xref: /openbmc/linux/fs/nfsd/nfs4xdr.c (revision 6dfcd296)
1 /*
2  *  Server-side XDR for NFSv4
3  *
4  *  Copyright (c) 2002 The Regents of the University of Michigan.
5  *  All rights reserved.
6  *
7  *  Kendrick Smith <kmsmith@umich.edu>
8  *  Andy Adamson   <andros@umich.edu>
9  *
10  *  Redistribution and use in source and binary forms, with or without
11  *  modification, are permitted provided that the following conditions
12  *  are met:
13  *
14  *  1. Redistributions of source code must retain the above copyright
15  *     notice, this list of conditions and the following disclaimer.
16  *  2. Redistributions in binary form must reproduce the above copyright
17  *     notice, this list of conditions and the following disclaimer in the
18  *     documentation and/or other materials provided with the distribution.
19  *  3. Neither the name of the University nor the names of its
20  *     contributors may be used to endorse or promote products derived
21  *     from this software without specific prior written permission.
22  *
23  *  THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
24  *  WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
25  *  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
26  *  DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
27  *  FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
28  *  CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
29  *  SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
30  *  BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
31  *  LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
32  *  NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
33  *  SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
34  */
35 
36 #include <linux/file.h>
37 #include <linux/slab.h>
38 #include <linux/namei.h>
39 #include <linux/statfs.h>
40 #include <linux/utsname.h>
41 #include <linux/pagemap.h>
42 #include <linux/sunrpc/svcauth_gss.h>
43 
44 #include "idmap.h"
45 #include "acl.h"
46 #include "xdr4.h"
47 #include "vfs.h"
48 #include "state.h"
49 #include "cache.h"
50 #include "netns.h"
51 #include "pnfs.h"
52 
53 #ifdef CONFIG_NFSD_V4_SECURITY_LABEL
54 #include <linux/security.h>
55 #endif
56 
57 
58 #define NFSDDBG_FACILITY		NFSDDBG_XDR
59 
60 /*
61  * As per referral draft, the fsid for a referral MUST be different from the fsid of the containing
62  * directory in order to indicate to the client that a filesystem boundary is present
63  * We use a fixed fsid for a referral
64  */
65 #define NFS4_REFERRAL_FSID_MAJOR	0x8000000ULL
66 #define NFS4_REFERRAL_FSID_MINOR	0x8000000ULL
67 
68 static __be32
69 check_filename(char *str, int len)
70 {
71 	int i;
72 
73 	if (len == 0)
74 		return nfserr_inval;
75 	if (isdotent(str, len))
76 		return nfserr_badname;
77 	for (i = 0; i < len; i++)
78 		if (str[i] == '/')
79 			return nfserr_badname;
80 	return 0;
81 }
82 
83 #define DECODE_HEAD				\
84 	__be32 *p;				\
85 	__be32 status
86 #define DECODE_TAIL				\
87 	status = 0;				\
88 out:						\
89 	return status;				\
90 xdr_error:					\
91 	dprintk("NFSD: xdr error (%s:%d)\n",	\
92 			__FILE__, __LINE__);	\
93 	status = nfserr_bad_xdr;		\
94 	goto out
95 
96 #define READMEM(x,nbytes) do {			\
97 	x = (char *)p;				\
98 	p += XDR_QUADLEN(nbytes);		\
99 } while (0)
100 #define SAVEMEM(x,nbytes) do {			\
101 	if (!(x = (p==argp->tmp || p == argp->tmpp) ? \
102  		savemem(argp, p, nbytes) :	\
103  		(char *)p)) {			\
104 		dprintk("NFSD: xdr error (%s:%d)\n", \
105 				__FILE__, __LINE__); \
106 		goto xdr_error;			\
107 		}				\
108 	p += XDR_QUADLEN(nbytes);		\
109 } while (0)
110 #define COPYMEM(x,nbytes) do {			\
111 	memcpy((x), p, nbytes);			\
112 	p += XDR_QUADLEN(nbytes);		\
113 } while (0)
114 
115 /* READ_BUF, read_buf(): nbytes must be <= PAGE_SIZE */
116 #define READ_BUF(nbytes)  do {			\
117 	if (nbytes <= (u32)((char *)argp->end - (char *)argp->p)) {	\
118 		p = argp->p;			\
119 		argp->p += XDR_QUADLEN(nbytes);	\
120 	} else if (!(p = read_buf(argp, nbytes))) { \
121 		dprintk("NFSD: xdr error (%s:%d)\n", \
122 				__FILE__, __LINE__); \
123 		goto xdr_error;			\
124 	}					\
125 } while (0)
126 
127 static void next_decode_page(struct nfsd4_compoundargs *argp)
128 {
129 	argp->p = page_address(argp->pagelist[0]);
130 	argp->pagelist++;
131 	if (argp->pagelen < PAGE_SIZE) {
132 		argp->end = argp->p + (argp->pagelen>>2);
133 		argp->pagelen = 0;
134 	} else {
135 		argp->end = argp->p + (PAGE_SIZE>>2);
136 		argp->pagelen -= PAGE_SIZE;
137 	}
138 }
139 
140 static __be32 *read_buf(struct nfsd4_compoundargs *argp, u32 nbytes)
141 {
142 	/* We want more bytes than seem to be available.
143 	 * Maybe we need a new page, maybe we have just run out
144 	 */
145 	unsigned int avail = (char *)argp->end - (char *)argp->p;
146 	__be32 *p;
147 	if (avail + argp->pagelen < nbytes)
148 		return NULL;
149 	if (avail + PAGE_SIZE < nbytes) /* need more than a page !! */
150 		return NULL;
151 	/* ok, we can do it with the current plus the next page */
152 	if (nbytes <= sizeof(argp->tmp))
153 		p = argp->tmp;
154 	else {
155 		kfree(argp->tmpp);
156 		p = argp->tmpp = kmalloc(nbytes, GFP_KERNEL);
157 		if (!p)
158 			return NULL;
159 
160 	}
161 	/*
162 	 * The following memcpy is safe because read_buf is always
163 	 * called with nbytes > avail, and the two cases above both
164 	 * guarantee p points to at least nbytes bytes.
165 	 */
166 	memcpy(p, argp->p, avail);
167 	next_decode_page(argp);
168 	memcpy(((char*)p)+avail, argp->p, (nbytes - avail));
169 	argp->p += XDR_QUADLEN(nbytes - avail);
170 	return p;
171 }
172 
173 static int zero_clientid(clientid_t *clid)
174 {
175 	return (clid->cl_boot == 0) && (clid->cl_id == 0);
176 }
177 
178 /**
179  * svcxdr_tmpalloc - allocate memory to be freed after compound processing
180  * @argp: NFSv4 compound argument structure
181  * @p: pointer to be freed (with kfree())
182  *
183  * Marks @p to be freed when processing the compound operation
184  * described in @argp finishes.
185  */
186 static void *
187 svcxdr_tmpalloc(struct nfsd4_compoundargs *argp, u32 len)
188 {
189 	struct svcxdr_tmpbuf *tb;
190 
191 	tb = kmalloc(sizeof(*tb) + len, GFP_KERNEL);
192 	if (!tb)
193 		return NULL;
194 	tb->next = argp->to_free;
195 	argp->to_free = tb;
196 	return tb->buf;
197 }
198 
199 /*
200  * For xdr strings that need to be passed to other kernel api's
201  * as null-terminated strings.
202  *
203  * Note null-terminating in place usually isn't safe since the
204  * buffer might end on a page boundary.
205  */
206 static char *
207 svcxdr_dupstr(struct nfsd4_compoundargs *argp, void *buf, u32 len)
208 {
209 	char *p = svcxdr_tmpalloc(argp, len + 1);
210 
211 	if (!p)
212 		return NULL;
213 	memcpy(p, buf, len);
214 	p[len] = '\0';
215 	return p;
216 }
217 
218 /**
219  * savemem - duplicate a chunk of memory for later processing
220  * @argp: NFSv4 compound argument structure to be freed with
221  * @p: pointer to be duplicated
222  * @nbytes: length to be duplicated
223  *
224  * Returns a pointer to a copy of @nbytes bytes of memory at @p
225  * that are preserved until processing of the NFSv4 compound
226  * operation described by @argp finishes.
227  */
228 static char *savemem(struct nfsd4_compoundargs *argp, __be32 *p, int nbytes)
229 {
230 	void *ret;
231 
232 	ret = svcxdr_tmpalloc(argp, nbytes);
233 	if (!ret)
234 		return NULL;
235 	memcpy(ret, p, nbytes);
236 	return ret;
237 }
238 
239 /*
240  * We require the high 32 bits of 'seconds' to be 0, and
241  * we ignore all 32 bits of 'nseconds'.
242  */
243 static __be32
244 nfsd4_decode_time(struct nfsd4_compoundargs *argp, struct timespec *tv)
245 {
246 	DECODE_HEAD;
247 	u64 sec;
248 
249 	READ_BUF(12);
250 	p = xdr_decode_hyper(p, &sec);
251 	tv->tv_sec = sec;
252 	tv->tv_nsec = be32_to_cpup(p++);
253 	if (tv->tv_nsec >= (u32)1000000000)
254 		return nfserr_inval;
255 
256 	DECODE_TAIL;
257 }
258 
259 static __be32
260 nfsd4_decode_bitmap(struct nfsd4_compoundargs *argp, u32 *bmval)
261 {
262 	u32 bmlen;
263 	DECODE_HEAD;
264 
265 	bmval[0] = 0;
266 	bmval[1] = 0;
267 	bmval[2] = 0;
268 
269 	READ_BUF(4);
270 	bmlen = be32_to_cpup(p++);
271 	if (bmlen > 1000)
272 		goto xdr_error;
273 
274 	READ_BUF(bmlen << 2);
275 	if (bmlen > 0)
276 		bmval[0] = be32_to_cpup(p++);
277 	if (bmlen > 1)
278 		bmval[1] = be32_to_cpup(p++);
279 	if (bmlen > 2)
280 		bmval[2] = be32_to_cpup(p++);
281 
282 	DECODE_TAIL;
283 }
284 
285 static __be32
286 nfsd4_decode_fattr(struct nfsd4_compoundargs *argp, u32 *bmval,
287 		   struct iattr *iattr, struct nfs4_acl **acl,
288 		   struct xdr_netobj *label)
289 {
290 	int expected_len, len = 0;
291 	u32 dummy32;
292 	char *buf;
293 
294 	DECODE_HEAD;
295 	iattr->ia_valid = 0;
296 	if ((status = nfsd4_decode_bitmap(argp, bmval)))
297 		return status;
298 
299 	READ_BUF(4);
300 	expected_len = be32_to_cpup(p++);
301 
302 	if (bmval[0] & FATTR4_WORD0_SIZE) {
303 		READ_BUF(8);
304 		len += 8;
305 		p = xdr_decode_hyper(p, &iattr->ia_size);
306 		iattr->ia_valid |= ATTR_SIZE;
307 	}
308 	if (bmval[0] & FATTR4_WORD0_ACL) {
309 		u32 nace;
310 		struct nfs4_ace *ace;
311 
312 		READ_BUF(4); len += 4;
313 		nace = be32_to_cpup(p++);
314 
315 		if (nace > NFS4_ACL_MAX)
316 			return nfserr_fbig;
317 
318 		*acl = svcxdr_tmpalloc(argp, nfs4_acl_bytes(nace));
319 		if (*acl == NULL)
320 			return nfserr_jukebox;
321 
322 		(*acl)->naces = nace;
323 		for (ace = (*acl)->aces; ace < (*acl)->aces + nace; ace++) {
324 			READ_BUF(16); len += 16;
325 			ace->type = be32_to_cpup(p++);
326 			ace->flag = be32_to_cpup(p++);
327 			ace->access_mask = be32_to_cpup(p++);
328 			dummy32 = be32_to_cpup(p++);
329 			READ_BUF(dummy32);
330 			len += XDR_QUADLEN(dummy32) << 2;
331 			READMEM(buf, dummy32);
332 			ace->whotype = nfs4_acl_get_whotype(buf, dummy32);
333 			status = nfs_ok;
334 			if (ace->whotype != NFS4_ACL_WHO_NAMED)
335 				;
336 			else if (ace->flag & NFS4_ACE_IDENTIFIER_GROUP)
337 				status = nfsd_map_name_to_gid(argp->rqstp,
338 						buf, dummy32, &ace->who_gid);
339 			else
340 				status = nfsd_map_name_to_uid(argp->rqstp,
341 						buf, dummy32, &ace->who_uid);
342 			if (status)
343 				return status;
344 		}
345 	} else
346 		*acl = NULL;
347 	if (bmval[1] & FATTR4_WORD1_MODE) {
348 		READ_BUF(4);
349 		len += 4;
350 		iattr->ia_mode = be32_to_cpup(p++);
351 		iattr->ia_mode &= (S_IFMT | S_IALLUGO);
352 		iattr->ia_valid |= ATTR_MODE;
353 	}
354 	if (bmval[1] & FATTR4_WORD1_OWNER) {
355 		READ_BUF(4);
356 		len += 4;
357 		dummy32 = be32_to_cpup(p++);
358 		READ_BUF(dummy32);
359 		len += (XDR_QUADLEN(dummy32) << 2);
360 		READMEM(buf, dummy32);
361 		if ((status = nfsd_map_name_to_uid(argp->rqstp, buf, dummy32, &iattr->ia_uid)))
362 			return status;
363 		iattr->ia_valid |= ATTR_UID;
364 	}
365 	if (bmval[1] & FATTR4_WORD1_OWNER_GROUP) {
366 		READ_BUF(4);
367 		len += 4;
368 		dummy32 = be32_to_cpup(p++);
369 		READ_BUF(dummy32);
370 		len += (XDR_QUADLEN(dummy32) << 2);
371 		READMEM(buf, dummy32);
372 		if ((status = nfsd_map_name_to_gid(argp->rqstp, buf, dummy32, &iattr->ia_gid)))
373 			return status;
374 		iattr->ia_valid |= ATTR_GID;
375 	}
376 	if (bmval[1] & FATTR4_WORD1_TIME_ACCESS_SET) {
377 		READ_BUF(4);
378 		len += 4;
379 		dummy32 = be32_to_cpup(p++);
380 		switch (dummy32) {
381 		case NFS4_SET_TO_CLIENT_TIME:
382 			len += 12;
383 			status = nfsd4_decode_time(argp, &iattr->ia_atime);
384 			if (status)
385 				return status;
386 			iattr->ia_valid |= (ATTR_ATIME | ATTR_ATIME_SET);
387 			break;
388 		case NFS4_SET_TO_SERVER_TIME:
389 			iattr->ia_valid |= ATTR_ATIME;
390 			break;
391 		default:
392 			goto xdr_error;
393 		}
394 	}
395 	if (bmval[1] & FATTR4_WORD1_TIME_MODIFY_SET) {
396 		READ_BUF(4);
397 		len += 4;
398 		dummy32 = be32_to_cpup(p++);
399 		switch (dummy32) {
400 		case NFS4_SET_TO_CLIENT_TIME:
401 			len += 12;
402 			status = nfsd4_decode_time(argp, &iattr->ia_mtime);
403 			if (status)
404 				return status;
405 			iattr->ia_valid |= (ATTR_MTIME | ATTR_MTIME_SET);
406 			break;
407 		case NFS4_SET_TO_SERVER_TIME:
408 			iattr->ia_valid |= ATTR_MTIME;
409 			break;
410 		default:
411 			goto xdr_error;
412 		}
413 	}
414 
415 	label->len = 0;
416 #ifdef CONFIG_NFSD_V4_SECURITY_LABEL
417 	if (bmval[2] & FATTR4_WORD2_SECURITY_LABEL) {
418 		READ_BUF(4);
419 		len += 4;
420 		dummy32 = be32_to_cpup(p++); /* lfs: we don't use it */
421 		READ_BUF(4);
422 		len += 4;
423 		dummy32 = be32_to_cpup(p++); /* pi: we don't use it either */
424 		READ_BUF(4);
425 		len += 4;
426 		dummy32 = be32_to_cpup(p++);
427 		READ_BUF(dummy32);
428 		if (dummy32 > NFS4_MAXLABELLEN)
429 			return nfserr_badlabel;
430 		len += (XDR_QUADLEN(dummy32) << 2);
431 		READMEM(buf, dummy32);
432 		label->len = dummy32;
433 		label->data = svcxdr_dupstr(argp, buf, dummy32);
434 		if (!label->data)
435 			return nfserr_jukebox;
436 	}
437 #endif
438 
439 	if (bmval[0] & ~NFSD_WRITEABLE_ATTRS_WORD0
440 	    || bmval[1] & ~NFSD_WRITEABLE_ATTRS_WORD1
441 	    || bmval[2] & ~NFSD_WRITEABLE_ATTRS_WORD2)
442 		READ_BUF(expected_len - len);
443 	else if (len != expected_len)
444 		goto xdr_error;
445 
446 	DECODE_TAIL;
447 }
448 
449 static __be32
450 nfsd4_decode_stateid(struct nfsd4_compoundargs *argp, stateid_t *sid)
451 {
452 	DECODE_HEAD;
453 
454 	READ_BUF(sizeof(stateid_t));
455 	sid->si_generation = be32_to_cpup(p++);
456 	COPYMEM(&sid->si_opaque, sizeof(stateid_opaque_t));
457 
458 	DECODE_TAIL;
459 }
460 
461 static __be32
462 nfsd4_decode_access(struct nfsd4_compoundargs *argp, struct nfsd4_access *access)
463 {
464 	DECODE_HEAD;
465 
466 	READ_BUF(4);
467 	access->ac_req_access = be32_to_cpup(p++);
468 
469 	DECODE_TAIL;
470 }
471 
472 static __be32 nfsd4_decode_cb_sec(struct nfsd4_compoundargs *argp, struct nfsd4_cb_sec *cbs)
473 {
474 	DECODE_HEAD;
475 	u32 dummy, uid, gid;
476 	char *machine_name;
477 	int i;
478 	int nr_secflavs;
479 
480 	/* callback_sec_params4 */
481 	READ_BUF(4);
482 	nr_secflavs = be32_to_cpup(p++);
483 	if (nr_secflavs)
484 		cbs->flavor = (u32)(-1);
485 	else
486 		/* Is this legal? Be generous, take it to mean AUTH_NONE: */
487 		cbs->flavor = 0;
488 	for (i = 0; i < nr_secflavs; ++i) {
489 		READ_BUF(4);
490 		dummy = be32_to_cpup(p++);
491 		switch (dummy) {
492 		case RPC_AUTH_NULL:
493 			/* Nothing to read */
494 			if (cbs->flavor == (u32)(-1))
495 				cbs->flavor = RPC_AUTH_NULL;
496 			break;
497 		case RPC_AUTH_UNIX:
498 			READ_BUF(8);
499 			/* stamp */
500 			dummy = be32_to_cpup(p++);
501 
502 			/* machine name */
503 			dummy = be32_to_cpup(p++);
504 			READ_BUF(dummy);
505 			SAVEMEM(machine_name, dummy);
506 
507 			/* uid, gid */
508 			READ_BUF(8);
509 			uid = be32_to_cpup(p++);
510 			gid = be32_to_cpup(p++);
511 
512 			/* more gids */
513 			READ_BUF(4);
514 			dummy = be32_to_cpup(p++);
515 			READ_BUF(dummy * 4);
516 			if (cbs->flavor == (u32)(-1)) {
517 				kuid_t kuid = make_kuid(&init_user_ns, uid);
518 				kgid_t kgid = make_kgid(&init_user_ns, gid);
519 				if (uid_valid(kuid) && gid_valid(kgid)) {
520 					cbs->uid = kuid;
521 					cbs->gid = kgid;
522 					cbs->flavor = RPC_AUTH_UNIX;
523 				} else {
524 					dprintk("RPC_AUTH_UNIX with invalid"
525 						"uid or gid ignoring!\n");
526 				}
527 			}
528 			break;
529 		case RPC_AUTH_GSS:
530 			dprintk("RPC_AUTH_GSS callback secflavor "
531 				"not supported!\n");
532 			READ_BUF(8);
533 			/* gcbp_service */
534 			dummy = be32_to_cpup(p++);
535 			/* gcbp_handle_from_server */
536 			dummy = be32_to_cpup(p++);
537 			READ_BUF(dummy);
538 			p += XDR_QUADLEN(dummy);
539 			/* gcbp_handle_from_client */
540 			READ_BUF(4);
541 			dummy = be32_to_cpup(p++);
542 			READ_BUF(dummy);
543 			break;
544 		default:
545 			dprintk("Illegal callback secflavor\n");
546 			return nfserr_inval;
547 		}
548 	}
549 	DECODE_TAIL;
550 }
551 
552 static __be32 nfsd4_decode_backchannel_ctl(struct nfsd4_compoundargs *argp, struct nfsd4_backchannel_ctl *bc)
553 {
554 	DECODE_HEAD;
555 
556 	READ_BUF(4);
557 	bc->bc_cb_program = be32_to_cpup(p++);
558 	nfsd4_decode_cb_sec(argp, &bc->bc_cb_sec);
559 
560 	DECODE_TAIL;
561 }
562 
563 static __be32 nfsd4_decode_bind_conn_to_session(struct nfsd4_compoundargs *argp, struct nfsd4_bind_conn_to_session *bcts)
564 {
565 	DECODE_HEAD;
566 
567 	READ_BUF(NFS4_MAX_SESSIONID_LEN + 8);
568 	COPYMEM(bcts->sessionid.data, NFS4_MAX_SESSIONID_LEN);
569 	bcts->dir = be32_to_cpup(p++);
570 	/* XXX: skipping ctsa_use_conn_in_rdma_mode.  Perhaps Tom Tucker
571 	 * could help us figure out we should be using it. */
572 	DECODE_TAIL;
573 }
574 
575 static __be32
576 nfsd4_decode_close(struct nfsd4_compoundargs *argp, struct nfsd4_close *close)
577 {
578 	DECODE_HEAD;
579 
580 	READ_BUF(4);
581 	close->cl_seqid = be32_to_cpup(p++);
582 	return nfsd4_decode_stateid(argp, &close->cl_stateid);
583 
584 	DECODE_TAIL;
585 }
586 
587 
588 static __be32
589 nfsd4_decode_commit(struct nfsd4_compoundargs *argp, struct nfsd4_commit *commit)
590 {
591 	DECODE_HEAD;
592 
593 	READ_BUF(12);
594 	p = xdr_decode_hyper(p, &commit->co_offset);
595 	commit->co_count = be32_to_cpup(p++);
596 
597 	DECODE_TAIL;
598 }
599 
600 static __be32
601 nfsd4_decode_create(struct nfsd4_compoundargs *argp, struct nfsd4_create *create)
602 {
603 	DECODE_HEAD;
604 
605 	READ_BUF(4);
606 	create->cr_type = be32_to_cpup(p++);
607 	switch (create->cr_type) {
608 	case NF4LNK:
609 		READ_BUF(4);
610 		create->cr_datalen = be32_to_cpup(p++);
611 		READ_BUF(create->cr_datalen);
612 		create->cr_data = svcxdr_dupstr(argp, p, create->cr_datalen);
613 		if (!create->cr_data)
614 			return nfserr_jukebox;
615 		break;
616 	case NF4BLK:
617 	case NF4CHR:
618 		READ_BUF(8);
619 		create->cr_specdata1 = be32_to_cpup(p++);
620 		create->cr_specdata2 = be32_to_cpup(p++);
621 		break;
622 	case NF4SOCK:
623 	case NF4FIFO:
624 	case NF4DIR:
625 	default:
626 		break;
627 	}
628 
629 	READ_BUF(4);
630 	create->cr_namelen = be32_to_cpup(p++);
631 	READ_BUF(create->cr_namelen);
632 	SAVEMEM(create->cr_name, create->cr_namelen);
633 	if ((status = check_filename(create->cr_name, create->cr_namelen)))
634 		return status;
635 
636 	status = nfsd4_decode_fattr(argp, create->cr_bmval, &create->cr_iattr,
637 				    &create->cr_acl, &create->cr_label);
638 	if (status)
639 		goto out;
640 
641 	DECODE_TAIL;
642 }
643 
644 static inline __be32
645 nfsd4_decode_delegreturn(struct nfsd4_compoundargs *argp, struct nfsd4_delegreturn *dr)
646 {
647 	return nfsd4_decode_stateid(argp, &dr->dr_stateid);
648 }
649 
650 static inline __be32
651 nfsd4_decode_getattr(struct nfsd4_compoundargs *argp, struct nfsd4_getattr *getattr)
652 {
653 	return nfsd4_decode_bitmap(argp, getattr->ga_bmval);
654 }
655 
656 static __be32
657 nfsd4_decode_link(struct nfsd4_compoundargs *argp, struct nfsd4_link *link)
658 {
659 	DECODE_HEAD;
660 
661 	READ_BUF(4);
662 	link->li_namelen = be32_to_cpup(p++);
663 	READ_BUF(link->li_namelen);
664 	SAVEMEM(link->li_name, link->li_namelen);
665 	if ((status = check_filename(link->li_name, link->li_namelen)))
666 		return status;
667 
668 	DECODE_TAIL;
669 }
670 
671 static __be32
672 nfsd4_decode_lock(struct nfsd4_compoundargs *argp, struct nfsd4_lock *lock)
673 {
674 	DECODE_HEAD;
675 
676 	/*
677 	* type, reclaim(boolean), offset, length, new_lock_owner(boolean)
678 	*/
679 	READ_BUF(28);
680 	lock->lk_type = be32_to_cpup(p++);
681 	if ((lock->lk_type < NFS4_READ_LT) || (lock->lk_type > NFS4_WRITEW_LT))
682 		goto xdr_error;
683 	lock->lk_reclaim = be32_to_cpup(p++);
684 	p = xdr_decode_hyper(p, &lock->lk_offset);
685 	p = xdr_decode_hyper(p, &lock->lk_length);
686 	lock->lk_is_new = be32_to_cpup(p++);
687 
688 	if (lock->lk_is_new) {
689 		READ_BUF(4);
690 		lock->lk_new_open_seqid = be32_to_cpup(p++);
691 		status = nfsd4_decode_stateid(argp, &lock->lk_new_open_stateid);
692 		if (status)
693 			return status;
694 		READ_BUF(8 + sizeof(clientid_t));
695 		lock->lk_new_lock_seqid = be32_to_cpup(p++);
696 		COPYMEM(&lock->lk_new_clientid, sizeof(clientid_t));
697 		lock->lk_new_owner.len = be32_to_cpup(p++);
698 		READ_BUF(lock->lk_new_owner.len);
699 		READMEM(lock->lk_new_owner.data, lock->lk_new_owner.len);
700 	} else {
701 		status = nfsd4_decode_stateid(argp, &lock->lk_old_lock_stateid);
702 		if (status)
703 			return status;
704 		READ_BUF(4);
705 		lock->lk_old_lock_seqid = be32_to_cpup(p++);
706 	}
707 
708 	DECODE_TAIL;
709 }
710 
711 static __be32
712 nfsd4_decode_lockt(struct nfsd4_compoundargs *argp, struct nfsd4_lockt *lockt)
713 {
714 	DECODE_HEAD;
715 
716 	READ_BUF(32);
717 	lockt->lt_type = be32_to_cpup(p++);
718 	if((lockt->lt_type < NFS4_READ_LT) || (lockt->lt_type > NFS4_WRITEW_LT))
719 		goto xdr_error;
720 	p = xdr_decode_hyper(p, &lockt->lt_offset);
721 	p = xdr_decode_hyper(p, &lockt->lt_length);
722 	COPYMEM(&lockt->lt_clientid, 8);
723 	lockt->lt_owner.len = be32_to_cpup(p++);
724 	READ_BUF(lockt->lt_owner.len);
725 	READMEM(lockt->lt_owner.data, lockt->lt_owner.len);
726 
727 	DECODE_TAIL;
728 }
729 
730 static __be32
731 nfsd4_decode_locku(struct nfsd4_compoundargs *argp, struct nfsd4_locku *locku)
732 {
733 	DECODE_HEAD;
734 
735 	READ_BUF(8);
736 	locku->lu_type = be32_to_cpup(p++);
737 	if ((locku->lu_type < NFS4_READ_LT) || (locku->lu_type > NFS4_WRITEW_LT))
738 		goto xdr_error;
739 	locku->lu_seqid = be32_to_cpup(p++);
740 	status = nfsd4_decode_stateid(argp, &locku->lu_stateid);
741 	if (status)
742 		return status;
743 	READ_BUF(16);
744 	p = xdr_decode_hyper(p, &locku->lu_offset);
745 	p = xdr_decode_hyper(p, &locku->lu_length);
746 
747 	DECODE_TAIL;
748 }
749 
750 static __be32
751 nfsd4_decode_lookup(struct nfsd4_compoundargs *argp, struct nfsd4_lookup *lookup)
752 {
753 	DECODE_HEAD;
754 
755 	READ_BUF(4);
756 	lookup->lo_len = be32_to_cpup(p++);
757 	READ_BUF(lookup->lo_len);
758 	SAVEMEM(lookup->lo_name, lookup->lo_len);
759 	if ((status = check_filename(lookup->lo_name, lookup->lo_len)))
760 		return status;
761 
762 	DECODE_TAIL;
763 }
764 
765 static __be32 nfsd4_decode_share_access(struct nfsd4_compoundargs *argp, u32 *share_access, u32 *deleg_want, u32 *deleg_when)
766 {
767 	__be32 *p;
768 	u32 w;
769 
770 	READ_BUF(4);
771 	w = be32_to_cpup(p++);
772 	*share_access = w & NFS4_SHARE_ACCESS_MASK;
773 	*deleg_want = w & NFS4_SHARE_WANT_MASK;
774 	if (deleg_when)
775 		*deleg_when = w & NFS4_SHARE_WHEN_MASK;
776 
777 	switch (w & NFS4_SHARE_ACCESS_MASK) {
778 	case NFS4_SHARE_ACCESS_READ:
779 	case NFS4_SHARE_ACCESS_WRITE:
780 	case NFS4_SHARE_ACCESS_BOTH:
781 		break;
782 	default:
783 		return nfserr_bad_xdr;
784 	}
785 	w &= ~NFS4_SHARE_ACCESS_MASK;
786 	if (!w)
787 		return nfs_ok;
788 	if (!argp->minorversion)
789 		return nfserr_bad_xdr;
790 	switch (w & NFS4_SHARE_WANT_MASK) {
791 	case NFS4_SHARE_WANT_NO_PREFERENCE:
792 	case NFS4_SHARE_WANT_READ_DELEG:
793 	case NFS4_SHARE_WANT_WRITE_DELEG:
794 	case NFS4_SHARE_WANT_ANY_DELEG:
795 	case NFS4_SHARE_WANT_NO_DELEG:
796 	case NFS4_SHARE_WANT_CANCEL:
797 		break;
798 	default:
799 		return nfserr_bad_xdr;
800 	}
801 	w &= ~NFS4_SHARE_WANT_MASK;
802 	if (!w)
803 		return nfs_ok;
804 
805 	if (!deleg_when)	/* open_downgrade */
806 		return nfserr_inval;
807 	switch (w) {
808 	case NFS4_SHARE_SIGNAL_DELEG_WHEN_RESRC_AVAIL:
809 	case NFS4_SHARE_PUSH_DELEG_WHEN_UNCONTENDED:
810 	case (NFS4_SHARE_SIGNAL_DELEG_WHEN_RESRC_AVAIL |
811 	      NFS4_SHARE_PUSH_DELEG_WHEN_UNCONTENDED):
812 		return nfs_ok;
813 	}
814 xdr_error:
815 	return nfserr_bad_xdr;
816 }
817 
818 static __be32 nfsd4_decode_share_deny(struct nfsd4_compoundargs *argp, u32 *x)
819 {
820 	__be32 *p;
821 
822 	READ_BUF(4);
823 	*x = be32_to_cpup(p++);
824 	/* Note: unlinke access bits, deny bits may be zero. */
825 	if (*x & ~NFS4_SHARE_DENY_BOTH)
826 		return nfserr_bad_xdr;
827 	return nfs_ok;
828 xdr_error:
829 	return nfserr_bad_xdr;
830 }
831 
832 static __be32 nfsd4_decode_opaque(struct nfsd4_compoundargs *argp, struct xdr_netobj *o)
833 {
834 	__be32 *p;
835 
836 	READ_BUF(4);
837 	o->len = be32_to_cpup(p++);
838 
839 	if (o->len == 0 || o->len > NFS4_OPAQUE_LIMIT)
840 		return nfserr_bad_xdr;
841 
842 	READ_BUF(o->len);
843 	SAVEMEM(o->data, o->len);
844 	return nfs_ok;
845 xdr_error:
846 	return nfserr_bad_xdr;
847 }
848 
849 static __be32
850 nfsd4_decode_open(struct nfsd4_compoundargs *argp, struct nfsd4_open *open)
851 {
852 	DECODE_HEAD;
853 	u32 dummy;
854 
855 	memset(open->op_bmval, 0, sizeof(open->op_bmval));
856 	open->op_iattr.ia_valid = 0;
857 	open->op_openowner = NULL;
858 
859 	open->op_xdr_error = 0;
860 	/* seqid, share_access, share_deny, clientid, ownerlen */
861 	READ_BUF(4);
862 	open->op_seqid = be32_to_cpup(p++);
863 	/* decode, yet ignore deleg_when until supported */
864 	status = nfsd4_decode_share_access(argp, &open->op_share_access,
865 					   &open->op_deleg_want, &dummy);
866 	if (status)
867 		goto xdr_error;
868 	status = nfsd4_decode_share_deny(argp, &open->op_share_deny);
869 	if (status)
870 		goto xdr_error;
871 	READ_BUF(sizeof(clientid_t));
872 	COPYMEM(&open->op_clientid, sizeof(clientid_t));
873 	status = nfsd4_decode_opaque(argp, &open->op_owner);
874 	if (status)
875 		goto xdr_error;
876 	READ_BUF(4);
877 	open->op_create = be32_to_cpup(p++);
878 	switch (open->op_create) {
879 	case NFS4_OPEN_NOCREATE:
880 		break;
881 	case NFS4_OPEN_CREATE:
882 		READ_BUF(4);
883 		open->op_createmode = be32_to_cpup(p++);
884 		switch (open->op_createmode) {
885 		case NFS4_CREATE_UNCHECKED:
886 		case NFS4_CREATE_GUARDED:
887 			status = nfsd4_decode_fattr(argp, open->op_bmval,
888 				&open->op_iattr, &open->op_acl, &open->op_label);
889 			if (status)
890 				goto out;
891 			break;
892 		case NFS4_CREATE_EXCLUSIVE:
893 			READ_BUF(NFS4_VERIFIER_SIZE);
894 			COPYMEM(open->op_verf.data, NFS4_VERIFIER_SIZE);
895 			break;
896 		case NFS4_CREATE_EXCLUSIVE4_1:
897 			if (argp->minorversion < 1)
898 				goto xdr_error;
899 			READ_BUF(NFS4_VERIFIER_SIZE);
900 			COPYMEM(open->op_verf.data, NFS4_VERIFIER_SIZE);
901 			status = nfsd4_decode_fattr(argp, open->op_bmval,
902 				&open->op_iattr, &open->op_acl, &open->op_label);
903 			if (status)
904 				goto out;
905 			break;
906 		default:
907 			goto xdr_error;
908 		}
909 		break;
910 	default:
911 		goto xdr_error;
912 	}
913 
914 	/* open_claim */
915 	READ_BUF(4);
916 	open->op_claim_type = be32_to_cpup(p++);
917 	switch (open->op_claim_type) {
918 	case NFS4_OPEN_CLAIM_NULL:
919 	case NFS4_OPEN_CLAIM_DELEGATE_PREV:
920 		READ_BUF(4);
921 		open->op_fname.len = be32_to_cpup(p++);
922 		READ_BUF(open->op_fname.len);
923 		SAVEMEM(open->op_fname.data, open->op_fname.len);
924 		if ((status = check_filename(open->op_fname.data, open->op_fname.len)))
925 			return status;
926 		break;
927 	case NFS4_OPEN_CLAIM_PREVIOUS:
928 		READ_BUF(4);
929 		open->op_delegate_type = be32_to_cpup(p++);
930 		break;
931 	case NFS4_OPEN_CLAIM_DELEGATE_CUR:
932 		status = nfsd4_decode_stateid(argp, &open->op_delegate_stateid);
933 		if (status)
934 			return status;
935 		READ_BUF(4);
936 		open->op_fname.len = be32_to_cpup(p++);
937 		READ_BUF(open->op_fname.len);
938 		SAVEMEM(open->op_fname.data, open->op_fname.len);
939 		if ((status = check_filename(open->op_fname.data, open->op_fname.len)))
940 			return status;
941 		break;
942 	case NFS4_OPEN_CLAIM_FH:
943 	case NFS4_OPEN_CLAIM_DELEG_PREV_FH:
944 		if (argp->minorversion < 1)
945 			goto xdr_error;
946 		/* void */
947 		break;
948 	case NFS4_OPEN_CLAIM_DELEG_CUR_FH:
949 		if (argp->minorversion < 1)
950 			goto xdr_error;
951 		status = nfsd4_decode_stateid(argp, &open->op_delegate_stateid);
952 		if (status)
953 			return status;
954 		break;
955 	default:
956 		goto xdr_error;
957 	}
958 
959 	DECODE_TAIL;
960 }
961 
962 static __be32
963 nfsd4_decode_open_confirm(struct nfsd4_compoundargs *argp, struct nfsd4_open_confirm *open_conf)
964 {
965 	DECODE_HEAD;
966 
967 	if (argp->minorversion >= 1)
968 		return nfserr_notsupp;
969 
970 	status = nfsd4_decode_stateid(argp, &open_conf->oc_req_stateid);
971 	if (status)
972 		return status;
973 	READ_BUF(4);
974 	open_conf->oc_seqid = be32_to_cpup(p++);
975 
976 	DECODE_TAIL;
977 }
978 
979 static __be32
980 nfsd4_decode_open_downgrade(struct nfsd4_compoundargs *argp, struct nfsd4_open_downgrade *open_down)
981 {
982 	DECODE_HEAD;
983 
984 	status = nfsd4_decode_stateid(argp, &open_down->od_stateid);
985 	if (status)
986 		return status;
987 	READ_BUF(4);
988 	open_down->od_seqid = be32_to_cpup(p++);
989 	status = nfsd4_decode_share_access(argp, &open_down->od_share_access,
990 					   &open_down->od_deleg_want, NULL);
991 	if (status)
992 		return status;
993 	status = nfsd4_decode_share_deny(argp, &open_down->od_share_deny);
994 	if (status)
995 		return status;
996 	DECODE_TAIL;
997 }
998 
999 static __be32
1000 nfsd4_decode_putfh(struct nfsd4_compoundargs *argp, struct nfsd4_putfh *putfh)
1001 {
1002 	DECODE_HEAD;
1003 
1004 	READ_BUF(4);
1005 	putfh->pf_fhlen = be32_to_cpup(p++);
1006 	if (putfh->pf_fhlen > NFS4_FHSIZE)
1007 		goto xdr_error;
1008 	READ_BUF(putfh->pf_fhlen);
1009 	SAVEMEM(putfh->pf_fhval, putfh->pf_fhlen);
1010 
1011 	DECODE_TAIL;
1012 }
1013 
1014 static __be32
1015 nfsd4_decode_putpubfh(struct nfsd4_compoundargs *argp, void *p)
1016 {
1017 	if (argp->minorversion == 0)
1018 		return nfs_ok;
1019 	return nfserr_notsupp;
1020 }
1021 
1022 static __be32
1023 nfsd4_decode_read(struct nfsd4_compoundargs *argp, struct nfsd4_read *read)
1024 {
1025 	DECODE_HEAD;
1026 
1027 	status = nfsd4_decode_stateid(argp, &read->rd_stateid);
1028 	if (status)
1029 		return status;
1030 	READ_BUF(12);
1031 	p = xdr_decode_hyper(p, &read->rd_offset);
1032 	read->rd_length = be32_to_cpup(p++);
1033 
1034 	DECODE_TAIL;
1035 }
1036 
1037 static __be32
1038 nfsd4_decode_readdir(struct nfsd4_compoundargs *argp, struct nfsd4_readdir *readdir)
1039 {
1040 	DECODE_HEAD;
1041 
1042 	READ_BUF(24);
1043 	p = xdr_decode_hyper(p, &readdir->rd_cookie);
1044 	COPYMEM(readdir->rd_verf.data, sizeof(readdir->rd_verf.data));
1045 	readdir->rd_dircount = be32_to_cpup(p++);
1046 	readdir->rd_maxcount = be32_to_cpup(p++);
1047 	if ((status = nfsd4_decode_bitmap(argp, readdir->rd_bmval)))
1048 		goto out;
1049 
1050 	DECODE_TAIL;
1051 }
1052 
1053 static __be32
1054 nfsd4_decode_remove(struct nfsd4_compoundargs *argp, struct nfsd4_remove *remove)
1055 {
1056 	DECODE_HEAD;
1057 
1058 	READ_BUF(4);
1059 	remove->rm_namelen = be32_to_cpup(p++);
1060 	READ_BUF(remove->rm_namelen);
1061 	SAVEMEM(remove->rm_name, remove->rm_namelen);
1062 	if ((status = check_filename(remove->rm_name, remove->rm_namelen)))
1063 		return status;
1064 
1065 	DECODE_TAIL;
1066 }
1067 
1068 static __be32
1069 nfsd4_decode_rename(struct nfsd4_compoundargs *argp, struct nfsd4_rename *rename)
1070 {
1071 	DECODE_HEAD;
1072 
1073 	READ_BUF(4);
1074 	rename->rn_snamelen = be32_to_cpup(p++);
1075 	READ_BUF(rename->rn_snamelen);
1076 	SAVEMEM(rename->rn_sname, rename->rn_snamelen);
1077 	READ_BUF(4);
1078 	rename->rn_tnamelen = be32_to_cpup(p++);
1079 	READ_BUF(rename->rn_tnamelen);
1080 	SAVEMEM(rename->rn_tname, rename->rn_tnamelen);
1081 	if ((status = check_filename(rename->rn_sname, rename->rn_snamelen)))
1082 		return status;
1083 	if ((status = check_filename(rename->rn_tname, rename->rn_tnamelen)))
1084 		return status;
1085 
1086 	DECODE_TAIL;
1087 }
1088 
1089 static __be32
1090 nfsd4_decode_renew(struct nfsd4_compoundargs *argp, clientid_t *clientid)
1091 {
1092 	DECODE_HEAD;
1093 
1094 	if (argp->minorversion >= 1)
1095 		return nfserr_notsupp;
1096 
1097 	READ_BUF(sizeof(clientid_t));
1098 	COPYMEM(clientid, sizeof(clientid_t));
1099 
1100 	DECODE_TAIL;
1101 }
1102 
1103 static __be32
1104 nfsd4_decode_secinfo(struct nfsd4_compoundargs *argp,
1105 		     struct nfsd4_secinfo *secinfo)
1106 {
1107 	DECODE_HEAD;
1108 
1109 	READ_BUF(4);
1110 	secinfo->si_namelen = be32_to_cpup(p++);
1111 	READ_BUF(secinfo->si_namelen);
1112 	SAVEMEM(secinfo->si_name, secinfo->si_namelen);
1113 	status = check_filename(secinfo->si_name, secinfo->si_namelen);
1114 	if (status)
1115 		return status;
1116 	DECODE_TAIL;
1117 }
1118 
1119 static __be32
1120 nfsd4_decode_secinfo_no_name(struct nfsd4_compoundargs *argp,
1121 		     struct nfsd4_secinfo_no_name *sin)
1122 {
1123 	DECODE_HEAD;
1124 
1125 	READ_BUF(4);
1126 	sin->sin_style = be32_to_cpup(p++);
1127 	DECODE_TAIL;
1128 }
1129 
1130 static __be32
1131 nfsd4_decode_setattr(struct nfsd4_compoundargs *argp, struct nfsd4_setattr *setattr)
1132 {
1133 	__be32 status;
1134 
1135 	status = nfsd4_decode_stateid(argp, &setattr->sa_stateid);
1136 	if (status)
1137 		return status;
1138 	return nfsd4_decode_fattr(argp, setattr->sa_bmval, &setattr->sa_iattr,
1139 				  &setattr->sa_acl, &setattr->sa_label);
1140 }
1141 
1142 static __be32
1143 nfsd4_decode_setclientid(struct nfsd4_compoundargs *argp, struct nfsd4_setclientid *setclientid)
1144 {
1145 	DECODE_HEAD;
1146 
1147 	if (argp->minorversion >= 1)
1148 		return nfserr_notsupp;
1149 
1150 	READ_BUF(NFS4_VERIFIER_SIZE);
1151 	COPYMEM(setclientid->se_verf.data, NFS4_VERIFIER_SIZE);
1152 
1153 	status = nfsd4_decode_opaque(argp, &setclientid->se_name);
1154 	if (status)
1155 		return nfserr_bad_xdr;
1156 	READ_BUF(8);
1157 	setclientid->se_callback_prog = be32_to_cpup(p++);
1158 	setclientid->se_callback_netid_len = be32_to_cpup(p++);
1159 	READ_BUF(setclientid->se_callback_netid_len);
1160 	SAVEMEM(setclientid->se_callback_netid_val, setclientid->se_callback_netid_len);
1161 	READ_BUF(4);
1162 	setclientid->se_callback_addr_len = be32_to_cpup(p++);
1163 
1164 	READ_BUF(setclientid->se_callback_addr_len);
1165 	SAVEMEM(setclientid->se_callback_addr_val, setclientid->se_callback_addr_len);
1166 	READ_BUF(4);
1167 	setclientid->se_callback_ident = be32_to_cpup(p++);
1168 
1169 	DECODE_TAIL;
1170 }
1171 
1172 static __be32
1173 nfsd4_decode_setclientid_confirm(struct nfsd4_compoundargs *argp, struct nfsd4_setclientid_confirm *scd_c)
1174 {
1175 	DECODE_HEAD;
1176 
1177 	if (argp->minorversion >= 1)
1178 		return nfserr_notsupp;
1179 
1180 	READ_BUF(8 + NFS4_VERIFIER_SIZE);
1181 	COPYMEM(&scd_c->sc_clientid, 8);
1182 	COPYMEM(&scd_c->sc_confirm, NFS4_VERIFIER_SIZE);
1183 
1184 	DECODE_TAIL;
1185 }
1186 
1187 /* Also used for NVERIFY */
1188 static __be32
1189 nfsd4_decode_verify(struct nfsd4_compoundargs *argp, struct nfsd4_verify *verify)
1190 {
1191 	DECODE_HEAD;
1192 
1193 	if ((status = nfsd4_decode_bitmap(argp, verify->ve_bmval)))
1194 		goto out;
1195 
1196 	/* For convenience's sake, we compare raw xdr'd attributes in
1197 	 * nfsd4_proc_verify */
1198 
1199 	READ_BUF(4);
1200 	verify->ve_attrlen = be32_to_cpup(p++);
1201 	READ_BUF(verify->ve_attrlen);
1202 	SAVEMEM(verify->ve_attrval, verify->ve_attrlen);
1203 
1204 	DECODE_TAIL;
1205 }
1206 
1207 static __be32
1208 nfsd4_decode_write(struct nfsd4_compoundargs *argp, struct nfsd4_write *write)
1209 {
1210 	int avail;
1211 	int len;
1212 	DECODE_HEAD;
1213 
1214 	status = nfsd4_decode_stateid(argp, &write->wr_stateid);
1215 	if (status)
1216 		return status;
1217 	READ_BUF(16);
1218 	p = xdr_decode_hyper(p, &write->wr_offset);
1219 	write->wr_stable_how = be32_to_cpup(p++);
1220 	if (write->wr_stable_how > 2)
1221 		goto xdr_error;
1222 	write->wr_buflen = be32_to_cpup(p++);
1223 
1224 	/* Sorry .. no magic macros for this.. *
1225 	 * READ_BUF(write->wr_buflen);
1226 	 * SAVEMEM(write->wr_buf, write->wr_buflen);
1227 	 */
1228 	avail = (char*)argp->end - (char*)argp->p;
1229 	if (avail + argp->pagelen < write->wr_buflen) {
1230 		dprintk("NFSD: xdr error (%s:%d)\n",
1231 				__FILE__, __LINE__);
1232 		goto xdr_error;
1233 	}
1234 	write->wr_head.iov_base = p;
1235 	write->wr_head.iov_len = avail;
1236 	write->wr_pagelist = argp->pagelist;
1237 
1238 	len = XDR_QUADLEN(write->wr_buflen) << 2;
1239 	if (len >= avail) {
1240 		int pages;
1241 
1242 		len -= avail;
1243 
1244 		pages = len >> PAGE_SHIFT;
1245 		argp->pagelist += pages;
1246 		argp->pagelen -= pages * PAGE_SIZE;
1247 		len -= pages * PAGE_SIZE;
1248 
1249 		argp->p = (__be32 *)page_address(argp->pagelist[0]);
1250 		argp->pagelist++;
1251 		argp->end = argp->p + XDR_QUADLEN(PAGE_SIZE);
1252 	}
1253 	argp->p += XDR_QUADLEN(len);
1254 
1255 	DECODE_TAIL;
1256 }
1257 
1258 static __be32
1259 nfsd4_decode_release_lockowner(struct nfsd4_compoundargs *argp, struct nfsd4_release_lockowner *rlockowner)
1260 {
1261 	DECODE_HEAD;
1262 
1263 	if (argp->minorversion >= 1)
1264 		return nfserr_notsupp;
1265 
1266 	READ_BUF(12);
1267 	COPYMEM(&rlockowner->rl_clientid, sizeof(clientid_t));
1268 	rlockowner->rl_owner.len = be32_to_cpup(p++);
1269 	READ_BUF(rlockowner->rl_owner.len);
1270 	READMEM(rlockowner->rl_owner.data, rlockowner->rl_owner.len);
1271 
1272 	if (argp->minorversion && !zero_clientid(&rlockowner->rl_clientid))
1273 		return nfserr_inval;
1274 	DECODE_TAIL;
1275 }
1276 
1277 static __be32
1278 nfsd4_decode_exchange_id(struct nfsd4_compoundargs *argp,
1279 			 struct nfsd4_exchange_id *exid)
1280 {
1281 	int dummy, tmp;
1282 	DECODE_HEAD;
1283 
1284 	READ_BUF(NFS4_VERIFIER_SIZE);
1285 	COPYMEM(exid->verifier.data, NFS4_VERIFIER_SIZE);
1286 
1287 	status = nfsd4_decode_opaque(argp, &exid->clname);
1288 	if (status)
1289 		return nfserr_bad_xdr;
1290 
1291 	READ_BUF(4);
1292 	exid->flags = be32_to_cpup(p++);
1293 
1294 	/* Ignore state_protect4_a */
1295 	READ_BUF(4);
1296 	exid->spa_how = be32_to_cpup(p++);
1297 	switch (exid->spa_how) {
1298 	case SP4_NONE:
1299 		break;
1300 	case SP4_MACH_CRED:
1301 		/* spo_must_enforce */
1302 		status = nfsd4_decode_bitmap(argp,
1303 					exid->spo_must_enforce);
1304 		if (status)
1305 			goto out;
1306 		/* spo_must_allow */
1307 		status = nfsd4_decode_bitmap(argp, exid->spo_must_allow);
1308 		if (status)
1309 			goto out;
1310 		break;
1311 	case SP4_SSV:
1312 		/* ssp_ops */
1313 		READ_BUF(4);
1314 		dummy = be32_to_cpup(p++);
1315 		READ_BUF(dummy * 4);
1316 		p += dummy;
1317 
1318 		READ_BUF(4);
1319 		dummy = be32_to_cpup(p++);
1320 		READ_BUF(dummy * 4);
1321 		p += dummy;
1322 
1323 		/* ssp_hash_algs<> */
1324 		READ_BUF(4);
1325 		tmp = be32_to_cpup(p++);
1326 		while (tmp--) {
1327 			READ_BUF(4);
1328 			dummy = be32_to_cpup(p++);
1329 			READ_BUF(dummy);
1330 			p += XDR_QUADLEN(dummy);
1331 		}
1332 
1333 		/* ssp_encr_algs<> */
1334 		READ_BUF(4);
1335 		tmp = be32_to_cpup(p++);
1336 		while (tmp--) {
1337 			READ_BUF(4);
1338 			dummy = be32_to_cpup(p++);
1339 			READ_BUF(dummy);
1340 			p += XDR_QUADLEN(dummy);
1341 		}
1342 
1343 		/* ssp_window and ssp_num_gss_handles */
1344 		READ_BUF(8);
1345 		dummy = be32_to_cpup(p++);
1346 		dummy = be32_to_cpup(p++);
1347 		break;
1348 	default:
1349 		goto xdr_error;
1350 	}
1351 
1352 	/* Ignore Implementation ID */
1353 	READ_BUF(4);    /* nfs_impl_id4 array length */
1354 	dummy = be32_to_cpup(p++);
1355 
1356 	if (dummy > 1)
1357 		goto xdr_error;
1358 
1359 	if (dummy == 1) {
1360 		/* nii_domain */
1361 		READ_BUF(4);
1362 		dummy = be32_to_cpup(p++);
1363 		READ_BUF(dummy);
1364 		p += XDR_QUADLEN(dummy);
1365 
1366 		/* nii_name */
1367 		READ_BUF(4);
1368 		dummy = be32_to_cpup(p++);
1369 		READ_BUF(dummy);
1370 		p += XDR_QUADLEN(dummy);
1371 
1372 		/* nii_date */
1373 		READ_BUF(12);
1374 		p += 3;
1375 	}
1376 	DECODE_TAIL;
1377 }
1378 
1379 static __be32
1380 nfsd4_decode_create_session(struct nfsd4_compoundargs *argp,
1381 			    struct nfsd4_create_session *sess)
1382 {
1383 	DECODE_HEAD;
1384 	u32 dummy;
1385 
1386 	READ_BUF(16);
1387 	COPYMEM(&sess->clientid, 8);
1388 	sess->seqid = be32_to_cpup(p++);
1389 	sess->flags = be32_to_cpup(p++);
1390 
1391 	/* Fore channel attrs */
1392 	READ_BUF(28);
1393 	dummy = be32_to_cpup(p++); /* headerpadsz is always 0 */
1394 	sess->fore_channel.maxreq_sz = be32_to_cpup(p++);
1395 	sess->fore_channel.maxresp_sz = be32_to_cpup(p++);
1396 	sess->fore_channel.maxresp_cached = be32_to_cpup(p++);
1397 	sess->fore_channel.maxops = be32_to_cpup(p++);
1398 	sess->fore_channel.maxreqs = be32_to_cpup(p++);
1399 	sess->fore_channel.nr_rdma_attrs = be32_to_cpup(p++);
1400 	if (sess->fore_channel.nr_rdma_attrs == 1) {
1401 		READ_BUF(4);
1402 		sess->fore_channel.rdma_attrs = be32_to_cpup(p++);
1403 	} else if (sess->fore_channel.nr_rdma_attrs > 1) {
1404 		dprintk("Too many fore channel attr bitmaps!\n");
1405 		goto xdr_error;
1406 	}
1407 
1408 	/* Back channel attrs */
1409 	READ_BUF(28);
1410 	dummy = be32_to_cpup(p++); /* headerpadsz is always 0 */
1411 	sess->back_channel.maxreq_sz = be32_to_cpup(p++);
1412 	sess->back_channel.maxresp_sz = be32_to_cpup(p++);
1413 	sess->back_channel.maxresp_cached = be32_to_cpup(p++);
1414 	sess->back_channel.maxops = be32_to_cpup(p++);
1415 	sess->back_channel.maxreqs = be32_to_cpup(p++);
1416 	sess->back_channel.nr_rdma_attrs = be32_to_cpup(p++);
1417 	if (sess->back_channel.nr_rdma_attrs == 1) {
1418 		READ_BUF(4);
1419 		sess->back_channel.rdma_attrs = be32_to_cpup(p++);
1420 	} else if (sess->back_channel.nr_rdma_attrs > 1) {
1421 		dprintk("Too many back channel attr bitmaps!\n");
1422 		goto xdr_error;
1423 	}
1424 
1425 	READ_BUF(4);
1426 	sess->callback_prog = be32_to_cpup(p++);
1427 	nfsd4_decode_cb_sec(argp, &sess->cb_sec);
1428 	DECODE_TAIL;
1429 }
1430 
1431 static __be32
1432 nfsd4_decode_destroy_session(struct nfsd4_compoundargs *argp,
1433 			     struct nfsd4_destroy_session *destroy_session)
1434 {
1435 	DECODE_HEAD;
1436 	READ_BUF(NFS4_MAX_SESSIONID_LEN);
1437 	COPYMEM(destroy_session->sessionid.data, NFS4_MAX_SESSIONID_LEN);
1438 
1439 	DECODE_TAIL;
1440 }
1441 
1442 static __be32
1443 nfsd4_decode_free_stateid(struct nfsd4_compoundargs *argp,
1444 			  struct nfsd4_free_stateid *free_stateid)
1445 {
1446 	DECODE_HEAD;
1447 
1448 	READ_BUF(sizeof(stateid_t));
1449 	free_stateid->fr_stateid.si_generation = be32_to_cpup(p++);
1450 	COPYMEM(&free_stateid->fr_stateid.si_opaque, sizeof(stateid_opaque_t));
1451 
1452 	DECODE_TAIL;
1453 }
1454 
1455 static __be32
1456 nfsd4_decode_sequence(struct nfsd4_compoundargs *argp,
1457 		      struct nfsd4_sequence *seq)
1458 {
1459 	DECODE_HEAD;
1460 
1461 	READ_BUF(NFS4_MAX_SESSIONID_LEN + 16);
1462 	COPYMEM(seq->sessionid.data, NFS4_MAX_SESSIONID_LEN);
1463 	seq->seqid = be32_to_cpup(p++);
1464 	seq->slotid = be32_to_cpup(p++);
1465 	seq->maxslots = be32_to_cpup(p++);
1466 	seq->cachethis = be32_to_cpup(p++);
1467 
1468 	DECODE_TAIL;
1469 }
1470 
1471 static __be32
1472 nfsd4_decode_test_stateid(struct nfsd4_compoundargs *argp, struct nfsd4_test_stateid *test_stateid)
1473 {
1474 	int i;
1475 	__be32 *p, status;
1476 	struct nfsd4_test_stateid_id *stateid;
1477 
1478 	READ_BUF(4);
1479 	test_stateid->ts_num_ids = ntohl(*p++);
1480 
1481 	INIT_LIST_HEAD(&test_stateid->ts_stateid_list);
1482 
1483 	for (i = 0; i < test_stateid->ts_num_ids; i++) {
1484 		stateid = svcxdr_tmpalloc(argp, sizeof(*stateid));
1485 		if (!stateid) {
1486 			status = nfserrno(-ENOMEM);
1487 			goto out;
1488 		}
1489 
1490 		INIT_LIST_HEAD(&stateid->ts_id_list);
1491 		list_add_tail(&stateid->ts_id_list, &test_stateid->ts_stateid_list);
1492 
1493 		status = nfsd4_decode_stateid(argp, &stateid->ts_id_stateid);
1494 		if (status)
1495 			goto out;
1496 	}
1497 
1498 	status = 0;
1499 out:
1500 	return status;
1501 xdr_error:
1502 	dprintk("NFSD: xdr error (%s:%d)\n", __FILE__, __LINE__);
1503 	status = nfserr_bad_xdr;
1504 	goto out;
1505 }
1506 
1507 static __be32 nfsd4_decode_destroy_clientid(struct nfsd4_compoundargs *argp, struct nfsd4_destroy_clientid *dc)
1508 {
1509 	DECODE_HEAD;
1510 
1511 	READ_BUF(8);
1512 	COPYMEM(&dc->clientid, 8);
1513 
1514 	DECODE_TAIL;
1515 }
1516 
1517 static __be32 nfsd4_decode_reclaim_complete(struct nfsd4_compoundargs *argp, struct nfsd4_reclaim_complete *rc)
1518 {
1519 	DECODE_HEAD;
1520 
1521 	READ_BUF(4);
1522 	rc->rca_one_fs = be32_to_cpup(p++);
1523 
1524 	DECODE_TAIL;
1525 }
1526 
1527 #ifdef CONFIG_NFSD_PNFS
1528 static __be32
1529 nfsd4_decode_getdeviceinfo(struct nfsd4_compoundargs *argp,
1530 		struct nfsd4_getdeviceinfo *gdev)
1531 {
1532 	DECODE_HEAD;
1533 	u32 num, i;
1534 
1535 	READ_BUF(sizeof(struct nfsd4_deviceid) + 3 * 4);
1536 	COPYMEM(&gdev->gd_devid, sizeof(struct nfsd4_deviceid));
1537 	gdev->gd_layout_type = be32_to_cpup(p++);
1538 	gdev->gd_maxcount = be32_to_cpup(p++);
1539 	num = be32_to_cpup(p++);
1540 	if (num) {
1541 		READ_BUF(4 * num);
1542 		gdev->gd_notify_types = be32_to_cpup(p++);
1543 		for (i = 1; i < num; i++) {
1544 			if (be32_to_cpup(p++)) {
1545 				status = nfserr_inval;
1546 				goto out;
1547 			}
1548 		}
1549 	}
1550 	DECODE_TAIL;
1551 }
1552 
1553 static __be32
1554 nfsd4_decode_layoutget(struct nfsd4_compoundargs *argp,
1555 		struct nfsd4_layoutget *lgp)
1556 {
1557 	DECODE_HEAD;
1558 
1559 	READ_BUF(36);
1560 	lgp->lg_signal = be32_to_cpup(p++);
1561 	lgp->lg_layout_type = be32_to_cpup(p++);
1562 	lgp->lg_seg.iomode = be32_to_cpup(p++);
1563 	p = xdr_decode_hyper(p, &lgp->lg_seg.offset);
1564 	p = xdr_decode_hyper(p, &lgp->lg_seg.length);
1565 	p = xdr_decode_hyper(p, &lgp->lg_minlength);
1566 
1567 	status = nfsd4_decode_stateid(argp, &lgp->lg_sid);
1568 	if (status)
1569 		return status;
1570 
1571 	READ_BUF(4);
1572 	lgp->lg_maxcount = be32_to_cpup(p++);
1573 
1574 	DECODE_TAIL;
1575 }
1576 
1577 static __be32
1578 nfsd4_decode_layoutcommit(struct nfsd4_compoundargs *argp,
1579 		struct nfsd4_layoutcommit *lcp)
1580 {
1581 	DECODE_HEAD;
1582 	u32 timechange;
1583 
1584 	READ_BUF(20);
1585 	p = xdr_decode_hyper(p, &lcp->lc_seg.offset);
1586 	p = xdr_decode_hyper(p, &lcp->lc_seg.length);
1587 	lcp->lc_reclaim = be32_to_cpup(p++);
1588 
1589 	status = nfsd4_decode_stateid(argp, &lcp->lc_sid);
1590 	if (status)
1591 		return status;
1592 
1593 	READ_BUF(4);
1594 	lcp->lc_newoffset = be32_to_cpup(p++);
1595 	if (lcp->lc_newoffset) {
1596 		READ_BUF(8);
1597 		p = xdr_decode_hyper(p, &lcp->lc_last_wr);
1598 	} else
1599 		lcp->lc_last_wr = 0;
1600 	READ_BUF(4);
1601 	timechange = be32_to_cpup(p++);
1602 	if (timechange) {
1603 		status = nfsd4_decode_time(argp, &lcp->lc_mtime);
1604 		if (status)
1605 			return status;
1606 	} else {
1607 		lcp->lc_mtime.tv_nsec = UTIME_NOW;
1608 	}
1609 	READ_BUF(8);
1610 	lcp->lc_layout_type = be32_to_cpup(p++);
1611 
1612 	/*
1613 	 * Save the layout update in XDR format and let the layout driver deal
1614 	 * with it later.
1615 	 */
1616 	lcp->lc_up_len = be32_to_cpup(p++);
1617 	if (lcp->lc_up_len > 0) {
1618 		READ_BUF(lcp->lc_up_len);
1619 		READMEM(lcp->lc_up_layout, lcp->lc_up_len);
1620 	}
1621 
1622 	DECODE_TAIL;
1623 }
1624 
1625 static __be32
1626 nfsd4_decode_layoutreturn(struct nfsd4_compoundargs *argp,
1627 		struct nfsd4_layoutreturn *lrp)
1628 {
1629 	DECODE_HEAD;
1630 
1631 	READ_BUF(16);
1632 	lrp->lr_reclaim = be32_to_cpup(p++);
1633 	lrp->lr_layout_type = be32_to_cpup(p++);
1634 	lrp->lr_seg.iomode = be32_to_cpup(p++);
1635 	lrp->lr_return_type = be32_to_cpup(p++);
1636 	if (lrp->lr_return_type == RETURN_FILE) {
1637 		READ_BUF(16);
1638 		p = xdr_decode_hyper(p, &lrp->lr_seg.offset);
1639 		p = xdr_decode_hyper(p, &lrp->lr_seg.length);
1640 
1641 		status = nfsd4_decode_stateid(argp, &lrp->lr_sid);
1642 		if (status)
1643 			return status;
1644 
1645 		READ_BUF(4);
1646 		lrp->lrf_body_len = be32_to_cpup(p++);
1647 		if (lrp->lrf_body_len > 0) {
1648 			READ_BUF(lrp->lrf_body_len);
1649 			READMEM(lrp->lrf_body, lrp->lrf_body_len);
1650 		}
1651 	} else {
1652 		lrp->lr_seg.offset = 0;
1653 		lrp->lr_seg.length = NFS4_MAX_UINT64;
1654 	}
1655 
1656 	DECODE_TAIL;
1657 }
1658 #endif /* CONFIG_NFSD_PNFS */
1659 
1660 static __be32
1661 nfsd4_decode_fallocate(struct nfsd4_compoundargs *argp,
1662 		       struct nfsd4_fallocate *fallocate)
1663 {
1664 	DECODE_HEAD;
1665 
1666 	status = nfsd4_decode_stateid(argp, &fallocate->falloc_stateid);
1667 	if (status)
1668 		return status;
1669 
1670 	READ_BUF(16);
1671 	p = xdr_decode_hyper(p, &fallocate->falloc_offset);
1672 	xdr_decode_hyper(p, &fallocate->falloc_length);
1673 
1674 	DECODE_TAIL;
1675 }
1676 
1677 static __be32
1678 nfsd4_decode_clone(struct nfsd4_compoundargs *argp, struct nfsd4_clone *clone)
1679 {
1680 	DECODE_HEAD;
1681 
1682 	status = nfsd4_decode_stateid(argp, &clone->cl_src_stateid);
1683 	if (status)
1684 		return status;
1685 	status = nfsd4_decode_stateid(argp, &clone->cl_dst_stateid);
1686 	if (status)
1687 		return status;
1688 
1689 	READ_BUF(8 + 8 + 8);
1690 	p = xdr_decode_hyper(p, &clone->cl_src_pos);
1691 	p = xdr_decode_hyper(p, &clone->cl_dst_pos);
1692 	p = xdr_decode_hyper(p, &clone->cl_count);
1693 	DECODE_TAIL;
1694 }
1695 
1696 static __be32
1697 nfsd4_decode_copy(struct nfsd4_compoundargs *argp, struct nfsd4_copy *copy)
1698 {
1699 	DECODE_HEAD;
1700 	unsigned int tmp;
1701 
1702 	status = nfsd4_decode_stateid(argp, &copy->cp_src_stateid);
1703 	if (status)
1704 		return status;
1705 	status = nfsd4_decode_stateid(argp, &copy->cp_dst_stateid);
1706 	if (status)
1707 		return status;
1708 
1709 	READ_BUF(8 + 8 + 8 + 4 + 4 + 4);
1710 	p = xdr_decode_hyper(p, &copy->cp_src_pos);
1711 	p = xdr_decode_hyper(p, &copy->cp_dst_pos);
1712 	p = xdr_decode_hyper(p, &copy->cp_count);
1713 	copy->cp_consecutive = be32_to_cpup(p++);
1714 	copy->cp_synchronous = be32_to_cpup(p++);
1715 	tmp = be32_to_cpup(p); /* Source server list not supported */
1716 
1717 	DECODE_TAIL;
1718 }
1719 
1720 static __be32
1721 nfsd4_decode_seek(struct nfsd4_compoundargs *argp, struct nfsd4_seek *seek)
1722 {
1723 	DECODE_HEAD;
1724 
1725 	status = nfsd4_decode_stateid(argp, &seek->seek_stateid);
1726 	if (status)
1727 		return status;
1728 
1729 	READ_BUF(8 + 4);
1730 	p = xdr_decode_hyper(p, &seek->seek_offset);
1731 	seek->seek_whence = be32_to_cpup(p);
1732 
1733 	DECODE_TAIL;
1734 }
1735 
1736 static __be32
1737 nfsd4_decode_noop(struct nfsd4_compoundargs *argp, void *p)
1738 {
1739 	return nfs_ok;
1740 }
1741 
1742 static __be32
1743 nfsd4_decode_notsupp(struct nfsd4_compoundargs *argp, void *p)
1744 {
1745 	return nfserr_notsupp;
1746 }
1747 
1748 typedef __be32(*nfsd4_dec)(struct nfsd4_compoundargs *argp, void *);
1749 
1750 static nfsd4_dec nfsd4_dec_ops[] = {
1751 	[OP_ACCESS]		= (nfsd4_dec)nfsd4_decode_access,
1752 	[OP_CLOSE]		= (nfsd4_dec)nfsd4_decode_close,
1753 	[OP_COMMIT]		= (nfsd4_dec)nfsd4_decode_commit,
1754 	[OP_CREATE]		= (nfsd4_dec)nfsd4_decode_create,
1755 	[OP_DELEGPURGE]		= (nfsd4_dec)nfsd4_decode_notsupp,
1756 	[OP_DELEGRETURN]	= (nfsd4_dec)nfsd4_decode_delegreturn,
1757 	[OP_GETATTR]		= (nfsd4_dec)nfsd4_decode_getattr,
1758 	[OP_GETFH]		= (nfsd4_dec)nfsd4_decode_noop,
1759 	[OP_LINK]		= (nfsd4_dec)nfsd4_decode_link,
1760 	[OP_LOCK]		= (nfsd4_dec)nfsd4_decode_lock,
1761 	[OP_LOCKT]		= (nfsd4_dec)nfsd4_decode_lockt,
1762 	[OP_LOCKU]		= (nfsd4_dec)nfsd4_decode_locku,
1763 	[OP_LOOKUP]		= (nfsd4_dec)nfsd4_decode_lookup,
1764 	[OP_LOOKUPP]		= (nfsd4_dec)nfsd4_decode_noop,
1765 	[OP_NVERIFY]		= (nfsd4_dec)nfsd4_decode_verify,
1766 	[OP_OPEN]		= (nfsd4_dec)nfsd4_decode_open,
1767 	[OP_OPENATTR]		= (nfsd4_dec)nfsd4_decode_notsupp,
1768 	[OP_OPEN_CONFIRM]	= (nfsd4_dec)nfsd4_decode_open_confirm,
1769 	[OP_OPEN_DOWNGRADE]	= (nfsd4_dec)nfsd4_decode_open_downgrade,
1770 	[OP_PUTFH]		= (nfsd4_dec)nfsd4_decode_putfh,
1771 	[OP_PUTPUBFH]		= (nfsd4_dec)nfsd4_decode_putpubfh,
1772 	[OP_PUTROOTFH]		= (nfsd4_dec)nfsd4_decode_noop,
1773 	[OP_READ]		= (nfsd4_dec)nfsd4_decode_read,
1774 	[OP_READDIR]		= (nfsd4_dec)nfsd4_decode_readdir,
1775 	[OP_READLINK]		= (nfsd4_dec)nfsd4_decode_noop,
1776 	[OP_REMOVE]		= (nfsd4_dec)nfsd4_decode_remove,
1777 	[OP_RENAME]		= (nfsd4_dec)nfsd4_decode_rename,
1778 	[OP_RENEW]		= (nfsd4_dec)nfsd4_decode_renew,
1779 	[OP_RESTOREFH]		= (nfsd4_dec)nfsd4_decode_noop,
1780 	[OP_SAVEFH]		= (nfsd4_dec)nfsd4_decode_noop,
1781 	[OP_SECINFO]		= (nfsd4_dec)nfsd4_decode_secinfo,
1782 	[OP_SETATTR]		= (nfsd4_dec)nfsd4_decode_setattr,
1783 	[OP_SETCLIENTID]	= (nfsd4_dec)nfsd4_decode_setclientid,
1784 	[OP_SETCLIENTID_CONFIRM] = (nfsd4_dec)nfsd4_decode_setclientid_confirm,
1785 	[OP_VERIFY]		= (nfsd4_dec)nfsd4_decode_verify,
1786 	[OP_WRITE]		= (nfsd4_dec)nfsd4_decode_write,
1787 	[OP_RELEASE_LOCKOWNER]	= (nfsd4_dec)nfsd4_decode_release_lockowner,
1788 
1789 	/* new operations for NFSv4.1 */
1790 	[OP_BACKCHANNEL_CTL]	= (nfsd4_dec)nfsd4_decode_backchannel_ctl,
1791 	[OP_BIND_CONN_TO_SESSION]= (nfsd4_dec)nfsd4_decode_bind_conn_to_session,
1792 	[OP_EXCHANGE_ID]	= (nfsd4_dec)nfsd4_decode_exchange_id,
1793 	[OP_CREATE_SESSION]	= (nfsd4_dec)nfsd4_decode_create_session,
1794 	[OP_DESTROY_SESSION]	= (nfsd4_dec)nfsd4_decode_destroy_session,
1795 	[OP_FREE_STATEID]	= (nfsd4_dec)nfsd4_decode_free_stateid,
1796 	[OP_GET_DIR_DELEGATION]	= (nfsd4_dec)nfsd4_decode_notsupp,
1797 #ifdef CONFIG_NFSD_PNFS
1798 	[OP_GETDEVICEINFO]	= (nfsd4_dec)nfsd4_decode_getdeviceinfo,
1799 	[OP_GETDEVICELIST]	= (nfsd4_dec)nfsd4_decode_notsupp,
1800 	[OP_LAYOUTCOMMIT]	= (nfsd4_dec)nfsd4_decode_layoutcommit,
1801 	[OP_LAYOUTGET]		= (nfsd4_dec)nfsd4_decode_layoutget,
1802 	[OP_LAYOUTRETURN]	= (nfsd4_dec)nfsd4_decode_layoutreturn,
1803 #else
1804 	[OP_GETDEVICEINFO]	= (nfsd4_dec)nfsd4_decode_notsupp,
1805 	[OP_GETDEVICELIST]	= (nfsd4_dec)nfsd4_decode_notsupp,
1806 	[OP_LAYOUTCOMMIT]	= (nfsd4_dec)nfsd4_decode_notsupp,
1807 	[OP_LAYOUTGET]		= (nfsd4_dec)nfsd4_decode_notsupp,
1808 	[OP_LAYOUTRETURN]	= (nfsd4_dec)nfsd4_decode_notsupp,
1809 #endif
1810 	[OP_SECINFO_NO_NAME]	= (nfsd4_dec)nfsd4_decode_secinfo_no_name,
1811 	[OP_SEQUENCE]		= (nfsd4_dec)nfsd4_decode_sequence,
1812 	[OP_SET_SSV]		= (nfsd4_dec)nfsd4_decode_notsupp,
1813 	[OP_TEST_STATEID]	= (nfsd4_dec)nfsd4_decode_test_stateid,
1814 	[OP_WANT_DELEGATION]	= (nfsd4_dec)nfsd4_decode_notsupp,
1815 	[OP_DESTROY_CLIENTID]	= (nfsd4_dec)nfsd4_decode_destroy_clientid,
1816 	[OP_RECLAIM_COMPLETE]	= (nfsd4_dec)nfsd4_decode_reclaim_complete,
1817 
1818 	/* new operations for NFSv4.2 */
1819 	[OP_ALLOCATE]		= (nfsd4_dec)nfsd4_decode_fallocate,
1820 	[OP_COPY]		= (nfsd4_dec)nfsd4_decode_copy,
1821 	[OP_COPY_NOTIFY]	= (nfsd4_dec)nfsd4_decode_notsupp,
1822 	[OP_DEALLOCATE]		= (nfsd4_dec)nfsd4_decode_fallocate,
1823 	[OP_IO_ADVISE]		= (nfsd4_dec)nfsd4_decode_notsupp,
1824 	[OP_LAYOUTERROR]	= (nfsd4_dec)nfsd4_decode_notsupp,
1825 	[OP_LAYOUTSTATS]	= (nfsd4_dec)nfsd4_decode_notsupp,
1826 	[OP_OFFLOAD_CANCEL]	= (nfsd4_dec)nfsd4_decode_notsupp,
1827 	[OP_OFFLOAD_STATUS]	= (nfsd4_dec)nfsd4_decode_notsupp,
1828 	[OP_READ_PLUS]		= (nfsd4_dec)nfsd4_decode_notsupp,
1829 	[OP_SEEK]		= (nfsd4_dec)nfsd4_decode_seek,
1830 	[OP_WRITE_SAME]		= (nfsd4_dec)nfsd4_decode_notsupp,
1831 	[OP_CLONE]		= (nfsd4_dec)nfsd4_decode_clone,
1832 };
1833 
1834 static inline bool
1835 nfsd4_opnum_in_range(struct nfsd4_compoundargs *argp, struct nfsd4_op *op)
1836 {
1837 	if (op->opnum < FIRST_NFS4_OP)
1838 		return false;
1839 	else if (argp->minorversion == 0 && op->opnum > LAST_NFS40_OP)
1840 		return false;
1841 	else if (argp->minorversion == 1 && op->opnum > LAST_NFS41_OP)
1842 		return false;
1843 	else if (argp->minorversion == 2 && op->opnum > LAST_NFS42_OP)
1844 		return false;
1845 	return true;
1846 }
1847 
1848 static __be32
1849 nfsd4_decode_compound(struct nfsd4_compoundargs *argp)
1850 {
1851 	DECODE_HEAD;
1852 	struct nfsd4_op *op;
1853 	bool cachethis = false;
1854 	int auth_slack= argp->rqstp->rq_auth_slack;
1855 	int max_reply = auth_slack + 8; /* opcnt, status */
1856 	int readcount = 0;
1857 	int readbytes = 0;
1858 	int i;
1859 
1860 	READ_BUF(4);
1861 	argp->taglen = be32_to_cpup(p++);
1862 	READ_BUF(argp->taglen);
1863 	SAVEMEM(argp->tag, argp->taglen);
1864 	READ_BUF(8);
1865 	argp->minorversion = be32_to_cpup(p++);
1866 	argp->opcnt = be32_to_cpup(p++);
1867 	max_reply += 4 + (XDR_QUADLEN(argp->taglen) << 2);
1868 
1869 	if (argp->taglen > NFSD4_MAX_TAGLEN)
1870 		goto xdr_error;
1871 	if (argp->opcnt > 100)
1872 		goto xdr_error;
1873 
1874 	if (argp->opcnt > ARRAY_SIZE(argp->iops)) {
1875 		argp->ops = kzalloc(argp->opcnt * sizeof(*argp->ops), GFP_KERNEL);
1876 		if (!argp->ops) {
1877 			argp->ops = argp->iops;
1878 			dprintk("nfsd: couldn't allocate room for COMPOUND\n");
1879 			goto xdr_error;
1880 		}
1881 	}
1882 
1883 	if (argp->minorversion > NFSD_SUPPORTED_MINOR_VERSION)
1884 		argp->opcnt = 0;
1885 
1886 	for (i = 0; i < argp->opcnt; i++) {
1887 		op = &argp->ops[i];
1888 		op->replay = NULL;
1889 
1890 		READ_BUF(4);
1891 		op->opnum = be32_to_cpup(p++);
1892 
1893 		if (nfsd4_opnum_in_range(argp, op))
1894 			op->status = nfsd4_dec_ops[op->opnum](argp, &op->u);
1895 		else {
1896 			op->opnum = OP_ILLEGAL;
1897 			op->status = nfserr_op_illegal;
1898 		}
1899 		/*
1900 		 * We'll try to cache the result in the DRC if any one
1901 		 * op in the compound wants to be cached:
1902 		 */
1903 		cachethis |= nfsd4_cache_this_op(op);
1904 
1905 		if (op->opnum == OP_READ) {
1906 			readcount++;
1907 			readbytes += nfsd4_max_reply(argp->rqstp, op);
1908 		} else
1909 			max_reply += nfsd4_max_reply(argp->rqstp, op);
1910 		/*
1911 		 * OP_LOCK may return a conflicting lock.  (Special case
1912 		 * because it will just skip encoding this if it runs
1913 		 * out of xdr buffer space, and it is the only operation
1914 		 * that behaves this way.)
1915 		 */
1916 		if (op->opnum == OP_LOCK)
1917 			max_reply += NFS4_OPAQUE_LIMIT;
1918 
1919 		if (op->status) {
1920 			argp->opcnt = i+1;
1921 			break;
1922 		}
1923 	}
1924 	/* Sessions make the DRC unnecessary: */
1925 	if (argp->minorversion)
1926 		cachethis = false;
1927 	svc_reserve(argp->rqstp, max_reply + readbytes);
1928 	argp->rqstp->rq_cachetype = cachethis ? RC_REPLBUFF : RC_NOCACHE;
1929 
1930 	if (readcount > 1 || max_reply > PAGE_SIZE - auth_slack)
1931 		clear_bit(RQ_SPLICE_OK, &argp->rqstp->rq_flags);
1932 
1933 	DECODE_TAIL;
1934 }
1935 
1936 static __be32 *encode_change(__be32 *p, struct kstat *stat, struct inode *inode)
1937 {
1938 	if (IS_I_VERSION(inode)) {
1939 		p = xdr_encode_hyper(p, inode->i_version);
1940 	} else {
1941 		*p++ = cpu_to_be32(stat->ctime.tv_sec);
1942 		*p++ = cpu_to_be32(stat->ctime.tv_nsec);
1943 	}
1944 	return p;
1945 }
1946 
1947 static __be32 *encode_cinfo(__be32 *p, struct nfsd4_change_info *c)
1948 {
1949 	*p++ = cpu_to_be32(c->atomic);
1950 	if (c->change_supported) {
1951 		p = xdr_encode_hyper(p, c->before_change);
1952 		p = xdr_encode_hyper(p, c->after_change);
1953 	} else {
1954 		*p++ = cpu_to_be32(c->before_ctime_sec);
1955 		*p++ = cpu_to_be32(c->before_ctime_nsec);
1956 		*p++ = cpu_to_be32(c->after_ctime_sec);
1957 		*p++ = cpu_to_be32(c->after_ctime_nsec);
1958 	}
1959 	return p;
1960 }
1961 
1962 /* Encode as an array of strings the string given with components
1963  * separated @sep, escaped with esc_enter and esc_exit.
1964  */
1965 static __be32 nfsd4_encode_components_esc(struct xdr_stream *xdr, char sep,
1966 					  char *components, char esc_enter,
1967 					  char esc_exit)
1968 {
1969 	__be32 *p;
1970 	__be32 pathlen;
1971 	int pathlen_offset;
1972 	int strlen, count=0;
1973 	char *str, *end, *next;
1974 
1975 	dprintk("nfsd4_encode_components(%s)\n", components);
1976 
1977 	pathlen_offset = xdr->buf->len;
1978 	p = xdr_reserve_space(xdr, 4);
1979 	if (!p)
1980 		return nfserr_resource;
1981 	p++; /* We will fill this in with @count later */
1982 
1983 	end = str = components;
1984 	while (*end) {
1985 		bool found_esc = false;
1986 
1987 		/* try to parse as esc_start, ..., esc_end, sep */
1988 		if (*str == esc_enter) {
1989 			for (; *end && (*end != esc_exit); end++)
1990 				/* find esc_exit or end of string */;
1991 			next = end + 1;
1992 			if (*end && (!*next || *next == sep)) {
1993 				str++;
1994 				found_esc = true;
1995 			}
1996 		}
1997 
1998 		if (!found_esc)
1999 			for (; *end && (*end != sep); end++)
2000 				/* find sep or end of string */;
2001 
2002 		strlen = end - str;
2003 		if (strlen) {
2004 			p = xdr_reserve_space(xdr, strlen + 4);
2005 			if (!p)
2006 				return nfserr_resource;
2007 			p = xdr_encode_opaque(p, str, strlen);
2008 			count++;
2009 		}
2010 		else
2011 			end++;
2012 		if (found_esc)
2013 			end = next;
2014 
2015 		str = end;
2016 	}
2017 	pathlen = htonl(count);
2018 	write_bytes_to_xdr_buf(xdr->buf, pathlen_offset, &pathlen, 4);
2019 	return 0;
2020 }
2021 
2022 /* Encode as an array of strings the string given with components
2023  * separated @sep.
2024  */
2025 static __be32 nfsd4_encode_components(struct xdr_stream *xdr, char sep,
2026 				      char *components)
2027 {
2028 	return nfsd4_encode_components_esc(xdr, sep, components, 0, 0);
2029 }
2030 
2031 /*
2032  * encode a location element of a fs_locations structure
2033  */
2034 static __be32 nfsd4_encode_fs_location4(struct xdr_stream *xdr,
2035 					struct nfsd4_fs_location *location)
2036 {
2037 	__be32 status;
2038 
2039 	status = nfsd4_encode_components_esc(xdr, ':', location->hosts,
2040 						'[', ']');
2041 	if (status)
2042 		return status;
2043 	status = nfsd4_encode_components(xdr, '/', location->path);
2044 	if (status)
2045 		return status;
2046 	return 0;
2047 }
2048 
2049 /*
2050  * Encode a path in RFC3530 'pathname4' format
2051  */
2052 static __be32 nfsd4_encode_path(struct xdr_stream *xdr,
2053 				const struct path *root,
2054 				const struct path *path)
2055 {
2056 	struct path cur = *path;
2057 	__be32 *p;
2058 	struct dentry **components = NULL;
2059 	unsigned int ncomponents = 0;
2060 	__be32 err = nfserr_jukebox;
2061 
2062 	dprintk("nfsd4_encode_components(");
2063 
2064 	path_get(&cur);
2065 	/* First walk the path up to the nfsd root, and store the
2066 	 * dentries/path components in an array.
2067 	 */
2068 	for (;;) {
2069 		if (path_equal(&cur, root))
2070 			break;
2071 		if (cur.dentry == cur.mnt->mnt_root) {
2072 			if (follow_up(&cur))
2073 				continue;
2074 			goto out_free;
2075 		}
2076 		if ((ncomponents & 15) == 0) {
2077 			struct dentry **new;
2078 			new = krealloc(components,
2079 					sizeof(*new) * (ncomponents + 16),
2080 					GFP_KERNEL);
2081 			if (!new)
2082 				goto out_free;
2083 			components = new;
2084 		}
2085 		components[ncomponents++] = cur.dentry;
2086 		cur.dentry = dget_parent(cur.dentry);
2087 	}
2088 	err = nfserr_resource;
2089 	p = xdr_reserve_space(xdr, 4);
2090 	if (!p)
2091 		goto out_free;
2092 	*p++ = cpu_to_be32(ncomponents);
2093 
2094 	while (ncomponents) {
2095 		struct dentry *dentry = components[ncomponents - 1];
2096 		unsigned int len;
2097 
2098 		spin_lock(&dentry->d_lock);
2099 		len = dentry->d_name.len;
2100 		p = xdr_reserve_space(xdr, len + 4);
2101 		if (!p) {
2102 			spin_unlock(&dentry->d_lock);
2103 			goto out_free;
2104 		}
2105 		p = xdr_encode_opaque(p, dentry->d_name.name, len);
2106 		dprintk("/%pd", dentry);
2107 		spin_unlock(&dentry->d_lock);
2108 		dput(dentry);
2109 		ncomponents--;
2110 	}
2111 
2112 	err = 0;
2113 out_free:
2114 	dprintk(")\n");
2115 	while (ncomponents)
2116 		dput(components[--ncomponents]);
2117 	kfree(components);
2118 	path_put(&cur);
2119 	return err;
2120 }
2121 
2122 static __be32 nfsd4_encode_fsloc_fsroot(struct xdr_stream *xdr,
2123 			struct svc_rqst *rqstp, const struct path *path)
2124 {
2125 	struct svc_export *exp_ps;
2126 	__be32 res;
2127 
2128 	exp_ps = rqst_find_fsidzero_export(rqstp);
2129 	if (IS_ERR(exp_ps))
2130 		return nfserrno(PTR_ERR(exp_ps));
2131 	res = nfsd4_encode_path(xdr, &exp_ps->ex_path, path);
2132 	exp_put(exp_ps);
2133 	return res;
2134 }
2135 
2136 /*
2137  *  encode a fs_locations structure
2138  */
2139 static __be32 nfsd4_encode_fs_locations(struct xdr_stream *xdr,
2140 			struct svc_rqst *rqstp, struct svc_export *exp)
2141 {
2142 	__be32 status;
2143 	int i;
2144 	__be32 *p;
2145 	struct nfsd4_fs_locations *fslocs = &exp->ex_fslocs;
2146 
2147 	status = nfsd4_encode_fsloc_fsroot(xdr, rqstp, &exp->ex_path);
2148 	if (status)
2149 		return status;
2150 	p = xdr_reserve_space(xdr, 4);
2151 	if (!p)
2152 		return nfserr_resource;
2153 	*p++ = cpu_to_be32(fslocs->locations_count);
2154 	for (i=0; i<fslocs->locations_count; i++) {
2155 		status = nfsd4_encode_fs_location4(xdr, &fslocs->locations[i]);
2156 		if (status)
2157 			return status;
2158 	}
2159 	return 0;
2160 }
2161 
2162 static u32 nfs4_file_type(umode_t mode)
2163 {
2164 	switch (mode & S_IFMT) {
2165 	case S_IFIFO:	return NF4FIFO;
2166 	case S_IFCHR:	return NF4CHR;
2167 	case S_IFDIR:	return NF4DIR;
2168 	case S_IFBLK:	return NF4BLK;
2169 	case S_IFLNK:	return NF4LNK;
2170 	case S_IFREG:	return NF4REG;
2171 	case S_IFSOCK:	return NF4SOCK;
2172 	default:	return NF4BAD;
2173 	};
2174 }
2175 
2176 static inline __be32
2177 nfsd4_encode_aclname(struct xdr_stream *xdr, struct svc_rqst *rqstp,
2178 		     struct nfs4_ace *ace)
2179 {
2180 	if (ace->whotype != NFS4_ACL_WHO_NAMED)
2181 		return nfs4_acl_write_who(xdr, ace->whotype);
2182 	else if (ace->flag & NFS4_ACE_IDENTIFIER_GROUP)
2183 		return nfsd4_encode_group(xdr, rqstp, ace->who_gid);
2184 	else
2185 		return nfsd4_encode_user(xdr, rqstp, ace->who_uid);
2186 }
2187 
2188 static inline __be32
2189 nfsd4_encode_layout_types(struct xdr_stream *xdr, u32 layout_types)
2190 {
2191 	__be32		*p;
2192 	unsigned long	i = hweight_long(layout_types);
2193 
2194 	p = xdr_reserve_space(xdr, 4 + 4 * i);
2195 	if (!p)
2196 		return nfserr_resource;
2197 
2198 	*p++ = cpu_to_be32(i);
2199 
2200 	for (i = LAYOUT_NFSV4_1_FILES; i < LAYOUT_TYPE_MAX; ++i)
2201 		if (layout_types & (1 << i))
2202 			*p++ = cpu_to_be32(i);
2203 
2204 	return 0;
2205 }
2206 
2207 #define WORD0_ABSENT_FS_ATTRS (FATTR4_WORD0_FS_LOCATIONS | FATTR4_WORD0_FSID | \
2208 			      FATTR4_WORD0_RDATTR_ERROR)
2209 #define WORD1_ABSENT_FS_ATTRS FATTR4_WORD1_MOUNTED_ON_FILEID
2210 #define WORD2_ABSENT_FS_ATTRS 0
2211 
2212 #ifdef CONFIG_NFSD_V4_SECURITY_LABEL
2213 static inline __be32
2214 nfsd4_encode_security_label(struct xdr_stream *xdr, struct svc_rqst *rqstp,
2215 			    void *context, int len)
2216 {
2217 	__be32 *p;
2218 
2219 	p = xdr_reserve_space(xdr, len + 4 + 4 + 4);
2220 	if (!p)
2221 		return nfserr_resource;
2222 
2223 	/*
2224 	 * For now we use a 0 here to indicate the null translation; in
2225 	 * the future we may place a call to translation code here.
2226 	 */
2227 	*p++ = cpu_to_be32(0); /* lfs */
2228 	*p++ = cpu_to_be32(0); /* pi */
2229 	p = xdr_encode_opaque(p, context, len);
2230 	return 0;
2231 }
2232 #else
2233 static inline __be32
2234 nfsd4_encode_security_label(struct xdr_stream *xdr, struct svc_rqst *rqstp,
2235 			    void *context, int len)
2236 { return 0; }
2237 #endif
2238 
2239 static __be32 fattr_handle_absent_fs(u32 *bmval0, u32 *bmval1, u32 *bmval2, u32 *rdattr_err)
2240 {
2241 	/* As per referral draft:  */
2242 	if (*bmval0 & ~WORD0_ABSENT_FS_ATTRS ||
2243 	    *bmval1 & ~WORD1_ABSENT_FS_ATTRS) {
2244 		if (*bmval0 & FATTR4_WORD0_RDATTR_ERROR ||
2245 	            *bmval0 & FATTR4_WORD0_FS_LOCATIONS)
2246 			*rdattr_err = NFSERR_MOVED;
2247 		else
2248 			return nfserr_moved;
2249 	}
2250 	*bmval0 &= WORD0_ABSENT_FS_ATTRS;
2251 	*bmval1 &= WORD1_ABSENT_FS_ATTRS;
2252 	*bmval2 &= WORD2_ABSENT_FS_ATTRS;
2253 	return 0;
2254 }
2255 
2256 
2257 static int get_parent_attributes(struct svc_export *exp, struct kstat *stat)
2258 {
2259 	struct path path = exp->ex_path;
2260 	int err;
2261 
2262 	path_get(&path);
2263 	while (follow_up(&path)) {
2264 		if (path.dentry != path.mnt->mnt_root)
2265 			break;
2266 	}
2267 	err = vfs_getattr(&path, stat);
2268 	path_put(&path);
2269 	return err;
2270 }
2271 
2272 static __be32
2273 nfsd4_encode_bitmap(struct xdr_stream *xdr, u32 bmval0, u32 bmval1, u32 bmval2)
2274 {
2275 	__be32 *p;
2276 
2277 	if (bmval2) {
2278 		p = xdr_reserve_space(xdr, 16);
2279 		if (!p)
2280 			goto out_resource;
2281 		*p++ = cpu_to_be32(3);
2282 		*p++ = cpu_to_be32(bmval0);
2283 		*p++ = cpu_to_be32(bmval1);
2284 		*p++ = cpu_to_be32(bmval2);
2285 	} else if (bmval1) {
2286 		p = xdr_reserve_space(xdr, 12);
2287 		if (!p)
2288 			goto out_resource;
2289 		*p++ = cpu_to_be32(2);
2290 		*p++ = cpu_to_be32(bmval0);
2291 		*p++ = cpu_to_be32(bmval1);
2292 	} else {
2293 		p = xdr_reserve_space(xdr, 8);
2294 		if (!p)
2295 			goto out_resource;
2296 		*p++ = cpu_to_be32(1);
2297 		*p++ = cpu_to_be32(bmval0);
2298 	}
2299 
2300 	return 0;
2301 out_resource:
2302 	return nfserr_resource;
2303 }
2304 
2305 /*
2306  * Note: @fhp can be NULL; in this case, we might have to compose the filehandle
2307  * ourselves.
2308  */
2309 static __be32
2310 nfsd4_encode_fattr(struct xdr_stream *xdr, struct svc_fh *fhp,
2311 		struct svc_export *exp,
2312 		struct dentry *dentry, u32 *bmval,
2313 		struct svc_rqst *rqstp, int ignore_crossmnt)
2314 {
2315 	u32 bmval0 = bmval[0];
2316 	u32 bmval1 = bmval[1];
2317 	u32 bmval2 = bmval[2];
2318 	struct kstat stat;
2319 	struct svc_fh *tempfh = NULL;
2320 	struct kstatfs statfs;
2321 	__be32 *p;
2322 	int starting_len = xdr->buf->len;
2323 	int attrlen_offset;
2324 	__be32 attrlen;
2325 	u32 dummy;
2326 	u64 dummy64;
2327 	u32 rdattr_err = 0;
2328 	__be32 status;
2329 	int err;
2330 	struct nfs4_acl *acl = NULL;
2331 	void *context = NULL;
2332 	int contextlen;
2333 	bool contextsupport = false;
2334 	struct nfsd4_compoundres *resp = rqstp->rq_resp;
2335 	u32 minorversion = resp->cstate.minorversion;
2336 	struct path path = {
2337 		.mnt	= exp->ex_path.mnt,
2338 		.dentry	= dentry,
2339 	};
2340 	struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
2341 
2342 	BUG_ON(bmval1 & NFSD_WRITEONLY_ATTRS_WORD1);
2343 	BUG_ON(bmval0 & ~nfsd_suppattrs0(minorversion));
2344 	BUG_ON(bmval1 & ~nfsd_suppattrs1(minorversion));
2345 	BUG_ON(bmval2 & ~nfsd_suppattrs2(minorversion));
2346 
2347 	if (exp->ex_fslocs.migrated) {
2348 		status = fattr_handle_absent_fs(&bmval0, &bmval1, &bmval2, &rdattr_err);
2349 		if (status)
2350 			goto out;
2351 	}
2352 
2353 	err = vfs_getattr(&path, &stat);
2354 	if (err)
2355 		goto out_nfserr;
2356 	if ((bmval0 & (FATTR4_WORD0_FILES_AVAIL | FATTR4_WORD0_FILES_FREE |
2357 			FATTR4_WORD0_FILES_TOTAL | FATTR4_WORD0_MAXNAME)) ||
2358 	    (bmval1 & (FATTR4_WORD1_SPACE_AVAIL | FATTR4_WORD1_SPACE_FREE |
2359 		       FATTR4_WORD1_SPACE_TOTAL))) {
2360 		err = vfs_statfs(&path, &statfs);
2361 		if (err)
2362 			goto out_nfserr;
2363 	}
2364 	if ((bmval0 & (FATTR4_WORD0_FILEHANDLE | FATTR4_WORD0_FSID)) && !fhp) {
2365 		tempfh = kmalloc(sizeof(struct svc_fh), GFP_KERNEL);
2366 		status = nfserr_jukebox;
2367 		if (!tempfh)
2368 			goto out;
2369 		fh_init(tempfh, NFS4_FHSIZE);
2370 		status = fh_compose(tempfh, exp, dentry, NULL);
2371 		if (status)
2372 			goto out;
2373 		fhp = tempfh;
2374 	}
2375 	if (bmval0 & FATTR4_WORD0_ACL) {
2376 		err = nfsd4_get_nfs4_acl(rqstp, dentry, &acl);
2377 		if (err == -EOPNOTSUPP)
2378 			bmval0 &= ~FATTR4_WORD0_ACL;
2379 		else if (err == -EINVAL) {
2380 			status = nfserr_attrnotsupp;
2381 			goto out;
2382 		} else if (err != 0)
2383 			goto out_nfserr;
2384 	}
2385 
2386 #ifdef CONFIG_NFSD_V4_SECURITY_LABEL
2387 	if ((bmval2 & FATTR4_WORD2_SECURITY_LABEL) ||
2388 	     bmval0 & FATTR4_WORD0_SUPPORTED_ATTRS) {
2389 		err = security_inode_getsecctx(d_inode(dentry),
2390 						&context, &contextlen);
2391 		contextsupport = (err == 0);
2392 		if (bmval2 & FATTR4_WORD2_SECURITY_LABEL) {
2393 			if (err == -EOPNOTSUPP)
2394 				bmval2 &= ~FATTR4_WORD2_SECURITY_LABEL;
2395 			else if (err)
2396 				goto out_nfserr;
2397 		}
2398 	}
2399 #endif /* CONFIG_NFSD_V4_SECURITY_LABEL */
2400 
2401 	status = nfsd4_encode_bitmap(xdr, bmval0, bmval1, bmval2);
2402 	if (status)
2403 		goto out;
2404 
2405 	attrlen_offset = xdr->buf->len;
2406 	p = xdr_reserve_space(xdr, 4);
2407 	if (!p)
2408 		goto out_resource;
2409 	p++;                /* to be backfilled later */
2410 
2411 	if (bmval0 & FATTR4_WORD0_SUPPORTED_ATTRS) {
2412 		u32 word0 = nfsd_suppattrs0(minorversion);
2413 		u32 word1 = nfsd_suppattrs1(minorversion);
2414 		u32 word2 = nfsd_suppattrs2(minorversion);
2415 
2416 		if (!IS_POSIXACL(dentry->d_inode))
2417 			word0 &= ~FATTR4_WORD0_ACL;
2418 		if (!contextsupport)
2419 			word2 &= ~FATTR4_WORD2_SECURITY_LABEL;
2420 		if (!word2) {
2421 			p = xdr_reserve_space(xdr, 12);
2422 			if (!p)
2423 				goto out_resource;
2424 			*p++ = cpu_to_be32(2);
2425 			*p++ = cpu_to_be32(word0);
2426 			*p++ = cpu_to_be32(word1);
2427 		} else {
2428 			p = xdr_reserve_space(xdr, 16);
2429 			if (!p)
2430 				goto out_resource;
2431 			*p++ = cpu_to_be32(3);
2432 			*p++ = cpu_to_be32(word0);
2433 			*p++ = cpu_to_be32(word1);
2434 			*p++ = cpu_to_be32(word2);
2435 		}
2436 	}
2437 	if (bmval0 & FATTR4_WORD0_TYPE) {
2438 		p = xdr_reserve_space(xdr, 4);
2439 		if (!p)
2440 			goto out_resource;
2441 		dummy = nfs4_file_type(stat.mode);
2442 		if (dummy == NF4BAD) {
2443 			status = nfserr_serverfault;
2444 			goto out;
2445 		}
2446 		*p++ = cpu_to_be32(dummy);
2447 	}
2448 	if (bmval0 & FATTR4_WORD0_FH_EXPIRE_TYPE) {
2449 		p = xdr_reserve_space(xdr, 4);
2450 		if (!p)
2451 			goto out_resource;
2452 		if (exp->ex_flags & NFSEXP_NOSUBTREECHECK)
2453 			*p++ = cpu_to_be32(NFS4_FH_PERSISTENT);
2454 		else
2455 			*p++ = cpu_to_be32(NFS4_FH_PERSISTENT|
2456 						NFS4_FH_VOL_RENAME);
2457 	}
2458 	if (bmval0 & FATTR4_WORD0_CHANGE) {
2459 		p = xdr_reserve_space(xdr, 8);
2460 		if (!p)
2461 			goto out_resource;
2462 		p = encode_change(p, &stat, d_inode(dentry));
2463 	}
2464 	if (bmval0 & FATTR4_WORD0_SIZE) {
2465 		p = xdr_reserve_space(xdr, 8);
2466 		if (!p)
2467 			goto out_resource;
2468 		p = xdr_encode_hyper(p, stat.size);
2469 	}
2470 	if (bmval0 & FATTR4_WORD0_LINK_SUPPORT) {
2471 		p = xdr_reserve_space(xdr, 4);
2472 		if (!p)
2473 			goto out_resource;
2474 		*p++ = cpu_to_be32(1);
2475 	}
2476 	if (bmval0 & FATTR4_WORD0_SYMLINK_SUPPORT) {
2477 		p = xdr_reserve_space(xdr, 4);
2478 		if (!p)
2479 			goto out_resource;
2480 		*p++ = cpu_to_be32(1);
2481 	}
2482 	if (bmval0 & FATTR4_WORD0_NAMED_ATTR) {
2483 		p = xdr_reserve_space(xdr, 4);
2484 		if (!p)
2485 			goto out_resource;
2486 		*p++ = cpu_to_be32(0);
2487 	}
2488 	if (bmval0 & FATTR4_WORD0_FSID) {
2489 		p = xdr_reserve_space(xdr, 16);
2490 		if (!p)
2491 			goto out_resource;
2492 		if (exp->ex_fslocs.migrated) {
2493 			p = xdr_encode_hyper(p, NFS4_REFERRAL_FSID_MAJOR);
2494 			p = xdr_encode_hyper(p, NFS4_REFERRAL_FSID_MINOR);
2495 		} else switch(fsid_source(fhp)) {
2496 		case FSIDSOURCE_FSID:
2497 			p = xdr_encode_hyper(p, (u64)exp->ex_fsid);
2498 			p = xdr_encode_hyper(p, (u64)0);
2499 			break;
2500 		case FSIDSOURCE_DEV:
2501 			*p++ = cpu_to_be32(0);
2502 			*p++ = cpu_to_be32(MAJOR(stat.dev));
2503 			*p++ = cpu_to_be32(0);
2504 			*p++ = cpu_to_be32(MINOR(stat.dev));
2505 			break;
2506 		case FSIDSOURCE_UUID:
2507 			p = xdr_encode_opaque_fixed(p, exp->ex_uuid,
2508 								EX_UUID_LEN);
2509 			break;
2510 		}
2511 	}
2512 	if (bmval0 & FATTR4_WORD0_UNIQUE_HANDLES) {
2513 		p = xdr_reserve_space(xdr, 4);
2514 		if (!p)
2515 			goto out_resource;
2516 		*p++ = cpu_to_be32(0);
2517 	}
2518 	if (bmval0 & FATTR4_WORD0_LEASE_TIME) {
2519 		p = xdr_reserve_space(xdr, 4);
2520 		if (!p)
2521 			goto out_resource;
2522 		*p++ = cpu_to_be32(nn->nfsd4_lease);
2523 	}
2524 	if (bmval0 & FATTR4_WORD0_RDATTR_ERROR) {
2525 		p = xdr_reserve_space(xdr, 4);
2526 		if (!p)
2527 			goto out_resource;
2528 		*p++ = cpu_to_be32(rdattr_err);
2529 	}
2530 	if (bmval0 & FATTR4_WORD0_ACL) {
2531 		struct nfs4_ace *ace;
2532 
2533 		if (acl == NULL) {
2534 			p = xdr_reserve_space(xdr, 4);
2535 			if (!p)
2536 				goto out_resource;
2537 
2538 			*p++ = cpu_to_be32(0);
2539 			goto out_acl;
2540 		}
2541 		p = xdr_reserve_space(xdr, 4);
2542 		if (!p)
2543 			goto out_resource;
2544 		*p++ = cpu_to_be32(acl->naces);
2545 
2546 		for (ace = acl->aces; ace < acl->aces + acl->naces; ace++) {
2547 			p = xdr_reserve_space(xdr, 4*3);
2548 			if (!p)
2549 				goto out_resource;
2550 			*p++ = cpu_to_be32(ace->type);
2551 			*p++ = cpu_to_be32(ace->flag);
2552 			*p++ = cpu_to_be32(ace->access_mask &
2553 							NFS4_ACE_MASK_ALL);
2554 			status = nfsd4_encode_aclname(xdr, rqstp, ace);
2555 			if (status)
2556 				goto out;
2557 		}
2558 	}
2559 out_acl:
2560 	if (bmval0 & FATTR4_WORD0_ACLSUPPORT) {
2561 		p = xdr_reserve_space(xdr, 4);
2562 		if (!p)
2563 			goto out_resource;
2564 		*p++ = cpu_to_be32(IS_POSIXACL(dentry->d_inode) ?
2565 			ACL4_SUPPORT_ALLOW_ACL|ACL4_SUPPORT_DENY_ACL : 0);
2566 	}
2567 	if (bmval0 & FATTR4_WORD0_CANSETTIME) {
2568 		p = xdr_reserve_space(xdr, 4);
2569 		if (!p)
2570 			goto out_resource;
2571 		*p++ = cpu_to_be32(1);
2572 	}
2573 	if (bmval0 & FATTR4_WORD0_CASE_INSENSITIVE) {
2574 		p = xdr_reserve_space(xdr, 4);
2575 		if (!p)
2576 			goto out_resource;
2577 		*p++ = cpu_to_be32(0);
2578 	}
2579 	if (bmval0 & FATTR4_WORD0_CASE_PRESERVING) {
2580 		p = xdr_reserve_space(xdr, 4);
2581 		if (!p)
2582 			goto out_resource;
2583 		*p++ = cpu_to_be32(1);
2584 	}
2585 	if (bmval0 & FATTR4_WORD0_CHOWN_RESTRICTED) {
2586 		p = xdr_reserve_space(xdr, 4);
2587 		if (!p)
2588 			goto out_resource;
2589 		*p++ = cpu_to_be32(1);
2590 	}
2591 	if (bmval0 & FATTR4_WORD0_FILEHANDLE) {
2592 		p = xdr_reserve_space(xdr, fhp->fh_handle.fh_size + 4);
2593 		if (!p)
2594 			goto out_resource;
2595 		p = xdr_encode_opaque(p, &fhp->fh_handle.fh_base,
2596 					fhp->fh_handle.fh_size);
2597 	}
2598 	if (bmval0 & FATTR4_WORD0_FILEID) {
2599 		p = xdr_reserve_space(xdr, 8);
2600 		if (!p)
2601 			goto out_resource;
2602 		p = xdr_encode_hyper(p, stat.ino);
2603 	}
2604 	if (bmval0 & FATTR4_WORD0_FILES_AVAIL) {
2605 		p = xdr_reserve_space(xdr, 8);
2606 		if (!p)
2607 			goto out_resource;
2608 		p = xdr_encode_hyper(p, (u64) statfs.f_ffree);
2609 	}
2610 	if (bmval0 & FATTR4_WORD0_FILES_FREE) {
2611 		p = xdr_reserve_space(xdr, 8);
2612 		if (!p)
2613 			goto out_resource;
2614 		p = xdr_encode_hyper(p, (u64) statfs.f_ffree);
2615 	}
2616 	if (bmval0 & FATTR4_WORD0_FILES_TOTAL) {
2617 		p = xdr_reserve_space(xdr, 8);
2618 		if (!p)
2619 			goto out_resource;
2620 		p = xdr_encode_hyper(p, (u64) statfs.f_files);
2621 	}
2622 	if (bmval0 & FATTR4_WORD0_FS_LOCATIONS) {
2623 		status = nfsd4_encode_fs_locations(xdr, rqstp, exp);
2624 		if (status)
2625 			goto out;
2626 	}
2627 	if (bmval0 & FATTR4_WORD0_HOMOGENEOUS) {
2628 		p = xdr_reserve_space(xdr, 4);
2629 		if (!p)
2630 			goto out_resource;
2631 		*p++ = cpu_to_be32(1);
2632 	}
2633 	if (bmval0 & FATTR4_WORD0_MAXFILESIZE) {
2634 		p = xdr_reserve_space(xdr, 8);
2635 		if (!p)
2636 			goto out_resource;
2637 		p = xdr_encode_hyper(p, exp->ex_path.mnt->mnt_sb->s_maxbytes);
2638 	}
2639 	if (bmval0 & FATTR4_WORD0_MAXLINK) {
2640 		p = xdr_reserve_space(xdr, 4);
2641 		if (!p)
2642 			goto out_resource;
2643 		*p++ = cpu_to_be32(255);
2644 	}
2645 	if (bmval0 & FATTR4_WORD0_MAXNAME) {
2646 		p = xdr_reserve_space(xdr, 4);
2647 		if (!p)
2648 			goto out_resource;
2649 		*p++ = cpu_to_be32(statfs.f_namelen);
2650 	}
2651 	if (bmval0 & FATTR4_WORD0_MAXREAD) {
2652 		p = xdr_reserve_space(xdr, 8);
2653 		if (!p)
2654 			goto out_resource;
2655 		p = xdr_encode_hyper(p, (u64) svc_max_payload(rqstp));
2656 	}
2657 	if (bmval0 & FATTR4_WORD0_MAXWRITE) {
2658 		p = xdr_reserve_space(xdr, 8);
2659 		if (!p)
2660 			goto out_resource;
2661 		p = xdr_encode_hyper(p, (u64) svc_max_payload(rqstp));
2662 	}
2663 	if (bmval1 & FATTR4_WORD1_MODE) {
2664 		p = xdr_reserve_space(xdr, 4);
2665 		if (!p)
2666 			goto out_resource;
2667 		*p++ = cpu_to_be32(stat.mode & S_IALLUGO);
2668 	}
2669 	if (bmval1 & FATTR4_WORD1_NO_TRUNC) {
2670 		p = xdr_reserve_space(xdr, 4);
2671 		if (!p)
2672 			goto out_resource;
2673 		*p++ = cpu_to_be32(1);
2674 	}
2675 	if (bmval1 & FATTR4_WORD1_NUMLINKS) {
2676 		p = xdr_reserve_space(xdr, 4);
2677 		if (!p)
2678 			goto out_resource;
2679 		*p++ = cpu_to_be32(stat.nlink);
2680 	}
2681 	if (bmval1 & FATTR4_WORD1_OWNER) {
2682 		status = nfsd4_encode_user(xdr, rqstp, stat.uid);
2683 		if (status)
2684 			goto out;
2685 	}
2686 	if (bmval1 & FATTR4_WORD1_OWNER_GROUP) {
2687 		status = nfsd4_encode_group(xdr, rqstp, stat.gid);
2688 		if (status)
2689 			goto out;
2690 	}
2691 	if (bmval1 & FATTR4_WORD1_RAWDEV) {
2692 		p = xdr_reserve_space(xdr, 8);
2693 		if (!p)
2694 			goto out_resource;
2695 		*p++ = cpu_to_be32((u32) MAJOR(stat.rdev));
2696 		*p++ = cpu_to_be32((u32) MINOR(stat.rdev));
2697 	}
2698 	if (bmval1 & FATTR4_WORD1_SPACE_AVAIL) {
2699 		p = xdr_reserve_space(xdr, 8);
2700 		if (!p)
2701 			goto out_resource;
2702 		dummy64 = (u64)statfs.f_bavail * (u64)statfs.f_bsize;
2703 		p = xdr_encode_hyper(p, dummy64);
2704 	}
2705 	if (bmval1 & FATTR4_WORD1_SPACE_FREE) {
2706 		p = xdr_reserve_space(xdr, 8);
2707 		if (!p)
2708 			goto out_resource;
2709 		dummy64 = (u64)statfs.f_bfree * (u64)statfs.f_bsize;
2710 		p = xdr_encode_hyper(p, dummy64);
2711 	}
2712 	if (bmval1 & FATTR4_WORD1_SPACE_TOTAL) {
2713 		p = xdr_reserve_space(xdr, 8);
2714 		if (!p)
2715 			goto out_resource;
2716 		dummy64 = (u64)statfs.f_blocks * (u64)statfs.f_bsize;
2717 		p = xdr_encode_hyper(p, dummy64);
2718 	}
2719 	if (bmval1 & FATTR4_WORD1_SPACE_USED) {
2720 		p = xdr_reserve_space(xdr, 8);
2721 		if (!p)
2722 			goto out_resource;
2723 		dummy64 = (u64)stat.blocks << 9;
2724 		p = xdr_encode_hyper(p, dummy64);
2725 	}
2726 	if (bmval1 & FATTR4_WORD1_TIME_ACCESS) {
2727 		p = xdr_reserve_space(xdr, 12);
2728 		if (!p)
2729 			goto out_resource;
2730 		p = xdr_encode_hyper(p, (s64)stat.atime.tv_sec);
2731 		*p++ = cpu_to_be32(stat.atime.tv_nsec);
2732 	}
2733 	if (bmval1 & FATTR4_WORD1_TIME_DELTA) {
2734 		p = xdr_reserve_space(xdr, 12);
2735 		if (!p)
2736 			goto out_resource;
2737 		*p++ = cpu_to_be32(0);
2738 		*p++ = cpu_to_be32(1);
2739 		*p++ = cpu_to_be32(0);
2740 	}
2741 	if (bmval1 & FATTR4_WORD1_TIME_METADATA) {
2742 		p = xdr_reserve_space(xdr, 12);
2743 		if (!p)
2744 			goto out_resource;
2745 		p = xdr_encode_hyper(p, (s64)stat.ctime.tv_sec);
2746 		*p++ = cpu_to_be32(stat.ctime.tv_nsec);
2747 	}
2748 	if (bmval1 & FATTR4_WORD1_TIME_MODIFY) {
2749 		p = xdr_reserve_space(xdr, 12);
2750 		if (!p)
2751 			goto out_resource;
2752 		p = xdr_encode_hyper(p, (s64)stat.mtime.tv_sec);
2753 		*p++ = cpu_to_be32(stat.mtime.tv_nsec);
2754 	}
2755 	if (bmval1 & FATTR4_WORD1_MOUNTED_ON_FILEID) {
2756 		struct kstat parent_stat;
2757 		u64 ino = stat.ino;
2758 
2759 		p = xdr_reserve_space(xdr, 8);
2760 		if (!p)
2761                 	goto out_resource;
2762 		/*
2763 		 * Get parent's attributes if not ignoring crossmount
2764 		 * and this is the root of a cross-mounted filesystem.
2765 		 */
2766 		if (ignore_crossmnt == 0 &&
2767 		    dentry == exp->ex_path.mnt->mnt_root) {
2768 			err = get_parent_attributes(exp, &parent_stat);
2769 			if (err)
2770 				goto out_nfserr;
2771 			ino = parent_stat.ino;
2772 		}
2773 		p = xdr_encode_hyper(p, ino);
2774 	}
2775 #ifdef CONFIG_NFSD_PNFS
2776 	if (bmval1 & FATTR4_WORD1_FS_LAYOUT_TYPES) {
2777 		status = nfsd4_encode_layout_types(xdr, exp->ex_layout_types);
2778 		if (status)
2779 			goto out;
2780 	}
2781 
2782 	if (bmval2 & FATTR4_WORD2_LAYOUT_TYPES) {
2783 		status = nfsd4_encode_layout_types(xdr, exp->ex_layout_types);
2784 		if (status)
2785 			goto out;
2786 	}
2787 
2788 	if (bmval2 & FATTR4_WORD2_LAYOUT_BLKSIZE) {
2789 		p = xdr_reserve_space(xdr, 4);
2790 		if (!p)
2791 			goto out_resource;
2792 		*p++ = cpu_to_be32(stat.blksize);
2793 	}
2794 #endif /* CONFIG_NFSD_PNFS */
2795 	if (bmval2 & FATTR4_WORD2_SUPPATTR_EXCLCREAT) {
2796 		status = nfsd4_encode_bitmap(xdr, NFSD_SUPPATTR_EXCLCREAT_WORD0,
2797 						  NFSD_SUPPATTR_EXCLCREAT_WORD1,
2798 						  NFSD_SUPPATTR_EXCLCREAT_WORD2);
2799 		if (status)
2800 			goto out;
2801 	}
2802 
2803 	if (bmval2 & FATTR4_WORD2_SECURITY_LABEL) {
2804 		status = nfsd4_encode_security_label(xdr, rqstp, context,
2805 								contextlen);
2806 		if (status)
2807 			goto out;
2808 	}
2809 
2810 	attrlen = htonl(xdr->buf->len - attrlen_offset - 4);
2811 	write_bytes_to_xdr_buf(xdr->buf, attrlen_offset, &attrlen, 4);
2812 	status = nfs_ok;
2813 
2814 out:
2815 #ifdef CONFIG_NFSD_V4_SECURITY_LABEL
2816 	if (context)
2817 		security_release_secctx(context, contextlen);
2818 #endif /* CONFIG_NFSD_V4_SECURITY_LABEL */
2819 	kfree(acl);
2820 	if (tempfh) {
2821 		fh_put(tempfh);
2822 		kfree(tempfh);
2823 	}
2824 	if (status)
2825 		xdr_truncate_encode(xdr, starting_len);
2826 	return status;
2827 out_nfserr:
2828 	status = nfserrno(err);
2829 	goto out;
2830 out_resource:
2831 	status = nfserr_resource;
2832 	goto out;
2833 }
2834 
2835 static void svcxdr_init_encode_from_buffer(struct xdr_stream *xdr,
2836 				struct xdr_buf *buf, __be32 *p, int bytes)
2837 {
2838 	xdr->scratch.iov_len = 0;
2839 	memset(buf, 0, sizeof(struct xdr_buf));
2840 	buf->head[0].iov_base = p;
2841 	buf->head[0].iov_len = 0;
2842 	buf->len = 0;
2843 	xdr->buf = buf;
2844 	xdr->iov = buf->head;
2845 	xdr->p = p;
2846 	xdr->end = (void *)p + bytes;
2847 	buf->buflen = bytes;
2848 }
2849 
2850 __be32 nfsd4_encode_fattr_to_buf(__be32 **p, int words,
2851 			struct svc_fh *fhp, struct svc_export *exp,
2852 			struct dentry *dentry, u32 *bmval,
2853 			struct svc_rqst *rqstp, int ignore_crossmnt)
2854 {
2855 	struct xdr_buf dummy;
2856 	struct xdr_stream xdr;
2857 	__be32 ret;
2858 
2859 	svcxdr_init_encode_from_buffer(&xdr, &dummy, *p, words << 2);
2860 	ret = nfsd4_encode_fattr(&xdr, fhp, exp, dentry, bmval, rqstp,
2861 							ignore_crossmnt);
2862 	*p = xdr.p;
2863 	return ret;
2864 }
2865 
2866 static inline int attributes_need_mount(u32 *bmval)
2867 {
2868 	if (bmval[0] & ~(FATTR4_WORD0_RDATTR_ERROR | FATTR4_WORD0_LEASE_TIME))
2869 		return 1;
2870 	if (bmval[1] & ~FATTR4_WORD1_MOUNTED_ON_FILEID)
2871 		return 1;
2872 	return 0;
2873 }
2874 
2875 static __be32
2876 nfsd4_encode_dirent_fattr(struct xdr_stream *xdr, struct nfsd4_readdir *cd,
2877 			const char *name, int namlen)
2878 {
2879 	struct svc_export *exp = cd->rd_fhp->fh_export;
2880 	struct dentry *dentry;
2881 	__be32 nfserr;
2882 	int ignore_crossmnt = 0;
2883 
2884 	dentry = lookup_one_len_unlocked(name, cd->rd_fhp->fh_dentry, namlen);
2885 	if (IS_ERR(dentry))
2886 		return nfserrno(PTR_ERR(dentry));
2887 	if (d_really_is_negative(dentry)) {
2888 		/*
2889 		 * we're not holding the i_mutex here, so there's
2890 		 * a window where this directory entry could have gone
2891 		 * away.
2892 		 */
2893 		dput(dentry);
2894 		return nfserr_noent;
2895 	}
2896 
2897 	exp_get(exp);
2898 	/*
2899 	 * In the case of a mountpoint, the client may be asking for
2900 	 * attributes that are only properties of the underlying filesystem
2901 	 * as opposed to the cross-mounted file system. In such a case,
2902 	 * we will not follow the cross mount and will fill the attribtutes
2903 	 * directly from the mountpoint dentry.
2904 	 */
2905 	if (nfsd_mountpoint(dentry, exp)) {
2906 		int err;
2907 
2908 		if (!(exp->ex_flags & NFSEXP_V4ROOT)
2909 				&& !attributes_need_mount(cd->rd_bmval)) {
2910 			ignore_crossmnt = 1;
2911 			goto out_encode;
2912 		}
2913 		/*
2914 		 * Why the heck aren't we just using nfsd_lookup??
2915 		 * Different "."/".." handling?  Something else?
2916 		 * At least, add a comment here to explain....
2917 		 */
2918 		err = nfsd_cross_mnt(cd->rd_rqstp, &dentry, &exp);
2919 		if (err) {
2920 			nfserr = nfserrno(err);
2921 			goto out_put;
2922 		}
2923 		nfserr = check_nfsd_access(exp, cd->rd_rqstp);
2924 		if (nfserr)
2925 			goto out_put;
2926 
2927 	}
2928 out_encode:
2929 	nfserr = nfsd4_encode_fattr(xdr, NULL, exp, dentry, cd->rd_bmval,
2930 					cd->rd_rqstp, ignore_crossmnt);
2931 out_put:
2932 	dput(dentry);
2933 	exp_put(exp);
2934 	return nfserr;
2935 }
2936 
2937 static __be32 *
2938 nfsd4_encode_rdattr_error(struct xdr_stream *xdr, __be32 nfserr)
2939 {
2940 	__be32 *p;
2941 
2942 	p = xdr_reserve_space(xdr, 20);
2943 	if (!p)
2944 		return NULL;
2945 	*p++ = htonl(2);
2946 	*p++ = htonl(FATTR4_WORD0_RDATTR_ERROR); /* bmval0 */
2947 	*p++ = htonl(0);			 /* bmval1 */
2948 
2949 	*p++ = htonl(4);     /* attribute length */
2950 	*p++ = nfserr;       /* no htonl */
2951 	return p;
2952 }
2953 
2954 static int
2955 nfsd4_encode_dirent(void *ccdv, const char *name, int namlen,
2956 		    loff_t offset, u64 ino, unsigned int d_type)
2957 {
2958 	struct readdir_cd *ccd = ccdv;
2959 	struct nfsd4_readdir *cd = container_of(ccd, struct nfsd4_readdir, common);
2960 	struct xdr_stream *xdr = cd->xdr;
2961 	int start_offset = xdr->buf->len;
2962 	int cookie_offset;
2963 	u32 name_and_cookie;
2964 	int entry_bytes;
2965 	__be32 nfserr = nfserr_toosmall;
2966 	__be64 wire_offset;
2967 	__be32 *p;
2968 
2969 	/* In nfsv4, "." and ".." never make it onto the wire.. */
2970 	if (name && isdotent(name, namlen)) {
2971 		cd->common.err = nfs_ok;
2972 		return 0;
2973 	}
2974 
2975 	if (cd->cookie_offset) {
2976 		wire_offset = cpu_to_be64(offset);
2977 		write_bytes_to_xdr_buf(xdr->buf, cd->cookie_offset,
2978 							&wire_offset, 8);
2979 	}
2980 
2981 	p = xdr_reserve_space(xdr, 4);
2982 	if (!p)
2983 		goto fail;
2984 	*p++ = xdr_one;                             /* mark entry present */
2985 	cookie_offset = xdr->buf->len;
2986 	p = xdr_reserve_space(xdr, 3*4 + namlen);
2987 	if (!p)
2988 		goto fail;
2989 	p = xdr_encode_hyper(p, NFS_OFFSET_MAX);    /* offset of next entry */
2990 	p = xdr_encode_array(p, name, namlen);      /* name length & name */
2991 
2992 	nfserr = nfsd4_encode_dirent_fattr(xdr, cd, name, namlen);
2993 	switch (nfserr) {
2994 	case nfs_ok:
2995 		break;
2996 	case nfserr_resource:
2997 		nfserr = nfserr_toosmall;
2998 		goto fail;
2999 	case nfserr_noent:
3000 		xdr_truncate_encode(xdr, start_offset);
3001 		goto skip_entry;
3002 	default:
3003 		/*
3004 		 * If the client requested the RDATTR_ERROR attribute,
3005 		 * we stuff the error code into this attribute
3006 		 * and continue.  If this attribute was not requested,
3007 		 * then in accordance with the spec, we fail the
3008 		 * entire READDIR operation(!)
3009 		 */
3010 		if (!(cd->rd_bmval[0] & FATTR4_WORD0_RDATTR_ERROR))
3011 			goto fail;
3012 		p = nfsd4_encode_rdattr_error(xdr, nfserr);
3013 		if (p == NULL) {
3014 			nfserr = nfserr_toosmall;
3015 			goto fail;
3016 		}
3017 	}
3018 	nfserr = nfserr_toosmall;
3019 	entry_bytes = xdr->buf->len - start_offset;
3020 	if (entry_bytes > cd->rd_maxcount)
3021 		goto fail;
3022 	cd->rd_maxcount -= entry_bytes;
3023 	/*
3024 	 * RFC 3530 14.2.24 describes rd_dircount as only a "hint", so
3025 	 * let's always let through the first entry, at least:
3026 	 */
3027 	if (!cd->rd_dircount)
3028 		goto fail;
3029 	name_and_cookie = 4 + 4 * XDR_QUADLEN(namlen) + 8;
3030 	if (name_and_cookie > cd->rd_dircount && cd->cookie_offset)
3031 		goto fail;
3032 	cd->rd_dircount -= min(cd->rd_dircount, name_and_cookie);
3033 
3034 	cd->cookie_offset = cookie_offset;
3035 skip_entry:
3036 	cd->common.err = nfs_ok;
3037 	return 0;
3038 fail:
3039 	xdr_truncate_encode(xdr, start_offset);
3040 	cd->common.err = nfserr;
3041 	return -EINVAL;
3042 }
3043 
3044 static __be32
3045 nfsd4_encode_stateid(struct xdr_stream *xdr, stateid_t *sid)
3046 {
3047 	__be32 *p;
3048 
3049 	p = xdr_reserve_space(xdr, sizeof(stateid_t));
3050 	if (!p)
3051 		return nfserr_resource;
3052 	*p++ = cpu_to_be32(sid->si_generation);
3053 	p = xdr_encode_opaque_fixed(p, &sid->si_opaque,
3054 					sizeof(stateid_opaque_t));
3055 	return 0;
3056 }
3057 
3058 static __be32
3059 nfsd4_encode_access(struct nfsd4_compoundres *resp, __be32 nfserr, struct nfsd4_access *access)
3060 {
3061 	struct xdr_stream *xdr = &resp->xdr;
3062 	__be32 *p;
3063 
3064 	if (!nfserr) {
3065 		p = xdr_reserve_space(xdr, 8);
3066 		if (!p)
3067 			return nfserr_resource;
3068 		*p++ = cpu_to_be32(access->ac_supported);
3069 		*p++ = cpu_to_be32(access->ac_resp_access);
3070 	}
3071 	return nfserr;
3072 }
3073 
3074 static __be32 nfsd4_encode_bind_conn_to_session(struct nfsd4_compoundres *resp, __be32 nfserr, struct nfsd4_bind_conn_to_session *bcts)
3075 {
3076 	struct xdr_stream *xdr = &resp->xdr;
3077 	__be32 *p;
3078 
3079 	if (!nfserr) {
3080 		p = xdr_reserve_space(xdr, NFS4_MAX_SESSIONID_LEN + 8);
3081 		if (!p)
3082 			return nfserr_resource;
3083 		p = xdr_encode_opaque_fixed(p, bcts->sessionid.data,
3084 						NFS4_MAX_SESSIONID_LEN);
3085 		*p++ = cpu_to_be32(bcts->dir);
3086 		/* Upshifting from TCP to RDMA is not supported */
3087 		*p++ = cpu_to_be32(0);
3088 	}
3089 	return nfserr;
3090 }
3091 
3092 static __be32
3093 nfsd4_encode_close(struct nfsd4_compoundres *resp, __be32 nfserr, struct nfsd4_close *close)
3094 {
3095 	struct xdr_stream *xdr = &resp->xdr;
3096 
3097 	if (!nfserr)
3098 		nfserr = nfsd4_encode_stateid(xdr, &close->cl_stateid);
3099 
3100 	return nfserr;
3101 }
3102 
3103 
3104 static __be32
3105 nfsd4_encode_commit(struct nfsd4_compoundres *resp, __be32 nfserr, struct nfsd4_commit *commit)
3106 {
3107 	struct xdr_stream *xdr = &resp->xdr;
3108 	__be32 *p;
3109 
3110 	if (!nfserr) {
3111 		p = xdr_reserve_space(xdr, NFS4_VERIFIER_SIZE);
3112 		if (!p)
3113 			return nfserr_resource;
3114 		p = xdr_encode_opaque_fixed(p, commit->co_verf.data,
3115 						NFS4_VERIFIER_SIZE);
3116 	}
3117 	return nfserr;
3118 }
3119 
3120 static __be32
3121 nfsd4_encode_create(struct nfsd4_compoundres *resp, __be32 nfserr, struct nfsd4_create *create)
3122 {
3123 	struct xdr_stream *xdr = &resp->xdr;
3124 	__be32 *p;
3125 
3126 	if (!nfserr) {
3127 		p = xdr_reserve_space(xdr, 20);
3128 		if (!p)
3129 			return nfserr_resource;
3130 		encode_cinfo(p, &create->cr_cinfo);
3131 		nfserr = nfsd4_encode_bitmap(xdr, create->cr_bmval[0],
3132 				create->cr_bmval[1], create->cr_bmval[2]);
3133 	}
3134 	return nfserr;
3135 }
3136 
3137 static __be32
3138 nfsd4_encode_getattr(struct nfsd4_compoundres *resp, __be32 nfserr, struct nfsd4_getattr *getattr)
3139 {
3140 	struct svc_fh *fhp = getattr->ga_fhp;
3141 	struct xdr_stream *xdr = &resp->xdr;
3142 
3143 	if (nfserr)
3144 		return nfserr;
3145 
3146 	nfserr = nfsd4_encode_fattr(xdr, fhp, fhp->fh_export, fhp->fh_dentry,
3147 				    getattr->ga_bmval,
3148 				    resp->rqstp, 0);
3149 	return nfserr;
3150 }
3151 
3152 static __be32
3153 nfsd4_encode_getfh(struct nfsd4_compoundres *resp, __be32 nfserr, struct svc_fh **fhpp)
3154 {
3155 	struct xdr_stream *xdr = &resp->xdr;
3156 	struct svc_fh *fhp = *fhpp;
3157 	unsigned int len;
3158 	__be32 *p;
3159 
3160 	if (!nfserr) {
3161 		len = fhp->fh_handle.fh_size;
3162 		p = xdr_reserve_space(xdr, len + 4);
3163 		if (!p)
3164 			return nfserr_resource;
3165 		p = xdr_encode_opaque(p, &fhp->fh_handle.fh_base, len);
3166 	}
3167 	return nfserr;
3168 }
3169 
3170 /*
3171 * Including all fields other than the name, a LOCK4denied structure requires
3172 *   8(clientid) + 4(namelen) + 8(offset) + 8(length) + 4(type) = 32 bytes.
3173 */
3174 static __be32
3175 nfsd4_encode_lock_denied(struct xdr_stream *xdr, struct nfsd4_lock_denied *ld)
3176 {
3177 	struct xdr_netobj *conf = &ld->ld_owner;
3178 	__be32 *p;
3179 
3180 again:
3181 	p = xdr_reserve_space(xdr, 32 + XDR_LEN(conf->len));
3182 	if (!p) {
3183 		/*
3184 		 * Don't fail to return the result just because we can't
3185 		 * return the conflicting open:
3186 		 */
3187 		if (conf->len) {
3188 			kfree(conf->data);
3189 			conf->len = 0;
3190 			conf->data = NULL;
3191 			goto again;
3192 		}
3193 		return nfserr_resource;
3194 	}
3195 	p = xdr_encode_hyper(p, ld->ld_start);
3196 	p = xdr_encode_hyper(p, ld->ld_length);
3197 	*p++ = cpu_to_be32(ld->ld_type);
3198 	if (conf->len) {
3199 		p = xdr_encode_opaque_fixed(p, &ld->ld_clientid, 8);
3200 		p = xdr_encode_opaque(p, conf->data, conf->len);
3201 		kfree(conf->data);
3202 	}  else {  /* non - nfsv4 lock in conflict, no clientid nor owner */
3203 		p = xdr_encode_hyper(p, (u64)0); /* clientid */
3204 		*p++ = cpu_to_be32(0); /* length of owner name */
3205 	}
3206 	return nfserr_denied;
3207 }
3208 
3209 static __be32
3210 nfsd4_encode_lock(struct nfsd4_compoundres *resp, __be32 nfserr, struct nfsd4_lock *lock)
3211 {
3212 	struct xdr_stream *xdr = &resp->xdr;
3213 
3214 	if (!nfserr)
3215 		nfserr = nfsd4_encode_stateid(xdr, &lock->lk_resp_stateid);
3216 	else if (nfserr == nfserr_denied)
3217 		nfserr = nfsd4_encode_lock_denied(xdr, &lock->lk_denied);
3218 
3219 	return nfserr;
3220 }
3221 
3222 static __be32
3223 nfsd4_encode_lockt(struct nfsd4_compoundres *resp, __be32 nfserr, struct nfsd4_lockt *lockt)
3224 {
3225 	struct xdr_stream *xdr = &resp->xdr;
3226 
3227 	if (nfserr == nfserr_denied)
3228 		nfsd4_encode_lock_denied(xdr, &lockt->lt_denied);
3229 	return nfserr;
3230 }
3231 
3232 static __be32
3233 nfsd4_encode_locku(struct nfsd4_compoundres *resp, __be32 nfserr, struct nfsd4_locku *locku)
3234 {
3235 	struct xdr_stream *xdr = &resp->xdr;
3236 
3237 	if (!nfserr)
3238 		nfserr = nfsd4_encode_stateid(xdr, &locku->lu_stateid);
3239 
3240 	return nfserr;
3241 }
3242 
3243 
3244 static __be32
3245 nfsd4_encode_link(struct nfsd4_compoundres *resp, __be32 nfserr, struct nfsd4_link *link)
3246 {
3247 	struct xdr_stream *xdr = &resp->xdr;
3248 	__be32 *p;
3249 
3250 	if (!nfserr) {
3251 		p = xdr_reserve_space(xdr, 20);
3252 		if (!p)
3253 			return nfserr_resource;
3254 		p = encode_cinfo(p, &link->li_cinfo);
3255 	}
3256 	return nfserr;
3257 }
3258 
3259 
3260 static __be32
3261 nfsd4_encode_open(struct nfsd4_compoundres *resp, __be32 nfserr, struct nfsd4_open *open)
3262 {
3263 	struct xdr_stream *xdr = &resp->xdr;
3264 	__be32 *p;
3265 
3266 	if (nfserr)
3267 		goto out;
3268 
3269 	nfserr = nfsd4_encode_stateid(xdr, &open->op_stateid);
3270 	if (nfserr)
3271 		goto out;
3272 	p = xdr_reserve_space(xdr, 24);
3273 	if (!p)
3274 		return nfserr_resource;
3275 	p = encode_cinfo(p, &open->op_cinfo);
3276 	*p++ = cpu_to_be32(open->op_rflags);
3277 
3278 	nfserr = nfsd4_encode_bitmap(xdr, open->op_bmval[0], open->op_bmval[1],
3279 					open->op_bmval[2]);
3280 	if (nfserr)
3281 		goto out;
3282 
3283 	p = xdr_reserve_space(xdr, 4);
3284 	if (!p)
3285 		return nfserr_resource;
3286 
3287 	*p++ = cpu_to_be32(open->op_delegate_type);
3288 	switch (open->op_delegate_type) {
3289 	case NFS4_OPEN_DELEGATE_NONE:
3290 		break;
3291 	case NFS4_OPEN_DELEGATE_READ:
3292 		nfserr = nfsd4_encode_stateid(xdr, &open->op_delegate_stateid);
3293 		if (nfserr)
3294 			return nfserr;
3295 		p = xdr_reserve_space(xdr, 20);
3296 		if (!p)
3297 			return nfserr_resource;
3298 		*p++ = cpu_to_be32(open->op_recall);
3299 
3300 		/*
3301 		 * TODO: ACE's in delegations
3302 		 */
3303 		*p++ = cpu_to_be32(NFS4_ACE_ACCESS_ALLOWED_ACE_TYPE);
3304 		*p++ = cpu_to_be32(0);
3305 		*p++ = cpu_to_be32(0);
3306 		*p++ = cpu_to_be32(0);   /* XXX: is NULL principal ok? */
3307 		break;
3308 	case NFS4_OPEN_DELEGATE_WRITE:
3309 		nfserr = nfsd4_encode_stateid(xdr, &open->op_delegate_stateid);
3310 		if (nfserr)
3311 			return nfserr;
3312 		p = xdr_reserve_space(xdr, 32);
3313 		if (!p)
3314 			return nfserr_resource;
3315 		*p++ = cpu_to_be32(0);
3316 
3317 		/*
3318 		 * TODO: space_limit's in delegations
3319 		 */
3320 		*p++ = cpu_to_be32(NFS4_LIMIT_SIZE);
3321 		*p++ = cpu_to_be32(~(u32)0);
3322 		*p++ = cpu_to_be32(~(u32)0);
3323 
3324 		/*
3325 		 * TODO: ACE's in delegations
3326 		 */
3327 		*p++ = cpu_to_be32(NFS4_ACE_ACCESS_ALLOWED_ACE_TYPE);
3328 		*p++ = cpu_to_be32(0);
3329 		*p++ = cpu_to_be32(0);
3330 		*p++ = cpu_to_be32(0);   /* XXX: is NULL principal ok? */
3331 		break;
3332 	case NFS4_OPEN_DELEGATE_NONE_EXT: /* 4.1 */
3333 		switch (open->op_why_no_deleg) {
3334 		case WND4_CONTENTION:
3335 		case WND4_RESOURCE:
3336 			p = xdr_reserve_space(xdr, 8);
3337 			if (!p)
3338 				return nfserr_resource;
3339 			*p++ = cpu_to_be32(open->op_why_no_deleg);
3340 			/* deleg signaling not supported yet: */
3341 			*p++ = cpu_to_be32(0);
3342 			break;
3343 		default:
3344 			p = xdr_reserve_space(xdr, 4);
3345 			if (!p)
3346 				return nfserr_resource;
3347 			*p++ = cpu_to_be32(open->op_why_no_deleg);
3348 		}
3349 		break;
3350 	default:
3351 		BUG();
3352 	}
3353 	/* XXX save filehandle here */
3354 out:
3355 	return nfserr;
3356 }
3357 
3358 static __be32
3359 nfsd4_encode_open_confirm(struct nfsd4_compoundres *resp, __be32 nfserr, struct nfsd4_open_confirm *oc)
3360 {
3361 	struct xdr_stream *xdr = &resp->xdr;
3362 
3363 	if (!nfserr)
3364 		nfserr = nfsd4_encode_stateid(xdr, &oc->oc_resp_stateid);
3365 
3366 	return nfserr;
3367 }
3368 
3369 static __be32
3370 nfsd4_encode_open_downgrade(struct nfsd4_compoundres *resp, __be32 nfserr, struct nfsd4_open_downgrade *od)
3371 {
3372 	struct xdr_stream *xdr = &resp->xdr;
3373 
3374 	if (!nfserr)
3375 		nfserr = nfsd4_encode_stateid(xdr, &od->od_stateid);
3376 
3377 	return nfserr;
3378 }
3379 
3380 static __be32 nfsd4_encode_splice_read(
3381 				struct nfsd4_compoundres *resp,
3382 				struct nfsd4_read *read,
3383 				struct file *file, unsigned long maxcount)
3384 {
3385 	struct xdr_stream *xdr = &resp->xdr;
3386 	struct xdr_buf *buf = xdr->buf;
3387 	u32 eof;
3388 	long len;
3389 	int space_left;
3390 	__be32 nfserr;
3391 	__be32 *p = xdr->p - 2;
3392 
3393 	/* Make sure there will be room for padding if needed */
3394 	if (xdr->end - xdr->p < 1)
3395 		return nfserr_resource;
3396 
3397 	len = maxcount;
3398 	nfserr = nfsd_splice_read(read->rd_rqstp, file,
3399 				  read->rd_offset, &maxcount);
3400 	if (nfserr) {
3401 		/*
3402 		 * nfsd_splice_actor may have already messed with the
3403 		 * page length; reset it so as not to confuse
3404 		 * xdr_truncate_encode:
3405 		 */
3406 		buf->page_len = 0;
3407 		return nfserr;
3408 	}
3409 
3410 	eof = nfsd_eof_on_read(len, maxcount, read->rd_offset,
3411 				d_inode(read->rd_fhp->fh_dentry)->i_size);
3412 
3413 	*(p++) = htonl(eof);
3414 	*(p++) = htonl(maxcount);
3415 
3416 	buf->page_len = maxcount;
3417 	buf->len += maxcount;
3418 	xdr->page_ptr += (buf->page_base + maxcount + PAGE_SIZE - 1)
3419 							/ PAGE_SIZE;
3420 
3421 	/* Use rest of head for padding and remaining ops: */
3422 	buf->tail[0].iov_base = xdr->p;
3423 	buf->tail[0].iov_len = 0;
3424 	xdr->iov = buf->tail;
3425 	if (maxcount&3) {
3426 		int pad = 4 - (maxcount&3);
3427 
3428 		*(xdr->p++) = 0;
3429 
3430 		buf->tail[0].iov_base += maxcount&3;
3431 		buf->tail[0].iov_len = pad;
3432 		buf->len += pad;
3433 	}
3434 
3435 	space_left = min_t(int, (void *)xdr->end - (void *)xdr->p,
3436 				buf->buflen - buf->len);
3437 	buf->buflen = buf->len + space_left;
3438 	xdr->end = (__be32 *)((void *)xdr->end + space_left);
3439 
3440 	return 0;
3441 }
3442 
3443 static __be32 nfsd4_encode_readv(struct nfsd4_compoundres *resp,
3444 				 struct nfsd4_read *read,
3445 				 struct file *file, unsigned long maxcount)
3446 {
3447 	struct xdr_stream *xdr = &resp->xdr;
3448 	u32 eof;
3449 	int v;
3450 	int starting_len = xdr->buf->len - 8;
3451 	long len;
3452 	int thislen;
3453 	__be32 nfserr;
3454 	__be32 tmp;
3455 	__be32 *p;
3456 	u32 zzz = 0;
3457 	int pad;
3458 
3459 	len = maxcount;
3460 	v = 0;
3461 
3462 	thislen = min_t(long, len, ((void *)xdr->end - (void *)xdr->p));
3463 	p = xdr_reserve_space(xdr, (thislen+3)&~3);
3464 	WARN_ON_ONCE(!p);
3465 	resp->rqstp->rq_vec[v].iov_base = p;
3466 	resp->rqstp->rq_vec[v].iov_len = thislen;
3467 	v++;
3468 	len -= thislen;
3469 
3470 	while (len) {
3471 		thislen = min_t(long, len, PAGE_SIZE);
3472 		p = xdr_reserve_space(xdr, (thislen+3)&~3);
3473 		WARN_ON_ONCE(!p);
3474 		resp->rqstp->rq_vec[v].iov_base = p;
3475 		resp->rqstp->rq_vec[v].iov_len = thislen;
3476 		v++;
3477 		len -= thislen;
3478 	}
3479 	read->rd_vlen = v;
3480 
3481 	len = maxcount;
3482 	nfserr = nfsd_readv(file, read->rd_offset, resp->rqstp->rq_vec,
3483 			read->rd_vlen, &maxcount);
3484 	if (nfserr)
3485 		return nfserr;
3486 	xdr_truncate_encode(xdr, starting_len + 8 + ((maxcount+3)&~3));
3487 
3488 	eof = nfsd_eof_on_read(len, maxcount, read->rd_offset,
3489 				d_inode(read->rd_fhp->fh_dentry)->i_size);
3490 
3491 	tmp = htonl(eof);
3492 	write_bytes_to_xdr_buf(xdr->buf, starting_len    , &tmp, 4);
3493 	tmp = htonl(maxcount);
3494 	write_bytes_to_xdr_buf(xdr->buf, starting_len + 4, &tmp, 4);
3495 
3496 	pad = (maxcount&3) ? 4 - (maxcount&3) : 0;
3497 	write_bytes_to_xdr_buf(xdr->buf, starting_len + 8 + maxcount,
3498 								&zzz, pad);
3499 	return 0;
3500 
3501 }
3502 
3503 static __be32
3504 nfsd4_encode_read(struct nfsd4_compoundres *resp, __be32 nfserr,
3505 		  struct nfsd4_read *read)
3506 {
3507 	unsigned long maxcount;
3508 	struct xdr_stream *xdr = &resp->xdr;
3509 	struct file *file = read->rd_filp;
3510 	int starting_len = xdr->buf->len;
3511 	struct raparms *ra = NULL;
3512 	__be32 *p;
3513 
3514 	if (nfserr)
3515 		goto out;
3516 
3517 	p = xdr_reserve_space(xdr, 8); /* eof flag and byte count */
3518 	if (!p) {
3519 		WARN_ON_ONCE(test_bit(RQ_SPLICE_OK, &resp->rqstp->rq_flags));
3520 		nfserr = nfserr_resource;
3521 		goto out;
3522 	}
3523 	if (resp->xdr.buf->page_len &&
3524 	    test_bit(RQ_SPLICE_OK, &resp->rqstp->rq_flags)) {
3525 		WARN_ON_ONCE(1);
3526 		nfserr = nfserr_resource;
3527 		goto out;
3528 	}
3529 	xdr_commit_encode(xdr);
3530 
3531 	maxcount = svc_max_payload(resp->rqstp);
3532 	maxcount = min_t(unsigned long, maxcount,
3533 			 (xdr->buf->buflen - xdr->buf->len));
3534 	maxcount = min_t(unsigned long, maxcount, read->rd_length);
3535 
3536 	if (read->rd_tmp_file)
3537 		ra = nfsd_init_raparms(file);
3538 
3539 	if (file->f_op->splice_read &&
3540 	    test_bit(RQ_SPLICE_OK, &resp->rqstp->rq_flags))
3541 		nfserr = nfsd4_encode_splice_read(resp, read, file, maxcount);
3542 	else
3543 		nfserr = nfsd4_encode_readv(resp, read, file, maxcount);
3544 
3545 	if (ra)
3546 		nfsd_put_raparams(file, ra);
3547 
3548 	if (nfserr)
3549 		xdr_truncate_encode(xdr, starting_len);
3550 
3551 out:
3552 	if (file)
3553 		fput(file);
3554 	return nfserr;
3555 }
3556 
3557 static __be32
3558 nfsd4_encode_readlink(struct nfsd4_compoundres *resp, __be32 nfserr, struct nfsd4_readlink *readlink)
3559 {
3560 	int maxcount;
3561 	__be32 wire_count;
3562 	int zero = 0;
3563 	struct xdr_stream *xdr = &resp->xdr;
3564 	int length_offset = xdr->buf->len;
3565 	__be32 *p;
3566 
3567 	if (nfserr)
3568 		return nfserr;
3569 
3570 	p = xdr_reserve_space(xdr, 4);
3571 	if (!p)
3572 		return nfserr_resource;
3573 	maxcount = PAGE_SIZE;
3574 
3575 	p = xdr_reserve_space(xdr, maxcount);
3576 	if (!p)
3577 		return nfserr_resource;
3578 	/*
3579 	 * XXX: By default, the ->readlink() VFS op will truncate symlinks
3580 	 * if they would overflow the buffer.  Is this kosher in NFSv4?  If
3581 	 * not, one easy fix is: if ->readlink() precisely fills the buffer,
3582 	 * assume that truncation occurred, and return NFS4ERR_RESOURCE.
3583 	 */
3584 	nfserr = nfsd_readlink(readlink->rl_rqstp, readlink->rl_fhp,
3585 						(char *)p, &maxcount);
3586 	if (nfserr == nfserr_isdir)
3587 		nfserr = nfserr_inval;
3588 	if (nfserr) {
3589 		xdr_truncate_encode(xdr, length_offset);
3590 		return nfserr;
3591 	}
3592 
3593 	wire_count = htonl(maxcount);
3594 	write_bytes_to_xdr_buf(xdr->buf, length_offset, &wire_count, 4);
3595 	xdr_truncate_encode(xdr, length_offset + 4 + ALIGN(maxcount, 4));
3596 	if (maxcount & 3)
3597 		write_bytes_to_xdr_buf(xdr->buf, length_offset + 4 + maxcount,
3598 						&zero, 4 - (maxcount&3));
3599 	return 0;
3600 }
3601 
3602 static __be32
3603 nfsd4_encode_readdir(struct nfsd4_compoundres *resp, __be32 nfserr, struct nfsd4_readdir *readdir)
3604 {
3605 	int maxcount;
3606 	int bytes_left;
3607 	loff_t offset;
3608 	__be64 wire_offset;
3609 	struct xdr_stream *xdr = &resp->xdr;
3610 	int starting_len = xdr->buf->len;
3611 	__be32 *p;
3612 
3613 	if (nfserr)
3614 		return nfserr;
3615 
3616 	p = xdr_reserve_space(xdr, NFS4_VERIFIER_SIZE);
3617 	if (!p)
3618 		return nfserr_resource;
3619 
3620 	/* XXX: Following NFSv3, we ignore the READDIR verifier for now. */
3621 	*p++ = cpu_to_be32(0);
3622 	*p++ = cpu_to_be32(0);
3623 	resp->xdr.buf->head[0].iov_len = ((char *)resp->xdr.p)
3624 				- (char *)resp->xdr.buf->head[0].iov_base;
3625 
3626 	/*
3627 	 * Number of bytes left for directory entries allowing for the
3628 	 * final 8 bytes of the readdir and a following failed op:
3629 	 */
3630 	bytes_left = xdr->buf->buflen - xdr->buf->len
3631 			- COMPOUND_ERR_SLACK_SPACE - 8;
3632 	if (bytes_left < 0) {
3633 		nfserr = nfserr_resource;
3634 		goto err_no_verf;
3635 	}
3636 	maxcount = min_t(u32, readdir->rd_maxcount, INT_MAX);
3637 	/*
3638 	 * Note the rfc defines rd_maxcount as the size of the
3639 	 * READDIR4resok structure, which includes the verifier above
3640 	 * and the 8 bytes encoded at the end of this function:
3641 	 */
3642 	if (maxcount < 16) {
3643 		nfserr = nfserr_toosmall;
3644 		goto err_no_verf;
3645 	}
3646 	maxcount = min_t(int, maxcount-16, bytes_left);
3647 
3648 	/* RFC 3530 14.2.24 allows us to ignore dircount when it's 0: */
3649 	if (!readdir->rd_dircount)
3650 		readdir->rd_dircount = INT_MAX;
3651 
3652 	readdir->xdr = xdr;
3653 	readdir->rd_maxcount = maxcount;
3654 	readdir->common.err = 0;
3655 	readdir->cookie_offset = 0;
3656 
3657 	offset = readdir->rd_cookie;
3658 	nfserr = nfsd_readdir(readdir->rd_rqstp, readdir->rd_fhp,
3659 			      &offset,
3660 			      &readdir->common, nfsd4_encode_dirent);
3661 	if (nfserr == nfs_ok &&
3662 	    readdir->common.err == nfserr_toosmall &&
3663 	    xdr->buf->len == starting_len + 8) {
3664 		/* nothing encoded; which limit did we hit?: */
3665 		if (maxcount - 16 < bytes_left)
3666 			/* It was the fault of rd_maxcount: */
3667 			nfserr = nfserr_toosmall;
3668 		else
3669 			/* We ran out of buffer space: */
3670 			nfserr = nfserr_resource;
3671 	}
3672 	if (nfserr)
3673 		goto err_no_verf;
3674 
3675 	if (readdir->cookie_offset) {
3676 		wire_offset = cpu_to_be64(offset);
3677 		write_bytes_to_xdr_buf(xdr->buf, readdir->cookie_offset,
3678 							&wire_offset, 8);
3679 	}
3680 
3681 	p = xdr_reserve_space(xdr, 8);
3682 	if (!p) {
3683 		WARN_ON_ONCE(1);
3684 		goto err_no_verf;
3685 	}
3686 	*p++ = 0;	/* no more entries */
3687 	*p++ = htonl(readdir->common.err == nfserr_eof);
3688 
3689 	return 0;
3690 err_no_verf:
3691 	xdr_truncate_encode(xdr, starting_len);
3692 	return nfserr;
3693 }
3694 
3695 static __be32
3696 nfsd4_encode_remove(struct nfsd4_compoundres *resp, __be32 nfserr, struct nfsd4_remove *remove)
3697 {
3698 	struct xdr_stream *xdr = &resp->xdr;
3699 	__be32 *p;
3700 
3701 	if (!nfserr) {
3702 		p = xdr_reserve_space(xdr, 20);
3703 		if (!p)
3704 			return nfserr_resource;
3705 		p = encode_cinfo(p, &remove->rm_cinfo);
3706 	}
3707 	return nfserr;
3708 }
3709 
3710 static __be32
3711 nfsd4_encode_rename(struct nfsd4_compoundres *resp, __be32 nfserr, struct nfsd4_rename *rename)
3712 {
3713 	struct xdr_stream *xdr = &resp->xdr;
3714 	__be32 *p;
3715 
3716 	if (!nfserr) {
3717 		p = xdr_reserve_space(xdr, 40);
3718 		if (!p)
3719 			return nfserr_resource;
3720 		p = encode_cinfo(p, &rename->rn_sinfo);
3721 		p = encode_cinfo(p, &rename->rn_tinfo);
3722 	}
3723 	return nfserr;
3724 }
3725 
3726 static __be32
3727 nfsd4_do_encode_secinfo(struct xdr_stream *xdr,
3728 			 __be32 nfserr, struct svc_export *exp)
3729 {
3730 	u32 i, nflavs, supported;
3731 	struct exp_flavor_info *flavs;
3732 	struct exp_flavor_info def_flavs[2];
3733 	__be32 *p, *flavorsp;
3734 	static bool report = true;
3735 
3736 	if (nfserr)
3737 		goto out;
3738 	nfserr = nfserr_resource;
3739 	if (exp->ex_nflavors) {
3740 		flavs = exp->ex_flavors;
3741 		nflavs = exp->ex_nflavors;
3742 	} else { /* Handling of some defaults in absence of real secinfo: */
3743 		flavs = def_flavs;
3744 		if (exp->ex_client->flavour->flavour == RPC_AUTH_UNIX) {
3745 			nflavs = 2;
3746 			flavs[0].pseudoflavor = RPC_AUTH_UNIX;
3747 			flavs[1].pseudoflavor = RPC_AUTH_NULL;
3748 		} else if (exp->ex_client->flavour->flavour == RPC_AUTH_GSS) {
3749 			nflavs = 1;
3750 			flavs[0].pseudoflavor
3751 					= svcauth_gss_flavor(exp->ex_client);
3752 		} else {
3753 			nflavs = 1;
3754 			flavs[0].pseudoflavor
3755 					= exp->ex_client->flavour->flavour;
3756 		}
3757 	}
3758 
3759 	supported = 0;
3760 	p = xdr_reserve_space(xdr, 4);
3761 	if (!p)
3762 		goto out;
3763 	flavorsp = p++;		/* to be backfilled later */
3764 
3765 	for (i = 0; i < nflavs; i++) {
3766 		rpc_authflavor_t pf = flavs[i].pseudoflavor;
3767 		struct rpcsec_gss_info info;
3768 
3769 		if (rpcauth_get_gssinfo(pf, &info) == 0) {
3770 			supported++;
3771 			p = xdr_reserve_space(xdr, 4 + 4 +
3772 					      XDR_LEN(info.oid.len) + 4 + 4);
3773 			if (!p)
3774 				goto out;
3775 			*p++ = cpu_to_be32(RPC_AUTH_GSS);
3776 			p = xdr_encode_opaque(p,  info.oid.data, info.oid.len);
3777 			*p++ = cpu_to_be32(info.qop);
3778 			*p++ = cpu_to_be32(info.service);
3779 		} else if (pf < RPC_AUTH_MAXFLAVOR) {
3780 			supported++;
3781 			p = xdr_reserve_space(xdr, 4);
3782 			if (!p)
3783 				goto out;
3784 			*p++ = cpu_to_be32(pf);
3785 		} else {
3786 			if (report)
3787 				pr_warn("NFS: SECINFO: security flavor %u "
3788 					"is not supported\n", pf);
3789 		}
3790 	}
3791 
3792 	if (nflavs != supported)
3793 		report = false;
3794 	*flavorsp = htonl(supported);
3795 	nfserr = 0;
3796 out:
3797 	if (exp)
3798 		exp_put(exp);
3799 	return nfserr;
3800 }
3801 
3802 static __be32
3803 nfsd4_encode_secinfo(struct nfsd4_compoundres *resp, __be32 nfserr,
3804 		     struct nfsd4_secinfo *secinfo)
3805 {
3806 	struct xdr_stream *xdr = &resp->xdr;
3807 
3808 	return nfsd4_do_encode_secinfo(xdr, nfserr, secinfo->si_exp);
3809 }
3810 
3811 static __be32
3812 nfsd4_encode_secinfo_no_name(struct nfsd4_compoundres *resp, __be32 nfserr,
3813 		     struct nfsd4_secinfo_no_name *secinfo)
3814 {
3815 	struct xdr_stream *xdr = &resp->xdr;
3816 
3817 	return nfsd4_do_encode_secinfo(xdr, nfserr, secinfo->sin_exp);
3818 }
3819 
3820 /*
3821  * The SETATTR encode routine is special -- it always encodes a bitmap,
3822  * regardless of the error status.
3823  */
3824 static __be32
3825 nfsd4_encode_setattr(struct nfsd4_compoundres *resp, __be32 nfserr, struct nfsd4_setattr *setattr)
3826 {
3827 	struct xdr_stream *xdr = &resp->xdr;
3828 	__be32 *p;
3829 
3830 	p = xdr_reserve_space(xdr, 16);
3831 	if (!p)
3832 		return nfserr_resource;
3833 	if (nfserr) {
3834 		*p++ = cpu_to_be32(3);
3835 		*p++ = cpu_to_be32(0);
3836 		*p++ = cpu_to_be32(0);
3837 		*p++ = cpu_to_be32(0);
3838 	}
3839 	else {
3840 		*p++ = cpu_to_be32(3);
3841 		*p++ = cpu_to_be32(setattr->sa_bmval[0]);
3842 		*p++ = cpu_to_be32(setattr->sa_bmval[1]);
3843 		*p++ = cpu_to_be32(setattr->sa_bmval[2]);
3844 	}
3845 	return nfserr;
3846 }
3847 
3848 static __be32
3849 nfsd4_encode_setclientid(struct nfsd4_compoundres *resp, __be32 nfserr, struct nfsd4_setclientid *scd)
3850 {
3851 	struct xdr_stream *xdr = &resp->xdr;
3852 	__be32 *p;
3853 
3854 	if (!nfserr) {
3855 		p = xdr_reserve_space(xdr, 8 + NFS4_VERIFIER_SIZE);
3856 		if (!p)
3857 			return nfserr_resource;
3858 		p = xdr_encode_opaque_fixed(p, &scd->se_clientid, 8);
3859 		p = xdr_encode_opaque_fixed(p, &scd->se_confirm,
3860 						NFS4_VERIFIER_SIZE);
3861 	}
3862 	else if (nfserr == nfserr_clid_inuse) {
3863 		p = xdr_reserve_space(xdr, 8);
3864 		if (!p)
3865 			return nfserr_resource;
3866 		*p++ = cpu_to_be32(0);
3867 		*p++ = cpu_to_be32(0);
3868 	}
3869 	return nfserr;
3870 }
3871 
3872 static __be32
3873 nfsd4_encode_write(struct nfsd4_compoundres *resp, __be32 nfserr, struct nfsd4_write *write)
3874 {
3875 	struct xdr_stream *xdr = &resp->xdr;
3876 	__be32 *p;
3877 
3878 	if (!nfserr) {
3879 		p = xdr_reserve_space(xdr, 16);
3880 		if (!p)
3881 			return nfserr_resource;
3882 		*p++ = cpu_to_be32(write->wr_bytes_written);
3883 		*p++ = cpu_to_be32(write->wr_how_written);
3884 		p = xdr_encode_opaque_fixed(p, write->wr_verifier.data,
3885 							NFS4_VERIFIER_SIZE);
3886 	}
3887 	return nfserr;
3888 }
3889 
3890 static __be32
3891 nfsd4_encode_exchange_id(struct nfsd4_compoundres *resp, __be32 nfserr,
3892 			 struct nfsd4_exchange_id *exid)
3893 {
3894 	struct xdr_stream *xdr = &resp->xdr;
3895 	__be32 *p;
3896 	char *major_id;
3897 	char *server_scope;
3898 	int major_id_sz;
3899 	int server_scope_sz;
3900 	int status = 0;
3901 	uint64_t minor_id = 0;
3902 
3903 	if (nfserr)
3904 		return nfserr;
3905 
3906 	major_id = utsname()->nodename;
3907 	major_id_sz = strlen(major_id);
3908 	server_scope = utsname()->nodename;
3909 	server_scope_sz = strlen(server_scope);
3910 
3911 	p = xdr_reserve_space(xdr,
3912 		8 /* eir_clientid */ +
3913 		4 /* eir_sequenceid */ +
3914 		4 /* eir_flags */ +
3915 		4 /* spr_how */);
3916 	if (!p)
3917 		return nfserr_resource;
3918 
3919 	p = xdr_encode_opaque_fixed(p, &exid->clientid, 8);
3920 	*p++ = cpu_to_be32(exid->seqid);
3921 	*p++ = cpu_to_be32(exid->flags);
3922 
3923 	*p++ = cpu_to_be32(exid->spa_how);
3924 
3925 	switch (exid->spa_how) {
3926 	case SP4_NONE:
3927 		break;
3928 	case SP4_MACH_CRED:
3929 		/* spo_must_enforce bitmap: */
3930 		status = nfsd4_encode_bitmap(xdr,
3931 					exid->spo_must_enforce[0],
3932 					exid->spo_must_enforce[1],
3933 					exid->spo_must_enforce[2]);
3934 		if (status)
3935 			goto out;
3936 		/* spo_must_allow bitmap: */
3937 		status = nfsd4_encode_bitmap(xdr,
3938 					exid->spo_must_allow[0],
3939 					exid->spo_must_allow[1],
3940 					exid->spo_must_allow[2]);
3941 		if (status)
3942 			goto out;
3943 		break;
3944 	default:
3945 		WARN_ON_ONCE(1);
3946 	}
3947 
3948 	p = xdr_reserve_space(xdr,
3949 		8 /* so_minor_id */ +
3950 		4 /* so_major_id.len */ +
3951 		(XDR_QUADLEN(major_id_sz) * 4) +
3952 		4 /* eir_server_scope.len */ +
3953 		(XDR_QUADLEN(server_scope_sz) * 4) +
3954 		4 /* eir_server_impl_id.count (0) */);
3955 	if (!p)
3956 		return nfserr_resource;
3957 
3958 	/* The server_owner struct */
3959 	p = xdr_encode_hyper(p, minor_id);      /* Minor id */
3960 	/* major id */
3961 	p = xdr_encode_opaque(p, major_id, major_id_sz);
3962 
3963 	/* Server scope */
3964 	p = xdr_encode_opaque(p, server_scope, server_scope_sz);
3965 
3966 	/* Implementation id */
3967 	*p++ = cpu_to_be32(0);	/* zero length nfs_impl_id4 array */
3968 	return 0;
3969 out:
3970 	return status;
3971 }
3972 
3973 static __be32
3974 nfsd4_encode_create_session(struct nfsd4_compoundres *resp, __be32 nfserr,
3975 			    struct nfsd4_create_session *sess)
3976 {
3977 	struct xdr_stream *xdr = &resp->xdr;
3978 	__be32 *p;
3979 
3980 	if (nfserr)
3981 		return nfserr;
3982 
3983 	p = xdr_reserve_space(xdr, 24);
3984 	if (!p)
3985 		return nfserr_resource;
3986 	p = xdr_encode_opaque_fixed(p, sess->sessionid.data,
3987 					NFS4_MAX_SESSIONID_LEN);
3988 	*p++ = cpu_to_be32(sess->seqid);
3989 	*p++ = cpu_to_be32(sess->flags);
3990 
3991 	p = xdr_reserve_space(xdr, 28);
3992 	if (!p)
3993 		return nfserr_resource;
3994 	*p++ = cpu_to_be32(0); /* headerpadsz */
3995 	*p++ = cpu_to_be32(sess->fore_channel.maxreq_sz);
3996 	*p++ = cpu_to_be32(sess->fore_channel.maxresp_sz);
3997 	*p++ = cpu_to_be32(sess->fore_channel.maxresp_cached);
3998 	*p++ = cpu_to_be32(sess->fore_channel.maxops);
3999 	*p++ = cpu_to_be32(sess->fore_channel.maxreqs);
4000 	*p++ = cpu_to_be32(sess->fore_channel.nr_rdma_attrs);
4001 
4002 	if (sess->fore_channel.nr_rdma_attrs) {
4003 		p = xdr_reserve_space(xdr, 4);
4004 		if (!p)
4005 			return nfserr_resource;
4006 		*p++ = cpu_to_be32(sess->fore_channel.rdma_attrs);
4007 	}
4008 
4009 	p = xdr_reserve_space(xdr, 28);
4010 	if (!p)
4011 		return nfserr_resource;
4012 	*p++ = cpu_to_be32(0); /* headerpadsz */
4013 	*p++ = cpu_to_be32(sess->back_channel.maxreq_sz);
4014 	*p++ = cpu_to_be32(sess->back_channel.maxresp_sz);
4015 	*p++ = cpu_to_be32(sess->back_channel.maxresp_cached);
4016 	*p++ = cpu_to_be32(sess->back_channel.maxops);
4017 	*p++ = cpu_to_be32(sess->back_channel.maxreqs);
4018 	*p++ = cpu_to_be32(sess->back_channel.nr_rdma_attrs);
4019 
4020 	if (sess->back_channel.nr_rdma_attrs) {
4021 		p = xdr_reserve_space(xdr, 4);
4022 		if (!p)
4023 			return nfserr_resource;
4024 		*p++ = cpu_to_be32(sess->back_channel.rdma_attrs);
4025 	}
4026 	return 0;
4027 }
4028 
4029 static __be32
4030 nfsd4_encode_sequence(struct nfsd4_compoundres *resp, __be32 nfserr,
4031 		      struct nfsd4_sequence *seq)
4032 {
4033 	struct xdr_stream *xdr = &resp->xdr;
4034 	__be32 *p;
4035 
4036 	if (nfserr)
4037 		return nfserr;
4038 
4039 	p = xdr_reserve_space(xdr, NFS4_MAX_SESSIONID_LEN + 20);
4040 	if (!p)
4041 		return nfserr_resource;
4042 	p = xdr_encode_opaque_fixed(p, seq->sessionid.data,
4043 					NFS4_MAX_SESSIONID_LEN);
4044 	*p++ = cpu_to_be32(seq->seqid);
4045 	*p++ = cpu_to_be32(seq->slotid);
4046 	/* Note slotid's are numbered from zero: */
4047 	*p++ = cpu_to_be32(seq->maxslots - 1); /* sr_highest_slotid */
4048 	*p++ = cpu_to_be32(seq->maxslots - 1); /* sr_target_highest_slotid */
4049 	*p++ = cpu_to_be32(seq->status_flags);
4050 
4051 	resp->cstate.data_offset = xdr->buf->len; /* DRC cache data pointer */
4052 	return 0;
4053 }
4054 
4055 static __be32
4056 nfsd4_encode_test_stateid(struct nfsd4_compoundres *resp, __be32 nfserr,
4057 			  struct nfsd4_test_stateid *test_stateid)
4058 {
4059 	struct xdr_stream *xdr = &resp->xdr;
4060 	struct nfsd4_test_stateid_id *stateid, *next;
4061 	__be32 *p;
4062 
4063 	if (nfserr)
4064 		return nfserr;
4065 
4066 	p = xdr_reserve_space(xdr, 4 + (4 * test_stateid->ts_num_ids));
4067 	if (!p)
4068 		return nfserr_resource;
4069 	*p++ = htonl(test_stateid->ts_num_ids);
4070 
4071 	list_for_each_entry_safe(stateid, next, &test_stateid->ts_stateid_list, ts_id_list) {
4072 		*p++ = stateid->ts_id_status;
4073 	}
4074 
4075 	return nfserr;
4076 }
4077 
4078 #ifdef CONFIG_NFSD_PNFS
4079 static __be32
4080 nfsd4_encode_getdeviceinfo(struct nfsd4_compoundres *resp, __be32 nfserr,
4081 		struct nfsd4_getdeviceinfo *gdev)
4082 {
4083 	struct xdr_stream *xdr = &resp->xdr;
4084 	const struct nfsd4_layout_ops *ops =
4085 		nfsd4_layout_ops[gdev->gd_layout_type];
4086 	u32 starting_len = xdr->buf->len, needed_len;
4087 	__be32 *p;
4088 
4089 	dprintk("%s: err %d\n", __func__, be32_to_cpu(nfserr));
4090 	if (nfserr)
4091 		goto out;
4092 
4093 	nfserr = nfserr_resource;
4094 	p = xdr_reserve_space(xdr, 4);
4095 	if (!p)
4096 		goto out;
4097 
4098 	*p++ = cpu_to_be32(gdev->gd_layout_type);
4099 
4100 	/* If maxcount is 0 then just update notifications */
4101 	if (gdev->gd_maxcount != 0) {
4102 		nfserr = ops->encode_getdeviceinfo(xdr, gdev);
4103 		if (nfserr) {
4104 			/*
4105 			 * We don't bother to burden the layout drivers with
4106 			 * enforcing gd_maxcount, just tell the client to
4107 			 * come back with a bigger buffer if it's not enough.
4108 			 */
4109 			if (xdr->buf->len + 4 > gdev->gd_maxcount)
4110 				goto toosmall;
4111 			goto out;
4112 		}
4113 	}
4114 
4115 	nfserr = nfserr_resource;
4116 	if (gdev->gd_notify_types) {
4117 		p = xdr_reserve_space(xdr, 4 + 4);
4118 		if (!p)
4119 			goto out;
4120 		*p++ = cpu_to_be32(1);			/* bitmap length */
4121 		*p++ = cpu_to_be32(gdev->gd_notify_types);
4122 	} else {
4123 		p = xdr_reserve_space(xdr, 4);
4124 		if (!p)
4125 			goto out;
4126 		*p++ = 0;
4127 	}
4128 
4129 	nfserr = 0;
4130 out:
4131 	kfree(gdev->gd_device);
4132 	dprintk("%s: done: %d\n", __func__, be32_to_cpu(nfserr));
4133 	return nfserr;
4134 
4135 toosmall:
4136 	dprintk("%s: maxcount too small\n", __func__);
4137 	needed_len = xdr->buf->len + 4 /* notifications */;
4138 	xdr_truncate_encode(xdr, starting_len);
4139 	p = xdr_reserve_space(xdr, 4);
4140 	if (!p) {
4141 		nfserr = nfserr_resource;
4142 	} else {
4143 		*p++ = cpu_to_be32(needed_len);
4144 		nfserr = nfserr_toosmall;
4145 	}
4146 	goto out;
4147 }
4148 
4149 static __be32
4150 nfsd4_encode_layoutget(struct nfsd4_compoundres *resp, __be32 nfserr,
4151 		struct nfsd4_layoutget *lgp)
4152 {
4153 	struct xdr_stream *xdr = &resp->xdr;
4154 	const struct nfsd4_layout_ops *ops =
4155 		nfsd4_layout_ops[lgp->lg_layout_type];
4156 	__be32 *p;
4157 
4158 	dprintk("%s: err %d\n", __func__, nfserr);
4159 	if (nfserr)
4160 		goto out;
4161 
4162 	nfserr = nfserr_resource;
4163 	p = xdr_reserve_space(xdr, 36 + sizeof(stateid_opaque_t));
4164 	if (!p)
4165 		goto out;
4166 
4167 	*p++ = cpu_to_be32(1);	/* we always set return-on-close */
4168 	*p++ = cpu_to_be32(lgp->lg_sid.si_generation);
4169 	p = xdr_encode_opaque_fixed(p, &lgp->lg_sid.si_opaque,
4170 				    sizeof(stateid_opaque_t));
4171 
4172 	*p++ = cpu_to_be32(1);	/* we always return a single layout */
4173 	p = xdr_encode_hyper(p, lgp->lg_seg.offset);
4174 	p = xdr_encode_hyper(p, lgp->lg_seg.length);
4175 	*p++ = cpu_to_be32(lgp->lg_seg.iomode);
4176 	*p++ = cpu_to_be32(lgp->lg_layout_type);
4177 
4178 	nfserr = ops->encode_layoutget(xdr, lgp);
4179 out:
4180 	kfree(lgp->lg_content);
4181 	return nfserr;
4182 }
4183 
4184 static __be32
4185 nfsd4_encode_layoutcommit(struct nfsd4_compoundres *resp, __be32 nfserr,
4186 			  struct nfsd4_layoutcommit *lcp)
4187 {
4188 	struct xdr_stream *xdr = &resp->xdr;
4189 	__be32 *p;
4190 
4191 	if (nfserr)
4192 		return nfserr;
4193 
4194 	p = xdr_reserve_space(xdr, 4);
4195 	if (!p)
4196 		return nfserr_resource;
4197 	*p++ = cpu_to_be32(lcp->lc_size_chg);
4198 	if (lcp->lc_size_chg) {
4199 		p = xdr_reserve_space(xdr, 8);
4200 		if (!p)
4201 			return nfserr_resource;
4202 		p = xdr_encode_hyper(p, lcp->lc_newsize);
4203 	}
4204 
4205 	return nfs_ok;
4206 }
4207 
4208 static __be32
4209 nfsd4_encode_layoutreturn(struct nfsd4_compoundres *resp, __be32 nfserr,
4210 		struct nfsd4_layoutreturn *lrp)
4211 {
4212 	struct xdr_stream *xdr = &resp->xdr;
4213 	__be32 *p;
4214 
4215 	if (nfserr)
4216 		return nfserr;
4217 
4218 	p = xdr_reserve_space(xdr, 4);
4219 	if (!p)
4220 		return nfserr_resource;
4221 	*p++ = cpu_to_be32(lrp->lrs_present);
4222 	if (lrp->lrs_present)
4223 		return nfsd4_encode_stateid(xdr, &lrp->lr_sid);
4224 	return nfs_ok;
4225 }
4226 #endif /* CONFIG_NFSD_PNFS */
4227 
4228 static __be32
4229 nfsd42_encode_write_res(struct nfsd4_compoundres *resp, struct nfsd42_write_res *write)
4230 {
4231 	__be32 *p;
4232 
4233 	p = xdr_reserve_space(&resp->xdr, 4 + 8 + 4 + NFS4_VERIFIER_SIZE);
4234 	if (!p)
4235 		return nfserr_resource;
4236 
4237 	*p++ = cpu_to_be32(0);
4238 	p = xdr_encode_hyper(p, write->wr_bytes_written);
4239 	*p++ = cpu_to_be32(write->wr_stable_how);
4240 	p = xdr_encode_opaque_fixed(p, write->wr_verifier.data,
4241 				    NFS4_VERIFIER_SIZE);
4242 	return nfs_ok;
4243 }
4244 
4245 static __be32
4246 nfsd4_encode_copy(struct nfsd4_compoundres *resp, __be32 nfserr,
4247 		  struct nfsd4_copy *copy)
4248 {
4249 	__be32 *p;
4250 
4251 	if (!nfserr) {
4252 		nfserr = nfsd42_encode_write_res(resp, &copy->cp_res);
4253 		if (nfserr)
4254 			return nfserr;
4255 
4256 		p = xdr_reserve_space(&resp->xdr, 4 + 4);
4257 		*p++ = cpu_to_be32(copy->cp_consecutive);
4258 		*p++ = cpu_to_be32(copy->cp_synchronous);
4259 	}
4260 	return nfserr;
4261 }
4262 
4263 static __be32
4264 nfsd4_encode_seek(struct nfsd4_compoundres *resp, __be32 nfserr,
4265 		  struct nfsd4_seek *seek)
4266 {
4267 	__be32 *p;
4268 
4269 	if (nfserr)
4270 		return nfserr;
4271 
4272 	p = xdr_reserve_space(&resp->xdr, 4 + 8);
4273 	*p++ = cpu_to_be32(seek->seek_eof);
4274 	p = xdr_encode_hyper(p, seek->seek_pos);
4275 
4276 	return nfserr;
4277 }
4278 
4279 static __be32
4280 nfsd4_encode_noop(struct nfsd4_compoundres *resp, __be32 nfserr, void *p)
4281 {
4282 	return nfserr;
4283 }
4284 
4285 typedef __be32(* nfsd4_enc)(struct nfsd4_compoundres *, __be32, void *);
4286 
4287 /*
4288  * Note: nfsd4_enc_ops vector is shared for v4.0 and v4.1
4289  * since we don't need to filter out obsolete ops as this is
4290  * done in the decoding phase.
4291  */
4292 static nfsd4_enc nfsd4_enc_ops[] = {
4293 	[OP_ACCESS]		= (nfsd4_enc)nfsd4_encode_access,
4294 	[OP_CLOSE]		= (nfsd4_enc)nfsd4_encode_close,
4295 	[OP_COMMIT]		= (nfsd4_enc)nfsd4_encode_commit,
4296 	[OP_CREATE]		= (nfsd4_enc)nfsd4_encode_create,
4297 	[OP_DELEGPURGE]		= (nfsd4_enc)nfsd4_encode_noop,
4298 	[OP_DELEGRETURN]	= (nfsd4_enc)nfsd4_encode_noop,
4299 	[OP_GETATTR]		= (nfsd4_enc)nfsd4_encode_getattr,
4300 	[OP_GETFH]		= (nfsd4_enc)nfsd4_encode_getfh,
4301 	[OP_LINK]		= (nfsd4_enc)nfsd4_encode_link,
4302 	[OP_LOCK]		= (nfsd4_enc)nfsd4_encode_lock,
4303 	[OP_LOCKT]		= (nfsd4_enc)nfsd4_encode_lockt,
4304 	[OP_LOCKU]		= (nfsd4_enc)nfsd4_encode_locku,
4305 	[OP_LOOKUP]		= (nfsd4_enc)nfsd4_encode_noop,
4306 	[OP_LOOKUPP]		= (nfsd4_enc)nfsd4_encode_noop,
4307 	[OP_NVERIFY]		= (nfsd4_enc)nfsd4_encode_noop,
4308 	[OP_OPEN]		= (nfsd4_enc)nfsd4_encode_open,
4309 	[OP_OPENATTR]		= (nfsd4_enc)nfsd4_encode_noop,
4310 	[OP_OPEN_CONFIRM]	= (nfsd4_enc)nfsd4_encode_open_confirm,
4311 	[OP_OPEN_DOWNGRADE]	= (nfsd4_enc)nfsd4_encode_open_downgrade,
4312 	[OP_PUTFH]		= (nfsd4_enc)nfsd4_encode_noop,
4313 	[OP_PUTPUBFH]		= (nfsd4_enc)nfsd4_encode_noop,
4314 	[OP_PUTROOTFH]		= (nfsd4_enc)nfsd4_encode_noop,
4315 	[OP_READ]		= (nfsd4_enc)nfsd4_encode_read,
4316 	[OP_READDIR]		= (nfsd4_enc)nfsd4_encode_readdir,
4317 	[OP_READLINK]		= (nfsd4_enc)nfsd4_encode_readlink,
4318 	[OP_REMOVE]		= (nfsd4_enc)nfsd4_encode_remove,
4319 	[OP_RENAME]		= (nfsd4_enc)nfsd4_encode_rename,
4320 	[OP_RENEW]		= (nfsd4_enc)nfsd4_encode_noop,
4321 	[OP_RESTOREFH]		= (nfsd4_enc)nfsd4_encode_noop,
4322 	[OP_SAVEFH]		= (nfsd4_enc)nfsd4_encode_noop,
4323 	[OP_SECINFO]		= (nfsd4_enc)nfsd4_encode_secinfo,
4324 	[OP_SETATTR]		= (nfsd4_enc)nfsd4_encode_setattr,
4325 	[OP_SETCLIENTID]	= (nfsd4_enc)nfsd4_encode_setclientid,
4326 	[OP_SETCLIENTID_CONFIRM] = (nfsd4_enc)nfsd4_encode_noop,
4327 	[OP_VERIFY]		= (nfsd4_enc)nfsd4_encode_noop,
4328 	[OP_WRITE]		= (nfsd4_enc)nfsd4_encode_write,
4329 	[OP_RELEASE_LOCKOWNER]	= (nfsd4_enc)nfsd4_encode_noop,
4330 
4331 	/* NFSv4.1 operations */
4332 	[OP_BACKCHANNEL_CTL]	= (nfsd4_enc)nfsd4_encode_noop,
4333 	[OP_BIND_CONN_TO_SESSION] = (nfsd4_enc)nfsd4_encode_bind_conn_to_session,
4334 	[OP_EXCHANGE_ID]	= (nfsd4_enc)nfsd4_encode_exchange_id,
4335 	[OP_CREATE_SESSION]	= (nfsd4_enc)nfsd4_encode_create_session,
4336 	[OP_DESTROY_SESSION]	= (nfsd4_enc)nfsd4_encode_noop,
4337 	[OP_FREE_STATEID]	= (nfsd4_enc)nfsd4_encode_noop,
4338 	[OP_GET_DIR_DELEGATION]	= (nfsd4_enc)nfsd4_encode_noop,
4339 #ifdef CONFIG_NFSD_PNFS
4340 	[OP_GETDEVICEINFO]	= (nfsd4_enc)nfsd4_encode_getdeviceinfo,
4341 	[OP_GETDEVICELIST]	= (nfsd4_enc)nfsd4_encode_noop,
4342 	[OP_LAYOUTCOMMIT]	= (nfsd4_enc)nfsd4_encode_layoutcommit,
4343 	[OP_LAYOUTGET]		= (nfsd4_enc)nfsd4_encode_layoutget,
4344 	[OP_LAYOUTRETURN]	= (nfsd4_enc)nfsd4_encode_layoutreturn,
4345 #else
4346 	[OP_GETDEVICEINFO]	= (nfsd4_enc)nfsd4_encode_noop,
4347 	[OP_GETDEVICELIST]	= (nfsd4_enc)nfsd4_encode_noop,
4348 	[OP_LAYOUTCOMMIT]	= (nfsd4_enc)nfsd4_encode_noop,
4349 	[OP_LAYOUTGET]		= (nfsd4_enc)nfsd4_encode_noop,
4350 	[OP_LAYOUTRETURN]	= (nfsd4_enc)nfsd4_encode_noop,
4351 #endif
4352 	[OP_SECINFO_NO_NAME]	= (nfsd4_enc)nfsd4_encode_secinfo_no_name,
4353 	[OP_SEQUENCE]		= (nfsd4_enc)nfsd4_encode_sequence,
4354 	[OP_SET_SSV]		= (nfsd4_enc)nfsd4_encode_noop,
4355 	[OP_TEST_STATEID]	= (nfsd4_enc)nfsd4_encode_test_stateid,
4356 	[OP_WANT_DELEGATION]	= (nfsd4_enc)nfsd4_encode_noop,
4357 	[OP_DESTROY_CLIENTID]	= (nfsd4_enc)nfsd4_encode_noop,
4358 	[OP_RECLAIM_COMPLETE]	= (nfsd4_enc)nfsd4_encode_noop,
4359 
4360 	/* NFSv4.2 operations */
4361 	[OP_ALLOCATE]		= (nfsd4_enc)nfsd4_encode_noop,
4362 	[OP_COPY]		= (nfsd4_enc)nfsd4_encode_copy,
4363 	[OP_COPY_NOTIFY]	= (nfsd4_enc)nfsd4_encode_noop,
4364 	[OP_DEALLOCATE]		= (nfsd4_enc)nfsd4_encode_noop,
4365 	[OP_IO_ADVISE]		= (nfsd4_enc)nfsd4_encode_noop,
4366 	[OP_LAYOUTERROR]	= (nfsd4_enc)nfsd4_encode_noop,
4367 	[OP_LAYOUTSTATS]	= (nfsd4_enc)nfsd4_encode_noop,
4368 	[OP_OFFLOAD_CANCEL]	= (nfsd4_enc)nfsd4_encode_noop,
4369 	[OP_OFFLOAD_STATUS]	= (nfsd4_enc)nfsd4_encode_noop,
4370 	[OP_READ_PLUS]		= (nfsd4_enc)nfsd4_encode_noop,
4371 	[OP_SEEK]		= (nfsd4_enc)nfsd4_encode_seek,
4372 	[OP_WRITE_SAME]		= (nfsd4_enc)nfsd4_encode_noop,
4373 	[OP_CLONE]		= (nfsd4_enc)nfsd4_encode_noop,
4374 };
4375 
4376 /*
4377  * Calculate whether we still have space to encode repsize bytes.
4378  * There are two considerations:
4379  *     - For NFS versions >=4.1, the size of the reply must stay within
4380  *       session limits
4381  *     - For all NFS versions, we must stay within limited preallocated
4382  *       buffer space.
4383  *
4384  * This is called before the operation is processed, so can only provide
4385  * an upper estimate.  For some nonidempotent operations (such as
4386  * getattr), it's not necessarily a problem if that estimate is wrong,
4387  * as we can fail it after processing without significant side effects.
4388  */
4389 __be32 nfsd4_check_resp_size(struct nfsd4_compoundres *resp, u32 respsize)
4390 {
4391 	struct xdr_buf *buf = &resp->rqstp->rq_res;
4392 	struct nfsd4_slot *slot = resp->cstate.slot;
4393 
4394 	if (buf->len + respsize <= buf->buflen)
4395 		return nfs_ok;
4396 	if (!nfsd4_has_session(&resp->cstate))
4397 		return nfserr_resource;
4398 	if (slot->sl_flags & NFSD4_SLOT_CACHETHIS) {
4399 		WARN_ON_ONCE(1);
4400 		return nfserr_rep_too_big_to_cache;
4401 	}
4402 	return nfserr_rep_too_big;
4403 }
4404 
4405 void
4406 nfsd4_encode_operation(struct nfsd4_compoundres *resp, struct nfsd4_op *op)
4407 {
4408 	struct xdr_stream *xdr = &resp->xdr;
4409 	struct nfs4_stateowner *so = resp->cstate.replay_owner;
4410 	struct svc_rqst *rqstp = resp->rqstp;
4411 	int post_err_offset;
4412 	nfsd4_enc encoder;
4413 	__be32 *p;
4414 
4415 	p = xdr_reserve_space(xdr, 8);
4416 	if (!p) {
4417 		WARN_ON_ONCE(1);
4418 		return;
4419 	}
4420 	*p++ = cpu_to_be32(op->opnum);
4421 	post_err_offset = xdr->buf->len;
4422 
4423 	if (op->opnum == OP_ILLEGAL)
4424 		goto status;
4425 	BUG_ON(op->opnum < 0 || op->opnum >= ARRAY_SIZE(nfsd4_enc_ops) ||
4426 	       !nfsd4_enc_ops[op->opnum]);
4427 	encoder = nfsd4_enc_ops[op->opnum];
4428 	op->status = encoder(resp, op->status, &op->u);
4429 	xdr_commit_encode(xdr);
4430 
4431 	/* nfsd4_check_resp_size guarantees enough room for error status */
4432 	if (!op->status) {
4433 		int space_needed = 0;
4434 		if (!nfsd4_last_compound_op(rqstp))
4435 			space_needed = COMPOUND_ERR_SLACK_SPACE;
4436 		op->status = nfsd4_check_resp_size(resp, space_needed);
4437 	}
4438 	if (op->status == nfserr_resource && nfsd4_has_session(&resp->cstate)) {
4439 		struct nfsd4_slot *slot = resp->cstate.slot;
4440 
4441 		if (slot->sl_flags & NFSD4_SLOT_CACHETHIS)
4442 			op->status = nfserr_rep_too_big_to_cache;
4443 		else
4444 			op->status = nfserr_rep_too_big;
4445 	}
4446 	if (op->status == nfserr_resource ||
4447 	    op->status == nfserr_rep_too_big ||
4448 	    op->status == nfserr_rep_too_big_to_cache) {
4449 		/*
4450 		 * The operation may have already been encoded or
4451 		 * partially encoded.  No op returns anything additional
4452 		 * in the case of one of these three errors, so we can
4453 		 * just truncate back to after the status.  But it's a
4454 		 * bug if we had to do this on a non-idempotent op:
4455 		 */
4456 		warn_on_nonidempotent_op(op);
4457 		xdr_truncate_encode(xdr, post_err_offset);
4458 	}
4459 	if (so) {
4460 		int len = xdr->buf->len - post_err_offset;
4461 
4462 		so->so_replay.rp_status = op->status;
4463 		so->so_replay.rp_buflen = len;
4464 		read_bytes_from_xdr_buf(xdr->buf, post_err_offset,
4465 						so->so_replay.rp_buf, len);
4466 	}
4467 status:
4468 	/* Note that op->status is already in network byte order: */
4469 	write_bytes_to_xdr_buf(xdr->buf, post_err_offset - 4, &op->status, 4);
4470 }
4471 
4472 /*
4473  * Encode the reply stored in the stateowner reply cache
4474  *
4475  * XDR note: do not encode rp->rp_buflen: the buffer contains the
4476  * previously sent already encoded operation.
4477  */
4478 void
4479 nfsd4_encode_replay(struct xdr_stream *xdr, struct nfsd4_op *op)
4480 {
4481 	__be32 *p;
4482 	struct nfs4_replay *rp = op->replay;
4483 
4484 	BUG_ON(!rp);
4485 
4486 	p = xdr_reserve_space(xdr, 8 + rp->rp_buflen);
4487 	if (!p) {
4488 		WARN_ON_ONCE(1);
4489 		return;
4490 	}
4491 	*p++ = cpu_to_be32(op->opnum);
4492 	*p++ = rp->rp_status;  /* already xdr'ed */
4493 
4494 	p = xdr_encode_opaque_fixed(p, rp->rp_buf, rp->rp_buflen);
4495 }
4496 
4497 int
4498 nfs4svc_encode_voidres(struct svc_rqst *rqstp, __be32 *p, void *dummy)
4499 {
4500         return xdr_ressize_check(rqstp, p);
4501 }
4502 
4503 int nfsd4_release_compoundargs(void *rq, __be32 *p, void *resp)
4504 {
4505 	struct svc_rqst *rqstp = rq;
4506 	struct nfsd4_compoundargs *args = rqstp->rq_argp;
4507 
4508 	if (args->ops != args->iops) {
4509 		kfree(args->ops);
4510 		args->ops = args->iops;
4511 	}
4512 	kfree(args->tmpp);
4513 	args->tmpp = NULL;
4514 	while (args->to_free) {
4515 		struct svcxdr_tmpbuf *tb = args->to_free;
4516 		args->to_free = tb->next;
4517 		kfree(tb);
4518 	}
4519 	return 1;
4520 }
4521 
4522 int
4523 nfs4svc_decode_compoundargs(struct svc_rqst *rqstp, __be32 *p, struct nfsd4_compoundargs *args)
4524 {
4525 	if (rqstp->rq_arg.head[0].iov_len % 4) {
4526 		/* client is nuts */
4527 		dprintk("%s: compound not properly padded! (peeraddr=%pISc xid=0x%x)",
4528 			__func__, svc_addr(rqstp), be32_to_cpu(rqstp->rq_xid));
4529 		return 0;
4530 	}
4531 	args->p = p;
4532 	args->end = rqstp->rq_arg.head[0].iov_base + rqstp->rq_arg.head[0].iov_len;
4533 	args->pagelist = rqstp->rq_arg.pages;
4534 	args->pagelen = rqstp->rq_arg.page_len;
4535 	args->tmpp = NULL;
4536 	args->to_free = NULL;
4537 	args->ops = args->iops;
4538 	args->rqstp = rqstp;
4539 
4540 	return !nfsd4_decode_compound(args);
4541 }
4542 
4543 int
4544 nfs4svc_encode_compoundres(struct svc_rqst *rqstp, __be32 *p, struct nfsd4_compoundres *resp)
4545 {
4546 	/*
4547 	 * All that remains is to write the tag and operation count...
4548 	 */
4549 	struct xdr_buf *buf = resp->xdr.buf;
4550 
4551 	WARN_ON_ONCE(buf->len != buf->head[0].iov_len + buf->page_len +
4552 				 buf->tail[0].iov_len);
4553 
4554 	rqstp->rq_next_page = resp->xdr.page_ptr + 1;
4555 
4556 	p = resp->tagp;
4557 	*p++ = htonl(resp->taglen);
4558 	memcpy(p, resp->tag, resp->taglen);
4559 	p += XDR_QUADLEN(resp->taglen);
4560 	*p++ = htonl(resp->opcnt);
4561 
4562 	nfsd4_sequence_done(resp);
4563 	return 1;
4564 }
4565 
4566 /*
4567  * Local variables:
4568  *  c-basic-offset: 8
4569  * End:
4570  */
4571