fs/nfsd/nfs4state.c

   1 /*
   2 *  Copyright (c) 2001 The Regents of the University of Michigan.
   3 *  All rights reserved.
   4 *
   5 *  Kendrick Smith <kmsmith@umich.edu>
   6 *  Andy Adamson <kandros@umich.edu>
   7 *
   8 *  Redistribution and use in source and binary forms, with or without
   9 *  modification, are permitted provided that the following conditions
  10 *  are met:
  11 *
  12 *  1. Redistributions of source code must retain the above copyright
  13 *     notice, this list of conditions and the following disclaimer.
  14 *  2. Redistributions in binary form must reproduce the above copyright
  15 *     notice, this list of conditions and the following disclaimer in the
  16 *     documentation and/or other materials provided with the distribution.
  17 *  3. Neither the name of the University nor the names of its
  18 *     contributors may be used to endorse or promote products derived
  19 *     from this software without specific prior written permission.
  20 *
  21 *  THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
  22 *  WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
  23 *  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
  24 *  DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
  25 *  FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  26 *  CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  27 *  SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
  28 *  BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
  29 *  LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
  30 *  NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
  31 *  SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  32 *
  33 */
  34
  35 #include <linux/file.h>
  36 #include <linux/fs.h>
  37 #include <linux/slab.h>
  38 #include <linux/namei.h>
  39 #include <linux/swap.h>
  40 #include <linux/pagemap.h>
  41 #include <linux/ratelimit.h>
  42 #include <linux/sunrpc/svcauth_gss.h>
  43 #include <linux/sunrpc/addr.h>
  44 #include <linux/hash.h>
  45 #include "xdr4.h"
  46 #include "xdr4cb.h"
  47 #include "vfs.h"
  48 #include "current_stateid.h"
  49
  50 #include "netns.h"
  51
  52 #define NFSDDBG_FACILITY                NFSDDBG_PROC
  53
  54 #define all_ones {{~0,~0},~0}
  55 static const stateid_t one_stateid = {
  56         .si_generation = ~0,
  57         .si_opaque = all_ones,
  58 };
  59 static const stateid_t zero_stateid = {
  60         /* all fields zero */
  61 };
  62 static const stateid_t currentstateid = {
  63         .si_generation = 1,
  64 };
  65
  66 static u64 current_sessionid = 1;
  67
  68 #define ZERO_STATEID(stateid) (!memcmp((stateid), &zero_stateid, sizeof(stateid_t)))
  69 #define ONE_STATEID(stateid)  (!memcmp((stateid), &one_stateid, sizeof(stateid_t)))
  70 #define CURRENT_STATEID(stateid) (!memcmp((stateid), &currentstateid, sizeof(stateid_t)))
  71
  72 /* forward declarations */
  73 static int check_for_locks(struct nfs4_file *filp, struct nfs4_lockowner *lowner);
  74
  75 /* Locking: */
  76
  77 /* Currently used for almost all code touching nfsv4 state: */
  78 static DEFINE_MUTEX(client_mutex);
  79
  80 /*
  81  * Currently used for the del_recall_lru and file hash table.  In an
  82  * effort to decrease the scope of the client_mutex, this spinlock may
  83  * eventually cover more:
  84  */
  85 static DEFINE_SPINLOCK(state_lock);
  86
  87 static struct kmem_cache *openowner_slab;
  88 static struct kmem_cache *lockowner_slab;
  89 static struct kmem_cache *file_slab;
  90 static struct kmem_cache *stateid_slab;
  91 static struct kmem_cache *deleg_slab;
  92
  93 void
  94 nfs4_lock_state(void)
  95 {
  96         mutex_lock(&client_mutex);
  97 }
  98
  99 static void free_session(struct nfsd4_session *);
 100
 101 static bool is_session_dead(struct nfsd4_session *ses)
 102 {
 103         return ses->se_flags & NFS4_SESSION_DEAD;
 104 }
 105
 106 static __be32 mark_session_dead_locked(struct nfsd4_session *ses, int ref_held_by_me)
 107 {
 108         if (atomic_read(&ses->se_ref) > ref_held_by_me)
 109                 return nfserr_jukebox;
 110         ses->se_flags |= NFS4_SESSION_DEAD;
 111         return nfs_ok;
 112 }
 113
 114 void
 115 nfs4_unlock_state(void)
 116 {
 117         mutex_unlock(&client_mutex);
 118 }
 119
 120 static bool is_client_expired(struct nfs4_client *clp)
 121 {
 122         return clp->cl_time == 0;
 123 }
 124
 125 static __be32 mark_client_expired_locked(struct nfs4_client *clp)
 126 {
 127         if (atomic_read(&clp->cl_refcount))
 128                 return nfserr_jukebox;
 129         clp->cl_time = 0;
 130         return nfs_ok;
 131 }
 132
 133 static __be32 mark_client_expired(struct nfs4_client *clp)
 134 {
 135         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
 136         __be32 ret;
 137
 138         spin_lock(&nn->client_lock);
 139         ret = mark_client_expired_locked(clp);
 140         spin_unlock(&nn->client_lock);
 141         return ret;
 142 }
 143
 144 static __be32 get_client_locked(struct nfs4_client *clp)
 145 {
 146         if (is_client_expired(clp))
 147                 return nfserr_expired;
 148         atomic_inc(&clp->cl_refcount);
 149         return nfs_ok;
 150 }
 151
 152 /* must be called under the client_lock */
 153 static inline void
 154 renew_client_locked(struct nfs4_client *clp)
 155 {
 156         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
 157
 158         if (is_client_expired(clp)) {
 159                 WARN_ON(1);
 160                 printk("%s: client (clientid %08x/%08x) already expired\n",
 161                         __func__,
 162                         clp->cl_clientid.cl_boot,
 163                         clp->cl_clientid.cl_id);
 164                 return;
 165         }
 166
 167         dprintk("renewing client (clientid %08x/%08x)\n",
 168                         clp->cl_clientid.cl_boot,
 169                         clp->cl_clientid.cl_id);
 170         list_move_tail(&clp->cl_lru, &nn->client_lru);
 171         clp->cl_time = get_seconds();
 172 }
 173
 174 static inline void
 175 renew_client(struct nfs4_client *clp)
 176 {
 177         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
 178
 179         spin_lock(&nn->client_lock);
 180         renew_client_locked(clp);
 181         spin_unlock(&nn->client_lock);
 182 }
 183
 184 static void put_client_renew_locked(struct nfs4_client *clp)
 185 {
 186         if (!atomic_dec_and_test(&clp->cl_refcount))
 187                 return;
 188         if (!is_client_expired(clp))
 189                 renew_client_locked(clp);
 190 }
 191
 192 static void put_client_renew(struct nfs4_client *clp)
 193 {
 194         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
 195
 196         if (!atomic_dec_and_lock(&clp->cl_refcount, &nn->client_lock))
 197                 return;
 198         if (!is_client_expired(clp))
 199                 renew_client_locked(clp);
 200         spin_unlock(&nn->client_lock);
 201 }
 202
 203 static __be32 nfsd4_get_session_locked(struct nfsd4_session *ses)
 204 {
 205         __be32 status;
 206
 207         if (is_session_dead(ses))
 208                 return nfserr_badsession;
 209         status = get_client_locked(ses->se_client);
 210         if (status)
 211                 return status;
 212         atomic_inc(&ses->se_ref);
 213         return nfs_ok;
 214 }
 215
 216 static void nfsd4_put_session_locked(struct nfsd4_session *ses)
 217 {
 218         struct nfs4_client *clp = ses->se_client;
 219
 220         if (atomic_dec_and_test(&ses->se_ref) && is_session_dead(ses))
 221                 free_session(ses);
 222         put_client_renew_locked(clp);
 223 }
 224
 225 static void nfsd4_put_session(struct nfsd4_session *ses)
 226 {
 227         struct nfs4_client *clp = ses->se_client;
 228         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
 229
 230         spin_lock(&nn->client_lock);
 231         nfsd4_put_session_locked(ses);
 232         spin_unlock(&nn->client_lock);
 233 }
 234
 235
 236 static inline u32
 237 opaque_hashval(const void *ptr, int nbytes)
 238 {
 239         unsigned char *cptr = (unsigned char *) ptr;
 240
 241         u32 x = 0;
 242         while (nbytes--) {
 243                 x *= 37;
 244                 x += *cptr++;
 245         }
 246         return x;
 247 }
 248
 249 static void nfsd4_free_file(struct nfs4_file *f)
 250 {
 251         kmem_cache_free(file_slab, f);
 252 }
 253
 254 static inline void
 255 put_nfs4_file(struct nfs4_file *fi)
 256 {
 257         might_lock(&state_lock);
 258
 259         if (atomic_dec_and_lock(&fi->fi_ref, &state_lock)) {
 260                 hlist_del(&fi->fi_hash);
 261                 spin_unlock(&state_lock);
 262                 iput(fi->fi_inode);
 263                 nfsd4_free_file(fi);
 264         }
 265 }
 266
 267 static inline void
 268 get_nfs4_file(struct nfs4_file *fi)
 269 {
 270         atomic_inc(&fi->fi_ref);
 271 }
 272
 273 static struct file *
 274 __nfs4_get_fd(struct nfs4_file *f, int oflag)
 275 {
 276         if (f->fi_fds[oflag])
 277                 return get_file(f->fi_fds[oflag]);
 278         return NULL;
 279 }
 280
 281 static struct file *
 282 find_writeable_file_locked(struct nfs4_file *f)
 283 {
 284         struct file *ret;
 285
 286         lockdep_assert_held(&f->fi_lock);
 287
 288         ret = __nfs4_get_fd(f, O_WRONLY);
 289         if (!ret)
 290                 ret = __nfs4_get_fd(f, O_RDWR);
 291         return ret;
 292 }
 293
 294 static struct file *
 295 find_writeable_file(struct nfs4_file *f)
 296 {
 297         struct file *ret;
 298
 299         spin_lock(&f->fi_lock);
 300         ret = find_writeable_file_locked(f);
 301         spin_unlock(&f->fi_lock);
 302
 303         return ret;
 304 }
 305
 306 static struct file *find_readable_file_locked(struct nfs4_file *f)
 307 {
 308         struct file *ret;
 309
 310         lockdep_assert_held(&f->fi_lock);
 311
 312         ret = __nfs4_get_fd(f, O_RDONLY);
 313         if (!ret)
 314                 ret = __nfs4_get_fd(f, O_RDWR);
 315         return ret;
 316 }
 317
 318 static struct file *
 319 find_readable_file(struct nfs4_file *f)
 320 {
 321         struct file *ret;
 322
 323         spin_lock(&f->fi_lock);
 324         ret = find_readable_file_locked(f);
 325         spin_unlock(&f->fi_lock);
 326
 327         return ret;
 328 }
 329
 330 static struct file *
 331 find_any_file(struct nfs4_file *f)
 332 {
 333         struct file *ret;
 334
 335         spin_lock(&f->fi_lock);
 336         ret = __nfs4_get_fd(f, O_RDWR);
 337         if (!ret) {
 338                 ret = __nfs4_get_fd(f, O_WRONLY);
 339                 if (!ret)
 340                         ret = __nfs4_get_fd(f, O_RDONLY);
 341         }
 342         spin_unlock(&f->fi_lock);
 343         return ret;
 344 }
 345
 346 static int num_delegations;
 347 unsigned long max_delegations;
 348
 349 /*
 350  * Open owner state (share locks)
 351  */
 352
 353 /* hash tables for lock and open owners */
 354 #define OWNER_HASH_BITS              8
 355 #define OWNER_HASH_SIZE             (1 << OWNER_HASH_BITS)
 356 #define OWNER_HASH_MASK             (OWNER_HASH_SIZE - 1)
 357
 358 static unsigned int ownerstr_hashval(u32 clientid, struct xdr_netobj *ownername)
 359 {
 360         unsigned int ret;
 361
 362         ret = opaque_hashval(ownername->data, ownername->len);
 363         ret += clientid;
 364         return ret & OWNER_HASH_MASK;
 365 }
 366
 367 /* hash table for nfs4_file */
 368 #define FILE_HASH_BITS                   8
 369 #define FILE_HASH_SIZE                  (1 << FILE_HASH_BITS)
 370
 371 static unsigned int file_hashval(struct inode *ino)
 372 {
 373         /* XXX: why are we hashing on inode pointer, anyway? */
 374         return hash_ptr(ino, FILE_HASH_BITS);
 375 }
 376
 377 static struct hlist_head file_hashtbl[FILE_HASH_SIZE];
 378
 379 static void
 380 __nfs4_file_get_access(struct nfs4_file *fp, u32 access)
 381 {
 382         lockdep_assert_held(&fp->fi_lock);
 383
 384         if (access & NFS4_SHARE_ACCESS_WRITE)
 385                 atomic_inc(&fp->fi_access[O_WRONLY]);
 386         if (access & NFS4_SHARE_ACCESS_READ)
 387                 atomic_inc(&fp->fi_access[O_RDONLY]);
 388 }
 389
 390 static __be32
 391 nfs4_file_get_access(struct nfs4_file *fp, u32 access)
 392 {
 393         lockdep_assert_held(&fp->fi_lock);
 394
 395         /* Does this access mode make sense? */
 396         if (access & ~NFS4_SHARE_ACCESS_BOTH)
 397                 return nfserr_inval;
 398
 399         /* Does it conflict with a deny mode already set? */
 400         if ((access & fp->fi_share_deny) != 0)
 401                 return nfserr_share_denied;
 402
 403         __nfs4_file_get_access(fp, access);
 404         return nfs_ok;
 405 }
 406
 407 static __be32 nfs4_file_check_deny(struct nfs4_file *fp, u32 deny)
 408 {
 409         /* Common case is that there is no deny mode. */
 410         if (deny) {
 411                 /* Does this deny mode make sense? */
 412                 if (deny & ~NFS4_SHARE_DENY_BOTH)
 413                         return nfserr_inval;
 414
 415                 if ((deny & NFS4_SHARE_DENY_READ) &&
 416                     atomic_read(&fp->fi_access[O_RDONLY]))
 417                         return nfserr_share_denied;
 418
 419                 if ((deny & NFS4_SHARE_DENY_WRITE) &&
 420                     atomic_read(&fp->fi_access[O_WRONLY]))
 421                         return nfserr_share_denied;
 422         }
 423         return nfs_ok;
 424 }
 425
 426 static void __nfs4_file_put_access(struct nfs4_file *fp, int oflag)
 427 {
 428         might_lock(&fp->fi_lock);
 429
 430         if (atomic_dec_and_lock(&fp->fi_access[oflag], &fp->fi_lock)) {
 431                 struct file *f1 = NULL;
 432                 struct file *f2 = NULL;
 433
 434                 swap(f1, fp->fi_fds[oflag]);
 435                 if (atomic_read(&fp->fi_access[1 - oflag]) == 0)
 436                         swap(f2, fp->fi_fds[O_RDWR]);
 437                 spin_unlock(&fp->fi_lock);
 438                 if (f1)
 439                         fput(f1);
 440                 if (f2)
 441                         fput(f2);
 442         }
 443 }
 444
 445 static void nfs4_file_put_access(struct nfs4_file *fp, u32 access)
 446 {
 447         WARN_ON_ONCE(access & ~NFS4_SHARE_ACCESS_BOTH);
 448
 449         if (access & NFS4_SHARE_ACCESS_WRITE)
 450                 __nfs4_file_put_access(fp, O_WRONLY);
 451         if (access & NFS4_SHARE_ACCESS_READ)
 452                 __nfs4_file_put_access(fp, O_RDONLY);
 453 }
 454
 455 static struct nfs4_stid *nfs4_alloc_stid(struct nfs4_client *cl, struct
 456 kmem_cache *slab)
 457 {
 458         struct idr *stateids = &cl->cl_stateids;
 459         struct nfs4_stid *stid;
 460         int new_id;
 461
 462         stid = kmem_cache_alloc(slab, GFP_KERNEL);
 463         if (!stid)
 464                 return NULL;
 465
 466         new_id = idr_alloc_cyclic(stateids, stid, 0, 0, GFP_KERNEL);
 467         if (new_id < 0)
 468                 goto out_free;
 469         stid->sc_client = cl;
 470         stid->sc_type = 0;
 471         stid->sc_stateid.si_opaque.so_id = new_id;
 472         stid->sc_stateid.si_opaque.so_clid = cl->cl_clientid;
 473         /* Will be incremented before return to client: */
 474         stid->sc_stateid.si_generation = 0;
 475         atomic_set(&stid->sc_count, 1);
 476
 477         /*
 478          * It shouldn't be a problem to reuse an opaque stateid value.
 479          * I don't think it is for 4.1.  But with 4.0 I worry that, for
 480          * example, a stray write retransmission could be accepted by
 481          * the server when it should have been rejected.  Therefore,
 482          * adopt a trick from the sctp code to attempt to maximize the
 483          * amount of time until an id is reused, by ensuring they always
 484          * "increase" (mod INT_MAX):
 485          */
 486         return stid;
 487 out_free:
 488         kmem_cache_free(slab, stid);
 489         return NULL;
 490 }
 491
 492 static struct nfs4_ol_stateid * nfs4_alloc_stateid(struct nfs4_client *clp)
 493 {
 494         return openlockstateid(nfs4_alloc_stid(clp, stateid_slab));
 495 }
 496
 497 /*
 498  * When we recall a delegation, we should be careful not to hand it
 499  * out again straight away.
 500  * To ensure this we keep a pair of bloom filters ('new' and 'old')
 501  * in which the filehandles of recalled delegations are "stored".
 502  * If a filehandle appear in either filter, a delegation is blocked.
 503  * When a delegation is recalled, the filehandle is stored in the "new"
 504  * filter.
 505  * Every 30 seconds we swap the filters and clear the "new" one,
 506  * unless both are empty of course.
 507  *
 508  * Each filter is 256 bits.  We hash the filehandle to 32bit and use the
 509  * low 3 bytes as hash-table indices.
 510  *
 511  * 'state_lock', which is always held when block_delegations() is called,
 512  * is used to manage concurrent access.  Testing does not need the lock
 513  * except when swapping the two filters.
 514  */
 515 static struct bloom_pair {
 516         int     entries, old_entries;
 517         time_t  swap_time;
 518         int     new; /* index into 'set' */
 519         DECLARE_BITMAP(set[2], 256);
 520 } blocked_delegations;
 521
 522 static int delegation_blocked(struct knfsd_fh *fh)
 523 {
 524         u32 hash;
 525         struct bloom_pair *bd = &blocked_delegations;
 526
 527         if (bd->entries == 0)
 528                 return 0;
 529         if (seconds_since_boot() - bd->swap_time > 30) {
 530                 spin_lock(&state_lock);
 531                 if (seconds_since_boot() - bd->swap_time > 30) {
 532                         bd->entries -= bd->old_entries;
 533                         bd->old_entries = bd->entries;
 534                         memset(bd->set[bd->new], 0,
 535                                sizeof(bd->set[0]));
 536                         bd->new = 1-bd->new;
 537                         bd->swap_time = seconds_since_boot();
 538                 }
 539                 spin_unlock(&state_lock);
 540         }
 541         hash = arch_fast_hash(&fh->fh_base, fh->fh_size, 0);
 542         if (test_bit(hash&255, bd->set[0]) &&
 543             test_bit((hash>>8)&255, bd->set[0]) &&
 544             test_bit((hash>>16)&255, bd->set[0]))
 545                 return 1;
 546
 547         if (test_bit(hash&255, bd->set[1]) &&
 548             test_bit((hash>>8)&255, bd->set[1]) &&
 549             test_bit((hash>>16)&255, bd->set[1]))
 550                 return 1;
 551
 552         return 0;
 553 }
 554
 555 static void block_delegations(struct knfsd_fh *fh)
 556 {
 557         u32 hash;
 558         struct bloom_pair *bd = &blocked_delegations;
 559
 560         lockdep_assert_held(&state_lock);
 561
 562         hash = arch_fast_hash(&fh->fh_base, fh->fh_size, 0);
 563
 564         __set_bit(hash&255, bd->set[bd->new]);
 565         __set_bit((hash>>8)&255, bd->set[bd->new]);
 566         __set_bit((hash>>16)&255, bd->set[bd->new]);
 567         if (bd->entries == 0)
 568                 bd->swap_time = seconds_since_boot();
 569         bd->entries += 1;
 570 }
 571
 572 static struct nfs4_delegation *
 573 alloc_init_deleg(struct nfs4_client *clp, struct nfs4_ol_stateid *stp, struct svc_fh *current_fh)
 574 {
 575         struct nfs4_delegation *dp;
 576
 577         dprintk("NFSD alloc_init_deleg\n");
 578         if (num_delegations > max_delegations)
 579                 return NULL;
 580         if (delegation_blocked(&current_fh->fh_handle))
 581                 return NULL;
 582         dp = delegstateid(nfs4_alloc_stid(clp, deleg_slab));
 583         if (dp == NULL)
 584                 return dp;
 585         /*
 586          * delegation seqid's are never incremented.  The 4.1 special
 587          * meaning of seqid 0 isn't meaningful, really, but let's avoid
 588          * 0 anyway just for consistency and use 1:
 589          */
 590         dp->dl_stid.sc_stateid.si_generation = 1;
 591         num_delegations++;
 592         INIT_LIST_HEAD(&dp->dl_perfile);
 593         INIT_LIST_HEAD(&dp->dl_perclnt);
 594         INIT_LIST_HEAD(&dp->dl_recall_lru);
 595         dp->dl_file = NULL;
 596         dp->dl_type = NFS4_OPEN_DELEGATE_READ;
 597         fh_copy_shallow(&dp->dl_fh, &current_fh->fh_handle);
 598         dp->dl_time = 0;
 599         INIT_WORK(&dp->dl_recall.cb_work, nfsd4_run_cb_recall);
 600         return dp;
 601 }
 602
 603 static void remove_stid(struct nfs4_stid *s)
 604 {
 605         struct idr *stateids = &s->sc_client->cl_stateids;
 606
 607         idr_remove(stateids, s->sc_stateid.si_opaque.so_id);
 608 }
 609
 610 static void nfs4_free_stid(struct kmem_cache *slab, struct nfs4_stid *s)
 611 {
 612         kmem_cache_free(slab, s);
 613 }
 614
 615 void
 616 nfs4_put_delegation(struct nfs4_delegation *dp)
 617 {
 618         if (atomic_dec_and_test(&dp->dl_stid.sc_count)) {
 619                 remove_stid(&dp->dl_stid);
 620                 nfs4_free_stid(deleg_slab, &dp->dl_stid);
 621                 num_delegations--;
 622         }
 623 }
 624
 625 static void nfs4_put_deleg_lease(struct nfs4_file *fp)
 626 {
 627         lockdep_assert_held(&state_lock);
 628
 629         if (!fp->fi_lease)
 630                 return;
 631         if (atomic_dec_and_test(&fp->fi_delegees)) {
 632                 vfs_setlease(fp->fi_deleg_file, F_UNLCK, &fp->fi_lease);
 633                 fp->fi_lease = NULL;
 634                 fput(fp->fi_deleg_file);
 635                 fp->fi_deleg_file = NULL;
 636         }
 637 }
 638
 639 static void unhash_stid(struct nfs4_stid *s)
 640 {
 641         s->sc_type = 0;
 642 }
 643
 644 static void
 645 hash_delegation_locked(struct nfs4_delegation *dp, struct nfs4_file *fp)
 646 {
 647         lockdep_assert_held(&state_lock);
 648         lockdep_assert_held(&fp->fi_lock);
 649
 650         dp->dl_stid.sc_type = NFS4_DELEG_STID;
 651         list_add(&dp->dl_perfile, &fp->fi_delegations);
 652         list_add(&dp->dl_perclnt, &dp->dl_stid.sc_client->cl_delegations);
 653 }
 654
 655 /* Called under the state lock. */
 656 static void
 657 unhash_delegation(struct nfs4_delegation *dp)
 658 {
 659         struct nfs4_file *fp = dp->dl_file;
 660
 661         spin_lock(&state_lock);
 662         dp->dl_stid.sc_type = NFS4_CLOSED_DELEG_STID;
 663         /* Ensure that deleg break won't try to requeue it */
 664         ++dp->dl_time;
 665         spin_lock(&fp->fi_lock);
 666         list_del_init(&dp->dl_perclnt);
 667         list_del_init(&dp->dl_recall_lru);
 668         list_del_init(&dp->dl_perfile);
 669         spin_unlock(&fp->fi_lock);
 670         if (fp) {
 671                 nfs4_put_deleg_lease(fp);
 672                 dp->dl_file = NULL;
 673         }
 674         spin_unlock(&state_lock);
 675         if (fp)
 676                 put_nfs4_file(fp);
 677 }
 678
 679 static void destroy_revoked_delegation(struct nfs4_delegation *dp)
 680 {
 681         list_del_init(&dp->dl_recall_lru);
 682         nfs4_put_delegation(dp);
 683 }
 684
 685 static void destroy_delegation(struct nfs4_delegation *dp)
 686 {
 687         unhash_delegation(dp);
 688         nfs4_put_delegation(dp);
 689 }
 690
 691 static void revoke_delegation(struct nfs4_delegation *dp)
 692 {
 693         struct nfs4_client *clp = dp->dl_stid.sc_client;
 694
 695         if (clp->cl_minorversion == 0)
 696                 destroy_delegation(dp);
 697         else {
 698                 unhash_delegation(dp);
 699                 dp->dl_stid.sc_type = NFS4_REVOKED_DELEG_STID;
 700                 list_add(&dp->dl_recall_lru, &clp->cl_revoked);
 701         }
 702 }
 703
 704 /*
 705  * SETCLIENTID state
 706  */
 707
 708 static unsigned int clientid_hashval(u32 id)
 709 {
 710         return id & CLIENT_HASH_MASK;
 711 }
 712
 713 static unsigned int clientstr_hashval(const char *name)
 714 {
 715         return opaque_hashval(name, 8) & CLIENT_HASH_MASK;
 716 }
 717
 718 /*
 719  * We store the NONE, READ, WRITE, and BOTH bits separately in the
 720  * st_{access,deny}_bmap field of the stateid, in order to track not
 721  * only what share bits are currently in force, but also what
 722  * combinations of share bits previous opens have used.  This allows us
 723  * to enforce the recommendation of rfc 3530 14.2.19 that the server
 724  * return an error if the client attempt to downgrade to a combination
 725  * of share bits not explicable by closing some of its previous opens.
 726  *
 727  * XXX: This enforcement is actually incomplete, since we don't keep
 728  * track of access/deny bit combinations; so, e.g., we allow:
 729  *
 730  *      OPEN allow read, deny write
 731  *      OPEN allow both, deny none
 732  *      DOWNGRADE allow read, deny none
 733  *
 734  * which we should reject.
 735  */
 736 static unsigned int
 737 bmap_to_share_mode(unsigned long bmap) {
 738         int i;
 739         unsigned int access = 0;
 740
 741         for (i = 1; i < 4; i++) {
 742                 if (test_bit(i, &bmap))
 743                         access |= i;
 744         }
 745         return access;
 746 }
 747
 748 /* set share access for a given stateid */
 749 static inline void
 750 set_access(u32 access, struct nfs4_ol_stateid *stp)
 751 {
 752         unsigned char mask = 1 << access;
 753
 754         WARN_ON_ONCE(access > NFS4_SHARE_ACCESS_BOTH);
 755         stp->st_access_bmap |= mask;
 756 }
 757
 758 /* clear share access for a given stateid */
 759 static inline void
 760 clear_access(u32 access, struct nfs4_ol_stateid *stp)
 761 {
 762         unsigned char mask = 1 << access;
 763
 764         WARN_ON_ONCE(access > NFS4_SHARE_ACCESS_BOTH);
 765         stp->st_access_bmap &= ~mask;
 766 }
 767
 768 /* test whether a given stateid has access */
 769 static inline bool
 770 test_access(u32 access, struct nfs4_ol_stateid *stp)
 771 {
 772         unsigned char mask = 1 << access;
 773
 774         return (bool)(stp->st_access_bmap & mask);
 775 }
 776
 777 /* set share deny for a given stateid */
 778 static inline void
 779 set_deny(u32 deny, struct nfs4_ol_stateid *stp)
 780 {
 781         unsigned char mask = 1 << deny;
 782
 783         WARN_ON_ONCE(deny > NFS4_SHARE_DENY_BOTH);
 784         stp->st_deny_bmap |= mask;
 785 }
 786
 787 /* clear share deny for a given stateid */
 788 static inline void
 789 clear_deny(u32 deny, struct nfs4_ol_stateid *stp)
 790 {
 791         unsigned char mask = 1 << deny;
 792
 793         WARN_ON_ONCE(deny > NFS4_SHARE_DENY_BOTH);
 794         stp->st_deny_bmap &= ~mask;
 795 }
 796
 797 /* test whether a given stateid is denying specific access */
 798 static inline bool
 799 test_deny(u32 deny, struct nfs4_ol_stateid *stp)
 800 {
 801         unsigned char mask = 1 << deny;
 802
 803         return (bool)(stp->st_deny_bmap & mask);
 804 }
 805
 806 static int nfs4_access_to_omode(u32 access)
 807 {
 808         switch (access & NFS4_SHARE_ACCESS_BOTH) {
 809         case NFS4_SHARE_ACCESS_READ:
 810                 return O_RDONLY;
 811         case NFS4_SHARE_ACCESS_WRITE:
 812                 return O_WRONLY;
 813         case NFS4_SHARE_ACCESS_BOTH:
 814                 return O_RDWR;
 815         }
 816         WARN_ON_ONCE(1);
 817         return O_RDONLY;
 818 }
 819
 820 /*
 821  * A stateid that had a deny mode associated with it is being released
 822  * or downgraded. Recalculate the deny mode on the file.
 823  */
 824 static void
 825 recalculate_deny_mode(struct nfs4_file *fp)
 826 {
 827         struct nfs4_ol_stateid *stp;
 828
 829         spin_lock(&fp->fi_lock);
 830         fp->fi_share_deny = 0;
 831         list_for_each_entry(stp, &fp->fi_stateids, st_perfile)
 832                 fp->fi_share_deny |= bmap_to_share_mode(stp->st_deny_bmap);
 833         spin_unlock(&fp->fi_lock);
 834 }
 835
 836 static void
 837 reset_union_bmap_deny(u32 deny, struct nfs4_ol_stateid *stp)
 838 {
 839         int i;
 840         bool change = false;
 841
 842         for (i = 1; i < 4; i++) {
 843                 if ((i & deny) != i) {
 844                         change = true;
 845                         clear_deny(i, stp);
 846                 }
 847         }
 848
 849         /* Recalculate per-file deny mode if there was a change */
 850         if (change)
 851                 recalculate_deny_mode(stp->st_file);
 852 }
 853
 854 /* release all access and file references for a given stateid */
 855 static void
 856 release_all_access(struct nfs4_ol_stateid *stp)
 857 {
 858         int i;
 859         struct nfs4_file *fp = stp->st_file;
 860
 861         if (fp && stp->st_deny_bmap != 0)
 862                 recalculate_deny_mode(fp);
 863
 864         for (i = 1; i < 4; i++) {
 865                 if (test_access(i, stp))
 866                         nfs4_file_put_access(stp->st_file, i);
 867                 clear_access(i, stp);
 868         }
 869 }
 870
 871 static void unhash_generic_stateid(struct nfs4_ol_stateid *stp)
 872 {
 873         struct nfs4_file *fp = stp->st_file;
 874
 875         spin_lock(&fp->fi_lock);
 876         list_del(&stp->st_perfile);
 877         spin_unlock(&fp->fi_lock);
 878         list_del(&stp->st_perstateowner);
 879 }
 880
 881 static void close_generic_stateid(struct nfs4_ol_stateid *stp)
 882 {
 883         release_all_access(stp);
 884         put_nfs4_file(stp->st_file);
 885         stp->st_file = NULL;
 886 }
 887
 888 static void free_generic_stateid(struct nfs4_ol_stateid *stp)
 889 {
 890         remove_stid(&stp->st_stid);
 891         nfs4_free_stid(stateid_slab, &stp->st_stid);
 892 }
 893
 894 static void __release_lock_stateid(struct nfs4_ol_stateid *stp)
 895 {
 896         struct file *file;
 897
 898         list_del(&stp->st_locks);
 899         unhash_generic_stateid(stp);
 900         unhash_stid(&stp->st_stid);
 901         file = find_any_file(stp->st_file);
 902         if (file)
 903                 filp_close(file, (fl_owner_t)lockowner(stp->st_stateowner));
 904         close_generic_stateid(stp);
 905         free_generic_stateid(stp);
 906 }
 907
 908 static void unhash_lockowner(struct nfs4_lockowner *lo)
 909 {
 910         struct nfs4_ol_stateid *stp;
 911
 912         list_del(&lo->lo_owner.so_strhash);
 913         while (!list_empty(&lo->lo_owner.so_stateids)) {
 914                 stp = list_first_entry(&lo->lo_owner.so_stateids,
 915                                 struct nfs4_ol_stateid, st_perstateowner);
 916                 __release_lock_stateid(stp);
 917         }
 918 }
 919
 920 static void nfs4_free_lockowner(struct nfs4_lockowner *lo)
 921 {
 922         kfree(lo->lo_owner.so_owner.data);
 923         kmem_cache_free(lockowner_slab, lo);
 924 }
 925
 926 static void release_lockowner(struct nfs4_lockowner *lo)
 927 {
 928         unhash_lockowner(lo);
 929         nfs4_free_lockowner(lo);
 930 }
 931
 932 static void release_lockowner_if_empty(struct nfs4_lockowner *lo)
 933 {
 934         if (list_empty(&lo->lo_owner.so_stateids))
 935                 release_lockowner(lo);
 936 }
 937
 938 static void release_lock_stateid(struct nfs4_ol_stateid *stp)
 939 {
 940         struct nfs4_lockowner *lo;
 941
 942         lo = lockowner(stp->st_stateowner);
 943         __release_lock_stateid(stp);
 944         release_lockowner_if_empty(lo);
 945 }
 946
 947 static void release_open_stateid_locks(struct nfs4_ol_stateid *open_stp)
 948 {
 949         struct nfs4_ol_stateid *stp;
 950
 951         while (!list_empty(&open_stp->st_locks)) {
 952                 stp = list_entry(open_stp->st_locks.next,
 953                                 struct nfs4_ol_stateid, st_locks);
 954                 release_lock_stateid(stp);
 955         }
 956 }
 957
 958 static void unhash_open_stateid(struct nfs4_ol_stateid *stp)
 959 {
 960         unhash_generic_stateid(stp);
 961         release_open_stateid_locks(stp);
 962         close_generic_stateid(stp);
 963 }
 964
 965 static void release_open_stateid(struct nfs4_ol_stateid *stp)
 966 {
 967         unhash_open_stateid(stp);
 968         free_generic_stateid(stp);
 969 }
 970
 971 static void unhash_openowner(struct nfs4_openowner *oo)
 972 {
 973         struct nfs4_ol_stateid *stp;
 974
 975         list_del(&oo->oo_owner.so_strhash);
 976         list_del(&oo->oo_perclient);
 977         while (!list_empty(&oo->oo_owner.so_stateids)) {
 978                 stp = list_first_entry(&oo->oo_owner.so_stateids,
 979                                 struct nfs4_ol_stateid, st_perstateowner);
 980                 release_open_stateid(stp);
 981         }
 982 }
 983
 984 static void release_last_closed_stateid(struct nfs4_openowner *oo)
 985 {
 986         struct nfs4_ol_stateid *s = oo->oo_last_closed_stid;
 987
 988         if (s) {
 989                 free_generic_stateid(s);
 990                 oo->oo_last_closed_stid = NULL;
 991         }
 992 }
 993
 994 static void nfs4_free_openowner(struct nfs4_openowner *oo)
 995 {
 996         kfree(oo->oo_owner.so_owner.data);
 997         kmem_cache_free(openowner_slab, oo);
 998 }
 999
1000 static void release_openowner(struct nfs4_openowner *oo)
1001 {
1002         unhash_openowner(oo);
1003         list_del(&oo->oo_close_lru);
1004         release_last_closed_stateid(oo);
1005         nfs4_free_openowner(oo);
1006 }
1007
1008 static inline int
1009 hash_sessionid(struct nfs4_sessionid *sessionid)
1010 {
1011         struct nfsd4_sessionid *sid = (struct nfsd4_sessionid *)sessionid;
1012
1013         return sid->sequence % SESSION_HASH_SIZE;
1014 }
1015
1016 #ifdef NFSD_DEBUG
1017 static inline void
1018 dump_sessionid(const char *fn, struct nfs4_sessionid *sessionid)
1019 {
1020         u32 *ptr = (u32 *)(&sessionid->data[0]);
1021         dprintk("%s: %u:%u:%u:%u\n", fn, ptr[0], ptr[1], ptr[2], ptr[3]);
1022 }
1023 #else
1024 static inline void
1025 dump_sessionid(const char *fn, struct nfs4_sessionid *sessionid)
1026 {
1027 }
1028 #endif
1029
1030 /*
1031  * Bump the seqid on cstate->replay_owner, and clear replay_owner if it
1032  * won't be used for replay.
1033  */
1034 void nfsd4_bump_seqid(struct nfsd4_compound_state *cstate, __be32 nfserr)
1035 {
1036         struct nfs4_stateowner *so = cstate->replay_owner;
1037
1038         if (nfserr == nfserr_replay_me)
1039                 return;
1040
1041         if (!seqid_mutating_err(ntohl(nfserr))) {
1042                 cstate->replay_owner = NULL;
1043                 return;
1044         }
1045         if (!so)
1046                 return;
1047         if (so->so_is_open_owner)
1048                 release_last_closed_stateid(openowner(so));
1049         so->so_seqid++;
1050         return;
1051 }
1052
1053 static void
1054 gen_sessionid(struct nfsd4_session *ses)
1055 {
1056         struct nfs4_client *clp = ses->se_client;
1057         struct nfsd4_sessionid *sid;
1058
1059         sid = (struct nfsd4_sessionid *)ses->se_sessionid.data;
1060         sid->clientid = clp->cl_clientid;
1061         sid->sequence = current_sessionid++;
1062         sid->reserved = 0;
1063 }
1064
1065 /*
1066  * The protocol defines ca_maxresponssize_cached to include the size of
1067  * the rpc header, but all we need to cache is the data starting after
1068  * the end of the initial SEQUENCE operation--the rest we regenerate
1069  * each time.  Therefore we can advertise a ca_maxresponssize_cached
1070  * value that is the number of bytes in our cache plus a few additional
1071  * bytes.  In order to stay on the safe side, and not promise more than
1072  * we can cache, those additional bytes must be the minimum possible: 24
1073  * bytes of rpc header (xid through accept state, with AUTH_NULL
1074  * verifier), 12 for the compound header (with zero-length tag), and 44
1075  * for the SEQUENCE op response:
1076  */
1077 #define NFSD_MIN_HDR_SEQ_SZ  (24 + 12 + 44)
1078
1079 static void
1080 free_session_slots(struct nfsd4_session *ses)
1081 {
1082         int i;
1083
1084         for (i = 0; i < ses->se_fchannel.maxreqs; i++)
1085                 kfree(ses->se_slots[i]);
1086 }
1087
1088 /*
1089  * We don't actually need to cache the rpc and session headers, so we
1090  * can allocate a little less for each slot:
1091  */
1092 static inline u32 slot_bytes(struct nfsd4_channel_attrs *ca)
1093 {
1094         u32 size;
1095
1096         if (ca->maxresp_cached < NFSD_MIN_HDR_SEQ_SZ)
1097                 size = 0;
1098         else
1099                 size = ca->maxresp_cached - NFSD_MIN_HDR_SEQ_SZ;
1100         return size + sizeof(struct nfsd4_slot);
1101 }
1102
1103 /*
1104  * XXX: If we run out of reserved DRC memory we could (up to a point)
1105  * re-negotiate active sessions and reduce their slot usage to make
1106  * room for new connections. For now we just fail the create session.
1107  */
1108 static u32 nfsd4_get_drc_mem(struct nfsd4_channel_attrs *ca)
1109 {
1110         u32 slotsize = slot_bytes(ca);
1111         u32 num = ca->maxreqs;
1112         int avail;
1113
1114         spin_lock(&nfsd_drc_lock);
1115         avail = min((unsigned long)NFSD_MAX_MEM_PER_SESSION,
1116                     nfsd_drc_max_mem - nfsd_drc_mem_used);
1117         num = min_t(int, num, avail / slotsize);
1118         nfsd_drc_mem_used += num * slotsize;
1119         spin_unlock(&nfsd_drc_lock);
1120
1121         return num;
1122 }
1123
1124 static void nfsd4_put_drc_mem(struct nfsd4_channel_attrs *ca)
1125 {
1126         int slotsize = slot_bytes(ca);
1127
1128         spin_lock(&nfsd_drc_lock);
1129         nfsd_drc_mem_used -= slotsize * ca->maxreqs;
1130         spin_unlock(&nfsd_drc_lock);
1131 }
1132
1133 static struct nfsd4_session *alloc_session(struct nfsd4_channel_attrs *fattrs,
1134                                            struct nfsd4_channel_attrs *battrs)
1135 {
1136         int numslots = fattrs->maxreqs;
1137         int slotsize = slot_bytes(fattrs);
1138         struct nfsd4_session *new;
1139         int mem, i;
1140
1141         BUILD_BUG_ON(NFSD_MAX_SLOTS_PER_SESSION * sizeof(struct nfsd4_slot *)
1142                         + sizeof(struct nfsd4_session) > PAGE_SIZE);
1143         mem = numslots * sizeof(struct nfsd4_slot *);
1144
1145         new = kzalloc(sizeof(*new) + mem, GFP_KERNEL);
1146         if (!new)
1147                 return NULL;
1148         /* allocate each struct nfsd4_slot and data cache in one piece */
1149         for (i = 0; i < numslots; i++) {
1150                 new->se_slots[i] = kzalloc(slotsize, GFP_KERNEL);
1151                 if (!new->se_slots[i])
1152                         goto out_free;
1153         }
1154
1155         memcpy(&new->se_fchannel, fattrs, sizeof(struct nfsd4_channel_attrs));
1156         memcpy(&new->se_bchannel, battrs, sizeof(struct nfsd4_channel_attrs));
1157
1158         return new;
1159 out_free:
1160         while (i--)
1161                 kfree(new->se_slots[i]);
1162         kfree(new);
1163         return NULL;
1164 }
1165
1166 static void free_conn(struct nfsd4_conn *c)
1167 {
1168         svc_xprt_put(c->cn_xprt);
1169         kfree(c);
1170 }
1171
1172 static void nfsd4_conn_lost(struct svc_xpt_user *u)
1173 {
1174         struct nfsd4_conn *c = container_of(u, struct nfsd4_conn, cn_xpt_user);
1175         struct nfs4_client *clp = c->cn_session->se_client;
1176
1177         spin_lock(&clp->cl_lock);
1178         if (!list_empty(&c->cn_persession)) {
1179                 list_del(&c->cn_persession);
1180                 free_conn(c);
1181         }
1182         nfsd4_probe_callback(clp);
1183         spin_unlock(&clp->cl_lock);
1184 }
1185
1186 static struct nfsd4_conn *alloc_conn(struct svc_rqst *rqstp, u32 flags)
1187 {
1188         struct nfsd4_conn *conn;
1189
1190         conn = kmalloc(sizeof(struct nfsd4_conn), GFP_KERNEL);
1191         if (!conn)
1192                 return NULL;
1193         svc_xprt_get(rqstp->rq_xprt);
1194         conn->cn_xprt = rqstp->rq_xprt;
1195         conn->cn_flags = flags;
1196         INIT_LIST_HEAD(&conn->cn_xpt_user.list);
1197         return conn;
1198 }
1199
1200 static void __nfsd4_hash_conn(struct nfsd4_conn *conn, struct nfsd4_session *ses)
1201 {
1202         conn->cn_session = ses;
1203         list_add(&conn->cn_persession, &ses->se_conns);
1204 }
1205
1206 static void nfsd4_hash_conn(struct nfsd4_conn *conn, struct nfsd4_session *ses)
1207 {
1208         struct nfs4_client *clp = ses->se_client;
1209
1210         spin_lock(&clp->cl_lock);
1211         __nfsd4_hash_conn(conn, ses);
1212         spin_unlock(&clp->cl_lock);
1213 }
1214
1215 static int nfsd4_register_conn(struct nfsd4_conn *conn)
1216 {
1217         conn->cn_xpt_user.callback = nfsd4_conn_lost;
1218         return register_xpt_user(conn->cn_xprt, &conn->cn_xpt_user);
1219 }
1220
1221 static void nfsd4_init_conn(struct svc_rqst *rqstp, struct nfsd4_conn *conn, struct nfsd4_session *ses)
1222 {
1223         int ret;
1224
1225         nfsd4_hash_conn(conn, ses);
1226         ret = nfsd4_register_conn(conn);
1227         if (ret)
1228                 /* oops; xprt is already down: */
1229                 nfsd4_conn_lost(&conn->cn_xpt_user);
1230         /* We may have gained or lost a callback channel: */
1231         nfsd4_probe_callback_sync(ses->se_client);
1232 }
1233
1234 static struct nfsd4_conn *alloc_conn_from_crses(struct svc_rqst *rqstp, struct nfsd4_create_session *cses)
1235 {
1236         u32 dir = NFS4_CDFC4_FORE;
1237
1238         if (cses->flags & SESSION4_BACK_CHAN)
1239                 dir |= NFS4_CDFC4_BACK;
1240         return alloc_conn(rqstp, dir);
1241 }
1242
1243 /* must be called under client_lock */
1244 static void nfsd4_del_conns(struct nfsd4_session *s)
1245 {
1246         struct nfs4_client *clp = s->se_client;
1247         struct nfsd4_conn *c;
1248
1249         spin_lock(&clp->cl_lock);
1250         while (!list_empty(&s->se_conns)) {
1251                 c = list_first_entry(&s->se_conns, struct nfsd4_conn, cn_persession);
1252                 list_del_init(&c->cn_persession);
1253                 spin_unlock(&clp->cl_lock);
1254
1255                 unregister_xpt_user(c->cn_xprt, &c->cn_xpt_user);
1256                 free_conn(c);
1257
1258                 spin_lock(&clp->cl_lock);
1259         }
1260         spin_unlock(&clp->cl_lock);
1261 }
1262
1263 static void __free_session(struct nfsd4_session *ses)
1264 {
1265         free_session_slots(ses);
1266         kfree(ses);
1267 }
1268
1269 static void free_session(struct nfsd4_session *ses)
1270 {
1271         struct nfsd_net *nn = net_generic(ses->se_client->net, nfsd_net_id);
1272
1273         lockdep_assert_held(&nn->client_lock);
1274         nfsd4_del_conns(ses);
1275         nfsd4_put_drc_mem(&ses->se_fchannel);
1276         __free_session(ses);
1277 }
1278
1279 static void init_session(struct svc_rqst *rqstp, struct nfsd4_session *new, struct nfs4_client *clp, struct nfsd4_create_session *cses)
1280 {
1281         int idx;
1282         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
1283
1284         new->se_client = clp;
1285         gen_sessionid(new);
1286
1287         INIT_LIST_HEAD(&new->se_conns);
1288
1289         new->se_cb_seq_nr = 1;
1290         new->se_flags = cses->flags;
1291         new->se_cb_prog = cses->callback_prog;
1292         new->se_cb_sec = cses->cb_sec;
1293         atomic_set(&new->se_ref, 0);
1294         idx = hash_sessionid(&new->se_sessionid);
1295         spin_lock(&nn->client_lock);
1296         list_add(&new->se_hash, &nn->sessionid_hashtbl[idx]);
1297         spin_lock(&clp->cl_lock);
1298         list_add(&new->se_perclnt, &clp->cl_sessions);
1299         spin_unlock(&clp->cl_lock);
1300         spin_unlock(&nn->client_lock);
1301
1302         if (cses->flags & SESSION4_BACK_CHAN) {
1303                 struct sockaddr *sa = svc_addr(rqstp);
1304                 /*
1305                  * This is a little silly; with sessions there's no real
1306                  * use for the callback address.  Use the peer address
1307                  * as a reasonable default for now, but consider fixing
1308                  * the rpc client not to require an address in the
1309                  * future:
1310                  */
1311                 rpc_copy_addr((struct sockaddr *)&clp->cl_cb_conn.cb_addr, sa);
1312                 clp->cl_cb_conn.cb_addrlen = svc_addr_len(sa);
1313         }
1314 }
1315
1316 /* caller must hold client_lock */
1317 static struct nfsd4_session *
1318 __find_in_sessionid_hashtbl(struct nfs4_sessionid *sessionid, struct net *net)
1319 {
1320         struct nfsd4_session *elem;
1321         int idx;
1322         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
1323
1324         dump_sessionid(__func__, sessionid);
1325         idx = hash_sessionid(sessionid);
1326         /* Search in the appropriate list */
1327         list_for_each_entry(elem, &nn->sessionid_hashtbl[idx], se_hash) {
1328                 if (!memcmp(elem->se_sessionid.data, sessionid->data,
1329                             NFS4_MAX_SESSIONID_LEN)) {
1330                         return elem;
1331                 }
1332         }
1333
1334         dprintk("%s: session not found\n", __func__);
1335         return NULL;
1336 }
1337
1338 static struct nfsd4_session *
1339 find_in_sessionid_hashtbl(struct nfs4_sessionid *sessionid, struct net *net,
1340                 __be32 *ret)
1341 {
1342         struct nfsd4_session *session;
1343         __be32 status = nfserr_badsession;
1344
1345         session = __find_in_sessionid_hashtbl(sessionid, net);
1346         if (!session)
1347                 goto out;
1348         status = nfsd4_get_session_locked(session);
1349         if (status)
1350                 session = NULL;
1351 out:
1352         *ret = status;
1353         return session;
1354 }
1355
1356 /* caller must hold client_lock */
1357 static void
1358 unhash_session(struct nfsd4_session *ses)
1359 {
1360         list_del(&ses->se_hash);
1361         spin_lock(&ses->se_client->cl_lock);
1362         list_del(&ses->se_perclnt);
1363         spin_unlock(&ses->se_client->cl_lock);
1364 }
1365
1366 /* SETCLIENTID and SETCLIENTID_CONFIRM Helper functions */
1367 static int
1368 STALE_CLIENTID(clientid_t *clid, struct nfsd_net *nn)
1369 {
1370         if (clid->cl_boot == nn->boot_time)
1371                 return 0;
1372         dprintk("NFSD stale clientid (%08x/%08x) boot_time %08lx\n",
1373                 clid->cl_boot, clid->cl_id, nn->boot_time);
1374         return 1;
1375 }
1376
1377 /*
1378  * XXX Should we use a slab cache ?
1379  * This type of memory management is somewhat inefficient, but we use it
1380  * anyway since SETCLIENTID is not a common operation.
1381  */
1382 static struct nfs4_client *alloc_client(struct xdr_netobj name)
1383 {
1384         struct nfs4_client *clp;
1385
1386         clp = kzalloc(sizeof(struct nfs4_client), GFP_KERNEL);
1387         if (clp == NULL)
1388                 return NULL;
1389         clp->cl_name.data = kmemdup(name.data, name.len, GFP_KERNEL);
1390         if (clp->cl_name.data == NULL) {
1391                 kfree(clp);
1392                 return NULL;
1393         }
1394         clp->cl_name.len = name.len;
1395         INIT_LIST_HEAD(&clp->cl_sessions);
1396         idr_init(&clp->cl_stateids);
1397         atomic_set(&clp->cl_refcount, 0);
1398         clp->cl_cb_state = NFSD4_CB_UNKNOWN;
1399         INIT_LIST_HEAD(&clp->cl_idhash);
1400         INIT_LIST_HEAD(&clp->cl_openowners);
1401         INIT_LIST_HEAD(&clp->cl_delegations);
1402         INIT_LIST_HEAD(&clp->cl_lru);
1403         INIT_LIST_HEAD(&clp->cl_callbacks);
1404         INIT_LIST_HEAD(&clp->cl_revoked);
1405         spin_lock_init(&clp->cl_lock);
1406         rpc_init_wait_queue(&clp->cl_cb_waitq, "Backchannel slot table");
1407         return clp;
1408 }
1409
1410 static void
1411 free_client(struct nfs4_client *clp)
1412 {
1413         struct nfsd_net __maybe_unused *nn = net_generic(clp->net, nfsd_net_id);
1414
1415         lockdep_assert_held(&nn->client_lock);
1416         while (!list_empty(&clp->cl_sessions)) {
1417                 struct nfsd4_session *ses;
1418                 ses = list_entry(clp->cl_sessions.next, struct nfsd4_session,
1419                                 se_perclnt);
1420                 list_del(&ses->se_perclnt);
1421                 WARN_ON_ONCE(atomic_read(&ses->se_ref));
1422                 free_session(ses);
1423         }
1424         rpc_destroy_wait_queue(&clp->cl_cb_waitq);
1425         free_svc_cred(&clp->cl_cred);
1426         kfree(clp->cl_name.data);
1427         idr_destroy(&clp->cl_stateids);
1428         kfree(clp);
1429 }
1430
1431 /* must be called under the client_lock */
1432 static inline void
1433 unhash_client_locked(struct nfs4_client *clp)
1434 {
1435         struct nfsd4_session *ses;
1436
1437         list_del(&clp->cl_lru);
1438         spin_lock(&clp->cl_lock);
1439         list_for_each_entry(ses, &clp->cl_sessions, se_perclnt)
1440                 list_del_init(&ses->se_hash);
1441         spin_unlock(&clp->cl_lock);
1442 }
1443
1444 static void
1445 destroy_client(struct nfs4_client *clp)
1446 {
1447         struct nfs4_openowner *oo;
1448         struct nfs4_delegation *dp;
1449         struct list_head reaplist;
1450         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
1451
1452         INIT_LIST_HEAD(&reaplist);
1453         spin_lock(&state_lock);
1454         while (!list_empty(&clp->cl_delegations)) {
1455                 dp = list_entry(clp->cl_delegations.next, struct nfs4_delegation, dl_perclnt);
1456                 list_del_init(&dp->dl_perclnt);
1457                 /* Ensure that deleg break won't try to requeue it */
1458                 ++dp->dl_time;
1459                 list_move(&dp->dl_recall_lru, &reaplist);
1460         }
1461         spin_unlock(&state_lock);
1462         while (!list_empty(&reaplist)) {
1463                 dp = list_entry(reaplist.next, struct nfs4_delegation, dl_recall_lru);
1464                 destroy_delegation(dp);
1465         }
1466         list_splice_init(&clp->cl_revoked, &reaplist);
1467         while (!list_empty(&reaplist)) {
1468                 dp = list_entry(reaplist.next, struct nfs4_delegation, dl_recall_lru);
1469                 destroy_revoked_delegation(dp);
1470         }
1471         while (!list_empty(&clp->cl_openowners)) {
1472                 oo = list_entry(clp->cl_openowners.next, struct nfs4_openowner, oo_perclient);
1473                 release_openowner(oo);
1474         }
1475         nfsd4_shutdown_callback(clp);
1476         if (clp->cl_cb_conn.cb_xprt)
1477                 svc_xprt_put(clp->cl_cb_conn.cb_xprt);
1478         list_del(&clp->cl_idhash);
1479         if (test_bit(NFSD4_CLIENT_CONFIRMED, &clp->cl_flags))
1480                 rb_erase(&clp->cl_namenode, &nn->conf_name_tree);
1481         else
1482                 rb_erase(&clp->cl_namenode, &nn->unconf_name_tree);
1483         spin_lock(&nn->client_lock);
1484         unhash_client_locked(clp);
1485         WARN_ON_ONCE(atomic_read(&clp->cl_refcount));
1486         free_client(clp);
1487         spin_unlock(&nn->client_lock);
1488 }
1489
1490 static void expire_client(struct nfs4_client *clp)
1491 {
1492         nfsd4_client_record_remove(clp);
1493         destroy_client(clp);
1494 }
1495
1496 static void copy_verf(struct nfs4_client *target, nfs4_verifier *source)
1497 {
1498         memcpy(target->cl_verifier.data, source->data,
1499                         sizeof(target->cl_verifier.data));
1500 }
1501
1502 static void copy_clid(struct nfs4_client *target, struct nfs4_client *source)
1503 {
1504         target->cl_clientid.cl_boot = source->cl_clientid.cl_boot;
1505         target->cl_clientid.cl_id = source->cl_clientid.cl_id;
1506 }
1507
1508 static int copy_cred(struct svc_cred *target, struct svc_cred *source)
1509 {
1510         if (source->cr_principal) {
1511                 target->cr_principal =
1512                                 kstrdup(source->cr_principal, GFP_KERNEL);
1513                 if (target->cr_principal == NULL)
1514                         return -ENOMEM;
1515         } else
1516                 target->cr_principal = NULL;
1517         target->cr_flavor = source->cr_flavor;
1518         target->cr_uid = source->cr_uid;
1519         target->cr_gid = source->cr_gid;
1520         target->cr_group_info = source->cr_group_info;
1521         get_group_info(target->cr_group_info);
1522         target->cr_gss_mech = source->cr_gss_mech;
1523         if (source->cr_gss_mech)
1524                 gss_mech_get(source->cr_gss_mech);
1525         return 0;
1526 }
1527
1528 static long long
1529 compare_blob(const struct xdr_netobj *o1, const struct xdr_netobj *o2)
1530 {
1531         long long res;
1532
1533         res = o1->len - o2->len;
1534         if (res)
1535                 return res;
1536         return (long long)memcmp(o1->data, o2->data, o1->len);
1537 }
1538
1539 static int same_name(const char *n1, const char *n2)
1540 {
1541         return 0 == memcmp(n1, n2, HEXDIR_LEN);
1542 }
1543
1544 static int
1545 same_verf(nfs4_verifier *v1, nfs4_verifier *v2)
1546 {
1547         return 0 == memcmp(v1->data, v2->data, sizeof(v1->data));
1548 }
1549
1550 static int
1551 same_clid(clientid_t *cl1, clientid_t *cl2)
1552 {
1553         return (cl1->cl_boot == cl2->cl_boot) && (cl1->cl_id == cl2->cl_id);
1554 }
1555
1556 static bool groups_equal(struct group_info *g1, struct group_info *g2)
1557 {
1558         int i;
1559
1560         if (g1->ngroups != g2->ngroups)
1561                 return false;
1562         for (i=0; i<g1->ngroups; i++)
1563                 if (!gid_eq(GROUP_AT(g1, i), GROUP_AT(g2, i)))
1564                         return false;
1565         return true;
1566 }
1567
1568 /*
1569  * RFC 3530 language requires clid_inuse be returned when the
1570  * "principal" associated with a requests differs from that previously
1571  * used.  We use uid, gid's, and gss principal string as our best
1572  * approximation.  We also don't want to allow non-gss use of a client
1573  * established using gss: in theory cr_principal should catch that
1574  * change, but in practice cr_principal can be null even in the gss case
1575  * since gssd doesn't always pass down a principal string.
1576  */
1577 static bool is_gss_cred(struct svc_cred *cr)
1578 {
1579         /* Is cr_flavor one of the gss "pseudoflavors"?: */
1580         return (cr->cr_flavor > RPC_AUTH_MAXFLAVOR);
1581 }
1582
1583
1584 static bool
1585 same_creds(struct svc_cred *cr1, struct svc_cred *cr2)
1586 {
1587         if ((is_gss_cred(cr1) != is_gss_cred(cr2))
1588                 || (!uid_eq(cr1->cr_uid, cr2->cr_uid))
1589                 || (!gid_eq(cr1->cr_gid, cr2->cr_gid))
1590                 || !groups_equal(cr1->cr_group_info, cr2->cr_group_info))
1591                 return false;
1592         if (cr1->cr_principal == cr2->cr_principal)
1593                 return true;
1594         if (!cr1->cr_principal || !cr2->cr_principal)
1595                 return false;
1596         return 0 == strcmp(cr1->cr_principal, cr2->cr_principal);
1597 }
1598
1599 static bool svc_rqst_integrity_protected(struct svc_rqst *rqstp)
1600 {
1601         struct svc_cred *cr = &rqstp->rq_cred;
1602         u32 service;
1603
1604         if (!cr->cr_gss_mech)
1605                 return false;
1606         service = gss_pseudoflavor_to_service(cr->cr_gss_mech, cr->cr_flavor);
1607         return service == RPC_GSS_SVC_INTEGRITY ||
1608                service == RPC_GSS_SVC_PRIVACY;
1609 }
1610
1611 static bool mach_creds_match(struct nfs4_client *cl, struct svc_rqst *rqstp)
1612 {
1613         struct svc_cred *cr = &rqstp->rq_cred;
1614
1615         if (!cl->cl_mach_cred)
1616                 return true;
1617         if (cl->cl_cred.cr_gss_mech != cr->cr_gss_mech)
1618                 return false;
1619         if (!svc_rqst_integrity_protected(rqstp))
1620                 return false;
1621         if (!cr->cr_principal)
1622                 return false;
1623         return 0 == strcmp(cl->cl_cred.cr_principal, cr->cr_principal);
1624 }
1625
1626 static void gen_clid(struct nfs4_client *clp, struct nfsd_net *nn)
1627 {
1628         static u32 current_clientid = 1;
1629
1630         clp->cl_clientid.cl_boot = nn->boot_time;
1631         clp->cl_clientid.cl_id = current_clientid++;
1632 }
1633
1634 static void gen_confirm(struct nfs4_client *clp)
1635 {
1636         __be32 verf[2];
1637         static u32 i;
1638
1639         /*
1640          * This is opaque to client, so no need to byte-swap. Use
1641          * __force to keep sparse happy
1642          */
1643         verf[0] = (__force __be32)get_seconds();
1644         verf[1] = (__force __be32)i++;
1645         memcpy(clp->cl_confirm.data, verf, sizeof(clp->cl_confirm.data));
1646 }
1647
1648 static struct nfs4_stid *find_stateid(struct nfs4_client *cl, stateid_t *t)
1649 {
1650         struct nfs4_stid *ret;
1651
1652         ret = idr_find(&cl->cl_stateids, t->si_opaque.so_id);
1653         if (!ret || !ret->sc_type)
1654                 return NULL;
1655         return ret;
1656 }
1657
1658 static struct nfs4_stid *find_stateid_by_type(struct nfs4_client *cl, stateid_t *t, char typemask)
1659 {
1660         struct nfs4_stid *s;
1661
1662         s = find_stateid(cl, t);
1663         if (!s)
1664                 return NULL;
1665         if (typemask & s->sc_type)
1666                 return s;
1667         return NULL;
1668 }
1669
1670 static struct nfs4_client *create_client(struct xdr_netobj name,
1671                 struct svc_rqst *rqstp, nfs4_verifier *verf)
1672 {
1673         struct nfs4_client *clp;
1674         struct sockaddr *sa = svc_addr(rqstp);
1675         int ret;
1676         struct net *net = SVC_NET(rqstp);
1677         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
1678
1679         clp = alloc_client(name);
1680         if (clp == NULL)
1681                 return NULL;
1682
1683         ret = copy_cred(&clp->cl_cred, &rqstp->rq_cred);
1684         if (ret) {
1685                 spin_lock(&nn->client_lock);
1686                 free_client(clp);
1687                 spin_unlock(&nn->client_lock);
1688                 return NULL;
1689         }
1690         INIT_WORK(&clp->cl_cb_null.cb_work, nfsd4_run_cb_null);
1691         clp->cl_time = get_seconds();
1692         clear_bit(0, &clp->cl_cb_slot_busy);
1693         copy_verf(clp, verf);
1694         rpc_copy_addr((struct sockaddr *) &clp->cl_addr, sa);
1695         gen_confirm(clp);
1696         clp->cl_cb_session = NULL;
1697         clp->net = net;
1698         return clp;
1699 }
1700
1701 static void
1702 add_clp_to_name_tree(struct nfs4_client *new_clp, struct rb_root *root)
1703 {
1704         struct rb_node **new = &(root->rb_node), *parent = NULL;
1705         struct nfs4_client *clp;
1706
1707         while (*new) {
1708                 clp = rb_entry(*new, struct nfs4_client, cl_namenode);
1709                 parent = *new;
1710
1711                 if (compare_blob(&clp->cl_name, &new_clp->cl_name) > 0)
1712                         new = &((*new)->rb_left);
1713                 else
1714                         new = &((*new)->rb_right);
1715         }
1716
1717         rb_link_node(&new_clp->cl_namenode, parent, new);
1718         rb_insert_color(&new_clp->cl_namenode, root);
1719 }
1720
1721 static struct nfs4_client *
1722 find_clp_in_name_tree(struct xdr_netobj *name, struct rb_root *root)
1723 {
1724         long long cmp;
1725         struct rb_node *node = root->rb_node;
1726         struct nfs4_client *clp;
1727
1728         while (node) {
1729                 clp = rb_entry(node, struct nfs4_client, cl_namenode);
1730                 cmp = compare_blob(&clp->cl_name, name);
1731                 if (cmp > 0)
1732                         node = node->rb_left;
1733                 else if (cmp < 0)
1734                         node = node->rb_right;
1735                 else
1736                         return clp;
1737         }
1738         return NULL;
1739 }
1740
1741 static void
1742 add_to_unconfirmed(struct nfs4_client *clp)
1743 {
1744         unsigned int idhashval;
1745         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
1746
1747         clear_bit(NFSD4_CLIENT_CONFIRMED, &clp->cl_flags);
1748         add_clp_to_name_tree(clp, &nn->unconf_name_tree);
1749         idhashval = clientid_hashval(clp->cl_clientid.cl_id);
1750         list_add(&clp->cl_idhash, &nn->unconf_id_hashtbl[idhashval]);
1751         renew_client(clp);
1752 }
1753
1754 static void
1755 move_to_confirmed(struct nfs4_client *clp)
1756 {
1757         unsigned int idhashval = clientid_hashval(clp->cl_clientid.cl_id);
1758         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
1759
1760         dprintk("NFSD: move_to_confirm nfs4_client %p\n", clp);
1761         list_move(&clp->cl_idhash, &nn->conf_id_hashtbl[idhashval]);
1762         rb_erase(&clp->cl_namenode, &nn->unconf_name_tree);
1763         add_clp_to_name_tree(clp, &nn->conf_name_tree);
1764         set_bit(NFSD4_CLIENT_CONFIRMED, &clp->cl_flags);
1765         renew_client(clp);
1766 }
1767
1768 static struct nfs4_client *
1769 find_client_in_id_table(struct list_head *tbl, clientid_t *clid, bool sessions)
1770 {
1771         struct nfs4_client *clp;
1772         unsigned int idhashval = clientid_hashval(clid->cl_id);
1773
1774         list_for_each_entry(clp, &tbl[idhashval], cl_idhash) {
1775                 if (same_clid(&clp->cl_clientid, clid)) {
1776                         if ((bool)clp->cl_minorversion != sessions)
1777                                 return NULL;
1778                         renew_client(clp);
1779                         return clp;
1780                 }
1781         }
1782         return NULL;
1783 }
1784
1785 static struct nfs4_client *
1786 find_confirmed_client(clientid_t *clid, bool sessions, struct nfsd_net *nn)
1787 {
1788         struct list_head *tbl = nn->conf_id_hashtbl;
1789
1790         return find_client_in_id_table(tbl, clid, sessions);
1791 }
1792
1793 static struct nfs4_client *
1794 find_unconfirmed_client(clientid_t *clid, bool sessions, struct nfsd_net *nn)
1795 {
1796         struct list_head *tbl = nn->unconf_id_hashtbl;
1797
1798         return find_client_in_id_table(tbl, clid, sessions);
1799 }
1800
1801 static bool clp_used_exchangeid(struct nfs4_client *clp)
1802 {
1803         return clp->cl_exchange_flags != 0;
1804 }
1805
1806 static struct nfs4_client *
1807 find_confirmed_client_by_name(struct xdr_netobj *name, struct nfsd_net *nn)
1808 {
1809         return find_clp_in_name_tree(name, &nn->conf_name_tree);
1810 }
1811
1812 static struct nfs4_client *
1813 find_unconfirmed_client_by_name(struct xdr_netobj *name, struct nfsd_net *nn)
1814 {
1815         return find_clp_in_name_tree(name, &nn->unconf_name_tree);
1816 }
1817
1818 static void
1819 gen_callback(struct nfs4_client *clp, struct nfsd4_setclientid *se, struct svc_rqst *rqstp)
1820 {
1821         struct nfs4_cb_conn *conn = &clp->cl_cb_conn;
1822         struct sockaddr *sa = svc_addr(rqstp);
1823         u32 scopeid = rpc_get_scope_id(sa);
1824         unsigned short expected_family;
1825
1826         /* Currently, we only support tcp and tcp6 for the callback channel */
1827         if (se->se_callback_netid_len == 3 &&
1828             !memcmp(se->se_callback_netid_val, "tcp", 3))
1829                 expected_family = AF_INET;
1830         else if (se->se_callback_netid_len == 4 &&
1831                  !memcmp(se->se_callback_netid_val, "tcp6", 4))
1832                 expected_family = AF_INET6;
1833         else
1834                 goto out_err;
1835
1836         conn->cb_addrlen = rpc_uaddr2sockaddr(clp->net, se->se_callback_addr_val,
1837                                             se->se_callback_addr_len,
1838                                             (struct sockaddr *)&conn->cb_addr,
1839                                             sizeof(conn->cb_addr));
1840
1841         if (!conn->cb_addrlen || conn->cb_addr.ss_family != expected_family)
1842                 goto out_err;
1843
1844         if (conn->cb_addr.ss_family == AF_INET6)
1845                 ((struct sockaddr_in6 *)&conn->cb_addr)->sin6_scope_id = scopeid;
1846
1847         conn->cb_prog = se->se_callback_prog;
1848         conn->cb_ident = se->se_callback_ident;
1849         memcpy(&conn->cb_saddr, &rqstp->rq_daddr, rqstp->rq_daddrlen);
1850         return;
1851 out_err:
1852         conn->cb_addr.ss_family = AF_UNSPEC;
1853         conn->cb_addrlen = 0;
1854         dprintk(KERN_INFO "NFSD: this client (clientid %08x/%08x) "
1855                 "will not receive delegations\n",
1856                 clp->cl_clientid.cl_boot, clp->cl_clientid.cl_id);
1857
1858         return;
1859 }
1860
1861 /*
1862  * Cache a reply. nfsd4_check_resp_size() has bounded the cache size.
1863  */
1864 static void
1865 nfsd4_store_cache_entry(struct nfsd4_compoundres *resp)
1866 {
1867         struct xdr_buf *buf = resp->xdr.buf;
1868         struct nfsd4_slot *slot = resp->cstate.slot;
1869         unsigned int base;
1870
1871         dprintk("--> %s slot %p\n", __func__, slot);
1872
1873         slot->sl_opcnt = resp->opcnt;
1874         slot->sl_status = resp->cstate.status;
1875
1876         slot->sl_flags |= NFSD4_SLOT_INITIALIZED;
1877         if (nfsd4_not_cached(resp)) {
1878                 slot->sl_datalen = 0;
1879                 return;
1880         }
1881         base = resp->cstate.data_offset;
1882         slot->sl_datalen = buf->len - base;
1883         if (read_bytes_from_xdr_buf(buf, base, slot->sl_data, slot->sl_datalen))
1884                 WARN("%s: sessions DRC could not cache compound\n", __func__);
1885         return;
1886 }
1887
1888 /*
1889  * Encode the replay sequence operation from the slot values.
1890  * If cachethis is FALSE encode the uncached rep error on the next
1891  * operation which sets resp->p and increments resp->opcnt for
1892  * nfs4svc_encode_compoundres.
1893  *
1894  */
1895 static __be32
1896 nfsd4_enc_sequence_replay(struct nfsd4_compoundargs *args,
1897                           struct nfsd4_compoundres *resp)
1898 {
1899         struct nfsd4_op *op;
1900         struct nfsd4_slot *slot = resp->cstate.slot;
1901
1902         /* Encode the replayed sequence operation */
1903         op = &args->ops[resp->opcnt - 1];
1904         nfsd4_encode_operation(resp, op);
1905
1906         /* Return nfserr_retry_uncached_rep in next operation. */
1907         if (args->opcnt > 1 && !(slot->sl_flags & NFSD4_SLOT_CACHETHIS)) {
1908                 op = &args->ops[resp->opcnt++];
1909                 op->status = nfserr_retry_uncached_rep;
1910                 nfsd4_encode_operation(resp, op);
1911         }
1912         return op->status;
1913 }
1914
1915 /*
1916  * The sequence operation is not cached because we can use the slot and
1917  * session values.
1918  */
1919 static __be32
1920 nfsd4_replay_cache_entry(struct nfsd4_compoundres *resp,
1921                          struct nfsd4_sequence *seq)
1922 {
1923         struct nfsd4_slot *slot = resp->cstate.slot;
1924         struct xdr_stream *xdr = &resp->xdr;
1925         __be32 *p;
1926         __be32 status;
1927
1928         dprintk("--> %s slot %p\n", __func__, slot);
1929
1930         status = nfsd4_enc_sequence_replay(resp->rqstp->rq_argp, resp);
1931         if (status)
1932                 return status;
1933
1934         p = xdr_reserve_space(xdr, slot->sl_datalen);
1935         if (!p) {
1936                 WARN_ON_ONCE(1);
1937                 return nfserr_serverfault;
1938         }
1939         xdr_encode_opaque_fixed(p, slot->sl_data, slot->sl_datalen);
1940         xdr_commit_encode(xdr);
1941
1942         resp->opcnt = slot->sl_opcnt;
1943         return slot->sl_status;
1944 }
1945
1946 /*
1947  * Set the exchange_id flags returned by the server.
1948  */
1949 static void
1950 nfsd4_set_ex_flags(struct nfs4_client *new, struct nfsd4_exchange_id *clid)
1951 {
1952         /* pNFS is not supported */
1953         new->cl_exchange_flags |= EXCHGID4_FLAG_USE_NON_PNFS;
1954
1955         /* Referrals are supported, Migration is not. */
1956         new->cl_exchange_flags |= EXCHGID4_FLAG_SUPP_MOVED_REFER;
1957
1958         /* set the wire flags to return to client. */
1959         clid->flags = new->cl_exchange_flags;
1960 }
1961
1962 static bool client_has_state(struct nfs4_client *clp)
1963 {
1964         /*
1965          * Note clp->cl_openowners check isn't quite right: there's no
1966          * need to count owners without stateid's.
1967          *
1968          * Also note we should probably be using this in 4.0 case too.
1969          */
1970         return !list_empty(&clp->cl_openowners)
1971                 || !list_empty(&clp->cl_delegations)
1972                 || !list_empty(&clp->cl_sessions);
1973 }
1974
1975 __be32
1976 nfsd4_exchange_id(struct svc_rqst *rqstp,
1977                   struct nfsd4_compound_state *cstate,
1978                   struct nfsd4_exchange_id *exid)
1979 {
1980         struct nfs4_client *unconf, *conf, *new;
1981         __be32 status;
1982         char                    addr_str[INET6_ADDRSTRLEN];
1983         nfs4_verifier           verf = exid->verifier;
1984         struct sockaddr         *sa = svc_addr(rqstp);
1985         bool    update = exid->flags & EXCHGID4_FLAG_UPD_CONFIRMED_REC_A;
1986         struct nfsd_net         *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
1987
1988         rpc_ntop(sa, addr_str, sizeof(addr_str));
1989         dprintk("%s rqstp=%p exid=%p clname.len=%u clname.data=%p "
1990                 "ip_addr=%s flags %x, spa_how %d\n",
1991                 __func__, rqstp, exid, exid->clname.len, exid->clname.data,
1992                 addr_str, exid->flags, exid->spa_how);
1993
1994         if (exid->flags & ~EXCHGID4_FLAG_MASK_A)
1995                 return nfserr_inval;
1996
1997         switch (exid->spa_how) {
1998         case SP4_MACH_CRED:
1999                 if (!svc_rqst_integrity_protected(rqstp))
2000                         return nfserr_inval;
2001         case SP4_NONE:
2002                 break;
2003         default:                                /* checked by xdr code */
2004                 WARN_ON_ONCE(1);
2005         case SP4_SSV:
2006                 return nfserr_encr_alg_unsupp;
2007         }
2008
2009         /* Cases below refer to rfc 5661 section 18.35.4: */
2010         nfs4_lock_state();
2011         conf = find_confirmed_client_by_name(&exid->clname, nn);
2012         if (conf) {
2013                 bool creds_match = same_creds(&conf->cl_cred, &rqstp->rq_cred);
2014                 bool verfs_match = same_verf(&verf, &conf->cl_verifier);
2015
2016                 if (update) {
2017                         if (!clp_used_exchangeid(conf)) { /* buggy client */
2018                                 status = nfserr_inval;
2019                                 goto out;
2020                         }
2021                         if (!mach_creds_match(conf, rqstp)) {
2022                                 status = nfserr_wrong_cred;
2023                                 goto out;
2024                         }
2025                         if (!creds_match) { /* case 9 */
2026                                 status = nfserr_perm;
2027                                 goto out;
2028                         }
2029                         if (!verfs_match) { /* case 8 */
2030                                 status = nfserr_not_same;
2031                                 goto out;
2032                         }
2033                         /* case 6 */
2034                         exid->flags |= EXCHGID4_FLAG_CONFIRMED_R;
2035                         new = conf;
2036                         goto out_copy;
2037                 }
2038                 if (!creds_match) { /* case 3 */
2039                         if (client_has_state(conf)) {
2040                                 status = nfserr_clid_inuse;
2041                                 goto out;
2042                         }
2043                         expire_client(conf);
2044                         goto out_new;
2045                 }
2046                 if (verfs_match) { /* case 2 */
2047                         conf->cl_exchange_flags |= EXCHGID4_FLAG_CONFIRMED_R;
2048                         new = conf;
2049                         goto out_copy;
2050                 }
2051                 /* case 5, client reboot */
2052                 goto out_new;
2053         }
2054
2055         if (update) { /* case 7 */
2056                 status = nfserr_noent;
2057                 goto out;
2058         }
2059
2060         unconf  = find_unconfirmed_client_by_name(&exid->clname, nn);
2061         if (unconf) /* case 4, possible retry or client restart */
2062                 expire_client(unconf);
2063
2064         /* case 1 (normal case) */
2065 out_new:
2066         new = create_client(exid->clname, rqstp, &verf);
2067         if (new == NULL) {
2068                 status = nfserr_jukebox;
2069                 goto out;
2070         }
2071         new->cl_minorversion = cstate->minorversion;
2072         new->cl_mach_cred = (exid->spa_how == SP4_MACH_CRED);
2073
2074         gen_clid(new, nn);
2075         add_to_unconfirmed(new);
2076 out_copy:
2077         exid->clientid.cl_boot = new->cl_clientid.cl_boot;
2078         exid->clientid.cl_id = new->cl_clientid.cl_id;
2079
2080         exid->seqid = new->cl_cs_slot.sl_seqid + 1;
2081         nfsd4_set_ex_flags(new, exid);
2082
2083         dprintk("nfsd4_exchange_id seqid %d flags %x\n",
2084                 new->cl_cs_slot.sl_seqid, new->cl_exchange_flags);
2085         status = nfs_ok;
2086
2087 out:
2088         nfs4_unlock_state();
2089         return status;
2090 }
2091
2092 static __be32
2093 check_slot_seqid(u32 seqid, u32 slot_seqid, int slot_inuse)
2094 {
2095         dprintk("%s enter. seqid %d slot_seqid %d\n", __func__, seqid,
2096                 slot_seqid);
2097
2098         /* The slot is in use, and no response has been sent. */
2099         if (slot_inuse) {
2100                 if (seqid == slot_seqid)
2101                         return nfserr_jukebox;
2102                 else
2103                         return nfserr_seq_misordered;
2104         }
2105         /* Note unsigned 32-bit arithmetic handles wraparound: */
2106         if (likely(seqid == slot_seqid + 1))
2107                 return nfs_ok;
2108         if (seqid == slot_seqid)
2109                 return nfserr_replay_cache;
2110         return nfserr_seq_misordered;
2111 }
2112
2113 /*
2114  * Cache the create session result into the create session single DRC
2115  * slot cache by saving the xdr structure. sl_seqid has been set.
2116  * Do this for solo or embedded create session operations.
2117  */
2118 static void
2119 nfsd4_cache_create_session(struct nfsd4_create_session *cr_ses,
2120                            struct nfsd4_clid_slot *slot, __be32 nfserr)
2121 {
2122         slot->sl_status = nfserr;
2123         memcpy(&slot->sl_cr_ses, cr_ses, sizeof(*cr_ses));
2124 }
2125
2126 static __be32
2127 nfsd4_replay_create_session(struct nfsd4_create_session *cr_ses,
2128                             struct nfsd4_clid_slot *slot)
2129 {
2130         memcpy(cr_ses, &slot->sl_cr_ses, sizeof(*cr_ses));
2131         return slot->sl_status;
2132 }
2133
2134 #define NFSD_MIN_REQ_HDR_SEQ_SZ ((\
2135                         2 * 2 + /* credential,verifier: AUTH_NULL, length 0 */ \
2136                         1 +     /* MIN tag is length with zero, only length */ \
2137                         3 +     /* version, opcount, opcode */ \
2138                         XDR_QUADLEN(NFS4_MAX_SESSIONID_LEN) + \
2139                                 /* seqid, slotID, slotID, cache */ \
2140                         4 ) * sizeof(__be32))
2141
2142 #define NFSD_MIN_RESP_HDR_SEQ_SZ ((\
2143                         2 +     /* verifier: AUTH_NULL, length 0 */\
2144                         1 +     /* status */ \
2145                         1 +     /* MIN tag is length with zero, only length */ \
2146                         3 +     /* opcount, opcode, opstatus*/ \
2147                         XDR_QUADLEN(NFS4_MAX_SESSIONID_LEN) + \
2148                                 /* seqid, slotID, slotID, slotID, status */ \
2149                         5 ) * sizeof(__be32))
2150
2151 static __be32 check_forechannel_attrs(struct nfsd4_channel_attrs *ca, struct nfsd_net *nn)
2152 {
2153         u32 maxrpc = nn->nfsd_serv->sv_max_mesg;
2154
2155         if (ca->maxreq_sz < NFSD_MIN_REQ_HDR_SEQ_SZ)
2156                 return nfserr_toosmall;
2157         if (ca->maxresp_sz < NFSD_MIN_RESP_HDR_SEQ_SZ)
2158                 return nfserr_toosmall;
2159         ca->headerpadsz = 0;
2160         ca->maxreq_sz = min_t(u32, ca->maxreq_sz, maxrpc);
2161         ca->maxresp_sz = min_t(u32, ca->maxresp_sz, maxrpc);
2162         ca->maxops = min_t(u32, ca->maxops, NFSD_MAX_OPS_PER_COMPOUND);
2163         ca->maxresp_cached = min_t(u32, ca->maxresp_cached,
2164                         NFSD_SLOT_CACHE_SIZE + NFSD_MIN_HDR_SEQ_SZ);
2165         ca->maxreqs = min_t(u32, ca->maxreqs, NFSD_MAX_SLOTS_PER_SESSION);
2166         /*
2167          * Note decreasing slot size below client's request may make it
2168          * difficult for client to function correctly, whereas
2169          * decreasing the number of slots will (just?) affect
2170          * performance.  When short on memory we therefore prefer to
2171          * decrease number of slots instead of their size.  Clients that
2172          * request larger slots than they need will get poor results:
2173          */
2174         ca->maxreqs = nfsd4_get_drc_mem(ca);
2175         if (!ca->maxreqs)
2176                 return nfserr_jukebox;
2177
2178         return nfs_ok;
2179 }
2180
2181 #define NFSD_CB_MAX_REQ_SZ      ((NFS4_enc_cb_recall_sz + \
2182                                  RPC_MAX_HEADER_WITH_AUTH) * sizeof(__be32))
2183 #define NFSD_CB_MAX_RESP_SZ     ((NFS4_dec_cb_recall_sz + \
2184                                  RPC_MAX_REPHEADER_WITH_AUTH) * sizeof(__be32))
2185
2186 static __be32 check_backchannel_attrs(struct nfsd4_channel_attrs *ca)
2187 {
2188         ca->headerpadsz = 0;
2189
2190         /*
2191          * These RPC_MAX_HEADER macros are overkill, especially since we
2192          * don't even do gss on the backchannel yet.  But this is still
2193          * less than 1k.  Tighten up this estimate in the unlikely event
2194          * it turns out to be a problem for some client:
2195          */
2196         if (ca->maxreq_sz < NFSD_CB_MAX_REQ_SZ)
2197                 return nfserr_toosmall;
2198         if (ca->maxresp_sz < NFSD_CB_MAX_RESP_SZ)
2199                 return nfserr_toosmall;
2200         ca->maxresp_cached = 0;
2201         if (ca->maxops < 2)
2202                 return nfserr_toosmall;
2203
2204         return nfs_ok;
2205 }
2206
2207 static __be32 nfsd4_check_cb_sec(struct nfsd4_cb_sec *cbs)
2208 {
2209         switch (cbs->flavor) {
2210         case RPC_AUTH_NULL:
2211         case RPC_AUTH_UNIX:
2212                 return nfs_ok;
2213         default:
2214                 /*
2215                  * GSS case: the spec doesn't allow us to return this
2216                  * error.  But it also doesn't allow us not to support
2217                  * GSS.
2218                  * I'd rather this fail hard than return some error the
2219                  * client might think it can already handle:
2220                  */
2221                 return nfserr_encr_alg_unsupp;
2222         }
2223 }
2224
2225 __be32
2226 nfsd4_create_session(struct svc_rqst *rqstp,
2227                      struct nfsd4_compound_state *cstate,
2228                      struct nfsd4_create_session *cr_ses)
2229 {
2230         struct sockaddr *sa = svc_addr(rqstp);
2231         struct nfs4_client *conf, *unconf;
2232         struct nfsd4_session *new;
2233         struct nfsd4_conn *conn;
2234         struct nfsd4_clid_slot *cs_slot = NULL;
2235         __be32 status = 0;
2236         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
2237
2238         if (cr_ses->flags & ~SESSION4_FLAG_MASK_A)
2239                 return nfserr_inval;
2240         status = nfsd4_check_cb_sec(&cr_ses->cb_sec);
2241         if (status)
2242                 return status;
2243         status = check_forechannel_attrs(&cr_ses->fore_channel, nn);
2244         if (status)
2245                 return status;
2246         status = check_backchannel_attrs(&cr_ses->back_channel);
2247         if (status)
2248                 goto out_release_drc_mem;
2249         status = nfserr_jukebox;
2250         new = alloc_session(&cr_ses->fore_channel, &cr_ses->back_channel);
2251         if (!new)
2252                 goto out_release_drc_mem;
2253         conn = alloc_conn_from_crses(rqstp, cr_ses);
2254         if (!conn)
2255                 goto out_free_session;
2256
2257         nfs4_lock_state();
2258         unconf = find_unconfirmed_client(&cr_ses->clientid, true, nn);
2259         conf = find_confirmed_client(&cr_ses->clientid, true, nn);
2260         WARN_ON_ONCE(conf && unconf);
2261
2262         if (conf) {
2263                 status = nfserr_wrong_cred;
2264                 if (!mach_creds_match(conf, rqstp))
2265                         goto out_free_conn;
2266                 cs_slot = &conf->cl_cs_slot;
2267                 status = check_slot_seqid(cr_ses->seqid, cs_slot->sl_seqid, 0);
2268                 if (status == nfserr_replay_cache) {
2269                         status = nfsd4_replay_create_session(cr_ses, cs_slot);
2270                         goto out_free_conn;
2271                 } else if (cr_ses->seqid != cs_slot->sl_seqid + 1) {
2272                         status = nfserr_seq_misordered;
2273                         goto out_free_conn;
2274                 }
2275         } else if (unconf) {
2276                 struct nfs4_client *old;
2277                 if (!same_creds(&unconf->cl_cred, &rqstp->rq_cred) ||
2278                     !rpc_cmp_addr(sa, (struct sockaddr *) &unconf->cl_addr)) {
2279                         status = nfserr_clid_inuse;
2280                         goto out_free_conn;
2281                 }
2282                 status = nfserr_wrong_cred;
2283                 if (!mach_creds_match(unconf, rqstp))
2284                         goto out_free_conn;
2285                 cs_slot = &unconf->cl_cs_slot;
2286                 status = check_slot_seqid(cr_ses->seqid, cs_slot->sl_seqid, 0);
2287                 if (status) {
2288                         /* an unconfirmed replay returns misordered */
2289                         status = nfserr_seq_misordered;
2290                         goto out_free_conn;
2291                 }
2292                 old = find_confirmed_client_by_name(&unconf->cl_name, nn);
2293                 if (old) {
2294                         status = mark_client_expired(old);
2295                         if (status)
2296                                 goto out_free_conn;
2297                         expire_client(old);
2298                 }
2299                 move_to_confirmed(unconf);
2300                 conf = unconf;
2301         } else {
2302                 status = nfserr_stale_clientid;
2303                 goto out_free_conn;
2304         }
2305         status = nfs_ok;
2306         /*
2307          * We do not support RDMA or persistent sessions
2308          */
2309         cr_ses->flags &= ~SESSION4_PERSIST;
2310         cr_ses->flags &= ~SESSION4_RDMA;
2311
2312         init_session(rqstp, new, conf, cr_ses);
2313         nfsd4_init_conn(rqstp, conn, new);
2314
2315         memcpy(cr_ses->sessionid.data, new->se_sessionid.data,
2316                NFS4_MAX_SESSIONID_LEN);
2317         cs_slot->sl_seqid++;
2318         cr_ses->seqid = cs_slot->sl_seqid;
2319
2320         /* cache solo and embedded create sessions under the state lock */
2321         nfsd4_cache_create_session(cr_ses, cs_slot, status);
2322         nfs4_unlock_state();
2323         return status;
2324 out_free_conn:
2325         nfs4_unlock_state();
2326         free_conn(conn);
2327 out_free_session:
2328         __free_session(new);
2329 out_release_drc_mem:
2330         nfsd4_put_drc_mem(&cr_ses->fore_channel);
2331         return status;
2332 }
2333
2334 static __be32 nfsd4_map_bcts_dir(u32 *dir)
2335 {
2336         switch (*dir) {
2337         case NFS4_CDFC4_FORE:
2338         case NFS4_CDFC4_BACK:
2339                 return nfs_ok;
2340         case NFS4_CDFC4_FORE_OR_BOTH:
2341         case NFS4_CDFC4_BACK_OR_BOTH:
2342                 *dir = NFS4_CDFC4_BOTH;
2343                 return nfs_ok;
2344         };
2345         return nfserr_inval;
2346 }
2347
2348 __be32 nfsd4_backchannel_ctl(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, struct nfsd4_backchannel_ctl *bc)
2349 {
2350         struct nfsd4_session *session = cstate->session;
2351         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
2352         __be32 status;
2353
2354         status = nfsd4_check_cb_sec(&bc->bc_cb_sec);
2355         if (status)
2356                 return status;
2357         spin_lock(&nn->client_lock);
2358         session->se_cb_prog = bc->bc_cb_program;
2359         session->se_cb_sec = bc->bc_cb_sec;
2360         spin_unlock(&nn->client_lock);
2361
2362         nfsd4_probe_callback(session->se_client);
2363
2364         return nfs_ok;
2365 }
2366
2367 __be32 nfsd4_bind_conn_to_session(struct svc_rqst *rqstp,
2368                      struct nfsd4_compound_state *cstate,
2369                      struct nfsd4_bind_conn_to_session *bcts)
2370 {
2371         __be32 status;
2372         struct nfsd4_conn *conn;
2373         struct nfsd4_session *session;
2374         struct net *net = SVC_NET(rqstp);
2375         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
2376
2377         if (!nfsd4_last_compound_op(rqstp))
2378                 return nfserr_not_only_op;
2379         nfs4_lock_state();
2380         spin_lock(&nn->client_lock);
2381         session = find_in_sessionid_hashtbl(&bcts->sessionid, net, &status);
2382         spin_unlock(&nn->client_lock);
2383         if (!session)
2384                 goto out_no_session;
2385         status = nfserr_wrong_cred;
2386         if (!mach_creds_match(session->se_client, rqstp))
2387                 goto out;
2388         status = nfsd4_map_bcts_dir(&bcts->dir);
2389         if (status)
2390                 goto out;
2391         conn = alloc_conn(rqstp, bcts->dir);
2392         status = nfserr_jukebox;
2393         if (!conn)
2394                 goto out;
2395         nfsd4_init_conn(rqstp, conn, session);
2396         status = nfs_ok;
2397 out:
2398         nfsd4_put_session(session);
2399 out_no_session:
2400         nfs4_unlock_state();
2401         return status;
2402 }
2403
2404 static bool nfsd4_compound_in_session(struct nfsd4_session *session, struct nfs4_sessionid *sid)
2405 {
2406         if (!session)
2407                 return 0;
2408         return !memcmp(sid, &session->se_sessionid, sizeof(*sid));
2409 }
2410
2411 __be32
2412 nfsd4_destroy_session(struct svc_rqst *r,
2413                       struct nfsd4_compound_state *cstate,
2414                       struct nfsd4_destroy_session *sessionid)
2415 {
2416         struct nfsd4_session *ses;
2417         __be32 status;
2418         int ref_held_by_me = 0;
2419         struct net *net = SVC_NET(r);
2420         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
2421
2422         nfs4_lock_state();
2423         status = nfserr_not_only_op;
2424         if (nfsd4_compound_in_session(cstate->session, &sessionid->sessionid)) {
2425                 if (!nfsd4_last_compound_op(r))
2426                         goto out;
2427                 ref_held_by_me++;
2428         }
2429         dump_sessionid(__func__, &sessionid->sessionid);
2430         spin_lock(&nn->client_lock);
2431         ses = find_in_sessionid_hashtbl(&sessionid->sessionid, net, &status);
2432         if (!ses)
2433                 goto out_client_lock;
2434         status = nfserr_wrong_cred;
2435         if (!mach_creds_match(ses->se_client, r))
2436                 goto out_put_session;
2437         status = mark_session_dead_locked(ses, 1 + ref_held_by_me);
2438         if (status)
2439                 goto out_put_session;
2440         unhash_session(ses);
2441         spin_unlock(&nn->client_lock);
2442
2443         nfsd4_probe_callback_sync(ses->se_client);
2444
2445         spin_lock(&nn->client_lock);
2446         status = nfs_ok;
2447 out_put_session:
2448         nfsd4_put_session_locked(ses);
2449 out_client_lock:
2450         spin_unlock(&nn->client_lock);
2451 out:
2452         nfs4_unlock_state();
2453         return status;
2454 }
2455
2456 static struct nfsd4_conn *__nfsd4_find_conn(struct svc_xprt *xpt, struct nfsd4_session *s)
2457 {
2458         struct nfsd4_conn *c;
2459
2460         list_for_each_entry(c, &s->se_conns, cn_persession) {
2461                 if (c->cn_xprt == xpt) {
2462                         return c;
2463                 }
2464         }
2465         return NULL;
2466 }
2467
2468 static __be32 nfsd4_sequence_check_conn(struct nfsd4_conn *new, struct nfsd4_session *ses)
2469 {
2470         struct nfs4_client *clp = ses->se_client;
2471         struct nfsd4_conn *c;
2472         __be32 status = nfs_ok;
2473         int ret;
2474
2475         spin_lock(&clp->cl_lock);
2476         c = __nfsd4_find_conn(new->cn_xprt, ses);
2477         if (c)
2478                 goto out_free;
2479         status = nfserr_conn_not_bound_to_session;
2480         if (clp->cl_mach_cred)
2481                 goto out_free;
2482         __nfsd4_hash_conn(new, ses);
2483         spin_unlock(&clp->cl_lock);
2484         ret = nfsd4_register_conn(new);
2485         if (ret)
2486                 /* oops; xprt is already down: */
2487                 nfsd4_conn_lost(&new->cn_xpt_user);
2488         return nfs_ok;
2489 out_free:
2490         spin_unlock(&clp->cl_lock);
2491         free_conn(new);
2492         return status;
2493 }
2494
2495 static bool nfsd4_session_too_many_ops(struct svc_rqst *rqstp, struct nfsd4_session *session)
2496 {
2497         struct nfsd4_compoundargs *args = rqstp->rq_argp;
2498
2499         return args->opcnt > session->se_fchannel.maxops;
2500 }
2501
2502 static bool nfsd4_request_too_big(struct svc_rqst *rqstp,
2503                                   struct nfsd4_session *session)
2504 {
2505         struct xdr_buf *xb = &rqstp->rq_arg;
2506
2507         return xb->len > session->se_fchannel.maxreq_sz;
2508 }
2509
2510 __be32
2511 nfsd4_sequence(struct svc_rqst *rqstp,
2512                struct nfsd4_compound_state *cstate,
2513                struct nfsd4_sequence *seq)
2514 {
2515         struct nfsd4_compoundres *resp = rqstp->rq_resp;
2516         struct xdr_stream *xdr = &resp->xdr;
2517         struct nfsd4_session *session;
2518         struct nfs4_client *clp;
2519         struct nfsd4_slot *slot;
2520         struct nfsd4_conn *conn;
2521         __be32 status;
2522         int buflen;
2523         struct net *net = SVC_NET(rqstp);
2524         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
2525
2526         if (resp->opcnt != 1)
2527                 return nfserr_sequence_pos;
2528
2529         /*
2530          * Will be either used or freed by nfsd4_sequence_check_conn
2531          * below.
2532          */
2533         conn = alloc_conn(rqstp, NFS4_CDFC4_FORE);
2534         if (!conn)
2535                 return nfserr_jukebox;
2536
2537         spin_lock(&nn->client_lock);
2538         session = find_in_sessionid_hashtbl(&seq->sessionid, net, &status);
2539         if (!session)
2540                 goto out_no_session;
2541         clp = session->se_client;
2542
2543         status = nfserr_too_many_ops;
2544         if (nfsd4_session_too_many_ops(rqstp, session))
2545                 goto out_put_session;
2546
2547         status = nfserr_req_too_big;
2548         if (nfsd4_request_too_big(rqstp, session))
2549                 goto out_put_session;
2550
2551         status = nfserr_badslot;
2552         if (seq->slotid >= session->se_fchannel.maxreqs)
2553                 goto out_put_session;
2554
2555         slot = session->se_slots[seq->slotid];
2556         dprintk("%s: slotid %d\n", __func__, seq->slotid);
2557
2558         /* We do not negotiate the number of slots yet, so set the
2559          * maxslots to the session maxreqs which is used to encode
2560          * sr_highest_slotid and the sr_target_slot id to maxslots */
2561         seq->maxslots = session->se_fchannel.maxreqs;
2562
2563         status = check_slot_seqid(seq->seqid, slot->sl_seqid,
2564                                         slot->sl_flags & NFSD4_SLOT_INUSE);
2565         if (status == nfserr_replay_cache) {
2566                 status = nfserr_seq_misordered;
2567                 if (!(slot->sl_flags & NFSD4_SLOT_INITIALIZED))
2568                         goto out_put_session;
2569                 cstate->slot = slot;
2570                 cstate->session = session;
2571                 cstate->clp = clp;
2572                 /* Return the cached reply status and set cstate->status
2573                  * for nfsd4_proc_compound processing */
2574                 status = nfsd4_replay_cache_entry(resp, seq);
2575                 cstate->status = nfserr_replay_cache;
2576                 goto out;
2577         }
2578         if (status)
2579                 goto out_put_session;
2580
2581         status = nfsd4_sequence_check_conn(conn, session);
2582         conn = NULL;
2583         if (status)
2584                 goto out_put_session;
2585
2586         buflen = (seq->cachethis) ?
2587                         session->se_fchannel.maxresp_cached :
2588                         session->se_fchannel.maxresp_sz;
2589         status = (seq->cachethis) ? nfserr_rep_too_big_to_cache :
2590                                     nfserr_rep_too_big;
2591         if (xdr_restrict_buflen(xdr, buflen - rqstp->rq_auth_slack))
2592                 goto out_put_session;
2593         svc_reserve(rqstp, buflen);
2594
2595         status = nfs_ok;
2596         /* Success! bump slot seqid */
2597         slot->sl_seqid = seq->seqid;
2598         slot->sl_flags |= NFSD4_SLOT_INUSE;
2599         if (seq->cachethis)
2600                 slot->sl_flags |= NFSD4_SLOT_CACHETHIS;
2601         else
2602                 slot->sl_flags &= ~NFSD4_SLOT_CACHETHIS;
2603
2604         cstate->slot = slot;
2605         cstate->session = session;
2606         cstate->clp = clp;
2607
2608 out:
2609         switch (clp->cl_cb_state) {
2610         case NFSD4_CB_DOWN:
2611                 seq->status_flags = SEQ4_STATUS_CB_PATH_DOWN;
2612                 break;
2613         case NFSD4_CB_FAULT:
2614                 seq->status_flags = SEQ4_STATUS_BACKCHANNEL_FAULT;
2615                 break;
2616         default:
2617                 seq->status_flags = 0;
2618         }
2619         if (!list_empty(&clp->cl_revoked))
2620                 seq->status_flags |= SEQ4_STATUS_RECALLABLE_STATE_REVOKED;
2621 out_no_session:
2622         if (conn)
2623                 free_conn(conn);
2624         spin_unlock(&nn->client_lock);
2625         return status;
2626 out_put_session:
2627         nfsd4_put_session_locked(session);
2628         goto out_no_session;
2629 }
2630
2631 void
2632 nfsd4_sequence_done(struct nfsd4_compoundres *resp)
2633 {
2634         struct nfsd4_compound_state *cs = &resp->cstate;
2635
2636         if (nfsd4_has_session(cs)) {
2637                 if (cs->status != nfserr_replay_cache) {
2638                         nfsd4_store_cache_entry(resp);
2639                         cs->slot->sl_flags &= ~NFSD4_SLOT_INUSE;
2640                 }
2641                 /* Drop session reference that was taken in nfsd4_sequence() */
2642                 nfsd4_put_session(cs->session);
2643         } else if (cs->clp)
2644                 put_client_renew(cs->clp);
2645 }
2646
2647 __be32
2648 nfsd4_destroy_clientid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, struct nfsd4_destroy_clientid *dc)
2649 {
2650         struct nfs4_client *conf, *unconf, *clp;
2651         __be32 status = 0;
2652         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
2653
2654         nfs4_lock_state();
2655         unconf = find_unconfirmed_client(&dc->clientid, true, nn);
2656         conf = find_confirmed_client(&dc->clientid, true, nn);
2657         WARN_ON_ONCE(conf && unconf);
2658
2659         if (conf) {
2660                 clp = conf;
2661
2662                 if (client_has_state(conf)) {
2663                         status = nfserr_clientid_busy;
2664                         goto out;
2665                 }
2666         } else if (unconf)
2667                 clp = unconf;
2668         else {
2669                 status = nfserr_stale_clientid;
2670                 goto out;
2671         }
2672         if (!mach_creds_match(clp, rqstp)) {
2673                 status = nfserr_wrong_cred;
2674                 goto out;
2675         }
2676         expire_client(clp);
2677 out:
2678         nfs4_unlock_state();
2679         return status;
2680 }
2681
2682 __be32
2683 nfsd4_reclaim_complete(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, struct nfsd4_reclaim_complete *rc)
2684 {
2685         __be32 status = 0;
2686
2687         if (rc->rca_one_fs) {
2688                 if (!cstate->current_fh.fh_dentry)
2689                         return nfserr_nofilehandle;
2690                 /*
2691                  * We don't take advantage of the rca_one_fs case.
2692                  * That's OK, it's optional, we can safely ignore it.
2693                  */
2694                  return nfs_ok;
2695         }
2696
2697         nfs4_lock_state();
2698         status = nfserr_complete_already;
2699         if (test_and_set_bit(NFSD4_CLIENT_RECLAIM_COMPLETE,
2700                              &cstate->session->se_client->cl_flags))
2701                 goto out;
2702
2703         status = nfserr_stale_clientid;
2704         if (is_client_expired(cstate->session->se_client))
2705                 /*
2706                  * The following error isn't really legal.
2707                  * But we only get here if the client just explicitly
2708                  * destroyed the client.  Surely it no longer cares what
2709                  * error it gets back on an operation for the dead
2710                  * client.
2711                  */
2712                 goto out;
2713
2714         status = nfs_ok;
2715         nfsd4_client_record_create(cstate->session->se_client);
2716 out:
2717         nfs4_unlock_state();
2718         return status;
2719 }
2720
2721 __be32
2722 nfsd4_setclientid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
2723                   struct nfsd4_setclientid *setclid)
2724 {
2725         struct xdr_netobj       clname = setclid->se_name;
2726         nfs4_verifier           clverifier = setclid->se_verf;
2727         struct nfs4_client      *conf, *unconf, *new;
2728         __be32                  status;
2729         struct nfsd_net         *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
2730
2731         /* Cases below refer to rfc 3530 section 14.2.33: */
2732         nfs4_lock_state();
2733         conf = find_confirmed_client_by_name(&clname, nn);
2734         if (conf) {
2735                 /* case 0: */
2736                 status = nfserr_clid_inuse;
2737                 if (clp_used_exchangeid(conf))
2738                         goto out;
2739                 if (!same_creds(&conf->cl_cred, &rqstp->rq_cred)) {
2740                         char addr_str[INET6_ADDRSTRLEN];
2741                         rpc_ntop((struct sockaddr *) &conf->cl_addr, addr_str,
2742                                  sizeof(addr_str));
2743                         dprintk("NFSD: setclientid: string in use by client "
2744                                 "at %s\n", addr_str);
2745                         goto out;
2746                 }
2747         }
2748         unconf = find_unconfirmed_client_by_name(&clname, nn);
2749         if (unconf)
2750                 expire_client(unconf);
2751         status = nfserr_jukebox;
2752         new = create_client(clname, rqstp, &clverifier);
2753         if (new == NULL)
2754                 goto out;
2755         if (conf && same_verf(&conf->cl_verifier, &clverifier))
2756                 /* case 1: probable callback update */
2757                 copy_clid(new, conf);
2758         else /* case 4 (new client) or cases 2, 3 (client reboot): */
2759                 gen_clid(new, nn);
2760         new->cl_minorversion = 0;
2761         gen_callback(new, setclid, rqstp);
2762         add_to_unconfirmed(new);
2763         setclid->se_clientid.cl_boot = new->cl_clientid.cl_boot;
2764         setclid->se_clientid.cl_id = new->cl_clientid.cl_id;
2765         memcpy(setclid->se_confirm.data, new->cl_confirm.data, sizeof(setclid->se_confirm.data));
2766         status = nfs_ok;
2767 out:
2768         nfs4_unlock_state();
2769         return status;
2770 }
2771
2772
2773 __be32
2774 nfsd4_setclientid_confirm(struct svc_rqst *rqstp,
2775                          struct nfsd4_compound_state *cstate,
2776                          struct nfsd4_setclientid_confirm *setclientid_confirm)
2777 {
2778         struct nfs4_client *conf, *unconf;
2779         nfs4_verifier confirm = setclientid_confirm->sc_confirm;
2780         clientid_t * clid = &setclientid_confirm->sc_clientid;
2781         __be32 status;
2782         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
2783
2784         if (STALE_CLIENTID(clid, nn))
2785                 return nfserr_stale_clientid;
2786         nfs4_lock_state();
2787
2788         conf = find_confirmed_client(clid, false, nn);
2789         unconf = find_unconfirmed_client(clid, false, nn);
2790         /*
2791          * We try hard to give out unique clientid's, so if we get an
2792          * attempt to confirm the same clientid with a different cred,
2793          * there's a bug somewhere.  Let's charitably assume it's our
2794          * bug.
2795          */
2796         status = nfserr_serverfault;
2797         if (unconf && !same_creds(&unconf->cl_cred, &rqstp->rq_cred))
2798                 goto out;
2799         if (conf && !same_creds(&conf->cl_cred, &rqstp->rq_cred))
2800                 goto out;
2801         /* cases below refer to rfc 3530 section 14.2.34: */
2802         if (!unconf || !same_verf(&confirm, &unconf->cl_confirm)) {
2803                 if (conf && !unconf) /* case 2: probable retransmit */
2804                         status = nfs_ok;
2805                 else /* case 4: client hasn't noticed we rebooted yet? */
2806                         status = nfserr_stale_clientid;
2807                 goto out;
2808         }
2809         status = nfs_ok;
2810         if (conf) { /* case 1: callback update */
2811                 nfsd4_change_callback(conf, &unconf->cl_cb_conn);
2812                 nfsd4_probe_callback(conf);
2813                 expire_client(unconf);
2814         } else { /* case 3: normal case; new or rebooted client */
2815                 conf = find_confirmed_client_by_name(&unconf->cl_name, nn);
2816                 if (conf) {
2817                         status = mark_client_expired(conf);
2818                         if (status)
2819                                 goto out;
2820                         expire_client(conf);
2821                 }
2822                 move_to_confirmed(unconf);
2823                 nfsd4_probe_callback(unconf);
2824         }
2825 out:
2826         nfs4_unlock_state();
2827         return status;
2828 }
2829
2830 static struct nfs4_file *nfsd4_alloc_file(void)
2831 {
2832         return kmem_cache_alloc(file_slab, GFP_KERNEL);
2833 }
2834
2835 /* OPEN Share state helper functions */
2836 static void nfsd4_init_file(struct nfs4_file *fp, struct inode *ino)
2837 {
2838         unsigned int hashval = file_hashval(ino);
2839
2840         lockdep_assert_held(&state_lock);
2841
2842         atomic_set(&fp->fi_ref, 1);
2843         spin_lock_init(&fp->fi_lock);
2844         INIT_LIST_HEAD(&fp->fi_stateids);
2845         INIT_LIST_HEAD(&fp->fi_delegations);
2846         ihold(ino);
2847         fp->fi_inode = ino;
2848         fp->fi_had_conflict = false;
2849         fp->fi_lease = NULL;
2850         fp->fi_share_deny = 0;
2851         memset(fp->fi_fds, 0, sizeof(fp->fi_fds));
2852         memset(fp->fi_access, 0, sizeof(fp->fi_access));
2853         hlist_add_head(&fp->fi_hash, &file_hashtbl[hashval]);
2854 }
2855
2856 void
2857 nfsd4_free_slabs(void)
2858 {
2859         kmem_cache_destroy(openowner_slab);
2860         kmem_cache_destroy(lockowner_slab);
2861         kmem_cache_destroy(file_slab);
2862         kmem_cache_destroy(stateid_slab);
2863         kmem_cache_destroy(deleg_slab);
2864 }
2865
2866 int
2867 nfsd4_init_slabs(void)
2868 {
2869         openowner_slab = kmem_cache_create("nfsd4_openowners",
2870                         sizeof(struct nfs4_openowner), 0, 0, NULL);
2871         if (openowner_slab == NULL)
2872                 goto out;
2873         lockowner_slab = kmem_cache_create("nfsd4_lockowners",
2874                         sizeof(struct nfs4_lockowner), 0, 0, NULL);
2875         if (lockowner_slab == NULL)
2876                 goto out_free_openowner_slab;
2877         file_slab = kmem_cache_create("nfsd4_files",
2878                         sizeof(struct nfs4_file), 0, 0, NULL);
2879         if (file_slab == NULL)
2880                 goto out_free_lockowner_slab;
2881         stateid_slab = kmem_cache_create("nfsd4_stateids",
2882                         sizeof(struct nfs4_ol_stateid), 0, 0, NULL);
2883         if (stateid_slab == NULL)
2884                 goto out_free_file_slab;
2885         deleg_slab = kmem_cache_create("nfsd4_delegations",
2886                         sizeof(struct nfs4_delegation), 0, 0, NULL);
2887         if (deleg_slab == NULL)
2888                 goto out_free_stateid_slab;
2889         return 0;
2890
2891 out_free_stateid_slab:
2892         kmem_cache_destroy(stateid_slab);
2893 out_free_file_slab:
2894         kmem_cache_destroy(file_slab);
2895 out_free_lockowner_slab:
2896         kmem_cache_destroy(lockowner_slab);
2897 out_free_openowner_slab:
2898         kmem_cache_destroy(openowner_slab);
2899 out:
2900         dprintk("nfsd4: out of memory while initializing nfsv4\n");
2901         return -ENOMEM;
2902 }
2903
2904 static void init_nfs4_replay(struct nfs4_replay *rp)
2905 {
2906         rp->rp_status = nfserr_serverfault;
2907         rp->rp_buflen = 0;
2908         rp->rp_buf = rp->rp_ibuf;
2909 }
2910
2911 static inline void *alloc_stateowner(struct kmem_cache *slab, struct xdr_netobj *owner, struct nfs4_client *clp)
2912 {
2913         struct nfs4_stateowner *sop;
2914
2915         sop = kmem_cache_alloc(slab, GFP_KERNEL);
2916         if (!sop)
2917                 return NULL;
2918
2919         sop->so_owner.data = kmemdup(owner->data, owner->len, GFP_KERNEL);
2920         if (!sop->so_owner.data) {
2921                 kmem_cache_free(slab, sop);
2922                 return NULL;
2923         }
2924         sop->so_owner.len = owner->len;
2925
2926         INIT_LIST_HEAD(&sop->so_stateids);
2927         sop->so_client = clp;
2928         init_nfs4_replay(&sop->so_replay);
2929         return sop;
2930 }
2931
2932 static void hash_openowner(struct nfs4_openowner *oo, struct nfs4_client *clp, unsigned int strhashval)
2933 {
2934         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
2935
2936         list_add(&oo->oo_owner.so_strhash, &nn->ownerstr_hashtbl[strhashval]);
2937         list_add(&oo->oo_perclient, &clp->cl_openowners);
2938 }
2939
2940 static struct nfs4_openowner *
2941 alloc_init_open_stateowner(unsigned int strhashval, struct nfsd4_open *open,
2942                            struct nfsd4_compound_state *cstate)
2943 {
2944         struct nfs4_client *clp = cstate->clp;
2945         struct nfs4_openowner *oo;
2946
2947         oo = alloc_stateowner(openowner_slab, &open->op_owner, clp);
2948         if (!oo)
2949                 return NULL;
2950         oo->oo_owner.so_is_open_owner = 1;
2951         oo->oo_owner.so_seqid = open->op_seqid;
2952         oo->oo_flags = NFS4_OO_NEW;
2953         if (nfsd4_has_session(cstate))
2954                 oo->oo_flags |= NFS4_OO_CONFIRMED;
2955         oo->oo_time = 0;
2956         oo->oo_last_closed_stid = NULL;
2957         INIT_LIST_HEAD(&oo->oo_close_lru);
2958         hash_openowner(oo, clp, strhashval);
2959         return oo;
2960 }
2961
2962 static void init_open_stateid(struct nfs4_ol_stateid *stp, struct nfs4_file *fp, struct nfsd4_open *open) {
2963         struct nfs4_openowner *oo = open->op_openowner;
2964
2965         stp->st_stid.sc_type = NFS4_OPEN_STID;
2966         INIT_LIST_HEAD(&stp->st_locks);
2967         list_add(&stp->st_perstateowner, &oo->oo_owner.so_stateids);
2968         stp->st_stateowner = &oo->oo_owner;
2969         get_nfs4_file(fp);
2970         stp->st_file = fp;
2971         stp->st_access_bmap = 0;
2972         stp->st_deny_bmap = 0;
2973         set_access(open->op_share_access, stp);
2974         set_deny(open->op_share_deny, stp);
2975         stp->st_openstp = NULL;
2976         spin_lock(&fp->fi_lock);
2977         list_add(&stp->st_perfile, &fp->fi_stateids);
2978         spin_unlock(&fp->fi_lock);
2979 }
2980
2981 static void
2982 move_to_close_lru(struct nfs4_openowner *oo, struct net *net)
2983 {
2984         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
2985
2986         dprintk("NFSD: move_to_close_lru nfs4_openowner %p\n", oo);
2987
2988         list_move_tail(&oo->oo_close_lru, &nn->close_lru);
2989         oo->oo_time = get_seconds();
2990 }
2991
2992 static int
2993 same_owner_str(struct nfs4_stateowner *sop, struct xdr_netobj *owner,
2994                                                         clientid_t *clid)
2995 {
2996         return (sop->so_owner.len == owner->len) &&
2997                 0 == memcmp(sop->so_owner.data, owner->data, owner->len) &&
2998                 (sop->so_client->cl_clientid.cl_id == clid->cl_id);
2999 }
3000
3001 static struct nfs4_openowner *
3002 find_openstateowner_str(unsigned int hashval, struct nfsd4_open *open,
3003                         bool sessions, struct nfsd_net *nn)
3004 {
3005         struct nfs4_stateowner *so;
3006         struct nfs4_openowner *oo;
3007         struct nfs4_client *clp;
3008
3009         list_for_each_entry(so, &nn->ownerstr_hashtbl[hashval], so_strhash) {
3010                 if (!so->so_is_open_owner)
3011                         continue;
3012                 if (same_owner_str(so, &open->op_owner, &open->op_clientid)) {
3013                         oo = openowner(so);
3014                         clp = oo->oo_owner.so_client;
3015                         if ((bool)clp->cl_minorversion != sessions)
3016                                 return NULL;
3017                         renew_client(oo->oo_owner.so_client);
3018                         return oo;
3019                 }
3020         }
3021         return NULL;
3022 }
3023
3024 /* search file_hashtbl[] for file */
3025 static struct nfs4_file *
3026 find_file_locked(struct inode *ino)
3027 {
3028         unsigned int hashval = file_hashval(ino);
3029         struct nfs4_file *fp;
3030
3031         lockdep_assert_held(&state_lock);
3032
3033         hlist_for_each_entry(fp, &file_hashtbl[hashval], fi_hash) {
3034                 if (fp->fi_inode == ino) {
3035                         get_nfs4_file(fp);
3036                         return fp;
3037                 }
3038         }
3039         return NULL;
3040 }
3041
3042 static struct nfs4_file *
3043 find_file(struct inode *ino)
3044 {
3045         struct nfs4_file *fp;
3046
3047         spin_lock(&state_lock);
3048         fp = find_file_locked(ino);
3049         spin_unlock(&state_lock);
3050         return fp;
3051 }
3052
3053 static struct nfs4_file *
3054 find_or_add_file(struct inode *ino, struct nfs4_file *new)
3055 {
3056         struct nfs4_file *fp;
3057
3058         spin_lock(&state_lock);
3059         fp = find_file_locked(ino);
3060         if (fp == NULL) {
3061                 nfsd4_init_file(new, ino);
3062                 fp = new;
3063         }
3064         spin_unlock(&state_lock);
3065
3066         return fp;
3067 }
3068
3069 /*
3070  * Called to check deny when READ with all zero stateid or
3071  * WRITE with all zero or all one stateid
3072  */
3073 static __be32
3074 nfs4_share_conflict(struct svc_fh *current_fh, unsigned int deny_type)
3075 {
3076         struct inode *ino = current_fh->fh_dentry->d_inode;
3077         struct nfs4_file *fp;
3078         __be32 ret = nfs_ok;
3079
3080         fp = find_file(ino);
3081         if (!fp)
3082                 return ret;
3083         /* Check for conflicting share reservations */
3084         spin_lock(&fp->fi_lock);
3085         if (fp->fi_share_deny & deny_type)
3086                 ret = nfserr_locked;
3087         spin_unlock(&fp->fi_lock);
3088         put_nfs4_file(fp);
3089         return ret;
3090 }
3091
3092 void nfsd4_prepare_cb_recall(struct nfs4_delegation *dp)
3093 {
3094         struct nfs4_client *clp = dp->dl_stid.sc_client;
3095         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
3096
3097         /*
3098          * We can't do this in nfsd_break_deleg_cb because it is
3099          * already holding inode->i_lock
3100          */
3101         spin_lock(&state_lock);
3102         block_delegations(&dp->dl_fh);
3103         /*
3104          * If the dl_time != 0, then we know that it has already been
3105          * queued for a lease break. Don't queue it again.
3106          */
3107         if (dp->dl_time == 0) {
3108                 dp->dl_time = get_seconds();
3109                 list_add_tail(&dp->dl_recall_lru, &nn->del_recall_lru);
3110         }
3111         spin_unlock(&state_lock);
3112 }
3113
3114 static void nfsd_break_one_deleg(struct nfs4_delegation *dp)
3115 {
3116         /*
3117          * We're assuming the state code never drops its reference
3118          * without first removing the lease.  Since we're in this lease
3119          * callback (and since the lease code is serialized by the kernel
3120          * lock) we know the server hasn't removed the lease yet, we know
3121          * it's safe to take a reference.
3122          */
3123         atomic_inc(&dp->dl_stid.sc_count);
3124         nfsd4_cb_recall(dp);
3125 }
3126
3127 /* Called from break_lease() with i_lock held. */
3128 static void nfsd_break_deleg_cb(struct file_lock *fl)
3129 {
3130         struct nfs4_file *fp = (struct nfs4_file *)fl->fl_owner;
3131         struct nfs4_delegation *dp;
3132
3133         if (!fp) {
3134                 WARN(1, "(%p)->fl_owner NULL\n", fl);
3135                 return;
3136         }
3137         if (fp->fi_had_conflict) {
3138                 WARN(1, "duplicate break on %p\n", fp);
3139                 return;
3140         }
3141         /*
3142          * We don't want the locks code to timeout the lease for us;
3143          * we'll remove it ourself if a delegation isn't returned
3144          * in time:
3145          */
3146         fl->fl_break_time = 0;
3147
3148         spin_lock(&fp->fi_lock);
3149         fp->fi_had_conflict = true;
3150         /*
3151          * If there are no delegations on the list, then we can't count on this
3152          * lease ever being cleaned up. Set the fl_break_time to jiffies so that
3153          * time_out_leases will do it ASAP. The fact that fi_had_conflict is now
3154          * true should keep any new delegations from being hashed.
3155          */
3156         if (list_empty(&fp->fi_delegations))
3157                 fl->fl_break_time = jiffies;
3158         else
3159                 list_for_each_entry(dp, &fp->fi_delegations, dl_perfile)
3160                         nfsd_break_one_deleg(dp);
3161         spin_unlock(&fp->fi_lock);
3162 }
3163
3164 static
3165 int nfsd_change_deleg_cb(struct file_lock **onlist, int arg)
3166 {
3167         if (arg & F_UNLCK)
3168                 return lease_modify(onlist, arg);
3169         else
3170                 return -EAGAIN;
3171 }
3172
3173 static const struct lock_manager_operations nfsd_lease_mng_ops = {
3174         .lm_break = nfsd_break_deleg_cb,
3175         .lm_change = nfsd_change_deleg_cb,
3176 };
3177
3178 static __be32 nfsd4_check_seqid(struct nfsd4_compound_state *cstate, struct nfs4_stateowner *so, u32 seqid)
3179 {
3180         if (nfsd4_has_session(cstate))
3181                 return nfs_ok;
3182         if (seqid == so->so_seqid - 1)
3183                 return nfserr_replay_me;
3184         if (seqid == so->so_seqid)
3185                 return nfs_ok;
3186         return nfserr_bad_seqid;
3187 }
3188
3189 static __be32 lookup_clientid(clientid_t *clid,
3190                 struct nfsd4_compound_state *cstate,
3191                 struct nfsd_net *nn)
3192 {
3193         struct nfs4_client *found;
3194
3195         if (cstate->clp) {
3196                 found = cstate->clp;
3197                 if (!same_clid(&found->cl_clientid, clid))
3198                         return nfserr_stale_clientid;
3199                 return nfs_ok;
3200         }
3201
3202         if (STALE_CLIENTID(clid, nn))
3203                 return nfserr_stale_clientid;
3204
3205         /*
3206          * For v4.1+ we get the client in the SEQUENCE op. If we don't have one
3207          * cached already then we know this is for is for v4.0 and "sessions"
3208          * will be false.
3209          */
3210         WARN_ON_ONCE(cstate->session);
3211         found = find_confirmed_client(clid, false, nn);
3212         if (!found)
3213                 return nfserr_expired;
3214
3215         /* Cache the nfs4_client in cstate! */
3216         cstate->clp = found;
3217         atomic_inc(&found->cl_refcount);
3218         return nfs_ok;
3219 }
3220
3221 __be32
3222 nfsd4_process_open1(struct nfsd4_compound_state *cstate,
3223                     struct nfsd4_open *open, struct nfsd_net *nn)
3224 {
3225         clientid_t *clientid = &open->op_clientid;
3226         struct nfs4_client *clp = NULL;
3227         unsigned int strhashval;
3228         struct nfs4_openowner *oo = NULL;
3229         __be32 status;
3230
3231         if (STALE_CLIENTID(&open->op_clientid, nn))
3232                 return nfserr_stale_clientid;
3233         /*
3234          * In case we need it later, after we've already created the
3235          * file and don't want to risk a further failure:
3236          */
3237         open->op_file = nfsd4_alloc_file();
3238         if (open->op_file == NULL)
3239                 return nfserr_jukebox;
3240
3241         status = lookup_clientid(clientid, cstate, nn);
3242         if (status)
3243                 return status;
3244         clp = cstate->clp;
3245
3246         strhashval = ownerstr_hashval(clientid->cl_id, &open->op_owner);
3247         oo = find_openstateowner_str(strhashval, open, cstate->minorversion, nn);
3248         open->op_openowner = oo;
3249         if (!oo) {
3250                 goto new_owner;
3251         }
3252         if (!(oo->oo_flags & NFS4_OO_CONFIRMED)) {
3253                 /* Replace unconfirmed owners without checking for replay. */
3254                 release_openowner(oo);
3255                 open->op_openowner = NULL;
3256                 goto new_owner;
3257         }
3258         status = nfsd4_check_seqid(cstate, &oo->oo_owner, open->op_seqid);
3259         if (status)
3260                 return status;
3261         goto alloc_stateid;
3262 new_owner:
3263         oo = alloc_init_open_stateowner(strhashval, open, cstate);
3264         if (oo == NULL)
3265                 return nfserr_jukebox;
3266         open->op_openowner = oo;
3267 alloc_stateid:
3268         open->op_stp = nfs4_alloc_stateid(clp);
3269         if (!open->op_stp)
3270                 return nfserr_jukebox;
3271         return nfs_ok;
3272 }
3273
3274 static inline __be32
3275 nfs4_check_delegmode(struct nfs4_delegation *dp, int flags)
3276 {
3277         if ((flags & WR_STATE) && (dp->dl_type == NFS4_OPEN_DELEGATE_READ))
3278                 return nfserr_openmode;
3279         else
3280                 return nfs_ok;
3281 }
3282
3283 static int share_access_to_flags(u32 share_access)
3284 {
3285         return share_access == NFS4_SHARE_ACCESS_READ ? RD_STATE : WR_STATE;
3286 }
3287
3288 static struct nfs4_delegation *find_deleg_stateid(struct nfs4_client *cl, stateid_t *s)
3289 {
3290         struct nfs4_stid *ret;
3291
3292         ret = find_stateid_by_type(cl, s, NFS4_DELEG_STID);
3293         if (!ret)
3294                 return NULL;
3295         return delegstateid(ret);
3296 }
3297
3298 static bool nfsd4_is_deleg_cur(struct nfsd4_open *open)
3299 {
3300         return open->op_claim_type == NFS4_OPEN_CLAIM_DELEGATE_CUR ||
3301                open->op_claim_type == NFS4_OPEN_CLAIM_DELEG_CUR_FH;
3302 }
3303
3304 static __be32
3305 nfs4_check_deleg(struct nfs4_client *cl, struct nfsd4_open *open,
3306                 struct nfs4_delegation **dp)
3307 {
3308         int flags;
3309         __be32 status = nfserr_bad_stateid;
3310
3311         *dp = find_deleg_stateid(cl, &open->op_delegate_stateid);
3312         if (*dp == NULL)
3313                 goto out;
3314         flags = share_access_to_flags(open->op_share_access);
3315         status = nfs4_check_delegmode(*dp, flags);
3316         if (status)
3317                 *dp = NULL;
3318 out:
3319         if (!nfsd4_is_deleg_cur(open))
3320                 return nfs_ok;
3321         if (status)
3322                 return status;
3323         open->op_openowner->oo_flags |= NFS4_OO_CONFIRMED;
3324         return nfs_ok;
3325 }
3326
3327 static struct nfs4_ol_stateid *
3328 nfsd4_find_existing_open(struct nfs4_file *fp, struct nfsd4_open *open)
3329 {
3330         struct nfs4_ol_stateid *local, *ret = NULL;
3331         struct nfs4_openowner *oo = open->op_openowner;
3332
3333         spin_lock(&fp->fi_lock);
3334         list_for_each_entry(local, &fp->fi_stateids, st_perfile) {
3335                 /* ignore lock owners */
3336                 if (local->st_stateowner->so_is_open_owner == 0)
3337                         continue;
3338                 if (local->st_stateowner == &oo->oo_owner) {
3339                         ret = local;
3340                         break;
3341                 }
3342         }
3343         spin_unlock(&fp->fi_lock);
3344         return ret;
3345 }
3346
3347 static inline int nfs4_access_to_access(u32 nfs4_access)
3348 {
3349         int flags = 0;
3350
3351         if (nfs4_access & NFS4_SHARE_ACCESS_READ)
3352                 flags |= NFSD_MAY_READ;
3353         if (nfs4_access & NFS4_SHARE_ACCESS_WRITE)
3354                 flags |= NFSD_MAY_WRITE;
3355         return flags;
3356 }
3357
3358 static inline __be32
3359 nfsd4_truncate(struct svc_rqst *rqstp, struct svc_fh *fh,
3360                 struct nfsd4_open *open)
3361 {
3362         struct iattr iattr = {
3363                 .ia_valid = ATTR_SIZE,
3364                 .ia_size = 0,
3365         };
3366         if (!open->op_truncate)
3367                 return 0;
3368         if (!(open->op_share_access & NFS4_SHARE_ACCESS_WRITE))
3369                 return nfserr_inval;
3370         return nfsd_setattr(rqstp, fh, &iattr, 0, (time_t)0);
3371 }
3372
3373 static __be32 nfs4_get_vfs_file(struct svc_rqst *rqstp, struct nfs4_file *fp,
3374                 struct svc_fh *cur_fh, struct nfs4_ol_stateid *stp,
3375                 struct nfsd4_open *open)
3376 {
3377         struct file *filp = NULL;
3378         __be32 status;
3379         int oflag = nfs4_access_to_omode(open->op_share_access);
3380         int access = nfs4_access_to_access(open->op_share_access);
3381         unsigned char old_access_bmap, old_deny_bmap;
3382
3383         spin_lock(&fp->fi_lock);
3384
3385         /*
3386          * Are we trying to set a deny mode that would conflict with
3387          * current access?
3388          */
3389         status = nfs4_file_check_deny(fp, open->op_share_deny);
3390         if (status != nfs_ok) {
3391                 spin_unlock(&fp->fi_lock);
3392                 goto out;
3393         }
3394
3395         /* set access to the file */
3396         status = nfs4_file_get_access(fp, open->op_share_access);
3397         if (status != nfs_ok) {
3398                 spin_unlock(&fp->fi_lock);
3399                 goto out;
3400         }
3401
3402         /* Set access bits in stateid */
3403         old_access_bmap = stp->st_access_bmap;
3404         set_access(open->op_share_access, stp);
3405
3406         /* Set new deny mask */
3407         old_deny_bmap = stp->st_deny_bmap;
3408         set_deny(open->op_share_deny, stp);
3409         fp->fi_share_deny |= (open->op_share_deny & NFS4_SHARE_DENY_BOTH);
3410
3411         if (!fp->fi_fds[oflag]) {
3412                 spin_unlock(&fp->fi_lock);
3413                 status = nfsd_open(rqstp, cur_fh, S_IFREG, access, &filp);
3414                 if (status)
3415                         goto out_put_access;
3416                 spin_lock(&fp->fi_lock);
3417                 if (!fp->fi_fds[oflag]) {
3418                         fp->fi_fds[oflag] = filp;
3419                         filp = NULL;
3420                 }
3421         }
3422         spin_unlock(&fp->fi_lock);
3423         if (filp)
3424                 fput(filp);
3425
3426         status = nfsd4_truncate(rqstp, cur_fh, open);
3427         if (status)
3428                 goto out_put_access;
3429 out:
3430         return status;
3431 out_put_access:
3432         stp->st_access_bmap = old_access_bmap;
3433         nfs4_file_put_access(fp, open->op_share_access);
3434         reset_union_bmap_deny(bmap_to_share_mode(old_deny_bmap), stp);
3435         goto out;
3436 }
3437
3438 static __be32
3439 nfs4_upgrade_open(struct svc_rqst *rqstp, struct nfs4_file *fp, struct svc_fh *cur_fh, struct nfs4_ol_stateid *stp, struct nfsd4_open *open)
3440 {
3441         __be32 status;
3442         unsigned char old_deny_bmap;
3443
3444         if (!test_access(open->op_share_access, stp))
3445                 return nfs4_get_vfs_file(rqstp, fp, cur_fh, stp, open);
3446
3447         /* test and set deny mode */
3448         spin_lock(&fp->fi_lock);
3449         status = nfs4_file_check_deny(fp, open->op_share_deny);
3450         if (status == nfs_ok) {
3451                 old_deny_bmap = stp->st_deny_bmap;
3452                 set_deny(open->op_share_deny, stp);
3453                 fp->fi_share_deny |=
3454                                 (open->op_share_deny & NFS4_SHARE_DENY_BOTH);
3455         }
3456         spin_unlock(&fp->fi_lock);
3457
3458         if (status != nfs_ok)
3459                 return status;
3460
3461         status = nfsd4_truncate(rqstp, cur_fh, open);
3462         if (status != nfs_ok)
3463                 reset_union_bmap_deny(old_deny_bmap, stp);
3464         return status;
3465 }
3466
3467 static void
3468 nfs4_set_claim_prev(struct nfsd4_open *open, bool has_session)
3469 {
3470         open->op_openowner->oo_flags |= NFS4_OO_CONFIRMED;
3471 }
3472
3473 /* Should we give out recallable state?: */
3474 static bool nfsd4_cb_channel_good(struct nfs4_client *clp)
3475 {
3476         if (clp->cl_cb_state == NFSD4_CB_UP)
3477                 return true;
3478         /*
3479          * In the sessions case, since we don't have to establish a
3480          * separate connection for callbacks, we assume it's OK
3481          * until we hear otherwise:
3482          */
3483         return clp->cl_minorversion && clp->cl_cb_state == NFSD4_CB_UNKNOWN;
3484 }
3485
3486 static struct file_lock *nfs4_alloc_init_lease(struct nfs4_file *fp, int flag)
3487 {
3488         struct file_lock *fl;
3489
3490         fl = locks_alloc_lock();
3491         if (!fl)
3492                 return NULL;
3493         locks_init_lock(fl);
3494         fl->fl_lmops = &nfsd_lease_mng_ops;
3495         fl->fl_flags = FL_DELEG;
3496         fl->fl_type = flag == NFS4_OPEN_DELEGATE_READ? F_RDLCK: F_WRLCK;
3497         fl->fl_end = OFFSET_MAX;
3498         fl->fl_owner = (fl_owner_t)fp;
3499         fl->fl_pid = current->tgid;
3500         return fl;
3501 }
3502
3503 static int nfs4_setlease(struct nfs4_delegation *dp)
3504 {
3505         struct nfs4_file *fp = dp->dl_file;
3506         struct file_lock *fl;
3507         struct file *filp;
3508         int status = 0;
3509
3510         fl = nfs4_alloc_init_lease(fp, NFS4_OPEN_DELEGATE_READ);
3511         if (!fl)
3512                 return -ENOMEM;
3513         filp = find_readable_file(fp);
3514         if (!filp) {
3515                 /* We should always have a readable file here */
3516                 WARN_ON_ONCE(1);
3517                 return -EBADF;
3518         }
3519         fl->fl_file = filp;
3520         status = vfs_setlease(filp, fl->fl_type, &fl);
3521         if (status) {
3522                 locks_free_lock(fl);
3523                 goto out_fput;
3524         }
3525         spin_lock(&state_lock);
3526         spin_lock(&fp->fi_lock);
3527         /* Did the lease get broken before we took the lock? */
3528         status = -EAGAIN;
3529         if (fp->fi_had_conflict)
3530                 goto out_unlock;
3531         /* Race breaker */
3532         if (fp->fi_lease) {
3533                 status = 0;
3534                 atomic_inc(&fp->fi_delegees);
3535                 hash_delegation_locked(dp, fp);
3536                 goto out_unlock;
3537         }
3538         fp->fi_lease = fl;
3539         fp->fi_deleg_file = filp;
3540         atomic_set(&fp->fi_delegees, 1);
3541         hash_delegation_locked(dp, fp);
3542         spin_unlock(&fp->fi_lock);
3543         spin_unlock(&state_lock);
3544         return 0;
3545 out_unlock:
3546         spin_unlock(&fp->fi_lock);
3547         spin_unlock(&state_lock);
3548 out_fput:
3549         fput(filp);
3550         return status;
3551 }
3552
3553 static int nfs4_set_delegation(struct nfs4_delegation *dp, struct nfs4_file *fp)
3554 {
3555         int status = 0;
3556
3557         if (fp->fi_had_conflict)
3558                 return -EAGAIN;
3559         get_nfs4_file(fp);
3560         spin_lock(&state_lock);
3561         spin_lock(&fp->fi_lock);
3562         dp->dl_file = fp;
3563         if (!fp->fi_lease) {
3564                 spin_unlock(&fp->fi_lock);
3565                 spin_unlock(&state_lock);
3566                 return nfs4_setlease(dp);
3567         }
3568         atomic_inc(&fp->fi_delegees);
3569         if (fp->fi_had_conflict) {
3570                 status = -EAGAIN;
3571                 goto out_unlock;
3572         }
3573         hash_delegation_locked(dp, fp);
3574 out_unlock:
3575         spin_unlock(&fp->fi_lock);
3576         spin_unlock(&state_lock);
3577         return status;
3578 }
3579
3580 static void nfsd4_open_deleg_none_ext(struct nfsd4_open *open, int status)
3581 {
3582         open->op_delegate_type = NFS4_OPEN_DELEGATE_NONE_EXT;
3583         if (status == -EAGAIN)
3584                 open->op_why_no_deleg = WND4_CONTENTION;
3585         else {
3586                 open->op_why_no_deleg = WND4_RESOURCE;
3587                 switch (open->op_deleg_want) {
3588                 case NFS4_SHARE_WANT_READ_DELEG:
3589                 case NFS4_SHARE_WANT_WRITE_DELEG:
3590                 case NFS4_SHARE_WANT_ANY_DELEG:
3591                         break;
3592                 case NFS4_SHARE_WANT_CANCEL:
3593                         open->op_why_no_deleg = WND4_CANCELLED;
3594                         break;
3595                 case NFS4_SHARE_WANT_NO_DELEG:
3596                         WARN_ON_ONCE(1);
3597                 }
3598         }
3599 }
3600
3601 /*
3602  * Attempt to hand out a delegation.
3603  *
3604  * Note we don't support write delegations, and won't until the vfs has
3605  * proper support for them.
3606  */
3607 static void
3608 nfs4_open_delegation(struct net *net, struct svc_fh *fh,
3609                      struct nfsd4_open *open, struct nfs4_ol_stateid *stp)
3610 {
3611         struct nfs4_delegation *dp;
3612         struct nfs4_openowner *oo = container_of(stp->st_stateowner, struct nfs4_openowner, oo_owner);
3613         int cb_up;
3614         int status = 0;
3615
3616         cb_up = nfsd4_cb_channel_good(oo->oo_owner.so_client);
3617         open->op_recall = 0;
3618         switch (open->op_claim_type) {
3619                 case NFS4_OPEN_CLAIM_PREVIOUS:
3620                         if (!cb_up)
3621                                 open->op_recall = 1;
3622                         if (open->op_delegate_type != NFS4_OPEN_DELEGATE_READ)
3623                                 goto out_no_deleg;
3624                         break;
3625                 case NFS4_OPEN_CLAIM_NULL:
3626                 case NFS4_OPEN_CLAIM_FH:
3627                         /*
3628                          * Let's not give out any delegations till everyone's
3629                          * had the chance to reclaim theirs....
3630                          */
3631                         if (locks_in_grace(net))
3632                                 goto out_no_deleg;
3633                         if (!cb_up || !(oo->oo_flags & NFS4_OO_CONFIRMED))
3634                                 goto out_no_deleg;
3635                         /*
3636                          * Also, if the file was opened for write or
3637                          * create, there's a good chance the client's
3638                          * about to write to it, resulting in an
3639                          * immediate recall (since we don't support
3640                          * write delegations):
3641                          */
3642                         if (open->op_share_access & NFS4_SHARE_ACCESS_WRITE)
3643                                 goto out_no_deleg;
3644                         if (open->op_create == NFS4_OPEN_CREATE)
3645                                 goto out_no_deleg;
3646                         break;
3647                 default:
3648                         goto out_no_deleg;
3649         }
3650         dp = alloc_init_deleg(oo->oo_owner.so_client, stp, fh);
3651         if (dp == NULL)
3652                 goto out_no_deleg;
3653         status = nfs4_set_delegation(dp, stp->st_file);
3654         if (status)
3655                 goto out_free;
3656
3657         memcpy(&open->op_delegate_stateid, &dp->dl_stid.sc_stateid, sizeof(dp->dl_stid.sc_stateid));
3658
3659         dprintk("NFSD: delegation stateid=" STATEID_FMT "\n",
3660                 STATEID_VAL(&dp->dl_stid.sc_stateid));
3661         open->op_delegate_type = NFS4_OPEN_DELEGATE_READ;
3662         return;
3663 out_free:
3664         destroy_delegation(dp);
3665 out_no_deleg:
3666         open->op_delegate_type = NFS4_OPEN_DELEGATE_NONE;
3667         if (open->op_claim_type == NFS4_OPEN_CLAIM_PREVIOUS &&
3668             open->op_delegate_type != NFS4_OPEN_DELEGATE_NONE) {
3669                 dprintk("NFSD: WARNING: refusing delegation reclaim\n");
3670                 open->op_recall = 1;
3671         }
3672
3673         /* 4.1 client asking for a delegation? */
3674         if (open->op_deleg_want)
3675                 nfsd4_open_deleg_none_ext(open, status);
3676         return;
3677 }
3678
3679 static void nfsd4_deleg_xgrade_none_ext(struct nfsd4_open *open,
3680                                         struct nfs4_delegation *dp)
3681 {
3682         if (open->op_deleg_want == NFS4_SHARE_WANT_READ_DELEG &&
3683             dp->dl_type == NFS4_OPEN_DELEGATE_WRITE) {
3684                 open->op_delegate_type = NFS4_OPEN_DELEGATE_NONE_EXT;
3685                 open->op_why_no_deleg = WND4_NOT_SUPP_DOWNGRADE;
3686         } else if (open->op_deleg_want == NFS4_SHARE_WANT_WRITE_DELEG &&
3687                    dp->dl_type == NFS4_OPEN_DELEGATE_WRITE) {
3688                 open->op_delegate_type = NFS4_OPEN_DELEGATE_NONE_EXT;
3689                 open->op_why_no_deleg = WND4_NOT_SUPP_UPGRADE;
3690         }
3691         /* Otherwise the client must be confused wanting a delegation
3692          * it already has, therefore we don't return
3693          * NFS4_OPEN_DELEGATE_NONE_EXT and reason.
3694          */
3695 }
3696
3697 /*
3698  * called with nfs4_lock_state() held.
3699  */
3700 __be32
3701 nfsd4_process_open2(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_open *open)
3702 {
3703         struct nfsd4_compoundres *resp = rqstp->rq_resp;
3704         struct nfs4_client *cl = open->op_openowner->oo_owner.so_client;
3705         struct nfs4_file *fp = NULL;
3706         struct inode *ino = current_fh->fh_dentry->d_inode;
3707         struct nfs4_ol_stateid *stp = NULL;
3708         struct nfs4_delegation *dp = NULL;
3709         __be32 status;
3710
3711         /*
3712          * Lookup file; if found, lookup stateid and check open request,
3713          * and check for delegations in the process of being recalled.
3714          * If not found, create the nfs4_file struct
3715          */
3716         fp = find_or_add_file(ino, open->op_file);
3717         if (fp != open->op_file) {
3718                 status = nfs4_check_deleg(cl, open, &dp);
3719                 if (status)
3720                         goto out;
3721                 stp = nfsd4_find_existing_open(fp, open);
3722         } else {
3723                 open->op_file = NULL;
3724                 status = nfserr_bad_stateid;
3725                 if (nfsd4_is_deleg_cur(open))
3726                         goto out;
3727                 status = nfserr_jukebox;
3728         }
3729
3730         /*
3731          * OPEN the file, or upgrade an existing OPEN.
3732          * If truncate fails, the OPEN fails.
3733          */
3734         if (stp) {
3735                 /* Stateid was found, this is an OPEN upgrade */
3736                 status = nfs4_upgrade_open(rqstp, fp, current_fh, stp, open);
3737                 if (status)
3738                         goto out;
3739         } else {
3740                 stp = open->op_stp;
3741                 open->op_stp = NULL;
3742                 init_open_stateid(stp, fp, open);
3743                 status = nfs4_get_vfs_file(rqstp, fp, current_fh, stp, open);
3744                 if (status) {
3745                         release_open_stateid(stp);
3746                         goto out;
3747                 }
3748         }
3749         update_stateid(&stp->st_stid.sc_stateid);
3750         memcpy(&open->op_stateid, &stp->st_stid.sc_stateid, sizeof(stateid_t));
3751
3752         if (nfsd4_has_session(&resp->cstate)) {
3753                 if (open->op_deleg_want & NFS4_SHARE_WANT_NO_DELEG) {
3754                         open->op_delegate_type = NFS4_OPEN_DELEGATE_NONE_EXT;
3755                         open->op_why_no_deleg = WND4_NOT_WANTED;
3756                         goto nodeleg;
3757                 }
3758         }
3759
3760         /*
3761         * Attempt to hand out a delegation. No error return, because the
3762         * OPEN succeeds even if we fail.
3763         */
3764         nfs4_open_delegation(SVC_NET(rqstp), current_fh, open, stp);
3765 nodeleg:
3766         status = nfs_ok;
3767
3768         dprintk("%s: stateid=" STATEID_FMT "\n", __func__,
3769                 STATEID_VAL(&stp->st_stid.sc_stateid));
3770 out:
3771         /* 4.1 client trying to upgrade/downgrade delegation? */
3772         if (open->op_delegate_type == NFS4_OPEN_DELEGATE_NONE && dp &&
3773             open->op_deleg_want)
3774                 nfsd4_deleg_xgrade_none_ext(open, dp);
3775
3776         if (fp)
3777                 put_nfs4_file(fp);
3778         if (status == 0 && open->op_claim_type == NFS4_OPEN_CLAIM_PREVIOUS)
3779                 nfs4_set_claim_prev(open, nfsd4_has_session(&resp->cstate));
3780         /*
3781         * To finish the open response, we just need to set the rflags.
3782         */
3783         open->op_rflags = NFS4_OPEN_RESULT_LOCKTYPE_POSIX;
3784         if (!(open->op_openowner->oo_flags & NFS4_OO_CONFIRMED) &&
3785             !nfsd4_has_session(&resp->cstate))
3786                 open->op_rflags |= NFS4_OPEN_RESULT_CONFIRM;
3787
3788         return status;
3789 }
3790
3791 void nfsd4_cleanup_open_state(struct nfsd4_open *open, __be32 status)
3792 {
3793         if (open->op_openowner) {
3794                 struct nfs4_openowner *oo = open->op_openowner;
3795
3796                 if (!list_empty(&oo->oo_owner.so_stateids))
3797                         list_del_init(&oo->oo_close_lru);
3798                 if (oo->oo_flags & NFS4_OO_NEW) {
3799                         if (status) {
3800                                 release_openowner(oo);
3801                                 open->op_openowner = NULL;
3802                         } else
3803                                 oo->oo_flags &= ~NFS4_OO_NEW;
3804                 }
3805         }
3806         if (open->op_file)
3807                 nfsd4_free_file(open->op_file);
3808         if (open->op_stp)
3809                 free_generic_stateid(open->op_stp);
3810 }
3811
3812 __be32
3813 nfsd4_renew(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
3814             clientid_t *clid)
3815 {
3816         struct nfs4_client *clp;
3817         __be32 status;
3818         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
3819
3820         nfs4_lock_state();
3821         dprintk("process_renew(%08x/%08x): starting\n",
3822                         clid->cl_boot, clid->cl_id);
3823         status = lookup_clientid(clid, cstate, nn);
3824         if (status)
3825                 goto out;
3826         clp = cstate->clp;
3827         status = nfserr_cb_path_down;
3828         if (!list_empty(&clp->cl_delegations)
3829                         && clp->cl_cb_state != NFSD4_CB_UP)
3830                 goto out;
3831         status = nfs_ok;
3832 out:
3833         nfs4_unlock_state();
3834         return status;
3835 }
3836
3837 static void
3838 nfsd4_end_grace(struct nfsd_net *nn)
3839 {
3840         /* do nothing if grace period already ended */
3841         if (nn->grace_ended)
3842                 return;
3843
3844         dprintk("NFSD: end of grace period\n");
3845         nn->grace_ended = true;
3846         nfsd4_record_grace_done(nn, nn->boot_time);
3847         locks_end_grace(&nn->nfsd4_manager);
3848         /*
3849          * Now that every NFSv4 client has had the chance to recover and
3850          * to see the (possibly new, possibly shorter) lease time, we
3851          * can safely set the next grace time to the current lease time:
3852          */
3853         nn->nfsd4_grace = nn->nfsd4_lease;
3854 }
3855
3856 static time_t
3857 nfs4_laundromat(struct nfsd_net *nn)
3858 {
3859         struct nfs4_client *clp;
3860         struct nfs4_openowner *oo;
3861         struct nfs4_delegation *dp;
3862         struct list_head *pos, *next, reaplist;
3863         time_t cutoff = get_seconds() - nn->nfsd4_lease;
3864         time_t t, new_timeo = nn->nfsd4_lease;
3865
3866         nfs4_lock_state();
3867
3868         dprintk("NFSD: laundromat service - starting\n");
3869         nfsd4_end_grace(nn);
3870         INIT_LIST_HEAD(&reaplist);
3871         spin_lock(&nn->client_lock);
3872         list_for_each_safe(pos, next, &nn->client_lru) {
3873                 clp = list_entry(pos, struct nfs4_client, cl_lru);
3874                 if (time_after((unsigned long)clp->cl_time, (unsigned long)cutoff)) {
3875                         t = clp->cl_time - cutoff;
3876                         new_timeo = min(new_timeo, t);
3877                         break;
3878                 }
3879                 if (mark_client_expired_locked(clp)) {
3880                         dprintk("NFSD: client in use (clientid %08x)\n",
3881                                 clp->cl_clientid.cl_id);
3882                         continue;
3883                 }
3884                 list_move(&clp->cl_lru, &reaplist);
3885         }
3886         spin_unlock(&nn->client_lock);
3887         list_for_each_safe(pos, next, &reaplist) {
3888                 clp = list_entry(pos, struct nfs4_client, cl_lru);
3889                 dprintk("NFSD: purging unused client (clientid %08x)\n",
3890                         clp->cl_clientid.cl_id);
3891                 expire_client(clp);
3892         }
3893         spin_lock(&state_lock);
3894         list_for_each_safe(pos, next, &nn->del_recall_lru) {
3895                 dp = list_entry (pos, struct nfs4_delegation, dl_recall_lru);
3896                 if (net_generic(dp->dl_stid.sc_client->net, nfsd_net_id) != nn)
3897                         continue;
3898                 if (time_after((unsigned long)dp->dl_time, (unsigned long)cutoff)) {
3899                         t = dp->dl_time - cutoff;
3900                         new_timeo = min(new_timeo, t);
3901                         break;
3902                 }
3903                 list_move(&dp->dl_recall_lru, &reaplist);
3904         }
3905         spin_unlock(&state_lock);
3906         list_for_each_safe(pos, next, &reaplist) {
3907                 dp = list_entry (pos, struct nfs4_delegation, dl_recall_lru);
3908                 revoke_delegation(dp);
3909         }
3910         list_for_each_safe(pos, next, &nn->close_lru) {
3911                 oo = container_of(pos, struct nfs4_openowner, oo_close_lru);
3912                 if (time_after((unsigned long)oo->oo_time, (unsigned long)cutoff)) {
3913                         t = oo->oo_time - cutoff;
3914                         new_timeo = min(new_timeo, t);
3915                         break;
3916                 }
3917                 release_openowner(oo);
3918         }
3919         new_timeo = max_t(time_t, new_timeo, NFSD_LAUNDROMAT_MINTIMEOUT);
3920         nfs4_unlock_state();
3921         return new_timeo;
3922 }
3923
3924 static struct workqueue_struct *laundry_wq;
3925 static void laundromat_main(struct work_struct *);
3926
3927 static void
3928 laundromat_main(struct work_struct *laundry)
3929 {
3930         time_t t;
3931         struct delayed_work *dwork = container_of(laundry, struct delayed_work,
3932                                                   work);
3933         struct nfsd_net *nn = container_of(dwork, struct nfsd_net,
3934                                            laundromat_work);
3935
3936         t = nfs4_laundromat(nn);
3937         dprintk("NFSD: laundromat_main - sleeping for %ld seconds\n", t);
3938         queue_delayed_work(laundry_wq, &nn->laundromat_work, t*HZ);
3939 }
3940
3941 static inline __be32 nfs4_check_fh(struct svc_fh *fhp, struct nfs4_ol_stateid *stp)
3942 {
3943         if (fhp->fh_dentry->d_inode != stp->st_file->fi_inode)
3944                 return nfserr_bad_stateid;
3945         return nfs_ok;
3946 }
3947
3948 static inline int
3949 access_permit_read(struct nfs4_ol_stateid *stp)
3950 {
3951         return test_access(NFS4_SHARE_ACCESS_READ, stp) ||
3952                 test_access(NFS4_SHARE_ACCESS_BOTH, stp) ||
3953                 test_access(NFS4_SHARE_ACCESS_WRITE, stp);
3954 }
3955
3956 static inline int
3957 access_permit_write(struct nfs4_ol_stateid *stp)
3958 {
3959         return test_access(NFS4_SHARE_ACCESS_WRITE, stp) ||
3960                 test_access(NFS4_SHARE_ACCESS_BOTH, stp);
3961 }
3962
3963 static
3964 __be32 nfs4_check_openmode(struct nfs4_ol_stateid *stp, int flags)
3965 {
3966         __be32 status = nfserr_openmode;
3967
3968         /* For lock stateid's, we test the parent open, not the lock: */
3969         if (stp->st_openstp)
3970                 stp = stp->st_openstp;
3971         if ((flags & WR_STATE) && !access_permit_write(stp))
3972                 goto out;
3973         if ((flags & RD_STATE) && !access_permit_read(stp))
3974                 goto out;
3975         status = nfs_ok;
3976 out:
3977         return status;
3978 }
3979
3980 static inline __be32
3981 check_special_stateids(struct net *net, svc_fh *current_fh, stateid_t *stateid, int flags)
3982 {
3983         if (ONE_STATEID(stateid) && (flags & RD_STATE))
3984                 return nfs_ok;
3985         else if (locks_in_grace(net)) {
3986                 /* Answer in remaining cases depends on existence of
3987                  * conflicting state; so we must wait out the grace period. */
3988                 return nfserr_grace;
3989         } else if (flags & WR_STATE)
3990                 return nfs4_share_conflict(current_fh,
3991                                 NFS4_SHARE_DENY_WRITE);
3992         else /* (flags & RD_STATE) && ZERO_STATEID(stateid) */
3993                 return nfs4_share_conflict(current_fh,
3994                                 NFS4_SHARE_DENY_READ);
3995 }
3996
3997 /*
3998  * Allow READ/WRITE during grace period on recovered state only for files
3999  * that are not able to provide mandatory locking.
4000  */
4001 static inline int
4002 grace_disallows_io(struct net *net, struct inode *inode)
4003 {
4004         return locks_in_grace(net) && mandatory_lock(inode);
4005 }
4006
4007 /* Returns true iff a is later than b: */
4008 static bool stateid_generation_after(stateid_t *a, stateid_t *b)
4009 {
4010         return (s32)(a->si_generation - b->si_generation) > 0;
4011 }
4012
4013 static __be32 check_stateid_generation(stateid_t *in, stateid_t *ref, bool has_session)
4014 {
4015         /*
4016          * When sessions are used the stateid generation number is ignored
4017          * when it is zero.
4018          */
4019         if (has_session && in->si_generation == 0)
4020                 return nfs_ok;
4021
4022         if (in->si_generation == ref->si_generation)
4023                 return nfs_ok;
4024
4025         /* If the client sends us a stateid from the future, it's buggy: */
4026         if (stateid_generation_after(in, ref))
4027                 return nfserr_bad_stateid;
4028         /*
4029          * However, we could see a stateid from the past, even from a
4030          * non-buggy client.  For example, if the client sends a lock
4031          * while some IO is outstanding, the lock may bump si_generation
4032          * while the IO is still in flight.  The client could avoid that
4033          * situation by waiting for responses on all the IO requests,
4034          * but better performance may result in retrying IO that
4035          * receives an old_stateid error if requests are rarely
4036          * reordered in flight:
4037          */
4038         return nfserr_old_stateid;
4039 }
4040
4041 static __be32 nfsd4_validate_stateid(struct nfs4_client *cl, stateid_t *stateid)
4042 {
4043         struct nfs4_stid *s;
4044         struct nfs4_ol_stateid *ols;
4045         __be32 status;
4046
4047         if (ZERO_STATEID(stateid) || ONE_STATEID(stateid))
4048                 return nfserr_bad_stateid;
4049         /* Client debugging aid. */
4050         if (!same_clid(&stateid->si_opaque.so_clid, &cl->cl_clientid)) {
4051                 char addr_str[INET6_ADDRSTRLEN];
4052                 rpc_ntop((struct sockaddr *)&cl->cl_addr, addr_str,
4053                                  sizeof(addr_str));
4054                 pr_warn_ratelimited("NFSD: client %s testing state ID "
4055                                         "with incorrect client ID\n", addr_str);
4056                 return nfserr_bad_stateid;
4057         }
4058         s = find_stateid(cl, stateid);
4059         if (!s)
4060                 return nfserr_bad_stateid;
4061         status = check_stateid_generation(stateid, &s->sc_stateid, 1);
4062         if (status)
4063                 return status;
4064         switch (s->sc_type) {
4065         case NFS4_DELEG_STID:
4066                 return nfs_ok;
4067         case NFS4_REVOKED_DELEG_STID:
4068                 return nfserr_deleg_revoked;
4069         case NFS4_OPEN_STID:
4070         case NFS4_LOCK_STID:
4071                 ols = openlockstateid(s);
4072                 if (ols->st_stateowner->so_is_open_owner
4073                                 && !(openowner(ols->st_stateowner)->oo_flags
4074                                                 & NFS4_OO_CONFIRMED))
4075                         return nfserr_bad_stateid;
4076                 return nfs_ok;
4077         default:
4078                 printk("unknown stateid type %x\n", s->sc_type);
4079                 /* Fallthrough */
4080         case NFS4_CLOSED_STID:
4081         case NFS4_CLOSED_DELEG_STID:
4082                 return nfserr_bad_stateid;
4083         }
4084 }
4085
4086 static __be32
4087 nfsd4_lookup_stateid(struct nfsd4_compound_state *cstate,
4088                      stateid_t *stateid, unsigned char typemask,
4089                      struct nfs4_stid **s, struct nfsd_net *nn)
4090 {
4091         __be32 status;
4092
4093         if (ZERO_STATEID(stateid) || ONE_STATEID(stateid))
4094                 return nfserr_bad_stateid;
4095         status = lookup_clientid(&stateid->si_opaque.so_clid, cstate, nn);
4096         if (status == nfserr_stale_clientid) {
4097                 if (cstate->session)
4098                         return nfserr_bad_stateid;
4099                 return nfserr_stale_stateid;
4100         }
4101         if (status)
4102                 return status;
4103         *s = find_stateid_by_type(cstate->clp, stateid, typemask);
4104         if (!*s)
4105                 return nfserr_bad_stateid;
4106         return nfs_ok;
4107 }
4108
4109 /*
4110 * Checks for stateid operations
4111 */
4112 __be32
4113 nfs4_preprocess_stateid_op(struct net *net, struct nfsd4_compound_state *cstate,
4114                            stateid_t *stateid, int flags, struct file **filpp)
4115 {
4116         struct nfs4_stid *s;
4117         struct nfs4_ol_stateid *stp = NULL;
4118         struct nfs4_delegation *dp = NULL;
4119         struct svc_fh *current_fh = &cstate->current_fh;
4120         struct inode *ino = current_fh->fh_dentry->d_inode;
4121         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
4122         struct file *file = NULL;
4123         __be32 status;
4124
4125         if (filpp)
4126                 *filpp = NULL;
4127
4128         if (grace_disallows_io(net, ino))
4129                 return nfserr_grace;
4130
4131         if (ZERO_STATEID(stateid) || ONE_STATEID(stateid))
4132                 return check_special_stateids(net, current_fh, stateid, flags);
4133
4134         nfs4_lock_state();
4135
4136         status = nfsd4_lookup_stateid(cstate, stateid,
4137                                 NFS4_DELEG_STID|NFS4_OPEN_STID|NFS4_LOCK_STID,
4138                                 &s, nn);
4139         if (status)
4140                 goto out;
4141         status = check_stateid_generation(stateid, &s->sc_stateid, nfsd4_has_session(cstate));
4142         if (status)
4143                 goto out;
4144         switch (s->sc_type) {
4145         case NFS4_DELEG_STID:
4146                 dp = delegstateid(s);
4147                 status = nfs4_check_delegmode(dp, flags);
4148                 if (status)
4149                         goto out;
4150                 if (filpp) {
4151                         file = dp->dl_file->fi_deleg_file;
4152                         if (!file) {
4153                                 WARN_ON_ONCE(1);
4154                                 status = nfserr_serverfault;
4155                                 goto out;
4156                         }
4157                         get_file(file);
4158                 }
4159                 break;
4160         case NFS4_OPEN_STID:
4161         case NFS4_LOCK_STID:
4162                 stp = openlockstateid(s);
4163                 status = nfs4_check_fh(current_fh, stp);
4164                 if (status)
4165                         goto out;
4166                 if (stp->st_stateowner->so_is_open_owner
4167                     && !(openowner(stp->st_stateowner)->oo_flags & NFS4_OO_CONFIRMED))
4168                         goto out;
4169                 status = nfs4_check_openmode(stp, flags);
4170                 if (status)
4171                         goto out;
4172                 if (filpp) {
4173                         if (flags & RD_STATE)
4174                                 file = find_readable_file(stp->st_file);
4175                         else
4176                                 file = find_writeable_file(stp->st_file);
4177                 }
4178                 break;
4179         default:
4180                 status = nfserr_bad_stateid;
4181                 goto out;
4182         }
4183         status = nfs_ok;
4184         if (file)
4185                 *filpp = file;
4186 out:
4187         nfs4_unlock_state();
4188         return status;
4189 }
4190
4191 static __be32
4192 nfsd4_free_lock_stateid(struct nfs4_ol_stateid *stp)
4193 {
4194         struct nfs4_lockowner *lo = lockowner(stp->st_stateowner);
4195
4196         if (check_for_locks(stp->st_file, lo))
4197                 return nfserr_locks_held;
4198         release_lockowner_if_empty(lo);
4199         return nfs_ok;
4200 }
4201
4202 /*
4203  * Test if the stateid is valid
4204  */
4205 __be32
4206 nfsd4_test_stateid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
4207                    struct nfsd4_test_stateid *test_stateid)
4208 {
4209         struct nfsd4_test_stateid_id *stateid;
4210         struct nfs4_client *cl = cstate->session->se_client;
4211
4212         nfs4_lock_state();
4213         list_for_each_entry(stateid, &test_stateid->ts_stateid_list, ts_id_list)
4214                 stateid->ts_id_status =
4215                         nfsd4_validate_stateid(cl, &stateid->ts_id_stateid);
4216         nfs4_unlock_state();
4217
4218         return nfs_ok;
4219 }
4220
4221 __be32
4222 nfsd4_free_stateid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
4223                    struct nfsd4_free_stateid *free_stateid)
4224 {
4225         stateid_t *stateid = &free_stateid->fr_stateid;
4226         struct nfs4_stid *s;
4227         struct nfs4_delegation *dp;
4228         struct nfs4_client *cl = cstate->session->se_client;
4229         __be32 ret = nfserr_bad_stateid;
4230
4231         nfs4_lock_state();
4232         s = find_stateid(cl, stateid);
4233         if (!s)
4234                 goto out;
4235         switch (s->sc_type) {
4236         case NFS4_DELEG_STID:
4237                 ret = nfserr_locks_held;
4238                 goto out;
4239         case NFS4_OPEN_STID:
4240         case NFS4_LOCK_STID:
4241                 ret = check_stateid_generation(stateid, &s->sc_stateid, 1);
4242                 if (ret)
4243                         goto out;
4244                 if (s->sc_type == NFS4_LOCK_STID)
4245                         ret = nfsd4_free_lock_stateid(openlockstateid(s));
4246                 else
4247                         ret = nfserr_locks_held;
4248                 break;
4249         case NFS4_REVOKED_DELEG_STID:
4250                 dp = delegstateid(s);
4251                 destroy_revoked_delegation(dp);
4252                 ret = nfs_ok;
4253                 break;
4254         default:
4255                 ret = nfserr_bad_stateid;
4256         }
4257 out:
4258         nfs4_unlock_state();
4259         return ret;
4260 }
4261
4262 static inline int
4263 setlkflg (int type)
4264 {
4265         return (type == NFS4_READW_LT || type == NFS4_READ_LT) ?
4266                 RD_STATE : WR_STATE;
4267 }
4268
4269 static __be32 nfs4_seqid_op_checks(struct nfsd4_compound_state *cstate, stateid_t *stateid, u32 seqid, struct nfs4_ol_stateid *stp)
4270 {
4271         struct svc_fh *current_fh = &cstate->current_fh;
4272         struct nfs4_stateowner *sop = stp->st_stateowner;
4273         __be32 status;
4274
4275         status = nfsd4_check_seqid(cstate, sop, seqid);
4276         if (status)
4277                 return status;
4278         if (stp->st_stid.sc_type == NFS4_CLOSED_STID
4279                 || stp->st_stid.sc_type == NFS4_REVOKED_DELEG_STID)
4280                 /*
4281                  * "Closed" stateid's exist *only* to return
4282                  * nfserr_replay_me from the previous step, and
4283                  * revoked delegations are kept only for free_stateid.
4284                  */
4285                 return nfserr_bad_stateid;
4286         status = check_stateid_generation(stateid, &stp->st_stid.sc_stateid, nfsd4_has_session(cstate));
4287         if (status)
4288                 return status;
4289         return nfs4_check_fh(current_fh, stp);
4290 }
4291
4292 /*
4293  * Checks for sequence id mutating operations.
4294  */
4295 static __be32
4296 nfs4_preprocess_seqid_op(struct nfsd4_compound_state *cstate, u32 seqid,
4297                          stateid_t *stateid, char typemask,
4298                          struct nfs4_ol_stateid **stpp,
4299                          struct nfsd_net *nn)
4300 {
4301         __be32 status;
4302         struct nfs4_stid *s;
4303         struct nfs4_ol_stateid *stp = NULL;
4304
4305         dprintk("NFSD: %s: seqid=%d stateid = " STATEID_FMT "\n", __func__,
4306                 seqid, STATEID_VAL(stateid));
4307
4308         *stpp = NULL;
4309         status = nfsd4_lookup_stateid(cstate, stateid, typemask, &s, nn);
4310         if (status)
4311                 return status;
4312         stp = openlockstateid(s);
4313         if (!nfsd4_has_session(cstate))
4314                 cstate->replay_owner = stp->st_stateowner;
4315
4316         status = nfs4_seqid_op_checks(cstate, stateid, seqid, stp);
4317         if (!status)
4318                 *stpp = stp;
4319         return status;
4320 }
4321
4322 static __be32 nfs4_preprocess_confirmed_seqid_op(struct nfsd4_compound_state *cstate, u32 seqid,
4323                                                  stateid_t *stateid, struct nfs4_ol_stateid **stpp, struct nfsd_net *nn)
4324 {
4325         __be32 status;
4326         struct nfs4_openowner *oo;
4327
4328         status = nfs4_preprocess_seqid_op(cstate, seqid, stateid,
4329                                                 NFS4_OPEN_STID, stpp, nn);
4330         if (status)
4331                 return status;
4332         oo = openowner((*stpp)->st_stateowner);
4333         if (!(oo->oo_flags & NFS4_OO_CONFIRMED))
4334                 return nfserr_bad_stateid;
4335         return nfs_ok;
4336 }
4337
4338 __be32
4339 nfsd4_open_confirm(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
4340                    struct nfsd4_open_confirm *oc)
4341 {
4342         __be32 status;
4343         struct nfs4_openowner *oo;
4344         struct nfs4_ol_stateid *stp;
4345         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
4346
4347         dprintk("NFSD: nfsd4_open_confirm on file %pd\n",
4348                         cstate->current_fh.fh_dentry);
4349
4350         status = fh_verify(rqstp, &cstate->current_fh, S_IFREG, 0);
4351         if (status)
4352                 return status;
4353
4354         nfs4_lock_state();
4355
4356         status = nfs4_preprocess_seqid_op(cstate,
4357                                         oc->oc_seqid, &oc->oc_req_stateid,
4358                                         NFS4_OPEN_STID, &stp, nn);
4359         if (status)
4360                 goto out;
4361         oo = openowner(stp->st_stateowner);
4362         status = nfserr_bad_stateid;
4363         if (oo->oo_flags & NFS4_OO_CONFIRMED)
4364                 goto out;
4365         oo->oo_flags |= NFS4_OO_CONFIRMED;
4366         update_stateid(&stp->st_stid.sc_stateid);
4367         memcpy(&oc->oc_resp_stateid, &stp->st_stid.sc_stateid, sizeof(stateid_t));
4368         dprintk("NFSD: %s: success, seqid=%d stateid=" STATEID_FMT "\n",
4369                 __func__, oc->oc_seqid, STATEID_VAL(&stp->st_stid.sc_stateid));
4370
4371         nfsd4_client_record_create(oo->oo_owner.so_client);
4372         status = nfs_ok;
4373 out:
4374         nfsd4_bump_seqid(cstate, status);
4375         if (!cstate->replay_owner)
4376                 nfs4_unlock_state();
4377         return status;
4378 }
4379
4380 static inline void nfs4_stateid_downgrade_bit(struct nfs4_ol_stateid *stp, u32 access)
4381 {
4382         if (!test_access(access, stp))
4383                 return;
4384         nfs4_file_put_access(stp->st_file, access);
4385         clear_access(access, stp);
4386 }
4387
4388 static inline void nfs4_stateid_downgrade(struct nfs4_ol_stateid *stp, u32 to_access)
4389 {
4390         switch (to_access) {
4391         case NFS4_SHARE_ACCESS_READ:
4392                 nfs4_stateid_downgrade_bit(stp, NFS4_SHARE_ACCESS_WRITE);
4393                 nfs4_stateid_downgrade_bit(stp, NFS4_SHARE_ACCESS_BOTH);
4394                 break;
4395         case NFS4_SHARE_ACCESS_WRITE:
4396                 nfs4_stateid_downgrade_bit(stp, NFS4_SHARE_ACCESS_READ);
4397                 nfs4_stateid_downgrade_bit(stp, NFS4_SHARE_ACCESS_BOTH);
4398                 break;
4399         case NFS4_SHARE_ACCESS_BOTH:
4400                 break;
4401         default:
4402                 WARN_ON_ONCE(1);
4403         }
4404 }
4405
4406 __be32
4407 nfsd4_open_downgrade(struct svc_rqst *rqstp,
4408                      struct nfsd4_compound_state *cstate,
4409                      struct nfsd4_open_downgrade *od)
4410 {
4411         __be32 status;
4412         struct nfs4_ol_stateid *stp;
4413         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
4414
4415         dprintk("NFSD: nfsd4_open_downgrade on file %pd\n",
4416                         cstate->current_fh.fh_dentry);
4417
4418         /* We don't yet support WANT bits: */
4419         if (od->od_deleg_want)
4420                 dprintk("NFSD: %s: od_deleg_want=0x%x ignored\n", __func__,
4421                         od->od_deleg_want);
4422
4423         nfs4_lock_state();
4424         status = nfs4_preprocess_confirmed_seqid_op(cstate, od->od_seqid,
4425                                         &od->od_stateid, &stp, nn);
4426         if (status)
4427                 goto out;
4428         status = nfserr_inval;
4429         if (!test_access(od->od_share_access, stp)) {
4430                 dprintk("NFSD: access not a subset of current bitmap: 0x%hhx, input access=%08x\n",
4431                         stp->st_access_bmap, od->od_share_access);
4432                 goto out;
4433         }
4434         if (!test_deny(od->od_share_deny, stp)) {
4435                 dprintk("NFSD: deny not a subset of current bitmap: 0x%hhx, input deny=%08x\n",
4436                         stp->st_deny_bmap, od->od_share_deny);
4437                 goto out;
4438         }
4439         nfs4_stateid_downgrade(stp, od->od_share_access);
4440
4441         reset_union_bmap_deny(od->od_share_deny, stp);
4442
4443         update_stateid(&stp->st_stid.sc_stateid);
4444         memcpy(&od->od_stateid, &stp->st_stid.sc_stateid, sizeof(stateid_t));
4445         status = nfs_ok;
4446 out:
4447         nfsd4_bump_seqid(cstate, status);
4448         if (!cstate->replay_owner)
4449                 nfs4_unlock_state();
4450         return status;
4451 }
4452
4453 static void nfsd4_close_open_stateid(struct nfs4_ol_stateid *s)
4454 {
4455         struct nfs4_client *clp = s->st_stid.sc_client;
4456         struct nfs4_openowner *oo = openowner(s->st_stateowner);
4457
4458         s->st_stid.sc_type = NFS4_CLOSED_STID;
4459         unhash_open_stateid(s);
4460
4461         if (clp->cl_minorversion) {
4462                 free_generic_stateid(s);
4463                 if (list_empty(&oo->oo_owner.so_stateids))
4464                         release_openowner(oo);
4465         } else {
4466                 oo->oo_last_closed_stid = s;
4467                 /*
4468                  * In the 4.0 case we need to keep the owners around a
4469                  * little while to handle CLOSE replay.
4470                  */
4471                 if (list_empty(&oo->oo_owner.so_stateids))
4472                         move_to_close_lru(oo, clp->net);
4473         }
4474 }
4475
4476 /*
4477  * nfs4_unlock_state() called after encode
4478  */
4479 __be32
4480 nfsd4_close(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
4481             struct nfsd4_close *close)
4482 {
4483         __be32 status;
4484         struct nfs4_ol_stateid *stp;
4485         struct net *net = SVC_NET(rqstp);
4486         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
4487
4488         dprintk("NFSD: nfsd4_close on file %pd\n",
4489                         cstate->current_fh.fh_dentry);
4490
4491         nfs4_lock_state();
4492         status = nfs4_preprocess_seqid_op(cstate, close->cl_seqid,
4493                                         &close->cl_stateid,
4494                                         NFS4_OPEN_STID|NFS4_CLOSED_STID,
4495                                         &stp, nn);
4496         nfsd4_bump_seqid(cstate, status);
4497         if (status)
4498                 goto out;
4499         update_stateid(&stp->st_stid.sc_stateid);
4500         memcpy(&close->cl_stateid, &stp->st_stid.sc_stateid, sizeof(stateid_t));
4501
4502         nfsd4_close_open_stateid(stp);
4503 out:
4504         if (!cstate->replay_owner)
4505                 nfs4_unlock_state();
4506         return status;
4507 }
4508
4509 __be32
4510 nfsd4_delegreturn(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
4511                   struct nfsd4_delegreturn *dr)
4512 {
4513         struct nfs4_delegation *dp;
4514         stateid_t *stateid = &dr->dr_stateid;
4515         struct nfs4_stid *s;
4516         __be32 status;
4517         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
4518
4519         if ((status = fh_verify(rqstp, &cstate->current_fh, S_IFREG, 0)))
4520                 return status;
4521
4522         nfs4_lock_state();
4523         status = nfsd4_lookup_stateid(cstate, stateid, NFS4_DELEG_STID, &s, nn);
4524         if (status)
4525                 goto out;
4526         dp = delegstateid(s);
4527         status = check_stateid_generation(stateid, &dp->dl_stid.sc_stateid, nfsd4_has_session(cstate));
4528         if (status)
4529                 goto out;
4530
4531         destroy_delegation(dp);
4532 out:
4533         nfs4_unlock_state();
4534
4535         return status;
4536 }
4537
4538
4539 #define LOFF_OVERFLOW(start, len)      ((u64)(len) > ~(u64)(start))
4540
4541 static inline u64
4542 end_offset(u64 start, u64 len)
4543 {
4544         u64 end;
4545
4546         end = start + len;
4547         return end >= start ? end: NFS4_MAX_UINT64;
4548 }
4549
4550 /* last octet in a range */
4551 static inline u64
4552 last_byte_offset(u64 start, u64 len)
4553 {
4554         u64 end;
4555
4556         WARN_ON_ONCE(!len);
4557         end = start + len;
4558         return end > start ? end - 1: NFS4_MAX_UINT64;
4559 }
4560
4561 /*
4562  * TODO: Linux file offsets are _signed_ 64-bit quantities, which means that
4563  * we can't properly handle lock requests that go beyond the (2^63 - 1)-th
4564  * byte, because of sign extension problems.  Since NFSv4 calls for 64-bit
4565  * locking, this prevents us from being completely protocol-compliant.  The
4566  * real solution to this problem is to start using unsigned file offsets in
4567  * the VFS, but this is a very deep change!
4568  */
4569 static inline void
4570 nfs4_transform_lock_offset(struct file_lock *lock)
4571 {
4572         if (lock->fl_start < 0)
4573                 lock->fl_start = OFFSET_MAX;
4574         if (lock->fl_end < 0)
4575                 lock->fl_end = OFFSET_MAX;
4576 }
4577
4578 /* Hack!: For now, we're defining this just so we can use a pointer to it
4579  * as a unique cookie to identify our (NFSv4's) posix locks. */
4580 static const struct lock_manager_operations nfsd_posix_mng_ops  = {
4581 };
4582
4583 static inline void
4584 nfs4_set_lock_denied(struct file_lock *fl, struct nfsd4_lock_denied *deny)
4585 {
4586         struct nfs4_lockowner *lo;
4587
4588         if (fl->fl_lmops == &nfsd_posix_mng_ops) {
4589                 lo = (struct nfs4_lockowner *) fl->fl_owner;
4590                 deny->ld_owner.data = kmemdup(lo->lo_owner.so_owner.data,
4591                                         lo->lo_owner.so_owner.len, GFP_KERNEL);
4592                 if (!deny->ld_owner.data)
4593                         /* We just don't care that much */
4594                         goto nevermind;
4595                 deny->ld_owner.len = lo->lo_owner.so_owner.len;
4596                 deny->ld_clientid = lo->lo_owner.so_client->cl_clientid;
4597         } else {
4598 nevermind:
4599                 deny->ld_owner.len = 0;
4600                 deny->ld_owner.data = NULL;
4601                 deny->ld_clientid.cl_boot = 0;
4602                 deny->ld_clientid.cl_id = 0;
4603         }
4604         deny->ld_start = fl->fl_start;
4605         deny->ld_length = NFS4_MAX_UINT64;
4606         if (fl->fl_end != NFS4_MAX_UINT64)
4607                 deny->ld_length = fl->fl_end - fl->fl_start + 1;
4608         deny->ld_type = NFS4_READ_LT;
4609         if (fl->fl_type != F_RDLCK)
4610                 deny->ld_type = NFS4_WRITE_LT;
4611 }
4612
4613 static struct nfs4_lockowner *
4614 find_lockowner_str(clientid_t *clid, struct xdr_netobj *owner,
4615                 struct nfsd_net *nn)
4616 {
4617         unsigned int strhashval = ownerstr_hashval(clid->cl_id, owner);
4618         struct nfs4_stateowner *so;
4619
4620         list_for_each_entry(so, &nn->ownerstr_hashtbl[strhashval], so_strhash) {
4621                 if (so->so_is_open_owner)
4622                         continue;
4623                 if (!same_owner_str(so, owner, clid))
4624                         continue;
4625                 return lockowner(so);
4626         }
4627         return NULL;
4628 }
4629
4630 /*
4631  * Alloc a lock owner structure.
4632  * Called in nfsd4_lock - therefore, OPEN and OPEN_CONFIRM (if needed) has
4633  * occurred.
4634  *
4635  * strhashval = ownerstr_hashval
4636  */
4637 static struct nfs4_lockowner *
4638 alloc_init_lock_stateowner(unsigned int strhashval, struct nfs4_client *clp, struct nfs4_ol_stateid *open_stp, struct nfsd4_lock *lock) {
4639         struct nfs4_lockowner *lo;
4640         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
4641
4642         lo = alloc_stateowner(lockowner_slab, &lock->lk_new_owner, clp);
4643         if (!lo)
4644                 return NULL;
4645         INIT_LIST_HEAD(&lo->lo_owner.so_stateids);
4646         lo->lo_owner.so_is_open_owner = 0;
4647         /* It is the openowner seqid that will be incremented in encode in the
4648          * case of new lockowners; so increment the lock seqid manually: */
4649         lo->lo_owner.so_seqid = lock->lk_new_lock_seqid + 1;
4650         list_add(&lo->lo_owner.so_strhash, &nn->ownerstr_hashtbl[strhashval]);
4651         return lo;
4652 }
4653
4654 static struct nfs4_ol_stateid *
4655 alloc_init_lock_stateid(struct nfs4_lockowner *lo, struct nfs4_file *fp, struct nfs4_ol_stateid *open_stp)
4656 {
4657         struct nfs4_ol_stateid *stp;
4658         struct nfs4_client *clp = lo->lo_owner.so_client;
4659
4660         stp = nfs4_alloc_stateid(clp);
4661         if (stp == NULL)
4662                 return NULL;
4663         stp->st_stid.sc_type = NFS4_LOCK_STID;
4664         list_add(&stp->st_perstateowner, &lo->lo_owner.so_stateids);
4665         stp->st_stateowner = &lo->lo_owner;
4666         get_nfs4_file(fp);
4667         stp->st_file = fp;
4668         stp->st_access_bmap = 0;
4669         stp->st_deny_bmap = open_stp->st_deny_bmap;
4670         stp->st_openstp = open_stp;
4671         list_add(&stp->st_locks, &open_stp->st_locks);
4672         spin_lock(&fp->fi_lock);
4673         list_add(&stp->st_perfile, &fp->fi_stateids);
4674         spin_unlock(&fp->fi_lock);
4675         return stp;
4676 }
4677
4678 static struct nfs4_ol_stateid *
4679 find_lock_stateid(struct nfs4_lockowner *lo, struct nfs4_file *fp)
4680 {
4681         struct nfs4_ol_stateid *lst;
4682
4683         list_for_each_entry(lst, &lo->lo_owner.so_stateids, st_perstateowner) {
4684                 if (lst->st_file == fp)
4685                         return lst;
4686         }
4687         return NULL;
4688 }
4689
4690
4691 static int
4692 check_lock_length(u64 offset, u64 length)
4693 {
4694         return ((length == 0)  || ((length != NFS4_MAX_UINT64) &&
4695              LOFF_OVERFLOW(offset, length)));
4696 }
4697
4698 static void get_lock_access(struct nfs4_ol_stateid *lock_stp, u32 access)
4699 {
4700         struct nfs4_file *fp = lock_stp->st_file;
4701
4702         lockdep_assert_held(&fp->fi_lock);
4703
4704         if (test_access(access, lock_stp))
4705                 return;
4706         __nfs4_file_get_access(fp, access);
4707         set_access(access, lock_stp);
4708 }
4709
4710 static __be32 lookup_or_create_lock_state(struct nfsd4_compound_state *cstate, struct nfs4_ol_stateid *ost, struct nfsd4_lock *lock, struct nfs4_ol_stateid **lst, bool *new)
4711 {
4712         struct nfs4_file *fi = ost->st_file;
4713         struct nfs4_openowner *oo = openowner(ost->st_stateowner);
4714         struct nfs4_client *cl = oo->oo_owner.so_client;
4715         struct nfs4_lockowner *lo;
4716         unsigned int strhashval;
4717         struct nfsd_net *nn = net_generic(cl->net, nfsd_net_id);
4718
4719         lo = find_lockowner_str(&cl->cl_clientid, &lock->v.new.owner, nn);
4720         if (!lo) {
4721                 strhashval = ownerstr_hashval(cl->cl_clientid.cl_id,
4722                                 &lock->v.new.owner);
4723                 lo = alloc_init_lock_stateowner(strhashval, cl, ost, lock);
4724                 if (lo == NULL)
4725                         return nfserr_jukebox;
4726         } else {
4727                 /* with an existing lockowner, seqids must be the same */
4728                 if (!cstate->minorversion &&
4729                     lock->lk_new_lock_seqid != lo->lo_owner.so_seqid)
4730                         return nfserr_bad_seqid;
4731         }
4732
4733         *lst = find_lock_stateid(lo, fi);
4734         if (*lst == NULL) {
4735                 *lst = alloc_init_lock_stateid(lo, fi, ost);
4736                 if (*lst == NULL) {
4737                         release_lockowner_if_empty(lo);
4738                         return nfserr_jukebox;
4739                 }
4740                 *new = true;
4741         }
4742         return nfs_ok;
4743 }
4744
4745 /*
4746  *  LOCK operation
4747  */
4748 __be32
4749 nfsd4_lock(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
4750            struct nfsd4_lock *lock)
4751 {
4752         struct nfs4_openowner *open_sop = NULL;
4753         struct nfs4_lockowner *lock_sop = NULL;
4754         struct nfs4_ol_stateid *lock_stp;
4755         struct nfs4_file *fp;
4756         struct file *filp = NULL;
4757         struct file_lock *file_lock = NULL;
4758         struct file_lock *conflock = NULL;
4759         __be32 status = 0;
4760         bool new_state = false;
4761         int lkflg;
4762         int err;
4763         struct net *net = SVC_NET(rqstp);
4764         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
4765
4766         dprintk("NFSD: nfsd4_lock: start=%Ld length=%Ld\n",
4767                 (long long) lock->lk_offset,
4768                 (long long) lock->lk_length);
4769
4770         if (check_lock_length(lock->lk_offset, lock->lk_length))
4771                  return nfserr_inval;
4772
4773         if ((status = fh_verify(rqstp, &cstate->current_fh,
4774                                 S_IFREG, NFSD_MAY_LOCK))) {
4775                 dprintk("NFSD: nfsd4_lock: permission denied!\n");
4776                 return status;
4777         }
4778
4779         nfs4_lock_state();
4780
4781         if (lock->lk_is_new) {
4782                 struct nfs4_ol_stateid *open_stp = NULL;
4783
4784                 if (nfsd4_has_session(cstate))
4785                         /* See rfc 5661 18.10.3: given clientid is ignored: */
4786                         memcpy(&lock->v.new.clientid,
4787                                 &cstate->session->se_client->cl_clientid,
4788                                 sizeof(clientid_t));
4789
4790                 status = nfserr_stale_clientid;
4791                 if (STALE_CLIENTID(&lock->lk_new_clientid, nn))
4792                         goto out;
4793
4794                 /* validate and update open stateid and open seqid */
4795                 status = nfs4_preprocess_confirmed_seqid_op(cstate,
4796                                         lock->lk_new_open_seqid,
4797                                         &lock->lk_new_open_stateid,
4798                                         &open_stp, nn);
4799                 if (status)
4800                         goto out;
4801                 open_sop = openowner(open_stp->st_stateowner);
4802                 status = nfserr_bad_stateid;
4803                 if (!same_clid(&open_sop->oo_owner.so_client->cl_clientid,
4804                                                 &lock->v.new.clientid))
4805                         goto out;
4806                 status = lookup_or_create_lock_state(cstate, open_stp, lock,
4807                                                         &lock_stp, &new_state);
4808         } else
4809                 status = nfs4_preprocess_seqid_op(cstate,
4810                                        lock->lk_old_lock_seqid,
4811                                        &lock->lk_old_lock_stateid,
4812                                        NFS4_LOCK_STID, &lock_stp, nn);
4813         if (status)
4814                 goto out;
4815         lock_sop = lockowner(lock_stp->st_stateowner);
4816
4817         lkflg = setlkflg(lock->lk_type);
4818         status = nfs4_check_openmode(lock_stp, lkflg);
4819         if (status)
4820                 goto out;
4821
4822         status = nfserr_grace;
4823         if (locks_in_grace(net) && !lock->lk_reclaim)
4824                 goto out;
4825         status = nfserr_no_grace;
4826         if (!locks_in_grace(net) && lock->lk_reclaim)
4827                 goto out;
4828
4829         file_lock = locks_alloc_lock();
4830         if (!file_lock) {
4831                 dprintk("NFSD: %s: unable to allocate lock!\n", __func__);
4832                 status = nfserr_jukebox;
4833                 goto out;
4834         }
4835
4836         fp = lock_stp->st_file;
4837         locks_init_lock(file_lock);
4838         switch (lock->lk_type) {
4839                 case NFS4_READ_LT:
4840                 case NFS4_READW_LT:
4841                         spin_lock(&fp->fi_lock);
4842                         filp = find_readable_file_locked(fp);
4843                         if (filp)
4844                                 get_lock_access(lock_stp, NFS4_SHARE_ACCESS_READ);
4845                         spin_unlock(&fp->fi_lock);
4846                         file_lock->fl_type = F_RDLCK;
4847                         break;
4848                 case NFS4_WRITE_LT:
4849                 case NFS4_WRITEW_LT:
4850                         spin_lock(&fp->fi_lock);
4851                         filp = find_writeable_file_locked(fp);
4852                         if (filp)
4853                                 get_lock_access(lock_stp, NFS4_SHARE_ACCESS_WRITE);
4854                         spin_unlock(&fp->fi_lock);
4855                         file_lock->fl_type = F_WRLCK;
4856                         break;
4857                 default:
4858                         status = nfserr_inval;
4859                 goto out;
4860         }
4861         if (!filp) {
4862                 status = nfserr_openmode;
4863                 goto out;
4864         }
4865         file_lock->fl_owner = (fl_owner_t)lock_sop;
4866         file_lock->fl_pid = current->tgid;
4867         file_lock->fl_file = filp;
4868         file_lock->fl_flags = FL_POSIX;
4869         file_lock->fl_lmops = &nfsd_posix_mng_ops;
4870         file_lock->fl_start = lock->lk_offset;
4871         file_lock->fl_end = last_byte_offset(lock->lk_offset, lock->lk_length);
4872         nfs4_transform_lock_offset(file_lock);
4873
4874         conflock = locks_alloc_lock();
4875         if (!conflock) {
4876                 dprintk("NFSD: %s: unable to allocate lock!\n", __func__);
4877                 status = nfserr_jukebox;
4878                 goto out;
4879         }
4880
4881         err = vfs_lock_file(filp, F_SETLK, file_lock, conflock);
4882         switch (-err) {
4883         case 0: /* success! */
4884                 update_stateid(&lock_stp->st_stid.sc_stateid);
4885                 memcpy(&lock->lk_resp_stateid, &lock_stp->st_stid.sc_stateid,
4886                                 sizeof(stateid_t));
4887                 status = 0;
4888                 break;
4889         case (EAGAIN):          /* conflock holds conflicting lock */
4890                 status = nfserr_denied;
4891                 dprintk("NFSD: nfsd4_lock: conflicting lock found!\n");
4892                 nfs4_set_lock_denied(conflock, &lock->lk_denied);
4893                 break;
4894         case (EDEADLK):
4895                 status = nfserr_deadlock;
4896                 break;
4897         default:
4898                 dprintk("NFSD: nfsd4_lock: vfs_lock_file() failed! status %d\n",err);
4899                 status = nfserrno(err);
4900                 break;
4901         }
4902 out:
4903         if (filp)
4904                 fput(filp);
4905         if (status && new_state)
4906                 release_lock_stateid(lock_stp);
4907         nfsd4_bump_seqid(cstate, status);
4908         if (!cstate->replay_owner)
4909                 nfs4_unlock_state();
4910         if (file_lock)
4911                 locks_free_lock(file_lock);
4912         if (conflock)
4913                 locks_free_lock(conflock);
4914         return status;
4915 }
4916
4917 /*
4918  * The NFSv4 spec allows a client to do a LOCKT without holding an OPEN,
4919  * so we do a temporary open here just to get an open file to pass to
4920  * vfs_test_lock.  (Arguably perhaps test_lock should be done with an
4921  * inode operation.)
4922  */
4923 static __be32 nfsd_test_lock(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file_lock *lock)
4924 {
4925         struct file *file;
4926         __be32 err = nfsd_open(rqstp, fhp, S_IFREG, NFSD_MAY_READ, &file);
4927         if (!err) {
4928                 err = nfserrno(vfs_test_lock(file, lock));
4929                 nfsd_close(file);
4930         }
4931         return err;
4932 }
4933
4934 /*
4935  * LOCKT operation
4936  */
4937 __be32
4938 nfsd4_lockt(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
4939             struct nfsd4_lockt *lockt)
4940 {
4941         struct file_lock *file_lock = NULL;
4942         struct nfs4_lockowner *lo;
4943         __be32 status;
4944         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
4945
4946         if (locks_in_grace(SVC_NET(rqstp)))
4947                 return nfserr_grace;
4948
4949         if (check_lock_length(lockt->lt_offset, lockt->lt_length))
4950                  return nfserr_inval;
4951
4952         nfs4_lock_state();
4953
4954         if (!nfsd4_has_session(cstate)) {
4955                 status = lookup_clientid(&lockt->lt_clientid, cstate, nn);
4956                 if (status)
4957                         goto out;
4958         }
4959
4960         if ((status = fh_verify(rqstp, &cstate->current_fh, S_IFREG, 0)))
4961                 goto out;
4962
4963         file_lock = locks_alloc_lock();
4964         if (!file_lock) {
4965                 dprintk("NFSD: %s: unable to allocate lock!\n", __func__);
4966                 status = nfserr_jukebox;
4967                 goto out;
4968         }
4969         locks_init_lock(file_lock);
4970         switch (lockt->lt_type) {
4971                 case NFS4_READ_LT:
4972                 case NFS4_READW_LT:
4973                         file_lock->fl_type = F_RDLCK;
4974                 break;
4975                 case NFS4_WRITE_LT:
4976                 case NFS4_WRITEW_LT:
4977                         file_lock->fl_type = F_WRLCK;
4978                 break;
4979                 default:
4980                         dprintk("NFSD: nfs4_lockt: bad lock type!\n");
4981                         status = nfserr_inval;
4982                 goto out;
4983         }
4984
4985         lo = find_lockowner_str(&lockt->lt_clientid, &lockt->lt_owner, nn);
4986         if (lo)
4987                 file_lock->fl_owner = (fl_owner_t)lo;
4988         file_lock->fl_pid = current->tgid;
4989         file_lock->fl_flags = FL_POSIX;
4990
4991         file_lock->fl_start = lockt->lt_offset;
4992         file_lock->fl_end = last_byte_offset(lockt->lt_offset, lockt->lt_length);
4993
4994         nfs4_transform_lock_offset(file_lock);
4995
4996         status = nfsd_test_lock(rqstp, &cstate->current_fh, file_lock);
4997         if (status)
4998                 goto out;
4999
5000         if (file_lock->fl_type != F_UNLCK) {
5001                 status = nfserr_denied;
5002                 nfs4_set_lock_denied(file_lock, &lockt->lt_denied);
5003         }
5004 out:
5005         nfs4_unlock_state();
5006         if (file_lock)
5007                 locks_free_lock(file_lock);
5008         return status;
5009 }
5010
5011 __be32
5012 nfsd4_locku(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
5013             struct nfsd4_locku *locku)
5014 {
5015         struct nfs4_ol_stateid *stp;
5016         struct file *filp = NULL;
5017         struct file_lock *file_lock = NULL;
5018         __be32 status;
5019         int err;
5020         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
5021
5022         dprintk("NFSD: nfsd4_locku: start=%Ld length=%Ld\n",
5023                 (long long) locku->lu_offset,
5024                 (long long) locku->lu_length);
5025
5026         if (check_lock_length(locku->lu_offset, locku->lu_length))
5027                  return nfserr_inval;
5028
5029         nfs4_lock_state();
5030
5031         status = nfs4_preprocess_seqid_op(cstate, locku->lu_seqid,
5032                                         &locku->lu_stateid, NFS4_LOCK_STID,
5033                                         &stp, nn);
5034         if (status)
5035                 goto out;
5036         filp = find_any_file(stp->st_file);
5037         if (!filp) {
5038                 status = nfserr_lock_range;
5039                 goto out;
5040         }
5041         file_lock = locks_alloc_lock();
5042         if (!file_lock) {
5043                 dprintk("NFSD: %s: unable to allocate lock!\n", __func__);
5044                 status = nfserr_jukebox;
5045                 goto fput;
5046         }
5047         locks_init_lock(file_lock);
5048         file_lock->fl_type = F_UNLCK;
5049         file_lock->fl_owner = (fl_owner_t)lockowner(stp->st_stateowner);
5050         file_lock->fl_pid = current->tgid;
5051         file_lock->fl_file = filp;
5052         file_lock->fl_flags = FL_POSIX;
5053         file_lock->fl_lmops = &nfsd_posix_mng_ops;
5054         file_lock->fl_start = locku->lu_offset;
5055
5056         file_lock->fl_end = last_byte_offset(locku->lu_offset,
5057                                                 locku->lu_length);
5058         nfs4_transform_lock_offset(file_lock);
5059
5060         err = vfs_lock_file(filp, F_SETLK, file_lock, NULL);
5061         if (err) {
5062                 dprintk("NFSD: nfs4_locku: vfs_lock_file failed!\n");
5063                 goto out_nfserr;
5064         }
5065         update_stateid(&stp->st_stid.sc_stateid);
5066         memcpy(&locku->lu_stateid, &stp->st_stid.sc_stateid, sizeof(stateid_t));
5067 fput:
5068         fput(filp);
5069 out:
5070         nfsd4_bump_seqid(cstate, status);
5071         if (!cstate->replay_owner)
5072                 nfs4_unlock_state();
5073         if (file_lock)
5074                 locks_free_lock(file_lock);
5075         return status;
5076
5077 out_nfserr:
5078         status = nfserrno(err);
5079         goto fput;
5080 }
5081
5082 /*
5083  * returns
5084  *      1: locks held by lockowner
5085  *      0: no locks held by lockowner
5086  */
5087 static int
5088 check_for_locks(struct nfs4_file *filp, struct nfs4_lockowner *lowner)
5089 {
5090         struct file_lock **flpp;
5091         struct inode *inode = filp->fi_inode;
5092         int status = 0;
5093
5094         spin_lock(&inode->i_lock);
5095         for (flpp = &inode->i_flock; *flpp != NULL; flpp = &(*flpp)->fl_next) {
5096                 if ((*flpp)->fl_owner == (fl_owner_t)lowner) {
5097                         status = 1;
5098                         goto out;
5099                 }
5100         }
5101 out:
5102         spin_unlock(&inode->i_lock);
5103         return status;
5104 }
5105
5106 __be32
5107 nfsd4_release_lockowner(struct svc_rqst *rqstp,
5108                         struct nfsd4_compound_state *cstate,
5109                         struct nfsd4_release_lockowner *rlockowner)
5110 {
5111         clientid_t *clid = &rlockowner->rl_clientid;
5112         struct nfs4_stateowner *sop = NULL, *tmp;
5113         struct nfs4_lockowner *lo;
5114         struct nfs4_ol_stateid *stp;
5115         struct xdr_netobj *owner = &rlockowner->rl_owner;
5116         unsigned int hashval = ownerstr_hashval(clid->cl_id, owner);
5117         __be32 status;
5118         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
5119
5120         dprintk("nfsd4_release_lockowner clientid: (%08x/%08x):\n",
5121                 clid->cl_boot, clid->cl_id);
5122
5123         nfs4_lock_state();
5124
5125         status = lookup_clientid(clid, cstate, nn);
5126         if (status)
5127                 goto out;
5128
5129         status = nfserr_locks_held;
5130
5131         /* Find the matching lock stateowner */
5132         list_for_each_entry(tmp, &nn->ownerstr_hashtbl[hashval], so_strhash) {
5133                 if (tmp->so_is_open_owner)
5134                         continue;
5135                 if (same_owner_str(tmp, owner, clid)) {
5136                         sop = tmp;
5137                         break;
5138                 }
5139         }
5140
5141         /* No matching owner found, maybe a replay? Just declare victory... */
5142         if (!sop) {
5143                 status = nfs_ok;
5144                 goto out;
5145         }
5146
5147         lo = lockowner(sop);
5148         /* see if there are still any locks associated with it */
5149         list_for_each_entry(stp, &sop->so_stateids, st_perstateowner) {
5150                 if (check_for_locks(stp->st_file, lo))
5151                         goto out;
5152         }
5153
5154         status = nfs_ok;
5155         release_lockowner(lo);
5156 out:
5157         nfs4_unlock_state();
5158         return status;
5159 }
5160
5161 static inline struct nfs4_client_reclaim *
5162 alloc_reclaim(void)
5163 {
5164         return kmalloc(sizeof(struct nfs4_client_reclaim), GFP_KERNEL);
5165 }
5166
5167 bool
5168 nfs4_has_reclaimed_state(const char *name, struct nfsd_net *nn)
5169 {
5170         struct nfs4_client_reclaim *crp;
5171
5172         crp = nfsd4_find_reclaim_client(name, nn);
5173         return (crp && crp->cr_clp);
5174 }
5175
5176 /*
5177  * failure => all reset bets are off, nfserr_no_grace...
5178  */
5179 struct nfs4_client_reclaim *
5180 nfs4_client_to_reclaim(const char *name, struct nfsd_net *nn)
5181 {
5182         unsigned int strhashval;
5183         struct nfs4_client_reclaim *crp;
5184
5185         dprintk("NFSD nfs4_client_to_reclaim NAME: %.*s\n", HEXDIR_LEN, name);
5186         crp = alloc_reclaim();
5187         if (crp) {
5188                 strhashval = clientstr_hashval(name);
5189                 INIT_LIST_HEAD(&crp->cr_strhash);
5190                 list_add(&crp->cr_strhash, &nn->reclaim_str_hashtbl[strhashval]);
5191                 memcpy(crp->cr_recdir, name, HEXDIR_LEN);
5192                 crp->cr_clp = NULL;
5193                 nn->reclaim_str_hashtbl_size++;
5194         }
5195         return crp;
5196 }
5197
5198 void
5199 nfs4_remove_reclaim_record(struct nfs4_client_reclaim *crp, struct nfsd_net *nn)
5200 {
5201         list_del(&crp->cr_strhash);
5202         kfree(crp);
5203         nn->reclaim_str_hashtbl_size--;
5204 }
5205
5206 void
5207 nfs4_release_reclaim(struct nfsd_net *nn)
5208 {
5209         struct nfs4_client_reclaim *crp = NULL;
5210         int i;
5211
5212         for (i = 0; i < CLIENT_HASH_SIZE; i++) {
5213                 while (!list_empty(&nn->reclaim_str_hashtbl[i])) {
5214                         crp = list_entry(nn->reclaim_str_hashtbl[i].next,
5215                                         struct nfs4_client_reclaim, cr_strhash);
5216                         nfs4_remove_reclaim_record(crp, nn);
5217                 }
5218         }
5219         WARN_ON_ONCE(nn->reclaim_str_hashtbl_size);
5220 }
5221
5222 /*
5223  * called from OPEN, CLAIM_PREVIOUS with a new clientid. */
5224 struct nfs4_client_reclaim *
5225 nfsd4_find_reclaim_client(const char *recdir, struct nfsd_net *nn)
5226 {
5227         unsigned int strhashval;
5228         struct nfs4_client_reclaim *crp = NULL;
5229
5230         dprintk("NFSD: nfs4_find_reclaim_client for recdir %s\n", recdir);
5231
5232         strhashval = clientstr_hashval(recdir);
5233         list_for_each_entry(crp, &nn->reclaim_str_hashtbl[strhashval], cr_strhash) {
5234                 if (same_name(crp->cr_recdir, recdir)) {
5235                         return crp;
5236                 }
5237         }
5238         return NULL;
5239 }
5240
5241 /*
5242 * Called from OPEN. Look for clientid in reclaim list.
5243 */
5244 __be32
5245 nfs4_check_open_reclaim(clientid_t *clid,
5246                 struct nfsd4_compound_state *cstate,
5247                 struct nfsd_net *nn)
5248 {
5249         __be32 status;
5250
5251         /* find clientid in conf_id_hashtbl */
5252         status = lookup_clientid(clid, cstate, nn);
5253         if (status)
5254                 return nfserr_reclaim_bad;
5255
5256         if (nfsd4_client_record_check(cstate->clp))
5257                 return nfserr_reclaim_bad;
5258
5259         return nfs_ok;
5260 }
5261
5262 #ifdef CONFIG_NFSD_FAULT_INJECTION
5263
5264 u64 nfsd_forget_client(struct nfs4_client *clp, u64 max)
5265 {
5266         if (mark_client_expired(clp))
5267                 return 0;
5268         expire_client(clp);
5269         return 1;
5270 }
5271
5272 u64 nfsd_print_client(struct nfs4_client *clp, u64 num)
5273 {
5274         char buf[INET6_ADDRSTRLEN];
5275         rpc_ntop((struct sockaddr *)&clp->cl_addr, buf, sizeof(buf));
5276         printk(KERN_INFO "NFS Client: %s\n", buf);
5277         return 1;
5278 }
5279
5280 static void nfsd_print_count(struct nfs4_client *clp, unsigned int count,
5281                              const char *type)
5282 {
5283         char buf[INET6_ADDRSTRLEN];
5284         rpc_ntop((struct sockaddr *)&clp->cl_addr, buf, sizeof(buf));
5285         printk(KERN_INFO "NFS Client: %s has %u %s\n", buf, count, type);
5286 }
5287
5288 static u64 nfsd_foreach_client_lock(struct nfs4_client *clp, u64 max,
5289                                     void (*func)(struct nfs4_ol_stateid *))
5290 {
5291         struct nfs4_openowner *oop;
5292         struct nfs4_ol_stateid *stp, *st_next;
5293         struct nfs4_ol_stateid *lst, *lst_next;
5294         u64 count = 0;
5295
5296         list_for_each_entry(oop, &clp->cl_openowners, oo_perclient) {
5297                 list_for_each_entry_safe(stp, st_next,
5298                                 &oop->oo_owner.so_stateids, st_perstateowner) {
5299                         list_for_each_entry_safe(lst, lst_next,
5300                                         &stp->st_locks, st_locks) {
5301                                 if (func)
5302                                         func(lst);
5303                                 if (++count == max)
5304                                         return count;
5305                         }
5306                 }
5307         }
5308
5309         return count;
5310 }
5311
5312 u64 nfsd_forget_client_locks(struct nfs4_client *clp, u64 max)
5313 {
5314         return nfsd_foreach_client_lock(clp, max, release_lock_stateid);
5315 }
5316
5317 u64 nfsd_print_client_locks(struct nfs4_client *clp, u64 max)
5318 {
5319         u64 count = nfsd_foreach_client_lock(clp, max, NULL);
5320         nfsd_print_count(clp, count, "locked files");
5321         return count;
5322 }
5323
5324 static u64 nfsd_foreach_client_open(struct nfs4_client *clp, u64 max, void (*func)(struct nfs4_openowner *))
5325 {
5326         struct nfs4_openowner *oop, *next;
5327         u64 count = 0;
5328
5329         list_for_each_entry_safe(oop, next, &clp->cl_openowners, oo_perclient) {
5330                 if (func)
5331                         func(oop);
5332                 if (++count == max)
5333                         break;
5334         }
5335
5336         return count;
5337 }
5338
5339 u64 nfsd_forget_client_openowners(struct nfs4_client *clp, u64 max)
5340 {
5341         return nfsd_foreach_client_open(clp, max, release_openowner);
5342 }
5343
5344 u64 nfsd_print_client_openowners(struct nfs4_client *clp, u64 max)
5345 {
5346         u64 count = nfsd_foreach_client_open(clp, max, NULL);
5347         nfsd_print_count(clp, count, "open files");
5348         return count;
5349 }
5350
5351 static u64 nfsd_find_all_delegations(struct nfs4_client *clp, u64 max,
5352                                      struct list_head *victims)
5353 {
5354         struct nfs4_delegation *dp, *next;
5355         u64 count = 0;
5356
5357         lockdep_assert_held(&state_lock);
5358         list_for_each_entry_safe(dp, next, &clp->cl_delegations, dl_perclnt) {
5359                 if (victims) {
5360                         /*
5361                          * It's not safe to mess with delegations that have a
5362                          * non-zero dl_time. They might have already been broken
5363                          * and could be processed by the laundromat outside of
5364                          * the state_lock. Just leave them be.
5365                          */
5366                         if (dp->dl_time != 0)
5367                                 continue;
5368
5369                         /*
5370                          * Increment dl_time to ensure that delegation breaks
5371                          * don't monkey with it now that we are.
5372                          */
5373                         ++dp->dl_time;
5374                         list_move(&dp->dl_recall_lru, victims);
5375                 }
5376                 if (++count == max)
5377                         break;
5378         }
5379         return count;
5380 }
5381
5382 u64 nfsd_forget_client_delegations(struct nfs4_client *clp, u64 max)
5383 {
5384         struct nfs4_delegation *dp, *next;
5385         LIST_HEAD(victims);
5386         u64 count;
5387
5388         spin_lock(&state_lock);
5389         count = nfsd_find_all_delegations(clp, max, &victims);
5390         spin_unlock(&state_lock);
5391
5392         list_for_each_entry_safe(dp, next, &victims, dl_recall_lru)
5393                 revoke_delegation(dp);
5394
5395         return count;
5396 }
5397
5398 u64 nfsd_recall_client_delegations(struct nfs4_client *clp, u64 max)
5399 {
5400         struct nfs4_delegation *dp;
5401         LIST_HEAD(victims);
5402         u64 count;
5403
5404         spin_lock(&state_lock);
5405         count = nfsd_find_all_delegations(clp, max, &victims);
5406         while (!list_empty(&victims)) {
5407                 dp = list_first_entry(&victims, struct nfs4_delegation,
5408                                         dl_recall_lru);
5409                 list_del_init(&dp->dl_recall_lru);
5410                 dp->dl_time = 0;
5411                 nfsd_break_one_deleg(dp);
5412         }
5413         spin_unlock(&state_lock);
5414
5415         return count;
5416 }
5417
5418 u64 nfsd_print_client_delegations(struct nfs4_client *clp, u64 max)
5419 {
5420         u64 count = 0;
5421
5422         spin_lock(&state_lock);
5423         count = nfsd_find_all_delegations(clp, max, NULL);
5424         spin_unlock(&state_lock);
5425
5426         nfsd_print_count(clp, count, "delegations");
5427         return count;
5428 }
5429
5430 u64 nfsd_for_n_state(u64 max, u64 (*func)(struct nfs4_client *, u64))
5431 {
5432         struct nfs4_client *clp, *next;
5433         u64 count = 0;
5434         struct nfsd_net *nn = net_generic(current->nsproxy->net_ns, nfsd_net_id);
5435
5436         if (!nfsd_netns_ready(nn))
5437                 return 0;
5438
5439         list_for_each_entry_safe(clp, next, &nn->client_lru, cl_lru) {
5440                 count += func(clp, max - count);
5441                 if ((max != 0) && (count >= max))
5442                         break;
5443         }
5444
5445         return count;
5446 }
5447
5448 struct nfs4_client *nfsd_find_client(struct sockaddr_storage *addr, size_t addr_size)
5449 {
5450         struct nfs4_client *clp;
5451         struct nfsd_net *nn = net_generic(current->nsproxy->net_ns, nfsd_net_id);
5452
5453         if (!nfsd_netns_ready(nn))
5454                 return NULL;
5455
5456         list_for_each_entry(clp, &nn->client_lru, cl_lru) {
5457                 if (memcmp(&clp->cl_addr, addr, addr_size) == 0)
5458                         return clp;
5459         }
5460         return NULL;
5461 }
5462
5463 #endif /* CONFIG_NFSD_FAULT_INJECTION */
5464
5465 /*
5466  * Since the lifetime of a delegation isn't limited to that of an open, a
5467  * client may quite reasonably hang on to a delegation as long as it has
5468  * the inode cached.  This becomes an obvious problem the first time a
5469  * client's inode cache approaches the size of the server's total memory.
5470  *
5471  * For now we avoid this problem by imposing a hard limit on the number
5472  * of delegations, which varies according to the server's memory size.
5473  */
5474 static void
5475 set_max_delegations(void)
5476 {
5477         /*
5478          * Allow at most 4 delegations per megabyte of RAM.  Quick
5479          * estimates suggest that in the worst case (where every delegation
5480          * is for a different inode), a delegation could take about 1.5K,
5481          * giving a worst case usage of about 6% of memory.
5482          */
5483         max_delegations = nr_free_buffer_pages() >> (20 - 2 - PAGE_SHIFT);
5484 }
5485
5486 static int nfs4_state_create_net(struct net *net)
5487 {
5488         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
5489         int i;
5490
5491         nn->conf_id_hashtbl = kmalloc(sizeof(struct list_head) *
5492                         CLIENT_HASH_SIZE, GFP_KERNEL);
5493         if (!nn->conf_id_hashtbl)
5494                 goto err;
5495         nn->unconf_id_hashtbl = kmalloc(sizeof(struct list_head) *
5496                         CLIENT_HASH_SIZE, GFP_KERNEL);
5497         if (!nn->unconf_id_hashtbl)
5498                 goto err_unconf_id;
5499         nn->ownerstr_hashtbl = kmalloc(sizeof(struct list_head) *
5500                         OWNER_HASH_SIZE, GFP_KERNEL);
5501         if (!nn->ownerstr_hashtbl)
5502                 goto err_ownerstr;
5503         nn->sessionid_hashtbl = kmalloc(sizeof(struct list_head) *
5504                         SESSION_HASH_SIZE, GFP_KERNEL);
5505         if (!nn->sessionid_hashtbl)
5506                 goto err_sessionid;
5507
5508         for (i = 0; i < CLIENT_HASH_SIZE; i++) {
5509                 INIT_LIST_HEAD(&nn->conf_id_hashtbl[i]);
5510                 INIT_LIST_HEAD(&nn->unconf_id_hashtbl[i]);
5511         }
5512         for (i = 0; i < OWNER_HASH_SIZE; i++)
5513                 INIT_LIST_HEAD(&nn->ownerstr_hashtbl[i]);
5514         for (i = 0; i < SESSION_HASH_SIZE; i++)
5515                 INIT_LIST_HEAD(&nn->sessionid_hashtbl[i]);
5516         nn->conf_name_tree = RB_ROOT;
5517         nn->unconf_name_tree = RB_ROOT;
5518         INIT_LIST_HEAD(&nn->client_lru);
5519         INIT_LIST_HEAD(&nn->close_lru);
5520         INIT_LIST_HEAD(&nn->del_recall_lru);
5521         spin_lock_init(&nn->client_lock);
5522
5523         INIT_DELAYED_WORK(&nn->laundromat_work, laundromat_main);
5524         get_net(net);
5525
5526         return 0;
5527
5528 err_sessionid:
5529         kfree(nn->ownerstr_hashtbl);
5530 err_ownerstr:
5531         kfree(nn->unconf_id_hashtbl);
5532 err_unconf_id:
5533         kfree(nn->conf_id_hashtbl);
5534 err:
5535         return -ENOMEM;
5536 }
5537
5538 static void
5539 nfs4_state_destroy_net(struct net *net)
5540 {
5541         int i;
5542         struct nfs4_client *clp = NULL;
5543         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
5544
5545         for (i = 0; i < CLIENT_HASH_SIZE; i++) {
5546                 while (!list_empty(&nn->conf_id_hashtbl[i])) {
5547                         clp = list_entry(nn->conf_id_hashtbl[i].next, struct nfs4_client, cl_idhash);
5548                         destroy_client(clp);
5549                 }
5550         }
5551
5552         for (i = 0; i < CLIENT_HASH_SIZE; i++) {
5553                 while (!list_empty(&nn->unconf_id_hashtbl[i])) {
5554                         clp = list_entry(nn->unconf_id_hashtbl[i].next, struct nfs4_client, cl_idhash);
5555                         destroy_client(clp);
5556                 }
5557         }
5558
5559         kfree(nn->sessionid_hashtbl);
5560         kfree(nn->ownerstr_hashtbl);
5561         kfree(nn->unconf_id_hashtbl);
5562         kfree(nn->conf_id_hashtbl);
5563         put_net(net);
5564 }
5565
5566 int
5567 nfs4_state_start_net(struct net *net)
5568 {
5569         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
5570         int ret;
5571
5572         ret = nfs4_state_create_net(net);
5573         if (ret)
5574                 return ret;
5575         nfsd4_client_tracking_init(net);
5576         nn->boot_time = get_seconds();
5577         locks_start_grace(net, &nn->nfsd4_manager);
5578         nn->grace_ended = false;
5579         printk(KERN_INFO "NFSD: starting %ld-second grace period (net %p)\n",
5580                nn->nfsd4_grace, net);
5581         queue_delayed_work(laundry_wq, &nn->laundromat_work, nn->nfsd4_grace * HZ);
5582         return 0;
5583 }
5584
5585 /* initialization to perform when the nfsd service is started: */
5586
5587 int
5588 nfs4_state_start(void)
5589 {
5590         int ret;
5591
5592         ret = set_callback_cred();
5593         if (ret)
5594                 return -ENOMEM;
5595         laundry_wq = create_singlethread_workqueue("nfsd4");
5596         if (laundry_wq == NULL) {
5597                 ret = -ENOMEM;
5598                 goto out_recovery;
5599         }
5600         ret = nfsd4_create_callback_queue();
5601         if (ret)
5602                 goto out_free_laundry;
5603
5604         set_max_delegations();
5605
5606         return 0;
5607
5608 out_free_laundry:
5609         destroy_workqueue(laundry_wq);
5610 out_recovery:
5611         return ret;
5612 }
5613
5614 void
5615 nfs4_state_shutdown_net(struct net *net)
5616 {
5617         struct nfs4_delegation *dp = NULL;
5618         struct list_head *pos, *next, reaplist;
5619         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
5620
5621         cancel_delayed_work_sync(&nn->laundromat_work);
5622         locks_end_grace(&nn->nfsd4_manager);
5623
5624         nfs4_lock_state();
5625         INIT_LIST_HEAD(&reaplist);
5626         spin_lock(&state_lock);
5627         list_for_each_safe(pos, next, &nn->del_recall_lru) {
5628                 dp = list_entry (pos, struct nfs4_delegation, dl_recall_lru);
5629                 list_move(&dp->dl_recall_lru, &reaplist);
5630         }
5631         spin_unlock(&state_lock);
5632         list_for_each_safe(pos, next, &reaplist) {
5633                 dp = list_entry (pos, struct nfs4_delegation, dl_recall_lru);
5634                 destroy_delegation(dp);
5635         }
5636
5637         nfsd4_client_tracking_exit(net);
5638         nfs4_state_destroy_net(net);
5639         nfs4_unlock_state();
5640 }
5641
5642 void
5643 nfs4_state_shutdown(void)
5644 {
5645         destroy_workqueue(laundry_wq);
5646         nfsd4_destroy_callback_queue();
5647 }
5648
5649 static void
5650 get_stateid(struct nfsd4_compound_state *cstate, stateid_t *stateid)
5651 {
5652         if (HAS_STATE_ID(cstate, CURRENT_STATE_ID_FLAG) && CURRENT_STATEID(stateid))
5653                 memcpy(stateid, &cstate->current_stateid, sizeof(stateid_t));
5654 }
5655
5656 static void
5657 put_stateid(struct nfsd4_compound_state *cstate, stateid_t *stateid)
5658 {
5659         if (cstate->minorversion) {
5660                 memcpy(&cstate->current_stateid, stateid, sizeof(stateid_t));
5661                 SET_STATE_ID(cstate, CURRENT_STATE_ID_FLAG);
5662         }
5663 }
5664
5665 void
5666 clear_current_stateid(struct nfsd4_compound_state *cstate)
5667 {
5668         CLEAR_STATE_ID(cstate, CURRENT_STATE_ID_FLAG);
5669 }
5670
5671 /*
5672  * functions to set current state id
5673  */
5674 void
5675 nfsd4_set_opendowngradestateid(struct nfsd4_compound_state *cstate, struct nfsd4_open_downgrade *odp)
5676 {
5677         put_stateid(cstate, &odp->od_stateid);
5678 }
5679
5680 void
5681 nfsd4_set_openstateid(struct nfsd4_compound_state *cstate, struct nfsd4_open *open)
5682 {
5683         put_stateid(cstate, &open->op_stateid);
5684 }
5685
5686 void
5687 nfsd4_set_closestateid(struct nfsd4_compound_state *cstate, struct nfsd4_close *close)
5688 {
5689         put_stateid(cstate, &close->cl_stateid);
5690 }
5691
5692 void
5693 nfsd4_set_lockstateid(struct nfsd4_compound_state *cstate, struct nfsd4_lock *lock)
5694 {
5695         put_stateid(cstate, &lock->lk_resp_stateid);
5696 }
5697
5698 /*
5699  * functions to consume current state id
5700  */
5701
5702 void
5703 nfsd4_get_opendowngradestateid(struct nfsd4_compound_state *cstate, struct nfsd4_open_downgrade *odp)
5704 {
5705         get_stateid(cstate, &odp->od_stateid);
5706 }
5707
5708 void
5709 nfsd4_get_delegreturnstateid(struct nfsd4_compound_state *cstate, struct nfsd4_delegreturn *drp)
5710 {
5711         get_stateid(cstate, &drp->dr_stateid);
5712 }
5713
5714 void
5715 nfsd4_get_freestateid(struct nfsd4_compound_state *cstate, struct nfsd4_free_stateid *fsp)
5716 {
5717         get_stateid(cstate, &fsp->fr_stateid);
5718 }
5719
5720 void
5721 nfsd4_get_setattrstateid(struct nfsd4_compound_state *cstate, struct nfsd4_setattr *setattr)
5722 {
5723         get_stateid(cstate, &setattr->sa_stateid);
5724 }
5725
5726 void
5727 nfsd4_get_closestateid(struct nfsd4_compound_state *cstate, struct nfsd4_close *close)
5728 {
5729         get_stateid(cstate, &close->cl_stateid);
5730 }
5731
5732 void
5733 nfsd4_get_lockustateid(struct nfsd4_compound_state *cstate, struct nfsd4_locku *locku)
5734 {
5735         get_stateid(cstate, &locku->lu_stateid);
5736 }
5737
5738 void
5739 nfsd4_get_readstateid(struct nfsd4_compound_state *cstate, struct nfsd4_read *read)
5740 {
5741         get_stateid(cstate, &read->rd_stateid);
5742 }
5743
5744 void
5745 nfsd4_get_writestateid(struct nfsd4_compound_state *cstate, struct nfsd4_write *write)
5746 {
5747         get_stateid(cstate, &write->wr_stateid);
5748 }