xref: /linux/fs/nfs/callback_xdr.c (revision e9fb13bfec7e017130ddc5c1b5466340470f4900)
1 /*
2  * linux/fs/nfs/callback_xdr.c
3  *
4  * Copyright (C) 2004 Trond Myklebust
5  *
6  * NFSv4 callback encode/decode procedures
7  */
8 #include <linux/kernel.h>
9 #include <linux/sunrpc/svc.h>
10 #include <linux/nfs4.h>
11 #include <linux/nfs_fs.h>
12 #include <linux/slab.h>
13 #include <linux/sunrpc/bc_xprt.h>
14 #include "nfs4_fs.h"
15 #include "callback.h"
16 #include "internal.h"
17 
18 #define CB_OP_TAGLEN_MAXSZ	(512)
19 #define CB_OP_HDR_RES_MAXSZ	(2 + CB_OP_TAGLEN_MAXSZ)
20 #define CB_OP_GETATTR_BITMAP_MAXSZ	(4)
21 #define CB_OP_GETATTR_RES_MAXSZ	(CB_OP_HDR_RES_MAXSZ + \
22 				CB_OP_GETATTR_BITMAP_MAXSZ + \
23 				2 + 2 + 3 + 3)
24 #define CB_OP_RECALL_RES_MAXSZ	(CB_OP_HDR_RES_MAXSZ)
25 
26 #if defined(CONFIG_NFS_V4_1)
27 #define CB_OP_LAYOUTRECALL_RES_MAXSZ	(CB_OP_HDR_RES_MAXSZ)
28 #define CB_OP_SEQUENCE_RES_MAXSZ	(CB_OP_HDR_RES_MAXSZ + \
29 					4 + 1 + 3)
30 #define CB_OP_RECALLANY_RES_MAXSZ	(CB_OP_HDR_RES_MAXSZ)
31 #define CB_OP_RECALLSLOT_RES_MAXSZ	(CB_OP_HDR_RES_MAXSZ)
32 #endif /* CONFIG_NFS_V4_1 */
33 
34 #define NFSDBG_FACILITY NFSDBG_CALLBACK
35 
36 /* Internal error code */
37 #define NFS4ERR_RESOURCE_HDR	11050
38 
39 typedef __be32 (*callback_process_op_t)(void *, void *,
40 					struct cb_process_state *);
41 typedef __be32 (*callback_decode_arg_t)(struct svc_rqst *, struct xdr_stream *, void *);
42 typedef __be32 (*callback_encode_res_t)(struct svc_rqst *, struct xdr_stream *, void *);
43 
44 
45 struct callback_op {
46 	callback_process_op_t process_op;
47 	callback_decode_arg_t decode_args;
48 	callback_encode_res_t encode_res;
49 	long res_maxsize;
50 };
51 
52 static struct callback_op callback_ops[];
53 
54 static __be32 nfs4_callback_null(struct svc_rqst *rqstp, void *argp, void *resp)
55 {
56 	return htonl(NFS4_OK);
57 }
58 
59 static int nfs4_decode_void(struct svc_rqst *rqstp, __be32 *p, void *dummy)
60 {
61 	return xdr_argsize_check(rqstp, p);
62 }
63 
64 static int nfs4_encode_void(struct svc_rqst *rqstp, __be32 *p, void *dummy)
65 {
66 	return xdr_ressize_check(rqstp, p);
67 }
68 
69 static __be32 *read_buf(struct xdr_stream *xdr, int nbytes)
70 {
71 	__be32 *p;
72 
73 	p = xdr_inline_decode(xdr, nbytes);
74 	if (unlikely(p == NULL))
75 		printk(KERN_WARNING "NFSv4 callback reply buffer overflowed!\n");
76 	return p;
77 }
78 
79 static __be32 decode_string(struct xdr_stream *xdr, unsigned int *len, const char **str)
80 {
81 	__be32 *p;
82 
83 	p = read_buf(xdr, 4);
84 	if (unlikely(p == NULL))
85 		return htonl(NFS4ERR_RESOURCE);
86 	*len = ntohl(*p);
87 
88 	if (*len != 0) {
89 		p = read_buf(xdr, *len);
90 		if (unlikely(p == NULL))
91 			return htonl(NFS4ERR_RESOURCE);
92 		*str = (const char *)p;
93 	} else
94 		*str = NULL;
95 
96 	return 0;
97 }
98 
99 static __be32 decode_fh(struct xdr_stream *xdr, struct nfs_fh *fh)
100 {
101 	__be32 *p;
102 
103 	p = read_buf(xdr, 4);
104 	if (unlikely(p == NULL))
105 		return htonl(NFS4ERR_RESOURCE);
106 	fh->size = ntohl(*p);
107 	if (fh->size > NFS4_FHSIZE)
108 		return htonl(NFS4ERR_BADHANDLE);
109 	p = read_buf(xdr, fh->size);
110 	if (unlikely(p == NULL))
111 		return htonl(NFS4ERR_RESOURCE);
112 	memcpy(&fh->data[0], p, fh->size);
113 	memset(&fh->data[fh->size], 0, sizeof(fh->data) - fh->size);
114 	return 0;
115 }
116 
117 static __be32 decode_bitmap(struct xdr_stream *xdr, uint32_t *bitmap)
118 {
119 	__be32 *p;
120 	unsigned int attrlen;
121 
122 	p = read_buf(xdr, 4);
123 	if (unlikely(p == NULL))
124 		return htonl(NFS4ERR_RESOURCE);
125 	attrlen = ntohl(*p);
126 	p = read_buf(xdr, attrlen << 2);
127 	if (unlikely(p == NULL))
128 		return htonl(NFS4ERR_RESOURCE);
129 	if (likely(attrlen > 0))
130 		bitmap[0] = ntohl(*p++);
131 	if (attrlen > 1)
132 		bitmap[1] = ntohl(*p);
133 	return 0;
134 }
135 
136 static __be32 decode_stateid(struct xdr_stream *xdr, nfs4_stateid *stateid)
137 {
138 	__be32 *p;
139 
140 	p = read_buf(xdr, 16);
141 	if (unlikely(p == NULL))
142 		return htonl(NFS4ERR_RESOURCE);
143 	memcpy(stateid->data, p, 16);
144 	return 0;
145 }
146 
147 static __be32 decode_compound_hdr_arg(struct xdr_stream *xdr, struct cb_compound_hdr_arg *hdr)
148 {
149 	__be32 *p;
150 	__be32 status;
151 
152 	status = decode_string(xdr, &hdr->taglen, &hdr->tag);
153 	if (unlikely(status != 0))
154 		return status;
155 	/* We do not like overly long tags! */
156 	if (hdr->taglen > CB_OP_TAGLEN_MAXSZ - 12) {
157 		printk("NFSv4 CALLBACK %s: client sent tag of length %u\n",
158 				__func__, hdr->taglen);
159 		return htonl(NFS4ERR_RESOURCE);
160 	}
161 	p = read_buf(xdr, 12);
162 	if (unlikely(p == NULL))
163 		return htonl(NFS4ERR_RESOURCE);
164 	hdr->minorversion = ntohl(*p++);
165 	/* Check minor version is zero or one. */
166 	if (hdr->minorversion <= 1) {
167 		hdr->cb_ident = ntohl(*p++); /* ignored by v4.1 */
168 	} else {
169 		printk(KERN_WARNING "%s: NFSv4 server callback with "
170 			"illegal minor version %u!\n",
171 			__func__, hdr->minorversion);
172 		return htonl(NFS4ERR_MINOR_VERS_MISMATCH);
173 	}
174 	hdr->nops = ntohl(*p);
175 	dprintk("%s: minorversion %d nops %d\n", __func__,
176 		hdr->minorversion, hdr->nops);
177 	return 0;
178 }
179 
180 static __be32 decode_op_hdr(struct xdr_stream *xdr, unsigned int *op)
181 {
182 	__be32 *p;
183 	p = read_buf(xdr, 4);
184 	if (unlikely(p == NULL))
185 		return htonl(NFS4ERR_RESOURCE_HDR);
186 	*op = ntohl(*p);
187 	return 0;
188 }
189 
190 static __be32 decode_getattr_args(struct svc_rqst *rqstp, struct xdr_stream *xdr, struct cb_getattrargs *args)
191 {
192 	__be32 status;
193 
194 	status = decode_fh(xdr, &args->fh);
195 	if (unlikely(status != 0))
196 		goto out;
197 	args->addr = svc_addr(rqstp);
198 	status = decode_bitmap(xdr, args->bitmap);
199 out:
200 	dprintk("%s: exit with status = %d\n", __func__, ntohl(status));
201 	return status;
202 }
203 
204 static __be32 decode_recall_args(struct svc_rqst *rqstp, struct xdr_stream *xdr, struct cb_recallargs *args)
205 {
206 	__be32 *p;
207 	__be32 status;
208 
209 	args->addr = svc_addr(rqstp);
210 	status = decode_stateid(xdr, &args->stateid);
211 	if (unlikely(status != 0))
212 		goto out;
213 	p = read_buf(xdr, 4);
214 	if (unlikely(p == NULL)) {
215 		status = htonl(NFS4ERR_RESOURCE);
216 		goto out;
217 	}
218 	args->truncate = ntohl(*p);
219 	status = decode_fh(xdr, &args->fh);
220 out:
221 	dprintk("%s: exit with status = %d\n", __func__, ntohl(status));
222 	return status;
223 }
224 
225 #if defined(CONFIG_NFS_V4_1)
226 
227 static __be32 decode_layoutrecall_args(struct svc_rqst *rqstp,
228 				       struct xdr_stream *xdr,
229 				       struct cb_layoutrecallargs *args)
230 {
231 	__be32 *p;
232 	__be32 status = 0;
233 	uint32_t iomode;
234 
235 	args->cbl_addr = svc_addr(rqstp);
236 	p = read_buf(xdr, 4 * sizeof(uint32_t));
237 	if (unlikely(p == NULL)) {
238 		status = htonl(NFS4ERR_BADXDR);
239 		goto out;
240 	}
241 
242 	args->cbl_layout_type = ntohl(*p++);
243 	/* Depite the spec's xdr, iomode really belongs in the FILE switch,
244 	 * as it is unusable and ignored with the other types.
245 	 */
246 	iomode = ntohl(*p++);
247 	args->cbl_layoutchanged = ntohl(*p++);
248 	args->cbl_recall_type = ntohl(*p++);
249 
250 	if (args->cbl_recall_type == RETURN_FILE) {
251 		args->cbl_range.iomode = iomode;
252 		status = decode_fh(xdr, &args->cbl_fh);
253 		if (unlikely(status != 0))
254 			goto out;
255 
256 		p = read_buf(xdr, 2 * sizeof(uint64_t));
257 		if (unlikely(p == NULL)) {
258 			status = htonl(NFS4ERR_BADXDR);
259 			goto out;
260 		}
261 		p = xdr_decode_hyper(p, &args->cbl_range.offset);
262 		p = xdr_decode_hyper(p, &args->cbl_range.length);
263 		status = decode_stateid(xdr, &args->cbl_stateid);
264 		if (unlikely(status != 0))
265 			goto out;
266 	} else if (args->cbl_recall_type == RETURN_FSID) {
267 		p = read_buf(xdr, 2 * sizeof(uint64_t));
268 		if (unlikely(p == NULL)) {
269 			status = htonl(NFS4ERR_BADXDR);
270 			goto out;
271 		}
272 		p = xdr_decode_hyper(p, &args->cbl_fsid.major);
273 		p = xdr_decode_hyper(p, &args->cbl_fsid.minor);
274 	} else if (args->cbl_recall_type != RETURN_ALL) {
275 		status = htonl(NFS4ERR_BADXDR);
276 		goto out;
277 	}
278 	dprintk("%s: ltype 0x%x iomode %d changed %d recall_type %d\n",
279 		__func__,
280 		args->cbl_layout_type, iomode,
281 		args->cbl_layoutchanged, args->cbl_recall_type);
282 out:
283 	dprintk("%s: exit with status = %d\n", __func__, ntohl(status));
284 	return status;
285 }
286 
287 static __be32 decode_sessionid(struct xdr_stream *xdr,
288 				 struct nfs4_sessionid *sid)
289 {
290 	__be32 *p;
291 	int len = NFS4_MAX_SESSIONID_LEN;
292 
293 	p = read_buf(xdr, len);
294 	if (unlikely(p == NULL))
295 		return htonl(NFS4ERR_RESOURCE);
296 
297 	memcpy(sid->data, p, len);
298 	return 0;
299 }
300 
301 static __be32 decode_rc_list(struct xdr_stream *xdr,
302 			       struct referring_call_list *rc_list)
303 {
304 	__be32 *p;
305 	int i;
306 	__be32 status;
307 
308 	status = decode_sessionid(xdr, &rc_list->rcl_sessionid);
309 	if (status)
310 		goto out;
311 
312 	status = htonl(NFS4ERR_RESOURCE);
313 	p = read_buf(xdr, sizeof(uint32_t));
314 	if (unlikely(p == NULL))
315 		goto out;
316 
317 	rc_list->rcl_nrefcalls = ntohl(*p++);
318 	if (rc_list->rcl_nrefcalls) {
319 		p = read_buf(xdr,
320 			     rc_list->rcl_nrefcalls * 2 * sizeof(uint32_t));
321 		if (unlikely(p == NULL))
322 			goto out;
323 		rc_list->rcl_refcalls = kmalloc(rc_list->rcl_nrefcalls *
324 						sizeof(*rc_list->rcl_refcalls),
325 						GFP_KERNEL);
326 		if (unlikely(rc_list->rcl_refcalls == NULL))
327 			goto out;
328 		for (i = 0; i < rc_list->rcl_nrefcalls; i++) {
329 			rc_list->rcl_refcalls[i].rc_sequenceid = ntohl(*p++);
330 			rc_list->rcl_refcalls[i].rc_slotid = ntohl(*p++);
331 		}
332 	}
333 	status = 0;
334 
335 out:
336 	return status;
337 }
338 
339 static __be32 decode_cb_sequence_args(struct svc_rqst *rqstp,
340 					struct xdr_stream *xdr,
341 					struct cb_sequenceargs *args)
342 {
343 	__be32 *p;
344 	int i;
345 	__be32 status;
346 
347 	status = decode_sessionid(xdr, &args->csa_sessionid);
348 	if (status)
349 		goto out;
350 
351 	status = htonl(NFS4ERR_RESOURCE);
352 	p = read_buf(xdr, 5 * sizeof(uint32_t));
353 	if (unlikely(p == NULL))
354 		goto out;
355 
356 	args->csa_addr = svc_addr(rqstp);
357 	args->csa_sequenceid = ntohl(*p++);
358 	args->csa_slotid = ntohl(*p++);
359 	args->csa_highestslotid = ntohl(*p++);
360 	args->csa_cachethis = ntohl(*p++);
361 	args->csa_nrclists = ntohl(*p++);
362 	args->csa_rclists = NULL;
363 	if (args->csa_nrclists) {
364 		args->csa_rclists = kmalloc(args->csa_nrclists *
365 					    sizeof(*args->csa_rclists),
366 					    GFP_KERNEL);
367 		if (unlikely(args->csa_rclists == NULL))
368 			goto out;
369 
370 		for (i = 0; i < args->csa_nrclists; i++) {
371 			status = decode_rc_list(xdr, &args->csa_rclists[i]);
372 			if (status)
373 				goto out_free;
374 		}
375 	}
376 	status = 0;
377 
378 	dprintk("%s: sessionid %x:%x:%x:%x sequenceid %u slotid %u "
379 		"highestslotid %u cachethis %d nrclists %u\n",
380 		__func__,
381 		((u32 *)&args->csa_sessionid)[0],
382 		((u32 *)&args->csa_sessionid)[1],
383 		((u32 *)&args->csa_sessionid)[2],
384 		((u32 *)&args->csa_sessionid)[3],
385 		args->csa_sequenceid, args->csa_slotid,
386 		args->csa_highestslotid, args->csa_cachethis,
387 		args->csa_nrclists);
388 out:
389 	dprintk("%s: exit with status = %d\n", __func__, ntohl(status));
390 	return status;
391 
392 out_free:
393 	for (i = 0; i < args->csa_nrclists; i++)
394 		kfree(args->csa_rclists[i].rcl_refcalls);
395 	kfree(args->csa_rclists);
396 	goto out;
397 }
398 
399 static __be32 decode_recallany_args(struct svc_rqst *rqstp,
400 				      struct xdr_stream *xdr,
401 				      struct cb_recallanyargs *args)
402 {
403 	__be32 *p;
404 
405 	args->craa_addr = svc_addr(rqstp);
406 	p = read_buf(xdr, 4);
407 	if (unlikely(p == NULL))
408 		return htonl(NFS4ERR_BADXDR);
409 	args->craa_objs_to_keep = ntohl(*p++);
410 	p = read_buf(xdr, 4);
411 	if (unlikely(p == NULL))
412 		return htonl(NFS4ERR_BADXDR);
413 	args->craa_type_mask = ntohl(*p);
414 
415 	return 0;
416 }
417 
418 static __be32 decode_recallslot_args(struct svc_rqst *rqstp,
419 					struct xdr_stream *xdr,
420 					struct cb_recallslotargs *args)
421 {
422 	__be32 *p;
423 
424 	args->crsa_addr = svc_addr(rqstp);
425 	p = read_buf(xdr, 4);
426 	if (unlikely(p == NULL))
427 		return htonl(NFS4ERR_BADXDR);
428 	args->crsa_target_max_slots = ntohl(*p++);
429 	return 0;
430 }
431 
432 #endif /* CONFIG_NFS_V4_1 */
433 
434 static __be32 encode_string(struct xdr_stream *xdr, unsigned int len, const char *str)
435 {
436 	__be32 *p;
437 
438 	p = xdr_reserve_space(xdr, 4 + len);
439 	if (unlikely(p == NULL))
440 		return htonl(NFS4ERR_RESOURCE);
441 	xdr_encode_opaque(p, str, len);
442 	return 0;
443 }
444 
445 #define CB_SUPPORTED_ATTR0 (FATTR4_WORD0_CHANGE|FATTR4_WORD0_SIZE)
446 #define CB_SUPPORTED_ATTR1 (FATTR4_WORD1_TIME_METADATA|FATTR4_WORD1_TIME_MODIFY)
447 static __be32 encode_attr_bitmap(struct xdr_stream *xdr, const uint32_t *bitmap, __be32 **savep)
448 {
449 	__be32 bm[2];
450 	__be32 *p;
451 
452 	bm[0] = htonl(bitmap[0] & CB_SUPPORTED_ATTR0);
453 	bm[1] = htonl(bitmap[1] & CB_SUPPORTED_ATTR1);
454 	if (bm[1] != 0) {
455 		p = xdr_reserve_space(xdr, 16);
456 		if (unlikely(p == NULL))
457 			return htonl(NFS4ERR_RESOURCE);
458 		*p++ = htonl(2);
459 		*p++ = bm[0];
460 		*p++ = bm[1];
461 	} else if (bm[0] != 0) {
462 		p = xdr_reserve_space(xdr, 12);
463 		if (unlikely(p == NULL))
464 			return htonl(NFS4ERR_RESOURCE);
465 		*p++ = htonl(1);
466 		*p++ = bm[0];
467 	} else {
468 		p = xdr_reserve_space(xdr, 8);
469 		if (unlikely(p == NULL))
470 			return htonl(NFS4ERR_RESOURCE);
471 		*p++ = htonl(0);
472 	}
473 	*savep = p;
474 	return 0;
475 }
476 
477 static __be32 encode_attr_change(struct xdr_stream *xdr, const uint32_t *bitmap, uint64_t change)
478 {
479 	__be32 *p;
480 
481 	if (!(bitmap[0] & FATTR4_WORD0_CHANGE))
482 		return 0;
483 	p = xdr_reserve_space(xdr, 8);
484 	if (unlikely(!p))
485 		return htonl(NFS4ERR_RESOURCE);
486 	p = xdr_encode_hyper(p, change);
487 	return 0;
488 }
489 
490 static __be32 encode_attr_size(struct xdr_stream *xdr, const uint32_t *bitmap, uint64_t size)
491 {
492 	__be32 *p;
493 
494 	if (!(bitmap[0] & FATTR4_WORD0_SIZE))
495 		return 0;
496 	p = xdr_reserve_space(xdr, 8);
497 	if (unlikely(!p))
498 		return htonl(NFS4ERR_RESOURCE);
499 	p = xdr_encode_hyper(p, size);
500 	return 0;
501 }
502 
503 static __be32 encode_attr_time(struct xdr_stream *xdr, const struct timespec *time)
504 {
505 	__be32 *p;
506 
507 	p = xdr_reserve_space(xdr, 12);
508 	if (unlikely(!p))
509 		return htonl(NFS4ERR_RESOURCE);
510 	p = xdr_encode_hyper(p, time->tv_sec);
511 	*p = htonl(time->tv_nsec);
512 	return 0;
513 }
514 
515 static __be32 encode_attr_ctime(struct xdr_stream *xdr, const uint32_t *bitmap, const struct timespec *time)
516 {
517 	if (!(bitmap[1] & FATTR4_WORD1_TIME_METADATA))
518 		return 0;
519 	return encode_attr_time(xdr,time);
520 }
521 
522 static __be32 encode_attr_mtime(struct xdr_stream *xdr, const uint32_t *bitmap, const struct timespec *time)
523 {
524 	if (!(bitmap[1] & FATTR4_WORD1_TIME_MODIFY))
525 		return 0;
526 	return encode_attr_time(xdr,time);
527 }
528 
529 static __be32 encode_compound_hdr_res(struct xdr_stream *xdr, struct cb_compound_hdr_res *hdr)
530 {
531 	__be32 status;
532 
533 	hdr->status = xdr_reserve_space(xdr, 4);
534 	if (unlikely(hdr->status == NULL))
535 		return htonl(NFS4ERR_RESOURCE);
536 	status = encode_string(xdr, hdr->taglen, hdr->tag);
537 	if (unlikely(status != 0))
538 		return status;
539 	hdr->nops = xdr_reserve_space(xdr, 4);
540 	if (unlikely(hdr->nops == NULL))
541 		return htonl(NFS4ERR_RESOURCE);
542 	return 0;
543 }
544 
545 static __be32 encode_op_hdr(struct xdr_stream *xdr, uint32_t op, __be32 res)
546 {
547 	__be32 *p;
548 
549 	p = xdr_reserve_space(xdr, 8);
550 	if (unlikely(p == NULL))
551 		return htonl(NFS4ERR_RESOURCE_HDR);
552 	*p++ = htonl(op);
553 	*p = res;
554 	return 0;
555 }
556 
557 static __be32 encode_getattr_res(struct svc_rqst *rqstp, struct xdr_stream *xdr, const struct cb_getattrres *res)
558 {
559 	__be32 *savep = NULL;
560 	__be32 status = res->status;
561 
562 	if (unlikely(status != 0))
563 		goto out;
564 	status = encode_attr_bitmap(xdr, res->bitmap, &savep);
565 	if (unlikely(status != 0))
566 		goto out;
567 	status = encode_attr_change(xdr, res->bitmap, res->change_attr);
568 	if (unlikely(status != 0))
569 		goto out;
570 	status = encode_attr_size(xdr, res->bitmap, res->size);
571 	if (unlikely(status != 0))
572 		goto out;
573 	status = encode_attr_ctime(xdr, res->bitmap, &res->ctime);
574 	if (unlikely(status != 0))
575 		goto out;
576 	status = encode_attr_mtime(xdr, res->bitmap, &res->mtime);
577 	*savep = htonl((unsigned int)((char *)xdr->p - (char *)(savep+1)));
578 out:
579 	dprintk("%s: exit with status = %d\n", __func__, ntohl(status));
580 	return status;
581 }
582 
583 #if defined(CONFIG_NFS_V4_1)
584 
585 static __be32 encode_sessionid(struct xdr_stream *xdr,
586 				 const struct nfs4_sessionid *sid)
587 {
588 	__be32 *p;
589 	int len = NFS4_MAX_SESSIONID_LEN;
590 
591 	p = xdr_reserve_space(xdr, len);
592 	if (unlikely(p == NULL))
593 		return htonl(NFS4ERR_RESOURCE);
594 
595 	memcpy(p, sid, len);
596 	return 0;
597 }
598 
599 static __be32 encode_cb_sequence_res(struct svc_rqst *rqstp,
600 				       struct xdr_stream *xdr,
601 				       const struct cb_sequenceres *res)
602 {
603 	__be32 *p;
604 	unsigned status = res->csr_status;
605 
606 	if (unlikely(status != 0))
607 		goto out;
608 
609 	encode_sessionid(xdr, &res->csr_sessionid);
610 
611 	p = xdr_reserve_space(xdr, 4 * sizeof(uint32_t));
612 	if (unlikely(p == NULL))
613 		return htonl(NFS4ERR_RESOURCE);
614 
615 	*p++ = htonl(res->csr_sequenceid);
616 	*p++ = htonl(res->csr_slotid);
617 	*p++ = htonl(res->csr_highestslotid);
618 	*p++ = htonl(res->csr_target_highestslotid);
619 out:
620 	dprintk("%s: exit with status = %d\n", __func__, ntohl(status));
621 	return status;
622 }
623 
624 static __be32
625 preprocess_nfs41_op(int nop, unsigned int op_nr, struct callback_op **op)
626 {
627 	if (op_nr == OP_CB_SEQUENCE) {
628 		if (nop != 0)
629 			return htonl(NFS4ERR_SEQUENCE_POS);
630 	} else {
631 		if (nop == 0)
632 			return htonl(NFS4ERR_OP_NOT_IN_SESSION);
633 	}
634 
635 	switch (op_nr) {
636 	case OP_CB_GETATTR:
637 	case OP_CB_RECALL:
638 	case OP_CB_SEQUENCE:
639 	case OP_CB_RECALL_ANY:
640 	case OP_CB_RECALL_SLOT:
641 	case OP_CB_LAYOUTRECALL:
642 		*op = &callback_ops[op_nr];
643 		break;
644 
645 	case OP_CB_NOTIFY_DEVICEID:
646 	case OP_CB_NOTIFY:
647 	case OP_CB_PUSH_DELEG:
648 	case OP_CB_RECALLABLE_OBJ_AVAIL:
649 	case OP_CB_WANTS_CANCELLED:
650 	case OP_CB_NOTIFY_LOCK:
651 		return htonl(NFS4ERR_NOTSUPP);
652 
653 	default:
654 		return htonl(NFS4ERR_OP_ILLEGAL);
655 	}
656 
657 	return htonl(NFS_OK);
658 }
659 
660 static void nfs4_callback_free_slot(struct nfs4_session *session)
661 {
662 	struct nfs4_slot_table *tbl = &session->bc_slot_table;
663 
664 	spin_lock(&tbl->slot_tbl_lock);
665 	/*
666 	 * Let the state manager know callback processing done.
667 	 * A single slot, so highest used slotid is either 0 or -1
668 	 */
669 	tbl->highest_used_slotid--;
670 	nfs4_check_drain_bc_complete(session);
671 	spin_unlock(&tbl->slot_tbl_lock);
672 }
673 
674 static void nfs4_cb_free_slot(struct nfs_client *clp)
675 {
676 	if (clp && clp->cl_session)
677 		nfs4_callback_free_slot(clp->cl_session);
678 }
679 
680 /* A single slot, so highest used slotid is either 0 or -1 */
681 void nfs4_cb_take_slot(struct nfs_client *clp)
682 {
683 	struct nfs4_slot_table *tbl = &clp->cl_session->bc_slot_table;
684 
685 	spin_lock(&tbl->slot_tbl_lock);
686 	tbl->highest_used_slotid++;
687 	BUG_ON(tbl->highest_used_slotid != 0);
688 	spin_unlock(&tbl->slot_tbl_lock);
689 }
690 
691 #else /* CONFIG_NFS_V4_1 */
692 
693 static __be32
694 preprocess_nfs41_op(int nop, unsigned int op_nr, struct callback_op **op)
695 {
696 	return htonl(NFS4ERR_MINOR_VERS_MISMATCH);
697 }
698 
699 static void nfs4_cb_free_slot(struct nfs_client *clp)
700 {
701 }
702 #endif /* CONFIG_NFS_V4_1 */
703 
704 static __be32
705 preprocess_nfs4_op(unsigned int op_nr, struct callback_op **op)
706 {
707 	switch (op_nr) {
708 	case OP_CB_GETATTR:
709 	case OP_CB_RECALL:
710 		*op = &callback_ops[op_nr];
711 		break;
712 	default:
713 		return htonl(NFS4ERR_OP_ILLEGAL);
714 	}
715 
716 	return htonl(NFS_OK);
717 }
718 
719 static __be32 process_op(uint32_t minorversion, int nop,
720 		struct svc_rqst *rqstp,
721 		struct xdr_stream *xdr_in, void *argp,
722 		struct xdr_stream *xdr_out, void *resp,
723 		struct cb_process_state *cps)
724 {
725 	struct callback_op *op = &callback_ops[0];
726 	unsigned int op_nr;
727 	__be32 status;
728 	long maxlen;
729 	__be32 res;
730 
731 	dprintk("%s: start\n", __func__);
732 	status = decode_op_hdr(xdr_in, &op_nr);
733 	if (unlikely(status))
734 		return status;
735 
736 	dprintk("%s: minorversion=%d nop=%d op_nr=%u\n",
737 		__func__, minorversion, nop, op_nr);
738 
739 	status = minorversion ? preprocess_nfs41_op(nop, op_nr, &op) :
740 				preprocess_nfs4_op(op_nr, &op);
741 	if (status == htonl(NFS4ERR_OP_ILLEGAL))
742 		op_nr = OP_CB_ILLEGAL;
743 	if (status)
744 		goto encode_hdr;
745 
746 	if (cps->drc_status) {
747 		status = cps->drc_status;
748 		goto encode_hdr;
749 	}
750 
751 	maxlen = xdr_out->end - xdr_out->p;
752 	if (maxlen > 0 && maxlen < PAGE_SIZE) {
753 		status = op->decode_args(rqstp, xdr_in, argp);
754 		if (likely(status == 0))
755 			status = op->process_op(argp, resp, cps);
756 	} else
757 		status = htonl(NFS4ERR_RESOURCE);
758 
759 encode_hdr:
760 	res = encode_op_hdr(xdr_out, op_nr, status);
761 	if (unlikely(res))
762 		return res;
763 	if (op->encode_res != NULL && status == 0)
764 		status = op->encode_res(rqstp, xdr_out, resp);
765 	dprintk("%s: done, status = %d\n", __func__, ntohl(status));
766 	return status;
767 }
768 
769 /*
770  * Decode, process and encode a COMPOUND
771  */
772 static __be32 nfs4_callback_compound(struct svc_rqst *rqstp, void *argp, void *resp)
773 {
774 	struct cb_compound_hdr_arg hdr_arg = { 0 };
775 	struct cb_compound_hdr_res hdr_res = { NULL };
776 	struct xdr_stream xdr_in, xdr_out;
777 	__be32 *p, status;
778 	struct cb_process_state cps = {
779 		.drc_status = 0,
780 		.clp = NULL,
781 	};
782 	unsigned int nops = 0;
783 
784 	dprintk("%s: start\n", __func__);
785 
786 	xdr_init_decode(&xdr_in, &rqstp->rq_arg, rqstp->rq_arg.head[0].iov_base);
787 
788 	p = (__be32*)((char *)rqstp->rq_res.head[0].iov_base + rqstp->rq_res.head[0].iov_len);
789 	xdr_init_encode(&xdr_out, &rqstp->rq_res, p);
790 
791 	status = decode_compound_hdr_arg(&xdr_in, &hdr_arg);
792 	if (status == __constant_htonl(NFS4ERR_RESOURCE))
793 		return rpc_garbage_args;
794 
795 	if (hdr_arg.minorversion == 0) {
796 		cps.clp = nfs4_find_client_ident(hdr_arg.cb_ident);
797 		if (!cps.clp || !check_gss_callback_principal(cps.clp, rqstp))
798 			return rpc_drop_reply;
799 	}
800 
801 	hdr_res.taglen = hdr_arg.taglen;
802 	hdr_res.tag = hdr_arg.tag;
803 	if (encode_compound_hdr_res(&xdr_out, &hdr_res) != 0)
804 		return rpc_system_err;
805 
806 	while (status == 0 && nops != hdr_arg.nops) {
807 		status = process_op(hdr_arg.minorversion, nops, rqstp,
808 				    &xdr_in, argp, &xdr_out, resp, &cps);
809 		nops++;
810 	}
811 
812 	/* Buffer overflow in decode_ops_hdr or encode_ops_hdr. Return
813 	* resource error in cb_compound status without returning op */
814 	if (unlikely(status == htonl(NFS4ERR_RESOURCE_HDR))) {
815 		status = htonl(NFS4ERR_RESOURCE);
816 		nops--;
817 	}
818 
819 	*hdr_res.status = status;
820 	*hdr_res.nops = htonl(nops);
821 	nfs4_cb_free_slot(cps.clp);
822 	nfs_put_client(cps.clp);
823 	dprintk("%s: done, status = %u\n", __func__, ntohl(status));
824 	return rpc_success;
825 }
826 
827 /*
828  * Define NFS4 callback COMPOUND ops.
829  */
830 static struct callback_op callback_ops[] = {
831 	[0] = {
832 		.res_maxsize = CB_OP_HDR_RES_MAXSZ,
833 	},
834 	[OP_CB_GETATTR] = {
835 		.process_op = (callback_process_op_t)nfs4_callback_getattr,
836 		.decode_args = (callback_decode_arg_t)decode_getattr_args,
837 		.encode_res = (callback_encode_res_t)encode_getattr_res,
838 		.res_maxsize = CB_OP_GETATTR_RES_MAXSZ,
839 	},
840 	[OP_CB_RECALL] = {
841 		.process_op = (callback_process_op_t)nfs4_callback_recall,
842 		.decode_args = (callback_decode_arg_t)decode_recall_args,
843 		.res_maxsize = CB_OP_RECALL_RES_MAXSZ,
844 	},
845 #if defined(CONFIG_NFS_V4_1)
846 	[OP_CB_LAYOUTRECALL] = {
847 		.process_op = (callback_process_op_t)nfs4_callback_layoutrecall,
848 		.decode_args =
849 			(callback_decode_arg_t)decode_layoutrecall_args,
850 		.res_maxsize = CB_OP_LAYOUTRECALL_RES_MAXSZ,
851 	},
852 	[OP_CB_SEQUENCE] = {
853 		.process_op = (callback_process_op_t)nfs4_callback_sequence,
854 		.decode_args = (callback_decode_arg_t)decode_cb_sequence_args,
855 		.encode_res = (callback_encode_res_t)encode_cb_sequence_res,
856 		.res_maxsize = CB_OP_SEQUENCE_RES_MAXSZ,
857 	},
858 	[OP_CB_RECALL_ANY] = {
859 		.process_op = (callback_process_op_t)nfs4_callback_recallany,
860 		.decode_args = (callback_decode_arg_t)decode_recallany_args,
861 		.res_maxsize = CB_OP_RECALLANY_RES_MAXSZ,
862 	},
863 	[OP_CB_RECALL_SLOT] = {
864 		.process_op = (callback_process_op_t)nfs4_callback_recallslot,
865 		.decode_args = (callback_decode_arg_t)decode_recallslot_args,
866 		.res_maxsize = CB_OP_RECALLSLOT_RES_MAXSZ,
867 	},
868 #endif /* CONFIG_NFS_V4_1 */
869 };
870 
871 /*
872  * Define NFS4 callback procedures
873  */
874 static struct svc_procedure nfs4_callback_procedures1[] = {
875 	[CB_NULL] = {
876 		.pc_func = nfs4_callback_null,
877 		.pc_decode = (kxdrproc_t)nfs4_decode_void,
878 		.pc_encode = (kxdrproc_t)nfs4_encode_void,
879 		.pc_xdrressize = 1,
880 	},
881 	[CB_COMPOUND] = {
882 		.pc_func = nfs4_callback_compound,
883 		.pc_encode = (kxdrproc_t)nfs4_encode_void,
884 		.pc_argsize = 256,
885 		.pc_ressize = 256,
886 		.pc_xdrressize = NFS4_CALLBACK_BUFSIZE,
887 	}
888 };
889 
890 struct svc_version nfs4_callback_version1 = {
891 	.vs_vers = 1,
892 	.vs_nproc = ARRAY_SIZE(nfs4_callback_procedures1),
893 	.vs_proc = nfs4_callback_procedures1,
894 	.vs_xdrsize = NFS4_CALLBACK_XDRSIZE,
895 	.vs_dispatch = NULL,
896 	.vs_hidden = 1,
897 };
898 
899 struct svc_version nfs4_callback_version4 = {
900 	.vs_vers = 4,
901 	.vs_nproc = ARRAY_SIZE(nfs4_callback_procedures1),
902 	.vs_proc = nfs4_callback_procedures1,
903 	.vs_xdrsize = NFS4_CALLBACK_XDRSIZE,
904 	.vs_dispatch = NULL,
905 };
906