fs/nfsd/nfs4state.c

   1 /*
   2 *  Copyright (c) 2001 The Regents of the University of Michigan.
   3 *  All rights reserved.
   4 *
   5 *  Kendrick Smith <kmsmith@umich.edu>
   6 *  Andy Adamson <kandros@umich.edu>
   7 *
   8 *  Redistribution and use in source and binary forms, with or without
   9 *  modification, are permitted provided that the following conditions
  10 *  are met:
  11 *
  12 *  1. Redistributions of source code must retain the above copyright
  13 *     notice, this list of conditions and the following disclaimer.
  14 *  2. Redistributions in binary form must reproduce the above copyright
  15 *     notice, this list of conditions and the following disclaimer in the
  16 *     documentation and/or other materials provided with the distribution.
  17 *  3. Neither the name of the University nor the names of its
  18 *     contributors may be used to endorse or promote products derived
  19 *     from this software without specific prior written permission.
  20 *
  21 *  THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
  22 *  WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
  23 *  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
  24 *  DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
  25 *  FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  26 *  CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  27 *  SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
  28 *  BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
  29 *  LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
  30 *  NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
  31 *  SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  32 *
  33 */
  34
  35 #include <linux/file.h>
  36 #include <linux/fs.h>
  37 #include <linux/slab.h>
  38 #include <linux/namei.h>
  39 #include <linux/swap.h>
  40 #include <linux/pagemap.h>
  41 #include <linux/ratelimit.h>
  42 #include <linux/sunrpc/svcauth_gss.h>
  43 #include <linux/sunrpc/addr.h>
  44 #include <linux/hash.h>
  45 #include "xdr4.h"
  46 #include "xdr4cb.h"
  47 #include "vfs.h"
  48 #include "current_stateid.h"
  49
  50 #include "netns.h"
  51
  52 #define NFSDDBG_FACILITY                NFSDDBG_PROC
  53
  54 #define all_ones {{~0,~0},~0}
  55 static const stateid_t one_stateid = {
  56         .si_generation = ~0,
  57         .si_opaque = all_ones,
  58 };
  59 static const stateid_t zero_stateid = {
  60         /* all fields zero */
  61 };
  62 static const stateid_t currentstateid = {
  63         .si_generation = 1,
  64 };
  65
  66 static u64 current_sessionid = 1;
  67
  68 #define ZERO_STATEID(stateid) (!memcmp((stateid), &zero_stateid, sizeof(stateid_t)))
  69 #define ONE_STATEID(stateid)  (!memcmp((stateid), &one_stateid, sizeof(stateid_t)))
  70 #define CURRENT_STATEID(stateid) (!memcmp((stateid), &currentstateid, sizeof(stateid_t)))
  71
  72 /* forward declarations */
  73 static bool check_for_locks(struct nfs4_file *fp, struct nfs4_lockowner *lowner);
  74 static void nfs4_free_ol_stateid(struct nfs4_stid *stid);
  75
  76 /* Locking: */
  77
  78 /*
  79  * Currently used for the del_recall_lru and file hash table.  In an
  80  * effort to decrease the scope of the client_mutex, this spinlock may
  81  * eventually cover more:
  82  */
  83 static DEFINE_SPINLOCK(state_lock);
  84
  85 /*
  86  * A waitqueue for all in-progress 4.0 CLOSE operations that are waiting for
  87  * the refcount on the open stateid to drop.
  88  */
  89 static DECLARE_WAIT_QUEUE_HEAD(close_wq);
  90
  91 static struct kmem_cache *openowner_slab;
  92 static struct kmem_cache *lockowner_slab;
  93 static struct kmem_cache *file_slab;
  94 static struct kmem_cache *stateid_slab;
  95 static struct kmem_cache *deleg_slab;
  96
  97 static void free_session(struct nfsd4_session *);
  98
  99 static bool is_session_dead(struct nfsd4_session *ses)
 100 {
 101         return ses->se_flags & NFS4_SESSION_DEAD;
 102 }
 103
 104 static __be32 mark_session_dead_locked(struct nfsd4_session *ses, int ref_held_by_me)
 105 {
 106         if (atomic_read(&ses->se_ref) > ref_held_by_me)
 107                 return nfserr_jukebox;
 108         ses->se_flags |= NFS4_SESSION_DEAD;
 109         return nfs_ok;
 110 }
 111
 112 static bool is_client_expired(struct nfs4_client *clp)
 113 {
 114         return clp->cl_time == 0;
 115 }
 116
 117 static __be32 get_client_locked(struct nfs4_client *clp)
 118 {
 119         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
 120
 121         lockdep_assert_held(&nn->client_lock);
 122
 123         if (is_client_expired(clp))
 124                 return nfserr_expired;
 125         atomic_inc(&clp->cl_refcount);
 126         return nfs_ok;
 127 }
 128
 129 /* must be called under the client_lock */
 130 static inline void
 131 renew_client_locked(struct nfs4_client *clp)
 132 {
 133         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
 134
 135         if (is_client_expired(clp)) {
 136                 WARN_ON(1);
 137                 printk("%s: client (clientid %08x/%08x) already expired\n",
 138                         __func__,
 139                         clp->cl_clientid.cl_boot,
 140                         clp->cl_clientid.cl_id);
 141                 return;
 142         }
 143
 144         dprintk("renewing client (clientid %08x/%08x)\n",
 145                         clp->cl_clientid.cl_boot,
 146                         clp->cl_clientid.cl_id);
 147         list_move_tail(&clp->cl_lru, &nn->client_lru);
 148         clp->cl_time = get_seconds();
 149 }
 150
 151 static inline void
 152 renew_client(struct nfs4_client *clp)
 153 {
 154         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
 155
 156         spin_lock(&nn->client_lock);
 157         renew_client_locked(clp);
 158         spin_unlock(&nn->client_lock);
 159 }
 160
 161 static void put_client_renew_locked(struct nfs4_client *clp)
 162 {
 163         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
 164
 165         lockdep_assert_held(&nn->client_lock);
 166
 167         if (!atomic_dec_and_test(&clp->cl_refcount))
 168                 return;
 169         if (!is_client_expired(clp))
 170                 renew_client_locked(clp);
 171 }
 172
 173 static void put_client_renew(struct nfs4_client *clp)
 174 {
 175         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
 176
 177         if (!atomic_dec_and_lock(&clp->cl_refcount, &nn->client_lock))
 178                 return;
 179         if (!is_client_expired(clp))
 180                 renew_client_locked(clp);
 181         spin_unlock(&nn->client_lock);
 182 }
 183
 184 static __be32 nfsd4_get_session_locked(struct nfsd4_session *ses)
 185 {
 186         __be32 status;
 187
 188         if (is_session_dead(ses))
 189                 return nfserr_badsession;
 190         status = get_client_locked(ses->se_client);
 191         if (status)
 192                 return status;
 193         atomic_inc(&ses->se_ref);
 194         return nfs_ok;
 195 }
 196
 197 static void nfsd4_put_session_locked(struct nfsd4_session *ses)
 198 {
 199         struct nfs4_client *clp = ses->se_client;
 200         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
 201
 202         lockdep_assert_held(&nn->client_lock);
 203
 204         if (atomic_dec_and_test(&ses->se_ref) && is_session_dead(ses))
 205                 free_session(ses);
 206         put_client_renew_locked(clp);
 207 }
 208
 209 static void nfsd4_put_session(struct nfsd4_session *ses)
 210 {
 211         struct nfs4_client *clp = ses->se_client;
 212         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
 213
 214         spin_lock(&nn->client_lock);
 215         nfsd4_put_session_locked(ses);
 216         spin_unlock(&nn->client_lock);
 217 }
 218
 219 static inline struct nfs4_stateowner *
 220 nfs4_get_stateowner(struct nfs4_stateowner *sop)
 221 {
 222         atomic_inc(&sop->so_count);
 223         return sop;
 224 }
 225
 226 static int
 227 same_owner_str(struct nfs4_stateowner *sop, struct xdr_netobj *owner)
 228 {
 229         return (sop->so_owner.len == owner->len) &&
 230                 0 == memcmp(sop->so_owner.data, owner->data, owner->len);
 231 }
 232
 233 static struct nfs4_openowner *
 234 find_openstateowner_str_locked(unsigned int hashval, struct nfsd4_open *open,
 235                         struct nfs4_client *clp)
 236 {
 237         struct nfs4_stateowner *so;
 238
 239         lockdep_assert_held(&clp->cl_lock);
 240
 241         list_for_each_entry(so, &clp->cl_ownerstr_hashtbl[hashval],
 242                             so_strhash) {
 243                 if (!so->so_is_open_owner)
 244                         continue;
 245                 if (same_owner_str(so, &open->op_owner))
 246                         return openowner(nfs4_get_stateowner(so));
 247         }
 248         return NULL;
 249 }
 250
 251 static struct nfs4_openowner *
 252 find_openstateowner_str(unsigned int hashval, struct nfsd4_open *open,
 253                         struct nfs4_client *clp)
 254 {
 255         struct nfs4_openowner *oo;
 256
 257         spin_lock(&clp->cl_lock);
 258         oo = find_openstateowner_str_locked(hashval, open, clp);
 259         spin_unlock(&clp->cl_lock);
 260         return oo;
 261 }
 262
 263 static inline u32
 264 opaque_hashval(const void *ptr, int nbytes)
 265 {
 266         unsigned char *cptr = (unsigned char *) ptr;
 267
 268         u32 x = 0;
 269         while (nbytes--) {
 270                 x *= 37;
 271                 x += *cptr++;
 272         }
 273         return x;
 274 }
 275
 276 static void nfsd4_free_file(struct nfs4_file *f)
 277 {
 278         kmem_cache_free(file_slab, f);
 279 }
 280
 281 static inline void
 282 put_nfs4_file(struct nfs4_file *fi)
 283 {
 284         might_lock(&state_lock);
 285
 286         if (atomic_dec_and_lock(&fi->fi_ref, &state_lock)) {
 287                 hlist_del(&fi->fi_hash);
 288                 spin_unlock(&state_lock);
 289                 nfsd4_free_file(fi);
 290         }
 291 }
 292
 293 static inline void
 294 get_nfs4_file(struct nfs4_file *fi)
 295 {
 296         atomic_inc(&fi->fi_ref);
 297 }
 298
 299 static struct file *
 300 __nfs4_get_fd(struct nfs4_file *f, int oflag)
 301 {
 302         if (f->fi_fds[oflag])
 303                 return get_file(f->fi_fds[oflag]);
 304         return NULL;
 305 }
 306
 307 static struct file *
 308 find_writeable_file_locked(struct nfs4_file *f)
 309 {
 310         struct file *ret;
 311
 312         lockdep_assert_held(&f->fi_lock);
 313
 314         ret = __nfs4_get_fd(f, O_WRONLY);
 315         if (!ret)
 316                 ret = __nfs4_get_fd(f, O_RDWR);
 317         return ret;
 318 }
 319
 320 static struct file *
 321 find_writeable_file(struct nfs4_file *f)
 322 {
 323         struct file *ret;
 324
 325         spin_lock(&f->fi_lock);
 326         ret = find_writeable_file_locked(f);
 327         spin_unlock(&f->fi_lock);
 328
 329         return ret;
 330 }
 331
 332 static struct file *find_readable_file_locked(struct nfs4_file *f)
 333 {
 334         struct file *ret;
 335
 336         lockdep_assert_held(&f->fi_lock);
 337
 338         ret = __nfs4_get_fd(f, O_RDONLY);
 339         if (!ret)
 340                 ret = __nfs4_get_fd(f, O_RDWR);
 341         return ret;
 342 }
 343
 344 static struct file *
 345 find_readable_file(struct nfs4_file *f)
 346 {
 347         struct file *ret;
 348
 349         spin_lock(&f->fi_lock);
 350         ret = find_readable_file_locked(f);
 351         spin_unlock(&f->fi_lock);
 352
 353         return ret;
 354 }
 355
 356 static struct file *
 357 find_any_file(struct nfs4_file *f)
 358 {
 359         struct file *ret;
 360
 361         spin_lock(&f->fi_lock);
 362         ret = __nfs4_get_fd(f, O_RDWR);
 363         if (!ret) {
 364                 ret = __nfs4_get_fd(f, O_WRONLY);
 365                 if (!ret)
 366                         ret = __nfs4_get_fd(f, O_RDONLY);
 367         }
 368         spin_unlock(&f->fi_lock);
 369         return ret;
 370 }
 371
 372 static atomic_long_t num_delegations;
 373 unsigned long max_delegations;
 374
 375 /*
 376  * Open owner state (share locks)
 377  */
 378
 379 /* hash tables for lock and open owners */
 380 #define OWNER_HASH_BITS              8
 381 #define OWNER_HASH_SIZE             (1 << OWNER_HASH_BITS)
 382 #define OWNER_HASH_MASK             (OWNER_HASH_SIZE - 1)
 383
 384 static unsigned int ownerstr_hashval(struct xdr_netobj *ownername)
 385 {
 386         unsigned int ret;
 387
 388         ret = opaque_hashval(ownername->data, ownername->len);
 389         return ret & OWNER_HASH_MASK;
 390 }
 391
 392 /* hash table for nfs4_file */
 393 #define FILE_HASH_BITS                   8
 394 #define FILE_HASH_SIZE                  (1 << FILE_HASH_BITS)
 395
 396 static unsigned int nfsd_fh_hashval(struct knfsd_fh *fh)
 397 {
 398         return jhash2(fh->fh_base.fh_pad, XDR_QUADLEN(fh->fh_size), 0);
 399 }
 400
 401 static unsigned int file_hashval(struct knfsd_fh *fh)
 402 {
 403         return nfsd_fh_hashval(fh) & (FILE_HASH_SIZE - 1);
 404 }
 405
 406 static bool nfsd_fh_match(struct knfsd_fh *fh1, struct knfsd_fh *fh2)
 407 {
 408         return fh1->fh_size == fh2->fh_size &&
 409                 !memcmp(fh1->fh_base.fh_pad,
 410                                 fh2->fh_base.fh_pad,
 411                                 fh1->fh_size);
 412 }
 413
 414 static struct hlist_head file_hashtbl[FILE_HASH_SIZE];
 415
 416 static void
 417 __nfs4_file_get_access(struct nfs4_file *fp, u32 access)
 418 {
 419         lockdep_assert_held(&fp->fi_lock);
 420
 421         if (access & NFS4_SHARE_ACCESS_WRITE)
 422                 atomic_inc(&fp->fi_access[O_WRONLY]);
 423         if (access & NFS4_SHARE_ACCESS_READ)
 424                 atomic_inc(&fp->fi_access[O_RDONLY]);
 425 }
 426
 427 static __be32
 428 nfs4_file_get_access(struct nfs4_file *fp, u32 access)
 429 {
 430         lockdep_assert_held(&fp->fi_lock);
 431
 432         /* Does this access mode make sense? */
 433         if (access & ~NFS4_SHARE_ACCESS_BOTH)
 434                 return nfserr_inval;
 435
 436         /* Does it conflict with a deny mode already set? */
 437         if ((access & fp->fi_share_deny) != 0)
 438                 return nfserr_share_denied;
 439
 440         __nfs4_file_get_access(fp, access);
 441         return nfs_ok;
 442 }
 443
 444 static __be32 nfs4_file_check_deny(struct nfs4_file *fp, u32 deny)
 445 {
 446         /* Common case is that there is no deny mode. */
 447         if (deny) {
 448                 /* Does this deny mode make sense? */
 449                 if (deny & ~NFS4_SHARE_DENY_BOTH)
 450                         return nfserr_inval;
 451
 452                 if ((deny & NFS4_SHARE_DENY_READ) &&
 453                     atomic_read(&fp->fi_access[O_RDONLY]))
 454                         return nfserr_share_denied;
 455
 456                 if ((deny & NFS4_SHARE_DENY_WRITE) &&
 457                     atomic_read(&fp->fi_access[O_WRONLY]))
 458                         return nfserr_share_denied;
 459         }
 460         return nfs_ok;
 461 }
 462
 463 static void __nfs4_file_put_access(struct nfs4_file *fp, int oflag)
 464 {
 465         might_lock(&fp->fi_lock);
 466
 467         if (atomic_dec_and_lock(&fp->fi_access[oflag], &fp->fi_lock)) {
 468                 struct file *f1 = NULL;
 469                 struct file *f2 = NULL;
 470
 471                 swap(f1, fp->fi_fds[oflag]);
 472                 if (atomic_read(&fp->fi_access[1 - oflag]) == 0)
 473                         swap(f2, fp->fi_fds[O_RDWR]);
 474                 spin_unlock(&fp->fi_lock);
 475                 if (f1)
 476                         fput(f1);
 477                 if (f2)
 478                         fput(f2);
 479         }
 480 }
 481
 482 static void nfs4_file_put_access(struct nfs4_file *fp, u32 access)
 483 {
 484         WARN_ON_ONCE(access & ~NFS4_SHARE_ACCESS_BOTH);
 485
 486         if (access & NFS4_SHARE_ACCESS_WRITE)
 487                 __nfs4_file_put_access(fp, O_WRONLY);
 488         if (access & NFS4_SHARE_ACCESS_READ)
 489                 __nfs4_file_put_access(fp, O_RDONLY);
 490 }
 491
 492 static struct nfs4_stid *nfs4_alloc_stid(struct nfs4_client *cl,
 493                                          struct kmem_cache *slab)
 494 {
 495         struct nfs4_stid *stid;
 496         int new_id;
 497
 498         stid = kmem_cache_zalloc(slab, GFP_KERNEL);
 499         if (!stid)
 500                 return NULL;
 501
 502         idr_preload(GFP_KERNEL);
 503         spin_lock(&cl->cl_lock);
 504         new_id = idr_alloc_cyclic(&cl->cl_stateids, stid, 0, 0, GFP_NOWAIT);
 505         spin_unlock(&cl->cl_lock);
 506         idr_preload_end();
 507         if (new_id < 0)
 508                 goto out_free;
 509         stid->sc_client = cl;
 510         stid->sc_stateid.si_opaque.so_id = new_id;
 511         stid->sc_stateid.si_opaque.so_clid = cl->cl_clientid;
 512         /* Will be incremented before return to client: */
 513         atomic_set(&stid->sc_count, 1);
 514
 515         /*
 516          * It shouldn't be a problem to reuse an opaque stateid value.
 517          * I don't think it is for 4.1.  But with 4.0 I worry that, for
 518          * example, a stray write retransmission could be accepted by
 519          * the server when it should have been rejected.  Therefore,
 520          * adopt a trick from the sctp code to attempt to maximize the
 521          * amount of time until an id is reused, by ensuring they always
 522          * "increase" (mod INT_MAX):
 523          */
 524         return stid;
 525 out_free:
 526         kmem_cache_free(slab, stid);
 527         return NULL;
 528 }
 529
 530 static struct nfs4_ol_stateid * nfs4_alloc_open_stateid(struct nfs4_client *clp)
 531 {
 532         struct nfs4_stid *stid;
 533         struct nfs4_ol_stateid *stp;
 534
 535         stid = nfs4_alloc_stid(clp, stateid_slab);
 536         if (!stid)
 537                 return NULL;
 538
 539         stp = openlockstateid(stid);
 540         stp->st_stid.sc_free = nfs4_free_ol_stateid;
 541         return stp;
 542 }
 543
 544 static void nfs4_free_deleg(struct nfs4_stid *stid)
 545 {
 546         kmem_cache_free(deleg_slab, stid);
 547         atomic_long_dec(&num_delegations);
 548 }
 549
 550 /*
 551  * When we recall a delegation, we should be careful not to hand it
 552  * out again straight away.
 553  * To ensure this we keep a pair of bloom filters ('new' and 'old')
 554  * in which the filehandles of recalled delegations are "stored".
 555  * If a filehandle appear in either filter, a delegation is blocked.
 556  * When a delegation is recalled, the filehandle is stored in the "new"
 557  * filter.
 558  * Every 30 seconds we swap the filters and clear the "new" one,
 559  * unless both are empty of course.
 560  *
 561  * Each filter is 256 bits.  We hash the filehandle to 32bit and use the
 562  * low 3 bytes as hash-table indices.
 563  *
 564  * 'blocked_delegations_lock', which is always taken in block_delegations(),
 565  * is used to manage concurrent access.  Testing does not need the lock
 566  * except when swapping the two filters.
 567  */
 568 static DEFINE_SPINLOCK(blocked_delegations_lock);
 569 static struct bloom_pair {
 570         int     entries, old_entries;
 571         time_t  swap_time;
 572         int     new; /* index into 'set' */
 573         DECLARE_BITMAP(set[2], 256);
 574 } blocked_delegations;
 575
 576 static int delegation_blocked(struct knfsd_fh *fh)
 577 {
 578         u32 hash;
 579         struct bloom_pair *bd = &blocked_delegations;
 580
 581         if (bd->entries == 0)
 582                 return 0;
 583         if (seconds_since_boot() - bd->swap_time > 30) {
 584                 spin_lock(&blocked_delegations_lock);
 585                 if (seconds_since_boot() - bd->swap_time > 30) {
 586                         bd->entries -= bd->old_entries;
 587                         bd->old_entries = bd->entries;
 588                         memset(bd->set[bd->new], 0,
 589                                sizeof(bd->set[0]));
 590                         bd->new = 1-bd->new;
 591                         bd->swap_time = seconds_since_boot();
 592                 }
 593                 spin_unlock(&blocked_delegations_lock);
 594         }
 595         hash = arch_fast_hash(&fh->fh_base, fh->fh_size, 0);
 596         if (test_bit(hash&255, bd->set[0]) &&
 597             test_bit((hash>>8)&255, bd->set[0]) &&
 598             test_bit((hash>>16)&255, bd->set[0]))
 599                 return 1;
 600
 601         if (test_bit(hash&255, bd->set[1]) &&
 602             test_bit((hash>>8)&255, bd->set[1]) &&
 603             test_bit((hash>>16)&255, bd->set[1]))
 604                 return 1;
 605
 606         return 0;
 607 }
 608
 609 static void block_delegations(struct knfsd_fh *fh)
 610 {
 611         u32 hash;
 612         struct bloom_pair *bd = &blocked_delegations;
 613
 614         hash = arch_fast_hash(&fh->fh_base, fh->fh_size, 0);
 615
 616         spin_lock(&blocked_delegations_lock);
 617         __set_bit(hash&255, bd->set[bd->new]);
 618         __set_bit((hash>>8)&255, bd->set[bd->new]);
 619         __set_bit((hash>>16)&255, bd->set[bd->new]);
 620         if (bd->entries == 0)
 621                 bd->swap_time = seconds_since_boot();
 622         bd->entries += 1;
 623         spin_unlock(&blocked_delegations_lock);
 624 }
 625
 626 static struct nfs4_delegation *
 627 alloc_init_deleg(struct nfs4_client *clp, struct svc_fh *current_fh)
 628 {
 629         struct nfs4_delegation *dp;
 630         long n;
 631
 632         dprintk("NFSD alloc_init_deleg\n");
 633         n = atomic_long_inc_return(&num_delegations);
 634         if (n < 0 || n > max_delegations)
 635                 goto out_dec;
 636         if (delegation_blocked(&current_fh->fh_handle))
 637                 goto out_dec;
 638         dp = delegstateid(nfs4_alloc_stid(clp, deleg_slab));
 639         if (dp == NULL)
 640                 goto out_dec;
 641
 642         dp->dl_stid.sc_free = nfs4_free_deleg;
 643         /*
 644          * delegation seqid's are never incremented.  The 4.1 special
 645          * meaning of seqid 0 isn't meaningful, really, but let's avoid
 646          * 0 anyway just for consistency and use 1:
 647          */
 648         dp->dl_stid.sc_stateid.si_generation = 1;
 649         INIT_LIST_HEAD(&dp->dl_perfile);
 650         INIT_LIST_HEAD(&dp->dl_perclnt);
 651         INIT_LIST_HEAD(&dp->dl_recall_lru);
 652         dp->dl_type = NFS4_OPEN_DELEGATE_READ;
 653         INIT_WORK(&dp->dl_recall.cb_work, nfsd4_run_cb_recall);
 654         return dp;
 655 out_dec:
 656         atomic_long_dec(&num_delegations);
 657         return NULL;
 658 }
 659
 660 void
 661 nfs4_put_stid(struct nfs4_stid *s)
 662 {
 663         struct nfs4_file *fp = s->sc_file;
 664         struct nfs4_client *clp = s->sc_client;
 665
 666         might_lock(&clp->cl_lock);
 667
 668         if (!atomic_dec_and_lock(&s->sc_count, &clp->cl_lock)) {
 669                 wake_up_all(&close_wq);
 670                 return;
 671         }
 672         idr_remove(&clp->cl_stateids, s->sc_stateid.si_opaque.so_id);
 673         spin_unlock(&clp->cl_lock);
 674         s->sc_free(s);
 675         if (fp)
 676                 put_nfs4_file(fp);
 677 }
 678
 679 static void nfs4_put_deleg_lease(struct nfs4_file *fp)
 680 {
 681         struct file *filp = NULL;
 682
 683         spin_lock(&fp->fi_lock);
 684         if (fp->fi_deleg_file && atomic_dec_and_test(&fp->fi_delegees))
 685                 swap(filp, fp->fi_deleg_file);
 686         spin_unlock(&fp->fi_lock);
 687
 688         if (filp) {
 689                 vfs_setlease(filp, F_UNLCK, NULL, NULL);
 690                 fput(filp);
 691         }
 692 }
 693
 694 static void unhash_stid(struct nfs4_stid *s)
 695 {
 696         s->sc_type = 0;
 697 }
 698
 699 static void
 700 hash_delegation_locked(struct nfs4_delegation *dp, struct nfs4_file *fp)
 701 {
 702         lockdep_assert_held(&state_lock);
 703         lockdep_assert_held(&fp->fi_lock);
 704
 705         atomic_inc(&dp->dl_stid.sc_count);
 706         dp->dl_stid.sc_type = NFS4_DELEG_STID;
 707         list_add(&dp->dl_perfile, &fp->fi_delegations);
 708         list_add(&dp->dl_perclnt, &dp->dl_stid.sc_client->cl_delegations);
 709 }
 710
 711 static void
 712 unhash_delegation_locked(struct nfs4_delegation *dp)
 713 {
 714         struct nfs4_file *fp = dp->dl_stid.sc_file;
 715
 716         lockdep_assert_held(&state_lock);
 717
 718         dp->dl_stid.sc_type = NFS4_CLOSED_DELEG_STID;
 719         /* Ensure that deleg break won't try to requeue it */
 720         ++dp->dl_time;
 721         spin_lock(&fp->fi_lock);
 722         list_del_init(&dp->dl_perclnt);
 723         list_del_init(&dp->dl_recall_lru);
 724         list_del_init(&dp->dl_perfile);
 725         spin_unlock(&fp->fi_lock);
 726 }
 727
 728 static void destroy_delegation(struct nfs4_delegation *dp)
 729 {
 730         spin_lock(&state_lock);
 731         unhash_delegation_locked(dp);
 732         spin_unlock(&state_lock);
 733         nfs4_put_deleg_lease(dp->dl_stid.sc_file);
 734         nfs4_put_stid(&dp->dl_stid);
 735 }
 736
 737 static void revoke_delegation(struct nfs4_delegation *dp)
 738 {
 739         struct nfs4_client *clp = dp->dl_stid.sc_client;
 740
 741         WARN_ON(!list_empty(&dp->dl_recall_lru));
 742
 743         nfs4_put_deleg_lease(dp->dl_stid.sc_file);
 744
 745         if (clp->cl_minorversion == 0)
 746                 nfs4_put_stid(&dp->dl_stid);
 747         else {
 748                 dp->dl_stid.sc_type = NFS4_REVOKED_DELEG_STID;
 749                 spin_lock(&clp->cl_lock);
 750                 list_add(&dp->dl_recall_lru, &clp->cl_revoked);
 751                 spin_unlock(&clp->cl_lock);
 752         }
 753 }
 754
 755 /*
 756  * SETCLIENTID state
 757  */
 758
 759 static unsigned int clientid_hashval(u32 id)
 760 {
 761         return id & CLIENT_HASH_MASK;
 762 }
 763
 764 static unsigned int clientstr_hashval(const char *name)
 765 {
 766         return opaque_hashval(name, 8) & CLIENT_HASH_MASK;
 767 }
 768
 769 /*
 770  * We store the NONE, READ, WRITE, and BOTH bits separately in the
 771  * st_{access,deny}_bmap field of the stateid, in order to track not
 772  * only what share bits are currently in force, but also what
 773  * combinations of share bits previous opens have used.  This allows us
 774  * to enforce the recommendation of rfc 3530 14.2.19 that the server
 775  * return an error if the client attempt to downgrade to a combination
 776  * of share bits not explicable by closing some of its previous opens.
 777  *
 778  * XXX: This enforcement is actually incomplete, since we don't keep
 779  * track of access/deny bit combinations; so, e.g., we allow:
 780  *
 781  *      OPEN allow read, deny write
 782  *      OPEN allow both, deny none
 783  *      DOWNGRADE allow read, deny none
 784  *
 785  * which we should reject.
 786  */
 787 static unsigned int
 788 bmap_to_share_mode(unsigned long bmap) {
 789         int i;
 790         unsigned int access = 0;
 791
 792         for (i = 1; i < 4; i++) {
 793                 if (test_bit(i, &bmap))
 794                         access |= i;
 795         }
 796         return access;
 797 }
 798
 799 /* set share access for a given stateid */
 800 static inline void
 801 set_access(u32 access, struct nfs4_ol_stateid *stp)
 802 {
 803         unsigned char mask = 1 << access;
 804
 805         WARN_ON_ONCE(access > NFS4_SHARE_ACCESS_BOTH);
 806         stp->st_access_bmap |= mask;
 807 }
 808
 809 /* clear share access for a given stateid */
 810 static inline void
 811 clear_access(u32 access, struct nfs4_ol_stateid *stp)
 812 {
 813         unsigned char mask = 1 << access;
 814
 815         WARN_ON_ONCE(access > NFS4_SHARE_ACCESS_BOTH);
 816         stp->st_access_bmap &= ~mask;
 817 }
 818
 819 /* test whether a given stateid has access */
 820 static inline bool
 821 test_access(u32 access, struct nfs4_ol_stateid *stp)
 822 {
 823         unsigned char mask = 1 << access;
 824
 825         return (bool)(stp->st_access_bmap & mask);
 826 }
 827
 828 /* set share deny for a given stateid */
 829 static inline void
 830 set_deny(u32 deny, struct nfs4_ol_stateid *stp)
 831 {
 832         unsigned char mask = 1 << deny;
 833
 834         WARN_ON_ONCE(deny > NFS4_SHARE_DENY_BOTH);
 835         stp->st_deny_bmap |= mask;
 836 }
 837
 838 /* clear share deny for a given stateid */
 839 static inline void
 840 clear_deny(u32 deny, struct nfs4_ol_stateid *stp)
 841 {
 842         unsigned char mask = 1 << deny;
 843
 844         WARN_ON_ONCE(deny > NFS4_SHARE_DENY_BOTH);
 845         stp->st_deny_bmap &= ~mask;
 846 }
 847
 848 /* test whether a given stateid is denying specific access */
 849 static inline bool
 850 test_deny(u32 deny, struct nfs4_ol_stateid *stp)
 851 {
 852         unsigned char mask = 1 << deny;
 853
 854         return (bool)(stp->st_deny_bmap & mask);
 855 }
 856
 857 static int nfs4_access_to_omode(u32 access)
 858 {
 859         switch (access & NFS4_SHARE_ACCESS_BOTH) {
 860         case NFS4_SHARE_ACCESS_READ:
 861                 return O_RDONLY;
 862         case NFS4_SHARE_ACCESS_WRITE:
 863                 return O_WRONLY;
 864         case NFS4_SHARE_ACCESS_BOTH:
 865                 return O_RDWR;
 866         }
 867         WARN_ON_ONCE(1);
 868         return O_RDONLY;
 869 }
 870
 871 /*
 872  * A stateid that had a deny mode associated with it is being released
 873  * or downgraded. Recalculate the deny mode on the file.
 874  */
 875 static void
 876 recalculate_deny_mode(struct nfs4_file *fp)
 877 {
 878         struct nfs4_ol_stateid *stp;
 879
 880         spin_lock(&fp->fi_lock);
 881         fp->fi_share_deny = 0;
 882         list_for_each_entry(stp, &fp->fi_stateids, st_perfile)
 883                 fp->fi_share_deny |= bmap_to_share_mode(stp->st_deny_bmap);
 884         spin_unlock(&fp->fi_lock);
 885 }
 886
 887 static void
 888 reset_union_bmap_deny(u32 deny, struct nfs4_ol_stateid *stp)
 889 {
 890         int i;
 891         bool change = false;
 892
 893         for (i = 1; i < 4; i++) {
 894                 if ((i & deny) != i) {
 895                         change = true;
 896                         clear_deny(i, stp);
 897                 }
 898         }
 899
 900         /* Recalculate per-file deny mode if there was a change */
 901         if (change)
 902                 recalculate_deny_mode(stp->st_stid.sc_file);
 903 }
 904
 905 /* release all access and file references for a given stateid */
 906 static void
 907 release_all_access(struct nfs4_ol_stateid *stp)
 908 {
 909         int i;
 910         struct nfs4_file *fp = stp->st_stid.sc_file;
 911
 912         if (fp && stp->st_deny_bmap != 0)
 913                 recalculate_deny_mode(fp);
 914
 915         for (i = 1; i < 4; i++) {
 916                 if (test_access(i, stp))
 917                         nfs4_file_put_access(stp->st_stid.sc_file, i);
 918                 clear_access(i, stp);
 919         }
 920 }
 921
 922 static void nfs4_put_stateowner(struct nfs4_stateowner *sop)
 923 {
 924         struct nfs4_client *clp = sop->so_client;
 925
 926         might_lock(&clp->cl_lock);
 927
 928         if (!atomic_dec_and_lock(&sop->so_count, &clp->cl_lock))
 929                 return;
 930         sop->so_ops->so_unhash(sop);
 931         spin_unlock(&clp->cl_lock);
 932         kfree(sop->so_owner.data);
 933         sop->so_ops->so_free(sop);
 934 }
 935
 936 static void unhash_ol_stateid(struct nfs4_ol_stateid *stp)
 937 {
 938         struct nfs4_file *fp = stp->st_stid.sc_file;
 939
 940         lockdep_assert_held(&stp->st_stateowner->so_client->cl_lock);
 941
 942         spin_lock(&fp->fi_lock);
 943         list_del(&stp->st_perfile);
 944         spin_unlock(&fp->fi_lock);
 945         list_del(&stp->st_perstateowner);
 946 }
 947
 948 static void nfs4_free_ol_stateid(struct nfs4_stid *stid)
 949 {
 950         struct nfs4_ol_stateid *stp = openlockstateid(stid);
 951
 952         release_all_access(stp);
 953         if (stp->st_stateowner)
 954                 nfs4_put_stateowner(stp->st_stateowner);
 955         kmem_cache_free(stateid_slab, stid);
 956 }
 957
 958 static void nfs4_free_lock_stateid(struct nfs4_stid *stid)
 959 {
 960         struct nfs4_ol_stateid *stp = openlockstateid(stid);
 961         struct nfs4_lockowner *lo = lockowner(stp->st_stateowner);
 962         struct file *file;
 963
 964         file = find_any_file(stp->st_stid.sc_file);
 965         if (file)
 966                 filp_close(file, (fl_owner_t)lo);
 967         nfs4_free_ol_stateid(stid);
 968 }
 969
 970 /*
 971  * Put the persistent reference to an already unhashed generic stateid, while
 972  * holding the cl_lock. If it's the last reference, then put it onto the
 973  * reaplist for later destruction.
 974  */
 975 static void put_ol_stateid_locked(struct nfs4_ol_stateid *stp,
 976                                        struct list_head *reaplist)
 977 {
 978         struct nfs4_stid *s = &stp->st_stid;
 979         struct nfs4_client *clp = s->sc_client;
 980
 981         lockdep_assert_held(&clp->cl_lock);
 982
 983         WARN_ON_ONCE(!list_empty(&stp->st_locks));
 984
 985         if (!atomic_dec_and_test(&s->sc_count)) {
 986                 wake_up_all(&close_wq);
 987                 return;
 988         }
 989
 990         idr_remove(&clp->cl_stateids, s->sc_stateid.si_opaque.so_id);
 991         list_add(&stp->st_locks, reaplist);
 992 }
 993
 994 static void unhash_lock_stateid(struct nfs4_ol_stateid *stp)
 995 {
 996         struct nfs4_openowner *oo = openowner(stp->st_openstp->st_stateowner);
 997
 998         lockdep_assert_held(&oo->oo_owner.so_client->cl_lock);
 999
1000         list_del_init(&stp->st_locks);
1001         unhash_ol_stateid(stp);
1002         unhash_stid(&stp->st_stid);
1003 }
1004
1005 static void release_lock_stateid(struct nfs4_ol_stateid *stp)
1006 {
1007         struct nfs4_openowner *oo = openowner(stp->st_openstp->st_stateowner);
1008
1009         spin_lock(&oo->oo_owner.so_client->cl_lock);
1010         unhash_lock_stateid(stp);
1011         spin_unlock(&oo->oo_owner.so_client->cl_lock);
1012         nfs4_put_stid(&stp->st_stid);
1013 }
1014
1015 static void unhash_lockowner_locked(struct nfs4_lockowner *lo)
1016 {
1017         struct nfs4_client *clp = lo->lo_owner.so_client;
1018
1019         lockdep_assert_held(&clp->cl_lock);
1020
1021         list_del_init(&lo->lo_owner.so_strhash);
1022 }
1023
1024 /*
1025  * Free a list of generic stateids that were collected earlier after being
1026  * fully unhashed.
1027  */
1028 static void
1029 free_ol_stateid_reaplist(struct list_head *reaplist)
1030 {
1031         struct nfs4_ol_stateid *stp;
1032         struct nfs4_file *fp;
1033
1034         might_sleep();
1035
1036         while (!list_empty(reaplist)) {
1037                 stp = list_first_entry(reaplist, struct nfs4_ol_stateid,
1038                                        st_locks);
1039                 list_del(&stp->st_locks);
1040                 fp = stp->st_stid.sc_file;
1041                 stp->st_stid.sc_free(&stp->st_stid);
1042                 if (fp)
1043                         put_nfs4_file(fp);
1044         }
1045 }
1046
1047 static void release_lockowner(struct nfs4_lockowner *lo)
1048 {
1049         struct nfs4_client *clp = lo->lo_owner.so_client;
1050         struct nfs4_ol_stateid *stp;
1051         struct list_head reaplist;
1052
1053         INIT_LIST_HEAD(&reaplist);
1054
1055         spin_lock(&clp->cl_lock);
1056         unhash_lockowner_locked(lo);
1057         while (!list_empty(&lo->lo_owner.so_stateids)) {
1058                 stp = list_first_entry(&lo->lo_owner.so_stateids,
1059                                 struct nfs4_ol_stateid, st_perstateowner);
1060                 unhash_lock_stateid(stp);
1061                 put_ol_stateid_locked(stp, &reaplist);
1062         }
1063         spin_unlock(&clp->cl_lock);
1064         free_ol_stateid_reaplist(&reaplist);
1065         nfs4_put_stateowner(&lo->lo_owner);
1066 }
1067
1068 static void release_open_stateid_locks(struct nfs4_ol_stateid *open_stp,
1069                                        struct list_head *reaplist)
1070 {
1071         struct nfs4_ol_stateid *stp;
1072
1073         while (!list_empty(&open_stp->st_locks)) {
1074                 stp = list_entry(open_stp->st_locks.next,
1075                                 struct nfs4_ol_stateid, st_locks);
1076                 unhash_lock_stateid(stp);
1077                 put_ol_stateid_locked(stp, reaplist);
1078         }
1079 }
1080
1081 static void unhash_open_stateid(struct nfs4_ol_stateid *stp,
1082                                 struct list_head *reaplist)
1083 {
1084         lockdep_assert_held(&stp->st_stid.sc_client->cl_lock);
1085
1086         unhash_ol_stateid(stp);
1087         release_open_stateid_locks(stp, reaplist);
1088 }
1089
1090 static void release_open_stateid(struct nfs4_ol_stateid *stp)
1091 {
1092         LIST_HEAD(reaplist);
1093
1094         spin_lock(&stp->st_stid.sc_client->cl_lock);
1095         unhash_open_stateid(stp, &reaplist);
1096         put_ol_stateid_locked(stp, &reaplist);
1097         spin_unlock(&stp->st_stid.sc_client->cl_lock);
1098         free_ol_stateid_reaplist(&reaplist);
1099 }
1100
1101 static void unhash_openowner_locked(struct nfs4_openowner *oo)
1102 {
1103         struct nfs4_client *clp = oo->oo_owner.so_client;
1104
1105         lockdep_assert_held(&clp->cl_lock);
1106
1107         list_del_init(&oo->oo_owner.so_strhash);
1108         list_del_init(&oo->oo_perclient);
1109 }
1110
1111 static void release_last_closed_stateid(struct nfs4_openowner *oo)
1112 {
1113         struct nfsd_net *nn = net_generic(oo->oo_owner.so_client->net,
1114                                           nfsd_net_id);
1115         struct nfs4_ol_stateid *s;
1116
1117         spin_lock(&nn->client_lock);
1118         s = oo->oo_last_closed_stid;
1119         if (s) {
1120                 list_del_init(&oo->oo_close_lru);
1121                 oo->oo_last_closed_stid = NULL;
1122         }
1123         spin_unlock(&nn->client_lock);
1124         if (s)
1125                 nfs4_put_stid(&s->st_stid);
1126 }
1127
1128 static void release_openowner(struct nfs4_openowner *oo)
1129 {
1130         struct nfs4_ol_stateid *stp;
1131         struct nfs4_client *clp = oo->oo_owner.so_client;
1132         struct list_head reaplist;
1133
1134         INIT_LIST_HEAD(&reaplist);
1135
1136         spin_lock(&clp->cl_lock);
1137         unhash_openowner_locked(oo);
1138         while (!list_empty(&oo->oo_owner.so_stateids)) {
1139                 stp = list_first_entry(&oo->oo_owner.so_stateids,
1140                                 struct nfs4_ol_stateid, st_perstateowner);
1141                 unhash_open_stateid(stp, &reaplist);
1142                 put_ol_stateid_locked(stp, &reaplist);
1143         }
1144         spin_unlock(&clp->cl_lock);
1145         free_ol_stateid_reaplist(&reaplist);
1146         release_last_closed_stateid(oo);
1147         nfs4_put_stateowner(&oo->oo_owner);
1148 }
1149
1150 static inline int
1151 hash_sessionid(struct nfs4_sessionid *sessionid)
1152 {
1153         struct nfsd4_sessionid *sid = (struct nfsd4_sessionid *)sessionid;
1154
1155         return sid->sequence % SESSION_HASH_SIZE;
1156 }
1157
1158 #ifdef NFSD_DEBUG
1159 static inline void
1160 dump_sessionid(const char *fn, struct nfs4_sessionid *sessionid)
1161 {
1162         u32 *ptr = (u32 *)(&sessionid->data[0]);
1163         dprintk("%s: %u:%u:%u:%u\n", fn, ptr[0], ptr[1], ptr[2], ptr[3]);
1164 }
1165 #else
1166 static inline void
1167 dump_sessionid(const char *fn, struct nfs4_sessionid *sessionid)
1168 {
1169 }
1170 #endif
1171
1172 /*
1173  * Bump the seqid on cstate->replay_owner, and clear replay_owner if it
1174  * won't be used for replay.
1175  */
1176 void nfsd4_bump_seqid(struct nfsd4_compound_state *cstate, __be32 nfserr)
1177 {
1178         struct nfs4_stateowner *so = cstate->replay_owner;
1179
1180         if (nfserr == nfserr_replay_me)
1181                 return;
1182
1183         if (!seqid_mutating_err(ntohl(nfserr))) {
1184                 nfsd4_cstate_clear_replay(cstate);
1185                 return;
1186         }
1187         if (!so)
1188                 return;
1189         if (so->so_is_open_owner)
1190                 release_last_closed_stateid(openowner(so));
1191         so->so_seqid++;
1192         return;
1193 }
1194
1195 static void
1196 gen_sessionid(struct nfsd4_session *ses)
1197 {
1198         struct nfs4_client *clp = ses->se_client;
1199         struct nfsd4_sessionid *sid;
1200
1201         sid = (struct nfsd4_sessionid *)ses->se_sessionid.data;
1202         sid->clientid = clp->cl_clientid;
1203         sid->sequence = current_sessionid++;
1204         sid->reserved = 0;
1205 }
1206
1207 /*
1208  * The protocol defines ca_maxresponssize_cached to include the size of
1209  * the rpc header, but all we need to cache is the data starting after
1210  * the end of the initial SEQUENCE operation--the rest we regenerate
1211  * each time.  Therefore we can advertise a ca_maxresponssize_cached
1212  * value that is the number of bytes in our cache plus a few additional
1213  * bytes.  In order to stay on the safe side, and not promise more than
1214  * we can cache, those additional bytes must be the minimum possible: 24
1215  * bytes of rpc header (xid through accept state, with AUTH_NULL
1216  * verifier), 12 for the compound header (with zero-length tag), and 44
1217  * for the SEQUENCE op response:
1218  */
1219 #define NFSD_MIN_HDR_SEQ_SZ  (24 + 12 + 44)
1220
1221 static void
1222 free_session_slots(struct nfsd4_session *ses)
1223 {
1224         int i;
1225
1226         for (i = 0; i < ses->se_fchannel.maxreqs; i++)
1227                 kfree(ses->se_slots[i]);
1228 }
1229
1230 /*
1231  * We don't actually need to cache the rpc and session headers, so we
1232  * can allocate a little less for each slot:
1233  */
1234 static inline u32 slot_bytes(struct nfsd4_channel_attrs *ca)
1235 {
1236         u32 size;
1237
1238         if (ca->maxresp_cached < NFSD_MIN_HDR_SEQ_SZ)
1239                 size = 0;
1240         else
1241                 size = ca->maxresp_cached - NFSD_MIN_HDR_SEQ_SZ;
1242         return size + sizeof(struct nfsd4_slot);
1243 }
1244
1245 /*
1246  * XXX: If we run out of reserved DRC memory we could (up to a point)
1247  * re-negotiate active sessions and reduce their slot usage to make
1248  * room for new connections. For now we just fail the create session.
1249  */
1250 static u32 nfsd4_get_drc_mem(struct nfsd4_channel_attrs *ca)
1251 {
1252         u32 slotsize = slot_bytes(ca);
1253         u32 num = ca->maxreqs;
1254         int avail;
1255
1256         spin_lock(&nfsd_drc_lock);
1257         avail = min((unsigned long)NFSD_MAX_MEM_PER_SESSION,
1258                     nfsd_drc_max_mem - nfsd_drc_mem_used);
1259         num = min_t(int, num, avail / slotsize);
1260         nfsd_drc_mem_used += num * slotsize;
1261         spin_unlock(&nfsd_drc_lock);
1262
1263         return num;
1264 }
1265
1266 static void nfsd4_put_drc_mem(struct nfsd4_channel_attrs *ca)
1267 {
1268         int slotsize = slot_bytes(ca);
1269
1270         spin_lock(&nfsd_drc_lock);
1271         nfsd_drc_mem_used -= slotsize * ca->maxreqs;
1272         spin_unlock(&nfsd_drc_lock);
1273 }
1274
1275 static struct nfsd4_session *alloc_session(struct nfsd4_channel_attrs *fattrs,
1276                                            struct nfsd4_channel_attrs *battrs)
1277 {
1278         int numslots = fattrs->maxreqs;
1279         int slotsize = slot_bytes(fattrs);
1280         struct nfsd4_session *new;
1281         int mem, i;
1282
1283         BUILD_BUG_ON(NFSD_MAX_SLOTS_PER_SESSION * sizeof(struct nfsd4_slot *)
1284                         + sizeof(struct nfsd4_session) > PAGE_SIZE);
1285         mem = numslots * sizeof(struct nfsd4_slot *);
1286
1287         new = kzalloc(sizeof(*new) + mem, GFP_KERNEL);
1288         if (!new)
1289                 return NULL;
1290         /* allocate each struct nfsd4_slot and data cache in one piece */
1291         for (i = 0; i < numslots; i++) {
1292                 new->se_slots[i] = kzalloc(slotsize, GFP_KERNEL);
1293                 if (!new->se_slots[i])
1294                         goto out_free;
1295         }
1296
1297         memcpy(&new->se_fchannel, fattrs, sizeof(struct nfsd4_channel_attrs));
1298         memcpy(&new->se_bchannel, battrs, sizeof(struct nfsd4_channel_attrs));
1299
1300         return new;
1301 out_free:
1302         while (i--)
1303                 kfree(new->se_slots[i]);
1304         kfree(new);
1305         return NULL;
1306 }
1307
1308 static void free_conn(struct nfsd4_conn *c)
1309 {
1310         svc_xprt_put(c->cn_xprt);
1311         kfree(c);
1312 }
1313
1314 static void nfsd4_conn_lost(struct svc_xpt_user *u)
1315 {
1316         struct nfsd4_conn *c = container_of(u, struct nfsd4_conn, cn_xpt_user);
1317         struct nfs4_client *clp = c->cn_session->se_client;
1318
1319         spin_lock(&clp->cl_lock);
1320         if (!list_empty(&c->cn_persession)) {
1321                 list_del(&c->cn_persession);
1322                 free_conn(c);
1323         }
1324         nfsd4_probe_callback(clp);
1325         spin_unlock(&clp->cl_lock);
1326 }
1327
1328 static struct nfsd4_conn *alloc_conn(struct svc_rqst *rqstp, u32 flags)
1329 {
1330         struct nfsd4_conn *conn;
1331
1332         conn = kmalloc(sizeof(struct nfsd4_conn), GFP_KERNEL);
1333         if (!conn)
1334                 return NULL;
1335         svc_xprt_get(rqstp->rq_xprt);
1336         conn->cn_xprt = rqstp->rq_xprt;
1337         conn->cn_flags = flags;
1338         INIT_LIST_HEAD(&conn->cn_xpt_user.list);
1339         return conn;
1340 }
1341
1342 static void __nfsd4_hash_conn(struct nfsd4_conn *conn, struct nfsd4_session *ses)
1343 {
1344         conn->cn_session = ses;
1345         list_add(&conn->cn_persession, &ses->se_conns);
1346 }
1347
1348 static void nfsd4_hash_conn(struct nfsd4_conn *conn, struct nfsd4_session *ses)
1349 {
1350         struct nfs4_client *clp = ses->se_client;
1351
1352         spin_lock(&clp->cl_lock);
1353         __nfsd4_hash_conn(conn, ses);
1354         spin_unlock(&clp->cl_lock);
1355 }
1356
1357 static int nfsd4_register_conn(struct nfsd4_conn *conn)
1358 {
1359         conn->cn_xpt_user.callback = nfsd4_conn_lost;
1360         return register_xpt_user(conn->cn_xprt, &conn->cn_xpt_user);
1361 }
1362
1363 static void nfsd4_init_conn(struct svc_rqst *rqstp, struct nfsd4_conn *conn, struct nfsd4_session *ses)
1364 {
1365         int ret;
1366
1367         nfsd4_hash_conn(conn, ses);
1368         ret = nfsd4_register_conn(conn);
1369         if (ret)
1370                 /* oops; xprt is already down: */
1371                 nfsd4_conn_lost(&conn->cn_xpt_user);
1372         /* We may have gained or lost a callback channel: */
1373         nfsd4_probe_callback_sync(ses->se_client);
1374 }
1375
1376 static struct nfsd4_conn *alloc_conn_from_crses(struct svc_rqst *rqstp, struct nfsd4_create_session *cses)
1377 {
1378         u32 dir = NFS4_CDFC4_FORE;
1379
1380         if (cses->flags & SESSION4_BACK_CHAN)
1381                 dir |= NFS4_CDFC4_BACK;
1382         return alloc_conn(rqstp, dir);
1383 }
1384
1385 /* must be called under client_lock */
1386 static void nfsd4_del_conns(struct nfsd4_session *s)
1387 {
1388         struct nfs4_client *clp = s->se_client;
1389         struct nfsd4_conn *c;
1390
1391         spin_lock(&clp->cl_lock);
1392         while (!list_empty(&s->se_conns)) {
1393                 c = list_first_entry(&s->se_conns, struct nfsd4_conn, cn_persession);
1394                 list_del_init(&c->cn_persession);
1395                 spin_unlock(&clp->cl_lock);
1396
1397                 unregister_xpt_user(c->cn_xprt, &c->cn_xpt_user);
1398                 free_conn(c);
1399
1400                 spin_lock(&clp->cl_lock);
1401         }
1402         spin_unlock(&clp->cl_lock);
1403 }
1404
1405 static void __free_session(struct nfsd4_session *ses)
1406 {
1407         free_session_slots(ses);
1408         kfree(ses);
1409 }
1410
1411 static void free_session(struct nfsd4_session *ses)
1412 {
1413         nfsd4_del_conns(ses);
1414         nfsd4_put_drc_mem(&ses->se_fchannel);
1415         __free_session(ses);
1416 }
1417
1418 static void init_session(struct svc_rqst *rqstp, struct nfsd4_session *new, struct nfs4_client *clp, struct nfsd4_create_session *cses)
1419 {
1420         int idx;
1421         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
1422
1423         new->se_client = clp;
1424         gen_sessionid(new);
1425
1426         INIT_LIST_HEAD(&new->se_conns);
1427
1428         new->se_cb_seq_nr = 1;
1429         new->se_flags = cses->flags;
1430         new->se_cb_prog = cses->callback_prog;
1431         new->se_cb_sec = cses->cb_sec;
1432         atomic_set(&new->se_ref, 0);
1433         idx = hash_sessionid(&new->se_sessionid);
1434         list_add(&new->se_hash, &nn->sessionid_hashtbl[idx]);
1435         spin_lock(&clp->cl_lock);
1436         list_add(&new->se_perclnt, &clp->cl_sessions);
1437         spin_unlock(&clp->cl_lock);
1438
1439         if (cses->flags & SESSION4_BACK_CHAN) {
1440                 struct sockaddr *sa = svc_addr(rqstp);
1441                 /*
1442                  * This is a little silly; with sessions there's no real
1443                  * use for the callback address.  Use the peer address
1444                  * as a reasonable default for now, but consider fixing
1445                  * the rpc client not to require an address in the
1446                  * future:
1447                  */
1448                 rpc_copy_addr((struct sockaddr *)&clp->cl_cb_conn.cb_addr, sa);
1449                 clp->cl_cb_conn.cb_addrlen = svc_addr_len(sa);
1450         }
1451 }
1452
1453 /* caller must hold client_lock */
1454 static struct nfsd4_session *
1455 __find_in_sessionid_hashtbl(struct nfs4_sessionid *sessionid, struct net *net)
1456 {
1457         struct nfsd4_session *elem;
1458         int idx;
1459         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
1460
1461         lockdep_assert_held(&nn->client_lock);
1462
1463         dump_sessionid(__func__, sessionid);
1464         idx = hash_sessionid(sessionid);
1465         /* Search in the appropriate list */
1466         list_for_each_entry(elem, &nn->sessionid_hashtbl[idx], se_hash) {
1467                 if (!memcmp(elem->se_sessionid.data, sessionid->data,
1468                             NFS4_MAX_SESSIONID_LEN)) {
1469                         return elem;
1470                 }
1471         }
1472
1473         dprintk("%s: session not found\n", __func__);
1474         return NULL;
1475 }
1476
1477 static struct nfsd4_session *
1478 find_in_sessionid_hashtbl(struct nfs4_sessionid *sessionid, struct net *net,
1479                 __be32 *ret)
1480 {
1481         struct nfsd4_session *session;
1482         __be32 status = nfserr_badsession;
1483
1484         session = __find_in_sessionid_hashtbl(sessionid, net);
1485         if (!session)
1486                 goto out;
1487         status = nfsd4_get_session_locked(session);
1488         if (status)
1489                 session = NULL;
1490 out:
1491         *ret = status;
1492         return session;
1493 }
1494
1495 /* caller must hold client_lock */
1496 static void
1497 unhash_session(struct nfsd4_session *ses)
1498 {
1499         struct nfs4_client *clp = ses->se_client;
1500         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
1501
1502         lockdep_assert_held(&nn->client_lock);
1503
1504         list_del(&ses->se_hash);
1505         spin_lock(&ses->se_client->cl_lock);
1506         list_del(&ses->se_perclnt);
1507         spin_unlock(&ses->se_client->cl_lock);
1508 }
1509
1510 /* SETCLIENTID and SETCLIENTID_CONFIRM Helper functions */
1511 static int
1512 STALE_CLIENTID(clientid_t *clid, struct nfsd_net *nn)
1513 {
1514         if (clid->cl_boot == nn->boot_time)
1515                 return 0;
1516         dprintk("NFSD stale clientid (%08x/%08x) boot_time %08lx\n",
1517                 clid->cl_boot, clid->cl_id, nn->boot_time);
1518         return 1;
1519 }
1520
1521 /*
1522  * XXX Should we use a slab cache ?
1523  * This type of memory management is somewhat inefficient, but we use it
1524  * anyway since SETCLIENTID is not a common operation.
1525  */
1526 static struct nfs4_client *alloc_client(struct xdr_netobj name)
1527 {
1528         struct nfs4_client *clp;
1529         int i;
1530
1531         clp = kzalloc(sizeof(struct nfs4_client), GFP_KERNEL);
1532         if (clp == NULL)
1533                 return NULL;
1534         clp->cl_name.data = kmemdup(name.data, name.len, GFP_KERNEL);
1535         if (clp->cl_name.data == NULL)
1536                 goto err_no_name;
1537         clp->cl_ownerstr_hashtbl = kmalloc(sizeof(struct list_head) *
1538                         OWNER_HASH_SIZE, GFP_KERNEL);
1539         if (!clp->cl_ownerstr_hashtbl)
1540                 goto err_no_hashtbl;
1541         for (i = 0; i < OWNER_HASH_SIZE; i++)
1542                 INIT_LIST_HEAD(&clp->cl_ownerstr_hashtbl[i]);
1543         clp->cl_name.len = name.len;
1544         INIT_LIST_HEAD(&clp->cl_sessions);
1545         idr_init(&clp->cl_stateids);
1546         atomic_set(&clp->cl_refcount, 0);
1547         clp->cl_cb_state = NFSD4_CB_UNKNOWN;
1548         INIT_LIST_HEAD(&clp->cl_idhash);
1549         INIT_LIST_HEAD(&clp->cl_openowners);
1550         INIT_LIST_HEAD(&clp->cl_delegations);
1551         INIT_LIST_HEAD(&clp->cl_lru);
1552         INIT_LIST_HEAD(&clp->cl_callbacks);
1553         INIT_LIST_HEAD(&clp->cl_revoked);
1554         spin_lock_init(&clp->cl_lock);
1555         rpc_init_wait_queue(&clp->cl_cb_waitq, "Backchannel slot table");
1556         return clp;
1557 err_no_hashtbl:
1558         kfree(clp->cl_name.data);
1559 err_no_name:
1560         kfree(clp);
1561         return NULL;
1562 }
1563
1564 static void
1565 free_client(struct nfs4_client *clp)
1566 {
1567         while (!list_empty(&clp->cl_sessions)) {
1568                 struct nfsd4_session *ses;
1569                 ses = list_entry(clp->cl_sessions.next, struct nfsd4_session,
1570                                 se_perclnt);
1571                 list_del(&ses->se_perclnt);
1572                 WARN_ON_ONCE(atomic_read(&ses->se_ref));
1573                 free_session(ses);
1574         }
1575         rpc_destroy_wait_queue(&clp->cl_cb_waitq);
1576         free_svc_cred(&clp->cl_cred);
1577         kfree(clp->cl_ownerstr_hashtbl);
1578         kfree(clp->cl_name.data);
1579         idr_destroy(&clp->cl_stateids);
1580         kfree(clp);
1581 }
1582
1583 /* must be called under the client_lock */
1584 static void
1585 unhash_client_locked(struct nfs4_client *clp)
1586 {
1587         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
1588         struct nfsd4_session *ses;
1589
1590         lockdep_assert_held(&nn->client_lock);
1591
1592         /* Mark the client as expired! */
1593         clp->cl_time = 0;
1594         /* Make it invisible */
1595         if (!list_empty(&clp->cl_idhash)) {
1596                 list_del_init(&clp->cl_idhash);
1597                 if (test_bit(NFSD4_CLIENT_CONFIRMED, &clp->cl_flags))
1598                         rb_erase(&clp->cl_namenode, &nn->conf_name_tree);
1599                 else
1600                         rb_erase(&clp->cl_namenode, &nn->unconf_name_tree);
1601         }
1602         list_del_init(&clp->cl_lru);
1603         spin_lock(&clp->cl_lock);
1604         list_for_each_entry(ses, &clp->cl_sessions, se_perclnt)
1605                 list_del_init(&ses->se_hash);
1606         spin_unlock(&clp->cl_lock);
1607 }
1608
1609 static void
1610 unhash_client(struct nfs4_client *clp)
1611 {
1612         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
1613
1614         spin_lock(&nn->client_lock);
1615         unhash_client_locked(clp);
1616         spin_unlock(&nn->client_lock);
1617 }
1618
1619 static __be32 mark_client_expired_locked(struct nfs4_client *clp)
1620 {
1621         if (atomic_read(&clp->cl_refcount))
1622                 return nfserr_jukebox;
1623         unhash_client_locked(clp);
1624         return nfs_ok;
1625 }
1626
1627 static void
1628 __destroy_client(struct nfs4_client *clp)
1629 {
1630         struct nfs4_openowner *oo;
1631         struct nfs4_delegation *dp;
1632         struct list_head reaplist;
1633
1634         INIT_LIST_HEAD(&reaplist);
1635         spin_lock(&state_lock);
1636         while (!list_empty(&clp->cl_delegations)) {
1637                 dp = list_entry(clp->cl_delegations.next, struct nfs4_delegation, dl_perclnt);
1638                 unhash_delegation_locked(dp);
1639                 list_add(&dp->dl_recall_lru, &reaplist);
1640         }
1641         spin_unlock(&state_lock);
1642         while (!list_empty(&reaplist)) {
1643                 dp = list_entry(reaplist.next, struct nfs4_delegation, dl_recall_lru);
1644                 list_del_init(&dp->dl_recall_lru);
1645                 nfs4_put_deleg_lease(dp->dl_stid.sc_file);
1646                 nfs4_put_stid(&dp->dl_stid);
1647         }
1648         while (!list_empty(&clp->cl_revoked)) {
1649                 dp = list_entry(reaplist.next, struct nfs4_delegation, dl_recall_lru);
1650                 list_del_init(&dp->dl_recall_lru);
1651                 nfs4_put_stid(&dp->dl_stid);
1652         }
1653         while (!list_empty(&clp->cl_openowners)) {
1654                 oo = list_entry(clp->cl_openowners.next, struct nfs4_openowner, oo_perclient);
1655                 nfs4_get_stateowner(&oo->oo_owner);
1656                 release_openowner(oo);
1657         }
1658         nfsd4_shutdown_callback(clp);
1659         if (clp->cl_cb_conn.cb_xprt)
1660                 svc_xprt_put(clp->cl_cb_conn.cb_xprt);
1661         free_client(clp);
1662 }
1663
1664 static void
1665 destroy_client(struct nfs4_client *clp)
1666 {
1667         unhash_client(clp);
1668         __destroy_client(clp);
1669 }
1670
1671 static void expire_client(struct nfs4_client *clp)
1672 {
1673         unhash_client(clp);
1674         nfsd4_client_record_remove(clp);
1675         __destroy_client(clp);
1676 }
1677
1678 static void copy_verf(struct nfs4_client *target, nfs4_verifier *source)
1679 {
1680         memcpy(target->cl_verifier.data, source->data,
1681                         sizeof(target->cl_verifier.data));
1682 }
1683
1684 static void copy_clid(struct nfs4_client *target, struct nfs4_client *source)
1685 {
1686         target->cl_clientid.cl_boot = source->cl_clientid.cl_boot;
1687         target->cl_clientid.cl_id = source->cl_clientid.cl_id;
1688 }
1689
1690 static int copy_cred(struct svc_cred *target, struct svc_cred *source)
1691 {
1692         if (source->cr_principal) {
1693                 target->cr_principal =
1694                                 kstrdup(source->cr_principal, GFP_KERNEL);
1695                 if (target->cr_principal == NULL)
1696                         return -ENOMEM;
1697         } else
1698                 target->cr_principal = NULL;
1699         target->cr_flavor = source->cr_flavor;
1700         target->cr_uid = source->cr_uid;
1701         target->cr_gid = source->cr_gid;
1702         target->cr_group_info = source->cr_group_info;
1703         get_group_info(target->cr_group_info);
1704         target->cr_gss_mech = source->cr_gss_mech;
1705         if (source->cr_gss_mech)
1706                 gss_mech_get(source->cr_gss_mech);
1707         return 0;
1708 }
1709
1710 static long long
1711 compare_blob(const struct xdr_netobj *o1, const struct xdr_netobj *o2)
1712 {
1713         long long res;
1714
1715         res = o1->len - o2->len;
1716         if (res)
1717                 return res;
1718         return (long long)memcmp(o1->data, o2->data, o1->len);
1719 }
1720
1721 static int same_name(const char *n1, const char *n2)
1722 {
1723         return 0 == memcmp(n1, n2, HEXDIR_LEN);
1724 }
1725
1726 static int
1727 same_verf(nfs4_verifier *v1, nfs4_verifier *v2)
1728 {
1729         return 0 == memcmp(v1->data, v2->data, sizeof(v1->data));
1730 }
1731
1732 static int
1733 same_clid(clientid_t *cl1, clientid_t *cl2)
1734 {
1735         return (cl1->cl_boot == cl2->cl_boot) && (cl1->cl_id == cl2->cl_id);
1736 }
1737
1738 static bool groups_equal(struct group_info *g1, struct group_info *g2)
1739 {
1740         int i;
1741
1742         if (g1->ngroups != g2->ngroups)
1743                 return false;
1744         for (i=0; i<g1->ngroups; i++)
1745                 if (!gid_eq(GROUP_AT(g1, i), GROUP_AT(g2, i)))
1746                         return false;
1747         return true;
1748 }
1749
1750 /*
1751  * RFC 3530 language requires clid_inuse be returned when the
1752  * "principal" associated with a requests differs from that previously
1753  * used.  We use uid, gid's, and gss principal string as our best
1754  * approximation.  We also don't want to allow non-gss use of a client
1755  * established using gss: in theory cr_principal should catch that
1756  * change, but in practice cr_principal can be null even in the gss case
1757  * since gssd doesn't always pass down a principal string.
1758  */
1759 static bool is_gss_cred(struct svc_cred *cr)
1760 {
1761         /* Is cr_flavor one of the gss "pseudoflavors"?: */
1762         return (cr->cr_flavor > RPC_AUTH_MAXFLAVOR);
1763 }
1764
1765
1766 static bool
1767 same_creds(struct svc_cred *cr1, struct svc_cred *cr2)
1768 {
1769         if ((is_gss_cred(cr1) != is_gss_cred(cr2))
1770                 || (!uid_eq(cr1->cr_uid, cr2->cr_uid))
1771                 || (!gid_eq(cr1->cr_gid, cr2->cr_gid))
1772                 || !groups_equal(cr1->cr_group_info, cr2->cr_group_info))
1773                 return false;
1774         if (cr1->cr_principal == cr2->cr_principal)
1775                 return true;
1776         if (!cr1->cr_principal || !cr2->cr_principal)
1777                 return false;
1778         return 0 == strcmp(cr1->cr_principal, cr2->cr_principal);
1779 }
1780
1781 static bool svc_rqst_integrity_protected(struct svc_rqst *rqstp)
1782 {
1783         struct svc_cred *cr = &rqstp->rq_cred;
1784         u32 service;
1785
1786         if (!cr->cr_gss_mech)
1787                 return false;
1788         service = gss_pseudoflavor_to_service(cr->cr_gss_mech, cr->cr_flavor);
1789         return service == RPC_GSS_SVC_INTEGRITY ||
1790                service == RPC_GSS_SVC_PRIVACY;
1791 }
1792
1793 static bool mach_creds_match(struct nfs4_client *cl, struct svc_rqst *rqstp)
1794 {
1795         struct svc_cred *cr = &rqstp->rq_cred;
1796
1797         if (!cl->cl_mach_cred)
1798                 return true;
1799         if (cl->cl_cred.cr_gss_mech != cr->cr_gss_mech)
1800                 return false;
1801         if (!svc_rqst_integrity_protected(rqstp))
1802                 return false;
1803         if (!cr->cr_principal)
1804                 return false;
1805         return 0 == strcmp(cl->cl_cred.cr_principal, cr->cr_principal);
1806 }
1807
1808 static void gen_confirm(struct nfs4_client *clp, struct nfsd_net *nn)
1809 {
1810         __be32 verf[2];
1811
1812         /*
1813          * This is opaque to client, so no need to byte-swap. Use
1814          * __force to keep sparse happy
1815          */
1816         verf[0] = (__force __be32)get_seconds();
1817         verf[1] = (__force __be32)nn->clientid_counter;
1818         memcpy(clp->cl_confirm.data, verf, sizeof(clp->cl_confirm.data));
1819 }
1820
1821 static void gen_clid(struct nfs4_client *clp, struct nfsd_net *nn)
1822 {
1823         clp->cl_clientid.cl_boot = nn->boot_time;
1824         clp->cl_clientid.cl_id = nn->clientid_counter++;
1825         gen_confirm(clp, nn);
1826 }
1827
1828 static struct nfs4_stid *
1829 find_stateid_locked(struct nfs4_client *cl, stateid_t *t)
1830 {
1831         struct nfs4_stid *ret;
1832
1833         ret = idr_find(&cl->cl_stateids, t->si_opaque.so_id);
1834         if (!ret || !ret->sc_type)
1835                 return NULL;
1836         return ret;
1837 }
1838
1839 static struct nfs4_stid *
1840 find_stateid_by_type(struct nfs4_client *cl, stateid_t *t, char typemask)
1841 {
1842         struct nfs4_stid *s;
1843
1844         spin_lock(&cl->cl_lock);
1845         s = find_stateid_locked(cl, t);
1846         if (s != NULL) {
1847                 if (typemask & s->sc_type)
1848                         atomic_inc(&s->sc_count);
1849                 else
1850                         s = NULL;
1851         }
1852         spin_unlock(&cl->cl_lock);
1853         return s;
1854 }
1855
1856 static struct nfs4_client *create_client(struct xdr_netobj name,
1857                 struct svc_rqst *rqstp, nfs4_verifier *verf)
1858 {
1859         struct nfs4_client *clp;
1860         struct sockaddr *sa = svc_addr(rqstp);
1861         int ret;
1862         struct net *net = SVC_NET(rqstp);
1863
1864         clp = alloc_client(name);
1865         if (clp == NULL)
1866                 return NULL;
1867
1868         ret = copy_cred(&clp->cl_cred, &rqstp->rq_cred);
1869         if (ret) {
1870                 free_client(clp);
1871                 return NULL;
1872         }
1873         INIT_WORK(&clp->cl_cb_null.cb_work, nfsd4_run_cb_null);
1874         clp->cl_time = get_seconds();
1875         clear_bit(0, &clp->cl_cb_slot_busy);
1876         copy_verf(clp, verf);
1877         rpc_copy_addr((struct sockaddr *) &clp->cl_addr, sa);
1878         clp->cl_cb_session = NULL;
1879         clp->net = net;
1880         return clp;
1881 }
1882
1883 static void
1884 add_clp_to_name_tree(struct nfs4_client *new_clp, struct rb_root *root)
1885 {
1886         struct rb_node **new = &(root->rb_node), *parent = NULL;
1887         struct nfs4_client *clp;
1888
1889         while (*new) {
1890                 clp = rb_entry(*new, struct nfs4_client, cl_namenode);
1891                 parent = *new;
1892
1893                 if (compare_blob(&clp->cl_name, &new_clp->cl_name) > 0)
1894                         new = &((*new)->rb_left);
1895                 else
1896                         new = &((*new)->rb_right);
1897         }
1898
1899         rb_link_node(&new_clp->cl_namenode, parent, new);
1900         rb_insert_color(&new_clp->cl_namenode, root);
1901 }
1902
1903 static struct nfs4_client *
1904 find_clp_in_name_tree(struct xdr_netobj *name, struct rb_root *root)
1905 {
1906         long long cmp;
1907         struct rb_node *node = root->rb_node;
1908         struct nfs4_client *clp;
1909
1910         while (node) {
1911                 clp = rb_entry(node, struct nfs4_client, cl_namenode);
1912                 cmp = compare_blob(&clp->cl_name, name);
1913                 if (cmp > 0)
1914                         node = node->rb_left;
1915                 else if (cmp < 0)
1916                         node = node->rb_right;
1917                 else
1918                         return clp;
1919         }
1920         return NULL;
1921 }
1922
1923 static void
1924 add_to_unconfirmed(struct nfs4_client *clp)
1925 {
1926         unsigned int idhashval;
1927         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
1928
1929         lockdep_assert_held(&nn->client_lock);
1930
1931         clear_bit(NFSD4_CLIENT_CONFIRMED, &clp->cl_flags);
1932         add_clp_to_name_tree(clp, &nn->unconf_name_tree);
1933         idhashval = clientid_hashval(clp->cl_clientid.cl_id);
1934         list_add(&clp->cl_idhash, &nn->unconf_id_hashtbl[idhashval]);
1935         renew_client_locked(clp);
1936 }
1937
1938 static void
1939 move_to_confirmed(struct nfs4_client *clp)
1940 {
1941         unsigned int idhashval = clientid_hashval(clp->cl_clientid.cl_id);
1942         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
1943
1944         lockdep_assert_held(&nn->client_lock);
1945
1946         dprintk("NFSD: move_to_confirm nfs4_client %p\n", clp);
1947         list_move(&clp->cl_idhash, &nn->conf_id_hashtbl[idhashval]);
1948         rb_erase(&clp->cl_namenode, &nn->unconf_name_tree);
1949         add_clp_to_name_tree(clp, &nn->conf_name_tree);
1950         set_bit(NFSD4_CLIENT_CONFIRMED, &clp->cl_flags);
1951         renew_client_locked(clp);
1952 }
1953
1954 static struct nfs4_client *
1955 find_client_in_id_table(struct list_head *tbl, clientid_t *clid, bool sessions)
1956 {
1957         struct nfs4_client *clp;
1958         unsigned int idhashval = clientid_hashval(clid->cl_id);
1959
1960         list_for_each_entry(clp, &tbl[idhashval], cl_idhash) {
1961                 if (same_clid(&clp->cl_clientid, clid)) {
1962                         if ((bool)clp->cl_minorversion != sessions)
1963                                 return NULL;
1964                         renew_client_locked(clp);
1965                         return clp;
1966                 }
1967         }
1968         return NULL;
1969 }
1970
1971 static struct nfs4_client *
1972 find_confirmed_client(clientid_t *clid, bool sessions, struct nfsd_net *nn)
1973 {
1974         struct list_head *tbl = nn->conf_id_hashtbl;
1975
1976         lockdep_assert_held(&nn->client_lock);
1977         return find_client_in_id_table(tbl, clid, sessions);
1978 }
1979
1980 static struct nfs4_client *
1981 find_unconfirmed_client(clientid_t *clid, bool sessions, struct nfsd_net *nn)
1982 {
1983         struct list_head *tbl = nn->unconf_id_hashtbl;
1984
1985         lockdep_assert_held(&nn->client_lock);
1986         return find_client_in_id_table(tbl, clid, sessions);
1987 }
1988
1989 static bool clp_used_exchangeid(struct nfs4_client *clp)
1990 {
1991         return clp->cl_exchange_flags != 0;
1992 }
1993
1994 static struct nfs4_client *
1995 find_confirmed_client_by_name(struct xdr_netobj *name, struct nfsd_net *nn)
1996 {
1997         lockdep_assert_held(&nn->client_lock);
1998         return find_clp_in_name_tree(name, &nn->conf_name_tree);
1999 }
2000
2001 static struct nfs4_client *
2002 find_unconfirmed_client_by_name(struct xdr_netobj *name, struct nfsd_net *nn)
2003 {
2004         lockdep_assert_held(&nn->client_lock);
2005         return find_clp_in_name_tree(name, &nn->unconf_name_tree);
2006 }
2007
2008 static void
2009 gen_callback(struct nfs4_client *clp, struct nfsd4_setclientid *se, struct svc_rqst *rqstp)
2010 {
2011         struct nfs4_cb_conn *conn = &clp->cl_cb_conn;
2012         struct sockaddr *sa = svc_addr(rqstp);
2013         u32 scopeid = rpc_get_scope_id(sa);
2014         unsigned short expected_family;
2015
2016         /* Currently, we only support tcp and tcp6 for the callback channel */
2017         if (se->se_callback_netid_len == 3 &&
2018             !memcmp(se->se_callback_netid_val, "tcp", 3))
2019                 expected_family = AF_INET;
2020         else if (se->se_callback_netid_len == 4 &&
2021                  !memcmp(se->se_callback_netid_val, "tcp6", 4))
2022                 expected_family = AF_INET6;
2023         else
2024                 goto out_err;
2025
2026         conn->cb_addrlen = rpc_uaddr2sockaddr(clp->net, se->se_callback_addr_val,
2027                                             se->se_callback_addr_len,
2028                                             (struct sockaddr *)&conn->cb_addr,
2029                                             sizeof(conn->cb_addr));
2030
2031         if (!conn->cb_addrlen || conn->cb_addr.ss_family != expected_family)
2032                 goto out_err;
2033
2034         if (conn->cb_addr.ss_family == AF_INET6)
2035                 ((struct sockaddr_in6 *)&conn->cb_addr)->sin6_scope_id = scopeid;
2036
2037         conn->cb_prog = se->se_callback_prog;
2038         conn->cb_ident = se->se_callback_ident;
2039         memcpy(&conn->cb_saddr, &rqstp->rq_daddr, rqstp->rq_daddrlen);
2040         return;
2041 out_err:
2042         conn->cb_addr.ss_family = AF_UNSPEC;
2043         conn->cb_addrlen = 0;
2044         dprintk(KERN_INFO "NFSD: this client (clientid %08x/%08x) "
2045                 "will not receive delegations\n",
2046                 clp->cl_clientid.cl_boot, clp->cl_clientid.cl_id);
2047
2048         return;
2049 }
2050
2051 /*
2052  * Cache a reply. nfsd4_check_resp_size() has bounded the cache size.
2053  */
2054 static void
2055 nfsd4_store_cache_entry(struct nfsd4_compoundres *resp)
2056 {
2057         struct xdr_buf *buf = resp->xdr.buf;
2058         struct nfsd4_slot *slot = resp->cstate.slot;
2059         unsigned int base;
2060
2061         dprintk("--> %s slot %p\n", __func__, slot);
2062
2063         slot->sl_opcnt = resp->opcnt;
2064         slot->sl_status = resp->cstate.status;
2065
2066         slot->sl_flags |= NFSD4_SLOT_INITIALIZED;
2067         if (nfsd4_not_cached(resp)) {
2068                 slot->sl_datalen = 0;
2069                 return;
2070         }
2071         base = resp->cstate.data_offset;
2072         slot->sl_datalen = buf->len - base;
2073         if (read_bytes_from_xdr_buf(buf, base, slot->sl_data, slot->sl_datalen))
2074                 WARN("%s: sessions DRC could not cache compound\n", __func__);
2075         return;
2076 }
2077
2078 /*
2079  * Encode the replay sequence operation from the slot values.
2080  * If cachethis is FALSE encode the uncached rep error on the next
2081  * operation which sets resp->p and increments resp->opcnt for
2082  * nfs4svc_encode_compoundres.
2083  *
2084  */
2085 static __be32
2086 nfsd4_enc_sequence_replay(struct nfsd4_compoundargs *args,
2087                           struct nfsd4_compoundres *resp)
2088 {
2089         struct nfsd4_op *op;
2090         struct nfsd4_slot *slot = resp->cstate.slot;
2091
2092         /* Encode the replayed sequence operation */
2093         op = &args->ops[resp->opcnt - 1];
2094         nfsd4_encode_operation(resp, op);
2095
2096         /* Return nfserr_retry_uncached_rep in next operation. */
2097         if (args->opcnt > 1 && !(slot->sl_flags & NFSD4_SLOT_CACHETHIS)) {
2098                 op = &args->ops[resp->opcnt++];
2099                 op->status = nfserr_retry_uncached_rep;
2100                 nfsd4_encode_operation(resp, op);
2101         }
2102         return op->status;
2103 }
2104
2105 /*
2106  * The sequence operation is not cached because we can use the slot and
2107  * session values.
2108  */
2109 static __be32
2110 nfsd4_replay_cache_entry(struct nfsd4_compoundres *resp,
2111                          struct nfsd4_sequence *seq)
2112 {
2113         struct nfsd4_slot *slot = resp->cstate.slot;
2114         struct xdr_stream *xdr = &resp->xdr;
2115         __be32 *p;
2116         __be32 status;
2117
2118         dprintk("--> %s slot %p\n", __func__, slot);
2119
2120         status = nfsd4_enc_sequence_replay(resp->rqstp->rq_argp, resp);
2121         if (status)
2122                 return status;
2123
2124         p = xdr_reserve_space(xdr, slot->sl_datalen);
2125         if (!p) {
2126                 WARN_ON_ONCE(1);
2127                 return nfserr_serverfault;
2128         }
2129         xdr_encode_opaque_fixed(p, slot->sl_data, slot->sl_datalen);
2130         xdr_commit_encode(xdr);
2131
2132         resp->opcnt = slot->sl_opcnt;
2133         return slot->sl_status;
2134 }
2135
2136 /*
2137  * Set the exchange_id flags returned by the server.
2138  */
2139 static void
2140 nfsd4_set_ex_flags(struct nfs4_client *new, struct nfsd4_exchange_id *clid)
2141 {
2142         /* pNFS is not supported */
2143         new->cl_exchange_flags |= EXCHGID4_FLAG_USE_NON_PNFS;
2144
2145         /* Referrals are supported, Migration is not. */
2146         new->cl_exchange_flags |= EXCHGID4_FLAG_SUPP_MOVED_REFER;
2147
2148         /* set the wire flags to return to client. */
2149         clid->flags = new->cl_exchange_flags;
2150 }
2151
2152 static bool client_has_state(struct nfs4_client *clp)
2153 {
2154         /*
2155          * Note clp->cl_openowners check isn't quite right: there's no
2156          * need to count owners without stateid's.
2157          *
2158          * Also note we should probably be using this in 4.0 case too.
2159          */
2160         return !list_empty(&clp->cl_openowners)
2161                 || !list_empty(&clp->cl_delegations)
2162                 || !list_empty(&clp->cl_sessions);
2163 }
2164
2165 __be32
2166 nfsd4_exchange_id(struct svc_rqst *rqstp,
2167                   struct nfsd4_compound_state *cstate,
2168                   struct nfsd4_exchange_id *exid)
2169 {
2170         struct nfs4_client *conf, *new;
2171         struct nfs4_client *unconf = NULL;
2172         __be32 status;
2173         char                    addr_str[INET6_ADDRSTRLEN];
2174         nfs4_verifier           verf = exid->verifier;
2175         struct sockaddr         *sa = svc_addr(rqstp);
2176         bool    update = exid->flags & EXCHGID4_FLAG_UPD_CONFIRMED_REC_A;
2177         struct nfsd_net         *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
2178
2179         rpc_ntop(sa, addr_str, sizeof(addr_str));
2180         dprintk("%s rqstp=%p exid=%p clname.len=%u clname.data=%p "
2181                 "ip_addr=%s flags %x, spa_how %d\n",
2182                 __func__, rqstp, exid, exid->clname.len, exid->clname.data,
2183                 addr_str, exid->flags, exid->spa_how);
2184
2185         if (exid->flags & ~EXCHGID4_FLAG_MASK_A)
2186                 return nfserr_inval;
2187
2188         switch (exid->spa_how) {
2189         case SP4_MACH_CRED:
2190                 if (!svc_rqst_integrity_protected(rqstp))
2191                         return nfserr_inval;
2192         case SP4_NONE:
2193                 break;
2194         default:                                /* checked by xdr code */
2195                 WARN_ON_ONCE(1);
2196         case SP4_SSV:
2197                 return nfserr_encr_alg_unsupp;
2198         }
2199
2200         new = create_client(exid->clname, rqstp, &verf);
2201         if (new == NULL)
2202                 return nfserr_jukebox;
2203
2204         /* Cases below refer to rfc 5661 section 18.35.4: */
2205         spin_lock(&nn->client_lock);
2206         conf = find_confirmed_client_by_name(&exid->clname, nn);
2207         if (conf) {
2208                 bool creds_match = same_creds(&conf->cl_cred, &rqstp->rq_cred);
2209                 bool verfs_match = same_verf(&verf, &conf->cl_verifier);
2210
2211                 if (update) {
2212                         if (!clp_used_exchangeid(conf)) { /* buggy client */
2213                                 status = nfserr_inval;
2214                                 goto out;
2215                         }
2216                         if (!mach_creds_match(conf, rqstp)) {
2217                                 status = nfserr_wrong_cred;
2218                                 goto out;
2219                         }
2220                         if (!creds_match) { /* case 9 */
2221                                 status = nfserr_perm;
2222                                 goto out;
2223                         }
2224                         if (!verfs_match) { /* case 8 */
2225                                 status = nfserr_not_same;
2226                                 goto out;
2227                         }
2228                         /* case 6 */
2229                         exid->flags |= EXCHGID4_FLAG_CONFIRMED_R;
2230                         goto out_copy;
2231                 }
2232                 if (!creds_match) { /* case 3 */
2233                         if (client_has_state(conf)) {
2234                                 status = nfserr_clid_inuse;
2235                                 goto out;
2236                         }
2237                         goto out_new;
2238                 }
2239                 if (verfs_match) { /* case 2 */
2240                         conf->cl_exchange_flags |= EXCHGID4_FLAG_CONFIRMED_R;
2241                         goto out_copy;
2242                 }
2243                 /* case 5, client reboot */
2244                 conf = NULL;
2245                 goto out_new;
2246         }
2247
2248         if (update) { /* case 7 */
2249                 status = nfserr_noent;
2250                 goto out;
2251         }
2252
2253         unconf  = find_unconfirmed_client_by_name(&exid->clname, nn);
2254         if (unconf) /* case 4, possible retry or client restart */
2255                 unhash_client_locked(unconf);
2256
2257         /* case 1 (normal case) */
2258 out_new:
2259         if (conf) {
2260                 status = mark_client_expired_locked(conf);
2261                 if (status)
2262                         goto out;
2263         }
2264         new->cl_minorversion = cstate->minorversion;
2265         new->cl_mach_cred = (exid->spa_how == SP4_MACH_CRED);
2266
2267         gen_clid(new, nn);
2268         add_to_unconfirmed(new);
2269         swap(new, conf);
2270 out_copy:
2271         exid->clientid.cl_boot = conf->cl_clientid.cl_boot;
2272         exid->clientid.cl_id = conf->cl_clientid.cl_id;
2273
2274         exid->seqid = conf->cl_cs_slot.sl_seqid + 1;
2275         nfsd4_set_ex_flags(conf, exid);
2276
2277         dprintk("nfsd4_exchange_id seqid %d flags %x\n",
2278                 conf->cl_cs_slot.sl_seqid, conf->cl_exchange_flags);
2279         status = nfs_ok;
2280
2281 out:
2282         spin_unlock(&nn->client_lock);
2283         if (new)
2284                 expire_client(new);
2285         if (unconf)
2286                 expire_client(unconf);
2287         return status;
2288 }
2289
2290 static __be32
2291 check_slot_seqid(u32 seqid, u32 slot_seqid, int slot_inuse)
2292 {
2293         dprintk("%s enter. seqid %d slot_seqid %d\n", __func__, seqid,
2294                 slot_seqid);
2295
2296         /* The slot is in use, and no response has been sent. */
2297         if (slot_inuse) {
2298                 if (seqid == slot_seqid)
2299                         return nfserr_jukebox;
2300                 else
2301                         return nfserr_seq_misordered;
2302         }
2303         /* Note unsigned 32-bit arithmetic handles wraparound: */
2304         if (likely(seqid == slot_seqid + 1))
2305                 return nfs_ok;
2306         if (seqid == slot_seqid)
2307                 return nfserr_replay_cache;
2308         return nfserr_seq_misordered;
2309 }
2310
2311 /*
2312  * Cache the create session result into the create session single DRC
2313  * slot cache by saving the xdr structure. sl_seqid has been set.
2314  * Do this for solo or embedded create session operations.
2315  */
2316 static void
2317 nfsd4_cache_create_session(struct nfsd4_create_session *cr_ses,
2318                            struct nfsd4_clid_slot *slot, __be32 nfserr)
2319 {
2320         slot->sl_status = nfserr;
2321         memcpy(&slot->sl_cr_ses, cr_ses, sizeof(*cr_ses));
2322 }
2323
2324 static __be32
2325 nfsd4_replay_create_session(struct nfsd4_create_session *cr_ses,
2326                             struct nfsd4_clid_slot *slot)
2327 {
2328         memcpy(cr_ses, &slot->sl_cr_ses, sizeof(*cr_ses));
2329         return slot->sl_status;
2330 }
2331
2332 #define NFSD_MIN_REQ_HDR_SEQ_SZ ((\
2333                         2 * 2 + /* credential,verifier: AUTH_NULL, length 0 */ \
2334                         1 +     /* MIN tag is length with zero, only length */ \
2335                         3 +     /* version, opcount, opcode */ \
2336                         XDR_QUADLEN(NFS4_MAX_SESSIONID_LEN) + \
2337                                 /* seqid, slotID, slotID, cache */ \
2338                         4 ) * sizeof(__be32))
2339
2340 #define NFSD_MIN_RESP_HDR_SEQ_SZ ((\
2341                         2 +     /* verifier: AUTH_NULL, length 0 */\
2342                         1 +     /* status */ \
2343                         1 +     /* MIN tag is length with zero, only length */ \
2344                         3 +     /* opcount, opcode, opstatus*/ \
2345                         XDR_QUADLEN(NFS4_MAX_SESSIONID_LEN) + \
2346                                 /* seqid, slotID, slotID, slotID, status */ \
2347                         5 ) * sizeof(__be32))
2348
2349 static __be32 check_forechannel_attrs(struct nfsd4_channel_attrs *ca, struct nfsd_net *nn)
2350 {
2351         u32 maxrpc = nn->nfsd_serv->sv_max_mesg;
2352
2353         if (ca->maxreq_sz < NFSD_MIN_REQ_HDR_SEQ_SZ)
2354                 return nfserr_toosmall;
2355         if (ca->maxresp_sz < NFSD_MIN_RESP_HDR_SEQ_SZ)
2356                 return nfserr_toosmall;
2357         ca->headerpadsz = 0;
2358         ca->maxreq_sz = min_t(u32, ca->maxreq_sz, maxrpc);
2359         ca->maxresp_sz = min_t(u32, ca->maxresp_sz, maxrpc);
2360         ca->maxops = min_t(u32, ca->maxops, NFSD_MAX_OPS_PER_COMPOUND);
2361         ca->maxresp_cached = min_t(u32, ca->maxresp_cached,
2362                         NFSD_SLOT_CACHE_SIZE + NFSD_MIN_HDR_SEQ_SZ);
2363         ca->maxreqs = min_t(u32, ca->maxreqs, NFSD_MAX_SLOTS_PER_SESSION);
2364         /*
2365          * Note decreasing slot size below client's request may make it
2366          * difficult for client to function correctly, whereas
2367          * decreasing the number of slots will (just?) affect
2368          * performance.  When short on memory we therefore prefer to
2369          * decrease number of slots instead of their size.  Clients that
2370          * request larger slots than they need will get poor results:
2371          */
2372         ca->maxreqs = nfsd4_get_drc_mem(ca);
2373         if (!ca->maxreqs)
2374                 return nfserr_jukebox;
2375
2376         return nfs_ok;
2377 }
2378
2379 #define NFSD_CB_MAX_REQ_SZ      ((NFS4_enc_cb_recall_sz + \
2380                                  RPC_MAX_HEADER_WITH_AUTH) * sizeof(__be32))
2381 #define NFSD_CB_MAX_RESP_SZ     ((NFS4_dec_cb_recall_sz + \
2382                                  RPC_MAX_REPHEADER_WITH_AUTH) * sizeof(__be32))
2383
2384 static __be32 check_backchannel_attrs(struct nfsd4_channel_attrs *ca)
2385 {
2386         ca->headerpadsz = 0;
2387
2388         /*
2389          * These RPC_MAX_HEADER macros are overkill, especially since we
2390          * don't even do gss on the backchannel yet.  But this is still
2391          * less than 1k.  Tighten up this estimate in the unlikely event
2392          * it turns out to be a problem for some client:
2393          */
2394         if (ca->maxreq_sz < NFSD_CB_MAX_REQ_SZ)
2395                 return nfserr_toosmall;
2396         if (ca->maxresp_sz < NFSD_CB_MAX_RESP_SZ)
2397                 return nfserr_toosmall;
2398         ca->maxresp_cached = 0;
2399         if (ca->maxops < 2)
2400                 return nfserr_toosmall;
2401
2402         return nfs_ok;
2403 }
2404
2405 static __be32 nfsd4_check_cb_sec(struct nfsd4_cb_sec *cbs)
2406 {
2407         switch (cbs->flavor) {
2408         case RPC_AUTH_NULL:
2409         case RPC_AUTH_UNIX:
2410                 return nfs_ok;
2411         default:
2412                 /*
2413                  * GSS case: the spec doesn't allow us to return this
2414                  * error.  But it also doesn't allow us not to support
2415                  * GSS.
2416                  * I'd rather this fail hard than return some error the
2417                  * client might think it can already handle:
2418                  */
2419                 return nfserr_encr_alg_unsupp;
2420         }
2421 }
2422
2423 __be32
2424 nfsd4_create_session(struct svc_rqst *rqstp,
2425                      struct nfsd4_compound_state *cstate,
2426                      struct nfsd4_create_session *cr_ses)
2427 {
2428         struct sockaddr *sa = svc_addr(rqstp);
2429         struct nfs4_client *conf, *unconf;
2430         struct nfs4_client *old = NULL;
2431         struct nfsd4_session *new;
2432         struct nfsd4_conn *conn;
2433         struct nfsd4_clid_slot *cs_slot = NULL;
2434         __be32 status = 0;
2435         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
2436
2437         if (cr_ses->flags & ~SESSION4_FLAG_MASK_A)
2438                 return nfserr_inval;
2439         status = nfsd4_check_cb_sec(&cr_ses->cb_sec);
2440         if (status)
2441                 return status;
2442         status = check_forechannel_attrs(&cr_ses->fore_channel, nn);
2443         if (status)
2444                 return status;
2445         status = check_backchannel_attrs(&cr_ses->back_channel);
2446         if (status)
2447                 goto out_release_drc_mem;
2448         status = nfserr_jukebox;
2449         new = alloc_session(&cr_ses->fore_channel, &cr_ses->back_channel);
2450         if (!new)
2451                 goto out_release_drc_mem;
2452         conn = alloc_conn_from_crses(rqstp, cr_ses);
2453         if (!conn)
2454                 goto out_free_session;
2455
2456         spin_lock(&nn->client_lock);
2457         unconf = find_unconfirmed_client(&cr_ses->clientid, true, nn);
2458         conf = find_confirmed_client(&cr_ses->clientid, true, nn);
2459         WARN_ON_ONCE(conf && unconf);
2460
2461         if (conf) {
2462                 status = nfserr_wrong_cred;
2463                 if (!mach_creds_match(conf, rqstp))
2464                         goto out_free_conn;
2465                 cs_slot = &conf->cl_cs_slot;
2466                 status = check_slot_seqid(cr_ses->seqid, cs_slot->sl_seqid, 0);
2467                 if (status == nfserr_replay_cache) {
2468                         status = nfsd4_replay_create_session(cr_ses, cs_slot);
2469                         goto out_free_conn;
2470                 } else if (cr_ses->seqid != cs_slot->sl_seqid + 1) {
2471                         status = nfserr_seq_misordered;
2472                         goto out_free_conn;
2473                 }
2474         } else if (unconf) {
2475                 if (!same_creds(&unconf->cl_cred, &rqstp->rq_cred) ||
2476                     !rpc_cmp_addr(sa, (struct sockaddr *) &unconf->cl_addr)) {
2477                         status = nfserr_clid_inuse;
2478                         goto out_free_conn;
2479                 }
2480                 status = nfserr_wrong_cred;
2481                 if (!mach_creds_match(unconf, rqstp))
2482                         goto out_free_conn;
2483                 cs_slot = &unconf->cl_cs_slot;
2484                 status = check_slot_seqid(cr_ses->seqid, cs_slot->sl_seqid, 0);
2485                 if (status) {
2486                         /* an unconfirmed replay returns misordered */
2487                         status = nfserr_seq_misordered;
2488                         goto out_free_conn;
2489                 }
2490                 old = find_confirmed_client_by_name(&unconf->cl_name, nn);
2491                 if (old) {
2492                         status = mark_client_expired_locked(old);
2493                         if (status) {
2494                                 old = NULL;
2495                                 goto out_free_conn;
2496                         }
2497                 }
2498                 move_to_confirmed(unconf);
2499                 conf = unconf;
2500         } else {
2501                 status = nfserr_stale_clientid;
2502                 goto out_free_conn;
2503         }
2504         status = nfs_ok;
2505         /*
2506          * We do not support RDMA or persistent sessions
2507          */
2508         cr_ses->flags &= ~SESSION4_PERSIST;
2509         cr_ses->flags &= ~SESSION4_RDMA;
2510
2511         init_session(rqstp, new, conf, cr_ses);
2512         nfsd4_get_session_locked(new);
2513
2514         memcpy(cr_ses->sessionid.data, new->se_sessionid.data,
2515                NFS4_MAX_SESSIONID_LEN);
2516         cs_slot->sl_seqid++;
2517         cr_ses->seqid = cs_slot->sl_seqid;
2518
2519         /* cache solo and embedded create sessions under the client_lock */
2520         nfsd4_cache_create_session(cr_ses, cs_slot, status);
2521         spin_unlock(&nn->client_lock);
2522         /* init connection and backchannel */
2523         nfsd4_init_conn(rqstp, conn, new);
2524         nfsd4_put_session(new);
2525         if (old)
2526                 expire_client(old);
2527         return status;
2528 out_free_conn:
2529         spin_unlock(&nn->client_lock);
2530         free_conn(conn);
2531         if (old)
2532                 expire_client(old);
2533 out_free_session:
2534         __free_session(new);
2535 out_release_drc_mem:
2536         nfsd4_put_drc_mem(&cr_ses->fore_channel);
2537         return status;
2538 }
2539
2540 static __be32 nfsd4_map_bcts_dir(u32 *dir)
2541 {
2542         switch (*dir) {
2543         case NFS4_CDFC4_FORE:
2544         case NFS4_CDFC4_BACK:
2545                 return nfs_ok;
2546         case NFS4_CDFC4_FORE_OR_BOTH:
2547         case NFS4_CDFC4_BACK_OR_BOTH:
2548                 *dir = NFS4_CDFC4_BOTH;
2549                 return nfs_ok;
2550         };
2551         return nfserr_inval;
2552 }
2553
2554 __be32 nfsd4_backchannel_ctl(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, struct nfsd4_backchannel_ctl *bc)
2555 {
2556         struct nfsd4_session *session = cstate->session;
2557         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
2558         __be32 status;
2559
2560         status = nfsd4_check_cb_sec(&bc->bc_cb_sec);
2561         if (status)
2562                 return status;
2563         spin_lock(&nn->client_lock);
2564         session->se_cb_prog = bc->bc_cb_program;
2565         session->se_cb_sec = bc->bc_cb_sec;
2566         spin_unlock(&nn->client_lock);
2567
2568         nfsd4_probe_callback(session->se_client);
2569
2570         return nfs_ok;
2571 }
2572
2573 __be32 nfsd4_bind_conn_to_session(struct svc_rqst *rqstp,
2574                      struct nfsd4_compound_state *cstate,
2575                      struct nfsd4_bind_conn_to_session *bcts)
2576 {
2577         __be32 status;
2578         struct nfsd4_conn *conn;
2579         struct nfsd4_session *session;
2580         struct net *net = SVC_NET(rqstp);
2581         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
2582
2583         if (!nfsd4_last_compound_op(rqstp))
2584                 return nfserr_not_only_op;
2585         spin_lock(&nn->client_lock);
2586         session = find_in_sessionid_hashtbl(&bcts->sessionid, net, &status);
2587         spin_unlock(&nn->client_lock);
2588         if (!session)
2589                 goto out_no_session;
2590         status = nfserr_wrong_cred;
2591         if (!mach_creds_match(session->se_client, rqstp))
2592                 goto out;
2593         status = nfsd4_map_bcts_dir(&bcts->dir);
2594         if (status)
2595                 goto out;
2596         conn = alloc_conn(rqstp, bcts->dir);
2597         status = nfserr_jukebox;
2598         if (!conn)
2599                 goto out;
2600         nfsd4_init_conn(rqstp, conn, session);
2601         status = nfs_ok;
2602 out:
2603         nfsd4_put_session(session);
2604 out_no_session:
2605         return status;
2606 }
2607
2608 static bool nfsd4_compound_in_session(struct nfsd4_session *session, struct nfs4_sessionid *sid)
2609 {
2610         if (!session)
2611                 return 0;
2612         return !memcmp(sid, &session->se_sessionid, sizeof(*sid));
2613 }
2614
2615 __be32
2616 nfsd4_destroy_session(struct svc_rqst *r,
2617                       struct nfsd4_compound_state *cstate,
2618                       struct nfsd4_destroy_session *sessionid)
2619 {
2620         struct nfsd4_session *ses;
2621         __be32 status;
2622         int ref_held_by_me = 0;
2623         struct net *net = SVC_NET(r);
2624         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
2625
2626         status = nfserr_not_only_op;
2627         if (nfsd4_compound_in_session(cstate->session, &sessionid->sessionid)) {
2628                 if (!nfsd4_last_compound_op(r))
2629                         goto out;
2630                 ref_held_by_me++;
2631         }
2632         dump_sessionid(__func__, &sessionid->sessionid);
2633         spin_lock(&nn->client_lock);
2634         ses = find_in_sessionid_hashtbl(&sessionid->sessionid, net, &status);
2635         if (!ses)
2636                 goto out_client_lock;
2637         status = nfserr_wrong_cred;
2638         if (!mach_creds_match(ses->se_client, r))
2639                 goto out_put_session;
2640         status = mark_session_dead_locked(ses, 1 + ref_held_by_me);
2641         if (status)
2642                 goto out_put_session;
2643         unhash_session(ses);
2644         spin_unlock(&nn->client_lock);
2645
2646         nfsd4_probe_callback_sync(ses->se_client);
2647
2648         spin_lock(&nn->client_lock);
2649         status = nfs_ok;
2650 out_put_session:
2651         nfsd4_put_session_locked(ses);
2652 out_client_lock:
2653         spin_unlock(&nn->client_lock);
2654 out:
2655         return status;
2656 }
2657
2658 static struct nfsd4_conn *__nfsd4_find_conn(struct svc_xprt *xpt, struct nfsd4_session *s)
2659 {
2660         struct nfsd4_conn *c;
2661
2662         list_for_each_entry(c, &s->se_conns, cn_persession) {
2663                 if (c->cn_xprt == xpt) {
2664                         return c;
2665                 }
2666         }
2667         return NULL;
2668 }
2669
2670 static __be32 nfsd4_sequence_check_conn(struct nfsd4_conn *new, struct nfsd4_session *ses)
2671 {
2672         struct nfs4_client *clp = ses->se_client;
2673         struct nfsd4_conn *c;
2674         __be32 status = nfs_ok;
2675         int ret;
2676
2677         spin_lock(&clp->cl_lock);
2678         c = __nfsd4_find_conn(new->cn_xprt, ses);
2679         if (c)
2680                 goto out_free;
2681         status = nfserr_conn_not_bound_to_session;
2682         if (clp->cl_mach_cred)
2683                 goto out_free;
2684         __nfsd4_hash_conn(new, ses);
2685         spin_unlock(&clp->cl_lock);
2686         ret = nfsd4_register_conn(new);
2687         if (ret)
2688                 /* oops; xprt is already down: */
2689                 nfsd4_conn_lost(&new->cn_xpt_user);
2690         return nfs_ok;
2691 out_free:
2692         spin_unlock(&clp->cl_lock);
2693         free_conn(new);
2694         return status;
2695 }
2696
2697 static bool nfsd4_session_too_many_ops(struct svc_rqst *rqstp, struct nfsd4_session *session)
2698 {
2699         struct nfsd4_compoundargs *args = rqstp->rq_argp;
2700
2701         return args->opcnt > session->se_fchannel.maxops;
2702 }
2703
2704 static bool nfsd4_request_too_big(struct svc_rqst *rqstp,
2705                                   struct nfsd4_session *session)
2706 {
2707         struct xdr_buf *xb = &rqstp->rq_arg;
2708
2709         return xb->len > session->se_fchannel.maxreq_sz;
2710 }
2711
2712 __be32
2713 nfsd4_sequence(struct svc_rqst *rqstp,
2714                struct nfsd4_compound_state *cstate,
2715                struct nfsd4_sequence *seq)
2716 {
2717         struct nfsd4_compoundres *resp = rqstp->rq_resp;
2718         struct xdr_stream *xdr = &resp->xdr;
2719         struct nfsd4_session *session;
2720         struct nfs4_client *clp;
2721         struct nfsd4_slot *slot;
2722         struct nfsd4_conn *conn;
2723         __be32 status;
2724         int buflen;
2725         struct net *net = SVC_NET(rqstp);
2726         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
2727
2728         if (resp->opcnt != 1)
2729                 return nfserr_sequence_pos;
2730
2731         /*
2732          * Will be either used or freed by nfsd4_sequence_check_conn
2733          * below.
2734          */
2735         conn = alloc_conn(rqstp, NFS4_CDFC4_FORE);
2736         if (!conn)
2737                 return nfserr_jukebox;
2738
2739         spin_lock(&nn->client_lock);
2740         session = find_in_sessionid_hashtbl(&seq->sessionid, net, &status);
2741         if (!session)
2742                 goto out_no_session;
2743         clp = session->se_client;
2744
2745         status = nfserr_too_many_ops;
2746         if (nfsd4_session_too_many_ops(rqstp, session))
2747                 goto out_put_session;
2748
2749         status = nfserr_req_too_big;
2750         if (nfsd4_request_too_big(rqstp, session))
2751                 goto out_put_session;
2752
2753         status = nfserr_badslot;
2754         if (seq->slotid >= session->se_fchannel.maxreqs)
2755                 goto out_put_session;
2756
2757         slot = session->se_slots[seq->slotid];
2758         dprintk("%s: slotid %d\n", __func__, seq->slotid);
2759
2760         /* We do not negotiate the number of slots yet, so set the
2761          * maxslots to the session maxreqs which is used to encode
2762          * sr_highest_slotid and the sr_target_slot id to maxslots */
2763         seq->maxslots = session->se_fchannel.maxreqs;
2764
2765         status = check_slot_seqid(seq->seqid, slot->sl_seqid,
2766                                         slot->sl_flags & NFSD4_SLOT_INUSE);
2767         if (status == nfserr_replay_cache) {
2768                 status = nfserr_seq_misordered;
2769                 if (!(slot->sl_flags & NFSD4_SLOT_INITIALIZED))
2770                         goto out_put_session;
2771                 cstate->slot = slot;
2772                 cstate->session = session;
2773                 cstate->clp = clp;
2774                 /* Return the cached reply status and set cstate->status
2775                  * for nfsd4_proc_compound processing */
2776                 status = nfsd4_replay_cache_entry(resp, seq);
2777                 cstate->status = nfserr_replay_cache;
2778                 goto out;
2779         }
2780         if (status)
2781                 goto out_put_session;
2782
2783         status = nfsd4_sequence_check_conn(conn, session);
2784         conn = NULL;
2785         if (status)
2786                 goto out_put_session;
2787
2788         buflen = (seq->cachethis) ?
2789                         session->se_fchannel.maxresp_cached :
2790                         session->se_fchannel.maxresp_sz;
2791         status = (seq->cachethis) ? nfserr_rep_too_big_to_cache :
2792                                     nfserr_rep_too_big;
2793         if (xdr_restrict_buflen(xdr, buflen - rqstp->rq_auth_slack))
2794                 goto out_put_session;
2795         svc_reserve(rqstp, buflen);
2796
2797         status = nfs_ok;
2798         /* Success! bump slot seqid */
2799         slot->sl_seqid = seq->seqid;
2800         slot->sl_flags |= NFSD4_SLOT_INUSE;
2801         if (seq->cachethis)
2802                 slot->sl_flags |= NFSD4_SLOT_CACHETHIS;
2803         else
2804                 slot->sl_flags &= ~NFSD4_SLOT_CACHETHIS;
2805
2806         cstate->slot = slot;
2807         cstate->session = session;
2808         cstate->clp = clp;
2809
2810 out:
2811         switch (clp->cl_cb_state) {
2812         case NFSD4_CB_DOWN:
2813                 seq->status_flags = SEQ4_STATUS_CB_PATH_DOWN;
2814                 break;
2815         case NFSD4_CB_FAULT:
2816                 seq->status_flags = SEQ4_STATUS_BACKCHANNEL_FAULT;
2817                 break;
2818         default:
2819                 seq->status_flags = 0;
2820         }
2821         if (!list_empty(&clp->cl_revoked))
2822                 seq->status_flags |= SEQ4_STATUS_RECALLABLE_STATE_REVOKED;
2823 out_no_session:
2824         if (conn)
2825                 free_conn(conn);
2826         spin_unlock(&nn->client_lock);
2827         return status;
2828 out_put_session:
2829         nfsd4_put_session_locked(session);
2830         goto out_no_session;
2831 }
2832
2833 void
2834 nfsd4_sequence_done(struct nfsd4_compoundres *resp)
2835 {
2836         struct nfsd4_compound_state *cs = &resp->cstate;
2837
2838         if (nfsd4_has_session(cs)) {
2839                 if (cs->status != nfserr_replay_cache) {
2840                         nfsd4_store_cache_entry(resp);
2841                         cs->slot->sl_flags &= ~NFSD4_SLOT_INUSE;
2842                 }
2843                 /* Drop session reference that was taken in nfsd4_sequence() */
2844                 nfsd4_put_session(cs->session);
2845         } else if (cs->clp)
2846                 put_client_renew(cs->clp);
2847 }
2848
2849 __be32
2850 nfsd4_destroy_clientid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, struct nfsd4_destroy_clientid *dc)
2851 {
2852         struct nfs4_client *conf, *unconf;
2853         struct nfs4_client *clp = NULL;
2854         __be32 status = 0;
2855         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
2856
2857         spin_lock(&nn->client_lock);
2858         unconf = find_unconfirmed_client(&dc->clientid, true, nn);
2859         conf = find_confirmed_client(&dc->clientid, true, nn);
2860         WARN_ON_ONCE(conf && unconf);
2861
2862         if (conf) {
2863                 if (client_has_state(conf)) {
2864                         status = nfserr_clientid_busy;
2865                         goto out;
2866                 }
2867                 status = mark_client_expired_locked(conf);
2868                 if (status)
2869                         goto out;
2870                 clp = conf;
2871         } else if (unconf)
2872                 clp = unconf;
2873         else {
2874                 status = nfserr_stale_clientid;
2875                 goto out;
2876         }
2877         if (!mach_creds_match(clp, rqstp)) {
2878                 clp = NULL;
2879                 status = nfserr_wrong_cred;
2880                 goto out;
2881         }
2882         unhash_client_locked(clp);
2883 out:
2884         spin_unlock(&nn->client_lock);
2885         if (clp)
2886                 expire_client(clp);
2887         return status;
2888 }
2889
2890 __be32
2891 nfsd4_reclaim_complete(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, struct nfsd4_reclaim_complete *rc)
2892 {
2893         __be32 status = 0;
2894
2895         if (rc->rca_one_fs) {
2896                 if (!cstate->current_fh.fh_dentry)
2897                         return nfserr_nofilehandle;
2898                 /*
2899                  * We don't take advantage of the rca_one_fs case.
2900                  * That's OK, it's optional, we can safely ignore it.
2901                  */
2902                  return nfs_ok;
2903         }
2904
2905         status = nfserr_complete_already;
2906         if (test_and_set_bit(NFSD4_CLIENT_RECLAIM_COMPLETE,
2907                              &cstate->session->se_client->cl_flags))
2908                 goto out;
2909
2910         status = nfserr_stale_clientid;
2911         if (is_client_expired(cstate->session->se_client))
2912                 /*
2913                  * The following error isn't really legal.
2914                  * But we only get here if the client just explicitly
2915                  * destroyed the client.  Surely it no longer cares what
2916                  * error it gets back on an operation for the dead
2917                  * client.
2918                  */
2919                 goto out;
2920
2921         status = nfs_ok;
2922         nfsd4_client_record_create(cstate->session->se_client);
2923 out:
2924         return status;
2925 }
2926
2927 __be32
2928 nfsd4_setclientid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
2929                   struct nfsd4_setclientid *setclid)
2930 {
2931         struct xdr_netobj       clname = setclid->se_name;
2932         nfs4_verifier           clverifier = setclid->se_verf;
2933         struct nfs4_client      *conf, *new;
2934         struct nfs4_client      *unconf = NULL;
2935         __be32                  status;
2936         struct nfsd_net         *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
2937
2938         new = create_client(clname, rqstp, &clverifier);
2939         if (new == NULL)
2940                 return nfserr_jukebox;
2941         /* Cases below refer to rfc 3530 section 14.2.33: */
2942         spin_lock(&nn->client_lock);
2943         conf = find_confirmed_client_by_name(&clname, nn);
2944         if (conf) {
2945                 /* case 0: */
2946                 status = nfserr_clid_inuse;
2947                 if (clp_used_exchangeid(conf))
2948                         goto out;
2949                 if (!same_creds(&conf->cl_cred, &rqstp->rq_cred)) {
2950                         char addr_str[INET6_ADDRSTRLEN];
2951                         rpc_ntop((struct sockaddr *) &conf->cl_addr, addr_str,
2952                                  sizeof(addr_str));
2953                         dprintk("NFSD: setclientid: string in use by client "
2954                                 "at %s\n", addr_str);
2955                         goto out;
2956                 }
2957         }
2958         unconf = find_unconfirmed_client_by_name(&clname, nn);
2959         if (unconf)
2960                 unhash_client_locked(unconf);
2961         if (conf && same_verf(&conf->cl_verifier, &clverifier))
2962                 /* case 1: probable callback update */
2963                 copy_clid(new, conf);
2964         else /* case 4 (new client) or cases 2, 3 (client reboot): */
2965                 gen_clid(new, nn);
2966         new->cl_minorversion = 0;
2967         gen_callback(new, setclid, rqstp);
2968         add_to_unconfirmed(new);
2969         setclid->se_clientid.cl_boot = new->cl_clientid.cl_boot;
2970         setclid->se_clientid.cl_id = new->cl_clientid.cl_id;
2971         memcpy(setclid->se_confirm.data, new->cl_confirm.data, sizeof(setclid->se_confirm.data));
2972         new = NULL;
2973         status = nfs_ok;
2974 out:
2975         spin_unlock(&nn->client_lock);
2976         if (new)
2977                 free_client(new);
2978         if (unconf)
2979                 expire_client(unconf);
2980         return status;
2981 }
2982
2983
2984 __be32
2985 nfsd4_setclientid_confirm(struct svc_rqst *rqstp,
2986                          struct nfsd4_compound_state *cstate,
2987                          struct nfsd4_setclientid_confirm *setclientid_confirm)
2988 {
2989         struct nfs4_client *conf, *unconf;
2990         struct nfs4_client *old = NULL;
2991         nfs4_verifier confirm = setclientid_confirm->sc_confirm;
2992         clientid_t * clid = &setclientid_confirm->sc_clientid;
2993         __be32 status;
2994         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
2995
2996         if (STALE_CLIENTID(clid, nn))
2997                 return nfserr_stale_clientid;
2998
2999         spin_lock(&nn->client_lock);
3000         conf = find_confirmed_client(clid, false, nn);
3001         unconf = find_unconfirmed_client(clid, false, nn);
3002         /*
3003          * We try hard to give out unique clientid's, so if we get an
3004          * attempt to confirm the same clientid with a different cred,
3005          * there's a bug somewhere.  Let's charitably assume it's our
3006          * bug.
3007          */
3008         status = nfserr_serverfault;
3009         if (unconf && !same_creds(&unconf->cl_cred, &rqstp->rq_cred))
3010                 goto out;
3011         if (conf && !same_creds(&conf->cl_cred, &rqstp->rq_cred))
3012                 goto out;
3013         /* cases below refer to rfc 3530 section 14.2.34: */
3014         if (!unconf || !same_verf(&confirm, &unconf->cl_confirm)) {
3015                 if (conf && !unconf) /* case 2: probable retransmit */
3016                         status = nfs_ok;
3017                 else /* case 4: client hasn't noticed we rebooted yet? */
3018                         status = nfserr_stale_clientid;
3019                 goto out;
3020         }
3021         status = nfs_ok;
3022         if (conf) { /* case 1: callback update */
3023                 old = unconf;
3024                 unhash_client_locked(old);
3025                 nfsd4_change_callback(conf, &unconf->cl_cb_conn);
3026         } else { /* case 3: normal case; new or rebooted client */
3027                 old = find_confirmed_client_by_name(&unconf->cl_name, nn);
3028                 if (old) {
3029                         status = mark_client_expired_locked(old);
3030                         if (status) {
3031                                 old = NULL;
3032                                 goto out;
3033                         }
3034                 }
3035                 move_to_confirmed(unconf);
3036                 conf = unconf;
3037         }
3038         get_client_locked(conf);
3039         spin_unlock(&nn->client_lock);
3040         nfsd4_probe_callback(conf);
3041         spin_lock(&nn->client_lock);
3042         put_client_renew_locked(conf);
3043 out:
3044         spin_unlock(&nn->client_lock);
3045         if (old)
3046                 expire_client(old);
3047         return status;
3048 }
3049
3050 static struct nfs4_file *nfsd4_alloc_file(void)
3051 {
3052         return kmem_cache_alloc(file_slab, GFP_KERNEL);
3053 }
3054
3055 /* OPEN Share state helper functions */
3056 static void nfsd4_init_file(struct nfs4_file *fp, struct knfsd_fh *fh)
3057 {
3058         unsigned int hashval = file_hashval(fh);
3059
3060         lockdep_assert_held(&state_lock);
3061
3062         atomic_set(&fp->fi_ref, 1);
3063         spin_lock_init(&fp->fi_lock);
3064         INIT_LIST_HEAD(&fp->fi_stateids);
3065         INIT_LIST_HEAD(&fp->fi_delegations);
3066         fh_copy_shallow(&fp->fi_fhandle, fh);
3067         fp->fi_deleg_file = NULL;
3068         fp->fi_had_conflict = false;
3069         fp->fi_share_deny = 0;
3070         memset(fp->fi_fds, 0, sizeof(fp->fi_fds));
3071         memset(fp->fi_access, 0, sizeof(fp->fi_access));
3072         hlist_add_head(&fp->fi_hash, &file_hashtbl[hashval]);
3073 }
3074
3075 void
3076 nfsd4_free_slabs(void)
3077 {
3078         kmem_cache_destroy(openowner_slab);
3079         kmem_cache_destroy(lockowner_slab);
3080         kmem_cache_destroy(file_slab);
3081         kmem_cache_destroy(stateid_slab);
3082         kmem_cache_destroy(deleg_slab);
3083 }
3084
3085 int
3086 nfsd4_init_slabs(void)
3087 {
3088         openowner_slab = kmem_cache_create("nfsd4_openowners",
3089                         sizeof(struct nfs4_openowner), 0, 0, NULL);
3090         if (openowner_slab == NULL)
3091                 goto out;
3092         lockowner_slab = kmem_cache_create("nfsd4_lockowners",
3093                         sizeof(struct nfs4_lockowner), 0, 0, NULL);
3094         if (lockowner_slab == NULL)
3095                 goto out_free_openowner_slab;
3096         file_slab = kmem_cache_create("nfsd4_files",
3097                         sizeof(struct nfs4_file), 0, 0, NULL);
3098         if (file_slab == NULL)
3099                 goto out_free_lockowner_slab;
3100         stateid_slab = kmem_cache_create("nfsd4_stateids",
3101                         sizeof(struct nfs4_ol_stateid), 0, 0, NULL);
3102         if (stateid_slab == NULL)
3103                 goto out_free_file_slab;
3104         deleg_slab = kmem_cache_create("nfsd4_delegations",
3105                         sizeof(struct nfs4_delegation), 0, 0, NULL);
3106         if (deleg_slab == NULL)
3107                 goto out_free_stateid_slab;
3108         return 0;
3109
3110 out_free_stateid_slab:
3111         kmem_cache_destroy(stateid_slab);
3112 out_free_file_slab:
3113         kmem_cache_destroy(file_slab);
3114 out_free_lockowner_slab:
3115         kmem_cache_destroy(lockowner_slab);
3116 out_free_openowner_slab:
3117         kmem_cache_destroy(openowner_slab);
3118 out:
3119         dprintk("nfsd4: out of memory while initializing nfsv4\n");
3120         return -ENOMEM;
3121 }
3122
3123 static void init_nfs4_replay(struct nfs4_replay *rp)
3124 {
3125         rp->rp_status = nfserr_serverfault;
3126         rp->rp_buflen = 0;
3127         rp->rp_buf = rp->rp_ibuf;
3128         mutex_init(&rp->rp_mutex);
3129 }
3130
3131 static void nfsd4_cstate_assign_replay(struct nfsd4_compound_state *cstate,
3132                 struct nfs4_stateowner *so)
3133 {
3134         if (!nfsd4_has_session(cstate)) {
3135                 mutex_lock(&so->so_replay.rp_mutex);
3136                 cstate->replay_owner = nfs4_get_stateowner(so);
3137         }
3138 }
3139
3140 void nfsd4_cstate_clear_replay(struct nfsd4_compound_state *cstate)
3141 {
3142         struct nfs4_stateowner *so = cstate->replay_owner;
3143
3144         if (so != NULL) {
3145                 cstate->replay_owner = NULL;
3146                 mutex_unlock(&so->so_replay.rp_mutex);
3147                 nfs4_put_stateowner(so);
3148         }
3149 }
3150
3151 static inline void *alloc_stateowner(struct kmem_cache *slab, struct xdr_netobj *owner, struct nfs4_client *clp)
3152 {
3153         struct nfs4_stateowner *sop;
3154
3155         sop = kmem_cache_alloc(slab, GFP_KERNEL);
3156         if (!sop)
3157                 return NULL;
3158
3159         sop->so_owner.data = kmemdup(owner->data, owner->len, GFP_KERNEL);
3160         if (!sop->so_owner.data) {
3161                 kmem_cache_free(slab, sop);
3162                 return NULL;
3163         }
3164         sop->so_owner.len = owner->len;
3165
3166         INIT_LIST_HEAD(&sop->so_stateids);
3167         sop->so_client = clp;
3168         init_nfs4_replay(&sop->so_replay);
3169         atomic_set(&sop->so_count, 1);
3170         return sop;
3171 }
3172
3173 static void hash_openowner(struct nfs4_openowner *oo, struct nfs4_client *clp, unsigned int strhashval)
3174 {
3175         lockdep_assert_held(&clp->cl_lock);
3176
3177         list_add(&oo->oo_owner.so_strhash,
3178                  &clp->cl_ownerstr_hashtbl[strhashval]);
3179         list_add(&oo->oo_perclient, &clp->cl_openowners);
3180 }
3181
3182 static void nfs4_unhash_openowner(struct nfs4_stateowner *so)
3183 {
3184         unhash_openowner_locked(openowner(so));
3185 }
3186
3187 static void nfs4_free_openowner(struct nfs4_stateowner *so)
3188 {
3189         struct nfs4_openowner *oo = openowner(so);
3190
3191         kmem_cache_free(openowner_slab, oo);
3192 }
3193
3194 static const struct nfs4_stateowner_operations openowner_ops = {
3195         .so_unhash =    nfs4_unhash_openowner,
3196         .so_free =      nfs4_free_openowner,
3197 };
3198
3199 static struct nfs4_openowner *
3200 alloc_init_open_stateowner(unsigned int strhashval, struct nfsd4_open *open,
3201                            struct nfsd4_compound_state *cstate)
3202 {
3203         struct nfs4_client *clp = cstate->clp;
3204         struct nfs4_openowner *oo, *ret;
3205
3206         oo = alloc_stateowner(openowner_slab, &open->op_owner, clp);
3207         if (!oo)
3208                 return NULL;
3209         oo->oo_owner.so_ops = &openowner_ops;
3210         oo->oo_owner.so_is_open_owner = 1;
3211         oo->oo_owner.so_seqid = open->op_seqid;
3212         oo->oo_flags = 0;
3213         if (nfsd4_has_session(cstate))
3214                 oo->oo_flags |= NFS4_OO_CONFIRMED;
3215         oo->oo_time = 0;
3216         oo->oo_last_closed_stid = NULL;
3217         INIT_LIST_HEAD(&oo->oo_close_lru);
3218         spin_lock(&clp->cl_lock);
3219         ret = find_openstateowner_str_locked(strhashval, open, clp);
3220         if (ret == NULL) {
3221                 hash_openowner(oo, clp, strhashval);
3222                 ret = oo;
3223         } else
3224                 nfs4_free_openowner(&oo->oo_owner);
3225         spin_unlock(&clp->cl_lock);
3226         return oo;
3227 }
3228
3229 static void init_open_stateid(struct nfs4_ol_stateid *stp, struct nfs4_file *fp, struct nfsd4_open *open) {
3230         struct nfs4_openowner *oo = open->op_openowner;
3231
3232         atomic_inc(&stp->st_stid.sc_count);
3233         stp->st_stid.sc_type = NFS4_OPEN_STID;
3234         INIT_LIST_HEAD(&stp->st_locks);
3235         stp->st_stateowner = nfs4_get_stateowner(&oo->oo_owner);
3236         get_nfs4_file(fp);
3237         stp->st_stid.sc_file = fp;
3238         stp->st_access_bmap = 0;
3239         stp->st_deny_bmap = 0;
3240         stp->st_openstp = NULL;
3241         spin_lock(&oo->oo_owner.so_client->cl_lock);
3242         list_add(&stp->st_perstateowner, &oo->oo_owner.so_stateids);
3243         spin_lock(&fp->fi_lock);
3244         list_add(&stp->st_perfile, &fp->fi_stateids);
3245         spin_unlock(&fp->fi_lock);
3246         spin_unlock(&oo->oo_owner.so_client->cl_lock);
3247 }
3248
3249 /*
3250  * In the 4.0 case we need to keep the owners around a little while to handle
3251  * CLOSE replay. We still do need to release any file access that is held by
3252  * them before returning however.
3253  */
3254 static void
3255 move_to_close_lru(struct nfs4_ol_stateid *s, struct net *net)
3256 {
3257         struct nfs4_ol_stateid *last;
3258         struct nfs4_openowner *oo = openowner(s->st_stateowner);
3259         struct nfsd_net *nn = net_generic(s->st_stid.sc_client->net,
3260                                                 nfsd_net_id);
3261
3262         dprintk("NFSD: move_to_close_lru nfs4_openowner %p\n", oo);
3263
3264         /*
3265          * We know that we hold one reference via nfsd4_close, and another
3266          * "persistent" reference for the client. If the refcount is higher
3267          * than 2, then there are still calls in progress that are using this
3268          * stateid. We can't put the sc_file reference until they are finished.
3269          * Wait for the refcount to drop to 2. Since it has been unhashed,
3270          * there should be no danger of the refcount going back up again at
3271          * this point.
3272          */
3273         wait_event(close_wq, atomic_read(&s->st_stid.sc_count) == 2);
3274
3275         release_all_access(s);
3276         if (s->st_stid.sc_file) {
3277                 put_nfs4_file(s->st_stid.sc_file);
3278                 s->st_stid.sc_file = NULL;
3279         }
3280
3281         spin_lock(&nn->client_lock);
3282         last = oo->oo_last_closed_stid;
3283         oo->oo_last_closed_stid = s;
3284         list_move_tail(&oo->oo_close_lru, &nn->close_lru);
3285         oo->oo_time = get_seconds();
3286         spin_unlock(&nn->client_lock);
3287         if (last)
3288                 nfs4_put_stid(&last->st_stid);
3289 }
3290
3291 /* search file_hashtbl[] for file */
3292 static struct nfs4_file *
3293 find_file_locked(struct knfsd_fh *fh)
3294 {
3295         unsigned int hashval = file_hashval(fh);
3296         struct nfs4_file *fp;
3297
3298         lockdep_assert_held(&state_lock);
3299
3300         hlist_for_each_entry(fp, &file_hashtbl[hashval], fi_hash) {
3301                 if (nfsd_fh_match(&fp->fi_fhandle, fh)) {
3302                         get_nfs4_file(fp);
3303                         return fp;
3304                 }
3305         }
3306         return NULL;
3307 }
3308
3309 static struct nfs4_file *
3310 find_file(struct knfsd_fh *fh)
3311 {
3312         struct nfs4_file *fp;
3313
3314         spin_lock(&state_lock);
3315         fp = find_file_locked(fh);
3316         spin_unlock(&state_lock);
3317         return fp;
3318 }
3319
3320 static struct nfs4_file *
3321 find_or_add_file(struct nfs4_file *new, struct knfsd_fh *fh)
3322 {
3323         struct nfs4_file *fp;
3324
3325         spin_lock(&state_lock);
3326         fp = find_file_locked(fh);
3327         if (fp == NULL) {
3328                 nfsd4_init_file(new, fh);
3329                 fp = new;
3330         }
3331         spin_unlock(&state_lock);
3332
3333         return fp;
3334 }
3335
3336 /*
3337  * Called to check deny when READ with all zero stateid or
3338  * WRITE with all zero or all one stateid
3339  */
3340 static __be32
3341 nfs4_share_conflict(struct svc_fh *current_fh, unsigned int deny_type)
3342 {
3343         struct nfs4_file *fp;
3344         __be32 ret = nfs_ok;
3345
3346         fp = find_file(&current_fh->fh_handle);
3347         if (!fp)
3348                 return ret;
3349         /* Check for conflicting share reservations */
3350         spin_lock(&fp->fi_lock);
3351         if (fp->fi_share_deny & deny_type)
3352                 ret = nfserr_locked;
3353         spin_unlock(&fp->fi_lock);
3354         put_nfs4_file(fp);
3355         return ret;
3356 }
3357
3358 void nfsd4_prepare_cb_recall(struct nfs4_delegation *dp)
3359 {
3360         struct nfsd_net *nn = net_generic(dp->dl_stid.sc_client->net,
3361                                           nfsd_net_id);
3362
3363         block_delegations(&dp->dl_stid.sc_file->fi_fhandle);
3364
3365         /*
3366          * We can't do this in nfsd_break_deleg_cb because it is
3367          * already holding inode->i_lock.
3368          *
3369          * If the dl_time != 0, then we know that it has already been
3370          * queued for a lease break. Don't queue it again.
3371          */
3372         spin_lock(&state_lock);
3373         if (dp->dl_time == 0) {
3374                 dp->dl_time = get_seconds();
3375                 list_add_tail(&dp->dl_recall_lru, &nn->del_recall_lru);
3376         }
3377         spin_unlock(&state_lock);
3378 }
3379
3380 static void nfsd_break_one_deleg(struct nfs4_delegation *dp)
3381 {
3382         /*
3383          * We're assuming the state code never drops its reference
3384          * without first removing the lease.  Since we're in this lease
3385          * callback (and since the lease code is serialized by the kernel
3386          * lock) we know the server hasn't removed the lease yet, we know
3387          * it's safe to take a reference.
3388          */
3389         atomic_inc(&dp->dl_stid.sc_count);
3390         nfsd4_cb_recall(dp);
3391 }
3392
3393 /* Called from break_lease() with i_lock held. */
3394 static bool
3395 nfsd_break_deleg_cb(struct file_lock *fl)
3396 {
3397         bool ret = false;
3398         struct nfs4_file *fp = (struct nfs4_file *)fl->fl_owner;
3399         struct nfs4_delegation *dp;
3400
3401         if (!fp) {
3402                 WARN(1, "(%p)->fl_owner NULL\n", fl);
3403                 return ret;
3404         }
3405         if (fp->fi_had_conflict) {
3406                 WARN(1, "duplicate break on %p\n", fp);
3407                 return ret;
3408         }
3409         /*
3410          * We don't want the locks code to timeout the lease for us;
3411          * we'll remove it ourself if a delegation isn't returned
3412          * in time:
3413          */
3414         fl->fl_break_time = 0;
3415
3416         spin_lock(&fp->fi_lock);
3417         fp->fi_had_conflict = true;
3418         /*
3419          * If there are no delegations on the list, then return true
3420          * so that the lease code will go ahead and delete it.
3421          */
3422         if (list_empty(&fp->fi_delegations))
3423                 ret = true;
3424         else
3425                 list_for_each_entry(dp, &fp->fi_delegations, dl_perfile)
3426                         nfsd_break_one_deleg(dp);
3427         spin_unlock(&fp->fi_lock);
3428         return ret;
3429 }
3430
3431 static int
3432 nfsd_change_deleg_cb(struct file_lock **onlist, int arg, struct list_head *dispose)
3433 {
3434         if (arg & F_UNLCK)
3435                 return lease_modify(onlist, arg, dispose);
3436         else
3437                 return -EAGAIN;
3438 }
3439
3440 static const struct lock_manager_operations nfsd_lease_mng_ops = {
3441         .lm_break = nfsd_break_deleg_cb,
3442         .lm_change = nfsd_change_deleg_cb,
3443 };
3444
3445 static __be32 nfsd4_check_seqid(struct nfsd4_compound_state *cstate, struct nfs4_stateowner *so, u32 seqid)
3446 {
3447         if (nfsd4_has_session(cstate))
3448                 return nfs_ok;
3449         if (seqid == so->so_seqid - 1)
3450                 return nfserr_replay_me;
3451         if (seqid == so->so_seqid)
3452                 return nfs_ok;
3453         return nfserr_bad_seqid;
3454 }
3455
3456 static __be32 lookup_clientid(clientid_t *clid,
3457                 struct nfsd4_compound_state *cstate,
3458                 struct nfsd_net *nn)
3459 {
3460         struct nfs4_client *found;
3461
3462         if (cstate->clp) {
3463                 found = cstate->clp;
3464                 if (!same_clid(&found->cl_clientid, clid))
3465                         return nfserr_stale_clientid;
3466                 return nfs_ok;
3467         }
3468
3469         if (STALE_CLIENTID(clid, nn))
3470                 return nfserr_stale_clientid;
3471
3472         /*
3473          * For v4.1+ we get the client in the SEQUENCE op. If we don't have one
3474          * cached already then we know this is for is for v4.0 and "sessions"
3475          * will be false.
3476          */
3477         WARN_ON_ONCE(cstate->session);
3478         spin_lock(&nn->client_lock);
3479         found = find_confirmed_client(clid, false, nn);
3480         if (!found) {
3481                 spin_unlock(&nn->client_lock);
3482                 return nfserr_expired;
3483         }
3484         atomic_inc(&found->cl_refcount);
3485         spin_unlock(&nn->client_lock);
3486
3487         /* Cache the nfs4_client in cstate! */
3488         cstate->clp = found;
3489         return nfs_ok;
3490 }
3491
3492 __be32
3493 nfsd4_process_open1(struct nfsd4_compound_state *cstate,
3494                     struct nfsd4_open *open, struct nfsd_net *nn)
3495 {
3496         clientid_t *clientid = &open->op_clientid;
3497         struct nfs4_client *clp = NULL;
3498         unsigned int strhashval;
3499         struct nfs4_openowner *oo = NULL;
3500         __be32 status;
3501
3502         if (STALE_CLIENTID(&open->op_clientid, nn))
3503                 return nfserr_stale_clientid;
3504         /*
3505          * In case we need it later, after we've already created the
3506          * file and don't want to risk a further failure:
3507          */
3508         open->op_file = nfsd4_alloc_file();
3509         if (open->op_file == NULL)
3510                 return nfserr_jukebox;
3511
3512         status = lookup_clientid(clientid, cstate, nn);
3513         if (status)
3514                 return status;
3515         clp = cstate->clp;
3516
3517         strhashval = ownerstr_hashval(&open->op_owner);
3518         oo = find_openstateowner_str(strhashval, open, clp);
3519         open->op_openowner = oo;
3520         if (!oo) {
3521                 goto new_owner;
3522         }
3523         if (!(oo->oo_flags & NFS4_OO_CONFIRMED)) {
3524                 /* Replace unconfirmed owners without checking for replay. */
3525                 release_openowner(oo);
3526                 open->op_openowner = NULL;
3527                 goto new_owner;
3528         }
3529         status = nfsd4_check_seqid(cstate, &oo->oo_owner, open->op_seqid);
3530         if (status)
3531                 return status;
3532         goto alloc_stateid;
3533 new_owner:
3534         oo = alloc_init_open_stateowner(strhashval, open, cstate);
3535         if (oo == NULL)
3536                 return nfserr_jukebox;
3537         open->op_openowner = oo;
3538 alloc_stateid:
3539         open->op_stp = nfs4_alloc_open_stateid(clp);
3540         if (!open->op_stp)
3541                 return nfserr_jukebox;
3542         return nfs_ok;
3543 }
3544
3545 static inline __be32
3546 nfs4_check_delegmode(struct nfs4_delegation *dp, int flags)
3547 {
3548         if ((flags & WR_STATE) && (dp->dl_type == NFS4_OPEN_DELEGATE_READ))
3549                 return nfserr_openmode;
3550         else
3551                 return nfs_ok;
3552 }
3553
3554 static int share_access_to_flags(u32 share_access)
3555 {
3556         return share_access == NFS4_SHARE_ACCESS_READ ? RD_STATE : WR_STATE;
3557 }
3558
3559 static struct nfs4_delegation *find_deleg_stateid(struct nfs4_client *cl, stateid_t *s)
3560 {
3561         struct nfs4_stid *ret;
3562
3563         ret = find_stateid_by_type(cl, s, NFS4_DELEG_STID);
3564         if (!ret)
3565                 return NULL;
3566         return delegstateid(ret);
3567 }
3568
3569 static bool nfsd4_is_deleg_cur(struct nfsd4_open *open)
3570 {
3571         return open->op_claim_type == NFS4_OPEN_CLAIM_DELEGATE_CUR ||
3572                open->op_claim_type == NFS4_OPEN_CLAIM_DELEG_CUR_FH;
3573 }
3574
3575 static __be32
3576 nfs4_check_deleg(struct nfs4_client *cl, struct nfsd4_open *open,
3577                 struct nfs4_delegation **dp)
3578 {
3579         int flags;
3580         __be32 status = nfserr_bad_stateid;
3581         struct nfs4_delegation *deleg;
3582
3583         deleg = find_deleg_stateid(cl, &open->op_delegate_stateid);
3584         if (deleg == NULL)
3585                 goto out;
3586         flags = share_access_to_flags(open->op_share_access);
3587         status = nfs4_check_delegmode(deleg, flags);
3588         if (status) {
3589                 nfs4_put_stid(&deleg->dl_stid);
3590                 goto out;
3591         }
3592         *dp = deleg;
3593 out:
3594         if (!nfsd4_is_deleg_cur(open))
3595                 return nfs_ok;
3596         if (status)
3597                 return status;
3598         open->op_openowner->oo_flags |= NFS4_OO_CONFIRMED;
3599         return nfs_ok;
3600 }
3601
3602 static struct nfs4_ol_stateid *
3603 nfsd4_find_existing_open(struct nfs4_file *fp, struct nfsd4_open *open)
3604 {
3605         struct nfs4_ol_stateid *local, *ret = NULL;
3606         struct nfs4_openowner *oo = open->op_openowner;
3607
3608         spin_lock(&fp->fi_lock);
3609         list_for_each_entry(local, &fp->fi_stateids, st_perfile) {
3610                 /* ignore lock owners */
3611                 if (local->st_stateowner->so_is_open_owner == 0)
3612                         continue;
3613                 if (local->st_stateowner == &oo->oo_owner) {
3614                         ret = local;
3615                         atomic_inc(&ret->st_stid.sc_count);
3616                         break;
3617                 }
3618         }
3619         spin_unlock(&fp->fi_lock);
3620         return ret;
3621 }
3622
3623 static inline int nfs4_access_to_access(u32 nfs4_access)
3624 {
3625         int flags = 0;
3626
3627         if (nfs4_access & NFS4_SHARE_ACCESS_READ)
3628                 flags |= NFSD_MAY_READ;
3629         if (nfs4_access & NFS4_SHARE_ACCESS_WRITE)
3630                 flags |= NFSD_MAY_WRITE;
3631         return flags;
3632 }
3633
3634 static inline __be32
3635 nfsd4_truncate(struct svc_rqst *rqstp, struct svc_fh *fh,
3636                 struct nfsd4_open *open)
3637 {
3638         struct iattr iattr = {
3639                 .ia_valid = ATTR_SIZE,
3640                 .ia_size = 0,
3641         };
3642         if (!open->op_truncate)
3643                 return 0;
3644         if (!(open->op_share_access & NFS4_SHARE_ACCESS_WRITE))
3645                 return nfserr_inval;
3646         return nfsd_setattr(rqstp, fh, &iattr, 0, (time_t)0);
3647 }
3648
3649 static __be32 nfs4_get_vfs_file(struct svc_rqst *rqstp, struct nfs4_file *fp,
3650                 struct svc_fh *cur_fh, struct nfs4_ol_stateid *stp,
3651                 struct nfsd4_open *open)
3652 {
3653         struct file *filp = NULL;
3654         __be32 status;
3655         int oflag = nfs4_access_to_omode(open->op_share_access);
3656         int access = nfs4_access_to_access(open->op_share_access);
3657         unsigned char old_access_bmap, old_deny_bmap;
3658
3659         spin_lock(&fp->fi_lock);
3660
3661         /*
3662          * Are we trying to set a deny mode that would conflict with
3663          * current access?
3664          */
3665         status = nfs4_file_check_deny(fp, open->op_share_deny);
3666         if (status != nfs_ok) {
3667                 spin_unlock(&fp->fi_lock);
3668                 goto out;
3669         }
3670
3671         /* set access to the file */
3672         status = nfs4_file_get_access(fp, open->op_share_access);
3673         if (status != nfs_ok) {
3674                 spin_unlock(&fp->fi_lock);
3675                 goto out;
3676         }
3677
3678         /* Set access bits in stateid */
3679         old_access_bmap = stp->st_access_bmap;
3680         set_access(open->op_share_access, stp);
3681
3682         /* Set new deny mask */
3683         old_deny_bmap = stp->st_deny_bmap;
3684         set_deny(open->op_share_deny, stp);
3685         fp->fi_share_deny |= (open->op_share_deny & NFS4_SHARE_DENY_BOTH);
3686
3687         if (!fp->fi_fds[oflag]) {
3688                 spin_unlock(&fp->fi_lock);
3689                 status = nfsd_open(rqstp, cur_fh, S_IFREG, access, &filp);
3690                 if (status)
3691                         goto out_put_access;
3692                 spin_lock(&fp->fi_lock);
3693                 if (!fp->fi_fds[oflag]) {
3694                         fp->fi_fds[oflag] = filp;
3695                         filp = NULL;
3696                 }
3697         }
3698         spin_unlock(&fp->fi_lock);
3699         if (filp)
3700                 fput(filp);
3701
3702         status = nfsd4_truncate(rqstp, cur_fh, open);
3703         if (status)
3704                 goto out_put_access;
3705 out:
3706         return status;
3707 out_put_access:
3708         stp->st_access_bmap = old_access_bmap;
3709         nfs4_file_put_access(fp, open->op_share_access);
3710         reset_union_bmap_deny(bmap_to_share_mode(old_deny_bmap), stp);
3711         goto out;
3712 }
3713
3714 static __be32
3715 nfs4_upgrade_open(struct svc_rqst *rqstp, struct nfs4_file *fp, struct svc_fh *cur_fh, struct nfs4_ol_stateid *stp, struct nfsd4_open *open)
3716 {
3717         __be32 status;
3718         unsigned char old_deny_bmap;
3719
3720         if (!test_access(open->op_share_access, stp))
3721                 return nfs4_get_vfs_file(rqstp, fp, cur_fh, stp, open);
3722
3723         /* test and set deny mode */
3724         spin_lock(&fp->fi_lock);
3725         status = nfs4_file_check_deny(fp, open->op_share_deny);
3726         if (status == nfs_ok) {
3727                 old_deny_bmap = stp->st_deny_bmap;
3728                 set_deny(open->op_share_deny, stp);
3729                 fp->fi_share_deny |=
3730                                 (open->op_share_deny & NFS4_SHARE_DENY_BOTH);
3731         }
3732         spin_unlock(&fp->fi_lock);
3733
3734         if (status != nfs_ok)
3735                 return status;
3736
3737         status = nfsd4_truncate(rqstp, cur_fh, open);
3738         if (status != nfs_ok)
3739                 reset_union_bmap_deny(old_deny_bmap, stp);
3740         return status;
3741 }
3742
3743 static void
3744 nfs4_set_claim_prev(struct nfsd4_open *open, bool has_session)
3745 {
3746         open->op_openowner->oo_flags |= NFS4_OO_CONFIRMED;
3747 }
3748
3749 /* Should we give out recallable state?: */
3750 static bool nfsd4_cb_channel_good(struct nfs4_client *clp)
3751 {
3752         if (clp->cl_cb_state == NFSD4_CB_UP)
3753                 return true;
3754         /*
3755          * In the sessions case, since we don't have to establish a
3756          * separate connection for callbacks, we assume it's OK
3757          * until we hear otherwise:
3758          */
3759         return clp->cl_minorversion && clp->cl_cb_state == NFSD4_CB_UNKNOWN;
3760 }
3761
3762 static struct file_lock *nfs4_alloc_init_lease(struct nfs4_file *fp, int flag)
3763 {
3764         struct file_lock *fl;
3765
3766         fl = locks_alloc_lock();
3767         if (!fl)
3768                 return NULL;
3769         fl->fl_lmops = &nfsd_lease_mng_ops;
3770         fl->fl_flags = FL_DELEG;
3771         fl->fl_type = flag == NFS4_OPEN_DELEGATE_READ? F_RDLCK: F_WRLCK;
3772         fl->fl_end = OFFSET_MAX;
3773         fl->fl_owner = (fl_owner_t)fp;
3774         fl->fl_pid = current->tgid;
3775         return fl;
3776 }
3777
3778 static int nfs4_setlease(struct nfs4_delegation *dp)
3779 {
3780         struct nfs4_file *fp = dp->dl_stid.sc_file;
3781         struct file_lock *fl, *ret;
3782         struct file *filp;
3783         int status = 0;
3784
3785         fl = nfs4_alloc_init_lease(fp, NFS4_OPEN_DELEGATE_READ);
3786         if (!fl)
3787                 return -ENOMEM;
3788         filp = find_readable_file(fp);
3789         if (!filp) {
3790                 /* We should always have a readable file here */
3791                 WARN_ON_ONCE(1);
3792                 return -EBADF;
3793         }
3794         fl->fl_file = filp;
3795         ret = fl;
3796         status = vfs_setlease(filp, fl->fl_type, &fl, NULL);
3797         if (fl)
3798                 locks_free_lock(fl);
3799         if (status)
3800                 goto out_fput;
3801         spin_lock(&state_lock);
3802         spin_lock(&fp->fi_lock);
3803         /* Did the lease get broken before we took the lock? */
3804         status = -EAGAIN;
3805         if (fp->fi_had_conflict)
3806                 goto out_unlock;
3807         /* Race breaker */
3808         if (fp->fi_deleg_file) {
3809                 status = 0;
3810                 atomic_inc(&fp->fi_delegees);
3811                 hash_delegation_locked(dp, fp);
3812                 goto out_unlock;
3813         }
3814         fp->fi_deleg_file = filp;
3815         atomic_set(&fp->fi_delegees, 1);
3816         hash_delegation_locked(dp, fp);
3817         spin_unlock(&fp->fi_lock);
3818         spin_unlock(&state_lock);
3819         return 0;
3820 out_unlock:
3821         spin_unlock(&fp->fi_lock);
3822         spin_unlock(&state_lock);
3823 out_fput:
3824         fput(filp);
3825         return status;
3826 }
3827
3828 static struct nfs4_delegation *
3829 nfs4_set_delegation(struct nfs4_client *clp, struct svc_fh *fh,
3830                     struct nfs4_file *fp)
3831 {
3832         int status;
3833         struct nfs4_delegation *dp;
3834
3835         if (fp->fi_had_conflict)
3836                 return ERR_PTR(-EAGAIN);
3837
3838         dp = alloc_init_deleg(clp, fh);
3839         if (!dp)
3840                 return ERR_PTR(-ENOMEM);
3841
3842         get_nfs4_file(fp);
3843         spin_lock(&state_lock);
3844         spin_lock(&fp->fi_lock);
3845         dp->dl_stid.sc_file = fp;
3846         if (!fp->fi_deleg_file) {
3847                 spin_unlock(&fp->fi_lock);
3848                 spin_unlock(&state_lock);
3849                 status = nfs4_setlease(dp);
3850                 goto out;
3851         }
3852         atomic_inc(&fp->fi_delegees);
3853         if (fp->fi_had_conflict) {
3854                 status = -EAGAIN;
3855                 goto out_unlock;
3856         }
3857         hash_delegation_locked(dp, fp);
3858         status = 0;
3859 out_unlock:
3860         spin_unlock(&fp->fi_lock);
3861         spin_unlock(&state_lock);
3862 out:
3863         if (status) {
3864                 nfs4_put_stid(&dp->dl_stid);
3865                 return ERR_PTR(status);
3866         }
3867         return dp;
3868 }
3869
3870 static void nfsd4_open_deleg_none_ext(struct nfsd4_open *open, int status)
3871 {
3872         open->op_delegate_type = NFS4_OPEN_DELEGATE_NONE_EXT;
3873         if (status == -EAGAIN)
3874                 open->op_why_no_deleg = WND4_CONTENTION;
3875         else {
3876                 open->op_why_no_deleg = WND4_RESOURCE;
3877                 switch (open->op_deleg_want) {
3878                 case NFS4_SHARE_WANT_READ_DELEG:
3879                 case NFS4_SHARE_WANT_WRITE_DELEG:
3880                 case NFS4_SHARE_WANT_ANY_DELEG:
3881                         break;
3882                 case NFS4_SHARE_WANT_CANCEL:
3883                         open->op_why_no_deleg = WND4_CANCELLED;
3884                         break;
3885                 case NFS4_SHARE_WANT_NO_DELEG:
3886                         WARN_ON_ONCE(1);
3887                 }
3888         }
3889 }
3890
3891 /*
3892  * Attempt to hand out a delegation.
3893  *
3894  * Note we don't support write delegations, and won't until the vfs has
3895  * proper support for them.
3896  */
3897 static void
3898 nfs4_open_delegation(struct svc_fh *fh, struct nfsd4_open *open,
3899                         struct nfs4_ol_stateid *stp)
3900 {
3901         struct nfs4_delegation *dp;
3902         struct nfs4_openowner *oo = openowner(stp->st_stateowner);
3903         struct nfs4_client *clp = stp->st_stid.sc_client;
3904         int cb_up;
3905         int status = 0;
3906
3907         cb_up = nfsd4_cb_channel_good(oo->oo_owner.so_client);
3908         open->op_recall = 0;
3909         switch (open->op_claim_type) {
3910                 case NFS4_OPEN_CLAIM_PREVIOUS:
3911                         if (!cb_up)
3912                                 open->op_recall = 1;
3913                         if (open->op_delegate_type != NFS4_OPEN_DELEGATE_READ)
3914                                 goto out_no_deleg;
3915                         break;
3916                 case NFS4_OPEN_CLAIM_NULL:
3917                 case NFS4_OPEN_CLAIM_FH:
3918                         /*
3919                          * Let's not give out any delegations till everyone's
3920                          * had the chance to reclaim theirs....
3921                          */
3922                         if (locks_in_grace(clp->net))
3923                                 goto out_no_deleg;
3924                         if (!cb_up || !(oo->oo_flags & NFS4_OO_CONFIRMED))
3925                                 goto out_no_deleg;
3926                         /*
3927                          * Also, if the file was opened for write or
3928                          * create, there's a good chance the client's
3929                          * about to write to it, resulting in an
3930                          * immediate recall (since we don't support
3931                          * write delegations):
3932                          */
3933                         if (open->op_share_access & NFS4_SHARE_ACCESS_WRITE)
3934                                 goto out_no_deleg;
3935                         if (open->op_create == NFS4_OPEN_CREATE)
3936                                 goto out_no_deleg;
3937                         break;
3938                 default:
3939                         goto out_no_deleg;
3940         }
3941         dp = nfs4_set_delegation(clp, fh, stp->st_stid.sc_file);
3942         if (IS_ERR(dp))
3943                 goto out_no_deleg;
3944
3945         memcpy(&open->op_delegate_stateid, &dp->dl_stid.sc_stateid, sizeof(dp->dl_stid.sc_stateid));
3946
3947         dprintk("NFSD: delegation stateid=" STATEID_FMT "\n",
3948                 STATEID_VAL(&dp->dl_stid.sc_stateid));
3949         open->op_delegate_type = NFS4_OPEN_DELEGATE_READ;
3950         nfs4_put_stid(&dp->dl_stid);
3951         return;
3952 out_no_deleg:
3953         open->op_delegate_type = NFS4_OPEN_DELEGATE_NONE;
3954         if (open->op_claim_type == NFS4_OPEN_CLAIM_PREVIOUS &&
3955             open->op_delegate_type != NFS4_OPEN_DELEGATE_NONE) {
3956                 dprintk("NFSD: WARNING: refusing delegation reclaim\n");
3957                 open->op_recall = 1;
3958         }
3959
3960         /* 4.1 client asking for a delegation? */
3961         if (open->op_deleg_want)
3962                 nfsd4_open_deleg_none_ext(open, status);
3963         return;
3964 }
3965
3966 static void nfsd4_deleg_xgrade_none_ext(struct nfsd4_open *open,
3967                                         struct nfs4_delegation *dp)
3968 {
3969         if (open->op_deleg_want == NFS4_SHARE_WANT_READ_DELEG &&
3970             dp->dl_type == NFS4_OPEN_DELEGATE_WRITE) {
3971                 open->op_delegate_type = NFS4_OPEN_DELEGATE_NONE_EXT;
3972                 open->op_why_no_deleg = WND4_NOT_SUPP_DOWNGRADE;
3973         } else if (open->op_deleg_want == NFS4_SHARE_WANT_WRITE_DELEG &&
3974                    dp->dl_type == NFS4_OPEN_DELEGATE_WRITE) {
3975                 open->op_delegate_type = NFS4_OPEN_DELEGATE_NONE_EXT;
3976                 open->op_why_no_deleg = WND4_NOT_SUPP_UPGRADE;
3977         }
3978         /* Otherwise the client must be confused wanting a delegation
3979          * it already has, therefore we don't return
3980          * NFS4_OPEN_DELEGATE_NONE_EXT and reason.
3981          */
3982 }
3983
3984 __be32
3985 nfsd4_process_open2(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_open *open)
3986 {
3987         struct nfsd4_compoundres *resp = rqstp->rq_resp;
3988         struct nfs4_client *cl = open->op_openowner->oo_owner.so_client;
3989         struct nfs4_file *fp = NULL;
3990         struct nfs4_ol_stateid *stp = NULL;
3991         struct nfs4_delegation *dp = NULL;
3992         __be32 status;
3993
3994         /*
3995          * Lookup file; if found, lookup stateid and check open request,
3996          * and check for delegations in the process of being recalled.
3997          * If not found, create the nfs4_file struct
3998          */
3999         fp = find_or_add_file(open->op_file, &current_fh->fh_handle);
4000         if (fp != open->op_file) {
4001                 status = nfs4_check_deleg(cl, open, &dp);
4002                 if (status)
4003                         goto out;
4004                 stp = nfsd4_find_existing_open(fp, open);
4005         } else {
4006                 open->op_file = NULL;
4007                 status = nfserr_bad_stateid;
4008                 if (nfsd4_is_deleg_cur(open))
4009                         goto out;
4010                 status = nfserr_jukebox;
4011         }
4012
4013         /*
4014          * OPEN the file, or upgrade an existing OPEN.
4015          * If truncate fails, the OPEN fails.
4016          */
4017         if (stp) {
4018                 /* Stateid was found, this is an OPEN upgrade */
4019                 status = nfs4_upgrade_open(rqstp, fp, current_fh, stp, open);
4020                 if (status)
4021                         goto out;
4022         } else {
4023                 stp = open->op_stp;
4024                 open->op_stp = NULL;
4025                 init_open_stateid(stp, fp, open);
4026                 status = nfs4_get_vfs_file(rqstp, fp, current_fh, stp, open);
4027                 if (status) {
4028                         release_open_stateid(stp);
4029                         goto out;
4030                 }
4031         }
4032         update_stateid(&stp->st_stid.sc_stateid);
4033         memcpy(&open->op_stateid, &stp->st_stid.sc_stateid, sizeof(stateid_t));
4034
4035         if (nfsd4_has_session(&resp->cstate)) {
4036                 if (open->op_deleg_want & NFS4_SHARE_WANT_NO_DELEG) {
4037                         open->op_delegate_type = NFS4_OPEN_DELEGATE_NONE_EXT;
4038                         open->op_why_no_deleg = WND4_NOT_WANTED;
4039                         goto nodeleg;
4040                 }
4041         }
4042
4043         /*
4044         * Attempt to hand out a delegation. No error return, because the
4045         * OPEN succeeds even if we fail.
4046         */
4047         nfs4_open_delegation(current_fh, open, stp);
4048 nodeleg:
4049         status = nfs_ok;
4050
4051         dprintk("%s: stateid=" STATEID_FMT "\n", __func__,
4052                 STATEID_VAL(&stp->st_stid.sc_stateid));
4053 out:
4054         /* 4.1 client trying to upgrade/downgrade delegation? */
4055         if (open->op_delegate_type == NFS4_OPEN_DELEGATE_NONE && dp &&
4056             open->op_deleg_want)
4057                 nfsd4_deleg_xgrade_none_ext(open, dp);
4058
4059         if (fp)
4060                 put_nfs4_file(fp);
4061         if (status == 0 && open->op_claim_type == NFS4_OPEN_CLAIM_PREVIOUS)
4062                 nfs4_set_claim_prev(open, nfsd4_has_session(&resp->cstate));
4063         /*
4064         * To finish the open response, we just need to set the rflags.
4065         */
4066         open->op_rflags = NFS4_OPEN_RESULT_LOCKTYPE_POSIX;
4067         if (!(open->op_openowner->oo_flags & NFS4_OO_CONFIRMED) &&
4068             !nfsd4_has_session(&resp->cstate))
4069                 open->op_rflags |= NFS4_OPEN_RESULT_CONFIRM;
4070         if (dp)
4071                 nfs4_put_stid(&dp->dl_stid);
4072         if (stp)
4073                 nfs4_put_stid(&stp->st_stid);
4074
4075         return status;
4076 }
4077
4078 void nfsd4_cleanup_open_state(struct nfsd4_compound_state *cstate,
4079                               struct nfsd4_open *open, __be32 status)
4080 {
4081         if (open->op_openowner) {
4082                 struct nfs4_stateowner *so = &open->op_openowner->oo_owner;
4083
4084                 nfsd4_cstate_assign_replay(cstate, so);
4085                 nfs4_put_stateowner(so);
4086         }
4087         if (open->op_file)
4088                 nfsd4_free_file(open->op_file);
4089         if (open->op_stp)
4090                 nfs4_put_stid(&open->op_stp->st_stid);
4091 }
4092
4093 __be32
4094 nfsd4_renew(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
4095             clientid_t *clid)
4096 {
4097         struct nfs4_client *clp;
4098         __be32 status;
4099         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
4100
4101         dprintk("process_renew(%08x/%08x): starting\n",
4102                         clid->cl_boot, clid->cl_id);
4103         status = lookup_clientid(clid, cstate, nn);
4104         if (status)
4105                 goto out;
4106         clp = cstate->clp;
4107         status = nfserr_cb_path_down;
4108         if (!list_empty(&clp->cl_delegations)
4109                         && clp->cl_cb_state != NFSD4_CB_UP)
4110                 goto out;
4111         status = nfs_ok;
4112 out:
4113         return status;
4114 }
4115
4116 static void
4117 nfsd4_end_grace(struct nfsd_net *nn)
4118 {
4119         /* do nothing if grace period already ended */
4120         if (nn->grace_ended)
4121                 return;
4122
4123         dprintk("NFSD: end of grace period\n");
4124         nn->grace_ended = true;
4125         nfsd4_record_grace_done(nn, nn->boot_time);
4126         locks_end_grace(&nn->nfsd4_manager);
4127         /*
4128          * Now that every NFSv4 client has had the chance to recover and
4129          * to see the (possibly new, possibly shorter) lease time, we
4130          * can safely set the next grace time to the current lease time:
4131          */
4132         nn->nfsd4_grace = nn->nfsd4_lease;
4133 }
4134
4135 static time_t
4136 nfs4_laundromat(struct nfsd_net *nn)
4137 {
4138         struct nfs4_client *clp;
4139         struct nfs4_openowner *oo;
4140         struct nfs4_delegation *dp;
4141         struct nfs4_ol_stateid *stp;
4142         struct list_head *pos, *next, reaplist;
4143         time_t cutoff = get_seconds() - nn->nfsd4_lease;
4144         time_t t, new_timeo = nn->nfsd4_lease;
4145
4146         dprintk("NFSD: laundromat service - starting\n");
4147         nfsd4_end_grace(nn);
4148         INIT_LIST_HEAD(&reaplist);
4149         spin_lock(&nn->client_lock);
4150         list_for_each_safe(pos, next, &nn->client_lru) {
4151                 clp = list_entry(pos, struct nfs4_client, cl_lru);
4152                 if (time_after((unsigned long)clp->cl_time, (unsigned long)cutoff)) {
4153                         t = clp->cl_time - cutoff;
4154                         new_timeo = min(new_timeo, t);
4155                         break;
4156                 }
4157                 if (mark_client_expired_locked(clp)) {
4158                         dprintk("NFSD: client in use (clientid %08x)\n",
4159                                 clp->cl_clientid.cl_id);
4160                         continue;
4161                 }
4162                 list_add(&clp->cl_lru, &reaplist);
4163         }
4164         spin_unlock(&nn->client_lock);
4165         list_for_each_safe(pos, next, &reaplist) {
4166                 clp = list_entry(pos, struct nfs4_client, cl_lru);
4167                 dprintk("NFSD: purging unused client (clientid %08x)\n",
4168                         clp->cl_clientid.cl_id);
4169                 list_del_init(&clp->cl_lru);
4170                 expire_client(clp);
4171         }
4172         spin_lock(&state_lock);
4173         list_for_each_safe(pos, next, &nn->del_recall_lru) {
4174                 dp = list_entry (pos, struct nfs4_delegation, dl_recall_lru);
4175                 if (net_generic(dp->dl_stid.sc_client->net, nfsd_net_id) != nn)
4176                         continue;
4177                 if (time_after((unsigned long)dp->dl_time, (unsigned long)cutoff)) {
4178                         t = dp->dl_time - cutoff;
4179                         new_timeo = min(new_timeo, t);
4180                         break;
4181                 }
4182                 unhash_delegation_locked(dp);
4183                 list_add(&dp->dl_recall_lru, &reaplist);
4184         }
4185         spin_unlock(&state_lock);
4186         while (!list_empty(&reaplist)) {
4187                 dp = list_first_entry(&reaplist, struct nfs4_delegation,
4188                                         dl_recall_lru);
4189                 list_del_init(&dp->dl_recall_lru);
4190                 revoke_delegation(dp);
4191         }
4192
4193         spin_lock(&nn->client_lock);
4194         while (!list_empty(&nn->close_lru)) {
4195                 oo = list_first_entry(&nn->close_lru, struct nfs4_openowner,
4196                                         oo_close_lru);
4197                 if (time_after((unsigned long)oo->oo_time,
4198                                (unsigned long)cutoff)) {
4199                         t = oo->oo_time - cutoff;
4200                         new_timeo = min(new_timeo, t);
4201                         break;
4202                 }
4203                 list_del_init(&oo->oo_close_lru);
4204                 stp = oo->oo_last_closed_stid;
4205                 oo->oo_last_closed_stid = NULL;
4206                 spin_unlock(&nn->client_lock);
4207                 nfs4_put_stid(&stp->st_stid);
4208                 spin_lock(&nn->client_lock);
4209         }
4210         spin_unlock(&nn->client_lock);
4211
4212         new_timeo = max_t(time_t, new_timeo, NFSD_LAUNDROMAT_MINTIMEOUT);
4213         return new_timeo;
4214 }
4215
4216 static struct workqueue_struct *laundry_wq;
4217 static void laundromat_main(struct work_struct *);
4218
4219 static void
4220 laundromat_main(struct work_struct *laundry)
4221 {
4222         time_t t;
4223         struct delayed_work *dwork = container_of(laundry, struct delayed_work,
4224                                                   work);
4225         struct nfsd_net *nn = container_of(dwork, struct nfsd_net,
4226                                            laundromat_work);
4227
4228         t = nfs4_laundromat(nn);
4229         dprintk("NFSD: laundromat_main - sleeping for %ld seconds\n", t);
4230         queue_delayed_work(laundry_wq, &nn->laundromat_work, t*HZ);
4231 }
4232
4233 static inline __be32 nfs4_check_fh(struct svc_fh *fhp, struct nfs4_ol_stateid *stp)
4234 {
4235         if (!nfsd_fh_match(&fhp->fh_handle, &stp->st_stid.sc_file->fi_fhandle))
4236                 return nfserr_bad_stateid;
4237         return nfs_ok;
4238 }
4239
4240 static inline int
4241 access_permit_read(struct nfs4_ol_stateid *stp)
4242 {
4243         return test_access(NFS4_SHARE_ACCESS_READ, stp) ||
4244                 test_access(NFS4_SHARE_ACCESS_BOTH, stp) ||
4245                 test_access(NFS4_SHARE_ACCESS_WRITE, stp);
4246 }
4247
4248 static inline int
4249 access_permit_write(struct nfs4_ol_stateid *stp)
4250 {
4251         return test_access(NFS4_SHARE_ACCESS_WRITE, stp) ||
4252                 test_access(NFS4_SHARE_ACCESS_BOTH, stp);
4253 }
4254
4255 static
4256 __be32 nfs4_check_openmode(struct nfs4_ol_stateid *stp, int flags)
4257 {
4258         __be32 status = nfserr_openmode;
4259
4260         /* For lock stateid's, we test the parent open, not the lock: */
4261         if (stp->st_openstp)
4262                 stp = stp->st_openstp;
4263         if ((flags & WR_STATE) && !access_permit_write(stp))
4264                 goto out;
4265         if ((flags & RD_STATE) && !access_permit_read(stp))
4266                 goto out;
4267         status = nfs_ok;
4268 out:
4269         return status;
4270 }
4271
4272 static inline __be32
4273 check_special_stateids(struct net *net, svc_fh *current_fh, stateid_t *stateid, int flags)
4274 {
4275         if (ONE_STATEID(stateid) && (flags & RD_STATE))
4276                 return nfs_ok;
4277         else if (locks_in_grace(net)) {
4278                 /* Answer in remaining cases depends on existence of
4279                  * conflicting state; so we must wait out the grace period. */
4280                 return nfserr_grace;
4281         } else if (flags & WR_STATE)
4282                 return nfs4_share_conflict(current_fh,
4283                                 NFS4_SHARE_DENY_WRITE);
4284         else /* (flags & RD_STATE) && ZERO_STATEID(stateid) */
4285                 return nfs4_share_conflict(current_fh,
4286                                 NFS4_SHARE_DENY_READ);
4287 }
4288
4289 /*
4290  * Allow READ/WRITE during grace period on recovered state only for files
4291  * that are not able to provide mandatory locking.
4292  */
4293 static inline int
4294 grace_disallows_io(struct net *net, struct inode *inode)
4295 {
4296         return locks_in_grace(net) && mandatory_lock(inode);
4297 }
4298
4299 /* Returns true iff a is later than b: */
4300 static bool stateid_generation_after(stateid_t *a, stateid_t *b)
4301 {
4302         return (s32)(a->si_generation - b->si_generation) > 0;
4303 }
4304
4305 static __be32 check_stateid_generation(stateid_t *in, stateid_t *ref, bool has_session)
4306 {
4307         /*
4308          * When sessions are used the stateid generation number is ignored
4309          * when it is zero.
4310          */
4311         if (has_session && in->si_generation == 0)
4312                 return nfs_ok;
4313
4314         if (in->si_generation == ref->si_generation)
4315                 return nfs_ok;
4316
4317         /* If the client sends us a stateid from the future, it's buggy: */
4318         if (stateid_generation_after(in, ref))
4319                 return nfserr_bad_stateid;
4320         /*
4321          * However, we could see a stateid from the past, even from a
4322          * non-buggy client.  For example, if the client sends a lock
4323          * while some IO is outstanding, the lock may bump si_generation
4324          * while the IO is still in flight.  The client could avoid that
4325          * situation by waiting for responses on all the IO requests,
4326          * but better performance may result in retrying IO that
4327          * receives an old_stateid error if requests are rarely
4328          * reordered in flight:
4329          */
4330         return nfserr_old_stateid;
4331 }
4332
4333 static __be32 nfsd4_validate_stateid(struct nfs4_client *cl, stateid_t *stateid)
4334 {
4335         struct nfs4_stid *s;
4336         struct nfs4_ol_stateid *ols;
4337         __be32 status = nfserr_bad_stateid;
4338
4339         if (ZERO_STATEID(stateid) || ONE_STATEID(stateid))
4340                 return status;
4341         /* Client debugging aid. */
4342         if (!same_clid(&stateid->si_opaque.so_clid, &cl->cl_clientid)) {
4343                 char addr_str[INET6_ADDRSTRLEN];
4344                 rpc_ntop((struct sockaddr *)&cl->cl_addr, addr_str,
4345                                  sizeof(addr_str));
4346                 pr_warn_ratelimited("NFSD: client %s testing state ID "
4347                                         "with incorrect client ID\n", addr_str);
4348                 return status;
4349         }
4350         spin_lock(&cl->cl_lock);
4351         s = find_stateid_locked(cl, stateid);
4352         if (!s)
4353                 goto out_unlock;
4354         status = check_stateid_generation(stateid, &s->sc_stateid, 1);
4355         if (status)
4356                 goto out_unlock;
4357         switch (s->sc_type) {
4358         case NFS4_DELEG_STID:
4359                 status = nfs_ok;
4360                 break;
4361         case NFS4_REVOKED_DELEG_STID:
4362                 status = nfserr_deleg_revoked;
4363                 break;
4364         case NFS4_OPEN_STID:
4365         case NFS4_LOCK_STID:
4366                 ols = openlockstateid(s);
4367                 if (ols->st_stateowner->so_is_open_owner
4368                                 && !(openowner(ols->st_stateowner)->oo_flags
4369                                                 & NFS4_OO_CONFIRMED))
4370                         status = nfserr_bad_stateid;
4371                 else
4372                         status = nfs_ok;
4373                 break;
4374         default:
4375                 printk("unknown stateid type %x\n", s->sc_type);
4376                 /* Fallthrough */
4377         case NFS4_CLOSED_STID:
4378         case NFS4_CLOSED_DELEG_STID:
4379                 status = nfserr_bad_stateid;
4380         }
4381 out_unlock:
4382         spin_unlock(&cl->cl_lock);
4383         return status;
4384 }
4385
4386 static __be32
4387 nfsd4_lookup_stateid(struct nfsd4_compound_state *cstate,
4388                      stateid_t *stateid, unsigned char typemask,
4389                      struct nfs4_stid **s, struct nfsd_net *nn)
4390 {
4391         __be32 status;
4392
4393         if (ZERO_STATEID(stateid) || ONE_STATEID(stateid))
4394                 return nfserr_bad_stateid;
4395         status = lookup_clientid(&stateid->si_opaque.so_clid, cstate, nn);
4396         if (status == nfserr_stale_clientid) {
4397                 if (cstate->session)
4398                         return nfserr_bad_stateid;
4399                 return nfserr_stale_stateid;
4400         }
4401         if (status)
4402                 return status;
4403         *s = find_stateid_by_type(cstate->clp, stateid, typemask);
4404         if (!*s)
4405                 return nfserr_bad_stateid;
4406         return nfs_ok;
4407 }
4408
4409 /*
4410 * Checks for stateid operations
4411 */
4412 __be32
4413 nfs4_preprocess_stateid_op(struct net *net, struct nfsd4_compound_state *cstate,
4414                            stateid_t *stateid, int flags, struct file **filpp)
4415 {
4416         struct nfs4_stid *s;
4417         struct nfs4_ol_stateid *stp = NULL;
4418         struct nfs4_delegation *dp = NULL;
4419         struct svc_fh *current_fh = &cstate->current_fh;
4420         struct inode *ino = current_fh->fh_dentry->d_inode;
4421         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
4422         struct file *file = NULL;
4423         __be32 status;
4424
4425         if (filpp)
4426                 *filpp = NULL;
4427
4428         if (grace_disallows_io(net, ino))
4429                 return nfserr_grace;
4430
4431         if (ZERO_STATEID(stateid) || ONE_STATEID(stateid))
4432                 return check_special_stateids(net, current_fh, stateid, flags);
4433
4434         status = nfsd4_lookup_stateid(cstate, stateid,
4435                                 NFS4_DELEG_STID|NFS4_OPEN_STID|NFS4_LOCK_STID,
4436                                 &s, nn);
4437         if (status)
4438                 return status;
4439         status = check_stateid_generation(stateid, &s->sc_stateid, nfsd4_has_session(cstate));
4440         if (status)
4441                 goto out;
4442         switch (s->sc_type) {
4443         case NFS4_DELEG_STID:
4444                 dp = delegstateid(s);
4445                 status = nfs4_check_delegmode(dp, flags);
4446                 if (status)
4447                         goto out;
4448                 if (filpp) {
4449                         file = dp->dl_stid.sc_file->fi_deleg_file;
4450                         if (!file) {
4451                                 WARN_ON_ONCE(1);
4452                                 status = nfserr_serverfault;
4453                                 goto out;
4454                         }
4455                         get_file(file);
4456                 }
4457                 break;
4458         case NFS4_OPEN_STID:
4459         case NFS4_LOCK_STID:
4460                 stp = openlockstateid(s);
4461                 status = nfs4_check_fh(current_fh, stp);
4462                 if (status)
4463                         goto out;
4464                 if (stp->st_stateowner->so_is_open_owner
4465                     && !(openowner(stp->st_stateowner)->oo_flags & NFS4_OO_CONFIRMED))
4466                         goto out;
4467                 status = nfs4_check_openmode(stp, flags);
4468                 if (status)
4469                         goto out;
4470                 if (filpp) {
4471                         struct nfs4_file *fp = stp->st_stid.sc_file;
4472
4473                         if (flags & RD_STATE)
4474                                 file = find_readable_file(fp);
4475                         else
4476                                 file = find_writeable_file(fp);
4477                 }
4478                 break;
4479         default:
4480                 status = nfserr_bad_stateid;
4481                 goto out;
4482         }
4483         status = nfs_ok;
4484         if (file)
4485                 *filpp = file;
4486 out:
4487         nfs4_put_stid(s);
4488         return status;
4489 }
4490
4491 /*
4492  * Test if the stateid is valid
4493  */
4494 __be32
4495 nfsd4_test_stateid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
4496                    struct nfsd4_test_stateid *test_stateid)
4497 {
4498         struct nfsd4_test_stateid_id *stateid;
4499         struct nfs4_client *cl = cstate->session->se_client;
4500
4501         list_for_each_entry(stateid, &test_stateid->ts_stateid_list, ts_id_list)
4502                 stateid->ts_id_status =
4503                         nfsd4_validate_stateid(cl, &stateid->ts_id_stateid);
4504
4505         return nfs_ok;
4506 }
4507
4508 __be32
4509 nfsd4_free_stateid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
4510                    struct nfsd4_free_stateid *free_stateid)
4511 {
4512         stateid_t *stateid = &free_stateid->fr_stateid;
4513         struct nfs4_stid *s;
4514         struct nfs4_delegation *dp;
4515         struct nfs4_ol_stateid *stp;
4516         struct nfs4_client *cl = cstate->session->se_client;
4517         __be32 ret = nfserr_bad_stateid;
4518
4519         spin_lock(&cl->cl_lock);
4520         s = find_stateid_locked(cl, stateid);
4521         if (!s)
4522                 goto out_unlock;
4523         switch (s->sc_type) {
4524         case NFS4_DELEG_STID:
4525                 ret = nfserr_locks_held;
4526                 break;
4527         case NFS4_OPEN_STID:
4528                 ret = check_stateid_generation(stateid, &s->sc_stateid, 1);
4529                 if (ret)
4530                         break;
4531                 ret = nfserr_locks_held;
4532                 break;
4533         case NFS4_LOCK_STID:
4534                 ret = check_stateid_generation(stateid, &s->sc_stateid, 1);
4535                 if (ret)
4536                         break;
4537                 stp = openlockstateid(s);
4538                 ret = nfserr_locks_held;
4539                 if (check_for_locks(stp->st_stid.sc_file,
4540                                     lockowner(stp->st_stateowner)))
4541                         break;
4542                 unhash_lock_stateid(stp);
4543                 spin_unlock(&cl->cl_lock);
4544                 nfs4_put_stid(s);
4545                 ret = nfs_ok;
4546                 goto out;
4547         case NFS4_REVOKED_DELEG_STID:
4548                 dp = delegstateid(s);
4549                 list_del_init(&dp->dl_recall_lru);
4550                 spin_unlock(&cl->cl_lock);
4551                 nfs4_put_stid(s);
4552                 ret = nfs_ok;
4553                 goto out;
4554         /* Default falls through and returns nfserr_bad_stateid */
4555         }
4556 out_unlock:
4557         spin_unlock(&cl->cl_lock);
4558 out:
4559         return ret;
4560 }
4561
4562 static inline int
4563 setlkflg (int type)
4564 {
4565         return (type == NFS4_READW_LT || type == NFS4_READ_LT) ?
4566                 RD_STATE : WR_STATE;
4567 }
4568
4569 static __be32 nfs4_seqid_op_checks(struct nfsd4_compound_state *cstate, stateid_t *stateid, u32 seqid, struct nfs4_ol_stateid *stp)
4570 {
4571         struct svc_fh *current_fh = &cstate->current_fh;
4572         struct nfs4_stateowner *sop = stp->st_stateowner;
4573         __be32 status;
4574
4575         status = nfsd4_check_seqid(cstate, sop, seqid);
4576         if (status)
4577                 return status;
4578         if (stp->st_stid.sc_type == NFS4_CLOSED_STID
4579                 || stp->st_stid.sc_type == NFS4_REVOKED_DELEG_STID)
4580                 /*
4581                  * "Closed" stateid's exist *only* to return
4582                  * nfserr_replay_me from the previous step, and
4583                  * revoked delegations are kept only for free_stateid.
4584                  */
4585                 return nfserr_bad_stateid;
4586         status = check_stateid_generation(stateid, &stp->st_stid.sc_stateid, nfsd4_has_session(cstate));
4587         if (status)
4588                 return status;
4589         return nfs4_check_fh(current_fh, stp);
4590 }
4591
4592 /*
4593  * Checks for sequence id mutating operations.
4594  */
4595 static __be32
4596 nfs4_preprocess_seqid_op(struct nfsd4_compound_state *cstate, u32 seqid,
4597                          stateid_t *stateid, char typemask,
4598                          struct nfs4_ol_stateid **stpp,
4599                          struct nfsd_net *nn)
4600 {
4601         __be32 status;
4602         struct nfs4_stid *s;
4603         struct nfs4_ol_stateid *stp = NULL;
4604
4605         dprintk("NFSD: %s: seqid=%d stateid = " STATEID_FMT "\n", __func__,
4606                 seqid, STATEID_VAL(stateid));
4607
4608         *stpp = NULL;
4609         status = nfsd4_lookup_stateid(cstate, stateid, typemask, &s, nn);
4610         if (status)
4611                 return status;
4612         stp = openlockstateid(s);
4613         nfsd4_cstate_assign_replay(cstate, stp->st_stateowner);
4614
4615         status = nfs4_seqid_op_checks(cstate, stateid, seqid, stp);
4616         if (!status)
4617                 *stpp = stp;
4618         else
4619                 nfs4_put_stid(&stp->st_stid);
4620         return status;
4621 }
4622
4623 static __be32 nfs4_preprocess_confirmed_seqid_op(struct nfsd4_compound_state *cstate, u32 seqid,
4624                                                  stateid_t *stateid, struct nfs4_ol_stateid **stpp, struct nfsd_net *nn)
4625 {
4626         __be32 status;
4627         struct nfs4_openowner *oo;
4628         struct nfs4_ol_stateid *stp;
4629
4630         status = nfs4_preprocess_seqid_op(cstate, seqid, stateid,
4631                                                 NFS4_OPEN_STID, &stp, nn);
4632         if (status)
4633                 return status;
4634         oo = openowner(stp->st_stateowner);
4635         if (!(oo->oo_flags & NFS4_OO_CONFIRMED)) {
4636                 nfs4_put_stid(&stp->st_stid);
4637                 return nfserr_bad_stateid;
4638         }
4639         *stpp = stp;
4640         return nfs_ok;
4641 }
4642
4643 __be32
4644 nfsd4_open_confirm(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
4645                    struct nfsd4_open_confirm *oc)
4646 {
4647         __be32 status;
4648         struct nfs4_openowner *oo;
4649         struct nfs4_ol_stateid *stp;
4650         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
4651
4652         dprintk("NFSD: nfsd4_open_confirm on file %pd\n",
4653                         cstate->current_fh.fh_dentry);
4654
4655         status = fh_verify(rqstp, &cstate->current_fh, S_IFREG, 0);
4656         if (status)
4657                 return status;
4658
4659         status = nfs4_preprocess_seqid_op(cstate,
4660                                         oc->oc_seqid, &oc->oc_req_stateid,
4661                                         NFS4_OPEN_STID, &stp, nn);
4662         if (status)
4663                 goto out;
4664         oo = openowner(stp->st_stateowner);
4665         status = nfserr_bad_stateid;
4666         if (oo->oo_flags & NFS4_OO_CONFIRMED)
4667                 goto put_stateid;
4668         oo->oo_flags |= NFS4_OO_CONFIRMED;
4669         update_stateid(&stp->st_stid.sc_stateid);
4670         memcpy(&oc->oc_resp_stateid, &stp->st_stid.sc_stateid, sizeof(stateid_t));
4671         dprintk("NFSD: %s: success, seqid=%d stateid=" STATEID_FMT "\n",
4672                 __func__, oc->oc_seqid, STATEID_VAL(&stp->st_stid.sc_stateid));
4673
4674         nfsd4_client_record_create(oo->oo_owner.so_client);
4675         status = nfs_ok;
4676 put_stateid:
4677         nfs4_put_stid(&stp->st_stid);
4678 out:
4679         nfsd4_bump_seqid(cstate, status);
4680         return status;
4681 }
4682
4683 static inline void nfs4_stateid_downgrade_bit(struct nfs4_ol_stateid *stp, u32 access)
4684 {
4685         if (!test_access(access, stp))
4686                 return;
4687         nfs4_file_put_access(stp->st_stid.sc_file, access);
4688         clear_access(access, stp);
4689 }
4690
4691 static inline void nfs4_stateid_downgrade(struct nfs4_ol_stateid *stp, u32 to_access)
4692 {
4693         switch (to_access) {
4694         case NFS4_SHARE_ACCESS_READ:
4695                 nfs4_stateid_downgrade_bit(stp, NFS4_SHARE_ACCESS_WRITE);
4696                 nfs4_stateid_downgrade_bit(stp, NFS4_SHARE_ACCESS_BOTH);
4697                 break;
4698         case NFS4_SHARE_ACCESS_WRITE:
4699                 nfs4_stateid_downgrade_bit(stp, NFS4_SHARE_ACCESS_READ);
4700                 nfs4_stateid_downgrade_bit(stp, NFS4_SHARE_ACCESS_BOTH);
4701                 break;
4702         case NFS4_SHARE_ACCESS_BOTH:
4703                 break;
4704         default:
4705                 WARN_ON_ONCE(1);
4706         }
4707 }
4708
4709 __be32
4710 nfsd4_open_downgrade(struct svc_rqst *rqstp,
4711                      struct nfsd4_compound_state *cstate,
4712                      struct nfsd4_open_downgrade *od)
4713 {
4714         __be32 status;
4715         struct nfs4_ol_stateid *stp;
4716         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
4717
4718         dprintk("NFSD: nfsd4_open_downgrade on file %pd\n",
4719                         cstate->current_fh.fh_dentry);
4720
4721         /* We don't yet support WANT bits: */
4722         if (od->od_deleg_want)
4723                 dprintk("NFSD: %s: od_deleg_want=0x%x ignored\n", __func__,
4724                         od->od_deleg_want);
4725
4726         status = nfs4_preprocess_confirmed_seqid_op(cstate, od->od_seqid,
4727                                         &od->od_stateid, &stp, nn);
4728         if (status)
4729                 goto out;
4730         status = nfserr_inval;
4731         if (!test_access(od->od_share_access, stp)) {
4732                 dprintk("NFSD: access not a subset of current bitmap: 0x%hhx, input access=%08x\n",
4733                         stp->st_access_bmap, od->od_share_access);
4734                 goto put_stateid;
4735         }
4736         if (!test_deny(od->od_share_deny, stp)) {
4737                 dprintk("NFSD: deny not a subset of current bitmap: 0x%hhx, input deny=%08x\n",
4738                         stp->st_deny_bmap, od->od_share_deny);
4739                 goto put_stateid;
4740         }
4741         nfs4_stateid_downgrade(stp, od->od_share_access);
4742
4743         reset_union_bmap_deny(od->od_share_deny, stp);
4744
4745         update_stateid(&stp->st_stid.sc_stateid);
4746         memcpy(&od->od_stateid, &stp->st_stid.sc_stateid, sizeof(stateid_t));
4747         status = nfs_ok;
4748 put_stateid:
4749         nfs4_put_stid(&stp->st_stid);
4750 out:
4751         nfsd4_bump_seqid(cstate, status);
4752         return status;
4753 }
4754
4755 static void nfsd4_close_open_stateid(struct nfs4_ol_stateid *s)
4756 {
4757         struct nfs4_client *clp = s->st_stid.sc_client;
4758         LIST_HEAD(reaplist);
4759
4760         s->st_stid.sc_type = NFS4_CLOSED_STID;
4761         spin_lock(&clp->cl_lock);
4762         unhash_open_stateid(s, &reaplist);
4763
4764         if (clp->cl_minorversion) {
4765                 put_ol_stateid_locked(s, &reaplist);
4766                 spin_unlock(&clp->cl_lock);
4767                 free_ol_stateid_reaplist(&reaplist);
4768         } else {
4769                 spin_unlock(&clp->cl_lock);
4770                 free_ol_stateid_reaplist(&reaplist);
4771                 move_to_close_lru(s, clp->net);
4772         }
4773 }
4774
4775 /*
4776  * nfs4_unlock_state() called after encode
4777  */
4778 __be32
4779 nfsd4_close(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
4780             struct nfsd4_close *close)
4781 {
4782         __be32 status;
4783         struct nfs4_ol_stateid *stp;
4784         struct net *net = SVC_NET(rqstp);
4785         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
4786
4787         dprintk("NFSD: nfsd4_close on file %pd\n",
4788                         cstate->current_fh.fh_dentry);
4789
4790         status = nfs4_preprocess_seqid_op(cstate, close->cl_seqid,
4791                                         &close->cl_stateid,
4792                                         NFS4_OPEN_STID|NFS4_CLOSED_STID,
4793                                         &stp, nn);
4794         nfsd4_bump_seqid(cstate, status);
4795         if (status)
4796                 goto out;
4797         update_stateid(&stp->st_stid.sc_stateid);
4798         memcpy(&close->cl_stateid, &stp->st_stid.sc_stateid, sizeof(stateid_t));
4799
4800         nfsd4_close_open_stateid(stp);
4801
4802         /* put reference from nfs4_preprocess_seqid_op */
4803         nfs4_put_stid(&stp->st_stid);
4804 out:
4805         return status;
4806 }
4807
4808 __be32
4809 nfsd4_delegreturn(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
4810                   struct nfsd4_delegreturn *dr)
4811 {
4812         struct nfs4_delegation *dp;
4813         stateid_t *stateid = &dr->dr_stateid;
4814         struct nfs4_stid *s;
4815         __be32 status;
4816         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
4817
4818         if ((status = fh_verify(rqstp, &cstate->current_fh, S_IFREG, 0)))
4819                 return status;
4820
4821         status = nfsd4_lookup_stateid(cstate, stateid, NFS4_DELEG_STID, &s, nn);
4822         if (status)
4823                 goto out;
4824         dp = delegstateid(s);
4825         status = check_stateid_generation(stateid, &dp->dl_stid.sc_stateid, nfsd4_has_session(cstate));
4826         if (status)
4827                 goto put_stateid;
4828
4829         destroy_delegation(dp);
4830 put_stateid:
4831         nfs4_put_stid(&dp->dl_stid);
4832 out:
4833         return status;
4834 }
4835
4836
4837 #define LOFF_OVERFLOW(start, len)      ((u64)(len) > ~(u64)(start))
4838
4839 static inline u64
4840 end_offset(u64 start, u64 len)
4841 {
4842         u64 end;
4843
4844         end = start + len;
4845         return end >= start ? end: NFS4_MAX_UINT64;
4846 }
4847
4848 /* last octet in a range */
4849 static inline u64
4850 last_byte_offset(u64 start, u64 len)
4851 {
4852         u64 end;
4853
4854         WARN_ON_ONCE(!len);
4855         end = start + len;
4856         return end > start ? end - 1: NFS4_MAX_UINT64;
4857 }
4858
4859 /*
4860  * TODO: Linux file offsets are _signed_ 64-bit quantities, which means that
4861  * we can't properly handle lock requests that go beyond the (2^63 - 1)-th
4862  * byte, because of sign extension problems.  Since NFSv4 calls for 64-bit
4863  * locking, this prevents us from being completely protocol-compliant.  The
4864  * real solution to this problem is to start using unsigned file offsets in
4865  * the VFS, but this is a very deep change!
4866  */
4867 static inline void
4868 nfs4_transform_lock_offset(struct file_lock *lock)
4869 {
4870         if (lock->fl_start < 0)
4871                 lock->fl_start = OFFSET_MAX;
4872         if (lock->fl_end < 0)
4873                 lock->fl_end = OFFSET_MAX;
4874 }
4875
4876 static void nfsd4_fl_get_owner(struct file_lock *dst, struct file_lock *src)
4877 {
4878         struct nfs4_lockowner *lo = (struct nfs4_lockowner *)src->fl_owner;
4879         dst->fl_owner = (fl_owner_t)lockowner(nfs4_get_stateowner(&lo->lo_owner));
4880 }
4881
4882 static void nfsd4_fl_put_owner(struct file_lock *fl)
4883 {
4884         struct nfs4_lockowner *lo = (struct nfs4_lockowner *)fl->fl_owner;
4885
4886         if (lo) {
4887                 nfs4_put_stateowner(&lo->lo_owner);
4888                 fl->fl_owner = NULL;
4889         }
4890 }
4891
4892 static const struct lock_manager_operations nfsd_posix_mng_ops  = {
4893         .lm_get_owner = nfsd4_fl_get_owner,
4894         .lm_put_owner = nfsd4_fl_put_owner,
4895 };
4896
4897 static inline void
4898 nfs4_set_lock_denied(struct file_lock *fl, struct nfsd4_lock_denied *deny)
4899 {
4900         struct nfs4_lockowner *lo;
4901
4902         if (fl->fl_lmops == &nfsd_posix_mng_ops) {
4903                 lo = (struct nfs4_lockowner *) fl->fl_owner;
4904                 deny->ld_owner.data = kmemdup(lo->lo_owner.so_owner.data,
4905                                         lo->lo_owner.so_owner.len, GFP_KERNEL);
4906                 if (!deny->ld_owner.data)
4907                         /* We just don't care that much */
4908                         goto nevermind;
4909                 deny->ld_owner.len = lo->lo_owner.so_owner.len;
4910                 deny->ld_clientid = lo->lo_owner.so_client->cl_clientid;
4911         } else {
4912 nevermind:
4913                 deny->ld_owner.len = 0;
4914                 deny->ld_owner.data = NULL;
4915                 deny->ld_clientid.cl_boot = 0;
4916                 deny->ld_clientid.cl_id = 0;
4917         }
4918         deny->ld_start = fl->fl_start;
4919         deny->ld_length = NFS4_MAX_UINT64;
4920         if (fl->fl_end != NFS4_MAX_UINT64)
4921                 deny->ld_length = fl->fl_end - fl->fl_start + 1;
4922         deny->ld_type = NFS4_READ_LT;
4923         if (fl->fl_type != F_RDLCK)
4924                 deny->ld_type = NFS4_WRITE_LT;
4925 }
4926
4927 static struct nfs4_lockowner *
4928 find_lockowner_str_locked(clientid_t *clid, struct xdr_netobj *owner,
4929                 struct nfs4_client *clp)
4930 {
4931         unsigned int strhashval = ownerstr_hashval(owner);
4932         struct nfs4_stateowner *so;
4933
4934         lockdep_assert_held(&clp->cl_lock);
4935
4936         list_for_each_entry(so, &clp->cl_ownerstr_hashtbl[strhashval],
4937                             so_strhash) {
4938                 if (so->so_is_open_owner)
4939                         continue;
4940                 if (same_owner_str(so, owner))
4941                         return lockowner(nfs4_get_stateowner(so));
4942         }
4943         return NULL;
4944 }
4945
4946 static struct nfs4_lockowner *
4947 find_lockowner_str(clientid_t *clid, struct xdr_netobj *owner,
4948                 struct nfs4_client *clp)
4949 {
4950         struct nfs4_lockowner *lo;
4951
4952         spin_lock(&clp->cl_lock);
4953         lo = find_lockowner_str_locked(clid, owner, clp);
4954         spin_unlock(&clp->cl_lock);
4955         return lo;
4956 }
4957
4958 static void nfs4_unhash_lockowner(struct nfs4_stateowner *sop)
4959 {
4960         unhash_lockowner_locked(lockowner(sop));
4961 }
4962
4963 static void nfs4_free_lockowner(struct nfs4_stateowner *sop)
4964 {
4965         struct nfs4_lockowner *lo = lockowner(sop);
4966
4967         kmem_cache_free(lockowner_slab, lo);
4968 }
4969
4970 static const struct nfs4_stateowner_operations lockowner_ops = {
4971         .so_unhash =    nfs4_unhash_lockowner,
4972         .so_free =      nfs4_free_lockowner,
4973 };
4974
4975 /*
4976  * Alloc a lock owner structure.
4977  * Called in nfsd4_lock - therefore, OPEN and OPEN_CONFIRM (if needed) has
4978  * occurred.
4979  *
4980  * strhashval = ownerstr_hashval
4981  */
4982 static struct nfs4_lockowner *
4983 alloc_init_lock_stateowner(unsigned int strhashval, struct nfs4_client *clp,
4984                            struct nfs4_ol_stateid *open_stp,
4985                            struct nfsd4_lock *lock)
4986 {
4987         struct nfs4_lockowner *lo, *ret;
4988
4989         lo = alloc_stateowner(lockowner_slab, &lock->lk_new_owner, clp);
4990         if (!lo)
4991                 return NULL;
4992         INIT_LIST_HEAD(&lo->lo_owner.so_stateids);
4993         lo->lo_owner.so_is_open_owner = 0;
4994         lo->lo_owner.so_seqid = lock->lk_new_lock_seqid;
4995         lo->lo_owner.so_ops = &lockowner_ops;
4996         spin_lock(&clp->cl_lock);
4997         ret = find_lockowner_str_locked(&clp->cl_clientid,
4998                         &lock->lk_new_owner, clp);
4999         if (ret == NULL) {
5000                 list_add(&lo->lo_owner.so_strhash,
5001                          &clp->cl_ownerstr_hashtbl[strhashval]);
5002                 ret = lo;
5003         } else
5004                 nfs4_free_lockowner(&lo->lo_owner);
5005         spin_unlock(&clp->cl_lock);
5006         return lo;
5007 }
5008
5009 static void
5010 init_lock_stateid(struct nfs4_ol_stateid *stp, struct nfs4_lockowner *lo,
5011                   struct nfs4_file *fp, struct inode *inode,
5012                   struct nfs4_ol_stateid *open_stp)
5013 {
5014         struct nfs4_client *clp = lo->lo_owner.so_client;
5015
5016         lockdep_assert_held(&clp->cl_lock);
5017
5018         atomic_inc(&stp->st_stid.sc_count);
5019         stp->st_stid.sc_type = NFS4_LOCK_STID;
5020         stp->st_stateowner = nfs4_get_stateowner(&lo->lo_owner);
5021         get_nfs4_file(fp);
5022         stp->st_stid.sc_file = fp;
5023         stp->st_stid.sc_free = nfs4_free_lock_stateid;
5024         stp->st_access_bmap = 0;
5025         stp->st_deny_bmap = open_stp->st_deny_bmap;
5026         stp->st_openstp = open_stp;
5027         list_add(&stp->st_locks, &open_stp->st_locks);
5028         list_add(&stp->st_perstateowner, &lo->lo_owner.so_stateids);
5029         spin_lock(&fp->fi_lock);
5030         list_add(&stp->st_perfile, &fp->fi_stateids);
5031         spin_unlock(&fp->fi_lock);
5032 }
5033
5034 static struct nfs4_ol_stateid *
5035 find_lock_stateid(struct nfs4_lockowner *lo, struct nfs4_file *fp)
5036 {
5037         struct nfs4_ol_stateid *lst;
5038         struct nfs4_client *clp = lo->lo_owner.so_client;
5039
5040         lockdep_assert_held(&clp->cl_lock);
5041
5042         list_for_each_entry(lst, &lo->lo_owner.so_stateids, st_perstateowner) {
5043                 if (lst->st_stid.sc_file == fp) {
5044                         atomic_inc(&lst->st_stid.sc_count);
5045                         return lst;
5046                 }
5047         }
5048         return NULL;
5049 }
5050
5051 static struct nfs4_ol_stateid *
5052 find_or_create_lock_stateid(struct nfs4_lockowner *lo, struct nfs4_file *fi,
5053                             struct inode *inode, struct nfs4_ol_stateid *ost,
5054                             bool *new)
5055 {
5056         struct nfs4_stid *ns = NULL;
5057         struct nfs4_ol_stateid *lst;
5058         struct nfs4_openowner *oo = openowner(ost->st_stateowner);
5059         struct nfs4_client *clp = oo->oo_owner.so_client;
5060
5061         spin_lock(&clp->cl_lock);
5062         lst = find_lock_stateid(lo, fi);
5063         if (lst == NULL) {
5064                 spin_unlock(&clp->cl_lock);
5065                 ns = nfs4_alloc_stid(clp, stateid_slab);
5066                 if (ns == NULL)
5067                         return NULL;
5068
5069                 spin_lock(&clp->cl_lock);
5070                 lst = find_lock_stateid(lo, fi);
5071                 if (likely(!lst)) {
5072                         lst = openlockstateid(ns);
5073                         init_lock_stateid(lst, lo, fi, inode, ost);
5074                         ns = NULL;
5075                         *new = true;
5076                 }
5077         }
5078         spin_unlock(&clp->cl_lock);
5079         if (ns)
5080                 nfs4_put_stid(ns);
5081         return lst;
5082 }
5083
5084 static int
5085 check_lock_length(u64 offset, u64 length)
5086 {
5087         return ((length == 0)  || ((length != NFS4_MAX_UINT64) &&
5088              LOFF_OVERFLOW(offset, length)));
5089 }
5090
5091 static void get_lock_access(struct nfs4_ol_stateid *lock_stp, u32 access)
5092 {
5093         struct nfs4_file *fp = lock_stp->st_stid.sc_file;
5094
5095         lockdep_assert_held(&fp->fi_lock);
5096
5097         if (test_access(access, lock_stp))
5098                 return;
5099         __nfs4_file_get_access(fp, access);
5100         set_access(access, lock_stp);
5101 }
5102
5103 static __be32
5104 lookup_or_create_lock_state(struct nfsd4_compound_state *cstate,
5105                             struct nfs4_ol_stateid *ost,
5106                             struct nfsd4_lock *lock,
5107                             struct nfs4_ol_stateid **lst, bool *new)
5108 {
5109         __be32 status;
5110         struct nfs4_file *fi = ost->st_stid.sc_file;
5111         struct nfs4_openowner *oo = openowner(ost->st_stateowner);
5112         struct nfs4_client *cl = oo->oo_owner.so_client;
5113         struct inode *inode = cstate->current_fh.fh_dentry->d_inode;
5114         struct nfs4_lockowner *lo;
5115         unsigned int strhashval;
5116
5117         lo = find_lockowner_str(&cl->cl_clientid, &lock->v.new.owner, cl);
5118         if (!lo) {
5119                 strhashval = ownerstr_hashval(&lock->v.new.owner);
5120                 lo = alloc_init_lock_stateowner(strhashval, cl, ost, lock);
5121                 if (lo == NULL)
5122                         return nfserr_jukebox;
5123         } else {
5124                 /* with an existing lockowner, seqids must be the same */
5125                 status = nfserr_bad_seqid;
5126                 if (!cstate->minorversion &&
5127                     lock->lk_new_lock_seqid != lo->lo_owner.so_seqid)
5128                         goto out;
5129         }
5130
5131         *lst = find_or_create_lock_stateid(lo, fi, inode, ost, new);
5132         if (*lst == NULL) {
5133                 status = nfserr_jukebox;
5134                 goto out;
5135         }
5136         status = nfs_ok;
5137 out:
5138         nfs4_put_stateowner(&lo->lo_owner);
5139         return status;
5140 }
5141
5142 /*
5143  *  LOCK operation
5144  */
5145 __be32
5146 nfsd4_lock(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
5147            struct nfsd4_lock *lock)
5148 {
5149         struct nfs4_openowner *open_sop = NULL;
5150         struct nfs4_lockowner *lock_sop = NULL;
5151         struct nfs4_ol_stateid *lock_stp = NULL;
5152         struct nfs4_ol_stateid *open_stp = NULL;
5153         struct nfs4_file *fp;
5154         struct file *filp = NULL;
5155         struct file_lock *file_lock = NULL;
5156         struct file_lock *conflock = NULL;
5157         __be32 status = 0;
5158         int lkflg;
5159         int err;
5160         bool new = false;
5161         struct net *net = SVC_NET(rqstp);
5162         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
5163
5164         dprintk("NFSD: nfsd4_lock: start=%Ld length=%Ld\n",
5165                 (long long) lock->lk_offset,
5166                 (long long) lock->lk_length);
5167
5168         if (check_lock_length(lock->lk_offset, lock->lk_length))
5169                  return nfserr_inval;
5170
5171         if ((status = fh_verify(rqstp, &cstate->current_fh,
5172                                 S_IFREG, NFSD_MAY_LOCK))) {
5173                 dprintk("NFSD: nfsd4_lock: permission denied!\n");
5174                 return status;
5175         }
5176
5177         if (lock->lk_is_new) {
5178                 if (nfsd4_has_session(cstate))
5179                         /* See rfc 5661 18.10.3: given clientid is ignored: */
5180                         memcpy(&lock->v.new.clientid,
5181                                 &cstate->session->se_client->cl_clientid,
5182                                 sizeof(clientid_t));
5183
5184                 status = nfserr_stale_clientid;
5185                 if (STALE_CLIENTID(&lock->lk_new_clientid, nn))
5186                         goto out;
5187
5188                 /* validate and update open stateid and open seqid */
5189                 status = nfs4_preprocess_confirmed_seqid_op(cstate,
5190                                         lock->lk_new_open_seqid,
5191                                         &lock->lk_new_open_stateid,
5192                                         &open_stp, nn);
5193                 if (status)
5194                         goto out;
5195                 open_sop = openowner(open_stp->st_stateowner);
5196                 status = nfserr_bad_stateid;
5197                 if (!same_clid(&open_sop->oo_owner.so_client->cl_clientid,
5198                                                 &lock->v.new.clientid))
5199                         goto out;
5200                 status = lookup_or_create_lock_state(cstate, open_stp, lock,
5201                                                         &lock_stp, &new);
5202         } else {
5203                 status = nfs4_preprocess_seqid_op(cstate,
5204                                        lock->lk_old_lock_seqid,
5205                                        &lock->lk_old_lock_stateid,
5206                                        NFS4_LOCK_STID, &lock_stp, nn);
5207         }
5208         if (status)
5209                 goto out;
5210         lock_sop = lockowner(lock_stp->st_stateowner);
5211
5212         lkflg = setlkflg(lock->lk_type);
5213         status = nfs4_check_openmode(lock_stp, lkflg);
5214         if (status)
5215                 goto out;
5216
5217         status = nfserr_grace;
5218         if (locks_in_grace(net) && !lock->lk_reclaim)
5219                 goto out;
5220         status = nfserr_no_grace;
5221         if (!locks_in_grace(net) && lock->lk_reclaim)
5222                 goto out;
5223
5224         file_lock = locks_alloc_lock();
5225         if (!file_lock) {
5226                 dprintk("NFSD: %s: unable to allocate lock!\n", __func__);
5227                 status = nfserr_jukebox;
5228                 goto out;
5229         }
5230
5231         fp = lock_stp->st_stid.sc_file;
5232         switch (lock->lk_type) {
5233                 case NFS4_READ_LT:
5234                 case NFS4_READW_LT:
5235                         spin_lock(&fp->fi_lock);
5236                         filp = find_readable_file_locked(fp);
5237                         if (filp)
5238                                 get_lock_access(lock_stp, NFS4_SHARE_ACCESS_READ);
5239                         spin_unlock(&fp->fi_lock);
5240                         file_lock->fl_type = F_RDLCK;
5241                         break;
5242                 case NFS4_WRITE_LT:
5243                 case NFS4_WRITEW_LT:
5244                         spin_lock(&fp->fi_lock);
5245                         filp = find_writeable_file_locked(fp);
5246                         if (filp)
5247                                 get_lock_access(lock_stp, NFS4_SHARE_ACCESS_WRITE);
5248                         spin_unlock(&fp->fi_lock);
5249                         file_lock->fl_type = F_WRLCK;
5250                         break;
5251                 default:
5252                         status = nfserr_inval;
5253                 goto out;
5254         }
5255         if (!filp) {
5256                 status = nfserr_openmode;
5257                 goto out;
5258         }
5259
5260         file_lock->fl_owner = (fl_owner_t)lockowner(nfs4_get_stateowner(&lock_sop->lo_owner));
5261         file_lock->fl_pid = current->tgid;
5262         file_lock->fl_file = filp;
5263         file_lock->fl_flags = FL_POSIX;
5264         file_lock->fl_lmops = &nfsd_posix_mng_ops;
5265         file_lock->fl_start = lock->lk_offset;
5266         file_lock->fl_end = last_byte_offset(lock->lk_offset, lock->lk_length);
5267         nfs4_transform_lock_offset(file_lock);
5268
5269         conflock = locks_alloc_lock();
5270         if (!conflock) {
5271                 dprintk("NFSD: %s: unable to allocate lock!\n", __func__);
5272                 status = nfserr_jukebox;
5273                 goto out;
5274         }
5275
5276         err = vfs_lock_file(filp, F_SETLK, file_lock, conflock);
5277         switch (-err) {
5278         case 0: /* success! */
5279                 update_stateid(&lock_stp->st_stid.sc_stateid);
5280                 memcpy(&lock->lk_resp_stateid, &lock_stp->st_stid.sc_stateid,
5281                                 sizeof(stateid_t));
5282                 status = 0;
5283                 break;
5284         case (EAGAIN):          /* conflock holds conflicting lock */
5285                 status = nfserr_denied;
5286                 dprintk("NFSD: nfsd4_lock: conflicting lock found!\n");
5287                 nfs4_set_lock_denied(conflock, &lock->lk_denied);
5288                 break;
5289         case (EDEADLK):
5290                 status = nfserr_deadlock;
5291                 break;
5292         default:
5293                 dprintk("NFSD: nfsd4_lock: vfs_lock_file() failed! status %d\n",err);
5294                 status = nfserrno(err);
5295                 break;
5296         }
5297 out:
5298         if (filp)
5299                 fput(filp);
5300         if (lock_stp) {
5301                 /* Bump seqid manually if the 4.0 replay owner is openowner */
5302                 if (cstate->replay_owner &&
5303                     cstate->replay_owner != &lock_sop->lo_owner &&
5304                     seqid_mutating_err(ntohl(status)))
5305                         lock_sop->lo_owner.so_seqid++;
5306
5307                 /*
5308                  * If this is a new, never-before-used stateid, and we are
5309                  * returning an error, then just go ahead and release it.
5310                  */
5311                 if (status && new)
5312                         release_lock_stateid(lock_stp);
5313
5314                 nfs4_put_stid(&lock_stp->st_stid);
5315         }
5316         if (open_stp)
5317                 nfs4_put_stid(&open_stp->st_stid);
5318         nfsd4_bump_seqid(cstate, status);
5319         if (file_lock)
5320                 locks_free_lock(file_lock);
5321         if (conflock)
5322                 locks_free_lock(conflock);
5323         return status;
5324 }
5325
5326 /*
5327  * The NFSv4 spec allows a client to do a LOCKT without holding an OPEN,
5328  * so we do a temporary open here just to get an open file to pass to
5329  * vfs_test_lock.  (Arguably perhaps test_lock should be done with an
5330  * inode operation.)
5331  */
5332 static __be32 nfsd_test_lock(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file_lock *lock)
5333 {
5334         struct file *file;
5335         __be32 err = nfsd_open(rqstp, fhp, S_IFREG, NFSD_MAY_READ, &file);
5336         if (!err) {
5337                 err = nfserrno(vfs_test_lock(file, lock));
5338                 nfsd_close(file);
5339         }
5340         return err;
5341 }
5342
5343 /*
5344  * LOCKT operation
5345  */
5346 __be32
5347 nfsd4_lockt(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
5348             struct nfsd4_lockt *lockt)
5349 {
5350         struct file_lock *file_lock = NULL;
5351         struct nfs4_lockowner *lo = NULL;
5352         __be32 status;
5353         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
5354
5355         if (locks_in_grace(SVC_NET(rqstp)))
5356                 return nfserr_grace;
5357
5358         if (check_lock_length(lockt->lt_offset, lockt->lt_length))
5359                  return nfserr_inval;
5360
5361         if (!nfsd4_has_session(cstate)) {
5362                 status = lookup_clientid(&lockt->lt_clientid, cstate, nn);
5363                 if (status)
5364                         goto out;
5365         }
5366
5367         if ((status = fh_verify(rqstp, &cstate->current_fh, S_IFREG, 0)))
5368                 goto out;
5369
5370         file_lock = locks_alloc_lock();
5371         if (!file_lock) {
5372                 dprintk("NFSD: %s: unable to allocate lock!\n", __func__);
5373                 status = nfserr_jukebox;
5374                 goto out;
5375         }
5376
5377         switch (lockt->lt_type) {
5378                 case NFS4_READ_LT:
5379                 case NFS4_READW_LT:
5380                         file_lock->fl_type = F_RDLCK;
5381                 break;
5382                 case NFS4_WRITE_LT:
5383                 case NFS4_WRITEW_LT:
5384                         file_lock->fl_type = F_WRLCK;
5385                 break;
5386                 default:
5387                         dprintk("NFSD: nfs4_lockt: bad lock type!\n");
5388                         status = nfserr_inval;
5389                 goto out;
5390         }
5391
5392         lo = find_lockowner_str(&lockt->lt_clientid, &lockt->lt_owner,
5393                                 cstate->clp);
5394         if (lo)
5395                 file_lock->fl_owner = (fl_owner_t)lo;
5396         file_lock->fl_pid = current->tgid;
5397         file_lock->fl_flags = FL_POSIX;
5398
5399         file_lock->fl_start = lockt->lt_offset;
5400         file_lock->fl_end = last_byte_offset(lockt->lt_offset, lockt->lt_length);
5401
5402         nfs4_transform_lock_offset(file_lock);
5403
5404         status = nfsd_test_lock(rqstp, &cstate->current_fh, file_lock);
5405         if (status)
5406                 goto out;
5407
5408         if (file_lock->fl_type != F_UNLCK) {
5409                 status = nfserr_denied;
5410                 nfs4_set_lock_denied(file_lock, &lockt->lt_denied);
5411         }
5412 out:
5413         if (lo)
5414                 nfs4_put_stateowner(&lo->lo_owner);
5415         if (file_lock)
5416                 locks_free_lock(file_lock);
5417         return status;
5418 }
5419
5420 __be32
5421 nfsd4_locku(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
5422             struct nfsd4_locku *locku)
5423 {
5424         struct nfs4_ol_stateid *stp;
5425         struct file *filp = NULL;
5426         struct file_lock *file_lock = NULL;
5427         __be32 status;
5428         int err;
5429         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
5430
5431         dprintk("NFSD: nfsd4_locku: start=%Ld length=%Ld\n",
5432                 (long long) locku->lu_offset,
5433                 (long long) locku->lu_length);
5434
5435         if (check_lock_length(locku->lu_offset, locku->lu_length))
5436                  return nfserr_inval;
5437
5438         status = nfs4_preprocess_seqid_op(cstate, locku->lu_seqid,
5439                                         &locku->lu_stateid, NFS4_LOCK_STID,
5440                                         &stp, nn);
5441         if (status)
5442                 goto out;
5443         filp = find_any_file(stp->st_stid.sc_file);
5444         if (!filp) {
5445                 status = nfserr_lock_range;
5446                 goto put_stateid;
5447         }
5448         file_lock = locks_alloc_lock();
5449         if (!file_lock) {
5450                 dprintk("NFSD: %s: unable to allocate lock!\n", __func__);
5451                 status = nfserr_jukebox;
5452                 goto fput;
5453         }
5454
5455         file_lock->fl_type = F_UNLCK;
5456         file_lock->fl_owner = (fl_owner_t)lockowner(nfs4_get_stateowner(stp->st_stateowner));
5457         file_lock->fl_pid = current->tgid;
5458         file_lock->fl_file = filp;
5459         file_lock->fl_flags = FL_POSIX;
5460         file_lock->fl_lmops = &nfsd_posix_mng_ops;
5461         file_lock->fl_start = locku->lu_offset;
5462
5463         file_lock->fl_end = last_byte_offset(locku->lu_offset,
5464                                                 locku->lu_length);
5465         nfs4_transform_lock_offset(file_lock);
5466
5467         err = vfs_lock_file(filp, F_SETLK, file_lock, NULL);
5468         if (err) {
5469                 dprintk("NFSD: nfs4_locku: vfs_lock_file failed!\n");
5470                 goto out_nfserr;
5471         }
5472         update_stateid(&stp->st_stid.sc_stateid);
5473         memcpy(&locku->lu_stateid, &stp->st_stid.sc_stateid, sizeof(stateid_t));
5474 fput:
5475         fput(filp);
5476 put_stateid:
5477         nfs4_put_stid(&stp->st_stid);
5478 out:
5479         nfsd4_bump_seqid(cstate, status);
5480         if (file_lock)
5481                 locks_free_lock(file_lock);
5482         return status;
5483
5484 out_nfserr:
5485         status = nfserrno(err);
5486         goto fput;
5487 }
5488
5489 /*
5490  * returns
5491  *      true:  locks held by lockowner
5492  *      false: no locks held by lockowner
5493  */
5494 static bool
5495 check_for_locks(struct nfs4_file *fp, struct nfs4_lockowner *lowner)
5496 {
5497         struct file_lock **flpp;
5498         int status = false;
5499         struct file *filp = find_any_file(fp);
5500         struct inode *inode;
5501
5502         if (!filp) {
5503                 /* Any valid lock stateid should have some sort of access */
5504                 WARN_ON_ONCE(1);
5505                 return status;
5506         }
5507
5508         inode = file_inode(filp);
5509
5510         spin_lock(&inode->i_lock);
5511         for (flpp = &inode->i_flock; *flpp != NULL; flpp = &(*flpp)->fl_next) {
5512                 if ((*flpp)->fl_owner == (fl_owner_t)lowner) {
5513                         status = true;
5514                         break;
5515                 }
5516         }
5517         spin_unlock(&inode->i_lock);
5518         fput(filp);
5519         return status;
5520 }
5521
5522 __be32
5523 nfsd4_release_lockowner(struct svc_rqst *rqstp,
5524                         struct nfsd4_compound_state *cstate,
5525                         struct nfsd4_release_lockowner *rlockowner)
5526 {
5527         clientid_t *clid = &rlockowner->rl_clientid;
5528         struct nfs4_stateowner *sop;
5529         struct nfs4_lockowner *lo = NULL;
5530         struct nfs4_ol_stateid *stp;
5531         struct xdr_netobj *owner = &rlockowner->rl_owner;
5532         unsigned int hashval = ownerstr_hashval(owner);
5533         __be32 status;
5534         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
5535         struct nfs4_client *clp;
5536
5537         dprintk("nfsd4_release_lockowner clientid: (%08x/%08x):\n",
5538                 clid->cl_boot, clid->cl_id);
5539
5540         status = lookup_clientid(clid, cstate, nn);
5541         if (status)
5542                 return status;
5543
5544         clp = cstate->clp;
5545         /* Find the matching lock stateowner */
5546         spin_lock(&clp->cl_lock);
5547         list_for_each_entry(sop, &clp->cl_ownerstr_hashtbl[hashval],
5548                             so_strhash) {
5549
5550                 if (sop->so_is_open_owner || !same_owner_str(sop, owner))
5551                         continue;
5552
5553                 /* see if there are still any locks associated with it */
5554                 lo = lockowner(sop);
5555                 list_for_each_entry(stp, &sop->so_stateids, st_perstateowner) {
5556                         if (check_for_locks(stp->st_stid.sc_file, lo)) {
5557                                 status = nfserr_locks_held;
5558                                 spin_unlock(&clp->cl_lock);
5559                                 return status;
5560                         }
5561                 }
5562
5563                 nfs4_get_stateowner(sop);
5564                 break;
5565         }
5566         spin_unlock(&clp->cl_lock);
5567         if (lo)
5568                 release_lockowner(lo);
5569         return status;
5570 }
5571
5572 static inline struct nfs4_client_reclaim *
5573 alloc_reclaim(void)
5574 {
5575         return kmalloc(sizeof(struct nfs4_client_reclaim), GFP_KERNEL);
5576 }
5577
5578 bool
5579 nfs4_has_reclaimed_state(const char *name, struct nfsd_net *nn)
5580 {
5581         struct nfs4_client_reclaim *crp;
5582
5583         crp = nfsd4_find_reclaim_client(name, nn);
5584         return (crp && crp->cr_clp);
5585 }
5586
5587 /*
5588  * failure => all reset bets are off, nfserr_no_grace...
5589  */
5590 struct nfs4_client_reclaim *
5591 nfs4_client_to_reclaim(const char *name, struct nfsd_net *nn)
5592 {
5593         unsigned int strhashval;
5594         struct nfs4_client_reclaim *crp;
5595
5596         dprintk("NFSD nfs4_client_to_reclaim NAME: %.*s\n", HEXDIR_LEN, name);
5597         crp = alloc_reclaim();
5598         if (crp) {
5599                 strhashval = clientstr_hashval(name);
5600                 INIT_LIST_HEAD(&crp->cr_strhash);
5601                 list_add(&crp->cr_strhash, &nn->reclaim_str_hashtbl[strhashval]);
5602                 memcpy(crp->cr_recdir, name, HEXDIR_LEN);
5603                 crp->cr_clp = NULL;
5604                 nn->reclaim_str_hashtbl_size++;
5605         }
5606         return crp;
5607 }
5608
5609 void
5610 nfs4_remove_reclaim_record(struct nfs4_client_reclaim *crp, struct nfsd_net *nn)
5611 {
5612         list_del(&crp->cr_strhash);
5613         kfree(crp);
5614         nn->reclaim_str_hashtbl_size--;
5615 }
5616
5617 void
5618 nfs4_release_reclaim(struct nfsd_net *nn)
5619 {
5620         struct nfs4_client_reclaim *crp = NULL;
5621         int i;
5622
5623         for (i = 0; i < CLIENT_HASH_SIZE; i++) {
5624                 while (!list_empty(&nn->reclaim_str_hashtbl[i])) {
5625                         crp = list_entry(nn->reclaim_str_hashtbl[i].next,
5626                                         struct nfs4_client_reclaim, cr_strhash);
5627                         nfs4_remove_reclaim_record(crp, nn);
5628                 }
5629         }
5630         WARN_ON_ONCE(nn->reclaim_str_hashtbl_size);
5631 }
5632
5633 /*
5634  * called from OPEN, CLAIM_PREVIOUS with a new clientid. */
5635 struct nfs4_client_reclaim *
5636 nfsd4_find_reclaim_client(const char *recdir, struct nfsd_net *nn)
5637 {
5638         unsigned int strhashval;
5639         struct nfs4_client_reclaim *crp = NULL;
5640
5641         dprintk("NFSD: nfs4_find_reclaim_client for recdir %s\n", recdir);
5642
5643         strhashval = clientstr_hashval(recdir);
5644         list_for_each_entry(crp, &nn->reclaim_str_hashtbl[strhashval], cr_strhash) {
5645                 if (same_name(crp->cr_recdir, recdir)) {
5646                         return crp;
5647                 }
5648         }
5649         return NULL;
5650 }
5651
5652 /*
5653 * Called from OPEN. Look for clientid in reclaim list.
5654 */
5655 __be32
5656 nfs4_check_open_reclaim(clientid_t *clid,
5657                 struct nfsd4_compound_state *cstate,
5658                 struct nfsd_net *nn)
5659 {
5660         __be32 status;
5661
5662         /* find clientid in conf_id_hashtbl */
5663         status = lookup_clientid(clid, cstate, nn);
5664         if (status)
5665                 return nfserr_reclaim_bad;
5666
5667         if (nfsd4_client_record_check(cstate->clp))
5668                 return nfserr_reclaim_bad;
5669
5670         return nfs_ok;
5671 }
5672
5673 #ifdef CONFIG_NFSD_FAULT_INJECTION
5674 static inline void
5675 put_client(struct nfs4_client *clp)
5676 {
5677         atomic_dec(&clp->cl_refcount);
5678 }
5679
5680 static struct nfs4_client *
5681 nfsd_find_client(struct sockaddr_storage *addr, size_t addr_size)
5682 {
5683         struct nfs4_client *clp;
5684         struct nfsd_net *nn = net_generic(current->nsproxy->net_ns,
5685                                           nfsd_net_id);
5686
5687         if (!nfsd_netns_ready(nn))
5688                 return NULL;
5689
5690         list_for_each_entry(clp, &nn->client_lru, cl_lru) {
5691                 if (memcmp(&clp->cl_addr, addr, addr_size) == 0)
5692                         return clp;
5693         }
5694         return NULL;
5695 }
5696
5697 u64
5698 nfsd_inject_print_clients(void)
5699 {
5700         struct nfs4_client *clp;
5701         u64 count = 0;
5702         struct nfsd_net *nn = net_generic(current->nsproxy->net_ns,
5703                                           nfsd_net_id);
5704         char buf[INET6_ADDRSTRLEN];
5705
5706         if (!nfsd_netns_ready(nn))
5707                 return 0;
5708
5709         spin_lock(&nn->client_lock);
5710         list_for_each_entry(clp, &nn->client_lru, cl_lru) {
5711                 rpc_ntop((struct sockaddr *)&clp->cl_addr, buf, sizeof(buf));
5712                 pr_info("NFS Client: %s\n", buf);
5713                 ++count;
5714         }
5715         spin_unlock(&nn->client_lock);
5716
5717         return count;
5718 }
5719
5720 u64
5721 nfsd_inject_forget_client(struct sockaddr_storage *addr, size_t addr_size)
5722 {
5723         u64 count = 0;
5724         struct nfs4_client *clp;
5725         struct nfsd_net *nn = net_generic(current->nsproxy->net_ns,
5726                                           nfsd_net_id);
5727
5728         if (!nfsd_netns_ready(nn))
5729                 return count;
5730
5731         spin_lock(&nn->client_lock);
5732         clp = nfsd_find_client(addr, addr_size);
5733         if (clp) {
5734                 if (mark_client_expired_locked(clp) == nfs_ok)
5735                         ++count;
5736                 else
5737                         clp = NULL;
5738         }
5739         spin_unlock(&nn->client_lock);
5740
5741         if (clp)
5742                 expire_client(clp);
5743
5744         return count;
5745 }
5746
5747 u64
5748 nfsd_inject_forget_clients(u64 max)
5749 {
5750         u64 count = 0;
5751         struct nfs4_client *clp, *next;
5752         struct nfsd_net *nn = net_generic(current->nsproxy->net_ns,
5753                                                 nfsd_net_id);
5754         LIST_HEAD(reaplist);
5755
5756         if (!nfsd_netns_ready(nn))
5757                 return count;
5758
5759         spin_lock(&nn->client_lock);
5760         list_for_each_entry_safe(clp, next, &nn->client_lru, cl_lru) {
5761                 if (mark_client_expired_locked(clp) == nfs_ok) {
5762                         list_add(&clp->cl_lru, &reaplist);
5763                         if (max != 0 && ++count >= max)
5764                                 break;
5765                 }
5766         }
5767         spin_unlock(&nn->client_lock);
5768
5769         list_for_each_entry_safe(clp, next, &reaplist, cl_lru)
5770                 expire_client(clp);
5771
5772         return count;
5773 }
5774
5775 static void nfsd_print_count(struct nfs4_client *clp, unsigned int count,
5776                              const char *type)
5777 {
5778         char buf[INET6_ADDRSTRLEN];
5779         rpc_ntop((struct sockaddr *)&clp->cl_addr, buf, sizeof(buf));
5780         printk(KERN_INFO "NFS Client: %s has %u %s\n", buf, count, type);
5781 }
5782
5783 static void
5784 nfsd_inject_add_lock_to_list(struct nfs4_ol_stateid *lst,
5785                              struct list_head *collect)
5786 {
5787         struct nfs4_client *clp = lst->st_stid.sc_client;
5788         struct nfsd_net *nn = net_generic(current->nsproxy->net_ns,
5789                                           nfsd_net_id);
5790
5791         if (!collect)
5792                 return;
5793
5794         lockdep_assert_held(&nn->client_lock);
5795         atomic_inc(&clp->cl_refcount);
5796         list_add(&lst->st_locks, collect);
5797 }
5798
5799 static u64 nfsd_foreach_client_lock(struct nfs4_client *clp, u64 max,
5800                                     struct list_head *collect,
5801                                     void (*func)(struct nfs4_ol_stateid *))
5802 {
5803         struct nfs4_openowner *oop;
5804         struct nfs4_ol_stateid *stp, *st_next;
5805         struct nfs4_ol_stateid *lst, *lst_next;
5806         u64 count = 0;
5807
5808         spin_lock(&clp->cl_lock);
5809         list_for_each_entry(oop, &clp->cl_openowners, oo_perclient) {
5810                 list_for_each_entry_safe(stp, st_next,
5811                                 &oop->oo_owner.so_stateids, st_perstateowner) {
5812                         list_for_each_entry_safe(lst, lst_next,
5813                                         &stp->st_locks, st_locks) {
5814                                 if (func) {
5815                                         func(lst);
5816                                         nfsd_inject_add_lock_to_list(lst,
5817                                                                 collect);
5818                                 }
5819                                 ++count;
5820                                 /*
5821                                  * Despite the fact that these functions deal
5822                                  * with 64-bit integers for "count", we must
5823                                  * ensure that it doesn't blow up the
5824                                  * clp->cl_refcount. Throw a warning if we
5825                                  * start to approach INT_MAX here.
5826                                  */
5827                                 WARN_ON_ONCE(count == (INT_MAX / 2));
5828                                 if (count == max)
5829                                         goto out;
5830                         }
5831                 }
5832         }
5833 out:
5834         spin_unlock(&clp->cl_lock);
5835
5836         return count;
5837 }
5838
5839 static u64
5840 nfsd_collect_client_locks(struct nfs4_client *clp, struct list_head *collect,
5841                           u64 max)
5842 {
5843         return nfsd_foreach_client_lock(clp, max, collect, unhash_lock_stateid);
5844 }
5845
5846 static u64
5847 nfsd_print_client_locks(struct nfs4_client *clp)
5848 {
5849         u64 count = nfsd_foreach_client_lock(clp, 0, NULL, NULL);
5850         nfsd_print_count(clp, count, "locked files");
5851         return count;
5852 }
5853
5854 u64
5855 nfsd_inject_print_locks(void)
5856 {
5857         struct nfs4_client *clp;
5858         u64 count = 0;
5859         struct nfsd_net *nn = net_generic(current->nsproxy->net_ns,
5860                                                 nfsd_net_id);
5861
5862         if (!nfsd_netns_ready(nn))
5863                 return 0;
5864
5865         spin_lock(&nn->client_lock);
5866         list_for_each_entry(clp, &nn->client_lru, cl_lru)
5867                 count += nfsd_print_client_locks(clp);
5868         spin_unlock(&nn->client_lock);
5869
5870         return count;
5871 }
5872
5873 static void
5874 nfsd_reap_locks(struct list_head *reaplist)
5875 {
5876         struct nfs4_client *clp;
5877         struct nfs4_ol_stateid *stp, *next;
5878
5879         list_for_each_entry_safe(stp, next, reaplist, st_locks) {
5880                 list_del_init(&stp->st_locks);
5881                 clp = stp->st_stid.sc_client;
5882                 nfs4_put_stid(&stp->st_stid);
5883                 put_client(clp);
5884         }
5885 }
5886
5887 u64
5888 nfsd_inject_forget_client_locks(struct sockaddr_storage *addr, size_t addr_size)
5889 {
5890         unsigned int count = 0;
5891         struct nfs4_client *clp;
5892         struct nfsd_net *nn = net_generic(current->nsproxy->net_ns,
5893                                                 nfsd_net_id);
5894         LIST_HEAD(reaplist);
5895
5896         if (!nfsd_netns_ready(nn))
5897                 return count;
5898
5899         spin_lock(&nn->client_lock);
5900         clp = nfsd_find_client(addr, addr_size);
5901         if (clp)
5902                 count = nfsd_collect_client_locks(clp, &reaplist, 0);
5903         spin_unlock(&nn->client_lock);
5904         nfsd_reap_locks(&reaplist);
5905         return count;
5906 }
5907
5908 u64
5909 nfsd_inject_forget_locks(u64 max)
5910 {
5911         u64 count = 0;
5912         struct nfs4_client *clp;
5913         struct nfsd_net *nn = net_generic(current->nsproxy->net_ns,
5914                                                 nfsd_net_id);
5915         LIST_HEAD(reaplist);
5916
5917         if (!nfsd_netns_ready(nn))
5918                 return count;
5919
5920         spin_lock(&nn->client_lock);
5921         list_for_each_entry(clp, &nn->client_lru, cl_lru) {
5922                 count += nfsd_collect_client_locks(clp, &reaplist, max - count);
5923                 if (max != 0 && count >= max)
5924                         break;
5925         }
5926         spin_unlock(&nn->client_lock);
5927         nfsd_reap_locks(&reaplist);
5928         return count;
5929 }
5930
5931 static u64
5932 nfsd_foreach_client_openowner(struct nfs4_client *clp, u64 max,
5933                               struct list_head *collect,
5934                               void (*func)(struct nfs4_openowner *))
5935 {
5936         struct nfs4_openowner *oop, *next;
5937         struct nfsd_net *nn = net_generic(current->nsproxy->net_ns,
5938                                                 nfsd_net_id);
5939         u64 count = 0;
5940
5941         lockdep_assert_held(&nn->client_lock);
5942
5943         spin_lock(&clp->cl_lock);
5944         list_for_each_entry_safe(oop, next, &clp->cl_openowners, oo_perclient) {
5945                 if (func) {
5946                         func(oop);
5947                         if (collect) {
5948                                 atomic_inc(&clp->cl_refcount);
5949                                 list_add(&oop->oo_perclient, collect);
5950                         }
5951                 }
5952                 ++count;
5953                 /*
5954                  * Despite the fact that these functions deal with
5955                  * 64-bit integers for "count", we must ensure that
5956                  * it doesn't blow up the clp->cl_refcount. Throw a
5957                  * warning if we start to approach INT_MAX here.
5958                  */
5959                 WARN_ON_ONCE(count == (INT_MAX / 2));
5960                 if (count == max)
5961                         break;
5962         }
5963         spin_unlock(&clp->cl_lock);
5964
5965         return count;
5966 }
5967
5968 static u64
5969 nfsd_print_client_openowners(struct nfs4_client *clp)
5970 {
5971         u64 count = nfsd_foreach_client_openowner(clp, 0, NULL, NULL);
5972
5973         nfsd_print_count(clp, count, "openowners");
5974         return count;
5975 }
5976
5977 static u64
5978 nfsd_collect_client_openowners(struct nfs4_client *clp,
5979                                struct list_head *collect, u64 max)
5980 {
5981         return nfsd_foreach_client_openowner(clp, max, collect,
5982                                                 unhash_openowner_locked);
5983 }
5984
5985 u64
5986 nfsd_inject_print_openowners(void)
5987 {
5988         struct nfs4_client *clp;
5989         u64 count = 0;
5990         struct nfsd_net *nn = net_generic(current->nsproxy->net_ns,
5991                                                 nfsd_net_id);
5992
5993         if (!nfsd_netns_ready(nn))
5994                 return 0;
5995
5996         spin_lock(&nn->client_lock);
5997         list_for_each_entry(clp, &nn->client_lru, cl_lru)
5998                 count += nfsd_print_client_openowners(clp);
5999         spin_unlock(&nn->client_lock);
6000
6001         return count;
6002 }
6003
6004 static void
6005 nfsd_reap_openowners(struct list_head *reaplist)
6006 {
6007         struct nfs4_client *clp;
6008         struct nfs4_openowner *oop, *next;
6009
6010         list_for_each_entry_safe(oop, next, reaplist, oo_perclient) {
6011                 list_del_init(&oop->oo_perclient);
6012                 clp = oop->oo_owner.so_client;
6013                 release_openowner(oop);
6014                 put_client(clp);
6015         }
6016 }
6017
6018 u64
6019 nfsd_inject_forget_client_openowners(struct sockaddr_storage *addr,
6020                                      size_t addr_size)
6021 {
6022         unsigned int count = 0;
6023         struct nfs4_client *clp;
6024         struct nfsd_net *nn = net_generic(current->nsproxy->net_ns,
6025                                                 nfsd_net_id);
6026         LIST_HEAD(reaplist);
6027
6028         if (!nfsd_netns_ready(nn))
6029                 return count;
6030
6031         spin_lock(&nn->client_lock);
6032         clp = nfsd_find_client(addr, addr_size);
6033         if (clp)
6034                 count = nfsd_collect_client_openowners(clp, &reaplist, 0);
6035         spin_unlock(&nn->client_lock);
6036         nfsd_reap_openowners(&reaplist);
6037         return count;
6038 }
6039
6040 u64
6041 nfsd_inject_forget_openowners(u64 max)
6042 {
6043         u64 count = 0;
6044         struct nfs4_client *clp;
6045         struct nfsd_net *nn = net_generic(current->nsproxy->net_ns,
6046                                                 nfsd_net_id);
6047         LIST_HEAD(reaplist);
6048
6049         if (!nfsd_netns_ready(nn))
6050                 return count;
6051
6052         spin_lock(&nn->client_lock);
6053         list_for_each_entry(clp, &nn->client_lru, cl_lru) {
6054                 count += nfsd_collect_client_openowners(clp, &reaplist,
6055                                                         max - count);
6056                 if (max != 0 && count >= max)
6057                         break;
6058         }
6059         spin_unlock(&nn->client_lock);
6060         nfsd_reap_openowners(&reaplist);
6061         return count;
6062 }
6063
6064 static u64 nfsd_find_all_delegations(struct nfs4_client *clp, u64 max,
6065                                      struct list_head *victims)
6066 {
6067         struct nfs4_delegation *dp, *next;
6068         struct nfsd_net *nn = net_generic(current->nsproxy->net_ns,
6069                                                 nfsd_net_id);
6070         u64 count = 0;
6071
6072         lockdep_assert_held(&nn->client_lock);
6073
6074         spin_lock(&state_lock);
6075         list_for_each_entry_safe(dp, next, &clp->cl_delegations, dl_perclnt) {
6076                 if (victims) {
6077                         /*
6078                          * It's not safe to mess with delegations that have a
6079                          * non-zero dl_time. They might have already been broken
6080                          * and could be processed by the laundromat outside of
6081                          * the state_lock. Just leave them be.
6082                          */
6083                         if (dp->dl_time != 0)
6084                                 continue;
6085
6086                         atomic_inc(&clp->cl_refcount);
6087                         unhash_delegation_locked(dp);
6088                         list_add(&dp->dl_recall_lru, victims);
6089                 }
6090                 ++count;
6091                 /*
6092                  * Despite the fact that these functions deal with
6093                  * 64-bit integers for "count", we must ensure that
6094                  * it doesn't blow up the clp->cl_refcount. Throw a
6095                  * warning if we start to approach INT_MAX here.
6096                  */
6097                 WARN_ON_ONCE(count == (INT_MAX / 2));
6098                 if (count == max)
6099                         break;
6100         }
6101         spin_unlock(&state_lock);
6102         return count;
6103 }
6104
6105 static u64
6106 nfsd_print_client_delegations(struct nfs4_client *clp)
6107 {
6108         u64 count = nfsd_find_all_delegations(clp, 0, NULL);
6109
6110         nfsd_print_count(clp, count, "delegations");
6111         return count;
6112 }
6113
6114 u64
6115 nfsd_inject_print_delegations(void)
6116 {
6117         struct nfs4_client *clp;
6118         u64 count = 0;
6119         struct nfsd_net *nn = net_generic(current->nsproxy->net_ns,
6120                                                 nfsd_net_id);
6121
6122         if (!nfsd_netns_ready(nn))
6123                 return 0;
6124
6125         spin_lock(&nn->client_lock);
6126         list_for_each_entry(clp, &nn->client_lru, cl_lru)
6127                 count += nfsd_print_client_delegations(clp);
6128         spin_unlock(&nn->client_lock);
6129
6130         return count;
6131 }
6132
6133 static void
6134 nfsd_forget_delegations(struct list_head *reaplist)
6135 {
6136         struct nfs4_client *clp;
6137         struct nfs4_delegation *dp, *next;
6138
6139         list_for_each_entry_safe(dp, next, reaplist, dl_recall_lru) {
6140                 list_del_init(&dp->dl_recall_lru);
6141                 clp = dp->dl_stid.sc_client;
6142                 revoke_delegation(dp);
6143                 put_client(clp);
6144         }
6145 }
6146
6147 u64
6148 nfsd_inject_forget_client_delegations(struct sockaddr_storage *addr,
6149                                       size_t addr_size)
6150 {
6151         u64 count = 0;
6152         struct nfs4_client *clp;
6153         struct nfsd_net *nn = net_generic(current->nsproxy->net_ns,
6154                                                 nfsd_net_id);
6155         LIST_HEAD(reaplist);
6156
6157         if (!nfsd_netns_ready(nn))
6158                 return count;
6159
6160         spin_lock(&nn->client_lock);
6161         clp = nfsd_find_client(addr, addr_size);
6162         if (clp)
6163                 count = nfsd_find_all_delegations(clp, 0, &reaplist);
6164         spin_unlock(&nn->client_lock);
6165
6166         nfsd_forget_delegations(&reaplist);
6167         return count;
6168 }
6169
6170 u64
6171 nfsd_inject_forget_delegations(u64 max)
6172 {
6173         u64 count = 0;
6174         struct nfs4_client *clp;
6175         struct nfsd_net *nn = net_generic(current->nsproxy->net_ns,
6176                                                 nfsd_net_id);
6177         LIST_HEAD(reaplist);
6178
6179         if (!nfsd_netns_ready(nn))
6180                 return count;
6181
6182         spin_lock(&nn->client_lock);
6183         list_for_each_entry(clp, &nn->client_lru, cl_lru) {
6184                 count += nfsd_find_all_delegations(clp, max - count, &reaplist);
6185                 if (max != 0 && count >= max)
6186                         break;
6187         }
6188         spin_unlock(&nn->client_lock);
6189         nfsd_forget_delegations(&reaplist);
6190         return count;
6191 }
6192
6193 static void
6194 nfsd_recall_delegations(struct list_head *reaplist)
6195 {
6196         struct nfs4_client *clp;
6197         struct nfs4_delegation *dp, *next;
6198
6199         list_for_each_entry_safe(dp, next, reaplist, dl_recall_lru) {
6200                 list_del_init(&dp->dl_recall_lru);
6201                 clp = dp->dl_stid.sc_client;
6202                 /*
6203                  * We skipped all entries that had a zero dl_time before,
6204                  * so we can now reset the dl_time back to 0. If a delegation
6205                  * break comes in now, then it won't make any difference since
6206                  * we're recalling it either way.
6207                  */
6208                 spin_lock(&state_lock);
6209                 dp->dl_time = 0;
6210                 spin_unlock(&state_lock);
6211                 nfsd_break_one_deleg(dp);
6212                 put_client(clp);
6213         }
6214 }
6215
6216 u64
6217 nfsd_inject_recall_client_delegations(struct sockaddr_storage *addr,
6218                                       size_t addr_size)
6219 {
6220         u64 count = 0;
6221         struct nfs4_client *clp;
6222         struct nfsd_net *nn = net_generic(current->nsproxy->net_ns,
6223                                                 nfsd_net_id);
6224         LIST_HEAD(reaplist);
6225
6226         if (!nfsd_netns_ready(nn))
6227                 return count;
6228
6229         spin_lock(&nn->client_lock);
6230         clp = nfsd_find_client(addr, addr_size);
6231         if (clp)
6232                 count = nfsd_find_all_delegations(clp, 0, &reaplist);
6233         spin_unlock(&nn->client_lock);
6234
6235         nfsd_recall_delegations(&reaplist);
6236         return count;
6237 }
6238
6239 u64
6240 nfsd_inject_recall_delegations(u64 max)
6241 {
6242         u64 count = 0;
6243         struct nfs4_client *clp, *next;
6244         struct nfsd_net *nn = net_generic(current->nsproxy->net_ns,
6245                                                 nfsd_net_id);
6246         LIST_HEAD(reaplist);
6247
6248         if (!nfsd_netns_ready(nn))
6249                 return count;
6250
6251         spin_lock(&nn->client_lock);
6252         list_for_each_entry_safe(clp, next, &nn->client_lru, cl_lru) {
6253                 count += nfsd_find_all_delegations(clp, max - count, &reaplist);
6254                 if (max != 0 && ++count >= max)
6255                         break;
6256         }
6257         spin_unlock(&nn->client_lock);
6258         nfsd_recall_delegations(&reaplist);
6259         return count;
6260 }
6261 #endif /* CONFIG_NFSD_FAULT_INJECTION */
6262
6263 /*
6264  * Since the lifetime of a delegation isn't limited to that of an open, a
6265  * client may quite reasonably hang on to a delegation as long as it has
6266  * the inode cached.  This becomes an obvious problem the first time a
6267  * client's inode cache approaches the size of the server's total memory.
6268  *
6269  * For now we avoid this problem by imposing a hard limit on the number
6270  * of delegations, which varies according to the server's memory size.
6271  */
6272 static void
6273 set_max_delegations(void)
6274 {
6275         /*
6276          * Allow at most 4 delegations per megabyte of RAM.  Quick
6277          * estimates suggest that in the worst case (where every delegation
6278          * is for a different inode), a delegation could take about 1.5K,
6279          * giving a worst case usage of about 6% of memory.
6280          */
6281         max_delegations = nr_free_buffer_pages() >> (20 - 2 - PAGE_SHIFT);
6282 }
6283
6284 static int nfs4_state_create_net(struct net *net)
6285 {
6286         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
6287         int i;
6288
6289         nn->conf_id_hashtbl = kmalloc(sizeof(struct list_head) *
6290                         CLIENT_HASH_SIZE, GFP_KERNEL);
6291         if (!nn->conf_id_hashtbl)
6292                 goto err;
6293         nn->unconf_id_hashtbl = kmalloc(sizeof(struct list_head) *
6294                         CLIENT_HASH_SIZE, GFP_KERNEL);
6295         if (!nn->unconf_id_hashtbl)
6296                 goto err_unconf_id;
6297         nn->sessionid_hashtbl = kmalloc(sizeof(struct list_head) *
6298                         SESSION_HASH_SIZE, GFP_KERNEL);
6299         if (!nn->sessionid_hashtbl)
6300                 goto err_sessionid;
6301
6302         for (i = 0; i < CLIENT_HASH_SIZE; i++) {
6303                 INIT_LIST_HEAD(&nn->conf_id_hashtbl[i]);
6304                 INIT_LIST_HEAD(&nn->unconf_id_hashtbl[i]);
6305         }
6306         for (i = 0; i < SESSION_HASH_SIZE; i++)
6307                 INIT_LIST_HEAD(&nn->sessionid_hashtbl[i]);
6308         nn->conf_name_tree = RB_ROOT;
6309         nn->unconf_name_tree = RB_ROOT;
6310         INIT_LIST_HEAD(&nn->client_lru);
6311         INIT_LIST_HEAD(&nn->close_lru);
6312         INIT_LIST_HEAD(&nn->del_recall_lru);
6313         spin_lock_init(&nn->client_lock);
6314
6315         INIT_DELAYED_WORK(&nn->laundromat_work, laundromat_main);
6316         get_net(net);
6317
6318         return 0;
6319
6320 err_sessionid:
6321         kfree(nn->unconf_id_hashtbl);
6322 err_unconf_id:
6323         kfree(nn->conf_id_hashtbl);
6324 err:
6325         return -ENOMEM;
6326 }
6327
6328 static void
6329 nfs4_state_destroy_net(struct net *net)
6330 {
6331         int i;
6332         struct nfs4_client *clp = NULL;
6333         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
6334
6335         for (i = 0; i < CLIENT_HASH_SIZE; i++) {
6336                 while (!list_empty(&nn->conf_id_hashtbl[i])) {
6337                         clp = list_entry(nn->conf_id_hashtbl[i].next, struct nfs4_client, cl_idhash);
6338                         destroy_client(clp);
6339                 }
6340         }
6341
6342         for (i = 0; i < CLIENT_HASH_SIZE; i++) {
6343                 while (!list_empty(&nn->unconf_id_hashtbl[i])) {
6344                         clp = list_entry(nn->unconf_id_hashtbl[i].next, struct nfs4_client, cl_idhash);
6345                         destroy_client(clp);
6346                 }
6347         }
6348
6349         kfree(nn->sessionid_hashtbl);
6350         kfree(nn->unconf_id_hashtbl);
6351         kfree(nn->conf_id_hashtbl);
6352         put_net(net);
6353 }
6354
6355 int
6356 nfs4_state_start_net(struct net *net)
6357 {
6358         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
6359         int ret;
6360
6361         ret = nfs4_state_create_net(net);
6362         if (ret)
6363                 return ret;
6364         nfsd4_client_tracking_init(net);
6365         nn->boot_time = get_seconds();
6366         locks_start_grace(net, &nn->nfsd4_manager);
6367         nn->grace_ended = false;
6368         printk(KERN_INFO "NFSD: starting %ld-second grace period (net %p)\n",
6369                nn->nfsd4_grace, net);
6370         queue_delayed_work(laundry_wq, &nn->laundromat_work, nn->nfsd4_grace * HZ);
6371         return 0;
6372 }
6373
6374 /* initialization to perform when the nfsd service is started: */
6375
6376 int
6377 nfs4_state_start(void)
6378 {
6379         int ret;
6380
6381         ret = set_callback_cred();
6382         if (ret)
6383                 return -ENOMEM;
6384         laundry_wq = create_singlethread_workqueue("nfsd4");
6385         if (laundry_wq == NULL) {
6386                 ret = -ENOMEM;
6387                 goto out_recovery;
6388         }
6389         ret = nfsd4_create_callback_queue();
6390         if (ret)
6391                 goto out_free_laundry;
6392
6393         set_max_delegations();
6394
6395         return 0;
6396
6397 out_free_laundry:
6398         destroy_workqueue(laundry_wq);
6399 out_recovery:
6400         return ret;
6401 }
6402
6403 void
6404 nfs4_state_shutdown_net(struct net *net)
6405 {
6406         struct nfs4_delegation *dp = NULL;
6407         struct list_head *pos, *next, reaplist;
6408         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
6409
6410         cancel_delayed_work_sync(&nn->laundromat_work);
6411         locks_end_grace(&nn->nfsd4_manager);
6412
6413         INIT_LIST_HEAD(&reaplist);
6414         spin_lock(&state_lock);
6415         list_for_each_safe(pos, next, &nn->del_recall_lru) {
6416                 dp = list_entry (pos, struct nfs4_delegation, dl_recall_lru);
6417                 unhash_delegation_locked(dp);
6418                 list_add(&dp->dl_recall_lru, &reaplist);
6419         }
6420         spin_unlock(&state_lock);
6421         list_for_each_safe(pos, next, &reaplist) {
6422                 dp = list_entry (pos, struct nfs4_delegation, dl_recall_lru);
6423                 list_del_init(&dp->dl_recall_lru);
6424                 nfs4_put_deleg_lease(dp->dl_stid.sc_file);
6425                 nfs4_put_stid(&dp->dl_stid);
6426         }
6427
6428         nfsd4_client_tracking_exit(net);
6429         nfs4_state_destroy_net(net);
6430 }
6431
6432 void
6433 nfs4_state_shutdown(void)
6434 {
6435         destroy_workqueue(laundry_wq);
6436         nfsd4_destroy_callback_queue();
6437 }
6438
6439 static void
6440 get_stateid(struct nfsd4_compound_state *cstate, stateid_t *stateid)
6441 {
6442         if (HAS_STATE_ID(cstate, CURRENT_STATE_ID_FLAG) && CURRENT_STATEID(stateid))
6443                 memcpy(stateid, &cstate->current_stateid, sizeof(stateid_t));
6444 }
6445
6446 static void
6447 put_stateid(struct nfsd4_compound_state *cstate, stateid_t *stateid)
6448 {
6449         if (cstate->minorversion) {
6450                 memcpy(&cstate->current_stateid, stateid, sizeof(stateid_t));
6451                 SET_STATE_ID(cstate, CURRENT_STATE_ID_FLAG);
6452         }
6453 }
6454
6455 void
6456 clear_current_stateid(struct nfsd4_compound_state *cstate)
6457 {
6458         CLEAR_STATE_ID(cstate, CURRENT_STATE_ID_FLAG);
6459 }
6460
6461 /*
6462  * functions to set current state id
6463  */
6464 void
6465 nfsd4_set_opendowngradestateid(struct nfsd4_compound_state *cstate, struct nfsd4_open_downgrade *odp)
6466 {
6467         put_stateid(cstate, &odp->od_stateid);
6468 }
6469
6470 void
6471 nfsd4_set_openstateid(struct nfsd4_compound_state *cstate, struct nfsd4_open *open)
6472 {
6473         put_stateid(cstate, &open->op_stateid);
6474 }
6475
6476 void
6477 nfsd4_set_closestateid(struct nfsd4_compound_state *cstate, struct nfsd4_close *close)
6478 {
6479         put_stateid(cstate, &close->cl_stateid);
6480 }
6481
6482 void
6483 nfsd4_set_lockstateid(struct nfsd4_compound_state *cstate, struct nfsd4_lock *lock)
6484 {
6485         put_stateid(cstate, &lock->lk_resp_stateid);
6486 }
6487
6488 /*
6489  * functions to consume current state id
6490  */
6491
6492 void
6493 nfsd4_get_opendowngradestateid(struct nfsd4_compound_state *cstate, struct nfsd4_open_downgrade *odp)
6494 {
6495         get_stateid(cstate, &odp->od_stateid);
6496 }
6497
6498 void
6499 nfsd4_get_delegreturnstateid(struct nfsd4_compound_state *cstate, struct nfsd4_delegreturn *drp)
6500 {
6501         get_stateid(cstate, &drp->dr_stateid);
6502 }
6503
6504 void
6505 nfsd4_get_freestateid(struct nfsd4_compound_state *cstate, struct nfsd4_free_stateid *fsp)
6506 {
6507         get_stateid(cstate, &fsp->fr_stateid);
6508 }
6509
6510 void
6511 nfsd4_get_setattrstateid(struct nfsd4_compound_state *cstate, struct nfsd4_setattr *setattr)
6512 {
6513         get_stateid(cstate, &setattr->sa_stateid);
6514 }
6515
6516 void
6517 nfsd4_get_closestateid(struct nfsd4_compound_state *cstate, struct nfsd4_close *close)
6518 {
6519         get_stateid(cstate, &close->cl_stateid);
6520 }
6521
6522 void
6523 nfsd4_get_lockustateid(struct nfsd4_compound_state *cstate, struct nfsd4_locku *locku)
6524 {
6525         get_stateid(cstate, &locku->lu_stateid);
6526 }
6527
6528 void
6529 nfsd4_get_readstateid(struct nfsd4_compound_state *cstate, struct nfsd4_read *read)
6530 {
6531         get_stateid(cstate, &read->rd_stateid);
6532 }
6533
6534 void
6535 nfsd4_get_writestateid(struct nfsd4_compound_state *cstate, struct nfsd4_write *write)
6536 {
6537         get_stateid(cstate, &write->wr_stateid);
6538 }