fs/nfsd/nfs4state.c

   1 /*
   2 *  Copyright (c) 2001 The Regents of the University of Michigan.
   3 *  All rights reserved.
   4 *
   5 *  Kendrick Smith <kmsmith@umich.edu>
   6 *  Andy Adamson <kandros@umich.edu>
   7 *
   8 *  Redistribution and use in source and binary forms, with or without
   9 *  modification, are permitted provided that the following conditions
  10 *  are met:
  11 *
  12 *  1. Redistributions of source code must retain the above copyright
  13 *     notice, this list of conditions and the following disclaimer.
  14 *  2. Redistributions in binary form must reproduce the above copyright
  15 *     notice, this list of conditions and the following disclaimer in the
  16 *     documentation and/or other materials provided with the distribution.
  17 *  3. Neither the name of the University nor the names of its
  18 *     contributors may be used to endorse or promote products derived
  19 *     from this software without specific prior written permission.
  20 *
  21 *  THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
  22 *  WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
  23 *  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
  24 *  DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
  25 *  FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  26 *  CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  27 *  SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
  28 *  BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
  29 *  LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
  30 *  NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
  31 *  SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  32 *
  33 */
  34
  35 #include <linux/file.h>
  36 #include <linux/fs.h>
  37 #include <linux/slab.h>
  38 #include <linux/namei.h>
  39 #include <linux/swap.h>
  40 #include <linux/pagemap.h>
  41 #include <linux/ratelimit.h>
  42 #include <linux/sunrpc/svcauth_gss.h>
  43 #include <linux/sunrpc/clnt.h>
  44 #include "xdr4.h"
  45 #include "vfs.h"
  46 #include "current_stateid.h"
  47
  48 #define NFSDDBG_FACILITY                NFSDDBG_PROC
  49
  50 /* Globals */
  51 time_t nfsd4_lease = 90;     /* default lease time */
  52 time_t nfsd4_grace = 90;
  53 static time_t boot_time;
  54
  55 #define all_ones {{~0,~0},~0}
  56 static const stateid_t one_stateid = {
  57         .si_generation = ~0,
  58         .si_opaque = all_ones,
  59 };
  60 static const stateid_t zero_stateid = {
  61         /* all fields zero */
  62 };
  63 static const stateid_t currentstateid = {
  64         .si_generation = 1,
  65 };
  66
  67 static u64 current_sessionid = 1;
  68
  69 #define ZERO_STATEID(stateid) (!memcmp((stateid), &zero_stateid, sizeof(stateid_t)))
  70 #define ONE_STATEID(stateid)  (!memcmp((stateid), &one_stateid, sizeof(stateid_t)))
  71 #define CURRENT_STATEID(stateid) (!memcmp((stateid), &currentstateid, sizeof(stateid_t)))
  72
  73 /* forward declarations */
  74 static int check_for_locks(struct nfs4_file *filp, struct nfs4_lockowner *lowner);
  75
  76 /* Locking: */
  77
  78 /* Currently used for almost all code touching nfsv4 state: */
  79 static DEFINE_MUTEX(client_mutex);
  80
  81 /*
  82  * Currently used for the del_recall_lru and file hash table.  In an
  83  * effort to decrease the scope of the client_mutex, this spinlock may
  84  * eventually cover more:
  85  */
  86 static DEFINE_SPINLOCK(recall_lock);
  87
  88 static struct kmem_cache *openowner_slab = NULL;
  89 static struct kmem_cache *lockowner_slab = NULL;
  90 static struct kmem_cache *file_slab = NULL;
  91 static struct kmem_cache *stateid_slab = NULL;
  92 static struct kmem_cache *deleg_slab = NULL;
  93
  94 void
  95 nfs4_lock_state(void)
  96 {
  97         mutex_lock(&client_mutex);
  98 }
  99
 100 static void free_session(struct kref *);
 101
 102 /* Must be called under the client_lock */
 103 static void nfsd4_put_session_locked(struct nfsd4_session *ses)
 104 {
 105         kref_put(&ses->se_ref, free_session);
 106 }
 107
 108 static void nfsd4_get_session(struct nfsd4_session *ses)
 109 {
 110         kref_get(&ses->se_ref);
 111 }
 112
 113 void
 114 nfs4_unlock_state(void)
 115 {
 116         mutex_unlock(&client_mutex);
 117 }
 118
 119 static inline u32
 120 opaque_hashval(const void *ptr, int nbytes)
 121 {
 122         unsigned char *cptr = (unsigned char *) ptr;
 123
 124         u32 x = 0;
 125         while (nbytes--) {
 126                 x *= 37;
 127                 x += *cptr++;
 128         }
 129         return x;
 130 }
 131
 132 static struct list_head del_recall_lru;
 133
 134 static void nfsd4_free_file(struct nfs4_file *f)
 135 {
 136         kmem_cache_free(file_slab, f);
 137 }
 138
 139 static inline void
 140 put_nfs4_file(struct nfs4_file *fi)
 141 {
 142         if (atomic_dec_and_lock(&fi->fi_ref, &recall_lock)) {
 143                 list_del(&fi->fi_hash);
 144                 spin_unlock(&recall_lock);
 145                 iput(fi->fi_inode);
 146                 nfsd4_free_file(fi);
 147         }
 148 }
 149
 150 static inline void
 151 get_nfs4_file(struct nfs4_file *fi)
 152 {
 153         atomic_inc(&fi->fi_ref);
 154 }
 155
 156 static int num_delegations;
 157 unsigned int max_delegations;
 158
 159 /*
 160  * Open owner state (share locks)
 161  */
 162
 163 /* hash tables for lock and open owners */
 164 #define OWNER_HASH_BITS              8
 165 #define OWNER_HASH_SIZE             (1 << OWNER_HASH_BITS)
 166 #define OWNER_HASH_MASK             (OWNER_HASH_SIZE - 1)
 167
 168 static unsigned int ownerstr_hashval(u32 clientid, struct xdr_netobj *ownername)
 169 {
 170         unsigned int ret;
 171
 172         ret = opaque_hashval(ownername->data, ownername->len);
 173         ret += clientid;
 174         return ret & OWNER_HASH_MASK;
 175 }
 176
 177 static struct list_head ownerstr_hashtbl[OWNER_HASH_SIZE];
 178
 179 /* hash table for nfs4_file */
 180 #define FILE_HASH_BITS                   8
 181 #define FILE_HASH_SIZE                  (1 << FILE_HASH_BITS)
 182
 183 static unsigned int file_hashval(struct inode *ino)
 184 {
 185         /* XXX: why are we hashing on inode pointer, anyway? */
 186         return hash_ptr(ino, FILE_HASH_BITS);
 187 }
 188
 189 static struct list_head file_hashtbl[FILE_HASH_SIZE];
 190
 191 static void __nfs4_file_get_access(struct nfs4_file *fp, int oflag)
 192 {
 193         BUG_ON(!(fp->fi_fds[oflag] || fp->fi_fds[O_RDWR]));
 194         atomic_inc(&fp->fi_access[oflag]);
 195 }
 196
 197 static void nfs4_file_get_access(struct nfs4_file *fp, int oflag)
 198 {
 199         if (oflag == O_RDWR) {
 200                 __nfs4_file_get_access(fp, O_RDONLY);
 201                 __nfs4_file_get_access(fp, O_WRONLY);
 202         } else
 203                 __nfs4_file_get_access(fp, oflag);
 204 }
 205
 206 static void nfs4_file_put_fd(struct nfs4_file *fp, int oflag)
 207 {
 208         if (fp->fi_fds[oflag]) {
 209                 fput(fp->fi_fds[oflag]);
 210                 fp->fi_fds[oflag] = NULL;
 211         }
 212 }
 213
 214 static void __nfs4_file_put_access(struct nfs4_file *fp, int oflag)
 215 {
 216         if (atomic_dec_and_test(&fp->fi_access[oflag])) {
 217                 nfs4_file_put_fd(fp, oflag);
 218                 /*
 219                  * It's also safe to get rid of the RDWR open *if*
 220                  * we no longer have need of the other kind of access
 221                  * or if we already have the other kind of open:
 222                  */
 223                 if (fp->fi_fds[1-oflag]
 224                         || atomic_read(&fp->fi_access[1 - oflag]) == 0)
 225                         nfs4_file_put_fd(fp, O_RDWR);
 226         }
 227 }
 228
 229 static void nfs4_file_put_access(struct nfs4_file *fp, int oflag)
 230 {
 231         if (oflag == O_RDWR) {
 232                 __nfs4_file_put_access(fp, O_RDONLY);
 233                 __nfs4_file_put_access(fp, O_WRONLY);
 234         } else
 235                 __nfs4_file_put_access(fp, oflag);
 236 }
 237
 238 static inline int get_new_stid(struct nfs4_stid *stid)
 239 {
 240         static int min_stateid = 0;
 241         struct idr *stateids = &stid->sc_client->cl_stateids;
 242         int new_stid;
 243         int error;
 244
 245         error = idr_get_new_above(stateids, stid, min_stateid, &new_stid);
 246         /*
 247          * Note: the necessary preallocation was done in
 248          * nfs4_alloc_stateid().  The idr code caps the number of
 249          * preallocations that can exist at a time, but the state lock
 250          * prevents anyone from using ours before we get here:
 251          */
 252         BUG_ON(error);
 253         /*
 254          * It shouldn't be a problem to reuse an opaque stateid value.
 255          * I don't think it is for 4.1.  But with 4.0 I worry that, for
 256          * example, a stray write retransmission could be accepted by
 257          * the server when it should have been rejected.  Therefore,
 258          * adopt a trick from the sctp code to attempt to maximize the
 259          * amount of time until an id is reused, by ensuring they always
 260          * "increase" (mod INT_MAX):
 261          */
 262
 263         min_stateid = new_stid+1;
 264         if (min_stateid == INT_MAX)
 265                 min_stateid = 0;
 266         return new_stid;
 267 }
 268
 269 static void init_stid(struct nfs4_stid *stid, struct nfs4_client *cl, unsigned char type)
 270 {
 271         stateid_t *s = &stid->sc_stateid;
 272         int new_id;
 273
 274         stid->sc_type = type;
 275         stid->sc_client = cl;
 276         s->si_opaque.so_clid = cl->cl_clientid;
 277         new_id = get_new_stid(stid);
 278         s->si_opaque.so_id = (u32)new_id;
 279         /* Will be incremented before return to client: */
 280         s->si_generation = 0;
 281 }
 282
 283 static struct nfs4_stid *nfs4_alloc_stid(struct nfs4_client *cl, struct kmem_cache *slab)
 284 {
 285         struct idr *stateids = &cl->cl_stateids;
 286
 287         if (!idr_pre_get(stateids, GFP_KERNEL))
 288                 return NULL;
 289         /*
 290          * Note: if we fail here (or any time between now and the time
 291          * we actually get the new idr), we won't need to undo the idr
 292          * preallocation, since the idr code caps the number of
 293          * preallocated entries.
 294          */
 295         return kmem_cache_alloc(slab, GFP_KERNEL);
 296 }
 297
 298 static struct nfs4_ol_stateid * nfs4_alloc_stateid(struct nfs4_client *clp)
 299 {
 300         return openlockstateid(nfs4_alloc_stid(clp, stateid_slab));
 301 }
 302
 303 static struct nfs4_delegation *
 304 alloc_init_deleg(struct nfs4_client *clp, struct nfs4_ol_stateid *stp, struct svc_fh *current_fh, u32 type)
 305 {
 306         struct nfs4_delegation *dp;
 307         struct nfs4_file *fp = stp->st_file;
 308
 309         dprintk("NFSD alloc_init_deleg\n");
 310         /*
 311          * Major work on the lease subsystem (for example, to support
 312          * calbacks on stat) will be required before we can support
 313          * write delegations properly.
 314          */
 315         if (type != NFS4_OPEN_DELEGATE_READ)
 316                 return NULL;
 317         if (fp->fi_had_conflict)
 318                 return NULL;
 319         if (num_delegations > max_delegations)
 320                 return NULL;
 321         dp = delegstateid(nfs4_alloc_stid(clp, deleg_slab));
 322         if (dp == NULL)
 323                 return dp;
 324         init_stid(&dp->dl_stid, clp, NFS4_DELEG_STID);
 325         /*
 326          * delegation seqid's are never incremented.  The 4.1 special
 327          * meaning of seqid 0 isn't meaningful, really, but let's avoid
 328          * 0 anyway just for consistency and use 1:
 329          */
 330         dp->dl_stid.sc_stateid.si_generation = 1;
 331         num_delegations++;
 332         INIT_LIST_HEAD(&dp->dl_perfile);
 333         INIT_LIST_HEAD(&dp->dl_perclnt);
 334         INIT_LIST_HEAD(&dp->dl_recall_lru);
 335         get_nfs4_file(fp);
 336         dp->dl_file = fp;
 337         dp->dl_type = type;
 338         fh_copy_shallow(&dp->dl_fh, &current_fh->fh_handle);
 339         dp->dl_time = 0;
 340         atomic_set(&dp->dl_count, 1);
 341         INIT_WORK(&dp->dl_recall.cb_work, nfsd4_do_callback_rpc);
 342         return dp;
 343 }
 344
 345 void
 346 nfs4_put_delegation(struct nfs4_delegation *dp)
 347 {
 348         if (atomic_dec_and_test(&dp->dl_count)) {
 349                 dprintk("NFSD: freeing dp %p\n",dp);
 350                 put_nfs4_file(dp->dl_file);
 351                 kmem_cache_free(deleg_slab, dp);
 352                 num_delegations--;
 353         }
 354 }
 355
 356 static void nfs4_put_deleg_lease(struct nfs4_file *fp)
 357 {
 358         if (atomic_dec_and_test(&fp->fi_delegees)) {
 359                 vfs_setlease(fp->fi_deleg_file, F_UNLCK, &fp->fi_lease);
 360                 fp->fi_lease = NULL;
 361                 fput(fp->fi_deleg_file);
 362                 fp->fi_deleg_file = NULL;
 363         }
 364 }
 365
 366 static void unhash_stid(struct nfs4_stid *s)
 367 {
 368         struct idr *stateids = &s->sc_client->cl_stateids;
 369
 370         idr_remove(stateids, s->sc_stateid.si_opaque.so_id);
 371 }
 372
 373 /* Called under the state lock. */
 374 static void
 375 unhash_delegation(struct nfs4_delegation *dp)
 376 {
 377         unhash_stid(&dp->dl_stid);
 378         list_del_init(&dp->dl_perclnt);
 379         spin_lock(&recall_lock);
 380         list_del_init(&dp->dl_perfile);
 381         list_del_init(&dp->dl_recall_lru);
 382         spin_unlock(&recall_lock);
 383         nfs4_put_deleg_lease(dp->dl_file);
 384         nfs4_put_delegation(dp);
 385 }
 386
 387 /*
 388  * SETCLIENTID state
 389  */
 390
 391 /* client_lock protects the client lru list and session hash table */
 392 static DEFINE_SPINLOCK(client_lock);
 393
 394 /* Hash tables for nfs4_clientid state */
 395 #define CLIENT_HASH_BITS                 4
 396 #define CLIENT_HASH_SIZE                (1 << CLIENT_HASH_BITS)
 397 #define CLIENT_HASH_MASK                (CLIENT_HASH_SIZE - 1)
 398
 399 static unsigned int clientid_hashval(u32 id)
 400 {
 401         return id & CLIENT_HASH_MASK;
 402 }
 403
 404 static unsigned int clientstr_hashval(const char *name)
 405 {
 406         return opaque_hashval(name, 8) & CLIENT_HASH_MASK;
 407 }
 408
 409 /*
 410  * reclaim_str_hashtbl[] holds known client info from previous reset/reboot
 411  * used in reboot/reset lease grace period processing
 412  *
 413  * conf_id_hashtbl[], and conf_str_hashtbl[] hold confirmed
 414  * setclientid_confirmed info.
 415  *
 416  * unconf_str_hastbl[] and unconf_id_hashtbl[] hold unconfirmed
 417  * setclientid info.
 418  *
 419  * client_lru holds client queue ordered by nfs4_client.cl_time
 420  * for lease renewal.
 421  *
 422  * close_lru holds (open) stateowner queue ordered by nfs4_stateowner.so_time
 423  * for last close replay.
 424  */
 425 static struct list_head reclaim_str_hashtbl[CLIENT_HASH_SIZE];
 426 static int reclaim_str_hashtbl_size = 0;
 427 static struct list_head conf_id_hashtbl[CLIENT_HASH_SIZE];
 428 static struct list_head conf_str_hashtbl[CLIENT_HASH_SIZE];
 429 static struct list_head unconf_str_hashtbl[CLIENT_HASH_SIZE];
 430 static struct list_head unconf_id_hashtbl[CLIENT_HASH_SIZE];
 431 static struct list_head client_lru;
 432 static struct list_head close_lru;
 433
 434 /*
 435  * We store the NONE, READ, WRITE, and BOTH bits separately in the
 436  * st_{access,deny}_bmap field of the stateid, in order to track not
 437  * only what share bits are currently in force, but also what
 438  * combinations of share bits previous opens have used.  This allows us
 439  * to enforce the recommendation of rfc 3530 14.2.19 that the server
 440  * return an error if the client attempt to downgrade to a combination
 441  * of share bits not explicable by closing some of its previous opens.
 442  *
 443  * XXX: This enforcement is actually incomplete, since we don't keep
 444  * track of access/deny bit combinations; so, e.g., we allow:
 445  *
 446  *      OPEN allow read, deny write
 447  *      OPEN allow both, deny none
 448  *      DOWNGRADE allow read, deny none
 449  *
 450  * which we should reject.
 451  */
 452 static unsigned int
 453 bmap_to_share_mode(unsigned long bmap) {
 454         int i;
 455         unsigned int access = 0;
 456
 457         for (i = 1; i < 4; i++) {
 458                 if (test_bit(i, &bmap))
 459                         access |= i;
 460         }
 461         return access;
 462 }
 463
 464 static bool
 465 test_share(struct nfs4_ol_stateid *stp, struct nfsd4_open *open) {
 466         unsigned int access, deny;
 467
 468         access = bmap_to_share_mode(stp->st_access_bmap);
 469         deny = bmap_to_share_mode(stp->st_deny_bmap);
 470         if ((access & open->op_share_deny) || (deny & open->op_share_access))
 471                 return false;
 472         return true;
 473 }
 474
 475 /* set share access for a given stateid */
 476 static inline void
 477 set_access(u32 access, struct nfs4_ol_stateid *stp)
 478 {
 479         __set_bit(access, &stp->st_access_bmap);
 480 }
 481
 482 /* clear share access for a given stateid */
 483 static inline void
 484 clear_access(u32 access, struct nfs4_ol_stateid *stp)
 485 {
 486         __clear_bit(access, &stp->st_access_bmap);
 487 }
 488
 489 /* test whether a given stateid has access */
 490 static inline bool
 491 test_access(u32 access, struct nfs4_ol_stateid *stp)
 492 {
 493         return test_bit(access, &stp->st_access_bmap);
 494 }
 495
 496 /* set share deny for a given stateid */
 497 static inline void
 498 set_deny(u32 access, struct nfs4_ol_stateid *stp)
 499 {
 500         __set_bit(access, &stp->st_deny_bmap);
 501 }
 502
 503 /* clear share deny for a given stateid */
 504 static inline void
 505 clear_deny(u32 access, struct nfs4_ol_stateid *stp)
 506 {
 507         __clear_bit(access, &stp->st_deny_bmap);
 508 }
 509
 510 /* test whether a given stateid is denying specific access */
 511 static inline bool
 512 test_deny(u32 access, struct nfs4_ol_stateid *stp)
 513 {
 514         return test_bit(access, &stp->st_deny_bmap);
 515 }
 516
 517 static int nfs4_access_to_omode(u32 access)
 518 {
 519         switch (access & NFS4_SHARE_ACCESS_BOTH) {
 520         case NFS4_SHARE_ACCESS_READ:
 521                 return O_RDONLY;
 522         case NFS4_SHARE_ACCESS_WRITE:
 523                 return O_WRONLY;
 524         case NFS4_SHARE_ACCESS_BOTH:
 525                 return O_RDWR;
 526         }
 527         BUG();
 528 }
 529
 530 /* release all access and file references for a given stateid */
 531 static void
 532 release_all_access(struct nfs4_ol_stateid *stp)
 533 {
 534         int i;
 535
 536         for (i = 1; i < 4; i++) {
 537                 if (test_access(i, stp))
 538                         nfs4_file_put_access(stp->st_file,
 539                                              nfs4_access_to_omode(i));
 540                 clear_access(i, stp);
 541         }
 542 }
 543
 544 static void unhash_generic_stateid(struct nfs4_ol_stateid *stp)
 545 {
 546         list_del(&stp->st_perfile);
 547         list_del(&stp->st_perstateowner);
 548 }
 549
 550 static void close_generic_stateid(struct nfs4_ol_stateid *stp)
 551 {
 552         release_all_access(stp);
 553         put_nfs4_file(stp->st_file);
 554         stp->st_file = NULL;
 555 }
 556
 557 static void free_generic_stateid(struct nfs4_ol_stateid *stp)
 558 {
 559         kmem_cache_free(stateid_slab, stp);
 560 }
 561
 562 static void release_lock_stateid(struct nfs4_ol_stateid *stp)
 563 {
 564         struct file *file;
 565
 566         unhash_generic_stateid(stp);
 567         unhash_stid(&stp->st_stid);
 568         file = find_any_file(stp->st_file);
 569         if (file)
 570                 locks_remove_posix(file, (fl_owner_t)lockowner(stp->st_stateowner));
 571         close_generic_stateid(stp);
 572         free_generic_stateid(stp);
 573 }
 574
 575 static void unhash_lockowner(struct nfs4_lockowner *lo)
 576 {
 577         struct nfs4_ol_stateid *stp;
 578
 579         list_del(&lo->lo_owner.so_strhash);
 580         list_del(&lo->lo_perstateid);
 581         list_del(&lo->lo_owner_ino_hash);
 582         while (!list_empty(&lo->lo_owner.so_stateids)) {
 583                 stp = list_first_entry(&lo->lo_owner.so_stateids,
 584                                 struct nfs4_ol_stateid, st_perstateowner);
 585                 release_lock_stateid(stp);
 586         }
 587 }
 588
 589 static void release_lockowner(struct nfs4_lockowner *lo)
 590 {
 591         unhash_lockowner(lo);
 592         nfs4_free_lockowner(lo);
 593 }
 594
 595 static void
 596 release_stateid_lockowners(struct nfs4_ol_stateid *open_stp)
 597 {
 598         struct nfs4_lockowner *lo;
 599
 600         while (!list_empty(&open_stp->st_lockowners)) {
 601                 lo = list_entry(open_stp->st_lockowners.next,
 602                                 struct nfs4_lockowner, lo_perstateid);
 603                 release_lockowner(lo);
 604         }
 605 }
 606
 607 static void unhash_open_stateid(struct nfs4_ol_stateid *stp)
 608 {
 609         unhash_generic_stateid(stp);
 610         release_stateid_lockowners(stp);
 611         close_generic_stateid(stp);
 612 }
 613
 614 static void release_open_stateid(struct nfs4_ol_stateid *stp)
 615 {
 616         unhash_open_stateid(stp);
 617         unhash_stid(&stp->st_stid);
 618         free_generic_stateid(stp);
 619 }
 620
 621 static void unhash_openowner(struct nfs4_openowner *oo)
 622 {
 623         struct nfs4_ol_stateid *stp;
 624
 625         list_del(&oo->oo_owner.so_strhash);
 626         list_del(&oo->oo_perclient);
 627         while (!list_empty(&oo->oo_owner.so_stateids)) {
 628                 stp = list_first_entry(&oo->oo_owner.so_stateids,
 629                                 struct nfs4_ol_stateid, st_perstateowner);
 630                 release_open_stateid(stp);
 631         }
 632 }
 633
 634 static void release_last_closed_stateid(struct nfs4_openowner *oo)
 635 {
 636         struct nfs4_ol_stateid *s = oo->oo_last_closed_stid;
 637
 638         if (s) {
 639                 unhash_stid(&s->st_stid);
 640                 free_generic_stateid(s);
 641                 oo->oo_last_closed_stid = NULL;
 642         }
 643 }
 644
 645 static void release_openowner(struct nfs4_openowner *oo)
 646 {
 647         unhash_openowner(oo);
 648         list_del(&oo->oo_close_lru);
 649         release_last_closed_stateid(oo);
 650         nfs4_free_openowner(oo);
 651 }
 652
 653 #define SESSION_HASH_SIZE       512
 654 static struct list_head sessionid_hashtbl[SESSION_HASH_SIZE];
 655
 656 static inline int
 657 hash_sessionid(struct nfs4_sessionid *sessionid)
 658 {
 659         struct nfsd4_sessionid *sid = (struct nfsd4_sessionid *)sessionid;
 660
 661         return sid->sequence % SESSION_HASH_SIZE;
 662 }
 663
 664 #ifdef NFSD_DEBUG
 665 static inline void
 666 dump_sessionid(const char *fn, struct nfs4_sessionid *sessionid)
 667 {
 668         u32 *ptr = (u32 *)(&sessionid->data[0]);
 669         dprintk("%s: %u:%u:%u:%u\n", fn, ptr[0], ptr[1], ptr[2], ptr[3]);
 670 }
 671 #else
 672 static inline void
 673 dump_sessionid(const char *fn, struct nfs4_sessionid *sessionid)
 674 {
 675 }
 676 #endif
 677
 678
 679 static void
 680 gen_sessionid(struct nfsd4_session *ses)
 681 {
 682         struct nfs4_client *clp = ses->se_client;
 683         struct nfsd4_sessionid *sid;
 684
 685         sid = (struct nfsd4_sessionid *)ses->se_sessionid.data;
 686         sid->clientid = clp->cl_clientid;
 687         sid->sequence = current_sessionid++;
 688         sid->reserved = 0;
 689 }
 690
 691 /*
 692  * The protocol defines ca_maxresponssize_cached to include the size of
 693  * the rpc header, but all we need to cache is the data starting after
 694  * the end of the initial SEQUENCE operation--the rest we regenerate
 695  * each time.  Therefore we can advertise a ca_maxresponssize_cached
 696  * value that is the number of bytes in our cache plus a few additional
 697  * bytes.  In order to stay on the safe side, and not promise more than
 698  * we can cache, those additional bytes must be the minimum possible: 24
 699  * bytes of rpc header (xid through accept state, with AUTH_NULL
 700  * verifier), 12 for the compound header (with zero-length tag), and 44
 701  * for the SEQUENCE op response:
 702  */
 703 #define NFSD_MIN_HDR_SEQ_SZ  (24 + 12 + 44)
 704
 705 static void
 706 free_session_slots(struct nfsd4_session *ses)
 707 {
 708         int i;
 709
 710         for (i = 0; i < ses->se_fchannel.maxreqs; i++)
 711                 kfree(ses->se_slots[i]);
 712 }
 713
 714 /*
 715  * We don't actually need to cache the rpc and session headers, so we
 716  * can allocate a little less for each slot:
 717  */
 718 static inline int slot_bytes(struct nfsd4_channel_attrs *ca)
 719 {
 720         return ca->maxresp_cached - NFSD_MIN_HDR_SEQ_SZ;
 721 }
 722
 723 static int nfsd4_sanitize_slot_size(u32 size)
 724 {
 725         size -= NFSD_MIN_HDR_SEQ_SZ; /* We don't cache the rpc header */
 726         size = min_t(u32, size, NFSD_SLOT_CACHE_SIZE);
 727
 728         return size;
 729 }
 730
 731 /*
 732  * XXX: If we run out of reserved DRC memory we could (up to a point)
 733  * re-negotiate active sessions and reduce their slot usage to make
 734  * room for new connections. For now we just fail the create session.
 735  */
 736 static int nfsd4_get_drc_mem(int slotsize, u32 num)
 737 {
 738         int avail;
 739
 740         num = min_t(u32, num, NFSD_MAX_SLOTS_PER_SESSION);
 741
 742         spin_lock(&nfsd_drc_lock);
 743         avail = min_t(int, NFSD_MAX_MEM_PER_SESSION,
 744                         nfsd_drc_max_mem - nfsd_drc_mem_used);
 745         num = min_t(int, num, avail / slotsize);
 746         nfsd_drc_mem_used += num * slotsize;
 747         spin_unlock(&nfsd_drc_lock);
 748
 749         return num;
 750 }
 751
 752 static void nfsd4_put_drc_mem(int slotsize, int num)
 753 {
 754         spin_lock(&nfsd_drc_lock);
 755         nfsd_drc_mem_used -= slotsize * num;
 756         spin_unlock(&nfsd_drc_lock);
 757 }
 758
 759 static struct nfsd4_session *alloc_session(int slotsize, int numslots)
 760 {
 761         struct nfsd4_session *new;
 762         int mem, i;
 763
 764         BUILD_BUG_ON(NFSD_MAX_SLOTS_PER_SESSION * sizeof(struct nfsd4_slot *)
 765                         + sizeof(struct nfsd4_session) > PAGE_SIZE);
 766         mem = numslots * sizeof(struct nfsd4_slot *);
 767
 768         new = kzalloc(sizeof(*new) + mem, GFP_KERNEL);
 769         if (!new)
 770                 return NULL;
 771         /* allocate each struct nfsd4_slot and data cache in one piece */
 772         for (i = 0; i < numslots; i++) {
 773                 mem = sizeof(struct nfsd4_slot) + slotsize;
 774                 new->se_slots[i] = kzalloc(mem, GFP_KERNEL);
 775                 if (!new->se_slots[i])
 776                         goto out_free;
 777         }
 778         return new;
 779 out_free:
 780         while (i--)
 781                 kfree(new->se_slots[i]);
 782         kfree(new);
 783         return NULL;
 784 }
 785
 786 static void init_forechannel_attrs(struct nfsd4_channel_attrs *new, struct nfsd4_channel_attrs *req, int numslots, int slotsize)
 787 {
 788         u32 maxrpc = nfsd_serv->sv_max_mesg;
 789
 790         new->maxreqs = numslots;
 791         new->maxresp_cached = min_t(u32, req->maxresp_cached,
 792                                         slotsize + NFSD_MIN_HDR_SEQ_SZ);
 793         new->maxreq_sz = min_t(u32, req->maxreq_sz, maxrpc);
 794         new->maxresp_sz = min_t(u32, req->maxresp_sz, maxrpc);
 795         new->maxops = min_t(u32, req->maxops, NFSD_MAX_OPS_PER_COMPOUND);
 796 }
 797
 798 static void free_conn(struct nfsd4_conn *c)
 799 {
 800         svc_xprt_put(c->cn_xprt);
 801         kfree(c);
 802 }
 803
 804 static void nfsd4_conn_lost(struct svc_xpt_user *u)
 805 {
 806         struct nfsd4_conn *c = container_of(u, struct nfsd4_conn, cn_xpt_user);
 807         struct nfs4_client *clp = c->cn_session->se_client;
 808
 809         spin_lock(&clp->cl_lock);
 810         if (!list_empty(&c->cn_persession)) {
 811                 list_del(&c->cn_persession);
 812                 free_conn(c);
 813         }
 814         spin_unlock(&clp->cl_lock);
 815         nfsd4_probe_callback(clp);
 816 }
 817
 818 static struct nfsd4_conn *alloc_conn(struct svc_rqst *rqstp, u32 flags)
 819 {
 820         struct nfsd4_conn *conn;
 821
 822         conn = kmalloc(sizeof(struct nfsd4_conn), GFP_KERNEL);
 823         if (!conn)
 824                 return NULL;
 825         svc_xprt_get(rqstp->rq_xprt);
 826         conn->cn_xprt = rqstp->rq_xprt;
 827         conn->cn_flags = flags;
 828         INIT_LIST_HEAD(&conn->cn_xpt_user.list);
 829         return conn;
 830 }
 831
 832 static void __nfsd4_hash_conn(struct nfsd4_conn *conn, struct nfsd4_session *ses)
 833 {
 834         conn->cn_session = ses;
 835         list_add(&conn->cn_persession, &ses->se_conns);
 836 }
 837
 838 static void nfsd4_hash_conn(struct nfsd4_conn *conn, struct nfsd4_session *ses)
 839 {
 840         struct nfs4_client *clp = ses->se_client;
 841
 842         spin_lock(&clp->cl_lock);
 843         __nfsd4_hash_conn(conn, ses);
 844         spin_unlock(&clp->cl_lock);
 845 }
 846
 847 static int nfsd4_register_conn(struct nfsd4_conn *conn)
 848 {
 849         conn->cn_xpt_user.callback = nfsd4_conn_lost;
 850         return register_xpt_user(conn->cn_xprt, &conn->cn_xpt_user);
 851 }
 852
 853 static __be32 nfsd4_new_conn(struct svc_rqst *rqstp, struct nfsd4_session *ses, u32 dir)
 854 {
 855         struct nfsd4_conn *conn;
 856         int ret;
 857
 858         conn = alloc_conn(rqstp, dir);
 859         if (!conn)
 860                 return nfserr_jukebox;
 861         nfsd4_hash_conn(conn, ses);
 862         ret = nfsd4_register_conn(conn);
 863         if (ret)
 864                 /* oops; xprt is already down: */
 865                 nfsd4_conn_lost(&conn->cn_xpt_user);
 866         if (ses->se_client->cl_cb_state == NFSD4_CB_DOWN &&
 867                 dir & NFS4_CDFC4_BACK) {
 868                 /* callback channel may be back up */
 869                 nfsd4_probe_callback(ses->se_client);
 870         }
 871         return nfs_ok;
 872 }
 873
 874 static __be32 nfsd4_new_conn_from_crses(struct svc_rqst *rqstp, struct nfsd4_session *ses)
 875 {
 876         u32 dir = NFS4_CDFC4_FORE;
 877
 878         if (ses->se_flags & SESSION4_BACK_CHAN)
 879                 dir |= NFS4_CDFC4_BACK;
 880
 881         return nfsd4_new_conn(rqstp, ses, dir);
 882 }
 883
 884 /* must be called under client_lock */
 885 static void nfsd4_del_conns(struct nfsd4_session *s)
 886 {
 887         struct nfs4_client *clp = s->se_client;
 888         struct nfsd4_conn *c;
 889
 890         spin_lock(&clp->cl_lock);
 891         while (!list_empty(&s->se_conns)) {
 892                 c = list_first_entry(&s->se_conns, struct nfsd4_conn, cn_persession);
 893                 list_del_init(&c->cn_persession);
 894                 spin_unlock(&clp->cl_lock);
 895
 896                 unregister_xpt_user(c->cn_xprt, &c->cn_xpt_user);
 897                 free_conn(c);
 898
 899                 spin_lock(&clp->cl_lock);
 900         }
 901         spin_unlock(&clp->cl_lock);
 902 }
 903
 904 static void free_session(struct kref *kref)
 905 {
 906         struct nfsd4_session *ses;
 907         int mem;
 908
 909         lockdep_assert_held(&client_lock);
 910         ses = container_of(kref, struct nfsd4_session, se_ref);
 911         nfsd4_del_conns(ses);
 912         spin_lock(&nfsd_drc_lock);
 913         mem = ses->se_fchannel.maxreqs * slot_bytes(&ses->se_fchannel);
 914         nfsd_drc_mem_used -= mem;
 915         spin_unlock(&nfsd_drc_lock);
 916         free_session_slots(ses);
 917         kfree(ses);
 918 }
 919
 920 void nfsd4_put_session(struct nfsd4_session *ses)
 921 {
 922         spin_lock(&client_lock);
 923         nfsd4_put_session_locked(ses);
 924         spin_unlock(&client_lock);
 925 }
 926
 927 static struct nfsd4_session *alloc_init_session(struct svc_rqst *rqstp, struct nfs4_client *clp, struct nfsd4_create_session *cses)
 928 {
 929         struct nfsd4_session *new;
 930         struct nfsd4_channel_attrs *fchan = &cses->fore_channel;
 931         int numslots, slotsize;
 932         __be32 status;
 933         int idx;
 934
 935         /*
 936          * Note decreasing slot size below client's request may
 937          * make it difficult for client to function correctly, whereas
 938          * decreasing the number of slots will (just?) affect
 939          * performance.  When short on memory we therefore prefer to
 940          * decrease number of slots instead of their size.
 941          */
 942         slotsize = nfsd4_sanitize_slot_size(fchan->maxresp_cached);
 943         numslots = nfsd4_get_drc_mem(slotsize, fchan->maxreqs);
 944         if (numslots < 1)
 945                 return NULL;
 946
 947         new = alloc_session(slotsize, numslots);
 948         if (!new) {
 949                 nfsd4_put_drc_mem(slotsize, fchan->maxreqs);
 950                 return NULL;
 951         }
 952         init_forechannel_attrs(&new->se_fchannel, fchan, numslots, slotsize);
 953
 954         new->se_client = clp;
 955         gen_sessionid(new);
 956
 957         INIT_LIST_HEAD(&new->se_conns);
 958
 959         new->se_cb_seq_nr = 1;
 960         new->se_flags = cses->flags;
 961         new->se_cb_prog = cses->callback_prog;
 962         kref_init(&new->se_ref);
 963         idx = hash_sessionid(&new->se_sessionid);
 964         spin_lock(&client_lock);
 965         list_add(&new->se_hash, &sessionid_hashtbl[idx]);
 966         spin_lock(&clp->cl_lock);
 967         list_add(&new->se_perclnt, &clp->cl_sessions);
 968         spin_unlock(&clp->cl_lock);
 969         spin_unlock(&client_lock);
 970
 971         status = nfsd4_new_conn_from_crses(rqstp, new);
 972         /* whoops: benny points out, status is ignored! (err, or bogus) */
 973         if (status) {
 974                 spin_lock(&client_lock);
 975                 free_session(&new->se_ref);
 976                 spin_unlock(&client_lock);
 977                 return NULL;
 978         }
 979         if (cses->flags & SESSION4_BACK_CHAN) {
 980                 struct sockaddr *sa = svc_addr(rqstp);
 981                 /*
 982                  * This is a little silly; with sessions there's no real
 983                  * use for the callback address.  Use the peer address
 984                  * as a reasonable default for now, but consider fixing
 985                  * the rpc client not to require an address in the
 986                  * future:
 987                  */
 988                 rpc_copy_addr((struct sockaddr *)&clp->cl_cb_conn.cb_addr, sa);
 989                 clp->cl_cb_conn.cb_addrlen = svc_addr_len(sa);
 990         }
 991         nfsd4_probe_callback(clp);
 992         return new;
 993 }
 994
 995 /* caller must hold client_lock */
 996 static struct nfsd4_session *
 997 find_in_sessionid_hashtbl(struct nfs4_sessionid *sessionid)
 998 {
 999         struct nfsd4_session *elem;
1000         int idx;
1001
1002         dump_sessionid(__func__, sessionid);
1003         idx = hash_sessionid(sessionid);
1004         /* Search in the appropriate list */
1005         list_for_each_entry(elem, &sessionid_hashtbl[idx], se_hash) {
1006                 if (!memcmp(elem->se_sessionid.data, sessionid->data,
1007                             NFS4_MAX_SESSIONID_LEN)) {
1008                         return elem;
1009                 }
1010         }
1011
1012         dprintk("%s: session not found\n", __func__);
1013         return NULL;
1014 }
1015
1016 /* caller must hold client_lock */
1017 static void
1018 unhash_session(struct nfsd4_session *ses)
1019 {
1020         list_del(&ses->se_hash);
1021         spin_lock(&ses->se_client->cl_lock);
1022         list_del(&ses->se_perclnt);
1023         spin_unlock(&ses->se_client->cl_lock);
1024 }
1025
1026 /* must be called under the client_lock */
1027 static inline void
1028 renew_client_locked(struct nfs4_client *clp)
1029 {
1030         if (is_client_expired(clp)) {
1031                 WARN_ON(1);
1032                 printk("%s: client (clientid %08x/%08x) already expired\n",
1033                         __func__,
1034                         clp->cl_clientid.cl_boot,
1035                         clp->cl_clientid.cl_id);
1036                 return;
1037         }
1038
1039         dprintk("renewing client (clientid %08x/%08x)\n",
1040                         clp->cl_clientid.cl_boot,
1041                         clp->cl_clientid.cl_id);
1042         list_move_tail(&clp->cl_lru, &client_lru);
1043         clp->cl_time = get_seconds();
1044 }
1045
1046 static inline void
1047 renew_client(struct nfs4_client *clp)
1048 {
1049         spin_lock(&client_lock);
1050         renew_client_locked(clp);
1051         spin_unlock(&client_lock);
1052 }
1053
1054 /* SETCLIENTID and SETCLIENTID_CONFIRM Helper functions */
1055 static int
1056 STALE_CLIENTID(clientid_t *clid)
1057 {
1058         if (clid->cl_boot == boot_time)
1059                 return 0;
1060         dprintk("NFSD stale clientid (%08x/%08x) boot_time %08lx\n",
1061                 clid->cl_boot, clid->cl_id, boot_time);
1062         return 1;
1063 }
1064
1065 /*
1066  * XXX Should we use a slab cache ?
1067  * This type of memory management is somewhat inefficient, but we use it
1068  * anyway since SETCLIENTID is not a common operation.
1069  */
1070 static struct nfs4_client *alloc_client(struct xdr_netobj name)
1071 {
1072         struct nfs4_client *clp;
1073
1074         clp = kzalloc(sizeof(struct nfs4_client), GFP_KERNEL);
1075         if (clp == NULL)
1076                 return NULL;
1077         clp->cl_name.data = kmemdup(name.data, name.len, GFP_KERNEL);
1078         if (clp->cl_name.data == NULL) {
1079                 kfree(clp);
1080                 return NULL;
1081         }
1082         clp->cl_name.len = name.len;
1083         return clp;
1084 }
1085
1086 static inline void
1087 free_client(struct nfs4_client *clp)
1088 {
1089         lockdep_assert_held(&client_lock);
1090         while (!list_empty(&clp->cl_sessions)) {
1091                 struct nfsd4_session *ses;
1092                 ses = list_entry(clp->cl_sessions.next, struct nfsd4_session,
1093                                 se_perclnt);
1094                 list_del(&ses->se_perclnt);
1095                 nfsd4_put_session_locked(ses);
1096         }
1097         free_svc_cred(&clp->cl_cred);
1098         kfree(clp->cl_name.data);
1099         kfree(clp);
1100 }
1101
1102 void
1103 release_session_client(struct nfsd4_session *session)
1104 {
1105         struct nfs4_client *clp = session->se_client;
1106
1107         if (!atomic_dec_and_lock(&clp->cl_refcount, &client_lock))
1108                 return;
1109         if (is_client_expired(clp)) {
1110                 free_client(clp);
1111                 session->se_client = NULL;
1112         } else
1113                 renew_client_locked(clp);
1114         spin_unlock(&client_lock);
1115 }
1116
1117 /* must be called under the client_lock */
1118 static inline void
1119 unhash_client_locked(struct nfs4_client *clp)
1120 {
1121         struct nfsd4_session *ses;
1122
1123         mark_client_expired(clp);
1124         list_del(&clp->cl_lru);
1125         spin_lock(&clp->cl_lock);
1126         list_for_each_entry(ses, &clp->cl_sessions, se_perclnt)
1127                 list_del_init(&ses->se_hash);
1128         spin_unlock(&clp->cl_lock);
1129 }
1130
1131 static void
1132 expire_client(struct nfs4_client *clp)
1133 {
1134         struct nfs4_openowner *oo;
1135         struct nfs4_delegation *dp;
1136         struct list_head reaplist;
1137
1138         INIT_LIST_HEAD(&reaplist);
1139         spin_lock(&recall_lock);
1140         while (!list_empty(&clp->cl_delegations)) {
1141                 dp = list_entry(clp->cl_delegations.next, struct nfs4_delegation, dl_perclnt);
1142                 list_del_init(&dp->dl_perclnt);
1143                 list_move(&dp->dl_recall_lru, &reaplist);
1144         }
1145         spin_unlock(&recall_lock);
1146         while (!list_empty(&reaplist)) {
1147                 dp = list_entry(reaplist.next, struct nfs4_delegation, dl_recall_lru);
1148                 unhash_delegation(dp);
1149         }
1150         while (!list_empty(&clp->cl_openowners)) {
1151                 oo = list_entry(clp->cl_openowners.next, struct nfs4_openowner, oo_perclient);
1152                 release_openowner(oo);
1153         }
1154         nfsd4_shutdown_callback(clp);
1155         if (clp->cl_cb_conn.cb_xprt)
1156                 svc_xprt_put(clp->cl_cb_conn.cb_xprt);
1157         list_del(&clp->cl_idhash);
1158         list_del(&clp->cl_strhash);
1159         spin_lock(&client_lock);
1160         unhash_client_locked(clp);
1161         if (atomic_read(&clp->cl_refcount) == 0)
1162                 free_client(clp);
1163         spin_unlock(&client_lock);
1164 }
1165
1166 static void copy_verf(struct nfs4_client *target, nfs4_verifier *source)
1167 {
1168         memcpy(target->cl_verifier.data, source->data,
1169                         sizeof(target->cl_verifier.data));
1170 }
1171
1172 static void copy_clid(struct nfs4_client *target, struct nfs4_client *source)
1173 {
1174         target->cl_clientid.cl_boot = source->cl_clientid.cl_boot;
1175         target->cl_clientid.cl_id = source->cl_clientid.cl_id;
1176 }
1177
1178 static int copy_cred(struct svc_cred *target, struct svc_cred *source)
1179 {
1180         if (source->cr_principal) {
1181                 target->cr_principal =
1182                                 kstrdup(source->cr_principal, GFP_KERNEL);
1183                 if (target->cr_principal == NULL)
1184                         return -ENOMEM;
1185         } else
1186                 target->cr_principal = NULL;
1187         target->cr_flavor = source->cr_flavor;
1188         target->cr_uid = source->cr_uid;
1189         target->cr_gid = source->cr_gid;
1190         target->cr_group_info = source->cr_group_info;
1191         get_group_info(target->cr_group_info);
1192         return 0;
1193 }
1194
1195 static int same_name(const char *n1, const char *n2)
1196 {
1197         return 0 == memcmp(n1, n2, HEXDIR_LEN);
1198 }
1199
1200 static int
1201 same_verf(nfs4_verifier *v1, nfs4_verifier *v2)
1202 {
1203         return 0 == memcmp(v1->data, v2->data, sizeof(v1->data));
1204 }
1205
1206 static int
1207 same_clid(clientid_t *cl1, clientid_t *cl2)
1208 {
1209         return (cl1->cl_boot == cl2->cl_boot) && (cl1->cl_id == cl2->cl_id);
1210 }
1211
1212 static bool groups_equal(struct group_info *g1, struct group_info *g2)
1213 {
1214         int i;
1215
1216         if (g1->ngroups != g2->ngroups)
1217                 return false;
1218         for (i=0; i<g1->ngroups; i++)
1219                 if (GROUP_AT(g1, i) != GROUP_AT(g2, i))
1220                         return false;
1221         return true;
1222 }
1223
1224 static int
1225 same_creds(struct svc_cred *cr1, struct svc_cred *cr2)
1226 {
1227         if ((cr1->cr_flavor != cr2->cr_flavor)
1228                 || (cr1->cr_uid != cr2->cr_uid)
1229                 || (cr1->cr_gid != cr2->cr_gid)
1230                 || !groups_equal(cr1->cr_group_info, cr2->cr_group_info))
1231                 return false;
1232         if (cr1->cr_principal == cr2->cr_principal)
1233                 return true;
1234         if (!cr1->cr_principal || !cr2->cr_principal)
1235                 return false;
1236         return 0 == strcmp(cr1->cr_principal, cr1->cr_principal);
1237 }
1238
1239 static void gen_clid(struct nfs4_client *clp)
1240 {
1241         static u32 current_clientid = 1;
1242
1243         clp->cl_clientid.cl_boot = boot_time;
1244         clp->cl_clientid.cl_id = current_clientid++;
1245 }
1246
1247 static void gen_confirm(struct nfs4_client *clp)
1248 {
1249         __be32 verf[2];
1250         static u32 i;
1251
1252         verf[0] = (__be32)get_seconds();
1253         verf[1] = (__be32)i++;
1254         memcpy(clp->cl_confirm.data, verf, sizeof(clp->cl_confirm.data));
1255 }
1256
1257 static struct nfs4_stid *find_stateid(struct nfs4_client *cl, stateid_t *t)
1258 {
1259         return idr_find(&cl->cl_stateids, t->si_opaque.so_id);
1260 }
1261
1262 static struct nfs4_stid *find_stateid_by_type(struct nfs4_client *cl, stateid_t *t, char typemask)
1263 {
1264         struct nfs4_stid *s;
1265
1266         s = find_stateid(cl, t);
1267         if (!s)
1268                 return NULL;
1269         if (typemask & s->sc_type)
1270                 return s;
1271         return NULL;
1272 }
1273
1274 static struct nfs4_client *create_client(struct xdr_netobj name, char *recdir,
1275                 struct svc_rqst *rqstp, nfs4_verifier *verf)
1276 {
1277         struct nfs4_client *clp;
1278         struct sockaddr *sa = svc_addr(rqstp);
1279         int ret;
1280
1281         clp = alloc_client(name);
1282         if (clp == NULL)
1283                 return NULL;
1284
1285         INIT_LIST_HEAD(&clp->cl_sessions);
1286         ret = copy_cred(&clp->cl_cred, &rqstp->rq_cred);
1287         if (ret) {
1288                 spin_lock(&client_lock);
1289                 free_client(clp);
1290                 spin_unlock(&client_lock);
1291                 return NULL;
1292         }
1293         idr_init(&clp->cl_stateids);
1294         memcpy(clp->cl_recdir, recdir, HEXDIR_LEN);
1295         atomic_set(&clp->cl_refcount, 0);
1296         clp->cl_cb_state = NFSD4_CB_UNKNOWN;
1297         INIT_LIST_HEAD(&clp->cl_idhash);
1298         INIT_LIST_HEAD(&clp->cl_strhash);
1299         INIT_LIST_HEAD(&clp->cl_openowners);
1300         INIT_LIST_HEAD(&clp->cl_delegations);
1301         INIT_LIST_HEAD(&clp->cl_lru);
1302         INIT_LIST_HEAD(&clp->cl_callbacks);
1303         spin_lock_init(&clp->cl_lock);
1304         INIT_WORK(&clp->cl_cb_null.cb_work, nfsd4_do_callback_rpc);
1305         clp->cl_time = get_seconds();
1306         clear_bit(0, &clp->cl_cb_slot_busy);
1307         rpc_init_wait_queue(&clp->cl_cb_waitq, "Backchannel slot table");
1308         copy_verf(clp, verf);
1309         rpc_copy_addr((struct sockaddr *) &clp->cl_addr, sa);
1310         gen_confirm(clp);
1311         clp->cl_cb_session = NULL;
1312         return clp;
1313 }
1314
1315 static void
1316 add_to_unconfirmed(struct nfs4_client *clp, unsigned int strhashval)
1317 {
1318         unsigned int idhashval;
1319
1320         list_add(&clp->cl_strhash, &unconf_str_hashtbl[strhashval]);
1321         idhashval = clientid_hashval(clp->cl_clientid.cl_id);
1322         list_add(&clp->cl_idhash, &unconf_id_hashtbl[idhashval]);
1323         renew_client(clp);
1324 }
1325
1326 static void
1327 move_to_confirmed(struct nfs4_client *clp)
1328 {
1329         unsigned int idhashval = clientid_hashval(clp->cl_clientid.cl_id);
1330         unsigned int strhashval;
1331
1332         dprintk("NFSD: move_to_confirm nfs4_client %p\n", clp);
1333         list_move(&clp->cl_idhash, &conf_id_hashtbl[idhashval]);
1334         strhashval = clientstr_hashval(clp->cl_recdir);
1335         list_move(&clp->cl_strhash, &conf_str_hashtbl[strhashval]);
1336         renew_client(clp);
1337 }
1338
1339 static struct nfs4_client *
1340 find_confirmed_client(clientid_t *clid)
1341 {
1342         struct nfs4_client *clp;
1343         unsigned int idhashval = clientid_hashval(clid->cl_id);
1344
1345         list_for_each_entry(clp, &conf_id_hashtbl[idhashval], cl_idhash) {
1346                 if (same_clid(&clp->cl_clientid, clid)) {
1347                         renew_client(clp);
1348                         return clp;
1349                 }
1350         }
1351         return NULL;
1352 }
1353
1354 static struct nfs4_client *
1355 find_unconfirmed_client(clientid_t *clid)
1356 {
1357         struct nfs4_client *clp;
1358         unsigned int idhashval = clientid_hashval(clid->cl_id);
1359
1360         list_for_each_entry(clp, &unconf_id_hashtbl[idhashval], cl_idhash) {
1361                 if (same_clid(&clp->cl_clientid, clid))
1362                         return clp;
1363         }
1364         return NULL;
1365 }
1366
1367 static bool clp_used_exchangeid(struct nfs4_client *clp)
1368 {
1369         return clp->cl_exchange_flags != 0;
1370 }
1371
1372 static struct nfs4_client *
1373 find_confirmed_client_by_str(const char *dname, unsigned int hashval)
1374 {
1375         struct nfs4_client *clp;
1376
1377         list_for_each_entry(clp, &conf_str_hashtbl[hashval], cl_strhash) {
1378                 if (same_name(clp->cl_recdir, dname))
1379                         return clp;
1380         }
1381         return NULL;
1382 }
1383
1384 static struct nfs4_client *
1385 find_unconfirmed_client_by_str(const char *dname, unsigned int hashval)
1386 {
1387         struct nfs4_client *clp;
1388
1389         list_for_each_entry(clp, &unconf_str_hashtbl[hashval], cl_strhash) {
1390                 if (same_name(clp->cl_recdir, dname))
1391                         return clp;
1392         }
1393         return NULL;
1394 }
1395
1396 static void
1397 gen_callback(struct nfs4_client *clp, struct nfsd4_setclientid *se, struct svc_rqst *rqstp)
1398 {
1399         struct nfs4_cb_conn *conn = &clp->cl_cb_conn;
1400         struct sockaddr *sa = svc_addr(rqstp);
1401         u32 scopeid = rpc_get_scope_id(sa);
1402         unsigned short expected_family;
1403
1404         /* Currently, we only support tcp and tcp6 for the callback channel */
1405         if (se->se_callback_netid_len == 3 &&
1406             !memcmp(se->se_callback_netid_val, "tcp", 3))
1407                 expected_family = AF_INET;
1408         else if (se->se_callback_netid_len == 4 &&
1409                  !memcmp(se->se_callback_netid_val, "tcp6", 4))
1410                 expected_family = AF_INET6;
1411         else
1412                 goto out_err;
1413
1414         conn->cb_addrlen = rpc_uaddr2sockaddr(&init_net, se->se_callback_addr_val,
1415                                             se->se_callback_addr_len,
1416                                             (struct sockaddr *)&conn->cb_addr,
1417                                             sizeof(conn->cb_addr));
1418
1419         if (!conn->cb_addrlen || conn->cb_addr.ss_family != expected_family)
1420                 goto out_err;
1421
1422         if (conn->cb_addr.ss_family == AF_INET6)
1423                 ((struct sockaddr_in6 *)&conn->cb_addr)->sin6_scope_id = scopeid;
1424
1425         conn->cb_prog = se->se_callback_prog;
1426         conn->cb_ident = se->se_callback_ident;
1427         memcpy(&conn->cb_saddr, &rqstp->rq_daddr, rqstp->rq_daddrlen);
1428         return;
1429 out_err:
1430         conn->cb_addr.ss_family = AF_UNSPEC;
1431         conn->cb_addrlen = 0;
1432         dprintk(KERN_INFO "NFSD: this client (clientid %08x/%08x) "
1433                 "will not receive delegations\n",
1434                 clp->cl_clientid.cl_boot, clp->cl_clientid.cl_id);
1435
1436         return;
1437 }
1438
1439 /*
1440  * Cache a reply. nfsd4_check_drc_limit() has bounded the cache size.
1441  */
1442 void
1443 nfsd4_store_cache_entry(struct nfsd4_compoundres *resp)
1444 {
1445         struct nfsd4_slot *slot = resp->cstate.slot;
1446         unsigned int base;
1447
1448         dprintk("--> %s slot %p\n", __func__, slot);
1449
1450         slot->sl_opcnt = resp->opcnt;
1451         slot->sl_status = resp->cstate.status;
1452
1453         slot->sl_flags |= NFSD4_SLOT_INITIALIZED;
1454         if (nfsd4_not_cached(resp)) {
1455                 slot->sl_datalen = 0;
1456                 return;
1457         }
1458         slot->sl_datalen = (char *)resp->p - (char *)resp->cstate.datap;
1459         base = (char *)resp->cstate.datap -
1460                                         (char *)resp->xbuf->head[0].iov_base;
1461         if (read_bytes_from_xdr_buf(resp->xbuf, base, slot->sl_data,
1462                                     slot->sl_datalen))
1463                 WARN("%s: sessions DRC could not cache compound\n", __func__);
1464         return;
1465 }
1466
1467 /*
1468  * Encode the replay sequence operation from the slot values.
1469  * If cachethis is FALSE encode the uncached rep error on the next
1470  * operation which sets resp->p and increments resp->opcnt for
1471  * nfs4svc_encode_compoundres.
1472  *
1473  */
1474 static __be32
1475 nfsd4_enc_sequence_replay(struct nfsd4_compoundargs *args,
1476                           struct nfsd4_compoundres *resp)
1477 {
1478         struct nfsd4_op *op;
1479         struct nfsd4_slot *slot = resp->cstate.slot;
1480
1481         /* Encode the replayed sequence operation */
1482         op = &args->ops[resp->opcnt - 1];
1483         nfsd4_encode_operation(resp, op);
1484
1485         /* Return nfserr_retry_uncached_rep in next operation. */
1486         if (args->opcnt > 1 && !(slot->sl_flags & NFSD4_SLOT_CACHETHIS)) {
1487                 op = &args->ops[resp->opcnt++];
1488                 op->status = nfserr_retry_uncached_rep;
1489                 nfsd4_encode_operation(resp, op);
1490         }
1491         return op->status;
1492 }
1493
1494 /*
1495  * The sequence operation is not cached because we can use the slot and
1496  * session values.
1497  */
1498 __be32
1499 nfsd4_replay_cache_entry(struct nfsd4_compoundres *resp,
1500                          struct nfsd4_sequence *seq)
1501 {
1502         struct nfsd4_slot *slot = resp->cstate.slot;
1503         __be32 status;
1504
1505         dprintk("--> %s slot %p\n", __func__, slot);
1506
1507         /* Either returns 0 or nfserr_retry_uncached */
1508         status = nfsd4_enc_sequence_replay(resp->rqstp->rq_argp, resp);
1509         if (status == nfserr_retry_uncached_rep)
1510                 return status;
1511
1512         /* The sequence operation has been encoded, cstate->datap set. */
1513         memcpy(resp->cstate.datap, slot->sl_data, slot->sl_datalen);
1514
1515         resp->opcnt = slot->sl_opcnt;
1516         resp->p = resp->cstate.datap + XDR_QUADLEN(slot->sl_datalen);
1517         status = slot->sl_status;
1518
1519         return status;
1520 }
1521
1522 /*
1523  * Set the exchange_id flags returned by the server.
1524  */
1525 static void
1526 nfsd4_set_ex_flags(struct nfs4_client *new, struct nfsd4_exchange_id *clid)
1527 {
1528         /* pNFS is not supported */
1529         new->cl_exchange_flags |= EXCHGID4_FLAG_USE_NON_PNFS;
1530
1531         /* Referrals are supported, Migration is not. */
1532         new->cl_exchange_flags |= EXCHGID4_FLAG_SUPP_MOVED_REFER;
1533
1534         /* set the wire flags to return to client. */
1535         clid->flags = new->cl_exchange_flags;
1536 }
1537
1538 static bool client_has_state(struct nfs4_client *clp)
1539 {
1540         /*
1541          * Note clp->cl_openowners check isn't quite right: there's no
1542          * need to count owners without stateid's.
1543          *
1544          * Also note we should probably be using this in 4.0 case too.
1545          */
1546         return !list_empty(&clp->cl_openowners)
1547                 || !list_empty(&clp->cl_delegations)
1548                 || !list_empty(&clp->cl_sessions);
1549 }
1550
1551 __be32
1552 nfsd4_exchange_id(struct svc_rqst *rqstp,
1553                   struct nfsd4_compound_state *cstate,
1554                   struct nfsd4_exchange_id *exid)
1555 {
1556         struct nfs4_client *unconf, *conf, *new;
1557         __be32 status;
1558         unsigned int            strhashval;
1559         char                    dname[HEXDIR_LEN];
1560         char                    addr_str[INET6_ADDRSTRLEN];
1561         nfs4_verifier           verf = exid->verifier;
1562         struct sockaddr         *sa = svc_addr(rqstp);
1563         bool    update = exid->flags & EXCHGID4_FLAG_UPD_CONFIRMED_REC_A;
1564
1565         rpc_ntop(sa, addr_str, sizeof(addr_str));
1566         dprintk("%s rqstp=%p exid=%p clname.len=%u clname.data=%p "
1567                 "ip_addr=%s flags %x, spa_how %d\n",
1568                 __func__, rqstp, exid, exid->clname.len, exid->clname.data,
1569                 addr_str, exid->flags, exid->spa_how);
1570
1571         if (exid->flags & ~EXCHGID4_FLAG_MASK_A)
1572                 return nfserr_inval;
1573
1574         /* Currently only support SP4_NONE */
1575         switch (exid->spa_how) {
1576         case SP4_NONE:
1577                 break;
1578         case SP4_SSV:
1579                 return nfserr_serverfault;
1580         default:
1581                 BUG();                          /* checked by xdr code */
1582         case SP4_MACH_CRED:
1583                 return nfserr_serverfault;      /* no excuse :-/ */
1584         }
1585
1586         status = nfs4_make_rec_clidname(dname, &exid->clname);
1587
1588         if (status)
1589                 return status;
1590
1591         strhashval = clientstr_hashval(dname);
1592
1593         /* Cases below refer to rfc 5661 section 18.35.4: */
1594         nfs4_lock_state();
1595         conf = find_confirmed_client_by_str(dname, strhashval);
1596         if (conf) {
1597                 bool creds_match = same_creds(&conf->cl_cred, &rqstp->rq_cred);
1598                 bool verfs_match = same_verf(&verf, &conf->cl_verifier);
1599
1600                 if (update) {
1601                         if (!clp_used_exchangeid(conf)) { /* buggy client */
1602                                 status = nfserr_inval;
1603                                 goto out;
1604                         }
1605                         if (!creds_match) { /* case 9 */
1606                                 status = nfserr_perm;
1607                                 goto out;
1608                         }
1609                         if (!verfs_match) { /* case 8 */
1610                                 status = nfserr_not_same;
1611                                 goto out;
1612                         }
1613                         /* case 6 */
1614                         exid->flags |= EXCHGID4_FLAG_CONFIRMED_R;
1615                         new = conf;
1616                         goto out_copy;
1617                 }
1618                 if (!creds_match) { /* case 3 */
1619                         if (client_has_state(conf)) {
1620                                 status = nfserr_clid_inuse;
1621                                 goto out;
1622                         }
1623                         expire_client(conf);
1624                         goto out_new;
1625                 }
1626                 if (verfs_match) { /* case 2 */
1627                         conf->cl_exchange_flags |= EXCHGID4_FLAG_CONFIRMED_R;
1628                         new = conf;
1629                         goto out_copy;
1630                 }
1631                 /* case 5, client reboot */
1632                 goto out_new;
1633         }
1634
1635         if (update) { /* case 7 */
1636                 status = nfserr_noent;
1637                 goto out;
1638         }
1639
1640         unconf  = find_unconfirmed_client_by_str(dname, strhashval);
1641         if (unconf) /* case 4, possible retry or client restart */
1642                 expire_client(unconf);
1643
1644         /* case 1 (normal case) */
1645 out_new:
1646         new = create_client(exid->clname, dname, rqstp, &verf);
1647         if (new == NULL) {
1648                 status = nfserr_jukebox;
1649                 goto out;
1650         }
1651
1652         gen_clid(new);
1653         add_to_unconfirmed(new, strhashval);
1654 out_copy:
1655         exid->clientid.cl_boot = new->cl_clientid.cl_boot;
1656         exid->clientid.cl_id = new->cl_clientid.cl_id;
1657
1658         exid->seqid = new->cl_cs_slot.sl_seqid + 1;
1659         nfsd4_set_ex_flags(new, exid);
1660
1661         dprintk("nfsd4_exchange_id seqid %d flags %x\n",
1662                 new->cl_cs_slot.sl_seqid, new->cl_exchange_flags);
1663         status = nfs_ok;
1664
1665 out:
1666         nfs4_unlock_state();
1667         return status;
1668 }
1669
1670 static __be32
1671 check_slot_seqid(u32 seqid, u32 slot_seqid, int slot_inuse)
1672 {
1673         dprintk("%s enter. seqid %d slot_seqid %d\n", __func__, seqid,
1674                 slot_seqid);
1675
1676         /* The slot is in use, and no response has been sent. */
1677         if (slot_inuse) {
1678                 if (seqid == slot_seqid)
1679                         return nfserr_jukebox;
1680                 else
1681                         return nfserr_seq_misordered;
1682         }
1683         /* Note unsigned 32-bit arithmetic handles wraparound: */
1684         if (likely(seqid == slot_seqid + 1))
1685                 return nfs_ok;
1686         if (seqid == slot_seqid)
1687                 return nfserr_replay_cache;
1688         return nfserr_seq_misordered;
1689 }
1690
1691 /*
1692  * Cache the create session result into the create session single DRC
1693  * slot cache by saving the xdr structure. sl_seqid has been set.
1694  * Do this for solo or embedded create session operations.
1695  */
1696 static void
1697 nfsd4_cache_create_session(struct nfsd4_create_session *cr_ses,
1698                            struct nfsd4_clid_slot *slot, __be32 nfserr)
1699 {
1700         slot->sl_status = nfserr;
1701         memcpy(&slot->sl_cr_ses, cr_ses, sizeof(*cr_ses));
1702 }
1703
1704 static __be32
1705 nfsd4_replay_create_session(struct nfsd4_create_session *cr_ses,
1706                             struct nfsd4_clid_slot *slot)
1707 {
1708         memcpy(cr_ses, &slot->sl_cr_ses, sizeof(*cr_ses));
1709         return slot->sl_status;
1710 }
1711
1712 #define NFSD_MIN_REQ_HDR_SEQ_SZ ((\
1713                         2 * 2 + /* credential,verifier: AUTH_NULL, length 0 */ \
1714                         1 +     /* MIN tag is length with zero, only length */ \
1715                         3 +     /* version, opcount, opcode */ \
1716                         XDR_QUADLEN(NFS4_MAX_SESSIONID_LEN) + \
1717                                 /* seqid, slotID, slotID, cache */ \
1718                         4 ) * sizeof(__be32))
1719
1720 #define NFSD_MIN_RESP_HDR_SEQ_SZ ((\
1721                         2 +     /* verifier: AUTH_NULL, length 0 */\
1722                         1 +     /* status */ \
1723                         1 +     /* MIN tag is length with zero, only length */ \
1724                         3 +     /* opcount, opcode, opstatus*/ \
1725                         XDR_QUADLEN(NFS4_MAX_SESSIONID_LEN) + \
1726                                 /* seqid, slotID, slotID, slotID, status */ \
1727                         5 ) * sizeof(__be32))
1728
1729 static bool check_forechannel_attrs(struct nfsd4_channel_attrs fchannel)
1730 {
1731         return fchannel.maxreq_sz < NFSD_MIN_REQ_HDR_SEQ_SZ
1732                 || fchannel.maxresp_sz < NFSD_MIN_RESP_HDR_SEQ_SZ;
1733 }
1734
1735 __be32
1736 nfsd4_create_session(struct svc_rqst *rqstp,
1737                      struct nfsd4_compound_state *cstate,
1738                      struct nfsd4_create_session *cr_ses)
1739 {
1740         struct sockaddr *sa = svc_addr(rqstp);
1741         struct nfs4_client *conf, *unconf;
1742         struct nfsd4_session *new;
1743         struct nfsd4_clid_slot *cs_slot = NULL;
1744         bool confirm_me = false;
1745         __be32 status = 0;
1746
1747         if (cr_ses->flags & ~SESSION4_FLAG_MASK_A)
1748                 return nfserr_inval;
1749
1750         nfs4_lock_state();
1751         unconf = find_unconfirmed_client(&cr_ses->clientid);
1752         conf = find_confirmed_client(&cr_ses->clientid);
1753
1754         if (conf) {
1755                 cs_slot = &conf->cl_cs_slot;
1756                 status = check_slot_seqid(cr_ses->seqid, cs_slot->sl_seqid, 0);
1757                 if (status == nfserr_replay_cache) {
1758                         status = nfsd4_replay_create_session(cr_ses, cs_slot);
1759                         goto out;
1760                 } else if (cr_ses->seqid != cs_slot->sl_seqid + 1) {
1761                         status = nfserr_seq_misordered;
1762                         goto out;
1763                 }
1764         } else if (unconf) {
1765                 if (!same_creds(&unconf->cl_cred, &rqstp->rq_cred) ||
1766                     !rpc_cmp_addr(sa, (struct sockaddr *) &unconf->cl_addr)) {
1767                         status = nfserr_clid_inuse;
1768                         goto out;
1769                 }
1770                 cs_slot = &unconf->cl_cs_slot;
1771                 status = check_slot_seqid(cr_ses->seqid, cs_slot->sl_seqid, 0);
1772                 if (status) {
1773                         /* an unconfirmed replay returns misordered */
1774                         status = nfserr_seq_misordered;
1775                         goto out;
1776                 }
1777                 confirm_me = true;
1778                 conf = unconf;
1779         } else {
1780                 status = nfserr_stale_clientid;
1781                 goto out;
1782         }
1783
1784         /*
1785          * XXX: we should probably set this at creation time, and check
1786          * for consistent minorversion use throughout:
1787          */
1788         conf->cl_minorversion = 1;
1789         /*
1790          * We do not support RDMA or persistent sessions
1791          */
1792         cr_ses->flags &= ~SESSION4_PERSIST;
1793         cr_ses->flags &= ~SESSION4_RDMA;
1794
1795         status = nfserr_toosmall;
1796         if (check_forechannel_attrs(cr_ses->fore_channel))
1797                 goto out;
1798
1799         status = nfserr_jukebox;
1800         new = alloc_init_session(rqstp, conf, cr_ses);
1801         if (!new)
1802                 goto out;
1803         status = nfs_ok;
1804         memcpy(cr_ses->sessionid.data, new->se_sessionid.data,
1805                NFS4_MAX_SESSIONID_LEN);
1806         memcpy(&cr_ses->fore_channel, &new->se_fchannel,
1807                 sizeof(struct nfsd4_channel_attrs));
1808         cs_slot->sl_seqid++;
1809         cr_ses->seqid = cs_slot->sl_seqid;
1810
1811         /* cache solo and embedded create sessions under the state lock */
1812         nfsd4_cache_create_session(cr_ses, cs_slot, status);
1813         if (confirm_me) {
1814                 unsigned int hash = clientstr_hashval(unconf->cl_recdir);
1815                 struct nfs4_client *old =
1816                         find_confirmed_client_by_str(conf->cl_recdir, hash);
1817                 if (old)
1818                         expire_client(old);
1819                 move_to_confirmed(conf);
1820         }
1821 out:
1822         nfs4_unlock_state();
1823         dprintk("%s returns %d\n", __func__, ntohl(status));
1824         return status;
1825 }
1826
1827 static bool nfsd4_last_compound_op(struct svc_rqst *rqstp)
1828 {
1829         struct nfsd4_compoundres *resp = rqstp->rq_resp;
1830         struct nfsd4_compoundargs *argp = rqstp->rq_argp;
1831
1832         return argp->opcnt == resp->opcnt;
1833 }
1834
1835 static __be32 nfsd4_map_bcts_dir(u32 *dir)
1836 {
1837         switch (*dir) {
1838         case NFS4_CDFC4_FORE:
1839         case NFS4_CDFC4_BACK:
1840                 return nfs_ok;
1841         case NFS4_CDFC4_FORE_OR_BOTH:
1842         case NFS4_CDFC4_BACK_OR_BOTH:
1843                 *dir = NFS4_CDFC4_BOTH;
1844                 return nfs_ok;
1845         };
1846         return nfserr_inval;
1847 }
1848
1849 __be32 nfsd4_bind_conn_to_session(struct svc_rqst *rqstp,
1850                      struct nfsd4_compound_state *cstate,
1851                      struct nfsd4_bind_conn_to_session *bcts)
1852 {
1853         __be32 status;
1854
1855         if (!nfsd4_last_compound_op(rqstp))
1856                 return nfserr_not_only_op;
1857         spin_lock(&client_lock);
1858         cstate->session = find_in_sessionid_hashtbl(&bcts->sessionid);
1859         /* Sorta weird: we only need the refcnt'ing because new_conn acquires
1860          * client_lock iself: */
1861         if (cstate->session) {
1862                 nfsd4_get_session(cstate->session);
1863                 atomic_inc(&cstate->session->se_client->cl_refcount);
1864         }
1865         spin_unlock(&client_lock);
1866         if (!cstate->session)
1867                 return nfserr_badsession;
1868
1869         status = nfsd4_map_bcts_dir(&bcts->dir);
1870         if (!status)
1871                 nfsd4_new_conn(rqstp, cstate->session, bcts->dir);
1872         return status;
1873 }
1874
1875 static bool nfsd4_compound_in_session(struct nfsd4_session *session, struct nfs4_sessionid *sid)
1876 {
1877         if (!session)
1878                 return 0;
1879         return !memcmp(sid, &session->se_sessionid, sizeof(*sid));
1880 }
1881
1882 __be32
1883 nfsd4_destroy_session(struct svc_rqst *r,
1884                       struct nfsd4_compound_state *cstate,
1885                       struct nfsd4_destroy_session *sessionid)
1886 {
1887         struct nfsd4_session *ses;
1888         __be32 status = nfserr_badsession;
1889
1890         /* Notes:
1891          * - The confirmed nfs4_client->cl_sessionid holds destroyed sessinid
1892          * - Should we return nfserr_back_chan_busy if waiting for
1893          *   callbacks on to-be-destroyed session?
1894          * - Do we need to clear any callback info from previous session?
1895          */
1896
1897         if (nfsd4_compound_in_session(cstate->session, &sessionid->sessionid)) {
1898                 if (!nfsd4_last_compound_op(r))
1899                         return nfserr_not_only_op;
1900         }
1901         dump_sessionid(__func__, &sessionid->sessionid);
1902         spin_lock(&client_lock);
1903         ses = find_in_sessionid_hashtbl(&sessionid->sessionid);
1904         if (!ses) {
1905                 spin_unlock(&client_lock);
1906                 goto out;
1907         }
1908
1909         unhash_session(ses);
1910         spin_unlock(&client_lock);
1911
1912         nfs4_lock_state();
1913         nfsd4_probe_callback_sync(ses->se_client);
1914         nfs4_unlock_state();
1915
1916         spin_lock(&client_lock);
1917         nfsd4_del_conns(ses);
1918         nfsd4_put_session_locked(ses);
1919         spin_unlock(&client_lock);
1920         status = nfs_ok;
1921 out:
1922         dprintk("%s returns %d\n", __func__, ntohl(status));
1923         return status;
1924 }
1925
1926 static struct nfsd4_conn *__nfsd4_find_conn(struct svc_xprt *xpt, struct nfsd4_session *s)
1927 {
1928         struct nfsd4_conn *c;
1929
1930         list_for_each_entry(c, &s->se_conns, cn_persession) {
1931                 if (c->cn_xprt == xpt) {
1932                         return c;
1933                 }
1934         }
1935         return NULL;
1936 }
1937
1938 static void nfsd4_sequence_check_conn(struct nfsd4_conn *new, struct nfsd4_session *ses)
1939 {
1940         struct nfs4_client *clp = ses->se_client;
1941         struct nfsd4_conn *c;
1942         int ret;
1943
1944         spin_lock(&clp->cl_lock);
1945         c = __nfsd4_find_conn(new->cn_xprt, ses);
1946         if (c) {
1947                 spin_unlock(&clp->cl_lock);
1948                 free_conn(new);
1949                 return;
1950         }
1951         __nfsd4_hash_conn(new, ses);
1952         spin_unlock(&clp->cl_lock);
1953         ret = nfsd4_register_conn(new);
1954         if (ret)
1955                 /* oops; xprt is already down: */
1956                 nfsd4_conn_lost(&new->cn_xpt_user);
1957         return;
1958 }
1959
1960 static bool nfsd4_session_too_many_ops(struct svc_rqst *rqstp, struct nfsd4_session *session)
1961 {
1962         struct nfsd4_compoundargs *args = rqstp->rq_argp;
1963
1964         return args->opcnt > session->se_fchannel.maxops;
1965 }
1966
1967 static bool nfsd4_request_too_big(struct svc_rqst *rqstp,
1968                                   struct nfsd4_session *session)
1969 {
1970         struct xdr_buf *xb = &rqstp->rq_arg;
1971
1972         return xb->len > session->se_fchannel.maxreq_sz;
1973 }
1974
1975 __be32
1976 nfsd4_sequence(struct svc_rqst *rqstp,
1977                struct nfsd4_compound_state *cstate,
1978                struct nfsd4_sequence *seq)
1979 {
1980         struct nfsd4_compoundres *resp = rqstp->rq_resp;
1981         struct nfsd4_session *session;
1982         struct nfsd4_slot *slot;
1983         struct nfsd4_conn *conn;
1984         __be32 status;
1985
1986         if (resp->opcnt != 1)
1987                 return nfserr_sequence_pos;
1988
1989         /*
1990          * Will be either used or freed by nfsd4_sequence_check_conn
1991          * below.
1992          */
1993         conn = alloc_conn(rqstp, NFS4_CDFC4_FORE);
1994         if (!conn)
1995                 return nfserr_jukebox;
1996
1997         spin_lock(&client_lock);
1998         status = nfserr_badsession;
1999         session = find_in_sessionid_hashtbl(&seq->sessionid);
2000         if (!session)
2001                 goto out;
2002
2003         status = nfserr_too_many_ops;
2004         if (nfsd4_session_too_many_ops(rqstp, session))
2005                 goto out;
2006
2007         status = nfserr_req_too_big;
2008         if (nfsd4_request_too_big(rqstp, session))
2009                 goto out;
2010
2011         status = nfserr_badslot;
2012         if (seq->slotid >= session->se_fchannel.maxreqs)
2013                 goto out;
2014
2015         slot = session->se_slots[seq->slotid];
2016         dprintk("%s: slotid %d\n", __func__, seq->slotid);
2017
2018         /* We do not negotiate the number of slots yet, so set the
2019          * maxslots to the session maxreqs which is used to encode
2020          * sr_highest_slotid and the sr_target_slot id to maxslots */
2021         seq->maxslots = session->se_fchannel.maxreqs;
2022
2023         status = check_slot_seqid(seq->seqid, slot->sl_seqid,
2024                                         slot->sl_flags & NFSD4_SLOT_INUSE);
2025         if (status == nfserr_replay_cache) {
2026                 status = nfserr_seq_misordered;
2027                 if (!(slot->sl_flags & NFSD4_SLOT_INITIALIZED))
2028                         goto out;
2029                 cstate->slot = slot;
2030                 cstate->session = session;
2031                 /* Return the cached reply status and set cstate->status
2032                  * for nfsd4_proc_compound processing */
2033                 status = nfsd4_replay_cache_entry(resp, seq);
2034                 cstate->status = nfserr_replay_cache;
2035                 goto out;
2036         }
2037         if (status)
2038                 goto out;
2039
2040         nfsd4_sequence_check_conn(conn, session);
2041         conn = NULL;
2042
2043         /* Success! bump slot seqid */
2044         slot->sl_seqid = seq->seqid;
2045         slot->sl_flags |= NFSD4_SLOT_INUSE;
2046         if (seq->cachethis)
2047                 slot->sl_flags |= NFSD4_SLOT_CACHETHIS;
2048         else
2049                 slot->sl_flags &= ~NFSD4_SLOT_CACHETHIS;
2050
2051         cstate->slot = slot;
2052         cstate->session = session;
2053
2054 out:
2055         /* Hold a session reference until done processing the compound. */
2056         if (cstate->session) {
2057                 struct nfs4_client *clp = session->se_client;
2058
2059                 nfsd4_get_session(cstate->session);
2060                 atomic_inc(&clp->cl_refcount);
2061                 switch (clp->cl_cb_state) {
2062                 case NFSD4_CB_DOWN:
2063                         seq->status_flags = SEQ4_STATUS_CB_PATH_DOWN;
2064                         break;
2065                 case NFSD4_CB_FAULT:
2066                         seq->status_flags = SEQ4_STATUS_BACKCHANNEL_FAULT;
2067                         break;
2068                 default:
2069                         seq->status_flags = 0;
2070                 }
2071         }
2072         kfree(conn);
2073         spin_unlock(&client_lock);
2074         dprintk("%s: return %d\n", __func__, ntohl(status));
2075         return status;
2076 }
2077
2078 __be32
2079 nfsd4_destroy_clientid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, struct nfsd4_destroy_clientid *dc)
2080 {
2081         struct nfs4_client *conf, *unconf, *clp;
2082         __be32 status = 0;
2083
2084         nfs4_lock_state();
2085         unconf = find_unconfirmed_client(&dc->clientid);
2086         conf = find_confirmed_client(&dc->clientid);
2087
2088         if (conf) {
2089                 clp = conf;
2090
2091                 if (!is_client_expired(conf) && client_has_state(conf)) {
2092                         status = nfserr_clientid_busy;
2093                         goto out;
2094                 }
2095
2096                 /* rfc5661 18.50.3 */
2097                 if (cstate->session && conf == cstate->session->se_client) {
2098                         status = nfserr_clientid_busy;
2099                         goto out;
2100                 }
2101         } else if (unconf)
2102                 clp = unconf;
2103         else {
2104                 status = nfserr_stale_clientid;
2105                 goto out;
2106         }
2107
2108         expire_client(clp);
2109 out:
2110         nfs4_unlock_state();
2111         dprintk("%s return %d\n", __func__, ntohl(status));
2112         return status;
2113 }
2114
2115 __be32
2116 nfsd4_reclaim_complete(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, struct nfsd4_reclaim_complete *rc)
2117 {
2118         __be32 status = 0;
2119
2120         if (rc->rca_one_fs) {
2121                 if (!cstate->current_fh.fh_dentry)
2122                         return nfserr_nofilehandle;
2123                 /*
2124                  * We don't take advantage of the rca_one_fs case.
2125                  * That's OK, it's optional, we can safely ignore it.
2126                  */
2127                  return nfs_ok;
2128         }
2129
2130         nfs4_lock_state();
2131         status = nfserr_complete_already;
2132         if (test_and_set_bit(NFSD4_CLIENT_RECLAIM_COMPLETE,
2133                              &cstate->session->se_client->cl_flags))
2134                 goto out;
2135
2136         status = nfserr_stale_clientid;
2137         if (is_client_expired(cstate->session->se_client))
2138                 /*
2139                  * The following error isn't really legal.
2140                  * But we only get here if the client just explicitly
2141                  * destroyed the client.  Surely it no longer cares what
2142                  * error it gets back on an operation for the dead
2143                  * client.
2144                  */
2145                 goto out;
2146
2147         status = nfs_ok;
2148         nfsd4_client_record_create(cstate->session->se_client);
2149 out:
2150         nfs4_unlock_state();
2151         return status;
2152 }
2153
2154 __be32
2155 nfsd4_setclientid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
2156                   struct nfsd4_setclientid *setclid)
2157 {
2158         struct xdr_netobj       clname = setclid->se_name;
2159         nfs4_verifier           clverifier = setclid->se_verf;
2160         unsigned int            strhashval;
2161         struct nfs4_client      *conf, *unconf, *new;
2162         __be32                  status;
2163         char                    dname[HEXDIR_LEN];
2164
2165         status = nfs4_make_rec_clidname(dname, &clname);
2166         if (status)
2167                 return status;
2168
2169         strhashval = clientstr_hashval(dname);
2170
2171         /* Cases below refer to rfc 3530 section 14.2.33: */
2172         nfs4_lock_state();
2173         conf = find_confirmed_client_by_str(dname, strhashval);
2174         if (conf) {
2175                 /* case 0: */
2176                 status = nfserr_clid_inuse;
2177                 if (clp_used_exchangeid(conf))
2178                         goto out;
2179                 if (!same_creds(&conf->cl_cred, &rqstp->rq_cred)) {
2180                         char addr_str[INET6_ADDRSTRLEN];
2181                         rpc_ntop((struct sockaddr *) &conf->cl_addr, addr_str,
2182                                  sizeof(addr_str));
2183                         dprintk("NFSD: setclientid: string in use by client "
2184                                 "at %s\n", addr_str);
2185                         goto out;
2186                 }
2187         }
2188         unconf = find_unconfirmed_client_by_str(dname, strhashval);
2189         if (unconf)
2190                 expire_client(unconf);
2191         status = nfserr_jukebox;
2192         new = create_client(clname, dname, rqstp, &clverifier);
2193         if (new == NULL)
2194                 goto out;
2195         if (conf && same_verf(&conf->cl_verifier, &clverifier))
2196                 /* case 1: probable callback update */
2197                 copy_clid(new, conf);
2198         else /* case 4 (new client) or cases 2, 3 (client reboot): */
2199                 gen_clid(new);
2200         /*
2201          * XXX: we should probably set this at creation time, and check
2202          * for consistent minorversion use throughout:
2203          */
2204         new->cl_minorversion = 0;
2205         gen_callback(new, setclid, rqstp);
2206         add_to_unconfirmed(new, strhashval);
2207         setclid->se_clientid.cl_boot = new->cl_clientid.cl_boot;
2208         setclid->se_clientid.cl_id = new->cl_clientid.cl_id;
2209         memcpy(setclid->se_confirm.data, new->cl_confirm.data, sizeof(setclid->se_confirm.data));
2210         status = nfs_ok;
2211 out:
2212         nfs4_unlock_state();
2213         return status;
2214 }
2215
2216
2217 __be32
2218 nfsd4_setclientid_confirm(struct svc_rqst *rqstp,
2219                          struct nfsd4_compound_state *cstate,
2220                          struct nfsd4_setclientid_confirm *setclientid_confirm)
2221 {
2222         struct nfs4_client *conf, *unconf;
2223         nfs4_verifier confirm = setclientid_confirm->sc_confirm;
2224         clientid_t * clid = &setclientid_confirm->sc_clientid;
2225         __be32 status;
2226
2227         if (STALE_CLIENTID(clid))
2228                 return nfserr_stale_clientid;
2229         nfs4_lock_state();
2230
2231         conf = find_confirmed_client(clid);
2232         unconf = find_unconfirmed_client(clid);
2233         /*
2234          * We try hard to give out unique clientid's, so if we get an
2235          * attempt to confirm the same clientid with a different cred,
2236          * there's a bug somewhere.  Let's charitably assume it's our
2237          * bug.
2238          */
2239         status = nfserr_serverfault;
2240         if (unconf && !same_creds(&unconf->cl_cred, &rqstp->rq_cred))
2241                 goto out;
2242         if (conf && !same_creds(&conf->cl_cred, &rqstp->rq_cred))
2243                 goto out;
2244         /* cases below refer to rfc 3530 section 14.2.34: */
2245         if (!unconf || !same_verf(&confirm, &unconf->cl_confirm)) {
2246                 if (conf && !unconf) /* case 2: probable retransmit */
2247                         status = nfs_ok;
2248                 else /* case 4: client hasn't noticed we rebooted yet? */
2249                         status = nfserr_stale_clientid;
2250                 goto out;
2251         }
2252         status = nfs_ok;
2253         if (conf) { /* case 1: callback update */
2254                 nfsd4_change_callback(conf, &unconf->cl_cb_conn);
2255                 nfsd4_probe_callback(conf);
2256                 expire_client(unconf);
2257         } else { /* case 3: normal case; new or rebooted client */
2258                 unsigned int hash = clientstr_hashval(unconf->cl_recdir);
2259
2260                 conf = find_confirmed_client_by_str(unconf->cl_recdir, hash);
2261                 if (conf) {
2262                         nfsd4_client_record_remove(conf);
2263                         expire_client(conf);
2264                 }
2265                 move_to_confirmed(unconf);
2266                 nfsd4_probe_callback(unconf);
2267         }
2268 out:
2269         nfs4_unlock_state();
2270         return status;
2271 }
2272
2273 static struct nfs4_file *nfsd4_alloc_file(void)
2274 {
2275         return kmem_cache_alloc(file_slab, GFP_KERNEL);
2276 }
2277
2278 /* OPEN Share state helper functions */
2279 static void nfsd4_init_file(struct nfs4_file *fp, struct inode *ino)
2280 {
2281         unsigned int hashval = file_hashval(ino);
2282
2283         atomic_set(&fp->fi_ref, 1);
2284         INIT_LIST_HEAD(&fp->fi_hash);
2285         INIT_LIST_HEAD(&fp->fi_stateids);
2286         INIT_LIST_HEAD(&fp->fi_delegations);
2287         fp->fi_inode = igrab(ino);
2288         fp->fi_had_conflict = false;
2289         fp->fi_lease = NULL;
2290         memset(fp->fi_fds, 0, sizeof(fp->fi_fds));
2291         memset(fp->fi_access, 0, sizeof(fp->fi_access));
2292         spin_lock(&recall_lock);
2293         list_add(&fp->fi_hash, &file_hashtbl[hashval]);
2294         spin_unlock(&recall_lock);
2295 }
2296
2297 static void
2298 nfsd4_free_slab(struct kmem_cache **slab)
2299 {
2300         if (*slab == NULL)
2301                 return;
2302         kmem_cache_destroy(*slab);
2303         *slab = NULL;
2304 }
2305
2306 void
2307 nfsd4_free_slabs(void)
2308 {
2309         nfsd4_free_slab(&openowner_slab);
2310         nfsd4_free_slab(&lockowner_slab);
2311         nfsd4_free_slab(&file_slab);
2312         nfsd4_free_slab(&stateid_slab);
2313         nfsd4_free_slab(&deleg_slab);
2314 }
2315
2316 int
2317 nfsd4_init_slabs(void)
2318 {
2319         openowner_slab = kmem_cache_create("nfsd4_openowners",
2320                         sizeof(struct nfs4_openowner), 0, 0, NULL);
2321         if (openowner_slab == NULL)
2322                 goto out_nomem;
2323         lockowner_slab = kmem_cache_create("nfsd4_lockowners",
2324                         sizeof(struct nfs4_openowner), 0, 0, NULL);
2325         if (lockowner_slab == NULL)
2326                 goto out_nomem;
2327         file_slab = kmem_cache_create("nfsd4_files",
2328                         sizeof(struct nfs4_file), 0, 0, NULL);
2329         if (file_slab == NULL)
2330                 goto out_nomem;
2331         stateid_slab = kmem_cache_create("nfsd4_stateids",
2332                         sizeof(struct nfs4_ol_stateid), 0, 0, NULL);
2333         if (stateid_slab == NULL)
2334                 goto out_nomem;
2335         deleg_slab = kmem_cache_create("nfsd4_delegations",
2336                         sizeof(struct nfs4_delegation), 0, 0, NULL);
2337         if (deleg_slab == NULL)
2338                 goto out_nomem;
2339         return 0;
2340 out_nomem:
2341         nfsd4_free_slabs();
2342         dprintk("nfsd4: out of memory while initializing nfsv4\n");
2343         return -ENOMEM;
2344 }
2345
2346 void nfs4_free_openowner(struct nfs4_openowner *oo)
2347 {
2348         kfree(oo->oo_owner.so_owner.data);
2349         kmem_cache_free(openowner_slab, oo);
2350 }
2351
2352 void nfs4_free_lockowner(struct nfs4_lockowner *lo)
2353 {
2354         kfree(lo->lo_owner.so_owner.data);
2355         kmem_cache_free(lockowner_slab, lo);
2356 }
2357
2358 static void init_nfs4_replay(struct nfs4_replay *rp)
2359 {
2360         rp->rp_status = nfserr_serverfault;
2361         rp->rp_buflen = 0;
2362         rp->rp_buf = rp->rp_ibuf;
2363 }
2364
2365 static inline void *alloc_stateowner(struct kmem_cache *slab, struct xdr_netobj *owner, struct nfs4_client *clp)
2366 {
2367         struct nfs4_stateowner *sop;
2368
2369         sop = kmem_cache_alloc(slab, GFP_KERNEL);
2370         if (!sop)
2371                 return NULL;
2372
2373         sop->so_owner.data = kmemdup(owner->data, owner->len, GFP_KERNEL);
2374         if (!sop->so_owner.data) {
2375                 kmem_cache_free(slab, sop);
2376                 return NULL;
2377         }
2378         sop->so_owner.len = owner->len;
2379
2380         INIT_LIST_HEAD(&sop->so_stateids);
2381         sop->so_client = clp;
2382         init_nfs4_replay(&sop->so_replay);
2383         return sop;
2384 }
2385
2386 static void hash_openowner(struct nfs4_openowner *oo, struct nfs4_client *clp, unsigned int strhashval)
2387 {
2388         list_add(&oo->oo_owner.so_strhash, &ownerstr_hashtbl[strhashval]);
2389         list_add(&oo->oo_perclient, &clp->cl_openowners);
2390 }
2391
2392 static struct nfs4_openowner *
2393 alloc_init_open_stateowner(unsigned int strhashval, struct nfs4_client *clp, struct nfsd4_open *open) {
2394         struct nfs4_openowner *oo;
2395
2396         oo = alloc_stateowner(openowner_slab, &open->op_owner, clp);
2397         if (!oo)
2398                 return NULL;
2399         oo->oo_owner.so_is_open_owner = 1;
2400         oo->oo_owner.so_seqid = open->op_seqid;
2401         oo->oo_flags = NFS4_OO_NEW;
2402         oo->oo_time = 0;
2403         oo->oo_last_closed_stid = NULL;
2404         INIT_LIST_HEAD(&oo->oo_close_lru);
2405         hash_openowner(oo, clp, strhashval);
2406         return oo;
2407 }
2408
2409 static void init_open_stateid(struct nfs4_ol_stateid *stp, struct nfs4_file *fp, struct nfsd4_open *open) {
2410         struct nfs4_openowner *oo = open->op_openowner;
2411         struct nfs4_client *clp = oo->oo_owner.so_client;
2412
2413         init_stid(&stp->st_stid, clp, NFS4_OPEN_STID);
2414         INIT_LIST_HEAD(&stp->st_lockowners);
2415         list_add(&stp->st_perstateowner, &oo->oo_owner.so_stateids);
2416         list_add(&stp->st_perfile, &fp->fi_stateids);
2417         stp->st_stateowner = &oo->oo_owner;
2418         get_nfs4_file(fp);
2419         stp->st_file = fp;
2420         stp->st_access_bmap = 0;
2421         stp->st_deny_bmap = 0;
2422         set_access(open->op_share_access, stp);
2423         set_deny(open->op_share_deny, stp);
2424         stp->st_openstp = NULL;
2425 }
2426
2427 static void
2428 move_to_close_lru(struct nfs4_openowner *oo)
2429 {
2430         dprintk("NFSD: move_to_close_lru nfs4_openowner %p\n", oo);
2431
2432         list_move_tail(&oo->oo_close_lru, &close_lru);
2433         oo->oo_time = get_seconds();
2434 }
2435
2436 static int
2437 same_owner_str(struct nfs4_stateowner *sop, struct xdr_netobj *owner,
2438                                                         clientid_t *clid)
2439 {
2440         return (sop->so_owner.len == owner->len) &&
2441                 0 == memcmp(sop->so_owner.data, owner->data, owner->len) &&
2442                 (sop->so_client->cl_clientid.cl_id == clid->cl_id);
2443 }
2444
2445 static struct nfs4_openowner *
2446 find_openstateowner_str(unsigned int hashval, struct nfsd4_open *open)
2447 {
2448         struct nfs4_stateowner *so;
2449         struct nfs4_openowner *oo;
2450
2451         list_for_each_entry(so, &ownerstr_hashtbl[hashval], so_strhash) {
2452                 if (!so->so_is_open_owner)
2453                         continue;
2454                 if (same_owner_str(so, &open->op_owner, &open->op_clientid)) {
2455                         oo = openowner(so);
2456                         renew_client(oo->oo_owner.so_client);
2457                         return oo;
2458                 }
2459         }
2460         return NULL;
2461 }
2462
2463 /* search file_hashtbl[] for file */
2464 static struct nfs4_file *
2465 find_file(struct inode *ino)
2466 {
2467         unsigned int hashval = file_hashval(ino);
2468         struct nfs4_file *fp;
2469
2470         spin_lock(&recall_lock);
2471         list_for_each_entry(fp, &file_hashtbl[hashval], fi_hash) {
2472                 if (fp->fi_inode == ino) {
2473                         get_nfs4_file(fp);
2474                         spin_unlock(&recall_lock);
2475                         return fp;
2476                 }
2477         }
2478         spin_unlock(&recall_lock);
2479         return NULL;
2480 }
2481
2482 /*
2483  * Called to check deny when READ with all zero stateid or
2484  * WRITE with all zero or all one stateid
2485  */
2486 static __be32
2487 nfs4_share_conflict(struct svc_fh *current_fh, unsigned int deny_type)
2488 {
2489         struct inode *ino = current_fh->fh_dentry->d_inode;
2490         struct nfs4_file *fp;
2491         struct nfs4_ol_stateid *stp;
2492         __be32 ret;
2493
2494         dprintk("NFSD: nfs4_share_conflict\n");
2495
2496         fp = find_file(ino);
2497         if (!fp)
2498                 return nfs_ok;
2499         ret = nfserr_locked;
2500         /* Search for conflicting share reservations */
2501         list_for_each_entry(stp, &fp->fi_stateids, st_perfile) {
2502                 if (test_deny(deny_type, stp) ||
2503                     test_deny(NFS4_SHARE_DENY_BOTH, stp))
2504                         goto out;
2505         }
2506         ret = nfs_ok;
2507 out:
2508         put_nfs4_file(fp);
2509         return ret;
2510 }
2511
2512 static void nfsd_break_one_deleg(struct nfs4_delegation *dp)
2513 {
2514         /* We're assuming the state code never drops its reference
2515          * without first removing the lease.  Since we're in this lease
2516          * callback (and since the lease code is serialized by the kernel
2517          * lock) we know the server hasn't removed the lease yet, we know
2518          * it's safe to take a reference: */
2519         atomic_inc(&dp->dl_count);
2520
2521         list_add_tail(&dp->dl_recall_lru, &del_recall_lru);
2522
2523         /* only place dl_time is set. protected by lock_flocks*/
2524         dp->dl_time = get_seconds();
2525
2526         nfsd4_cb_recall(dp);
2527 }
2528
2529 /* Called from break_lease() with lock_flocks() held. */
2530 static void nfsd_break_deleg_cb(struct file_lock *fl)
2531 {
2532         struct nfs4_file *fp = (struct nfs4_file *)fl->fl_owner;
2533         struct nfs4_delegation *dp;
2534
2535         BUG_ON(!fp);
2536         /* We assume break_lease is only called once per lease: */
2537         BUG_ON(fp->fi_had_conflict);
2538         /*
2539          * We don't want the locks code to timeout the lease for us;
2540          * we'll remove it ourself if a delegation isn't returned
2541          * in time:
2542          */
2543         fl->fl_break_time = 0;
2544
2545         spin_lock(&recall_lock);
2546         fp->fi_had_conflict = true;
2547         list_for_each_entry(dp, &fp->fi_delegations, dl_perfile)
2548                 nfsd_break_one_deleg(dp);
2549         spin_unlock(&recall_lock);
2550 }
2551
2552 static
2553 int nfsd_change_deleg_cb(struct file_lock **onlist, int arg)
2554 {
2555         if (arg & F_UNLCK)
2556                 return lease_modify(onlist, arg);
2557         else
2558                 return -EAGAIN;
2559 }
2560
2561 static const struct lock_manager_operations nfsd_lease_mng_ops = {
2562         .lm_break = nfsd_break_deleg_cb,
2563         .lm_change = nfsd_change_deleg_cb,
2564 };
2565
2566 static __be32 nfsd4_check_seqid(struct nfsd4_compound_state *cstate, struct nfs4_stateowner *so, u32 seqid)
2567 {
2568         if (nfsd4_has_session(cstate))
2569                 return nfs_ok;
2570         if (seqid == so->so_seqid - 1)
2571                 return nfserr_replay_me;
2572         if (seqid == so->so_seqid)
2573                 return nfs_ok;
2574         return nfserr_bad_seqid;
2575 }
2576
2577 __be32
2578 nfsd4_process_open1(struct nfsd4_compound_state *cstate,
2579                     struct nfsd4_open *open)
2580 {
2581         clientid_t *clientid = &open->op_clientid;
2582         struct nfs4_client *clp = NULL;
2583         unsigned int strhashval;
2584         struct nfs4_openowner *oo = NULL;
2585         __be32 status;
2586
2587         if (STALE_CLIENTID(&open->op_clientid))
2588                 return nfserr_stale_clientid;
2589         /*
2590          * In case we need it later, after we've already created the
2591          * file and don't want to risk a further failure:
2592          */
2593         open->op_file = nfsd4_alloc_file();
2594         if (open->op_file == NULL)
2595                 return nfserr_jukebox;
2596
2597         strhashval = ownerstr_hashval(clientid->cl_id, &open->op_owner);
2598         oo = find_openstateowner_str(strhashval, open);
2599         open->op_openowner = oo;
2600         if (!oo) {
2601                 clp = find_confirmed_client(clientid);
2602                 if (clp == NULL)
2603                         return nfserr_expired;
2604                 goto new_owner;
2605         }
2606         if (!(oo->oo_flags & NFS4_OO_CONFIRMED)) {
2607                 /* Replace unconfirmed owners without checking for replay. */
2608                 clp = oo->oo_owner.so_client;
2609                 release_openowner(oo);
2610                 open->op_openowner = NULL;
2611                 goto new_owner;
2612         }
2613         status = nfsd4_check_seqid(cstate, &oo->oo_owner, open->op_seqid);
2614         if (status)
2615                 return status;
2616         clp = oo->oo_owner.so_client;
2617         goto alloc_stateid;
2618 new_owner:
2619         oo = alloc_init_open_stateowner(strhashval, clp, open);
2620         if (oo == NULL)
2621                 return nfserr_jukebox;
2622         open->op_openowner = oo;
2623 alloc_stateid:
2624         open->op_stp = nfs4_alloc_stateid(clp);
2625         if (!open->op_stp)
2626                 return nfserr_jukebox;
2627         return nfs_ok;
2628 }
2629
2630 static inline __be32
2631 nfs4_check_delegmode(struct nfs4_delegation *dp, int flags)
2632 {
2633         if ((flags & WR_STATE) && (dp->dl_type == NFS4_OPEN_DELEGATE_READ))
2634                 return nfserr_openmode;
2635         else
2636                 return nfs_ok;
2637 }
2638
2639 static int share_access_to_flags(u32 share_access)
2640 {
2641         return share_access == NFS4_SHARE_ACCESS_READ ? RD_STATE : WR_STATE;
2642 }
2643
2644 static struct nfs4_delegation *find_deleg_stateid(struct nfs4_client *cl, stateid_t *s)
2645 {
2646         struct nfs4_stid *ret;
2647
2648         ret = find_stateid_by_type(cl, s, NFS4_DELEG_STID);
2649         if (!ret)
2650                 return NULL;
2651         return delegstateid(ret);
2652 }
2653
2654 static bool nfsd4_is_deleg_cur(struct nfsd4_open *open)
2655 {
2656         return open->op_claim_type == NFS4_OPEN_CLAIM_DELEGATE_CUR ||
2657                open->op_claim_type == NFS4_OPEN_CLAIM_DELEG_CUR_FH;
2658 }
2659
2660 static __be32
2661 nfs4_check_deleg(struct nfs4_client *cl, struct nfs4_file *fp, struct nfsd4_open *open,
2662                 struct nfs4_delegation **dp)
2663 {
2664         int flags;
2665         __be32 status = nfserr_bad_stateid;
2666
2667         *dp = find_deleg_stateid(cl, &open->op_delegate_stateid);
2668         if (*dp == NULL)
2669                 goto out;
2670         flags = share_access_to_flags(open->op_share_access);
2671         status = nfs4_check_delegmode(*dp, flags);
2672         if (status)
2673                 *dp = NULL;
2674 out:
2675         if (!nfsd4_is_deleg_cur(open))
2676                 return nfs_ok;
2677         if (status)
2678                 return status;
2679         open->op_openowner->oo_flags |= NFS4_OO_CONFIRMED;
2680         return nfs_ok;
2681 }
2682
2683 static __be32
2684 nfs4_check_open(struct nfs4_file *fp, struct nfsd4_open *open, struct nfs4_ol_stateid **stpp)
2685 {
2686         struct nfs4_ol_stateid *local;
2687         struct nfs4_openowner *oo = open->op_openowner;
2688
2689         list_for_each_entry(local, &fp->fi_stateids, st_perfile) {
2690                 /* ignore lock owners */
2691                 if (local->st_stateowner->so_is_open_owner == 0)
2692                         continue;
2693                 /* remember if we have seen this open owner */
2694                 if (local->st_stateowner == &oo->oo_owner)
2695                         *stpp = local;
2696                 /* check for conflicting share reservations */
2697                 if (!test_share(local, open))
2698                         return nfserr_share_denied;
2699         }
2700         return nfs_ok;
2701 }
2702
2703 static void nfs4_free_stateid(struct nfs4_ol_stateid *s)
2704 {
2705         kmem_cache_free(stateid_slab, s);
2706 }
2707
2708 static inline int nfs4_access_to_access(u32 nfs4_access)
2709 {
2710         int flags = 0;
2711
2712         if (nfs4_access & NFS4_SHARE_ACCESS_READ)
2713                 flags |= NFSD_MAY_READ;
2714         if (nfs4_access & NFS4_SHARE_ACCESS_WRITE)
2715                 flags |= NFSD_MAY_WRITE;
2716         return flags;
2717 }
2718
2719 static __be32 nfs4_get_vfs_file(struct svc_rqst *rqstp, struct nfs4_file *fp,
2720                 struct svc_fh *cur_fh, struct nfsd4_open *open)
2721 {
2722         __be32 status;
2723         int oflag = nfs4_access_to_omode(open->op_share_access);
2724         int access = nfs4_access_to_access(open->op_share_access);
2725
2726         if (!fp->fi_fds[oflag]) {
2727                 status = nfsd_open(rqstp, cur_fh, S_IFREG, access,
2728                         &fp->fi_fds[oflag]);
2729                 if (status)
2730                         return status;
2731         }
2732         nfs4_file_get_access(fp, oflag);
2733
2734         return nfs_ok;
2735 }
2736
2737 static inline __be32
2738 nfsd4_truncate(struct svc_rqst *rqstp, struct svc_fh *fh,
2739                 struct nfsd4_open *open)
2740 {
2741         struct iattr iattr = {
2742                 .ia_valid = ATTR_SIZE,
2743                 .ia_size = 0,
2744         };
2745         if (!open->op_truncate)
2746                 return 0;
2747         if (!(open->op_share_access & NFS4_SHARE_ACCESS_WRITE))
2748                 return nfserr_inval;
2749         return nfsd_setattr(rqstp, fh, &iattr, 0, (time_t)0);
2750 }
2751
2752 static __be32
2753 nfs4_upgrade_open(struct svc_rqst *rqstp, struct nfs4_file *fp, struct svc_fh *cur_fh, struct nfs4_ol_stateid *stp, struct nfsd4_open *open)
2754 {
2755         u32 op_share_access = open->op_share_access;
2756         bool new_access;
2757         __be32 status;
2758
2759         new_access = !test_access(op_share_access, stp);
2760         if (new_access) {
2761                 status = nfs4_get_vfs_file(rqstp, fp, cur_fh, open);
2762                 if (status)
2763                         return status;
2764         }
2765         status = nfsd4_truncate(rqstp, cur_fh, open);
2766         if (status) {
2767                 if (new_access) {
2768                         int oflag = nfs4_access_to_omode(op_share_access);
2769                         nfs4_file_put_access(fp, oflag);
2770                 }
2771                 return status;
2772         }
2773         /* remember the open */
2774         set_access(op_share_access, stp);
2775         set_deny(open->op_share_deny, stp);
2776
2777         return nfs_ok;
2778 }
2779
2780
2781 static void
2782 nfs4_set_claim_prev(struct nfsd4_open *open, bool has_session)
2783 {
2784         open->op_openowner->oo_flags |= NFS4_OO_CONFIRMED;
2785 }
2786
2787 /* Should we give out recallable state?: */
2788 static bool nfsd4_cb_channel_good(struct nfs4_client *clp)
2789 {
2790         if (clp->cl_cb_state == NFSD4_CB_UP)
2791                 return true;
2792         /*
2793          * In the sessions case, since we don't have to establish a
2794          * separate connection for callbacks, we assume it's OK
2795          * until we hear otherwise:
2796          */
2797         return clp->cl_minorversion && clp->cl_cb_state == NFSD4_CB_UNKNOWN;
2798 }
2799
2800 static struct file_lock *nfs4_alloc_init_lease(struct nfs4_delegation *dp, int flag)
2801 {
2802         struct file_lock *fl;
2803
2804         fl = locks_alloc_lock();
2805         if (!fl)
2806                 return NULL;
2807         locks_init_lock(fl);
2808         fl->fl_lmops = &nfsd_lease_mng_ops;
2809         fl->fl_flags = FL_LEASE;
2810         fl->fl_type = flag == NFS4_OPEN_DELEGATE_READ? F_RDLCK: F_WRLCK;
2811         fl->fl_end = OFFSET_MAX;
2812         fl->fl_owner = (fl_owner_t)(dp->dl_file);
2813         fl->fl_pid = current->tgid;
2814         return fl;
2815 }
2816
2817 static int nfs4_setlease(struct nfs4_delegation *dp, int flag)
2818 {
2819         struct nfs4_file *fp = dp->dl_file;
2820         struct file_lock *fl;
2821         int status;
2822
2823         fl = nfs4_alloc_init_lease(dp, flag);
2824         if (!fl)
2825                 return -ENOMEM;
2826         fl->fl_file = find_readable_file(fp);
2827         list_add(&dp->dl_perclnt, &dp->dl_stid.sc_client->cl_delegations);
2828         status = vfs_setlease(fl->fl_file, fl->fl_type, &fl);
2829         if (status) {
2830                 list_del_init(&dp->dl_perclnt);
2831                 locks_free_lock(fl);
2832                 return -ENOMEM;
2833         }
2834         fp->fi_lease = fl;
2835         fp->fi_deleg_file = fl->fl_file;
2836         get_file(fp->fi_deleg_file);
2837         atomic_set(&fp->fi_delegees, 1);
2838         list_add(&dp->dl_perfile, &fp->fi_delegations);
2839         return 0;
2840 }
2841
2842 static int nfs4_set_delegation(struct nfs4_delegation *dp, int flag)
2843 {
2844         struct nfs4_file *fp = dp->dl_file;
2845
2846         if (!fp->fi_lease)
2847                 return nfs4_setlease(dp, flag);
2848         spin_lock(&recall_lock);
2849         if (fp->fi_had_conflict) {
2850                 spin_unlock(&recall_lock);
2851                 return -EAGAIN;
2852         }
2853         atomic_inc(&fp->fi_delegees);
2854         list_add(&dp->dl_perfile, &fp->fi_delegations);
2855         spin_unlock(&recall_lock);
2856         list_add(&dp->dl_perclnt, &dp->dl_stid.sc_client->cl_delegations);
2857         return 0;
2858 }
2859
2860 static void nfsd4_open_deleg_none_ext(struct nfsd4_open *open, int status)
2861 {
2862         open->op_delegate_type = NFS4_OPEN_DELEGATE_NONE_EXT;
2863         if (status == -EAGAIN)
2864                 open->op_why_no_deleg = WND4_CONTENTION;
2865         else {
2866                 open->op_why_no_deleg = WND4_RESOURCE;
2867                 switch (open->op_deleg_want) {
2868                 case NFS4_SHARE_WANT_READ_DELEG:
2869                 case NFS4_SHARE_WANT_WRITE_DELEG:
2870                 case NFS4_SHARE_WANT_ANY_DELEG:
2871                         break;
2872                 case NFS4_SHARE_WANT_CANCEL:
2873                         open->op_why_no_deleg = WND4_CANCELLED;
2874                         break;
2875                 case NFS4_SHARE_WANT_NO_DELEG:
2876                         BUG();  /* not supposed to get here */
2877                 }
2878         }
2879 }
2880
2881 /*
2882  * Attempt to hand out a delegation.
2883  */
2884 static void
2885 nfs4_open_delegation(struct svc_fh *fh, struct nfsd4_open *open, struct nfs4_ol_stateid *stp)
2886 {
2887         struct nfs4_delegation *dp;
2888         struct nfs4_openowner *oo = container_of(stp->st_stateowner, struct nfs4_openowner, oo_owner);
2889         int cb_up;
2890         int status = 0, flag = 0;
2891
2892         cb_up = nfsd4_cb_channel_good(oo->oo_owner.so_client);
2893         flag = NFS4_OPEN_DELEGATE_NONE;
2894         open->op_recall = 0;
2895         switch (open->op_claim_type) {
2896                 case NFS4_OPEN_CLAIM_PREVIOUS:
2897                         if (!cb_up)
2898                                 open->op_recall = 1;
2899                         flag = open->op_delegate_type;
2900                         if (flag == NFS4_OPEN_DELEGATE_NONE)
2901                                 goto out;
2902                         break;
2903                 case NFS4_OPEN_CLAIM_NULL:
2904                         /* Let's not give out any delegations till everyone's
2905                          * had the chance to reclaim theirs.... */
2906                         if (locks_in_grace())
2907                                 goto out;
2908                         if (!cb_up || !(oo->oo_flags & NFS4_OO_CONFIRMED))
2909                                 goto out;
2910                         if (open->op_share_access & NFS4_SHARE_ACCESS_WRITE)
2911                                 flag = NFS4_OPEN_DELEGATE_WRITE;
2912                         else
2913                                 flag = NFS4_OPEN_DELEGATE_READ;
2914                         break;
2915                 default:
2916                         goto out;
2917         }
2918
2919         dp = alloc_init_deleg(oo->oo_owner.so_client, stp, fh, flag);
2920         if (dp == NULL)
2921                 goto out_no_deleg;
2922         status = nfs4_set_delegation(dp, flag);
2923         if (status)
2924                 goto out_free;
2925
2926         memcpy(&open->op_delegate_stateid, &dp->dl_stid.sc_stateid, sizeof(dp->dl_stid.sc_stateid));
2927
2928         dprintk("NFSD: delegation stateid=" STATEID_FMT "\n",
2929                 STATEID_VAL(&dp->dl_stid.sc_stateid));
2930 out:
2931         open->op_delegate_type = flag;
2932         if (flag == NFS4_OPEN_DELEGATE_NONE) {
2933                 if (open->op_claim_type == NFS4_OPEN_CLAIM_PREVIOUS &&
2934                     open->op_delegate_type != NFS4_OPEN_DELEGATE_NONE)
2935                         dprintk("NFSD: WARNING: refusing delegation reclaim\n");
2936
2937                 /* 4.1 client asking for a delegation? */
2938                 if (open->op_deleg_want)
2939                         nfsd4_open_deleg_none_ext(open, status);
2940         }
2941         return;
2942 out_free:
2943         nfs4_put_delegation(dp);
2944 out_no_deleg:
2945         flag = NFS4_OPEN_DELEGATE_NONE;
2946         goto out;
2947 }
2948
2949 static void nfsd4_deleg_xgrade_none_ext(struct nfsd4_open *open,
2950                                         struct nfs4_delegation *dp)
2951 {
2952         if (open->op_deleg_want == NFS4_SHARE_WANT_READ_DELEG &&
2953             dp->dl_type == NFS4_OPEN_DELEGATE_WRITE) {
2954                 open->op_delegate_type = NFS4_OPEN_DELEGATE_NONE_EXT;
2955                 open->op_why_no_deleg = WND4_NOT_SUPP_DOWNGRADE;
2956         } else if (open->op_deleg_want == NFS4_SHARE_WANT_WRITE_DELEG &&
2957                    dp->dl_type == NFS4_OPEN_DELEGATE_WRITE) {
2958                 open->op_delegate_type = NFS4_OPEN_DELEGATE_NONE_EXT;
2959                 open->op_why_no_deleg = WND4_NOT_SUPP_UPGRADE;
2960         }
2961         /* Otherwise the client must be confused wanting a delegation
2962          * it already has, therefore we don't return
2963          * NFS4_OPEN_DELEGATE_NONE_EXT and reason.
2964          */
2965 }
2966
2967 /*
2968  * called with nfs4_lock_state() held.
2969  */
2970 __be32
2971 nfsd4_process_open2(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_open *open)
2972 {
2973         struct nfsd4_compoundres *resp = rqstp->rq_resp;
2974         struct nfs4_client *cl = open->op_openowner->oo_owner.so_client;
2975         struct nfs4_file *fp = NULL;
2976         struct inode *ino = current_fh->fh_dentry->d_inode;
2977         struct nfs4_ol_stateid *stp = NULL;
2978         struct nfs4_delegation *dp = NULL;
2979         __be32 status;
2980
2981         /*
2982          * Lookup file; if found, lookup stateid and check open request,
2983          * and check for delegations in the process of being recalled.
2984          * If not found, create the nfs4_file struct
2985          */
2986         fp = find_file(ino);
2987         if (fp) {
2988                 if ((status = nfs4_check_open(fp, open, &stp)))
2989                         goto out;
2990                 status = nfs4_check_deleg(cl, fp, open, &dp);
2991                 if (status)
2992                         goto out;
2993         } else {
2994                 status = nfserr_bad_stateid;
2995                 if (nfsd4_is_deleg_cur(open))
2996                         goto out;
2997                 status = nfserr_jukebox;
2998                 fp = open->op_file;
2999                 open->op_file = NULL;
3000                 nfsd4_init_file(fp, ino);
3001         }
3002
3003         /*
3004          * OPEN the file, or upgrade an existing OPEN.
3005          * If truncate fails, the OPEN fails.
3006          */
3007         if (stp) {
3008                 /* Stateid was found, this is an OPEN upgrade */
3009                 status = nfs4_upgrade_open(rqstp, fp, current_fh, stp, open);
3010                 if (status)
3011                         goto out;
3012         } else {
3013                 status = nfs4_get_vfs_file(rqstp, fp, current_fh, open);
3014                 if (status)
3015                         goto out;
3016                 status = nfsd4_truncate(rqstp, current_fh, open);
3017                 if (status)
3018                         goto out;
3019                 stp = open->op_stp;
3020                 open->op_stp = NULL;
3021                 init_open_stateid(stp, fp, open);
3022         }
3023         update_stateid(&stp->st_stid.sc_stateid);
3024         memcpy(&open->op_stateid, &stp->st_stid.sc_stateid, sizeof(stateid_t));
3025
3026         if (nfsd4_has_session(&resp->cstate)) {
3027                 open->op_openowner->oo_flags |= NFS4_OO_CONFIRMED;
3028
3029                 if (open->op_deleg_want & NFS4_SHARE_WANT_NO_DELEG) {
3030                         open->op_delegate_type = NFS4_OPEN_DELEGATE_NONE_EXT;
3031                         open->op_why_no_deleg = WND4_NOT_WANTED;
3032                         goto nodeleg;
3033                 }
3034         }
3035
3036         /*
3037         * Attempt to hand out a delegation. No error return, because the
3038         * OPEN succeeds even if we fail.
3039         */
3040         nfs4_open_delegation(current_fh, open, stp);
3041 nodeleg:
3042         status = nfs_ok;
3043
3044         dprintk("%s: stateid=" STATEID_FMT "\n", __func__,
3045                 STATEID_VAL(&stp->st_stid.sc_stateid));
3046 out:
3047         /* 4.1 client trying to upgrade/downgrade delegation? */
3048         if (open->op_delegate_type == NFS4_OPEN_DELEGATE_NONE && dp &&
3049             open->op_deleg_want)
3050                 nfsd4_deleg_xgrade_none_ext(open, dp);
3051
3052         if (fp)
3053                 put_nfs4_file(fp);
3054         if (status == 0 && open->op_claim_type == NFS4_OPEN_CLAIM_PREVIOUS)
3055                 nfs4_set_claim_prev(open, nfsd4_has_session(&resp->cstate));
3056         /*
3057         * To finish the open response, we just need to set the rflags.
3058         */
3059         open->op_rflags = NFS4_OPEN_RESULT_LOCKTYPE_POSIX;
3060         if (!(open->op_openowner->oo_flags & NFS4_OO_CONFIRMED) &&
3061             !nfsd4_has_session(&resp->cstate))
3062                 open->op_rflags |= NFS4_OPEN_RESULT_CONFIRM;
3063
3064         return status;
3065 }
3066
3067 void nfsd4_cleanup_open_state(struct nfsd4_open *open, __be32 status)
3068 {
3069         if (open->op_openowner) {
3070                 struct nfs4_openowner *oo = open->op_openowner;
3071
3072                 if (!list_empty(&oo->oo_owner.so_stateids))
3073                         list_del_init(&oo->oo_close_lru);
3074                 if (oo->oo_flags & NFS4_OO_NEW) {
3075                         if (status) {
3076                                 release_openowner(oo);
3077                                 open->op_openowner = NULL;
3078                         } else
3079                                 oo->oo_flags &= ~NFS4_OO_NEW;
3080                 }
3081         }
3082         if (open->op_file)
3083                 nfsd4_free_file(open->op_file);
3084         if (open->op_stp)
3085                 nfs4_free_stateid(open->op_stp);
3086 }
3087
3088 __be32
3089 nfsd4_renew(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
3090             clientid_t *clid)
3091 {
3092         struct nfs4_client *clp;
3093         __be32 status;
3094
3095         nfs4_lock_state();
3096         dprintk("process_renew(%08x/%08x): starting\n",
3097                         clid->cl_boot, clid->cl_id);
3098         status = nfserr_stale_clientid;
3099         if (STALE_CLIENTID(clid))
3100                 goto out;
3101         clp = find_confirmed_client(clid);
3102         status = nfserr_expired;
3103         if (clp == NULL) {
3104                 /* We assume the client took too long to RENEW. */
3105                 dprintk("nfsd4_renew: clientid not found!\n");
3106                 goto out;
3107         }
3108         status = nfserr_cb_path_down;
3109         if (!list_empty(&clp->cl_delegations)
3110                         && clp->cl_cb_state != NFSD4_CB_UP)
3111                 goto out;
3112         status = nfs_ok;
3113 out:
3114         nfs4_unlock_state();
3115         return status;
3116 }
3117
3118 static struct lock_manager nfsd4_manager = {
3119 };
3120
3121 static bool grace_ended;
3122
3123 static void
3124 nfsd4_end_grace(void)
3125 {
3126         /* do nothing if grace period already ended */
3127         if (grace_ended)
3128                 return;
3129
3130         dprintk("NFSD: end of grace period\n");
3131         grace_ended = true;
3132         nfsd4_record_grace_done(&init_net, boot_time);
3133         locks_end_grace(&nfsd4_manager);
3134         /*
3135          * Now that every NFSv4 client has had the chance to recover and
3136          * to see the (possibly new, possibly shorter) lease time, we
3137          * can safely set the next grace time to the current lease time:
3138          */
3139         nfsd4_grace = nfsd4_lease;
3140 }
3141
3142 static time_t
3143 nfs4_laundromat(void)
3144 {
3145         struct nfs4_client *clp;
3146         struct nfs4_openowner *oo;
3147         struct nfs4_delegation *dp;
3148         struct list_head *pos, *next, reaplist;
3149         time_t cutoff = get_seconds() - nfsd4_lease;
3150         time_t t, clientid_val = nfsd4_lease;
3151         time_t u, test_val = nfsd4_lease;
3152
3153         nfs4_lock_state();
3154
3155         dprintk("NFSD: laundromat service - starting\n");
3156         nfsd4_end_grace();
3157         INIT_LIST_HEAD(&reaplist);
3158         spin_lock(&client_lock);
3159         list_for_each_safe(pos, next, &client_lru) {
3160                 clp = list_entry(pos, struct nfs4_client, cl_lru);
3161                 if (time_after((unsigned long)clp->cl_time, (unsigned long)cutoff)) {
3162                         t = clp->cl_time - cutoff;
3163                         if (clientid_val > t)
3164                                 clientid_val = t;
3165                         break;
3166                 }
3167                 if (atomic_read(&clp->cl_refcount)) {
3168                         dprintk("NFSD: client in use (clientid %08x)\n",
3169                                 clp->cl_clientid.cl_id);
3170                         continue;
3171                 }
3172                 unhash_client_locked(clp);
3173                 list_add(&clp->cl_lru, &reaplist);
3174         }
3175         spin_unlock(&client_lock);
3176         list_for_each_safe(pos, next, &reaplist) {
3177                 clp = list_entry(pos, struct nfs4_client, cl_lru);
3178                 dprintk("NFSD: purging unused client (clientid %08x)\n",
3179                         clp->cl_clientid.cl_id);
3180                 nfsd4_client_record_remove(clp);
3181                 expire_client(clp);
3182         }
3183         spin_lock(&recall_lock);
3184         list_for_each_safe(pos, next, &del_recall_lru) {
3185                 dp = list_entry (pos, struct nfs4_delegation, dl_recall_lru);
3186                 if (time_after((unsigned long)dp->dl_time, (unsigned long)cutoff)) {
3187                         u = dp->dl_time - cutoff;
3188                         if (test_val > u)
3189                                 test_val = u;
3190                         break;
3191                 }
3192                 list_move(&dp->dl_recall_lru, &reaplist);
3193         }
3194         spin_unlock(&recall_lock);
3195         list_for_each_safe(pos, next, &reaplist) {
3196                 dp = list_entry (pos, struct nfs4_delegation, dl_recall_lru);
3197                 unhash_delegation(dp);
3198         }
3199         test_val = nfsd4_lease;
3200         list_for_each_safe(pos, next, &close_lru) {
3201                 oo = container_of(pos, struct nfs4_openowner, oo_close_lru);
3202                 if (time_after((unsigned long)oo->oo_time, (unsigned long)cutoff)) {
3203                         u = oo->oo_time - cutoff;
3204                         if (test_val > u)
3205                                 test_val = u;
3206                         break;
3207                 }
3208                 release_openowner(oo);
3209         }
3210         if (clientid_val < NFSD_LAUNDROMAT_MINTIMEOUT)
3211                 clientid_val = NFSD_LAUNDROMAT_MINTIMEOUT;
3212         nfs4_unlock_state();
3213         return clientid_val;
3214 }
3215
3216 static struct workqueue_struct *laundry_wq;
3217 static void laundromat_main(struct work_struct *);
3218 static DECLARE_DELAYED_WORK(laundromat_work, laundromat_main);
3219
3220 static void
3221 laundromat_main(struct work_struct *not_used)
3222 {
3223         time_t t;
3224
3225         t = nfs4_laundromat();
3226         dprintk("NFSD: laundromat_main - sleeping for %ld seconds\n", t);
3227         queue_delayed_work(laundry_wq, &laundromat_work, t*HZ);
3228 }
3229
3230 static inline __be32 nfs4_check_fh(struct svc_fh *fhp, struct nfs4_ol_stateid *stp)
3231 {
3232         if (fhp->fh_dentry->d_inode != stp->st_file->fi_inode)
3233                 return nfserr_bad_stateid;
3234         return nfs_ok;
3235 }
3236
3237 static int
3238 STALE_STATEID(stateid_t *stateid)
3239 {
3240         if (stateid->si_opaque.so_clid.cl_boot == boot_time)
3241                 return 0;
3242         dprintk("NFSD: stale stateid " STATEID_FMT "!\n",
3243                 STATEID_VAL(stateid));
3244         return 1;
3245 }
3246
3247 static inline int
3248 access_permit_read(struct nfs4_ol_stateid *stp)
3249 {
3250         return test_access(NFS4_SHARE_ACCESS_READ, stp) ||
3251                 test_access(NFS4_SHARE_ACCESS_BOTH, stp) ||
3252                 test_access(NFS4_SHARE_ACCESS_WRITE, stp);
3253 }
3254
3255 static inline int
3256 access_permit_write(struct nfs4_ol_stateid *stp)
3257 {
3258         return test_access(NFS4_SHARE_ACCESS_WRITE, stp) ||
3259                 test_access(NFS4_SHARE_ACCESS_BOTH, stp);
3260 }
3261
3262 static
3263 __be32 nfs4_check_openmode(struct nfs4_ol_stateid *stp, int flags)
3264 {
3265         __be32 status = nfserr_openmode;
3266
3267         /* For lock stateid's, we test the parent open, not the lock: */
3268         if (stp->st_openstp)
3269                 stp = stp->st_openstp;
3270         if ((flags & WR_STATE) && !access_permit_write(stp))
3271                 goto out;
3272         if ((flags & RD_STATE) && !access_permit_read(stp))
3273                 goto out;
3274         status = nfs_ok;
3275 out:
3276         return status;
3277 }
3278
3279 static inline __be32
3280 check_special_stateids(svc_fh *current_fh, stateid_t *stateid, int flags)
3281 {
3282         if (ONE_STATEID(stateid) && (flags & RD_STATE))
3283                 return nfs_ok;
3284         else if (locks_in_grace()) {
3285                 /* Answer in remaining cases depends on existence of
3286                  * conflicting state; so we must wait out the grace period. */
3287                 return nfserr_grace;
3288         } else if (flags & WR_STATE)
3289                 return nfs4_share_conflict(current_fh,
3290                                 NFS4_SHARE_DENY_WRITE);
3291         else /* (flags & RD_STATE) && ZERO_STATEID(stateid) */
3292                 return nfs4_share_conflict(current_fh,
3293                                 NFS4_SHARE_DENY_READ);
3294 }
3295
3296 /*
3297  * Allow READ/WRITE during grace period on recovered state only for files
3298  * that are not able to provide mandatory locking.
3299  */
3300 static inline int
3301 grace_disallows_io(struct inode *inode)
3302 {
3303         return locks_in_grace() && mandatory_lock(inode);
3304 }
3305
3306 /* Returns true iff a is later than b: */
3307 static bool stateid_generation_after(stateid_t *a, stateid_t *b)
3308 {
3309         return (s32)a->si_generation - (s32)b->si_generation > 0;
3310 }
3311
3312 static __be32 check_stateid_generation(stateid_t *in, stateid_t *ref, bool has_session)
3313 {
3314         /*
3315          * When sessions are used the stateid generation number is ignored
3316          * when it is zero.
3317          */
3318         if (has_session && in->si_generation == 0)
3319                 return nfs_ok;
3320
3321         if (in->si_generation == ref->si_generation)
3322                 return nfs_ok;
3323
3324         /* If the client sends us a stateid from the future, it's buggy: */
3325         if (stateid_generation_after(in, ref))
3326                 return nfserr_bad_stateid;
3327         /*
3328          * However, we could see a stateid from the past, even from a
3329          * non-buggy client.  For example, if the client sends a lock
3330          * while some IO is outstanding, the lock may bump si_generation
3331          * while the IO is still in flight.  The client could avoid that
3332          * situation by waiting for responses on all the IO requests,
3333          * but better performance may result in retrying IO that
3334          * receives an old_stateid error if requests are rarely
3335          * reordered in flight:
3336          */
3337         return nfserr_old_stateid;
3338 }
3339
3340 static __be32 nfsd4_validate_stateid(struct nfs4_client *cl, stateid_t *stateid)
3341 {
3342         struct nfs4_stid *s;
3343         struct nfs4_ol_stateid *ols;
3344         __be32 status;
3345
3346         if (ZERO_STATEID(stateid) || ONE_STATEID(stateid))
3347                 return nfserr_bad_stateid;
3348         /* Client debugging aid. */
3349         if (!same_clid(&stateid->si_opaque.so_clid, &cl->cl_clientid)) {
3350                 char addr_str[INET6_ADDRSTRLEN];
3351                 rpc_ntop((struct sockaddr *)&cl->cl_addr, addr_str,
3352                                  sizeof(addr_str));
3353                 pr_warn_ratelimited("NFSD: client %s testing state ID "
3354                                         "with incorrect client ID\n", addr_str);
3355                 return nfserr_bad_stateid;
3356         }
3357         s = find_stateid(cl, stateid);
3358         if (!s)
3359                 return nfserr_bad_stateid;
3360         status = check_stateid_generation(stateid, &s->sc_stateid, 1);
3361         if (status)
3362                 return status;
3363         if (!(s->sc_type & (NFS4_OPEN_STID | NFS4_LOCK_STID)))
3364                 return nfs_ok;
3365         ols = openlockstateid(s);
3366         if (ols->st_stateowner->so_is_open_owner
3367             && !(openowner(ols->st_stateowner)->oo_flags & NFS4_OO_CONFIRMED))
3368                 return nfserr_bad_stateid;
3369         return nfs_ok;
3370 }
3371
3372 static __be32 nfsd4_lookup_stateid(stateid_t *stateid, unsigned char typemask, struct nfs4_stid **s)
3373 {
3374         struct nfs4_client *cl;
3375
3376         if (ZERO_STATEID(stateid) || ONE_STATEID(stateid))
3377                 return nfserr_bad_stateid;
3378         if (STALE_STATEID(stateid))
3379                 return nfserr_stale_stateid;
3380         cl = find_confirmed_client(&stateid->si_opaque.so_clid);
3381         if (!cl)
3382                 return nfserr_expired;
3383         *s = find_stateid_by_type(cl, stateid, typemask);
3384         if (!*s)
3385                 return nfserr_bad_stateid;
3386         return nfs_ok;
3387
3388 }
3389
3390 /*
3391 * Checks for stateid operations
3392 */
3393 __be32
3394 nfs4_preprocess_stateid_op(struct nfsd4_compound_state *cstate,
3395                            stateid_t *stateid, int flags, struct file **filpp)
3396 {
3397         struct nfs4_stid *s;
3398         struct nfs4_ol_stateid *stp = NULL;
3399         struct nfs4_delegation *dp = NULL;
3400         struct svc_fh *current_fh = &cstate->current_fh;
3401         struct inode *ino = current_fh->fh_dentry->d_inode;
3402         __be32 status;
3403
3404         if (filpp)
3405                 *filpp = NULL;
3406
3407         if (grace_disallows_io(ino))
3408                 return nfserr_grace;
3409
3410         if (ZERO_STATEID(stateid) || ONE_STATEID(stateid))
3411                 return check_special_stateids(current_fh, stateid, flags);
3412
3413         status = nfsd4_lookup_stateid(stateid, NFS4_DELEG_STID|NFS4_OPEN_STID|NFS4_LOCK_STID, &s);
3414         if (status)
3415                 return status;
3416         status = check_stateid_generation(stateid, &s->sc_stateid, nfsd4_has_session(cstate));
3417         if (status)
3418                 goto out;
3419         switch (s->sc_type) {
3420         case NFS4_DELEG_STID:
3421                 dp = delegstateid(s);
3422                 status = nfs4_check_delegmode(dp, flags);
3423                 if (status)
3424                         goto out;
3425                 if (filpp) {
3426                         *filpp = dp->dl_file->fi_deleg_file;
3427                         BUG_ON(!*filpp);
3428                 }
3429                 break;
3430         case NFS4_OPEN_STID:
3431         case NFS4_LOCK_STID:
3432                 stp = openlockstateid(s);
3433                 status = nfs4_check_fh(current_fh, stp);
3434                 if (status)
3435                         goto out;
3436                 if (stp->st_stateowner->so_is_open_owner
3437                     && !(openowner(stp->st_stateowner)->oo_flags & NFS4_OO_CONFIRMED))
3438                         goto out;
3439                 status = nfs4_check_openmode(stp, flags);
3440                 if (status)
3441                         goto out;
3442                 if (filpp) {
3443                         if (flags & RD_STATE)
3444                                 *filpp = find_readable_file(stp->st_file);
3445                         else
3446                                 *filpp = find_writeable_file(stp->st_file);
3447                 }
3448                 break;
3449         default:
3450                 return nfserr_bad_stateid;
3451         }
3452         status = nfs_ok;
3453 out:
3454         return status;
3455 }
3456
3457 static __be32
3458 nfsd4_free_lock_stateid(struct nfs4_ol_stateid *stp)
3459 {
3460         if (check_for_locks(stp->st_file, lockowner(stp->st_stateowner)))
3461                 return nfserr_locks_held;
3462         release_lock_stateid(stp);
3463         return nfs_ok;
3464 }
3465
3466 /*
3467  * Test if the stateid is valid
3468  */
3469 __be32
3470 nfsd4_test_stateid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
3471                    struct nfsd4_test_stateid *test_stateid)
3472 {
3473         struct nfsd4_test_stateid_id *stateid;
3474         struct nfs4_client *cl = cstate->session->se_client;
3475
3476         nfs4_lock_state();
3477         list_for_each_entry(stateid, &test_stateid->ts_stateid_list, ts_id_list)
3478                 stateid->ts_id_status =
3479                         nfsd4_validate_stateid(cl, &stateid->ts_id_stateid);
3480         nfs4_unlock_state();
3481
3482         return nfs_ok;
3483 }
3484
3485 __be32
3486 nfsd4_free_stateid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
3487                    struct nfsd4_free_stateid *free_stateid)
3488 {
3489         stateid_t *stateid = &free_stateid->fr_stateid;
3490         struct nfs4_stid *s;
3491         struct nfs4_client *cl = cstate->session->se_client;
3492         __be32 ret = nfserr_bad_stateid;
3493
3494         nfs4_lock_state();
3495         s = find_stateid(cl, stateid);
3496         if (!s)
3497                 goto out;
3498         switch (s->sc_type) {
3499         case NFS4_DELEG_STID:
3500                 ret = nfserr_locks_held;
3501                 goto out;
3502         case NFS4_OPEN_STID:
3503         case NFS4_LOCK_STID:
3504                 ret = check_stateid_generation(stateid, &s->sc_stateid, 1);
3505                 if (ret)
3506                         goto out;
3507                 if (s->sc_type == NFS4_LOCK_STID)
3508                         ret = nfsd4_free_lock_stateid(openlockstateid(s));
3509                 else
3510                         ret = nfserr_locks_held;
3511                 break;
3512         default:
3513                 ret = nfserr_bad_stateid;
3514         }
3515 out:
3516         nfs4_unlock_state();
3517         return ret;
3518 }
3519
3520 static inline int
3521 setlkflg (int type)
3522 {
3523         return (type == NFS4_READW_LT || type == NFS4_READ_LT) ?
3524                 RD_STATE : WR_STATE;
3525 }
3526
3527 static __be32 nfs4_seqid_op_checks(struct nfsd4_compound_state *cstate, stateid_t *stateid, u32 seqid, struct nfs4_ol_stateid *stp)
3528 {
3529         struct svc_fh *current_fh = &cstate->current_fh;
3530         struct nfs4_stateowner *sop = stp->st_stateowner;
3531         __be32 status;
3532
3533         status = nfsd4_check_seqid(cstate, sop, seqid);
3534         if (status)
3535                 return status;
3536         if (stp->st_stid.sc_type == NFS4_CLOSED_STID)
3537                 /*
3538                  * "Closed" stateid's exist *only* to return
3539                  * nfserr_replay_me from the previous step.
3540                  */
3541                 return nfserr_bad_stateid;
3542         status = check_stateid_generation(stateid, &stp->st_stid.sc_stateid, nfsd4_has_session(cstate));
3543         if (status)
3544                 return status;
3545         return nfs4_check_fh(current_fh, stp);
3546 }
3547
3548 /*
3549  * Checks for sequence id mutating operations.
3550  */
3551 static __be32
3552 nfs4_preprocess_seqid_op(struct nfsd4_compound_state *cstate, u32 seqid,
3553                          stateid_t *stateid, char typemask,
3554                          struct nfs4_ol_stateid **stpp)
3555 {
3556         __be32 status;
3557         struct nfs4_stid *s;
3558
3559         dprintk("NFSD: %s: seqid=%d stateid = " STATEID_FMT "\n", __func__,
3560                 seqid, STATEID_VAL(stateid));
3561
3562         *stpp = NULL;
3563         status = nfsd4_lookup_stateid(stateid, typemask, &s);
3564         if (status)
3565                 return status;
3566         *stpp = openlockstateid(s);
3567         cstate->replay_owner = (*stpp)->st_stateowner;
3568
3569         return nfs4_seqid_op_checks(cstate, stateid, seqid, *stpp);
3570 }
3571
3572 static __be32 nfs4_preprocess_confirmed_seqid_op(struct nfsd4_compound_state *cstate, u32 seqid, stateid_t *stateid, struct nfs4_ol_stateid **stpp)
3573 {
3574         __be32 status;
3575         struct nfs4_openowner *oo;
3576
3577         status = nfs4_preprocess_seqid_op(cstate, seqid, stateid,
3578                                                 NFS4_OPEN_STID, stpp);
3579         if (status)
3580                 return status;
3581         oo = openowner((*stpp)->st_stateowner);
3582         if (!(oo->oo_flags & NFS4_OO_CONFIRMED))
3583                 return nfserr_bad_stateid;
3584         return nfs_ok;
3585 }
3586
3587 __be32
3588 nfsd4_open_confirm(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
3589                    struct nfsd4_open_confirm *oc)
3590 {
3591         __be32 status;
3592         struct nfs4_openowner *oo;
3593         struct nfs4_ol_stateid *stp;
3594
3595         dprintk("NFSD: nfsd4_open_confirm on file %.*s\n",
3596                         (int)cstate->current_fh.fh_dentry->d_name.len,
3597                         cstate->current_fh.fh_dentry->d_name.name);
3598
3599         status = fh_verify(rqstp, &cstate->current_fh, S_IFREG, 0);
3600         if (status)
3601                 return status;
3602
3603         nfs4_lock_state();
3604
3605         status = nfs4_preprocess_seqid_op(cstate,
3606                                         oc->oc_seqid, &oc->oc_req_stateid,
3607                                         NFS4_OPEN_STID, &stp);
3608         if (status)
3609                 goto out;
3610         oo = openowner(stp->st_stateowner);
3611         status = nfserr_bad_stateid;
3612         if (oo->oo_flags & NFS4_OO_CONFIRMED)
3613                 goto out;
3614         oo->oo_flags |= NFS4_OO_CONFIRMED;
3615         update_stateid(&stp->st_stid.sc_stateid);
3616         memcpy(&oc->oc_resp_stateid, &stp->st_stid.sc_stateid, sizeof(stateid_t));
3617         dprintk("NFSD: %s: success, seqid=%d stateid=" STATEID_FMT "\n",
3618                 __func__, oc->oc_seqid, STATEID_VAL(&stp->st_stid.sc_stateid));
3619
3620         nfsd4_client_record_create(oo->oo_owner.so_client);
3621         status = nfs_ok;
3622 out:
3623         if (!cstate->replay_owner)
3624                 nfs4_unlock_state();
3625         return status;
3626 }
3627
3628 static inline void nfs4_stateid_downgrade_bit(struct nfs4_ol_stateid *stp, u32 access)
3629 {
3630         if (!test_access(access, stp))
3631                 return;
3632         nfs4_file_put_access(stp->st_file, nfs4_access_to_omode(access));
3633         clear_access(access, stp);
3634 }
3635
3636 static inline void nfs4_stateid_downgrade(struct nfs4_ol_stateid *stp, u32 to_access)
3637 {
3638         switch (to_access) {
3639         case NFS4_SHARE_ACCESS_READ:
3640                 nfs4_stateid_downgrade_bit(stp, NFS4_SHARE_ACCESS_WRITE);
3641                 nfs4_stateid_downgrade_bit(stp, NFS4_SHARE_ACCESS_BOTH);
3642                 break;
3643         case NFS4_SHARE_ACCESS_WRITE:
3644                 nfs4_stateid_downgrade_bit(stp, NFS4_SHARE_ACCESS_READ);
3645                 nfs4_stateid_downgrade_bit(stp, NFS4_SHARE_ACCESS_BOTH);
3646                 break;
3647         case NFS4_SHARE_ACCESS_BOTH:
3648                 break;
3649         default:
3650                 BUG();
3651         }
3652 }
3653
3654 static void
3655 reset_union_bmap_deny(unsigned long deny, struct nfs4_ol_stateid *stp)
3656 {
3657         int i;
3658         for (i = 0; i < 4; i++) {
3659                 if ((i & deny) != i)
3660                         clear_deny(i, stp);
3661         }
3662 }
3663
3664 __be32
3665 nfsd4_open_downgrade(struct svc_rqst *rqstp,
3666                      struct nfsd4_compound_state *cstate,
3667                      struct nfsd4_open_downgrade *od)
3668 {
3669         __be32 status;
3670         struct nfs4_ol_stateid *stp;
3671
3672         dprintk("NFSD: nfsd4_open_downgrade on file %.*s\n",
3673                         (int)cstate->current_fh.fh_dentry->d_name.len,
3674                         cstate->current_fh.fh_dentry->d_name.name);
3675
3676         /* We don't yet support WANT bits: */
3677         if (od->od_deleg_want)
3678                 dprintk("NFSD: %s: od_deleg_want=0x%x ignored\n", __func__,
3679                         od->od_deleg_want);
3680
3681         nfs4_lock_state();
3682         status = nfs4_preprocess_confirmed_seqid_op(cstate, od->od_seqid,
3683                                         &od->od_stateid, &stp);
3684         if (status)
3685                 goto out;
3686         status = nfserr_inval;
3687         if (!test_access(od->od_share_access, stp)) {
3688                 dprintk("NFSD: access not a subset current bitmap: 0x%lx, input access=%08x\n",
3689                         stp->st_access_bmap, od->od_share_access);
3690                 goto out;
3691         }
3692         if (!test_deny(od->od_share_deny, stp)) {
3693                 dprintk("NFSD:deny not a subset current bitmap: 0x%lx, input deny=%08x\n",
3694                         stp->st_deny_bmap, od->od_share_deny);
3695                 goto out;
3696         }
3697         nfs4_stateid_downgrade(stp, od->od_share_access);
3698
3699         reset_union_bmap_deny(od->od_share_deny, stp);
3700
3701         update_stateid(&stp->st_stid.sc_stateid);
3702         memcpy(&od->od_stateid, &stp->st_stid.sc_stateid, sizeof(stateid_t));
3703         status = nfs_ok;
3704 out:
3705         if (!cstate->replay_owner)
3706                 nfs4_unlock_state();
3707         return status;
3708 }
3709
3710 void nfsd4_purge_closed_stateid(struct nfs4_stateowner *so)
3711 {
3712         struct nfs4_openowner *oo;
3713         struct nfs4_ol_stateid *s;
3714
3715         if (!so->so_is_open_owner)
3716                 return;
3717         oo = openowner(so);
3718         s = oo->oo_last_closed_stid;
3719         if (!s)
3720                 return;
3721         if (!(oo->oo_flags & NFS4_OO_PURGE_CLOSE)) {
3722                 /* Release the last_closed_stid on the next seqid bump: */
3723                 oo->oo_flags |= NFS4_OO_PURGE_CLOSE;
3724                 return;
3725         }
3726         oo->oo_flags &= ~NFS4_OO_PURGE_CLOSE;
3727         release_last_closed_stateid(oo);
3728 }
3729
3730 static void nfsd4_close_open_stateid(struct nfs4_ol_stateid *s)
3731 {
3732         unhash_open_stateid(s);
3733         s->st_stid.sc_type = NFS4_CLOSED_STID;
3734 }
3735
3736 /*
3737  * nfs4_unlock_state() called after encode
3738  */
3739 __be32
3740 nfsd4_close(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
3741             struct nfsd4_close *close)
3742 {
3743         __be32 status;
3744         struct nfs4_openowner *oo;
3745         struct nfs4_ol_stateid *stp;
3746
3747         dprintk("NFSD: nfsd4_close on file %.*s\n",
3748                         (int)cstate->current_fh.fh_dentry->d_name.len,
3749                         cstate->current_fh.fh_dentry->d_name.name);
3750
3751         nfs4_lock_state();
3752         status = nfs4_preprocess_seqid_op(cstate, close->cl_seqid,
3753                                         &close->cl_stateid,
3754                                         NFS4_OPEN_STID|NFS4_CLOSED_STID,
3755                                         &stp);
3756         if (status)
3757                 goto out;
3758         oo = openowner(stp->st_stateowner);
3759         status = nfs_ok;
3760         update_stateid(&stp->st_stid.sc_stateid);
3761         memcpy(&close->cl_stateid, &stp->st_stid.sc_stateid, sizeof(stateid_t));
3762
3763         nfsd4_close_open_stateid(stp);
3764         oo->oo_last_closed_stid = stp;
3765
3766         /* place unused nfs4_stateowners on so_close_lru list to be
3767          * released by the laundromat service after the lease period
3768          * to enable us to handle CLOSE replay
3769          */
3770         if (list_empty(&oo->oo_owner.so_stateids))
3771                 move_to_close_lru(oo);
3772 out:
3773         if (!cstate->replay_owner)
3774                 nfs4_unlock_state();
3775         return status;
3776 }
3777
3778 __be32
3779 nfsd4_delegreturn(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
3780                   struct nfsd4_delegreturn *dr)
3781 {
3782         struct nfs4_delegation *dp;
3783         stateid_t *stateid = &dr->dr_stateid;
3784         struct nfs4_stid *s;
3785         struct inode *inode;
3786         __be32 status;
3787
3788         if ((status = fh_verify(rqstp, &cstate->current_fh, S_IFREG, 0)))
3789                 return status;
3790         inode = cstate->current_fh.fh_dentry->d_inode;
3791
3792         nfs4_lock_state();
3793         status = nfsd4_lookup_stateid(stateid, NFS4_DELEG_STID, &s);
3794         if (status)
3795                 goto out;
3796         dp = delegstateid(s);
3797         status = check_stateid_generation(stateid, &dp->dl_stid.sc_stateid, nfsd4_has_session(cstate));
3798         if (status)
3799                 goto out;
3800
3801         unhash_delegation(dp);
3802 out:
3803         nfs4_unlock_state();
3804
3805         return status;
3806 }
3807
3808
3809 #define LOFF_OVERFLOW(start, len)      ((u64)(len) > ~(u64)(start))
3810
3811 #define LOCKOWNER_INO_HASH_BITS 8
3812 #define LOCKOWNER_INO_HASH_SIZE (1 << LOCKOWNER_INO_HASH_BITS)
3813 #define LOCKOWNER_INO_HASH_MASK (LOCKOWNER_INO_HASH_SIZE - 1)
3814
3815 static inline u64
3816 end_offset(u64 start, u64 len)
3817 {
3818         u64 end;
3819
3820         end = start + len;
3821         return end >= start ? end: NFS4_MAX_UINT64;
3822 }
3823
3824 /* last octet in a range */
3825 static inline u64
3826 last_byte_offset(u64 start, u64 len)
3827 {
3828         u64 end;
3829
3830         BUG_ON(!len);
3831         end = start + len;
3832         return end > start ? end - 1: NFS4_MAX_UINT64;
3833 }
3834
3835 static unsigned int lockowner_ino_hashval(struct inode *inode, u32 cl_id, struct xdr_netobj *ownername)
3836 {
3837         return (file_hashval(inode) + cl_id
3838                         + opaque_hashval(ownername->data, ownername->len))
3839                 & LOCKOWNER_INO_HASH_MASK;
3840 }
3841
3842 static struct list_head lockowner_ino_hashtbl[LOCKOWNER_INO_HASH_SIZE];
3843
3844 /*
3845  * TODO: Linux file offsets are _signed_ 64-bit quantities, which means that
3846  * we can't properly handle lock requests that go beyond the (2^63 - 1)-th
3847  * byte, because of sign extension problems.  Since NFSv4 calls for 64-bit
3848  * locking, this prevents us from being completely protocol-compliant.  The
3849  * real solution to this problem is to start using unsigned file offsets in
3850  * the VFS, but this is a very deep change!
3851  */
3852 static inline void
3853 nfs4_transform_lock_offset(struct file_lock *lock)
3854 {
3855         if (lock->fl_start < 0)
3856                 lock->fl_start = OFFSET_MAX;
3857         if (lock->fl_end < 0)
3858                 lock->fl_end = OFFSET_MAX;
3859 }
3860
3861 /* Hack!: For now, we're defining this just so we can use a pointer to it
3862  * as a unique cookie to identify our (NFSv4's) posix locks. */
3863 static const struct lock_manager_operations nfsd_posix_mng_ops  = {
3864 };
3865
3866 static inline void
3867 nfs4_set_lock_denied(struct file_lock *fl, struct nfsd4_lock_denied *deny)
3868 {
3869         struct nfs4_lockowner *lo;
3870
3871         if (fl->fl_lmops == &nfsd_posix_mng_ops) {
3872                 lo = (struct nfs4_lockowner *) fl->fl_owner;
3873                 deny->ld_owner.data = kmemdup(lo->lo_owner.so_owner.data,
3874                                         lo->lo_owner.so_owner.len, GFP_KERNEL);
3875                 if (!deny->ld_owner.data)
3876                         /* We just don't care that much */
3877                         goto nevermind;
3878                 deny->ld_owner.len = lo->lo_owner.so_owner.len;
3879                 deny->ld_clientid = lo->lo_owner.so_client->cl_clientid;
3880         } else {
3881 nevermind:
3882                 deny->ld_owner.len = 0;
3883                 deny->ld_owner.data = NULL;
3884                 deny->ld_clientid.cl_boot = 0;
3885                 deny->ld_clientid.cl_id = 0;
3886         }
3887         deny->ld_start = fl->fl_start;
3888         deny->ld_length = NFS4_MAX_UINT64;
3889         if (fl->fl_end != NFS4_MAX_UINT64)
3890                 deny->ld_length = fl->fl_end - fl->fl_start + 1;
3891         deny->ld_type = NFS4_READ_LT;
3892         if (fl->fl_type != F_RDLCK)
3893                 deny->ld_type = NFS4_WRITE_LT;
3894 }
3895
3896 static bool same_lockowner_ino(struct nfs4_lockowner *lo, struct inode *inode, clientid_t *clid, struct xdr_netobj *owner)
3897 {
3898         struct nfs4_ol_stateid *lst;
3899
3900         if (!same_owner_str(&lo->lo_owner, owner, clid))
3901                 return false;
3902         lst = list_first_entry(&lo->lo_owner.so_stateids,
3903                                struct nfs4_ol_stateid, st_perstateowner);
3904         return lst->st_file->fi_inode == inode;
3905 }
3906
3907 static struct nfs4_lockowner *
3908 find_lockowner_str(struct inode *inode, clientid_t *clid,
3909                 struct xdr_netobj *owner)
3910 {
3911         unsigned int hashval = lockowner_ino_hashval(inode, clid->cl_id, owner);
3912         struct nfs4_lockowner *lo;
3913
3914         list_for_each_entry(lo, &lockowner_ino_hashtbl[hashval], lo_owner_ino_hash) {
3915                 if (same_lockowner_ino(lo, inode, clid, owner))
3916                         return lo;
3917         }
3918         return NULL;
3919 }
3920
3921 static void hash_lockowner(struct nfs4_lockowner *lo, unsigned int strhashval, struct nfs4_client *clp, struct nfs4_ol_stateid *open_stp)
3922 {
3923         struct inode *inode = open_stp->st_file->fi_inode;
3924         unsigned int inohash = lockowner_ino_hashval(inode,
3925                         clp->cl_clientid.cl_id, &lo->lo_owner.so_owner);
3926
3927         list_add(&lo->lo_owner.so_strhash, &ownerstr_hashtbl[strhashval]);
3928         list_add(&lo->lo_owner_ino_hash, &lockowner_ino_hashtbl[inohash]);
3929         list_add(&lo->lo_perstateid, &open_stp->st_lockowners);
3930 }
3931
3932 /*
3933  * Alloc a lock owner structure.
3934  * Called in nfsd4_lock - therefore, OPEN and OPEN_CONFIRM (if needed) has
3935  * occurred.
3936  *
3937  * strhashval = ownerstr_hashval
3938  */
3939
3940 static struct nfs4_lockowner *
3941 alloc_init_lock_stateowner(unsigned int strhashval, struct nfs4_client *clp, struct nfs4_ol_stateid *open_stp, struct nfsd4_lock *lock) {
3942         struct nfs4_lockowner *lo;
3943
3944         lo = alloc_stateowner(lockowner_slab, &lock->lk_new_owner, clp);
3945         if (!lo)
3946                 return NULL;
3947         INIT_LIST_HEAD(&lo->lo_owner.so_stateids);
3948         lo->lo_owner.so_is_open_owner = 0;
3949         /* It is the openowner seqid that will be incremented in encode in the
3950          * case of new lockowners; so increment the lock seqid manually: */
3951         lo->lo_owner.so_seqid = lock->lk_new_lock_seqid + 1;
3952         hash_lockowner(lo, strhashval, clp, open_stp);
3953         return lo;
3954 }
3955
3956 static struct nfs4_ol_stateid *
3957 alloc_init_lock_stateid(struct nfs4_lockowner *lo, struct nfs4_file *fp, struct nfs4_ol_stateid *open_stp)
3958 {
3959         struct nfs4_ol_stateid *stp;
3960         struct nfs4_client *clp = lo->lo_owner.so_client;
3961
3962         stp = nfs4_alloc_stateid(clp);
3963         if (stp == NULL)
3964                 return NULL;
3965         init_stid(&stp->st_stid, clp, NFS4_LOCK_STID);
3966         list_add(&stp->st_perfile, &fp->fi_stateids);
3967         list_add(&stp->st_perstateowner, &lo->lo_owner.so_stateids);
3968         stp->st_stateowner = &lo->lo_owner;
3969         get_nfs4_file(fp);
3970         stp->st_file = fp;
3971         stp->st_access_bmap = 0;
3972         stp->st_deny_bmap = open_stp->st_deny_bmap;
3973         stp->st_openstp = open_stp;
3974         return stp;
3975 }
3976
3977 static int
3978 check_lock_length(u64 offset, u64 length)
3979 {
3980         return ((length == 0)  || ((length != NFS4_MAX_UINT64) &&
3981              LOFF_OVERFLOW(offset, length)));
3982 }
3983
3984 static void get_lock_access(struct nfs4_ol_stateid *lock_stp, u32 access)
3985 {
3986         struct nfs4_file *fp = lock_stp->st_file;
3987         int oflag = nfs4_access_to_omode(access);
3988
3989         if (test_access(access, lock_stp))
3990                 return;
3991         nfs4_file_get_access(fp, oflag);
3992         set_access(access, lock_stp);
3993 }
3994
3995 static __be32 lookup_or_create_lock_state(struct nfsd4_compound_state *cstate, struct nfs4_ol_stateid *ost, struct nfsd4_lock *lock, struct nfs4_ol_stateid **lst, bool *new)
3996 {
3997         struct nfs4_file *fi = ost->st_file;
3998         struct nfs4_openowner *oo = openowner(ost->st_stateowner);
3999         struct nfs4_client *cl = oo->oo_owner.so_client;
4000         struct nfs4_lockowner *lo;
4001         unsigned int strhashval;
4002
4003         lo = find_lockowner_str(fi->fi_inode, &cl->cl_clientid, &lock->v.new.owner);
4004         if (lo) {
4005                 if (!cstate->minorversion)
4006                         return nfserr_bad_seqid;
4007                 /* XXX: a lockowner always has exactly one stateid: */
4008                 *lst = list_first_entry(&lo->lo_owner.so_stateids,
4009                                 struct nfs4_ol_stateid, st_perstateowner);
4010                 return nfs_ok;
4011         }
4012         strhashval = ownerstr_hashval(cl->cl_clientid.cl_id,
4013                         &lock->v.new.owner);
4014         lo = alloc_init_lock_stateowner(strhashval, cl, ost, lock);
4015         if (lo == NULL)
4016                 return nfserr_jukebox;
4017         *lst = alloc_init_lock_stateid(lo, fi, ost);
4018         if (*lst == NULL) {
4019                 release_lockowner(lo);
4020                 return nfserr_jukebox;
4021         }
4022         *new = true;
4023         return nfs_ok;
4024 }
4025
4026 /*
4027  *  LOCK operation
4028  */
4029 __be32
4030 nfsd4_lock(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
4031            struct nfsd4_lock *lock)
4032 {
4033         struct nfs4_openowner *open_sop = NULL;
4034         struct nfs4_lockowner *lock_sop = NULL;
4035         struct nfs4_ol_stateid *lock_stp;
4036         struct file *filp = NULL;
4037         struct file_lock file_lock;
4038         struct file_lock conflock;
4039         __be32 status = 0;
4040         bool new_state = false;
4041         int lkflg;
4042         int err;
4043
4044         dprintk("NFSD: nfsd4_lock: start=%Ld length=%Ld\n",
4045                 (long long) lock->lk_offset,
4046                 (long long) lock->lk_length);
4047
4048         if (check_lock_length(lock->lk_offset, lock->lk_length))
4049                  return nfserr_inval;
4050
4051         if ((status = fh_verify(rqstp, &cstate->current_fh,
4052                                 S_IFREG, NFSD_MAY_LOCK))) {
4053                 dprintk("NFSD: nfsd4_lock: permission denied!\n");
4054                 return status;
4055         }
4056
4057         nfs4_lock_state();
4058
4059         if (lock->lk_is_new) {
4060                 struct nfs4_ol_stateid *open_stp = NULL;
4061
4062                 if (nfsd4_has_session(cstate))
4063                         /* See rfc 5661 18.10.3: given clientid is ignored: */
4064                         memcpy(&lock->v.new.clientid,
4065                                 &cstate->session->se_client->cl_clientid,
4066                                 sizeof(clientid_t));
4067
4068                 status = nfserr_stale_clientid;
4069                 if (STALE_CLIENTID(&lock->lk_new_clientid))
4070                         goto out;
4071
4072                 /* validate and update open stateid and open seqid */
4073                 status = nfs4_preprocess_confirmed_seqid_op(cstate,
4074                                         lock->lk_new_open_seqid,
4075                                         &lock->lk_new_open_stateid,
4076                                         &open_stp);
4077                 if (status)
4078                         goto out;
4079                 open_sop = openowner(open_stp->st_stateowner);
4080                 status = nfserr_bad_stateid;
4081                 if (!same_clid(&open_sop->oo_owner.so_client->cl_clientid,
4082                                                 &lock->v.new.clientid))
4083                         goto out;
4084                 status = lookup_or_create_lock_state(cstate, open_stp, lock,
4085                                                         &lock_stp, &new_state);
4086         } else
4087                 status = nfs4_preprocess_seqid_op(cstate,
4088                                        lock->lk_old_lock_seqid,
4089                                        &lock->lk_old_lock_stateid,
4090                                        NFS4_LOCK_STID, &lock_stp);
4091         if (status)
4092                 goto out;
4093         lock_sop = lockowner(lock_stp->st_stateowner);
4094
4095         lkflg = setlkflg(lock->lk_type);
4096         status = nfs4_check_openmode(lock_stp, lkflg);
4097         if (status)
4098                 goto out;
4099
4100         status = nfserr_grace;
4101         if (locks_in_grace() && !lock->lk_reclaim)
4102                 goto out;
4103         status = nfserr_no_grace;
4104         if (!locks_in_grace() && lock->lk_reclaim)
4105                 goto out;
4106
4107         locks_init_lock(&file_lock);
4108         switch (lock->lk_type) {
4109                 case NFS4_READ_LT:
4110                 case NFS4_READW_LT:
4111                         filp = find_readable_file(lock_stp->st_file);
4112                         if (filp)
4113                                 get_lock_access(lock_stp, NFS4_SHARE_ACCESS_READ);
4114                         file_lock.fl_type = F_RDLCK;
4115                         break;
4116                 case NFS4_WRITE_LT:
4117                 case NFS4_WRITEW_LT:
4118                         filp = find_writeable_file(lock_stp->st_file);
4119                         if (filp)
4120                                 get_lock_access(lock_stp, NFS4_SHARE_ACCESS_WRITE);
4121                         file_lock.fl_type = F_WRLCK;
4122                         break;
4123                 default:
4124                         status = nfserr_inval;
4125                 goto out;
4126         }
4127         if (!filp) {
4128                 status = nfserr_openmode;
4129                 goto out;
4130         }
4131         file_lock.fl_owner = (fl_owner_t)lock_sop;
4132         file_lock.fl_pid = current->tgid;
4133         file_lock.fl_file = filp;
4134         file_lock.fl_flags = FL_POSIX;
4135         file_lock.fl_lmops = &nfsd_posix_mng_ops;
4136
4137         file_lock.fl_start = lock->lk_offset;
4138         file_lock.fl_end = last_byte_offset(lock->lk_offset, lock->lk_length);
4139         nfs4_transform_lock_offset(&file_lock);
4140
4141         /*
4142         * Try to lock the file in the VFS.
4143         * Note: locks.c uses the BKL to protect the inode's lock list.
4144         */
4145
4146         err = vfs_lock_file(filp, F_SETLK, &file_lock, &conflock);
4147         switch (-err) {
4148         case 0: /* success! */
4149                 update_stateid(&lock_stp->st_stid.sc_stateid);
4150                 memcpy(&lock->lk_resp_stateid, &lock_stp->st_stid.sc_stateid,
4151                                 sizeof(stateid_t));
4152                 status = 0;
4153                 break;
4154         case (EAGAIN):          /* conflock holds conflicting lock */
4155                 status = nfserr_denied;
4156                 dprintk("NFSD: nfsd4_lock: conflicting lock found!\n");
4157                 nfs4_set_lock_denied(&conflock, &lock->lk_denied);
4158                 break;
4159         case (EDEADLK):
4160                 status = nfserr_deadlock;
4161                 break;
4162         default:
4163                 dprintk("NFSD: nfsd4_lock: vfs_lock_file() failed! status %d\n",err);
4164                 status = nfserrno(err);
4165                 break;
4166         }
4167 out:
4168         if (status && new_state)
4169                 release_lockowner(lock_sop);
4170         if (!cstate->replay_owner)
4171                 nfs4_unlock_state();
4172         return status;
4173 }
4174
4175 /*
4176  * The NFSv4 spec allows a client to do a LOCKT without holding an OPEN,
4177  * so we do a temporary open here just to get an open file to pass to
4178  * vfs_test_lock.  (Arguably perhaps test_lock should be done with an
4179  * inode operation.)
4180  */
4181 static __be32 nfsd_test_lock(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file_lock *lock)
4182 {
4183         struct file *file;
4184         __be32 err = nfsd_open(rqstp, fhp, S_IFREG, NFSD_MAY_READ, &file);
4185         if (!err) {
4186                 err = nfserrno(vfs_test_lock(file, lock));
4187                 nfsd_close(file);
4188         }
4189         return err;
4190 }
4191
4192 /*
4193  * LOCKT operation
4194  */
4195 __be32
4196 nfsd4_lockt(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
4197             struct nfsd4_lockt *lockt)
4198 {
4199         struct inode *inode;
4200         struct file_lock file_lock;
4201         struct nfs4_lockowner *lo;
4202         __be32 status;
4203
4204         if (locks_in_grace())
4205                 return nfserr_grace;
4206
4207         if (check_lock_length(lockt->lt_offset, lockt->lt_length))
4208                  return nfserr_inval;
4209
4210         nfs4_lock_state();
4211
4212         status = nfserr_stale_clientid;
4213         if (!nfsd4_has_session(cstate) && STALE_CLIENTID(&lockt->lt_clientid))
4214                 goto out;
4215
4216         if ((status = fh_verify(rqstp, &cstate->current_fh, S_IFREG, 0)))
4217                 goto out;
4218
4219         inode = cstate->current_fh.fh_dentry->d_inode;
4220         locks_init_lock(&file_lock);
4221         switch (lockt->lt_type) {
4222                 case NFS4_READ_LT:
4223                 case NFS4_READW_LT:
4224                         file_lock.fl_type = F_RDLCK;
4225                 break;
4226                 case NFS4_WRITE_LT:
4227                 case NFS4_WRITEW_LT:
4228                         file_lock.fl_type = F_WRLCK;
4229                 break;
4230                 default:
4231                         dprintk("NFSD: nfs4_lockt: bad lock type!\n");
4232                         status = nfserr_inval;
4233                 goto out;
4234         }
4235
4236         lo = find_lockowner_str(inode, &lockt->lt_clientid, &lockt->lt_owner);
4237         if (lo)
4238                 file_lock.fl_owner = (fl_owner_t)lo;
4239         file_lock.fl_pid = current->tgid;
4240         file_lock.fl_flags = FL_POSIX;
4241
4242         file_lock.fl_start = lockt->lt_offset;
4243         file_lock.fl_end = last_byte_offset(lockt->lt_offset, lockt->lt_length);
4244
4245         nfs4_transform_lock_offset(&file_lock);
4246
4247         status = nfsd_test_lock(rqstp, &cstate->current_fh, &file_lock);
4248         if (status)
4249                 goto out;
4250
4251         if (file_lock.fl_type != F_UNLCK) {
4252                 status = nfserr_denied;
4253                 nfs4_set_lock_denied(&file_lock, &lockt->lt_denied);
4254         }
4255 out:
4256         nfs4_unlock_state();
4257         return status;
4258 }
4259
4260 __be32
4261 nfsd4_locku(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
4262             struct nfsd4_locku *locku)
4263 {
4264         struct nfs4_ol_stateid *stp;
4265         struct file *filp = NULL;
4266         struct file_lock file_lock;
4267         __be32 status;
4268         int err;
4269
4270         dprintk("NFSD: nfsd4_locku: start=%Ld length=%Ld\n",
4271                 (long long) locku->lu_offset,
4272                 (long long) locku->lu_length);
4273
4274         if (check_lock_length(locku->lu_offset, locku->lu_length))
4275                  return nfserr_inval;
4276
4277         nfs4_lock_state();
4278
4279         status = nfs4_preprocess_seqid_op(cstate, locku->lu_seqid,
4280                                         &locku->lu_stateid, NFS4_LOCK_STID, &stp);
4281         if (status)
4282                 goto out;
4283         filp = find_any_file(stp->st_file);
4284         if (!filp) {
4285                 status = nfserr_lock_range;
4286                 goto out;
4287         }
4288         BUG_ON(!filp);
4289         locks_init_lock(&file_lock);
4290         file_lock.fl_type = F_UNLCK;
4291         file_lock.fl_owner = (fl_owner_t)lockowner(stp->st_stateowner);
4292         file_lock.fl_pid = current->tgid;
4293         file_lock.fl_file = filp;
4294         file_lock.fl_flags = FL_POSIX;
4295         file_lock.fl_lmops = &nfsd_posix_mng_ops;
4296         file_lock.fl_start = locku->lu_offset;
4297
4298         file_lock.fl_end = last_byte_offset(locku->lu_offset, locku->lu_length);
4299         nfs4_transform_lock_offset(&file_lock);
4300
4301         /*
4302         *  Try to unlock the file in the VFS.
4303         */
4304         err = vfs_lock_file(filp, F_SETLK, &file_lock, NULL);
4305         if (err) {
4306                 dprintk("NFSD: nfs4_locku: vfs_lock_file failed!\n");
4307                 goto out_nfserr;
4308         }
4309         /*
4310         * OK, unlock succeeded; the only thing left to do is update the stateid.
4311         */
4312         update_stateid(&stp->st_stid.sc_stateid);
4313         memcpy(&locku->lu_stateid, &stp->st_stid.sc_stateid, sizeof(stateid_t));
4314
4315 out:
4316         if (!cstate->replay_owner)
4317                 nfs4_unlock_state();
4318         return status;
4319
4320 out_nfserr:
4321         status = nfserrno(err);
4322         goto out;
4323 }
4324
4325 /*
4326  * returns
4327  *      1: locks held by lockowner
4328  *      0: no locks held by lockowner
4329  */
4330 static int
4331 check_for_locks(struct nfs4_file *filp, struct nfs4_lockowner *lowner)
4332 {
4333         struct file_lock **flpp;
4334         struct inode *inode = filp->fi_inode;
4335         int status = 0;
4336
4337         lock_flocks();
4338         for (flpp = &inode->i_flock; *flpp != NULL; flpp = &(*flpp)->fl_next) {
4339                 if ((*flpp)->fl_owner == (fl_owner_t)lowner) {
4340                         status = 1;
4341                         goto out;
4342                 }
4343         }
4344 out:
4345         unlock_flocks();
4346         return status;
4347 }
4348
4349 __be32
4350 nfsd4_release_lockowner(struct svc_rqst *rqstp,
4351                         struct nfsd4_compound_state *cstate,
4352                         struct nfsd4_release_lockowner *rlockowner)
4353 {
4354         clientid_t *clid = &rlockowner->rl_clientid;
4355         struct nfs4_stateowner *sop;
4356         struct nfs4_lockowner *lo;
4357         struct nfs4_ol_stateid *stp;
4358         struct xdr_netobj *owner = &rlockowner->rl_owner;
4359         struct list_head matches;
4360         unsigned int hashval = ownerstr_hashval(clid->cl_id, owner);
4361         __be32 status;
4362
4363         dprintk("nfsd4_release_lockowner clientid: (%08x/%08x):\n",
4364                 clid->cl_boot, clid->cl_id);
4365
4366         /* XXX check for lease expiration */
4367
4368         status = nfserr_stale_clientid;
4369         if (STALE_CLIENTID(clid))
4370                 return status;
4371
4372         nfs4_lock_state();
4373
4374         status = nfserr_locks_held;
4375         INIT_LIST_HEAD(&matches);
4376
4377         list_for_each_entry(sop, &ownerstr_hashtbl[hashval], so_strhash) {
4378                 if (sop->so_is_open_owner)
4379                         continue;
4380                 if (!same_owner_str(sop, owner, clid))
4381                         continue;
4382                 list_for_each_entry(stp, &sop->so_stateids,
4383                                 st_perstateowner) {
4384                         lo = lockowner(sop);
4385                         if (check_for_locks(stp->st_file, lo))
4386                                 goto out;
4387                         list_add(&lo->lo_list, &matches);
4388                 }
4389         }
4390         /* Clients probably won't expect us to return with some (but not all)
4391          * of the lockowner state released; so don't release any until all
4392          * have been checked. */
4393         status = nfs_ok;
4394         while (!list_empty(&matches)) {
4395                 lo = list_entry(matches.next, struct nfs4_lockowner,
4396                                                                 lo_list);
4397                 /* unhash_stateowner deletes so_perclient only
4398                  * for openowners. */
4399                 list_del(&lo->lo_list);
4400                 release_lockowner(lo);
4401         }
4402 out:
4403         nfs4_unlock_state();
4404         return status;
4405 }
4406
4407 static inline struct nfs4_client_reclaim *
4408 alloc_reclaim(void)
4409 {
4410         return kmalloc(sizeof(struct nfs4_client_reclaim), GFP_KERNEL);
4411 }
4412
4413 int
4414 nfs4_has_reclaimed_state(const char *name, bool use_exchange_id)
4415 {
4416         unsigned int strhashval = clientstr_hashval(name);
4417         struct nfs4_client *clp;
4418
4419         clp = find_confirmed_client_by_str(name, strhashval);
4420         if (!clp)
4421                 return 0;
4422         return test_bit(NFSD4_CLIENT_STABLE, &clp->cl_flags);
4423 }
4424
4425 /*
4426  * failure => all reset bets are off, nfserr_no_grace...
4427  */
4428 int
4429 nfs4_client_to_reclaim(const char *name)
4430 {
4431         unsigned int strhashval;
4432         struct nfs4_client_reclaim *crp = NULL;
4433
4434         dprintk("NFSD nfs4_client_to_reclaim NAME: %.*s\n", HEXDIR_LEN, name);
4435         crp = alloc_reclaim();
4436         if (!crp)
4437                 return 0;
4438         strhashval = clientstr_hashval(name);
4439         INIT_LIST_HEAD(&crp->cr_strhash);
4440         list_add(&crp->cr_strhash, &reclaim_str_hashtbl[strhashval]);
4441         memcpy(crp->cr_recdir, name, HEXDIR_LEN);
4442         reclaim_str_hashtbl_size++;
4443         return 1;
4444 }
4445
4446 void
4447 nfs4_release_reclaim(void)
4448 {
4449         struct nfs4_client_reclaim *crp = NULL;
4450         int i;
4451
4452         for (i = 0; i < CLIENT_HASH_SIZE; i++) {
4453                 while (!list_empty(&reclaim_str_hashtbl[i])) {
4454                         crp = list_entry(reclaim_str_hashtbl[i].next,
4455                                         struct nfs4_client_reclaim, cr_strhash);
4456                         list_del(&crp->cr_strhash);
4457                         kfree(crp);
4458                         reclaim_str_hashtbl_size--;
4459                 }
4460         }
4461         BUG_ON(reclaim_str_hashtbl_size);
4462 }
4463
4464 /*
4465  * called from OPEN, CLAIM_PREVIOUS with a new clientid. */
4466 struct nfs4_client_reclaim *
4467 nfsd4_find_reclaim_client(struct nfs4_client *clp)
4468 {
4469         unsigned int strhashval;
4470         struct nfs4_client_reclaim *crp = NULL;
4471
4472         dprintk("NFSD: nfs4_find_reclaim_client for %.*s with recdir %s\n",
4473                             clp->cl_name.len, clp->cl_name.data,
4474                             clp->cl_recdir);
4475
4476         /* find clp->cl_name in reclaim_str_hashtbl */
4477         strhashval = clientstr_hashval(clp->cl_recdir);
4478         list_for_each_entry(crp, &reclaim_str_hashtbl[strhashval], cr_strhash) {
4479                 if (same_name(crp->cr_recdir, clp->cl_recdir)) {
4480                         return crp;
4481                 }
4482         }
4483         return NULL;
4484 }
4485
4486 /*
4487 * Called from OPEN. Look for clientid in reclaim list.
4488 */
4489 __be32
4490 nfs4_check_open_reclaim(clientid_t *clid)
4491 {
4492         struct nfs4_client *clp;
4493
4494         /* find clientid in conf_id_hashtbl */
4495         clp = find_confirmed_client(clid);
4496         if (clp == NULL)
4497                 return nfserr_reclaim_bad;
4498
4499         return nfsd4_client_record_check(clp) ? nfserr_reclaim_bad : nfs_ok;
4500 }
4501
4502 #ifdef CONFIG_NFSD_FAULT_INJECTION
4503
4504 void nfsd_forget_clients(u64 num)
4505 {
4506         struct nfs4_client *clp, *next;
4507         int count = 0;
4508
4509         nfs4_lock_state();
4510         list_for_each_entry_safe(clp, next, &client_lru, cl_lru) {
4511                 nfsd4_client_record_remove(clp);
4512                 expire_client(clp);
4513                 if (++count == num)
4514                         break;
4515         }
4516         nfs4_unlock_state();
4517
4518         printk(KERN_INFO "NFSD: Forgot %d clients", count);
4519 }
4520
4521 static void release_lockowner_sop(struct nfs4_stateowner *sop)
4522 {
4523         release_lockowner(lockowner(sop));
4524 }
4525
4526 static void release_openowner_sop(struct nfs4_stateowner *sop)
4527 {
4528         release_openowner(openowner(sop));
4529 }
4530
4531 static int nfsd_release_n_owners(u64 num, bool is_open_owner,
4532                                 void (*release_sop)(struct nfs4_stateowner *))
4533 {
4534         int i, count = 0;
4535         struct nfs4_stateowner *sop, *next;
4536
4537         for (i = 0; i < OWNER_HASH_SIZE; i++) {
4538                 list_for_each_entry_safe(sop, next, &ownerstr_hashtbl[i], so_strhash) {
4539                         if (sop->so_is_open_owner != is_open_owner)
4540                                 continue;
4541                         release_sop(sop);
4542                         if (++count == num)
4543                                 return count;
4544                 }
4545         }
4546         return count;
4547 }
4548
4549 void nfsd_forget_locks(u64 num)
4550 {
4551         int count;
4552
4553         nfs4_lock_state();
4554         count = nfsd_release_n_owners(num, false, release_lockowner_sop);
4555         nfs4_unlock_state();
4556
4557         printk(KERN_INFO "NFSD: Forgot %d locks", count);
4558 }
4559
4560 void nfsd_forget_openowners(u64 num)
4561 {
4562         int count;
4563
4564         nfs4_lock_state();
4565         count = nfsd_release_n_owners(num, true, release_openowner_sop);
4566         nfs4_unlock_state();
4567
4568         printk(KERN_INFO "NFSD: Forgot %d open owners", count);
4569 }
4570
4571 int nfsd_process_n_delegations(u64 num, void (*deleg_func)(struct nfs4_delegation *))
4572 {
4573         int i, count = 0;
4574         struct nfs4_file *fp, *fnext;
4575         struct nfs4_delegation *dp, *dnext;
4576
4577         for (i = 0; i < FILE_HASH_SIZE; i++) {
4578                 list_for_each_entry_safe(fp, fnext, &file_hashtbl[i], fi_hash) {
4579                         list_for_each_entry_safe(dp, dnext, &fp->fi_delegations, dl_perfile) {
4580                                 deleg_func(dp);
4581                                 if (++count == num)
4582                                         return count;
4583                         }
4584                 }
4585         }
4586
4587         return count;
4588 }
4589
4590 void nfsd_forget_delegations(u64 num)
4591 {
4592         unsigned int count;
4593
4594         nfs4_lock_state();
4595         count = nfsd_process_n_delegations(num, unhash_delegation);
4596         nfs4_unlock_state();
4597
4598         printk(KERN_INFO "NFSD: Forgot %d delegations", count);
4599 }
4600
4601 void nfsd_recall_delegations(u64 num)
4602 {
4603         unsigned int count;
4604
4605         nfs4_lock_state();
4606         spin_lock(&recall_lock);
4607         count = nfsd_process_n_delegations(num, nfsd_break_one_deleg);
4608         spin_unlock(&recall_lock);
4609         nfs4_unlock_state();
4610
4611         printk(KERN_INFO "NFSD: Recalled %d delegations", count);
4612 }
4613
4614 #endif /* CONFIG_NFSD_FAULT_INJECTION */
4615
4616 /* initialization to perform at module load time: */
4617
4618 void
4619 nfs4_state_init(void)
4620 {
4621         int i;
4622
4623         for (i = 0; i < CLIENT_HASH_SIZE; i++) {
4624                 INIT_LIST_HEAD(&conf_id_hashtbl[i]);
4625                 INIT_LIST_HEAD(&conf_str_hashtbl[i]);
4626                 INIT_LIST_HEAD(&unconf_str_hashtbl[i]);
4627                 INIT_LIST_HEAD(&unconf_id_hashtbl[i]);
4628                 INIT_LIST_HEAD(&reclaim_str_hashtbl[i]);
4629         }
4630         for (i = 0; i < SESSION_HASH_SIZE; i++)
4631                 INIT_LIST_HEAD(&sessionid_hashtbl[i]);
4632         for (i = 0; i < FILE_HASH_SIZE; i++) {
4633                 INIT_LIST_HEAD(&file_hashtbl[i]);
4634         }
4635         for (i = 0; i < OWNER_HASH_SIZE; i++) {
4636                 INIT_LIST_HEAD(&ownerstr_hashtbl[i]);
4637         }
4638         for (i = 0; i < LOCKOWNER_INO_HASH_SIZE; i++)
4639                 INIT_LIST_HEAD(&lockowner_ino_hashtbl[i]);
4640         INIT_LIST_HEAD(&close_lru);
4641         INIT_LIST_HEAD(&client_lru);
4642         INIT_LIST_HEAD(&del_recall_lru);
4643         reclaim_str_hashtbl_size = 0;
4644 }
4645
4646 /*
4647  * Since the lifetime of a delegation isn't limited to that of an open, a
4648  * client may quite reasonably hang on to a delegation as long as it has
4649  * the inode cached.  This becomes an obvious problem the first time a
4650  * client's inode cache approaches the size of the server's total memory.
4651  *
4652  * For now we avoid this problem by imposing a hard limit on the number
4653  * of delegations, which varies according to the server's memory size.
4654  */
4655 static void
4656 set_max_delegations(void)
4657 {
4658         /*
4659          * Allow at most 4 delegations per megabyte of RAM.  Quick
4660          * estimates suggest that in the worst case (where every delegation
4661          * is for a different inode), a delegation could take about 1.5K,
4662          * giving a worst case usage of about 6% of memory.
4663          */
4664         max_delegations = nr_free_buffer_pages() >> (20 - 2 - PAGE_SHIFT);
4665 }
4666
4667 /* initialization to perform when the nfsd service is started: */
4668
4669 int
4670 nfs4_state_start(void)
4671 {
4672         int ret;
4673
4674         /*
4675          * FIXME: For now, we hang most of the pernet global stuff off of
4676          * init_net until nfsd is fully containerized. Eventually, we'll
4677          * need to pass a net pointer into this function, take a reference
4678          * to that instead and then do most of the rest of this on a per-net
4679          * basis.
4680          */
4681         get_net(&init_net);
4682         nfsd4_client_tracking_init(&init_net);
4683         boot_time = get_seconds();
4684         locks_start_grace(&nfsd4_manager);
4685         grace_ended = false;
4686         printk(KERN_INFO "NFSD: starting %ld-second grace period\n",
4687                nfsd4_grace);
4688         ret = set_callback_cred();
4689         if (ret) {
4690                 ret = -ENOMEM;
4691                 goto out_recovery;
4692         }
4693         laundry_wq = create_singlethread_workqueue("nfsd4");
4694         if (laundry_wq == NULL) {
4695                 ret = -ENOMEM;
4696                 goto out_recovery;
4697         }
4698         ret = nfsd4_create_callback_queue();
4699         if (ret)
4700                 goto out_free_laundry;
4701         queue_delayed_work(laundry_wq, &laundromat_work, nfsd4_grace * HZ);
4702         set_max_delegations();
4703         return 0;
4704 out_free_laundry:
4705         destroy_workqueue(laundry_wq);
4706 out_recovery:
4707         nfsd4_client_tracking_exit(&init_net);
4708         put_net(&init_net);
4709         return ret;
4710 }
4711
4712 static void
4713 __nfs4_state_shutdown(void)
4714 {
4715         int i;
4716         struct nfs4_client *clp = NULL;
4717         struct nfs4_delegation *dp = NULL;
4718         struct list_head *pos, *next, reaplist;
4719
4720         for (i = 0; i < CLIENT_HASH_SIZE; i++) {
4721                 while (!list_empty(&conf_id_hashtbl[i])) {
4722                         clp = list_entry(conf_id_hashtbl[i].next, struct nfs4_client, cl_idhash);
4723                         expire_client(clp);
4724                 }
4725                 while (!list_empty(&unconf_str_hashtbl[i])) {
4726                         clp = list_entry(unconf_str_hashtbl[i].next, struct nfs4_client, cl_strhash);
4727                         expire_client(clp);
4728                 }
4729         }
4730         INIT_LIST_HEAD(&reaplist);
4731         spin_lock(&recall_lock);
4732         list_for_each_safe(pos, next, &del_recall_lru) {
4733                 dp = list_entry (pos, struct nfs4_delegation, dl_recall_lru);
4734                 list_move(&dp->dl_recall_lru, &reaplist);
4735         }
4736         spin_unlock(&recall_lock);
4737         list_for_each_safe(pos, next, &reaplist) {
4738                 dp = list_entry (pos, struct nfs4_delegation, dl_recall_lru);
4739                 unhash_delegation(dp);
4740         }
4741
4742         nfsd4_client_tracking_exit(&init_net);
4743         put_net(&init_net);
4744 }
4745
4746 void
4747 nfs4_state_shutdown(void)
4748 {
4749         cancel_delayed_work_sync(&laundromat_work);
4750         destroy_workqueue(laundry_wq);
4751         locks_end_grace(&nfsd4_manager);
4752         nfs4_lock_state();
4753         __nfs4_state_shutdown();
4754         nfs4_unlock_state();
4755         nfsd4_destroy_callback_queue();
4756 }
4757
4758 static void
4759 get_stateid(struct nfsd4_compound_state *cstate, stateid_t *stateid)
4760 {
4761         if (HAS_STATE_ID(cstate, CURRENT_STATE_ID_FLAG) && CURRENT_STATEID(stateid))
4762                 memcpy(stateid, &cstate->current_stateid, sizeof(stateid_t));
4763 }
4764
4765 static void
4766 put_stateid(struct nfsd4_compound_state *cstate, stateid_t *stateid)
4767 {
4768         if (cstate->minorversion) {
4769                 memcpy(&cstate->current_stateid, stateid, sizeof(stateid_t));
4770                 SET_STATE_ID(cstate, CURRENT_STATE_ID_FLAG);
4771         }
4772 }
4773
4774 void
4775 clear_current_stateid(struct nfsd4_compound_state *cstate)
4776 {
4777         CLEAR_STATE_ID(cstate, CURRENT_STATE_ID_FLAG);
4778 }
4779
4780 /*
4781  * functions to set current state id
4782  */
4783 void
4784 nfsd4_set_opendowngradestateid(struct nfsd4_compound_state *cstate, struct nfsd4_open_downgrade *odp)
4785 {
4786         put_stateid(cstate, &odp->od_stateid);
4787 }
4788
4789 void
4790 nfsd4_set_openstateid(struct nfsd4_compound_state *cstate, struct nfsd4_open *open)
4791 {
4792         put_stateid(cstate, &open->op_stateid);
4793 }
4794
4795 void
4796 nfsd4_set_closestateid(struct nfsd4_compound_state *cstate, struct nfsd4_close *close)
4797 {
4798         put_stateid(cstate, &close->cl_stateid);
4799 }
4800
4801 void
4802 nfsd4_set_lockstateid(struct nfsd4_compound_state *cstate, struct nfsd4_lock *lock)
4803 {
4804         put_stateid(cstate, &lock->lk_resp_stateid);
4805 }
4806
4807 /*
4808  * functions to consume current state id
4809  */
4810
4811 void
4812 nfsd4_get_opendowngradestateid(struct nfsd4_compound_state *cstate, struct nfsd4_open_downgrade *odp)
4813 {
4814         get_stateid(cstate, &odp->od_stateid);
4815 }
4816
4817 void
4818 nfsd4_get_delegreturnstateid(struct nfsd4_compound_state *cstate, struct nfsd4_delegreturn *drp)
4819 {
4820         get_stateid(cstate, &drp->dr_stateid);
4821 }
4822
4823 void
4824 nfsd4_get_freestateid(struct nfsd4_compound_state *cstate, struct nfsd4_free_stateid *fsp)
4825 {
4826         get_stateid(cstate, &fsp->fr_stateid);
4827 }
4828
4829 void
4830 nfsd4_get_setattrstateid(struct nfsd4_compound_state *cstate, struct nfsd4_setattr *setattr)
4831 {
4832         get_stateid(cstate, &setattr->sa_stateid);
4833 }
4834
4835 void
4836 nfsd4_get_closestateid(struct nfsd4_compound_state *cstate, struct nfsd4_close *close)
4837 {
4838         get_stateid(cstate, &close->cl_stateid);
4839 }
4840
4841 void
4842 nfsd4_get_lockustateid(struct nfsd4_compound_state *cstate, struct nfsd4_locku *locku)
4843 {
4844         get_stateid(cstate, &locku->lu_stateid);
4845 }
4846
4847 void
4848 nfsd4_get_readstateid(struct nfsd4_compound_state *cstate, struct nfsd4_read *read)
4849 {
4850         get_stateid(cstate, &read->rd_stateid);
4851 }
4852
4853 void
4854 nfsd4_get_writestateid(struct nfsd4_compound_state *cstate, struct nfsd4_write *write)
4855 {
4856         get_stateid(cstate, &write->wr_stateid);
4857 }