xref: /openbmc/linux/fs/nfsd/vfs.c (revision 6774def6)
1 /*
2  * File operations used by nfsd. Some of these have been ripped from
3  * other parts of the kernel because they weren't exported, others
4  * are partial duplicates with added or changed functionality.
5  *
6  * Note that several functions dget() the dentry upon which they want
7  * to act, most notably those that create directory entries. Response
8  * dentry's are dput()'d if necessary in the release callback.
9  * So if you notice code paths that apparently fail to dput() the
10  * dentry, don't worry--they have been taken care of.
11  *
12  * Copyright (C) 1995-1999 Olaf Kirch <okir@monad.swb.de>
13  * Zerocpy NFS support (C) 2002 Hirokazu Takahashi <taka@valinux.co.jp>
14  */
15 
16 #include <linux/fs.h>
17 #include <linux/file.h>
18 #include <linux/splice.h>
19 #include <linux/fcntl.h>
20 #include <linux/namei.h>
21 #include <linux/delay.h>
22 #include <linux/fsnotify.h>
23 #include <linux/posix_acl_xattr.h>
24 #include <linux/xattr.h>
25 #include <linux/jhash.h>
26 #include <linux/ima.h>
27 #include <linux/slab.h>
28 #include <asm/uaccess.h>
29 #include <linux/exportfs.h>
30 #include <linux/writeback.h>
31 #include <linux/security.h>
32 
33 #ifdef CONFIG_NFSD_V3
34 #include "xdr3.h"
35 #endif /* CONFIG_NFSD_V3 */
36 
37 #ifdef CONFIG_NFSD_V4
38 #include "acl.h"
39 #include "idmap.h"
40 #endif /* CONFIG_NFSD_V4 */
41 
42 #include "nfsd.h"
43 #include "vfs.h"
44 
45 #define NFSDDBG_FACILITY		NFSDDBG_FILEOP
46 
47 
48 /*
49  * This is a cache of readahead params that help us choose the proper
50  * readahead strategy. Initially, we set all readahead parameters to 0
51  * and let the VFS handle things.
52  * If you increase the number of cached files very much, you'll need to
53  * add a hash table here.
54  */
55 struct raparms {
56 	struct raparms		*p_next;
57 	unsigned int		p_count;
58 	ino_t			p_ino;
59 	dev_t			p_dev;
60 	int			p_set;
61 	struct file_ra_state	p_ra;
62 	unsigned int		p_hindex;
63 };
64 
65 struct raparm_hbucket {
66 	struct raparms		*pb_head;
67 	spinlock_t		pb_lock;
68 } ____cacheline_aligned_in_smp;
69 
70 #define RAPARM_HASH_BITS	4
71 #define RAPARM_HASH_SIZE	(1<<RAPARM_HASH_BITS)
72 #define RAPARM_HASH_MASK	(RAPARM_HASH_SIZE-1)
73 static struct raparm_hbucket	raparm_hash[RAPARM_HASH_SIZE];
74 
75 /*
76  * Called from nfsd_lookup and encode_dirent. Check if we have crossed
77  * a mount point.
78  * Returns -EAGAIN or -ETIMEDOUT leaving *dpp and *expp unchanged,
79  *  or nfs_ok having possibly changed *dpp and *expp
80  */
81 int
82 nfsd_cross_mnt(struct svc_rqst *rqstp, struct dentry **dpp,
83 		        struct svc_export **expp)
84 {
85 	struct svc_export *exp = *expp, *exp2 = NULL;
86 	struct dentry *dentry = *dpp;
87 	struct path path = {.mnt = mntget(exp->ex_path.mnt),
88 			    .dentry = dget(dentry)};
89 	int err = 0;
90 
91 	err = follow_down(&path);
92 	if (err < 0)
93 		goto out;
94 
95 	exp2 = rqst_exp_get_by_name(rqstp, &path);
96 	if (IS_ERR(exp2)) {
97 		err = PTR_ERR(exp2);
98 		/*
99 		 * We normally allow NFS clients to continue
100 		 * "underneath" a mountpoint that is not exported.
101 		 * The exception is V4ROOT, where no traversal is ever
102 		 * allowed without an explicit export of the new
103 		 * directory.
104 		 */
105 		if (err == -ENOENT && !(exp->ex_flags & NFSEXP_V4ROOT))
106 			err = 0;
107 		path_put(&path);
108 		goto out;
109 	}
110 	if (nfsd_v4client(rqstp) ||
111 		(exp->ex_flags & NFSEXP_CROSSMOUNT) || EX_NOHIDE(exp2)) {
112 		/* successfully crossed mount point */
113 		/*
114 		 * This is subtle: path.dentry is *not* on path.mnt
115 		 * at this point.  The only reason we are safe is that
116 		 * original mnt is pinned down by exp, so we should
117 		 * put path *before* putting exp
118 		 */
119 		*dpp = path.dentry;
120 		path.dentry = dentry;
121 		*expp = exp2;
122 		exp2 = exp;
123 	}
124 	path_put(&path);
125 	exp_put(exp2);
126 out:
127 	return err;
128 }
129 
130 static void follow_to_parent(struct path *path)
131 {
132 	struct dentry *dp;
133 
134 	while (path->dentry == path->mnt->mnt_root && follow_up(path))
135 		;
136 	dp = dget_parent(path->dentry);
137 	dput(path->dentry);
138 	path->dentry = dp;
139 }
140 
141 static int nfsd_lookup_parent(struct svc_rqst *rqstp, struct dentry *dparent, struct svc_export **exp, struct dentry **dentryp)
142 {
143 	struct svc_export *exp2;
144 	struct path path = {.mnt = mntget((*exp)->ex_path.mnt),
145 			    .dentry = dget(dparent)};
146 
147 	follow_to_parent(&path);
148 
149 	exp2 = rqst_exp_parent(rqstp, &path);
150 	if (PTR_ERR(exp2) == -ENOENT) {
151 		*dentryp = dget(dparent);
152 	} else if (IS_ERR(exp2)) {
153 		path_put(&path);
154 		return PTR_ERR(exp2);
155 	} else {
156 		*dentryp = dget(path.dentry);
157 		exp_put(*exp);
158 		*exp = exp2;
159 	}
160 	path_put(&path);
161 	return 0;
162 }
163 
164 /*
165  * For nfsd purposes, we treat V4ROOT exports as though there was an
166  * export at *every* directory.
167  */
168 int nfsd_mountpoint(struct dentry *dentry, struct svc_export *exp)
169 {
170 	if (d_mountpoint(dentry))
171 		return 1;
172 	if (nfsd4_is_junction(dentry))
173 		return 1;
174 	if (!(exp->ex_flags & NFSEXP_V4ROOT))
175 		return 0;
176 	return dentry->d_inode != NULL;
177 }
178 
179 __be32
180 nfsd_lookup_dentry(struct svc_rqst *rqstp, struct svc_fh *fhp,
181 		   const char *name, unsigned int len,
182 		   struct svc_export **exp_ret, struct dentry **dentry_ret)
183 {
184 	struct svc_export	*exp;
185 	struct dentry		*dparent;
186 	struct dentry		*dentry;
187 	int			host_err;
188 
189 	dprintk("nfsd: nfsd_lookup(fh %s, %.*s)\n", SVCFH_fmt(fhp), len,name);
190 
191 	dparent = fhp->fh_dentry;
192 	exp = exp_get(fhp->fh_export);
193 
194 	/* Lookup the name, but don't follow links */
195 	if (isdotent(name, len)) {
196 		if (len==1)
197 			dentry = dget(dparent);
198 		else if (dparent != exp->ex_path.dentry)
199 			dentry = dget_parent(dparent);
200 		else if (!EX_NOHIDE(exp) && !nfsd_v4client(rqstp))
201 			dentry = dget(dparent); /* .. == . just like at / */
202 		else {
203 			/* checking mountpoint crossing is very different when stepping up */
204 			host_err = nfsd_lookup_parent(rqstp, dparent, &exp, &dentry);
205 			if (host_err)
206 				goto out_nfserr;
207 		}
208 	} else {
209 		/*
210 		 * In the nfsd4_open() case, this may be held across
211 		 * subsequent open and delegation acquisition which may
212 		 * need to take the child's i_mutex:
213 		 */
214 		fh_lock_nested(fhp, I_MUTEX_PARENT);
215 		dentry = lookup_one_len(name, dparent, len);
216 		host_err = PTR_ERR(dentry);
217 		if (IS_ERR(dentry))
218 			goto out_nfserr;
219 		/*
220 		 * check if we have crossed a mount point ...
221 		 */
222 		if (nfsd_mountpoint(dentry, exp)) {
223 			if ((host_err = nfsd_cross_mnt(rqstp, &dentry, &exp))) {
224 				dput(dentry);
225 				goto out_nfserr;
226 			}
227 		}
228 	}
229 	*dentry_ret = dentry;
230 	*exp_ret = exp;
231 	return 0;
232 
233 out_nfserr:
234 	exp_put(exp);
235 	return nfserrno(host_err);
236 }
237 
238 /*
239  * Look up one component of a pathname.
240  * N.B. After this call _both_ fhp and resfh need an fh_put
241  *
242  * If the lookup would cross a mountpoint, and the mounted filesystem
243  * is exported to the client with NFSEXP_NOHIDE, then the lookup is
244  * accepted as it stands and the mounted directory is
245  * returned. Otherwise the covered directory is returned.
246  * NOTE: this mountpoint crossing is not supported properly by all
247  *   clients and is explicitly disallowed for NFSv3
248  *      NeilBrown <neilb@cse.unsw.edu.au>
249  */
250 __be32
251 nfsd_lookup(struct svc_rqst *rqstp, struct svc_fh *fhp, const char *name,
252 				unsigned int len, struct svc_fh *resfh)
253 {
254 	struct svc_export	*exp;
255 	struct dentry		*dentry;
256 	__be32 err;
257 
258 	err = fh_verify(rqstp, fhp, S_IFDIR, NFSD_MAY_EXEC);
259 	if (err)
260 		return err;
261 	err = nfsd_lookup_dentry(rqstp, fhp, name, len, &exp, &dentry);
262 	if (err)
263 		return err;
264 	err = check_nfsd_access(exp, rqstp);
265 	if (err)
266 		goto out;
267 	/*
268 	 * Note: we compose the file handle now, but as the
269 	 * dentry may be negative, it may need to be updated.
270 	 */
271 	err = fh_compose(resfh, exp, dentry, fhp);
272 	if (!err && !dentry->d_inode)
273 		err = nfserr_noent;
274 out:
275 	dput(dentry);
276 	exp_put(exp);
277 	return err;
278 }
279 
280 /*
281  * Commit metadata changes to stable storage.
282  */
283 static int
284 commit_metadata(struct svc_fh *fhp)
285 {
286 	struct inode *inode = fhp->fh_dentry->d_inode;
287 	const struct export_operations *export_ops = inode->i_sb->s_export_op;
288 
289 	if (!EX_ISSYNC(fhp->fh_export))
290 		return 0;
291 
292 	if (export_ops->commit_metadata)
293 		return export_ops->commit_metadata(inode);
294 	return sync_inode_metadata(inode, 1);
295 }
296 
297 /*
298  * Go over the attributes and take care of the small differences between
299  * NFS semantics and what Linux expects.
300  */
301 static void
302 nfsd_sanitize_attrs(struct inode *inode, struct iattr *iap)
303 {
304 	/*
305 	 * NFSv2 does not differentiate between "set-[ac]time-to-now"
306 	 * which only requires access, and "set-[ac]time-to-X" which
307 	 * requires ownership.
308 	 * So if it looks like it might be "set both to the same time which
309 	 * is close to now", and if inode_change_ok fails, then we
310 	 * convert to "set to now" instead of "set to explicit time"
311 	 *
312 	 * We only call inode_change_ok as the last test as technically
313 	 * it is not an interface that we should be using.
314 	 */
315 #define BOTH_TIME_SET (ATTR_ATIME_SET | ATTR_MTIME_SET)
316 #define	MAX_TOUCH_TIME_ERROR (30*60)
317 	if ((iap->ia_valid & BOTH_TIME_SET) == BOTH_TIME_SET &&
318 	    iap->ia_mtime.tv_sec == iap->ia_atime.tv_sec) {
319 		/*
320 		 * Looks probable.
321 		 *
322 		 * Now just make sure time is in the right ballpark.
323 		 * Solaris, at least, doesn't seem to care what the time
324 		 * request is.  We require it be within 30 minutes of now.
325 		 */
326 		time_t delta = iap->ia_atime.tv_sec - get_seconds();
327 		if (delta < 0)
328 			delta = -delta;
329 		if (delta < MAX_TOUCH_TIME_ERROR &&
330 		    inode_change_ok(inode, iap) != 0) {
331 			/*
332 			 * Turn off ATTR_[AM]TIME_SET but leave ATTR_[AM]TIME.
333 			 * This will cause notify_change to set these times
334 			 * to "now"
335 			 */
336 			iap->ia_valid &= ~BOTH_TIME_SET;
337 		}
338 	}
339 
340 	/* sanitize the mode change */
341 	if (iap->ia_valid & ATTR_MODE) {
342 		iap->ia_mode &= S_IALLUGO;
343 		iap->ia_mode |= (inode->i_mode & ~S_IALLUGO);
344 	}
345 
346 	/* Revoke setuid/setgid on chown */
347 	if (!S_ISDIR(inode->i_mode) &&
348 	    ((iap->ia_valid & ATTR_UID) || (iap->ia_valid & ATTR_GID))) {
349 		iap->ia_valid |= ATTR_KILL_PRIV;
350 		if (iap->ia_valid & ATTR_MODE) {
351 			/* we're setting mode too, just clear the s*id bits */
352 			iap->ia_mode &= ~S_ISUID;
353 			if (iap->ia_mode & S_IXGRP)
354 				iap->ia_mode &= ~S_ISGID;
355 		} else {
356 			/* set ATTR_KILL_* bits and let VFS handle it */
357 			iap->ia_valid |= (ATTR_KILL_SUID | ATTR_KILL_SGID);
358 		}
359 	}
360 }
361 
362 static __be32
363 nfsd_get_write_access(struct svc_rqst *rqstp, struct svc_fh *fhp,
364 		struct iattr *iap)
365 {
366 	struct inode *inode = fhp->fh_dentry->d_inode;
367 	int host_err;
368 
369 	if (iap->ia_size < inode->i_size) {
370 		__be32 err;
371 
372 		err = nfsd_permission(rqstp, fhp->fh_export, fhp->fh_dentry,
373 				NFSD_MAY_TRUNC | NFSD_MAY_OWNER_OVERRIDE);
374 		if (err)
375 			return err;
376 	}
377 
378 	host_err = get_write_access(inode);
379 	if (host_err)
380 		goto out_nfserrno;
381 
382 	host_err = locks_verify_truncate(inode, NULL, iap->ia_size);
383 	if (host_err)
384 		goto out_put_write_access;
385 	return 0;
386 
387 out_put_write_access:
388 	put_write_access(inode);
389 out_nfserrno:
390 	return nfserrno(host_err);
391 }
392 
393 /*
394  * Set various file attributes.  After this call fhp needs an fh_put.
395  */
396 __be32
397 nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp, struct iattr *iap,
398 	     int check_guard, time_t guardtime)
399 {
400 	struct dentry	*dentry;
401 	struct inode	*inode;
402 	int		accmode = NFSD_MAY_SATTR;
403 	umode_t		ftype = 0;
404 	__be32		err;
405 	int		host_err;
406 	bool		get_write_count;
407 	int		size_change = 0;
408 
409 	if (iap->ia_valid & (ATTR_ATIME | ATTR_MTIME | ATTR_SIZE))
410 		accmode |= NFSD_MAY_WRITE|NFSD_MAY_OWNER_OVERRIDE;
411 	if (iap->ia_valid & ATTR_SIZE)
412 		ftype = S_IFREG;
413 
414 	/* Callers that do fh_verify should do the fh_want_write: */
415 	get_write_count = !fhp->fh_dentry;
416 
417 	/* Get inode */
418 	err = fh_verify(rqstp, fhp, ftype, accmode);
419 	if (err)
420 		goto out;
421 	if (get_write_count) {
422 		host_err = fh_want_write(fhp);
423 		if (host_err)
424 			return nfserrno(host_err);
425 	}
426 
427 	dentry = fhp->fh_dentry;
428 	inode = dentry->d_inode;
429 
430 	/* Ignore any mode updates on symlinks */
431 	if (S_ISLNK(inode->i_mode))
432 		iap->ia_valid &= ~ATTR_MODE;
433 
434 	if (!iap->ia_valid)
435 		goto out;
436 
437 	nfsd_sanitize_attrs(inode, iap);
438 
439 	/*
440 	 * The size case is special, it changes the file in addition to the
441 	 * attributes.
442 	 */
443 	if (iap->ia_valid & ATTR_SIZE) {
444 		err = nfsd_get_write_access(rqstp, fhp, iap);
445 		if (err)
446 			goto out;
447 		size_change = 1;
448 
449 		/*
450 		 * RFC5661, Section 18.30.4:
451 		 *   Changing the size of a file with SETATTR indirectly
452 		 *   changes the time_modify and change attributes.
453 		 *
454 		 * (and similar for the older RFCs)
455 		 */
456 		if (iap->ia_size != i_size_read(inode))
457 			iap->ia_valid |= ATTR_MTIME;
458 	}
459 
460 	iap->ia_valid |= ATTR_CTIME;
461 
462 	if (check_guard && guardtime != inode->i_ctime.tv_sec) {
463 		err = nfserr_notsync;
464 		goto out_put_write_access;
465 	}
466 
467 	fh_lock(fhp);
468 	host_err = notify_change(dentry, iap, NULL);
469 	fh_unlock(fhp);
470 	err = nfserrno(host_err);
471 
472 out_put_write_access:
473 	if (size_change)
474 		put_write_access(inode);
475 	if (!err)
476 		err = nfserrno(commit_metadata(fhp));
477 out:
478 	return err;
479 }
480 
481 #if defined(CONFIG_NFSD_V4)
482 /*
483  * NFS junction information is stored in an extended attribute.
484  */
485 #define NFSD_JUNCTION_XATTR_NAME	XATTR_TRUSTED_PREFIX "junction.nfs"
486 
487 /**
488  * nfsd4_is_junction - Test if an object could be an NFS junction
489  *
490  * @dentry: object to test
491  *
492  * Returns 1 if "dentry" appears to contain NFS junction information.
493  * Otherwise 0 is returned.
494  */
495 int nfsd4_is_junction(struct dentry *dentry)
496 {
497 	struct inode *inode = dentry->d_inode;
498 
499 	if (inode == NULL)
500 		return 0;
501 	if (inode->i_mode & S_IXUGO)
502 		return 0;
503 	if (!(inode->i_mode & S_ISVTX))
504 		return 0;
505 	if (vfs_getxattr(dentry, NFSD_JUNCTION_XATTR_NAME, NULL, 0) <= 0)
506 		return 0;
507 	return 1;
508 }
509 #ifdef CONFIG_NFSD_V4_SECURITY_LABEL
510 __be32 nfsd4_set_nfs4_label(struct svc_rqst *rqstp, struct svc_fh *fhp,
511 		struct xdr_netobj *label)
512 {
513 	__be32 error;
514 	int host_error;
515 	struct dentry *dentry;
516 
517 	error = fh_verify(rqstp, fhp, 0 /* S_IFREG */, NFSD_MAY_SATTR);
518 	if (error)
519 		return error;
520 
521 	dentry = fhp->fh_dentry;
522 
523 	mutex_lock(&dentry->d_inode->i_mutex);
524 	host_error = security_inode_setsecctx(dentry, label->data, label->len);
525 	mutex_unlock(&dentry->d_inode->i_mutex);
526 	return nfserrno(host_error);
527 }
528 #else
529 __be32 nfsd4_set_nfs4_label(struct svc_rqst *rqstp, struct svc_fh *fhp,
530 		struct xdr_netobj *label)
531 {
532 	return nfserr_notsupp;
533 }
534 #endif
535 
536 #endif /* defined(CONFIG_NFSD_V4) */
537 
538 #ifdef CONFIG_NFSD_V3
539 /*
540  * Check server access rights to a file system object
541  */
542 struct accessmap {
543 	u32		access;
544 	int		how;
545 };
546 static struct accessmap	nfs3_regaccess[] = {
547     {	NFS3_ACCESS_READ,	NFSD_MAY_READ			},
548     {	NFS3_ACCESS_EXECUTE,	NFSD_MAY_EXEC			},
549     {	NFS3_ACCESS_MODIFY,	NFSD_MAY_WRITE|NFSD_MAY_TRUNC	},
550     {	NFS3_ACCESS_EXTEND,	NFSD_MAY_WRITE			},
551 
552     {	0,			0				}
553 };
554 
555 static struct accessmap	nfs3_diraccess[] = {
556     {	NFS3_ACCESS_READ,	NFSD_MAY_READ			},
557     {	NFS3_ACCESS_LOOKUP,	NFSD_MAY_EXEC			},
558     {	NFS3_ACCESS_MODIFY,	NFSD_MAY_EXEC|NFSD_MAY_WRITE|NFSD_MAY_TRUNC},
559     {	NFS3_ACCESS_EXTEND,	NFSD_MAY_EXEC|NFSD_MAY_WRITE	},
560     {	NFS3_ACCESS_DELETE,	NFSD_MAY_REMOVE			},
561 
562     {	0,			0				}
563 };
564 
565 static struct accessmap	nfs3_anyaccess[] = {
566 	/* Some clients - Solaris 2.6 at least, make an access call
567 	 * to the server to check for access for things like /dev/null
568 	 * (which really, the server doesn't care about).  So
569 	 * We provide simple access checking for them, looking
570 	 * mainly at mode bits, and we make sure to ignore read-only
571 	 * filesystem checks
572 	 */
573     {	NFS3_ACCESS_READ,	NFSD_MAY_READ			},
574     {	NFS3_ACCESS_EXECUTE,	NFSD_MAY_EXEC			},
575     {	NFS3_ACCESS_MODIFY,	NFSD_MAY_WRITE|NFSD_MAY_LOCAL_ACCESS	},
576     {	NFS3_ACCESS_EXTEND,	NFSD_MAY_WRITE|NFSD_MAY_LOCAL_ACCESS	},
577 
578     {	0,			0				}
579 };
580 
581 __be32
582 nfsd_access(struct svc_rqst *rqstp, struct svc_fh *fhp, u32 *access, u32 *supported)
583 {
584 	struct accessmap	*map;
585 	struct svc_export	*export;
586 	struct dentry		*dentry;
587 	u32			query, result = 0, sresult = 0;
588 	__be32			error;
589 
590 	error = fh_verify(rqstp, fhp, 0, NFSD_MAY_NOP);
591 	if (error)
592 		goto out;
593 
594 	export = fhp->fh_export;
595 	dentry = fhp->fh_dentry;
596 
597 	if (S_ISREG(dentry->d_inode->i_mode))
598 		map = nfs3_regaccess;
599 	else if (S_ISDIR(dentry->d_inode->i_mode))
600 		map = nfs3_diraccess;
601 	else
602 		map = nfs3_anyaccess;
603 
604 
605 	query = *access;
606 	for  (; map->access; map++) {
607 		if (map->access & query) {
608 			__be32 err2;
609 
610 			sresult |= map->access;
611 
612 			err2 = nfsd_permission(rqstp, export, dentry, map->how);
613 			switch (err2) {
614 			case nfs_ok:
615 				result |= map->access;
616 				break;
617 
618 			/* the following error codes just mean the access was not allowed,
619 			 * rather than an error occurred */
620 			case nfserr_rofs:
621 			case nfserr_acces:
622 			case nfserr_perm:
623 				/* simply don't "or" in the access bit. */
624 				break;
625 			default:
626 				error = err2;
627 				goto out;
628 			}
629 		}
630 	}
631 	*access = result;
632 	if (supported)
633 		*supported = sresult;
634 
635  out:
636 	return error;
637 }
638 #endif /* CONFIG_NFSD_V3 */
639 
640 static int nfsd_open_break_lease(struct inode *inode, int access)
641 {
642 	unsigned int mode;
643 
644 	if (access & NFSD_MAY_NOT_BREAK_LEASE)
645 		return 0;
646 	mode = (access & NFSD_MAY_WRITE) ? O_WRONLY : O_RDONLY;
647 	return break_lease(inode, mode | O_NONBLOCK);
648 }
649 
650 /*
651  * Open an existing file or directory.
652  * The may_flags argument indicates the type of open (read/write/lock)
653  * and additional flags.
654  * N.B. After this call fhp needs an fh_put
655  */
656 __be32
657 nfsd_open(struct svc_rqst *rqstp, struct svc_fh *fhp, umode_t type,
658 			int may_flags, struct file **filp)
659 {
660 	struct path	path;
661 	struct inode	*inode;
662 	struct file	*file;
663 	int		flags = O_RDONLY|O_LARGEFILE;
664 	__be32		err;
665 	int		host_err = 0;
666 
667 	validate_process_creds();
668 
669 	/*
670 	 * If we get here, then the client has already done an "open",
671 	 * and (hopefully) checked permission - so allow OWNER_OVERRIDE
672 	 * in case a chmod has now revoked permission.
673 	 *
674 	 * Arguably we should also allow the owner override for
675 	 * directories, but we never have and it doesn't seem to have
676 	 * caused anyone a problem.  If we were to change this, note
677 	 * also that our filldir callbacks would need a variant of
678 	 * lookup_one_len that doesn't check permissions.
679 	 */
680 	if (type == S_IFREG)
681 		may_flags |= NFSD_MAY_OWNER_OVERRIDE;
682 	err = fh_verify(rqstp, fhp, type, may_flags);
683 	if (err)
684 		goto out;
685 
686 	path.mnt = fhp->fh_export->ex_path.mnt;
687 	path.dentry = fhp->fh_dentry;
688 	inode = path.dentry->d_inode;
689 
690 	/* Disallow write access to files with the append-only bit set
691 	 * or any access when mandatory locking enabled
692 	 */
693 	err = nfserr_perm;
694 	if (IS_APPEND(inode) && (may_flags & NFSD_MAY_WRITE))
695 		goto out;
696 	/*
697 	 * We must ignore files (but only files) which might have mandatory
698 	 * locks on them because there is no way to know if the accesser has
699 	 * the lock.
700 	 */
701 	if (S_ISREG((inode)->i_mode) && mandatory_lock(inode))
702 		goto out;
703 
704 	if (!inode->i_fop)
705 		goto out;
706 
707 	host_err = nfsd_open_break_lease(inode, may_flags);
708 	if (host_err) /* NOMEM or WOULDBLOCK */
709 		goto out_nfserr;
710 
711 	if (may_flags & NFSD_MAY_WRITE) {
712 		if (may_flags & NFSD_MAY_READ)
713 			flags = O_RDWR|O_LARGEFILE;
714 		else
715 			flags = O_WRONLY|O_LARGEFILE;
716 	}
717 
718 	file = dentry_open(&path, flags, current_cred());
719 	if (IS_ERR(file)) {
720 		host_err = PTR_ERR(file);
721 		goto out_nfserr;
722 	}
723 
724 	host_err = ima_file_check(file, may_flags, 0);
725 	if (host_err) {
726 		nfsd_close(file);
727 		goto out_nfserr;
728 	}
729 
730 	if (may_flags & NFSD_MAY_64BIT_COOKIE)
731 		file->f_mode |= FMODE_64BITHASH;
732 	else
733 		file->f_mode |= FMODE_32BITHASH;
734 
735 	*filp = file;
736 out_nfserr:
737 	err = nfserrno(host_err);
738 out:
739 	validate_process_creds();
740 	return err;
741 }
742 
743 /*
744  * Close a file.
745  */
746 void
747 nfsd_close(struct file *filp)
748 {
749 	fput(filp);
750 }
751 
752 /*
753  * Obtain the readahead parameters for the file
754  * specified by (dev, ino).
755  */
756 
757 static inline struct raparms *
758 nfsd_get_raparms(dev_t dev, ino_t ino)
759 {
760 	struct raparms	*ra, **rap, **frap = NULL;
761 	int depth = 0;
762 	unsigned int hash;
763 	struct raparm_hbucket *rab;
764 
765 	hash = jhash_2words(dev, ino, 0xfeedbeef) & RAPARM_HASH_MASK;
766 	rab = &raparm_hash[hash];
767 
768 	spin_lock(&rab->pb_lock);
769 	for (rap = &rab->pb_head; (ra = *rap); rap = &ra->p_next) {
770 		if (ra->p_ino == ino && ra->p_dev == dev)
771 			goto found;
772 		depth++;
773 		if (ra->p_count == 0)
774 			frap = rap;
775 	}
776 	depth = nfsdstats.ra_size;
777 	if (!frap) {
778 		spin_unlock(&rab->pb_lock);
779 		return NULL;
780 	}
781 	rap = frap;
782 	ra = *frap;
783 	ra->p_dev = dev;
784 	ra->p_ino = ino;
785 	ra->p_set = 0;
786 	ra->p_hindex = hash;
787 found:
788 	if (rap != &rab->pb_head) {
789 		*rap = ra->p_next;
790 		ra->p_next   = rab->pb_head;
791 		rab->pb_head = ra;
792 	}
793 	ra->p_count++;
794 	nfsdstats.ra_depth[depth*10/nfsdstats.ra_size]++;
795 	spin_unlock(&rab->pb_lock);
796 	return ra;
797 }
798 
799 /*
800  * Grab and keep cached pages associated with a file in the svc_rqst
801  * so that they can be passed to the network sendmsg/sendpage routines
802  * directly. They will be released after the sending has completed.
803  */
804 static int
805 nfsd_splice_actor(struct pipe_inode_info *pipe, struct pipe_buffer *buf,
806 		  struct splice_desc *sd)
807 {
808 	struct svc_rqst *rqstp = sd->u.data;
809 	struct page **pp = rqstp->rq_next_page;
810 	struct page *page = buf->page;
811 	size_t size;
812 
813 	size = sd->len;
814 
815 	if (rqstp->rq_res.page_len == 0) {
816 		get_page(page);
817 		put_page(*rqstp->rq_next_page);
818 		*(rqstp->rq_next_page++) = page;
819 		rqstp->rq_res.page_base = buf->offset;
820 		rqstp->rq_res.page_len = size;
821 	} else if (page != pp[-1]) {
822 		get_page(page);
823 		if (*rqstp->rq_next_page)
824 			put_page(*rqstp->rq_next_page);
825 		*(rqstp->rq_next_page++) = page;
826 		rqstp->rq_res.page_len += size;
827 	} else
828 		rqstp->rq_res.page_len += size;
829 
830 	return size;
831 }
832 
833 static int nfsd_direct_splice_actor(struct pipe_inode_info *pipe,
834 				    struct splice_desc *sd)
835 {
836 	return __splice_from_pipe(pipe, sd, nfsd_splice_actor);
837 }
838 
839 static __be32
840 nfsd_finish_read(struct file *file, unsigned long *count, int host_err)
841 {
842 	if (host_err >= 0) {
843 		nfsdstats.io_read += host_err;
844 		*count = host_err;
845 		fsnotify_access(file);
846 		return 0;
847 	} else
848 		return nfserrno(host_err);
849 }
850 
851 __be32 nfsd_splice_read(struct svc_rqst *rqstp,
852 		     struct file *file, loff_t offset, unsigned long *count)
853 {
854 	struct splice_desc sd = {
855 		.len		= 0,
856 		.total_len	= *count,
857 		.pos		= offset,
858 		.u.data		= rqstp,
859 	};
860 	int host_err;
861 
862 	rqstp->rq_next_page = rqstp->rq_respages + 1;
863 	host_err = splice_direct_to_actor(file, &sd, nfsd_direct_splice_actor);
864 	return nfsd_finish_read(file, count, host_err);
865 }
866 
867 __be32 nfsd_readv(struct file *file, loff_t offset, struct kvec *vec, int vlen,
868 		unsigned long *count)
869 {
870 	mm_segment_t oldfs;
871 	int host_err;
872 
873 	oldfs = get_fs();
874 	set_fs(KERNEL_DS);
875 	host_err = vfs_readv(file, (struct iovec __user *)vec, vlen, &offset);
876 	set_fs(oldfs);
877 	return nfsd_finish_read(file, count, host_err);
878 }
879 
880 static __be32
881 nfsd_vfs_read(struct svc_rqst *rqstp, struct file *file,
882 	      loff_t offset, struct kvec *vec, int vlen, unsigned long *count)
883 {
884 	if (file->f_op->splice_read && rqstp->rq_splice_ok)
885 		return nfsd_splice_read(rqstp, file, offset, count);
886 	else
887 		return nfsd_readv(file, offset, vec, vlen, count);
888 }
889 
890 /*
891  * Gathered writes: If another process is currently writing to the file,
892  * there's a high chance this is another nfsd (triggered by a bulk write
893  * from a client's biod). Rather than syncing the file with each write
894  * request, we sleep for 10 msec.
895  *
896  * I don't know if this roughly approximates C. Juszak's idea of
897  * gathered writes, but it's a nice and simple solution (IMHO), and it
898  * seems to work:-)
899  *
900  * Note: we do this only in the NFSv2 case, since v3 and higher have a
901  * better tool (separate unstable writes and commits) for solving this
902  * problem.
903  */
904 static int wait_for_concurrent_writes(struct file *file)
905 {
906 	struct inode *inode = file_inode(file);
907 	static ino_t last_ino;
908 	static dev_t last_dev;
909 	int err = 0;
910 
911 	if (atomic_read(&inode->i_writecount) > 1
912 	    || (last_ino == inode->i_ino && last_dev == inode->i_sb->s_dev)) {
913 		dprintk("nfsd: write defer %d\n", task_pid_nr(current));
914 		msleep(10);
915 		dprintk("nfsd: write resume %d\n", task_pid_nr(current));
916 	}
917 
918 	if (inode->i_state & I_DIRTY) {
919 		dprintk("nfsd: write sync %d\n", task_pid_nr(current));
920 		err = vfs_fsync(file, 0);
921 	}
922 	last_ino = inode->i_ino;
923 	last_dev = inode->i_sb->s_dev;
924 	return err;
925 }
926 
927 static __be32
928 nfsd_vfs_write(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file *file,
929 				loff_t offset, struct kvec *vec, int vlen,
930 				unsigned long *cnt, int *stablep)
931 {
932 	struct svc_export	*exp;
933 	struct dentry		*dentry;
934 	struct inode		*inode;
935 	mm_segment_t		oldfs;
936 	__be32			err = 0;
937 	int			host_err;
938 	int			stable = *stablep;
939 	int			use_wgather;
940 	loff_t			pos = offset;
941 	unsigned int		pflags = current->flags;
942 
943 	if (rqstp->rq_local)
944 		/*
945 		 * We want less throttling in balance_dirty_pages()
946 		 * and shrink_inactive_list() so that nfs to
947 		 * localhost doesn't cause nfsd to lock up due to all
948 		 * the client's dirty pages or its congested queue.
949 		 */
950 		current->flags |= PF_LESS_THROTTLE;
951 
952 	dentry = file->f_path.dentry;
953 	inode = dentry->d_inode;
954 	exp   = fhp->fh_export;
955 
956 	use_wgather = (rqstp->rq_vers == 2) && EX_WGATHER(exp);
957 
958 	if (!EX_ISSYNC(exp))
959 		stable = 0;
960 
961 	/* Write the data. */
962 	oldfs = get_fs(); set_fs(KERNEL_DS);
963 	host_err = vfs_writev(file, (struct iovec __user *)vec, vlen, &pos);
964 	set_fs(oldfs);
965 	if (host_err < 0)
966 		goto out_nfserr;
967 	*cnt = host_err;
968 	nfsdstats.io_write += host_err;
969 	fsnotify_modify(file);
970 
971 	if (stable) {
972 		if (use_wgather)
973 			host_err = wait_for_concurrent_writes(file);
974 		else
975 			host_err = vfs_fsync_range(file, offset, offset+*cnt, 0);
976 	}
977 
978 out_nfserr:
979 	dprintk("nfsd: write complete host_err=%d\n", host_err);
980 	if (host_err >= 0)
981 		err = 0;
982 	else
983 		err = nfserrno(host_err);
984 	if (rqstp->rq_local)
985 		tsk_restore_flags(current, pflags, PF_LESS_THROTTLE);
986 	return err;
987 }
988 
989 __be32 nfsd_get_tmp_read_open(struct svc_rqst *rqstp, struct svc_fh *fhp,
990 		struct file **file, struct raparms **ra)
991 {
992 	struct inode *inode;
993 	__be32 err;
994 
995 	err = nfsd_open(rqstp, fhp, S_IFREG, NFSD_MAY_READ, file);
996 	if (err)
997 		return err;
998 
999 	inode = file_inode(*file);
1000 
1001 	/* Get readahead parameters */
1002 	*ra = nfsd_get_raparms(inode->i_sb->s_dev, inode->i_ino);
1003 
1004 	if (*ra && (*ra)->p_set)
1005 		(*file)->f_ra = (*ra)->p_ra;
1006 	return nfs_ok;
1007 }
1008 
1009 void nfsd_put_tmp_read_open(struct file *file, struct raparms *ra)
1010 {
1011 	/* Write back readahead params */
1012 	if (ra) {
1013 		struct raparm_hbucket *rab = &raparm_hash[ra->p_hindex];
1014 		spin_lock(&rab->pb_lock);
1015 		ra->p_ra = file->f_ra;
1016 		ra->p_set = 1;
1017 		ra->p_count--;
1018 		spin_unlock(&rab->pb_lock);
1019 	}
1020 	nfsd_close(file);
1021 }
1022 
1023 /*
1024  * Read data from a file. count must contain the requested read count
1025  * on entry. On return, *count contains the number of bytes actually read.
1026  * N.B. After this call fhp needs an fh_put
1027  */
1028 __be32 nfsd_read(struct svc_rqst *rqstp, struct svc_fh *fhp,
1029 	loff_t offset, struct kvec *vec, int vlen, unsigned long *count)
1030 {
1031 	struct file *file;
1032 	struct raparms	*ra;
1033 	__be32 err;
1034 
1035 	err = nfsd_get_tmp_read_open(rqstp, fhp, &file, &ra);
1036 	if (err)
1037 		return err;
1038 
1039 	err = nfsd_vfs_read(rqstp, file, offset, vec, vlen, count);
1040 
1041 	nfsd_put_tmp_read_open(file, ra);
1042 
1043 	return err;
1044 }
1045 
1046 /*
1047  * Write data to a file.
1048  * The stable flag requests synchronous writes.
1049  * N.B. After this call fhp needs an fh_put
1050  */
1051 __be32
1052 nfsd_write(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file *file,
1053 		loff_t offset, struct kvec *vec, int vlen, unsigned long *cnt,
1054 		int *stablep)
1055 {
1056 	__be32			err = 0;
1057 
1058 	if (file) {
1059 		err = nfsd_permission(rqstp, fhp->fh_export, fhp->fh_dentry,
1060 				NFSD_MAY_WRITE|NFSD_MAY_OWNER_OVERRIDE);
1061 		if (err)
1062 			goto out;
1063 		err = nfsd_vfs_write(rqstp, fhp, file, offset, vec, vlen, cnt,
1064 				stablep);
1065 	} else {
1066 		err = nfsd_open(rqstp, fhp, S_IFREG, NFSD_MAY_WRITE, &file);
1067 		if (err)
1068 			goto out;
1069 
1070 		if (cnt)
1071 			err = nfsd_vfs_write(rqstp, fhp, file, offset, vec, vlen,
1072 					     cnt, stablep);
1073 		nfsd_close(file);
1074 	}
1075 out:
1076 	return err;
1077 }
1078 
1079 #ifdef CONFIG_NFSD_V3
1080 /*
1081  * Commit all pending writes to stable storage.
1082  *
1083  * Note: we only guarantee that data that lies within the range specified
1084  * by the 'offset' and 'count' parameters will be synced.
1085  *
1086  * Unfortunately we cannot lock the file to make sure we return full WCC
1087  * data to the client, as locking happens lower down in the filesystem.
1088  */
1089 __be32
1090 nfsd_commit(struct svc_rqst *rqstp, struct svc_fh *fhp,
1091                loff_t offset, unsigned long count)
1092 {
1093 	struct file	*file;
1094 	loff_t		end = LLONG_MAX;
1095 	__be32		err = nfserr_inval;
1096 
1097 	if (offset < 0)
1098 		goto out;
1099 	if (count != 0) {
1100 		end = offset + (loff_t)count - 1;
1101 		if (end < offset)
1102 			goto out;
1103 	}
1104 
1105 	err = nfsd_open(rqstp, fhp, S_IFREG,
1106 			NFSD_MAY_WRITE|NFSD_MAY_NOT_BREAK_LEASE, &file);
1107 	if (err)
1108 		goto out;
1109 	if (EX_ISSYNC(fhp->fh_export)) {
1110 		int err2 = vfs_fsync_range(file, offset, end, 0);
1111 
1112 		if (err2 != -EINVAL)
1113 			err = nfserrno(err2);
1114 		else
1115 			err = nfserr_notsupp;
1116 	}
1117 
1118 	nfsd_close(file);
1119 out:
1120 	return err;
1121 }
1122 #endif /* CONFIG_NFSD_V3 */
1123 
1124 static __be32
1125 nfsd_create_setattr(struct svc_rqst *rqstp, struct svc_fh *resfhp,
1126 			struct iattr *iap)
1127 {
1128 	/*
1129 	 * Mode has already been set earlier in create:
1130 	 */
1131 	iap->ia_valid &= ~ATTR_MODE;
1132 	/*
1133 	 * Setting uid/gid works only for root.  Irix appears to
1134 	 * send along the gid on create when it tries to implement
1135 	 * setgid directories via NFS:
1136 	 */
1137 	if (!uid_eq(current_fsuid(), GLOBAL_ROOT_UID))
1138 		iap->ia_valid &= ~(ATTR_UID|ATTR_GID);
1139 	if (iap->ia_valid)
1140 		return nfsd_setattr(rqstp, resfhp, iap, 0, (time_t)0);
1141 	/* Callers expect file metadata to be committed here */
1142 	return nfserrno(commit_metadata(resfhp));
1143 }
1144 
1145 /* HPUX client sometimes creates a file in mode 000, and sets size to 0.
1146  * setting size to 0 may fail for some specific file systems by the permission
1147  * checking which requires WRITE permission but the mode is 000.
1148  * we ignore the resizing(to 0) on the just new created file, since the size is
1149  * 0 after file created.
1150  *
1151  * call this only after vfs_create() is called.
1152  * */
1153 static void
1154 nfsd_check_ignore_resizing(struct iattr *iap)
1155 {
1156 	if ((iap->ia_valid & ATTR_SIZE) && (iap->ia_size == 0))
1157 		iap->ia_valid &= ~ATTR_SIZE;
1158 }
1159 
1160 /*
1161  * Create a file (regular, directory, device, fifo); UNIX sockets
1162  * not yet implemented.
1163  * If the response fh has been verified, the parent directory should
1164  * already be locked. Note that the parent directory is left locked.
1165  *
1166  * N.B. Every call to nfsd_create needs an fh_put for _both_ fhp and resfhp
1167  */
1168 __be32
1169 nfsd_create(struct svc_rqst *rqstp, struct svc_fh *fhp,
1170 		char *fname, int flen, struct iattr *iap,
1171 		int type, dev_t rdev, struct svc_fh *resfhp)
1172 {
1173 	struct dentry	*dentry, *dchild = NULL;
1174 	struct inode	*dirp;
1175 	__be32		err;
1176 	__be32		err2;
1177 	int		host_err;
1178 
1179 	err = nfserr_perm;
1180 	if (!flen)
1181 		goto out;
1182 	err = nfserr_exist;
1183 	if (isdotent(fname, flen))
1184 		goto out;
1185 
1186 	err = fh_verify(rqstp, fhp, S_IFDIR, NFSD_MAY_CREATE);
1187 	if (err)
1188 		goto out;
1189 
1190 	dentry = fhp->fh_dentry;
1191 	dirp = dentry->d_inode;
1192 
1193 	err = nfserr_notdir;
1194 	if (!dirp->i_op->lookup)
1195 		goto out;
1196 	/*
1197 	 * Check whether the response file handle has been verified yet.
1198 	 * If it has, the parent directory should already be locked.
1199 	 */
1200 	if (!resfhp->fh_dentry) {
1201 		host_err = fh_want_write(fhp);
1202 		if (host_err)
1203 			goto out_nfserr;
1204 
1205 		/* called from nfsd_proc_mkdir, or possibly nfsd3_proc_create */
1206 		fh_lock_nested(fhp, I_MUTEX_PARENT);
1207 		dchild = lookup_one_len(fname, dentry, flen);
1208 		host_err = PTR_ERR(dchild);
1209 		if (IS_ERR(dchild))
1210 			goto out_nfserr;
1211 		err = fh_compose(resfhp, fhp->fh_export, dchild, fhp);
1212 		if (err)
1213 			goto out;
1214 	} else {
1215 		/* called from nfsd_proc_create */
1216 		dchild = dget(resfhp->fh_dentry);
1217 		if (!fhp->fh_locked) {
1218 			/* not actually possible */
1219 			printk(KERN_ERR
1220 				"nfsd_create: parent %pd2 not locked!\n",
1221 				dentry);
1222 			err = nfserr_io;
1223 			goto out;
1224 		}
1225 	}
1226 	/*
1227 	 * Make sure the child dentry is still negative ...
1228 	 */
1229 	err = nfserr_exist;
1230 	if (dchild->d_inode) {
1231 		dprintk("nfsd_create: dentry %pd/%pd not negative!\n",
1232 			dentry, dchild);
1233 		goto out;
1234 	}
1235 
1236 	if (!(iap->ia_valid & ATTR_MODE))
1237 		iap->ia_mode = 0;
1238 	iap->ia_mode = (iap->ia_mode & S_IALLUGO) | type;
1239 
1240 	err = nfserr_inval;
1241 	if (!S_ISREG(type) && !S_ISDIR(type) && !special_file(type)) {
1242 		printk(KERN_WARNING "nfsd: bad file type %o in nfsd_create\n",
1243 		       type);
1244 		goto out;
1245 	}
1246 
1247 	/*
1248 	 * Get the dir op function pointer.
1249 	 */
1250 	err = 0;
1251 	host_err = 0;
1252 	switch (type) {
1253 	case S_IFREG:
1254 		host_err = vfs_create(dirp, dchild, iap->ia_mode, true);
1255 		if (!host_err)
1256 			nfsd_check_ignore_resizing(iap);
1257 		break;
1258 	case S_IFDIR:
1259 		host_err = vfs_mkdir(dirp, dchild, iap->ia_mode);
1260 		break;
1261 	case S_IFCHR:
1262 	case S_IFBLK:
1263 	case S_IFIFO:
1264 	case S_IFSOCK:
1265 		host_err = vfs_mknod(dirp, dchild, iap->ia_mode, rdev);
1266 		break;
1267 	}
1268 	if (host_err < 0)
1269 		goto out_nfserr;
1270 
1271 	err = nfsd_create_setattr(rqstp, resfhp, iap);
1272 
1273 	/*
1274 	 * nfsd_create_setattr already committed the child.  Transactional
1275 	 * filesystems had a chance to commit changes for both parent and
1276 	 * child * simultaneously making the following commit_metadata a
1277 	 * noop.
1278 	 */
1279 	err2 = nfserrno(commit_metadata(fhp));
1280 	if (err2)
1281 		err = err2;
1282 	/*
1283 	 * Update the file handle to get the new inode info.
1284 	 */
1285 	if (!err)
1286 		err = fh_update(resfhp);
1287 out:
1288 	if (dchild && !IS_ERR(dchild))
1289 		dput(dchild);
1290 	return err;
1291 
1292 out_nfserr:
1293 	err = nfserrno(host_err);
1294 	goto out;
1295 }
1296 
1297 #ifdef CONFIG_NFSD_V3
1298 
1299 static inline int nfsd_create_is_exclusive(int createmode)
1300 {
1301 	return createmode == NFS3_CREATE_EXCLUSIVE
1302 	       || createmode == NFS4_CREATE_EXCLUSIVE4_1;
1303 }
1304 
1305 /*
1306  * NFSv3 and NFSv4 version of nfsd_create
1307  */
1308 __be32
1309 do_nfsd_create(struct svc_rqst *rqstp, struct svc_fh *fhp,
1310 		char *fname, int flen, struct iattr *iap,
1311 		struct svc_fh *resfhp, int createmode, u32 *verifier,
1312 	        bool *truncp, bool *created)
1313 {
1314 	struct dentry	*dentry, *dchild = NULL;
1315 	struct inode	*dirp;
1316 	__be32		err;
1317 	int		host_err;
1318 	__u32		v_mtime=0, v_atime=0;
1319 
1320 	err = nfserr_perm;
1321 	if (!flen)
1322 		goto out;
1323 	err = nfserr_exist;
1324 	if (isdotent(fname, flen))
1325 		goto out;
1326 	if (!(iap->ia_valid & ATTR_MODE))
1327 		iap->ia_mode = 0;
1328 	err = fh_verify(rqstp, fhp, S_IFDIR, NFSD_MAY_EXEC);
1329 	if (err)
1330 		goto out;
1331 
1332 	dentry = fhp->fh_dentry;
1333 	dirp = dentry->d_inode;
1334 
1335 	/* Get all the sanity checks out of the way before
1336 	 * we lock the parent. */
1337 	err = nfserr_notdir;
1338 	if (!dirp->i_op->lookup)
1339 		goto out;
1340 
1341 	host_err = fh_want_write(fhp);
1342 	if (host_err)
1343 		goto out_nfserr;
1344 
1345 	fh_lock_nested(fhp, I_MUTEX_PARENT);
1346 
1347 	/*
1348 	 * Compose the response file handle.
1349 	 */
1350 	dchild = lookup_one_len(fname, dentry, flen);
1351 	host_err = PTR_ERR(dchild);
1352 	if (IS_ERR(dchild))
1353 		goto out_nfserr;
1354 
1355 	/* If file doesn't exist, check for permissions to create one */
1356 	if (!dchild->d_inode) {
1357 		err = fh_verify(rqstp, fhp, S_IFDIR, NFSD_MAY_CREATE);
1358 		if (err)
1359 			goto out;
1360 	}
1361 
1362 	err = fh_compose(resfhp, fhp->fh_export, dchild, fhp);
1363 	if (err)
1364 		goto out;
1365 
1366 	if (nfsd_create_is_exclusive(createmode)) {
1367 		/* solaris7 gets confused (bugid 4218508) if these have
1368 		 * the high bit set, so just clear the high bits. If this is
1369 		 * ever changed to use different attrs for storing the
1370 		 * verifier, then do_open_lookup() will also need to be fixed
1371 		 * accordingly.
1372 		 */
1373 		v_mtime = verifier[0]&0x7fffffff;
1374 		v_atime = verifier[1]&0x7fffffff;
1375 	}
1376 
1377 	if (dchild->d_inode) {
1378 		err = 0;
1379 
1380 		switch (createmode) {
1381 		case NFS3_CREATE_UNCHECKED:
1382 			if (! S_ISREG(dchild->d_inode->i_mode))
1383 				goto out;
1384 			else if (truncp) {
1385 				/* in nfsv4, we need to treat this case a little
1386 				 * differently.  we don't want to truncate the
1387 				 * file now; this would be wrong if the OPEN
1388 				 * fails for some other reason.  furthermore,
1389 				 * if the size is nonzero, we should ignore it
1390 				 * according to spec!
1391 				 */
1392 				*truncp = (iap->ia_valid & ATTR_SIZE) && !iap->ia_size;
1393 			}
1394 			else {
1395 				iap->ia_valid &= ATTR_SIZE;
1396 				goto set_attr;
1397 			}
1398 			break;
1399 		case NFS3_CREATE_EXCLUSIVE:
1400 			if (   dchild->d_inode->i_mtime.tv_sec == v_mtime
1401 			    && dchild->d_inode->i_atime.tv_sec == v_atime
1402 			    && dchild->d_inode->i_size  == 0 ) {
1403 				if (created)
1404 					*created = 1;
1405 				break;
1406 			}
1407 		case NFS4_CREATE_EXCLUSIVE4_1:
1408 			if (   dchild->d_inode->i_mtime.tv_sec == v_mtime
1409 			    && dchild->d_inode->i_atime.tv_sec == v_atime
1410 			    && dchild->d_inode->i_size  == 0 ) {
1411 				if (created)
1412 					*created = 1;
1413 				goto set_attr;
1414 			}
1415 			 /* fallthru */
1416 		case NFS3_CREATE_GUARDED:
1417 			err = nfserr_exist;
1418 		}
1419 		fh_drop_write(fhp);
1420 		goto out;
1421 	}
1422 
1423 	host_err = vfs_create(dirp, dchild, iap->ia_mode, true);
1424 	if (host_err < 0) {
1425 		fh_drop_write(fhp);
1426 		goto out_nfserr;
1427 	}
1428 	if (created)
1429 		*created = 1;
1430 
1431 	nfsd_check_ignore_resizing(iap);
1432 
1433 	if (nfsd_create_is_exclusive(createmode)) {
1434 		/* Cram the verifier into atime/mtime */
1435 		iap->ia_valid = ATTR_MTIME|ATTR_ATIME
1436 			| ATTR_MTIME_SET|ATTR_ATIME_SET;
1437 		/* XXX someone who knows this better please fix it for nsec */
1438 		iap->ia_mtime.tv_sec = v_mtime;
1439 		iap->ia_atime.tv_sec = v_atime;
1440 		iap->ia_mtime.tv_nsec = 0;
1441 		iap->ia_atime.tv_nsec = 0;
1442 	}
1443 
1444  set_attr:
1445 	err = nfsd_create_setattr(rqstp, resfhp, iap);
1446 
1447 	/*
1448 	 * nfsd_create_setattr already committed the child
1449 	 * (and possibly also the parent).
1450 	 */
1451 	if (!err)
1452 		err = nfserrno(commit_metadata(fhp));
1453 
1454 	/*
1455 	 * Update the filehandle to get the new inode info.
1456 	 */
1457 	if (!err)
1458 		err = fh_update(resfhp);
1459 
1460  out:
1461 	fh_unlock(fhp);
1462 	if (dchild && !IS_ERR(dchild))
1463 		dput(dchild);
1464 	fh_drop_write(fhp);
1465  	return err;
1466 
1467  out_nfserr:
1468 	err = nfserrno(host_err);
1469 	goto out;
1470 }
1471 #endif /* CONFIG_NFSD_V3 */
1472 
1473 /*
1474  * Read a symlink. On entry, *lenp must contain the maximum path length that
1475  * fits into the buffer. On return, it contains the true length.
1476  * N.B. After this call fhp needs an fh_put
1477  */
1478 __be32
1479 nfsd_readlink(struct svc_rqst *rqstp, struct svc_fh *fhp, char *buf, int *lenp)
1480 {
1481 	struct inode	*inode;
1482 	mm_segment_t	oldfs;
1483 	__be32		err;
1484 	int		host_err;
1485 	struct path path;
1486 
1487 	err = fh_verify(rqstp, fhp, S_IFLNK, NFSD_MAY_NOP);
1488 	if (err)
1489 		goto out;
1490 
1491 	path.mnt = fhp->fh_export->ex_path.mnt;
1492 	path.dentry = fhp->fh_dentry;
1493 	inode = path.dentry->d_inode;
1494 
1495 	err = nfserr_inval;
1496 	if (!inode->i_op->readlink)
1497 		goto out;
1498 
1499 	touch_atime(&path);
1500 	/* N.B. Why does this call need a get_fs()??
1501 	 * Remove the set_fs and watch the fireworks:-) --okir
1502 	 */
1503 
1504 	oldfs = get_fs(); set_fs(KERNEL_DS);
1505 	host_err = inode->i_op->readlink(path.dentry, (char __user *)buf, *lenp);
1506 	set_fs(oldfs);
1507 
1508 	if (host_err < 0)
1509 		goto out_nfserr;
1510 	*lenp = host_err;
1511 	err = 0;
1512 out:
1513 	return err;
1514 
1515 out_nfserr:
1516 	err = nfserrno(host_err);
1517 	goto out;
1518 }
1519 
1520 /*
1521  * Create a symlink and look up its inode
1522  * N.B. After this call _both_ fhp and resfhp need an fh_put
1523  */
1524 __be32
1525 nfsd_symlink(struct svc_rqst *rqstp, struct svc_fh *fhp,
1526 				char *fname, int flen,
1527 				char *path,
1528 				struct svc_fh *resfhp)
1529 {
1530 	struct dentry	*dentry, *dnew;
1531 	__be32		err, cerr;
1532 	int		host_err;
1533 
1534 	err = nfserr_noent;
1535 	if (!flen || path[0] == '\0')
1536 		goto out;
1537 	err = nfserr_exist;
1538 	if (isdotent(fname, flen))
1539 		goto out;
1540 
1541 	err = fh_verify(rqstp, fhp, S_IFDIR, NFSD_MAY_CREATE);
1542 	if (err)
1543 		goto out;
1544 
1545 	host_err = fh_want_write(fhp);
1546 	if (host_err)
1547 		goto out_nfserr;
1548 
1549 	fh_lock(fhp);
1550 	dentry = fhp->fh_dentry;
1551 	dnew = lookup_one_len(fname, dentry, flen);
1552 	host_err = PTR_ERR(dnew);
1553 	if (IS_ERR(dnew))
1554 		goto out_nfserr;
1555 
1556 	host_err = vfs_symlink(dentry->d_inode, dnew, path);
1557 	err = nfserrno(host_err);
1558 	if (!err)
1559 		err = nfserrno(commit_metadata(fhp));
1560 	fh_unlock(fhp);
1561 
1562 	fh_drop_write(fhp);
1563 
1564 	cerr = fh_compose(resfhp, fhp->fh_export, dnew, fhp);
1565 	dput(dnew);
1566 	if (err==0) err = cerr;
1567 out:
1568 	return err;
1569 
1570 out_nfserr:
1571 	err = nfserrno(host_err);
1572 	goto out;
1573 }
1574 
1575 /*
1576  * Create a hardlink
1577  * N.B. After this call _both_ ffhp and tfhp need an fh_put
1578  */
1579 __be32
1580 nfsd_link(struct svc_rqst *rqstp, struct svc_fh *ffhp,
1581 				char *name, int len, struct svc_fh *tfhp)
1582 {
1583 	struct dentry	*ddir, *dnew, *dold;
1584 	struct inode	*dirp;
1585 	__be32		err;
1586 	int		host_err;
1587 
1588 	err = fh_verify(rqstp, ffhp, S_IFDIR, NFSD_MAY_CREATE);
1589 	if (err)
1590 		goto out;
1591 	err = fh_verify(rqstp, tfhp, 0, NFSD_MAY_NOP);
1592 	if (err)
1593 		goto out;
1594 	err = nfserr_isdir;
1595 	if (S_ISDIR(tfhp->fh_dentry->d_inode->i_mode))
1596 		goto out;
1597 	err = nfserr_perm;
1598 	if (!len)
1599 		goto out;
1600 	err = nfserr_exist;
1601 	if (isdotent(name, len))
1602 		goto out;
1603 
1604 	host_err = fh_want_write(tfhp);
1605 	if (host_err) {
1606 		err = nfserrno(host_err);
1607 		goto out;
1608 	}
1609 
1610 	fh_lock_nested(ffhp, I_MUTEX_PARENT);
1611 	ddir = ffhp->fh_dentry;
1612 	dirp = ddir->d_inode;
1613 
1614 	dnew = lookup_one_len(name, ddir, len);
1615 	host_err = PTR_ERR(dnew);
1616 	if (IS_ERR(dnew))
1617 		goto out_nfserr;
1618 
1619 	dold = tfhp->fh_dentry;
1620 
1621 	err = nfserr_noent;
1622 	if (!dold->d_inode)
1623 		goto out_dput;
1624 	host_err = vfs_link(dold, dirp, dnew, NULL);
1625 	if (!host_err) {
1626 		err = nfserrno(commit_metadata(ffhp));
1627 		if (!err)
1628 			err = nfserrno(commit_metadata(tfhp));
1629 	} else {
1630 		if (host_err == -EXDEV && rqstp->rq_vers == 2)
1631 			err = nfserr_acces;
1632 		else
1633 			err = nfserrno(host_err);
1634 	}
1635 out_dput:
1636 	dput(dnew);
1637 out_unlock:
1638 	fh_unlock(ffhp);
1639 	fh_drop_write(tfhp);
1640 out:
1641 	return err;
1642 
1643 out_nfserr:
1644 	err = nfserrno(host_err);
1645 	goto out_unlock;
1646 }
1647 
1648 /*
1649  * Rename a file
1650  * N.B. After this call _both_ ffhp and tfhp need an fh_put
1651  */
1652 __be32
1653 nfsd_rename(struct svc_rqst *rqstp, struct svc_fh *ffhp, char *fname, int flen,
1654 			    struct svc_fh *tfhp, char *tname, int tlen)
1655 {
1656 	struct dentry	*fdentry, *tdentry, *odentry, *ndentry, *trap;
1657 	struct inode	*fdir, *tdir;
1658 	__be32		err;
1659 	int		host_err;
1660 
1661 	err = fh_verify(rqstp, ffhp, S_IFDIR, NFSD_MAY_REMOVE);
1662 	if (err)
1663 		goto out;
1664 	err = fh_verify(rqstp, tfhp, S_IFDIR, NFSD_MAY_CREATE);
1665 	if (err)
1666 		goto out;
1667 
1668 	fdentry = ffhp->fh_dentry;
1669 	fdir = fdentry->d_inode;
1670 
1671 	tdentry = tfhp->fh_dentry;
1672 	tdir = tdentry->d_inode;
1673 
1674 	err = nfserr_perm;
1675 	if (!flen || isdotent(fname, flen) || !tlen || isdotent(tname, tlen))
1676 		goto out;
1677 
1678 	host_err = fh_want_write(ffhp);
1679 	if (host_err) {
1680 		err = nfserrno(host_err);
1681 		goto out;
1682 	}
1683 
1684 	/* cannot use fh_lock as we need deadlock protective ordering
1685 	 * so do it by hand */
1686 	trap = lock_rename(tdentry, fdentry);
1687 	ffhp->fh_locked = tfhp->fh_locked = 1;
1688 	fill_pre_wcc(ffhp);
1689 	fill_pre_wcc(tfhp);
1690 
1691 	odentry = lookup_one_len(fname, fdentry, flen);
1692 	host_err = PTR_ERR(odentry);
1693 	if (IS_ERR(odentry))
1694 		goto out_nfserr;
1695 
1696 	host_err = -ENOENT;
1697 	if (!odentry->d_inode)
1698 		goto out_dput_old;
1699 	host_err = -EINVAL;
1700 	if (odentry == trap)
1701 		goto out_dput_old;
1702 
1703 	ndentry = lookup_one_len(tname, tdentry, tlen);
1704 	host_err = PTR_ERR(ndentry);
1705 	if (IS_ERR(ndentry))
1706 		goto out_dput_old;
1707 	host_err = -ENOTEMPTY;
1708 	if (ndentry == trap)
1709 		goto out_dput_new;
1710 
1711 	host_err = -EXDEV;
1712 	if (ffhp->fh_export->ex_path.mnt != tfhp->fh_export->ex_path.mnt)
1713 		goto out_dput_new;
1714 	if (ffhp->fh_export->ex_path.dentry != tfhp->fh_export->ex_path.dentry)
1715 		goto out_dput_new;
1716 
1717 	host_err = vfs_rename(fdir, odentry, tdir, ndentry, NULL, 0);
1718 	if (!host_err) {
1719 		host_err = commit_metadata(tfhp);
1720 		if (!host_err)
1721 			host_err = commit_metadata(ffhp);
1722 	}
1723  out_dput_new:
1724 	dput(ndentry);
1725  out_dput_old:
1726 	dput(odentry);
1727  out_nfserr:
1728 	err = nfserrno(host_err);
1729 	/*
1730 	 * We cannot rely on fh_unlock on the two filehandles,
1731 	 * as that would do the wrong thing if the two directories
1732 	 * were the same, so again we do it by hand.
1733 	 */
1734 	fill_post_wcc(ffhp);
1735 	fill_post_wcc(tfhp);
1736 	unlock_rename(tdentry, fdentry);
1737 	ffhp->fh_locked = tfhp->fh_locked = 0;
1738 	fh_drop_write(ffhp);
1739 
1740 out:
1741 	return err;
1742 }
1743 
1744 /*
1745  * Unlink a file or directory
1746  * N.B. After this call fhp needs an fh_put
1747  */
1748 __be32
1749 nfsd_unlink(struct svc_rqst *rqstp, struct svc_fh *fhp, int type,
1750 				char *fname, int flen)
1751 {
1752 	struct dentry	*dentry, *rdentry;
1753 	struct inode	*dirp;
1754 	__be32		err;
1755 	int		host_err;
1756 
1757 	err = nfserr_acces;
1758 	if (!flen || isdotent(fname, flen))
1759 		goto out;
1760 	err = fh_verify(rqstp, fhp, S_IFDIR, NFSD_MAY_REMOVE);
1761 	if (err)
1762 		goto out;
1763 
1764 	host_err = fh_want_write(fhp);
1765 	if (host_err)
1766 		goto out_nfserr;
1767 
1768 	fh_lock_nested(fhp, I_MUTEX_PARENT);
1769 	dentry = fhp->fh_dentry;
1770 	dirp = dentry->d_inode;
1771 
1772 	rdentry = lookup_one_len(fname, dentry, flen);
1773 	host_err = PTR_ERR(rdentry);
1774 	if (IS_ERR(rdentry))
1775 		goto out_nfserr;
1776 
1777 	if (!rdentry->d_inode) {
1778 		dput(rdentry);
1779 		err = nfserr_noent;
1780 		goto out;
1781 	}
1782 
1783 	if (!type)
1784 		type = rdentry->d_inode->i_mode & S_IFMT;
1785 
1786 	if (type != S_IFDIR)
1787 		host_err = vfs_unlink(dirp, rdentry, NULL);
1788 	else
1789 		host_err = vfs_rmdir(dirp, rdentry);
1790 	if (!host_err)
1791 		host_err = commit_metadata(fhp);
1792 	dput(rdentry);
1793 
1794 out_nfserr:
1795 	err = nfserrno(host_err);
1796 out:
1797 	return err;
1798 }
1799 
1800 /*
1801  * We do this buffering because we must not call back into the file
1802  * system's ->lookup() method from the filldir callback. That may well
1803  * deadlock a number of file systems.
1804  *
1805  * This is based heavily on the implementation of same in XFS.
1806  */
1807 struct buffered_dirent {
1808 	u64		ino;
1809 	loff_t		offset;
1810 	int		namlen;
1811 	unsigned int	d_type;
1812 	char		name[];
1813 };
1814 
1815 struct readdir_data {
1816 	struct dir_context ctx;
1817 	char		*dirent;
1818 	size_t		used;
1819 	int		full;
1820 };
1821 
1822 static int nfsd_buffered_filldir(void *__buf, const char *name, int namlen,
1823 				 loff_t offset, u64 ino, unsigned int d_type)
1824 {
1825 	struct readdir_data *buf = __buf;
1826 	struct buffered_dirent *de = (void *)(buf->dirent + buf->used);
1827 	unsigned int reclen;
1828 
1829 	reclen = ALIGN(sizeof(struct buffered_dirent) + namlen, sizeof(u64));
1830 	if (buf->used + reclen > PAGE_SIZE) {
1831 		buf->full = 1;
1832 		return -EINVAL;
1833 	}
1834 
1835 	de->namlen = namlen;
1836 	de->offset = offset;
1837 	de->ino = ino;
1838 	de->d_type = d_type;
1839 	memcpy(de->name, name, namlen);
1840 	buf->used += reclen;
1841 
1842 	return 0;
1843 }
1844 
1845 static __be32 nfsd_buffered_readdir(struct file *file, filldir_t func,
1846 				    struct readdir_cd *cdp, loff_t *offsetp)
1847 {
1848 	struct buffered_dirent *de;
1849 	int host_err;
1850 	int size;
1851 	loff_t offset;
1852 	struct readdir_data buf = {
1853 		.ctx.actor = nfsd_buffered_filldir,
1854 		.dirent = (void *)__get_free_page(GFP_KERNEL)
1855 	};
1856 
1857 	if (!buf.dirent)
1858 		return nfserrno(-ENOMEM);
1859 
1860 	offset = *offsetp;
1861 
1862 	while (1) {
1863 		struct inode *dir_inode = file_inode(file);
1864 		unsigned int reclen;
1865 
1866 		cdp->err = nfserr_eof; /* will be cleared on successful read */
1867 		buf.used = 0;
1868 		buf.full = 0;
1869 
1870 		host_err = iterate_dir(file, &buf.ctx);
1871 		if (buf.full)
1872 			host_err = 0;
1873 
1874 		if (host_err < 0)
1875 			break;
1876 
1877 		size = buf.used;
1878 
1879 		if (!size)
1880 			break;
1881 
1882 		/*
1883 		 * Various filldir functions may end up calling back into
1884 		 * lookup_one_len() and the file system's ->lookup() method.
1885 		 * These expect i_mutex to be held, as it would within readdir.
1886 		 */
1887 		host_err = mutex_lock_killable(&dir_inode->i_mutex);
1888 		if (host_err)
1889 			break;
1890 
1891 		de = (struct buffered_dirent *)buf.dirent;
1892 		while (size > 0) {
1893 			offset = de->offset;
1894 
1895 			if (func(cdp, de->name, de->namlen, de->offset,
1896 				 de->ino, de->d_type))
1897 				break;
1898 
1899 			if (cdp->err != nfs_ok)
1900 				break;
1901 
1902 			reclen = ALIGN(sizeof(*de) + de->namlen,
1903 				       sizeof(u64));
1904 			size -= reclen;
1905 			de = (struct buffered_dirent *)((char *)de + reclen);
1906 		}
1907 		mutex_unlock(&dir_inode->i_mutex);
1908 		if (size > 0) /* We bailed out early */
1909 			break;
1910 
1911 		offset = vfs_llseek(file, 0, SEEK_CUR);
1912 	}
1913 
1914 	free_page((unsigned long)(buf.dirent));
1915 
1916 	if (host_err)
1917 		return nfserrno(host_err);
1918 
1919 	*offsetp = offset;
1920 	return cdp->err;
1921 }
1922 
1923 /*
1924  * Read entries from a directory.
1925  * The  NFSv3/4 verifier we ignore for now.
1926  */
1927 __be32
1928 nfsd_readdir(struct svc_rqst *rqstp, struct svc_fh *fhp, loff_t *offsetp,
1929 	     struct readdir_cd *cdp, filldir_t func)
1930 {
1931 	__be32		err;
1932 	struct file	*file;
1933 	loff_t		offset = *offsetp;
1934 	int             may_flags = NFSD_MAY_READ;
1935 
1936 	/* NFSv2 only supports 32 bit cookies */
1937 	if (rqstp->rq_vers > 2)
1938 		may_flags |= NFSD_MAY_64BIT_COOKIE;
1939 
1940 	err = nfsd_open(rqstp, fhp, S_IFDIR, may_flags, &file);
1941 	if (err)
1942 		goto out;
1943 
1944 	offset = vfs_llseek(file, offset, SEEK_SET);
1945 	if (offset < 0) {
1946 		err = nfserrno((int)offset);
1947 		goto out_close;
1948 	}
1949 
1950 	err = nfsd_buffered_readdir(file, func, cdp, offsetp);
1951 
1952 	if (err == nfserr_eof || err == nfserr_toosmall)
1953 		err = nfs_ok; /* can still be found in ->err */
1954 out_close:
1955 	nfsd_close(file);
1956 out:
1957 	return err;
1958 }
1959 
1960 /*
1961  * Get file system stats
1962  * N.B. After this call fhp needs an fh_put
1963  */
1964 __be32
1965 nfsd_statfs(struct svc_rqst *rqstp, struct svc_fh *fhp, struct kstatfs *stat, int access)
1966 {
1967 	__be32 err;
1968 
1969 	err = fh_verify(rqstp, fhp, 0, NFSD_MAY_NOP | access);
1970 	if (!err) {
1971 		struct path path = {
1972 			.mnt	= fhp->fh_export->ex_path.mnt,
1973 			.dentry	= fhp->fh_dentry,
1974 		};
1975 		if (vfs_statfs(&path, stat))
1976 			err = nfserr_io;
1977 	}
1978 	return err;
1979 }
1980 
1981 static int exp_rdonly(struct svc_rqst *rqstp, struct svc_export *exp)
1982 {
1983 	return nfsexp_flags(rqstp, exp) & NFSEXP_READONLY;
1984 }
1985 
1986 /*
1987  * Check for a user's access permissions to this inode.
1988  */
1989 __be32
1990 nfsd_permission(struct svc_rqst *rqstp, struct svc_export *exp,
1991 					struct dentry *dentry, int acc)
1992 {
1993 	struct inode	*inode = dentry->d_inode;
1994 	int		err;
1995 
1996 	if ((acc & NFSD_MAY_MASK) == NFSD_MAY_NOP)
1997 		return 0;
1998 #if 0
1999 	dprintk("nfsd: permission 0x%x%s%s%s%s%s%s%s mode 0%o%s%s%s\n",
2000 		acc,
2001 		(acc & NFSD_MAY_READ)?	" read"  : "",
2002 		(acc & NFSD_MAY_WRITE)?	" write" : "",
2003 		(acc & NFSD_MAY_EXEC)?	" exec"  : "",
2004 		(acc & NFSD_MAY_SATTR)?	" sattr" : "",
2005 		(acc & NFSD_MAY_TRUNC)?	" trunc" : "",
2006 		(acc & NFSD_MAY_LOCK)?	" lock"  : "",
2007 		(acc & NFSD_MAY_OWNER_OVERRIDE)? " owneroverride" : "",
2008 		inode->i_mode,
2009 		IS_IMMUTABLE(inode)?	" immut" : "",
2010 		IS_APPEND(inode)?	" append" : "",
2011 		__mnt_is_readonly(exp->ex_path.mnt)?	" ro" : "");
2012 	dprintk("      owner %d/%d user %d/%d\n",
2013 		inode->i_uid, inode->i_gid, current_fsuid(), current_fsgid());
2014 #endif
2015 
2016 	/* Normally we reject any write/sattr etc access on a read-only file
2017 	 * system.  But if it is IRIX doing check on write-access for a
2018 	 * device special file, we ignore rofs.
2019 	 */
2020 	if (!(acc & NFSD_MAY_LOCAL_ACCESS))
2021 		if (acc & (NFSD_MAY_WRITE | NFSD_MAY_SATTR | NFSD_MAY_TRUNC)) {
2022 			if (exp_rdonly(rqstp, exp) ||
2023 			    __mnt_is_readonly(exp->ex_path.mnt))
2024 				return nfserr_rofs;
2025 			if (/* (acc & NFSD_MAY_WRITE) && */ IS_IMMUTABLE(inode))
2026 				return nfserr_perm;
2027 		}
2028 	if ((acc & NFSD_MAY_TRUNC) && IS_APPEND(inode))
2029 		return nfserr_perm;
2030 
2031 	if (acc & NFSD_MAY_LOCK) {
2032 		/* If we cannot rely on authentication in NLM requests,
2033 		 * just allow locks, otherwise require read permission, or
2034 		 * ownership
2035 		 */
2036 		if (exp->ex_flags & NFSEXP_NOAUTHNLM)
2037 			return 0;
2038 		else
2039 			acc = NFSD_MAY_READ | NFSD_MAY_OWNER_OVERRIDE;
2040 	}
2041 	/*
2042 	 * The file owner always gets access permission for accesses that
2043 	 * would normally be checked at open time. This is to make
2044 	 * file access work even when the client has done a fchmod(fd, 0).
2045 	 *
2046 	 * However, `cp foo bar' should fail nevertheless when bar is
2047 	 * readonly. A sensible way to do this might be to reject all
2048 	 * attempts to truncate a read-only file, because a creat() call
2049 	 * always implies file truncation.
2050 	 * ... but this isn't really fair.  A process may reasonably call
2051 	 * ftruncate on an open file descriptor on a file with perm 000.
2052 	 * We must trust the client to do permission checking - using "ACCESS"
2053 	 * with NFSv3.
2054 	 */
2055 	if ((acc & NFSD_MAY_OWNER_OVERRIDE) &&
2056 	    uid_eq(inode->i_uid, current_fsuid()))
2057 		return 0;
2058 
2059 	/* This assumes  NFSD_MAY_{READ,WRITE,EXEC} == MAY_{READ,WRITE,EXEC} */
2060 	err = inode_permission(inode, acc & (MAY_READ|MAY_WRITE|MAY_EXEC));
2061 
2062 	/* Allow read access to binaries even when mode 111 */
2063 	if (err == -EACCES && S_ISREG(inode->i_mode) &&
2064 	     (acc == (NFSD_MAY_READ | NFSD_MAY_OWNER_OVERRIDE) ||
2065 	      acc == (NFSD_MAY_READ | NFSD_MAY_READ_IF_EXEC)))
2066 		err = inode_permission(inode, MAY_EXEC);
2067 
2068 	return err? nfserrno(err) : 0;
2069 }
2070 
2071 void
2072 nfsd_racache_shutdown(void)
2073 {
2074 	struct raparms *raparm, *last_raparm;
2075 	unsigned int i;
2076 
2077 	dprintk("nfsd: freeing readahead buffers.\n");
2078 
2079 	for (i = 0; i < RAPARM_HASH_SIZE; i++) {
2080 		raparm = raparm_hash[i].pb_head;
2081 		while(raparm) {
2082 			last_raparm = raparm;
2083 			raparm = raparm->p_next;
2084 			kfree(last_raparm);
2085 		}
2086 		raparm_hash[i].pb_head = NULL;
2087 	}
2088 }
2089 /*
2090  * Initialize readahead param cache
2091  */
2092 int
2093 nfsd_racache_init(int cache_size)
2094 {
2095 	int	i;
2096 	int	j = 0;
2097 	int	nperbucket;
2098 	struct raparms **raparm = NULL;
2099 
2100 
2101 	if (raparm_hash[0].pb_head)
2102 		return 0;
2103 	nperbucket = DIV_ROUND_UP(cache_size, RAPARM_HASH_SIZE);
2104 	nperbucket = max(2, nperbucket);
2105 	cache_size = nperbucket * RAPARM_HASH_SIZE;
2106 
2107 	dprintk("nfsd: allocating %d readahead buffers.\n", cache_size);
2108 
2109 	for (i = 0; i < RAPARM_HASH_SIZE; i++) {
2110 		spin_lock_init(&raparm_hash[i].pb_lock);
2111 
2112 		raparm = &raparm_hash[i].pb_head;
2113 		for (j = 0; j < nperbucket; j++) {
2114 			*raparm = kzalloc(sizeof(struct raparms), GFP_KERNEL);
2115 			if (!*raparm)
2116 				goto out_nomem;
2117 			raparm = &(*raparm)->p_next;
2118 		}
2119 		*raparm = NULL;
2120 	}
2121 
2122 	nfsdstats.ra_size = cache_size;
2123 	return 0;
2124 
2125 out_nomem:
2126 	dprintk("nfsd: kmalloc failed, freeing readahead buffers\n");
2127 	nfsd_racache_shutdown();
2128 	return -ENOMEM;
2129 }
2130