fs/nfsd/nfs4state.c

   1 /*
   2 *  Copyright (c) 2001 The Regents of the University of Michigan.
   3 *  All rights reserved.
   4 *
   5 *  Kendrick Smith <kmsmith@umich.edu>
   6 *  Andy Adamson <kandros@umich.edu>
   7 *
   8 *  Redistribution and use in source and binary forms, with or without
   9 *  modification, are permitted provided that the following conditions
  10 *  are met:
  11 *
  12 *  1. Redistributions of source code must retain the above copyright
  13 *     notice, this list of conditions and the following disclaimer.
  14 *  2. Redistributions in binary form must reproduce the above copyright
  15 *     notice, this list of conditions and the following disclaimer in the
  16 *     documentation and/or other materials provided with the distribution.
  17 *  3. Neither the name of the University nor the names of its
  18 *     contributors may be used to endorse or promote products derived
  19 *     from this software without specific prior written permission.
  20 *
  21 *  THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
  22 *  WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
  23 *  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
  24 *  DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
  25 *  FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  26 *  CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  27 *  SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
  28 *  BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
  29 *  LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
  30 *  NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
  31 *  SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  32 *
  33 */
  34
  35 #include <linux/file.h>
  36 #include <linux/fs.h>
  37 #include <linux/slab.h>
  38 #include <linux/namei.h>
  39 #include <linux/swap.h>
  40 #include <linux/pagemap.h>
  41 #include <linux/ratelimit.h>
  42 #include <linux/sunrpc/svcauth_gss.h>
  43 #include <linux/sunrpc/addr.h>
  44 #include <linux/jhash.h>
  45 #include <linux/string_helpers.h>
  46 #include <linux/fsnotify.h>
  47 #include <linux/nfs_ssc.h>
  48 #include "xdr4.h"
  49 #include "xdr4cb.h"
  50 #include "vfs.h"
  51 #include "current_stateid.h"
  52
  53 #include "netns.h"
  54 #include "pnfs.h"
  55 #include "filecache.h"
  56 #include "trace.h"
  57
  58 #define NFSDDBG_FACILITY                NFSDDBG_PROC
  59
  60 #define all_ones {{~0,~0},~0}
  61 static const stateid_t one_stateid = {
  62         .si_generation = ~0,
  63         .si_opaque = all_ones,
  64 };
  65 static const stateid_t zero_stateid = {
  66         /* all fields zero */
  67 };
  68 static const stateid_t currentstateid = {
  69         .si_generation = 1,
  70 };
  71 static const stateid_t close_stateid = {
  72         .si_generation = 0xffffffffU,
  73 };
  74
  75 static u64 current_sessionid = 1;
  76
  77 #define ZERO_STATEID(stateid) (!memcmp((stateid), &zero_stateid, sizeof(stateid_t)))
  78 #define ONE_STATEID(stateid)  (!memcmp((stateid), &one_stateid, sizeof(stateid_t)))
  79 #define CURRENT_STATEID(stateid) (!memcmp((stateid), &currentstateid, sizeof(stateid_t)))
  80 #define CLOSE_STATEID(stateid)  (!memcmp((stateid), &close_stateid, sizeof(stateid_t)))
  81
  82 /* forward declarations */
  83 static bool check_for_locks(struct nfs4_file *fp, struct nfs4_lockowner *lowner);
  84 static void nfs4_free_ol_stateid(struct nfs4_stid *stid);
  85 void nfsd4_end_grace(struct nfsd_net *nn);
  86 static void _free_cpntf_state_locked(struct nfsd_net *nn, struct nfs4_cpntf_state *cps);
  87
  88 /* Locking: */
  89
  90 /*
  91  * Currently used for the del_recall_lru and file hash table.  In an
  92  * effort to decrease the scope of the client_mutex, this spinlock may
  93  * eventually cover more:
  94  */
  95 static DEFINE_SPINLOCK(state_lock);
  96
  97 enum nfsd4_st_mutex_lock_subclass {
  98         OPEN_STATEID_MUTEX = 0,
  99         LOCK_STATEID_MUTEX = 1,
 100 };
 101
 102 /*
 103  * A waitqueue for all in-progress 4.0 CLOSE operations that are waiting for
 104  * the refcount on the open stateid to drop.
 105  */
 106 static DECLARE_WAIT_QUEUE_HEAD(close_wq);
 107
 108 /*
 109  * A waitqueue where a writer to clients/#/ctl destroying a client can
 110  * wait for cl_rpc_users to drop to 0 and then for the client to be
 111  * unhashed.
 112  */
 113 static DECLARE_WAIT_QUEUE_HEAD(expiry_wq);
 114
 115 static struct kmem_cache *client_slab;
 116 static struct kmem_cache *openowner_slab;
 117 static struct kmem_cache *lockowner_slab;
 118 static struct kmem_cache *file_slab;
 119 static struct kmem_cache *stateid_slab;
 120 static struct kmem_cache *deleg_slab;
 121 static struct kmem_cache *odstate_slab;
 122
 123 static void free_session(struct nfsd4_session *);
 124
 125 static const struct nfsd4_callback_ops nfsd4_cb_recall_ops;
 126 static const struct nfsd4_callback_ops nfsd4_cb_notify_lock_ops;
 127
 128 static struct workqueue_struct *laundry_wq;
 129
 130 int nfsd4_create_laundry_wq(void)
 131 {
 132         int rc = 0;
 133
 134         laundry_wq = alloc_workqueue("%s", WQ_UNBOUND, 0, "nfsd4");
 135         if (laundry_wq == NULL)
 136                 rc = -ENOMEM;
 137         return rc;
 138 }
 139
 140 void nfsd4_destroy_laundry_wq(void)
 141 {
 142         destroy_workqueue(laundry_wq);
 143 }
 144
 145 static bool is_session_dead(struct nfsd4_session *ses)
 146 {
 147         return ses->se_flags & NFS4_SESSION_DEAD;
 148 }
 149
 150 static __be32 mark_session_dead_locked(struct nfsd4_session *ses, int ref_held_by_me)
 151 {
 152         if (atomic_read(&ses->se_ref) > ref_held_by_me)
 153                 return nfserr_jukebox;
 154         ses->se_flags |= NFS4_SESSION_DEAD;
 155         return nfs_ok;
 156 }
 157
 158 static bool is_client_expired(struct nfs4_client *clp)
 159 {
 160         return clp->cl_time == 0;
 161 }
 162
 163 static void nfsd4_dec_courtesy_client_count(struct nfsd_net *nn,
 164                                         struct nfs4_client *clp)
 165 {
 166         if (clp->cl_state != NFSD4_ACTIVE)
 167                 atomic_add_unless(&nn->nfsd_courtesy_clients, -1, 0);
 168 }
 169
 170 static __be32 get_client_locked(struct nfs4_client *clp)
 171 {
 172         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
 173
 174         lockdep_assert_held(&nn->client_lock);
 175
 176         if (is_client_expired(clp))
 177                 return nfserr_expired;
 178         atomic_inc(&clp->cl_rpc_users);
 179         nfsd4_dec_courtesy_client_count(nn, clp);
 180         clp->cl_state = NFSD4_ACTIVE;
 181         return nfs_ok;
 182 }
 183
 184 /* must be called under the client_lock */
 185 static inline void
 186 renew_client_locked(struct nfs4_client *clp)
 187 {
 188         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
 189
 190         if (is_client_expired(clp)) {
 191                 WARN_ON(1);
 192                 printk("%s: client (clientid %08x/%08x) already expired\n",
 193                         __func__,
 194                         clp->cl_clientid.cl_boot,
 195                         clp->cl_clientid.cl_id);
 196                 return;
 197         }
 198
 199         list_move_tail(&clp->cl_lru, &nn->client_lru);
 200         clp->cl_time = ktime_get_boottime_seconds();
 201         nfsd4_dec_courtesy_client_count(nn, clp);
 202         clp->cl_state = NFSD4_ACTIVE;
 203 }
 204
 205 static void put_client_renew_locked(struct nfs4_client *clp)
 206 {
 207         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
 208
 209         lockdep_assert_held(&nn->client_lock);
 210
 211         if (!atomic_dec_and_test(&clp->cl_rpc_users))
 212                 return;
 213         if (!is_client_expired(clp))
 214                 renew_client_locked(clp);
 215         else
 216                 wake_up_all(&expiry_wq);
 217 }
 218
 219 static void put_client_renew(struct nfs4_client *clp)
 220 {
 221         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
 222
 223         if (!atomic_dec_and_lock(&clp->cl_rpc_users, &nn->client_lock))
 224                 return;
 225         if (!is_client_expired(clp))
 226                 renew_client_locked(clp);
 227         else
 228                 wake_up_all(&expiry_wq);
 229         spin_unlock(&nn->client_lock);
 230 }
 231
 232 static __be32 nfsd4_get_session_locked(struct nfsd4_session *ses)
 233 {
 234         __be32 status;
 235
 236         if (is_session_dead(ses))
 237                 return nfserr_badsession;
 238         status = get_client_locked(ses->se_client);
 239         if (status)
 240                 return status;
 241         atomic_inc(&ses->se_ref);
 242         return nfs_ok;
 243 }
 244
 245 static void nfsd4_put_session_locked(struct nfsd4_session *ses)
 246 {
 247         struct nfs4_client *clp = ses->se_client;
 248         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
 249
 250         lockdep_assert_held(&nn->client_lock);
 251
 252         if (atomic_dec_and_test(&ses->se_ref) && is_session_dead(ses))
 253                 free_session(ses);
 254         put_client_renew_locked(clp);
 255 }
 256
 257 static void nfsd4_put_session(struct nfsd4_session *ses)
 258 {
 259         struct nfs4_client *clp = ses->se_client;
 260         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
 261
 262         spin_lock(&nn->client_lock);
 263         nfsd4_put_session_locked(ses);
 264         spin_unlock(&nn->client_lock);
 265 }
 266
 267 static struct nfsd4_blocked_lock *
 268 find_blocked_lock(struct nfs4_lockowner *lo, struct knfsd_fh *fh,
 269                         struct nfsd_net *nn)
 270 {
 271         struct nfsd4_blocked_lock *cur, *found = NULL;
 272
 273         spin_lock(&nn->blocked_locks_lock);
 274         list_for_each_entry(cur, &lo->lo_blocked, nbl_list) {
 275                 if (fh_match(fh, &cur->nbl_fh)) {
 276                         list_del_init(&cur->nbl_list);
 277                         WARN_ON(list_empty(&cur->nbl_lru));
 278                         list_del_init(&cur->nbl_lru);
 279                         found = cur;
 280                         break;
 281                 }
 282         }
 283         spin_unlock(&nn->blocked_locks_lock);
 284         if (found)
 285                 locks_delete_block(&found->nbl_lock);
 286         return found;
 287 }
 288
 289 static struct nfsd4_blocked_lock *
 290 find_or_allocate_block(struct nfs4_lockowner *lo, struct knfsd_fh *fh,
 291                         struct nfsd_net *nn)
 292 {
 293         struct nfsd4_blocked_lock *nbl;
 294
 295         nbl = find_blocked_lock(lo, fh, nn);
 296         if (!nbl) {
 297                 nbl= kmalloc(sizeof(*nbl), GFP_KERNEL);
 298                 if (nbl) {
 299                         INIT_LIST_HEAD(&nbl->nbl_list);
 300                         INIT_LIST_HEAD(&nbl->nbl_lru);
 301                         fh_copy_shallow(&nbl->nbl_fh, fh);
 302                         locks_init_lock(&nbl->nbl_lock);
 303                         kref_init(&nbl->nbl_kref);
 304                         nfsd4_init_cb(&nbl->nbl_cb, lo->lo_owner.so_client,
 305                                         &nfsd4_cb_notify_lock_ops,
 306                                         NFSPROC4_CLNT_CB_NOTIFY_LOCK);
 307                 }
 308         }
 309         return nbl;
 310 }
 311
 312 static void
 313 free_nbl(struct kref *kref)
 314 {
 315         struct nfsd4_blocked_lock *nbl;
 316
 317         nbl = container_of(kref, struct nfsd4_blocked_lock, nbl_kref);
 318         kfree(nbl);
 319 }
 320
 321 static void
 322 free_blocked_lock(struct nfsd4_blocked_lock *nbl)
 323 {
 324         locks_delete_block(&nbl->nbl_lock);
 325         locks_release_private(&nbl->nbl_lock);
 326         kref_put(&nbl->nbl_kref, free_nbl);
 327 }
 328
 329 static void
 330 remove_blocked_locks(struct nfs4_lockowner *lo)
 331 {
 332         struct nfs4_client *clp = lo->lo_owner.so_client;
 333         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
 334         struct nfsd4_blocked_lock *nbl;
 335         LIST_HEAD(reaplist);
 336
 337         /* Dequeue all blocked locks */
 338         spin_lock(&nn->blocked_locks_lock);
 339         while (!list_empty(&lo->lo_blocked)) {
 340                 nbl = list_first_entry(&lo->lo_blocked,
 341                                         struct nfsd4_blocked_lock,
 342                                         nbl_list);
 343                 list_del_init(&nbl->nbl_list);
 344                 WARN_ON(list_empty(&nbl->nbl_lru));
 345                 list_move(&nbl->nbl_lru, &reaplist);
 346         }
 347         spin_unlock(&nn->blocked_locks_lock);
 348
 349         /* Now free them */
 350         while (!list_empty(&reaplist)) {
 351                 nbl = list_first_entry(&reaplist, struct nfsd4_blocked_lock,
 352                                         nbl_lru);
 353                 list_del_init(&nbl->nbl_lru);
 354                 free_blocked_lock(nbl);
 355         }
 356 }
 357
 358 static void
 359 nfsd4_cb_notify_lock_prepare(struct nfsd4_callback *cb)
 360 {
 361         struct nfsd4_blocked_lock       *nbl = container_of(cb,
 362                                                 struct nfsd4_blocked_lock, nbl_cb);
 363         locks_delete_block(&nbl->nbl_lock);
 364 }
 365
 366 static int
 367 nfsd4_cb_notify_lock_done(struct nfsd4_callback *cb, struct rpc_task *task)
 368 {
 369         trace_nfsd_cb_notify_lock_done(&zero_stateid, task);
 370
 371         /*
 372          * Since this is just an optimization, we don't try very hard if it
 373          * turns out not to succeed. We'll requeue it on NFS4ERR_DELAY, and
 374          * just quit trying on anything else.
 375          */
 376         switch (task->tk_status) {
 377         case -NFS4ERR_DELAY:
 378                 rpc_delay(task, 1 * HZ);
 379                 return 0;
 380         default:
 381                 return 1;
 382         }
 383 }
 384
 385 static void
 386 nfsd4_cb_notify_lock_release(struct nfsd4_callback *cb)
 387 {
 388         struct nfsd4_blocked_lock       *nbl = container_of(cb,
 389                                                 struct nfsd4_blocked_lock, nbl_cb);
 390
 391         free_blocked_lock(nbl);
 392 }
 393
 394 static const struct nfsd4_callback_ops nfsd4_cb_notify_lock_ops = {
 395         .prepare        = nfsd4_cb_notify_lock_prepare,
 396         .done           = nfsd4_cb_notify_lock_done,
 397         .release        = nfsd4_cb_notify_lock_release,
 398 };
 399
 400 /*
 401  * We store the NONE, READ, WRITE, and BOTH bits separately in the
 402  * st_{access,deny}_bmap field of the stateid, in order to track not
 403  * only what share bits are currently in force, but also what
 404  * combinations of share bits previous opens have used.  This allows us
 405  * to enforce the recommendation in
 406  * https://datatracker.ietf.org/doc/html/rfc7530#section-16.19.4 that
 407  * the server return an error if the client attempt to downgrade to a
 408  * combination of share bits not explicable by closing some of its
 409  * previous opens.
 410  *
 411  * This enforcement is arguably incomplete, since we don't keep
 412  * track of access/deny bit combinations; so, e.g., we allow:
 413  *
 414  *      OPEN allow read, deny write
 415  *      OPEN allow both, deny none
 416  *      DOWNGRADE allow read, deny none
 417  *
 418  * which we should reject.
 419  *
 420  * But you could also argue that our current code is already overkill,
 421  * since it only exists to return NFS4ERR_INVAL on incorrect client
 422  * behavior.
 423  */
 424 static unsigned int
 425 bmap_to_share_mode(unsigned long bmap)
 426 {
 427         int i;
 428         unsigned int access = 0;
 429
 430         for (i = 1; i < 4; i++) {
 431                 if (test_bit(i, &bmap))
 432                         access |= i;
 433         }
 434         return access;
 435 }
 436
 437 /* set share access for a given stateid */
 438 static inline void
 439 set_access(u32 access, struct nfs4_ol_stateid *stp)
 440 {
 441         unsigned char mask = 1 << access;
 442
 443         WARN_ON_ONCE(access > NFS4_SHARE_ACCESS_BOTH);
 444         stp->st_access_bmap |= mask;
 445 }
 446
 447 /* clear share access for a given stateid */
 448 static inline void
 449 clear_access(u32 access, struct nfs4_ol_stateid *stp)
 450 {
 451         unsigned char mask = 1 << access;
 452
 453         WARN_ON_ONCE(access > NFS4_SHARE_ACCESS_BOTH);
 454         stp->st_access_bmap &= ~mask;
 455 }
 456
 457 /* test whether a given stateid has access */
 458 static inline bool
 459 test_access(u32 access, struct nfs4_ol_stateid *stp)
 460 {
 461         unsigned char mask = 1 << access;
 462
 463         return (bool)(stp->st_access_bmap & mask);
 464 }
 465
 466 /* set share deny for a given stateid */
 467 static inline void
 468 set_deny(u32 deny, struct nfs4_ol_stateid *stp)
 469 {
 470         unsigned char mask = 1 << deny;
 471
 472         WARN_ON_ONCE(deny > NFS4_SHARE_DENY_BOTH);
 473         stp->st_deny_bmap |= mask;
 474 }
 475
 476 /* clear share deny for a given stateid */
 477 static inline void
 478 clear_deny(u32 deny, struct nfs4_ol_stateid *stp)
 479 {
 480         unsigned char mask = 1 << deny;
 481
 482         WARN_ON_ONCE(deny > NFS4_SHARE_DENY_BOTH);
 483         stp->st_deny_bmap &= ~mask;
 484 }
 485
 486 /* test whether a given stateid is denying specific access */
 487 static inline bool
 488 test_deny(u32 deny, struct nfs4_ol_stateid *stp)
 489 {
 490         unsigned char mask = 1 << deny;
 491
 492         return (bool)(stp->st_deny_bmap & mask);
 493 }
 494
 495 static int nfs4_access_to_omode(u32 access)
 496 {
 497         switch (access & NFS4_SHARE_ACCESS_BOTH) {
 498         case NFS4_SHARE_ACCESS_READ:
 499                 return O_RDONLY;
 500         case NFS4_SHARE_ACCESS_WRITE:
 501                 return O_WRONLY;
 502         case NFS4_SHARE_ACCESS_BOTH:
 503                 return O_RDWR;
 504         }
 505         WARN_ON_ONCE(1);
 506         return O_RDONLY;
 507 }
 508
 509 static inline int
 510 access_permit_read(struct nfs4_ol_stateid *stp)
 511 {
 512         return test_access(NFS4_SHARE_ACCESS_READ, stp) ||
 513                 test_access(NFS4_SHARE_ACCESS_BOTH, stp) ||
 514                 test_access(NFS4_SHARE_ACCESS_WRITE, stp);
 515 }
 516
 517 static inline int
 518 access_permit_write(struct nfs4_ol_stateid *stp)
 519 {
 520         return test_access(NFS4_SHARE_ACCESS_WRITE, stp) ||
 521                 test_access(NFS4_SHARE_ACCESS_BOTH, stp);
 522 }
 523
 524 static inline struct nfs4_stateowner *
 525 nfs4_get_stateowner(struct nfs4_stateowner *sop)
 526 {
 527         atomic_inc(&sop->so_count);
 528         return sop;
 529 }
 530
 531 static int
 532 same_owner_str(struct nfs4_stateowner *sop, struct xdr_netobj *owner)
 533 {
 534         return (sop->so_owner.len == owner->len) &&
 535                 0 == memcmp(sop->so_owner.data, owner->data, owner->len);
 536 }
 537
 538 static struct nfs4_openowner *
 539 find_openstateowner_str_locked(unsigned int hashval, struct nfsd4_open *open,
 540                         struct nfs4_client *clp)
 541 {
 542         struct nfs4_stateowner *so;
 543
 544         lockdep_assert_held(&clp->cl_lock);
 545
 546         list_for_each_entry(so, &clp->cl_ownerstr_hashtbl[hashval],
 547                             so_strhash) {
 548                 if (!so->so_is_open_owner)
 549                         continue;
 550                 if (same_owner_str(so, &open->op_owner))
 551                         return openowner(nfs4_get_stateowner(so));
 552         }
 553         return NULL;
 554 }
 555
 556 static struct nfs4_openowner *
 557 find_openstateowner_str(unsigned int hashval, struct nfsd4_open *open,
 558                         struct nfs4_client *clp)
 559 {
 560         struct nfs4_openowner *oo;
 561
 562         spin_lock(&clp->cl_lock);
 563         oo = find_openstateowner_str_locked(hashval, open, clp);
 564         spin_unlock(&clp->cl_lock);
 565         return oo;
 566 }
 567
 568 static inline u32
 569 opaque_hashval(const void *ptr, int nbytes)
 570 {
 571         unsigned char *cptr = (unsigned char *) ptr;
 572
 573         u32 x = 0;
 574         while (nbytes--) {
 575                 x *= 37;
 576                 x += *cptr++;
 577         }
 578         return x;
 579 }
 580
 581 static void nfsd4_free_file_rcu(struct rcu_head *rcu)
 582 {
 583         struct nfs4_file *fp = container_of(rcu, struct nfs4_file, fi_rcu);
 584
 585         kmem_cache_free(file_slab, fp);
 586 }
 587
 588 void
 589 put_nfs4_file(struct nfs4_file *fi)
 590 {
 591         might_lock(&state_lock);
 592
 593         if (refcount_dec_and_lock(&fi->fi_ref, &state_lock)) {
 594                 hlist_del_rcu(&fi->fi_hash);
 595                 spin_unlock(&state_lock);
 596                 WARN_ON_ONCE(!list_empty(&fi->fi_clnt_odstate));
 597                 WARN_ON_ONCE(!list_empty(&fi->fi_delegations));
 598                 call_rcu(&fi->fi_rcu, nfsd4_free_file_rcu);
 599         }
 600 }
 601
 602 static struct nfsd_file *
 603 __nfs4_get_fd(struct nfs4_file *f, int oflag)
 604 {
 605         if (f->fi_fds[oflag])
 606                 return nfsd_file_get(f->fi_fds[oflag]);
 607         return NULL;
 608 }
 609
 610 static struct nfsd_file *
 611 find_writeable_file_locked(struct nfs4_file *f)
 612 {
 613         struct nfsd_file *ret;
 614
 615         lockdep_assert_held(&f->fi_lock);
 616
 617         ret = __nfs4_get_fd(f, O_WRONLY);
 618         if (!ret)
 619                 ret = __nfs4_get_fd(f, O_RDWR);
 620         return ret;
 621 }
 622
 623 static struct nfsd_file *
 624 find_writeable_file(struct nfs4_file *f)
 625 {
 626         struct nfsd_file *ret;
 627
 628         spin_lock(&f->fi_lock);
 629         ret = find_writeable_file_locked(f);
 630         spin_unlock(&f->fi_lock);
 631
 632         return ret;
 633 }
 634
 635 static struct nfsd_file *
 636 find_readable_file_locked(struct nfs4_file *f)
 637 {
 638         struct nfsd_file *ret;
 639
 640         lockdep_assert_held(&f->fi_lock);
 641
 642         ret = __nfs4_get_fd(f, O_RDONLY);
 643         if (!ret)
 644                 ret = __nfs4_get_fd(f, O_RDWR);
 645         return ret;
 646 }
 647
 648 static struct nfsd_file *
 649 find_readable_file(struct nfs4_file *f)
 650 {
 651         struct nfsd_file *ret;
 652
 653         spin_lock(&f->fi_lock);
 654         ret = find_readable_file_locked(f);
 655         spin_unlock(&f->fi_lock);
 656
 657         return ret;
 658 }
 659
 660 struct nfsd_file *
 661 find_any_file(struct nfs4_file *f)
 662 {
 663         struct nfsd_file *ret;
 664
 665         if (!f)
 666                 return NULL;
 667         spin_lock(&f->fi_lock);
 668         ret = __nfs4_get_fd(f, O_RDWR);
 669         if (!ret) {
 670                 ret = __nfs4_get_fd(f, O_WRONLY);
 671                 if (!ret)
 672                         ret = __nfs4_get_fd(f, O_RDONLY);
 673         }
 674         spin_unlock(&f->fi_lock);
 675         return ret;
 676 }
 677
 678 static struct nfsd_file *find_any_file_locked(struct nfs4_file *f)
 679 {
 680         lockdep_assert_held(&f->fi_lock);
 681
 682         if (f->fi_fds[O_RDWR])
 683                 return f->fi_fds[O_RDWR];
 684         if (f->fi_fds[O_WRONLY])
 685                 return f->fi_fds[O_WRONLY];
 686         if (f->fi_fds[O_RDONLY])
 687                 return f->fi_fds[O_RDONLY];
 688         return NULL;
 689 }
 690
 691 static struct nfsd_file *find_deleg_file_locked(struct nfs4_file *f)
 692 {
 693         lockdep_assert_held(&f->fi_lock);
 694
 695         if (f->fi_deleg_file)
 696                 return f->fi_deleg_file;
 697         return NULL;
 698 }
 699
 700 static atomic_long_t num_delegations;
 701 unsigned long max_delegations;
 702
 703 /*
 704  * Open owner state (share locks)
 705  */
 706
 707 /* hash tables for lock and open owners */
 708 #define OWNER_HASH_BITS              8
 709 #define OWNER_HASH_SIZE             (1 << OWNER_HASH_BITS)
 710 #define OWNER_HASH_MASK             (OWNER_HASH_SIZE - 1)
 711
 712 static unsigned int ownerstr_hashval(struct xdr_netobj *ownername)
 713 {
 714         unsigned int ret;
 715
 716         ret = opaque_hashval(ownername->data, ownername->len);
 717         return ret & OWNER_HASH_MASK;
 718 }
 719
 720 /* hash table for nfs4_file */
 721 #define FILE_HASH_BITS                   8
 722 #define FILE_HASH_SIZE                  (1 << FILE_HASH_BITS)
 723
 724 static unsigned int file_hashval(struct svc_fh *fh)
 725 {
 726         struct inode *inode = d_inode(fh->fh_dentry);
 727
 728         /* XXX: why not (here & in file cache) use inode? */
 729         return (unsigned int)hash_long(inode->i_ino, FILE_HASH_BITS);
 730 }
 731
 732 static struct hlist_head file_hashtbl[FILE_HASH_SIZE];
 733
 734 /*
 735  * Check if courtesy clients have conflicting access and resolve it if possible
 736  *
 737  * access:  is op_share_access if share_access is true.
 738  *          Check if access mode, op_share_access, would conflict with
 739  *          the current deny mode of the file 'fp'.
 740  * access:  is op_share_deny if share_access is false.
 741  *          Check if the deny mode, op_share_deny, would conflict with
 742  *          current access of the file 'fp'.
 743  * stp:     skip checking this entry.
 744  * new_stp: normal open, not open upgrade.
 745  *
 746  * Function returns:
 747  *      false - access/deny mode conflict with normal client.
 748  *      true  - no conflict or conflict with courtesy client(s) is resolved.
 749  */
 750 static bool
 751 nfs4_resolve_deny_conflicts_locked(struct nfs4_file *fp, bool new_stp,
 752                 struct nfs4_ol_stateid *stp, u32 access, bool share_access)
 753 {
 754         struct nfs4_ol_stateid *st;
 755         bool resolvable = true;
 756         unsigned char bmap;
 757         struct nfsd_net *nn;
 758         struct nfs4_client *clp;
 759
 760         lockdep_assert_held(&fp->fi_lock);
 761         list_for_each_entry(st, &fp->fi_stateids, st_perfile) {
 762                 /* ignore lock stateid */
 763                 if (st->st_openstp)
 764                         continue;
 765                 if (st == stp && new_stp)
 766                         continue;
 767                 /* check file access against deny mode or vice versa */
 768                 bmap = share_access ? st->st_deny_bmap : st->st_access_bmap;
 769                 if (!(access & bmap_to_share_mode(bmap)))
 770                         continue;
 771                 clp = st->st_stid.sc_client;
 772                 if (try_to_expire_client(clp))
 773                         continue;
 774                 resolvable = false;
 775                 break;
 776         }
 777         if (resolvable) {
 778                 clp = stp->st_stid.sc_client;
 779                 nn = net_generic(clp->net, nfsd_net_id);
 780                 mod_delayed_work(laundry_wq, &nn->laundromat_work, 0);
 781         }
 782         return resolvable;
 783 }
 784
 785 static void
 786 __nfs4_file_get_access(struct nfs4_file *fp, u32 access)
 787 {
 788         lockdep_assert_held(&fp->fi_lock);
 789
 790         if (access & NFS4_SHARE_ACCESS_WRITE)
 791                 atomic_inc(&fp->fi_access[O_WRONLY]);
 792         if (access & NFS4_SHARE_ACCESS_READ)
 793                 atomic_inc(&fp->fi_access[O_RDONLY]);
 794 }
 795
 796 static __be32
 797 nfs4_file_get_access(struct nfs4_file *fp, u32 access)
 798 {
 799         lockdep_assert_held(&fp->fi_lock);
 800
 801         /* Does this access mode make sense? */
 802         if (access & ~NFS4_SHARE_ACCESS_BOTH)
 803                 return nfserr_inval;
 804
 805         /* Does it conflict with a deny mode already set? */
 806         if ((access & fp->fi_share_deny) != 0)
 807                 return nfserr_share_denied;
 808
 809         __nfs4_file_get_access(fp, access);
 810         return nfs_ok;
 811 }
 812
 813 static __be32 nfs4_file_check_deny(struct nfs4_file *fp, u32 deny)
 814 {
 815         /* Common case is that there is no deny mode. */
 816         if (deny) {
 817                 /* Does this deny mode make sense? */
 818                 if (deny & ~NFS4_SHARE_DENY_BOTH)
 819                         return nfserr_inval;
 820
 821                 if ((deny & NFS4_SHARE_DENY_READ) &&
 822                     atomic_read(&fp->fi_access[O_RDONLY]))
 823                         return nfserr_share_denied;
 824
 825                 if ((deny & NFS4_SHARE_DENY_WRITE) &&
 826                     atomic_read(&fp->fi_access[O_WRONLY]))
 827                         return nfserr_share_denied;
 828         }
 829         return nfs_ok;
 830 }
 831
 832 static void __nfs4_file_put_access(struct nfs4_file *fp, int oflag)
 833 {
 834         might_lock(&fp->fi_lock);
 835
 836         if (atomic_dec_and_lock(&fp->fi_access[oflag], &fp->fi_lock)) {
 837                 struct nfsd_file *f1 = NULL;
 838                 struct nfsd_file *f2 = NULL;
 839
 840                 swap(f1, fp->fi_fds[oflag]);
 841                 if (atomic_read(&fp->fi_access[1 - oflag]) == 0)
 842                         swap(f2, fp->fi_fds[O_RDWR]);
 843                 spin_unlock(&fp->fi_lock);
 844                 if (f1)
 845                         nfsd_file_put(f1);
 846                 if (f2)
 847                         nfsd_file_put(f2);
 848         }
 849 }
 850
 851 static void nfs4_file_put_access(struct nfs4_file *fp, u32 access)
 852 {
 853         WARN_ON_ONCE(access & ~NFS4_SHARE_ACCESS_BOTH);
 854
 855         if (access & NFS4_SHARE_ACCESS_WRITE)
 856                 __nfs4_file_put_access(fp, O_WRONLY);
 857         if (access & NFS4_SHARE_ACCESS_READ)
 858                 __nfs4_file_put_access(fp, O_RDONLY);
 859 }
 860
 861 /*
 862  * Allocate a new open/delegation state counter. This is needed for
 863  * pNFS for proper return on close semantics.
 864  *
 865  * Note that we only allocate it for pNFS-enabled exports, otherwise
 866  * all pointers to struct nfs4_clnt_odstate are always NULL.
 867  */
 868 static struct nfs4_clnt_odstate *
 869 alloc_clnt_odstate(struct nfs4_client *clp)
 870 {
 871         struct nfs4_clnt_odstate *co;
 872
 873         co = kmem_cache_zalloc(odstate_slab, GFP_KERNEL);
 874         if (co) {
 875                 co->co_client = clp;
 876                 refcount_set(&co->co_odcount, 1);
 877         }
 878         return co;
 879 }
 880
 881 static void
 882 hash_clnt_odstate_locked(struct nfs4_clnt_odstate *co)
 883 {
 884         struct nfs4_file *fp = co->co_file;
 885
 886         lockdep_assert_held(&fp->fi_lock);
 887         list_add(&co->co_perfile, &fp->fi_clnt_odstate);
 888 }
 889
 890 static inline void
 891 get_clnt_odstate(struct nfs4_clnt_odstate *co)
 892 {
 893         if (co)
 894                 refcount_inc(&co->co_odcount);
 895 }
 896
 897 static void
 898 put_clnt_odstate(struct nfs4_clnt_odstate *co)
 899 {
 900         struct nfs4_file *fp;
 901
 902         if (!co)
 903                 return;
 904
 905         fp = co->co_file;
 906         if (refcount_dec_and_lock(&co->co_odcount, &fp->fi_lock)) {
 907                 list_del(&co->co_perfile);
 908                 spin_unlock(&fp->fi_lock);
 909
 910                 nfsd4_return_all_file_layouts(co->co_client, fp);
 911                 kmem_cache_free(odstate_slab, co);
 912         }
 913 }
 914
 915 static struct nfs4_clnt_odstate *
 916 find_or_hash_clnt_odstate(struct nfs4_file *fp, struct nfs4_clnt_odstate *new)
 917 {
 918         struct nfs4_clnt_odstate *co;
 919         struct nfs4_client *cl;
 920
 921         if (!new)
 922                 return NULL;
 923
 924         cl = new->co_client;
 925
 926         spin_lock(&fp->fi_lock);
 927         list_for_each_entry(co, &fp->fi_clnt_odstate, co_perfile) {
 928                 if (co->co_client == cl) {
 929                         get_clnt_odstate(co);
 930                         goto out;
 931                 }
 932         }
 933         co = new;
 934         co->co_file = fp;
 935         hash_clnt_odstate_locked(new);
 936 out:
 937         spin_unlock(&fp->fi_lock);
 938         return co;
 939 }
 940
 941 struct nfs4_stid *nfs4_alloc_stid(struct nfs4_client *cl, struct kmem_cache *slab,
 942                                   void (*sc_free)(struct nfs4_stid *))
 943 {
 944         struct nfs4_stid *stid;
 945         int new_id;
 946
 947         stid = kmem_cache_zalloc(slab, GFP_KERNEL);
 948         if (!stid)
 949                 return NULL;
 950
 951         idr_preload(GFP_KERNEL);
 952         spin_lock(&cl->cl_lock);
 953         /* Reserving 0 for start of file in nfsdfs "states" file: */
 954         new_id = idr_alloc_cyclic(&cl->cl_stateids, stid, 1, 0, GFP_NOWAIT);
 955         spin_unlock(&cl->cl_lock);
 956         idr_preload_end();
 957         if (new_id < 0)
 958                 goto out_free;
 959
 960         stid->sc_free = sc_free;
 961         stid->sc_client = cl;
 962         stid->sc_stateid.si_opaque.so_id = new_id;
 963         stid->sc_stateid.si_opaque.so_clid = cl->cl_clientid;
 964         /* Will be incremented before return to client: */
 965         refcount_set(&stid->sc_count, 1);
 966         spin_lock_init(&stid->sc_lock);
 967         INIT_LIST_HEAD(&stid->sc_cp_list);
 968
 969         /*
 970          * It shouldn't be a problem to reuse an opaque stateid value.
 971          * I don't think it is for 4.1.  But with 4.0 I worry that, for
 972          * example, a stray write retransmission could be accepted by
 973          * the server when it should have been rejected.  Therefore,
 974          * adopt a trick from the sctp code to attempt to maximize the
 975          * amount of time until an id is reused, by ensuring they always
 976          * "increase" (mod INT_MAX):
 977          */
 978         return stid;
 979 out_free:
 980         kmem_cache_free(slab, stid);
 981         return NULL;
 982 }
 983
 984 /*
 985  * Create a unique stateid_t to represent each COPY.
 986  */
 987 static int nfs4_init_cp_state(struct nfsd_net *nn, copy_stateid_t *stid,
 988                               unsigned char cs_type)
 989 {
 990         int new_id;
 991
 992         stid->cs_stid.si_opaque.so_clid.cl_boot = (u32)nn->boot_time;
 993         stid->cs_stid.si_opaque.so_clid.cl_id = nn->s2s_cp_cl_id;
 994         stid->cs_type = cs_type;
 995
 996         idr_preload(GFP_KERNEL);
 997         spin_lock(&nn->s2s_cp_lock);
 998         new_id = idr_alloc_cyclic(&nn->s2s_cp_stateids, stid, 0, 0, GFP_NOWAIT);
 999         stid->cs_stid.si_opaque.so_id = new_id;
1000         stid->cs_stid.si_generation = 1;
1001         spin_unlock(&nn->s2s_cp_lock);
1002         idr_preload_end();
1003         if (new_id < 0)
1004                 return 0;
1005         return 1;
1006 }
1007
1008 int nfs4_init_copy_state(struct nfsd_net *nn, struct nfsd4_copy *copy)
1009 {
1010         return nfs4_init_cp_state(nn, &copy->cp_stateid, NFS4_COPY_STID);
1011 }
1012
1013 struct nfs4_cpntf_state *nfs4_alloc_init_cpntf_state(struct nfsd_net *nn,
1014                                                      struct nfs4_stid *p_stid)
1015 {
1016         struct nfs4_cpntf_state *cps;
1017
1018         cps = kzalloc(sizeof(struct nfs4_cpntf_state), GFP_KERNEL);
1019         if (!cps)
1020                 return NULL;
1021         cps->cpntf_time = ktime_get_boottime_seconds();
1022         refcount_set(&cps->cp_stateid.cs_count, 1);
1023         if (!nfs4_init_cp_state(nn, &cps->cp_stateid, NFS4_COPYNOTIFY_STID))
1024                 goto out_free;
1025         spin_lock(&nn->s2s_cp_lock);
1026         list_add(&cps->cp_list, &p_stid->sc_cp_list);
1027         spin_unlock(&nn->s2s_cp_lock);
1028         return cps;
1029 out_free:
1030         kfree(cps);
1031         return NULL;
1032 }
1033
1034 void nfs4_free_copy_state(struct nfsd4_copy *copy)
1035 {
1036         struct nfsd_net *nn;
1037
1038         WARN_ON_ONCE(copy->cp_stateid.cs_type != NFS4_COPY_STID);
1039         nn = net_generic(copy->cp_clp->net, nfsd_net_id);
1040         spin_lock(&nn->s2s_cp_lock);
1041         idr_remove(&nn->s2s_cp_stateids,
1042                    copy->cp_stateid.cs_stid.si_opaque.so_id);
1043         spin_unlock(&nn->s2s_cp_lock);
1044 }
1045
1046 static void nfs4_free_cpntf_statelist(struct net *net, struct nfs4_stid *stid)
1047 {
1048         struct nfs4_cpntf_state *cps;
1049         struct nfsd_net *nn;
1050
1051         nn = net_generic(net, nfsd_net_id);
1052         spin_lock(&nn->s2s_cp_lock);
1053         while (!list_empty(&stid->sc_cp_list)) {
1054                 cps = list_first_entry(&stid->sc_cp_list,
1055                                        struct nfs4_cpntf_state, cp_list);
1056                 _free_cpntf_state_locked(nn, cps);
1057         }
1058         spin_unlock(&nn->s2s_cp_lock);
1059 }
1060
1061 static struct nfs4_ol_stateid * nfs4_alloc_open_stateid(struct nfs4_client *clp)
1062 {
1063         struct nfs4_stid *stid;
1064
1065         stid = nfs4_alloc_stid(clp, stateid_slab, nfs4_free_ol_stateid);
1066         if (!stid)
1067                 return NULL;
1068
1069         return openlockstateid(stid);
1070 }
1071
1072 static void nfs4_free_deleg(struct nfs4_stid *stid)
1073 {
1074         struct nfs4_delegation *dp = delegstateid(stid);
1075
1076         WARN_ON_ONCE(!list_empty(&stid->sc_cp_list));
1077         WARN_ON_ONCE(!list_empty(&dp->dl_perfile));
1078         WARN_ON_ONCE(!list_empty(&dp->dl_perclnt));
1079         WARN_ON_ONCE(!list_empty(&dp->dl_recall_lru));
1080         kmem_cache_free(deleg_slab, stid);
1081         atomic_long_dec(&num_delegations);
1082 }
1083
1084 /*
1085  * When we recall a delegation, we should be careful not to hand it
1086  * out again straight away.
1087  * To ensure this we keep a pair of bloom filters ('new' and 'old')
1088  * in which the filehandles of recalled delegations are "stored".
1089  * If a filehandle appear in either filter, a delegation is blocked.
1090  * When a delegation is recalled, the filehandle is stored in the "new"
1091  * filter.
1092  * Every 30 seconds we swap the filters and clear the "new" one,
1093  * unless both are empty of course.
1094  *
1095  * Each filter is 256 bits.  We hash the filehandle to 32bit and use the
1096  * low 3 bytes as hash-table indices.
1097  *
1098  * 'blocked_delegations_lock', which is always taken in block_delegations(),
1099  * is used to manage concurrent access.  Testing does not need the lock
1100  * except when swapping the two filters.
1101  */
1102 static DEFINE_SPINLOCK(blocked_delegations_lock);
1103 static struct bloom_pair {
1104         int     entries, old_entries;
1105         time64_t swap_time;
1106         int     new; /* index into 'set' */
1107         DECLARE_BITMAP(set[2], 256);
1108 } blocked_delegations;
1109
1110 static int delegation_blocked(struct knfsd_fh *fh)
1111 {
1112         u32 hash;
1113         struct bloom_pair *bd = &blocked_delegations;
1114
1115         if (bd->entries == 0)
1116                 return 0;
1117         if (ktime_get_seconds() - bd->swap_time > 30) {
1118                 spin_lock(&blocked_delegations_lock);
1119                 if (ktime_get_seconds() - bd->swap_time > 30) {
1120                         bd->entries -= bd->old_entries;
1121                         bd->old_entries = bd->entries;
1122                         memset(bd->set[bd->new], 0,
1123                                sizeof(bd->set[0]));
1124                         bd->new = 1-bd->new;
1125                         bd->swap_time = ktime_get_seconds();
1126                 }
1127                 spin_unlock(&blocked_delegations_lock);
1128         }
1129         hash = jhash(&fh->fh_raw, fh->fh_size, 0);
1130         if (test_bit(hash&255, bd->set[0]) &&
1131             test_bit((hash>>8)&255, bd->set[0]) &&
1132             test_bit((hash>>16)&255, bd->set[0]))
1133                 return 1;
1134
1135         if (test_bit(hash&255, bd->set[1]) &&
1136             test_bit((hash>>8)&255, bd->set[1]) &&
1137             test_bit((hash>>16)&255, bd->set[1]))
1138                 return 1;
1139
1140         return 0;
1141 }
1142
1143 static void block_delegations(struct knfsd_fh *fh)
1144 {
1145         u32 hash;
1146         struct bloom_pair *bd = &blocked_delegations;
1147
1148         hash = jhash(&fh->fh_raw, fh->fh_size, 0);
1149
1150         spin_lock(&blocked_delegations_lock);
1151         __set_bit(hash&255, bd->set[bd->new]);
1152         __set_bit((hash>>8)&255, bd->set[bd->new]);
1153         __set_bit((hash>>16)&255, bd->set[bd->new]);
1154         if (bd->entries == 0)
1155                 bd->swap_time = ktime_get_seconds();
1156         bd->entries += 1;
1157         spin_unlock(&blocked_delegations_lock);
1158 }
1159
1160 static struct nfs4_delegation *
1161 alloc_init_deleg(struct nfs4_client *clp, struct nfs4_file *fp,
1162                  struct nfs4_clnt_odstate *odstate)
1163 {
1164         struct nfs4_delegation *dp;
1165         long n;
1166
1167         dprintk("NFSD alloc_init_deleg\n");
1168         n = atomic_long_inc_return(&num_delegations);
1169         if (n < 0 || n > max_delegations)
1170                 goto out_dec;
1171         if (delegation_blocked(&fp->fi_fhandle))
1172                 goto out_dec;
1173         dp = delegstateid(nfs4_alloc_stid(clp, deleg_slab, nfs4_free_deleg));
1174         if (dp == NULL)
1175                 goto out_dec;
1176
1177         /*
1178          * delegation seqid's are never incremented.  The 4.1 special
1179          * meaning of seqid 0 isn't meaningful, really, but let's avoid
1180          * 0 anyway just for consistency and use 1:
1181          */
1182         dp->dl_stid.sc_stateid.si_generation = 1;
1183         INIT_LIST_HEAD(&dp->dl_perfile);
1184         INIT_LIST_HEAD(&dp->dl_perclnt);
1185         INIT_LIST_HEAD(&dp->dl_recall_lru);
1186         dp->dl_clnt_odstate = odstate;
1187         get_clnt_odstate(odstate);
1188         dp->dl_type = NFS4_OPEN_DELEGATE_READ;
1189         dp->dl_retries = 1;
1190         dp->dl_recalled = false;
1191         nfsd4_init_cb(&dp->dl_recall, dp->dl_stid.sc_client,
1192                       &nfsd4_cb_recall_ops, NFSPROC4_CLNT_CB_RECALL);
1193         get_nfs4_file(fp);
1194         dp->dl_stid.sc_file = fp;
1195         return dp;
1196 out_dec:
1197         atomic_long_dec(&num_delegations);
1198         return NULL;
1199 }
1200
1201 void
1202 nfs4_put_stid(struct nfs4_stid *s)
1203 {
1204         struct nfs4_file *fp = s->sc_file;
1205         struct nfs4_client *clp = s->sc_client;
1206
1207         might_lock(&clp->cl_lock);
1208
1209         if (!refcount_dec_and_lock(&s->sc_count, &clp->cl_lock)) {
1210                 wake_up_all(&close_wq);
1211                 return;
1212         }
1213         idr_remove(&clp->cl_stateids, s->sc_stateid.si_opaque.so_id);
1214         nfs4_free_cpntf_statelist(clp->net, s);
1215         spin_unlock(&clp->cl_lock);
1216         s->sc_free(s);
1217         if (fp)
1218                 put_nfs4_file(fp);
1219 }
1220
1221 void
1222 nfs4_inc_and_copy_stateid(stateid_t *dst, struct nfs4_stid *stid)
1223 {
1224         stateid_t *src = &stid->sc_stateid;
1225
1226         spin_lock(&stid->sc_lock);
1227         if (unlikely(++src->si_generation == 0))
1228                 src->si_generation = 1;
1229         memcpy(dst, src, sizeof(*dst));
1230         spin_unlock(&stid->sc_lock);
1231 }
1232
1233 static void put_deleg_file(struct nfs4_file *fp)
1234 {
1235         struct nfsd_file *nf = NULL;
1236
1237         spin_lock(&fp->fi_lock);
1238         if (--fp->fi_delegees == 0)
1239                 swap(nf, fp->fi_deleg_file);
1240         spin_unlock(&fp->fi_lock);
1241
1242         if (nf)
1243                 nfsd_file_put(nf);
1244 }
1245
1246 static void nfs4_unlock_deleg_lease(struct nfs4_delegation *dp)
1247 {
1248         struct nfs4_file *fp = dp->dl_stid.sc_file;
1249         struct nfsd_file *nf = fp->fi_deleg_file;
1250
1251         WARN_ON_ONCE(!fp->fi_delegees);
1252
1253         vfs_setlease(nf->nf_file, F_UNLCK, NULL, (void **)&dp);
1254         put_deleg_file(fp);
1255 }
1256
1257 static void destroy_unhashed_deleg(struct nfs4_delegation *dp)
1258 {
1259         put_clnt_odstate(dp->dl_clnt_odstate);
1260         nfs4_unlock_deleg_lease(dp);
1261         nfs4_put_stid(&dp->dl_stid);
1262 }
1263
1264 void nfs4_unhash_stid(struct nfs4_stid *s)
1265 {
1266         s->sc_type = 0;
1267 }
1268
1269 /**
1270  * nfs4_delegation_exists - Discover if this delegation already exists
1271  * @clp:     a pointer to the nfs4_client we're granting a delegation to
1272  * @fp:      a pointer to the nfs4_file we're granting a delegation on
1273  *
1274  * Return:
1275  *      On success: true iff an existing delegation is found
1276  */
1277
1278 static bool
1279 nfs4_delegation_exists(struct nfs4_client *clp, struct nfs4_file *fp)
1280 {
1281         struct nfs4_delegation *searchdp = NULL;
1282         struct nfs4_client *searchclp = NULL;
1283
1284         lockdep_assert_held(&state_lock);
1285         lockdep_assert_held(&fp->fi_lock);
1286
1287         list_for_each_entry(searchdp, &fp->fi_delegations, dl_perfile) {
1288                 searchclp = searchdp->dl_stid.sc_client;
1289                 if (clp == searchclp) {
1290                         return true;
1291                 }
1292         }
1293         return false;
1294 }
1295
1296 /**
1297  * hash_delegation_locked - Add a delegation to the appropriate lists
1298  * @dp:     a pointer to the nfs4_delegation we are adding.
1299  * @fp:     a pointer to the nfs4_file we're granting a delegation on
1300  *
1301  * Return:
1302  *      On success: NULL if the delegation was successfully hashed.
1303  *
1304  *      On error: -EAGAIN if one was previously granted to this
1305  *                 nfs4_client for this nfs4_file. Delegation is not hashed.
1306  *
1307  */
1308
1309 static int
1310 hash_delegation_locked(struct nfs4_delegation *dp, struct nfs4_file *fp)
1311 {
1312         struct nfs4_client *clp = dp->dl_stid.sc_client;
1313
1314         lockdep_assert_held(&state_lock);
1315         lockdep_assert_held(&fp->fi_lock);
1316
1317         if (nfs4_delegation_exists(clp, fp))
1318                 return -EAGAIN;
1319         refcount_inc(&dp->dl_stid.sc_count);
1320         dp->dl_stid.sc_type = NFS4_DELEG_STID;
1321         list_add(&dp->dl_perfile, &fp->fi_delegations);
1322         list_add(&dp->dl_perclnt, &clp->cl_delegations);
1323         return 0;
1324 }
1325
1326 static bool delegation_hashed(struct nfs4_delegation *dp)
1327 {
1328         return !(list_empty(&dp->dl_perfile));
1329 }
1330
1331 static bool
1332 unhash_delegation_locked(struct nfs4_delegation *dp)
1333 {
1334         struct nfs4_file *fp = dp->dl_stid.sc_file;
1335
1336         lockdep_assert_held(&state_lock);
1337
1338         if (!delegation_hashed(dp))
1339                 return false;
1340
1341         dp->dl_stid.sc_type = NFS4_CLOSED_DELEG_STID;
1342         /* Ensure that deleg break won't try to requeue it */
1343         ++dp->dl_time;
1344         spin_lock(&fp->fi_lock);
1345         list_del_init(&dp->dl_perclnt);
1346         list_del_init(&dp->dl_recall_lru);
1347         list_del_init(&dp->dl_perfile);
1348         spin_unlock(&fp->fi_lock);
1349         return true;
1350 }
1351
1352 static void destroy_delegation(struct nfs4_delegation *dp)
1353 {
1354         bool unhashed;
1355
1356         spin_lock(&state_lock);
1357         unhashed = unhash_delegation_locked(dp);
1358         spin_unlock(&state_lock);
1359         if (unhashed)
1360                 destroy_unhashed_deleg(dp);
1361 }
1362
1363 static void revoke_delegation(struct nfs4_delegation *dp)
1364 {
1365         struct nfs4_client *clp = dp->dl_stid.sc_client;
1366
1367         WARN_ON(!list_empty(&dp->dl_recall_lru));
1368
1369         if (clp->cl_minorversion) {
1370                 dp->dl_stid.sc_type = NFS4_REVOKED_DELEG_STID;
1371                 refcount_inc(&dp->dl_stid.sc_count);
1372                 spin_lock(&clp->cl_lock);
1373                 list_add(&dp->dl_recall_lru, &clp->cl_revoked);
1374                 spin_unlock(&clp->cl_lock);
1375         }
1376         destroy_unhashed_deleg(dp);
1377 }
1378
1379 /*
1380  * SETCLIENTID state
1381  */
1382
1383 static unsigned int clientid_hashval(u32 id)
1384 {
1385         return id & CLIENT_HASH_MASK;
1386 }
1387
1388 static unsigned int clientstr_hashval(struct xdr_netobj name)
1389 {
1390         return opaque_hashval(name.data, 8) & CLIENT_HASH_MASK;
1391 }
1392
1393 /*
1394  * A stateid that had a deny mode associated with it is being released
1395  * or downgraded. Recalculate the deny mode on the file.
1396  */
1397 static void
1398 recalculate_deny_mode(struct nfs4_file *fp)
1399 {
1400         struct nfs4_ol_stateid *stp;
1401
1402         spin_lock(&fp->fi_lock);
1403         fp->fi_share_deny = 0;
1404         list_for_each_entry(stp, &fp->fi_stateids, st_perfile)
1405                 fp->fi_share_deny |= bmap_to_share_mode(stp->st_deny_bmap);
1406         spin_unlock(&fp->fi_lock);
1407 }
1408
1409 static void
1410 reset_union_bmap_deny(u32 deny, struct nfs4_ol_stateid *stp)
1411 {
1412         int i;
1413         bool change = false;
1414
1415         for (i = 1; i < 4; i++) {
1416                 if ((i & deny) != i) {
1417                         change = true;
1418                         clear_deny(i, stp);
1419                 }
1420         }
1421
1422         /* Recalculate per-file deny mode if there was a change */
1423         if (change)
1424                 recalculate_deny_mode(stp->st_stid.sc_file);
1425 }
1426
1427 /* release all access and file references for a given stateid */
1428 static void
1429 release_all_access(struct nfs4_ol_stateid *stp)
1430 {
1431         int i;
1432         struct nfs4_file *fp = stp->st_stid.sc_file;
1433
1434         if (fp && stp->st_deny_bmap != 0)
1435                 recalculate_deny_mode(fp);
1436
1437         for (i = 1; i < 4; i++) {
1438                 if (test_access(i, stp))
1439                         nfs4_file_put_access(stp->st_stid.sc_file, i);
1440                 clear_access(i, stp);
1441         }
1442 }
1443
1444 static inline void nfs4_free_stateowner(struct nfs4_stateowner *sop)
1445 {
1446         kfree(sop->so_owner.data);
1447         sop->so_ops->so_free(sop);
1448 }
1449
1450 static void nfs4_put_stateowner(struct nfs4_stateowner *sop)
1451 {
1452         struct nfs4_client *clp = sop->so_client;
1453
1454         might_lock(&clp->cl_lock);
1455
1456         if (!atomic_dec_and_lock(&sop->so_count, &clp->cl_lock))
1457                 return;
1458         sop->so_ops->so_unhash(sop);
1459         spin_unlock(&clp->cl_lock);
1460         nfs4_free_stateowner(sop);
1461 }
1462
1463 static bool
1464 nfs4_ol_stateid_unhashed(const struct nfs4_ol_stateid *stp)
1465 {
1466         return list_empty(&stp->st_perfile);
1467 }
1468
1469 static bool unhash_ol_stateid(struct nfs4_ol_stateid *stp)
1470 {
1471         struct nfs4_file *fp = stp->st_stid.sc_file;
1472
1473         lockdep_assert_held(&stp->st_stateowner->so_client->cl_lock);
1474
1475         if (list_empty(&stp->st_perfile))
1476                 return false;
1477
1478         spin_lock(&fp->fi_lock);
1479         list_del_init(&stp->st_perfile);
1480         spin_unlock(&fp->fi_lock);
1481         list_del(&stp->st_perstateowner);
1482         return true;
1483 }
1484
1485 static void nfs4_free_ol_stateid(struct nfs4_stid *stid)
1486 {
1487         struct nfs4_ol_stateid *stp = openlockstateid(stid);
1488
1489         put_clnt_odstate(stp->st_clnt_odstate);
1490         release_all_access(stp);
1491         if (stp->st_stateowner)
1492                 nfs4_put_stateowner(stp->st_stateowner);
1493         WARN_ON(!list_empty(&stid->sc_cp_list));
1494         kmem_cache_free(stateid_slab, stid);
1495 }
1496
1497 static void nfs4_free_lock_stateid(struct nfs4_stid *stid)
1498 {
1499         struct nfs4_ol_stateid *stp = openlockstateid(stid);
1500         struct nfs4_lockowner *lo = lockowner(stp->st_stateowner);
1501         struct nfsd_file *nf;
1502
1503         nf = find_any_file(stp->st_stid.sc_file);
1504         if (nf) {
1505                 get_file(nf->nf_file);
1506                 filp_close(nf->nf_file, (fl_owner_t)lo);
1507                 nfsd_file_put(nf);
1508         }
1509         nfs4_free_ol_stateid(stid);
1510 }
1511
1512 /*
1513  * Put the persistent reference to an already unhashed generic stateid, while
1514  * holding the cl_lock. If it's the last reference, then put it onto the
1515  * reaplist for later destruction.
1516  */
1517 static void put_ol_stateid_locked(struct nfs4_ol_stateid *stp,
1518                                        struct list_head *reaplist)
1519 {
1520         struct nfs4_stid *s = &stp->st_stid;
1521         struct nfs4_client *clp = s->sc_client;
1522
1523         lockdep_assert_held(&clp->cl_lock);
1524
1525         WARN_ON_ONCE(!list_empty(&stp->st_locks));
1526
1527         if (!refcount_dec_and_test(&s->sc_count)) {
1528                 wake_up_all(&close_wq);
1529                 return;
1530         }
1531
1532         idr_remove(&clp->cl_stateids, s->sc_stateid.si_opaque.so_id);
1533         list_add(&stp->st_locks, reaplist);
1534 }
1535
1536 static bool unhash_lock_stateid(struct nfs4_ol_stateid *stp)
1537 {
1538         lockdep_assert_held(&stp->st_stid.sc_client->cl_lock);
1539
1540         if (!unhash_ol_stateid(stp))
1541                 return false;
1542         list_del_init(&stp->st_locks);
1543         nfs4_unhash_stid(&stp->st_stid);
1544         return true;
1545 }
1546
1547 static void release_lock_stateid(struct nfs4_ol_stateid *stp)
1548 {
1549         struct nfs4_client *clp = stp->st_stid.sc_client;
1550         bool unhashed;
1551
1552         spin_lock(&clp->cl_lock);
1553         unhashed = unhash_lock_stateid(stp);
1554         spin_unlock(&clp->cl_lock);
1555         if (unhashed)
1556                 nfs4_put_stid(&stp->st_stid);
1557 }
1558
1559 static void unhash_lockowner_locked(struct nfs4_lockowner *lo)
1560 {
1561         struct nfs4_client *clp = lo->lo_owner.so_client;
1562
1563         lockdep_assert_held(&clp->cl_lock);
1564
1565         list_del_init(&lo->lo_owner.so_strhash);
1566 }
1567
1568 /*
1569  * Free a list of generic stateids that were collected earlier after being
1570  * fully unhashed.
1571  */
1572 static void
1573 free_ol_stateid_reaplist(struct list_head *reaplist)
1574 {
1575         struct nfs4_ol_stateid *stp;
1576         struct nfs4_file *fp;
1577
1578         might_sleep();
1579
1580         while (!list_empty(reaplist)) {
1581                 stp = list_first_entry(reaplist, struct nfs4_ol_stateid,
1582                                        st_locks);
1583                 list_del(&stp->st_locks);
1584                 fp = stp->st_stid.sc_file;
1585                 stp->st_stid.sc_free(&stp->st_stid);
1586                 if (fp)
1587                         put_nfs4_file(fp);
1588         }
1589 }
1590
1591 static void release_open_stateid_locks(struct nfs4_ol_stateid *open_stp,
1592                                        struct list_head *reaplist)
1593 {
1594         struct nfs4_ol_stateid *stp;
1595
1596         lockdep_assert_held(&open_stp->st_stid.sc_client->cl_lock);
1597
1598         while (!list_empty(&open_stp->st_locks)) {
1599                 stp = list_entry(open_stp->st_locks.next,
1600                                 struct nfs4_ol_stateid, st_locks);
1601                 WARN_ON(!unhash_lock_stateid(stp));
1602                 put_ol_stateid_locked(stp, reaplist);
1603         }
1604 }
1605
1606 static bool unhash_open_stateid(struct nfs4_ol_stateid *stp,
1607                                 struct list_head *reaplist)
1608 {
1609         lockdep_assert_held(&stp->st_stid.sc_client->cl_lock);
1610
1611         if (!unhash_ol_stateid(stp))
1612                 return false;
1613         release_open_stateid_locks(stp, reaplist);
1614         return true;
1615 }
1616
1617 static void release_open_stateid(struct nfs4_ol_stateid *stp)
1618 {
1619         LIST_HEAD(reaplist);
1620
1621         spin_lock(&stp->st_stid.sc_client->cl_lock);
1622         if (unhash_open_stateid(stp, &reaplist))
1623                 put_ol_stateid_locked(stp, &reaplist);
1624         spin_unlock(&stp->st_stid.sc_client->cl_lock);
1625         free_ol_stateid_reaplist(&reaplist);
1626 }
1627
1628 static void unhash_openowner_locked(struct nfs4_openowner *oo)
1629 {
1630         struct nfs4_client *clp = oo->oo_owner.so_client;
1631
1632         lockdep_assert_held(&clp->cl_lock);
1633
1634         list_del_init(&oo->oo_owner.so_strhash);
1635         list_del_init(&oo->oo_perclient);
1636 }
1637
1638 static void release_last_closed_stateid(struct nfs4_openowner *oo)
1639 {
1640         struct nfsd_net *nn = net_generic(oo->oo_owner.so_client->net,
1641                                           nfsd_net_id);
1642         struct nfs4_ol_stateid *s;
1643
1644         spin_lock(&nn->client_lock);
1645         s = oo->oo_last_closed_stid;
1646         if (s) {
1647                 list_del_init(&oo->oo_close_lru);
1648                 oo->oo_last_closed_stid = NULL;
1649         }
1650         spin_unlock(&nn->client_lock);
1651         if (s)
1652                 nfs4_put_stid(&s->st_stid);
1653 }
1654
1655 static void release_openowner(struct nfs4_openowner *oo)
1656 {
1657         struct nfs4_ol_stateid *stp;
1658         struct nfs4_client *clp = oo->oo_owner.so_client;
1659         struct list_head reaplist;
1660
1661         INIT_LIST_HEAD(&reaplist);
1662
1663         spin_lock(&clp->cl_lock);
1664         unhash_openowner_locked(oo);
1665         while (!list_empty(&oo->oo_owner.so_stateids)) {
1666                 stp = list_first_entry(&oo->oo_owner.so_stateids,
1667                                 struct nfs4_ol_stateid, st_perstateowner);
1668                 if (unhash_open_stateid(stp, &reaplist))
1669                         put_ol_stateid_locked(stp, &reaplist);
1670         }
1671         spin_unlock(&clp->cl_lock);
1672         free_ol_stateid_reaplist(&reaplist);
1673         release_last_closed_stateid(oo);
1674         nfs4_put_stateowner(&oo->oo_owner);
1675 }
1676
1677 static inline int
1678 hash_sessionid(struct nfs4_sessionid *sessionid)
1679 {
1680         struct nfsd4_sessionid *sid = (struct nfsd4_sessionid *)sessionid;
1681
1682         return sid->sequence % SESSION_HASH_SIZE;
1683 }
1684
1685 #ifdef CONFIG_SUNRPC_DEBUG
1686 static inline void
1687 dump_sessionid(const char *fn, struct nfs4_sessionid *sessionid)
1688 {
1689         u32 *ptr = (u32 *)(&sessionid->data[0]);
1690         dprintk("%s: %u:%u:%u:%u\n", fn, ptr[0], ptr[1], ptr[2], ptr[3]);
1691 }
1692 #else
1693 static inline void
1694 dump_sessionid(const char *fn, struct nfs4_sessionid *sessionid)
1695 {
1696 }
1697 #endif
1698
1699 /*
1700  * Bump the seqid on cstate->replay_owner, and clear replay_owner if it
1701  * won't be used for replay.
1702  */
1703 void nfsd4_bump_seqid(struct nfsd4_compound_state *cstate, __be32 nfserr)
1704 {
1705         struct nfs4_stateowner *so = cstate->replay_owner;
1706
1707         if (nfserr == nfserr_replay_me)
1708                 return;
1709
1710         if (!seqid_mutating_err(ntohl(nfserr))) {
1711                 nfsd4_cstate_clear_replay(cstate);
1712                 return;
1713         }
1714         if (!so)
1715                 return;
1716         if (so->so_is_open_owner)
1717                 release_last_closed_stateid(openowner(so));
1718         so->so_seqid++;
1719         return;
1720 }
1721
1722 static void
1723 gen_sessionid(struct nfsd4_session *ses)
1724 {
1725         struct nfs4_client *clp = ses->se_client;
1726         struct nfsd4_sessionid *sid;
1727
1728         sid = (struct nfsd4_sessionid *)ses->se_sessionid.data;
1729         sid->clientid = clp->cl_clientid;
1730         sid->sequence = current_sessionid++;
1731         sid->reserved = 0;
1732 }
1733
1734 /*
1735  * The protocol defines ca_maxresponssize_cached to include the size of
1736  * the rpc header, but all we need to cache is the data starting after
1737  * the end of the initial SEQUENCE operation--the rest we regenerate
1738  * each time.  Therefore we can advertise a ca_maxresponssize_cached
1739  * value that is the number of bytes in our cache plus a few additional
1740  * bytes.  In order to stay on the safe side, and not promise more than
1741  * we can cache, those additional bytes must be the minimum possible: 24
1742  * bytes of rpc header (xid through accept state, with AUTH_NULL
1743  * verifier), 12 for the compound header (with zero-length tag), and 44
1744  * for the SEQUENCE op response:
1745  */
1746 #define NFSD_MIN_HDR_SEQ_SZ  (24 + 12 + 44)
1747
1748 static void
1749 free_session_slots(struct nfsd4_session *ses)
1750 {
1751         int i;
1752
1753         for (i = 0; i < ses->se_fchannel.maxreqs; i++) {
1754                 free_svc_cred(&ses->se_slots[i]->sl_cred);
1755                 kfree(ses->se_slots[i]);
1756         }
1757 }
1758
1759 /*
1760  * We don't actually need to cache the rpc and session headers, so we
1761  * can allocate a little less for each slot:
1762  */
1763 static inline u32 slot_bytes(struct nfsd4_channel_attrs *ca)
1764 {
1765         u32 size;
1766
1767         if (ca->maxresp_cached < NFSD_MIN_HDR_SEQ_SZ)
1768                 size = 0;
1769         else
1770                 size = ca->maxresp_cached - NFSD_MIN_HDR_SEQ_SZ;
1771         return size + sizeof(struct nfsd4_slot);
1772 }
1773
1774 /*
1775  * XXX: If we run out of reserved DRC memory we could (up to a point)
1776  * re-negotiate active sessions and reduce their slot usage to make
1777  * room for new connections. For now we just fail the create session.
1778  */
1779 static u32 nfsd4_get_drc_mem(struct nfsd4_channel_attrs *ca, struct nfsd_net *nn)
1780 {
1781         u32 slotsize = slot_bytes(ca);
1782         u32 num = ca->maxreqs;
1783         unsigned long avail, total_avail;
1784         unsigned int scale_factor;
1785
1786         spin_lock(&nfsd_drc_lock);
1787         if (nfsd_drc_max_mem > nfsd_drc_mem_used)
1788                 total_avail = nfsd_drc_max_mem - nfsd_drc_mem_used;
1789         else
1790                 /* We have handed out more space than we chose in
1791                  * set_max_drc() to allow.  That isn't really a
1792                  * problem as long as that doesn't make us think we
1793                  * have lots more due to integer overflow.
1794                  */
1795                 total_avail = 0;
1796         avail = min((unsigned long)NFSD_MAX_MEM_PER_SESSION, total_avail);
1797         /*
1798          * Never use more than a fraction of the remaining memory,
1799          * unless it's the only way to give this client a slot.
1800          * The chosen fraction is either 1/8 or 1/number of threads,
1801          * whichever is smaller.  This ensures there are adequate
1802          * slots to support multiple clients per thread.
1803          * Give the client one slot even if that would require
1804          * over-allocation--it is better than failure.
1805          */
1806         scale_factor = max_t(unsigned int, 8, nn->nfsd_serv->sv_nrthreads);
1807
1808         avail = clamp_t(unsigned long, avail, slotsize,
1809                         total_avail/scale_factor);
1810         num = min_t(int, num, avail / slotsize);
1811         num = max_t(int, num, 1);
1812         nfsd_drc_mem_used += num * slotsize;
1813         spin_unlock(&nfsd_drc_lock);
1814
1815         return num;
1816 }
1817
1818 static void nfsd4_put_drc_mem(struct nfsd4_channel_attrs *ca)
1819 {
1820         int slotsize = slot_bytes(ca);
1821
1822         spin_lock(&nfsd_drc_lock);
1823         nfsd_drc_mem_used -= slotsize * ca->maxreqs;
1824         spin_unlock(&nfsd_drc_lock);
1825 }
1826
1827 static struct nfsd4_session *alloc_session(struct nfsd4_channel_attrs *fattrs,
1828                                            struct nfsd4_channel_attrs *battrs)
1829 {
1830         int numslots = fattrs->maxreqs;
1831         int slotsize = slot_bytes(fattrs);
1832         struct nfsd4_session *new;
1833         int mem, i;
1834
1835         BUILD_BUG_ON(NFSD_MAX_SLOTS_PER_SESSION * sizeof(struct nfsd4_slot *)
1836                         + sizeof(struct nfsd4_session) > PAGE_SIZE);
1837         mem = numslots * sizeof(struct nfsd4_slot *);
1838
1839         new = kzalloc(sizeof(*new) + mem, GFP_KERNEL);
1840         if (!new)
1841                 return NULL;
1842         /* allocate each struct nfsd4_slot and data cache in one piece */
1843         for (i = 0; i < numslots; i++) {
1844                 new->se_slots[i] = kzalloc(slotsize, GFP_KERNEL);
1845                 if (!new->se_slots[i])
1846                         goto out_free;
1847         }
1848
1849         memcpy(&new->se_fchannel, fattrs, sizeof(struct nfsd4_channel_attrs));
1850         memcpy(&new->se_bchannel, battrs, sizeof(struct nfsd4_channel_attrs));
1851
1852         return new;
1853 out_free:
1854         while (i--)
1855                 kfree(new->se_slots[i]);
1856         kfree(new);
1857         return NULL;
1858 }
1859
1860 static void free_conn(struct nfsd4_conn *c)
1861 {
1862         svc_xprt_put(c->cn_xprt);
1863         kfree(c);
1864 }
1865
1866 static void nfsd4_conn_lost(struct svc_xpt_user *u)
1867 {
1868         struct nfsd4_conn *c = container_of(u, struct nfsd4_conn, cn_xpt_user);
1869         struct nfs4_client *clp = c->cn_session->se_client;
1870
1871         trace_nfsd_cb_lost(clp);
1872
1873         spin_lock(&clp->cl_lock);
1874         if (!list_empty(&c->cn_persession)) {
1875                 list_del(&c->cn_persession);
1876                 free_conn(c);
1877         }
1878         nfsd4_probe_callback(clp);
1879         spin_unlock(&clp->cl_lock);
1880 }
1881
1882 static struct nfsd4_conn *alloc_conn(struct svc_rqst *rqstp, u32 flags)
1883 {
1884         struct nfsd4_conn *conn;
1885
1886         conn = kmalloc(sizeof(struct nfsd4_conn), GFP_KERNEL);
1887         if (!conn)
1888                 return NULL;
1889         svc_xprt_get(rqstp->rq_xprt);
1890         conn->cn_xprt = rqstp->rq_xprt;
1891         conn->cn_flags = flags;
1892         INIT_LIST_HEAD(&conn->cn_xpt_user.list);
1893         return conn;
1894 }
1895
1896 static void __nfsd4_hash_conn(struct nfsd4_conn *conn, struct nfsd4_session *ses)
1897 {
1898         conn->cn_session = ses;
1899         list_add(&conn->cn_persession, &ses->se_conns);
1900 }
1901
1902 static void nfsd4_hash_conn(struct nfsd4_conn *conn, struct nfsd4_session *ses)
1903 {
1904         struct nfs4_client *clp = ses->se_client;
1905
1906         spin_lock(&clp->cl_lock);
1907         __nfsd4_hash_conn(conn, ses);
1908         spin_unlock(&clp->cl_lock);
1909 }
1910
1911 static int nfsd4_register_conn(struct nfsd4_conn *conn)
1912 {
1913         conn->cn_xpt_user.callback = nfsd4_conn_lost;
1914         return register_xpt_user(conn->cn_xprt, &conn->cn_xpt_user);
1915 }
1916
1917 static void nfsd4_init_conn(struct svc_rqst *rqstp, struct nfsd4_conn *conn, struct nfsd4_session *ses)
1918 {
1919         int ret;
1920
1921         nfsd4_hash_conn(conn, ses);
1922         ret = nfsd4_register_conn(conn);
1923         if (ret)
1924                 /* oops; xprt is already down: */
1925                 nfsd4_conn_lost(&conn->cn_xpt_user);
1926         /* We may have gained or lost a callback channel: */
1927         nfsd4_probe_callback_sync(ses->se_client);
1928 }
1929
1930 static struct nfsd4_conn *alloc_conn_from_crses(struct svc_rqst *rqstp, struct nfsd4_create_session *cses)
1931 {
1932         u32 dir = NFS4_CDFC4_FORE;
1933
1934         if (cses->flags & SESSION4_BACK_CHAN)
1935                 dir |= NFS4_CDFC4_BACK;
1936         return alloc_conn(rqstp, dir);
1937 }
1938
1939 /* must be called under client_lock */
1940 static void nfsd4_del_conns(struct nfsd4_session *s)
1941 {
1942         struct nfs4_client *clp = s->se_client;
1943         struct nfsd4_conn *c;
1944
1945         spin_lock(&clp->cl_lock);
1946         while (!list_empty(&s->se_conns)) {
1947                 c = list_first_entry(&s->se_conns, struct nfsd4_conn, cn_persession);
1948                 list_del_init(&c->cn_persession);
1949                 spin_unlock(&clp->cl_lock);
1950
1951                 unregister_xpt_user(c->cn_xprt, &c->cn_xpt_user);
1952                 free_conn(c);
1953
1954                 spin_lock(&clp->cl_lock);
1955         }
1956         spin_unlock(&clp->cl_lock);
1957 }
1958
1959 static void __free_session(struct nfsd4_session *ses)
1960 {
1961         free_session_slots(ses);
1962         kfree(ses);
1963 }
1964
1965 static void free_session(struct nfsd4_session *ses)
1966 {
1967         nfsd4_del_conns(ses);
1968         nfsd4_put_drc_mem(&ses->se_fchannel);
1969         __free_session(ses);
1970 }
1971
1972 static void init_session(struct svc_rqst *rqstp, struct nfsd4_session *new, struct nfs4_client *clp, struct nfsd4_create_session *cses)
1973 {
1974         int idx;
1975         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
1976
1977         new->se_client = clp;
1978         gen_sessionid(new);
1979
1980         INIT_LIST_HEAD(&new->se_conns);
1981
1982         new->se_cb_seq_nr = 1;
1983         new->se_flags = cses->flags;
1984         new->se_cb_prog = cses->callback_prog;
1985         new->se_cb_sec = cses->cb_sec;
1986         atomic_set(&new->se_ref, 0);
1987         idx = hash_sessionid(&new->se_sessionid);
1988         list_add(&new->se_hash, &nn->sessionid_hashtbl[idx]);
1989         spin_lock(&clp->cl_lock);
1990         list_add(&new->se_perclnt, &clp->cl_sessions);
1991         spin_unlock(&clp->cl_lock);
1992
1993         {
1994                 struct sockaddr *sa = svc_addr(rqstp);
1995                 /*
1996                  * This is a little silly; with sessions there's no real
1997                  * use for the callback address.  Use the peer address
1998                  * as a reasonable default for now, but consider fixing
1999                  * the rpc client not to require an address in the
2000                  * future:
2001                  */
2002                 rpc_copy_addr((struct sockaddr *)&clp->cl_cb_conn.cb_addr, sa);
2003                 clp->cl_cb_conn.cb_addrlen = svc_addr_len(sa);
2004         }
2005 }
2006
2007 /* caller must hold client_lock */
2008 static struct nfsd4_session *
2009 __find_in_sessionid_hashtbl(struct nfs4_sessionid *sessionid, struct net *net)
2010 {
2011         struct nfsd4_session *elem;
2012         int idx;
2013         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
2014
2015         lockdep_assert_held(&nn->client_lock);
2016
2017         dump_sessionid(__func__, sessionid);
2018         idx = hash_sessionid(sessionid);
2019         /* Search in the appropriate list */
2020         list_for_each_entry(elem, &nn->sessionid_hashtbl[idx], se_hash) {
2021                 if (!memcmp(elem->se_sessionid.data, sessionid->data,
2022                             NFS4_MAX_SESSIONID_LEN)) {
2023                         return elem;
2024                 }
2025         }
2026
2027         dprintk("%s: session not found\n", __func__);
2028         return NULL;
2029 }
2030
2031 static struct nfsd4_session *
2032 find_in_sessionid_hashtbl(struct nfs4_sessionid *sessionid, struct net *net,
2033                 __be32 *ret)
2034 {
2035         struct nfsd4_session *session;
2036         __be32 status = nfserr_badsession;
2037
2038         session = __find_in_sessionid_hashtbl(sessionid, net);
2039         if (!session)
2040                 goto out;
2041         status = nfsd4_get_session_locked(session);
2042         if (status)
2043                 session = NULL;
2044 out:
2045         *ret = status;
2046         return session;
2047 }
2048
2049 /* caller must hold client_lock */
2050 static void
2051 unhash_session(struct nfsd4_session *ses)
2052 {
2053         struct nfs4_client *clp = ses->se_client;
2054         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
2055
2056         lockdep_assert_held(&nn->client_lock);
2057
2058         list_del(&ses->se_hash);
2059         spin_lock(&ses->se_client->cl_lock);
2060         list_del(&ses->se_perclnt);
2061         spin_unlock(&ses->se_client->cl_lock);
2062 }
2063
2064 /* SETCLIENTID and SETCLIENTID_CONFIRM Helper functions */
2065 static int
2066 STALE_CLIENTID(clientid_t *clid, struct nfsd_net *nn)
2067 {
2068         /*
2069          * We're assuming the clid was not given out from a boot
2070          * precisely 2^32 (about 136 years) before this one.  That seems
2071          * a safe assumption:
2072          */
2073         if (clid->cl_boot == (u32)nn->boot_time)
2074                 return 0;
2075         trace_nfsd_clid_stale(clid);
2076         return 1;
2077 }
2078
2079 /*
2080  * XXX Should we use a slab cache ?
2081  * This type of memory management is somewhat inefficient, but we use it
2082  * anyway since SETCLIENTID is not a common operation.
2083  */
2084 static struct nfs4_client *alloc_client(struct xdr_netobj name,
2085                                 struct nfsd_net *nn)
2086 {
2087         struct nfs4_client *clp;
2088         int i;
2089
2090         if (atomic_read(&nn->nfs4_client_count) >= nn->nfs4_max_clients) {
2091                 mod_delayed_work(laundry_wq, &nn->laundromat_work, 0);
2092                 return NULL;
2093         }
2094         clp = kmem_cache_zalloc(client_slab, GFP_KERNEL);
2095         if (clp == NULL)
2096                 return NULL;
2097         xdr_netobj_dup(&clp->cl_name, &name, GFP_KERNEL);
2098         if (clp->cl_name.data == NULL)
2099                 goto err_no_name;
2100         clp->cl_ownerstr_hashtbl = kmalloc_array(OWNER_HASH_SIZE,
2101                                                  sizeof(struct list_head),
2102                                                  GFP_KERNEL);
2103         if (!clp->cl_ownerstr_hashtbl)
2104                 goto err_no_hashtbl;
2105         for (i = 0; i < OWNER_HASH_SIZE; i++)
2106                 INIT_LIST_HEAD(&clp->cl_ownerstr_hashtbl[i]);
2107         INIT_LIST_HEAD(&clp->cl_sessions);
2108         idr_init(&clp->cl_stateids);
2109         atomic_set(&clp->cl_rpc_users, 0);
2110         clp->cl_cb_state = NFSD4_CB_UNKNOWN;
2111         clp->cl_state = NFSD4_ACTIVE;
2112         atomic_inc(&nn->nfs4_client_count);
2113         atomic_set(&clp->cl_delegs_in_recall, 0);
2114         INIT_LIST_HEAD(&clp->cl_idhash);
2115         INIT_LIST_HEAD(&clp->cl_openowners);
2116         INIT_LIST_HEAD(&clp->cl_delegations);
2117         INIT_LIST_HEAD(&clp->cl_lru);
2118         INIT_LIST_HEAD(&clp->cl_revoked);
2119 #ifdef CONFIG_NFSD_PNFS
2120         INIT_LIST_HEAD(&clp->cl_lo_states);
2121 #endif
2122         INIT_LIST_HEAD(&clp->async_copies);
2123         spin_lock_init(&clp->async_lock);
2124         spin_lock_init(&clp->cl_lock);
2125         rpc_init_wait_queue(&clp->cl_cb_waitq, "Backchannel slot table");
2126         return clp;
2127 err_no_hashtbl:
2128         kfree(clp->cl_name.data);
2129 err_no_name:
2130         kmem_cache_free(client_slab, clp);
2131         return NULL;
2132 }
2133
2134 static void __free_client(struct kref *k)
2135 {
2136         struct nfsdfs_client *c = container_of(k, struct nfsdfs_client, cl_ref);
2137         struct nfs4_client *clp = container_of(c, struct nfs4_client, cl_nfsdfs);
2138
2139         free_svc_cred(&clp->cl_cred);
2140         kfree(clp->cl_ownerstr_hashtbl);
2141         kfree(clp->cl_name.data);
2142         kfree(clp->cl_nii_domain.data);
2143         kfree(clp->cl_nii_name.data);
2144         idr_destroy(&clp->cl_stateids);
2145         kmem_cache_free(client_slab, clp);
2146 }
2147
2148 static void drop_client(struct nfs4_client *clp)
2149 {
2150         kref_put(&clp->cl_nfsdfs.cl_ref, __free_client);
2151 }
2152
2153 static void
2154 free_client(struct nfs4_client *clp)
2155 {
2156         while (!list_empty(&clp->cl_sessions)) {
2157                 struct nfsd4_session *ses;
2158                 ses = list_entry(clp->cl_sessions.next, struct nfsd4_session,
2159                                 se_perclnt);
2160                 list_del(&ses->se_perclnt);
2161                 WARN_ON_ONCE(atomic_read(&ses->se_ref));
2162                 free_session(ses);
2163         }
2164         rpc_destroy_wait_queue(&clp->cl_cb_waitq);
2165         if (clp->cl_nfsd_dentry) {
2166                 nfsd_client_rmdir(clp->cl_nfsd_dentry);
2167                 clp->cl_nfsd_dentry = NULL;
2168                 wake_up_all(&expiry_wq);
2169         }
2170         drop_client(clp);
2171 }
2172
2173 /* must be called under the client_lock */
2174 static void
2175 unhash_client_locked(struct nfs4_client *clp)
2176 {
2177         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
2178         struct nfsd4_session *ses;
2179
2180         lockdep_assert_held(&nn->client_lock);
2181
2182         /* Mark the client as expired! */
2183         clp->cl_time = 0;
2184         /* Make it invisible */
2185         if (!list_empty(&clp->cl_idhash)) {
2186                 list_del_init(&clp->cl_idhash);
2187                 if (test_bit(NFSD4_CLIENT_CONFIRMED, &clp->cl_flags))
2188                         rb_erase(&clp->cl_namenode, &nn->conf_name_tree);
2189                 else
2190                         rb_erase(&clp->cl_namenode, &nn->unconf_name_tree);
2191         }
2192         list_del_init(&clp->cl_lru);
2193         spin_lock(&clp->cl_lock);
2194         list_for_each_entry(ses, &clp->cl_sessions, se_perclnt)
2195                 list_del_init(&ses->se_hash);
2196         spin_unlock(&clp->cl_lock);
2197 }
2198
2199 static void
2200 unhash_client(struct nfs4_client *clp)
2201 {
2202         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
2203
2204         spin_lock(&nn->client_lock);
2205         unhash_client_locked(clp);
2206         spin_unlock(&nn->client_lock);
2207 }
2208
2209 static __be32 mark_client_expired_locked(struct nfs4_client *clp)
2210 {
2211         if (atomic_read(&clp->cl_rpc_users))
2212                 return nfserr_jukebox;
2213         unhash_client_locked(clp);
2214         return nfs_ok;
2215 }
2216
2217 static void
2218 __destroy_client(struct nfs4_client *clp)
2219 {
2220         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
2221         int i;
2222         struct nfs4_openowner *oo;
2223         struct nfs4_delegation *dp;
2224         struct list_head reaplist;
2225
2226         INIT_LIST_HEAD(&reaplist);
2227         spin_lock(&state_lock);
2228         while (!list_empty(&clp->cl_delegations)) {
2229                 dp = list_entry(clp->cl_delegations.next, struct nfs4_delegation, dl_perclnt);
2230                 WARN_ON(!unhash_delegation_locked(dp));
2231                 list_add(&dp->dl_recall_lru, &reaplist);
2232         }
2233         spin_unlock(&state_lock);
2234         while (!list_empty(&reaplist)) {
2235                 dp = list_entry(reaplist.next, struct nfs4_delegation, dl_recall_lru);
2236                 list_del_init(&dp->dl_recall_lru);
2237                 destroy_unhashed_deleg(dp);
2238         }
2239         while (!list_empty(&clp->cl_revoked)) {
2240                 dp = list_entry(clp->cl_revoked.next, struct nfs4_delegation, dl_recall_lru);
2241                 list_del_init(&dp->dl_recall_lru);
2242                 nfs4_put_stid(&dp->dl_stid);
2243         }
2244         while (!list_empty(&clp->cl_openowners)) {
2245                 oo = list_entry(clp->cl_openowners.next, struct nfs4_openowner, oo_perclient);
2246                 nfs4_get_stateowner(&oo->oo_owner);
2247                 release_openowner(oo);
2248         }
2249         for (i = 0; i < OWNER_HASH_SIZE; i++) {
2250                 struct nfs4_stateowner *so, *tmp;
2251
2252                 list_for_each_entry_safe(so, tmp, &clp->cl_ownerstr_hashtbl[i],
2253                                          so_strhash) {
2254                         /* Should be no openowners at this point */
2255                         WARN_ON_ONCE(so->so_is_open_owner);
2256                         remove_blocked_locks(lockowner(so));
2257                 }
2258         }
2259         nfsd4_return_all_client_layouts(clp);
2260         nfsd4_shutdown_copy(clp);
2261         nfsd4_shutdown_callback(clp);
2262         if (clp->cl_cb_conn.cb_xprt)
2263                 svc_xprt_put(clp->cl_cb_conn.cb_xprt);
2264         atomic_add_unless(&nn->nfs4_client_count, -1, 0);
2265         nfsd4_dec_courtesy_client_count(nn, clp);
2266         free_client(clp);
2267         wake_up_all(&expiry_wq);
2268 }
2269
2270 static void
2271 destroy_client(struct nfs4_client *clp)
2272 {
2273         unhash_client(clp);
2274         __destroy_client(clp);
2275 }
2276
2277 static void inc_reclaim_complete(struct nfs4_client *clp)
2278 {
2279         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
2280
2281         if (!nn->track_reclaim_completes)
2282                 return;
2283         if (!nfsd4_find_reclaim_client(clp->cl_name, nn))
2284                 return;
2285         if (atomic_inc_return(&nn->nr_reclaim_complete) ==
2286                         nn->reclaim_str_hashtbl_size) {
2287                 printk(KERN_INFO "NFSD: all clients done reclaiming, ending NFSv4 grace period (net %x)\n",
2288                                 clp->net->ns.inum);
2289                 nfsd4_end_grace(nn);
2290         }
2291 }
2292
2293 static void expire_client(struct nfs4_client *clp)
2294 {
2295         unhash_client(clp);
2296         nfsd4_client_record_remove(clp);
2297         __destroy_client(clp);
2298 }
2299
2300 static void copy_verf(struct nfs4_client *target, nfs4_verifier *source)
2301 {
2302         memcpy(target->cl_verifier.data, source->data,
2303                         sizeof(target->cl_verifier.data));
2304 }
2305
2306 static void copy_clid(struct nfs4_client *target, struct nfs4_client *source)
2307 {
2308         target->cl_clientid.cl_boot = source->cl_clientid.cl_boot;
2309         target->cl_clientid.cl_id = source->cl_clientid.cl_id;
2310 }
2311
2312 static int copy_cred(struct svc_cred *target, struct svc_cred *source)
2313 {
2314         target->cr_principal = kstrdup(source->cr_principal, GFP_KERNEL);
2315         target->cr_raw_principal = kstrdup(source->cr_raw_principal,
2316                                                                 GFP_KERNEL);
2317         target->cr_targ_princ = kstrdup(source->cr_targ_princ, GFP_KERNEL);
2318         if ((source->cr_principal && !target->cr_principal) ||
2319             (source->cr_raw_principal && !target->cr_raw_principal) ||
2320             (source->cr_targ_princ && !target->cr_targ_princ))
2321                 return -ENOMEM;
2322
2323         target->cr_flavor = source->cr_flavor;
2324         target->cr_uid = source->cr_uid;
2325         target->cr_gid = source->cr_gid;
2326         target->cr_group_info = source->cr_group_info;
2327         get_group_info(target->cr_group_info);
2328         target->cr_gss_mech = source->cr_gss_mech;
2329         if (source->cr_gss_mech)
2330                 gss_mech_get(source->cr_gss_mech);
2331         return 0;
2332 }
2333
2334 static int
2335 compare_blob(const struct xdr_netobj *o1, const struct xdr_netobj *o2)
2336 {
2337         if (o1->len < o2->len)
2338                 return -1;
2339         if (o1->len > o2->len)
2340                 return 1;
2341         return memcmp(o1->data, o2->data, o1->len);
2342 }
2343
2344 static int
2345 same_verf(nfs4_verifier *v1, nfs4_verifier *v2)
2346 {
2347         return 0 == memcmp(v1->data, v2->data, sizeof(v1->data));
2348 }
2349
2350 static int
2351 same_clid(clientid_t *cl1, clientid_t *cl2)
2352 {
2353         return (cl1->cl_boot == cl2->cl_boot) && (cl1->cl_id == cl2->cl_id);
2354 }
2355
2356 static bool groups_equal(struct group_info *g1, struct group_info *g2)
2357 {
2358         int i;
2359
2360         if (g1->ngroups != g2->ngroups)
2361                 return false;
2362         for (i=0; i<g1->ngroups; i++)
2363                 if (!gid_eq(g1->gid[i], g2->gid[i]))
2364                         return false;
2365         return true;
2366 }
2367
2368 /*
2369  * RFC 3530 language requires clid_inuse be returned when the
2370  * "principal" associated with a requests differs from that previously
2371  * used.  We use uid, gid's, and gss principal string as our best
2372  * approximation.  We also don't want to allow non-gss use of a client
2373  * established using gss: in theory cr_principal should catch that
2374  * change, but in practice cr_principal can be null even in the gss case
2375  * since gssd doesn't always pass down a principal string.
2376  */
2377 static bool is_gss_cred(struct svc_cred *cr)
2378 {
2379         /* Is cr_flavor one of the gss "pseudoflavors"?: */
2380         return (cr->cr_flavor > RPC_AUTH_MAXFLAVOR);
2381 }
2382
2383
2384 static bool
2385 same_creds(struct svc_cred *cr1, struct svc_cred *cr2)
2386 {
2387         if ((is_gss_cred(cr1) != is_gss_cred(cr2))
2388                 || (!uid_eq(cr1->cr_uid, cr2->cr_uid))
2389                 || (!gid_eq(cr1->cr_gid, cr2->cr_gid))
2390                 || !groups_equal(cr1->cr_group_info, cr2->cr_group_info))
2391                 return false;
2392         /* XXX: check that cr_targ_princ fields match ? */
2393         if (cr1->cr_principal == cr2->cr_principal)
2394                 return true;
2395         if (!cr1->cr_principal || !cr2->cr_principal)
2396                 return false;
2397         return 0 == strcmp(cr1->cr_principal, cr2->cr_principal);
2398 }
2399
2400 static bool svc_rqst_integrity_protected(struct svc_rqst *rqstp)
2401 {
2402         struct svc_cred *cr = &rqstp->rq_cred;
2403         u32 service;
2404
2405         if (!cr->cr_gss_mech)
2406                 return false;
2407         service = gss_pseudoflavor_to_service(cr->cr_gss_mech, cr->cr_flavor);
2408         return service == RPC_GSS_SVC_INTEGRITY ||
2409                service == RPC_GSS_SVC_PRIVACY;
2410 }
2411
2412 bool nfsd4_mach_creds_match(struct nfs4_client *cl, struct svc_rqst *rqstp)
2413 {
2414         struct svc_cred *cr = &rqstp->rq_cred;
2415
2416         if (!cl->cl_mach_cred)
2417                 return true;
2418         if (cl->cl_cred.cr_gss_mech != cr->cr_gss_mech)
2419                 return false;
2420         if (!svc_rqst_integrity_protected(rqstp))
2421                 return false;
2422         if (cl->cl_cred.cr_raw_principal)
2423                 return 0 == strcmp(cl->cl_cred.cr_raw_principal,
2424                                                 cr->cr_raw_principal);
2425         if (!cr->cr_principal)
2426                 return false;
2427         return 0 == strcmp(cl->cl_cred.cr_principal, cr->cr_principal);
2428 }
2429
2430 static void gen_confirm(struct nfs4_client *clp, struct nfsd_net *nn)
2431 {
2432         __be32 verf[2];
2433
2434         /*
2435          * This is opaque to client, so no need to byte-swap. Use
2436          * __force to keep sparse happy
2437          */
2438         verf[0] = (__force __be32)(u32)ktime_get_real_seconds();
2439         verf[1] = (__force __be32)nn->clverifier_counter++;
2440         memcpy(clp->cl_confirm.data, verf, sizeof(clp->cl_confirm.data));
2441 }
2442
2443 static void gen_clid(struct nfs4_client *clp, struct nfsd_net *nn)
2444 {
2445         clp->cl_clientid.cl_boot = (u32)nn->boot_time;
2446         clp->cl_clientid.cl_id = nn->clientid_counter++;
2447         gen_confirm(clp, nn);
2448 }
2449
2450 static struct nfs4_stid *
2451 find_stateid_locked(struct nfs4_client *cl, stateid_t *t)
2452 {
2453         struct nfs4_stid *ret;
2454
2455         ret = idr_find(&cl->cl_stateids, t->si_opaque.so_id);
2456         if (!ret || !ret->sc_type)
2457                 return NULL;
2458         return ret;
2459 }
2460
2461 static struct nfs4_stid *
2462 find_stateid_by_type(struct nfs4_client *cl, stateid_t *t, char typemask)
2463 {
2464         struct nfs4_stid *s;
2465
2466         spin_lock(&cl->cl_lock);
2467         s = find_stateid_locked(cl, t);
2468         if (s != NULL) {
2469                 if (typemask & s->sc_type)
2470                         refcount_inc(&s->sc_count);
2471                 else
2472                         s = NULL;
2473         }
2474         spin_unlock(&cl->cl_lock);
2475         return s;
2476 }
2477
2478 static struct nfs4_client *get_nfsdfs_clp(struct inode *inode)
2479 {
2480         struct nfsdfs_client *nc;
2481         nc = get_nfsdfs_client(inode);
2482         if (!nc)
2483                 return NULL;
2484         return container_of(nc, struct nfs4_client, cl_nfsdfs);
2485 }
2486
2487 static void seq_quote_mem(struct seq_file *m, char *data, int len)
2488 {
2489         seq_printf(m, "\"");
2490         seq_escape_mem(m, data, len, ESCAPE_HEX | ESCAPE_NAP | ESCAPE_APPEND, "\"\\");
2491         seq_printf(m, "\"");
2492 }
2493
2494 static const char *cb_state2str(int state)
2495 {
2496         switch (state) {
2497         case NFSD4_CB_UP:
2498                 return "UP";
2499         case NFSD4_CB_UNKNOWN:
2500                 return "UNKNOWN";
2501         case NFSD4_CB_DOWN:
2502                 return "DOWN";
2503         case NFSD4_CB_FAULT:
2504                 return "FAULT";
2505         }
2506         return "UNDEFINED";
2507 }
2508
2509 static int client_info_show(struct seq_file *m, void *v)
2510 {
2511         struct inode *inode = file_inode(m->file);
2512         struct nfs4_client *clp;
2513         u64 clid;
2514
2515         clp = get_nfsdfs_clp(inode);
2516         if (!clp)
2517                 return -ENXIO;
2518         memcpy(&clid, &clp->cl_clientid, sizeof(clid));
2519         seq_printf(m, "clientid: 0x%llx\n", clid);
2520         seq_printf(m, "address: \"%pISpc\"\n", (struct sockaddr *)&clp->cl_addr);
2521
2522         if (clp->cl_state == NFSD4_COURTESY)
2523                 seq_puts(m, "status: courtesy\n");
2524         else if (clp->cl_state == NFSD4_EXPIRABLE)
2525                 seq_puts(m, "status: expirable\n");
2526         else if (test_bit(NFSD4_CLIENT_CONFIRMED, &clp->cl_flags))
2527                 seq_puts(m, "status: confirmed\n");
2528         else
2529                 seq_puts(m, "status: unconfirmed\n");
2530         seq_printf(m, "seconds from last renew: %lld\n",
2531                 ktime_get_boottime_seconds() - clp->cl_time);
2532         seq_printf(m, "name: ");
2533         seq_quote_mem(m, clp->cl_name.data, clp->cl_name.len);
2534         seq_printf(m, "\nminor version: %d\n", clp->cl_minorversion);
2535         if (clp->cl_nii_domain.data) {
2536                 seq_printf(m, "Implementation domain: ");
2537                 seq_quote_mem(m, clp->cl_nii_domain.data,
2538                                         clp->cl_nii_domain.len);
2539                 seq_printf(m, "\nImplementation name: ");
2540                 seq_quote_mem(m, clp->cl_nii_name.data, clp->cl_nii_name.len);
2541                 seq_printf(m, "\nImplementation time: [%lld, %ld]\n",
2542                         clp->cl_nii_time.tv_sec, clp->cl_nii_time.tv_nsec);
2543         }
2544         seq_printf(m, "callback state: %s\n", cb_state2str(clp->cl_cb_state));
2545         seq_printf(m, "callback address: %pISpc\n", &clp->cl_cb_conn.cb_addr);
2546         drop_client(clp);
2547
2548         return 0;
2549 }
2550
2551 DEFINE_SHOW_ATTRIBUTE(client_info);
2552
2553 static void *states_start(struct seq_file *s, loff_t *pos)
2554         __acquires(&clp->cl_lock)
2555 {
2556         struct nfs4_client *clp = s->private;
2557         unsigned long id = *pos;
2558         void *ret;
2559
2560         spin_lock(&clp->cl_lock);
2561         ret = idr_get_next_ul(&clp->cl_stateids, &id);
2562         *pos = id;
2563         return ret;
2564 }
2565
2566 static void *states_next(struct seq_file *s, void *v, loff_t *pos)
2567 {
2568         struct nfs4_client *clp = s->private;
2569         unsigned long id = *pos;
2570         void *ret;
2571
2572         id = *pos;
2573         id++;
2574         ret = idr_get_next_ul(&clp->cl_stateids, &id);
2575         *pos = id;
2576         return ret;
2577 }
2578
2579 static void states_stop(struct seq_file *s, void *v)
2580         __releases(&clp->cl_lock)
2581 {
2582         struct nfs4_client *clp = s->private;
2583
2584         spin_unlock(&clp->cl_lock);
2585 }
2586
2587 static void nfs4_show_fname(struct seq_file *s, struct nfsd_file *f)
2588 {
2589          seq_printf(s, "filename: \"%pD2\"", f->nf_file);
2590 }
2591
2592 static void nfs4_show_superblock(struct seq_file *s, struct nfsd_file *f)
2593 {
2594         struct inode *inode = file_inode(f->nf_file);
2595
2596         seq_printf(s, "superblock: \"%02x:%02x:%ld\"",
2597                                         MAJOR(inode->i_sb->s_dev),
2598                                          MINOR(inode->i_sb->s_dev),
2599                                          inode->i_ino);
2600 }
2601
2602 static void nfs4_show_owner(struct seq_file *s, struct nfs4_stateowner *oo)
2603 {
2604         seq_printf(s, "owner: ");
2605         seq_quote_mem(s, oo->so_owner.data, oo->so_owner.len);
2606 }
2607
2608 static void nfs4_show_stateid(struct seq_file *s, stateid_t *stid)
2609 {
2610         seq_printf(s, "0x%.8x", stid->si_generation);
2611         seq_printf(s, "%12phN", &stid->si_opaque);
2612 }
2613
2614 static int nfs4_show_open(struct seq_file *s, struct nfs4_stid *st)
2615 {
2616         struct nfs4_ol_stateid *ols;
2617         struct nfs4_file *nf;
2618         struct nfsd_file *file;
2619         struct nfs4_stateowner *oo;
2620         unsigned int access, deny;
2621
2622         if (st->sc_type != NFS4_OPEN_STID && st->sc_type != NFS4_LOCK_STID)
2623                 return 0; /* XXX: or SEQ_SKIP? */
2624         ols = openlockstateid(st);
2625         oo = ols->st_stateowner;
2626         nf = st->sc_file;
2627
2628         spin_lock(&nf->fi_lock);
2629         file = find_any_file_locked(nf);
2630         if (!file)
2631                 goto out;
2632
2633         seq_printf(s, "- ");
2634         nfs4_show_stateid(s, &st->sc_stateid);
2635         seq_printf(s, ": { type: open, ");
2636
2637         access = bmap_to_share_mode(ols->st_access_bmap);
2638         deny   = bmap_to_share_mode(ols->st_deny_bmap);
2639
2640         seq_printf(s, "access: %s%s, ",
2641                 access & NFS4_SHARE_ACCESS_READ ? "r" : "-",
2642                 access & NFS4_SHARE_ACCESS_WRITE ? "w" : "-");
2643         seq_printf(s, "deny: %s%s, ",
2644                 deny & NFS4_SHARE_ACCESS_READ ? "r" : "-",
2645                 deny & NFS4_SHARE_ACCESS_WRITE ? "w" : "-");
2646
2647         nfs4_show_superblock(s, file);
2648         seq_printf(s, ", ");
2649         nfs4_show_fname(s, file);
2650         seq_printf(s, ", ");
2651         nfs4_show_owner(s, oo);
2652         seq_printf(s, " }\n");
2653 out:
2654         spin_unlock(&nf->fi_lock);
2655         return 0;
2656 }
2657
2658 static int nfs4_show_lock(struct seq_file *s, struct nfs4_stid *st)
2659 {
2660         struct nfs4_ol_stateid *ols;
2661         struct nfs4_file *nf;
2662         struct nfsd_file *file;
2663         struct nfs4_stateowner *oo;
2664
2665         ols = openlockstateid(st);
2666         oo = ols->st_stateowner;
2667         nf = st->sc_file;
2668         spin_lock(&nf->fi_lock);
2669         file = find_any_file_locked(nf);
2670         if (!file)
2671                 goto out;
2672
2673         seq_printf(s, "- ");
2674         nfs4_show_stateid(s, &st->sc_stateid);
2675         seq_printf(s, ": { type: lock, ");
2676
2677         /*
2678          * Note: a lock stateid isn't really the same thing as a lock,
2679          * it's the locking state held by one owner on a file, and there
2680          * may be multiple (or no) lock ranges associated with it.
2681          * (Same for the matter is true of open stateids.)
2682          */
2683
2684         nfs4_show_superblock(s, file);
2685         /* XXX: open stateid? */
2686         seq_printf(s, ", ");
2687         nfs4_show_fname(s, file);
2688         seq_printf(s, ", ");
2689         nfs4_show_owner(s, oo);
2690         seq_printf(s, " }\n");
2691 out:
2692         spin_unlock(&nf->fi_lock);
2693         return 0;
2694 }
2695
2696 static int nfs4_show_deleg(struct seq_file *s, struct nfs4_stid *st)
2697 {
2698         struct nfs4_delegation *ds;
2699         struct nfs4_file *nf;
2700         struct nfsd_file *file;
2701
2702         ds = delegstateid(st);
2703         nf = st->sc_file;
2704         spin_lock(&nf->fi_lock);
2705         file = find_deleg_file_locked(nf);
2706         if (!file)
2707                 goto out;
2708
2709         seq_printf(s, "- ");
2710         nfs4_show_stateid(s, &st->sc_stateid);
2711         seq_printf(s, ": { type: deleg, ");
2712
2713         /* Kinda dead code as long as we only support read delegs: */
2714         seq_printf(s, "access: %s, ",
2715                 ds->dl_type == NFS4_OPEN_DELEGATE_READ ? "r" : "w");
2716
2717         /* XXX: lease time, whether it's being recalled. */
2718
2719         nfs4_show_superblock(s, file);
2720         seq_printf(s, ", ");
2721         nfs4_show_fname(s, file);
2722         seq_printf(s, " }\n");
2723 out:
2724         spin_unlock(&nf->fi_lock);
2725         return 0;
2726 }
2727
2728 static int nfs4_show_layout(struct seq_file *s, struct nfs4_stid *st)
2729 {
2730         struct nfs4_layout_stateid *ls;
2731         struct nfsd_file *file;
2732
2733         ls = container_of(st, struct nfs4_layout_stateid, ls_stid);
2734         file = ls->ls_file;
2735
2736         seq_printf(s, "- ");
2737         nfs4_show_stateid(s, &st->sc_stateid);
2738         seq_printf(s, ": { type: layout, ");
2739
2740         /* XXX: What else would be useful? */
2741
2742         nfs4_show_superblock(s, file);
2743         seq_printf(s, ", ");
2744         nfs4_show_fname(s, file);
2745         seq_printf(s, " }\n");
2746
2747         return 0;
2748 }
2749
2750 static int states_show(struct seq_file *s, void *v)
2751 {
2752         struct nfs4_stid *st = v;
2753
2754         switch (st->sc_type) {
2755         case NFS4_OPEN_STID:
2756                 return nfs4_show_open(s, st);
2757         case NFS4_LOCK_STID:
2758                 return nfs4_show_lock(s, st);
2759         case NFS4_DELEG_STID:
2760                 return nfs4_show_deleg(s, st);
2761         case NFS4_LAYOUT_STID:
2762                 return nfs4_show_layout(s, st);
2763         default:
2764                 return 0; /* XXX: or SEQ_SKIP? */
2765         }
2766         /* XXX: copy stateids? */
2767 }
2768
2769 static struct seq_operations states_seq_ops = {
2770         .start = states_start,
2771         .next = states_next,
2772         .stop = states_stop,
2773         .show = states_show
2774 };
2775
2776 static int client_states_open(struct inode *inode, struct file *file)
2777 {
2778         struct seq_file *s;
2779         struct nfs4_client *clp;
2780         int ret;
2781
2782         clp = get_nfsdfs_clp(inode);
2783         if (!clp)
2784                 return -ENXIO;
2785
2786         ret = seq_open(file, &states_seq_ops);
2787         if (ret)
2788                 return ret;
2789         s = file->private_data;
2790         s->private = clp;
2791         return 0;
2792 }
2793
2794 static int client_opens_release(struct inode *inode, struct file *file)
2795 {
2796         struct seq_file *m = file->private_data;
2797         struct nfs4_client *clp = m->private;
2798
2799         /* XXX: alternatively, we could get/drop in seq start/stop */
2800         drop_client(clp);
2801         return 0;
2802 }
2803
2804 static const struct file_operations client_states_fops = {
2805         .open           = client_states_open,
2806         .read           = seq_read,
2807         .llseek         = seq_lseek,
2808         .release        = client_opens_release,
2809 };
2810
2811 /*
2812  * Normally we refuse to destroy clients that are in use, but here the
2813  * administrator is telling us to just do it.  We also want to wait
2814  * so the caller has a guarantee that the client's locks are gone by
2815  * the time the write returns:
2816  */
2817 static void force_expire_client(struct nfs4_client *clp)
2818 {
2819         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
2820         bool already_expired;
2821
2822         trace_nfsd_clid_admin_expired(&clp->cl_clientid);
2823
2824         spin_lock(&nn->client_lock);
2825         clp->cl_time = 0;
2826         spin_unlock(&nn->client_lock);
2827
2828         wait_event(expiry_wq, atomic_read(&clp->cl_rpc_users) == 0);
2829         spin_lock(&nn->client_lock);
2830         already_expired = list_empty(&clp->cl_lru);
2831         if (!already_expired)
2832                 unhash_client_locked(clp);
2833         spin_unlock(&nn->client_lock);
2834
2835         if (!already_expired)
2836                 expire_client(clp);
2837         else
2838                 wait_event(expiry_wq, clp->cl_nfsd_dentry == NULL);
2839 }
2840
2841 static ssize_t client_ctl_write(struct file *file, const char __user *buf,
2842                                    size_t size, loff_t *pos)
2843 {
2844         char *data;
2845         struct nfs4_client *clp;
2846
2847         data = simple_transaction_get(file, buf, size);
2848         if (IS_ERR(data))
2849                 return PTR_ERR(data);
2850         if (size != 7 || 0 != memcmp(data, "expire\n", 7))
2851                 return -EINVAL;
2852         clp = get_nfsdfs_clp(file_inode(file));
2853         if (!clp)
2854                 return -ENXIO;
2855         force_expire_client(clp);
2856         drop_client(clp);
2857         return 7;
2858 }
2859
2860 static const struct file_operations client_ctl_fops = {
2861         .write          = client_ctl_write,
2862         .release        = simple_transaction_release,
2863 };
2864
2865 static const struct tree_descr client_files[] = {
2866         [0] = {"info", &client_info_fops, S_IRUSR},
2867         [1] = {"states", &client_states_fops, S_IRUSR},
2868         [2] = {"ctl", &client_ctl_fops, S_IWUSR},
2869         [3] = {""},
2870 };
2871
2872 static struct nfs4_client *create_client(struct xdr_netobj name,
2873                 struct svc_rqst *rqstp, nfs4_verifier *verf)
2874 {
2875         struct nfs4_client *clp;
2876         struct sockaddr *sa = svc_addr(rqstp);
2877         int ret;
2878         struct net *net = SVC_NET(rqstp);
2879         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
2880         struct dentry *dentries[ARRAY_SIZE(client_files)];
2881
2882         clp = alloc_client(name, nn);
2883         if (clp == NULL)
2884                 return NULL;
2885
2886         ret = copy_cred(&clp->cl_cred, &rqstp->rq_cred);
2887         if (ret) {
2888                 free_client(clp);
2889                 return NULL;
2890         }
2891         gen_clid(clp, nn);
2892         kref_init(&clp->cl_nfsdfs.cl_ref);
2893         nfsd4_init_cb(&clp->cl_cb_null, clp, NULL, NFSPROC4_CLNT_CB_NULL);
2894         clp->cl_time = ktime_get_boottime_seconds();
2895         clear_bit(0, &clp->cl_cb_slot_busy);
2896         copy_verf(clp, verf);
2897         memcpy(&clp->cl_addr, sa, sizeof(struct sockaddr_storage));
2898         clp->cl_cb_session = NULL;
2899         clp->net = net;
2900         clp->cl_nfsd_dentry = nfsd_client_mkdir(
2901                 nn, &clp->cl_nfsdfs,
2902                 clp->cl_clientid.cl_id - nn->clientid_base,
2903                 client_files, dentries);
2904         clp->cl_nfsd_info_dentry = dentries[0];
2905         if (!clp->cl_nfsd_dentry) {
2906                 free_client(clp);
2907                 return NULL;
2908         }
2909         return clp;
2910 }
2911
2912 static void
2913 add_clp_to_name_tree(struct nfs4_client *new_clp, struct rb_root *root)
2914 {
2915         struct rb_node **new = &(root->rb_node), *parent = NULL;
2916         struct nfs4_client *clp;
2917
2918         while (*new) {
2919                 clp = rb_entry(*new, struct nfs4_client, cl_namenode);
2920                 parent = *new;
2921
2922                 if (compare_blob(&clp->cl_name, &new_clp->cl_name) > 0)
2923                         new = &((*new)->rb_left);
2924                 else
2925                         new = &((*new)->rb_right);
2926         }
2927
2928         rb_link_node(&new_clp->cl_namenode, parent, new);
2929         rb_insert_color(&new_clp->cl_namenode, root);
2930 }
2931
2932 static struct nfs4_client *
2933 find_clp_in_name_tree(struct xdr_netobj *name, struct rb_root *root)
2934 {
2935         int cmp;
2936         struct rb_node *node = root->rb_node;
2937         struct nfs4_client *clp;
2938
2939         while (node) {
2940                 clp = rb_entry(node, struct nfs4_client, cl_namenode);
2941                 cmp = compare_blob(&clp->cl_name, name);
2942                 if (cmp > 0)
2943                         node = node->rb_left;
2944                 else if (cmp < 0)
2945                         node = node->rb_right;
2946                 else
2947                         return clp;
2948         }
2949         return NULL;
2950 }
2951
2952 static void
2953 add_to_unconfirmed(struct nfs4_client *clp)
2954 {
2955         unsigned int idhashval;
2956         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
2957
2958         lockdep_assert_held(&nn->client_lock);
2959
2960         clear_bit(NFSD4_CLIENT_CONFIRMED, &clp->cl_flags);
2961         add_clp_to_name_tree(clp, &nn->unconf_name_tree);
2962         idhashval = clientid_hashval(clp->cl_clientid.cl_id);
2963         list_add(&clp->cl_idhash, &nn->unconf_id_hashtbl[idhashval]);
2964         renew_client_locked(clp);
2965 }
2966
2967 static void
2968 move_to_confirmed(struct nfs4_client *clp)
2969 {
2970         unsigned int idhashval = clientid_hashval(clp->cl_clientid.cl_id);
2971         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
2972
2973         lockdep_assert_held(&nn->client_lock);
2974
2975         list_move(&clp->cl_idhash, &nn->conf_id_hashtbl[idhashval]);
2976         rb_erase(&clp->cl_namenode, &nn->unconf_name_tree);
2977         add_clp_to_name_tree(clp, &nn->conf_name_tree);
2978         set_bit(NFSD4_CLIENT_CONFIRMED, &clp->cl_flags);
2979         trace_nfsd_clid_confirmed(&clp->cl_clientid);
2980         renew_client_locked(clp);
2981 }
2982
2983 static struct nfs4_client *
2984 find_client_in_id_table(struct list_head *tbl, clientid_t *clid, bool sessions)
2985 {
2986         struct nfs4_client *clp;
2987         unsigned int idhashval = clientid_hashval(clid->cl_id);
2988
2989         list_for_each_entry(clp, &tbl[idhashval], cl_idhash) {
2990                 if (same_clid(&clp->cl_clientid, clid)) {
2991                         if ((bool)clp->cl_minorversion != sessions)
2992                                 return NULL;
2993                         renew_client_locked(clp);
2994                         return clp;
2995                 }
2996         }
2997         return NULL;
2998 }
2999
3000 static struct nfs4_client *
3001 find_confirmed_client(clientid_t *clid, bool sessions, struct nfsd_net *nn)
3002 {
3003         struct list_head *tbl = nn->conf_id_hashtbl;
3004
3005         lockdep_assert_held(&nn->client_lock);
3006         return find_client_in_id_table(tbl, clid, sessions);
3007 }
3008
3009 static struct nfs4_client *
3010 find_unconfirmed_client(clientid_t *clid, bool sessions, struct nfsd_net *nn)
3011 {
3012         struct list_head *tbl = nn->unconf_id_hashtbl;
3013
3014         lockdep_assert_held(&nn->client_lock);
3015         return find_client_in_id_table(tbl, clid, sessions);
3016 }
3017
3018 static bool clp_used_exchangeid(struct nfs4_client *clp)
3019 {
3020         return clp->cl_exchange_flags != 0;
3021 }
3022
3023 static struct nfs4_client *
3024 find_confirmed_client_by_name(struct xdr_netobj *name, struct nfsd_net *nn)
3025 {
3026         lockdep_assert_held(&nn->client_lock);
3027         return find_clp_in_name_tree(name, &nn->conf_name_tree);
3028 }
3029
3030 static struct nfs4_client *
3031 find_unconfirmed_client_by_name(struct xdr_netobj *name, struct nfsd_net *nn)
3032 {
3033         lockdep_assert_held(&nn->client_lock);
3034         return find_clp_in_name_tree(name, &nn->unconf_name_tree);
3035 }
3036
3037 static void
3038 gen_callback(struct nfs4_client *clp, struct nfsd4_setclientid *se, struct svc_rqst *rqstp)
3039 {
3040         struct nfs4_cb_conn *conn = &clp->cl_cb_conn;
3041         struct sockaddr *sa = svc_addr(rqstp);
3042         u32 scopeid = rpc_get_scope_id(sa);
3043         unsigned short expected_family;
3044
3045         /* Currently, we only support tcp and tcp6 for the callback channel */
3046         if (se->se_callback_netid_len == 3 &&
3047             !memcmp(se->se_callback_netid_val, "tcp", 3))
3048                 expected_family = AF_INET;
3049         else if (se->se_callback_netid_len == 4 &&
3050                  !memcmp(se->se_callback_netid_val, "tcp6", 4))
3051                 expected_family = AF_INET6;
3052         else
3053                 goto out_err;
3054
3055         conn->cb_addrlen = rpc_uaddr2sockaddr(clp->net, se->se_callback_addr_val,
3056                                             se->se_callback_addr_len,
3057                                             (struct sockaddr *)&conn->cb_addr,
3058                                             sizeof(conn->cb_addr));
3059
3060         if (!conn->cb_addrlen || conn->cb_addr.ss_family != expected_family)
3061                 goto out_err;
3062
3063         if (conn->cb_addr.ss_family == AF_INET6)
3064                 ((struct sockaddr_in6 *)&conn->cb_addr)->sin6_scope_id = scopeid;
3065
3066         conn->cb_prog = se->se_callback_prog;
3067         conn->cb_ident = se->se_callback_ident;
3068         memcpy(&conn->cb_saddr, &rqstp->rq_daddr, rqstp->rq_daddrlen);
3069         trace_nfsd_cb_args(clp, conn);
3070         return;
3071 out_err:
3072         conn->cb_addr.ss_family = AF_UNSPEC;
3073         conn->cb_addrlen = 0;
3074         trace_nfsd_cb_nodelegs(clp);
3075         return;
3076 }
3077
3078 /*
3079  * Cache a reply. nfsd4_check_resp_size() has bounded the cache size.
3080  */
3081 static void
3082 nfsd4_store_cache_entry(struct nfsd4_compoundres *resp)
3083 {
3084         struct xdr_buf *buf = resp->xdr->buf;
3085         struct nfsd4_slot *slot = resp->cstate.slot;
3086         unsigned int base;
3087
3088         dprintk("--> %s slot %p\n", __func__, slot);
3089
3090         slot->sl_flags |= NFSD4_SLOT_INITIALIZED;
3091         slot->sl_opcnt = resp->opcnt;
3092         slot->sl_status = resp->cstate.status;
3093         free_svc_cred(&slot->sl_cred);
3094         copy_cred(&slot->sl_cred, &resp->rqstp->rq_cred);
3095
3096         if (!nfsd4_cache_this(resp)) {
3097                 slot->sl_flags &= ~NFSD4_SLOT_CACHED;
3098                 return;
3099         }
3100         slot->sl_flags |= NFSD4_SLOT_CACHED;
3101
3102         base = resp->cstate.data_offset;
3103         slot->sl_datalen = buf->len - base;
3104         if (read_bytes_from_xdr_buf(buf, base, slot->sl_data, slot->sl_datalen))
3105                 WARN(1, "%s: sessions DRC could not cache compound\n",
3106                      __func__);
3107         return;
3108 }
3109
3110 /*
3111  * Encode the replay sequence operation from the slot values.
3112  * If cachethis is FALSE encode the uncached rep error on the next
3113  * operation which sets resp->p and increments resp->opcnt for
3114  * nfs4svc_encode_compoundres.
3115  *
3116  */
3117 static __be32
3118 nfsd4_enc_sequence_replay(struct nfsd4_compoundargs *args,
3119                           struct nfsd4_compoundres *resp)
3120 {
3121         struct nfsd4_op *op;
3122         struct nfsd4_slot *slot = resp->cstate.slot;
3123
3124         /* Encode the replayed sequence operation */
3125         op = &args->ops[resp->opcnt - 1];
3126         nfsd4_encode_operation(resp, op);
3127
3128         if (slot->sl_flags & NFSD4_SLOT_CACHED)
3129                 return op->status;
3130         if (args->opcnt == 1) {
3131                 /*
3132                  * The original operation wasn't a solo sequence--we
3133                  * always cache those--so this retry must not match the
3134                  * original:
3135                  */
3136                 op->status = nfserr_seq_false_retry;
3137         } else {
3138                 op = &args->ops[resp->opcnt++];
3139                 op->status = nfserr_retry_uncached_rep;
3140                 nfsd4_encode_operation(resp, op);
3141         }
3142         return op->status;
3143 }
3144
3145 /*
3146  * The sequence operation is not cached because we can use the slot and
3147  * session values.
3148  */
3149 static __be32
3150 nfsd4_replay_cache_entry(struct nfsd4_compoundres *resp,
3151                          struct nfsd4_sequence *seq)
3152 {
3153         struct nfsd4_slot *slot = resp->cstate.slot;
3154         struct xdr_stream *xdr = resp->xdr;
3155         __be32 *p;
3156         __be32 status;
3157
3158         dprintk("--> %s slot %p\n", __func__, slot);
3159
3160         status = nfsd4_enc_sequence_replay(resp->rqstp->rq_argp, resp);
3161         if (status)
3162                 return status;
3163
3164         p = xdr_reserve_space(xdr, slot->sl_datalen);
3165         if (!p) {
3166                 WARN_ON_ONCE(1);
3167                 return nfserr_serverfault;
3168         }
3169         xdr_encode_opaque_fixed(p, slot->sl_data, slot->sl_datalen);
3170         xdr_commit_encode(xdr);
3171
3172         resp->opcnt = slot->sl_opcnt;
3173         return slot->sl_status;
3174 }
3175
3176 /*
3177  * Set the exchange_id flags returned by the server.
3178  */
3179 static void
3180 nfsd4_set_ex_flags(struct nfs4_client *new, struct nfsd4_exchange_id *clid)
3181 {
3182 #ifdef CONFIG_NFSD_PNFS
3183         new->cl_exchange_flags |= EXCHGID4_FLAG_USE_PNFS_MDS;
3184 #else
3185         new->cl_exchange_flags |= EXCHGID4_FLAG_USE_NON_PNFS;
3186 #endif
3187
3188         /* Referrals are supported, Migration is not. */
3189         new->cl_exchange_flags |= EXCHGID4_FLAG_SUPP_MOVED_REFER;
3190
3191         /* set the wire flags to return to client. */
3192         clid->flags = new->cl_exchange_flags;
3193 }
3194
3195 static bool client_has_openowners(struct nfs4_client *clp)
3196 {
3197         struct nfs4_openowner *oo;
3198
3199         list_for_each_entry(oo, &clp->cl_openowners, oo_perclient) {
3200                 if (!list_empty(&oo->oo_owner.so_stateids))
3201                         return true;
3202         }
3203         return false;
3204 }
3205
3206 static bool client_has_state(struct nfs4_client *clp)
3207 {
3208         return client_has_openowners(clp)
3209 #ifdef CONFIG_NFSD_PNFS
3210                 || !list_empty(&clp->cl_lo_states)
3211 #endif
3212                 || !list_empty(&clp->cl_delegations)
3213                 || !list_empty(&clp->cl_sessions)
3214                 || !list_empty(&clp->async_copies);
3215 }
3216
3217 static __be32 copy_impl_id(struct nfs4_client *clp,
3218                                 struct nfsd4_exchange_id *exid)
3219 {
3220         if (!exid->nii_domain.data)
3221                 return 0;
3222         xdr_netobj_dup(&clp->cl_nii_domain, &exid->nii_domain, GFP_KERNEL);
3223         if (!clp->cl_nii_domain.data)
3224                 return nfserr_jukebox;
3225         xdr_netobj_dup(&clp->cl_nii_name, &exid->nii_name, GFP_KERNEL);
3226         if (!clp->cl_nii_name.data)
3227                 return nfserr_jukebox;
3228         clp->cl_nii_time = exid->nii_time;
3229         return 0;
3230 }
3231
3232 __be32
3233 nfsd4_exchange_id(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
3234                 union nfsd4_op_u *u)
3235 {
3236         struct nfsd4_exchange_id *exid = &u->exchange_id;
3237         struct nfs4_client *conf, *new;
3238         struct nfs4_client *unconf = NULL;
3239         __be32 status;
3240         char                    addr_str[INET6_ADDRSTRLEN];
3241         nfs4_verifier           verf = exid->verifier;
3242         struct sockaddr         *sa = svc_addr(rqstp);
3243         bool    update = exid->flags & EXCHGID4_FLAG_UPD_CONFIRMED_REC_A;
3244         struct nfsd_net         *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
3245
3246         rpc_ntop(sa, addr_str, sizeof(addr_str));
3247         dprintk("%s rqstp=%p exid=%p clname.len=%u clname.data=%p "
3248                 "ip_addr=%s flags %x, spa_how %u\n",
3249                 __func__, rqstp, exid, exid->clname.len, exid->clname.data,
3250                 addr_str, exid->flags, exid->spa_how);
3251
3252         if (exid->flags & ~EXCHGID4_FLAG_MASK_A)
3253                 return nfserr_inval;
3254
3255         new = create_client(exid->clname, rqstp, &verf);
3256         if (new == NULL)
3257                 return nfserr_jukebox;
3258         status = copy_impl_id(new, exid);
3259         if (status)
3260                 goto out_nolock;
3261
3262         switch (exid->spa_how) {
3263         case SP4_MACH_CRED:
3264                 exid->spo_must_enforce[0] = 0;
3265                 exid->spo_must_enforce[1] = (
3266                         1 << (OP_BIND_CONN_TO_SESSION - 32) |
3267                         1 << (OP_EXCHANGE_ID - 32) |
3268                         1 << (OP_CREATE_SESSION - 32) |
3269                         1 << (OP_DESTROY_SESSION - 32) |
3270                         1 << (OP_DESTROY_CLIENTID - 32));
3271
3272                 exid->spo_must_allow[0] &= (1 << (OP_CLOSE) |
3273                                         1 << (OP_OPEN_DOWNGRADE) |
3274                                         1 << (OP_LOCKU) |
3275                                         1 << (OP_DELEGRETURN));
3276
3277                 exid->spo_must_allow[1] &= (
3278                                         1 << (OP_TEST_STATEID - 32) |
3279                                         1 << (OP_FREE_STATEID - 32));
3280                 if (!svc_rqst_integrity_protected(rqstp)) {
3281                         status = nfserr_inval;
3282                         goto out_nolock;
3283                 }
3284                 /*
3285                  * Sometimes userspace doesn't give us a principal.
3286                  * Which is a bug, really.  Anyway, we can't enforce
3287                  * MACH_CRED in that case, better to give up now:
3288                  */
3289                 if (!new->cl_cred.cr_principal &&
3290                                         !new->cl_cred.cr_raw_principal) {
3291                         status = nfserr_serverfault;
3292                         goto out_nolock;
3293                 }
3294                 new->cl_mach_cred = true;
3295                 break;
3296         case SP4_NONE:
3297                 break;
3298         default:                                /* checked by xdr code */
3299                 WARN_ON_ONCE(1);
3300                 fallthrough;
3301         case SP4_SSV:
3302                 status = nfserr_encr_alg_unsupp;
3303                 goto out_nolock;
3304         }
3305
3306         /* Cases below refer to rfc 5661 section 18.35.4: */
3307         spin_lock(&nn->client_lock);
3308         conf = find_confirmed_client_by_name(&exid->clname, nn);
3309         if (conf) {
3310                 bool creds_match = same_creds(&conf->cl_cred, &rqstp->rq_cred);
3311                 bool verfs_match = same_verf(&verf, &conf->cl_verifier);
3312
3313                 if (update) {
3314                         if (!clp_used_exchangeid(conf)) { /* buggy client */
3315                                 status = nfserr_inval;
3316                                 goto out;
3317                         }
3318                         if (!nfsd4_mach_creds_match(conf, rqstp)) {
3319                                 status = nfserr_wrong_cred;
3320                                 goto out;
3321                         }
3322                         if (!creds_match) { /* case 9 */
3323                                 status = nfserr_perm;
3324                                 goto out;
3325                         }
3326                         if (!verfs_match) { /* case 8 */
3327                                 status = nfserr_not_same;
3328                                 goto out;
3329                         }
3330                         /* case 6 */
3331                         exid->flags |= EXCHGID4_FLAG_CONFIRMED_R;
3332                         trace_nfsd_clid_confirmed_r(conf);
3333                         goto out_copy;
3334                 }
3335                 if (!creds_match) { /* case 3 */
3336                         if (client_has_state(conf)) {
3337                                 status = nfserr_clid_inuse;
3338                                 trace_nfsd_clid_cred_mismatch(conf, rqstp);
3339                                 goto out;
3340                         }
3341                         goto out_new;
3342                 }
3343                 if (verfs_match) { /* case 2 */
3344                         conf->cl_exchange_flags |= EXCHGID4_FLAG_CONFIRMED_R;
3345                         trace_nfsd_clid_confirmed_r(conf);
3346                         goto out_copy;
3347                 }
3348                 /* case 5, client reboot */
3349                 trace_nfsd_clid_verf_mismatch(conf, rqstp, &verf);
3350                 conf = NULL;
3351                 goto out_new;
3352         }
3353
3354         if (update) { /* case 7 */
3355                 status = nfserr_noent;
3356                 goto out;
3357         }
3358
3359         unconf = find_unconfirmed_client_by_name(&exid->clname, nn);
3360         if (unconf) /* case 4, possible retry or client restart */
3361                 unhash_client_locked(unconf);
3362
3363         /* case 1, new owner ID */
3364         trace_nfsd_clid_fresh(new);
3365
3366 out_new:
3367         if (conf) {
3368                 status = mark_client_expired_locked(conf);
3369                 if (status)
3370                         goto out;
3371                 trace_nfsd_clid_replaced(&conf->cl_clientid);
3372         }
3373         new->cl_minorversion = cstate->minorversion;
3374         new->cl_spo_must_allow.u.words[0] = exid->spo_must_allow[0];
3375         new->cl_spo_must_allow.u.words[1] = exid->spo_must_allow[1];
3376
3377         add_to_unconfirmed(new);
3378         swap(new, conf);
3379 out_copy:
3380         exid->clientid.cl_boot = conf->cl_clientid.cl_boot;
3381         exid->clientid.cl_id = conf->cl_clientid.cl_id;
3382
3383         exid->seqid = conf->cl_cs_slot.sl_seqid + 1;
3384         nfsd4_set_ex_flags(conf, exid);
3385
3386         dprintk("nfsd4_exchange_id seqid %d flags %x\n",
3387                 conf->cl_cs_slot.sl_seqid, conf->cl_exchange_flags);
3388         status = nfs_ok;
3389
3390 out:
3391         spin_unlock(&nn->client_lock);
3392 out_nolock:
3393         if (new)
3394                 expire_client(new);
3395         if (unconf) {
3396                 trace_nfsd_clid_expire_unconf(&unconf->cl_clientid);
3397                 expire_client(unconf);
3398         }
3399         return status;
3400 }
3401
3402 static __be32
3403 check_slot_seqid(u32 seqid, u32 slot_seqid, int slot_inuse)
3404 {
3405         dprintk("%s enter. seqid %d slot_seqid %d\n", __func__, seqid,
3406                 slot_seqid);
3407
3408         /* The slot is in use, and no response has been sent. */
3409         if (slot_inuse) {
3410                 if (seqid == slot_seqid)
3411                         return nfserr_jukebox;
3412                 else
3413                         return nfserr_seq_misordered;
3414         }
3415         /* Note unsigned 32-bit arithmetic handles wraparound: */
3416         if (likely(seqid == slot_seqid + 1))
3417                 return nfs_ok;
3418         if (seqid == slot_seqid)
3419                 return nfserr_replay_cache;
3420         return nfserr_seq_misordered;
3421 }
3422
3423 /*
3424  * Cache the create session result into the create session single DRC
3425  * slot cache by saving the xdr structure. sl_seqid has been set.
3426  * Do this for solo or embedded create session operations.
3427  */
3428 static void
3429 nfsd4_cache_create_session(struct nfsd4_create_session *cr_ses,
3430                            struct nfsd4_clid_slot *slot, __be32 nfserr)
3431 {
3432         slot->sl_status = nfserr;
3433         memcpy(&slot->sl_cr_ses, cr_ses, sizeof(*cr_ses));
3434 }
3435
3436 static __be32
3437 nfsd4_replay_create_session(struct nfsd4_create_session *cr_ses,
3438                             struct nfsd4_clid_slot *slot)
3439 {
3440         memcpy(cr_ses, &slot->sl_cr_ses, sizeof(*cr_ses));
3441         return slot->sl_status;
3442 }
3443
3444 #define NFSD_MIN_REQ_HDR_SEQ_SZ ((\
3445                         2 * 2 + /* credential,verifier: AUTH_NULL, length 0 */ \
3446                         1 +     /* MIN tag is length with zero, only length */ \
3447                         3 +     /* version, opcount, opcode */ \
3448                         XDR_QUADLEN(NFS4_MAX_SESSIONID_LEN) + \
3449                                 /* seqid, slotID, slotID, cache */ \
3450                         4 ) * sizeof(__be32))
3451
3452 #define NFSD_MIN_RESP_HDR_SEQ_SZ ((\
3453                         2 +     /* verifier: AUTH_NULL, length 0 */\
3454                         1 +     /* status */ \
3455                         1 +     /* MIN tag is length with zero, only length */ \
3456                         3 +     /* opcount, opcode, opstatus*/ \
3457                         XDR_QUADLEN(NFS4_MAX_SESSIONID_LEN) + \
3458                                 /* seqid, slotID, slotID, slotID, status */ \
3459                         5 ) * sizeof(__be32))
3460
3461 static __be32 check_forechannel_attrs(struct nfsd4_channel_attrs *ca, struct nfsd_net *nn)
3462 {
3463         u32 maxrpc = nn->nfsd_serv->sv_max_mesg;
3464
3465         if (ca->maxreq_sz < NFSD_MIN_REQ_HDR_SEQ_SZ)
3466                 return nfserr_toosmall;
3467         if (ca->maxresp_sz < NFSD_MIN_RESP_HDR_SEQ_SZ)
3468                 return nfserr_toosmall;
3469         ca->headerpadsz = 0;
3470         ca->maxreq_sz = min_t(u32, ca->maxreq_sz, maxrpc);
3471         ca->maxresp_sz = min_t(u32, ca->maxresp_sz, maxrpc);
3472         ca->maxops = min_t(u32, ca->maxops, NFSD_MAX_OPS_PER_COMPOUND);
3473         ca->maxresp_cached = min_t(u32, ca->maxresp_cached,
3474                         NFSD_SLOT_CACHE_SIZE + NFSD_MIN_HDR_SEQ_SZ);
3475         ca->maxreqs = min_t(u32, ca->maxreqs, NFSD_MAX_SLOTS_PER_SESSION);
3476         /*
3477          * Note decreasing slot size below client's request may make it
3478          * difficult for client to function correctly, whereas
3479          * decreasing the number of slots will (just?) affect
3480          * performance.  When short on memory we therefore prefer to
3481          * decrease number of slots instead of their size.  Clients that
3482          * request larger slots than they need will get poor results:
3483          * Note that we always allow at least one slot, because our
3484          * accounting is soft and provides no guarantees either way.
3485          */
3486         ca->maxreqs = nfsd4_get_drc_mem(ca, nn);
3487
3488         return nfs_ok;
3489 }
3490
3491 /*
3492  * Server's NFSv4.1 backchannel support is AUTH_SYS-only for now.
3493  * These are based on similar macros in linux/sunrpc/msg_prot.h .
3494  */
3495 #define RPC_MAX_HEADER_WITH_AUTH_SYS \
3496         (RPC_CALLHDRSIZE + 2 * (2 + UNX_CALLSLACK))
3497
3498 #define RPC_MAX_REPHEADER_WITH_AUTH_SYS \
3499         (RPC_REPHDRSIZE + (2 + NUL_REPLYSLACK))
3500
3501 #define NFSD_CB_MAX_REQ_SZ      ((NFS4_enc_cb_recall_sz + \
3502                                  RPC_MAX_HEADER_WITH_AUTH_SYS) * sizeof(__be32))
3503 #define NFSD_CB_MAX_RESP_SZ     ((NFS4_dec_cb_recall_sz + \
3504                                  RPC_MAX_REPHEADER_WITH_AUTH_SYS) * \
3505                                  sizeof(__be32))
3506
3507 static __be32 check_backchannel_attrs(struct nfsd4_channel_attrs *ca)
3508 {
3509         ca->headerpadsz = 0;
3510
3511         if (ca->maxreq_sz < NFSD_CB_MAX_REQ_SZ)
3512                 return nfserr_toosmall;
3513         if (ca->maxresp_sz < NFSD_CB_MAX_RESP_SZ)
3514                 return nfserr_toosmall;
3515         ca->maxresp_cached = 0;
3516         if (ca->maxops < 2)
3517                 return nfserr_toosmall;
3518
3519         return nfs_ok;
3520 }
3521
3522 static __be32 nfsd4_check_cb_sec(struct nfsd4_cb_sec *cbs)
3523 {
3524         switch (cbs->flavor) {
3525         case RPC_AUTH_NULL:
3526         case RPC_AUTH_UNIX:
3527                 return nfs_ok;
3528         default:
3529                 /*
3530                  * GSS case: the spec doesn't allow us to return this
3531                  * error.  But it also doesn't allow us not to support
3532                  * GSS.
3533                  * I'd rather this fail hard than return some error the
3534                  * client might think it can already handle:
3535                  */
3536                 return nfserr_encr_alg_unsupp;
3537         }
3538 }
3539
3540 __be32
3541 nfsd4_create_session(struct svc_rqst *rqstp,
3542                 struct nfsd4_compound_state *cstate, union nfsd4_op_u *u)
3543 {
3544         struct nfsd4_create_session *cr_ses = &u->create_session;
3545         struct sockaddr *sa = svc_addr(rqstp);
3546         struct nfs4_client *conf, *unconf;
3547         struct nfs4_client *old = NULL;
3548         struct nfsd4_session *new;
3549         struct nfsd4_conn *conn;
3550         struct nfsd4_clid_slot *cs_slot = NULL;
3551         __be32 status = 0;
3552         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
3553
3554         if (cr_ses->flags & ~SESSION4_FLAG_MASK_A)
3555                 return nfserr_inval;
3556         status = nfsd4_check_cb_sec(&cr_ses->cb_sec);
3557         if (status)
3558                 return status;
3559         status = check_forechannel_attrs(&cr_ses->fore_channel, nn);
3560         if (status)
3561                 return status;
3562         status = check_backchannel_attrs(&cr_ses->back_channel);
3563         if (status)
3564                 goto out_release_drc_mem;
3565         status = nfserr_jukebox;
3566         new = alloc_session(&cr_ses->fore_channel, &cr_ses->back_channel);
3567         if (!new)
3568                 goto out_release_drc_mem;
3569         conn = alloc_conn_from_crses(rqstp, cr_ses);
3570         if (!conn)
3571                 goto out_free_session;
3572
3573         spin_lock(&nn->client_lock);
3574         unconf = find_unconfirmed_client(&cr_ses->clientid, true, nn);
3575         conf = find_confirmed_client(&cr_ses->clientid, true, nn);
3576         WARN_ON_ONCE(conf && unconf);
3577
3578         if (conf) {
3579                 status = nfserr_wrong_cred;
3580                 if (!nfsd4_mach_creds_match(conf, rqstp))
3581                         goto out_free_conn;
3582                 cs_slot = &conf->cl_cs_slot;
3583                 status = check_slot_seqid(cr_ses->seqid, cs_slot->sl_seqid, 0);
3584                 if (status) {
3585                         if (status == nfserr_replay_cache)
3586                                 status = nfsd4_replay_create_session(cr_ses, cs_slot);
3587                         goto out_free_conn;
3588                 }
3589         } else if (unconf) {
3590                 status = nfserr_clid_inuse;
3591                 if (!same_creds(&unconf->cl_cred, &rqstp->rq_cred) ||
3592                     !rpc_cmp_addr(sa, (struct sockaddr *) &unconf->cl_addr)) {
3593                         trace_nfsd_clid_cred_mismatch(unconf, rqstp);
3594                         goto out_free_conn;
3595                 }
3596                 status = nfserr_wrong_cred;
3597                 if (!nfsd4_mach_creds_match(unconf, rqstp))
3598                         goto out_free_conn;
3599                 cs_slot = &unconf->cl_cs_slot;
3600                 status = check_slot_seqid(cr_ses->seqid, cs_slot->sl_seqid, 0);
3601                 if (status) {
3602                         /* an unconfirmed replay returns misordered */
3603                         status = nfserr_seq_misordered;
3604                         goto out_free_conn;
3605                 }
3606                 old = find_confirmed_client_by_name(&unconf->cl_name, nn);
3607                 if (old) {
3608                         status = mark_client_expired_locked(old);
3609                         if (status) {
3610                                 old = NULL;
3611                                 goto out_free_conn;
3612                         }
3613                         trace_nfsd_clid_replaced(&old->cl_clientid);
3614                 }
3615                 move_to_confirmed(unconf);
3616                 conf = unconf;
3617         } else {
3618                 status = nfserr_stale_clientid;
3619                 goto out_free_conn;
3620         }
3621         status = nfs_ok;
3622         /* Persistent sessions are not supported */
3623         cr_ses->flags &= ~SESSION4_PERSIST;
3624         /* Upshifting from TCP to RDMA is not supported */
3625         cr_ses->flags &= ~SESSION4_RDMA;
3626
3627         init_session(rqstp, new, conf, cr_ses);
3628         nfsd4_get_session_locked(new);
3629
3630         memcpy(cr_ses->sessionid.data, new->se_sessionid.data,
3631                NFS4_MAX_SESSIONID_LEN);
3632         cs_slot->sl_seqid++;
3633         cr_ses->seqid = cs_slot->sl_seqid;
3634
3635         /* cache solo and embedded create sessions under the client_lock */
3636         nfsd4_cache_create_session(cr_ses, cs_slot, status);
3637         spin_unlock(&nn->client_lock);
3638         if (conf == unconf)
3639                 fsnotify_dentry(conf->cl_nfsd_info_dentry, FS_MODIFY);
3640         /* init connection and backchannel */
3641         nfsd4_init_conn(rqstp, conn, new);
3642         nfsd4_put_session(new);
3643         if (old)
3644                 expire_client(old);
3645         return status;
3646 out_free_conn:
3647         spin_unlock(&nn->client_lock);
3648         free_conn(conn);
3649         if (old)
3650                 expire_client(old);
3651 out_free_session:
3652         __free_session(new);
3653 out_release_drc_mem:
3654         nfsd4_put_drc_mem(&cr_ses->fore_channel);
3655         return status;
3656 }
3657
3658 static __be32 nfsd4_map_bcts_dir(u32 *dir)
3659 {
3660         switch (*dir) {
3661         case NFS4_CDFC4_FORE:
3662         case NFS4_CDFC4_BACK:
3663                 return nfs_ok;
3664         case NFS4_CDFC4_FORE_OR_BOTH:
3665         case NFS4_CDFC4_BACK_OR_BOTH:
3666                 *dir = NFS4_CDFC4_BOTH;
3667                 return nfs_ok;
3668         }
3669         return nfserr_inval;
3670 }
3671
3672 __be32 nfsd4_backchannel_ctl(struct svc_rqst *rqstp,
3673                 struct nfsd4_compound_state *cstate,
3674                 union nfsd4_op_u *u)
3675 {
3676         struct nfsd4_backchannel_ctl *bc = &u->backchannel_ctl;
3677         struct nfsd4_session *session = cstate->session;
3678         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
3679         __be32 status;
3680
3681         status = nfsd4_check_cb_sec(&bc->bc_cb_sec);
3682         if (status)
3683                 return status;
3684         spin_lock(&nn->client_lock);
3685         session->se_cb_prog = bc->bc_cb_program;
3686         session->se_cb_sec = bc->bc_cb_sec;
3687         spin_unlock(&nn->client_lock);
3688
3689         nfsd4_probe_callback(session->se_client);
3690
3691         return nfs_ok;
3692 }
3693
3694 static struct nfsd4_conn *__nfsd4_find_conn(struct svc_xprt *xpt, struct nfsd4_session *s)
3695 {
3696         struct nfsd4_conn *c;
3697
3698         list_for_each_entry(c, &s->se_conns, cn_persession) {
3699                 if (c->cn_xprt == xpt) {
3700                         return c;
3701                 }
3702         }
3703         return NULL;
3704 }
3705
3706 static __be32 nfsd4_match_existing_connection(struct svc_rqst *rqst,
3707                 struct nfsd4_session *session, u32 req, struct nfsd4_conn **conn)
3708 {
3709         struct nfs4_client *clp = session->se_client;
3710         struct svc_xprt *xpt = rqst->rq_xprt;
3711         struct nfsd4_conn *c;
3712         __be32 status;
3713
3714         /* Following the last paragraph of RFC 5661 Section 18.34.3: */
3715         spin_lock(&clp->cl_lock);
3716         c = __nfsd4_find_conn(xpt, session);
3717         if (!c)
3718                 status = nfserr_noent;
3719         else if (req == c->cn_flags)
3720                 status = nfs_ok;
3721         else if (req == NFS4_CDFC4_FORE_OR_BOTH &&
3722                                 c->cn_flags != NFS4_CDFC4_BACK)
3723                 status = nfs_ok;
3724         else if (req == NFS4_CDFC4_BACK_OR_BOTH &&
3725                                 c->cn_flags != NFS4_CDFC4_FORE)
3726                 status = nfs_ok;
3727         else
3728                 status = nfserr_inval;
3729         spin_unlock(&clp->cl_lock);
3730         if (status == nfs_ok && conn)
3731                 *conn = c;
3732         return status;
3733 }
3734
3735 __be32 nfsd4_bind_conn_to_session(struct svc_rqst *rqstp,
3736                      struct nfsd4_compound_state *cstate,
3737                      union nfsd4_op_u *u)
3738 {
3739         struct nfsd4_bind_conn_to_session *bcts = &u->bind_conn_to_session;
3740         __be32 status;
3741         struct nfsd4_conn *conn;
3742         struct nfsd4_session *session;
3743         struct net *net = SVC_NET(rqstp);
3744         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
3745
3746         if (!nfsd4_last_compound_op(rqstp))
3747                 return nfserr_not_only_op;
3748         spin_lock(&nn->client_lock);
3749         session = find_in_sessionid_hashtbl(&bcts->sessionid, net, &status);
3750         spin_unlock(&nn->client_lock);
3751         if (!session)
3752                 goto out_no_session;
3753         status = nfserr_wrong_cred;
3754         if (!nfsd4_mach_creds_match(session->se_client, rqstp))
3755                 goto out;
3756         status = nfsd4_match_existing_connection(rqstp, session,
3757                         bcts->dir, &conn);
3758         if (status == nfs_ok) {
3759                 if (bcts->dir == NFS4_CDFC4_FORE_OR_BOTH ||
3760                                 bcts->dir == NFS4_CDFC4_BACK)
3761                         conn->cn_flags |= NFS4_CDFC4_BACK;
3762                 nfsd4_probe_callback(session->se_client);
3763                 goto out;
3764         }
3765         if (status == nfserr_inval)
3766                 goto out;
3767         status = nfsd4_map_bcts_dir(&bcts->dir);
3768         if (status)
3769                 goto out;
3770         conn = alloc_conn(rqstp, bcts->dir);
3771         status = nfserr_jukebox;
3772         if (!conn)
3773                 goto out;
3774         nfsd4_init_conn(rqstp, conn, session);
3775         status = nfs_ok;
3776 out:
3777         nfsd4_put_session(session);
3778 out_no_session:
3779         return status;
3780 }
3781
3782 static bool nfsd4_compound_in_session(struct nfsd4_compound_state *cstate, struct nfs4_sessionid *sid)
3783 {
3784         if (!cstate->session)
3785                 return false;
3786         return !memcmp(sid, &cstate->session->se_sessionid, sizeof(*sid));
3787 }
3788
3789 __be32
3790 nfsd4_destroy_session(struct svc_rqst *r, struct nfsd4_compound_state *cstate,
3791                 union nfsd4_op_u *u)
3792 {
3793         struct nfs4_sessionid *sessionid = &u->destroy_session.sessionid;
3794         struct nfsd4_session *ses;
3795         __be32 status;
3796         int ref_held_by_me = 0;
3797         struct net *net = SVC_NET(r);
3798         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
3799
3800         status = nfserr_not_only_op;
3801         if (nfsd4_compound_in_session(cstate, sessionid)) {
3802                 if (!nfsd4_last_compound_op(r))
3803                         goto out;
3804                 ref_held_by_me++;
3805         }
3806         dump_sessionid(__func__, sessionid);
3807         spin_lock(&nn->client_lock);
3808         ses = find_in_sessionid_hashtbl(sessionid, net, &status);
3809         if (!ses)
3810                 goto out_client_lock;
3811         status = nfserr_wrong_cred;
3812         if (!nfsd4_mach_creds_match(ses->se_client, r))
3813                 goto out_put_session;
3814         status = mark_session_dead_locked(ses, 1 + ref_held_by_me);
3815         if (status)
3816                 goto out_put_session;
3817         unhash_session(ses);
3818         spin_unlock(&nn->client_lock);
3819
3820         nfsd4_probe_callback_sync(ses->se_client);
3821
3822         spin_lock(&nn->client_lock);
3823         status = nfs_ok;
3824 out_put_session:
3825         nfsd4_put_session_locked(ses);
3826 out_client_lock:
3827         spin_unlock(&nn->client_lock);
3828 out:
3829         return status;
3830 }
3831
3832 static __be32 nfsd4_sequence_check_conn(struct nfsd4_conn *new, struct nfsd4_session *ses)
3833 {
3834         struct nfs4_client *clp = ses->se_client;
3835         struct nfsd4_conn *c;
3836         __be32 status = nfs_ok;
3837         int ret;
3838
3839         spin_lock(&clp->cl_lock);
3840         c = __nfsd4_find_conn(new->cn_xprt, ses);
3841         if (c)
3842                 goto out_free;
3843         status = nfserr_conn_not_bound_to_session;
3844         if (clp->cl_mach_cred)
3845                 goto out_free;
3846         __nfsd4_hash_conn(new, ses);
3847         spin_unlock(&clp->cl_lock);
3848         ret = nfsd4_register_conn(new);
3849         if (ret)
3850                 /* oops; xprt is already down: */
3851                 nfsd4_conn_lost(&new->cn_xpt_user);
3852         return nfs_ok;
3853 out_free:
3854         spin_unlock(&clp->cl_lock);
3855         free_conn(new);
3856         return status;
3857 }
3858
3859 static bool nfsd4_session_too_many_ops(struct svc_rqst *rqstp, struct nfsd4_session *session)
3860 {
3861         struct nfsd4_compoundargs *args = rqstp->rq_argp;
3862
3863         return args->opcnt > session->se_fchannel.maxops;
3864 }
3865
3866 static bool nfsd4_request_too_big(struct svc_rqst *rqstp,
3867                                   struct nfsd4_session *session)
3868 {
3869         struct xdr_buf *xb = &rqstp->rq_arg;
3870
3871         return xb->len > session->se_fchannel.maxreq_sz;
3872 }
3873
3874 static bool replay_matches_cache(struct svc_rqst *rqstp,
3875                  struct nfsd4_sequence *seq, struct nfsd4_slot *slot)
3876 {
3877         struct nfsd4_compoundargs *argp = rqstp->rq_argp;
3878
3879         if ((bool)(slot->sl_flags & NFSD4_SLOT_CACHETHIS) !=
3880             (bool)seq->cachethis)
3881                 return false;
3882         /*
3883          * If there's an error then the reply can have fewer ops than
3884          * the call.
3885          */
3886         if (slot->sl_opcnt < argp->opcnt && !slot->sl_status)
3887                 return false;
3888         /*
3889          * But if we cached a reply with *more* ops than the call you're
3890          * sending us now, then this new call is clearly not really a
3891          * replay of the old one:
3892          */
3893         if (slot->sl_opcnt > argp->opcnt)
3894                 return false;
3895         /* This is the only check explicitly called by spec: */
3896         if (!same_creds(&rqstp->rq_cred, &slot->sl_cred))
3897                 return false;
3898         /*
3899          * There may be more comparisons we could actually do, but the
3900          * spec doesn't require us to catch every case where the calls
3901          * don't match (that would require caching the call as well as
3902          * the reply), so we don't bother.
3903          */
3904         return true;
3905 }
3906
3907 __be32
3908 nfsd4_sequence(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
3909                 union nfsd4_op_u *u)
3910 {
3911         struct nfsd4_sequence *seq = &u->sequence;
3912         struct nfsd4_compoundres *resp = rqstp->rq_resp;
3913         struct xdr_stream *xdr = resp->xdr;
3914         struct nfsd4_session *session;
3915         struct nfs4_client *clp;
3916         struct nfsd4_slot *slot;
3917         struct nfsd4_conn *conn;
3918         __be32 status;
3919         int buflen;
3920         struct net *net = SVC_NET(rqstp);
3921         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
3922
3923         if (resp->opcnt != 1)
3924                 return nfserr_sequence_pos;
3925
3926         /*
3927          * Will be either used or freed by nfsd4_sequence_check_conn
3928          * below.
3929          */
3930         conn = alloc_conn(rqstp, NFS4_CDFC4_FORE);
3931         if (!conn)
3932                 return nfserr_jukebox;
3933
3934         spin_lock(&nn->client_lock);
3935         session = find_in_sessionid_hashtbl(&seq->sessionid, net, &status);
3936         if (!session)
3937                 goto out_no_session;
3938         clp = session->se_client;
3939
3940         status = nfserr_too_many_ops;
3941         if (nfsd4_session_too_many_ops(rqstp, session))
3942                 goto out_put_session;
3943
3944         status = nfserr_req_too_big;
3945         if (nfsd4_request_too_big(rqstp, session))
3946                 goto out_put_session;
3947
3948         status = nfserr_badslot;
3949         if (seq->slotid >= session->se_fchannel.maxreqs)
3950                 goto out_put_session;
3951
3952         slot = session->se_slots[seq->slotid];
3953         dprintk("%s: slotid %d\n", __func__, seq->slotid);
3954
3955         /* We do not negotiate the number of slots yet, so set the
3956          * maxslots to the session maxreqs which is used to encode
3957          * sr_highest_slotid and the sr_target_slot id to maxslots */
3958         seq->maxslots = session->se_fchannel.maxreqs;
3959
3960         status = check_slot_seqid(seq->seqid, slot->sl_seqid,
3961                                         slot->sl_flags & NFSD4_SLOT_INUSE);
3962         if (status == nfserr_replay_cache) {
3963                 status = nfserr_seq_misordered;
3964                 if (!(slot->sl_flags & NFSD4_SLOT_INITIALIZED))
3965                         goto out_put_session;
3966                 status = nfserr_seq_false_retry;
3967                 if (!replay_matches_cache(rqstp, seq, slot))
3968                         goto out_put_session;
3969                 cstate->slot = slot;
3970                 cstate->session = session;
3971                 cstate->clp = clp;
3972                 /* Return the cached reply status and set cstate->status
3973                  * for nfsd4_proc_compound processing */
3974                 status = nfsd4_replay_cache_entry(resp, seq);
3975                 cstate->status = nfserr_replay_cache;
3976                 goto out;
3977         }
3978         if (status)
3979                 goto out_put_session;
3980
3981         status = nfsd4_sequence_check_conn(conn, session);
3982         conn = NULL;
3983         if (status)
3984                 goto out_put_session;
3985
3986         buflen = (seq->cachethis) ?
3987                         session->se_fchannel.maxresp_cached :
3988                         session->se_fchannel.maxresp_sz;
3989         status = (seq->cachethis) ? nfserr_rep_too_big_to_cache :
3990                                     nfserr_rep_too_big;
3991         if (xdr_restrict_buflen(xdr, buflen - rqstp->rq_auth_slack))
3992                 goto out_put_session;
3993         svc_reserve(rqstp, buflen);
3994
3995         status = nfs_ok;
3996         /* Success! bump slot seqid */
3997         slot->sl_seqid = seq->seqid;
3998         slot->sl_flags |= NFSD4_SLOT_INUSE;
3999         if (seq->cachethis)
4000                 slot->sl_flags |= NFSD4_SLOT_CACHETHIS;
4001         else
4002                 slot->sl_flags &= ~NFSD4_SLOT_CACHETHIS;
4003
4004         cstate->slot = slot;
4005         cstate->session = session;
4006         cstate->clp = clp;
4007
4008 out:
4009         switch (clp->cl_cb_state) {
4010         case NFSD4_CB_DOWN:
4011                 seq->status_flags = SEQ4_STATUS_CB_PATH_DOWN;
4012                 break;
4013         case NFSD4_CB_FAULT:
4014                 seq->status_flags = SEQ4_STATUS_BACKCHANNEL_FAULT;
4015                 break;
4016         default:
4017                 seq->status_flags = 0;
4018         }
4019         if (!list_empty(&clp->cl_revoked))
4020                 seq->status_flags |= SEQ4_STATUS_RECALLABLE_STATE_REVOKED;
4021 out_no_session:
4022         if (conn)
4023                 free_conn(conn);
4024         spin_unlock(&nn->client_lock);
4025         return status;
4026 out_put_session:
4027         nfsd4_put_session_locked(session);
4028         goto out_no_session;
4029 }
4030
4031 void
4032 nfsd4_sequence_done(struct nfsd4_compoundres *resp)
4033 {
4034         struct nfsd4_compound_state *cs = &resp->cstate;
4035
4036         if (nfsd4_has_session(cs)) {
4037                 if (cs->status != nfserr_replay_cache) {
4038                         nfsd4_store_cache_entry(resp);
4039                         cs->slot->sl_flags &= ~NFSD4_SLOT_INUSE;
4040                 }
4041                 /* Drop session reference that was taken in nfsd4_sequence() */
4042                 nfsd4_put_session(cs->session);
4043         } else if (cs->clp)
4044                 put_client_renew(cs->clp);
4045 }
4046
4047 __be32
4048 nfsd4_destroy_clientid(struct svc_rqst *rqstp,
4049                 struct nfsd4_compound_state *cstate,
4050                 union nfsd4_op_u *u)
4051 {
4052         struct nfsd4_destroy_clientid *dc = &u->destroy_clientid;
4053         struct nfs4_client *conf, *unconf;
4054         struct nfs4_client *clp = NULL;
4055         __be32 status = 0;
4056         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
4057
4058         spin_lock(&nn->client_lock);
4059         unconf = find_unconfirmed_client(&dc->clientid, true, nn);
4060         conf = find_confirmed_client(&dc->clientid, true, nn);
4061         WARN_ON_ONCE(conf && unconf);
4062
4063         if (conf) {
4064                 if (client_has_state(conf)) {
4065                         status = nfserr_clientid_busy;
4066                         goto out;
4067                 }
4068                 status = mark_client_expired_locked(conf);
4069                 if (status)
4070                         goto out;
4071                 clp = conf;
4072         } else if (unconf)
4073                 clp = unconf;
4074         else {
4075                 status = nfserr_stale_clientid;
4076                 goto out;
4077         }
4078         if (!nfsd4_mach_creds_match(clp, rqstp)) {
4079                 clp = NULL;
4080                 status = nfserr_wrong_cred;
4081                 goto out;
4082         }
4083         trace_nfsd_clid_destroyed(&clp->cl_clientid);
4084         unhash_client_locked(clp);
4085 out:
4086         spin_unlock(&nn->client_lock);
4087         if (clp)
4088                 expire_client(clp);
4089         return status;
4090 }
4091
4092 __be32
4093 nfsd4_reclaim_complete(struct svc_rqst *rqstp,
4094                 struct nfsd4_compound_state *cstate, union nfsd4_op_u *u)
4095 {
4096         struct nfsd4_reclaim_complete *rc = &u->reclaim_complete;
4097         struct nfs4_client *clp = cstate->clp;
4098         __be32 status = 0;
4099
4100         if (rc->rca_one_fs) {
4101                 if (!cstate->current_fh.fh_dentry)
4102                         return nfserr_nofilehandle;
4103                 /*
4104                  * We don't take advantage of the rca_one_fs case.
4105                  * That's OK, it's optional, we can safely ignore it.
4106                  */
4107                 return nfs_ok;
4108         }
4109
4110         status = nfserr_complete_already;
4111         if (test_and_set_bit(NFSD4_CLIENT_RECLAIM_COMPLETE, &clp->cl_flags))
4112                 goto out;
4113
4114         status = nfserr_stale_clientid;
4115         if (is_client_expired(clp))
4116                 /*
4117                  * The following error isn't really legal.
4118                  * But we only get here if the client just explicitly
4119                  * destroyed the client.  Surely it no longer cares what
4120                  * error it gets back on an operation for the dead
4121                  * client.
4122                  */
4123                 goto out;
4124
4125         status = nfs_ok;
4126         trace_nfsd_clid_reclaim_complete(&clp->cl_clientid);
4127         nfsd4_client_record_create(clp);
4128         inc_reclaim_complete(clp);
4129 out:
4130         return status;
4131 }
4132
4133 __be32
4134 nfsd4_setclientid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
4135                   union nfsd4_op_u *u)
4136 {
4137         struct nfsd4_setclientid *setclid = &u->setclientid;
4138         struct xdr_netobj       clname = setclid->se_name;
4139         nfs4_verifier           clverifier = setclid->se_verf;
4140         struct nfs4_client      *conf, *new;
4141         struct nfs4_client      *unconf = NULL;
4142         __be32                  status;
4143         struct nfsd_net         *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
4144
4145         new = create_client(clname, rqstp, &clverifier);
4146         if (new == NULL)
4147                 return nfserr_jukebox;
4148         spin_lock(&nn->client_lock);
4149         conf = find_confirmed_client_by_name(&clname, nn);
4150         if (conf && client_has_state(conf)) {
4151                 status = nfserr_clid_inuse;
4152                 if (clp_used_exchangeid(conf))
4153                         goto out;
4154                 if (!same_creds(&conf->cl_cred, &rqstp->rq_cred)) {
4155                         trace_nfsd_clid_cred_mismatch(conf, rqstp);
4156                         goto out;
4157                 }
4158         }
4159         unconf = find_unconfirmed_client_by_name(&clname, nn);
4160         if (unconf)
4161                 unhash_client_locked(unconf);
4162         if (conf) {
4163                 if (same_verf(&conf->cl_verifier, &clverifier)) {
4164                         copy_clid(new, conf);
4165                         gen_confirm(new, nn);
4166                 } else
4167                         trace_nfsd_clid_verf_mismatch(conf, rqstp,
4168                                                       &clverifier);
4169         } else
4170                 trace_nfsd_clid_fresh(new);
4171         new->cl_minorversion = 0;
4172         gen_callback(new, setclid, rqstp);
4173         add_to_unconfirmed(new);
4174         setclid->se_clientid.cl_boot = new->cl_clientid.cl_boot;
4175         setclid->se_clientid.cl_id = new->cl_clientid.cl_id;
4176         memcpy(setclid->se_confirm.data, new->cl_confirm.data, sizeof(setclid->se_confirm.data));
4177         new = NULL;
4178         status = nfs_ok;
4179 out:
4180         spin_unlock(&nn->client_lock);
4181         if (new)
4182                 free_client(new);
4183         if (unconf) {
4184                 trace_nfsd_clid_expire_unconf(&unconf->cl_clientid);
4185                 expire_client(unconf);
4186         }
4187         return status;
4188 }
4189
4190 __be32
4191 nfsd4_setclientid_confirm(struct svc_rqst *rqstp,
4192                         struct nfsd4_compound_state *cstate,
4193                         union nfsd4_op_u *u)
4194 {
4195         struct nfsd4_setclientid_confirm *setclientid_confirm =
4196                         &u->setclientid_confirm;
4197         struct nfs4_client *conf, *unconf;
4198         struct nfs4_client *old = NULL;
4199         nfs4_verifier confirm = setclientid_confirm->sc_confirm;
4200         clientid_t * clid = &setclientid_confirm->sc_clientid;
4201         __be32 status;
4202         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
4203
4204         if (STALE_CLIENTID(clid, nn))
4205                 return nfserr_stale_clientid;
4206
4207         spin_lock(&nn->client_lock);
4208         conf = find_confirmed_client(clid, false, nn);
4209         unconf = find_unconfirmed_client(clid, false, nn);
4210         /*
4211          * We try hard to give out unique clientid's, so if we get an
4212          * attempt to confirm the same clientid with a different cred,
4213          * the client may be buggy; this should never happen.
4214          *
4215          * Nevertheless, RFC 7530 recommends INUSE for this case:
4216          */
4217         status = nfserr_clid_inuse;
4218         if (unconf && !same_creds(&unconf->cl_cred, &rqstp->rq_cred)) {
4219                 trace_nfsd_clid_cred_mismatch(unconf, rqstp);
4220                 goto out;
4221         }
4222         if (conf && !same_creds(&conf->cl_cred, &rqstp->rq_cred)) {
4223                 trace_nfsd_clid_cred_mismatch(conf, rqstp);
4224                 goto out;
4225         }
4226         if (!unconf || !same_verf(&confirm, &unconf->cl_confirm)) {
4227                 if (conf && same_verf(&confirm, &conf->cl_confirm)) {
4228                         status = nfs_ok;
4229                 } else
4230                         status = nfserr_stale_clientid;
4231                 goto out;
4232         }
4233         status = nfs_ok;
4234         if (conf) {
4235                 old = unconf;
4236                 unhash_client_locked(old);
4237                 nfsd4_change_callback(conf, &unconf->cl_cb_conn);
4238         } else {
4239                 old = find_confirmed_client_by_name(&unconf->cl_name, nn);
4240                 if (old) {
4241                         status = nfserr_clid_inuse;
4242                         if (client_has_state(old)
4243                                         && !same_creds(&unconf->cl_cred,
4244                                                         &old->cl_cred)) {
4245                                 old = NULL;
4246                                 goto out;
4247                         }
4248                         status = mark_client_expired_locked(old);
4249                         if (status) {
4250                                 old = NULL;
4251                                 goto out;
4252                         }
4253                         trace_nfsd_clid_replaced(&old->cl_clientid);
4254                 }
4255                 move_to_confirmed(unconf);
4256                 conf = unconf;
4257         }
4258         get_client_locked(conf);
4259         spin_unlock(&nn->client_lock);
4260         if (conf == unconf)
4261                 fsnotify_dentry(conf->cl_nfsd_info_dentry, FS_MODIFY);
4262         nfsd4_probe_callback(conf);
4263         spin_lock(&nn->client_lock);
4264         put_client_renew_locked(conf);
4265 out:
4266         spin_unlock(&nn->client_lock);
4267         if (old)
4268                 expire_client(old);
4269         return status;
4270 }
4271
4272 static struct nfs4_file *nfsd4_alloc_file(void)
4273 {
4274         return kmem_cache_alloc(file_slab, GFP_KERNEL);
4275 }
4276
4277 /* OPEN Share state helper functions */
4278 static void nfsd4_init_file(struct svc_fh *fh, unsigned int hashval,
4279                                 struct nfs4_file *fp)
4280 {
4281         lockdep_assert_held(&state_lock);
4282
4283         refcount_set(&fp->fi_ref, 1);
4284         spin_lock_init(&fp->fi_lock);
4285         INIT_LIST_HEAD(&fp->fi_stateids);
4286         INIT_LIST_HEAD(&fp->fi_delegations);
4287         INIT_LIST_HEAD(&fp->fi_clnt_odstate);
4288         fh_copy_shallow(&fp->fi_fhandle, &fh->fh_handle);
4289         fp->fi_deleg_file = NULL;
4290         fp->fi_had_conflict = false;
4291         fp->fi_share_deny = 0;
4292         memset(fp->fi_fds, 0, sizeof(fp->fi_fds));
4293         memset(fp->fi_access, 0, sizeof(fp->fi_access));
4294         fp->fi_aliased = false;
4295         fp->fi_inode = d_inode(fh->fh_dentry);
4296 #ifdef CONFIG_NFSD_PNFS
4297         INIT_LIST_HEAD(&fp->fi_lo_states);
4298         atomic_set(&fp->fi_lo_recalls, 0);
4299 #endif
4300         hlist_add_head_rcu(&fp->fi_hash, &file_hashtbl[hashval]);
4301 }
4302
4303 void
4304 nfsd4_free_slabs(void)
4305 {
4306         kmem_cache_destroy(client_slab);
4307         kmem_cache_destroy(openowner_slab);
4308         kmem_cache_destroy(lockowner_slab);
4309         kmem_cache_destroy(file_slab);
4310         kmem_cache_destroy(stateid_slab);
4311         kmem_cache_destroy(deleg_slab);
4312         kmem_cache_destroy(odstate_slab);
4313 }
4314
4315 int
4316 nfsd4_init_slabs(void)
4317 {
4318         client_slab = kmem_cache_create("nfsd4_clients",
4319                         sizeof(struct nfs4_client), 0, 0, NULL);
4320         if (client_slab == NULL)
4321                 goto out;
4322         openowner_slab = kmem_cache_create("nfsd4_openowners",
4323                         sizeof(struct nfs4_openowner), 0, 0, NULL);
4324         if (openowner_slab == NULL)
4325                 goto out_free_client_slab;
4326         lockowner_slab = kmem_cache_create("nfsd4_lockowners",
4327                         sizeof(struct nfs4_lockowner), 0, 0, NULL);
4328         if (lockowner_slab == NULL)
4329                 goto out_free_openowner_slab;
4330         file_slab = kmem_cache_create("nfsd4_files",
4331                         sizeof(struct nfs4_file), 0, 0, NULL);
4332         if (file_slab == NULL)
4333                 goto out_free_lockowner_slab;
4334         stateid_slab = kmem_cache_create("nfsd4_stateids",
4335                         sizeof(struct nfs4_ol_stateid), 0, 0, NULL);
4336         if (stateid_slab == NULL)
4337                 goto out_free_file_slab;
4338         deleg_slab = kmem_cache_create("nfsd4_delegations",
4339                         sizeof(struct nfs4_delegation), 0, 0, NULL);
4340         if (deleg_slab == NULL)
4341                 goto out_free_stateid_slab;
4342         odstate_slab = kmem_cache_create("nfsd4_odstate",
4343                         sizeof(struct nfs4_clnt_odstate), 0, 0, NULL);
4344         if (odstate_slab == NULL)
4345                 goto out_free_deleg_slab;
4346         return 0;
4347
4348 out_free_deleg_slab:
4349         kmem_cache_destroy(deleg_slab);
4350 out_free_stateid_slab:
4351         kmem_cache_destroy(stateid_slab);
4352 out_free_file_slab:
4353         kmem_cache_destroy(file_slab);
4354 out_free_lockowner_slab:
4355         kmem_cache_destroy(lockowner_slab);
4356 out_free_openowner_slab:
4357         kmem_cache_destroy(openowner_slab);
4358 out_free_client_slab:
4359         kmem_cache_destroy(client_slab);
4360 out:
4361         return -ENOMEM;
4362 }
4363
4364 static unsigned long
4365 nfsd_courtesy_client_count(struct shrinker *shrink, struct shrink_control *sc)
4366 {
4367         int cnt;
4368         struct nfsd_net *nn = container_of(shrink,
4369                         struct nfsd_net, nfsd_client_shrinker);
4370
4371         cnt = atomic_read(&nn->nfsd_courtesy_clients);
4372         if (cnt > 0)
4373                 mod_delayed_work(laundry_wq, &nn->nfsd_shrinker_work, 0);
4374         return (unsigned long)cnt;
4375 }
4376
4377 static unsigned long
4378 nfsd_courtesy_client_scan(struct shrinker *shrink, struct shrink_control *sc)
4379 {
4380         return SHRINK_STOP;
4381 }
4382
4383 int
4384 nfsd4_init_leases_net(struct nfsd_net *nn)
4385 {
4386         struct sysinfo si;
4387         u64 max_clients;
4388
4389         nn->nfsd4_lease = 90;   /* default lease time */
4390         nn->nfsd4_grace = 90;
4391         nn->somebody_reclaimed = false;
4392         nn->track_reclaim_completes = false;
4393         nn->clverifier_counter = get_random_u32();
4394         nn->clientid_base = get_random_u32();
4395         nn->clientid_counter = nn->clientid_base + 1;
4396         nn->s2s_cp_cl_id = nn->clientid_counter++;
4397
4398         atomic_set(&nn->nfs4_client_count, 0);
4399         si_meminfo(&si);
4400         max_clients = (u64)si.totalram * si.mem_unit / (1024 * 1024 * 1024);
4401         max_clients *= NFS4_CLIENTS_PER_GB;
4402         nn->nfs4_max_clients = max_t(int, max_clients, NFS4_CLIENTS_PER_GB);
4403
4404         atomic_set(&nn->nfsd_courtesy_clients, 0);
4405         nn->nfsd_client_shrinker.scan_objects = nfsd_courtesy_client_scan;
4406         nn->nfsd_client_shrinker.count_objects = nfsd_courtesy_client_count;
4407         nn->nfsd_client_shrinker.seeks = DEFAULT_SEEKS;
4408         return register_shrinker(&nn->nfsd_client_shrinker, "nfsd-client");
4409 }
4410
4411 void
4412 nfsd4_leases_net_shutdown(struct nfsd_net *nn)
4413 {
4414         unregister_shrinker(&nn->nfsd_client_shrinker);
4415 }
4416
4417 static void init_nfs4_replay(struct nfs4_replay *rp)
4418 {
4419         rp->rp_status = nfserr_serverfault;
4420         rp->rp_buflen = 0;
4421         rp->rp_buf = rp->rp_ibuf;
4422         mutex_init(&rp->rp_mutex);
4423 }
4424
4425 static void nfsd4_cstate_assign_replay(struct nfsd4_compound_state *cstate,
4426                 struct nfs4_stateowner *so)
4427 {
4428         if (!nfsd4_has_session(cstate)) {
4429                 mutex_lock(&so->so_replay.rp_mutex);
4430                 cstate->replay_owner = nfs4_get_stateowner(so);
4431         }
4432 }
4433
4434 void nfsd4_cstate_clear_replay(struct nfsd4_compound_state *cstate)
4435 {
4436         struct nfs4_stateowner *so = cstate->replay_owner;
4437
4438         if (so != NULL) {
4439                 cstate->replay_owner = NULL;
4440                 mutex_unlock(&so->so_replay.rp_mutex);
4441                 nfs4_put_stateowner(so);
4442         }
4443 }
4444
4445 static inline void *alloc_stateowner(struct kmem_cache *slab, struct xdr_netobj *owner, struct nfs4_client *clp)
4446 {
4447         struct nfs4_stateowner *sop;
4448
4449         sop = kmem_cache_alloc(slab, GFP_KERNEL);
4450         if (!sop)
4451                 return NULL;
4452
4453         xdr_netobj_dup(&sop->so_owner, owner, GFP_KERNEL);
4454         if (!sop->so_owner.data) {
4455                 kmem_cache_free(slab, sop);
4456                 return NULL;
4457         }
4458
4459         INIT_LIST_HEAD(&sop->so_stateids);
4460         sop->so_client = clp;
4461         init_nfs4_replay(&sop->so_replay);
4462         atomic_set(&sop->so_count, 1);
4463         return sop;
4464 }
4465
4466 static void hash_openowner(struct nfs4_openowner *oo, struct nfs4_client *clp, unsigned int strhashval)
4467 {
4468         lockdep_assert_held(&clp->cl_lock);
4469
4470         list_add(&oo->oo_owner.so_strhash,
4471                  &clp->cl_ownerstr_hashtbl[strhashval]);
4472         list_add(&oo->oo_perclient, &clp->cl_openowners);
4473 }
4474
4475 static void nfs4_unhash_openowner(struct nfs4_stateowner *so)
4476 {
4477         unhash_openowner_locked(openowner(so));
4478 }
4479
4480 static void nfs4_free_openowner(struct nfs4_stateowner *so)
4481 {
4482         struct nfs4_openowner *oo = openowner(so);
4483
4484         kmem_cache_free(openowner_slab, oo);
4485 }
4486
4487 static const struct nfs4_stateowner_operations openowner_ops = {
4488         .so_unhash =    nfs4_unhash_openowner,
4489         .so_free =      nfs4_free_openowner,
4490 };
4491
4492 static struct nfs4_ol_stateid *
4493 nfsd4_find_existing_open(struct nfs4_file *fp, struct nfsd4_open *open)
4494 {
4495         struct nfs4_ol_stateid *local, *ret = NULL;
4496         struct nfs4_openowner *oo = open->op_openowner;
4497
4498         lockdep_assert_held(&fp->fi_lock);
4499
4500         list_for_each_entry(local, &fp->fi_stateids, st_perfile) {
4501                 /* ignore lock owners */
4502                 if (local->st_stateowner->so_is_open_owner == 0)
4503                         continue;
4504                 if (local->st_stateowner != &oo->oo_owner)
4505                         continue;
4506                 if (local->st_stid.sc_type == NFS4_OPEN_STID) {
4507                         ret = local;
4508                         refcount_inc(&ret->st_stid.sc_count);
4509                         break;
4510                 }
4511         }
4512         return ret;
4513 }
4514
4515 static __be32
4516 nfsd4_verify_open_stid(struct nfs4_stid *s)
4517 {
4518         __be32 ret = nfs_ok;
4519
4520         switch (s->sc_type) {
4521         default:
4522                 break;
4523         case 0:
4524         case NFS4_CLOSED_STID:
4525         case NFS4_CLOSED_DELEG_STID:
4526                 ret = nfserr_bad_stateid;
4527                 break;
4528         case NFS4_REVOKED_DELEG_STID:
4529                 ret = nfserr_deleg_revoked;
4530         }
4531         return ret;
4532 }
4533
4534 /* Lock the stateid st_mutex, and deal with races with CLOSE */
4535 static __be32
4536 nfsd4_lock_ol_stateid(struct nfs4_ol_stateid *stp)
4537 {
4538         __be32 ret;
4539
4540         mutex_lock_nested(&stp->st_mutex, LOCK_STATEID_MUTEX);
4541         ret = nfsd4_verify_open_stid(&stp->st_stid);
4542         if (ret != nfs_ok)
4543                 mutex_unlock(&stp->st_mutex);
4544         return ret;
4545 }
4546
4547 static struct nfs4_ol_stateid *
4548 nfsd4_find_and_lock_existing_open(struct nfs4_file *fp, struct nfsd4_open *open)
4549 {
4550         struct nfs4_ol_stateid *stp;
4551         for (;;) {
4552                 spin_lock(&fp->fi_lock);
4553                 stp = nfsd4_find_existing_open(fp, open);
4554                 spin_unlock(&fp->fi_lock);
4555                 if (!stp || nfsd4_lock_ol_stateid(stp) == nfs_ok)
4556                         break;
4557                 nfs4_put_stid(&stp->st_stid);
4558         }
4559         return stp;
4560 }
4561
4562 static struct nfs4_openowner *
4563 alloc_init_open_stateowner(unsigned int strhashval, struct nfsd4_open *open,
4564                            struct nfsd4_compound_state *cstate)
4565 {
4566         struct nfs4_client *clp = cstate->clp;
4567         struct nfs4_openowner *oo, *ret;
4568
4569         oo = alloc_stateowner(openowner_slab, &open->op_owner, clp);
4570         if (!oo)
4571                 return NULL;
4572         oo->oo_owner.so_ops = &openowner_ops;
4573         oo->oo_owner.so_is_open_owner = 1;
4574         oo->oo_owner.so_seqid = open->op_seqid;
4575         oo->oo_flags = 0;
4576         if (nfsd4_has_session(cstate))
4577                 oo->oo_flags |= NFS4_OO_CONFIRMED;
4578         oo->oo_time = 0;
4579         oo->oo_last_closed_stid = NULL;
4580         INIT_LIST_HEAD(&oo->oo_close_lru);
4581         spin_lock(&clp->cl_lock);
4582         ret = find_openstateowner_str_locked(strhashval, open, clp);
4583         if (ret == NULL) {
4584                 hash_openowner(oo, clp, strhashval);
4585                 ret = oo;
4586         } else
4587                 nfs4_free_stateowner(&oo->oo_owner);
4588
4589         spin_unlock(&clp->cl_lock);
4590         return ret;
4591 }
4592
4593 static struct nfs4_ol_stateid *
4594 init_open_stateid(struct nfs4_file *fp, struct nfsd4_open *open)
4595 {
4596
4597         struct nfs4_openowner *oo = open->op_openowner;
4598         struct nfs4_ol_stateid *retstp = NULL;
4599         struct nfs4_ol_stateid *stp;
4600
4601         stp = open->op_stp;
4602         /* We are moving these outside of the spinlocks to avoid the warnings */
4603         mutex_init(&stp->st_mutex);
4604         mutex_lock_nested(&stp->st_mutex, OPEN_STATEID_MUTEX);
4605
4606 retry:
4607         spin_lock(&oo->oo_owner.so_client->cl_lock);
4608         spin_lock(&fp->fi_lock);
4609
4610         retstp = nfsd4_find_existing_open(fp, open);
4611         if (retstp)
4612                 goto out_unlock;
4613
4614         open->op_stp = NULL;
4615         refcount_inc(&stp->st_stid.sc_count);
4616         stp->st_stid.sc_type = NFS4_OPEN_STID;
4617         INIT_LIST_HEAD(&stp->st_locks);
4618         stp->st_stateowner = nfs4_get_stateowner(&oo->oo_owner);
4619         get_nfs4_file(fp);
4620         stp->st_stid.sc_file = fp;
4621         stp->st_access_bmap = 0;
4622         stp->st_deny_bmap = 0;
4623         stp->st_openstp = NULL;
4624         list_add(&stp->st_perstateowner, &oo->oo_owner.so_stateids);
4625         list_add(&stp->st_perfile, &fp->fi_stateids);
4626
4627 out_unlock:
4628         spin_unlock(&fp->fi_lock);
4629         spin_unlock(&oo->oo_owner.so_client->cl_lock);
4630         if (retstp) {
4631                 /* Handle races with CLOSE */
4632                 if (nfsd4_lock_ol_stateid(retstp) != nfs_ok) {
4633                         nfs4_put_stid(&retstp->st_stid);
4634                         goto retry;
4635                 }
4636                 /* To keep mutex tracking happy */
4637                 mutex_unlock(&stp->st_mutex);
4638                 stp = retstp;
4639         }
4640         return stp;
4641 }
4642
4643 /*
4644  * In the 4.0 case we need to keep the owners around a little while to handle
4645  * CLOSE replay. We still do need to release any file access that is held by
4646  * them before returning however.
4647  */
4648 static void
4649 move_to_close_lru(struct nfs4_ol_stateid *s, struct net *net)
4650 {
4651         struct nfs4_ol_stateid *last;
4652         struct nfs4_openowner *oo = openowner(s->st_stateowner);
4653         struct nfsd_net *nn = net_generic(s->st_stid.sc_client->net,
4654                                                 nfsd_net_id);
4655
4656         dprintk("NFSD: move_to_close_lru nfs4_openowner %p\n", oo);
4657
4658         /*
4659          * We know that we hold one reference via nfsd4_close, and another
4660          * "persistent" reference for the client. If the refcount is higher
4661          * than 2, then there are still calls in progress that are using this
4662          * stateid. We can't put the sc_file reference until they are finished.
4663          * Wait for the refcount to drop to 2. Since it has been unhashed,
4664          * there should be no danger of the refcount going back up again at
4665          * this point.
4666          */
4667         wait_event(close_wq, refcount_read(&s->st_stid.sc_count) == 2);
4668
4669         release_all_access(s);
4670         if (s->st_stid.sc_file) {
4671                 put_nfs4_file(s->st_stid.sc_file);
4672                 s->st_stid.sc_file = NULL;
4673         }
4674
4675         spin_lock(&nn->client_lock);
4676         last = oo->oo_last_closed_stid;
4677         oo->oo_last_closed_stid = s;
4678         list_move_tail(&oo->oo_close_lru, &nn->close_lru);
4679         oo->oo_time = ktime_get_boottime_seconds();
4680         spin_unlock(&nn->client_lock);
4681         if (last)
4682                 nfs4_put_stid(&last->st_stid);
4683 }
4684
4685 /* search file_hashtbl[] for file */
4686 static struct nfs4_file *
4687 find_file_locked(struct svc_fh *fh, unsigned int hashval)
4688 {
4689         struct nfs4_file *fp;
4690
4691         hlist_for_each_entry_rcu(fp, &file_hashtbl[hashval], fi_hash,
4692                                 lockdep_is_held(&state_lock)) {
4693                 if (fh_match(&fp->fi_fhandle, &fh->fh_handle)) {
4694                         if (refcount_inc_not_zero(&fp->fi_ref))
4695                                 return fp;
4696                 }
4697         }
4698         return NULL;
4699 }
4700
4701 static struct nfs4_file *insert_file(struct nfs4_file *new, struct svc_fh *fh,
4702                                      unsigned int hashval)
4703 {
4704         struct nfs4_file *fp;
4705         struct nfs4_file *ret = NULL;
4706         bool alias_found = false;
4707
4708         spin_lock(&state_lock);
4709         hlist_for_each_entry_rcu(fp, &file_hashtbl[hashval], fi_hash,
4710                                  lockdep_is_held(&state_lock)) {
4711                 if (fh_match(&fp->fi_fhandle, &fh->fh_handle)) {
4712                         if (refcount_inc_not_zero(&fp->fi_ref))
4713                                 ret = fp;
4714                 } else if (d_inode(fh->fh_dentry) == fp->fi_inode)
4715                         fp->fi_aliased = alias_found = true;
4716         }
4717         if (likely(ret == NULL)) {
4718                 nfsd4_init_file(fh, hashval, new);
4719                 new->fi_aliased = alias_found;
4720                 ret = new;
4721         }
4722         spin_unlock(&state_lock);
4723         return ret;
4724 }
4725
4726 static struct nfs4_file * find_file(struct svc_fh *fh)
4727 {
4728         struct nfs4_file *fp;
4729         unsigned int hashval = file_hashval(fh);
4730
4731         rcu_read_lock();
4732         fp = find_file_locked(fh, hashval);
4733         rcu_read_unlock();
4734         return fp;
4735 }
4736
4737 static struct nfs4_file *
4738 find_or_add_file(struct nfs4_file *new, struct svc_fh *fh)
4739 {
4740         struct nfs4_file *fp;
4741         unsigned int hashval = file_hashval(fh);
4742
4743         rcu_read_lock();
4744         fp = find_file_locked(fh, hashval);
4745         rcu_read_unlock();
4746         if (fp)
4747                 return fp;
4748
4749         return insert_file(new, fh, hashval);
4750 }
4751
4752 /*
4753  * Called to check deny when READ with all zero stateid or
4754  * WRITE with all zero or all one stateid
4755  */
4756 static __be32
4757 nfs4_share_conflict(struct svc_fh *current_fh, unsigned int deny_type)
4758 {
4759         struct nfs4_file *fp;
4760         __be32 ret = nfs_ok;
4761
4762         fp = find_file(current_fh);
4763         if (!fp)
4764                 return ret;
4765         /* Check for conflicting share reservations */
4766         spin_lock(&fp->fi_lock);
4767         if (fp->fi_share_deny & deny_type)
4768                 ret = nfserr_locked;
4769         spin_unlock(&fp->fi_lock);
4770         put_nfs4_file(fp);
4771         return ret;
4772 }
4773
4774 static bool nfsd4_deleg_present(const struct inode *inode)
4775 {
4776         struct file_lock_context *ctx = smp_load_acquire(&inode->i_flctx);
4777
4778         return ctx && !list_empty_careful(&ctx->flc_lease);
4779 }
4780
4781 /**
4782  * nfsd_wait_for_delegreturn - wait for delegations to be returned
4783  * @rqstp: the RPC transaction being executed
4784  * @inode: in-core inode of the file being waited for
4785  *
4786  * The timeout prevents deadlock if all nfsd threads happen to be
4787  * tied up waiting for returning delegations.
4788  *
4789  * Return values:
4790  *   %true: delegation was returned
4791  *   %false: timed out waiting for delegreturn
4792  */
4793 bool nfsd_wait_for_delegreturn(struct svc_rqst *rqstp, struct inode *inode)
4794 {
4795         long __maybe_unused timeo;
4796
4797         timeo = wait_var_event_timeout(inode, !nfsd4_deleg_present(inode),
4798                                        NFSD_DELEGRETURN_TIMEOUT);
4799         trace_nfsd_delegret_wakeup(rqstp, inode, timeo);
4800         return timeo > 0;
4801 }
4802
4803 static void nfsd4_cb_recall_prepare(struct nfsd4_callback *cb)
4804 {
4805         struct nfs4_delegation *dp = cb_to_delegation(cb);
4806         struct nfsd_net *nn = net_generic(dp->dl_stid.sc_client->net,
4807                                           nfsd_net_id);
4808
4809         block_delegations(&dp->dl_stid.sc_file->fi_fhandle);
4810
4811         /*
4812          * We can't do this in nfsd_break_deleg_cb because it is
4813          * already holding inode->i_lock.
4814          *
4815          * If the dl_time != 0, then we know that it has already been
4816          * queued for a lease break. Don't queue it again.
4817          */
4818         spin_lock(&state_lock);
4819         if (delegation_hashed(dp) && dp->dl_time == 0) {
4820                 dp->dl_time = ktime_get_boottime_seconds();
4821                 list_add_tail(&dp->dl_recall_lru, &nn->del_recall_lru);
4822         }
4823         spin_unlock(&state_lock);
4824 }
4825
4826 static int nfsd4_cb_recall_done(struct nfsd4_callback *cb,
4827                 struct rpc_task *task)
4828 {
4829         struct nfs4_delegation *dp = cb_to_delegation(cb);
4830
4831         trace_nfsd_cb_recall_done(&dp->dl_stid.sc_stateid, task);
4832
4833         if (dp->dl_stid.sc_type == NFS4_CLOSED_DELEG_STID ||
4834             dp->dl_stid.sc_type == NFS4_REVOKED_DELEG_STID)
4835                 return 1;
4836
4837         switch (task->tk_status) {
4838         case 0:
4839                 return 1;
4840         case -NFS4ERR_DELAY:
4841                 rpc_delay(task, 2 * HZ);
4842                 return 0;
4843         case -EBADHANDLE:
4844         case -NFS4ERR_BAD_STATEID:
4845                 /*
4846                  * Race: client probably got cb_recall before open reply
4847                  * granting delegation.
4848                  */
4849                 if (dp->dl_retries--) {
4850                         rpc_delay(task, 2 * HZ);
4851                         return 0;
4852                 }
4853                 fallthrough;
4854         default:
4855                 return 1;
4856         }
4857 }
4858
4859 static void nfsd4_cb_recall_release(struct nfsd4_callback *cb)
4860 {
4861         struct nfs4_delegation *dp = cb_to_delegation(cb);
4862
4863         nfs4_put_stid(&dp->dl_stid);
4864 }
4865
4866 static const struct nfsd4_callback_ops nfsd4_cb_recall_ops = {
4867         .prepare        = nfsd4_cb_recall_prepare,
4868         .done           = nfsd4_cb_recall_done,
4869         .release        = nfsd4_cb_recall_release,
4870 };
4871
4872 static void nfsd_break_one_deleg(struct nfs4_delegation *dp)
4873 {
4874         /*
4875          * We're assuming the state code never drops its reference
4876          * without first removing the lease.  Since we're in this lease
4877          * callback (and since the lease code is serialized by the
4878          * flc_lock) we know the server hasn't removed the lease yet, and
4879          * we know it's safe to take a reference.
4880          */
4881         refcount_inc(&dp->dl_stid.sc_count);
4882         WARN_ON_ONCE(!nfsd4_run_cb(&dp->dl_recall));
4883 }
4884
4885 /* Called from break_lease() with flc_lock held. */
4886 static bool
4887 nfsd_break_deleg_cb(struct file_lock *fl)
4888 {
4889         struct nfs4_delegation *dp = (struct nfs4_delegation *)fl->fl_owner;
4890         struct nfs4_file *fp = dp->dl_stid.sc_file;
4891         struct nfs4_client *clp = dp->dl_stid.sc_client;
4892         struct nfsd_net *nn;
4893
4894         trace_nfsd_cb_recall(&dp->dl_stid);
4895
4896         dp->dl_recalled = true;
4897         atomic_inc(&clp->cl_delegs_in_recall);
4898         if (try_to_expire_client(clp)) {
4899                 nn = net_generic(clp->net, nfsd_net_id);
4900                 mod_delayed_work(laundry_wq, &nn->laundromat_work, 0);
4901         }
4902
4903         /*
4904          * We don't want the locks code to timeout the lease for us;
4905          * we'll remove it ourself if a delegation isn't returned
4906          * in time:
4907          */
4908         fl->fl_break_time = 0;
4909
4910         spin_lock(&fp->fi_lock);
4911         fp->fi_had_conflict = true;
4912         nfsd_break_one_deleg(dp);
4913         spin_unlock(&fp->fi_lock);
4914         return false;
4915 }
4916
4917 /**
4918  * nfsd_breaker_owns_lease - Check if lease conflict was resolved
4919  * @fl: Lock state to check
4920  *
4921  * Return values:
4922  *   %true: Lease conflict was resolved
4923  *   %false: Lease conflict was not resolved.
4924  */
4925 static bool nfsd_breaker_owns_lease(struct file_lock *fl)
4926 {
4927         struct nfs4_delegation *dl = fl->fl_owner;
4928         struct svc_rqst *rqst;
4929         struct nfs4_client *clp;
4930
4931         if (!i_am_nfsd())
4932                 return false;
4933         rqst = kthread_data(current);
4934         /* Note rq_prog == NFS_ACL_PROGRAM is also possible: */
4935         if (rqst->rq_prog != NFS_PROGRAM || rqst->rq_vers < 4)
4936                 return false;
4937         clp = *(rqst->rq_lease_breaker);
4938         return dl->dl_stid.sc_client == clp;
4939 }
4940
4941 static int
4942 nfsd_change_deleg_cb(struct file_lock *onlist, int arg,
4943                      struct list_head *dispose)
4944 {
4945         struct nfs4_delegation *dp = (struct nfs4_delegation *)onlist->fl_owner;
4946         struct nfs4_client *clp = dp->dl_stid.sc_client;
4947
4948         if (arg & F_UNLCK) {
4949                 if (dp->dl_recalled)
4950                         atomic_dec(&clp->cl_delegs_in_recall);
4951                 return lease_modify(onlist, arg, dispose);
4952         } else
4953                 return -EAGAIN;
4954 }
4955
4956 static const struct lock_manager_operations nfsd_lease_mng_ops = {
4957         .lm_breaker_owns_lease = nfsd_breaker_owns_lease,
4958         .lm_break = nfsd_break_deleg_cb,
4959         .lm_change = nfsd_change_deleg_cb,
4960 };
4961
4962 static __be32 nfsd4_check_seqid(struct nfsd4_compound_state *cstate, struct nfs4_stateowner *so, u32 seqid)
4963 {
4964         if (nfsd4_has_session(cstate))
4965                 return nfs_ok;
4966         if (seqid == so->so_seqid - 1)
4967                 return nfserr_replay_me;
4968         if (seqid == so->so_seqid)
4969                 return nfs_ok;
4970         return nfserr_bad_seqid;
4971 }
4972
4973 static struct nfs4_client *lookup_clientid(clientid_t *clid, bool sessions,
4974                                                 struct nfsd_net *nn)
4975 {
4976         struct nfs4_client *found;
4977
4978         spin_lock(&nn->client_lock);
4979         found = find_confirmed_client(clid, sessions, nn);
4980         if (found)
4981                 atomic_inc(&found->cl_rpc_users);
4982         spin_unlock(&nn->client_lock);
4983         return found;
4984 }
4985
4986 static __be32 set_client(clientid_t *clid,
4987                 struct nfsd4_compound_state *cstate,
4988                 struct nfsd_net *nn)
4989 {
4990         if (cstate->clp) {
4991                 if (!same_clid(&cstate->clp->cl_clientid, clid))
4992                         return nfserr_stale_clientid;
4993                 return nfs_ok;
4994         }
4995         if (STALE_CLIENTID(clid, nn))
4996                 return nfserr_stale_clientid;
4997         /*
4998          * We're in the 4.0 case (otherwise the SEQUENCE op would have
4999          * set cstate->clp), so session = false:
5000          */
5001         cstate->clp = lookup_clientid(clid, false, nn);
5002         if (!cstate->clp)
5003                 return nfserr_expired;
5004         return nfs_ok;
5005 }
5006
5007 __be32
5008 nfsd4_process_open1(struct nfsd4_compound_state *cstate,
5009                     struct nfsd4_open *open, struct nfsd_net *nn)
5010 {
5011         clientid_t *clientid = &open->op_clientid;
5012         struct nfs4_client *clp = NULL;
5013         unsigned int strhashval;
5014         struct nfs4_openowner *oo = NULL;
5015         __be32 status;
5016
5017         /*
5018          * In case we need it later, after we've already created the
5019          * file and don't want to risk a further failure:
5020          */
5021         open->op_file = nfsd4_alloc_file();
5022         if (open->op_file == NULL)
5023                 return nfserr_jukebox;
5024
5025         status = set_client(clientid, cstate, nn);
5026         if (status)
5027                 return status;
5028         clp = cstate->clp;
5029
5030         strhashval = ownerstr_hashval(&open->op_owner);
5031         oo = find_openstateowner_str(strhashval, open, clp);
5032         open->op_openowner = oo;
5033         if (!oo) {
5034                 goto new_owner;
5035         }
5036         if (!(oo->oo_flags & NFS4_OO_CONFIRMED)) {
5037                 /* Replace unconfirmed owners without checking for replay. */
5038                 release_openowner(oo);
5039                 open->op_openowner = NULL;
5040                 goto new_owner;
5041         }
5042         status = nfsd4_check_seqid(cstate, &oo->oo_owner, open->op_seqid);
5043         if (status)
5044                 return status;
5045         goto alloc_stateid;
5046 new_owner:
5047         oo = alloc_init_open_stateowner(strhashval, open, cstate);
5048         if (oo == NULL)
5049                 return nfserr_jukebox;
5050         open->op_openowner = oo;
5051 alloc_stateid:
5052         open->op_stp = nfs4_alloc_open_stateid(clp);
5053         if (!open->op_stp)
5054                 return nfserr_jukebox;
5055
5056         if (nfsd4_has_session(cstate) &&
5057             (cstate->current_fh.fh_export->ex_flags & NFSEXP_PNFS)) {
5058                 open->op_odstate = alloc_clnt_odstate(clp);
5059                 if (!open->op_odstate)
5060                         return nfserr_jukebox;
5061         }
5062
5063         return nfs_ok;
5064 }
5065
5066 static inline __be32
5067 nfs4_check_delegmode(struct nfs4_delegation *dp, int flags)
5068 {
5069         if ((flags & WR_STATE) && (dp->dl_type == NFS4_OPEN_DELEGATE_READ))
5070                 return nfserr_openmode;
5071         else
5072                 return nfs_ok;
5073 }
5074
5075 static int share_access_to_flags(u32 share_access)
5076 {
5077         return share_access == NFS4_SHARE_ACCESS_READ ? RD_STATE : WR_STATE;
5078 }
5079
5080 static struct nfs4_delegation *find_deleg_stateid(struct nfs4_client *cl, stateid_t *s)
5081 {
5082         struct nfs4_stid *ret;
5083
5084         ret = find_stateid_by_type(cl, s,
5085                                 NFS4_DELEG_STID|NFS4_REVOKED_DELEG_STID);
5086         if (!ret)
5087                 return NULL;
5088         return delegstateid(ret);
5089 }
5090
5091 static bool nfsd4_is_deleg_cur(struct nfsd4_open *open)
5092 {
5093         return open->op_claim_type == NFS4_OPEN_CLAIM_DELEGATE_CUR ||
5094                open->op_claim_type == NFS4_OPEN_CLAIM_DELEG_CUR_FH;
5095 }
5096
5097 static __be32
5098 nfs4_check_deleg(struct nfs4_client *cl, struct nfsd4_open *open,
5099                 struct nfs4_delegation **dp)
5100 {
5101         int flags;
5102         __be32 status = nfserr_bad_stateid;
5103         struct nfs4_delegation *deleg;
5104
5105         deleg = find_deleg_stateid(cl, &open->op_delegate_stateid);
5106         if (deleg == NULL)
5107                 goto out;
5108         if (deleg->dl_stid.sc_type == NFS4_REVOKED_DELEG_STID) {
5109                 nfs4_put_stid(&deleg->dl_stid);
5110                 if (cl->cl_minorversion)
5111                         status = nfserr_deleg_revoked;
5112                 goto out;
5113         }
5114         flags = share_access_to_flags(open->op_share_access);
5115         status = nfs4_check_delegmode(deleg, flags);
5116         if (status) {
5117                 nfs4_put_stid(&deleg->dl_stid);
5118                 goto out;
5119         }
5120         *dp = deleg;
5121 out:
5122         if (!nfsd4_is_deleg_cur(open))
5123                 return nfs_ok;
5124         if (status)
5125                 return status;
5126         open->op_openowner->oo_flags |= NFS4_OO_CONFIRMED;
5127         return nfs_ok;
5128 }
5129
5130 static inline int nfs4_access_to_access(u32 nfs4_access)
5131 {
5132         int flags = 0;
5133
5134         if (nfs4_access & NFS4_SHARE_ACCESS_READ)
5135                 flags |= NFSD_MAY_READ;
5136         if (nfs4_access & NFS4_SHARE_ACCESS_WRITE)
5137                 flags |= NFSD_MAY_WRITE;
5138         return flags;
5139 }
5140
5141 static inline __be32
5142 nfsd4_truncate(struct svc_rqst *rqstp, struct svc_fh *fh,
5143                 struct nfsd4_open *open)
5144 {
5145         struct iattr iattr = {
5146                 .ia_valid = ATTR_SIZE,
5147                 .ia_size = 0,
5148         };
5149         struct nfsd_attrs attrs = {
5150                 .na_iattr       = &iattr,
5151         };
5152         if (!open->op_truncate)
5153                 return 0;
5154         if (!(open->op_share_access & NFS4_SHARE_ACCESS_WRITE))
5155                 return nfserr_inval;
5156         return nfsd_setattr(rqstp, fh, &attrs, 0, (time64_t)0);
5157 }
5158
5159 static __be32 nfs4_get_vfs_file(struct svc_rqst *rqstp, struct nfs4_file *fp,
5160                 struct svc_fh *cur_fh, struct nfs4_ol_stateid *stp,
5161                 struct nfsd4_open *open, bool new_stp)
5162 {
5163         struct nfsd_file *nf = NULL;
5164         __be32 status;
5165         int oflag = nfs4_access_to_omode(open->op_share_access);
5166         int access = nfs4_access_to_access(open->op_share_access);
5167         unsigned char old_access_bmap, old_deny_bmap;
5168
5169         spin_lock(&fp->fi_lock);
5170
5171         /*
5172          * Are we trying to set a deny mode that would conflict with
5173          * current access?
5174          */
5175         status = nfs4_file_check_deny(fp, open->op_share_deny);
5176         if (status != nfs_ok) {
5177                 if (status != nfserr_share_denied) {
5178                         spin_unlock(&fp->fi_lock);
5179                         goto out;
5180                 }
5181                 if (nfs4_resolve_deny_conflicts_locked(fp, new_stp,
5182                                 stp, open->op_share_deny, false))
5183                         status = nfserr_jukebox;
5184                 spin_unlock(&fp->fi_lock);
5185                 goto out;
5186         }
5187
5188         /* set access to the file */
5189         status = nfs4_file_get_access(fp, open->op_share_access);
5190         if (status != nfs_ok) {
5191                 if (status != nfserr_share_denied) {
5192                         spin_unlock(&fp->fi_lock);
5193                         goto out;
5194                 }
5195                 if (nfs4_resolve_deny_conflicts_locked(fp, new_stp,
5196                                 stp, open->op_share_access, true))
5197                         status = nfserr_jukebox;
5198                 spin_unlock(&fp->fi_lock);
5199                 goto out;
5200         }
5201
5202         /* Set access bits in stateid */
5203         old_access_bmap = stp->st_access_bmap;
5204         set_access(open->op_share_access, stp);
5205
5206         /* Set new deny mask */
5207         old_deny_bmap = stp->st_deny_bmap;
5208         set_deny(open->op_share_deny, stp);
5209         fp->fi_share_deny |= (open->op_share_deny & NFS4_SHARE_DENY_BOTH);
5210
5211         if (!fp->fi_fds[oflag]) {
5212                 spin_unlock(&fp->fi_lock);
5213
5214                 status = nfsd_file_acquire_opened(rqstp, cur_fh, access,
5215                                                   open->op_filp, &nf);
5216                 if (status != nfs_ok)
5217                         goto out_put_access;
5218
5219                 spin_lock(&fp->fi_lock);
5220                 if (!fp->fi_fds[oflag]) {
5221                         fp->fi_fds[oflag] = nf;
5222                         nf = NULL;
5223                 }
5224         }
5225         spin_unlock(&fp->fi_lock);
5226         if (nf)
5227                 nfsd_file_put(nf);
5228
5229         status = nfserrno(nfsd_open_break_lease(cur_fh->fh_dentry->d_inode,
5230                                                                 access));
5231         if (status)
5232                 goto out_put_access;
5233
5234         status = nfsd4_truncate(rqstp, cur_fh, open);
5235         if (status)
5236                 goto out_put_access;
5237 out:
5238         return status;
5239 out_put_access:
5240         stp->st_access_bmap = old_access_bmap;
5241         nfs4_file_put_access(fp, open->op_share_access);
5242         reset_union_bmap_deny(bmap_to_share_mode(old_deny_bmap), stp);
5243         goto out;
5244 }
5245
5246 static __be32
5247 nfs4_upgrade_open(struct svc_rqst *rqstp, struct nfs4_file *fp,
5248                 struct svc_fh *cur_fh, struct nfs4_ol_stateid *stp,
5249                 struct nfsd4_open *open)
5250 {
5251         __be32 status;
5252         unsigned char old_deny_bmap = stp->st_deny_bmap;
5253
5254         if (!test_access(open->op_share_access, stp))
5255                 return nfs4_get_vfs_file(rqstp, fp, cur_fh, stp, open, false);
5256
5257         /* test and set deny mode */
5258         spin_lock(&fp->fi_lock);
5259         status = nfs4_file_check_deny(fp, open->op_share_deny);
5260         if (status == nfs_ok) {
5261                 if (status != nfserr_share_denied) {
5262                         set_deny(open->op_share_deny, stp);
5263                         fp->fi_share_deny |=
5264                                 (open->op_share_deny & NFS4_SHARE_DENY_BOTH);
5265                 } else {
5266                         if (nfs4_resolve_deny_conflicts_locked(fp, false,
5267                                         stp, open->op_share_deny, false))
5268                                 status = nfserr_jukebox;
5269                 }
5270         }
5271         spin_unlock(&fp->fi_lock);
5272
5273         if (status != nfs_ok)
5274                 return status;
5275
5276         status = nfsd4_truncate(rqstp, cur_fh, open);
5277         if (status != nfs_ok)
5278                 reset_union_bmap_deny(old_deny_bmap, stp);
5279         return status;
5280 }
5281
5282 /* Should we give out recallable state?: */
5283 static bool nfsd4_cb_channel_good(struct nfs4_client *clp)
5284 {
5285         if (clp->cl_cb_state == NFSD4_CB_UP)
5286                 return true;
5287         /*
5288          * In the sessions case, since we don't have to establish a
5289          * separate connection for callbacks, we assume it's OK
5290          * until we hear otherwise:
5291          */
5292         return clp->cl_minorversion && clp->cl_cb_state == NFSD4_CB_UNKNOWN;
5293 }
5294
5295 static struct file_lock *nfs4_alloc_init_lease(struct nfs4_delegation *dp,
5296                                                 int flag)
5297 {
5298         struct file_lock *fl;
5299
5300         fl = locks_alloc_lock();
5301         if (!fl)
5302                 return NULL;
5303         fl->fl_lmops = &nfsd_lease_mng_ops;
5304         fl->fl_flags = FL_DELEG;
5305         fl->fl_type = flag == NFS4_OPEN_DELEGATE_READ? F_RDLCK: F_WRLCK;
5306         fl->fl_end = OFFSET_MAX;
5307         fl->fl_owner = (fl_owner_t)dp;
5308         fl->fl_pid = current->tgid;
5309         fl->fl_file = dp->dl_stid.sc_file->fi_deleg_file->nf_file;
5310         return fl;
5311 }
5312
5313 static int nfsd4_check_conflicting_opens(struct nfs4_client *clp,
5314                                          struct nfs4_file *fp)
5315 {
5316         struct nfs4_ol_stateid *st;
5317         struct file *f = fp->fi_deleg_file->nf_file;
5318         struct inode *ino = locks_inode(f);
5319         int writes;
5320
5321         writes = atomic_read(&ino->i_writecount);
5322         if (!writes)
5323                 return 0;
5324         /*
5325          * There could be multiple filehandles (hence multiple
5326          * nfs4_files) referencing this file, but that's not too
5327          * common; let's just give up in that case rather than
5328          * trying to go look up all the clients using that other
5329          * nfs4_file as well:
5330          */
5331         if (fp->fi_aliased)
5332                 return -EAGAIN;
5333         /*
5334          * If there's a close in progress, make sure that we see it
5335          * clear any fi_fds[] entries before we see it decrement
5336          * i_writecount:
5337          */
5338         smp_mb__after_atomic();
5339
5340         if (fp->fi_fds[O_WRONLY])
5341                 writes--;
5342         if (fp->fi_fds[O_RDWR])
5343                 writes--;
5344         if (writes > 0)
5345                 return -EAGAIN; /* There may be non-NFSv4 writers */
5346         /*
5347          * It's possible there are non-NFSv4 write opens in progress,
5348          * but if they haven't incremented i_writecount yet then they
5349          * also haven't called break lease yet; so, they'll break this
5350          * lease soon enough.  So, all that's left to check for is NFSv4
5351          * opens:
5352          */
5353         spin_lock(&fp->fi_lock);
5354         list_for_each_entry(st, &fp->fi_stateids, st_perfile) {
5355                 if (st->st_openstp == NULL /* it's an open */ &&
5356                     access_permit_write(st) &&
5357                     st->st_stid.sc_client != clp) {
5358                         spin_unlock(&fp->fi_lock);
5359                         return -EAGAIN;
5360                 }
5361         }
5362         spin_unlock(&fp->fi_lock);
5363         /*
5364          * There's a small chance that we could be racing with another
5365          * NFSv4 open.  However, any open that hasn't added itself to
5366          * the fi_stateids list also hasn't called break_lease yet; so,
5367          * they'll break this lease soon enough.
5368          */
5369         return 0;
5370 }
5371
5372 /*
5373  * It's possible that between opening the dentry and setting the delegation,
5374  * that it has been renamed or unlinked. Redo the lookup to verify that this
5375  * hasn't happened.
5376  */
5377 static int
5378 nfsd4_verify_deleg_dentry(struct nfsd4_open *open, struct nfs4_file *fp,
5379                           struct svc_fh *parent)
5380 {
5381         struct svc_export *exp;
5382         struct dentry *child;
5383         __be32 err;
5384
5385         err = nfsd_lookup_dentry(open->op_rqstp, parent,
5386                                  open->op_fname, open->op_fnamelen,
5387                                  &exp, &child);
5388
5389         if (err)
5390                 return -EAGAIN;
5391
5392         exp_put(exp);
5393         dput(child);
5394         if (child != file_dentry(fp->fi_deleg_file->nf_file))
5395                 return -EAGAIN;
5396
5397         return 0;
5398 }
5399
5400 static struct nfs4_delegation *
5401 nfs4_set_delegation(struct nfsd4_open *open, struct nfs4_ol_stateid *stp,
5402                     struct svc_fh *parent)
5403 {
5404         int status = 0;
5405         struct nfs4_client *clp = stp->st_stid.sc_client;
5406         struct nfs4_file *fp = stp->st_stid.sc_file;
5407         struct nfs4_clnt_odstate *odstate = stp->st_clnt_odstate;
5408         struct nfs4_delegation *dp;
5409         struct nfsd_file *nf;
5410         struct file_lock *fl;
5411
5412         /*
5413          * The fi_had_conflict and nfs_get_existing_delegation checks
5414          * here are just optimizations; we'll need to recheck them at
5415          * the end:
5416          */
5417         if (fp->fi_had_conflict)
5418                 return ERR_PTR(-EAGAIN);
5419
5420         nf = find_readable_file(fp);
5421         if (!nf) {
5422                 /*
5423                  * We probably could attempt another open and get a read
5424                  * delegation, but for now, don't bother until the
5425                  * client actually sends us one.
5426                  */
5427                 return ERR_PTR(-EAGAIN);
5428         }
5429         spin_lock(&state_lock);
5430         spin_lock(&fp->fi_lock);
5431         if (nfs4_delegation_exists(clp, fp))
5432                 status = -EAGAIN;
5433         else if (!fp->fi_deleg_file) {
5434                 fp->fi_deleg_file = nf;
5435                 /* increment early to prevent fi_deleg_file from being
5436                  * cleared */
5437                 fp->fi_delegees = 1;
5438                 nf = NULL;
5439         } else
5440                 fp->fi_delegees++;
5441         spin_unlock(&fp->fi_lock);
5442         spin_unlock(&state_lock);
5443         if (nf)
5444                 nfsd_file_put(nf);
5445         if (status)
5446                 return ERR_PTR(status);
5447
5448         status = -ENOMEM;
5449         dp = alloc_init_deleg(clp, fp, odstate);
5450         if (!dp)
5451                 goto out_delegees;
5452
5453         fl = nfs4_alloc_init_lease(dp, NFS4_OPEN_DELEGATE_READ);
5454         if (!fl)
5455                 goto out_clnt_odstate;
5456
5457         status = vfs_setlease(fp->fi_deleg_file->nf_file, fl->fl_type, &fl, NULL);
5458         if (fl)
5459                 locks_free_lock(fl);
5460         if (status)
5461                 goto out_clnt_odstate;
5462
5463         if (parent) {
5464                 status = nfsd4_verify_deleg_dentry(open, fp, parent);
5465                 if (status)
5466                         goto out_unlock;
5467         }
5468
5469         status = nfsd4_check_conflicting_opens(clp, fp);
5470         if (status)
5471                 goto out_unlock;
5472
5473         spin_lock(&state_lock);
5474         spin_lock(&fp->fi_lock);
5475         if (fp->fi_had_conflict)
5476                 status = -EAGAIN;
5477         else
5478                 status = hash_delegation_locked(dp, fp);
5479         spin_unlock(&fp->fi_lock);
5480         spin_unlock(&state_lock);
5481
5482         if (status)
5483                 goto out_unlock;
5484
5485         return dp;
5486 out_unlock:
5487         vfs_setlease(fp->fi_deleg_file->nf_file, F_UNLCK, NULL, (void **)&dp);
5488 out_clnt_odstate:
5489         put_clnt_odstate(dp->dl_clnt_odstate);
5490         nfs4_put_stid(&dp->dl_stid);
5491 out_delegees:
5492         put_deleg_file(fp);
5493         return ERR_PTR(status);
5494 }
5495
5496 static void nfsd4_open_deleg_none_ext(struct nfsd4_open *open, int status)
5497 {
5498         open->op_delegate_type = NFS4_OPEN_DELEGATE_NONE_EXT;
5499         if (status == -EAGAIN)
5500                 open->op_why_no_deleg = WND4_CONTENTION;
5501         else {
5502                 open->op_why_no_deleg = WND4_RESOURCE;
5503                 switch (open->op_deleg_want) {
5504                 case NFS4_SHARE_WANT_READ_DELEG:
5505                 case NFS4_SHARE_WANT_WRITE_DELEG:
5506                 case NFS4_SHARE_WANT_ANY_DELEG:
5507                         break;
5508                 case NFS4_SHARE_WANT_CANCEL:
5509                         open->op_why_no_deleg = WND4_CANCELLED;
5510                         break;
5511                 case NFS4_SHARE_WANT_NO_DELEG:
5512                         WARN_ON_ONCE(1);
5513                 }
5514         }
5515 }
5516
5517 /*
5518  * Attempt to hand out a delegation.
5519  *
5520  * Note we don't support write delegations, and won't until the vfs has
5521  * proper support for them.
5522  */
5523 static void
5524 nfs4_open_delegation(struct nfsd4_open *open, struct nfs4_ol_stateid *stp,
5525                      struct svc_fh *currentfh)
5526 {
5527         struct nfs4_delegation *dp;
5528         struct nfs4_openowner *oo = openowner(stp->st_stateowner);
5529         struct nfs4_client *clp = stp->st_stid.sc_client;
5530         struct svc_fh *parent = NULL;
5531         int cb_up;
5532         int status = 0;
5533
5534         cb_up = nfsd4_cb_channel_good(oo->oo_owner.so_client);
5535         open->op_recall = 0;
5536         switch (open->op_claim_type) {
5537                 case NFS4_OPEN_CLAIM_PREVIOUS:
5538                         if (!cb_up)
5539                                 open->op_recall = 1;
5540                         if (open->op_delegate_type != NFS4_OPEN_DELEGATE_READ)
5541                                 goto out_no_deleg;
5542                         break;
5543                 case NFS4_OPEN_CLAIM_NULL:
5544                         parent = currentfh;
5545                         fallthrough;
5546                 case NFS4_OPEN_CLAIM_FH:
5547                         /*
5548                          * Let's not give out any delegations till everyone's
5549                          * had the chance to reclaim theirs, *and* until
5550                          * NLM locks have all been reclaimed:
5551                          */
5552                         if (locks_in_grace(clp->net))
5553                                 goto out_no_deleg;
5554                         if (!cb_up || !(oo->oo_flags & NFS4_OO_CONFIRMED))
5555                                 goto out_no_deleg;
5556                         break;
5557                 default:
5558                         goto out_no_deleg;
5559         }
5560         dp = nfs4_set_delegation(open, stp, parent);
5561         if (IS_ERR(dp))
5562                 goto out_no_deleg;
5563
5564         memcpy(&open->op_delegate_stateid, &dp->dl_stid.sc_stateid, sizeof(dp->dl_stid.sc_stateid));
5565
5566         trace_nfsd_deleg_read(&dp->dl_stid.sc_stateid);
5567         open->op_delegate_type = NFS4_OPEN_DELEGATE_READ;
5568         nfs4_put_stid(&dp->dl_stid);
5569         return;
5570 out_no_deleg:
5571         open->op_delegate_type = NFS4_OPEN_DELEGATE_NONE;
5572         if (open->op_claim_type == NFS4_OPEN_CLAIM_PREVIOUS &&
5573             open->op_delegate_type != NFS4_OPEN_DELEGATE_NONE) {
5574                 dprintk("NFSD: WARNING: refusing delegation reclaim\n");
5575                 open->op_recall = 1;
5576         }
5577
5578         /* 4.1 client asking for a delegation? */
5579         if (open->op_deleg_want)
5580                 nfsd4_open_deleg_none_ext(open, status);
5581         return;
5582 }
5583
5584 static void nfsd4_deleg_xgrade_none_ext(struct nfsd4_open *open,
5585                                         struct nfs4_delegation *dp)
5586 {
5587         if (open->op_deleg_want == NFS4_SHARE_WANT_READ_DELEG &&
5588             dp->dl_type == NFS4_OPEN_DELEGATE_WRITE) {
5589                 open->op_delegate_type = NFS4_OPEN_DELEGATE_NONE_EXT;
5590                 open->op_why_no_deleg = WND4_NOT_SUPP_DOWNGRADE;
5591         } else if (open->op_deleg_want == NFS4_SHARE_WANT_WRITE_DELEG &&
5592                    dp->dl_type == NFS4_OPEN_DELEGATE_WRITE) {
5593                 open->op_delegate_type = NFS4_OPEN_DELEGATE_NONE_EXT;
5594                 open->op_why_no_deleg = WND4_NOT_SUPP_UPGRADE;
5595         }
5596         /* Otherwise the client must be confused wanting a delegation
5597          * it already has, therefore we don't return
5598          * NFS4_OPEN_DELEGATE_NONE_EXT and reason.
5599          */
5600 }
5601
5602 /**
5603  * nfsd4_process_open2 - finish open processing
5604  * @rqstp: the RPC transaction being executed
5605  * @current_fh: NFSv4 COMPOUND's current filehandle
5606  * @open: OPEN arguments
5607  *
5608  * If successful, (1) truncate the file if open->op_truncate was
5609  * set, (2) set open->op_stateid, (3) set open->op_delegation.
5610  *
5611  * Returns %nfs_ok on success; otherwise an nfs4stat value in
5612  * network byte order is returned.
5613  */
5614 __be32
5615 nfsd4_process_open2(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_open *open)
5616 {
5617         struct nfsd4_compoundres *resp = rqstp->rq_resp;
5618         struct nfs4_client *cl = open->op_openowner->oo_owner.so_client;
5619         struct nfs4_file *fp = NULL;
5620         struct nfs4_ol_stateid *stp = NULL;
5621         struct nfs4_delegation *dp = NULL;
5622         __be32 status;
5623         bool new_stp = false;
5624
5625         /*
5626          * Lookup file; if found, lookup stateid and check open request,
5627          * and check for delegations in the process of being recalled.
5628          * If not found, create the nfs4_file struct
5629          */
5630         fp = find_or_add_file(open->op_file, current_fh);
5631         if (fp != open->op_file) {
5632                 status = nfs4_check_deleg(cl, open, &dp);
5633                 if (status)
5634                         goto out;
5635                 stp = nfsd4_find_and_lock_existing_open(fp, open);
5636         } else {
5637                 open->op_file = NULL;
5638                 status = nfserr_bad_stateid;
5639                 if (nfsd4_is_deleg_cur(open))
5640                         goto out;
5641         }
5642
5643         if (!stp) {
5644                 stp = init_open_stateid(fp, open);
5645                 if (!open->op_stp)
5646                         new_stp = true;
5647         }
5648
5649         /*
5650          * OPEN the file, or upgrade an existing OPEN.
5651          * If truncate fails, the OPEN fails.
5652          *
5653          * stp is already locked.
5654          */
5655         if (!new_stp) {
5656                 /* Stateid was found, this is an OPEN upgrade */
5657                 status = nfs4_upgrade_open(rqstp, fp, current_fh, stp, open);
5658                 if (status) {
5659                         mutex_unlock(&stp->st_mutex);
5660                         goto out;
5661                 }
5662         } else {
5663                 status = nfs4_get_vfs_file(rqstp, fp, current_fh, stp, open, true);
5664                 if (status) {
5665                         stp->st_stid.sc_type = NFS4_CLOSED_STID;
5666                         release_open_stateid(stp);
5667                         mutex_unlock(&stp->st_mutex);
5668                         goto out;
5669                 }
5670
5671                 stp->st_clnt_odstate = find_or_hash_clnt_odstate(fp,
5672                                                         open->op_odstate);
5673                 if (stp->st_clnt_odstate == open->op_odstate)
5674                         open->op_odstate = NULL;
5675         }
5676
5677         nfs4_inc_and_copy_stateid(&open->op_stateid, &stp->st_stid);
5678         mutex_unlock(&stp->st_mutex);
5679
5680         if (nfsd4_has_session(&resp->cstate)) {
5681                 if (open->op_deleg_want & NFS4_SHARE_WANT_NO_DELEG) {
5682                         open->op_delegate_type = NFS4_OPEN_DELEGATE_NONE_EXT;
5683                         open->op_why_no_deleg = WND4_NOT_WANTED;
5684                         goto nodeleg;
5685                 }
5686         }
5687
5688         /*
5689         * Attempt to hand out a delegation. No error return, because the
5690         * OPEN succeeds even if we fail.
5691         */
5692         nfs4_open_delegation(open, stp, &resp->cstate.current_fh);
5693 nodeleg:
5694         status = nfs_ok;
5695         trace_nfsd_open(&stp->st_stid.sc_stateid);
5696 out:
5697         /* 4.1 client trying to upgrade/downgrade delegation? */
5698         if (open->op_delegate_type == NFS4_OPEN_DELEGATE_NONE && dp &&
5699             open->op_deleg_want)
5700                 nfsd4_deleg_xgrade_none_ext(open, dp);
5701
5702         if (fp)
5703                 put_nfs4_file(fp);
5704         if (status == 0 && open->op_claim_type == NFS4_OPEN_CLAIM_PREVIOUS)
5705                 open->op_openowner->oo_flags |= NFS4_OO_CONFIRMED;
5706         /*
5707         * To finish the open response, we just need to set the rflags.
5708         */
5709         open->op_rflags = NFS4_OPEN_RESULT_LOCKTYPE_POSIX;
5710         if (nfsd4_has_session(&resp->cstate))
5711                 open->op_rflags |= NFS4_OPEN_RESULT_MAY_NOTIFY_LOCK;
5712         else if (!(open->op_openowner->oo_flags & NFS4_OO_CONFIRMED))
5713                 open->op_rflags |= NFS4_OPEN_RESULT_CONFIRM;
5714
5715         if (dp)
5716                 nfs4_put_stid(&dp->dl_stid);
5717         if (stp)
5718                 nfs4_put_stid(&stp->st_stid);
5719
5720         return status;
5721 }
5722
5723 void nfsd4_cleanup_open_state(struct nfsd4_compound_state *cstate,
5724                               struct nfsd4_open *open)
5725 {
5726         if (open->op_openowner) {
5727                 struct nfs4_stateowner *so = &open->op_openowner->oo_owner;
5728
5729                 nfsd4_cstate_assign_replay(cstate, so);
5730                 nfs4_put_stateowner(so);
5731         }
5732         if (open->op_file)
5733                 kmem_cache_free(file_slab, open->op_file);
5734         if (open->op_stp)
5735                 nfs4_put_stid(&open->op_stp->st_stid);
5736         if (open->op_odstate)
5737                 kmem_cache_free(odstate_slab, open->op_odstate);
5738 }
5739
5740 __be32
5741 nfsd4_renew(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
5742             union nfsd4_op_u *u)
5743 {
5744         clientid_t *clid = &u->renew;
5745         struct nfs4_client *clp;
5746         __be32 status;
5747         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
5748
5749         trace_nfsd_clid_renew(clid);
5750         status = set_client(clid, cstate, nn);
5751         if (status)
5752                 return status;
5753         clp = cstate->clp;
5754         if (!list_empty(&clp->cl_delegations)
5755                         && clp->cl_cb_state != NFSD4_CB_UP)
5756                 return nfserr_cb_path_down;
5757         return nfs_ok;
5758 }
5759
5760 void
5761 nfsd4_end_grace(struct nfsd_net *nn)
5762 {
5763         /* do nothing if grace period already ended */
5764         if (nn->grace_ended)
5765                 return;
5766
5767         trace_nfsd_grace_complete(nn);
5768         nn->grace_ended = true;
5769         /*
5770          * If the server goes down again right now, an NFSv4
5771          * client will still be allowed to reclaim after it comes back up,
5772          * even if it hasn't yet had a chance to reclaim state this time.
5773          *
5774          */
5775         nfsd4_record_grace_done(nn);
5776         /*
5777          * At this point, NFSv4 clients can still reclaim.  But if the
5778          * server crashes, any that have not yet reclaimed will be out
5779          * of luck on the next boot.
5780          *
5781          * (NFSv4.1+ clients are considered to have reclaimed once they
5782          * call RECLAIM_COMPLETE.  NFSv4.0 clients are considered to
5783          * have reclaimed after their first OPEN.)
5784          */
5785         locks_end_grace(&nn->nfsd4_manager);
5786         /*
5787          * At this point, and once lockd and/or any other containers
5788          * exit their grace period, further reclaims will fail and
5789          * regular locking can resume.
5790          */
5791 }
5792
5793 /*
5794  * If we've waited a lease period but there are still clients trying to
5795  * reclaim, wait a little longer to give them a chance to finish.
5796  */
5797 static bool clients_still_reclaiming(struct nfsd_net *nn)
5798 {
5799         time64_t double_grace_period_end = nn->boot_time +
5800                                            2 * nn->nfsd4_lease;
5801
5802         if (nn->track_reclaim_completes &&
5803                         atomic_read(&nn->nr_reclaim_complete) ==
5804                         nn->reclaim_str_hashtbl_size)
5805                 return false;
5806         if (!nn->somebody_reclaimed)
5807                 return false;
5808         nn->somebody_reclaimed = false;
5809         /*
5810          * If we've given them *two* lease times to reclaim, and they're
5811          * still not done, give up:
5812          */
5813         if (ktime_get_boottime_seconds() > double_grace_period_end)
5814                 return false;
5815         return true;
5816 }
5817
5818 struct laundry_time {
5819         time64_t cutoff;
5820         time64_t new_timeo;
5821 };
5822
5823 static bool state_expired(struct laundry_time *lt, time64_t last_refresh)
5824 {
5825         time64_t time_remaining;
5826
5827         if (last_refresh < lt->cutoff)
5828                 return true;
5829         time_remaining = last_refresh - lt->cutoff;
5830         lt->new_timeo = min(lt->new_timeo, time_remaining);
5831         return false;
5832 }
5833
5834 #ifdef CONFIG_NFSD_V4_2_INTER_SSC
5835 void nfsd4_ssc_init_umount_work(struct nfsd_net *nn)
5836 {
5837         spin_lock_init(&nn->nfsd_ssc_lock);
5838         INIT_LIST_HEAD(&nn->nfsd_ssc_mount_list);
5839         init_waitqueue_head(&nn->nfsd_ssc_waitq);
5840 }
5841 EXPORT_SYMBOL_GPL(nfsd4_ssc_init_umount_work);
5842
5843 /*
5844  * This is called when nfsd is being shutdown, after all inter_ssc
5845  * cleanup were done, to destroy the ssc delayed unmount list.
5846  */
5847 static void nfsd4_ssc_shutdown_umount(struct nfsd_net *nn)
5848 {
5849         struct nfsd4_ssc_umount_item *ni = NULL;
5850         struct nfsd4_ssc_umount_item *tmp;
5851
5852         spin_lock(&nn->nfsd_ssc_lock);
5853         list_for_each_entry_safe(ni, tmp, &nn->nfsd_ssc_mount_list, nsui_list) {
5854                 list_del(&ni->nsui_list);
5855                 spin_unlock(&nn->nfsd_ssc_lock);
5856                 mntput(ni->nsui_vfsmount);
5857                 kfree(ni);
5858                 spin_lock(&nn->nfsd_ssc_lock);
5859         }
5860         spin_unlock(&nn->nfsd_ssc_lock);
5861 }
5862
5863 static void nfsd4_ssc_expire_umount(struct nfsd_net *nn)
5864 {
5865         bool do_wakeup = false;
5866         struct nfsd4_ssc_umount_item *ni = NULL;
5867         struct nfsd4_ssc_umount_item *tmp;
5868
5869         spin_lock(&nn->nfsd_ssc_lock);
5870         list_for_each_entry_safe(ni, tmp, &nn->nfsd_ssc_mount_list, nsui_list) {
5871                 if (time_after(jiffies, ni->nsui_expire)) {
5872                         if (refcount_read(&ni->nsui_refcnt) > 1)
5873                                 continue;
5874
5875                         /* mark being unmount */
5876                         ni->nsui_busy = true;
5877                         spin_unlock(&nn->nfsd_ssc_lock);
5878                         mntput(ni->nsui_vfsmount);
5879                         spin_lock(&nn->nfsd_ssc_lock);
5880
5881                         /* waiters need to start from begin of list */
5882                         list_del(&ni->nsui_list);
5883                         kfree(ni);
5884
5885                         /* wakeup ssc_connect waiters */
5886                         do_wakeup = true;
5887                         continue;
5888                 }
5889                 break;
5890         }
5891         if (do_wakeup)
5892                 wake_up_all(&nn->nfsd_ssc_waitq);
5893         spin_unlock(&nn->nfsd_ssc_lock);
5894 }
5895 #endif
5896
5897 /* Check if any lock belonging to this lockowner has any blockers */
5898 static bool
5899 nfs4_lockowner_has_blockers(struct nfs4_lockowner *lo)
5900 {
5901         struct file_lock_context *ctx;
5902         struct nfs4_ol_stateid *stp;
5903         struct nfs4_file *nf;
5904
5905         list_for_each_entry(stp, &lo->lo_owner.so_stateids, st_perstateowner) {
5906                 nf = stp->st_stid.sc_file;
5907                 ctx = nf->fi_inode->i_flctx;
5908                 if (!ctx)
5909                         continue;
5910                 if (locks_owner_has_blockers(ctx, lo))
5911                         return true;
5912         }
5913         return false;
5914 }
5915
5916 static bool
5917 nfs4_anylock_blockers(struct nfs4_client *clp)
5918 {
5919         int i;
5920         struct nfs4_stateowner *so;
5921         struct nfs4_lockowner *lo;
5922
5923         if (atomic_read(&clp->cl_delegs_in_recall))
5924                 return true;
5925         spin_lock(&clp->cl_lock);
5926         for (i = 0; i < OWNER_HASH_SIZE; i++) {
5927                 list_for_each_entry(so, &clp->cl_ownerstr_hashtbl[i],
5928                                 so_strhash) {
5929                         if (so->so_is_open_owner)
5930                                 continue;
5931                         lo = lockowner(so);
5932                         if (nfs4_lockowner_has_blockers(lo)) {
5933                                 spin_unlock(&clp->cl_lock);
5934                                 return true;
5935                         }
5936                 }
5937         }
5938         spin_unlock(&clp->cl_lock);
5939         return false;
5940 }
5941
5942 static void
5943 nfs4_get_client_reaplist(struct nfsd_net *nn, struct list_head *reaplist,
5944                                 struct laundry_time *lt)
5945 {
5946         unsigned int maxreap, reapcnt = 0;
5947         struct list_head *pos, *next;
5948         struct nfs4_client *clp;
5949
5950         maxreap = (atomic_read(&nn->nfs4_client_count) >= nn->nfs4_max_clients) ?
5951                         NFSD_CLIENT_MAX_TRIM_PER_RUN : 0;
5952         INIT_LIST_HEAD(reaplist);
5953         spin_lock(&nn->client_lock);
5954         list_for_each_safe(pos, next, &nn->client_lru) {
5955                 clp = list_entry(pos, struct nfs4_client, cl_lru);
5956                 if (clp->cl_state == NFSD4_EXPIRABLE)
5957                         goto exp_client;
5958                 if (!state_expired(lt, clp->cl_time))
5959                         break;
5960                 if (!atomic_read(&clp->cl_rpc_users)) {
5961                         if (clp->cl_state == NFSD4_ACTIVE)
5962                                 atomic_inc(&nn->nfsd_courtesy_clients);
5963                         clp->cl_state = NFSD4_COURTESY;
5964                 }
5965                 if (!client_has_state(clp))
5966                         goto exp_client;
5967                 if (!nfs4_anylock_blockers(clp))
5968                         if (reapcnt >= maxreap)
5969                                 continue;
5970 exp_client:
5971                 if (!mark_client_expired_locked(clp)) {
5972                         list_add(&clp->cl_lru, reaplist);
5973                         reapcnt++;
5974                 }
5975         }
5976         spin_unlock(&nn->client_lock);
5977 }
5978
5979 static void
5980 nfs4_get_courtesy_client_reaplist(struct nfsd_net *nn,
5981                                 struct list_head *reaplist)
5982 {
5983         unsigned int maxreap = 0, reapcnt = 0;
5984         struct list_head *pos, *next;
5985         struct nfs4_client *clp;
5986
5987         maxreap = NFSD_CLIENT_MAX_TRIM_PER_RUN;
5988         INIT_LIST_HEAD(reaplist);
5989
5990         spin_lock(&nn->client_lock);
5991         list_for_each_safe(pos, next, &nn->client_lru) {
5992                 clp = list_entry(pos, struct nfs4_client, cl_lru);
5993                 if (clp->cl_state == NFSD4_ACTIVE)
5994                         break;
5995                 if (reapcnt >= maxreap)
5996                         break;
5997                 if (!mark_client_expired_locked(clp)) {
5998                         list_add(&clp->cl_lru, reaplist);
5999                         reapcnt++;
6000                 }
6001         }
6002         spin_unlock(&nn->client_lock);
6003 }
6004
6005 static void
6006 nfs4_process_client_reaplist(struct list_head *reaplist)
6007 {
6008         struct list_head *pos, *next;
6009         struct nfs4_client *clp;
6010
6011         list_for_each_safe(pos, next, reaplist) {
6012                 clp = list_entry(pos, struct nfs4_client, cl_lru);
6013                 trace_nfsd_clid_purged(&clp->cl_clientid);
6014                 list_del_init(&clp->cl_lru);
6015                 expire_client(clp);
6016         }
6017 }
6018
6019 static time64_t
6020 nfs4_laundromat(struct nfsd_net *nn)
6021 {
6022         struct nfs4_openowner *oo;
6023         struct nfs4_delegation *dp;
6024         struct nfs4_ol_stateid *stp;
6025         struct nfsd4_blocked_lock *nbl;
6026         struct list_head *pos, *next, reaplist;
6027         struct laundry_time lt = {
6028                 .cutoff = ktime_get_boottime_seconds() - nn->nfsd4_lease,
6029                 .new_timeo = nn->nfsd4_lease
6030         };
6031         struct nfs4_cpntf_state *cps;
6032         copy_stateid_t *cps_t;
6033         int i;
6034
6035         if (clients_still_reclaiming(nn)) {
6036                 lt.new_timeo = 0;
6037                 goto out;
6038         }
6039         nfsd4_end_grace(nn);
6040
6041         spin_lock(&nn->s2s_cp_lock);
6042         idr_for_each_entry(&nn->s2s_cp_stateids, cps_t, i) {
6043                 cps = container_of(cps_t, struct nfs4_cpntf_state, cp_stateid);
6044                 if (cps->cp_stateid.cs_type == NFS4_COPYNOTIFY_STID &&
6045                                 state_expired(&lt, cps->cpntf_time))
6046                         _free_cpntf_state_locked(nn, cps);
6047         }
6048         spin_unlock(&nn->s2s_cp_lock);
6049         nfs4_get_client_reaplist(nn, &reaplist, &lt);
6050         nfs4_process_client_reaplist(&reaplist);
6051
6052         spin_lock(&state_lock);
6053         list_for_each_safe(pos, next, &nn->del_recall_lru) {
6054                 dp = list_entry (pos, struct nfs4_delegation, dl_recall_lru);
6055                 if (!state_expired(&lt, dp->dl_time))
6056                         break;
6057                 WARN_ON(!unhash_delegation_locked(dp));
6058                 list_add(&dp->dl_recall_lru, &reaplist);
6059         }
6060         spin_unlock(&state_lock);
6061         while (!list_empty(&reaplist)) {
6062                 dp = list_first_entry(&reaplist, struct nfs4_delegation,
6063                                         dl_recall_lru);
6064                 list_del_init(&dp->dl_recall_lru);
6065                 revoke_delegation(dp);
6066         }
6067
6068         spin_lock(&nn->client_lock);
6069         while (!list_empty(&nn->close_lru)) {
6070                 oo = list_first_entry(&nn->close_lru, struct nfs4_openowner,
6071                                         oo_close_lru);
6072                 if (!state_expired(&lt, oo->oo_time))
6073                         break;
6074                 list_del_init(&oo->oo_close_lru);
6075                 stp = oo->oo_last_closed_stid;
6076                 oo->oo_last_closed_stid = NULL;
6077                 spin_unlock(&nn->client_lock);
6078                 nfs4_put_stid(&stp->st_stid);
6079                 spin_lock(&nn->client_lock);
6080         }
6081         spin_unlock(&nn->client_lock);
6082
6083         /*
6084          * It's possible for a client to try and acquire an already held lock
6085          * that is being held for a long time, and then lose interest in it.
6086          * So, we clean out any un-revisited request after a lease period
6087          * under the assumption that the client is no longer interested.
6088          *
6089          * RFC5661, sec. 9.6 states that the client must not rely on getting
6090          * notifications and must continue to poll for locks, even when the
6091          * server supports them. Thus this shouldn't lead to clients blocking
6092          * indefinitely once the lock does become free.
6093          */
6094         BUG_ON(!list_empty(&reaplist));
6095         spin_lock(&nn->blocked_locks_lock);
6096         while (!list_empty(&nn->blocked_locks_lru)) {
6097                 nbl = list_first_entry(&nn->blocked_locks_lru,
6098                                         struct nfsd4_blocked_lock, nbl_lru);
6099                 if (!state_expired(&lt, nbl->nbl_time))
6100                         break;
6101                 list_move(&nbl->nbl_lru, &reaplist);
6102                 list_del_init(&nbl->nbl_list);
6103         }
6104         spin_unlock(&nn->blocked_locks_lock);
6105
6106         while (!list_empty(&reaplist)) {
6107                 nbl = list_first_entry(&reaplist,
6108                                         struct nfsd4_blocked_lock, nbl_lru);
6109                 list_del_init(&nbl->nbl_lru);
6110                 free_blocked_lock(nbl);
6111         }
6112 #ifdef CONFIG_NFSD_V4_2_INTER_SSC
6113         /* service the server-to-server copy delayed unmount list */
6114         nfsd4_ssc_expire_umount(nn);
6115 #endif
6116 out:
6117         return max_t(time64_t, lt.new_timeo, NFSD_LAUNDROMAT_MINTIMEOUT);
6118 }
6119
6120 static void laundromat_main(struct work_struct *);
6121
6122 static void
6123 laundromat_main(struct work_struct *laundry)
6124 {
6125         time64_t t;
6126         struct delayed_work *dwork = to_delayed_work(laundry);
6127         struct nfsd_net *nn = container_of(dwork, struct nfsd_net,
6128                                            laundromat_work);
6129
6130         t = nfs4_laundromat(nn);
6131         queue_delayed_work(laundry_wq, &nn->laundromat_work, t*HZ);
6132 }
6133
6134 static void
6135 courtesy_client_reaper(struct work_struct *reaper)
6136 {
6137         struct list_head reaplist;
6138         struct delayed_work *dwork = to_delayed_work(reaper);
6139         struct nfsd_net *nn = container_of(dwork, struct nfsd_net,
6140                                         nfsd_shrinker_work);
6141
6142         nfs4_get_courtesy_client_reaplist(nn, &reaplist);
6143         nfs4_process_client_reaplist(&reaplist);
6144 }
6145
6146 static inline __be32 nfs4_check_fh(struct svc_fh *fhp, struct nfs4_stid *stp)
6147 {
6148         if (!fh_match(&fhp->fh_handle, &stp->sc_file->fi_fhandle))
6149                 return nfserr_bad_stateid;
6150         return nfs_ok;
6151 }
6152
6153 static
6154 __be32 nfs4_check_openmode(struct nfs4_ol_stateid *stp, int flags)
6155 {
6156         __be32 status = nfserr_openmode;
6157
6158         /* For lock stateid's, we test the parent open, not the lock: */
6159         if (stp->st_openstp)
6160                 stp = stp->st_openstp;
6161         if ((flags & WR_STATE) && !access_permit_write(stp))
6162                 goto out;
6163         if ((flags & RD_STATE) && !access_permit_read(stp))
6164                 goto out;
6165         status = nfs_ok;
6166 out:
6167         return status;
6168 }
6169
6170 static inline __be32
6171 check_special_stateids(struct net *net, svc_fh *current_fh, stateid_t *stateid, int flags)
6172 {
6173         if (ONE_STATEID(stateid) && (flags & RD_STATE))
6174                 return nfs_ok;
6175         else if (opens_in_grace(net)) {
6176                 /* Answer in remaining cases depends on existence of
6177                  * conflicting state; so we must wait out the grace period. */
6178                 return nfserr_grace;
6179         } else if (flags & WR_STATE)
6180                 return nfs4_share_conflict(current_fh,
6181                                 NFS4_SHARE_DENY_WRITE);
6182         else /* (flags & RD_STATE) && ZERO_STATEID(stateid) */
6183                 return nfs4_share_conflict(current_fh,
6184                                 NFS4_SHARE_DENY_READ);
6185 }
6186
6187 static __be32 check_stateid_generation(stateid_t *in, stateid_t *ref, bool has_session)
6188 {
6189         /*
6190          * When sessions are used the stateid generation number is ignored
6191          * when it is zero.
6192          */
6193         if (has_session && in->si_generation == 0)
6194                 return nfs_ok;
6195
6196         if (in->si_generation == ref->si_generation)
6197                 return nfs_ok;
6198
6199         /* If the client sends us a stateid from the future, it's buggy: */
6200         if (nfsd4_stateid_generation_after(in, ref))
6201                 return nfserr_bad_stateid;
6202         /*
6203          * However, we could see a stateid from the past, even from a
6204          * non-buggy client.  For example, if the client sends a lock
6205          * while some IO is outstanding, the lock may bump si_generation
6206          * while the IO is still in flight.  The client could avoid that
6207          * situation by waiting for responses on all the IO requests,
6208          * but better performance may result in retrying IO that
6209          * receives an old_stateid error if requests are rarely
6210          * reordered in flight:
6211          */
6212         return nfserr_old_stateid;
6213 }
6214
6215 static __be32 nfsd4_stid_check_stateid_generation(stateid_t *in, struct nfs4_stid *s, bool has_session)
6216 {
6217         __be32 ret;
6218
6219         spin_lock(&s->sc_lock);
6220         ret = nfsd4_verify_open_stid(s);
6221         if (ret == nfs_ok)
6222                 ret = check_stateid_generation(in, &s->sc_stateid, has_session);
6223         spin_unlock(&s->sc_lock);
6224         return ret;
6225 }
6226
6227 static __be32 nfsd4_check_openowner_confirmed(struct nfs4_ol_stateid *ols)
6228 {
6229         if (ols->st_stateowner->so_is_open_owner &&
6230             !(openowner(ols->st_stateowner)->oo_flags & NFS4_OO_CONFIRMED))
6231                 return nfserr_bad_stateid;
6232         return nfs_ok;
6233 }
6234
6235 static __be32 nfsd4_validate_stateid(struct nfs4_client *cl, stateid_t *stateid)
6236 {
6237         struct nfs4_stid *s;
6238         __be32 status = nfserr_bad_stateid;
6239
6240         if (ZERO_STATEID(stateid) || ONE_STATEID(stateid) ||
6241                 CLOSE_STATEID(stateid))
6242                 return status;
6243         if (!same_clid(&stateid->si_opaque.so_clid, &cl->cl_clientid))
6244                 return status;
6245         spin_lock(&cl->cl_lock);
6246         s = find_stateid_locked(cl, stateid);
6247         if (!s)
6248                 goto out_unlock;
6249         status = nfsd4_stid_check_stateid_generation(stateid, s, 1);
6250         if (status)
6251                 goto out_unlock;
6252         switch (s->sc_type) {
6253         case NFS4_DELEG_STID:
6254                 status = nfs_ok;
6255                 break;
6256         case NFS4_REVOKED_DELEG_STID:
6257                 status = nfserr_deleg_revoked;
6258                 break;
6259         case NFS4_OPEN_STID:
6260         case NFS4_LOCK_STID:
6261                 status = nfsd4_check_openowner_confirmed(openlockstateid(s));
6262                 break;
6263         default:
6264                 printk("unknown stateid type %x\n", s->sc_type);
6265                 fallthrough;
6266         case NFS4_CLOSED_STID:
6267         case NFS4_CLOSED_DELEG_STID:
6268                 status = nfserr_bad_stateid;
6269         }
6270 out_unlock:
6271         spin_unlock(&cl->cl_lock);
6272         return status;
6273 }
6274
6275 __be32
6276 nfsd4_lookup_stateid(struct nfsd4_compound_state *cstate,
6277                      stateid_t *stateid, unsigned char typemask,
6278                      struct nfs4_stid **s, struct nfsd_net *nn)
6279 {
6280         __be32 status;
6281         struct nfs4_stid *stid;
6282         bool return_revoked = false;
6283
6284         /*
6285          *  only return revoked delegations if explicitly asked.
6286          *  otherwise we report revoked or bad_stateid status.
6287          */
6288         if (typemask & NFS4_REVOKED_DELEG_STID)
6289                 return_revoked = true;
6290         else if (typemask & NFS4_DELEG_STID)
6291                 typemask |= NFS4_REVOKED_DELEG_STID;
6292
6293         if (ZERO_STATEID(stateid) || ONE_STATEID(stateid) ||
6294                 CLOSE_STATEID(stateid))
6295                 return nfserr_bad_stateid;
6296         status = set_client(&stateid->si_opaque.so_clid, cstate, nn);
6297         if (status == nfserr_stale_clientid) {
6298                 if (cstate->session)
6299                         return nfserr_bad_stateid;
6300                 return nfserr_stale_stateid;
6301         }
6302         if (status)
6303                 return status;
6304         stid = find_stateid_by_type(cstate->clp, stateid, typemask);
6305         if (!stid)
6306                 return nfserr_bad_stateid;
6307         if ((stid->sc_type == NFS4_REVOKED_DELEG_STID) && !return_revoked) {
6308                 nfs4_put_stid(stid);
6309                 if (cstate->minorversion)
6310                         return nfserr_deleg_revoked;
6311                 return nfserr_bad_stateid;
6312         }
6313         *s = stid;
6314         return nfs_ok;
6315 }
6316
6317 static struct nfsd_file *
6318 nfs4_find_file(struct nfs4_stid *s, int flags)
6319 {
6320         if (!s)
6321                 return NULL;
6322
6323         switch (s->sc_type) {
6324         case NFS4_DELEG_STID:
6325                 if (WARN_ON_ONCE(!s->sc_file->fi_deleg_file))
6326                         return NULL;
6327                 return nfsd_file_get(s->sc_file->fi_deleg_file);
6328         case NFS4_OPEN_STID:
6329         case NFS4_LOCK_STID:
6330                 if (flags & RD_STATE)
6331                         return find_readable_file(s->sc_file);
6332                 else
6333                         return find_writeable_file(s->sc_file);
6334         }
6335
6336         return NULL;
6337 }
6338
6339 static __be32
6340 nfs4_check_olstateid(struct nfs4_ol_stateid *ols, int flags)
6341 {
6342         __be32 status;
6343
6344         status = nfsd4_check_openowner_confirmed(ols);
6345         if (status)
6346                 return status;
6347         return nfs4_check_openmode(ols, flags);
6348 }
6349
6350 static __be32
6351 nfs4_check_file(struct svc_rqst *rqstp, struct svc_fh *fhp, struct nfs4_stid *s,
6352                 struct nfsd_file **nfp, int flags)
6353 {
6354         int acc = (flags & RD_STATE) ? NFSD_MAY_READ : NFSD_MAY_WRITE;
6355         struct nfsd_file *nf;
6356         __be32 status;
6357
6358         nf = nfs4_find_file(s, flags);
6359         if (nf) {
6360                 status = nfsd_permission(rqstp, fhp->fh_export, fhp->fh_dentry,
6361                                 acc | NFSD_MAY_OWNER_OVERRIDE);
6362                 if (status) {
6363                         nfsd_file_put(nf);
6364                         goto out;
6365                 }
6366         } else {
6367                 status = nfsd_file_acquire(rqstp, fhp, acc, &nf);
6368                 if (status)
6369                         return status;
6370         }
6371         *nfp = nf;
6372 out:
6373         return status;
6374 }
6375 static void
6376 _free_cpntf_state_locked(struct nfsd_net *nn, struct nfs4_cpntf_state *cps)
6377 {
6378         WARN_ON_ONCE(cps->cp_stateid.cs_type != NFS4_COPYNOTIFY_STID);
6379         if (!refcount_dec_and_test(&cps->cp_stateid.cs_count))
6380                 return;
6381         list_del(&cps->cp_list);
6382         idr_remove(&nn->s2s_cp_stateids,
6383                    cps->cp_stateid.cs_stid.si_opaque.so_id);
6384         kfree(cps);
6385 }
6386 /*
6387  * A READ from an inter server to server COPY will have a
6388  * copy stateid. Look up the copy notify stateid from the
6389  * idr structure and take a reference on it.
6390  */
6391 __be32 manage_cpntf_state(struct nfsd_net *nn, stateid_t *st,
6392                           struct nfs4_client *clp,
6393                           struct nfs4_cpntf_state **cps)
6394 {
6395         copy_stateid_t *cps_t;
6396         struct nfs4_cpntf_state *state = NULL;
6397
6398         if (st->si_opaque.so_clid.cl_id != nn->s2s_cp_cl_id)
6399                 return nfserr_bad_stateid;
6400         spin_lock(&nn->s2s_cp_lock);
6401         cps_t = idr_find(&nn->s2s_cp_stateids, st->si_opaque.so_id);
6402         if (cps_t) {
6403                 state = container_of(cps_t, struct nfs4_cpntf_state,
6404                                      cp_stateid);
6405                 if (state->cp_stateid.cs_type != NFS4_COPYNOTIFY_STID) {
6406                         state = NULL;
6407                         goto unlock;
6408                 }
6409                 if (!clp)
6410                         refcount_inc(&state->cp_stateid.cs_count);
6411                 else
6412                         _free_cpntf_state_locked(nn, state);
6413         }
6414 unlock:
6415         spin_unlock(&nn->s2s_cp_lock);
6416         if (!state)
6417                 return nfserr_bad_stateid;
6418         if (!clp && state)
6419                 *cps = state;
6420         return 0;
6421 }
6422
6423 static __be32 find_cpntf_state(struct nfsd_net *nn, stateid_t *st,
6424                                struct nfs4_stid **stid)
6425 {
6426         __be32 status;
6427         struct nfs4_cpntf_state *cps = NULL;
6428         struct nfs4_client *found;
6429
6430         status = manage_cpntf_state(nn, st, NULL, &cps);
6431         if (status)
6432                 return status;
6433
6434         cps->cpntf_time = ktime_get_boottime_seconds();
6435
6436         status = nfserr_expired;
6437         found = lookup_clientid(&cps->cp_p_clid, true, nn);
6438         if (!found)
6439                 goto out;
6440
6441         *stid = find_stateid_by_type(found, &cps->cp_p_stateid,
6442                         NFS4_DELEG_STID|NFS4_OPEN_STID|NFS4_LOCK_STID);
6443         if (*stid)
6444                 status = nfs_ok;
6445         else
6446                 status = nfserr_bad_stateid;
6447
6448         put_client_renew(found);
6449 out:
6450         nfs4_put_cpntf_state(nn, cps);
6451         return status;
6452 }
6453
6454 void nfs4_put_cpntf_state(struct nfsd_net *nn, struct nfs4_cpntf_state *cps)
6455 {
6456         spin_lock(&nn->s2s_cp_lock);
6457         _free_cpntf_state_locked(nn, cps);
6458         spin_unlock(&nn->s2s_cp_lock);
6459 }
6460
6461 /*
6462  * Checks for stateid operations
6463  */
6464 __be32
6465 nfs4_preprocess_stateid_op(struct svc_rqst *rqstp,
6466                 struct nfsd4_compound_state *cstate, struct svc_fh *fhp,
6467                 stateid_t *stateid, int flags, struct nfsd_file **nfp,
6468                 struct nfs4_stid **cstid)
6469 {
6470         struct net *net = SVC_NET(rqstp);
6471         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
6472         struct nfs4_stid *s = NULL;
6473         __be32 status;
6474
6475         if (nfp)
6476                 *nfp = NULL;
6477
6478         if (ZERO_STATEID(stateid) || ONE_STATEID(stateid)) {
6479                 if (cstid)
6480                         status = nfserr_bad_stateid;
6481                 else
6482                         status = check_special_stateids(net, fhp, stateid,
6483                                                                         flags);
6484                 goto done;
6485         }
6486
6487         status = nfsd4_lookup_stateid(cstate, stateid,
6488                                 NFS4_DELEG_STID|NFS4_OPEN_STID|NFS4_LOCK_STID,
6489                                 &s, nn);
6490         if (status == nfserr_bad_stateid)
6491                 status = find_cpntf_state(nn, stateid, &s);
6492         if (status)
6493                 return status;
6494         status = nfsd4_stid_check_stateid_generation(stateid, s,
6495                         nfsd4_has_session(cstate));
6496         if (status)
6497                 goto out;
6498
6499         switch (s->sc_type) {
6500         case NFS4_DELEG_STID:
6501                 status = nfs4_check_delegmode(delegstateid(s), flags);
6502                 break;
6503         case NFS4_OPEN_STID:
6504         case NFS4_LOCK_STID:
6505                 status = nfs4_check_olstateid(openlockstateid(s), flags);
6506                 break;
6507         default:
6508                 status = nfserr_bad_stateid;
6509                 break;
6510         }
6511         if (status)
6512                 goto out;
6513         status = nfs4_check_fh(fhp, s);
6514
6515 done:
6516         if (status == nfs_ok && nfp)
6517                 status = nfs4_check_file(rqstp, fhp, s, nfp, flags);
6518 out:
6519         if (s) {
6520                 if (!status && cstid)
6521                         *cstid = s;
6522                 else
6523                         nfs4_put_stid(s);
6524         }
6525         return status;
6526 }
6527
6528 /*
6529  * Test if the stateid is valid
6530  */
6531 __be32
6532 nfsd4_test_stateid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
6533                    union nfsd4_op_u *u)
6534 {
6535         struct nfsd4_test_stateid *test_stateid = &u->test_stateid;
6536         struct nfsd4_test_stateid_id *stateid;
6537         struct nfs4_client *cl = cstate->clp;
6538
6539         list_for_each_entry(stateid, &test_stateid->ts_stateid_list, ts_id_list)
6540                 stateid->ts_id_status =
6541                         nfsd4_validate_stateid(cl, &stateid->ts_id_stateid);
6542
6543         return nfs_ok;
6544 }
6545
6546 static __be32
6547 nfsd4_free_lock_stateid(stateid_t *stateid, struct nfs4_stid *s)
6548 {
6549         struct nfs4_ol_stateid *stp = openlockstateid(s);
6550         __be32 ret;
6551
6552         ret = nfsd4_lock_ol_stateid(stp);
6553         if (ret)
6554                 goto out_put_stid;
6555
6556         ret = check_stateid_generation(stateid, &s->sc_stateid, 1);
6557         if (ret)
6558                 goto out;
6559
6560         ret = nfserr_locks_held;
6561         if (check_for_locks(stp->st_stid.sc_file,
6562                             lockowner(stp->st_stateowner)))
6563                 goto out;
6564
6565         release_lock_stateid(stp);
6566         ret = nfs_ok;
6567
6568 out:
6569         mutex_unlock(&stp->st_mutex);
6570 out_put_stid:
6571         nfs4_put_stid(s);
6572         return ret;
6573 }
6574
6575 __be32
6576 nfsd4_free_stateid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
6577                    union nfsd4_op_u *u)
6578 {
6579         struct nfsd4_free_stateid *free_stateid = &u->free_stateid;
6580         stateid_t *stateid = &free_stateid->fr_stateid;
6581         struct nfs4_stid *s;
6582         struct nfs4_delegation *dp;
6583         struct nfs4_client *cl = cstate->clp;
6584         __be32 ret = nfserr_bad_stateid;
6585
6586         spin_lock(&cl->cl_lock);
6587         s = find_stateid_locked(cl, stateid);
6588         if (!s)
6589                 goto out_unlock;
6590         spin_lock(&s->sc_lock);
6591         switch (s->sc_type) {
6592         case NFS4_DELEG_STID:
6593                 ret = nfserr_locks_held;
6594                 break;
6595         case NFS4_OPEN_STID:
6596                 ret = check_stateid_generation(stateid, &s->sc_stateid, 1);
6597                 if (ret)
6598                         break;
6599                 ret = nfserr_locks_held;
6600                 break;
6601         case NFS4_LOCK_STID:
6602                 spin_unlock(&s->sc_lock);
6603                 refcount_inc(&s->sc_count);
6604                 spin_unlock(&cl->cl_lock);
6605                 ret = nfsd4_free_lock_stateid(stateid, s);
6606                 goto out;
6607         case NFS4_REVOKED_DELEG_STID:
6608                 spin_unlock(&s->sc_lock);
6609                 dp = delegstateid(s);
6610                 list_del_init(&dp->dl_recall_lru);
6611                 spin_unlock(&cl->cl_lock);
6612                 nfs4_put_stid(s);
6613                 ret = nfs_ok;
6614                 goto out;
6615         /* Default falls through and returns nfserr_bad_stateid */
6616         }
6617         spin_unlock(&s->sc_lock);
6618 out_unlock:
6619         spin_unlock(&cl->cl_lock);
6620 out:
6621         return ret;
6622 }
6623
6624 static inline int
6625 setlkflg (int type)
6626 {
6627         return (type == NFS4_READW_LT || type == NFS4_READ_LT) ?
6628                 RD_STATE : WR_STATE;
6629 }
6630
6631 static __be32 nfs4_seqid_op_checks(struct nfsd4_compound_state *cstate, stateid_t *stateid, u32 seqid, struct nfs4_ol_stateid *stp)
6632 {
6633         struct svc_fh *current_fh = &cstate->current_fh;
6634         struct nfs4_stateowner *sop = stp->st_stateowner;
6635         __be32 status;
6636
6637         status = nfsd4_check_seqid(cstate, sop, seqid);
6638         if (status)
6639                 return status;
6640         status = nfsd4_lock_ol_stateid(stp);
6641         if (status != nfs_ok)
6642                 return status;
6643         status = check_stateid_generation(stateid, &stp->st_stid.sc_stateid, nfsd4_has_session(cstate));
6644         if (status == nfs_ok)
6645                 status = nfs4_check_fh(current_fh, &stp->st_stid);
6646         if (status != nfs_ok)
6647                 mutex_unlock(&stp->st_mutex);
6648         return status;
6649 }
6650
6651 /*
6652  * Checks for sequence id mutating operations.
6653  */
6654 static __be32
6655 nfs4_preprocess_seqid_op(struct nfsd4_compound_state *cstate, u32 seqid,
6656                          stateid_t *stateid, char typemask,
6657                          struct nfs4_ol_stateid **stpp,
6658                          struct nfsd_net *nn)
6659 {
6660         __be32 status;
6661         struct nfs4_stid *s;
6662         struct nfs4_ol_stateid *stp = NULL;
6663
6664         trace_nfsd_preprocess(seqid, stateid);
6665
6666         *stpp = NULL;
6667         status = nfsd4_lookup_stateid(cstate, stateid, typemask, &s, nn);
6668         if (status)
6669                 return status;
6670         stp = openlockstateid(s);
6671         nfsd4_cstate_assign_replay(cstate, stp->st_stateowner);
6672
6673         status = nfs4_seqid_op_checks(cstate, stateid, seqid, stp);
6674         if (!status)
6675                 *stpp = stp;
6676         else
6677                 nfs4_put_stid(&stp->st_stid);
6678         return status;
6679 }
6680
6681 static __be32 nfs4_preprocess_confirmed_seqid_op(struct nfsd4_compound_state *cstate, u32 seqid,
6682                                                  stateid_t *stateid, struct nfs4_ol_stateid **stpp, struct nfsd_net *nn)
6683 {
6684         __be32 status;
6685         struct nfs4_openowner *oo;
6686         struct nfs4_ol_stateid *stp;
6687
6688         status = nfs4_preprocess_seqid_op(cstate, seqid, stateid,
6689                                                 NFS4_OPEN_STID, &stp, nn);
6690         if (status)
6691                 return status;
6692         oo = openowner(stp->st_stateowner);
6693         if (!(oo->oo_flags & NFS4_OO_CONFIRMED)) {
6694                 mutex_unlock(&stp->st_mutex);
6695                 nfs4_put_stid(&stp->st_stid);
6696                 return nfserr_bad_stateid;
6697         }
6698         *stpp = stp;
6699         return nfs_ok;
6700 }
6701
6702 __be32
6703 nfsd4_open_confirm(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
6704                    union nfsd4_op_u *u)
6705 {
6706         struct nfsd4_open_confirm *oc = &u->open_confirm;
6707         __be32 status;
6708         struct nfs4_openowner *oo;
6709         struct nfs4_ol_stateid *stp;
6710         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
6711
6712         dprintk("NFSD: nfsd4_open_confirm on file %pd\n",
6713                         cstate->current_fh.fh_dentry);
6714
6715         status = fh_verify(rqstp, &cstate->current_fh, S_IFREG, 0);
6716         if (status)
6717                 return status;
6718
6719         status = nfs4_preprocess_seqid_op(cstate,
6720                                         oc->oc_seqid, &oc->oc_req_stateid,
6721                                         NFS4_OPEN_STID, &stp, nn);
6722         if (status)
6723                 goto out;
6724         oo = openowner(stp->st_stateowner);
6725         status = nfserr_bad_stateid;
6726         if (oo->oo_flags & NFS4_OO_CONFIRMED) {
6727                 mutex_unlock(&stp->st_mutex);
6728                 goto put_stateid;
6729         }
6730         oo->oo_flags |= NFS4_OO_CONFIRMED;
6731         nfs4_inc_and_copy_stateid(&oc->oc_resp_stateid, &stp->st_stid);
6732         mutex_unlock(&stp->st_mutex);
6733         trace_nfsd_open_confirm(oc->oc_seqid, &stp->st_stid.sc_stateid);
6734         nfsd4_client_record_create(oo->oo_owner.so_client);
6735         status = nfs_ok;
6736 put_stateid:
6737         nfs4_put_stid(&stp->st_stid);
6738 out:
6739         nfsd4_bump_seqid(cstate, status);
6740         return status;
6741 }
6742
6743 static inline void nfs4_stateid_downgrade_bit(struct nfs4_ol_stateid *stp, u32 access)
6744 {
6745         if (!test_access(access, stp))
6746                 return;
6747         nfs4_file_put_access(stp->st_stid.sc_file, access);
6748         clear_access(access, stp);
6749 }
6750
6751 static inline void nfs4_stateid_downgrade(struct nfs4_ol_stateid *stp, u32 to_access)
6752 {
6753         switch (to_access) {
6754         case NFS4_SHARE_ACCESS_READ:
6755                 nfs4_stateid_downgrade_bit(stp, NFS4_SHARE_ACCESS_WRITE);
6756                 nfs4_stateid_downgrade_bit(stp, NFS4_SHARE_ACCESS_BOTH);
6757                 break;
6758         case NFS4_SHARE_ACCESS_WRITE:
6759                 nfs4_stateid_downgrade_bit(stp, NFS4_SHARE_ACCESS_READ);
6760                 nfs4_stateid_downgrade_bit(stp, NFS4_SHARE_ACCESS_BOTH);
6761                 break;
6762         case NFS4_SHARE_ACCESS_BOTH:
6763                 break;
6764         default:
6765                 WARN_ON_ONCE(1);
6766         }
6767 }
6768
6769 __be32
6770 nfsd4_open_downgrade(struct svc_rqst *rqstp,
6771                      struct nfsd4_compound_state *cstate, union nfsd4_op_u *u)
6772 {
6773         struct nfsd4_open_downgrade *od = &u->open_downgrade;
6774         __be32 status;
6775         struct nfs4_ol_stateid *stp;
6776         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
6777
6778         dprintk("NFSD: nfsd4_open_downgrade on file %pd\n",
6779                         cstate->current_fh.fh_dentry);
6780
6781         /* We don't yet support WANT bits: */
6782         if (od->od_deleg_want)
6783                 dprintk("NFSD: %s: od_deleg_want=0x%x ignored\n", __func__,
6784                         od->od_deleg_want);
6785
6786         status = nfs4_preprocess_confirmed_seqid_op(cstate, od->od_seqid,
6787                                         &od->od_stateid, &stp, nn);
6788         if (status)
6789                 goto out;
6790         status = nfserr_inval;
6791         if (!test_access(od->od_share_access, stp)) {
6792                 dprintk("NFSD: access not a subset of current bitmap: 0x%hhx, input access=%08x\n",
6793                         stp->st_access_bmap, od->od_share_access);
6794                 goto put_stateid;
6795         }
6796         if (!test_deny(od->od_share_deny, stp)) {
6797                 dprintk("NFSD: deny not a subset of current bitmap: 0x%hhx, input deny=%08x\n",
6798                         stp->st_deny_bmap, od->od_share_deny);
6799                 goto put_stateid;
6800         }
6801         nfs4_stateid_downgrade(stp, od->od_share_access);
6802         reset_union_bmap_deny(od->od_share_deny, stp);
6803         nfs4_inc_and_copy_stateid(&od->od_stateid, &stp->st_stid);
6804         status = nfs_ok;
6805 put_stateid:
6806         mutex_unlock(&stp->st_mutex);
6807         nfs4_put_stid(&stp->st_stid);
6808 out:
6809         nfsd4_bump_seqid(cstate, status);
6810         return status;
6811 }
6812
6813 static void nfsd4_close_open_stateid(struct nfs4_ol_stateid *s)
6814 {
6815         struct nfs4_client *clp = s->st_stid.sc_client;
6816         bool unhashed;
6817         LIST_HEAD(reaplist);
6818         struct nfs4_ol_stateid *stp;
6819
6820         spin_lock(&clp->cl_lock);
6821         unhashed = unhash_open_stateid(s, &reaplist);
6822
6823         if (clp->cl_minorversion) {
6824                 if (unhashed)
6825                         put_ol_stateid_locked(s, &reaplist);
6826                 spin_unlock(&clp->cl_lock);
6827                 list_for_each_entry(stp, &reaplist, st_locks)
6828                         nfs4_free_cpntf_statelist(clp->net, &stp->st_stid);
6829                 free_ol_stateid_reaplist(&reaplist);
6830         } else {
6831                 spin_unlock(&clp->cl_lock);
6832                 free_ol_stateid_reaplist(&reaplist);
6833                 if (unhashed)
6834                         move_to_close_lru(s, clp->net);
6835         }
6836 }
6837
6838 /*
6839  * nfs4_unlock_state() called after encode
6840  */
6841 __be32
6842 nfsd4_close(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
6843                 union nfsd4_op_u *u)
6844 {
6845         struct nfsd4_close *close = &u->close;
6846         __be32 status;
6847         struct nfs4_ol_stateid *stp;
6848         struct net *net = SVC_NET(rqstp);
6849         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
6850
6851         dprintk("NFSD: nfsd4_close on file %pd\n",
6852                         cstate->current_fh.fh_dentry);
6853
6854         status = nfs4_preprocess_seqid_op(cstate, close->cl_seqid,
6855                                         &close->cl_stateid,
6856                                         NFS4_OPEN_STID|NFS4_CLOSED_STID,
6857                                         &stp, nn);
6858         nfsd4_bump_seqid(cstate, status);
6859         if (status)
6860                 goto out;
6861
6862         stp->st_stid.sc_type = NFS4_CLOSED_STID;
6863
6864         /*
6865          * Technically we don't _really_ have to increment or copy it, since
6866          * it should just be gone after this operation and we clobber the
6867          * copied value below, but we continue to do so here just to ensure
6868          * that racing ops see that there was a state change.
6869          */
6870         nfs4_inc_and_copy_stateid(&close->cl_stateid, &stp->st_stid);
6871
6872         nfsd4_close_open_stateid(stp);
6873         mutex_unlock(&stp->st_mutex);
6874
6875         /* v4.1+ suggests that we send a special stateid in here, since the
6876          * clients should just ignore this anyway. Since this is not useful
6877          * for v4.0 clients either, we set it to the special close_stateid
6878          * universally.
6879          *
6880          * See RFC5661 section 18.2.4, and RFC7530 section 16.2.5
6881          */
6882         memcpy(&close->cl_stateid, &close_stateid, sizeof(close->cl_stateid));
6883
6884         /* put reference from nfs4_preprocess_seqid_op */
6885         nfs4_put_stid(&stp->st_stid);
6886 out:
6887         return status;
6888 }
6889
6890 __be32
6891 nfsd4_delegreturn(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
6892                   union nfsd4_op_u *u)
6893 {
6894         struct nfsd4_delegreturn *dr = &u->delegreturn;
6895         struct nfs4_delegation *dp;
6896         stateid_t *stateid = &dr->dr_stateid;
6897         struct nfs4_stid *s;
6898         __be32 status;
6899         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
6900
6901         if ((status = fh_verify(rqstp, &cstate->current_fh, S_IFREG, 0)))
6902                 return status;
6903
6904         status = nfsd4_lookup_stateid(cstate, stateid, NFS4_DELEG_STID, &s, nn);
6905         if (status)
6906                 goto out;
6907         dp = delegstateid(s);
6908         status = nfsd4_stid_check_stateid_generation(stateid, &dp->dl_stid, nfsd4_has_session(cstate));
6909         if (status)
6910                 goto put_stateid;
6911
6912         wake_up_var(d_inode(cstate->current_fh.fh_dentry));
6913         destroy_delegation(dp);
6914 put_stateid:
6915         nfs4_put_stid(&dp->dl_stid);
6916 out:
6917         return status;
6918 }
6919
6920 /* last octet in a range */
6921 static inline u64
6922 last_byte_offset(u64 start, u64 len)
6923 {
6924         u64 end;
6925
6926         WARN_ON_ONCE(!len);
6927         end = start + len;
6928         return end > start ? end - 1: NFS4_MAX_UINT64;
6929 }
6930
6931 /*
6932  * TODO: Linux file offsets are _signed_ 64-bit quantities, which means that
6933  * we can't properly handle lock requests that go beyond the (2^63 - 1)-th
6934  * byte, because of sign extension problems.  Since NFSv4 calls for 64-bit
6935  * locking, this prevents us from being completely protocol-compliant.  The
6936  * real solution to this problem is to start using unsigned file offsets in
6937  * the VFS, but this is a very deep change!
6938  */
6939 static inline void
6940 nfs4_transform_lock_offset(struct file_lock *lock)
6941 {
6942         if (lock->fl_start < 0)
6943                 lock->fl_start = OFFSET_MAX;
6944         if (lock->fl_end < 0)
6945                 lock->fl_end = OFFSET_MAX;
6946 }
6947
6948 static fl_owner_t
6949 nfsd4_lm_get_owner(fl_owner_t owner)
6950 {
6951         struct nfs4_lockowner *lo = (struct nfs4_lockowner *)owner;
6952
6953         nfs4_get_stateowner(&lo->lo_owner);
6954         return owner;
6955 }
6956
6957 static void
6958 nfsd4_lm_put_owner(fl_owner_t owner)
6959 {
6960         struct nfs4_lockowner *lo = (struct nfs4_lockowner *)owner;
6961
6962         if (lo)
6963                 nfs4_put_stateowner(&lo->lo_owner);
6964 }
6965
6966 /* return pointer to struct nfs4_client if client is expirable */
6967 static bool
6968 nfsd4_lm_lock_expirable(struct file_lock *cfl)
6969 {
6970         struct nfs4_lockowner *lo = (struct nfs4_lockowner *)cfl->fl_owner;
6971         struct nfs4_client *clp = lo->lo_owner.so_client;
6972         struct nfsd_net *nn;
6973
6974         if (try_to_expire_client(clp)) {
6975                 nn = net_generic(clp->net, nfsd_net_id);
6976                 mod_delayed_work(laundry_wq, &nn->laundromat_work, 0);
6977                 return true;
6978         }
6979         return false;
6980 }
6981
6982 /* schedule laundromat to run immediately and wait for it to complete */
6983 static void
6984 nfsd4_lm_expire_lock(void)
6985 {
6986         flush_workqueue(laundry_wq);
6987 }
6988
6989 static void
6990 nfsd4_lm_notify(struct file_lock *fl)
6991 {
6992         struct nfs4_lockowner           *lo = (struct nfs4_lockowner *)fl->fl_owner;
6993         struct net                      *net = lo->lo_owner.so_client->net;
6994         struct nfsd_net                 *nn = net_generic(net, nfsd_net_id);
6995         struct nfsd4_blocked_lock       *nbl = container_of(fl,
6996                                                 struct nfsd4_blocked_lock, nbl_lock);
6997         bool queue = false;
6998
6999         /* An empty list means that something else is going to be using it */
7000         spin_lock(&nn->blocked_locks_lock);
7001         if (!list_empty(&nbl->nbl_list)) {
7002                 list_del_init(&nbl->nbl_list);
7003                 list_del_init(&nbl->nbl_lru);
7004                 queue = true;
7005         }
7006         spin_unlock(&nn->blocked_locks_lock);
7007
7008         if (queue) {
7009                 trace_nfsd_cb_notify_lock(lo, nbl);
7010                 nfsd4_run_cb(&nbl->nbl_cb);
7011         }
7012 }
7013
7014 static const struct lock_manager_operations nfsd_posix_mng_ops  = {
7015         .lm_mod_owner = THIS_MODULE,
7016         .lm_notify = nfsd4_lm_notify,
7017         .lm_get_owner = nfsd4_lm_get_owner,
7018         .lm_put_owner = nfsd4_lm_put_owner,
7019         .lm_lock_expirable = nfsd4_lm_lock_expirable,
7020         .lm_expire_lock = nfsd4_lm_expire_lock,
7021 };
7022
7023 static inline void
7024 nfs4_set_lock_denied(struct file_lock *fl, struct nfsd4_lock_denied *deny)
7025 {
7026         struct nfs4_lockowner *lo;
7027
7028         if (fl->fl_lmops == &nfsd_posix_mng_ops) {
7029                 lo = (struct nfs4_lockowner *) fl->fl_owner;
7030                 xdr_netobj_dup(&deny->ld_owner, &lo->lo_owner.so_owner,
7031                                                 GFP_KERNEL);
7032                 if (!deny->ld_owner.data)
7033                         /* We just don't care that much */
7034                         goto nevermind;
7035                 deny->ld_clientid = lo->lo_owner.so_client->cl_clientid;
7036         } else {
7037 nevermind:
7038                 deny->ld_owner.len = 0;
7039                 deny->ld_owner.data = NULL;
7040                 deny->ld_clientid.cl_boot = 0;
7041                 deny->ld_clientid.cl_id = 0;
7042         }
7043         deny->ld_start = fl->fl_start;
7044         deny->ld_length = NFS4_MAX_UINT64;
7045         if (fl->fl_end != NFS4_MAX_UINT64)
7046                 deny->ld_length = fl->fl_end - fl->fl_start + 1;
7047         deny->ld_type = NFS4_READ_LT;
7048         if (fl->fl_type != F_RDLCK)
7049                 deny->ld_type = NFS4_WRITE_LT;
7050 }
7051
7052 static struct nfs4_lockowner *
7053 find_lockowner_str_locked(struct nfs4_client *clp, struct xdr_netobj *owner)
7054 {
7055         unsigned int strhashval = ownerstr_hashval(owner);
7056         struct nfs4_stateowner *so;
7057
7058         lockdep_assert_held(&clp->cl_lock);
7059
7060         list_for_each_entry(so, &clp->cl_ownerstr_hashtbl[strhashval],
7061                             so_strhash) {
7062                 if (so->so_is_open_owner)
7063                         continue;
7064                 if (same_owner_str(so, owner))
7065                         return lockowner(nfs4_get_stateowner(so));
7066         }
7067         return NULL;
7068 }
7069
7070 static struct nfs4_lockowner *
7071 find_lockowner_str(struct nfs4_client *clp, struct xdr_netobj *owner)
7072 {
7073         struct nfs4_lockowner *lo;
7074
7075         spin_lock(&clp->cl_lock);
7076         lo = find_lockowner_str_locked(clp, owner);
7077         spin_unlock(&clp->cl_lock);
7078         return lo;
7079 }
7080
7081 static void nfs4_unhash_lockowner(struct nfs4_stateowner *sop)
7082 {
7083         unhash_lockowner_locked(lockowner(sop));
7084 }
7085
7086 static void nfs4_free_lockowner(struct nfs4_stateowner *sop)
7087 {
7088         struct nfs4_lockowner *lo = lockowner(sop);
7089
7090         kmem_cache_free(lockowner_slab, lo);
7091 }
7092
7093 static const struct nfs4_stateowner_operations lockowner_ops = {
7094         .so_unhash =    nfs4_unhash_lockowner,
7095         .so_free =      nfs4_free_lockowner,
7096 };
7097
7098 /*
7099  * Alloc a lock owner structure.
7100  * Called in nfsd4_lock - therefore, OPEN and OPEN_CONFIRM (if needed) has
7101  * occurred.
7102  *
7103  * strhashval = ownerstr_hashval
7104  */
7105 static struct nfs4_lockowner *
7106 alloc_init_lock_stateowner(unsigned int strhashval, struct nfs4_client *clp,
7107                            struct nfs4_ol_stateid *open_stp,
7108                            struct nfsd4_lock *lock)
7109 {
7110         struct nfs4_lockowner *lo, *ret;
7111
7112         lo = alloc_stateowner(lockowner_slab, &lock->lk_new_owner, clp);
7113         if (!lo)
7114                 return NULL;
7115         INIT_LIST_HEAD(&lo->lo_blocked);
7116         INIT_LIST_HEAD(&lo->lo_owner.so_stateids);
7117         lo->lo_owner.so_is_open_owner = 0;
7118         lo->lo_owner.so_seqid = lock->lk_new_lock_seqid;
7119         lo->lo_owner.so_ops = &lockowner_ops;
7120         spin_lock(&clp->cl_lock);
7121         ret = find_lockowner_str_locked(clp, &lock->lk_new_owner);
7122         if (ret == NULL) {
7123                 list_add(&lo->lo_owner.so_strhash,
7124                          &clp->cl_ownerstr_hashtbl[strhashval]);
7125                 ret = lo;
7126         } else
7127                 nfs4_free_stateowner(&lo->lo_owner);
7128
7129         spin_unlock(&clp->cl_lock);
7130         return ret;
7131 }
7132
7133 static struct nfs4_ol_stateid *
7134 find_lock_stateid(const struct nfs4_lockowner *lo,
7135                   const struct nfs4_ol_stateid *ost)
7136 {
7137         struct nfs4_ol_stateid *lst;
7138
7139         lockdep_assert_held(&ost->st_stid.sc_client->cl_lock);
7140
7141         /* If ost is not hashed, ost->st_locks will not be valid */
7142         if (!nfs4_ol_stateid_unhashed(ost))
7143                 list_for_each_entry(lst, &ost->st_locks, st_locks) {
7144                         if (lst->st_stateowner == &lo->lo_owner) {
7145                                 refcount_inc(&lst->st_stid.sc_count);
7146                                 return lst;
7147                         }
7148                 }
7149         return NULL;
7150 }
7151
7152 static struct nfs4_ol_stateid *
7153 init_lock_stateid(struct nfs4_ol_stateid *stp, struct nfs4_lockowner *lo,
7154                   struct nfs4_file *fp, struct inode *inode,
7155                   struct nfs4_ol_stateid *open_stp)
7156 {
7157         struct nfs4_client *clp = lo->lo_owner.so_client;
7158         struct nfs4_ol_stateid *retstp;
7159
7160         mutex_init(&stp->st_mutex);
7161         mutex_lock_nested(&stp->st_mutex, OPEN_STATEID_MUTEX);
7162 retry:
7163         spin_lock(&clp->cl_lock);
7164         if (nfs4_ol_stateid_unhashed(open_stp))
7165                 goto out_close;
7166         retstp = find_lock_stateid(lo, open_stp);
7167         if (retstp)
7168                 goto out_found;
7169         refcount_inc(&stp->st_stid.sc_count);
7170         stp->st_stid.sc_type = NFS4_LOCK_STID;
7171         stp->st_stateowner = nfs4_get_stateowner(&lo->lo_owner);
7172         get_nfs4_file(fp);
7173         stp->st_stid.sc_file = fp;
7174         stp->st_access_bmap = 0;
7175         stp->st_deny_bmap = open_stp->st_deny_bmap;
7176         stp->st_openstp = open_stp;
7177         spin_lock(&fp->fi_lock);
7178         list_add(&stp->st_locks, &open_stp->st_locks);
7179         list_add(&stp->st_perstateowner, &lo->lo_owner.so_stateids);
7180         list_add(&stp->st_perfile, &fp->fi_stateids);
7181         spin_unlock(&fp->fi_lock);
7182         spin_unlock(&clp->cl_lock);
7183         return stp;
7184 out_found:
7185         spin_unlock(&clp->cl_lock);
7186         if (nfsd4_lock_ol_stateid(retstp) != nfs_ok) {
7187                 nfs4_put_stid(&retstp->st_stid);
7188                 goto retry;
7189         }
7190         /* To keep mutex tracking happy */
7191         mutex_unlock(&stp->st_mutex);
7192         return retstp;
7193 out_close:
7194         spin_unlock(&clp->cl_lock);
7195         mutex_unlock(&stp->st_mutex);
7196         return NULL;
7197 }
7198
7199 static struct nfs4_ol_stateid *
7200 find_or_create_lock_stateid(struct nfs4_lockowner *lo, struct nfs4_file *fi,
7201                             struct inode *inode, struct nfs4_ol_stateid *ost,
7202                             bool *new)
7203 {
7204         struct nfs4_stid *ns = NULL;
7205         struct nfs4_ol_stateid *lst;
7206         struct nfs4_openowner *oo = openowner(ost->st_stateowner);
7207         struct nfs4_client *clp = oo->oo_owner.so_client;
7208
7209         *new = false;
7210         spin_lock(&clp->cl_lock);
7211         lst = find_lock_stateid(lo, ost);
7212         spin_unlock(&clp->cl_lock);
7213         if (lst != NULL) {
7214                 if (nfsd4_lock_ol_stateid(lst) == nfs_ok)
7215                         goto out;
7216                 nfs4_put_stid(&lst->st_stid);
7217         }
7218         ns = nfs4_alloc_stid(clp, stateid_slab, nfs4_free_lock_stateid);
7219         if (ns == NULL)
7220                 return NULL;
7221
7222         lst = init_lock_stateid(openlockstateid(ns), lo, fi, inode, ost);
7223         if (lst == openlockstateid(ns))
7224                 *new = true;
7225         else
7226                 nfs4_put_stid(ns);
7227 out:
7228         return lst;
7229 }
7230
7231 static int
7232 check_lock_length(u64 offset, u64 length)
7233 {
7234         return ((length == 0) || ((length != NFS4_MAX_UINT64) &&
7235                 (length > ~offset)));
7236 }
7237
7238 static void get_lock_access(struct nfs4_ol_stateid *lock_stp, u32 access)
7239 {
7240         struct nfs4_file *fp = lock_stp->st_stid.sc_file;
7241
7242         lockdep_assert_held(&fp->fi_lock);
7243
7244         if (test_access(access, lock_stp))
7245                 return;
7246         __nfs4_file_get_access(fp, access);
7247         set_access(access, lock_stp);
7248 }
7249
7250 static __be32
7251 lookup_or_create_lock_state(struct nfsd4_compound_state *cstate,
7252                             struct nfs4_ol_stateid *ost,
7253                             struct nfsd4_lock *lock,
7254                             struct nfs4_ol_stateid **plst, bool *new)
7255 {
7256         __be32 status;
7257         struct nfs4_file *fi = ost->st_stid.sc_file;
7258         struct nfs4_openowner *oo = openowner(ost->st_stateowner);
7259         struct nfs4_client *cl = oo->oo_owner.so_client;
7260         struct inode *inode = d_inode(cstate->current_fh.fh_dentry);
7261         struct nfs4_lockowner *lo;
7262         struct nfs4_ol_stateid *lst;
7263         unsigned int strhashval;
7264
7265         lo = find_lockowner_str(cl, &lock->lk_new_owner);
7266         if (!lo) {
7267                 strhashval = ownerstr_hashval(&lock->lk_new_owner);
7268                 lo = alloc_init_lock_stateowner(strhashval, cl, ost, lock);
7269                 if (lo == NULL)
7270                         return nfserr_jukebox;
7271         } else {
7272                 /* with an existing lockowner, seqids must be the same */
7273                 status = nfserr_bad_seqid;
7274                 if (!cstate->minorversion &&
7275                     lock->lk_new_lock_seqid != lo->lo_owner.so_seqid)
7276                         goto out;
7277         }
7278
7279         lst = find_or_create_lock_stateid(lo, fi, inode, ost, new);
7280         if (lst == NULL) {
7281                 status = nfserr_jukebox;
7282                 goto out;
7283         }
7284
7285         status = nfs_ok;
7286         *plst = lst;
7287 out:
7288         nfs4_put_stateowner(&lo->lo_owner);
7289         return status;
7290 }
7291
7292 /*
7293  *  LOCK operation
7294  */
7295 __be32
7296 nfsd4_lock(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
7297            union nfsd4_op_u *u)
7298 {
7299         struct nfsd4_lock *lock = &u->lock;
7300         struct nfs4_openowner *open_sop = NULL;
7301         struct nfs4_lockowner *lock_sop = NULL;
7302         struct nfs4_ol_stateid *lock_stp = NULL;
7303         struct nfs4_ol_stateid *open_stp = NULL;
7304         struct nfs4_file *fp;
7305         struct nfsd_file *nf = NULL;
7306         struct nfsd4_blocked_lock *nbl = NULL;
7307         struct file_lock *file_lock = NULL;
7308         struct file_lock *conflock = NULL;
7309         __be32 status = 0;
7310         int lkflg;
7311         int err;
7312         bool new = false;
7313         unsigned char fl_type;
7314         unsigned int fl_flags = FL_POSIX;
7315         struct net *net = SVC_NET(rqstp);
7316         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
7317
7318         dprintk("NFSD: nfsd4_lock: start=%Ld length=%Ld\n",
7319                 (long long) lock->lk_offset,
7320                 (long long) lock->lk_length);
7321
7322         if (check_lock_length(lock->lk_offset, lock->lk_length))
7323                  return nfserr_inval;
7324
7325         if ((status = fh_verify(rqstp, &cstate->current_fh,
7326                                 S_IFREG, NFSD_MAY_LOCK))) {
7327                 dprintk("NFSD: nfsd4_lock: permission denied!\n");
7328                 return status;
7329         }
7330
7331         if (lock->lk_is_new) {
7332                 if (nfsd4_has_session(cstate))
7333                         /* See rfc 5661 18.10.3: given clientid is ignored: */
7334                         memcpy(&lock->lk_new_clientid,
7335                                 &cstate->clp->cl_clientid,
7336                                 sizeof(clientid_t));
7337
7338                 /* validate and update open stateid and open seqid */
7339                 status = nfs4_preprocess_confirmed_seqid_op(cstate,
7340                                         lock->lk_new_open_seqid,
7341                                         &lock->lk_new_open_stateid,
7342                                         &open_stp, nn);
7343                 if (status)
7344                         goto out;
7345                 mutex_unlock(&open_stp->st_mutex);
7346                 open_sop = openowner(open_stp->st_stateowner);
7347                 status = nfserr_bad_stateid;
7348                 if (!same_clid(&open_sop->oo_owner.so_client->cl_clientid,
7349                                                 &lock->lk_new_clientid))
7350                         goto out;
7351                 status = lookup_or_create_lock_state(cstate, open_stp, lock,
7352                                                         &lock_stp, &new);
7353         } else {
7354                 status = nfs4_preprocess_seqid_op(cstate,
7355                                        lock->lk_old_lock_seqid,
7356                                        &lock->lk_old_lock_stateid,
7357                                        NFS4_LOCK_STID, &lock_stp, nn);
7358         }
7359         if (status)
7360                 goto out;
7361         lock_sop = lockowner(lock_stp->st_stateowner);
7362
7363         lkflg = setlkflg(lock->lk_type);
7364         status = nfs4_check_openmode(lock_stp, lkflg);
7365         if (status)
7366                 goto out;
7367
7368         status = nfserr_grace;
7369         if (locks_in_grace(net) && !lock->lk_reclaim)
7370                 goto out;
7371         status = nfserr_no_grace;
7372         if (!locks_in_grace(net) && lock->lk_reclaim)
7373                 goto out;
7374
7375         if (lock->lk_reclaim)
7376                 fl_flags |= FL_RECLAIM;
7377
7378         fp = lock_stp->st_stid.sc_file;
7379         switch (lock->lk_type) {
7380                 case NFS4_READW_LT:
7381                         if (nfsd4_has_session(cstate))
7382                                 fl_flags |= FL_SLEEP;
7383                         fallthrough;
7384                 case NFS4_READ_LT:
7385                         spin_lock(&fp->fi_lock);
7386                         nf = find_readable_file_locked(fp);
7387                         if (nf)
7388                                 get_lock_access(lock_stp, NFS4_SHARE_ACCESS_READ);
7389                         spin_unlock(&fp->fi_lock);
7390                         fl_type = F_RDLCK;
7391                         break;
7392                 case NFS4_WRITEW_LT:
7393                         if (nfsd4_has_session(cstate))
7394                                 fl_flags |= FL_SLEEP;
7395                         fallthrough;
7396                 case NFS4_WRITE_LT:
7397                         spin_lock(&fp->fi_lock);
7398                         nf = find_writeable_file_locked(fp);
7399                         if (nf)
7400                                 get_lock_access(lock_stp, NFS4_SHARE_ACCESS_WRITE);
7401                         spin_unlock(&fp->fi_lock);
7402                         fl_type = F_WRLCK;
7403                         break;
7404                 default:
7405                         status = nfserr_inval;
7406                 goto out;
7407         }
7408
7409         if (!nf) {
7410                 status = nfserr_openmode;
7411                 goto out;
7412         }
7413
7414         /*
7415          * Most filesystems with their own ->lock operations will block
7416          * the nfsd thread waiting to acquire the lock.  That leads to
7417          * deadlocks (we don't want every nfsd thread tied up waiting
7418          * for file locks), so don't attempt blocking lock notifications
7419          * on those filesystems:
7420          */
7421         if (nf->nf_file->f_op->lock)
7422                 fl_flags &= ~FL_SLEEP;
7423
7424         nbl = find_or_allocate_block(lock_sop, &fp->fi_fhandle, nn);
7425         if (!nbl) {
7426                 dprintk("NFSD: %s: unable to allocate block!\n", __func__);
7427                 status = nfserr_jukebox;
7428                 goto out;
7429         }
7430
7431         file_lock = &nbl->nbl_lock;
7432         file_lock->fl_type = fl_type;
7433         file_lock->fl_owner = (fl_owner_t)lockowner(nfs4_get_stateowner(&lock_sop->lo_owner));
7434         file_lock->fl_pid = current->tgid;
7435         file_lock->fl_file = nf->nf_file;
7436         file_lock->fl_flags = fl_flags;
7437         file_lock->fl_lmops = &nfsd_posix_mng_ops;
7438         file_lock->fl_start = lock->lk_offset;
7439         file_lock->fl_end = last_byte_offset(lock->lk_offset, lock->lk_length);
7440         nfs4_transform_lock_offset(file_lock);
7441
7442         conflock = locks_alloc_lock();
7443         if (!conflock) {
7444                 dprintk("NFSD: %s: unable to allocate lock!\n", __func__);
7445                 status = nfserr_jukebox;
7446                 goto out;
7447         }
7448
7449         if (fl_flags & FL_SLEEP) {
7450                 nbl->nbl_time = ktime_get_boottime_seconds();
7451                 spin_lock(&nn->blocked_locks_lock);
7452                 list_add_tail(&nbl->nbl_list, &lock_sop->lo_blocked);
7453                 list_add_tail(&nbl->nbl_lru, &nn->blocked_locks_lru);
7454                 kref_get(&nbl->nbl_kref);
7455                 spin_unlock(&nn->blocked_locks_lock);
7456         }
7457
7458         err = vfs_lock_file(nf->nf_file, F_SETLK, file_lock, conflock);
7459         switch (err) {
7460         case 0: /* success! */
7461                 nfs4_inc_and_copy_stateid(&lock->lk_resp_stateid, &lock_stp->st_stid);
7462                 status = 0;
7463                 if (lock->lk_reclaim)
7464                         nn->somebody_reclaimed = true;
7465                 break;
7466         case FILE_LOCK_DEFERRED:
7467                 kref_put(&nbl->nbl_kref, free_nbl);
7468                 nbl = NULL;
7469                 fallthrough;
7470         case -EAGAIN:           /* conflock holds conflicting lock */
7471                 status = nfserr_denied;
7472                 dprintk("NFSD: nfsd4_lock: conflicting lock found!\n");
7473                 nfs4_set_lock_denied(conflock, &lock->lk_denied);
7474                 break;
7475         case -EDEADLK:
7476                 status = nfserr_deadlock;
7477                 break;
7478         default:
7479                 dprintk("NFSD: nfsd4_lock: vfs_lock_file() failed! status %d\n",err);
7480                 status = nfserrno(err);
7481                 break;
7482         }
7483 out:
7484         if (nbl) {
7485                 /* dequeue it if we queued it before */
7486                 if (fl_flags & FL_SLEEP) {
7487                         spin_lock(&nn->blocked_locks_lock);
7488                         if (!list_empty(&nbl->nbl_list) &&
7489                             !list_empty(&nbl->nbl_lru)) {
7490                                 list_del_init(&nbl->nbl_list);
7491                                 list_del_init(&nbl->nbl_lru);
7492                                 kref_put(&nbl->nbl_kref, free_nbl);
7493                         }
7494                         /* nbl can use one of lists to be linked to reaplist */
7495                         spin_unlock(&nn->blocked_locks_lock);
7496                 }
7497                 free_blocked_lock(nbl);
7498         }
7499         if (nf)
7500                 nfsd_file_put(nf);
7501         if (lock_stp) {
7502                 /* Bump seqid manually if the 4.0 replay owner is openowner */
7503                 if (cstate->replay_owner &&
7504                     cstate->replay_owner != &lock_sop->lo_owner &&
7505                     seqid_mutating_err(ntohl(status)))
7506                         lock_sop->lo_owner.so_seqid++;
7507
7508                 /*
7509                  * If this is a new, never-before-used stateid, and we are
7510                  * returning an error, then just go ahead and release it.
7511                  */
7512                 if (status && new)
7513                         release_lock_stateid(lock_stp);
7514
7515                 mutex_unlock(&lock_stp->st_mutex);
7516
7517                 nfs4_put_stid(&lock_stp->st_stid);
7518         }
7519         if (open_stp)
7520                 nfs4_put_stid(&open_stp->st_stid);
7521         nfsd4_bump_seqid(cstate, status);
7522         if (conflock)
7523                 locks_free_lock(conflock);
7524         return status;
7525 }
7526
7527 /*
7528  * The NFSv4 spec allows a client to do a LOCKT without holding an OPEN,
7529  * so we do a temporary open here just to get an open file to pass to
7530  * vfs_test_lock.
7531  */
7532 static __be32 nfsd_test_lock(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file_lock *lock)
7533 {
7534         struct nfsd_file *nf;
7535         struct inode *inode;
7536         __be32 err;
7537
7538         err = nfsd_file_acquire(rqstp, fhp, NFSD_MAY_READ, &nf);
7539         if (err)
7540                 return err;
7541         inode = fhp->fh_dentry->d_inode;
7542         inode_lock(inode); /* to block new leases till after test_lock: */
7543         err = nfserrno(nfsd_open_break_lease(inode, NFSD_MAY_READ));
7544         if (err)
7545                 goto out;
7546         lock->fl_file = nf->nf_file;
7547         err = nfserrno(vfs_test_lock(nf->nf_file, lock));
7548         lock->fl_file = NULL;
7549 out:
7550         inode_unlock(inode);
7551         nfsd_file_put(nf);
7552         return err;
7553 }
7554
7555 /*
7556  * LOCKT operation
7557  */
7558 __be32
7559 nfsd4_lockt(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
7560             union nfsd4_op_u *u)
7561 {
7562         struct nfsd4_lockt *lockt = &u->lockt;
7563         struct file_lock *file_lock = NULL;
7564         struct nfs4_lockowner *lo = NULL;
7565         __be32 status;
7566         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
7567
7568         if (locks_in_grace(SVC_NET(rqstp)))
7569                 return nfserr_grace;
7570
7571         if (check_lock_length(lockt->lt_offset, lockt->lt_length))
7572                  return nfserr_inval;
7573
7574         if (!nfsd4_has_session(cstate)) {
7575                 status = set_client(&lockt->lt_clientid, cstate, nn);
7576                 if (status)
7577                         goto out;
7578         }
7579
7580         if ((status = fh_verify(rqstp, &cstate->current_fh, S_IFREG, 0)))
7581                 goto out;
7582
7583         file_lock = locks_alloc_lock();
7584         if (!file_lock) {
7585                 dprintk("NFSD: %s: unable to allocate lock!\n", __func__);
7586                 status = nfserr_jukebox;
7587                 goto out;
7588         }
7589
7590         switch (lockt->lt_type) {
7591                 case NFS4_READ_LT:
7592                 case NFS4_READW_LT:
7593                         file_lock->fl_type = F_RDLCK;
7594                         break;
7595                 case NFS4_WRITE_LT:
7596                 case NFS4_WRITEW_LT:
7597                         file_lock->fl_type = F_WRLCK;
7598                         break;
7599                 default:
7600                         dprintk("NFSD: nfs4_lockt: bad lock type!\n");
7601                         status = nfserr_inval;
7602                         goto out;
7603         }
7604
7605         lo = find_lockowner_str(cstate->clp, &lockt->lt_owner);
7606         if (lo)
7607                 file_lock->fl_owner = (fl_owner_t)lo;
7608         file_lock->fl_pid = current->tgid;
7609         file_lock->fl_flags = FL_POSIX;
7610
7611         file_lock->fl_start = lockt->lt_offset;
7612         file_lock->fl_end = last_byte_offset(lockt->lt_offset, lockt->lt_length);
7613
7614         nfs4_transform_lock_offset(file_lock);
7615
7616         status = nfsd_test_lock(rqstp, &cstate->current_fh, file_lock);
7617         if (status)
7618                 goto out;
7619
7620         if (file_lock->fl_type != F_UNLCK) {
7621                 status = nfserr_denied;
7622                 nfs4_set_lock_denied(file_lock, &lockt->lt_denied);
7623         }
7624 out:
7625         if (lo)
7626                 nfs4_put_stateowner(&lo->lo_owner);
7627         if (file_lock)
7628                 locks_free_lock(file_lock);
7629         return status;
7630 }
7631
7632 __be32
7633 nfsd4_locku(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
7634             union nfsd4_op_u *u)
7635 {
7636         struct nfsd4_locku *locku = &u->locku;
7637         struct nfs4_ol_stateid *stp;
7638         struct nfsd_file *nf = NULL;
7639         struct file_lock *file_lock = NULL;
7640         __be32 status;
7641         int err;
7642         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
7643
7644         dprintk("NFSD: nfsd4_locku: start=%Ld length=%Ld\n",
7645                 (long long) locku->lu_offset,
7646                 (long long) locku->lu_length);
7647
7648         if (check_lock_length(locku->lu_offset, locku->lu_length))
7649                  return nfserr_inval;
7650
7651         status = nfs4_preprocess_seqid_op(cstate, locku->lu_seqid,
7652                                         &locku->lu_stateid, NFS4_LOCK_STID,
7653                                         &stp, nn);
7654         if (status)
7655                 goto out;
7656         nf = find_any_file(stp->st_stid.sc_file);
7657         if (!nf) {
7658                 status = nfserr_lock_range;
7659                 goto put_stateid;
7660         }
7661         file_lock = locks_alloc_lock();
7662         if (!file_lock) {
7663                 dprintk("NFSD: %s: unable to allocate lock!\n", __func__);
7664                 status = nfserr_jukebox;
7665                 goto put_file;
7666         }
7667
7668         file_lock->fl_type = F_UNLCK;
7669         file_lock->fl_owner = (fl_owner_t)lockowner(nfs4_get_stateowner(stp->st_stateowner));
7670         file_lock->fl_pid = current->tgid;
7671         file_lock->fl_file = nf->nf_file;
7672         file_lock->fl_flags = FL_POSIX;
7673         file_lock->fl_lmops = &nfsd_posix_mng_ops;
7674         file_lock->fl_start = locku->lu_offset;
7675
7676         file_lock->fl_end = last_byte_offset(locku->lu_offset,
7677                                                 locku->lu_length);
7678         nfs4_transform_lock_offset(file_lock);
7679
7680         err = vfs_lock_file(nf->nf_file, F_SETLK, file_lock, NULL);
7681         if (err) {
7682                 dprintk("NFSD: nfs4_locku: vfs_lock_file failed!\n");
7683                 goto out_nfserr;
7684         }
7685         nfs4_inc_and_copy_stateid(&locku->lu_stateid, &stp->st_stid);
7686 put_file:
7687         nfsd_file_put(nf);
7688 put_stateid:
7689         mutex_unlock(&stp->st_mutex);
7690         nfs4_put_stid(&stp->st_stid);
7691 out:
7692         nfsd4_bump_seqid(cstate, status);
7693         if (file_lock)
7694                 locks_free_lock(file_lock);
7695         return status;
7696
7697 out_nfserr:
7698         status = nfserrno(err);
7699         goto put_file;
7700 }
7701
7702 /*
7703  * returns
7704  *      true:  locks held by lockowner
7705  *      false: no locks held by lockowner
7706  */
7707 static bool
7708 check_for_locks(struct nfs4_file *fp, struct nfs4_lockowner *lowner)
7709 {
7710         struct file_lock *fl;
7711         int status = false;
7712         struct nfsd_file *nf = find_any_file(fp);
7713         struct inode *inode;
7714         struct file_lock_context *flctx;
7715
7716         if (!nf) {
7717                 /* Any valid lock stateid should have some sort of access */
7718                 WARN_ON_ONCE(1);
7719                 return status;
7720         }
7721
7722         inode = locks_inode(nf->nf_file);
7723         flctx = inode->i_flctx;
7724
7725         if (flctx && !list_empty_careful(&flctx->flc_posix)) {
7726                 spin_lock(&flctx->flc_lock);
7727                 list_for_each_entry(fl, &flctx->flc_posix, fl_list) {
7728                         if (fl->fl_owner == (fl_owner_t)lowner) {
7729                                 status = true;
7730                                 break;
7731                         }
7732                 }
7733                 spin_unlock(&flctx->flc_lock);
7734         }
7735         nfsd_file_put(nf);
7736         return status;
7737 }
7738
7739 /**
7740  * nfsd4_release_lockowner - process NFSv4.0 RELEASE_LOCKOWNER operations
7741  * @rqstp: RPC transaction
7742  * @cstate: NFSv4 COMPOUND state
7743  * @u: RELEASE_LOCKOWNER arguments
7744  *
7745  * The lockowner's so_count is bumped when a lock record is added
7746  * or when copying a conflicting lock. The latter case is brief,
7747  * but can lead to fleeting false positives when looking for
7748  * locks-in-use.
7749  *
7750  * Return values:
7751  *   %nfs_ok: lockowner released or not found
7752  *   %nfserr_locks_held: lockowner still in use
7753  *   %nfserr_stale_clientid: clientid no longer active
7754  *   %nfserr_expired: clientid not recognized
7755  */
7756 __be32
7757 nfsd4_release_lockowner(struct svc_rqst *rqstp,
7758                         struct nfsd4_compound_state *cstate,
7759                         union nfsd4_op_u *u)
7760 {
7761         struct nfsd4_release_lockowner *rlockowner = &u->release_lockowner;
7762         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
7763         clientid_t *clid = &rlockowner->rl_clientid;
7764         struct nfs4_ol_stateid *stp;
7765         struct nfs4_lockowner *lo;
7766         struct nfs4_client *clp;
7767         LIST_HEAD(reaplist);
7768         __be32 status;
7769
7770         dprintk("nfsd4_release_lockowner clientid: (%08x/%08x):\n",
7771                 clid->cl_boot, clid->cl_id);
7772
7773         status = set_client(clid, cstate, nn);
7774         if (status)
7775                 return status;
7776         clp = cstate->clp;
7777
7778         spin_lock(&clp->cl_lock);
7779         lo = find_lockowner_str_locked(clp, &rlockowner->rl_owner);
7780         if (!lo) {
7781                 spin_unlock(&clp->cl_lock);
7782                 return nfs_ok;
7783         }
7784         if (atomic_read(&lo->lo_owner.so_count) != 2) {
7785                 spin_unlock(&clp->cl_lock);
7786                 nfs4_put_stateowner(&lo->lo_owner);
7787                 return nfserr_locks_held;
7788         }
7789         unhash_lockowner_locked(lo);
7790         while (!list_empty(&lo->lo_owner.so_stateids)) {
7791                 stp = list_first_entry(&lo->lo_owner.so_stateids,
7792                                        struct nfs4_ol_stateid,
7793                                        st_perstateowner);
7794                 WARN_ON(!unhash_lock_stateid(stp));
7795                 put_ol_stateid_locked(stp, &reaplist);
7796         }
7797         spin_unlock(&clp->cl_lock);
7798
7799         free_ol_stateid_reaplist(&reaplist);
7800         remove_blocked_locks(lo);
7801         nfs4_put_stateowner(&lo->lo_owner);
7802         return nfs_ok;
7803 }
7804
7805 static inline struct nfs4_client_reclaim *
7806 alloc_reclaim(void)
7807 {
7808         return kmalloc(sizeof(struct nfs4_client_reclaim), GFP_KERNEL);
7809 }
7810
7811 bool
7812 nfs4_has_reclaimed_state(struct xdr_netobj name, struct nfsd_net *nn)
7813 {
7814         struct nfs4_client_reclaim *crp;
7815
7816         crp = nfsd4_find_reclaim_client(name, nn);
7817         return (crp && crp->cr_clp);
7818 }
7819
7820 /*
7821  * failure => all reset bets are off, nfserr_no_grace...
7822  *
7823  * The caller is responsible for freeing name.data if NULL is returned (it
7824  * will be freed in nfs4_remove_reclaim_record in the normal case).
7825  */
7826 struct nfs4_client_reclaim *
7827 nfs4_client_to_reclaim(struct xdr_netobj name, struct xdr_netobj princhash,
7828                 struct nfsd_net *nn)
7829 {
7830         unsigned int strhashval;
7831         struct nfs4_client_reclaim *crp;
7832
7833         crp = alloc_reclaim();
7834         if (crp) {
7835                 strhashval = clientstr_hashval(name);
7836                 INIT_LIST_HEAD(&crp->cr_strhash);
7837                 list_add(&crp->cr_strhash, &nn->reclaim_str_hashtbl[strhashval]);
7838                 crp->cr_name.data = name.data;
7839                 crp->cr_name.len = name.len;
7840                 crp->cr_princhash.data = princhash.data;
7841                 crp->cr_princhash.len = princhash.len;
7842                 crp->cr_clp = NULL;
7843                 nn->reclaim_str_hashtbl_size++;
7844         }
7845         return crp;
7846 }
7847
7848 void
7849 nfs4_remove_reclaim_record(struct nfs4_client_reclaim *crp, struct nfsd_net *nn)
7850 {
7851         list_del(&crp->cr_strhash);
7852         kfree(crp->cr_name.data);
7853         kfree(crp->cr_princhash.data);
7854         kfree(crp);
7855         nn->reclaim_str_hashtbl_size--;
7856 }
7857
7858 void
7859 nfs4_release_reclaim(struct nfsd_net *nn)
7860 {
7861         struct nfs4_client_reclaim *crp = NULL;
7862         int i;
7863
7864         for (i = 0; i < CLIENT_HASH_SIZE; i++) {
7865                 while (!list_empty(&nn->reclaim_str_hashtbl[i])) {
7866                         crp = list_entry(nn->reclaim_str_hashtbl[i].next,
7867                                         struct nfs4_client_reclaim, cr_strhash);
7868                         nfs4_remove_reclaim_record(crp, nn);
7869                 }
7870         }
7871         WARN_ON_ONCE(nn->reclaim_str_hashtbl_size);
7872 }
7873
7874 /*
7875  * called from OPEN, CLAIM_PREVIOUS with a new clientid. */
7876 struct nfs4_client_reclaim *
7877 nfsd4_find_reclaim_client(struct xdr_netobj name, struct nfsd_net *nn)
7878 {
7879         unsigned int strhashval;
7880         struct nfs4_client_reclaim *crp = NULL;
7881
7882         strhashval = clientstr_hashval(name);
7883         list_for_each_entry(crp, &nn->reclaim_str_hashtbl[strhashval], cr_strhash) {
7884                 if (compare_blob(&crp->cr_name, &name) == 0) {
7885                         return crp;
7886                 }
7887         }
7888         return NULL;
7889 }
7890
7891 __be32
7892 nfs4_check_open_reclaim(struct nfs4_client *clp)
7893 {
7894         if (test_bit(NFSD4_CLIENT_RECLAIM_COMPLETE, &clp->cl_flags))
7895                 return nfserr_no_grace;
7896
7897         if (nfsd4_client_record_check(clp))
7898                 return nfserr_reclaim_bad;
7899
7900         return nfs_ok;
7901 }
7902
7903 /*
7904  * Since the lifetime of a delegation isn't limited to that of an open, a
7905  * client may quite reasonably hang on to a delegation as long as it has
7906  * the inode cached.  This becomes an obvious problem the first time a
7907  * client's inode cache approaches the size of the server's total memory.
7908  *
7909  * For now we avoid this problem by imposing a hard limit on the number
7910  * of delegations, which varies according to the server's memory size.
7911  */
7912 static void
7913 set_max_delegations(void)
7914 {
7915         /*
7916          * Allow at most 4 delegations per megabyte of RAM.  Quick
7917          * estimates suggest that in the worst case (where every delegation
7918          * is for a different inode), a delegation could take about 1.5K,
7919          * giving a worst case usage of about 6% of memory.
7920          */
7921         max_delegations = nr_free_buffer_pages() >> (20 - 2 - PAGE_SHIFT);
7922 }
7923
7924 static int nfs4_state_create_net(struct net *net)
7925 {
7926         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
7927         int i;
7928
7929         nn->conf_id_hashtbl = kmalloc_array(CLIENT_HASH_SIZE,
7930                                             sizeof(struct list_head),
7931                                             GFP_KERNEL);
7932         if (!nn->conf_id_hashtbl)
7933                 goto err;
7934         nn->unconf_id_hashtbl = kmalloc_array(CLIENT_HASH_SIZE,
7935                                               sizeof(struct list_head),
7936                                               GFP_KERNEL);
7937         if (!nn->unconf_id_hashtbl)
7938                 goto err_unconf_id;
7939         nn->sessionid_hashtbl = kmalloc_array(SESSION_HASH_SIZE,
7940                                               sizeof(struct list_head),
7941                                               GFP_KERNEL);
7942         if (!nn->sessionid_hashtbl)
7943                 goto err_sessionid;
7944
7945         for (i = 0; i < CLIENT_HASH_SIZE; i++) {
7946                 INIT_LIST_HEAD(&nn->conf_id_hashtbl[i]);
7947                 INIT_LIST_HEAD(&nn->unconf_id_hashtbl[i]);
7948         }
7949         for (i = 0; i < SESSION_HASH_SIZE; i++)
7950                 INIT_LIST_HEAD(&nn->sessionid_hashtbl[i]);
7951         nn->conf_name_tree = RB_ROOT;
7952         nn->unconf_name_tree = RB_ROOT;
7953         nn->boot_time = ktime_get_real_seconds();
7954         nn->grace_ended = false;
7955         nn->nfsd4_manager.block_opens = true;
7956         INIT_LIST_HEAD(&nn->nfsd4_manager.list);
7957         INIT_LIST_HEAD(&nn->client_lru);
7958         INIT_LIST_HEAD(&nn->close_lru);
7959         INIT_LIST_HEAD(&nn->del_recall_lru);
7960         spin_lock_init(&nn->client_lock);
7961         spin_lock_init(&nn->s2s_cp_lock);
7962         idr_init(&nn->s2s_cp_stateids);
7963
7964         spin_lock_init(&nn->blocked_locks_lock);
7965         INIT_LIST_HEAD(&nn->blocked_locks_lru);
7966
7967         INIT_DELAYED_WORK(&nn->laundromat_work, laundromat_main);
7968         INIT_DELAYED_WORK(&nn->nfsd_shrinker_work, courtesy_client_reaper);
7969         get_net(net);
7970
7971         return 0;
7972
7973 err_sessionid:
7974         kfree(nn->unconf_id_hashtbl);
7975 err_unconf_id:
7976         kfree(nn->conf_id_hashtbl);
7977 err:
7978         return -ENOMEM;
7979 }
7980
7981 static void
7982 nfs4_state_destroy_net(struct net *net)
7983 {
7984         int i;
7985         struct nfs4_client *clp = NULL;
7986         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
7987
7988         for (i = 0; i < CLIENT_HASH_SIZE; i++) {
7989                 while (!list_empty(&nn->conf_id_hashtbl[i])) {
7990                         clp = list_entry(nn->conf_id_hashtbl[i].next, struct nfs4_client, cl_idhash);
7991                         destroy_client(clp);
7992                 }
7993         }
7994
7995         WARN_ON(!list_empty(&nn->blocked_locks_lru));
7996
7997         for (i = 0; i < CLIENT_HASH_SIZE; i++) {
7998                 while (!list_empty(&nn->unconf_id_hashtbl[i])) {
7999                         clp = list_entry(nn->unconf_id_hashtbl[i].next, struct nfs4_client, cl_idhash);
8000                         destroy_client(clp);
8001                 }
8002         }
8003
8004         kfree(nn->sessionid_hashtbl);
8005         kfree(nn->unconf_id_hashtbl);
8006         kfree(nn->conf_id_hashtbl);
8007         put_net(net);
8008 }
8009
8010 int
8011 nfs4_state_start_net(struct net *net)
8012 {
8013         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
8014         int ret;
8015
8016         ret = nfs4_state_create_net(net);
8017         if (ret)
8018                 return ret;
8019         locks_start_grace(net, &nn->nfsd4_manager);
8020         nfsd4_client_tracking_init(net);
8021         if (nn->track_reclaim_completes && nn->reclaim_str_hashtbl_size == 0)
8022                 goto skip_grace;
8023         printk(KERN_INFO "NFSD: starting %lld-second grace period (net %x)\n",
8024                nn->nfsd4_grace, net->ns.inum);
8025         trace_nfsd_grace_start(nn);
8026         queue_delayed_work(laundry_wq, &nn->laundromat_work, nn->nfsd4_grace * HZ);
8027         return 0;
8028
8029 skip_grace:
8030         printk(KERN_INFO "NFSD: no clients to reclaim, skipping NFSv4 grace period (net %x)\n",
8031                         net->ns.inum);
8032         queue_delayed_work(laundry_wq, &nn->laundromat_work, nn->nfsd4_lease * HZ);
8033         nfsd4_end_grace(nn);
8034         return 0;
8035 }
8036
8037 /* initialization to perform when the nfsd service is started: */
8038
8039 int
8040 nfs4_state_start(void)
8041 {
8042         int ret;
8043
8044         ret = nfsd4_create_callback_queue();
8045         if (ret)
8046                 return ret;
8047
8048         set_max_delegations();
8049         return 0;
8050 }
8051
8052 void
8053 nfs4_state_shutdown_net(struct net *net)
8054 {
8055         struct nfs4_delegation *dp = NULL;
8056         struct list_head *pos, *next, reaplist;
8057         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
8058
8059         cancel_delayed_work_sync(&nn->laundromat_work);
8060         locks_end_grace(&nn->nfsd4_manager);
8061
8062         INIT_LIST_HEAD(&reaplist);
8063         spin_lock(&state_lock);
8064         list_for_each_safe(pos, next, &nn->del_recall_lru) {
8065                 dp = list_entry (pos, struct nfs4_delegation, dl_recall_lru);
8066                 WARN_ON(!unhash_delegation_locked(dp));
8067                 list_add(&dp->dl_recall_lru, &reaplist);
8068         }
8069         spin_unlock(&state_lock);
8070         list_for_each_safe(pos, next, &reaplist) {
8071                 dp = list_entry (pos, struct nfs4_delegation, dl_recall_lru);
8072                 list_del_init(&dp->dl_recall_lru);
8073                 destroy_unhashed_deleg(dp);
8074         }
8075
8076         nfsd4_client_tracking_exit(net);
8077         nfs4_state_destroy_net(net);
8078 #ifdef CONFIG_NFSD_V4_2_INTER_SSC
8079         nfsd4_ssc_shutdown_umount(nn);
8080 #endif
8081 }
8082
8083 void
8084 nfs4_state_shutdown(void)
8085 {
8086         nfsd4_destroy_callback_queue();
8087 }
8088
8089 static void
8090 get_stateid(struct nfsd4_compound_state *cstate, stateid_t *stateid)
8091 {
8092         if (HAS_CSTATE_FLAG(cstate, CURRENT_STATE_ID_FLAG) &&
8093             CURRENT_STATEID(stateid))
8094                 memcpy(stateid, &cstate->current_stateid, sizeof(stateid_t));
8095 }
8096
8097 static void
8098 put_stateid(struct nfsd4_compound_state *cstate, stateid_t *stateid)
8099 {
8100         if (cstate->minorversion) {
8101                 memcpy(&cstate->current_stateid, stateid, sizeof(stateid_t));
8102                 SET_CSTATE_FLAG(cstate, CURRENT_STATE_ID_FLAG);
8103         }
8104 }
8105
8106 void
8107 clear_current_stateid(struct nfsd4_compound_state *cstate)
8108 {
8109         CLEAR_CSTATE_FLAG(cstate, CURRENT_STATE_ID_FLAG);
8110 }
8111
8112 /*
8113  * functions to set current state id
8114  */
8115 void
8116 nfsd4_set_opendowngradestateid(struct nfsd4_compound_state *cstate,
8117                 union nfsd4_op_u *u)
8118 {
8119         put_stateid(cstate, &u->open_downgrade.od_stateid);
8120 }
8121
8122 void
8123 nfsd4_set_openstateid(struct nfsd4_compound_state *cstate,
8124                 union nfsd4_op_u *u)
8125 {
8126         put_stateid(cstate, &u->open.op_stateid);
8127 }
8128
8129 void
8130 nfsd4_set_closestateid(struct nfsd4_compound_state *cstate,
8131                 union nfsd4_op_u *u)
8132 {
8133         put_stateid(cstate, &u->close.cl_stateid);
8134 }
8135
8136 void
8137 nfsd4_set_lockstateid(struct nfsd4_compound_state *cstate,
8138                 union nfsd4_op_u *u)
8139 {
8140         put_stateid(cstate, &u->lock.lk_resp_stateid);
8141 }
8142
8143 /*
8144  * functions to consume current state id
8145  */
8146
8147 void
8148 nfsd4_get_opendowngradestateid(struct nfsd4_compound_state *cstate,
8149                 union nfsd4_op_u *u)
8150 {
8151         get_stateid(cstate, &u->open_downgrade.od_stateid);
8152 }
8153
8154 void
8155 nfsd4_get_delegreturnstateid(struct nfsd4_compound_state *cstate,
8156                 union nfsd4_op_u *u)
8157 {
8158         get_stateid(cstate, &u->delegreturn.dr_stateid);
8159 }
8160
8161 void
8162 nfsd4_get_freestateid(struct nfsd4_compound_state *cstate,
8163                 union nfsd4_op_u *u)
8164 {
8165         get_stateid(cstate, &u->free_stateid.fr_stateid);
8166 }
8167
8168 void
8169 nfsd4_get_setattrstateid(struct nfsd4_compound_state *cstate,
8170                 union nfsd4_op_u *u)
8171 {
8172         get_stateid(cstate, &u->setattr.sa_stateid);
8173 }
8174
8175 void
8176 nfsd4_get_closestateid(struct nfsd4_compound_state *cstate,
8177                 union nfsd4_op_u *u)
8178 {
8179         get_stateid(cstate, &u->close.cl_stateid);
8180 }
8181
8182 void
8183 nfsd4_get_lockustateid(struct nfsd4_compound_state *cstate,
8184                 union nfsd4_op_u *u)
8185 {
8186         get_stateid(cstate, &u->locku.lu_stateid);
8187 }
8188
8189 void
8190 nfsd4_get_readstateid(struct nfsd4_compound_state *cstate,
8191                 union nfsd4_op_u *u)
8192 {
8193         get_stateid(cstate, &u->read.rd_stateid);
8194 }
8195
8196 void
8197 nfsd4_get_writestateid(struct nfsd4_compound_state *cstate,
8198                 union nfsd4_op_u *u)
8199 {
8200         get_stateid(cstate, &u->write.wr_stateid);
8201 }