xref: /linux/fs/nfsd/nfs4xdr.c (revision 7effbd18e496a954540fb6319db0d87d28a70496)
1 /*
2  *  Server-side XDR for NFSv4
3  *
4  *  Copyright (c) 2002 The Regents of the University of Michigan.
5  *  All rights reserved.
6  *
7  *  Kendrick Smith <kmsmith@umich.edu>
8  *  Andy Adamson   <andros@umich.edu>
9  *
10  *  Redistribution and use in source and binary forms, with or without
11  *  modification, are permitted provided that the following conditions
12  *  are met:
13  *
14  *  1. Redistributions of source code must retain the above copyright
15  *     notice, this list of conditions and the following disclaimer.
16  *  2. Redistributions in binary form must reproduce the above copyright
17  *     notice, this list of conditions and the following disclaimer in the
18  *     documentation and/or other materials provided with the distribution.
19  *  3. Neither the name of the University nor the names of its
20  *     contributors may be used to endorse or promote products derived
21  *     from this software without specific prior written permission.
22  *
23  *  THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
24  *  WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
25  *  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
26  *  DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
27  *  FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
28  *  CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
29  *  SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
30  *  BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
31  *  LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
32  *  NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
33  *  SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
34  */
35 
36 #include <linux/file.h>
37 #include <linux/slab.h>
38 #include <linux/namei.h>
39 #include <linux/statfs.h>
40 #include <linux/utsname.h>
41 #include <linux/pagemap.h>
42 #include <linux/sunrpc/svcauth_gss.h>
43 #include <linux/sunrpc/addr.h>
44 #include <linux/xattr.h>
45 #include <linux/vmalloc.h>
46 
47 #include <uapi/linux/xattr.h>
48 
49 #include "idmap.h"
50 #include "acl.h"
51 #include "xdr4.h"
52 #include "vfs.h"
53 #include "state.h"
54 #include "cache.h"
55 #include "netns.h"
56 #include "pnfs.h"
57 #include "filecache.h"
58 
59 #include "trace.h"
60 
61 #ifdef CONFIG_NFSD_V4_SECURITY_LABEL
62 #include <linux/security.h>
63 #endif
64 
65 
66 #define NFSDDBG_FACILITY		NFSDDBG_XDR
67 
68 const u32 nfsd_suppattrs[3][3] = {
69 	{NFSD4_SUPPORTED_ATTRS_WORD0,
70 	 NFSD4_SUPPORTED_ATTRS_WORD1,
71 	 NFSD4_SUPPORTED_ATTRS_WORD2},
72 
73 	{NFSD4_1_SUPPORTED_ATTRS_WORD0,
74 	 NFSD4_1_SUPPORTED_ATTRS_WORD1,
75 	 NFSD4_1_SUPPORTED_ATTRS_WORD2},
76 
77 	{NFSD4_1_SUPPORTED_ATTRS_WORD0,
78 	 NFSD4_1_SUPPORTED_ATTRS_WORD1,
79 	 NFSD4_2_SUPPORTED_ATTRS_WORD2},
80 };
81 
82 /*
83  * As per referral draft, the fsid for a referral MUST be different from the fsid of the containing
84  * directory in order to indicate to the client that a filesystem boundary is present
85  * We use a fixed fsid for a referral
86  */
87 #define NFS4_REFERRAL_FSID_MAJOR	0x8000000ULL
88 #define NFS4_REFERRAL_FSID_MINOR	0x8000000ULL
89 
90 static __be32
91 check_filename(char *str, int len)
92 {
93 	int i;
94 
95 	if (len == 0)
96 		return nfserr_inval;
97 	if (len > NFS4_MAXNAMLEN)
98 		return nfserr_nametoolong;
99 	if (isdotent(str, len))
100 		return nfserr_badname;
101 	for (i = 0; i < len; i++)
102 		if (str[i] == '/')
103 			return nfserr_badname;
104 	return 0;
105 }
106 
107 static int zero_clientid(clientid_t *clid)
108 {
109 	return (clid->cl_boot == 0) && (clid->cl_id == 0);
110 }
111 
112 /**
113  * svcxdr_tmpalloc - allocate memory to be freed after compound processing
114  * @argp: NFSv4 compound argument structure
115  * @len: length of buffer to allocate
116  *
117  * Allocates a buffer of size @len to be freed when processing the compound
118  * operation described in @argp finishes.
119  */
120 static void *
121 svcxdr_tmpalloc(struct nfsd4_compoundargs *argp, u32 len)
122 {
123 	struct svcxdr_tmpbuf *tb;
124 
125 	tb = kmalloc(sizeof(*tb) + len, GFP_KERNEL);
126 	if (!tb)
127 		return NULL;
128 	tb->next = argp->to_free;
129 	argp->to_free = tb;
130 	return tb->buf;
131 }
132 
133 /*
134  * For xdr strings that need to be passed to other kernel api's
135  * as null-terminated strings.
136  *
137  * Note null-terminating in place usually isn't safe since the
138  * buffer might end on a page boundary.
139  */
140 static char *
141 svcxdr_dupstr(struct nfsd4_compoundargs *argp, void *buf, u32 len)
142 {
143 	char *p = svcxdr_tmpalloc(argp, len + 1);
144 
145 	if (!p)
146 		return NULL;
147 	memcpy(p, buf, len);
148 	p[len] = '\0';
149 	return p;
150 }
151 
152 static void *
153 svcxdr_savemem(struct nfsd4_compoundargs *argp, __be32 *p, u32 len)
154 {
155 	__be32 *tmp;
156 
157 	/*
158 	 * The location of the decoded data item is stable,
159 	 * so @p is OK to use. This is the common case.
160 	 */
161 	if (p != argp->xdr->scratch.iov_base)
162 		return p;
163 
164 	tmp = svcxdr_tmpalloc(argp, len);
165 	if (!tmp)
166 		return NULL;
167 	memcpy(tmp, p, len);
168 	return tmp;
169 }
170 
171 /*
172  * NFSv4 basic data type decoders
173  */
174 
175 /*
176  * This helper handles variable-length opaques which belong to protocol
177  * elements that this implementation does not support.
178  */
179 static __be32
180 nfsd4_decode_ignored_string(struct nfsd4_compoundargs *argp, u32 maxlen)
181 {
182 	u32 len;
183 
184 	if (xdr_stream_decode_u32(argp->xdr, &len) < 0)
185 		return nfserr_bad_xdr;
186 	if (maxlen && len > maxlen)
187 		return nfserr_bad_xdr;
188 	if (!xdr_inline_decode(argp->xdr, len))
189 		return nfserr_bad_xdr;
190 
191 	return nfs_ok;
192 }
193 
194 static __be32
195 nfsd4_decode_opaque(struct nfsd4_compoundargs *argp, struct xdr_netobj *o)
196 {
197 	__be32 *p;
198 	u32 len;
199 
200 	if (xdr_stream_decode_u32(argp->xdr, &len) < 0)
201 		return nfserr_bad_xdr;
202 	if (len == 0 || len > NFS4_OPAQUE_LIMIT)
203 		return nfserr_bad_xdr;
204 	p = xdr_inline_decode(argp->xdr, len);
205 	if (!p)
206 		return nfserr_bad_xdr;
207 	o->data = svcxdr_savemem(argp, p, len);
208 	if (!o->data)
209 		return nfserr_jukebox;
210 	o->len = len;
211 
212 	return nfs_ok;
213 }
214 
215 static __be32
216 nfsd4_decode_component4(struct nfsd4_compoundargs *argp, char **namp, u32 *lenp)
217 {
218 	__be32 *p, status;
219 
220 	if (xdr_stream_decode_u32(argp->xdr, lenp) < 0)
221 		return nfserr_bad_xdr;
222 	p = xdr_inline_decode(argp->xdr, *lenp);
223 	if (!p)
224 		return nfserr_bad_xdr;
225 	status = check_filename((char *)p, *lenp);
226 	if (status)
227 		return status;
228 	*namp = svcxdr_savemem(argp, p, *lenp);
229 	if (!*namp)
230 		return nfserr_jukebox;
231 
232 	return nfs_ok;
233 }
234 
235 static __be32
236 nfsd4_decode_nfstime4(struct nfsd4_compoundargs *argp, struct timespec64 *tv)
237 {
238 	__be32 *p;
239 
240 	p = xdr_inline_decode(argp->xdr, XDR_UNIT * 3);
241 	if (!p)
242 		return nfserr_bad_xdr;
243 	p = xdr_decode_hyper(p, &tv->tv_sec);
244 	tv->tv_nsec = be32_to_cpup(p++);
245 	if (tv->tv_nsec >= (u32)1000000000)
246 		return nfserr_inval;
247 	return nfs_ok;
248 }
249 
250 static __be32
251 nfsd4_decode_verifier4(struct nfsd4_compoundargs *argp, nfs4_verifier *verf)
252 {
253 	__be32 *p;
254 
255 	p = xdr_inline_decode(argp->xdr, NFS4_VERIFIER_SIZE);
256 	if (!p)
257 		return nfserr_bad_xdr;
258 	memcpy(verf->data, p, sizeof(verf->data));
259 	return nfs_ok;
260 }
261 
262 /**
263  * nfsd4_decode_bitmap4 - Decode an NFSv4 bitmap4
264  * @argp: NFSv4 compound argument structure
265  * @bmval: pointer to an array of u32's to decode into
266  * @bmlen: size of the @bmval array
267  *
268  * The server needs to return nfs_ok rather than nfserr_bad_xdr when
269  * encountering bitmaps containing bits it does not recognize. This
270  * includes bits in bitmap words past WORDn, where WORDn is the last
271  * bitmap WORD the implementation currently supports. Thus we are
272  * careful here to simply ignore bits in bitmap words that this
273  * implementation has yet to support explicitly.
274  *
275  * Return values:
276  *   %nfs_ok: @bmval populated successfully
277  *   %nfserr_bad_xdr: the encoded bitmap was invalid
278  */
279 static __be32
280 nfsd4_decode_bitmap4(struct nfsd4_compoundargs *argp, u32 *bmval, u32 bmlen)
281 {
282 	ssize_t status;
283 
284 	status = xdr_stream_decode_uint32_array(argp->xdr, bmval, bmlen);
285 	return status == -EBADMSG ? nfserr_bad_xdr : nfs_ok;
286 }
287 
288 static __be32
289 nfsd4_decode_nfsace4(struct nfsd4_compoundargs *argp, struct nfs4_ace *ace)
290 {
291 	__be32 *p, status;
292 	u32 length;
293 
294 	if (xdr_stream_decode_u32(argp->xdr, &ace->type) < 0)
295 		return nfserr_bad_xdr;
296 	if (xdr_stream_decode_u32(argp->xdr, &ace->flag) < 0)
297 		return nfserr_bad_xdr;
298 	if (xdr_stream_decode_u32(argp->xdr, &ace->access_mask) < 0)
299 		return nfserr_bad_xdr;
300 
301 	if (xdr_stream_decode_u32(argp->xdr, &length) < 0)
302 		return nfserr_bad_xdr;
303 	p = xdr_inline_decode(argp->xdr, length);
304 	if (!p)
305 		return nfserr_bad_xdr;
306 	ace->whotype = nfs4_acl_get_whotype((char *)p, length);
307 	if (ace->whotype != NFS4_ACL_WHO_NAMED)
308 		status = nfs_ok;
309 	else if (ace->flag & NFS4_ACE_IDENTIFIER_GROUP)
310 		status = nfsd_map_name_to_gid(argp->rqstp,
311 				(char *)p, length, &ace->who_gid);
312 	else
313 		status = nfsd_map_name_to_uid(argp->rqstp,
314 				(char *)p, length, &ace->who_uid);
315 
316 	return status;
317 }
318 
319 /* A counted array of nfsace4's */
320 static noinline __be32
321 nfsd4_decode_acl(struct nfsd4_compoundargs *argp, struct nfs4_acl **acl)
322 {
323 	struct nfs4_ace *ace;
324 	__be32 status;
325 	u32 count;
326 
327 	if (xdr_stream_decode_u32(argp->xdr, &count) < 0)
328 		return nfserr_bad_xdr;
329 
330 	if (count > xdr_stream_remaining(argp->xdr) / 20)
331 		/*
332 		 * Even with 4-byte names there wouldn't be
333 		 * space for that many aces; something fishy is
334 		 * going on:
335 		 */
336 		return nfserr_fbig;
337 
338 	*acl = svcxdr_tmpalloc(argp, nfs4_acl_bytes(count));
339 	if (*acl == NULL)
340 		return nfserr_jukebox;
341 
342 	(*acl)->naces = count;
343 	for (ace = (*acl)->aces; ace < (*acl)->aces + count; ace++) {
344 		status = nfsd4_decode_nfsace4(argp, ace);
345 		if (status)
346 			return status;
347 	}
348 
349 	return nfs_ok;
350 }
351 
352 static noinline __be32
353 nfsd4_decode_security_label(struct nfsd4_compoundargs *argp,
354 			    struct xdr_netobj *label)
355 {
356 	u32 lfs, pi, length;
357 	__be32 *p;
358 
359 	if (xdr_stream_decode_u32(argp->xdr, &lfs) < 0)
360 		return nfserr_bad_xdr;
361 	if (xdr_stream_decode_u32(argp->xdr, &pi) < 0)
362 		return nfserr_bad_xdr;
363 
364 	if (xdr_stream_decode_u32(argp->xdr, &length) < 0)
365 		return nfserr_bad_xdr;
366 	if (length > NFS4_MAXLABELLEN)
367 		return nfserr_badlabel;
368 	p = xdr_inline_decode(argp->xdr, length);
369 	if (!p)
370 		return nfserr_bad_xdr;
371 	label->len = length;
372 	label->data = svcxdr_dupstr(argp, p, length);
373 	if (!label->data)
374 		return nfserr_jukebox;
375 
376 	return nfs_ok;
377 }
378 
379 static __be32
380 nfsd4_decode_fattr4(struct nfsd4_compoundargs *argp, u32 *bmval, u32 bmlen,
381 		    struct iattr *iattr, struct nfs4_acl **acl,
382 		    struct xdr_netobj *label, int *umask)
383 {
384 	unsigned int starting_pos;
385 	u32 attrlist4_count;
386 	__be32 *p, status;
387 
388 	iattr->ia_valid = 0;
389 	status = nfsd4_decode_bitmap4(argp, bmval, bmlen);
390 	if (status)
391 		return nfserr_bad_xdr;
392 
393 	if (bmval[0] & ~NFSD_WRITEABLE_ATTRS_WORD0
394 	    || bmval[1] & ~NFSD_WRITEABLE_ATTRS_WORD1
395 	    || bmval[2] & ~NFSD_WRITEABLE_ATTRS_WORD2) {
396 		if (nfsd_attrs_supported(argp->minorversion, bmval))
397 			return nfserr_inval;
398 		return nfserr_attrnotsupp;
399 	}
400 
401 	if (xdr_stream_decode_u32(argp->xdr, &attrlist4_count) < 0)
402 		return nfserr_bad_xdr;
403 	starting_pos = xdr_stream_pos(argp->xdr);
404 
405 	if (bmval[0] & FATTR4_WORD0_SIZE) {
406 		u64 size;
407 
408 		if (xdr_stream_decode_u64(argp->xdr, &size) < 0)
409 			return nfserr_bad_xdr;
410 		iattr->ia_size = size;
411 		iattr->ia_valid |= ATTR_SIZE;
412 	}
413 	if (bmval[0] & FATTR4_WORD0_ACL) {
414 		status = nfsd4_decode_acl(argp, acl);
415 		if (status)
416 			return status;
417 	} else
418 		*acl = NULL;
419 	if (bmval[1] & FATTR4_WORD1_MODE) {
420 		u32 mode;
421 
422 		if (xdr_stream_decode_u32(argp->xdr, &mode) < 0)
423 			return nfserr_bad_xdr;
424 		iattr->ia_mode = mode;
425 		iattr->ia_mode &= (S_IFMT | S_IALLUGO);
426 		iattr->ia_valid |= ATTR_MODE;
427 	}
428 	if (bmval[1] & FATTR4_WORD1_OWNER) {
429 		u32 length;
430 
431 		if (xdr_stream_decode_u32(argp->xdr, &length) < 0)
432 			return nfserr_bad_xdr;
433 		p = xdr_inline_decode(argp->xdr, length);
434 		if (!p)
435 			return nfserr_bad_xdr;
436 		status = nfsd_map_name_to_uid(argp->rqstp, (char *)p, length,
437 					      &iattr->ia_uid);
438 		if (status)
439 			return status;
440 		iattr->ia_valid |= ATTR_UID;
441 	}
442 	if (bmval[1] & FATTR4_WORD1_OWNER_GROUP) {
443 		u32 length;
444 
445 		if (xdr_stream_decode_u32(argp->xdr, &length) < 0)
446 			return nfserr_bad_xdr;
447 		p = xdr_inline_decode(argp->xdr, length);
448 		if (!p)
449 			return nfserr_bad_xdr;
450 		status = nfsd_map_name_to_gid(argp->rqstp, (char *)p, length,
451 					      &iattr->ia_gid);
452 		if (status)
453 			return status;
454 		iattr->ia_valid |= ATTR_GID;
455 	}
456 	if (bmval[1] & FATTR4_WORD1_TIME_ACCESS_SET) {
457 		u32 set_it;
458 
459 		if (xdr_stream_decode_u32(argp->xdr, &set_it) < 0)
460 			return nfserr_bad_xdr;
461 		switch (set_it) {
462 		case NFS4_SET_TO_CLIENT_TIME:
463 			status = nfsd4_decode_nfstime4(argp, &iattr->ia_atime);
464 			if (status)
465 				return status;
466 			iattr->ia_valid |= (ATTR_ATIME | ATTR_ATIME_SET);
467 			break;
468 		case NFS4_SET_TO_SERVER_TIME:
469 			iattr->ia_valid |= ATTR_ATIME;
470 			break;
471 		default:
472 			return nfserr_bad_xdr;
473 		}
474 	}
475 	if (bmval[1] & FATTR4_WORD1_TIME_CREATE) {
476 		struct timespec64 ts;
477 
478 		/* No Linux filesystem supports setting this attribute. */
479 		bmval[1] &= ~FATTR4_WORD1_TIME_CREATE;
480 		status = nfsd4_decode_nfstime4(argp, &ts);
481 		if (status)
482 			return status;
483 	}
484 	if (bmval[1] & FATTR4_WORD1_TIME_MODIFY_SET) {
485 		u32 set_it;
486 
487 		if (xdr_stream_decode_u32(argp->xdr, &set_it) < 0)
488 			return nfserr_bad_xdr;
489 		switch (set_it) {
490 		case NFS4_SET_TO_CLIENT_TIME:
491 			status = nfsd4_decode_nfstime4(argp, &iattr->ia_mtime);
492 			if (status)
493 				return status;
494 			iattr->ia_valid |= (ATTR_MTIME | ATTR_MTIME_SET);
495 			break;
496 		case NFS4_SET_TO_SERVER_TIME:
497 			iattr->ia_valid |= ATTR_MTIME;
498 			break;
499 		default:
500 			return nfserr_bad_xdr;
501 		}
502 	}
503 	label->len = 0;
504 	if (IS_ENABLED(CONFIG_NFSD_V4_SECURITY_LABEL) &&
505 	    bmval[2] & FATTR4_WORD2_SECURITY_LABEL) {
506 		status = nfsd4_decode_security_label(argp, label);
507 		if (status)
508 			return status;
509 	}
510 	if (bmval[2] & FATTR4_WORD2_MODE_UMASK) {
511 		u32 mode, mask;
512 
513 		if (!umask)
514 			return nfserr_bad_xdr;
515 		if (xdr_stream_decode_u32(argp->xdr, &mode) < 0)
516 			return nfserr_bad_xdr;
517 		iattr->ia_mode = mode & (S_IFMT | S_IALLUGO);
518 		if (xdr_stream_decode_u32(argp->xdr, &mask) < 0)
519 			return nfserr_bad_xdr;
520 		*umask = mask & S_IRWXUGO;
521 		iattr->ia_valid |= ATTR_MODE;
522 	}
523 
524 	/* request sanity: did attrlist4 contain the expected number of words? */
525 	if (attrlist4_count != xdr_stream_pos(argp->xdr) - starting_pos)
526 		return nfserr_bad_xdr;
527 
528 	return nfs_ok;
529 }
530 
531 static __be32
532 nfsd4_decode_stateid4(struct nfsd4_compoundargs *argp, stateid_t *sid)
533 {
534 	__be32 *p;
535 
536 	p = xdr_inline_decode(argp->xdr, NFS4_STATEID_SIZE);
537 	if (!p)
538 		return nfserr_bad_xdr;
539 	sid->si_generation = be32_to_cpup(p++);
540 	memcpy(&sid->si_opaque, p, sizeof(sid->si_opaque));
541 	return nfs_ok;
542 }
543 
544 static __be32
545 nfsd4_decode_clientid4(struct nfsd4_compoundargs *argp, clientid_t *clientid)
546 {
547 	__be32 *p;
548 
549 	p = xdr_inline_decode(argp->xdr, sizeof(__be64));
550 	if (!p)
551 		return nfserr_bad_xdr;
552 	memcpy(clientid, p, sizeof(*clientid));
553 	return nfs_ok;
554 }
555 
556 static __be32
557 nfsd4_decode_state_owner4(struct nfsd4_compoundargs *argp,
558 			  clientid_t *clientid, struct xdr_netobj *owner)
559 {
560 	__be32 status;
561 
562 	status = nfsd4_decode_clientid4(argp, clientid);
563 	if (status)
564 		return status;
565 	return nfsd4_decode_opaque(argp, owner);
566 }
567 
568 #ifdef CONFIG_NFSD_PNFS
569 static __be32
570 nfsd4_decode_deviceid4(struct nfsd4_compoundargs *argp,
571 		       struct nfsd4_deviceid *devid)
572 {
573 	__be32 *p;
574 
575 	p = xdr_inline_decode(argp->xdr, NFS4_DEVICEID4_SIZE);
576 	if (!p)
577 		return nfserr_bad_xdr;
578 	memcpy(devid, p, sizeof(*devid));
579 	return nfs_ok;
580 }
581 
582 static __be32
583 nfsd4_decode_layoutupdate4(struct nfsd4_compoundargs *argp,
584 			   struct nfsd4_layoutcommit *lcp)
585 {
586 	if (xdr_stream_decode_u32(argp->xdr, &lcp->lc_layout_type) < 0)
587 		return nfserr_bad_xdr;
588 	if (lcp->lc_layout_type < LAYOUT_NFSV4_1_FILES)
589 		return nfserr_bad_xdr;
590 	if (lcp->lc_layout_type >= LAYOUT_TYPE_MAX)
591 		return nfserr_bad_xdr;
592 
593 	if (xdr_stream_decode_u32(argp->xdr, &lcp->lc_up_len) < 0)
594 		return nfserr_bad_xdr;
595 	if (lcp->lc_up_len > 0) {
596 		lcp->lc_up_layout = xdr_inline_decode(argp->xdr, lcp->lc_up_len);
597 		if (!lcp->lc_up_layout)
598 			return nfserr_bad_xdr;
599 	}
600 
601 	return nfs_ok;
602 }
603 
604 static __be32
605 nfsd4_decode_layoutreturn4(struct nfsd4_compoundargs *argp,
606 			   struct nfsd4_layoutreturn *lrp)
607 {
608 	__be32 status;
609 
610 	if (xdr_stream_decode_u32(argp->xdr, &lrp->lr_return_type) < 0)
611 		return nfserr_bad_xdr;
612 	switch (lrp->lr_return_type) {
613 	case RETURN_FILE:
614 		if (xdr_stream_decode_u64(argp->xdr, &lrp->lr_seg.offset) < 0)
615 			return nfserr_bad_xdr;
616 		if (xdr_stream_decode_u64(argp->xdr, &lrp->lr_seg.length) < 0)
617 			return nfserr_bad_xdr;
618 		status = nfsd4_decode_stateid4(argp, &lrp->lr_sid);
619 		if (status)
620 			return status;
621 		if (xdr_stream_decode_u32(argp->xdr, &lrp->lrf_body_len) < 0)
622 			return nfserr_bad_xdr;
623 		if (lrp->lrf_body_len > 0) {
624 			lrp->lrf_body = xdr_inline_decode(argp->xdr, lrp->lrf_body_len);
625 			if (!lrp->lrf_body)
626 				return nfserr_bad_xdr;
627 		}
628 		break;
629 	case RETURN_FSID:
630 	case RETURN_ALL:
631 		lrp->lr_seg.offset = 0;
632 		lrp->lr_seg.length = NFS4_MAX_UINT64;
633 		break;
634 	default:
635 		return nfserr_bad_xdr;
636 	}
637 
638 	return nfs_ok;
639 }
640 
641 #endif /* CONFIG_NFSD_PNFS */
642 
643 static __be32
644 nfsd4_decode_sessionid4(struct nfsd4_compoundargs *argp,
645 			struct nfs4_sessionid *sessionid)
646 {
647 	__be32 *p;
648 
649 	p = xdr_inline_decode(argp->xdr, NFS4_MAX_SESSIONID_LEN);
650 	if (!p)
651 		return nfserr_bad_xdr;
652 	memcpy(sessionid->data, p, sizeof(sessionid->data));
653 	return nfs_ok;
654 }
655 
656 /* Defined in Appendix A of RFC 5531 */
657 static __be32
658 nfsd4_decode_authsys_parms(struct nfsd4_compoundargs *argp,
659 			   struct nfsd4_cb_sec *cbs)
660 {
661 	u32 stamp, gidcount, uid, gid;
662 	__be32 *p, status;
663 
664 	if (xdr_stream_decode_u32(argp->xdr, &stamp) < 0)
665 		return nfserr_bad_xdr;
666 	/* machine name */
667 	status = nfsd4_decode_ignored_string(argp, 255);
668 	if (status)
669 		return status;
670 	if (xdr_stream_decode_u32(argp->xdr, &uid) < 0)
671 		return nfserr_bad_xdr;
672 	if (xdr_stream_decode_u32(argp->xdr, &gid) < 0)
673 		return nfserr_bad_xdr;
674 	if (xdr_stream_decode_u32(argp->xdr, &gidcount) < 0)
675 		return nfserr_bad_xdr;
676 	if (gidcount > 16)
677 		return nfserr_bad_xdr;
678 	p = xdr_inline_decode(argp->xdr, gidcount << 2);
679 	if (!p)
680 		return nfserr_bad_xdr;
681 	if (cbs->flavor == (u32)(-1)) {
682 		struct user_namespace *userns = nfsd_user_namespace(argp->rqstp);
683 
684 		kuid_t kuid = make_kuid(userns, uid);
685 		kgid_t kgid = make_kgid(userns, gid);
686 		if (uid_valid(kuid) && gid_valid(kgid)) {
687 			cbs->uid = kuid;
688 			cbs->gid = kgid;
689 			cbs->flavor = RPC_AUTH_UNIX;
690 		} else {
691 			dprintk("RPC_AUTH_UNIX with invalid uid or gid, ignoring!\n");
692 		}
693 	}
694 
695 	return nfs_ok;
696 }
697 
698 static __be32
699 nfsd4_decode_gss_cb_handles4(struct nfsd4_compoundargs *argp,
700 			     struct nfsd4_cb_sec *cbs)
701 {
702 	__be32 status;
703 	u32 service;
704 
705 	dprintk("RPC_AUTH_GSS callback secflavor not supported!\n");
706 
707 	if (xdr_stream_decode_u32(argp->xdr, &service) < 0)
708 		return nfserr_bad_xdr;
709 	if (service < RPC_GSS_SVC_NONE || service > RPC_GSS_SVC_PRIVACY)
710 		return nfserr_bad_xdr;
711 	/* gcbp_handle_from_server */
712 	status = nfsd4_decode_ignored_string(argp, 0);
713 	if (status)
714 		return status;
715 	/* gcbp_handle_from_client */
716 	status = nfsd4_decode_ignored_string(argp, 0);
717 	if (status)
718 		return status;
719 
720 	return nfs_ok;
721 }
722 
723 /* a counted array of callback_sec_parms4 items */
724 static __be32
725 nfsd4_decode_cb_sec(struct nfsd4_compoundargs *argp, struct nfsd4_cb_sec *cbs)
726 {
727 	u32 i, secflavor, nr_secflavs;
728 	__be32 status;
729 
730 	/* callback_sec_params4 */
731 	if (xdr_stream_decode_u32(argp->xdr, &nr_secflavs) < 0)
732 		return nfserr_bad_xdr;
733 	if (nr_secflavs)
734 		cbs->flavor = (u32)(-1);
735 	else
736 		/* Is this legal? Be generous, take it to mean AUTH_NONE: */
737 		cbs->flavor = 0;
738 
739 	for (i = 0; i < nr_secflavs; ++i) {
740 		if (xdr_stream_decode_u32(argp->xdr, &secflavor) < 0)
741 			return nfserr_bad_xdr;
742 		switch (secflavor) {
743 		case RPC_AUTH_NULL:
744 			/* void */
745 			if (cbs->flavor == (u32)(-1))
746 				cbs->flavor = RPC_AUTH_NULL;
747 			break;
748 		case RPC_AUTH_UNIX:
749 			status = nfsd4_decode_authsys_parms(argp, cbs);
750 			if (status)
751 				return status;
752 			break;
753 		case RPC_AUTH_GSS:
754 			status = nfsd4_decode_gss_cb_handles4(argp, cbs);
755 			if (status)
756 				return status;
757 			break;
758 		default:
759 			return nfserr_inval;
760 		}
761 	}
762 
763 	return nfs_ok;
764 }
765 
766 
767 /*
768  * NFSv4 operation argument decoders
769  */
770 
771 static __be32
772 nfsd4_decode_access(struct nfsd4_compoundargs *argp,
773 		    union nfsd4_op_u *u)
774 {
775 	struct nfsd4_access *access = &u->access;
776 	if (xdr_stream_decode_u32(argp->xdr, &access->ac_req_access) < 0)
777 		return nfserr_bad_xdr;
778 	return nfs_ok;
779 }
780 
781 static __be32
782 nfsd4_decode_close(struct nfsd4_compoundargs *argp, union nfsd4_op_u *u)
783 {
784 	struct nfsd4_close *close = &u->close;
785 	if (xdr_stream_decode_u32(argp->xdr, &close->cl_seqid) < 0)
786 		return nfserr_bad_xdr;
787 	return nfsd4_decode_stateid4(argp, &close->cl_stateid);
788 }
789 
790 
791 static __be32
792 nfsd4_decode_commit(struct nfsd4_compoundargs *argp, union nfsd4_op_u *u)
793 {
794 	struct nfsd4_commit *commit = &u->commit;
795 	if (xdr_stream_decode_u64(argp->xdr, &commit->co_offset) < 0)
796 		return nfserr_bad_xdr;
797 	if (xdr_stream_decode_u32(argp->xdr, &commit->co_count) < 0)
798 		return nfserr_bad_xdr;
799 	memset(&commit->co_verf, 0, sizeof(commit->co_verf));
800 	return nfs_ok;
801 }
802 
803 static __be32
804 nfsd4_decode_create(struct nfsd4_compoundargs *argp, union nfsd4_op_u *u)
805 {
806 	struct nfsd4_create *create = &u->create;
807 	__be32 *p, status;
808 
809 	memset(create, 0, sizeof(*create));
810 	if (xdr_stream_decode_u32(argp->xdr, &create->cr_type) < 0)
811 		return nfserr_bad_xdr;
812 	switch (create->cr_type) {
813 	case NF4LNK:
814 		if (xdr_stream_decode_u32(argp->xdr, &create->cr_datalen) < 0)
815 			return nfserr_bad_xdr;
816 		p = xdr_inline_decode(argp->xdr, create->cr_datalen);
817 		if (!p)
818 			return nfserr_bad_xdr;
819 		create->cr_data = svcxdr_dupstr(argp, p, create->cr_datalen);
820 		if (!create->cr_data)
821 			return nfserr_jukebox;
822 		break;
823 	case NF4BLK:
824 	case NF4CHR:
825 		if (xdr_stream_decode_u32(argp->xdr, &create->cr_specdata1) < 0)
826 			return nfserr_bad_xdr;
827 		if (xdr_stream_decode_u32(argp->xdr, &create->cr_specdata2) < 0)
828 			return nfserr_bad_xdr;
829 		break;
830 	case NF4SOCK:
831 	case NF4FIFO:
832 	case NF4DIR:
833 	default:
834 		break;
835 	}
836 	status = nfsd4_decode_component4(argp, &create->cr_name,
837 					 &create->cr_namelen);
838 	if (status)
839 		return status;
840 	status = nfsd4_decode_fattr4(argp, create->cr_bmval,
841 				    ARRAY_SIZE(create->cr_bmval),
842 				    &create->cr_iattr, &create->cr_acl,
843 				    &create->cr_label, &create->cr_umask);
844 	if (status)
845 		return status;
846 
847 	return nfs_ok;
848 }
849 
850 static inline __be32
851 nfsd4_decode_delegreturn(struct nfsd4_compoundargs *argp, union nfsd4_op_u *u)
852 {
853 	struct nfsd4_delegreturn *dr = &u->delegreturn;
854 	return nfsd4_decode_stateid4(argp, &dr->dr_stateid);
855 }
856 
857 static inline __be32
858 nfsd4_decode_getattr(struct nfsd4_compoundargs *argp, union nfsd4_op_u *u)
859 {
860 	struct nfsd4_getattr *getattr = &u->getattr;
861 	memset(getattr, 0, sizeof(*getattr));
862 	return nfsd4_decode_bitmap4(argp, getattr->ga_bmval,
863 				    ARRAY_SIZE(getattr->ga_bmval));
864 }
865 
866 static __be32
867 nfsd4_decode_link(struct nfsd4_compoundargs *argp, union nfsd4_op_u *u)
868 {
869 	struct nfsd4_link *link = &u->link;
870 	memset(link, 0, sizeof(*link));
871 	return nfsd4_decode_component4(argp, &link->li_name, &link->li_namelen);
872 }
873 
874 static __be32
875 nfsd4_decode_open_to_lock_owner4(struct nfsd4_compoundargs *argp,
876 				 struct nfsd4_lock *lock)
877 {
878 	__be32 status;
879 
880 	if (xdr_stream_decode_u32(argp->xdr, &lock->lk_new_open_seqid) < 0)
881 		return nfserr_bad_xdr;
882 	status = nfsd4_decode_stateid4(argp, &lock->lk_new_open_stateid);
883 	if (status)
884 		return status;
885 	if (xdr_stream_decode_u32(argp->xdr, &lock->lk_new_lock_seqid) < 0)
886 		return nfserr_bad_xdr;
887 	return nfsd4_decode_state_owner4(argp, &lock->lk_new_clientid,
888 					 &lock->lk_new_owner);
889 }
890 
891 static __be32
892 nfsd4_decode_exist_lock_owner4(struct nfsd4_compoundargs *argp,
893 			       struct nfsd4_lock *lock)
894 {
895 	__be32 status;
896 
897 	status = nfsd4_decode_stateid4(argp, &lock->lk_old_lock_stateid);
898 	if (status)
899 		return status;
900 	if (xdr_stream_decode_u32(argp->xdr, &lock->lk_old_lock_seqid) < 0)
901 		return nfserr_bad_xdr;
902 
903 	return nfs_ok;
904 }
905 
906 static __be32
907 nfsd4_decode_locker4(struct nfsd4_compoundargs *argp, struct nfsd4_lock *lock)
908 {
909 	if (xdr_stream_decode_bool(argp->xdr, &lock->lk_is_new) < 0)
910 		return nfserr_bad_xdr;
911 	if (lock->lk_is_new)
912 		return nfsd4_decode_open_to_lock_owner4(argp, lock);
913 	return nfsd4_decode_exist_lock_owner4(argp, lock);
914 }
915 
916 static __be32
917 nfsd4_decode_lock(struct nfsd4_compoundargs *argp, union nfsd4_op_u *u)
918 {
919 	struct nfsd4_lock *lock = &u->lock;
920 	memset(lock, 0, sizeof(*lock));
921 	if (xdr_stream_decode_u32(argp->xdr, &lock->lk_type) < 0)
922 		return nfserr_bad_xdr;
923 	if ((lock->lk_type < NFS4_READ_LT) || (lock->lk_type > NFS4_WRITEW_LT))
924 		return nfserr_bad_xdr;
925 	if (xdr_stream_decode_bool(argp->xdr, &lock->lk_reclaim) < 0)
926 		return nfserr_bad_xdr;
927 	if (xdr_stream_decode_u64(argp->xdr, &lock->lk_offset) < 0)
928 		return nfserr_bad_xdr;
929 	if (xdr_stream_decode_u64(argp->xdr, &lock->lk_length) < 0)
930 		return nfserr_bad_xdr;
931 	return nfsd4_decode_locker4(argp, lock);
932 }
933 
934 static __be32
935 nfsd4_decode_lockt(struct nfsd4_compoundargs *argp, union nfsd4_op_u *u)
936 {
937 	struct nfsd4_lockt *lockt = &u->lockt;
938 	memset(lockt, 0, sizeof(*lockt));
939 	if (xdr_stream_decode_u32(argp->xdr, &lockt->lt_type) < 0)
940 		return nfserr_bad_xdr;
941 	if ((lockt->lt_type < NFS4_READ_LT) || (lockt->lt_type > NFS4_WRITEW_LT))
942 		return nfserr_bad_xdr;
943 	if (xdr_stream_decode_u64(argp->xdr, &lockt->lt_offset) < 0)
944 		return nfserr_bad_xdr;
945 	if (xdr_stream_decode_u64(argp->xdr, &lockt->lt_length) < 0)
946 		return nfserr_bad_xdr;
947 	return nfsd4_decode_state_owner4(argp, &lockt->lt_clientid,
948 					 &lockt->lt_owner);
949 }
950 
951 static __be32
952 nfsd4_decode_locku(struct nfsd4_compoundargs *argp, union nfsd4_op_u *u)
953 {
954 	struct nfsd4_locku *locku = &u->locku;
955 	__be32 status;
956 
957 	if (xdr_stream_decode_u32(argp->xdr, &locku->lu_type) < 0)
958 		return nfserr_bad_xdr;
959 	if ((locku->lu_type < NFS4_READ_LT) || (locku->lu_type > NFS4_WRITEW_LT))
960 		return nfserr_bad_xdr;
961 	if (xdr_stream_decode_u32(argp->xdr, &locku->lu_seqid) < 0)
962 		return nfserr_bad_xdr;
963 	status = nfsd4_decode_stateid4(argp, &locku->lu_stateid);
964 	if (status)
965 		return status;
966 	if (xdr_stream_decode_u64(argp->xdr, &locku->lu_offset) < 0)
967 		return nfserr_bad_xdr;
968 	if (xdr_stream_decode_u64(argp->xdr, &locku->lu_length) < 0)
969 		return nfserr_bad_xdr;
970 
971 	return nfs_ok;
972 }
973 
974 static __be32
975 nfsd4_decode_lookup(struct nfsd4_compoundargs *argp, union nfsd4_op_u *u)
976 {
977 	struct nfsd4_lookup *lookup = &u->lookup;
978 	return nfsd4_decode_component4(argp, &lookup->lo_name, &lookup->lo_len);
979 }
980 
981 static __be32
982 nfsd4_decode_createhow4(struct nfsd4_compoundargs *argp, struct nfsd4_open *open)
983 {
984 	__be32 status;
985 
986 	if (xdr_stream_decode_u32(argp->xdr, &open->op_createmode) < 0)
987 		return nfserr_bad_xdr;
988 	switch (open->op_createmode) {
989 	case NFS4_CREATE_UNCHECKED:
990 	case NFS4_CREATE_GUARDED:
991 		status = nfsd4_decode_fattr4(argp, open->op_bmval,
992 					     ARRAY_SIZE(open->op_bmval),
993 					     &open->op_iattr, &open->op_acl,
994 					     &open->op_label, &open->op_umask);
995 		if (status)
996 			return status;
997 		break;
998 	case NFS4_CREATE_EXCLUSIVE:
999 		status = nfsd4_decode_verifier4(argp, &open->op_verf);
1000 		if (status)
1001 			return status;
1002 		break;
1003 	case NFS4_CREATE_EXCLUSIVE4_1:
1004 		if (argp->minorversion < 1)
1005 			return nfserr_bad_xdr;
1006 		status = nfsd4_decode_verifier4(argp, &open->op_verf);
1007 		if (status)
1008 			return status;
1009 		status = nfsd4_decode_fattr4(argp, open->op_bmval,
1010 					     ARRAY_SIZE(open->op_bmval),
1011 					     &open->op_iattr, &open->op_acl,
1012 					     &open->op_label, &open->op_umask);
1013 		if (status)
1014 			return status;
1015 		break;
1016 	default:
1017 		return nfserr_bad_xdr;
1018 	}
1019 
1020 	return nfs_ok;
1021 }
1022 
1023 static __be32
1024 nfsd4_decode_openflag4(struct nfsd4_compoundargs *argp, struct nfsd4_open *open)
1025 {
1026 	__be32 status;
1027 
1028 	if (xdr_stream_decode_u32(argp->xdr, &open->op_create) < 0)
1029 		return nfserr_bad_xdr;
1030 	switch (open->op_create) {
1031 	case NFS4_OPEN_NOCREATE:
1032 		break;
1033 	case NFS4_OPEN_CREATE:
1034 		status = nfsd4_decode_createhow4(argp, open);
1035 		if (status)
1036 			return status;
1037 		break;
1038 	default:
1039 		return nfserr_bad_xdr;
1040 	}
1041 
1042 	return nfs_ok;
1043 }
1044 
1045 static __be32 nfsd4_decode_share_access(struct nfsd4_compoundargs *argp, u32 *share_access, u32 *deleg_want, u32 *deleg_when)
1046 {
1047 	u32 w;
1048 
1049 	if (xdr_stream_decode_u32(argp->xdr, &w) < 0)
1050 		return nfserr_bad_xdr;
1051 	*share_access = w & NFS4_SHARE_ACCESS_MASK;
1052 	*deleg_want = w & NFS4_SHARE_WANT_MASK;
1053 	if (deleg_when)
1054 		*deleg_when = w & NFS4_SHARE_WHEN_MASK;
1055 
1056 	switch (w & NFS4_SHARE_ACCESS_MASK) {
1057 	case NFS4_SHARE_ACCESS_READ:
1058 	case NFS4_SHARE_ACCESS_WRITE:
1059 	case NFS4_SHARE_ACCESS_BOTH:
1060 		break;
1061 	default:
1062 		return nfserr_bad_xdr;
1063 	}
1064 	w &= ~NFS4_SHARE_ACCESS_MASK;
1065 	if (!w)
1066 		return nfs_ok;
1067 	if (!argp->minorversion)
1068 		return nfserr_bad_xdr;
1069 	switch (w & NFS4_SHARE_WANT_MASK) {
1070 	case NFS4_SHARE_WANT_NO_PREFERENCE:
1071 	case NFS4_SHARE_WANT_READ_DELEG:
1072 	case NFS4_SHARE_WANT_WRITE_DELEG:
1073 	case NFS4_SHARE_WANT_ANY_DELEG:
1074 	case NFS4_SHARE_WANT_NO_DELEG:
1075 	case NFS4_SHARE_WANT_CANCEL:
1076 		break;
1077 	default:
1078 		return nfserr_bad_xdr;
1079 	}
1080 	w &= ~NFS4_SHARE_WANT_MASK;
1081 	if (!w)
1082 		return nfs_ok;
1083 
1084 	if (!deleg_when)	/* open_downgrade */
1085 		return nfserr_inval;
1086 	switch (w) {
1087 	case NFS4_SHARE_SIGNAL_DELEG_WHEN_RESRC_AVAIL:
1088 	case NFS4_SHARE_PUSH_DELEG_WHEN_UNCONTENDED:
1089 	case (NFS4_SHARE_SIGNAL_DELEG_WHEN_RESRC_AVAIL |
1090 	      NFS4_SHARE_PUSH_DELEG_WHEN_UNCONTENDED):
1091 		return nfs_ok;
1092 	}
1093 	return nfserr_bad_xdr;
1094 }
1095 
1096 static __be32 nfsd4_decode_share_deny(struct nfsd4_compoundargs *argp, u32 *x)
1097 {
1098 	if (xdr_stream_decode_u32(argp->xdr, x) < 0)
1099 		return nfserr_bad_xdr;
1100 	/* Note: unlike access bits, deny bits may be zero. */
1101 	if (*x & ~NFS4_SHARE_DENY_BOTH)
1102 		return nfserr_bad_xdr;
1103 
1104 	return nfs_ok;
1105 }
1106 
1107 static __be32
1108 nfsd4_decode_open_claim4(struct nfsd4_compoundargs *argp,
1109 			 struct nfsd4_open *open)
1110 {
1111 	__be32 status;
1112 
1113 	if (xdr_stream_decode_u32(argp->xdr, &open->op_claim_type) < 0)
1114 		return nfserr_bad_xdr;
1115 	switch (open->op_claim_type) {
1116 	case NFS4_OPEN_CLAIM_NULL:
1117 	case NFS4_OPEN_CLAIM_DELEGATE_PREV:
1118 		status = nfsd4_decode_component4(argp, &open->op_fname,
1119 						 &open->op_fnamelen);
1120 		if (status)
1121 			return status;
1122 		break;
1123 	case NFS4_OPEN_CLAIM_PREVIOUS:
1124 		if (xdr_stream_decode_u32(argp->xdr, &open->op_delegate_type) < 0)
1125 			return nfserr_bad_xdr;
1126 		break;
1127 	case NFS4_OPEN_CLAIM_DELEGATE_CUR:
1128 		status = nfsd4_decode_stateid4(argp, &open->op_delegate_stateid);
1129 		if (status)
1130 			return status;
1131 		status = nfsd4_decode_component4(argp, &open->op_fname,
1132 						 &open->op_fnamelen);
1133 		if (status)
1134 			return status;
1135 		break;
1136 	case NFS4_OPEN_CLAIM_FH:
1137 	case NFS4_OPEN_CLAIM_DELEG_PREV_FH:
1138 		if (argp->minorversion < 1)
1139 			return nfserr_bad_xdr;
1140 		/* void */
1141 		break;
1142 	case NFS4_OPEN_CLAIM_DELEG_CUR_FH:
1143 		if (argp->minorversion < 1)
1144 			return nfserr_bad_xdr;
1145 		status = nfsd4_decode_stateid4(argp, &open->op_delegate_stateid);
1146 		if (status)
1147 			return status;
1148 		break;
1149 	default:
1150 		return nfserr_bad_xdr;
1151 	}
1152 
1153 	return nfs_ok;
1154 }
1155 
1156 static __be32
1157 nfsd4_decode_open(struct nfsd4_compoundargs *argp, union nfsd4_op_u *u)
1158 {
1159 	struct nfsd4_open *open = &u->open;
1160 	__be32 status;
1161 	u32 dummy;
1162 
1163 	memset(open, 0, sizeof(*open));
1164 
1165 	if (xdr_stream_decode_u32(argp->xdr, &open->op_seqid) < 0)
1166 		return nfserr_bad_xdr;
1167 	/* deleg_want is ignored */
1168 	status = nfsd4_decode_share_access(argp, &open->op_share_access,
1169 					   &open->op_deleg_want, &dummy);
1170 	if (status)
1171 		return status;
1172 	status = nfsd4_decode_share_deny(argp, &open->op_share_deny);
1173 	if (status)
1174 		return status;
1175 	status = nfsd4_decode_state_owner4(argp, &open->op_clientid,
1176 					   &open->op_owner);
1177 	if (status)
1178 		return status;
1179 	status = nfsd4_decode_openflag4(argp, open);
1180 	if (status)
1181 		return status;
1182 	return nfsd4_decode_open_claim4(argp, open);
1183 }
1184 
1185 static __be32
1186 nfsd4_decode_open_confirm(struct nfsd4_compoundargs *argp,
1187 			  union nfsd4_op_u *u)
1188 {
1189 	struct nfsd4_open_confirm *open_conf = &u->open_confirm;
1190 	__be32 status;
1191 
1192 	if (argp->minorversion >= 1)
1193 		return nfserr_notsupp;
1194 
1195 	status = nfsd4_decode_stateid4(argp, &open_conf->oc_req_stateid);
1196 	if (status)
1197 		return status;
1198 	if (xdr_stream_decode_u32(argp->xdr, &open_conf->oc_seqid) < 0)
1199 		return nfserr_bad_xdr;
1200 
1201 	memset(&open_conf->oc_resp_stateid, 0,
1202 	       sizeof(open_conf->oc_resp_stateid));
1203 	return nfs_ok;
1204 }
1205 
1206 static __be32
1207 nfsd4_decode_open_downgrade(struct nfsd4_compoundargs *argp,
1208 			    union nfsd4_op_u *u)
1209 {
1210 	struct nfsd4_open_downgrade *open_down = &u->open_downgrade;
1211 	__be32 status;
1212 
1213 	memset(open_down, 0, sizeof(*open_down));
1214 	status = nfsd4_decode_stateid4(argp, &open_down->od_stateid);
1215 	if (status)
1216 		return status;
1217 	if (xdr_stream_decode_u32(argp->xdr, &open_down->od_seqid) < 0)
1218 		return nfserr_bad_xdr;
1219 	/* deleg_want is ignored */
1220 	status = nfsd4_decode_share_access(argp, &open_down->od_share_access,
1221 					   &open_down->od_deleg_want, NULL);
1222 	if (status)
1223 		return status;
1224 	return nfsd4_decode_share_deny(argp, &open_down->od_share_deny);
1225 }
1226 
1227 static __be32
1228 nfsd4_decode_putfh(struct nfsd4_compoundargs *argp, union nfsd4_op_u *u)
1229 {
1230 	struct nfsd4_putfh *putfh = &u->putfh;
1231 	__be32 *p;
1232 
1233 	if (xdr_stream_decode_u32(argp->xdr, &putfh->pf_fhlen) < 0)
1234 		return nfserr_bad_xdr;
1235 	if (putfh->pf_fhlen > NFS4_FHSIZE)
1236 		return nfserr_bad_xdr;
1237 	p = xdr_inline_decode(argp->xdr, putfh->pf_fhlen);
1238 	if (!p)
1239 		return nfserr_bad_xdr;
1240 	putfh->pf_fhval = svcxdr_savemem(argp, p, putfh->pf_fhlen);
1241 	if (!putfh->pf_fhval)
1242 		return nfserr_jukebox;
1243 
1244 	putfh->no_verify = false;
1245 	return nfs_ok;
1246 }
1247 
1248 static __be32
1249 nfsd4_decode_putpubfh(struct nfsd4_compoundargs *argp, union nfsd4_op_u *p)
1250 {
1251 	if (argp->minorversion == 0)
1252 		return nfs_ok;
1253 	return nfserr_notsupp;
1254 }
1255 
1256 static __be32
1257 nfsd4_decode_read(struct nfsd4_compoundargs *argp, union nfsd4_op_u *u)
1258 {
1259 	struct nfsd4_read *read = &u->read;
1260 	__be32 status;
1261 
1262 	memset(read, 0, sizeof(*read));
1263 	status = nfsd4_decode_stateid4(argp, &read->rd_stateid);
1264 	if (status)
1265 		return status;
1266 	if (xdr_stream_decode_u64(argp->xdr, &read->rd_offset) < 0)
1267 		return nfserr_bad_xdr;
1268 	if (xdr_stream_decode_u32(argp->xdr, &read->rd_length) < 0)
1269 		return nfserr_bad_xdr;
1270 
1271 	return nfs_ok;
1272 }
1273 
1274 static __be32
1275 nfsd4_decode_readdir(struct nfsd4_compoundargs *argp, union nfsd4_op_u *u)
1276 {
1277 	struct nfsd4_readdir *readdir = &u->readdir;
1278 	__be32 status;
1279 
1280 	memset(readdir, 0, sizeof(*readdir));
1281 	if (xdr_stream_decode_u64(argp->xdr, &readdir->rd_cookie) < 0)
1282 		return nfserr_bad_xdr;
1283 	status = nfsd4_decode_verifier4(argp, &readdir->rd_verf);
1284 	if (status)
1285 		return status;
1286 	if (xdr_stream_decode_u32(argp->xdr, &readdir->rd_dircount) < 0)
1287 		return nfserr_bad_xdr;
1288 	if (xdr_stream_decode_u32(argp->xdr, &readdir->rd_maxcount) < 0)
1289 		return nfserr_bad_xdr;
1290 	if (xdr_stream_decode_uint32_array(argp->xdr, readdir->rd_bmval,
1291 					   ARRAY_SIZE(readdir->rd_bmval)) < 0)
1292 		return nfserr_bad_xdr;
1293 
1294 	return nfs_ok;
1295 }
1296 
1297 static __be32
1298 nfsd4_decode_remove(struct nfsd4_compoundargs *argp, union nfsd4_op_u *u)
1299 {
1300 	struct nfsd4_remove *remove = &u->remove;
1301 	memset(&remove->rm_cinfo, 0, sizeof(remove->rm_cinfo));
1302 	return nfsd4_decode_component4(argp, &remove->rm_name, &remove->rm_namelen);
1303 }
1304 
1305 static __be32
1306 nfsd4_decode_rename(struct nfsd4_compoundargs *argp, union nfsd4_op_u *u)
1307 {
1308 	struct nfsd4_rename *rename = &u->rename;
1309 	__be32 status;
1310 
1311 	memset(rename, 0, sizeof(*rename));
1312 	status = nfsd4_decode_component4(argp, &rename->rn_sname, &rename->rn_snamelen);
1313 	if (status)
1314 		return status;
1315 	return nfsd4_decode_component4(argp, &rename->rn_tname, &rename->rn_tnamelen);
1316 }
1317 
1318 static __be32
1319 nfsd4_decode_renew(struct nfsd4_compoundargs *argp, union nfsd4_op_u *u)
1320 {
1321 	clientid_t *clientid = &u->renew;
1322 	return nfsd4_decode_clientid4(argp, clientid);
1323 }
1324 
1325 static __be32
1326 nfsd4_decode_secinfo(struct nfsd4_compoundargs *argp,
1327 		     union nfsd4_op_u *u)
1328 {
1329 	struct nfsd4_secinfo *secinfo = &u->secinfo;
1330 	secinfo->si_exp = NULL;
1331 	return nfsd4_decode_component4(argp, &secinfo->si_name, &secinfo->si_namelen);
1332 }
1333 
1334 static __be32
1335 nfsd4_decode_setattr(struct nfsd4_compoundargs *argp, union nfsd4_op_u *u)
1336 {
1337 	struct nfsd4_setattr *setattr = &u->setattr;
1338 	__be32 status;
1339 
1340 	memset(setattr, 0, sizeof(*setattr));
1341 	status = nfsd4_decode_stateid4(argp, &setattr->sa_stateid);
1342 	if (status)
1343 		return status;
1344 	return nfsd4_decode_fattr4(argp, setattr->sa_bmval,
1345 				   ARRAY_SIZE(setattr->sa_bmval),
1346 				   &setattr->sa_iattr, &setattr->sa_acl,
1347 				   &setattr->sa_label, NULL);
1348 }
1349 
1350 static __be32
1351 nfsd4_decode_setclientid(struct nfsd4_compoundargs *argp, union nfsd4_op_u *u)
1352 {
1353 	struct nfsd4_setclientid *setclientid = &u->setclientid;
1354 	__be32 *p, status;
1355 
1356 	memset(setclientid, 0, sizeof(*setclientid));
1357 
1358 	if (argp->minorversion >= 1)
1359 		return nfserr_notsupp;
1360 
1361 	status = nfsd4_decode_verifier4(argp, &setclientid->se_verf);
1362 	if (status)
1363 		return status;
1364 	status = nfsd4_decode_opaque(argp, &setclientid->se_name);
1365 	if (status)
1366 		return status;
1367 	if (xdr_stream_decode_u32(argp->xdr, &setclientid->se_callback_prog) < 0)
1368 		return nfserr_bad_xdr;
1369 	if (xdr_stream_decode_u32(argp->xdr, &setclientid->se_callback_netid_len) < 0)
1370 		return nfserr_bad_xdr;
1371 	p = xdr_inline_decode(argp->xdr, setclientid->se_callback_netid_len);
1372 	if (!p)
1373 		return nfserr_bad_xdr;
1374 	setclientid->se_callback_netid_val = svcxdr_savemem(argp, p,
1375 						setclientid->se_callback_netid_len);
1376 	if (!setclientid->se_callback_netid_val)
1377 		return nfserr_jukebox;
1378 
1379 	if (xdr_stream_decode_u32(argp->xdr, &setclientid->se_callback_addr_len) < 0)
1380 		return nfserr_bad_xdr;
1381 	p = xdr_inline_decode(argp->xdr, setclientid->se_callback_addr_len);
1382 	if (!p)
1383 		return nfserr_bad_xdr;
1384 	setclientid->se_callback_addr_val = svcxdr_savemem(argp, p,
1385 						setclientid->se_callback_addr_len);
1386 	if (!setclientid->se_callback_addr_val)
1387 		return nfserr_jukebox;
1388 	if (xdr_stream_decode_u32(argp->xdr, &setclientid->se_callback_ident) < 0)
1389 		return nfserr_bad_xdr;
1390 
1391 	return nfs_ok;
1392 }
1393 
1394 static __be32
1395 nfsd4_decode_setclientid_confirm(struct nfsd4_compoundargs *argp,
1396 				 union nfsd4_op_u *u)
1397 {
1398 	struct nfsd4_setclientid_confirm *scd_c = &u->setclientid_confirm;
1399 	__be32 status;
1400 
1401 	if (argp->minorversion >= 1)
1402 		return nfserr_notsupp;
1403 
1404 	status = nfsd4_decode_clientid4(argp, &scd_c->sc_clientid);
1405 	if (status)
1406 		return status;
1407 	return nfsd4_decode_verifier4(argp, &scd_c->sc_confirm);
1408 }
1409 
1410 /* Also used for NVERIFY */
1411 static __be32
1412 nfsd4_decode_verify(struct nfsd4_compoundargs *argp, union nfsd4_op_u *u)
1413 {
1414 	struct nfsd4_verify *verify = &u->verify;
1415 	__be32 *p, status;
1416 
1417 	memset(verify, 0, sizeof(*verify));
1418 
1419 	status = nfsd4_decode_bitmap4(argp, verify->ve_bmval,
1420 				      ARRAY_SIZE(verify->ve_bmval));
1421 	if (status)
1422 		return status;
1423 
1424 	/* For convenience's sake, we compare raw xdr'd attributes in
1425 	 * nfsd4_proc_verify */
1426 
1427 	if (xdr_stream_decode_u32(argp->xdr, &verify->ve_attrlen) < 0)
1428 		return nfserr_bad_xdr;
1429 	p = xdr_inline_decode(argp->xdr, verify->ve_attrlen);
1430 	if (!p)
1431 		return nfserr_bad_xdr;
1432 	verify->ve_attrval = svcxdr_savemem(argp, p, verify->ve_attrlen);
1433 	if (!verify->ve_attrval)
1434 		return nfserr_jukebox;
1435 
1436 	return nfs_ok;
1437 }
1438 
1439 static __be32
1440 nfsd4_decode_write(struct nfsd4_compoundargs *argp, union nfsd4_op_u *u)
1441 {
1442 	struct nfsd4_write *write = &u->write;
1443 	__be32 status;
1444 
1445 	status = nfsd4_decode_stateid4(argp, &write->wr_stateid);
1446 	if (status)
1447 		return status;
1448 	if (xdr_stream_decode_u64(argp->xdr, &write->wr_offset) < 0)
1449 		return nfserr_bad_xdr;
1450 	if (xdr_stream_decode_u32(argp->xdr, &write->wr_stable_how) < 0)
1451 		return nfserr_bad_xdr;
1452 	if (write->wr_stable_how > NFS_FILE_SYNC)
1453 		return nfserr_bad_xdr;
1454 	if (xdr_stream_decode_u32(argp->xdr, &write->wr_buflen) < 0)
1455 		return nfserr_bad_xdr;
1456 	if (!xdr_stream_subsegment(argp->xdr, &write->wr_payload, write->wr_buflen))
1457 		return nfserr_bad_xdr;
1458 
1459 	write->wr_bytes_written = 0;
1460 	write->wr_how_written = 0;
1461 	memset(&write->wr_verifier, 0, sizeof(write->wr_verifier));
1462 	return nfs_ok;
1463 }
1464 
1465 static __be32
1466 nfsd4_decode_release_lockowner(struct nfsd4_compoundargs *argp,
1467 			       union nfsd4_op_u *u)
1468 {
1469 	struct nfsd4_release_lockowner *rlockowner = &u->release_lockowner;
1470 	__be32 status;
1471 
1472 	if (argp->minorversion >= 1)
1473 		return nfserr_notsupp;
1474 
1475 	status = nfsd4_decode_state_owner4(argp, &rlockowner->rl_clientid,
1476 					   &rlockowner->rl_owner);
1477 	if (status)
1478 		return status;
1479 
1480 	if (argp->minorversion && !zero_clientid(&rlockowner->rl_clientid))
1481 		return nfserr_inval;
1482 
1483 	return nfs_ok;
1484 }
1485 
1486 static __be32 nfsd4_decode_backchannel_ctl(struct nfsd4_compoundargs *argp,
1487 					   union nfsd4_op_u *u)
1488 {
1489 	struct nfsd4_backchannel_ctl *bc = &u->backchannel_ctl;
1490 	memset(bc, 0, sizeof(*bc));
1491 	if (xdr_stream_decode_u32(argp->xdr, &bc->bc_cb_program) < 0)
1492 		return nfserr_bad_xdr;
1493 	return nfsd4_decode_cb_sec(argp, &bc->bc_cb_sec);
1494 }
1495 
1496 static __be32 nfsd4_decode_bind_conn_to_session(struct nfsd4_compoundargs *argp,
1497 						union nfsd4_op_u *u)
1498 {
1499 	struct nfsd4_bind_conn_to_session *bcts = &u->bind_conn_to_session;
1500 	u32 use_conn_in_rdma_mode;
1501 	__be32 status;
1502 
1503 	memset(bcts, 0, sizeof(*bcts));
1504 	status = nfsd4_decode_sessionid4(argp, &bcts->sessionid);
1505 	if (status)
1506 		return status;
1507 	if (xdr_stream_decode_u32(argp->xdr, &bcts->dir) < 0)
1508 		return nfserr_bad_xdr;
1509 	if (xdr_stream_decode_u32(argp->xdr, &use_conn_in_rdma_mode) < 0)
1510 		return nfserr_bad_xdr;
1511 
1512 	return nfs_ok;
1513 }
1514 
1515 static __be32
1516 nfsd4_decode_state_protect_ops(struct nfsd4_compoundargs *argp,
1517 			       struct nfsd4_exchange_id *exid)
1518 {
1519 	__be32 status;
1520 
1521 	status = nfsd4_decode_bitmap4(argp, exid->spo_must_enforce,
1522 				      ARRAY_SIZE(exid->spo_must_enforce));
1523 	if (status)
1524 		return nfserr_bad_xdr;
1525 	status = nfsd4_decode_bitmap4(argp, exid->spo_must_allow,
1526 				      ARRAY_SIZE(exid->spo_must_allow));
1527 	if (status)
1528 		return nfserr_bad_xdr;
1529 
1530 	return nfs_ok;
1531 }
1532 
1533 /*
1534  * This implementation currently does not support SP4_SSV.
1535  * This decoder simply skips over these arguments.
1536  */
1537 static noinline __be32
1538 nfsd4_decode_ssv_sp_parms(struct nfsd4_compoundargs *argp,
1539 			  struct nfsd4_exchange_id *exid)
1540 {
1541 	u32 count, window, num_gss_handles;
1542 	__be32 status;
1543 
1544 	/* ssp_ops */
1545 	status = nfsd4_decode_state_protect_ops(argp, exid);
1546 	if (status)
1547 		return status;
1548 
1549 	/* ssp_hash_algs<> */
1550 	if (xdr_stream_decode_u32(argp->xdr, &count) < 0)
1551 		return nfserr_bad_xdr;
1552 	while (count--) {
1553 		status = nfsd4_decode_ignored_string(argp, 0);
1554 		if (status)
1555 			return status;
1556 	}
1557 
1558 	/* ssp_encr_algs<> */
1559 	if (xdr_stream_decode_u32(argp->xdr, &count) < 0)
1560 		return nfserr_bad_xdr;
1561 	while (count--) {
1562 		status = nfsd4_decode_ignored_string(argp, 0);
1563 		if (status)
1564 			return status;
1565 	}
1566 
1567 	if (xdr_stream_decode_u32(argp->xdr, &window) < 0)
1568 		return nfserr_bad_xdr;
1569 	if (xdr_stream_decode_u32(argp->xdr, &num_gss_handles) < 0)
1570 		return nfserr_bad_xdr;
1571 
1572 	return nfs_ok;
1573 }
1574 
1575 static __be32
1576 nfsd4_decode_state_protect4_a(struct nfsd4_compoundargs *argp,
1577 			      struct nfsd4_exchange_id *exid)
1578 {
1579 	__be32 status;
1580 
1581 	if (xdr_stream_decode_u32(argp->xdr, &exid->spa_how) < 0)
1582 		return nfserr_bad_xdr;
1583 	switch (exid->spa_how) {
1584 	case SP4_NONE:
1585 		break;
1586 	case SP4_MACH_CRED:
1587 		status = nfsd4_decode_state_protect_ops(argp, exid);
1588 		if (status)
1589 			return status;
1590 		break;
1591 	case SP4_SSV:
1592 		status = nfsd4_decode_ssv_sp_parms(argp, exid);
1593 		if (status)
1594 			return status;
1595 		break;
1596 	default:
1597 		return nfserr_bad_xdr;
1598 	}
1599 
1600 	return nfs_ok;
1601 }
1602 
1603 static __be32
1604 nfsd4_decode_nfs_impl_id4(struct nfsd4_compoundargs *argp,
1605 			  struct nfsd4_exchange_id *exid)
1606 {
1607 	__be32 status;
1608 	u32 count;
1609 
1610 	if (xdr_stream_decode_u32(argp->xdr, &count) < 0)
1611 		return nfserr_bad_xdr;
1612 	switch (count) {
1613 	case 0:
1614 		break;
1615 	case 1:
1616 		/* Note that RFC 8881 places no length limit on
1617 		 * nii_domain, but this implementation permits no
1618 		 * more than NFS4_OPAQUE_LIMIT bytes */
1619 		status = nfsd4_decode_opaque(argp, &exid->nii_domain);
1620 		if (status)
1621 			return status;
1622 		/* Note that RFC 8881 places no length limit on
1623 		 * nii_name, but this implementation permits no
1624 		 * more than NFS4_OPAQUE_LIMIT bytes */
1625 		status = nfsd4_decode_opaque(argp, &exid->nii_name);
1626 		if (status)
1627 			return status;
1628 		status = nfsd4_decode_nfstime4(argp, &exid->nii_time);
1629 		if (status)
1630 			return status;
1631 		break;
1632 	default:
1633 		return nfserr_bad_xdr;
1634 	}
1635 
1636 	return nfs_ok;
1637 }
1638 
1639 static __be32
1640 nfsd4_decode_exchange_id(struct nfsd4_compoundargs *argp,
1641 			 union nfsd4_op_u *u)
1642 {
1643 	struct nfsd4_exchange_id *exid = &u->exchange_id;
1644 	__be32 status;
1645 
1646 	memset(exid, 0, sizeof(*exid));
1647 	status = nfsd4_decode_verifier4(argp, &exid->verifier);
1648 	if (status)
1649 		return status;
1650 	status = nfsd4_decode_opaque(argp, &exid->clname);
1651 	if (status)
1652 		return status;
1653 	if (xdr_stream_decode_u32(argp->xdr, &exid->flags) < 0)
1654 		return nfserr_bad_xdr;
1655 	status = nfsd4_decode_state_protect4_a(argp, exid);
1656 	if (status)
1657 		return status;
1658 	return nfsd4_decode_nfs_impl_id4(argp, exid);
1659 }
1660 
1661 static __be32
1662 nfsd4_decode_channel_attrs4(struct nfsd4_compoundargs *argp,
1663 			    struct nfsd4_channel_attrs *ca)
1664 {
1665 	__be32 *p;
1666 
1667 	p = xdr_inline_decode(argp->xdr, XDR_UNIT * 7);
1668 	if (!p)
1669 		return nfserr_bad_xdr;
1670 
1671 	/* headerpadsz is ignored */
1672 	p++;
1673 	ca->maxreq_sz = be32_to_cpup(p++);
1674 	ca->maxresp_sz = be32_to_cpup(p++);
1675 	ca->maxresp_cached = be32_to_cpup(p++);
1676 	ca->maxops = be32_to_cpup(p++);
1677 	ca->maxreqs = be32_to_cpup(p++);
1678 	ca->nr_rdma_attrs = be32_to_cpup(p);
1679 	switch (ca->nr_rdma_attrs) {
1680 	case 0:
1681 		break;
1682 	case 1:
1683 		if (xdr_stream_decode_u32(argp->xdr, &ca->rdma_attrs) < 0)
1684 			return nfserr_bad_xdr;
1685 		break;
1686 	default:
1687 		return nfserr_bad_xdr;
1688 	}
1689 
1690 	return nfs_ok;
1691 }
1692 
1693 static __be32
1694 nfsd4_decode_create_session(struct nfsd4_compoundargs *argp,
1695 			    union nfsd4_op_u *u)
1696 {
1697 	struct nfsd4_create_session *sess = &u->create_session;
1698 	__be32 status;
1699 
1700 	memset(sess, 0, sizeof(*sess));
1701 	status = nfsd4_decode_clientid4(argp, &sess->clientid);
1702 	if (status)
1703 		return status;
1704 	if (xdr_stream_decode_u32(argp->xdr, &sess->seqid) < 0)
1705 		return nfserr_bad_xdr;
1706 	if (xdr_stream_decode_u32(argp->xdr, &sess->flags) < 0)
1707 		return nfserr_bad_xdr;
1708 	status = nfsd4_decode_channel_attrs4(argp, &sess->fore_channel);
1709 	if (status)
1710 		return status;
1711 	status = nfsd4_decode_channel_attrs4(argp, &sess->back_channel);
1712 	if (status)
1713 		return status;
1714 	if (xdr_stream_decode_u32(argp->xdr, &sess->callback_prog) < 0)
1715 		return nfserr_bad_xdr;
1716 	return nfsd4_decode_cb_sec(argp, &sess->cb_sec);
1717 }
1718 
1719 static __be32
1720 nfsd4_decode_destroy_session(struct nfsd4_compoundargs *argp,
1721 			     union nfsd4_op_u *u)
1722 {
1723 	struct nfsd4_destroy_session *destroy_session = &u->destroy_session;
1724 	return nfsd4_decode_sessionid4(argp, &destroy_session->sessionid);
1725 }
1726 
1727 static __be32
1728 nfsd4_decode_free_stateid(struct nfsd4_compoundargs *argp,
1729 			  union nfsd4_op_u *u)
1730 {
1731 	struct nfsd4_free_stateid *free_stateid = &u->free_stateid;
1732 	return nfsd4_decode_stateid4(argp, &free_stateid->fr_stateid);
1733 }
1734 
1735 #ifdef CONFIG_NFSD_PNFS
1736 static __be32
1737 nfsd4_decode_getdeviceinfo(struct nfsd4_compoundargs *argp,
1738 		union nfsd4_op_u *u)
1739 {
1740 	struct nfsd4_getdeviceinfo *gdev = &u->getdeviceinfo;
1741 	__be32 status;
1742 
1743 	memset(gdev, 0, sizeof(*gdev));
1744 	status = nfsd4_decode_deviceid4(argp, &gdev->gd_devid);
1745 	if (status)
1746 		return status;
1747 	if (xdr_stream_decode_u32(argp->xdr, &gdev->gd_layout_type) < 0)
1748 		return nfserr_bad_xdr;
1749 	if (xdr_stream_decode_u32(argp->xdr, &gdev->gd_maxcount) < 0)
1750 		return nfserr_bad_xdr;
1751 	if (xdr_stream_decode_uint32_array(argp->xdr,
1752 					   &gdev->gd_notify_types, 1) < 0)
1753 		return nfserr_bad_xdr;
1754 
1755 	return nfs_ok;
1756 }
1757 
1758 static __be32
1759 nfsd4_decode_layoutcommit(struct nfsd4_compoundargs *argp,
1760 			  union nfsd4_op_u *u)
1761 {
1762 	struct nfsd4_layoutcommit *lcp = &u->layoutcommit;
1763 	__be32 *p, status;
1764 
1765 	memset(lcp, 0, sizeof(*lcp));
1766 	if (xdr_stream_decode_u64(argp->xdr, &lcp->lc_seg.offset) < 0)
1767 		return nfserr_bad_xdr;
1768 	if (xdr_stream_decode_u64(argp->xdr, &lcp->lc_seg.length) < 0)
1769 		return nfserr_bad_xdr;
1770 	if (xdr_stream_decode_bool(argp->xdr, &lcp->lc_reclaim) < 0)
1771 		return nfserr_bad_xdr;
1772 	status = nfsd4_decode_stateid4(argp, &lcp->lc_sid);
1773 	if (status)
1774 		return status;
1775 	if (xdr_stream_decode_u32(argp->xdr, &lcp->lc_newoffset) < 0)
1776 		return nfserr_bad_xdr;
1777 	if (lcp->lc_newoffset) {
1778 		if (xdr_stream_decode_u64(argp->xdr, &lcp->lc_last_wr) < 0)
1779 			return nfserr_bad_xdr;
1780 	} else
1781 		lcp->lc_last_wr = 0;
1782 	p = xdr_inline_decode(argp->xdr, XDR_UNIT);
1783 	if (!p)
1784 		return nfserr_bad_xdr;
1785 	if (xdr_item_is_present(p)) {
1786 		status = nfsd4_decode_nfstime4(argp, &lcp->lc_mtime);
1787 		if (status)
1788 			return status;
1789 	} else {
1790 		lcp->lc_mtime.tv_nsec = UTIME_NOW;
1791 	}
1792 	return nfsd4_decode_layoutupdate4(argp, lcp);
1793 }
1794 
1795 static __be32
1796 nfsd4_decode_layoutget(struct nfsd4_compoundargs *argp,
1797 		union nfsd4_op_u *u)
1798 {
1799 	struct nfsd4_layoutget *lgp = &u->layoutget;
1800 	__be32 status;
1801 
1802 	memset(lgp, 0, sizeof(*lgp));
1803 	if (xdr_stream_decode_u32(argp->xdr, &lgp->lg_signal) < 0)
1804 		return nfserr_bad_xdr;
1805 	if (xdr_stream_decode_u32(argp->xdr, &lgp->lg_layout_type) < 0)
1806 		return nfserr_bad_xdr;
1807 	if (xdr_stream_decode_u32(argp->xdr, &lgp->lg_seg.iomode) < 0)
1808 		return nfserr_bad_xdr;
1809 	if (xdr_stream_decode_u64(argp->xdr, &lgp->lg_seg.offset) < 0)
1810 		return nfserr_bad_xdr;
1811 	if (xdr_stream_decode_u64(argp->xdr, &lgp->lg_seg.length) < 0)
1812 		return nfserr_bad_xdr;
1813 	if (xdr_stream_decode_u64(argp->xdr, &lgp->lg_minlength) < 0)
1814 		return nfserr_bad_xdr;
1815 	status = nfsd4_decode_stateid4(argp, &lgp->lg_sid);
1816 	if (status)
1817 		return status;
1818 	if (xdr_stream_decode_u32(argp->xdr, &lgp->lg_maxcount) < 0)
1819 		return nfserr_bad_xdr;
1820 
1821 	return nfs_ok;
1822 }
1823 
1824 static __be32
1825 nfsd4_decode_layoutreturn(struct nfsd4_compoundargs *argp,
1826 		union nfsd4_op_u *u)
1827 {
1828 	struct nfsd4_layoutreturn *lrp = &u->layoutreturn;
1829 	memset(lrp, 0, sizeof(*lrp));
1830 	if (xdr_stream_decode_bool(argp->xdr, &lrp->lr_reclaim) < 0)
1831 		return nfserr_bad_xdr;
1832 	if (xdr_stream_decode_u32(argp->xdr, &lrp->lr_layout_type) < 0)
1833 		return nfserr_bad_xdr;
1834 	if (xdr_stream_decode_u32(argp->xdr, &lrp->lr_seg.iomode) < 0)
1835 		return nfserr_bad_xdr;
1836 	return nfsd4_decode_layoutreturn4(argp, lrp);
1837 }
1838 #endif /* CONFIG_NFSD_PNFS */
1839 
1840 static __be32 nfsd4_decode_secinfo_no_name(struct nfsd4_compoundargs *argp,
1841 					   union nfsd4_op_u *u)
1842 {
1843 	struct nfsd4_secinfo_no_name *sin = &u->secinfo_no_name;
1844 	if (xdr_stream_decode_u32(argp->xdr, &sin->sin_style) < 0)
1845 		return nfserr_bad_xdr;
1846 
1847 	sin->sin_exp = NULL;
1848 	return nfs_ok;
1849 }
1850 
1851 static __be32
1852 nfsd4_decode_sequence(struct nfsd4_compoundargs *argp,
1853 		      union nfsd4_op_u *u)
1854 {
1855 	struct nfsd4_sequence *seq = &u->sequence;
1856 	__be32 *p, status;
1857 
1858 	status = nfsd4_decode_sessionid4(argp, &seq->sessionid);
1859 	if (status)
1860 		return status;
1861 	p = xdr_inline_decode(argp->xdr, XDR_UNIT * 4);
1862 	if (!p)
1863 		return nfserr_bad_xdr;
1864 	seq->seqid = be32_to_cpup(p++);
1865 	seq->slotid = be32_to_cpup(p++);
1866 	seq->maxslots = be32_to_cpup(p++);
1867 	seq->cachethis = be32_to_cpup(p);
1868 
1869 	seq->status_flags = 0;
1870 	return nfs_ok;
1871 }
1872 
1873 static __be32
1874 nfsd4_decode_test_stateid(struct nfsd4_compoundargs *argp,
1875 			  union nfsd4_op_u *u)
1876 {
1877 	struct nfsd4_test_stateid *test_stateid = &u->test_stateid;
1878 	struct nfsd4_test_stateid_id *stateid;
1879 	__be32 status;
1880 	u32 i;
1881 
1882 	memset(test_stateid, 0, sizeof(*test_stateid));
1883 	if (xdr_stream_decode_u32(argp->xdr, &test_stateid->ts_num_ids) < 0)
1884 		return nfserr_bad_xdr;
1885 
1886 	INIT_LIST_HEAD(&test_stateid->ts_stateid_list);
1887 	for (i = 0; i < test_stateid->ts_num_ids; i++) {
1888 		stateid = svcxdr_tmpalloc(argp, sizeof(*stateid));
1889 		if (!stateid)
1890 			return nfserr_jukebox;
1891 		INIT_LIST_HEAD(&stateid->ts_id_list);
1892 		list_add_tail(&stateid->ts_id_list, &test_stateid->ts_stateid_list);
1893 		status = nfsd4_decode_stateid4(argp, &stateid->ts_id_stateid);
1894 		if (status)
1895 			return status;
1896 	}
1897 
1898 	return nfs_ok;
1899 }
1900 
1901 static __be32 nfsd4_decode_destroy_clientid(struct nfsd4_compoundargs *argp,
1902 					    union nfsd4_op_u *u)
1903 {
1904 	struct nfsd4_destroy_clientid *dc = &u->destroy_clientid;
1905 	return nfsd4_decode_clientid4(argp, &dc->clientid);
1906 }
1907 
1908 static __be32 nfsd4_decode_reclaim_complete(struct nfsd4_compoundargs *argp,
1909 					    union nfsd4_op_u *u)
1910 {
1911 	struct nfsd4_reclaim_complete *rc = &u->reclaim_complete;
1912 	if (xdr_stream_decode_bool(argp->xdr, &rc->rca_one_fs) < 0)
1913 		return nfserr_bad_xdr;
1914 	return nfs_ok;
1915 }
1916 
1917 static __be32
1918 nfsd4_decode_fallocate(struct nfsd4_compoundargs *argp,
1919 		       union nfsd4_op_u *u)
1920 {
1921 	struct nfsd4_fallocate *fallocate = &u->allocate;
1922 	__be32 status;
1923 
1924 	status = nfsd4_decode_stateid4(argp, &fallocate->falloc_stateid);
1925 	if (status)
1926 		return status;
1927 	if (xdr_stream_decode_u64(argp->xdr, &fallocate->falloc_offset) < 0)
1928 		return nfserr_bad_xdr;
1929 	if (xdr_stream_decode_u64(argp->xdr, &fallocate->falloc_length) < 0)
1930 		return nfserr_bad_xdr;
1931 
1932 	return nfs_ok;
1933 }
1934 
1935 static __be32 nfsd4_decode_nl4_server(struct nfsd4_compoundargs *argp,
1936 				      struct nl4_server *ns)
1937 {
1938 	struct nfs42_netaddr *naddr;
1939 	__be32 *p;
1940 
1941 	if (xdr_stream_decode_u32(argp->xdr, &ns->nl4_type) < 0)
1942 		return nfserr_bad_xdr;
1943 
1944 	/* currently support for 1 inter-server source server */
1945 	switch (ns->nl4_type) {
1946 	case NL4_NETADDR:
1947 		naddr = &ns->u.nl4_addr;
1948 
1949 		if (xdr_stream_decode_u32(argp->xdr, &naddr->netid_len) < 0)
1950 			return nfserr_bad_xdr;
1951 		if (naddr->netid_len > RPCBIND_MAXNETIDLEN)
1952 			return nfserr_bad_xdr;
1953 
1954 		p = xdr_inline_decode(argp->xdr, naddr->netid_len);
1955 		if (!p)
1956 			return nfserr_bad_xdr;
1957 		memcpy(naddr->netid, p, naddr->netid_len);
1958 
1959 		if (xdr_stream_decode_u32(argp->xdr, &naddr->addr_len) < 0)
1960 			return nfserr_bad_xdr;
1961 		if (naddr->addr_len > RPCBIND_MAXUADDRLEN)
1962 			return nfserr_bad_xdr;
1963 
1964 		p = xdr_inline_decode(argp->xdr, naddr->addr_len);
1965 		if (!p)
1966 			return nfserr_bad_xdr;
1967 		memcpy(naddr->addr, p, naddr->addr_len);
1968 		break;
1969 	default:
1970 		return nfserr_bad_xdr;
1971 	}
1972 
1973 	return nfs_ok;
1974 }
1975 
1976 static __be32
1977 nfsd4_decode_copy(struct nfsd4_compoundargs *argp, union nfsd4_op_u *u)
1978 {
1979 	struct nfsd4_copy *copy = &u->copy;
1980 	u32 consecutive, i, count, sync;
1981 	struct nl4_server *ns_dummy;
1982 	__be32 status;
1983 
1984 	memset(copy, 0, sizeof(*copy));
1985 	status = nfsd4_decode_stateid4(argp, &copy->cp_src_stateid);
1986 	if (status)
1987 		return status;
1988 	status = nfsd4_decode_stateid4(argp, &copy->cp_dst_stateid);
1989 	if (status)
1990 		return status;
1991 	if (xdr_stream_decode_u64(argp->xdr, &copy->cp_src_pos) < 0)
1992 		return nfserr_bad_xdr;
1993 	if (xdr_stream_decode_u64(argp->xdr, &copy->cp_dst_pos) < 0)
1994 		return nfserr_bad_xdr;
1995 	if (xdr_stream_decode_u64(argp->xdr, &copy->cp_count) < 0)
1996 		return nfserr_bad_xdr;
1997 	/* ca_consecutive: we always do consecutive copies */
1998 	if (xdr_stream_decode_u32(argp->xdr, &consecutive) < 0)
1999 		return nfserr_bad_xdr;
2000 	if (xdr_stream_decode_bool(argp->xdr, &sync) < 0)
2001 		return nfserr_bad_xdr;
2002 	nfsd4_copy_set_sync(copy, sync);
2003 
2004 	if (xdr_stream_decode_u32(argp->xdr, &count) < 0)
2005 		return nfserr_bad_xdr;
2006 	copy->cp_src = svcxdr_tmpalloc(argp, sizeof(*copy->cp_src));
2007 	if (copy->cp_src == NULL)
2008 		return nfserr_jukebox;
2009 	if (count == 0) { /* intra-server copy */
2010 		__set_bit(NFSD4_COPY_F_INTRA, &copy->cp_flags);
2011 		return nfs_ok;
2012 	}
2013 
2014 	/* decode all the supplied server addresses but use only the first */
2015 	status = nfsd4_decode_nl4_server(argp, copy->cp_src);
2016 	if (status)
2017 		return status;
2018 
2019 	ns_dummy = kmalloc(sizeof(struct nl4_server), GFP_KERNEL);
2020 	if (ns_dummy == NULL)
2021 		return nfserr_jukebox;
2022 	for (i = 0; i < count - 1; i++) {
2023 		status = nfsd4_decode_nl4_server(argp, ns_dummy);
2024 		if (status) {
2025 			kfree(ns_dummy);
2026 			return status;
2027 		}
2028 	}
2029 	kfree(ns_dummy);
2030 
2031 	return nfs_ok;
2032 }
2033 
2034 static __be32
2035 nfsd4_decode_copy_notify(struct nfsd4_compoundargs *argp,
2036 			 union nfsd4_op_u *u)
2037 {
2038 	struct nfsd4_copy_notify *cn = &u->copy_notify;
2039 	__be32 status;
2040 
2041 	memset(cn, 0, sizeof(*cn));
2042 	cn->cpn_src = svcxdr_tmpalloc(argp, sizeof(*cn->cpn_src));
2043 	if (cn->cpn_src == NULL)
2044 		return nfserr_jukebox;
2045 	cn->cpn_dst = svcxdr_tmpalloc(argp, sizeof(*cn->cpn_dst));
2046 	if (cn->cpn_dst == NULL)
2047 		return nfserr_jukebox;
2048 
2049 	status = nfsd4_decode_stateid4(argp, &cn->cpn_src_stateid);
2050 	if (status)
2051 		return status;
2052 	return nfsd4_decode_nl4_server(argp, cn->cpn_dst);
2053 }
2054 
2055 static __be32
2056 nfsd4_decode_offload_status(struct nfsd4_compoundargs *argp,
2057 			    union nfsd4_op_u *u)
2058 {
2059 	struct nfsd4_offload_status *os = &u->offload_status;
2060 	os->count = 0;
2061 	os->status = 0;
2062 	return nfsd4_decode_stateid4(argp, &os->stateid);
2063 }
2064 
2065 static __be32
2066 nfsd4_decode_seek(struct nfsd4_compoundargs *argp, union nfsd4_op_u *u)
2067 {
2068 	struct nfsd4_seek *seek = &u->seek;
2069 	__be32 status;
2070 
2071 	status = nfsd4_decode_stateid4(argp, &seek->seek_stateid);
2072 	if (status)
2073 		return status;
2074 	if (xdr_stream_decode_u64(argp->xdr, &seek->seek_offset) < 0)
2075 		return nfserr_bad_xdr;
2076 	if (xdr_stream_decode_u32(argp->xdr, &seek->seek_whence) < 0)
2077 		return nfserr_bad_xdr;
2078 
2079 	seek->seek_eof = 0;
2080 	seek->seek_pos = 0;
2081 	return nfs_ok;
2082 }
2083 
2084 static __be32
2085 nfsd4_decode_clone(struct nfsd4_compoundargs *argp, union nfsd4_op_u *u)
2086 {
2087 	struct nfsd4_clone *clone = &u->clone;
2088 	__be32 status;
2089 
2090 	status = nfsd4_decode_stateid4(argp, &clone->cl_src_stateid);
2091 	if (status)
2092 		return status;
2093 	status = nfsd4_decode_stateid4(argp, &clone->cl_dst_stateid);
2094 	if (status)
2095 		return status;
2096 	if (xdr_stream_decode_u64(argp->xdr, &clone->cl_src_pos) < 0)
2097 		return nfserr_bad_xdr;
2098 	if (xdr_stream_decode_u64(argp->xdr, &clone->cl_dst_pos) < 0)
2099 		return nfserr_bad_xdr;
2100 	if (xdr_stream_decode_u64(argp->xdr, &clone->cl_count) < 0)
2101 		return nfserr_bad_xdr;
2102 
2103 	return nfs_ok;
2104 }
2105 
2106 /*
2107  * XDR data that is more than PAGE_SIZE in size is normally part of a
2108  * read or write. However, the size of extended attributes is limited
2109  * by the maximum request size, and then further limited by the underlying
2110  * filesystem limits. This can exceed PAGE_SIZE (currently, XATTR_SIZE_MAX
2111  * is 64k). Since there is no kvec- or page-based interface to xattrs,
2112  * and we're not dealing with contiguous pages, we need to do some copying.
2113  */
2114 
2115 /*
2116  * Decode data into buffer.
2117  */
2118 static __be32
2119 nfsd4_vbuf_from_vector(struct nfsd4_compoundargs *argp, struct xdr_buf *xdr,
2120 		       char **bufp, u32 buflen)
2121 {
2122 	struct page **pages = xdr->pages;
2123 	struct kvec *head = xdr->head;
2124 	char *tmp, *dp;
2125 	u32 len;
2126 
2127 	if (buflen <= head->iov_len) {
2128 		/*
2129 		 * We're in luck, the head has enough space. Just return
2130 		 * the head, no need for copying.
2131 		 */
2132 		*bufp = head->iov_base;
2133 		return 0;
2134 	}
2135 
2136 	tmp = svcxdr_tmpalloc(argp, buflen);
2137 	if (tmp == NULL)
2138 		return nfserr_jukebox;
2139 
2140 	dp = tmp;
2141 	memcpy(dp, head->iov_base, head->iov_len);
2142 	buflen -= head->iov_len;
2143 	dp += head->iov_len;
2144 
2145 	while (buflen > 0) {
2146 		len = min_t(u32, buflen, PAGE_SIZE);
2147 		memcpy(dp, page_address(*pages), len);
2148 
2149 		buflen -= len;
2150 		dp += len;
2151 		pages++;
2152 	}
2153 
2154 	*bufp = tmp;
2155 	return 0;
2156 }
2157 
2158 /*
2159  * Get a user extended attribute name from the XDR buffer.
2160  * It will not have the "user." prefix, so prepend it.
2161  * Lastly, check for nul characters in the name.
2162  */
2163 static __be32
2164 nfsd4_decode_xattr_name(struct nfsd4_compoundargs *argp, char **namep)
2165 {
2166 	char *name, *sp, *dp;
2167 	u32 namelen, cnt;
2168 	__be32 *p;
2169 
2170 	if (xdr_stream_decode_u32(argp->xdr, &namelen) < 0)
2171 		return nfserr_bad_xdr;
2172 	if (namelen > (XATTR_NAME_MAX - XATTR_USER_PREFIX_LEN))
2173 		return nfserr_nametoolong;
2174 	if (namelen == 0)
2175 		return nfserr_bad_xdr;
2176 	p = xdr_inline_decode(argp->xdr, namelen);
2177 	if (!p)
2178 		return nfserr_bad_xdr;
2179 	name = svcxdr_tmpalloc(argp, namelen + XATTR_USER_PREFIX_LEN + 1);
2180 	if (!name)
2181 		return nfserr_jukebox;
2182 	memcpy(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN);
2183 
2184 	/*
2185 	 * Copy the extended attribute name over while checking for 0
2186 	 * characters.
2187 	 */
2188 	sp = (char *)p;
2189 	dp = name + XATTR_USER_PREFIX_LEN;
2190 	cnt = namelen;
2191 
2192 	while (cnt-- > 0) {
2193 		if (*sp == '\0')
2194 			return nfserr_bad_xdr;
2195 		*dp++ = *sp++;
2196 	}
2197 	*dp = '\0';
2198 
2199 	*namep = name;
2200 
2201 	return nfs_ok;
2202 }
2203 
2204 /*
2205  * A GETXATTR op request comes without a length specifier. We just set the
2206  * maximum length for the reply based on XATTR_SIZE_MAX and the maximum
2207  * channel reply size. nfsd_getxattr will probe the length of the xattr,
2208  * check it against getxa_len, and allocate + return the value.
2209  */
2210 static __be32
2211 nfsd4_decode_getxattr(struct nfsd4_compoundargs *argp,
2212 		      union nfsd4_op_u *u)
2213 {
2214 	struct nfsd4_getxattr *getxattr = &u->getxattr;
2215 	__be32 status;
2216 	u32 maxcount;
2217 
2218 	memset(getxattr, 0, sizeof(*getxattr));
2219 	status = nfsd4_decode_xattr_name(argp, &getxattr->getxa_name);
2220 	if (status)
2221 		return status;
2222 
2223 	maxcount = svc_max_payload(argp->rqstp);
2224 	maxcount = min_t(u32, XATTR_SIZE_MAX, maxcount);
2225 
2226 	getxattr->getxa_len = maxcount;
2227 	return nfs_ok;
2228 }
2229 
2230 static __be32
2231 nfsd4_decode_setxattr(struct nfsd4_compoundargs *argp,
2232 		      union nfsd4_op_u *u)
2233 {
2234 	struct nfsd4_setxattr *setxattr = &u->setxattr;
2235 	u32 flags, maxcount, size;
2236 	__be32 status;
2237 
2238 	memset(setxattr, 0, sizeof(*setxattr));
2239 
2240 	if (xdr_stream_decode_u32(argp->xdr, &flags) < 0)
2241 		return nfserr_bad_xdr;
2242 
2243 	if (flags > SETXATTR4_REPLACE)
2244 		return nfserr_inval;
2245 	setxattr->setxa_flags = flags;
2246 
2247 	status = nfsd4_decode_xattr_name(argp, &setxattr->setxa_name);
2248 	if (status)
2249 		return status;
2250 
2251 	maxcount = svc_max_payload(argp->rqstp);
2252 	maxcount = min_t(u32, XATTR_SIZE_MAX, maxcount);
2253 
2254 	if (xdr_stream_decode_u32(argp->xdr, &size) < 0)
2255 		return nfserr_bad_xdr;
2256 	if (size > maxcount)
2257 		return nfserr_xattr2big;
2258 
2259 	setxattr->setxa_len = size;
2260 	if (size > 0) {
2261 		struct xdr_buf payload;
2262 
2263 		if (!xdr_stream_subsegment(argp->xdr, &payload, size))
2264 			return nfserr_bad_xdr;
2265 		status = nfsd4_vbuf_from_vector(argp, &payload,
2266 						&setxattr->setxa_buf, size);
2267 	}
2268 
2269 	return nfs_ok;
2270 }
2271 
2272 static __be32
2273 nfsd4_decode_listxattrs(struct nfsd4_compoundargs *argp,
2274 			union nfsd4_op_u *u)
2275 {
2276 	struct nfsd4_listxattrs *listxattrs = &u->listxattrs;
2277 	u32 maxcount;
2278 
2279 	memset(listxattrs, 0, sizeof(*listxattrs));
2280 
2281 	if (xdr_stream_decode_u64(argp->xdr, &listxattrs->lsxa_cookie) < 0)
2282 		return nfserr_bad_xdr;
2283 
2284 	/*
2285 	 * If the cookie  is too large to have even one user.x attribute
2286 	 * plus trailing '\0' left in a maximum size buffer, it's invalid.
2287 	 */
2288 	if (listxattrs->lsxa_cookie >=
2289 	    (XATTR_LIST_MAX / (XATTR_USER_PREFIX_LEN + 2)))
2290 		return nfserr_badcookie;
2291 
2292 	if (xdr_stream_decode_u32(argp->xdr, &maxcount) < 0)
2293 		return nfserr_bad_xdr;
2294 	if (maxcount < 8)
2295 		/* Always need at least 2 words (length and one character) */
2296 		return nfserr_inval;
2297 
2298 	maxcount = min(maxcount, svc_max_payload(argp->rqstp));
2299 	listxattrs->lsxa_maxcount = maxcount;
2300 
2301 	return nfs_ok;
2302 }
2303 
2304 static __be32
2305 nfsd4_decode_removexattr(struct nfsd4_compoundargs *argp,
2306 			 union nfsd4_op_u *u)
2307 {
2308 	struct nfsd4_removexattr *removexattr = &u->removexattr;
2309 	memset(removexattr, 0, sizeof(*removexattr));
2310 	return nfsd4_decode_xattr_name(argp, &removexattr->rmxa_name);
2311 }
2312 
2313 static __be32
2314 nfsd4_decode_noop(struct nfsd4_compoundargs *argp, union nfsd4_op_u *p)
2315 {
2316 	return nfs_ok;
2317 }
2318 
2319 static __be32
2320 nfsd4_decode_notsupp(struct nfsd4_compoundargs *argp, union nfsd4_op_u *p)
2321 {
2322 	return nfserr_notsupp;
2323 }
2324 
2325 typedef __be32(*nfsd4_dec)(struct nfsd4_compoundargs *argp, union nfsd4_op_u *u);
2326 
2327 static const nfsd4_dec nfsd4_dec_ops[] = {
2328 	[OP_ACCESS]		= nfsd4_decode_access,
2329 	[OP_CLOSE]		= nfsd4_decode_close,
2330 	[OP_COMMIT]		= nfsd4_decode_commit,
2331 	[OP_CREATE]		= nfsd4_decode_create,
2332 	[OP_DELEGPURGE]		= nfsd4_decode_notsupp,
2333 	[OP_DELEGRETURN]	= nfsd4_decode_delegreturn,
2334 	[OP_GETATTR]		= nfsd4_decode_getattr,
2335 	[OP_GETFH]		= nfsd4_decode_noop,
2336 	[OP_LINK]		= nfsd4_decode_link,
2337 	[OP_LOCK]		= nfsd4_decode_lock,
2338 	[OP_LOCKT]		= nfsd4_decode_lockt,
2339 	[OP_LOCKU]		= nfsd4_decode_locku,
2340 	[OP_LOOKUP]		= nfsd4_decode_lookup,
2341 	[OP_LOOKUPP]		= nfsd4_decode_noop,
2342 	[OP_NVERIFY]		= nfsd4_decode_verify,
2343 	[OP_OPEN]		= nfsd4_decode_open,
2344 	[OP_OPENATTR]		= nfsd4_decode_notsupp,
2345 	[OP_OPEN_CONFIRM]	= nfsd4_decode_open_confirm,
2346 	[OP_OPEN_DOWNGRADE]	= nfsd4_decode_open_downgrade,
2347 	[OP_PUTFH]		= nfsd4_decode_putfh,
2348 	[OP_PUTPUBFH]		= nfsd4_decode_putpubfh,
2349 	[OP_PUTROOTFH]		= nfsd4_decode_noop,
2350 	[OP_READ]		= nfsd4_decode_read,
2351 	[OP_READDIR]		= nfsd4_decode_readdir,
2352 	[OP_READLINK]		= nfsd4_decode_noop,
2353 	[OP_REMOVE]		= nfsd4_decode_remove,
2354 	[OP_RENAME]		= nfsd4_decode_rename,
2355 	[OP_RENEW]		= nfsd4_decode_renew,
2356 	[OP_RESTOREFH]		= nfsd4_decode_noop,
2357 	[OP_SAVEFH]		= nfsd4_decode_noop,
2358 	[OP_SECINFO]		= nfsd4_decode_secinfo,
2359 	[OP_SETATTR]		= nfsd4_decode_setattr,
2360 	[OP_SETCLIENTID]	= nfsd4_decode_setclientid,
2361 	[OP_SETCLIENTID_CONFIRM] = nfsd4_decode_setclientid_confirm,
2362 	[OP_VERIFY]		= nfsd4_decode_verify,
2363 	[OP_WRITE]		= nfsd4_decode_write,
2364 	[OP_RELEASE_LOCKOWNER]	= nfsd4_decode_release_lockowner,
2365 
2366 	/* new operations for NFSv4.1 */
2367 	[OP_BACKCHANNEL_CTL]	= nfsd4_decode_backchannel_ctl,
2368 	[OP_BIND_CONN_TO_SESSION] = nfsd4_decode_bind_conn_to_session,
2369 	[OP_EXCHANGE_ID]	= nfsd4_decode_exchange_id,
2370 	[OP_CREATE_SESSION]	= nfsd4_decode_create_session,
2371 	[OP_DESTROY_SESSION]	= nfsd4_decode_destroy_session,
2372 	[OP_FREE_STATEID]	= nfsd4_decode_free_stateid,
2373 	[OP_GET_DIR_DELEGATION]	= nfsd4_decode_notsupp,
2374 #ifdef CONFIG_NFSD_PNFS
2375 	[OP_GETDEVICEINFO]	= nfsd4_decode_getdeviceinfo,
2376 	[OP_GETDEVICELIST]	= nfsd4_decode_notsupp,
2377 	[OP_LAYOUTCOMMIT]	= nfsd4_decode_layoutcommit,
2378 	[OP_LAYOUTGET]		= nfsd4_decode_layoutget,
2379 	[OP_LAYOUTRETURN]	= nfsd4_decode_layoutreturn,
2380 #else
2381 	[OP_GETDEVICEINFO]	= nfsd4_decode_notsupp,
2382 	[OP_GETDEVICELIST]	= nfsd4_decode_notsupp,
2383 	[OP_LAYOUTCOMMIT]	= nfsd4_decode_notsupp,
2384 	[OP_LAYOUTGET]		= nfsd4_decode_notsupp,
2385 	[OP_LAYOUTRETURN]	= nfsd4_decode_notsupp,
2386 #endif
2387 	[OP_SECINFO_NO_NAME]	= nfsd4_decode_secinfo_no_name,
2388 	[OP_SEQUENCE]		= nfsd4_decode_sequence,
2389 	[OP_SET_SSV]		= nfsd4_decode_notsupp,
2390 	[OP_TEST_STATEID]	= nfsd4_decode_test_stateid,
2391 	[OP_WANT_DELEGATION]	= nfsd4_decode_notsupp,
2392 	[OP_DESTROY_CLIENTID]	= nfsd4_decode_destroy_clientid,
2393 	[OP_RECLAIM_COMPLETE]	= nfsd4_decode_reclaim_complete,
2394 
2395 	/* new operations for NFSv4.2 */
2396 	[OP_ALLOCATE]		= nfsd4_decode_fallocate,
2397 	[OP_COPY]		= nfsd4_decode_copy,
2398 	[OP_COPY_NOTIFY]	= nfsd4_decode_copy_notify,
2399 	[OP_DEALLOCATE]		= nfsd4_decode_fallocate,
2400 	[OP_IO_ADVISE]		= nfsd4_decode_notsupp,
2401 	[OP_LAYOUTERROR]	= nfsd4_decode_notsupp,
2402 	[OP_LAYOUTSTATS]	= nfsd4_decode_notsupp,
2403 	[OP_OFFLOAD_CANCEL]	= nfsd4_decode_offload_status,
2404 	[OP_OFFLOAD_STATUS]	= nfsd4_decode_offload_status,
2405 	[OP_READ_PLUS]		= nfsd4_decode_read,
2406 	[OP_SEEK]		= nfsd4_decode_seek,
2407 	[OP_WRITE_SAME]		= nfsd4_decode_notsupp,
2408 	[OP_CLONE]		= nfsd4_decode_clone,
2409 	/* RFC 8276 extended atributes operations */
2410 	[OP_GETXATTR]		= nfsd4_decode_getxattr,
2411 	[OP_SETXATTR]		= nfsd4_decode_setxattr,
2412 	[OP_LISTXATTRS]		= nfsd4_decode_listxattrs,
2413 	[OP_REMOVEXATTR]	= nfsd4_decode_removexattr,
2414 };
2415 
2416 static inline bool
2417 nfsd4_opnum_in_range(struct nfsd4_compoundargs *argp, struct nfsd4_op *op)
2418 {
2419 	if (op->opnum < FIRST_NFS4_OP)
2420 		return false;
2421 	else if (argp->minorversion == 0 && op->opnum > LAST_NFS40_OP)
2422 		return false;
2423 	else if (argp->minorversion == 1 && op->opnum > LAST_NFS41_OP)
2424 		return false;
2425 	else if (argp->minorversion == 2 && op->opnum > LAST_NFS42_OP)
2426 		return false;
2427 	return true;
2428 }
2429 
2430 static bool
2431 nfsd4_decode_compound(struct nfsd4_compoundargs *argp)
2432 {
2433 	struct nfsd4_op *op;
2434 	bool cachethis = false;
2435 	int auth_slack= argp->rqstp->rq_auth_slack;
2436 	int max_reply = auth_slack + 8; /* opcnt, status */
2437 	int readcount = 0;
2438 	int readbytes = 0;
2439 	__be32 *p;
2440 	int i;
2441 
2442 	if (xdr_stream_decode_u32(argp->xdr, &argp->taglen) < 0)
2443 		return false;
2444 	max_reply += XDR_UNIT;
2445 	argp->tag = NULL;
2446 	if (unlikely(argp->taglen)) {
2447 		if (argp->taglen > NFSD4_MAX_TAGLEN)
2448 			return false;
2449 		p = xdr_inline_decode(argp->xdr, argp->taglen);
2450 		if (!p)
2451 			return false;
2452 		argp->tag = svcxdr_savemem(argp, p, argp->taglen);
2453 		if (!argp->tag)
2454 			return false;
2455 		max_reply += xdr_align_size(argp->taglen);
2456 	}
2457 
2458 	if (xdr_stream_decode_u32(argp->xdr, &argp->minorversion) < 0)
2459 		return false;
2460 	if (xdr_stream_decode_u32(argp->xdr, &argp->client_opcnt) < 0)
2461 		return false;
2462 	argp->opcnt = min_t(u32, argp->client_opcnt,
2463 			    NFSD_MAX_OPS_PER_COMPOUND);
2464 
2465 	if (argp->opcnt > ARRAY_SIZE(argp->iops)) {
2466 		argp->ops = vcalloc(argp->opcnt, sizeof(*argp->ops));
2467 		if (!argp->ops) {
2468 			argp->ops = argp->iops;
2469 			return false;
2470 		}
2471 	}
2472 
2473 	if (argp->minorversion > NFSD_SUPPORTED_MINOR_VERSION)
2474 		argp->opcnt = 0;
2475 
2476 	for (i = 0; i < argp->opcnt; i++) {
2477 		op = &argp->ops[i];
2478 		op->replay = NULL;
2479 
2480 		if (xdr_stream_decode_u32(argp->xdr, &op->opnum) < 0)
2481 			return false;
2482 		if (nfsd4_opnum_in_range(argp, op)) {
2483 			op->status = nfsd4_dec_ops[op->opnum](argp, &op->u);
2484 			if (op->status != nfs_ok)
2485 				trace_nfsd_compound_decode_err(argp->rqstp,
2486 							       argp->opcnt, i,
2487 							       op->opnum,
2488 							       op->status);
2489 		} else {
2490 			op->opnum = OP_ILLEGAL;
2491 			op->status = nfserr_op_illegal;
2492 		}
2493 		op->opdesc = OPDESC(op);
2494 		/*
2495 		 * We'll try to cache the result in the DRC if any one
2496 		 * op in the compound wants to be cached:
2497 		 */
2498 		cachethis |= nfsd4_cache_this_op(op);
2499 
2500 		if (op->opnum == OP_READ || op->opnum == OP_READ_PLUS) {
2501 			readcount++;
2502 			readbytes += nfsd4_max_reply(argp->rqstp, op);
2503 		} else
2504 			max_reply += nfsd4_max_reply(argp->rqstp, op);
2505 		/*
2506 		 * OP_LOCK and OP_LOCKT may return a conflicting lock.
2507 		 * (Special case because it will just skip encoding this
2508 		 * if it runs out of xdr buffer space, and it is the only
2509 		 * operation that behaves this way.)
2510 		 */
2511 		if (op->opnum == OP_LOCK || op->opnum == OP_LOCKT)
2512 			max_reply += NFS4_OPAQUE_LIMIT;
2513 
2514 		if (op->status) {
2515 			argp->opcnt = i+1;
2516 			break;
2517 		}
2518 	}
2519 	/* Sessions make the DRC unnecessary: */
2520 	if (argp->minorversion)
2521 		cachethis = false;
2522 	svc_reserve(argp->rqstp, max_reply + readbytes);
2523 	argp->rqstp->rq_cachetype = cachethis ? RC_REPLBUFF : RC_NOCACHE;
2524 
2525 	if (readcount > 1 || max_reply > PAGE_SIZE - auth_slack)
2526 		clear_bit(RQ_SPLICE_OK, &argp->rqstp->rq_flags);
2527 
2528 	return true;
2529 }
2530 
2531 static __be32 *encode_change(__be32 *p, struct kstat *stat, struct inode *inode,
2532 			     struct svc_export *exp)
2533 {
2534 	if (exp->ex_flags & NFSEXP_V4ROOT) {
2535 		*p++ = cpu_to_be32(convert_to_wallclock(exp->cd->flush_time));
2536 		*p++ = 0;
2537 	} else
2538 		p = xdr_encode_hyper(p, nfsd4_change_attribute(stat, inode));
2539 	return p;
2540 }
2541 
2542 /*
2543  * ctime (in NFSv4, time_metadata) is not writeable, and the client
2544  * doesn't really care what resolution could theoretically be stored by
2545  * the filesystem.
2546  *
2547  * The client cares how close together changes can be while still
2548  * guaranteeing ctime changes.  For most filesystems (which have
2549  * timestamps with nanosecond fields) that is limited by the resolution
2550  * of the time returned from current_time() (which I'm assuming to be
2551  * 1/HZ).
2552  */
2553 static __be32 *encode_time_delta(__be32 *p, struct inode *inode)
2554 {
2555 	struct timespec64 ts;
2556 	u32 ns;
2557 
2558 	ns = max_t(u32, NSEC_PER_SEC/HZ, inode->i_sb->s_time_gran);
2559 	ts = ns_to_timespec64(ns);
2560 
2561 	p = xdr_encode_hyper(p, ts.tv_sec);
2562 	*p++ = cpu_to_be32(ts.tv_nsec);
2563 
2564 	return p;
2565 }
2566 
2567 static __be32 *encode_cinfo(__be32 *p, struct nfsd4_change_info *c)
2568 {
2569 	*p++ = cpu_to_be32(c->atomic);
2570 	p = xdr_encode_hyper(p, c->before_change);
2571 	p = xdr_encode_hyper(p, c->after_change);
2572 	return p;
2573 }
2574 
2575 /* Encode as an array of strings the string given with components
2576  * separated @sep, escaped with esc_enter and esc_exit.
2577  */
2578 static __be32 nfsd4_encode_components_esc(struct xdr_stream *xdr, char sep,
2579 					  char *components, char esc_enter,
2580 					  char esc_exit)
2581 {
2582 	__be32 *p;
2583 	__be32 pathlen;
2584 	int pathlen_offset;
2585 	int strlen, count=0;
2586 	char *str, *end, *next;
2587 
2588 	dprintk("nfsd4_encode_components(%s)\n", components);
2589 
2590 	pathlen_offset = xdr->buf->len;
2591 	p = xdr_reserve_space(xdr, 4);
2592 	if (!p)
2593 		return nfserr_resource;
2594 	p++; /* We will fill this in with @count later */
2595 
2596 	end = str = components;
2597 	while (*end) {
2598 		bool found_esc = false;
2599 
2600 		/* try to parse as esc_start, ..., esc_end, sep */
2601 		if (*str == esc_enter) {
2602 			for (; *end && (*end != esc_exit); end++)
2603 				/* find esc_exit or end of string */;
2604 			next = end + 1;
2605 			if (*end && (!*next || *next == sep)) {
2606 				str++;
2607 				found_esc = true;
2608 			}
2609 		}
2610 
2611 		if (!found_esc)
2612 			for (; *end && (*end != sep); end++)
2613 				/* find sep or end of string */;
2614 
2615 		strlen = end - str;
2616 		if (strlen) {
2617 			p = xdr_reserve_space(xdr, strlen + 4);
2618 			if (!p)
2619 				return nfserr_resource;
2620 			p = xdr_encode_opaque(p, str, strlen);
2621 			count++;
2622 		}
2623 		else
2624 			end++;
2625 		if (found_esc)
2626 			end = next;
2627 
2628 		str = end;
2629 	}
2630 	pathlen = htonl(count);
2631 	write_bytes_to_xdr_buf(xdr->buf, pathlen_offset, &pathlen, 4);
2632 	return 0;
2633 }
2634 
2635 /* Encode as an array of strings the string given with components
2636  * separated @sep.
2637  */
2638 static __be32 nfsd4_encode_components(struct xdr_stream *xdr, char sep,
2639 				      char *components)
2640 {
2641 	return nfsd4_encode_components_esc(xdr, sep, components, 0, 0);
2642 }
2643 
2644 /*
2645  * encode a location element of a fs_locations structure
2646  */
2647 static __be32 nfsd4_encode_fs_location4(struct xdr_stream *xdr,
2648 					struct nfsd4_fs_location *location)
2649 {
2650 	__be32 status;
2651 
2652 	status = nfsd4_encode_components_esc(xdr, ':', location->hosts,
2653 						'[', ']');
2654 	if (status)
2655 		return status;
2656 	status = nfsd4_encode_components(xdr, '/', location->path);
2657 	if (status)
2658 		return status;
2659 	return 0;
2660 }
2661 
2662 /*
2663  * Encode a path in RFC3530 'pathname4' format
2664  */
2665 static __be32 nfsd4_encode_path(struct xdr_stream *xdr,
2666 				const struct path *root,
2667 				const struct path *path)
2668 {
2669 	struct path cur = *path;
2670 	__be32 *p;
2671 	struct dentry **components = NULL;
2672 	unsigned int ncomponents = 0;
2673 	__be32 err = nfserr_jukebox;
2674 
2675 	dprintk("nfsd4_encode_components(");
2676 
2677 	path_get(&cur);
2678 	/* First walk the path up to the nfsd root, and store the
2679 	 * dentries/path components in an array.
2680 	 */
2681 	for (;;) {
2682 		if (path_equal(&cur, root))
2683 			break;
2684 		if (cur.dentry == cur.mnt->mnt_root) {
2685 			if (follow_up(&cur))
2686 				continue;
2687 			goto out_free;
2688 		}
2689 		if ((ncomponents & 15) == 0) {
2690 			struct dentry **new;
2691 			new = krealloc(components,
2692 					sizeof(*new) * (ncomponents + 16),
2693 					GFP_KERNEL);
2694 			if (!new)
2695 				goto out_free;
2696 			components = new;
2697 		}
2698 		components[ncomponents++] = cur.dentry;
2699 		cur.dentry = dget_parent(cur.dentry);
2700 	}
2701 	err = nfserr_resource;
2702 	p = xdr_reserve_space(xdr, 4);
2703 	if (!p)
2704 		goto out_free;
2705 	*p++ = cpu_to_be32(ncomponents);
2706 
2707 	while (ncomponents) {
2708 		struct dentry *dentry = components[ncomponents - 1];
2709 		unsigned int len;
2710 
2711 		spin_lock(&dentry->d_lock);
2712 		len = dentry->d_name.len;
2713 		p = xdr_reserve_space(xdr, len + 4);
2714 		if (!p) {
2715 			spin_unlock(&dentry->d_lock);
2716 			goto out_free;
2717 		}
2718 		p = xdr_encode_opaque(p, dentry->d_name.name, len);
2719 		dprintk("/%pd", dentry);
2720 		spin_unlock(&dentry->d_lock);
2721 		dput(dentry);
2722 		ncomponents--;
2723 	}
2724 
2725 	err = 0;
2726 out_free:
2727 	dprintk(")\n");
2728 	while (ncomponents)
2729 		dput(components[--ncomponents]);
2730 	kfree(components);
2731 	path_put(&cur);
2732 	return err;
2733 }
2734 
2735 static __be32 nfsd4_encode_fsloc_fsroot(struct xdr_stream *xdr,
2736 			struct svc_rqst *rqstp, const struct path *path)
2737 {
2738 	struct svc_export *exp_ps;
2739 	__be32 res;
2740 
2741 	exp_ps = rqst_find_fsidzero_export(rqstp);
2742 	if (IS_ERR(exp_ps))
2743 		return nfserrno(PTR_ERR(exp_ps));
2744 	res = nfsd4_encode_path(xdr, &exp_ps->ex_path, path);
2745 	exp_put(exp_ps);
2746 	return res;
2747 }
2748 
2749 /*
2750  *  encode a fs_locations structure
2751  */
2752 static __be32 nfsd4_encode_fs_locations(struct xdr_stream *xdr,
2753 			struct svc_rqst *rqstp, struct svc_export *exp)
2754 {
2755 	__be32 status;
2756 	int i;
2757 	__be32 *p;
2758 	struct nfsd4_fs_locations *fslocs = &exp->ex_fslocs;
2759 
2760 	status = nfsd4_encode_fsloc_fsroot(xdr, rqstp, &exp->ex_path);
2761 	if (status)
2762 		return status;
2763 	p = xdr_reserve_space(xdr, 4);
2764 	if (!p)
2765 		return nfserr_resource;
2766 	*p++ = cpu_to_be32(fslocs->locations_count);
2767 	for (i=0; i<fslocs->locations_count; i++) {
2768 		status = nfsd4_encode_fs_location4(xdr, &fslocs->locations[i]);
2769 		if (status)
2770 			return status;
2771 	}
2772 	return 0;
2773 }
2774 
2775 static u32 nfs4_file_type(umode_t mode)
2776 {
2777 	switch (mode & S_IFMT) {
2778 	case S_IFIFO:	return NF4FIFO;
2779 	case S_IFCHR:	return NF4CHR;
2780 	case S_IFDIR:	return NF4DIR;
2781 	case S_IFBLK:	return NF4BLK;
2782 	case S_IFLNK:	return NF4LNK;
2783 	case S_IFREG:	return NF4REG;
2784 	case S_IFSOCK:	return NF4SOCK;
2785 	default:	return NF4BAD;
2786 	}
2787 }
2788 
2789 static inline __be32
2790 nfsd4_encode_aclname(struct xdr_stream *xdr, struct svc_rqst *rqstp,
2791 		     struct nfs4_ace *ace)
2792 {
2793 	if (ace->whotype != NFS4_ACL_WHO_NAMED)
2794 		return nfs4_acl_write_who(xdr, ace->whotype);
2795 	else if (ace->flag & NFS4_ACE_IDENTIFIER_GROUP)
2796 		return nfsd4_encode_group(xdr, rqstp, ace->who_gid);
2797 	else
2798 		return nfsd4_encode_user(xdr, rqstp, ace->who_uid);
2799 }
2800 
2801 static inline __be32
2802 nfsd4_encode_layout_types(struct xdr_stream *xdr, u32 layout_types)
2803 {
2804 	__be32		*p;
2805 	unsigned long	i = hweight_long(layout_types);
2806 
2807 	p = xdr_reserve_space(xdr, 4 + 4 * i);
2808 	if (!p)
2809 		return nfserr_resource;
2810 
2811 	*p++ = cpu_to_be32(i);
2812 
2813 	for (i = LAYOUT_NFSV4_1_FILES; i < LAYOUT_TYPE_MAX; ++i)
2814 		if (layout_types & (1 << i))
2815 			*p++ = cpu_to_be32(i);
2816 
2817 	return 0;
2818 }
2819 
2820 #define WORD0_ABSENT_FS_ATTRS (FATTR4_WORD0_FS_LOCATIONS | FATTR4_WORD0_FSID | \
2821 			      FATTR4_WORD0_RDATTR_ERROR)
2822 #define WORD1_ABSENT_FS_ATTRS FATTR4_WORD1_MOUNTED_ON_FILEID
2823 #define WORD2_ABSENT_FS_ATTRS 0
2824 
2825 #ifdef CONFIG_NFSD_V4_SECURITY_LABEL
2826 static inline __be32
2827 nfsd4_encode_security_label(struct xdr_stream *xdr, struct svc_rqst *rqstp,
2828 			    void *context, int len)
2829 {
2830 	__be32 *p;
2831 
2832 	p = xdr_reserve_space(xdr, len + 4 + 4 + 4);
2833 	if (!p)
2834 		return nfserr_resource;
2835 
2836 	/*
2837 	 * For now we use a 0 here to indicate the null translation; in
2838 	 * the future we may place a call to translation code here.
2839 	 */
2840 	*p++ = cpu_to_be32(0); /* lfs */
2841 	*p++ = cpu_to_be32(0); /* pi */
2842 	p = xdr_encode_opaque(p, context, len);
2843 	return 0;
2844 }
2845 #else
2846 static inline __be32
2847 nfsd4_encode_security_label(struct xdr_stream *xdr, struct svc_rqst *rqstp,
2848 			    void *context, int len)
2849 { return 0; }
2850 #endif
2851 
2852 static __be32 fattr_handle_absent_fs(u32 *bmval0, u32 *bmval1, u32 *bmval2, u32 *rdattr_err)
2853 {
2854 	/* As per referral draft:  */
2855 	if (*bmval0 & ~WORD0_ABSENT_FS_ATTRS ||
2856 	    *bmval1 & ~WORD1_ABSENT_FS_ATTRS) {
2857 		if (*bmval0 & FATTR4_WORD0_RDATTR_ERROR ||
2858 	            *bmval0 & FATTR4_WORD0_FS_LOCATIONS)
2859 			*rdattr_err = NFSERR_MOVED;
2860 		else
2861 			return nfserr_moved;
2862 	}
2863 	*bmval0 &= WORD0_ABSENT_FS_ATTRS;
2864 	*bmval1 &= WORD1_ABSENT_FS_ATTRS;
2865 	*bmval2 &= WORD2_ABSENT_FS_ATTRS;
2866 	return 0;
2867 }
2868 
2869 
2870 static int nfsd4_get_mounted_on_ino(struct svc_export *exp, u64 *pino)
2871 {
2872 	struct path path = exp->ex_path;
2873 	struct kstat stat;
2874 	int err;
2875 
2876 	path_get(&path);
2877 	while (follow_up(&path)) {
2878 		if (path.dentry != path.mnt->mnt_root)
2879 			break;
2880 	}
2881 	err = vfs_getattr(&path, &stat, STATX_INO, AT_STATX_SYNC_AS_STAT);
2882 	path_put(&path);
2883 	if (!err)
2884 		*pino = stat.ino;
2885 	return err;
2886 }
2887 
2888 static __be32
2889 nfsd4_encode_bitmap(struct xdr_stream *xdr, u32 bmval0, u32 bmval1, u32 bmval2)
2890 {
2891 	__be32 *p;
2892 
2893 	if (bmval2) {
2894 		p = xdr_reserve_space(xdr, 16);
2895 		if (!p)
2896 			goto out_resource;
2897 		*p++ = cpu_to_be32(3);
2898 		*p++ = cpu_to_be32(bmval0);
2899 		*p++ = cpu_to_be32(bmval1);
2900 		*p++ = cpu_to_be32(bmval2);
2901 	} else if (bmval1) {
2902 		p = xdr_reserve_space(xdr, 12);
2903 		if (!p)
2904 			goto out_resource;
2905 		*p++ = cpu_to_be32(2);
2906 		*p++ = cpu_to_be32(bmval0);
2907 		*p++ = cpu_to_be32(bmval1);
2908 	} else {
2909 		p = xdr_reserve_space(xdr, 8);
2910 		if (!p)
2911 			goto out_resource;
2912 		*p++ = cpu_to_be32(1);
2913 		*p++ = cpu_to_be32(bmval0);
2914 	}
2915 
2916 	return 0;
2917 out_resource:
2918 	return nfserr_resource;
2919 }
2920 
2921 /*
2922  * Note: @fhp can be NULL; in this case, we might have to compose the filehandle
2923  * ourselves.
2924  */
2925 static __be32
2926 nfsd4_encode_fattr(struct xdr_stream *xdr, struct svc_fh *fhp,
2927 		struct svc_export *exp,
2928 		struct dentry *dentry, u32 *bmval,
2929 		struct svc_rqst *rqstp, int ignore_crossmnt)
2930 {
2931 	u32 bmval0 = bmval[0];
2932 	u32 bmval1 = bmval[1];
2933 	u32 bmval2 = bmval[2];
2934 	struct kstat stat;
2935 	struct svc_fh *tempfh = NULL;
2936 	struct kstatfs statfs;
2937 	__be32 *p, *attrlen_p;
2938 	int starting_len = xdr->buf->len;
2939 	int attrlen_offset;
2940 	u32 dummy;
2941 	u64 dummy64;
2942 	u32 rdattr_err = 0;
2943 	__be32 status;
2944 	int err;
2945 	struct nfs4_acl *acl = NULL;
2946 #ifdef CONFIG_NFSD_V4_SECURITY_LABEL
2947 	void *context = NULL;
2948 	int contextlen;
2949 #endif
2950 	bool contextsupport = false;
2951 	struct nfsd4_compoundres *resp = rqstp->rq_resp;
2952 	u32 minorversion = resp->cstate.minorversion;
2953 	struct path path = {
2954 		.mnt	= exp->ex_path.mnt,
2955 		.dentry	= dentry,
2956 	};
2957 	struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
2958 
2959 	BUG_ON(bmval1 & NFSD_WRITEONLY_ATTRS_WORD1);
2960 	BUG_ON(!nfsd_attrs_supported(minorversion, bmval));
2961 
2962 	if (exp->ex_fslocs.migrated) {
2963 		status = fattr_handle_absent_fs(&bmval0, &bmval1, &bmval2, &rdattr_err);
2964 		if (status)
2965 			goto out;
2966 	}
2967 
2968 	err = vfs_getattr(&path, &stat,
2969 			  STATX_BASIC_STATS | STATX_BTIME | STATX_CHANGE_COOKIE,
2970 			  AT_STATX_SYNC_AS_STAT);
2971 	if (err)
2972 		goto out_nfserr;
2973 	if (!(stat.result_mask & STATX_BTIME))
2974 		/* underlying FS does not offer btime so we can't share it */
2975 		bmval1 &= ~FATTR4_WORD1_TIME_CREATE;
2976 	if ((bmval0 & (FATTR4_WORD0_FILES_AVAIL | FATTR4_WORD0_FILES_FREE |
2977 			FATTR4_WORD0_FILES_TOTAL | FATTR4_WORD0_MAXNAME)) ||
2978 	    (bmval1 & (FATTR4_WORD1_SPACE_AVAIL | FATTR4_WORD1_SPACE_FREE |
2979 		       FATTR4_WORD1_SPACE_TOTAL))) {
2980 		err = vfs_statfs(&path, &statfs);
2981 		if (err)
2982 			goto out_nfserr;
2983 	}
2984 	if ((bmval0 & (FATTR4_WORD0_FILEHANDLE | FATTR4_WORD0_FSID)) && !fhp) {
2985 		tempfh = kmalloc(sizeof(struct svc_fh), GFP_KERNEL);
2986 		status = nfserr_jukebox;
2987 		if (!tempfh)
2988 			goto out;
2989 		fh_init(tempfh, NFS4_FHSIZE);
2990 		status = fh_compose(tempfh, exp, dentry, NULL);
2991 		if (status)
2992 			goto out;
2993 		fhp = tempfh;
2994 	}
2995 	if (bmval0 & FATTR4_WORD0_ACL) {
2996 		err = nfsd4_get_nfs4_acl(rqstp, dentry, &acl);
2997 		if (err == -EOPNOTSUPP)
2998 			bmval0 &= ~FATTR4_WORD0_ACL;
2999 		else if (err == -EINVAL) {
3000 			status = nfserr_attrnotsupp;
3001 			goto out;
3002 		} else if (err != 0)
3003 			goto out_nfserr;
3004 	}
3005 
3006 #ifdef CONFIG_NFSD_V4_SECURITY_LABEL
3007 	if ((bmval2 & FATTR4_WORD2_SECURITY_LABEL) ||
3008 	     bmval0 & FATTR4_WORD0_SUPPORTED_ATTRS) {
3009 		if (exp->ex_flags & NFSEXP_SECURITY_LABEL)
3010 			err = security_inode_getsecctx(d_inode(dentry),
3011 						&context, &contextlen);
3012 		else
3013 			err = -EOPNOTSUPP;
3014 		contextsupport = (err == 0);
3015 		if (bmval2 & FATTR4_WORD2_SECURITY_LABEL) {
3016 			if (err == -EOPNOTSUPP)
3017 				bmval2 &= ~FATTR4_WORD2_SECURITY_LABEL;
3018 			else if (err)
3019 				goto out_nfserr;
3020 		}
3021 	}
3022 #endif /* CONFIG_NFSD_V4_SECURITY_LABEL */
3023 
3024 	status = nfsd4_encode_bitmap(xdr, bmval0, bmval1, bmval2);
3025 	if (status)
3026 		goto out;
3027 
3028 	attrlen_offset = xdr->buf->len;
3029 	attrlen_p = xdr_reserve_space(xdr, XDR_UNIT);
3030 	if (!attrlen_p)
3031 		goto out_resource;
3032 
3033 	if (bmval0 & FATTR4_WORD0_SUPPORTED_ATTRS) {
3034 		u32 supp[3];
3035 
3036 		memcpy(supp, nfsd_suppattrs[minorversion], sizeof(supp));
3037 
3038 		if (!IS_POSIXACL(dentry->d_inode))
3039 			supp[0] &= ~FATTR4_WORD0_ACL;
3040 		if (!contextsupport)
3041 			supp[2] &= ~FATTR4_WORD2_SECURITY_LABEL;
3042 		if (!supp[2]) {
3043 			p = xdr_reserve_space(xdr, 12);
3044 			if (!p)
3045 				goto out_resource;
3046 			*p++ = cpu_to_be32(2);
3047 			*p++ = cpu_to_be32(supp[0]);
3048 			*p++ = cpu_to_be32(supp[1]);
3049 		} else {
3050 			p = xdr_reserve_space(xdr, 16);
3051 			if (!p)
3052 				goto out_resource;
3053 			*p++ = cpu_to_be32(3);
3054 			*p++ = cpu_to_be32(supp[0]);
3055 			*p++ = cpu_to_be32(supp[1]);
3056 			*p++ = cpu_to_be32(supp[2]);
3057 		}
3058 	}
3059 	if (bmval0 & FATTR4_WORD0_TYPE) {
3060 		p = xdr_reserve_space(xdr, 4);
3061 		if (!p)
3062 			goto out_resource;
3063 		dummy = nfs4_file_type(stat.mode);
3064 		if (dummy == NF4BAD) {
3065 			status = nfserr_serverfault;
3066 			goto out;
3067 		}
3068 		*p++ = cpu_to_be32(dummy);
3069 	}
3070 	if (bmval0 & FATTR4_WORD0_FH_EXPIRE_TYPE) {
3071 		p = xdr_reserve_space(xdr, 4);
3072 		if (!p)
3073 			goto out_resource;
3074 		if (exp->ex_flags & NFSEXP_NOSUBTREECHECK)
3075 			*p++ = cpu_to_be32(NFS4_FH_PERSISTENT);
3076 		else
3077 			*p++ = cpu_to_be32(NFS4_FH_PERSISTENT|
3078 						NFS4_FH_VOL_RENAME);
3079 	}
3080 	if (bmval0 & FATTR4_WORD0_CHANGE) {
3081 		p = xdr_reserve_space(xdr, 8);
3082 		if (!p)
3083 			goto out_resource;
3084 		p = encode_change(p, &stat, d_inode(dentry), exp);
3085 	}
3086 	if (bmval0 & FATTR4_WORD0_SIZE) {
3087 		p = xdr_reserve_space(xdr, 8);
3088 		if (!p)
3089 			goto out_resource;
3090 		p = xdr_encode_hyper(p, stat.size);
3091 	}
3092 	if (bmval0 & FATTR4_WORD0_LINK_SUPPORT) {
3093 		p = xdr_reserve_space(xdr, 4);
3094 		if (!p)
3095 			goto out_resource;
3096 		*p++ = cpu_to_be32(1);
3097 	}
3098 	if (bmval0 & FATTR4_WORD0_SYMLINK_SUPPORT) {
3099 		p = xdr_reserve_space(xdr, 4);
3100 		if (!p)
3101 			goto out_resource;
3102 		*p++ = cpu_to_be32(1);
3103 	}
3104 	if (bmval0 & FATTR4_WORD0_NAMED_ATTR) {
3105 		p = xdr_reserve_space(xdr, 4);
3106 		if (!p)
3107 			goto out_resource;
3108 		*p++ = cpu_to_be32(0);
3109 	}
3110 	if (bmval0 & FATTR4_WORD0_FSID) {
3111 		p = xdr_reserve_space(xdr, 16);
3112 		if (!p)
3113 			goto out_resource;
3114 		if (exp->ex_fslocs.migrated) {
3115 			p = xdr_encode_hyper(p, NFS4_REFERRAL_FSID_MAJOR);
3116 			p = xdr_encode_hyper(p, NFS4_REFERRAL_FSID_MINOR);
3117 		} else switch(fsid_source(fhp)) {
3118 		case FSIDSOURCE_FSID:
3119 			p = xdr_encode_hyper(p, (u64)exp->ex_fsid);
3120 			p = xdr_encode_hyper(p, (u64)0);
3121 			break;
3122 		case FSIDSOURCE_DEV:
3123 			*p++ = cpu_to_be32(0);
3124 			*p++ = cpu_to_be32(MAJOR(stat.dev));
3125 			*p++ = cpu_to_be32(0);
3126 			*p++ = cpu_to_be32(MINOR(stat.dev));
3127 			break;
3128 		case FSIDSOURCE_UUID:
3129 			p = xdr_encode_opaque_fixed(p, exp->ex_uuid,
3130 								EX_UUID_LEN);
3131 			break;
3132 		}
3133 	}
3134 	if (bmval0 & FATTR4_WORD0_UNIQUE_HANDLES) {
3135 		p = xdr_reserve_space(xdr, 4);
3136 		if (!p)
3137 			goto out_resource;
3138 		*p++ = cpu_to_be32(0);
3139 	}
3140 	if (bmval0 & FATTR4_WORD0_LEASE_TIME) {
3141 		p = xdr_reserve_space(xdr, 4);
3142 		if (!p)
3143 			goto out_resource;
3144 		*p++ = cpu_to_be32(nn->nfsd4_lease);
3145 	}
3146 	if (bmval0 & FATTR4_WORD0_RDATTR_ERROR) {
3147 		p = xdr_reserve_space(xdr, 4);
3148 		if (!p)
3149 			goto out_resource;
3150 		*p++ = cpu_to_be32(rdattr_err);
3151 	}
3152 	if (bmval0 & FATTR4_WORD0_ACL) {
3153 		struct nfs4_ace *ace;
3154 
3155 		if (acl == NULL) {
3156 			p = xdr_reserve_space(xdr, 4);
3157 			if (!p)
3158 				goto out_resource;
3159 
3160 			*p++ = cpu_to_be32(0);
3161 			goto out_acl;
3162 		}
3163 		p = xdr_reserve_space(xdr, 4);
3164 		if (!p)
3165 			goto out_resource;
3166 		*p++ = cpu_to_be32(acl->naces);
3167 
3168 		for (ace = acl->aces; ace < acl->aces + acl->naces; ace++) {
3169 			p = xdr_reserve_space(xdr, 4*3);
3170 			if (!p)
3171 				goto out_resource;
3172 			*p++ = cpu_to_be32(ace->type);
3173 			*p++ = cpu_to_be32(ace->flag);
3174 			*p++ = cpu_to_be32(ace->access_mask &
3175 							NFS4_ACE_MASK_ALL);
3176 			status = nfsd4_encode_aclname(xdr, rqstp, ace);
3177 			if (status)
3178 				goto out;
3179 		}
3180 	}
3181 out_acl:
3182 	if (bmval0 & FATTR4_WORD0_ACLSUPPORT) {
3183 		p = xdr_reserve_space(xdr, 4);
3184 		if (!p)
3185 			goto out_resource;
3186 		*p++ = cpu_to_be32(IS_POSIXACL(dentry->d_inode) ?
3187 			ACL4_SUPPORT_ALLOW_ACL|ACL4_SUPPORT_DENY_ACL : 0);
3188 	}
3189 	if (bmval0 & FATTR4_WORD0_CANSETTIME) {
3190 		p = xdr_reserve_space(xdr, 4);
3191 		if (!p)
3192 			goto out_resource;
3193 		*p++ = cpu_to_be32(1);
3194 	}
3195 	if (bmval0 & FATTR4_WORD0_CASE_INSENSITIVE) {
3196 		p = xdr_reserve_space(xdr, 4);
3197 		if (!p)
3198 			goto out_resource;
3199 		*p++ = cpu_to_be32(0);
3200 	}
3201 	if (bmval0 & FATTR4_WORD0_CASE_PRESERVING) {
3202 		p = xdr_reserve_space(xdr, 4);
3203 		if (!p)
3204 			goto out_resource;
3205 		*p++ = cpu_to_be32(1);
3206 	}
3207 	if (bmval0 & FATTR4_WORD0_CHOWN_RESTRICTED) {
3208 		p = xdr_reserve_space(xdr, 4);
3209 		if (!p)
3210 			goto out_resource;
3211 		*p++ = cpu_to_be32(1);
3212 	}
3213 	if (bmval0 & FATTR4_WORD0_FILEHANDLE) {
3214 		p = xdr_reserve_space(xdr, fhp->fh_handle.fh_size + 4);
3215 		if (!p)
3216 			goto out_resource;
3217 		p = xdr_encode_opaque(p, &fhp->fh_handle.fh_raw,
3218 					fhp->fh_handle.fh_size);
3219 	}
3220 	if (bmval0 & FATTR4_WORD0_FILEID) {
3221 		p = xdr_reserve_space(xdr, 8);
3222 		if (!p)
3223 			goto out_resource;
3224 		p = xdr_encode_hyper(p, stat.ino);
3225 	}
3226 	if (bmval0 & FATTR4_WORD0_FILES_AVAIL) {
3227 		p = xdr_reserve_space(xdr, 8);
3228 		if (!p)
3229 			goto out_resource;
3230 		p = xdr_encode_hyper(p, (u64) statfs.f_ffree);
3231 	}
3232 	if (bmval0 & FATTR4_WORD0_FILES_FREE) {
3233 		p = xdr_reserve_space(xdr, 8);
3234 		if (!p)
3235 			goto out_resource;
3236 		p = xdr_encode_hyper(p, (u64) statfs.f_ffree);
3237 	}
3238 	if (bmval0 & FATTR4_WORD0_FILES_TOTAL) {
3239 		p = xdr_reserve_space(xdr, 8);
3240 		if (!p)
3241 			goto out_resource;
3242 		p = xdr_encode_hyper(p, (u64) statfs.f_files);
3243 	}
3244 	if (bmval0 & FATTR4_WORD0_FS_LOCATIONS) {
3245 		status = nfsd4_encode_fs_locations(xdr, rqstp, exp);
3246 		if (status)
3247 			goto out;
3248 	}
3249 	if (bmval0 & FATTR4_WORD0_HOMOGENEOUS) {
3250 		p = xdr_reserve_space(xdr, 4);
3251 		if (!p)
3252 			goto out_resource;
3253 		*p++ = cpu_to_be32(1);
3254 	}
3255 	if (bmval0 & FATTR4_WORD0_MAXFILESIZE) {
3256 		p = xdr_reserve_space(xdr, 8);
3257 		if (!p)
3258 			goto out_resource;
3259 		p = xdr_encode_hyper(p, exp->ex_path.mnt->mnt_sb->s_maxbytes);
3260 	}
3261 	if (bmval0 & FATTR4_WORD0_MAXLINK) {
3262 		p = xdr_reserve_space(xdr, 4);
3263 		if (!p)
3264 			goto out_resource;
3265 		*p++ = cpu_to_be32(255);
3266 	}
3267 	if (bmval0 & FATTR4_WORD0_MAXNAME) {
3268 		p = xdr_reserve_space(xdr, 4);
3269 		if (!p)
3270 			goto out_resource;
3271 		*p++ = cpu_to_be32(statfs.f_namelen);
3272 	}
3273 	if (bmval0 & FATTR4_WORD0_MAXREAD) {
3274 		p = xdr_reserve_space(xdr, 8);
3275 		if (!p)
3276 			goto out_resource;
3277 		p = xdr_encode_hyper(p, (u64) svc_max_payload(rqstp));
3278 	}
3279 	if (bmval0 & FATTR4_WORD0_MAXWRITE) {
3280 		p = xdr_reserve_space(xdr, 8);
3281 		if (!p)
3282 			goto out_resource;
3283 		p = xdr_encode_hyper(p, (u64) svc_max_payload(rqstp));
3284 	}
3285 	if (bmval1 & FATTR4_WORD1_MODE) {
3286 		p = xdr_reserve_space(xdr, 4);
3287 		if (!p)
3288 			goto out_resource;
3289 		*p++ = cpu_to_be32(stat.mode & S_IALLUGO);
3290 	}
3291 	if (bmval1 & FATTR4_WORD1_NO_TRUNC) {
3292 		p = xdr_reserve_space(xdr, 4);
3293 		if (!p)
3294 			goto out_resource;
3295 		*p++ = cpu_to_be32(1);
3296 	}
3297 	if (bmval1 & FATTR4_WORD1_NUMLINKS) {
3298 		p = xdr_reserve_space(xdr, 4);
3299 		if (!p)
3300 			goto out_resource;
3301 		*p++ = cpu_to_be32(stat.nlink);
3302 	}
3303 	if (bmval1 & FATTR4_WORD1_OWNER) {
3304 		status = nfsd4_encode_user(xdr, rqstp, stat.uid);
3305 		if (status)
3306 			goto out;
3307 	}
3308 	if (bmval1 & FATTR4_WORD1_OWNER_GROUP) {
3309 		status = nfsd4_encode_group(xdr, rqstp, stat.gid);
3310 		if (status)
3311 			goto out;
3312 	}
3313 	if (bmval1 & FATTR4_WORD1_RAWDEV) {
3314 		p = xdr_reserve_space(xdr, 8);
3315 		if (!p)
3316 			goto out_resource;
3317 		*p++ = cpu_to_be32((u32) MAJOR(stat.rdev));
3318 		*p++ = cpu_to_be32((u32) MINOR(stat.rdev));
3319 	}
3320 	if (bmval1 & FATTR4_WORD1_SPACE_AVAIL) {
3321 		p = xdr_reserve_space(xdr, 8);
3322 		if (!p)
3323 			goto out_resource;
3324 		dummy64 = (u64)statfs.f_bavail * (u64)statfs.f_bsize;
3325 		p = xdr_encode_hyper(p, dummy64);
3326 	}
3327 	if (bmval1 & FATTR4_WORD1_SPACE_FREE) {
3328 		p = xdr_reserve_space(xdr, 8);
3329 		if (!p)
3330 			goto out_resource;
3331 		dummy64 = (u64)statfs.f_bfree * (u64)statfs.f_bsize;
3332 		p = xdr_encode_hyper(p, dummy64);
3333 	}
3334 	if (bmval1 & FATTR4_WORD1_SPACE_TOTAL) {
3335 		p = xdr_reserve_space(xdr, 8);
3336 		if (!p)
3337 			goto out_resource;
3338 		dummy64 = (u64)statfs.f_blocks * (u64)statfs.f_bsize;
3339 		p = xdr_encode_hyper(p, dummy64);
3340 	}
3341 	if (bmval1 & FATTR4_WORD1_SPACE_USED) {
3342 		p = xdr_reserve_space(xdr, 8);
3343 		if (!p)
3344 			goto out_resource;
3345 		dummy64 = (u64)stat.blocks << 9;
3346 		p = xdr_encode_hyper(p, dummy64);
3347 	}
3348 	if (bmval1 & FATTR4_WORD1_TIME_ACCESS) {
3349 		p = xdr_reserve_space(xdr, 12);
3350 		if (!p)
3351 			goto out_resource;
3352 		p = xdr_encode_hyper(p, (s64)stat.atime.tv_sec);
3353 		*p++ = cpu_to_be32(stat.atime.tv_nsec);
3354 	}
3355 	if (bmval1 & FATTR4_WORD1_TIME_DELTA) {
3356 		p = xdr_reserve_space(xdr, 12);
3357 		if (!p)
3358 			goto out_resource;
3359 		p = encode_time_delta(p, d_inode(dentry));
3360 	}
3361 	if (bmval1 & FATTR4_WORD1_TIME_METADATA) {
3362 		p = xdr_reserve_space(xdr, 12);
3363 		if (!p)
3364 			goto out_resource;
3365 		p = xdr_encode_hyper(p, (s64)stat.ctime.tv_sec);
3366 		*p++ = cpu_to_be32(stat.ctime.tv_nsec);
3367 	}
3368 	if (bmval1 & FATTR4_WORD1_TIME_MODIFY) {
3369 		p = xdr_reserve_space(xdr, 12);
3370 		if (!p)
3371 			goto out_resource;
3372 		p = xdr_encode_hyper(p, (s64)stat.mtime.tv_sec);
3373 		*p++ = cpu_to_be32(stat.mtime.tv_nsec);
3374 	}
3375 	if (bmval1 & FATTR4_WORD1_TIME_CREATE) {
3376 		p = xdr_reserve_space(xdr, 12);
3377 		if (!p)
3378 			goto out_resource;
3379 		p = xdr_encode_hyper(p, (s64)stat.btime.tv_sec);
3380 		*p++ = cpu_to_be32(stat.btime.tv_nsec);
3381 	}
3382 	if (bmval1 & FATTR4_WORD1_MOUNTED_ON_FILEID) {
3383 		u64 ino = stat.ino;
3384 
3385 		p = xdr_reserve_space(xdr, 8);
3386 		if (!p)
3387                 	goto out_resource;
3388 		/*
3389 		 * Get ino of mountpoint in parent filesystem, if not ignoring
3390 		 * crossmount and this is the root of a cross-mounted
3391 		 * filesystem.
3392 		 */
3393 		if (ignore_crossmnt == 0 &&
3394 		    dentry == exp->ex_path.mnt->mnt_root) {
3395 			err = nfsd4_get_mounted_on_ino(exp, &ino);
3396 			if (err)
3397 				goto out_nfserr;
3398 		}
3399 		p = xdr_encode_hyper(p, ino);
3400 	}
3401 #ifdef CONFIG_NFSD_PNFS
3402 	if (bmval1 & FATTR4_WORD1_FS_LAYOUT_TYPES) {
3403 		status = nfsd4_encode_layout_types(xdr, exp->ex_layout_types);
3404 		if (status)
3405 			goto out;
3406 	}
3407 
3408 	if (bmval2 & FATTR4_WORD2_LAYOUT_TYPES) {
3409 		status = nfsd4_encode_layout_types(xdr, exp->ex_layout_types);
3410 		if (status)
3411 			goto out;
3412 	}
3413 
3414 	if (bmval2 & FATTR4_WORD2_LAYOUT_BLKSIZE) {
3415 		p = xdr_reserve_space(xdr, 4);
3416 		if (!p)
3417 			goto out_resource;
3418 		*p++ = cpu_to_be32(stat.blksize);
3419 	}
3420 #endif /* CONFIG_NFSD_PNFS */
3421 	if (bmval2 & FATTR4_WORD2_SUPPATTR_EXCLCREAT) {
3422 		u32 supp[3];
3423 
3424 		memcpy(supp, nfsd_suppattrs[minorversion], sizeof(supp));
3425 		supp[0] &= NFSD_SUPPATTR_EXCLCREAT_WORD0;
3426 		supp[1] &= NFSD_SUPPATTR_EXCLCREAT_WORD1;
3427 		supp[2] &= NFSD_SUPPATTR_EXCLCREAT_WORD2;
3428 
3429 		status = nfsd4_encode_bitmap(xdr, supp[0], supp[1], supp[2]);
3430 		if (status)
3431 			goto out;
3432 	}
3433 
3434 #ifdef CONFIG_NFSD_V4_SECURITY_LABEL
3435 	if (bmval2 & FATTR4_WORD2_SECURITY_LABEL) {
3436 		status = nfsd4_encode_security_label(xdr, rqstp, context,
3437 								contextlen);
3438 		if (status)
3439 			goto out;
3440 	}
3441 #endif
3442 
3443 	if (bmval2 & FATTR4_WORD2_XATTR_SUPPORT) {
3444 		p = xdr_reserve_space(xdr, 4);
3445 		if (!p)
3446 			goto out_resource;
3447 		err = xattr_supported_namespace(d_inode(dentry),
3448 						XATTR_USER_PREFIX);
3449 		*p++ = cpu_to_be32(err == 0);
3450 	}
3451 
3452 	*attrlen_p = cpu_to_be32(xdr->buf->len - attrlen_offset - XDR_UNIT);
3453 	status = nfs_ok;
3454 
3455 out:
3456 #ifdef CONFIG_NFSD_V4_SECURITY_LABEL
3457 	if (context)
3458 		security_release_secctx(context, contextlen);
3459 #endif /* CONFIG_NFSD_V4_SECURITY_LABEL */
3460 	kfree(acl);
3461 	if (tempfh) {
3462 		fh_put(tempfh);
3463 		kfree(tempfh);
3464 	}
3465 	if (status)
3466 		xdr_truncate_encode(xdr, starting_len);
3467 	return status;
3468 out_nfserr:
3469 	status = nfserrno(err);
3470 	goto out;
3471 out_resource:
3472 	status = nfserr_resource;
3473 	goto out;
3474 }
3475 
3476 static void svcxdr_init_encode_from_buffer(struct xdr_stream *xdr,
3477 				struct xdr_buf *buf, __be32 *p, int bytes)
3478 {
3479 	xdr->scratch.iov_len = 0;
3480 	memset(buf, 0, sizeof(struct xdr_buf));
3481 	buf->head[0].iov_base = p;
3482 	buf->head[0].iov_len = 0;
3483 	buf->len = 0;
3484 	xdr->buf = buf;
3485 	xdr->iov = buf->head;
3486 	xdr->p = p;
3487 	xdr->end = (void *)p + bytes;
3488 	buf->buflen = bytes;
3489 }
3490 
3491 __be32 nfsd4_encode_fattr_to_buf(__be32 **p, int words,
3492 			struct svc_fh *fhp, struct svc_export *exp,
3493 			struct dentry *dentry, u32 *bmval,
3494 			struct svc_rqst *rqstp, int ignore_crossmnt)
3495 {
3496 	struct xdr_buf dummy;
3497 	struct xdr_stream xdr;
3498 	__be32 ret;
3499 
3500 	svcxdr_init_encode_from_buffer(&xdr, &dummy, *p, words << 2);
3501 	ret = nfsd4_encode_fattr(&xdr, fhp, exp, dentry, bmval, rqstp,
3502 							ignore_crossmnt);
3503 	*p = xdr.p;
3504 	return ret;
3505 }
3506 
3507 static inline int attributes_need_mount(u32 *bmval)
3508 {
3509 	if (bmval[0] & ~(FATTR4_WORD0_RDATTR_ERROR | FATTR4_WORD0_LEASE_TIME))
3510 		return 1;
3511 	if (bmval[1] & ~FATTR4_WORD1_MOUNTED_ON_FILEID)
3512 		return 1;
3513 	return 0;
3514 }
3515 
3516 static __be32
3517 nfsd4_encode_dirent_fattr(struct xdr_stream *xdr, struct nfsd4_readdir *cd,
3518 			const char *name, int namlen)
3519 {
3520 	struct svc_export *exp = cd->rd_fhp->fh_export;
3521 	struct dentry *dentry;
3522 	__be32 nfserr;
3523 	int ignore_crossmnt = 0;
3524 
3525 	dentry = lookup_positive_unlocked(name, cd->rd_fhp->fh_dentry, namlen);
3526 	if (IS_ERR(dentry))
3527 		return nfserrno(PTR_ERR(dentry));
3528 
3529 	exp_get(exp);
3530 	/*
3531 	 * In the case of a mountpoint, the client may be asking for
3532 	 * attributes that are only properties of the underlying filesystem
3533 	 * as opposed to the cross-mounted file system. In such a case,
3534 	 * we will not follow the cross mount and will fill the attribtutes
3535 	 * directly from the mountpoint dentry.
3536 	 */
3537 	if (nfsd_mountpoint(dentry, exp)) {
3538 		int err;
3539 
3540 		if (!(exp->ex_flags & NFSEXP_V4ROOT)
3541 				&& !attributes_need_mount(cd->rd_bmval)) {
3542 			ignore_crossmnt = 1;
3543 			goto out_encode;
3544 		}
3545 		/*
3546 		 * Why the heck aren't we just using nfsd_lookup??
3547 		 * Different "."/".." handling?  Something else?
3548 		 * At least, add a comment here to explain....
3549 		 */
3550 		err = nfsd_cross_mnt(cd->rd_rqstp, &dentry, &exp);
3551 		if (err) {
3552 			nfserr = nfserrno(err);
3553 			goto out_put;
3554 		}
3555 		nfserr = check_nfsd_access(exp, cd->rd_rqstp);
3556 		if (nfserr)
3557 			goto out_put;
3558 
3559 	}
3560 out_encode:
3561 	nfserr = nfsd4_encode_fattr(xdr, NULL, exp, dentry, cd->rd_bmval,
3562 					cd->rd_rqstp, ignore_crossmnt);
3563 out_put:
3564 	dput(dentry);
3565 	exp_put(exp);
3566 	return nfserr;
3567 }
3568 
3569 static __be32 *
3570 nfsd4_encode_rdattr_error(struct xdr_stream *xdr, __be32 nfserr)
3571 {
3572 	__be32 *p;
3573 
3574 	p = xdr_reserve_space(xdr, 20);
3575 	if (!p)
3576 		return NULL;
3577 	*p++ = htonl(2);
3578 	*p++ = htonl(FATTR4_WORD0_RDATTR_ERROR); /* bmval0 */
3579 	*p++ = htonl(0);			 /* bmval1 */
3580 
3581 	*p++ = htonl(4);     /* attribute length */
3582 	*p++ = nfserr;       /* no htonl */
3583 	return p;
3584 }
3585 
3586 static int
3587 nfsd4_encode_dirent(void *ccdv, const char *name, int namlen,
3588 		    loff_t offset, u64 ino, unsigned int d_type)
3589 {
3590 	struct readdir_cd *ccd = ccdv;
3591 	struct nfsd4_readdir *cd = container_of(ccd, struct nfsd4_readdir, common);
3592 	struct xdr_stream *xdr = cd->xdr;
3593 	int start_offset = xdr->buf->len;
3594 	int cookie_offset;
3595 	u32 name_and_cookie;
3596 	int entry_bytes;
3597 	__be32 nfserr = nfserr_toosmall;
3598 	__be64 wire_offset;
3599 	__be32 *p;
3600 
3601 	/* In nfsv4, "." and ".." never make it onto the wire.. */
3602 	if (name && isdotent(name, namlen)) {
3603 		cd->common.err = nfs_ok;
3604 		return 0;
3605 	}
3606 
3607 	if (cd->cookie_offset) {
3608 		wire_offset = cpu_to_be64(offset);
3609 		write_bytes_to_xdr_buf(xdr->buf, cd->cookie_offset,
3610 							&wire_offset, 8);
3611 	}
3612 
3613 	p = xdr_reserve_space(xdr, 4);
3614 	if (!p)
3615 		goto fail;
3616 	*p++ = xdr_one;                             /* mark entry present */
3617 	cookie_offset = xdr->buf->len;
3618 	p = xdr_reserve_space(xdr, 3*4 + namlen);
3619 	if (!p)
3620 		goto fail;
3621 	p = xdr_encode_hyper(p, OFFSET_MAX);        /* offset of next entry */
3622 	p = xdr_encode_array(p, name, namlen);      /* name length & name */
3623 
3624 	nfserr = nfsd4_encode_dirent_fattr(xdr, cd, name, namlen);
3625 	switch (nfserr) {
3626 	case nfs_ok:
3627 		break;
3628 	case nfserr_resource:
3629 		nfserr = nfserr_toosmall;
3630 		goto fail;
3631 	case nfserr_noent:
3632 		xdr_truncate_encode(xdr, start_offset);
3633 		goto skip_entry;
3634 	case nfserr_jukebox:
3635 		/*
3636 		 * The pseudoroot should only display dentries that lead to
3637 		 * exports. If we get EJUKEBOX here, then we can't tell whether
3638 		 * this entry should be included. Just fail the whole READDIR
3639 		 * with NFS4ERR_DELAY in that case, and hope that the situation
3640 		 * will resolve itself by the client's next attempt.
3641 		 */
3642 		if (cd->rd_fhp->fh_export->ex_flags & NFSEXP_V4ROOT)
3643 			goto fail;
3644 		fallthrough;
3645 	default:
3646 		/*
3647 		 * If the client requested the RDATTR_ERROR attribute,
3648 		 * we stuff the error code into this attribute
3649 		 * and continue.  If this attribute was not requested,
3650 		 * then in accordance with the spec, we fail the
3651 		 * entire READDIR operation(!)
3652 		 */
3653 		if (!(cd->rd_bmval[0] & FATTR4_WORD0_RDATTR_ERROR))
3654 			goto fail;
3655 		p = nfsd4_encode_rdattr_error(xdr, nfserr);
3656 		if (p == NULL) {
3657 			nfserr = nfserr_toosmall;
3658 			goto fail;
3659 		}
3660 	}
3661 	nfserr = nfserr_toosmall;
3662 	entry_bytes = xdr->buf->len - start_offset;
3663 	if (entry_bytes > cd->rd_maxcount)
3664 		goto fail;
3665 	cd->rd_maxcount -= entry_bytes;
3666 	/*
3667 	 * RFC 3530 14.2.24 describes rd_dircount as only a "hint", and
3668 	 * notes that it could be zero. If it is zero, then the server
3669 	 * should enforce only the rd_maxcount value.
3670 	 */
3671 	if (cd->rd_dircount) {
3672 		name_and_cookie = 4 + 4 * XDR_QUADLEN(namlen) + 8;
3673 		if (name_and_cookie > cd->rd_dircount && cd->cookie_offset)
3674 			goto fail;
3675 		cd->rd_dircount -= min(cd->rd_dircount, name_and_cookie);
3676 		if (!cd->rd_dircount)
3677 			cd->rd_maxcount = 0;
3678 	}
3679 
3680 	cd->cookie_offset = cookie_offset;
3681 skip_entry:
3682 	cd->common.err = nfs_ok;
3683 	return 0;
3684 fail:
3685 	xdr_truncate_encode(xdr, start_offset);
3686 	cd->common.err = nfserr;
3687 	return -EINVAL;
3688 }
3689 
3690 static __be32
3691 nfsd4_encode_stateid(struct xdr_stream *xdr, stateid_t *sid)
3692 {
3693 	__be32 *p;
3694 
3695 	p = xdr_reserve_space(xdr, sizeof(stateid_t));
3696 	if (!p)
3697 		return nfserr_resource;
3698 	*p++ = cpu_to_be32(sid->si_generation);
3699 	p = xdr_encode_opaque_fixed(p, &sid->si_opaque,
3700 					sizeof(stateid_opaque_t));
3701 	return 0;
3702 }
3703 
3704 static __be32
3705 nfsd4_encode_access(struct nfsd4_compoundres *resp, __be32 nfserr,
3706 		    union nfsd4_op_u *u)
3707 {
3708 	struct nfsd4_access *access = &u->access;
3709 	struct xdr_stream *xdr = resp->xdr;
3710 	__be32 *p;
3711 
3712 	p = xdr_reserve_space(xdr, 8);
3713 	if (!p)
3714 		return nfserr_resource;
3715 	*p++ = cpu_to_be32(access->ac_supported);
3716 	*p++ = cpu_to_be32(access->ac_resp_access);
3717 	return 0;
3718 }
3719 
3720 static __be32 nfsd4_encode_bind_conn_to_session(struct nfsd4_compoundres *resp, __be32 nfserr,
3721 						union nfsd4_op_u *u)
3722 {
3723 	struct nfsd4_bind_conn_to_session *bcts = &u->bind_conn_to_session;
3724 	struct xdr_stream *xdr = resp->xdr;
3725 	__be32 *p;
3726 
3727 	p = xdr_reserve_space(xdr, NFS4_MAX_SESSIONID_LEN + 8);
3728 	if (!p)
3729 		return nfserr_resource;
3730 	p = xdr_encode_opaque_fixed(p, bcts->sessionid.data,
3731 					NFS4_MAX_SESSIONID_LEN);
3732 	*p++ = cpu_to_be32(bcts->dir);
3733 	/* Upshifting from TCP to RDMA is not supported */
3734 	*p++ = cpu_to_be32(0);
3735 	return 0;
3736 }
3737 
3738 static __be32
3739 nfsd4_encode_close(struct nfsd4_compoundres *resp, __be32 nfserr,
3740 		   union nfsd4_op_u *u)
3741 {
3742 	struct nfsd4_close *close = &u->close;
3743 	struct xdr_stream *xdr = resp->xdr;
3744 
3745 	return nfsd4_encode_stateid(xdr, &close->cl_stateid);
3746 }
3747 
3748 
3749 static __be32
3750 nfsd4_encode_commit(struct nfsd4_compoundres *resp, __be32 nfserr,
3751 		    union nfsd4_op_u *u)
3752 {
3753 	struct nfsd4_commit *commit = &u->commit;
3754 	struct xdr_stream *xdr = resp->xdr;
3755 	__be32 *p;
3756 
3757 	p = xdr_reserve_space(xdr, NFS4_VERIFIER_SIZE);
3758 	if (!p)
3759 		return nfserr_resource;
3760 	p = xdr_encode_opaque_fixed(p, commit->co_verf.data,
3761 						NFS4_VERIFIER_SIZE);
3762 	return 0;
3763 }
3764 
3765 static __be32
3766 nfsd4_encode_create(struct nfsd4_compoundres *resp, __be32 nfserr,
3767 		    union nfsd4_op_u *u)
3768 {
3769 	struct nfsd4_create *create = &u->create;
3770 	struct xdr_stream *xdr = resp->xdr;
3771 	__be32 *p;
3772 
3773 	p = xdr_reserve_space(xdr, 20);
3774 	if (!p)
3775 		return nfserr_resource;
3776 	encode_cinfo(p, &create->cr_cinfo);
3777 	return nfsd4_encode_bitmap(xdr, create->cr_bmval[0],
3778 			create->cr_bmval[1], create->cr_bmval[2]);
3779 }
3780 
3781 static __be32
3782 nfsd4_encode_getattr(struct nfsd4_compoundres *resp, __be32 nfserr,
3783 		     union nfsd4_op_u *u)
3784 {
3785 	struct nfsd4_getattr *getattr = &u->getattr;
3786 	struct svc_fh *fhp = getattr->ga_fhp;
3787 	struct xdr_stream *xdr = resp->xdr;
3788 
3789 	return nfsd4_encode_fattr(xdr, fhp, fhp->fh_export, fhp->fh_dentry,
3790 				    getattr->ga_bmval, resp->rqstp, 0);
3791 }
3792 
3793 static __be32
3794 nfsd4_encode_getfh(struct nfsd4_compoundres *resp, __be32 nfserr,
3795 		   union nfsd4_op_u *u)
3796 {
3797 	struct svc_fh **fhpp = &u->getfh;
3798 	struct xdr_stream *xdr = resp->xdr;
3799 	struct svc_fh *fhp = *fhpp;
3800 	unsigned int len;
3801 	__be32 *p;
3802 
3803 	len = fhp->fh_handle.fh_size;
3804 	p = xdr_reserve_space(xdr, len + 4);
3805 	if (!p)
3806 		return nfserr_resource;
3807 	p = xdr_encode_opaque(p, &fhp->fh_handle.fh_raw, len);
3808 	return 0;
3809 }
3810 
3811 /*
3812 * Including all fields other than the name, a LOCK4denied structure requires
3813 *   8(clientid) + 4(namelen) + 8(offset) + 8(length) + 4(type) = 32 bytes.
3814 */
3815 static __be32
3816 nfsd4_encode_lock_denied(struct xdr_stream *xdr, struct nfsd4_lock_denied *ld)
3817 {
3818 	struct xdr_netobj *conf = &ld->ld_owner;
3819 	__be32 *p;
3820 
3821 again:
3822 	p = xdr_reserve_space(xdr, 32 + XDR_LEN(conf->len));
3823 	if (!p) {
3824 		/*
3825 		 * Don't fail to return the result just because we can't
3826 		 * return the conflicting open:
3827 		 */
3828 		if (conf->len) {
3829 			kfree(conf->data);
3830 			conf->len = 0;
3831 			conf->data = NULL;
3832 			goto again;
3833 		}
3834 		return nfserr_resource;
3835 	}
3836 	p = xdr_encode_hyper(p, ld->ld_start);
3837 	p = xdr_encode_hyper(p, ld->ld_length);
3838 	*p++ = cpu_to_be32(ld->ld_type);
3839 	if (conf->len) {
3840 		p = xdr_encode_opaque_fixed(p, &ld->ld_clientid, 8);
3841 		p = xdr_encode_opaque(p, conf->data, conf->len);
3842 		kfree(conf->data);
3843 	}  else {  /* non - nfsv4 lock in conflict, no clientid nor owner */
3844 		p = xdr_encode_hyper(p, (u64)0); /* clientid */
3845 		*p++ = cpu_to_be32(0); /* length of owner name */
3846 	}
3847 	return nfserr_denied;
3848 }
3849 
3850 static __be32
3851 nfsd4_encode_lock(struct nfsd4_compoundres *resp, __be32 nfserr,
3852 		  union nfsd4_op_u *u)
3853 {
3854 	struct nfsd4_lock *lock = &u->lock;
3855 	struct xdr_stream *xdr = resp->xdr;
3856 
3857 	if (!nfserr)
3858 		nfserr = nfsd4_encode_stateid(xdr, &lock->lk_resp_stateid);
3859 	else if (nfserr == nfserr_denied)
3860 		nfserr = nfsd4_encode_lock_denied(xdr, &lock->lk_denied);
3861 
3862 	return nfserr;
3863 }
3864 
3865 static __be32
3866 nfsd4_encode_lockt(struct nfsd4_compoundres *resp, __be32 nfserr,
3867 		   union nfsd4_op_u *u)
3868 {
3869 	struct nfsd4_lockt *lockt = &u->lockt;
3870 	struct xdr_stream *xdr = resp->xdr;
3871 
3872 	if (nfserr == nfserr_denied)
3873 		nfsd4_encode_lock_denied(xdr, &lockt->lt_denied);
3874 	return nfserr;
3875 }
3876 
3877 static __be32
3878 nfsd4_encode_locku(struct nfsd4_compoundres *resp, __be32 nfserr,
3879 		   union nfsd4_op_u *u)
3880 {
3881 	struct nfsd4_locku *locku = &u->locku;
3882 	struct xdr_stream *xdr = resp->xdr;
3883 
3884 	return nfsd4_encode_stateid(xdr, &locku->lu_stateid);
3885 }
3886 
3887 
3888 static __be32
3889 nfsd4_encode_link(struct nfsd4_compoundres *resp, __be32 nfserr,
3890 		  union nfsd4_op_u *u)
3891 {
3892 	struct nfsd4_link *link = &u->link;
3893 	struct xdr_stream *xdr = resp->xdr;
3894 	__be32 *p;
3895 
3896 	p = xdr_reserve_space(xdr, 20);
3897 	if (!p)
3898 		return nfserr_resource;
3899 	p = encode_cinfo(p, &link->li_cinfo);
3900 	return 0;
3901 }
3902 
3903 
3904 static __be32
3905 nfsd4_encode_open(struct nfsd4_compoundres *resp, __be32 nfserr,
3906 		  union nfsd4_op_u *u)
3907 {
3908 	struct nfsd4_open *open = &u->open;
3909 	struct xdr_stream *xdr = resp->xdr;
3910 	__be32 *p;
3911 
3912 	nfserr = nfsd4_encode_stateid(xdr, &open->op_stateid);
3913 	if (nfserr)
3914 		return nfserr;
3915 	p = xdr_reserve_space(xdr, 24);
3916 	if (!p)
3917 		return nfserr_resource;
3918 	p = encode_cinfo(p, &open->op_cinfo);
3919 	*p++ = cpu_to_be32(open->op_rflags);
3920 
3921 	nfserr = nfsd4_encode_bitmap(xdr, open->op_bmval[0], open->op_bmval[1],
3922 					open->op_bmval[2]);
3923 	if (nfserr)
3924 		return nfserr;
3925 
3926 	p = xdr_reserve_space(xdr, 4);
3927 	if (!p)
3928 		return nfserr_resource;
3929 
3930 	*p++ = cpu_to_be32(open->op_delegate_type);
3931 	switch (open->op_delegate_type) {
3932 	case NFS4_OPEN_DELEGATE_NONE:
3933 		break;
3934 	case NFS4_OPEN_DELEGATE_READ:
3935 		nfserr = nfsd4_encode_stateid(xdr, &open->op_delegate_stateid);
3936 		if (nfserr)
3937 			return nfserr;
3938 		p = xdr_reserve_space(xdr, 20);
3939 		if (!p)
3940 			return nfserr_resource;
3941 		*p++ = cpu_to_be32(open->op_recall);
3942 
3943 		/*
3944 		 * TODO: ACE's in delegations
3945 		 */
3946 		*p++ = cpu_to_be32(NFS4_ACE_ACCESS_ALLOWED_ACE_TYPE);
3947 		*p++ = cpu_to_be32(0);
3948 		*p++ = cpu_to_be32(0);
3949 		*p++ = cpu_to_be32(0);   /* XXX: is NULL principal ok? */
3950 		break;
3951 	case NFS4_OPEN_DELEGATE_WRITE:
3952 		nfserr = nfsd4_encode_stateid(xdr, &open->op_delegate_stateid);
3953 		if (nfserr)
3954 			return nfserr;
3955 		p = xdr_reserve_space(xdr, 32);
3956 		if (!p)
3957 			return nfserr_resource;
3958 		*p++ = cpu_to_be32(0);
3959 
3960 		/*
3961 		 * TODO: space_limit's in delegations
3962 		 */
3963 		*p++ = cpu_to_be32(NFS4_LIMIT_SIZE);
3964 		*p++ = cpu_to_be32(~(u32)0);
3965 		*p++ = cpu_to_be32(~(u32)0);
3966 
3967 		/*
3968 		 * TODO: ACE's in delegations
3969 		 */
3970 		*p++ = cpu_to_be32(NFS4_ACE_ACCESS_ALLOWED_ACE_TYPE);
3971 		*p++ = cpu_to_be32(0);
3972 		*p++ = cpu_to_be32(0);
3973 		*p++ = cpu_to_be32(0);   /* XXX: is NULL principal ok? */
3974 		break;
3975 	case NFS4_OPEN_DELEGATE_NONE_EXT: /* 4.1 */
3976 		switch (open->op_why_no_deleg) {
3977 		case WND4_CONTENTION:
3978 		case WND4_RESOURCE:
3979 			p = xdr_reserve_space(xdr, 8);
3980 			if (!p)
3981 				return nfserr_resource;
3982 			*p++ = cpu_to_be32(open->op_why_no_deleg);
3983 			/* deleg signaling not supported yet: */
3984 			*p++ = cpu_to_be32(0);
3985 			break;
3986 		default:
3987 			p = xdr_reserve_space(xdr, 4);
3988 			if (!p)
3989 				return nfserr_resource;
3990 			*p++ = cpu_to_be32(open->op_why_no_deleg);
3991 		}
3992 		break;
3993 	default:
3994 		BUG();
3995 	}
3996 	/* XXX save filehandle here */
3997 	return 0;
3998 }
3999 
4000 static __be32
4001 nfsd4_encode_open_confirm(struct nfsd4_compoundres *resp, __be32 nfserr,
4002 			  union nfsd4_op_u *u)
4003 {
4004 	struct nfsd4_open_confirm *oc = &u->open_confirm;
4005 	struct xdr_stream *xdr = resp->xdr;
4006 
4007 	return nfsd4_encode_stateid(xdr, &oc->oc_resp_stateid);
4008 }
4009 
4010 static __be32
4011 nfsd4_encode_open_downgrade(struct nfsd4_compoundres *resp, __be32 nfserr,
4012 			    union nfsd4_op_u *u)
4013 {
4014 	struct nfsd4_open_downgrade *od = &u->open_downgrade;
4015 	struct xdr_stream *xdr = resp->xdr;
4016 
4017 	return nfsd4_encode_stateid(xdr, &od->od_stateid);
4018 }
4019 
4020 static __be32 nfsd4_encode_splice_read(
4021 				struct nfsd4_compoundres *resp,
4022 				struct nfsd4_read *read,
4023 				struct file *file, unsigned long maxcount)
4024 {
4025 	struct xdr_stream *xdr = resp->xdr;
4026 	struct xdr_buf *buf = xdr->buf;
4027 	int status, space_left;
4028 	__be32 nfserr;
4029 
4030 	/* Make sure there will be room for padding if needed */
4031 	if (xdr->end - xdr->p < 1)
4032 		return nfserr_resource;
4033 
4034 	nfserr = nfsd_splice_read(read->rd_rqstp, read->rd_fhp,
4035 				  file, read->rd_offset, &maxcount,
4036 				  &read->rd_eof);
4037 	read->rd_length = maxcount;
4038 	if (nfserr)
4039 		goto out_err;
4040 	status = svc_encode_result_payload(read->rd_rqstp,
4041 					   buf->head[0].iov_len, maxcount);
4042 	if (status) {
4043 		nfserr = nfserrno(status);
4044 		goto out_err;
4045 	}
4046 
4047 	buf->page_len = maxcount;
4048 	buf->len += maxcount;
4049 	xdr->page_ptr += (buf->page_base + maxcount + PAGE_SIZE - 1)
4050 							/ PAGE_SIZE;
4051 
4052 	/* Use rest of head for padding and remaining ops: */
4053 	buf->tail[0].iov_base = xdr->p;
4054 	buf->tail[0].iov_len = 0;
4055 	xdr->iov = buf->tail;
4056 	if (maxcount&3) {
4057 		int pad = 4 - (maxcount&3);
4058 
4059 		*(xdr->p++) = 0;
4060 
4061 		buf->tail[0].iov_base += maxcount&3;
4062 		buf->tail[0].iov_len = pad;
4063 		buf->len += pad;
4064 	}
4065 
4066 	space_left = min_t(int, (void *)xdr->end - (void *)xdr->p,
4067 				buf->buflen - buf->len);
4068 	buf->buflen = buf->len + space_left;
4069 	xdr->end = (__be32 *)((void *)xdr->end + space_left);
4070 
4071 	return 0;
4072 
4073 out_err:
4074 	/*
4075 	 * nfsd_splice_actor may have already messed with the
4076 	 * page length; reset it so as not to confuse
4077 	 * xdr_truncate_encode in our caller.
4078 	 */
4079 	buf->page_len = 0;
4080 	return nfserr;
4081 }
4082 
4083 static __be32 nfsd4_encode_readv(struct nfsd4_compoundres *resp,
4084 				 struct nfsd4_read *read,
4085 				 struct file *file, unsigned long maxcount)
4086 {
4087 	struct xdr_stream *xdr = resp->xdr;
4088 	unsigned int starting_len = xdr->buf->len;
4089 	__be32 zero = xdr_zero;
4090 	__be32 nfserr;
4091 
4092 	read->rd_vlen = xdr_reserve_space_vec(xdr, resp->rqstp->rq_vec, maxcount);
4093 	if (read->rd_vlen < 0)
4094 		return nfserr_resource;
4095 
4096 	nfserr = nfsd_readv(resp->rqstp, read->rd_fhp, file, read->rd_offset,
4097 			    resp->rqstp->rq_vec, read->rd_vlen, &maxcount,
4098 			    &read->rd_eof);
4099 	read->rd_length = maxcount;
4100 	if (nfserr)
4101 		return nfserr;
4102 	if (svc_encode_result_payload(resp->rqstp, starting_len, maxcount))
4103 		return nfserr_io;
4104 	xdr_truncate_encode(xdr, starting_len + xdr_align_size(maxcount));
4105 
4106 	write_bytes_to_xdr_buf(xdr->buf, starting_len + maxcount, &zero,
4107 			       xdr_pad_size(maxcount));
4108 	return nfs_ok;
4109 }
4110 
4111 static __be32
4112 nfsd4_encode_read(struct nfsd4_compoundres *resp, __be32 nfserr,
4113 		  union nfsd4_op_u *u)
4114 {
4115 	struct nfsd4_read *read = &u->read;
4116 	bool splice_ok = test_bit(RQ_SPLICE_OK, &resp->rqstp->rq_flags);
4117 	unsigned long maxcount;
4118 	struct xdr_stream *xdr = resp->xdr;
4119 	struct file *file;
4120 	int starting_len = xdr->buf->len;
4121 	__be32 *p;
4122 
4123 	if (nfserr)
4124 		return nfserr;
4125 	file = read->rd_nf->nf_file;
4126 
4127 	p = xdr_reserve_space(xdr, 8); /* eof flag and byte count */
4128 	if (!p) {
4129 		WARN_ON_ONCE(splice_ok);
4130 		return nfserr_resource;
4131 	}
4132 	if (resp->xdr->buf->page_len && splice_ok) {
4133 		WARN_ON_ONCE(1);
4134 		return nfserr_serverfault;
4135 	}
4136 	xdr_commit_encode(xdr);
4137 
4138 	maxcount = min_t(unsigned long, read->rd_length,
4139 			 (xdr->buf->buflen - xdr->buf->len));
4140 
4141 	if (file->f_op->splice_read && splice_ok)
4142 		nfserr = nfsd4_encode_splice_read(resp, read, file, maxcount);
4143 	else
4144 		nfserr = nfsd4_encode_readv(resp, read, file, maxcount);
4145 	if (nfserr) {
4146 		xdr_truncate_encode(xdr, starting_len);
4147 		return nfserr;
4148 	}
4149 
4150 	p = xdr_encode_bool(p, read->rd_eof);
4151 	*p = cpu_to_be32(read->rd_length);
4152 	return nfs_ok;
4153 }
4154 
4155 static __be32
4156 nfsd4_encode_readlink(struct nfsd4_compoundres *resp, __be32 nfserr,
4157 		      union nfsd4_op_u *u)
4158 {
4159 	struct nfsd4_readlink *readlink = &u->readlink;
4160 	__be32 *p, *maxcount_p, zero = xdr_zero;
4161 	struct xdr_stream *xdr = resp->xdr;
4162 	int length_offset = xdr->buf->len;
4163 	int maxcount, status;
4164 
4165 	maxcount_p = xdr_reserve_space(xdr, XDR_UNIT);
4166 	if (!maxcount_p)
4167 		return nfserr_resource;
4168 	maxcount = PAGE_SIZE;
4169 
4170 	p = xdr_reserve_space(xdr, maxcount);
4171 	if (!p)
4172 		return nfserr_resource;
4173 	/*
4174 	 * XXX: By default, vfs_readlink() will truncate symlinks if they
4175 	 * would overflow the buffer.  Is this kosher in NFSv4?  If not, one
4176 	 * easy fix is: if vfs_readlink() precisely fills the buffer, assume
4177 	 * that truncation occurred, and return NFS4ERR_RESOURCE.
4178 	 */
4179 	nfserr = nfsd_readlink(readlink->rl_rqstp, readlink->rl_fhp,
4180 						(char *)p, &maxcount);
4181 	if (nfserr == nfserr_isdir)
4182 		nfserr = nfserr_inval;
4183 	if (nfserr)
4184 		goto out_err;
4185 	status = svc_encode_result_payload(readlink->rl_rqstp, length_offset,
4186 					   maxcount);
4187 	if (status) {
4188 		nfserr = nfserrno(status);
4189 		goto out_err;
4190 	}
4191 	*maxcount_p = cpu_to_be32(maxcount);
4192 	xdr_truncate_encode(xdr, length_offset + 4 + xdr_align_size(maxcount));
4193 	write_bytes_to_xdr_buf(xdr->buf, length_offset + 4 + maxcount, &zero,
4194 			       xdr_pad_size(maxcount));
4195 	return nfs_ok;
4196 
4197 out_err:
4198 	xdr_truncate_encode(xdr, length_offset);
4199 	return nfserr;
4200 }
4201 
4202 static __be32
4203 nfsd4_encode_readdir(struct nfsd4_compoundres *resp, __be32 nfserr,
4204 		     union nfsd4_op_u *u)
4205 {
4206 	struct nfsd4_readdir *readdir = &u->readdir;
4207 	int maxcount;
4208 	int bytes_left;
4209 	loff_t offset;
4210 	__be64 wire_offset;
4211 	struct xdr_stream *xdr = resp->xdr;
4212 	int starting_len = xdr->buf->len;
4213 	__be32 *p;
4214 
4215 	p = xdr_reserve_space(xdr, NFS4_VERIFIER_SIZE);
4216 	if (!p)
4217 		return nfserr_resource;
4218 
4219 	/* XXX: Following NFSv3, we ignore the READDIR verifier for now. */
4220 	*p++ = cpu_to_be32(0);
4221 	*p++ = cpu_to_be32(0);
4222 	xdr->buf->head[0].iov_len = (char *)xdr->p -
4223 				    (char *)xdr->buf->head[0].iov_base;
4224 
4225 	/*
4226 	 * Number of bytes left for directory entries allowing for the
4227 	 * final 8 bytes of the readdir and a following failed op:
4228 	 */
4229 	bytes_left = xdr->buf->buflen - xdr->buf->len
4230 			- COMPOUND_ERR_SLACK_SPACE - 8;
4231 	if (bytes_left < 0) {
4232 		nfserr = nfserr_resource;
4233 		goto err_no_verf;
4234 	}
4235 	maxcount = svc_max_payload(resp->rqstp);
4236 	maxcount = min_t(u32, readdir->rd_maxcount, maxcount);
4237 	/*
4238 	 * Note the rfc defines rd_maxcount as the size of the
4239 	 * READDIR4resok structure, which includes the verifier above
4240 	 * and the 8 bytes encoded at the end of this function:
4241 	 */
4242 	if (maxcount < 16) {
4243 		nfserr = nfserr_toosmall;
4244 		goto err_no_verf;
4245 	}
4246 	maxcount = min_t(int, maxcount-16, bytes_left);
4247 
4248 	/* RFC 3530 14.2.24 allows us to ignore dircount when it's 0: */
4249 	if (!readdir->rd_dircount)
4250 		readdir->rd_dircount = svc_max_payload(resp->rqstp);
4251 
4252 	readdir->xdr = xdr;
4253 	readdir->rd_maxcount = maxcount;
4254 	readdir->common.err = 0;
4255 	readdir->cookie_offset = 0;
4256 
4257 	offset = readdir->rd_cookie;
4258 	nfserr = nfsd_readdir(readdir->rd_rqstp, readdir->rd_fhp,
4259 			      &offset,
4260 			      &readdir->common, nfsd4_encode_dirent);
4261 	if (nfserr == nfs_ok &&
4262 	    readdir->common.err == nfserr_toosmall &&
4263 	    xdr->buf->len == starting_len + 8) {
4264 		/* nothing encoded; which limit did we hit?: */
4265 		if (maxcount - 16 < bytes_left)
4266 			/* It was the fault of rd_maxcount: */
4267 			nfserr = nfserr_toosmall;
4268 		else
4269 			/* We ran out of buffer space: */
4270 			nfserr = nfserr_resource;
4271 	}
4272 	if (nfserr)
4273 		goto err_no_verf;
4274 
4275 	if (readdir->cookie_offset) {
4276 		wire_offset = cpu_to_be64(offset);
4277 		write_bytes_to_xdr_buf(xdr->buf, readdir->cookie_offset,
4278 							&wire_offset, 8);
4279 	}
4280 
4281 	p = xdr_reserve_space(xdr, 8);
4282 	if (!p) {
4283 		WARN_ON_ONCE(1);
4284 		goto err_no_verf;
4285 	}
4286 	*p++ = 0;	/* no more entries */
4287 	*p++ = htonl(readdir->common.err == nfserr_eof);
4288 
4289 	return 0;
4290 err_no_verf:
4291 	xdr_truncate_encode(xdr, starting_len);
4292 	return nfserr;
4293 }
4294 
4295 static __be32
4296 nfsd4_encode_remove(struct nfsd4_compoundres *resp, __be32 nfserr,
4297 		    union nfsd4_op_u *u)
4298 {
4299 	struct nfsd4_remove *remove = &u->remove;
4300 	struct xdr_stream *xdr = resp->xdr;
4301 	__be32 *p;
4302 
4303 	p = xdr_reserve_space(xdr, 20);
4304 	if (!p)
4305 		return nfserr_resource;
4306 	p = encode_cinfo(p, &remove->rm_cinfo);
4307 	return 0;
4308 }
4309 
4310 static __be32
4311 nfsd4_encode_rename(struct nfsd4_compoundres *resp, __be32 nfserr,
4312 		    union nfsd4_op_u *u)
4313 {
4314 	struct nfsd4_rename *rename = &u->rename;
4315 	struct xdr_stream *xdr = resp->xdr;
4316 	__be32 *p;
4317 
4318 	p = xdr_reserve_space(xdr, 40);
4319 	if (!p)
4320 		return nfserr_resource;
4321 	p = encode_cinfo(p, &rename->rn_sinfo);
4322 	p = encode_cinfo(p, &rename->rn_tinfo);
4323 	return 0;
4324 }
4325 
4326 static __be32
4327 nfsd4_do_encode_secinfo(struct xdr_stream *xdr, struct svc_export *exp)
4328 {
4329 	u32 i, nflavs, supported;
4330 	struct exp_flavor_info *flavs;
4331 	struct exp_flavor_info def_flavs[2];
4332 	__be32 *p, *flavorsp;
4333 	static bool report = true;
4334 
4335 	if (exp->ex_nflavors) {
4336 		flavs = exp->ex_flavors;
4337 		nflavs = exp->ex_nflavors;
4338 	} else { /* Handling of some defaults in absence of real secinfo: */
4339 		flavs = def_flavs;
4340 		if (exp->ex_client->flavour->flavour == RPC_AUTH_UNIX) {
4341 			nflavs = 2;
4342 			flavs[0].pseudoflavor = RPC_AUTH_UNIX;
4343 			flavs[1].pseudoflavor = RPC_AUTH_NULL;
4344 		} else if (exp->ex_client->flavour->flavour == RPC_AUTH_GSS) {
4345 			nflavs = 1;
4346 			flavs[0].pseudoflavor
4347 					= svcauth_gss_flavor(exp->ex_client);
4348 		} else {
4349 			nflavs = 1;
4350 			flavs[0].pseudoflavor
4351 					= exp->ex_client->flavour->flavour;
4352 		}
4353 	}
4354 
4355 	supported = 0;
4356 	p = xdr_reserve_space(xdr, 4);
4357 	if (!p)
4358 		return nfserr_resource;
4359 	flavorsp = p++;		/* to be backfilled later */
4360 
4361 	for (i = 0; i < nflavs; i++) {
4362 		rpc_authflavor_t pf = flavs[i].pseudoflavor;
4363 		struct rpcsec_gss_info info;
4364 
4365 		if (rpcauth_get_gssinfo(pf, &info) == 0) {
4366 			supported++;
4367 			p = xdr_reserve_space(xdr, 4 + 4 +
4368 					      XDR_LEN(info.oid.len) + 4 + 4);
4369 			if (!p)
4370 				return nfserr_resource;
4371 			*p++ = cpu_to_be32(RPC_AUTH_GSS);
4372 			p = xdr_encode_opaque(p,  info.oid.data, info.oid.len);
4373 			*p++ = cpu_to_be32(info.qop);
4374 			*p++ = cpu_to_be32(info.service);
4375 		} else if (pf < RPC_AUTH_MAXFLAVOR) {
4376 			supported++;
4377 			p = xdr_reserve_space(xdr, 4);
4378 			if (!p)
4379 				return nfserr_resource;
4380 			*p++ = cpu_to_be32(pf);
4381 		} else {
4382 			if (report)
4383 				pr_warn("NFS: SECINFO: security flavor %u "
4384 					"is not supported\n", pf);
4385 		}
4386 	}
4387 
4388 	if (nflavs != supported)
4389 		report = false;
4390 	*flavorsp = htonl(supported);
4391 	return 0;
4392 }
4393 
4394 static __be32
4395 nfsd4_encode_secinfo(struct nfsd4_compoundres *resp, __be32 nfserr,
4396 		     union nfsd4_op_u *u)
4397 {
4398 	struct nfsd4_secinfo *secinfo = &u->secinfo;
4399 	struct xdr_stream *xdr = resp->xdr;
4400 
4401 	return nfsd4_do_encode_secinfo(xdr, secinfo->si_exp);
4402 }
4403 
4404 static __be32
4405 nfsd4_encode_secinfo_no_name(struct nfsd4_compoundres *resp, __be32 nfserr,
4406 		     union nfsd4_op_u *u)
4407 {
4408 	struct nfsd4_secinfo_no_name *secinfo = &u->secinfo_no_name;
4409 	struct xdr_stream *xdr = resp->xdr;
4410 
4411 	return nfsd4_do_encode_secinfo(xdr, secinfo->sin_exp);
4412 }
4413 
4414 /*
4415  * The SETATTR encode routine is special -- it always encodes a bitmap,
4416  * regardless of the error status.
4417  */
4418 static __be32
4419 nfsd4_encode_setattr(struct nfsd4_compoundres *resp, __be32 nfserr,
4420 		     union nfsd4_op_u *u)
4421 {
4422 	struct nfsd4_setattr *setattr = &u->setattr;
4423 	struct xdr_stream *xdr = resp->xdr;
4424 	__be32 *p;
4425 
4426 	p = xdr_reserve_space(xdr, 16);
4427 	if (!p)
4428 		return nfserr_resource;
4429 	if (nfserr) {
4430 		*p++ = cpu_to_be32(3);
4431 		*p++ = cpu_to_be32(0);
4432 		*p++ = cpu_to_be32(0);
4433 		*p++ = cpu_to_be32(0);
4434 	}
4435 	else {
4436 		*p++ = cpu_to_be32(3);
4437 		*p++ = cpu_to_be32(setattr->sa_bmval[0]);
4438 		*p++ = cpu_to_be32(setattr->sa_bmval[1]);
4439 		*p++ = cpu_to_be32(setattr->sa_bmval[2]);
4440 	}
4441 	return nfserr;
4442 }
4443 
4444 static __be32
4445 nfsd4_encode_setclientid(struct nfsd4_compoundres *resp, __be32 nfserr,
4446 			 union nfsd4_op_u *u)
4447 {
4448 	struct nfsd4_setclientid *scd = &u->setclientid;
4449 	struct xdr_stream *xdr = resp->xdr;
4450 	__be32 *p;
4451 
4452 	if (!nfserr) {
4453 		p = xdr_reserve_space(xdr, 8 + NFS4_VERIFIER_SIZE);
4454 		if (!p)
4455 			return nfserr_resource;
4456 		p = xdr_encode_opaque_fixed(p, &scd->se_clientid, 8);
4457 		p = xdr_encode_opaque_fixed(p, &scd->se_confirm,
4458 						NFS4_VERIFIER_SIZE);
4459 	}
4460 	else if (nfserr == nfserr_clid_inuse) {
4461 		p = xdr_reserve_space(xdr, 8);
4462 		if (!p)
4463 			return nfserr_resource;
4464 		*p++ = cpu_to_be32(0);
4465 		*p++ = cpu_to_be32(0);
4466 	}
4467 	return nfserr;
4468 }
4469 
4470 static __be32
4471 nfsd4_encode_write(struct nfsd4_compoundres *resp, __be32 nfserr,
4472 		   union nfsd4_op_u *u)
4473 {
4474 	struct nfsd4_write *write = &u->write;
4475 	struct xdr_stream *xdr = resp->xdr;
4476 	__be32 *p;
4477 
4478 	p = xdr_reserve_space(xdr, 16);
4479 	if (!p)
4480 		return nfserr_resource;
4481 	*p++ = cpu_to_be32(write->wr_bytes_written);
4482 	*p++ = cpu_to_be32(write->wr_how_written);
4483 	p = xdr_encode_opaque_fixed(p, write->wr_verifier.data,
4484 						NFS4_VERIFIER_SIZE);
4485 	return 0;
4486 }
4487 
4488 static __be32
4489 nfsd4_encode_exchange_id(struct nfsd4_compoundres *resp, __be32 nfserr,
4490 			 union nfsd4_op_u *u)
4491 {
4492 	struct nfsd4_exchange_id *exid = &u->exchange_id;
4493 	struct xdr_stream *xdr = resp->xdr;
4494 	__be32 *p;
4495 	char *major_id;
4496 	char *server_scope;
4497 	int major_id_sz;
4498 	int server_scope_sz;
4499 	uint64_t minor_id = 0;
4500 	struct nfsd_net *nn = net_generic(SVC_NET(resp->rqstp), nfsd_net_id);
4501 
4502 	major_id = nn->nfsd_name;
4503 	major_id_sz = strlen(nn->nfsd_name);
4504 	server_scope = nn->nfsd_name;
4505 	server_scope_sz = strlen(nn->nfsd_name);
4506 
4507 	p = xdr_reserve_space(xdr,
4508 		8 /* eir_clientid */ +
4509 		4 /* eir_sequenceid */ +
4510 		4 /* eir_flags */ +
4511 		4 /* spr_how */);
4512 	if (!p)
4513 		return nfserr_resource;
4514 
4515 	p = xdr_encode_opaque_fixed(p, &exid->clientid, 8);
4516 	*p++ = cpu_to_be32(exid->seqid);
4517 	*p++ = cpu_to_be32(exid->flags);
4518 
4519 	*p++ = cpu_to_be32(exid->spa_how);
4520 
4521 	switch (exid->spa_how) {
4522 	case SP4_NONE:
4523 		break;
4524 	case SP4_MACH_CRED:
4525 		/* spo_must_enforce bitmap: */
4526 		nfserr = nfsd4_encode_bitmap(xdr,
4527 					exid->spo_must_enforce[0],
4528 					exid->spo_must_enforce[1],
4529 					exid->spo_must_enforce[2]);
4530 		if (nfserr)
4531 			return nfserr;
4532 		/* spo_must_allow bitmap: */
4533 		nfserr = nfsd4_encode_bitmap(xdr,
4534 					exid->spo_must_allow[0],
4535 					exid->spo_must_allow[1],
4536 					exid->spo_must_allow[2]);
4537 		if (nfserr)
4538 			return nfserr;
4539 		break;
4540 	default:
4541 		WARN_ON_ONCE(1);
4542 	}
4543 
4544 	p = xdr_reserve_space(xdr,
4545 		8 /* so_minor_id */ +
4546 		4 /* so_major_id.len */ +
4547 		(XDR_QUADLEN(major_id_sz) * 4) +
4548 		4 /* eir_server_scope.len */ +
4549 		(XDR_QUADLEN(server_scope_sz) * 4) +
4550 		4 /* eir_server_impl_id.count (0) */);
4551 	if (!p)
4552 		return nfserr_resource;
4553 
4554 	/* The server_owner struct */
4555 	p = xdr_encode_hyper(p, minor_id);      /* Minor id */
4556 	/* major id */
4557 	p = xdr_encode_opaque(p, major_id, major_id_sz);
4558 
4559 	/* Server scope */
4560 	p = xdr_encode_opaque(p, server_scope, server_scope_sz);
4561 
4562 	/* Implementation id */
4563 	*p++ = cpu_to_be32(0);	/* zero length nfs_impl_id4 array */
4564 	return 0;
4565 }
4566 
4567 static __be32
4568 nfsd4_encode_create_session(struct nfsd4_compoundres *resp, __be32 nfserr,
4569 			    union nfsd4_op_u *u)
4570 {
4571 	struct nfsd4_create_session *sess = &u->create_session;
4572 	struct xdr_stream *xdr = resp->xdr;
4573 	__be32 *p;
4574 
4575 	p = xdr_reserve_space(xdr, 24);
4576 	if (!p)
4577 		return nfserr_resource;
4578 	p = xdr_encode_opaque_fixed(p, sess->sessionid.data,
4579 					NFS4_MAX_SESSIONID_LEN);
4580 	*p++ = cpu_to_be32(sess->seqid);
4581 	*p++ = cpu_to_be32(sess->flags);
4582 
4583 	p = xdr_reserve_space(xdr, 28);
4584 	if (!p)
4585 		return nfserr_resource;
4586 	*p++ = cpu_to_be32(0); /* headerpadsz */
4587 	*p++ = cpu_to_be32(sess->fore_channel.maxreq_sz);
4588 	*p++ = cpu_to_be32(sess->fore_channel.maxresp_sz);
4589 	*p++ = cpu_to_be32(sess->fore_channel.maxresp_cached);
4590 	*p++ = cpu_to_be32(sess->fore_channel.maxops);
4591 	*p++ = cpu_to_be32(sess->fore_channel.maxreqs);
4592 	*p++ = cpu_to_be32(sess->fore_channel.nr_rdma_attrs);
4593 
4594 	if (sess->fore_channel.nr_rdma_attrs) {
4595 		p = xdr_reserve_space(xdr, 4);
4596 		if (!p)
4597 			return nfserr_resource;
4598 		*p++ = cpu_to_be32(sess->fore_channel.rdma_attrs);
4599 	}
4600 
4601 	p = xdr_reserve_space(xdr, 28);
4602 	if (!p)
4603 		return nfserr_resource;
4604 	*p++ = cpu_to_be32(0); /* headerpadsz */
4605 	*p++ = cpu_to_be32(sess->back_channel.maxreq_sz);
4606 	*p++ = cpu_to_be32(sess->back_channel.maxresp_sz);
4607 	*p++ = cpu_to_be32(sess->back_channel.maxresp_cached);
4608 	*p++ = cpu_to_be32(sess->back_channel.maxops);
4609 	*p++ = cpu_to_be32(sess->back_channel.maxreqs);
4610 	*p++ = cpu_to_be32(sess->back_channel.nr_rdma_attrs);
4611 
4612 	if (sess->back_channel.nr_rdma_attrs) {
4613 		p = xdr_reserve_space(xdr, 4);
4614 		if (!p)
4615 			return nfserr_resource;
4616 		*p++ = cpu_to_be32(sess->back_channel.rdma_attrs);
4617 	}
4618 	return 0;
4619 }
4620 
4621 static __be32
4622 nfsd4_encode_sequence(struct nfsd4_compoundres *resp, __be32 nfserr,
4623 		      union nfsd4_op_u *u)
4624 {
4625 	struct nfsd4_sequence *seq = &u->sequence;
4626 	struct xdr_stream *xdr = resp->xdr;
4627 	__be32 *p;
4628 
4629 	p = xdr_reserve_space(xdr, NFS4_MAX_SESSIONID_LEN + 20);
4630 	if (!p)
4631 		return nfserr_resource;
4632 	p = xdr_encode_opaque_fixed(p, seq->sessionid.data,
4633 					NFS4_MAX_SESSIONID_LEN);
4634 	*p++ = cpu_to_be32(seq->seqid);
4635 	*p++ = cpu_to_be32(seq->slotid);
4636 	/* Note slotid's are numbered from zero: */
4637 	*p++ = cpu_to_be32(seq->maxslots - 1); /* sr_highest_slotid */
4638 	*p++ = cpu_to_be32(seq->maxslots - 1); /* sr_target_highest_slotid */
4639 	*p++ = cpu_to_be32(seq->status_flags);
4640 
4641 	resp->cstate.data_offset = xdr->buf->len; /* DRC cache data pointer */
4642 	return 0;
4643 }
4644 
4645 static __be32
4646 nfsd4_encode_test_stateid(struct nfsd4_compoundres *resp, __be32 nfserr,
4647 			  union nfsd4_op_u *u)
4648 {
4649 	struct nfsd4_test_stateid *test_stateid = &u->test_stateid;
4650 	struct xdr_stream *xdr = resp->xdr;
4651 	struct nfsd4_test_stateid_id *stateid, *next;
4652 	__be32 *p;
4653 
4654 	p = xdr_reserve_space(xdr, 4 + (4 * test_stateid->ts_num_ids));
4655 	if (!p)
4656 		return nfserr_resource;
4657 	*p++ = htonl(test_stateid->ts_num_ids);
4658 
4659 	list_for_each_entry_safe(stateid, next, &test_stateid->ts_stateid_list, ts_id_list) {
4660 		*p++ = stateid->ts_id_status;
4661 	}
4662 
4663 	return 0;
4664 }
4665 
4666 #ifdef CONFIG_NFSD_PNFS
4667 static __be32
4668 nfsd4_encode_getdeviceinfo(struct nfsd4_compoundres *resp, __be32 nfserr,
4669 		union nfsd4_op_u *u)
4670 {
4671 	struct nfsd4_getdeviceinfo *gdev = &u->getdeviceinfo;
4672 	struct xdr_stream *xdr = resp->xdr;
4673 	const struct nfsd4_layout_ops *ops;
4674 	u32 starting_len = xdr->buf->len, needed_len;
4675 	__be32 *p;
4676 
4677 	p = xdr_reserve_space(xdr, 4);
4678 	if (!p)
4679 		return nfserr_resource;
4680 
4681 	*p++ = cpu_to_be32(gdev->gd_layout_type);
4682 
4683 	/* If maxcount is 0 then just update notifications */
4684 	if (gdev->gd_maxcount != 0) {
4685 		ops = nfsd4_layout_ops[gdev->gd_layout_type];
4686 		nfserr = ops->encode_getdeviceinfo(xdr, gdev);
4687 		if (nfserr) {
4688 			/*
4689 			 * We don't bother to burden the layout drivers with
4690 			 * enforcing gd_maxcount, just tell the client to
4691 			 * come back with a bigger buffer if it's not enough.
4692 			 */
4693 			if (xdr->buf->len + 4 > gdev->gd_maxcount)
4694 				goto toosmall;
4695 			return nfserr;
4696 		}
4697 	}
4698 
4699 	if (gdev->gd_notify_types) {
4700 		p = xdr_reserve_space(xdr, 4 + 4);
4701 		if (!p)
4702 			return nfserr_resource;
4703 		*p++ = cpu_to_be32(1);			/* bitmap length */
4704 		*p++ = cpu_to_be32(gdev->gd_notify_types);
4705 	} else {
4706 		p = xdr_reserve_space(xdr, 4);
4707 		if (!p)
4708 			return nfserr_resource;
4709 		*p++ = 0;
4710 	}
4711 
4712 	return 0;
4713 toosmall:
4714 	dprintk("%s: maxcount too small\n", __func__);
4715 	needed_len = xdr->buf->len + 4 /* notifications */;
4716 	xdr_truncate_encode(xdr, starting_len);
4717 	p = xdr_reserve_space(xdr, 4);
4718 	if (!p)
4719 		return nfserr_resource;
4720 	*p++ = cpu_to_be32(needed_len);
4721 	return nfserr_toosmall;
4722 }
4723 
4724 static __be32
4725 nfsd4_encode_layoutget(struct nfsd4_compoundres *resp, __be32 nfserr,
4726 		union nfsd4_op_u *u)
4727 {
4728 	struct nfsd4_layoutget *lgp = &u->layoutget;
4729 	struct xdr_stream *xdr = resp->xdr;
4730 	const struct nfsd4_layout_ops *ops;
4731 	__be32 *p;
4732 
4733 	p = xdr_reserve_space(xdr, 36 + sizeof(stateid_opaque_t));
4734 	if (!p)
4735 		return nfserr_resource;
4736 
4737 	*p++ = cpu_to_be32(1);	/* we always set return-on-close */
4738 	*p++ = cpu_to_be32(lgp->lg_sid.si_generation);
4739 	p = xdr_encode_opaque_fixed(p, &lgp->lg_sid.si_opaque,
4740 				    sizeof(stateid_opaque_t));
4741 
4742 	*p++ = cpu_to_be32(1);	/* we always return a single layout */
4743 	p = xdr_encode_hyper(p, lgp->lg_seg.offset);
4744 	p = xdr_encode_hyper(p, lgp->lg_seg.length);
4745 	*p++ = cpu_to_be32(lgp->lg_seg.iomode);
4746 	*p++ = cpu_to_be32(lgp->lg_layout_type);
4747 
4748 	ops = nfsd4_layout_ops[lgp->lg_layout_type];
4749 	return ops->encode_layoutget(xdr, lgp);
4750 }
4751 
4752 static __be32
4753 nfsd4_encode_layoutcommit(struct nfsd4_compoundres *resp, __be32 nfserr,
4754 			  union nfsd4_op_u *u)
4755 {
4756 	struct nfsd4_layoutcommit *lcp = &u->layoutcommit;
4757 	struct xdr_stream *xdr = resp->xdr;
4758 	__be32 *p;
4759 
4760 	p = xdr_reserve_space(xdr, 4);
4761 	if (!p)
4762 		return nfserr_resource;
4763 	*p++ = cpu_to_be32(lcp->lc_size_chg);
4764 	if (lcp->lc_size_chg) {
4765 		p = xdr_reserve_space(xdr, 8);
4766 		if (!p)
4767 			return nfserr_resource;
4768 		p = xdr_encode_hyper(p, lcp->lc_newsize);
4769 	}
4770 
4771 	return 0;
4772 }
4773 
4774 static __be32
4775 nfsd4_encode_layoutreturn(struct nfsd4_compoundres *resp, __be32 nfserr,
4776 		union nfsd4_op_u *u)
4777 {
4778 	struct nfsd4_layoutreturn *lrp = &u->layoutreturn;
4779 	struct xdr_stream *xdr = resp->xdr;
4780 	__be32 *p;
4781 
4782 	p = xdr_reserve_space(xdr, 4);
4783 	if (!p)
4784 		return nfserr_resource;
4785 	*p++ = cpu_to_be32(lrp->lrs_present);
4786 	if (lrp->lrs_present)
4787 		return nfsd4_encode_stateid(xdr, &lrp->lr_sid);
4788 	return 0;
4789 }
4790 #endif /* CONFIG_NFSD_PNFS */
4791 
4792 static __be32
4793 nfsd42_encode_write_res(struct nfsd4_compoundres *resp,
4794 		struct nfsd42_write_res *write, bool sync)
4795 {
4796 	__be32 *p;
4797 	p = xdr_reserve_space(resp->xdr, 4);
4798 	if (!p)
4799 		return nfserr_resource;
4800 
4801 	if (sync)
4802 		*p++ = cpu_to_be32(0);
4803 	else {
4804 		__be32 nfserr;
4805 		*p++ = cpu_to_be32(1);
4806 		nfserr = nfsd4_encode_stateid(resp->xdr, &write->cb_stateid);
4807 		if (nfserr)
4808 			return nfserr;
4809 	}
4810 	p = xdr_reserve_space(resp->xdr, 8 + 4 + NFS4_VERIFIER_SIZE);
4811 	if (!p)
4812 		return nfserr_resource;
4813 
4814 	p = xdr_encode_hyper(p, write->wr_bytes_written);
4815 	*p++ = cpu_to_be32(write->wr_stable_how);
4816 	p = xdr_encode_opaque_fixed(p, write->wr_verifier.data,
4817 				    NFS4_VERIFIER_SIZE);
4818 	return nfs_ok;
4819 }
4820 
4821 static __be32
4822 nfsd42_encode_nl4_server(struct nfsd4_compoundres *resp, struct nl4_server *ns)
4823 {
4824 	struct xdr_stream *xdr = resp->xdr;
4825 	struct nfs42_netaddr *addr;
4826 	__be32 *p;
4827 
4828 	p = xdr_reserve_space(xdr, 4);
4829 	*p++ = cpu_to_be32(ns->nl4_type);
4830 
4831 	switch (ns->nl4_type) {
4832 	case NL4_NETADDR:
4833 		addr = &ns->u.nl4_addr;
4834 
4835 		/* netid_len, netid, uaddr_len, uaddr (port included
4836 		 * in RPCBIND_MAXUADDRLEN)
4837 		 */
4838 		p = xdr_reserve_space(xdr,
4839 			4 /* netid len */ +
4840 			(XDR_QUADLEN(addr->netid_len) * 4) +
4841 			4 /* uaddr len */ +
4842 			(XDR_QUADLEN(addr->addr_len) * 4));
4843 		if (!p)
4844 			return nfserr_resource;
4845 
4846 		*p++ = cpu_to_be32(addr->netid_len);
4847 		p = xdr_encode_opaque_fixed(p, addr->netid,
4848 					    addr->netid_len);
4849 		*p++ = cpu_to_be32(addr->addr_len);
4850 		p = xdr_encode_opaque_fixed(p, addr->addr,
4851 					addr->addr_len);
4852 		break;
4853 	default:
4854 		WARN_ON_ONCE(ns->nl4_type != NL4_NETADDR);
4855 		return nfserr_inval;
4856 	}
4857 
4858 	return 0;
4859 }
4860 
4861 static __be32
4862 nfsd4_encode_copy(struct nfsd4_compoundres *resp, __be32 nfserr,
4863 		  union nfsd4_op_u *u)
4864 {
4865 	struct nfsd4_copy *copy = &u->copy;
4866 	__be32 *p;
4867 
4868 	nfserr = nfsd42_encode_write_res(resp, &copy->cp_res,
4869 					 nfsd4_copy_is_sync(copy));
4870 	if (nfserr)
4871 		return nfserr;
4872 
4873 	p = xdr_reserve_space(resp->xdr, 4 + 4);
4874 	*p++ = xdr_one; /* cr_consecutive */
4875 	*p = nfsd4_copy_is_sync(copy) ? xdr_one : xdr_zero;
4876 	return 0;
4877 }
4878 
4879 static __be32
4880 nfsd4_encode_offload_status(struct nfsd4_compoundres *resp, __be32 nfserr,
4881 			    union nfsd4_op_u *u)
4882 {
4883 	struct nfsd4_offload_status *os = &u->offload_status;
4884 	struct xdr_stream *xdr = resp->xdr;
4885 	__be32 *p;
4886 
4887 	p = xdr_reserve_space(xdr, 8 + 4);
4888 	if (!p)
4889 		return nfserr_resource;
4890 	p = xdr_encode_hyper(p, os->count);
4891 	*p++ = cpu_to_be32(0);
4892 	return nfserr;
4893 }
4894 
4895 static __be32
4896 nfsd4_encode_read_plus_data(struct nfsd4_compoundres *resp,
4897 			    struct nfsd4_read *read)
4898 {
4899 	bool splice_ok = test_bit(RQ_SPLICE_OK, &resp->rqstp->rq_flags);
4900 	struct file *file = read->rd_nf->nf_file;
4901 	struct xdr_stream *xdr = resp->xdr;
4902 	unsigned long maxcount;
4903 	__be32 nfserr, *p;
4904 
4905 	/* Content type, offset, byte count */
4906 	p = xdr_reserve_space(xdr, 4 + 8 + 4);
4907 	if (!p)
4908 		return nfserr_io;
4909 	if (resp->xdr->buf->page_len && splice_ok) {
4910 		WARN_ON_ONCE(splice_ok);
4911 		return nfserr_serverfault;
4912 	}
4913 
4914 	maxcount = min_t(unsigned long, read->rd_length,
4915 			 (xdr->buf->buflen - xdr->buf->len));
4916 
4917 	if (file->f_op->splice_read && splice_ok)
4918 		nfserr = nfsd4_encode_splice_read(resp, read, file, maxcount);
4919 	else
4920 		nfserr = nfsd4_encode_readv(resp, read, file, maxcount);
4921 	if (nfserr)
4922 		return nfserr;
4923 
4924 	*p++ = cpu_to_be32(NFS4_CONTENT_DATA);
4925 	p = xdr_encode_hyper(p, read->rd_offset);
4926 	*p = cpu_to_be32(read->rd_length);
4927 
4928 	return nfs_ok;
4929 }
4930 
4931 static __be32
4932 nfsd4_encode_read_plus(struct nfsd4_compoundres *resp, __be32 nfserr,
4933 		       union nfsd4_op_u *u)
4934 {
4935 	struct nfsd4_read *read = &u->read;
4936 	struct file *file = read->rd_nf->nf_file;
4937 	struct xdr_stream *xdr = resp->xdr;
4938 	int starting_len = xdr->buf->len;
4939 	u32 segments = 0;
4940 	__be32 *p;
4941 
4942 	if (nfserr)
4943 		return nfserr;
4944 
4945 	/* eof flag, segment count */
4946 	p = xdr_reserve_space(xdr, 4 + 4);
4947 	if (!p)
4948 		return nfserr_io;
4949 	xdr_commit_encode(xdr);
4950 
4951 	read->rd_eof = read->rd_offset >= i_size_read(file_inode(file));
4952 	if (read->rd_eof)
4953 		goto out;
4954 
4955 	nfserr = nfsd4_encode_read_plus_data(resp, read);
4956 	if (nfserr) {
4957 		xdr_truncate_encode(xdr, starting_len);
4958 		return nfserr;
4959 	}
4960 
4961 	segments++;
4962 
4963 out:
4964 	p = xdr_encode_bool(p, read->rd_eof);
4965 	*p = cpu_to_be32(segments);
4966 	return nfserr;
4967 }
4968 
4969 static __be32
4970 nfsd4_encode_copy_notify(struct nfsd4_compoundres *resp, __be32 nfserr,
4971 			 union nfsd4_op_u *u)
4972 {
4973 	struct nfsd4_copy_notify *cn = &u->copy_notify;
4974 	struct xdr_stream *xdr = resp->xdr;
4975 	__be32 *p;
4976 
4977 	if (nfserr)
4978 		return nfserr;
4979 
4980 	/* 8 sec, 4 nsec */
4981 	p = xdr_reserve_space(xdr, 12);
4982 	if (!p)
4983 		return nfserr_resource;
4984 
4985 	/* cnr_lease_time */
4986 	p = xdr_encode_hyper(p, cn->cpn_sec);
4987 	*p++ = cpu_to_be32(cn->cpn_nsec);
4988 
4989 	/* cnr_stateid */
4990 	nfserr = nfsd4_encode_stateid(xdr, &cn->cpn_cnr_stateid);
4991 	if (nfserr)
4992 		return nfserr;
4993 
4994 	/* cnr_src.nl_nsvr */
4995 	p = xdr_reserve_space(xdr, 4);
4996 	if (!p)
4997 		return nfserr_resource;
4998 
4999 	*p++ = cpu_to_be32(1);
5000 
5001 	nfserr = nfsd42_encode_nl4_server(resp, cn->cpn_src);
5002 	return nfserr;
5003 }
5004 
5005 static __be32
5006 nfsd4_encode_seek(struct nfsd4_compoundres *resp, __be32 nfserr,
5007 		  union nfsd4_op_u *u)
5008 {
5009 	struct nfsd4_seek *seek = &u->seek;
5010 	__be32 *p;
5011 
5012 	p = xdr_reserve_space(resp->xdr, 4 + 8);
5013 	*p++ = cpu_to_be32(seek->seek_eof);
5014 	p = xdr_encode_hyper(p, seek->seek_pos);
5015 
5016 	return 0;
5017 }
5018 
5019 static __be32
5020 nfsd4_encode_noop(struct nfsd4_compoundres *resp, __be32 nfserr,
5021 		  union nfsd4_op_u *p)
5022 {
5023 	return nfserr;
5024 }
5025 
5026 /*
5027  * Encode kmalloc-ed buffer in to XDR stream.
5028  */
5029 static __be32
5030 nfsd4_vbuf_to_stream(struct xdr_stream *xdr, char *buf, u32 buflen)
5031 {
5032 	u32 cplen;
5033 	__be32 *p;
5034 
5035 	cplen = min_t(unsigned long, buflen,
5036 		      ((void *)xdr->end - (void *)xdr->p));
5037 	p = xdr_reserve_space(xdr, cplen);
5038 	if (!p)
5039 		return nfserr_resource;
5040 
5041 	memcpy(p, buf, cplen);
5042 	buf += cplen;
5043 	buflen -= cplen;
5044 
5045 	while (buflen) {
5046 		cplen = min_t(u32, buflen, PAGE_SIZE);
5047 		p = xdr_reserve_space(xdr, cplen);
5048 		if (!p)
5049 			return nfserr_resource;
5050 
5051 		memcpy(p, buf, cplen);
5052 
5053 		if (cplen < PAGE_SIZE) {
5054 			/*
5055 			 * We're done, with a length that wasn't page
5056 			 * aligned, so possibly not word aligned. Pad
5057 			 * any trailing bytes with 0.
5058 			 */
5059 			xdr_encode_opaque_fixed(p, NULL, cplen);
5060 			break;
5061 		}
5062 
5063 		buflen -= PAGE_SIZE;
5064 		buf += PAGE_SIZE;
5065 	}
5066 
5067 	return 0;
5068 }
5069 
5070 static __be32
5071 nfsd4_encode_getxattr(struct nfsd4_compoundres *resp, __be32 nfserr,
5072 		      union nfsd4_op_u *u)
5073 {
5074 	struct nfsd4_getxattr *getxattr = &u->getxattr;
5075 	struct xdr_stream *xdr = resp->xdr;
5076 	__be32 *p, err;
5077 
5078 	p = xdr_reserve_space(xdr, 4);
5079 	if (!p)
5080 		return nfserr_resource;
5081 
5082 	*p = cpu_to_be32(getxattr->getxa_len);
5083 
5084 	if (getxattr->getxa_len == 0)
5085 		return 0;
5086 
5087 	err = nfsd4_vbuf_to_stream(xdr, getxattr->getxa_buf,
5088 				    getxattr->getxa_len);
5089 
5090 	kvfree(getxattr->getxa_buf);
5091 
5092 	return err;
5093 }
5094 
5095 static __be32
5096 nfsd4_encode_setxattr(struct nfsd4_compoundres *resp, __be32 nfserr,
5097 		      union nfsd4_op_u *u)
5098 {
5099 	struct nfsd4_setxattr *setxattr = &u->setxattr;
5100 	struct xdr_stream *xdr = resp->xdr;
5101 	__be32 *p;
5102 
5103 	p = xdr_reserve_space(xdr, 20);
5104 	if (!p)
5105 		return nfserr_resource;
5106 
5107 	encode_cinfo(p, &setxattr->setxa_cinfo);
5108 
5109 	return 0;
5110 }
5111 
5112 /*
5113  * See if there are cookie values that can be rejected outright.
5114  */
5115 static __be32
5116 nfsd4_listxattr_validate_cookie(struct nfsd4_listxattrs *listxattrs,
5117 				u32 *offsetp)
5118 {
5119 	u64 cookie = listxattrs->lsxa_cookie;
5120 
5121 	/*
5122 	 * If the cookie is larger than the maximum number we can fit
5123 	 * in either the buffer we just got back from vfs_listxattr, or,
5124 	 * XDR-encoded, in the return buffer, it's invalid.
5125 	 */
5126 	if (cookie > (listxattrs->lsxa_len) / (XATTR_USER_PREFIX_LEN + 2))
5127 		return nfserr_badcookie;
5128 
5129 	if (cookie > (listxattrs->lsxa_maxcount /
5130 		      (XDR_QUADLEN(XATTR_USER_PREFIX_LEN + 2) + 4)))
5131 		return nfserr_badcookie;
5132 
5133 	*offsetp = (u32)cookie;
5134 	return 0;
5135 }
5136 
5137 static __be32
5138 nfsd4_encode_listxattrs(struct nfsd4_compoundres *resp, __be32 nfserr,
5139 			union nfsd4_op_u *u)
5140 {
5141 	struct nfsd4_listxattrs *listxattrs = &u->listxattrs;
5142 	struct xdr_stream *xdr = resp->xdr;
5143 	u32 cookie_offset, count_offset, eof;
5144 	u32 left, xdrleft, slen, count;
5145 	u32 xdrlen, offset;
5146 	u64 cookie;
5147 	char *sp;
5148 	__be32 status, tmp;
5149 	__be32 *p;
5150 	u32 nuser;
5151 
5152 	eof = 1;
5153 
5154 	status = nfsd4_listxattr_validate_cookie(listxattrs, &offset);
5155 	if (status)
5156 		goto out;
5157 
5158 	/*
5159 	 * Reserve space for the cookie and the name array count. Record
5160 	 * the offsets to save them later.
5161 	 */
5162 	cookie_offset = xdr->buf->len;
5163 	count_offset = cookie_offset + 8;
5164 	p = xdr_reserve_space(xdr, 12);
5165 	if (!p) {
5166 		status = nfserr_resource;
5167 		goto out;
5168 	}
5169 
5170 	count = 0;
5171 	left = listxattrs->lsxa_len;
5172 	sp = listxattrs->lsxa_buf;
5173 	nuser = 0;
5174 
5175 	xdrleft = listxattrs->lsxa_maxcount;
5176 
5177 	while (left > 0 && xdrleft > 0) {
5178 		slen = strlen(sp);
5179 
5180 		/*
5181 		 * Check if this is a "user." attribute, skip it if not.
5182 		 */
5183 		if (strncmp(sp, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN))
5184 			goto contloop;
5185 
5186 		slen -= XATTR_USER_PREFIX_LEN;
5187 		xdrlen = 4 + ((slen + 3) & ~3);
5188 		if (xdrlen > xdrleft) {
5189 			if (count == 0) {
5190 				/*
5191 				 * Can't even fit the first attribute name.
5192 				 */
5193 				status = nfserr_toosmall;
5194 				goto out;
5195 			}
5196 			eof = 0;
5197 			goto wreof;
5198 		}
5199 
5200 		left -= XATTR_USER_PREFIX_LEN;
5201 		sp += XATTR_USER_PREFIX_LEN;
5202 		if (nuser++ < offset)
5203 			goto contloop;
5204 
5205 
5206 		p = xdr_reserve_space(xdr, xdrlen);
5207 		if (!p) {
5208 			status = nfserr_resource;
5209 			goto out;
5210 		}
5211 
5212 		xdr_encode_opaque(p, sp, slen);
5213 
5214 		xdrleft -= xdrlen;
5215 		count++;
5216 contloop:
5217 		sp += slen + 1;
5218 		left -= slen + 1;
5219 	}
5220 
5221 	/*
5222 	 * If there were user attributes to copy, but we didn't copy
5223 	 * any, the offset was too large (e.g. the cookie was invalid).
5224 	 */
5225 	if (nuser > 0 && count == 0) {
5226 		status = nfserr_badcookie;
5227 		goto out;
5228 	}
5229 
5230 wreof:
5231 	p = xdr_reserve_space(xdr, 4);
5232 	if (!p) {
5233 		status = nfserr_resource;
5234 		goto out;
5235 	}
5236 	*p = cpu_to_be32(eof);
5237 
5238 	cookie = offset + count;
5239 
5240 	write_bytes_to_xdr_buf(xdr->buf, cookie_offset, &cookie, 8);
5241 	tmp = cpu_to_be32(count);
5242 	write_bytes_to_xdr_buf(xdr->buf, count_offset, &tmp, 4);
5243 out:
5244 	if (listxattrs->lsxa_len)
5245 		kvfree(listxattrs->lsxa_buf);
5246 	return status;
5247 }
5248 
5249 static __be32
5250 nfsd4_encode_removexattr(struct nfsd4_compoundres *resp, __be32 nfserr,
5251 			 union nfsd4_op_u *u)
5252 {
5253 	struct nfsd4_removexattr *removexattr = &u->removexattr;
5254 	struct xdr_stream *xdr = resp->xdr;
5255 	__be32 *p;
5256 
5257 	p = xdr_reserve_space(xdr, 20);
5258 	if (!p)
5259 		return nfserr_resource;
5260 
5261 	p = encode_cinfo(p, &removexattr->rmxa_cinfo);
5262 	return 0;
5263 }
5264 
5265 typedef __be32(*nfsd4_enc)(struct nfsd4_compoundres *, __be32, union nfsd4_op_u *u);
5266 
5267 /*
5268  * Note: nfsd4_enc_ops vector is shared for v4.0 and v4.1
5269  * since we don't need to filter out obsolete ops as this is
5270  * done in the decoding phase.
5271  */
5272 static const nfsd4_enc nfsd4_enc_ops[] = {
5273 	[OP_ACCESS]		= nfsd4_encode_access,
5274 	[OP_CLOSE]		= nfsd4_encode_close,
5275 	[OP_COMMIT]		= nfsd4_encode_commit,
5276 	[OP_CREATE]		= nfsd4_encode_create,
5277 	[OP_DELEGPURGE]		= nfsd4_encode_noop,
5278 	[OP_DELEGRETURN]	= nfsd4_encode_noop,
5279 	[OP_GETATTR]		= nfsd4_encode_getattr,
5280 	[OP_GETFH]		= nfsd4_encode_getfh,
5281 	[OP_LINK]		= nfsd4_encode_link,
5282 	[OP_LOCK]		= nfsd4_encode_lock,
5283 	[OP_LOCKT]		= nfsd4_encode_lockt,
5284 	[OP_LOCKU]		= nfsd4_encode_locku,
5285 	[OP_LOOKUP]		= nfsd4_encode_noop,
5286 	[OP_LOOKUPP]		= nfsd4_encode_noop,
5287 	[OP_NVERIFY]		= nfsd4_encode_noop,
5288 	[OP_OPEN]		= nfsd4_encode_open,
5289 	[OP_OPENATTR]		= nfsd4_encode_noop,
5290 	[OP_OPEN_CONFIRM]	= nfsd4_encode_open_confirm,
5291 	[OP_OPEN_DOWNGRADE]	= nfsd4_encode_open_downgrade,
5292 	[OP_PUTFH]		= nfsd4_encode_noop,
5293 	[OP_PUTPUBFH]		= nfsd4_encode_noop,
5294 	[OP_PUTROOTFH]		= nfsd4_encode_noop,
5295 	[OP_READ]		= nfsd4_encode_read,
5296 	[OP_READDIR]		= nfsd4_encode_readdir,
5297 	[OP_READLINK]		= nfsd4_encode_readlink,
5298 	[OP_REMOVE]		= nfsd4_encode_remove,
5299 	[OP_RENAME]		= nfsd4_encode_rename,
5300 	[OP_RENEW]		= nfsd4_encode_noop,
5301 	[OP_RESTOREFH]		= nfsd4_encode_noop,
5302 	[OP_SAVEFH]		= nfsd4_encode_noop,
5303 	[OP_SECINFO]		= nfsd4_encode_secinfo,
5304 	[OP_SETATTR]		= nfsd4_encode_setattr,
5305 	[OP_SETCLIENTID]	= nfsd4_encode_setclientid,
5306 	[OP_SETCLIENTID_CONFIRM] = nfsd4_encode_noop,
5307 	[OP_VERIFY]		= nfsd4_encode_noop,
5308 	[OP_WRITE]		= nfsd4_encode_write,
5309 	[OP_RELEASE_LOCKOWNER]	= nfsd4_encode_noop,
5310 
5311 	/* NFSv4.1 operations */
5312 	[OP_BACKCHANNEL_CTL]	= nfsd4_encode_noop,
5313 	[OP_BIND_CONN_TO_SESSION] = nfsd4_encode_bind_conn_to_session,
5314 	[OP_EXCHANGE_ID]	= nfsd4_encode_exchange_id,
5315 	[OP_CREATE_SESSION]	= nfsd4_encode_create_session,
5316 	[OP_DESTROY_SESSION]	= nfsd4_encode_noop,
5317 	[OP_FREE_STATEID]	= nfsd4_encode_noop,
5318 	[OP_GET_DIR_DELEGATION]	= nfsd4_encode_noop,
5319 #ifdef CONFIG_NFSD_PNFS
5320 	[OP_GETDEVICEINFO]	= nfsd4_encode_getdeviceinfo,
5321 	[OP_GETDEVICELIST]	= nfsd4_encode_noop,
5322 	[OP_LAYOUTCOMMIT]	= nfsd4_encode_layoutcommit,
5323 	[OP_LAYOUTGET]		= nfsd4_encode_layoutget,
5324 	[OP_LAYOUTRETURN]	= nfsd4_encode_layoutreturn,
5325 #else
5326 	[OP_GETDEVICEINFO]	= nfsd4_encode_noop,
5327 	[OP_GETDEVICELIST]	= nfsd4_encode_noop,
5328 	[OP_LAYOUTCOMMIT]	= nfsd4_encode_noop,
5329 	[OP_LAYOUTGET]		= nfsd4_encode_noop,
5330 	[OP_LAYOUTRETURN]	= nfsd4_encode_noop,
5331 #endif
5332 	[OP_SECINFO_NO_NAME]	= nfsd4_encode_secinfo_no_name,
5333 	[OP_SEQUENCE]		= nfsd4_encode_sequence,
5334 	[OP_SET_SSV]		= nfsd4_encode_noop,
5335 	[OP_TEST_STATEID]	= nfsd4_encode_test_stateid,
5336 	[OP_WANT_DELEGATION]	= nfsd4_encode_noop,
5337 	[OP_DESTROY_CLIENTID]	= nfsd4_encode_noop,
5338 	[OP_RECLAIM_COMPLETE]	= nfsd4_encode_noop,
5339 
5340 	/* NFSv4.2 operations */
5341 	[OP_ALLOCATE]		= nfsd4_encode_noop,
5342 	[OP_COPY]		= nfsd4_encode_copy,
5343 	[OP_COPY_NOTIFY]	= nfsd4_encode_copy_notify,
5344 	[OP_DEALLOCATE]		= nfsd4_encode_noop,
5345 	[OP_IO_ADVISE]		= nfsd4_encode_noop,
5346 	[OP_LAYOUTERROR]	= nfsd4_encode_noop,
5347 	[OP_LAYOUTSTATS]	= nfsd4_encode_noop,
5348 	[OP_OFFLOAD_CANCEL]	= nfsd4_encode_noop,
5349 	[OP_OFFLOAD_STATUS]	= nfsd4_encode_offload_status,
5350 	[OP_READ_PLUS]		= nfsd4_encode_read_plus,
5351 	[OP_SEEK]		= nfsd4_encode_seek,
5352 	[OP_WRITE_SAME]		= nfsd4_encode_noop,
5353 	[OP_CLONE]		= nfsd4_encode_noop,
5354 
5355 	/* RFC 8276 extended atributes operations */
5356 	[OP_GETXATTR]		= nfsd4_encode_getxattr,
5357 	[OP_SETXATTR]		= nfsd4_encode_setxattr,
5358 	[OP_LISTXATTRS]		= nfsd4_encode_listxattrs,
5359 	[OP_REMOVEXATTR]	= nfsd4_encode_removexattr,
5360 };
5361 
5362 /*
5363  * Calculate whether we still have space to encode repsize bytes.
5364  * There are two considerations:
5365  *     - For NFS versions >=4.1, the size of the reply must stay within
5366  *       session limits
5367  *     - For all NFS versions, we must stay within limited preallocated
5368  *       buffer space.
5369  *
5370  * This is called before the operation is processed, so can only provide
5371  * an upper estimate.  For some nonidempotent operations (such as
5372  * getattr), it's not necessarily a problem if that estimate is wrong,
5373  * as we can fail it after processing without significant side effects.
5374  */
5375 __be32 nfsd4_check_resp_size(struct nfsd4_compoundres *resp, u32 respsize)
5376 {
5377 	struct xdr_buf *buf = &resp->rqstp->rq_res;
5378 	struct nfsd4_slot *slot = resp->cstate.slot;
5379 
5380 	if (buf->len + respsize <= buf->buflen)
5381 		return nfs_ok;
5382 	if (!nfsd4_has_session(&resp->cstate))
5383 		return nfserr_resource;
5384 	if (slot->sl_flags & NFSD4_SLOT_CACHETHIS) {
5385 		WARN_ON_ONCE(1);
5386 		return nfserr_rep_too_big_to_cache;
5387 	}
5388 	return nfserr_rep_too_big;
5389 }
5390 
5391 void
5392 nfsd4_encode_operation(struct nfsd4_compoundres *resp, struct nfsd4_op *op)
5393 {
5394 	struct xdr_stream *xdr = resp->xdr;
5395 	struct nfs4_stateowner *so = resp->cstate.replay_owner;
5396 	struct svc_rqst *rqstp = resp->rqstp;
5397 	const struct nfsd4_operation *opdesc = op->opdesc;
5398 	int post_err_offset;
5399 	nfsd4_enc encoder;
5400 	__be32 *p;
5401 
5402 	p = xdr_reserve_space(xdr, 8);
5403 	if (!p) {
5404 		WARN_ON_ONCE(1);
5405 		return;
5406 	}
5407 	*p++ = cpu_to_be32(op->opnum);
5408 	post_err_offset = xdr->buf->len;
5409 
5410 	if (op->opnum == OP_ILLEGAL)
5411 		goto status;
5412 	if (op->status && opdesc &&
5413 			!(opdesc->op_flags & OP_NONTRIVIAL_ERROR_ENCODE))
5414 		goto status;
5415 	BUG_ON(op->opnum >= ARRAY_SIZE(nfsd4_enc_ops) ||
5416 	       !nfsd4_enc_ops[op->opnum]);
5417 	encoder = nfsd4_enc_ops[op->opnum];
5418 	op->status = encoder(resp, op->status, &op->u);
5419 	if (op->status)
5420 		trace_nfsd_compound_encode_err(rqstp, op->opnum, op->status);
5421 	if (opdesc && opdesc->op_release)
5422 		opdesc->op_release(&op->u);
5423 	xdr_commit_encode(xdr);
5424 
5425 	/* nfsd4_check_resp_size guarantees enough room for error status */
5426 	if (!op->status) {
5427 		int space_needed = 0;
5428 		if (!nfsd4_last_compound_op(rqstp))
5429 			space_needed = COMPOUND_ERR_SLACK_SPACE;
5430 		op->status = nfsd4_check_resp_size(resp, space_needed);
5431 	}
5432 	if (op->status == nfserr_resource && nfsd4_has_session(&resp->cstate)) {
5433 		struct nfsd4_slot *slot = resp->cstate.slot;
5434 
5435 		if (slot->sl_flags & NFSD4_SLOT_CACHETHIS)
5436 			op->status = nfserr_rep_too_big_to_cache;
5437 		else
5438 			op->status = nfserr_rep_too_big;
5439 	}
5440 	if (op->status == nfserr_resource ||
5441 	    op->status == nfserr_rep_too_big ||
5442 	    op->status == nfserr_rep_too_big_to_cache) {
5443 		/*
5444 		 * The operation may have already been encoded or
5445 		 * partially encoded.  No op returns anything additional
5446 		 * in the case of one of these three errors, so we can
5447 		 * just truncate back to after the status.  But it's a
5448 		 * bug if we had to do this on a non-idempotent op:
5449 		 */
5450 		warn_on_nonidempotent_op(op);
5451 		xdr_truncate_encode(xdr, post_err_offset);
5452 	}
5453 	if (so) {
5454 		int len = xdr->buf->len - post_err_offset;
5455 
5456 		so->so_replay.rp_status = op->status;
5457 		so->so_replay.rp_buflen = len;
5458 		read_bytes_from_xdr_buf(xdr->buf, post_err_offset,
5459 						so->so_replay.rp_buf, len);
5460 	}
5461 status:
5462 	*p = op->status;
5463 }
5464 
5465 /*
5466  * Encode the reply stored in the stateowner reply cache
5467  *
5468  * XDR note: do not encode rp->rp_buflen: the buffer contains the
5469  * previously sent already encoded operation.
5470  */
5471 void
5472 nfsd4_encode_replay(struct xdr_stream *xdr, struct nfsd4_op *op)
5473 {
5474 	__be32 *p;
5475 	struct nfs4_replay *rp = op->replay;
5476 
5477 	p = xdr_reserve_space(xdr, 8 + rp->rp_buflen);
5478 	if (!p) {
5479 		WARN_ON_ONCE(1);
5480 		return;
5481 	}
5482 	*p++ = cpu_to_be32(op->opnum);
5483 	*p++ = rp->rp_status;  /* already xdr'ed */
5484 
5485 	p = xdr_encode_opaque_fixed(p, rp->rp_buf, rp->rp_buflen);
5486 }
5487 
5488 void nfsd4_release_compoundargs(struct svc_rqst *rqstp)
5489 {
5490 	struct nfsd4_compoundargs *args = rqstp->rq_argp;
5491 
5492 	if (args->ops != args->iops) {
5493 		vfree(args->ops);
5494 		args->ops = args->iops;
5495 	}
5496 	while (args->to_free) {
5497 		struct svcxdr_tmpbuf *tb = args->to_free;
5498 		args->to_free = tb->next;
5499 		kfree(tb);
5500 	}
5501 }
5502 
5503 bool
5504 nfs4svc_decode_compoundargs(struct svc_rqst *rqstp, struct xdr_stream *xdr)
5505 {
5506 	struct nfsd4_compoundargs *args = rqstp->rq_argp;
5507 
5508 	/* svcxdr_tmp_alloc */
5509 	args->to_free = NULL;
5510 
5511 	args->xdr = xdr;
5512 	args->ops = args->iops;
5513 	args->rqstp = rqstp;
5514 
5515 	return nfsd4_decode_compound(args);
5516 }
5517 
5518 bool
5519 nfs4svc_encode_compoundres(struct svc_rqst *rqstp, struct xdr_stream *xdr)
5520 {
5521 	struct nfsd4_compoundres *resp = rqstp->rq_resp;
5522 	__be32 *p;
5523 
5524 	/*
5525 	 * Send buffer space for the following items is reserved
5526 	 * at the top of nfsd4_proc_compound().
5527 	 */
5528 	p = resp->statusp;
5529 
5530 	*p++ = resp->cstate.status;
5531 
5532 	rqstp->rq_next_page = xdr->page_ptr + 1;
5533 
5534 	*p++ = htonl(resp->taglen);
5535 	memcpy(p, resp->tag, resp->taglen);
5536 	p += XDR_QUADLEN(resp->taglen);
5537 	*p++ = htonl(resp->opcnt);
5538 
5539 	nfsd4_sequence_done(resp);
5540 	return true;
5541 }
5542