fs/nfsd/nfs4state.c

   1 /*
   2 *  Copyright (c) 2001 The Regents of the University of Michigan.
   3 *  All rights reserved.
   4 *
   5 *  Kendrick Smith <kmsmith@umich.edu>
   6 *  Andy Adamson <kandros@umich.edu>
   7 *
   8 *  Redistribution and use in source and binary forms, with or without
   9 *  modification, are permitted provided that the following conditions
  10 *  are met:
  11 *
  12 *  1. Redistributions of source code must retain the above copyright
  13 *     notice, this list of conditions and the following disclaimer.
  14 *  2. Redistributions in binary form must reproduce the above copyright
  15 *     notice, this list of conditions and the following disclaimer in the
  16 *     documentation and/or other materials provided with the distribution.
  17 *  3. Neither the name of the University nor the names of its
  18 *     contributors may be used to endorse or promote products derived
  19 *     from this software without specific prior written permission.
  20 *
  21 *  THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
  22 *  WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
  23 *  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
  24 *  DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
  25 *  FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  26 *  CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  27 *  SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
  28 *  BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
  29 *  LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
  30 *  NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
  31 *  SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  32 *
  33 */
  34
  35 #include <linux/file.h>
  36 #include <linux/fs.h>
  37 #include <linux/slab.h>
  38 #include <linux/namei.h>
  39 #include <linux/swap.h>
  40 #include <linux/pagemap.h>
  41 #include <linux/ratelimit.h>
  42 #include <linux/sunrpc/svcauth_gss.h>
  43 #include <linux/sunrpc/addr.h>
  44 #include <linux/jhash.h>
  45 #include <linux/string_helpers.h>
  46 #include "xdr4.h"
  47 #include "xdr4cb.h"
  48 #include "vfs.h"
  49 #include "current_stateid.h"
  50
  51 #include "netns.h"
  52 #include "pnfs.h"
  53 #include "filecache.h"
  54
  55 #define NFSDDBG_FACILITY                NFSDDBG_PROC
  56
  57 #define all_ones {{~0,~0},~0}
  58 static const stateid_t one_stateid = {
  59         .si_generation = ~0,
  60         .si_opaque = all_ones,
  61 };
  62 static const stateid_t zero_stateid = {
  63         /* all fields zero */
  64 };
  65 static const stateid_t currentstateid = {
  66         .si_generation = 1,
  67 };
  68 static const stateid_t close_stateid = {
  69         .si_generation = 0xffffffffU,
  70 };
  71
  72 static u64 current_sessionid = 1;
  73
  74 #define ZERO_STATEID(stateid) (!memcmp((stateid), &zero_stateid, sizeof(stateid_t)))
  75 #define ONE_STATEID(stateid)  (!memcmp((stateid), &one_stateid, sizeof(stateid_t)))
  76 #define CURRENT_STATEID(stateid) (!memcmp((stateid), &currentstateid, sizeof(stateid_t)))
  77 #define CLOSE_STATEID(stateid)  (!memcmp((stateid), &close_stateid, sizeof(stateid_t)))
  78
  79 /* forward declarations */
  80 static bool check_for_locks(struct nfs4_file *fp, struct nfs4_lockowner *lowner);
  81 static void nfs4_free_ol_stateid(struct nfs4_stid *stid);
  82 void nfsd4_end_grace(struct nfsd_net *nn);
  83
  84 /* Locking: */
  85
  86 /*
  87  * Currently used for the del_recall_lru and file hash table.  In an
  88  * effort to decrease the scope of the client_mutex, this spinlock may
  89  * eventually cover more:
  90  */
  91 static DEFINE_SPINLOCK(state_lock);
  92
  93 enum nfsd4_st_mutex_lock_subclass {
  94         OPEN_STATEID_MUTEX = 0,
  95         LOCK_STATEID_MUTEX = 1,
  96 };
  97
  98 /*
  99  * A waitqueue for all in-progress 4.0 CLOSE operations that are waiting for
 100  * the refcount on the open stateid to drop.
 101  */
 102 static DECLARE_WAIT_QUEUE_HEAD(close_wq);
 103
 104 /*
 105  * A waitqueue where a writer to clients/#/ctl destroying a client can
 106  * wait for cl_rpc_users to drop to 0 and then for the client to be
 107  * unhashed.
 108  */
 109 static DECLARE_WAIT_QUEUE_HEAD(expiry_wq);
 110
 111 static struct kmem_cache *client_slab;
 112 static struct kmem_cache *openowner_slab;
 113 static struct kmem_cache *lockowner_slab;
 114 static struct kmem_cache *file_slab;
 115 static struct kmem_cache *stateid_slab;
 116 static struct kmem_cache *deleg_slab;
 117 static struct kmem_cache *odstate_slab;
 118
 119 static void free_session(struct nfsd4_session *);
 120
 121 static const struct nfsd4_callback_ops nfsd4_cb_recall_ops;
 122 static const struct nfsd4_callback_ops nfsd4_cb_notify_lock_ops;
 123
 124 static bool is_session_dead(struct nfsd4_session *ses)
 125 {
 126         return ses->se_flags & NFS4_SESSION_DEAD;
 127 }
 128
 129 static __be32 mark_session_dead_locked(struct nfsd4_session *ses, int ref_held_by_me)
 130 {
 131         if (atomic_read(&ses->se_ref) > ref_held_by_me)
 132                 return nfserr_jukebox;
 133         ses->se_flags |= NFS4_SESSION_DEAD;
 134         return nfs_ok;
 135 }
 136
 137 static bool is_client_expired(struct nfs4_client *clp)
 138 {
 139         return clp->cl_time == 0;
 140 }
 141
 142 static __be32 get_client_locked(struct nfs4_client *clp)
 143 {
 144         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
 145
 146         lockdep_assert_held(&nn->client_lock);
 147
 148         if (is_client_expired(clp))
 149                 return nfserr_expired;
 150         atomic_inc(&clp->cl_rpc_users);
 151         return nfs_ok;
 152 }
 153
 154 /* must be called under the client_lock */
 155 static inline void
 156 renew_client_locked(struct nfs4_client *clp)
 157 {
 158         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
 159
 160         if (is_client_expired(clp)) {
 161                 WARN_ON(1);
 162                 printk("%s: client (clientid %08x/%08x) already expired\n",
 163                         __func__,
 164                         clp->cl_clientid.cl_boot,
 165                         clp->cl_clientid.cl_id);
 166                 return;
 167         }
 168
 169         dprintk("renewing client (clientid %08x/%08x)\n",
 170                         clp->cl_clientid.cl_boot,
 171                         clp->cl_clientid.cl_id);
 172         list_move_tail(&clp->cl_lru, &nn->client_lru);
 173         clp->cl_time = get_seconds();
 174 }
 175
 176 static void put_client_renew_locked(struct nfs4_client *clp)
 177 {
 178         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
 179
 180         lockdep_assert_held(&nn->client_lock);
 181
 182         if (!atomic_dec_and_test(&clp->cl_rpc_users))
 183                 return;
 184         if (!is_client_expired(clp))
 185                 renew_client_locked(clp);
 186         else
 187                 wake_up_all(&expiry_wq);
 188 }
 189
 190 static void put_client_renew(struct nfs4_client *clp)
 191 {
 192         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
 193
 194         if (!atomic_dec_and_lock(&clp->cl_rpc_users, &nn->client_lock))
 195                 return;
 196         if (!is_client_expired(clp))
 197                 renew_client_locked(clp);
 198         else
 199                 wake_up_all(&expiry_wq);
 200         spin_unlock(&nn->client_lock);
 201 }
 202
 203 static __be32 nfsd4_get_session_locked(struct nfsd4_session *ses)
 204 {
 205         __be32 status;
 206
 207         if (is_session_dead(ses))
 208                 return nfserr_badsession;
 209         status = get_client_locked(ses->se_client);
 210         if (status)
 211                 return status;
 212         atomic_inc(&ses->se_ref);
 213         return nfs_ok;
 214 }
 215
 216 static void nfsd4_put_session_locked(struct nfsd4_session *ses)
 217 {
 218         struct nfs4_client *clp = ses->se_client;
 219         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
 220
 221         lockdep_assert_held(&nn->client_lock);
 222
 223         if (atomic_dec_and_test(&ses->se_ref) && is_session_dead(ses))
 224                 free_session(ses);
 225         put_client_renew_locked(clp);
 226 }
 227
 228 static void nfsd4_put_session(struct nfsd4_session *ses)
 229 {
 230         struct nfs4_client *clp = ses->se_client;
 231         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
 232
 233         spin_lock(&nn->client_lock);
 234         nfsd4_put_session_locked(ses);
 235         spin_unlock(&nn->client_lock);
 236 }
 237
 238 static struct nfsd4_blocked_lock *
 239 find_blocked_lock(struct nfs4_lockowner *lo, struct knfsd_fh *fh,
 240                         struct nfsd_net *nn)
 241 {
 242         struct nfsd4_blocked_lock *cur, *found = NULL;
 243
 244         spin_lock(&nn->blocked_locks_lock);
 245         list_for_each_entry(cur, &lo->lo_blocked, nbl_list) {
 246                 if (fh_match(fh, &cur->nbl_fh)) {
 247                         list_del_init(&cur->nbl_list);
 248                         list_del_init(&cur->nbl_lru);
 249                         found = cur;
 250                         break;
 251                 }
 252         }
 253         spin_unlock(&nn->blocked_locks_lock);
 254         if (found)
 255                 locks_delete_block(&found->nbl_lock);
 256         return found;
 257 }
 258
 259 static struct nfsd4_blocked_lock *
 260 find_or_allocate_block(struct nfs4_lockowner *lo, struct knfsd_fh *fh,
 261                         struct nfsd_net *nn)
 262 {
 263         struct nfsd4_blocked_lock *nbl;
 264
 265         nbl = find_blocked_lock(lo, fh, nn);
 266         if (!nbl) {
 267                 nbl= kmalloc(sizeof(*nbl), GFP_KERNEL);
 268                 if (nbl) {
 269                         fh_copy_shallow(&nbl->nbl_fh, fh);
 270                         locks_init_lock(&nbl->nbl_lock);
 271                         nfsd4_init_cb(&nbl->nbl_cb, lo->lo_owner.so_client,
 272                                         &nfsd4_cb_notify_lock_ops,
 273                                         NFSPROC4_CLNT_CB_NOTIFY_LOCK);
 274                 }
 275         }
 276         return nbl;
 277 }
 278
 279 static void
 280 free_blocked_lock(struct nfsd4_blocked_lock *nbl)
 281 {
 282         locks_delete_block(&nbl->nbl_lock);
 283         locks_release_private(&nbl->nbl_lock);
 284         kfree(nbl);
 285 }
 286
 287 static void
 288 remove_blocked_locks(struct nfs4_lockowner *lo)
 289 {
 290         struct nfs4_client *clp = lo->lo_owner.so_client;
 291         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
 292         struct nfsd4_blocked_lock *nbl;
 293         LIST_HEAD(reaplist);
 294
 295         /* Dequeue all blocked locks */
 296         spin_lock(&nn->blocked_locks_lock);
 297         while (!list_empty(&lo->lo_blocked)) {
 298                 nbl = list_first_entry(&lo->lo_blocked,
 299                                         struct nfsd4_blocked_lock,
 300                                         nbl_list);
 301                 list_del_init(&nbl->nbl_list);
 302                 list_move(&nbl->nbl_lru, &reaplist);
 303         }
 304         spin_unlock(&nn->blocked_locks_lock);
 305
 306         /* Now free them */
 307         while (!list_empty(&reaplist)) {
 308                 nbl = list_first_entry(&reaplist, struct nfsd4_blocked_lock,
 309                                         nbl_lru);
 310                 list_del_init(&nbl->nbl_lru);
 311                 free_blocked_lock(nbl);
 312         }
 313 }
 314
 315 static void
 316 nfsd4_cb_notify_lock_prepare(struct nfsd4_callback *cb)
 317 {
 318         struct nfsd4_blocked_lock       *nbl = container_of(cb,
 319                                                 struct nfsd4_blocked_lock, nbl_cb);
 320         locks_delete_block(&nbl->nbl_lock);
 321 }
 322
 323 static int
 324 nfsd4_cb_notify_lock_done(struct nfsd4_callback *cb, struct rpc_task *task)
 325 {
 326         /*
 327          * Since this is just an optimization, we don't try very hard if it
 328          * turns out not to succeed. We'll requeue it on NFS4ERR_DELAY, and
 329          * just quit trying on anything else.
 330          */
 331         switch (task->tk_status) {
 332         case -NFS4ERR_DELAY:
 333                 rpc_delay(task, 1 * HZ);
 334                 return 0;
 335         default:
 336                 return 1;
 337         }
 338 }
 339
 340 static void
 341 nfsd4_cb_notify_lock_release(struct nfsd4_callback *cb)
 342 {
 343         struct nfsd4_blocked_lock       *nbl = container_of(cb,
 344                                                 struct nfsd4_blocked_lock, nbl_cb);
 345
 346         free_blocked_lock(nbl);
 347 }
 348
 349 static const struct nfsd4_callback_ops nfsd4_cb_notify_lock_ops = {
 350         .prepare        = nfsd4_cb_notify_lock_prepare,
 351         .done           = nfsd4_cb_notify_lock_done,
 352         .release        = nfsd4_cb_notify_lock_release,
 353 };
 354
 355 static inline struct nfs4_stateowner *
 356 nfs4_get_stateowner(struct nfs4_stateowner *sop)
 357 {
 358         atomic_inc(&sop->so_count);
 359         return sop;
 360 }
 361
 362 static int
 363 same_owner_str(struct nfs4_stateowner *sop, struct xdr_netobj *owner)
 364 {
 365         return (sop->so_owner.len == owner->len) &&
 366                 0 == memcmp(sop->so_owner.data, owner->data, owner->len);
 367 }
 368
 369 static struct nfs4_openowner *
 370 find_openstateowner_str_locked(unsigned int hashval, struct nfsd4_open *open,
 371                         struct nfs4_client *clp)
 372 {
 373         struct nfs4_stateowner *so;
 374
 375         lockdep_assert_held(&clp->cl_lock);
 376
 377         list_for_each_entry(so, &clp->cl_ownerstr_hashtbl[hashval],
 378                             so_strhash) {
 379                 if (!so->so_is_open_owner)
 380                         continue;
 381                 if (same_owner_str(so, &open->op_owner))
 382                         return openowner(nfs4_get_stateowner(so));
 383         }
 384         return NULL;
 385 }
 386
 387 static struct nfs4_openowner *
 388 find_openstateowner_str(unsigned int hashval, struct nfsd4_open *open,
 389                         struct nfs4_client *clp)
 390 {
 391         struct nfs4_openowner *oo;
 392
 393         spin_lock(&clp->cl_lock);
 394         oo = find_openstateowner_str_locked(hashval, open, clp);
 395         spin_unlock(&clp->cl_lock);
 396         return oo;
 397 }
 398
 399 static inline u32
 400 opaque_hashval(const void *ptr, int nbytes)
 401 {
 402         unsigned char *cptr = (unsigned char *) ptr;
 403
 404         u32 x = 0;
 405         while (nbytes--) {
 406                 x *= 37;
 407                 x += *cptr++;
 408         }
 409         return x;
 410 }
 411
 412 static void nfsd4_free_file_rcu(struct rcu_head *rcu)
 413 {
 414         struct nfs4_file *fp = container_of(rcu, struct nfs4_file, fi_rcu);
 415
 416         kmem_cache_free(file_slab, fp);
 417 }
 418
 419 void
 420 put_nfs4_file(struct nfs4_file *fi)
 421 {
 422         might_lock(&state_lock);
 423
 424         if (refcount_dec_and_lock(&fi->fi_ref, &state_lock)) {
 425                 hlist_del_rcu(&fi->fi_hash);
 426                 spin_unlock(&state_lock);
 427                 WARN_ON_ONCE(!list_empty(&fi->fi_clnt_odstate));
 428                 WARN_ON_ONCE(!list_empty(&fi->fi_delegations));
 429                 call_rcu(&fi->fi_rcu, nfsd4_free_file_rcu);
 430         }
 431 }
 432
 433 static struct nfsd_file *
 434 __nfs4_get_fd(struct nfs4_file *f, int oflag)
 435 {
 436         if (f->fi_fds[oflag])
 437                 return nfsd_file_get(f->fi_fds[oflag]);
 438         return NULL;
 439 }
 440
 441 static struct nfsd_file *
 442 find_writeable_file_locked(struct nfs4_file *f)
 443 {
 444         struct nfsd_file *ret;
 445
 446         lockdep_assert_held(&f->fi_lock);
 447
 448         ret = __nfs4_get_fd(f, O_WRONLY);
 449         if (!ret)
 450                 ret = __nfs4_get_fd(f, O_RDWR);
 451         return ret;
 452 }
 453
 454 static struct nfsd_file *
 455 find_writeable_file(struct nfs4_file *f)
 456 {
 457         struct nfsd_file *ret;
 458
 459         spin_lock(&f->fi_lock);
 460         ret = find_writeable_file_locked(f);
 461         spin_unlock(&f->fi_lock);
 462
 463         return ret;
 464 }
 465
 466 static struct nfsd_file *
 467 find_readable_file_locked(struct nfs4_file *f)
 468 {
 469         struct nfsd_file *ret;
 470
 471         lockdep_assert_held(&f->fi_lock);
 472
 473         ret = __nfs4_get_fd(f, O_RDONLY);
 474         if (!ret)
 475                 ret = __nfs4_get_fd(f, O_RDWR);
 476         return ret;
 477 }
 478
 479 static struct nfsd_file *
 480 find_readable_file(struct nfs4_file *f)
 481 {
 482         struct nfsd_file *ret;
 483
 484         spin_lock(&f->fi_lock);
 485         ret = find_readable_file_locked(f);
 486         spin_unlock(&f->fi_lock);
 487
 488         return ret;
 489 }
 490
 491 struct nfsd_file *
 492 find_any_file(struct nfs4_file *f)
 493 {
 494         struct nfsd_file *ret;
 495
 496         spin_lock(&f->fi_lock);
 497         ret = __nfs4_get_fd(f, O_RDWR);
 498         if (!ret) {
 499                 ret = __nfs4_get_fd(f, O_WRONLY);
 500                 if (!ret)
 501                         ret = __nfs4_get_fd(f, O_RDONLY);
 502         }
 503         spin_unlock(&f->fi_lock);
 504         return ret;
 505 }
 506
 507 static atomic_long_t num_delegations;
 508 unsigned long max_delegations;
 509
 510 /*
 511  * Open owner state (share locks)
 512  */
 513
 514 /* hash tables for lock and open owners */
 515 #define OWNER_HASH_BITS              8
 516 #define OWNER_HASH_SIZE             (1 << OWNER_HASH_BITS)
 517 #define OWNER_HASH_MASK             (OWNER_HASH_SIZE - 1)
 518
 519 static unsigned int ownerstr_hashval(struct xdr_netobj *ownername)
 520 {
 521         unsigned int ret;
 522
 523         ret = opaque_hashval(ownername->data, ownername->len);
 524         return ret & OWNER_HASH_MASK;
 525 }
 526
 527 /* hash table for nfs4_file */
 528 #define FILE_HASH_BITS                   8
 529 #define FILE_HASH_SIZE                  (1 << FILE_HASH_BITS)
 530
 531 static unsigned int nfsd_fh_hashval(struct knfsd_fh *fh)
 532 {
 533         return jhash2(fh->fh_base.fh_pad, XDR_QUADLEN(fh->fh_size), 0);
 534 }
 535
 536 static unsigned int file_hashval(struct knfsd_fh *fh)
 537 {
 538         return nfsd_fh_hashval(fh) & (FILE_HASH_SIZE - 1);
 539 }
 540
 541 static struct hlist_head file_hashtbl[FILE_HASH_SIZE];
 542
 543 static void
 544 __nfs4_file_get_access(struct nfs4_file *fp, u32 access)
 545 {
 546         lockdep_assert_held(&fp->fi_lock);
 547
 548         if (access & NFS4_SHARE_ACCESS_WRITE)
 549                 atomic_inc(&fp->fi_access[O_WRONLY]);
 550         if (access & NFS4_SHARE_ACCESS_READ)
 551                 atomic_inc(&fp->fi_access[O_RDONLY]);
 552 }
 553
 554 static __be32
 555 nfs4_file_get_access(struct nfs4_file *fp, u32 access)
 556 {
 557         lockdep_assert_held(&fp->fi_lock);
 558
 559         /* Does this access mode make sense? */
 560         if (access & ~NFS4_SHARE_ACCESS_BOTH)
 561                 return nfserr_inval;
 562
 563         /* Does it conflict with a deny mode already set? */
 564         if ((access & fp->fi_share_deny) != 0)
 565                 return nfserr_share_denied;
 566
 567         __nfs4_file_get_access(fp, access);
 568         return nfs_ok;
 569 }
 570
 571 static __be32 nfs4_file_check_deny(struct nfs4_file *fp, u32 deny)
 572 {
 573         /* Common case is that there is no deny mode. */
 574         if (deny) {
 575                 /* Does this deny mode make sense? */
 576                 if (deny & ~NFS4_SHARE_DENY_BOTH)
 577                         return nfserr_inval;
 578
 579                 if ((deny & NFS4_SHARE_DENY_READ) &&
 580                     atomic_read(&fp->fi_access[O_RDONLY]))
 581                         return nfserr_share_denied;
 582
 583                 if ((deny & NFS4_SHARE_DENY_WRITE) &&
 584                     atomic_read(&fp->fi_access[O_WRONLY]))
 585                         return nfserr_share_denied;
 586         }
 587         return nfs_ok;
 588 }
 589
 590 static void __nfs4_file_put_access(struct nfs4_file *fp, int oflag)
 591 {
 592         might_lock(&fp->fi_lock);
 593
 594         if (atomic_dec_and_lock(&fp->fi_access[oflag], &fp->fi_lock)) {
 595                 struct nfsd_file *f1 = NULL;
 596                 struct nfsd_file *f2 = NULL;
 597
 598                 swap(f1, fp->fi_fds[oflag]);
 599                 if (atomic_read(&fp->fi_access[1 - oflag]) == 0)
 600                         swap(f2, fp->fi_fds[O_RDWR]);
 601                 spin_unlock(&fp->fi_lock);
 602                 if (f1)
 603                         nfsd_file_put(f1);
 604                 if (f2)
 605                         nfsd_file_put(f2);
 606         }
 607 }
 608
 609 static void nfs4_file_put_access(struct nfs4_file *fp, u32 access)
 610 {
 611         WARN_ON_ONCE(access & ~NFS4_SHARE_ACCESS_BOTH);
 612
 613         if (access & NFS4_SHARE_ACCESS_WRITE)
 614                 __nfs4_file_put_access(fp, O_WRONLY);
 615         if (access & NFS4_SHARE_ACCESS_READ)
 616                 __nfs4_file_put_access(fp, O_RDONLY);
 617 }
 618
 619 /*
 620  * Allocate a new open/delegation state counter. This is needed for
 621  * pNFS for proper return on close semantics.
 622  *
 623  * Note that we only allocate it for pNFS-enabled exports, otherwise
 624  * all pointers to struct nfs4_clnt_odstate are always NULL.
 625  */
 626 static struct nfs4_clnt_odstate *
 627 alloc_clnt_odstate(struct nfs4_client *clp)
 628 {
 629         struct nfs4_clnt_odstate *co;
 630
 631         co = kmem_cache_zalloc(odstate_slab, GFP_KERNEL);
 632         if (co) {
 633                 co->co_client = clp;
 634                 refcount_set(&co->co_odcount, 1);
 635         }
 636         return co;
 637 }
 638
 639 static void
 640 hash_clnt_odstate_locked(struct nfs4_clnt_odstate *co)
 641 {
 642         struct nfs4_file *fp = co->co_file;
 643
 644         lockdep_assert_held(&fp->fi_lock);
 645         list_add(&co->co_perfile, &fp->fi_clnt_odstate);
 646 }
 647
 648 static inline void
 649 get_clnt_odstate(struct nfs4_clnt_odstate *co)
 650 {
 651         if (co)
 652                 refcount_inc(&co->co_odcount);
 653 }
 654
 655 static void
 656 put_clnt_odstate(struct nfs4_clnt_odstate *co)
 657 {
 658         struct nfs4_file *fp;
 659
 660         if (!co)
 661                 return;
 662
 663         fp = co->co_file;
 664         if (refcount_dec_and_lock(&co->co_odcount, &fp->fi_lock)) {
 665                 list_del(&co->co_perfile);
 666                 spin_unlock(&fp->fi_lock);
 667
 668                 nfsd4_return_all_file_layouts(co->co_client, fp);
 669                 kmem_cache_free(odstate_slab, co);
 670         }
 671 }
 672
 673 static struct nfs4_clnt_odstate *
 674 find_or_hash_clnt_odstate(struct nfs4_file *fp, struct nfs4_clnt_odstate *new)
 675 {
 676         struct nfs4_clnt_odstate *co;
 677         struct nfs4_client *cl;
 678
 679         if (!new)
 680                 return NULL;
 681
 682         cl = new->co_client;
 683
 684         spin_lock(&fp->fi_lock);
 685         list_for_each_entry(co, &fp->fi_clnt_odstate, co_perfile) {
 686                 if (co->co_client == cl) {
 687                         get_clnt_odstate(co);
 688                         goto out;
 689                 }
 690         }
 691         co = new;
 692         co->co_file = fp;
 693         hash_clnt_odstate_locked(new);
 694 out:
 695         spin_unlock(&fp->fi_lock);
 696         return co;
 697 }
 698
 699 struct nfs4_stid *nfs4_alloc_stid(struct nfs4_client *cl, struct kmem_cache *slab,
 700                                   void (*sc_free)(struct nfs4_stid *))
 701 {
 702         struct nfs4_stid *stid;
 703         int new_id;
 704
 705         stid = kmem_cache_zalloc(slab, GFP_KERNEL);
 706         if (!stid)
 707                 return NULL;
 708
 709         idr_preload(GFP_KERNEL);
 710         spin_lock(&cl->cl_lock);
 711         /* Reserving 0 for start of file in nfsdfs "states" file: */
 712         new_id = idr_alloc_cyclic(&cl->cl_stateids, stid, 1, 0, GFP_NOWAIT);
 713         spin_unlock(&cl->cl_lock);
 714         idr_preload_end();
 715         if (new_id < 0)
 716                 goto out_free;
 717
 718         stid->sc_free = sc_free;
 719         stid->sc_client = cl;
 720         stid->sc_stateid.si_opaque.so_id = new_id;
 721         stid->sc_stateid.si_opaque.so_clid = cl->cl_clientid;
 722         /* Will be incremented before return to client: */
 723         refcount_set(&stid->sc_count, 1);
 724         spin_lock_init(&stid->sc_lock);
 725
 726         /*
 727          * It shouldn't be a problem to reuse an opaque stateid value.
 728          * I don't think it is for 4.1.  But with 4.0 I worry that, for
 729          * example, a stray write retransmission could be accepted by
 730          * the server when it should have been rejected.  Therefore,
 731          * adopt a trick from the sctp code to attempt to maximize the
 732          * amount of time until an id is reused, by ensuring they always
 733          * "increase" (mod INT_MAX):
 734          */
 735         return stid;
 736 out_free:
 737         kmem_cache_free(slab, stid);
 738         return NULL;
 739 }
 740
 741 /*
 742  * Create a unique stateid_t to represent each COPY.
 743  */
 744 int nfs4_init_cp_state(struct nfsd_net *nn, struct nfsd4_copy *copy)
 745 {
 746         int new_id;
 747
 748         idr_preload(GFP_KERNEL);
 749         spin_lock(&nn->s2s_cp_lock);
 750         new_id = idr_alloc_cyclic(&nn->s2s_cp_stateids, copy, 0, 0, GFP_NOWAIT);
 751         spin_unlock(&nn->s2s_cp_lock);
 752         idr_preload_end();
 753         if (new_id < 0)
 754                 return 0;
 755         copy->cp_stateid.si_opaque.so_id = new_id;
 756         copy->cp_stateid.si_opaque.so_clid.cl_boot = nn->boot_time;
 757         copy->cp_stateid.si_opaque.so_clid.cl_id = nn->s2s_cp_cl_id;
 758         return 1;
 759 }
 760
 761 void nfs4_free_cp_state(struct nfsd4_copy *copy)
 762 {
 763         struct nfsd_net *nn;
 764
 765         nn = net_generic(copy->cp_clp->net, nfsd_net_id);
 766         spin_lock(&nn->s2s_cp_lock);
 767         idr_remove(&nn->s2s_cp_stateids, copy->cp_stateid.si_opaque.so_id);
 768         spin_unlock(&nn->s2s_cp_lock);
 769 }
 770
 771 static struct nfs4_ol_stateid * nfs4_alloc_open_stateid(struct nfs4_client *clp)
 772 {
 773         struct nfs4_stid *stid;
 774
 775         stid = nfs4_alloc_stid(clp, stateid_slab, nfs4_free_ol_stateid);
 776         if (!stid)
 777                 return NULL;
 778
 779         return openlockstateid(stid);
 780 }
 781
 782 static void nfs4_free_deleg(struct nfs4_stid *stid)
 783 {
 784         kmem_cache_free(deleg_slab, stid);
 785         atomic_long_dec(&num_delegations);
 786 }
 787
 788 /*
 789  * When we recall a delegation, we should be careful not to hand it
 790  * out again straight away.
 791  * To ensure this we keep a pair of bloom filters ('new' and 'old')
 792  * in which the filehandles of recalled delegations are "stored".
 793  * If a filehandle appear in either filter, a delegation is blocked.
 794  * When a delegation is recalled, the filehandle is stored in the "new"
 795  * filter.
 796  * Every 30 seconds we swap the filters and clear the "new" one,
 797  * unless both are empty of course.
 798  *
 799  * Each filter is 256 bits.  We hash the filehandle to 32bit and use the
 800  * low 3 bytes as hash-table indices.
 801  *
 802  * 'blocked_delegations_lock', which is always taken in block_delegations(),
 803  * is used to manage concurrent access.  Testing does not need the lock
 804  * except when swapping the two filters.
 805  */
 806 static DEFINE_SPINLOCK(blocked_delegations_lock);
 807 static struct bloom_pair {
 808         int     entries, old_entries;
 809         time_t  swap_time;
 810         int     new; /* index into 'set' */
 811         DECLARE_BITMAP(set[2], 256);
 812 } blocked_delegations;
 813
 814 static int delegation_blocked(struct knfsd_fh *fh)
 815 {
 816         u32 hash;
 817         struct bloom_pair *bd = &blocked_delegations;
 818
 819         if (bd->entries == 0)
 820                 return 0;
 821         if (seconds_since_boot() - bd->swap_time > 30) {
 822                 spin_lock(&blocked_delegations_lock);
 823                 if (seconds_since_boot() - bd->swap_time > 30) {
 824                         bd->entries -= bd->old_entries;
 825                         bd->old_entries = bd->entries;
 826                         memset(bd->set[bd->new], 0,
 827                                sizeof(bd->set[0]));
 828                         bd->new = 1-bd->new;
 829                         bd->swap_time = seconds_since_boot();
 830                 }
 831                 spin_unlock(&blocked_delegations_lock);
 832         }
 833         hash = jhash(&fh->fh_base, fh->fh_size, 0);
 834         if (test_bit(hash&255, bd->set[0]) &&
 835             test_bit((hash>>8)&255, bd->set[0]) &&
 836             test_bit((hash>>16)&255, bd->set[0]))
 837                 return 1;
 838
 839         if (test_bit(hash&255, bd->set[1]) &&
 840             test_bit((hash>>8)&255, bd->set[1]) &&
 841             test_bit((hash>>16)&255, bd->set[1]))
 842                 return 1;
 843
 844         return 0;
 845 }
 846
 847 static void block_delegations(struct knfsd_fh *fh)
 848 {
 849         u32 hash;
 850         struct bloom_pair *bd = &blocked_delegations;
 851
 852         hash = jhash(&fh->fh_base, fh->fh_size, 0);
 853
 854         spin_lock(&blocked_delegations_lock);
 855         __set_bit(hash&255, bd->set[bd->new]);
 856         __set_bit((hash>>8)&255, bd->set[bd->new]);
 857         __set_bit((hash>>16)&255, bd->set[bd->new]);
 858         if (bd->entries == 0)
 859                 bd->swap_time = seconds_since_boot();
 860         bd->entries += 1;
 861         spin_unlock(&blocked_delegations_lock);
 862 }
 863
 864 static struct nfs4_delegation *
 865 alloc_init_deleg(struct nfs4_client *clp, struct nfs4_file *fp,
 866                  struct svc_fh *current_fh,
 867                  struct nfs4_clnt_odstate *odstate)
 868 {
 869         struct nfs4_delegation *dp;
 870         long n;
 871
 872         dprintk("NFSD alloc_init_deleg\n");
 873         n = atomic_long_inc_return(&num_delegations);
 874         if (n < 0 || n > max_delegations)
 875                 goto out_dec;
 876         if (delegation_blocked(&current_fh->fh_handle))
 877                 goto out_dec;
 878         dp = delegstateid(nfs4_alloc_stid(clp, deleg_slab, nfs4_free_deleg));
 879         if (dp == NULL)
 880                 goto out_dec;
 881
 882         /*
 883          * delegation seqid's are never incremented.  The 4.1 special
 884          * meaning of seqid 0 isn't meaningful, really, but let's avoid
 885          * 0 anyway just for consistency and use 1:
 886          */
 887         dp->dl_stid.sc_stateid.si_generation = 1;
 888         INIT_LIST_HEAD(&dp->dl_perfile);
 889         INIT_LIST_HEAD(&dp->dl_perclnt);
 890         INIT_LIST_HEAD(&dp->dl_recall_lru);
 891         dp->dl_clnt_odstate = odstate;
 892         get_clnt_odstate(odstate);
 893         dp->dl_type = NFS4_OPEN_DELEGATE_READ;
 894         dp->dl_retries = 1;
 895         nfsd4_init_cb(&dp->dl_recall, dp->dl_stid.sc_client,
 896                       &nfsd4_cb_recall_ops, NFSPROC4_CLNT_CB_RECALL);
 897         get_nfs4_file(fp);
 898         dp->dl_stid.sc_file = fp;
 899         return dp;
 900 out_dec:
 901         atomic_long_dec(&num_delegations);
 902         return NULL;
 903 }
 904
 905 void
 906 nfs4_put_stid(struct nfs4_stid *s)
 907 {
 908         struct nfs4_file *fp = s->sc_file;
 909         struct nfs4_client *clp = s->sc_client;
 910
 911         might_lock(&clp->cl_lock);
 912
 913         if (!refcount_dec_and_lock(&s->sc_count, &clp->cl_lock)) {
 914                 wake_up_all(&close_wq);
 915                 return;
 916         }
 917         idr_remove(&clp->cl_stateids, s->sc_stateid.si_opaque.so_id);
 918         spin_unlock(&clp->cl_lock);
 919         s->sc_free(s);
 920         if (fp)
 921                 put_nfs4_file(fp);
 922 }
 923
 924 void
 925 nfs4_inc_and_copy_stateid(stateid_t *dst, struct nfs4_stid *stid)
 926 {
 927         stateid_t *src = &stid->sc_stateid;
 928
 929         spin_lock(&stid->sc_lock);
 930         if (unlikely(++src->si_generation == 0))
 931                 src->si_generation = 1;
 932         memcpy(dst, src, sizeof(*dst));
 933         spin_unlock(&stid->sc_lock);
 934 }
 935
 936 static void put_deleg_file(struct nfs4_file *fp)
 937 {
 938         struct nfsd_file *nf = NULL;
 939
 940         spin_lock(&fp->fi_lock);
 941         if (--fp->fi_delegees == 0)
 942                 swap(nf, fp->fi_deleg_file);
 943         spin_unlock(&fp->fi_lock);
 944
 945         if (nf)
 946                 nfsd_file_put(nf);
 947 }
 948
 949 static void nfs4_unlock_deleg_lease(struct nfs4_delegation *dp)
 950 {
 951         struct nfs4_file *fp = dp->dl_stid.sc_file;
 952         struct nfsd_file *nf = fp->fi_deleg_file;
 953
 954         WARN_ON_ONCE(!fp->fi_delegees);
 955
 956         vfs_setlease(nf->nf_file, F_UNLCK, NULL, (void **)&dp);
 957         put_deleg_file(fp);
 958 }
 959
 960 static void destroy_unhashed_deleg(struct nfs4_delegation *dp)
 961 {
 962         put_clnt_odstate(dp->dl_clnt_odstate);
 963         nfs4_unlock_deleg_lease(dp);
 964         nfs4_put_stid(&dp->dl_stid);
 965 }
 966
 967 void nfs4_unhash_stid(struct nfs4_stid *s)
 968 {
 969         s->sc_type = 0;
 970 }
 971
 972 /**
 973  * nfs4_delegation_exists - Discover if this delegation already exists
 974  * @clp:     a pointer to the nfs4_client we're granting a delegation to
 975  * @fp:      a pointer to the nfs4_file we're granting a delegation on
 976  *
 977  * Return:
 978  *      On success: true iff an existing delegation is found
 979  */
 980
 981 static bool
 982 nfs4_delegation_exists(struct nfs4_client *clp, struct nfs4_file *fp)
 983 {
 984         struct nfs4_delegation *searchdp = NULL;
 985         struct nfs4_client *searchclp = NULL;
 986
 987         lockdep_assert_held(&state_lock);
 988         lockdep_assert_held(&fp->fi_lock);
 989
 990         list_for_each_entry(searchdp, &fp->fi_delegations, dl_perfile) {
 991                 searchclp = searchdp->dl_stid.sc_client;
 992                 if (clp == searchclp) {
 993                         return true;
 994                 }
 995         }
 996         return false;
 997 }
 998
 999 /**
1000  * hash_delegation_locked - Add a delegation to the appropriate lists
1001  * @dp:     a pointer to the nfs4_delegation we are adding.
1002  * @fp:     a pointer to the nfs4_file we're granting a delegation on
1003  *
1004  * Return:
1005  *      On success: NULL if the delegation was successfully hashed.
1006  *
1007  *      On error: -EAGAIN if one was previously granted to this
1008  *                 nfs4_client for this nfs4_file. Delegation is not hashed.
1009  *
1010  */
1011
1012 static int
1013 hash_delegation_locked(struct nfs4_delegation *dp, struct nfs4_file *fp)
1014 {
1015         struct nfs4_client *clp = dp->dl_stid.sc_client;
1016
1017         lockdep_assert_held(&state_lock);
1018         lockdep_assert_held(&fp->fi_lock);
1019
1020         if (nfs4_delegation_exists(clp, fp))
1021                 return -EAGAIN;
1022         refcount_inc(&dp->dl_stid.sc_count);
1023         dp->dl_stid.sc_type = NFS4_DELEG_STID;
1024         list_add(&dp->dl_perfile, &fp->fi_delegations);
1025         list_add(&dp->dl_perclnt, &clp->cl_delegations);
1026         return 0;
1027 }
1028
1029 static bool
1030 unhash_delegation_locked(struct nfs4_delegation *dp)
1031 {
1032         struct nfs4_file *fp = dp->dl_stid.sc_file;
1033
1034         lockdep_assert_held(&state_lock);
1035
1036         if (list_empty(&dp->dl_perfile))
1037                 return false;
1038
1039         dp->dl_stid.sc_type = NFS4_CLOSED_DELEG_STID;
1040         /* Ensure that deleg break won't try to requeue it */
1041         ++dp->dl_time;
1042         spin_lock(&fp->fi_lock);
1043         list_del_init(&dp->dl_perclnt);
1044         list_del_init(&dp->dl_recall_lru);
1045         list_del_init(&dp->dl_perfile);
1046         spin_unlock(&fp->fi_lock);
1047         return true;
1048 }
1049
1050 static void destroy_delegation(struct nfs4_delegation *dp)
1051 {
1052         bool unhashed;
1053
1054         spin_lock(&state_lock);
1055         unhashed = unhash_delegation_locked(dp);
1056         spin_unlock(&state_lock);
1057         if (unhashed)
1058                 destroy_unhashed_deleg(dp);
1059 }
1060
1061 static void revoke_delegation(struct nfs4_delegation *dp)
1062 {
1063         struct nfs4_client *clp = dp->dl_stid.sc_client;
1064
1065         WARN_ON(!list_empty(&dp->dl_recall_lru));
1066
1067         if (clp->cl_minorversion) {
1068                 dp->dl_stid.sc_type = NFS4_REVOKED_DELEG_STID;
1069                 refcount_inc(&dp->dl_stid.sc_count);
1070                 spin_lock(&clp->cl_lock);
1071                 list_add(&dp->dl_recall_lru, &clp->cl_revoked);
1072                 spin_unlock(&clp->cl_lock);
1073         }
1074         destroy_unhashed_deleg(dp);
1075 }
1076
1077 /*
1078  * SETCLIENTID state
1079  */
1080
1081 static unsigned int clientid_hashval(u32 id)
1082 {
1083         return id & CLIENT_HASH_MASK;
1084 }
1085
1086 static unsigned int clientstr_hashval(struct xdr_netobj name)
1087 {
1088         return opaque_hashval(name.data, 8) & CLIENT_HASH_MASK;
1089 }
1090
1091 /*
1092  * We store the NONE, READ, WRITE, and BOTH bits separately in the
1093  * st_{access,deny}_bmap field of the stateid, in order to track not
1094  * only what share bits are currently in force, but also what
1095  * combinations of share bits previous opens have used.  This allows us
1096  * to enforce the recommendation of rfc 3530 14.2.19 that the server
1097  * return an error if the client attempt to downgrade to a combination
1098  * of share bits not explicable by closing some of its previous opens.
1099  *
1100  * XXX: This enforcement is actually incomplete, since we don't keep
1101  * track of access/deny bit combinations; so, e.g., we allow:
1102  *
1103  *      OPEN allow read, deny write
1104  *      OPEN allow both, deny none
1105  *      DOWNGRADE allow read, deny none
1106  *
1107  * which we should reject.
1108  */
1109 static unsigned int
1110 bmap_to_share_mode(unsigned long bmap) {
1111         int i;
1112         unsigned int access = 0;
1113
1114         for (i = 1; i < 4; i++) {
1115                 if (test_bit(i, &bmap))
1116                         access |= i;
1117         }
1118         return access;
1119 }
1120
1121 /* set share access for a given stateid */
1122 static inline void
1123 set_access(u32 access, struct nfs4_ol_stateid *stp)
1124 {
1125         unsigned char mask = 1 << access;
1126
1127         WARN_ON_ONCE(access > NFS4_SHARE_ACCESS_BOTH);
1128         stp->st_access_bmap |= mask;
1129 }
1130
1131 /* clear share access for a given stateid */
1132 static inline void
1133 clear_access(u32 access, struct nfs4_ol_stateid *stp)
1134 {
1135         unsigned char mask = 1 << access;
1136
1137         WARN_ON_ONCE(access > NFS4_SHARE_ACCESS_BOTH);
1138         stp->st_access_bmap &= ~mask;
1139 }
1140
1141 /* test whether a given stateid has access */
1142 static inline bool
1143 test_access(u32 access, struct nfs4_ol_stateid *stp)
1144 {
1145         unsigned char mask = 1 << access;
1146
1147         return (bool)(stp->st_access_bmap & mask);
1148 }
1149
1150 /* set share deny for a given stateid */
1151 static inline void
1152 set_deny(u32 deny, struct nfs4_ol_stateid *stp)
1153 {
1154         unsigned char mask = 1 << deny;
1155
1156         WARN_ON_ONCE(deny > NFS4_SHARE_DENY_BOTH);
1157         stp->st_deny_bmap |= mask;
1158 }
1159
1160 /* clear share deny for a given stateid */
1161 static inline void
1162 clear_deny(u32 deny, struct nfs4_ol_stateid *stp)
1163 {
1164         unsigned char mask = 1 << deny;
1165
1166         WARN_ON_ONCE(deny > NFS4_SHARE_DENY_BOTH);
1167         stp->st_deny_bmap &= ~mask;
1168 }
1169
1170 /* test whether a given stateid is denying specific access */
1171 static inline bool
1172 test_deny(u32 deny, struct nfs4_ol_stateid *stp)
1173 {
1174         unsigned char mask = 1 << deny;
1175
1176         return (bool)(stp->st_deny_bmap & mask);
1177 }
1178
1179 static int nfs4_access_to_omode(u32 access)
1180 {
1181         switch (access & NFS4_SHARE_ACCESS_BOTH) {
1182         case NFS4_SHARE_ACCESS_READ:
1183                 return O_RDONLY;
1184         case NFS4_SHARE_ACCESS_WRITE:
1185                 return O_WRONLY;
1186         case NFS4_SHARE_ACCESS_BOTH:
1187                 return O_RDWR;
1188         }
1189         WARN_ON_ONCE(1);
1190         return O_RDONLY;
1191 }
1192
1193 /*
1194  * A stateid that had a deny mode associated with it is being released
1195  * or downgraded. Recalculate the deny mode on the file.
1196  */
1197 static void
1198 recalculate_deny_mode(struct nfs4_file *fp)
1199 {
1200         struct nfs4_ol_stateid *stp;
1201
1202         spin_lock(&fp->fi_lock);
1203         fp->fi_share_deny = 0;
1204         list_for_each_entry(stp, &fp->fi_stateids, st_perfile)
1205                 fp->fi_share_deny |= bmap_to_share_mode(stp->st_deny_bmap);
1206         spin_unlock(&fp->fi_lock);
1207 }
1208
1209 static void
1210 reset_union_bmap_deny(u32 deny, struct nfs4_ol_stateid *stp)
1211 {
1212         int i;
1213         bool change = false;
1214
1215         for (i = 1; i < 4; i++) {
1216                 if ((i & deny) != i) {
1217                         change = true;
1218                         clear_deny(i, stp);
1219                 }
1220         }
1221
1222         /* Recalculate per-file deny mode if there was a change */
1223         if (change)
1224                 recalculate_deny_mode(stp->st_stid.sc_file);
1225 }
1226
1227 /* release all access and file references for a given stateid */
1228 static void
1229 release_all_access(struct nfs4_ol_stateid *stp)
1230 {
1231         int i;
1232         struct nfs4_file *fp = stp->st_stid.sc_file;
1233
1234         if (fp && stp->st_deny_bmap != 0)
1235                 recalculate_deny_mode(fp);
1236
1237         for (i = 1; i < 4; i++) {
1238                 if (test_access(i, stp))
1239                         nfs4_file_put_access(stp->st_stid.sc_file, i);
1240                 clear_access(i, stp);
1241         }
1242 }
1243
1244 static inline void nfs4_free_stateowner(struct nfs4_stateowner *sop)
1245 {
1246         kfree(sop->so_owner.data);
1247         sop->so_ops->so_free(sop);
1248 }
1249
1250 static void nfs4_put_stateowner(struct nfs4_stateowner *sop)
1251 {
1252         struct nfs4_client *clp = sop->so_client;
1253
1254         might_lock(&clp->cl_lock);
1255
1256         if (!atomic_dec_and_lock(&sop->so_count, &clp->cl_lock))
1257                 return;
1258         sop->so_ops->so_unhash(sop);
1259         spin_unlock(&clp->cl_lock);
1260         nfs4_free_stateowner(sop);
1261 }
1262
1263 static bool unhash_ol_stateid(struct nfs4_ol_stateid *stp)
1264 {
1265         struct nfs4_file *fp = stp->st_stid.sc_file;
1266
1267         lockdep_assert_held(&stp->st_stateowner->so_client->cl_lock);
1268
1269         if (list_empty(&stp->st_perfile))
1270                 return false;
1271
1272         spin_lock(&fp->fi_lock);
1273         list_del_init(&stp->st_perfile);
1274         spin_unlock(&fp->fi_lock);
1275         list_del(&stp->st_perstateowner);
1276         return true;
1277 }
1278
1279 static void nfs4_free_ol_stateid(struct nfs4_stid *stid)
1280 {
1281         struct nfs4_ol_stateid *stp = openlockstateid(stid);
1282
1283         put_clnt_odstate(stp->st_clnt_odstate);
1284         release_all_access(stp);
1285         if (stp->st_stateowner)
1286                 nfs4_put_stateowner(stp->st_stateowner);
1287         kmem_cache_free(stateid_slab, stid);
1288 }
1289
1290 static void nfs4_free_lock_stateid(struct nfs4_stid *stid)
1291 {
1292         struct nfs4_ol_stateid *stp = openlockstateid(stid);
1293         struct nfs4_lockowner *lo = lockowner(stp->st_stateowner);
1294         struct nfsd_file *nf;
1295
1296         nf = find_any_file(stp->st_stid.sc_file);
1297         if (nf) {
1298                 get_file(nf->nf_file);
1299                 filp_close(nf->nf_file, (fl_owner_t)lo);
1300                 nfsd_file_put(nf);
1301         }
1302         nfs4_free_ol_stateid(stid);
1303 }
1304
1305 /*
1306  * Put the persistent reference to an already unhashed generic stateid, while
1307  * holding the cl_lock. If it's the last reference, then put it onto the
1308  * reaplist for later destruction.
1309  */
1310 static void put_ol_stateid_locked(struct nfs4_ol_stateid *stp,
1311                                        struct list_head *reaplist)
1312 {
1313         struct nfs4_stid *s = &stp->st_stid;
1314         struct nfs4_client *clp = s->sc_client;
1315
1316         lockdep_assert_held(&clp->cl_lock);
1317
1318         WARN_ON_ONCE(!list_empty(&stp->st_locks));
1319
1320         if (!refcount_dec_and_test(&s->sc_count)) {
1321                 wake_up_all(&close_wq);
1322                 return;
1323         }
1324
1325         idr_remove(&clp->cl_stateids, s->sc_stateid.si_opaque.so_id);
1326         list_add(&stp->st_locks, reaplist);
1327 }
1328
1329 static bool unhash_lock_stateid(struct nfs4_ol_stateid *stp)
1330 {
1331         lockdep_assert_held(&stp->st_stid.sc_client->cl_lock);
1332
1333         list_del_init(&stp->st_locks);
1334         nfs4_unhash_stid(&stp->st_stid);
1335         return unhash_ol_stateid(stp);
1336 }
1337
1338 static void release_lock_stateid(struct nfs4_ol_stateid *stp)
1339 {
1340         struct nfs4_client *clp = stp->st_stid.sc_client;
1341         bool unhashed;
1342
1343         spin_lock(&clp->cl_lock);
1344         unhashed = unhash_lock_stateid(stp);
1345         spin_unlock(&clp->cl_lock);
1346         if (unhashed)
1347                 nfs4_put_stid(&stp->st_stid);
1348 }
1349
1350 static void unhash_lockowner_locked(struct nfs4_lockowner *lo)
1351 {
1352         struct nfs4_client *clp = lo->lo_owner.so_client;
1353
1354         lockdep_assert_held(&clp->cl_lock);
1355
1356         list_del_init(&lo->lo_owner.so_strhash);
1357 }
1358
1359 /*
1360  * Free a list of generic stateids that were collected earlier after being
1361  * fully unhashed.
1362  */
1363 static void
1364 free_ol_stateid_reaplist(struct list_head *reaplist)
1365 {
1366         struct nfs4_ol_stateid *stp;
1367         struct nfs4_file *fp;
1368
1369         might_sleep();
1370
1371         while (!list_empty(reaplist)) {
1372                 stp = list_first_entry(reaplist, struct nfs4_ol_stateid,
1373                                        st_locks);
1374                 list_del(&stp->st_locks);
1375                 fp = stp->st_stid.sc_file;
1376                 stp->st_stid.sc_free(&stp->st_stid);
1377                 if (fp)
1378                         put_nfs4_file(fp);
1379         }
1380 }
1381
1382 static void release_open_stateid_locks(struct nfs4_ol_stateid *open_stp,
1383                                        struct list_head *reaplist)
1384 {
1385         struct nfs4_ol_stateid *stp;
1386
1387         lockdep_assert_held(&open_stp->st_stid.sc_client->cl_lock);
1388
1389         while (!list_empty(&open_stp->st_locks)) {
1390                 stp = list_entry(open_stp->st_locks.next,
1391                                 struct nfs4_ol_stateid, st_locks);
1392                 WARN_ON(!unhash_lock_stateid(stp));
1393                 put_ol_stateid_locked(stp, reaplist);
1394         }
1395 }
1396
1397 static bool unhash_open_stateid(struct nfs4_ol_stateid *stp,
1398                                 struct list_head *reaplist)
1399 {
1400         bool unhashed;
1401
1402         lockdep_assert_held(&stp->st_stid.sc_client->cl_lock);
1403
1404         unhashed = unhash_ol_stateid(stp);
1405         release_open_stateid_locks(stp, reaplist);
1406         return unhashed;
1407 }
1408
1409 static void release_open_stateid(struct nfs4_ol_stateid *stp)
1410 {
1411         LIST_HEAD(reaplist);
1412
1413         spin_lock(&stp->st_stid.sc_client->cl_lock);
1414         if (unhash_open_stateid(stp, &reaplist))
1415                 put_ol_stateid_locked(stp, &reaplist);
1416         spin_unlock(&stp->st_stid.sc_client->cl_lock);
1417         free_ol_stateid_reaplist(&reaplist);
1418 }
1419
1420 static void unhash_openowner_locked(struct nfs4_openowner *oo)
1421 {
1422         struct nfs4_client *clp = oo->oo_owner.so_client;
1423
1424         lockdep_assert_held(&clp->cl_lock);
1425
1426         list_del_init(&oo->oo_owner.so_strhash);
1427         list_del_init(&oo->oo_perclient);
1428 }
1429
1430 static void release_last_closed_stateid(struct nfs4_openowner *oo)
1431 {
1432         struct nfsd_net *nn = net_generic(oo->oo_owner.so_client->net,
1433                                           nfsd_net_id);
1434         struct nfs4_ol_stateid *s;
1435
1436         spin_lock(&nn->client_lock);
1437         s = oo->oo_last_closed_stid;
1438         if (s) {
1439                 list_del_init(&oo->oo_close_lru);
1440                 oo->oo_last_closed_stid = NULL;
1441         }
1442         spin_unlock(&nn->client_lock);
1443         if (s)
1444                 nfs4_put_stid(&s->st_stid);
1445 }
1446
1447 static void release_openowner(struct nfs4_openowner *oo)
1448 {
1449         struct nfs4_ol_stateid *stp;
1450         struct nfs4_client *clp = oo->oo_owner.so_client;
1451         struct list_head reaplist;
1452
1453         INIT_LIST_HEAD(&reaplist);
1454
1455         spin_lock(&clp->cl_lock);
1456         unhash_openowner_locked(oo);
1457         while (!list_empty(&oo->oo_owner.so_stateids)) {
1458                 stp = list_first_entry(&oo->oo_owner.so_stateids,
1459                                 struct nfs4_ol_stateid, st_perstateowner);
1460                 if (unhash_open_stateid(stp, &reaplist))
1461                         put_ol_stateid_locked(stp, &reaplist);
1462         }
1463         spin_unlock(&clp->cl_lock);
1464         free_ol_stateid_reaplist(&reaplist);
1465         release_last_closed_stateid(oo);
1466         nfs4_put_stateowner(&oo->oo_owner);
1467 }
1468
1469 static inline int
1470 hash_sessionid(struct nfs4_sessionid *sessionid)
1471 {
1472         struct nfsd4_sessionid *sid = (struct nfsd4_sessionid *)sessionid;
1473
1474         return sid->sequence % SESSION_HASH_SIZE;
1475 }
1476
1477 #ifdef CONFIG_SUNRPC_DEBUG
1478 static inline void
1479 dump_sessionid(const char *fn, struct nfs4_sessionid *sessionid)
1480 {
1481         u32 *ptr = (u32 *)(&sessionid->data[0]);
1482         dprintk("%s: %u:%u:%u:%u\n", fn, ptr[0], ptr[1], ptr[2], ptr[3]);
1483 }
1484 #else
1485 static inline void
1486 dump_sessionid(const char *fn, struct nfs4_sessionid *sessionid)
1487 {
1488 }
1489 #endif
1490
1491 /*
1492  * Bump the seqid on cstate->replay_owner, and clear replay_owner if it
1493  * won't be used for replay.
1494  */
1495 void nfsd4_bump_seqid(struct nfsd4_compound_state *cstate, __be32 nfserr)
1496 {
1497         struct nfs4_stateowner *so = cstate->replay_owner;
1498
1499         if (nfserr == nfserr_replay_me)
1500                 return;
1501
1502         if (!seqid_mutating_err(ntohl(nfserr))) {
1503                 nfsd4_cstate_clear_replay(cstate);
1504                 return;
1505         }
1506         if (!so)
1507                 return;
1508         if (so->so_is_open_owner)
1509                 release_last_closed_stateid(openowner(so));
1510         so->so_seqid++;
1511         return;
1512 }
1513
1514 static void
1515 gen_sessionid(struct nfsd4_session *ses)
1516 {
1517         struct nfs4_client *clp = ses->se_client;
1518         struct nfsd4_sessionid *sid;
1519
1520         sid = (struct nfsd4_sessionid *)ses->se_sessionid.data;
1521         sid->clientid = clp->cl_clientid;
1522         sid->sequence = current_sessionid++;
1523         sid->reserved = 0;
1524 }
1525
1526 /*
1527  * The protocol defines ca_maxresponssize_cached to include the size of
1528  * the rpc header, but all we need to cache is the data starting after
1529  * the end of the initial SEQUENCE operation--the rest we regenerate
1530  * each time.  Therefore we can advertise a ca_maxresponssize_cached
1531  * value that is the number of bytes in our cache plus a few additional
1532  * bytes.  In order to stay on the safe side, and not promise more than
1533  * we can cache, those additional bytes must be the minimum possible: 24
1534  * bytes of rpc header (xid through accept state, with AUTH_NULL
1535  * verifier), 12 for the compound header (with zero-length tag), and 44
1536  * for the SEQUENCE op response:
1537  */
1538 #define NFSD_MIN_HDR_SEQ_SZ  (24 + 12 + 44)
1539
1540 static void
1541 free_session_slots(struct nfsd4_session *ses)
1542 {
1543         int i;
1544
1545         for (i = 0; i < ses->se_fchannel.maxreqs; i++) {
1546                 free_svc_cred(&ses->se_slots[i]->sl_cred);
1547                 kfree(ses->se_slots[i]);
1548         }
1549 }
1550
1551 /*
1552  * We don't actually need to cache the rpc and session headers, so we
1553  * can allocate a little less for each slot:
1554  */
1555 static inline u32 slot_bytes(struct nfsd4_channel_attrs *ca)
1556 {
1557         u32 size;
1558
1559         if (ca->maxresp_cached < NFSD_MIN_HDR_SEQ_SZ)
1560                 size = 0;
1561         else
1562                 size = ca->maxresp_cached - NFSD_MIN_HDR_SEQ_SZ;
1563         return size + sizeof(struct nfsd4_slot);
1564 }
1565
1566 /*
1567  * XXX: If we run out of reserved DRC memory we could (up to a point)
1568  * re-negotiate active sessions and reduce their slot usage to make
1569  * room for new connections. For now we just fail the create session.
1570  */
1571 static u32 nfsd4_get_drc_mem(struct nfsd4_channel_attrs *ca, struct nfsd_net *nn)
1572 {
1573         u32 slotsize = slot_bytes(ca);
1574         u32 num = ca->maxreqs;
1575         unsigned long avail, total_avail;
1576         unsigned int scale_factor;
1577
1578         spin_lock(&nfsd_drc_lock);
1579         if (nfsd_drc_max_mem > nfsd_drc_mem_used)
1580                 total_avail = nfsd_drc_max_mem - nfsd_drc_mem_used;
1581         else
1582                 /* We have handed out more space than we chose in
1583                  * set_max_drc() to allow.  That isn't really a
1584                  * problem as long as that doesn't make us think we
1585                  * have lots more due to integer overflow.
1586                  */
1587                 total_avail = 0;
1588         avail = min((unsigned long)NFSD_MAX_MEM_PER_SESSION, total_avail);
1589         /*
1590          * Never use more than a fraction of the remaining memory,
1591          * unless it's the only way to give this client a slot.
1592          * The chosen fraction is either 1/8 or 1/number of threads,
1593          * whichever is smaller.  This ensures there are adequate
1594          * slots to support multiple clients per thread.
1595          * Give the client one slot even if that would require
1596          * over-allocation--it is better than failure.
1597          */
1598         scale_factor = max_t(unsigned int, 8, nn->nfsd_serv->sv_nrthreads);
1599
1600         avail = clamp_t(unsigned long, avail, slotsize,
1601                         total_avail/scale_factor);
1602         num = min_t(int, num, avail / slotsize);
1603         num = max_t(int, num, 1);
1604         nfsd_drc_mem_used += num * slotsize;
1605         spin_unlock(&nfsd_drc_lock);
1606
1607         return num;
1608 }
1609
1610 static void nfsd4_put_drc_mem(struct nfsd4_channel_attrs *ca)
1611 {
1612         int slotsize = slot_bytes(ca);
1613
1614         spin_lock(&nfsd_drc_lock);
1615         nfsd_drc_mem_used -= slotsize * ca->maxreqs;
1616         spin_unlock(&nfsd_drc_lock);
1617 }
1618
1619 static struct nfsd4_session *alloc_session(struct nfsd4_channel_attrs *fattrs,
1620                                            struct nfsd4_channel_attrs *battrs)
1621 {
1622         int numslots = fattrs->maxreqs;
1623         int slotsize = slot_bytes(fattrs);
1624         struct nfsd4_session *new;
1625         int mem, i;
1626
1627         BUILD_BUG_ON(NFSD_MAX_SLOTS_PER_SESSION * sizeof(struct nfsd4_slot *)
1628                         + sizeof(struct nfsd4_session) > PAGE_SIZE);
1629         mem = numslots * sizeof(struct nfsd4_slot *);
1630
1631         new = kzalloc(sizeof(*new) + mem, GFP_KERNEL);
1632         if (!new)
1633                 return NULL;
1634         /* allocate each struct nfsd4_slot and data cache in one piece */
1635         for (i = 0; i < numslots; i++) {
1636                 new->se_slots[i] = kzalloc(slotsize, GFP_KERNEL);
1637                 if (!new->se_slots[i])
1638                         goto out_free;
1639         }
1640
1641         memcpy(&new->se_fchannel, fattrs, sizeof(struct nfsd4_channel_attrs));
1642         memcpy(&new->se_bchannel, battrs, sizeof(struct nfsd4_channel_attrs));
1643
1644         return new;
1645 out_free:
1646         while (i--)
1647                 kfree(new->se_slots[i]);
1648         kfree(new);
1649         return NULL;
1650 }
1651
1652 static void free_conn(struct nfsd4_conn *c)
1653 {
1654         svc_xprt_put(c->cn_xprt);
1655         kfree(c);
1656 }
1657
1658 static void nfsd4_conn_lost(struct svc_xpt_user *u)
1659 {
1660         struct nfsd4_conn *c = container_of(u, struct nfsd4_conn, cn_xpt_user);
1661         struct nfs4_client *clp = c->cn_session->se_client;
1662
1663         spin_lock(&clp->cl_lock);
1664         if (!list_empty(&c->cn_persession)) {
1665                 list_del(&c->cn_persession);
1666                 free_conn(c);
1667         }
1668         nfsd4_probe_callback(clp);
1669         spin_unlock(&clp->cl_lock);
1670 }
1671
1672 static struct nfsd4_conn *alloc_conn(struct svc_rqst *rqstp, u32 flags)
1673 {
1674         struct nfsd4_conn *conn;
1675
1676         conn = kmalloc(sizeof(struct nfsd4_conn), GFP_KERNEL);
1677         if (!conn)
1678                 return NULL;
1679         svc_xprt_get(rqstp->rq_xprt);
1680         conn->cn_xprt = rqstp->rq_xprt;
1681         conn->cn_flags = flags;
1682         INIT_LIST_HEAD(&conn->cn_xpt_user.list);
1683         return conn;
1684 }
1685
1686 static void __nfsd4_hash_conn(struct nfsd4_conn *conn, struct nfsd4_session *ses)
1687 {
1688         conn->cn_session = ses;
1689         list_add(&conn->cn_persession, &ses->se_conns);
1690 }
1691
1692 static void nfsd4_hash_conn(struct nfsd4_conn *conn, struct nfsd4_session *ses)
1693 {
1694         struct nfs4_client *clp = ses->se_client;
1695
1696         spin_lock(&clp->cl_lock);
1697         __nfsd4_hash_conn(conn, ses);
1698         spin_unlock(&clp->cl_lock);
1699 }
1700
1701 static int nfsd4_register_conn(struct nfsd4_conn *conn)
1702 {
1703         conn->cn_xpt_user.callback = nfsd4_conn_lost;
1704         return register_xpt_user(conn->cn_xprt, &conn->cn_xpt_user);
1705 }
1706
1707 static void nfsd4_init_conn(struct svc_rqst *rqstp, struct nfsd4_conn *conn, struct nfsd4_session *ses)
1708 {
1709         int ret;
1710
1711         nfsd4_hash_conn(conn, ses);
1712         ret = nfsd4_register_conn(conn);
1713         if (ret)
1714                 /* oops; xprt is already down: */
1715                 nfsd4_conn_lost(&conn->cn_xpt_user);
1716         /* We may have gained or lost a callback channel: */
1717         nfsd4_probe_callback_sync(ses->se_client);
1718 }
1719
1720 static struct nfsd4_conn *alloc_conn_from_crses(struct svc_rqst *rqstp, struct nfsd4_create_session *cses)
1721 {
1722         u32 dir = NFS4_CDFC4_FORE;
1723
1724         if (cses->flags & SESSION4_BACK_CHAN)
1725                 dir |= NFS4_CDFC4_BACK;
1726         return alloc_conn(rqstp, dir);
1727 }
1728
1729 /* must be called under client_lock */
1730 static void nfsd4_del_conns(struct nfsd4_session *s)
1731 {
1732         struct nfs4_client *clp = s->se_client;
1733         struct nfsd4_conn *c;
1734
1735         spin_lock(&clp->cl_lock);
1736         while (!list_empty(&s->se_conns)) {
1737                 c = list_first_entry(&s->se_conns, struct nfsd4_conn, cn_persession);
1738                 list_del_init(&c->cn_persession);
1739                 spin_unlock(&clp->cl_lock);
1740
1741                 unregister_xpt_user(c->cn_xprt, &c->cn_xpt_user);
1742                 free_conn(c);
1743
1744                 spin_lock(&clp->cl_lock);
1745         }
1746         spin_unlock(&clp->cl_lock);
1747 }
1748
1749 static void __free_session(struct nfsd4_session *ses)
1750 {
1751         free_session_slots(ses);
1752         kfree(ses);
1753 }
1754
1755 static void free_session(struct nfsd4_session *ses)
1756 {
1757         nfsd4_del_conns(ses);
1758         nfsd4_put_drc_mem(&ses->se_fchannel);
1759         __free_session(ses);
1760 }
1761
1762 static void init_session(struct svc_rqst *rqstp, struct nfsd4_session *new, struct nfs4_client *clp, struct nfsd4_create_session *cses)
1763 {
1764         int idx;
1765         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
1766
1767         new->se_client = clp;
1768         gen_sessionid(new);
1769
1770         INIT_LIST_HEAD(&new->se_conns);
1771
1772         new->se_cb_seq_nr = 1;
1773         new->se_flags = cses->flags;
1774         new->se_cb_prog = cses->callback_prog;
1775         new->se_cb_sec = cses->cb_sec;
1776         atomic_set(&new->se_ref, 0);
1777         idx = hash_sessionid(&new->se_sessionid);
1778         list_add(&new->se_hash, &nn->sessionid_hashtbl[idx]);
1779         spin_lock(&clp->cl_lock);
1780         list_add(&new->se_perclnt, &clp->cl_sessions);
1781         spin_unlock(&clp->cl_lock);
1782
1783         {
1784                 struct sockaddr *sa = svc_addr(rqstp);
1785                 /*
1786                  * This is a little silly; with sessions there's no real
1787                  * use for the callback address.  Use the peer address
1788                  * as a reasonable default for now, but consider fixing
1789                  * the rpc client not to require an address in the
1790                  * future:
1791                  */
1792                 rpc_copy_addr((struct sockaddr *)&clp->cl_cb_conn.cb_addr, sa);
1793                 clp->cl_cb_conn.cb_addrlen = svc_addr_len(sa);
1794         }
1795 }
1796
1797 /* caller must hold client_lock */
1798 static struct nfsd4_session *
1799 __find_in_sessionid_hashtbl(struct nfs4_sessionid *sessionid, struct net *net)
1800 {
1801         struct nfsd4_session *elem;
1802         int idx;
1803         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
1804
1805         lockdep_assert_held(&nn->client_lock);
1806
1807         dump_sessionid(__func__, sessionid);
1808         idx = hash_sessionid(sessionid);
1809         /* Search in the appropriate list */
1810         list_for_each_entry(elem, &nn->sessionid_hashtbl[idx], se_hash) {
1811                 if (!memcmp(elem->se_sessionid.data, sessionid->data,
1812                             NFS4_MAX_SESSIONID_LEN)) {
1813                         return elem;
1814                 }
1815         }
1816
1817         dprintk("%s: session not found\n", __func__);
1818         return NULL;
1819 }
1820
1821 static struct nfsd4_session *
1822 find_in_sessionid_hashtbl(struct nfs4_sessionid *sessionid, struct net *net,
1823                 __be32 *ret)
1824 {
1825         struct nfsd4_session *session;
1826         __be32 status = nfserr_badsession;
1827
1828         session = __find_in_sessionid_hashtbl(sessionid, net);
1829         if (!session)
1830                 goto out;
1831         status = nfsd4_get_session_locked(session);
1832         if (status)
1833                 session = NULL;
1834 out:
1835         *ret = status;
1836         return session;
1837 }
1838
1839 /* caller must hold client_lock */
1840 static void
1841 unhash_session(struct nfsd4_session *ses)
1842 {
1843         struct nfs4_client *clp = ses->se_client;
1844         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
1845
1846         lockdep_assert_held(&nn->client_lock);
1847
1848         list_del(&ses->se_hash);
1849         spin_lock(&ses->se_client->cl_lock);
1850         list_del(&ses->se_perclnt);
1851         spin_unlock(&ses->se_client->cl_lock);
1852 }
1853
1854 /* SETCLIENTID and SETCLIENTID_CONFIRM Helper functions */
1855 static int
1856 STALE_CLIENTID(clientid_t *clid, struct nfsd_net *nn)
1857 {
1858         /*
1859          * We're assuming the clid was not given out from a boot
1860          * precisely 2^32 (about 136 years) before this one.  That seems
1861          * a safe assumption:
1862          */
1863         if (clid->cl_boot == (u32)nn->boot_time)
1864                 return 0;
1865         dprintk("NFSD stale clientid (%08x/%08x) boot_time %08lx\n",
1866                 clid->cl_boot, clid->cl_id, nn->boot_time);
1867         return 1;
1868 }
1869
1870 /*
1871  * XXX Should we use a slab cache ?
1872  * This type of memory management is somewhat inefficient, but we use it
1873  * anyway since SETCLIENTID is not a common operation.
1874  */
1875 static struct nfs4_client *alloc_client(struct xdr_netobj name)
1876 {
1877         struct nfs4_client *clp;
1878         int i;
1879
1880         clp = kmem_cache_zalloc(client_slab, GFP_KERNEL);
1881         if (clp == NULL)
1882                 return NULL;
1883         xdr_netobj_dup(&clp->cl_name, &name, GFP_KERNEL);
1884         if (clp->cl_name.data == NULL)
1885                 goto err_no_name;
1886         clp->cl_ownerstr_hashtbl = kmalloc_array(OWNER_HASH_SIZE,
1887                                                  sizeof(struct list_head),
1888                                                  GFP_KERNEL);
1889         if (!clp->cl_ownerstr_hashtbl)
1890                 goto err_no_hashtbl;
1891         for (i = 0; i < OWNER_HASH_SIZE; i++)
1892                 INIT_LIST_HEAD(&clp->cl_ownerstr_hashtbl[i]);
1893         INIT_LIST_HEAD(&clp->cl_sessions);
1894         idr_init(&clp->cl_stateids);
1895         atomic_set(&clp->cl_rpc_users, 0);
1896         clp->cl_cb_state = NFSD4_CB_UNKNOWN;
1897         INIT_LIST_HEAD(&clp->cl_idhash);
1898         INIT_LIST_HEAD(&clp->cl_openowners);
1899         INIT_LIST_HEAD(&clp->cl_delegations);
1900         INIT_LIST_HEAD(&clp->cl_lru);
1901         INIT_LIST_HEAD(&clp->cl_revoked);
1902 #ifdef CONFIG_NFSD_PNFS
1903         INIT_LIST_HEAD(&clp->cl_lo_states);
1904 #endif
1905         INIT_LIST_HEAD(&clp->async_copies);
1906         spin_lock_init(&clp->async_lock);
1907         spin_lock_init(&clp->cl_lock);
1908         rpc_init_wait_queue(&clp->cl_cb_waitq, "Backchannel slot table");
1909         return clp;
1910 err_no_hashtbl:
1911         kfree(clp->cl_name.data);
1912 err_no_name:
1913         kmem_cache_free(client_slab, clp);
1914         return NULL;
1915 }
1916
1917 static void __free_client(struct kref *k)
1918 {
1919         struct nfsdfs_client *c = container_of(k, struct nfsdfs_client, cl_ref);
1920         struct nfs4_client *clp = container_of(c, struct nfs4_client, cl_nfsdfs);
1921
1922         free_svc_cred(&clp->cl_cred);
1923         kfree(clp->cl_ownerstr_hashtbl);
1924         kfree(clp->cl_name.data);
1925         kfree(clp->cl_nii_domain.data);
1926         kfree(clp->cl_nii_name.data);
1927         idr_destroy(&clp->cl_stateids);
1928         kmem_cache_free(client_slab, clp);
1929 }
1930
1931 static void drop_client(struct nfs4_client *clp)
1932 {
1933         kref_put(&clp->cl_nfsdfs.cl_ref, __free_client);
1934 }
1935
1936 static void
1937 free_client(struct nfs4_client *clp)
1938 {
1939         while (!list_empty(&clp->cl_sessions)) {
1940                 struct nfsd4_session *ses;
1941                 ses = list_entry(clp->cl_sessions.next, struct nfsd4_session,
1942                                 se_perclnt);
1943                 list_del(&ses->se_perclnt);
1944                 WARN_ON_ONCE(atomic_read(&ses->se_ref));
1945                 free_session(ses);
1946         }
1947         rpc_destroy_wait_queue(&clp->cl_cb_waitq);
1948         if (clp->cl_nfsd_dentry) {
1949                 nfsd_client_rmdir(clp->cl_nfsd_dentry);
1950                 clp->cl_nfsd_dentry = NULL;
1951                 wake_up_all(&expiry_wq);
1952         }
1953         drop_client(clp);
1954 }
1955
1956 /* must be called under the client_lock */
1957 static void
1958 unhash_client_locked(struct nfs4_client *clp)
1959 {
1960         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
1961         struct nfsd4_session *ses;
1962
1963         lockdep_assert_held(&nn->client_lock);
1964
1965         /* Mark the client as expired! */
1966         clp->cl_time = 0;
1967         /* Make it invisible */
1968         if (!list_empty(&clp->cl_idhash)) {
1969                 list_del_init(&clp->cl_idhash);
1970                 if (test_bit(NFSD4_CLIENT_CONFIRMED, &clp->cl_flags))
1971                         rb_erase(&clp->cl_namenode, &nn->conf_name_tree);
1972                 else
1973                         rb_erase(&clp->cl_namenode, &nn->unconf_name_tree);
1974         }
1975         list_del_init(&clp->cl_lru);
1976         spin_lock(&clp->cl_lock);
1977         list_for_each_entry(ses, &clp->cl_sessions, se_perclnt)
1978                 list_del_init(&ses->se_hash);
1979         spin_unlock(&clp->cl_lock);
1980 }
1981
1982 static void
1983 unhash_client(struct nfs4_client *clp)
1984 {
1985         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
1986
1987         spin_lock(&nn->client_lock);
1988         unhash_client_locked(clp);
1989         spin_unlock(&nn->client_lock);
1990 }
1991
1992 static __be32 mark_client_expired_locked(struct nfs4_client *clp)
1993 {
1994         if (atomic_read(&clp->cl_rpc_users))
1995                 return nfserr_jukebox;
1996         unhash_client_locked(clp);
1997         return nfs_ok;
1998 }
1999
2000 static void
2001 __destroy_client(struct nfs4_client *clp)
2002 {
2003         int i;
2004         struct nfs4_openowner *oo;
2005         struct nfs4_delegation *dp;
2006         struct list_head reaplist;
2007
2008         INIT_LIST_HEAD(&reaplist);
2009         spin_lock(&state_lock);
2010         while (!list_empty(&clp->cl_delegations)) {
2011                 dp = list_entry(clp->cl_delegations.next, struct nfs4_delegation, dl_perclnt);
2012                 WARN_ON(!unhash_delegation_locked(dp));
2013                 list_add(&dp->dl_recall_lru, &reaplist);
2014         }
2015         spin_unlock(&state_lock);
2016         while (!list_empty(&reaplist)) {
2017                 dp = list_entry(reaplist.next, struct nfs4_delegation, dl_recall_lru);
2018                 list_del_init(&dp->dl_recall_lru);
2019                 destroy_unhashed_deleg(dp);
2020         }
2021         while (!list_empty(&clp->cl_revoked)) {
2022                 dp = list_entry(clp->cl_revoked.next, struct nfs4_delegation, dl_recall_lru);
2023                 list_del_init(&dp->dl_recall_lru);
2024                 nfs4_put_stid(&dp->dl_stid);
2025         }
2026         while (!list_empty(&clp->cl_openowners)) {
2027                 oo = list_entry(clp->cl_openowners.next, struct nfs4_openowner, oo_perclient);
2028                 nfs4_get_stateowner(&oo->oo_owner);
2029                 release_openowner(oo);
2030         }
2031         for (i = 0; i < OWNER_HASH_SIZE; i++) {
2032                 struct nfs4_stateowner *so, *tmp;
2033
2034                 list_for_each_entry_safe(so, tmp, &clp->cl_ownerstr_hashtbl[i],
2035                                          so_strhash) {
2036                         /* Should be no openowners at this point */
2037                         WARN_ON_ONCE(so->so_is_open_owner);
2038                         remove_blocked_locks(lockowner(so));
2039                 }
2040         }
2041         nfsd4_return_all_client_layouts(clp);
2042         nfsd4_shutdown_copy(clp);
2043         nfsd4_shutdown_callback(clp);
2044         if (clp->cl_cb_conn.cb_xprt)
2045                 svc_xprt_put(clp->cl_cb_conn.cb_xprt);
2046         free_client(clp);
2047         wake_up_all(&expiry_wq);
2048 }
2049
2050 static void
2051 destroy_client(struct nfs4_client *clp)
2052 {
2053         unhash_client(clp);
2054         __destroy_client(clp);
2055 }
2056
2057 static void inc_reclaim_complete(struct nfs4_client *clp)
2058 {
2059         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
2060
2061         if (!nn->track_reclaim_completes)
2062                 return;
2063         if (!nfsd4_find_reclaim_client(clp->cl_name, nn))
2064                 return;
2065         if (atomic_inc_return(&nn->nr_reclaim_complete) ==
2066                         nn->reclaim_str_hashtbl_size) {
2067                 printk(KERN_INFO "NFSD: all clients done reclaiming, ending NFSv4 grace period (net %x)\n",
2068                                 clp->net->ns.inum);
2069                 nfsd4_end_grace(nn);
2070         }
2071 }
2072
2073 static void expire_client(struct nfs4_client *clp)
2074 {
2075         unhash_client(clp);
2076         nfsd4_client_record_remove(clp);
2077         __destroy_client(clp);
2078 }
2079
2080 static void copy_verf(struct nfs4_client *target, nfs4_verifier *source)
2081 {
2082         memcpy(target->cl_verifier.data, source->data,
2083                         sizeof(target->cl_verifier.data));
2084 }
2085
2086 static void copy_clid(struct nfs4_client *target, struct nfs4_client *source)
2087 {
2088         target->cl_clientid.cl_boot = source->cl_clientid.cl_boot;
2089         target->cl_clientid.cl_id = source->cl_clientid.cl_id;
2090 }
2091
2092 static int copy_cred(struct svc_cred *target, struct svc_cred *source)
2093 {
2094         target->cr_principal = kstrdup(source->cr_principal, GFP_KERNEL);
2095         target->cr_raw_principal = kstrdup(source->cr_raw_principal,
2096                                                                 GFP_KERNEL);
2097         target->cr_targ_princ = kstrdup(source->cr_targ_princ, GFP_KERNEL);
2098         if ((source->cr_principal && !target->cr_principal) ||
2099             (source->cr_raw_principal && !target->cr_raw_principal) ||
2100             (source->cr_targ_princ && !target->cr_targ_princ))
2101                 return -ENOMEM;
2102
2103         target->cr_flavor = source->cr_flavor;
2104         target->cr_uid = source->cr_uid;
2105         target->cr_gid = source->cr_gid;
2106         target->cr_group_info = source->cr_group_info;
2107         get_group_info(target->cr_group_info);
2108         target->cr_gss_mech = source->cr_gss_mech;
2109         if (source->cr_gss_mech)
2110                 gss_mech_get(source->cr_gss_mech);
2111         return 0;
2112 }
2113
2114 static int
2115 compare_blob(const struct xdr_netobj *o1, const struct xdr_netobj *o2)
2116 {
2117         if (o1->len < o2->len)
2118                 return -1;
2119         if (o1->len > o2->len)
2120                 return 1;
2121         return memcmp(o1->data, o2->data, o1->len);
2122 }
2123
2124 static int
2125 same_verf(nfs4_verifier *v1, nfs4_verifier *v2)
2126 {
2127         return 0 == memcmp(v1->data, v2->data, sizeof(v1->data));
2128 }
2129
2130 static int
2131 same_clid(clientid_t *cl1, clientid_t *cl2)
2132 {
2133         return (cl1->cl_boot == cl2->cl_boot) && (cl1->cl_id == cl2->cl_id);
2134 }
2135
2136 static bool groups_equal(struct group_info *g1, struct group_info *g2)
2137 {
2138         int i;
2139
2140         if (g1->ngroups != g2->ngroups)
2141                 return false;
2142         for (i=0; i<g1->ngroups; i++)
2143                 if (!gid_eq(g1->gid[i], g2->gid[i]))
2144                         return false;
2145         return true;
2146 }
2147
2148 /*
2149  * RFC 3530 language requires clid_inuse be returned when the
2150  * "principal" associated with a requests differs from that previously
2151  * used.  We use uid, gid's, and gss principal string as our best
2152  * approximation.  We also don't want to allow non-gss use of a client
2153  * established using gss: in theory cr_principal should catch that
2154  * change, but in practice cr_principal can be null even in the gss case
2155  * since gssd doesn't always pass down a principal string.
2156  */
2157 static bool is_gss_cred(struct svc_cred *cr)
2158 {
2159         /* Is cr_flavor one of the gss "pseudoflavors"?: */
2160         return (cr->cr_flavor > RPC_AUTH_MAXFLAVOR);
2161 }
2162
2163
2164 static bool
2165 same_creds(struct svc_cred *cr1, struct svc_cred *cr2)
2166 {
2167         if ((is_gss_cred(cr1) != is_gss_cred(cr2))
2168                 || (!uid_eq(cr1->cr_uid, cr2->cr_uid))
2169                 || (!gid_eq(cr1->cr_gid, cr2->cr_gid))
2170                 || !groups_equal(cr1->cr_group_info, cr2->cr_group_info))
2171                 return false;
2172         /* XXX: check that cr_targ_princ fields match ? */
2173         if (cr1->cr_principal == cr2->cr_principal)
2174                 return true;
2175         if (!cr1->cr_principal || !cr2->cr_principal)
2176                 return false;
2177         return 0 == strcmp(cr1->cr_principal, cr2->cr_principal);
2178 }
2179
2180 static bool svc_rqst_integrity_protected(struct svc_rqst *rqstp)
2181 {
2182         struct svc_cred *cr = &rqstp->rq_cred;
2183         u32 service;
2184
2185         if (!cr->cr_gss_mech)
2186                 return false;
2187         service = gss_pseudoflavor_to_service(cr->cr_gss_mech, cr->cr_flavor);
2188         return service == RPC_GSS_SVC_INTEGRITY ||
2189                service == RPC_GSS_SVC_PRIVACY;
2190 }
2191
2192 bool nfsd4_mach_creds_match(struct nfs4_client *cl, struct svc_rqst *rqstp)
2193 {
2194         struct svc_cred *cr = &rqstp->rq_cred;
2195
2196         if (!cl->cl_mach_cred)
2197                 return true;
2198         if (cl->cl_cred.cr_gss_mech != cr->cr_gss_mech)
2199                 return false;
2200         if (!svc_rqst_integrity_protected(rqstp))
2201                 return false;
2202         if (cl->cl_cred.cr_raw_principal)
2203                 return 0 == strcmp(cl->cl_cred.cr_raw_principal,
2204                                                 cr->cr_raw_principal);
2205         if (!cr->cr_principal)
2206                 return false;
2207         return 0 == strcmp(cl->cl_cred.cr_principal, cr->cr_principal);
2208 }
2209
2210 static void gen_confirm(struct nfs4_client *clp, struct nfsd_net *nn)
2211 {
2212         __be32 verf[2];
2213
2214         /*
2215          * This is opaque to client, so no need to byte-swap. Use
2216          * __force to keep sparse happy
2217          */
2218         verf[0] = (__force __be32)get_seconds();
2219         verf[1] = (__force __be32)nn->clverifier_counter++;
2220         memcpy(clp->cl_confirm.data, verf, sizeof(clp->cl_confirm.data));
2221 }
2222
2223 static void gen_clid(struct nfs4_client *clp, struct nfsd_net *nn)
2224 {
2225         clp->cl_clientid.cl_boot = nn->boot_time;
2226         clp->cl_clientid.cl_id = nn->clientid_counter++;
2227         gen_confirm(clp, nn);
2228 }
2229
2230 static struct nfs4_stid *
2231 find_stateid_locked(struct nfs4_client *cl, stateid_t *t)
2232 {
2233         struct nfs4_stid *ret;
2234
2235         ret = idr_find(&cl->cl_stateids, t->si_opaque.so_id);
2236         if (!ret || !ret->sc_type)
2237                 return NULL;
2238         return ret;
2239 }
2240
2241 static struct nfs4_stid *
2242 find_stateid_by_type(struct nfs4_client *cl, stateid_t *t, char typemask)
2243 {
2244         struct nfs4_stid *s;
2245
2246         spin_lock(&cl->cl_lock);
2247         s = find_stateid_locked(cl, t);
2248         if (s != NULL) {
2249                 if (typemask & s->sc_type)
2250                         refcount_inc(&s->sc_count);
2251                 else
2252                         s = NULL;
2253         }
2254         spin_unlock(&cl->cl_lock);
2255         return s;
2256 }
2257
2258 static struct nfs4_client *get_nfsdfs_clp(struct inode *inode)
2259 {
2260         struct nfsdfs_client *nc;
2261         nc = get_nfsdfs_client(inode);
2262         if (!nc)
2263                 return NULL;
2264         return container_of(nc, struct nfs4_client, cl_nfsdfs);
2265 }
2266
2267 static void seq_quote_mem(struct seq_file *m, char *data, int len)
2268 {
2269         seq_printf(m, "\"");
2270         seq_escape_mem_ascii(m, data, len);
2271         seq_printf(m, "\"");
2272 }
2273
2274 static int client_info_show(struct seq_file *m, void *v)
2275 {
2276         struct inode *inode = m->private;
2277         struct nfs4_client *clp;
2278         u64 clid;
2279
2280         clp = get_nfsdfs_clp(inode);
2281         if (!clp)
2282                 return -ENXIO;
2283         memcpy(&clid, &clp->cl_clientid, sizeof(clid));
2284         seq_printf(m, "clientid: 0x%llx\n", clid);
2285         seq_printf(m, "address: \"%pISpc\"\n", (struct sockaddr *)&clp->cl_addr);
2286         seq_printf(m, "name: ");
2287         seq_quote_mem(m, clp->cl_name.data, clp->cl_name.len);
2288         seq_printf(m, "\nminor version: %d\n", clp->cl_minorversion);
2289         if (clp->cl_nii_domain.data) {
2290                 seq_printf(m, "Implementation domain: ");
2291                 seq_quote_mem(m, clp->cl_nii_domain.data,
2292                                         clp->cl_nii_domain.len);
2293                 seq_printf(m, "\nImplementation name: ");
2294                 seq_quote_mem(m, clp->cl_nii_name.data, clp->cl_nii_name.len);
2295                 seq_printf(m, "\nImplementation time: [%ld, %ld]\n",
2296                         clp->cl_nii_time.tv_sec, clp->cl_nii_time.tv_nsec);
2297         }
2298         drop_client(clp);
2299
2300         return 0;
2301 }
2302
2303 static int client_info_open(struct inode *inode, struct file *file)
2304 {
2305         return single_open(file, client_info_show, inode);
2306 }
2307
2308 static const struct file_operations client_info_fops = {
2309         .open           = client_info_open,
2310         .read           = seq_read,
2311         .llseek         = seq_lseek,
2312         .release        = single_release,
2313 };
2314
2315 static void *states_start(struct seq_file *s, loff_t *pos)
2316         __acquires(&clp->cl_lock)
2317 {
2318         struct nfs4_client *clp = s->private;
2319         unsigned long id = *pos;
2320         void *ret;
2321
2322         spin_lock(&clp->cl_lock);
2323         ret = idr_get_next_ul(&clp->cl_stateids, &id);
2324         *pos = id;
2325         return ret;
2326 }
2327
2328 static void *states_next(struct seq_file *s, void *v, loff_t *pos)
2329 {
2330         struct nfs4_client *clp = s->private;
2331         unsigned long id = *pos;
2332         void *ret;
2333
2334         id = *pos;
2335         id++;
2336         ret = idr_get_next_ul(&clp->cl_stateids, &id);
2337         *pos = id;
2338         return ret;
2339 }
2340
2341 static void states_stop(struct seq_file *s, void *v)
2342         __releases(&clp->cl_lock)
2343 {
2344         struct nfs4_client *clp = s->private;
2345
2346         spin_unlock(&clp->cl_lock);
2347 }
2348
2349 static void nfs4_show_superblock(struct seq_file *s, struct nfsd_file *f)
2350 {
2351         struct inode *inode = f->nf_inode;
2352
2353         seq_printf(s, "superblock: \"%02x:%02x:%ld\"",
2354                                         MAJOR(inode->i_sb->s_dev),
2355                                          MINOR(inode->i_sb->s_dev),
2356                                          inode->i_ino);
2357 }
2358
2359 static void nfs4_show_owner(struct seq_file *s, struct nfs4_stateowner *oo)
2360 {
2361         seq_printf(s, "owner: ");
2362         seq_quote_mem(s, oo->so_owner.data, oo->so_owner.len);
2363 }
2364
2365 static int nfs4_show_open(struct seq_file *s, struct nfs4_stid *st)
2366 {
2367         struct nfs4_ol_stateid *ols;
2368         struct nfs4_file *nf;
2369         struct nfsd_file *file;
2370         struct nfs4_stateowner *oo;
2371         unsigned int access, deny;
2372
2373         if (st->sc_type != NFS4_OPEN_STID && st->sc_type != NFS4_LOCK_STID)
2374                 return 0; /* XXX: or SEQ_SKIP? */
2375         ols = openlockstateid(st);
2376         oo = ols->st_stateowner;
2377         nf = st->sc_file;
2378         file = find_any_file(nf);
2379
2380         seq_printf(s, "- 0x%16phN: { type: open, ", &st->sc_stateid);
2381
2382         access = bmap_to_share_mode(ols->st_access_bmap);
2383         deny   = bmap_to_share_mode(ols->st_deny_bmap);
2384
2385         seq_printf(s, "access: \%s\%s, ",
2386                 access & NFS4_SHARE_ACCESS_READ ? "r" : "-",
2387                 access & NFS4_SHARE_ACCESS_WRITE ? "w" : "-");
2388         seq_printf(s, "deny: \%s\%s, ",
2389                 deny & NFS4_SHARE_ACCESS_READ ? "r" : "-",
2390                 deny & NFS4_SHARE_ACCESS_WRITE ? "w" : "-");
2391
2392         nfs4_show_superblock(s, file);
2393         seq_printf(s, ", ");
2394         nfs4_show_owner(s, oo);
2395         seq_printf(s, " }\n");
2396         nfsd_file_put(file);
2397
2398         return 0;
2399 }
2400
2401 static int nfs4_show_lock(struct seq_file *s, struct nfs4_stid *st)
2402 {
2403         struct nfs4_ol_stateid *ols;
2404         struct nfs4_file *nf;
2405         struct nfsd_file *file;
2406         struct nfs4_stateowner *oo;
2407
2408         ols = openlockstateid(st);
2409         oo = ols->st_stateowner;
2410         nf = st->sc_file;
2411         file = find_any_file(nf);
2412
2413         seq_printf(s, "- 0x%16phN: { type: lock, ", &st->sc_stateid);
2414
2415         /*
2416          * Note: a lock stateid isn't really the same thing as a lock,
2417          * it's the locking state held by one owner on a file, and there
2418          * may be multiple (or no) lock ranges associated with it.
2419          * (Same for the matter is true of open stateids.)
2420          */
2421
2422         nfs4_show_superblock(s, file);
2423         /* XXX: open stateid? */
2424         seq_printf(s, ", ");
2425         nfs4_show_owner(s, oo);
2426         seq_printf(s, " }\n");
2427         nfsd_file_put(file);
2428
2429         return 0;
2430 }
2431
2432 static int nfs4_show_deleg(struct seq_file *s, struct nfs4_stid *st)
2433 {
2434         struct nfs4_delegation *ds;
2435         struct nfs4_file *nf;
2436         struct nfsd_file *file;
2437
2438         ds = delegstateid(st);
2439         nf = st->sc_file;
2440         file = nf->fi_deleg_file;
2441
2442         seq_printf(s, "- 0x%16phN: { type: deleg, ", &st->sc_stateid);
2443
2444         /* Kinda dead code as long as we only support read delegs: */
2445         seq_printf(s, "access: %s, ",
2446                 ds->dl_type == NFS4_OPEN_DELEGATE_READ ? "r" : "w");
2447
2448         /* XXX: lease time, whether it's being recalled. */
2449
2450         nfs4_show_superblock(s, file);
2451         seq_printf(s, " }\n");
2452
2453         return 0;
2454 }
2455
2456 static int nfs4_show_layout(struct seq_file *s, struct nfs4_stid *st)
2457 {
2458         struct nfs4_layout_stateid *ls;
2459         struct nfsd_file *file;
2460
2461         ls = container_of(st, struct nfs4_layout_stateid, ls_stid);
2462         file = ls->ls_file;
2463
2464         seq_printf(s, "- 0x%16phN: { type: layout, ", &st->sc_stateid);
2465
2466         /* XXX: What else would be useful? */
2467
2468         nfs4_show_superblock(s, file);
2469         seq_printf(s, " }\n");
2470
2471         return 0;
2472 }
2473
2474 static int states_show(struct seq_file *s, void *v)
2475 {
2476         struct nfs4_stid *st = v;
2477
2478         switch (st->sc_type) {
2479         case NFS4_OPEN_STID:
2480                 return nfs4_show_open(s, st);
2481         case NFS4_LOCK_STID:
2482                 return nfs4_show_lock(s, st);
2483         case NFS4_DELEG_STID:
2484                 return nfs4_show_deleg(s, st);
2485         case NFS4_LAYOUT_STID:
2486                 return nfs4_show_layout(s, st);
2487         default:
2488                 return 0; /* XXX: or SEQ_SKIP? */
2489         }
2490         /* XXX: copy stateids? */
2491 }
2492
2493 static struct seq_operations states_seq_ops = {
2494         .start = states_start,
2495         .next = states_next,
2496         .stop = states_stop,
2497         .show = states_show
2498 };
2499
2500 static int client_states_open(struct inode *inode, struct file *file)
2501 {
2502         struct seq_file *s;
2503         struct nfs4_client *clp;
2504         int ret;
2505
2506         clp = get_nfsdfs_clp(inode);
2507         if (!clp)
2508                 return -ENXIO;
2509
2510         ret = seq_open(file, &states_seq_ops);
2511         if (ret)
2512                 return ret;
2513         s = file->private_data;
2514         s->private = clp;
2515         return 0;
2516 }
2517
2518 static int client_opens_release(struct inode *inode, struct file *file)
2519 {
2520         struct seq_file *m = file->private_data;
2521         struct nfs4_client *clp = m->private;
2522
2523         /* XXX: alternatively, we could get/drop in seq start/stop */
2524         drop_client(clp);
2525         return 0;
2526 }
2527
2528 static const struct file_operations client_states_fops = {
2529         .open           = client_states_open,
2530         .read           = seq_read,
2531         .llseek         = seq_lseek,
2532         .release        = client_opens_release,
2533 };
2534
2535 /*
2536  * Normally we refuse to destroy clients that are in use, but here the
2537  * administrator is telling us to just do it.  We also want to wait
2538  * so the caller has a guarantee that the client's locks are gone by
2539  * the time the write returns:
2540  */
2541 static void force_expire_client(struct nfs4_client *clp)
2542 {
2543         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
2544         bool already_expired;
2545
2546         spin_lock(&clp->cl_lock);
2547         clp->cl_time = 0;
2548         spin_unlock(&clp->cl_lock);
2549
2550         wait_event(expiry_wq, atomic_read(&clp->cl_rpc_users) == 0);
2551         spin_lock(&nn->client_lock);
2552         already_expired = list_empty(&clp->cl_lru);
2553         if (!already_expired)
2554                 unhash_client_locked(clp);
2555         spin_unlock(&nn->client_lock);
2556
2557         if (!already_expired)
2558                 expire_client(clp);
2559         else
2560                 wait_event(expiry_wq, clp->cl_nfsd_dentry == NULL);
2561 }
2562
2563 static ssize_t client_ctl_write(struct file *file, const char __user *buf,
2564                                    size_t size, loff_t *pos)
2565 {
2566         char *data;
2567         struct nfs4_client *clp;
2568
2569         data = simple_transaction_get(file, buf, size);
2570         if (IS_ERR(data))
2571                 return PTR_ERR(data);
2572         if (size != 7 || 0 != memcmp(data, "expire\n", 7))
2573                 return -EINVAL;
2574         clp = get_nfsdfs_clp(file_inode(file));
2575         if (!clp)
2576                 return -ENXIO;
2577         force_expire_client(clp);
2578         drop_client(clp);
2579         return 7;
2580 }
2581
2582 static const struct file_operations client_ctl_fops = {
2583         .write          = client_ctl_write,
2584         .release        = simple_transaction_release,
2585 };
2586
2587 static const struct tree_descr client_files[] = {
2588         [0] = {"info", &client_info_fops, S_IRUSR},
2589         [1] = {"states", &client_states_fops, S_IRUSR},
2590         [2] = {"ctl", &client_ctl_fops, S_IRUSR|S_IWUSR},
2591         [3] = {""},
2592 };
2593
2594 static struct nfs4_client *create_client(struct xdr_netobj name,
2595                 struct svc_rqst *rqstp, nfs4_verifier *verf)
2596 {
2597         struct nfs4_client *clp;
2598         struct sockaddr *sa = svc_addr(rqstp);
2599         int ret;
2600         struct net *net = SVC_NET(rqstp);
2601         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
2602
2603         clp = alloc_client(name);
2604         if (clp == NULL)
2605                 return NULL;
2606
2607         ret = copy_cred(&clp->cl_cred, &rqstp->rq_cred);
2608         if (ret) {
2609                 free_client(clp);
2610                 return NULL;
2611         }
2612         gen_clid(clp, nn);
2613         kref_init(&clp->cl_nfsdfs.cl_ref);
2614         nfsd4_init_cb(&clp->cl_cb_null, clp, NULL, NFSPROC4_CLNT_CB_NULL);
2615         clp->cl_time = get_seconds();
2616         clear_bit(0, &clp->cl_cb_slot_busy);
2617         copy_verf(clp, verf);
2618         memcpy(&clp->cl_addr, sa, sizeof(struct sockaddr_storage));
2619         clp->cl_cb_session = NULL;
2620         clp->net = net;
2621         clp->cl_nfsd_dentry = nfsd_client_mkdir(nn, &clp->cl_nfsdfs,
2622                         clp->cl_clientid.cl_id - nn->clientid_base,
2623                         client_files);
2624         if (!clp->cl_nfsd_dentry) {
2625                 free_client(clp);
2626                 return NULL;
2627         }
2628         return clp;
2629 }
2630
2631 static void
2632 add_clp_to_name_tree(struct nfs4_client *new_clp, struct rb_root *root)
2633 {
2634         struct rb_node **new = &(root->rb_node), *parent = NULL;
2635         struct nfs4_client *clp;
2636
2637         while (*new) {
2638                 clp = rb_entry(*new, struct nfs4_client, cl_namenode);
2639                 parent = *new;
2640
2641                 if (compare_blob(&clp->cl_name, &new_clp->cl_name) > 0)
2642                         new = &((*new)->rb_left);
2643                 else
2644                         new = &((*new)->rb_right);
2645         }
2646
2647         rb_link_node(&new_clp->cl_namenode, parent, new);
2648         rb_insert_color(&new_clp->cl_namenode, root);
2649 }
2650
2651 static struct nfs4_client *
2652 find_clp_in_name_tree(struct xdr_netobj *name, struct rb_root *root)
2653 {
2654         int cmp;
2655         struct rb_node *node = root->rb_node;
2656         struct nfs4_client *clp;
2657
2658         while (node) {
2659                 clp = rb_entry(node, struct nfs4_client, cl_namenode);
2660                 cmp = compare_blob(&clp->cl_name, name);
2661                 if (cmp > 0)
2662                         node = node->rb_left;
2663                 else if (cmp < 0)
2664                         node = node->rb_right;
2665                 else
2666                         return clp;
2667         }
2668         return NULL;
2669 }
2670
2671 static void
2672 add_to_unconfirmed(struct nfs4_client *clp)
2673 {
2674         unsigned int idhashval;
2675         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
2676
2677         lockdep_assert_held(&nn->client_lock);
2678
2679         clear_bit(NFSD4_CLIENT_CONFIRMED, &clp->cl_flags);
2680         add_clp_to_name_tree(clp, &nn->unconf_name_tree);
2681         idhashval = clientid_hashval(clp->cl_clientid.cl_id);
2682         list_add(&clp->cl_idhash, &nn->unconf_id_hashtbl[idhashval]);
2683         renew_client_locked(clp);
2684 }
2685
2686 static void
2687 move_to_confirmed(struct nfs4_client *clp)
2688 {
2689         unsigned int idhashval = clientid_hashval(clp->cl_clientid.cl_id);
2690         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
2691
2692         lockdep_assert_held(&nn->client_lock);
2693
2694         dprintk("NFSD: move_to_confirm nfs4_client %p\n", clp);
2695         list_move(&clp->cl_idhash, &nn->conf_id_hashtbl[idhashval]);
2696         rb_erase(&clp->cl_namenode, &nn->unconf_name_tree);
2697         add_clp_to_name_tree(clp, &nn->conf_name_tree);
2698         set_bit(NFSD4_CLIENT_CONFIRMED, &clp->cl_flags);
2699         renew_client_locked(clp);
2700 }
2701
2702 static struct nfs4_client *
2703 find_client_in_id_table(struct list_head *tbl, clientid_t *clid, bool sessions)
2704 {
2705         struct nfs4_client *clp;
2706         unsigned int idhashval = clientid_hashval(clid->cl_id);
2707
2708         list_for_each_entry(clp, &tbl[idhashval], cl_idhash) {
2709                 if (same_clid(&clp->cl_clientid, clid)) {
2710                         if ((bool)clp->cl_minorversion != sessions)
2711                                 return NULL;
2712                         renew_client_locked(clp);
2713                         return clp;
2714                 }
2715         }
2716         return NULL;
2717 }
2718
2719 static struct nfs4_client *
2720 find_confirmed_client(clientid_t *clid, bool sessions, struct nfsd_net *nn)
2721 {
2722         struct list_head *tbl = nn->conf_id_hashtbl;
2723
2724         lockdep_assert_held(&nn->client_lock);
2725         return find_client_in_id_table(tbl, clid, sessions);
2726 }
2727
2728 static struct nfs4_client *
2729 find_unconfirmed_client(clientid_t *clid, bool sessions, struct nfsd_net *nn)
2730 {
2731         struct list_head *tbl = nn->unconf_id_hashtbl;
2732
2733         lockdep_assert_held(&nn->client_lock);
2734         return find_client_in_id_table(tbl, clid, sessions);
2735 }
2736
2737 static bool clp_used_exchangeid(struct nfs4_client *clp)
2738 {
2739         return clp->cl_exchange_flags != 0;
2740 }
2741
2742 static struct nfs4_client *
2743 find_confirmed_client_by_name(struct xdr_netobj *name, struct nfsd_net *nn)
2744 {
2745         lockdep_assert_held(&nn->client_lock);
2746         return find_clp_in_name_tree(name, &nn->conf_name_tree);
2747 }
2748
2749 static struct nfs4_client *
2750 find_unconfirmed_client_by_name(struct xdr_netobj *name, struct nfsd_net *nn)
2751 {
2752         lockdep_assert_held(&nn->client_lock);
2753         return find_clp_in_name_tree(name, &nn->unconf_name_tree);
2754 }
2755
2756 static void
2757 gen_callback(struct nfs4_client *clp, struct nfsd4_setclientid *se, struct svc_rqst *rqstp)
2758 {
2759         struct nfs4_cb_conn *conn = &clp->cl_cb_conn;
2760         struct sockaddr *sa = svc_addr(rqstp);
2761         u32 scopeid = rpc_get_scope_id(sa);
2762         unsigned short expected_family;
2763
2764         /* Currently, we only support tcp and tcp6 for the callback channel */
2765         if (se->se_callback_netid_len == 3 &&
2766             !memcmp(se->se_callback_netid_val, "tcp", 3))
2767                 expected_family = AF_INET;
2768         else if (se->se_callback_netid_len == 4 &&
2769                  !memcmp(se->se_callback_netid_val, "tcp6", 4))
2770                 expected_family = AF_INET6;
2771         else
2772                 goto out_err;
2773
2774         conn->cb_addrlen = rpc_uaddr2sockaddr(clp->net, se->se_callback_addr_val,
2775                                             se->se_callback_addr_len,
2776                                             (struct sockaddr *)&conn->cb_addr,
2777                                             sizeof(conn->cb_addr));
2778
2779         if (!conn->cb_addrlen || conn->cb_addr.ss_family != expected_family)
2780                 goto out_err;
2781
2782         if (conn->cb_addr.ss_family == AF_INET6)
2783                 ((struct sockaddr_in6 *)&conn->cb_addr)->sin6_scope_id = scopeid;
2784
2785         conn->cb_prog = se->se_callback_prog;
2786         conn->cb_ident = se->se_callback_ident;
2787         memcpy(&conn->cb_saddr, &rqstp->rq_daddr, rqstp->rq_daddrlen);
2788         return;
2789 out_err:
2790         conn->cb_addr.ss_family = AF_UNSPEC;
2791         conn->cb_addrlen = 0;
2792         dprintk("NFSD: this client (clientid %08x/%08x) "
2793                 "will not receive delegations\n",
2794                 clp->cl_clientid.cl_boot, clp->cl_clientid.cl_id);
2795
2796         return;
2797 }
2798
2799 /*
2800  * Cache a reply. nfsd4_check_resp_size() has bounded the cache size.
2801  */
2802 static void
2803 nfsd4_store_cache_entry(struct nfsd4_compoundres *resp)
2804 {
2805         struct xdr_buf *buf = resp->xdr.buf;
2806         struct nfsd4_slot *slot = resp->cstate.slot;
2807         unsigned int base;
2808
2809         dprintk("--> %s slot %p\n", __func__, slot);
2810
2811         slot->sl_flags |= NFSD4_SLOT_INITIALIZED;
2812         slot->sl_opcnt = resp->opcnt;
2813         slot->sl_status = resp->cstate.status;
2814         free_svc_cred(&slot->sl_cred);
2815         copy_cred(&slot->sl_cred, &resp->rqstp->rq_cred);
2816
2817         if (!nfsd4_cache_this(resp)) {
2818                 slot->sl_flags &= ~NFSD4_SLOT_CACHED;
2819                 return;
2820         }
2821         slot->sl_flags |= NFSD4_SLOT_CACHED;
2822
2823         base = resp->cstate.data_offset;
2824         slot->sl_datalen = buf->len - base;
2825         if (read_bytes_from_xdr_buf(buf, base, slot->sl_data, slot->sl_datalen))
2826                 WARN(1, "%s: sessions DRC could not cache compound\n",
2827                      __func__);
2828         return;
2829 }
2830
2831 /*
2832  * Encode the replay sequence operation from the slot values.
2833  * If cachethis is FALSE encode the uncached rep error on the next
2834  * operation which sets resp->p and increments resp->opcnt for
2835  * nfs4svc_encode_compoundres.
2836  *
2837  */
2838 static __be32
2839 nfsd4_enc_sequence_replay(struct nfsd4_compoundargs *args,
2840                           struct nfsd4_compoundres *resp)
2841 {
2842         struct nfsd4_op *op;
2843         struct nfsd4_slot *slot = resp->cstate.slot;
2844
2845         /* Encode the replayed sequence operation */
2846         op = &args->ops[resp->opcnt - 1];
2847         nfsd4_encode_operation(resp, op);
2848
2849         if (slot->sl_flags & NFSD4_SLOT_CACHED)
2850                 return op->status;
2851         if (args->opcnt == 1) {
2852                 /*
2853                  * The original operation wasn't a solo sequence--we
2854                  * always cache those--so this retry must not match the
2855                  * original:
2856                  */
2857                 op->status = nfserr_seq_false_retry;
2858         } else {
2859                 op = &args->ops[resp->opcnt++];
2860                 op->status = nfserr_retry_uncached_rep;
2861                 nfsd4_encode_operation(resp, op);
2862         }
2863         return op->status;
2864 }
2865
2866 /*
2867  * The sequence operation is not cached because we can use the slot and
2868  * session values.
2869  */
2870 static __be32
2871 nfsd4_replay_cache_entry(struct nfsd4_compoundres *resp,
2872                          struct nfsd4_sequence *seq)
2873 {
2874         struct nfsd4_slot *slot = resp->cstate.slot;
2875         struct xdr_stream *xdr = &resp->xdr;
2876         __be32 *p;
2877         __be32 status;
2878
2879         dprintk("--> %s slot %p\n", __func__, slot);
2880
2881         status = nfsd4_enc_sequence_replay(resp->rqstp->rq_argp, resp);
2882         if (status)
2883                 return status;
2884
2885         p = xdr_reserve_space(xdr, slot->sl_datalen);
2886         if (!p) {
2887                 WARN_ON_ONCE(1);
2888                 return nfserr_serverfault;
2889         }
2890         xdr_encode_opaque_fixed(p, slot->sl_data, slot->sl_datalen);
2891         xdr_commit_encode(xdr);
2892
2893         resp->opcnt = slot->sl_opcnt;
2894         return slot->sl_status;
2895 }
2896
2897 /*
2898  * Set the exchange_id flags returned by the server.
2899  */
2900 static void
2901 nfsd4_set_ex_flags(struct nfs4_client *new, struct nfsd4_exchange_id *clid)
2902 {
2903 #ifdef CONFIG_NFSD_PNFS
2904         new->cl_exchange_flags |= EXCHGID4_FLAG_USE_PNFS_MDS;
2905 #else
2906         new->cl_exchange_flags |= EXCHGID4_FLAG_USE_NON_PNFS;
2907 #endif
2908
2909         /* Referrals are supported, Migration is not. */
2910         new->cl_exchange_flags |= EXCHGID4_FLAG_SUPP_MOVED_REFER;
2911
2912         /* set the wire flags to return to client. */
2913         clid->flags = new->cl_exchange_flags;
2914 }
2915
2916 static bool client_has_openowners(struct nfs4_client *clp)
2917 {
2918         struct nfs4_openowner *oo;
2919
2920         list_for_each_entry(oo, &clp->cl_openowners, oo_perclient) {
2921                 if (!list_empty(&oo->oo_owner.so_stateids))
2922                         return true;
2923         }
2924         return false;
2925 }
2926
2927 static bool client_has_state(struct nfs4_client *clp)
2928 {
2929         return client_has_openowners(clp)
2930 #ifdef CONFIG_NFSD_PNFS
2931                 || !list_empty(&clp->cl_lo_states)
2932 #endif
2933                 || !list_empty(&clp->cl_delegations)
2934                 || !list_empty(&clp->cl_sessions)
2935                 || !list_empty(&clp->async_copies);
2936 }
2937
2938 static __be32 copy_impl_id(struct nfs4_client *clp,
2939                                 struct nfsd4_exchange_id *exid)
2940 {
2941         if (!exid->nii_domain.data)
2942                 return 0;
2943         xdr_netobj_dup(&clp->cl_nii_domain, &exid->nii_domain, GFP_KERNEL);
2944         if (!clp->cl_nii_domain.data)
2945                 return nfserr_jukebox;
2946         xdr_netobj_dup(&clp->cl_nii_name, &exid->nii_name, GFP_KERNEL);
2947         if (!clp->cl_nii_name.data)
2948                 return nfserr_jukebox;
2949         clp->cl_nii_time.tv_sec = exid->nii_time.tv_sec;
2950         clp->cl_nii_time.tv_nsec = exid->nii_time.tv_nsec;
2951         return 0;
2952 }
2953
2954 __be32
2955 nfsd4_exchange_id(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
2956                 union nfsd4_op_u *u)
2957 {
2958         struct nfsd4_exchange_id *exid = &u->exchange_id;
2959         struct nfs4_client *conf, *new;
2960         struct nfs4_client *unconf = NULL;
2961         __be32 status;
2962         char                    addr_str[INET6_ADDRSTRLEN];
2963         nfs4_verifier           verf = exid->verifier;
2964         struct sockaddr         *sa = svc_addr(rqstp);
2965         bool    update = exid->flags & EXCHGID4_FLAG_UPD_CONFIRMED_REC_A;
2966         struct nfsd_net         *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
2967
2968         rpc_ntop(sa, addr_str, sizeof(addr_str));
2969         dprintk("%s rqstp=%p exid=%p clname.len=%u clname.data=%p "
2970                 "ip_addr=%s flags %x, spa_how %d\n",
2971                 __func__, rqstp, exid, exid->clname.len, exid->clname.data,
2972                 addr_str, exid->flags, exid->spa_how);
2973
2974         if (exid->flags & ~EXCHGID4_FLAG_MASK_A)
2975                 return nfserr_inval;
2976
2977         new = create_client(exid->clname, rqstp, &verf);
2978         if (new == NULL)
2979                 return nfserr_jukebox;
2980         status = copy_impl_id(new, exid);
2981         if (status)
2982                 goto out_nolock;
2983
2984         switch (exid->spa_how) {
2985         case SP4_MACH_CRED:
2986                 exid->spo_must_enforce[0] = 0;
2987                 exid->spo_must_enforce[1] = (
2988                         1 << (OP_BIND_CONN_TO_SESSION - 32) |
2989                         1 << (OP_EXCHANGE_ID - 32) |
2990                         1 << (OP_CREATE_SESSION - 32) |
2991                         1 << (OP_DESTROY_SESSION - 32) |
2992                         1 << (OP_DESTROY_CLIENTID - 32));
2993
2994                 exid->spo_must_allow[0] &= (1 << (OP_CLOSE) |
2995                                         1 << (OP_OPEN_DOWNGRADE) |
2996                                         1 << (OP_LOCKU) |
2997                                         1 << (OP_DELEGRETURN));
2998
2999                 exid->spo_must_allow[1] &= (
3000                                         1 << (OP_TEST_STATEID - 32) |
3001                                         1 << (OP_FREE_STATEID - 32));
3002                 if (!svc_rqst_integrity_protected(rqstp)) {
3003                         status = nfserr_inval;
3004                         goto out_nolock;
3005                 }
3006                 /*
3007                  * Sometimes userspace doesn't give us a principal.
3008                  * Which is a bug, really.  Anyway, we can't enforce
3009                  * MACH_CRED in that case, better to give up now:
3010                  */
3011                 if (!new->cl_cred.cr_principal &&
3012                                         !new->cl_cred.cr_raw_principal) {
3013                         status = nfserr_serverfault;
3014                         goto out_nolock;
3015                 }
3016                 new->cl_mach_cred = true;
3017         case SP4_NONE:
3018                 break;
3019         default:                                /* checked by xdr code */
3020                 WARN_ON_ONCE(1);
3021                 /* fall through */
3022         case SP4_SSV:
3023                 status = nfserr_encr_alg_unsupp;
3024                 goto out_nolock;
3025         }
3026
3027         /* Cases below refer to rfc 5661 section 18.35.4: */
3028         spin_lock(&nn->client_lock);
3029         conf = find_confirmed_client_by_name(&exid->clname, nn);
3030         if (conf) {
3031                 bool creds_match = same_creds(&conf->cl_cred, &rqstp->rq_cred);
3032                 bool verfs_match = same_verf(&verf, &conf->cl_verifier);
3033
3034                 if (update) {
3035                         if (!clp_used_exchangeid(conf)) { /* buggy client */
3036                                 status = nfserr_inval;
3037                                 goto out;
3038                         }
3039                         if (!nfsd4_mach_creds_match(conf, rqstp)) {
3040                                 status = nfserr_wrong_cred;
3041                                 goto out;
3042                         }
3043                         if (!creds_match) { /* case 9 */
3044                                 status = nfserr_perm;
3045                                 goto out;
3046                         }
3047                         if (!verfs_match) { /* case 8 */
3048                                 status = nfserr_not_same;
3049                                 goto out;
3050                         }
3051                         /* case 6 */
3052                         exid->flags |= EXCHGID4_FLAG_CONFIRMED_R;
3053                         goto out_copy;
3054                 }
3055                 if (!creds_match) { /* case 3 */
3056                         if (client_has_state(conf)) {
3057                                 status = nfserr_clid_inuse;
3058                                 goto out;
3059                         }
3060                         goto out_new;
3061                 }
3062                 if (verfs_match) { /* case 2 */
3063                         conf->cl_exchange_flags |= EXCHGID4_FLAG_CONFIRMED_R;
3064                         goto out_copy;
3065                 }
3066                 /* case 5, client reboot */
3067                 conf = NULL;
3068                 goto out_new;
3069         }
3070
3071         if (update) { /* case 7 */
3072                 status = nfserr_noent;
3073                 goto out;
3074         }
3075
3076         unconf  = find_unconfirmed_client_by_name(&exid->clname, nn);
3077         if (unconf) /* case 4, possible retry or client restart */
3078                 unhash_client_locked(unconf);
3079
3080         /* case 1 (normal case) */
3081 out_new:
3082         if (conf) {
3083                 status = mark_client_expired_locked(conf);
3084                 if (status)
3085                         goto out;
3086         }
3087         new->cl_minorversion = cstate->minorversion;
3088         new->cl_spo_must_allow.u.words[0] = exid->spo_must_allow[0];
3089         new->cl_spo_must_allow.u.words[1] = exid->spo_must_allow[1];
3090
3091         add_to_unconfirmed(new);
3092         swap(new, conf);
3093 out_copy:
3094         exid->clientid.cl_boot = conf->cl_clientid.cl_boot;
3095         exid->clientid.cl_id = conf->cl_clientid.cl_id;
3096
3097         exid->seqid = conf->cl_cs_slot.sl_seqid + 1;
3098         nfsd4_set_ex_flags(conf, exid);
3099
3100         dprintk("nfsd4_exchange_id seqid %d flags %x\n",
3101                 conf->cl_cs_slot.sl_seqid, conf->cl_exchange_flags);
3102         status = nfs_ok;
3103
3104 out:
3105         spin_unlock(&nn->client_lock);
3106 out_nolock:
3107         if (new)
3108                 expire_client(new);
3109         if (unconf)
3110                 expire_client(unconf);
3111         return status;
3112 }
3113
3114 static __be32
3115 check_slot_seqid(u32 seqid, u32 slot_seqid, int slot_inuse)
3116 {
3117         dprintk("%s enter. seqid %d slot_seqid %d\n", __func__, seqid,
3118                 slot_seqid);
3119
3120         /* The slot is in use, and no response has been sent. */
3121         if (slot_inuse) {
3122                 if (seqid == slot_seqid)
3123                         return nfserr_jukebox;
3124                 else
3125                         return nfserr_seq_misordered;
3126         }
3127         /* Note unsigned 32-bit arithmetic handles wraparound: */
3128         if (likely(seqid == slot_seqid + 1))
3129                 return nfs_ok;
3130         if (seqid == slot_seqid)
3131                 return nfserr_replay_cache;
3132         return nfserr_seq_misordered;
3133 }
3134
3135 /*
3136  * Cache the create session result into the create session single DRC
3137  * slot cache by saving the xdr structure. sl_seqid has been set.
3138  * Do this for solo or embedded create session operations.
3139  */
3140 static void
3141 nfsd4_cache_create_session(struct nfsd4_create_session *cr_ses,
3142                            struct nfsd4_clid_slot *slot, __be32 nfserr)
3143 {
3144         slot->sl_status = nfserr;
3145         memcpy(&slot->sl_cr_ses, cr_ses, sizeof(*cr_ses));
3146 }
3147
3148 static __be32
3149 nfsd4_replay_create_session(struct nfsd4_create_session *cr_ses,
3150                             struct nfsd4_clid_slot *slot)
3151 {
3152         memcpy(cr_ses, &slot->sl_cr_ses, sizeof(*cr_ses));
3153         return slot->sl_status;
3154 }
3155
3156 #define NFSD_MIN_REQ_HDR_SEQ_SZ ((\
3157                         2 * 2 + /* credential,verifier: AUTH_NULL, length 0 */ \
3158                         1 +     /* MIN tag is length with zero, only length */ \
3159                         3 +     /* version, opcount, opcode */ \
3160                         XDR_QUADLEN(NFS4_MAX_SESSIONID_LEN) + \
3161                                 /* seqid, slotID, slotID, cache */ \
3162                         4 ) * sizeof(__be32))
3163
3164 #define NFSD_MIN_RESP_HDR_SEQ_SZ ((\
3165                         2 +     /* verifier: AUTH_NULL, length 0 */\
3166                         1 +     /* status */ \
3167                         1 +     /* MIN tag is length with zero, only length */ \
3168                         3 +     /* opcount, opcode, opstatus*/ \
3169                         XDR_QUADLEN(NFS4_MAX_SESSIONID_LEN) + \
3170                                 /* seqid, slotID, slotID, slotID, status */ \
3171                         5 ) * sizeof(__be32))
3172
3173 static __be32 check_forechannel_attrs(struct nfsd4_channel_attrs *ca, struct nfsd_net *nn)
3174 {
3175         u32 maxrpc = nn->nfsd_serv->sv_max_mesg;
3176
3177         if (ca->maxreq_sz < NFSD_MIN_REQ_HDR_SEQ_SZ)
3178                 return nfserr_toosmall;
3179         if (ca->maxresp_sz < NFSD_MIN_RESP_HDR_SEQ_SZ)
3180                 return nfserr_toosmall;
3181         ca->headerpadsz = 0;
3182         ca->maxreq_sz = min_t(u32, ca->maxreq_sz, maxrpc);
3183         ca->maxresp_sz = min_t(u32, ca->maxresp_sz, maxrpc);
3184         ca->maxops = min_t(u32, ca->maxops, NFSD_MAX_OPS_PER_COMPOUND);
3185         ca->maxresp_cached = min_t(u32, ca->maxresp_cached,
3186                         NFSD_SLOT_CACHE_SIZE + NFSD_MIN_HDR_SEQ_SZ);
3187         ca->maxreqs = min_t(u32, ca->maxreqs, NFSD_MAX_SLOTS_PER_SESSION);
3188         /*
3189          * Note decreasing slot size below client's request may make it
3190          * difficult for client to function correctly, whereas
3191          * decreasing the number of slots will (just?) affect
3192          * performance.  When short on memory we therefore prefer to
3193          * decrease number of slots instead of their size.  Clients that
3194          * request larger slots than they need will get poor results:
3195          * Note that we always allow at least one slot, because our
3196          * accounting is soft and provides no guarantees either way.
3197          */
3198         ca->maxreqs = nfsd4_get_drc_mem(ca, nn);
3199
3200         return nfs_ok;
3201 }
3202
3203 /*
3204  * Server's NFSv4.1 backchannel support is AUTH_SYS-only for now.
3205  * These are based on similar macros in linux/sunrpc/msg_prot.h .
3206  */
3207 #define RPC_MAX_HEADER_WITH_AUTH_SYS \
3208         (RPC_CALLHDRSIZE + 2 * (2 + UNX_CALLSLACK))
3209
3210 #define RPC_MAX_REPHEADER_WITH_AUTH_SYS \
3211         (RPC_REPHDRSIZE + (2 + NUL_REPLYSLACK))
3212
3213 #define NFSD_CB_MAX_REQ_SZ      ((NFS4_enc_cb_recall_sz + \
3214                                  RPC_MAX_HEADER_WITH_AUTH_SYS) * sizeof(__be32))
3215 #define NFSD_CB_MAX_RESP_SZ     ((NFS4_dec_cb_recall_sz + \
3216                                  RPC_MAX_REPHEADER_WITH_AUTH_SYS) * \
3217                                  sizeof(__be32))
3218
3219 static __be32 check_backchannel_attrs(struct nfsd4_channel_attrs *ca)
3220 {
3221         ca->headerpadsz = 0;
3222
3223         if (ca->maxreq_sz < NFSD_CB_MAX_REQ_SZ)
3224                 return nfserr_toosmall;
3225         if (ca->maxresp_sz < NFSD_CB_MAX_RESP_SZ)
3226                 return nfserr_toosmall;
3227         ca->maxresp_cached = 0;
3228         if (ca->maxops < 2)
3229                 return nfserr_toosmall;
3230
3231         return nfs_ok;
3232 }
3233
3234 static __be32 nfsd4_check_cb_sec(struct nfsd4_cb_sec *cbs)
3235 {
3236         switch (cbs->flavor) {
3237         case RPC_AUTH_NULL:
3238         case RPC_AUTH_UNIX:
3239                 return nfs_ok;
3240         default:
3241                 /*
3242                  * GSS case: the spec doesn't allow us to return this
3243                  * error.  But it also doesn't allow us not to support
3244                  * GSS.
3245                  * I'd rather this fail hard than return some error the
3246                  * client might think it can already handle:
3247                  */
3248                 return nfserr_encr_alg_unsupp;
3249         }
3250 }
3251
3252 __be32
3253 nfsd4_create_session(struct svc_rqst *rqstp,
3254                 struct nfsd4_compound_state *cstate, union nfsd4_op_u *u)
3255 {
3256         struct nfsd4_create_session *cr_ses = &u->create_session;
3257         struct sockaddr *sa = svc_addr(rqstp);
3258         struct nfs4_client *conf, *unconf;
3259         struct nfs4_client *old = NULL;
3260         struct nfsd4_session *new;
3261         struct nfsd4_conn *conn;
3262         struct nfsd4_clid_slot *cs_slot = NULL;
3263         __be32 status = 0;
3264         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
3265
3266         if (cr_ses->flags & ~SESSION4_FLAG_MASK_A)
3267                 return nfserr_inval;
3268         status = nfsd4_check_cb_sec(&cr_ses->cb_sec);
3269         if (status)
3270                 return status;
3271         status = check_forechannel_attrs(&cr_ses->fore_channel, nn);
3272         if (status)
3273                 return status;
3274         status = check_backchannel_attrs(&cr_ses->back_channel);
3275         if (status)
3276                 goto out_release_drc_mem;
3277         status = nfserr_jukebox;
3278         new = alloc_session(&cr_ses->fore_channel, &cr_ses->back_channel);
3279         if (!new)
3280                 goto out_release_drc_mem;
3281         conn = alloc_conn_from_crses(rqstp, cr_ses);
3282         if (!conn)
3283                 goto out_free_session;
3284
3285         spin_lock(&nn->client_lock);
3286         unconf = find_unconfirmed_client(&cr_ses->clientid, true, nn);
3287         conf = find_confirmed_client(&cr_ses->clientid, true, nn);
3288         WARN_ON_ONCE(conf && unconf);
3289
3290         if (conf) {
3291                 status = nfserr_wrong_cred;
3292                 if (!nfsd4_mach_creds_match(conf, rqstp))
3293                         goto out_free_conn;
3294                 cs_slot = &conf->cl_cs_slot;
3295                 status = check_slot_seqid(cr_ses->seqid, cs_slot->sl_seqid, 0);
3296                 if (status) {
3297                         if (status == nfserr_replay_cache)
3298                                 status = nfsd4_replay_create_session(cr_ses, cs_slot);
3299                         goto out_free_conn;
3300                 }
3301         } else if (unconf) {
3302                 if (!same_creds(&unconf->cl_cred, &rqstp->rq_cred) ||
3303                     !rpc_cmp_addr(sa, (struct sockaddr *) &unconf->cl_addr)) {
3304                         status = nfserr_clid_inuse;
3305                         goto out_free_conn;
3306                 }
3307                 status = nfserr_wrong_cred;
3308                 if (!nfsd4_mach_creds_match(unconf, rqstp))
3309                         goto out_free_conn;
3310                 cs_slot = &unconf->cl_cs_slot;
3311                 status = check_slot_seqid(cr_ses->seqid, cs_slot->sl_seqid, 0);
3312                 if (status) {
3313                         /* an unconfirmed replay returns misordered */
3314                         status = nfserr_seq_misordered;
3315                         goto out_free_conn;
3316                 }
3317                 old = find_confirmed_client_by_name(&unconf->cl_name, nn);
3318                 if (old) {
3319                         status = mark_client_expired_locked(old);
3320                         if (status) {
3321                                 old = NULL;
3322                                 goto out_free_conn;
3323                         }
3324                 }
3325                 move_to_confirmed(unconf);
3326                 conf = unconf;
3327         } else {
3328                 status = nfserr_stale_clientid;
3329                 goto out_free_conn;
3330         }
3331         status = nfs_ok;
3332         /* Persistent sessions are not supported */
3333         cr_ses->flags &= ~SESSION4_PERSIST;
3334         /* Upshifting from TCP to RDMA is not supported */
3335         cr_ses->flags &= ~SESSION4_RDMA;
3336
3337         init_session(rqstp, new, conf, cr_ses);
3338         nfsd4_get_session_locked(new);
3339
3340         memcpy(cr_ses->sessionid.data, new->se_sessionid.data,
3341                NFS4_MAX_SESSIONID_LEN);
3342         cs_slot->sl_seqid++;
3343         cr_ses->seqid = cs_slot->sl_seqid;
3344
3345         /* cache solo and embedded create sessions under the client_lock */
3346         nfsd4_cache_create_session(cr_ses, cs_slot, status);
3347         spin_unlock(&nn->client_lock);
3348         /* init connection and backchannel */
3349         nfsd4_init_conn(rqstp, conn, new);
3350         nfsd4_put_session(new);
3351         if (old)
3352                 expire_client(old);
3353         return status;
3354 out_free_conn:
3355         spin_unlock(&nn->client_lock);
3356         free_conn(conn);
3357         if (old)
3358                 expire_client(old);
3359 out_free_session:
3360         __free_session(new);
3361 out_release_drc_mem:
3362         nfsd4_put_drc_mem(&cr_ses->fore_channel);
3363         return status;
3364 }
3365
3366 static __be32 nfsd4_map_bcts_dir(u32 *dir)
3367 {
3368         switch (*dir) {
3369         case NFS4_CDFC4_FORE:
3370         case NFS4_CDFC4_BACK:
3371                 return nfs_ok;
3372         case NFS4_CDFC4_FORE_OR_BOTH:
3373         case NFS4_CDFC4_BACK_OR_BOTH:
3374                 *dir = NFS4_CDFC4_BOTH;
3375                 return nfs_ok;
3376         };
3377         return nfserr_inval;
3378 }
3379
3380 __be32 nfsd4_backchannel_ctl(struct svc_rqst *rqstp,
3381                 struct nfsd4_compound_state *cstate,
3382                 union nfsd4_op_u *u)
3383 {
3384         struct nfsd4_backchannel_ctl *bc = &u->backchannel_ctl;
3385         struct nfsd4_session *session = cstate->session;
3386         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
3387         __be32 status;
3388
3389         status = nfsd4_check_cb_sec(&bc->bc_cb_sec);
3390         if (status)
3391                 return status;
3392         spin_lock(&nn->client_lock);
3393         session->se_cb_prog = bc->bc_cb_program;
3394         session->se_cb_sec = bc->bc_cb_sec;
3395         spin_unlock(&nn->client_lock);
3396
3397         nfsd4_probe_callback(session->se_client);
3398
3399         return nfs_ok;
3400 }
3401
3402 __be32 nfsd4_bind_conn_to_session(struct svc_rqst *rqstp,
3403                      struct nfsd4_compound_state *cstate,
3404                      union nfsd4_op_u *u)
3405 {
3406         struct nfsd4_bind_conn_to_session *bcts = &u->bind_conn_to_session;
3407         __be32 status;
3408         struct nfsd4_conn *conn;
3409         struct nfsd4_session *session;
3410         struct net *net = SVC_NET(rqstp);
3411         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
3412
3413         if (!nfsd4_last_compound_op(rqstp))
3414                 return nfserr_not_only_op;
3415         spin_lock(&nn->client_lock);
3416         session = find_in_sessionid_hashtbl(&bcts->sessionid, net, &status);
3417         spin_unlock(&nn->client_lock);
3418         if (!session)
3419                 goto out_no_session;
3420         status = nfserr_wrong_cred;
3421         if (!nfsd4_mach_creds_match(session->se_client, rqstp))
3422                 goto out;
3423         status = nfsd4_map_bcts_dir(&bcts->dir);
3424         if (status)
3425                 goto out;
3426         conn = alloc_conn(rqstp, bcts->dir);
3427         status = nfserr_jukebox;
3428         if (!conn)
3429                 goto out;
3430         nfsd4_init_conn(rqstp, conn, session);
3431         status = nfs_ok;
3432 out:
3433         nfsd4_put_session(session);
3434 out_no_session:
3435         return status;
3436 }
3437
3438 static bool nfsd4_compound_in_session(struct nfsd4_compound_state *cstate, struct nfs4_sessionid *sid)
3439 {
3440         if (!cstate->session)
3441                 return false;
3442         return !memcmp(sid, &cstate->session->se_sessionid, sizeof(*sid));
3443 }
3444
3445 __be32
3446 nfsd4_destroy_session(struct svc_rqst *r, struct nfsd4_compound_state *cstate,
3447                 union nfsd4_op_u *u)
3448 {
3449         struct nfs4_sessionid *sessionid = &u->destroy_session.sessionid;
3450         struct nfsd4_session *ses;
3451         __be32 status;
3452         int ref_held_by_me = 0;
3453         struct net *net = SVC_NET(r);
3454         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
3455
3456         status = nfserr_not_only_op;
3457         if (nfsd4_compound_in_session(cstate, sessionid)) {
3458                 if (!nfsd4_last_compound_op(r))
3459                         goto out;
3460                 ref_held_by_me++;
3461         }
3462         dump_sessionid(__func__, sessionid);
3463         spin_lock(&nn->client_lock);
3464         ses = find_in_sessionid_hashtbl(sessionid, net, &status);
3465         if (!ses)
3466                 goto out_client_lock;
3467         status = nfserr_wrong_cred;
3468         if (!nfsd4_mach_creds_match(ses->se_client, r))
3469                 goto out_put_session;
3470         status = mark_session_dead_locked(ses, 1 + ref_held_by_me);
3471         if (status)
3472                 goto out_put_session;
3473         unhash_session(ses);
3474         spin_unlock(&nn->client_lock);
3475
3476         nfsd4_probe_callback_sync(ses->se_client);
3477
3478         spin_lock(&nn->client_lock);
3479         status = nfs_ok;
3480 out_put_session:
3481         nfsd4_put_session_locked(ses);
3482 out_client_lock:
3483         spin_unlock(&nn->client_lock);
3484 out:
3485         return status;
3486 }
3487
3488 static struct nfsd4_conn *__nfsd4_find_conn(struct svc_xprt *xpt, struct nfsd4_session *s)
3489 {
3490         struct nfsd4_conn *c;
3491
3492         list_for_each_entry(c, &s->se_conns, cn_persession) {
3493                 if (c->cn_xprt == xpt) {
3494                         return c;
3495                 }
3496         }
3497         return NULL;
3498 }
3499
3500 static __be32 nfsd4_sequence_check_conn(struct nfsd4_conn *new, struct nfsd4_session *ses)
3501 {
3502         struct nfs4_client *clp = ses->se_client;
3503         struct nfsd4_conn *c;
3504         __be32 status = nfs_ok;
3505         int ret;
3506
3507         spin_lock(&clp->cl_lock);
3508         c = __nfsd4_find_conn(new->cn_xprt, ses);
3509         if (c)
3510                 goto out_free;
3511         status = nfserr_conn_not_bound_to_session;
3512         if (clp->cl_mach_cred)
3513                 goto out_free;
3514         __nfsd4_hash_conn(new, ses);
3515         spin_unlock(&clp->cl_lock);
3516         ret = nfsd4_register_conn(new);
3517         if (ret)
3518                 /* oops; xprt is already down: */
3519                 nfsd4_conn_lost(&new->cn_xpt_user);
3520         return nfs_ok;
3521 out_free:
3522         spin_unlock(&clp->cl_lock);
3523         free_conn(new);
3524         return status;
3525 }
3526
3527 static bool nfsd4_session_too_many_ops(struct svc_rqst *rqstp, struct nfsd4_session *session)
3528 {
3529         struct nfsd4_compoundargs *args = rqstp->rq_argp;
3530
3531         return args->opcnt > session->se_fchannel.maxops;
3532 }
3533
3534 static bool nfsd4_request_too_big(struct svc_rqst *rqstp,
3535                                   struct nfsd4_session *session)
3536 {
3537         struct xdr_buf *xb = &rqstp->rq_arg;
3538
3539         return xb->len > session->se_fchannel.maxreq_sz;
3540 }
3541
3542 static bool replay_matches_cache(struct svc_rqst *rqstp,
3543                  struct nfsd4_sequence *seq, struct nfsd4_slot *slot)
3544 {
3545         struct nfsd4_compoundargs *argp = rqstp->rq_argp;
3546
3547         if ((bool)(slot->sl_flags & NFSD4_SLOT_CACHETHIS) !=
3548             (bool)seq->cachethis)
3549                 return false;
3550         /*
3551          * If there's an error then the reply can have fewer ops than
3552          * the call.
3553          */
3554         if (slot->sl_opcnt < argp->opcnt && !slot->sl_status)
3555                 return false;
3556         /*
3557          * But if we cached a reply with *more* ops than the call you're
3558          * sending us now, then this new call is clearly not really a
3559          * replay of the old one:
3560          */
3561         if (slot->sl_opcnt > argp->opcnt)
3562                 return false;
3563         /* This is the only check explicitly called by spec: */
3564         if (!same_creds(&rqstp->rq_cred, &slot->sl_cred))
3565                 return false;
3566         /*
3567          * There may be more comparisons we could actually do, but the
3568          * spec doesn't require us to catch every case where the calls
3569          * don't match (that would require caching the call as well as
3570          * the reply), so we don't bother.
3571          */
3572         return true;
3573 }
3574
3575 __be32
3576 nfsd4_sequence(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
3577                 union nfsd4_op_u *u)
3578 {
3579         struct nfsd4_sequence *seq = &u->sequence;
3580         struct nfsd4_compoundres *resp = rqstp->rq_resp;
3581         struct xdr_stream *xdr = &resp->xdr;
3582         struct nfsd4_session *session;
3583         struct nfs4_client *clp;
3584         struct nfsd4_slot *slot;
3585         struct nfsd4_conn *conn;
3586         __be32 status;
3587         int buflen;
3588         struct net *net = SVC_NET(rqstp);
3589         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
3590
3591         if (resp->opcnt != 1)
3592                 return nfserr_sequence_pos;
3593
3594         /*
3595          * Will be either used or freed by nfsd4_sequence_check_conn
3596          * below.
3597          */
3598         conn = alloc_conn(rqstp, NFS4_CDFC4_FORE);
3599         if (!conn)
3600                 return nfserr_jukebox;
3601
3602         spin_lock(&nn->client_lock);
3603         session = find_in_sessionid_hashtbl(&seq->sessionid, net, &status);
3604         if (!session)
3605                 goto out_no_session;
3606         clp = session->se_client;
3607
3608         status = nfserr_too_many_ops;
3609         if (nfsd4_session_too_many_ops(rqstp, session))
3610                 goto out_put_session;
3611
3612         status = nfserr_req_too_big;
3613         if (nfsd4_request_too_big(rqstp, session))
3614                 goto out_put_session;
3615
3616         status = nfserr_badslot;
3617         if (seq->slotid >= session->se_fchannel.maxreqs)
3618                 goto out_put_session;
3619
3620         slot = session->se_slots[seq->slotid];
3621         dprintk("%s: slotid %d\n", __func__, seq->slotid);
3622
3623         /* We do not negotiate the number of slots yet, so set the
3624          * maxslots to the session maxreqs which is used to encode
3625          * sr_highest_slotid and the sr_target_slot id to maxslots */
3626         seq->maxslots = session->se_fchannel.maxreqs;
3627
3628         status = check_slot_seqid(seq->seqid, slot->sl_seqid,
3629                                         slot->sl_flags & NFSD4_SLOT_INUSE);
3630         if (status == nfserr_replay_cache) {
3631                 status = nfserr_seq_misordered;
3632                 if (!(slot->sl_flags & NFSD4_SLOT_INITIALIZED))
3633                         goto out_put_session;
3634                 status = nfserr_seq_false_retry;
3635                 if (!replay_matches_cache(rqstp, seq, slot))
3636                         goto out_put_session;
3637                 cstate->slot = slot;
3638                 cstate->session = session;
3639                 cstate->clp = clp;
3640                 /* Return the cached reply status and set cstate->status
3641                  * for nfsd4_proc_compound processing */
3642                 status = nfsd4_replay_cache_entry(resp, seq);
3643                 cstate->status = nfserr_replay_cache;
3644                 goto out;
3645         }
3646         if (status)
3647                 goto out_put_session;
3648
3649         status = nfsd4_sequence_check_conn(conn, session);
3650         conn = NULL;
3651         if (status)
3652                 goto out_put_session;
3653
3654         buflen = (seq->cachethis) ?
3655                         session->se_fchannel.maxresp_cached :
3656                         session->se_fchannel.maxresp_sz;
3657         status = (seq->cachethis) ? nfserr_rep_too_big_to_cache :
3658                                     nfserr_rep_too_big;
3659         if (xdr_restrict_buflen(xdr, buflen - rqstp->rq_auth_slack))
3660                 goto out_put_session;
3661         svc_reserve(rqstp, buflen);
3662
3663         status = nfs_ok;
3664         /* Success! bump slot seqid */
3665         slot->sl_seqid = seq->seqid;
3666         slot->sl_flags |= NFSD4_SLOT_INUSE;
3667         if (seq->cachethis)
3668                 slot->sl_flags |= NFSD4_SLOT_CACHETHIS;
3669         else
3670                 slot->sl_flags &= ~NFSD4_SLOT_CACHETHIS;
3671
3672         cstate->slot = slot;
3673         cstate->session = session;
3674         cstate->clp = clp;
3675
3676 out:
3677         switch (clp->cl_cb_state) {
3678         case NFSD4_CB_DOWN:
3679                 seq->status_flags = SEQ4_STATUS_CB_PATH_DOWN;
3680                 break;
3681         case NFSD4_CB_FAULT:
3682                 seq->status_flags = SEQ4_STATUS_BACKCHANNEL_FAULT;
3683                 break;
3684         default:
3685                 seq->status_flags = 0;
3686         }
3687         if (!list_empty(&clp->cl_revoked))
3688                 seq->status_flags |= SEQ4_STATUS_RECALLABLE_STATE_REVOKED;
3689 out_no_session:
3690         if (conn)
3691                 free_conn(conn);
3692         spin_unlock(&nn->client_lock);
3693         return status;
3694 out_put_session:
3695         nfsd4_put_session_locked(session);
3696         goto out_no_session;
3697 }
3698
3699 void
3700 nfsd4_sequence_done(struct nfsd4_compoundres *resp)
3701 {
3702         struct nfsd4_compound_state *cs = &resp->cstate;
3703
3704         if (nfsd4_has_session(cs)) {
3705                 if (cs->status != nfserr_replay_cache) {
3706                         nfsd4_store_cache_entry(resp);
3707                         cs->slot->sl_flags &= ~NFSD4_SLOT_INUSE;
3708                 }
3709                 /* Drop session reference that was taken in nfsd4_sequence() */
3710                 nfsd4_put_session(cs->session);
3711         } else if (cs->clp)
3712                 put_client_renew(cs->clp);
3713 }
3714
3715 __be32
3716 nfsd4_destroy_clientid(struct svc_rqst *rqstp,
3717                 struct nfsd4_compound_state *cstate,
3718                 union nfsd4_op_u *u)
3719 {
3720         struct nfsd4_destroy_clientid *dc = &u->destroy_clientid;
3721         struct nfs4_client *conf, *unconf;
3722         struct nfs4_client *clp = NULL;
3723         __be32 status = 0;
3724         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
3725
3726         spin_lock(&nn->client_lock);
3727         unconf = find_unconfirmed_client(&dc->clientid, true, nn);
3728         conf = find_confirmed_client(&dc->clientid, true, nn);
3729         WARN_ON_ONCE(conf && unconf);
3730
3731         if (conf) {
3732                 if (client_has_state(conf)) {
3733                         status = nfserr_clientid_busy;
3734                         goto out;
3735                 }
3736                 status = mark_client_expired_locked(conf);
3737                 if (status)
3738                         goto out;
3739                 clp = conf;
3740         } else if (unconf)
3741                 clp = unconf;
3742         else {
3743                 status = nfserr_stale_clientid;
3744                 goto out;
3745         }
3746         if (!nfsd4_mach_creds_match(clp, rqstp)) {
3747                 clp = NULL;
3748                 status = nfserr_wrong_cred;
3749                 goto out;
3750         }
3751         unhash_client_locked(clp);
3752 out:
3753         spin_unlock(&nn->client_lock);
3754         if (clp)
3755                 expire_client(clp);
3756         return status;
3757 }
3758
3759 __be32
3760 nfsd4_reclaim_complete(struct svc_rqst *rqstp,
3761                 struct nfsd4_compound_state *cstate, union nfsd4_op_u *u)
3762 {
3763         struct nfsd4_reclaim_complete *rc = &u->reclaim_complete;
3764         __be32 status = 0;
3765
3766         if (rc->rca_one_fs) {
3767                 if (!cstate->current_fh.fh_dentry)
3768                         return nfserr_nofilehandle;
3769                 /*
3770                  * We don't take advantage of the rca_one_fs case.
3771                  * That's OK, it's optional, we can safely ignore it.
3772                  */
3773                 return nfs_ok;
3774         }
3775
3776         status = nfserr_complete_already;
3777         if (test_and_set_bit(NFSD4_CLIENT_RECLAIM_COMPLETE,
3778                              &cstate->session->se_client->cl_flags))
3779                 goto out;
3780
3781         status = nfserr_stale_clientid;
3782         if (is_client_expired(cstate->session->se_client))
3783                 /*
3784                  * The following error isn't really legal.
3785                  * But we only get here if the client just explicitly
3786                  * destroyed the client.  Surely it no longer cares what
3787                  * error it gets back on an operation for the dead
3788                  * client.
3789                  */
3790                 goto out;
3791
3792         status = nfs_ok;
3793         nfsd4_client_record_create(cstate->session->se_client);
3794         inc_reclaim_complete(cstate->session->se_client);
3795 out:
3796         return status;
3797 }
3798
3799 __be32
3800 nfsd4_setclientid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
3801                   union nfsd4_op_u *u)
3802 {
3803         struct nfsd4_setclientid *setclid = &u->setclientid;
3804         struct xdr_netobj       clname = setclid->se_name;
3805         nfs4_verifier           clverifier = setclid->se_verf;
3806         struct nfs4_client      *conf, *new;
3807         struct nfs4_client      *unconf = NULL;
3808         __be32                  status;
3809         struct nfsd_net         *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
3810
3811         new = create_client(clname, rqstp, &clverifier);
3812         if (new == NULL)
3813                 return nfserr_jukebox;
3814         /* Cases below refer to rfc 3530 section 14.2.33: */
3815         spin_lock(&nn->client_lock);
3816         conf = find_confirmed_client_by_name(&clname, nn);
3817         if (conf && client_has_state(conf)) {
3818                 /* case 0: */
3819                 status = nfserr_clid_inuse;
3820                 if (clp_used_exchangeid(conf))
3821                         goto out;
3822                 if (!same_creds(&conf->cl_cred, &rqstp->rq_cred)) {
3823                         char addr_str[INET6_ADDRSTRLEN];
3824                         rpc_ntop((struct sockaddr *) &conf->cl_addr, addr_str,
3825                                  sizeof(addr_str));
3826                         dprintk("NFSD: setclientid: string in use by client "
3827                                 "at %s\n", addr_str);
3828                         goto out;
3829                 }
3830         }
3831         unconf = find_unconfirmed_client_by_name(&clname, nn);
3832         if (unconf)
3833                 unhash_client_locked(unconf);
3834         if (conf && same_verf(&conf->cl_verifier, &clverifier)) {
3835                 /* case 1: probable callback update */
3836                 copy_clid(new, conf);
3837                 gen_confirm(new, nn);
3838         } else /* case 4 (new client) or cases 2, 3 (client reboot): */
3839                 ;
3840         new->cl_minorversion = 0;
3841         gen_callback(new, setclid, rqstp);
3842         add_to_unconfirmed(new);
3843         setclid->se_clientid.cl_boot = new->cl_clientid.cl_boot;
3844         setclid->se_clientid.cl_id = new->cl_clientid.cl_id;
3845         memcpy(setclid->se_confirm.data, new->cl_confirm.data, sizeof(setclid->se_confirm.data));
3846         new = NULL;
3847         status = nfs_ok;
3848 out:
3849         spin_unlock(&nn->client_lock);
3850         if (new)
3851                 free_client(new);
3852         if (unconf)
3853                 expire_client(unconf);
3854         return status;
3855 }
3856
3857
3858 __be32
3859 nfsd4_setclientid_confirm(struct svc_rqst *rqstp,
3860                         struct nfsd4_compound_state *cstate,
3861                         union nfsd4_op_u *u)
3862 {
3863         struct nfsd4_setclientid_confirm *setclientid_confirm =
3864                         &u->setclientid_confirm;
3865         struct nfs4_client *conf, *unconf;
3866         struct nfs4_client *old = NULL;
3867         nfs4_verifier confirm = setclientid_confirm->sc_confirm;
3868         clientid_t * clid = &setclientid_confirm->sc_clientid;
3869         __be32 status;
3870         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
3871
3872         if (STALE_CLIENTID(clid, nn))
3873                 return nfserr_stale_clientid;
3874
3875         spin_lock(&nn->client_lock);
3876         conf = find_confirmed_client(clid, false, nn);
3877         unconf = find_unconfirmed_client(clid, false, nn);
3878         /*
3879          * We try hard to give out unique clientid's, so if we get an
3880          * attempt to confirm the same clientid with a different cred,
3881          * the client may be buggy; this should never happen.
3882          *
3883          * Nevertheless, RFC 7530 recommends INUSE for this case:
3884          */
3885         status = nfserr_clid_inuse;
3886         if (unconf && !same_creds(&unconf->cl_cred, &rqstp->rq_cred))
3887                 goto out;
3888         if (conf && !same_creds(&conf->cl_cred, &rqstp->rq_cred))
3889                 goto out;
3890         /* cases below refer to rfc 3530 section 14.2.34: */
3891         if (!unconf || !same_verf(&confirm, &unconf->cl_confirm)) {
3892                 if (conf && same_verf(&confirm, &conf->cl_confirm)) {
3893                         /* case 2: probable retransmit */
3894                         status = nfs_ok;
3895                 } else /* case 4: client hasn't noticed we rebooted yet? */
3896                         status = nfserr_stale_clientid;
3897                 goto out;
3898         }
3899         status = nfs_ok;
3900         if (conf) { /* case 1: callback update */
3901                 old = unconf;
3902                 unhash_client_locked(old);
3903                 nfsd4_change_callback(conf, &unconf->cl_cb_conn);
3904         } else { /* case 3: normal case; new or rebooted client */
3905                 old = find_confirmed_client_by_name(&unconf->cl_name, nn);
3906                 if (old) {
3907                         status = nfserr_clid_inuse;
3908                         if (client_has_state(old)
3909                                         && !same_creds(&unconf->cl_cred,
3910                                                         &old->cl_cred))
3911                                 goto out;
3912                         status = mark_client_expired_locked(old);
3913                         if (status) {
3914                                 old = NULL;
3915                                 goto out;
3916                         }
3917                 }
3918                 move_to_confirmed(unconf);
3919                 conf = unconf;
3920         }
3921         get_client_locked(conf);
3922         spin_unlock(&nn->client_lock);
3923         nfsd4_probe_callback(conf);
3924         spin_lock(&nn->client_lock);
3925         put_client_renew_locked(conf);
3926 out:
3927         spin_unlock(&nn->client_lock);
3928         if (old)
3929                 expire_client(old);
3930         return status;
3931 }
3932
3933 static struct nfs4_file *nfsd4_alloc_file(void)
3934 {
3935         return kmem_cache_alloc(file_slab, GFP_KERNEL);
3936 }
3937
3938 /* OPEN Share state helper functions */
3939 static void nfsd4_init_file(struct knfsd_fh *fh, unsigned int hashval,
3940                                 struct nfs4_file *fp)
3941 {
3942         lockdep_assert_held(&state_lock);
3943
3944         refcount_set(&fp->fi_ref, 1);
3945         spin_lock_init(&fp->fi_lock);
3946         INIT_LIST_HEAD(&fp->fi_stateids);
3947         INIT_LIST_HEAD(&fp->fi_delegations);
3948         INIT_LIST_HEAD(&fp->fi_clnt_odstate);
3949         fh_copy_shallow(&fp->fi_fhandle, fh);
3950         fp->fi_deleg_file = NULL;
3951         fp->fi_had_conflict = false;
3952         fp->fi_share_deny = 0;
3953         memset(fp->fi_fds, 0, sizeof(fp->fi_fds));
3954         memset(fp->fi_access, 0, sizeof(fp->fi_access));
3955 #ifdef CONFIG_NFSD_PNFS
3956         INIT_LIST_HEAD(&fp->fi_lo_states);
3957         atomic_set(&fp->fi_lo_recalls, 0);
3958 #endif
3959         hlist_add_head_rcu(&fp->fi_hash, &file_hashtbl[hashval]);
3960 }
3961
3962 void
3963 nfsd4_free_slabs(void)
3964 {
3965         kmem_cache_destroy(client_slab);
3966         kmem_cache_destroy(openowner_slab);
3967         kmem_cache_destroy(lockowner_slab);
3968         kmem_cache_destroy(file_slab);
3969         kmem_cache_destroy(stateid_slab);
3970         kmem_cache_destroy(deleg_slab);
3971         kmem_cache_destroy(odstate_slab);
3972 }
3973
3974 int
3975 nfsd4_init_slabs(void)
3976 {
3977         client_slab = kmem_cache_create("nfsd4_clients",
3978                         sizeof(struct nfs4_client), 0, 0, NULL);
3979         if (client_slab == NULL)
3980                 goto out;
3981         openowner_slab = kmem_cache_create("nfsd4_openowners",
3982                         sizeof(struct nfs4_openowner), 0, 0, NULL);
3983         if (openowner_slab == NULL)
3984                 goto out_free_client_slab;
3985         lockowner_slab = kmem_cache_create("nfsd4_lockowners",
3986                         sizeof(struct nfs4_lockowner), 0, 0, NULL);
3987         if (lockowner_slab == NULL)
3988                 goto out_free_openowner_slab;
3989         file_slab = kmem_cache_create("nfsd4_files",
3990                         sizeof(struct nfs4_file), 0, 0, NULL);
3991         if (file_slab == NULL)
3992                 goto out_free_lockowner_slab;
3993         stateid_slab = kmem_cache_create("nfsd4_stateids",
3994                         sizeof(struct nfs4_ol_stateid), 0, 0, NULL);
3995         if (stateid_slab == NULL)
3996                 goto out_free_file_slab;
3997         deleg_slab = kmem_cache_create("nfsd4_delegations",
3998                         sizeof(struct nfs4_delegation), 0, 0, NULL);
3999         if (deleg_slab == NULL)
4000                 goto out_free_stateid_slab;
4001         odstate_slab = kmem_cache_create("nfsd4_odstate",
4002                         sizeof(struct nfs4_clnt_odstate), 0, 0, NULL);
4003         if (odstate_slab == NULL)
4004                 goto out_free_deleg_slab;
4005         return 0;
4006
4007 out_free_deleg_slab:
4008         kmem_cache_destroy(deleg_slab);
4009 out_free_stateid_slab:
4010         kmem_cache_destroy(stateid_slab);
4011 out_free_file_slab:
4012         kmem_cache_destroy(file_slab);
4013 out_free_lockowner_slab:
4014         kmem_cache_destroy(lockowner_slab);
4015 out_free_openowner_slab:
4016         kmem_cache_destroy(openowner_slab);
4017 out_free_client_slab:
4018         kmem_cache_destroy(client_slab);
4019 out:
4020         dprintk("nfsd4: out of memory while initializing nfsv4\n");
4021         return -ENOMEM;
4022 }
4023
4024 static void init_nfs4_replay(struct nfs4_replay *rp)
4025 {
4026         rp->rp_status = nfserr_serverfault;
4027         rp->rp_buflen = 0;
4028         rp->rp_buf = rp->rp_ibuf;
4029         mutex_init(&rp->rp_mutex);
4030 }
4031
4032 static void nfsd4_cstate_assign_replay(struct nfsd4_compound_state *cstate,
4033                 struct nfs4_stateowner *so)
4034 {
4035         if (!nfsd4_has_session(cstate)) {
4036                 mutex_lock(&so->so_replay.rp_mutex);
4037                 cstate->replay_owner = nfs4_get_stateowner(so);
4038         }
4039 }
4040
4041 void nfsd4_cstate_clear_replay(struct nfsd4_compound_state *cstate)
4042 {
4043         struct nfs4_stateowner *so = cstate->replay_owner;
4044
4045         if (so != NULL) {
4046                 cstate->replay_owner = NULL;
4047                 mutex_unlock(&so->so_replay.rp_mutex);
4048                 nfs4_put_stateowner(so);
4049         }
4050 }
4051
4052 static inline void *alloc_stateowner(struct kmem_cache *slab, struct xdr_netobj *owner, struct nfs4_client *clp)
4053 {
4054         struct nfs4_stateowner *sop;
4055
4056         sop = kmem_cache_alloc(slab, GFP_KERNEL);
4057         if (!sop)
4058                 return NULL;
4059
4060         xdr_netobj_dup(&sop->so_owner, owner, GFP_KERNEL);
4061         if (!sop->so_owner.data) {
4062                 kmem_cache_free(slab, sop);
4063                 return NULL;
4064         }
4065
4066         INIT_LIST_HEAD(&sop->so_stateids);
4067         sop->so_client = clp;
4068         init_nfs4_replay(&sop->so_replay);
4069         atomic_set(&sop->so_count, 1);
4070         return sop;
4071 }
4072
4073 static void hash_openowner(struct nfs4_openowner *oo, struct nfs4_client *clp, unsigned int strhashval)
4074 {
4075         lockdep_assert_held(&clp->cl_lock);
4076
4077         list_add(&oo->oo_owner.so_strhash,
4078                  &clp->cl_ownerstr_hashtbl[strhashval]);
4079         list_add(&oo->oo_perclient, &clp->cl_openowners);
4080 }
4081
4082 static void nfs4_unhash_openowner(struct nfs4_stateowner *so)
4083 {
4084         unhash_openowner_locked(openowner(so));
4085 }
4086
4087 static void nfs4_free_openowner(struct nfs4_stateowner *so)
4088 {
4089         struct nfs4_openowner *oo = openowner(so);
4090
4091         kmem_cache_free(openowner_slab, oo);
4092 }
4093
4094 static const struct nfs4_stateowner_operations openowner_ops = {
4095         .so_unhash =    nfs4_unhash_openowner,
4096         .so_free =      nfs4_free_openowner,
4097 };
4098
4099 static struct nfs4_ol_stateid *
4100 nfsd4_find_existing_open(struct nfs4_file *fp, struct nfsd4_open *open)
4101 {
4102         struct nfs4_ol_stateid *local, *ret = NULL;
4103         struct nfs4_openowner *oo = open->op_openowner;
4104
4105         lockdep_assert_held(&fp->fi_lock);
4106
4107         list_for_each_entry(local, &fp->fi_stateids, st_perfile) {
4108                 /* ignore lock owners */
4109                 if (local->st_stateowner->so_is_open_owner == 0)
4110                         continue;
4111                 if (local->st_stateowner != &oo->oo_owner)
4112                         continue;
4113                 if (local->st_stid.sc_type == NFS4_OPEN_STID) {
4114                         ret = local;
4115                         refcount_inc(&ret->st_stid.sc_count);
4116                         break;
4117                 }
4118         }
4119         return ret;
4120 }
4121
4122 static __be32
4123 nfsd4_verify_open_stid(struct nfs4_stid *s)
4124 {
4125         __be32 ret = nfs_ok;
4126
4127         switch (s->sc_type) {
4128         default:
4129                 break;
4130         case 0:
4131         case NFS4_CLOSED_STID:
4132         case NFS4_CLOSED_DELEG_STID:
4133                 ret = nfserr_bad_stateid;
4134                 break;
4135         case NFS4_REVOKED_DELEG_STID:
4136                 ret = nfserr_deleg_revoked;
4137         }
4138         return ret;
4139 }
4140
4141 /* Lock the stateid st_mutex, and deal with races with CLOSE */
4142 static __be32
4143 nfsd4_lock_ol_stateid(struct nfs4_ol_stateid *stp)
4144 {
4145         __be32 ret;
4146
4147         mutex_lock_nested(&stp->st_mutex, LOCK_STATEID_MUTEX);
4148         ret = nfsd4_verify_open_stid(&stp->st_stid);
4149         if (ret != nfs_ok)
4150                 mutex_unlock(&stp->st_mutex);
4151         return ret;
4152 }
4153
4154 static struct nfs4_ol_stateid *
4155 nfsd4_find_and_lock_existing_open(struct nfs4_file *fp, struct nfsd4_open *open)
4156 {
4157         struct nfs4_ol_stateid *stp;
4158         for (;;) {
4159                 spin_lock(&fp->fi_lock);
4160                 stp = nfsd4_find_existing_open(fp, open);
4161                 spin_unlock(&fp->fi_lock);
4162                 if (!stp || nfsd4_lock_ol_stateid(stp) == nfs_ok)
4163                         break;
4164                 nfs4_put_stid(&stp->st_stid);
4165         }
4166         return stp;
4167 }
4168
4169 static struct nfs4_openowner *
4170 alloc_init_open_stateowner(unsigned int strhashval, struct nfsd4_open *open,
4171                            struct nfsd4_compound_state *cstate)
4172 {
4173         struct nfs4_client *clp = cstate->clp;
4174         struct nfs4_openowner *oo, *ret;
4175
4176         oo = alloc_stateowner(openowner_slab, &open->op_owner, clp);
4177         if (!oo)
4178                 return NULL;
4179         oo->oo_owner.so_ops = &openowner_ops;
4180         oo->oo_owner.so_is_open_owner = 1;
4181         oo->oo_owner.so_seqid = open->op_seqid;
4182         oo->oo_flags = 0;
4183         if (nfsd4_has_session(cstate))
4184                 oo->oo_flags |= NFS4_OO_CONFIRMED;
4185         oo->oo_time = 0;
4186         oo->oo_last_closed_stid = NULL;
4187         INIT_LIST_HEAD(&oo->oo_close_lru);
4188         spin_lock(&clp->cl_lock);
4189         ret = find_openstateowner_str_locked(strhashval, open, clp);
4190         if (ret == NULL) {
4191                 hash_openowner(oo, clp, strhashval);
4192                 ret = oo;
4193         } else
4194                 nfs4_free_stateowner(&oo->oo_owner);
4195
4196         spin_unlock(&clp->cl_lock);
4197         return ret;
4198 }
4199
4200 static struct nfs4_ol_stateid *
4201 init_open_stateid(struct nfs4_file *fp, struct nfsd4_open *open)
4202 {
4203
4204         struct nfs4_openowner *oo = open->op_openowner;
4205         struct nfs4_ol_stateid *retstp = NULL;
4206         struct nfs4_ol_stateid *stp;
4207
4208         stp = open->op_stp;
4209         /* We are moving these outside of the spinlocks to avoid the warnings */
4210         mutex_init(&stp->st_mutex);
4211         mutex_lock_nested(&stp->st_mutex, OPEN_STATEID_MUTEX);
4212
4213 retry:
4214         spin_lock(&oo->oo_owner.so_client->cl_lock);
4215         spin_lock(&fp->fi_lock);
4216
4217         retstp = nfsd4_find_existing_open(fp, open);
4218         if (retstp)
4219                 goto out_unlock;
4220
4221         open->op_stp = NULL;
4222         refcount_inc(&stp->st_stid.sc_count);
4223         stp->st_stid.sc_type = NFS4_OPEN_STID;
4224         INIT_LIST_HEAD(&stp->st_locks);
4225         stp->st_stateowner = nfs4_get_stateowner(&oo->oo_owner);
4226         get_nfs4_file(fp);
4227         stp->st_stid.sc_file = fp;
4228         stp->st_access_bmap = 0;
4229         stp->st_deny_bmap = 0;
4230         stp->st_openstp = NULL;
4231         list_add(&stp->st_perstateowner, &oo->oo_owner.so_stateids);
4232         list_add(&stp->st_perfile, &fp->fi_stateids);
4233
4234 out_unlock:
4235         spin_unlock(&fp->fi_lock);
4236         spin_unlock(&oo->oo_owner.so_client->cl_lock);
4237         if (retstp) {
4238                 /* Handle races with CLOSE */
4239                 if (nfsd4_lock_ol_stateid(retstp) != nfs_ok) {
4240                         nfs4_put_stid(&retstp->st_stid);
4241                         goto retry;
4242                 }
4243                 /* To keep mutex tracking happy */
4244                 mutex_unlock(&stp->st_mutex);
4245                 stp = retstp;
4246         }
4247         return stp;
4248 }
4249
4250 /*
4251  * In the 4.0 case we need to keep the owners around a little while to handle
4252  * CLOSE replay. We still do need to release any file access that is held by
4253  * them before returning however.
4254  */
4255 static void
4256 move_to_close_lru(struct nfs4_ol_stateid *s, struct net *net)
4257 {
4258         struct nfs4_ol_stateid *last;
4259         struct nfs4_openowner *oo = openowner(s->st_stateowner);
4260         struct nfsd_net *nn = net_generic(s->st_stid.sc_client->net,
4261                                                 nfsd_net_id);
4262
4263         dprintk("NFSD: move_to_close_lru nfs4_openowner %p\n", oo);
4264
4265         /*
4266          * We know that we hold one reference via nfsd4_close, and another
4267          * "persistent" reference for the client. If the refcount is higher
4268          * than 2, then there are still calls in progress that are using this
4269          * stateid. We can't put the sc_file reference until they are finished.
4270          * Wait for the refcount to drop to 2. Since it has been unhashed,
4271          * there should be no danger of the refcount going back up again at
4272          * this point.
4273          */
4274         wait_event(close_wq, refcount_read(&s->st_stid.sc_count) == 2);
4275
4276         release_all_access(s);
4277         if (s->st_stid.sc_file) {
4278                 put_nfs4_file(s->st_stid.sc_file);
4279                 s->st_stid.sc_file = NULL;
4280         }
4281
4282         spin_lock(&nn->client_lock);
4283         last = oo->oo_last_closed_stid;
4284         oo->oo_last_closed_stid = s;
4285         list_move_tail(&oo->oo_close_lru, &nn->close_lru);
4286         oo->oo_time = get_seconds();
4287         spin_unlock(&nn->client_lock);
4288         if (last)
4289                 nfs4_put_stid(&last->st_stid);
4290 }
4291
4292 /* search file_hashtbl[] for file */
4293 static struct nfs4_file *
4294 find_file_locked(struct knfsd_fh *fh, unsigned int hashval)
4295 {
4296         struct nfs4_file *fp;
4297
4298         hlist_for_each_entry_rcu(fp, &file_hashtbl[hashval], fi_hash) {
4299                 if (fh_match(&fp->fi_fhandle, fh)) {
4300                         if (refcount_inc_not_zero(&fp->fi_ref))
4301                                 return fp;
4302                 }
4303         }
4304         return NULL;
4305 }
4306
4307 struct nfs4_file *
4308 find_file(struct knfsd_fh *fh)
4309 {
4310         struct nfs4_file *fp;
4311         unsigned int hashval = file_hashval(fh);
4312
4313         rcu_read_lock();
4314         fp = find_file_locked(fh, hashval);
4315         rcu_read_unlock();
4316         return fp;
4317 }
4318
4319 static struct nfs4_file *
4320 find_or_add_file(struct nfs4_file *new, struct knfsd_fh *fh)
4321 {
4322         struct nfs4_file *fp;
4323         unsigned int hashval = file_hashval(fh);
4324
4325         rcu_read_lock();
4326         fp = find_file_locked(fh, hashval);
4327         rcu_read_unlock();
4328         if (fp)
4329                 return fp;
4330
4331         spin_lock(&state_lock);
4332         fp = find_file_locked(fh, hashval);
4333         if (likely(fp == NULL)) {
4334                 nfsd4_init_file(fh, hashval, new);
4335                 fp = new;
4336         }
4337         spin_unlock(&state_lock);
4338
4339         return fp;
4340 }
4341
4342 /*
4343  * Called to check deny when READ with all zero stateid or
4344  * WRITE with all zero or all one stateid
4345  */
4346 static __be32
4347 nfs4_share_conflict(struct svc_fh *current_fh, unsigned int deny_type)
4348 {
4349         struct nfs4_file *fp;
4350         __be32 ret = nfs_ok;
4351
4352         fp = find_file(&current_fh->fh_handle);
4353         if (!fp)
4354                 return ret;
4355         /* Check for conflicting share reservations */
4356         spin_lock(&fp->fi_lock);
4357         if (fp->fi_share_deny & deny_type)
4358                 ret = nfserr_locked;
4359         spin_unlock(&fp->fi_lock);
4360         put_nfs4_file(fp);
4361         return ret;
4362 }
4363
4364 static void nfsd4_cb_recall_prepare(struct nfsd4_callback *cb)
4365 {
4366         struct nfs4_delegation *dp = cb_to_delegation(cb);
4367         struct nfsd_net *nn = net_generic(dp->dl_stid.sc_client->net,
4368                                           nfsd_net_id);
4369
4370         block_delegations(&dp->dl_stid.sc_file->fi_fhandle);
4371
4372         /*
4373          * We can't do this in nfsd_break_deleg_cb because it is
4374          * already holding inode->i_lock.
4375          *
4376          * If the dl_time != 0, then we know that it has already been
4377          * queued for a lease break. Don't queue it again.
4378          */
4379         spin_lock(&state_lock);
4380         if (dp->dl_time == 0) {
4381                 dp->dl_time = get_seconds();
4382                 list_add_tail(&dp->dl_recall_lru, &nn->del_recall_lru);
4383         }
4384         spin_unlock(&state_lock);
4385 }
4386
4387 static int nfsd4_cb_recall_done(struct nfsd4_callback *cb,
4388                 struct rpc_task *task)
4389 {
4390         struct nfs4_delegation *dp = cb_to_delegation(cb);
4391
4392         if (dp->dl_stid.sc_type == NFS4_CLOSED_DELEG_STID)
4393                 return 1;
4394
4395         switch (task->tk_status) {
4396         case 0:
4397                 return 1;
4398         case -NFS4ERR_DELAY:
4399                 rpc_delay(task, 2 * HZ);
4400                 return 0;
4401         case -EBADHANDLE:
4402         case -NFS4ERR_BAD_STATEID:
4403                 /*
4404                  * Race: client probably got cb_recall before open reply
4405                  * granting delegation.
4406                  */
4407                 if (dp->dl_retries--) {
4408                         rpc_delay(task, 2 * HZ);
4409                         return 0;
4410                 }
4411                 /*FALLTHRU*/
4412         default:
4413                 return 1;
4414         }
4415 }
4416
4417 static void nfsd4_cb_recall_release(struct nfsd4_callback *cb)
4418 {
4419         struct nfs4_delegation *dp = cb_to_delegation(cb);
4420
4421         nfs4_put_stid(&dp->dl_stid);
4422 }
4423
4424 static const struct nfsd4_callback_ops nfsd4_cb_recall_ops = {
4425         .prepare        = nfsd4_cb_recall_prepare,
4426         .done           = nfsd4_cb_recall_done,
4427         .release        = nfsd4_cb_recall_release,
4428 };
4429
4430 static void nfsd_break_one_deleg(struct nfs4_delegation *dp)
4431 {
4432         /*
4433          * We're assuming the state code never drops its reference
4434          * without first removing the lease.  Since we're in this lease
4435          * callback (and since the lease code is serialized by the
4436          * i_lock) we know the server hasn't removed the lease yet, and
4437          * we know it's safe to take a reference.
4438          */
4439         refcount_inc(&dp->dl_stid.sc_count);
4440         nfsd4_run_cb(&dp->dl_recall);
4441 }
4442
4443 /* Called from break_lease() with i_lock held. */
4444 static bool
4445 nfsd_break_deleg_cb(struct file_lock *fl)
4446 {
4447         bool ret = false;
4448         struct nfs4_delegation *dp = (struct nfs4_delegation *)fl->fl_owner;
4449         struct nfs4_file *fp = dp->dl_stid.sc_file;
4450
4451         /*
4452          * We don't want the locks code to timeout the lease for us;
4453          * we'll remove it ourself if a delegation isn't returned
4454          * in time:
4455          */
4456         fl->fl_break_time = 0;
4457
4458         spin_lock(&fp->fi_lock);
4459         fp->fi_had_conflict = true;
4460         nfsd_break_one_deleg(dp);
4461         spin_unlock(&fp->fi_lock);
4462         return ret;
4463 }
4464
4465 static int
4466 nfsd_change_deleg_cb(struct file_lock *onlist, int arg,
4467                      struct list_head *dispose)
4468 {
4469         if (arg & F_UNLCK)
4470                 return lease_modify(onlist, arg, dispose);
4471         else
4472                 return -EAGAIN;
4473 }
4474
4475 static const struct lock_manager_operations nfsd_lease_mng_ops = {
4476         .lm_break = nfsd_break_deleg_cb,
4477         .lm_change = nfsd_change_deleg_cb,
4478 };
4479
4480 static __be32 nfsd4_check_seqid(struct nfsd4_compound_state *cstate, struct nfs4_stateowner *so, u32 seqid)
4481 {
4482         if (nfsd4_has_session(cstate))
4483                 return nfs_ok;
4484         if (seqid == so->so_seqid - 1)
4485                 return nfserr_replay_me;
4486         if (seqid == so->so_seqid)
4487                 return nfs_ok;
4488         return nfserr_bad_seqid;
4489 }
4490
4491 static __be32 lookup_clientid(clientid_t *clid,
4492                 struct nfsd4_compound_state *cstate,
4493                 struct nfsd_net *nn)
4494 {
4495         struct nfs4_client *found;
4496
4497         if (cstate->clp) {
4498                 found = cstate->clp;
4499                 if (!same_clid(&found->cl_clientid, clid))
4500                         return nfserr_stale_clientid;
4501                 return nfs_ok;
4502         }
4503
4504         if (STALE_CLIENTID(clid, nn))
4505                 return nfserr_stale_clientid;
4506
4507         /*
4508          * For v4.1+ we get the client in the SEQUENCE op. If we don't have one
4509          * cached already then we know this is for is for v4.0 and "sessions"
4510          * will be false.
4511          */
4512         WARN_ON_ONCE(cstate->session);
4513         spin_lock(&nn->client_lock);
4514         found = find_confirmed_client(clid, false, nn);
4515         if (!found) {
4516                 spin_unlock(&nn->client_lock);
4517                 return nfserr_expired;
4518         }
4519         atomic_inc(&found->cl_rpc_users);
4520         spin_unlock(&nn->client_lock);
4521
4522         /* Cache the nfs4_client in cstate! */
4523         cstate->clp = found;
4524         return nfs_ok;
4525 }
4526
4527 __be32
4528 nfsd4_process_open1(struct nfsd4_compound_state *cstate,
4529                     struct nfsd4_open *open, struct nfsd_net *nn)
4530 {
4531         clientid_t *clientid = &open->op_clientid;
4532         struct nfs4_client *clp = NULL;
4533         unsigned int strhashval;
4534         struct nfs4_openowner *oo = NULL;
4535         __be32 status;
4536
4537         if (STALE_CLIENTID(&open->op_clientid, nn))
4538                 return nfserr_stale_clientid;
4539         /*
4540          * In case we need it later, after we've already created the
4541          * file and don't want to risk a further failure:
4542          */
4543         open->op_file = nfsd4_alloc_file();
4544         if (open->op_file == NULL)
4545                 return nfserr_jukebox;
4546
4547         status = lookup_clientid(clientid, cstate, nn);
4548         if (status)
4549                 return status;
4550         clp = cstate->clp;
4551
4552         strhashval = ownerstr_hashval(&open->op_owner);
4553         oo = find_openstateowner_str(strhashval, open, clp);
4554         open->op_openowner = oo;
4555         if (!oo) {
4556                 goto new_owner;
4557         }
4558         if (!(oo->oo_flags & NFS4_OO_CONFIRMED)) {
4559                 /* Replace unconfirmed owners without checking for replay. */
4560                 release_openowner(oo);
4561                 open->op_openowner = NULL;
4562                 goto new_owner;
4563         }
4564         status = nfsd4_check_seqid(cstate, &oo->oo_owner, open->op_seqid);
4565         if (status)
4566                 return status;
4567         goto alloc_stateid;
4568 new_owner:
4569         oo = alloc_init_open_stateowner(strhashval, open, cstate);
4570         if (oo == NULL)
4571                 return nfserr_jukebox;
4572         open->op_openowner = oo;
4573 alloc_stateid:
4574         open->op_stp = nfs4_alloc_open_stateid(clp);
4575         if (!open->op_stp)
4576                 return nfserr_jukebox;
4577
4578         if (nfsd4_has_session(cstate) &&
4579             (cstate->current_fh.fh_export->ex_flags & NFSEXP_PNFS)) {
4580                 open->op_odstate = alloc_clnt_odstate(clp);
4581                 if (!open->op_odstate)
4582                         return nfserr_jukebox;
4583         }
4584
4585         return nfs_ok;
4586 }
4587
4588 static inline __be32
4589 nfs4_check_delegmode(struct nfs4_delegation *dp, int flags)
4590 {
4591         if ((flags & WR_STATE) && (dp->dl_type == NFS4_OPEN_DELEGATE_READ))
4592                 return nfserr_openmode;
4593         else
4594                 return nfs_ok;
4595 }
4596
4597 static int share_access_to_flags(u32 share_access)
4598 {
4599         return share_access == NFS4_SHARE_ACCESS_READ ? RD_STATE : WR_STATE;
4600 }
4601
4602 static struct nfs4_delegation *find_deleg_stateid(struct nfs4_client *cl, stateid_t *s)
4603 {
4604         struct nfs4_stid *ret;
4605
4606         ret = find_stateid_by_type(cl, s,
4607                                 NFS4_DELEG_STID|NFS4_REVOKED_DELEG_STID);
4608         if (!ret)
4609                 return NULL;
4610         return delegstateid(ret);
4611 }
4612
4613 static bool nfsd4_is_deleg_cur(struct nfsd4_open *open)
4614 {
4615         return open->op_claim_type == NFS4_OPEN_CLAIM_DELEGATE_CUR ||
4616                open->op_claim_type == NFS4_OPEN_CLAIM_DELEG_CUR_FH;
4617 }
4618
4619 static __be32
4620 nfs4_check_deleg(struct nfs4_client *cl, struct nfsd4_open *open,
4621                 struct nfs4_delegation **dp)
4622 {
4623         int flags;
4624         __be32 status = nfserr_bad_stateid;
4625         struct nfs4_delegation *deleg;
4626
4627         deleg = find_deleg_stateid(cl, &open->op_delegate_stateid);
4628         if (deleg == NULL)
4629                 goto out;
4630         if (deleg->dl_stid.sc_type == NFS4_REVOKED_DELEG_STID) {
4631                 nfs4_put_stid(&deleg->dl_stid);
4632                 if (cl->cl_minorversion)
4633                         status = nfserr_deleg_revoked;
4634                 goto out;
4635         }
4636         flags = share_access_to_flags(open->op_share_access);
4637         status = nfs4_check_delegmode(deleg, flags);
4638         if (status) {
4639                 nfs4_put_stid(&deleg->dl_stid);
4640                 goto out;
4641         }
4642         *dp = deleg;
4643 out:
4644         if (!nfsd4_is_deleg_cur(open))
4645                 return nfs_ok;
4646         if (status)
4647                 return status;
4648         open->op_openowner->oo_flags |= NFS4_OO_CONFIRMED;
4649         return nfs_ok;
4650 }
4651
4652 static inline int nfs4_access_to_access(u32 nfs4_access)
4653 {
4654         int flags = 0;
4655
4656         if (nfs4_access & NFS4_SHARE_ACCESS_READ)
4657                 flags |= NFSD_MAY_READ;
4658         if (nfs4_access & NFS4_SHARE_ACCESS_WRITE)
4659                 flags |= NFSD_MAY_WRITE;
4660         return flags;
4661 }
4662
4663 static inline __be32
4664 nfsd4_truncate(struct svc_rqst *rqstp, struct svc_fh *fh,
4665                 struct nfsd4_open *open)
4666 {
4667         struct iattr iattr = {
4668                 .ia_valid = ATTR_SIZE,
4669                 .ia_size = 0,
4670         };
4671         if (!open->op_truncate)
4672                 return 0;
4673         if (!(open->op_share_access & NFS4_SHARE_ACCESS_WRITE))
4674                 return nfserr_inval;
4675         return nfsd_setattr(rqstp, fh, &iattr, 0, (time_t)0);
4676 }
4677
4678 static __be32 nfs4_get_vfs_file(struct svc_rqst *rqstp, struct nfs4_file *fp,
4679                 struct svc_fh *cur_fh, struct nfs4_ol_stateid *stp,
4680                 struct nfsd4_open *open)
4681 {
4682         struct nfsd_file *nf = NULL;
4683         __be32 status;
4684         int oflag = nfs4_access_to_omode(open->op_share_access);
4685         int access = nfs4_access_to_access(open->op_share_access);
4686         unsigned char old_access_bmap, old_deny_bmap;
4687
4688         spin_lock(&fp->fi_lock);
4689
4690         /*
4691          * Are we trying to set a deny mode that would conflict with
4692          * current access?
4693          */
4694         status = nfs4_file_check_deny(fp, open->op_share_deny);
4695         if (status != nfs_ok) {
4696                 spin_unlock(&fp->fi_lock);
4697                 goto out;
4698         }
4699
4700         /* set access to the file */
4701         status = nfs4_file_get_access(fp, open->op_share_access);
4702         if (status != nfs_ok) {
4703                 spin_unlock(&fp->fi_lock);
4704                 goto out;
4705         }
4706
4707         /* Set access bits in stateid */
4708         old_access_bmap = stp->st_access_bmap;
4709         set_access(open->op_share_access, stp);
4710
4711         /* Set new deny mask */
4712         old_deny_bmap = stp->st_deny_bmap;
4713         set_deny(open->op_share_deny, stp);
4714         fp->fi_share_deny |= (open->op_share_deny & NFS4_SHARE_DENY_BOTH);
4715
4716         if (!fp->fi_fds[oflag]) {
4717                 spin_unlock(&fp->fi_lock);
4718                 status = nfsd_file_acquire(rqstp, cur_fh, access, &nf);
4719                 if (status)
4720                         goto out_put_access;
4721                 spin_lock(&fp->fi_lock);
4722                 if (!fp->fi_fds[oflag]) {
4723                         fp->fi_fds[oflag] = nf;
4724                         nf = NULL;
4725                 }
4726         }
4727         spin_unlock(&fp->fi_lock);
4728         if (nf)
4729                 nfsd_file_put(nf);
4730
4731         status = nfsd4_truncate(rqstp, cur_fh, open);
4732         if (status)
4733                 goto out_put_access;
4734 out:
4735         return status;
4736 out_put_access:
4737         stp->st_access_bmap = old_access_bmap;
4738         nfs4_file_put_access(fp, open->op_share_access);
4739         reset_union_bmap_deny(bmap_to_share_mode(old_deny_bmap), stp);
4740         goto out;
4741 }
4742
4743 static __be32
4744 nfs4_upgrade_open(struct svc_rqst *rqstp, struct nfs4_file *fp, struct svc_fh *cur_fh, struct nfs4_ol_stateid *stp, struct nfsd4_open *open)
4745 {
4746         __be32 status;
4747         unsigned char old_deny_bmap = stp->st_deny_bmap;
4748
4749         if (!test_access(open->op_share_access, stp))
4750                 return nfs4_get_vfs_file(rqstp, fp, cur_fh, stp, open);
4751
4752         /* test and set deny mode */
4753         spin_lock(&fp->fi_lock);
4754         status = nfs4_file_check_deny(fp, open->op_share_deny);
4755         if (status == nfs_ok) {
4756                 set_deny(open->op_share_deny, stp);
4757                 fp->fi_share_deny |=
4758                                 (open->op_share_deny & NFS4_SHARE_DENY_BOTH);
4759         }
4760         spin_unlock(&fp->fi_lock);
4761
4762         if (status != nfs_ok)
4763                 return status;
4764
4765         status = nfsd4_truncate(rqstp, cur_fh, open);
4766         if (status != nfs_ok)
4767                 reset_union_bmap_deny(old_deny_bmap, stp);
4768         return status;
4769 }
4770
4771 /* Should we give out recallable state?: */
4772 static bool nfsd4_cb_channel_good(struct nfs4_client *clp)
4773 {
4774         if (clp->cl_cb_state == NFSD4_CB_UP)
4775                 return true;
4776         /*
4777          * In the sessions case, since we don't have to establish a
4778          * separate connection for callbacks, we assume it's OK
4779          * until we hear otherwise:
4780          */
4781         return clp->cl_minorversion && clp->cl_cb_state == NFSD4_CB_UNKNOWN;
4782 }
4783
4784 static struct file_lock *nfs4_alloc_init_lease(struct nfs4_delegation *dp,
4785                                                 int flag)
4786 {
4787         struct file_lock *fl;
4788
4789         fl = locks_alloc_lock();
4790         if (!fl)
4791                 return NULL;
4792         fl->fl_lmops = &nfsd_lease_mng_ops;
4793         fl->fl_flags = FL_DELEG;
4794         fl->fl_type = flag == NFS4_OPEN_DELEGATE_READ? F_RDLCK: F_WRLCK;
4795         fl->fl_end = OFFSET_MAX;
4796         fl->fl_owner = (fl_owner_t)dp;
4797         fl->fl_pid = current->tgid;
4798         fl->fl_file = dp->dl_stid.sc_file->fi_deleg_file->nf_file;
4799         return fl;
4800 }
4801
4802 static struct nfs4_delegation *
4803 nfs4_set_delegation(struct nfs4_client *clp, struct svc_fh *fh,
4804                     struct nfs4_file *fp, struct nfs4_clnt_odstate *odstate)
4805 {
4806         int status = 0;
4807         struct nfs4_delegation *dp;
4808         struct nfsd_file *nf;
4809         struct file_lock *fl;
4810
4811         /*
4812          * The fi_had_conflict and nfs_get_existing_delegation checks
4813          * here are just optimizations; we'll need to recheck them at
4814          * the end:
4815          */
4816         if (fp->fi_had_conflict)
4817                 return ERR_PTR(-EAGAIN);
4818
4819         nf = find_readable_file(fp);
4820         if (!nf) {
4821                 /* We should always have a readable file here */
4822                 WARN_ON_ONCE(1);
4823                 return ERR_PTR(-EBADF);
4824         }
4825         spin_lock(&state_lock);
4826         spin_lock(&fp->fi_lock);
4827         if (nfs4_delegation_exists(clp, fp))
4828                 status = -EAGAIN;
4829         else if (!fp->fi_deleg_file) {
4830                 fp->fi_deleg_file = nf;
4831                 /* increment early to prevent fi_deleg_file from being
4832                  * cleared */
4833                 fp->fi_delegees = 1;
4834                 nf = NULL;
4835         } else
4836                 fp->fi_delegees++;
4837         spin_unlock(&fp->fi_lock);
4838         spin_unlock(&state_lock);
4839         if (nf)
4840                 nfsd_file_put(nf);
4841         if (status)
4842                 return ERR_PTR(status);
4843
4844         status = -ENOMEM;
4845         dp = alloc_init_deleg(clp, fp, fh, odstate);
4846         if (!dp)
4847                 goto out_delegees;
4848
4849         fl = nfs4_alloc_init_lease(dp, NFS4_OPEN_DELEGATE_READ);
4850         if (!fl)
4851                 goto out_clnt_odstate;
4852
4853         status = vfs_setlease(fp->fi_deleg_file->nf_file, fl->fl_type, &fl, NULL);
4854         if (fl)
4855                 locks_free_lock(fl);
4856         if (status)
4857                 goto out_clnt_odstate;
4858
4859         spin_lock(&state_lock);
4860         spin_lock(&fp->fi_lock);
4861         if (fp->fi_had_conflict)
4862                 status = -EAGAIN;
4863         else
4864                 status = hash_delegation_locked(dp, fp);
4865         spin_unlock(&fp->fi_lock);
4866         spin_unlock(&state_lock);
4867
4868         if (status)
4869                 goto out_unlock;
4870
4871         return dp;
4872 out_unlock:
4873         vfs_setlease(fp->fi_deleg_file->nf_file, F_UNLCK, NULL, (void **)&dp);
4874 out_clnt_odstate:
4875         put_clnt_odstate(dp->dl_clnt_odstate);
4876         nfs4_put_stid(&dp->dl_stid);
4877 out_delegees:
4878         put_deleg_file(fp);
4879         return ERR_PTR(status);
4880 }
4881
4882 static void nfsd4_open_deleg_none_ext(struct nfsd4_open *open, int status)
4883 {
4884         open->op_delegate_type = NFS4_OPEN_DELEGATE_NONE_EXT;
4885         if (status == -EAGAIN)
4886                 open->op_why_no_deleg = WND4_CONTENTION;
4887         else {
4888                 open->op_why_no_deleg = WND4_RESOURCE;
4889                 switch (open->op_deleg_want) {
4890                 case NFS4_SHARE_WANT_READ_DELEG:
4891                 case NFS4_SHARE_WANT_WRITE_DELEG:
4892                 case NFS4_SHARE_WANT_ANY_DELEG:
4893                         break;
4894                 case NFS4_SHARE_WANT_CANCEL:
4895                         open->op_why_no_deleg = WND4_CANCELLED;
4896                         break;
4897                 case NFS4_SHARE_WANT_NO_DELEG:
4898                         WARN_ON_ONCE(1);
4899                 }
4900         }
4901 }
4902
4903 /*
4904  * Attempt to hand out a delegation.
4905  *
4906  * Note we don't support write delegations, and won't until the vfs has
4907  * proper support for them.
4908  */
4909 static void
4910 nfs4_open_delegation(struct svc_fh *fh, struct nfsd4_open *open,
4911                         struct nfs4_ol_stateid *stp)
4912 {
4913         struct nfs4_delegation *dp;
4914         struct nfs4_openowner *oo = openowner(stp->st_stateowner);
4915         struct nfs4_client *clp = stp->st_stid.sc_client;
4916         int cb_up;
4917         int status = 0;
4918
4919         cb_up = nfsd4_cb_channel_good(oo->oo_owner.so_client);
4920         open->op_recall = 0;
4921         switch (open->op_claim_type) {
4922                 case NFS4_OPEN_CLAIM_PREVIOUS:
4923                         if (!cb_up)
4924                                 open->op_recall = 1;
4925                         if (open->op_delegate_type != NFS4_OPEN_DELEGATE_READ)
4926                                 goto out_no_deleg;
4927                         break;
4928                 case NFS4_OPEN_CLAIM_NULL:
4929                 case NFS4_OPEN_CLAIM_FH:
4930                         /*
4931                          * Let's not give out any delegations till everyone's
4932                          * had the chance to reclaim theirs, *and* until
4933                          * NLM locks have all been reclaimed:
4934                          */
4935                         if (locks_in_grace(clp->net))
4936                                 goto out_no_deleg;
4937                         if (!cb_up || !(oo->oo_flags & NFS4_OO_CONFIRMED))
4938                                 goto out_no_deleg;
4939                         /*
4940                          * Also, if the file was opened for write or
4941                          * create, there's a good chance the client's
4942                          * about to write to it, resulting in an
4943                          * immediate recall (since we don't support
4944                          * write delegations):
4945                          */
4946                         if (open->op_share_access & NFS4_SHARE_ACCESS_WRITE)
4947                                 goto out_no_deleg;
4948                         if (open->op_create == NFS4_OPEN_CREATE)
4949                                 goto out_no_deleg;
4950                         break;
4951                 default:
4952                         goto out_no_deleg;
4953         }
4954         dp = nfs4_set_delegation(clp, fh, stp->st_stid.sc_file, stp->st_clnt_odstate);
4955         if (IS_ERR(dp))
4956                 goto out_no_deleg;
4957
4958         memcpy(&open->op_delegate_stateid, &dp->dl_stid.sc_stateid, sizeof(dp->dl_stid.sc_stateid));
4959
4960         dprintk("NFSD: delegation stateid=" STATEID_FMT "\n",
4961                 STATEID_VAL(&dp->dl_stid.sc_stateid));
4962         open->op_delegate_type = NFS4_OPEN_DELEGATE_READ;
4963         nfs4_put_stid(&dp->dl_stid);
4964         return;
4965 out_no_deleg:
4966         open->op_delegate_type = NFS4_OPEN_DELEGATE_NONE;
4967         if (open->op_claim_type == NFS4_OPEN_CLAIM_PREVIOUS &&
4968             open->op_delegate_type != NFS4_OPEN_DELEGATE_NONE) {
4969                 dprintk("NFSD: WARNING: refusing delegation reclaim\n");
4970                 open->op_recall = 1;
4971         }
4972
4973         /* 4.1 client asking for a delegation? */
4974         if (open->op_deleg_want)
4975                 nfsd4_open_deleg_none_ext(open, status);
4976         return;
4977 }
4978
4979 static void nfsd4_deleg_xgrade_none_ext(struct nfsd4_open *open,
4980                                         struct nfs4_delegation *dp)
4981 {
4982         if (open->op_deleg_want == NFS4_SHARE_WANT_READ_DELEG &&
4983             dp->dl_type == NFS4_OPEN_DELEGATE_WRITE) {
4984                 open->op_delegate_type = NFS4_OPEN_DELEGATE_NONE_EXT;
4985                 open->op_why_no_deleg = WND4_NOT_SUPP_DOWNGRADE;
4986         } else if (open->op_deleg_want == NFS4_SHARE_WANT_WRITE_DELEG &&
4987                    dp->dl_type == NFS4_OPEN_DELEGATE_WRITE) {
4988                 open->op_delegate_type = NFS4_OPEN_DELEGATE_NONE_EXT;
4989                 open->op_why_no_deleg = WND4_NOT_SUPP_UPGRADE;
4990         }
4991         /* Otherwise the client must be confused wanting a delegation
4992          * it already has, therefore we don't return
4993          * NFS4_OPEN_DELEGATE_NONE_EXT and reason.
4994          */
4995 }
4996
4997 __be32
4998 nfsd4_process_open2(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_open *open)
4999 {
5000         struct nfsd4_compoundres *resp = rqstp->rq_resp;
5001         struct nfs4_client *cl = open->op_openowner->oo_owner.so_client;
5002         struct nfs4_file *fp = NULL;
5003         struct nfs4_ol_stateid *stp = NULL;
5004         struct nfs4_delegation *dp = NULL;
5005         __be32 status;
5006         bool new_stp = false;
5007
5008         /*
5009          * Lookup file; if found, lookup stateid and check open request,
5010          * and check for delegations in the process of being recalled.
5011          * If not found, create the nfs4_file struct
5012          */
5013         fp = find_or_add_file(open->op_file, &current_fh->fh_handle);
5014         if (fp != open->op_file) {
5015                 status = nfs4_check_deleg(cl, open, &dp);
5016                 if (status)
5017                         goto out;
5018                 stp = nfsd4_find_and_lock_existing_open(fp, open);
5019         } else {
5020                 open->op_file = NULL;
5021                 status = nfserr_bad_stateid;
5022                 if (nfsd4_is_deleg_cur(open))
5023                         goto out;
5024         }
5025
5026         if (!stp) {
5027                 stp = init_open_stateid(fp, open);
5028                 if (!open->op_stp)
5029                         new_stp = true;
5030         }
5031
5032         /*
5033          * OPEN the file, or upgrade an existing OPEN.
5034          * If truncate fails, the OPEN fails.
5035          *
5036          * stp is already locked.
5037          */
5038         if (!new_stp) {
5039                 /* Stateid was found, this is an OPEN upgrade */
5040                 status = nfs4_upgrade_open(rqstp, fp, current_fh, stp, open);
5041                 if (status) {
5042                         mutex_unlock(&stp->st_mutex);
5043                         goto out;
5044                 }
5045         } else {
5046                 status = nfs4_get_vfs_file(rqstp, fp, current_fh, stp, open);
5047                 if (status) {
5048                         stp->st_stid.sc_type = NFS4_CLOSED_STID;
5049                         release_open_stateid(stp);
5050                         mutex_unlock(&stp->st_mutex);
5051                         goto out;
5052                 }
5053
5054                 stp->st_clnt_odstate = find_or_hash_clnt_odstate(fp,
5055                                                         open->op_odstate);
5056                 if (stp->st_clnt_odstate == open->op_odstate)
5057                         open->op_odstate = NULL;
5058         }
5059
5060         nfs4_inc_and_copy_stateid(&open->op_stateid, &stp->st_stid);
5061         mutex_unlock(&stp->st_mutex);
5062
5063         if (nfsd4_has_session(&resp->cstate)) {
5064                 if (open->op_deleg_want & NFS4_SHARE_WANT_NO_DELEG) {
5065                         open->op_delegate_type = NFS4_OPEN_DELEGATE_NONE_EXT;
5066                         open->op_why_no_deleg = WND4_NOT_WANTED;
5067                         goto nodeleg;
5068                 }
5069         }
5070
5071         /*
5072         * Attempt to hand out a delegation. No error return, because the
5073         * OPEN succeeds even if we fail.
5074         */
5075         nfs4_open_delegation(current_fh, open, stp);
5076 nodeleg:
5077         status = nfs_ok;
5078
5079         dprintk("%s: stateid=" STATEID_FMT "\n", __func__,
5080                 STATEID_VAL(&stp->st_stid.sc_stateid));
5081 out:
5082         /* 4.1 client trying to upgrade/downgrade delegation? */
5083         if (open->op_delegate_type == NFS4_OPEN_DELEGATE_NONE && dp &&
5084             open->op_deleg_want)
5085                 nfsd4_deleg_xgrade_none_ext(open, dp);
5086
5087         if (fp)
5088                 put_nfs4_file(fp);
5089         if (status == 0 && open->op_claim_type == NFS4_OPEN_CLAIM_PREVIOUS)
5090                 open->op_openowner->oo_flags |= NFS4_OO_CONFIRMED;
5091         /*
5092         * To finish the open response, we just need to set the rflags.
5093         */
5094         open->op_rflags = NFS4_OPEN_RESULT_LOCKTYPE_POSIX;
5095         if (nfsd4_has_session(&resp->cstate))
5096                 open->op_rflags |= NFS4_OPEN_RESULT_MAY_NOTIFY_LOCK;
5097         else if (!(open->op_openowner->oo_flags & NFS4_OO_CONFIRMED))
5098                 open->op_rflags |= NFS4_OPEN_RESULT_CONFIRM;
5099
5100         if (dp)
5101                 nfs4_put_stid(&dp->dl_stid);
5102         if (stp)
5103                 nfs4_put_stid(&stp->st_stid);
5104
5105         return status;
5106 }
5107
5108 void nfsd4_cleanup_open_state(struct nfsd4_compound_state *cstate,
5109                               struct nfsd4_open *open)
5110 {
5111         if (open->op_openowner) {
5112                 struct nfs4_stateowner *so = &open->op_openowner->oo_owner;
5113
5114                 nfsd4_cstate_assign_replay(cstate, so);
5115                 nfs4_put_stateowner(so);
5116         }
5117         if (open->op_file)
5118                 kmem_cache_free(file_slab, open->op_file);
5119         if (open->op_stp)
5120                 nfs4_put_stid(&open->op_stp->st_stid);
5121         if (open->op_odstate)
5122                 kmem_cache_free(odstate_slab, open->op_odstate);
5123 }
5124
5125 __be32
5126 nfsd4_renew(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
5127             union nfsd4_op_u *u)
5128 {
5129         clientid_t *clid = &u->renew;
5130         struct nfs4_client *clp;
5131         __be32 status;
5132         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
5133
5134         dprintk("process_renew(%08x/%08x): starting\n",
5135                         clid->cl_boot, clid->cl_id);
5136         status = lookup_clientid(clid, cstate, nn);
5137         if (status)
5138                 goto out;
5139         clp = cstate->clp;
5140         status = nfserr_cb_path_down;
5141         if (!list_empty(&clp->cl_delegations)
5142                         && clp->cl_cb_state != NFSD4_CB_UP)
5143                 goto out;
5144         status = nfs_ok;
5145 out:
5146         return status;
5147 }
5148
5149 void
5150 nfsd4_end_grace(struct nfsd_net *nn)
5151 {
5152         /* do nothing if grace period already ended */
5153         if (nn->grace_ended)
5154                 return;
5155
5156         nn->grace_ended = true;
5157         /*
5158          * If the server goes down again right now, an NFSv4
5159          * client will still be allowed to reclaim after it comes back up,
5160          * even if it hasn't yet had a chance to reclaim state this time.
5161          *
5162          */
5163         nfsd4_record_grace_done(nn);
5164         /*
5165          * At this point, NFSv4 clients can still reclaim.  But if the
5166          * server crashes, any that have not yet reclaimed will be out
5167          * of luck on the next boot.
5168          *
5169          * (NFSv4.1+ clients are considered to have reclaimed once they
5170          * call RECLAIM_COMPLETE.  NFSv4.0 clients are considered to
5171          * have reclaimed after their first OPEN.)
5172          */
5173         locks_end_grace(&nn->nfsd4_manager);
5174         /*
5175          * At this point, and once lockd and/or any other containers
5176          * exit their grace period, further reclaims will fail and
5177          * regular locking can resume.
5178          */
5179 }
5180
5181 /*
5182  * If we've waited a lease period but there are still clients trying to
5183  * reclaim, wait a little longer to give them a chance to finish.
5184  */
5185 static bool clients_still_reclaiming(struct nfsd_net *nn)
5186 {
5187         unsigned long now = get_seconds();
5188         unsigned long double_grace_period_end = nn->boot_time +
5189                                                 2 * nn->nfsd4_lease;
5190
5191         if (nn->track_reclaim_completes &&
5192                         atomic_read(&nn->nr_reclaim_complete) ==
5193                         nn->reclaim_str_hashtbl_size)
5194                 return false;
5195         if (!nn->somebody_reclaimed)
5196                 return false;
5197         nn->somebody_reclaimed = false;
5198         /*
5199          * If we've given them *two* lease times to reclaim, and they're
5200          * still not done, give up:
5201          */
5202         if (time_after(now, double_grace_period_end))
5203                 return false;
5204         return true;
5205 }
5206
5207 static time_t
5208 nfs4_laundromat(struct nfsd_net *nn)
5209 {
5210         struct nfs4_client *clp;
5211         struct nfs4_openowner *oo;
5212         struct nfs4_delegation *dp;
5213         struct nfs4_ol_stateid *stp;
5214         struct nfsd4_blocked_lock *nbl;
5215         struct list_head *pos, *next, reaplist;
5216         time_t cutoff = get_seconds() - nn->nfsd4_lease;
5217         time_t t, new_timeo = nn->nfsd4_lease;
5218
5219         dprintk("NFSD: laundromat service - starting\n");
5220
5221         if (clients_still_reclaiming(nn)) {
5222                 new_timeo = 0;
5223                 goto out;
5224         }
5225         dprintk("NFSD: end of grace period\n");
5226         nfsd4_end_grace(nn);
5227         INIT_LIST_HEAD(&reaplist);
5228         spin_lock(&nn->client_lock);
5229         list_for_each_safe(pos, next, &nn->client_lru) {
5230                 clp = list_entry(pos, struct nfs4_client, cl_lru);
5231                 if (time_after((unsigned long)clp->cl_time, (unsigned long)cutoff)) {
5232                         t = clp->cl_time - cutoff;
5233                         new_timeo = min(new_timeo, t);
5234                         break;
5235                 }
5236                 if (mark_client_expired_locked(clp)) {
5237                         dprintk("NFSD: client in use (clientid %08x)\n",
5238                                 clp->cl_clientid.cl_id);
5239                         continue;
5240                 }
5241                 list_add(&clp->cl_lru, &reaplist);
5242         }
5243         spin_unlock(&nn->client_lock);
5244         list_for_each_safe(pos, next, &reaplist) {
5245                 clp = list_entry(pos, struct nfs4_client, cl_lru);
5246                 dprintk("NFSD: purging unused client (clientid %08x)\n",
5247                         clp->cl_clientid.cl_id);
5248                 list_del_init(&clp->cl_lru);
5249                 expire_client(clp);
5250         }
5251         spin_lock(&state_lock);
5252         list_for_each_safe(pos, next, &nn->del_recall_lru) {
5253                 dp = list_entry (pos, struct nfs4_delegation, dl_recall_lru);
5254                 if (time_after((unsigned long)dp->dl_time, (unsigned long)cutoff)) {
5255                         t = dp->dl_time - cutoff;
5256                         new_timeo = min(new_timeo, t);
5257                         break;
5258                 }
5259                 WARN_ON(!unhash_delegation_locked(dp));
5260                 list_add(&dp->dl_recall_lru, &reaplist);
5261         }
5262         spin_unlock(&state_lock);
5263         while (!list_empty(&reaplist)) {
5264                 dp = list_first_entry(&reaplist, struct nfs4_delegation,
5265                                         dl_recall_lru);
5266                 list_del_init(&dp->dl_recall_lru);
5267                 revoke_delegation(dp);
5268         }
5269
5270         spin_lock(&nn->client_lock);
5271         while (!list_empty(&nn->close_lru)) {
5272                 oo = list_first_entry(&nn->close_lru, struct nfs4_openowner,
5273                                         oo_close_lru);
5274                 if (time_after((unsigned long)oo->oo_time,
5275                                (unsigned long)cutoff)) {
5276                         t = oo->oo_time - cutoff;
5277                         new_timeo = min(new_timeo, t);
5278                         break;
5279                 }
5280                 list_del_init(&oo->oo_close_lru);
5281                 stp = oo->oo_last_closed_stid;
5282                 oo->oo_last_closed_stid = NULL;
5283                 spin_unlock(&nn->client_lock);
5284                 nfs4_put_stid(&stp->st_stid);
5285                 spin_lock(&nn->client_lock);
5286         }
5287         spin_unlock(&nn->client_lock);
5288
5289         /*
5290          * It's possible for a client to try and acquire an already held lock
5291          * that is being held for a long time, and then lose interest in it.
5292          * So, we clean out any un-revisited request after a lease period
5293          * under the assumption that the client is no longer interested.
5294          *
5295          * RFC5661, sec. 9.6 states that the client must not rely on getting
5296          * notifications and must continue to poll for locks, even when the
5297          * server supports them. Thus this shouldn't lead to clients blocking
5298          * indefinitely once the lock does become free.
5299          */
5300         BUG_ON(!list_empty(&reaplist));
5301         spin_lock(&nn->blocked_locks_lock);
5302         while (!list_empty(&nn->blocked_locks_lru)) {
5303                 nbl = list_first_entry(&nn->blocked_locks_lru,
5304                                         struct nfsd4_blocked_lock, nbl_lru);
5305                 if (time_after((unsigned long)nbl->nbl_time,
5306                                (unsigned long)cutoff)) {
5307                         t = nbl->nbl_time - cutoff;
5308                         new_timeo = min(new_timeo, t);
5309                         break;
5310                 }
5311                 list_move(&nbl->nbl_lru, &reaplist);
5312                 list_del_init(&nbl->nbl_list);
5313         }
5314         spin_unlock(&nn->blocked_locks_lock);
5315
5316         while (!list_empty(&reaplist)) {
5317                 nbl = list_first_entry(&reaplist,
5318                                         struct nfsd4_blocked_lock, nbl_lru);
5319                 list_del_init(&nbl->nbl_lru);
5320                 free_blocked_lock(nbl);
5321         }
5322 out:
5323         new_timeo = max_t(time_t, new_timeo, NFSD_LAUNDROMAT_MINTIMEOUT);
5324         return new_timeo;
5325 }
5326
5327 static struct workqueue_struct *laundry_wq;
5328 static void laundromat_main(struct work_struct *);
5329
5330 static void
5331 laundromat_main(struct work_struct *laundry)
5332 {
5333         time_t t;
5334         struct delayed_work *dwork = to_delayed_work(laundry);
5335         struct nfsd_net *nn = container_of(dwork, struct nfsd_net,
5336                                            laundromat_work);
5337
5338         t = nfs4_laundromat(nn);
5339         dprintk("NFSD: laundromat_main - sleeping for %ld seconds\n", t);
5340         queue_delayed_work(laundry_wq, &nn->laundromat_work, t*HZ);
5341 }
5342
5343 static inline __be32 nfs4_check_fh(struct svc_fh *fhp, struct nfs4_stid *stp)
5344 {
5345         if (!fh_match(&fhp->fh_handle, &stp->sc_file->fi_fhandle))
5346                 return nfserr_bad_stateid;
5347         return nfs_ok;
5348 }
5349
5350 static inline int
5351 access_permit_read(struct nfs4_ol_stateid *stp)
5352 {
5353         return test_access(NFS4_SHARE_ACCESS_READ, stp) ||
5354                 test_access(NFS4_SHARE_ACCESS_BOTH, stp) ||
5355                 test_access(NFS4_SHARE_ACCESS_WRITE, stp);
5356 }
5357
5358 static inline int
5359 access_permit_write(struct nfs4_ol_stateid *stp)
5360 {
5361         return test_access(NFS4_SHARE_ACCESS_WRITE, stp) ||
5362                 test_access(NFS4_SHARE_ACCESS_BOTH, stp);
5363 }
5364
5365 static
5366 __be32 nfs4_check_openmode(struct nfs4_ol_stateid *stp, int flags)
5367 {
5368         __be32 status = nfserr_openmode;
5369
5370         /* For lock stateid's, we test the parent open, not the lock: */
5371         if (stp->st_openstp)
5372                 stp = stp->st_openstp;
5373         if ((flags & WR_STATE) && !access_permit_write(stp))
5374                 goto out;
5375         if ((flags & RD_STATE) && !access_permit_read(stp))
5376                 goto out;
5377         status = nfs_ok;
5378 out:
5379         return status;
5380 }
5381
5382 static inline __be32
5383 check_special_stateids(struct net *net, svc_fh *current_fh, stateid_t *stateid, int flags)
5384 {
5385         if (ONE_STATEID(stateid) && (flags & RD_STATE))
5386                 return nfs_ok;
5387         else if (opens_in_grace(net)) {
5388                 /* Answer in remaining cases depends on existence of
5389                  * conflicting state; so we must wait out the grace period. */
5390                 return nfserr_grace;
5391         } else if (flags & WR_STATE)
5392                 return nfs4_share_conflict(current_fh,
5393                                 NFS4_SHARE_DENY_WRITE);
5394         else /* (flags & RD_STATE) && ZERO_STATEID(stateid) */
5395                 return nfs4_share_conflict(current_fh,
5396                                 NFS4_SHARE_DENY_READ);
5397 }
5398
5399 /*
5400  * Allow READ/WRITE during grace period on recovered state only for files
5401  * that are not able to provide mandatory locking.
5402  */
5403 static inline int
5404 grace_disallows_io(struct net *net, struct inode *inode)
5405 {
5406         return opens_in_grace(net) && mandatory_lock(inode);
5407 }
5408
5409 static __be32 check_stateid_generation(stateid_t *in, stateid_t *ref, bool has_session)
5410 {
5411         /*
5412          * When sessions are used the stateid generation number is ignored
5413          * when it is zero.
5414          */
5415         if (has_session && in->si_generation == 0)
5416                 return nfs_ok;
5417
5418         if (in->si_generation == ref->si_generation)
5419                 return nfs_ok;
5420
5421         /* If the client sends us a stateid from the future, it's buggy: */
5422         if (nfsd4_stateid_generation_after(in, ref))
5423                 return nfserr_bad_stateid;
5424         /*
5425          * However, we could see a stateid from the past, even from a
5426          * non-buggy client.  For example, if the client sends a lock
5427          * while some IO is outstanding, the lock may bump si_generation
5428          * while the IO is still in flight.  The client could avoid that
5429          * situation by waiting for responses on all the IO requests,
5430          * but better performance may result in retrying IO that
5431          * receives an old_stateid error if requests are rarely
5432          * reordered in flight:
5433          */
5434         return nfserr_old_stateid;
5435 }
5436
5437 static __be32 nfsd4_stid_check_stateid_generation(stateid_t *in, struct nfs4_stid *s, bool has_session)
5438 {
5439         __be32 ret;
5440
5441         spin_lock(&s->sc_lock);
5442         ret = nfsd4_verify_open_stid(s);
5443         if (ret == nfs_ok)
5444                 ret = check_stateid_generation(in, &s->sc_stateid, has_session);
5445         spin_unlock(&s->sc_lock);
5446         return ret;
5447 }
5448
5449 static __be32 nfsd4_check_openowner_confirmed(struct nfs4_ol_stateid *ols)
5450 {
5451         if (ols->st_stateowner->so_is_open_owner &&
5452             !(openowner(ols->st_stateowner)->oo_flags & NFS4_OO_CONFIRMED))
5453                 return nfserr_bad_stateid;
5454         return nfs_ok;
5455 }
5456
5457 static __be32 nfsd4_validate_stateid(struct nfs4_client *cl, stateid_t *stateid)
5458 {
5459         struct nfs4_stid *s;
5460         __be32 status = nfserr_bad_stateid;
5461
5462         if (ZERO_STATEID(stateid) || ONE_STATEID(stateid) ||
5463                 CLOSE_STATEID(stateid))
5464                 return status;
5465         /* Client debugging aid. */
5466         if (!same_clid(&stateid->si_opaque.so_clid, &cl->cl_clientid)) {
5467                 char addr_str[INET6_ADDRSTRLEN];
5468                 rpc_ntop((struct sockaddr *)&cl->cl_addr, addr_str,
5469                                  sizeof(addr_str));
5470                 pr_warn_ratelimited("NFSD: client %s testing state ID "
5471                                         "with incorrect client ID\n", addr_str);
5472                 return status;
5473         }
5474         spin_lock(&cl->cl_lock);
5475         s = find_stateid_locked(cl, stateid);
5476         if (!s)
5477                 goto out_unlock;
5478         status = nfsd4_stid_check_stateid_generation(stateid, s, 1);
5479         if (status)
5480                 goto out_unlock;
5481         switch (s->sc_type) {
5482         case NFS4_DELEG_STID:
5483                 status = nfs_ok;
5484                 break;
5485         case NFS4_REVOKED_DELEG_STID:
5486                 status = nfserr_deleg_revoked;
5487                 break;
5488         case NFS4_OPEN_STID:
5489         case NFS4_LOCK_STID:
5490                 status = nfsd4_check_openowner_confirmed(openlockstateid(s));
5491                 break;
5492         default:
5493                 printk("unknown stateid type %x\n", s->sc_type);
5494                 /* Fallthrough */
5495         case NFS4_CLOSED_STID:
5496         case NFS4_CLOSED_DELEG_STID:
5497                 status = nfserr_bad_stateid;
5498         }
5499 out_unlock:
5500         spin_unlock(&cl->cl_lock);
5501         return status;
5502 }
5503
5504 __be32
5505 nfsd4_lookup_stateid(struct nfsd4_compound_state *cstate,
5506                      stateid_t *stateid, unsigned char typemask,
5507                      struct nfs4_stid **s, struct nfsd_net *nn)
5508 {
5509         __be32 status;
5510         bool return_revoked = false;
5511
5512         /*
5513          *  only return revoked delegations if explicitly asked.
5514          *  otherwise we report revoked or bad_stateid status.
5515          */
5516         if (typemask & NFS4_REVOKED_DELEG_STID)
5517                 return_revoked = true;
5518         else if (typemask & NFS4_DELEG_STID)
5519                 typemask |= NFS4_REVOKED_DELEG_STID;
5520
5521         if (ZERO_STATEID(stateid) || ONE_STATEID(stateid) ||
5522                 CLOSE_STATEID(stateid))
5523                 return nfserr_bad_stateid;
5524         status = lookup_clientid(&stateid->si_opaque.so_clid, cstate, nn);
5525         if (status == nfserr_stale_clientid) {
5526                 if (cstate->session)
5527                         return nfserr_bad_stateid;
5528                 return nfserr_stale_stateid;
5529         }
5530         if (status)
5531                 return status;
5532         *s = find_stateid_by_type(cstate->clp, stateid, typemask);
5533         if (!*s)
5534                 return nfserr_bad_stateid;
5535         if (((*s)->sc_type == NFS4_REVOKED_DELEG_STID) && !return_revoked) {
5536                 nfs4_put_stid(*s);
5537                 if (cstate->minorversion)
5538                         return nfserr_deleg_revoked;
5539                 return nfserr_bad_stateid;
5540         }
5541         return nfs_ok;
5542 }
5543
5544 static struct nfsd_file *
5545 nfs4_find_file(struct nfs4_stid *s, int flags)
5546 {
5547         if (!s)
5548                 return NULL;
5549
5550         switch (s->sc_type) {
5551         case NFS4_DELEG_STID:
5552                 if (WARN_ON_ONCE(!s->sc_file->fi_deleg_file))
5553                         return NULL;
5554                 return nfsd_file_get(s->sc_file->fi_deleg_file);
5555         case NFS4_OPEN_STID:
5556         case NFS4_LOCK_STID:
5557                 if (flags & RD_STATE)
5558                         return find_readable_file(s->sc_file);
5559                 else
5560                         return find_writeable_file(s->sc_file);
5561                 break;
5562         }
5563
5564         return NULL;
5565 }
5566
5567 static __be32
5568 nfs4_check_olstateid(struct nfs4_ol_stateid *ols, int flags)
5569 {
5570         __be32 status;
5571
5572         status = nfsd4_check_openowner_confirmed(ols);
5573         if (status)
5574                 return status;
5575         return nfs4_check_openmode(ols, flags);
5576 }
5577
5578 static __be32
5579 nfs4_check_file(struct svc_rqst *rqstp, struct svc_fh *fhp, struct nfs4_stid *s,
5580                 struct nfsd_file **nfp, int flags)
5581 {
5582         int acc = (flags & RD_STATE) ? NFSD_MAY_READ : NFSD_MAY_WRITE;
5583         struct nfsd_file *nf;
5584         __be32 status;
5585
5586         nf = nfs4_find_file(s, flags);
5587         if (nf) {
5588                 status = nfsd_permission(rqstp, fhp->fh_export, fhp->fh_dentry,
5589                                 acc | NFSD_MAY_OWNER_OVERRIDE);
5590                 if (status) {
5591                         nfsd_file_put(nf);
5592                         goto out;
5593                 }
5594         } else {
5595                 status = nfsd_file_acquire(rqstp, fhp, acc, &nf);
5596                 if (status)
5597                         return status;
5598         }
5599         *nfp = nf;
5600 out:
5601         return status;
5602 }
5603
5604 /*
5605  * Checks for stateid operations
5606  */
5607 __be32
5608 nfs4_preprocess_stateid_op(struct svc_rqst *rqstp,
5609                 struct nfsd4_compound_state *cstate, struct svc_fh *fhp,
5610                 stateid_t *stateid, int flags, struct nfsd_file **nfp)
5611 {
5612         struct inode *ino = d_inode(fhp->fh_dentry);
5613         struct net *net = SVC_NET(rqstp);
5614         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
5615         struct nfs4_stid *s = NULL;
5616         __be32 status;
5617
5618         if (nfp)
5619                 *nfp = NULL;
5620
5621         if (grace_disallows_io(net, ino))
5622                 return nfserr_grace;
5623
5624         if (ZERO_STATEID(stateid) || ONE_STATEID(stateid)) {
5625                 status = check_special_stateids(net, fhp, stateid, flags);
5626                 goto done;
5627         }
5628
5629         status = nfsd4_lookup_stateid(cstate, stateid,
5630                                 NFS4_DELEG_STID|NFS4_OPEN_STID|NFS4_LOCK_STID,
5631                                 &s, nn);
5632         if (status)
5633                 return status;
5634         status = nfsd4_stid_check_stateid_generation(stateid, s,
5635                         nfsd4_has_session(cstate));
5636         if (status)
5637                 goto out;
5638
5639         switch (s->sc_type) {
5640         case NFS4_DELEG_STID:
5641                 status = nfs4_check_delegmode(delegstateid(s), flags);
5642                 break;
5643         case NFS4_OPEN_STID:
5644         case NFS4_LOCK_STID:
5645                 status = nfs4_check_olstateid(openlockstateid(s), flags);
5646                 break;
5647         default:
5648                 status = nfserr_bad_stateid;
5649                 break;
5650         }
5651         if (status)
5652                 goto out;
5653         status = nfs4_check_fh(fhp, s);
5654
5655 done:
5656         if (status == nfs_ok && nfp)
5657                 status = nfs4_check_file(rqstp, fhp, s, nfp, flags);
5658 out:
5659         if (s)
5660                 nfs4_put_stid(s);
5661         return status;
5662 }
5663
5664 /*
5665  * Test if the stateid is valid
5666  */
5667 __be32
5668 nfsd4_test_stateid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
5669                    union nfsd4_op_u *u)
5670 {
5671         struct nfsd4_test_stateid *test_stateid = &u->test_stateid;
5672         struct nfsd4_test_stateid_id *stateid;
5673         struct nfs4_client *cl = cstate->session->se_client;
5674
5675         list_for_each_entry(stateid, &test_stateid->ts_stateid_list, ts_id_list)
5676                 stateid->ts_id_status =
5677                         nfsd4_validate_stateid(cl, &stateid->ts_id_stateid);
5678
5679         return nfs_ok;
5680 }
5681
5682 static __be32
5683 nfsd4_free_lock_stateid(stateid_t *stateid, struct nfs4_stid *s)
5684 {
5685         struct nfs4_ol_stateid *stp = openlockstateid(s);
5686         __be32 ret;
5687
5688         ret = nfsd4_lock_ol_stateid(stp);
5689         if (ret)
5690                 goto out_put_stid;
5691
5692         ret = check_stateid_generation(stateid, &s->sc_stateid, 1);
5693         if (ret)
5694                 goto out;
5695
5696         ret = nfserr_locks_held;
5697         if (check_for_locks(stp->st_stid.sc_file,
5698                             lockowner(stp->st_stateowner)))
5699                 goto out;
5700
5701         release_lock_stateid(stp);
5702         ret = nfs_ok;
5703
5704 out:
5705         mutex_unlock(&stp->st_mutex);
5706 out_put_stid:
5707         nfs4_put_stid(s);
5708         return ret;
5709 }
5710
5711 __be32
5712 nfsd4_free_stateid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
5713                    union nfsd4_op_u *u)
5714 {
5715         struct nfsd4_free_stateid *free_stateid = &u->free_stateid;
5716         stateid_t *stateid = &free_stateid->fr_stateid;
5717         struct nfs4_stid *s;
5718         struct nfs4_delegation *dp;
5719         struct nfs4_client *cl = cstate->session->se_client;
5720         __be32 ret = nfserr_bad_stateid;
5721
5722         spin_lock(&cl->cl_lock);
5723         s = find_stateid_locked(cl, stateid);
5724         if (!s)
5725                 goto out_unlock;
5726         spin_lock(&s->sc_lock);
5727         switch (s->sc_type) {
5728         case NFS4_DELEG_STID:
5729                 ret = nfserr_locks_held;
5730                 break;
5731         case NFS4_OPEN_STID:
5732                 ret = check_stateid_generation(stateid, &s->sc_stateid, 1);
5733                 if (ret)
5734                         break;
5735                 ret = nfserr_locks_held;
5736                 break;
5737         case NFS4_LOCK_STID:
5738                 spin_unlock(&s->sc_lock);
5739                 refcount_inc(&s->sc_count);
5740                 spin_unlock(&cl->cl_lock);
5741                 ret = nfsd4_free_lock_stateid(stateid, s);
5742                 goto out;
5743         case NFS4_REVOKED_DELEG_STID:
5744                 spin_unlock(&s->sc_lock);
5745                 dp = delegstateid(s);
5746                 list_del_init(&dp->dl_recall_lru);
5747                 spin_unlock(&cl->cl_lock);
5748                 nfs4_put_stid(s);
5749                 ret = nfs_ok;
5750                 goto out;
5751         /* Default falls through and returns nfserr_bad_stateid */
5752         }
5753         spin_unlock(&s->sc_lock);
5754 out_unlock:
5755         spin_unlock(&cl->cl_lock);
5756 out:
5757         return ret;
5758 }
5759
5760 static inline int
5761 setlkflg (int type)
5762 {
5763         return (type == NFS4_READW_LT || type == NFS4_READ_LT) ?
5764                 RD_STATE : WR_STATE;
5765 }
5766
5767 static __be32 nfs4_seqid_op_checks(struct nfsd4_compound_state *cstate, stateid_t *stateid, u32 seqid, struct nfs4_ol_stateid *stp)
5768 {
5769         struct svc_fh *current_fh = &cstate->current_fh;
5770         struct nfs4_stateowner *sop = stp->st_stateowner;
5771         __be32 status;
5772
5773         status = nfsd4_check_seqid(cstate, sop, seqid);
5774         if (status)
5775                 return status;
5776         status = nfsd4_lock_ol_stateid(stp);
5777         if (status != nfs_ok)
5778                 return status;
5779         status = check_stateid_generation(stateid, &stp->st_stid.sc_stateid, nfsd4_has_session(cstate));
5780         if (status == nfs_ok)
5781                 status = nfs4_check_fh(current_fh, &stp->st_stid);
5782         if (status != nfs_ok)
5783                 mutex_unlock(&stp->st_mutex);
5784         return status;
5785 }
5786
5787 /*
5788  * Checks for sequence id mutating operations.
5789  */
5790 static __be32
5791 nfs4_preprocess_seqid_op(struct nfsd4_compound_state *cstate, u32 seqid,
5792                          stateid_t *stateid, char typemask,
5793                          struct nfs4_ol_stateid **stpp,
5794                          struct nfsd_net *nn)
5795 {
5796         __be32 status;
5797         struct nfs4_stid *s;
5798         struct nfs4_ol_stateid *stp = NULL;
5799
5800         dprintk("NFSD: %s: seqid=%d stateid = " STATEID_FMT "\n", __func__,
5801                 seqid, STATEID_VAL(stateid));
5802
5803         *stpp = NULL;
5804         status = nfsd4_lookup_stateid(cstate, stateid, typemask, &s, nn);
5805         if (status)
5806                 return status;
5807         stp = openlockstateid(s);
5808         nfsd4_cstate_assign_replay(cstate, stp->st_stateowner);
5809
5810         status = nfs4_seqid_op_checks(cstate, stateid, seqid, stp);
5811         if (!status)
5812                 *stpp = stp;
5813         else
5814                 nfs4_put_stid(&stp->st_stid);
5815         return status;
5816 }
5817
5818 static __be32 nfs4_preprocess_confirmed_seqid_op(struct nfsd4_compound_state *cstate, u32 seqid,
5819                                                  stateid_t *stateid, struct nfs4_ol_stateid **stpp, struct nfsd_net *nn)
5820 {
5821         __be32 status;
5822         struct nfs4_openowner *oo;
5823         struct nfs4_ol_stateid *stp;
5824
5825         status = nfs4_preprocess_seqid_op(cstate, seqid, stateid,
5826                                                 NFS4_OPEN_STID, &stp, nn);
5827         if (status)
5828                 return status;
5829         oo = openowner(stp->st_stateowner);
5830         if (!(oo->oo_flags & NFS4_OO_CONFIRMED)) {
5831                 mutex_unlock(&stp->st_mutex);
5832                 nfs4_put_stid(&stp->st_stid);
5833                 return nfserr_bad_stateid;
5834         }
5835         *stpp = stp;
5836         return nfs_ok;
5837 }
5838
5839 __be32
5840 nfsd4_open_confirm(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
5841                    union nfsd4_op_u *u)
5842 {
5843         struct nfsd4_open_confirm *oc = &u->open_confirm;
5844         __be32 status;
5845         struct nfs4_openowner *oo;
5846         struct nfs4_ol_stateid *stp;
5847         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
5848
5849         dprintk("NFSD: nfsd4_open_confirm on file %pd\n",
5850                         cstate->current_fh.fh_dentry);
5851
5852         status = fh_verify(rqstp, &cstate->current_fh, S_IFREG, 0);
5853         if (status)
5854                 return status;
5855
5856         status = nfs4_preprocess_seqid_op(cstate,
5857                                         oc->oc_seqid, &oc->oc_req_stateid,
5858                                         NFS4_OPEN_STID, &stp, nn);
5859         if (status)
5860                 goto out;
5861         oo = openowner(stp->st_stateowner);
5862         status = nfserr_bad_stateid;
5863         if (oo->oo_flags & NFS4_OO_CONFIRMED) {
5864                 mutex_unlock(&stp->st_mutex);
5865                 goto put_stateid;
5866         }
5867         oo->oo_flags |= NFS4_OO_CONFIRMED;
5868         nfs4_inc_and_copy_stateid(&oc->oc_resp_stateid, &stp->st_stid);
5869         mutex_unlock(&stp->st_mutex);
5870         dprintk("NFSD: %s: success, seqid=%d stateid=" STATEID_FMT "\n",
5871                 __func__, oc->oc_seqid, STATEID_VAL(&stp->st_stid.sc_stateid));
5872
5873         nfsd4_client_record_create(oo->oo_owner.so_client);
5874         status = nfs_ok;
5875 put_stateid:
5876         nfs4_put_stid(&stp->st_stid);
5877 out:
5878         nfsd4_bump_seqid(cstate, status);
5879         return status;
5880 }
5881
5882 static inline void nfs4_stateid_downgrade_bit(struct nfs4_ol_stateid *stp, u32 access)
5883 {
5884         if (!test_access(access, stp))
5885                 return;
5886         nfs4_file_put_access(stp->st_stid.sc_file, access);
5887         clear_access(access, stp);
5888 }
5889
5890 static inline void nfs4_stateid_downgrade(struct nfs4_ol_stateid *stp, u32 to_access)
5891 {
5892         switch (to_access) {
5893         case NFS4_SHARE_ACCESS_READ:
5894                 nfs4_stateid_downgrade_bit(stp, NFS4_SHARE_ACCESS_WRITE);
5895                 nfs4_stateid_downgrade_bit(stp, NFS4_SHARE_ACCESS_BOTH);
5896                 break;
5897         case NFS4_SHARE_ACCESS_WRITE:
5898                 nfs4_stateid_downgrade_bit(stp, NFS4_SHARE_ACCESS_READ);
5899                 nfs4_stateid_downgrade_bit(stp, NFS4_SHARE_ACCESS_BOTH);
5900                 break;
5901         case NFS4_SHARE_ACCESS_BOTH:
5902                 break;
5903         default:
5904                 WARN_ON_ONCE(1);
5905         }
5906 }
5907
5908 __be32
5909 nfsd4_open_downgrade(struct svc_rqst *rqstp,
5910                      struct nfsd4_compound_state *cstate, union nfsd4_op_u *u)
5911 {
5912         struct nfsd4_open_downgrade *od = &u->open_downgrade;
5913         __be32 status;
5914         struct nfs4_ol_stateid *stp;
5915         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
5916
5917         dprintk("NFSD: nfsd4_open_downgrade on file %pd\n",
5918                         cstate->current_fh.fh_dentry);
5919
5920         /* We don't yet support WANT bits: */
5921         if (od->od_deleg_want)
5922                 dprintk("NFSD: %s: od_deleg_want=0x%x ignored\n", __func__,
5923                         od->od_deleg_want);
5924
5925         status = nfs4_preprocess_confirmed_seqid_op(cstate, od->od_seqid,
5926                                         &od->od_stateid, &stp, nn);
5927         if (status)
5928                 goto out;
5929         status = nfserr_inval;
5930         if (!test_access(od->od_share_access, stp)) {
5931                 dprintk("NFSD: access not a subset of current bitmap: 0x%hhx, input access=%08x\n",
5932                         stp->st_access_bmap, od->od_share_access);
5933                 goto put_stateid;
5934         }
5935         if (!test_deny(od->od_share_deny, stp)) {
5936                 dprintk("NFSD: deny not a subset of current bitmap: 0x%hhx, input deny=%08x\n",
5937                         stp->st_deny_bmap, od->od_share_deny);
5938                 goto put_stateid;
5939         }
5940         nfs4_stateid_downgrade(stp, od->od_share_access);
5941         reset_union_bmap_deny(od->od_share_deny, stp);
5942         nfs4_inc_and_copy_stateid(&od->od_stateid, &stp->st_stid);
5943         status = nfs_ok;
5944 put_stateid:
5945         mutex_unlock(&stp->st_mutex);
5946         nfs4_put_stid(&stp->st_stid);
5947 out:
5948         nfsd4_bump_seqid(cstate, status);
5949         return status;
5950 }
5951
5952 static void nfsd4_close_open_stateid(struct nfs4_ol_stateid *s)
5953 {
5954         struct nfs4_client *clp = s->st_stid.sc_client;
5955         bool unhashed;
5956         LIST_HEAD(reaplist);
5957
5958         spin_lock(&clp->cl_lock);
5959         unhashed = unhash_open_stateid(s, &reaplist);
5960
5961         if (clp->cl_minorversion) {
5962                 if (unhashed)
5963                         put_ol_stateid_locked(s, &reaplist);
5964                 spin_unlock(&clp->cl_lock);
5965                 free_ol_stateid_reaplist(&reaplist);
5966         } else {
5967                 spin_unlock(&clp->cl_lock);
5968                 free_ol_stateid_reaplist(&reaplist);
5969                 if (unhashed)
5970                         move_to_close_lru(s, clp->net);
5971         }
5972 }
5973
5974 /*
5975  * nfs4_unlock_state() called after encode
5976  */
5977 __be32
5978 nfsd4_close(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
5979                 union nfsd4_op_u *u)
5980 {
5981         struct nfsd4_close *close = &u->close;
5982         __be32 status;
5983         struct nfs4_ol_stateid *stp;
5984         struct net *net = SVC_NET(rqstp);
5985         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
5986
5987         dprintk("NFSD: nfsd4_close on file %pd\n",
5988                         cstate->current_fh.fh_dentry);
5989
5990         status = nfs4_preprocess_seqid_op(cstate, close->cl_seqid,
5991                                         &close->cl_stateid,
5992                                         NFS4_OPEN_STID|NFS4_CLOSED_STID,
5993                                         &stp, nn);
5994         nfsd4_bump_seqid(cstate, status);
5995         if (status)
5996                 goto out;
5997
5998         stp->st_stid.sc_type = NFS4_CLOSED_STID;
5999
6000         /*
6001          * Technically we don't _really_ have to increment or copy it, since
6002          * it should just be gone after this operation and we clobber the
6003          * copied value below, but we continue to do so here just to ensure
6004          * that racing ops see that there was a state change.
6005          */
6006         nfs4_inc_and_copy_stateid(&close->cl_stateid, &stp->st_stid);
6007
6008         nfsd4_close_open_stateid(stp);
6009         mutex_unlock(&stp->st_mutex);
6010
6011         /* v4.1+ suggests that we send a special stateid in here, since the
6012          * clients should just ignore this anyway. Since this is not useful
6013          * for v4.0 clients either, we set it to the special close_stateid
6014          * universally.
6015          *
6016          * See RFC5661 section 18.2.4, and RFC7530 section 16.2.5
6017          */
6018         memcpy(&close->cl_stateid, &close_stateid, sizeof(close->cl_stateid));
6019
6020         /* put reference from nfs4_preprocess_seqid_op */
6021         nfs4_put_stid(&stp->st_stid);
6022 out:
6023         return status;
6024 }
6025
6026 __be32
6027 nfsd4_delegreturn(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
6028                   union nfsd4_op_u *u)
6029 {
6030         struct nfsd4_delegreturn *dr = &u->delegreturn;
6031         struct nfs4_delegation *dp;
6032         stateid_t *stateid = &dr->dr_stateid;
6033         struct nfs4_stid *s;
6034         __be32 status;
6035         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
6036
6037         if ((status = fh_verify(rqstp, &cstate->current_fh, S_IFREG, 0)))
6038                 return status;
6039
6040         status = nfsd4_lookup_stateid(cstate, stateid, NFS4_DELEG_STID, &s, nn);
6041         if (status)
6042                 goto out;
6043         dp = delegstateid(s);
6044         status = nfsd4_stid_check_stateid_generation(stateid, &dp->dl_stid, nfsd4_has_session(cstate));
6045         if (status)
6046                 goto put_stateid;
6047
6048         destroy_delegation(dp);
6049 put_stateid:
6050         nfs4_put_stid(&dp->dl_stid);
6051 out:
6052         return status;
6053 }
6054
6055 static inline u64
6056 end_offset(u64 start, u64 len)
6057 {
6058         u64 end;
6059
6060         end = start + len;
6061         return end >= start ? end: NFS4_MAX_UINT64;
6062 }
6063
6064 /* last octet in a range */
6065 static inline u64
6066 last_byte_offset(u64 start, u64 len)
6067 {
6068         u64 end;
6069
6070         WARN_ON_ONCE(!len);
6071         end = start + len;
6072         return end > start ? end - 1: NFS4_MAX_UINT64;
6073 }
6074
6075 /*
6076  * TODO: Linux file offsets are _signed_ 64-bit quantities, which means that
6077  * we can't properly handle lock requests that go beyond the (2^63 - 1)-th
6078  * byte, because of sign extension problems.  Since NFSv4 calls for 64-bit
6079  * locking, this prevents us from being completely protocol-compliant.  The
6080  * real solution to this problem is to start using unsigned file offsets in
6081  * the VFS, but this is a very deep change!
6082  */
6083 static inline void
6084 nfs4_transform_lock_offset(struct file_lock *lock)
6085 {
6086         if (lock->fl_start < 0)
6087                 lock->fl_start = OFFSET_MAX;
6088         if (lock->fl_end < 0)
6089                 lock->fl_end = OFFSET_MAX;
6090 }
6091
6092 static fl_owner_t
6093 nfsd4_fl_get_owner(fl_owner_t owner)
6094 {
6095         struct nfs4_lockowner *lo = (struct nfs4_lockowner *)owner;
6096
6097         nfs4_get_stateowner(&lo->lo_owner);
6098         return owner;
6099 }
6100
6101 static void
6102 nfsd4_fl_put_owner(fl_owner_t owner)
6103 {
6104         struct nfs4_lockowner *lo = (struct nfs4_lockowner *)owner;
6105
6106         if (lo)
6107                 nfs4_put_stateowner(&lo->lo_owner);
6108 }
6109
6110 static void
6111 nfsd4_lm_notify(struct file_lock *fl)
6112 {
6113         struct nfs4_lockowner           *lo = (struct nfs4_lockowner *)fl->fl_owner;
6114         struct net                      *net = lo->lo_owner.so_client->net;
6115         struct nfsd_net                 *nn = net_generic(net, nfsd_net_id);
6116         struct nfsd4_blocked_lock       *nbl = container_of(fl,
6117                                                 struct nfsd4_blocked_lock, nbl_lock);
6118         bool queue = false;
6119
6120         /* An empty list means that something else is going to be using it */
6121         spin_lock(&nn->blocked_locks_lock);
6122         if (!list_empty(&nbl->nbl_list)) {
6123                 list_del_init(&nbl->nbl_list);
6124                 list_del_init(&nbl->nbl_lru);
6125                 queue = true;
6126         }
6127         spin_unlock(&nn->blocked_locks_lock);
6128
6129         if (queue)
6130                 nfsd4_run_cb(&nbl->nbl_cb);
6131 }
6132
6133 static const struct lock_manager_operations nfsd_posix_mng_ops  = {
6134         .lm_notify = nfsd4_lm_notify,
6135         .lm_get_owner = nfsd4_fl_get_owner,
6136         .lm_put_owner = nfsd4_fl_put_owner,
6137 };
6138
6139 static inline void
6140 nfs4_set_lock_denied(struct file_lock *fl, struct nfsd4_lock_denied *deny)
6141 {
6142         struct nfs4_lockowner *lo;
6143
6144         if (fl->fl_lmops == &nfsd_posix_mng_ops) {
6145                 lo = (struct nfs4_lockowner *) fl->fl_owner;
6146                 xdr_netobj_dup(&deny->ld_owner, &lo->lo_owner.so_owner,
6147                                                 GFP_KERNEL);
6148                 if (!deny->ld_owner.data)
6149                         /* We just don't care that much */
6150                         goto nevermind;
6151                 deny->ld_clientid = lo->lo_owner.so_client->cl_clientid;
6152         } else {
6153 nevermind:
6154                 deny->ld_owner.len = 0;
6155                 deny->ld_owner.data = NULL;
6156                 deny->ld_clientid.cl_boot = 0;
6157                 deny->ld_clientid.cl_id = 0;
6158         }
6159         deny->ld_start = fl->fl_start;
6160         deny->ld_length = NFS4_MAX_UINT64;
6161         if (fl->fl_end != NFS4_MAX_UINT64)
6162                 deny->ld_length = fl->fl_end - fl->fl_start + 1;
6163         deny->ld_type = NFS4_READ_LT;
6164         if (fl->fl_type != F_RDLCK)
6165                 deny->ld_type = NFS4_WRITE_LT;
6166 }
6167
6168 static struct nfs4_lockowner *
6169 find_lockowner_str_locked(struct nfs4_client *clp, struct xdr_netobj *owner)
6170 {
6171         unsigned int strhashval = ownerstr_hashval(owner);
6172         struct nfs4_stateowner *so;
6173
6174         lockdep_assert_held(&clp->cl_lock);
6175
6176         list_for_each_entry(so, &clp->cl_ownerstr_hashtbl[strhashval],
6177                             so_strhash) {
6178                 if (so->so_is_open_owner)
6179                         continue;
6180                 if (same_owner_str(so, owner))
6181                         return lockowner(nfs4_get_stateowner(so));
6182         }
6183         return NULL;
6184 }
6185
6186 static struct nfs4_lockowner *
6187 find_lockowner_str(struct nfs4_client *clp, struct xdr_netobj *owner)
6188 {
6189         struct nfs4_lockowner *lo;
6190
6191         spin_lock(&clp->cl_lock);
6192         lo = find_lockowner_str_locked(clp, owner);
6193         spin_unlock(&clp->cl_lock);
6194         return lo;
6195 }
6196
6197 static void nfs4_unhash_lockowner(struct nfs4_stateowner *sop)
6198 {
6199         unhash_lockowner_locked(lockowner(sop));
6200 }
6201
6202 static void nfs4_free_lockowner(struct nfs4_stateowner *sop)
6203 {
6204         struct nfs4_lockowner *lo = lockowner(sop);
6205
6206         kmem_cache_free(lockowner_slab, lo);
6207 }
6208
6209 static const struct nfs4_stateowner_operations lockowner_ops = {
6210         .so_unhash =    nfs4_unhash_lockowner,
6211         .so_free =      nfs4_free_lockowner,
6212 };
6213
6214 /*
6215  * Alloc a lock owner structure.
6216  * Called in nfsd4_lock - therefore, OPEN and OPEN_CONFIRM (if needed) has
6217  * occurred.
6218  *
6219  * strhashval = ownerstr_hashval
6220  */
6221 static struct nfs4_lockowner *
6222 alloc_init_lock_stateowner(unsigned int strhashval, struct nfs4_client *clp,
6223                            struct nfs4_ol_stateid *open_stp,
6224                            struct nfsd4_lock *lock)
6225 {
6226         struct nfs4_lockowner *lo, *ret;
6227
6228         lo = alloc_stateowner(lockowner_slab, &lock->lk_new_owner, clp);
6229         if (!lo)
6230                 return NULL;
6231         INIT_LIST_HEAD(&lo->lo_blocked);
6232         INIT_LIST_HEAD(&lo->lo_owner.so_stateids);
6233         lo->lo_owner.so_is_open_owner = 0;
6234         lo->lo_owner.so_seqid = lock->lk_new_lock_seqid;
6235         lo->lo_owner.so_ops = &lockowner_ops;
6236         spin_lock(&clp->cl_lock);
6237         ret = find_lockowner_str_locked(clp, &lock->lk_new_owner);
6238         if (ret == NULL) {
6239                 list_add(&lo->lo_owner.so_strhash,
6240                          &clp->cl_ownerstr_hashtbl[strhashval]);
6241                 ret = lo;
6242         } else
6243                 nfs4_free_stateowner(&lo->lo_owner);
6244
6245         spin_unlock(&clp->cl_lock);
6246         return ret;
6247 }
6248
6249 static struct nfs4_ol_stateid *
6250 find_lock_stateid(struct nfs4_lockowner *lo, struct nfs4_file *fp)
6251 {
6252         struct nfs4_ol_stateid *lst;
6253         struct nfs4_client *clp = lo->lo_owner.so_client;
6254
6255         lockdep_assert_held(&clp->cl_lock);
6256
6257         list_for_each_entry(lst, &lo->lo_owner.so_stateids, st_perstateowner) {
6258                 if (lst->st_stid.sc_type != NFS4_LOCK_STID)
6259                         continue;
6260                 if (lst->st_stid.sc_file == fp) {
6261                         refcount_inc(&lst->st_stid.sc_count);
6262                         return lst;
6263                 }
6264         }
6265         return NULL;
6266 }
6267
6268 static struct nfs4_ol_stateid *
6269 init_lock_stateid(struct nfs4_ol_stateid *stp, struct nfs4_lockowner *lo,
6270                   struct nfs4_file *fp, struct inode *inode,
6271                   struct nfs4_ol_stateid *open_stp)
6272 {
6273         struct nfs4_client *clp = lo->lo_owner.so_client;
6274         struct nfs4_ol_stateid *retstp;
6275
6276         mutex_init(&stp->st_mutex);
6277         mutex_lock_nested(&stp->st_mutex, OPEN_STATEID_MUTEX);
6278 retry:
6279         spin_lock(&clp->cl_lock);
6280         spin_lock(&fp->fi_lock);
6281         retstp = find_lock_stateid(lo, fp);
6282         if (retstp)
6283                 goto out_unlock;
6284
6285         refcount_inc(&stp->st_stid.sc_count);
6286         stp->st_stid.sc_type = NFS4_LOCK_STID;
6287         stp->st_stateowner = nfs4_get_stateowner(&lo->lo_owner);
6288         get_nfs4_file(fp);
6289         stp->st_stid.sc_file = fp;
6290         stp->st_access_bmap = 0;
6291         stp->st_deny_bmap = open_stp->st_deny_bmap;
6292         stp->st_openstp = open_stp;
6293         list_add(&stp->st_locks, &open_stp->st_locks);
6294         list_add(&stp->st_perstateowner, &lo->lo_owner.so_stateids);
6295         list_add(&stp->st_perfile, &fp->fi_stateids);
6296 out_unlock:
6297         spin_unlock(&fp->fi_lock);
6298         spin_unlock(&clp->cl_lock);
6299         if (retstp) {
6300                 if (nfsd4_lock_ol_stateid(retstp) != nfs_ok) {
6301                         nfs4_put_stid(&retstp->st_stid);
6302                         goto retry;
6303                 }
6304                 /* To keep mutex tracking happy */
6305                 mutex_unlock(&stp->st_mutex);
6306                 stp = retstp;
6307         }
6308         return stp;
6309 }
6310
6311 static struct nfs4_ol_stateid *
6312 find_or_create_lock_stateid(struct nfs4_lockowner *lo, struct nfs4_file *fi,
6313                             struct inode *inode, struct nfs4_ol_stateid *ost,
6314                             bool *new)
6315 {
6316         struct nfs4_stid *ns = NULL;
6317         struct nfs4_ol_stateid *lst;
6318         struct nfs4_openowner *oo = openowner(ost->st_stateowner);
6319         struct nfs4_client *clp = oo->oo_owner.so_client;
6320
6321         *new = false;
6322         spin_lock(&clp->cl_lock);
6323         lst = find_lock_stateid(lo, fi);
6324         spin_unlock(&clp->cl_lock);
6325         if (lst != NULL) {
6326                 if (nfsd4_lock_ol_stateid(lst) == nfs_ok)
6327                         goto out;
6328                 nfs4_put_stid(&lst->st_stid);
6329         }
6330         ns = nfs4_alloc_stid(clp, stateid_slab, nfs4_free_lock_stateid);
6331         if (ns == NULL)
6332                 return NULL;
6333
6334         lst = init_lock_stateid(openlockstateid(ns), lo, fi, inode, ost);
6335         if (lst == openlockstateid(ns))
6336                 *new = true;
6337         else
6338                 nfs4_put_stid(ns);
6339 out:
6340         return lst;
6341 }
6342
6343 static int
6344 check_lock_length(u64 offset, u64 length)
6345 {
6346         return ((length == 0) || ((length != NFS4_MAX_UINT64) &&
6347                 (length > ~offset)));
6348 }
6349
6350 static void get_lock_access(struct nfs4_ol_stateid *lock_stp, u32 access)
6351 {
6352         struct nfs4_file *fp = lock_stp->st_stid.sc_file;
6353
6354         lockdep_assert_held(&fp->fi_lock);
6355
6356         if (test_access(access, lock_stp))
6357                 return;
6358         __nfs4_file_get_access(fp, access);
6359         set_access(access, lock_stp);
6360 }
6361
6362 static __be32
6363 lookup_or_create_lock_state(struct nfsd4_compound_state *cstate,
6364                             struct nfs4_ol_stateid *ost,
6365                             struct nfsd4_lock *lock,
6366                             struct nfs4_ol_stateid **plst, bool *new)
6367 {
6368         __be32 status;
6369         struct nfs4_file *fi = ost->st_stid.sc_file;
6370         struct nfs4_openowner *oo = openowner(ost->st_stateowner);
6371         struct nfs4_client *cl = oo->oo_owner.so_client;
6372         struct inode *inode = d_inode(cstate->current_fh.fh_dentry);
6373         struct nfs4_lockowner *lo;
6374         struct nfs4_ol_stateid *lst;
6375         unsigned int strhashval;
6376
6377         lo = find_lockowner_str(cl, &lock->lk_new_owner);
6378         if (!lo) {
6379                 strhashval = ownerstr_hashval(&lock->lk_new_owner);
6380                 lo = alloc_init_lock_stateowner(strhashval, cl, ost, lock);
6381                 if (lo == NULL)
6382                         return nfserr_jukebox;
6383         } else {
6384                 /* with an existing lockowner, seqids must be the same */
6385                 status = nfserr_bad_seqid;
6386                 if (!cstate->minorversion &&
6387                     lock->lk_new_lock_seqid != lo->lo_owner.so_seqid)
6388                         goto out;
6389         }
6390
6391         lst = find_or_create_lock_stateid(lo, fi, inode, ost, new);
6392         if (lst == NULL) {
6393                 status = nfserr_jukebox;
6394                 goto out;
6395         }
6396
6397         status = nfs_ok;
6398         *plst = lst;
6399 out:
6400         nfs4_put_stateowner(&lo->lo_owner);
6401         return status;
6402 }
6403
6404 /*
6405  *  LOCK operation
6406  */
6407 __be32
6408 nfsd4_lock(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
6409            union nfsd4_op_u *u)
6410 {
6411         struct nfsd4_lock *lock = &u->lock;
6412         struct nfs4_openowner *open_sop = NULL;
6413         struct nfs4_lockowner *lock_sop = NULL;
6414         struct nfs4_ol_stateid *lock_stp = NULL;
6415         struct nfs4_ol_stateid *open_stp = NULL;
6416         struct nfs4_file *fp;
6417         struct nfsd_file *nf = NULL;
6418         struct nfsd4_blocked_lock *nbl = NULL;
6419         struct file_lock *file_lock = NULL;
6420         struct file_lock *conflock = NULL;
6421         __be32 status = 0;
6422         int lkflg;
6423         int err;
6424         bool new = false;
6425         unsigned char fl_type;
6426         unsigned int fl_flags = FL_POSIX;
6427         struct net *net = SVC_NET(rqstp);
6428         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
6429
6430         dprintk("NFSD: nfsd4_lock: start=%Ld length=%Ld\n",
6431                 (long long) lock->lk_offset,
6432                 (long long) lock->lk_length);
6433
6434         if (check_lock_length(lock->lk_offset, lock->lk_length))
6435                  return nfserr_inval;
6436
6437         if ((status = fh_verify(rqstp, &cstate->current_fh,
6438                                 S_IFREG, NFSD_MAY_LOCK))) {
6439                 dprintk("NFSD: nfsd4_lock: permission denied!\n");
6440                 return status;
6441         }
6442
6443         if (lock->lk_is_new) {
6444                 if (nfsd4_has_session(cstate))
6445                         /* See rfc 5661 18.10.3: given clientid is ignored: */
6446                         memcpy(&lock->lk_new_clientid,
6447                                 &cstate->session->se_client->cl_clientid,
6448                                 sizeof(clientid_t));
6449
6450                 status = nfserr_stale_clientid;
6451                 if (STALE_CLIENTID(&lock->lk_new_clientid, nn))
6452                         goto out;
6453
6454                 /* validate and update open stateid and open seqid */
6455                 status = nfs4_preprocess_confirmed_seqid_op(cstate,
6456                                         lock->lk_new_open_seqid,
6457                                         &lock->lk_new_open_stateid,
6458                                         &open_stp, nn);
6459                 if (status)
6460                         goto out;
6461                 mutex_unlock(&open_stp->st_mutex);
6462                 open_sop = openowner(open_stp->st_stateowner);
6463                 status = nfserr_bad_stateid;
6464                 if (!same_clid(&open_sop->oo_owner.so_client->cl_clientid,
6465                                                 &lock->lk_new_clientid))
6466                         goto out;
6467                 status = lookup_or_create_lock_state(cstate, open_stp, lock,
6468                                                         &lock_stp, &new);
6469         } else {
6470                 status = nfs4_preprocess_seqid_op(cstate,
6471                                        lock->lk_old_lock_seqid,
6472                                        &lock->lk_old_lock_stateid,
6473                                        NFS4_LOCK_STID, &lock_stp, nn);
6474         }
6475         if (status)
6476                 goto out;
6477         lock_sop = lockowner(lock_stp->st_stateowner);
6478
6479         lkflg = setlkflg(lock->lk_type);
6480         status = nfs4_check_openmode(lock_stp, lkflg);
6481         if (status)
6482                 goto out;
6483
6484         status = nfserr_grace;
6485         if (locks_in_grace(net) && !lock->lk_reclaim)
6486                 goto out;
6487         status = nfserr_no_grace;
6488         if (!locks_in_grace(net) && lock->lk_reclaim)
6489                 goto out;
6490
6491         fp = lock_stp->st_stid.sc_file;
6492         switch (lock->lk_type) {
6493                 case NFS4_READW_LT:
6494                         if (nfsd4_has_session(cstate))
6495                                 fl_flags |= FL_SLEEP;
6496                         /* Fallthrough */
6497                 case NFS4_READ_LT:
6498                         spin_lock(&fp->fi_lock);
6499                         nf = find_readable_file_locked(fp);
6500                         if (nf)
6501                                 get_lock_access(lock_stp, NFS4_SHARE_ACCESS_READ);
6502                         spin_unlock(&fp->fi_lock);
6503                         fl_type = F_RDLCK;
6504                         break;
6505                 case NFS4_WRITEW_LT:
6506                         if (nfsd4_has_session(cstate))
6507                                 fl_flags |= FL_SLEEP;
6508                         /* Fallthrough */
6509                 case NFS4_WRITE_LT:
6510                         spin_lock(&fp->fi_lock);
6511                         nf = find_writeable_file_locked(fp);
6512                         if (nf)
6513                                 get_lock_access(lock_stp, NFS4_SHARE_ACCESS_WRITE);
6514                         spin_unlock(&fp->fi_lock);
6515                         fl_type = F_WRLCK;
6516                         break;
6517                 default:
6518                         status = nfserr_inval;
6519                 goto out;
6520         }
6521
6522         if (!nf) {
6523                 status = nfserr_openmode;
6524                 goto out;
6525         }
6526
6527         nbl = find_or_allocate_block(lock_sop, &fp->fi_fhandle, nn);
6528         if (!nbl) {
6529                 dprintk("NFSD: %s: unable to allocate block!\n", __func__);
6530                 status = nfserr_jukebox;
6531                 goto out;
6532         }
6533
6534         file_lock = &nbl->nbl_lock;
6535         file_lock->fl_type = fl_type;
6536         file_lock->fl_owner = (fl_owner_t)lockowner(nfs4_get_stateowner(&lock_sop->lo_owner));
6537         file_lock->fl_pid = current->tgid;
6538         file_lock->fl_file = nf->nf_file;
6539         file_lock->fl_flags = fl_flags;
6540         file_lock->fl_lmops = &nfsd_posix_mng_ops;
6541         file_lock->fl_start = lock->lk_offset;
6542         file_lock->fl_end = last_byte_offset(lock->lk_offset, lock->lk_length);
6543         nfs4_transform_lock_offset(file_lock);
6544
6545         conflock = locks_alloc_lock();
6546         if (!conflock) {
6547                 dprintk("NFSD: %s: unable to allocate lock!\n", __func__);
6548                 status = nfserr_jukebox;
6549                 goto out;
6550         }
6551
6552         if (fl_flags & FL_SLEEP) {
6553                 nbl->nbl_time = get_seconds();
6554                 spin_lock(&nn->blocked_locks_lock);
6555                 list_add_tail(&nbl->nbl_list, &lock_sop->lo_blocked);
6556                 list_add_tail(&nbl->nbl_lru, &nn->blocked_locks_lru);
6557                 spin_unlock(&nn->blocked_locks_lock);
6558         }
6559
6560         err = vfs_lock_file(nf->nf_file, F_SETLK, file_lock, conflock);
6561         switch (err) {
6562         case 0: /* success! */
6563                 nfs4_inc_and_copy_stateid(&lock->lk_resp_stateid, &lock_stp->st_stid);
6564                 status = 0;
6565                 if (lock->lk_reclaim)
6566                         nn->somebody_reclaimed = true;
6567                 break;
6568         case FILE_LOCK_DEFERRED:
6569                 nbl = NULL;
6570                 /* Fallthrough */
6571         case -EAGAIN:           /* conflock holds conflicting lock */
6572                 status = nfserr_denied;
6573                 dprintk("NFSD: nfsd4_lock: conflicting lock found!\n");
6574                 nfs4_set_lock_denied(conflock, &lock->lk_denied);
6575                 break;
6576         case -EDEADLK:
6577                 status = nfserr_deadlock;
6578                 break;
6579         default:
6580                 dprintk("NFSD: nfsd4_lock: vfs_lock_file() failed! status %d\n",err);
6581                 status = nfserrno(err);
6582                 break;
6583         }
6584 out:
6585         if (nbl) {
6586                 /* dequeue it if we queued it before */
6587                 if (fl_flags & FL_SLEEP) {
6588                         spin_lock(&nn->blocked_locks_lock);
6589                         list_del_init(&nbl->nbl_list);
6590                         list_del_init(&nbl->nbl_lru);
6591                         spin_unlock(&nn->blocked_locks_lock);
6592                 }
6593                 free_blocked_lock(nbl);
6594         }
6595         if (nf)
6596                 nfsd_file_put(nf);
6597         if (lock_stp) {
6598                 /* Bump seqid manually if the 4.0 replay owner is openowner */
6599                 if (cstate->replay_owner &&
6600                     cstate->replay_owner != &lock_sop->lo_owner &&
6601                     seqid_mutating_err(ntohl(status)))
6602                         lock_sop->lo_owner.so_seqid++;
6603
6604                 /*
6605                  * If this is a new, never-before-used stateid, and we are
6606                  * returning an error, then just go ahead and release it.
6607                  */
6608                 if (status && new)
6609                         release_lock_stateid(lock_stp);
6610
6611                 mutex_unlock(&lock_stp->st_mutex);
6612
6613                 nfs4_put_stid(&lock_stp->st_stid);
6614         }
6615         if (open_stp)
6616                 nfs4_put_stid(&open_stp->st_stid);
6617         nfsd4_bump_seqid(cstate, status);
6618         if (conflock)
6619                 locks_free_lock(conflock);
6620         return status;
6621 }
6622
6623 /*
6624  * The NFSv4 spec allows a client to do a LOCKT without holding an OPEN,
6625  * so we do a temporary open here just to get an open file to pass to
6626  * vfs_test_lock.  (Arguably perhaps test_lock should be done with an
6627  * inode operation.)
6628  */
6629 static __be32 nfsd_test_lock(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file_lock *lock)
6630 {
6631         struct nfsd_file *nf;
6632         __be32 err = nfsd_file_acquire(rqstp, fhp, NFSD_MAY_READ, &nf);
6633         if (!err) {
6634                 err = nfserrno(vfs_test_lock(nf->nf_file, lock));
6635                 nfsd_file_put(nf);
6636         }
6637         return err;
6638 }
6639
6640 /*
6641  * LOCKT operation
6642  */
6643 __be32
6644 nfsd4_lockt(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
6645             union nfsd4_op_u *u)
6646 {
6647         struct nfsd4_lockt *lockt = &u->lockt;
6648         struct file_lock *file_lock = NULL;
6649         struct nfs4_lockowner *lo = NULL;
6650         __be32 status;
6651         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
6652
6653         if (locks_in_grace(SVC_NET(rqstp)))
6654                 return nfserr_grace;
6655
6656         if (check_lock_length(lockt->lt_offset, lockt->lt_length))
6657                  return nfserr_inval;
6658
6659         if (!nfsd4_has_session(cstate)) {
6660                 status = lookup_clientid(&lockt->lt_clientid, cstate, nn);
6661                 if (status)
6662                         goto out;
6663         }
6664
6665         if ((status = fh_verify(rqstp, &cstate->current_fh, S_IFREG, 0)))
6666                 goto out;
6667
6668         file_lock = locks_alloc_lock();
6669         if (!file_lock) {
6670                 dprintk("NFSD: %s: unable to allocate lock!\n", __func__);
6671                 status = nfserr_jukebox;
6672                 goto out;
6673         }
6674
6675         switch (lockt->lt_type) {
6676                 case NFS4_READ_LT:
6677                 case NFS4_READW_LT:
6678                         file_lock->fl_type = F_RDLCK;
6679                         break;
6680                 case NFS4_WRITE_LT:
6681                 case NFS4_WRITEW_LT:
6682                         file_lock->fl_type = F_WRLCK;
6683                         break;
6684                 default:
6685                         dprintk("NFSD: nfs4_lockt: bad lock type!\n");
6686                         status = nfserr_inval;
6687                         goto out;
6688         }
6689
6690         lo = find_lockowner_str(cstate->clp, &lockt->lt_owner);
6691         if (lo)
6692                 file_lock->fl_owner = (fl_owner_t)lo;
6693         file_lock->fl_pid = current->tgid;
6694         file_lock->fl_flags = FL_POSIX;
6695
6696         file_lock->fl_start = lockt->lt_offset;
6697         file_lock->fl_end = last_byte_offset(lockt->lt_offset, lockt->lt_length);
6698
6699         nfs4_transform_lock_offset(file_lock);
6700
6701         status = nfsd_test_lock(rqstp, &cstate->current_fh, file_lock);
6702         if (status)
6703                 goto out;
6704
6705         if (file_lock->fl_type != F_UNLCK) {
6706                 status = nfserr_denied;
6707                 nfs4_set_lock_denied(file_lock, &lockt->lt_denied);
6708         }
6709 out:
6710         if (lo)
6711                 nfs4_put_stateowner(&lo->lo_owner);
6712         if (file_lock)
6713                 locks_free_lock(file_lock);
6714         return status;
6715 }
6716
6717 __be32
6718 nfsd4_locku(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
6719             union nfsd4_op_u *u)
6720 {
6721         struct nfsd4_locku *locku = &u->locku;
6722         struct nfs4_ol_stateid *stp;
6723         struct nfsd_file *nf = NULL;
6724         struct file_lock *file_lock = NULL;
6725         __be32 status;
6726         int err;
6727         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
6728
6729         dprintk("NFSD: nfsd4_locku: start=%Ld length=%Ld\n",
6730                 (long long) locku->lu_offset,
6731                 (long long) locku->lu_length);
6732
6733         if (check_lock_length(locku->lu_offset, locku->lu_length))
6734                  return nfserr_inval;
6735
6736         status = nfs4_preprocess_seqid_op(cstate, locku->lu_seqid,
6737                                         &locku->lu_stateid, NFS4_LOCK_STID,
6738                                         &stp, nn);
6739         if (status)
6740                 goto out;
6741         nf = find_any_file(stp->st_stid.sc_file);
6742         if (!nf) {
6743                 status = nfserr_lock_range;
6744                 goto put_stateid;
6745         }
6746         file_lock = locks_alloc_lock();
6747         if (!file_lock) {
6748                 dprintk("NFSD: %s: unable to allocate lock!\n", __func__);
6749                 status = nfserr_jukebox;
6750                 goto put_file;
6751         }
6752
6753         file_lock->fl_type = F_UNLCK;
6754         file_lock->fl_owner = (fl_owner_t)lockowner(nfs4_get_stateowner(stp->st_stateowner));
6755         file_lock->fl_pid = current->tgid;
6756         file_lock->fl_file = nf->nf_file;
6757         file_lock->fl_flags = FL_POSIX;
6758         file_lock->fl_lmops = &nfsd_posix_mng_ops;
6759         file_lock->fl_start = locku->lu_offset;
6760
6761         file_lock->fl_end = last_byte_offset(locku->lu_offset,
6762                                                 locku->lu_length);
6763         nfs4_transform_lock_offset(file_lock);
6764
6765         err = vfs_lock_file(nf->nf_file, F_SETLK, file_lock, NULL);
6766         if (err) {
6767                 dprintk("NFSD: nfs4_locku: vfs_lock_file failed!\n");
6768                 goto out_nfserr;
6769         }
6770         nfs4_inc_and_copy_stateid(&locku->lu_stateid, &stp->st_stid);
6771 put_file:
6772         nfsd_file_put(nf);
6773 put_stateid:
6774         mutex_unlock(&stp->st_mutex);
6775         nfs4_put_stid(&stp->st_stid);
6776 out:
6777         nfsd4_bump_seqid(cstate, status);
6778         if (file_lock)
6779                 locks_free_lock(file_lock);
6780         return status;
6781
6782 out_nfserr:
6783         status = nfserrno(err);
6784         goto put_file;
6785 }
6786
6787 /*
6788  * returns
6789  *      true:  locks held by lockowner
6790  *      false: no locks held by lockowner
6791  */
6792 static bool
6793 check_for_locks(struct nfs4_file *fp, struct nfs4_lockowner *lowner)
6794 {
6795         struct file_lock *fl;
6796         int status = false;
6797         struct nfsd_file *nf = find_any_file(fp);
6798         struct inode *inode;
6799         struct file_lock_context *flctx;
6800
6801         if (!nf) {
6802                 /* Any valid lock stateid should have some sort of access */
6803                 WARN_ON_ONCE(1);
6804                 return status;
6805         }
6806
6807         inode = locks_inode(nf->nf_file);
6808         flctx = inode->i_flctx;
6809
6810         if (flctx && !list_empty_careful(&flctx->flc_posix)) {
6811                 spin_lock(&flctx->flc_lock);
6812                 list_for_each_entry(fl, &flctx->flc_posix, fl_list) {
6813                         if (fl->fl_owner == (fl_owner_t)lowner) {
6814                                 status = true;
6815                                 break;
6816                         }
6817                 }
6818                 spin_unlock(&flctx->flc_lock);
6819         }
6820         nfsd_file_put(nf);
6821         return status;
6822 }
6823
6824 __be32
6825 nfsd4_release_lockowner(struct svc_rqst *rqstp,
6826                         struct nfsd4_compound_state *cstate,
6827                         union nfsd4_op_u *u)
6828 {
6829         struct nfsd4_release_lockowner *rlockowner = &u->release_lockowner;
6830         clientid_t *clid = &rlockowner->rl_clientid;
6831         struct nfs4_stateowner *sop;
6832         struct nfs4_lockowner *lo = NULL;
6833         struct nfs4_ol_stateid *stp;
6834         struct xdr_netobj *owner = &rlockowner->rl_owner;
6835         unsigned int hashval = ownerstr_hashval(owner);
6836         __be32 status;
6837         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
6838         struct nfs4_client *clp;
6839         LIST_HEAD (reaplist);
6840
6841         dprintk("nfsd4_release_lockowner clientid: (%08x/%08x):\n",
6842                 clid->cl_boot, clid->cl_id);
6843
6844         status = lookup_clientid(clid, cstate, nn);
6845         if (status)
6846                 return status;
6847
6848         clp = cstate->clp;
6849         /* Find the matching lock stateowner */
6850         spin_lock(&clp->cl_lock);
6851         list_for_each_entry(sop, &clp->cl_ownerstr_hashtbl[hashval],
6852                             so_strhash) {
6853
6854                 if (sop->so_is_open_owner || !same_owner_str(sop, owner))
6855                         continue;
6856
6857                 /* see if there are still any locks associated with it */
6858                 lo = lockowner(sop);
6859                 list_for_each_entry(stp, &sop->so_stateids, st_perstateowner) {
6860                         if (check_for_locks(stp->st_stid.sc_file, lo)) {
6861                                 status = nfserr_locks_held;
6862                                 spin_unlock(&clp->cl_lock);
6863                                 return status;
6864                         }
6865                 }
6866
6867                 nfs4_get_stateowner(sop);
6868                 break;
6869         }
6870         if (!lo) {
6871                 spin_unlock(&clp->cl_lock);
6872                 return status;
6873         }
6874
6875         unhash_lockowner_locked(lo);
6876         while (!list_empty(&lo->lo_owner.so_stateids)) {
6877                 stp = list_first_entry(&lo->lo_owner.so_stateids,
6878                                        struct nfs4_ol_stateid,
6879                                        st_perstateowner);
6880                 WARN_ON(!unhash_lock_stateid(stp));
6881                 put_ol_stateid_locked(stp, &reaplist);
6882         }
6883         spin_unlock(&clp->cl_lock);
6884         free_ol_stateid_reaplist(&reaplist);
6885         remove_blocked_locks(lo);
6886         nfs4_put_stateowner(&lo->lo_owner);
6887
6888         return status;
6889 }
6890
6891 static inline struct nfs4_client_reclaim *
6892 alloc_reclaim(void)
6893 {
6894         return kmalloc(sizeof(struct nfs4_client_reclaim), GFP_KERNEL);
6895 }
6896
6897 bool
6898 nfs4_has_reclaimed_state(struct xdr_netobj name, struct nfsd_net *nn)
6899 {
6900         struct nfs4_client_reclaim *crp;
6901
6902         crp = nfsd4_find_reclaim_client(name, nn);
6903         return (crp && crp->cr_clp);
6904 }
6905
6906 /*
6907  * failure => all reset bets are off, nfserr_no_grace...
6908  *
6909  * The caller is responsible for freeing name.data if NULL is returned (it
6910  * will be freed in nfs4_remove_reclaim_record in the normal case).
6911  */
6912 struct nfs4_client_reclaim *
6913 nfs4_client_to_reclaim(struct xdr_netobj name, struct xdr_netobj princhash,
6914                 struct nfsd_net *nn)
6915 {
6916         unsigned int strhashval;
6917         struct nfs4_client_reclaim *crp;
6918
6919         dprintk("NFSD nfs4_client_to_reclaim NAME: %.*s\n", name.len, name.data);
6920         crp = alloc_reclaim();
6921         if (crp) {
6922                 strhashval = clientstr_hashval(name);
6923                 INIT_LIST_HEAD(&crp->cr_strhash);
6924                 list_add(&crp->cr_strhash, &nn->reclaim_str_hashtbl[strhashval]);
6925                 crp->cr_name.data = name.data;
6926                 crp->cr_name.len = name.len;
6927                 crp->cr_princhash.data = princhash.data;
6928                 crp->cr_princhash.len = princhash.len;
6929                 crp->cr_clp = NULL;
6930                 nn->reclaim_str_hashtbl_size++;
6931         }
6932         return crp;
6933 }
6934
6935 void
6936 nfs4_remove_reclaim_record(struct nfs4_client_reclaim *crp, struct nfsd_net *nn)
6937 {
6938         list_del(&crp->cr_strhash);
6939         kfree(crp->cr_name.data);
6940         kfree(crp->cr_princhash.data);
6941         kfree(crp);
6942         nn->reclaim_str_hashtbl_size--;
6943 }
6944
6945 void
6946 nfs4_release_reclaim(struct nfsd_net *nn)
6947 {
6948         struct nfs4_client_reclaim *crp = NULL;
6949         int i;
6950
6951         for (i = 0; i < CLIENT_HASH_SIZE; i++) {
6952                 while (!list_empty(&nn->reclaim_str_hashtbl[i])) {
6953                         crp = list_entry(nn->reclaim_str_hashtbl[i].next,
6954                                         struct nfs4_client_reclaim, cr_strhash);
6955                         nfs4_remove_reclaim_record(crp, nn);
6956                 }
6957         }
6958         WARN_ON_ONCE(nn->reclaim_str_hashtbl_size);
6959 }
6960
6961 /*
6962  * called from OPEN, CLAIM_PREVIOUS with a new clientid. */
6963 struct nfs4_client_reclaim *
6964 nfsd4_find_reclaim_client(struct xdr_netobj name, struct nfsd_net *nn)
6965 {
6966         unsigned int strhashval;
6967         struct nfs4_client_reclaim *crp = NULL;
6968
6969         dprintk("NFSD: nfs4_find_reclaim_client for name %.*s\n", name.len, name.data);
6970
6971         strhashval = clientstr_hashval(name);
6972         list_for_each_entry(crp, &nn->reclaim_str_hashtbl[strhashval], cr_strhash) {
6973                 if (compare_blob(&crp->cr_name, &name) == 0) {
6974                         return crp;
6975                 }
6976         }
6977         return NULL;
6978 }
6979
6980 /*
6981 * Called from OPEN. Look for clientid in reclaim list.
6982 */
6983 __be32
6984 nfs4_check_open_reclaim(clientid_t *clid,
6985                 struct nfsd4_compound_state *cstate,
6986                 struct nfsd_net *nn)
6987 {
6988         __be32 status;
6989
6990         /* find clientid in conf_id_hashtbl */
6991         status = lookup_clientid(clid, cstate, nn);
6992         if (status)
6993                 return nfserr_reclaim_bad;
6994
6995         if (test_bit(NFSD4_CLIENT_RECLAIM_COMPLETE, &cstate->clp->cl_flags))
6996                 return nfserr_no_grace;
6997
6998         if (nfsd4_client_record_check(cstate->clp))
6999                 return nfserr_reclaim_bad;
7000
7001         return nfs_ok;
7002 }
7003
7004 #ifdef CONFIG_NFSD_FAULT_INJECTION
7005 static inline void
7006 put_client(struct nfs4_client *clp)
7007 {
7008         atomic_dec(&clp->cl_rpc_users);
7009 }
7010
7011 static struct nfs4_client *
7012 nfsd_find_client(struct sockaddr_storage *addr, size_t addr_size)
7013 {
7014         struct nfs4_client *clp;
7015         struct nfsd_net *nn = net_generic(current->nsproxy->net_ns,
7016                                           nfsd_net_id);
7017
7018         if (!nfsd_netns_ready(nn))
7019                 return NULL;
7020
7021         list_for_each_entry(clp, &nn->client_lru, cl_lru) {
7022                 if (memcmp(&clp->cl_addr, addr, addr_size) == 0)
7023                         return clp;
7024         }
7025         return NULL;
7026 }
7027
7028 u64
7029 nfsd_inject_print_clients(void)
7030 {
7031         struct nfs4_client *clp;
7032         u64 count = 0;
7033         struct nfsd_net *nn = net_generic(current->nsproxy->net_ns,
7034                                           nfsd_net_id);
7035         char buf[INET6_ADDRSTRLEN];
7036
7037         if (!nfsd_netns_ready(nn))
7038                 return 0;
7039
7040         spin_lock(&nn->client_lock);
7041         list_for_each_entry(clp, &nn->client_lru, cl_lru) {
7042                 rpc_ntop((struct sockaddr *)&clp->cl_addr, buf, sizeof(buf));
7043                 pr_info("NFS Client: %s\n", buf);
7044                 ++count;
7045         }
7046         spin_unlock(&nn->client_lock);
7047
7048         return count;
7049 }
7050
7051 u64
7052 nfsd_inject_forget_client(struct sockaddr_storage *addr, size_t addr_size)
7053 {
7054         u64 count = 0;
7055         struct nfs4_client *clp;
7056         struct nfsd_net *nn = net_generic(current->nsproxy->net_ns,
7057                                           nfsd_net_id);
7058
7059         if (!nfsd_netns_ready(nn))
7060                 return count;
7061
7062         spin_lock(&nn->client_lock);
7063         clp = nfsd_find_client(addr, addr_size);
7064         if (clp) {
7065                 if (mark_client_expired_locked(clp) == nfs_ok)
7066                         ++count;
7067                 else
7068                         clp = NULL;
7069         }
7070         spin_unlock(&nn->client_lock);
7071
7072         if (clp)
7073                 expire_client(clp);
7074
7075         return count;
7076 }
7077
7078 u64
7079 nfsd_inject_forget_clients(u64 max)
7080 {
7081         u64 count = 0;
7082         struct nfs4_client *clp, *next;
7083         struct nfsd_net *nn = net_generic(current->nsproxy->net_ns,
7084                                                 nfsd_net_id);
7085         LIST_HEAD(reaplist);
7086
7087         if (!nfsd_netns_ready(nn))
7088                 return count;
7089
7090         spin_lock(&nn->client_lock);
7091         list_for_each_entry_safe(clp, next, &nn->client_lru, cl_lru) {
7092                 if (mark_client_expired_locked(clp) == nfs_ok) {
7093                         list_add(&clp->cl_lru, &reaplist);
7094                         if (max != 0 && ++count >= max)
7095                                 break;
7096                 }
7097         }
7098         spin_unlock(&nn->client_lock);
7099
7100         list_for_each_entry_safe(clp, next, &reaplist, cl_lru)
7101                 expire_client(clp);
7102
7103         return count;
7104 }
7105
7106 static void nfsd_print_count(struct nfs4_client *clp, unsigned int count,
7107                              const char *type)
7108 {
7109         char buf[INET6_ADDRSTRLEN];
7110         rpc_ntop((struct sockaddr *)&clp->cl_addr, buf, sizeof(buf));
7111         printk(KERN_INFO "NFS Client: %s has %u %s\n", buf, count, type);
7112 }
7113
7114 static void
7115 nfsd_inject_add_lock_to_list(struct nfs4_ol_stateid *lst,
7116                              struct list_head *collect)
7117 {
7118         struct nfs4_client *clp = lst->st_stid.sc_client;
7119         struct nfsd_net *nn = net_generic(current->nsproxy->net_ns,
7120                                           nfsd_net_id);
7121
7122         if (!collect)
7123                 return;
7124
7125         lockdep_assert_held(&nn->client_lock);
7126         atomic_inc(&clp->cl_rpc_users);
7127         list_add(&lst->st_locks, collect);
7128 }
7129
7130 static u64 nfsd_foreach_client_lock(struct nfs4_client *clp, u64 max,
7131                                     struct list_head *collect,
7132                                     bool (*func)(struct nfs4_ol_stateid *))
7133 {
7134         struct nfs4_openowner *oop;
7135         struct nfs4_ol_stateid *stp, *st_next;
7136         struct nfs4_ol_stateid *lst, *lst_next;
7137         u64 count = 0;
7138
7139         spin_lock(&clp->cl_lock);
7140         list_for_each_entry(oop, &clp->cl_openowners, oo_perclient) {
7141                 list_for_each_entry_safe(stp, st_next,
7142                                 &oop->oo_owner.so_stateids, st_perstateowner) {
7143                         list_for_each_entry_safe(lst, lst_next,
7144                                         &stp->st_locks, st_locks) {
7145                                 if (func) {
7146                                         if (func(lst))
7147                                                 nfsd_inject_add_lock_to_list(lst,
7148                                                                         collect);
7149                                 }
7150                                 ++count;
7151                                 /*
7152                                  * Despite the fact that these functions deal
7153                                  * with 64-bit integers for "count", we must
7154                                  * ensure that it doesn't blow up the
7155                                  * clp->cl_rpc_users. Throw a warning if we
7156                                  * start to approach INT_MAX here.
7157                                  */
7158                                 WARN_ON_ONCE(count == (INT_MAX / 2));
7159                                 if (count == max)
7160                                         goto out;
7161                         }
7162                 }
7163         }
7164 out:
7165         spin_unlock(&clp->cl_lock);
7166
7167         return count;
7168 }
7169
7170 static u64
7171 nfsd_collect_client_locks(struct nfs4_client *clp, struct list_head *collect,
7172                           u64 max)
7173 {
7174         return nfsd_foreach_client_lock(clp, max, collect, unhash_lock_stateid);
7175 }
7176
7177 static u64
7178 nfsd_print_client_locks(struct nfs4_client *clp)
7179 {
7180         u64 count = nfsd_foreach_client_lock(clp, 0, NULL, NULL);
7181         nfsd_print_count(clp, count, "locked files");
7182         return count;
7183 }
7184
7185 u64
7186 nfsd_inject_print_locks(void)
7187 {
7188         struct nfs4_client *clp;
7189         u64 count = 0;
7190         struct nfsd_net *nn = net_generic(current->nsproxy->net_ns,
7191                                                 nfsd_net_id);
7192
7193         if (!nfsd_netns_ready(nn))
7194                 return 0;
7195
7196         spin_lock(&nn->client_lock);
7197         list_for_each_entry(clp, &nn->client_lru, cl_lru)
7198                 count += nfsd_print_client_locks(clp);
7199         spin_unlock(&nn->client_lock);
7200
7201         return count;
7202 }
7203
7204 static void
7205 nfsd_reap_locks(struct list_head *reaplist)
7206 {
7207         struct nfs4_client *clp;
7208         struct nfs4_ol_stateid *stp, *next;
7209
7210         list_for_each_entry_safe(stp, next, reaplist, st_locks) {
7211                 list_del_init(&stp->st_locks);
7212                 clp = stp->st_stid.sc_client;
7213                 nfs4_put_stid(&stp->st_stid);
7214                 put_client(clp);
7215         }
7216 }
7217
7218 u64
7219 nfsd_inject_forget_client_locks(struct sockaddr_storage *addr, size_t addr_size)
7220 {
7221         unsigned int count = 0;
7222         struct nfs4_client *clp;
7223         struct nfsd_net *nn = net_generic(current->nsproxy->net_ns,
7224                                                 nfsd_net_id);
7225         LIST_HEAD(reaplist);
7226
7227         if (!nfsd_netns_ready(nn))
7228                 return count;
7229
7230         spin_lock(&nn->client_lock);
7231         clp = nfsd_find_client(addr, addr_size);
7232         if (clp)
7233                 count = nfsd_collect_client_locks(clp, &reaplist, 0);
7234         spin_unlock(&nn->client_lock);
7235         nfsd_reap_locks(&reaplist);
7236         return count;
7237 }
7238
7239 u64
7240 nfsd_inject_forget_locks(u64 max)
7241 {
7242         u64 count = 0;
7243         struct nfs4_client *clp;
7244         struct nfsd_net *nn = net_generic(current->nsproxy->net_ns,
7245                                                 nfsd_net_id);
7246         LIST_HEAD(reaplist);
7247
7248         if (!nfsd_netns_ready(nn))
7249                 return count;
7250
7251         spin_lock(&nn->client_lock);
7252         list_for_each_entry(clp, &nn->client_lru, cl_lru) {
7253                 count += nfsd_collect_client_locks(clp, &reaplist, max - count);
7254                 if (max != 0 && count >= max)
7255                         break;
7256         }
7257         spin_unlock(&nn->client_lock);
7258         nfsd_reap_locks(&reaplist);
7259         return count;
7260 }
7261
7262 static u64
7263 nfsd_foreach_client_openowner(struct nfs4_client *clp, u64 max,
7264                               struct list_head *collect,
7265                               void (*func)(struct nfs4_openowner *))
7266 {
7267         struct nfs4_openowner *oop, *next;
7268         struct nfsd_net *nn = net_generic(current->nsproxy->net_ns,
7269                                                 nfsd_net_id);
7270         u64 count = 0;
7271
7272         lockdep_assert_held(&nn->client_lock);
7273
7274         spin_lock(&clp->cl_lock);
7275         list_for_each_entry_safe(oop, next, &clp->cl_openowners, oo_perclient) {
7276                 if (func) {
7277                         func(oop);
7278                         if (collect) {
7279                                 atomic_inc(&clp->cl_rpc_users);
7280                                 list_add(&oop->oo_perclient, collect);
7281                         }
7282                 }
7283                 ++count;
7284                 /*
7285                  * Despite the fact that these functions deal with
7286                  * 64-bit integers for "count", we must ensure that
7287                  * it doesn't blow up the clp->cl_rpc_users. Throw a
7288                  * warning if we start to approach INT_MAX here.
7289                  */
7290                 WARN_ON_ONCE(count == (INT_MAX / 2));
7291                 if (count == max)
7292                         break;
7293         }
7294         spin_unlock(&clp->cl_lock);
7295
7296         return count;
7297 }
7298
7299 static u64
7300 nfsd_print_client_openowners(struct nfs4_client *clp)
7301 {
7302         u64 count = nfsd_foreach_client_openowner(clp, 0, NULL, NULL);
7303
7304         nfsd_print_count(clp, count, "openowners");
7305         return count;
7306 }
7307
7308 static u64
7309 nfsd_collect_client_openowners(struct nfs4_client *clp,
7310                                struct list_head *collect, u64 max)
7311 {
7312         return nfsd_foreach_client_openowner(clp, max, collect,
7313                                                 unhash_openowner_locked);
7314 }
7315
7316 u64
7317 nfsd_inject_print_openowners(void)
7318 {
7319         struct nfs4_client *clp;
7320         u64 count = 0;
7321         struct nfsd_net *nn = net_generic(current->nsproxy->net_ns,
7322                                                 nfsd_net_id);
7323
7324         if (!nfsd_netns_ready(nn))
7325                 return 0;
7326
7327         spin_lock(&nn->client_lock);
7328         list_for_each_entry(clp, &nn->client_lru, cl_lru)
7329                 count += nfsd_print_client_openowners(clp);
7330         spin_unlock(&nn->client_lock);
7331
7332         return count;
7333 }
7334
7335 static void
7336 nfsd_reap_openowners(struct list_head *reaplist)
7337 {
7338         struct nfs4_client *clp;
7339         struct nfs4_openowner *oop, *next;
7340
7341         list_for_each_entry_safe(oop, next, reaplist, oo_perclient) {
7342                 list_del_init(&oop->oo_perclient);
7343                 clp = oop->oo_owner.so_client;
7344                 release_openowner(oop);
7345                 put_client(clp);
7346         }
7347 }
7348
7349 u64
7350 nfsd_inject_forget_client_openowners(struct sockaddr_storage *addr,
7351                                      size_t addr_size)
7352 {
7353         unsigned int count = 0;
7354         struct nfs4_client *clp;
7355         struct nfsd_net *nn = net_generic(current->nsproxy->net_ns,
7356                                                 nfsd_net_id);
7357         LIST_HEAD(reaplist);
7358
7359         if (!nfsd_netns_ready(nn))
7360                 return count;
7361
7362         spin_lock(&nn->client_lock);
7363         clp = nfsd_find_client(addr, addr_size);
7364         if (clp)
7365                 count = nfsd_collect_client_openowners(clp, &reaplist, 0);
7366         spin_unlock(&nn->client_lock);
7367         nfsd_reap_openowners(&reaplist);
7368         return count;
7369 }
7370
7371 u64
7372 nfsd_inject_forget_openowners(u64 max)
7373 {
7374         u64 count = 0;
7375         struct nfs4_client *clp;
7376         struct nfsd_net *nn = net_generic(current->nsproxy->net_ns,
7377                                                 nfsd_net_id);
7378         LIST_HEAD(reaplist);
7379
7380         if (!nfsd_netns_ready(nn))
7381                 return count;
7382
7383         spin_lock(&nn->client_lock);
7384         list_for_each_entry(clp, &nn->client_lru, cl_lru) {
7385                 count += nfsd_collect_client_openowners(clp, &reaplist,
7386                                                         max - count);
7387                 if (max != 0 && count >= max)
7388                         break;
7389         }
7390         spin_unlock(&nn->client_lock);
7391         nfsd_reap_openowners(&reaplist);
7392         return count;
7393 }
7394
7395 static u64 nfsd_find_all_delegations(struct nfs4_client *clp, u64 max,
7396                                      struct list_head *victims)
7397 {
7398         struct nfs4_delegation *dp, *next;
7399         struct nfsd_net *nn = net_generic(current->nsproxy->net_ns,
7400                                                 nfsd_net_id);
7401         u64 count = 0;
7402
7403         lockdep_assert_held(&nn->client_lock);
7404
7405         spin_lock(&state_lock);
7406         list_for_each_entry_safe(dp, next, &clp->cl_delegations, dl_perclnt) {
7407                 if (victims) {
7408                         /*
7409                          * It's not safe to mess with delegations that have a
7410                          * non-zero dl_time. They might have already been broken
7411                          * and could be processed by the laundromat outside of
7412                          * the state_lock. Just leave them be.
7413                          */
7414                         if (dp->dl_time != 0)
7415                                 continue;
7416
7417                         atomic_inc(&clp->cl_rpc_users);
7418                         WARN_ON(!unhash_delegation_locked(dp));
7419                         list_add(&dp->dl_recall_lru, victims);
7420                 }
7421                 ++count;
7422                 /*
7423                  * Despite the fact that these functions deal with
7424                  * 64-bit integers for "count", we must ensure that
7425                  * it doesn't blow up the clp->cl_rpc_users. Throw a
7426                  * warning if we start to approach INT_MAX here.
7427                  */
7428                 WARN_ON_ONCE(count == (INT_MAX / 2));
7429                 if (count == max)
7430                         break;
7431         }
7432         spin_unlock(&state_lock);
7433         return count;
7434 }
7435
7436 static u64
7437 nfsd_print_client_delegations(struct nfs4_client *clp)
7438 {
7439         u64 count = nfsd_find_all_delegations(clp, 0, NULL);
7440
7441         nfsd_print_count(clp, count, "delegations");
7442         return count;
7443 }
7444
7445 u64
7446 nfsd_inject_print_delegations(void)
7447 {
7448         struct nfs4_client *clp;
7449         u64 count = 0;
7450         struct nfsd_net *nn = net_generic(current->nsproxy->net_ns,
7451                                                 nfsd_net_id);
7452
7453         if (!nfsd_netns_ready(nn))
7454                 return 0;
7455
7456         spin_lock(&nn->client_lock);
7457         list_for_each_entry(clp, &nn->client_lru, cl_lru)
7458                 count += nfsd_print_client_delegations(clp);
7459         spin_unlock(&nn->client_lock);
7460
7461         return count;
7462 }
7463
7464 static void
7465 nfsd_forget_delegations(struct list_head *reaplist)
7466 {
7467         struct nfs4_client *clp;
7468         struct nfs4_delegation *dp, *next;
7469
7470         list_for_each_entry_safe(dp, next, reaplist, dl_recall_lru) {
7471                 list_del_init(&dp->dl_recall_lru);
7472                 clp = dp->dl_stid.sc_client;
7473                 revoke_delegation(dp);
7474                 put_client(clp);
7475         }
7476 }
7477
7478 u64
7479 nfsd_inject_forget_client_delegations(struct sockaddr_storage *addr,
7480                                       size_t addr_size)
7481 {
7482         u64 count = 0;
7483         struct nfs4_client *clp;
7484         struct nfsd_net *nn = net_generic(current->nsproxy->net_ns,
7485                                                 nfsd_net_id);
7486         LIST_HEAD(reaplist);
7487
7488         if (!nfsd_netns_ready(nn))
7489                 return count;
7490
7491         spin_lock(&nn->client_lock);
7492         clp = nfsd_find_client(addr, addr_size);
7493         if (clp)
7494                 count = nfsd_find_all_delegations(clp, 0, &reaplist);
7495         spin_unlock(&nn->client_lock);
7496
7497         nfsd_forget_delegations(&reaplist);
7498         return count;
7499 }
7500
7501 u64
7502 nfsd_inject_forget_delegations(u64 max)
7503 {
7504         u64 count = 0;
7505         struct nfs4_client *clp;
7506         struct nfsd_net *nn = net_generic(current->nsproxy->net_ns,
7507                                                 nfsd_net_id);
7508         LIST_HEAD(reaplist);
7509
7510         if (!nfsd_netns_ready(nn))
7511                 return count;
7512
7513         spin_lock(&nn->client_lock);
7514         list_for_each_entry(clp, &nn->client_lru, cl_lru) {
7515                 count += nfsd_find_all_delegations(clp, max - count, &reaplist);
7516                 if (max != 0 && count >= max)
7517                         break;
7518         }
7519         spin_unlock(&nn->client_lock);
7520         nfsd_forget_delegations(&reaplist);
7521         return count;
7522 }
7523
7524 static void
7525 nfsd_recall_delegations(struct list_head *reaplist)
7526 {
7527         struct nfs4_client *clp;
7528         struct nfs4_delegation *dp, *next;
7529
7530         list_for_each_entry_safe(dp, next, reaplist, dl_recall_lru) {
7531                 list_del_init(&dp->dl_recall_lru);
7532                 clp = dp->dl_stid.sc_client;
7533                 /*
7534                  * We skipped all entries that had a zero dl_time before,
7535                  * so we can now reset the dl_time back to 0. If a delegation
7536                  * break comes in now, then it won't make any difference since
7537                  * we're recalling it either way.
7538                  */
7539                 spin_lock(&state_lock);
7540                 dp->dl_time = 0;
7541                 spin_unlock(&state_lock);
7542                 nfsd_break_one_deleg(dp);
7543                 put_client(clp);
7544         }
7545 }
7546
7547 u64
7548 nfsd_inject_recall_client_delegations(struct sockaddr_storage *addr,
7549                                       size_t addr_size)
7550 {
7551         u64 count = 0;
7552         struct nfs4_client *clp;
7553         struct nfsd_net *nn = net_generic(current->nsproxy->net_ns,
7554                                                 nfsd_net_id);
7555         LIST_HEAD(reaplist);
7556
7557         if (!nfsd_netns_ready(nn))
7558                 return count;
7559
7560         spin_lock(&nn->client_lock);
7561         clp = nfsd_find_client(addr, addr_size);
7562         if (clp)
7563                 count = nfsd_find_all_delegations(clp, 0, &reaplist);
7564         spin_unlock(&nn->client_lock);
7565
7566         nfsd_recall_delegations(&reaplist);
7567         return count;
7568 }
7569
7570 u64
7571 nfsd_inject_recall_delegations(u64 max)
7572 {
7573         u64 count = 0;
7574         struct nfs4_client *clp, *next;
7575         struct nfsd_net *nn = net_generic(current->nsproxy->net_ns,
7576                                                 nfsd_net_id);
7577         LIST_HEAD(reaplist);
7578
7579         if (!nfsd_netns_ready(nn))
7580                 return count;
7581
7582         spin_lock(&nn->client_lock);
7583         list_for_each_entry_safe(clp, next, &nn->client_lru, cl_lru) {
7584                 count += nfsd_find_all_delegations(clp, max - count, &reaplist);
7585                 if (max != 0 && ++count >= max)
7586                         break;
7587         }
7588         spin_unlock(&nn->client_lock);
7589         nfsd_recall_delegations(&reaplist);
7590         return count;
7591 }
7592 #endif /* CONFIG_NFSD_FAULT_INJECTION */
7593
7594 /*
7595  * Since the lifetime of a delegation isn't limited to that of an open, a
7596  * client may quite reasonably hang on to a delegation as long as it has
7597  * the inode cached.  This becomes an obvious problem the first time a
7598  * client's inode cache approaches the size of the server's total memory.
7599  *
7600  * For now we avoid this problem by imposing a hard limit on the number
7601  * of delegations, which varies according to the server's memory size.
7602  */
7603 static void
7604 set_max_delegations(void)
7605 {
7606         /*
7607          * Allow at most 4 delegations per megabyte of RAM.  Quick
7608          * estimates suggest that in the worst case (where every delegation
7609          * is for a different inode), a delegation could take about 1.5K,
7610          * giving a worst case usage of about 6% of memory.
7611          */
7612         max_delegations = nr_free_buffer_pages() >> (20 - 2 - PAGE_SHIFT);
7613 }
7614
7615 static int nfs4_state_create_net(struct net *net)
7616 {
7617         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
7618         int i;
7619
7620         nn->conf_id_hashtbl = kmalloc_array(CLIENT_HASH_SIZE,
7621                                             sizeof(struct list_head),
7622                                             GFP_KERNEL);
7623         if (!nn->conf_id_hashtbl)
7624                 goto err;
7625         nn->unconf_id_hashtbl = kmalloc_array(CLIENT_HASH_SIZE,
7626                                               sizeof(struct list_head),
7627                                               GFP_KERNEL);
7628         if (!nn->unconf_id_hashtbl)
7629                 goto err_unconf_id;
7630         nn->sessionid_hashtbl = kmalloc_array(SESSION_HASH_SIZE,
7631                                               sizeof(struct list_head),
7632                                               GFP_KERNEL);
7633         if (!nn->sessionid_hashtbl)
7634                 goto err_sessionid;
7635
7636         for (i = 0; i < CLIENT_HASH_SIZE; i++) {
7637                 INIT_LIST_HEAD(&nn->conf_id_hashtbl[i]);
7638                 INIT_LIST_HEAD(&nn->unconf_id_hashtbl[i]);
7639         }
7640         for (i = 0; i < SESSION_HASH_SIZE; i++)
7641                 INIT_LIST_HEAD(&nn->sessionid_hashtbl[i]);
7642         nn->conf_name_tree = RB_ROOT;
7643         nn->unconf_name_tree = RB_ROOT;
7644         nn->boot_time = get_seconds();
7645         nn->grace_ended = false;
7646         nn->nfsd4_manager.block_opens = true;
7647         INIT_LIST_HEAD(&nn->nfsd4_manager.list);
7648         INIT_LIST_HEAD(&nn->client_lru);
7649         INIT_LIST_HEAD(&nn->close_lru);
7650         INIT_LIST_HEAD(&nn->del_recall_lru);
7651         spin_lock_init(&nn->client_lock);
7652         spin_lock_init(&nn->s2s_cp_lock);
7653         idr_init(&nn->s2s_cp_stateids);
7654
7655         spin_lock_init(&nn->blocked_locks_lock);
7656         INIT_LIST_HEAD(&nn->blocked_locks_lru);
7657
7658         INIT_DELAYED_WORK(&nn->laundromat_work, laundromat_main);
7659         get_net(net);
7660
7661         return 0;
7662
7663 err_sessionid:
7664         kfree(nn->unconf_id_hashtbl);
7665 err_unconf_id:
7666         kfree(nn->conf_id_hashtbl);
7667 err:
7668         return -ENOMEM;
7669 }
7670
7671 static void
7672 nfs4_state_destroy_net(struct net *net)
7673 {
7674         int i;
7675         struct nfs4_client *clp = NULL;
7676         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
7677
7678         for (i = 0; i < CLIENT_HASH_SIZE; i++) {
7679                 while (!list_empty(&nn->conf_id_hashtbl[i])) {
7680                         clp = list_entry(nn->conf_id_hashtbl[i].next, struct nfs4_client, cl_idhash);
7681                         destroy_client(clp);
7682                 }
7683         }
7684
7685         WARN_ON(!list_empty(&nn->blocked_locks_lru));
7686
7687         for (i = 0; i < CLIENT_HASH_SIZE; i++) {
7688                 while (!list_empty(&nn->unconf_id_hashtbl[i])) {
7689                         clp = list_entry(nn->unconf_id_hashtbl[i].next, struct nfs4_client, cl_idhash);
7690                         destroy_client(clp);
7691                 }
7692         }
7693
7694         kfree(nn->sessionid_hashtbl);
7695         kfree(nn->unconf_id_hashtbl);
7696         kfree(nn->conf_id_hashtbl);
7697         put_net(net);
7698 }
7699
7700 int
7701 nfs4_state_start_net(struct net *net)
7702 {
7703         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
7704         int ret;
7705
7706         ret = nfs4_state_create_net(net);
7707         if (ret)
7708                 return ret;
7709         locks_start_grace(net, &nn->nfsd4_manager);
7710         nfsd4_client_tracking_init(net);
7711         if (nn->track_reclaim_completes && nn->reclaim_str_hashtbl_size == 0)
7712                 goto skip_grace;
7713         printk(KERN_INFO "NFSD: starting %ld-second grace period (net %x)\n",
7714                nn->nfsd4_grace, net->ns.inum);
7715         queue_delayed_work(laundry_wq, &nn->laundromat_work, nn->nfsd4_grace * HZ);
7716         return 0;
7717
7718 skip_grace:
7719         printk(KERN_INFO "NFSD: no clients to reclaim, skipping NFSv4 grace period (net %x)\n",
7720                         net->ns.inum);
7721         queue_delayed_work(laundry_wq, &nn->laundromat_work, nn->nfsd4_lease * HZ);
7722         nfsd4_end_grace(nn);
7723         return 0;
7724 }
7725
7726 /* initialization to perform when the nfsd service is started: */
7727
7728 int
7729 nfs4_state_start(void)
7730 {
7731         int ret;
7732
7733         laundry_wq = alloc_workqueue("%s", WQ_UNBOUND, 0, "nfsd4");
7734         if (laundry_wq == NULL) {
7735                 ret = -ENOMEM;
7736                 goto out;
7737         }
7738         ret = nfsd4_create_callback_queue();
7739         if (ret)
7740                 goto out_free_laundry;
7741
7742         set_max_delegations();
7743         return 0;
7744
7745 out_free_laundry:
7746         destroy_workqueue(laundry_wq);
7747 out:
7748         return ret;
7749 }
7750
7751 void
7752 nfs4_state_shutdown_net(struct net *net)
7753 {
7754         struct nfs4_delegation *dp = NULL;
7755         struct list_head *pos, *next, reaplist;
7756         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
7757
7758         cancel_delayed_work_sync(&nn->laundromat_work);
7759         locks_end_grace(&nn->nfsd4_manager);
7760
7761         INIT_LIST_HEAD(&reaplist);
7762         spin_lock(&state_lock);
7763         list_for_each_safe(pos, next, &nn->del_recall_lru) {
7764                 dp = list_entry (pos, struct nfs4_delegation, dl_recall_lru);
7765                 WARN_ON(!unhash_delegation_locked(dp));
7766                 list_add(&dp->dl_recall_lru, &reaplist);
7767         }
7768         spin_unlock(&state_lock);
7769         list_for_each_safe(pos, next, &reaplist) {
7770                 dp = list_entry (pos, struct nfs4_delegation, dl_recall_lru);
7771                 list_del_init(&dp->dl_recall_lru);
7772                 destroy_unhashed_deleg(dp);
7773         }
7774
7775         nfsd4_client_tracking_exit(net);
7776         nfs4_state_destroy_net(net);
7777 }
7778
7779 void
7780 nfs4_state_shutdown(void)
7781 {
7782         destroy_workqueue(laundry_wq);
7783         nfsd4_destroy_callback_queue();
7784 }
7785
7786 static void
7787 get_stateid(struct nfsd4_compound_state *cstate, stateid_t *stateid)
7788 {
7789         if (HAS_STATE_ID(cstate, CURRENT_STATE_ID_FLAG) && CURRENT_STATEID(stateid))
7790                 memcpy(stateid, &cstate->current_stateid, sizeof(stateid_t));
7791 }
7792
7793 static void
7794 put_stateid(struct nfsd4_compound_state *cstate, stateid_t *stateid)
7795 {
7796         if (cstate->minorversion) {
7797                 memcpy(&cstate->current_stateid, stateid, sizeof(stateid_t));
7798                 SET_STATE_ID(cstate, CURRENT_STATE_ID_FLAG);
7799         }
7800 }
7801
7802 void
7803 clear_current_stateid(struct nfsd4_compound_state *cstate)
7804 {
7805         CLEAR_STATE_ID(cstate, CURRENT_STATE_ID_FLAG);
7806 }
7807
7808 /*
7809  * functions to set current state id
7810  */
7811 void
7812 nfsd4_set_opendowngradestateid(struct nfsd4_compound_state *cstate,
7813                 union nfsd4_op_u *u)
7814 {
7815         put_stateid(cstate, &u->open_downgrade.od_stateid);
7816 }
7817
7818 void
7819 nfsd4_set_openstateid(struct nfsd4_compound_state *cstate,
7820                 union nfsd4_op_u *u)
7821 {
7822         put_stateid(cstate, &u->open.op_stateid);
7823 }
7824
7825 void
7826 nfsd4_set_closestateid(struct nfsd4_compound_state *cstate,
7827                 union nfsd4_op_u *u)
7828 {
7829         put_stateid(cstate, &u->close.cl_stateid);
7830 }
7831
7832 void
7833 nfsd4_set_lockstateid(struct nfsd4_compound_state *cstate,
7834                 union nfsd4_op_u *u)
7835 {
7836         put_stateid(cstate, &u->lock.lk_resp_stateid);
7837 }
7838
7839 /*
7840  * functions to consume current state id
7841  */
7842
7843 void
7844 nfsd4_get_opendowngradestateid(struct nfsd4_compound_state *cstate,
7845                 union nfsd4_op_u *u)
7846 {
7847         get_stateid(cstate, &u->open_downgrade.od_stateid);
7848 }
7849
7850 void
7851 nfsd4_get_delegreturnstateid(struct nfsd4_compound_state *cstate,
7852                 union nfsd4_op_u *u)
7853 {
7854         get_stateid(cstate, &u->delegreturn.dr_stateid);
7855 }
7856
7857 void
7858 nfsd4_get_freestateid(struct nfsd4_compound_state *cstate,
7859                 union nfsd4_op_u *u)
7860 {
7861         get_stateid(cstate, &u->free_stateid.fr_stateid);
7862 }
7863
7864 void
7865 nfsd4_get_setattrstateid(struct nfsd4_compound_state *cstate,
7866                 union nfsd4_op_u *u)
7867 {
7868         get_stateid(cstate, &u->setattr.sa_stateid);
7869 }
7870
7871 void
7872 nfsd4_get_closestateid(struct nfsd4_compound_state *cstate,
7873                 union nfsd4_op_u *u)
7874 {
7875         get_stateid(cstate, &u->close.cl_stateid);
7876 }
7877
7878 void
7879 nfsd4_get_lockustateid(struct nfsd4_compound_state *cstate,
7880                 union nfsd4_op_u *u)
7881 {
7882         get_stateid(cstate, &u->locku.lu_stateid);
7883 }
7884
7885 void
7886 nfsd4_get_readstateid(struct nfsd4_compound_state *cstate,
7887                 union nfsd4_op_u *u)
7888 {
7889         get_stateid(cstate, &u->read.rd_stateid);
7890 }
7891
7892 void
7893 nfsd4_get_writestateid(struct nfsd4_compound_state *cstate,
7894                 union nfsd4_op_u *u)
7895 {
7896         get_stateid(cstate, &u->write.wr_stateid);
7897 }