fs/nfsd/nfs4state.c

   1 /*
   2 *  Copyright (c) 2001 The Regents of the University of Michigan.
   3 *  All rights reserved.
   4 *
   5 *  Kendrick Smith <kmsmith@umich.edu>
   6 *  Andy Adamson <kandros@umich.edu>
   7 *
   8 *  Redistribution and use in source and binary forms, with or without
   9 *  modification, are permitted provided that the following conditions
  10 *  are met:
  11 *
  12 *  1. Redistributions of source code must retain the above copyright
  13 *     notice, this list of conditions and the following disclaimer.
  14 *  2. Redistributions in binary form must reproduce the above copyright
  15 *     notice, this list of conditions and the following disclaimer in the
  16 *     documentation and/or other materials provided with the distribution.
  17 *  3. Neither the name of the University nor the names of its
  18 *     contributors may be used to endorse or promote products derived
  19 *     from this software without specific prior written permission.
  20 *
  21 *  THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
  22 *  WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
  23 *  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
  24 *  DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
  25 *  FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  26 *  CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  27 *  SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
  28 *  BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
  29 *  LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
  30 *  NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
  31 *  SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  32 *
  33 */
  34
  35 #include <linux/file.h>
  36 #include <linux/fs.h>
  37 #include <linux/slab.h>
  38 #include <linux/namei.h>
  39 #include <linux/swap.h>
  40 #include <linux/pagemap.h>
  41 #include <linux/ratelimit.h>
  42 #include <linux/sunrpc/svcauth_gss.h>
  43 #include <linux/sunrpc/addr.h>
  44 #include "xdr4.h"
  45 #include "xdr4cb.h"
  46 #include "vfs.h"
  47 #include "current_stateid.h"
  48
  49 #include "netns.h"
  50
  51 #define NFSDDBG_FACILITY                NFSDDBG_PROC
  52
  53 #define all_ones {{~0,~0},~0}
  54 static const stateid_t one_stateid = {
  55         .si_generation = ~0,
  56         .si_opaque = all_ones,
  57 };
  58 static const stateid_t zero_stateid = {
  59         /* all fields zero */
  60 };
  61 static const stateid_t currentstateid = {
  62         .si_generation = 1,
  63 };
  64
  65 static u64 current_sessionid = 1;
  66
  67 #define ZERO_STATEID(stateid) (!memcmp((stateid), &zero_stateid, sizeof(stateid_t)))
  68 #define ONE_STATEID(stateid)  (!memcmp((stateid), &one_stateid, sizeof(stateid_t)))
  69 #define CURRENT_STATEID(stateid) (!memcmp((stateid), &currentstateid, sizeof(stateid_t)))
  70
  71 /* forward declarations */
  72 static int check_for_locks(struct nfs4_file *filp, struct nfs4_lockowner *lowner);
  73
  74 /* Locking: */
  75
  76 /* Currently used for almost all code touching nfsv4 state: */
  77 static DEFINE_MUTEX(client_mutex);
  78
  79 /*
  80  * Currently used for the del_recall_lru and file hash table.  In an
  81  * effort to decrease the scope of the client_mutex, this spinlock may
  82  * eventually cover more:
  83  */
  84 static DEFINE_SPINLOCK(recall_lock);
  85
  86 static struct kmem_cache *openowner_slab = NULL;
  87 static struct kmem_cache *lockowner_slab = NULL;
  88 static struct kmem_cache *file_slab = NULL;
  89 static struct kmem_cache *stateid_slab = NULL;
  90 static struct kmem_cache *deleg_slab = NULL;
  91
  92 void
  93 nfs4_lock_state(void)
  94 {
  95         mutex_lock(&client_mutex);
  96 }
  97
  98 static void free_session(struct nfsd4_session *);
  99
 100 void nfsd4_put_session(struct nfsd4_session *ses)
 101 {
 102         atomic_dec(&ses->se_ref);
 103 }
 104
 105 static bool is_session_dead(struct nfsd4_session *ses)
 106 {
 107         return ses->se_flags & NFS4_SESSION_DEAD;
 108 }
 109
 110 static __be32 mark_session_dead_locked(struct nfsd4_session *ses)
 111 {
 112         if (atomic_read(&ses->se_ref))
 113                 return nfserr_jukebox;
 114         ses->se_flags |= NFS4_SESSION_DEAD;
 115         return nfs_ok;
 116 }
 117
 118 static __be32 nfsd4_get_session_locked(struct nfsd4_session *ses)
 119 {
 120         if (is_session_dead(ses))
 121                 return nfserr_badsession;
 122         atomic_inc(&ses->se_ref);
 123         return nfs_ok;
 124 }
 125
 126 void
 127 nfs4_unlock_state(void)
 128 {
 129         mutex_unlock(&client_mutex);
 130 }
 131
 132 static bool is_client_expired(struct nfs4_client *clp)
 133 {
 134         return clp->cl_time == 0;
 135 }
 136
 137 static __be32 mark_client_expired_locked(struct nfs4_client *clp)
 138 {
 139         if (atomic_read(&clp->cl_refcount))
 140                 return nfserr_jukebox;
 141         clp->cl_time = 0;
 142         return nfs_ok;
 143 }
 144
 145 static __be32 mark_client_expired(struct nfs4_client *clp)
 146 {
 147         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
 148         __be32 ret;
 149
 150         spin_lock(&nn->client_lock);
 151         ret = mark_client_expired_locked(clp);
 152         spin_unlock(&nn->client_lock);
 153         return ret;
 154 }
 155
 156 static __be32 get_client_locked(struct nfs4_client *clp)
 157 {
 158         if (is_client_expired(clp))
 159                 return nfserr_expired;
 160         atomic_inc(&clp->cl_refcount);
 161         return nfs_ok;
 162 }
 163
 164 /* must be called under the client_lock */
 165 static inline void
 166 renew_client_locked(struct nfs4_client *clp)
 167 {
 168         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
 169
 170         if (is_client_expired(clp)) {
 171                 WARN_ON(1);
 172                 printk("%s: client (clientid %08x/%08x) already expired\n",
 173                         __func__,
 174                         clp->cl_clientid.cl_boot,
 175                         clp->cl_clientid.cl_id);
 176                 return;
 177         }
 178
 179         dprintk("renewing client (clientid %08x/%08x)\n",
 180                         clp->cl_clientid.cl_boot,
 181                         clp->cl_clientid.cl_id);
 182         list_move_tail(&clp->cl_lru, &nn->client_lru);
 183         clp->cl_time = get_seconds();
 184 }
 185
 186 static inline void
 187 renew_client(struct nfs4_client *clp)
 188 {
 189         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
 190
 191         spin_lock(&nn->client_lock);
 192         renew_client_locked(clp);
 193         spin_unlock(&nn->client_lock);
 194 }
 195
 196 static void put_client_renew_locked(struct nfs4_client *clp)
 197 {
 198         if (!atomic_dec_and_test(&clp->cl_refcount))
 199                 return;
 200         if (!is_client_expired(clp))
 201                 renew_client_locked(clp);
 202 }
 203
 204 void put_client_renew(struct nfs4_client *clp)
 205 {
 206         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
 207
 208         if (!atomic_dec_and_lock(&clp->cl_refcount, &nn->client_lock))
 209                 return;
 210         if (!is_client_expired(clp))
 211                 renew_client_locked(clp);
 212         spin_unlock(&nn->client_lock);
 213 }
 214
 215
 216 static inline u32
 217 opaque_hashval(const void *ptr, int nbytes)
 218 {
 219         unsigned char *cptr = (unsigned char *) ptr;
 220
 221         u32 x = 0;
 222         while (nbytes--) {
 223                 x *= 37;
 224                 x += *cptr++;
 225         }
 226         return x;
 227 }
 228
 229 static void nfsd4_free_file(struct nfs4_file *f)
 230 {
 231         kmem_cache_free(file_slab, f);
 232 }
 233
 234 static inline void
 235 put_nfs4_file(struct nfs4_file *fi)
 236 {
 237         if (atomic_dec_and_lock(&fi->fi_ref, &recall_lock)) {
 238                 hlist_del(&fi->fi_hash);
 239                 spin_unlock(&recall_lock);
 240                 iput(fi->fi_inode);
 241                 nfsd4_free_file(fi);
 242         }
 243 }
 244
 245 static inline void
 246 get_nfs4_file(struct nfs4_file *fi)
 247 {
 248         atomic_inc(&fi->fi_ref);
 249 }
 250
 251 static int num_delegations;
 252 unsigned long max_delegations;
 253
 254 /*
 255  * Open owner state (share locks)
 256  */
 257
 258 /* hash tables for lock and open owners */
 259 #define OWNER_HASH_BITS              8
 260 #define OWNER_HASH_SIZE             (1 << OWNER_HASH_BITS)
 261 #define OWNER_HASH_MASK             (OWNER_HASH_SIZE - 1)
 262
 263 static unsigned int ownerstr_hashval(u32 clientid, struct xdr_netobj *ownername)
 264 {
 265         unsigned int ret;
 266
 267         ret = opaque_hashval(ownername->data, ownername->len);
 268         ret += clientid;
 269         return ret & OWNER_HASH_MASK;
 270 }
 271
 272 /* hash table for nfs4_file */
 273 #define FILE_HASH_BITS                   8
 274 #define FILE_HASH_SIZE                  (1 << FILE_HASH_BITS)
 275
 276 static unsigned int file_hashval(struct inode *ino)
 277 {
 278         /* XXX: why are we hashing on inode pointer, anyway? */
 279         return hash_ptr(ino, FILE_HASH_BITS);
 280 }
 281
 282 static struct hlist_head file_hashtbl[FILE_HASH_SIZE];
 283
 284 static void __nfs4_file_get_access(struct nfs4_file *fp, int oflag)
 285 {
 286         WARN_ON_ONCE(!(fp->fi_fds[oflag] || fp->fi_fds[O_RDWR]));
 287         atomic_inc(&fp->fi_access[oflag]);
 288 }
 289
 290 static void nfs4_file_get_access(struct nfs4_file *fp, int oflag)
 291 {
 292         if (oflag == O_RDWR) {
 293                 __nfs4_file_get_access(fp, O_RDONLY);
 294                 __nfs4_file_get_access(fp, O_WRONLY);
 295         } else
 296                 __nfs4_file_get_access(fp, oflag);
 297 }
 298
 299 static void nfs4_file_put_fd(struct nfs4_file *fp, int oflag)
 300 {
 301         if (fp->fi_fds[oflag]) {
 302                 fput(fp->fi_fds[oflag]);
 303                 fp->fi_fds[oflag] = NULL;
 304         }
 305 }
 306
 307 static void __nfs4_file_put_access(struct nfs4_file *fp, int oflag)
 308 {
 309         if (atomic_dec_and_test(&fp->fi_access[oflag])) {
 310                 nfs4_file_put_fd(fp, oflag);
 311                 if (atomic_read(&fp->fi_access[1 - oflag]) == 0)
 312                         nfs4_file_put_fd(fp, O_RDWR);
 313         }
 314 }
 315
 316 static void nfs4_file_put_access(struct nfs4_file *fp, int oflag)
 317 {
 318         if (oflag == O_RDWR) {
 319                 __nfs4_file_put_access(fp, O_RDONLY);
 320                 __nfs4_file_put_access(fp, O_WRONLY);
 321         } else
 322                 __nfs4_file_put_access(fp, oflag);
 323 }
 324
 325 static struct nfs4_stid *nfs4_alloc_stid(struct nfs4_client *cl, struct
 326 kmem_cache *slab)
 327 {
 328         struct idr *stateids = &cl->cl_stateids;
 329         struct nfs4_stid *stid;
 330         int new_id;
 331
 332         stid = kmem_cache_alloc(slab, GFP_KERNEL);
 333         if (!stid)
 334                 return NULL;
 335
 336         new_id = idr_alloc_cyclic(stateids, stid, 0, 0, GFP_KERNEL);
 337         if (new_id < 0)
 338                 goto out_free;
 339         stid->sc_client = cl;
 340         stid->sc_type = 0;
 341         stid->sc_stateid.si_opaque.so_id = new_id;
 342         stid->sc_stateid.si_opaque.so_clid = cl->cl_clientid;
 343         /* Will be incremented before return to client: */
 344         stid->sc_stateid.si_generation = 0;
 345
 346         /*
 347          * It shouldn't be a problem to reuse an opaque stateid value.
 348          * I don't think it is for 4.1.  But with 4.0 I worry that, for
 349          * example, a stray write retransmission could be accepted by
 350          * the server when it should have been rejected.  Therefore,
 351          * adopt a trick from the sctp code to attempt to maximize the
 352          * amount of time until an id is reused, by ensuring they always
 353          * "increase" (mod INT_MAX):
 354          */
 355         return stid;
 356 out_free:
 357         kmem_cache_free(slab, stid);
 358         return NULL;
 359 }
 360
 361 static struct nfs4_ol_stateid * nfs4_alloc_stateid(struct nfs4_client *clp)
 362 {
 363         return openlockstateid(nfs4_alloc_stid(clp, stateid_slab));
 364 }
 365
 366 static struct nfs4_delegation *
 367 alloc_init_deleg(struct nfs4_client *clp, struct nfs4_ol_stateid *stp, struct svc_fh *current_fh, u32 type)
 368 {
 369         struct nfs4_delegation *dp;
 370
 371         dprintk("NFSD alloc_init_deleg\n");
 372         /*
 373          * Major work on the lease subsystem (for example, to support
 374          * calbacks on stat) will be required before we can support
 375          * write delegations properly.
 376          */
 377         if (type != NFS4_OPEN_DELEGATE_READ)
 378                 return NULL;
 379         if (num_delegations > max_delegations)
 380                 return NULL;
 381         dp = delegstateid(nfs4_alloc_stid(clp, deleg_slab));
 382         if (dp == NULL)
 383                 return dp;
 384         dp->dl_stid.sc_type = NFS4_DELEG_STID;
 385         /*
 386          * delegation seqid's are never incremented.  The 4.1 special
 387          * meaning of seqid 0 isn't meaningful, really, but let's avoid
 388          * 0 anyway just for consistency and use 1:
 389          */
 390         dp->dl_stid.sc_stateid.si_generation = 1;
 391         num_delegations++;
 392         INIT_LIST_HEAD(&dp->dl_perfile);
 393         INIT_LIST_HEAD(&dp->dl_perclnt);
 394         INIT_LIST_HEAD(&dp->dl_recall_lru);
 395         dp->dl_file = NULL;
 396         dp->dl_type = type;
 397         fh_copy_shallow(&dp->dl_fh, &current_fh->fh_handle);
 398         dp->dl_time = 0;
 399         atomic_set(&dp->dl_count, 1);
 400         nfsd4_init_callback(&dp->dl_recall);
 401         return dp;
 402 }
 403
 404 static void remove_stid(struct nfs4_stid *s)
 405 {
 406         struct idr *stateids = &s->sc_client->cl_stateids;
 407
 408         idr_remove(stateids, s->sc_stateid.si_opaque.so_id);
 409 }
 410
 411 void
 412 nfs4_put_delegation(struct nfs4_delegation *dp)
 413 {
 414         if (atomic_dec_and_test(&dp->dl_count)) {
 415                 kmem_cache_free(deleg_slab, dp);
 416                 num_delegations--;
 417         }
 418 }
 419
 420 static void nfs4_put_deleg_lease(struct nfs4_file *fp)
 421 {
 422         if (atomic_dec_and_test(&fp->fi_delegees)) {
 423                 vfs_setlease(fp->fi_deleg_file, F_UNLCK, &fp->fi_lease);
 424                 fp->fi_lease = NULL;
 425                 fput(fp->fi_deleg_file);
 426                 fp->fi_deleg_file = NULL;
 427         }
 428 }
 429
 430 static void unhash_stid(struct nfs4_stid *s)
 431 {
 432         s->sc_type = 0;
 433 }
 434
 435 /* Called under the state lock. */
 436 static void
 437 unhash_delegation(struct nfs4_delegation *dp)
 438 {
 439         list_del_init(&dp->dl_perclnt);
 440         spin_lock(&recall_lock);
 441         list_del_init(&dp->dl_perfile);
 442         list_del_init(&dp->dl_recall_lru);
 443         spin_unlock(&recall_lock);
 444         nfs4_put_deleg_lease(dp->dl_file);
 445         put_nfs4_file(dp->dl_file);
 446         dp->dl_file = NULL;
 447 }
 448
 449
 450
 451 static void destroy_revoked_delegation(struct nfs4_delegation *dp)
 452 {
 453         list_del_init(&dp->dl_recall_lru);
 454         remove_stid(&dp->dl_stid);
 455         nfs4_put_delegation(dp);
 456 }
 457
 458 static void destroy_delegation(struct nfs4_delegation *dp)
 459 {
 460         unhash_delegation(dp);
 461         remove_stid(&dp->dl_stid);
 462         nfs4_put_delegation(dp);
 463 }
 464
 465 static void revoke_delegation(struct nfs4_delegation *dp)
 466 {
 467         struct nfs4_client *clp = dp->dl_stid.sc_client;
 468
 469         if (clp->cl_minorversion == 0)
 470                 destroy_delegation(dp);
 471         else {
 472                 unhash_delegation(dp);
 473                 dp->dl_stid.sc_type = NFS4_REVOKED_DELEG_STID;
 474                 list_add(&dp->dl_recall_lru, &clp->cl_revoked);
 475         }
 476 }
 477
 478 /*
 479  * SETCLIENTID state
 480  */
 481
 482 static unsigned int clientid_hashval(u32 id)
 483 {
 484         return id & CLIENT_HASH_MASK;
 485 }
 486
 487 static unsigned int clientstr_hashval(const char *name)
 488 {
 489         return opaque_hashval(name, 8) & CLIENT_HASH_MASK;
 490 }
 491
 492 /*
 493  * We store the NONE, READ, WRITE, and BOTH bits separately in the
 494  * st_{access,deny}_bmap field of the stateid, in order to track not
 495  * only what share bits are currently in force, but also what
 496  * combinations of share bits previous opens have used.  This allows us
 497  * to enforce the recommendation of rfc 3530 14.2.19 that the server
 498  * return an error if the client attempt to downgrade to a combination
 499  * of share bits not explicable by closing some of its previous opens.
 500  *
 501  * XXX: This enforcement is actually incomplete, since we don't keep
 502  * track of access/deny bit combinations; so, e.g., we allow:
 503  *
 504  *      OPEN allow read, deny write
 505  *      OPEN allow both, deny none
 506  *      DOWNGRADE allow read, deny none
 507  *
 508  * which we should reject.
 509  */
 510 static unsigned int
 511 bmap_to_share_mode(unsigned long bmap) {
 512         int i;
 513         unsigned int access = 0;
 514
 515         for (i = 1; i < 4; i++) {
 516                 if (test_bit(i, &bmap))
 517                         access |= i;
 518         }
 519         return access;
 520 }
 521
 522 static bool
 523 test_share(struct nfs4_ol_stateid *stp, struct nfsd4_open *open) {
 524         unsigned int access, deny;
 525
 526         access = bmap_to_share_mode(stp->st_access_bmap);
 527         deny = bmap_to_share_mode(stp->st_deny_bmap);
 528         if ((access & open->op_share_deny) || (deny & open->op_share_access))
 529                 return false;
 530         return true;
 531 }
 532
 533 /* set share access for a given stateid */
 534 static inline void
 535 set_access(u32 access, struct nfs4_ol_stateid *stp)
 536 {
 537         __set_bit(access, &stp->st_access_bmap);
 538 }
 539
 540 /* clear share access for a given stateid */
 541 static inline void
 542 clear_access(u32 access, struct nfs4_ol_stateid *stp)
 543 {
 544         __clear_bit(access, &stp->st_access_bmap);
 545 }
 546
 547 /* test whether a given stateid has access */
 548 static inline bool
 549 test_access(u32 access, struct nfs4_ol_stateid *stp)
 550 {
 551         return test_bit(access, &stp->st_access_bmap);
 552 }
 553
 554 /* set share deny for a given stateid */
 555 static inline void
 556 set_deny(u32 access, struct nfs4_ol_stateid *stp)
 557 {
 558         __set_bit(access, &stp->st_deny_bmap);
 559 }
 560
 561 /* clear share deny for a given stateid */
 562 static inline void
 563 clear_deny(u32 access, struct nfs4_ol_stateid *stp)
 564 {
 565         __clear_bit(access, &stp->st_deny_bmap);
 566 }
 567
 568 /* test whether a given stateid is denying specific access */
 569 static inline bool
 570 test_deny(u32 access, struct nfs4_ol_stateid *stp)
 571 {
 572         return test_bit(access, &stp->st_deny_bmap);
 573 }
 574
 575 static int nfs4_access_to_omode(u32 access)
 576 {
 577         switch (access & NFS4_SHARE_ACCESS_BOTH) {
 578         case NFS4_SHARE_ACCESS_READ:
 579                 return O_RDONLY;
 580         case NFS4_SHARE_ACCESS_WRITE:
 581                 return O_WRONLY;
 582         case NFS4_SHARE_ACCESS_BOTH:
 583                 return O_RDWR;
 584         }
 585         WARN_ON_ONCE(1);
 586         return O_RDONLY;
 587 }
 588
 589 /* release all access and file references for a given stateid */
 590 static void
 591 release_all_access(struct nfs4_ol_stateid *stp)
 592 {
 593         int i;
 594
 595         for (i = 1; i < 4; i++) {
 596                 if (test_access(i, stp))
 597                         nfs4_file_put_access(stp->st_file,
 598                                              nfs4_access_to_omode(i));
 599                 clear_access(i, stp);
 600         }
 601 }
 602
 603 static void unhash_generic_stateid(struct nfs4_ol_stateid *stp)
 604 {
 605         list_del(&stp->st_perfile);
 606         list_del(&stp->st_perstateowner);
 607 }
 608
 609 static void close_generic_stateid(struct nfs4_ol_stateid *stp)
 610 {
 611         release_all_access(stp);
 612         put_nfs4_file(stp->st_file);
 613         stp->st_file = NULL;
 614 }
 615
 616 static void free_generic_stateid(struct nfs4_ol_stateid *stp)
 617 {
 618         remove_stid(&stp->st_stid);
 619         kmem_cache_free(stateid_slab, stp);
 620 }
 621
 622 static void release_lock_stateid(struct nfs4_ol_stateid *stp)
 623 {
 624         struct file *file;
 625
 626         unhash_generic_stateid(stp);
 627         unhash_stid(&stp->st_stid);
 628         file = find_any_file(stp->st_file);
 629         if (file)
 630                 locks_remove_posix(file, (fl_owner_t)lockowner(stp->st_stateowner));
 631         close_generic_stateid(stp);
 632         free_generic_stateid(stp);
 633 }
 634
 635 static void unhash_lockowner(struct nfs4_lockowner *lo)
 636 {
 637         struct nfs4_ol_stateid *stp;
 638
 639         list_del(&lo->lo_owner.so_strhash);
 640         list_del(&lo->lo_perstateid);
 641         list_del(&lo->lo_owner_ino_hash);
 642         while (!list_empty(&lo->lo_owner.so_stateids)) {
 643                 stp = list_first_entry(&lo->lo_owner.so_stateids,
 644                                 struct nfs4_ol_stateid, st_perstateowner);
 645                 release_lock_stateid(stp);
 646         }
 647 }
 648
 649 static void release_lockowner(struct nfs4_lockowner *lo)
 650 {
 651         unhash_lockowner(lo);
 652         nfs4_free_lockowner(lo);
 653 }
 654
 655 static void
 656 release_stateid_lockowners(struct nfs4_ol_stateid *open_stp)
 657 {
 658         struct nfs4_lockowner *lo;
 659
 660         while (!list_empty(&open_stp->st_lockowners)) {
 661                 lo = list_entry(open_stp->st_lockowners.next,
 662                                 struct nfs4_lockowner, lo_perstateid);
 663                 release_lockowner(lo);
 664         }
 665 }
 666
 667 static void unhash_open_stateid(struct nfs4_ol_stateid *stp)
 668 {
 669         unhash_generic_stateid(stp);
 670         release_stateid_lockowners(stp);
 671         close_generic_stateid(stp);
 672 }
 673
 674 static void release_open_stateid(struct nfs4_ol_stateid *stp)
 675 {
 676         unhash_open_stateid(stp);
 677         unhash_stid(&stp->st_stid);
 678         free_generic_stateid(stp);
 679 }
 680
 681 static void unhash_openowner(struct nfs4_openowner *oo)
 682 {
 683         struct nfs4_ol_stateid *stp;
 684
 685         list_del(&oo->oo_owner.so_strhash);
 686         list_del(&oo->oo_perclient);
 687         while (!list_empty(&oo->oo_owner.so_stateids)) {
 688                 stp = list_first_entry(&oo->oo_owner.so_stateids,
 689                                 struct nfs4_ol_stateid, st_perstateowner);
 690                 release_open_stateid(stp);
 691         }
 692 }
 693
 694 static void release_last_closed_stateid(struct nfs4_openowner *oo)
 695 {
 696         struct nfs4_ol_stateid *s = oo->oo_last_closed_stid;
 697
 698         if (s) {
 699                 unhash_stid(&s->st_stid);
 700                 free_generic_stateid(s);
 701                 oo->oo_last_closed_stid = NULL;
 702         }
 703 }
 704
 705 static void release_openowner(struct nfs4_openowner *oo)
 706 {
 707         unhash_openowner(oo);
 708         list_del(&oo->oo_close_lru);
 709         release_last_closed_stateid(oo);
 710         nfs4_free_openowner(oo);
 711 }
 712
 713 static inline int
 714 hash_sessionid(struct nfs4_sessionid *sessionid)
 715 {
 716         struct nfsd4_sessionid *sid = (struct nfsd4_sessionid *)sessionid;
 717
 718         return sid->sequence % SESSION_HASH_SIZE;
 719 }
 720
 721 #ifdef NFSD_DEBUG
 722 static inline void
 723 dump_sessionid(const char *fn, struct nfs4_sessionid *sessionid)
 724 {
 725         u32 *ptr = (u32 *)(&sessionid->data[0]);
 726         dprintk("%s: %u:%u:%u:%u\n", fn, ptr[0], ptr[1], ptr[2], ptr[3]);
 727 }
 728 #else
 729 static inline void
 730 dump_sessionid(const char *fn, struct nfs4_sessionid *sessionid)
 731 {
 732 }
 733 #endif
 734
 735 /*
 736  * Bump the seqid on cstate->replay_owner, and clear replay_owner if it
 737  * won't be used for replay.
 738  */
 739 void nfsd4_bump_seqid(struct nfsd4_compound_state *cstate, __be32 nfserr)
 740 {
 741         struct nfs4_stateowner *so = cstate->replay_owner;
 742
 743         if (nfserr == nfserr_replay_me)
 744                 return;
 745
 746         if (!seqid_mutating_err(ntohl(nfserr))) {
 747                 cstate->replay_owner = NULL;
 748                 return;
 749         }
 750         if (!so)
 751                 return;
 752         if (so->so_is_open_owner)
 753                 release_last_closed_stateid(openowner(so));
 754         so->so_seqid++;
 755         return;
 756 }
 757
 758 static void
 759 gen_sessionid(struct nfsd4_session *ses)
 760 {
 761         struct nfs4_client *clp = ses->se_client;
 762         struct nfsd4_sessionid *sid;
 763
 764         sid = (struct nfsd4_sessionid *)ses->se_sessionid.data;
 765         sid->clientid = clp->cl_clientid;
 766         sid->sequence = current_sessionid++;
 767         sid->reserved = 0;
 768 }
 769
 770 /*
 771  * The protocol defines ca_maxresponssize_cached to include the size of
 772  * the rpc header, but all we need to cache is the data starting after
 773  * the end of the initial SEQUENCE operation--the rest we regenerate
 774  * each time.  Therefore we can advertise a ca_maxresponssize_cached
 775  * value that is the number of bytes in our cache plus a few additional
 776  * bytes.  In order to stay on the safe side, and not promise more than
 777  * we can cache, those additional bytes must be the minimum possible: 24
 778  * bytes of rpc header (xid through accept state, with AUTH_NULL
 779  * verifier), 12 for the compound header (with zero-length tag), and 44
 780  * for the SEQUENCE op response:
 781  */
 782 #define NFSD_MIN_HDR_SEQ_SZ  (24 + 12 + 44)
 783
 784 static void
 785 free_session_slots(struct nfsd4_session *ses)
 786 {
 787         int i;
 788
 789         for (i = 0; i < ses->se_fchannel.maxreqs; i++)
 790                 kfree(ses->se_slots[i]);
 791 }
 792
 793 /*
 794  * We don't actually need to cache the rpc and session headers, so we
 795  * can allocate a little less for each slot:
 796  */
 797 static inline u32 slot_bytes(struct nfsd4_channel_attrs *ca)
 798 {
 799         u32 size;
 800
 801         if (ca->maxresp_cached < NFSD_MIN_HDR_SEQ_SZ)
 802                 size = 0;
 803         else
 804                 size = ca->maxresp_cached - NFSD_MIN_HDR_SEQ_SZ;
 805         return size + sizeof(struct nfsd4_slot);
 806 }
 807
 808 /*
 809  * XXX: If we run out of reserved DRC memory we could (up to a point)
 810  * re-negotiate active sessions and reduce their slot usage to make
 811  * room for new connections. For now we just fail the create session.
 812  */
 813 static u32 nfsd4_get_drc_mem(struct nfsd4_channel_attrs *ca)
 814 {
 815         u32 slotsize = slot_bytes(ca);
 816         u32 num = ca->maxreqs;
 817         int avail;
 818
 819         spin_lock(&nfsd_drc_lock);
 820         avail = min((unsigned long)NFSD_MAX_MEM_PER_SESSION,
 821                     nfsd_drc_max_mem - nfsd_drc_mem_used);
 822         num = min_t(int, num, avail / slotsize);
 823         nfsd_drc_mem_used += num * slotsize;
 824         spin_unlock(&nfsd_drc_lock);
 825
 826         return num;
 827 }
 828
 829 static void nfsd4_put_drc_mem(struct nfsd4_channel_attrs *ca)
 830 {
 831         int slotsize = slot_bytes(ca);
 832
 833         spin_lock(&nfsd_drc_lock);
 834         nfsd_drc_mem_used -= slotsize * ca->maxreqs;
 835         spin_unlock(&nfsd_drc_lock);
 836 }
 837
 838 static struct nfsd4_session *alloc_session(struct nfsd4_channel_attrs *attrs)
 839 {
 840         int numslots = attrs->maxreqs;
 841         int slotsize = slot_bytes(attrs);
 842         struct nfsd4_session *new;
 843         int mem, i;
 844
 845         BUILD_BUG_ON(NFSD_MAX_SLOTS_PER_SESSION * sizeof(struct nfsd4_slot *)
 846                         + sizeof(struct nfsd4_session) > PAGE_SIZE);
 847         mem = numslots * sizeof(struct nfsd4_slot *);
 848
 849         new = kzalloc(sizeof(*new) + mem, GFP_KERNEL);
 850         if (!new)
 851                 return NULL;
 852         /* allocate each struct nfsd4_slot and data cache in one piece */
 853         for (i = 0; i < numslots; i++) {
 854                 new->se_slots[i] = kzalloc(slotsize, GFP_KERNEL);
 855                 if (!new->se_slots[i])
 856                         goto out_free;
 857         }
 858         return new;
 859 out_free:
 860         while (i--)
 861                 kfree(new->se_slots[i]);
 862         kfree(new);
 863         return NULL;
 864 }
 865
 866 static void free_conn(struct nfsd4_conn *c)
 867 {
 868         svc_xprt_put(c->cn_xprt);
 869         kfree(c);
 870 }
 871
 872 static void nfsd4_conn_lost(struct svc_xpt_user *u)
 873 {
 874         struct nfsd4_conn *c = container_of(u, struct nfsd4_conn, cn_xpt_user);
 875         struct nfs4_client *clp = c->cn_session->se_client;
 876
 877         spin_lock(&clp->cl_lock);
 878         if (!list_empty(&c->cn_persession)) {
 879                 list_del(&c->cn_persession);
 880                 free_conn(c);
 881         }
 882         nfsd4_probe_callback(clp);
 883         spin_unlock(&clp->cl_lock);
 884 }
 885
 886 static struct nfsd4_conn *alloc_conn(struct svc_rqst *rqstp, u32 flags)
 887 {
 888         struct nfsd4_conn *conn;
 889
 890         conn = kmalloc(sizeof(struct nfsd4_conn), GFP_KERNEL);
 891         if (!conn)
 892                 return NULL;
 893         svc_xprt_get(rqstp->rq_xprt);
 894         conn->cn_xprt = rqstp->rq_xprt;
 895         conn->cn_flags = flags;
 896         INIT_LIST_HEAD(&conn->cn_xpt_user.list);
 897         return conn;
 898 }
 899
 900 static void __nfsd4_hash_conn(struct nfsd4_conn *conn, struct nfsd4_session *ses)
 901 {
 902         conn->cn_session = ses;
 903         list_add(&conn->cn_persession, &ses->se_conns);
 904 }
 905
 906 static void nfsd4_hash_conn(struct nfsd4_conn *conn, struct nfsd4_session *ses)
 907 {
 908         struct nfs4_client *clp = ses->se_client;
 909
 910         spin_lock(&clp->cl_lock);
 911         __nfsd4_hash_conn(conn, ses);
 912         spin_unlock(&clp->cl_lock);
 913 }
 914
 915 static int nfsd4_register_conn(struct nfsd4_conn *conn)
 916 {
 917         conn->cn_xpt_user.callback = nfsd4_conn_lost;
 918         return register_xpt_user(conn->cn_xprt, &conn->cn_xpt_user);
 919 }
 920
 921 static void nfsd4_init_conn(struct svc_rqst *rqstp, struct nfsd4_conn *conn, struct nfsd4_session *ses)
 922 {
 923         int ret;
 924
 925         nfsd4_hash_conn(conn, ses);
 926         ret = nfsd4_register_conn(conn);
 927         if (ret)
 928                 /* oops; xprt is already down: */
 929                 nfsd4_conn_lost(&conn->cn_xpt_user);
 930         if (conn->cn_flags & NFS4_CDFC4_BACK) {
 931                 /* callback channel may be back up */
 932                 nfsd4_probe_callback(ses->se_client);
 933         }
 934 }
 935
 936 static struct nfsd4_conn *alloc_conn_from_crses(struct svc_rqst *rqstp, struct nfsd4_create_session *cses)
 937 {
 938         u32 dir = NFS4_CDFC4_FORE;
 939
 940         if (cses->flags & SESSION4_BACK_CHAN)
 941                 dir |= NFS4_CDFC4_BACK;
 942         return alloc_conn(rqstp, dir);
 943 }
 944
 945 /* must be called under client_lock */
 946 static void nfsd4_del_conns(struct nfsd4_session *s)
 947 {
 948         struct nfs4_client *clp = s->se_client;
 949         struct nfsd4_conn *c;
 950
 951         spin_lock(&clp->cl_lock);
 952         while (!list_empty(&s->se_conns)) {
 953                 c = list_first_entry(&s->se_conns, struct nfsd4_conn, cn_persession);
 954                 list_del_init(&c->cn_persession);
 955                 spin_unlock(&clp->cl_lock);
 956
 957                 unregister_xpt_user(c->cn_xprt, &c->cn_xpt_user);
 958                 free_conn(c);
 959
 960                 spin_lock(&clp->cl_lock);
 961         }
 962         spin_unlock(&clp->cl_lock);
 963 }
 964
 965 static void __free_session(struct nfsd4_session *ses)
 966 {
 967         free_session_slots(ses);
 968         kfree(ses);
 969 }
 970
 971 static void free_session(struct nfsd4_session *ses)
 972 {
 973         struct nfsd_net *nn = net_generic(ses->se_client->net, nfsd_net_id);
 974
 975         lockdep_assert_held(&nn->client_lock);
 976         nfsd4_del_conns(ses);
 977         nfsd4_put_drc_mem(&ses->se_fchannel);
 978         __free_session(ses);
 979 }
 980
 981 static void init_session(struct svc_rqst *rqstp, struct nfsd4_session *new, struct nfs4_client *clp, struct nfsd4_create_session *cses)
 982 {
 983         int idx;
 984         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
 985
 986         new->se_client = clp;
 987         gen_sessionid(new);
 988
 989         INIT_LIST_HEAD(&new->se_conns);
 990
 991         new->se_cb_seq_nr = 1;
 992         new->se_flags = cses->flags;
 993         new->se_cb_prog = cses->callback_prog;
 994         new->se_cb_sec = cses->cb_sec;
 995         atomic_set(&new->se_ref, 0);
 996         idx = hash_sessionid(&new->se_sessionid);
 997         spin_lock(&nn->client_lock);
 998         list_add(&new->se_hash, &nn->sessionid_hashtbl[idx]);
 999         spin_lock(&clp->cl_lock);
1000         list_add(&new->se_perclnt, &clp->cl_sessions);
1001         spin_unlock(&clp->cl_lock);
1002         spin_unlock(&nn->client_lock);
1003         memcpy(&new->se_fchannel, &cses->fore_channel,
1004                         sizeof(struct nfsd4_channel_attrs));
1005         if (cses->flags & SESSION4_BACK_CHAN) {
1006                 struct sockaddr *sa = svc_addr(rqstp);
1007                 /*
1008                  * This is a little silly; with sessions there's no real
1009                  * use for the callback address.  Use the peer address
1010                  * as a reasonable default for now, but consider fixing
1011                  * the rpc client not to require an address in the
1012                  * future:
1013                  */
1014                 rpc_copy_addr((struct sockaddr *)&clp->cl_cb_conn.cb_addr, sa);
1015                 clp->cl_cb_conn.cb_addrlen = svc_addr_len(sa);
1016         }
1017 }
1018
1019 /* caller must hold client_lock */
1020 static struct nfsd4_session *
1021 find_in_sessionid_hashtbl(struct nfs4_sessionid *sessionid, struct net *net)
1022 {
1023         struct nfsd4_session *elem;
1024         int idx;
1025         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
1026
1027         dump_sessionid(__func__, sessionid);
1028         idx = hash_sessionid(sessionid);
1029         /* Search in the appropriate list */
1030         list_for_each_entry(elem, &nn->sessionid_hashtbl[idx], se_hash) {
1031                 if (!memcmp(elem->se_sessionid.data, sessionid->data,
1032                             NFS4_MAX_SESSIONID_LEN)) {
1033                         return elem;
1034                 }
1035         }
1036
1037         dprintk("%s: session not found\n", __func__);
1038         return NULL;
1039 }
1040
1041 /* caller must hold client_lock */
1042 static void
1043 unhash_session(struct nfsd4_session *ses)
1044 {
1045         list_del(&ses->se_hash);
1046         spin_lock(&ses->se_client->cl_lock);
1047         list_del(&ses->se_perclnt);
1048         spin_unlock(&ses->se_client->cl_lock);
1049 }
1050
1051 /* SETCLIENTID and SETCLIENTID_CONFIRM Helper functions */
1052 static int
1053 STALE_CLIENTID(clientid_t *clid, struct nfsd_net *nn)
1054 {
1055         if (clid->cl_boot == nn->boot_time)
1056                 return 0;
1057         dprintk("NFSD stale clientid (%08x/%08x) boot_time %08lx\n",
1058                 clid->cl_boot, clid->cl_id, nn->boot_time);
1059         return 1;
1060 }
1061
1062 /*
1063  * XXX Should we use a slab cache ?
1064  * This type of memory management is somewhat inefficient, but we use it
1065  * anyway since SETCLIENTID is not a common operation.
1066  */
1067 static struct nfs4_client *alloc_client(struct xdr_netobj name)
1068 {
1069         struct nfs4_client *clp;
1070
1071         clp = kzalloc(sizeof(struct nfs4_client), GFP_KERNEL);
1072         if (clp == NULL)
1073                 return NULL;
1074         clp->cl_name.data = kmemdup(name.data, name.len, GFP_KERNEL);
1075         if (clp->cl_name.data == NULL) {
1076                 kfree(clp);
1077                 return NULL;
1078         }
1079         clp->cl_name.len = name.len;
1080         INIT_LIST_HEAD(&clp->cl_sessions);
1081         idr_init(&clp->cl_stateids);
1082         atomic_set(&clp->cl_refcount, 0);
1083         clp->cl_cb_state = NFSD4_CB_UNKNOWN;
1084         INIT_LIST_HEAD(&clp->cl_idhash);
1085         INIT_LIST_HEAD(&clp->cl_openowners);
1086         INIT_LIST_HEAD(&clp->cl_delegations);
1087         INIT_LIST_HEAD(&clp->cl_lru);
1088         INIT_LIST_HEAD(&clp->cl_callbacks);
1089         INIT_LIST_HEAD(&clp->cl_revoked);
1090         spin_lock_init(&clp->cl_lock);
1091         rpc_init_wait_queue(&clp->cl_cb_waitq, "Backchannel slot table");
1092         return clp;
1093 }
1094
1095 static inline void
1096 free_client(struct nfs4_client *clp)
1097 {
1098         struct nfsd_net __maybe_unused *nn = net_generic(clp->net, nfsd_net_id);
1099
1100         lockdep_assert_held(&nn->client_lock);
1101         while (!list_empty(&clp->cl_sessions)) {
1102                 struct nfsd4_session *ses;
1103                 ses = list_entry(clp->cl_sessions.next, struct nfsd4_session,
1104                                 se_perclnt);
1105                 list_del(&ses->se_perclnt);
1106                 WARN_ON_ONCE(atomic_read(&ses->se_ref));
1107                 free_session(ses);
1108         }
1109         rpc_destroy_wait_queue(&clp->cl_cb_waitq);
1110         free_svc_cred(&clp->cl_cred);
1111         kfree(clp->cl_name.data);
1112         idr_destroy(&clp->cl_stateids);
1113         kfree(clp);
1114 }
1115
1116 /* must be called under the client_lock */
1117 static inline void
1118 unhash_client_locked(struct nfs4_client *clp)
1119 {
1120         struct nfsd4_session *ses;
1121
1122         list_del(&clp->cl_lru);
1123         spin_lock(&clp->cl_lock);
1124         list_for_each_entry(ses, &clp->cl_sessions, se_perclnt)
1125                 list_del_init(&ses->se_hash);
1126         spin_unlock(&clp->cl_lock);
1127 }
1128
1129 static void
1130 destroy_client(struct nfs4_client *clp)
1131 {
1132         struct nfs4_openowner *oo;
1133         struct nfs4_delegation *dp;
1134         struct list_head reaplist;
1135         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
1136
1137         INIT_LIST_HEAD(&reaplist);
1138         spin_lock(&recall_lock);
1139         while (!list_empty(&clp->cl_delegations)) {
1140                 dp = list_entry(clp->cl_delegations.next, struct nfs4_delegation, dl_perclnt);
1141                 list_del_init(&dp->dl_perclnt);
1142                 list_move(&dp->dl_recall_lru, &reaplist);
1143         }
1144         spin_unlock(&recall_lock);
1145         while (!list_empty(&reaplist)) {
1146                 dp = list_entry(reaplist.next, struct nfs4_delegation, dl_recall_lru);
1147                 destroy_delegation(dp);
1148         }
1149         while (!list_empty(&clp->cl_openowners)) {
1150                 oo = list_entry(clp->cl_openowners.next, struct nfs4_openowner, oo_perclient);
1151                 release_openowner(oo);
1152         }
1153         nfsd4_shutdown_callback(clp);
1154         if (clp->cl_cb_conn.cb_xprt)
1155                 svc_xprt_put(clp->cl_cb_conn.cb_xprt);
1156         list_del(&clp->cl_idhash);
1157         if (test_bit(NFSD4_CLIENT_CONFIRMED, &clp->cl_flags))
1158                 rb_erase(&clp->cl_namenode, &nn->conf_name_tree);
1159         else
1160                 rb_erase(&clp->cl_namenode, &nn->unconf_name_tree);
1161         spin_lock(&nn->client_lock);
1162         unhash_client_locked(clp);
1163         WARN_ON_ONCE(atomic_read(&clp->cl_refcount));
1164         free_client(clp);
1165         spin_unlock(&nn->client_lock);
1166 }
1167
1168 static void expire_client(struct nfs4_client *clp)
1169 {
1170         nfsd4_client_record_remove(clp);
1171         destroy_client(clp);
1172 }
1173
1174 static void copy_verf(struct nfs4_client *target, nfs4_verifier *source)
1175 {
1176         memcpy(target->cl_verifier.data, source->data,
1177                         sizeof(target->cl_verifier.data));
1178 }
1179
1180 static void copy_clid(struct nfs4_client *target, struct nfs4_client *source)
1181 {
1182         target->cl_clientid.cl_boot = source->cl_clientid.cl_boot;
1183         target->cl_clientid.cl_id = source->cl_clientid.cl_id;
1184 }
1185
1186 static int copy_cred(struct svc_cred *target, struct svc_cred *source)
1187 {
1188         if (source->cr_principal) {
1189                 target->cr_principal =
1190                                 kstrdup(source->cr_principal, GFP_KERNEL);
1191                 if (target->cr_principal == NULL)
1192                         return -ENOMEM;
1193         } else
1194                 target->cr_principal = NULL;
1195         target->cr_flavor = source->cr_flavor;
1196         target->cr_uid = source->cr_uid;
1197         target->cr_gid = source->cr_gid;
1198         target->cr_group_info = source->cr_group_info;
1199         get_group_info(target->cr_group_info);
1200         return 0;
1201 }
1202
1203 static long long
1204 compare_blob(const struct xdr_netobj *o1, const struct xdr_netobj *o2)
1205 {
1206         long long res;
1207
1208         res = o1->len - o2->len;
1209         if (res)
1210                 return res;
1211         return (long long)memcmp(o1->data, o2->data, o1->len);
1212 }
1213
1214 static int same_name(const char *n1, const char *n2)
1215 {
1216         return 0 == memcmp(n1, n2, HEXDIR_LEN);
1217 }
1218
1219 static int
1220 same_verf(nfs4_verifier *v1, nfs4_verifier *v2)
1221 {
1222         return 0 == memcmp(v1->data, v2->data, sizeof(v1->data));
1223 }
1224
1225 static int
1226 same_clid(clientid_t *cl1, clientid_t *cl2)
1227 {
1228         return (cl1->cl_boot == cl2->cl_boot) && (cl1->cl_id == cl2->cl_id);
1229 }
1230
1231 static bool groups_equal(struct group_info *g1, struct group_info *g2)
1232 {
1233         int i;
1234
1235         if (g1->ngroups != g2->ngroups)
1236                 return false;
1237         for (i=0; i<g1->ngroups; i++)
1238                 if (!gid_eq(GROUP_AT(g1, i), GROUP_AT(g2, i)))
1239                         return false;
1240         return true;
1241 }
1242
1243 /*
1244  * RFC 3530 language requires clid_inuse be returned when the
1245  * "principal" associated with a requests differs from that previously
1246  * used.  We use uid, gid's, and gss principal string as our best
1247  * approximation.  We also don't want to allow non-gss use of a client
1248  * established using gss: in theory cr_principal should catch that
1249  * change, but in practice cr_principal can be null even in the gss case
1250  * since gssd doesn't always pass down a principal string.
1251  */
1252 static bool is_gss_cred(struct svc_cred *cr)
1253 {
1254         /* Is cr_flavor one of the gss "pseudoflavors"?: */
1255         return (cr->cr_flavor > RPC_AUTH_MAXFLAVOR);
1256 }
1257
1258
1259 static bool
1260 same_creds(struct svc_cred *cr1, struct svc_cred *cr2)
1261 {
1262         if ((is_gss_cred(cr1) != is_gss_cred(cr2))
1263                 || (!uid_eq(cr1->cr_uid, cr2->cr_uid))
1264                 || (!gid_eq(cr1->cr_gid, cr2->cr_gid))
1265                 || !groups_equal(cr1->cr_group_info, cr2->cr_group_info))
1266                 return false;
1267         if (cr1->cr_principal == cr2->cr_principal)
1268                 return true;
1269         if (!cr1->cr_principal || !cr2->cr_principal)
1270                 return false;
1271         return 0 == strcmp(cr1->cr_principal, cr2->cr_principal);
1272 }
1273
1274 static void gen_clid(struct nfs4_client *clp, struct nfsd_net *nn)
1275 {
1276         static u32 current_clientid = 1;
1277
1278         clp->cl_clientid.cl_boot = nn->boot_time;
1279         clp->cl_clientid.cl_id = current_clientid++;
1280 }
1281
1282 static void gen_confirm(struct nfs4_client *clp)
1283 {
1284         __be32 verf[2];
1285         static u32 i;
1286
1287         verf[0] = (__be32)get_seconds();
1288         verf[1] = (__be32)i++;
1289         memcpy(clp->cl_confirm.data, verf, sizeof(clp->cl_confirm.data));
1290 }
1291
1292 static struct nfs4_stid *find_stateid(struct nfs4_client *cl, stateid_t *t)
1293 {
1294         struct nfs4_stid *ret;
1295
1296         ret = idr_find(&cl->cl_stateids, t->si_opaque.so_id);
1297         if (!ret || !ret->sc_type)
1298                 return NULL;
1299         return ret;
1300 }
1301
1302 static struct nfs4_stid *find_stateid_by_type(struct nfs4_client *cl, stateid_t *t, char typemask)
1303 {
1304         struct nfs4_stid *s;
1305
1306         s = find_stateid(cl, t);
1307         if (!s)
1308                 return NULL;
1309         if (typemask & s->sc_type)
1310                 return s;
1311         return NULL;
1312 }
1313
1314 static struct nfs4_client *create_client(struct xdr_netobj name,
1315                 struct svc_rqst *rqstp, nfs4_verifier *verf)
1316 {
1317         struct nfs4_client *clp;
1318         struct sockaddr *sa = svc_addr(rqstp);
1319         int ret;
1320         struct net *net = SVC_NET(rqstp);
1321         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
1322
1323         clp = alloc_client(name);
1324         if (clp == NULL)
1325                 return NULL;
1326
1327         ret = copy_cred(&clp->cl_cred, &rqstp->rq_cred);
1328         if (ret) {
1329                 spin_lock(&nn->client_lock);
1330                 free_client(clp);
1331                 spin_unlock(&nn->client_lock);
1332                 return NULL;
1333         }
1334         nfsd4_init_callback(&clp->cl_cb_null);
1335         clp->cl_time = get_seconds();
1336         clear_bit(0, &clp->cl_cb_slot_busy);
1337         copy_verf(clp, verf);
1338         rpc_copy_addr((struct sockaddr *) &clp->cl_addr, sa);
1339         gen_confirm(clp);
1340         clp->cl_cb_session = NULL;
1341         clp->net = net;
1342         return clp;
1343 }
1344
1345 static void
1346 add_clp_to_name_tree(struct nfs4_client *new_clp, struct rb_root *root)
1347 {
1348         struct rb_node **new = &(root->rb_node), *parent = NULL;
1349         struct nfs4_client *clp;
1350
1351         while (*new) {
1352                 clp = rb_entry(*new, struct nfs4_client, cl_namenode);
1353                 parent = *new;
1354
1355                 if (compare_blob(&clp->cl_name, &new_clp->cl_name) > 0)
1356                         new = &((*new)->rb_left);
1357                 else
1358                         new = &((*new)->rb_right);
1359         }
1360
1361         rb_link_node(&new_clp->cl_namenode, parent, new);
1362         rb_insert_color(&new_clp->cl_namenode, root);
1363 }
1364
1365 static struct nfs4_client *
1366 find_clp_in_name_tree(struct xdr_netobj *name, struct rb_root *root)
1367 {
1368         long long cmp;
1369         struct rb_node *node = root->rb_node;
1370         struct nfs4_client *clp;
1371
1372         while (node) {
1373                 clp = rb_entry(node, struct nfs4_client, cl_namenode);
1374                 cmp = compare_blob(&clp->cl_name, name);
1375                 if (cmp > 0)
1376                         node = node->rb_left;
1377                 else if (cmp < 0)
1378                         node = node->rb_right;
1379                 else
1380                         return clp;
1381         }
1382         return NULL;
1383 }
1384
1385 static void
1386 add_to_unconfirmed(struct nfs4_client *clp)
1387 {
1388         unsigned int idhashval;
1389         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
1390
1391         clear_bit(NFSD4_CLIENT_CONFIRMED, &clp->cl_flags);
1392         add_clp_to_name_tree(clp, &nn->unconf_name_tree);
1393         idhashval = clientid_hashval(clp->cl_clientid.cl_id);
1394         list_add(&clp->cl_idhash, &nn->unconf_id_hashtbl[idhashval]);
1395         renew_client(clp);
1396 }
1397
1398 static void
1399 move_to_confirmed(struct nfs4_client *clp)
1400 {
1401         unsigned int idhashval = clientid_hashval(clp->cl_clientid.cl_id);
1402         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
1403
1404         dprintk("NFSD: move_to_confirm nfs4_client %p\n", clp);
1405         list_move(&clp->cl_idhash, &nn->conf_id_hashtbl[idhashval]);
1406         rb_erase(&clp->cl_namenode, &nn->unconf_name_tree);
1407         add_clp_to_name_tree(clp, &nn->conf_name_tree);
1408         set_bit(NFSD4_CLIENT_CONFIRMED, &clp->cl_flags);
1409         renew_client(clp);
1410 }
1411
1412 static struct nfs4_client *
1413 find_client_in_id_table(struct list_head *tbl, clientid_t *clid, bool sessions)
1414 {
1415         struct nfs4_client *clp;
1416         unsigned int idhashval = clientid_hashval(clid->cl_id);
1417
1418         list_for_each_entry(clp, &tbl[idhashval], cl_idhash) {
1419                 if (same_clid(&clp->cl_clientid, clid)) {
1420                         if ((bool)clp->cl_minorversion != sessions)
1421                                 return NULL;
1422                         renew_client(clp);
1423                         return clp;
1424                 }
1425         }
1426         return NULL;
1427 }
1428
1429 static struct nfs4_client *
1430 find_confirmed_client(clientid_t *clid, bool sessions, struct nfsd_net *nn)
1431 {
1432         struct list_head *tbl = nn->conf_id_hashtbl;
1433
1434         return find_client_in_id_table(tbl, clid, sessions);
1435 }
1436
1437 static struct nfs4_client *
1438 find_unconfirmed_client(clientid_t *clid, bool sessions, struct nfsd_net *nn)
1439 {
1440         struct list_head *tbl = nn->unconf_id_hashtbl;
1441
1442         return find_client_in_id_table(tbl, clid, sessions);
1443 }
1444
1445 static bool clp_used_exchangeid(struct nfs4_client *clp)
1446 {
1447         return clp->cl_exchange_flags != 0;
1448 }
1449
1450 static struct nfs4_client *
1451 find_confirmed_client_by_name(struct xdr_netobj *name, struct nfsd_net *nn)
1452 {
1453         return find_clp_in_name_tree(name, &nn->conf_name_tree);
1454 }
1455
1456 static struct nfs4_client *
1457 find_unconfirmed_client_by_name(struct xdr_netobj *name, struct nfsd_net *nn)
1458 {
1459         return find_clp_in_name_tree(name, &nn->unconf_name_tree);
1460 }
1461
1462 static void
1463 gen_callback(struct nfs4_client *clp, struct nfsd4_setclientid *se, struct svc_rqst *rqstp)
1464 {
1465         struct nfs4_cb_conn *conn = &clp->cl_cb_conn;
1466         struct sockaddr *sa = svc_addr(rqstp);
1467         u32 scopeid = rpc_get_scope_id(sa);
1468         unsigned short expected_family;
1469
1470         /* Currently, we only support tcp and tcp6 for the callback channel */
1471         if (se->se_callback_netid_len == 3 &&
1472             !memcmp(se->se_callback_netid_val, "tcp", 3))
1473                 expected_family = AF_INET;
1474         else if (se->se_callback_netid_len == 4 &&
1475                  !memcmp(se->se_callback_netid_val, "tcp6", 4))
1476                 expected_family = AF_INET6;
1477         else
1478                 goto out_err;
1479
1480         conn->cb_addrlen = rpc_uaddr2sockaddr(clp->net, se->se_callback_addr_val,
1481                                             se->se_callback_addr_len,
1482                                             (struct sockaddr *)&conn->cb_addr,
1483                                             sizeof(conn->cb_addr));
1484
1485         if (!conn->cb_addrlen || conn->cb_addr.ss_family != expected_family)
1486                 goto out_err;
1487
1488         if (conn->cb_addr.ss_family == AF_INET6)
1489                 ((struct sockaddr_in6 *)&conn->cb_addr)->sin6_scope_id = scopeid;
1490
1491         conn->cb_prog = se->se_callback_prog;
1492         conn->cb_ident = se->se_callback_ident;
1493         memcpy(&conn->cb_saddr, &rqstp->rq_daddr, rqstp->rq_daddrlen);
1494         return;
1495 out_err:
1496         conn->cb_addr.ss_family = AF_UNSPEC;
1497         conn->cb_addrlen = 0;
1498         dprintk(KERN_INFO "NFSD: this client (clientid %08x/%08x) "
1499                 "will not receive delegations\n",
1500                 clp->cl_clientid.cl_boot, clp->cl_clientid.cl_id);
1501
1502         return;
1503 }
1504
1505 /*
1506  * Cache a reply. nfsd4_check_drc_limit() has bounded the cache size.
1507  */
1508 void
1509 nfsd4_store_cache_entry(struct nfsd4_compoundres *resp)
1510 {
1511         struct nfsd4_slot *slot = resp->cstate.slot;
1512         unsigned int base;
1513
1514         dprintk("--> %s slot %p\n", __func__, slot);
1515
1516         slot->sl_opcnt = resp->opcnt;
1517         slot->sl_status = resp->cstate.status;
1518
1519         slot->sl_flags |= NFSD4_SLOT_INITIALIZED;
1520         if (nfsd4_not_cached(resp)) {
1521                 slot->sl_datalen = 0;
1522                 return;
1523         }
1524         slot->sl_datalen = (char *)resp->p - (char *)resp->cstate.datap;
1525         base = (char *)resp->cstate.datap -
1526                                         (char *)resp->xbuf->head[0].iov_base;
1527         if (read_bytes_from_xdr_buf(resp->xbuf, base, slot->sl_data,
1528                                     slot->sl_datalen))
1529                 WARN("%s: sessions DRC could not cache compound\n", __func__);
1530         return;
1531 }
1532
1533 /*
1534  * Encode the replay sequence operation from the slot values.
1535  * If cachethis is FALSE encode the uncached rep error on the next
1536  * operation which sets resp->p and increments resp->opcnt for
1537  * nfs4svc_encode_compoundres.
1538  *
1539  */
1540 static __be32
1541 nfsd4_enc_sequence_replay(struct nfsd4_compoundargs *args,
1542                           struct nfsd4_compoundres *resp)
1543 {
1544         struct nfsd4_op *op;
1545         struct nfsd4_slot *slot = resp->cstate.slot;
1546
1547         /* Encode the replayed sequence operation */
1548         op = &args->ops[resp->opcnt - 1];
1549         nfsd4_encode_operation(resp, op);
1550
1551         /* Return nfserr_retry_uncached_rep in next operation. */
1552         if (args->opcnt > 1 && !(slot->sl_flags & NFSD4_SLOT_CACHETHIS)) {
1553                 op = &args->ops[resp->opcnt++];
1554                 op->status = nfserr_retry_uncached_rep;
1555                 nfsd4_encode_operation(resp, op);
1556         }
1557         return op->status;
1558 }
1559
1560 /*
1561  * The sequence operation is not cached because we can use the slot and
1562  * session values.
1563  */
1564 __be32
1565 nfsd4_replay_cache_entry(struct nfsd4_compoundres *resp,
1566                          struct nfsd4_sequence *seq)
1567 {
1568         struct nfsd4_slot *slot = resp->cstate.slot;
1569         __be32 status;
1570
1571         dprintk("--> %s slot %p\n", __func__, slot);
1572
1573         /* Either returns 0 or nfserr_retry_uncached */
1574         status = nfsd4_enc_sequence_replay(resp->rqstp->rq_argp, resp);
1575         if (status == nfserr_retry_uncached_rep)
1576                 return status;
1577
1578         /* The sequence operation has been encoded, cstate->datap set. */
1579         memcpy(resp->cstate.datap, slot->sl_data, slot->sl_datalen);
1580
1581         resp->opcnt = slot->sl_opcnt;
1582         resp->p = resp->cstate.datap + XDR_QUADLEN(slot->sl_datalen);
1583         status = slot->sl_status;
1584
1585         return status;
1586 }
1587
1588 /*
1589  * Set the exchange_id flags returned by the server.
1590  */
1591 static void
1592 nfsd4_set_ex_flags(struct nfs4_client *new, struct nfsd4_exchange_id *clid)
1593 {
1594         /* pNFS is not supported */
1595         new->cl_exchange_flags |= EXCHGID4_FLAG_USE_NON_PNFS;
1596
1597         /* Referrals are supported, Migration is not. */
1598         new->cl_exchange_flags |= EXCHGID4_FLAG_SUPP_MOVED_REFER;
1599
1600         /* set the wire flags to return to client. */
1601         clid->flags = new->cl_exchange_flags;
1602 }
1603
1604 static bool client_has_state(struct nfs4_client *clp)
1605 {
1606         /*
1607          * Note clp->cl_openowners check isn't quite right: there's no
1608          * need to count owners without stateid's.
1609          *
1610          * Also note we should probably be using this in 4.0 case too.
1611          */
1612         return !list_empty(&clp->cl_openowners)
1613                 || !list_empty(&clp->cl_delegations)
1614                 || !list_empty(&clp->cl_sessions);
1615 }
1616
1617 __be32
1618 nfsd4_exchange_id(struct svc_rqst *rqstp,
1619                   struct nfsd4_compound_state *cstate,
1620                   struct nfsd4_exchange_id *exid)
1621 {
1622         struct nfs4_client *unconf, *conf, *new;
1623         __be32 status;
1624         char                    addr_str[INET6_ADDRSTRLEN];
1625         nfs4_verifier           verf = exid->verifier;
1626         struct sockaddr         *sa = svc_addr(rqstp);
1627         bool    update = exid->flags & EXCHGID4_FLAG_UPD_CONFIRMED_REC_A;
1628         struct nfsd_net         *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
1629
1630         rpc_ntop(sa, addr_str, sizeof(addr_str));
1631         dprintk("%s rqstp=%p exid=%p clname.len=%u clname.data=%p "
1632                 "ip_addr=%s flags %x, spa_how %d\n",
1633                 __func__, rqstp, exid, exid->clname.len, exid->clname.data,
1634                 addr_str, exid->flags, exid->spa_how);
1635
1636         if (exid->flags & ~EXCHGID4_FLAG_MASK_A)
1637                 return nfserr_inval;
1638
1639         /* Currently only support SP4_NONE */
1640         switch (exid->spa_how) {
1641         case SP4_NONE:
1642                 break;
1643         default:                                /* checked by xdr code */
1644                 WARN_ON_ONCE(1);
1645         case SP4_SSV:
1646                 return nfserr_encr_alg_unsupp;
1647         case SP4_MACH_CRED:
1648                 return nfserr_serverfault;      /* no excuse :-/ */
1649         }
1650
1651         /* Cases below refer to rfc 5661 section 18.35.4: */
1652         nfs4_lock_state();
1653         conf = find_confirmed_client_by_name(&exid->clname, nn);
1654         if (conf) {
1655                 bool creds_match = same_creds(&conf->cl_cred, &rqstp->rq_cred);
1656                 bool verfs_match = same_verf(&verf, &conf->cl_verifier);
1657
1658                 if (update) {
1659                         if (!clp_used_exchangeid(conf)) { /* buggy client */
1660                                 status = nfserr_inval;
1661                                 goto out;
1662                         }
1663                         if (!creds_match) { /* case 9 */
1664                                 status = nfserr_perm;
1665                                 goto out;
1666                         }
1667                         if (!verfs_match) { /* case 8 */
1668                                 status = nfserr_not_same;
1669                                 goto out;
1670                         }
1671                         /* case 6 */
1672                         exid->flags |= EXCHGID4_FLAG_CONFIRMED_R;
1673                         new = conf;
1674                         goto out_copy;
1675                 }
1676                 if (!creds_match) { /* case 3 */
1677                         if (client_has_state(conf)) {
1678                                 status = nfserr_clid_inuse;
1679                                 goto out;
1680                         }
1681                         expire_client(conf);
1682                         goto out_new;
1683                 }
1684                 if (verfs_match) { /* case 2 */
1685                         conf->cl_exchange_flags |= EXCHGID4_FLAG_CONFIRMED_R;
1686                         new = conf;
1687                         goto out_copy;
1688                 }
1689                 /* case 5, client reboot */
1690                 goto out_new;
1691         }
1692
1693         if (update) { /* case 7 */
1694                 status = nfserr_noent;
1695                 goto out;
1696         }
1697
1698         unconf  = find_unconfirmed_client_by_name(&exid->clname, nn);
1699         if (unconf) /* case 4, possible retry or client restart */
1700                 expire_client(unconf);
1701
1702         /* case 1 (normal case) */
1703 out_new:
1704         new = create_client(exid->clname, rqstp, &verf);
1705         if (new == NULL) {
1706                 status = nfserr_jukebox;
1707                 goto out;
1708         }
1709         new->cl_minorversion = 1;
1710
1711         gen_clid(new, nn);
1712         add_to_unconfirmed(new);
1713 out_copy:
1714         exid->clientid.cl_boot = new->cl_clientid.cl_boot;
1715         exid->clientid.cl_id = new->cl_clientid.cl_id;
1716
1717         exid->seqid = new->cl_cs_slot.sl_seqid + 1;
1718         nfsd4_set_ex_flags(new, exid);
1719
1720         dprintk("nfsd4_exchange_id seqid %d flags %x\n",
1721                 new->cl_cs_slot.sl_seqid, new->cl_exchange_flags);
1722         status = nfs_ok;
1723
1724 out:
1725         nfs4_unlock_state();
1726         return status;
1727 }
1728
1729 static __be32
1730 check_slot_seqid(u32 seqid, u32 slot_seqid, int slot_inuse)
1731 {
1732         dprintk("%s enter. seqid %d slot_seqid %d\n", __func__, seqid,
1733                 slot_seqid);
1734
1735         /* The slot is in use, and no response has been sent. */
1736         if (slot_inuse) {
1737                 if (seqid == slot_seqid)
1738                         return nfserr_jukebox;
1739                 else
1740                         return nfserr_seq_misordered;
1741         }
1742         /* Note unsigned 32-bit arithmetic handles wraparound: */
1743         if (likely(seqid == slot_seqid + 1))
1744                 return nfs_ok;
1745         if (seqid == slot_seqid)
1746                 return nfserr_replay_cache;
1747         return nfserr_seq_misordered;
1748 }
1749
1750 /*
1751  * Cache the create session result into the create session single DRC
1752  * slot cache by saving the xdr structure. sl_seqid has been set.
1753  * Do this for solo or embedded create session operations.
1754  */
1755 static void
1756 nfsd4_cache_create_session(struct nfsd4_create_session *cr_ses,
1757                            struct nfsd4_clid_slot *slot, __be32 nfserr)
1758 {
1759         slot->sl_status = nfserr;
1760         memcpy(&slot->sl_cr_ses, cr_ses, sizeof(*cr_ses));
1761 }
1762
1763 static __be32
1764 nfsd4_replay_create_session(struct nfsd4_create_session *cr_ses,
1765                             struct nfsd4_clid_slot *slot)
1766 {
1767         memcpy(cr_ses, &slot->sl_cr_ses, sizeof(*cr_ses));
1768         return slot->sl_status;
1769 }
1770
1771 #define NFSD_MIN_REQ_HDR_SEQ_SZ ((\
1772                         2 * 2 + /* credential,verifier: AUTH_NULL, length 0 */ \
1773                         1 +     /* MIN tag is length with zero, only length */ \
1774                         3 +     /* version, opcount, opcode */ \
1775                         XDR_QUADLEN(NFS4_MAX_SESSIONID_LEN) + \
1776                                 /* seqid, slotID, slotID, cache */ \
1777                         4 ) * sizeof(__be32))
1778
1779 #define NFSD_MIN_RESP_HDR_SEQ_SZ ((\
1780                         2 +     /* verifier: AUTH_NULL, length 0 */\
1781                         1 +     /* status */ \
1782                         1 +     /* MIN tag is length with zero, only length */ \
1783                         3 +     /* opcount, opcode, opstatus*/ \
1784                         XDR_QUADLEN(NFS4_MAX_SESSIONID_LEN) + \
1785                                 /* seqid, slotID, slotID, slotID, status */ \
1786                         5 ) * sizeof(__be32))
1787
1788 static __be32 check_forechannel_attrs(struct nfsd4_channel_attrs *ca, struct nfsd_net *nn)
1789 {
1790         u32 maxrpc = nn->nfsd_serv->sv_max_mesg;
1791
1792         if (ca->maxreq_sz < NFSD_MIN_REQ_HDR_SEQ_SZ)
1793                 return nfserr_toosmall;
1794         if (ca->maxresp_sz < NFSD_MIN_RESP_HDR_SEQ_SZ)
1795                 return nfserr_toosmall;
1796         ca->headerpadsz = 0;
1797         ca->maxreq_sz = min_t(u32, ca->maxreq_sz, maxrpc);
1798         ca->maxresp_sz = min_t(u32, ca->maxresp_sz, maxrpc);
1799         ca->maxops = min_t(u32, ca->maxops, NFSD_MAX_OPS_PER_COMPOUND);
1800         ca->maxresp_cached = min_t(u32, ca->maxresp_cached,
1801                         NFSD_SLOT_CACHE_SIZE + NFSD_MIN_HDR_SEQ_SZ);
1802         ca->maxreqs = min_t(u32, ca->maxreqs, NFSD_MAX_SLOTS_PER_SESSION);
1803         /*
1804          * Note decreasing slot size below client's request may make it
1805          * difficult for client to function correctly, whereas
1806          * decreasing the number of slots will (just?) affect
1807          * performance.  When short on memory we therefore prefer to
1808          * decrease number of slots instead of their size.  Clients that
1809          * request larger slots than they need will get poor results:
1810          */
1811         ca->maxreqs = nfsd4_get_drc_mem(ca);
1812         if (!ca->maxreqs)
1813                 return nfserr_jukebox;
1814
1815         return nfs_ok;
1816 }
1817
1818 static __be32 check_backchannel_attrs(struct nfsd4_channel_attrs *ca)
1819 {
1820         ca->headerpadsz = 0;
1821
1822         /*
1823          * These RPC_MAX_HEADER macros are overkill, especially since we
1824          * don't even do gss on the backchannel yet.  But this is still
1825          * less than 1k.  Tighten up this estimate in the unlikely event
1826          * it turns out to be a problem for some client:
1827          */
1828         if (ca->maxreq_sz < NFS4_enc_cb_recall_sz + RPC_MAX_HEADER_WITH_AUTH)
1829                 return nfserr_toosmall;
1830         if (ca->maxresp_sz < NFS4_dec_cb_recall_sz + RPC_MAX_REPHEADER_WITH_AUTH)
1831                 return nfserr_toosmall;
1832         ca->maxresp_cached = 0;
1833         if (ca->maxops < 2)
1834                 return nfserr_toosmall;
1835
1836         return nfs_ok;
1837 }
1838
1839 __be32
1840 nfsd4_create_session(struct svc_rqst *rqstp,
1841                      struct nfsd4_compound_state *cstate,
1842                      struct nfsd4_create_session *cr_ses)
1843 {
1844         struct sockaddr *sa = svc_addr(rqstp);
1845         struct nfs4_client *conf, *unconf;
1846         struct nfsd4_session *new;
1847         struct nfsd4_conn *conn;
1848         struct nfsd4_clid_slot *cs_slot = NULL;
1849         __be32 status = 0;
1850         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
1851
1852         if (cr_ses->flags & ~SESSION4_FLAG_MASK_A)
1853                 return nfserr_inval;
1854         status = check_forechannel_attrs(&cr_ses->fore_channel, nn);
1855         if (status)
1856                 return status;
1857         status = check_backchannel_attrs(&cr_ses->back_channel);
1858         if (status)
1859                 return status;
1860         status = nfserr_jukebox;
1861         new = alloc_session(&cr_ses->fore_channel);
1862         if (!new)
1863                 goto out_release_drc_mem;
1864         conn = alloc_conn_from_crses(rqstp, cr_ses);
1865         if (!conn)
1866                 goto out_free_session;
1867
1868         nfs4_lock_state();
1869         unconf = find_unconfirmed_client(&cr_ses->clientid, true, nn);
1870         conf = find_confirmed_client(&cr_ses->clientid, true, nn);
1871         WARN_ON_ONCE(conf && unconf);
1872
1873         if (conf) {
1874                 cs_slot = &conf->cl_cs_slot;
1875                 status = check_slot_seqid(cr_ses->seqid, cs_slot->sl_seqid, 0);
1876                 if (status == nfserr_replay_cache) {
1877                         status = nfsd4_replay_create_session(cr_ses, cs_slot);
1878                         goto out_free_conn;
1879                 } else if (cr_ses->seqid != cs_slot->sl_seqid + 1) {
1880                         status = nfserr_seq_misordered;
1881                         goto out_free_conn;
1882                 }
1883         } else if (unconf) {
1884                 struct nfs4_client *old;
1885                 if (!same_creds(&unconf->cl_cred, &rqstp->rq_cred) ||
1886                     !rpc_cmp_addr(sa, (struct sockaddr *) &unconf->cl_addr)) {
1887                         status = nfserr_clid_inuse;
1888                         goto out_free_conn;
1889                 }
1890                 cs_slot = &unconf->cl_cs_slot;
1891                 status = check_slot_seqid(cr_ses->seqid, cs_slot->sl_seqid, 0);
1892                 if (status) {
1893                         /* an unconfirmed replay returns misordered */
1894                         status = nfserr_seq_misordered;
1895                         goto out_free_conn;
1896                 }
1897                 old = find_confirmed_client_by_name(&unconf->cl_name, nn);
1898                 if (old) {
1899                         status = mark_client_expired(old);
1900                         if (status)
1901                                 goto out_free_conn;
1902                         expire_client(old);
1903                 }
1904                 move_to_confirmed(unconf);
1905                 conf = unconf;
1906         } else {
1907                 status = nfserr_stale_clientid;
1908                 goto out_free_conn;
1909         }
1910         status = nfs_ok;
1911         /*
1912          * We do not support RDMA or persistent sessions
1913          */
1914         cr_ses->flags &= ~SESSION4_PERSIST;
1915         cr_ses->flags &= ~SESSION4_RDMA;
1916
1917         init_session(rqstp, new, conf, cr_ses);
1918         nfsd4_init_conn(rqstp, conn, new);
1919
1920         memcpy(cr_ses->sessionid.data, new->se_sessionid.data,
1921                NFS4_MAX_SESSIONID_LEN);
1922         cs_slot->sl_seqid++;
1923         cr_ses->seqid = cs_slot->sl_seqid;
1924
1925         /* cache solo and embedded create sessions under the state lock */
1926         nfsd4_cache_create_session(cr_ses, cs_slot, status);
1927         nfs4_unlock_state();
1928         return status;
1929 out_free_conn:
1930         nfs4_unlock_state();
1931         free_conn(conn);
1932 out_free_session:
1933         __free_session(new);
1934 out_release_drc_mem:
1935         nfsd4_put_drc_mem(&cr_ses->fore_channel);
1936         return status;
1937 }
1938
1939 static __be32 nfsd4_map_bcts_dir(u32 *dir)
1940 {
1941         switch (*dir) {
1942         case NFS4_CDFC4_FORE:
1943         case NFS4_CDFC4_BACK:
1944                 return nfs_ok;
1945         case NFS4_CDFC4_FORE_OR_BOTH:
1946         case NFS4_CDFC4_BACK_OR_BOTH:
1947                 *dir = NFS4_CDFC4_BOTH;
1948                 return nfs_ok;
1949         };
1950         return nfserr_inval;
1951 }
1952
1953 __be32 nfsd4_backchannel_ctl(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, struct nfsd4_backchannel_ctl *bc)
1954 {
1955         struct nfsd4_session *session = cstate->session;
1956         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
1957
1958         spin_lock(&nn->client_lock);
1959         session->se_cb_prog = bc->bc_cb_program;
1960         session->se_cb_sec = bc->bc_cb_sec;
1961         spin_unlock(&nn->client_lock);
1962
1963         nfsd4_probe_callback(session->se_client);
1964
1965         return nfs_ok;
1966 }
1967
1968 __be32 nfsd4_bind_conn_to_session(struct svc_rqst *rqstp,
1969                      struct nfsd4_compound_state *cstate,
1970                      struct nfsd4_bind_conn_to_session *bcts)
1971 {
1972         __be32 status;
1973         struct nfsd4_conn *conn;
1974         struct nfsd4_session *session;
1975         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
1976
1977         if (!nfsd4_last_compound_op(rqstp))
1978                 return nfserr_not_only_op;
1979         nfs4_lock_state();
1980         spin_lock(&nn->client_lock);
1981         session = find_in_sessionid_hashtbl(&bcts->sessionid, SVC_NET(rqstp));
1982         spin_unlock(&nn->client_lock);
1983         status = nfserr_badsession;
1984         if (!session)
1985                 goto out;
1986         status = nfsd4_map_bcts_dir(&bcts->dir);
1987         if (status)
1988                 goto out;
1989         conn = alloc_conn(rqstp, bcts->dir);
1990         status = nfserr_jukebox;
1991         if (!conn)
1992                 goto out;
1993         nfsd4_init_conn(rqstp, conn, session);
1994         status = nfs_ok;
1995 out:
1996         nfs4_unlock_state();
1997         return status;
1998 }
1999
2000 static bool nfsd4_compound_in_session(struct nfsd4_session *session, struct nfs4_sessionid *sid)
2001 {
2002         if (!session)
2003                 return 0;
2004         return !memcmp(sid, &session->se_sessionid, sizeof(*sid));
2005 }
2006
2007 __be32
2008 nfsd4_destroy_session(struct svc_rqst *r,
2009                       struct nfsd4_compound_state *cstate,
2010                       struct nfsd4_destroy_session *sessionid)
2011 {
2012         struct nfsd4_session *ses;
2013         __be32 status;
2014         struct nfsd_net *nn = net_generic(SVC_NET(r), nfsd_net_id);
2015
2016         nfs4_lock_state();
2017         status = nfserr_not_only_op;
2018         if (nfsd4_compound_in_session(cstate->session, &sessionid->sessionid)) {
2019                 if (!nfsd4_last_compound_op(r))
2020                         goto out;
2021         }
2022         dump_sessionid(__func__, &sessionid->sessionid);
2023         spin_lock(&nn->client_lock);
2024         ses = find_in_sessionid_hashtbl(&sessionid->sessionid, SVC_NET(r));
2025         status = nfserr_badsession;
2026         if (!ses)
2027                 goto out_client_lock;
2028         status = mark_session_dead_locked(ses);
2029         if (status)
2030                 goto out_client_lock;
2031         unhash_session(ses);
2032         spin_unlock(&nn->client_lock);
2033
2034         nfsd4_probe_callback_sync(ses->se_client);
2035
2036         spin_lock(&nn->client_lock);
2037         free_session(ses);
2038         status = nfs_ok;
2039 out_client_lock:
2040         spin_unlock(&nn->client_lock);
2041 out:
2042         nfs4_unlock_state();
2043         return status;
2044 }
2045
2046 static struct nfsd4_conn *__nfsd4_find_conn(struct svc_xprt *xpt, struct nfsd4_session *s)
2047 {
2048         struct nfsd4_conn *c;
2049
2050         list_for_each_entry(c, &s->se_conns, cn_persession) {
2051                 if (c->cn_xprt == xpt) {
2052                         return c;
2053                 }
2054         }
2055         return NULL;
2056 }
2057
2058 static void nfsd4_sequence_check_conn(struct nfsd4_conn *new, struct nfsd4_session *ses)
2059 {
2060         struct nfs4_client *clp = ses->se_client;
2061         struct nfsd4_conn *c;
2062         int ret;
2063
2064         spin_lock(&clp->cl_lock);
2065         c = __nfsd4_find_conn(new->cn_xprt, ses);
2066         if (c) {
2067                 spin_unlock(&clp->cl_lock);
2068                 free_conn(new);
2069                 return;
2070         }
2071         __nfsd4_hash_conn(new, ses);
2072         spin_unlock(&clp->cl_lock);
2073         ret = nfsd4_register_conn(new);
2074         if (ret)
2075                 /* oops; xprt is already down: */
2076                 nfsd4_conn_lost(&new->cn_xpt_user);
2077         return;
2078 }
2079
2080 static bool nfsd4_session_too_many_ops(struct svc_rqst *rqstp, struct nfsd4_session *session)
2081 {
2082         struct nfsd4_compoundargs *args = rqstp->rq_argp;
2083
2084         return args->opcnt > session->se_fchannel.maxops;
2085 }
2086
2087 static bool nfsd4_request_too_big(struct svc_rqst *rqstp,
2088                                   struct nfsd4_session *session)
2089 {
2090         struct xdr_buf *xb = &rqstp->rq_arg;
2091
2092         return xb->len > session->se_fchannel.maxreq_sz;
2093 }
2094
2095 __be32
2096 nfsd4_sequence(struct svc_rqst *rqstp,
2097                struct nfsd4_compound_state *cstate,
2098                struct nfsd4_sequence *seq)
2099 {
2100         struct nfsd4_compoundres *resp = rqstp->rq_resp;
2101         struct nfsd4_session *session;
2102         struct nfs4_client *clp;
2103         struct nfsd4_slot *slot;
2104         struct nfsd4_conn *conn;
2105         __be32 status;
2106         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
2107
2108         if (resp->opcnt != 1)
2109                 return nfserr_sequence_pos;
2110
2111         /*
2112          * Will be either used or freed by nfsd4_sequence_check_conn
2113          * below.
2114          */
2115         conn = alloc_conn(rqstp, NFS4_CDFC4_FORE);
2116         if (!conn)
2117                 return nfserr_jukebox;
2118
2119         spin_lock(&nn->client_lock);
2120         status = nfserr_badsession;
2121         session = find_in_sessionid_hashtbl(&seq->sessionid, SVC_NET(rqstp));
2122         if (!session)
2123                 goto out_no_session;
2124         clp = session->se_client;
2125         status = get_client_locked(clp);
2126         if (status)
2127                 goto out_no_session;
2128         status = nfsd4_get_session_locked(session);
2129         if (status)
2130                 goto out_put_client;
2131
2132         status = nfserr_too_many_ops;
2133         if (nfsd4_session_too_many_ops(rqstp, session))
2134                 goto out_put_session;
2135
2136         status = nfserr_req_too_big;
2137         if (nfsd4_request_too_big(rqstp, session))
2138                 goto out_put_session;
2139
2140         status = nfserr_badslot;
2141         if (seq->slotid >= session->se_fchannel.maxreqs)
2142                 goto out_put_session;
2143
2144         slot = session->se_slots[seq->slotid];
2145         dprintk("%s: slotid %d\n", __func__, seq->slotid);
2146
2147         /* We do not negotiate the number of slots yet, so set the
2148          * maxslots to the session maxreqs which is used to encode
2149          * sr_highest_slotid and the sr_target_slot id to maxslots */
2150         seq->maxslots = session->se_fchannel.maxreqs;
2151
2152         status = check_slot_seqid(seq->seqid, slot->sl_seqid,
2153                                         slot->sl_flags & NFSD4_SLOT_INUSE);
2154         if (status == nfserr_replay_cache) {
2155                 status = nfserr_seq_misordered;
2156                 if (!(slot->sl_flags & NFSD4_SLOT_INITIALIZED))
2157                         goto out_put_session;
2158                 cstate->slot = slot;
2159                 cstate->session = session;
2160                 /* Return the cached reply status and set cstate->status
2161                  * for nfsd4_proc_compound processing */
2162                 status = nfsd4_replay_cache_entry(resp, seq);
2163                 cstate->status = nfserr_replay_cache;
2164                 goto out;
2165         }
2166         if (status)
2167                 goto out_put_session;
2168
2169         nfsd4_sequence_check_conn(conn, session);
2170         conn = NULL;
2171
2172         /* Success! bump slot seqid */
2173         slot->sl_seqid = seq->seqid;
2174         slot->sl_flags |= NFSD4_SLOT_INUSE;
2175         if (seq->cachethis)
2176                 slot->sl_flags |= NFSD4_SLOT_CACHETHIS;
2177         else
2178                 slot->sl_flags &= ~NFSD4_SLOT_CACHETHIS;
2179
2180         cstate->slot = slot;
2181         cstate->session = session;
2182
2183 out:
2184         switch (clp->cl_cb_state) {
2185         case NFSD4_CB_DOWN:
2186                 seq->status_flags = SEQ4_STATUS_CB_PATH_DOWN;
2187                 break;
2188         case NFSD4_CB_FAULT:
2189                 seq->status_flags = SEQ4_STATUS_BACKCHANNEL_FAULT;
2190                 break;
2191         default:
2192                 seq->status_flags = 0;
2193         }
2194         if (!list_empty(&clp->cl_revoked))
2195                 seq->status_flags |= SEQ4_STATUS_RECALLABLE_STATE_REVOKED;
2196 out_no_session:
2197         kfree(conn);
2198         spin_unlock(&nn->client_lock);
2199         return status;
2200 out_put_session:
2201         nfsd4_put_session(session);
2202 out_put_client:
2203         put_client_renew_locked(clp);
2204         goto out_no_session;
2205 }
2206
2207 __be32
2208 nfsd4_destroy_clientid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, struct nfsd4_destroy_clientid *dc)
2209 {
2210         struct nfs4_client *conf, *unconf, *clp;
2211         __be32 status = 0;
2212         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
2213
2214         nfs4_lock_state();
2215         unconf = find_unconfirmed_client(&dc->clientid, true, nn);
2216         conf = find_confirmed_client(&dc->clientid, true, nn);
2217         WARN_ON_ONCE(conf && unconf);
2218
2219         if (conf) {
2220                 clp = conf;
2221
2222                 if (client_has_state(conf)) {
2223                         status = nfserr_clientid_busy;
2224                         goto out;
2225                 }
2226         } else if (unconf)
2227                 clp = unconf;
2228         else {
2229                 status = nfserr_stale_clientid;
2230                 goto out;
2231         }
2232
2233         expire_client(clp);
2234 out:
2235         nfs4_unlock_state();
2236         return status;
2237 }
2238
2239 __be32
2240 nfsd4_reclaim_complete(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, struct nfsd4_reclaim_complete *rc)
2241 {
2242         __be32 status = 0;
2243
2244         if (rc->rca_one_fs) {
2245                 if (!cstate->current_fh.fh_dentry)
2246                         return nfserr_nofilehandle;
2247                 /*
2248                  * We don't take advantage of the rca_one_fs case.
2249                  * That's OK, it's optional, we can safely ignore it.
2250                  */
2251                  return nfs_ok;
2252         }
2253
2254         nfs4_lock_state();
2255         status = nfserr_complete_already;
2256         if (test_and_set_bit(NFSD4_CLIENT_RECLAIM_COMPLETE,
2257                              &cstate->session->se_client->cl_flags))
2258                 goto out;
2259
2260         status = nfserr_stale_clientid;
2261         if (is_client_expired(cstate->session->se_client))
2262                 /*
2263                  * The following error isn't really legal.
2264                  * But we only get here if the client just explicitly
2265                  * destroyed the client.  Surely it no longer cares what
2266                  * error it gets back on an operation for the dead
2267                  * client.
2268                  */
2269                 goto out;
2270
2271         status = nfs_ok;
2272         nfsd4_client_record_create(cstate->session->se_client);
2273 out:
2274         nfs4_unlock_state();
2275         return status;
2276 }
2277
2278 __be32
2279 nfsd4_setclientid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
2280                   struct nfsd4_setclientid *setclid)
2281 {
2282         struct xdr_netobj       clname = setclid->se_name;
2283         nfs4_verifier           clverifier = setclid->se_verf;
2284         struct nfs4_client      *conf, *unconf, *new;
2285         __be32                  status;
2286         struct nfsd_net         *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
2287
2288         /* Cases below refer to rfc 3530 section 14.2.33: */
2289         nfs4_lock_state();
2290         conf = find_confirmed_client_by_name(&clname, nn);
2291         if (conf) {
2292                 /* case 0: */
2293                 status = nfserr_clid_inuse;
2294                 if (clp_used_exchangeid(conf))
2295                         goto out;
2296                 if (!same_creds(&conf->cl_cred, &rqstp->rq_cred)) {
2297                         char addr_str[INET6_ADDRSTRLEN];
2298                         rpc_ntop((struct sockaddr *) &conf->cl_addr, addr_str,
2299                                  sizeof(addr_str));
2300                         dprintk("NFSD: setclientid: string in use by client "
2301                                 "at %s\n", addr_str);
2302                         goto out;
2303                 }
2304         }
2305         unconf = find_unconfirmed_client_by_name(&clname, nn);
2306         if (unconf)
2307                 expire_client(unconf);
2308         status = nfserr_jukebox;
2309         new = create_client(clname, rqstp, &clverifier);
2310         if (new == NULL)
2311                 goto out;
2312         if (conf && same_verf(&conf->cl_verifier, &clverifier))
2313                 /* case 1: probable callback update */
2314                 copy_clid(new, conf);
2315         else /* case 4 (new client) or cases 2, 3 (client reboot): */
2316                 gen_clid(new, nn);
2317         new->cl_minorversion = 0;
2318         gen_callback(new, setclid, rqstp);
2319         add_to_unconfirmed(new);
2320         setclid->se_clientid.cl_boot = new->cl_clientid.cl_boot;
2321         setclid->se_clientid.cl_id = new->cl_clientid.cl_id;
2322         memcpy(setclid->se_confirm.data, new->cl_confirm.data, sizeof(setclid->se_confirm.data));
2323         status = nfs_ok;
2324 out:
2325         nfs4_unlock_state();
2326         return status;
2327 }
2328
2329
2330 __be32
2331 nfsd4_setclientid_confirm(struct svc_rqst *rqstp,
2332                          struct nfsd4_compound_state *cstate,
2333                          struct nfsd4_setclientid_confirm *setclientid_confirm)
2334 {
2335         struct nfs4_client *conf, *unconf;
2336         nfs4_verifier confirm = setclientid_confirm->sc_confirm;
2337         clientid_t * clid = &setclientid_confirm->sc_clientid;
2338         __be32 status;
2339         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
2340
2341         if (STALE_CLIENTID(clid, nn))
2342                 return nfserr_stale_clientid;
2343         nfs4_lock_state();
2344
2345         conf = find_confirmed_client(clid, false, nn);
2346         unconf = find_unconfirmed_client(clid, false, nn);
2347         /*
2348          * We try hard to give out unique clientid's, so if we get an
2349          * attempt to confirm the same clientid with a different cred,
2350          * there's a bug somewhere.  Let's charitably assume it's our
2351          * bug.
2352          */
2353         status = nfserr_serverfault;
2354         if (unconf && !same_creds(&unconf->cl_cred, &rqstp->rq_cred))
2355                 goto out;
2356         if (conf && !same_creds(&conf->cl_cred, &rqstp->rq_cred))
2357                 goto out;
2358         /* cases below refer to rfc 3530 section 14.2.34: */
2359         if (!unconf || !same_verf(&confirm, &unconf->cl_confirm)) {
2360                 if (conf && !unconf) /* case 2: probable retransmit */
2361                         status = nfs_ok;
2362                 else /* case 4: client hasn't noticed we rebooted yet? */
2363                         status = nfserr_stale_clientid;
2364                 goto out;
2365         }
2366         status = nfs_ok;
2367         if (conf) { /* case 1: callback update */
2368                 nfsd4_change_callback(conf, &unconf->cl_cb_conn);
2369                 nfsd4_probe_callback(conf);
2370                 expire_client(unconf);
2371         } else { /* case 3: normal case; new or rebooted client */
2372                 conf = find_confirmed_client_by_name(&unconf->cl_name, nn);
2373                 if (conf) {
2374                         status = mark_client_expired(conf);
2375                         if (status)
2376                                 goto out;
2377                         expire_client(conf);
2378                 }
2379                 move_to_confirmed(unconf);
2380                 nfsd4_probe_callback(unconf);
2381         }
2382 out:
2383         nfs4_unlock_state();
2384         return status;
2385 }
2386
2387 static struct nfs4_file *nfsd4_alloc_file(void)
2388 {
2389         return kmem_cache_alloc(file_slab, GFP_KERNEL);
2390 }
2391
2392 /* OPEN Share state helper functions */
2393 static void nfsd4_init_file(struct nfs4_file *fp, struct inode *ino)
2394 {
2395         unsigned int hashval = file_hashval(ino);
2396
2397         atomic_set(&fp->fi_ref, 1);
2398         INIT_LIST_HEAD(&fp->fi_stateids);
2399         INIT_LIST_HEAD(&fp->fi_delegations);
2400         fp->fi_inode = igrab(ino);
2401         fp->fi_had_conflict = false;
2402         fp->fi_lease = NULL;
2403         memset(fp->fi_fds, 0, sizeof(fp->fi_fds));
2404         memset(fp->fi_access, 0, sizeof(fp->fi_access));
2405         spin_lock(&recall_lock);
2406         hlist_add_head(&fp->fi_hash, &file_hashtbl[hashval]);
2407         spin_unlock(&recall_lock);
2408 }
2409
2410 static void
2411 nfsd4_free_slab(struct kmem_cache **slab)
2412 {
2413         if (*slab == NULL)
2414                 return;
2415         kmem_cache_destroy(*slab);
2416         *slab = NULL;
2417 }
2418
2419 void
2420 nfsd4_free_slabs(void)
2421 {
2422         nfsd4_free_slab(&openowner_slab);
2423         nfsd4_free_slab(&lockowner_slab);
2424         nfsd4_free_slab(&file_slab);
2425         nfsd4_free_slab(&stateid_slab);
2426         nfsd4_free_slab(&deleg_slab);
2427 }
2428
2429 int
2430 nfsd4_init_slabs(void)
2431 {
2432         openowner_slab = kmem_cache_create("nfsd4_openowners",
2433                         sizeof(struct nfs4_openowner), 0, 0, NULL);
2434         if (openowner_slab == NULL)
2435                 goto out_nomem;
2436         lockowner_slab = kmem_cache_create("nfsd4_lockowners",
2437                         sizeof(struct nfs4_lockowner), 0, 0, NULL);
2438         if (lockowner_slab == NULL)
2439                 goto out_nomem;
2440         file_slab = kmem_cache_create("nfsd4_files",
2441                         sizeof(struct nfs4_file), 0, 0, NULL);
2442         if (file_slab == NULL)
2443                 goto out_nomem;
2444         stateid_slab = kmem_cache_create("nfsd4_stateids",
2445                         sizeof(struct nfs4_ol_stateid), 0, 0, NULL);
2446         if (stateid_slab == NULL)
2447                 goto out_nomem;
2448         deleg_slab = kmem_cache_create("nfsd4_delegations",
2449                         sizeof(struct nfs4_delegation), 0, 0, NULL);
2450         if (deleg_slab == NULL)
2451                 goto out_nomem;
2452         return 0;
2453 out_nomem:
2454         nfsd4_free_slabs();
2455         dprintk("nfsd4: out of memory while initializing nfsv4\n");
2456         return -ENOMEM;
2457 }
2458
2459 void nfs4_free_openowner(struct nfs4_openowner *oo)
2460 {
2461         kfree(oo->oo_owner.so_owner.data);
2462         kmem_cache_free(openowner_slab, oo);
2463 }
2464
2465 void nfs4_free_lockowner(struct nfs4_lockowner *lo)
2466 {
2467         kfree(lo->lo_owner.so_owner.data);
2468         kmem_cache_free(lockowner_slab, lo);
2469 }
2470
2471 static void init_nfs4_replay(struct nfs4_replay *rp)
2472 {
2473         rp->rp_status = nfserr_serverfault;
2474         rp->rp_buflen = 0;
2475         rp->rp_buf = rp->rp_ibuf;
2476 }
2477
2478 static inline void *alloc_stateowner(struct kmem_cache *slab, struct xdr_netobj *owner, struct nfs4_client *clp)
2479 {
2480         struct nfs4_stateowner *sop;
2481
2482         sop = kmem_cache_alloc(slab, GFP_KERNEL);
2483         if (!sop)
2484                 return NULL;
2485
2486         sop->so_owner.data = kmemdup(owner->data, owner->len, GFP_KERNEL);
2487         if (!sop->so_owner.data) {
2488                 kmem_cache_free(slab, sop);
2489                 return NULL;
2490         }
2491         sop->so_owner.len = owner->len;
2492
2493         INIT_LIST_HEAD(&sop->so_stateids);
2494         sop->so_client = clp;
2495         init_nfs4_replay(&sop->so_replay);
2496         return sop;
2497 }
2498
2499 static void hash_openowner(struct nfs4_openowner *oo, struct nfs4_client *clp, unsigned int strhashval)
2500 {
2501         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
2502
2503         list_add(&oo->oo_owner.so_strhash, &nn->ownerstr_hashtbl[strhashval]);
2504         list_add(&oo->oo_perclient, &clp->cl_openowners);
2505 }
2506
2507 static struct nfs4_openowner *
2508 alloc_init_open_stateowner(unsigned int strhashval, struct nfs4_client *clp, struct nfsd4_open *open) {
2509         struct nfs4_openowner *oo;
2510
2511         oo = alloc_stateowner(openowner_slab, &open->op_owner, clp);
2512         if (!oo)
2513                 return NULL;
2514         oo->oo_owner.so_is_open_owner = 1;
2515         oo->oo_owner.so_seqid = open->op_seqid;
2516         oo->oo_flags = NFS4_OO_NEW;
2517         oo->oo_time = 0;
2518         oo->oo_last_closed_stid = NULL;
2519         INIT_LIST_HEAD(&oo->oo_close_lru);
2520         hash_openowner(oo, clp, strhashval);
2521         return oo;
2522 }
2523
2524 static void init_open_stateid(struct nfs4_ol_stateid *stp, struct nfs4_file *fp, struct nfsd4_open *open) {
2525         struct nfs4_openowner *oo = open->op_openowner;
2526
2527         stp->st_stid.sc_type = NFS4_OPEN_STID;
2528         INIT_LIST_HEAD(&stp->st_lockowners);
2529         list_add(&stp->st_perstateowner, &oo->oo_owner.so_stateids);
2530         list_add(&stp->st_perfile, &fp->fi_stateids);
2531         stp->st_stateowner = &oo->oo_owner;
2532         get_nfs4_file(fp);
2533         stp->st_file = fp;
2534         stp->st_access_bmap = 0;
2535         stp->st_deny_bmap = 0;
2536         set_access(open->op_share_access, stp);
2537         set_deny(open->op_share_deny, stp);
2538         stp->st_openstp = NULL;
2539 }
2540
2541 static void
2542 move_to_close_lru(struct nfs4_openowner *oo, struct net *net)
2543 {
2544         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
2545
2546         dprintk("NFSD: move_to_close_lru nfs4_openowner %p\n", oo);
2547
2548         list_move_tail(&oo->oo_close_lru, &nn->close_lru);
2549         oo->oo_time = get_seconds();
2550 }
2551
2552 static int
2553 same_owner_str(struct nfs4_stateowner *sop, struct xdr_netobj *owner,
2554                                                         clientid_t *clid)
2555 {
2556         return (sop->so_owner.len == owner->len) &&
2557                 0 == memcmp(sop->so_owner.data, owner->data, owner->len) &&
2558                 (sop->so_client->cl_clientid.cl_id == clid->cl_id);
2559 }
2560
2561 static struct nfs4_openowner *
2562 find_openstateowner_str(unsigned int hashval, struct nfsd4_open *open,
2563                         bool sessions, struct nfsd_net *nn)
2564 {
2565         struct nfs4_stateowner *so;
2566         struct nfs4_openowner *oo;
2567         struct nfs4_client *clp;
2568
2569         list_for_each_entry(so, &nn->ownerstr_hashtbl[hashval], so_strhash) {
2570                 if (!so->so_is_open_owner)
2571                         continue;
2572                 if (same_owner_str(so, &open->op_owner, &open->op_clientid)) {
2573                         oo = openowner(so);
2574                         clp = oo->oo_owner.so_client;
2575                         if ((bool)clp->cl_minorversion != sessions)
2576                                 return NULL;
2577                         renew_client(oo->oo_owner.so_client);
2578                         return oo;
2579                 }
2580         }
2581         return NULL;
2582 }
2583
2584 /* search file_hashtbl[] for file */
2585 static struct nfs4_file *
2586 find_file(struct inode *ino)
2587 {
2588         unsigned int hashval = file_hashval(ino);
2589         struct nfs4_file *fp;
2590
2591         spin_lock(&recall_lock);
2592         hlist_for_each_entry(fp, &file_hashtbl[hashval], fi_hash) {
2593                 if (fp->fi_inode == ino) {
2594                         get_nfs4_file(fp);
2595                         spin_unlock(&recall_lock);
2596                         return fp;
2597                 }
2598         }
2599         spin_unlock(&recall_lock);
2600         return NULL;
2601 }
2602
2603 /*
2604  * Called to check deny when READ with all zero stateid or
2605  * WRITE with all zero or all one stateid
2606  */
2607 static __be32
2608 nfs4_share_conflict(struct svc_fh *current_fh, unsigned int deny_type)
2609 {
2610         struct inode *ino = current_fh->fh_dentry->d_inode;
2611         struct nfs4_file *fp;
2612         struct nfs4_ol_stateid *stp;
2613         __be32 ret;
2614
2615         fp = find_file(ino);
2616         if (!fp)
2617                 return nfs_ok;
2618         ret = nfserr_locked;
2619         /* Search for conflicting share reservations */
2620         list_for_each_entry(stp, &fp->fi_stateids, st_perfile) {
2621                 if (test_deny(deny_type, stp) ||
2622                     test_deny(NFS4_SHARE_DENY_BOTH, stp))
2623                         goto out;
2624         }
2625         ret = nfs_ok;
2626 out:
2627         put_nfs4_file(fp);
2628         return ret;
2629 }
2630
2631 static void nfsd_break_one_deleg(struct nfs4_delegation *dp)
2632 {
2633         struct nfs4_client *clp = dp->dl_stid.sc_client;
2634         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
2635
2636         /* We're assuming the state code never drops its reference
2637          * without first removing the lease.  Since we're in this lease
2638          * callback (and since the lease code is serialized by the kernel
2639          * lock) we know the server hasn't removed the lease yet, we know
2640          * it's safe to take a reference: */
2641         atomic_inc(&dp->dl_count);
2642
2643         list_add_tail(&dp->dl_recall_lru, &nn->del_recall_lru);
2644
2645         /* only place dl_time is set. protected by lock_flocks*/
2646         dp->dl_time = get_seconds();
2647
2648         nfsd4_cb_recall(dp);
2649 }
2650
2651 /* Called from break_lease() with lock_flocks() held. */
2652 static void nfsd_break_deleg_cb(struct file_lock *fl)
2653 {
2654         struct nfs4_file *fp = (struct nfs4_file *)fl->fl_owner;
2655         struct nfs4_delegation *dp;
2656
2657         if (!fp) {
2658                 WARN(1, "(%p)->fl_owner NULL\n", fl);
2659                 return;
2660         }
2661         if (fp->fi_had_conflict) {
2662                 WARN(1, "duplicate break on %p\n", fp);
2663                 return;
2664         }
2665         /*
2666          * We don't want the locks code to timeout the lease for us;
2667          * we'll remove it ourself if a delegation isn't returned
2668          * in time:
2669          */
2670         fl->fl_break_time = 0;
2671
2672         spin_lock(&recall_lock);
2673         fp->fi_had_conflict = true;
2674         list_for_each_entry(dp, &fp->fi_delegations, dl_perfile)
2675                 nfsd_break_one_deleg(dp);
2676         spin_unlock(&recall_lock);
2677 }
2678
2679 static
2680 int nfsd_change_deleg_cb(struct file_lock **onlist, int arg)
2681 {
2682         if (arg & F_UNLCK)
2683                 return lease_modify(onlist, arg);
2684         else
2685                 return -EAGAIN;
2686 }
2687
2688 static const struct lock_manager_operations nfsd_lease_mng_ops = {
2689         .lm_break = nfsd_break_deleg_cb,
2690         .lm_change = nfsd_change_deleg_cb,
2691 };
2692
2693 static __be32 nfsd4_check_seqid(struct nfsd4_compound_state *cstate, struct nfs4_stateowner *so, u32 seqid)
2694 {
2695         if (nfsd4_has_session(cstate))
2696                 return nfs_ok;
2697         if (seqid == so->so_seqid - 1)
2698                 return nfserr_replay_me;
2699         if (seqid == so->so_seqid)
2700                 return nfs_ok;
2701         return nfserr_bad_seqid;
2702 }
2703
2704 __be32
2705 nfsd4_process_open1(struct nfsd4_compound_state *cstate,
2706                     struct nfsd4_open *open, struct nfsd_net *nn)
2707 {
2708         clientid_t *clientid = &open->op_clientid;
2709         struct nfs4_client *clp = NULL;
2710         unsigned int strhashval;
2711         struct nfs4_openowner *oo = NULL;
2712         __be32 status;
2713
2714         if (STALE_CLIENTID(&open->op_clientid, nn))
2715                 return nfserr_stale_clientid;
2716         /*
2717          * In case we need it later, after we've already created the
2718          * file and don't want to risk a further failure:
2719          */
2720         open->op_file = nfsd4_alloc_file();
2721         if (open->op_file == NULL)
2722                 return nfserr_jukebox;
2723
2724         strhashval = ownerstr_hashval(clientid->cl_id, &open->op_owner);
2725         oo = find_openstateowner_str(strhashval, open, cstate->minorversion, nn);
2726         open->op_openowner = oo;
2727         if (!oo) {
2728                 clp = find_confirmed_client(clientid, cstate->minorversion,
2729                                             nn);
2730                 if (clp == NULL)
2731                         return nfserr_expired;
2732                 goto new_owner;
2733         }
2734         if (!(oo->oo_flags & NFS4_OO_CONFIRMED)) {
2735                 /* Replace unconfirmed owners without checking for replay. */
2736                 clp = oo->oo_owner.so_client;
2737                 release_openowner(oo);
2738                 open->op_openowner = NULL;
2739                 goto new_owner;
2740         }
2741         status = nfsd4_check_seqid(cstate, &oo->oo_owner, open->op_seqid);
2742         if (status)
2743                 return status;
2744         clp = oo->oo_owner.so_client;
2745         goto alloc_stateid;
2746 new_owner:
2747         oo = alloc_init_open_stateowner(strhashval, clp, open);
2748         if (oo == NULL)
2749                 return nfserr_jukebox;
2750         open->op_openowner = oo;
2751 alloc_stateid:
2752         open->op_stp = nfs4_alloc_stateid(clp);
2753         if (!open->op_stp)
2754                 return nfserr_jukebox;
2755         return nfs_ok;
2756 }
2757
2758 static inline __be32
2759 nfs4_check_delegmode(struct nfs4_delegation *dp, int flags)
2760 {
2761         if ((flags & WR_STATE) && (dp->dl_type == NFS4_OPEN_DELEGATE_READ))
2762                 return nfserr_openmode;
2763         else
2764                 return nfs_ok;
2765 }
2766
2767 static int share_access_to_flags(u32 share_access)
2768 {
2769         return share_access == NFS4_SHARE_ACCESS_READ ? RD_STATE : WR_STATE;
2770 }
2771
2772 static struct nfs4_delegation *find_deleg_stateid(struct nfs4_client *cl, stateid_t *s)
2773 {
2774         struct nfs4_stid *ret;
2775
2776         ret = find_stateid_by_type(cl, s, NFS4_DELEG_STID);
2777         if (!ret)
2778                 return NULL;
2779         return delegstateid(ret);
2780 }
2781
2782 static bool nfsd4_is_deleg_cur(struct nfsd4_open *open)
2783 {
2784         return open->op_claim_type == NFS4_OPEN_CLAIM_DELEGATE_CUR ||
2785                open->op_claim_type == NFS4_OPEN_CLAIM_DELEG_CUR_FH;
2786 }
2787
2788 static __be32
2789 nfs4_check_deleg(struct nfs4_client *cl, struct nfsd4_open *open,
2790                 struct nfs4_delegation **dp)
2791 {
2792         int flags;
2793         __be32 status = nfserr_bad_stateid;
2794
2795         *dp = find_deleg_stateid(cl, &open->op_delegate_stateid);
2796         if (*dp == NULL)
2797                 goto out;
2798         flags = share_access_to_flags(open->op_share_access);
2799         status = nfs4_check_delegmode(*dp, flags);
2800         if (status)
2801                 *dp = NULL;
2802 out:
2803         if (!nfsd4_is_deleg_cur(open))
2804                 return nfs_ok;
2805         if (status)
2806                 return status;
2807         open->op_openowner->oo_flags |= NFS4_OO_CONFIRMED;
2808         return nfs_ok;
2809 }
2810
2811 static __be32
2812 nfs4_check_open(struct nfs4_file *fp, struct nfsd4_open *open, struct nfs4_ol_stateid **stpp)
2813 {
2814         struct nfs4_ol_stateid *local;
2815         struct nfs4_openowner *oo = open->op_openowner;
2816
2817         list_for_each_entry(local, &fp->fi_stateids, st_perfile) {
2818                 /* ignore lock owners */
2819                 if (local->st_stateowner->so_is_open_owner == 0)
2820                         continue;
2821                 /* remember if we have seen this open owner */
2822                 if (local->st_stateowner == &oo->oo_owner)
2823                         *stpp = local;
2824                 /* check for conflicting share reservations */
2825                 if (!test_share(local, open))
2826                         return nfserr_share_denied;
2827         }
2828         return nfs_ok;
2829 }
2830
2831 static inline int nfs4_access_to_access(u32 nfs4_access)
2832 {
2833         int flags = 0;
2834
2835         if (nfs4_access & NFS4_SHARE_ACCESS_READ)
2836                 flags |= NFSD_MAY_READ;
2837         if (nfs4_access & NFS4_SHARE_ACCESS_WRITE)
2838                 flags |= NFSD_MAY_WRITE;
2839         return flags;
2840 }
2841
2842 static __be32 nfs4_get_vfs_file(struct svc_rqst *rqstp, struct nfs4_file *fp,
2843                 struct svc_fh *cur_fh, struct nfsd4_open *open)
2844 {
2845         __be32 status;
2846         int oflag = nfs4_access_to_omode(open->op_share_access);
2847         int access = nfs4_access_to_access(open->op_share_access);
2848
2849         if (!fp->fi_fds[oflag]) {
2850                 status = nfsd_open(rqstp, cur_fh, S_IFREG, access,
2851                         &fp->fi_fds[oflag]);
2852                 if (status)
2853                         return status;
2854         }
2855         nfs4_file_get_access(fp, oflag);
2856
2857         return nfs_ok;
2858 }
2859
2860 static inline __be32
2861 nfsd4_truncate(struct svc_rqst *rqstp, struct svc_fh *fh,
2862                 struct nfsd4_open *open)
2863 {
2864         struct iattr iattr = {
2865                 .ia_valid = ATTR_SIZE,
2866                 .ia_size = 0,
2867         };
2868         if (!open->op_truncate)
2869                 return 0;
2870         if (!(open->op_share_access & NFS4_SHARE_ACCESS_WRITE))
2871                 return nfserr_inval;
2872         return nfsd_setattr(rqstp, fh, &iattr, 0, (time_t)0);
2873 }
2874
2875 static __be32
2876 nfs4_upgrade_open(struct svc_rqst *rqstp, struct nfs4_file *fp, struct svc_fh *cur_fh, struct nfs4_ol_stateid *stp, struct nfsd4_open *open)
2877 {
2878         u32 op_share_access = open->op_share_access;
2879         bool new_access;
2880         __be32 status;
2881
2882         new_access = !test_access(op_share_access, stp);
2883         if (new_access) {
2884                 status = nfs4_get_vfs_file(rqstp, fp, cur_fh, open);
2885                 if (status)
2886                         return status;
2887         }
2888         status = nfsd4_truncate(rqstp, cur_fh, open);
2889         if (status) {
2890                 if (new_access) {
2891                         int oflag = nfs4_access_to_omode(op_share_access);
2892                         nfs4_file_put_access(fp, oflag);
2893                 }
2894                 return status;
2895         }
2896         /* remember the open */
2897         set_access(op_share_access, stp);
2898         set_deny(open->op_share_deny, stp);
2899
2900         return nfs_ok;
2901 }
2902
2903
2904 static void
2905 nfs4_set_claim_prev(struct nfsd4_open *open, bool has_session)
2906 {
2907         open->op_openowner->oo_flags |= NFS4_OO_CONFIRMED;
2908 }
2909
2910 /* Should we give out recallable state?: */
2911 static bool nfsd4_cb_channel_good(struct nfs4_client *clp)
2912 {
2913         if (clp->cl_cb_state == NFSD4_CB_UP)
2914                 return true;
2915         /*
2916          * In the sessions case, since we don't have to establish a
2917          * separate connection for callbacks, we assume it's OK
2918          * until we hear otherwise:
2919          */
2920         return clp->cl_minorversion && clp->cl_cb_state == NFSD4_CB_UNKNOWN;
2921 }
2922
2923 static struct file_lock *nfs4_alloc_init_lease(struct nfs4_delegation *dp, int flag)
2924 {
2925         struct file_lock *fl;
2926
2927         fl = locks_alloc_lock();
2928         if (!fl)
2929                 return NULL;
2930         locks_init_lock(fl);
2931         fl->fl_lmops = &nfsd_lease_mng_ops;
2932         fl->fl_flags = FL_LEASE;
2933         fl->fl_type = flag == NFS4_OPEN_DELEGATE_READ? F_RDLCK: F_WRLCK;
2934         fl->fl_end = OFFSET_MAX;
2935         fl->fl_owner = (fl_owner_t)(dp->dl_file);
2936         fl->fl_pid = current->tgid;
2937         return fl;
2938 }
2939
2940 static int nfs4_setlease(struct nfs4_delegation *dp, int flag)
2941 {
2942         struct nfs4_file *fp = dp->dl_file;
2943         struct file_lock *fl;
2944         int status;
2945
2946         fl = nfs4_alloc_init_lease(dp, flag);
2947         if (!fl)
2948                 return -ENOMEM;
2949         fl->fl_file = find_readable_file(fp);
2950         list_add(&dp->dl_perclnt, &dp->dl_stid.sc_client->cl_delegations);
2951         status = vfs_setlease(fl->fl_file, fl->fl_type, &fl);
2952         if (status) {
2953                 list_del_init(&dp->dl_perclnt);
2954                 locks_free_lock(fl);
2955                 return -ENOMEM;
2956         }
2957         fp->fi_lease = fl;
2958         fp->fi_deleg_file = get_file(fl->fl_file);
2959         atomic_set(&fp->fi_delegees, 1);
2960         list_add(&dp->dl_perfile, &fp->fi_delegations);
2961         return 0;
2962 }
2963
2964 static int nfs4_set_delegation(struct nfs4_delegation *dp, int flag, struct nfs4_file *fp)
2965 {
2966         int status;
2967
2968         if (fp->fi_had_conflict)
2969                 return -EAGAIN;
2970         get_nfs4_file(fp);
2971         dp->dl_file = fp;
2972         if (!fp->fi_lease) {
2973                 status = nfs4_setlease(dp, flag);
2974                 if (status)
2975                         goto out_free;
2976                 return 0;
2977         }
2978         spin_lock(&recall_lock);
2979         if (fp->fi_had_conflict) {
2980                 spin_unlock(&recall_lock);
2981                 status = -EAGAIN;
2982                 goto out_free;
2983         }
2984         atomic_inc(&fp->fi_delegees);
2985         list_add(&dp->dl_perfile, &fp->fi_delegations);
2986         spin_unlock(&recall_lock);
2987         list_add(&dp->dl_perclnt, &dp->dl_stid.sc_client->cl_delegations);
2988         return 0;
2989 out_free:
2990         put_nfs4_file(fp);
2991         dp->dl_file = fp;
2992         return status;
2993 }
2994
2995 static void nfsd4_open_deleg_none_ext(struct nfsd4_open *open, int status)
2996 {
2997         open->op_delegate_type = NFS4_OPEN_DELEGATE_NONE_EXT;
2998         if (status == -EAGAIN)
2999                 open->op_why_no_deleg = WND4_CONTENTION;
3000         else {
3001                 open->op_why_no_deleg = WND4_RESOURCE;
3002                 switch (open->op_deleg_want) {
3003                 case NFS4_SHARE_WANT_READ_DELEG:
3004                 case NFS4_SHARE_WANT_WRITE_DELEG:
3005                 case NFS4_SHARE_WANT_ANY_DELEG:
3006                         break;
3007                 case NFS4_SHARE_WANT_CANCEL:
3008                         open->op_why_no_deleg = WND4_CANCELLED;
3009                         break;
3010                 case NFS4_SHARE_WANT_NO_DELEG:
3011                         WARN_ON_ONCE(1);
3012                 }
3013         }
3014 }
3015
3016 /*
3017  * Attempt to hand out a delegation.
3018  */
3019 static void
3020 nfs4_open_delegation(struct net *net, struct svc_fh *fh,
3021                      struct nfsd4_open *open, struct nfs4_ol_stateid *stp)
3022 {
3023         struct nfs4_delegation *dp;
3024         struct nfs4_openowner *oo = container_of(stp->st_stateowner, struct nfs4_openowner, oo_owner);
3025         int cb_up;
3026         int status = 0, flag = 0;
3027
3028         cb_up = nfsd4_cb_channel_good(oo->oo_owner.so_client);
3029         flag = NFS4_OPEN_DELEGATE_NONE;
3030         open->op_recall = 0;
3031         switch (open->op_claim_type) {
3032                 case NFS4_OPEN_CLAIM_PREVIOUS:
3033                         if (!cb_up)
3034                                 open->op_recall = 1;
3035                         flag = open->op_delegate_type;
3036                         if (flag == NFS4_OPEN_DELEGATE_NONE)
3037                                 goto out;
3038                         break;
3039                 case NFS4_OPEN_CLAIM_NULL:
3040                         /* Let's not give out any delegations till everyone's
3041                          * had the chance to reclaim theirs.... */
3042                         if (locks_in_grace(net))
3043                                 goto out;
3044                         if (!cb_up || !(oo->oo_flags & NFS4_OO_CONFIRMED))
3045                                 goto out;
3046                         if (open->op_share_access & NFS4_SHARE_ACCESS_WRITE)
3047                                 flag = NFS4_OPEN_DELEGATE_WRITE;
3048                         else
3049                                 flag = NFS4_OPEN_DELEGATE_READ;
3050                         break;
3051                 default:
3052                         goto out;
3053         }
3054
3055         dp = alloc_init_deleg(oo->oo_owner.so_client, stp, fh, flag);
3056         if (dp == NULL)
3057                 goto out_no_deleg;
3058         status = nfs4_set_delegation(dp, flag, stp->st_file);
3059         if (status)
3060                 goto out_free;
3061
3062         memcpy(&open->op_delegate_stateid, &dp->dl_stid.sc_stateid, sizeof(dp->dl_stid.sc_stateid));
3063
3064         dprintk("NFSD: delegation stateid=" STATEID_FMT "\n",
3065                 STATEID_VAL(&dp->dl_stid.sc_stateid));
3066 out:
3067         open->op_delegate_type = flag;
3068         if (flag == NFS4_OPEN_DELEGATE_NONE) {
3069                 if (open->op_claim_type == NFS4_OPEN_CLAIM_PREVIOUS &&
3070                     open->op_delegate_type != NFS4_OPEN_DELEGATE_NONE)
3071                         dprintk("NFSD: WARNING: refusing delegation reclaim\n");
3072
3073                 /* 4.1 client asking for a delegation? */
3074                 if (open->op_deleg_want)
3075                         nfsd4_open_deleg_none_ext(open, status);
3076         }
3077         return;
3078 out_free:
3079         unhash_stid(&dp->dl_stid);
3080         nfs4_put_delegation(dp);
3081 out_no_deleg:
3082         flag = NFS4_OPEN_DELEGATE_NONE;
3083         goto out;
3084 }
3085
3086 static void nfsd4_deleg_xgrade_none_ext(struct nfsd4_open *open,
3087                                         struct nfs4_delegation *dp)
3088 {
3089         if (open->op_deleg_want == NFS4_SHARE_WANT_READ_DELEG &&
3090             dp->dl_type == NFS4_OPEN_DELEGATE_WRITE) {
3091                 open->op_delegate_type = NFS4_OPEN_DELEGATE_NONE_EXT;
3092                 open->op_why_no_deleg = WND4_NOT_SUPP_DOWNGRADE;
3093         } else if (open->op_deleg_want == NFS4_SHARE_WANT_WRITE_DELEG &&
3094                    dp->dl_type == NFS4_OPEN_DELEGATE_WRITE) {
3095                 open->op_delegate_type = NFS4_OPEN_DELEGATE_NONE_EXT;
3096                 open->op_why_no_deleg = WND4_NOT_SUPP_UPGRADE;
3097         }
3098         /* Otherwise the client must be confused wanting a delegation
3099          * it already has, therefore we don't return
3100          * NFS4_OPEN_DELEGATE_NONE_EXT and reason.
3101          */
3102 }
3103
3104 /*
3105  * called with nfs4_lock_state() held.
3106  */
3107 __be32
3108 nfsd4_process_open2(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_open *open)
3109 {
3110         struct nfsd4_compoundres *resp = rqstp->rq_resp;
3111         struct nfs4_client *cl = open->op_openowner->oo_owner.so_client;
3112         struct nfs4_file *fp = NULL;
3113         struct inode *ino = current_fh->fh_dentry->d_inode;
3114         struct nfs4_ol_stateid *stp = NULL;
3115         struct nfs4_delegation *dp = NULL;
3116         __be32 status;
3117
3118         /*
3119          * Lookup file; if found, lookup stateid and check open request,
3120          * and check for delegations in the process of being recalled.
3121          * If not found, create the nfs4_file struct
3122          */
3123         fp = find_file(ino);
3124         if (fp) {
3125                 if ((status = nfs4_check_open(fp, open, &stp)))
3126                         goto out;
3127                 status = nfs4_check_deleg(cl, open, &dp);
3128                 if (status)
3129                         goto out;
3130         } else {
3131                 status = nfserr_bad_stateid;
3132                 if (nfsd4_is_deleg_cur(open))
3133                         goto out;
3134                 status = nfserr_jukebox;
3135                 fp = open->op_file;
3136                 open->op_file = NULL;
3137                 nfsd4_init_file(fp, ino);
3138         }
3139
3140         /*
3141          * OPEN the file, or upgrade an existing OPEN.
3142          * If truncate fails, the OPEN fails.
3143          */
3144         if (stp) {
3145                 /* Stateid was found, this is an OPEN upgrade */
3146                 status = nfs4_upgrade_open(rqstp, fp, current_fh, stp, open);
3147                 if (status)
3148                         goto out;
3149         } else {
3150                 status = nfs4_get_vfs_file(rqstp, fp, current_fh, open);
3151                 if (status)
3152                         goto out;
3153                 status = nfsd4_truncate(rqstp, current_fh, open);
3154                 if (status)
3155                         goto out;
3156                 stp = open->op_stp;
3157                 open->op_stp = NULL;
3158                 init_open_stateid(stp, fp, open);
3159         }
3160         update_stateid(&stp->st_stid.sc_stateid);
3161         memcpy(&open->op_stateid, &stp->st_stid.sc_stateid, sizeof(stateid_t));
3162
3163         if (nfsd4_has_session(&resp->cstate)) {
3164                 open->op_openowner->oo_flags |= NFS4_OO_CONFIRMED;
3165
3166                 if (open->op_deleg_want & NFS4_SHARE_WANT_NO_DELEG) {
3167                         open->op_delegate_type = NFS4_OPEN_DELEGATE_NONE_EXT;
3168                         open->op_why_no_deleg = WND4_NOT_WANTED;
3169                         goto nodeleg;
3170                 }
3171         }
3172
3173         /*
3174         * Attempt to hand out a delegation. No error return, because the
3175         * OPEN succeeds even if we fail.
3176         */
3177         nfs4_open_delegation(SVC_NET(rqstp), current_fh, open, stp);
3178 nodeleg:
3179         status = nfs_ok;
3180
3181         dprintk("%s: stateid=" STATEID_FMT "\n", __func__,
3182                 STATEID_VAL(&stp->st_stid.sc_stateid));
3183 out:
3184         /* 4.1 client trying to upgrade/downgrade delegation? */
3185         if (open->op_delegate_type == NFS4_OPEN_DELEGATE_NONE && dp &&
3186             open->op_deleg_want)
3187                 nfsd4_deleg_xgrade_none_ext(open, dp);
3188
3189         if (fp)
3190                 put_nfs4_file(fp);
3191         if (status == 0 && open->op_claim_type == NFS4_OPEN_CLAIM_PREVIOUS)
3192                 nfs4_set_claim_prev(open, nfsd4_has_session(&resp->cstate));
3193         /*
3194         * To finish the open response, we just need to set the rflags.
3195         */
3196         open->op_rflags = NFS4_OPEN_RESULT_LOCKTYPE_POSIX;
3197         if (!(open->op_openowner->oo_flags & NFS4_OO_CONFIRMED) &&
3198             !nfsd4_has_session(&resp->cstate))
3199                 open->op_rflags |= NFS4_OPEN_RESULT_CONFIRM;
3200
3201         return status;
3202 }
3203
3204 void nfsd4_cleanup_open_state(struct nfsd4_open *open, __be32 status)
3205 {
3206         if (open->op_openowner) {
3207                 struct nfs4_openowner *oo = open->op_openowner;
3208
3209                 if (!list_empty(&oo->oo_owner.so_stateids))
3210                         list_del_init(&oo->oo_close_lru);
3211                 if (oo->oo_flags & NFS4_OO_NEW) {
3212                         if (status) {
3213                                 release_openowner(oo);
3214                                 open->op_openowner = NULL;
3215                         } else
3216                                 oo->oo_flags &= ~NFS4_OO_NEW;
3217                 }
3218         }
3219         if (open->op_file)
3220                 nfsd4_free_file(open->op_file);
3221         if (open->op_stp)
3222                 free_generic_stateid(open->op_stp);
3223 }
3224
3225 static __be32 lookup_clientid(clientid_t *clid, bool session, struct nfsd_net *nn, struct nfs4_client **clp)
3226 {
3227         struct nfs4_client *found;
3228
3229         if (STALE_CLIENTID(clid, nn))
3230                 return nfserr_stale_clientid;
3231         found = find_confirmed_client(clid, session, nn);
3232         if (clp)
3233                 *clp = found;
3234         return found ? nfs_ok : nfserr_expired;
3235 }
3236
3237 __be32
3238 nfsd4_renew(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
3239             clientid_t *clid)
3240 {
3241         struct nfs4_client *clp;
3242         __be32 status;
3243         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
3244
3245         nfs4_lock_state();
3246         dprintk("process_renew(%08x/%08x): starting\n",
3247                         clid->cl_boot, clid->cl_id);
3248         status = lookup_clientid(clid, cstate->minorversion, nn, &clp);
3249         if (status)
3250                 goto out;
3251         status = nfserr_cb_path_down;
3252         if (!list_empty(&clp->cl_delegations)
3253                         && clp->cl_cb_state != NFSD4_CB_UP)
3254                 goto out;
3255         status = nfs_ok;
3256 out:
3257         nfs4_unlock_state();
3258         return status;
3259 }
3260
3261 static void
3262 nfsd4_end_grace(struct nfsd_net *nn)
3263 {
3264         /* do nothing if grace period already ended */
3265         if (nn->grace_ended)
3266                 return;
3267
3268         dprintk("NFSD: end of grace period\n");
3269         nn->grace_ended = true;
3270         nfsd4_record_grace_done(nn, nn->boot_time);
3271         locks_end_grace(&nn->nfsd4_manager);
3272         /*
3273          * Now that every NFSv4 client has had the chance to recover and
3274          * to see the (possibly new, possibly shorter) lease time, we
3275          * can safely set the next grace time to the current lease time:
3276          */
3277         nn->nfsd4_grace = nn->nfsd4_lease;
3278 }
3279
3280 static time_t
3281 nfs4_laundromat(struct nfsd_net *nn)
3282 {
3283         struct nfs4_client *clp;
3284         struct nfs4_openowner *oo;
3285         struct nfs4_delegation *dp;
3286         struct list_head *pos, *next, reaplist;
3287         time_t cutoff = get_seconds() - nn->nfsd4_lease;
3288         time_t t, clientid_val = nn->nfsd4_lease;
3289         time_t u, test_val = nn->nfsd4_lease;
3290
3291         nfs4_lock_state();
3292
3293         dprintk("NFSD: laundromat service - starting\n");
3294         nfsd4_end_grace(nn);
3295         INIT_LIST_HEAD(&reaplist);
3296         spin_lock(&nn->client_lock);
3297         list_for_each_safe(pos, next, &nn->client_lru) {
3298                 clp = list_entry(pos, struct nfs4_client, cl_lru);
3299                 if (time_after((unsigned long)clp->cl_time, (unsigned long)cutoff)) {
3300                         t = clp->cl_time - cutoff;
3301                         if (clientid_val > t)
3302                                 clientid_val = t;
3303                         break;
3304                 }
3305                 if (mark_client_expired_locked(clp)) {
3306                         dprintk("NFSD: client in use (clientid %08x)\n",
3307                                 clp->cl_clientid.cl_id);
3308                         continue;
3309                 }
3310                 list_move(&clp->cl_lru, &reaplist);
3311         }
3312         spin_unlock(&nn->client_lock);
3313         list_for_each_safe(pos, next, &reaplist) {
3314                 clp = list_entry(pos, struct nfs4_client, cl_lru);
3315                 dprintk("NFSD: purging unused client (clientid %08x)\n",
3316                         clp->cl_clientid.cl_id);
3317                 expire_client(clp);
3318         }
3319         spin_lock(&recall_lock);
3320         list_for_each_safe(pos, next, &nn->del_recall_lru) {
3321                 dp = list_entry (pos, struct nfs4_delegation, dl_recall_lru);
3322                 if (net_generic(dp->dl_stid.sc_client->net, nfsd_net_id) != nn)
3323                         continue;
3324                 if (time_after((unsigned long)dp->dl_time, (unsigned long)cutoff)) {
3325                         u = dp->dl_time - cutoff;
3326                         if (test_val > u)
3327                                 test_val = u;
3328                         break;
3329                 }
3330                 list_move(&dp->dl_recall_lru, &reaplist);
3331         }
3332         spin_unlock(&recall_lock);
3333         list_for_each_safe(pos, next, &reaplist) {
3334                 dp = list_entry (pos, struct nfs4_delegation, dl_recall_lru);
3335                 revoke_delegation(dp);
3336         }
3337         test_val = nn->nfsd4_lease;
3338         list_for_each_safe(pos, next, &nn->close_lru) {
3339                 oo = container_of(pos, struct nfs4_openowner, oo_close_lru);
3340                 if (time_after((unsigned long)oo->oo_time, (unsigned long)cutoff)) {
3341                         u = oo->oo_time - cutoff;
3342                         if (test_val > u)
3343                                 test_val = u;
3344                         break;
3345                 }
3346                 release_openowner(oo);
3347         }
3348         if (clientid_val < NFSD_LAUNDROMAT_MINTIMEOUT)
3349                 clientid_val = NFSD_LAUNDROMAT_MINTIMEOUT;
3350         nfs4_unlock_state();
3351         return clientid_val;
3352 }
3353
3354 static struct workqueue_struct *laundry_wq;
3355 static void laundromat_main(struct work_struct *);
3356
3357 static void
3358 laundromat_main(struct work_struct *laundry)
3359 {
3360         time_t t;
3361         struct delayed_work *dwork = container_of(laundry, struct delayed_work,
3362                                                   work);
3363         struct nfsd_net *nn = container_of(dwork, struct nfsd_net,
3364                                            laundromat_work);
3365
3366         t = nfs4_laundromat(nn);
3367         dprintk("NFSD: laundromat_main - sleeping for %ld seconds\n", t);
3368         queue_delayed_work(laundry_wq, &nn->laundromat_work, t*HZ);
3369 }
3370
3371 static inline __be32 nfs4_check_fh(struct svc_fh *fhp, struct nfs4_ol_stateid *stp)
3372 {
3373         if (fhp->fh_dentry->d_inode != stp->st_file->fi_inode)
3374                 return nfserr_bad_stateid;
3375         return nfs_ok;
3376 }
3377
3378 static inline int
3379 access_permit_read(struct nfs4_ol_stateid *stp)
3380 {
3381         return test_access(NFS4_SHARE_ACCESS_READ, stp) ||
3382                 test_access(NFS4_SHARE_ACCESS_BOTH, stp) ||
3383                 test_access(NFS4_SHARE_ACCESS_WRITE, stp);
3384 }
3385
3386 static inline int
3387 access_permit_write(struct nfs4_ol_stateid *stp)
3388 {
3389         return test_access(NFS4_SHARE_ACCESS_WRITE, stp) ||
3390                 test_access(NFS4_SHARE_ACCESS_BOTH, stp);
3391 }
3392
3393 static
3394 __be32 nfs4_check_openmode(struct nfs4_ol_stateid *stp, int flags)
3395 {
3396         __be32 status = nfserr_openmode;
3397
3398         /* For lock stateid's, we test the parent open, not the lock: */
3399         if (stp->st_openstp)
3400                 stp = stp->st_openstp;
3401         if ((flags & WR_STATE) && !access_permit_write(stp))
3402                 goto out;
3403         if ((flags & RD_STATE) && !access_permit_read(stp))
3404                 goto out;
3405         status = nfs_ok;
3406 out:
3407         return status;
3408 }
3409
3410 static inline __be32
3411 check_special_stateids(struct net *net, svc_fh *current_fh, stateid_t *stateid, int flags)
3412 {
3413         if (ONE_STATEID(stateid) && (flags & RD_STATE))
3414                 return nfs_ok;
3415         else if (locks_in_grace(net)) {
3416                 /* Answer in remaining cases depends on existence of
3417                  * conflicting state; so we must wait out the grace period. */
3418                 return nfserr_grace;
3419         } else if (flags & WR_STATE)
3420                 return nfs4_share_conflict(current_fh,
3421                                 NFS4_SHARE_DENY_WRITE);
3422         else /* (flags & RD_STATE) && ZERO_STATEID(stateid) */
3423                 return nfs4_share_conflict(current_fh,
3424                                 NFS4_SHARE_DENY_READ);
3425 }
3426
3427 /*
3428  * Allow READ/WRITE during grace period on recovered state only for files
3429  * that are not able to provide mandatory locking.
3430  */
3431 static inline int
3432 grace_disallows_io(struct net *net, struct inode *inode)
3433 {
3434         return locks_in_grace(net) && mandatory_lock(inode);
3435 }
3436
3437 /* Returns true iff a is later than b: */
3438 static bool stateid_generation_after(stateid_t *a, stateid_t *b)
3439 {
3440         return (s32)a->si_generation - (s32)b->si_generation > 0;
3441 }
3442
3443 static __be32 check_stateid_generation(stateid_t *in, stateid_t *ref, bool has_session)
3444 {
3445         /*
3446          * When sessions are used the stateid generation number is ignored
3447          * when it is zero.
3448          */
3449         if (has_session && in->si_generation == 0)
3450                 return nfs_ok;
3451
3452         if (in->si_generation == ref->si_generation)
3453                 return nfs_ok;
3454
3455         /* If the client sends us a stateid from the future, it's buggy: */
3456         if (stateid_generation_after(in, ref))
3457                 return nfserr_bad_stateid;
3458         /*
3459          * However, we could see a stateid from the past, even from a
3460          * non-buggy client.  For example, if the client sends a lock
3461          * while some IO is outstanding, the lock may bump si_generation
3462          * while the IO is still in flight.  The client could avoid that
3463          * situation by waiting for responses on all the IO requests,
3464          * but better performance may result in retrying IO that
3465          * receives an old_stateid error if requests are rarely
3466          * reordered in flight:
3467          */
3468         return nfserr_old_stateid;
3469 }
3470
3471 static __be32 nfsd4_validate_stateid(struct nfs4_client *cl, stateid_t *stateid)
3472 {
3473         struct nfs4_stid *s;
3474         struct nfs4_ol_stateid *ols;
3475         __be32 status;
3476
3477         if (ZERO_STATEID(stateid) || ONE_STATEID(stateid))
3478                 return nfserr_bad_stateid;
3479         /* Client debugging aid. */
3480         if (!same_clid(&stateid->si_opaque.so_clid, &cl->cl_clientid)) {
3481                 char addr_str[INET6_ADDRSTRLEN];
3482                 rpc_ntop((struct sockaddr *)&cl->cl_addr, addr_str,
3483                                  sizeof(addr_str));
3484                 pr_warn_ratelimited("NFSD: client %s testing state ID "
3485                                         "with incorrect client ID\n", addr_str);
3486                 return nfserr_bad_stateid;
3487         }
3488         s = find_stateid(cl, stateid);
3489         if (!s)
3490                 return nfserr_bad_stateid;
3491         status = check_stateid_generation(stateid, &s->sc_stateid, 1);
3492         if (status)
3493                 return status;
3494         switch (s->sc_type) {
3495         case NFS4_DELEG_STID:
3496                 return nfs_ok;
3497         case NFS4_REVOKED_DELEG_STID:
3498                 return nfserr_deleg_revoked;
3499         case NFS4_OPEN_STID:
3500         case NFS4_LOCK_STID:
3501                 ols = openlockstateid(s);
3502                 if (ols->st_stateowner->so_is_open_owner
3503                                 && !(openowner(ols->st_stateowner)->oo_flags
3504                                                 & NFS4_OO_CONFIRMED))
3505                         return nfserr_bad_stateid;
3506                 return nfs_ok;
3507         default:
3508                 printk("unknown stateid type %x\n", s->sc_type);
3509         case NFS4_CLOSED_STID:
3510                 return nfserr_bad_stateid;
3511         }
3512 }
3513
3514 static __be32 nfsd4_lookup_stateid(stateid_t *stateid, unsigned char typemask,
3515                                    struct nfs4_stid **s, bool sessions,
3516                                    struct nfsd_net *nn)
3517 {
3518         struct nfs4_client *cl;
3519         __be32 status;
3520
3521         if (ZERO_STATEID(stateid) || ONE_STATEID(stateid))
3522                 return nfserr_bad_stateid;
3523         status = lookup_clientid(&stateid->si_opaque.so_clid, sessions,
3524                                                         nn, &cl);
3525         if (status == nfserr_stale_clientid)
3526                 return nfserr_stale_stateid;
3527         if (status)
3528                 return status;
3529         *s = find_stateid_by_type(cl, stateid, typemask);
3530         if (!*s)
3531                 return nfserr_bad_stateid;
3532         return nfs_ok;
3533 }
3534
3535 /*
3536 * Checks for stateid operations
3537 */
3538 __be32
3539 nfs4_preprocess_stateid_op(struct net *net, struct nfsd4_compound_state *cstate,
3540                            stateid_t *stateid, int flags, struct file **filpp)
3541 {
3542         struct nfs4_stid *s;
3543         struct nfs4_ol_stateid *stp = NULL;
3544         struct nfs4_delegation *dp = NULL;
3545         struct svc_fh *current_fh = &cstate->current_fh;
3546         struct inode *ino = current_fh->fh_dentry->d_inode;
3547         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
3548         __be32 status;
3549
3550         if (filpp)
3551                 *filpp = NULL;
3552
3553         if (grace_disallows_io(net, ino))
3554                 return nfserr_grace;
3555
3556         if (ZERO_STATEID(stateid) || ONE_STATEID(stateid))
3557                 return check_special_stateids(net, current_fh, stateid, flags);
3558
3559         status = nfsd4_lookup_stateid(stateid, NFS4_DELEG_STID|NFS4_OPEN_STID|NFS4_LOCK_STID,
3560                                       &s, cstate->minorversion, nn);
3561         if (status)
3562                 return status;
3563         status = check_stateid_generation(stateid, &s->sc_stateid, nfsd4_has_session(cstate));
3564         if (status)
3565                 goto out;
3566         switch (s->sc_type) {
3567         case NFS4_DELEG_STID:
3568                 dp = delegstateid(s);
3569                 status = nfs4_check_delegmode(dp, flags);
3570                 if (status)
3571                         goto out;
3572                 if (filpp) {
3573                         *filpp = dp->dl_file->fi_deleg_file;
3574                         if (!*filpp) {
3575                                 WARN_ON_ONCE(1);
3576                                 status = nfserr_serverfault;
3577                                 goto out;
3578                         }
3579                 }
3580                 break;
3581         case NFS4_OPEN_STID:
3582         case NFS4_LOCK_STID:
3583                 stp = openlockstateid(s);
3584                 status = nfs4_check_fh(current_fh, stp);
3585                 if (status)
3586                         goto out;
3587                 if (stp->st_stateowner->so_is_open_owner
3588                     && !(openowner(stp->st_stateowner)->oo_flags & NFS4_OO_CONFIRMED))
3589                         goto out;
3590                 status = nfs4_check_openmode(stp, flags);
3591                 if (status)
3592                         goto out;
3593                 if (filpp) {
3594                         if (flags & RD_STATE)
3595                                 *filpp = find_readable_file(stp->st_file);
3596                         else
3597                                 *filpp = find_writeable_file(stp->st_file);
3598                 }
3599                 break;
3600         default:
3601                 return nfserr_bad_stateid;
3602         }
3603         status = nfs_ok;
3604 out:
3605         return status;
3606 }
3607
3608 static __be32
3609 nfsd4_free_lock_stateid(struct nfs4_ol_stateid *stp)
3610 {
3611         struct nfs4_lockowner *lo = lockowner(stp->st_stateowner);
3612
3613         if (check_for_locks(stp->st_file, lo))
3614                 return nfserr_locks_held;
3615         /*
3616          * Currently there's a 1-1 lock stateid<->lockowner
3617          * correspondance, and we have to delete the lockowner when we
3618          * delete the lock stateid:
3619          */
3620         release_lockowner(lo);
3621         return nfs_ok;
3622 }
3623
3624 /*
3625  * Test if the stateid is valid
3626  */
3627 __be32
3628 nfsd4_test_stateid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
3629                    struct nfsd4_test_stateid *test_stateid)
3630 {
3631         struct nfsd4_test_stateid_id *stateid;
3632         struct nfs4_client *cl = cstate->session->se_client;
3633
3634         nfs4_lock_state();
3635         list_for_each_entry(stateid, &test_stateid->ts_stateid_list, ts_id_list)
3636                 stateid->ts_id_status =
3637                         nfsd4_validate_stateid(cl, &stateid->ts_id_stateid);
3638         nfs4_unlock_state();
3639
3640         return nfs_ok;
3641 }
3642
3643 __be32
3644 nfsd4_free_stateid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
3645                    struct nfsd4_free_stateid *free_stateid)
3646 {
3647         stateid_t *stateid = &free_stateid->fr_stateid;
3648         struct nfs4_stid *s;
3649         struct nfs4_delegation *dp;
3650         struct nfs4_client *cl = cstate->session->se_client;
3651         __be32 ret = nfserr_bad_stateid;
3652
3653         nfs4_lock_state();
3654         s = find_stateid(cl, stateid);
3655         if (!s)
3656                 goto out;
3657         switch (s->sc_type) {
3658         case NFS4_DELEG_STID:
3659                 ret = nfserr_locks_held;
3660                 goto out;
3661         case NFS4_OPEN_STID:
3662         case NFS4_LOCK_STID:
3663                 ret = check_stateid_generation(stateid, &s->sc_stateid, 1);
3664                 if (ret)
3665                         goto out;
3666                 if (s->sc_type == NFS4_LOCK_STID)
3667                         ret = nfsd4_free_lock_stateid(openlockstateid(s));
3668                 else
3669                         ret = nfserr_locks_held;
3670                 break;
3671         case NFS4_REVOKED_DELEG_STID:
3672                 dp = delegstateid(s);
3673                 destroy_revoked_delegation(dp);
3674                 ret = nfs_ok;
3675                 break;
3676         default:
3677                 ret = nfserr_bad_stateid;
3678         }
3679 out:
3680         nfs4_unlock_state();
3681         return ret;
3682 }
3683
3684 static inline int
3685 setlkflg (int type)
3686 {
3687         return (type == NFS4_READW_LT || type == NFS4_READ_LT) ?
3688                 RD_STATE : WR_STATE;
3689 }
3690
3691 static __be32 nfs4_seqid_op_checks(struct nfsd4_compound_state *cstate, stateid_t *stateid, u32 seqid, struct nfs4_ol_stateid *stp)
3692 {
3693         struct svc_fh *current_fh = &cstate->current_fh;
3694         struct nfs4_stateowner *sop = stp->st_stateowner;
3695         __be32 status;
3696
3697         status = nfsd4_check_seqid(cstate, sop, seqid);
3698         if (status)
3699                 return status;
3700         if (stp->st_stid.sc_type == NFS4_CLOSED_STID
3701                 || stp->st_stid.sc_type == NFS4_REVOKED_DELEG_STID)
3702                 /*
3703                  * "Closed" stateid's exist *only* to return
3704                  * nfserr_replay_me from the previous step, and
3705                  * revoked delegations are kept only for free_stateid.
3706                  */
3707                 return nfserr_bad_stateid;
3708         status = check_stateid_generation(stateid, &stp->st_stid.sc_stateid, nfsd4_has_session(cstate));
3709         if (status)
3710                 return status;
3711         return nfs4_check_fh(current_fh, stp);
3712 }
3713
3714 /*
3715  * Checks for sequence id mutating operations.
3716  */
3717 static __be32
3718 nfs4_preprocess_seqid_op(struct nfsd4_compound_state *cstate, u32 seqid,
3719                          stateid_t *stateid, char typemask,
3720                          struct nfs4_ol_stateid **stpp,
3721                          struct nfsd_net *nn)
3722 {
3723         __be32 status;
3724         struct nfs4_stid *s;
3725
3726         dprintk("NFSD: %s: seqid=%d stateid = " STATEID_FMT "\n", __func__,
3727                 seqid, STATEID_VAL(stateid));
3728
3729         *stpp = NULL;
3730         status = nfsd4_lookup_stateid(stateid, typemask, &s,
3731                                       cstate->minorversion, nn);
3732         if (status)
3733                 return status;
3734         *stpp = openlockstateid(s);
3735         if (!nfsd4_has_session(cstate))
3736                 cstate->replay_owner = (*stpp)->st_stateowner;
3737
3738         return nfs4_seqid_op_checks(cstate, stateid, seqid, *stpp);
3739 }
3740
3741 static __be32 nfs4_preprocess_confirmed_seqid_op(struct nfsd4_compound_state *cstate, u32 seqid,
3742                                                  stateid_t *stateid, struct nfs4_ol_stateid **stpp, struct nfsd_net *nn)
3743 {
3744         __be32 status;
3745         struct nfs4_openowner *oo;
3746
3747         status = nfs4_preprocess_seqid_op(cstate, seqid, stateid,
3748                                                 NFS4_OPEN_STID, stpp, nn);
3749         if (status)
3750                 return status;
3751         oo = openowner((*stpp)->st_stateowner);
3752         if (!(oo->oo_flags & NFS4_OO_CONFIRMED))
3753                 return nfserr_bad_stateid;
3754         return nfs_ok;
3755 }
3756
3757 __be32
3758 nfsd4_open_confirm(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
3759                    struct nfsd4_open_confirm *oc)
3760 {
3761         __be32 status;
3762         struct nfs4_openowner *oo;
3763         struct nfs4_ol_stateid *stp;
3764         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
3765
3766         dprintk("NFSD: nfsd4_open_confirm on file %.*s\n",
3767                         (int)cstate->current_fh.fh_dentry->d_name.len,
3768                         cstate->current_fh.fh_dentry->d_name.name);
3769
3770         status = fh_verify(rqstp, &cstate->current_fh, S_IFREG, 0);
3771         if (status)
3772                 return status;
3773
3774         nfs4_lock_state();
3775
3776         status = nfs4_preprocess_seqid_op(cstate,
3777                                         oc->oc_seqid, &oc->oc_req_stateid,
3778                                         NFS4_OPEN_STID, &stp, nn);
3779         if (status)
3780                 goto out;
3781         oo = openowner(stp->st_stateowner);
3782         status = nfserr_bad_stateid;
3783         if (oo->oo_flags & NFS4_OO_CONFIRMED)
3784                 goto out;
3785         oo->oo_flags |= NFS4_OO_CONFIRMED;
3786         update_stateid(&stp->st_stid.sc_stateid);
3787         memcpy(&oc->oc_resp_stateid, &stp->st_stid.sc_stateid, sizeof(stateid_t));
3788         dprintk("NFSD: %s: success, seqid=%d stateid=" STATEID_FMT "\n",
3789                 __func__, oc->oc_seqid, STATEID_VAL(&stp->st_stid.sc_stateid));
3790
3791         nfsd4_client_record_create(oo->oo_owner.so_client);
3792         status = nfs_ok;
3793 out:
3794         nfsd4_bump_seqid(cstate, status);
3795         if (!cstate->replay_owner)
3796                 nfs4_unlock_state();
3797         return status;
3798 }
3799
3800 static inline void nfs4_stateid_downgrade_bit(struct nfs4_ol_stateid *stp, u32 access)
3801 {
3802         if (!test_access(access, stp))
3803                 return;
3804         nfs4_file_put_access(stp->st_file, nfs4_access_to_omode(access));
3805         clear_access(access, stp);
3806 }
3807
3808 static inline void nfs4_stateid_downgrade(struct nfs4_ol_stateid *stp, u32 to_access)
3809 {
3810         switch (to_access) {
3811         case NFS4_SHARE_ACCESS_READ:
3812                 nfs4_stateid_downgrade_bit(stp, NFS4_SHARE_ACCESS_WRITE);
3813                 nfs4_stateid_downgrade_bit(stp, NFS4_SHARE_ACCESS_BOTH);
3814                 break;
3815         case NFS4_SHARE_ACCESS_WRITE:
3816                 nfs4_stateid_downgrade_bit(stp, NFS4_SHARE_ACCESS_READ);
3817                 nfs4_stateid_downgrade_bit(stp, NFS4_SHARE_ACCESS_BOTH);
3818                 break;
3819         case NFS4_SHARE_ACCESS_BOTH:
3820                 break;
3821         default:
3822                 WARN_ON_ONCE(1);
3823         }
3824 }
3825
3826 static void
3827 reset_union_bmap_deny(unsigned long deny, struct nfs4_ol_stateid *stp)
3828 {
3829         int i;
3830         for (i = 0; i < 4; i++) {
3831                 if ((i & deny) != i)
3832                         clear_deny(i, stp);
3833         }
3834 }
3835
3836 __be32
3837 nfsd4_open_downgrade(struct svc_rqst *rqstp,
3838                      struct nfsd4_compound_state *cstate,
3839                      struct nfsd4_open_downgrade *od)
3840 {
3841         __be32 status;
3842         struct nfs4_ol_stateid *stp;
3843         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
3844
3845         dprintk("NFSD: nfsd4_open_downgrade on file %.*s\n",
3846                         (int)cstate->current_fh.fh_dentry->d_name.len,
3847                         cstate->current_fh.fh_dentry->d_name.name);
3848
3849         /* We don't yet support WANT bits: */
3850         if (od->od_deleg_want)
3851                 dprintk("NFSD: %s: od_deleg_want=0x%x ignored\n", __func__,
3852                         od->od_deleg_want);
3853
3854         nfs4_lock_state();
3855         status = nfs4_preprocess_confirmed_seqid_op(cstate, od->od_seqid,
3856                                         &od->od_stateid, &stp, nn);
3857         if (status)
3858                 goto out;
3859         status = nfserr_inval;
3860         if (!test_access(od->od_share_access, stp)) {
3861                 dprintk("NFSD: access not a subset current bitmap: 0x%lx, input access=%08x\n",
3862                         stp->st_access_bmap, od->od_share_access);
3863                 goto out;
3864         }
3865         if (!test_deny(od->od_share_deny, stp)) {
3866                 dprintk("NFSD:deny not a subset current bitmap: 0x%lx, input deny=%08x\n",
3867                         stp->st_deny_bmap, od->od_share_deny);
3868                 goto out;
3869         }
3870         nfs4_stateid_downgrade(stp, od->od_share_access);
3871
3872         reset_union_bmap_deny(od->od_share_deny, stp);
3873
3874         update_stateid(&stp->st_stid.sc_stateid);
3875         memcpy(&od->od_stateid, &stp->st_stid.sc_stateid, sizeof(stateid_t));
3876         status = nfs_ok;
3877 out:
3878         nfsd4_bump_seqid(cstate, status);
3879         if (!cstate->replay_owner)
3880                 nfs4_unlock_state();
3881         return status;
3882 }
3883
3884 static void nfsd4_close_open_stateid(struct nfs4_ol_stateid *s)
3885 {
3886         unhash_open_stateid(s);
3887         s->st_stid.sc_type = NFS4_CLOSED_STID;
3888 }
3889
3890 /*
3891  * nfs4_unlock_state() called after encode
3892  */
3893 __be32
3894 nfsd4_close(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
3895             struct nfsd4_close *close)
3896 {
3897         __be32 status;
3898         struct nfs4_openowner *oo;
3899         struct nfs4_ol_stateid *stp;
3900         struct net *net = SVC_NET(rqstp);
3901         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
3902
3903         dprintk("NFSD: nfsd4_close on file %.*s\n",
3904                         (int)cstate->current_fh.fh_dentry->d_name.len,
3905                         cstate->current_fh.fh_dentry->d_name.name);
3906
3907         nfs4_lock_state();
3908         status = nfs4_preprocess_seqid_op(cstate, close->cl_seqid,
3909                                         &close->cl_stateid,
3910                                         NFS4_OPEN_STID|NFS4_CLOSED_STID,
3911                                         &stp, nn);
3912         nfsd4_bump_seqid(cstate, status);
3913         if (status)
3914                 goto out;
3915         oo = openowner(stp->st_stateowner);
3916         update_stateid(&stp->st_stid.sc_stateid);
3917         memcpy(&close->cl_stateid, &stp->st_stid.sc_stateid, sizeof(stateid_t));
3918
3919         nfsd4_close_open_stateid(stp);
3920
3921         if (cstate->minorversion) {
3922                 unhash_stid(&stp->st_stid);
3923                 free_generic_stateid(stp);
3924         } else
3925                 oo->oo_last_closed_stid = stp;
3926
3927         if (list_empty(&oo->oo_owner.so_stateids)) {
3928                 if (cstate->minorversion)
3929                         release_openowner(oo);
3930                 else {
3931                         /*
3932                          * In the 4.0 case we need to keep the owners around a
3933                          * little while to handle CLOSE replay.
3934                          */
3935                         move_to_close_lru(oo, SVC_NET(rqstp));
3936                 }
3937         }
3938 out:
3939         if (!cstate->replay_owner)
3940                 nfs4_unlock_state();
3941         return status;
3942 }
3943
3944 __be32
3945 nfsd4_delegreturn(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
3946                   struct nfsd4_delegreturn *dr)
3947 {
3948         struct nfs4_delegation *dp;
3949         stateid_t *stateid = &dr->dr_stateid;
3950         struct nfs4_stid *s;
3951         __be32 status;
3952         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
3953
3954         if ((status = fh_verify(rqstp, &cstate->current_fh, S_IFREG, 0)))
3955                 return status;
3956
3957         nfs4_lock_state();
3958         status = nfsd4_lookup_stateid(stateid, NFS4_DELEG_STID, &s,
3959                                       cstate->minorversion, nn);
3960         if (status)
3961                 goto out;
3962         dp = delegstateid(s);
3963         status = check_stateid_generation(stateid, &dp->dl_stid.sc_stateid, nfsd4_has_session(cstate));
3964         if (status)
3965                 goto out;
3966
3967         destroy_delegation(dp);
3968 out:
3969         nfs4_unlock_state();
3970
3971         return status;
3972 }
3973
3974
3975 #define LOFF_OVERFLOW(start, len)      ((u64)(len) > ~(u64)(start))
3976
3977 #define LOCKOWNER_INO_HASH_MASK (LOCKOWNER_INO_HASH_SIZE - 1)
3978
3979 static inline u64
3980 end_offset(u64 start, u64 len)
3981 {
3982         u64 end;
3983
3984         end = start + len;
3985         return end >= start ? end: NFS4_MAX_UINT64;
3986 }
3987
3988 /* last octet in a range */
3989 static inline u64
3990 last_byte_offset(u64 start, u64 len)
3991 {
3992         u64 end;
3993
3994         WARN_ON_ONCE(!len);
3995         end = start + len;
3996         return end > start ? end - 1: NFS4_MAX_UINT64;
3997 }
3998
3999 static unsigned int lockowner_ino_hashval(struct inode *inode, u32 cl_id, struct xdr_netobj *ownername)
4000 {
4001         return (file_hashval(inode) + cl_id
4002                         + opaque_hashval(ownername->data, ownername->len))
4003                 & LOCKOWNER_INO_HASH_MASK;
4004 }
4005
4006 /*
4007  * TODO: Linux file offsets are _signed_ 64-bit quantities, which means that
4008  * we can't properly handle lock requests that go beyond the (2^63 - 1)-th
4009  * byte, because of sign extension problems.  Since NFSv4 calls for 64-bit
4010  * locking, this prevents us from being completely protocol-compliant.  The
4011  * real solution to this problem is to start using unsigned file offsets in
4012  * the VFS, but this is a very deep change!
4013  */
4014 static inline void
4015 nfs4_transform_lock_offset(struct file_lock *lock)
4016 {
4017         if (lock->fl_start < 0)
4018                 lock->fl_start = OFFSET_MAX;
4019         if (lock->fl_end < 0)
4020                 lock->fl_end = OFFSET_MAX;
4021 }
4022
4023 /* Hack!: For now, we're defining this just so we can use a pointer to it
4024  * as a unique cookie to identify our (NFSv4's) posix locks. */
4025 static const struct lock_manager_operations nfsd_posix_mng_ops  = {
4026 };
4027
4028 static inline void
4029 nfs4_set_lock_denied(struct file_lock *fl, struct nfsd4_lock_denied *deny)
4030 {
4031         struct nfs4_lockowner *lo;
4032
4033         if (fl->fl_lmops == &nfsd_posix_mng_ops) {
4034                 lo = (struct nfs4_lockowner *) fl->fl_owner;
4035                 deny->ld_owner.data = kmemdup(lo->lo_owner.so_owner.data,
4036                                         lo->lo_owner.so_owner.len, GFP_KERNEL);
4037                 if (!deny->ld_owner.data)
4038                         /* We just don't care that much */
4039                         goto nevermind;
4040                 deny->ld_owner.len = lo->lo_owner.so_owner.len;
4041                 deny->ld_clientid = lo->lo_owner.so_client->cl_clientid;
4042         } else {
4043 nevermind:
4044                 deny->ld_owner.len = 0;
4045                 deny->ld_owner.data = NULL;
4046                 deny->ld_clientid.cl_boot = 0;
4047                 deny->ld_clientid.cl_id = 0;
4048         }
4049         deny->ld_start = fl->fl_start;
4050         deny->ld_length = NFS4_MAX_UINT64;
4051         if (fl->fl_end != NFS4_MAX_UINT64)
4052                 deny->ld_length = fl->fl_end - fl->fl_start + 1;
4053         deny->ld_type = NFS4_READ_LT;
4054         if (fl->fl_type != F_RDLCK)
4055                 deny->ld_type = NFS4_WRITE_LT;
4056 }
4057
4058 static bool same_lockowner_ino(struct nfs4_lockowner *lo, struct inode *inode, clientid_t *clid, struct xdr_netobj *owner)
4059 {
4060         struct nfs4_ol_stateid *lst;
4061
4062         if (!same_owner_str(&lo->lo_owner, owner, clid))
4063                 return false;
4064         if (list_empty(&lo->lo_owner.so_stateids)) {
4065                 WARN_ON_ONCE(1);
4066                 return false;
4067         }
4068         lst = list_first_entry(&lo->lo_owner.so_stateids,
4069                                struct nfs4_ol_stateid, st_perstateowner);
4070         return lst->st_file->fi_inode == inode;
4071 }
4072
4073 static struct nfs4_lockowner *
4074 find_lockowner_str(struct inode *inode, clientid_t *clid,
4075                    struct xdr_netobj *owner, struct nfsd_net *nn)
4076 {
4077         unsigned int hashval = lockowner_ino_hashval(inode, clid->cl_id, owner);
4078         struct nfs4_lockowner *lo;
4079
4080         list_for_each_entry(lo, &nn->lockowner_ino_hashtbl[hashval], lo_owner_ino_hash) {
4081                 if (same_lockowner_ino(lo, inode, clid, owner))
4082                         return lo;
4083         }
4084         return NULL;
4085 }
4086
4087 static void hash_lockowner(struct nfs4_lockowner *lo, unsigned int strhashval, struct nfs4_client *clp, struct nfs4_ol_stateid *open_stp)
4088 {
4089         struct inode *inode = open_stp->st_file->fi_inode;
4090         unsigned int inohash = lockowner_ino_hashval(inode,
4091                         clp->cl_clientid.cl_id, &lo->lo_owner.so_owner);
4092         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
4093
4094         list_add(&lo->lo_owner.so_strhash, &nn->ownerstr_hashtbl[strhashval]);
4095         list_add(&lo->lo_owner_ino_hash, &nn->lockowner_ino_hashtbl[inohash]);
4096         list_add(&lo->lo_perstateid, &open_stp->st_lockowners);
4097 }
4098
4099 /*
4100  * Alloc a lock owner structure.
4101  * Called in nfsd4_lock - therefore, OPEN and OPEN_CONFIRM (if needed) has
4102  * occurred.
4103  *
4104  * strhashval = ownerstr_hashval
4105  */
4106
4107 static struct nfs4_lockowner *
4108 alloc_init_lock_stateowner(unsigned int strhashval, struct nfs4_client *clp, struct nfs4_ol_stateid *open_stp, struct nfsd4_lock *lock) {
4109         struct nfs4_lockowner *lo;
4110
4111         lo = alloc_stateowner(lockowner_slab, &lock->lk_new_owner, clp);
4112         if (!lo)
4113                 return NULL;
4114         INIT_LIST_HEAD(&lo->lo_owner.so_stateids);
4115         lo->lo_owner.so_is_open_owner = 0;
4116         /* It is the openowner seqid that will be incremented in encode in the
4117          * case of new lockowners; so increment the lock seqid manually: */
4118         lo->lo_owner.so_seqid = lock->lk_new_lock_seqid + 1;
4119         hash_lockowner(lo, strhashval, clp, open_stp);
4120         return lo;
4121 }
4122
4123 static struct nfs4_ol_stateid *
4124 alloc_init_lock_stateid(struct nfs4_lockowner *lo, struct nfs4_file *fp, struct nfs4_ol_stateid *open_stp)
4125 {
4126         struct nfs4_ol_stateid *stp;
4127         struct nfs4_client *clp = lo->lo_owner.so_client;
4128
4129         stp = nfs4_alloc_stateid(clp);
4130         if (stp == NULL)
4131                 return NULL;
4132         stp->st_stid.sc_type = NFS4_LOCK_STID;
4133         list_add(&stp->st_perfile, &fp->fi_stateids);
4134         list_add(&stp->st_perstateowner, &lo->lo_owner.so_stateids);
4135         stp->st_stateowner = &lo->lo_owner;
4136         get_nfs4_file(fp);
4137         stp->st_file = fp;
4138         stp->st_access_bmap = 0;
4139         stp->st_deny_bmap = open_stp->st_deny_bmap;
4140         stp->st_openstp = open_stp;
4141         return stp;
4142 }
4143
4144 static int
4145 check_lock_length(u64 offset, u64 length)
4146 {
4147         return ((length == 0)  || ((length != NFS4_MAX_UINT64) &&
4148              LOFF_OVERFLOW(offset, length)));
4149 }
4150
4151 static void get_lock_access(struct nfs4_ol_stateid *lock_stp, u32 access)
4152 {
4153         struct nfs4_file *fp = lock_stp->st_file;
4154         int oflag = nfs4_access_to_omode(access);
4155
4156         if (test_access(access, lock_stp))
4157                 return;
4158         nfs4_file_get_access(fp, oflag);
4159         set_access(access, lock_stp);
4160 }
4161
4162 static __be32 lookup_or_create_lock_state(struct nfsd4_compound_state *cstate, struct nfs4_ol_stateid *ost, struct nfsd4_lock *lock, struct nfs4_ol_stateid **lst, bool *new)
4163 {
4164         struct nfs4_file *fi = ost->st_file;
4165         struct nfs4_openowner *oo = openowner(ost->st_stateowner);
4166         struct nfs4_client *cl = oo->oo_owner.so_client;
4167         struct nfs4_lockowner *lo;
4168         unsigned int strhashval;
4169         struct nfsd_net *nn = net_generic(cl->net, nfsd_net_id);
4170
4171         lo = find_lockowner_str(fi->fi_inode, &cl->cl_clientid,
4172                                 &lock->v.new.owner, nn);
4173         if (lo) {
4174                 if (!cstate->minorversion)
4175                         return nfserr_bad_seqid;
4176                 /* XXX: a lockowner always has exactly one stateid: */
4177                 *lst = list_first_entry(&lo->lo_owner.so_stateids,
4178                                 struct nfs4_ol_stateid, st_perstateowner);
4179                 return nfs_ok;
4180         }
4181         strhashval = ownerstr_hashval(cl->cl_clientid.cl_id,
4182                         &lock->v.new.owner);
4183         lo = alloc_init_lock_stateowner(strhashval, cl, ost, lock);
4184         if (lo == NULL)
4185                 return nfserr_jukebox;
4186         *lst = alloc_init_lock_stateid(lo, fi, ost);
4187         if (*lst == NULL) {
4188                 release_lockowner(lo);
4189                 return nfserr_jukebox;
4190         }
4191         *new = true;
4192         return nfs_ok;
4193 }
4194
4195 /*
4196  *  LOCK operation
4197  */
4198 __be32
4199 nfsd4_lock(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
4200            struct nfsd4_lock *lock)
4201 {
4202         struct nfs4_openowner *open_sop = NULL;
4203         struct nfs4_lockowner *lock_sop = NULL;
4204         struct nfs4_ol_stateid *lock_stp;
4205         struct file *filp = NULL;
4206         struct file_lock *file_lock = NULL;
4207         struct file_lock *conflock = NULL;
4208         __be32 status = 0;
4209         bool new_state = false;
4210         int lkflg;
4211         int err;
4212         struct net *net = SVC_NET(rqstp);
4213         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
4214
4215         dprintk("NFSD: nfsd4_lock: start=%Ld length=%Ld\n",
4216                 (long long) lock->lk_offset,
4217                 (long long) lock->lk_length);
4218
4219         if (check_lock_length(lock->lk_offset, lock->lk_length))
4220                  return nfserr_inval;
4221
4222         if ((status = fh_verify(rqstp, &cstate->current_fh,
4223                                 S_IFREG, NFSD_MAY_LOCK))) {
4224                 dprintk("NFSD: nfsd4_lock: permission denied!\n");
4225                 return status;
4226         }
4227
4228         nfs4_lock_state();
4229
4230         if (lock->lk_is_new) {
4231                 struct nfs4_ol_stateid *open_stp = NULL;
4232
4233                 if (nfsd4_has_session(cstate))
4234                         /* See rfc 5661 18.10.3: given clientid is ignored: */
4235                         memcpy(&lock->v.new.clientid,
4236                                 &cstate->session->se_client->cl_clientid,
4237                                 sizeof(clientid_t));
4238
4239                 status = nfserr_stale_clientid;
4240                 if (STALE_CLIENTID(&lock->lk_new_clientid, nn))
4241                         goto out;
4242
4243                 /* validate and update open stateid and open seqid */
4244                 status = nfs4_preprocess_confirmed_seqid_op(cstate,
4245                                         lock->lk_new_open_seqid,
4246                                         &lock->lk_new_open_stateid,
4247                                         &open_stp, nn);
4248                 if (status)
4249                         goto out;
4250                 open_sop = openowner(open_stp->st_stateowner);
4251                 status = nfserr_bad_stateid;
4252                 if (!same_clid(&open_sop->oo_owner.so_client->cl_clientid,
4253                                                 &lock->v.new.clientid))
4254                         goto out;
4255                 status = lookup_or_create_lock_state(cstate, open_stp, lock,
4256                                                         &lock_stp, &new_state);
4257         } else
4258                 status = nfs4_preprocess_seqid_op(cstate,
4259                                        lock->lk_old_lock_seqid,
4260                                        &lock->lk_old_lock_stateid,
4261                                        NFS4_LOCK_STID, &lock_stp, nn);
4262         if (status)
4263                 goto out;
4264         lock_sop = lockowner(lock_stp->st_stateowner);
4265
4266         lkflg = setlkflg(lock->lk_type);
4267         status = nfs4_check_openmode(lock_stp, lkflg);
4268         if (status)
4269                 goto out;
4270
4271         status = nfserr_grace;
4272         if (locks_in_grace(net) && !lock->lk_reclaim)
4273                 goto out;
4274         status = nfserr_no_grace;
4275         if (!locks_in_grace(net) && lock->lk_reclaim)
4276                 goto out;
4277
4278         file_lock = locks_alloc_lock();
4279         if (!file_lock) {
4280                 dprintk("NFSD: %s: unable to allocate lock!\n", __func__);
4281                 status = nfserr_jukebox;
4282                 goto out;
4283         }
4284
4285         locks_init_lock(file_lock);
4286         switch (lock->lk_type) {
4287                 case NFS4_READ_LT:
4288                 case NFS4_READW_LT:
4289                         filp = find_readable_file(lock_stp->st_file);
4290                         if (filp)
4291                                 get_lock_access(lock_stp, NFS4_SHARE_ACCESS_READ);
4292                         file_lock->fl_type = F_RDLCK;
4293                         break;
4294                 case NFS4_WRITE_LT:
4295                 case NFS4_WRITEW_LT:
4296                         filp = find_writeable_file(lock_stp->st_file);
4297                         if (filp)
4298                                 get_lock_access(lock_stp, NFS4_SHARE_ACCESS_WRITE);
4299                         file_lock->fl_type = F_WRLCK;
4300                         break;
4301                 default:
4302                         status = nfserr_inval;
4303                 goto out;
4304         }
4305         if (!filp) {
4306                 status = nfserr_openmode;
4307                 goto out;
4308         }
4309         file_lock->fl_owner = (fl_owner_t)lock_sop;
4310         file_lock->fl_pid = current->tgid;
4311         file_lock->fl_file = filp;
4312         file_lock->fl_flags = FL_POSIX;
4313         file_lock->fl_lmops = &nfsd_posix_mng_ops;
4314         file_lock->fl_start = lock->lk_offset;
4315         file_lock->fl_end = last_byte_offset(lock->lk_offset, lock->lk_length);
4316         nfs4_transform_lock_offset(file_lock);
4317
4318         conflock = locks_alloc_lock();
4319         if (!conflock) {
4320                 dprintk("NFSD: %s: unable to allocate lock!\n", __func__);
4321                 status = nfserr_jukebox;
4322                 goto out;
4323         }
4324
4325         err = vfs_lock_file(filp, F_SETLK, file_lock, conflock);
4326         switch (-err) {
4327         case 0: /* success! */
4328                 update_stateid(&lock_stp->st_stid.sc_stateid);
4329                 memcpy(&lock->lk_resp_stateid, &lock_stp->st_stid.sc_stateid,
4330                                 sizeof(stateid_t));
4331                 status = 0;
4332                 break;
4333         case (EAGAIN):          /* conflock holds conflicting lock */
4334                 status = nfserr_denied;
4335                 dprintk("NFSD: nfsd4_lock: conflicting lock found!\n");
4336                 nfs4_set_lock_denied(conflock, &lock->lk_denied);
4337                 break;
4338         case (EDEADLK):
4339                 status = nfserr_deadlock;
4340                 break;
4341         default:
4342                 dprintk("NFSD: nfsd4_lock: vfs_lock_file() failed! status %d\n",err);
4343                 status = nfserrno(err);
4344                 break;
4345         }
4346 out:
4347         if (status && new_state)
4348                 release_lockowner(lock_sop);
4349         nfsd4_bump_seqid(cstate, status);
4350         if (!cstate->replay_owner)
4351                 nfs4_unlock_state();
4352         if (file_lock)
4353                 locks_free_lock(file_lock);
4354         if (conflock)
4355                 locks_free_lock(conflock);
4356         return status;
4357 }
4358
4359 /*
4360  * The NFSv4 spec allows a client to do a LOCKT without holding an OPEN,
4361  * so we do a temporary open here just to get an open file to pass to
4362  * vfs_test_lock.  (Arguably perhaps test_lock should be done with an
4363  * inode operation.)
4364  */
4365 static __be32 nfsd_test_lock(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file_lock *lock)
4366 {
4367         struct file *file;
4368         __be32 err = nfsd_open(rqstp, fhp, S_IFREG, NFSD_MAY_READ, &file);
4369         if (!err) {
4370                 err = nfserrno(vfs_test_lock(file, lock));
4371                 nfsd_close(file);
4372         }
4373         return err;
4374 }
4375
4376 /*
4377  * LOCKT operation
4378  */
4379 __be32
4380 nfsd4_lockt(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
4381             struct nfsd4_lockt *lockt)
4382 {
4383         struct inode *inode;
4384         struct file_lock *file_lock = NULL;
4385         struct nfs4_lockowner *lo;
4386         __be32 status;
4387         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
4388
4389         if (locks_in_grace(SVC_NET(rqstp)))
4390                 return nfserr_grace;
4391
4392         if (check_lock_length(lockt->lt_offset, lockt->lt_length))
4393                  return nfserr_inval;
4394
4395         nfs4_lock_state();
4396
4397         if (!nfsd4_has_session(cstate)) {
4398                 status = lookup_clientid(&lockt->lt_clientid, false, nn, NULL);
4399                 if (status)
4400                         goto out;
4401         }
4402
4403         if ((status = fh_verify(rqstp, &cstate->current_fh, S_IFREG, 0)))
4404                 goto out;
4405
4406         inode = cstate->current_fh.fh_dentry->d_inode;
4407         file_lock = locks_alloc_lock();
4408         if (!file_lock) {
4409                 dprintk("NFSD: %s: unable to allocate lock!\n", __func__);
4410                 status = nfserr_jukebox;
4411                 goto out;
4412         }
4413         locks_init_lock(file_lock);
4414         switch (lockt->lt_type) {
4415                 case NFS4_READ_LT:
4416                 case NFS4_READW_LT:
4417                         file_lock->fl_type = F_RDLCK;
4418                 break;
4419                 case NFS4_WRITE_LT:
4420                 case NFS4_WRITEW_LT:
4421                         file_lock->fl_type = F_WRLCK;
4422                 break;
4423                 default:
4424                         dprintk("NFSD: nfs4_lockt: bad lock type!\n");
4425                         status = nfserr_inval;
4426                 goto out;
4427         }
4428
4429         lo = find_lockowner_str(inode, &lockt->lt_clientid, &lockt->lt_owner, nn);
4430         if (lo)
4431                 file_lock->fl_owner = (fl_owner_t)lo;
4432         file_lock->fl_pid = current->tgid;
4433         file_lock->fl_flags = FL_POSIX;
4434
4435         file_lock->fl_start = lockt->lt_offset;
4436         file_lock->fl_end = last_byte_offset(lockt->lt_offset, lockt->lt_length);
4437
4438         nfs4_transform_lock_offset(file_lock);
4439
4440         status = nfsd_test_lock(rqstp, &cstate->current_fh, file_lock);
4441         if (status)
4442                 goto out;
4443
4444         if (file_lock->fl_type != F_UNLCK) {
4445                 status = nfserr_denied;
4446                 nfs4_set_lock_denied(file_lock, &lockt->lt_denied);
4447         }
4448 out:
4449         nfs4_unlock_state();
4450         if (file_lock)
4451                 locks_free_lock(file_lock);
4452         return status;
4453 }
4454
4455 __be32
4456 nfsd4_locku(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
4457             struct nfsd4_locku *locku)
4458 {
4459         struct nfs4_lockowner *lo;
4460         struct nfs4_ol_stateid *stp;
4461         struct file *filp = NULL;
4462         struct file_lock *file_lock = NULL;
4463         __be32 status;
4464         int err;
4465         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
4466
4467         dprintk("NFSD: nfsd4_locku: start=%Ld length=%Ld\n",
4468                 (long long) locku->lu_offset,
4469                 (long long) locku->lu_length);
4470
4471         if (check_lock_length(locku->lu_offset, locku->lu_length))
4472                  return nfserr_inval;
4473
4474         nfs4_lock_state();
4475
4476         status = nfs4_preprocess_seqid_op(cstate, locku->lu_seqid,
4477                                         &locku->lu_stateid, NFS4_LOCK_STID,
4478                                         &stp, nn);
4479         if (status)
4480                 goto out;
4481         filp = find_any_file(stp->st_file);
4482         if (!filp) {
4483                 status = nfserr_lock_range;
4484                 goto out;
4485         }
4486         file_lock = locks_alloc_lock();
4487         if (!file_lock) {
4488                 dprintk("NFSD: %s: unable to allocate lock!\n", __func__);
4489                 status = nfserr_jukebox;
4490                 goto out;
4491         }
4492         lo = lockowner(stp->st_stateowner);
4493         locks_init_lock(file_lock);
4494         file_lock->fl_type = F_UNLCK;
4495         file_lock->fl_owner = (fl_owner_t)lo;
4496         file_lock->fl_pid = current->tgid;
4497         file_lock->fl_file = filp;
4498         file_lock->fl_flags = FL_POSIX;
4499         file_lock->fl_lmops = &nfsd_posix_mng_ops;
4500         file_lock->fl_start = locku->lu_offset;
4501
4502         file_lock->fl_end = last_byte_offset(locku->lu_offset,
4503                                                 locku->lu_length);
4504         nfs4_transform_lock_offset(file_lock);
4505
4506         err = vfs_lock_file(filp, F_SETLK, file_lock, NULL);
4507         if (err) {
4508                 dprintk("NFSD: nfs4_locku: vfs_lock_file failed!\n");
4509                 goto out_nfserr;
4510         }
4511         update_stateid(&stp->st_stid.sc_stateid);
4512         memcpy(&locku->lu_stateid, &stp->st_stid.sc_stateid, sizeof(stateid_t));
4513
4514         if (nfsd4_has_session(cstate) && !check_for_locks(stp->st_file, lo)) {
4515                 WARN_ON_ONCE(cstate->replay_owner);
4516                 release_lockowner(lo);
4517         }
4518
4519 out:
4520         nfsd4_bump_seqid(cstate, status);
4521         if (!cstate->replay_owner)
4522                 nfs4_unlock_state();
4523         if (file_lock)
4524                 locks_free_lock(file_lock);
4525         return status;
4526
4527 out_nfserr:
4528         status = nfserrno(err);
4529         goto out;
4530 }
4531
4532 /*
4533  * returns
4534  *      1: locks held by lockowner
4535  *      0: no locks held by lockowner
4536  */
4537 static int
4538 check_for_locks(struct nfs4_file *filp, struct nfs4_lockowner *lowner)
4539 {
4540         struct file_lock **flpp;
4541         struct inode *inode = filp->fi_inode;
4542         int status = 0;
4543
4544         lock_flocks();
4545         for (flpp = &inode->i_flock; *flpp != NULL; flpp = &(*flpp)->fl_next) {
4546                 if ((*flpp)->fl_owner == (fl_owner_t)lowner) {
4547                         status = 1;
4548                         goto out;
4549                 }
4550         }
4551 out:
4552         unlock_flocks();
4553         return status;
4554 }
4555
4556 __be32
4557 nfsd4_release_lockowner(struct svc_rqst *rqstp,
4558                         struct nfsd4_compound_state *cstate,
4559                         struct nfsd4_release_lockowner *rlockowner)
4560 {
4561         clientid_t *clid = &rlockowner->rl_clientid;
4562         struct nfs4_stateowner *sop;
4563         struct nfs4_lockowner *lo;
4564         struct nfs4_ol_stateid *stp;
4565         struct xdr_netobj *owner = &rlockowner->rl_owner;
4566         struct list_head matches;
4567         unsigned int hashval = ownerstr_hashval(clid->cl_id, owner);
4568         __be32 status;
4569         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
4570
4571         dprintk("nfsd4_release_lockowner clientid: (%08x/%08x):\n",
4572                 clid->cl_boot, clid->cl_id);
4573
4574         nfs4_lock_state();
4575
4576         status = lookup_clientid(clid, cstate->minorversion, nn, NULL);
4577         if (status)
4578                 goto out;
4579
4580         status = nfserr_locks_held;
4581         INIT_LIST_HEAD(&matches);
4582
4583         list_for_each_entry(sop, &nn->ownerstr_hashtbl[hashval], so_strhash) {
4584                 if (sop->so_is_open_owner)
4585                         continue;
4586                 if (!same_owner_str(sop, owner, clid))
4587                         continue;
4588                 list_for_each_entry(stp, &sop->so_stateids,
4589                                 st_perstateowner) {
4590                         lo = lockowner(sop);
4591                         if (check_for_locks(stp->st_file, lo))
4592                                 goto out;
4593                         list_add(&lo->lo_list, &matches);
4594                 }
4595         }
4596         /* Clients probably won't expect us to return with some (but not all)
4597          * of the lockowner state released; so don't release any until all
4598          * have been checked. */
4599         status = nfs_ok;
4600         while (!list_empty(&matches)) {
4601                 lo = list_entry(matches.next, struct nfs4_lockowner,
4602                                                                 lo_list);
4603                 /* unhash_stateowner deletes so_perclient only
4604                  * for openowners. */
4605                 list_del(&lo->lo_list);
4606                 release_lockowner(lo);
4607         }
4608 out:
4609         nfs4_unlock_state();
4610         return status;
4611 }
4612
4613 static inline struct nfs4_client_reclaim *
4614 alloc_reclaim(void)
4615 {
4616         return kmalloc(sizeof(struct nfs4_client_reclaim), GFP_KERNEL);
4617 }
4618
4619 bool
4620 nfs4_has_reclaimed_state(const char *name, struct nfsd_net *nn)
4621 {
4622         struct nfs4_client_reclaim *crp;
4623
4624         crp = nfsd4_find_reclaim_client(name, nn);
4625         return (crp && crp->cr_clp);
4626 }
4627
4628 /*
4629  * failure => all reset bets are off, nfserr_no_grace...
4630  */
4631 struct nfs4_client_reclaim *
4632 nfs4_client_to_reclaim(const char *name, struct nfsd_net *nn)
4633 {
4634         unsigned int strhashval;
4635         struct nfs4_client_reclaim *crp;
4636
4637         dprintk("NFSD nfs4_client_to_reclaim NAME: %.*s\n", HEXDIR_LEN, name);
4638         crp = alloc_reclaim();
4639         if (crp) {
4640                 strhashval = clientstr_hashval(name);
4641                 INIT_LIST_HEAD(&crp->cr_strhash);
4642                 list_add(&crp->cr_strhash, &nn->reclaim_str_hashtbl[strhashval]);
4643                 memcpy(crp->cr_recdir, name, HEXDIR_LEN);
4644                 crp->cr_clp = NULL;
4645                 nn->reclaim_str_hashtbl_size++;
4646         }
4647         return crp;
4648 }
4649
4650 void
4651 nfs4_remove_reclaim_record(struct nfs4_client_reclaim *crp, struct nfsd_net *nn)
4652 {
4653         list_del(&crp->cr_strhash);
4654         kfree(crp);
4655         nn->reclaim_str_hashtbl_size--;
4656 }
4657
4658 void
4659 nfs4_release_reclaim(struct nfsd_net *nn)
4660 {
4661         struct nfs4_client_reclaim *crp = NULL;
4662         int i;
4663
4664         for (i = 0; i < CLIENT_HASH_SIZE; i++) {
4665                 while (!list_empty(&nn->reclaim_str_hashtbl[i])) {
4666                         crp = list_entry(nn->reclaim_str_hashtbl[i].next,
4667                                         struct nfs4_client_reclaim, cr_strhash);
4668                         nfs4_remove_reclaim_record(crp, nn);
4669                 }
4670         }
4671         WARN_ON_ONCE(nn->reclaim_str_hashtbl_size);
4672 }
4673
4674 /*
4675  * called from OPEN, CLAIM_PREVIOUS with a new clientid. */
4676 struct nfs4_client_reclaim *
4677 nfsd4_find_reclaim_client(const char *recdir, struct nfsd_net *nn)
4678 {
4679         unsigned int strhashval;
4680         struct nfs4_client_reclaim *crp = NULL;
4681
4682         dprintk("NFSD: nfs4_find_reclaim_client for recdir %s\n", recdir);
4683
4684         strhashval = clientstr_hashval(recdir);
4685         list_for_each_entry(crp, &nn->reclaim_str_hashtbl[strhashval], cr_strhash) {
4686                 if (same_name(crp->cr_recdir, recdir)) {
4687                         return crp;
4688                 }
4689         }
4690         return NULL;
4691 }
4692
4693 /*
4694 * Called from OPEN. Look for clientid in reclaim list.
4695 */
4696 __be32
4697 nfs4_check_open_reclaim(clientid_t *clid, bool sessions, struct nfsd_net *nn)
4698 {
4699         struct nfs4_client *clp;
4700
4701         /* find clientid in conf_id_hashtbl */
4702         clp = find_confirmed_client(clid, sessions, nn);
4703         if (clp == NULL)
4704                 return nfserr_reclaim_bad;
4705
4706         return nfsd4_client_record_check(clp) ? nfserr_reclaim_bad : nfs_ok;
4707 }
4708
4709 #ifdef CONFIG_NFSD_FAULT_INJECTION
4710
4711 u64 nfsd_forget_client(struct nfs4_client *clp, u64 max)
4712 {
4713         if (mark_client_expired(clp))
4714                 return 0;
4715         expire_client(clp);
4716         return 1;
4717 }
4718
4719 u64 nfsd_print_client(struct nfs4_client *clp, u64 num)
4720 {
4721         char buf[INET6_ADDRSTRLEN];
4722         rpc_ntop((struct sockaddr *)&clp->cl_addr, buf, sizeof(buf));
4723         printk(KERN_INFO "NFS Client: %s\n", buf);
4724         return 1;
4725 }
4726
4727 static void nfsd_print_count(struct nfs4_client *clp, unsigned int count,
4728                              const char *type)
4729 {
4730         char buf[INET6_ADDRSTRLEN];
4731         rpc_ntop((struct sockaddr *)&clp->cl_addr, buf, sizeof(buf));
4732         printk(KERN_INFO "NFS Client: %s has %u %s\n", buf, count, type);
4733 }
4734
4735 static u64 nfsd_foreach_client_lock(struct nfs4_client *clp, u64 max, void (*func)(struct nfs4_lockowner *))
4736 {
4737         struct nfs4_openowner *oop;
4738         struct nfs4_lockowner *lop, *lo_next;
4739         struct nfs4_ol_stateid *stp, *st_next;
4740         u64 count = 0;
4741
4742         list_for_each_entry(oop, &clp->cl_openowners, oo_perclient) {
4743                 list_for_each_entry_safe(stp, st_next, &oop->oo_owner.so_stateids, st_perstateowner) {
4744                         list_for_each_entry_safe(lop, lo_next, &stp->st_lockowners, lo_perstateid) {
4745                                 if (func)
4746                                         func(lop);
4747                                 if (++count == max)
4748                                         return count;
4749                         }
4750                 }
4751         }
4752
4753         return count;
4754 }
4755
4756 u64 nfsd_forget_client_locks(struct nfs4_client *clp, u64 max)
4757 {
4758         return nfsd_foreach_client_lock(clp, max, release_lockowner);
4759 }
4760
4761 u64 nfsd_print_client_locks(struct nfs4_client *clp, u64 max)
4762 {
4763         u64 count = nfsd_foreach_client_lock(clp, max, NULL);
4764         nfsd_print_count(clp, count, "locked files");
4765         return count;
4766 }
4767
4768 static u64 nfsd_foreach_client_open(struct nfs4_client *clp, u64 max, void (*func)(struct nfs4_openowner *))
4769 {
4770         struct nfs4_openowner *oop, *next;
4771         u64 count = 0;
4772
4773         list_for_each_entry_safe(oop, next, &clp->cl_openowners, oo_perclient) {
4774                 if (func)
4775                         func(oop);
4776                 if (++count == max)
4777                         break;
4778         }
4779
4780         return count;
4781 }
4782
4783 u64 nfsd_forget_client_openowners(struct nfs4_client *clp, u64 max)
4784 {
4785         return nfsd_foreach_client_open(clp, max, release_openowner);
4786 }
4787
4788 u64 nfsd_print_client_openowners(struct nfs4_client *clp, u64 max)
4789 {
4790         u64 count = nfsd_foreach_client_open(clp, max, NULL);
4791         nfsd_print_count(clp, count, "open files");
4792         return count;
4793 }
4794
4795 static u64 nfsd_find_all_delegations(struct nfs4_client *clp, u64 max,
4796                                      struct list_head *victims)
4797 {
4798         struct nfs4_delegation *dp, *next;
4799         u64 count = 0;
4800
4801         list_for_each_entry_safe(dp, next, &clp->cl_delegations, dl_perclnt) {
4802                 if (victims)
4803                         list_move(&dp->dl_recall_lru, victims);
4804                 if (++count == max)
4805                         break;
4806         }
4807         return count;
4808 }
4809
4810 u64 nfsd_forget_client_delegations(struct nfs4_client *clp, u64 max)
4811 {
4812         struct nfs4_delegation *dp, *next;
4813         LIST_HEAD(victims);
4814         u64 count;
4815
4816         spin_lock(&recall_lock);
4817         count = nfsd_find_all_delegations(clp, max, &victims);
4818         spin_unlock(&recall_lock);
4819
4820         list_for_each_entry_safe(dp, next, &victims, dl_recall_lru)
4821                 revoke_delegation(dp);
4822
4823         return count;
4824 }
4825
4826 u64 nfsd_recall_client_delegations(struct nfs4_client *clp, u64 max)
4827 {
4828         struct nfs4_delegation *dp, *next;
4829         LIST_HEAD(victims);
4830         u64 count;
4831
4832         spin_lock(&recall_lock);
4833         count = nfsd_find_all_delegations(clp, max, &victims);
4834         list_for_each_entry_safe(dp, next, &victims, dl_recall_lru)
4835                 nfsd_break_one_deleg(dp);
4836         spin_unlock(&recall_lock);
4837
4838         return count;
4839 }
4840
4841 u64 nfsd_print_client_delegations(struct nfs4_client *clp, u64 max)
4842 {
4843         u64 count = 0;
4844
4845         spin_lock(&recall_lock);
4846         count = nfsd_find_all_delegations(clp, max, NULL);
4847         spin_unlock(&recall_lock);
4848
4849         nfsd_print_count(clp, count, "delegations");
4850         return count;
4851 }
4852
4853 u64 nfsd_for_n_state(u64 max, u64 (*func)(struct nfs4_client *, u64))
4854 {
4855         struct nfs4_client *clp, *next;
4856         u64 count = 0;
4857         struct nfsd_net *nn = net_generic(current->nsproxy->net_ns, nfsd_net_id);
4858
4859         if (!nfsd_netns_ready(nn))
4860                 return 0;
4861
4862         list_for_each_entry_safe(clp, next, &nn->client_lru, cl_lru) {
4863                 count += func(clp, max - count);
4864                 if ((max != 0) && (count >= max))
4865                         break;
4866         }
4867
4868         return count;
4869 }
4870
4871 struct nfs4_client *nfsd_find_client(struct sockaddr_storage *addr, size_t addr_size)
4872 {
4873         struct nfs4_client *clp;
4874         struct nfsd_net *nn = net_generic(current->nsproxy->net_ns, nfsd_net_id);
4875
4876         if (!nfsd_netns_ready(nn))
4877                 return NULL;
4878
4879         list_for_each_entry(clp, &nn->client_lru, cl_lru) {
4880                 if (memcmp(&clp->cl_addr, addr, addr_size) == 0)
4881                         return clp;
4882         }
4883         return NULL;
4884 }
4885
4886 #endif /* CONFIG_NFSD_FAULT_INJECTION */
4887
4888 /* initialization to perform at module load time: */
4889
4890 void
4891 nfs4_state_init(void)
4892 {
4893 }
4894
4895 /*
4896  * Since the lifetime of a delegation isn't limited to that of an open, a
4897  * client may quite reasonably hang on to a delegation as long as it has
4898  * the inode cached.  This becomes an obvious problem the first time a
4899  * client's inode cache approaches the size of the server's total memory.
4900  *
4901  * For now we avoid this problem by imposing a hard limit on the number
4902  * of delegations, which varies according to the server's memory size.
4903  */
4904 static void
4905 set_max_delegations(void)
4906 {
4907         /*
4908          * Allow at most 4 delegations per megabyte of RAM.  Quick
4909          * estimates suggest that in the worst case (where every delegation
4910          * is for a different inode), a delegation could take about 1.5K,
4911          * giving a worst case usage of about 6% of memory.
4912          */
4913         max_delegations = nr_free_buffer_pages() >> (20 - 2 - PAGE_SHIFT);
4914 }
4915
4916 static int nfs4_state_create_net(struct net *net)
4917 {
4918         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
4919         int i;
4920
4921         nn->conf_id_hashtbl = kmalloc(sizeof(struct list_head) *
4922                         CLIENT_HASH_SIZE, GFP_KERNEL);
4923         if (!nn->conf_id_hashtbl)
4924                 goto err;
4925         nn->unconf_id_hashtbl = kmalloc(sizeof(struct list_head) *
4926                         CLIENT_HASH_SIZE, GFP_KERNEL);
4927         if (!nn->unconf_id_hashtbl)
4928                 goto err_unconf_id;
4929         nn->ownerstr_hashtbl = kmalloc(sizeof(struct list_head) *
4930                         OWNER_HASH_SIZE, GFP_KERNEL);
4931         if (!nn->ownerstr_hashtbl)
4932                 goto err_ownerstr;
4933         nn->lockowner_ino_hashtbl = kmalloc(sizeof(struct list_head) *
4934                         LOCKOWNER_INO_HASH_SIZE, GFP_KERNEL);
4935         if (!nn->lockowner_ino_hashtbl)
4936                 goto err_lockowner_ino;
4937         nn->sessionid_hashtbl = kmalloc(sizeof(struct list_head) *
4938                         SESSION_HASH_SIZE, GFP_KERNEL);
4939         if (!nn->sessionid_hashtbl)
4940                 goto err_sessionid;
4941
4942         for (i = 0; i < CLIENT_HASH_SIZE; i++) {
4943                 INIT_LIST_HEAD(&nn->conf_id_hashtbl[i]);
4944                 INIT_LIST_HEAD(&nn->unconf_id_hashtbl[i]);
4945         }
4946         for (i = 0; i < OWNER_HASH_SIZE; i++)
4947                 INIT_LIST_HEAD(&nn->ownerstr_hashtbl[i]);
4948         for (i = 0; i < LOCKOWNER_INO_HASH_SIZE; i++)
4949                 INIT_LIST_HEAD(&nn->lockowner_ino_hashtbl[i]);
4950         for (i = 0; i < SESSION_HASH_SIZE; i++)
4951                 INIT_LIST_HEAD(&nn->sessionid_hashtbl[i]);
4952         nn->conf_name_tree = RB_ROOT;
4953         nn->unconf_name_tree = RB_ROOT;
4954         INIT_LIST_HEAD(&nn->client_lru);
4955         INIT_LIST_HEAD(&nn->close_lru);
4956         INIT_LIST_HEAD(&nn->del_recall_lru);
4957         spin_lock_init(&nn->client_lock);
4958
4959         INIT_DELAYED_WORK(&nn->laundromat_work, laundromat_main);
4960         get_net(net);
4961
4962         return 0;
4963
4964 err_sessionid:
4965         kfree(nn->lockowner_ino_hashtbl);
4966 err_lockowner_ino:
4967         kfree(nn->ownerstr_hashtbl);
4968 err_ownerstr:
4969         kfree(nn->unconf_id_hashtbl);
4970 err_unconf_id:
4971         kfree(nn->conf_id_hashtbl);
4972 err:
4973         return -ENOMEM;
4974 }
4975
4976 static void
4977 nfs4_state_destroy_net(struct net *net)
4978 {
4979         int i;
4980         struct nfs4_client *clp = NULL;
4981         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
4982
4983         for (i = 0; i < CLIENT_HASH_SIZE; i++) {
4984                 while (!list_empty(&nn->conf_id_hashtbl[i])) {
4985                         clp = list_entry(nn->conf_id_hashtbl[i].next, struct nfs4_client, cl_idhash);
4986                         destroy_client(clp);
4987                 }
4988         }
4989
4990         for (i = 0; i < CLIENT_HASH_SIZE; i++) {
4991                 while (!list_empty(&nn->unconf_id_hashtbl[i])) {
4992                         clp = list_entry(nn->unconf_id_hashtbl[i].next, struct nfs4_client, cl_idhash);
4993                         destroy_client(clp);
4994                 }
4995         }
4996
4997         kfree(nn->sessionid_hashtbl);
4998         kfree(nn->lockowner_ino_hashtbl);
4999         kfree(nn->ownerstr_hashtbl);
5000         kfree(nn->unconf_id_hashtbl);
5001         kfree(nn->conf_id_hashtbl);
5002         put_net(net);
5003 }
5004
5005 int
5006 nfs4_state_start_net(struct net *net)
5007 {
5008         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
5009         int ret;
5010
5011         ret = nfs4_state_create_net(net);
5012         if (ret)
5013                 return ret;
5014         nfsd4_client_tracking_init(net);
5015         nn->boot_time = get_seconds();
5016         locks_start_grace(net, &nn->nfsd4_manager);
5017         nn->grace_ended = false;
5018         printk(KERN_INFO "NFSD: starting %ld-second grace period (net %p)\n",
5019                nn->nfsd4_grace, net);
5020         queue_delayed_work(laundry_wq, &nn->laundromat_work, nn->nfsd4_grace * HZ);
5021         return 0;
5022 }
5023
5024 /* initialization to perform when the nfsd service is started: */
5025
5026 int
5027 nfs4_state_start(void)
5028 {
5029         int ret;
5030
5031         ret = set_callback_cred();
5032         if (ret)
5033                 return -ENOMEM;
5034         laundry_wq = create_singlethread_workqueue("nfsd4");
5035         if (laundry_wq == NULL) {
5036                 ret = -ENOMEM;
5037                 goto out_recovery;
5038         }
5039         ret = nfsd4_create_callback_queue();
5040         if (ret)
5041                 goto out_free_laundry;
5042
5043         set_max_delegations();
5044
5045         return 0;
5046
5047 out_free_laundry:
5048         destroy_workqueue(laundry_wq);
5049 out_recovery:
5050         return ret;
5051 }
5052
5053 /* should be called with the state lock held */
5054 void
5055 nfs4_state_shutdown_net(struct net *net)
5056 {
5057         struct nfs4_delegation *dp = NULL;
5058         struct list_head *pos, *next, reaplist;
5059         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
5060
5061         cancel_delayed_work_sync(&nn->laundromat_work);
5062         locks_end_grace(&nn->nfsd4_manager);
5063
5064         INIT_LIST_HEAD(&reaplist);
5065         spin_lock(&recall_lock);
5066         list_for_each_safe(pos, next, &nn->del_recall_lru) {
5067                 dp = list_entry (pos, struct nfs4_delegation, dl_recall_lru);
5068                 list_move(&dp->dl_recall_lru, &reaplist);
5069         }
5070         spin_unlock(&recall_lock);
5071         list_for_each_safe(pos, next, &reaplist) {
5072                 dp = list_entry (pos, struct nfs4_delegation, dl_recall_lru);
5073                 destroy_delegation(dp);
5074         }
5075
5076         nfsd4_client_tracking_exit(net);
5077         nfs4_state_destroy_net(net);
5078 }
5079
5080 void
5081 nfs4_state_shutdown(void)
5082 {
5083         destroy_workqueue(laundry_wq);
5084         nfsd4_destroy_callback_queue();
5085 }
5086
5087 static void
5088 get_stateid(struct nfsd4_compound_state *cstate, stateid_t *stateid)
5089 {
5090         if (HAS_STATE_ID(cstate, CURRENT_STATE_ID_FLAG) && CURRENT_STATEID(stateid))
5091                 memcpy(stateid, &cstate->current_stateid, sizeof(stateid_t));
5092 }
5093
5094 static void
5095 put_stateid(struct nfsd4_compound_state *cstate, stateid_t *stateid)
5096 {
5097         if (cstate->minorversion) {
5098                 memcpy(&cstate->current_stateid, stateid, sizeof(stateid_t));
5099                 SET_STATE_ID(cstate, CURRENT_STATE_ID_FLAG);
5100         }
5101 }
5102
5103 void
5104 clear_current_stateid(struct nfsd4_compound_state *cstate)
5105 {
5106         CLEAR_STATE_ID(cstate, CURRENT_STATE_ID_FLAG);
5107 }
5108
5109 /*
5110  * functions to set current state id
5111  */
5112 void
5113 nfsd4_set_opendowngradestateid(struct nfsd4_compound_state *cstate, struct nfsd4_open_downgrade *odp)
5114 {
5115         put_stateid(cstate, &odp->od_stateid);
5116 }
5117
5118 void
5119 nfsd4_set_openstateid(struct nfsd4_compound_state *cstate, struct nfsd4_open *open)
5120 {
5121         put_stateid(cstate, &open->op_stateid);
5122 }
5123
5124 void
5125 nfsd4_set_closestateid(struct nfsd4_compound_state *cstate, struct nfsd4_close *close)
5126 {
5127         put_stateid(cstate, &close->cl_stateid);
5128 }
5129
5130 void
5131 nfsd4_set_lockstateid(struct nfsd4_compound_state *cstate, struct nfsd4_lock *lock)
5132 {
5133         put_stateid(cstate, &lock->lk_resp_stateid);
5134 }
5135
5136 /*
5137  * functions to consume current state id
5138  */
5139
5140 void
5141 nfsd4_get_opendowngradestateid(struct nfsd4_compound_state *cstate, struct nfsd4_open_downgrade *odp)
5142 {
5143         get_stateid(cstate, &odp->od_stateid);
5144 }
5145
5146 void
5147 nfsd4_get_delegreturnstateid(struct nfsd4_compound_state *cstate, struct nfsd4_delegreturn *drp)
5148 {
5149         get_stateid(cstate, &drp->dr_stateid);
5150 }
5151
5152 void
5153 nfsd4_get_freestateid(struct nfsd4_compound_state *cstate, struct nfsd4_free_stateid *fsp)
5154 {
5155         get_stateid(cstate, &fsp->fr_stateid);
5156 }
5157
5158 void
5159 nfsd4_get_setattrstateid(struct nfsd4_compound_state *cstate, struct nfsd4_setattr *setattr)
5160 {
5161         get_stateid(cstate, &setattr->sa_stateid);
5162 }
5163
5164 void
5165 nfsd4_get_closestateid(struct nfsd4_compound_state *cstate, struct nfsd4_close *close)
5166 {
5167         get_stateid(cstate, &close->cl_stateid);
5168 }
5169
5170 void
5171 nfsd4_get_lockustateid(struct nfsd4_compound_state *cstate, struct nfsd4_locku *locku)
5172 {
5173         get_stateid(cstate, &locku->lu_stateid);
5174 }
5175
5176 void
5177 nfsd4_get_readstateid(struct nfsd4_compound_state *cstate, struct nfsd4_read *read)
5178 {
5179         get_stateid(cstate, &read->rd_stateid);
5180 }
5181
5182 void
5183 nfsd4_get_writestateid(struct nfsd4_compound_state *cstate, struct nfsd4_write *write)
5184 {
5185         get_stateid(cstate, &write->wr_stateid);
5186 }