fs/nfsd/nfs4state.c

   1 /*
   2 *  Copyright (c) 2001 The Regents of the University of Michigan.
   3 *  All rights reserved.
   4 *
   5 *  Kendrick Smith <kmsmith@umich.edu>
   6 *  Andy Adamson <kandros@umich.edu>
   7 *
   8 *  Redistribution and use in source and binary forms, with or without
   9 *  modification, are permitted provided that the following conditions
  10 *  are met:
  11 *
  12 *  1. Redistributions of source code must retain the above copyright
  13 *     notice, this list of conditions and the following disclaimer.
  14 *  2. Redistributions in binary form must reproduce the above copyright
  15 *     notice, this list of conditions and the following disclaimer in the
  16 *     documentation and/or other materials provided with the distribution.
  17 *  3. Neither the name of the University nor the names of its
  18 *     contributors may be used to endorse or promote products derived
  19 *     from this software without specific prior written permission.
  20 *
  21 *  THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
  22 *  WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
  23 *  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
  24 *  DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
  25 *  FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  26 *  CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  27 *  SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
  28 *  BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
  29 *  LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
  30 *  NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
  31 *  SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  32 *
  33 */
  34
  35 #include <linux/file.h>
  36 #include <linux/fs.h>
  37 #include <linux/slab.h>
  38 #include <linux/namei.h>
  39 #include <linux/swap.h>
  40 #include <linux/pagemap.h>
  41 #include <linux/ratelimit.h>
  42 #include <linux/sunrpc/svcauth_gss.h>
  43 #include <linux/sunrpc/addr.h>
  44 #include <linux/hash.h>
  45 #include "xdr4.h"
  46 #include "xdr4cb.h"
  47 #include "vfs.h"
  48 #include "current_stateid.h"
  49
  50 #include "netns.h"
  51
  52 #define NFSDDBG_FACILITY                NFSDDBG_PROC
  53
  54 #define all_ones {{~0,~0},~0}
  55 static const stateid_t one_stateid = {
  56         .si_generation = ~0,
  57         .si_opaque = all_ones,
  58 };
  59 static const stateid_t zero_stateid = {
  60         /* all fields zero */
  61 };
  62 static const stateid_t currentstateid = {
  63         .si_generation = 1,
  64 };
  65
  66 static u64 current_sessionid = 1;
  67
  68 #define ZERO_STATEID(stateid) (!memcmp((stateid), &zero_stateid, sizeof(stateid_t)))
  69 #define ONE_STATEID(stateid)  (!memcmp((stateid), &one_stateid, sizeof(stateid_t)))
  70 #define CURRENT_STATEID(stateid) (!memcmp((stateid), &currentstateid, sizeof(stateid_t)))
  71
  72 /* forward declarations */
  73 static bool check_for_locks(struct nfs4_file *fp, struct nfs4_lockowner *lowner);
  74 static void nfs4_free_ol_stateid(struct nfs4_stid *stid);
  75
  76 /* Locking: */
  77
  78 /*
  79  * Currently used for the del_recall_lru and file hash table.  In an
  80  * effort to decrease the scope of the client_mutex, this spinlock may
  81  * eventually cover more:
  82  */
  83 static DEFINE_SPINLOCK(state_lock);
  84
  85 /*
  86  * A waitqueue for all in-progress 4.0 CLOSE operations that are waiting for
  87  * the refcount on the open stateid to drop.
  88  */
  89 static DECLARE_WAIT_QUEUE_HEAD(close_wq);
  90
  91 static struct kmem_cache *openowner_slab;
  92 static struct kmem_cache *lockowner_slab;
  93 static struct kmem_cache *file_slab;
  94 static struct kmem_cache *stateid_slab;
  95 static struct kmem_cache *deleg_slab;
  96
  97 static void free_session(struct nfsd4_session *);
  98
  99 static bool is_session_dead(struct nfsd4_session *ses)
 100 {
 101         return ses->se_flags & NFS4_SESSION_DEAD;
 102 }
 103
 104 static __be32 mark_session_dead_locked(struct nfsd4_session *ses, int ref_held_by_me)
 105 {
 106         if (atomic_read(&ses->se_ref) > ref_held_by_me)
 107                 return nfserr_jukebox;
 108         ses->se_flags |= NFS4_SESSION_DEAD;
 109         return nfs_ok;
 110 }
 111
 112 static bool is_client_expired(struct nfs4_client *clp)
 113 {
 114         return clp->cl_time == 0;
 115 }
 116
 117 static __be32 get_client_locked(struct nfs4_client *clp)
 118 {
 119         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
 120
 121         lockdep_assert_held(&nn->client_lock);
 122
 123         if (is_client_expired(clp))
 124                 return nfserr_expired;
 125         atomic_inc(&clp->cl_refcount);
 126         return nfs_ok;
 127 }
 128
 129 /* must be called under the client_lock */
 130 static inline void
 131 renew_client_locked(struct nfs4_client *clp)
 132 {
 133         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
 134
 135         if (is_client_expired(clp)) {
 136                 WARN_ON(1);
 137                 printk("%s: client (clientid %08x/%08x) already expired\n",
 138                         __func__,
 139                         clp->cl_clientid.cl_boot,
 140                         clp->cl_clientid.cl_id);
 141                 return;
 142         }
 143
 144         dprintk("renewing client (clientid %08x/%08x)\n",
 145                         clp->cl_clientid.cl_boot,
 146                         clp->cl_clientid.cl_id);
 147         list_move_tail(&clp->cl_lru, &nn->client_lru);
 148         clp->cl_time = get_seconds();
 149 }
 150
 151 static inline void
 152 renew_client(struct nfs4_client *clp)
 153 {
 154         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
 155
 156         spin_lock(&nn->client_lock);
 157         renew_client_locked(clp);
 158         spin_unlock(&nn->client_lock);
 159 }
 160
 161 static void put_client_renew_locked(struct nfs4_client *clp)
 162 {
 163         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
 164
 165         lockdep_assert_held(&nn->client_lock);
 166
 167         if (!atomic_dec_and_test(&clp->cl_refcount))
 168                 return;
 169         if (!is_client_expired(clp))
 170                 renew_client_locked(clp);
 171 }
 172
 173 static void put_client_renew(struct nfs4_client *clp)
 174 {
 175         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
 176
 177         if (!atomic_dec_and_lock(&clp->cl_refcount, &nn->client_lock))
 178                 return;
 179         if (!is_client_expired(clp))
 180                 renew_client_locked(clp);
 181         spin_unlock(&nn->client_lock);
 182 }
 183
 184 static __be32 nfsd4_get_session_locked(struct nfsd4_session *ses)
 185 {
 186         __be32 status;
 187
 188         if (is_session_dead(ses))
 189                 return nfserr_badsession;
 190         status = get_client_locked(ses->se_client);
 191         if (status)
 192                 return status;
 193         atomic_inc(&ses->se_ref);
 194         return nfs_ok;
 195 }
 196
 197 static void nfsd4_put_session_locked(struct nfsd4_session *ses)
 198 {
 199         struct nfs4_client *clp = ses->se_client;
 200         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
 201
 202         lockdep_assert_held(&nn->client_lock);
 203
 204         if (atomic_dec_and_test(&ses->se_ref) && is_session_dead(ses))
 205                 free_session(ses);
 206         put_client_renew_locked(clp);
 207 }
 208
 209 static void nfsd4_put_session(struct nfsd4_session *ses)
 210 {
 211         struct nfs4_client *clp = ses->se_client;
 212         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
 213
 214         spin_lock(&nn->client_lock);
 215         nfsd4_put_session_locked(ses);
 216         spin_unlock(&nn->client_lock);
 217 }
 218
 219 static inline struct nfs4_stateowner *
 220 nfs4_get_stateowner(struct nfs4_stateowner *sop)
 221 {
 222         atomic_inc(&sop->so_count);
 223         return sop;
 224 }
 225
 226 static int
 227 same_owner_str(struct nfs4_stateowner *sop, struct xdr_netobj *owner)
 228 {
 229         return (sop->so_owner.len == owner->len) &&
 230                 0 == memcmp(sop->so_owner.data, owner->data, owner->len);
 231 }
 232
 233 static struct nfs4_openowner *
 234 find_openstateowner_str_locked(unsigned int hashval, struct nfsd4_open *open,
 235                         struct nfs4_client *clp)
 236 {
 237         struct nfs4_stateowner *so;
 238
 239         lockdep_assert_held(&clp->cl_lock);
 240
 241         list_for_each_entry(so, &clp->cl_ownerstr_hashtbl[hashval],
 242                             so_strhash) {
 243                 if (!so->so_is_open_owner)
 244                         continue;
 245                 if (same_owner_str(so, &open->op_owner))
 246                         return openowner(nfs4_get_stateowner(so));
 247         }
 248         return NULL;
 249 }
 250
 251 static struct nfs4_openowner *
 252 find_openstateowner_str(unsigned int hashval, struct nfsd4_open *open,
 253                         struct nfs4_client *clp)
 254 {
 255         struct nfs4_openowner *oo;
 256
 257         spin_lock(&clp->cl_lock);
 258         oo = find_openstateowner_str_locked(hashval, open, clp);
 259         spin_unlock(&clp->cl_lock);
 260         return oo;
 261 }
 262
 263 static inline u32
 264 opaque_hashval(const void *ptr, int nbytes)
 265 {
 266         unsigned char *cptr = (unsigned char *) ptr;
 267
 268         u32 x = 0;
 269         while (nbytes--) {
 270                 x *= 37;
 271                 x += *cptr++;
 272         }
 273         return x;
 274 }
 275
 276 static void nfsd4_free_file(struct nfs4_file *f)
 277 {
 278         kmem_cache_free(file_slab, f);
 279 }
 280
 281 static inline void
 282 put_nfs4_file(struct nfs4_file *fi)
 283 {
 284         might_lock(&state_lock);
 285
 286         if (atomic_dec_and_lock(&fi->fi_ref, &state_lock)) {
 287                 hlist_del(&fi->fi_hash);
 288                 spin_unlock(&state_lock);
 289                 nfsd4_free_file(fi);
 290         }
 291 }
 292
 293 static inline void
 294 get_nfs4_file(struct nfs4_file *fi)
 295 {
 296         atomic_inc(&fi->fi_ref);
 297 }
 298
 299 static struct file *
 300 __nfs4_get_fd(struct nfs4_file *f, int oflag)
 301 {
 302         if (f->fi_fds[oflag])
 303                 return get_file(f->fi_fds[oflag]);
 304         return NULL;
 305 }
 306
 307 static struct file *
 308 find_writeable_file_locked(struct nfs4_file *f)
 309 {
 310         struct file *ret;
 311
 312         lockdep_assert_held(&f->fi_lock);
 313
 314         ret = __nfs4_get_fd(f, O_WRONLY);
 315         if (!ret)
 316                 ret = __nfs4_get_fd(f, O_RDWR);
 317         return ret;
 318 }
 319
 320 static struct file *
 321 find_writeable_file(struct nfs4_file *f)
 322 {
 323         struct file *ret;
 324
 325         spin_lock(&f->fi_lock);
 326         ret = find_writeable_file_locked(f);
 327         spin_unlock(&f->fi_lock);
 328
 329         return ret;
 330 }
 331
 332 static struct file *find_readable_file_locked(struct nfs4_file *f)
 333 {
 334         struct file *ret;
 335
 336         lockdep_assert_held(&f->fi_lock);
 337
 338         ret = __nfs4_get_fd(f, O_RDONLY);
 339         if (!ret)
 340                 ret = __nfs4_get_fd(f, O_RDWR);
 341         return ret;
 342 }
 343
 344 static struct file *
 345 find_readable_file(struct nfs4_file *f)
 346 {
 347         struct file *ret;
 348
 349         spin_lock(&f->fi_lock);
 350         ret = find_readable_file_locked(f);
 351         spin_unlock(&f->fi_lock);
 352
 353         return ret;
 354 }
 355
 356 static struct file *
 357 find_any_file(struct nfs4_file *f)
 358 {
 359         struct file *ret;
 360
 361         spin_lock(&f->fi_lock);
 362         ret = __nfs4_get_fd(f, O_RDWR);
 363         if (!ret) {
 364                 ret = __nfs4_get_fd(f, O_WRONLY);
 365                 if (!ret)
 366                         ret = __nfs4_get_fd(f, O_RDONLY);
 367         }
 368         spin_unlock(&f->fi_lock);
 369         return ret;
 370 }
 371
 372 static atomic_long_t num_delegations;
 373 unsigned long max_delegations;
 374
 375 /*
 376  * Open owner state (share locks)
 377  */
 378
 379 /* hash tables for lock and open owners */
 380 #define OWNER_HASH_BITS              8
 381 #define OWNER_HASH_SIZE             (1 << OWNER_HASH_BITS)
 382 #define OWNER_HASH_MASK             (OWNER_HASH_SIZE - 1)
 383
 384 static unsigned int ownerstr_hashval(struct xdr_netobj *ownername)
 385 {
 386         unsigned int ret;
 387
 388         ret = opaque_hashval(ownername->data, ownername->len);
 389         return ret & OWNER_HASH_MASK;
 390 }
 391
 392 /* hash table for nfs4_file */
 393 #define FILE_HASH_BITS                   8
 394 #define FILE_HASH_SIZE                  (1 << FILE_HASH_BITS)
 395
 396 static unsigned int nfsd_fh_hashval(struct knfsd_fh *fh)
 397 {
 398         return jhash2(fh->fh_base.fh_pad, XDR_QUADLEN(fh->fh_size), 0);
 399 }
 400
 401 static unsigned int file_hashval(struct knfsd_fh *fh)
 402 {
 403         return nfsd_fh_hashval(fh) & (FILE_HASH_SIZE - 1);
 404 }
 405
 406 static bool nfsd_fh_match(struct knfsd_fh *fh1, struct knfsd_fh *fh2)
 407 {
 408         return fh1->fh_size == fh2->fh_size &&
 409                 !memcmp(fh1->fh_base.fh_pad,
 410                                 fh2->fh_base.fh_pad,
 411                                 fh1->fh_size);
 412 }
 413
 414 static struct hlist_head file_hashtbl[FILE_HASH_SIZE];
 415
 416 static void
 417 __nfs4_file_get_access(struct nfs4_file *fp, u32 access)
 418 {
 419         lockdep_assert_held(&fp->fi_lock);
 420
 421         if (access & NFS4_SHARE_ACCESS_WRITE)
 422                 atomic_inc(&fp->fi_access[O_WRONLY]);
 423         if (access & NFS4_SHARE_ACCESS_READ)
 424                 atomic_inc(&fp->fi_access[O_RDONLY]);
 425 }
 426
 427 static __be32
 428 nfs4_file_get_access(struct nfs4_file *fp, u32 access)
 429 {
 430         lockdep_assert_held(&fp->fi_lock);
 431
 432         /* Does this access mode make sense? */
 433         if (access & ~NFS4_SHARE_ACCESS_BOTH)
 434                 return nfserr_inval;
 435
 436         /* Does it conflict with a deny mode already set? */
 437         if ((access & fp->fi_share_deny) != 0)
 438                 return nfserr_share_denied;
 439
 440         __nfs4_file_get_access(fp, access);
 441         return nfs_ok;
 442 }
 443
 444 static __be32 nfs4_file_check_deny(struct nfs4_file *fp, u32 deny)
 445 {
 446         /* Common case is that there is no deny mode. */
 447         if (deny) {
 448                 /* Does this deny mode make sense? */
 449                 if (deny & ~NFS4_SHARE_DENY_BOTH)
 450                         return nfserr_inval;
 451
 452                 if ((deny & NFS4_SHARE_DENY_READ) &&
 453                     atomic_read(&fp->fi_access[O_RDONLY]))
 454                         return nfserr_share_denied;
 455
 456                 if ((deny & NFS4_SHARE_DENY_WRITE) &&
 457                     atomic_read(&fp->fi_access[O_WRONLY]))
 458                         return nfserr_share_denied;
 459         }
 460         return nfs_ok;
 461 }
 462
 463 static void __nfs4_file_put_access(struct nfs4_file *fp, int oflag)
 464 {
 465         might_lock(&fp->fi_lock);
 466
 467         if (atomic_dec_and_lock(&fp->fi_access[oflag], &fp->fi_lock)) {
 468                 struct file *f1 = NULL;
 469                 struct file *f2 = NULL;
 470
 471                 swap(f1, fp->fi_fds[oflag]);
 472                 if (atomic_read(&fp->fi_access[1 - oflag]) == 0)
 473                         swap(f2, fp->fi_fds[O_RDWR]);
 474                 spin_unlock(&fp->fi_lock);
 475                 if (f1)
 476                         fput(f1);
 477                 if (f2)
 478                         fput(f2);
 479         }
 480 }
 481
 482 static void nfs4_file_put_access(struct nfs4_file *fp, u32 access)
 483 {
 484         WARN_ON_ONCE(access & ~NFS4_SHARE_ACCESS_BOTH);
 485
 486         if (access & NFS4_SHARE_ACCESS_WRITE)
 487                 __nfs4_file_put_access(fp, O_WRONLY);
 488         if (access & NFS4_SHARE_ACCESS_READ)
 489                 __nfs4_file_put_access(fp, O_RDONLY);
 490 }
 491
 492 static struct nfs4_stid *nfs4_alloc_stid(struct nfs4_client *cl,
 493                                          struct kmem_cache *slab)
 494 {
 495         struct nfs4_stid *stid;
 496         int new_id;
 497
 498         stid = kmem_cache_zalloc(slab, GFP_KERNEL);
 499         if (!stid)
 500                 return NULL;
 501
 502         idr_preload(GFP_KERNEL);
 503         spin_lock(&cl->cl_lock);
 504         new_id = idr_alloc_cyclic(&cl->cl_stateids, stid, 0, 0, GFP_NOWAIT);
 505         spin_unlock(&cl->cl_lock);
 506         idr_preload_end();
 507         if (new_id < 0)
 508                 goto out_free;
 509         stid->sc_client = cl;
 510         stid->sc_stateid.si_opaque.so_id = new_id;
 511         stid->sc_stateid.si_opaque.so_clid = cl->cl_clientid;
 512         /* Will be incremented before return to client: */
 513         atomic_set(&stid->sc_count, 1);
 514
 515         /*
 516          * It shouldn't be a problem to reuse an opaque stateid value.
 517          * I don't think it is for 4.1.  But with 4.0 I worry that, for
 518          * example, a stray write retransmission could be accepted by
 519          * the server when it should have been rejected.  Therefore,
 520          * adopt a trick from the sctp code to attempt to maximize the
 521          * amount of time until an id is reused, by ensuring they always
 522          * "increase" (mod INT_MAX):
 523          */
 524         return stid;
 525 out_free:
 526         kmem_cache_free(slab, stid);
 527         return NULL;
 528 }
 529
 530 static struct nfs4_ol_stateid * nfs4_alloc_open_stateid(struct nfs4_client *clp)
 531 {
 532         struct nfs4_stid *stid;
 533         struct nfs4_ol_stateid *stp;
 534
 535         stid = nfs4_alloc_stid(clp, stateid_slab);
 536         if (!stid)
 537                 return NULL;
 538
 539         stp = openlockstateid(stid);
 540         stp->st_stid.sc_free = nfs4_free_ol_stateid;
 541         return stp;
 542 }
 543
 544 static void nfs4_free_deleg(struct nfs4_stid *stid)
 545 {
 546         kmem_cache_free(deleg_slab, stid);
 547         atomic_long_dec(&num_delegations);
 548 }
 549
 550 /*
 551  * When we recall a delegation, we should be careful not to hand it
 552  * out again straight away.
 553  * To ensure this we keep a pair of bloom filters ('new' and 'old')
 554  * in which the filehandles of recalled delegations are "stored".
 555  * If a filehandle appear in either filter, a delegation is blocked.
 556  * When a delegation is recalled, the filehandle is stored in the "new"
 557  * filter.
 558  * Every 30 seconds we swap the filters and clear the "new" one,
 559  * unless both are empty of course.
 560  *
 561  * Each filter is 256 bits.  We hash the filehandle to 32bit and use the
 562  * low 3 bytes as hash-table indices.
 563  *
 564  * 'blocked_delegations_lock', which is always taken in block_delegations(),
 565  * is used to manage concurrent access.  Testing does not need the lock
 566  * except when swapping the two filters.
 567  */
 568 static DEFINE_SPINLOCK(blocked_delegations_lock);
 569 static struct bloom_pair {
 570         int     entries, old_entries;
 571         time_t  swap_time;
 572         int     new; /* index into 'set' */
 573         DECLARE_BITMAP(set[2], 256);
 574 } blocked_delegations;
 575
 576 static int delegation_blocked(struct knfsd_fh *fh)
 577 {
 578         u32 hash;
 579         struct bloom_pair *bd = &blocked_delegations;
 580
 581         if (bd->entries == 0)
 582                 return 0;
 583         if (seconds_since_boot() - bd->swap_time > 30) {
 584                 spin_lock(&blocked_delegations_lock);
 585                 if (seconds_since_boot() - bd->swap_time > 30) {
 586                         bd->entries -= bd->old_entries;
 587                         bd->old_entries = bd->entries;
 588                         memset(bd->set[bd->new], 0,
 589                                sizeof(bd->set[0]));
 590                         bd->new = 1-bd->new;
 591                         bd->swap_time = seconds_since_boot();
 592                 }
 593                 spin_unlock(&blocked_delegations_lock);
 594         }
 595         hash = arch_fast_hash(&fh->fh_base, fh->fh_size, 0);
 596         if (test_bit(hash&255, bd->set[0]) &&
 597             test_bit((hash>>8)&255, bd->set[0]) &&
 598             test_bit((hash>>16)&255, bd->set[0]))
 599                 return 1;
 600
 601         if (test_bit(hash&255, bd->set[1]) &&
 602             test_bit((hash>>8)&255, bd->set[1]) &&
 603             test_bit((hash>>16)&255, bd->set[1]))
 604                 return 1;
 605
 606         return 0;
 607 }
 608
 609 static void block_delegations(struct knfsd_fh *fh)
 610 {
 611         u32 hash;
 612         struct bloom_pair *bd = &blocked_delegations;
 613
 614         hash = arch_fast_hash(&fh->fh_base, fh->fh_size, 0);
 615
 616         spin_lock(&blocked_delegations_lock);
 617         __set_bit(hash&255, bd->set[bd->new]);
 618         __set_bit((hash>>8)&255, bd->set[bd->new]);
 619         __set_bit((hash>>16)&255, bd->set[bd->new]);
 620         if (bd->entries == 0)
 621                 bd->swap_time = seconds_since_boot();
 622         bd->entries += 1;
 623         spin_unlock(&blocked_delegations_lock);
 624 }
 625
 626 static struct nfs4_delegation *
 627 alloc_init_deleg(struct nfs4_client *clp, struct svc_fh *current_fh)
 628 {
 629         struct nfs4_delegation *dp;
 630         long n;
 631
 632         dprintk("NFSD alloc_init_deleg\n");
 633         n = atomic_long_inc_return(&num_delegations);
 634         if (n < 0 || n > max_delegations)
 635                 goto out_dec;
 636         if (delegation_blocked(&current_fh->fh_handle))
 637                 goto out_dec;
 638         dp = delegstateid(nfs4_alloc_stid(clp, deleg_slab));
 639         if (dp == NULL)
 640                 goto out_dec;
 641
 642         dp->dl_stid.sc_free = nfs4_free_deleg;
 643         /*
 644          * delegation seqid's are never incremented.  The 4.1 special
 645          * meaning of seqid 0 isn't meaningful, really, but let's avoid
 646          * 0 anyway just for consistency and use 1:
 647          */
 648         dp->dl_stid.sc_stateid.si_generation = 1;
 649         INIT_LIST_HEAD(&dp->dl_perfile);
 650         INIT_LIST_HEAD(&dp->dl_perclnt);
 651         INIT_LIST_HEAD(&dp->dl_recall_lru);
 652         dp->dl_type = NFS4_OPEN_DELEGATE_READ;
 653         INIT_WORK(&dp->dl_recall.cb_work, nfsd4_run_cb_recall);
 654         return dp;
 655 out_dec:
 656         atomic_long_dec(&num_delegations);
 657         return NULL;
 658 }
 659
 660 void
 661 nfs4_put_stid(struct nfs4_stid *s)
 662 {
 663         struct nfs4_file *fp = s->sc_file;
 664         struct nfs4_client *clp = s->sc_client;
 665
 666         might_lock(&clp->cl_lock);
 667
 668         if (!atomic_dec_and_lock(&s->sc_count, &clp->cl_lock)) {
 669                 wake_up_all(&close_wq);
 670                 return;
 671         }
 672         idr_remove(&clp->cl_stateids, s->sc_stateid.si_opaque.so_id);
 673         spin_unlock(&clp->cl_lock);
 674         s->sc_free(s);
 675         if (fp)
 676                 put_nfs4_file(fp);
 677 }
 678
 679 static void nfs4_put_deleg_lease(struct nfs4_file *fp)
 680 {
 681         struct file *filp = NULL;
 682
 683         spin_lock(&fp->fi_lock);
 684         if (fp->fi_deleg_file && atomic_dec_and_test(&fp->fi_delegees))
 685                 swap(filp, fp->fi_deleg_file);
 686         spin_unlock(&fp->fi_lock);
 687
 688         if (filp) {
 689                 vfs_setlease(filp, F_UNLCK, NULL, NULL);
 690                 fput(filp);
 691         }
 692 }
 693
 694 static void unhash_stid(struct nfs4_stid *s)
 695 {
 696         s->sc_type = 0;
 697 }
 698
 699 static void
 700 hash_delegation_locked(struct nfs4_delegation *dp, struct nfs4_file *fp)
 701 {
 702         lockdep_assert_held(&state_lock);
 703         lockdep_assert_held(&fp->fi_lock);
 704
 705         atomic_inc(&dp->dl_stid.sc_count);
 706         dp->dl_stid.sc_type = NFS4_DELEG_STID;
 707         list_add(&dp->dl_perfile, &fp->fi_delegations);
 708         list_add(&dp->dl_perclnt, &dp->dl_stid.sc_client->cl_delegations);
 709 }
 710
 711 static void
 712 unhash_delegation_locked(struct nfs4_delegation *dp)
 713 {
 714         struct nfs4_file *fp = dp->dl_stid.sc_file;
 715
 716         lockdep_assert_held(&state_lock);
 717
 718         dp->dl_stid.sc_type = NFS4_CLOSED_DELEG_STID;
 719         /* Ensure that deleg break won't try to requeue it */
 720         ++dp->dl_time;
 721         spin_lock(&fp->fi_lock);
 722         list_del_init(&dp->dl_perclnt);
 723         list_del_init(&dp->dl_recall_lru);
 724         list_del_init(&dp->dl_perfile);
 725         spin_unlock(&fp->fi_lock);
 726 }
 727
 728 static void destroy_delegation(struct nfs4_delegation *dp)
 729 {
 730         spin_lock(&state_lock);
 731         unhash_delegation_locked(dp);
 732         spin_unlock(&state_lock);
 733         nfs4_put_deleg_lease(dp->dl_stid.sc_file);
 734         nfs4_put_stid(&dp->dl_stid);
 735 }
 736
 737 static void revoke_delegation(struct nfs4_delegation *dp)
 738 {
 739         struct nfs4_client *clp = dp->dl_stid.sc_client;
 740
 741         WARN_ON(!list_empty(&dp->dl_recall_lru));
 742
 743         nfs4_put_deleg_lease(dp->dl_stid.sc_file);
 744
 745         if (clp->cl_minorversion == 0)
 746                 nfs4_put_stid(&dp->dl_stid);
 747         else {
 748                 dp->dl_stid.sc_type = NFS4_REVOKED_DELEG_STID;
 749                 spin_lock(&clp->cl_lock);
 750                 list_add(&dp->dl_recall_lru, &clp->cl_revoked);
 751                 spin_unlock(&clp->cl_lock);
 752         }
 753 }
 754
 755 /*
 756  * SETCLIENTID state
 757  */
 758
 759 static unsigned int clientid_hashval(u32 id)
 760 {
 761         return id & CLIENT_HASH_MASK;
 762 }
 763
 764 static unsigned int clientstr_hashval(const char *name)
 765 {
 766         return opaque_hashval(name, 8) & CLIENT_HASH_MASK;
 767 }
 768
 769 /*
 770  * We store the NONE, READ, WRITE, and BOTH bits separately in the
 771  * st_{access,deny}_bmap field of the stateid, in order to track not
 772  * only what share bits are currently in force, but also what
 773  * combinations of share bits previous opens have used.  This allows us
 774  * to enforce the recommendation of rfc 3530 14.2.19 that the server
 775  * return an error if the client attempt to downgrade to a combination
 776  * of share bits not explicable by closing some of its previous opens.
 777  *
 778  * XXX: This enforcement is actually incomplete, since we don't keep
 779  * track of access/deny bit combinations; so, e.g., we allow:
 780  *
 781  *      OPEN allow read, deny write
 782  *      OPEN allow both, deny none
 783  *      DOWNGRADE allow read, deny none
 784  *
 785  * which we should reject.
 786  */
 787 static unsigned int
 788 bmap_to_share_mode(unsigned long bmap) {
 789         int i;
 790         unsigned int access = 0;
 791
 792         for (i = 1; i < 4; i++) {
 793                 if (test_bit(i, &bmap))
 794                         access |= i;
 795         }
 796         return access;
 797 }
 798
 799 /* set share access for a given stateid */
 800 static inline void
 801 set_access(u32 access, struct nfs4_ol_stateid *stp)
 802 {
 803         unsigned char mask = 1 << access;
 804
 805         WARN_ON_ONCE(access > NFS4_SHARE_ACCESS_BOTH);
 806         stp->st_access_bmap |= mask;
 807 }
 808
 809 /* clear share access for a given stateid */
 810 static inline void
 811 clear_access(u32 access, struct nfs4_ol_stateid *stp)
 812 {
 813         unsigned char mask = 1 << access;
 814
 815         WARN_ON_ONCE(access > NFS4_SHARE_ACCESS_BOTH);
 816         stp->st_access_bmap &= ~mask;
 817 }
 818
 819 /* test whether a given stateid has access */
 820 static inline bool
 821 test_access(u32 access, struct nfs4_ol_stateid *stp)
 822 {
 823         unsigned char mask = 1 << access;
 824
 825         return (bool)(stp->st_access_bmap & mask);
 826 }
 827
 828 /* set share deny for a given stateid */
 829 static inline void
 830 set_deny(u32 deny, struct nfs4_ol_stateid *stp)
 831 {
 832         unsigned char mask = 1 << deny;
 833
 834         WARN_ON_ONCE(deny > NFS4_SHARE_DENY_BOTH);
 835         stp->st_deny_bmap |= mask;
 836 }
 837
 838 /* clear share deny for a given stateid */
 839 static inline void
 840 clear_deny(u32 deny, struct nfs4_ol_stateid *stp)
 841 {
 842         unsigned char mask = 1 << deny;
 843
 844         WARN_ON_ONCE(deny > NFS4_SHARE_DENY_BOTH);
 845         stp->st_deny_bmap &= ~mask;
 846 }
 847
 848 /* test whether a given stateid is denying specific access */
 849 static inline bool
 850 test_deny(u32 deny, struct nfs4_ol_stateid *stp)
 851 {
 852         unsigned char mask = 1 << deny;
 853
 854         return (bool)(stp->st_deny_bmap & mask);
 855 }
 856
 857 static int nfs4_access_to_omode(u32 access)
 858 {
 859         switch (access & NFS4_SHARE_ACCESS_BOTH) {
 860         case NFS4_SHARE_ACCESS_READ:
 861                 return O_RDONLY;
 862         case NFS4_SHARE_ACCESS_WRITE:
 863                 return O_WRONLY;
 864         case NFS4_SHARE_ACCESS_BOTH:
 865                 return O_RDWR;
 866         }
 867         WARN_ON_ONCE(1);
 868         return O_RDONLY;
 869 }
 870
 871 /*
 872  * A stateid that had a deny mode associated with it is being released
 873  * or downgraded. Recalculate the deny mode on the file.
 874  */
 875 static void
 876 recalculate_deny_mode(struct nfs4_file *fp)
 877 {
 878         struct nfs4_ol_stateid *stp;
 879
 880         spin_lock(&fp->fi_lock);
 881         fp->fi_share_deny = 0;
 882         list_for_each_entry(stp, &fp->fi_stateids, st_perfile)
 883                 fp->fi_share_deny |= bmap_to_share_mode(stp->st_deny_bmap);
 884         spin_unlock(&fp->fi_lock);
 885 }
 886
 887 static void
 888 reset_union_bmap_deny(u32 deny, struct nfs4_ol_stateid *stp)
 889 {
 890         int i;
 891         bool change = false;
 892
 893         for (i = 1; i < 4; i++) {
 894                 if ((i & deny) != i) {
 895                         change = true;
 896                         clear_deny(i, stp);
 897                 }
 898         }
 899
 900         /* Recalculate per-file deny mode if there was a change */
 901         if (change)
 902                 recalculate_deny_mode(stp->st_stid.sc_file);
 903 }
 904
 905 /* release all access and file references for a given stateid */
 906 static void
 907 release_all_access(struct nfs4_ol_stateid *stp)
 908 {
 909         int i;
 910         struct nfs4_file *fp = stp->st_stid.sc_file;
 911
 912         if (fp && stp->st_deny_bmap != 0)
 913                 recalculate_deny_mode(fp);
 914
 915         for (i = 1; i < 4; i++) {
 916                 if (test_access(i, stp))
 917                         nfs4_file_put_access(stp->st_stid.sc_file, i);
 918                 clear_access(i, stp);
 919         }
 920 }
 921
 922 static void nfs4_put_stateowner(struct nfs4_stateowner *sop)
 923 {
 924         struct nfs4_client *clp = sop->so_client;
 925
 926         might_lock(&clp->cl_lock);
 927
 928         if (!atomic_dec_and_lock(&sop->so_count, &clp->cl_lock))
 929                 return;
 930         sop->so_ops->so_unhash(sop);
 931         spin_unlock(&clp->cl_lock);
 932         kfree(sop->so_owner.data);
 933         sop->so_ops->so_free(sop);
 934 }
 935
 936 static void unhash_ol_stateid(struct nfs4_ol_stateid *stp)
 937 {
 938         struct nfs4_file *fp = stp->st_stid.sc_file;
 939
 940         lockdep_assert_held(&stp->st_stateowner->so_client->cl_lock);
 941
 942         spin_lock(&fp->fi_lock);
 943         list_del(&stp->st_perfile);
 944         spin_unlock(&fp->fi_lock);
 945         list_del(&stp->st_perstateowner);
 946 }
 947
 948 static void nfs4_free_ol_stateid(struct nfs4_stid *stid)
 949 {
 950         struct nfs4_ol_stateid *stp = openlockstateid(stid);
 951
 952         release_all_access(stp);
 953         if (stp->st_stateowner)
 954                 nfs4_put_stateowner(stp->st_stateowner);
 955         kmem_cache_free(stateid_slab, stid);
 956 }
 957
 958 static void nfs4_free_lock_stateid(struct nfs4_stid *stid)
 959 {
 960         struct nfs4_ol_stateid *stp = openlockstateid(stid);
 961         struct nfs4_lockowner *lo = lockowner(stp->st_stateowner);
 962         struct file *file;
 963
 964         file = find_any_file(stp->st_stid.sc_file);
 965         if (file)
 966                 filp_close(file, (fl_owner_t)lo);
 967         nfs4_free_ol_stateid(stid);
 968 }
 969
 970 /*
 971  * Put the persistent reference to an already unhashed generic stateid, while
 972  * holding the cl_lock. If it's the last reference, then put it onto the
 973  * reaplist for later destruction.
 974  */
 975 static void put_ol_stateid_locked(struct nfs4_ol_stateid *stp,
 976                                        struct list_head *reaplist)
 977 {
 978         struct nfs4_stid *s = &stp->st_stid;
 979         struct nfs4_client *clp = s->sc_client;
 980
 981         lockdep_assert_held(&clp->cl_lock);
 982
 983         WARN_ON_ONCE(!list_empty(&stp->st_locks));
 984
 985         if (!atomic_dec_and_test(&s->sc_count)) {
 986                 wake_up_all(&close_wq);
 987                 return;
 988         }
 989
 990         idr_remove(&clp->cl_stateids, s->sc_stateid.si_opaque.so_id);
 991         list_add(&stp->st_locks, reaplist);
 992 }
 993
 994 static void unhash_lock_stateid(struct nfs4_ol_stateid *stp)
 995 {
 996         struct nfs4_openowner *oo = openowner(stp->st_openstp->st_stateowner);
 997
 998         lockdep_assert_held(&oo->oo_owner.so_client->cl_lock);
 999
1000         list_del_init(&stp->st_locks);
1001         unhash_ol_stateid(stp);
1002         unhash_stid(&stp->st_stid);
1003 }
1004
1005 static void release_lock_stateid(struct nfs4_ol_stateid *stp)
1006 {
1007         struct nfs4_openowner *oo = openowner(stp->st_openstp->st_stateowner);
1008
1009         spin_lock(&oo->oo_owner.so_client->cl_lock);
1010         unhash_lock_stateid(stp);
1011         spin_unlock(&oo->oo_owner.so_client->cl_lock);
1012         nfs4_put_stid(&stp->st_stid);
1013 }
1014
1015 static void unhash_lockowner_locked(struct nfs4_lockowner *lo)
1016 {
1017         struct nfs4_client *clp = lo->lo_owner.so_client;
1018
1019         lockdep_assert_held(&clp->cl_lock);
1020
1021         list_del_init(&lo->lo_owner.so_strhash);
1022 }
1023
1024 /*
1025  * Free a list of generic stateids that were collected earlier after being
1026  * fully unhashed.
1027  */
1028 static void
1029 free_ol_stateid_reaplist(struct list_head *reaplist)
1030 {
1031         struct nfs4_ol_stateid *stp;
1032         struct nfs4_file *fp;
1033
1034         might_sleep();
1035
1036         while (!list_empty(reaplist)) {
1037                 stp = list_first_entry(reaplist, struct nfs4_ol_stateid,
1038                                        st_locks);
1039                 list_del(&stp->st_locks);
1040                 fp = stp->st_stid.sc_file;
1041                 stp->st_stid.sc_free(&stp->st_stid);
1042                 if (fp)
1043                         put_nfs4_file(fp);
1044         }
1045 }
1046
1047 static void release_lockowner(struct nfs4_lockowner *lo)
1048 {
1049         struct nfs4_client *clp = lo->lo_owner.so_client;
1050         struct nfs4_ol_stateid *stp;
1051         struct list_head reaplist;
1052
1053         INIT_LIST_HEAD(&reaplist);
1054
1055         spin_lock(&clp->cl_lock);
1056         unhash_lockowner_locked(lo);
1057         while (!list_empty(&lo->lo_owner.so_stateids)) {
1058                 stp = list_first_entry(&lo->lo_owner.so_stateids,
1059                                 struct nfs4_ol_stateid, st_perstateowner);
1060                 unhash_lock_stateid(stp);
1061                 put_ol_stateid_locked(stp, &reaplist);
1062         }
1063         spin_unlock(&clp->cl_lock);
1064         free_ol_stateid_reaplist(&reaplist);
1065         nfs4_put_stateowner(&lo->lo_owner);
1066 }
1067
1068 static void release_open_stateid_locks(struct nfs4_ol_stateid *open_stp,
1069                                        struct list_head *reaplist)
1070 {
1071         struct nfs4_ol_stateid *stp;
1072
1073         while (!list_empty(&open_stp->st_locks)) {
1074                 stp = list_entry(open_stp->st_locks.next,
1075                                 struct nfs4_ol_stateid, st_locks);
1076                 unhash_lock_stateid(stp);
1077                 put_ol_stateid_locked(stp, reaplist);
1078         }
1079 }
1080
1081 static void unhash_open_stateid(struct nfs4_ol_stateid *stp,
1082                                 struct list_head *reaplist)
1083 {
1084         lockdep_assert_held(&stp->st_stid.sc_client->cl_lock);
1085
1086         unhash_ol_stateid(stp);
1087         release_open_stateid_locks(stp, reaplist);
1088 }
1089
1090 static void release_open_stateid(struct nfs4_ol_stateid *stp)
1091 {
1092         LIST_HEAD(reaplist);
1093
1094         spin_lock(&stp->st_stid.sc_client->cl_lock);
1095         unhash_open_stateid(stp, &reaplist);
1096         put_ol_stateid_locked(stp, &reaplist);
1097         spin_unlock(&stp->st_stid.sc_client->cl_lock);
1098         free_ol_stateid_reaplist(&reaplist);
1099 }
1100
1101 static void unhash_openowner_locked(struct nfs4_openowner *oo)
1102 {
1103         struct nfs4_client *clp = oo->oo_owner.so_client;
1104
1105         lockdep_assert_held(&clp->cl_lock);
1106
1107         list_del_init(&oo->oo_owner.so_strhash);
1108         list_del_init(&oo->oo_perclient);
1109 }
1110
1111 static void release_last_closed_stateid(struct nfs4_openowner *oo)
1112 {
1113         struct nfsd_net *nn = net_generic(oo->oo_owner.so_client->net,
1114                                           nfsd_net_id);
1115         struct nfs4_ol_stateid *s;
1116
1117         spin_lock(&nn->client_lock);
1118         s = oo->oo_last_closed_stid;
1119         if (s) {
1120                 list_del_init(&oo->oo_close_lru);
1121                 oo->oo_last_closed_stid = NULL;
1122         }
1123         spin_unlock(&nn->client_lock);
1124         if (s)
1125                 nfs4_put_stid(&s->st_stid);
1126 }
1127
1128 static void release_openowner(struct nfs4_openowner *oo)
1129 {
1130         struct nfs4_ol_stateid *stp;
1131         struct nfs4_client *clp = oo->oo_owner.so_client;
1132         struct list_head reaplist;
1133
1134         INIT_LIST_HEAD(&reaplist);
1135
1136         spin_lock(&clp->cl_lock);
1137         unhash_openowner_locked(oo);
1138         while (!list_empty(&oo->oo_owner.so_stateids)) {
1139                 stp = list_first_entry(&oo->oo_owner.so_stateids,
1140                                 struct nfs4_ol_stateid, st_perstateowner);
1141                 unhash_open_stateid(stp, &reaplist);
1142                 put_ol_stateid_locked(stp, &reaplist);
1143         }
1144         spin_unlock(&clp->cl_lock);
1145         free_ol_stateid_reaplist(&reaplist);
1146         release_last_closed_stateid(oo);
1147         nfs4_put_stateowner(&oo->oo_owner);
1148 }
1149
1150 static inline int
1151 hash_sessionid(struct nfs4_sessionid *sessionid)
1152 {
1153         struct nfsd4_sessionid *sid = (struct nfsd4_sessionid *)sessionid;
1154
1155         return sid->sequence % SESSION_HASH_SIZE;
1156 }
1157
1158 #ifdef NFSD_DEBUG
1159 static inline void
1160 dump_sessionid(const char *fn, struct nfs4_sessionid *sessionid)
1161 {
1162         u32 *ptr = (u32 *)(&sessionid->data[0]);
1163         dprintk("%s: %u:%u:%u:%u\n", fn, ptr[0], ptr[1], ptr[2], ptr[3]);
1164 }
1165 #else
1166 static inline void
1167 dump_sessionid(const char *fn, struct nfs4_sessionid *sessionid)
1168 {
1169 }
1170 #endif
1171
1172 /*
1173  * Bump the seqid on cstate->replay_owner, and clear replay_owner if it
1174  * won't be used for replay.
1175  */
1176 void nfsd4_bump_seqid(struct nfsd4_compound_state *cstate, __be32 nfserr)
1177 {
1178         struct nfs4_stateowner *so = cstate->replay_owner;
1179
1180         if (nfserr == nfserr_replay_me)
1181                 return;
1182
1183         if (!seqid_mutating_err(ntohl(nfserr))) {
1184                 nfsd4_cstate_clear_replay(cstate);
1185                 return;
1186         }
1187         if (!so)
1188                 return;
1189         if (so->so_is_open_owner)
1190                 release_last_closed_stateid(openowner(so));
1191         so->so_seqid++;
1192         return;
1193 }
1194
1195 static void
1196 gen_sessionid(struct nfsd4_session *ses)
1197 {
1198         struct nfs4_client *clp = ses->se_client;
1199         struct nfsd4_sessionid *sid;
1200
1201         sid = (struct nfsd4_sessionid *)ses->se_sessionid.data;
1202         sid->clientid = clp->cl_clientid;
1203         sid->sequence = current_sessionid++;
1204         sid->reserved = 0;
1205 }
1206
1207 /*
1208  * The protocol defines ca_maxresponssize_cached to include the size of
1209  * the rpc header, but all we need to cache is the data starting after
1210  * the end of the initial SEQUENCE operation--the rest we regenerate
1211  * each time.  Therefore we can advertise a ca_maxresponssize_cached
1212  * value that is the number of bytes in our cache plus a few additional
1213  * bytes.  In order to stay on the safe side, and not promise more than
1214  * we can cache, those additional bytes must be the minimum possible: 24
1215  * bytes of rpc header (xid through accept state, with AUTH_NULL
1216  * verifier), 12 for the compound header (with zero-length tag), and 44
1217  * for the SEQUENCE op response:
1218  */
1219 #define NFSD_MIN_HDR_SEQ_SZ  (24 + 12 + 44)
1220
1221 static void
1222 free_session_slots(struct nfsd4_session *ses)
1223 {
1224         int i;
1225
1226         for (i = 0; i < ses->se_fchannel.maxreqs; i++)
1227                 kfree(ses->se_slots[i]);
1228 }
1229
1230 /*
1231  * We don't actually need to cache the rpc and session headers, so we
1232  * can allocate a little less for each slot:
1233  */
1234 static inline u32 slot_bytes(struct nfsd4_channel_attrs *ca)
1235 {
1236         u32 size;
1237
1238         if (ca->maxresp_cached < NFSD_MIN_HDR_SEQ_SZ)
1239                 size = 0;
1240         else
1241                 size = ca->maxresp_cached - NFSD_MIN_HDR_SEQ_SZ;
1242         return size + sizeof(struct nfsd4_slot);
1243 }
1244
1245 /*
1246  * XXX: If we run out of reserved DRC memory we could (up to a point)
1247  * re-negotiate active sessions and reduce their slot usage to make
1248  * room for new connections. For now we just fail the create session.
1249  */
1250 static u32 nfsd4_get_drc_mem(struct nfsd4_channel_attrs *ca)
1251 {
1252         u32 slotsize = slot_bytes(ca);
1253         u32 num = ca->maxreqs;
1254         int avail;
1255
1256         spin_lock(&nfsd_drc_lock);
1257         avail = min((unsigned long)NFSD_MAX_MEM_PER_SESSION,
1258                     nfsd_drc_max_mem - nfsd_drc_mem_used);
1259         num = min_t(int, num, avail / slotsize);
1260         nfsd_drc_mem_used += num * slotsize;
1261         spin_unlock(&nfsd_drc_lock);
1262
1263         return num;
1264 }
1265
1266 static void nfsd4_put_drc_mem(struct nfsd4_channel_attrs *ca)
1267 {
1268         int slotsize = slot_bytes(ca);
1269
1270         spin_lock(&nfsd_drc_lock);
1271         nfsd_drc_mem_used -= slotsize * ca->maxreqs;
1272         spin_unlock(&nfsd_drc_lock);
1273 }
1274
1275 static struct nfsd4_session *alloc_session(struct nfsd4_channel_attrs *fattrs,
1276                                            struct nfsd4_channel_attrs *battrs)
1277 {
1278         int numslots = fattrs->maxreqs;
1279         int slotsize = slot_bytes(fattrs);
1280         struct nfsd4_session *new;
1281         int mem, i;
1282
1283         BUILD_BUG_ON(NFSD_MAX_SLOTS_PER_SESSION * sizeof(struct nfsd4_slot *)
1284                         + sizeof(struct nfsd4_session) > PAGE_SIZE);
1285         mem = numslots * sizeof(struct nfsd4_slot *);
1286
1287         new = kzalloc(sizeof(*new) + mem, GFP_KERNEL);
1288         if (!new)
1289                 return NULL;
1290         /* allocate each struct nfsd4_slot and data cache in one piece */
1291         for (i = 0; i < numslots; i++) {
1292                 new->se_slots[i] = kzalloc(slotsize, GFP_KERNEL);
1293                 if (!new->se_slots[i])
1294                         goto out_free;
1295         }
1296
1297         memcpy(&new->se_fchannel, fattrs, sizeof(struct nfsd4_channel_attrs));
1298         memcpy(&new->se_bchannel, battrs, sizeof(struct nfsd4_channel_attrs));
1299
1300         return new;
1301 out_free:
1302         while (i--)
1303                 kfree(new->se_slots[i]);
1304         kfree(new);
1305         return NULL;
1306 }
1307
1308 static void free_conn(struct nfsd4_conn *c)
1309 {
1310         svc_xprt_put(c->cn_xprt);
1311         kfree(c);
1312 }
1313
1314 static void nfsd4_conn_lost(struct svc_xpt_user *u)
1315 {
1316         struct nfsd4_conn *c = container_of(u, struct nfsd4_conn, cn_xpt_user);
1317         struct nfs4_client *clp = c->cn_session->se_client;
1318
1319         spin_lock(&clp->cl_lock);
1320         if (!list_empty(&c->cn_persession)) {
1321                 list_del(&c->cn_persession);
1322                 free_conn(c);
1323         }
1324         nfsd4_probe_callback(clp);
1325         spin_unlock(&clp->cl_lock);
1326 }
1327
1328 static struct nfsd4_conn *alloc_conn(struct svc_rqst *rqstp, u32 flags)
1329 {
1330         struct nfsd4_conn *conn;
1331
1332         conn = kmalloc(sizeof(struct nfsd4_conn), GFP_KERNEL);
1333         if (!conn)
1334                 return NULL;
1335         svc_xprt_get(rqstp->rq_xprt);
1336         conn->cn_xprt = rqstp->rq_xprt;
1337         conn->cn_flags = flags;
1338         INIT_LIST_HEAD(&conn->cn_xpt_user.list);
1339         return conn;
1340 }
1341
1342 static void __nfsd4_hash_conn(struct nfsd4_conn *conn, struct nfsd4_session *ses)
1343 {
1344         conn->cn_session = ses;
1345         list_add(&conn->cn_persession, &ses->se_conns);
1346 }
1347
1348 static void nfsd4_hash_conn(struct nfsd4_conn *conn, struct nfsd4_session *ses)
1349 {
1350         struct nfs4_client *clp = ses->se_client;
1351
1352         spin_lock(&clp->cl_lock);
1353         __nfsd4_hash_conn(conn, ses);
1354         spin_unlock(&clp->cl_lock);
1355 }
1356
1357 static int nfsd4_register_conn(struct nfsd4_conn *conn)
1358 {
1359         conn->cn_xpt_user.callback = nfsd4_conn_lost;
1360         return register_xpt_user(conn->cn_xprt, &conn->cn_xpt_user);
1361 }
1362
1363 static void nfsd4_init_conn(struct svc_rqst *rqstp, struct nfsd4_conn *conn, struct nfsd4_session *ses)
1364 {
1365         int ret;
1366
1367         nfsd4_hash_conn(conn, ses);
1368         ret = nfsd4_register_conn(conn);
1369         if (ret)
1370                 /* oops; xprt is already down: */
1371                 nfsd4_conn_lost(&conn->cn_xpt_user);
1372         /* We may have gained or lost a callback channel: */
1373         nfsd4_probe_callback_sync(ses->se_client);
1374 }
1375
1376 static struct nfsd4_conn *alloc_conn_from_crses(struct svc_rqst *rqstp, struct nfsd4_create_session *cses)
1377 {
1378         u32 dir = NFS4_CDFC4_FORE;
1379
1380         if (cses->flags & SESSION4_BACK_CHAN)
1381                 dir |= NFS4_CDFC4_BACK;
1382         return alloc_conn(rqstp, dir);
1383 }
1384
1385 /* must be called under client_lock */
1386 static void nfsd4_del_conns(struct nfsd4_session *s)
1387 {
1388         struct nfs4_client *clp = s->se_client;
1389         struct nfsd4_conn *c;
1390
1391         spin_lock(&clp->cl_lock);
1392         while (!list_empty(&s->se_conns)) {
1393                 c = list_first_entry(&s->se_conns, struct nfsd4_conn, cn_persession);
1394                 list_del_init(&c->cn_persession);
1395                 spin_unlock(&clp->cl_lock);
1396
1397                 unregister_xpt_user(c->cn_xprt, &c->cn_xpt_user);
1398                 free_conn(c);
1399
1400                 spin_lock(&clp->cl_lock);
1401         }
1402         spin_unlock(&clp->cl_lock);
1403 }
1404
1405 static void __free_session(struct nfsd4_session *ses)
1406 {
1407         free_session_slots(ses);
1408         kfree(ses);
1409 }
1410
1411 static void free_session(struct nfsd4_session *ses)
1412 {
1413         nfsd4_del_conns(ses);
1414         nfsd4_put_drc_mem(&ses->se_fchannel);
1415         __free_session(ses);
1416 }
1417
1418 static void init_session(struct svc_rqst *rqstp, struct nfsd4_session *new, struct nfs4_client *clp, struct nfsd4_create_session *cses)
1419 {
1420         int idx;
1421         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
1422
1423         new->se_client = clp;
1424         gen_sessionid(new);
1425
1426         INIT_LIST_HEAD(&new->se_conns);
1427
1428         new->se_cb_seq_nr = 1;
1429         new->se_flags = cses->flags;
1430         new->se_cb_prog = cses->callback_prog;
1431         new->se_cb_sec = cses->cb_sec;
1432         atomic_set(&new->se_ref, 0);
1433         idx = hash_sessionid(&new->se_sessionid);
1434         list_add(&new->se_hash, &nn->sessionid_hashtbl[idx]);
1435         spin_lock(&clp->cl_lock);
1436         list_add(&new->se_perclnt, &clp->cl_sessions);
1437         spin_unlock(&clp->cl_lock);
1438
1439         if (cses->flags & SESSION4_BACK_CHAN) {
1440                 struct sockaddr *sa = svc_addr(rqstp);
1441                 /*
1442                  * This is a little silly; with sessions there's no real
1443                  * use for the callback address.  Use the peer address
1444                  * as a reasonable default for now, but consider fixing
1445                  * the rpc client not to require an address in the
1446                  * future:
1447                  */
1448                 rpc_copy_addr((struct sockaddr *)&clp->cl_cb_conn.cb_addr, sa);
1449                 clp->cl_cb_conn.cb_addrlen = svc_addr_len(sa);
1450         }
1451 }
1452
1453 /* caller must hold client_lock */
1454 static struct nfsd4_session *
1455 __find_in_sessionid_hashtbl(struct nfs4_sessionid *sessionid, struct net *net)
1456 {
1457         struct nfsd4_session *elem;
1458         int idx;
1459         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
1460
1461         lockdep_assert_held(&nn->client_lock);
1462
1463         dump_sessionid(__func__, sessionid);
1464         idx = hash_sessionid(sessionid);
1465         /* Search in the appropriate list */
1466         list_for_each_entry(elem, &nn->sessionid_hashtbl[idx], se_hash) {
1467                 if (!memcmp(elem->se_sessionid.data, sessionid->data,
1468                             NFS4_MAX_SESSIONID_LEN)) {
1469                         return elem;
1470                 }
1471         }
1472
1473         dprintk("%s: session not found\n", __func__);
1474         return NULL;
1475 }
1476
1477 static struct nfsd4_session *
1478 find_in_sessionid_hashtbl(struct nfs4_sessionid *sessionid, struct net *net,
1479                 __be32 *ret)
1480 {
1481         struct nfsd4_session *session;
1482         __be32 status = nfserr_badsession;
1483
1484         session = __find_in_sessionid_hashtbl(sessionid, net);
1485         if (!session)
1486                 goto out;
1487         status = nfsd4_get_session_locked(session);
1488         if (status)
1489                 session = NULL;
1490 out:
1491         *ret = status;
1492         return session;
1493 }
1494
1495 /* caller must hold client_lock */
1496 static void
1497 unhash_session(struct nfsd4_session *ses)
1498 {
1499         struct nfs4_client *clp = ses->se_client;
1500         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
1501
1502         lockdep_assert_held(&nn->client_lock);
1503
1504         list_del(&ses->se_hash);
1505         spin_lock(&ses->se_client->cl_lock);
1506         list_del(&ses->se_perclnt);
1507         spin_unlock(&ses->se_client->cl_lock);
1508 }
1509
1510 /* SETCLIENTID and SETCLIENTID_CONFIRM Helper functions */
1511 static int
1512 STALE_CLIENTID(clientid_t *clid, struct nfsd_net *nn)
1513 {
1514         if (clid->cl_boot == nn->boot_time)
1515                 return 0;
1516         dprintk("NFSD stale clientid (%08x/%08x) boot_time %08lx\n",
1517                 clid->cl_boot, clid->cl_id, nn->boot_time);
1518         return 1;
1519 }
1520
1521 /*
1522  * XXX Should we use a slab cache ?
1523  * This type of memory management is somewhat inefficient, but we use it
1524  * anyway since SETCLIENTID is not a common operation.
1525  */
1526 static struct nfs4_client *alloc_client(struct xdr_netobj name)
1527 {
1528         struct nfs4_client *clp;
1529         int i;
1530
1531         clp = kzalloc(sizeof(struct nfs4_client), GFP_KERNEL);
1532         if (clp == NULL)
1533                 return NULL;
1534         clp->cl_name.data = kmemdup(name.data, name.len, GFP_KERNEL);
1535         if (clp->cl_name.data == NULL)
1536                 goto err_no_name;
1537         clp->cl_ownerstr_hashtbl = kmalloc(sizeof(struct list_head) *
1538                         OWNER_HASH_SIZE, GFP_KERNEL);
1539         if (!clp->cl_ownerstr_hashtbl)
1540                 goto err_no_hashtbl;
1541         for (i = 0; i < OWNER_HASH_SIZE; i++)
1542                 INIT_LIST_HEAD(&clp->cl_ownerstr_hashtbl[i]);
1543         clp->cl_name.len = name.len;
1544         INIT_LIST_HEAD(&clp->cl_sessions);
1545         idr_init(&clp->cl_stateids);
1546         atomic_set(&clp->cl_refcount, 0);
1547         clp->cl_cb_state = NFSD4_CB_UNKNOWN;
1548         INIT_LIST_HEAD(&clp->cl_idhash);
1549         INIT_LIST_HEAD(&clp->cl_openowners);
1550         INIT_LIST_HEAD(&clp->cl_delegations);
1551         INIT_LIST_HEAD(&clp->cl_lru);
1552         INIT_LIST_HEAD(&clp->cl_callbacks);
1553         INIT_LIST_HEAD(&clp->cl_revoked);
1554         spin_lock_init(&clp->cl_lock);
1555         rpc_init_wait_queue(&clp->cl_cb_waitq, "Backchannel slot table");
1556         return clp;
1557 err_no_hashtbl:
1558         kfree(clp->cl_name.data);
1559 err_no_name:
1560         kfree(clp);
1561         return NULL;
1562 }
1563
1564 static void
1565 free_client(struct nfs4_client *clp)
1566 {
1567         while (!list_empty(&clp->cl_sessions)) {
1568                 struct nfsd4_session *ses;
1569                 ses = list_entry(clp->cl_sessions.next, struct nfsd4_session,
1570                                 se_perclnt);
1571                 list_del(&ses->se_perclnt);
1572                 WARN_ON_ONCE(atomic_read(&ses->se_ref));
1573                 free_session(ses);
1574         }
1575         rpc_destroy_wait_queue(&clp->cl_cb_waitq);
1576         free_svc_cred(&clp->cl_cred);
1577         kfree(clp->cl_ownerstr_hashtbl);
1578         kfree(clp->cl_name.data);
1579         idr_destroy(&clp->cl_stateids);
1580         kfree(clp);
1581 }
1582
1583 /* must be called under the client_lock */
1584 static void
1585 unhash_client_locked(struct nfs4_client *clp)
1586 {
1587         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
1588         struct nfsd4_session *ses;
1589
1590         lockdep_assert_held(&nn->client_lock);
1591
1592         /* Mark the client as expired! */
1593         clp->cl_time = 0;
1594         /* Make it invisible */
1595         if (!list_empty(&clp->cl_idhash)) {
1596                 list_del_init(&clp->cl_idhash);
1597                 if (test_bit(NFSD4_CLIENT_CONFIRMED, &clp->cl_flags))
1598                         rb_erase(&clp->cl_namenode, &nn->conf_name_tree);
1599                 else
1600                         rb_erase(&clp->cl_namenode, &nn->unconf_name_tree);
1601         }
1602         list_del_init(&clp->cl_lru);
1603         spin_lock(&clp->cl_lock);
1604         list_for_each_entry(ses, &clp->cl_sessions, se_perclnt)
1605                 list_del_init(&ses->se_hash);
1606         spin_unlock(&clp->cl_lock);
1607 }
1608
1609 static void
1610 unhash_client(struct nfs4_client *clp)
1611 {
1612         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
1613
1614         spin_lock(&nn->client_lock);
1615         unhash_client_locked(clp);
1616         spin_unlock(&nn->client_lock);
1617 }
1618
1619 static __be32 mark_client_expired_locked(struct nfs4_client *clp)
1620 {
1621         if (atomic_read(&clp->cl_refcount))
1622                 return nfserr_jukebox;
1623         unhash_client_locked(clp);
1624         return nfs_ok;
1625 }
1626
1627 static void
1628 __destroy_client(struct nfs4_client *clp)
1629 {
1630         struct nfs4_openowner *oo;
1631         struct nfs4_delegation *dp;
1632         struct list_head reaplist;
1633
1634         INIT_LIST_HEAD(&reaplist);
1635         spin_lock(&state_lock);
1636         while (!list_empty(&clp->cl_delegations)) {
1637                 dp = list_entry(clp->cl_delegations.next, struct nfs4_delegation, dl_perclnt);
1638                 unhash_delegation_locked(dp);
1639                 list_add(&dp->dl_recall_lru, &reaplist);
1640         }
1641         spin_unlock(&state_lock);
1642         while (!list_empty(&reaplist)) {
1643                 dp = list_entry(reaplist.next, struct nfs4_delegation, dl_recall_lru);
1644                 list_del_init(&dp->dl_recall_lru);
1645                 nfs4_put_deleg_lease(dp->dl_stid.sc_file);
1646                 nfs4_put_stid(&dp->dl_stid);
1647         }
1648         while (!list_empty(&clp->cl_revoked)) {
1649                 dp = list_entry(reaplist.next, struct nfs4_delegation, dl_recall_lru);
1650                 list_del_init(&dp->dl_recall_lru);
1651                 nfs4_put_stid(&dp->dl_stid);
1652         }
1653         while (!list_empty(&clp->cl_openowners)) {
1654                 oo = list_entry(clp->cl_openowners.next, struct nfs4_openowner, oo_perclient);
1655                 nfs4_get_stateowner(&oo->oo_owner);
1656                 release_openowner(oo);
1657         }
1658         nfsd4_shutdown_callback(clp);
1659         if (clp->cl_cb_conn.cb_xprt)
1660                 svc_xprt_put(clp->cl_cb_conn.cb_xprt);
1661         free_client(clp);
1662 }
1663
1664 static void
1665 destroy_client(struct nfs4_client *clp)
1666 {
1667         unhash_client(clp);
1668         __destroy_client(clp);
1669 }
1670
1671 static void expire_client(struct nfs4_client *clp)
1672 {
1673         unhash_client(clp);
1674         nfsd4_client_record_remove(clp);
1675         __destroy_client(clp);
1676 }
1677
1678 static void copy_verf(struct nfs4_client *target, nfs4_verifier *source)
1679 {
1680         memcpy(target->cl_verifier.data, source->data,
1681                         sizeof(target->cl_verifier.data));
1682 }
1683
1684 static void copy_clid(struct nfs4_client *target, struct nfs4_client *source)
1685 {
1686         target->cl_clientid.cl_boot = source->cl_clientid.cl_boot;
1687         target->cl_clientid.cl_id = source->cl_clientid.cl_id;
1688 }
1689
1690 static int copy_cred(struct svc_cred *target, struct svc_cred *source)
1691 {
1692         if (source->cr_principal) {
1693                 target->cr_principal =
1694                                 kstrdup(source->cr_principal, GFP_KERNEL);
1695                 if (target->cr_principal == NULL)
1696                         return -ENOMEM;
1697         } else
1698                 target->cr_principal = NULL;
1699         target->cr_flavor = source->cr_flavor;
1700         target->cr_uid = source->cr_uid;
1701         target->cr_gid = source->cr_gid;
1702         target->cr_group_info = source->cr_group_info;
1703         get_group_info(target->cr_group_info);
1704         target->cr_gss_mech = source->cr_gss_mech;
1705         if (source->cr_gss_mech)
1706                 gss_mech_get(source->cr_gss_mech);
1707         return 0;
1708 }
1709
1710 static long long
1711 compare_blob(const struct xdr_netobj *o1, const struct xdr_netobj *o2)
1712 {
1713         long long res;
1714
1715         res = o1->len - o2->len;
1716         if (res)
1717                 return res;
1718         return (long long)memcmp(o1->data, o2->data, o1->len);
1719 }
1720
1721 static int same_name(const char *n1, const char *n2)
1722 {
1723         return 0 == memcmp(n1, n2, HEXDIR_LEN);
1724 }
1725
1726 static int
1727 same_verf(nfs4_verifier *v1, nfs4_verifier *v2)
1728 {
1729         return 0 == memcmp(v1->data, v2->data, sizeof(v1->data));
1730 }
1731
1732 static int
1733 same_clid(clientid_t *cl1, clientid_t *cl2)
1734 {
1735         return (cl1->cl_boot == cl2->cl_boot) && (cl1->cl_id == cl2->cl_id);
1736 }
1737
1738 static bool groups_equal(struct group_info *g1, struct group_info *g2)
1739 {
1740         int i;
1741
1742         if (g1->ngroups != g2->ngroups)
1743                 return false;
1744         for (i=0; i<g1->ngroups; i++)
1745                 if (!gid_eq(GROUP_AT(g1, i), GROUP_AT(g2, i)))
1746                         return false;
1747         return true;
1748 }
1749
1750 /*
1751  * RFC 3530 language requires clid_inuse be returned when the
1752  * "principal" associated with a requests differs from that previously
1753  * used.  We use uid, gid's, and gss principal string as our best
1754  * approximation.  We also don't want to allow non-gss use of a client
1755  * established using gss: in theory cr_principal should catch that
1756  * change, but in practice cr_principal can be null even in the gss case
1757  * since gssd doesn't always pass down a principal string.
1758  */
1759 static bool is_gss_cred(struct svc_cred *cr)
1760 {
1761         /* Is cr_flavor one of the gss "pseudoflavors"?: */
1762         return (cr->cr_flavor > RPC_AUTH_MAXFLAVOR);
1763 }
1764
1765
1766 static bool
1767 same_creds(struct svc_cred *cr1, struct svc_cred *cr2)
1768 {
1769         if ((is_gss_cred(cr1) != is_gss_cred(cr2))
1770                 || (!uid_eq(cr1->cr_uid, cr2->cr_uid))
1771                 || (!gid_eq(cr1->cr_gid, cr2->cr_gid))
1772                 || !groups_equal(cr1->cr_group_info, cr2->cr_group_info))
1773                 return false;
1774         if (cr1->cr_principal == cr2->cr_principal)
1775                 return true;
1776         if (!cr1->cr_principal || !cr2->cr_principal)
1777                 return false;
1778         return 0 == strcmp(cr1->cr_principal, cr2->cr_principal);
1779 }
1780
1781 static bool svc_rqst_integrity_protected(struct svc_rqst *rqstp)
1782 {
1783         struct svc_cred *cr = &rqstp->rq_cred;
1784         u32 service;
1785
1786         if (!cr->cr_gss_mech)
1787                 return false;
1788         service = gss_pseudoflavor_to_service(cr->cr_gss_mech, cr->cr_flavor);
1789         return service == RPC_GSS_SVC_INTEGRITY ||
1790                service == RPC_GSS_SVC_PRIVACY;
1791 }
1792
1793 static bool mach_creds_match(struct nfs4_client *cl, struct svc_rqst *rqstp)
1794 {
1795         struct svc_cred *cr = &rqstp->rq_cred;
1796
1797         if (!cl->cl_mach_cred)
1798                 return true;
1799         if (cl->cl_cred.cr_gss_mech != cr->cr_gss_mech)
1800                 return false;
1801         if (!svc_rqst_integrity_protected(rqstp))
1802                 return false;
1803         if (!cr->cr_principal)
1804                 return false;
1805         return 0 == strcmp(cl->cl_cred.cr_principal, cr->cr_principal);
1806 }
1807
1808 static void gen_confirm(struct nfs4_client *clp, struct nfsd_net *nn)
1809 {
1810         __be32 verf[2];
1811
1812         /*
1813          * This is opaque to client, so no need to byte-swap. Use
1814          * __force to keep sparse happy
1815          */
1816         verf[0] = (__force __be32)get_seconds();
1817         verf[1] = (__force __be32)nn->clientid_counter;
1818         memcpy(clp->cl_confirm.data, verf, sizeof(clp->cl_confirm.data));
1819 }
1820
1821 static void gen_clid(struct nfs4_client *clp, struct nfsd_net *nn)
1822 {
1823         clp->cl_clientid.cl_boot = nn->boot_time;
1824         clp->cl_clientid.cl_id = nn->clientid_counter++;
1825         gen_confirm(clp, nn);
1826 }
1827
1828 static struct nfs4_stid *
1829 find_stateid_locked(struct nfs4_client *cl, stateid_t *t)
1830 {
1831         struct nfs4_stid *ret;
1832
1833         ret = idr_find(&cl->cl_stateids, t->si_opaque.so_id);
1834         if (!ret || !ret->sc_type)
1835                 return NULL;
1836         return ret;
1837 }
1838
1839 static struct nfs4_stid *
1840 find_stateid_by_type(struct nfs4_client *cl, stateid_t *t, char typemask)
1841 {
1842         struct nfs4_stid *s;
1843
1844         spin_lock(&cl->cl_lock);
1845         s = find_stateid_locked(cl, t);
1846         if (s != NULL) {
1847                 if (typemask & s->sc_type)
1848                         atomic_inc(&s->sc_count);
1849                 else
1850                         s = NULL;
1851         }
1852         spin_unlock(&cl->cl_lock);
1853         return s;
1854 }
1855
1856 static struct nfs4_client *create_client(struct xdr_netobj name,
1857                 struct svc_rqst *rqstp, nfs4_verifier *verf)
1858 {
1859         struct nfs4_client *clp;
1860         struct sockaddr *sa = svc_addr(rqstp);
1861         int ret;
1862         struct net *net = SVC_NET(rqstp);
1863
1864         clp = alloc_client(name);
1865         if (clp == NULL)
1866                 return NULL;
1867
1868         ret = copy_cred(&clp->cl_cred, &rqstp->rq_cred);
1869         if (ret) {
1870                 free_client(clp);
1871                 return NULL;
1872         }
1873         INIT_WORK(&clp->cl_cb_null.cb_work, nfsd4_run_cb_null);
1874         clp->cl_time = get_seconds();
1875         clear_bit(0, &clp->cl_cb_slot_busy);
1876         copy_verf(clp, verf);
1877         rpc_copy_addr((struct sockaddr *) &clp->cl_addr, sa);
1878         clp->cl_cb_session = NULL;
1879         clp->net = net;
1880         return clp;
1881 }
1882
1883 static void
1884 add_clp_to_name_tree(struct nfs4_client *new_clp, struct rb_root *root)
1885 {
1886         struct rb_node **new = &(root->rb_node), *parent = NULL;
1887         struct nfs4_client *clp;
1888
1889         while (*new) {
1890                 clp = rb_entry(*new, struct nfs4_client, cl_namenode);
1891                 parent = *new;
1892
1893                 if (compare_blob(&clp->cl_name, &new_clp->cl_name) > 0)
1894                         new = &((*new)->rb_left);
1895                 else
1896                         new = &((*new)->rb_right);
1897         }
1898
1899         rb_link_node(&new_clp->cl_namenode, parent, new);
1900         rb_insert_color(&new_clp->cl_namenode, root);
1901 }
1902
1903 static struct nfs4_client *
1904 find_clp_in_name_tree(struct xdr_netobj *name, struct rb_root *root)
1905 {
1906         long long cmp;
1907         struct rb_node *node = root->rb_node;
1908         struct nfs4_client *clp;
1909
1910         while (node) {
1911                 clp = rb_entry(node, struct nfs4_client, cl_namenode);
1912                 cmp = compare_blob(&clp->cl_name, name);
1913                 if (cmp > 0)
1914                         node = node->rb_left;
1915                 else if (cmp < 0)
1916                         node = node->rb_right;
1917                 else
1918                         return clp;
1919         }
1920         return NULL;
1921 }
1922
1923 static void
1924 add_to_unconfirmed(struct nfs4_client *clp)
1925 {
1926         unsigned int idhashval;
1927         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
1928
1929         lockdep_assert_held(&nn->client_lock);
1930
1931         clear_bit(NFSD4_CLIENT_CONFIRMED, &clp->cl_flags);
1932         add_clp_to_name_tree(clp, &nn->unconf_name_tree);
1933         idhashval = clientid_hashval(clp->cl_clientid.cl_id);
1934         list_add(&clp->cl_idhash, &nn->unconf_id_hashtbl[idhashval]);
1935         renew_client_locked(clp);
1936 }
1937
1938 static void
1939 move_to_confirmed(struct nfs4_client *clp)
1940 {
1941         unsigned int idhashval = clientid_hashval(clp->cl_clientid.cl_id);
1942         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
1943
1944         lockdep_assert_held(&nn->client_lock);
1945
1946         dprintk("NFSD: move_to_confirm nfs4_client %p\n", clp);
1947         list_move(&clp->cl_idhash, &nn->conf_id_hashtbl[idhashval]);
1948         rb_erase(&clp->cl_namenode, &nn->unconf_name_tree);
1949         add_clp_to_name_tree(clp, &nn->conf_name_tree);
1950         set_bit(NFSD4_CLIENT_CONFIRMED, &clp->cl_flags);
1951         renew_client_locked(clp);
1952 }
1953
1954 static struct nfs4_client *
1955 find_client_in_id_table(struct list_head *tbl, clientid_t *clid, bool sessions)
1956 {
1957         struct nfs4_client *clp;
1958         unsigned int idhashval = clientid_hashval(clid->cl_id);
1959
1960         list_for_each_entry(clp, &tbl[idhashval], cl_idhash) {
1961                 if (same_clid(&clp->cl_clientid, clid)) {
1962                         if ((bool)clp->cl_minorversion != sessions)
1963                                 return NULL;
1964                         renew_client_locked(clp);
1965                         return clp;
1966                 }
1967         }
1968         return NULL;
1969 }
1970
1971 static struct nfs4_client *
1972 find_confirmed_client(clientid_t *clid, bool sessions, struct nfsd_net *nn)
1973 {
1974         struct list_head *tbl = nn->conf_id_hashtbl;
1975
1976         lockdep_assert_held(&nn->client_lock);
1977         return find_client_in_id_table(tbl, clid, sessions);
1978 }
1979
1980 static struct nfs4_client *
1981 find_unconfirmed_client(clientid_t *clid, bool sessions, struct nfsd_net *nn)
1982 {
1983         struct list_head *tbl = nn->unconf_id_hashtbl;
1984
1985         lockdep_assert_held(&nn->client_lock);
1986         return find_client_in_id_table(tbl, clid, sessions);
1987 }
1988
1989 static bool clp_used_exchangeid(struct nfs4_client *clp)
1990 {
1991         return clp->cl_exchange_flags != 0;
1992 }
1993
1994 static struct nfs4_client *
1995 find_confirmed_client_by_name(struct xdr_netobj *name, struct nfsd_net *nn)
1996 {
1997         lockdep_assert_held(&nn->client_lock);
1998         return find_clp_in_name_tree(name, &nn->conf_name_tree);
1999 }
2000
2001 static struct nfs4_client *
2002 find_unconfirmed_client_by_name(struct xdr_netobj *name, struct nfsd_net *nn)
2003 {
2004         lockdep_assert_held(&nn->client_lock);
2005         return find_clp_in_name_tree(name, &nn->unconf_name_tree);
2006 }
2007
2008 static void
2009 gen_callback(struct nfs4_client *clp, struct nfsd4_setclientid *se, struct svc_rqst *rqstp)
2010 {
2011         struct nfs4_cb_conn *conn = &clp->cl_cb_conn;
2012         struct sockaddr *sa = svc_addr(rqstp);
2013         u32 scopeid = rpc_get_scope_id(sa);
2014         unsigned short expected_family;
2015
2016         /* Currently, we only support tcp and tcp6 for the callback channel */
2017         if (se->se_callback_netid_len == 3 &&
2018             !memcmp(se->se_callback_netid_val, "tcp", 3))
2019                 expected_family = AF_INET;
2020         else if (se->se_callback_netid_len == 4 &&
2021                  !memcmp(se->se_callback_netid_val, "tcp6", 4))
2022                 expected_family = AF_INET6;
2023         else
2024                 goto out_err;
2025
2026         conn->cb_addrlen = rpc_uaddr2sockaddr(clp->net, se->se_callback_addr_val,
2027                                             se->se_callback_addr_len,
2028                                             (struct sockaddr *)&conn->cb_addr,
2029                                             sizeof(conn->cb_addr));
2030
2031         if (!conn->cb_addrlen || conn->cb_addr.ss_family != expected_family)
2032                 goto out_err;
2033
2034         if (conn->cb_addr.ss_family == AF_INET6)
2035                 ((struct sockaddr_in6 *)&conn->cb_addr)->sin6_scope_id = scopeid;
2036
2037         conn->cb_prog = se->se_callback_prog;
2038         conn->cb_ident = se->se_callback_ident;
2039         memcpy(&conn->cb_saddr, &rqstp->rq_daddr, rqstp->rq_daddrlen);
2040         return;
2041 out_err:
2042         conn->cb_addr.ss_family = AF_UNSPEC;
2043         conn->cb_addrlen = 0;
2044         dprintk(KERN_INFO "NFSD: this client (clientid %08x/%08x) "
2045                 "will not receive delegations\n",
2046                 clp->cl_clientid.cl_boot, clp->cl_clientid.cl_id);
2047
2048         return;
2049 }
2050
2051 /*
2052  * Cache a reply. nfsd4_check_resp_size() has bounded the cache size.
2053  */
2054 static void
2055 nfsd4_store_cache_entry(struct nfsd4_compoundres *resp)
2056 {
2057         struct xdr_buf *buf = resp->xdr.buf;
2058         struct nfsd4_slot *slot = resp->cstate.slot;
2059         unsigned int base;
2060
2061         dprintk("--> %s slot %p\n", __func__, slot);
2062
2063         slot->sl_opcnt = resp->opcnt;
2064         slot->sl_status = resp->cstate.status;
2065
2066         slot->sl_flags |= NFSD4_SLOT_INITIALIZED;
2067         if (nfsd4_not_cached(resp)) {
2068                 slot->sl_datalen = 0;
2069                 return;
2070         }
2071         base = resp->cstate.data_offset;
2072         slot->sl_datalen = buf->len - base;
2073         if (read_bytes_from_xdr_buf(buf, base, slot->sl_data, slot->sl_datalen))
2074                 WARN("%s: sessions DRC could not cache compound\n", __func__);
2075         return;
2076 }
2077
2078 /*
2079  * Encode the replay sequence operation from the slot values.
2080  * If cachethis is FALSE encode the uncached rep error on the next
2081  * operation which sets resp->p and increments resp->opcnt for
2082  * nfs4svc_encode_compoundres.
2083  *
2084  */
2085 static __be32
2086 nfsd4_enc_sequence_replay(struct nfsd4_compoundargs *args,
2087                           struct nfsd4_compoundres *resp)
2088 {
2089         struct nfsd4_op *op;
2090         struct nfsd4_slot *slot = resp->cstate.slot;
2091
2092         /* Encode the replayed sequence operation */
2093         op = &args->ops[resp->opcnt - 1];
2094         nfsd4_encode_operation(resp, op);
2095
2096         /* Return nfserr_retry_uncached_rep in next operation. */
2097         if (args->opcnt > 1 && !(slot->sl_flags & NFSD4_SLOT_CACHETHIS)) {
2098                 op = &args->ops[resp->opcnt++];
2099                 op->status = nfserr_retry_uncached_rep;
2100                 nfsd4_encode_operation(resp, op);
2101         }
2102         return op->status;
2103 }
2104
2105 /*
2106  * The sequence operation is not cached because we can use the slot and
2107  * session values.
2108  */
2109 static __be32
2110 nfsd4_replay_cache_entry(struct nfsd4_compoundres *resp,
2111                          struct nfsd4_sequence *seq)
2112 {
2113         struct nfsd4_slot *slot = resp->cstate.slot;
2114         struct xdr_stream *xdr = &resp->xdr;
2115         __be32 *p;
2116         __be32 status;
2117
2118         dprintk("--> %s slot %p\n", __func__, slot);
2119
2120         status = nfsd4_enc_sequence_replay(resp->rqstp->rq_argp, resp);
2121         if (status)
2122                 return status;
2123
2124         p = xdr_reserve_space(xdr, slot->sl_datalen);
2125         if (!p) {
2126                 WARN_ON_ONCE(1);
2127                 return nfserr_serverfault;
2128         }
2129         xdr_encode_opaque_fixed(p, slot->sl_data, slot->sl_datalen);
2130         xdr_commit_encode(xdr);
2131
2132         resp->opcnt = slot->sl_opcnt;
2133         return slot->sl_status;
2134 }
2135
2136 /*
2137  * Set the exchange_id flags returned by the server.
2138  */
2139 static void
2140 nfsd4_set_ex_flags(struct nfs4_client *new, struct nfsd4_exchange_id *clid)
2141 {
2142         /* pNFS is not supported */
2143         new->cl_exchange_flags |= EXCHGID4_FLAG_USE_NON_PNFS;
2144
2145         /* Referrals are supported, Migration is not. */
2146         new->cl_exchange_flags |= EXCHGID4_FLAG_SUPP_MOVED_REFER;
2147
2148         /* set the wire flags to return to client. */
2149         clid->flags = new->cl_exchange_flags;
2150 }
2151
2152 static bool client_has_state(struct nfs4_client *clp)
2153 {
2154         /*
2155          * Note clp->cl_openowners check isn't quite right: there's no
2156          * need to count owners without stateid's.
2157          *
2158          * Also note we should probably be using this in 4.0 case too.
2159          */
2160         return !list_empty(&clp->cl_openowners)
2161                 || !list_empty(&clp->cl_delegations)
2162                 || !list_empty(&clp->cl_sessions);
2163 }
2164
2165 __be32
2166 nfsd4_exchange_id(struct svc_rqst *rqstp,
2167                   struct nfsd4_compound_state *cstate,
2168                   struct nfsd4_exchange_id *exid)
2169 {
2170         struct nfs4_client *conf, *new;
2171         struct nfs4_client *unconf = NULL;
2172         __be32 status;
2173         char                    addr_str[INET6_ADDRSTRLEN];
2174         nfs4_verifier           verf = exid->verifier;
2175         struct sockaddr         *sa = svc_addr(rqstp);
2176         bool    update = exid->flags & EXCHGID4_FLAG_UPD_CONFIRMED_REC_A;
2177         struct nfsd_net         *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
2178
2179         rpc_ntop(sa, addr_str, sizeof(addr_str));
2180         dprintk("%s rqstp=%p exid=%p clname.len=%u clname.data=%p "
2181                 "ip_addr=%s flags %x, spa_how %d\n",
2182                 __func__, rqstp, exid, exid->clname.len, exid->clname.data,
2183                 addr_str, exid->flags, exid->spa_how);
2184
2185         if (exid->flags & ~EXCHGID4_FLAG_MASK_A)
2186                 return nfserr_inval;
2187
2188         switch (exid->spa_how) {
2189         case SP4_MACH_CRED:
2190                 if (!svc_rqst_integrity_protected(rqstp))
2191                         return nfserr_inval;
2192         case SP4_NONE:
2193                 break;
2194         default:                                /* checked by xdr code */
2195                 WARN_ON_ONCE(1);
2196         case SP4_SSV:
2197                 return nfserr_encr_alg_unsupp;
2198         }
2199
2200         new = create_client(exid->clname, rqstp, &verf);
2201         if (new == NULL)
2202                 return nfserr_jukebox;
2203
2204         /* Cases below refer to rfc 5661 section 18.35.4: */
2205         spin_lock(&nn->client_lock);
2206         conf = find_confirmed_client_by_name(&exid->clname, nn);
2207         if (conf) {
2208                 bool creds_match = same_creds(&conf->cl_cred, &rqstp->rq_cred);
2209                 bool verfs_match = same_verf(&verf, &conf->cl_verifier);
2210
2211                 if (update) {
2212                         if (!clp_used_exchangeid(conf)) { /* buggy client */
2213                                 status = nfserr_inval;
2214                                 goto out;
2215                         }
2216                         if (!mach_creds_match(conf, rqstp)) {
2217                                 status = nfserr_wrong_cred;
2218                                 goto out;
2219                         }
2220                         if (!creds_match) { /* case 9 */
2221                                 status = nfserr_perm;
2222                                 goto out;
2223                         }
2224                         if (!verfs_match) { /* case 8 */
2225                                 status = nfserr_not_same;
2226                                 goto out;
2227                         }
2228                         /* case 6 */
2229                         exid->flags |= EXCHGID4_FLAG_CONFIRMED_R;
2230                         goto out_copy;
2231                 }
2232                 if (!creds_match) { /* case 3 */
2233                         if (client_has_state(conf)) {
2234                                 status = nfserr_clid_inuse;
2235                                 goto out;
2236                         }
2237                         goto out_new;
2238                 }
2239                 if (verfs_match) { /* case 2 */
2240                         conf->cl_exchange_flags |= EXCHGID4_FLAG_CONFIRMED_R;
2241                         goto out_copy;
2242                 }
2243                 /* case 5, client reboot */
2244                 conf = NULL;
2245                 goto out_new;
2246         }
2247
2248         if (update) { /* case 7 */
2249                 status = nfserr_noent;
2250                 goto out;
2251         }
2252
2253         unconf  = find_unconfirmed_client_by_name(&exid->clname, nn);
2254         if (unconf) /* case 4, possible retry or client restart */
2255                 unhash_client_locked(unconf);
2256
2257         /* case 1 (normal case) */
2258 out_new:
2259         if (conf) {
2260                 status = mark_client_expired_locked(conf);
2261                 if (status)
2262                         goto out;
2263         }
2264         new->cl_minorversion = cstate->minorversion;
2265         new->cl_mach_cred = (exid->spa_how == SP4_MACH_CRED);
2266
2267         gen_clid(new, nn);
2268         add_to_unconfirmed(new);
2269         swap(new, conf);
2270 out_copy:
2271         exid->clientid.cl_boot = conf->cl_clientid.cl_boot;
2272         exid->clientid.cl_id = conf->cl_clientid.cl_id;
2273
2274         exid->seqid = conf->cl_cs_slot.sl_seqid + 1;
2275         nfsd4_set_ex_flags(conf, exid);
2276
2277         dprintk("nfsd4_exchange_id seqid %d flags %x\n",
2278                 conf->cl_cs_slot.sl_seqid, conf->cl_exchange_flags);
2279         status = nfs_ok;
2280
2281 out:
2282         spin_unlock(&nn->client_lock);
2283         if (new)
2284                 expire_client(new);
2285         if (unconf)
2286                 expire_client(unconf);
2287         return status;
2288 }
2289
2290 static __be32
2291 check_slot_seqid(u32 seqid, u32 slot_seqid, int slot_inuse)
2292 {
2293         dprintk("%s enter. seqid %d slot_seqid %d\n", __func__, seqid,
2294                 slot_seqid);
2295
2296         /* The slot is in use, and no response has been sent. */
2297         if (slot_inuse) {
2298                 if (seqid == slot_seqid)
2299                         return nfserr_jukebox;
2300                 else
2301                         return nfserr_seq_misordered;
2302         }
2303         /* Note unsigned 32-bit arithmetic handles wraparound: */
2304         if (likely(seqid == slot_seqid + 1))
2305                 return nfs_ok;
2306         if (seqid == slot_seqid)
2307                 return nfserr_replay_cache;
2308         return nfserr_seq_misordered;
2309 }
2310
2311 /*
2312  * Cache the create session result into the create session single DRC
2313  * slot cache by saving the xdr structure. sl_seqid has been set.
2314  * Do this for solo or embedded create session operations.
2315  */
2316 static void
2317 nfsd4_cache_create_session(struct nfsd4_create_session *cr_ses,
2318                            struct nfsd4_clid_slot *slot, __be32 nfserr)
2319 {
2320         slot->sl_status = nfserr;
2321         memcpy(&slot->sl_cr_ses, cr_ses, sizeof(*cr_ses));
2322 }
2323
2324 static __be32
2325 nfsd4_replay_create_session(struct nfsd4_create_session *cr_ses,
2326                             struct nfsd4_clid_slot *slot)
2327 {
2328         memcpy(cr_ses, &slot->sl_cr_ses, sizeof(*cr_ses));
2329         return slot->sl_status;
2330 }
2331
2332 #define NFSD_MIN_REQ_HDR_SEQ_SZ ((\
2333                         2 * 2 + /* credential,verifier: AUTH_NULL, length 0 */ \
2334                         1 +     /* MIN tag is length with zero, only length */ \
2335                         3 +     /* version, opcount, opcode */ \
2336                         XDR_QUADLEN(NFS4_MAX_SESSIONID_LEN) + \
2337                                 /* seqid, slotID, slotID, cache */ \
2338                         4 ) * sizeof(__be32))
2339
2340 #define NFSD_MIN_RESP_HDR_SEQ_SZ ((\
2341                         2 +     /* verifier: AUTH_NULL, length 0 */\
2342                         1 +     /* status */ \
2343                         1 +     /* MIN tag is length with zero, only length */ \
2344                         3 +     /* opcount, opcode, opstatus*/ \
2345                         XDR_QUADLEN(NFS4_MAX_SESSIONID_LEN) + \
2346                                 /* seqid, slotID, slotID, slotID, status */ \
2347                         5 ) * sizeof(__be32))
2348
2349 static __be32 check_forechannel_attrs(struct nfsd4_channel_attrs *ca, struct nfsd_net *nn)
2350 {
2351         u32 maxrpc = nn->nfsd_serv->sv_max_mesg;
2352
2353         if (ca->maxreq_sz < NFSD_MIN_REQ_HDR_SEQ_SZ)
2354                 return nfserr_toosmall;
2355         if (ca->maxresp_sz < NFSD_MIN_RESP_HDR_SEQ_SZ)
2356                 return nfserr_toosmall;
2357         ca->headerpadsz = 0;
2358         ca->maxreq_sz = min_t(u32, ca->maxreq_sz, maxrpc);
2359         ca->maxresp_sz = min_t(u32, ca->maxresp_sz, maxrpc);
2360         ca->maxops = min_t(u32, ca->maxops, NFSD_MAX_OPS_PER_COMPOUND);
2361         ca->maxresp_cached = min_t(u32, ca->maxresp_cached,
2362                         NFSD_SLOT_CACHE_SIZE + NFSD_MIN_HDR_SEQ_SZ);
2363         ca->maxreqs = min_t(u32, ca->maxreqs, NFSD_MAX_SLOTS_PER_SESSION);
2364         /*
2365          * Note decreasing slot size below client's request may make it
2366          * difficult for client to function correctly, whereas
2367          * decreasing the number of slots will (just?) affect
2368          * performance.  When short on memory we therefore prefer to
2369          * decrease number of slots instead of their size.  Clients that
2370          * request larger slots than they need will get poor results:
2371          */
2372         ca->maxreqs = nfsd4_get_drc_mem(ca);
2373         if (!ca->maxreqs)
2374                 return nfserr_jukebox;
2375
2376         return nfs_ok;
2377 }
2378
2379 #define NFSD_CB_MAX_REQ_SZ      ((NFS4_enc_cb_recall_sz + \
2380                                  RPC_MAX_HEADER_WITH_AUTH) * sizeof(__be32))
2381 #define NFSD_CB_MAX_RESP_SZ     ((NFS4_dec_cb_recall_sz + \
2382                                  RPC_MAX_REPHEADER_WITH_AUTH) * sizeof(__be32))
2383
2384 static __be32 check_backchannel_attrs(struct nfsd4_channel_attrs *ca)
2385 {
2386         ca->headerpadsz = 0;
2387
2388         /*
2389          * These RPC_MAX_HEADER macros are overkill, especially since we
2390          * don't even do gss on the backchannel yet.  But this is still
2391          * less than 1k.  Tighten up this estimate in the unlikely event
2392          * it turns out to be a problem for some client:
2393          */
2394         if (ca->maxreq_sz < NFSD_CB_MAX_REQ_SZ)
2395                 return nfserr_toosmall;
2396         if (ca->maxresp_sz < NFSD_CB_MAX_RESP_SZ)
2397                 return nfserr_toosmall;
2398         ca->maxresp_cached = 0;
2399         if (ca->maxops < 2)
2400                 return nfserr_toosmall;
2401
2402         return nfs_ok;
2403 }
2404
2405 static __be32 nfsd4_check_cb_sec(struct nfsd4_cb_sec *cbs)
2406 {
2407         switch (cbs->flavor) {
2408         case RPC_AUTH_NULL:
2409         case RPC_AUTH_UNIX:
2410                 return nfs_ok;
2411         default:
2412                 /*
2413                  * GSS case: the spec doesn't allow us to return this
2414                  * error.  But it also doesn't allow us not to support
2415                  * GSS.
2416                  * I'd rather this fail hard than return some error the
2417                  * client might think it can already handle:
2418                  */
2419                 return nfserr_encr_alg_unsupp;
2420         }
2421 }
2422
2423 __be32
2424 nfsd4_create_session(struct svc_rqst *rqstp,
2425                      struct nfsd4_compound_state *cstate,
2426                      struct nfsd4_create_session *cr_ses)
2427 {
2428         struct sockaddr *sa = svc_addr(rqstp);
2429         struct nfs4_client *conf, *unconf;
2430         struct nfs4_client *old = NULL;
2431         struct nfsd4_session *new;
2432         struct nfsd4_conn *conn;
2433         struct nfsd4_clid_slot *cs_slot = NULL;
2434         __be32 status = 0;
2435         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
2436
2437         if (cr_ses->flags & ~SESSION4_FLAG_MASK_A)
2438                 return nfserr_inval;
2439         status = nfsd4_check_cb_sec(&cr_ses->cb_sec);
2440         if (status)
2441                 return status;
2442         status = check_forechannel_attrs(&cr_ses->fore_channel, nn);
2443         if (status)
2444                 return status;
2445         status = check_backchannel_attrs(&cr_ses->back_channel);
2446         if (status)
2447                 goto out_release_drc_mem;
2448         status = nfserr_jukebox;
2449         new = alloc_session(&cr_ses->fore_channel, &cr_ses->back_channel);
2450         if (!new)
2451                 goto out_release_drc_mem;
2452         conn = alloc_conn_from_crses(rqstp, cr_ses);
2453         if (!conn)
2454                 goto out_free_session;
2455
2456         spin_lock(&nn->client_lock);
2457         unconf = find_unconfirmed_client(&cr_ses->clientid, true, nn);
2458         conf = find_confirmed_client(&cr_ses->clientid, true, nn);
2459         WARN_ON_ONCE(conf && unconf);
2460
2461         if (conf) {
2462                 status = nfserr_wrong_cred;
2463                 if (!mach_creds_match(conf, rqstp))
2464                         goto out_free_conn;
2465                 cs_slot = &conf->cl_cs_slot;
2466                 status = check_slot_seqid(cr_ses->seqid, cs_slot->sl_seqid, 0);
2467                 if (status == nfserr_replay_cache) {
2468                         status = nfsd4_replay_create_session(cr_ses, cs_slot);
2469                         goto out_free_conn;
2470                 } else if (cr_ses->seqid != cs_slot->sl_seqid + 1) {
2471                         status = nfserr_seq_misordered;
2472                         goto out_free_conn;
2473                 }
2474         } else if (unconf) {
2475                 if (!same_creds(&unconf->cl_cred, &rqstp->rq_cred) ||
2476                     !rpc_cmp_addr(sa, (struct sockaddr *) &unconf->cl_addr)) {
2477                         status = nfserr_clid_inuse;
2478                         goto out_free_conn;
2479                 }
2480                 status = nfserr_wrong_cred;
2481                 if (!mach_creds_match(unconf, rqstp))
2482                         goto out_free_conn;
2483                 cs_slot = &unconf->cl_cs_slot;
2484                 status = check_slot_seqid(cr_ses->seqid, cs_slot->sl_seqid, 0);
2485                 if (status) {
2486                         /* an unconfirmed replay returns misordered */
2487                         status = nfserr_seq_misordered;
2488                         goto out_free_conn;
2489                 }
2490                 old = find_confirmed_client_by_name(&unconf->cl_name, nn);
2491                 if (old) {
2492                         status = mark_client_expired_locked(old);
2493                         if (status) {
2494                                 old = NULL;
2495                                 goto out_free_conn;
2496                         }
2497                 }
2498                 move_to_confirmed(unconf);
2499                 conf = unconf;
2500         } else {
2501                 status = nfserr_stale_clientid;
2502                 goto out_free_conn;
2503         }
2504         status = nfs_ok;
2505         /*
2506          * We do not support RDMA or persistent sessions
2507          */
2508         cr_ses->flags &= ~SESSION4_PERSIST;
2509         cr_ses->flags &= ~SESSION4_RDMA;
2510
2511         init_session(rqstp, new, conf, cr_ses);
2512         nfsd4_get_session_locked(new);
2513
2514         memcpy(cr_ses->sessionid.data, new->se_sessionid.data,
2515                NFS4_MAX_SESSIONID_LEN);
2516         cs_slot->sl_seqid++;
2517         cr_ses->seqid = cs_slot->sl_seqid;
2518
2519         /* cache solo and embedded create sessions under the client_lock */
2520         nfsd4_cache_create_session(cr_ses, cs_slot, status);
2521         spin_unlock(&nn->client_lock);
2522         /* init connection and backchannel */
2523         nfsd4_init_conn(rqstp, conn, new);
2524         nfsd4_put_session(new);
2525         if (old)
2526                 expire_client(old);
2527         return status;
2528 out_free_conn:
2529         spin_unlock(&nn->client_lock);
2530         free_conn(conn);
2531         if (old)
2532                 expire_client(old);
2533 out_free_session:
2534         __free_session(new);
2535 out_release_drc_mem:
2536         nfsd4_put_drc_mem(&cr_ses->fore_channel);
2537         return status;
2538 }
2539
2540 static __be32 nfsd4_map_bcts_dir(u32 *dir)
2541 {
2542         switch (*dir) {
2543         case NFS4_CDFC4_FORE:
2544         case NFS4_CDFC4_BACK:
2545                 return nfs_ok;
2546         case NFS4_CDFC4_FORE_OR_BOTH:
2547         case NFS4_CDFC4_BACK_OR_BOTH:
2548                 *dir = NFS4_CDFC4_BOTH;
2549                 return nfs_ok;
2550         };
2551         return nfserr_inval;
2552 }
2553
2554 __be32 nfsd4_backchannel_ctl(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, struct nfsd4_backchannel_ctl *bc)
2555 {
2556         struct nfsd4_session *session = cstate->session;
2557         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
2558         __be32 status;
2559
2560         status = nfsd4_check_cb_sec(&bc->bc_cb_sec);
2561         if (status)
2562                 return status;
2563         spin_lock(&nn->client_lock);
2564         session->se_cb_prog = bc->bc_cb_program;
2565         session->se_cb_sec = bc->bc_cb_sec;
2566         spin_unlock(&nn->client_lock);
2567
2568         nfsd4_probe_callback(session->se_client);
2569
2570         return nfs_ok;
2571 }
2572
2573 __be32 nfsd4_bind_conn_to_session(struct svc_rqst *rqstp,
2574                      struct nfsd4_compound_state *cstate,
2575                      struct nfsd4_bind_conn_to_session *bcts)
2576 {
2577         __be32 status;
2578         struct nfsd4_conn *conn;
2579         struct nfsd4_session *session;
2580         struct net *net = SVC_NET(rqstp);
2581         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
2582
2583         if (!nfsd4_last_compound_op(rqstp))
2584                 return nfserr_not_only_op;
2585         spin_lock(&nn->client_lock);
2586         session = find_in_sessionid_hashtbl(&bcts->sessionid, net, &status);
2587         spin_unlock(&nn->client_lock);
2588         if (!session)
2589                 goto out_no_session;
2590         status = nfserr_wrong_cred;
2591         if (!mach_creds_match(session->se_client, rqstp))
2592                 goto out;
2593         status = nfsd4_map_bcts_dir(&bcts->dir);
2594         if (status)
2595                 goto out;
2596         conn = alloc_conn(rqstp, bcts->dir);
2597         status = nfserr_jukebox;
2598         if (!conn)
2599                 goto out;
2600         nfsd4_init_conn(rqstp, conn, session);
2601         status = nfs_ok;
2602 out:
2603         nfsd4_put_session(session);
2604 out_no_session:
2605         return status;
2606 }
2607
2608 static bool nfsd4_compound_in_session(struct nfsd4_session *session, struct nfs4_sessionid *sid)
2609 {
2610         if (!session)
2611                 return 0;
2612         return !memcmp(sid, &session->se_sessionid, sizeof(*sid));
2613 }
2614
2615 __be32
2616 nfsd4_destroy_session(struct svc_rqst *r,
2617                       struct nfsd4_compound_state *cstate,
2618                       struct nfsd4_destroy_session *sessionid)
2619 {
2620         struct nfsd4_session *ses;
2621         __be32 status;
2622         int ref_held_by_me = 0;
2623         struct net *net = SVC_NET(r);
2624         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
2625
2626         status = nfserr_not_only_op;
2627         if (nfsd4_compound_in_session(cstate->session, &sessionid->sessionid)) {
2628                 if (!nfsd4_last_compound_op(r))
2629                         goto out;
2630                 ref_held_by_me++;
2631         }
2632         dump_sessionid(__func__, &sessionid->sessionid);
2633         spin_lock(&nn->client_lock);
2634         ses = find_in_sessionid_hashtbl(&sessionid->sessionid, net, &status);
2635         if (!ses)
2636                 goto out_client_lock;
2637         status = nfserr_wrong_cred;
2638         if (!mach_creds_match(ses->se_client, r))
2639                 goto out_put_session;
2640         status = mark_session_dead_locked(ses, 1 + ref_held_by_me);
2641         if (status)
2642                 goto out_put_session;
2643         unhash_session(ses);
2644         spin_unlock(&nn->client_lock);
2645
2646         nfsd4_probe_callback_sync(ses->se_client);
2647
2648         spin_lock(&nn->client_lock);
2649         status = nfs_ok;
2650 out_put_session:
2651         nfsd4_put_session_locked(ses);
2652 out_client_lock:
2653         spin_unlock(&nn->client_lock);
2654 out:
2655         return status;
2656 }
2657
2658 static struct nfsd4_conn *__nfsd4_find_conn(struct svc_xprt *xpt, struct nfsd4_session *s)
2659 {
2660         struct nfsd4_conn *c;
2661
2662         list_for_each_entry(c, &s->se_conns, cn_persession) {
2663                 if (c->cn_xprt == xpt) {
2664                         return c;
2665                 }
2666         }
2667         return NULL;
2668 }
2669
2670 static __be32 nfsd4_sequence_check_conn(struct nfsd4_conn *new, struct nfsd4_session *ses)
2671 {
2672         struct nfs4_client *clp = ses->se_client;
2673         struct nfsd4_conn *c;
2674         __be32 status = nfs_ok;
2675         int ret;
2676
2677         spin_lock(&clp->cl_lock);
2678         c = __nfsd4_find_conn(new->cn_xprt, ses);
2679         if (c)
2680                 goto out_free;
2681         status = nfserr_conn_not_bound_to_session;
2682         if (clp->cl_mach_cred)
2683                 goto out_free;
2684         __nfsd4_hash_conn(new, ses);
2685         spin_unlock(&clp->cl_lock);
2686         ret = nfsd4_register_conn(new);
2687         if (ret)
2688                 /* oops; xprt is already down: */
2689                 nfsd4_conn_lost(&new->cn_xpt_user);
2690         return nfs_ok;
2691 out_free:
2692         spin_unlock(&clp->cl_lock);
2693         free_conn(new);
2694         return status;
2695 }
2696
2697 static bool nfsd4_session_too_many_ops(struct svc_rqst *rqstp, struct nfsd4_session *session)
2698 {
2699         struct nfsd4_compoundargs *args = rqstp->rq_argp;
2700
2701         return args->opcnt > session->se_fchannel.maxops;
2702 }
2703
2704 static bool nfsd4_request_too_big(struct svc_rqst *rqstp,
2705                                   struct nfsd4_session *session)
2706 {
2707         struct xdr_buf *xb = &rqstp->rq_arg;
2708
2709         return xb->len > session->se_fchannel.maxreq_sz;
2710 }
2711
2712 __be32
2713 nfsd4_sequence(struct svc_rqst *rqstp,
2714                struct nfsd4_compound_state *cstate,
2715                struct nfsd4_sequence *seq)
2716 {
2717         struct nfsd4_compoundres *resp = rqstp->rq_resp;
2718         struct xdr_stream *xdr = &resp->xdr;
2719         struct nfsd4_session *session;
2720         struct nfs4_client *clp;
2721         struct nfsd4_slot *slot;
2722         struct nfsd4_conn *conn;
2723         __be32 status;
2724         int buflen;
2725         struct net *net = SVC_NET(rqstp);
2726         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
2727
2728         if (resp->opcnt != 1)
2729                 return nfserr_sequence_pos;
2730
2731         /*
2732          * Will be either used or freed by nfsd4_sequence_check_conn
2733          * below.
2734          */
2735         conn = alloc_conn(rqstp, NFS4_CDFC4_FORE);
2736         if (!conn)
2737                 return nfserr_jukebox;
2738
2739         spin_lock(&nn->client_lock);
2740         session = find_in_sessionid_hashtbl(&seq->sessionid, net, &status);
2741         if (!session)
2742                 goto out_no_session;
2743         clp = session->se_client;
2744
2745         status = nfserr_too_many_ops;
2746         if (nfsd4_session_too_many_ops(rqstp, session))
2747                 goto out_put_session;
2748
2749         status = nfserr_req_too_big;
2750         if (nfsd4_request_too_big(rqstp, session))
2751                 goto out_put_session;
2752
2753         status = nfserr_badslot;
2754         if (seq->slotid >= session->se_fchannel.maxreqs)
2755                 goto out_put_session;
2756
2757         slot = session->se_slots[seq->slotid];
2758         dprintk("%s: slotid %d\n", __func__, seq->slotid);
2759
2760         /* We do not negotiate the number of slots yet, so set the
2761          * maxslots to the session maxreqs which is used to encode
2762          * sr_highest_slotid and the sr_target_slot id to maxslots */
2763         seq->maxslots = session->se_fchannel.maxreqs;
2764
2765         status = check_slot_seqid(seq->seqid, slot->sl_seqid,
2766                                         slot->sl_flags & NFSD4_SLOT_INUSE);
2767         if (status == nfserr_replay_cache) {
2768                 status = nfserr_seq_misordered;
2769                 if (!(slot->sl_flags & NFSD4_SLOT_INITIALIZED))
2770                         goto out_put_session;
2771                 cstate->slot = slot;
2772                 cstate->session = session;
2773                 cstate->clp = clp;
2774                 /* Return the cached reply status and set cstate->status
2775                  * for nfsd4_proc_compound processing */
2776                 status = nfsd4_replay_cache_entry(resp, seq);
2777                 cstate->status = nfserr_replay_cache;
2778                 goto out;
2779         }
2780         if (status)
2781                 goto out_put_session;
2782
2783         status = nfsd4_sequence_check_conn(conn, session);
2784         conn = NULL;
2785         if (status)
2786                 goto out_put_session;
2787
2788         buflen = (seq->cachethis) ?
2789                         session->se_fchannel.maxresp_cached :
2790                         session->se_fchannel.maxresp_sz;
2791         status = (seq->cachethis) ? nfserr_rep_too_big_to_cache :
2792                                     nfserr_rep_too_big;
2793         if (xdr_restrict_buflen(xdr, buflen - rqstp->rq_auth_slack))
2794                 goto out_put_session;
2795         svc_reserve(rqstp, buflen);
2796
2797         status = nfs_ok;
2798         /* Success! bump slot seqid */
2799         slot->sl_seqid = seq->seqid;
2800         slot->sl_flags |= NFSD4_SLOT_INUSE;
2801         if (seq->cachethis)
2802                 slot->sl_flags |= NFSD4_SLOT_CACHETHIS;
2803         else
2804                 slot->sl_flags &= ~NFSD4_SLOT_CACHETHIS;
2805
2806         cstate->slot = slot;
2807         cstate->session = session;
2808         cstate->clp = clp;
2809
2810 out:
2811         switch (clp->cl_cb_state) {
2812         case NFSD4_CB_DOWN:
2813                 seq->status_flags = SEQ4_STATUS_CB_PATH_DOWN;
2814                 break;
2815         case NFSD4_CB_FAULT:
2816                 seq->status_flags = SEQ4_STATUS_BACKCHANNEL_FAULT;
2817                 break;
2818         default:
2819                 seq->status_flags = 0;
2820         }
2821         if (!list_empty(&clp->cl_revoked))
2822                 seq->status_flags |= SEQ4_STATUS_RECALLABLE_STATE_REVOKED;
2823 out_no_session:
2824         if (conn)
2825                 free_conn(conn);
2826         spin_unlock(&nn->client_lock);
2827         return status;
2828 out_put_session:
2829         nfsd4_put_session_locked(session);
2830         goto out_no_session;
2831 }
2832
2833 void
2834 nfsd4_sequence_done(struct nfsd4_compoundres *resp)
2835 {
2836         struct nfsd4_compound_state *cs = &resp->cstate;
2837
2838         if (nfsd4_has_session(cs)) {
2839                 if (cs->status != nfserr_replay_cache) {
2840                         nfsd4_store_cache_entry(resp);
2841                         cs->slot->sl_flags &= ~NFSD4_SLOT_INUSE;
2842                 }
2843                 /* Drop session reference that was taken in nfsd4_sequence() */
2844                 nfsd4_put_session(cs->session);
2845         } else if (cs->clp)
2846                 put_client_renew(cs->clp);
2847 }
2848
2849 __be32
2850 nfsd4_destroy_clientid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, struct nfsd4_destroy_clientid *dc)
2851 {
2852         struct nfs4_client *conf, *unconf;
2853         struct nfs4_client *clp = NULL;
2854         __be32 status = 0;
2855         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
2856
2857         spin_lock(&nn->client_lock);
2858         unconf = find_unconfirmed_client(&dc->clientid, true, nn);
2859         conf = find_confirmed_client(&dc->clientid, true, nn);
2860         WARN_ON_ONCE(conf && unconf);
2861
2862         if (conf) {
2863                 if (client_has_state(conf)) {
2864                         status = nfserr_clientid_busy;
2865                         goto out;
2866                 }
2867                 status = mark_client_expired_locked(conf);
2868                 if (status)
2869                         goto out;
2870                 clp = conf;
2871         } else if (unconf)
2872                 clp = unconf;
2873         else {
2874                 status = nfserr_stale_clientid;
2875                 goto out;
2876         }
2877         if (!mach_creds_match(clp, rqstp)) {
2878                 clp = NULL;
2879                 status = nfserr_wrong_cred;
2880                 goto out;
2881         }
2882         unhash_client_locked(clp);
2883 out:
2884         spin_unlock(&nn->client_lock);
2885         if (clp)
2886                 expire_client(clp);
2887         return status;
2888 }
2889
2890 __be32
2891 nfsd4_reclaim_complete(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, struct nfsd4_reclaim_complete *rc)
2892 {
2893         __be32 status = 0;
2894
2895         if (rc->rca_one_fs) {
2896                 if (!cstate->current_fh.fh_dentry)
2897                         return nfserr_nofilehandle;
2898                 /*
2899                  * We don't take advantage of the rca_one_fs case.
2900                  * That's OK, it's optional, we can safely ignore it.
2901                  */
2902                  return nfs_ok;
2903         }
2904
2905         status = nfserr_complete_already;
2906         if (test_and_set_bit(NFSD4_CLIENT_RECLAIM_COMPLETE,
2907                              &cstate->session->se_client->cl_flags))
2908                 goto out;
2909
2910         status = nfserr_stale_clientid;
2911         if (is_client_expired(cstate->session->se_client))
2912                 /*
2913                  * The following error isn't really legal.
2914                  * But we only get here if the client just explicitly
2915                  * destroyed the client.  Surely it no longer cares what
2916                  * error it gets back on an operation for the dead
2917                  * client.
2918                  */
2919                 goto out;
2920
2921         status = nfs_ok;
2922         nfsd4_client_record_create(cstate->session->se_client);
2923 out:
2924         return status;
2925 }
2926
2927 __be32
2928 nfsd4_setclientid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
2929                   struct nfsd4_setclientid *setclid)
2930 {
2931         struct xdr_netobj       clname = setclid->se_name;
2932         nfs4_verifier           clverifier = setclid->se_verf;
2933         struct nfs4_client      *conf, *new;
2934         struct nfs4_client      *unconf = NULL;
2935         __be32                  status;
2936         struct nfsd_net         *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
2937
2938         new = create_client(clname, rqstp, &clverifier);
2939         if (new == NULL)
2940                 return nfserr_jukebox;
2941         /* Cases below refer to rfc 3530 section 14.2.33: */
2942         spin_lock(&nn->client_lock);
2943         conf = find_confirmed_client_by_name(&clname, nn);
2944         if (conf) {
2945                 /* case 0: */
2946                 status = nfserr_clid_inuse;
2947                 if (clp_used_exchangeid(conf))
2948                         goto out;
2949                 if (!same_creds(&conf->cl_cred, &rqstp->rq_cred)) {
2950                         char addr_str[INET6_ADDRSTRLEN];
2951                         rpc_ntop((struct sockaddr *) &conf->cl_addr, addr_str,
2952                                  sizeof(addr_str));
2953                         dprintk("NFSD: setclientid: string in use by client "
2954                                 "at %s\n", addr_str);
2955                         goto out;
2956                 }
2957         }
2958         unconf = find_unconfirmed_client_by_name(&clname, nn);
2959         if (unconf)
2960                 unhash_client_locked(unconf);
2961         if (conf && same_verf(&conf->cl_verifier, &clverifier))
2962                 /* case 1: probable callback update */
2963                 copy_clid(new, conf);
2964         else /* case 4 (new client) or cases 2, 3 (client reboot): */
2965                 gen_clid(new, nn);
2966         new->cl_minorversion = 0;
2967         gen_callback(new, setclid, rqstp);
2968         add_to_unconfirmed(new);
2969         setclid->se_clientid.cl_boot = new->cl_clientid.cl_boot;
2970         setclid->se_clientid.cl_id = new->cl_clientid.cl_id;
2971         memcpy(setclid->se_confirm.data, new->cl_confirm.data, sizeof(setclid->se_confirm.data));
2972         new = NULL;
2973         status = nfs_ok;
2974 out:
2975         spin_unlock(&nn->client_lock);
2976         if (new)
2977                 free_client(new);
2978         if (unconf)
2979                 expire_client(unconf);
2980         return status;
2981 }
2982
2983
2984 __be32
2985 nfsd4_setclientid_confirm(struct svc_rqst *rqstp,
2986                          struct nfsd4_compound_state *cstate,
2987                          struct nfsd4_setclientid_confirm *setclientid_confirm)
2988 {
2989         struct nfs4_client *conf, *unconf;
2990         struct nfs4_client *old = NULL;
2991         nfs4_verifier confirm = setclientid_confirm->sc_confirm;
2992         clientid_t * clid = &setclientid_confirm->sc_clientid;
2993         __be32 status;
2994         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
2995
2996         if (STALE_CLIENTID(clid, nn))
2997                 return nfserr_stale_clientid;
2998
2999         spin_lock(&nn->client_lock);
3000         conf = find_confirmed_client(clid, false, nn);
3001         unconf = find_unconfirmed_client(clid, false, nn);
3002         /*
3003          * We try hard to give out unique clientid's, so if we get an
3004          * attempt to confirm the same clientid with a different cred,
3005          * there's a bug somewhere.  Let's charitably assume it's our
3006          * bug.
3007          */
3008         status = nfserr_serverfault;
3009         if (unconf && !same_creds(&unconf->cl_cred, &rqstp->rq_cred))
3010                 goto out;
3011         if (conf && !same_creds(&conf->cl_cred, &rqstp->rq_cred))
3012                 goto out;
3013         /* cases below refer to rfc 3530 section 14.2.34: */
3014         if (!unconf || !same_verf(&confirm, &unconf->cl_confirm)) {
3015                 if (conf && !unconf) /* case 2: probable retransmit */
3016                         status = nfs_ok;
3017                 else /* case 4: client hasn't noticed we rebooted yet? */
3018                         status = nfserr_stale_clientid;
3019                 goto out;
3020         }
3021         status = nfs_ok;
3022         if (conf) { /* case 1: callback update */
3023                 old = unconf;
3024                 unhash_client_locked(old);
3025                 nfsd4_change_callback(conf, &unconf->cl_cb_conn);
3026         } else { /* case 3: normal case; new or rebooted client */
3027                 old = find_confirmed_client_by_name(&unconf->cl_name, nn);
3028                 if (old) {
3029                         status = mark_client_expired_locked(old);
3030                         if (status) {
3031                                 old = NULL;
3032                                 goto out;
3033                         }
3034                 }
3035                 move_to_confirmed(unconf);
3036                 conf = unconf;
3037         }
3038         get_client_locked(conf);
3039         spin_unlock(&nn->client_lock);
3040         nfsd4_probe_callback(conf);
3041         spin_lock(&nn->client_lock);
3042         put_client_renew_locked(conf);
3043 out:
3044         spin_unlock(&nn->client_lock);
3045         if (old)
3046                 expire_client(old);
3047         return status;
3048 }
3049
3050 static struct nfs4_file *nfsd4_alloc_file(void)
3051 {
3052         return kmem_cache_alloc(file_slab, GFP_KERNEL);
3053 }
3054
3055 /* OPEN Share state helper functions */
3056 static void nfsd4_init_file(struct nfs4_file *fp, struct knfsd_fh *fh)
3057 {
3058         unsigned int hashval = file_hashval(fh);
3059
3060         lockdep_assert_held(&state_lock);
3061
3062         atomic_set(&fp->fi_ref, 1);
3063         spin_lock_init(&fp->fi_lock);
3064         INIT_LIST_HEAD(&fp->fi_stateids);
3065         INIT_LIST_HEAD(&fp->fi_delegations);
3066         fh_copy_shallow(&fp->fi_fhandle, fh);
3067         fp->fi_deleg_file = NULL;
3068         fp->fi_had_conflict = false;
3069         fp->fi_share_deny = 0;
3070         memset(fp->fi_fds, 0, sizeof(fp->fi_fds));
3071         memset(fp->fi_access, 0, sizeof(fp->fi_access));
3072         hlist_add_head(&fp->fi_hash, &file_hashtbl[hashval]);
3073 }
3074
3075 void
3076 nfsd4_free_slabs(void)
3077 {
3078         kmem_cache_destroy(openowner_slab);
3079         kmem_cache_destroy(lockowner_slab);
3080         kmem_cache_destroy(file_slab);
3081         kmem_cache_destroy(stateid_slab);
3082         kmem_cache_destroy(deleg_slab);
3083 }
3084
3085 int
3086 nfsd4_init_slabs(void)
3087 {
3088         openowner_slab = kmem_cache_create("nfsd4_openowners",
3089                         sizeof(struct nfs4_openowner), 0, 0, NULL);
3090         if (openowner_slab == NULL)
3091                 goto out;
3092         lockowner_slab = kmem_cache_create("nfsd4_lockowners",
3093                         sizeof(struct nfs4_lockowner), 0, 0, NULL);
3094         if (lockowner_slab == NULL)
3095                 goto out_free_openowner_slab;
3096         file_slab = kmem_cache_create("nfsd4_files",
3097                         sizeof(struct nfs4_file), 0, 0, NULL);
3098         if (file_slab == NULL)
3099                 goto out_free_lockowner_slab;
3100         stateid_slab = kmem_cache_create("nfsd4_stateids",
3101                         sizeof(struct nfs4_ol_stateid), 0, 0, NULL);
3102         if (stateid_slab == NULL)
3103                 goto out_free_file_slab;
3104         deleg_slab = kmem_cache_create("nfsd4_delegations",
3105                         sizeof(struct nfs4_delegation), 0, 0, NULL);
3106         if (deleg_slab == NULL)
3107                 goto out_free_stateid_slab;
3108         return 0;
3109
3110 out_free_stateid_slab:
3111         kmem_cache_destroy(stateid_slab);
3112 out_free_file_slab:
3113         kmem_cache_destroy(file_slab);
3114 out_free_lockowner_slab:
3115         kmem_cache_destroy(lockowner_slab);
3116 out_free_openowner_slab:
3117         kmem_cache_destroy(openowner_slab);
3118 out:
3119         dprintk("nfsd4: out of memory while initializing nfsv4\n");
3120         return -ENOMEM;
3121 }
3122
3123 static void init_nfs4_replay(struct nfs4_replay *rp)
3124 {
3125         rp->rp_status = nfserr_serverfault;
3126         rp->rp_buflen = 0;
3127         rp->rp_buf = rp->rp_ibuf;
3128         mutex_init(&rp->rp_mutex);
3129 }
3130
3131 static void nfsd4_cstate_assign_replay(struct nfsd4_compound_state *cstate,
3132                 struct nfs4_stateowner *so)
3133 {
3134         if (!nfsd4_has_session(cstate)) {
3135                 mutex_lock(&so->so_replay.rp_mutex);
3136                 cstate->replay_owner = nfs4_get_stateowner(so);
3137         }
3138 }
3139
3140 void nfsd4_cstate_clear_replay(struct nfsd4_compound_state *cstate)
3141 {
3142         struct nfs4_stateowner *so = cstate->replay_owner;
3143
3144         if (so != NULL) {
3145                 cstate->replay_owner = NULL;
3146                 mutex_unlock(&so->so_replay.rp_mutex);
3147                 nfs4_put_stateowner(so);
3148         }
3149 }
3150
3151 static inline void *alloc_stateowner(struct kmem_cache *slab, struct xdr_netobj *owner, struct nfs4_client *clp)
3152 {
3153         struct nfs4_stateowner *sop;
3154
3155         sop = kmem_cache_alloc(slab, GFP_KERNEL);
3156         if (!sop)
3157                 return NULL;
3158
3159         sop->so_owner.data = kmemdup(owner->data, owner->len, GFP_KERNEL);
3160         if (!sop->so_owner.data) {
3161                 kmem_cache_free(slab, sop);
3162                 return NULL;
3163         }
3164         sop->so_owner.len = owner->len;
3165
3166         INIT_LIST_HEAD(&sop->so_stateids);
3167         sop->so_client = clp;
3168         init_nfs4_replay(&sop->so_replay);
3169         atomic_set(&sop->so_count, 1);
3170         return sop;
3171 }
3172
3173 static void hash_openowner(struct nfs4_openowner *oo, struct nfs4_client *clp, unsigned int strhashval)
3174 {
3175         lockdep_assert_held(&clp->cl_lock);
3176
3177         list_add(&oo->oo_owner.so_strhash,
3178                  &clp->cl_ownerstr_hashtbl[strhashval]);
3179         list_add(&oo->oo_perclient, &clp->cl_openowners);
3180 }
3181
3182 static void nfs4_unhash_openowner(struct nfs4_stateowner *so)
3183 {
3184         unhash_openowner_locked(openowner(so));
3185 }
3186
3187 static void nfs4_free_openowner(struct nfs4_stateowner *so)
3188 {
3189         struct nfs4_openowner *oo = openowner(so);
3190
3191         kmem_cache_free(openowner_slab, oo);
3192 }
3193
3194 static const struct nfs4_stateowner_operations openowner_ops = {
3195         .so_unhash =    nfs4_unhash_openowner,
3196         .so_free =      nfs4_free_openowner,
3197 };
3198
3199 static struct nfs4_openowner *
3200 alloc_init_open_stateowner(unsigned int strhashval, struct nfsd4_open *open,
3201                            struct nfsd4_compound_state *cstate)
3202 {
3203         struct nfs4_client *clp = cstate->clp;
3204         struct nfs4_openowner *oo, *ret;
3205
3206         oo = alloc_stateowner(openowner_slab, &open->op_owner, clp);
3207         if (!oo)
3208                 return NULL;
3209         oo->oo_owner.so_ops = &openowner_ops;
3210         oo->oo_owner.so_is_open_owner = 1;
3211         oo->oo_owner.so_seqid = open->op_seqid;
3212         oo->oo_flags = 0;
3213         if (nfsd4_has_session(cstate))
3214                 oo->oo_flags |= NFS4_OO_CONFIRMED;
3215         oo->oo_time = 0;
3216         oo->oo_last_closed_stid = NULL;
3217         INIT_LIST_HEAD(&oo->oo_close_lru);
3218         spin_lock(&clp->cl_lock);
3219         ret = find_openstateowner_str_locked(strhashval, open, clp);
3220         if (ret == NULL) {
3221                 hash_openowner(oo, clp, strhashval);
3222                 ret = oo;
3223         } else
3224                 nfs4_free_openowner(&oo->oo_owner);
3225         spin_unlock(&clp->cl_lock);
3226         return oo;
3227 }
3228
3229 static void init_open_stateid(struct nfs4_ol_stateid *stp, struct nfs4_file *fp, struct nfsd4_open *open) {
3230         struct nfs4_openowner *oo = open->op_openowner;
3231
3232         atomic_inc(&stp->st_stid.sc_count);
3233         stp->st_stid.sc_type = NFS4_OPEN_STID;
3234         INIT_LIST_HEAD(&stp->st_locks);
3235         stp->st_stateowner = nfs4_get_stateowner(&oo->oo_owner);
3236         get_nfs4_file(fp);
3237         stp->st_stid.sc_file = fp;
3238         stp->st_access_bmap = 0;
3239         stp->st_deny_bmap = 0;
3240         stp->st_openstp = NULL;
3241         spin_lock(&oo->oo_owner.so_client->cl_lock);
3242         list_add(&stp->st_perstateowner, &oo->oo_owner.so_stateids);
3243         spin_lock(&fp->fi_lock);
3244         list_add(&stp->st_perfile, &fp->fi_stateids);
3245         spin_unlock(&fp->fi_lock);
3246         spin_unlock(&oo->oo_owner.so_client->cl_lock);
3247 }
3248
3249 /*
3250  * In the 4.0 case we need to keep the owners around a little while to handle
3251  * CLOSE replay. We still do need to release any file access that is held by
3252  * them before returning however.
3253  */
3254 static void
3255 move_to_close_lru(struct nfs4_ol_stateid *s, struct net *net)
3256 {
3257         struct nfs4_ol_stateid *last;
3258         struct nfs4_openowner *oo = openowner(s->st_stateowner);
3259         struct nfsd_net *nn = net_generic(s->st_stid.sc_client->net,
3260                                                 nfsd_net_id);
3261
3262         dprintk("NFSD: move_to_close_lru nfs4_openowner %p\n", oo);
3263
3264         /*
3265          * We know that we hold one reference via nfsd4_close, and another
3266          * "persistent" reference for the client. If the refcount is higher
3267          * than 2, then there are still calls in progress that are using this
3268          * stateid. We can't put the sc_file reference until they are finished.
3269          * Wait for the refcount to drop to 2. Since it has been unhashed,
3270          * there should be no danger of the refcount going back up again at
3271          * this point.
3272          */
3273         wait_event(close_wq, atomic_read(&s->st_stid.sc_count) == 2);
3274
3275         release_all_access(s);
3276         if (s->st_stid.sc_file) {
3277                 put_nfs4_file(s->st_stid.sc_file);
3278                 s->st_stid.sc_file = NULL;
3279         }
3280
3281         spin_lock(&nn->client_lock);
3282         last = oo->oo_last_closed_stid;
3283         oo->oo_last_closed_stid = s;
3284         list_move_tail(&oo->oo_close_lru, &nn->close_lru);
3285         oo->oo_time = get_seconds();
3286         spin_unlock(&nn->client_lock);
3287         if (last)
3288                 nfs4_put_stid(&last->st_stid);
3289 }
3290
3291 /* search file_hashtbl[] for file */
3292 static struct nfs4_file *
3293 find_file_locked(struct knfsd_fh *fh)
3294 {
3295         unsigned int hashval = file_hashval(fh);
3296         struct nfs4_file *fp;
3297
3298         lockdep_assert_held(&state_lock);
3299
3300         hlist_for_each_entry(fp, &file_hashtbl[hashval], fi_hash) {
3301                 if (nfsd_fh_match(&fp->fi_fhandle, fh)) {
3302                         get_nfs4_file(fp);
3303                         return fp;
3304                 }
3305         }
3306         return NULL;
3307 }
3308
3309 static struct nfs4_file *
3310 find_file(struct knfsd_fh *fh)
3311 {
3312         struct nfs4_file *fp;
3313
3314         spin_lock(&state_lock);
3315         fp = find_file_locked(fh);
3316         spin_unlock(&state_lock);
3317         return fp;
3318 }
3319
3320 static struct nfs4_file *
3321 find_or_add_file(struct nfs4_file *new, struct knfsd_fh *fh)
3322 {
3323         struct nfs4_file *fp;
3324
3325         spin_lock(&state_lock);
3326         fp = find_file_locked(fh);
3327         if (fp == NULL) {
3328                 nfsd4_init_file(new, fh);
3329                 fp = new;
3330         }
3331         spin_unlock(&state_lock);
3332
3333         return fp;
3334 }
3335
3336 /*
3337  * Called to check deny when READ with all zero stateid or
3338  * WRITE with all zero or all one stateid
3339  */
3340 static __be32
3341 nfs4_share_conflict(struct svc_fh *current_fh, unsigned int deny_type)
3342 {
3343         struct nfs4_file *fp;
3344         __be32 ret = nfs_ok;
3345
3346         fp = find_file(&current_fh->fh_handle);
3347         if (!fp)
3348                 return ret;
3349         /* Check for conflicting share reservations */
3350         spin_lock(&fp->fi_lock);
3351         if (fp->fi_share_deny & deny_type)
3352                 ret = nfserr_locked;
3353         spin_unlock(&fp->fi_lock);
3354         put_nfs4_file(fp);
3355         return ret;
3356 }
3357
3358 void nfsd4_prepare_cb_recall(struct nfs4_delegation *dp)
3359 {
3360         struct nfsd_net *nn = net_generic(dp->dl_stid.sc_client->net,
3361                                           nfsd_net_id);
3362
3363         block_delegations(&dp->dl_stid.sc_file->fi_fhandle);
3364
3365         /*
3366          * We can't do this in nfsd_break_deleg_cb because it is
3367          * already holding inode->i_lock.
3368          *
3369          * If the dl_time != 0, then we know that it has already been
3370          * queued for a lease break. Don't queue it again.
3371          */
3372         spin_lock(&state_lock);
3373         if (dp->dl_time == 0) {
3374                 dp->dl_time = get_seconds();
3375                 list_add_tail(&dp->dl_recall_lru, &nn->del_recall_lru);
3376         }
3377         spin_unlock(&state_lock);
3378 }
3379
3380 static void nfsd_break_one_deleg(struct nfs4_delegation *dp)
3381 {
3382         /*
3383          * We're assuming the state code never drops its reference
3384          * without first removing the lease.  Since we're in this lease
3385          * callback (and since the lease code is serialized by the kernel
3386          * lock) we know the server hasn't removed the lease yet, we know
3387          * it's safe to take a reference.
3388          */
3389         atomic_inc(&dp->dl_stid.sc_count);
3390         nfsd4_cb_recall(dp);
3391 }
3392
3393 /* Called from break_lease() with i_lock held. */
3394 static void nfsd_break_deleg_cb(struct file_lock *fl)
3395 {
3396         struct nfs4_file *fp = (struct nfs4_file *)fl->fl_owner;
3397         struct nfs4_delegation *dp;
3398
3399         if (!fp) {
3400                 WARN(1, "(%p)->fl_owner NULL\n", fl);
3401                 return;
3402         }
3403         if (fp->fi_had_conflict) {
3404                 WARN(1, "duplicate break on %p\n", fp);
3405                 return;
3406         }
3407         /*
3408          * We don't want the locks code to timeout the lease for us;
3409          * we'll remove it ourself if a delegation isn't returned
3410          * in time:
3411          */
3412         fl->fl_break_time = 0;
3413
3414         spin_lock(&fp->fi_lock);
3415         fp->fi_had_conflict = true;
3416         /*
3417          * If there are no delegations on the list, then we can't count on this
3418          * lease ever being cleaned up. Set the fl_break_time to jiffies so that
3419          * time_out_leases will do it ASAP. The fact that fi_had_conflict is now
3420          * true should keep any new delegations from being hashed.
3421          */
3422         if (list_empty(&fp->fi_delegations))
3423                 fl->fl_break_time = jiffies;
3424         else
3425                 list_for_each_entry(dp, &fp->fi_delegations, dl_perfile)
3426                         nfsd_break_one_deleg(dp);
3427         spin_unlock(&fp->fi_lock);
3428 }
3429
3430 static
3431 int nfsd_change_deleg_cb(struct file_lock **onlist, int arg)
3432 {
3433         if (arg & F_UNLCK)
3434                 return lease_modify(onlist, arg);
3435         else
3436                 return -EAGAIN;
3437 }
3438
3439 static const struct lock_manager_operations nfsd_lease_mng_ops = {
3440         .lm_break = nfsd_break_deleg_cb,
3441         .lm_change = nfsd_change_deleg_cb,
3442 };
3443
3444 static __be32 nfsd4_check_seqid(struct nfsd4_compound_state *cstate, struct nfs4_stateowner *so, u32 seqid)
3445 {
3446         if (nfsd4_has_session(cstate))
3447                 return nfs_ok;
3448         if (seqid == so->so_seqid - 1)
3449                 return nfserr_replay_me;
3450         if (seqid == so->so_seqid)
3451                 return nfs_ok;
3452         return nfserr_bad_seqid;
3453 }
3454
3455 static __be32 lookup_clientid(clientid_t *clid,
3456                 struct nfsd4_compound_state *cstate,
3457                 struct nfsd_net *nn)
3458 {
3459         struct nfs4_client *found;
3460
3461         if (cstate->clp) {
3462                 found = cstate->clp;
3463                 if (!same_clid(&found->cl_clientid, clid))
3464                         return nfserr_stale_clientid;
3465                 return nfs_ok;
3466         }
3467
3468         if (STALE_CLIENTID(clid, nn))
3469                 return nfserr_stale_clientid;
3470
3471         /*
3472          * For v4.1+ we get the client in the SEQUENCE op. If we don't have one
3473          * cached already then we know this is for is for v4.0 and "sessions"
3474          * will be false.
3475          */
3476         WARN_ON_ONCE(cstate->session);
3477         spin_lock(&nn->client_lock);
3478         found = find_confirmed_client(clid, false, nn);
3479         if (!found) {
3480                 spin_unlock(&nn->client_lock);
3481                 return nfserr_expired;
3482         }
3483         atomic_inc(&found->cl_refcount);
3484         spin_unlock(&nn->client_lock);
3485
3486         /* Cache the nfs4_client in cstate! */
3487         cstate->clp = found;
3488         return nfs_ok;
3489 }
3490
3491 __be32
3492 nfsd4_process_open1(struct nfsd4_compound_state *cstate,
3493                     struct nfsd4_open *open, struct nfsd_net *nn)
3494 {
3495         clientid_t *clientid = &open->op_clientid;
3496         struct nfs4_client *clp = NULL;
3497         unsigned int strhashval;
3498         struct nfs4_openowner *oo = NULL;
3499         __be32 status;
3500
3501         if (STALE_CLIENTID(&open->op_clientid, nn))
3502                 return nfserr_stale_clientid;
3503         /*
3504          * In case we need it later, after we've already created the
3505          * file and don't want to risk a further failure:
3506          */
3507         open->op_file = nfsd4_alloc_file();
3508         if (open->op_file == NULL)
3509                 return nfserr_jukebox;
3510
3511         status = lookup_clientid(clientid, cstate, nn);
3512         if (status)
3513                 return status;
3514         clp = cstate->clp;
3515
3516         strhashval = ownerstr_hashval(&open->op_owner);
3517         oo = find_openstateowner_str(strhashval, open, clp);
3518         open->op_openowner = oo;
3519         if (!oo) {
3520                 goto new_owner;
3521         }
3522         if (!(oo->oo_flags & NFS4_OO_CONFIRMED)) {
3523                 /* Replace unconfirmed owners without checking for replay. */
3524                 release_openowner(oo);
3525                 open->op_openowner = NULL;
3526                 goto new_owner;
3527         }
3528         status = nfsd4_check_seqid(cstate, &oo->oo_owner, open->op_seqid);
3529         if (status)
3530                 return status;
3531         goto alloc_stateid;
3532 new_owner:
3533         oo = alloc_init_open_stateowner(strhashval, open, cstate);
3534         if (oo == NULL)
3535                 return nfserr_jukebox;
3536         open->op_openowner = oo;
3537 alloc_stateid:
3538         open->op_stp = nfs4_alloc_open_stateid(clp);
3539         if (!open->op_stp)
3540                 return nfserr_jukebox;
3541         return nfs_ok;
3542 }
3543
3544 static inline __be32
3545 nfs4_check_delegmode(struct nfs4_delegation *dp, int flags)
3546 {
3547         if ((flags & WR_STATE) && (dp->dl_type == NFS4_OPEN_DELEGATE_READ))
3548                 return nfserr_openmode;
3549         else
3550                 return nfs_ok;
3551 }
3552
3553 static int share_access_to_flags(u32 share_access)
3554 {
3555         return share_access == NFS4_SHARE_ACCESS_READ ? RD_STATE : WR_STATE;
3556 }
3557
3558 static struct nfs4_delegation *find_deleg_stateid(struct nfs4_client *cl, stateid_t *s)
3559 {
3560         struct nfs4_stid *ret;
3561
3562         ret = find_stateid_by_type(cl, s, NFS4_DELEG_STID);
3563         if (!ret)
3564                 return NULL;
3565         return delegstateid(ret);
3566 }
3567
3568 static bool nfsd4_is_deleg_cur(struct nfsd4_open *open)
3569 {
3570         return open->op_claim_type == NFS4_OPEN_CLAIM_DELEGATE_CUR ||
3571                open->op_claim_type == NFS4_OPEN_CLAIM_DELEG_CUR_FH;
3572 }
3573
3574 static __be32
3575 nfs4_check_deleg(struct nfs4_client *cl, struct nfsd4_open *open,
3576                 struct nfs4_delegation **dp)
3577 {
3578         int flags;
3579         __be32 status = nfserr_bad_stateid;
3580         struct nfs4_delegation *deleg;
3581
3582         deleg = find_deleg_stateid(cl, &open->op_delegate_stateid);
3583         if (deleg == NULL)
3584                 goto out;
3585         flags = share_access_to_flags(open->op_share_access);
3586         status = nfs4_check_delegmode(deleg, flags);
3587         if (status) {
3588                 nfs4_put_stid(&deleg->dl_stid);
3589                 goto out;
3590         }
3591         *dp = deleg;
3592 out:
3593         if (!nfsd4_is_deleg_cur(open))
3594                 return nfs_ok;
3595         if (status)
3596                 return status;
3597         open->op_openowner->oo_flags |= NFS4_OO_CONFIRMED;
3598         return nfs_ok;
3599 }
3600
3601 static struct nfs4_ol_stateid *
3602 nfsd4_find_existing_open(struct nfs4_file *fp, struct nfsd4_open *open)
3603 {
3604         struct nfs4_ol_stateid *local, *ret = NULL;
3605         struct nfs4_openowner *oo = open->op_openowner;
3606
3607         spin_lock(&fp->fi_lock);
3608         list_for_each_entry(local, &fp->fi_stateids, st_perfile) {
3609                 /* ignore lock owners */
3610                 if (local->st_stateowner->so_is_open_owner == 0)
3611                         continue;
3612                 if (local->st_stateowner == &oo->oo_owner) {
3613                         ret = local;
3614                         atomic_inc(&ret->st_stid.sc_count);
3615                         break;
3616                 }
3617         }
3618         spin_unlock(&fp->fi_lock);
3619         return ret;
3620 }
3621
3622 static inline int nfs4_access_to_access(u32 nfs4_access)
3623 {
3624         int flags = 0;
3625
3626         if (nfs4_access & NFS4_SHARE_ACCESS_READ)
3627                 flags |= NFSD_MAY_READ;
3628         if (nfs4_access & NFS4_SHARE_ACCESS_WRITE)
3629                 flags |= NFSD_MAY_WRITE;
3630         return flags;
3631 }
3632
3633 static inline __be32
3634 nfsd4_truncate(struct svc_rqst *rqstp, struct svc_fh *fh,
3635                 struct nfsd4_open *open)
3636 {
3637         struct iattr iattr = {
3638                 .ia_valid = ATTR_SIZE,
3639                 .ia_size = 0,
3640         };
3641         if (!open->op_truncate)
3642                 return 0;
3643         if (!(open->op_share_access & NFS4_SHARE_ACCESS_WRITE))
3644                 return nfserr_inval;
3645         return nfsd_setattr(rqstp, fh, &iattr, 0, (time_t)0);
3646 }
3647
3648 static __be32 nfs4_get_vfs_file(struct svc_rqst *rqstp, struct nfs4_file *fp,
3649                 struct svc_fh *cur_fh, struct nfs4_ol_stateid *stp,
3650                 struct nfsd4_open *open)
3651 {
3652         struct file *filp = NULL;
3653         __be32 status;
3654         int oflag = nfs4_access_to_omode(open->op_share_access);
3655         int access = nfs4_access_to_access(open->op_share_access);
3656         unsigned char old_access_bmap, old_deny_bmap;
3657
3658         spin_lock(&fp->fi_lock);
3659
3660         /*
3661          * Are we trying to set a deny mode that would conflict with
3662          * current access?
3663          */
3664         status = nfs4_file_check_deny(fp, open->op_share_deny);
3665         if (status != nfs_ok) {
3666                 spin_unlock(&fp->fi_lock);
3667                 goto out;
3668         }
3669
3670         /* set access to the file */
3671         status = nfs4_file_get_access(fp, open->op_share_access);
3672         if (status != nfs_ok) {
3673                 spin_unlock(&fp->fi_lock);
3674                 goto out;
3675         }
3676
3677         /* Set access bits in stateid */
3678         old_access_bmap = stp->st_access_bmap;
3679         set_access(open->op_share_access, stp);
3680
3681         /* Set new deny mask */
3682         old_deny_bmap = stp->st_deny_bmap;
3683         set_deny(open->op_share_deny, stp);
3684         fp->fi_share_deny |= (open->op_share_deny & NFS4_SHARE_DENY_BOTH);
3685
3686         if (!fp->fi_fds[oflag]) {
3687                 spin_unlock(&fp->fi_lock);
3688                 status = nfsd_open(rqstp, cur_fh, S_IFREG, access, &filp);
3689                 if (status)
3690                         goto out_put_access;
3691                 spin_lock(&fp->fi_lock);
3692                 if (!fp->fi_fds[oflag]) {
3693                         fp->fi_fds[oflag] = filp;
3694                         filp = NULL;
3695                 }
3696         }
3697         spin_unlock(&fp->fi_lock);
3698         if (filp)
3699                 fput(filp);
3700
3701         status = nfsd4_truncate(rqstp, cur_fh, open);
3702         if (status)
3703                 goto out_put_access;
3704 out:
3705         return status;
3706 out_put_access:
3707         stp->st_access_bmap = old_access_bmap;
3708         nfs4_file_put_access(fp, open->op_share_access);
3709         reset_union_bmap_deny(bmap_to_share_mode(old_deny_bmap), stp);
3710         goto out;
3711 }
3712
3713 static __be32
3714 nfs4_upgrade_open(struct svc_rqst *rqstp, struct nfs4_file *fp, struct svc_fh *cur_fh, struct nfs4_ol_stateid *stp, struct nfsd4_open *open)
3715 {
3716         __be32 status;
3717         unsigned char old_deny_bmap;
3718
3719         if (!test_access(open->op_share_access, stp))
3720                 return nfs4_get_vfs_file(rqstp, fp, cur_fh, stp, open);
3721
3722         /* test and set deny mode */
3723         spin_lock(&fp->fi_lock);
3724         status = nfs4_file_check_deny(fp, open->op_share_deny);
3725         if (status == nfs_ok) {
3726                 old_deny_bmap = stp->st_deny_bmap;
3727                 set_deny(open->op_share_deny, stp);
3728                 fp->fi_share_deny |=
3729                                 (open->op_share_deny & NFS4_SHARE_DENY_BOTH);
3730         }
3731         spin_unlock(&fp->fi_lock);
3732
3733         if (status != nfs_ok)
3734                 return status;
3735
3736         status = nfsd4_truncate(rqstp, cur_fh, open);
3737         if (status != nfs_ok)
3738                 reset_union_bmap_deny(old_deny_bmap, stp);
3739         return status;
3740 }
3741
3742 static void
3743 nfs4_set_claim_prev(struct nfsd4_open *open, bool has_session)
3744 {
3745         open->op_openowner->oo_flags |= NFS4_OO_CONFIRMED;
3746 }
3747
3748 /* Should we give out recallable state?: */
3749 static bool nfsd4_cb_channel_good(struct nfs4_client *clp)
3750 {
3751         if (clp->cl_cb_state == NFSD4_CB_UP)
3752                 return true;
3753         /*
3754          * In the sessions case, since we don't have to establish a
3755          * separate connection for callbacks, we assume it's OK
3756          * until we hear otherwise:
3757          */
3758         return clp->cl_minorversion && clp->cl_cb_state == NFSD4_CB_UNKNOWN;
3759 }
3760
3761 static struct file_lock *nfs4_alloc_init_lease(struct nfs4_file *fp, int flag)
3762 {
3763         struct file_lock *fl;
3764
3765         fl = locks_alloc_lock();
3766         if (!fl)
3767                 return NULL;
3768         fl->fl_lmops = &nfsd_lease_mng_ops;
3769         fl->fl_flags = FL_DELEG;
3770         fl->fl_type = flag == NFS4_OPEN_DELEGATE_READ? F_RDLCK: F_WRLCK;
3771         fl->fl_end = OFFSET_MAX;
3772         fl->fl_owner = (fl_owner_t)fp;
3773         fl->fl_pid = current->tgid;
3774         return fl;
3775 }
3776
3777 static int nfs4_setlease(struct nfs4_delegation *dp)
3778 {
3779         struct nfs4_file *fp = dp->dl_stid.sc_file;
3780         struct file_lock *fl, *ret;
3781         struct file *filp;
3782         int status = 0;
3783
3784         fl = nfs4_alloc_init_lease(fp, NFS4_OPEN_DELEGATE_READ);
3785         if (!fl)
3786                 return -ENOMEM;
3787         filp = find_readable_file(fp);
3788         if (!filp) {
3789                 /* We should always have a readable file here */
3790                 WARN_ON_ONCE(1);
3791                 return -EBADF;
3792         }
3793         fl->fl_file = filp;
3794         ret = fl;
3795         status = vfs_setlease(filp, fl->fl_type, &fl, NULL);
3796         if (status) {
3797                 locks_free_lock(fl);
3798                 goto out_fput;
3799         }
3800         if (ret != fl)
3801                 locks_free_lock(fl);
3802         spin_lock(&state_lock);
3803         spin_lock(&fp->fi_lock);
3804         /* Did the lease get broken before we took the lock? */
3805         status = -EAGAIN;
3806         if (fp->fi_had_conflict)
3807                 goto out_unlock;
3808         /* Race breaker */
3809         if (fp->fi_deleg_file) {
3810                 status = 0;
3811                 atomic_inc(&fp->fi_delegees);
3812                 hash_delegation_locked(dp, fp);
3813                 goto out_unlock;
3814         }
3815         fp->fi_deleg_file = filp;
3816         atomic_set(&fp->fi_delegees, 1);
3817         hash_delegation_locked(dp, fp);
3818         spin_unlock(&fp->fi_lock);
3819         spin_unlock(&state_lock);
3820         return 0;
3821 out_unlock:
3822         spin_unlock(&fp->fi_lock);
3823         spin_unlock(&state_lock);
3824 out_fput:
3825         fput(filp);
3826         return status;
3827 }
3828
3829 static struct nfs4_delegation *
3830 nfs4_set_delegation(struct nfs4_client *clp, struct svc_fh *fh,
3831                     struct nfs4_file *fp)
3832 {
3833         int status;
3834         struct nfs4_delegation *dp;
3835
3836         if (fp->fi_had_conflict)
3837                 return ERR_PTR(-EAGAIN);
3838
3839         dp = alloc_init_deleg(clp, fh);
3840         if (!dp)
3841                 return ERR_PTR(-ENOMEM);
3842
3843         get_nfs4_file(fp);
3844         spin_lock(&state_lock);
3845         spin_lock(&fp->fi_lock);
3846         dp->dl_stid.sc_file = fp;
3847         if (!fp->fi_deleg_file) {
3848                 spin_unlock(&fp->fi_lock);
3849                 spin_unlock(&state_lock);
3850                 status = nfs4_setlease(dp);
3851                 goto out;
3852         }
3853         atomic_inc(&fp->fi_delegees);
3854         if (fp->fi_had_conflict) {
3855                 status = -EAGAIN;
3856                 goto out_unlock;
3857         }
3858         hash_delegation_locked(dp, fp);
3859         status = 0;
3860 out_unlock:
3861         spin_unlock(&fp->fi_lock);
3862         spin_unlock(&state_lock);
3863 out:
3864         if (status) {
3865                 nfs4_put_stid(&dp->dl_stid);
3866                 return ERR_PTR(status);
3867         }
3868         return dp;
3869 }
3870
3871 static void nfsd4_open_deleg_none_ext(struct nfsd4_open *open, int status)
3872 {
3873         open->op_delegate_type = NFS4_OPEN_DELEGATE_NONE_EXT;
3874         if (status == -EAGAIN)
3875                 open->op_why_no_deleg = WND4_CONTENTION;
3876         else {
3877                 open->op_why_no_deleg = WND4_RESOURCE;
3878                 switch (open->op_deleg_want) {
3879                 case NFS4_SHARE_WANT_READ_DELEG:
3880                 case NFS4_SHARE_WANT_WRITE_DELEG:
3881                 case NFS4_SHARE_WANT_ANY_DELEG:
3882                         break;
3883                 case NFS4_SHARE_WANT_CANCEL:
3884                         open->op_why_no_deleg = WND4_CANCELLED;
3885                         break;
3886                 case NFS4_SHARE_WANT_NO_DELEG:
3887                         WARN_ON_ONCE(1);
3888                 }
3889         }
3890 }
3891
3892 /*
3893  * Attempt to hand out a delegation.
3894  *
3895  * Note we don't support write delegations, and won't until the vfs has
3896  * proper support for them.
3897  */
3898 static void
3899 nfs4_open_delegation(struct svc_fh *fh, struct nfsd4_open *open,
3900                         struct nfs4_ol_stateid *stp)
3901 {
3902         struct nfs4_delegation *dp;
3903         struct nfs4_openowner *oo = openowner(stp->st_stateowner);
3904         struct nfs4_client *clp = stp->st_stid.sc_client;
3905         int cb_up;
3906         int status = 0;
3907
3908         cb_up = nfsd4_cb_channel_good(oo->oo_owner.so_client);
3909         open->op_recall = 0;
3910         switch (open->op_claim_type) {
3911                 case NFS4_OPEN_CLAIM_PREVIOUS:
3912                         if (!cb_up)
3913                                 open->op_recall = 1;
3914                         if (open->op_delegate_type != NFS4_OPEN_DELEGATE_READ)
3915                                 goto out_no_deleg;
3916                         break;
3917                 case NFS4_OPEN_CLAIM_NULL:
3918                 case NFS4_OPEN_CLAIM_FH:
3919                         /*
3920                          * Let's not give out any delegations till everyone's
3921                          * had the chance to reclaim theirs....
3922                          */
3923                         if (locks_in_grace(clp->net))
3924                                 goto out_no_deleg;
3925                         if (!cb_up || !(oo->oo_flags & NFS4_OO_CONFIRMED))
3926                                 goto out_no_deleg;
3927                         /*
3928                          * Also, if the file was opened for write or
3929                          * create, there's a good chance the client's
3930                          * about to write to it, resulting in an
3931                          * immediate recall (since we don't support
3932                          * write delegations):
3933                          */
3934                         if (open->op_share_access & NFS4_SHARE_ACCESS_WRITE)
3935                                 goto out_no_deleg;
3936                         if (open->op_create == NFS4_OPEN_CREATE)
3937                                 goto out_no_deleg;
3938                         break;
3939                 default:
3940                         goto out_no_deleg;
3941         }
3942         dp = nfs4_set_delegation(clp, fh, stp->st_stid.sc_file);
3943         if (IS_ERR(dp))
3944                 goto out_no_deleg;
3945
3946         memcpy(&open->op_delegate_stateid, &dp->dl_stid.sc_stateid, sizeof(dp->dl_stid.sc_stateid));
3947
3948         dprintk("NFSD: delegation stateid=" STATEID_FMT "\n",
3949                 STATEID_VAL(&dp->dl_stid.sc_stateid));
3950         open->op_delegate_type = NFS4_OPEN_DELEGATE_READ;
3951         nfs4_put_stid(&dp->dl_stid);
3952         return;
3953 out_no_deleg:
3954         open->op_delegate_type = NFS4_OPEN_DELEGATE_NONE;
3955         if (open->op_claim_type == NFS4_OPEN_CLAIM_PREVIOUS &&
3956             open->op_delegate_type != NFS4_OPEN_DELEGATE_NONE) {
3957                 dprintk("NFSD: WARNING: refusing delegation reclaim\n");
3958                 open->op_recall = 1;
3959         }
3960
3961         /* 4.1 client asking for a delegation? */
3962         if (open->op_deleg_want)
3963                 nfsd4_open_deleg_none_ext(open, status);
3964         return;
3965 }
3966
3967 static void nfsd4_deleg_xgrade_none_ext(struct nfsd4_open *open,
3968                                         struct nfs4_delegation *dp)
3969 {
3970         if (open->op_deleg_want == NFS4_SHARE_WANT_READ_DELEG &&
3971             dp->dl_type == NFS4_OPEN_DELEGATE_WRITE) {
3972                 open->op_delegate_type = NFS4_OPEN_DELEGATE_NONE_EXT;
3973                 open->op_why_no_deleg = WND4_NOT_SUPP_DOWNGRADE;
3974         } else if (open->op_deleg_want == NFS4_SHARE_WANT_WRITE_DELEG &&
3975                    dp->dl_type == NFS4_OPEN_DELEGATE_WRITE) {
3976                 open->op_delegate_type = NFS4_OPEN_DELEGATE_NONE_EXT;
3977                 open->op_why_no_deleg = WND4_NOT_SUPP_UPGRADE;
3978         }
3979         /* Otherwise the client must be confused wanting a delegation
3980          * it already has, therefore we don't return
3981          * NFS4_OPEN_DELEGATE_NONE_EXT and reason.
3982          */
3983 }
3984
3985 __be32
3986 nfsd4_process_open2(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_open *open)
3987 {
3988         struct nfsd4_compoundres *resp = rqstp->rq_resp;
3989         struct nfs4_client *cl = open->op_openowner->oo_owner.so_client;
3990         struct nfs4_file *fp = NULL;
3991         struct nfs4_ol_stateid *stp = NULL;
3992         struct nfs4_delegation *dp = NULL;
3993         __be32 status;
3994
3995         /*
3996          * Lookup file; if found, lookup stateid and check open request,
3997          * and check for delegations in the process of being recalled.
3998          * If not found, create the nfs4_file struct
3999          */
4000         fp = find_or_add_file(open->op_file, &current_fh->fh_handle);
4001         if (fp != open->op_file) {
4002                 status = nfs4_check_deleg(cl, open, &dp);
4003                 if (status)
4004                         goto out;
4005                 stp = nfsd4_find_existing_open(fp, open);
4006         } else {
4007                 open->op_file = NULL;
4008                 status = nfserr_bad_stateid;
4009                 if (nfsd4_is_deleg_cur(open))
4010                         goto out;
4011                 status = nfserr_jukebox;
4012         }
4013
4014         /*
4015          * OPEN the file, or upgrade an existing OPEN.
4016          * If truncate fails, the OPEN fails.
4017          */
4018         if (stp) {
4019                 /* Stateid was found, this is an OPEN upgrade */
4020                 status = nfs4_upgrade_open(rqstp, fp, current_fh, stp, open);
4021                 if (status)
4022                         goto out;
4023         } else {
4024                 stp = open->op_stp;
4025                 open->op_stp = NULL;
4026                 init_open_stateid(stp, fp, open);
4027                 status = nfs4_get_vfs_file(rqstp, fp, current_fh, stp, open);
4028                 if (status) {
4029                         release_open_stateid(stp);
4030                         goto out;
4031                 }
4032         }
4033         update_stateid(&stp->st_stid.sc_stateid);
4034         memcpy(&open->op_stateid, &stp->st_stid.sc_stateid, sizeof(stateid_t));
4035
4036         if (nfsd4_has_session(&resp->cstate)) {
4037                 if (open->op_deleg_want & NFS4_SHARE_WANT_NO_DELEG) {
4038                         open->op_delegate_type = NFS4_OPEN_DELEGATE_NONE_EXT;
4039                         open->op_why_no_deleg = WND4_NOT_WANTED;
4040                         goto nodeleg;
4041                 }
4042         }
4043
4044         /*
4045         * Attempt to hand out a delegation. No error return, because the
4046         * OPEN succeeds even if we fail.
4047         */
4048         nfs4_open_delegation(current_fh, open, stp);
4049 nodeleg:
4050         status = nfs_ok;
4051
4052         dprintk("%s: stateid=" STATEID_FMT "\n", __func__,
4053                 STATEID_VAL(&stp->st_stid.sc_stateid));
4054 out:
4055         /* 4.1 client trying to upgrade/downgrade delegation? */
4056         if (open->op_delegate_type == NFS4_OPEN_DELEGATE_NONE && dp &&
4057             open->op_deleg_want)
4058                 nfsd4_deleg_xgrade_none_ext(open, dp);
4059
4060         if (fp)
4061                 put_nfs4_file(fp);
4062         if (status == 0 && open->op_claim_type == NFS4_OPEN_CLAIM_PREVIOUS)
4063                 nfs4_set_claim_prev(open, nfsd4_has_session(&resp->cstate));
4064         /*
4065         * To finish the open response, we just need to set the rflags.
4066         */
4067         open->op_rflags = NFS4_OPEN_RESULT_LOCKTYPE_POSIX;
4068         if (!(open->op_openowner->oo_flags & NFS4_OO_CONFIRMED) &&
4069             !nfsd4_has_session(&resp->cstate))
4070                 open->op_rflags |= NFS4_OPEN_RESULT_CONFIRM;
4071         if (dp)
4072                 nfs4_put_stid(&dp->dl_stid);
4073         if (stp)
4074                 nfs4_put_stid(&stp->st_stid);
4075
4076         return status;
4077 }
4078
4079 void nfsd4_cleanup_open_state(struct nfsd4_compound_state *cstate,
4080                               struct nfsd4_open *open, __be32 status)
4081 {
4082         if (open->op_openowner) {
4083                 struct nfs4_stateowner *so = &open->op_openowner->oo_owner;
4084
4085                 nfsd4_cstate_assign_replay(cstate, so);
4086                 nfs4_put_stateowner(so);
4087         }
4088         if (open->op_file)
4089                 nfsd4_free_file(open->op_file);
4090         if (open->op_stp)
4091                 nfs4_put_stid(&open->op_stp->st_stid);
4092 }
4093
4094 __be32
4095 nfsd4_renew(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
4096             clientid_t *clid)
4097 {
4098         struct nfs4_client *clp;
4099         __be32 status;
4100         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
4101
4102         dprintk("process_renew(%08x/%08x): starting\n",
4103                         clid->cl_boot, clid->cl_id);
4104         status = lookup_clientid(clid, cstate, nn);
4105         if (status)
4106                 goto out;
4107         clp = cstate->clp;
4108         status = nfserr_cb_path_down;
4109         if (!list_empty(&clp->cl_delegations)
4110                         && clp->cl_cb_state != NFSD4_CB_UP)
4111                 goto out;
4112         status = nfs_ok;
4113 out:
4114         return status;
4115 }
4116
4117 static void
4118 nfsd4_end_grace(struct nfsd_net *nn)
4119 {
4120         /* do nothing if grace period already ended */
4121         if (nn->grace_ended)
4122                 return;
4123
4124         dprintk("NFSD: end of grace period\n");
4125         nn->grace_ended = true;
4126         nfsd4_record_grace_done(nn, nn->boot_time);
4127         locks_end_grace(&nn->nfsd4_manager);
4128         /*
4129          * Now that every NFSv4 client has had the chance to recover and
4130          * to see the (possibly new, possibly shorter) lease time, we
4131          * can safely set the next grace time to the current lease time:
4132          */
4133         nn->nfsd4_grace = nn->nfsd4_lease;
4134 }
4135
4136 static time_t
4137 nfs4_laundromat(struct nfsd_net *nn)
4138 {
4139         struct nfs4_client *clp;
4140         struct nfs4_openowner *oo;
4141         struct nfs4_delegation *dp;
4142         struct nfs4_ol_stateid *stp;
4143         struct list_head *pos, *next, reaplist;
4144         time_t cutoff = get_seconds() - nn->nfsd4_lease;
4145         time_t t, new_timeo = nn->nfsd4_lease;
4146
4147         dprintk("NFSD: laundromat service - starting\n");
4148         nfsd4_end_grace(nn);
4149         INIT_LIST_HEAD(&reaplist);
4150         spin_lock(&nn->client_lock);
4151         list_for_each_safe(pos, next, &nn->client_lru) {
4152                 clp = list_entry(pos, struct nfs4_client, cl_lru);
4153                 if (time_after((unsigned long)clp->cl_time, (unsigned long)cutoff)) {
4154                         t = clp->cl_time - cutoff;
4155                         new_timeo = min(new_timeo, t);
4156                         break;
4157                 }
4158                 if (mark_client_expired_locked(clp)) {
4159                         dprintk("NFSD: client in use (clientid %08x)\n",
4160                                 clp->cl_clientid.cl_id);
4161                         continue;
4162                 }
4163                 list_add(&clp->cl_lru, &reaplist);
4164         }
4165         spin_unlock(&nn->client_lock);
4166         list_for_each_safe(pos, next, &reaplist) {
4167                 clp = list_entry(pos, struct nfs4_client, cl_lru);
4168                 dprintk("NFSD: purging unused client (clientid %08x)\n",
4169                         clp->cl_clientid.cl_id);
4170                 list_del_init(&clp->cl_lru);
4171                 expire_client(clp);
4172         }
4173         spin_lock(&state_lock);
4174         list_for_each_safe(pos, next, &nn->del_recall_lru) {
4175                 dp = list_entry (pos, struct nfs4_delegation, dl_recall_lru);
4176                 if (net_generic(dp->dl_stid.sc_client->net, nfsd_net_id) != nn)
4177                         continue;
4178                 if (time_after((unsigned long)dp->dl_time, (unsigned long)cutoff)) {
4179                         t = dp->dl_time - cutoff;
4180                         new_timeo = min(new_timeo, t);
4181                         break;
4182                 }
4183                 unhash_delegation_locked(dp);
4184                 list_add(&dp->dl_recall_lru, &reaplist);
4185         }
4186         spin_unlock(&state_lock);
4187         while (!list_empty(&reaplist)) {
4188                 dp = list_first_entry(&reaplist, struct nfs4_delegation,
4189                                         dl_recall_lru);
4190                 list_del_init(&dp->dl_recall_lru);
4191                 revoke_delegation(dp);
4192         }
4193
4194         spin_lock(&nn->client_lock);
4195         while (!list_empty(&nn->close_lru)) {
4196                 oo = list_first_entry(&nn->close_lru, struct nfs4_openowner,
4197                                         oo_close_lru);
4198                 if (time_after((unsigned long)oo->oo_time,
4199                                (unsigned long)cutoff)) {
4200                         t = oo->oo_time - cutoff;
4201                         new_timeo = min(new_timeo, t);
4202                         break;
4203                 }
4204                 list_del_init(&oo->oo_close_lru);
4205                 stp = oo->oo_last_closed_stid;
4206                 oo->oo_last_closed_stid = NULL;
4207                 spin_unlock(&nn->client_lock);
4208                 nfs4_put_stid(&stp->st_stid);
4209                 spin_lock(&nn->client_lock);
4210         }
4211         spin_unlock(&nn->client_lock);
4212
4213         new_timeo = max_t(time_t, new_timeo, NFSD_LAUNDROMAT_MINTIMEOUT);
4214         return new_timeo;
4215 }
4216
4217 static struct workqueue_struct *laundry_wq;
4218 static void laundromat_main(struct work_struct *);
4219
4220 static void
4221 laundromat_main(struct work_struct *laundry)
4222 {
4223         time_t t;
4224         struct delayed_work *dwork = container_of(laundry, struct delayed_work,
4225                                                   work);
4226         struct nfsd_net *nn = container_of(dwork, struct nfsd_net,
4227                                            laundromat_work);
4228
4229         t = nfs4_laundromat(nn);
4230         dprintk("NFSD: laundromat_main - sleeping for %ld seconds\n", t);
4231         queue_delayed_work(laundry_wq, &nn->laundromat_work, t*HZ);
4232 }
4233
4234 static inline __be32 nfs4_check_fh(struct svc_fh *fhp, struct nfs4_ol_stateid *stp)
4235 {
4236         if (!nfsd_fh_match(&fhp->fh_handle, &stp->st_stid.sc_file->fi_fhandle))
4237                 return nfserr_bad_stateid;
4238         return nfs_ok;
4239 }
4240
4241 static inline int
4242 access_permit_read(struct nfs4_ol_stateid *stp)
4243 {
4244         return test_access(NFS4_SHARE_ACCESS_READ, stp) ||
4245                 test_access(NFS4_SHARE_ACCESS_BOTH, stp) ||
4246                 test_access(NFS4_SHARE_ACCESS_WRITE, stp);
4247 }
4248
4249 static inline int
4250 access_permit_write(struct nfs4_ol_stateid *stp)
4251 {
4252         return test_access(NFS4_SHARE_ACCESS_WRITE, stp) ||
4253                 test_access(NFS4_SHARE_ACCESS_BOTH, stp);
4254 }
4255
4256 static
4257 __be32 nfs4_check_openmode(struct nfs4_ol_stateid *stp, int flags)
4258 {
4259         __be32 status = nfserr_openmode;
4260
4261         /* For lock stateid's, we test the parent open, not the lock: */
4262         if (stp->st_openstp)
4263                 stp = stp->st_openstp;
4264         if ((flags & WR_STATE) && !access_permit_write(stp))
4265                 goto out;
4266         if ((flags & RD_STATE) && !access_permit_read(stp))
4267                 goto out;
4268         status = nfs_ok;
4269 out:
4270         return status;
4271 }
4272
4273 static inline __be32
4274 check_special_stateids(struct net *net, svc_fh *current_fh, stateid_t *stateid, int flags)
4275 {
4276         if (ONE_STATEID(stateid) && (flags & RD_STATE))
4277                 return nfs_ok;
4278         else if (locks_in_grace(net)) {
4279                 /* Answer in remaining cases depends on existence of
4280                  * conflicting state; so we must wait out the grace period. */
4281                 return nfserr_grace;
4282         } else if (flags & WR_STATE)
4283                 return nfs4_share_conflict(current_fh,
4284                                 NFS4_SHARE_DENY_WRITE);
4285         else /* (flags & RD_STATE) && ZERO_STATEID(stateid) */
4286                 return nfs4_share_conflict(current_fh,
4287                                 NFS4_SHARE_DENY_READ);
4288 }
4289
4290 /*
4291  * Allow READ/WRITE during grace period on recovered state only for files
4292  * that are not able to provide mandatory locking.
4293  */
4294 static inline int
4295 grace_disallows_io(struct net *net, struct inode *inode)
4296 {
4297         return locks_in_grace(net) && mandatory_lock(inode);
4298 }
4299
4300 /* Returns true iff a is later than b: */
4301 static bool stateid_generation_after(stateid_t *a, stateid_t *b)
4302 {
4303         return (s32)(a->si_generation - b->si_generation) > 0;
4304 }
4305
4306 static __be32 check_stateid_generation(stateid_t *in, stateid_t *ref, bool has_session)
4307 {
4308         /*
4309          * When sessions are used the stateid generation number is ignored
4310          * when it is zero.
4311          */
4312         if (has_session && in->si_generation == 0)
4313                 return nfs_ok;
4314
4315         if (in->si_generation == ref->si_generation)
4316                 return nfs_ok;
4317
4318         /* If the client sends us a stateid from the future, it's buggy: */
4319         if (stateid_generation_after(in, ref))
4320                 return nfserr_bad_stateid;
4321         /*
4322          * However, we could see a stateid from the past, even from a
4323          * non-buggy client.  For example, if the client sends a lock
4324          * while some IO is outstanding, the lock may bump si_generation
4325          * while the IO is still in flight.  The client could avoid that
4326          * situation by waiting for responses on all the IO requests,
4327          * but better performance may result in retrying IO that
4328          * receives an old_stateid error if requests are rarely
4329          * reordered in flight:
4330          */
4331         return nfserr_old_stateid;
4332 }
4333
4334 static __be32 nfsd4_validate_stateid(struct nfs4_client *cl, stateid_t *stateid)
4335 {
4336         struct nfs4_stid *s;
4337         struct nfs4_ol_stateid *ols;
4338         __be32 status = nfserr_bad_stateid;
4339
4340         if (ZERO_STATEID(stateid) || ONE_STATEID(stateid))
4341                 return status;
4342         /* Client debugging aid. */
4343         if (!same_clid(&stateid->si_opaque.so_clid, &cl->cl_clientid)) {
4344                 char addr_str[INET6_ADDRSTRLEN];
4345                 rpc_ntop((struct sockaddr *)&cl->cl_addr, addr_str,
4346                                  sizeof(addr_str));
4347                 pr_warn_ratelimited("NFSD: client %s testing state ID "
4348                                         "with incorrect client ID\n", addr_str);
4349                 return status;
4350         }
4351         spin_lock(&cl->cl_lock);
4352         s = find_stateid_locked(cl, stateid);
4353         if (!s)
4354                 goto out_unlock;
4355         status = check_stateid_generation(stateid, &s->sc_stateid, 1);
4356         if (status)
4357                 goto out_unlock;
4358         switch (s->sc_type) {
4359         case NFS4_DELEG_STID:
4360                 status = nfs_ok;
4361                 break;
4362         case NFS4_REVOKED_DELEG_STID:
4363                 status = nfserr_deleg_revoked;
4364                 break;
4365         case NFS4_OPEN_STID:
4366         case NFS4_LOCK_STID:
4367                 ols = openlockstateid(s);
4368                 if (ols->st_stateowner->so_is_open_owner
4369                                 && !(openowner(ols->st_stateowner)->oo_flags
4370                                                 & NFS4_OO_CONFIRMED))
4371                         status = nfserr_bad_stateid;
4372                 else
4373                         status = nfs_ok;
4374                 break;
4375         default:
4376                 printk("unknown stateid type %x\n", s->sc_type);
4377                 /* Fallthrough */
4378         case NFS4_CLOSED_STID:
4379         case NFS4_CLOSED_DELEG_STID:
4380                 status = nfserr_bad_stateid;
4381         }
4382 out_unlock:
4383         spin_unlock(&cl->cl_lock);
4384         return status;
4385 }
4386
4387 static __be32
4388 nfsd4_lookup_stateid(struct nfsd4_compound_state *cstate,
4389                      stateid_t *stateid, unsigned char typemask,
4390                      struct nfs4_stid **s, struct nfsd_net *nn)
4391 {
4392         __be32 status;
4393
4394         if (ZERO_STATEID(stateid) || ONE_STATEID(stateid))
4395                 return nfserr_bad_stateid;
4396         status = lookup_clientid(&stateid->si_opaque.so_clid, cstate, nn);
4397         if (status == nfserr_stale_clientid) {
4398                 if (cstate->session)
4399                         return nfserr_bad_stateid;
4400                 return nfserr_stale_stateid;
4401         }
4402         if (status)
4403                 return status;
4404         *s = find_stateid_by_type(cstate->clp, stateid, typemask);
4405         if (!*s)
4406                 return nfserr_bad_stateid;
4407         return nfs_ok;
4408 }
4409
4410 /*
4411 * Checks for stateid operations
4412 */
4413 __be32
4414 nfs4_preprocess_stateid_op(struct net *net, struct nfsd4_compound_state *cstate,
4415                            stateid_t *stateid, int flags, struct file **filpp)
4416 {
4417         struct nfs4_stid *s;
4418         struct nfs4_ol_stateid *stp = NULL;
4419         struct nfs4_delegation *dp = NULL;
4420         struct svc_fh *current_fh = &cstate->current_fh;
4421         struct inode *ino = current_fh->fh_dentry->d_inode;
4422         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
4423         struct file *file = NULL;
4424         __be32 status;
4425
4426         if (filpp)
4427                 *filpp = NULL;
4428
4429         if (grace_disallows_io(net, ino))
4430                 return nfserr_grace;
4431
4432         if (ZERO_STATEID(stateid) || ONE_STATEID(stateid))
4433                 return check_special_stateids(net, current_fh, stateid, flags);
4434
4435         status = nfsd4_lookup_stateid(cstate, stateid,
4436                                 NFS4_DELEG_STID|NFS4_OPEN_STID|NFS4_LOCK_STID,
4437                                 &s, nn);
4438         if (status)
4439                 return status;
4440         status = check_stateid_generation(stateid, &s->sc_stateid, nfsd4_has_session(cstate));
4441         if (status)
4442                 goto out;
4443         switch (s->sc_type) {
4444         case NFS4_DELEG_STID:
4445                 dp = delegstateid(s);
4446                 status = nfs4_check_delegmode(dp, flags);
4447                 if (status)
4448                         goto out;
4449                 if (filpp) {
4450                         file = dp->dl_stid.sc_file->fi_deleg_file;
4451                         if (!file) {
4452                                 WARN_ON_ONCE(1);
4453                                 status = nfserr_serverfault;
4454                                 goto out;
4455                         }
4456                         get_file(file);
4457                 }
4458                 break;
4459         case NFS4_OPEN_STID:
4460         case NFS4_LOCK_STID:
4461                 stp = openlockstateid(s);
4462                 status = nfs4_check_fh(current_fh, stp);
4463                 if (status)
4464                         goto out;
4465                 if (stp->st_stateowner->so_is_open_owner
4466                     && !(openowner(stp->st_stateowner)->oo_flags & NFS4_OO_CONFIRMED))
4467                         goto out;
4468                 status = nfs4_check_openmode(stp, flags);
4469                 if (status)
4470                         goto out;
4471                 if (filpp) {
4472                         struct nfs4_file *fp = stp->st_stid.sc_file;
4473
4474                         if (flags & RD_STATE)
4475                                 file = find_readable_file(fp);
4476                         else
4477                                 file = find_writeable_file(fp);
4478                 }
4479                 break;
4480         default:
4481                 status = nfserr_bad_stateid;
4482                 goto out;
4483         }
4484         status = nfs_ok;
4485         if (file)
4486                 *filpp = file;
4487 out:
4488         nfs4_put_stid(s);
4489         return status;
4490 }
4491
4492 /*
4493  * Test if the stateid is valid
4494  */
4495 __be32
4496 nfsd4_test_stateid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
4497                    struct nfsd4_test_stateid *test_stateid)
4498 {
4499         struct nfsd4_test_stateid_id *stateid;
4500         struct nfs4_client *cl = cstate->session->se_client;
4501
4502         list_for_each_entry(stateid, &test_stateid->ts_stateid_list, ts_id_list)
4503                 stateid->ts_id_status =
4504                         nfsd4_validate_stateid(cl, &stateid->ts_id_stateid);
4505
4506         return nfs_ok;
4507 }
4508
4509 __be32
4510 nfsd4_free_stateid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
4511                    struct nfsd4_free_stateid *free_stateid)
4512 {
4513         stateid_t *stateid = &free_stateid->fr_stateid;
4514         struct nfs4_stid *s;
4515         struct nfs4_delegation *dp;
4516         struct nfs4_ol_stateid *stp;
4517         struct nfs4_client *cl = cstate->session->se_client;
4518         __be32 ret = nfserr_bad_stateid;
4519
4520         spin_lock(&cl->cl_lock);
4521         s = find_stateid_locked(cl, stateid);
4522         if (!s)
4523                 goto out_unlock;
4524         switch (s->sc_type) {
4525         case NFS4_DELEG_STID:
4526                 ret = nfserr_locks_held;
4527                 break;
4528         case NFS4_OPEN_STID:
4529                 ret = check_stateid_generation(stateid, &s->sc_stateid, 1);
4530                 if (ret)
4531                         break;
4532                 ret = nfserr_locks_held;
4533                 break;
4534         case NFS4_LOCK_STID:
4535                 ret = check_stateid_generation(stateid, &s->sc_stateid, 1);
4536                 if (ret)
4537                         break;
4538                 stp = openlockstateid(s);
4539                 ret = nfserr_locks_held;
4540                 if (check_for_locks(stp->st_stid.sc_file,
4541                                     lockowner(stp->st_stateowner)))
4542                         break;
4543                 unhash_lock_stateid(stp);
4544                 spin_unlock(&cl->cl_lock);
4545                 nfs4_put_stid(s);
4546                 ret = nfs_ok;
4547                 goto out;
4548         case NFS4_REVOKED_DELEG_STID:
4549                 dp = delegstateid(s);
4550                 list_del_init(&dp->dl_recall_lru);
4551                 spin_unlock(&cl->cl_lock);
4552                 nfs4_put_stid(s);
4553                 ret = nfs_ok;
4554                 goto out;
4555         /* Default falls through and returns nfserr_bad_stateid */
4556         }
4557 out_unlock:
4558         spin_unlock(&cl->cl_lock);
4559 out:
4560         return ret;
4561 }
4562
4563 static inline int
4564 setlkflg (int type)
4565 {
4566         return (type == NFS4_READW_LT || type == NFS4_READ_LT) ?
4567                 RD_STATE : WR_STATE;
4568 }
4569
4570 static __be32 nfs4_seqid_op_checks(struct nfsd4_compound_state *cstate, stateid_t *stateid, u32 seqid, struct nfs4_ol_stateid *stp)
4571 {
4572         struct svc_fh *current_fh = &cstate->current_fh;
4573         struct nfs4_stateowner *sop = stp->st_stateowner;
4574         __be32 status;
4575
4576         status = nfsd4_check_seqid(cstate, sop, seqid);
4577         if (status)
4578                 return status;
4579         if (stp->st_stid.sc_type == NFS4_CLOSED_STID
4580                 || stp->st_stid.sc_type == NFS4_REVOKED_DELEG_STID)
4581                 /*
4582                  * "Closed" stateid's exist *only* to return
4583                  * nfserr_replay_me from the previous step, and
4584                  * revoked delegations are kept only for free_stateid.
4585                  */
4586                 return nfserr_bad_stateid;
4587         status = check_stateid_generation(stateid, &stp->st_stid.sc_stateid, nfsd4_has_session(cstate));
4588         if (status)
4589                 return status;
4590         return nfs4_check_fh(current_fh, stp);
4591 }
4592
4593 /*
4594  * Checks for sequence id mutating operations.
4595  */
4596 static __be32
4597 nfs4_preprocess_seqid_op(struct nfsd4_compound_state *cstate, u32 seqid,
4598                          stateid_t *stateid, char typemask,
4599                          struct nfs4_ol_stateid **stpp,
4600                          struct nfsd_net *nn)
4601 {
4602         __be32 status;
4603         struct nfs4_stid *s;
4604         struct nfs4_ol_stateid *stp = NULL;
4605
4606         dprintk("NFSD: %s: seqid=%d stateid = " STATEID_FMT "\n", __func__,
4607                 seqid, STATEID_VAL(stateid));
4608
4609         *stpp = NULL;
4610         status = nfsd4_lookup_stateid(cstate, stateid, typemask, &s, nn);
4611         if (status)
4612                 return status;
4613         stp = openlockstateid(s);
4614         nfsd4_cstate_assign_replay(cstate, stp->st_stateowner);
4615
4616         status = nfs4_seqid_op_checks(cstate, stateid, seqid, stp);
4617         if (!status)
4618                 *stpp = stp;
4619         else
4620                 nfs4_put_stid(&stp->st_stid);
4621         return status;
4622 }
4623
4624 static __be32 nfs4_preprocess_confirmed_seqid_op(struct nfsd4_compound_state *cstate, u32 seqid,
4625                                                  stateid_t *stateid, struct nfs4_ol_stateid **stpp, struct nfsd_net *nn)
4626 {
4627         __be32 status;
4628         struct nfs4_openowner *oo;
4629         struct nfs4_ol_stateid *stp;
4630
4631         status = nfs4_preprocess_seqid_op(cstate, seqid, stateid,
4632                                                 NFS4_OPEN_STID, &stp, nn);
4633         if (status)
4634                 return status;
4635         oo = openowner(stp->st_stateowner);
4636         if (!(oo->oo_flags & NFS4_OO_CONFIRMED)) {
4637                 nfs4_put_stid(&stp->st_stid);
4638                 return nfserr_bad_stateid;
4639         }
4640         *stpp = stp;
4641         return nfs_ok;
4642 }
4643
4644 __be32
4645 nfsd4_open_confirm(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
4646                    struct nfsd4_open_confirm *oc)
4647 {
4648         __be32 status;
4649         struct nfs4_openowner *oo;
4650         struct nfs4_ol_stateid *stp;
4651         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
4652
4653         dprintk("NFSD: nfsd4_open_confirm on file %pd\n",
4654                         cstate->current_fh.fh_dentry);
4655
4656         status = fh_verify(rqstp, &cstate->current_fh, S_IFREG, 0);
4657         if (status)
4658                 return status;
4659
4660         status = nfs4_preprocess_seqid_op(cstate,
4661                                         oc->oc_seqid, &oc->oc_req_stateid,
4662                                         NFS4_OPEN_STID, &stp, nn);
4663         if (status)
4664                 goto out;
4665         oo = openowner(stp->st_stateowner);
4666         status = nfserr_bad_stateid;
4667         if (oo->oo_flags & NFS4_OO_CONFIRMED)
4668                 goto put_stateid;
4669         oo->oo_flags |= NFS4_OO_CONFIRMED;
4670         update_stateid(&stp->st_stid.sc_stateid);
4671         memcpy(&oc->oc_resp_stateid, &stp->st_stid.sc_stateid, sizeof(stateid_t));
4672         dprintk("NFSD: %s: success, seqid=%d stateid=" STATEID_FMT "\n",
4673                 __func__, oc->oc_seqid, STATEID_VAL(&stp->st_stid.sc_stateid));
4674
4675         nfsd4_client_record_create(oo->oo_owner.so_client);
4676         status = nfs_ok;
4677 put_stateid:
4678         nfs4_put_stid(&stp->st_stid);
4679 out:
4680         nfsd4_bump_seqid(cstate, status);
4681         return status;
4682 }
4683
4684 static inline void nfs4_stateid_downgrade_bit(struct nfs4_ol_stateid *stp, u32 access)
4685 {
4686         if (!test_access(access, stp))
4687                 return;
4688         nfs4_file_put_access(stp->st_stid.sc_file, access);
4689         clear_access(access, stp);
4690 }
4691
4692 static inline void nfs4_stateid_downgrade(struct nfs4_ol_stateid *stp, u32 to_access)
4693 {
4694         switch (to_access) {
4695         case NFS4_SHARE_ACCESS_READ:
4696                 nfs4_stateid_downgrade_bit(stp, NFS4_SHARE_ACCESS_WRITE);
4697                 nfs4_stateid_downgrade_bit(stp, NFS4_SHARE_ACCESS_BOTH);
4698                 break;
4699         case NFS4_SHARE_ACCESS_WRITE:
4700                 nfs4_stateid_downgrade_bit(stp, NFS4_SHARE_ACCESS_READ);
4701                 nfs4_stateid_downgrade_bit(stp, NFS4_SHARE_ACCESS_BOTH);
4702                 break;
4703         case NFS4_SHARE_ACCESS_BOTH:
4704                 break;
4705         default:
4706                 WARN_ON_ONCE(1);
4707         }
4708 }
4709
4710 __be32
4711 nfsd4_open_downgrade(struct svc_rqst *rqstp,
4712                      struct nfsd4_compound_state *cstate,
4713                      struct nfsd4_open_downgrade *od)
4714 {
4715         __be32 status;
4716         struct nfs4_ol_stateid *stp;
4717         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
4718
4719         dprintk("NFSD: nfsd4_open_downgrade on file %pd\n",
4720                         cstate->current_fh.fh_dentry);
4721
4722         /* We don't yet support WANT bits: */
4723         if (od->od_deleg_want)
4724                 dprintk("NFSD: %s: od_deleg_want=0x%x ignored\n", __func__,
4725                         od->od_deleg_want);
4726
4727         status = nfs4_preprocess_confirmed_seqid_op(cstate, od->od_seqid,
4728                                         &od->od_stateid, &stp, nn);
4729         if (status)
4730                 goto out;
4731         status = nfserr_inval;
4732         if (!test_access(od->od_share_access, stp)) {
4733                 dprintk("NFSD: access not a subset of current bitmap: 0x%hhx, input access=%08x\n",
4734                         stp->st_access_bmap, od->od_share_access);
4735                 goto put_stateid;
4736         }
4737         if (!test_deny(od->od_share_deny, stp)) {
4738                 dprintk("NFSD: deny not a subset of current bitmap: 0x%hhx, input deny=%08x\n",
4739                         stp->st_deny_bmap, od->od_share_deny);
4740                 goto put_stateid;
4741         }
4742         nfs4_stateid_downgrade(stp, od->od_share_access);
4743
4744         reset_union_bmap_deny(od->od_share_deny, stp);
4745
4746         update_stateid(&stp->st_stid.sc_stateid);
4747         memcpy(&od->od_stateid, &stp->st_stid.sc_stateid, sizeof(stateid_t));
4748         status = nfs_ok;
4749 put_stateid:
4750         nfs4_put_stid(&stp->st_stid);
4751 out:
4752         nfsd4_bump_seqid(cstate, status);
4753         return status;
4754 }
4755
4756 static void nfsd4_close_open_stateid(struct nfs4_ol_stateid *s)
4757 {
4758         struct nfs4_client *clp = s->st_stid.sc_client;
4759         LIST_HEAD(reaplist);
4760
4761         s->st_stid.sc_type = NFS4_CLOSED_STID;
4762         spin_lock(&clp->cl_lock);
4763         unhash_open_stateid(s, &reaplist);
4764
4765         if (clp->cl_minorversion) {
4766                 put_ol_stateid_locked(s, &reaplist);
4767                 spin_unlock(&clp->cl_lock);
4768                 free_ol_stateid_reaplist(&reaplist);
4769         } else {
4770                 spin_unlock(&clp->cl_lock);
4771                 free_ol_stateid_reaplist(&reaplist);
4772                 move_to_close_lru(s, clp->net);
4773         }
4774 }
4775
4776 /*
4777  * nfs4_unlock_state() called after encode
4778  */
4779 __be32
4780 nfsd4_close(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
4781             struct nfsd4_close *close)
4782 {
4783         __be32 status;
4784         struct nfs4_ol_stateid *stp;
4785         struct net *net = SVC_NET(rqstp);
4786         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
4787
4788         dprintk("NFSD: nfsd4_close on file %pd\n",
4789                         cstate->current_fh.fh_dentry);
4790
4791         status = nfs4_preprocess_seqid_op(cstate, close->cl_seqid,
4792                                         &close->cl_stateid,
4793                                         NFS4_OPEN_STID|NFS4_CLOSED_STID,
4794                                         &stp, nn);
4795         nfsd4_bump_seqid(cstate, status);
4796         if (status)
4797                 goto out;
4798         update_stateid(&stp->st_stid.sc_stateid);
4799         memcpy(&close->cl_stateid, &stp->st_stid.sc_stateid, sizeof(stateid_t));
4800
4801         nfsd4_close_open_stateid(stp);
4802
4803         /* put reference from nfs4_preprocess_seqid_op */
4804         nfs4_put_stid(&stp->st_stid);
4805 out:
4806         return status;
4807 }
4808
4809 __be32
4810 nfsd4_delegreturn(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
4811                   struct nfsd4_delegreturn *dr)
4812 {
4813         struct nfs4_delegation *dp;
4814         stateid_t *stateid = &dr->dr_stateid;
4815         struct nfs4_stid *s;
4816         __be32 status;
4817         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
4818
4819         if ((status = fh_verify(rqstp, &cstate->current_fh, S_IFREG, 0)))
4820                 return status;
4821
4822         status = nfsd4_lookup_stateid(cstate, stateid, NFS4_DELEG_STID, &s, nn);
4823         if (status)
4824                 goto out;
4825         dp = delegstateid(s);
4826         status = check_stateid_generation(stateid, &dp->dl_stid.sc_stateid, nfsd4_has_session(cstate));
4827         if (status)
4828                 goto put_stateid;
4829
4830         destroy_delegation(dp);
4831 put_stateid:
4832         nfs4_put_stid(&dp->dl_stid);
4833 out:
4834         return status;
4835 }
4836
4837
4838 #define LOFF_OVERFLOW(start, len)      ((u64)(len) > ~(u64)(start))
4839
4840 static inline u64
4841 end_offset(u64 start, u64 len)
4842 {
4843         u64 end;
4844
4845         end = start + len;
4846         return end >= start ? end: NFS4_MAX_UINT64;
4847 }
4848
4849 /* last octet in a range */
4850 static inline u64
4851 last_byte_offset(u64 start, u64 len)
4852 {
4853         u64 end;
4854
4855         WARN_ON_ONCE(!len);
4856         end = start + len;
4857         return end > start ? end - 1: NFS4_MAX_UINT64;
4858 }
4859
4860 /*
4861  * TODO: Linux file offsets are _signed_ 64-bit quantities, which means that
4862  * we can't properly handle lock requests that go beyond the (2^63 - 1)-th
4863  * byte, because of sign extension problems.  Since NFSv4 calls for 64-bit
4864  * locking, this prevents us from being completely protocol-compliant.  The
4865  * real solution to this problem is to start using unsigned file offsets in
4866  * the VFS, but this is a very deep change!
4867  */
4868 static inline void
4869 nfs4_transform_lock_offset(struct file_lock *lock)
4870 {
4871         if (lock->fl_start < 0)
4872                 lock->fl_start = OFFSET_MAX;
4873         if (lock->fl_end < 0)
4874                 lock->fl_end = OFFSET_MAX;
4875 }
4876
4877 static void nfsd4_fl_get_owner(struct file_lock *dst, struct file_lock *src)
4878 {
4879         struct nfs4_lockowner *lo = (struct nfs4_lockowner *)src->fl_owner;
4880         dst->fl_owner = (fl_owner_t)lockowner(nfs4_get_stateowner(&lo->lo_owner));
4881 }
4882
4883 static void nfsd4_fl_put_owner(struct file_lock *fl)
4884 {
4885         struct nfs4_lockowner *lo = (struct nfs4_lockowner *)fl->fl_owner;
4886
4887         if (lo) {
4888                 nfs4_put_stateowner(&lo->lo_owner);
4889                 fl->fl_owner = NULL;
4890         }
4891 }
4892
4893 static const struct lock_manager_operations nfsd_posix_mng_ops  = {
4894         .lm_get_owner = nfsd4_fl_get_owner,
4895         .lm_put_owner = nfsd4_fl_put_owner,
4896 };
4897
4898 static inline void
4899 nfs4_set_lock_denied(struct file_lock *fl, struct nfsd4_lock_denied *deny)
4900 {
4901         struct nfs4_lockowner *lo;
4902
4903         if (fl->fl_lmops == &nfsd_posix_mng_ops) {
4904                 lo = (struct nfs4_lockowner *) fl->fl_owner;
4905                 deny->ld_owner.data = kmemdup(lo->lo_owner.so_owner.data,
4906                                         lo->lo_owner.so_owner.len, GFP_KERNEL);
4907                 if (!deny->ld_owner.data)
4908                         /* We just don't care that much */
4909                         goto nevermind;
4910                 deny->ld_owner.len = lo->lo_owner.so_owner.len;
4911                 deny->ld_clientid = lo->lo_owner.so_client->cl_clientid;
4912         } else {
4913 nevermind:
4914                 deny->ld_owner.len = 0;
4915                 deny->ld_owner.data = NULL;
4916                 deny->ld_clientid.cl_boot = 0;
4917                 deny->ld_clientid.cl_id = 0;
4918         }
4919         deny->ld_start = fl->fl_start;
4920         deny->ld_length = NFS4_MAX_UINT64;
4921         if (fl->fl_end != NFS4_MAX_UINT64)
4922                 deny->ld_length = fl->fl_end - fl->fl_start + 1;
4923         deny->ld_type = NFS4_READ_LT;
4924         if (fl->fl_type != F_RDLCK)
4925                 deny->ld_type = NFS4_WRITE_LT;
4926 }
4927
4928 static struct nfs4_lockowner *
4929 find_lockowner_str_locked(clientid_t *clid, struct xdr_netobj *owner,
4930                 struct nfs4_client *clp)
4931 {
4932         unsigned int strhashval = ownerstr_hashval(owner);
4933         struct nfs4_stateowner *so;
4934
4935         lockdep_assert_held(&clp->cl_lock);
4936
4937         list_for_each_entry(so, &clp->cl_ownerstr_hashtbl[strhashval],
4938                             so_strhash) {
4939                 if (so->so_is_open_owner)
4940                         continue;
4941                 if (same_owner_str(so, owner))
4942                         return lockowner(nfs4_get_stateowner(so));
4943         }
4944         return NULL;
4945 }
4946
4947 static struct nfs4_lockowner *
4948 find_lockowner_str(clientid_t *clid, struct xdr_netobj *owner,
4949                 struct nfs4_client *clp)
4950 {
4951         struct nfs4_lockowner *lo;
4952
4953         spin_lock(&clp->cl_lock);
4954         lo = find_lockowner_str_locked(clid, owner, clp);
4955         spin_unlock(&clp->cl_lock);
4956         return lo;
4957 }
4958
4959 static void nfs4_unhash_lockowner(struct nfs4_stateowner *sop)
4960 {
4961         unhash_lockowner_locked(lockowner(sop));
4962 }
4963
4964 static void nfs4_free_lockowner(struct nfs4_stateowner *sop)
4965 {
4966         struct nfs4_lockowner *lo = lockowner(sop);
4967
4968         kmem_cache_free(lockowner_slab, lo);
4969 }
4970
4971 static const struct nfs4_stateowner_operations lockowner_ops = {
4972         .so_unhash =    nfs4_unhash_lockowner,
4973         .so_free =      nfs4_free_lockowner,
4974 };
4975
4976 /*
4977  * Alloc a lock owner structure.
4978  * Called in nfsd4_lock - therefore, OPEN and OPEN_CONFIRM (if needed) has
4979  * occurred.
4980  *
4981  * strhashval = ownerstr_hashval
4982  */
4983 static struct nfs4_lockowner *
4984 alloc_init_lock_stateowner(unsigned int strhashval, struct nfs4_client *clp,
4985                            struct nfs4_ol_stateid *open_stp,
4986                            struct nfsd4_lock *lock)
4987 {
4988         struct nfs4_lockowner *lo, *ret;
4989
4990         lo = alloc_stateowner(lockowner_slab, &lock->lk_new_owner, clp);
4991         if (!lo)
4992                 return NULL;
4993         INIT_LIST_HEAD(&lo->lo_owner.so_stateids);
4994         lo->lo_owner.so_is_open_owner = 0;
4995         lo->lo_owner.so_seqid = lock->lk_new_lock_seqid;
4996         lo->lo_owner.so_ops = &lockowner_ops;
4997         spin_lock(&clp->cl_lock);
4998         ret = find_lockowner_str_locked(&clp->cl_clientid,
4999                         &lock->lk_new_owner, clp);
5000         if (ret == NULL) {
5001                 list_add(&lo->lo_owner.so_strhash,
5002                          &clp->cl_ownerstr_hashtbl[strhashval]);
5003                 ret = lo;
5004         } else
5005                 nfs4_free_lockowner(&lo->lo_owner);
5006         spin_unlock(&clp->cl_lock);
5007         return lo;
5008 }
5009
5010 static void
5011 init_lock_stateid(struct nfs4_ol_stateid *stp, struct nfs4_lockowner *lo,
5012                   struct nfs4_file *fp, struct inode *inode,
5013                   struct nfs4_ol_stateid *open_stp)
5014 {
5015         struct nfs4_client *clp = lo->lo_owner.so_client;
5016
5017         lockdep_assert_held(&clp->cl_lock);
5018
5019         atomic_inc(&stp->st_stid.sc_count);
5020         stp->st_stid.sc_type = NFS4_LOCK_STID;
5021         stp->st_stateowner = nfs4_get_stateowner(&lo->lo_owner);
5022         get_nfs4_file(fp);
5023         stp->st_stid.sc_file = fp;
5024         stp->st_stid.sc_free = nfs4_free_lock_stateid;
5025         stp->st_access_bmap = 0;
5026         stp->st_deny_bmap = open_stp->st_deny_bmap;
5027         stp->st_openstp = open_stp;
5028         list_add(&stp->st_locks, &open_stp->st_locks);
5029         list_add(&stp->st_perstateowner, &lo->lo_owner.so_stateids);
5030         spin_lock(&fp->fi_lock);
5031         list_add(&stp->st_perfile, &fp->fi_stateids);
5032         spin_unlock(&fp->fi_lock);
5033 }
5034
5035 static struct nfs4_ol_stateid *
5036 find_lock_stateid(struct nfs4_lockowner *lo, struct nfs4_file *fp)
5037 {
5038         struct nfs4_ol_stateid *lst;
5039         struct nfs4_client *clp = lo->lo_owner.so_client;
5040
5041         lockdep_assert_held(&clp->cl_lock);
5042
5043         list_for_each_entry(lst, &lo->lo_owner.so_stateids, st_perstateowner) {
5044                 if (lst->st_stid.sc_file == fp) {
5045                         atomic_inc(&lst->st_stid.sc_count);
5046                         return lst;
5047                 }
5048         }
5049         return NULL;
5050 }
5051
5052 static struct nfs4_ol_stateid *
5053 find_or_create_lock_stateid(struct nfs4_lockowner *lo, struct nfs4_file *fi,
5054                             struct inode *inode, struct nfs4_ol_stateid *ost,
5055                             bool *new)
5056 {
5057         struct nfs4_stid *ns = NULL;
5058         struct nfs4_ol_stateid *lst;
5059         struct nfs4_openowner *oo = openowner(ost->st_stateowner);
5060         struct nfs4_client *clp = oo->oo_owner.so_client;
5061
5062         spin_lock(&clp->cl_lock);
5063         lst = find_lock_stateid(lo, fi);
5064         if (lst == NULL) {
5065                 spin_unlock(&clp->cl_lock);
5066                 ns = nfs4_alloc_stid(clp, stateid_slab);
5067                 if (ns == NULL)
5068                         return NULL;
5069
5070                 spin_lock(&clp->cl_lock);
5071                 lst = find_lock_stateid(lo, fi);
5072                 if (likely(!lst)) {
5073                         lst = openlockstateid(ns);
5074                         init_lock_stateid(lst, lo, fi, inode, ost);
5075                         ns = NULL;
5076                         *new = true;
5077                 }
5078         }
5079         spin_unlock(&clp->cl_lock);
5080         if (ns)
5081                 nfs4_put_stid(ns);
5082         return lst;
5083 }
5084
5085 static int
5086 check_lock_length(u64 offset, u64 length)
5087 {
5088         return ((length == 0)  || ((length != NFS4_MAX_UINT64) &&
5089              LOFF_OVERFLOW(offset, length)));
5090 }
5091
5092 static void get_lock_access(struct nfs4_ol_stateid *lock_stp, u32 access)
5093 {
5094         struct nfs4_file *fp = lock_stp->st_stid.sc_file;
5095
5096         lockdep_assert_held(&fp->fi_lock);
5097
5098         if (test_access(access, lock_stp))
5099                 return;
5100         __nfs4_file_get_access(fp, access);
5101         set_access(access, lock_stp);
5102 }
5103
5104 static __be32
5105 lookup_or_create_lock_state(struct nfsd4_compound_state *cstate,
5106                             struct nfs4_ol_stateid *ost,
5107                             struct nfsd4_lock *lock,
5108                             struct nfs4_ol_stateid **lst, bool *new)
5109 {
5110         __be32 status;
5111         struct nfs4_file *fi = ost->st_stid.sc_file;
5112         struct nfs4_openowner *oo = openowner(ost->st_stateowner);
5113         struct nfs4_client *cl = oo->oo_owner.so_client;
5114         struct inode *inode = cstate->current_fh.fh_dentry->d_inode;
5115         struct nfs4_lockowner *lo;
5116         unsigned int strhashval;
5117
5118         lo = find_lockowner_str(&cl->cl_clientid, &lock->v.new.owner, cl);
5119         if (!lo) {
5120                 strhashval = ownerstr_hashval(&lock->v.new.owner);
5121                 lo = alloc_init_lock_stateowner(strhashval, cl, ost, lock);
5122                 if (lo == NULL)
5123                         return nfserr_jukebox;
5124         } else {
5125                 /* with an existing lockowner, seqids must be the same */
5126                 status = nfserr_bad_seqid;
5127                 if (!cstate->minorversion &&
5128                     lock->lk_new_lock_seqid != lo->lo_owner.so_seqid)
5129                         goto out;
5130         }
5131
5132         *lst = find_or_create_lock_stateid(lo, fi, inode, ost, new);
5133         if (*lst == NULL) {
5134                 status = nfserr_jukebox;
5135                 goto out;
5136         }
5137         status = nfs_ok;
5138 out:
5139         nfs4_put_stateowner(&lo->lo_owner);
5140         return status;
5141 }
5142
5143 /*
5144  *  LOCK operation
5145  */
5146 __be32
5147 nfsd4_lock(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
5148            struct nfsd4_lock *lock)
5149 {
5150         struct nfs4_openowner *open_sop = NULL;
5151         struct nfs4_lockowner *lock_sop = NULL;
5152         struct nfs4_ol_stateid *lock_stp = NULL;
5153         struct nfs4_ol_stateid *open_stp = NULL;
5154         struct nfs4_file *fp;
5155         struct file *filp = NULL;
5156         struct file_lock *file_lock = NULL;
5157         struct file_lock *conflock = NULL;
5158         __be32 status = 0;
5159         int lkflg;
5160         int err;
5161         bool new = false;
5162         struct net *net = SVC_NET(rqstp);
5163         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
5164
5165         dprintk("NFSD: nfsd4_lock: start=%Ld length=%Ld\n",
5166                 (long long) lock->lk_offset,
5167                 (long long) lock->lk_length);
5168
5169         if (check_lock_length(lock->lk_offset, lock->lk_length))
5170                  return nfserr_inval;
5171
5172         if ((status = fh_verify(rqstp, &cstate->current_fh,
5173                                 S_IFREG, NFSD_MAY_LOCK))) {
5174                 dprintk("NFSD: nfsd4_lock: permission denied!\n");
5175                 return status;
5176         }
5177
5178         if (lock->lk_is_new) {
5179                 if (nfsd4_has_session(cstate))
5180                         /* See rfc 5661 18.10.3: given clientid is ignored: */
5181                         memcpy(&lock->v.new.clientid,
5182                                 &cstate->session->se_client->cl_clientid,
5183                                 sizeof(clientid_t));
5184
5185                 status = nfserr_stale_clientid;
5186                 if (STALE_CLIENTID(&lock->lk_new_clientid, nn))
5187                         goto out;
5188
5189                 /* validate and update open stateid and open seqid */
5190                 status = nfs4_preprocess_confirmed_seqid_op(cstate,
5191                                         lock->lk_new_open_seqid,
5192                                         &lock->lk_new_open_stateid,
5193                                         &open_stp, nn);
5194                 if (status)
5195                         goto out;
5196                 open_sop = openowner(open_stp->st_stateowner);
5197                 status = nfserr_bad_stateid;
5198                 if (!same_clid(&open_sop->oo_owner.so_client->cl_clientid,
5199                                                 &lock->v.new.clientid))
5200                         goto out;
5201                 status = lookup_or_create_lock_state(cstate, open_stp, lock,
5202                                                         &lock_stp, &new);
5203         } else {
5204                 status = nfs4_preprocess_seqid_op(cstate,
5205                                        lock->lk_old_lock_seqid,
5206                                        &lock->lk_old_lock_stateid,
5207                                        NFS4_LOCK_STID, &lock_stp, nn);
5208         }
5209         if (status)
5210                 goto out;
5211         lock_sop = lockowner(lock_stp->st_stateowner);
5212
5213         lkflg = setlkflg(lock->lk_type);
5214         status = nfs4_check_openmode(lock_stp, lkflg);
5215         if (status)
5216                 goto out;
5217
5218         status = nfserr_grace;
5219         if (locks_in_grace(net) && !lock->lk_reclaim)
5220                 goto out;
5221         status = nfserr_no_grace;
5222         if (!locks_in_grace(net) && lock->lk_reclaim)
5223                 goto out;
5224
5225         file_lock = locks_alloc_lock();
5226         if (!file_lock) {
5227                 dprintk("NFSD: %s: unable to allocate lock!\n", __func__);
5228                 status = nfserr_jukebox;
5229                 goto out;
5230         }
5231
5232         fp = lock_stp->st_stid.sc_file;
5233         switch (lock->lk_type) {
5234                 case NFS4_READ_LT:
5235                 case NFS4_READW_LT:
5236                         spin_lock(&fp->fi_lock);
5237                         filp = find_readable_file_locked(fp);
5238                         if (filp)
5239                                 get_lock_access(lock_stp, NFS4_SHARE_ACCESS_READ);
5240                         spin_unlock(&fp->fi_lock);
5241                         file_lock->fl_type = F_RDLCK;
5242                         break;
5243                 case NFS4_WRITE_LT:
5244                 case NFS4_WRITEW_LT:
5245                         spin_lock(&fp->fi_lock);
5246                         filp = find_writeable_file_locked(fp);
5247                         if (filp)
5248                                 get_lock_access(lock_stp, NFS4_SHARE_ACCESS_WRITE);
5249                         spin_unlock(&fp->fi_lock);
5250                         file_lock->fl_type = F_WRLCK;
5251                         break;
5252                 default:
5253                         status = nfserr_inval;
5254                 goto out;
5255         }
5256         if (!filp) {
5257                 status = nfserr_openmode;
5258                 goto out;
5259         }
5260
5261         file_lock->fl_owner = (fl_owner_t)lockowner(nfs4_get_stateowner(&lock_sop->lo_owner));
5262         file_lock->fl_pid = current->tgid;
5263         file_lock->fl_file = filp;
5264         file_lock->fl_flags = FL_POSIX;
5265         file_lock->fl_lmops = &nfsd_posix_mng_ops;
5266         file_lock->fl_start = lock->lk_offset;
5267         file_lock->fl_end = last_byte_offset(lock->lk_offset, lock->lk_length);
5268         nfs4_transform_lock_offset(file_lock);
5269
5270         conflock = locks_alloc_lock();
5271         if (!conflock) {
5272                 dprintk("NFSD: %s: unable to allocate lock!\n", __func__);
5273                 status = nfserr_jukebox;
5274                 goto out;
5275         }
5276
5277         err = vfs_lock_file(filp, F_SETLK, file_lock, conflock);
5278         switch (-err) {
5279         case 0: /* success! */
5280                 update_stateid(&lock_stp->st_stid.sc_stateid);
5281                 memcpy(&lock->lk_resp_stateid, &lock_stp->st_stid.sc_stateid,
5282                                 sizeof(stateid_t));
5283                 status = 0;
5284                 break;
5285         case (EAGAIN):          /* conflock holds conflicting lock */
5286                 status = nfserr_denied;
5287                 dprintk("NFSD: nfsd4_lock: conflicting lock found!\n");
5288                 nfs4_set_lock_denied(conflock, &lock->lk_denied);
5289                 break;
5290         case (EDEADLK):
5291                 status = nfserr_deadlock;
5292                 break;
5293         default:
5294                 dprintk("NFSD: nfsd4_lock: vfs_lock_file() failed! status %d\n",err);
5295                 status = nfserrno(err);
5296                 break;
5297         }
5298 out:
5299         if (filp)
5300                 fput(filp);
5301         if (lock_stp) {
5302                 /* Bump seqid manually if the 4.0 replay owner is openowner */
5303                 if (cstate->replay_owner &&
5304                     cstate->replay_owner != &lock_sop->lo_owner &&
5305                     seqid_mutating_err(ntohl(status)))
5306                         lock_sop->lo_owner.so_seqid++;
5307
5308                 /*
5309                  * If this is a new, never-before-used stateid, and we are
5310                  * returning an error, then just go ahead and release it.
5311                  */
5312                 if (status && new)
5313                         release_lock_stateid(lock_stp);
5314
5315                 nfs4_put_stid(&lock_stp->st_stid);
5316         }
5317         if (open_stp)
5318                 nfs4_put_stid(&open_stp->st_stid);
5319         nfsd4_bump_seqid(cstate, status);
5320         if (file_lock)
5321                 locks_free_lock(file_lock);
5322         if (conflock)
5323                 locks_free_lock(conflock);
5324         return status;
5325 }
5326
5327 /*
5328  * The NFSv4 spec allows a client to do a LOCKT without holding an OPEN,
5329  * so we do a temporary open here just to get an open file to pass to
5330  * vfs_test_lock.  (Arguably perhaps test_lock should be done with an
5331  * inode operation.)
5332  */
5333 static __be32 nfsd_test_lock(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file_lock *lock)
5334 {
5335         struct file *file;
5336         __be32 err = nfsd_open(rqstp, fhp, S_IFREG, NFSD_MAY_READ, &file);
5337         if (!err) {
5338                 err = nfserrno(vfs_test_lock(file, lock));
5339                 nfsd_close(file);
5340         }
5341         return err;
5342 }
5343
5344 /*
5345  * LOCKT operation
5346  */
5347 __be32
5348 nfsd4_lockt(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
5349             struct nfsd4_lockt *lockt)
5350 {
5351         struct file_lock *file_lock = NULL;
5352         struct nfs4_lockowner *lo = NULL;
5353         __be32 status;
5354         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
5355
5356         if (locks_in_grace(SVC_NET(rqstp)))
5357                 return nfserr_grace;
5358
5359         if (check_lock_length(lockt->lt_offset, lockt->lt_length))
5360                  return nfserr_inval;
5361
5362         if (!nfsd4_has_session(cstate)) {
5363                 status = lookup_clientid(&lockt->lt_clientid, cstate, nn);
5364                 if (status)
5365                         goto out;
5366         }
5367
5368         if ((status = fh_verify(rqstp, &cstate->current_fh, S_IFREG, 0)))
5369                 goto out;
5370
5371         file_lock = locks_alloc_lock();
5372         if (!file_lock) {
5373                 dprintk("NFSD: %s: unable to allocate lock!\n", __func__);
5374                 status = nfserr_jukebox;
5375                 goto out;
5376         }
5377
5378         switch (lockt->lt_type) {
5379                 case NFS4_READ_LT:
5380                 case NFS4_READW_LT:
5381                         file_lock->fl_type = F_RDLCK;
5382                 break;
5383                 case NFS4_WRITE_LT:
5384                 case NFS4_WRITEW_LT:
5385                         file_lock->fl_type = F_WRLCK;
5386                 break;
5387                 default:
5388                         dprintk("NFSD: nfs4_lockt: bad lock type!\n");
5389                         status = nfserr_inval;
5390                 goto out;
5391         }
5392
5393         lo = find_lockowner_str(&lockt->lt_clientid, &lockt->lt_owner,
5394                                 cstate->clp);
5395         if (lo)
5396                 file_lock->fl_owner = (fl_owner_t)lo;
5397         file_lock->fl_pid = current->tgid;
5398         file_lock->fl_flags = FL_POSIX;
5399
5400         file_lock->fl_start = lockt->lt_offset;
5401         file_lock->fl_end = last_byte_offset(lockt->lt_offset, lockt->lt_length);
5402
5403         nfs4_transform_lock_offset(file_lock);
5404
5405         status = nfsd_test_lock(rqstp, &cstate->current_fh, file_lock);
5406         if (status)
5407                 goto out;
5408
5409         if (file_lock->fl_type != F_UNLCK) {
5410                 status = nfserr_denied;
5411                 nfs4_set_lock_denied(file_lock, &lockt->lt_denied);
5412         }
5413 out:
5414         if (lo)
5415                 nfs4_put_stateowner(&lo->lo_owner);
5416         if (file_lock)
5417                 locks_free_lock(file_lock);
5418         return status;
5419 }
5420
5421 __be32
5422 nfsd4_locku(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
5423             struct nfsd4_locku *locku)
5424 {
5425         struct nfs4_ol_stateid *stp;
5426         struct file *filp = NULL;
5427         struct file_lock *file_lock = NULL;
5428         __be32 status;
5429         int err;
5430         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
5431
5432         dprintk("NFSD: nfsd4_locku: start=%Ld length=%Ld\n",
5433                 (long long) locku->lu_offset,
5434                 (long long) locku->lu_length);
5435
5436         if (check_lock_length(locku->lu_offset, locku->lu_length))
5437                  return nfserr_inval;
5438
5439         status = nfs4_preprocess_seqid_op(cstate, locku->lu_seqid,
5440                                         &locku->lu_stateid, NFS4_LOCK_STID,
5441                                         &stp, nn);
5442         if (status)
5443                 goto out;
5444         filp = find_any_file(stp->st_stid.sc_file);
5445         if (!filp) {
5446                 status = nfserr_lock_range;
5447                 goto put_stateid;
5448         }
5449         file_lock = locks_alloc_lock();
5450         if (!file_lock) {
5451                 dprintk("NFSD: %s: unable to allocate lock!\n", __func__);
5452                 status = nfserr_jukebox;
5453                 goto fput;
5454         }
5455
5456         file_lock->fl_type = F_UNLCK;
5457         file_lock->fl_owner = (fl_owner_t)lockowner(nfs4_get_stateowner(stp->st_stateowner));
5458         file_lock->fl_pid = current->tgid;
5459         file_lock->fl_file = filp;
5460         file_lock->fl_flags = FL_POSIX;
5461         file_lock->fl_lmops = &nfsd_posix_mng_ops;
5462         file_lock->fl_start = locku->lu_offset;
5463
5464         file_lock->fl_end = last_byte_offset(locku->lu_offset,
5465                                                 locku->lu_length);
5466         nfs4_transform_lock_offset(file_lock);
5467
5468         err = vfs_lock_file(filp, F_SETLK, file_lock, NULL);
5469         if (err) {
5470                 dprintk("NFSD: nfs4_locku: vfs_lock_file failed!\n");
5471                 goto out_nfserr;
5472         }
5473         update_stateid(&stp->st_stid.sc_stateid);
5474         memcpy(&locku->lu_stateid, &stp->st_stid.sc_stateid, sizeof(stateid_t));
5475 fput:
5476         fput(filp);
5477 put_stateid:
5478         nfs4_put_stid(&stp->st_stid);
5479 out:
5480         nfsd4_bump_seqid(cstate, status);
5481         if (file_lock)
5482                 locks_free_lock(file_lock);
5483         return status;
5484
5485 out_nfserr:
5486         status = nfserrno(err);
5487         goto fput;
5488 }
5489
5490 /*
5491  * returns
5492  *      true:  locks held by lockowner
5493  *      false: no locks held by lockowner
5494  */
5495 static bool
5496 check_for_locks(struct nfs4_file *fp, struct nfs4_lockowner *lowner)
5497 {
5498         struct file_lock **flpp;
5499         int status = false;
5500         struct file *filp = find_any_file(fp);
5501         struct inode *inode;
5502
5503         if (!filp) {
5504                 /* Any valid lock stateid should have some sort of access */
5505                 WARN_ON_ONCE(1);
5506                 return status;
5507         }
5508
5509         inode = file_inode(filp);
5510
5511         spin_lock(&inode->i_lock);
5512         for (flpp = &inode->i_flock; *flpp != NULL; flpp = &(*flpp)->fl_next) {
5513                 if ((*flpp)->fl_owner == (fl_owner_t)lowner) {
5514                         status = true;
5515                         break;
5516                 }
5517         }
5518         spin_unlock(&inode->i_lock);
5519         fput(filp);
5520         return status;
5521 }
5522
5523 __be32
5524 nfsd4_release_lockowner(struct svc_rqst *rqstp,
5525                         struct nfsd4_compound_state *cstate,
5526                         struct nfsd4_release_lockowner *rlockowner)
5527 {
5528         clientid_t *clid = &rlockowner->rl_clientid;
5529         struct nfs4_stateowner *sop;
5530         struct nfs4_lockowner *lo = NULL;
5531         struct nfs4_ol_stateid *stp;
5532         struct xdr_netobj *owner = &rlockowner->rl_owner;
5533         unsigned int hashval = ownerstr_hashval(owner);
5534         __be32 status;
5535         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
5536         struct nfs4_client *clp;
5537
5538         dprintk("nfsd4_release_lockowner clientid: (%08x/%08x):\n",
5539                 clid->cl_boot, clid->cl_id);
5540
5541         status = lookup_clientid(clid, cstate, nn);
5542         if (status)
5543                 return status;
5544
5545         clp = cstate->clp;
5546         /* Find the matching lock stateowner */
5547         spin_lock(&clp->cl_lock);
5548         list_for_each_entry(sop, &clp->cl_ownerstr_hashtbl[hashval],
5549                             so_strhash) {
5550
5551                 if (sop->so_is_open_owner || !same_owner_str(sop, owner))
5552                         continue;
5553
5554                 /* see if there are still any locks associated with it */
5555                 lo = lockowner(sop);
5556                 list_for_each_entry(stp, &sop->so_stateids, st_perstateowner) {
5557                         if (check_for_locks(stp->st_stid.sc_file, lo)) {
5558                                 status = nfserr_locks_held;
5559                                 spin_unlock(&clp->cl_lock);
5560                                 return status;
5561                         }
5562                 }
5563
5564                 nfs4_get_stateowner(sop);
5565                 break;
5566         }
5567         spin_unlock(&clp->cl_lock);
5568         if (lo)
5569                 release_lockowner(lo);
5570         return status;
5571 }
5572
5573 static inline struct nfs4_client_reclaim *
5574 alloc_reclaim(void)
5575 {
5576         return kmalloc(sizeof(struct nfs4_client_reclaim), GFP_KERNEL);
5577 }
5578
5579 bool
5580 nfs4_has_reclaimed_state(const char *name, struct nfsd_net *nn)
5581 {
5582         struct nfs4_client_reclaim *crp;
5583
5584         crp = nfsd4_find_reclaim_client(name, nn);
5585         return (crp && crp->cr_clp);
5586 }
5587
5588 /*
5589  * failure => all reset bets are off, nfserr_no_grace...
5590  */
5591 struct nfs4_client_reclaim *
5592 nfs4_client_to_reclaim(const char *name, struct nfsd_net *nn)
5593 {
5594         unsigned int strhashval;
5595         struct nfs4_client_reclaim *crp;
5596
5597         dprintk("NFSD nfs4_client_to_reclaim NAME: %.*s\n", HEXDIR_LEN, name);
5598         crp = alloc_reclaim();
5599         if (crp) {
5600                 strhashval = clientstr_hashval(name);
5601                 INIT_LIST_HEAD(&crp->cr_strhash);
5602                 list_add(&crp->cr_strhash, &nn->reclaim_str_hashtbl[strhashval]);
5603                 memcpy(crp->cr_recdir, name, HEXDIR_LEN);
5604                 crp->cr_clp = NULL;
5605                 nn->reclaim_str_hashtbl_size++;
5606         }
5607         return crp;
5608 }
5609
5610 void
5611 nfs4_remove_reclaim_record(struct nfs4_client_reclaim *crp, struct nfsd_net *nn)
5612 {
5613         list_del(&crp->cr_strhash);
5614         kfree(crp);
5615         nn->reclaim_str_hashtbl_size--;
5616 }
5617
5618 void
5619 nfs4_release_reclaim(struct nfsd_net *nn)
5620 {
5621         struct nfs4_client_reclaim *crp = NULL;
5622         int i;
5623
5624         for (i = 0; i < CLIENT_HASH_SIZE; i++) {
5625                 while (!list_empty(&nn->reclaim_str_hashtbl[i])) {
5626                         crp = list_entry(nn->reclaim_str_hashtbl[i].next,
5627                                         struct nfs4_client_reclaim, cr_strhash);
5628                         nfs4_remove_reclaim_record(crp, nn);
5629                 }
5630         }
5631         WARN_ON_ONCE(nn->reclaim_str_hashtbl_size);
5632 }
5633
5634 /*
5635  * called from OPEN, CLAIM_PREVIOUS with a new clientid. */
5636 struct nfs4_client_reclaim *
5637 nfsd4_find_reclaim_client(const char *recdir, struct nfsd_net *nn)
5638 {
5639         unsigned int strhashval;
5640         struct nfs4_client_reclaim *crp = NULL;
5641
5642         dprintk("NFSD: nfs4_find_reclaim_client for recdir %s\n", recdir);
5643
5644         strhashval = clientstr_hashval(recdir);
5645         list_for_each_entry(crp, &nn->reclaim_str_hashtbl[strhashval], cr_strhash) {
5646                 if (same_name(crp->cr_recdir, recdir)) {
5647                         return crp;
5648                 }
5649         }
5650         return NULL;
5651 }
5652
5653 /*
5654 * Called from OPEN. Look for clientid in reclaim list.
5655 */
5656 __be32
5657 nfs4_check_open_reclaim(clientid_t *clid,
5658                 struct nfsd4_compound_state *cstate,
5659                 struct nfsd_net *nn)
5660 {
5661         __be32 status;
5662
5663         /* find clientid in conf_id_hashtbl */
5664         status = lookup_clientid(clid, cstate, nn);
5665         if (status)
5666                 return nfserr_reclaim_bad;
5667
5668         if (nfsd4_client_record_check(cstate->clp))
5669                 return nfserr_reclaim_bad;
5670
5671         return nfs_ok;
5672 }
5673
5674 #ifdef CONFIG_NFSD_FAULT_INJECTION
5675 static inline void
5676 put_client(struct nfs4_client *clp)
5677 {
5678         atomic_dec(&clp->cl_refcount);
5679 }
5680
5681 static struct nfs4_client *
5682 nfsd_find_client(struct sockaddr_storage *addr, size_t addr_size)
5683 {
5684         struct nfs4_client *clp;
5685         struct nfsd_net *nn = net_generic(current->nsproxy->net_ns,
5686                                           nfsd_net_id);
5687
5688         if (!nfsd_netns_ready(nn))
5689                 return NULL;
5690
5691         list_for_each_entry(clp, &nn->client_lru, cl_lru) {
5692                 if (memcmp(&clp->cl_addr, addr, addr_size) == 0)
5693                         return clp;
5694         }
5695         return NULL;
5696 }
5697
5698 u64
5699 nfsd_inject_print_clients(void)
5700 {
5701         struct nfs4_client *clp;
5702         u64 count = 0;
5703         struct nfsd_net *nn = net_generic(current->nsproxy->net_ns,
5704                                           nfsd_net_id);
5705         char buf[INET6_ADDRSTRLEN];
5706
5707         if (!nfsd_netns_ready(nn))
5708                 return 0;
5709
5710         spin_lock(&nn->client_lock);
5711         list_for_each_entry(clp, &nn->client_lru, cl_lru) {
5712                 rpc_ntop((struct sockaddr *)&clp->cl_addr, buf, sizeof(buf));
5713                 pr_info("NFS Client: %s\n", buf);
5714                 ++count;
5715         }
5716         spin_unlock(&nn->client_lock);
5717
5718         return count;
5719 }
5720
5721 u64
5722 nfsd_inject_forget_client(struct sockaddr_storage *addr, size_t addr_size)
5723 {
5724         u64 count = 0;
5725         struct nfs4_client *clp;
5726         struct nfsd_net *nn = net_generic(current->nsproxy->net_ns,
5727                                           nfsd_net_id);
5728
5729         if (!nfsd_netns_ready(nn))
5730                 return count;
5731
5732         spin_lock(&nn->client_lock);
5733         clp = nfsd_find_client(addr, addr_size);
5734         if (clp) {
5735                 if (mark_client_expired_locked(clp) == nfs_ok)
5736                         ++count;
5737                 else
5738                         clp = NULL;
5739         }
5740         spin_unlock(&nn->client_lock);
5741
5742         if (clp)
5743                 expire_client(clp);
5744
5745         return count;
5746 }
5747
5748 u64
5749 nfsd_inject_forget_clients(u64 max)
5750 {
5751         u64 count = 0;
5752         struct nfs4_client *clp, *next;
5753         struct nfsd_net *nn = net_generic(current->nsproxy->net_ns,
5754                                                 nfsd_net_id);
5755         LIST_HEAD(reaplist);
5756
5757         if (!nfsd_netns_ready(nn))
5758                 return count;
5759
5760         spin_lock(&nn->client_lock);
5761         list_for_each_entry_safe(clp, next, &nn->client_lru, cl_lru) {
5762                 if (mark_client_expired_locked(clp) == nfs_ok) {
5763                         list_add(&clp->cl_lru, &reaplist);
5764                         if (max != 0 && ++count >= max)
5765                                 break;
5766                 }
5767         }
5768         spin_unlock(&nn->client_lock);
5769
5770         list_for_each_entry_safe(clp, next, &reaplist, cl_lru)
5771                 expire_client(clp);
5772
5773         return count;
5774 }
5775
5776 static void nfsd_print_count(struct nfs4_client *clp, unsigned int count,
5777                              const char *type)
5778 {
5779         char buf[INET6_ADDRSTRLEN];
5780         rpc_ntop((struct sockaddr *)&clp->cl_addr, buf, sizeof(buf));
5781         printk(KERN_INFO "NFS Client: %s has %u %s\n", buf, count, type);
5782 }
5783
5784 static void
5785 nfsd_inject_add_lock_to_list(struct nfs4_ol_stateid *lst,
5786                              struct list_head *collect)
5787 {
5788         struct nfs4_client *clp = lst->st_stid.sc_client;
5789         struct nfsd_net *nn = net_generic(current->nsproxy->net_ns,
5790                                           nfsd_net_id);
5791
5792         if (!collect)
5793                 return;
5794
5795         lockdep_assert_held(&nn->client_lock);
5796         atomic_inc(&clp->cl_refcount);
5797         list_add(&lst->st_locks, collect);
5798 }
5799
5800 static u64 nfsd_foreach_client_lock(struct nfs4_client *clp, u64 max,
5801                                     struct list_head *collect,
5802                                     void (*func)(struct nfs4_ol_stateid *))
5803 {
5804         struct nfs4_openowner *oop;
5805         struct nfs4_ol_stateid *stp, *st_next;
5806         struct nfs4_ol_stateid *lst, *lst_next;
5807         u64 count = 0;
5808
5809         spin_lock(&clp->cl_lock);
5810         list_for_each_entry(oop, &clp->cl_openowners, oo_perclient) {
5811                 list_for_each_entry_safe(stp, st_next,
5812                                 &oop->oo_owner.so_stateids, st_perstateowner) {
5813                         list_for_each_entry_safe(lst, lst_next,
5814                                         &stp->st_locks, st_locks) {
5815                                 if (func) {
5816                                         func(lst);
5817                                         nfsd_inject_add_lock_to_list(lst,
5818                                                                 collect);
5819                                 }
5820                                 ++count;
5821                                 /*
5822                                  * Despite the fact that these functions deal
5823                                  * with 64-bit integers for "count", we must
5824                                  * ensure that it doesn't blow up the
5825                                  * clp->cl_refcount. Throw a warning if we
5826                                  * start to approach INT_MAX here.
5827                                  */
5828                                 WARN_ON_ONCE(count == (INT_MAX / 2));
5829                                 if (count == max)
5830                                         goto out;
5831                         }
5832                 }
5833         }
5834 out:
5835         spin_unlock(&clp->cl_lock);
5836
5837         return count;
5838 }
5839
5840 static u64
5841 nfsd_collect_client_locks(struct nfs4_client *clp, struct list_head *collect,
5842                           u64 max)
5843 {
5844         return nfsd_foreach_client_lock(clp, max, collect, unhash_lock_stateid);
5845 }
5846
5847 static u64
5848 nfsd_print_client_locks(struct nfs4_client *clp)
5849 {
5850         u64 count = nfsd_foreach_client_lock(clp, 0, NULL, NULL);
5851         nfsd_print_count(clp, count, "locked files");
5852         return count;
5853 }
5854
5855 u64
5856 nfsd_inject_print_locks(void)
5857 {
5858         struct nfs4_client *clp;
5859         u64 count = 0;
5860         struct nfsd_net *nn = net_generic(current->nsproxy->net_ns,
5861                                                 nfsd_net_id);
5862
5863         if (!nfsd_netns_ready(nn))
5864                 return 0;
5865
5866         spin_lock(&nn->client_lock);
5867         list_for_each_entry(clp, &nn->client_lru, cl_lru)
5868                 count += nfsd_print_client_locks(clp);
5869         spin_unlock(&nn->client_lock);
5870
5871         return count;
5872 }
5873
5874 static void
5875 nfsd_reap_locks(struct list_head *reaplist)
5876 {
5877         struct nfs4_client *clp;
5878         struct nfs4_ol_stateid *stp, *next;
5879
5880         list_for_each_entry_safe(stp, next, reaplist, st_locks) {
5881                 list_del_init(&stp->st_locks);
5882                 clp = stp->st_stid.sc_client;
5883                 nfs4_put_stid(&stp->st_stid);
5884                 put_client(clp);
5885         }
5886 }
5887
5888 u64
5889 nfsd_inject_forget_client_locks(struct sockaddr_storage *addr, size_t addr_size)
5890 {
5891         unsigned int count = 0;
5892         struct nfs4_client *clp;
5893         struct nfsd_net *nn = net_generic(current->nsproxy->net_ns,
5894                                                 nfsd_net_id);
5895         LIST_HEAD(reaplist);
5896
5897         if (!nfsd_netns_ready(nn))
5898                 return count;
5899
5900         spin_lock(&nn->client_lock);
5901         clp = nfsd_find_client(addr, addr_size);
5902         if (clp)
5903                 count = nfsd_collect_client_locks(clp, &reaplist, 0);
5904         spin_unlock(&nn->client_lock);
5905         nfsd_reap_locks(&reaplist);
5906         return count;
5907 }
5908
5909 u64
5910 nfsd_inject_forget_locks(u64 max)
5911 {
5912         u64 count = 0;
5913         struct nfs4_client *clp;
5914         struct nfsd_net *nn = net_generic(current->nsproxy->net_ns,
5915                                                 nfsd_net_id);
5916         LIST_HEAD(reaplist);
5917
5918         if (!nfsd_netns_ready(nn))
5919                 return count;
5920
5921         spin_lock(&nn->client_lock);
5922         list_for_each_entry(clp, &nn->client_lru, cl_lru) {
5923                 count += nfsd_collect_client_locks(clp, &reaplist, max - count);
5924                 if (max != 0 && count >= max)
5925                         break;
5926         }
5927         spin_unlock(&nn->client_lock);
5928         nfsd_reap_locks(&reaplist);
5929         return count;
5930 }
5931
5932 static u64
5933 nfsd_foreach_client_openowner(struct nfs4_client *clp, u64 max,
5934                               struct list_head *collect,
5935                               void (*func)(struct nfs4_openowner *))
5936 {
5937         struct nfs4_openowner *oop, *next;
5938         struct nfsd_net *nn = net_generic(current->nsproxy->net_ns,
5939                                                 nfsd_net_id);
5940         u64 count = 0;
5941
5942         lockdep_assert_held(&nn->client_lock);
5943
5944         spin_lock(&clp->cl_lock);
5945         list_for_each_entry_safe(oop, next, &clp->cl_openowners, oo_perclient) {
5946                 if (func) {
5947                         func(oop);
5948                         if (collect) {
5949                                 atomic_inc(&clp->cl_refcount);
5950                                 list_add(&oop->oo_perclient, collect);
5951                         }
5952                 }
5953                 ++count;
5954                 /*
5955                  * Despite the fact that these functions deal with
5956                  * 64-bit integers for "count", we must ensure that
5957                  * it doesn't blow up the clp->cl_refcount. Throw a
5958                  * warning if we start to approach INT_MAX here.
5959                  */
5960                 WARN_ON_ONCE(count == (INT_MAX / 2));
5961                 if (count == max)
5962                         break;
5963         }
5964         spin_unlock(&clp->cl_lock);
5965
5966         return count;
5967 }
5968
5969 static u64
5970 nfsd_print_client_openowners(struct nfs4_client *clp)
5971 {
5972         u64 count = nfsd_foreach_client_openowner(clp, 0, NULL, NULL);
5973
5974         nfsd_print_count(clp, count, "openowners");
5975         return count;
5976 }
5977
5978 static u64
5979 nfsd_collect_client_openowners(struct nfs4_client *clp,
5980                                struct list_head *collect, u64 max)
5981 {
5982         return nfsd_foreach_client_openowner(clp, max, collect,
5983                                                 unhash_openowner_locked);
5984 }
5985
5986 u64
5987 nfsd_inject_print_openowners(void)
5988 {
5989         struct nfs4_client *clp;
5990         u64 count = 0;
5991         struct nfsd_net *nn = net_generic(current->nsproxy->net_ns,
5992                                                 nfsd_net_id);
5993
5994         if (!nfsd_netns_ready(nn))
5995                 return 0;
5996
5997         spin_lock(&nn->client_lock);
5998         list_for_each_entry(clp, &nn->client_lru, cl_lru)
5999                 count += nfsd_print_client_openowners(clp);
6000         spin_unlock(&nn->client_lock);
6001
6002         return count;
6003 }
6004
6005 static void
6006 nfsd_reap_openowners(struct list_head *reaplist)
6007 {
6008         struct nfs4_client *clp;
6009         struct nfs4_openowner *oop, *next;
6010
6011         list_for_each_entry_safe(oop, next, reaplist, oo_perclient) {
6012                 list_del_init(&oop->oo_perclient);
6013                 clp = oop->oo_owner.so_client;
6014                 release_openowner(oop);
6015                 put_client(clp);
6016         }
6017 }
6018
6019 u64
6020 nfsd_inject_forget_client_openowners(struct sockaddr_storage *addr,
6021                                      size_t addr_size)
6022 {
6023         unsigned int count = 0;
6024         struct nfs4_client *clp;
6025         struct nfsd_net *nn = net_generic(current->nsproxy->net_ns,
6026                                                 nfsd_net_id);
6027         LIST_HEAD(reaplist);
6028
6029         if (!nfsd_netns_ready(nn))
6030                 return count;
6031
6032         spin_lock(&nn->client_lock);
6033         clp = nfsd_find_client(addr, addr_size);
6034         if (clp)
6035                 count = nfsd_collect_client_openowners(clp, &reaplist, 0);
6036         spin_unlock(&nn->client_lock);
6037         nfsd_reap_openowners(&reaplist);
6038         return count;
6039 }
6040
6041 u64
6042 nfsd_inject_forget_openowners(u64 max)
6043 {
6044         u64 count = 0;
6045         struct nfs4_client *clp;
6046         struct nfsd_net *nn = net_generic(current->nsproxy->net_ns,
6047                                                 nfsd_net_id);
6048         LIST_HEAD(reaplist);
6049
6050         if (!nfsd_netns_ready(nn))
6051                 return count;
6052
6053         spin_lock(&nn->client_lock);
6054         list_for_each_entry(clp, &nn->client_lru, cl_lru) {
6055                 count += nfsd_collect_client_openowners(clp, &reaplist,
6056                                                         max - count);
6057                 if (max != 0 && count >= max)
6058                         break;
6059         }
6060         spin_unlock(&nn->client_lock);
6061         nfsd_reap_openowners(&reaplist);
6062         return count;
6063 }
6064
6065 static u64 nfsd_find_all_delegations(struct nfs4_client *clp, u64 max,
6066                                      struct list_head *victims)
6067 {
6068         struct nfs4_delegation *dp, *next;
6069         struct nfsd_net *nn = net_generic(current->nsproxy->net_ns,
6070                                                 nfsd_net_id);
6071         u64 count = 0;
6072
6073         lockdep_assert_held(&nn->client_lock);
6074
6075         spin_lock(&state_lock);
6076         list_for_each_entry_safe(dp, next, &clp->cl_delegations, dl_perclnt) {
6077                 if (victims) {
6078                         /*
6079                          * It's not safe to mess with delegations that have a
6080                          * non-zero dl_time. They might have already been broken
6081                          * and could be processed by the laundromat outside of
6082                          * the state_lock. Just leave them be.
6083                          */
6084                         if (dp->dl_time != 0)
6085                                 continue;
6086
6087                         atomic_inc(&clp->cl_refcount);
6088                         unhash_delegation_locked(dp);
6089                         list_add(&dp->dl_recall_lru, victims);
6090                 }
6091                 ++count;
6092                 /*
6093                  * Despite the fact that these functions deal with
6094                  * 64-bit integers for "count", we must ensure that
6095                  * it doesn't blow up the clp->cl_refcount. Throw a
6096                  * warning if we start to approach INT_MAX here.
6097                  */
6098                 WARN_ON_ONCE(count == (INT_MAX / 2));
6099                 if (count == max)
6100                         break;
6101         }
6102         spin_unlock(&state_lock);
6103         return count;
6104 }
6105
6106 static u64
6107 nfsd_print_client_delegations(struct nfs4_client *clp)
6108 {
6109         u64 count = nfsd_find_all_delegations(clp, 0, NULL);
6110
6111         nfsd_print_count(clp, count, "delegations");
6112         return count;
6113 }
6114
6115 u64
6116 nfsd_inject_print_delegations(void)
6117 {
6118         struct nfs4_client *clp;
6119         u64 count = 0;
6120         struct nfsd_net *nn = net_generic(current->nsproxy->net_ns,
6121                                                 nfsd_net_id);
6122
6123         if (!nfsd_netns_ready(nn))
6124                 return 0;
6125
6126         spin_lock(&nn->client_lock);
6127         list_for_each_entry(clp, &nn->client_lru, cl_lru)
6128                 count += nfsd_print_client_delegations(clp);
6129         spin_unlock(&nn->client_lock);
6130
6131         return count;
6132 }
6133
6134 static void
6135 nfsd_forget_delegations(struct list_head *reaplist)
6136 {
6137         struct nfs4_client *clp;
6138         struct nfs4_delegation *dp, *next;
6139
6140         list_for_each_entry_safe(dp, next, reaplist, dl_recall_lru) {
6141                 list_del_init(&dp->dl_recall_lru);
6142                 clp = dp->dl_stid.sc_client;
6143                 revoke_delegation(dp);
6144                 put_client(clp);
6145         }
6146 }
6147
6148 u64
6149 nfsd_inject_forget_client_delegations(struct sockaddr_storage *addr,
6150                                       size_t addr_size)
6151 {
6152         u64 count = 0;
6153         struct nfs4_client *clp;
6154         struct nfsd_net *nn = net_generic(current->nsproxy->net_ns,
6155                                                 nfsd_net_id);
6156         LIST_HEAD(reaplist);
6157
6158         if (!nfsd_netns_ready(nn))
6159                 return count;
6160
6161         spin_lock(&nn->client_lock);
6162         clp = nfsd_find_client(addr, addr_size);
6163         if (clp)
6164                 count = nfsd_find_all_delegations(clp, 0, &reaplist);
6165         spin_unlock(&nn->client_lock);
6166
6167         nfsd_forget_delegations(&reaplist);
6168         return count;
6169 }
6170
6171 u64
6172 nfsd_inject_forget_delegations(u64 max)
6173 {
6174         u64 count = 0;
6175         struct nfs4_client *clp;
6176         struct nfsd_net *nn = net_generic(current->nsproxy->net_ns,
6177                                                 nfsd_net_id);
6178         LIST_HEAD(reaplist);
6179
6180         if (!nfsd_netns_ready(nn))
6181                 return count;
6182
6183         spin_lock(&nn->client_lock);
6184         list_for_each_entry(clp, &nn->client_lru, cl_lru) {
6185                 count += nfsd_find_all_delegations(clp, max - count, &reaplist);
6186                 if (max != 0 && count >= max)
6187                         break;
6188         }
6189         spin_unlock(&nn->client_lock);
6190         nfsd_forget_delegations(&reaplist);
6191         return count;
6192 }
6193
6194 static void
6195 nfsd_recall_delegations(struct list_head *reaplist)
6196 {
6197         struct nfs4_client *clp;
6198         struct nfs4_delegation *dp, *next;
6199
6200         list_for_each_entry_safe(dp, next, reaplist, dl_recall_lru) {
6201                 list_del_init(&dp->dl_recall_lru);
6202                 clp = dp->dl_stid.sc_client;
6203                 /*
6204                  * We skipped all entries that had a zero dl_time before,
6205                  * so we can now reset the dl_time back to 0. If a delegation
6206                  * break comes in now, then it won't make any difference since
6207                  * we're recalling it either way.
6208                  */
6209                 spin_lock(&state_lock);
6210                 dp->dl_time = 0;
6211                 spin_unlock(&state_lock);
6212                 nfsd_break_one_deleg(dp);
6213                 put_client(clp);
6214         }
6215 }
6216
6217 u64
6218 nfsd_inject_recall_client_delegations(struct sockaddr_storage *addr,
6219                                       size_t addr_size)
6220 {
6221         u64 count = 0;
6222         struct nfs4_client *clp;
6223         struct nfsd_net *nn = net_generic(current->nsproxy->net_ns,
6224                                                 nfsd_net_id);
6225         LIST_HEAD(reaplist);
6226
6227         if (!nfsd_netns_ready(nn))
6228                 return count;
6229
6230         spin_lock(&nn->client_lock);
6231         clp = nfsd_find_client(addr, addr_size);
6232         if (clp)
6233                 count = nfsd_find_all_delegations(clp, 0, &reaplist);
6234         spin_unlock(&nn->client_lock);
6235
6236         nfsd_recall_delegations(&reaplist);
6237         return count;
6238 }
6239
6240 u64
6241 nfsd_inject_recall_delegations(u64 max)
6242 {
6243         u64 count = 0;
6244         struct nfs4_client *clp, *next;
6245         struct nfsd_net *nn = net_generic(current->nsproxy->net_ns,
6246                                                 nfsd_net_id);
6247         LIST_HEAD(reaplist);
6248
6249         if (!nfsd_netns_ready(nn))
6250                 return count;
6251
6252         spin_lock(&nn->client_lock);
6253         list_for_each_entry_safe(clp, next, &nn->client_lru, cl_lru) {
6254                 count += nfsd_find_all_delegations(clp, max - count, &reaplist);
6255                 if (max != 0 && ++count >= max)
6256                         break;
6257         }
6258         spin_unlock(&nn->client_lock);
6259         nfsd_recall_delegations(&reaplist);
6260         return count;
6261 }
6262 #endif /* CONFIG_NFSD_FAULT_INJECTION */
6263
6264 /*
6265  * Since the lifetime of a delegation isn't limited to that of an open, a
6266  * client may quite reasonably hang on to a delegation as long as it has
6267  * the inode cached.  This becomes an obvious problem the first time a
6268  * client's inode cache approaches the size of the server's total memory.
6269  *
6270  * For now we avoid this problem by imposing a hard limit on the number
6271  * of delegations, which varies according to the server's memory size.
6272  */
6273 static void
6274 set_max_delegations(void)
6275 {
6276         /*
6277          * Allow at most 4 delegations per megabyte of RAM.  Quick
6278          * estimates suggest that in the worst case (where every delegation
6279          * is for a different inode), a delegation could take about 1.5K,
6280          * giving a worst case usage of about 6% of memory.
6281          */
6282         max_delegations = nr_free_buffer_pages() >> (20 - 2 - PAGE_SHIFT);
6283 }
6284
6285 static int nfs4_state_create_net(struct net *net)
6286 {
6287         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
6288         int i;
6289
6290         nn->conf_id_hashtbl = kmalloc(sizeof(struct list_head) *
6291                         CLIENT_HASH_SIZE, GFP_KERNEL);
6292         if (!nn->conf_id_hashtbl)
6293                 goto err;
6294         nn->unconf_id_hashtbl = kmalloc(sizeof(struct list_head) *
6295                         CLIENT_HASH_SIZE, GFP_KERNEL);
6296         if (!nn->unconf_id_hashtbl)
6297                 goto err_unconf_id;
6298         nn->sessionid_hashtbl = kmalloc(sizeof(struct list_head) *
6299                         SESSION_HASH_SIZE, GFP_KERNEL);
6300         if (!nn->sessionid_hashtbl)
6301                 goto err_sessionid;
6302
6303         for (i = 0; i < CLIENT_HASH_SIZE; i++) {
6304                 INIT_LIST_HEAD(&nn->conf_id_hashtbl[i]);
6305                 INIT_LIST_HEAD(&nn->unconf_id_hashtbl[i]);
6306         }
6307         for (i = 0; i < SESSION_HASH_SIZE; i++)
6308                 INIT_LIST_HEAD(&nn->sessionid_hashtbl[i]);
6309         nn->conf_name_tree = RB_ROOT;
6310         nn->unconf_name_tree = RB_ROOT;
6311         INIT_LIST_HEAD(&nn->client_lru);
6312         INIT_LIST_HEAD(&nn->close_lru);
6313         INIT_LIST_HEAD(&nn->del_recall_lru);
6314         spin_lock_init(&nn->client_lock);
6315
6316         INIT_DELAYED_WORK(&nn->laundromat_work, laundromat_main);
6317         get_net(net);
6318
6319         return 0;
6320
6321 err_sessionid:
6322         kfree(nn->unconf_id_hashtbl);
6323 err_unconf_id:
6324         kfree(nn->conf_id_hashtbl);
6325 err:
6326         return -ENOMEM;
6327 }
6328
6329 static void
6330 nfs4_state_destroy_net(struct net *net)
6331 {
6332         int i;
6333         struct nfs4_client *clp = NULL;
6334         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
6335
6336         for (i = 0; i < CLIENT_HASH_SIZE; i++) {
6337                 while (!list_empty(&nn->conf_id_hashtbl[i])) {
6338                         clp = list_entry(nn->conf_id_hashtbl[i].next, struct nfs4_client, cl_idhash);
6339                         destroy_client(clp);
6340                 }
6341         }
6342
6343         for (i = 0; i < CLIENT_HASH_SIZE; i++) {
6344                 while (!list_empty(&nn->unconf_id_hashtbl[i])) {
6345                         clp = list_entry(nn->unconf_id_hashtbl[i].next, struct nfs4_client, cl_idhash);
6346                         destroy_client(clp);
6347                 }
6348         }
6349
6350         kfree(nn->sessionid_hashtbl);
6351         kfree(nn->unconf_id_hashtbl);
6352         kfree(nn->conf_id_hashtbl);
6353         put_net(net);
6354 }
6355
6356 int
6357 nfs4_state_start_net(struct net *net)
6358 {
6359         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
6360         int ret;
6361
6362         ret = nfs4_state_create_net(net);
6363         if (ret)
6364                 return ret;
6365         nfsd4_client_tracking_init(net);
6366         nn->boot_time = get_seconds();
6367         locks_start_grace(net, &nn->nfsd4_manager);
6368         nn->grace_ended = false;
6369         printk(KERN_INFO "NFSD: starting %ld-second grace period (net %p)\n",
6370                nn->nfsd4_grace, net);
6371         queue_delayed_work(laundry_wq, &nn->laundromat_work, nn->nfsd4_grace * HZ);
6372         return 0;
6373 }
6374
6375 /* initialization to perform when the nfsd service is started: */
6376
6377 int
6378 nfs4_state_start(void)
6379 {
6380         int ret;
6381
6382         ret = set_callback_cred();
6383         if (ret)
6384                 return -ENOMEM;
6385         laundry_wq = create_singlethread_workqueue("nfsd4");
6386         if (laundry_wq == NULL) {
6387                 ret = -ENOMEM;
6388                 goto out_recovery;
6389         }
6390         ret = nfsd4_create_callback_queue();
6391         if (ret)
6392                 goto out_free_laundry;
6393
6394         set_max_delegations();
6395
6396         return 0;
6397
6398 out_free_laundry:
6399         destroy_workqueue(laundry_wq);
6400 out_recovery:
6401         return ret;
6402 }
6403
6404 void
6405 nfs4_state_shutdown_net(struct net *net)
6406 {
6407         struct nfs4_delegation *dp = NULL;
6408         struct list_head *pos, *next, reaplist;
6409         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
6410
6411         cancel_delayed_work_sync(&nn->laundromat_work);
6412         locks_end_grace(&nn->nfsd4_manager);
6413
6414         INIT_LIST_HEAD(&reaplist);
6415         spin_lock(&state_lock);
6416         list_for_each_safe(pos, next, &nn->del_recall_lru) {
6417                 dp = list_entry (pos, struct nfs4_delegation, dl_recall_lru);
6418                 unhash_delegation_locked(dp);
6419                 list_add(&dp->dl_recall_lru, &reaplist);
6420         }
6421         spin_unlock(&state_lock);
6422         list_for_each_safe(pos, next, &reaplist) {
6423                 dp = list_entry (pos, struct nfs4_delegation, dl_recall_lru);
6424                 list_del_init(&dp->dl_recall_lru);
6425                 nfs4_put_deleg_lease(dp->dl_stid.sc_file);
6426                 nfs4_put_stid(&dp->dl_stid);
6427         }
6428
6429         nfsd4_client_tracking_exit(net);
6430         nfs4_state_destroy_net(net);
6431 }
6432
6433 void
6434 nfs4_state_shutdown(void)
6435 {
6436         destroy_workqueue(laundry_wq);
6437         nfsd4_destroy_callback_queue();
6438 }
6439
6440 static void
6441 get_stateid(struct nfsd4_compound_state *cstate, stateid_t *stateid)
6442 {
6443         if (HAS_STATE_ID(cstate, CURRENT_STATE_ID_FLAG) && CURRENT_STATEID(stateid))
6444                 memcpy(stateid, &cstate->current_stateid, sizeof(stateid_t));
6445 }
6446
6447 static void
6448 put_stateid(struct nfsd4_compound_state *cstate, stateid_t *stateid)
6449 {
6450         if (cstate->minorversion) {
6451                 memcpy(&cstate->current_stateid, stateid, sizeof(stateid_t));
6452                 SET_STATE_ID(cstate, CURRENT_STATE_ID_FLAG);
6453         }
6454 }
6455
6456 void
6457 clear_current_stateid(struct nfsd4_compound_state *cstate)
6458 {
6459         CLEAR_STATE_ID(cstate, CURRENT_STATE_ID_FLAG);
6460 }
6461
6462 /*
6463  * functions to set current state id
6464  */
6465 void
6466 nfsd4_set_opendowngradestateid(struct nfsd4_compound_state *cstate, struct nfsd4_open_downgrade *odp)
6467 {
6468         put_stateid(cstate, &odp->od_stateid);
6469 }
6470
6471 void
6472 nfsd4_set_openstateid(struct nfsd4_compound_state *cstate, struct nfsd4_open *open)
6473 {
6474         put_stateid(cstate, &open->op_stateid);
6475 }
6476
6477 void
6478 nfsd4_set_closestateid(struct nfsd4_compound_state *cstate, struct nfsd4_close *close)
6479 {
6480         put_stateid(cstate, &close->cl_stateid);
6481 }
6482
6483 void
6484 nfsd4_set_lockstateid(struct nfsd4_compound_state *cstate, struct nfsd4_lock *lock)
6485 {
6486         put_stateid(cstate, &lock->lk_resp_stateid);
6487 }
6488
6489 /*
6490  * functions to consume current state id
6491  */
6492
6493 void
6494 nfsd4_get_opendowngradestateid(struct nfsd4_compound_state *cstate, struct nfsd4_open_downgrade *odp)
6495 {
6496         get_stateid(cstate, &odp->od_stateid);
6497 }
6498
6499 void
6500 nfsd4_get_delegreturnstateid(struct nfsd4_compound_state *cstate, struct nfsd4_delegreturn *drp)
6501 {
6502         get_stateid(cstate, &drp->dr_stateid);
6503 }
6504
6505 void
6506 nfsd4_get_freestateid(struct nfsd4_compound_state *cstate, struct nfsd4_free_stateid *fsp)
6507 {
6508         get_stateid(cstate, &fsp->fr_stateid);
6509 }
6510
6511 void
6512 nfsd4_get_setattrstateid(struct nfsd4_compound_state *cstate, struct nfsd4_setattr *setattr)
6513 {
6514         get_stateid(cstate, &setattr->sa_stateid);
6515 }
6516
6517 void
6518 nfsd4_get_closestateid(struct nfsd4_compound_state *cstate, struct nfsd4_close *close)
6519 {
6520         get_stateid(cstate, &close->cl_stateid);
6521 }
6522
6523 void
6524 nfsd4_get_lockustateid(struct nfsd4_compound_state *cstate, struct nfsd4_locku *locku)
6525 {
6526         get_stateid(cstate, &locku->lu_stateid);
6527 }
6528
6529 void
6530 nfsd4_get_readstateid(struct nfsd4_compound_state *cstate, struct nfsd4_read *read)
6531 {
6532         get_stateid(cstate, &read->rd_stateid);
6533 }
6534
6535 void
6536 nfsd4_get_writestateid(struct nfsd4_compound_state *cstate, struct nfsd4_write *write)
6537 {
6538         get_stateid(cstate, &write->wr_stateid);
6539 }