fs/nfsd/nfs4state.c

   1 /*
   2 *  Copyright (c) 2001 The Regents of the University of Michigan.
   3 *  All rights reserved.
   4 *
   5 *  Kendrick Smith <kmsmith@umich.edu>
   6 *  Andy Adamson <kandros@umich.edu>
   7 *
   8 *  Redistribution and use in source and binary forms, with or without
   9 *  modification, are permitted provided that the following conditions
  10 *  are met:
  11 *
  12 *  1. Redistributions of source code must retain the above copyright
  13 *     notice, this list of conditions and the following disclaimer.
  14 *  2. Redistributions in binary form must reproduce the above copyright
  15 *     notice, this list of conditions and the following disclaimer in the
  16 *     documentation and/or other materials provided with the distribution.
  17 *  3. Neither the name of the University nor the names of its
  18 *     contributors may be used to endorse or promote products derived
  19 *     from this software without specific prior written permission.
  20 *
  21 *  THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
  22 *  WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
  23 *  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
  24 *  DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
  25 *  FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  26 *  CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  27 *  SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
  28 *  BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
  29 *  LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
  30 *  NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
  31 *  SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  32 *
  33 */
  34
  35 #include <linux/file.h>
  36 #include <linux/fs.h>
  37 #include <linux/slab.h>
  38 #include <linux/namei.h>
  39 #include <linux/swap.h>
  40 #include <linux/pagemap.h>
  41 #include <linux/ratelimit.h>
  42 #include <linux/sunrpc/svcauth_gss.h>
  43 #include <linux/sunrpc/addr.h>
  44 #include "xdr4.h"
  45 #include "xdr4cb.h"
  46 #include "vfs.h"
  47 #include "current_stateid.h"
  48
  49 #include "netns.h"
  50
  51 #define NFSDDBG_FACILITY                NFSDDBG_PROC
  52
  53 #define all_ones {{~0,~0},~0}
  54 static const stateid_t one_stateid = {
  55         .si_generation = ~0,
  56         .si_opaque = all_ones,
  57 };
  58 static const stateid_t zero_stateid = {
  59         /* all fields zero */
  60 };
  61 static const stateid_t currentstateid = {
  62         .si_generation = 1,
  63 };
  64
  65 static u64 current_sessionid = 1;
  66
  67 #define ZERO_STATEID(stateid) (!memcmp((stateid), &zero_stateid, sizeof(stateid_t)))
  68 #define ONE_STATEID(stateid)  (!memcmp((stateid), &one_stateid, sizeof(stateid_t)))
  69 #define CURRENT_STATEID(stateid) (!memcmp((stateid), &currentstateid, sizeof(stateid_t)))
  70
  71 /* forward declarations */
  72 static int check_for_locks(struct nfs4_file *filp, struct nfs4_lockowner *lowner);
  73
  74 /* Locking: */
  75
  76 /* Currently used for almost all code touching nfsv4 state: */
  77 static DEFINE_MUTEX(client_mutex);
  78
  79 /*
  80  * Currently used for the del_recall_lru and file hash table.  In an
  81  * effort to decrease the scope of the client_mutex, this spinlock may
  82  * eventually cover more:
  83  */
  84 static DEFINE_SPINLOCK(recall_lock);
  85
  86 static struct kmem_cache *openowner_slab = NULL;
  87 static struct kmem_cache *lockowner_slab = NULL;
  88 static struct kmem_cache *file_slab = NULL;
  89 static struct kmem_cache *stateid_slab = NULL;
  90 static struct kmem_cache *deleg_slab = NULL;
  91
  92 void
  93 nfs4_lock_state(void)
  94 {
  95         mutex_lock(&client_mutex);
  96 }
  97
  98 static void free_session(struct nfsd4_session *);
  99
 100 static bool is_session_dead(struct nfsd4_session *ses)
 101 {
 102         return ses->se_flags & NFS4_SESSION_DEAD;
 103 }
 104
 105 void nfsd4_put_session(struct nfsd4_session *ses)
 106 {
 107         if (atomic_dec_and_test(&ses->se_ref) && is_session_dead(ses))
 108                 free_session(ses);
 109 }
 110
 111 static __be32 mark_session_dead_locked(struct nfsd4_session *ses, int ref_held_by_me)
 112 {
 113         if (atomic_read(&ses->se_ref) > ref_held_by_me)
 114                 return nfserr_jukebox;
 115         ses->se_flags |= NFS4_SESSION_DEAD;
 116         return nfs_ok;
 117 }
 118
 119 static __be32 nfsd4_get_session_locked(struct nfsd4_session *ses)
 120 {
 121         if (is_session_dead(ses))
 122                 return nfserr_badsession;
 123         atomic_inc(&ses->se_ref);
 124         return nfs_ok;
 125 }
 126
 127 void
 128 nfs4_unlock_state(void)
 129 {
 130         mutex_unlock(&client_mutex);
 131 }
 132
 133 static bool is_client_expired(struct nfs4_client *clp)
 134 {
 135         return clp->cl_time == 0;
 136 }
 137
 138 static __be32 mark_client_expired_locked(struct nfs4_client *clp)
 139 {
 140         if (atomic_read(&clp->cl_refcount))
 141                 return nfserr_jukebox;
 142         clp->cl_time = 0;
 143         return nfs_ok;
 144 }
 145
 146 static __be32 mark_client_expired(struct nfs4_client *clp)
 147 {
 148         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
 149         __be32 ret;
 150
 151         spin_lock(&nn->client_lock);
 152         ret = mark_client_expired_locked(clp);
 153         spin_unlock(&nn->client_lock);
 154         return ret;
 155 }
 156
 157 static __be32 get_client_locked(struct nfs4_client *clp)
 158 {
 159         if (is_client_expired(clp))
 160                 return nfserr_expired;
 161         atomic_inc(&clp->cl_refcount);
 162         return nfs_ok;
 163 }
 164
 165 /* must be called under the client_lock */
 166 static inline void
 167 renew_client_locked(struct nfs4_client *clp)
 168 {
 169         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
 170
 171         if (is_client_expired(clp)) {
 172                 WARN_ON(1);
 173                 printk("%s: client (clientid %08x/%08x) already expired\n",
 174                         __func__,
 175                         clp->cl_clientid.cl_boot,
 176                         clp->cl_clientid.cl_id);
 177                 return;
 178         }
 179
 180         dprintk("renewing client (clientid %08x/%08x)\n",
 181                         clp->cl_clientid.cl_boot,
 182                         clp->cl_clientid.cl_id);
 183         list_move_tail(&clp->cl_lru, &nn->client_lru);
 184         clp->cl_time = get_seconds();
 185 }
 186
 187 static inline void
 188 renew_client(struct nfs4_client *clp)
 189 {
 190         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
 191
 192         spin_lock(&nn->client_lock);
 193         renew_client_locked(clp);
 194         spin_unlock(&nn->client_lock);
 195 }
 196
 197 static void put_client_renew_locked(struct nfs4_client *clp)
 198 {
 199         if (!atomic_dec_and_test(&clp->cl_refcount))
 200                 return;
 201         if (!is_client_expired(clp))
 202                 renew_client_locked(clp);
 203 }
 204
 205 void put_client_renew(struct nfs4_client *clp)
 206 {
 207         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
 208
 209         if (!atomic_dec_and_lock(&clp->cl_refcount, &nn->client_lock))
 210                 return;
 211         if (!is_client_expired(clp))
 212                 renew_client_locked(clp);
 213         spin_unlock(&nn->client_lock);
 214 }
 215
 216
 217 static inline u32
 218 opaque_hashval(const void *ptr, int nbytes)
 219 {
 220         unsigned char *cptr = (unsigned char *) ptr;
 221
 222         u32 x = 0;
 223         while (nbytes--) {
 224                 x *= 37;
 225                 x += *cptr++;
 226         }
 227         return x;
 228 }
 229
 230 static void nfsd4_free_file(struct nfs4_file *f)
 231 {
 232         kmem_cache_free(file_slab, f);
 233 }
 234
 235 static inline void
 236 put_nfs4_file(struct nfs4_file *fi)
 237 {
 238         if (atomic_dec_and_lock(&fi->fi_ref, &recall_lock)) {
 239                 hlist_del(&fi->fi_hash);
 240                 spin_unlock(&recall_lock);
 241                 iput(fi->fi_inode);
 242                 nfsd4_free_file(fi);
 243         }
 244 }
 245
 246 static inline void
 247 get_nfs4_file(struct nfs4_file *fi)
 248 {
 249         atomic_inc(&fi->fi_ref);
 250 }
 251
 252 static int num_delegations;
 253 unsigned long max_delegations;
 254
 255 /*
 256  * Open owner state (share locks)
 257  */
 258
 259 /* hash tables for lock and open owners */
 260 #define OWNER_HASH_BITS              8
 261 #define OWNER_HASH_SIZE             (1 << OWNER_HASH_BITS)
 262 #define OWNER_HASH_MASK             (OWNER_HASH_SIZE - 1)
 263
 264 static unsigned int ownerstr_hashval(u32 clientid, struct xdr_netobj *ownername)
 265 {
 266         unsigned int ret;
 267
 268         ret = opaque_hashval(ownername->data, ownername->len);
 269         ret += clientid;
 270         return ret & OWNER_HASH_MASK;
 271 }
 272
 273 /* hash table for nfs4_file */
 274 #define FILE_HASH_BITS                   8
 275 #define FILE_HASH_SIZE                  (1 << FILE_HASH_BITS)
 276
 277 static unsigned int file_hashval(struct inode *ino)
 278 {
 279         /* XXX: why are we hashing on inode pointer, anyway? */
 280         return hash_ptr(ino, FILE_HASH_BITS);
 281 }
 282
 283 static struct hlist_head file_hashtbl[FILE_HASH_SIZE];
 284
 285 static void __nfs4_file_get_access(struct nfs4_file *fp, int oflag)
 286 {
 287         WARN_ON_ONCE(!(fp->fi_fds[oflag] || fp->fi_fds[O_RDWR]));
 288         atomic_inc(&fp->fi_access[oflag]);
 289 }
 290
 291 static void nfs4_file_get_access(struct nfs4_file *fp, int oflag)
 292 {
 293         if (oflag == O_RDWR) {
 294                 __nfs4_file_get_access(fp, O_RDONLY);
 295                 __nfs4_file_get_access(fp, O_WRONLY);
 296         } else
 297                 __nfs4_file_get_access(fp, oflag);
 298 }
 299
 300 static void nfs4_file_put_fd(struct nfs4_file *fp, int oflag)
 301 {
 302         if (fp->fi_fds[oflag]) {
 303                 fput(fp->fi_fds[oflag]);
 304                 fp->fi_fds[oflag] = NULL;
 305         }
 306 }
 307
 308 static void __nfs4_file_put_access(struct nfs4_file *fp, int oflag)
 309 {
 310         if (atomic_dec_and_test(&fp->fi_access[oflag])) {
 311                 nfs4_file_put_fd(fp, oflag);
 312                 if (atomic_read(&fp->fi_access[1 - oflag]) == 0)
 313                         nfs4_file_put_fd(fp, O_RDWR);
 314         }
 315 }
 316
 317 static void nfs4_file_put_access(struct nfs4_file *fp, int oflag)
 318 {
 319         if (oflag == O_RDWR) {
 320                 __nfs4_file_put_access(fp, O_RDONLY);
 321                 __nfs4_file_put_access(fp, O_WRONLY);
 322         } else
 323                 __nfs4_file_put_access(fp, oflag);
 324 }
 325
 326 static struct nfs4_stid *nfs4_alloc_stid(struct nfs4_client *cl, struct
 327 kmem_cache *slab)
 328 {
 329         struct idr *stateids = &cl->cl_stateids;
 330         struct nfs4_stid *stid;
 331         int new_id;
 332
 333         stid = kmem_cache_alloc(slab, GFP_KERNEL);
 334         if (!stid)
 335                 return NULL;
 336
 337         new_id = idr_alloc_cyclic(stateids, stid, 0, 0, GFP_KERNEL);
 338         if (new_id < 0)
 339                 goto out_free;
 340         stid->sc_client = cl;
 341         stid->sc_type = 0;
 342         stid->sc_stateid.si_opaque.so_id = new_id;
 343         stid->sc_stateid.si_opaque.so_clid = cl->cl_clientid;
 344         /* Will be incremented before return to client: */
 345         stid->sc_stateid.si_generation = 0;
 346
 347         /*
 348          * It shouldn't be a problem to reuse an opaque stateid value.
 349          * I don't think it is for 4.1.  But with 4.0 I worry that, for
 350          * example, a stray write retransmission could be accepted by
 351          * the server when it should have been rejected.  Therefore,
 352          * adopt a trick from the sctp code to attempt to maximize the
 353          * amount of time until an id is reused, by ensuring they always
 354          * "increase" (mod INT_MAX):
 355          */
 356         return stid;
 357 out_free:
 358         kmem_cache_free(slab, stid);
 359         return NULL;
 360 }
 361
 362 static struct nfs4_ol_stateid * nfs4_alloc_stateid(struct nfs4_client *clp)
 363 {
 364         return openlockstateid(nfs4_alloc_stid(clp, stateid_slab));
 365 }
 366
 367 static struct nfs4_delegation *
 368 alloc_init_deleg(struct nfs4_client *clp, struct nfs4_ol_stateid *stp, struct svc_fh *current_fh)
 369 {
 370         struct nfs4_delegation *dp;
 371
 372         dprintk("NFSD alloc_init_deleg\n");
 373         if (num_delegations > max_delegations)
 374                 return NULL;
 375         dp = delegstateid(nfs4_alloc_stid(clp, deleg_slab));
 376         if (dp == NULL)
 377                 return dp;
 378         dp->dl_stid.sc_type = NFS4_DELEG_STID;
 379         /*
 380          * delegation seqid's are never incremented.  The 4.1 special
 381          * meaning of seqid 0 isn't meaningful, really, but let's avoid
 382          * 0 anyway just for consistency and use 1:
 383          */
 384         dp->dl_stid.sc_stateid.si_generation = 1;
 385         num_delegations++;
 386         INIT_LIST_HEAD(&dp->dl_perfile);
 387         INIT_LIST_HEAD(&dp->dl_perclnt);
 388         INIT_LIST_HEAD(&dp->dl_recall_lru);
 389         dp->dl_file = NULL;
 390         dp->dl_type = NFS4_OPEN_DELEGATE_READ;
 391         fh_copy_shallow(&dp->dl_fh, &current_fh->fh_handle);
 392         dp->dl_time = 0;
 393         atomic_set(&dp->dl_count, 1);
 394         nfsd4_init_callback(&dp->dl_recall);
 395         return dp;
 396 }
 397
 398 static void remove_stid(struct nfs4_stid *s)
 399 {
 400         struct idr *stateids = &s->sc_client->cl_stateids;
 401
 402         idr_remove(stateids, s->sc_stateid.si_opaque.so_id);
 403 }
 404
 405 static void nfs4_free_stid(struct kmem_cache *slab, struct nfs4_stid *s)
 406 {
 407         kmem_cache_free(slab, s);
 408 }
 409
 410 void
 411 nfs4_put_delegation(struct nfs4_delegation *dp)
 412 {
 413         if (atomic_dec_and_test(&dp->dl_count)) {
 414                 nfs4_free_stid(deleg_slab, &dp->dl_stid);
 415                 num_delegations--;
 416         }
 417 }
 418
 419 static void nfs4_put_deleg_lease(struct nfs4_file *fp)
 420 {
 421         if (atomic_dec_and_test(&fp->fi_delegees)) {
 422                 vfs_setlease(fp->fi_deleg_file, F_UNLCK, &fp->fi_lease);
 423                 fp->fi_lease = NULL;
 424                 fput(fp->fi_deleg_file);
 425                 fp->fi_deleg_file = NULL;
 426         }
 427 }
 428
 429 static void unhash_stid(struct nfs4_stid *s)
 430 {
 431         s->sc_type = 0;
 432 }
 433
 434 /* Called under the state lock. */
 435 static void
 436 unhash_delegation(struct nfs4_delegation *dp)
 437 {
 438         list_del_init(&dp->dl_perclnt);
 439         spin_lock(&recall_lock);
 440         list_del_init(&dp->dl_perfile);
 441         list_del_init(&dp->dl_recall_lru);
 442         spin_unlock(&recall_lock);
 443         nfs4_put_deleg_lease(dp->dl_file);
 444         put_nfs4_file(dp->dl_file);
 445         dp->dl_file = NULL;
 446 }
 447
 448
 449
 450 static void destroy_revoked_delegation(struct nfs4_delegation *dp)
 451 {
 452         list_del_init(&dp->dl_recall_lru);
 453         remove_stid(&dp->dl_stid);
 454         nfs4_put_delegation(dp);
 455 }
 456
 457 static void destroy_delegation(struct nfs4_delegation *dp)
 458 {
 459         unhash_delegation(dp);
 460         remove_stid(&dp->dl_stid);
 461         nfs4_put_delegation(dp);
 462 }
 463
 464 static void revoke_delegation(struct nfs4_delegation *dp)
 465 {
 466         struct nfs4_client *clp = dp->dl_stid.sc_client;
 467
 468         if (clp->cl_minorversion == 0)
 469                 destroy_delegation(dp);
 470         else {
 471                 unhash_delegation(dp);
 472                 dp->dl_stid.sc_type = NFS4_REVOKED_DELEG_STID;
 473                 list_add(&dp->dl_recall_lru, &clp->cl_revoked);
 474         }
 475 }
 476
 477 /*
 478  * SETCLIENTID state
 479  */
 480
 481 static unsigned int clientid_hashval(u32 id)
 482 {
 483         return id & CLIENT_HASH_MASK;
 484 }
 485
 486 static unsigned int clientstr_hashval(const char *name)
 487 {
 488         return opaque_hashval(name, 8) & CLIENT_HASH_MASK;
 489 }
 490
 491 /*
 492  * We store the NONE, READ, WRITE, and BOTH bits separately in the
 493  * st_{access,deny}_bmap field of the stateid, in order to track not
 494  * only what share bits are currently in force, but also what
 495  * combinations of share bits previous opens have used.  This allows us
 496  * to enforce the recommendation of rfc 3530 14.2.19 that the server
 497  * return an error if the client attempt to downgrade to a combination
 498  * of share bits not explicable by closing some of its previous opens.
 499  *
 500  * XXX: This enforcement is actually incomplete, since we don't keep
 501  * track of access/deny bit combinations; so, e.g., we allow:
 502  *
 503  *      OPEN allow read, deny write
 504  *      OPEN allow both, deny none
 505  *      DOWNGRADE allow read, deny none
 506  *
 507  * which we should reject.
 508  */
 509 static unsigned int
 510 bmap_to_share_mode(unsigned long bmap) {
 511         int i;
 512         unsigned int access = 0;
 513
 514         for (i = 1; i < 4; i++) {
 515                 if (test_bit(i, &bmap))
 516                         access |= i;
 517         }
 518         return access;
 519 }
 520
 521 static bool
 522 test_share(struct nfs4_ol_stateid *stp, struct nfsd4_open *open) {
 523         unsigned int access, deny;
 524
 525         access = bmap_to_share_mode(stp->st_access_bmap);
 526         deny = bmap_to_share_mode(stp->st_deny_bmap);
 527         if ((access & open->op_share_deny) || (deny & open->op_share_access))
 528                 return false;
 529         return true;
 530 }
 531
 532 /* set share access for a given stateid */
 533 static inline void
 534 set_access(u32 access, struct nfs4_ol_stateid *stp)
 535 {
 536         __set_bit(access, &stp->st_access_bmap);
 537 }
 538
 539 /* clear share access for a given stateid */
 540 static inline void
 541 clear_access(u32 access, struct nfs4_ol_stateid *stp)
 542 {
 543         __clear_bit(access, &stp->st_access_bmap);
 544 }
 545
 546 /* test whether a given stateid has access */
 547 static inline bool
 548 test_access(u32 access, struct nfs4_ol_stateid *stp)
 549 {
 550         return test_bit(access, &stp->st_access_bmap);
 551 }
 552
 553 /* set share deny for a given stateid */
 554 static inline void
 555 set_deny(u32 access, struct nfs4_ol_stateid *stp)
 556 {
 557         __set_bit(access, &stp->st_deny_bmap);
 558 }
 559
 560 /* clear share deny for a given stateid */
 561 static inline void
 562 clear_deny(u32 access, struct nfs4_ol_stateid *stp)
 563 {
 564         __clear_bit(access, &stp->st_deny_bmap);
 565 }
 566
 567 /* test whether a given stateid is denying specific access */
 568 static inline bool
 569 test_deny(u32 access, struct nfs4_ol_stateid *stp)
 570 {
 571         return test_bit(access, &stp->st_deny_bmap);
 572 }
 573
 574 static int nfs4_access_to_omode(u32 access)
 575 {
 576         switch (access & NFS4_SHARE_ACCESS_BOTH) {
 577         case NFS4_SHARE_ACCESS_READ:
 578                 return O_RDONLY;
 579         case NFS4_SHARE_ACCESS_WRITE:
 580                 return O_WRONLY;
 581         case NFS4_SHARE_ACCESS_BOTH:
 582                 return O_RDWR;
 583         }
 584         WARN_ON_ONCE(1);
 585         return O_RDONLY;
 586 }
 587
 588 /* release all access and file references for a given stateid */
 589 static void
 590 release_all_access(struct nfs4_ol_stateid *stp)
 591 {
 592         int i;
 593
 594         for (i = 1; i < 4; i++) {
 595                 if (test_access(i, stp))
 596                         nfs4_file_put_access(stp->st_file,
 597                                              nfs4_access_to_omode(i));
 598                 clear_access(i, stp);
 599         }
 600 }
 601
 602 static void unhash_generic_stateid(struct nfs4_ol_stateid *stp)
 603 {
 604         list_del(&stp->st_perfile);
 605         list_del(&stp->st_perstateowner);
 606 }
 607
 608 static void close_generic_stateid(struct nfs4_ol_stateid *stp)
 609 {
 610         release_all_access(stp);
 611         put_nfs4_file(stp->st_file);
 612         stp->st_file = NULL;
 613 }
 614
 615 static void free_generic_stateid(struct nfs4_ol_stateid *stp)
 616 {
 617         remove_stid(&stp->st_stid);
 618         nfs4_free_stid(stateid_slab, &stp->st_stid);
 619 }
 620
 621 static void release_lock_stateid(struct nfs4_ol_stateid *stp)
 622 {
 623         struct file *file;
 624
 625         unhash_generic_stateid(stp);
 626         unhash_stid(&stp->st_stid);
 627         file = find_any_file(stp->st_file);
 628         if (file)
 629                 locks_remove_posix(file, (fl_owner_t)lockowner(stp->st_stateowner));
 630         close_generic_stateid(stp);
 631         free_generic_stateid(stp);
 632 }
 633
 634 static void unhash_lockowner(struct nfs4_lockowner *lo)
 635 {
 636         struct nfs4_ol_stateid *stp;
 637
 638         list_del(&lo->lo_owner.so_strhash);
 639         list_del(&lo->lo_perstateid);
 640         list_del(&lo->lo_owner_ino_hash);
 641         while (!list_empty(&lo->lo_owner.so_stateids)) {
 642                 stp = list_first_entry(&lo->lo_owner.so_stateids,
 643                                 struct nfs4_ol_stateid, st_perstateowner);
 644                 release_lock_stateid(stp);
 645         }
 646 }
 647
 648 static void release_lockowner(struct nfs4_lockowner *lo)
 649 {
 650         unhash_lockowner(lo);
 651         nfs4_free_lockowner(lo);
 652 }
 653
 654 static void
 655 release_stateid_lockowners(struct nfs4_ol_stateid *open_stp)
 656 {
 657         struct nfs4_lockowner *lo;
 658
 659         while (!list_empty(&open_stp->st_lockowners)) {
 660                 lo = list_entry(open_stp->st_lockowners.next,
 661                                 struct nfs4_lockowner, lo_perstateid);
 662                 release_lockowner(lo);
 663         }
 664 }
 665
 666 static void unhash_open_stateid(struct nfs4_ol_stateid *stp)
 667 {
 668         unhash_generic_stateid(stp);
 669         release_stateid_lockowners(stp);
 670         close_generic_stateid(stp);
 671 }
 672
 673 static void release_open_stateid(struct nfs4_ol_stateid *stp)
 674 {
 675         unhash_open_stateid(stp);
 676         free_generic_stateid(stp);
 677 }
 678
 679 static void unhash_openowner(struct nfs4_openowner *oo)
 680 {
 681         struct nfs4_ol_stateid *stp;
 682
 683         list_del(&oo->oo_owner.so_strhash);
 684         list_del(&oo->oo_perclient);
 685         while (!list_empty(&oo->oo_owner.so_stateids)) {
 686                 stp = list_first_entry(&oo->oo_owner.so_stateids,
 687                                 struct nfs4_ol_stateid, st_perstateowner);
 688                 release_open_stateid(stp);
 689         }
 690 }
 691
 692 static void release_last_closed_stateid(struct nfs4_openowner *oo)
 693 {
 694         struct nfs4_ol_stateid *s = oo->oo_last_closed_stid;
 695
 696         if (s) {
 697                 free_generic_stateid(s);
 698                 oo->oo_last_closed_stid = NULL;
 699         }
 700 }
 701
 702 static void release_openowner(struct nfs4_openowner *oo)
 703 {
 704         unhash_openowner(oo);
 705         list_del(&oo->oo_close_lru);
 706         release_last_closed_stateid(oo);
 707         nfs4_free_openowner(oo);
 708 }
 709
 710 static inline int
 711 hash_sessionid(struct nfs4_sessionid *sessionid)
 712 {
 713         struct nfsd4_sessionid *sid = (struct nfsd4_sessionid *)sessionid;
 714
 715         return sid->sequence % SESSION_HASH_SIZE;
 716 }
 717
 718 #ifdef NFSD_DEBUG
 719 static inline void
 720 dump_sessionid(const char *fn, struct nfs4_sessionid *sessionid)
 721 {
 722         u32 *ptr = (u32 *)(&sessionid->data[0]);
 723         dprintk("%s: %u:%u:%u:%u\n", fn, ptr[0], ptr[1], ptr[2], ptr[3]);
 724 }
 725 #else
 726 static inline void
 727 dump_sessionid(const char *fn, struct nfs4_sessionid *sessionid)
 728 {
 729 }
 730 #endif
 731
 732 /*
 733  * Bump the seqid on cstate->replay_owner, and clear replay_owner if it
 734  * won't be used for replay.
 735  */
 736 void nfsd4_bump_seqid(struct nfsd4_compound_state *cstate, __be32 nfserr)
 737 {
 738         struct nfs4_stateowner *so = cstate->replay_owner;
 739
 740         if (nfserr == nfserr_replay_me)
 741                 return;
 742
 743         if (!seqid_mutating_err(ntohl(nfserr))) {
 744                 cstate->replay_owner = NULL;
 745                 return;
 746         }
 747         if (!so)
 748                 return;
 749         if (so->so_is_open_owner)
 750                 release_last_closed_stateid(openowner(so));
 751         so->so_seqid++;
 752         return;
 753 }
 754
 755 static void
 756 gen_sessionid(struct nfsd4_session *ses)
 757 {
 758         struct nfs4_client *clp = ses->se_client;
 759         struct nfsd4_sessionid *sid;
 760
 761         sid = (struct nfsd4_sessionid *)ses->se_sessionid.data;
 762         sid->clientid = clp->cl_clientid;
 763         sid->sequence = current_sessionid++;
 764         sid->reserved = 0;
 765 }
 766
 767 /*
 768  * The protocol defines ca_maxresponssize_cached to include the size of
 769  * the rpc header, but all we need to cache is the data starting after
 770  * the end of the initial SEQUENCE operation--the rest we regenerate
 771  * each time.  Therefore we can advertise a ca_maxresponssize_cached
 772  * value that is the number of bytes in our cache plus a few additional
 773  * bytes.  In order to stay on the safe side, and not promise more than
 774  * we can cache, those additional bytes must be the minimum possible: 24
 775  * bytes of rpc header (xid through accept state, with AUTH_NULL
 776  * verifier), 12 for the compound header (with zero-length tag), and 44
 777  * for the SEQUENCE op response:
 778  */
 779 #define NFSD_MIN_HDR_SEQ_SZ  (24 + 12 + 44)
 780
 781 static void
 782 free_session_slots(struct nfsd4_session *ses)
 783 {
 784         int i;
 785
 786         for (i = 0; i < ses->se_fchannel.maxreqs; i++)
 787                 kfree(ses->se_slots[i]);
 788 }
 789
 790 /*
 791  * We don't actually need to cache the rpc and session headers, so we
 792  * can allocate a little less for each slot:
 793  */
 794 static inline u32 slot_bytes(struct nfsd4_channel_attrs *ca)
 795 {
 796         u32 size;
 797
 798         if (ca->maxresp_cached < NFSD_MIN_HDR_SEQ_SZ)
 799                 size = 0;
 800         else
 801                 size = ca->maxresp_cached - NFSD_MIN_HDR_SEQ_SZ;
 802         return size + sizeof(struct nfsd4_slot);
 803 }
 804
 805 /*
 806  * XXX: If we run out of reserved DRC memory we could (up to a point)
 807  * re-negotiate active sessions and reduce their slot usage to make
 808  * room for new connections. For now we just fail the create session.
 809  */
 810 static u32 nfsd4_get_drc_mem(struct nfsd4_channel_attrs *ca)
 811 {
 812         u32 slotsize = slot_bytes(ca);
 813         u32 num = ca->maxreqs;
 814         int avail;
 815
 816         spin_lock(&nfsd_drc_lock);
 817         avail = min((unsigned long)NFSD_MAX_MEM_PER_SESSION,
 818                     nfsd_drc_max_mem - nfsd_drc_mem_used);
 819         num = min_t(int, num, avail / slotsize);
 820         nfsd_drc_mem_used += num * slotsize;
 821         spin_unlock(&nfsd_drc_lock);
 822
 823         return num;
 824 }
 825
 826 static void nfsd4_put_drc_mem(struct nfsd4_channel_attrs *ca)
 827 {
 828         int slotsize = slot_bytes(ca);
 829
 830         spin_lock(&nfsd_drc_lock);
 831         nfsd_drc_mem_used -= slotsize * ca->maxreqs;
 832         spin_unlock(&nfsd_drc_lock);
 833 }
 834
 835 static struct nfsd4_session *alloc_session(struct nfsd4_channel_attrs *attrs)
 836 {
 837         int numslots = attrs->maxreqs;
 838         int slotsize = slot_bytes(attrs);
 839         struct nfsd4_session *new;
 840         int mem, i;
 841
 842         BUILD_BUG_ON(NFSD_MAX_SLOTS_PER_SESSION * sizeof(struct nfsd4_slot *)
 843                         + sizeof(struct nfsd4_session) > PAGE_SIZE);
 844         mem = numslots * sizeof(struct nfsd4_slot *);
 845
 846         new = kzalloc(sizeof(*new) + mem, GFP_KERNEL);
 847         if (!new)
 848                 return NULL;
 849         /* allocate each struct nfsd4_slot and data cache in one piece */
 850         for (i = 0; i < numslots; i++) {
 851                 new->se_slots[i] = kzalloc(slotsize, GFP_KERNEL);
 852                 if (!new->se_slots[i])
 853                         goto out_free;
 854         }
 855         return new;
 856 out_free:
 857         while (i--)
 858                 kfree(new->se_slots[i]);
 859         kfree(new);
 860         return NULL;
 861 }
 862
 863 static void free_conn(struct nfsd4_conn *c)
 864 {
 865         svc_xprt_put(c->cn_xprt);
 866         kfree(c);
 867 }
 868
 869 static void nfsd4_conn_lost(struct svc_xpt_user *u)
 870 {
 871         struct nfsd4_conn *c = container_of(u, struct nfsd4_conn, cn_xpt_user);
 872         struct nfs4_client *clp = c->cn_session->se_client;
 873
 874         spin_lock(&clp->cl_lock);
 875         if (!list_empty(&c->cn_persession)) {
 876                 list_del(&c->cn_persession);
 877                 free_conn(c);
 878         }
 879         nfsd4_probe_callback(clp);
 880         spin_unlock(&clp->cl_lock);
 881 }
 882
 883 static struct nfsd4_conn *alloc_conn(struct svc_rqst *rqstp, u32 flags)
 884 {
 885         struct nfsd4_conn *conn;
 886
 887         conn = kmalloc(sizeof(struct nfsd4_conn), GFP_KERNEL);
 888         if (!conn)
 889                 return NULL;
 890         svc_xprt_get(rqstp->rq_xprt);
 891         conn->cn_xprt = rqstp->rq_xprt;
 892         conn->cn_flags = flags;
 893         INIT_LIST_HEAD(&conn->cn_xpt_user.list);
 894         return conn;
 895 }
 896
 897 static void __nfsd4_hash_conn(struct nfsd4_conn *conn, struct nfsd4_session *ses)
 898 {
 899         conn->cn_session = ses;
 900         list_add(&conn->cn_persession, &ses->se_conns);
 901 }
 902
 903 static void nfsd4_hash_conn(struct nfsd4_conn *conn, struct nfsd4_session *ses)
 904 {
 905         struct nfs4_client *clp = ses->se_client;
 906
 907         spin_lock(&clp->cl_lock);
 908         __nfsd4_hash_conn(conn, ses);
 909         spin_unlock(&clp->cl_lock);
 910 }
 911
 912 static int nfsd4_register_conn(struct nfsd4_conn *conn)
 913 {
 914         conn->cn_xpt_user.callback = nfsd4_conn_lost;
 915         return register_xpt_user(conn->cn_xprt, &conn->cn_xpt_user);
 916 }
 917
 918 static void nfsd4_init_conn(struct svc_rqst *rqstp, struct nfsd4_conn *conn, struct nfsd4_session *ses)
 919 {
 920         int ret;
 921
 922         nfsd4_hash_conn(conn, ses);
 923         ret = nfsd4_register_conn(conn);
 924         if (ret)
 925                 /* oops; xprt is already down: */
 926                 nfsd4_conn_lost(&conn->cn_xpt_user);
 927         if (conn->cn_flags & NFS4_CDFC4_BACK) {
 928                 /* callback channel may be back up */
 929                 nfsd4_probe_callback(ses->se_client);
 930         }
 931 }
 932
 933 static struct nfsd4_conn *alloc_conn_from_crses(struct svc_rqst *rqstp, struct nfsd4_create_session *cses)
 934 {
 935         u32 dir = NFS4_CDFC4_FORE;
 936
 937         if (cses->flags & SESSION4_BACK_CHAN)
 938                 dir |= NFS4_CDFC4_BACK;
 939         return alloc_conn(rqstp, dir);
 940 }
 941
 942 /* must be called under client_lock */
 943 static void nfsd4_del_conns(struct nfsd4_session *s)
 944 {
 945         struct nfs4_client *clp = s->se_client;
 946         struct nfsd4_conn *c;
 947
 948         spin_lock(&clp->cl_lock);
 949         while (!list_empty(&s->se_conns)) {
 950                 c = list_first_entry(&s->se_conns, struct nfsd4_conn, cn_persession);
 951                 list_del_init(&c->cn_persession);
 952                 spin_unlock(&clp->cl_lock);
 953
 954                 unregister_xpt_user(c->cn_xprt, &c->cn_xpt_user);
 955                 free_conn(c);
 956
 957                 spin_lock(&clp->cl_lock);
 958         }
 959         spin_unlock(&clp->cl_lock);
 960 }
 961
 962 static void __free_session(struct nfsd4_session *ses)
 963 {
 964         free_session_slots(ses);
 965         kfree(ses);
 966 }
 967
 968 static void free_session(struct nfsd4_session *ses)
 969 {
 970         struct nfsd_net *nn = net_generic(ses->se_client->net, nfsd_net_id);
 971
 972         lockdep_assert_held(&nn->client_lock);
 973         nfsd4_del_conns(ses);
 974         nfsd4_put_drc_mem(&ses->se_fchannel);
 975         __free_session(ses);
 976 }
 977
 978 static void init_session(struct svc_rqst *rqstp, struct nfsd4_session *new, struct nfs4_client *clp, struct nfsd4_create_session *cses)
 979 {
 980         int idx;
 981         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
 982
 983         new->se_client = clp;
 984         gen_sessionid(new);
 985
 986         INIT_LIST_HEAD(&new->se_conns);
 987
 988         new->se_cb_seq_nr = 1;
 989         new->se_flags = cses->flags;
 990         new->se_cb_prog = cses->callback_prog;
 991         new->se_cb_sec = cses->cb_sec;
 992         atomic_set(&new->se_ref, 0);
 993         idx = hash_sessionid(&new->se_sessionid);
 994         spin_lock(&nn->client_lock);
 995         list_add(&new->se_hash, &nn->sessionid_hashtbl[idx]);
 996         spin_lock(&clp->cl_lock);
 997         list_add(&new->se_perclnt, &clp->cl_sessions);
 998         spin_unlock(&clp->cl_lock);
 999         spin_unlock(&nn->client_lock);
1000         memcpy(&new->se_fchannel, &cses->fore_channel,
1001                         sizeof(struct nfsd4_channel_attrs));
1002         if (cses->flags & SESSION4_BACK_CHAN) {
1003                 struct sockaddr *sa = svc_addr(rqstp);
1004                 /*
1005                  * This is a little silly; with sessions there's no real
1006                  * use for the callback address.  Use the peer address
1007                  * as a reasonable default for now, but consider fixing
1008                  * the rpc client not to require an address in the
1009                  * future:
1010                  */
1011                 rpc_copy_addr((struct sockaddr *)&clp->cl_cb_conn.cb_addr, sa);
1012                 clp->cl_cb_conn.cb_addrlen = svc_addr_len(sa);
1013         }
1014 }
1015
1016 /* caller must hold client_lock */
1017 static struct nfsd4_session *
1018 find_in_sessionid_hashtbl(struct nfs4_sessionid *sessionid, struct net *net)
1019 {
1020         struct nfsd4_session *elem;
1021         int idx;
1022         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
1023
1024         dump_sessionid(__func__, sessionid);
1025         idx = hash_sessionid(sessionid);
1026         /* Search in the appropriate list */
1027         list_for_each_entry(elem, &nn->sessionid_hashtbl[idx], se_hash) {
1028                 if (!memcmp(elem->se_sessionid.data, sessionid->data,
1029                             NFS4_MAX_SESSIONID_LEN)) {
1030                         return elem;
1031                 }
1032         }
1033
1034         dprintk("%s: session not found\n", __func__);
1035         return NULL;
1036 }
1037
1038 /* caller must hold client_lock */
1039 static void
1040 unhash_session(struct nfsd4_session *ses)
1041 {
1042         list_del(&ses->se_hash);
1043         spin_lock(&ses->se_client->cl_lock);
1044         list_del(&ses->se_perclnt);
1045         spin_unlock(&ses->se_client->cl_lock);
1046 }
1047
1048 /* SETCLIENTID and SETCLIENTID_CONFIRM Helper functions */
1049 static int
1050 STALE_CLIENTID(clientid_t *clid, struct nfsd_net *nn)
1051 {
1052         if (clid->cl_boot == nn->boot_time)
1053                 return 0;
1054         dprintk("NFSD stale clientid (%08x/%08x) boot_time %08lx\n",
1055                 clid->cl_boot, clid->cl_id, nn->boot_time);
1056         return 1;
1057 }
1058
1059 /*
1060  * XXX Should we use a slab cache ?
1061  * This type of memory management is somewhat inefficient, but we use it
1062  * anyway since SETCLIENTID is not a common operation.
1063  */
1064 static struct nfs4_client *alloc_client(struct xdr_netobj name)
1065 {
1066         struct nfs4_client *clp;
1067
1068         clp = kzalloc(sizeof(struct nfs4_client), GFP_KERNEL);
1069         if (clp == NULL)
1070                 return NULL;
1071         clp->cl_name.data = kmemdup(name.data, name.len, GFP_KERNEL);
1072         if (clp->cl_name.data == NULL) {
1073                 kfree(clp);
1074                 return NULL;
1075         }
1076         clp->cl_name.len = name.len;
1077         return clp;
1078 }
1079
1080 static inline void
1081 free_client(struct nfs4_client *clp)
1082 {
1083         struct nfsd_net __maybe_unused *nn = net_generic(clp->net, nfsd_net_id);
1084
1085         lockdep_assert_held(&nn->client_lock);
1086         while (!list_empty(&clp->cl_sessions)) {
1087                 struct nfsd4_session *ses;
1088                 ses = list_entry(clp->cl_sessions.next, struct nfsd4_session,
1089                                 se_perclnt);
1090                 list_del(&ses->se_perclnt);
1091                 WARN_ON_ONCE(atomic_read(&ses->se_ref));
1092                 free_session(ses);
1093         }
1094         free_svc_cred(&clp->cl_cred);
1095         kfree(clp->cl_name.data);
1096         idr_destroy(&clp->cl_stateids);
1097         kfree(clp);
1098 }
1099
1100 /* must be called under the client_lock */
1101 static inline void
1102 unhash_client_locked(struct nfs4_client *clp)
1103 {
1104         struct nfsd4_session *ses;
1105
1106         list_del(&clp->cl_lru);
1107         spin_lock(&clp->cl_lock);
1108         list_for_each_entry(ses, &clp->cl_sessions, se_perclnt)
1109                 list_del_init(&ses->se_hash);
1110         spin_unlock(&clp->cl_lock);
1111 }
1112
1113 static void
1114 destroy_client(struct nfs4_client *clp)
1115 {
1116         struct nfs4_openowner *oo;
1117         struct nfs4_delegation *dp;
1118         struct list_head reaplist;
1119         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
1120
1121         INIT_LIST_HEAD(&reaplist);
1122         spin_lock(&recall_lock);
1123         while (!list_empty(&clp->cl_delegations)) {
1124                 dp = list_entry(clp->cl_delegations.next, struct nfs4_delegation, dl_perclnt);
1125                 list_del_init(&dp->dl_perclnt);
1126                 list_move(&dp->dl_recall_lru, &reaplist);
1127         }
1128         spin_unlock(&recall_lock);
1129         while (!list_empty(&reaplist)) {
1130                 dp = list_entry(reaplist.next, struct nfs4_delegation, dl_recall_lru);
1131                 destroy_delegation(dp);
1132         }
1133         list_splice_init(&clp->cl_revoked, &reaplist);
1134         while (!list_empty(&reaplist)) {
1135                 dp = list_entry(reaplist.next, struct nfs4_delegation, dl_recall_lru);
1136                 destroy_revoked_delegation(dp);
1137         }
1138         while (!list_empty(&clp->cl_openowners)) {
1139                 oo = list_entry(clp->cl_openowners.next, struct nfs4_openowner, oo_perclient);
1140                 release_openowner(oo);
1141         }
1142         nfsd4_shutdown_callback(clp);
1143         if (clp->cl_cb_conn.cb_xprt)
1144                 svc_xprt_put(clp->cl_cb_conn.cb_xprt);
1145         list_del(&clp->cl_idhash);
1146         if (test_bit(NFSD4_CLIENT_CONFIRMED, &clp->cl_flags))
1147                 rb_erase(&clp->cl_namenode, &nn->conf_name_tree);
1148         else
1149                 rb_erase(&clp->cl_namenode, &nn->unconf_name_tree);
1150         spin_lock(&nn->client_lock);
1151         unhash_client_locked(clp);
1152         WARN_ON_ONCE(atomic_read(&clp->cl_refcount));
1153         free_client(clp);
1154         spin_unlock(&nn->client_lock);
1155 }
1156
1157 static void expire_client(struct nfs4_client *clp)
1158 {
1159         nfsd4_client_record_remove(clp);
1160         destroy_client(clp);
1161 }
1162
1163 static void copy_verf(struct nfs4_client *target, nfs4_verifier *source)
1164 {
1165         memcpy(target->cl_verifier.data, source->data,
1166                         sizeof(target->cl_verifier.data));
1167 }
1168
1169 static void copy_clid(struct nfs4_client *target, struct nfs4_client *source)
1170 {
1171         target->cl_clientid.cl_boot = source->cl_clientid.cl_boot;
1172         target->cl_clientid.cl_id = source->cl_clientid.cl_id;
1173 }
1174
1175 static int copy_cred(struct svc_cred *target, struct svc_cred *source)
1176 {
1177         if (source->cr_principal) {
1178                 target->cr_principal =
1179                                 kstrdup(source->cr_principal, GFP_KERNEL);
1180                 if (target->cr_principal == NULL)
1181                         return -ENOMEM;
1182         } else
1183                 target->cr_principal = NULL;
1184         target->cr_flavor = source->cr_flavor;
1185         target->cr_uid = source->cr_uid;
1186         target->cr_gid = source->cr_gid;
1187         target->cr_group_info = source->cr_group_info;
1188         get_group_info(target->cr_group_info);
1189         target->cr_gss_mech = source->cr_gss_mech;
1190         if (source->cr_gss_mech)
1191                 gss_mech_get(source->cr_gss_mech);
1192         return 0;
1193 }
1194
1195 static long long
1196 compare_blob(const struct xdr_netobj *o1, const struct xdr_netobj *o2)
1197 {
1198         long long res;
1199
1200         res = o1->len - o2->len;
1201         if (res)
1202                 return res;
1203         return (long long)memcmp(o1->data, o2->data, o1->len);
1204 }
1205
1206 static int same_name(const char *n1, const char *n2)
1207 {
1208         return 0 == memcmp(n1, n2, HEXDIR_LEN);
1209 }
1210
1211 static int
1212 same_verf(nfs4_verifier *v1, nfs4_verifier *v2)
1213 {
1214         return 0 == memcmp(v1->data, v2->data, sizeof(v1->data));
1215 }
1216
1217 static int
1218 same_clid(clientid_t *cl1, clientid_t *cl2)
1219 {
1220         return (cl1->cl_boot == cl2->cl_boot) && (cl1->cl_id == cl2->cl_id);
1221 }
1222
1223 static bool groups_equal(struct group_info *g1, struct group_info *g2)
1224 {
1225         int i;
1226
1227         if (g1->ngroups != g2->ngroups)
1228                 return false;
1229         for (i=0; i<g1->ngroups; i++)
1230                 if (!gid_eq(GROUP_AT(g1, i), GROUP_AT(g2, i)))
1231                         return false;
1232         return true;
1233 }
1234
1235 /*
1236  * RFC 3530 language requires clid_inuse be returned when the
1237  * "principal" associated with a requests differs from that previously
1238  * used.  We use uid, gid's, and gss principal string as our best
1239  * approximation.  We also don't want to allow non-gss use of a client
1240  * established using gss: in theory cr_principal should catch that
1241  * change, but in practice cr_principal can be null even in the gss case
1242  * since gssd doesn't always pass down a principal string.
1243  */
1244 static bool is_gss_cred(struct svc_cred *cr)
1245 {
1246         /* Is cr_flavor one of the gss "pseudoflavors"?: */
1247         return (cr->cr_flavor > RPC_AUTH_MAXFLAVOR);
1248 }
1249
1250
1251 static bool
1252 same_creds(struct svc_cred *cr1, struct svc_cred *cr2)
1253 {
1254         if ((is_gss_cred(cr1) != is_gss_cred(cr2))
1255                 || (!uid_eq(cr1->cr_uid, cr2->cr_uid))
1256                 || (!gid_eq(cr1->cr_gid, cr2->cr_gid))
1257                 || !groups_equal(cr1->cr_group_info, cr2->cr_group_info))
1258                 return false;
1259         if (cr1->cr_principal == cr2->cr_principal)
1260                 return true;
1261         if (!cr1->cr_principal || !cr2->cr_principal)
1262                 return false;
1263         return 0 == strcmp(cr1->cr_principal, cr2->cr_principal);
1264 }
1265
1266 static bool svc_rqst_integrity_protected(struct svc_rqst *rqstp)
1267 {
1268         struct svc_cred *cr = &rqstp->rq_cred;
1269         u32 service;
1270
1271         if (!cr->cr_gss_mech)
1272                 return false;
1273         service = gss_pseudoflavor_to_service(cr->cr_gss_mech, cr->cr_flavor);
1274         return service == RPC_GSS_SVC_INTEGRITY ||
1275                service == RPC_GSS_SVC_PRIVACY;
1276 }
1277
1278 static bool mach_creds_match(struct nfs4_client *cl, struct svc_rqst *rqstp)
1279 {
1280         struct svc_cred *cr = &rqstp->rq_cred;
1281
1282         if (!cl->cl_mach_cred)
1283                 return true;
1284         if (cl->cl_cred.cr_gss_mech != cr->cr_gss_mech)
1285                 return false;
1286         if (!svc_rqst_integrity_protected(rqstp))
1287                 return false;
1288         if (!cr->cr_principal)
1289                 return false;
1290         return 0 == strcmp(cl->cl_cred.cr_principal, cr->cr_principal);
1291 }
1292
1293 static void gen_clid(struct nfs4_client *clp, struct nfsd_net *nn)
1294 {
1295         static u32 current_clientid = 1;
1296
1297         clp->cl_clientid.cl_boot = nn->boot_time;
1298         clp->cl_clientid.cl_id = current_clientid++;
1299 }
1300
1301 static void gen_confirm(struct nfs4_client *clp)
1302 {
1303         __be32 verf[2];
1304         static u32 i;
1305
1306         verf[0] = (__be32)get_seconds();
1307         verf[1] = (__be32)i++;
1308         memcpy(clp->cl_confirm.data, verf, sizeof(clp->cl_confirm.data));
1309 }
1310
1311 static struct nfs4_stid *find_stateid(struct nfs4_client *cl, stateid_t *t)
1312 {
1313         struct nfs4_stid *ret;
1314
1315         ret = idr_find(&cl->cl_stateids, t->si_opaque.so_id);
1316         if (!ret || !ret->sc_type)
1317                 return NULL;
1318         return ret;
1319 }
1320
1321 static struct nfs4_stid *find_stateid_by_type(struct nfs4_client *cl, stateid_t *t, char typemask)
1322 {
1323         struct nfs4_stid *s;
1324
1325         s = find_stateid(cl, t);
1326         if (!s)
1327                 return NULL;
1328         if (typemask & s->sc_type)
1329                 return s;
1330         return NULL;
1331 }
1332
1333 static struct nfs4_client *create_client(struct xdr_netobj name,
1334                 struct svc_rqst *rqstp, nfs4_verifier *verf)
1335 {
1336         struct nfs4_client *clp;
1337         struct sockaddr *sa = svc_addr(rqstp);
1338         int ret;
1339         struct net *net = SVC_NET(rqstp);
1340         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
1341
1342         clp = alloc_client(name);
1343         if (clp == NULL)
1344                 return NULL;
1345
1346         INIT_LIST_HEAD(&clp->cl_sessions);
1347         ret = copy_cred(&clp->cl_cred, &rqstp->rq_cred);
1348         if (ret) {
1349                 spin_lock(&nn->client_lock);
1350                 free_client(clp);
1351                 spin_unlock(&nn->client_lock);
1352                 return NULL;
1353         }
1354         idr_init(&clp->cl_stateids);
1355         atomic_set(&clp->cl_refcount, 0);
1356         clp->cl_cb_state = NFSD4_CB_UNKNOWN;
1357         INIT_LIST_HEAD(&clp->cl_idhash);
1358         INIT_LIST_HEAD(&clp->cl_openowners);
1359         INIT_LIST_HEAD(&clp->cl_delegations);
1360         INIT_LIST_HEAD(&clp->cl_lru);
1361         INIT_LIST_HEAD(&clp->cl_callbacks);
1362         INIT_LIST_HEAD(&clp->cl_revoked);
1363         spin_lock_init(&clp->cl_lock);
1364         nfsd4_init_callback(&clp->cl_cb_null);
1365         clp->cl_time = get_seconds();
1366         clear_bit(0, &clp->cl_cb_slot_busy);
1367         rpc_init_wait_queue(&clp->cl_cb_waitq, "Backchannel slot table");
1368         copy_verf(clp, verf);
1369         rpc_copy_addr((struct sockaddr *) &clp->cl_addr, sa);
1370         gen_confirm(clp);
1371         clp->cl_cb_session = NULL;
1372         clp->net = net;
1373         return clp;
1374 }
1375
1376 static void
1377 add_clp_to_name_tree(struct nfs4_client *new_clp, struct rb_root *root)
1378 {
1379         struct rb_node **new = &(root->rb_node), *parent = NULL;
1380         struct nfs4_client *clp;
1381
1382         while (*new) {
1383                 clp = rb_entry(*new, struct nfs4_client, cl_namenode);
1384                 parent = *new;
1385
1386                 if (compare_blob(&clp->cl_name, &new_clp->cl_name) > 0)
1387                         new = &((*new)->rb_left);
1388                 else
1389                         new = &((*new)->rb_right);
1390         }
1391
1392         rb_link_node(&new_clp->cl_namenode, parent, new);
1393         rb_insert_color(&new_clp->cl_namenode, root);
1394 }
1395
1396 static struct nfs4_client *
1397 find_clp_in_name_tree(struct xdr_netobj *name, struct rb_root *root)
1398 {
1399         long long cmp;
1400         struct rb_node *node = root->rb_node;
1401         struct nfs4_client *clp;
1402
1403         while (node) {
1404                 clp = rb_entry(node, struct nfs4_client, cl_namenode);
1405                 cmp = compare_blob(&clp->cl_name, name);
1406                 if (cmp > 0)
1407                         node = node->rb_left;
1408                 else if (cmp < 0)
1409                         node = node->rb_right;
1410                 else
1411                         return clp;
1412         }
1413         return NULL;
1414 }
1415
1416 static void
1417 add_to_unconfirmed(struct nfs4_client *clp)
1418 {
1419         unsigned int idhashval;
1420         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
1421
1422         clear_bit(NFSD4_CLIENT_CONFIRMED, &clp->cl_flags);
1423         add_clp_to_name_tree(clp, &nn->unconf_name_tree);
1424         idhashval = clientid_hashval(clp->cl_clientid.cl_id);
1425         list_add(&clp->cl_idhash, &nn->unconf_id_hashtbl[idhashval]);
1426         renew_client(clp);
1427 }
1428
1429 static void
1430 move_to_confirmed(struct nfs4_client *clp)
1431 {
1432         unsigned int idhashval = clientid_hashval(clp->cl_clientid.cl_id);
1433         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
1434
1435         dprintk("NFSD: move_to_confirm nfs4_client %p\n", clp);
1436         list_move(&clp->cl_idhash, &nn->conf_id_hashtbl[idhashval]);
1437         rb_erase(&clp->cl_namenode, &nn->unconf_name_tree);
1438         add_clp_to_name_tree(clp, &nn->conf_name_tree);
1439         set_bit(NFSD4_CLIENT_CONFIRMED, &clp->cl_flags);
1440         renew_client(clp);
1441 }
1442
1443 static struct nfs4_client *
1444 find_client_in_id_table(struct list_head *tbl, clientid_t *clid, bool sessions)
1445 {
1446         struct nfs4_client *clp;
1447         unsigned int idhashval = clientid_hashval(clid->cl_id);
1448
1449         list_for_each_entry(clp, &tbl[idhashval], cl_idhash) {
1450                 if (same_clid(&clp->cl_clientid, clid)) {
1451                         if ((bool)clp->cl_minorversion != sessions)
1452                                 return NULL;
1453                         renew_client(clp);
1454                         return clp;
1455                 }
1456         }
1457         return NULL;
1458 }
1459
1460 static struct nfs4_client *
1461 find_confirmed_client(clientid_t *clid, bool sessions, struct nfsd_net *nn)
1462 {
1463         struct list_head *tbl = nn->conf_id_hashtbl;
1464
1465         return find_client_in_id_table(tbl, clid, sessions);
1466 }
1467
1468 static struct nfs4_client *
1469 find_unconfirmed_client(clientid_t *clid, bool sessions, struct nfsd_net *nn)
1470 {
1471         struct list_head *tbl = nn->unconf_id_hashtbl;
1472
1473         return find_client_in_id_table(tbl, clid, sessions);
1474 }
1475
1476 static bool clp_used_exchangeid(struct nfs4_client *clp)
1477 {
1478         return clp->cl_exchange_flags != 0;
1479 }
1480
1481 static struct nfs4_client *
1482 find_confirmed_client_by_name(struct xdr_netobj *name, struct nfsd_net *nn)
1483 {
1484         return find_clp_in_name_tree(name, &nn->conf_name_tree);
1485 }
1486
1487 static struct nfs4_client *
1488 find_unconfirmed_client_by_name(struct xdr_netobj *name, struct nfsd_net *nn)
1489 {
1490         return find_clp_in_name_tree(name, &nn->unconf_name_tree);
1491 }
1492
1493 static void
1494 gen_callback(struct nfs4_client *clp, struct nfsd4_setclientid *se, struct svc_rqst *rqstp)
1495 {
1496         struct nfs4_cb_conn *conn = &clp->cl_cb_conn;
1497         struct sockaddr *sa = svc_addr(rqstp);
1498         u32 scopeid = rpc_get_scope_id(sa);
1499         unsigned short expected_family;
1500
1501         /* Currently, we only support tcp and tcp6 for the callback channel */
1502         if (se->se_callback_netid_len == 3 &&
1503             !memcmp(se->se_callback_netid_val, "tcp", 3))
1504                 expected_family = AF_INET;
1505         else if (se->se_callback_netid_len == 4 &&
1506                  !memcmp(se->se_callback_netid_val, "tcp6", 4))
1507                 expected_family = AF_INET6;
1508         else
1509                 goto out_err;
1510
1511         conn->cb_addrlen = rpc_uaddr2sockaddr(clp->net, se->se_callback_addr_val,
1512                                             se->se_callback_addr_len,
1513                                             (struct sockaddr *)&conn->cb_addr,
1514                                             sizeof(conn->cb_addr));
1515
1516         if (!conn->cb_addrlen || conn->cb_addr.ss_family != expected_family)
1517                 goto out_err;
1518
1519         if (conn->cb_addr.ss_family == AF_INET6)
1520                 ((struct sockaddr_in6 *)&conn->cb_addr)->sin6_scope_id = scopeid;
1521
1522         conn->cb_prog = se->se_callback_prog;
1523         conn->cb_ident = se->se_callback_ident;
1524         memcpy(&conn->cb_saddr, &rqstp->rq_daddr, rqstp->rq_daddrlen);
1525         return;
1526 out_err:
1527         conn->cb_addr.ss_family = AF_UNSPEC;
1528         conn->cb_addrlen = 0;
1529         dprintk(KERN_INFO "NFSD: this client (clientid %08x/%08x) "
1530                 "will not receive delegations\n",
1531                 clp->cl_clientid.cl_boot, clp->cl_clientid.cl_id);
1532
1533         return;
1534 }
1535
1536 /*
1537  * Cache a reply. nfsd4_check_drc_limit() has bounded the cache size.
1538  */
1539 void
1540 nfsd4_store_cache_entry(struct nfsd4_compoundres *resp)
1541 {
1542         struct nfsd4_slot *slot = resp->cstate.slot;
1543         unsigned int base;
1544
1545         dprintk("--> %s slot %p\n", __func__, slot);
1546
1547         slot->sl_opcnt = resp->opcnt;
1548         slot->sl_status = resp->cstate.status;
1549
1550         slot->sl_flags |= NFSD4_SLOT_INITIALIZED;
1551         if (nfsd4_not_cached(resp)) {
1552                 slot->sl_datalen = 0;
1553                 return;
1554         }
1555         slot->sl_datalen = (char *)resp->p - (char *)resp->cstate.datap;
1556         base = (char *)resp->cstate.datap -
1557                                         (char *)resp->xbuf->head[0].iov_base;
1558         if (read_bytes_from_xdr_buf(resp->xbuf, base, slot->sl_data,
1559                                     slot->sl_datalen))
1560                 WARN("%s: sessions DRC could not cache compound\n", __func__);
1561         return;
1562 }
1563
1564 /*
1565  * Encode the replay sequence operation from the slot values.
1566  * If cachethis is FALSE encode the uncached rep error on the next
1567  * operation which sets resp->p and increments resp->opcnt for
1568  * nfs4svc_encode_compoundres.
1569  *
1570  */
1571 static __be32
1572 nfsd4_enc_sequence_replay(struct nfsd4_compoundargs *args,
1573                           struct nfsd4_compoundres *resp)
1574 {
1575         struct nfsd4_op *op;
1576         struct nfsd4_slot *slot = resp->cstate.slot;
1577
1578         /* Encode the replayed sequence operation */
1579         op = &args->ops[resp->opcnt - 1];
1580         nfsd4_encode_operation(resp, op);
1581
1582         /* Return nfserr_retry_uncached_rep in next operation. */
1583         if (args->opcnt > 1 && !(slot->sl_flags & NFSD4_SLOT_CACHETHIS)) {
1584                 op = &args->ops[resp->opcnt++];
1585                 op->status = nfserr_retry_uncached_rep;
1586                 nfsd4_encode_operation(resp, op);
1587         }
1588         return op->status;
1589 }
1590
1591 /*
1592  * The sequence operation is not cached because we can use the slot and
1593  * session values.
1594  */
1595 __be32
1596 nfsd4_replay_cache_entry(struct nfsd4_compoundres *resp,
1597                          struct nfsd4_sequence *seq)
1598 {
1599         struct nfsd4_slot *slot = resp->cstate.slot;
1600         __be32 status;
1601
1602         dprintk("--> %s slot %p\n", __func__, slot);
1603
1604         /* Either returns 0 or nfserr_retry_uncached */
1605         status = nfsd4_enc_sequence_replay(resp->rqstp->rq_argp, resp);
1606         if (status == nfserr_retry_uncached_rep)
1607                 return status;
1608
1609         /* The sequence operation has been encoded, cstate->datap set. */
1610         memcpy(resp->cstate.datap, slot->sl_data, slot->sl_datalen);
1611
1612         resp->opcnt = slot->sl_opcnt;
1613         resp->p = resp->cstate.datap + XDR_QUADLEN(slot->sl_datalen);
1614         status = slot->sl_status;
1615
1616         return status;
1617 }
1618
1619 /*
1620  * Set the exchange_id flags returned by the server.
1621  */
1622 static void
1623 nfsd4_set_ex_flags(struct nfs4_client *new, struct nfsd4_exchange_id *clid)
1624 {
1625         /* pNFS is not supported */
1626         new->cl_exchange_flags |= EXCHGID4_FLAG_USE_NON_PNFS;
1627
1628         /* Referrals are supported, Migration is not. */
1629         new->cl_exchange_flags |= EXCHGID4_FLAG_SUPP_MOVED_REFER;
1630
1631         /* set the wire flags to return to client. */
1632         clid->flags = new->cl_exchange_flags;
1633 }
1634
1635 static bool client_has_state(struct nfs4_client *clp)
1636 {
1637         /*
1638          * Note clp->cl_openowners check isn't quite right: there's no
1639          * need to count owners without stateid's.
1640          *
1641          * Also note we should probably be using this in 4.0 case too.
1642          */
1643         return !list_empty(&clp->cl_openowners)
1644                 || !list_empty(&clp->cl_delegations)
1645                 || !list_empty(&clp->cl_sessions);
1646 }
1647
1648 __be32
1649 nfsd4_exchange_id(struct svc_rqst *rqstp,
1650                   struct nfsd4_compound_state *cstate,
1651                   struct nfsd4_exchange_id *exid)
1652 {
1653         struct nfs4_client *unconf, *conf, *new;
1654         __be32 status;
1655         char                    addr_str[INET6_ADDRSTRLEN];
1656         nfs4_verifier           verf = exid->verifier;
1657         struct sockaddr         *sa = svc_addr(rqstp);
1658         bool    update = exid->flags & EXCHGID4_FLAG_UPD_CONFIRMED_REC_A;
1659         struct nfsd_net         *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
1660
1661         rpc_ntop(sa, addr_str, sizeof(addr_str));
1662         dprintk("%s rqstp=%p exid=%p clname.len=%u clname.data=%p "
1663                 "ip_addr=%s flags %x, spa_how %d\n",
1664                 __func__, rqstp, exid, exid->clname.len, exid->clname.data,
1665                 addr_str, exid->flags, exid->spa_how);
1666
1667         if (exid->flags & ~EXCHGID4_FLAG_MASK_A)
1668                 return nfserr_inval;
1669
1670         switch (exid->spa_how) {
1671         case SP4_MACH_CRED:
1672                 if (!svc_rqst_integrity_protected(rqstp))
1673                         return nfserr_inval;
1674         case SP4_NONE:
1675                 break;
1676         default:                                /* checked by xdr code */
1677                 WARN_ON_ONCE(1);
1678         case SP4_SSV:
1679                 return nfserr_encr_alg_unsupp;
1680         }
1681
1682         /* Cases below refer to rfc 5661 section 18.35.4: */
1683         nfs4_lock_state();
1684         conf = find_confirmed_client_by_name(&exid->clname, nn);
1685         if (conf) {
1686                 bool creds_match = same_creds(&conf->cl_cred, &rqstp->rq_cred);
1687                 bool verfs_match = same_verf(&verf, &conf->cl_verifier);
1688
1689                 if (update) {
1690                         if (!clp_used_exchangeid(conf)) { /* buggy client */
1691                                 status = nfserr_inval;
1692                                 goto out;
1693                         }
1694                         if (!mach_creds_match(conf, rqstp)) {
1695                                 status = nfserr_wrong_cred;
1696                                 goto out;
1697                         }
1698                         if (!creds_match) { /* case 9 */
1699                                 status = nfserr_perm;
1700                                 goto out;
1701                         }
1702                         if (!verfs_match) { /* case 8 */
1703                                 status = nfserr_not_same;
1704                                 goto out;
1705                         }
1706                         /* case 6 */
1707                         exid->flags |= EXCHGID4_FLAG_CONFIRMED_R;
1708                         new = conf;
1709                         goto out_copy;
1710                 }
1711                 if (!creds_match) { /* case 3 */
1712                         if (client_has_state(conf)) {
1713                                 status = nfserr_clid_inuse;
1714                                 goto out;
1715                         }
1716                         expire_client(conf);
1717                         goto out_new;
1718                 }
1719                 if (verfs_match) { /* case 2 */
1720                         conf->cl_exchange_flags |= EXCHGID4_FLAG_CONFIRMED_R;
1721                         new = conf;
1722                         goto out_copy;
1723                 }
1724                 /* case 5, client reboot */
1725                 goto out_new;
1726         }
1727
1728         if (update) { /* case 7 */
1729                 status = nfserr_noent;
1730                 goto out;
1731         }
1732
1733         unconf  = find_unconfirmed_client_by_name(&exid->clname, nn);
1734         if (unconf) /* case 4, possible retry or client restart */
1735                 expire_client(unconf);
1736
1737         /* case 1 (normal case) */
1738 out_new:
1739         new = create_client(exid->clname, rqstp, &verf);
1740         if (new == NULL) {
1741                 status = nfserr_jukebox;
1742                 goto out;
1743         }
1744         new->cl_minorversion = cstate->minorversion;
1745         new->cl_mach_cred = (exid->spa_how == SP4_MACH_CRED);
1746
1747         gen_clid(new, nn);
1748         add_to_unconfirmed(new);
1749 out_copy:
1750         exid->clientid.cl_boot = new->cl_clientid.cl_boot;
1751         exid->clientid.cl_id = new->cl_clientid.cl_id;
1752
1753         exid->seqid = new->cl_cs_slot.sl_seqid + 1;
1754         nfsd4_set_ex_flags(new, exid);
1755
1756         dprintk("nfsd4_exchange_id seqid %d flags %x\n",
1757                 new->cl_cs_slot.sl_seqid, new->cl_exchange_flags);
1758         status = nfs_ok;
1759
1760 out:
1761         nfs4_unlock_state();
1762         return status;
1763 }
1764
1765 static __be32
1766 check_slot_seqid(u32 seqid, u32 slot_seqid, int slot_inuse)
1767 {
1768         dprintk("%s enter. seqid %d slot_seqid %d\n", __func__, seqid,
1769                 slot_seqid);
1770
1771         /* The slot is in use, and no response has been sent. */
1772         if (slot_inuse) {
1773                 if (seqid == slot_seqid)
1774                         return nfserr_jukebox;
1775                 else
1776                         return nfserr_seq_misordered;
1777         }
1778         /* Note unsigned 32-bit arithmetic handles wraparound: */
1779         if (likely(seqid == slot_seqid + 1))
1780                 return nfs_ok;
1781         if (seqid == slot_seqid)
1782                 return nfserr_replay_cache;
1783         return nfserr_seq_misordered;
1784 }
1785
1786 /*
1787  * Cache the create session result into the create session single DRC
1788  * slot cache by saving the xdr structure. sl_seqid has been set.
1789  * Do this for solo or embedded create session operations.
1790  */
1791 static void
1792 nfsd4_cache_create_session(struct nfsd4_create_session *cr_ses,
1793                            struct nfsd4_clid_slot *slot, __be32 nfserr)
1794 {
1795         slot->sl_status = nfserr;
1796         memcpy(&slot->sl_cr_ses, cr_ses, sizeof(*cr_ses));
1797 }
1798
1799 static __be32
1800 nfsd4_replay_create_session(struct nfsd4_create_session *cr_ses,
1801                             struct nfsd4_clid_slot *slot)
1802 {
1803         memcpy(cr_ses, &slot->sl_cr_ses, sizeof(*cr_ses));
1804         return slot->sl_status;
1805 }
1806
1807 #define NFSD_MIN_REQ_HDR_SEQ_SZ ((\
1808                         2 * 2 + /* credential,verifier: AUTH_NULL, length 0 */ \
1809                         1 +     /* MIN tag is length with zero, only length */ \
1810                         3 +     /* version, opcount, opcode */ \
1811                         XDR_QUADLEN(NFS4_MAX_SESSIONID_LEN) + \
1812                                 /* seqid, slotID, slotID, cache */ \
1813                         4 ) * sizeof(__be32))
1814
1815 #define NFSD_MIN_RESP_HDR_SEQ_SZ ((\
1816                         2 +     /* verifier: AUTH_NULL, length 0 */\
1817                         1 +     /* status */ \
1818                         1 +     /* MIN tag is length with zero, only length */ \
1819                         3 +     /* opcount, opcode, opstatus*/ \
1820                         XDR_QUADLEN(NFS4_MAX_SESSIONID_LEN) + \
1821                                 /* seqid, slotID, slotID, slotID, status */ \
1822                         5 ) * sizeof(__be32))
1823
1824 static __be32 check_forechannel_attrs(struct nfsd4_channel_attrs *ca, struct nfsd_net *nn)
1825 {
1826         u32 maxrpc = nn->nfsd_serv->sv_max_mesg;
1827
1828         if (ca->maxreq_sz < NFSD_MIN_REQ_HDR_SEQ_SZ)
1829                 return nfserr_toosmall;
1830         if (ca->maxresp_sz < NFSD_MIN_RESP_HDR_SEQ_SZ)
1831                 return nfserr_toosmall;
1832         ca->headerpadsz = 0;
1833         ca->maxreq_sz = min_t(u32, ca->maxreq_sz, maxrpc);
1834         ca->maxresp_sz = min_t(u32, ca->maxresp_sz, maxrpc);
1835         ca->maxops = min_t(u32, ca->maxops, NFSD_MAX_OPS_PER_COMPOUND);
1836         ca->maxresp_cached = min_t(u32, ca->maxresp_cached,
1837                         NFSD_SLOT_CACHE_SIZE + NFSD_MIN_HDR_SEQ_SZ);
1838         ca->maxreqs = min_t(u32, ca->maxreqs, NFSD_MAX_SLOTS_PER_SESSION);
1839         /*
1840          * Note decreasing slot size below client's request may make it
1841          * difficult for client to function correctly, whereas
1842          * decreasing the number of slots will (just?) affect
1843          * performance.  When short on memory we therefore prefer to
1844          * decrease number of slots instead of their size.  Clients that
1845          * request larger slots than they need will get poor results:
1846          */
1847         ca->maxreqs = nfsd4_get_drc_mem(ca);
1848         if (!ca->maxreqs)
1849                 return nfserr_jukebox;
1850
1851         return nfs_ok;
1852 }
1853
1854 static __be32 check_backchannel_attrs(struct nfsd4_channel_attrs *ca)
1855 {
1856         ca->headerpadsz = 0;
1857
1858         /*
1859          * These RPC_MAX_HEADER macros are overkill, especially since we
1860          * don't even do gss on the backchannel yet.  But this is still
1861          * less than 1k.  Tighten up this estimate in the unlikely event
1862          * it turns out to be a problem for some client:
1863          */
1864         if (ca->maxreq_sz < NFS4_enc_cb_recall_sz + RPC_MAX_HEADER_WITH_AUTH)
1865                 return nfserr_toosmall;
1866         if (ca->maxresp_sz < NFS4_dec_cb_recall_sz + RPC_MAX_REPHEADER_WITH_AUTH)
1867                 return nfserr_toosmall;
1868         ca->maxresp_cached = 0;
1869         if (ca->maxops < 2)
1870                 return nfserr_toosmall;
1871
1872         return nfs_ok;
1873 }
1874
1875 static __be32 nfsd4_check_cb_sec(struct nfsd4_cb_sec *cbs)
1876 {
1877         switch (cbs->flavor) {
1878         case RPC_AUTH_NULL:
1879         case RPC_AUTH_UNIX:
1880                 return nfs_ok;
1881         default:
1882                 /*
1883                  * GSS case: the spec doesn't allow us to return this
1884                  * error.  But it also doesn't allow us not to support
1885                  * GSS.
1886                  * I'd rather this fail hard than return some error the
1887                  * client might think it can already handle:
1888                  */
1889                 return nfserr_encr_alg_unsupp;
1890         }
1891 }
1892
1893 __be32
1894 nfsd4_create_session(struct svc_rqst *rqstp,
1895                      struct nfsd4_compound_state *cstate,
1896                      struct nfsd4_create_session *cr_ses)
1897 {
1898         struct sockaddr *sa = svc_addr(rqstp);
1899         struct nfs4_client *conf, *unconf;
1900         struct nfsd4_session *new;
1901         struct nfsd4_conn *conn;
1902         struct nfsd4_clid_slot *cs_slot = NULL;
1903         __be32 status = 0;
1904         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
1905
1906         if (cr_ses->flags & ~SESSION4_FLAG_MASK_A)
1907                 return nfserr_inval;
1908         status = nfsd4_check_cb_sec(&cr_ses->cb_sec);
1909         if (status)
1910                 return status;
1911         status = check_forechannel_attrs(&cr_ses->fore_channel, nn);
1912         if (status)
1913                 return status;
1914         status = check_backchannel_attrs(&cr_ses->back_channel);
1915         if (status)
1916                 return status;
1917         status = nfserr_jukebox;
1918         new = alloc_session(&cr_ses->fore_channel);
1919         if (!new)
1920                 goto out_release_drc_mem;
1921         conn = alloc_conn_from_crses(rqstp, cr_ses);
1922         if (!conn)
1923                 goto out_free_session;
1924
1925         nfs4_lock_state();
1926         unconf = find_unconfirmed_client(&cr_ses->clientid, true, nn);
1927         conf = find_confirmed_client(&cr_ses->clientid, true, nn);
1928         WARN_ON_ONCE(conf && unconf);
1929
1930         if (conf) {
1931                 status = nfserr_wrong_cred;
1932                 if (!mach_creds_match(conf, rqstp))
1933                         goto out_free_conn;
1934                 cs_slot = &conf->cl_cs_slot;
1935                 status = check_slot_seqid(cr_ses->seqid, cs_slot->sl_seqid, 0);
1936                 if (status == nfserr_replay_cache) {
1937                         status = nfsd4_replay_create_session(cr_ses, cs_slot);
1938                         goto out_free_conn;
1939                 } else if (cr_ses->seqid != cs_slot->sl_seqid + 1) {
1940                         status = nfserr_seq_misordered;
1941                         goto out_free_conn;
1942                 }
1943         } else if (unconf) {
1944                 struct nfs4_client *old;
1945                 if (!same_creds(&unconf->cl_cred, &rqstp->rq_cred) ||
1946                     !rpc_cmp_addr(sa, (struct sockaddr *) &unconf->cl_addr)) {
1947                         status = nfserr_clid_inuse;
1948                         goto out_free_conn;
1949                 }
1950                 status = nfserr_wrong_cred;
1951                 if (!mach_creds_match(unconf, rqstp))
1952                         goto out_free_conn;
1953                 cs_slot = &unconf->cl_cs_slot;
1954                 status = check_slot_seqid(cr_ses->seqid, cs_slot->sl_seqid, 0);
1955                 if (status) {
1956                         /* an unconfirmed replay returns misordered */
1957                         status = nfserr_seq_misordered;
1958                         goto out_free_conn;
1959                 }
1960                 old = find_confirmed_client_by_name(&unconf->cl_name, nn);
1961                 if (old) {
1962                         status = mark_client_expired(old);
1963                         if (status)
1964                                 goto out_free_conn;
1965                         expire_client(old);
1966                 }
1967                 move_to_confirmed(unconf);
1968                 conf = unconf;
1969         } else {
1970                 status = nfserr_stale_clientid;
1971                 goto out_free_conn;
1972         }
1973         status = nfs_ok;
1974         /*
1975          * We do not support RDMA or persistent sessions
1976          */
1977         cr_ses->flags &= ~SESSION4_PERSIST;
1978         cr_ses->flags &= ~SESSION4_RDMA;
1979
1980         init_session(rqstp, new, conf, cr_ses);
1981         nfsd4_init_conn(rqstp, conn, new);
1982
1983         memcpy(cr_ses->sessionid.data, new->se_sessionid.data,
1984                NFS4_MAX_SESSIONID_LEN);
1985         cs_slot->sl_seqid++;
1986         cr_ses->seqid = cs_slot->sl_seqid;
1987
1988         /* cache solo and embedded create sessions under the state lock */
1989         nfsd4_cache_create_session(cr_ses, cs_slot, status);
1990         nfs4_unlock_state();
1991         return status;
1992 out_free_conn:
1993         nfs4_unlock_state();
1994         free_conn(conn);
1995 out_free_session:
1996         __free_session(new);
1997 out_release_drc_mem:
1998         nfsd4_put_drc_mem(&cr_ses->fore_channel);
1999         return status;
2000 }
2001
2002 static __be32 nfsd4_map_bcts_dir(u32 *dir)
2003 {
2004         switch (*dir) {
2005         case NFS4_CDFC4_FORE:
2006         case NFS4_CDFC4_BACK:
2007                 return nfs_ok;
2008         case NFS4_CDFC4_FORE_OR_BOTH:
2009         case NFS4_CDFC4_BACK_OR_BOTH:
2010                 *dir = NFS4_CDFC4_BOTH;
2011                 return nfs_ok;
2012         };
2013         return nfserr_inval;
2014 }
2015
2016 __be32 nfsd4_backchannel_ctl(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, struct nfsd4_backchannel_ctl *bc)
2017 {
2018         struct nfsd4_session *session = cstate->session;
2019         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
2020         __be32 status;
2021
2022         status = nfsd4_check_cb_sec(&bc->bc_cb_sec);
2023         if (status)
2024                 return status;
2025         spin_lock(&nn->client_lock);
2026         session->se_cb_prog = bc->bc_cb_program;
2027         session->se_cb_sec = bc->bc_cb_sec;
2028         spin_unlock(&nn->client_lock);
2029
2030         nfsd4_probe_callback(session->se_client);
2031
2032         return nfs_ok;
2033 }
2034
2035 __be32 nfsd4_bind_conn_to_session(struct svc_rqst *rqstp,
2036                      struct nfsd4_compound_state *cstate,
2037                      struct nfsd4_bind_conn_to_session *bcts)
2038 {
2039         __be32 status;
2040         struct nfsd4_conn *conn;
2041         struct nfsd4_session *session;
2042         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
2043
2044         if (!nfsd4_last_compound_op(rqstp))
2045                 return nfserr_not_only_op;
2046         nfs4_lock_state();
2047         spin_lock(&nn->client_lock);
2048         session = find_in_sessionid_hashtbl(&bcts->sessionid, SVC_NET(rqstp));
2049         spin_unlock(&nn->client_lock);
2050         status = nfserr_badsession;
2051         if (!session)
2052                 goto out;
2053         status = nfserr_wrong_cred;
2054         if (!mach_creds_match(session->se_client, rqstp))
2055                 goto out;
2056         status = nfsd4_map_bcts_dir(&bcts->dir);
2057         if (status)
2058                 goto out;
2059         conn = alloc_conn(rqstp, bcts->dir);
2060         status = nfserr_jukebox;
2061         if (!conn)
2062                 goto out;
2063         nfsd4_init_conn(rqstp, conn, session);
2064         status = nfs_ok;
2065 out:
2066         nfs4_unlock_state();
2067         return status;
2068 }
2069
2070 static bool nfsd4_compound_in_session(struct nfsd4_session *session, struct nfs4_sessionid *sid)
2071 {
2072         if (!session)
2073                 return 0;
2074         return !memcmp(sid, &session->se_sessionid, sizeof(*sid));
2075 }
2076
2077 __be32
2078 nfsd4_destroy_session(struct svc_rqst *r,
2079                       struct nfsd4_compound_state *cstate,
2080                       struct nfsd4_destroy_session *sessionid)
2081 {
2082         struct nfsd4_session *ses;
2083         __be32 status;
2084         int ref_held_by_me = 0;
2085         struct nfsd_net *nn = net_generic(SVC_NET(r), nfsd_net_id);
2086
2087         nfs4_lock_state();
2088         status = nfserr_not_only_op;
2089         if (nfsd4_compound_in_session(cstate->session, &sessionid->sessionid)) {
2090                 if (!nfsd4_last_compound_op(r))
2091                         goto out;
2092                 ref_held_by_me++;
2093         }
2094         dump_sessionid(__func__, &sessionid->sessionid);
2095         spin_lock(&nn->client_lock);
2096         ses = find_in_sessionid_hashtbl(&sessionid->sessionid, SVC_NET(r));
2097         status = nfserr_badsession;
2098         if (!ses)
2099                 goto out_client_lock;
2100         status = nfserr_wrong_cred;
2101         if (!mach_creds_match(ses->se_client, r))
2102                 goto out_client_lock;
2103         nfsd4_get_session_locked(ses);
2104         status = mark_session_dead_locked(ses, 1 + ref_held_by_me);
2105         if (status)
2106                 goto out_put_session;
2107         unhash_session(ses);
2108         spin_unlock(&nn->client_lock);
2109
2110         nfsd4_probe_callback_sync(ses->se_client);
2111
2112         spin_lock(&nn->client_lock);
2113         status = nfs_ok;
2114 out_put_session:
2115         nfsd4_put_session(ses);
2116 out_client_lock:
2117         spin_unlock(&nn->client_lock);
2118 out:
2119         nfs4_unlock_state();
2120         return status;
2121 }
2122
2123 static struct nfsd4_conn *__nfsd4_find_conn(struct svc_xprt *xpt, struct nfsd4_session *s)
2124 {
2125         struct nfsd4_conn *c;
2126
2127         list_for_each_entry(c, &s->se_conns, cn_persession) {
2128                 if (c->cn_xprt == xpt) {
2129                         return c;
2130                 }
2131         }
2132         return NULL;
2133 }
2134
2135 static __be32 nfsd4_sequence_check_conn(struct nfsd4_conn *new, struct nfsd4_session *ses)
2136 {
2137         struct nfs4_client *clp = ses->se_client;
2138         struct nfsd4_conn *c;
2139         __be32 status = nfs_ok;
2140         int ret;
2141
2142         spin_lock(&clp->cl_lock);
2143         c = __nfsd4_find_conn(new->cn_xprt, ses);
2144         if (c)
2145                 goto out_free;
2146         status = nfserr_conn_not_bound_to_session;
2147         if (clp->cl_mach_cred)
2148                 goto out_free;
2149         __nfsd4_hash_conn(new, ses);
2150         spin_unlock(&clp->cl_lock);
2151         ret = nfsd4_register_conn(new);
2152         if (ret)
2153                 /* oops; xprt is already down: */
2154                 nfsd4_conn_lost(&new->cn_xpt_user);
2155         return nfs_ok;
2156 out_free:
2157         spin_unlock(&clp->cl_lock);
2158         free_conn(new);
2159         return status;
2160 }
2161
2162 static bool nfsd4_session_too_many_ops(struct svc_rqst *rqstp, struct nfsd4_session *session)
2163 {
2164         struct nfsd4_compoundargs *args = rqstp->rq_argp;
2165
2166         return args->opcnt > session->se_fchannel.maxops;
2167 }
2168
2169 static bool nfsd4_request_too_big(struct svc_rqst *rqstp,
2170                                   struct nfsd4_session *session)
2171 {
2172         struct xdr_buf *xb = &rqstp->rq_arg;
2173
2174         return xb->len > session->se_fchannel.maxreq_sz;
2175 }
2176
2177 __be32
2178 nfsd4_sequence(struct svc_rqst *rqstp,
2179                struct nfsd4_compound_state *cstate,
2180                struct nfsd4_sequence *seq)
2181 {
2182         struct nfsd4_compoundres *resp = rqstp->rq_resp;
2183         struct nfsd4_session *session;
2184         struct nfs4_client *clp;
2185         struct nfsd4_slot *slot;
2186         struct nfsd4_conn *conn;
2187         __be32 status;
2188         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
2189
2190         if (resp->opcnt != 1)
2191                 return nfserr_sequence_pos;
2192
2193         /*
2194          * Will be either used or freed by nfsd4_sequence_check_conn
2195          * below.
2196          */
2197         conn = alloc_conn(rqstp, NFS4_CDFC4_FORE);
2198         if (!conn)
2199                 return nfserr_jukebox;
2200
2201         spin_lock(&nn->client_lock);
2202         status = nfserr_badsession;
2203         session = find_in_sessionid_hashtbl(&seq->sessionid, SVC_NET(rqstp));
2204         if (!session)
2205                 goto out_no_session;
2206         clp = session->se_client;
2207         status = get_client_locked(clp);
2208         if (status)
2209                 goto out_no_session;
2210         status = nfsd4_get_session_locked(session);
2211         if (status)
2212                 goto out_put_client;
2213
2214         status = nfserr_too_many_ops;
2215         if (nfsd4_session_too_many_ops(rqstp, session))
2216                 goto out_put_session;
2217
2218         status = nfserr_req_too_big;
2219         if (nfsd4_request_too_big(rqstp, session))
2220                 goto out_put_session;
2221
2222         status = nfserr_badslot;
2223         if (seq->slotid >= session->se_fchannel.maxreqs)
2224                 goto out_put_session;
2225
2226         slot = session->se_slots[seq->slotid];
2227         dprintk("%s: slotid %d\n", __func__, seq->slotid);
2228
2229         /* We do not negotiate the number of slots yet, so set the
2230          * maxslots to the session maxreqs which is used to encode
2231          * sr_highest_slotid and the sr_target_slot id to maxslots */
2232         seq->maxslots = session->se_fchannel.maxreqs;
2233
2234         status = check_slot_seqid(seq->seqid, slot->sl_seqid,
2235                                         slot->sl_flags & NFSD4_SLOT_INUSE);
2236         if (status == nfserr_replay_cache) {
2237                 status = nfserr_seq_misordered;
2238                 if (!(slot->sl_flags & NFSD4_SLOT_INITIALIZED))
2239                         goto out_put_session;
2240                 cstate->slot = slot;
2241                 cstate->session = session;
2242                 /* Return the cached reply status and set cstate->status
2243                  * for nfsd4_proc_compound processing */
2244                 status = nfsd4_replay_cache_entry(resp, seq);
2245                 cstate->status = nfserr_replay_cache;
2246                 goto out;
2247         }
2248         if (status)
2249                 goto out_put_session;
2250
2251         status = nfsd4_sequence_check_conn(conn, session);
2252         conn = NULL;
2253         if (status)
2254                 goto out_put_session;
2255
2256         /* Success! bump slot seqid */
2257         slot->sl_seqid = seq->seqid;
2258         slot->sl_flags |= NFSD4_SLOT_INUSE;
2259         if (seq->cachethis)
2260                 slot->sl_flags |= NFSD4_SLOT_CACHETHIS;
2261         else
2262                 slot->sl_flags &= ~NFSD4_SLOT_CACHETHIS;
2263
2264         cstate->slot = slot;
2265         cstate->session = session;
2266
2267 out:
2268         switch (clp->cl_cb_state) {
2269         case NFSD4_CB_DOWN:
2270                 seq->status_flags = SEQ4_STATUS_CB_PATH_DOWN;
2271                 break;
2272         case NFSD4_CB_FAULT:
2273                 seq->status_flags = SEQ4_STATUS_BACKCHANNEL_FAULT;
2274                 break;
2275         default:
2276                 seq->status_flags = 0;
2277         }
2278         if (!list_empty(&clp->cl_revoked))
2279                 seq->status_flags |= SEQ4_STATUS_RECALLABLE_STATE_REVOKED;
2280 out_no_session:
2281         kfree(conn);
2282         spin_unlock(&nn->client_lock);
2283         return status;
2284 out_put_session:
2285         nfsd4_put_session(session);
2286 out_put_client:
2287         put_client_renew_locked(clp);
2288         goto out_no_session;
2289 }
2290
2291 __be32
2292 nfsd4_destroy_clientid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, struct nfsd4_destroy_clientid *dc)
2293 {
2294         struct nfs4_client *conf, *unconf, *clp;
2295         __be32 status = 0;
2296         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
2297
2298         nfs4_lock_state();
2299         unconf = find_unconfirmed_client(&dc->clientid, true, nn);
2300         conf = find_confirmed_client(&dc->clientid, true, nn);
2301         WARN_ON_ONCE(conf && unconf);
2302
2303         if (conf) {
2304                 clp = conf;
2305
2306                 if (client_has_state(conf)) {
2307                         status = nfserr_clientid_busy;
2308                         goto out;
2309                 }
2310         } else if (unconf)
2311                 clp = unconf;
2312         else {
2313                 status = nfserr_stale_clientid;
2314                 goto out;
2315         }
2316         if (!mach_creds_match(clp, rqstp)) {
2317                 status = nfserr_wrong_cred;
2318                 goto out;
2319         }
2320         expire_client(clp);
2321 out:
2322         nfs4_unlock_state();
2323         return status;
2324 }
2325
2326 __be32
2327 nfsd4_reclaim_complete(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, struct nfsd4_reclaim_complete *rc)
2328 {
2329         __be32 status = 0;
2330
2331         if (rc->rca_one_fs) {
2332                 if (!cstate->current_fh.fh_dentry)
2333                         return nfserr_nofilehandle;
2334                 /*
2335                  * We don't take advantage of the rca_one_fs case.
2336                  * That's OK, it's optional, we can safely ignore it.
2337                  */
2338                  return nfs_ok;
2339         }
2340
2341         nfs4_lock_state();
2342         status = nfserr_complete_already;
2343         if (test_and_set_bit(NFSD4_CLIENT_RECLAIM_COMPLETE,
2344                              &cstate->session->se_client->cl_flags))
2345                 goto out;
2346
2347         status = nfserr_stale_clientid;
2348         if (is_client_expired(cstate->session->se_client))
2349                 /*
2350                  * The following error isn't really legal.
2351                  * But we only get here if the client just explicitly
2352                  * destroyed the client.  Surely it no longer cares what
2353                  * error it gets back on an operation for the dead
2354                  * client.
2355                  */
2356                 goto out;
2357
2358         status = nfs_ok;
2359         nfsd4_client_record_create(cstate->session->se_client);
2360 out:
2361         nfs4_unlock_state();
2362         return status;
2363 }
2364
2365 __be32
2366 nfsd4_setclientid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
2367                   struct nfsd4_setclientid *setclid)
2368 {
2369         struct xdr_netobj       clname = setclid->se_name;
2370         nfs4_verifier           clverifier = setclid->se_verf;
2371         struct nfs4_client      *conf, *unconf, *new;
2372         __be32                  status;
2373         struct nfsd_net         *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
2374
2375         /* Cases below refer to rfc 3530 section 14.2.33: */
2376         nfs4_lock_state();
2377         conf = find_confirmed_client_by_name(&clname, nn);
2378         if (conf) {
2379                 /* case 0: */
2380                 status = nfserr_clid_inuse;
2381                 if (clp_used_exchangeid(conf))
2382                         goto out;
2383                 if (!same_creds(&conf->cl_cred, &rqstp->rq_cred)) {
2384                         char addr_str[INET6_ADDRSTRLEN];
2385                         rpc_ntop((struct sockaddr *) &conf->cl_addr, addr_str,
2386                                  sizeof(addr_str));
2387                         dprintk("NFSD: setclientid: string in use by client "
2388                                 "at %s\n", addr_str);
2389                         goto out;
2390                 }
2391         }
2392         unconf = find_unconfirmed_client_by_name(&clname, nn);
2393         if (unconf)
2394                 expire_client(unconf);
2395         status = nfserr_jukebox;
2396         new = create_client(clname, rqstp, &clverifier);
2397         if (new == NULL)
2398                 goto out;
2399         if (conf && same_verf(&conf->cl_verifier, &clverifier))
2400                 /* case 1: probable callback update */
2401                 copy_clid(new, conf);
2402         else /* case 4 (new client) or cases 2, 3 (client reboot): */
2403                 gen_clid(new, nn);
2404         new->cl_minorversion = 0;
2405         gen_callback(new, setclid, rqstp);
2406         add_to_unconfirmed(new);
2407         setclid->se_clientid.cl_boot = new->cl_clientid.cl_boot;
2408         setclid->se_clientid.cl_id = new->cl_clientid.cl_id;
2409         memcpy(setclid->se_confirm.data, new->cl_confirm.data, sizeof(setclid->se_confirm.data));
2410         status = nfs_ok;
2411 out:
2412         nfs4_unlock_state();
2413         return status;
2414 }
2415
2416
2417 __be32
2418 nfsd4_setclientid_confirm(struct svc_rqst *rqstp,
2419                          struct nfsd4_compound_state *cstate,
2420                          struct nfsd4_setclientid_confirm *setclientid_confirm)
2421 {
2422         struct nfs4_client *conf, *unconf;
2423         nfs4_verifier confirm = setclientid_confirm->sc_confirm;
2424         clientid_t * clid = &setclientid_confirm->sc_clientid;
2425         __be32 status;
2426         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
2427
2428         if (STALE_CLIENTID(clid, nn))
2429                 return nfserr_stale_clientid;
2430         nfs4_lock_state();
2431
2432         conf = find_confirmed_client(clid, false, nn);
2433         unconf = find_unconfirmed_client(clid, false, nn);
2434         /*
2435          * We try hard to give out unique clientid's, so if we get an
2436          * attempt to confirm the same clientid with a different cred,
2437          * there's a bug somewhere.  Let's charitably assume it's our
2438          * bug.
2439          */
2440         status = nfserr_serverfault;
2441         if (unconf && !same_creds(&unconf->cl_cred, &rqstp->rq_cred))
2442                 goto out;
2443         if (conf && !same_creds(&conf->cl_cred, &rqstp->rq_cred))
2444                 goto out;
2445         /* cases below refer to rfc 3530 section 14.2.34: */
2446         if (!unconf || !same_verf(&confirm, &unconf->cl_confirm)) {
2447                 if (conf && !unconf) /* case 2: probable retransmit */
2448                         status = nfs_ok;
2449                 else /* case 4: client hasn't noticed we rebooted yet? */
2450                         status = nfserr_stale_clientid;
2451                 goto out;
2452         }
2453         status = nfs_ok;
2454         if (conf) { /* case 1: callback update */
2455                 nfsd4_change_callback(conf, &unconf->cl_cb_conn);
2456                 nfsd4_probe_callback(conf);
2457                 expire_client(unconf);
2458         } else { /* case 3: normal case; new or rebooted client */
2459                 conf = find_confirmed_client_by_name(&unconf->cl_name, nn);
2460                 if (conf) {
2461                         status = mark_client_expired(conf);
2462                         if (status)
2463                                 goto out;
2464                         expire_client(conf);
2465                 }
2466                 move_to_confirmed(unconf);
2467                 nfsd4_probe_callback(unconf);
2468         }
2469 out:
2470         nfs4_unlock_state();
2471         return status;
2472 }
2473
2474 static struct nfs4_file *nfsd4_alloc_file(void)
2475 {
2476         return kmem_cache_alloc(file_slab, GFP_KERNEL);
2477 }
2478
2479 /* OPEN Share state helper functions */
2480 static void nfsd4_init_file(struct nfs4_file *fp, struct inode *ino)
2481 {
2482         unsigned int hashval = file_hashval(ino);
2483
2484         atomic_set(&fp->fi_ref, 1);
2485         INIT_LIST_HEAD(&fp->fi_stateids);
2486         INIT_LIST_HEAD(&fp->fi_delegations);
2487         fp->fi_inode = igrab(ino);
2488         fp->fi_had_conflict = false;
2489         fp->fi_lease = NULL;
2490         memset(fp->fi_fds, 0, sizeof(fp->fi_fds));
2491         memset(fp->fi_access, 0, sizeof(fp->fi_access));
2492         spin_lock(&recall_lock);
2493         hlist_add_head(&fp->fi_hash, &file_hashtbl[hashval]);
2494         spin_unlock(&recall_lock);
2495 }
2496
2497 static void
2498 nfsd4_free_slab(struct kmem_cache **slab)
2499 {
2500         if (*slab == NULL)
2501                 return;
2502         kmem_cache_destroy(*slab);
2503         *slab = NULL;
2504 }
2505
2506 void
2507 nfsd4_free_slabs(void)
2508 {
2509         nfsd4_free_slab(&openowner_slab);
2510         nfsd4_free_slab(&lockowner_slab);
2511         nfsd4_free_slab(&file_slab);
2512         nfsd4_free_slab(&stateid_slab);
2513         nfsd4_free_slab(&deleg_slab);
2514 }
2515
2516 int
2517 nfsd4_init_slabs(void)
2518 {
2519         openowner_slab = kmem_cache_create("nfsd4_openowners",
2520                         sizeof(struct nfs4_openowner), 0, 0, NULL);
2521         if (openowner_slab == NULL)
2522                 goto out_nomem;
2523         lockowner_slab = kmem_cache_create("nfsd4_lockowners",
2524                         sizeof(struct nfs4_lockowner), 0, 0, NULL);
2525         if (lockowner_slab == NULL)
2526                 goto out_nomem;
2527         file_slab = kmem_cache_create("nfsd4_files",
2528                         sizeof(struct nfs4_file), 0, 0, NULL);
2529         if (file_slab == NULL)
2530                 goto out_nomem;
2531         stateid_slab = kmem_cache_create("nfsd4_stateids",
2532                         sizeof(struct nfs4_ol_stateid), 0, 0, NULL);
2533         if (stateid_slab == NULL)
2534                 goto out_nomem;
2535         deleg_slab = kmem_cache_create("nfsd4_delegations",
2536                         sizeof(struct nfs4_delegation), 0, 0, NULL);
2537         if (deleg_slab == NULL)
2538                 goto out_nomem;
2539         return 0;
2540 out_nomem:
2541         nfsd4_free_slabs();
2542         dprintk("nfsd4: out of memory while initializing nfsv4\n");
2543         return -ENOMEM;
2544 }
2545
2546 void nfs4_free_openowner(struct nfs4_openowner *oo)
2547 {
2548         kfree(oo->oo_owner.so_owner.data);
2549         kmem_cache_free(openowner_slab, oo);
2550 }
2551
2552 void nfs4_free_lockowner(struct nfs4_lockowner *lo)
2553 {
2554         kfree(lo->lo_owner.so_owner.data);
2555         kmem_cache_free(lockowner_slab, lo);
2556 }
2557
2558 static void init_nfs4_replay(struct nfs4_replay *rp)
2559 {
2560         rp->rp_status = nfserr_serverfault;
2561         rp->rp_buflen = 0;
2562         rp->rp_buf = rp->rp_ibuf;
2563 }
2564
2565 static inline void *alloc_stateowner(struct kmem_cache *slab, struct xdr_netobj *owner, struct nfs4_client *clp)
2566 {
2567         struct nfs4_stateowner *sop;
2568
2569         sop = kmem_cache_alloc(slab, GFP_KERNEL);
2570         if (!sop)
2571                 return NULL;
2572
2573         sop->so_owner.data = kmemdup(owner->data, owner->len, GFP_KERNEL);
2574         if (!sop->so_owner.data) {
2575                 kmem_cache_free(slab, sop);
2576                 return NULL;
2577         }
2578         sop->so_owner.len = owner->len;
2579
2580         INIT_LIST_HEAD(&sop->so_stateids);
2581         sop->so_client = clp;
2582         init_nfs4_replay(&sop->so_replay);
2583         return sop;
2584 }
2585
2586 static void hash_openowner(struct nfs4_openowner *oo, struct nfs4_client *clp, unsigned int strhashval)
2587 {
2588         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
2589
2590         list_add(&oo->oo_owner.so_strhash, &nn->ownerstr_hashtbl[strhashval]);
2591         list_add(&oo->oo_perclient, &clp->cl_openowners);
2592 }
2593
2594 static struct nfs4_openowner *
2595 alloc_init_open_stateowner(unsigned int strhashval, struct nfs4_client *clp, struct nfsd4_open *open) {
2596         struct nfs4_openowner *oo;
2597
2598         oo = alloc_stateowner(openowner_slab, &open->op_owner, clp);
2599         if (!oo)
2600                 return NULL;
2601         oo->oo_owner.so_is_open_owner = 1;
2602         oo->oo_owner.so_seqid = open->op_seqid;
2603         oo->oo_flags = NFS4_OO_NEW;
2604         oo->oo_time = 0;
2605         oo->oo_last_closed_stid = NULL;
2606         INIT_LIST_HEAD(&oo->oo_close_lru);
2607         hash_openowner(oo, clp, strhashval);
2608         return oo;
2609 }
2610
2611 static void init_open_stateid(struct nfs4_ol_stateid *stp, struct nfs4_file *fp, struct nfsd4_open *open) {
2612         struct nfs4_openowner *oo = open->op_openowner;
2613
2614         stp->st_stid.sc_type = NFS4_OPEN_STID;
2615         INIT_LIST_HEAD(&stp->st_lockowners);
2616         list_add(&stp->st_perstateowner, &oo->oo_owner.so_stateids);
2617         list_add(&stp->st_perfile, &fp->fi_stateids);
2618         stp->st_stateowner = &oo->oo_owner;
2619         get_nfs4_file(fp);
2620         stp->st_file = fp;
2621         stp->st_access_bmap = 0;
2622         stp->st_deny_bmap = 0;
2623         set_access(open->op_share_access, stp);
2624         set_deny(open->op_share_deny, stp);
2625         stp->st_openstp = NULL;
2626 }
2627
2628 static void
2629 move_to_close_lru(struct nfs4_openowner *oo, struct net *net)
2630 {
2631         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
2632
2633         dprintk("NFSD: move_to_close_lru nfs4_openowner %p\n", oo);
2634
2635         list_move_tail(&oo->oo_close_lru, &nn->close_lru);
2636         oo->oo_time = get_seconds();
2637 }
2638
2639 static int
2640 same_owner_str(struct nfs4_stateowner *sop, struct xdr_netobj *owner,
2641                                                         clientid_t *clid)
2642 {
2643         return (sop->so_owner.len == owner->len) &&
2644                 0 == memcmp(sop->so_owner.data, owner->data, owner->len) &&
2645                 (sop->so_client->cl_clientid.cl_id == clid->cl_id);
2646 }
2647
2648 static struct nfs4_openowner *
2649 find_openstateowner_str(unsigned int hashval, struct nfsd4_open *open,
2650                         bool sessions, struct nfsd_net *nn)
2651 {
2652         struct nfs4_stateowner *so;
2653         struct nfs4_openowner *oo;
2654         struct nfs4_client *clp;
2655
2656         list_for_each_entry(so, &nn->ownerstr_hashtbl[hashval], so_strhash) {
2657                 if (!so->so_is_open_owner)
2658                         continue;
2659                 if (same_owner_str(so, &open->op_owner, &open->op_clientid)) {
2660                         oo = openowner(so);
2661                         clp = oo->oo_owner.so_client;
2662                         if ((bool)clp->cl_minorversion != sessions)
2663                                 return NULL;
2664                         renew_client(oo->oo_owner.so_client);
2665                         return oo;
2666                 }
2667         }
2668         return NULL;
2669 }
2670
2671 /* search file_hashtbl[] for file */
2672 static struct nfs4_file *
2673 find_file(struct inode *ino)
2674 {
2675         unsigned int hashval = file_hashval(ino);
2676         struct nfs4_file *fp;
2677
2678         spin_lock(&recall_lock);
2679         hlist_for_each_entry(fp, &file_hashtbl[hashval], fi_hash) {
2680                 if (fp->fi_inode == ino) {
2681                         get_nfs4_file(fp);
2682                         spin_unlock(&recall_lock);
2683                         return fp;
2684                 }
2685         }
2686         spin_unlock(&recall_lock);
2687         return NULL;
2688 }
2689
2690 /*
2691  * Called to check deny when READ with all zero stateid or
2692  * WRITE with all zero or all one stateid
2693  */
2694 static __be32
2695 nfs4_share_conflict(struct svc_fh *current_fh, unsigned int deny_type)
2696 {
2697         struct inode *ino = current_fh->fh_dentry->d_inode;
2698         struct nfs4_file *fp;
2699         struct nfs4_ol_stateid *stp;
2700         __be32 ret;
2701
2702         fp = find_file(ino);
2703         if (!fp)
2704                 return nfs_ok;
2705         ret = nfserr_locked;
2706         /* Search for conflicting share reservations */
2707         list_for_each_entry(stp, &fp->fi_stateids, st_perfile) {
2708                 if (test_deny(deny_type, stp) ||
2709                     test_deny(NFS4_SHARE_DENY_BOTH, stp))
2710                         goto out;
2711         }
2712         ret = nfs_ok;
2713 out:
2714         put_nfs4_file(fp);
2715         return ret;
2716 }
2717
2718 static void nfsd_break_one_deleg(struct nfs4_delegation *dp)
2719 {
2720         struct nfs4_client *clp = dp->dl_stid.sc_client;
2721         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
2722
2723         /* We're assuming the state code never drops its reference
2724          * without first removing the lease.  Since we're in this lease
2725          * callback (and since the lease code is serialized by the kernel
2726          * lock) we know the server hasn't removed the lease yet, we know
2727          * it's safe to take a reference: */
2728         atomic_inc(&dp->dl_count);
2729
2730         list_add_tail(&dp->dl_recall_lru, &nn->del_recall_lru);
2731
2732         /* Only place dl_time is set; protected by i_lock: */
2733         dp->dl_time = get_seconds();
2734
2735         nfsd4_cb_recall(dp);
2736 }
2737
2738 /* Called from break_lease() with i_lock held. */
2739 static void nfsd_break_deleg_cb(struct file_lock *fl)
2740 {
2741         struct nfs4_file *fp = (struct nfs4_file *)fl->fl_owner;
2742         struct nfs4_delegation *dp;
2743
2744         if (!fp) {
2745                 WARN(1, "(%p)->fl_owner NULL\n", fl);
2746                 return;
2747         }
2748         if (fp->fi_had_conflict) {
2749                 WARN(1, "duplicate break on %p\n", fp);
2750                 return;
2751         }
2752         /*
2753          * We don't want the locks code to timeout the lease for us;
2754          * we'll remove it ourself if a delegation isn't returned
2755          * in time:
2756          */
2757         fl->fl_break_time = 0;
2758
2759         spin_lock(&recall_lock);
2760         fp->fi_had_conflict = true;
2761         list_for_each_entry(dp, &fp->fi_delegations, dl_perfile)
2762                 nfsd_break_one_deleg(dp);
2763         spin_unlock(&recall_lock);
2764 }
2765
2766 static
2767 int nfsd_change_deleg_cb(struct file_lock **onlist, int arg)
2768 {
2769         if (arg & F_UNLCK)
2770                 return lease_modify(onlist, arg);
2771         else
2772                 return -EAGAIN;
2773 }
2774
2775 static const struct lock_manager_operations nfsd_lease_mng_ops = {
2776         .lm_break = nfsd_break_deleg_cb,
2777         .lm_change = nfsd_change_deleg_cb,
2778 };
2779
2780 static __be32 nfsd4_check_seqid(struct nfsd4_compound_state *cstate, struct nfs4_stateowner *so, u32 seqid)
2781 {
2782         if (nfsd4_has_session(cstate))
2783                 return nfs_ok;
2784         if (seqid == so->so_seqid - 1)
2785                 return nfserr_replay_me;
2786         if (seqid == so->so_seqid)
2787                 return nfs_ok;
2788         return nfserr_bad_seqid;
2789 }
2790
2791 __be32
2792 nfsd4_process_open1(struct nfsd4_compound_state *cstate,
2793                     struct nfsd4_open *open, struct nfsd_net *nn)
2794 {
2795         clientid_t *clientid = &open->op_clientid;
2796         struct nfs4_client *clp = NULL;
2797         unsigned int strhashval;
2798         struct nfs4_openowner *oo = NULL;
2799         __be32 status;
2800
2801         if (STALE_CLIENTID(&open->op_clientid, nn))
2802                 return nfserr_stale_clientid;
2803         /*
2804          * In case we need it later, after we've already created the
2805          * file and don't want to risk a further failure:
2806          */
2807         open->op_file = nfsd4_alloc_file();
2808         if (open->op_file == NULL)
2809                 return nfserr_jukebox;
2810
2811         strhashval = ownerstr_hashval(clientid->cl_id, &open->op_owner);
2812         oo = find_openstateowner_str(strhashval, open, cstate->minorversion, nn);
2813         open->op_openowner = oo;
2814         if (!oo) {
2815                 clp = find_confirmed_client(clientid, cstate->minorversion,
2816                                             nn);
2817                 if (clp == NULL)
2818                         return nfserr_expired;
2819                 goto new_owner;
2820         }
2821         if (!(oo->oo_flags & NFS4_OO_CONFIRMED)) {
2822                 /* Replace unconfirmed owners without checking for replay. */
2823                 clp = oo->oo_owner.so_client;
2824                 release_openowner(oo);
2825                 open->op_openowner = NULL;
2826                 goto new_owner;
2827         }
2828         status = nfsd4_check_seqid(cstate, &oo->oo_owner, open->op_seqid);
2829         if (status)
2830                 return status;
2831         clp = oo->oo_owner.so_client;
2832         goto alloc_stateid;
2833 new_owner:
2834         oo = alloc_init_open_stateowner(strhashval, clp, open);
2835         if (oo == NULL)
2836                 return nfserr_jukebox;
2837         open->op_openowner = oo;
2838 alloc_stateid:
2839         open->op_stp = nfs4_alloc_stateid(clp);
2840         if (!open->op_stp)
2841                 return nfserr_jukebox;
2842         return nfs_ok;
2843 }
2844
2845 static inline __be32
2846 nfs4_check_delegmode(struct nfs4_delegation *dp, int flags)
2847 {
2848         if ((flags & WR_STATE) && (dp->dl_type == NFS4_OPEN_DELEGATE_READ))
2849                 return nfserr_openmode;
2850         else
2851                 return nfs_ok;
2852 }
2853
2854 static int share_access_to_flags(u32 share_access)
2855 {
2856         return share_access == NFS4_SHARE_ACCESS_READ ? RD_STATE : WR_STATE;
2857 }
2858
2859 static struct nfs4_delegation *find_deleg_stateid(struct nfs4_client *cl, stateid_t *s)
2860 {
2861         struct nfs4_stid *ret;
2862
2863         ret = find_stateid_by_type(cl, s, NFS4_DELEG_STID);
2864         if (!ret)
2865                 return NULL;
2866         return delegstateid(ret);
2867 }
2868
2869 static bool nfsd4_is_deleg_cur(struct nfsd4_open *open)
2870 {
2871         return open->op_claim_type == NFS4_OPEN_CLAIM_DELEGATE_CUR ||
2872                open->op_claim_type == NFS4_OPEN_CLAIM_DELEG_CUR_FH;
2873 }
2874
2875 static __be32
2876 nfs4_check_deleg(struct nfs4_client *cl, struct nfsd4_open *open,
2877                 struct nfs4_delegation **dp)
2878 {
2879         int flags;
2880         __be32 status = nfserr_bad_stateid;
2881
2882         *dp = find_deleg_stateid(cl, &open->op_delegate_stateid);
2883         if (*dp == NULL)
2884                 goto out;
2885         flags = share_access_to_flags(open->op_share_access);
2886         status = nfs4_check_delegmode(*dp, flags);
2887         if (status)
2888                 *dp = NULL;
2889 out:
2890         if (!nfsd4_is_deleg_cur(open))
2891                 return nfs_ok;
2892         if (status)
2893                 return status;
2894         open->op_openowner->oo_flags |= NFS4_OO_CONFIRMED;
2895         return nfs_ok;
2896 }
2897
2898 static __be32
2899 nfs4_check_open(struct nfs4_file *fp, struct nfsd4_open *open, struct nfs4_ol_stateid **stpp)
2900 {
2901         struct nfs4_ol_stateid *local;
2902         struct nfs4_openowner *oo = open->op_openowner;
2903
2904         list_for_each_entry(local, &fp->fi_stateids, st_perfile) {
2905                 /* ignore lock owners */
2906                 if (local->st_stateowner->so_is_open_owner == 0)
2907                         continue;
2908                 /* remember if we have seen this open owner */
2909                 if (local->st_stateowner == &oo->oo_owner)
2910                         *stpp = local;
2911                 /* check for conflicting share reservations */
2912                 if (!test_share(local, open))
2913                         return nfserr_share_denied;
2914         }
2915         return nfs_ok;
2916 }
2917
2918 static inline int nfs4_access_to_access(u32 nfs4_access)
2919 {
2920         int flags = 0;
2921
2922         if (nfs4_access & NFS4_SHARE_ACCESS_READ)
2923                 flags |= NFSD_MAY_READ;
2924         if (nfs4_access & NFS4_SHARE_ACCESS_WRITE)
2925                 flags |= NFSD_MAY_WRITE;
2926         return flags;
2927 }
2928
2929 static __be32 nfs4_get_vfs_file(struct svc_rqst *rqstp, struct nfs4_file *fp,
2930                 struct svc_fh *cur_fh, struct nfsd4_open *open)
2931 {
2932         __be32 status;
2933         int oflag = nfs4_access_to_omode(open->op_share_access);
2934         int access = nfs4_access_to_access(open->op_share_access);
2935
2936         if (!fp->fi_fds[oflag]) {
2937                 status = nfsd_open(rqstp, cur_fh, S_IFREG, access,
2938                         &fp->fi_fds[oflag]);
2939                 if (status)
2940                         return status;
2941         }
2942         nfs4_file_get_access(fp, oflag);
2943
2944         return nfs_ok;
2945 }
2946
2947 static inline __be32
2948 nfsd4_truncate(struct svc_rqst *rqstp, struct svc_fh *fh,
2949                 struct nfsd4_open *open)
2950 {
2951         struct iattr iattr = {
2952                 .ia_valid = ATTR_SIZE,
2953                 .ia_size = 0,
2954         };
2955         if (!open->op_truncate)
2956                 return 0;
2957         if (!(open->op_share_access & NFS4_SHARE_ACCESS_WRITE))
2958                 return nfserr_inval;
2959         return nfsd_setattr(rqstp, fh, &iattr, 0, (time_t)0);
2960 }
2961
2962 static __be32
2963 nfs4_upgrade_open(struct svc_rqst *rqstp, struct nfs4_file *fp, struct svc_fh *cur_fh, struct nfs4_ol_stateid *stp, struct nfsd4_open *open)
2964 {
2965         u32 op_share_access = open->op_share_access;
2966         bool new_access;
2967         __be32 status;
2968
2969         new_access = !test_access(op_share_access, stp);
2970         if (new_access) {
2971                 status = nfs4_get_vfs_file(rqstp, fp, cur_fh, open);
2972                 if (status)
2973                         return status;
2974         }
2975         status = nfsd4_truncate(rqstp, cur_fh, open);
2976         if (status) {
2977                 if (new_access) {
2978                         int oflag = nfs4_access_to_omode(op_share_access);
2979                         nfs4_file_put_access(fp, oflag);
2980                 }
2981                 return status;
2982         }
2983         /* remember the open */
2984         set_access(op_share_access, stp);
2985         set_deny(open->op_share_deny, stp);
2986
2987         return nfs_ok;
2988 }
2989
2990
2991 static void
2992 nfs4_set_claim_prev(struct nfsd4_open *open, bool has_session)
2993 {
2994         open->op_openowner->oo_flags |= NFS4_OO_CONFIRMED;
2995 }
2996
2997 /* Should we give out recallable state?: */
2998 static bool nfsd4_cb_channel_good(struct nfs4_client *clp)
2999 {
3000         if (clp->cl_cb_state == NFSD4_CB_UP)
3001                 return true;
3002         /*
3003          * In the sessions case, since we don't have to establish a
3004          * separate connection for callbacks, we assume it's OK
3005          * until we hear otherwise:
3006          */
3007         return clp->cl_minorversion && clp->cl_cb_state == NFSD4_CB_UNKNOWN;
3008 }
3009
3010 static struct file_lock *nfs4_alloc_init_lease(struct nfs4_delegation *dp, int flag)
3011 {
3012         struct file_lock *fl;
3013
3014         fl = locks_alloc_lock();
3015         if (!fl)
3016                 return NULL;
3017         locks_init_lock(fl);
3018         fl->fl_lmops = &nfsd_lease_mng_ops;
3019         fl->fl_flags = FL_DELEG;
3020         fl->fl_type = flag == NFS4_OPEN_DELEGATE_READ? F_RDLCK: F_WRLCK;
3021         fl->fl_end = OFFSET_MAX;
3022         fl->fl_owner = (fl_owner_t)(dp->dl_file);
3023         fl->fl_pid = current->tgid;
3024         return fl;
3025 }
3026
3027 static int nfs4_setlease(struct nfs4_delegation *dp)
3028 {
3029         struct nfs4_file *fp = dp->dl_file;
3030         struct file_lock *fl;
3031         int status;
3032
3033         fl = nfs4_alloc_init_lease(dp, NFS4_OPEN_DELEGATE_READ);
3034         if (!fl)
3035                 return -ENOMEM;
3036         fl->fl_file = find_readable_file(fp);
3037         list_add(&dp->dl_perclnt, &dp->dl_stid.sc_client->cl_delegations);
3038         status = vfs_setlease(fl->fl_file, fl->fl_type, &fl);
3039         if (status) {
3040                 list_del_init(&dp->dl_perclnt);
3041                 locks_free_lock(fl);
3042                 return status;
3043         }
3044         fp->fi_lease = fl;
3045         fp->fi_deleg_file = get_file(fl->fl_file);
3046         atomic_set(&fp->fi_delegees, 1);
3047         list_add(&dp->dl_perfile, &fp->fi_delegations);
3048         return 0;
3049 }
3050
3051 static int nfs4_set_delegation(struct nfs4_delegation *dp, struct nfs4_file *fp)
3052 {
3053         int status;
3054
3055         if (fp->fi_had_conflict)
3056                 return -EAGAIN;
3057         get_nfs4_file(fp);
3058         dp->dl_file = fp;
3059         if (!fp->fi_lease) {
3060                 status = nfs4_setlease(dp);
3061                 if (status)
3062                         goto out_free;
3063                 return 0;
3064         }
3065         spin_lock(&recall_lock);
3066         if (fp->fi_had_conflict) {
3067                 spin_unlock(&recall_lock);
3068                 status = -EAGAIN;
3069                 goto out_free;
3070         }
3071         atomic_inc(&fp->fi_delegees);
3072         list_add(&dp->dl_perfile, &fp->fi_delegations);
3073         spin_unlock(&recall_lock);
3074         list_add(&dp->dl_perclnt, &dp->dl_stid.sc_client->cl_delegations);
3075         return 0;
3076 out_free:
3077         put_nfs4_file(fp);
3078         dp->dl_file = fp;
3079         return status;
3080 }
3081
3082 static void nfsd4_open_deleg_none_ext(struct nfsd4_open *open, int status)
3083 {
3084         open->op_delegate_type = NFS4_OPEN_DELEGATE_NONE_EXT;
3085         if (status == -EAGAIN)
3086                 open->op_why_no_deleg = WND4_CONTENTION;
3087         else {
3088                 open->op_why_no_deleg = WND4_RESOURCE;
3089                 switch (open->op_deleg_want) {
3090                 case NFS4_SHARE_WANT_READ_DELEG:
3091                 case NFS4_SHARE_WANT_WRITE_DELEG:
3092                 case NFS4_SHARE_WANT_ANY_DELEG:
3093                         break;
3094                 case NFS4_SHARE_WANT_CANCEL:
3095                         open->op_why_no_deleg = WND4_CANCELLED;
3096                         break;
3097                 case NFS4_SHARE_WANT_NO_DELEG:
3098                         WARN_ON_ONCE(1);
3099                 }
3100         }
3101 }
3102
3103 /*
3104  * Attempt to hand out a delegation.
3105  *
3106  * Note we don't support write delegations, and won't until the vfs has
3107  * proper support for them.
3108  */
3109 static void
3110 nfs4_open_delegation(struct net *net, struct svc_fh *fh,
3111                      struct nfsd4_open *open, struct nfs4_ol_stateid *stp)
3112 {
3113         struct nfs4_delegation *dp;
3114         struct nfs4_openowner *oo = container_of(stp->st_stateowner, struct nfs4_openowner, oo_owner);
3115         int cb_up;
3116         int status = 0;
3117
3118         cb_up = nfsd4_cb_channel_good(oo->oo_owner.so_client);
3119         open->op_recall = 0;
3120         switch (open->op_claim_type) {
3121                 case NFS4_OPEN_CLAIM_PREVIOUS:
3122                         if (!cb_up)
3123                                 open->op_recall = 1;
3124                         if (open->op_delegate_type != NFS4_OPEN_DELEGATE_READ)
3125                                 goto out_no_deleg;
3126                         break;
3127                 case NFS4_OPEN_CLAIM_NULL:
3128                         /*
3129                          * Let's not give out any delegations till everyone's
3130                          * had the chance to reclaim theirs....
3131                          */
3132                         if (locks_in_grace(net))
3133                                 goto out_no_deleg;
3134                         if (!cb_up || !(oo->oo_flags & NFS4_OO_CONFIRMED))
3135                                 goto out_no_deleg;
3136                         /*
3137                          * Also, if the file was opened for write or
3138                          * create, there's a good chance the client's
3139                          * about to write to it, resulting in an
3140                          * immediate recall (since we don't support
3141                          * write delegations):
3142                          */
3143                         if (open->op_share_access & NFS4_SHARE_ACCESS_WRITE)
3144                                 goto out_no_deleg;
3145                         if (open->op_create == NFS4_OPEN_CREATE)
3146                                 goto out_no_deleg;
3147                         break;
3148                 default:
3149                         goto out_no_deleg;
3150         }
3151         dp = alloc_init_deleg(oo->oo_owner.so_client, stp, fh);
3152         if (dp == NULL)
3153                 goto out_no_deleg;
3154         status = nfs4_set_delegation(dp, stp->st_file);
3155         if (status)
3156                 goto out_free;
3157
3158         memcpy(&open->op_delegate_stateid, &dp->dl_stid.sc_stateid, sizeof(dp->dl_stid.sc_stateid));
3159
3160         dprintk("NFSD: delegation stateid=" STATEID_FMT "\n",
3161                 STATEID_VAL(&dp->dl_stid.sc_stateid));
3162         open->op_delegate_type = NFS4_OPEN_DELEGATE_READ;
3163         return;
3164 out_free:
3165         remove_stid(&dp->dl_stid);
3166         nfs4_put_delegation(dp);
3167 out_no_deleg:
3168         open->op_delegate_type = NFS4_OPEN_DELEGATE_NONE;
3169         if (open->op_claim_type == NFS4_OPEN_CLAIM_PREVIOUS &&
3170             open->op_delegate_type != NFS4_OPEN_DELEGATE_NONE) {
3171                 dprintk("NFSD: WARNING: refusing delegation reclaim\n");
3172                 open->op_recall = 1;
3173         }
3174
3175         /* 4.1 client asking for a delegation? */
3176         if (open->op_deleg_want)
3177                 nfsd4_open_deleg_none_ext(open, status);
3178         return;
3179 }
3180
3181 static void nfsd4_deleg_xgrade_none_ext(struct nfsd4_open *open,
3182                                         struct nfs4_delegation *dp)
3183 {
3184         if (open->op_deleg_want == NFS4_SHARE_WANT_READ_DELEG &&
3185             dp->dl_type == NFS4_OPEN_DELEGATE_WRITE) {
3186                 open->op_delegate_type = NFS4_OPEN_DELEGATE_NONE_EXT;
3187                 open->op_why_no_deleg = WND4_NOT_SUPP_DOWNGRADE;
3188         } else if (open->op_deleg_want == NFS4_SHARE_WANT_WRITE_DELEG &&
3189                    dp->dl_type == NFS4_OPEN_DELEGATE_WRITE) {
3190                 open->op_delegate_type = NFS4_OPEN_DELEGATE_NONE_EXT;
3191                 open->op_why_no_deleg = WND4_NOT_SUPP_UPGRADE;
3192         }
3193         /* Otherwise the client must be confused wanting a delegation
3194          * it already has, therefore we don't return
3195          * NFS4_OPEN_DELEGATE_NONE_EXT and reason.
3196          */
3197 }
3198
3199 /*
3200  * called with nfs4_lock_state() held.
3201  */
3202 __be32
3203 nfsd4_process_open2(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_open *open)
3204 {
3205         struct nfsd4_compoundres *resp = rqstp->rq_resp;
3206         struct nfs4_client *cl = open->op_openowner->oo_owner.so_client;
3207         struct nfs4_file *fp = NULL;
3208         struct inode *ino = current_fh->fh_dentry->d_inode;
3209         struct nfs4_ol_stateid *stp = NULL;
3210         struct nfs4_delegation *dp = NULL;
3211         __be32 status;
3212
3213         /*
3214          * Lookup file; if found, lookup stateid and check open request,
3215          * and check for delegations in the process of being recalled.
3216          * If not found, create the nfs4_file struct
3217          */
3218         fp = find_file(ino);
3219         if (fp) {
3220                 if ((status = nfs4_check_open(fp, open, &stp)))
3221                         goto out;
3222                 status = nfs4_check_deleg(cl, open, &dp);
3223                 if (status)
3224                         goto out;
3225         } else {
3226                 status = nfserr_bad_stateid;
3227                 if (nfsd4_is_deleg_cur(open))
3228                         goto out;
3229                 status = nfserr_jukebox;
3230                 fp = open->op_file;
3231                 open->op_file = NULL;
3232                 nfsd4_init_file(fp, ino);
3233         }
3234
3235         /*
3236          * OPEN the file, or upgrade an existing OPEN.
3237          * If truncate fails, the OPEN fails.
3238          */
3239         if (stp) {
3240                 /* Stateid was found, this is an OPEN upgrade */
3241                 status = nfs4_upgrade_open(rqstp, fp, current_fh, stp, open);
3242                 if (status)
3243                         goto out;
3244         } else {
3245                 status = nfs4_get_vfs_file(rqstp, fp, current_fh, open);
3246                 if (status)
3247                         goto out;
3248                 status = nfsd4_truncate(rqstp, current_fh, open);
3249                 if (status)
3250                         goto out;
3251                 stp = open->op_stp;
3252                 open->op_stp = NULL;
3253                 init_open_stateid(stp, fp, open);
3254         }
3255         update_stateid(&stp->st_stid.sc_stateid);
3256         memcpy(&open->op_stateid, &stp->st_stid.sc_stateid, sizeof(stateid_t));
3257
3258         if (nfsd4_has_session(&resp->cstate)) {
3259                 open->op_openowner->oo_flags |= NFS4_OO_CONFIRMED;
3260
3261                 if (open->op_deleg_want & NFS4_SHARE_WANT_NO_DELEG) {
3262                         open->op_delegate_type = NFS4_OPEN_DELEGATE_NONE_EXT;
3263                         open->op_why_no_deleg = WND4_NOT_WANTED;
3264                         goto nodeleg;
3265                 }
3266         }
3267
3268         /*
3269         * Attempt to hand out a delegation. No error return, because the
3270         * OPEN succeeds even if we fail.
3271         */
3272         nfs4_open_delegation(SVC_NET(rqstp), current_fh, open, stp);
3273 nodeleg:
3274         status = nfs_ok;
3275
3276         dprintk("%s: stateid=" STATEID_FMT "\n", __func__,
3277                 STATEID_VAL(&stp->st_stid.sc_stateid));
3278 out:
3279         /* 4.1 client trying to upgrade/downgrade delegation? */
3280         if (open->op_delegate_type == NFS4_OPEN_DELEGATE_NONE && dp &&
3281             open->op_deleg_want)
3282                 nfsd4_deleg_xgrade_none_ext(open, dp);
3283
3284         if (fp)
3285                 put_nfs4_file(fp);
3286         if (status == 0 && open->op_claim_type == NFS4_OPEN_CLAIM_PREVIOUS)
3287                 nfs4_set_claim_prev(open, nfsd4_has_session(&resp->cstate));
3288         /*
3289         * To finish the open response, we just need to set the rflags.
3290         */
3291         open->op_rflags = NFS4_OPEN_RESULT_LOCKTYPE_POSIX;
3292         if (!(open->op_openowner->oo_flags & NFS4_OO_CONFIRMED) &&
3293             !nfsd4_has_session(&resp->cstate))
3294                 open->op_rflags |= NFS4_OPEN_RESULT_CONFIRM;
3295
3296         return status;
3297 }
3298
3299 void nfsd4_cleanup_open_state(struct nfsd4_open *open, __be32 status)
3300 {
3301         if (open->op_openowner) {
3302                 struct nfs4_openowner *oo = open->op_openowner;
3303
3304                 if (!list_empty(&oo->oo_owner.so_stateids))
3305                         list_del_init(&oo->oo_close_lru);
3306                 if (oo->oo_flags & NFS4_OO_NEW) {
3307                         if (status) {
3308                                 release_openowner(oo);
3309                                 open->op_openowner = NULL;
3310                         } else
3311                                 oo->oo_flags &= ~NFS4_OO_NEW;
3312                 }
3313         }
3314         if (open->op_file)
3315                 nfsd4_free_file(open->op_file);
3316         if (open->op_stp)
3317                 free_generic_stateid(open->op_stp);
3318 }
3319
3320 static __be32 lookup_clientid(clientid_t *clid, bool session, struct nfsd_net *nn, struct nfs4_client **clp)
3321 {
3322         struct nfs4_client *found;
3323
3324         if (STALE_CLIENTID(clid, nn))
3325                 return nfserr_stale_clientid;
3326         found = find_confirmed_client(clid, session, nn);
3327         if (clp)
3328                 *clp = found;
3329         return found ? nfs_ok : nfserr_expired;
3330 }
3331
3332 __be32
3333 nfsd4_renew(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
3334             clientid_t *clid)
3335 {
3336         struct nfs4_client *clp;
3337         __be32 status;
3338         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
3339
3340         nfs4_lock_state();
3341         dprintk("process_renew(%08x/%08x): starting\n",
3342                         clid->cl_boot, clid->cl_id);
3343         status = lookup_clientid(clid, cstate->minorversion, nn, &clp);
3344         if (status)
3345                 goto out;
3346         status = nfserr_cb_path_down;
3347         if (!list_empty(&clp->cl_delegations)
3348                         && clp->cl_cb_state != NFSD4_CB_UP)
3349                 goto out;
3350         status = nfs_ok;
3351 out:
3352         nfs4_unlock_state();
3353         return status;
3354 }
3355
3356 static void
3357 nfsd4_end_grace(struct nfsd_net *nn)
3358 {
3359         /* do nothing if grace period already ended */
3360         if (nn->grace_ended)
3361                 return;
3362
3363         dprintk("NFSD: end of grace period\n");
3364         nn->grace_ended = true;
3365         nfsd4_record_grace_done(nn, nn->boot_time);
3366         locks_end_grace(&nn->nfsd4_manager);
3367         /*
3368          * Now that every NFSv4 client has had the chance to recover and
3369          * to see the (possibly new, possibly shorter) lease time, we
3370          * can safely set the next grace time to the current lease time:
3371          */
3372         nn->nfsd4_grace = nn->nfsd4_lease;
3373 }
3374
3375 static time_t
3376 nfs4_laundromat(struct nfsd_net *nn)
3377 {
3378         struct nfs4_client *clp;
3379         struct nfs4_openowner *oo;
3380         struct nfs4_delegation *dp;
3381         struct list_head *pos, *next, reaplist;
3382         time_t cutoff = get_seconds() - nn->nfsd4_lease;
3383         time_t t, clientid_val = nn->nfsd4_lease;
3384         time_t u, test_val = nn->nfsd4_lease;
3385
3386         nfs4_lock_state();
3387
3388         dprintk("NFSD: laundromat service - starting\n");
3389         nfsd4_end_grace(nn);
3390         INIT_LIST_HEAD(&reaplist);
3391         spin_lock(&nn->client_lock);
3392         list_for_each_safe(pos, next, &nn->client_lru) {
3393                 clp = list_entry(pos, struct nfs4_client, cl_lru);
3394                 if (time_after((unsigned long)clp->cl_time, (unsigned long)cutoff)) {
3395                         t = clp->cl_time - cutoff;
3396                         if (clientid_val > t)
3397                                 clientid_val = t;
3398                         break;
3399                 }
3400                 if (mark_client_expired_locked(clp)) {
3401                         dprintk("NFSD: client in use (clientid %08x)\n",
3402                                 clp->cl_clientid.cl_id);
3403                         continue;
3404                 }
3405                 list_move(&clp->cl_lru, &reaplist);
3406         }
3407         spin_unlock(&nn->client_lock);
3408         list_for_each_safe(pos, next, &reaplist) {
3409                 clp = list_entry(pos, struct nfs4_client, cl_lru);
3410                 dprintk("NFSD: purging unused client (clientid %08x)\n",
3411                         clp->cl_clientid.cl_id);
3412                 expire_client(clp);
3413         }
3414         spin_lock(&recall_lock);
3415         list_for_each_safe(pos, next, &nn->del_recall_lru) {
3416                 dp = list_entry (pos, struct nfs4_delegation, dl_recall_lru);
3417                 if (net_generic(dp->dl_stid.sc_client->net, nfsd_net_id) != nn)
3418                         continue;
3419                 if (time_after((unsigned long)dp->dl_time, (unsigned long)cutoff)) {
3420                         u = dp->dl_time - cutoff;
3421                         if (test_val > u)
3422                                 test_val = u;
3423                         break;
3424                 }
3425                 list_move(&dp->dl_recall_lru, &reaplist);
3426         }
3427         spin_unlock(&recall_lock);
3428         list_for_each_safe(pos, next, &reaplist) {
3429                 dp = list_entry (pos, struct nfs4_delegation, dl_recall_lru);
3430                 revoke_delegation(dp);
3431         }
3432         test_val = nn->nfsd4_lease;
3433         list_for_each_safe(pos, next, &nn->close_lru) {
3434                 oo = container_of(pos, struct nfs4_openowner, oo_close_lru);
3435                 if (time_after((unsigned long)oo->oo_time, (unsigned long)cutoff)) {
3436                         u = oo->oo_time - cutoff;
3437                         if (test_val > u)
3438                                 test_val = u;
3439                         break;
3440                 }
3441                 release_openowner(oo);
3442         }
3443         if (clientid_val < NFSD_LAUNDROMAT_MINTIMEOUT)
3444                 clientid_val = NFSD_LAUNDROMAT_MINTIMEOUT;
3445         nfs4_unlock_state();
3446         return clientid_val;
3447 }
3448
3449 static struct workqueue_struct *laundry_wq;
3450 static void laundromat_main(struct work_struct *);
3451
3452 static void
3453 laundromat_main(struct work_struct *laundry)
3454 {
3455         time_t t;
3456         struct delayed_work *dwork = container_of(laundry, struct delayed_work,
3457                                                   work);
3458         struct nfsd_net *nn = container_of(dwork, struct nfsd_net,
3459                                            laundromat_work);
3460
3461         t = nfs4_laundromat(nn);
3462         dprintk("NFSD: laundromat_main - sleeping for %ld seconds\n", t);
3463         queue_delayed_work(laundry_wq, &nn->laundromat_work, t*HZ);
3464 }
3465
3466 static inline __be32 nfs4_check_fh(struct svc_fh *fhp, struct nfs4_ol_stateid *stp)
3467 {
3468         if (fhp->fh_dentry->d_inode != stp->st_file->fi_inode)
3469                 return nfserr_bad_stateid;
3470         return nfs_ok;
3471 }
3472
3473 static inline int
3474 access_permit_read(struct nfs4_ol_stateid *stp)
3475 {
3476         return test_access(NFS4_SHARE_ACCESS_READ, stp) ||
3477                 test_access(NFS4_SHARE_ACCESS_BOTH, stp) ||
3478                 test_access(NFS4_SHARE_ACCESS_WRITE, stp);
3479 }
3480
3481 static inline int
3482 access_permit_write(struct nfs4_ol_stateid *stp)
3483 {
3484         return test_access(NFS4_SHARE_ACCESS_WRITE, stp) ||
3485                 test_access(NFS4_SHARE_ACCESS_BOTH, stp);
3486 }
3487
3488 static
3489 __be32 nfs4_check_openmode(struct nfs4_ol_stateid *stp, int flags)
3490 {
3491         __be32 status = nfserr_openmode;
3492
3493         /* For lock stateid's, we test the parent open, not the lock: */
3494         if (stp->st_openstp)
3495                 stp = stp->st_openstp;
3496         if ((flags & WR_STATE) && !access_permit_write(stp))
3497                 goto out;
3498         if ((flags & RD_STATE) && !access_permit_read(stp))
3499                 goto out;
3500         status = nfs_ok;
3501 out:
3502         return status;
3503 }
3504
3505 static inline __be32
3506 check_special_stateids(struct net *net, svc_fh *current_fh, stateid_t *stateid, int flags)
3507 {
3508         if (ONE_STATEID(stateid) && (flags & RD_STATE))
3509                 return nfs_ok;
3510         else if (locks_in_grace(net)) {
3511                 /* Answer in remaining cases depends on existence of
3512                  * conflicting state; so we must wait out the grace period. */
3513                 return nfserr_grace;
3514         } else if (flags & WR_STATE)
3515                 return nfs4_share_conflict(current_fh,
3516                                 NFS4_SHARE_DENY_WRITE);
3517         else /* (flags & RD_STATE) && ZERO_STATEID(stateid) */
3518                 return nfs4_share_conflict(current_fh,
3519                                 NFS4_SHARE_DENY_READ);
3520 }
3521
3522 /*
3523  * Allow READ/WRITE during grace period on recovered state only for files
3524  * that are not able to provide mandatory locking.
3525  */
3526 static inline int
3527 grace_disallows_io(struct net *net, struct inode *inode)
3528 {
3529         return locks_in_grace(net) && mandatory_lock(inode);
3530 }
3531
3532 /* Returns true iff a is later than b: */
3533 static bool stateid_generation_after(stateid_t *a, stateid_t *b)
3534 {
3535         return (s32)(a->si_generation - b->si_generation) > 0;
3536 }
3537
3538 static __be32 check_stateid_generation(stateid_t *in, stateid_t *ref, bool has_session)
3539 {
3540         /*
3541          * When sessions are used the stateid generation number is ignored
3542          * when it is zero.
3543          */
3544         if (has_session && in->si_generation == 0)
3545                 return nfs_ok;
3546
3547         if (in->si_generation == ref->si_generation)
3548                 return nfs_ok;
3549
3550         /* If the client sends us a stateid from the future, it's buggy: */
3551         if (stateid_generation_after(in, ref))
3552                 return nfserr_bad_stateid;
3553         /*
3554          * However, we could see a stateid from the past, even from a
3555          * non-buggy client.  For example, if the client sends a lock
3556          * while some IO is outstanding, the lock may bump si_generation
3557          * while the IO is still in flight.  The client could avoid that
3558          * situation by waiting for responses on all the IO requests,
3559          * but better performance may result in retrying IO that
3560          * receives an old_stateid error if requests are rarely
3561          * reordered in flight:
3562          */
3563         return nfserr_old_stateid;
3564 }
3565
3566 static __be32 nfsd4_validate_stateid(struct nfs4_client *cl, stateid_t *stateid)
3567 {
3568         struct nfs4_stid *s;
3569         struct nfs4_ol_stateid *ols;
3570         __be32 status;
3571
3572         if (ZERO_STATEID(stateid) || ONE_STATEID(stateid))
3573                 return nfserr_bad_stateid;
3574         /* Client debugging aid. */
3575         if (!same_clid(&stateid->si_opaque.so_clid, &cl->cl_clientid)) {
3576                 char addr_str[INET6_ADDRSTRLEN];
3577                 rpc_ntop((struct sockaddr *)&cl->cl_addr, addr_str,
3578                                  sizeof(addr_str));
3579                 pr_warn_ratelimited("NFSD: client %s testing state ID "
3580                                         "with incorrect client ID\n", addr_str);
3581                 return nfserr_bad_stateid;
3582         }
3583         s = find_stateid(cl, stateid);
3584         if (!s)
3585                 return nfserr_bad_stateid;
3586         status = check_stateid_generation(stateid, &s->sc_stateid, 1);
3587         if (status)
3588                 return status;
3589         switch (s->sc_type) {
3590         case NFS4_DELEG_STID:
3591                 return nfs_ok;
3592         case NFS4_REVOKED_DELEG_STID:
3593                 return nfserr_deleg_revoked;
3594         case NFS4_OPEN_STID:
3595         case NFS4_LOCK_STID:
3596                 ols = openlockstateid(s);
3597                 if (ols->st_stateowner->so_is_open_owner
3598                                 && !(openowner(ols->st_stateowner)->oo_flags
3599                                                 & NFS4_OO_CONFIRMED))
3600                         return nfserr_bad_stateid;
3601                 return nfs_ok;
3602         default:
3603                 printk("unknown stateid type %x\n", s->sc_type);
3604         case NFS4_CLOSED_STID:
3605                 return nfserr_bad_stateid;
3606         }
3607 }
3608
3609 static __be32 nfsd4_lookup_stateid(stateid_t *stateid, unsigned char typemask,
3610                                    struct nfs4_stid **s, bool sessions,
3611                                    struct nfsd_net *nn)
3612 {
3613         struct nfs4_client *cl;
3614         __be32 status;
3615
3616         if (ZERO_STATEID(stateid) || ONE_STATEID(stateid))
3617                 return nfserr_bad_stateid;
3618         status = lookup_clientid(&stateid->si_opaque.so_clid, sessions,
3619                                                         nn, &cl);
3620         if (status == nfserr_stale_clientid)
3621                 return nfserr_stale_stateid;
3622         if (status)
3623                 return status;
3624         *s = find_stateid_by_type(cl, stateid, typemask);
3625         if (!*s)
3626                 return nfserr_bad_stateid;
3627         return nfs_ok;
3628 }
3629
3630 /*
3631 * Checks for stateid operations
3632 */
3633 __be32
3634 nfs4_preprocess_stateid_op(struct net *net, struct nfsd4_compound_state *cstate,
3635                            stateid_t *stateid, int flags, struct file **filpp)
3636 {
3637         struct nfs4_stid *s;
3638         struct nfs4_ol_stateid *stp = NULL;
3639         struct nfs4_delegation *dp = NULL;
3640         struct svc_fh *current_fh = &cstate->current_fh;
3641         struct inode *ino = current_fh->fh_dentry->d_inode;
3642         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
3643         __be32 status;
3644
3645         if (filpp)
3646                 *filpp = NULL;
3647
3648         if (grace_disallows_io(net, ino))
3649                 return nfserr_grace;
3650
3651         if (ZERO_STATEID(stateid) || ONE_STATEID(stateid))
3652                 return check_special_stateids(net, current_fh, stateid, flags);
3653
3654         status = nfsd4_lookup_stateid(stateid, NFS4_DELEG_STID|NFS4_OPEN_STID|NFS4_LOCK_STID,
3655                                       &s, cstate->minorversion, nn);
3656         if (status)
3657                 return status;
3658         status = check_stateid_generation(stateid, &s->sc_stateid, nfsd4_has_session(cstate));
3659         if (status)
3660                 goto out;
3661         switch (s->sc_type) {
3662         case NFS4_DELEG_STID:
3663                 dp = delegstateid(s);
3664                 status = nfs4_check_delegmode(dp, flags);
3665                 if (status)
3666                         goto out;
3667                 if (filpp) {
3668                         *filpp = dp->dl_file->fi_deleg_file;
3669                         if (!*filpp) {
3670                                 WARN_ON_ONCE(1);
3671                                 status = nfserr_serverfault;
3672                                 goto out;
3673                         }
3674                 }
3675                 break;
3676         case NFS4_OPEN_STID:
3677         case NFS4_LOCK_STID:
3678                 stp = openlockstateid(s);
3679                 status = nfs4_check_fh(current_fh, stp);
3680                 if (status)
3681                         goto out;
3682                 if (stp->st_stateowner->so_is_open_owner
3683                     && !(openowner(stp->st_stateowner)->oo_flags & NFS4_OO_CONFIRMED))
3684                         goto out;
3685                 status = nfs4_check_openmode(stp, flags);
3686                 if (status)
3687                         goto out;
3688                 if (filpp) {
3689                         if (flags & RD_STATE)
3690                                 *filpp = find_readable_file(stp->st_file);
3691                         else
3692                                 *filpp = find_writeable_file(stp->st_file);
3693                 }
3694                 break;
3695         default:
3696                 return nfserr_bad_stateid;
3697         }
3698         status = nfs_ok;
3699 out:
3700         return status;
3701 }
3702
3703 static __be32
3704 nfsd4_free_lock_stateid(struct nfs4_ol_stateid *stp)
3705 {
3706         if (check_for_locks(stp->st_file, lockowner(stp->st_stateowner)))
3707                 return nfserr_locks_held;
3708         release_lock_stateid(stp);
3709         return nfs_ok;
3710 }
3711
3712 /*
3713  * Test if the stateid is valid
3714  */
3715 __be32
3716 nfsd4_test_stateid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
3717                    struct nfsd4_test_stateid *test_stateid)
3718 {
3719         struct nfsd4_test_stateid_id *stateid;
3720         struct nfs4_client *cl = cstate->session->se_client;
3721
3722         nfs4_lock_state();
3723         list_for_each_entry(stateid, &test_stateid->ts_stateid_list, ts_id_list)
3724                 stateid->ts_id_status =
3725                         nfsd4_validate_stateid(cl, &stateid->ts_id_stateid);
3726         nfs4_unlock_state();
3727
3728         return nfs_ok;
3729 }
3730
3731 __be32
3732 nfsd4_free_stateid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
3733                    struct nfsd4_free_stateid *free_stateid)
3734 {
3735         stateid_t *stateid = &free_stateid->fr_stateid;
3736         struct nfs4_stid *s;
3737         struct nfs4_delegation *dp;
3738         struct nfs4_client *cl = cstate->session->se_client;
3739         __be32 ret = nfserr_bad_stateid;
3740
3741         nfs4_lock_state();
3742         s = find_stateid(cl, stateid);
3743         if (!s)
3744                 goto out;
3745         switch (s->sc_type) {
3746         case NFS4_DELEG_STID:
3747                 ret = nfserr_locks_held;
3748                 goto out;
3749         case NFS4_OPEN_STID:
3750         case NFS4_LOCK_STID:
3751                 ret = check_stateid_generation(stateid, &s->sc_stateid, 1);
3752                 if (ret)
3753                         goto out;
3754                 if (s->sc_type == NFS4_LOCK_STID)
3755                         ret = nfsd4_free_lock_stateid(openlockstateid(s));
3756                 else
3757                         ret = nfserr_locks_held;
3758                 break;
3759         case NFS4_REVOKED_DELEG_STID:
3760                 dp = delegstateid(s);
3761                 destroy_revoked_delegation(dp);
3762                 ret = nfs_ok;
3763                 break;
3764         default:
3765                 ret = nfserr_bad_stateid;
3766         }
3767 out:
3768         nfs4_unlock_state();
3769         return ret;
3770 }
3771
3772 static inline int
3773 setlkflg (int type)
3774 {
3775         return (type == NFS4_READW_LT || type == NFS4_READ_LT) ?
3776                 RD_STATE : WR_STATE;
3777 }
3778
3779 static __be32 nfs4_seqid_op_checks(struct nfsd4_compound_state *cstate, stateid_t *stateid, u32 seqid, struct nfs4_ol_stateid *stp)
3780 {
3781         struct svc_fh *current_fh = &cstate->current_fh;
3782         struct nfs4_stateowner *sop = stp->st_stateowner;
3783         __be32 status;
3784
3785         status = nfsd4_check_seqid(cstate, sop, seqid);
3786         if (status)
3787                 return status;
3788         if (stp->st_stid.sc_type == NFS4_CLOSED_STID
3789                 || stp->st_stid.sc_type == NFS4_REVOKED_DELEG_STID)
3790                 /*
3791                  * "Closed" stateid's exist *only* to return
3792                  * nfserr_replay_me from the previous step, and
3793                  * revoked delegations are kept only for free_stateid.
3794                  */
3795                 return nfserr_bad_stateid;
3796         status = check_stateid_generation(stateid, &stp->st_stid.sc_stateid, nfsd4_has_session(cstate));
3797         if (status)
3798                 return status;
3799         return nfs4_check_fh(current_fh, stp);
3800 }
3801
3802 /*
3803  * Checks for sequence id mutating operations.
3804  */
3805 static __be32
3806 nfs4_preprocess_seqid_op(struct nfsd4_compound_state *cstate, u32 seqid,
3807                          stateid_t *stateid, char typemask,
3808                          struct nfs4_ol_stateid **stpp,
3809                          struct nfsd_net *nn)
3810 {
3811         __be32 status;
3812         struct nfs4_stid *s;
3813
3814         dprintk("NFSD: %s: seqid=%d stateid = " STATEID_FMT "\n", __func__,
3815                 seqid, STATEID_VAL(stateid));
3816
3817         *stpp = NULL;
3818         status = nfsd4_lookup_stateid(stateid, typemask, &s,
3819                                       cstate->minorversion, nn);
3820         if (status)
3821                 return status;
3822         *stpp = openlockstateid(s);
3823         if (!nfsd4_has_session(cstate))
3824                 cstate->replay_owner = (*stpp)->st_stateowner;
3825
3826         return nfs4_seqid_op_checks(cstate, stateid, seqid, *stpp);
3827 }
3828
3829 static __be32 nfs4_preprocess_confirmed_seqid_op(struct nfsd4_compound_state *cstate, u32 seqid,
3830                                                  stateid_t *stateid, struct nfs4_ol_stateid **stpp, struct nfsd_net *nn)
3831 {
3832         __be32 status;
3833         struct nfs4_openowner *oo;
3834
3835         status = nfs4_preprocess_seqid_op(cstate, seqid, stateid,
3836                                                 NFS4_OPEN_STID, stpp, nn);
3837         if (status)
3838                 return status;
3839         oo = openowner((*stpp)->st_stateowner);
3840         if (!(oo->oo_flags & NFS4_OO_CONFIRMED))
3841                 return nfserr_bad_stateid;
3842         return nfs_ok;
3843 }
3844
3845 __be32
3846 nfsd4_open_confirm(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
3847                    struct nfsd4_open_confirm *oc)
3848 {
3849         __be32 status;
3850         struct nfs4_openowner *oo;
3851         struct nfs4_ol_stateid *stp;
3852         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
3853
3854         dprintk("NFSD: nfsd4_open_confirm on file %pd\n",
3855                         cstate->current_fh.fh_dentry);
3856
3857         status = fh_verify(rqstp, &cstate->current_fh, S_IFREG, 0);
3858         if (status)
3859                 return status;
3860
3861         nfs4_lock_state();
3862
3863         status = nfs4_preprocess_seqid_op(cstate,
3864                                         oc->oc_seqid, &oc->oc_req_stateid,
3865                                         NFS4_OPEN_STID, &stp, nn);
3866         if (status)
3867                 goto out;
3868         oo = openowner(stp->st_stateowner);
3869         status = nfserr_bad_stateid;
3870         if (oo->oo_flags & NFS4_OO_CONFIRMED)
3871                 goto out;
3872         oo->oo_flags |= NFS4_OO_CONFIRMED;
3873         update_stateid(&stp->st_stid.sc_stateid);
3874         memcpy(&oc->oc_resp_stateid, &stp->st_stid.sc_stateid, sizeof(stateid_t));
3875         dprintk("NFSD: %s: success, seqid=%d stateid=" STATEID_FMT "\n",
3876                 __func__, oc->oc_seqid, STATEID_VAL(&stp->st_stid.sc_stateid));
3877
3878         nfsd4_client_record_create(oo->oo_owner.so_client);
3879         status = nfs_ok;
3880 out:
3881         nfsd4_bump_seqid(cstate, status);
3882         if (!cstate->replay_owner)
3883                 nfs4_unlock_state();
3884         return status;
3885 }
3886
3887 static inline void nfs4_stateid_downgrade_bit(struct nfs4_ol_stateid *stp, u32 access)
3888 {
3889         if (!test_access(access, stp))
3890                 return;
3891         nfs4_file_put_access(stp->st_file, nfs4_access_to_omode(access));
3892         clear_access(access, stp);
3893 }
3894
3895 static inline void nfs4_stateid_downgrade(struct nfs4_ol_stateid *stp, u32 to_access)
3896 {
3897         switch (to_access) {
3898         case NFS4_SHARE_ACCESS_READ:
3899                 nfs4_stateid_downgrade_bit(stp, NFS4_SHARE_ACCESS_WRITE);
3900                 nfs4_stateid_downgrade_bit(stp, NFS4_SHARE_ACCESS_BOTH);
3901                 break;
3902         case NFS4_SHARE_ACCESS_WRITE:
3903                 nfs4_stateid_downgrade_bit(stp, NFS4_SHARE_ACCESS_READ);
3904                 nfs4_stateid_downgrade_bit(stp, NFS4_SHARE_ACCESS_BOTH);
3905                 break;
3906         case NFS4_SHARE_ACCESS_BOTH:
3907                 break;
3908         default:
3909                 WARN_ON_ONCE(1);
3910         }
3911 }
3912
3913 static void
3914 reset_union_bmap_deny(unsigned long deny, struct nfs4_ol_stateid *stp)
3915 {
3916         int i;
3917         for (i = 0; i < 4; i++) {
3918                 if ((i & deny) != i)
3919                         clear_deny(i, stp);
3920         }
3921 }
3922
3923 __be32
3924 nfsd4_open_downgrade(struct svc_rqst *rqstp,
3925                      struct nfsd4_compound_state *cstate,
3926                      struct nfsd4_open_downgrade *od)
3927 {
3928         __be32 status;
3929         struct nfs4_ol_stateid *stp;
3930         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
3931
3932         dprintk("NFSD: nfsd4_open_downgrade on file %pd\n",
3933                         cstate->current_fh.fh_dentry);
3934
3935         /* We don't yet support WANT bits: */
3936         if (od->od_deleg_want)
3937                 dprintk("NFSD: %s: od_deleg_want=0x%x ignored\n", __func__,
3938                         od->od_deleg_want);
3939
3940         nfs4_lock_state();
3941         status = nfs4_preprocess_confirmed_seqid_op(cstate, od->od_seqid,
3942                                         &od->od_stateid, &stp, nn);
3943         if (status)
3944                 goto out;
3945         status = nfserr_inval;
3946         if (!test_access(od->od_share_access, stp)) {
3947                 dprintk("NFSD: access not a subset current bitmap: 0x%lx, input access=%08x\n",
3948                         stp->st_access_bmap, od->od_share_access);
3949                 goto out;
3950         }
3951         if (!test_deny(od->od_share_deny, stp)) {
3952                 dprintk("NFSD:deny not a subset current bitmap: 0x%lx, input deny=%08x\n",
3953                         stp->st_deny_bmap, od->od_share_deny);
3954                 goto out;
3955         }
3956         nfs4_stateid_downgrade(stp, od->od_share_access);
3957
3958         reset_union_bmap_deny(od->od_share_deny, stp);
3959
3960         update_stateid(&stp->st_stid.sc_stateid);
3961         memcpy(&od->od_stateid, &stp->st_stid.sc_stateid, sizeof(stateid_t));
3962         status = nfs_ok;
3963 out:
3964         nfsd4_bump_seqid(cstate, status);
3965         if (!cstate->replay_owner)
3966                 nfs4_unlock_state();
3967         return status;
3968 }
3969
3970 static void nfsd4_close_open_stateid(struct nfs4_ol_stateid *s)
3971 {
3972         unhash_open_stateid(s);
3973         s->st_stid.sc_type = NFS4_CLOSED_STID;
3974 }
3975
3976 /*
3977  * nfs4_unlock_state() called after encode
3978  */
3979 __be32
3980 nfsd4_close(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
3981             struct nfsd4_close *close)
3982 {
3983         __be32 status;
3984         struct nfs4_openowner *oo;
3985         struct nfs4_ol_stateid *stp;
3986         struct net *net = SVC_NET(rqstp);
3987         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
3988
3989         dprintk("NFSD: nfsd4_close on file %pd\n",
3990                         cstate->current_fh.fh_dentry);
3991
3992         nfs4_lock_state();
3993         status = nfs4_preprocess_seqid_op(cstate, close->cl_seqid,
3994                                         &close->cl_stateid,
3995                                         NFS4_OPEN_STID|NFS4_CLOSED_STID,
3996                                         &stp, nn);
3997         nfsd4_bump_seqid(cstate, status);
3998         if (status)
3999                 goto out;
4000         oo = openowner(stp->st_stateowner);
4001         update_stateid(&stp->st_stid.sc_stateid);
4002         memcpy(&close->cl_stateid, &stp->st_stid.sc_stateid, sizeof(stateid_t));
4003
4004         nfsd4_close_open_stateid(stp);
4005
4006         if (cstate->minorversion)
4007                 free_generic_stateid(stp);
4008         else
4009                 oo->oo_last_closed_stid = stp;
4010
4011         if (list_empty(&oo->oo_owner.so_stateids)) {
4012                 if (cstate->minorversion)
4013                         release_openowner(oo);
4014                 else {
4015                         /*
4016                          * In the 4.0 case we need to keep the owners around a
4017                          * little while to handle CLOSE replay.
4018                          */
4019                         move_to_close_lru(oo, SVC_NET(rqstp));
4020                 }
4021         }
4022 out:
4023         if (!cstate->replay_owner)
4024                 nfs4_unlock_state();
4025         return status;
4026 }
4027
4028 __be32
4029 nfsd4_delegreturn(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
4030                   struct nfsd4_delegreturn *dr)
4031 {
4032         struct nfs4_delegation *dp;
4033         stateid_t *stateid = &dr->dr_stateid;
4034         struct nfs4_stid *s;
4035         __be32 status;
4036         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
4037
4038         if ((status = fh_verify(rqstp, &cstate->current_fh, S_IFREG, 0)))
4039                 return status;
4040
4041         nfs4_lock_state();
4042         status = nfsd4_lookup_stateid(stateid, NFS4_DELEG_STID, &s,
4043                                       cstate->minorversion, nn);
4044         if (status)
4045                 goto out;
4046         dp = delegstateid(s);
4047         status = check_stateid_generation(stateid, &dp->dl_stid.sc_stateid, nfsd4_has_session(cstate));
4048         if (status)
4049                 goto out;
4050
4051         destroy_delegation(dp);
4052 out:
4053         nfs4_unlock_state();
4054
4055         return status;
4056 }
4057
4058
4059 #define LOFF_OVERFLOW(start, len)      ((u64)(len) > ~(u64)(start))
4060
4061 #define LOCKOWNER_INO_HASH_MASK (LOCKOWNER_INO_HASH_SIZE - 1)
4062
4063 static inline u64
4064 end_offset(u64 start, u64 len)
4065 {
4066         u64 end;
4067
4068         end = start + len;
4069         return end >= start ? end: NFS4_MAX_UINT64;
4070 }
4071
4072 /* last octet in a range */
4073 static inline u64
4074 last_byte_offset(u64 start, u64 len)
4075 {
4076         u64 end;
4077
4078         WARN_ON_ONCE(!len);
4079         end = start + len;
4080         return end > start ? end - 1: NFS4_MAX_UINT64;
4081 }
4082
4083 static unsigned int lockowner_ino_hashval(struct inode *inode, u32 cl_id, struct xdr_netobj *ownername)
4084 {
4085         return (file_hashval(inode) + cl_id
4086                         + opaque_hashval(ownername->data, ownername->len))
4087                 & LOCKOWNER_INO_HASH_MASK;
4088 }
4089
4090 /*
4091  * TODO: Linux file offsets are _signed_ 64-bit quantities, which means that
4092  * we can't properly handle lock requests that go beyond the (2^63 - 1)-th
4093  * byte, because of sign extension problems.  Since NFSv4 calls for 64-bit
4094  * locking, this prevents us from being completely protocol-compliant.  The
4095  * real solution to this problem is to start using unsigned file offsets in
4096  * the VFS, but this is a very deep change!
4097  */
4098 static inline void
4099 nfs4_transform_lock_offset(struct file_lock *lock)
4100 {
4101         if (lock->fl_start < 0)
4102                 lock->fl_start = OFFSET_MAX;
4103         if (lock->fl_end < 0)
4104                 lock->fl_end = OFFSET_MAX;
4105 }
4106
4107 /* Hack!: For now, we're defining this just so we can use a pointer to it
4108  * as a unique cookie to identify our (NFSv4's) posix locks. */
4109 static const struct lock_manager_operations nfsd_posix_mng_ops  = {
4110 };
4111
4112 static inline void
4113 nfs4_set_lock_denied(struct file_lock *fl, struct nfsd4_lock_denied *deny)
4114 {
4115         struct nfs4_lockowner *lo;
4116
4117         if (fl->fl_lmops == &nfsd_posix_mng_ops) {
4118                 lo = (struct nfs4_lockowner *) fl->fl_owner;
4119                 deny->ld_owner.data = kmemdup(lo->lo_owner.so_owner.data,
4120                                         lo->lo_owner.so_owner.len, GFP_KERNEL);
4121                 if (!deny->ld_owner.data)
4122                         /* We just don't care that much */
4123                         goto nevermind;
4124                 deny->ld_owner.len = lo->lo_owner.so_owner.len;
4125                 deny->ld_clientid = lo->lo_owner.so_client->cl_clientid;
4126         } else {
4127 nevermind:
4128                 deny->ld_owner.len = 0;
4129                 deny->ld_owner.data = NULL;
4130                 deny->ld_clientid.cl_boot = 0;
4131                 deny->ld_clientid.cl_id = 0;
4132         }
4133         deny->ld_start = fl->fl_start;
4134         deny->ld_length = NFS4_MAX_UINT64;
4135         if (fl->fl_end != NFS4_MAX_UINT64)
4136                 deny->ld_length = fl->fl_end - fl->fl_start + 1;
4137         deny->ld_type = NFS4_READ_LT;
4138         if (fl->fl_type != F_RDLCK)
4139                 deny->ld_type = NFS4_WRITE_LT;
4140 }
4141
4142 static bool same_lockowner_ino(struct nfs4_lockowner *lo, struct inode *inode, clientid_t *clid, struct xdr_netobj *owner)
4143 {
4144         struct nfs4_ol_stateid *lst;
4145
4146         if (!same_owner_str(&lo->lo_owner, owner, clid))
4147                 return false;
4148         lst = list_first_entry(&lo->lo_owner.so_stateids,
4149                                struct nfs4_ol_stateid, st_perstateowner);
4150         return lst->st_file->fi_inode == inode;
4151 }
4152
4153 static struct nfs4_lockowner *
4154 find_lockowner_str(struct inode *inode, clientid_t *clid,
4155                    struct xdr_netobj *owner, struct nfsd_net *nn)
4156 {
4157         unsigned int hashval = lockowner_ino_hashval(inode, clid->cl_id, owner);
4158         struct nfs4_lockowner *lo;
4159
4160         list_for_each_entry(lo, &nn->lockowner_ino_hashtbl[hashval], lo_owner_ino_hash) {
4161                 if (same_lockowner_ino(lo, inode, clid, owner))
4162                         return lo;
4163         }
4164         return NULL;
4165 }
4166
4167 static void hash_lockowner(struct nfs4_lockowner *lo, unsigned int strhashval, struct nfs4_client *clp, struct nfs4_ol_stateid *open_stp)
4168 {
4169         struct inode *inode = open_stp->st_file->fi_inode;
4170         unsigned int inohash = lockowner_ino_hashval(inode,
4171                         clp->cl_clientid.cl_id, &lo->lo_owner.so_owner);
4172         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
4173
4174         list_add(&lo->lo_owner.so_strhash, &nn->ownerstr_hashtbl[strhashval]);
4175         list_add(&lo->lo_owner_ino_hash, &nn->lockowner_ino_hashtbl[inohash]);
4176         list_add(&lo->lo_perstateid, &open_stp->st_lockowners);
4177 }
4178
4179 /*
4180  * Alloc a lock owner structure.
4181  * Called in nfsd4_lock - therefore, OPEN and OPEN_CONFIRM (if needed) has
4182  * occurred.
4183  *
4184  * strhashval = ownerstr_hashval
4185  */
4186
4187 static struct nfs4_lockowner *
4188 alloc_init_lock_stateowner(unsigned int strhashval, struct nfs4_client *clp, struct nfs4_ol_stateid *open_stp, struct nfsd4_lock *lock) {
4189         struct nfs4_lockowner *lo;
4190
4191         lo = alloc_stateowner(lockowner_slab, &lock->lk_new_owner, clp);
4192         if (!lo)
4193                 return NULL;
4194         INIT_LIST_HEAD(&lo->lo_owner.so_stateids);
4195         lo->lo_owner.so_is_open_owner = 0;
4196         /* It is the openowner seqid that will be incremented in encode in the
4197          * case of new lockowners; so increment the lock seqid manually: */
4198         lo->lo_owner.so_seqid = lock->lk_new_lock_seqid + 1;
4199         hash_lockowner(lo, strhashval, clp, open_stp);
4200         return lo;
4201 }
4202
4203 static struct nfs4_ol_stateid *
4204 alloc_init_lock_stateid(struct nfs4_lockowner *lo, struct nfs4_file *fp, struct nfs4_ol_stateid *open_stp)
4205 {
4206         struct nfs4_ol_stateid *stp;
4207         struct nfs4_client *clp = lo->lo_owner.so_client;
4208
4209         stp = nfs4_alloc_stateid(clp);
4210         if (stp == NULL)
4211                 return NULL;
4212         stp->st_stid.sc_type = NFS4_LOCK_STID;
4213         list_add(&stp->st_perfile, &fp->fi_stateids);
4214         list_add(&stp->st_perstateowner, &lo->lo_owner.so_stateids);
4215         stp->st_stateowner = &lo->lo_owner;
4216         get_nfs4_file(fp);
4217         stp->st_file = fp;
4218         stp->st_access_bmap = 0;
4219         stp->st_deny_bmap = open_stp->st_deny_bmap;
4220         stp->st_openstp = open_stp;
4221         return stp;
4222 }
4223
4224 static int
4225 check_lock_length(u64 offset, u64 length)
4226 {
4227         return ((length == 0)  || ((length != NFS4_MAX_UINT64) &&
4228              LOFF_OVERFLOW(offset, length)));
4229 }
4230
4231 static void get_lock_access(struct nfs4_ol_stateid *lock_stp, u32 access)
4232 {
4233         struct nfs4_file *fp = lock_stp->st_file;
4234         int oflag = nfs4_access_to_omode(access);
4235
4236         if (test_access(access, lock_stp))
4237                 return;
4238         nfs4_file_get_access(fp, oflag);
4239         set_access(access, lock_stp);
4240 }
4241
4242 static __be32 lookup_or_create_lock_state(struct nfsd4_compound_state *cstate, struct nfs4_ol_stateid *ost, struct nfsd4_lock *lock, struct nfs4_ol_stateid **lst, bool *new)
4243 {
4244         struct nfs4_file *fi = ost->st_file;
4245         struct nfs4_openowner *oo = openowner(ost->st_stateowner);
4246         struct nfs4_client *cl = oo->oo_owner.so_client;
4247         struct nfs4_lockowner *lo;
4248         unsigned int strhashval;
4249         struct nfsd_net *nn = net_generic(cl->net, nfsd_net_id);
4250
4251         lo = find_lockowner_str(fi->fi_inode, &cl->cl_clientid,
4252                                 &lock->v.new.owner, nn);
4253         if (lo) {
4254                 if (!cstate->minorversion)
4255                         return nfserr_bad_seqid;
4256                 /* XXX: a lockowner always has exactly one stateid: */
4257                 *lst = list_first_entry(&lo->lo_owner.so_stateids,
4258                                 struct nfs4_ol_stateid, st_perstateowner);
4259                 return nfs_ok;
4260         }
4261         strhashval = ownerstr_hashval(cl->cl_clientid.cl_id,
4262                         &lock->v.new.owner);
4263         lo = alloc_init_lock_stateowner(strhashval, cl, ost, lock);
4264         if (lo == NULL)
4265                 return nfserr_jukebox;
4266         *lst = alloc_init_lock_stateid(lo, fi, ost);
4267         if (*lst == NULL) {
4268                 release_lockowner(lo);
4269                 return nfserr_jukebox;
4270         }
4271         *new = true;
4272         return nfs_ok;
4273 }
4274
4275 /*
4276  *  LOCK operation
4277  */
4278 __be32
4279 nfsd4_lock(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
4280            struct nfsd4_lock *lock)
4281 {
4282         struct nfs4_openowner *open_sop = NULL;
4283         struct nfs4_lockowner *lock_sop = NULL;
4284         struct nfs4_ol_stateid *lock_stp;
4285         struct file *filp = NULL;
4286         struct file_lock *file_lock = NULL;
4287         struct file_lock *conflock = NULL;
4288         __be32 status = 0;
4289         bool new_state = false;
4290         int lkflg;
4291         int err;
4292         struct net *net = SVC_NET(rqstp);
4293         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
4294
4295         dprintk("NFSD: nfsd4_lock: start=%Ld length=%Ld\n",
4296                 (long long) lock->lk_offset,
4297                 (long long) lock->lk_length);
4298
4299         if (check_lock_length(lock->lk_offset, lock->lk_length))
4300                  return nfserr_inval;
4301
4302         if ((status = fh_verify(rqstp, &cstate->current_fh,
4303                                 S_IFREG, NFSD_MAY_LOCK))) {
4304                 dprintk("NFSD: nfsd4_lock: permission denied!\n");
4305                 return status;
4306         }
4307
4308         nfs4_lock_state();
4309
4310         if (lock->lk_is_new) {
4311                 struct nfs4_ol_stateid *open_stp = NULL;
4312
4313                 if (nfsd4_has_session(cstate))
4314                         /* See rfc 5661 18.10.3: given clientid is ignored: */
4315                         memcpy(&lock->v.new.clientid,
4316                                 &cstate->session->se_client->cl_clientid,
4317                                 sizeof(clientid_t));
4318
4319                 status = nfserr_stale_clientid;
4320                 if (STALE_CLIENTID(&lock->lk_new_clientid, nn))
4321                         goto out;
4322
4323                 /* validate and update open stateid and open seqid */
4324                 status = nfs4_preprocess_confirmed_seqid_op(cstate,
4325                                         lock->lk_new_open_seqid,
4326                                         &lock->lk_new_open_stateid,
4327                                         &open_stp, nn);
4328                 if (status)
4329                         goto out;
4330                 open_sop = openowner(open_stp->st_stateowner);
4331                 status = nfserr_bad_stateid;
4332                 if (!same_clid(&open_sop->oo_owner.so_client->cl_clientid,
4333                                                 &lock->v.new.clientid))
4334                         goto out;
4335                 status = lookup_or_create_lock_state(cstate, open_stp, lock,
4336                                                         &lock_stp, &new_state);
4337         } else
4338                 status = nfs4_preprocess_seqid_op(cstate,
4339                                        lock->lk_old_lock_seqid,
4340                                        &lock->lk_old_lock_stateid,
4341                                        NFS4_LOCK_STID, &lock_stp, nn);
4342         if (status)
4343                 goto out;
4344         lock_sop = lockowner(lock_stp->st_stateowner);
4345
4346         lkflg = setlkflg(lock->lk_type);
4347         status = nfs4_check_openmode(lock_stp, lkflg);
4348         if (status)
4349                 goto out;
4350
4351         status = nfserr_grace;
4352         if (locks_in_grace(net) && !lock->lk_reclaim)
4353                 goto out;
4354         status = nfserr_no_grace;
4355         if (!locks_in_grace(net) && lock->lk_reclaim)
4356                 goto out;
4357
4358         file_lock = locks_alloc_lock();
4359         if (!file_lock) {
4360                 dprintk("NFSD: %s: unable to allocate lock!\n", __func__);
4361                 status = nfserr_jukebox;
4362                 goto out;
4363         }
4364
4365         locks_init_lock(file_lock);
4366         switch (lock->lk_type) {
4367                 case NFS4_READ_LT:
4368                 case NFS4_READW_LT:
4369                         filp = find_readable_file(lock_stp->st_file);
4370                         if (filp)
4371                                 get_lock_access(lock_stp, NFS4_SHARE_ACCESS_READ);
4372                         file_lock->fl_type = F_RDLCK;
4373                         break;
4374                 case NFS4_WRITE_LT:
4375                 case NFS4_WRITEW_LT:
4376                         filp = find_writeable_file(lock_stp->st_file);
4377                         if (filp)
4378                                 get_lock_access(lock_stp, NFS4_SHARE_ACCESS_WRITE);
4379                         file_lock->fl_type = F_WRLCK;
4380                         break;
4381                 default:
4382                         status = nfserr_inval;
4383                 goto out;
4384         }
4385         if (!filp) {
4386                 status = nfserr_openmode;
4387                 goto out;
4388         }
4389         file_lock->fl_owner = (fl_owner_t)lock_sop;
4390         file_lock->fl_pid = current->tgid;
4391         file_lock->fl_file = filp;
4392         file_lock->fl_flags = FL_POSIX;
4393         file_lock->fl_lmops = &nfsd_posix_mng_ops;
4394         file_lock->fl_start = lock->lk_offset;
4395         file_lock->fl_end = last_byte_offset(lock->lk_offset, lock->lk_length);
4396         nfs4_transform_lock_offset(file_lock);
4397
4398         conflock = locks_alloc_lock();
4399         if (!conflock) {
4400                 dprintk("NFSD: %s: unable to allocate lock!\n", __func__);
4401                 status = nfserr_jukebox;
4402                 goto out;
4403         }
4404
4405         err = vfs_lock_file(filp, F_SETLK, file_lock, conflock);
4406         switch (-err) {
4407         case 0: /* success! */
4408                 update_stateid(&lock_stp->st_stid.sc_stateid);
4409                 memcpy(&lock->lk_resp_stateid, &lock_stp->st_stid.sc_stateid,
4410                                 sizeof(stateid_t));
4411                 status = 0;
4412                 break;
4413         case (EAGAIN):          /* conflock holds conflicting lock */
4414                 status = nfserr_denied;
4415                 dprintk("NFSD: nfsd4_lock: conflicting lock found!\n");
4416                 nfs4_set_lock_denied(conflock, &lock->lk_denied);
4417                 break;
4418         case (EDEADLK):
4419                 status = nfserr_deadlock;
4420                 break;
4421         default:
4422                 dprintk("NFSD: nfsd4_lock: vfs_lock_file() failed! status %d\n",err);
4423                 status = nfserrno(err);
4424                 break;
4425         }
4426 out:
4427         if (status && new_state)
4428                 release_lockowner(lock_sop);
4429         nfsd4_bump_seqid(cstate, status);
4430         if (!cstate->replay_owner)
4431                 nfs4_unlock_state();
4432         if (file_lock)
4433                 locks_free_lock(file_lock);
4434         if (conflock)
4435                 locks_free_lock(conflock);
4436         return status;
4437 }
4438
4439 /*
4440  * The NFSv4 spec allows a client to do a LOCKT without holding an OPEN,
4441  * so we do a temporary open here just to get an open file to pass to
4442  * vfs_test_lock.  (Arguably perhaps test_lock should be done with an
4443  * inode operation.)
4444  */
4445 static __be32 nfsd_test_lock(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file_lock *lock)
4446 {
4447         struct file *file;
4448         __be32 err = nfsd_open(rqstp, fhp, S_IFREG, NFSD_MAY_READ, &file);
4449         if (!err) {
4450                 err = nfserrno(vfs_test_lock(file, lock));
4451                 nfsd_close(file);
4452         }
4453         return err;
4454 }
4455
4456 /*
4457  * LOCKT operation
4458  */
4459 __be32
4460 nfsd4_lockt(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
4461             struct nfsd4_lockt *lockt)
4462 {
4463         struct inode *inode;
4464         struct file_lock *file_lock = NULL;
4465         struct nfs4_lockowner *lo;
4466         __be32 status;
4467         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
4468
4469         if (locks_in_grace(SVC_NET(rqstp)))
4470                 return nfserr_grace;
4471
4472         if (check_lock_length(lockt->lt_offset, lockt->lt_length))
4473                  return nfserr_inval;
4474
4475         nfs4_lock_state();
4476
4477         if (!nfsd4_has_session(cstate)) {
4478                 status = lookup_clientid(&lockt->lt_clientid, false, nn, NULL);
4479                 if (status)
4480                         goto out;
4481         }
4482
4483         if ((status = fh_verify(rqstp, &cstate->current_fh, S_IFREG, 0)))
4484                 goto out;
4485
4486         inode = cstate->current_fh.fh_dentry->d_inode;
4487         file_lock = locks_alloc_lock();
4488         if (!file_lock) {
4489                 dprintk("NFSD: %s: unable to allocate lock!\n", __func__);
4490                 status = nfserr_jukebox;
4491                 goto out;
4492         }
4493         locks_init_lock(file_lock);
4494         switch (lockt->lt_type) {
4495                 case NFS4_READ_LT:
4496                 case NFS4_READW_LT:
4497                         file_lock->fl_type = F_RDLCK;
4498                 break;
4499                 case NFS4_WRITE_LT:
4500                 case NFS4_WRITEW_LT:
4501                         file_lock->fl_type = F_WRLCK;
4502                 break;
4503                 default:
4504                         dprintk("NFSD: nfs4_lockt: bad lock type!\n");
4505                         status = nfserr_inval;
4506                 goto out;
4507         }
4508
4509         lo = find_lockowner_str(inode, &lockt->lt_clientid, &lockt->lt_owner, nn);
4510         if (lo)
4511                 file_lock->fl_owner = (fl_owner_t)lo;
4512         file_lock->fl_pid = current->tgid;
4513         file_lock->fl_flags = FL_POSIX;
4514
4515         file_lock->fl_start = lockt->lt_offset;
4516         file_lock->fl_end = last_byte_offset(lockt->lt_offset, lockt->lt_length);
4517
4518         nfs4_transform_lock_offset(file_lock);
4519
4520         status = nfsd_test_lock(rqstp, &cstate->current_fh, file_lock);
4521         if (status)
4522                 goto out;
4523
4524         if (file_lock->fl_type != F_UNLCK) {
4525                 status = nfserr_denied;
4526                 nfs4_set_lock_denied(file_lock, &lockt->lt_denied);
4527         }
4528 out:
4529         nfs4_unlock_state();
4530         if (file_lock)
4531                 locks_free_lock(file_lock);
4532         return status;
4533 }
4534
4535 __be32
4536 nfsd4_locku(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
4537             struct nfsd4_locku *locku)
4538 {
4539         struct nfs4_ol_stateid *stp;
4540         struct file *filp = NULL;
4541         struct file_lock *file_lock = NULL;
4542         __be32 status;
4543         int err;
4544         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
4545
4546         dprintk("NFSD: nfsd4_locku: start=%Ld length=%Ld\n",
4547                 (long long) locku->lu_offset,
4548                 (long long) locku->lu_length);
4549
4550         if (check_lock_length(locku->lu_offset, locku->lu_length))
4551                  return nfserr_inval;
4552
4553         nfs4_lock_state();
4554
4555         status = nfs4_preprocess_seqid_op(cstate, locku->lu_seqid,
4556                                         &locku->lu_stateid, NFS4_LOCK_STID,
4557                                         &stp, nn);
4558         if (status)
4559                 goto out;
4560         filp = find_any_file(stp->st_file);
4561         if (!filp) {
4562                 status = nfserr_lock_range;
4563                 goto out;
4564         }
4565         file_lock = locks_alloc_lock();
4566         if (!file_lock) {
4567                 dprintk("NFSD: %s: unable to allocate lock!\n", __func__);
4568                 status = nfserr_jukebox;
4569                 goto out;
4570         }
4571         locks_init_lock(file_lock);
4572         file_lock->fl_type = F_UNLCK;
4573         file_lock->fl_owner = (fl_owner_t)lockowner(stp->st_stateowner);
4574         file_lock->fl_pid = current->tgid;
4575         file_lock->fl_file = filp;
4576         file_lock->fl_flags = FL_POSIX;
4577         file_lock->fl_lmops = &nfsd_posix_mng_ops;
4578         file_lock->fl_start = locku->lu_offset;
4579
4580         file_lock->fl_end = last_byte_offset(locku->lu_offset,
4581                                                 locku->lu_length);
4582         nfs4_transform_lock_offset(file_lock);
4583
4584         err = vfs_lock_file(filp, F_SETLK, file_lock, NULL);
4585         if (err) {
4586                 dprintk("NFSD: nfs4_locku: vfs_lock_file failed!\n");
4587                 goto out_nfserr;
4588         }
4589         update_stateid(&stp->st_stid.sc_stateid);
4590         memcpy(&locku->lu_stateid, &stp->st_stid.sc_stateid, sizeof(stateid_t));
4591
4592 out:
4593         nfsd4_bump_seqid(cstate, status);
4594         if (!cstate->replay_owner)
4595                 nfs4_unlock_state();
4596         if (file_lock)
4597                 locks_free_lock(file_lock);
4598         return status;
4599
4600 out_nfserr:
4601         status = nfserrno(err);
4602         goto out;
4603 }
4604
4605 /*
4606  * returns
4607  *      1: locks held by lockowner
4608  *      0: no locks held by lockowner
4609  */
4610 static int
4611 check_for_locks(struct nfs4_file *filp, struct nfs4_lockowner *lowner)
4612 {
4613         struct file_lock **flpp;
4614         struct inode *inode = filp->fi_inode;
4615         int status = 0;
4616
4617         spin_lock(&inode->i_lock);
4618         for (flpp = &inode->i_flock; *flpp != NULL; flpp = &(*flpp)->fl_next) {
4619                 if ((*flpp)->fl_owner == (fl_owner_t)lowner) {
4620                         status = 1;
4621                         goto out;
4622                 }
4623         }
4624 out:
4625         spin_unlock(&inode->i_lock);
4626         return status;
4627 }
4628
4629 __be32
4630 nfsd4_release_lockowner(struct svc_rqst *rqstp,
4631                         struct nfsd4_compound_state *cstate,
4632                         struct nfsd4_release_lockowner *rlockowner)
4633 {
4634         clientid_t *clid = &rlockowner->rl_clientid;
4635         struct nfs4_stateowner *sop;
4636         struct nfs4_lockowner *lo;
4637         struct nfs4_ol_stateid *stp;
4638         struct xdr_netobj *owner = &rlockowner->rl_owner;
4639         struct list_head matches;
4640         unsigned int hashval = ownerstr_hashval(clid->cl_id, owner);
4641         __be32 status;
4642         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
4643
4644         dprintk("nfsd4_release_lockowner clientid: (%08x/%08x):\n",
4645                 clid->cl_boot, clid->cl_id);
4646
4647         nfs4_lock_state();
4648
4649         status = lookup_clientid(clid, cstate->minorversion, nn, NULL);
4650         if (status)
4651                 goto out;
4652
4653         status = nfserr_locks_held;
4654         INIT_LIST_HEAD(&matches);
4655
4656         list_for_each_entry(sop, &nn->ownerstr_hashtbl[hashval], so_strhash) {
4657                 if (sop->so_is_open_owner)
4658                         continue;
4659                 if (!same_owner_str(sop, owner, clid))
4660                         continue;
4661                 list_for_each_entry(stp, &sop->so_stateids,
4662                                 st_perstateowner) {
4663                         lo = lockowner(sop);
4664                         if (check_for_locks(stp->st_file, lo))
4665                                 goto out;
4666                         list_add(&lo->lo_list, &matches);
4667                 }
4668         }
4669         /* Clients probably won't expect us to return with some (but not all)
4670          * of the lockowner state released; so don't release any until all
4671          * have been checked. */
4672         status = nfs_ok;
4673         while (!list_empty(&matches)) {
4674                 lo = list_entry(matches.next, struct nfs4_lockowner,
4675                                                                 lo_list);
4676                 /* unhash_stateowner deletes so_perclient only
4677                  * for openowners. */
4678                 list_del(&lo->lo_list);
4679                 release_lockowner(lo);
4680         }
4681 out:
4682         nfs4_unlock_state();
4683         return status;
4684 }
4685
4686 static inline struct nfs4_client_reclaim *
4687 alloc_reclaim(void)
4688 {
4689         return kmalloc(sizeof(struct nfs4_client_reclaim), GFP_KERNEL);
4690 }
4691
4692 bool
4693 nfs4_has_reclaimed_state(const char *name, struct nfsd_net *nn)
4694 {
4695         struct nfs4_client_reclaim *crp;
4696
4697         crp = nfsd4_find_reclaim_client(name, nn);
4698         return (crp && crp->cr_clp);
4699 }
4700
4701 /*
4702  * failure => all reset bets are off, nfserr_no_grace...
4703  */
4704 struct nfs4_client_reclaim *
4705 nfs4_client_to_reclaim(const char *name, struct nfsd_net *nn)
4706 {
4707         unsigned int strhashval;
4708         struct nfs4_client_reclaim *crp;
4709
4710         dprintk("NFSD nfs4_client_to_reclaim NAME: %.*s\n", HEXDIR_LEN, name);
4711         crp = alloc_reclaim();
4712         if (crp) {
4713                 strhashval = clientstr_hashval(name);
4714                 INIT_LIST_HEAD(&crp->cr_strhash);
4715                 list_add(&crp->cr_strhash, &nn->reclaim_str_hashtbl[strhashval]);
4716                 memcpy(crp->cr_recdir, name, HEXDIR_LEN);
4717                 crp->cr_clp = NULL;
4718                 nn->reclaim_str_hashtbl_size++;
4719         }
4720         return crp;
4721 }
4722
4723 void
4724 nfs4_remove_reclaim_record(struct nfs4_client_reclaim *crp, struct nfsd_net *nn)
4725 {
4726         list_del(&crp->cr_strhash);
4727         kfree(crp);
4728         nn->reclaim_str_hashtbl_size--;
4729 }
4730
4731 void
4732 nfs4_release_reclaim(struct nfsd_net *nn)
4733 {
4734         struct nfs4_client_reclaim *crp = NULL;
4735         int i;
4736
4737         for (i = 0; i < CLIENT_HASH_SIZE; i++) {
4738                 while (!list_empty(&nn->reclaim_str_hashtbl[i])) {
4739                         crp = list_entry(nn->reclaim_str_hashtbl[i].next,
4740                                         struct nfs4_client_reclaim, cr_strhash);
4741                         nfs4_remove_reclaim_record(crp, nn);
4742                 }
4743         }
4744         WARN_ON_ONCE(nn->reclaim_str_hashtbl_size);
4745 }
4746
4747 /*
4748  * called from OPEN, CLAIM_PREVIOUS with a new clientid. */
4749 struct nfs4_client_reclaim *
4750 nfsd4_find_reclaim_client(const char *recdir, struct nfsd_net *nn)
4751 {
4752         unsigned int strhashval;
4753         struct nfs4_client_reclaim *crp = NULL;
4754
4755         dprintk("NFSD: nfs4_find_reclaim_client for recdir %s\n", recdir);
4756
4757         strhashval = clientstr_hashval(recdir);
4758         list_for_each_entry(crp, &nn->reclaim_str_hashtbl[strhashval], cr_strhash) {
4759                 if (same_name(crp->cr_recdir, recdir)) {
4760                         return crp;
4761                 }
4762         }
4763         return NULL;
4764 }
4765
4766 /*
4767 * Called from OPEN. Look for clientid in reclaim list.
4768 */
4769 __be32
4770 nfs4_check_open_reclaim(clientid_t *clid, bool sessions, struct nfsd_net *nn)
4771 {
4772         struct nfs4_client *clp;
4773
4774         /* find clientid in conf_id_hashtbl */
4775         clp = find_confirmed_client(clid, sessions, nn);
4776         if (clp == NULL)
4777                 return nfserr_reclaim_bad;
4778
4779         return nfsd4_client_record_check(clp) ? nfserr_reclaim_bad : nfs_ok;
4780 }
4781
4782 #ifdef CONFIG_NFSD_FAULT_INJECTION
4783
4784 u64 nfsd_forget_client(struct nfs4_client *clp, u64 max)
4785 {
4786         if (mark_client_expired(clp))
4787                 return 0;
4788         expire_client(clp);
4789         return 1;
4790 }
4791
4792 u64 nfsd_print_client(struct nfs4_client *clp, u64 num)
4793 {
4794         char buf[INET6_ADDRSTRLEN];
4795         rpc_ntop((struct sockaddr *)&clp->cl_addr, buf, sizeof(buf));
4796         printk(KERN_INFO "NFS Client: %s\n", buf);
4797         return 1;
4798 }
4799
4800 static void nfsd_print_count(struct nfs4_client *clp, unsigned int count,
4801                              const char *type)
4802 {
4803         char buf[INET6_ADDRSTRLEN];
4804         rpc_ntop((struct sockaddr *)&clp->cl_addr, buf, sizeof(buf));
4805         printk(KERN_INFO "NFS Client: %s has %u %s\n", buf, count, type);
4806 }
4807
4808 static u64 nfsd_foreach_client_lock(struct nfs4_client *clp, u64 max, void (*func)(struct nfs4_lockowner *))
4809 {
4810         struct nfs4_openowner *oop;
4811         struct nfs4_lockowner *lop, *lo_next;
4812         struct nfs4_ol_stateid *stp, *st_next;
4813         u64 count = 0;
4814
4815         list_for_each_entry(oop, &clp->cl_openowners, oo_perclient) {
4816                 list_for_each_entry_safe(stp, st_next, &oop->oo_owner.so_stateids, st_perstateowner) {
4817                         list_for_each_entry_safe(lop, lo_next, &stp->st_lockowners, lo_perstateid) {
4818                                 if (func)
4819                                         func(lop);
4820                                 if (++count == max)
4821                                         return count;
4822                         }
4823                 }
4824         }
4825
4826         return count;
4827 }
4828
4829 u64 nfsd_forget_client_locks(struct nfs4_client *clp, u64 max)
4830 {
4831         return nfsd_foreach_client_lock(clp, max, release_lockowner);
4832 }
4833
4834 u64 nfsd_print_client_locks(struct nfs4_client *clp, u64 max)
4835 {
4836         u64 count = nfsd_foreach_client_lock(clp, max, NULL);
4837         nfsd_print_count(clp, count, "locked files");
4838         return count;
4839 }
4840
4841 static u64 nfsd_foreach_client_open(struct nfs4_client *clp, u64 max, void (*func)(struct nfs4_openowner *))
4842 {
4843         struct nfs4_openowner *oop, *next;
4844         u64 count = 0;
4845
4846         list_for_each_entry_safe(oop, next, &clp->cl_openowners, oo_perclient) {
4847                 if (func)
4848                         func(oop);
4849                 if (++count == max)
4850                         break;
4851         }
4852
4853         return count;
4854 }
4855
4856 u64 nfsd_forget_client_openowners(struct nfs4_client *clp, u64 max)
4857 {
4858         return nfsd_foreach_client_open(clp, max, release_openowner);
4859 }
4860
4861 u64 nfsd_print_client_openowners(struct nfs4_client *clp, u64 max)
4862 {
4863         u64 count = nfsd_foreach_client_open(clp, max, NULL);
4864         nfsd_print_count(clp, count, "open files");
4865         return count;
4866 }
4867
4868 static u64 nfsd_find_all_delegations(struct nfs4_client *clp, u64 max,
4869                                      struct list_head *victims)
4870 {
4871         struct nfs4_delegation *dp, *next;
4872         u64 count = 0;
4873
4874         list_for_each_entry_safe(dp, next, &clp->cl_delegations, dl_perclnt) {
4875                 if (victims)
4876                         list_move(&dp->dl_recall_lru, victims);
4877                 if (++count == max)
4878                         break;
4879         }
4880         return count;
4881 }
4882
4883 u64 nfsd_forget_client_delegations(struct nfs4_client *clp, u64 max)
4884 {
4885         struct nfs4_delegation *dp, *next;
4886         LIST_HEAD(victims);
4887         u64 count;
4888
4889         spin_lock(&recall_lock);
4890         count = nfsd_find_all_delegations(clp, max, &victims);
4891         spin_unlock(&recall_lock);
4892
4893         list_for_each_entry_safe(dp, next, &victims, dl_recall_lru)
4894                 revoke_delegation(dp);
4895
4896         return count;
4897 }
4898
4899 u64 nfsd_recall_client_delegations(struct nfs4_client *clp, u64 max)
4900 {
4901         struct nfs4_delegation *dp, *next;
4902         LIST_HEAD(victims);
4903         u64 count;
4904
4905         spin_lock(&recall_lock);
4906         count = nfsd_find_all_delegations(clp, max, &victims);
4907         list_for_each_entry_safe(dp, next, &victims, dl_recall_lru)
4908                 nfsd_break_one_deleg(dp);
4909         spin_unlock(&recall_lock);
4910
4911         return count;
4912 }
4913
4914 u64 nfsd_print_client_delegations(struct nfs4_client *clp, u64 max)
4915 {
4916         u64 count = 0;
4917
4918         spin_lock(&recall_lock);
4919         count = nfsd_find_all_delegations(clp, max, NULL);
4920         spin_unlock(&recall_lock);
4921
4922         nfsd_print_count(clp, count, "delegations");
4923         return count;
4924 }
4925
4926 u64 nfsd_for_n_state(u64 max, u64 (*func)(struct nfs4_client *, u64))
4927 {
4928         struct nfs4_client *clp, *next;
4929         u64 count = 0;
4930         struct nfsd_net *nn = net_generic(current->nsproxy->net_ns, nfsd_net_id);
4931
4932         if (!nfsd_netns_ready(nn))
4933                 return 0;
4934
4935         list_for_each_entry_safe(clp, next, &nn->client_lru, cl_lru) {
4936                 count += func(clp, max - count);
4937                 if ((max != 0) && (count >= max))
4938                         break;
4939         }
4940
4941         return count;
4942 }
4943
4944 struct nfs4_client *nfsd_find_client(struct sockaddr_storage *addr, size_t addr_size)
4945 {
4946         struct nfs4_client *clp;
4947         struct nfsd_net *nn = net_generic(current->nsproxy->net_ns, nfsd_net_id);
4948
4949         if (!nfsd_netns_ready(nn))
4950                 return NULL;
4951
4952         list_for_each_entry(clp, &nn->client_lru, cl_lru) {
4953                 if (memcmp(&clp->cl_addr, addr, addr_size) == 0)
4954                         return clp;
4955         }
4956         return NULL;
4957 }
4958
4959 #endif /* CONFIG_NFSD_FAULT_INJECTION */
4960
4961 /* initialization to perform at module load time: */
4962
4963 void
4964 nfs4_state_init(void)
4965 {
4966 }
4967
4968 /*
4969  * Since the lifetime of a delegation isn't limited to that of an open, a
4970  * client may quite reasonably hang on to a delegation as long as it has
4971  * the inode cached.  This becomes an obvious problem the first time a
4972  * client's inode cache approaches the size of the server's total memory.
4973  *
4974  * For now we avoid this problem by imposing a hard limit on the number
4975  * of delegations, which varies according to the server's memory size.
4976  */
4977 static void
4978 set_max_delegations(void)
4979 {
4980         /*
4981          * Allow at most 4 delegations per megabyte of RAM.  Quick
4982          * estimates suggest that in the worst case (where every delegation
4983          * is for a different inode), a delegation could take about 1.5K,
4984          * giving a worst case usage of about 6% of memory.
4985          */
4986         max_delegations = nr_free_buffer_pages() >> (20 - 2 - PAGE_SHIFT);
4987 }
4988
4989 static int nfs4_state_create_net(struct net *net)
4990 {
4991         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
4992         int i;
4993
4994         nn->conf_id_hashtbl = kmalloc(sizeof(struct list_head) *
4995                         CLIENT_HASH_SIZE, GFP_KERNEL);
4996         if (!nn->conf_id_hashtbl)
4997                 goto err;
4998         nn->unconf_id_hashtbl = kmalloc(sizeof(struct list_head) *
4999                         CLIENT_HASH_SIZE, GFP_KERNEL);
5000         if (!nn->unconf_id_hashtbl)
5001                 goto err_unconf_id;
5002         nn->ownerstr_hashtbl = kmalloc(sizeof(struct list_head) *
5003                         OWNER_HASH_SIZE, GFP_KERNEL);
5004         if (!nn->ownerstr_hashtbl)
5005                 goto err_ownerstr;
5006         nn->lockowner_ino_hashtbl = kmalloc(sizeof(struct list_head) *
5007                         LOCKOWNER_INO_HASH_SIZE, GFP_KERNEL);
5008         if (!nn->lockowner_ino_hashtbl)
5009                 goto err_lockowner_ino;
5010         nn->sessionid_hashtbl = kmalloc(sizeof(struct list_head) *
5011                         SESSION_HASH_SIZE, GFP_KERNEL);
5012         if (!nn->sessionid_hashtbl)
5013                 goto err_sessionid;
5014
5015         for (i = 0; i < CLIENT_HASH_SIZE; i++) {
5016                 INIT_LIST_HEAD(&nn->conf_id_hashtbl[i]);
5017                 INIT_LIST_HEAD(&nn->unconf_id_hashtbl[i]);
5018         }
5019         for (i = 0; i < OWNER_HASH_SIZE; i++)
5020                 INIT_LIST_HEAD(&nn->ownerstr_hashtbl[i]);
5021         for (i = 0; i < LOCKOWNER_INO_HASH_SIZE; i++)
5022                 INIT_LIST_HEAD(&nn->lockowner_ino_hashtbl[i]);
5023         for (i = 0; i < SESSION_HASH_SIZE; i++)
5024                 INIT_LIST_HEAD(&nn->sessionid_hashtbl[i]);
5025         nn->conf_name_tree = RB_ROOT;
5026         nn->unconf_name_tree = RB_ROOT;
5027         INIT_LIST_HEAD(&nn->client_lru);
5028         INIT_LIST_HEAD(&nn->close_lru);
5029         INIT_LIST_HEAD(&nn->del_recall_lru);
5030         spin_lock_init(&nn->client_lock);
5031
5032         INIT_DELAYED_WORK(&nn->laundromat_work, laundromat_main);
5033         get_net(net);
5034
5035         return 0;
5036
5037 err_sessionid:
5038         kfree(nn->lockowner_ino_hashtbl);
5039 err_lockowner_ino:
5040         kfree(nn->ownerstr_hashtbl);
5041 err_ownerstr:
5042         kfree(nn->unconf_id_hashtbl);
5043 err_unconf_id:
5044         kfree(nn->conf_id_hashtbl);
5045 err:
5046         return -ENOMEM;
5047 }
5048
5049 static void
5050 nfs4_state_destroy_net(struct net *net)
5051 {
5052         int i;
5053         struct nfs4_client *clp = NULL;
5054         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
5055         struct rb_node *node, *tmp;
5056
5057         for (i = 0; i < CLIENT_HASH_SIZE; i++) {
5058                 while (!list_empty(&nn->conf_id_hashtbl[i])) {
5059                         clp = list_entry(nn->conf_id_hashtbl[i].next, struct nfs4_client, cl_idhash);
5060                         destroy_client(clp);
5061                 }
5062         }
5063
5064         node = rb_first(&nn->unconf_name_tree);
5065         while (node != NULL) {
5066                 tmp = node;
5067                 node = rb_next(tmp);
5068                 clp = rb_entry(tmp, struct nfs4_client, cl_namenode);
5069                 rb_erase(tmp, &nn->unconf_name_tree);
5070                 destroy_client(clp);
5071         }
5072
5073         kfree(nn->sessionid_hashtbl);
5074         kfree(nn->lockowner_ino_hashtbl);
5075         kfree(nn->ownerstr_hashtbl);
5076         kfree(nn->unconf_id_hashtbl);
5077         kfree(nn->conf_id_hashtbl);
5078         put_net(net);
5079 }
5080
5081 int
5082 nfs4_state_start_net(struct net *net)
5083 {
5084         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
5085         int ret;
5086
5087         ret = nfs4_state_create_net(net);
5088         if (ret)
5089                 return ret;
5090         nfsd4_client_tracking_init(net);
5091         nn->boot_time = get_seconds();
5092         locks_start_grace(net, &nn->nfsd4_manager);
5093         nn->grace_ended = false;
5094         printk(KERN_INFO "NFSD: starting %ld-second grace period (net %p)\n",
5095                nn->nfsd4_grace, net);
5096         queue_delayed_work(laundry_wq, &nn->laundromat_work, nn->nfsd4_grace * HZ);
5097         return 0;
5098 }
5099
5100 /* initialization to perform when the nfsd service is started: */
5101
5102 int
5103 nfs4_state_start(void)
5104 {
5105         int ret;
5106
5107         ret = set_callback_cred();
5108         if (ret)
5109                 return -ENOMEM;
5110         laundry_wq = create_singlethread_workqueue("nfsd4");
5111         if (laundry_wq == NULL) {
5112                 ret = -ENOMEM;
5113                 goto out_recovery;
5114         }
5115         ret = nfsd4_create_callback_queue();
5116         if (ret)
5117                 goto out_free_laundry;
5118
5119         set_max_delegations();
5120
5121         return 0;
5122
5123 out_free_laundry:
5124         destroy_workqueue(laundry_wq);
5125 out_recovery:
5126         return ret;
5127 }
5128
5129 void
5130 nfs4_state_shutdown_net(struct net *net)
5131 {
5132         struct nfs4_delegation *dp = NULL;
5133         struct list_head *pos, *next, reaplist;
5134         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
5135
5136         cancel_delayed_work_sync(&nn->laundromat_work);
5137         locks_end_grace(&nn->nfsd4_manager);
5138
5139         nfs4_lock_state();
5140         INIT_LIST_HEAD(&reaplist);
5141         spin_lock(&recall_lock);
5142         list_for_each_safe(pos, next, &nn->del_recall_lru) {
5143                 dp = list_entry (pos, struct nfs4_delegation, dl_recall_lru);
5144                 list_move(&dp->dl_recall_lru, &reaplist);
5145         }
5146         spin_unlock(&recall_lock);
5147         list_for_each_safe(pos, next, &reaplist) {
5148                 dp = list_entry (pos, struct nfs4_delegation, dl_recall_lru);
5149                 destroy_delegation(dp);
5150         }
5151
5152         nfsd4_client_tracking_exit(net);
5153         nfs4_state_destroy_net(net);
5154         nfs4_unlock_state();
5155 }
5156
5157 void
5158 nfs4_state_shutdown(void)
5159 {
5160         destroy_workqueue(laundry_wq);
5161         nfsd4_destroy_callback_queue();
5162 }
5163
5164 static void
5165 get_stateid(struct nfsd4_compound_state *cstate, stateid_t *stateid)
5166 {
5167         if (HAS_STATE_ID(cstate, CURRENT_STATE_ID_FLAG) && CURRENT_STATEID(stateid))
5168                 memcpy(stateid, &cstate->current_stateid, sizeof(stateid_t));
5169 }
5170
5171 static void
5172 put_stateid(struct nfsd4_compound_state *cstate, stateid_t *stateid)
5173 {
5174         if (cstate->minorversion) {
5175                 memcpy(&cstate->current_stateid, stateid, sizeof(stateid_t));
5176                 SET_STATE_ID(cstate, CURRENT_STATE_ID_FLAG);
5177         }
5178 }
5179
5180 void
5181 clear_current_stateid(struct nfsd4_compound_state *cstate)
5182 {
5183         CLEAR_STATE_ID(cstate, CURRENT_STATE_ID_FLAG);
5184 }
5185
5186 /*
5187  * functions to set current state id
5188  */
5189 void
5190 nfsd4_set_opendowngradestateid(struct nfsd4_compound_state *cstate, struct nfsd4_open_downgrade *odp)
5191 {
5192         put_stateid(cstate, &odp->od_stateid);
5193 }
5194
5195 void
5196 nfsd4_set_openstateid(struct nfsd4_compound_state *cstate, struct nfsd4_open *open)
5197 {
5198         put_stateid(cstate, &open->op_stateid);
5199 }
5200
5201 void
5202 nfsd4_set_closestateid(struct nfsd4_compound_state *cstate, struct nfsd4_close *close)
5203 {
5204         put_stateid(cstate, &close->cl_stateid);
5205 }
5206
5207 void
5208 nfsd4_set_lockstateid(struct nfsd4_compound_state *cstate, struct nfsd4_lock *lock)
5209 {
5210         put_stateid(cstate, &lock->lk_resp_stateid);
5211 }
5212
5213 /*
5214  * functions to consume current state id
5215  */
5216
5217 void
5218 nfsd4_get_opendowngradestateid(struct nfsd4_compound_state *cstate, struct nfsd4_open_downgrade *odp)
5219 {
5220         get_stateid(cstate, &odp->od_stateid);
5221 }
5222
5223 void
5224 nfsd4_get_delegreturnstateid(struct nfsd4_compound_state *cstate, struct nfsd4_delegreturn *drp)
5225 {
5226         get_stateid(cstate, &drp->dr_stateid);
5227 }
5228
5229 void
5230 nfsd4_get_freestateid(struct nfsd4_compound_state *cstate, struct nfsd4_free_stateid *fsp)
5231 {
5232         get_stateid(cstate, &fsp->fr_stateid);
5233 }
5234
5235 void
5236 nfsd4_get_setattrstateid(struct nfsd4_compound_state *cstate, struct nfsd4_setattr *setattr)
5237 {
5238         get_stateid(cstate, &setattr->sa_stateid);
5239 }
5240
5241 void
5242 nfsd4_get_closestateid(struct nfsd4_compound_state *cstate, struct nfsd4_close *close)
5243 {
5244         get_stateid(cstate, &close->cl_stateid);
5245 }
5246
5247 void
5248 nfsd4_get_lockustateid(struct nfsd4_compound_state *cstate, struct nfsd4_locku *locku)
5249 {
5250         get_stateid(cstate, &locku->lu_stateid);
5251 }
5252
5253 void
5254 nfsd4_get_readstateid(struct nfsd4_compound_state *cstate, struct nfsd4_read *read)
5255 {
5256         get_stateid(cstate, &read->rd_stateid);
5257 }
5258
5259 void
5260 nfsd4_get_writestateid(struct nfsd4_compound_state *cstate, struct nfsd4_write *write)
5261 {
5262         get_stateid(cstate, &write->wr_stateid);
5263 }