xref: /linux/net/sunrpc/xdr.c (revision 2dbc0838bcf24ca59cabc3130cf3b1d6809cdcd4)
1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  * linux/net/sunrpc/xdr.c
4  *
5  * Generic XDR support.
6  *
7  * Copyright (C) 1995, 1996 Olaf Kirch <okir@monad.swb.de>
8  */
9 
10 #include <linux/module.h>
11 #include <linux/slab.h>
12 #include <linux/types.h>
13 #include <linux/string.h>
14 #include <linux/kernel.h>
15 #include <linux/pagemap.h>
16 #include <linux/errno.h>
17 #include <linux/sunrpc/xdr.h>
18 #include <linux/sunrpc/msg_prot.h>
19 #include <linux/bvec.h>
20 #include <trace/events/sunrpc.h>
21 
22 /*
23  * XDR functions for basic NFS types
24  */
25 __be32 *
26 xdr_encode_netobj(__be32 *p, const struct xdr_netobj *obj)
27 {
28 	unsigned int	quadlen = XDR_QUADLEN(obj->len);
29 
30 	p[quadlen] = 0;		/* zero trailing bytes */
31 	*p++ = cpu_to_be32(obj->len);
32 	memcpy(p, obj->data, obj->len);
33 	return p + XDR_QUADLEN(obj->len);
34 }
35 EXPORT_SYMBOL_GPL(xdr_encode_netobj);
36 
37 __be32 *
38 xdr_decode_netobj(__be32 *p, struct xdr_netobj *obj)
39 {
40 	unsigned int	len;
41 
42 	if ((len = be32_to_cpu(*p++)) > XDR_MAX_NETOBJ)
43 		return NULL;
44 	obj->len  = len;
45 	obj->data = (u8 *) p;
46 	return p + XDR_QUADLEN(len);
47 }
48 EXPORT_SYMBOL_GPL(xdr_decode_netobj);
49 
50 /**
51  * xdr_encode_opaque_fixed - Encode fixed length opaque data
52  * @p: pointer to current position in XDR buffer.
53  * @ptr: pointer to data to encode (or NULL)
54  * @nbytes: size of data.
55  *
56  * Copy the array of data of length nbytes at ptr to the XDR buffer
57  * at position p, then align to the next 32-bit boundary by padding
58  * with zero bytes (see RFC1832).
59  * Note: if ptr is NULL, only the padding is performed.
60  *
61  * Returns the updated current XDR buffer position
62  *
63  */
64 __be32 *xdr_encode_opaque_fixed(__be32 *p, const void *ptr, unsigned int nbytes)
65 {
66 	if (likely(nbytes != 0)) {
67 		unsigned int quadlen = XDR_QUADLEN(nbytes);
68 		unsigned int padding = (quadlen << 2) - nbytes;
69 
70 		if (ptr != NULL)
71 			memcpy(p, ptr, nbytes);
72 		if (padding != 0)
73 			memset((char *)p + nbytes, 0, padding);
74 		p += quadlen;
75 	}
76 	return p;
77 }
78 EXPORT_SYMBOL_GPL(xdr_encode_opaque_fixed);
79 
80 /**
81  * xdr_encode_opaque - Encode variable length opaque data
82  * @p: pointer to current position in XDR buffer.
83  * @ptr: pointer to data to encode (or NULL)
84  * @nbytes: size of data.
85  *
86  * Returns the updated current XDR buffer position
87  */
88 __be32 *xdr_encode_opaque(__be32 *p, const void *ptr, unsigned int nbytes)
89 {
90 	*p++ = cpu_to_be32(nbytes);
91 	return xdr_encode_opaque_fixed(p, ptr, nbytes);
92 }
93 EXPORT_SYMBOL_GPL(xdr_encode_opaque);
94 
95 __be32 *
96 xdr_encode_string(__be32 *p, const char *string)
97 {
98 	return xdr_encode_array(p, string, strlen(string));
99 }
100 EXPORT_SYMBOL_GPL(xdr_encode_string);
101 
102 __be32 *
103 xdr_decode_string_inplace(__be32 *p, char **sp,
104 			  unsigned int *lenp, unsigned int maxlen)
105 {
106 	u32 len;
107 
108 	len = be32_to_cpu(*p++);
109 	if (len > maxlen)
110 		return NULL;
111 	*lenp = len;
112 	*sp = (char *) p;
113 	return p + XDR_QUADLEN(len);
114 }
115 EXPORT_SYMBOL_GPL(xdr_decode_string_inplace);
116 
117 /**
118  * xdr_terminate_string - '\0'-terminate a string residing in an xdr_buf
119  * @buf: XDR buffer where string resides
120  * @len: length of string, in bytes
121  *
122  */
123 void
124 xdr_terminate_string(struct xdr_buf *buf, const u32 len)
125 {
126 	char *kaddr;
127 
128 	kaddr = kmap_atomic(buf->pages[0]);
129 	kaddr[buf->page_base + len] = '\0';
130 	kunmap_atomic(kaddr);
131 }
132 EXPORT_SYMBOL_GPL(xdr_terminate_string);
133 
134 size_t
135 xdr_buf_pagecount(struct xdr_buf *buf)
136 {
137 	if (!buf->page_len)
138 		return 0;
139 	return (buf->page_base + buf->page_len + PAGE_SIZE - 1) >> PAGE_SHIFT;
140 }
141 
142 int
143 xdr_alloc_bvec(struct xdr_buf *buf, gfp_t gfp)
144 {
145 	size_t i, n = xdr_buf_pagecount(buf);
146 
147 	if (n != 0 && buf->bvec == NULL) {
148 		buf->bvec = kmalloc_array(n, sizeof(buf->bvec[0]), gfp);
149 		if (!buf->bvec)
150 			return -ENOMEM;
151 		for (i = 0; i < n; i++) {
152 			buf->bvec[i].bv_page = buf->pages[i];
153 			buf->bvec[i].bv_len = PAGE_SIZE;
154 			buf->bvec[i].bv_offset = 0;
155 		}
156 	}
157 	return 0;
158 }
159 
160 void
161 xdr_free_bvec(struct xdr_buf *buf)
162 {
163 	kfree(buf->bvec);
164 	buf->bvec = NULL;
165 }
166 
167 /**
168  * xdr_inline_pages - Prepare receive buffer for a large reply
169  * @xdr: xdr_buf into which reply will be placed
170  * @offset: expected offset where data payload will start, in bytes
171  * @pages: vector of struct page pointers
172  * @base: offset in first page where receive should start, in bytes
173  * @len: expected size of the upper layer data payload, in bytes
174  *
175  */
176 void
177 xdr_inline_pages(struct xdr_buf *xdr, unsigned int offset,
178 		 struct page **pages, unsigned int base, unsigned int len)
179 {
180 	struct kvec *head = xdr->head;
181 	struct kvec *tail = xdr->tail;
182 	char *buf = (char *)head->iov_base;
183 	unsigned int buflen = head->iov_len;
184 
185 	head->iov_len  = offset;
186 
187 	xdr->pages = pages;
188 	xdr->page_base = base;
189 	xdr->page_len = len;
190 
191 	tail->iov_base = buf + offset;
192 	tail->iov_len = buflen - offset;
193 	if ((xdr->page_len & 3) == 0)
194 		tail->iov_len -= sizeof(__be32);
195 
196 	xdr->buflen += len;
197 }
198 EXPORT_SYMBOL_GPL(xdr_inline_pages);
199 
200 /*
201  * Helper routines for doing 'memmove' like operations on a struct xdr_buf
202  */
203 
204 /**
205  * _shift_data_right_pages
206  * @pages: vector of pages containing both the source and dest memory area.
207  * @pgto_base: page vector address of destination
208  * @pgfrom_base: page vector address of source
209  * @len: number of bytes to copy
210  *
211  * Note: the addresses pgto_base and pgfrom_base are both calculated in
212  *       the same way:
213  *            if a memory area starts at byte 'base' in page 'pages[i]',
214  *            then its address is given as (i << PAGE_SHIFT) + base
215  * Also note: pgfrom_base must be < pgto_base, but the memory areas
216  * 	they point to may overlap.
217  */
218 static void
219 _shift_data_right_pages(struct page **pages, size_t pgto_base,
220 		size_t pgfrom_base, size_t len)
221 {
222 	struct page **pgfrom, **pgto;
223 	char *vfrom, *vto;
224 	size_t copy;
225 
226 	BUG_ON(pgto_base <= pgfrom_base);
227 
228 	pgto_base += len;
229 	pgfrom_base += len;
230 
231 	pgto = pages + (pgto_base >> PAGE_SHIFT);
232 	pgfrom = pages + (pgfrom_base >> PAGE_SHIFT);
233 
234 	pgto_base &= ~PAGE_MASK;
235 	pgfrom_base &= ~PAGE_MASK;
236 
237 	do {
238 		/* Are any pointers crossing a page boundary? */
239 		if (pgto_base == 0) {
240 			pgto_base = PAGE_SIZE;
241 			pgto--;
242 		}
243 		if (pgfrom_base == 0) {
244 			pgfrom_base = PAGE_SIZE;
245 			pgfrom--;
246 		}
247 
248 		copy = len;
249 		if (copy > pgto_base)
250 			copy = pgto_base;
251 		if (copy > pgfrom_base)
252 			copy = pgfrom_base;
253 		pgto_base -= copy;
254 		pgfrom_base -= copy;
255 
256 		vto = kmap_atomic(*pgto);
257 		if (*pgto != *pgfrom) {
258 			vfrom = kmap_atomic(*pgfrom);
259 			memcpy(vto + pgto_base, vfrom + pgfrom_base, copy);
260 			kunmap_atomic(vfrom);
261 		} else
262 			memmove(vto + pgto_base, vto + pgfrom_base, copy);
263 		flush_dcache_page(*pgto);
264 		kunmap_atomic(vto);
265 
266 	} while ((len -= copy) != 0);
267 }
268 
269 /**
270  * _copy_to_pages
271  * @pages: array of pages
272  * @pgbase: page vector address of destination
273  * @p: pointer to source data
274  * @len: length
275  *
276  * Copies data from an arbitrary memory location into an array of pages
277  * The copy is assumed to be non-overlapping.
278  */
279 static void
280 _copy_to_pages(struct page **pages, size_t pgbase, const char *p, size_t len)
281 {
282 	struct page **pgto;
283 	char *vto;
284 	size_t copy;
285 
286 	pgto = pages + (pgbase >> PAGE_SHIFT);
287 	pgbase &= ~PAGE_MASK;
288 
289 	for (;;) {
290 		copy = PAGE_SIZE - pgbase;
291 		if (copy > len)
292 			copy = len;
293 
294 		vto = kmap_atomic(*pgto);
295 		memcpy(vto + pgbase, p, copy);
296 		kunmap_atomic(vto);
297 
298 		len -= copy;
299 		if (len == 0)
300 			break;
301 
302 		pgbase += copy;
303 		if (pgbase == PAGE_SIZE) {
304 			flush_dcache_page(*pgto);
305 			pgbase = 0;
306 			pgto++;
307 		}
308 		p += copy;
309 	}
310 	flush_dcache_page(*pgto);
311 }
312 
313 /**
314  * _copy_from_pages
315  * @p: pointer to destination
316  * @pages: array of pages
317  * @pgbase: offset of source data
318  * @len: length
319  *
320  * Copies data into an arbitrary memory location from an array of pages
321  * The copy is assumed to be non-overlapping.
322  */
323 void
324 _copy_from_pages(char *p, struct page **pages, size_t pgbase, size_t len)
325 {
326 	struct page **pgfrom;
327 	char *vfrom;
328 	size_t copy;
329 
330 	pgfrom = pages + (pgbase >> PAGE_SHIFT);
331 	pgbase &= ~PAGE_MASK;
332 
333 	do {
334 		copy = PAGE_SIZE - pgbase;
335 		if (copy > len)
336 			copy = len;
337 
338 		vfrom = kmap_atomic(*pgfrom);
339 		memcpy(p, vfrom + pgbase, copy);
340 		kunmap_atomic(vfrom);
341 
342 		pgbase += copy;
343 		if (pgbase == PAGE_SIZE) {
344 			pgbase = 0;
345 			pgfrom++;
346 		}
347 		p += copy;
348 
349 	} while ((len -= copy) != 0);
350 }
351 EXPORT_SYMBOL_GPL(_copy_from_pages);
352 
353 /**
354  * xdr_shrink_bufhead
355  * @buf: xdr_buf
356  * @len: bytes to remove from buf->head[0]
357  *
358  * Shrinks XDR buffer's header kvec buf->head[0] by
359  * 'len' bytes. The extra data is not lost, but is instead
360  * moved into the inlined pages and/or the tail.
361  */
362 static unsigned int
363 xdr_shrink_bufhead(struct xdr_buf *buf, size_t len)
364 {
365 	struct kvec *head, *tail;
366 	size_t copy, offs;
367 	unsigned int pglen = buf->page_len;
368 	unsigned int result;
369 
370 	result = 0;
371 	tail = buf->tail;
372 	head = buf->head;
373 
374 	WARN_ON_ONCE(len > head->iov_len);
375 	if (len > head->iov_len)
376 		len = head->iov_len;
377 
378 	/* Shift the tail first */
379 	if (tail->iov_len != 0) {
380 		if (tail->iov_len > len) {
381 			copy = tail->iov_len - len;
382 			memmove((char *)tail->iov_base + len,
383 					tail->iov_base, copy);
384 			result += copy;
385 		}
386 		/* Copy from the inlined pages into the tail */
387 		copy = len;
388 		if (copy > pglen)
389 			copy = pglen;
390 		offs = len - copy;
391 		if (offs >= tail->iov_len)
392 			copy = 0;
393 		else if (copy > tail->iov_len - offs)
394 			copy = tail->iov_len - offs;
395 		if (copy != 0) {
396 			_copy_from_pages((char *)tail->iov_base + offs,
397 					buf->pages,
398 					buf->page_base + pglen + offs - len,
399 					copy);
400 			result += copy;
401 		}
402 		/* Do we also need to copy data from the head into the tail ? */
403 		if (len > pglen) {
404 			offs = copy = len - pglen;
405 			if (copy > tail->iov_len)
406 				copy = tail->iov_len;
407 			memcpy(tail->iov_base,
408 					(char *)head->iov_base +
409 					head->iov_len - offs,
410 					copy);
411 			result += copy;
412 		}
413 	}
414 	/* Now handle pages */
415 	if (pglen != 0) {
416 		if (pglen > len)
417 			_shift_data_right_pages(buf->pages,
418 					buf->page_base + len,
419 					buf->page_base,
420 					pglen - len);
421 		copy = len;
422 		if (len > pglen)
423 			copy = pglen;
424 		_copy_to_pages(buf->pages, buf->page_base,
425 				(char *)head->iov_base + head->iov_len - len,
426 				copy);
427 		result += copy;
428 	}
429 	head->iov_len -= len;
430 	buf->buflen -= len;
431 	/* Have we truncated the message? */
432 	if (buf->len > buf->buflen)
433 		buf->len = buf->buflen;
434 
435 	return result;
436 }
437 
438 /**
439  * xdr_shrink_pagelen
440  * @buf: xdr_buf
441  * @len: bytes to remove from buf->pages
442  *
443  * Shrinks XDR buffer's page array buf->pages by
444  * 'len' bytes. The extra data is not lost, but is instead
445  * moved into the tail.
446  */
447 static unsigned int
448 xdr_shrink_pagelen(struct xdr_buf *buf, size_t len)
449 {
450 	struct kvec *tail;
451 	size_t copy;
452 	unsigned int pglen = buf->page_len;
453 	unsigned int tailbuf_len;
454 	unsigned int result;
455 
456 	result = 0;
457 	tail = buf->tail;
458 	BUG_ON (len > pglen);
459 
460 	tailbuf_len = buf->buflen - buf->head->iov_len - buf->page_len;
461 
462 	/* Shift the tail first */
463 	if (tailbuf_len != 0) {
464 		unsigned int free_space = tailbuf_len - tail->iov_len;
465 
466 		if (len < free_space)
467 			free_space = len;
468 		tail->iov_len += free_space;
469 
470 		copy = len;
471 		if (tail->iov_len > len) {
472 			char *p = (char *)tail->iov_base + len;
473 			memmove(p, tail->iov_base, tail->iov_len - len);
474 			result += tail->iov_len - len;
475 		} else
476 			copy = tail->iov_len;
477 		/* Copy from the inlined pages into the tail */
478 		_copy_from_pages((char *)tail->iov_base,
479 				buf->pages, buf->page_base + pglen - len,
480 				copy);
481 		result += copy;
482 	}
483 	buf->page_len -= len;
484 	buf->buflen -= len;
485 	/* Have we truncated the message? */
486 	if (buf->len > buf->buflen)
487 		buf->len = buf->buflen;
488 
489 	return result;
490 }
491 
492 void
493 xdr_shift_buf(struct xdr_buf *buf, size_t len)
494 {
495 	xdr_shrink_bufhead(buf, len);
496 }
497 EXPORT_SYMBOL_GPL(xdr_shift_buf);
498 
499 /**
500  * xdr_stream_pos - Return the current offset from the start of the xdr_stream
501  * @xdr: pointer to struct xdr_stream
502  */
503 unsigned int xdr_stream_pos(const struct xdr_stream *xdr)
504 {
505 	return (unsigned int)(XDR_QUADLEN(xdr->buf->len) - xdr->nwords) << 2;
506 }
507 EXPORT_SYMBOL_GPL(xdr_stream_pos);
508 
509 /**
510  * xdr_init_encode - Initialize a struct xdr_stream for sending data.
511  * @xdr: pointer to xdr_stream struct
512  * @buf: pointer to XDR buffer in which to encode data
513  * @p: current pointer inside XDR buffer
514  * @rqst: pointer to controlling rpc_rqst, for debugging
515  *
516  * Note: at the moment the RPC client only passes the length of our
517  *	 scratch buffer in the xdr_buf's header kvec. Previously this
518  *	 meant we needed to call xdr_adjust_iovec() after encoding the
519  *	 data. With the new scheme, the xdr_stream manages the details
520  *	 of the buffer length, and takes care of adjusting the kvec
521  *	 length for us.
522  */
523 void xdr_init_encode(struct xdr_stream *xdr, struct xdr_buf *buf, __be32 *p,
524 		     struct rpc_rqst *rqst)
525 {
526 	struct kvec *iov = buf->head;
527 	int scratch_len = buf->buflen - buf->page_len - buf->tail[0].iov_len;
528 
529 	xdr_set_scratch_buffer(xdr, NULL, 0);
530 	BUG_ON(scratch_len < 0);
531 	xdr->buf = buf;
532 	xdr->iov = iov;
533 	xdr->p = (__be32 *)((char *)iov->iov_base + iov->iov_len);
534 	xdr->end = (__be32 *)((char *)iov->iov_base + scratch_len);
535 	BUG_ON(iov->iov_len > scratch_len);
536 
537 	if (p != xdr->p && p != NULL) {
538 		size_t len;
539 
540 		BUG_ON(p < xdr->p || p > xdr->end);
541 		len = (char *)p - (char *)xdr->p;
542 		xdr->p = p;
543 		buf->len += len;
544 		iov->iov_len += len;
545 	}
546 	xdr->rqst = rqst;
547 }
548 EXPORT_SYMBOL_GPL(xdr_init_encode);
549 
550 /**
551  * xdr_commit_encode - Ensure all data is written to buffer
552  * @xdr: pointer to xdr_stream
553  *
554  * We handle encoding across page boundaries by giving the caller a
555  * temporary location to write to, then later copying the data into
556  * place; xdr_commit_encode does that copying.
557  *
558  * Normally the caller doesn't need to call this directly, as the
559  * following xdr_reserve_space will do it.  But an explicit call may be
560  * required at the end of encoding, or any other time when the xdr_buf
561  * data might be read.
562  */
563 void xdr_commit_encode(struct xdr_stream *xdr)
564 {
565 	int shift = xdr->scratch.iov_len;
566 	void *page;
567 
568 	if (shift == 0)
569 		return;
570 	page = page_address(*xdr->page_ptr);
571 	memcpy(xdr->scratch.iov_base, page, shift);
572 	memmove(page, page + shift, (void *)xdr->p - page);
573 	xdr->scratch.iov_len = 0;
574 }
575 EXPORT_SYMBOL_GPL(xdr_commit_encode);
576 
577 static __be32 *xdr_get_next_encode_buffer(struct xdr_stream *xdr,
578 		size_t nbytes)
579 {
580 	__be32 *p;
581 	int space_left;
582 	int frag1bytes, frag2bytes;
583 
584 	if (nbytes > PAGE_SIZE)
585 		goto out_overflow; /* Bigger buffers require special handling */
586 	if (xdr->buf->len + nbytes > xdr->buf->buflen)
587 		goto out_overflow; /* Sorry, we're totally out of space */
588 	frag1bytes = (xdr->end - xdr->p) << 2;
589 	frag2bytes = nbytes - frag1bytes;
590 	if (xdr->iov)
591 		xdr->iov->iov_len += frag1bytes;
592 	else
593 		xdr->buf->page_len += frag1bytes;
594 	xdr->page_ptr++;
595 	xdr->iov = NULL;
596 	/*
597 	 * If the last encode didn't end exactly on a page boundary, the
598 	 * next one will straddle boundaries.  Encode into the next
599 	 * page, then copy it back later in xdr_commit_encode.  We use
600 	 * the "scratch" iov to track any temporarily unused fragment of
601 	 * space at the end of the previous buffer:
602 	 */
603 	xdr->scratch.iov_base = xdr->p;
604 	xdr->scratch.iov_len = frag1bytes;
605 	p = page_address(*xdr->page_ptr);
606 	/*
607 	 * Note this is where the next encode will start after we've
608 	 * shifted this one back:
609 	 */
610 	xdr->p = (void *)p + frag2bytes;
611 	space_left = xdr->buf->buflen - xdr->buf->len;
612 	xdr->end = (void *)p + min_t(int, space_left, PAGE_SIZE);
613 	xdr->buf->page_len += frag2bytes;
614 	xdr->buf->len += nbytes;
615 	return p;
616 out_overflow:
617 	trace_rpc_xdr_overflow(xdr, nbytes);
618 	return NULL;
619 }
620 
621 /**
622  * xdr_reserve_space - Reserve buffer space for sending
623  * @xdr: pointer to xdr_stream
624  * @nbytes: number of bytes to reserve
625  *
626  * Checks that we have enough buffer space to encode 'nbytes' more
627  * bytes of data. If so, update the total xdr_buf length, and
628  * adjust the length of the current kvec.
629  */
630 __be32 * xdr_reserve_space(struct xdr_stream *xdr, size_t nbytes)
631 {
632 	__be32 *p = xdr->p;
633 	__be32 *q;
634 
635 	xdr_commit_encode(xdr);
636 	/* align nbytes on the next 32-bit boundary */
637 	nbytes += 3;
638 	nbytes &= ~3;
639 	q = p + (nbytes >> 2);
640 	if (unlikely(q > xdr->end || q < p))
641 		return xdr_get_next_encode_buffer(xdr, nbytes);
642 	xdr->p = q;
643 	if (xdr->iov)
644 		xdr->iov->iov_len += nbytes;
645 	else
646 		xdr->buf->page_len += nbytes;
647 	xdr->buf->len += nbytes;
648 	return p;
649 }
650 EXPORT_SYMBOL_GPL(xdr_reserve_space);
651 
652 /**
653  * xdr_truncate_encode - truncate an encode buffer
654  * @xdr: pointer to xdr_stream
655  * @len: new length of buffer
656  *
657  * Truncates the xdr stream, so that xdr->buf->len == len,
658  * and xdr->p points at offset len from the start of the buffer, and
659  * head, tail, and page lengths are adjusted to correspond.
660  *
661  * If this means moving xdr->p to a different buffer, we assume that
662  * that the end pointer should be set to the end of the current page,
663  * except in the case of the head buffer when we assume the head
664  * buffer's current length represents the end of the available buffer.
665  *
666  * This is *not* safe to use on a buffer that already has inlined page
667  * cache pages (as in a zero-copy server read reply), except for the
668  * simple case of truncating from one position in the tail to another.
669  *
670  */
671 void xdr_truncate_encode(struct xdr_stream *xdr, size_t len)
672 {
673 	struct xdr_buf *buf = xdr->buf;
674 	struct kvec *head = buf->head;
675 	struct kvec *tail = buf->tail;
676 	int fraglen;
677 	int new;
678 
679 	if (len > buf->len) {
680 		WARN_ON_ONCE(1);
681 		return;
682 	}
683 	xdr_commit_encode(xdr);
684 
685 	fraglen = min_t(int, buf->len - len, tail->iov_len);
686 	tail->iov_len -= fraglen;
687 	buf->len -= fraglen;
688 	if (tail->iov_len) {
689 		xdr->p = tail->iov_base + tail->iov_len;
690 		WARN_ON_ONCE(!xdr->end);
691 		WARN_ON_ONCE(!xdr->iov);
692 		return;
693 	}
694 	WARN_ON_ONCE(fraglen);
695 	fraglen = min_t(int, buf->len - len, buf->page_len);
696 	buf->page_len -= fraglen;
697 	buf->len -= fraglen;
698 
699 	new = buf->page_base + buf->page_len;
700 
701 	xdr->page_ptr = buf->pages + (new >> PAGE_SHIFT);
702 
703 	if (buf->page_len) {
704 		xdr->p = page_address(*xdr->page_ptr);
705 		xdr->end = (void *)xdr->p + PAGE_SIZE;
706 		xdr->p = (void *)xdr->p + (new % PAGE_SIZE);
707 		WARN_ON_ONCE(xdr->iov);
708 		return;
709 	}
710 	if (fraglen)
711 		xdr->end = head->iov_base + head->iov_len;
712 	/* (otherwise assume xdr->end is already set) */
713 	xdr->page_ptr--;
714 	head->iov_len = len;
715 	buf->len = len;
716 	xdr->p = head->iov_base + head->iov_len;
717 	xdr->iov = buf->head;
718 }
719 EXPORT_SYMBOL(xdr_truncate_encode);
720 
721 /**
722  * xdr_restrict_buflen - decrease available buffer space
723  * @xdr: pointer to xdr_stream
724  * @newbuflen: new maximum number of bytes available
725  *
726  * Adjust our idea of how much space is available in the buffer.
727  * If we've already used too much space in the buffer, returns -1.
728  * If the available space is already smaller than newbuflen, returns 0
729  * and does nothing.  Otherwise, adjusts xdr->buf->buflen to newbuflen
730  * and ensures xdr->end is set at most offset newbuflen from the start
731  * of the buffer.
732  */
733 int xdr_restrict_buflen(struct xdr_stream *xdr, int newbuflen)
734 {
735 	struct xdr_buf *buf = xdr->buf;
736 	int left_in_this_buf = (void *)xdr->end - (void *)xdr->p;
737 	int end_offset = buf->len + left_in_this_buf;
738 
739 	if (newbuflen < 0 || newbuflen < buf->len)
740 		return -1;
741 	if (newbuflen > buf->buflen)
742 		return 0;
743 	if (newbuflen < end_offset)
744 		xdr->end = (void *)xdr->end + newbuflen - end_offset;
745 	buf->buflen = newbuflen;
746 	return 0;
747 }
748 EXPORT_SYMBOL(xdr_restrict_buflen);
749 
750 /**
751  * xdr_write_pages - Insert a list of pages into an XDR buffer for sending
752  * @xdr: pointer to xdr_stream
753  * @pages: list of pages
754  * @base: offset of first byte
755  * @len: length of data in bytes
756  *
757  */
758 void xdr_write_pages(struct xdr_stream *xdr, struct page **pages, unsigned int base,
759 		 unsigned int len)
760 {
761 	struct xdr_buf *buf = xdr->buf;
762 	struct kvec *iov = buf->tail;
763 	buf->pages = pages;
764 	buf->page_base = base;
765 	buf->page_len = len;
766 
767 	iov->iov_base = (char *)xdr->p;
768 	iov->iov_len  = 0;
769 	xdr->iov = iov;
770 
771 	if (len & 3) {
772 		unsigned int pad = 4 - (len & 3);
773 
774 		BUG_ON(xdr->p >= xdr->end);
775 		iov->iov_base = (char *)xdr->p + (len & 3);
776 		iov->iov_len  += pad;
777 		len += pad;
778 		*xdr->p++ = 0;
779 	}
780 	buf->buflen += len;
781 	buf->len += len;
782 }
783 EXPORT_SYMBOL_GPL(xdr_write_pages);
784 
785 static void xdr_set_iov(struct xdr_stream *xdr, struct kvec *iov,
786 		unsigned int len)
787 {
788 	if (len > iov->iov_len)
789 		len = iov->iov_len;
790 	xdr->p = (__be32*)iov->iov_base;
791 	xdr->end = (__be32*)(iov->iov_base + len);
792 	xdr->iov = iov;
793 	xdr->page_ptr = NULL;
794 }
795 
796 static int xdr_set_page_base(struct xdr_stream *xdr,
797 		unsigned int base, unsigned int len)
798 {
799 	unsigned int pgnr;
800 	unsigned int maxlen;
801 	unsigned int pgoff;
802 	unsigned int pgend;
803 	void *kaddr;
804 
805 	maxlen = xdr->buf->page_len;
806 	if (base >= maxlen)
807 		return -EINVAL;
808 	maxlen -= base;
809 	if (len > maxlen)
810 		len = maxlen;
811 
812 	base += xdr->buf->page_base;
813 
814 	pgnr = base >> PAGE_SHIFT;
815 	xdr->page_ptr = &xdr->buf->pages[pgnr];
816 	kaddr = page_address(*xdr->page_ptr);
817 
818 	pgoff = base & ~PAGE_MASK;
819 	xdr->p = (__be32*)(kaddr + pgoff);
820 
821 	pgend = pgoff + len;
822 	if (pgend > PAGE_SIZE)
823 		pgend = PAGE_SIZE;
824 	xdr->end = (__be32*)(kaddr + pgend);
825 	xdr->iov = NULL;
826 	return 0;
827 }
828 
829 static void xdr_set_next_page(struct xdr_stream *xdr)
830 {
831 	unsigned int newbase;
832 
833 	newbase = (1 + xdr->page_ptr - xdr->buf->pages) << PAGE_SHIFT;
834 	newbase -= xdr->buf->page_base;
835 
836 	if (xdr_set_page_base(xdr, newbase, PAGE_SIZE) < 0)
837 		xdr_set_iov(xdr, xdr->buf->tail, xdr->nwords << 2);
838 }
839 
840 static bool xdr_set_next_buffer(struct xdr_stream *xdr)
841 {
842 	if (xdr->page_ptr != NULL)
843 		xdr_set_next_page(xdr);
844 	else if (xdr->iov == xdr->buf->head) {
845 		if (xdr_set_page_base(xdr, 0, PAGE_SIZE) < 0)
846 			xdr_set_iov(xdr, xdr->buf->tail, xdr->nwords << 2);
847 	}
848 	return xdr->p != xdr->end;
849 }
850 
851 /**
852  * xdr_init_decode - Initialize an xdr_stream for decoding data.
853  * @xdr: pointer to xdr_stream struct
854  * @buf: pointer to XDR buffer from which to decode data
855  * @p: current pointer inside XDR buffer
856  * @rqst: pointer to controlling rpc_rqst, for debugging
857  */
858 void xdr_init_decode(struct xdr_stream *xdr, struct xdr_buf *buf, __be32 *p,
859 		     struct rpc_rqst *rqst)
860 {
861 	xdr->buf = buf;
862 	xdr->scratch.iov_base = NULL;
863 	xdr->scratch.iov_len = 0;
864 	xdr->nwords = XDR_QUADLEN(buf->len);
865 	if (buf->head[0].iov_len != 0)
866 		xdr_set_iov(xdr, buf->head, buf->len);
867 	else if (buf->page_len != 0)
868 		xdr_set_page_base(xdr, 0, buf->len);
869 	else
870 		xdr_set_iov(xdr, buf->head, buf->len);
871 	if (p != NULL && p > xdr->p && xdr->end >= p) {
872 		xdr->nwords -= p - xdr->p;
873 		xdr->p = p;
874 	}
875 	xdr->rqst = rqst;
876 }
877 EXPORT_SYMBOL_GPL(xdr_init_decode);
878 
879 /**
880  * xdr_init_decode_pages - Initialize an xdr_stream for decoding into pages
881  * @xdr: pointer to xdr_stream struct
882  * @buf: pointer to XDR buffer from which to decode data
883  * @pages: list of pages to decode into
884  * @len: length in bytes of buffer in pages
885  */
886 void xdr_init_decode_pages(struct xdr_stream *xdr, struct xdr_buf *buf,
887 			   struct page **pages, unsigned int len)
888 {
889 	memset(buf, 0, sizeof(*buf));
890 	buf->pages =  pages;
891 	buf->page_len =  len;
892 	buf->buflen =  len;
893 	buf->len = len;
894 	xdr_init_decode(xdr, buf, NULL, NULL);
895 }
896 EXPORT_SYMBOL_GPL(xdr_init_decode_pages);
897 
898 static __be32 * __xdr_inline_decode(struct xdr_stream *xdr, size_t nbytes)
899 {
900 	unsigned int nwords = XDR_QUADLEN(nbytes);
901 	__be32 *p = xdr->p;
902 	__be32 *q = p + nwords;
903 
904 	if (unlikely(nwords > xdr->nwords || q > xdr->end || q < p))
905 		return NULL;
906 	xdr->p = q;
907 	xdr->nwords -= nwords;
908 	return p;
909 }
910 
911 /**
912  * xdr_set_scratch_buffer - Attach a scratch buffer for decoding data.
913  * @xdr: pointer to xdr_stream struct
914  * @buf: pointer to an empty buffer
915  * @buflen: size of 'buf'
916  *
917  * The scratch buffer is used when decoding from an array of pages.
918  * If an xdr_inline_decode() call spans across page boundaries, then
919  * we copy the data into the scratch buffer in order to allow linear
920  * access.
921  */
922 void xdr_set_scratch_buffer(struct xdr_stream *xdr, void *buf, size_t buflen)
923 {
924 	xdr->scratch.iov_base = buf;
925 	xdr->scratch.iov_len = buflen;
926 }
927 EXPORT_SYMBOL_GPL(xdr_set_scratch_buffer);
928 
929 static __be32 *xdr_copy_to_scratch(struct xdr_stream *xdr, size_t nbytes)
930 {
931 	__be32 *p;
932 	char *cpdest = xdr->scratch.iov_base;
933 	size_t cplen = (char *)xdr->end - (char *)xdr->p;
934 
935 	if (nbytes > xdr->scratch.iov_len)
936 		goto out_overflow;
937 	p = __xdr_inline_decode(xdr, cplen);
938 	if (p == NULL)
939 		return NULL;
940 	memcpy(cpdest, p, cplen);
941 	if (!xdr_set_next_buffer(xdr))
942 		goto out_overflow;
943 	cpdest += cplen;
944 	nbytes -= cplen;
945 	p = __xdr_inline_decode(xdr, nbytes);
946 	if (p == NULL)
947 		return NULL;
948 	memcpy(cpdest, p, nbytes);
949 	return xdr->scratch.iov_base;
950 out_overflow:
951 	trace_rpc_xdr_overflow(xdr, nbytes);
952 	return NULL;
953 }
954 
955 /**
956  * xdr_inline_decode - Retrieve XDR data to decode
957  * @xdr: pointer to xdr_stream struct
958  * @nbytes: number of bytes of data to decode
959  *
960  * Check if the input buffer is long enough to enable us to decode
961  * 'nbytes' more bytes of data starting at the current position.
962  * If so return the current pointer, then update the current
963  * pointer position.
964  */
965 __be32 * xdr_inline_decode(struct xdr_stream *xdr, size_t nbytes)
966 {
967 	__be32 *p;
968 
969 	if (unlikely(nbytes == 0))
970 		return xdr->p;
971 	if (xdr->p == xdr->end && !xdr_set_next_buffer(xdr))
972 		goto out_overflow;
973 	p = __xdr_inline_decode(xdr, nbytes);
974 	if (p != NULL)
975 		return p;
976 	return xdr_copy_to_scratch(xdr, nbytes);
977 out_overflow:
978 	trace_rpc_xdr_overflow(xdr, nbytes);
979 	return NULL;
980 }
981 EXPORT_SYMBOL_GPL(xdr_inline_decode);
982 
983 static unsigned int xdr_align_pages(struct xdr_stream *xdr, unsigned int len)
984 {
985 	struct xdr_buf *buf = xdr->buf;
986 	struct kvec *iov;
987 	unsigned int nwords = XDR_QUADLEN(len);
988 	unsigned int cur = xdr_stream_pos(xdr);
989 	unsigned int copied, offset;
990 
991 	if (xdr->nwords == 0)
992 		return 0;
993 
994 	/* Realign pages to current pointer position */
995 	iov = buf->head;
996 	if (iov->iov_len > cur) {
997 		offset = iov->iov_len - cur;
998 		copied = xdr_shrink_bufhead(buf, offset);
999 		trace_rpc_xdr_alignment(xdr, offset, copied);
1000 		xdr->nwords = XDR_QUADLEN(buf->len - cur);
1001 	}
1002 
1003 	if (nwords > xdr->nwords) {
1004 		nwords = xdr->nwords;
1005 		len = nwords << 2;
1006 	}
1007 	if (buf->page_len <= len)
1008 		len = buf->page_len;
1009 	else if (nwords < xdr->nwords) {
1010 		/* Truncate page data and move it into the tail */
1011 		offset = buf->page_len - len;
1012 		copied = xdr_shrink_pagelen(buf, offset);
1013 		trace_rpc_xdr_alignment(xdr, offset, copied);
1014 		xdr->nwords = XDR_QUADLEN(buf->len - cur);
1015 	}
1016 	return len;
1017 }
1018 
1019 /**
1020  * xdr_read_pages - Ensure page-based XDR data to decode is aligned at current pointer position
1021  * @xdr: pointer to xdr_stream struct
1022  * @len: number of bytes of page data
1023  *
1024  * Moves data beyond the current pointer position from the XDR head[] buffer
1025  * into the page list. Any data that lies beyond current position + "len"
1026  * bytes is moved into the XDR tail[].
1027  *
1028  * Returns the number of XDR encoded bytes now contained in the pages
1029  */
1030 unsigned int xdr_read_pages(struct xdr_stream *xdr, unsigned int len)
1031 {
1032 	struct xdr_buf *buf = xdr->buf;
1033 	struct kvec *iov;
1034 	unsigned int nwords;
1035 	unsigned int end;
1036 	unsigned int padding;
1037 
1038 	len = xdr_align_pages(xdr, len);
1039 	if (len == 0)
1040 		return 0;
1041 	nwords = XDR_QUADLEN(len);
1042 	padding = (nwords << 2) - len;
1043 	xdr->iov = iov = buf->tail;
1044 	/* Compute remaining message length.  */
1045 	end = ((xdr->nwords - nwords) << 2) + padding;
1046 	if (end > iov->iov_len)
1047 		end = iov->iov_len;
1048 
1049 	/*
1050 	 * Position current pointer at beginning of tail, and
1051 	 * set remaining message length.
1052 	 */
1053 	xdr->p = (__be32 *)((char *)iov->iov_base + padding);
1054 	xdr->end = (__be32 *)((char *)iov->iov_base + end);
1055 	xdr->page_ptr = NULL;
1056 	xdr->nwords = XDR_QUADLEN(end - padding);
1057 	return len;
1058 }
1059 EXPORT_SYMBOL_GPL(xdr_read_pages);
1060 
1061 /**
1062  * xdr_enter_page - decode data from the XDR page
1063  * @xdr: pointer to xdr_stream struct
1064  * @len: number of bytes of page data
1065  *
1066  * Moves data beyond the current pointer position from the XDR head[] buffer
1067  * into the page list. Any data that lies beyond current position + "len"
1068  * bytes is moved into the XDR tail[]. The current pointer is then
1069  * repositioned at the beginning of the first XDR page.
1070  */
1071 void xdr_enter_page(struct xdr_stream *xdr, unsigned int len)
1072 {
1073 	len = xdr_align_pages(xdr, len);
1074 	/*
1075 	 * Position current pointer at beginning of tail, and
1076 	 * set remaining message length.
1077 	 */
1078 	if (len != 0)
1079 		xdr_set_page_base(xdr, 0, len);
1080 }
1081 EXPORT_SYMBOL_GPL(xdr_enter_page);
1082 
1083 static struct kvec empty_iov = {.iov_base = NULL, .iov_len = 0};
1084 
1085 void
1086 xdr_buf_from_iov(struct kvec *iov, struct xdr_buf *buf)
1087 {
1088 	buf->head[0] = *iov;
1089 	buf->tail[0] = empty_iov;
1090 	buf->page_len = 0;
1091 	buf->buflen = buf->len = iov->iov_len;
1092 }
1093 EXPORT_SYMBOL_GPL(xdr_buf_from_iov);
1094 
1095 /**
1096  * xdr_buf_subsegment - set subbuf to a portion of buf
1097  * @buf: an xdr buffer
1098  * @subbuf: the result buffer
1099  * @base: beginning of range in bytes
1100  * @len: length of range in bytes
1101  *
1102  * sets @subbuf to an xdr buffer representing the portion of @buf of
1103  * length @len starting at offset @base.
1104  *
1105  * @buf and @subbuf may be pointers to the same struct xdr_buf.
1106  *
1107  * Returns -1 if base of length are out of bounds.
1108  */
1109 int
1110 xdr_buf_subsegment(struct xdr_buf *buf, struct xdr_buf *subbuf,
1111 			unsigned int base, unsigned int len)
1112 {
1113 	subbuf->buflen = subbuf->len = len;
1114 	if (base < buf->head[0].iov_len) {
1115 		subbuf->head[0].iov_base = buf->head[0].iov_base + base;
1116 		subbuf->head[0].iov_len = min_t(unsigned int, len,
1117 						buf->head[0].iov_len - base);
1118 		len -= subbuf->head[0].iov_len;
1119 		base = 0;
1120 	} else {
1121 		base -= buf->head[0].iov_len;
1122 		subbuf->head[0].iov_len = 0;
1123 	}
1124 
1125 	if (base < buf->page_len) {
1126 		subbuf->page_len = min(buf->page_len - base, len);
1127 		base += buf->page_base;
1128 		subbuf->page_base = base & ~PAGE_MASK;
1129 		subbuf->pages = &buf->pages[base >> PAGE_SHIFT];
1130 		len -= subbuf->page_len;
1131 		base = 0;
1132 	} else {
1133 		base -= buf->page_len;
1134 		subbuf->page_len = 0;
1135 	}
1136 
1137 	if (base < buf->tail[0].iov_len) {
1138 		subbuf->tail[0].iov_base = buf->tail[0].iov_base + base;
1139 		subbuf->tail[0].iov_len = min_t(unsigned int, len,
1140 						buf->tail[0].iov_len - base);
1141 		len -= subbuf->tail[0].iov_len;
1142 		base = 0;
1143 	} else {
1144 		base -= buf->tail[0].iov_len;
1145 		subbuf->tail[0].iov_len = 0;
1146 	}
1147 
1148 	if (base || len)
1149 		return -1;
1150 	return 0;
1151 }
1152 EXPORT_SYMBOL_GPL(xdr_buf_subsegment);
1153 
1154 static void __read_bytes_from_xdr_buf(struct xdr_buf *subbuf, void *obj, unsigned int len)
1155 {
1156 	unsigned int this_len;
1157 
1158 	this_len = min_t(unsigned int, len, subbuf->head[0].iov_len);
1159 	memcpy(obj, subbuf->head[0].iov_base, this_len);
1160 	len -= this_len;
1161 	obj += this_len;
1162 	this_len = min_t(unsigned int, len, subbuf->page_len);
1163 	if (this_len)
1164 		_copy_from_pages(obj, subbuf->pages, subbuf->page_base, this_len);
1165 	len -= this_len;
1166 	obj += this_len;
1167 	this_len = min_t(unsigned int, len, subbuf->tail[0].iov_len);
1168 	memcpy(obj, subbuf->tail[0].iov_base, this_len);
1169 }
1170 
1171 /* obj is assumed to point to allocated memory of size at least len: */
1172 int read_bytes_from_xdr_buf(struct xdr_buf *buf, unsigned int base, void *obj, unsigned int len)
1173 {
1174 	struct xdr_buf subbuf;
1175 	int status;
1176 
1177 	status = xdr_buf_subsegment(buf, &subbuf, base, len);
1178 	if (status != 0)
1179 		return status;
1180 	__read_bytes_from_xdr_buf(&subbuf, obj, len);
1181 	return 0;
1182 }
1183 EXPORT_SYMBOL_GPL(read_bytes_from_xdr_buf);
1184 
1185 static void __write_bytes_to_xdr_buf(struct xdr_buf *subbuf, void *obj, unsigned int len)
1186 {
1187 	unsigned int this_len;
1188 
1189 	this_len = min_t(unsigned int, len, subbuf->head[0].iov_len);
1190 	memcpy(subbuf->head[0].iov_base, obj, this_len);
1191 	len -= this_len;
1192 	obj += this_len;
1193 	this_len = min_t(unsigned int, len, subbuf->page_len);
1194 	if (this_len)
1195 		_copy_to_pages(subbuf->pages, subbuf->page_base, obj, this_len);
1196 	len -= this_len;
1197 	obj += this_len;
1198 	this_len = min_t(unsigned int, len, subbuf->tail[0].iov_len);
1199 	memcpy(subbuf->tail[0].iov_base, obj, this_len);
1200 }
1201 
1202 /* obj is assumed to point to allocated memory of size at least len: */
1203 int write_bytes_to_xdr_buf(struct xdr_buf *buf, unsigned int base, void *obj, unsigned int len)
1204 {
1205 	struct xdr_buf subbuf;
1206 	int status;
1207 
1208 	status = xdr_buf_subsegment(buf, &subbuf, base, len);
1209 	if (status != 0)
1210 		return status;
1211 	__write_bytes_to_xdr_buf(&subbuf, obj, len);
1212 	return 0;
1213 }
1214 EXPORT_SYMBOL_GPL(write_bytes_to_xdr_buf);
1215 
1216 int
1217 xdr_decode_word(struct xdr_buf *buf, unsigned int base, u32 *obj)
1218 {
1219 	__be32	raw;
1220 	int	status;
1221 
1222 	status = read_bytes_from_xdr_buf(buf, base, &raw, sizeof(*obj));
1223 	if (status)
1224 		return status;
1225 	*obj = be32_to_cpu(raw);
1226 	return 0;
1227 }
1228 EXPORT_SYMBOL_GPL(xdr_decode_word);
1229 
1230 int
1231 xdr_encode_word(struct xdr_buf *buf, unsigned int base, u32 obj)
1232 {
1233 	__be32	raw = cpu_to_be32(obj);
1234 
1235 	return write_bytes_to_xdr_buf(buf, base, &raw, sizeof(obj));
1236 }
1237 EXPORT_SYMBOL_GPL(xdr_encode_word);
1238 
1239 /* If the netobj starting offset bytes from the start of xdr_buf is contained
1240  * entirely in the head or the tail, set object to point to it; otherwise
1241  * try to find space for it at the end of the tail, copy it there, and
1242  * set obj to point to it. */
1243 int xdr_buf_read_netobj(struct xdr_buf *buf, struct xdr_netobj *obj, unsigned int offset)
1244 {
1245 	struct xdr_buf subbuf;
1246 
1247 	if (xdr_decode_word(buf, offset, &obj->len))
1248 		return -EFAULT;
1249 	if (xdr_buf_subsegment(buf, &subbuf, offset + 4, obj->len))
1250 		return -EFAULT;
1251 
1252 	/* Is the obj contained entirely in the head? */
1253 	obj->data = subbuf.head[0].iov_base;
1254 	if (subbuf.head[0].iov_len == obj->len)
1255 		return 0;
1256 	/* ..or is the obj contained entirely in the tail? */
1257 	obj->data = subbuf.tail[0].iov_base;
1258 	if (subbuf.tail[0].iov_len == obj->len)
1259 		return 0;
1260 
1261 	/* use end of tail as storage for obj:
1262 	 * (We don't copy to the beginning because then we'd have
1263 	 * to worry about doing a potentially overlapping copy.
1264 	 * This assumes the object is at most half the length of the
1265 	 * tail.) */
1266 	if (obj->len > buf->buflen - buf->len)
1267 		return -ENOMEM;
1268 	if (buf->tail[0].iov_len != 0)
1269 		obj->data = buf->tail[0].iov_base + buf->tail[0].iov_len;
1270 	else
1271 		obj->data = buf->head[0].iov_base + buf->head[0].iov_len;
1272 	__read_bytes_from_xdr_buf(&subbuf, obj->data, obj->len);
1273 	return 0;
1274 }
1275 EXPORT_SYMBOL_GPL(xdr_buf_read_netobj);
1276 
1277 /* Returns 0 on success, or else a negative error code. */
1278 static int
1279 xdr_xcode_array2(struct xdr_buf *buf, unsigned int base,
1280 		 struct xdr_array2_desc *desc, int encode)
1281 {
1282 	char *elem = NULL, *c;
1283 	unsigned int copied = 0, todo, avail_here;
1284 	struct page **ppages = NULL;
1285 	int err;
1286 
1287 	if (encode) {
1288 		if (xdr_encode_word(buf, base, desc->array_len) != 0)
1289 			return -EINVAL;
1290 	} else {
1291 		if (xdr_decode_word(buf, base, &desc->array_len) != 0 ||
1292 		    desc->array_len > desc->array_maxlen ||
1293 		    (unsigned long) base + 4 + desc->array_len *
1294 				    desc->elem_size > buf->len)
1295 			return -EINVAL;
1296 	}
1297 	base += 4;
1298 
1299 	if (!desc->xcode)
1300 		return 0;
1301 
1302 	todo = desc->array_len * desc->elem_size;
1303 
1304 	/* process head */
1305 	if (todo && base < buf->head->iov_len) {
1306 		c = buf->head->iov_base + base;
1307 		avail_here = min_t(unsigned int, todo,
1308 				   buf->head->iov_len - base);
1309 		todo -= avail_here;
1310 
1311 		while (avail_here >= desc->elem_size) {
1312 			err = desc->xcode(desc, c);
1313 			if (err)
1314 				goto out;
1315 			c += desc->elem_size;
1316 			avail_here -= desc->elem_size;
1317 		}
1318 		if (avail_here) {
1319 			if (!elem) {
1320 				elem = kmalloc(desc->elem_size, GFP_KERNEL);
1321 				err = -ENOMEM;
1322 				if (!elem)
1323 					goto out;
1324 			}
1325 			if (encode) {
1326 				err = desc->xcode(desc, elem);
1327 				if (err)
1328 					goto out;
1329 				memcpy(c, elem, avail_here);
1330 			} else
1331 				memcpy(elem, c, avail_here);
1332 			copied = avail_here;
1333 		}
1334 		base = buf->head->iov_len;  /* align to start of pages */
1335 	}
1336 
1337 	/* process pages array */
1338 	base -= buf->head->iov_len;
1339 	if (todo && base < buf->page_len) {
1340 		unsigned int avail_page;
1341 
1342 		avail_here = min(todo, buf->page_len - base);
1343 		todo -= avail_here;
1344 
1345 		base += buf->page_base;
1346 		ppages = buf->pages + (base >> PAGE_SHIFT);
1347 		base &= ~PAGE_MASK;
1348 		avail_page = min_t(unsigned int, PAGE_SIZE - base,
1349 					avail_here);
1350 		c = kmap(*ppages) + base;
1351 
1352 		while (avail_here) {
1353 			avail_here -= avail_page;
1354 			if (copied || avail_page < desc->elem_size) {
1355 				unsigned int l = min(avail_page,
1356 					desc->elem_size - copied);
1357 				if (!elem) {
1358 					elem = kmalloc(desc->elem_size,
1359 						       GFP_KERNEL);
1360 					err = -ENOMEM;
1361 					if (!elem)
1362 						goto out;
1363 				}
1364 				if (encode) {
1365 					if (!copied) {
1366 						err = desc->xcode(desc, elem);
1367 						if (err)
1368 							goto out;
1369 					}
1370 					memcpy(c, elem + copied, l);
1371 					copied += l;
1372 					if (copied == desc->elem_size)
1373 						copied = 0;
1374 				} else {
1375 					memcpy(elem + copied, c, l);
1376 					copied += l;
1377 					if (copied == desc->elem_size) {
1378 						err = desc->xcode(desc, elem);
1379 						if (err)
1380 							goto out;
1381 						copied = 0;
1382 					}
1383 				}
1384 				avail_page -= l;
1385 				c += l;
1386 			}
1387 			while (avail_page >= desc->elem_size) {
1388 				err = desc->xcode(desc, c);
1389 				if (err)
1390 					goto out;
1391 				c += desc->elem_size;
1392 				avail_page -= desc->elem_size;
1393 			}
1394 			if (avail_page) {
1395 				unsigned int l = min(avail_page,
1396 					    desc->elem_size - copied);
1397 				if (!elem) {
1398 					elem = kmalloc(desc->elem_size,
1399 						       GFP_KERNEL);
1400 					err = -ENOMEM;
1401 					if (!elem)
1402 						goto out;
1403 				}
1404 				if (encode) {
1405 					if (!copied) {
1406 						err = desc->xcode(desc, elem);
1407 						if (err)
1408 							goto out;
1409 					}
1410 					memcpy(c, elem + copied, l);
1411 					copied += l;
1412 					if (copied == desc->elem_size)
1413 						copied = 0;
1414 				} else {
1415 					memcpy(elem + copied, c, l);
1416 					copied += l;
1417 					if (copied == desc->elem_size) {
1418 						err = desc->xcode(desc, elem);
1419 						if (err)
1420 							goto out;
1421 						copied = 0;
1422 					}
1423 				}
1424 			}
1425 			if (avail_here) {
1426 				kunmap(*ppages);
1427 				ppages++;
1428 				c = kmap(*ppages);
1429 			}
1430 
1431 			avail_page = min(avail_here,
1432 				 (unsigned int) PAGE_SIZE);
1433 		}
1434 		base = buf->page_len;  /* align to start of tail */
1435 	}
1436 
1437 	/* process tail */
1438 	base -= buf->page_len;
1439 	if (todo) {
1440 		c = buf->tail->iov_base + base;
1441 		if (copied) {
1442 			unsigned int l = desc->elem_size - copied;
1443 
1444 			if (encode)
1445 				memcpy(c, elem + copied, l);
1446 			else {
1447 				memcpy(elem + copied, c, l);
1448 				err = desc->xcode(desc, elem);
1449 				if (err)
1450 					goto out;
1451 			}
1452 			todo -= l;
1453 			c += l;
1454 		}
1455 		while (todo) {
1456 			err = desc->xcode(desc, c);
1457 			if (err)
1458 				goto out;
1459 			c += desc->elem_size;
1460 			todo -= desc->elem_size;
1461 		}
1462 	}
1463 	err = 0;
1464 
1465 out:
1466 	kfree(elem);
1467 	if (ppages)
1468 		kunmap(*ppages);
1469 	return err;
1470 }
1471 
1472 int
1473 xdr_decode_array2(struct xdr_buf *buf, unsigned int base,
1474 		  struct xdr_array2_desc *desc)
1475 {
1476 	if (base >= buf->len)
1477 		return -EINVAL;
1478 
1479 	return xdr_xcode_array2(buf, base, desc, 0);
1480 }
1481 EXPORT_SYMBOL_GPL(xdr_decode_array2);
1482 
1483 int
1484 xdr_encode_array2(struct xdr_buf *buf, unsigned int base,
1485 		  struct xdr_array2_desc *desc)
1486 {
1487 	if ((unsigned long) base + 4 + desc->array_len * desc->elem_size >
1488 	    buf->head->iov_len + buf->page_len + buf->tail->iov_len)
1489 		return -EINVAL;
1490 
1491 	return xdr_xcode_array2(buf, base, desc, 1);
1492 }
1493 EXPORT_SYMBOL_GPL(xdr_encode_array2);
1494 
1495 int
1496 xdr_process_buf(struct xdr_buf *buf, unsigned int offset, unsigned int len,
1497 		int (*actor)(struct scatterlist *, void *), void *data)
1498 {
1499 	int i, ret = 0;
1500 	unsigned int page_len, thislen, page_offset;
1501 	struct scatterlist      sg[1];
1502 
1503 	sg_init_table(sg, 1);
1504 
1505 	if (offset >= buf->head[0].iov_len) {
1506 		offset -= buf->head[0].iov_len;
1507 	} else {
1508 		thislen = buf->head[0].iov_len - offset;
1509 		if (thislen > len)
1510 			thislen = len;
1511 		sg_set_buf(sg, buf->head[0].iov_base + offset, thislen);
1512 		ret = actor(sg, data);
1513 		if (ret)
1514 			goto out;
1515 		offset = 0;
1516 		len -= thislen;
1517 	}
1518 	if (len == 0)
1519 		goto out;
1520 
1521 	if (offset >= buf->page_len) {
1522 		offset -= buf->page_len;
1523 	} else {
1524 		page_len = buf->page_len - offset;
1525 		if (page_len > len)
1526 			page_len = len;
1527 		len -= page_len;
1528 		page_offset = (offset + buf->page_base) & (PAGE_SIZE - 1);
1529 		i = (offset + buf->page_base) >> PAGE_SHIFT;
1530 		thislen = PAGE_SIZE - page_offset;
1531 		do {
1532 			if (thislen > page_len)
1533 				thislen = page_len;
1534 			sg_set_page(sg, buf->pages[i], thislen, page_offset);
1535 			ret = actor(sg, data);
1536 			if (ret)
1537 				goto out;
1538 			page_len -= thislen;
1539 			i++;
1540 			page_offset = 0;
1541 			thislen = PAGE_SIZE;
1542 		} while (page_len != 0);
1543 		offset = 0;
1544 	}
1545 	if (len == 0)
1546 		goto out;
1547 	if (offset < buf->tail[0].iov_len) {
1548 		thislen = buf->tail[0].iov_len - offset;
1549 		if (thislen > len)
1550 			thislen = len;
1551 		sg_set_buf(sg, buf->tail[0].iov_base + offset, thislen);
1552 		ret = actor(sg, data);
1553 		len -= thislen;
1554 	}
1555 	if (len != 0)
1556 		ret = -EINVAL;
1557 out:
1558 	return ret;
1559 }
1560 EXPORT_SYMBOL_GPL(xdr_process_buf);
1561 
1562 /**
1563  * xdr_stream_decode_opaque - Decode variable length opaque
1564  * @xdr: pointer to xdr_stream
1565  * @ptr: location to store opaque data
1566  * @size: size of storage buffer @ptr
1567  *
1568  * Return values:
1569  *   On success, returns size of object stored in *@ptr
1570  *   %-EBADMSG on XDR buffer overflow
1571  *   %-EMSGSIZE on overflow of storage buffer @ptr
1572  */
1573 ssize_t xdr_stream_decode_opaque(struct xdr_stream *xdr, void *ptr, size_t size)
1574 {
1575 	ssize_t ret;
1576 	void *p;
1577 
1578 	ret = xdr_stream_decode_opaque_inline(xdr, &p, size);
1579 	if (ret <= 0)
1580 		return ret;
1581 	memcpy(ptr, p, ret);
1582 	return ret;
1583 }
1584 EXPORT_SYMBOL_GPL(xdr_stream_decode_opaque);
1585 
1586 /**
1587  * xdr_stream_decode_opaque_dup - Decode and duplicate variable length opaque
1588  * @xdr: pointer to xdr_stream
1589  * @ptr: location to store pointer to opaque data
1590  * @maxlen: maximum acceptable object size
1591  * @gfp_flags: GFP mask to use
1592  *
1593  * Return values:
1594  *   On success, returns size of object stored in *@ptr
1595  *   %-EBADMSG on XDR buffer overflow
1596  *   %-EMSGSIZE if the size of the object would exceed @maxlen
1597  *   %-ENOMEM on memory allocation failure
1598  */
1599 ssize_t xdr_stream_decode_opaque_dup(struct xdr_stream *xdr, void **ptr,
1600 		size_t maxlen, gfp_t gfp_flags)
1601 {
1602 	ssize_t ret;
1603 	void *p;
1604 
1605 	ret = xdr_stream_decode_opaque_inline(xdr, &p, maxlen);
1606 	if (ret > 0) {
1607 		*ptr = kmemdup(p, ret, gfp_flags);
1608 		if (*ptr != NULL)
1609 			return ret;
1610 		ret = -ENOMEM;
1611 	}
1612 	*ptr = NULL;
1613 	return ret;
1614 }
1615 EXPORT_SYMBOL_GPL(xdr_stream_decode_opaque_dup);
1616 
1617 /**
1618  * xdr_stream_decode_string - Decode variable length string
1619  * @xdr: pointer to xdr_stream
1620  * @str: location to store string
1621  * @size: size of storage buffer @str
1622  *
1623  * Return values:
1624  *   On success, returns length of NUL-terminated string stored in *@str
1625  *   %-EBADMSG on XDR buffer overflow
1626  *   %-EMSGSIZE on overflow of storage buffer @str
1627  */
1628 ssize_t xdr_stream_decode_string(struct xdr_stream *xdr, char *str, size_t size)
1629 {
1630 	ssize_t ret;
1631 	void *p;
1632 
1633 	ret = xdr_stream_decode_opaque_inline(xdr, &p, size);
1634 	if (ret > 0) {
1635 		memcpy(str, p, ret);
1636 		str[ret] = '\0';
1637 		return strlen(str);
1638 	}
1639 	*str = '\0';
1640 	return ret;
1641 }
1642 EXPORT_SYMBOL_GPL(xdr_stream_decode_string);
1643 
1644 /**
1645  * xdr_stream_decode_string_dup - Decode and duplicate variable length string
1646  * @xdr: pointer to xdr_stream
1647  * @str: location to store pointer to string
1648  * @maxlen: maximum acceptable string length
1649  * @gfp_flags: GFP mask to use
1650  *
1651  * Return values:
1652  *   On success, returns length of NUL-terminated string stored in *@ptr
1653  *   %-EBADMSG on XDR buffer overflow
1654  *   %-EMSGSIZE if the size of the string would exceed @maxlen
1655  *   %-ENOMEM on memory allocation failure
1656  */
1657 ssize_t xdr_stream_decode_string_dup(struct xdr_stream *xdr, char **str,
1658 		size_t maxlen, gfp_t gfp_flags)
1659 {
1660 	void *p;
1661 	ssize_t ret;
1662 
1663 	ret = xdr_stream_decode_opaque_inline(xdr, &p, maxlen);
1664 	if (ret > 0) {
1665 		char *s = kmalloc(ret + 1, gfp_flags);
1666 		if (s != NULL) {
1667 			memcpy(s, p, ret);
1668 			s[ret] = '\0';
1669 			*str = s;
1670 			return strlen(s);
1671 		}
1672 		ret = -ENOMEM;
1673 	}
1674 	*str = NULL;
1675 	return ret;
1676 }
1677 EXPORT_SYMBOL_GPL(xdr_stream_decode_string_dup);
1678