfs_nfsdport.c
	--- a/sys/fs/nfsserver/nfs_nfsdport.c.vnet
	+++ b/sys/fs/nfsserver/nfs_nfsdport.c
	@@ -59,38 +59,34 @@
	extern u_int32_t newnfs_true, newnfs_false, newnfs_xdrneg1;
	extern int nfsrv_useacl;
	extern int newnfs_numnfsd;
	-extern struct mount nfsv4root_mnt;
	-extern struct nfsrv_stablefirst nfsrv_stablefirst;
	-extern SVCPOOL *nfsrvd_pool;
	-extern struct nfsv4lock nfsd_suspend_lock;
	-extern struct nfsclienthashhead *nfsclienthash;
	-extern struct nfslockhashhead *nfslockhash;
	-extern struct nfssessionhash *nfssessionhash;
	extern int nfsrv_sessionhashsize;
	extern struct nfsstatsv1 nfsstatsv1;
	extern struct nfslayouthash *nfslayouthash;
	extern int nfsrv_layouthashsize;
	extern struct mtx nfsrv_dslock_mtx;
	extern int nfs_pnfsiothreads;
	-extern struct nfsdontlisthead nfsrv_dontlisthead;
	-extern volatile int nfsrv_dontlistlen;
	extern volatile int nfsrv_devidcnt;
	extern int nfsrv_maxpnfsmirror;
	extern uint32_t nfs_srvmaxio;
	extern int nfs_bufpackets;
	extern u_long sb_max_adj;
	-struct vfsoptlist nfsv4root_opt, nfsv4root_newopt;
	+
	+VNET_DECLARE(int, nfsrv_numnfsd);
	+VNET_DECLARE(struct nfsrv_stablefirst, nfsrv_stablefirst);
	+VNET_DECLARE(SVCPOOL *, nfsrvd_pool);
	+VNET_DECLARE(struct nfsclienthashhead *, nfsclienthash);
	+VNET_DECLARE(struct nfslockhashhead *, nfslockhash);
	+VNET_DECLARE(struct nfssessionhash *, nfssessionhash);
	+VNET_DECLARE(struct nfsv4lock, nfsd_suspend_lock);
	+
	NFSDLOCKMUTEX;
	NFSSTATESPINLOCK;
	-struct nfsrchash_bucket nfsrchash_table[NFSRVCACHE_HASHSIZE];
	-struct nfsrchash_bucket nfsrcahash_table[NFSRVCACHE_HASHSIZE];
	struct mtx nfsrc_udpmtx;
	struct mtx nfs_v4root_mutex;
	struct mtx nfsrv_dontlistlock_mtx;
	struct mtx nfsrv_recalllock_mtx;
	-struct nfsrvfh nfs_rootfh, nfs_pubfh;
	-int nfs_pubfhset = 0, nfs_rootfhset = 0;
	-struct proc *nfsd_master_proc = NULL;
	+struct nfsrvfh nfs_pubfh;
	+int nfs_pubfhset = 0;
	int nfsd_debuglevel = 0;
	static pid_t nfsd_master_pid = (pid_t)-1;
	static char nfsd_master_comm[MAXCOMLEN + 1];
	@@ -99,8 +95,21 @@
	static fhandle_t zerofh;
	struct callout nfsd_callout;

	+VNET_DEFINE(struct proc *, nfsd_master_proc) = NULL;
	+VNET_DEFINE(struct nfsrchash_bucket, nfsrchash_table[NFSRVCACHE_HASHSIZE]);
	+VNET_DEFINE(struct nfsrchash_bucket, nfsrcahash_table[NFSRVCACHE_HASHSIZE]);
	+VNET_DEFINE(struct nfsrvfh, nfs_rootfh);
	+VNET_DEFINE(int, nfs_rootfhset) = 0;
	+
	+VNET_DEFINE_STATIC(struct mount, nfsv4root_mnt);
	+VNET_DEFINE_STATIC(struct vfsoptlist, nfsv4root_opt);
	+VNET_DEFINE_STATIC(struct vfsoptlist, nfsv4root_newopt);
	+VNET_DEFINE_STATIC(bool, nfsrv_suspend_nfsd) = false;
	+VNET_DEFINE_STATIC(bool, nfsrv_mntinited) = false;
	+
	static int nfssvc_srvcall(struct thread , struct nfssvc_args ,
	struct ucred *);
	+static bool nfsrv_jailed_not_at_root(void);
	static void nfsvno_updateds(struct vnode , struct ucred , struct thread *);

	int nfsrv_enable_crossmntpt = 1;
	@@ -3255,7 +3264,7 @@
	error = VFS_CHECKEXP(mp, nam, &exp->nes_exflag, credp,
	&exp->nes_numsecflavor, exp->nes_secflavors);
	if (error) {
	- if (nfs_rootfhset) {
	+ if (VNET(nfs_rootfhset)) {
	exp->nes_exflag = 0;
	exp->nes_numsecflavor = 0;
	error = 0;
	@@ -3290,7 +3299,7 @@
	error = VFS_CHECKEXP(mp, nam, &exp->nes_exflag, credp,
	&exp->nes_numsecflavor, exp->nes_secflavors);
	if (error) {
	- if (nfs_rootfhset) {
	+ if (VNET(nfs_rootfhset)) {
	exp->nes_exflag = 0;
	exp->nes_numsecflavor = 0;
	error = 0;
	@@ -3458,9 +3467,9 @@
	struct nameidata nd;
	fhandle_t fh;

	- error = vfs_export(&nfsv4root_mnt, &nfsexargp->export);
	+ error = vfs_export(&VNET(nfsv4root_mnt), &nfsexargp->export);
	if ((nfsexargp->export.ex_flags & MNT_DELEXPORT) != 0)
	- nfs_rootfhset = 0;
	+ VNET(nfs_rootfhset) = 0;
	else if (error == 0) {
	if (nfsexargp->fspec == NULL) {
	error = EPERM;
	@@ -3475,11 +3484,11 @@
	error = nfsvno_getfh(nd.ni_vp, &fh, p);
	vrele(nd.ni_vp);
	if (!error) {
	- nfs_rootfh.nfsrvfh_len = NFSX_MYFH;
	+ VNET(nfs_rootfh).nfsrvfh_len = NFSX_MYFH;
	NFSBCOPY((caddr_t)&fh,
	- nfs_rootfh.nfsrvfh_data,
	+ VNET(nfs_rootfh).nfsrvfh_data,
	sizeof (fhandle_t));
	- nfs_rootfhset = 1;
	+ VNET(nfs_rootfhset) = 1;
	}
	}

	@@ -3515,29 +3524,34 @@
	void
	nfsd_mntinit(void)
	{
	- static int inited = 0;

	- if (inited)
	+ if (VNET(nfsrv_mntinited))
	return;
	- inited = 1;
	- nfsv4root_mnt.mnt_flag = (MNT_RDONLY \| MNT_EXPORTED);
	- TAILQ_INIT(&nfsv4root_mnt.mnt_nvnodelist);
	- TAILQ_INIT(&nfsv4root_mnt.mnt_lazyvnodelist);
	- nfsv4root_mnt.mnt_export = NULL;
	- TAILQ_INIT(&nfsv4root_opt);
	- TAILQ_INIT(&nfsv4root_newopt);
	- nfsv4root_mnt.mnt_opt = &nfsv4root_opt;
	- nfsv4root_mnt.mnt_optnew = &nfsv4root_newopt;
	- nfsv4root_mnt.mnt_nvnodelistsize = 0;
	- nfsv4root_mnt.mnt_lazyvnodelistsize = 0;
	+ VNET(nfsrv_mntinited) = true;
	+ VNET(nfsv4root_mnt).mnt_flag = (MNT_RDONLY \| MNT_EXPORTED);
	+ mtx_init(&VNET(nfsv4root_mnt).mnt_mtx, "nfs4mnt", NULL, MTX_DEF);
	+ lockinit(&VNET(nfsv4root_mnt).mnt_explock, PVFS, "explock", 0, 0);
	+ TAILQ_INIT(&VNET(nfsv4root_mnt).mnt_nvnodelist);
	+ TAILQ_INIT(&VNET(nfsv4root_mnt).mnt_lazyvnodelist);
	+ VNET(nfsv4root_mnt).mnt_export = NULL;
	+ TAILQ_INIT(&VNET(nfsv4root_opt));
	+ TAILQ_INIT(&VNET(nfsv4root_newopt));
	+ VNET(nfsv4root_mnt).mnt_opt = &VNET(nfsv4root_opt);
	+ VNET(nfsv4root_mnt).mnt_optnew = &VNET(nfsv4root_newopt);
	+ VNET(nfsv4root_mnt).mnt_nvnodelistsize = 0;
	+ VNET(nfsv4root_mnt).mnt_lazyvnodelistsize = 0;
	}

	static void
	nfsd_timer(void *arg)
	{
	+ struct vnet *vnetp;

	+ vnetp = (struct vnet *)arg;
	+ CURVNET_SET(vnetp);
	nfsrv_servertimer();
	- callout_reset_sbt(&nfsd_callout, SBT_1S, SBT_1S, nfsd_timer, NULL, 0);
	+ CURVNET_RESTORE();
	+ callout_reset_sbt(&nfsd_callout, SBT_1S, SBT_1S, nfsd_timer, arg, 0);
	}

	/*
	@@ -3619,7 +3633,7 @@
	int error = 0, numsecflavor, secflavors[MAXSECFLAVORS], i;
	uint64_t exflags;

	- error = vfs_stdcheckexp(&nfsv4root_mnt, nd->nd_nam, &exflags,
	+ error = vfs_stdcheckexp(&VNET(nfsv4root_mnt), nd->nd_nam, &exflags,
	&credanon, &numsecflavor, secflavors);
	if (error) {
	error = NFSERR_PROGUNAVAIL;
	@@ -3674,6 +3688,11 @@
	char buf, cp, cp2, cp3;
	char fname[PNFS_FILENAME_LEN + 1];

	+ if (nfsrv_jailed_not_at_root()) {
	+ error = EPERM;
	+ goto out;
	+ }
	+ nfsd_mntinit();
	if (uap->flag & NFSSVC_NFSDADDSOCK) {
	error = copyin(uap->argp, (caddr_t)&sockarg, sizeof (sockarg));
	if (error)
	@@ -3781,7 +3800,7 @@
	nfsdarg.mdspathlen = 0;
	nfsdarg.mirrorcnt = 1;
	}
	- nfsd_timer(NULL);
	+ nfsd_timer(TD_TO_VNET(td));
	error = nfsrvd_nfsd(td, &nfsdarg);
	free(nfsdarg.addr, M_TEMP);
	free(nfsdarg.dnshost, M_TEMP);
	@@ -3881,7 +3900,6 @@
	int error = EINVAL, igotlock;
	struct proc *procp;
	gid_t *grps;
	- static int suspend_nfsd = 0;

	if (uap->flag & NFSSVC_PUBLICFH) {
	NFSBZERO((caddr_t)&nfs_pubfh.nfsrvfh_data,
	@@ -3965,10 +3983,10 @@
	error = fp_getfvp(p, stablefd, &fp, &vp);
	if (!error && (NFSFPFLAG(fp) & (FREAD \| FWRITE)) != (FREAD \| FWRITE))
	error = EBADF;
	- if (!error && newnfs_numnfsd != 0)
	+ if (!error && VNET(nfsrv_numnfsd) != 0)
	error = EPERM;
	if (!error) {
	- nfsrv_stablefirst.nsf_fp = fp;
	+ VNET(nfsrv_stablefirst).nsf_fp = fp;
	nfsrv_setupstable(p);
	}
	} else if (uap->flag & NFSSVC_ADMINREVOKE) {
	@@ -4015,25 +4033,25 @@
	nfsd_master_pid = procp->p_pid;
	bcopy(procp->p_comm, nfsd_master_comm, MAXCOMLEN + 1);
	nfsd_master_start = procp->p_stats->p_start;
	- nfsd_master_proc = procp;
	+ VNET(nfsd_master_proc) = procp;
	PROC_UNLOCK(procp);
	} else if ((uap->flag & NFSSVC_SUSPENDNFSD) != 0) {
	NFSLOCKV4ROOTMUTEX();
	- if (suspend_nfsd == 0) {
	+ if (!VNET(nfsrv_suspend_nfsd)) {
	/* Lock out all nfsd threads */
	do {
	- igotlock = nfsv4_lock(&nfsd_suspend_lock, 1,
	+ igotlock = nfsv4_lock(&VNET(nfsd_suspend_lock), 1,
	NULL, NFSV4ROOTLOCKMUTEXPTR, NULL);
	- } while (igotlock == 0 && suspend_nfsd == 0);
	- suspend_nfsd = 1;
	+ } while (igotlock == 0 && !VNET(nfsrv_suspend_nfsd));
	+ VNET(nfsrv_suspend_nfsd) = true;
	}
	NFSUNLOCKV4ROOTMUTEX();
	error = 0;
	} else if ((uap->flag & NFSSVC_RESUMENFSD) != 0) {
	NFSLOCKV4ROOTMUTEX();
	- if (suspend_nfsd != 0) {
	- nfsv4_unlock(&nfsd_suspend_lock, 0);
	- suspend_nfsd = 0;
	+ if (VNET(nfsrv_suspend_nfsd)) {
	+ nfsv4_unlock(&VNET(nfsd_suspend_lock), 0);
	+ VNET(nfsrv_suspend_nfsd) = false;
	}
	NFSUNLOCKV4ROOTMUTEX();
	error = 0;
	@@ -4044,6 +4062,26 @@
	}

	/*
	+ * If the nfssvc call is within a prison, it must be a vnet
	+ * prison and the root of the prison must be a file system
	+ * mount point.
	+ */
	+static bool
	+nfsrv_jailed_not_at_root(void)
	+{
	+
	+ if (!jailed(curthread->td_ucred))
	+ return (false);
	+ if (jailed_without_vnet(curthread->td_ucred))
	+ return (true);
	+ if (!prison_allow(curthread->td_ucred, PR_ALLOW_NFSD))
	+ return (true);
	+ if ((curthread->td_ucred->cr_prison->pr_root->v_vflag & VV_ROOT) == 0)
	+ return (true);
	+ return (false);
	+}
	+
	+/*
	* Check exports.
	* Returns 0 if ok, 1 otherwise.
	*/
	@@ -4141,10 +4179,10 @@
	{
	struct proc *procp;

	- if (nfsd_master_proc != NULL) {
	+ if (VNET(nfsd_master_proc) != NULL) {
	procp = pfind(nfsd_master_pid);
	/* Try to make sure it is the correct process. */
	- if (procp == nfsd_master_proc &&
	+ if (procp == VNET(nfsd_master_proc) &&
	procp->p_stats->p_start.tv_sec ==
	nfsd_master_start.tv_sec &&
	procp->p_stats->p_start.tv_usec ==
	@@ -4152,7 +4190,7 @@
	strcmp(procp->p_comm, nfsd_master_comm) == 0)
	kern_psignal(procp, SIGUSR2);
	else
	- nfsd_master_proc = NULL;
	+ VNET(nfsd_master_proc) = NULL;

	if (procp != NULL)
	PROC_UNLOCK(procp);
	@@ -7079,24 +7117,13 @@
	if (loaded)
	goto out;
	newnfs_portinit();
	- for (i = 0; i < NFSRVCACHE_HASHSIZE; i++) {
	- mtx_init(&nfsrchash_table[i].mtx, "nfsrtc", NULL,
	- MTX_DEF);
	- mtx_init(&nfsrcahash_table[i].mtx, "nfsrtca", NULL,
	- MTX_DEF);
	- }
	mtx_init(&nfsrc_udpmtx, "nfsuc", NULL, MTX_DEF);
	mtx_init(&nfs_v4root_mutex, "nfs4rt", NULL, MTX_DEF);
	- mtx_init(&nfsv4root_mnt.mnt_mtx, "nfs4mnt", NULL, MTX_DEF);
	mtx_init(&nfsrv_dontlistlock_mtx, "nfs4dnl", NULL, MTX_DEF);
	mtx_init(&nfsrv_recalllock_mtx, "nfs4rec", NULL, MTX_DEF);
	- lockinit(&nfsv4root_mnt.mnt_explock, PVFS, "explock", 0, 0);
	callout_init(&nfsd_callout, 1);
	- nfsrvd_initcache();
	- nfsd_init();
	- NFSD_LOCK();
	- nfsrvd_init(0);
	- NFSD_UNLOCK();
	+ nfsstatsv1.srvcache_tcppeak = 0;
	+ nfsstatsv1.srvcache_size = 0;
	nfsd_mntinit();
	#ifdef VV_DISABLEDELEG
	vn_deleg_ops.vndeleg_recall = nfsd_recalldelegation;
	@@ -7126,30 +7153,30 @@
	nfsrvd_cleancache();

	/* Free up the krpc server pool. */
	- if (nfsrvd_pool != NULL)
	- svcpool_destroy(nfsrvd_pool);
	+ if (VNET(nfsrvd_pool) != NULL)
	+ svcpool_destroy(VNET(nfsrvd_pool));

	/* and get rid of the locks */
	for (i = 0; i < NFSRVCACHE_HASHSIZE; i++) {
	- mtx_destroy(&nfsrchash_table[i].mtx);
	- mtx_destroy(&nfsrcahash_table[i].mtx);
	+ mtx_destroy(&VNET(nfsrchash_table)[i].mtx);
	+ mtx_destroy(&VNET(nfsrcahash_table)[i].mtx);
	}
	mtx_destroy(&nfsrc_udpmtx);
	mtx_destroy(&nfs_v4root_mutex);
	- mtx_destroy(&nfsv4root_mnt.mnt_mtx);
	+ mtx_destroy(&VNET(nfsv4root_mnt).mnt_mtx);
	mtx_destroy(&nfsrv_dontlistlock_mtx);
	mtx_destroy(&nfsrv_recalllock_mtx);
	for (i = 0; i < nfsrv_sessionhashsize; i++)
	- mtx_destroy(&nfssessionhash[i].mtx);
	+ mtx_destroy(&VNET(nfssessionhash)[i].mtx);
	if (nfslayouthash != NULL) {
	for (i = 0; i < nfsrv_layouthashsize; i++)
	mtx_destroy(&nfslayouthash[i].mtx);
	free(nfslayouthash, M_NFSDSESSION);
	}
	- lockdestroy(&nfsv4root_mnt.mnt_explock);
	- free(nfsclienthash, M_NFSDCLIENT);
	- free(nfslockhash, M_NFSDLOCKFILE);
	- free(nfssessionhash, M_NFSDSESSION);
	+ lockdestroy(&VNET(nfsv4root_mnt).mnt_explock);
	+ free(VNET(nfsclienthash), M_NFSDCLIENT);
	+ free(VNET(nfslockhash), M_NFSDLOCKFILE);
	+ free(VNET(nfssessionhash), M_NFSDSESSION);
	loaded = 0;
	break;
	default:
	diff --git a/sys/fs/nfsserver/nfs_nfsdsocket.c.vnet b/sys/fs/nfsserver/nfs_nfsdsocket.c
	--- a/sys/fs/nfsserver/nfs_nfsdsocket.c.vnet
	+++ b/sys/fs/nfsserver/nfs_nfsdsocket.c
	@@ -43,19 +43,23 @@
	#include <fs/nfs/nfsport.h>

	extern struct nfsstatsv1 nfsstatsv1;
	-extern struct nfsrvfh nfs_pubfh, nfs_rootfh;
	-extern int nfs_pubfhset, nfs_rootfhset;
	+extern struct nfsrvfh nfs_pubfh;
	+extern int nfs_pubfhset;
	extern struct nfsv4lock nfsv4rootfs_lock;
	-extern struct nfsrv_stablefirst nfsrv_stablefirst;
	-extern struct nfsclienthashhead *nfsclienthash;
	extern int nfsrv_clienthashsize;
	-extern int nfsrc_floodlevel, nfsrc_tcpsavedreplies;
	extern int nfsd_debuglevel;
	extern int nfsrv_layouthighwater;
	extern volatile int nfsrv_layoutcnt;
	NFSV4ROOTLOCKMUTEX;
	NFSSTATESPINLOCK;

	+VNET_DECLARE(struct nfsrv_stablefirst, nfsrv_stablefirst);
	+VNET_DECLARE(struct nfsclienthashhead *, nfsclienthash);
	+VNET_DECLARE(int, nfsrc_floodlevel);
	+VNET_DECLARE(int, nfsrc_tcpsavedreplies);
	+VNET_DECLARE(struct nfsrvfh, nfs_rootfh);
	+VNET_DECLARE(int, nfs_rootfhset);
	+
	int (nfsrv3_procs0[NFS_V3NPROCS])(struct nfsrv_descript ,
	int, vnode_t , struct nfsexstuff *) = {
	(int ()(struct nfsrv_descript , int, vnode_t , struct nfsexstuff *))0,
	@@ -753,7 +757,7 @@
	*/
	igotlock = 0;
	NFSLOCKV4ROOTMUTEX();
	- if (nfsrv_stablefirst.nsf_flags & NFSNSF_NEEDLOCK)
	+ if (VNET(nfsrv_stablefirst).nsf_flags & NFSNSF_NEEDLOCK)
	igotlock = nfsv4_lock(&nfsv4rootfs_lock, 1, NULL,
	NFSV4ROOTLOCKMUTEXPTR, NULL);
	else
	@@ -766,8 +770,8 @@
	* Done when the grace period is over or a client has long
	* since expired.
	*/
	- nfsrv_stablefirst.nsf_flags &= ~NFSNSF_NEEDLOCK;
	- if ((nfsrv_stablefirst.nsf_flags &
	+ VNET(nfsrv_stablefirst).nsf_flags &= ~NFSNSF_NEEDLOCK;
	+ if ((VNET(nfsrv_stablefirst).nsf_flags &
	(NFSNSF_GRACEOVER \| NFSNSF_UPDATEDONE)) == NFSNSF_GRACEOVER)
	nfsrv_updatestable(p);

	@@ -777,10 +781,10 @@
	* stable storage file and then remove them from the client
	* list.
	*/
	- if (nfsrv_stablefirst.nsf_flags & NFSNSF_EXPIREDCLIENT) {
	- nfsrv_stablefirst.nsf_flags &= ~NFSNSF_EXPIREDCLIENT;
	+ if (VNET(nfsrv_stablefirst).nsf_flags & NFSNSF_EXPIREDCLIENT) {
	+ VNET(nfsrv_stablefirst).nsf_flags &= ~NFSNSF_EXPIREDCLIENT;
	for (i = 0; i < nfsrv_clienthashsize; i++) {
	- LIST_FOREACH_SAFE(clp, &nfsclienthash[i], lc_hash,
	+ LIST_FOREACH_SAFE(clp, &VNET(nfsclienthash)[i], lc_hash,
	nclp) {
	if (clp->lc_flags & LCL_EXPIREIT) {
	if (!LIST_EMPTY(&clp->lc_open) \|\|
	@@ -814,7 +818,7 @@
	* If flagged, search for open owners that haven't had any opens
	* for a long time.
	*/
	- if (nfsrv_stablefirst.nsf_flags & NFSNSF_NOOPENS) {
	+ if (VNET(nfsrv_stablefirst).nsf_flags & NFSNSF_NOOPENS) {
	nfsrv_throwawayopens(p);
	}

	@@ -941,8 +945,8 @@
	if (i == 0 && (nd->nd_rp == NULL \|\|
	nd->nd_rp->rc_refcnt == 0) &&
	(nfsrv_mallocmget_limit() \|\|
	- nfsrc_tcpsavedreplies > nfsrc_floodlevel)) {
	- if (nfsrc_tcpsavedreplies > nfsrc_floodlevel)
	+ VNET(nfsrc_tcpsavedreplies) > VNET(nfsrc_floodlevel))) {
	+ if (VNET(nfsrc_tcpsavedreplies) > VNET(nfsrc_floodlevel))
	printf("nfsd server cache flooded, try "
	"increasing vfs.nfsd.tcphighwater\n");
	nd->nd_repstat = NFSERR_RESOURCE;
	@@ -1033,7 +1037,7 @@
	}
	break;
	case NFSV4OP_PUTROOTFH:
	- if (nfs_rootfhset) {
	+ if (VNET(nfs_rootfhset)) {
	if ((nd->nd_flag & ND_LASTOP) == 0) {
	/*
	* Pre-parse the next op#. If it is
	@@ -1054,7 +1058,7 @@
	} while (nextop == NFSV4OP_SAVEFH &&
	i < numops - 1);
	}
	- nfsd_fhtovp(nd, &nfs_rootfh, LK_SHARED, &nvp,
	+ nfsd_fhtovp(nd, &VNET(nfs_rootfh), LK_SHARED, &nvp,
	&nes, NULL, 0, nextop);
	if (!nd->nd_repstat) {
	if (vp)
	diff --git a/sys/fs/nfsserver/nfs_nfsdstate.c.vnetdcl b/sys/fs/nfsserver/nfs_nfsdstate.c
	--- a/sys/fs/nfsserver/nfs_nfsdstate.c.vnetdcl
	+++ b/sys/fs/nfsserver/nfs_nfsdstate.c
	@@ -35,16 +35,19 @@
	#include <sys/extattr.h>
	#include <fs/nfs/nfsport.h>

	-struct nfsrv_stablefirst nfsrv_stablefirst;
	int nfsrv_issuedelegs = 0;
	int nfsrv_dolocallocks = 0;
	struct nfsv4lock nfsv4rootfs_lock;
	time_t nfsdev_time = 0;
	int nfsrv_layouthashsize;
	volatile int nfsrv_layoutcnt = 0;
	-extern uint32_t nfs_srvmaxio;

	-extern int newnfs_numnfsd;
	+VNET_DEFINE(struct nfsrv_stablefirst, nfsrv_stablefirst);
	+
	+VNET_DECLARE(int, nfsrv_numnfsd);
	+VNET_DECLARE(struct nfsdontlisthead, nfsrv_dontlisthead);
	+
	+extern uint32_t nfs_srvmaxio;
	extern struct nfsstatsv1 nfsstatsv1;
	extern int nfsrv_lease;
	extern struct timeval nfsboottime;
	@@ -59,7 +62,6 @@
	extern int nfsrv_maxpnfsmirror;
	NFSV4ROOTLOCKMUTEX;
	NFSSTATESPINLOCK;
	-extern struct nfsdontlisthead nfsrv_dontlisthead;
	extern volatile int nfsrv_devidcnt;
	extern struct nfslayouthead nfsrv_recalllisthead;
	extern char *nfsrv_zeropnfsdat;
	@@ -118,11 +120,12 @@
	/*
	* Hash lists for nfs V4.
	*/
	-struct nfsclienthashhead *nfsclienthash;
	-struct nfslockhashhead *nfslockhash;
	-struct nfssessionhash *nfssessionhash;
	+VNET_DEFINE(struct nfsclienthashhead *, nfsclienthash);
	+VNET_DEFINE(struct nfslockhashhead *, nfslockhash);
	+VNET_DEFINE(struct nfssessionhash *, nfssessionhash);
	+VNET_DEFINE(volatile int, nfsrv_dontlistlen) = 0;
	+
	struct nfslayouthash *nfslayouthash;
	-volatile int nfsrv_dontlistlen = 0;

	static u_int32_t nfsrv_openpluslock = 0, nfsrv_delegatecnt = 0;
	static time_t nfsrvboottime;
	@@ -298,7 +301,7 @@
	*/
	gotit = i = 0;
	while (i < nfsrv_clienthashsize && !gotit) {
	- LIST_FOREACH(clp, &nfsclienthash[i], lc_hash) {
	+ LIST_FOREACH(clp, &VNET(nfsclienthash)[i], lc_hash) {
	if (new_clp->lc_idlen == clp->lc_idlen &&
	!NFSBCMP(new_clp->lc_id, clp->lc_id, clp->lc_idlen)) {
	gotit = 1;
	@@ -912,7 +915,7 @@
	*/
	gotit = i = 0;
	while (i < nfsrv_clienthashsize && !gotit) {
	- LIST_FOREACH(clp, &nfsclienthash[i], lc_hash) {
	+ LIST_FOREACH(clp, &VNET(nfsclienthash)[i], lc_hash) {
	if (revokep->nclid_idlen == clp->lc_idlen &&
	!NFSBCMP(revokep->nclid_id, clp->lc_id, clp->lc_idlen)) {
	gotit = 1;
	@@ -974,8 +977,8 @@
	* Rattle through the client lists until done.
	*/
	while (i < nfsrv_clienthashsize && cnt < maxcnt) {
	- clp = LIST_FIRST(&nfsclienthash[i]);
	- while (clp != LIST_END(&nfsclienthash[i]) && cnt < maxcnt) {
	+ clp = LIST_FIRST(&VNET(nfsclienthash)[i]);
	+ while (clp != LIST_END(&VNET(nfsclienthash)[i]) && cnt < maxcnt) {
	nfsrv_dumpaclient(clp, &dumpp[cnt]);
	cnt++;
	clp = LIST_NEXT(clp, lc_hash);
	@@ -1251,14 +1254,14 @@
	* If server hasn't started yet, just return.
	*/
	NFSLOCKSTATE();
	- if (nfsrv_stablefirst.nsf_eograce == 0) {
	+ if (VNET(nfsrv_stablefirst).nsf_eograce == 0) {
	NFSUNLOCKSTATE();
	return;
	}
	- if (!(nfsrv_stablefirst.nsf_flags & NFSNSF_UPDATEDONE)) {
	- if (!(nfsrv_stablefirst.nsf_flags & NFSNSF_GRACEOVER) &&
	- NFSD_MONOSEC > nfsrv_stablefirst.nsf_eograce)
	- nfsrv_stablefirst.nsf_flags \|=
	+ if (!(VNET(nfsrv_stablefirst).nsf_flags & NFSNSF_UPDATEDONE)) {
	+ if (!(VNET(nfsrv_stablefirst).nsf_flags & NFSNSF_GRACEOVER) &&
	+ NFSD_MONOSEC > VNET(nfsrv_stablefirst).nsf_eograce)
	+ VNET(nfsrv_stablefirst).nsf_flags \|=
	(NFSNSF_GRACEOVER \| NFSNSF_NEEDLOCK);
	NFSUNLOCKSTATE();
	return;
	@@ -1281,8 +1284,8 @@
	* For each client...
	*/
	for (i = 0; i < nfsrv_clienthashsize; i++) {
	- clp = LIST_FIRST(&nfsclienthash[i]);
	- while (clp != LIST_END(&nfsclienthash[i])) {
	+ clp = LIST_FIRST(&VNET(nfsclienthash)[i]);
	+ while (clp != LIST_END(&VNET(nfsclienthash)[i])) {
	nclp = LIST_NEXT(clp, lc_hash);
	if (!(clp->lc_flags & LCL_EXPIREIT)) {
	if (((clp->lc_expiry + NFSRV_STALELEASE) < NFSD_MONOSEC
	@@ -1313,7 +1316,7 @@
	* by an nfsd sometime soon.
	*/
	clp->lc_flags \|= LCL_EXPIREIT;
	- nfsrv_stablefirst.nsf_flags \|=
	+ VNET(nfsrv_stablefirst).nsf_flags \|=
	(NFSNSF_NEEDLOCK \| NFSNSF_EXPIREDCLIENT);
	} else {
	/*
	@@ -1331,7 +1334,7 @@
	if (stp->ls_noopens > NFSNOOPEN \|\|
	(nfsrv_openpluslock * 2) >
	nfsrv_v4statelimit)
	- nfsrv_stablefirst.nsf_flags \|=
	+ VNET(nfsrv_stablefirst).nsf_flags \|=
	NFSNSF_NOOPENS;
	} else {
	stp->ls_noopens = 0;
	@@ -4394,25 +4397,25 @@
	int error = 0, notreclaimed;
	struct nfsrv_stable *sp;

	- if ((nfsrv_stablefirst.nsf_flags & (NFSNSF_UPDATEDONE \|
	+ if ((VNET(nfsrv_stablefirst).nsf_flags & (NFSNSF_UPDATEDONE \|
	NFSNSF_GRACEOVER)) == 0) {
	/*
	* First, check to see if all of the clients have done a
	* ReclaimComplete. If so, grace can end now.
	*/
	notreclaimed = 0;
	- LIST_FOREACH(sp, &nfsrv_stablefirst.nsf_head, nst_list) {
	+ LIST_FOREACH(sp, &VNET(nfsrv_stablefirst).nsf_head, nst_list) {
	if ((sp->nst_flag & NFSNST_RECLAIMED) == 0) {
	notreclaimed = 1;
	break;
	}
	}
	if (notreclaimed == 0)
	- nfsrv_stablefirst.nsf_flags \|= (NFSNSF_GRACEOVER \|
	+ VNET(nfsrv_stablefirst).nsf_flags \|= (NFSNSF_GRACEOVER \|
	NFSNSF_NEEDLOCK);
	}

	- if ((nfsrv_stablefirst.nsf_flags & NFSNSF_GRACEOVER) != 0) {
	+ if ((VNET(nfsrv_stablefirst).nsf_flags & NFSNSF_GRACEOVER) != 0) {
	if (flags & NFSLCK_RECLAIM) {
	error = NFSERR_NOGRACE;
	goto out;
	@@ -4434,8 +4437,8 @@
	* extend grace a bit.
	*/
	if ((NFSD_MONOSEC + NFSRV_LEASEDELTA) >
	- nfsrv_stablefirst.nsf_eograce)
	- nfsrv_stablefirst.nsf_eograce = NFSD_MONOSEC +
	+ VNET(nfsrv_stablefirst).nsf_eograce)
	+ VNET(nfsrv_stablefirst).nsf_eograce = NFSD_MONOSEC +
	NFSRV_LEASEDELTA;
	}

	@@ -4870,7 +4873,7 @@
	void
	nfsrv_setupstable(NFSPROC_T *p)
	{
	- struct nfsrv_stablefirst *sf = &nfsrv_stablefirst;
	+ struct nfsrv_stablefirst *sf = &VNET(nfsrv_stablefirst);
	struct nfsrv_stable sp, nsp;
	struct nfst_rec *tsp;
	int error, i, tryagain;
	@@ -5005,7 +5008,7 @@
	void
	nfsrv_updatestable(NFSPROC_T *p)
	{
	- struct nfsrv_stablefirst *sf = &nfsrv_stablefirst;
	+ struct nfsrv_stablefirst *sf = &VNET(nfsrv_stablefirst);
	struct nfsrv_stable sp, nsp;
	int i;
	struct nfsvattr nva;
	@@ -5088,7 +5091,7 @@
	void
	nfsrv_writestable(u_char client, int len, int flag, NFSPROC_T p)
	{
	- struct nfsrv_stablefirst *sf = &nfsrv_stablefirst;
	+ struct nfsrv_stablefirst *sf = &VNET(nfsrv_stablefirst);
	struct nfst_rec *sp;
	int error;

	@@ -5121,12 +5124,12 @@
	/*
	* First find the client structure.
	*/
	- LIST_FOREACH(sp, &nfsrv_stablefirst.nsf_head, nst_list) {
	+ LIST_FOREACH(sp, &VNET(nfsrv_stablefirst).nsf_head, nst_list) {
	if (sp->nst_len == clp->lc_idlen &&
	!NFSBCMP(sp->nst_client, clp->lc_id, sp->nst_len))
	break;
	}
	- if (sp == LIST_END(&nfsrv_stablefirst.nsf_head))
	+ if (sp == LIST_END(&VNET(nfsrv_stablefirst).nsf_head))
	return;

	/*
	@@ -5148,12 +5151,12 @@
	/*
	* First find the client structure.
	*/
	- LIST_FOREACH(sp, &nfsrv_stablefirst.nsf_head, nst_list) {
	+ LIST_FOREACH(sp, &VNET(nfsrv_stablefirst).nsf_head, nst_list) {
	if (sp->nst_len == clp->lc_idlen &&
	!NFSBCMP(sp->nst_client, clp->lc_id, sp->nst_len))
	break;
	}
	- if (sp == LIST_END(&nfsrv_stablefirst.nsf_head))
	+ if (sp == LIST_END(&VNET(nfsrv_stablefirst).nsf_head))
	return;

	/*
	@@ -5174,7 +5177,7 @@
	/*
	* First, find the entry for the client.
	*/
	- LIST_FOREACH(sp, &nfsrv_stablefirst.nsf_head, nst_list) {
	+ LIST_FOREACH(sp, &VNET(nfsrv_stablefirst).nsf_head, nst_list) {
	if (sp->nst_len == clp->lc_idlen &&
	!NFSBCMP(sp->nst_client, clp->lc_id, sp->nst_len))
	break;
	@@ -5184,9 +5187,9 @@
	* If not in the list, state was revoked or no state was issued
	* since the previous reboot, a reclaim is denied.
	*/
	- if (sp == LIST_END(&nfsrv_stablefirst.nsf_head) \|\|
	+ if (sp == LIST_END(&VNET(nfsrv_stablefirst).nsf_head) \|\|
	(sp->nst_flag & NFSNST_REVOKE) \|\|
	- !(nfsrv_stablefirst.nsf_flags & NFSNSF_OK))
	+ !(VNET(nfsrv_stablefirst).nsf_flags & NFSNSF_OK))
	return (1);
	return (0);
	}
	@@ -5214,7 +5217,7 @@
	* If lease hasn't expired, we can't fix it.
	*/
	if (clp->lc_expiry >= NFSD_MONOSEC \|\|
	- !(nfsrv_stablefirst.nsf_flags & NFSNSF_UPDATEDONE))
	+ !(VNET(nfsrv_stablefirst).nsf_flags & NFSNSF_UPDATEDONE))
	return (0);
	if (*haslockp == 0) {
	NFSUNLOCKSTATE();
	@@ -5613,7 +5616,7 @@
	* First, check to see if the server is currently running and it has
	* been called for a regular file when issuing delegations.
	*/
	- if (newnfs_numnfsd == 0 \|\| vp->v_type != VREG \|\|
	+ if (VNET(nfsrv_numnfsd) == 0 \|\| vp->v_type != VREG \|\|
	nfsrv_issuedelegs == 0)
	return;

	@@ -5847,12 +5850,12 @@
	int i;

	NFSLOCKSTATE();
	- nfsrv_stablefirst.nsf_flags &= ~NFSNSF_NOOPENS;
	+ VNET(nfsrv_stablefirst).nsf_flags &= ~NFSNSF_NOOPENS;
	/*
	* For each client...
	*/
	for (i = 0; i < nfsrv_clienthashsize; i++) {
	- LIST_FOREACH_SAFE(clp, &nfsclienthash[i], lc_hash, nclp) {
	+ LIST_FOREACH_SAFE(clp, &VNET(nfsclienthash)[i], lc_hash, nclp) {
	LIST_FOREACH_SAFE(stp, &clp->lc_open, ls_list, nstp) {
	if (LIST_EMPTY(&stp->ls_open) &&
	(stp->ls_noopens > NFSNOOPEN \|\|
	@@ -5908,7 +5911,7 @@
	nfsrv_leaseexpiry(void)
	{

	- if (nfsrv_stablefirst.nsf_eograce > NFSD_MONOSEC)
	+ if (VNET(nfsrv_stablefirst).nsf_eograce > NFSD_MONOSEC)
	return (NFSD_MONOSEC + 2 * (nfsrv_lease + NFSRV_LEASEDELTA));
	return (NFSD_MONOSEC + nfsrv_lease + NFSRV_LEASEDELTA);
	}
	@@ -6229,7 +6232,7 @@
	* For each client, clean out the state and then free the structure.
	*/
	for (i = 0; i < nfsrv_clienthashsize; i++) {
	- LIST_FOREACH_SAFE(clp, &nfsclienthash[i], lc_hash, nclp) {
	+ LIST_FOREACH_SAFE(clp, &VNET(nfsclienthash)[i], lc_hash, nclp) {
	nfsrv_cleanclient(clp, p);
	nfsrv_freedeleglist(&clp->lc_deleg);
	nfsrv_freedeleglist(&clp->lc_olddeleg);
	@@ -6242,7 +6245,7 @@
	* Also, free up any remaining lock file structures.
	*/
	for (i = 0; i < nfsrv_lockhashsize; i++) {
	- LIST_FOREACH_SAFE(lfp, &nfslockhash[i], lf_hash, nlfp) {
	+ LIST_FOREACH_SAFE(lfp, &VNET(nfslockhash)[i], lf_hash, nlfp) {
	printf("nfsd unload: fnd a lock file struct\n");
	nfsrv_freenfslockfile(lfp);
	}
	@@ -6360,7 +6363,7 @@
	sep = nfsrv_findsession(nd->nd_sessionid);
	if (sep == NULL) {
	NFSUNLOCKSESSION(shp);
	- if ((nfsrv_stablefirst.nsf_flags & NFSNSF_GRACEOVER) != 0) {
	+ if ((VNET(nfsrv_stablefirst).nsf_flags & NFSNSF_GRACEOVER) != 0) {
	buf = malloc(INET6_ADDRSTRLEN, M_TEMP, M_WAITOK);
	switch (nd->nd_nam->sa_family) {
	#ifdef INET
	@@ -6722,7 +6725,7 @@
	int i;

	for (i = 0; i < nfsrv_clienthashsize; i++) {
	- LIST_FOREACH(clp, &nfsclienthash[i], lc_hash) {
	+ LIST_FOREACH(clp, &VNET(nfsclienthash)[i], lc_hash) {
	LIST_FOREACH(sep, &clp->lc_session, sess_list) {
	xprt = sep->sess_cbsess.nfsess_xprt;
	sep->sess_cbsess.nfsess_xprt = NULL;
	@@ -7586,10 +7589,10 @@
	nfsrv_freealllayouts();

	/* Get rid of any nfsdontlist entries. */
	- LIST_FOREACH_SAFE(mrp, &nfsrv_dontlisthead, nfsmr_list, nmrp)
	+ LIST_FOREACH_SAFE(mrp, &VNET(nfsrv_dontlisthead), nfsmr_list, nmrp)
	free(mrp, M_NFSDSTATE);
	- LIST_INIT(&nfsrv_dontlisthead);
	- nfsrv_dontlistlen = 0;
	+ LIST_INIT(&VNET(nfsrv_dontlisthead));
	+ VNET(nfsrv_dontlistlen) = 0;

	/* Free layouts in the recall list. */
	TAILQ_FOREACH_SAFE(lyp, &nfsrv_recalllisthead, lay_list, nlyp)
	@@ -8229,11 +8232,11 @@
	struct nfsdontlist *mrp;
	int ret;

	- if (nfsrv_dontlistlen == 0)
	+ if (VNET(nfsrv_dontlistlen) == 0)
	return (0);
	ret = 0;
	NFSDDONTLISTLOCK();
	- LIST_FOREACH(mrp, &nfsrv_dontlisthead, nfsmr_list) {
	+ LIST_FOREACH(mrp, &VNET(nfsrv_dontlisthead), nfsmr_list) {
	if (NFSBCMP(fhp, &mrp->nfsmr_fh, sizeof(*fhp)) == 0 &&
	(mrp->nfsmr_flags & NFSMR_DONTLAYOUT) != 0) {
	ret = 1;
	@@ -8307,15 +8310,15 @@
	nmrp->nfsmr_flags = NFSMR_DONTLAYOUT;
	NFSBCOPY(&fh, &nmrp->nfsmr_fh, sizeof(fh));
	NFSDDONTLISTLOCK();
	- LIST_FOREACH(mrp, &nfsrv_dontlisthead, nfsmr_list) {
	+ LIST_FOREACH(mrp, &VNET(nfsrv_dontlisthead), nfsmr_list) {
	if (NFSBCMP(&fh, &mrp->nfsmr_fh, sizeof(fh)) == 0)
	break;
	}
	if (mrp == NULL) {
	- LIST_INSERT_HEAD(&nfsrv_dontlisthead, nmrp, nfsmr_list);
	+ LIST_INSERT_HEAD(&VNET(nfsrv_dontlisthead), nmrp, nfsmr_list);
	mrp = nmrp;
	nmrp = NULL;
	- nfsrv_dontlistlen++;
	+ VNET(nfsrv_dontlistlen)++;
	NFSD_DEBUG(4, "nfsrv_copymr: in dontlist\n");
	} else {
	NFSDDONTLISTUNLOCK();
	diff --git a/sys/fs/nfsserver/nfs_nfsdsubs.c.vnetdcl b/sys/fs/nfsserver/nfs_nfsdsubs.c
	--- a/sys/fs/nfsserver/nfs_nfsdsubs.c.vnetdcl
	+++ b/sys/fs/nfsserver/nfs_nfsdsubs.c
	@@ -44,20 +44,23 @@
	#include <fs/nfs/nfsport.h>

	extern u_int32_t newnfs_true, newnfs_false;
	-extern int nfs_rootfhset;
	extern int nfs_pubfhset;
	-extern struct nfsclienthashhead *nfsclienthash;
	extern int nfsrv_clienthashsize;
	-extern struct nfslockhashhead *nfslockhash;
	extern int nfsrv_lockhashsize;
	-extern struct nfssessionhash *nfssessionhash;
	extern int nfsrv_sessionhashsize;
	extern int nfsrv_useacl;
	extern uid_t nfsrv_defaultuid;
	extern gid_t nfsrv_defaultgid;

	+VNET_DECLARE(struct nfsclienthashhead *, nfsclienthash);
	+VNET_DECLARE(struct nfslockhashhead *, nfslockhash);
	+VNET_DECLARE(struct nfssessionhash *, nfssessionhash);
	+VNET_DECLARE(int, nfs_rootfhset);
	+
	+VNET_DEFINE(struct nfsdontlisthead, nfsrv_dontlisthead);
	+
	+
	char nfs_v2pubfh[NFSX_V2FH];
	-struct nfsdontlisthead nfsrv_dontlisthead;
	struct nfslayouthead nfsrv_recalllisthead;
	static nfstype newnfsv2_type[9] = { NFNON, NFREG, NFDIR, NFBLK, NFCHR, NFLNK,
	NFNON, NFCHR, NFNON };
	@@ -2080,31 +2083,27 @@
	nfsd_init(void)
	{
	int i;
	- static int inited = 0;

	- if (inited)
	- return;
	- inited = 1;

	/*
	* Initialize client queues. Don't free/reinitialize
	* them when nfsds are restarted.
	*/
	- nfsclienthash = malloc(sizeof(struct nfsclienthashhead) *
	+ VNET(nfsclienthash) = malloc(sizeof(struct nfsclienthashhead) *
	nfsrv_clienthashsize, M_NFSDCLIENT, M_WAITOK \| M_ZERO);
	for (i = 0; i < nfsrv_clienthashsize; i++)
	- LIST_INIT(&nfsclienthash[i]);
	- nfslockhash = malloc(sizeof(struct nfslockhashhead) *
	+ LIST_INIT(&VNET(nfsclienthash)[i]);
	+ VNET(nfslockhash) = malloc(sizeof(struct nfslockhashhead) *
	nfsrv_lockhashsize, M_NFSDLOCKFILE, M_WAITOK \| M_ZERO);
	for (i = 0; i < nfsrv_lockhashsize; i++)
	- LIST_INIT(&nfslockhash[i]);
	- nfssessionhash = malloc(sizeof(struct nfssessionhash) *
	+ LIST_INIT(&VNET(nfslockhash)[i]);
	+ VNET(nfssessionhash) = malloc(sizeof(struct nfssessionhash) *
	nfsrv_sessionhashsize, M_NFSDSESSION, M_WAITOK \| M_ZERO);
	for (i = 0; i < nfsrv_sessionhashsize; i++) {
	- mtx_init(&nfssessionhash[i].mtx, "nfssm", NULL, MTX_DEF);
	- LIST_INIT(&nfssessionhash[i].list);
	+ mtx_init(&VNET(nfssessionhash)[i].mtx, "nfssm", NULL, MTX_DEF);
	+ LIST_INIT(&VNET(nfssessionhash)[i].list);
	}
	- LIST_INIT(&nfsrv_dontlisthead);
	+ LIST_INIT(&VNET(nfsrv_dontlisthead));
	TAILQ_INIT(&nfsrv_recalllisthead);

	/* and the v2 pubfh should be all zeros */
	@@ -2119,7 +2118,7 @@
	nfsd_checkrootexp(struct nfsrv_descript *nd)
	{

	- if (nfs_rootfhset == 0)
	+ if (VNET(nfs_rootfhset) == 0)
	return (NFSERR_AUTHERR \| AUTH_FAILED);
	if ((nd->nd_flag & (ND_GSS \| ND_EXAUTHSYS)) == ND_EXAUTHSYS)
	goto checktls;
	diff --git a/sys/kern/kern_jail.c.vnet b/sys/kern/kern_jail.c
	--- a/sys/kern/kern_jail.c.vnet
	+++ b/sys/kern/kern_jail.c
	@@ -218,6 +218,7 @@
	{"allow.unprivileged_proc_debug", "allow.nounprivileged_proc_debug",
	PR_ALLOW_UNPRIV_DEBUG},
	{"allow.suser", "allow.nosuser", PR_ALLOW_SUSER},
	+ {"allow.nfsd", "allow.nonfsd", PR_ALLOW_NFSD},
	};
	static unsigned pr_allow_all = PR_ALLOW_ALL_STATIC;
	const size_t pr_flag_allow_size = sizeof(pr_flag_allow);
	@@ -3717,11 +3718,14 @@
	* is only granted conditionally in the legacy jail case.
	*/
	switch (priv) {
	-#ifdef notyet
	/*
	* NFS-specific privileges.
	*/
	case PRIV_NFS_DAEMON:
	+ case PRIV_NFSD_VIMAGE:
	+ if ((cred->cr_prison->pr_allow & PR_ALLOW_NFSD) == 0)
	+ return (EPERM);
	+#ifdef notyet
	case PRIV_NFS_LOCKD:
	#endif
	/*
	@@ -4472,6 +4476,8 @@
	"B", "Unprivileged processes may use process debugging facilities");
	SYSCTL_JAIL_PARAM(_allow, suser, CTLTYPE_INT \| CTLFLAG_RW,
	"B", "Processes in jail with uid 0 have privilege");
	+SYSCTL_JAIL_PARAM(_allow, nfsd, CTLTYPE_INT \| CTLFLAG_RW,
	+ "B", "mountd/nfsd may run in the jail");

	SYSCTL_JAIL_PARAM_SUBNODE(allow, mount, "Jail mount/unmount permission flags");
	SYSCTL_JAIL_PARAM(_allow_mount, , CTLTYPE_INT \| CTLFLAG_RW,
	diff --git a/sys/kern/vfs_mount.c.vnetmnt b/sys/kern/vfs_mount.c
	--- a/sys/kern/vfs_mount.c.vnetmnt
	+++ b/sys/kern/vfs_mount.c
	@@ -924,7 +924,14 @@
	fsflags \|= MNT_SYNCHRONOUS;
	else if (strcmp(opt->name, "union") == 0)
	fsflags \|= MNT_UNION;
	- else if (strcmp(opt->name, "automounted") == 0) {
	+ else if (strcmp(opt->name, "export") == 0) {
	+ /*
	+ * Set MNT_EXPORTED for the specific case of a
	+ * vnet jailed call with the "export" option,
	+ * so that mountd can run within that jail.
	+ */
	+ fsflags \|= MNT_EXPORTED;
	+ } else if (strcmp(opt->name, "automounted") == 0) {
	fsflags \|= MNT_AUTOMOUNTED;
	do_freeopt = 1;
	} else if (strcmp(opt->name, "nocover") == 0) {
	@@ -1285,7 +1292,16 @@
	* Only privileged root, or (if MNT_USER is set) the user that
	* did the original mount is permitted to update it.
	*/
	- error = vfs_suser(mp, td);
	+ if (jailed(td->td_ucred) && !jailed_without_vnet(td->td_ucred) &&
	+ (td->td_ucred->cr_prison->pr_root->v_vflag & VV_ROOT) != 0 &&
	+ (fsflags & MNT_EXPORTED) != 0) {
	+ error = 0;
	+ if (!(mp->mnt_vfc->vfc_flags & VFCF_DELEGADMIN) &&
	+ mp->mnt_cred->cr_uid != td->td_ucred->cr_uid)
	+ error = priv_check(td, PRIV_VFS_MOUNT_OWNER);
	+ } else {
	+ error = vfs_suser(mp, td);
	+ }
	if (error != 0) {
	vput(vp);
	return (error);
	@@ -1330,7 +1346,11 @@
	* XXX The final recipients of VFS_MOUNT just overwrite the ndp they
	* get. No freeing of cn_pnbuf.
	*/
	- error = VFS_MOUNT(mp);
	+ error = 0;
	+ if ((fsflags & MNT_EXPORTED) == 0 \|\|
	+ !jailed(td->td_ucred) \|\| jailed_without_vnet(td->td_ucred) \|\|
	+ (td->td_ucred->cr_prison->pr_root->v_vflag & VV_ROOT) == 0)
	+ error = VFS_MOUNT(mp);

	export_error = 0;
	/* Process the export option. */
	@@ -1485,18 +1505,29 @@
	if (strlen(fstype) >= MFSNAMELEN \|\| strlen(fspath) >= MNAMELEN)
	return (ENAMETOOLONG);

	- if (jailed(td->td_ucred) \|\| usermount == 0) {
	- if ((error = priv_check(td, PRIV_VFS_MOUNT)) != 0)
	- return (error);
	- }
	-
	/*
	* Do not allow NFS export or MNT_SUIDDIR by unprivileged users.
	*/
	- if (fsflags & MNT_EXPORTED) {
	- error = priv_check(td, PRIV_VFS_MOUNT_EXPORTED);
	+ if (jailed(td->td_ucred) && !jailed_without_vnet(td->td_ucred) &&
	+ (td->td_ucred->cr_prison->pr_root->v_vflag & VV_ROOT) != 0 &&
	+ (fsflags & MNT_EXPORTED) != 0) {
	+ error = priv_check(td, PRIV_NFSD_VIMAGE);
	+printf("priv_nfsd_vimage=%d\n", error);
	if (error)
	return (error);
	+ } else {
	+ if (jailed(td->td_ucred) \|\| usermount == 0) {
	+ if ((error = priv_check(td, PRIV_VFS_MOUNT)) != 0)
	+ return (error);
	+ }
	+
	+#ifdef notnow
	+ if (fsflags & MNT_EXPORTED) {
	+ error = priv_check(td, PRIV_VFS_MOUNT_EXPORTED);
	+ if (error)
	+ return (error);
	+ }
	+#endif
	}
	if (fsflags & MNT_SUIDDIR) {
	error = priv_check(td, PRIV_VFS_MOUNT_SUIDDIR);
	diff --git a/sys/nfs/nfs_nfssvc.c.vnet b/sys/nfs/nfs_nfssvc.c
	--- a/sys/nfs/nfs_nfssvc.c.vnet
	+++ b/sys/nfs/nfs_nfssvc.c
	@@ -43,6 +43,7 @@
	#include <sys/sysproto.h>
	#include <sys/kernel.h>
	#include <sys/sysctl.h>
	+#include <sys/jail.h>
	#include <sys/priv.h>
	#include <sys/proc.h>
	#include <sys/lock.h>
	@@ -52,6 +53,8 @@
	#include <sys/syscall.h>
	#include <sys/sysproto.h>

	+#include <net/vnet.h>
	+
	#include <security/audit/audit.h>

	#include <nfs/nfssvc.h>
	@@ -90,6 +93,9 @@
	if (error != 0)
	return (error);
	}
	+
	+ CURVNET_SET(TD_TO_VNET(td));
	+
	error = EINVAL;
	if ((uap->flag & (NFSSVC_ADDSOCK \| NFSSVC_OLDNFSD \| NFSSVC_NFSD)) &&
	nfsd_call_nfsserver != NULL)
	@@ -111,6 +117,7 @@
	error = (*nfsd_call_nfsd)(td, uap);
	if (error == EINTR \|\| error == ERESTART)
	error = 0;
	+ CURVNET_RESTORE();
	return (error);
	}

	diff --git a/sys/rpc/rpcsec_gss/svc_rpcsec_gss.c.vnet b/sys/rpc/rpcsec_gss/svc_rpcsec_gss.c
	--- a/sys/rpc/rpcsec_gss/svc_rpcsec_gss.c.vnet
	+++ b/sys/rpc/rpcsec_gss/svc_rpcsec_gss.c
	@@ -478,7 +478,7 @@
	cr->cr_uid = cr->cr_ruid = cr->cr_svuid = uc->uid;
	cr->cr_rgid = cr->cr_svgid = uc->gid;
	crsetgroups(cr, uc->gidlen, uc->gidlist);
	- cr->cr_prison = &prison0;
	+ cr->cr_prison = curthread->td_ucred->cr_prison;
	prison_hold(cr->cr_prison);
	*crp = crhold(cr);

	diff --git a/sys/rpc/svc.c.vnetdcl b/sys/rpc/svc.c
	--- a/sys/rpc/svc.c.vnetdcl
	+++ b/sys/rpc/svc.c
	@@ -125,53 +125,55 @@
	pool->sp_space_high = (u_long)nmbclusters * MCLBYTES / 4;
	pool->sp_space_low = (pool->sp_space_high / 3) * 2;

	- sysctl_ctx_init(&pool->sp_sysctl);
	- if (sysctl_base) {
	- SYSCTL_ADD_PROC(&pool->sp_sysctl, sysctl_base, OID_AUTO,
	- "minthreads", CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_MPSAFE,
	- pool, 0, svcpool_minthread_sysctl, "I",
	- "Minimal number of threads");
	- SYSCTL_ADD_PROC(&pool->sp_sysctl, sysctl_base, OID_AUTO,
	- "maxthreads", CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_MPSAFE,
	- pool, 0, svcpool_maxthread_sysctl, "I",
	- "Maximal number of threads");
	- SYSCTL_ADD_PROC(&pool->sp_sysctl, sysctl_base, OID_AUTO,
	- "threads", CTLTYPE_INT \| CTLFLAG_RD \| CTLFLAG_MPSAFE,
	- pool, 0, svcpool_threads_sysctl, "I",
	- "Current number of threads");
	- SYSCTL_ADD_INT(&pool->sp_sysctl, sysctl_base, OID_AUTO,
	- "groups", CTLFLAG_RD, &pool->sp_groupcount, 0,
	- "Number of thread groups");
	-
	- SYSCTL_ADD_ULONG(&pool->sp_sysctl, sysctl_base, OID_AUTO,
	- "request_space_used", CTLFLAG_RD,
	- &pool->sp_space_used,
	- "Space in parsed but not handled requests.");
	-
	- SYSCTL_ADD_ULONG(&pool->sp_sysctl, sysctl_base, OID_AUTO,
	- "request_space_used_highest", CTLFLAG_RD,
	- &pool->sp_space_used_highest,
	- "Highest space used since reboot.");
	-
	- SYSCTL_ADD_ULONG(&pool->sp_sysctl, sysctl_base, OID_AUTO,
	- "request_space_high", CTLFLAG_RW,
	- &pool->sp_space_high,
	- "Maximum space in parsed but not handled requests.");
	-
	- SYSCTL_ADD_ULONG(&pool->sp_sysctl, sysctl_base, OID_AUTO,
	- "request_space_low", CTLFLAG_RW,
	- &pool->sp_space_low,
	- "Low water mark for request space.");
	-
	- SYSCTL_ADD_INT(&pool->sp_sysctl, sysctl_base, OID_AUTO,
	- "request_space_throttled", CTLFLAG_RD,
	- &pool->sp_space_throttled, 0,
	- "Whether nfs requests are currently throttled");
	-
	- SYSCTL_ADD_INT(&pool->sp_sysctl, sysctl_base, OID_AUTO,
	- "request_space_throttle_count", CTLFLAG_RD,
	- &pool->sp_space_throttle_count, 0,
	- "Count of times throttling based on request space has occurred");
	+ if (IS_DEFAULT_VNET(curvnet)) {
	+ sysctl_ctx_init(&pool->sp_sysctl);
	+ if (sysctl_base) {
	+ SYSCTL_ADD_PROC(&pool->sp_sysctl, sysctl_base, OID_AUTO,
	+ "minthreads", CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_MPSAFE,
	+ pool, 0, svcpool_minthread_sysctl, "I",
	+ "Minimal number of threads");
	+ SYSCTL_ADD_PROC(&pool->sp_sysctl, sysctl_base, OID_AUTO,
	+ "maxthreads", CTLTYPE_INT \| CTLFLAG_RW \| CTLFLAG_MPSAFE,
	+ pool, 0, svcpool_maxthread_sysctl, "I",
	+ "Maximal number of threads");
	+ SYSCTL_ADD_PROC(&pool->sp_sysctl, sysctl_base, OID_AUTO,
	+ "threads", CTLTYPE_INT \| CTLFLAG_RD \| CTLFLAG_MPSAFE,
	+ pool, 0, svcpool_threads_sysctl, "I",
	+ "Current number of threads");
	+ SYSCTL_ADD_INT(&pool->sp_sysctl, sysctl_base, OID_AUTO,
	+ "groups", CTLFLAG_RD, &pool->sp_groupcount, 0,
	+ "Number of thread groups");
	+
	+ SYSCTL_ADD_ULONG(&pool->sp_sysctl, sysctl_base, OID_AUTO,
	+ "request_space_used", CTLFLAG_RD,
	+ &pool->sp_space_used,
	+ "Space in parsed but not handled requests.");
	+
	+ SYSCTL_ADD_ULONG(&pool->sp_sysctl, sysctl_base, OID_AUTO,
	+ "request_space_used_highest", CTLFLAG_RD,
	+ &pool->sp_space_used_highest,
	+ "Highest space used since reboot.");
	+
	+ SYSCTL_ADD_ULONG(&pool->sp_sysctl, sysctl_base, OID_AUTO,
	+ "request_space_high", CTLFLAG_RW,
	+ &pool->sp_space_high,
	+ "Maximum space in parsed but not handled requests.");
	+
	+ SYSCTL_ADD_ULONG(&pool->sp_sysctl, sysctl_base, OID_AUTO,
	+ "request_space_low", CTLFLAG_RW,
	+ &pool->sp_space_low,
	+ "Low water mark for request space.");
	+
	+ SYSCTL_ADD_INT(&pool->sp_sysctl, sysctl_base, OID_AUTO,
	+ "request_space_throttled", CTLFLAG_RD,
	+ &pool->sp_space_throttled, 0,
	+ "Whether nfs requests are currently throttled");
	+
	+ SYSCTL_ADD_INT(&pool->sp_sysctl, sysctl_base, OID_AUTO,
	+ "request_space_throttle_count", CTLFLAG_RD,
	+ &pool->sp_space_throttle_count, 0,
	+ "Count of times throttling based on request space has occurred");
	+ }
	}

	return pool;
	diff --git a/sys/rpc/svc_auth.c.vnet b/sys/rpc/svc_auth.c
	--- a/sys/rpc/svc_auth.c.vnet
	+++ b/sys/rpc/svc_auth.c
	@@ -197,7 +197,7 @@
	cr->cr_uid = cr->cr_ruid = cr->cr_svuid = xprt->xp_uid;
	crsetgroups(cr, xprt->xp_ngrps, xprt->xp_gidp);
	cr->cr_rgid = cr->cr_svgid = xprt->xp_gidp[0];
	- cr->cr_prison = &prison0;
	+ cr->cr_prison = curthread->td_ucred->cr_prison;
	prison_hold(cr->cr_prison);
	*crp = cr;
	return (TRUE);
	@@ -210,7 +210,7 @@
	cr->cr_uid = cr->cr_ruid = cr->cr_svuid = xcr->cr_uid;
	crsetgroups(cr, xcr->cr_ngroups, xcr->cr_groups);
	cr->cr_rgid = cr->cr_svgid = cr->cr_groups[0];
	- cr->cr_prison = &prison0;
	+ cr->cr_prison = curthread->td_ucred->cr_prison;
	prison_hold(cr->cr_prison);
	*crp = cr;
	return (TRUE);
	diff --git a/sys/sys/jail.h.vnet b/sys/sys/jail.h
	--- a/sys/sys/jail.h.vnet
	+++ b/sys/sys/jail.h
	@@ -253,7 +253,8 @@
	#define PR_ALLOW_SUSER 0x00000400
	#define PR_ALLOW_RESERVED_PORTS 0x00008000
	#define PR_ALLOW_KMEM_ACCESS 0x00010000 /* reserved, not used yet */
	-#define PR_ALLOW_ALL_STATIC 0x000187ff
	+#define PR_ALLOW_NFSD 0x00020000
	+#define PR_ALLOW_ALL_STATIC 0x000387ff

	/*
	* PR_ALLOW_DIFFERENCES determines which flags are able to be
	diff --git a/sys/sys/priv.h.vnet b/sys/sys/priv.h
	--- a/sys/sys/priv.h.vnet
	+++ b/sys/sys/priv.h
	@@ -245,6 +245,7 @@
	*/
	#define PRIV_NFS_DAEMON 290 /* Can become the NFS daemon. */
	#define PRIV_NFS_LOCKD 291 /* Can become NFS lock daemon. */
	+#define PRIV_NFSD_VIMAGE 292 /* nfsd can run in vimage. */

	/*
	* VFS privileges.

File Metadata

Mime Type: text/plain
Expires: Thu, May 21, 10:44 PM (10 h, 52 m)
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 33407707
Default Alt Text: D37519.id113768.diff (58 KB)

D37519.id113768.diffNo OneTemporaryActions

D37519.id113768.diffView Options

File Metadata

Event Timeline

D37519.id113768.diff
No OneTemporary
Actions

D37519.id113768.diff
View Options