1	/*
2	* Server-side procedures for NFSv4.
3	*
4	* Copyright (c) 2002 The Regents of the University of Michigan.
5	* All rights reserved.
6	*
7	* Kendrick Smith <kmsmith@umich.edu>
8	* Andy Adamson <andros@umich.edu>
9	*
10	* Redistribution and use in source and binary forms, with or without
11	* modification, are permitted provided that the following conditions
12	* are met:
13	*
14	* 1. Redistributions of source code must retain the above copyright
15	* notice, this list of conditions and the following disclaimer.
16	* 2. Redistributions in binary form must reproduce the above copyright
17	* notice, this list of conditions and the following disclaimer in the
18	* documentation and/or other materials provided with the distribution.
19	* 3. Neither the name of the University nor the names of its
20	* contributors may be used to endorse or promote products derived
21	* from this software without specific prior written permission.
22	*
23	* THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
24	* WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
25	* MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
26	* DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
27	* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
28	* CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
29	* SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
30	* BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
31	* LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
32	* NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
33	* SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
34	*/
35	#include <linux/fs_struct.h>
36	#include <linux/file.h>
37	#include <linux/falloc.h>
38	#include <linux/slab.h>
39	#include <linux/kthread.h>
40	#include <linux/namei.h>
41
42	#include <linux/sunrpc/addr.h>
43	#include <linux/nfs_ssc.h>
44
45	#include "idmap.h"
46	#include "cache.h"
47	#include "xdr4.h"
48	#include "vfs.h"
49	#include "current_stateid.h"
50	#include "netns.h"
51	#include "acl.h"
52	#include "pnfs.h"
53	#include "trace.h"
54
55	static bool inter_copy_offload_enable;
56	module_param(inter_copy_offload_enable, bool, 0644);
57	MODULE_PARM_DESC(inter_copy_offload_enable,
58	"Enable inter server to server copy offload. Default: false");
59
60	#ifdef CONFIG_NFSD_V4_2_INTER_SSC
61	static int nfsd4_ssc_umount_timeout = 900000; /* default to 15 mins */
62	module_param(nfsd4_ssc_umount_timeout, int, 0644);
63	MODULE_PARM_DESC(nfsd4_ssc_umount_timeout,
64	"idle msecs before unmount export from source server");
65	#endif
66
67	#define NFSDDBG_FACILITY NFSDDBG_PROC
68
69	static u32 nfsd_attrmask[] = {
70	NFSD_WRITEABLE_ATTRS_WORD0,
71	NFSD_WRITEABLE_ATTRS_WORD1,
72	NFSD_WRITEABLE_ATTRS_WORD2
73	};
74
75	static u32 nfsd41_ex_attrmask[] = {
76	NFSD_SUPPATTR_EXCLCREAT_WORD0,
77	NFSD_SUPPATTR_EXCLCREAT_WORD1,
78	NFSD_SUPPATTR_EXCLCREAT_WORD2
79	};
80
81	static __be32
82	check_attr_support(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
83	u32 *bmval, u32 *writable)
84	{
85	struct dentry *dentry = cstate->current_fh.fh_dentry;
86	struct svc_export *exp = cstate->current_fh.fh_export;
87
88	if (!nfsd_attrs_supported(minorversion: cstate->minorversion, bmval))
89	return nfserr_attrnotsupp;
90	if ((bmval[0] & FATTR4_WORD0_ACL) && !IS_POSIXACL(d_inode(dentry)))
91	return nfserr_attrnotsupp;
92	if ((bmval[2] & FATTR4_WORD2_SECURITY_LABEL) &&
93	!(exp->ex_flags & NFSEXP_SECURITY_LABEL))
94	return nfserr_attrnotsupp;
95	if (writable && !bmval_is_subset(bm1: bmval, bm2: writable))
96	return nfserr_inval;
97	if (writable && (bmval[2] & FATTR4_WORD2_MODE_UMASK) &&
98	(bmval[1] & FATTR4_WORD1_MODE))
99	return nfserr_inval;
100	return nfs_ok;
101	}
102
103	static __be32
104	nfsd4_check_open_attributes(struct svc_rqst *rqstp,
105	struct nfsd4_compound_state *cstate, struct nfsd4_open *open)
106	{
107	__be32 status = nfs_ok;
108
109	if (open->op_create == NFS4_OPEN_CREATE) {
110	if (open->op_createmode == NFS4_CREATE_UNCHECKED
111	|| open->op_createmode == NFS4_CREATE_GUARDED)
112	status = check_attr_support(rqstp, cstate,
113	bmval: open->op_bmval, writable: nfsd_attrmask);
114	else if (open->op_createmode == NFS4_CREATE_EXCLUSIVE4_1)
115	status = check_attr_support(rqstp, cstate,
116	bmval: open->op_bmval, writable: nfsd41_ex_attrmask);
117	}
118
119	return status;
120	}
121
122	static int
123	is_create_with_attrs(struct nfsd4_open *open)
124	{
125	return open->op_create == NFS4_OPEN_CREATE
126	&& (open->op_createmode == NFS4_CREATE_UNCHECKED
127	|| open->op_createmode == NFS4_CREATE_GUARDED
128	|| open->op_createmode == NFS4_CREATE_EXCLUSIVE4_1);
129	}
130
131	static inline void
132	fh_dup2(struct svc_fh *dst, struct svc_fh *src)
133	{
134	fh_put(dst);
135	dget(dentry: src->fh_dentry);
136	if (src->fh_export)
137	exp_get(exp: src->fh_export);
138	*dst = *src;
139	}
140
141	static __be32
142	do_open_permission(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_open *open, int accmode)
143	{
144
145	if (open->op_truncate &&
146	!(open->op_share_access & NFS4_SHARE_ACCESS_WRITE))
147	return nfserr_inval;
148
149	accmode |= NFSD_MAY_READ_IF_EXEC;
150
151	if (open->op_share_access & NFS4_SHARE_ACCESS_READ)
152	accmode |= NFSD_MAY_READ;
153	if (open->op_share_access & NFS4_SHARE_ACCESS_WRITE)
154	accmode |= (NFSD_MAY_WRITE | NFSD_MAY_TRUNC);
155	if (open->op_share_deny & NFS4_SHARE_DENY_READ)
156	accmode |= NFSD_MAY_WRITE;
157
158	return fh_verify(rqstp, current_fh, S_IFREG, accmode);
159	}
160
161	static __be32 nfsd_check_obj_isreg(struct svc_fh *fh)
162	{
163	umode_t mode = d_inode(dentry: fh->fh_dentry)->i_mode;
164
165	if (S_ISREG(mode))
166	return nfs_ok;
167	if (S_ISDIR(mode))
168	return nfserr_isdir;
169	/*
170	* Using err_symlink as our catch-all case may look odd; but
171	* there's no other obvious error for this case in 4.0, and we
172	* happen to know that it will cause the linux v4 client to do
173	* the right thing on attempts to open something other than a
174	* regular file.
175	*/
176	return nfserr_symlink;
177	}
178
179	static void nfsd4_set_open_owner_reply_cache(struct nfsd4_compound_state *cstate, struct nfsd4_open *open, struct svc_fh *resfh)
180	{
181	if (nfsd4_has_session(cs: cstate))
182	return;
183	fh_copy_shallow(dst: &open->op_openowner->oo_owner.so_replay.rp_openfh,
184	src: &resfh->fh_handle);
185	}
186
187	static inline bool nfsd4_create_is_exclusive(int createmode)
188	{
189	return createmode == NFS4_CREATE_EXCLUSIVE ||
190	createmode == NFS4_CREATE_EXCLUSIVE4_1;
191	}
192
193	static __be32
194	nfsd4_vfs_create(struct svc_fh *fhp, struct dentry *child,
195	struct nfsd4_open *open)
196	{
197	struct file *filp;
198	struct path path;
199	int oflags;
200
201	oflags = O_CREAT | O_LARGEFILE;
202	switch (open->op_share_access & NFS4_SHARE_ACCESS_BOTH) {
203	case NFS4_SHARE_ACCESS_WRITE:
204	oflags |= O_WRONLY;
205	break;
206	case NFS4_SHARE_ACCESS_BOTH:
207	oflags |= O_RDWR;
208	break;
209	default:
210	oflags |= O_RDONLY;
211	}
212
213	path.mnt = fhp->fh_export->ex_path.mnt;
214	path.dentry = child;
215	filp = dentry_create(path: &path, flags: oflags, mode: open->op_iattr.ia_mode,
216	current_cred());
217	if (IS_ERR(ptr: filp))
218	return nfserrno(errno: PTR_ERR(ptr: filp));
219
220	open->op_filp = filp;
221	return nfs_ok;
222	}
223
224	/*
225	* Implement NFSv4's unchecked, guarded, and exclusive create
226	* semantics for regular files. Open state for this new file is
227	* subsequently fabricated in nfsd4_process_open2().
228	*
229	* Upon return, caller must release @fhp and @resfhp.
230	*/
231	static __be32
232	nfsd4_create_file(struct svc_rqst *rqstp, struct svc_fh *fhp,
233	struct svc_fh *resfhp, struct nfsd4_open *open)
234	{
235	struct iattr *iap = &open->op_iattr;
236	struct nfsd_attrs attrs = {
237	.na_iattr = iap,
238	.na_seclabel = &open->op_label,
239	};
240	struct dentry *parent, *child;
241	__u32 v_mtime, v_atime;
242	struct inode *inode;
243	__be32 status;
244	int host_err;
245
246	if (isdotent(open->op_fname, open->op_fnamelen))
247	return nfserr_exist;
248	if (!(iap->ia_valid & ATTR_MODE))
249	iap->ia_mode = 0;
250
251	status = fh_verify(rqstp, fhp, S_IFDIR, NFSD_MAY_EXEC);
252	if (status != nfs_ok)
253	return status;
254	parent = fhp->fh_dentry;
255	inode = d_inode(dentry: parent);
256
257	host_err = fh_want_write(fh: fhp);
258	if (host_err)
259	return nfserrno(errno: host_err);
260
261	if (is_create_with_attrs(open))
262	nfsd4_acl_to_attr(type: NF4REG, acl: open->op_acl, attr: &attrs);
263
264	inode_lock_nested(inode, subclass: I_MUTEX_PARENT);
265
266	child = lookup_one_len(open->op_fname, parent, open->op_fnamelen);
267	if (IS_ERR(ptr: child)) {
268	status = nfserrno(errno: PTR_ERR(ptr: child));
269	goto out;
270	}
271
272	if (d_really_is_negative(dentry: child)) {
273	status = fh_verify(rqstp, fhp, S_IFDIR, NFSD_MAY_CREATE);
274	if (status != nfs_ok)
275	goto out;
276	}
277
278	status = fh_compose(resfhp, fhp->fh_export, child, fhp);
279	if (status != nfs_ok)
280	goto out;
281
282	v_mtime = 0;
283	v_atime = 0;
284	if (nfsd4_create_is_exclusive(createmode: open->op_createmode)) {
285	u32 *verifier = (u32 *)open->op_verf.data;
286
287	/*
288	* Solaris 7 gets confused (bugid 4218508) if these have
289	* the high bit set, as do xfs filesystems without the
290	* "bigtime" feature. So just clear the high bits. If this
291	* is ever changed to use different attrs for storing the
292	* verifier, then do_open_lookup() will also need to be
293	* fixed accordingly.
294	*/
295	v_mtime = verifier[0] & 0x7fffffff;
296	v_atime = verifier[1] & 0x7fffffff;
297	}
298
299	if (d_really_is_positive(dentry: child)) {
300	/* NFSv4 protocol requires change attributes even though
301	* no change happened.
302	*/
303	status = fh_fill_both_attrs(fhp);
304	if (status != nfs_ok)
305	goto out;
306
307	switch (open->op_createmode) {
308	case NFS4_CREATE_UNCHECKED:
309	if (!d_is_reg(dentry: child))
310	break;
311
312	/*
313	* In NFSv4, we don't want to truncate the file
314	* now. This would be wrong if the OPEN fails for
315	* some other reason. Furthermore, if the size is
316	* nonzero, we should ignore it according to spec!
317	*/
318	open->op_truncate = (iap->ia_valid & ATTR_SIZE) &&
319	!iap->ia_size;
320	break;
321	case NFS4_CREATE_GUARDED:
322	status = nfserr_exist;
323	break;
324	case NFS4_CREATE_EXCLUSIVE:
325	if (inode_get_mtime_sec(inode: d_inode(dentry: child)) == v_mtime &&
326	inode_get_atime_sec(inode: d_inode(dentry: child)) == v_atime &&
327	d_inode(dentry: child)->i_size == 0) {
328	open->op_created = true;
329	break; /* subtle */
330	}
331	status = nfserr_exist;
332	break;
333	case NFS4_CREATE_EXCLUSIVE4_1:
334	if (inode_get_mtime_sec(inode: d_inode(dentry: child)) == v_mtime &&
335	inode_get_atime_sec(inode: d_inode(dentry: child)) == v_atime &&
336	d_inode(dentry: child)->i_size == 0) {
337	open->op_created = true;
338	goto set_attr; /* subtle */
339	}
340	status = nfserr_exist;
341	}
342	goto out;
343	}
344
345	if (!IS_POSIXACL(inode))
346	iap->ia_mode &= ~current_umask();
347
348	status = fh_fill_pre_attrs(fhp);
349	if (status != nfs_ok)
350	goto out;
351	status = nfsd4_vfs_create(fhp, child, open);
352	if (status != nfs_ok)
353	goto out;
354	open->op_created = true;
355	fh_fill_post_attrs(fhp);
356
357	/* A newly created file already has a file size of zero. */
358	if ((iap->ia_valid & ATTR_SIZE) && (iap->ia_size == 0))
359	iap->ia_valid &= ~ATTR_SIZE;
360	if (nfsd4_create_is_exclusive(createmode: open->op_createmode)) {
361	iap->ia_valid = ATTR_MTIME | ATTR_ATIME |
362	ATTR_MTIME_SET|ATTR_ATIME_SET;
363	iap->ia_mtime.tv_sec = v_mtime;
364	iap->ia_atime.tv_sec = v_atime;
365	iap->ia_mtime.tv_nsec = 0;
366	iap->ia_atime.tv_nsec = 0;
367	}
368
369	set_attr:
370	status = nfsd_create_setattr(rqstp, fhp, resfhp, iap: &attrs);
371
372	if (attrs.na_labelerr)
373	open->op_bmval[2] &= ~FATTR4_WORD2_SECURITY_LABEL;
374	if (attrs.na_aclerr)
375	open->op_bmval[0] &= ~FATTR4_WORD0_ACL;
376	out:
377	inode_unlock(inode);
378	nfsd_attrs_free(attrs: &attrs);
379	if (child && !IS_ERR(ptr: child))
380	dput(child);
381	fh_drop_write(fh: fhp);
382	return status;
383	}
384
385	/**
386	* set_change_info - set up the change_info4 for a reply
387	* @cinfo: pointer to nfsd4_change_info to be populated
388	* @fhp: pointer to svc_fh to use as source
389	*
390	* Many operations in NFSv4 require change_info4 in the reply. This function
391	* populates that from the info that we (should!) have already collected. In
392	* the event that we didn't get any pre-attrs, just zero out both.
393	*/
394	static void
395	set_change_info(struct nfsd4_change_info *cinfo, struct svc_fh *fhp)
396	{
397	cinfo->atomic = (u32)(fhp->fh_pre_saved && fhp->fh_post_saved && !fhp->fh_no_atomic_attr);
398	cinfo->before_change = fhp->fh_pre_change;
399	cinfo->after_change = fhp->fh_post_change;
400
401	/*
402	* If fetching the pre-change attributes failed, then we should
403	* have already failed the whole operation. We could have still
404	* failed to fetch post-change attributes however.
405	*
406	* If we didn't get post-op attrs, just zero-out the after
407	* field since we don't know what it should be. If the pre_saved
408	* field isn't set for some reason, throw warning and just copy
409	* whatever is in the after field.
410	*/
411	if (WARN_ON_ONCE(!fhp->fh_pre_saved))
412	cinfo->before_change = 0;
413	if (!fhp->fh_post_saved)
414	cinfo->after_change = cinfo->before_change + 1;
415	}
416
417	static __be32
418	do_open_lookup(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, struct nfsd4_open *open, struct svc_fh **resfh)
419	{
420	struct svc_fh *current_fh = &cstate->current_fh;
421	int accmode;
422	__be32 status;
423
424	*resfh = kmalloc(size: sizeof(struct svc_fh), GFP_KERNEL);
425	if (!*resfh)
426	return nfserr_jukebox;
427	fh_init(fhp: *resfh, NFS4_FHSIZE);
428	open->op_truncate = false;
429
430	if (open->op_create) {
431	/* FIXME: check session persistence and pnfs flags.
432	* The nfsv4.1 spec requires the following semantics:
433	*
434	* Persistent | pNFS | Server REQUIRED | Client Allowed
435	* Reply Cache | server | |
436	* -------------+--------+-----------------+--------------------
437	* no | no | EXCLUSIVE4_1 | EXCLUSIVE4_1
438	* | | | (SHOULD)
439	* | | and EXCLUSIVE4 | or EXCLUSIVE4
440	* | | | (SHOULD NOT)
441	* no | yes | EXCLUSIVE4_1 | EXCLUSIVE4_1
442	* yes | no | GUARDED4 | GUARDED4
443	* yes | yes | GUARDED4 | GUARDED4
444	*/
445
446	current->fs->umask = open->op_umask;
447	status = nfsd4_create_file(rqstp, fhp: current_fh, resfhp: *resfh, open);
448	current->fs->umask = 0;
449
450	/*
451	* Following rfc 3530 14.2.16, and rfc 5661 18.16.4
452	* use the returned bitmask to indicate which attributes
453	* we used to store the verifier:
454	*/
455	if (nfsd4_create_is_exclusive(createmode: open->op_createmode) && status == 0)
456	open->op_bmval[1] |= (FATTR4_WORD1_TIME_ACCESS |
457	FATTR4_WORD1_TIME_MODIFY);
458	} else {
459	status = nfsd_lookup(rqstp, current_fh,
460	open->op_fname, open->op_fnamelen, *resfh);
461	if (status == nfs_ok)
462	/* NFSv4 protocol requires change attributes even though
463	* no change happened.
464	*/
465	status = fh_fill_both_attrs(fhp: current_fh);
466	}
467	if (status)
468	goto out;
469	status = nfsd_check_obj_isreg(fh: *resfh);
470	if (status)
471	goto out;
472
473	nfsd4_set_open_owner_reply_cache(cstate, open, resfh: *resfh);
474	accmode = NFSD_MAY_NOP;
475	if (open->op_created ||
476	open->op_claim_type == NFS4_OPEN_CLAIM_DELEGATE_CUR)
477	accmode |= NFSD_MAY_OWNER_OVERRIDE;
478	status = do_open_permission(rqstp, current_fh: *resfh, open, accmode);
479	set_change_info(cinfo: &open->op_cinfo, fhp: current_fh);
480	out:
481	return status;
482	}
483
484	static __be32
485	do_open_fhandle(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, struct nfsd4_open *open)
486	{
487	struct svc_fh *current_fh = &cstate->current_fh;
488	int accmode = 0;
489
490	/* We don't know the target directory, and therefore can not
491	* set the change info
492	*/
493
494	memset(&open->op_cinfo, 0, sizeof(struct nfsd4_change_info));
495
496	nfsd4_set_open_owner_reply_cache(cstate, open, resfh: current_fh);
497
498	open->op_truncate = (open->op_iattr.ia_valid & ATTR_SIZE) &&
499	(open->op_iattr.ia_size == 0);
500	/*
501	* In the delegation case, the client is telling us about an
502	* open that it *already* performed locally, some time ago. We
503	* should let it succeed now if possible.
504	*
505	* In the case of a CLAIM_FH open, on the other hand, the client
506	* may be counting on us to enforce permissions (the Linux 4.1
507	* client uses this for normal opens, for example).
508	*/
509	if (open->op_claim_type == NFS4_OPEN_CLAIM_DELEG_CUR_FH)
510	accmode = NFSD_MAY_OWNER_OVERRIDE;
511
512	return do_open_permission(rqstp, current_fh, open, accmode);
513	}
514
515	static void
516	copy_clientid(clientid_t *clid, struct nfsd4_session *session)
517	{
518	struct nfsd4_sessionid *sid =
519	(struct nfsd4_sessionid *)session->se_sessionid.data;
520
521	clid->cl_boot = sid->clientid.cl_boot;
522	clid->cl_id = sid->clientid.cl_id;
523	}
524
525	static __be32
526	nfsd4_open(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
527	union nfsd4_op_u *u)
528	{
529	struct nfsd4_open *open = &u->open;
530	__be32 status;
531	struct svc_fh *resfh = NULL;
532	struct net *net = SVC_NET(rqstp);
533	struct nfsd_net *nn = net_generic(net, id: nfsd_net_id);
534	bool reclaim = false;
535
536	dprintk("NFSD: nfsd4_open filename %.*s op_openowner %p\n",
537	(int)open->op_fnamelen, open->op_fname,
538	open->op_openowner);
539
540	open->op_filp = NULL;
541	open->op_rqstp = rqstp;
542
543	/* This check required by spec. */
544	if (open->op_create && open->op_claim_type != NFS4_OPEN_CLAIM_NULL)
545	return nfserr_inval;
546
547	open->op_created = false;
548	/*
549	* RFC5661 18.51.3
550	* Before RECLAIM_COMPLETE done, server should deny new lock
551	*/
552	if (nfsd4_has_session(cs: cstate) &&
553	!test_bit(NFSD4_CLIENT_RECLAIM_COMPLETE, &cstate->clp->cl_flags) &&
554	open->op_claim_type != NFS4_OPEN_CLAIM_PREVIOUS)
555	return nfserr_grace;
556
557	if (nfsd4_has_session(cs: cstate))
558	copy_clientid(clid: &open->op_clientid, session: cstate->session);
559
560	/* check seqid for replay. set nfs4_owner */
561	status = nfsd4_process_open1(cstate, open, nn);
562	if (status == nfserr_replay_me) {
563	struct nfs4_replay *rp = &open->op_openowner->oo_owner.so_replay;
564	fh_put(&cstate->current_fh);
565	fh_copy_shallow(dst: &cstate->current_fh.fh_handle,
566	src: &rp->rp_openfh);
567	status = fh_verify(rqstp, &cstate->current_fh, 0, NFSD_MAY_NOP);
568	if (status)
569	dprintk("nfsd4_open: replay failed"
570	" restoring previous filehandle\n");
571	else
572	status = nfserr_replay_me;
573	}
574	if (status)
575	goto out;
576	if (open->op_xdr_error) {
577	status = open->op_xdr_error;
578	goto out;
579	}
580
581	status = nfsd4_check_open_attributes(rqstp, cstate, open);
582	if (status)
583	goto out;
584
585	/* Openowner is now set, so sequence id will get bumped. Now we need
586	* these checks before we do any creates: */
587	status = nfserr_grace;
588	if (opens_in_grace(net) && open->op_claim_type != NFS4_OPEN_CLAIM_PREVIOUS)
589	goto out;
590	status = nfserr_no_grace;
591	if (!opens_in_grace(net) && open->op_claim_type == NFS4_OPEN_CLAIM_PREVIOUS)
592	goto out;
593
594	switch (open->op_claim_type) {
595	case NFS4_OPEN_CLAIM_DELEGATE_CUR:
596	case NFS4_OPEN_CLAIM_NULL:
597	status = do_open_lookup(rqstp, cstate, open, resfh: &resfh);
598	if (status)
599	goto out;
600	break;
601	case NFS4_OPEN_CLAIM_PREVIOUS:
602	status = nfs4_check_open_reclaim(cstate->clp);
603	if (status)
604	goto out;
605	open->op_openowner->oo_flags |= NFS4_OO_CONFIRMED;
606	reclaim = true;
607	fallthrough;
608	case NFS4_OPEN_CLAIM_FH:
609	case NFS4_OPEN_CLAIM_DELEG_CUR_FH:
610	status = do_open_fhandle(rqstp, cstate, open);
611	if (status)
612	goto out;
613	resfh = &cstate->current_fh;
614	break;
615	case NFS4_OPEN_CLAIM_DELEG_PREV_FH:
616	case NFS4_OPEN_CLAIM_DELEGATE_PREV:
617	status = nfserr_notsupp;
618	goto out;
619	default:
620	status = nfserr_inval;
621	goto out;
622	}
623
624	status = nfsd4_process_open2(rqstp, current_fh: resfh, open);
625	if (status && open->op_created)
626	pr_warn("nfsd4_process_open2 failed to open newly-created file: status=%u\n",
627	be32_to_cpu(status));
628	if (reclaim && !status)
629	nn->somebody_reclaimed = true;
630	out:
631	if (open->op_filp) {
632	fput(open->op_filp);
633	open->op_filp = NULL;
634	}
635	if (resfh && resfh != &cstate->current_fh) {
636	fh_dup2(dst: &cstate->current_fh, src: resfh);
637	fh_put(resfh);
638	kfree(objp: resfh);
639	}
640	nfsd4_cleanup_open_state(cstate, open);
641	nfsd4_bump_seqid(cstate, nfserr: status);
642	return status;
643	}
644
645	/*
646	* OPEN is the only seqid-mutating operation whose decoding can fail
647	* with a seqid-mutating error (specifically, decoding of user names in
648	* the attributes). Therefore we have to do some processing to look up
649	* the stateowner so that we can bump the seqid.
650	*/
651	static __be32 nfsd4_open_omfg(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, struct nfsd4_op *op)
652	{
653	struct nfsd4_open *open = &op->u.open;
654
655	if (!seqid_mutating_err(ntohl(op->status)))
656	return op->status;
657	if (nfsd4_has_session(cs: cstate))
658	return op->status;
659	open->op_xdr_error = op->status;
660	return nfsd4_open(rqstp, cstate, u: &op->u);
661	}
662
663	/*
664	* filehandle-manipulating ops.
665	*/
666	static __be32
667	nfsd4_getfh(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
668	union nfsd4_op_u *u)
669	{
670	u->getfh = &cstate->current_fh;
671	return nfs_ok;
672	}
673
674	static __be32
675	nfsd4_putfh(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
676	union nfsd4_op_u *u)
677	{
678	struct nfsd4_putfh *putfh = &u->putfh;
679	__be32 ret;
680
681	fh_put(&cstate->current_fh);
682	cstate->current_fh.fh_handle.fh_size = putfh->pf_fhlen;
683	memcpy(&cstate->current_fh.fh_handle.fh_raw, putfh->pf_fhval,
684	putfh->pf_fhlen);
685	ret = fh_verify(rqstp, &cstate->current_fh, 0, NFSD_MAY_BYPASS_GSS);
686	#ifdef CONFIG_NFSD_V4_2_INTER_SSC
687	if (ret == nfserr_stale && putfh->no_verify) {
688	SET_FH_FLAG(&cstate->current_fh, NFSD4_FH_FOREIGN);
689	ret = 0;
690	}
691	#endif
692	return ret;
693	}
694
695	static __be32
696	nfsd4_putrootfh(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
697	union nfsd4_op_u *u)
698	{
699	fh_put(&cstate->current_fh);
700
701	return exp_pseudoroot(rqstp, &cstate->current_fh);
702	}
703
704	static __be32
705	nfsd4_restorefh(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
706	union nfsd4_op_u *u)
707	{
708	if (!cstate->save_fh.fh_dentry)
709	return nfserr_restorefh;
710
711	fh_dup2(dst: &cstate->current_fh, src: &cstate->save_fh);
712	if (HAS_CSTATE_FLAG(cstate, SAVED_STATE_ID_FLAG)) {
713	memcpy(&cstate->current_stateid, &cstate->save_stateid, sizeof(stateid_t));
714	SET_CSTATE_FLAG(cstate, CURRENT_STATE_ID_FLAG);
715	}
716	return nfs_ok;
717	}
718
719	static __be32
720	nfsd4_savefh(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
721	union nfsd4_op_u *u)
722	{
723	fh_dup2(dst: &cstate->save_fh, src: &cstate->current_fh);
724	if (HAS_CSTATE_FLAG(cstate, CURRENT_STATE_ID_FLAG)) {
725	memcpy(&cstate->save_stateid, &cstate->current_stateid, sizeof(stateid_t));
726	SET_CSTATE_FLAG(cstate, SAVED_STATE_ID_FLAG);
727	}
728	return nfs_ok;
729	}
730
731	/*
732	* misc nfsv4 ops
733	*/
734	static __be32
735	nfsd4_access(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
736	union nfsd4_op_u *u)
737	{
738	struct nfsd4_access *access = &u->access;
739	u32 access_full;
740
741	access_full = NFS3_ACCESS_FULL;
742	if (cstate->minorversion >= 2)
743	access_full |= NFS4_ACCESS_XALIST | NFS4_ACCESS_XAREAD |
744	NFS4_ACCESS_XAWRITE;
745
746	if (access->ac_req_access & ~access_full)
747	return nfserr_inval;
748
749	access->ac_resp_access = access->ac_req_access;
750	return nfsd_access(rqstp, &cstate->current_fh, &access->ac_resp_access,
751	&access->ac_supported);
752	}
753
754	static void gen_boot_verifier(nfs4_verifier *verifier, struct net *net)
755	{
756	__be32 *verf = (__be32 *)verifier->data;
757
758	BUILD_BUG_ON(2*sizeof(*verf) != sizeof(verifier->data));
759
760	nfsd_copy_write_verifier(verf, nn: net_generic(net, id: nfsd_net_id));
761	}
762
763	static __be32
764	nfsd4_commit(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
765	union nfsd4_op_u *u)
766	{
767	struct nfsd4_commit *commit = &u->commit;
768	struct nfsd_file *nf;
769	__be32 status;
770
771	status = nfsd_file_acquire(rqstp, fhp: &cstate->current_fh, NFSD_MAY_WRITE |
772	NFSD_MAY_NOT_BREAK_LEASE, nfp: &nf);
773	if (status != nfs_ok)
774	return status;
775
776	status = nfsd_commit(rqst: rqstp, fhp: &cstate->current_fh, nf, offset: commit->co_offset,
777	count: commit->co_count,
778	verf: (__be32 *)commit->co_verf.data);
779	nfsd_file_put(nf);
780	return status;
781	}
782
783	static __be32
784	nfsd4_create(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
785	union nfsd4_op_u *u)
786	{
787	struct nfsd4_create *create = &u->create;
788	struct nfsd_attrs attrs = {
789	.na_iattr = &create->cr_iattr,
790	.na_seclabel = &create->cr_label,
791	};
792	struct svc_fh resfh;
793	__be32 status;
794	dev_t rdev;
795
796	fh_init(fhp: &resfh, NFS4_FHSIZE);
797
798	status = fh_verify(rqstp, &cstate->current_fh, S_IFDIR, NFSD_MAY_NOP);
799	if (status)
800	return status;
801
802	status = check_attr_support(rqstp, cstate, bmval: create->cr_bmval,
803	writable: nfsd_attrmask);
804	if (status)
805	return status;
806
807	status = nfsd4_acl_to_attr(type: create->cr_type, acl: create->cr_acl, attr: &attrs);
808	current->fs->umask = create->cr_umask;
809	switch (create->cr_type) {
810	case NF4LNK:
811	status = nfsd_symlink(rqstp, &cstate->current_fh,
812	name: create->cr_name, len: create->cr_namelen,
813	path: create->cr_data, attrs: &attrs, res: &resfh);
814	break;
815
816	case NF4BLK:
817	status = nfserr_inval;
818	rdev = MKDEV(create->cr_specdata1, create->cr_specdata2);
819	if (MAJOR(rdev) != create->cr_specdata1 ||
820	MINOR(rdev) != create->cr_specdata2)
821	goto out_umask;
822	status = nfsd_create(rqstp, &cstate->current_fh,
823	name: create->cr_name, len: create->cr_namelen,
824	attrs: &attrs, S_IFBLK, rdev, res: &resfh);
825	break;
826
827	case NF4CHR:
828	status = nfserr_inval;
829	rdev = MKDEV(create->cr_specdata1, create->cr_specdata2);
830	if (MAJOR(rdev) != create->cr_specdata1 ||
831	MINOR(rdev) != create->cr_specdata2)
832	goto out_umask;
833	status = nfsd_create(rqstp, &cstate->current_fh,
834	name: create->cr_name, len: create->cr_namelen,
835	attrs: &attrs, S_IFCHR, rdev, res: &resfh);
836	break;
837
838	case NF4SOCK:
839	status = nfsd_create(rqstp, &cstate->current_fh,
840	name: create->cr_name, len: create->cr_namelen,
841	attrs: &attrs, S_IFSOCK, rdev: 0, res: &resfh);
842	break;
843
844	case NF4FIFO:
845	status = nfsd_create(rqstp, &cstate->current_fh,
846	name: create->cr_name, len: create->cr_namelen,
847	attrs: &attrs, S_IFIFO, rdev: 0, res: &resfh);
848	break;
849
850	case NF4DIR:
851	create->cr_iattr.ia_valid &= ~ATTR_SIZE;
852	status = nfsd_create(rqstp, &cstate->current_fh,
853	name: create->cr_name, len: create->cr_namelen,
854	attrs: &attrs, S_IFDIR, rdev: 0, res: &resfh);
855	break;
856
857	default:
858	status = nfserr_badtype;
859	}
860
861	if (status)
862	goto out;
863
864	if (attrs.na_labelerr)
865	create->cr_bmval[2] &= ~FATTR4_WORD2_SECURITY_LABEL;
866	if (attrs.na_aclerr)
867	create->cr_bmval[0] &= ~FATTR4_WORD0_ACL;
868	set_change_info(cinfo: &create->cr_cinfo, fhp: &cstate->current_fh);
869	fh_dup2(dst: &cstate->current_fh, src: &resfh);
870	out:
871	fh_put(&resfh);
872	out_umask:
873	current->fs->umask = 0;
874	nfsd_attrs_free(attrs: &attrs);
875	return status;
876	}
877
878	static __be32
879	nfsd4_getattr(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
880	union nfsd4_op_u *u)
881	{
882	struct nfsd4_getattr *getattr = &u->getattr;
883	__be32 status;
884
885	status = fh_verify(rqstp, &cstate->current_fh, 0, NFSD_MAY_NOP);
886	if (status)
887	return status;
888
889	if (getattr->ga_bmval[1] & NFSD_WRITEONLY_ATTRS_WORD1)
890	return nfserr_inval;
891
892	getattr->ga_bmval[0] &= nfsd_suppattrs[cstate->minorversion][0];
893	getattr->ga_bmval[1] &= nfsd_suppattrs[cstate->minorversion][1];
894	getattr->ga_bmval[2] &= nfsd_suppattrs[cstate->minorversion][2];
895
896	getattr->ga_fhp = &cstate->current_fh;
897	return nfs_ok;
898	}
899
900	static __be32
901	nfsd4_link(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
902	union nfsd4_op_u *u)
903	{
904	struct nfsd4_link *link = &u->link;
905	__be32 status;
906
907	status = nfsd_link(rqstp, &cstate->current_fh,
908	link->li_name, link->li_namelen, &cstate->save_fh);
909	if (!status)
910	set_change_info(cinfo: &link->li_cinfo, fhp: &cstate->current_fh);
911	return status;
912	}
913
914	static __be32 nfsd4_do_lookupp(struct svc_rqst *rqstp, struct svc_fh *fh)
915	{
916	struct svc_fh tmp_fh;
917	__be32 ret;
918
919	fh_init(fhp: &tmp_fh, NFS4_FHSIZE);
920	ret = exp_pseudoroot(rqstp, &tmp_fh);
921	if (ret)
922	return ret;
923	if (tmp_fh.fh_dentry == fh->fh_dentry) {
924	fh_put(&tmp_fh);
925	return nfserr_noent;
926	}
927	fh_put(&tmp_fh);
928	return nfsd_lookup(rqstp, fh, "..", 2, fh);
929	}
930
931	static __be32
932	nfsd4_lookupp(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
933	union nfsd4_op_u *u)
934	{
935	return nfsd4_do_lookupp(rqstp, fh: &cstate->current_fh);
936	}
937
938	static __be32
939	nfsd4_lookup(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
940	union nfsd4_op_u *u)
941	{
942	return nfsd_lookup(rqstp, &cstate->current_fh,
943	u->lookup.lo_name, u->lookup.lo_len,
944	&cstate->current_fh);
945	}
946
947	static __be32
948	nfsd4_read(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
949	union nfsd4_op_u *u)
950	{
951	struct nfsd4_read *read = &u->read;
952	__be32 status;
953
954	read->rd_nf = NULL;
955
956	trace_nfsd_read_start(rqstp, fhp: &cstate->current_fh,
957	offset: read->rd_offset, len: read->rd_length);
958
959	read->rd_length = min_t(u32, read->rd_length, svc_max_payload(rqstp));
960	if (read->rd_offset > (u64)OFFSET_MAX)
961	read->rd_offset = (u64)OFFSET_MAX;
962	if (read->rd_offset + read->rd_length > (u64)OFFSET_MAX)
963	read->rd_length = (u64)OFFSET_MAX - read->rd_offset;
964
965	/*
966	* If we do a zero copy read, then a client will see read data
967	* that reflects the state of the file *after* performing the
968	* following compound.
969	*
970	* To ensure proper ordering, we therefore turn off zero copy if
971	* the client wants us to do more in this compound:
972	*/
973	if (!nfsd4_last_compound_op(rqstp)) {
974	struct nfsd4_compoundargs *argp = rqstp->rq_argp;
975
976	argp->splice_ok = false;
977	}
978
979	/* check stateid */
980	status = nfs4_preprocess_stateid_op(rqstp, cstate, fhp: &cstate->current_fh,
981	stateid: &read->rd_stateid, RD_STATE,
982	filp: &read->rd_nf, NULL);
983
984	read->rd_rqstp = rqstp;
985	read->rd_fhp = &cstate->current_fh;
986	return status;
987	}
988
989
990	static void
991	nfsd4_read_release(union nfsd4_op_u *u)
992	{
993	if (u->read.rd_nf)
994	nfsd_file_put(nf: u->read.rd_nf);
995	trace_nfsd_read_done(rqstp: u->read.rd_rqstp, fhp: u->read.rd_fhp,
996	offset: u->read.rd_offset, len: u->read.rd_length);
997	}
998
999	static __be32
1000	nfsd4_readdir(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
1001	union nfsd4_op_u *u)
1002	{
1003	struct nfsd4_readdir *readdir = &u->readdir;
1004	u64 cookie = readdir->rd_cookie;
1005	static const nfs4_verifier zeroverf;
1006
1007	/* no need to check permission - this will be done in nfsd_readdir() */
1008
1009	if (readdir->rd_bmval[1] & NFSD_WRITEONLY_ATTRS_WORD1)
1010	return nfserr_inval;
1011
1012	readdir->rd_bmval[0] &= nfsd_suppattrs[cstate->minorversion][0];
1013	readdir->rd_bmval[1] &= nfsd_suppattrs[cstate->minorversion][1];
1014	readdir->rd_bmval[2] &= nfsd_suppattrs[cstate->minorversion][2];
1015
1016	if ((cookie == 1) || (cookie == 2) ||
1017	(cookie == 0 && memcmp(p: readdir->rd_verf.data, q: zeroverf.data, NFS4_VERIFIER_SIZE)))
1018	return nfserr_bad_cookie;
1019
1020	readdir->rd_rqstp = rqstp;
1021	readdir->rd_fhp = &cstate->current_fh;
1022	return nfs_ok;
1023	}
1024
1025	static __be32
1026	nfsd4_readlink(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
1027	union nfsd4_op_u *u)
1028	{
1029	u->readlink.rl_rqstp = rqstp;
1030	u->readlink.rl_fhp = &cstate->current_fh;
1031	return nfs_ok;
1032	}
1033
1034	static __be32
1035	nfsd4_remove(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
1036	union nfsd4_op_u *u)
1037	{
1038	struct nfsd4_remove *remove = &u->remove;
1039	__be32 status;
1040
1041	if (opens_in_grace(SVC_NET(rqstp)))
1042	return nfserr_grace;
1043	status = nfsd_unlink(rqstp, &cstate->current_fh, type: 0,
1044	name: remove->rm_name, len: remove->rm_namelen);
1045	if (!status)
1046	set_change_info(cinfo: &remove->rm_cinfo, fhp: &cstate->current_fh);
1047	return status;
1048	}
1049
1050	static __be32
1051	nfsd4_rename(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
1052	union nfsd4_op_u *u)
1053	{
1054	struct nfsd4_rename *rename = &u->rename;
1055	__be32 status;
1056
1057	if (opens_in_grace(SVC_NET(rqstp)))
1058	return nfserr_grace;
1059	status = nfsd_rename(rqstp, &cstate->save_fh, rename->rn_sname,
1060	rename->rn_snamelen, &cstate->current_fh,
1061	rename->rn_tname, rename->rn_tnamelen);
1062	if (status)
1063	return status;
1064	set_change_info(cinfo: &rename->rn_sinfo, fhp: &cstate->save_fh);
1065	set_change_info(cinfo: &rename->rn_tinfo, fhp: &cstate->current_fh);
1066	return nfs_ok;
1067	}
1068
1069	static __be32
1070	nfsd4_secinfo(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
1071	union nfsd4_op_u *u)
1072	{
1073	struct nfsd4_secinfo *secinfo = &u->secinfo;
1074	struct svc_export *exp;
1075	struct dentry *dentry;
1076	__be32 err;
1077
1078	err = fh_verify(rqstp, &cstate->current_fh, S_IFDIR, NFSD_MAY_EXEC);
1079	if (err)
1080	return err;
1081	err = nfsd_lookup_dentry(rqstp, &cstate->current_fh,
1082	secinfo->si_name, secinfo->si_namelen,
1083	&exp, &dentry);
1084	if (err)
1085	return err;
1086	if (d_really_is_negative(dentry)) {
1087	exp_put(exp);
1088	err = nfserr_noent;
1089	} else
1090	secinfo->si_exp = exp;
1091	dput(dentry);
1092	if (cstate->minorversion)
1093	/* See rfc 5661 section 2.6.3.1.1.8 */
1094	fh_put(&cstate->current_fh);
1095	return err;
1096	}
1097
1098	static __be32
1099	nfsd4_secinfo_no_name(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
1100	union nfsd4_op_u *u)
1101	{
1102	__be32 err;
1103
1104	switch (u->secinfo_no_name.sin_style) {
1105	case NFS4_SECINFO_STYLE4_CURRENT_FH:
1106	break;
1107	case NFS4_SECINFO_STYLE4_PARENT:
1108	err = nfsd4_do_lookupp(rqstp, fh: &cstate->current_fh);
1109	if (err)
1110	return err;
1111	break;
1112	default:
1113	return nfserr_inval;
1114	}
1115
1116	u->secinfo_no_name.sin_exp = exp_get(exp: cstate->current_fh.fh_export);
1117	fh_put(&cstate->current_fh);
1118	return nfs_ok;
1119	}
1120
1121	static void
1122	nfsd4_secinfo_release(union nfsd4_op_u *u)
1123	{
1124	if (u->secinfo.si_exp)
1125	exp_put(exp: u->secinfo.si_exp);
1126	}
1127
1128	static void
1129	nfsd4_secinfo_no_name_release(union nfsd4_op_u *u)
1130	{
1131	if (u->secinfo_no_name.sin_exp)
1132	exp_put(exp: u->secinfo_no_name.sin_exp);
1133	}
1134
1135	static __be32
1136	nfsd4_setattr(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
1137	union nfsd4_op_u *u)
1138	{
1139	struct nfsd4_setattr *setattr = &u->setattr;
1140	struct nfsd_attrs attrs = {
1141	.na_iattr = &setattr->sa_iattr,
1142	.na_seclabel = &setattr->sa_label,
1143	};
1144	struct inode *inode;
1145	__be32 status = nfs_ok;
1146	bool save_no_wcc;
1147	int err;
1148
1149	if (setattr->sa_iattr.ia_valid & ATTR_SIZE) {
1150	status = nfs4_preprocess_stateid_op(rqstp, cstate,
1151	fhp: &cstate->current_fh, stateid: &setattr->sa_stateid,
1152	WR_STATE, NULL, NULL);
1153	if (status)
1154	return status;
1155	}
1156	err = fh_want_write(fh: &cstate->current_fh);
1157	if (err)
1158	return nfserrno(errno: err);
1159	status = nfs_ok;
1160
1161	status = check_attr_support(rqstp, cstate, bmval: setattr->sa_bmval,
1162	writable: nfsd_attrmask);
1163	if (status)
1164	goto out;
1165
1166	inode = cstate->current_fh.fh_dentry->d_inode;
1167	status = nfsd4_acl_to_attr(S_ISDIR(inode->i_mode) ? NF4DIR : NF4REG,
1168	acl: setattr->sa_acl, attr: &attrs);
1169
1170	if (status)
1171	goto out;
1172	save_no_wcc = cstate->current_fh.fh_no_wcc;
1173	cstate->current_fh.fh_no_wcc = true;
1174	status = nfsd_setattr(rqstp, &cstate->current_fh, &attrs, NULL);
1175	cstate->current_fh.fh_no_wcc = save_no_wcc;
1176	if (!status)
1177	status = nfserrno(errno: attrs.na_labelerr);
1178	if (!status)
1179	status = nfserrno(errno: attrs.na_aclerr);
1180	out:
1181	nfsd_attrs_free(attrs: &attrs);
1182	fh_drop_write(fh: &cstate->current_fh);
1183	return status;
1184	}
1185
1186	static __be32
1187	nfsd4_write(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
1188	union nfsd4_op_u *u)
1189	{
1190	struct nfsd4_write *write = &u->write;
1191	stateid_t *stateid = &write->wr_stateid;
1192	struct nfsd_file *nf = NULL;
1193	__be32 status = nfs_ok;
1194	unsigned long cnt;
1195	int nvecs;
1196
1197	if (write->wr_offset > (u64)OFFSET_MAX ||
1198	write->wr_offset + write->wr_buflen > (u64)OFFSET_MAX)
1199	return nfserr_fbig;
1200
1201	cnt = write->wr_buflen;
1202	trace_nfsd_write_start(rqstp, fhp: &cstate->current_fh,
1203	offset: write->wr_offset, len: cnt);
1204	status = nfs4_preprocess_stateid_op(rqstp, cstate, fhp: &cstate->current_fh,
1205	stateid, WR_STATE, filp: &nf, NULL);
1206	if (status)
1207	return status;
1208
1209	write->wr_how_written = write->wr_stable_how;
1210
1211	nvecs = svc_fill_write_vector(rqstp, payload: &write->wr_payload);
1212	WARN_ON_ONCE(nvecs > ARRAY_SIZE(rqstp->rq_vec));
1213
1214	status = nfsd_vfs_write(rqstp, fhp: &cstate->current_fh, nf,
1215	offset: write->wr_offset, vec: rqstp->rq_vec, vlen: nvecs, cnt: &cnt,
1216	stable: write->wr_how_written,
1217	verf: (__be32 *)write->wr_verifier.data);
1218	nfsd_file_put(nf);
1219
1220	write->wr_bytes_written = cnt;
1221	trace_nfsd_write_done(rqstp, fhp: &cstate->current_fh,
1222	offset: write->wr_offset, len: cnt);
1223	return status;
1224	}
1225
1226	static __be32
1227	nfsd4_verify_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
1228	stateid_t *src_stateid, struct nfsd_file **src,
1229	stateid_t *dst_stateid, struct nfsd_file **dst)
1230	{
1231	__be32 status;
1232
1233	if (!cstate->save_fh.fh_dentry)
1234	return nfserr_nofilehandle;
1235
1236	status = nfs4_preprocess_stateid_op(rqstp, cstate, fhp: &cstate->save_fh,
1237	stateid: src_stateid, RD_STATE, filp: src, NULL);
1238	if (status)
1239	goto out;
1240
1241	status = nfs4_preprocess_stateid_op(rqstp, cstate, fhp: &cstate->current_fh,
1242	stateid: dst_stateid, WR_STATE, filp: dst, NULL);
1243	if (status)
1244	goto out_put_src;
1245
1246	/* fix up for NFS-specific error code */
1247	if (!S_ISREG(file_inode((*src)->nf_file)->i_mode) ||
1248	!S_ISREG(file_inode((*dst)->nf_file)->i_mode)) {
1249	status = nfserr_wrong_type;
1250	goto out_put_dst;
1251	}
1252
1253	out:
1254	return status;
1255	out_put_dst:
1256	nfsd_file_put(nf: *dst);
1257	*dst = NULL;
1258	out_put_src:
1259	nfsd_file_put(nf: *src);
1260	*src = NULL;
1261	goto out;
1262	}
1263
1264	static __be32
1265	nfsd4_clone(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
1266	union nfsd4_op_u *u)
1267	{
1268	struct nfsd4_clone *clone = &u->clone;
1269	struct nfsd_file *src, *dst;
1270	__be32 status;
1271
1272	status = nfsd4_verify_copy(rqstp, cstate, src_stateid: &clone->cl_src_stateid, src: &src,
1273	dst_stateid: &clone->cl_dst_stateid, dst: &dst);
1274	if (status)
1275	goto out;
1276
1277	status = nfsd4_clone_file_range(rqstp, nf_src: src, src_pos: clone->cl_src_pos,
1278	nf_dst: dst, dst_pos: clone->cl_dst_pos, count: clone->cl_count,
1279	EX_ISSYNC(cstate->current_fh.fh_export));
1280
1281	nfsd_file_put(nf: dst);
1282	nfsd_file_put(nf: src);
1283	out:
1284	return status;
1285	}
1286
1287	static void nfs4_put_copy(struct nfsd4_copy *copy)
1288	{
1289	if (!refcount_dec_and_test(r: &copy->refcount))
1290	return;
1291	kfree(objp: copy->cp_src);
1292	kfree(objp: copy);
1293	}
1294
1295	static void nfsd4_stop_copy(struct nfsd4_copy *copy)
1296	{
1297	if (!test_and_set_bit(NFSD4_COPY_F_STOPPED, addr: &copy->cp_flags))
1298	kthread_stop(k: copy->copy_task);
1299	nfs4_put_copy(copy);
1300	}
1301
1302	static struct nfsd4_copy *nfsd4_get_copy(struct nfs4_client *clp)
1303	{
1304	struct nfsd4_copy *copy = NULL;
1305
1306	spin_lock(lock: &clp->async_lock);
1307	if (!list_empty(head: &clp->async_copies)) {
1308	copy = list_first_entry(&clp->async_copies, struct nfsd4_copy,
1309	copies);
1310	refcount_inc(r: &copy->refcount);
1311	}
1312	spin_unlock(lock: &clp->async_lock);
1313	return copy;
1314	}
1315
1316	void nfsd4_shutdown_copy(struct nfs4_client *clp)
1317	{
1318	struct nfsd4_copy *copy;
1319
1320	while ((copy = nfsd4_get_copy(clp)) != NULL)
1321	nfsd4_stop_copy(copy);
1322	}
1323	#ifdef CONFIG_NFSD_V4_2_INTER_SSC
1324
1325	extern struct file *nfs42_ssc_open(struct vfsmount *ss_mnt,
1326	struct nfs_fh *src_fh,
1327	nfs4_stateid *stateid);
1328	extern void nfs42_ssc_close(struct file *filep);
1329
1330	extern void nfs_sb_deactive(struct super_block *sb);
1331
1332	#define NFSD42_INTERSSC_MOUNTOPS "vers=4.2,addr=%s,sec=sys"
1333
1334	/*
1335	* setup a work entry in the ssc delayed unmount list.
1336	*/
1337	static __be32 nfsd4_ssc_setup_dul(struct nfsd_net *nn, char *ipaddr,
1338	struct nfsd4_ssc_umount_item **nsui,
1339	struct svc_rqst *rqstp)
1340	{
1341	struct nfsd4_ssc_umount_item *ni = NULL;
1342	struct nfsd4_ssc_umount_item *work = NULL;
1343	struct nfsd4_ssc_umount_item *tmp;
1344	DEFINE_WAIT(wait);
1345	__be32 status = 0;
1346
1347	*nsui = NULL;
1348	work = kzalloc(size: sizeof(*work), GFP_KERNEL);
1349	try_again:
1350	spin_lock(lock: &nn->nfsd_ssc_lock);
1351	list_for_each_entry_safe(ni, tmp, &nn->nfsd_ssc_mount_list, nsui_list) {
1352	if (strncmp(ni->nsui_ipaddr, ipaddr, sizeof(ni->nsui_ipaddr)))
1353	continue;
1354	/* found a match */
1355	if (ni->nsui_busy) {
1356	/* wait - and try again */
1357	prepare_to_wait(wq_head: &nn->nfsd_ssc_waitq, wq_entry: &wait, TASK_IDLE);
1358	spin_unlock(lock: &nn->nfsd_ssc_lock);
1359
1360	/* allow 20secs for mount/unmount for now - revisit */
1361	if (svc_thread_should_stop(rqstp) ||
1362	(schedule_timeout(timeout: 20*HZ) == 0)) {
1363	finish_wait(wq_head: &nn->nfsd_ssc_waitq, wq_entry: &wait);
1364	kfree(objp: work);
1365	return nfserr_eagain;
1366	}
1367	finish_wait(wq_head: &nn->nfsd_ssc_waitq, wq_entry: &wait);
1368	goto try_again;
1369	}
1370	*nsui = ni;
1371	refcount_inc(r: &ni->nsui_refcnt);
1372	spin_unlock(lock: &nn->nfsd_ssc_lock);
1373	kfree(objp: work);
1374
1375	/* return vfsmount in (*nsui)->nsui_vfsmount */
1376	return 0;
1377	}
1378	if (work) {
1379	strscpy(work->nsui_ipaddr, ipaddr, sizeof(work->nsui_ipaddr) - 1);
1380	refcount_set(r: &work->nsui_refcnt, n: 2);
1381	work->nsui_busy = true;
1382	list_add_tail(new: &work->nsui_list, head: &nn->nfsd_ssc_mount_list);
1383	*nsui = work;
1384	} else
1385	status = nfserr_resource;
1386	spin_unlock(lock: &nn->nfsd_ssc_lock);
1387	return status;
1388	}
1389
1390	static void nfsd4_ssc_update_dul(struct nfsd_net *nn,
1391	struct nfsd4_ssc_umount_item *nsui,
1392	struct vfsmount *ss_mnt)
1393	{
1394	spin_lock(lock: &nn->nfsd_ssc_lock);
1395	nsui->nsui_vfsmount = ss_mnt;
1396	nsui->nsui_busy = false;
1397	wake_up_all(&nn->nfsd_ssc_waitq);
1398	spin_unlock(lock: &nn->nfsd_ssc_lock);
1399	}
1400
1401	static void nfsd4_ssc_cancel_dul(struct nfsd_net *nn,
1402	struct nfsd4_ssc_umount_item *nsui)
1403	{
1404	spin_lock(lock: &nn->nfsd_ssc_lock);
1405	list_del(entry: &nsui->nsui_list);
1406	wake_up_all(&nn->nfsd_ssc_waitq);
1407	spin_unlock(lock: &nn->nfsd_ssc_lock);
1408	kfree(objp: nsui);
1409	}
1410
1411	/*
1412	* Support one copy source server for now.
1413	*/
1414	static __be32
1415	nfsd4_interssc_connect(struct nl4_server *nss, struct svc_rqst *rqstp,
1416	struct nfsd4_ssc_umount_item **nsui)
1417	{
1418	struct file_system_type *type;
1419	struct vfsmount *ss_mnt;
1420	struct nfs42_netaddr *naddr;
1421	struct sockaddr_storage tmp_addr;
1422	size_t tmp_addrlen, match_netid_len = 3;
1423	char *startsep = "", *endsep = "", *match_netid = "tcp";
1424	char *ipaddr, *dev_name, *raw_data;
1425	int len, raw_len;
1426	__be32 status = nfserr_inval;
1427	struct nfsd_net *nn = net_generic(SVC_NET(rqstp), id: nfsd_net_id);
1428
1429	naddr = &nss->u.nl4_addr;
1430	tmp_addrlen = rpc_uaddr2sockaddr(SVC_NET(rqstp), naddr->addr,
1431	naddr->addr_len,
1432	(struct sockaddr *)&tmp_addr,
1433	sizeof(tmp_addr));
1434	*nsui = NULL;
1435	if (tmp_addrlen == 0)
1436	goto out_err;
1437
1438	if (tmp_addr.ss_family == AF_INET6) {
1439	startsep = "[";
1440	endsep = "]";
1441	match_netid = "tcp6";
1442	match_netid_len = 4;
1443	}
1444
1445	if (naddr->netid_len != match_netid_len ||
1446	strncmp(naddr->netid, match_netid, naddr->netid_len))
1447	goto out_err;
1448
1449	/* Construct the raw data for the vfs_kern_mount call */
1450	len = RPC_MAX_ADDRBUFLEN + 1;
1451	ipaddr = kzalloc(size: len, GFP_KERNEL);
1452	if (!ipaddr)
1453	goto out_err;
1454
1455	rpc_ntop((struct sockaddr *)&tmp_addr, ipaddr, len);
1456
1457	/* 2 for ipv6 endsep and startsep. 3 for ":/" and trailing '/0'*/
1458
1459	raw_len = strlen(NFSD42_INTERSSC_MOUNTOPS) + strlen(ipaddr);
1460	raw_data = kzalloc(size: raw_len, GFP_KERNEL);
1461	if (!raw_data)
1462	goto out_free_ipaddr;
1463
1464	snprintf(buf: raw_data, size: raw_len, NFSD42_INTERSSC_MOUNTOPS, ipaddr);
1465
1466	status = nfserr_nodev;
1467	type = get_fs_type(name: "nfs");
1468	if (!type)
1469	goto out_free_rawdata;
1470
1471	/* Set the server:<export> for the vfs_kern_mount call */
1472	dev_name = kzalloc(size: len + 5, GFP_KERNEL);
1473	if (!dev_name)
1474	goto out_free_rawdata;
1475	snprintf(buf: dev_name, size: len + 5, fmt: "%s%s%s:/", startsep, ipaddr, endsep);
1476
1477	status = nfsd4_ssc_setup_dul(nn, ipaddr, nsui, rqstp);
1478	if (status)
1479	goto out_free_devname;
1480	if ((*nsui)->nsui_vfsmount)
1481	goto out_done;
1482
1483	/* Use an 'internal' mount: SB_KERNMOUNT -> MNT_INTERNAL */
1484	ss_mnt = vfs_kern_mount(type, SB_KERNMOUNT, name: dev_name, data: raw_data);
1485	module_put(module: type->owner);
1486	if (IS_ERR(ptr: ss_mnt)) {
1487	status = nfserr_nodev;
1488	nfsd4_ssc_cancel_dul(nn, nsui: *nsui);
1489	goto out_free_devname;
1490	}
1491	nfsd4_ssc_update_dul(nn, nsui: *nsui, ss_mnt);
1492	out_done:
1493	status = 0;
1494
1495	out_free_devname:
1496	kfree(objp: dev_name);
1497	out_free_rawdata:
1498	kfree(objp: raw_data);
1499	out_free_ipaddr:
1500	kfree(objp: ipaddr);
1501	out_err:
1502	return status;
1503	}
1504
1505	/*
1506	* Verify COPY destination stateid.
1507	*
1508	* Connect to the source server with NFSv4.1.
1509	* Create the source struct file for nfsd_copy_range.
1510	* Called with COPY cstate:
1511	* SAVED_FH: source filehandle
1512	* CURRENT_FH: destination filehandle
1513	*/
1514	static __be32
1515	nfsd4_setup_inter_ssc(struct svc_rqst *rqstp,
1516	struct nfsd4_compound_state *cstate,
1517	struct nfsd4_copy *copy)
1518	{
1519	struct svc_fh *s_fh = NULL;
1520	stateid_t *s_stid = &copy->cp_src_stateid;
1521	__be32 status = nfserr_inval;
1522
1523	/* Verify the destination stateid and set dst struct file*/
1524	status = nfs4_preprocess_stateid_op(rqstp, cstate, fhp: &cstate->current_fh,
1525	stateid: &copy->cp_dst_stateid,
1526	WR_STATE, filp: &copy->nf_dst, NULL);
1527	if (status)
1528	goto out;
1529
1530	status = nfsd4_interssc_connect(nss: copy->cp_src, rqstp, nsui: &copy->ss_nsui);
1531	if (status)
1532	goto out;
1533
1534	s_fh = &cstate->save_fh;
1535
1536	copy->c_fh.size = s_fh->fh_handle.fh_size;
1537	memcpy(copy->c_fh.data, &s_fh->fh_handle.fh_raw, copy->c_fh.size);
1538	copy->stateid.seqid = cpu_to_be32(s_stid->si_generation);
1539	memcpy(copy->stateid.other, (void *)&s_stid->si_opaque,
1540	sizeof(stateid_opaque_t));
1541
1542	status = 0;
1543	out:
1544	return status;
1545	}
1546
1547	static void
1548	nfsd4_cleanup_inter_ssc(struct nfsd4_ssc_umount_item *nsui, struct file *filp,
1549	struct nfsd_file *dst)
1550	{
1551	struct nfsd_net *nn = net_generic(net: dst->nf_net, id: nfsd_net_id);
1552	long timeout = msecs_to_jiffies(m: nfsd4_ssc_umount_timeout);
1553
1554	nfs42_ssc_close(filep: filp);
1555	fput(filp);
1556
1557	spin_lock(lock: &nn->nfsd_ssc_lock);
1558	list_del(entry: &nsui->nsui_list);
1559	/*
1560	* vfsmount can be shared by multiple exports,
1561	* decrement refcnt. If the count drops to 1 it
1562	* will be unmounted when nsui_expire expires.
1563	*/
1564	refcount_dec(r: &nsui->nsui_refcnt);
1565	nsui->nsui_expire = jiffies + timeout;
1566	list_add_tail(new: &nsui->nsui_list, head: &nn->nfsd_ssc_mount_list);
1567	spin_unlock(lock: &nn->nfsd_ssc_lock);
1568	}
1569
1570	#else /* CONFIG_NFSD_V4_2_INTER_SSC */
1571
1572	static __be32
1573	nfsd4_setup_inter_ssc(struct svc_rqst *rqstp,
1574	struct nfsd4_compound_state *cstate,
1575	struct nfsd4_copy *copy)
1576	{
1577	return nfserr_inval;
1578	}
1579
1580	static void
1581	nfsd4_cleanup_inter_ssc(struct nfsd4_ssc_umount_item *nsui, struct file *filp,
1582	struct nfsd_file *dst)
1583	{
1584	}
1585
1586	static struct file *nfs42_ssc_open(struct vfsmount *ss_mnt,
1587	struct nfs_fh *src_fh,
1588	nfs4_stateid *stateid)
1589	{
1590	return NULL;
1591	}
1592	#endif /* CONFIG_NFSD_V4_2_INTER_SSC */
1593
1594	static __be32
1595	nfsd4_setup_intra_ssc(struct svc_rqst *rqstp,
1596	struct nfsd4_compound_state *cstate,
1597	struct nfsd4_copy *copy)
1598	{
1599	return nfsd4_verify_copy(rqstp, cstate, src_stateid: &copy->cp_src_stateid,
1600	src: &copy->nf_src, dst_stateid: &copy->cp_dst_stateid,
1601	dst: &copy->nf_dst);
1602	}
1603
1604	static void nfsd4_cb_offload_release(struct nfsd4_callback *cb)
1605	{
1606	struct nfsd4_cb_offload *cbo =
1607	container_of(cb, struct nfsd4_cb_offload, co_cb);
1608
1609	kfree(objp: cbo);
1610	}
1611
1612	static int nfsd4_cb_offload_done(struct nfsd4_callback *cb,
1613	struct rpc_task *task)
1614	{
1615	struct nfsd4_cb_offload *cbo =
1616	container_of(cb, struct nfsd4_cb_offload, co_cb);
1617
1618	trace_nfsd_cb_offload_done(stp: &cbo->co_res.cb_stateid, task);
1619	return 1;
1620	}
1621
1622	static const struct nfsd4_callback_ops nfsd4_cb_offload_ops = {
1623	.release = nfsd4_cb_offload_release,
1624	.done = nfsd4_cb_offload_done
1625	};
1626
1627	static void nfsd4_init_copy_res(struct nfsd4_copy *copy, bool sync)
1628	{
1629	copy->cp_res.wr_stable_how =
1630	test_bit(NFSD4_COPY_F_COMMITTED, &copy->cp_flags) ?
1631	NFS_FILE_SYNC : NFS_UNSTABLE;
1632	nfsd4_copy_set_sync(copy, sync);
1633	gen_boot_verifier(verifier: &copy->cp_res.wr_verifier, net: copy->cp_clp->net);
1634	}
1635
1636	static ssize_t _nfsd_copy_file_range(struct nfsd4_copy *copy,
1637	struct file *dst,
1638	struct file *src)
1639	{
1640	errseq_t since;
1641	ssize_t bytes_copied = 0;
1642	u64 bytes_total = copy->cp_count;
1643	u64 src_pos = copy->cp_src_pos;
1644	u64 dst_pos = copy->cp_dst_pos;
1645	int status;
1646	loff_t end;
1647
1648	/* See RFC 7862 p.67: */
1649	if (bytes_total == 0)
1650	bytes_total = ULLONG_MAX;
1651	do {
1652	/* Only async copies can be stopped here */
1653	if (kthread_should_stop())
1654	break;
1655	bytes_copied = nfsd_copy_file_range(src, src_pos, dst, dst_pos,
1656	bytes_total);
1657	if (bytes_copied <= 0)
1658	break;
1659	bytes_total -= bytes_copied;
1660	copy->cp_res.wr_bytes_written += bytes_copied;
1661	src_pos += bytes_copied;
1662	dst_pos += bytes_copied;
1663	} while (bytes_total > 0 && nfsd4_copy_is_async(copy));
1664	/* for a non-zero asynchronous copy do a commit of data */
1665	if (nfsd4_copy_is_async(copy) && copy->cp_res.wr_bytes_written > 0) {
1666	since = READ_ONCE(dst->f_wb_err);
1667	end = copy->cp_dst_pos + copy->cp_res.wr_bytes_written - 1;
1668	status = vfs_fsync_range(file: dst, start: copy->cp_dst_pos, end, datasync: 0);
1669	if (!status)
1670	status = filemap_check_wb_err(mapping: dst->f_mapping, since);
1671	if (!status)
1672	set_bit(NFSD4_COPY_F_COMMITTED, addr: &copy->cp_flags);
1673	}
1674	return bytes_copied;
1675	}
1676
1677	static __be32 nfsd4_do_copy(struct nfsd4_copy *copy,
1678	struct file *src, struct file *dst,
1679	bool sync)
1680	{
1681	__be32 status;
1682	ssize_t bytes;
1683
1684	bytes = _nfsd_copy_file_range(copy, dst, src);
1685
1686	/* for async copy, we ignore the error, client can always retry
1687	* to get the error
1688	*/
1689	if (bytes < 0 && !copy->cp_res.wr_bytes_written)
1690	status = nfserrno(errno: bytes);
1691	else {
1692	nfsd4_init_copy_res(copy, sync);
1693	status = nfs_ok;
1694	}
1695	return status;
1696	}
1697
1698	static void dup_copy_fields(struct nfsd4_copy *src, struct nfsd4_copy *dst)
1699	{
1700	dst->cp_src_pos = src->cp_src_pos;
1701	dst->cp_dst_pos = src->cp_dst_pos;
1702	dst->cp_count = src->cp_count;
1703	dst->cp_flags = src->cp_flags;
1704	memcpy(&dst->cp_res, &src->cp_res, sizeof(src->cp_res));
1705	memcpy(&dst->fh, &src->fh, sizeof(src->fh));
1706	dst->cp_clp = src->cp_clp;
1707	dst->nf_dst = nfsd_file_get(nf: src->nf_dst);
1708	/* for inter, nf_src doesn't exist yet */
1709	if (!nfsd4_ssc_is_inter(copy: src))
1710	dst->nf_src = nfsd_file_get(nf: src->nf_src);
1711
1712	memcpy(&dst->cp_stateid, &src->cp_stateid, sizeof(src->cp_stateid));
1713	memcpy(dst->cp_src, src->cp_src, sizeof(struct nl4_server));
1714	memcpy(&dst->stateid, &src->stateid, sizeof(src->stateid));
1715	memcpy(&dst->c_fh, &src->c_fh, sizeof(src->c_fh));
1716	dst->ss_nsui = src->ss_nsui;
1717	}
1718
1719	static void release_copy_files(struct nfsd4_copy *copy)
1720	{
1721	if (copy->nf_src)
1722	nfsd_file_put(nf: copy->nf_src);
1723	if (copy->nf_dst)
1724	nfsd_file_put(nf: copy->nf_dst);
1725	}
1726
1727	static void cleanup_async_copy(struct nfsd4_copy *copy)
1728	{
1729	nfs4_free_copy_state(copy);
1730	release_copy_files(copy);
1731	if (copy->cp_clp) {
1732	spin_lock(lock: &copy->cp_clp->async_lock);
1733	if (!list_empty(head: &copy->copies))
1734	list_del_init(entry: &copy->copies);
1735	spin_unlock(lock: &copy->cp_clp->async_lock);
1736	}
1737	nfs4_put_copy(copy);
1738	}
1739
1740	static void nfsd4_send_cb_offload(struct nfsd4_copy *copy, __be32 nfserr)
1741	{
1742	struct nfsd4_cb_offload *cbo;
1743
1744	cbo = kzalloc(size: sizeof(*cbo), GFP_KERNEL);
1745	if (!cbo)
1746	return;
1747
1748	memcpy(&cbo->co_res, &copy->cp_res, sizeof(copy->cp_res));
1749	memcpy(&cbo->co_fh, &copy->fh, sizeof(copy->fh));
1750	cbo->co_nfserr = nfserr;
1751
1752	nfsd4_init_cb(cb: &cbo->co_cb, clp: copy->cp_clp, ops: &nfsd4_cb_offload_ops,
1753	op: NFSPROC4_CLNT_CB_OFFLOAD);
1754	trace_nfsd_cb_offload(clp: copy->cp_clp, stp: &cbo->co_res.cb_stateid,
1755	fh: &cbo->co_fh, count: copy->cp_count, status: nfserr);
1756	nfsd4_run_cb(cb: &cbo->co_cb);
1757	}
1758
1759	/**
1760	* nfsd4_do_async_copy - kthread function for background server-side COPY
1761	* @data: arguments for COPY operation
1762	*
1763	* Return values:
1764	* %0: Copy operation is done.
1765	*/
1766	static int nfsd4_do_async_copy(void *data)
1767	{
1768	struct nfsd4_copy *copy = (struct nfsd4_copy *)data;
1769	__be32 nfserr;
1770
1771	trace_nfsd_copy_do_async(copy);
1772	if (nfsd4_ssc_is_inter(copy)) {
1773	struct file *filp;
1774
1775	filp = nfs42_ssc_open(ss_mnt: copy->ss_nsui->nsui_vfsmount,
1776	src_fh: &copy->c_fh, stateid: &copy->stateid);
1777	if (IS_ERR(ptr: filp)) {
1778	switch (PTR_ERR(ptr: filp)) {
1779	case -EBADF:
1780	nfserr = nfserr_wrong_type;
1781	break;
1782	default:
1783	nfserr = nfserr_offload_denied;
1784	}
1785	/* ss_mnt will be unmounted by the laundromat */
1786	goto do_callback;
1787	}
1788	nfserr = nfsd4_do_copy(copy, src: filp, dst: copy->nf_dst->nf_file,
1789	sync: false);
1790	nfsd4_cleanup_inter_ssc(nsui: copy->ss_nsui, filp, dst: copy->nf_dst);
1791	} else {
1792	nfserr = nfsd4_do_copy(copy, src: copy->nf_src->nf_file,
1793	dst: copy->nf_dst->nf_file, sync: false);
1794	}
1795
1796	do_callback:
1797	nfsd4_send_cb_offload(copy, nfserr);
1798	cleanup_async_copy(copy);
1799	return 0;
1800	}
1801
1802	static __be32
1803	nfsd4_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
1804	union nfsd4_op_u *u)
1805	{
1806	struct nfsd4_copy *copy = &u->copy;
1807	__be32 status;
1808	struct nfsd4_copy *async_copy = NULL;
1809
1810	copy->cp_clp = cstate->clp;
1811	if (nfsd4_ssc_is_inter(copy)) {
1812	trace_nfsd_copy_inter(copy);
1813	if (!inter_copy_offload_enable || nfsd4_copy_is_sync(copy)) {
1814	status = nfserr_notsupp;
1815	goto out;
1816	}
1817	status = nfsd4_setup_inter_ssc(rqstp, cstate, copy);
1818	if (status) {
1819	trace_nfsd_copy_done(copy, status);
1820	return nfserr_offload_denied;
1821	}
1822	} else {
1823	trace_nfsd_copy_intra(copy);
1824	status = nfsd4_setup_intra_ssc(rqstp, cstate, copy);
1825	if (status) {
1826	trace_nfsd_copy_done(copy, status);
1827	return status;
1828	}
1829	}
1830
1831	memcpy(&copy->fh, &cstate->current_fh.fh_handle,
1832	sizeof(struct knfsd_fh));
1833	if (nfsd4_copy_is_async(copy)) {
1834	struct nfsd_net *nn = net_generic(SVC_NET(rqstp), id: nfsd_net_id);
1835
1836	status = nfserrno(errno: -ENOMEM);
1837	async_copy = kzalloc(size: sizeof(struct nfsd4_copy), GFP_KERNEL);
1838	if (!async_copy)
1839	goto out_err;
1840	INIT_LIST_HEAD(list: &async_copy->copies);
1841	refcount_set(r: &async_copy->refcount, n: 1);
1842	async_copy->cp_src = kmalloc(size: sizeof(*async_copy->cp_src), GFP_KERNEL);
1843	if (!async_copy->cp_src)
1844	goto out_err;
1845	if (!nfs4_init_copy_state(nn, copy))
1846	goto out_err;
1847	memcpy(&copy->cp_res.cb_stateid, &copy->cp_stateid.cs_stid,
1848	sizeof(copy->cp_res.cb_stateid));
1849	dup_copy_fields(src: copy, dst: async_copy);
1850	async_copy->copy_task = kthread_create(nfsd4_do_async_copy,
1851	async_copy, "%s", "copy thread");
1852	if (IS_ERR(ptr: async_copy->copy_task))
1853	goto out_err;
1854	spin_lock(lock: &async_copy->cp_clp->async_lock);
1855	list_add(new: &async_copy->copies,
1856	head: &async_copy->cp_clp->async_copies);
1857	spin_unlock(lock: &async_copy->cp_clp->async_lock);
1858	wake_up_process(tsk: async_copy->copy_task);
1859	status = nfs_ok;
1860	} else {
1861	status = nfsd4_do_copy(copy, src: copy->nf_src->nf_file,
1862	dst: copy->nf_dst->nf_file, sync: true);
1863	}
1864	out:
1865	trace_nfsd_copy_done(copy, status);
1866	release_copy_files(copy);
1867	return status;
1868	out_err:
1869	if (nfsd4_ssc_is_inter(copy)) {
1870	/*
1871	* Source's vfsmount of inter-copy will be unmounted
1872	* by the laundromat. Use copy instead of async_copy
1873	* since async_copy->ss_nsui might not be set yet.
1874	*/
1875	refcount_dec(r: &copy->ss_nsui->nsui_refcnt);
1876	}
1877	if (async_copy)
1878	cleanup_async_copy(copy: async_copy);
1879	status = nfserrno(errno: -ENOMEM);
1880	goto out;
1881	}
1882
1883	static struct nfsd4_copy *
1884	find_async_copy_locked(struct nfs4_client *clp, stateid_t *stateid)
1885	{
1886	struct nfsd4_copy *copy;
1887
1888	lockdep_assert_held(&clp->async_lock);
1889
1890	list_for_each_entry(copy, &clp->async_copies, copies) {
1891	if (memcmp(p: &copy->cp_stateid.cs_stid, q: stateid, NFS4_STATEID_SIZE))
1892	continue;
1893	return copy;
1894	}
1895	return NULL;
1896	}
1897
1898	static struct nfsd4_copy *
1899	find_async_copy(struct nfs4_client *clp, stateid_t *stateid)
1900	{
1901	struct nfsd4_copy *copy;
1902
1903	spin_lock(lock: &clp->async_lock);
1904	copy = find_async_copy_locked(clp, stateid);
1905	if (copy)
1906	refcount_inc(r: &copy->refcount);
1907	spin_unlock(lock: &clp->async_lock);
1908	return copy;
1909	}
1910
1911	static __be32
1912	nfsd4_offload_cancel(struct svc_rqst *rqstp,
1913	struct nfsd4_compound_state *cstate,
1914	union nfsd4_op_u *u)
1915	{
1916	struct nfsd4_offload_status *os = &u->offload_status;
1917	struct nfsd4_copy *copy;
1918	struct nfs4_client *clp = cstate->clp;
1919
1920	copy = find_async_copy(clp, stateid: &os->stateid);
1921	if (!copy) {
1922	struct nfsd_net *nn = net_generic(SVC_NET(rqstp), id: nfsd_net_id);
1923
1924	return manage_cpntf_state(nn, st: &os->stateid, clp, NULL);
1925	} else
1926	nfsd4_stop_copy(copy);
1927
1928	return nfs_ok;
1929	}
1930
1931	static __be32
1932	nfsd4_copy_notify(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
1933	union nfsd4_op_u *u)
1934	{
1935	struct nfsd4_copy_notify *cn = &u->copy_notify;
1936	__be32 status;
1937	struct nfsd_net *nn = net_generic(SVC_NET(rqstp), id: nfsd_net_id);
1938	struct nfs4_stid *stid;
1939	struct nfs4_cpntf_state *cps;
1940	struct nfs4_client *clp = cstate->clp;
1941
1942	status = nfs4_preprocess_stateid_op(rqstp, cstate, fhp: &cstate->current_fh,
1943	stateid: &cn->cpn_src_stateid, RD_STATE, NULL,
1944	cstid: &stid);
1945	if (status)
1946	return status;
1947
1948	cn->cpn_lease_time.tv_sec = nn->nfsd4_lease;
1949	cn->cpn_lease_time.tv_nsec = 0;
1950
1951	status = nfserrno(errno: -ENOMEM);
1952	cps = nfs4_alloc_init_cpntf_state(nn, p_stid: stid);
1953	if (!cps)
1954	goto out;
1955	memcpy(&cn->cpn_cnr_stateid, &cps->cp_stateid.cs_stid, sizeof(stateid_t));
1956	memcpy(&cps->cp_p_stateid, &stid->sc_stateid, sizeof(stateid_t));
1957	memcpy(&cps->cp_p_clid, &clp->cl_clientid, sizeof(clientid_t));
1958
1959	/* For now, only return one server address in cpn_src, the
1960	* address used by the client to connect to this server.
1961	*/
1962	cn->cpn_src->nl4_type = NL4_NETADDR;
1963	status = nfsd4_set_netaddr(addr: (struct sockaddr *)&rqstp->rq_daddr,
1964	netaddr: &cn->cpn_src->u.nl4_addr);
1965	WARN_ON_ONCE(status);
1966	if (status) {
1967	nfs4_put_cpntf_state(nn, cps);
1968	goto out;
1969	}
1970	out:
1971	nfs4_put_stid(s: stid);
1972	return status;
1973	}
1974
1975	static __be32
1976	nfsd4_fallocate(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
1977	struct nfsd4_fallocate *fallocate, int flags)
1978	{
1979	__be32 status;
1980	struct nfsd_file *nf;
1981
1982	status = nfs4_preprocess_stateid_op(rqstp, cstate, fhp: &cstate->current_fh,
1983	stateid: &fallocate->falloc_stateid,
1984	WR_STATE, filp: &nf, NULL);
1985	if (status != nfs_ok)
1986	return status;
1987
1988	status = nfsd4_vfs_fallocate(rqstp, &cstate->current_fh, nf->nf_file,
1989	fallocate->falloc_offset,
1990	fallocate->falloc_length,
1991	flags);
1992	nfsd_file_put(nf);
1993	return status;
1994	}
1995
1996	static __be32
1997	nfsd4_offload_status(struct svc_rqst *rqstp,
1998	struct nfsd4_compound_state *cstate,
1999	union nfsd4_op_u *u)
2000	{
2001	struct nfsd4_offload_status *os = &u->offload_status;
2002	__be32 status = nfs_ok;
2003	struct nfsd4_copy *copy;
2004	struct nfs4_client *clp = cstate->clp;
2005
2006	spin_lock(lock: &clp->async_lock);
2007	copy = find_async_copy_locked(clp, stateid: &os->stateid);
2008	if (copy)
2009	os->count = copy->cp_res.wr_bytes_written;
2010	else
2011	status = nfserr_bad_stateid;
2012	spin_unlock(lock: &clp->async_lock);
2013
2014	return status;
2015	}
2016
2017	static __be32
2018	nfsd4_allocate(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
2019	union nfsd4_op_u *u)
2020	{
2021	return nfsd4_fallocate(rqstp, cstate, fallocate: &u->allocate, flags: 0);
2022	}
2023
2024	static __be32
2025	nfsd4_deallocate(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
2026	union nfsd4_op_u *u)
2027	{
2028	return nfsd4_fallocate(rqstp, cstate, fallocate: &u->deallocate,
2029	FALLOC_FL_PUNCH_HOLE | FALLOC_FL_KEEP_SIZE);
2030	}
2031
2032	static __be32
2033	nfsd4_seek(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
2034	union nfsd4_op_u *u)
2035	{
2036	struct nfsd4_seek *seek = &u->seek;
2037	int whence;
2038	__be32 status;
2039	struct nfsd_file *nf;
2040
2041	status = nfs4_preprocess_stateid_op(rqstp, cstate, fhp: &cstate->current_fh,
2042	stateid: &seek->seek_stateid,
2043	RD_STATE, filp: &nf, NULL);
2044	if (status)
2045	return status;
2046
2047	switch (seek->seek_whence) {
2048	case NFS4_CONTENT_DATA:
2049	whence = SEEK_DATA;
2050	break;
2051	case NFS4_CONTENT_HOLE:
2052	whence = SEEK_HOLE;
2053	break;
2054	default:
2055	status = nfserr_union_notsupp;
2056	goto out;
2057	}
2058
2059	/*
2060	* Note: This call does change file->f_pos, but nothing in NFSD
2061	* should ever file->f_pos.
2062	*/
2063	seek->seek_pos = vfs_llseek(file: nf->nf_file, offset: seek->seek_offset, whence);
2064	if (seek->seek_pos < 0)
2065	status = nfserrno(errno: seek->seek_pos);
2066	else if (seek->seek_pos >= i_size_read(inode: file_inode(f: nf->nf_file)))
2067	seek->seek_eof = true;
2068
2069	out:
2070	nfsd_file_put(nf);
2071	return status;
2072	}
2073
2074	/* This routine never returns NFS_OK! If there are no other errors, it
2075	* will return NFSERR_SAME or NFSERR_NOT_SAME depending on whether the
2076	* attributes matched. VERIFY is implemented by mapping NFSERR_SAME
2077	* to NFS_OK after the call; NVERIFY by mapping NFSERR_NOT_SAME to NFS_OK.
2078	*/
2079	static __be32
2080	_nfsd4_verify(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
2081	struct nfsd4_verify *verify)
2082	{
2083	__be32 *buf, *p;
2084	int count;
2085	__be32 status;
2086
2087	status = fh_verify(rqstp, &cstate->current_fh, 0, NFSD_MAY_NOP);
2088	if (status)
2089	return status;
2090
2091	status = check_attr_support(rqstp, cstate, bmval: verify->ve_bmval, NULL);
2092	if (status)
2093	return status;
2094
2095	if ((verify->ve_bmval[0] & FATTR4_WORD0_RDATTR_ERROR)
2096	|| (verify->ve_bmval[1] & NFSD_WRITEONLY_ATTRS_WORD1))
2097	return nfserr_inval;
2098	if (verify->ve_attrlen & 3)
2099	return nfserr_inval;
2100
2101	/* count in words:
2102	* bitmap_len(1) + bitmap(2) + attr_len(1) = 4
2103	*/
2104	count = 4 + (verify->ve_attrlen >> 2);
2105	buf = kmalloc(size: count << 2, GFP_KERNEL);
2106	if (!buf)
2107	return nfserr_jukebox;
2108
2109	p = buf;
2110	status = nfsd4_encode_fattr_to_buf(p: &p, words: count, fhp: &cstate->current_fh,
2111	exp: cstate->current_fh.fh_export,
2112	dentry: cstate->current_fh.fh_dentry,
2113	bmval: verify->ve_bmval,
2114	rqstp, ignore_crossmnt: 0);
2115	/*
2116	* If nfsd4_encode_fattr() ran out of space, assume that's because
2117	* the attributes are longer (hence different) than those given:
2118	*/
2119	if (status == nfserr_resource)
2120	status = nfserr_not_same;
2121	if (status)
2122	goto out_kfree;
2123
2124	/* skip bitmap */
2125	p = buf + 1 + ntohl(buf[0]);
2126	status = nfserr_not_same;
2127	if (ntohl(*p++) != verify->ve_attrlen)
2128	goto out_kfree;
2129	if (!memcmp(p, q: verify->ve_attrval, size: verify->ve_attrlen))
2130	status = nfserr_same;
2131
2132	out_kfree:
2133	kfree(objp: buf);
2134	return status;
2135	}
2136
2137	static __be32
2138	nfsd4_nverify(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
2139	union nfsd4_op_u *u)
2140	{
2141	__be32 status;
2142
2143	status = _nfsd4_verify(rqstp, cstate, verify: &u->verify);
2144	return status == nfserr_not_same ? nfs_ok : status;
2145	}
2146
2147	static __be32
2148	nfsd4_verify(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
2149	union nfsd4_op_u *u)
2150	{
2151	__be32 status;
2152
2153	status = _nfsd4_verify(rqstp, cstate, verify: &u->nverify);
2154	return status == nfserr_same ? nfs_ok : status;
2155	}
2156
2157	#ifdef CONFIG_NFSD_PNFS
2158	static const struct nfsd4_layout_ops *
2159	nfsd4_layout_verify(struct svc_export *exp, unsigned int layout_type)
2160	{
2161	if (!exp->ex_layout_types) {
2162	dprintk("%s: export does not support pNFS\n", __func__);
2163	return NULL;
2164	}
2165
2166	if (layout_type >= LAYOUT_TYPE_MAX ||
2167	!(exp->ex_layout_types & (1 << layout_type))) {
2168	dprintk("%s: layout type %d not supported\n",
2169	__func__, layout_type);
2170	return NULL;
2171	}
2172
2173	return nfsd4_layout_ops[layout_type];
2174	}
2175
2176	static __be32
2177	nfsd4_getdeviceinfo(struct svc_rqst *rqstp,
2178	struct nfsd4_compound_state *cstate, union nfsd4_op_u *u)
2179	{
2180	struct nfsd4_getdeviceinfo *gdp = &u->getdeviceinfo;
2181	const struct nfsd4_layout_ops *ops;
2182	struct nfsd4_deviceid_map *map;
2183	struct svc_export *exp;
2184	__be32 nfserr;
2185
2186	dprintk("%s: layout_type %u dev_id [0x%llx:0x%x] maxcnt %u\n",
2187	__func__,
2188	gdp->gd_layout_type,
2189	gdp->gd_devid.fsid_idx, gdp->gd_devid.generation,
2190	gdp->gd_maxcount);
2191
2192	map = nfsd4_find_devid_map(idx: gdp->gd_devid.fsid_idx);
2193	if (!map) {
2194	dprintk("%s: couldn't find device ID to export mapping!\n",
2195	__func__);
2196	return nfserr_noent;
2197	}
2198
2199	exp = rqst_exp_find(rqstp, map->fsid_type, map->fsid);
2200	if (IS_ERR(ptr: exp)) {
2201	dprintk("%s: could not find device id\n", __func__);
2202	return nfserr_noent;
2203	}
2204
2205	nfserr = nfserr_layoutunavailable;
2206	ops = nfsd4_layout_verify(exp, layout_type: gdp->gd_layout_type);
2207	if (!ops)
2208	goto out;
2209
2210	nfserr = nfs_ok;
2211	if (gdp->gd_maxcount != 0) {
2212	nfserr = ops->proc_getdeviceinfo(exp->ex_path.mnt->mnt_sb,
2213	rqstp, cstate->clp, gdp);
2214	}
2215
2216	gdp->gd_notify_types &= ops->notify_types;
2217	out:
2218	exp_put(exp);
2219	return nfserr;
2220	}
2221
2222	static void
2223	nfsd4_getdeviceinfo_release(union nfsd4_op_u *u)
2224	{
2225	kfree(objp: u->getdeviceinfo.gd_device);
2226	}
2227
2228	static __be32
2229	nfsd4_layoutget(struct svc_rqst *rqstp,
2230	struct nfsd4_compound_state *cstate, union nfsd4_op_u *u)
2231	{
2232	struct nfsd4_layoutget *lgp = &u->layoutget;
2233	struct svc_fh *current_fh = &cstate->current_fh;
2234	const struct nfsd4_layout_ops *ops;
2235	struct nfs4_layout_stateid *ls;
2236	__be32 nfserr;
2237	int accmode = NFSD_MAY_READ_IF_EXEC;
2238
2239	switch (lgp->lg_seg.iomode) {
2240	case IOMODE_READ:
2241	accmode |= NFSD_MAY_READ;
2242	break;
2243	case IOMODE_RW:
2244	accmode |= NFSD_MAY_READ | NFSD_MAY_WRITE;
2245	break;
2246	default:
2247	dprintk("%s: invalid iomode %d\n",
2248	__func__, lgp->lg_seg.iomode);
2249	nfserr = nfserr_badiomode;
2250	goto out;
2251	}
2252
2253	nfserr = fh_verify(rqstp, current_fh, 0, accmode);
2254	if (nfserr)
2255	goto out;
2256
2257	nfserr = nfserr_layoutunavailable;
2258	ops = nfsd4_layout_verify(exp: current_fh->fh_export, layout_type: lgp->lg_layout_type);
2259	if (!ops)
2260	goto out;
2261
2262	/*
2263	* Verify minlength and range as per RFC5661:
2264	* o If loga_length is less than loga_minlength,
2265	* the metadata server MUST return NFS4ERR_INVAL.
2266	* o If the sum of loga_offset and loga_minlength exceeds
2267	* NFS4_UINT64_MAX, and loga_minlength is not
2268	* NFS4_UINT64_MAX, the error NFS4ERR_INVAL MUST result.
2269	* o If the sum of loga_offset and loga_length exceeds
2270	* NFS4_UINT64_MAX, and loga_length is not NFS4_UINT64_MAX,
2271	* the error NFS4ERR_INVAL MUST result.
2272	*/
2273	nfserr = nfserr_inval;
2274	if (lgp->lg_seg.length < lgp->lg_minlength ||
2275	(lgp->lg_minlength != NFS4_MAX_UINT64 &&
2276	lgp->lg_minlength > NFS4_MAX_UINT64 - lgp->lg_seg.offset) ||
2277	(lgp->lg_seg.length != NFS4_MAX_UINT64 &&
2278	lgp->lg_seg.length > NFS4_MAX_UINT64 - lgp->lg_seg.offset))
2279	goto out;
2280	if (lgp->lg_seg.length == 0)
2281	goto out;
2282
2283	nfserr = nfsd4_preprocess_layout_stateid(rqstp, cstate, stateid: &lgp->lg_sid,
2284	create: true, layout_type: lgp->lg_layout_type, lsp: &ls);
2285	if (nfserr) {
2286	trace_nfsd_layout_get_lookup_fail(stp: &lgp->lg_sid);
2287	goto out;
2288	}
2289
2290	nfserr = nfserr_recallconflict;
2291	if (atomic_read(v: &ls->ls_stid.sc_file->fi_lo_recalls))
2292	goto out_put_stid;
2293
2294	nfserr = ops->proc_layoutget(d_inode(dentry: current_fh->fh_dentry),
2295	current_fh, lgp);
2296	if (nfserr)
2297	goto out_put_stid;
2298
2299	nfserr = nfsd4_insert_layout(lgp, ls);
2300
2301	out_put_stid:
2302	mutex_unlock(lock: &ls->ls_mutex);
2303	nfs4_put_stid(s: &ls->ls_stid);
2304	out:
2305	return nfserr;
2306	}
2307
2308	static void
2309	nfsd4_layoutget_release(union nfsd4_op_u *u)
2310	{
2311	kfree(objp: u->layoutget.lg_content);
2312	}
2313
2314	static __be32
2315	nfsd4_layoutcommit(struct svc_rqst *rqstp,
2316	struct nfsd4_compound_state *cstate, union nfsd4_op_u *u)
2317	{
2318	struct nfsd4_layoutcommit *lcp = &u->layoutcommit;
2319	const struct nfsd4_layout_seg *seg = &lcp->lc_seg;
2320	struct svc_fh *current_fh = &cstate->current_fh;
2321	const struct nfsd4_layout_ops *ops;
2322	loff_t new_size = lcp->lc_last_wr + 1;
2323	struct inode *inode;
2324	struct nfs4_layout_stateid *ls;
2325	__be32 nfserr;
2326
2327	nfserr = fh_verify(rqstp, current_fh, 0, NFSD_MAY_WRITE);
2328	if (nfserr)
2329	goto out;
2330
2331	nfserr = nfserr_layoutunavailable;
2332	ops = nfsd4_layout_verify(exp: current_fh->fh_export, layout_type: lcp->lc_layout_type);
2333	if (!ops)
2334	goto out;
2335	inode = d_inode(dentry: current_fh->fh_dentry);
2336
2337	nfserr = nfserr_inval;
2338	if (new_size <= seg->offset) {
2339	dprintk("pnfsd: last write before layout segment\n");
2340	goto out;
2341	}
2342	if (new_size > seg->offset + seg->length) {
2343	dprintk("pnfsd: last write beyond layout segment\n");
2344	goto out;
2345	}
2346	if (!lcp->lc_newoffset && new_size > i_size_read(inode)) {
2347	dprintk("pnfsd: layoutcommit beyond EOF\n");
2348	goto out;
2349	}
2350
2351	nfserr = nfsd4_preprocess_layout_stateid(rqstp, cstate, stateid: &lcp->lc_sid,
2352	create: false, layout_type: lcp->lc_layout_type,
2353	lsp: &ls);
2354	if (nfserr) {
2355	trace_nfsd_layout_commit_lookup_fail(stp: &lcp->lc_sid);
2356	/* fixup error code as per RFC5661 */
2357	if (nfserr == nfserr_bad_stateid)
2358	nfserr = nfserr_badlayout;
2359	goto out;
2360	}
2361
2362	/* LAYOUTCOMMIT does not require any serialization */
2363	mutex_unlock(lock: &ls->ls_mutex);
2364
2365	if (new_size > i_size_read(inode)) {
2366	lcp->lc_size_chg = true;
2367	lcp->lc_newsize = new_size;
2368	} else {
2369	lcp->lc_size_chg = false;
2370	}
2371
2372	nfserr = ops->proc_layoutcommit(inode, lcp);
2373	nfs4_put_stid(s: &ls->ls_stid);
2374	out:
2375	return nfserr;
2376	}
2377
2378	static __be32
2379	nfsd4_layoutreturn(struct svc_rqst *rqstp,
2380	struct nfsd4_compound_state *cstate, union nfsd4_op_u *u)
2381	{
2382	struct nfsd4_layoutreturn *lrp = &u->layoutreturn;
2383	struct svc_fh *current_fh = &cstate->current_fh;
2384	__be32 nfserr;
2385
2386	nfserr = fh_verify(rqstp, current_fh, 0, NFSD_MAY_NOP);
2387	if (nfserr)
2388	goto out;
2389
2390	nfserr = nfserr_layoutunavailable;
2391	if (!nfsd4_layout_verify(exp: current_fh->fh_export, layout_type: lrp->lr_layout_type))
2392	goto out;
2393
2394	switch (lrp->lr_seg.iomode) {
2395	case IOMODE_READ:
2396	case IOMODE_RW:
2397	case IOMODE_ANY:
2398	break;
2399	default:
2400	dprintk("%s: invalid iomode %d\n", __func__,
2401	lrp->lr_seg.iomode);
2402	nfserr = nfserr_inval;
2403	goto out;
2404	}
2405
2406	switch (lrp->lr_return_type) {
2407	case RETURN_FILE:
2408	nfserr = nfsd4_return_file_layouts(rqstp, cstate, lrp);
2409	break;
2410	case RETURN_FSID:
2411	case RETURN_ALL:
2412	nfserr = nfsd4_return_client_layouts(rqstp, cstate, lrp);
2413	break;
2414	default:
2415	dprintk("%s: invalid return_type %d\n", __func__,
2416	lrp->lr_return_type);
2417	nfserr = nfserr_inval;
2418	break;
2419	}
2420	out:
2421	return nfserr;
2422	}
2423	#endif /* CONFIG_NFSD_PNFS */
2424
2425	static __be32
2426	nfsd4_getxattr(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
2427	union nfsd4_op_u *u)
2428	{
2429	struct nfsd4_getxattr *getxattr = &u->getxattr;
2430
2431	return nfsd_getxattr(rqstp, fhp: &cstate->current_fh,
2432	name: getxattr->getxa_name, bufp: &getxattr->getxa_buf,
2433	lenp: &getxattr->getxa_len);
2434	}
2435
2436	static __be32
2437	nfsd4_setxattr(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
2438	union nfsd4_op_u *u)
2439	{
2440	struct nfsd4_setxattr *setxattr = &u->setxattr;
2441	__be32 ret;
2442
2443	if (opens_in_grace(SVC_NET(rqstp)))
2444	return nfserr_grace;
2445
2446	ret = nfsd_setxattr(rqstp, fhp: &cstate->current_fh, name: setxattr->setxa_name,
2447	buf: setxattr->setxa_buf, len: setxattr->setxa_len,
2448	flags: setxattr->setxa_flags);
2449
2450	if (!ret)
2451	set_change_info(cinfo: &setxattr->setxa_cinfo, fhp: &cstate->current_fh);
2452
2453	return ret;
2454	}
2455
2456	static __be32
2457	nfsd4_listxattrs(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
2458	union nfsd4_op_u *u)
2459	{
2460	/*
2461	* Get the entire list, then copy out only the user attributes
2462	* in the encode function.
2463	*/
2464	return nfsd_listxattr(rqstp, fhp: &cstate->current_fh,
2465	bufp: &u->listxattrs.lsxa_buf, lenp: &u->listxattrs.lsxa_len);
2466	}
2467
2468	static __be32
2469	nfsd4_removexattr(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
2470	union nfsd4_op_u *u)
2471	{
2472	struct nfsd4_removexattr *removexattr = &u->removexattr;
2473	__be32 ret;
2474
2475	if (opens_in_grace(SVC_NET(rqstp)))
2476	return nfserr_grace;
2477
2478	ret = nfsd_removexattr(rqstp, fhp: &cstate->current_fh,
2479	name: removexattr->rmxa_name);
2480
2481	if (!ret)
2482	set_change_info(cinfo: &removexattr->rmxa_cinfo, fhp: &cstate->current_fh);
2483
2484	return ret;
2485	}
2486
2487	/*
2488	* NULL call.
2489	*/
2490	static __be32
2491	nfsd4_proc_null(struct svc_rqst *rqstp)
2492	{
2493	return rpc_success;
2494	}
2495
2496	static inline void nfsd4_increment_op_stats(struct nfsd_net *nn, u32 opnum)
2497	{
2498	if (opnum >= FIRST_NFS4_OP && opnum <= LAST_NFS4_OP)
2499	percpu_counter_inc(fbc: &nn->counter[NFSD_STATS_NFS4_OP(opnum)]);
2500	}
2501
2502	static const struct nfsd4_operation nfsd4_ops[];
2503
2504	static const char *nfsd4_op_name(unsigned opnum);
2505
2506	/*
2507	* Enforce NFSv4.1 COMPOUND ordering rules:
2508	*
2509	* Also note, enforced elsewhere:
2510	* - SEQUENCE other than as first op results in
2511	* NFS4ERR_SEQUENCE_POS. (Enforced in nfsd4_sequence().)
2512	* - BIND_CONN_TO_SESSION must be the only op in its compound.
2513	* (Enforced in nfsd4_bind_conn_to_session().)
2514	* - DESTROY_SESSION must be the final operation in a compound, if
2515	* sessionid's in SEQUENCE and DESTROY_SESSION are the same.
2516	* (Enforced in nfsd4_destroy_session().)
2517	*/
2518	static __be32 nfs41_check_op_ordering(struct nfsd4_compoundargs *args)
2519	{
2520	struct nfsd4_op *first_op = &args->ops[0];
2521
2522	/* These ordering requirements don't apply to NFSv4.0: */
2523	if (args->minorversion == 0)
2524	return nfs_ok;
2525	/* This is weird, but OK, not our problem: */
2526	if (args->opcnt == 0)
2527	return nfs_ok;
2528	if (first_op->status == nfserr_op_illegal)
2529	return nfs_ok;
2530	if (!(nfsd4_ops[first_op->opnum].op_flags & ALLOWED_AS_FIRST_OP))
2531	return nfserr_op_not_in_session;
2532	if (first_op->opnum == OP_SEQUENCE)
2533	return nfs_ok;
2534	/*
2535	* So first_op is something allowed outside a session, like
2536	* EXCHANGE_ID; but then it has to be the only op in the
2537	* compound:
2538	*/
2539	if (args->opcnt != 1)
2540	return nfserr_not_only_op;
2541	return nfs_ok;
2542	}
2543
2544	const struct nfsd4_operation *OPDESC(struct nfsd4_op *op)
2545	{
2546	return &nfsd4_ops[op->opnum];
2547	}
2548
2549	bool nfsd4_cache_this_op(struct nfsd4_op *op)
2550	{
2551	if (op->opnum == OP_ILLEGAL)
2552	return false;
2553	return OPDESC(op)->op_flags & OP_CACHEME;
2554	}
2555
2556	static bool need_wrongsec_check(struct svc_rqst *rqstp)
2557	{
2558	struct nfsd4_compoundres *resp = rqstp->rq_resp;
2559	struct nfsd4_compoundargs *argp = rqstp->rq_argp;
2560	struct nfsd4_op *this = &argp->ops[resp->opcnt - 1];
2561	struct nfsd4_op *next = &argp->ops[resp->opcnt];
2562	const struct nfsd4_operation *thisd = OPDESC(op: this);
2563	const struct nfsd4_operation *nextd;
2564
2565	/*
2566	* Most ops check wronsec on our own; only the putfh-like ops
2567	* have special rules.
2568	*/
2569	if (!(thisd->op_flags & OP_IS_PUTFH_LIKE))
2570	return false;
2571	/*
2572	* rfc 5661 2.6.3.1.1.6: don't bother erroring out a
2573	* put-filehandle operation if we're not going to use the
2574	* result:
2575	*/
2576	if (argp->opcnt == resp->opcnt)
2577	return false;
2578	if (next->opnum == OP_ILLEGAL)
2579	return false;
2580	nextd = OPDESC(op: next);
2581	/*
2582	* Rest of 2.6.3.1.1: certain operations will return WRONGSEC
2583	* errors themselves as necessary; others should check for them
2584	* now:
2585	*/
2586	return !(nextd->op_flags & OP_HANDLES_WRONGSEC);
2587	}
2588
2589	#ifdef CONFIG_NFSD_V4_2_INTER_SSC
2590	static void
2591	check_if_stalefh_allowed(struct nfsd4_compoundargs *args)
2592	{
2593	struct nfsd4_op *op, *current_op = NULL, *saved_op = NULL;
2594	struct nfsd4_copy *copy;
2595	struct nfsd4_putfh *putfh;
2596	int i;
2597
2598	/* traverse all operation and if it's a COPY compound, mark the
2599	* source filehandle to skip verification
2600	*/
2601	for (i = 0; i < args->opcnt; i++) {
2602	op = &args->ops[i];
2603	if (op->opnum == OP_PUTFH)
2604	current_op = op;
2605	else if (op->opnum == OP_SAVEFH)
2606	saved_op = current_op;
2607	else if (op->opnum == OP_RESTOREFH)
2608	current_op = saved_op;
2609	else if (op->opnum == OP_COPY) {
2610	copy = (struct nfsd4_copy *)&op->u;
2611	if (!saved_op) {
2612	op->status = nfserr_nofilehandle;
2613	return;
2614	}
2615	putfh = (struct nfsd4_putfh *)&saved_op->u;
2616	if (nfsd4_ssc_is_inter(copy))
2617	putfh->no_verify = true;
2618	}
2619	}
2620	}
2621	#else
2622	static void
2623	check_if_stalefh_allowed(struct nfsd4_compoundargs *args)
2624	{
2625	}
2626	#endif
2627
2628	/*
2629	* COMPOUND call.
2630	*/
2631	static __be32
2632	nfsd4_proc_compound(struct svc_rqst *rqstp)
2633	{
2634	struct nfsd4_compoundargs *args = rqstp->rq_argp;
2635	struct nfsd4_compoundres *resp = rqstp->rq_resp;
2636	struct nfsd4_op *op;
2637	struct nfsd4_compound_state *cstate = &resp->cstate;
2638	struct svc_fh *current_fh = &cstate->current_fh;
2639	struct svc_fh *save_fh = &cstate->save_fh;
2640	struct nfsd_net *nn = net_generic(SVC_NET(rqstp), id: nfsd_net_id);
2641	__be32 status;
2642
2643	resp->xdr = &rqstp->rq_res_stream;
2644	resp->statusp = resp->xdr->p;
2645
2646	/* reserve space for: NFS status code */
2647	xdr_reserve_space(xdr: resp->xdr, XDR_UNIT);
2648
2649	/* reserve space for: taglen, tag, and opcnt */
2650	xdr_reserve_space(xdr: resp->xdr, XDR_UNIT * 2 + args->taglen);
2651	resp->taglen = args->taglen;
2652	resp->tag = args->tag;
2653	resp->rqstp = rqstp;
2654	cstate->minorversion = args->minorversion;
2655	fh_init(fhp: current_fh, NFS4_FHSIZE);
2656	fh_init(fhp: save_fh, NFS4_FHSIZE);
2657	/*
2658	* Don't use the deferral mechanism for NFSv4; compounds make it
2659	* too hard to avoid non-idempotency problems.
2660	*/
2661	clear_bit(nr: RQ_USEDEFERRAL, addr: &rqstp->rq_flags);
2662
2663	/*
2664	* According to RFC3010, this takes precedence over all other errors.
2665	*/
2666	status = nfserr_minor_vers_mismatch;
2667	if (nfsd_minorversion(nn, minorversion: args->minorversion, change: NFSD_TEST) <= 0)
2668	goto out;
2669
2670	status = nfs41_check_op_ordering(args);
2671	if (status) {
2672	op = &args->ops[0];
2673	op->status = status;
2674	resp->opcnt = 1;
2675	goto encode_op;
2676	}
2677	check_if_stalefh_allowed(args);
2678
2679	rqstp->rq_lease_breaker = (void **)&cstate->clp;
2680
2681	trace_nfsd_compound(rqst: rqstp, tag: args->tag, taglen: args->taglen, opcnt: args->client_opcnt);
2682	while (!status && resp->opcnt < args->opcnt) {
2683	op = &args->ops[resp->opcnt++];
2684
2685	if (unlikely(resp->opcnt == NFSD_MAX_OPS_PER_COMPOUND)) {
2686	/* If there are still more operations to process,
2687	* stop here and report NFS4ERR_RESOURCE. */
2688	if (cstate->minorversion == 0 &&
2689	args->client_opcnt > resp->opcnt) {
2690	op->status = nfserr_resource;
2691	goto encode_op;
2692	}
2693	}
2694
2695	/*
2696	* The XDR decode routines may have pre-set op->status;
2697	* for example, if there is a miscellaneous XDR error
2698	* it will be set to nfserr_bad_xdr.
2699	*/
2700	if (op->status) {
2701	if (op->opnum == OP_OPEN)
2702	op->status = nfsd4_open_omfg(rqstp, cstate, op);
2703	goto encode_op;
2704	}
2705	if (!current_fh->fh_dentry &&
2706	!HAS_FH_FLAG(current_fh, NFSD4_FH_FOREIGN)) {
2707	if (!(op->opdesc->op_flags & ALLOWED_WITHOUT_FH)) {
2708	op->status = nfserr_nofilehandle;
2709	goto encode_op;
2710	}
2711	} else if (current_fh->fh_export &&
2712	current_fh->fh_export->ex_fslocs.migrated &&
2713	!(op->opdesc->op_flags & ALLOWED_ON_ABSENT_FS)) {
2714	op->status = nfserr_moved;
2715	goto encode_op;
2716	}
2717
2718	fh_clear_pre_post_attrs(fhp: current_fh);
2719
2720	/* If op is non-idempotent */
2721	if (op->opdesc->op_flags & OP_MODIFIES_SOMETHING) {
2722	/*
2723	* Don't execute this op if we couldn't encode a
2724	* successful reply:
2725	*/
2726	u32 plen = op->opdesc->op_rsize_bop(rqstp, op);
2727	/*
2728	* Plus if there's another operation, make sure
2729	* we'll have space to at least encode an error:
2730	*/
2731	if (resp->opcnt < args->opcnt)
2732	plen += COMPOUND_ERR_SLACK_SPACE;
2733	op->status = nfsd4_check_resp_size(resp, plen);
2734	}
2735
2736	if (op->status)
2737	goto encode_op;
2738
2739	if (op->opdesc->op_get_currentstateid)
2740	op->opdesc->op_get_currentstateid(cstate, &op->u);
2741	op->status = op->opdesc->op_func(rqstp, cstate, &op->u);
2742
2743	/* Only from SEQUENCE */
2744	if (cstate->status == nfserr_replay_cache) {
2745	dprintk("%s NFS4.1 replay from cache\n", __func__);
2746	status = op->status;
2747	goto out;
2748	}
2749	if (!op->status) {
2750	if (op->opdesc->op_set_currentstateid)
2751	op->opdesc->op_set_currentstateid(cstate, &op->u);
2752
2753	if (op->opdesc->op_flags & OP_CLEAR_STATEID)
2754	clear_current_stateid(cstate);
2755
2756	if (current_fh->fh_export &&
2757	need_wrongsec_check(rqstp))
2758	op->status = check_nfsd_access(exp: current_fh->fh_export, rqstp);
2759	}
2760	encode_op:
2761	if (op->status == nfserr_replay_me) {
2762	op->replay = &cstate->replay_owner->so_replay;
2763	nfsd4_encode_replay(xdr: resp->xdr, op);
2764	status = op->status = op->replay->rp_status;
2765	} else {
2766	nfsd4_encode_operation(resp, op);
2767	status = op->status;
2768	}
2769
2770	trace_nfsd_compound_status(args_opcnt: args->client_opcnt, resp_opcnt: resp->opcnt,
2771	status, name: nfsd4_op_name(opnum: op->opnum));
2772
2773	nfsd4_cstate_clear_replay(cstate);
2774	nfsd4_increment_op_stats(nn, opnum: op->opnum);
2775	}
2776
2777	fh_put(current_fh);
2778	fh_put(save_fh);
2779	BUG_ON(cstate->replay_owner);
2780	out:
2781	cstate->status = status;
2782	/* Reset deferral mechanism for RPC deferrals */
2783	set_bit(nr: RQ_USEDEFERRAL, addr: &rqstp->rq_flags);
2784	return rpc_success;
2785	}
2786
2787	#define op_encode_hdr_size (2)
2788	#define op_encode_stateid_maxsz (XDR_QUADLEN(NFS4_STATEID_SIZE))
2789	#define op_encode_verifier_maxsz (XDR_QUADLEN(NFS4_VERIFIER_SIZE))
2790	#define op_encode_change_info_maxsz (5)
2791	#define nfs4_fattr_bitmap_maxsz (4)
2792
2793	/* We'll fall back on returning no lockowner if run out of space: */
2794	#define op_encode_lockowner_maxsz (0)
2795	#define op_encode_lock_denied_maxsz (8 + op_encode_lockowner_maxsz)
2796
2797	#define nfs4_owner_maxsz (1 + XDR_QUADLEN(IDMAP_NAMESZ))
2798
2799	#define op_encode_ace_maxsz (3 + nfs4_owner_maxsz)
2800	#define op_encode_delegation_maxsz (1 + op_encode_stateid_maxsz + 1 + \
2801	op_encode_ace_maxsz)
2802
2803	#define op_encode_channel_attrs_maxsz (6 + 1 + 1)
2804
2805	/*
2806	* The _rsize() helpers are invoked by the NFSv4 COMPOUND decoder, which
2807	* is called before sunrpc sets rq_res.buflen. Thus we have to compute
2808	* the maximum payload size here, based on transport limits and the size
2809	* of the remaining space in the rq_pages array.
2810	*/
2811	static u32 nfsd4_max_payload(const struct svc_rqst *rqstp)
2812	{
2813	u32 buflen;
2814
2815	buflen = (rqstp->rq_page_end - rqstp->rq_next_page) * PAGE_SIZE;
2816	buflen -= rqstp->rq_auth_slack;
2817	buflen -= rqstp->rq_res.head[0].iov_len;
2818	return min_t(u32, buflen, svc_max_payload(rqstp));
2819	}
2820
2821	static u32 nfsd4_only_status_rsize(const struct svc_rqst *rqstp,
2822	const struct nfsd4_op *op)
2823	{
2824	return (op_encode_hdr_size) * sizeof(__be32);
2825	}
2826
2827	static u32 nfsd4_status_stateid_rsize(const struct svc_rqst *rqstp,
2828	const struct nfsd4_op *op)
2829	{
2830	return (op_encode_hdr_size + op_encode_stateid_maxsz)* sizeof(__be32);
2831	}
2832
2833	static u32 nfsd4_access_rsize(const struct svc_rqst *rqstp,
2834	const struct nfsd4_op *op)
2835	{
2836	/* ac_supported, ac_resp_access */
2837	return (op_encode_hdr_size + 2)* sizeof(__be32);
2838	}
2839
2840	static u32 nfsd4_commit_rsize(const struct svc_rqst *rqstp,
2841	const struct nfsd4_op *op)
2842	{
2843	return (op_encode_hdr_size + op_encode_verifier_maxsz) * sizeof(__be32);
2844	}
2845
2846	static u32 nfsd4_create_rsize(const struct svc_rqst *rqstp,
2847	const struct nfsd4_op *op)
2848	{
2849	return (op_encode_hdr_size + op_encode_change_info_maxsz
2850	+ nfs4_fattr_bitmap_maxsz) * sizeof(__be32);
2851	}
2852
2853	/*
2854	* Note since this is an idempotent operation we won't insist on failing
2855	* the op prematurely if the estimate is too large. We may turn off splice
2856	* reads unnecessarily.
2857	*/
2858	static u32 nfsd4_getattr_rsize(const struct svc_rqst *rqstp,
2859	const struct nfsd4_op *op)
2860	{
2861	const u32 *bmap = op->u.getattr.ga_bmval;
2862	u32 bmap0 = bmap[0], bmap1 = bmap[1], bmap2 = bmap[2];
2863	u32 ret = 0;
2864
2865	if (bmap0 & FATTR4_WORD0_ACL)
2866	return nfsd4_max_payload(rqstp);
2867	if (bmap0 & FATTR4_WORD0_FS_LOCATIONS)
2868	return nfsd4_max_payload(rqstp);
2869
2870	if (bmap1 & FATTR4_WORD1_OWNER) {
2871	ret += IDMAP_NAMESZ + 4;
2872	bmap1 &= ~FATTR4_WORD1_OWNER;
2873	}
2874	if (bmap1 & FATTR4_WORD1_OWNER_GROUP) {
2875	ret += IDMAP_NAMESZ + 4;
2876	bmap1 &= ~FATTR4_WORD1_OWNER_GROUP;
2877	}
2878	if (bmap0 & FATTR4_WORD0_FILEHANDLE) {
2879	ret += NFS4_FHSIZE + 4;
2880	bmap0 &= ~FATTR4_WORD0_FILEHANDLE;
2881	}
2882	if (bmap2 & FATTR4_WORD2_SECURITY_LABEL) {
2883	ret += NFS4_MAXLABELLEN + 12;
2884	bmap2 &= ~FATTR4_WORD2_SECURITY_LABEL;
2885	}
2886	/*
2887	* Largest of remaining attributes are 16 bytes (e.g.,
2888	* supported_attributes)
2889	*/
2890	ret += 16 * (hweight32(bmap0) + hweight32(bmap1) + hweight32(bmap2));
2891	/* bitmask, length */
2892	ret += 20;
2893	return ret;
2894	}
2895
2896	static u32 nfsd4_getfh_rsize(const struct svc_rqst *rqstp,
2897	const struct nfsd4_op *op)
2898	{
2899	return (op_encode_hdr_size + 1) * sizeof(__be32) + NFS4_FHSIZE;
2900	}
2901
2902	static u32 nfsd4_link_rsize(const struct svc_rqst *rqstp,
2903	const struct nfsd4_op *op)
2904	{
2905	return (op_encode_hdr_size + op_encode_change_info_maxsz)
2906	* sizeof(__be32);
2907	}
2908
2909	static u32 nfsd4_lock_rsize(const struct svc_rqst *rqstp,
2910	const struct nfsd4_op *op)
2911	{
2912	return (op_encode_hdr_size + op_encode_lock_denied_maxsz)
2913	* sizeof(__be32);
2914	}
2915
2916	static u32 nfsd4_open_rsize(const struct svc_rqst *rqstp,
2917	const struct nfsd4_op *op)
2918	{
2919	return (op_encode_hdr_size + op_encode_stateid_maxsz
2920	+ op_encode_change_info_maxsz + 1
2921	+ nfs4_fattr_bitmap_maxsz
2922	+ op_encode_delegation_maxsz) * sizeof(__be32);
2923	}
2924
2925	static u32 nfsd4_read_rsize(const struct svc_rqst *rqstp,
2926	const struct nfsd4_op *op)
2927	{
2928	u32 rlen = min(op->u.read.rd_length, nfsd4_max_payload(rqstp));
2929
2930	return (op_encode_hdr_size + 2 + XDR_QUADLEN(rlen)) * sizeof(__be32);
2931	}
2932
2933	static u32 nfsd4_read_plus_rsize(const struct svc_rqst *rqstp,
2934	const struct nfsd4_op *op)
2935	{
2936	u32 rlen = min(op->u.read.rd_length, nfsd4_max_payload(rqstp));
2937	/*
2938	* If we detect that the file changed during hole encoding, then we
2939	* recover by encoding the remaining reply as data. This means we need
2940	* to set aside enough room to encode two data segments.
2941	*/
2942	u32 seg_len = 2 * (1 + 2 + 1);
2943
2944	return (op_encode_hdr_size + 2 + seg_len + XDR_QUADLEN(rlen)) * sizeof(__be32);
2945	}
2946
2947	static u32 nfsd4_readdir_rsize(const struct svc_rqst *rqstp,
2948	const struct nfsd4_op *op)
2949	{
2950	u32 rlen = min(op->u.readdir.rd_maxcount, nfsd4_max_payload(rqstp));
2951
2952	return (op_encode_hdr_size + op_encode_verifier_maxsz +
2953	XDR_QUADLEN(rlen)) * sizeof(__be32);
2954	}
2955
2956	static u32 nfsd4_readlink_rsize(const struct svc_rqst *rqstp,
2957	const struct nfsd4_op *op)
2958	{
2959	return (op_encode_hdr_size + 1) * sizeof(__be32) + PAGE_SIZE;
2960	}
2961
2962	static u32 nfsd4_remove_rsize(const struct svc_rqst *rqstp,
2963	const struct nfsd4_op *op)
2964	{
2965	return (op_encode_hdr_size + op_encode_change_info_maxsz)
2966	* sizeof(__be32);
2967	}
2968
2969	static u32 nfsd4_rename_rsize(const struct svc_rqst *rqstp,
2970	const struct nfsd4_op *op)
2971	{
2972	return (op_encode_hdr_size + op_encode_change_info_maxsz
2973	+ op_encode_change_info_maxsz) * sizeof(__be32);
2974	}
2975
2976	static u32 nfsd4_sequence_rsize(const struct svc_rqst *rqstp,
2977	const struct nfsd4_op *op)
2978	{
2979	return (op_encode_hdr_size
2980	+ XDR_QUADLEN(NFS4_MAX_SESSIONID_LEN) + 5) * sizeof(__be32);
2981	}
2982
2983	static u32 nfsd4_test_stateid_rsize(const struct svc_rqst *rqstp,
2984	const struct nfsd4_op *op)
2985	{
2986	return (op_encode_hdr_size + 1 + op->u.test_stateid.ts_num_ids)
2987	* sizeof(__be32);
2988	}
2989
2990	static u32 nfsd4_setattr_rsize(const struct svc_rqst *rqstp,
2991	const struct nfsd4_op *op)
2992	{
2993	return (op_encode_hdr_size + nfs4_fattr_bitmap_maxsz) * sizeof(__be32);
2994	}
2995
2996	static u32 nfsd4_secinfo_rsize(const struct svc_rqst *rqstp,
2997	const struct nfsd4_op *op)
2998	{
2999	return (op_encode_hdr_size + RPC_AUTH_MAXFLAVOR *
3000	(4 + XDR_QUADLEN(GSS_OID_MAX_LEN))) * sizeof(__be32);
3001	}
3002
3003	static u32 nfsd4_setclientid_rsize(const struct svc_rqst *rqstp,
3004	const struct nfsd4_op *op)
3005	{
3006	return (op_encode_hdr_size + 2 + XDR_QUADLEN(NFS4_VERIFIER_SIZE)) *
3007	sizeof(__be32);
3008	}
3009
3010	static u32 nfsd4_write_rsize(const struct svc_rqst *rqstp,
3011	const struct nfsd4_op *op)
3012	{
3013	return (op_encode_hdr_size + 2 + op_encode_verifier_maxsz) * sizeof(__be32);
3014	}
3015
3016	static u32 nfsd4_exchange_id_rsize(const struct svc_rqst *rqstp,
3017	const struct nfsd4_op *op)
3018	{
3019	return (op_encode_hdr_size + 2 + 1 + /* eir_clientid, eir_sequenceid */\
3020	1 + 1 + /* eir_flags, spr_how */\
3021	4 + /* spo_must_enforce & _allow with bitmap */\
3022	2 + /*eir_server_owner.so_minor_id */\
3023	/* eir_server_owner.so_major_id<> */\
3024	XDR_QUADLEN(NFS4_OPAQUE_LIMIT) + 1 +\
3025	/* eir_server_scope<> */\
3026	XDR_QUADLEN(NFS4_OPAQUE_LIMIT) + 1 +\
3027	1 + /* eir_server_impl_id array length */\
3028	0 /* ignored eir_server_impl_id contents */) * sizeof(__be32);
3029	}
3030
3031	static u32 nfsd4_bind_conn_to_session_rsize(const struct svc_rqst *rqstp,
3032	const struct nfsd4_op *op)
3033	{
3034	return (op_encode_hdr_size + \
3035	XDR_QUADLEN(NFS4_MAX_SESSIONID_LEN) + /* bctsr_sessid */\
3036	2 /* bctsr_dir, use_conn_in_rdma_mode */) * sizeof(__be32);
3037	}
3038
3039	static u32 nfsd4_create_session_rsize(const struct svc_rqst *rqstp,
3040	const struct nfsd4_op *op)
3041	{
3042	return (op_encode_hdr_size + \
3043	XDR_QUADLEN(NFS4_MAX_SESSIONID_LEN) + /* sessionid */\
3044	2 + /* csr_sequence, csr_flags */\
3045	op_encode_channel_attrs_maxsz + \
3046	op_encode_channel_attrs_maxsz) * sizeof(__be32);
3047	}
3048
3049	static u32 nfsd4_copy_rsize(const struct svc_rqst *rqstp,
3050	const struct nfsd4_op *op)
3051	{
3052	return (op_encode_hdr_size +
3053	1 /* wr_callback */ +
3054	op_encode_stateid_maxsz /* wr_callback */ +
3055	2 /* wr_count */ +
3056	1 /* wr_committed */ +
3057	op_encode_verifier_maxsz +
3058	1 /* cr_consecutive */ +
3059	1 /* cr_synchronous */) * sizeof(__be32);
3060	}
3061
3062	static u32 nfsd4_offload_status_rsize(const struct svc_rqst *rqstp,
3063	const struct nfsd4_op *op)
3064	{
3065	return (op_encode_hdr_size +
3066	2 /* osr_count */ +
3067	1 /* osr_complete<1> optional 0 for now */) * sizeof(__be32);
3068	}
3069
3070	static u32 nfsd4_copy_notify_rsize(const struct svc_rqst *rqstp,
3071	const struct nfsd4_op *op)
3072	{
3073	return (op_encode_hdr_size +
3074	3 /* cnr_lease_time */ +
3075	1 /* We support one cnr_source_server */ +
3076	1 /* cnr_stateid seq */ +
3077	op_encode_stateid_maxsz /* cnr_stateid */ +
3078	1 /* num cnr_source_server*/ +
3079	1 /* nl4_type */ +
3080	1 /* nl4 size */ +
3081	XDR_QUADLEN(NFS4_OPAQUE_LIMIT) /*nl4_loc + nl4_loc_sz */)
3082	* sizeof(__be32);
3083	}
3084
3085	#ifdef CONFIG_NFSD_PNFS
3086	static u32 nfsd4_getdeviceinfo_rsize(const struct svc_rqst *rqstp,
3087	const struct nfsd4_op *op)
3088	{
3089	u32 rlen = min(op->u.getdeviceinfo.gd_maxcount, nfsd4_max_payload(rqstp));
3090
3091	return (op_encode_hdr_size +
3092	1 /* gd_layout_type*/ +
3093	XDR_QUADLEN(rlen) +
3094	2 /* gd_notify_types */) * sizeof(__be32);
3095	}
3096
3097	/*
3098	* At this stage we don't really know what layout driver will handle the request,
3099	* so we need to define an arbitrary upper bound here.
3100	*/
3101	#define MAX_LAYOUT_SIZE 128
3102	static u32 nfsd4_layoutget_rsize(const struct svc_rqst *rqstp,
3103	const struct nfsd4_op *op)
3104	{
3105	return (op_encode_hdr_size +
3106	1 /* logr_return_on_close */ +
3107	op_encode_stateid_maxsz +
3108	1 /* nr of layouts */ +
3109	MAX_LAYOUT_SIZE) * sizeof(__be32);
3110	}
3111
3112	static u32 nfsd4_layoutcommit_rsize(const struct svc_rqst *rqstp,
3113	const struct nfsd4_op *op)
3114	{
3115	return (op_encode_hdr_size +
3116	1 /* locr_newsize */ +
3117	2 /* ns_size */) * sizeof(__be32);
3118	}
3119
3120	static u32 nfsd4_layoutreturn_rsize(const struct svc_rqst *rqstp,
3121	const struct nfsd4_op *op)
3122	{
3123	return (op_encode_hdr_size +
3124	1 /* lrs_stateid */ +
3125	op_encode_stateid_maxsz) * sizeof(__be32);
3126	}
3127	#endif /* CONFIG_NFSD_PNFS */
3128
3129
3130	static u32 nfsd4_seek_rsize(const struct svc_rqst *rqstp,
3131	const struct nfsd4_op *op)
3132	{
3133	return (op_encode_hdr_size + 3) * sizeof(__be32);
3134	}
3135
3136	static u32 nfsd4_getxattr_rsize(const struct svc_rqst *rqstp,
3137	const struct nfsd4_op *op)
3138	{
3139	u32 rlen = min_t(u32, XATTR_SIZE_MAX, nfsd4_max_payload(rqstp));
3140
3141	return (op_encode_hdr_size + 1 + XDR_QUADLEN(rlen)) * sizeof(__be32);
3142	}
3143
3144	static u32 nfsd4_setxattr_rsize(const struct svc_rqst *rqstp,
3145	const struct nfsd4_op *op)
3146	{
3147	return (op_encode_hdr_size + op_encode_change_info_maxsz)
3148	* sizeof(__be32);
3149	}
3150	static u32 nfsd4_listxattrs_rsize(const struct svc_rqst *rqstp,
3151	const struct nfsd4_op *op)
3152	{
3153	u32 rlen = min(op->u.listxattrs.lsxa_maxcount, nfsd4_max_payload(rqstp));
3154
3155	return (op_encode_hdr_size + 4 + XDR_QUADLEN(rlen)) * sizeof(__be32);
3156	}
3157
3158	static u32 nfsd4_removexattr_rsize(const struct svc_rqst *rqstp,
3159	const struct nfsd4_op *op)
3160	{
3161	return (op_encode_hdr_size + op_encode_change_info_maxsz)
3162	* sizeof(__be32);
3163	}
3164
3165
3166	static const struct nfsd4_operation nfsd4_ops[] = {
3167	[OP_ACCESS] = {
3168	.op_func = nfsd4_access,
3169	.op_name = "OP_ACCESS",
3170	.op_rsize_bop = nfsd4_access_rsize,
3171	},
3172	[OP_CLOSE] = {
3173	.op_func = nfsd4_close,
3174	.op_flags = OP_MODIFIES_SOMETHING,
3175	.op_name = "OP_CLOSE",
3176	.op_rsize_bop = nfsd4_status_stateid_rsize,
3177	.op_get_currentstateid = nfsd4_get_closestateid,
3178	.op_set_currentstateid = nfsd4_set_closestateid,
3179	},
3180	[OP_COMMIT] = {
3181	.op_func = nfsd4_commit,
3182	.op_flags = OP_MODIFIES_SOMETHING,
3183	.op_name = "OP_COMMIT",
3184	.op_rsize_bop = nfsd4_commit_rsize,
3185	},
3186	[OP_CREATE] = {
3187	.op_func = nfsd4_create,
3188	.op_flags = OP_MODIFIES_SOMETHING | OP_CACHEME | OP_CLEAR_STATEID,
3189	.op_name = "OP_CREATE",
3190	.op_rsize_bop = nfsd4_create_rsize,
3191	},
3192	[OP_DELEGRETURN] = {
3193	.op_func = nfsd4_delegreturn,
3194	.op_flags = OP_MODIFIES_SOMETHING,
3195	.op_name = "OP_DELEGRETURN",
3196	.op_rsize_bop = nfsd4_only_status_rsize,
3197	.op_get_currentstateid = nfsd4_get_delegreturnstateid,
3198	},
3199	[OP_GETATTR] = {
3200	.op_func = nfsd4_getattr,
3201	.op_flags = ALLOWED_ON_ABSENT_FS,
3202	.op_rsize_bop = nfsd4_getattr_rsize,
3203	.op_name = "OP_GETATTR",
3204	},
3205	[OP_GETFH] = {
3206	.op_func = nfsd4_getfh,
3207	.op_name = "OP_GETFH",
3208	.op_rsize_bop = nfsd4_getfh_rsize,
3209	},
3210	[OP_LINK] = {
3211	.op_func = nfsd4_link,
3212	.op_flags = ALLOWED_ON_ABSENT_FS | OP_MODIFIES_SOMETHING
3213	| OP_CACHEME,
3214	.op_name = "OP_LINK",
3215	.op_rsize_bop = nfsd4_link_rsize,
3216	},
3217	[OP_LOCK] = {
3218	.op_func = nfsd4_lock,
3219	.op_release = nfsd4_lock_release,
3220	.op_flags = OP_MODIFIES_SOMETHING |
3221	OP_NONTRIVIAL_ERROR_ENCODE,
3222	.op_name = "OP_LOCK",
3223	.op_rsize_bop = nfsd4_lock_rsize,
3224	.op_set_currentstateid = nfsd4_set_lockstateid,
3225	},
3226	[OP_LOCKT] = {
3227	.op_func = nfsd4_lockt,
3228	.op_release = nfsd4_lockt_release,
3229	.op_flags = OP_NONTRIVIAL_ERROR_ENCODE,
3230	.op_name = "OP_LOCKT",
3231	.op_rsize_bop = nfsd4_lock_rsize,
3232	},
3233	[OP_LOCKU] = {
3234	.op_func = nfsd4_locku,
3235	.op_flags = OP_MODIFIES_SOMETHING,
3236	.op_name = "OP_LOCKU",
3237	.op_rsize_bop = nfsd4_status_stateid_rsize,
3238	.op_get_currentstateid = nfsd4_get_lockustateid,
3239	},
3240	[OP_LOOKUP] = {
3241	.op_func = nfsd4_lookup,
3242	.op_flags = OP_HANDLES_WRONGSEC | OP_CLEAR_STATEID,
3243	.op_name = "OP_LOOKUP",
3244	.op_rsize_bop = nfsd4_only_status_rsize,
3245	},
3246	[OP_LOOKUPP] = {
3247	.op_func = nfsd4_lookupp,
3248	.op_flags = OP_HANDLES_WRONGSEC | OP_CLEAR_STATEID,
3249	.op_name = "OP_LOOKUPP",
3250	.op_rsize_bop = nfsd4_only_status_rsize,
3251	},
3252	[OP_NVERIFY] = {
3253	.op_func = nfsd4_nverify,
3254	.op_name = "OP_NVERIFY",
3255	.op_rsize_bop = nfsd4_only_status_rsize,
3256	},
3257	[OP_OPEN] = {
3258	.op_func = nfsd4_open,
3259	.op_flags = OP_HANDLES_WRONGSEC | OP_MODIFIES_SOMETHING,
3260	.op_name = "OP_OPEN",
3261	.op_rsize_bop = nfsd4_open_rsize,
3262	.op_set_currentstateid = nfsd4_set_openstateid,
3263	},
3264	[OP_OPEN_CONFIRM] = {
3265	.op_func = nfsd4_open_confirm,
3266	.op_flags = OP_MODIFIES_SOMETHING,
3267	.op_name = "OP_OPEN_CONFIRM",
3268	.op_rsize_bop = nfsd4_status_stateid_rsize,
3269	},
3270	[OP_OPEN_DOWNGRADE] = {
3271	.op_func = nfsd4_open_downgrade,
3272	.op_flags = OP_MODIFIES_SOMETHING,
3273	.op_name = "OP_OPEN_DOWNGRADE",
3274	.op_rsize_bop = nfsd4_status_stateid_rsize,
3275	.op_get_currentstateid = nfsd4_get_opendowngradestateid,
3276	.op_set_currentstateid = nfsd4_set_opendowngradestateid,
3277	},
3278	[OP_PUTFH] = {
3279	.op_func = nfsd4_putfh,
3280	.op_flags = ALLOWED_WITHOUT_FH | ALLOWED_ON_ABSENT_FS
3281	| OP_IS_PUTFH_LIKE | OP_CLEAR_STATEID,
3282	.op_name = "OP_PUTFH",
3283	.op_rsize_bop = nfsd4_only_status_rsize,
3284	},
3285	[OP_PUTPUBFH] = {
3286	.op_func = nfsd4_putrootfh,
3287	.op_flags = ALLOWED_WITHOUT_FH | ALLOWED_ON_ABSENT_FS
3288	| OP_IS_PUTFH_LIKE | OP_CLEAR_STATEID,
3289	.op_name = "OP_PUTPUBFH",
3290	.op_rsize_bop = nfsd4_only_status_rsize,
3291	},
3292	[OP_PUTROOTFH] = {
3293	.op_func = nfsd4_putrootfh,
3294	.op_flags = ALLOWED_WITHOUT_FH | ALLOWED_ON_ABSENT_FS
3295	| OP_IS_PUTFH_LIKE | OP_CLEAR_STATEID,
3296	.op_name = "OP_PUTROOTFH",
3297	.op_rsize_bop = nfsd4_only_status_rsize,
3298	},
3299	[OP_READ] = {
3300	.op_func = nfsd4_read,
3301	.op_release = nfsd4_read_release,
3302	.op_name = "OP_READ",
3303	.op_rsize_bop = nfsd4_read_rsize,
3304	.op_get_currentstateid = nfsd4_get_readstateid,
3305	},
3306	[OP_READDIR] = {
3307	.op_func = nfsd4_readdir,
3308	.op_name = "OP_READDIR",
3309	.op_rsize_bop = nfsd4_readdir_rsize,
3310	},
3311	[OP_READLINK] = {
3312	.op_func = nfsd4_readlink,
3313	.op_name = "OP_READLINK",
3314	.op_rsize_bop = nfsd4_readlink_rsize,
3315	},
3316	[OP_REMOVE] = {
3317	.op_func = nfsd4_remove,
3318	.op_flags = OP_MODIFIES_SOMETHING | OP_CACHEME,
3319	.op_name = "OP_REMOVE",
3320	.op_rsize_bop = nfsd4_remove_rsize,
3321	},
3322	[OP_RENAME] = {
3323	.op_func = nfsd4_rename,
3324	.op_flags = OP_MODIFIES_SOMETHING | OP_CACHEME,
3325	.op_name = "OP_RENAME",
3326	.op_rsize_bop = nfsd4_rename_rsize,
3327	},
3328	[OP_RENEW] = {
3329	.op_func = nfsd4_renew,
3330	.op_flags = ALLOWED_WITHOUT_FH | ALLOWED_ON_ABSENT_FS
3331	| OP_MODIFIES_SOMETHING,
3332	.op_name = "OP_RENEW",
3333	.op_rsize_bop = nfsd4_only_status_rsize,
3334
3335	},
3336	[OP_RESTOREFH] = {
3337	.op_func = nfsd4_restorefh,
3338	.op_flags = ALLOWED_WITHOUT_FH | ALLOWED_ON_ABSENT_FS
3339	| OP_IS_PUTFH_LIKE | OP_MODIFIES_SOMETHING,
3340	.op_name = "OP_RESTOREFH",
3341	.op_rsize_bop = nfsd4_only_status_rsize,
3342	},
3343	[OP_SAVEFH] = {
3344	.op_func = nfsd4_savefh,
3345	.op_flags = OP_HANDLES_WRONGSEC | OP_MODIFIES_SOMETHING,
3346	.op_name = "OP_SAVEFH",
3347	.op_rsize_bop = nfsd4_only_status_rsize,
3348	},
3349	[OP_SECINFO] = {
3350	.op_func = nfsd4_secinfo,
3351	.op_release = nfsd4_secinfo_release,
3352	.op_flags = OP_HANDLES_WRONGSEC,
3353	.op_name = "OP_SECINFO",
3354	.op_rsize_bop = nfsd4_secinfo_rsize,
3355	},
3356	[OP_SETATTR] = {
3357	.op_func = nfsd4_setattr,
3358	.op_name = "OP_SETATTR",
3359	.op_flags = OP_MODIFIES_SOMETHING | OP_CACHEME
3360	| OP_NONTRIVIAL_ERROR_ENCODE,
3361	.op_rsize_bop = nfsd4_setattr_rsize,
3362	.op_get_currentstateid = nfsd4_get_setattrstateid,
3363	},
3364	[OP_SETCLIENTID] = {
3365	.op_func = nfsd4_setclientid,
3366	.op_flags = ALLOWED_WITHOUT_FH | ALLOWED_ON_ABSENT_FS
3367	| OP_MODIFIES_SOMETHING | OP_CACHEME
3368	| OP_NONTRIVIAL_ERROR_ENCODE,
3369	.op_name = "OP_SETCLIENTID",
3370	.op_rsize_bop = nfsd4_setclientid_rsize,
3371	},
3372	[OP_SETCLIENTID_CONFIRM] = {
3373	.op_func = nfsd4_setclientid_confirm,
3374	.op_flags = ALLOWED_WITHOUT_FH | ALLOWED_ON_ABSENT_FS
3375	| OP_MODIFIES_SOMETHING | OP_CACHEME,
3376	.op_name = "OP_SETCLIENTID_CONFIRM",
3377	.op_rsize_bop = nfsd4_only_status_rsize,
3378	},
3379	[OP_VERIFY] = {
3380	.op_func = nfsd4_verify,
3381	.op_name = "OP_VERIFY",
3382	.op_rsize_bop = nfsd4_only_status_rsize,
3383	},
3384	[OP_WRITE] = {
3385	.op_func = nfsd4_write,
3386	.op_flags = OP_MODIFIES_SOMETHING | OP_CACHEME,
3387	.op_name = "OP_WRITE",
3388	.op_rsize_bop = nfsd4_write_rsize,
3389	.op_get_currentstateid = nfsd4_get_writestateid,
3390	},
3391	[OP_RELEASE_LOCKOWNER] = {
3392	.op_func = nfsd4_release_lockowner,
3393	.op_flags = ALLOWED_WITHOUT_FH | ALLOWED_ON_ABSENT_FS
3394	| OP_MODIFIES_SOMETHING,
3395	.op_name = "OP_RELEASE_LOCKOWNER",
3396	.op_rsize_bop = nfsd4_only_status_rsize,
3397	},
3398
3399	/* NFSv4.1 operations */
3400	[OP_EXCHANGE_ID] = {
3401	.op_func = nfsd4_exchange_id,
3402	.op_flags = ALLOWED_WITHOUT_FH | ALLOWED_AS_FIRST_OP
3403	| OP_MODIFIES_SOMETHING,
3404	.op_name = "OP_EXCHANGE_ID",
3405	.op_rsize_bop = nfsd4_exchange_id_rsize,
3406	},
3407	[OP_BACKCHANNEL_CTL] = {
3408	.op_func = nfsd4_backchannel_ctl,
3409	.op_flags = ALLOWED_WITHOUT_FH | OP_MODIFIES_SOMETHING,
3410	.op_name = "OP_BACKCHANNEL_CTL",
3411	.op_rsize_bop = nfsd4_only_status_rsize,
3412	},
3413	[OP_BIND_CONN_TO_SESSION] = {
3414	.op_func = nfsd4_bind_conn_to_session,
3415	.op_flags = ALLOWED_WITHOUT_FH | ALLOWED_AS_FIRST_OP
3416	| OP_MODIFIES_SOMETHING,
3417	.op_name = "OP_BIND_CONN_TO_SESSION",
3418	.op_rsize_bop = nfsd4_bind_conn_to_session_rsize,
3419	},
3420	[OP_CREATE_SESSION] = {
3421	.op_func = nfsd4_create_session,
3422	.op_flags = ALLOWED_WITHOUT_FH | ALLOWED_AS_FIRST_OP
3423	| OP_MODIFIES_SOMETHING,
3424	.op_name = "OP_CREATE_SESSION",
3425	.op_rsize_bop = nfsd4_create_session_rsize,
3426	},
3427	[OP_DESTROY_SESSION] = {
3428	.op_func = nfsd4_destroy_session,
3429	.op_flags = ALLOWED_WITHOUT_FH | ALLOWED_AS_FIRST_OP
3430	| OP_MODIFIES_SOMETHING,
3431	.op_name = "OP_DESTROY_SESSION",
3432	.op_rsize_bop = nfsd4_only_status_rsize,
3433	},
3434	[OP_SEQUENCE] = {
3435	.op_func = nfsd4_sequence,
3436	.op_flags = ALLOWED_WITHOUT_FH | ALLOWED_AS_FIRST_OP,
3437	.op_name = "OP_SEQUENCE",
3438	.op_rsize_bop = nfsd4_sequence_rsize,
3439	},
3440	[OP_DESTROY_CLIENTID] = {
3441	.op_func = nfsd4_destroy_clientid,
3442	.op_flags = ALLOWED_WITHOUT_FH | ALLOWED_AS_FIRST_OP
3443	| OP_MODIFIES_SOMETHING,
3444	.op_name = "OP_DESTROY_CLIENTID",
3445	.op_rsize_bop = nfsd4_only_status_rsize,
3446	},
3447	[OP_RECLAIM_COMPLETE] = {
3448	.op_func = nfsd4_reclaim_complete,
3449	.op_flags = ALLOWED_WITHOUT_FH | OP_MODIFIES_SOMETHING,
3450	.op_name = "OP_RECLAIM_COMPLETE",
3451	.op_rsize_bop = nfsd4_only_status_rsize,
3452	},
3453	[OP_SECINFO_NO_NAME] = {
3454	.op_func = nfsd4_secinfo_no_name,
3455	.op_release = nfsd4_secinfo_no_name_release,
3456	.op_flags = OP_HANDLES_WRONGSEC,
3457	.op_name = "OP_SECINFO_NO_NAME",
3458	.op_rsize_bop = nfsd4_secinfo_rsize,
3459	},
3460	[OP_TEST_STATEID] = {
3461	.op_func = nfsd4_test_stateid,
3462	.op_flags = ALLOWED_WITHOUT_FH,
3463	.op_name = "OP_TEST_STATEID",
3464	.op_rsize_bop = nfsd4_test_stateid_rsize,
3465	},
3466	[OP_FREE_STATEID] = {
3467	.op_func = nfsd4_free_stateid,
3468	.op_flags = ALLOWED_WITHOUT_FH | OP_MODIFIES_SOMETHING,
3469	.op_name = "OP_FREE_STATEID",
3470	.op_get_currentstateid = nfsd4_get_freestateid,
3471	.op_rsize_bop = nfsd4_only_status_rsize,
3472	},
3473	#ifdef CONFIG_NFSD_PNFS
3474	[OP_GETDEVICEINFO] = {
3475	.op_func = nfsd4_getdeviceinfo,
3476	.op_release = nfsd4_getdeviceinfo_release,
3477	.op_flags = ALLOWED_WITHOUT_FH,
3478	.op_name = "OP_GETDEVICEINFO",
3479	.op_rsize_bop = nfsd4_getdeviceinfo_rsize,
3480	},
3481	[OP_LAYOUTGET] = {
3482	.op_func = nfsd4_layoutget,
3483	.op_release = nfsd4_layoutget_release,
3484	.op_flags = OP_MODIFIES_SOMETHING,
3485	.op_name = "OP_LAYOUTGET",
3486	.op_rsize_bop = nfsd4_layoutget_rsize,
3487	},
3488	[OP_LAYOUTCOMMIT] = {
3489	.op_func = nfsd4_layoutcommit,
3490	.op_flags = OP_MODIFIES_SOMETHING,
3491	.op_name = "OP_LAYOUTCOMMIT",
3492	.op_rsize_bop = nfsd4_layoutcommit_rsize,
3493	},
3494	[OP_LAYOUTRETURN] = {
3495	.op_func = nfsd4_layoutreturn,
3496	.op_flags = OP_MODIFIES_SOMETHING,
3497	.op_name = "OP_LAYOUTRETURN",
3498	.op_rsize_bop = nfsd4_layoutreturn_rsize,
3499	},
3500	#endif /* CONFIG_NFSD_PNFS */
3501
3502	/* NFSv4.2 operations */
3503	[OP_ALLOCATE] = {
3504	.op_func = nfsd4_allocate,
3505	.op_flags = OP_MODIFIES_SOMETHING,
3506	.op_name = "OP_ALLOCATE",
3507	.op_rsize_bop = nfsd4_only_status_rsize,
3508	},
3509	[OP_DEALLOCATE] = {
3510	.op_func = nfsd4_deallocate,
3511	.op_flags = OP_MODIFIES_SOMETHING,
3512	.op_name = "OP_DEALLOCATE",
3513	.op_rsize_bop = nfsd4_only_status_rsize,
3514	},
3515	[OP_CLONE] = {
3516	.op_func = nfsd4_clone,
3517	.op_flags = OP_MODIFIES_SOMETHING,
3518	.op_name = "OP_CLONE",
3519	.op_rsize_bop = nfsd4_only_status_rsize,
3520	},
3521	[OP_COPY] = {
3522	.op_func = nfsd4_copy,
3523	.op_flags = OP_MODIFIES_SOMETHING,
3524	.op_name = "OP_COPY",
3525	.op_rsize_bop = nfsd4_copy_rsize,
3526	},
3527	[OP_READ_PLUS] = {
3528	.op_func = nfsd4_read,
3529	.op_release = nfsd4_read_release,
3530	.op_name = "OP_READ_PLUS",
3531	.op_rsize_bop = nfsd4_read_plus_rsize,
3532	.op_get_currentstateid = nfsd4_get_readstateid,
3533	},
3534	[OP_SEEK] = {
3535	.op_func = nfsd4_seek,
3536	.op_name = "OP_SEEK",
3537	.op_rsize_bop = nfsd4_seek_rsize,
3538	},
3539	[OP_OFFLOAD_STATUS] = {
3540	.op_func = nfsd4_offload_status,
3541	.op_name = "OP_OFFLOAD_STATUS",
3542	.op_rsize_bop = nfsd4_offload_status_rsize,
3543	},
3544	[OP_OFFLOAD_CANCEL] = {
3545	.op_func = nfsd4_offload_cancel,
3546	.op_flags = OP_MODIFIES_SOMETHING,
3547	.op_name = "OP_OFFLOAD_CANCEL",
3548	.op_rsize_bop = nfsd4_only_status_rsize,
3549	},
3550	[OP_COPY_NOTIFY] = {
3551	.op_func = nfsd4_copy_notify,
3552	.op_flags = OP_MODIFIES_SOMETHING,
3553	.op_name = "OP_COPY_NOTIFY",
3554	.op_rsize_bop = nfsd4_copy_notify_rsize,
3555	},
3556	[OP_GETXATTR] = {
3557	.op_func = nfsd4_getxattr,
3558	.op_name = "OP_GETXATTR",
3559	.op_rsize_bop = nfsd4_getxattr_rsize,
3560	},
3561	[OP_SETXATTR] = {
3562	.op_func = nfsd4_setxattr,
3563	.op_flags = OP_MODIFIES_SOMETHING | OP_CACHEME,
3564	.op_name = "OP_SETXATTR",
3565	.op_rsize_bop = nfsd4_setxattr_rsize,
3566	},
3567	[OP_LISTXATTRS] = {
3568	.op_func = nfsd4_listxattrs,
3569	.op_name = "OP_LISTXATTRS",
3570	.op_rsize_bop = nfsd4_listxattrs_rsize,
3571	},
3572	[OP_REMOVEXATTR] = {
3573	.op_func = nfsd4_removexattr,
3574	.op_flags = OP_MODIFIES_SOMETHING | OP_CACHEME,
3575	.op_name = "OP_REMOVEXATTR",
3576	.op_rsize_bop = nfsd4_removexattr_rsize,
3577	},
3578	};
3579
3580	/**
3581	* nfsd4_spo_must_allow - Determine if the compound op contains an
3582	* operation that is allowed to be sent with machine credentials
3583	*
3584	* @rqstp: a pointer to the struct svc_rqst
3585	*
3586	* Checks to see if the compound contains a spo_must_allow op
3587	* and confirms that it was sent with the proper machine creds.
3588	*/
3589
3590	bool nfsd4_spo_must_allow(struct svc_rqst *rqstp)
3591	{
3592	struct nfsd4_compoundres *resp = rqstp->rq_resp;
3593	struct nfsd4_compoundargs *argp = rqstp->rq_argp;
3594	struct nfsd4_op *this;
3595	struct nfsd4_compound_state *cstate = &resp->cstate;
3596	struct nfs4_op_map *allow = &cstate->clp->cl_spo_must_allow;
3597	u32 opiter;
3598
3599	if (!cstate->minorversion)
3600	return false;
3601
3602	if (cstate->spo_must_allowed)
3603	return true;
3604
3605	opiter = resp->opcnt;
3606	while (opiter < argp->opcnt) {
3607	this = &argp->ops[opiter++];
3608	if (test_bit(this->opnum, allow->u.longs) &&
3609	cstate->clp->cl_mach_cred &&
3610	nfsd4_mach_creds_match(cl: cstate->clp, rqstp)) {
3611	cstate->spo_must_allowed = true;
3612	return true;
3613	}
3614	}
3615	cstate->spo_must_allowed = false;
3616	return false;
3617	}
3618
3619	int nfsd4_max_reply(struct svc_rqst *rqstp, struct nfsd4_op *op)
3620	{
3621	if (op->opnum == OP_ILLEGAL || op->status == nfserr_notsupp)
3622	return op_encode_hdr_size * sizeof(__be32);
3623
3624	BUG_ON(OPDESC(op)->op_rsize_bop == NULL);
3625	return OPDESC(op)->op_rsize_bop(rqstp, op);
3626	}
3627
3628	void warn_on_nonidempotent_op(struct nfsd4_op *op)
3629	{
3630	if (OPDESC(op)->op_flags & OP_MODIFIES_SOMETHING) {
3631	pr_err("unable to encode reply to nonidempotent op %u (%s)\n",
3632	op->opnum, nfsd4_op_name(op->opnum));
3633	WARN_ON_ONCE(1);
3634	}
3635	}
3636
3637	static const char *nfsd4_op_name(unsigned opnum)
3638	{
3639	if (opnum < ARRAY_SIZE(nfsd4_ops))
3640	return nfsd4_ops[opnum].op_name;
3641	return "unknown_operation";
3642	}
3643
3644	static const struct svc_procedure nfsd_procedures4[2] = {
3645	[NFSPROC4_NULL] = {
3646	.pc_func = nfsd4_proc_null,
3647	.pc_decode = nfssvc_decode_voidarg,
3648	.pc_encode = nfssvc_encode_voidres,
3649	.pc_argsize = sizeof(struct nfsd_voidargs),
3650	.pc_argzero = sizeof(struct nfsd_voidargs),
3651	.pc_ressize = sizeof(struct nfsd_voidres),
3652	.pc_cachetype = RC_NOCACHE,
3653	.pc_xdrressize = 1,
3654	.pc_name = "NULL",
3655	},
3656	[NFSPROC4_COMPOUND] = {
3657	.pc_func = nfsd4_proc_compound,
3658	.pc_decode = nfs4svc_decode_compoundargs,
3659	.pc_encode = nfs4svc_encode_compoundres,
3660	.pc_argsize = sizeof(struct nfsd4_compoundargs),
3661	.pc_argzero = offsetof(struct nfsd4_compoundargs, iops),
3662	.pc_ressize = sizeof(struct nfsd4_compoundres),
3663	.pc_release = nfsd4_release_compoundargs,
3664	.pc_cachetype = RC_NOCACHE,
3665	.pc_xdrressize = NFSD_BUFSIZE/4,
3666	.pc_name = "COMPOUND",
3667	},
3668	};
3669
3670	static DEFINE_PER_CPU_ALIGNED(unsigned long,
3671	nfsd_count4[ARRAY_SIZE(nfsd_procedures4)]);
3672	const struct svc_version nfsd_version4 = {
3673	.vs_vers = 4,
3674	.vs_nproc = ARRAY_SIZE(nfsd_procedures4),
3675	.vs_proc = nfsd_procedures4,
3676	.vs_count = nfsd_count4,
3677	.vs_dispatch = nfsd_dispatch,
3678	.vs_xdrsize = NFS4_SVC_XDRSIZE,
3679	.vs_rpcb_optnl = true,
3680	.vs_need_cong_ctrl = true,
3681	};
3682