fs/nfsd/nfs4state.c

   1 /*
   2 *  Copyright (c) 2001 The Regents of the University of Michigan.
   3 *  All rights reserved.
   4 *
   5 *  Kendrick Smith <kmsmith@umich.edu>
   6 *  Andy Adamson <kandros@umich.edu>
   7 *
   8 *  Redistribution and use in source and binary forms, with or without
   9 *  modification, are permitted provided that the following conditions
  10 *  are met:
  11 *
  12 *  1. Redistributions of source code must retain the above copyright
  13 *     notice, this list of conditions and the following disclaimer.
  14 *  2. Redistributions in binary form must reproduce the above copyright
  15 *     notice, this list of conditions and the following disclaimer in the
  16 *     documentation and/or other materials provided with the distribution.
  17 *  3. Neither the name of the University nor the names of its
  18 *     contributors may be used to endorse or promote products derived
  19 *     from this software without specific prior written permission.
  20 *
  21 *  THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
  22 *  WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
  23 *  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
  24 *  DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
  25 *  FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  26 *  CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  27 *  SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
  28 *  BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
  29 *  LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
  30 *  NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
  31 *  SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  32 *
  33 */
  34
  35 #include <linux/file.h>
  36 #include <linux/fs.h>
  37 #include <linux/slab.h>
  38 #include <linux/namei.h>
  39 #include <linux/swap.h>
  40 #include <linux/pagemap.h>
  41 #include <linux/ratelimit.h>
  42 #include <linux/sunrpc/svcauth_gss.h>
  43 #include <linux/sunrpc/addr.h>
  44 #include <linux/hash.h>
  45 #include "xdr4.h"
  46 #include "xdr4cb.h"
  47 #include "vfs.h"
  48 #include "current_stateid.h"
  49
  50 #include "netns.h"
  51
  52 #define NFSDDBG_FACILITY                NFSDDBG_PROC
  53
  54 #define all_ones {{~0,~0},~0}
  55 static const stateid_t one_stateid = {
  56         .si_generation = ~0,
  57         .si_opaque = all_ones,
  58 };
  59 static const stateid_t zero_stateid = {
  60         /* all fields zero */
  61 };
  62 static const stateid_t currentstateid = {
  63         .si_generation = 1,
  64 };
  65
  66 static u64 current_sessionid = 1;
  67
  68 #define ZERO_STATEID(stateid) (!memcmp((stateid), &zero_stateid, sizeof(stateid_t)))
  69 #define ONE_STATEID(stateid)  (!memcmp((stateid), &one_stateid, sizeof(stateid_t)))
  70 #define CURRENT_STATEID(stateid) (!memcmp((stateid), &currentstateid, sizeof(stateid_t)))
  71
  72 /* forward declarations */
  73 static int check_for_locks(struct nfs4_file *filp, struct nfs4_lockowner *lowner);
  74
  75 /* Locking: */
  76
  77 /* Currently used for almost all code touching nfsv4 state: */
  78 static DEFINE_MUTEX(client_mutex);
  79
  80 /*
  81  * Currently used for the del_recall_lru and file hash table.  In an
  82  * effort to decrease the scope of the client_mutex, this spinlock may
  83  * eventually cover more:
  84  */
  85 static DEFINE_SPINLOCK(state_lock);
  86
  87 static struct kmem_cache *openowner_slab;
  88 static struct kmem_cache *lockowner_slab;
  89 static struct kmem_cache *file_slab;
  90 static struct kmem_cache *stateid_slab;
  91 static struct kmem_cache *deleg_slab;
  92
  93 void
  94 nfs4_lock_state(void)
  95 {
  96         mutex_lock(&client_mutex);
  97 }
  98
  99 static void free_session(struct nfsd4_session *);
 100
 101 static bool is_session_dead(struct nfsd4_session *ses)
 102 {
 103         return ses->se_flags & NFS4_SESSION_DEAD;
 104 }
 105
 106 void nfsd4_put_session(struct nfsd4_session *ses)
 107 {
 108         if (atomic_dec_and_test(&ses->se_ref) && is_session_dead(ses))
 109                 free_session(ses);
 110 }
 111
 112 static __be32 mark_session_dead_locked(struct nfsd4_session *ses, int ref_held_by_me)
 113 {
 114         if (atomic_read(&ses->se_ref) > ref_held_by_me)
 115                 return nfserr_jukebox;
 116         ses->se_flags |= NFS4_SESSION_DEAD;
 117         return nfs_ok;
 118 }
 119
 120 static __be32 nfsd4_get_session_locked(struct nfsd4_session *ses)
 121 {
 122         if (is_session_dead(ses))
 123                 return nfserr_badsession;
 124         atomic_inc(&ses->se_ref);
 125         return nfs_ok;
 126 }
 127
 128 void
 129 nfs4_unlock_state(void)
 130 {
 131         mutex_unlock(&client_mutex);
 132 }
 133
 134 static bool is_client_expired(struct nfs4_client *clp)
 135 {
 136         return clp->cl_time == 0;
 137 }
 138
 139 static __be32 mark_client_expired_locked(struct nfs4_client *clp)
 140 {
 141         if (atomic_read(&clp->cl_refcount))
 142                 return nfserr_jukebox;
 143         clp->cl_time = 0;
 144         return nfs_ok;
 145 }
 146
 147 static __be32 mark_client_expired(struct nfs4_client *clp)
 148 {
 149         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
 150         __be32 ret;
 151
 152         spin_lock(&nn->client_lock);
 153         ret = mark_client_expired_locked(clp);
 154         spin_unlock(&nn->client_lock);
 155         return ret;
 156 }
 157
 158 static __be32 get_client_locked(struct nfs4_client *clp)
 159 {
 160         if (is_client_expired(clp))
 161                 return nfserr_expired;
 162         atomic_inc(&clp->cl_refcount);
 163         return nfs_ok;
 164 }
 165
 166 /* must be called under the client_lock */
 167 static inline void
 168 renew_client_locked(struct nfs4_client *clp)
 169 {
 170         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
 171
 172         if (is_client_expired(clp)) {
 173                 WARN_ON(1);
 174                 printk("%s: client (clientid %08x/%08x) already expired\n",
 175                         __func__,
 176                         clp->cl_clientid.cl_boot,
 177                         clp->cl_clientid.cl_id);
 178                 return;
 179         }
 180
 181         dprintk("renewing client (clientid %08x/%08x)\n",
 182                         clp->cl_clientid.cl_boot,
 183                         clp->cl_clientid.cl_id);
 184         list_move_tail(&clp->cl_lru, &nn->client_lru);
 185         clp->cl_time = get_seconds();
 186 }
 187
 188 static inline void
 189 renew_client(struct nfs4_client *clp)
 190 {
 191         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
 192
 193         spin_lock(&nn->client_lock);
 194         renew_client_locked(clp);
 195         spin_unlock(&nn->client_lock);
 196 }
 197
 198 static void put_client_renew_locked(struct nfs4_client *clp)
 199 {
 200         if (!atomic_dec_and_test(&clp->cl_refcount))
 201                 return;
 202         if (!is_client_expired(clp))
 203                 renew_client_locked(clp);
 204 }
 205
 206 static inline u32
 207 opaque_hashval(const void *ptr, int nbytes)
 208 {
 209         unsigned char *cptr = (unsigned char *) ptr;
 210
 211         u32 x = 0;
 212         while (nbytes--) {
 213                 x *= 37;
 214                 x += *cptr++;
 215         }
 216         return x;
 217 }
 218
 219 static void nfsd4_free_file(struct nfs4_file *f)
 220 {
 221         kmem_cache_free(file_slab, f);
 222 }
 223
 224 static inline void
 225 put_nfs4_file(struct nfs4_file *fi)
 226 {
 227         if (atomic_dec_and_lock(&fi->fi_ref, &state_lock)) {
 228                 hlist_del(&fi->fi_hash);
 229                 spin_unlock(&state_lock);
 230                 iput(fi->fi_inode);
 231                 nfsd4_free_file(fi);
 232         }
 233 }
 234
 235 static inline void
 236 get_nfs4_file(struct nfs4_file *fi)
 237 {
 238         atomic_inc(&fi->fi_ref);
 239 }
 240
 241 static int num_delegations;
 242 unsigned long max_delegations;
 243
 244 /*
 245  * Open owner state (share locks)
 246  */
 247
 248 /* hash tables for lock and open owners */
 249 #define OWNER_HASH_BITS              8
 250 #define OWNER_HASH_SIZE             (1 << OWNER_HASH_BITS)
 251 #define OWNER_HASH_MASK             (OWNER_HASH_SIZE - 1)
 252
 253 static unsigned int ownerstr_hashval(u32 clientid, struct xdr_netobj *ownername)
 254 {
 255         unsigned int ret;
 256
 257         ret = opaque_hashval(ownername->data, ownername->len);
 258         ret += clientid;
 259         return ret & OWNER_HASH_MASK;
 260 }
 261
 262 /* hash table for nfs4_file */
 263 #define FILE_HASH_BITS                   8
 264 #define FILE_HASH_SIZE                  (1 << FILE_HASH_BITS)
 265
 266 static unsigned int file_hashval(struct inode *ino)
 267 {
 268         /* XXX: why are we hashing on inode pointer, anyway? */
 269         return hash_ptr(ino, FILE_HASH_BITS);
 270 }
 271
 272 static struct hlist_head file_hashtbl[FILE_HASH_SIZE];
 273
 274 static void __nfs4_file_get_access(struct nfs4_file *fp, int oflag)
 275 {
 276         WARN_ON_ONCE(!(fp->fi_fds[oflag] || fp->fi_fds[O_RDWR]));
 277         atomic_inc(&fp->fi_access[oflag]);
 278 }
 279
 280 static void nfs4_file_get_access(struct nfs4_file *fp, int oflag)
 281 {
 282         if (oflag == O_RDWR) {
 283                 __nfs4_file_get_access(fp, O_RDONLY);
 284                 __nfs4_file_get_access(fp, O_WRONLY);
 285         } else
 286                 __nfs4_file_get_access(fp, oflag);
 287 }
 288
 289 static void nfs4_file_put_fd(struct nfs4_file *fp, int oflag)
 290 {
 291         if (fp->fi_fds[oflag]) {
 292                 fput(fp->fi_fds[oflag]);
 293                 fp->fi_fds[oflag] = NULL;
 294         }
 295 }
 296
 297 static void __nfs4_file_put_access(struct nfs4_file *fp, int oflag)
 298 {
 299         if (atomic_dec_and_test(&fp->fi_access[oflag])) {
 300                 nfs4_file_put_fd(fp, oflag);
 301                 if (atomic_read(&fp->fi_access[1 - oflag]) == 0)
 302                         nfs4_file_put_fd(fp, O_RDWR);
 303         }
 304 }
 305
 306 static void nfs4_file_put_access(struct nfs4_file *fp, int oflag)
 307 {
 308         if (oflag == O_RDWR) {
 309                 __nfs4_file_put_access(fp, O_RDONLY);
 310                 __nfs4_file_put_access(fp, O_WRONLY);
 311         } else
 312                 __nfs4_file_put_access(fp, oflag);
 313 }
 314
 315 static struct nfs4_stid *nfs4_alloc_stid(struct nfs4_client *cl, struct
 316 kmem_cache *slab)
 317 {
 318         struct idr *stateids = &cl->cl_stateids;
 319         struct nfs4_stid *stid;
 320         int new_id;
 321
 322         stid = kmem_cache_alloc(slab, GFP_KERNEL);
 323         if (!stid)
 324                 return NULL;
 325
 326         new_id = idr_alloc_cyclic(stateids, stid, 0, 0, GFP_KERNEL);
 327         if (new_id < 0)
 328                 goto out_free;
 329         stid->sc_client = cl;
 330         stid->sc_type = 0;
 331         stid->sc_stateid.si_opaque.so_id = new_id;
 332         stid->sc_stateid.si_opaque.so_clid = cl->cl_clientid;
 333         /* Will be incremented before return to client: */
 334         stid->sc_stateid.si_generation = 0;
 335
 336         /*
 337          * It shouldn't be a problem to reuse an opaque stateid value.
 338          * I don't think it is for 4.1.  But with 4.0 I worry that, for
 339          * example, a stray write retransmission could be accepted by
 340          * the server when it should have been rejected.  Therefore,
 341          * adopt a trick from the sctp code to attempt to maximize the
 342          * amount of time until an id is reused, by ensuring they always
 343          * "increase" (mod INT_MAX):
 344          */
 345         return stid;
 346 out_free:
 347         kmem_cache_free(slab, stid);
 348         return NULL;
 349 }
 350
 351 static struct nfs4_ol_stateid * nfs4_alloc_stateid(struct nfs4_client *clp)
 352 {
 353         return openlockstateid(nfs4_alloc_stid(clp, stateid_slab));
 354 }
 355
 356 /*
 357  * When we recall a delegation, we should be careful not to hand it
 358  * out again straight away.
 359  * To ensure this we keep a pair of bloom filters ('new' and 'old')
 360  * in which the filehandles of recalled delegations are "stored".
 361  * If a filehandle appear in either filter, a delegation is blocked.
 362  * When a delegation is recalled, the filehandle is stored in the "new"
 363  * filter.
 364  * Every 30 seconds we swap the filters and clear the "new" one,
 365  * unless both are empty of course.
 366  *
 367  * Each filter is 256 bits.  We hash the filehandle to 32bit and use the
 368  * low 3 bytes as hash-table indices.
 369  *
 370  * 'state_lock', which is always held when block_delegations() is called,
 371  * is used to manage concurrent access.  Testing does not need the lock
 372  * except when swapping the two filters.
 373  */
 374 static struct bloom_pair {
 375         int     entries, old_entries;
 376         time_t  swap_time;
 377         int     new; /* index into 'set' */
 378         DECLARE_BITMAP(set[2], 256);
 379 } blocked_delegations;
 380
 381 static int delegation_blocked(struct knfsd_fh *fh)
 382 {
 383         u32 hash;
 384         struct bloom_pair *bd = &blocked_delegations;
 385
 386         if (bd->entries == 0)
 387                 return 0;
 388         if (seconds_since_boot() - bd->swap_time > 30) {
 389                 spin_lock(&state_lock);
 390                 if (seconds_since_boot() - bd->swap_time > 30) {
 391                         bd->entries -= bd->old_entries;
 392                         bd->old_entries = bd->entries;
 393                         memset(bd->set[bd->new], 0,
 394                                sizeof(bd->set[0]));
 395                         bd->new = 1-bd->new;
 396                         bd->swap_time = seconds_since_boot();
 397                 }
 398                 spin_unlock(&state_lock);
 399         }
 400         hash = arch_fast_hash(&fh->fh_base, fh->fh_size, 0);
 401         if (test_bit(hash&255, bd->set[0]) &&
 402             test_bit((hash>>8)&255, bd->set[0]) &&
 403             test_bit((hash>>16)&255, bd->set[0]))
 404                 return 1;
 405
 406         if (test_bit(hash&255, bd->set[1]) &&
 407             test_bit((hash>>8)&255, bd->set[1]) &&
 408             test_bit((hash>>16)&255, bd->set[1]))
 409                 return 1;
 410
 411         return 0;
 412 }
 413
 414 static void block_delegations(struct knfsd_fh *fh)
 415 {
 416         u32 hash;
 417         struct bloom_pair *bd = &blocked_delegations;
 418
 419         hash = arch_fast_hash(&fh->fh_base, fh->fh_size, 0);
 420
 421         __set_bit(hash&255, bd->set[bd->new]);
 422         __set_bit((hash>>8)&255, bd->set[bd->new]);
 423         __set_bit((hash>>16)&255, bd->set[bd->new]);
 424         if (bd->entries == 0)
 425                 bd->swap_time = seconds_since_boot();
 426         bd->entries += 1;
 427 }
 428
 429 static struct nfs4_delegation *
 430 alloc_init_deleg(struct nfs4_client *clp, struct nfs4_ol_stateid *stp, struct svc_fh *current_fh)
 431 {
 432         struct nfs4_delegation *dp;
 433
 434         dprintk("NFSD alloc_init_deleg\n");
 435         if (num_delegations > max_delegations)
 436                 return NULL;
 437         if (delegation_blocked(&current_fh->fh_handle))
 438                 return NULL;
 439         dp = delegstateid(nfs4_alloc_stid(clp, deleg_slab));
 440         if (dp == NULL)
 441                 return dp;
 442         /*
 443          * delegation seqid's are never incremented.  The 4.1 special
 444          * meaning of seqid 0 isn't meaningful, really, but let's avoid
 445          * 0 anyway just for consistency and use 1:
 446          */
 447         dp->dl_stid.sc_stateid.si_generation = 1;
 448         num_delegations++;
 449         INIT_LIST_HEAD(&dp->dl_perfile);
 450         INIT_LIST_HEAD(&dp->dl_perclnt);
 451         INIT_LIST_HEAD(&dp->dl_recall_lru);
 452         dp->dl_file = NULL;
 453         dp->dl_type = NFS4_OPEN_DELEGATE_READ;
 454         fh_copy_shallow(&dp->dl_fh, &current_fh->fh_handle);
 455         dp->dl_time = 0;
 456         atomic_set(&dp->dl_count, 1);
 457         nfsd4_init_callback(&dp->dl_recall);
 458         return dp;
 459 }
 460
 461 static void remove_stid(struct nfs4_stid *s)
 462 {
 463         struct idr *stateids = &s->sc_client->cl_stateids;
 464
 465         idr_remove(stateids, s->sc_stateid.si_opaque.so_id);
 466 }
 467
 468 static void nfs4_free_stid(struct kmem_cache *slab, struct nfs4_stid *s)
 469 {
 470         kmem_cache_free(slab, s);
 471 }
 472
 473 void
 474 nfs4_put_delegation(struct nfs4_delegation *dp)
 475 {
 476         if (atomic_dec_and_test(&dp->dl_count)) {
 477                 nfs4_free_stid(deleg_slab, &dp->dl_stid);
 478                 num_delegations--;
 479         }
 480 }
 481
 482 static void nfs4_put_deleg_lease(struct nfs4_file *fp)
 483 {
 484         if (!fp->fi_lease)
 485                 return;
 486         if (atomic_dec_and_test(&fp->fi_delegees)) {
 487                 vfs_setlease(fp->fi_deleg_file, F_UNLCK, &fp->fi_lease);
 488                 fp->fi_lease = NULL;
 489                 fput(fp->fi_deleg_file);
 490                 fp->fi_deleg_file = NULL;
 491         }
 492 }
 493
 494 static void unhash_stid(struct nfs4_stid *s)
 495 {
 496         s->sc_type = 0;
 497 }
 498
 499 static void
 500 hash_delegation_locked(struct nfs4_delegation *dp, struct nfs4_file *fp)
 501 {
 502         lockdep_assert_held(&state_lock);
 503
 504         dp->dl_stid.sc_type = NFS4_DELEG_STID;
 505         list_add(&dp->dl_perfile, &fp->fi_delegations);
 506         list_add(&dp->dl_perclnt, &dp->dl_stid.sc_client->cl_delegations);
 507 }
 508
 509 /* Called under the state lock. */
 510 static void
 511 unhash_delegation(struct nfs4_delegation *dp)
 512 {
 513         spin_lock(&state_lock);
 514         list_del_init(&dp->dl_perclnt);
 515         list_del_init(&dp->dl_perfile);
 516         list_del_init(&dp->dl_recall_lru);
 517         spin_unlock(&state_lock);
 518         if (dp->dl_file) {
 519                 nfs4_put_deleg_lease(dp->dl_file);
 520                 put_nfs4_file(dp->dl_file);
 521                 dp->dl_file = NULL;
 522         }
 523 }
 524
 525
 526
 527 static void destroy_revoked_delegation(struct nfs4_delegation *dp)
 528 {
 529         list_del_init(&dp->dl_recall_lru);
 530         remove_stid(&dp->dl_stid);
 531         nfs4_put_delegation(dp);
 532 }
 533
 534 static void destroy_delegation(struct nfs4_delegation *dp)
 535 {
 536         unhash_delegation(dp);
 537         remove_stid(&dp->dl_stid);
 538         nfs4_put_delegation(dp);
 539 }
 540
 541 static void revoke_delegation(struct nfs4_delegation *dp)
 542 {
 543         struct nfs4_client *clp = dp->dl_stid.sc_client;
 544
 545         if (clp->cl_minorversion == 0)
 546                 destroy_delegation(dp);
 547         else {
 548                 unhash_delegation(dp);
 549                 dp->dl_stid.sc_type = NFS4_REVOKED_DELEG_STID;
 550                 list_add(&dp->dl_recall_lru, &clp->cl_revoked);
 551         }
 552 }
 553
 554 /*
 555  * SETCLIENTID state
 556  */
 557
 558 static unsigned int clientid_hashval(u32 id)
 559 {
 560         return id & CLIENT_HASH_MASK;
 561 }
 562
 563 static unsigned int clientstr_hashval(const char *name)
 564 {
 565         return opaque_hashval(name, 8) & CLIENT_HASH_MASK;
 566 }
 567
 568 /*
 569  * We store the NONE, READ, WRITE, and BOTH bits separately in the
 570  * st_{access,deny}_bmap field of the stateid, in order to track not
 571  * only what share bits are currently in force, but also what
 572  * combinations of share bits previous opens have used.  This allows us
 573  * to enforce the recommendation of rfc 3530 14.2.19 that the server
 574  * return an error if the client attempt to downgrade to a combination
 575  * of share bits not explicable by closing some of its previous opens.
 576  *
 577  * XXX: This enforcement is actually incomplete, since we don't keep
 578  * track of access/deny bit combinations; so, e.g., we allow:
 579  *
 580  *      OPEN allow read, deny write
 581  *      OPEN allow both, deny none
 582  *      DOWNGRADE allow read, deny none
 583  *
 584  * which we should reject.
 585  */
 586 static unsigned int
 587 bmap_to_share_mode(unsigned long bmap) {
 588         int i;
 589         unsigned int access = 0;
 590
 591         for (i = 1; i < 4; i++) {
 592                 if (test_bit(i, &bmap))
 593                         access |= i;
 594         }
 595         return access;
 596 }
 597
 598 static bool
 599 test_share(struct nfs4_ol_stateid *stp, struct nfsd4_open *open) {
 600         unsigned int access, deny;
 601
 602         access = bmap_to_share_mode(stp->st_access_bmap);
 603         deny = bmap_to_share_mode(stp->st_deny_bmap);
 604         if ((access & open->op_share_deny) || (deny & open->op_share_access))
 605                 return false;
 606         return true;
 607 }
 608
 609 /* set share access for a given stateid */
 610 static inline void
 611 set_access(u32 access, struct nfs4_ol_stateid *stp)
 612 {
 613         __set_bit(access, &stp->st_access_bmap);
 614 }
 615
 616 /* clear share access for a given stateid */
 617 static inline void
 618 clear_access(u32 access, struct nfs4_ol_stateid *stp)
 619 {
 620         __clear_bit(access, &stp->st_access_bmap);
 621 }
 622
 623 /* test whether a given stateid has access */
 624 static inline bool
 625 test_access(u32 access, struct nfs4_ol_stateid *stp)
 626 {
 627         return test_bit(access, &stp->st_access_bmap);
 628 }
 629
 630 /* set share deny for a given stateid */
 631 static inline void
 632 set_deny(u32 access, struct nfs4_ol_stateid *stp)
 633 {
 634         __set_bit(access, &stp->st_deny_bmap);
 635 }
 636
 637 /* clear share deny for a given stateid */
 638 static inline void
 639 clear_deny(u32 access, struct nfs4_ol_stateid *stp)
 640 {
 641         __clear_bit(access, &stp->st_deny_bmap);
 642 }
 643
 644 /* test whether a given stateid is denying specific access */
 645 static inline bool
 646 test_deny(u32 access, struct nfs4_ol_stateid *stp)
 647 {
 648         return test_bit(access, &stp->st_deny_bmap);
 649 }
 650
 651 static int nfs4_access_to_omode(u32 access)
 652 {
 653         switch (access & NFS4_SHARE_ACCESS_BOTH) {
 654         case NFS4_SHARE_ACCESS_READ:
 655                 return O_RDONLY;
 656         case NFS4_SHARE_ACCESS_WRITE:
 657                 return O_WRONLY;
 658         case NFS4_SHARE_ACCESS_BOTH:
 659                 return O_RDWR;
 660         }
 661         WARN_ON_ONCE(1);
 662         return O_RDONLY;
 663 }
 664
 665 /* release all access and file references for a given stateid */
 666 static void
 667 release_all_access(struct nfs4_ol_stateid *stp)
 668 {
 669         int i;
 670
 671         for (i = 1; i < 4; i++) {
 672                 if (test_access(i, stp))
 673                         nfs4_file_put_access(stp->st_file,
 674                                              nfs4_access_to_omode(i));
 675                 clear_access(i, stp);
 676         }
 677 }
 678
 679 static void unhash_generic_stateid(struct nfs4_ol_stateid *stp)
 680 {
 681         list_del(&stp->st_perfile);
 682         list_del(&stp->st_perstateowner);
 683 }
 684
 685 static void close_generic_stateid(struct nfs4_ol_stateid *stp)
 686 {
 687         release_all_access(stp);
 688         put_nfs4_file(stp->st_file);
 689         stp->st_file = NULL;
 690 }
 691
 692 static void free_generic_stateid(struct nfs4_ol_stateid *stp)
 693 {
 694         remove_stid(&stp->st_stid);
 695         nfs4_free_stid(stateid_slab, &stp->st_stid);
 696 }
 697
 698 static void __release_lock_stateid(struct nfs4_ol_stateid *stp)
 699 {
 700         struct file *file;
 701
 702         list_del(&stp->st_locks);
 703         unhash_generic_stateid(stp);
 704         unhash_stid(&stp->st_stid);
 705         file = find_any_file(stp->st_file);
 706         if (file)
 707                 locks_remove_posix(file, (fl_owner_t)lockowner(stp->st_stateowner));
 708         close_generic_stateid(stp);
 709         free_generic_stateid(stp);
 710 }
 711
 712 static void unhash_lockowner(struct nfs4_lockowner *lo)
 713 {
 714         struct nfs4_ol_stateid *stp;
 715
 716         list_del(&lo->lo_owner.so_strhash);
 717         while (!list_empty(&lo->lo_owner.so_stateids)) {
 718                 stp = list_first_entry(&lo->lo_owner.so_stateids,
 719                                 struct nfs4_ol_stateid, st_perstateowner);
 720                 __release_lock_stateid(stp);
 721         }
 722 }
 723
 724 static void nfs4_free_lockowner(struct nfs4_lockowner *lo)
 725 {
 726         kfree(lo->lo_owner.so_owner.data);
 727         kmem_cache_free(lockowner_slab, lo);
 728 }
 729
 730 static void release_lockowner(struct nfs4_lockowner *lo)
 731 {
 732         unhash_lockowner(lo);
 733         nfs4_free_lockowner(lo);
 734 }
 735
 736 static void release_lockowner_if_empty(struct nfs4_lockowner *lo)
 737 {
 738         if (list_empty(&lo->lo_owner.so_stateids))
 739                 release_lockowner(lo);
 740 }
 741
 742 static void release_lock_stateid(struct nfs4_ol_stateid *stp)
 743 {
 744         struct nfs4_lockowner *lo;
 745
 746         lo = lockowner(stp->st_stateowner);
 747         __release_lock_stateid(stp);
 748         release_lockowner_if_empty(lo);
 749 }
 750
 751 static void release_open_stateid_locks(struct nfs4_ol_stateid *open_stp)
 752 {
 753         struct nfs4_ol_stateid *stp;
 754
 755         while (!list_empty(&open_stp->st_locks)) {
 756                 stp = list_entry(open_stp->st_locks.next,
 757                                 struct nfs4_ol_stateid, st_locks);
 758                 release_lock_stateid(stp);
 759         }
 760 }
 761
 762 static void unhash_open_stateid(struct nfs4_ol_stateid *stp)
 763 {
 764         unhash_generic_stateid(stp);
 765         release_open_stateid_locks(stp);
 766         close_generic_stateid(stp);
 767 }
 768
 769 static void release_open_stateid(struct nfs4_ol_stateid *stp)
 770 {
 771         unhash_open_stateid(stp);
 772         free_generic_stateid(stp);
 773 }
 774
 775 static void unhash_openowner(struct nfs4_openowner *oo)
 776 {
 777         struct nfs4_ol_stateid *stp;
 778
 779         list_del(&oo->oo_owner.so_strhash);
 780         list_del(&oo->oo_perclient);
 781         while (!list_empty(&oo->oo_owner.so_stateids)) {
 782                 stp = list_first_entry(&oo->oo_owner.so_stateids,
 783                                 struct nfs4_ol_stateid, st_perstateowner);
 784                 release_open_stateid(stp);
 785         }
 786 }
 787
 788 static void release_last_closed_stateid(struct nfs4_openowner *oo)
 789 {
 790         struct nfs4_ol_stateid *s = oo->oo_last_closed_stid;
 791
 792         if (s) {
 793                 free_generic_stateid(s);
 794                 oo->oo_last_closed_stid = NULL;
 795         }
 796 }
 797
 798 static void nfs4_free_openowner(struct nfs4_openowner *oo)
 799 {
 800         kfree(oo->oo_owner.so_owner.data);
 801         kmem_cache_free(openowner_slab, oo);
 802 }
 803
 804 static void release_openowner(struct nfs4_openowner *oo)
 805 {
 806         unhash_openowner(oo);
 807         list_del(&oo->oo_close_lru);
 808         release_last_closed_stateid(oo);
 809         nfs4_free_openowner(oo);
 810 }
 811
 812 static inline int
 813 hash_sessionid(struct nfs4_sessionid *sessionid)
 814 {
 815         struct nfsd4_sessionid *sid = (struct nfsd4_sessionid *)sessionid;
 816
 817         return sid->sequence % SESSION_HASH_SIZE;
 818 }
 819
 820 #ifdef NFSD_DEBUG
 821 static inline void
 822 dump_sessionid(const char *fn, struct nfs4_sessionid *sessionid)
 823 {
 824         u32 *ptr = (u32 *)(&sessionid->data[0]);
 825         dprintk("%s: %u:%u:%u:%u\n", fn, ptr[0], ptr[1], ptr[2], ptr[3]);
 826 }
 827 #else
 828 static inline void
 829 dump_sessionid(const char *fn, struct nfs4_sessionid *sessionid)
 830 {
 831 }
 832 #endif
 833
 834 /*
 835  * Bump the seqid on cstate->replay_owner, and clear replay_owner if it
 836  * won't be used for replay.
 837  */
 838 void nfsd4_bump_seqid(struct nfsd4_compound_state *cstate, __be32 nfserr)
 839 {
 840         struct nfs4_stateowner *so = cstate->replay_owner;
 841
 842         if (nfserr == nfserr_replay_me)
 843                 return;
 844
 845         if (!seqid_mutating_err(ntohl(nfserr))) {
 846                 cstate->replay_owner = NULL;
 847                 return;
 848         }
 849         if (!so)
 850                 return;
 851         if (so->so_is_open_owner)
 852                 release_last_closed_stateid(openowner(so));
 853         so->so_seqid++;
 854         return;
 855 }
 856
 857 static void
 858 gen_sessionid(struct nfsd4_session *ses)
 859 {
 860         struct nfs4_client *clp = ses->se_client;
 861         struct nfsd4_sessionid *sid;
 862
 863         sid = (struct nfsd4_sessionid *)ses->se_sessionid.data;
 864         sid->clientid = clp->cl_clientid;
 865         sid->sequence = current_sessionid++;
 866         sid->reserved = 0;
 867 }
 868
 869 /*
 870  * The protocol defines ca_maxresponssize_cached to include the size of
 871  * the rpc header, but all we need to cache is the data starting after
 872  * the end of the initial SEQUENCE operation--the rest we regenerate
 873  * each time.  Therefore we can advertise a ca_maxresponssize_cached
 874  * value that is the number of bytes in our cache plus a few additional
 875  * bytes.  In order to stay on the safe side, and not promise more than
 876  * we can cache, those additional bytes must be the minimum possible: 24
 877  * bytes of rpc header (xid through accept state, with AUTH_NULL
 878  * verifier), 12 for the compound header (with zero-length tag), and 44
 879  * for the SEQUENCE op response:
 880  */
 881 #define NFSD_MIN_HDR_SEQ_SZ  (24 + 12 + 44)
 882
 883 static void
 884 free_session_slots(struct nfsd4_session *ses)
 885 {
 886         int i;
 887
 888         for (i = 0; i < ses->se_fchannel.maxreqs; i++)
 889                 kfree(ses->se_slots[i]);
 890 }
 891
 892 /*
 893  * We don't actually need to cache the rpc and session headers, so we
 894  * can allocate a little less for each slot:
 895  */
 896 static inline u32 slot_bytes(struct nfsd4_channel_attrs *ca)
 897 {
 898         u32 size;
 899
 900         if (ca->maxresp_cached < NFSD_MIN_HDR_SEQ_SZ)
 901                 size = 0;
 902         else
 903                 size = ca->maxresp_cached - NFSD_MIN_HDR_SEQ_SZ;
 904         return size + sizeof(struct nfsd4_slot);
 905 }
 906
 907 /*
 908  * XXX: If we run out of reserved DRC memory we could (up to a point)
 909  * re-negotiate active sessions and reduce their slot usage to make
 910  * room for new connections. For now we just fail the create session.
 911  */
 912 static u32 nfsd4_get_drc_mem(struct nfsd4_channel_attrs *ca)
 913 {
 914         u32 slotsize = slot_bytes(ca);
 915         u32 num = ca->maxreqs;
 916         int avail;
 917
 918         spin_lock(&nfsd_drc_lock);
 919         avail = min((unsigned long)NFSD_MAX_MEM_PER_SESSION,
 920                     nfsd_drc_max_mem - nfsd_drc_mem_used);
 921         num = min_t(int, num, avail / slotsize);
 922         nfsd_drc_mem_used += num * slotsize;
 923         spin_unlock(&nfsd_drc_lock);
 924
 925         return num;
 926 }
 927
 928 static void nfsd4_put_drc_mem(struct nfsd4_channel_attrs *ca)
 929 {
 930         int slotsize = slot_bytes(ca);
 931
 932         spin_lock(&nfsd_drc_lock);
 933         nfsd_drc_mem_used -= slotsize * ca->maxreqs;
 934         spin_unlock(&nfsd_drc_lock);
 935 }
 936
 937 static struct nfsd4_session *alloc_session(struct nfsd4_channel_attrs *fattrs,
 938                                            struct nfsd4_channel_attrs *battrs)
 939 {
 940         int numslots = fattrs->maxreqs;
 941         int slotsize = slot_bytes(fattrs);
 942         struct nfsd4_session *new;
 943         int mem, i;
 944
 945         BUILD_BUG_ON(NFSD_MAX_SLOTS_PER_SESSION * sizeof(struct nfsd4_slot *)
 946                         + sizeof(struct nfsd4_session) > PAGE_SIZE);
 947         mem = numslots * sizeof(struct nfsd4_slot *);
 948
 949         new = kzalloc(sizeof(*new) + mem, GFP_KERNEL);
 950         if (!new)
 951                 return NULL;
 952         /* allocate each struct nfsd4_slot and data cache in one piece */
 953         for (i = 0; i < numslots; i++) {
 954                 new->se_slots[i] = kzalloc(slotsize, GFP_KERNEL);
 955                 if (!new->se_slots[i])
 956                         goto out_free;
 957         }
 958
 959         memcpy(&new->se_fchannel, fattrs, sizeof(struct nfsd4_channel_attrs));
 960         memcpy(&new->se_bchannel, battrs, sizeof(struct nfsd4_channel_attrs));
 961
 962         return new;
 963 out_free:
 964         while (i--)
 965                 kfree(new->se_slots[i]);
 966         kfree(new);
 967         return NULL;
 968 }
 969
 970 static void free_conn(struct nfsd4_conn *c)
 971 {
 972         svc_xprt_put(c->cn_xprt);
 973         kfree(c);
 974 }
 975
 976 static void nfsd4_conn_lost(struct svc_xpt_user *u)
 977 {
 978         struct nfsd4_conn *c = container_of(u, struct nfsd4_conn, cn_xpt_user);
 979         struct nfs4_client *clp = c->cn_session->se_client;
 980
 981         spin_lock(&clp->cl_lock);
 982         if (!list_empty(&c->cn_persession)) {
 983                 list_del(&c->cn_persession);
 984                 free_conn(c);
 985         }
 986         nfsd4_probe_callback(clp);
 987         spin_unlock(&clp->cl_lock);
 988 }
 989
 990 static struct nfsd4_conn *alloc_conn(struct svc_rqst *rqstp, u32 flags)
 991 {
 992         struct nfsd4_conn *conn;
 993
 994         conn = kmalloc(sizeof(struct nfsd4_conn), GFP_KERNEL);
 995         if (!conn)
 996                 return NULL;
 997         svc_xprt_get(rqstp->rq_xprt);
 998         conn->cn_xprt = rqstp->rq_xprt;
 999         conn->cn_flags = flags;
1000         INIT_LIST_HEAD(&conn->cn_xpt_user.list);
1001         return conn;
1002 }
1003
1004 static void __nfsd4_hash_conn(struct nfsd4_conn *conn, struct nfsd4_session *ses)
1005 {
1006         conn->cn_session = ses;
1007         list_add(&conn->cn_persession, &ses->se_conns);
1008 }
1009
1010 static void nfsd4_hash_conn(struct nfsd4_conn *conn, struct nfsd4_session *ses)
1011 {
1012         struct nfs4_client *clp = ses->se_client;
1013
1014         spin_lock(&clp->cl_lock);
1015         __nfsd4_hash_conn(conn, ses);
1016         spin_unlock(&clp->cl_lock);
1017 }
1018
1019 static int nfsd4_register_conn(struct nfsd4_conn *conn)
1020 {
1021         conn->cn_xpt_user.callback = nfsd4_conn_lost;
1022         return register_xpt_user(conn->cn_xprt, &conn->cn_xpt_user);
1023 }
1024
1025 static void nfsd4_init_conn(struct svc_rqst *rqstp, struct nfsd4_conn *conn, struct nfsd4_session *ses)
1026 {
1027         int ret;
1028
1029         nfsd4_hash_conn(conn, ses);
1030         ret = nfsd4_register_conn(conn);
1031         if (ret)
1032                 /* oops; xprt is already down: */
1033                 nfsd4_conn_lost(&conn->cn_xpt_user);
1034         if (conn->cn_flags & NFS4_CDFC4_BACK) {
1035                 /* callback channel may be back up */
1036                 nfsd4_probe_callback(ses->se_client);
1037         }
1038 }
1039
1040 static struct nfsd4_conn *alloc_conn_from_crses(struct svc_rqst *rqstp, struct nfsd4_create_session *cses)
1041 {
1042         u32 dir = NFS4_CDFC4_FORE;
1043
1044         if (cses->flags & SESSION4_BACK_CHAN)
1045                 dir |= NFS4_CDFC4_BACK;
1046         return alloc_conn(rqstp, dir);
1047 }
1048
1049 /* must be called under client_lock */
1050 static void nfsd4_del_conns(struct nfsd4_session *s)
1051 {
1052         struct nfs4_client *clp = s->se_client;
1053         struct nfsd4_conn *c;
1054
1055         spin_lock(&clp->cl_lock);
1056         while (!list_empty(&s->se_conns)) {
1057                 c = list_first_entry(&s->se_conns, struct nfsd4_conn, cn_persession);
1058                 list_del_init(&c->cn_persession);
1059                 spin_unlock(&clp->cl_lock);
1060
1061                 unregister_xpt_user(c->cn_xprt, &c->cn_xpt_user);
1062                 free_conn(c);
1063
1064                 spin_lock(&clp->cl_lock);
1065         }
1066         spin_unlock(&clp->cl_lock);
1067 }
1068
1069 static void __free_session(struct nfsd4_session *ses)
1070 {
1071         free_session_slots(ses);
1072         kfree(ses);
1073 }
1074
1075 static void free_session(struct nfsd4_session *ses)
1076 {
1077         struct nfsd_net *nn = net_generic(ses->se_client->net, nfsd_net_id);
1078
1079         lockdep_assert_held(&nn->client_lock);
1080         nfsd4_del_conns(ses);
1081         nfsd4_put_drc_mem(&ses->se_fchannel);
1082         __free_session(ses);
1083 }
1084
1085 static void init_session(struct svc_rqst *rqstp, struct nfsd4_session *new, struct nfs4_client *clp, struct nfsd4_create_session *cses)
1086 {
1087         int idx;
1088         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
1089
1090         new->se_client = clp;
1091         gen_sessionid(new);
1092
1093         INIT_LIST_HEAD(&new->se_conns);
1094
1095         new->se_cb_seq_nr = 1;
1096         new->se_flags = cses->flags;
1097         new->se_cb_prog = cses->callback_prog;
1098         new->se_cb_sec = cses->cb_sec;
1099         atomic_set(&new->se_ref, 0);
1100         idx = hash_sessionid(&new->se_sessionid);
1101         spin_lock(&nn->client_lock);
1102         list_add(&new->se_hash, &nn->sessionid_hashtbl[idx]);
1103         spin_lock(&clp->cl_lock);
1104         list_add(&new->se_perclnt, &clp->cl_sessions);
1105         spin_unlock(&clp->cl_lock);
1106         spin_unlock(&nn->client_lock);
1107
1108         if (cses->flags & SESSION4_BACK_CHAN) {
1109                 struct sockaddr *sa = svc_addr(rqstp);
1110                 /*
1111                  * This is a little silly; with sessions there's no real
1112                  * use for the callback address.  Use the peer address
1113                  * as a reasonable default for now, but consider fixing
1114                  * the rpc client not to require an address in the
1115                  * future:
1116                  */
1117                 rpc_copy_addr((struct sockaddr *)&clp->cl_cb_conn.cb_addr, sa);
1118                 clp->cl_cb_conn.cb_addrlen = svc_addr_len(sa);
1119         }
1120 }
1121
1122 /* caller must hold client_lock */
1123 static struct nfsd4_session *
1124 find_in_sessionid_hashtbl(struct nfs4_sessionid *sessionid, struct net *net)
1125 {
1126         struct nfsd4_session *elem;
1127         int idx;
1128         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
1129
1130         dump_sessionid(__func__, sessionid);
1131         idx = hash_sessionid(sessionid);
1132         /* Search in the appropriate list */
1133         list_for_each_entry(elem, &nn->sessionid_hashtbl[idx], se_hash) {
1134                 if (!memcmp(elem->se_sessionid.data, sessionid->data,
1135                             NFS4_MAX_SESSIONID_LEN)) {
1136                         return elem;
1137                 }
1138         }
1139
1140         dprintk("%s: session not found\n", __func__);
1141         return NULL;
1142 }
1143
1144 /* caller must hold client_lock */
1145 static void
1146 unhash_session(struct nfsd4_session *ses)
1147 {
1148         list_del(&ses->se_hash);
1149         spin_lock(&ses->se_client->cl_lock);
1150         list_del(&ses->se_perclnt);
1151         spin_unlock(&ses->se_client->cl_lock);
1152 }
1153
1154 /* SETCLIENTID and SETCLIENTID_CONFIRM Helper functions */
1155 static int
1156 STALE_CLIENTID(clientid_t *clid, struct nfsd_net *nn)
1157 {
1158         if (clid->cl_boot == nn->boot_time)
1159                 return 0;
1160         dprintk("NFSD stale clientid (%08x/%08x) boot_time %08lx\n",
1161                 clid->cl_boot, clid->cl_id, nn->boot_time);
1162         return 1;
1163 }
1164
1165 /*
1166  * XXX Should we use a slab cache ?
1167  * This type of memory management is somewhat inefficient, but we use it
1168  * anyway since SETCLIENTID is not a common operation.
1169  */
1170 static struct nfs4_client *alloc_client(struct xdr_netobj name)
1171 {
1172         struct nfs4_client *clp;
1173
1174         clp = kzalloc(sizeof(struct nfs4_client), GFP_KERNEL);
1175         if (clp == NULL)
1176                 return NULL;
1177         clp->cl_name.data = kmemdup(name.data, name.len, GFP_KERNEL);
1178         if (clp->cl_name.data == NULL) {
1179                 kfree(clp);
1180                 return NULL;
1181         }
1182         clp->cl_name.len = name.len;
1183         INIT_LIST_HEAD(&clp->cl_sessions);
1184         idr_init(&clp->cl_stateids);
1185         atomic_set(&clp->cl_refcount, 0);
1186         clp->cl_cb_state = NFSD4_CB_UNKNOWN;
1187         INIT_LIST_HEAD(&clp->cl_idhash);
1188         INIT_LIST_HEAD(&clp->cl_openowners);
1189         INIT_LIST_HEAD(&clp->cl_delegations);
1190         INIT_LIST_HEAD(&clp->cl_lru);
1191         INIT_LIST_HEAD(&clp->cl_callbacks);
1192         INIT_LIST_HEAD(&clp->cl_revoked);
1193         spin_lock_init(&clp->cl_lock);
1194         rpc_init_wait_queue(&clp->cl_cb_waitq, "Backchannel slot table");
1195         return clp;
1196 }
1197
1198 static void
1199 free_client(struct nfs4_client *clp)
1200 {
1201         struct nfsd_net __maybe_unused *nn = net_generic(clp->net, nfsd_net_id);
1202
1203         lockdep_assert_held(&nn->client_lock);
1204         while (!list_empty(&clp->cl_sessions)) {
1205                 struct nfsd4_session *ses;
1206                 ses = list_entry(clp->cl_sessions.next, struct nfsd4_session,
1207                                 se_perclnt);
1208                 list_del(&ses->se_perclnt);
1209                 WARN_ON_ONCE(atomic_read(&ses->se_ref));
1210                 free_session(ses);
1211         }
1212         rpc_destroy_wait_queue(&clp->cl_cb_waitq);
1213         free_svc_cred(&clp->cl_cred);
1214         kfree(clp->cl_name.data);
1215         idr_destroy(&clp->cl_stateids);
1216         kfree(clp);
1217 }
1218
1219 /* must be called under the client_lock */
1220 static inline void
1221 unhash_client_locked(struct nfs4_client *clp)
1222 {
1223         struct nfsd4_session *ses;
1224
1225         list_del(&clp->cl_lru);
1226         spin_lock(&clp->cl_lock);
1227         list_for_each_entry(ses, &clp->cl_sessions, se_perclnt)
1228                 list_del_init(&ses->se_hash);
1229         spin_unlock(&clp->cl_lock);
1230 }
1231
1232 static void
1233 destroy_client(struct nfs4_client *clp)
1234 {
1235         struct nfs4_openowner *oo;
1236         struct nfs4_delegation *dp;
1237         struct list_head reaplist;
1238         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
1239
1240         INIT_LIST_HEAD(&reaplist);
1241         spin_lock(&state_lock);
1242         while (!list_empty(&clp->cl_delegations)) {
1243                 dp = list_entry(clp->cl_delegations.next, struct nfs4_delegation, dl_perclnt);
1244                 list_del_init(&dp->dl_perclnt);
1245                 list_move(&dp->dl_recall_lru, &reaplist);
1246         }
1247         spin_unlock(&state_lock);
1248         while (!list_empty(&reaplist)) {
1249                 dp = list_entry(reaplist.next, struct nfs4_delegation, dl_recall_lru);
1250                 destroy_delegation(dp);
1251         }
1252         list_splice_init(&clp->cl_revoked, &reaplist);
1253         while (!list_empty(&reaplist)) {
1254                 dp = list_entry(reaplist.next, struct nfs4_delegation, dl_recall_lru);
1255                 destroy_revoked_delegation(dp);
1256         }
1257         while (!list_empty(&clp->cl_openowners)) {
1258                 oo = list_entry(clp->cl_openowners.next, struct nfs4_openowner, oo_perclient);
1259                 release_openowner(oo);
1260         }
1261         nfsd4_shutdown_callback(clp);
1262         if (clp->cl_cb_conn.cb_xprt)
1263                 svc_xprt_put(clp->cl_cb_conn.cb_xprt);
1264         list_del(&clp->cl_idhash);
1265         if (test_bit(NFSD4_CLIENT_CONFIRMED, &clp->cl_flags))
1266                 rb_erase(&clp->cl_namenode, &nn->conf_name_tree);
1267         else
1268                 rb_erase(&clp->cl_namenode, &nn->unconf_name_tree);
1269         spin_lock(&nn->client_lock);
1270         unhash_client_locked(clp);
1271         WARN_ON_ONCE(atomic_read(&clp->cl_refcount));
1272         free_client(clp);
1273         spin_unlock(&nn->client_lock);
1274 }
1275
1276 static void expire_client(struct nfs4_client *clp)
1277 {
1278         nfsd4_client_record_remove(clp);
1279         destroy_client(clp);
1280 }
1281
1282 static void copy_verf(struct nfs4_client *target, nfs4_verifier *source)
1283 {
1284         memcpy(target->cl_verifier.data, source->data,
1285                         sizeof(target->cl_verifier.data));
1286 }
1287
1288 static void copy_clid(struct nfs4_client *target, struct nfs4_client *source)
1289 {
1290         target->cl_clientid.cl_boot = source->cl_clientid.cl_boot;
1291         target->cl_clientid.cl_id = source->cl_clientid.cl_id;
1292 }
1293
1294 static int copy_cred(struct svc_cred *target, struct svc_cred *source)
1295 {
1296         if (source->cr_principal) {
1297                 target->cr_principal =
1298                                 kstrdup(source->cr_principal, GFP_KERNEL);
1299                 if (target->cr_principal == NULL)
1300                         return -ENOMEM;
1301         } else
1302                 target->cr_principal = NULL;
1303         target->cr_flavor = source->cr_flavor;
1304         target->cr_uid = source->cr_uid;
1305         target->cr_gid = source->cr_gid;
1306         target->cr_group_info = source->cr_group_info;
1307         get_group_info(target->cr_group_info);
1308         target->cr_gss_mech = source->cr_gss_mech;
1309         if (source->cr_gss_mech)
1310                 gss_mech_get(source->cr_gss_mech);
1311         return 0;
1312 }
1313
1314 static long long
1315 compare_blob(const struct xdr_netobj *o1, const struct xdr_netobj *o2)
1316 {
1317         long long res;
1318
1319         res = o1->len - o2->len;
1320         if (res)
1321                 return res;
1322         return (long long)memcmp(o1->data, o2->data, o1->len);
1323 }
1324
1325 static int same_name(const char *n1, const char *n2)
1326 {
1327         return 0 == memcmp(n1, n2, HEXDIR_LEN);
1328 }
1329
1330 static int
1331 same_verf(nfs4_verifier *v1, nfs4_verifier *v2)
1332 {
1333         return 0 == memcmp(v1->data, v2->data, sizeof(v1->data));
1334 }
1335
1336 static int
1337 same_clid(clientid_t *cl1, clientid_t *cl2)
1338 {
1339         return (cl1->cl_boot == cl2->cl_boot) && (cl1->cl_id == cl2->cl_id);
1340 }
1341
1342 static bool groups_equal(struct group_info *g1, struct group_info *g2)
1343 {
1344         int i;
1345
1346         if (g1->ngroups != g2->ngroups)
1347                 return false;
1348         for (i=0; i<g1->ngroups; i++)
1349                 if (!gid_eq(GROUP_AT(g1, i), GROUP_AT(g2, i)))
1350                         return false;
1351         return true;
1352 }
1353
1354 /*
1355  * RFC 3530 language requires clid_inuse be returned when the
1356  * "principal" associated with a requests differs from that previously
1357  * used.  We use uid, gid's, and gss principal string as our best
1358  * approximation.  We also don't want to allow non-gss use of a client
1359  * established using gss: in theory cr_principal should catch that
1360  * change, but in practice cr_principal can be null even in the gss case
1361  * since gssd doesn't always pass down a principal string.
1362  */
1363 static bool is_gss_cred(struct svc_cred *cr)
1364 {
1365         /* Is cr_flavor one of the gss "pseudoflavors"?: */
1366         return (cr->cr_flavor > RPC_AUTH_MAXFLAVOR);
1367 }
1368
1369
1370 static bool
1371 same_creds(struct svc_cred *cr1, struct svc_cred *cr2)
1372 {
1373         if ((is_gss_cred(cr1) != is_gss_cred(cr2))
1374                 || (!uid_eq(cr1->cr_uid, cr2->cr_uid))
1375                 || (!gid_eq(cr1->cr_gid, cr2->cr_gid))
1376                 || !groups_equal(cr1->cr_group_info, cr2->cr_group_info))
1377                 return false;
1378         if (cr1->cr_principal == cr2->cr_principal)
1379                 return true;
1380         if (!cr1->cr_principal || !cr2->cr_principal)
1381                 return false;
1382         return 0 == strcmp(cr1->cr_principal, cr2->cr_principal);
1383 }
1384
1385 static bool svc_rqst_integrity_protected(struct svc_rqst *rqstp)
1386 {
1387         struct svc_cred *cr = &rqstp->rq_cred;
1388         u32 service;
1389
1390         if (!cr->cr_gss_mech)
1391                 return false;
1392         service = gss_pseudoflavor_to_service(cr->cr_gss_mech, cr->cr_flavor);
1393         return service == RPC_GSS_SVC_INTEGRITY ||
1394                service == RPC_GSS_SVC_PRIVACY;
1395 }
1396
1397 static bool mach_creds_match(struct nfs4_client *cl, struct svc_rqst *rqstp)
1398 {
1399         struct svc_cred *cr = &rqstp->rq_cred;
1400
1401         if (!cl->cl_mach_cred)
1402                 return true;
1403         if (cl->cl_cred.cr_gss_mech != cr->cr_gss_mech)
1404                 return false;
1405         if (!svc_rqst_integrity_protected(rqstp))
1406                 return false;
1407         if (!cr->cr_principal)
1408                 return false;
1409         return 0 == strcmp(cl->cl_cred.cr_principal, cr->cr_principal);
1410 }
1411
1412 static void gen_clid(struct nfs4_client *clp, struct nfsd_net *nn)
1413 {
1414         static u32 current_clientid = 1;
1415
1416         clp->cl_clientid.cl_boot = nn->boot_time;
1417         clp->cl_clientid.cl_id = current_clientid++;
1418 }
1419
1420 static void gen_confirm(struct nfs4_client *clp)
1421 {
1422         __be32 verf[2];
1423         static u32 i;
1424
1425         /*
1426          * This is opaque to client, so no need to byte-swap. Use
1427          * __force to keep sparse happy
1428          */
1429         verf[0] = (__force __be32)get_seconds();
1430         verf[1] = (__force __be32)i++;
1431         memcpy(clp->cl_confirm.data, verf, sizeof(clp->cl_confirm.data));
1432 }
1433
1434 static struct nfs4_stid *find_stateid(struct nfs4_client *cl, stateid_t *t)
1435 {
1436         struct nfs4_stid *ret;
1437
1438         ret = idr_find(&cl->cl_stateids, t->si_opaque.so_id);
1439         if (!ret || !ret->sc_type)
1440                 return NULL;
1441         return ret;
1442 }
1443
1444 static struct nfs4_stid *find_stateid_by_type(struct nfs4_client *cl, stateid_t *t, char typemask)
1445 {
1446         struct nfs4_stid *s;
1447
1448         s = find_stateid(cl, t);
1449         if (!s)
1450                 return NULL;
1451         if (typemask & s->sc_type)
1452                 return s;
1453         return NULL;
1454 }
1455
1456 static struct nfs4_client *create_client(struct xdr_netobj name,
1457                 struct svc_rqst *rqstp, nfs4_verifier *verf)
1458 {
1459         struct nfs4_client *clp;
1460         struct sockaddr *sa = svc_addr(rqstp);
1461         int ret;
1462         struct net *net = SVC_NET(rqstp);
1463         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
1464
1465         clp = alloc_client(name);
1466         if (clp == NULL)
1467                 return NULL;
1468
1469         ret = copy_cred(&clp->cl_cred, &rqstp->rq_cred);
1470         if (ret) {
1471                 spin_lock(&nn->client_lock);
1472                 free_client(clp);
1473                 spin_unlock(&nn->client_lock);
1474                 return NULL;
1475         }
1476         nfsd4_init_callback(&clp->cl_cb_null);
1477         clp->cl_time = get_seconds();
1478         clear_bit(0, &clp->cl_cb_slot_busy);
1479         copy_verf(clp, verf);
1480         rpc_copy_addr((struct sockaddr *) &clp->cl_addr, sa);
1481         gen_confirm(clp);
1482         clp->cl_cb_session = NULL;
1483         clp->net = net;
1484         return clp;
1485 }
1486
1487 static void
1488 add_clp_to_name_tree(struct nfs4_client *new_clp, struct rb_root *root)
1489 {
1490         struct rb_node **new = &(root->rb_node), *parent = NULL;
1491         struct nfs4_client *clp;
1492
1493         while (*new) {
1494                 clp = rb_entry(*new, struct nfs4_client, cl_namenode);
1495                 parent = *new;
1496
1497                 if (compare_blob(&clp->cl_name, &new_clp->cl_name) > 0)
1498                         new = &((*new)->rb_left);
1499                 else
1500                         new = &((*new)->rb_right);
1501         }
1502
1503         rb_link_node(&new_clp->cl_namenode, parent, new);
1504         rb_insert_color(&new_clp->cl_namenode, root);
1505 }
1506
1507 static struct nfs4_client *
1508 find_clp_in_name_tree(struct xdr_netobj *name, struct rb_root *root)
1509 {
1510         long long cmp;
1511         struct rb_node *node = root->rb_node;
1512         struct nfs4_client *clp;
1513
1514         while (node) {
1515                 clp = rb_entry(node, struct nfs4_client, cl_namenode);
1516                 cmp = compare_blob(&clp->cl_name, name);
1517                 if (cmp > 0)
1518                         node = node->rb_left;
1519                 else if (cmp < 0)
1520                         node = node->rb_right;
1521                 else
1522                         return clp;
1523         }
1524         return NULL;
1525 }
1526
1527 static void
1528 add_to_unconfirmed(struct nfs4_client *clp)
1529 {
1530         unsigned int idhashval;
1531         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
1532
1533         clear_bit(NFSD4_CLIENT_CONFIRMED, &clp->cl_flags);
1534         add_clp_to_name_tree(clp, &nn->unconf_name_tree);
1535         idhashval = clientid_hashval(clp->cl_clientid.cl_id);
1536         list_add(&clp->cl_idhash, &nn->unconf_id_hashtbl[idhashval]);
1537         renew_client(clp);
1538 }
1539
1540 static void
1541 move_to_confirmed(struct nfs4_client *clp)
1542 {
1543         unsigned int idhashval = clientid_hashval(clp->cl_clientid.cl_id);
1544         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
1545
1546         dprintk("NFSD: move_to_confirm nfs4_client %p\n", clp);
1547         list_move(&clp->cl_idhash, &nn->conf_id_hashtbl[idhashval]);
1548         rb_erase(&clp->cl_namenode, &nn->unconf_name_tree);
1549         add_clp_to_name_tree(clp, &nn->conf_name_tree);
1550         set_bit(NFSD4_CLIENT_CONFIRMED, &clp->cl_flags);
1551         renew_client(clp);
1552 }
1553
1554 static struct nfs4_client *
1555 find_client_in_id_table(struct list_head *tbl, clientid_t *clid, bool sessions)
1556 {
1557         struct nfs4_client *clp;
1558         unsigned int idhashval = clientid_hashval(clid->cl_id);
1559
1560         list_for_each_entry(clp, &tbl[idhashval], cl_idhash) {
1561                 if (same_clid(&clp->cl_clientid, clid)) {
1562                         if ((bool)clp->cl_minorversion != sessions)
1563                                 return NULL;
1564                         renew_client(clp);
1565                         return clp;
1566                 }
1567         }
1568         return NULL;
1569 }
1570
1571 static struct nfs4_client *
1572 find_confirmed_client(clientid_t *clid, bool sessions, struct nfsd_net *nn)
1573 {
1574         struct list_head *tbl = nn->conf_id_hashtbl;
1575
1576         return find_client_in_id_table(tbl, clid, sessions);
1577 }
1578
1579 static struct nfs4_client *
1580 find_unconfirmed_client(clientid_t *clid, bool sessions, struct nfsd_net *nn)
1581 {
1582         struct list_head *tbl = nn->unconf_id_hashtbl;
1583
1584         return find_client_in_id_table(tbl, clid, sessions);
1585 }
1586
1587 static bool clp_used_exchangeid(struct nfs4_client *clp)
1588 {
1589         return clp->cl_exchange_flags != 0;
1590 }
1591
1592 static struct nfs4_client *
1593 find_confirmed_client_by_name(struct xdr_netobj *name, struct nfsd_net *nn)
1594 {
1595         return find_clp_in_name_tree(name, &nn->conf_name_tree);
1596 }
1597
1598 static struct nfs4_client *
1599 find_unconfirmed_client_by_name(struct xdr_netobj *name, struct nfsd_net *nn)
1600 {
1601         return find_clp_in_name_tree(name, &nn->unconf_name_tree);
1602 }
1603
1604 static void
1605 gen_callback(struct nfs4_client *clp, struct nfsd4_setclientid *se, struct svc_rqst *rqstp)
1606 {
1607         struct nfs4_cb_conn *conn = &clp->cl_cb_conn;
1608         struct sockaddr *sa = svc_addr(rqstp);
1609         u32 scopeid = rpc_get_scope_id(sa);
1610         unsigned short expected_family;
1611
1612         /* Currently, we only support tcp and tcp6 for the callback channel */
1613         if (se->se_callback_netid_len == 3 &&
1614             !memcmp(se->se_callback_netid_val, "tcp", 3))
1615                 expected_family = AF_INET;
1616         else if (se->se_callback_netid_len == 4 &&
1617                  !memcmp(se->se_callback_netid_val, "tcp6", 4))
1618                 expected_family = AF_INET6;
1619         else
1620                 goto out_err;
1621
1622         conn->cb_addrlen = rpc_uaddr2sockaddr(clp->net, se->se_callback_addr_val,
1623                                             se->se_callback_addr_len,
1624                                             (struct sockaddr *)&conn->cb_addr,
1625                                             sizeof(conn->cb_addr));
1626
1627         if (!conn->cb_addrlen || conn->cb_addr.ss_family != expected_family)
1628                 goto out_err;
1629
1630         if (conn->cb_addr.ss_family == AF_INET6)
1631                 ((struct sockaddr_in6 *)&conn->cb_addr)->sin6_scope_id = scopeid;
1632
1633         conn->cb_prog = se->se_callback_prog;
1634         conn->cb_ident = se->se_callback_ident;
1635         memcpy(&conn->cb_saddr, &rqstp->rq_daddr, rqstp->rq_daddrlen);
1636         return;
1637 out_err:
1638         conn->cb_addr.ss_family = AF_UNSPEC;
1639         conn->cb_addrlen = 0;
1640         dprintk(KERN_INFO "NFSD: this client (clientid %08x/%08x) "
1641                 "will not receive delegations\n",
1642                 clp->cl_clientid.cl_boot, clp->cl_clientid.cl_id);
1643
1644         return;
1645 }
1646
1647 /*
1648  * Cache a reply. nfsd4_check_resp_size() has bounded the cache size.
1649  */
1650 static void
1651 nfsd4_store_cache_entry(struct nfsd4_compoundres *resp)
1652 {
1653         struct xdr_buf *buf = resp->xdr.buf;
1654         struct nfsd4_slot *slot = resp->cstate.slot;
1655         unsigned int base;
1656
1657         dprintk("--> %s slot %p\n", __func__, slot);
1658
1659         slot->sl_opcnt = resp->opcnt;
1660         slot->sl_status = resp->cstate.status;
1661
1662         slot->sl_flags |= NFSD4_SLOT_INITIALIZED;
1663         if (nfsd4_not_cached(resp)) {
1664                 slot->sl_datalen = 0;
1665                 return;
1666         }
1667         base = resp->cstate.data_offset;
1668         slot->sl_datalen = buf->len - base;
1669         if (read_bytes_from_xdr_buf(buf, base, slot->sl_data, slot->sl_datalen))
1670                 WARN("%s: sessions DRC could not cache compound\n", __func__);
1671         return;
1672 }
1673
1674 /*
1675  * Encode the replay sequence operation from the slot values.
1676  * If cachethis is FALSE encode the uncached rep error on the next
1677  * operation which sets resp->p and increments resp->opcnt for
1678  * nfs4svc_encode_compoundres.
1679  *
1680  */
1681 static __be32
1682 nfsd4_enc_sequence_replay(struct nfsd4_compoundargs *args,
1683                           struct nfsd4_compoundres *resp)
1684 {
1685         struct nfsd4_op *op;
1686         struct nfsd4_slot *slot = resp->cstate.slot;
1687
1688         /* Encode the replayed sequence operation */
1689         op = &args->ops[resp->opcnt - 1];
1690         nfsd4_encode_operation(resp, op);
1691
1692         /* Return nfserr_retry_uncached_rep in next operation. */
1693         if (args->opcnt > 1 && !(slot->sl_flags & NFSD4_SLOT_CACHETHIS)) {
1694                 op = &args->ops[resp->opcnt++];
1695                 op->status = nfserr_retry_uncached_rep;
1696                 nfsd4_encode_operation(resp, op);
1697         }
1698         return op->status;
1699 }
1700
1701 /*
1702  * The sequence operation is not cached because we can use the slot and
1703  * session values.
1704  */
1705 static __be32
1706 nfsd4_replay_cache_entry(struct nfsd4_compoundres *resp,
1707                          struct nfsd4_sequence *seq)
1708 {
1709         struct nfsd4_slot *slot = resp->cstate.slot;
1710         struct xdr_stream *xdr = &resp->xdr;
1711         __be32 *p;
1712         __be32 status;
1713
1714         dprintk("--> %s slot %p\n", __func__, slot);
1715
1716         status = nfsd4_enc_sequence_replay(resp->rqstp->rq_argp, resp);
1717         if (status)
1718                 return status;
1719
1720         p = xdr_reserve_space(xdr, slot->sl_datalen);
1721         if (!p) {
1722                 WARN_ON_ONCE(1);
1723                 return nfserr_serverfault;
1724         }
1725         xdr_encode_opaque_fixed(p, slot->sl_data, slot->sl_datalen);
1726         xdr_commit_encode(xdr);
1727
1728         resp->opcnt = slot->sl_opcnt;
1729         return slot->sl_status;
1730 }
1731
1732 /*
1733  * Set the exchange_id flags returned by the server.
1734  */
1735 static void
1736 nfsd4_set_ex_flags(struct nfs4_client *new, struct nfsd4_exchange_id *clid)
1737 {
1738         /* pNFS is not supported */
1739         new->cl_exchange_flags |= EXCHGID4_FLAG_USE_NON_PNFS;
1740
1741         /* Referrals are supported, Migration is not. */
1742         new->cl_exchange_flags |= EXCHGID4_FLAG_SUPP_MOVED_REFER;
1743
1744         /* set the wire flags to return to client. */
1745         clid->flags = new->cl_exchange_flags;
1746 }
1747
1748 static bool client_has_state(struct nfs4_client *clp)
1749 {
1750         /*
1751          * Note clp->cl_openowners check isn't quite right: there's no
1752          * need to count owners without stateid's.
1753          *
1754          * Also note we should probably be using this in 4.0 case too.
1755          */
1756         return !list_empty(&clp->cl_openowners)
1757                 || !list_empty(&clp->cl_delegations)
1758                 || !list_empty(&clp->cl_sessions);
1759 }
1760
1761 __be32
1762 nfsd4_exchange_id(struct svc_rqst *rqstp,
1763                   struct nfsd4_compound_state *cstate,
1764                   struct nfsd4_exchange_id *exid)
1765 {
1766         struct nfs4_client *unconf, *conf, *new;
1767         __be32 status;
1768         char                    addr_str[INET6_ADDRSTRLEN];
1769         nfs4_verifier           verf = exid->verifier;
1770         struct sockaddr         *sa = svc_addr(rqstp);
1771         bool    update = exid->flags & EXCHGID4_FLAG_UPD_CONFIRMED_REC_A;
1772         struct nfsd_net         *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
1773
1774         rpc_ntop(sa, addr_str, sizeof(addr_str));
1775         dprintk("%s rqstp=%p exid=%p clname.len=%u clname.data=%p "
1776                 "ip_addr=%s flags %x, spa_how %d\n",
1777                 __func__, rqstp, exid, exid->clname.len, exid->clname.data,
1778                 addr_str, exid->flags, exid->spa_how);
1779
1780         if (exid->flags & ~EXCHGID4_FLAG_MASK_A)
1781                 return nfserr_inval;
1782
1783         switch (exid->spa_how) {
1784         case SP4_MACH_CRED:
1785                 if (!svc_rqst_integrity_protected(rqstp))
1786                         return nfserr_inval;
1787         case SP4_NONE:
1788                 break;
1789         default:                                /* checked by xdr code */
1790                 WARN_ON_ONCE(1);
1791         case SP4_SSV:
1792                 return nfserr_encr_alg_unsupp;
1793         }
1794
1795         /* Cases below refer to rfc 5661 section 18.35.4: */
1796         nfs4_lock_state();
1797         conf = find_confirmed_client_by_name(&exid->clname, nn);
1798         if (conf) {
1799                 bool creds_match = same_creds(&conf->cl_cred, &rqstp->rq_cred);
1800                 bool verfs_match = same_verf(&verf, &conf->cl_verifier);
1801
1802                 if (update) {
1803                         if (!clp_used_exchangeid(conf)) { /* buggy client */
1804                                 status = nfserr_inval;
1805                                 goto out;
1806                         }
1807                         if (!mach_creds_match(conf, rqstp)) {
1808                                 status = nfserr_wrong_cred;
1809                                 goto out;
1810                         }
1811                         if (!creds_match) { /* case 9 */
1812                                 status = nfserr_perm;
1813                                 goto out;
1814                         }
1815                         if (!verfs_match) { /* case 8 */
1816                                 status = nfserr_not_same;
1817                                 goto out;
1818                         }
1819                         /* case 6 */
1820                         exid->flags |= EXCHGID4_FLAG_CONFIRMED_R;
1821                         new = conf;
1822                         goto out_copy;
1823                 }
1824                 if (!creds_match) { /* case 3 */
1825                         if (client_has_state(conf)) {
1826                                 status = nfserr_clid_inuse;
1827                                 goto out;
1828                         }
1829                         expire_client(conf);
1830                         goto out_new;
1831                 }
1832                 if (verfs_match) { /* case 2 */
1833                         conf->cl_exchange_flags |= EXCHGID4_FLAG_CONFIRMED_R;
1834                         new = conf;
1835                         goto out_copy;
1836                 }
1837                 /* case 5, client reboot */
1838                 goto out_new;
1839         }
1840
1841         if (update) { /* case 7 */
1842                 status = nfserr_noent;
1843                 goto out;
1844         }
1845
1846         unconf  = find_unconfirmed_client_by_name(&exid->clname, nn);
1847         if (unconf) /* case 4, possible retry or client restart */
1848                 expire_client(unconf);
1849
1850         /* case 1 (normal case) */
1851 out_new:
1852         new = create_client(exid->clname, rqstp, &verf);
1853         if (new == NULL) {
1854                 status = nfserr_jukebox;
1855                 goto out;
1856         }
1857         new->cl_minorversion = cstate->minorversion;
1858         new->cl_mach_cred = (exid->spa_how == SP4_MACH_CRED);
1859
1860         gen_clid(new, nn);
1861         add_to_unconfirmed(new);
1862 out_copy:
1863         exid->clientid.cl_boot = new->cl_clientid.cl_boot;
1864         exid->clientid.cl_id = new->cl_clientid.cl_id;
1865
1866         exid->seqid = new->cl_cs_slot.sl_seqid + 1;
1867         nfsd4_set_ex_flags(new, exid);
1868
1869         dprintk("nfsd4_exchange_id seqid %d flags %x\n",
1870                 new->cl_cs_slot.sl_seqid, new->cl_exchange_flags);
1871         status = nfs_ok;
1872
1873 out:
1874         nfs4_unlock_state();
1875         return status;
1876 }
1877
1878 static __be32
1879 check_slot_seqid(u32 seqid, u32 slot_seqid, int slot_inuse)
1880 {
1881         dprintk("%s enter. seqid %d slot_seqid %d\n", __func__, seqid,
1882                 slot_seqid);
1883
1884         /* The slot is in use, and no response has been sent. */
1885         if (slot_inuse) {
1886                 if (seqid == slot_seqid)
1887                         return nfserr_jukebox;
1888                 else
1889                         return nfserr_seq_misordered;
1890         }
1891         /* Note unsigned 32-bit arithmetic handles wraparound: */
1892         if (likely(seqid == slot_seqid + 1))
1893                 return nfs_ok;
1894         if (seqid == slot_seqid)
1895                 return nfserr_replay_cache;
1896         return nfserr_seq_misordered;
1897 }
1898
1899 /*
1900  * Cache the create session result into the create session single DRC
1901  * slot cache by saving the xdr structure. sl_seqid has been set.
1902  * Do this for solo or embedded create session operations.
1903  */
1904 static void
1905 nfsd4_cache_create_session(struct nfsd4_create_session *cr_ses,
1906                            struct nfsd4_clid_slot *slot, __be32 nfserr)
1907 {
1908         slot->sl_status = nfserr;
1909         memcpy(&slot->sl_cr_ses, cr_ses, sizeof(*cr_ses));
1910 }
1911
1912 static __be32
1913 nfsd4_replay_create_session(struct nfsd4_create_session *cr_ses,
1914                             struct nfsd4_clid_slot *slot)
1915 {
1916         memcpy(cr_ses, &slot->sl_cr_ses, sizeof(*cr_ses));
1917         return slot->sl_status;
1918 }
1919
1920 #define NFSD_MIN_REQ_HDR_SEQ_SZ ((\
1921                         2 * 2 + /* credential,verifier: AUTH_NULL, length 0 */ \
1922                         1 +     /* MIN tag is length with zero, only length */ \
1923                         3 +     /* version, opcount, opcode */ \
1924                         XDR_QUADLEN(NFS4_MAX_SESSIONID_LEN) + \
1925                                 /* seqid, slotID, slotID, cache */ \
1926                         4 ) * sizeof(__be32))
1927
1928 #define NFSD_MIN_RESP_HDR_SEQ_SZ ((\
1929                         2 +     /* verifier: AUTH_NULL, length 0 */\
1930                         1 +     /* status */ \
1931                         1 +     /* MIN tag is length with zero, only length */ \
1932                         3 +     /* opcount, opcode, opstatus*/ \
1933                         XDR_QUADLEN(NFS4_MAX_SESSIONID_LEN) + \
1934                                 /* seqid, slotID, slotID, slotID, status */ \
1935                         5 ) * sizeof(__be32))
1936
1937 static __be32 check_forechannel_attrs(struct nfsd4_channel_attrs *ca, struct nfsd_net *nn)
1938 {
1939         u32 maxrpc = nn->nfsd_serv->sv_max_mesg;
1940
1941         if (ca->maxreq_sz < NFSD_MIN_REQ_HDR_SEQ_SZ)
1942                 return nfserr_toosmall;
1943         if (ca->maxresp_sz < NFSD_MIN_RESP_HDR_SEQ_SZ)
1944                 return nfserr_toosmall;
1945         ca->headerpadsz = 0;
1946         ca->maxreq_sz = min_t(u32, ca->maxreq_sz, maxrpc);
1947         ca->maxresp_sz = min_t(u32, ca->maxresp_sz, maxrpc);
1948         ca->maxops = min_t(u32, ca->maxops, NFSD_MAX_OPS_PER_COMPOUND);
1949         ca->maxresp_cached = min_t(u32, ca->maxresp_cached,
1950                         NFSD_SLOT_CACHE_SIZE + NFSD_MIN_HDR_SEQ_SZ);
1951         ca->maxreqs = min_t(u32, ca->maxreqs, NFSD_MAX_SLOTS_PER_SESSION);
1952         /*
1953          * Note decreasing slot size below client's request may make it
1954          * difficult for client to function correctly, whereas
1955          * decreasing the number of slots will (just?) affect
1956          * performance.  When short on memory we therefore prefer to
1957          * decrease number of slots instead of their size.  Clients that
1958          * request larger slots than they need will get poor results:
1959          */
1960         ca->maxreqs = nfsd4_get_drc_mem(ca);
1961         if (!ca->maxreqs)
1962                 return nfserr_jukebox;
1963
1964         return nfs_ok;
1965 }
1966
1967 #define NFSD_CB_MAX_REQ_SZ      ((NFS4_enc_cb_recall_sz + \
1968                                  RPC_MAX_HEADER_WITH_AUTH) * sizeof(__be32))
1969 #define NFSD_CB_MAX_RESP_SZ     ((NFS4_dec_cb_recall_sz + \
1970                                  RPC_MAX_REPHEADER_WITH_AUTH) * sizeof(__be32))
1971
1972 static __be32 check_backchannel_attrs(struct nfsd4_channel_attrs *ca)
1973 {
1974         ca->headerpadsz = 0;
1975
1976         /*
1977          * These RPC_MAX_HEADER macros are overkill, especially since we
1978          * don't even do gss on the backchannel yet.  But this is still
1979          * less than 1k.  Tighten up this estimate in the unlikely event
1980          * it turns out to be a problem for some client:
1981          */
1982         if (ca->maxreq_sz < NFSD_CB_MAX_REQ_SZ)
1983                 return nfserr_toosmall;
1984         if (ca->maxresp_sz < NFSD_CB_MAX_RESP_SZ)
1985                 return nfserr_toosmall;
1986         ca->maxresp_cached = 0;
1987         if (ca->maxops < 2)
1988                 return nfserr_toosmall;
1989
1990         return nfs_ok;
1991 }
1992
1993 static __be32 nfsd4_check_cb_sec(struct nfsd4_cb_sec *cbs)
1994 {
1995         switch (cbs->flavor) {
1996         case RPC_AUTH_NULL:
1997         case RPC_AUTH_UNIX:
1998                 return nfs_ok;
1999         default:
2000                 /*
2001                  * GSS case: the spec doesn't allow us to return this
2002                  * error.  But it also doesn't allow us not to support
2003                  * GSS.
2004                  * I'd rather this fail hard than return some error the
2005                  * client might think it can already handle:
2006                  */
2007                 return nfserr_encr_alg_unsupp;
2008         }
2009 }
2010
2011 __be32
2012 nfsd4_create_session(struct svc_rqst *rqstp,
2013                      struct nfsd4_compound_state *cstate,
2014                      struct nfsd4_create_session *cr_ses)
2015 {
2016         struct sockaddr *sa = svc_addr(rqstp);
2017         struct nfs4_client *conf, *unconf;
2018         struct nfsd4_session *new;
2019         struct nfsd4_conn *conn;
2020         struct nfsd4_clid_slot *cs_slot = NULL;
2021         __be32 status = 0;
2022         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
2023
2024         if (cr_ses->flags & ~SESSION4_FLAG_MASK_A)
2025                 return nfserr_inval;
2026         status = nfsd4_check_cb_sec(&cr_ses->cb_sec);
2027         if (status)
2028                 return status;
2029         status = check_forechannel_attrs(&cr_ses->fore_channel, nn);
2030         if (status)
2031                 return status;
2032         status = check_backchannel_attrs(&cr_ses->back_channel);
2033         if (status)
2034                 goto out_release_drc_mem;
2035         status = nfserr_jukebox;
2036         new = alloc_session(&cr_ses->fore_channel, &cr_ses->back_channel);
2037         if (!new)
2038                 goto out_release_drc_mem;
2039         conn = alloc_conn_from_crses(rqstp, cr_ses);
2040         if (!conn)
2041                 goto out_free_session;
2042
2043         nfs4_lock_state();
2044         unconf = find_unconfirmed_client(&cr_ses->clientid, true, nn);
2045         conf = find_confirmed_client(&cr_ses->clientid, true, nn);
2046         WARN_ON_ONCE(conf && unconf);
2047
2048         if (conf) {
2049                 status = nfserr_wrong_cred;
2050                 if (!mach_creds_match(conf, rqstp))
2051                         goto out_free_conn;
2052                 cs_slot = &conf->cl_cs_slot;
2053                 status = check_slot_seqid(cr_ses->seqid, cs_slot->sl_seqid, 0);
2054                 if (status == nfserr_replay_cache) {
2055                         status = nfsd4_replay_create_session(cr_ses, cs_slot);
2056                         goto out_free_conn;
2057                 } else if (cr_ses->seqid != cs_slot->sl_seqid + 1) {
2058                         status = nfserr_seq_misordered;
2059                         goto out_free_conn;
2060                 }
2061         } else if (unconf) {
2062                 struct nfs4_client *old;
2063                 if (!same_creds(&unconf->cl_cred, &rqstp->rq_cred) ||
2064                     !rpc_cmp_addr(sa, (struct sockaddr *) &unconf->cl_addr)) {
2065                         status = nfserr_clid_inuse;
2066                         goto out_free_conn;
2067                 }
2068                 status = nfserr_wrong_cred;
2069                 if (!mach_creds_match(unconf, rqstp))
2070                         goto out_free_conn;
2071                 cs_slot = &unconf->cl_cs_slot;
2072                 status = check_slot_seqid(cr_ses->seqid, cs_slot->sl_seqid, 0);
2073                 if (status) {
2074                         /* an unconfirmed replay returns misordered */
2075                         status = nfserr_seq_misordered;
2076                         goto out_free_conn;
2077                 }
2078                 old = find_confirmed_client_by_name(&unconf->cl_name, nn);
2079                 if (old) {
2080                         status = mark_client_expired(old);
2081                         if (status)
2082                                 goto out_free_conn;
2083                         expire_client(old);
2084                 }
2085                 move_to_confirmed(unconf);
2086                 conf = unconf;
2087         } else {
2088                 status = nfserr_stale_clientid;
2089                 goto out_free_conn;
2090         }
2091         status = nfs_ok;
2092         /*
2093          * We do not support RDMA or persistent sessions
2094          */
2095         cr_ses->flags &= ~SESSION4_PERSIST;
2096         cr_ses->flags &= ~SESSION4_RDMA;
2097
2098         init_session(rqstp, new, conf, cr_ses);
2099         nfsd4_init_conn(rqstp, conn, new);
2100
2101         memcpy(cr_ses->sessionid.data, new->se_sessionid.data,
2102                NFS4_MAX_SESSIONID_LEN);
2103         cs_slot->sl_seqid++;
2104         cr_ses->seqid = cs_slot->sl_seqid;
2105
2106         /* cache solo and embedded create sessions under the state lock */
2107         nfsd4_cache_create_session(cr_ses, cs_slot, status);
2108         nfs4_unlock_state();
2109         return status;
2110 out_free_conn:
2111         nfs4_unlock_state();
2112         free_conn(conn);
2113 out_free_session:
2114         __free_session(new);
2115 out_release_drc_mem:
2116         nfsd4_put_drc_mem(&cr_ses->fore_channel);
2117         return status;
2118 }
2119
2120 static __be32 nfsd4_map_bcts_dir(u32 *dir)
2121 {
2122         switch (*dir) {
2123         case NFS4_CDFC4_FORE:
2124         case NFS4_CDFC4_BACK:
2125                 return nfs_ok;
2126         case NFS4_CDFC4_FORE_OR_BOTH:
2127         case NFS4_CDFC4_BACK_OR_BOTH:
2128                 *dir = NFS4_CDFC4_BOTH;
2129                 return nfs_ok;
2130         };
2131         return nfserr_inval;
2132 }
2133
2134 __be32 nfsd4_backchannel_ctl(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, struct nfsd4_backchannel_ctl *bc)
2135 {
2136         struct nfsd4_session *session = cstate->session;
2137         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
2138         __be32 status;
2139
2140         status = nfsd4_check_cb_sec(&bc->bc_cb_sec);
2141         if (status)
2142                 return status;
2143         spin_lock(&nn->client_lock);
2144         session->se_cb_prog = bc->bc_cb_program;
2145         session->se_cb_sec = bc->bc_cb_sec;
2146         spin_unlock(&nn->client_lock);
2147
2148         nfsd4_probe_callback(session->se_client);
2149
2150         return nfs_ok;
2151 }
2152
2153 __be32 nfsd4_bind_conn_to_session(struct svc_rqst *rqstp,
2154                      struct nfsd4_compound_state *cstate,
2155                      struct nfsd4_bind_conn_to_session *bcts)
2156 {
2157         __be32 status;
2158         struct nfsd4_conn *conn;
2159         struct nfsd4_session *session;
2160         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
2161
2162         if (!nfsd4_last_compound_op(rqstp))
2163                 return nfserr_not_only_op;
2164         nfs4_lock_state();
2165         spin_lock(&nn->client_lock);
2166         session = find_in_sessionid_hashtbl(&bcts->sessionid, SVC_NET(rqstp));
2167         spin_unlock(&nn->client_lock);
2168         status = nfserr_badsession;
2169         if (!session)
2170                 goto out;
2171         status = nfserr_wrong_cred;
2172         if (!mach_creds_match(session->se_client, rqstp))
2173                 goto out;
2174         status = nfsd4_map_bcts_dir(&bcts->dir);
2175         if (status)
2176                 goto out;
2177         conn = alloc_conn(rqstp, bcts->dir);
2178         status = nfserr_jukebox;
2179         if (!conn)
2180                 goto out;
2181         nfsd4_init_conn(rqstp, conn, session);
2182         status = nfs_ok;
2183 out:
2184         nfs4_unlock_state();
2185         return status;
2186 }
2187
2188 static bool nfsd4_compound_in_session(struct nfsd4_session *session, struct nfs4_sessionid *sid)
2189 {
2190         if (!session)
2191                 return 0;
2192         return !memcmp(sid, &session->se_sessionid, sizeof(*sid));
2193 }
2194
2195 __be32
2196 nfsd4_destroy_session(struct svc_rqst *r,
2197                       struct nfsd4_compound_state *cstate,
2198                       struct nfsd4_destroy_session *sessionid)
2199 {
2200         struct nfsd4_session *ses;
2201         __be32 status;
2202         int ref_held_by_me = 0;
2203         struct nfsd_net *nn = net_generic(SVC_NET(r), nfsd_net_id);
2204
2205         nfs4_lock_state();
2206         status = nfserr_not_only_op;
2207         if (nfsd4_compound_in_session(cstate->session, &sessionid->sessionid)) {
2208                 if (!nfsd4_last_compound_op(r))
2209                         goto out;
2210                 ref_held_by_me++;
2211         }
2212         dump_sessionid(__func__, &sessionid->sessionid);
2213         spin_lock(&nn->client_lock);
2214         ses = find_in_sessionid_hashtbl(&sessionid->sessionid, SVC_NET(r));
2215         status = nfserr_badsession;
2216         if (!ses)
2217                 goto out_client_lock;
2218         status = nfserr_wrong_cred;
2219         if (!mach_creds_match(ses->se_client, r))
2220                 goto out_client_lock;
2221         nfsd4_get_session_locked(ses);
2222         status = mark_session_dead_locked(ses, 1 + ref_held_by_me);
2223         if (status)
2224                 goto out_put_session;
2225         unhash_session(ses);
2226         spin_unlock(&nn->client_lock);
2227
2228         nfsd4_probe_callback_sync(ses->se_client);
2229
2230         spin_lock(&nn->client_lock);
2231         status = nfs_ok;
2232 out_put_session:
2233         nfsd4_put_session(ses);
2234 out_client_lock:
2235         spin_unlock(&nn->client_lock);
2236 out:
2237         nfs4_unlock_state();
2238         return status;
2239 }
2240
2241 static struct nfsd4_conn *__nfsd4_find_conn(struct svc_xprt *xpt, struct nfsd4_session *s)
2242 {
2243         struct nfsd4_conn *c;
2244
2245         list_for_each_entry(c, &s->se_conns, cn_persession) {
2246                 if (c->cn_xprt == xpt) {
2247                         return c;
2248                 }
2249         }
2250         return NULL;
2251 }
2252
2253 static __be32 nfsd4_sequence_check_conn(struct nfsd4_conn *new, struct nfsd4_session *ses)
2254 {
2255         struct nfs4_client *clp = ses->se_client;
2256         struct nfsd4_conn *c;
2257         __be32 status = nfs_ok;
2258         int ret;
2259
2260         spin_lock(&clp->cl_lock);
2261         c = __nfsd4_find_conn(new->cn_xprt, ses);
2262         if (c)
2263                 goto out_free;
2264         status = nfserr_conn_not_bound_to_session;
2265         if (clp->cl_mach_cred)
2266                 goto out_free;
2267         __nfsd4_hash_conn(new, ses);
2268         spin_unlock(&clp->cl_lock);
2269         ret = nfsd4_register_conn(new);
2270         if (ret)
2271                 /* oops; xprt is already down: */
2272                 nfsd4_conn_lost(&new->cn_xpt_user);
2273         return nfs_ok;
2274 out_free:
2275         spin_unlock(&clp->cl_lock);
2276         free_conn(new);
2277         return status;
2278 }
2279
2280 static bool nfsd4_session_too_many_ops(struct svc_rqst *rqstp, struct nfsd4_session *session)
2281 {
2282         struct nfsd4_compoundargs *args = rqstp->rq_argp;
2283
2284         return args->opcnt > session->se_fchannel.maxops;
2285 }
2286
2287 static bool nfsd4_request_too_big(struct svc_rqst *rqstp,
2288                                   struct nfsd4_session *session)
2289 {
2290         struct xdr_buf *xb = &rqstp->rq_arg;
2291
2292         return xb->len > session->se_fchannel.maxreq_sz;
2293 }
2294
2295 __be32
2296 nfsd4_sequence(struct svc_rqst *rqstp,
2297                struct nfsd4_compound_state *cstate,
2298                struct nfsd4_sequence *seq)
2299 {
2300         struct nfsd4_compoundres *resp = rqstp->rq_resp;
2301         struct xdr_stream *xdr = &resp->xdr;
2302         struct nfsd4_session *session;
2303         struct nfs4_client *clp;
2304         struct nfsd4_slot *slot;
2305         struct nfsd4_conn *conn;
2306         __be32 status;
2307         int buflen;
2308         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
2309
2310         if (resp->opcnt != 1)
2311                 return nfserr_sequence_pos;
2312
2313         /*
2314          * Will be either used or freed by nfsd4_sequence_check_conn
2315          * below.
2316          */
2317         conn = alloc_conn(rqstp, NFS4_CDFC4_FORE);
2318         if (!conn)
2319                 return nfserr_jukebox;
2320
2321         spin_lock(&nn->client_lock);
2322         status = nfserr_badsession;
2323         session = find_in_sessionid_hashtbl(&seq->sessionid, SVC_NET(rqstp));
2324         if (!session)
2325                 goto out_no_session;
2326         clp = session->se_client;
2327         status = get_client_locked(clp);
2328         if (status)
2329                 goto out_no_session;
2330         status = nfsd4_get_session_locked(session);
2331         if (status)
2332                 goto out_put_client;
2333
2334         status = nfserr_too_many_ops;
2335         if (nfsd4_session_too_many_ops(rqstp, session))
2336                 goto out_put_session;
2337
2338         status = nfserr_req_too_big;
2339         if (nfsd4_request_too_big(rqstp, session))
2340                 goto out_put_session;
2341
2342         status = nfserr_badslot;
2343         if (seq->slotid >= session->se_fchannel.maxreqs)
2344                 goto out_put_session;
2345
2346         slot = session->se_slots[seq->slotid];
2347         dprintk("%s: slotid %d\n", __func__, seq->slotid);
2348
2349         /* We do not negotiate the number of slots yet, so set the
2350          * maxslots to the session maxreqs which is used to encode
2351          * sr_highest_slotid and the sr_target_slot id to maxslots */
2352         seq->maxslots = session->se_fchannel.maxreqs;
2353
2354         status = check_slot_seqid(seq->seqid, slot->sl_seqid,
2355                                         slot->sl_flags & NFSD4_SLOT_INUSE);
2356         if (status == nfserr_replay_cache) {
2357                 status = nfserr_seq_misordered;
2358                 if (!(slot->sl_flags & NFSD4_SLOT_INITIALIZED))
2359                         goto out_put_session;
2360                 cstate->slot = slot;
2361                 cstate->session = session;
2362                 /* Return the cached reply status and set cstate->status
2363                  * for nfsd4_proc_compound processing */
2364                 status = nfsd4_replay_cache_entry(resp, seq);
2365                 cstate->status = nfserr_replay_cache;
2366                 goto out;
2367         }
2368         if (status)
2369                 goto out_put_session;
2370
2371         status = nfsd4_sequence_check_conn(conn, session);
2372         conn = NULL;
2373         if (status)
2374                 goto out_put_session;
2375
2376         buflen = (seq->cachethis) ?
2377                         session->se_fchannel.maxresp_cached :
2378                         session->se_fchannel.maxresp_sz;
2379         status = (seq->cachethis) ? nfserr_rep_too_big_to_cache :
2380                                     nfserr_rep_too_big;
2381         if (xdr_restrict_buflen(xdr, buflen - rqstp->rq_auth_slack))
2382                 goto out_put_session;
2383         svc_reserve(rqstp, buflen);
2384
2385         status = nfs_ok;
2386         /* Success! bump slot seqid */
2387         slot->sl_seqid = seq->seqid;
2388         slot->sl_flags |= NFSD4_SLOT_INUSE;
2389         if (seq->cachethis)
2390                 slot->sl_flags |= NFSD4_SLOT_CACHETHIS;
2391         else
2392                 slot->sl_flags &= ~NFSD4_SLOT_CACHETHIS;
2393
2394         cstate->slot = slot;
2395         cstate->session = session;
2396
2397 out:
2398         switch (clp->cl_cb_state) {
2399         case NFSD4_CB_DOWN:
2400                 seq->status_flags = SEQ4_STATUS_CB_PATH_DOWN;
2401                 break;
2402         case NFSD4_CB_FAULT:
2403                 seq->status_flags = SEQ4_STATUS_BACKCHANNEL_FAULT;
2404                 break;
2405         default:
2406                 seq->status_flags = 0;
2407         }
2408         if (!list_empty(&clp->cl_revoked))
2409                 seq->status_flags |= SEQ4_STATUS_RECALLABLE_STATE_REVOKED;
2410 out_no_session:
2411         if (conn)
2412                 free_conn(conn);
2413         spin_unlock(&nn->client_lock);
2414         return status;
2415 out_put_session:
2416         nfsd4_put_session(session);
2417 out_put_client:
2418         put_client_renew_locked(clp);
2419         goto out_no_session;
2420 }
2421
2422 void
2423 nfsd4_sequence_done(struct nfsd4_compoundres *resp)
2424 {
2425         struct nfsd4_compound_state *cs = &resp->cstate;
2426
2427         if (nfsd4_has_session(cs)) {
2428                 struct nfs4_client *clp = cs->session->se_client;
2429                 struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
2430
2431                 if (cs->status != nfserr_replay_cache) {
2432                         nfsd4_store_cache_entry(resp);
2433                         cs->slot->sl_flags &= ~NFSD4_SLOT_INUSE;
2434                 }
2435                 /* Renew the clientid on success and on replay */
2436                 spin_lock(&nn->client_lock);
2437                 nfsd4_put_session(cs->session);
2438                 put_client_renew_locked(clp);
2439                 spin_unlock(&nn->client_lock);
2440         }
2441 }
2442
2443 __be32
2444 nfsd4_destroy_clientid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, struct nfsd4_destroy_clientid *dc)
2445 {
2446         struct nfs4_client *conf, *unconf, *clp;
2447         __be32 status = 0;
2448         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
2449
2450         nfs4_lock_state();
2451         unconf = find_unconfirmed_client(&dc->clientid, true, nn);
2452         conf = find_confirmed_client(&dc->clientid, true, nn);
2453         WARN_ON_ONCE(conf && unconf);
2454
2455         if (conf) {
2456                 clp = conf;
2457
2458                 if (client_has_state(conf)) {
2459                         status = nfserr_clientid_busy;
2460                         goto out;
2461                 }
2462         } else if (unconf)
2463                 clp = unconf;
2464         else {
2465                 status = nfserr_stale_clientid;
2466                 goto out;
2467         }
2468         if (!mach_creds_match(clp, rqstp)) {
2469                 status = nfserr_wrong_cred;
2470                 goto out;
2471         }
2472         expire_client(clp);
2473 out:
2474         nfs4_unlock_state();
2475         return status;
2476 }
2477
2478 __be32
2479 nfsd4_reclaim_complete(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, struct nfsd4_reclaim_complete *rc)
2480 {
2481         __be32 status = 0;
2482
2483         if (rc->rca_one_fs) {
2484                 if (!cstate->current_fh.fh_dentry)
2485                         return nfserr_nofilehandle;
2486                 /*
2487                  * We don't take advantage of the rca_one_fs case.
2488                  * That's OK, it's optional, we can safely ignore it.
2489                  */
2490                  return nfs_ok;
2491         }
2492
2493         nfs4_lock_state();
2494         status = nfserr_complete_already;
2495         if (test_and_set_bit(NFSD4_CLIENT_RECLAIM_COMPLETE,
2496                              &cstate->session->se_client->cl_flags))
2497                 goto out;
2498
2499         status = nfserr_stale_clientid;
2500         if (is_client_expired(cstate->session->se_client))
2501                 /*
2502                  * The following error isn't really legal.
2503                  * But we only get here if the client just explicitly
2504                  * destroyed the client.  Surely it no longer cares what
2505                  * error it gets back on an operation for the dead
2506                  * client.
2507                  */
2508                 goto out;
2509
2510         status = nfs_ok;
2511         nfsd4_client_record_create(cstate->session->se_client);
2512 out:
2513         nfs4_unlock_state();
2514         return status;
2515 }
2516
2517 __be32
2518 nfsd4_setclientid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
2519                   struct nfsd4_setclientid *setclid)
2520 {
2521         struct xdr_netobj       clname = setclid->se_name;
2522         nfs4_verifier           clverifier = setclid->se_verf;
2523         struct nfs4_client      *conf, *unconf, *new;
2524         __be32                  status;
2525         struct nfsd_net         *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
2526
2527         /* Cases below refer to rfc 3530 section 14.2.33: */
2528         nfs4_lock_state();
2529         conf = find_confirmed_client_by_name(&clname, nn);
2530         if (conf) {
2531                 /* case 0: */
2532                 status = nfserr_clid_inuse;
2533                 if (clp_used_exchangeid(conf))
2534                         goto out;
2535                 if (!same_creds(&conf->cl_cred, &rqstp->rq_cred)) {
2536                         char addr_str[INET6_ADDRSTRLEN];
2537                         rpc_ntop((struct sockaddr *) &conf->cl_addr, addr_str,
2538                                  sizeof(addr_str));
2539                         dprintk("NFSD: setclientid: string in use by client "
2540                                 "at %s\n", addr_str);
2541                         goto out;
2542                 }
2543         }
2544         unconf = find_unconfirmed_client_by_name(&clname, nn);
2545         if (unconf)
2546                 expire_client(unconf);
2547         status = nfserr_jukebox;
2548         new = create_client(clname, rqstp, &clverifier);
2549         if (new == NULL)
2550                 goto out;
2551         if (conf && same_verf(&conf->cl_verifier, &clverifier))
2552                 /* case 1: probable callback update */
2553                 copy_clid(new, conf);
2554         else /* case 4 (new client) or cases 2, 3 (client reboot): */
2555                 gen_clid(new, nn);
2556         new->cl_minorversion = 0;
2557         gen_callback(new, setclid, rqstp);
2558         add_to_unconfirmed(new);
2559         setclid->se_clientid.cl_boot = new->cl_clientid.cl_boot;
2560         setclid->se_clientid.cl_id = new->cl_clientid.cl_id;
2561         memcpy(setclid->se_confirm.data, new->cl_confirm.data, sizeof(setclid->se_confirm.data));
2562         status = nfs_ok;
2563 out:
2564         nfs4_unlock_state();
2565         return status;
2566 }
2567
2568
2569 __be32
2570 nfsd4_setclientid_confirm(struct svc_rqst *rqstp,
2571                          struct nfsd4_compound_state *cstate,
2572                          struct nfsd4_setclientid_confirm *setclientid_confirm)
2573 {
2574         struct nfs4_client *conf, *unconf;
2575         nfs4_verifier confirm = setclientid_confirm->sc_confirm;
2576         clientid_t * clid = &setclientid_confirm->sc_clientid;
2577         __be32 status;
2578         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
2579
2580         if (STALE_CLIENTID(clid, nn))
2581                 return nfserr_stale_clientid;
2582         nfs4_lock_state();
2583
2584         conf = find_confirmed_client(clid, false, nn);
2585         unconf = find_unconfirmed_client(clid, false, nn);
2586         /*
2587          * We try hard to give out unique clientid's, so if we get an
2588          * attempt to confirm the same clientid with a different cred,
2589          * there's a bug somewhere.  Let's charitably assume it's our
2590          * bug.
2591          */
2592         status = nfserr_serverfault;
2593         if (unconf && !same_creds(&unconf->cl_cred, &rqstp->rq_cred))
2594                 goto out;
2595         if (conf && !same_creds(&conf->cl_cred, &rqstp->rq_cred))
2596                 goto out;
2597         /* cases below refer to rfc 3530 section 14.2.34: */
2598         if (!unconf || !same_verf(&confirm, &unconf->cl_confirm)) {
2599                 if (conf && !unconf) /* case 2: probable retransmit */
2600                         status = nfs_ok;
2601                 else /* case 4: client hasn't noticed we rebooted yet? */
2602                         status = nfserr_stale_clientid;
2603                 goto out;
2604         }
2605         status = nfs_ok;
2606         if (conf) { /* case 1: callback update */
2607                 nfsd4_change_callback(conf, &unconf->cl_cb_conn);
2608                 nfsd4_probe_callback(conf);
2609                 expire_client(unconf);
2610         } else { /* case 3: normal case; new or rebooted client */
2611                 conf = find_confirmed_client_by_name(&unconf->cl_name, nn);
2612                 if (conf) {
2613                         status = mark_client_expired(conf);
2614                         if (status)
2615                                 goto out;
2616                         expire_client(conf);
2617                 }
2618                 move_to_confirmed(unconf);
2619                 nfsd4_probe_callback(unconf);
2620         }
2621 out:
2622         nfs4_unlock_state();
2623         return status;
2624 }
2625
2626 static struct nfs4_file *nfsd4_alloc_file(void)
2627 {
2628         return kmem_cache_alloc(file_slab, GFP_KERNEL);
2629 }
2630
2631 /* OPEN Share state helper functions */
2632 static void nfsd4_init_file(struct nfs4_file *fp, struct inode *ino)
2633 {
2634         unsigned int hashval = file_hashval(ino);
2635
2636         lockdep_assert_held(&state_lock);
2637
2638         atomic_set(&fp->fi_ref, 1);
2639         INIT_LIST_HEAD(&fp->fi_stateids);
2640         INIT_LIST_HEAD(&fp->fi_delegations);
2641         ihold(ino);
2642         fp->fi_inode = ino;
2643         fp->fi_had_conflict = false;
2644         fp->fi_lease = NULL;
2645         memset(fp->fi_fds, 0, sizeof(fp->fi_fds));
2646         memset(fp->fi_access, 0, sizeof(fp->fi_access));
2647         hlist_add_head(&fp->fi_hash, &file_hashtbl[hashval]);
2648 }
2649
2650 void
2651 nfsd4_free_slabs(void)
2652 {
2653         kmem_cache_destroy(openowner_slab);
2654         kmem_cache_destroy(lockowner_slab);
2655         kmem_cache_destroy(file_slab);
2656         kmem_cache_destroy(stateid_slab);
2657         kmem_cache_destroy(deleg_slab);
2658 }
2659
2660 int
2661 nfsd4_init_slabs(void)
2662 {
2663         openowner_slab = kmem_cache_create("nfsd4_openowners",
2664                         sizeof(struct nfs4_openowner), 0, 0, NULL);
2665         if (openowner_slab == NULL)
2666                 goto out;
2667         lockowner_slab = kmem_cache_create("nfsd4_lockowners",
2668                         sizeof(struct nfs4_lockowner), 0, 0, NULL);
2669         if (lockowner_slab == NULL)
2670                 goto out_free_openowner_slab;
2671         file_slab = kmem_cache_create("nfsd4_files",
2672                         sizeof(struct nfs4_file), 0, 0, NULL);
2673         if (file_slab == NULL)
2674                 goto out_free_lockowner_slab;
2675         stateid_slab = kmem_cache_create("nfsd4_stateids",
2676                         sizeof(struct nfs4_ol_stateid), 0, 0, NULL);
2677         if (stateid_slab == NULL)
2678                 goto out_free_file_slab;
2679         deleg_slab = kmem_cache_create("nfsd4_delegations",
2680                         sizeof(struct nfs4_delegation), 0, 0, NULL);
2681         if (deleg_slab == NULL)
2682                 goto out_free_stateid_slab;
2683         return 0;
2684
2685 out_free_stateid_slab:
2686         kmem_cache_destroy(stateid_slab);
2687 out_free_file_slab:
2688         kmem_cache_destroy(file_slab);
2689 out_free_lockowner_slab:
2690         kmem_cache_destroy(lockowner_slab);
2691 out_free_openowner_slab:
2692         kmem_cache_destroy(openowner_slab);
2693 out:
2694         dprintk("nfsd4: out of memory while initializing nfsv4\n");
2695         return -ENOMEM;
2696 }
2697
2698 static void init_nfs4_replay(struct nfs4_replay *rp)
2699 {
2700         rp->rp_status = nfserr_serverfault;
2701         rp->rp_buflen = 0;
2702         rp->rp_buf = rp->rp_ibuf;
2703 }
2704
2705 static inline void *alloc_stateowner(struct kmem_cache *slab, struct xdr_netobj *owner, struct nfs4_client *clp)
2706 {
2707         struct nfs4_stateowner *sop;
2708
2709         sop = kmem_cache_alloc(slab, GFP_KERNEL);
2710         if (!sop)
2711                 return NULL;
2712
2713         sop->so_owner.data = kmemdup(owner->data, owner->len, GFP_KERNEL);
2714         if (!sop->so_owner.data) {
2715                 kmem_cache_free(slab, sop);
2716                 return NULL;
2717         }
2718         sop->so_owner.len = owner->len;
2719
2720         INIT_LIST_HEAD(&sop->so_stateids);
2721         sop->so_client = clp;
2722         init_nfs4_replay(&sop->so_replay);
2723         return sop;
2724 }
2725
2726 static void hash_openowner(struct nfs4_openowner *oo, struct nfs4_client *clp, unsigned int strhashval)
2727 {
2728         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
2729
2730         list_add(&oo->oo_owner.so_strhash, &nn->ownerstr_hashtbl[strhashval]);
2731         list_add(&oo->oo_perclient, &clp->cl_openowners);
2732 }
2733
2734 static struct nfs4_openowner *
2735 alloc_init_open_stateowner(unsigned int strhashval, struct nfs4_client *clp,
2736                            struct nfsd4_open *open,
2737                            struct nfsd4_compound_state *cstate)
2738 {
2739         struct nfs4_openowner *oo;
2740
2741         oo = alloc_stateowner(openowner_slab, &open->op_owner, clp);
2742         if (!oo)
2743                 return NULL;
2744         oo->oo_owner.so_is_open_owner = 1;
2745         oo->oo_owner.so_seqid = open->op_seqid;
2746         oo->oo_flags = NFS4_OO_NEW;
2747         if (nfsd4_has_session(cstate))
2748                 oo->oo_flags |= NFS4_OO_CONFIRMED;
2749         oo->oo_time = 0;
2750         oo->oo_last_closed_stid = NULL;
2751         INIT_LIST_HEAD(&oo->oo_close_lru);
2752         hash_openowner(oo, clp, strhashval);
2753         return oo;
2754 }
2755
2756 static void init_open_stateid(struct nfs4_ol_stateid *stp, struct nfs4_file *fp, struct nfsd4_open *open) {
2757         struct nfs4_openowner *oo = open->op_openowner;
2758
2759         stp->st_stid.sc_type = NFS4_OPEN_STID;
2760         INIT_LIST_HEAD(&stp->st_locks);
2761         list_add(&stp->st_perstateowner, &oo->oo_owner.so_stateids);
2762         list_add(&stp->st_perfile, &fp->fi_stateids);
2763         stp->st_stateowner = &oo->oo_owner;
2764         get_nfs4_file(fp);
2765         stp->st_file = fp;
2766         stp->st_access_bmap = 0;
2767         stp->st_deny_bmap = 0;
2768         set_access(open->op_share_access, stp);
2769         set_deny(open->op_share_deny, stp);
2770         stp->st_openstp = NULL;
2771 }
2772
2773 static void
2774 move_to_close_lru(struct nfs4_openowner *oo, struct net *net)
2775 {
2776         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
2777
2778         dprintk("NFSD: move_to_close_lru nfs4_openowner %p\n", oo);
2779
2780         list_move_tail(&oo->oo_close_lru, &nn->close_lru);
2781         oo->oo_time = get_seconds();
2782 }
2783
2784 static int
2785 same_owner_str(struct nfs4_stateowner *sop, struct xdr_netobj *owner,
2786                                                         clientid_t *clid)
2787 {
2788         return (sop->so_owner.len == owner->len) &&
2789                 0 == memcmp(sop->so_owner.data, owner->data, owner->len) &&
2790                 (sop->so_client->cl_clientid.cl_id == clid->cl_id);
2791 }
2792
2793 static struct nfs4_openowner *
2794 find_openstateowner_str(unsigned int hashval, struct nfsd4_open *open,
2795                         bool sessions, struct nfsd_net *nn)
2796 {
2797         struct nfs4_stateowner *so;
2798         struct nfs4_openowner *oo;
2799         struct nfs4_client *clp;
2800
2801         list_for_each_entry(so, &nn->ownerstr_hashtbl[hashval], so_strhash) {
2802                 if (!so->so_is_open_owner)
2803                         continue;
2804                 if (same_owner_str(so, &open->op_owner, &open->op_clientid)) {
2805                         oo = openowner(so);
2806                         clp = oo->oo_owner.so_client;
2807                         if ((bool)clp->cl_minorversion != sessions)
2808                                 return NULL;
2809                         renew_client(oo->oo_owner.so_client);
2810                         return oo;
2811                 }
2812         }
2813         return NULL;
2814 }
2815
2816 /* search file_hashtbl[] for file */
2817 static struct nfs4_file *
2818 find_file_locked(struct inode *ino)
2819 {
2820         unsigned int hashval = file_hashval(ino);
2821         struct nfs4_file *fp;
2822
2823         lockdep_assert_held(&state_lock);
2824
2825         hlist_for_each_entry(fp, &file_hashtbl[hashval], fi_hash) {
2826                 if (fp->fi_inode == ino) {
2827                         get_nfs4_file(fp);
2828                         return fp;
2829                 }
2830         }
2831         return NULL;
2832 }
2833
2834 static struct nfs4_file *
2835 find_file(struct inode *ino)
2836 {
2837         struct nfs4_file *fp;
2838
2839         spin_lock(&state_lock);
2840         fp = find_file_locked(ino);
2841         spin_unlock(&state_lock);
2842         return fp;
2843 }
2844
2845 static struct nfs4_file *
2846 find_or_add_file(struct inode *ino, struct nfs4_file *new)
2847 {
2848         struct nfs4_file *fp;
2849
2850         spin_lock(&state_lock);
2851         fp = find_file_locked(ino);
2852         if (fp == NULL) {
2853                 nfsd4_init_file(new, ino);
2854                 fp = new;
2855         }
2856         spin_unlock(&state_lock);
2857
2858         return fp;
2859 }
2860
2861 /*
2862  * Called to check deny when READ with all zero stateid or
2863  * WRITE with all zero or all one stateid
2864  */
2865 static __be32
2866 nfs4_share_conflict(struct svc_fh *current_fh, unsigned int deny_type)
2867 {
2868         struct inode *ino = current_fh->fh_dentry->d_inode;
2869         struct nfs4_file *fp;
2870         struct nfs4_ol_stateid *stp;
2871         __be32 ret;
2872
2873         fp = find_file(ino);
2874         if (!fp)
2875                 return nfs_ok;
2876         ret = nfserr_locked;
2877         /* Search for conflicting share reservations */
2878         list_for_each_entry(stp, &fp->fi_stateids, st_perfile) {
2879                 if (test_deny(deny_type, stp) ||
2880                     test_deny(NFS4_SHARE_DENY_BOTH, stp))
2881                         goto out;
2882         }
2883         ret = nfs_ok;
2884 out:
2885         put_nfs4_file(fp);
2886         return ret;
2887 }
2888
2889 static void nfsd_break_one_deleg(struct nfs4_delegation *dp)
2890 {
2891         struct nfs4_client *clp = dp->dl_stid.sc_client;
2892         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
2893
2894         lockdep_assert_held(&state_lock);
2895         /* We're assuming the state code never drops its reference
2896          * without first removing the lease.  Since we're in this lease
2897          * callback (and since the lease code is serialized by the kernel
2898          * lock) we know the server hasn't removed the lease yet, we know
2899          * it's safe to take a reference: */
2900         atomic_inc(&dp->dl_count);
2901
2902         list_add_tail(&dp->dl_recall_lru, &nn->del_recall_lru);
2903
2904         /* Only place dl_time is set; protected by i_lock: */
2905         dp->dl_time = get_seconds();
2906
2907         block_delegations(&dp->dl_fh);
2908
2909         nfsd4_cb_recall(dp);
2910 }
2911
2912 /* Called from break_lease() with i_lock held. */
2913 static void nfsd_break_deleg_cb(struct file_lock *fl)
2914 {
2915         struct nfs4_file *fp = (struct nfs4_file *)fl->fl_owner;
2916         struct nfs4_delegation *dp;
2917
2918         if (!fp) {
2919                 WARN(1, "(%p)->fl_owner NULL\n", fl);
2920                 return;
2921         }
2922         if (fp->fi_had_conflict) {
2923                 WARN(1, "duplicate break on %p\n", fp);
2924                 return;
2925         }
2926         /*
2927          * We don't want the locks code to timeout the lease for us;
2928          * we'll remove it ourself if a delegation isn't returned
2929          * in time:
2930          */
2931         fl->fl_break_time = 0;
2932
2933         spin_lock(&state_lock);
2934         fp->fi_had_conflict = true;
2935         list_for_each_entry(dp, &fp->fi_delegations, dl_perfile)
2936                 nfsd_break_one_deleg(dp);
2937         spin_unlock(&state_lock);
2938 }
2939
2940 static
2941 int nfsd_change_deleg_cb(struct file_lock **onlist, int arg)
2942 {
2943         if (arg & F_UNLCK)
2944                 return lease_modify(onlist, arg);
2945         else
2946                 return -EAGAIN;
2947 }
2948
2949 static const struct lock_manager_operations nfsd_lease_mng_ops = {
2950         .lm_break = nfsd_break_deleg_cb,
2951         .lm_change = nfsd_change_deleg_cb,
2952 };
2953
2954 static __be32 nfsd4_check_seqid(struct nfsd4_compound_state *cstate, struct nfs4_stateowner *so, u32 seqid)
2955 {
2956         if (nfsd4_has_session(cstate))
2957                 return nfs_ok;
2958         if (seqid == so->so_seqid - 1)
2959                 return nfserr_replay_me;
2960         if (seqid == so->so_seqid)
2961                 return nfs_ok;
2962         return nfserr_bad_seqid;
2963 }
2964
2965 __be32
2966 nfsd4_process_open1(struct nfsd4_compound_state *cstate,
2967                     struct nfsd4_open *open, struct nfsd_net *nn)
2968 {
2969         clientid_t *clientid = &open->op_clientid;
2970         struct nfs4_client *clp = NULL;
2971         unsigned int strhashval;
2972         struct nfs4_openowner *oo = NULL;
2973         __be32 status;
2974
2975         if (STALE_CLIENTID(&open->op_clientid, nn))
2976                 return nfserr_stale_clientid;
2977         /*
2978          * In case we need it later, after we've already created the
2979          * file and don't want to risk a further failure:
2980          */
2981         open->op_file = nfsd4_alloc_file();
2982         if (open->op_file == NULL)
2983                 return nfserr_jukebox;
2984
2985         strhashval = ownerstr_hashval(clientid->cl_id, &open->op_owner);
2986         oo = find_openstateowner_str(strhashval, open, cstate->minorversion, nn);
2987         open->op_openowner = oo;
2988         if (!oo) {
2989                 clp = find_confirmed_client(clientid, cstate->minorversion,
2990                                             nn);
2991                 if (clp == NULL)
2992                         return nfserr_expired;
2993                 goto new_owner;
2994         }
2995         if (!(oo->oo_flags & NFS4_OO_CONFIRMED)) {
2996                 /* Replace unconfirmed owners without checking for replay. */
2997                 clp = oo->oo_owner.so_client;
2998                 release_openowner(oo);
2999                 open->op_openowner = NULL;
3000                 goto new_owner;
3001         }
3002         status = nfsd4_check_seqid(cstate, &oo->oo_owner, open->op_seqid);
3003         if (status)
3004                 return status;
3005         clp = oo->oo_owner.so_client;
3006         goto alloc_stateid;
3007 new_owner:
3008         oo = alloc_init_open_stateowner(strhashval, clp, open, cstate);
3009         if (oo == NULL)
3010                 return nfserr_jukebox;
3011         open->op_openowner = oo;
3012 alloc_stateid:
3013         open->op_stp = nfs4_alloc_stateid(clp);
3014         if (!open->op_stp)
3015                 return nfserr_jukebox;
3016         return nfs_ok;
3017 }
3018
3019 static inline __be32
3020 nfs4_check_delegmode(struct nfs4_delegation *dp, int flags)
3021 {
3022         if ((flags & WR_STATE) && (dp->dl_type == NFS4_OPEN_DELEGATE_READ))
3023                 return nfserr_openmode;
3024         else
3025                 return nfs_ok;
3026 }
3027
3028 static int share_access_to_flags(u32 share_access)
3029 {
3030         return share_access == NFS4_SHARE_ACCESS_READ ? RD_STATE : WR_STATE;
3031 }
3032
3033 static struct nfs4_delegation *find_deleg_stateid(struct nfs4_client *cl, stateid_t *s)
3034 {
3035         struct nfs4_stid *ret;
3036
3037         ret = find_stateid_by_type(cl, s, NFS4_DELEG_STID);
3038         if (!ret)
3039                 return NULL;
3040         return delegstateid(ret);
3041 }
3042
3043 static bool nfsd4_is_deleg_cur(struct nfsd4_open *open)
3044 {
3045         return open->op_claim_type == NFS4_OPEN_CLAIM_DELEGATE_CUR ||
3046                open->op_claim_type == NFS4_OPEN_CLAIM_DELEG_CUR_FH;
3047 }
3048
3049 static __be32
3050 nfs4_check_deleg(struct nfs4_client *cl, struct nfsd4_open *open,
3051                 struct nfs4_delegation **dp)
3052 {
3053         int flags;
3054         __be32 status = nfserr_bad_stateid;
3055
3056         *dp = find_deleg_stateid(cl, &open->op_delegate_stateid);
3057         if (*dp == NULL)
3058                 goto out;
3059         flags = share_access_to_flags(open->op_share_access);
3060         status = nfs4_check_delegmode(*dp, flags);
3061         if (status)
3062                 *dp = NULL;
3063 out:
3064         if (!nfsd4_is_deleg_cur(open))
3065                 return nfs_ok;
3066         if (status)
3067                 return status;
3068         open->op_openowner->oo_flags |= NFS4_OO_CONFIRMED;
3069         return nfs_ok;
3070 }
3071
3072 static __be32
3073 nfs4_check_open(struct nfs4_file *fp, struct nfsd4_open *open, struct nfs4_ol_stateid **stpp)
3074 {
3075         struct nfs4_ol_stateid *local;
3076         struct nfs4_openowner *oo = open->op_openowner;
3077
3078         list_for_each_entry(local, &fp->fi_stateids, st_perfile) {
3079                 /* ignore lock owners */
3080                 if (local->st_stateowner->so_is_open_owner == 0)
3081                         continue;
3082                 /* remember if we have seen this open owner */
3083                 if (local->st_stateowner == &oo->oo_owner)
3084                         *stpp = local;
3085                 /* check for conflicting share reservations */
3086                 if (!test_share(local, open))
3087                         return nfserr_share_denied;
3088         }
3089         return nfs_ok;
3090 }
3091
3092 static inline int nfs4_access_to_access(u32 nfs4_access)
3093 {
3094         int flags = 0;
3095
3096         if (nfs4_access & NFS4_SHARE_ACCESS_READ)
3097                 flags |= NFSD_MAY_READ;
3098         if (nfs4_access & NFS4_SHARE_ACCESS_WRITE)
3099                 flags |= NFSD_MAY_WRITE;
3100         return flags;
3101 }
3102
3103 static inline __be32
3104 nfsd4_truncate(struct svc_rqst *rqstp, struct svc_fh *fh,
3105                 struct nfsd4_open *open)
3106 {
3107         struct iattr iattr = {
3108                 .ia_valid = ATTR_SIZE,
3109                 .ia_size = 0,
3110         };
3111         if (!open->op_truncate)
3112                 return 0;
3113         if (!(open->op_share_access & NFS4_SHARE_ACCESS_WRITE))
3114                 return nfserr_inval;
3115         return nfsd_setattr(rqstp, fh, &iattr, 0, (time_t)0);
3116 }
3117
3118 static __be32 nfs4_get_vfs_file(struct svc_rqst *rqstp, struct nfs4_file *fp,
3119                 struct svc_fh *cur_fh, struct nfsd4_open *open)
3120 {
3121         __be32 status;
3122         int oflag = nfs4_access_to_omode(open->op_share_access);
3123         int access = nfs4_access_to_access(open->op_share_access);
3124
3125         if (!fp->fi_fds[oflag]) {
3126                 status = nfsd_open(rqstp, cur_fh, S_IFREG, access,
3127                         &fp->fi_fds[oflag]);
3128                 if (status)
3129                         goto out;
3130         }
3131         nfs4_file_get_access(fp, oflag);
3132
3133         status = nfsd4_truncate(rqstp, cur_fh, open);
3134         if (status)
3135                 goto out_put_access;
3136
3137         return nfs_ok;
3138
3139 out_put_access:
3140         nfs4_file_put_access(fp, oflag);
3141 out:
3142         return status;
3143 }
3144
3145 static __be32
3146 nfs4_upgrade_open(struct svc_rqst *rqstp, struct nfs4_file *fp, struct svc_fh *cur_fh, struct nfs4_ol_stateid *stp, struct nfsd4_open *open)
3147 {
3148         u32 op_share_access = open->op_share_access;
3149         __be32 status;
3150
3151         if (!test_access(op_share_access, stp))
3152                 status = nfs4_get_vfs_file(rqstp, fp, cur_fh, open);
3153         else
3154                 status = nfsd4_truncate(rqstp, cur_fh, open);
3155
3156         if (status)
3157                 return status;
3158
3159         /* remember the open */
3160         set_access(op_share_access, stp);
3161         set_deny(open->op_share_deny, stp);
3162         return nfs_ok;
3163 }
3164
3165
3166 static void
3167 nfs4_set_claim_prev(struct nfsd4_open *open, bool has_session)
3168 {
3169         open->op_openowner->oo_flags |= NFS4_OO_CONFIRMED;
3170 }
3171
3172 /* Should we give out recallable state?: */
3173 static bool nfsd4_cb_channel_good(struct nfs4_client *clp)
3174 {
3175         if (clp->cl_cb_state == NFSD4_CB_UP)
3176                 return true;
3177         /*
3178          * In the sessions case, since we don't have to establish a
3179          * separate connection for callbacks, we assume it's OK
3180          * until we hear otherwise:
3181          */
3182         return clp->cl_minorversion && clp->cl_cb_state == NFSD4_CB_UNKNOWN;
3183 }
3184
3185 static struct file_lock *nfs4_alloc_init_lease(struct nfs4_delegation *dp, int flag)
3186 {
3187         struct file_lock *fl;
3188
3189         fl = locks_alloc_lock();
3190         if (!fl)
3191                 return NULL;
3192         locks_init_lock(fl);
3193         fl->fl_lmops = &nfsd_lease_mng_ops;
3194         fl->fl_flags = FL_DELEG;
3195         fl->fl_type = flag == NFS4_OPEN_DELEGATE_READ? F_RDLCK: F_WRLCK;
3196         fl->fl_end = OFFSET_MAX;
3197         fl->fl_owner = (fl_owner_t)(dp->dl_file);
3198         fl->fl_pid = current->tgid;
3199         return fl;
3200 }
3201
3202 static int nfs4_setlease(struct nfs4_delegation *dp)
3203 {
3204         struct nfs4_file *fp = dp->dl_file;
3205         struct file_lock *fl;
3206         int status;
3207
3208         fl = nfs4_alloc_init_lease(dp, NFS4_OPEN_DELEGATE_READ);
3209         if (!fl)
3210                 return -ENOMEM;
3211         fl->fl_file = find_readable_file(fp);
3212         status = vfs_setlease(fl->fl_file, fl->fl_type, &fl);
3213         if (status)
3214                 goto out_free;
3215         fp->fi_lease = fl;
3216         fp->fi_deleg_file = get_file(fl->fl_file);
3217         atomic_set(&fp->fi_delegees, 1);
3218         spin_lock(&state_lock);
3219         hash_delegation_locked(dp, fp);
3220         spin_unlock(&state_lock);
3221         return 0;
3222 out_free:
3223         locks_free_lock(fl);
3224         return status;
3225 }
3226
3227 static int nfs4_set_delegation(struct nfs4_delegation *dp, struct nfs4_file *fp)
3228 {
3229         if (fp->fi_had_conflict)
3230                 return -EAGAIN;
3231         get_nfs4_file(fp);
3232         dp->dl_file = fp;
3233         if (!fp->fi_lease)
3234                 return nfs4_setlease(dp);
3235         spin_lock(&state_lock);
3236         atomic_inc(&fp->fi_delegees);
3237         if (fp->fi_had_conflict) {
3238                 spin_unlock(&state_lock);
3239                 return -EAGAIN;
3240         }
3241         hash_delegation_locked(dp, fp);
3242         spin_unlock(&state_lock);
3243         return 0;
3244 }
3245
3246 static void nfsd4_open_deleg_none_ext(struct nfsd4_open *open, int status)
3247 {
3248         open->op_delegate_type = NFS4_OPEN_DELEGATE_NONE_EXT;
3249         if (status == -EAGAIN)
3250                 open->op_why_no_deleg = WND4_CONTENTION;
3251         else {
3252                 open->op_why_no_deleg = WND4_RESOURCE;
3253                 switch (open->op_deleg_want) {
3254                 case NFS4_SHARE_WANT_READ_DELEG:
3255                 case NFS4_SHARE_WANT_WRITE_DELEG:
3256                 case NFS4_SHARE_WANT_ANY_DELEG:
3257                         break;
3258                 case NFS4_SHARE_WANT_CANCEL:
3259                         open->op_why_no_deleg = WND4_CANCELLED;
3260                         break;
3261                 case NFS4_SHARE_WANT_NO_DELEG:
3262                         WARN_ON_ONCE(1);
3263                 }
3264         }
3265 }
3266
3267 /*
3268  * Attempt to hand out a delegation.
3269  *
3270  * Note we don't support write delegations, and won't until the vfs has
3271  * proper support for them.
3272  */
3273 static void
3274 nfs4_open_delegation(struct net *net, struct svc_fh *fh,
3275                      struct nfsd4_open *open, struct nfs4_ol_stateid *stp)
3276 {
3277         struct nfs4_delegation *dp;
3278         struct nfs4_openowner *oo = container_of(stp->st_stateowner, struct nfs4_openowner, oo_owner);
3279         int cb_up;
3280         int status = 0;
3281
3282         cb_up = nfsd4_cb_channel_good(oo->oo_owner.so_client);
3283         open->op_recall = 0;
3284         switch (open->op_claim_type) {
3285                 case NFS4_OPEN_CLAIM_PREVIOUS:
3286                         if (!cb_up)
3287                                 open->op_recall = 1;
3288                         if (open->op_delegate_type != NFS4_OPEN_DELEGATE_READ)
3289                                 goto out_no_deleg;
3290                         break;
3291                 case NFS4_OPEN_CLAIM_NULL:
3292                 case NFS4_OPEN_CLAIM_FH:
3293                         /*
3294                          * Let's not give out any delegations till everyone's
3295                          * had the chance to reclaim theirs....
3296                          */
3297                         if (locks_in_grace(net))
3298                                 goto out_no_deleg;
3299                         if (!cb_up || !(oo->oo_flags & NFS4_OO_CONFIRMED))
3300                                 goto out_no_deleg;
3301                         /*
3302                          * Also, if the file was opened for write or
3303                          * create, there's a good chance the client's
3304                          * about to write to it, resulting in an
3305                          * immediate recall (since we don't support
3306                          * write delegations):
3307                          */
3308                         if (open->op_share_access & NFS4_SHARE_ACCESS_WRITE)
3309                                 goto out_no_deleg;
3310                         if (open->op_create == NFS4_OPEN_CREATE)
3311                                 goto out_no_deleg;
3312                         break;
3313                 default:
3314                         goto out_no_deleg;
3315         }
3316         dp = alloc_init_deleg(oo->oo_owner.so_client, stp, fh);
3317         if (dp == NULL)
3318                 goto out_no_deleg;
3319         status = nfs4_set_delegation(dp, stp->st_file);
3320         if (status)
3321                 goto out_free;
3322
3323         memcpy(&open->op_delegate_stateid, &dp->dl_stid.sc_stateid, sizeof(dp->dl_stid.sc_stateid));
3324
3325         dprintk("NFSD: delegation stateid=" STATEID_FMT "\n",
3326                 STATEID_VAL(&dp->dl_stid.sc_stateid));
3327         open->op_delegate_type = NFS4_OPEN_DELEGATE_READ;
3328         return;
3329 out_free:
3330         destroy_delegation(dp);
3331 out_no_deleg:
3332         open->op_delegate_type = NFS4_OPEN_DELEGATE_NONE;
3333         if (open->op_claim_type == NFS4_OPEN_CLAIM_PREVIOUS &&
3334             open->op_delegate_type != NFS4_OPEN_DELEGATE_NONE) {
3335                 dprintk("NFSD: WARNING: refusing delegation reclaim\n");
3336                 open->op_recall = 1;
3337         }
3338
3339         /* 4.1 client asking for a delegation? */
3340         if (open->op_deleg_want)
3341                 nfsd4_open_deleg_none_ext(open, status);
3342         return;
3343 }
3344
3345 static void nfsd4_deleg_xgrade_none_ext(struct nfsd4_open *open,
3346                                         struct nfs4_delegation *dp)
3347 {
3348         if (open->op_deleg_want == NFS4_SHARE_WANT_READ_DELEG &&
3349             dp->dl_type == NFS4_OPEN_DELEGATE_WRITE) {
3350                 open->op_delegate_type = NFS4_OPEN_DELEGATE_NONE_EXT;
3351                 open->op_why_no_deleg = WND4_NOT_SUPP_DOWNGRADE;
3352         } else if (open->op_deleg_want == NFS4_SHARE_WANT_WRITE_DELEG &&
3353                    dp->dl_type == NFS4_OPEN_DELEGATE_WRITE) {
3354                 open->op_delegate_type = NFS4_OPEN_DELEGATE_NONE_EXT;
3355                 open->op_why_no_deleg = WND4_NOT_SUPP_UPGRADE;
3356         }
3357         /* Otherwise the client must be confused wanting a delegation
3358          * it already has, therefore we don't return
3359          * NFS4_OPEN_DELEGATE_NONE_EXT and reason.
3360          */
3361 }
3362
3363 /*
3364  * called with nfs4_lock_state() held.
3365  */
3366 __be32
3367 nfsd4_process_open2(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_open *open)
3368 {
3369         struct nfsd4_compoundres *resp = rqstp->rq_resp;
3370         struct nfs4_client *cl = open->op_openowner->oo_owner.so_client;
3371         struct nfs4_file *fp = NULL;
3372         struct inode *ino = current_fh->fh_dentry->d_inode;
3373         struct nfs4_ol_stateid *stp = NULL;
3374         struct nfs4_delegation *dp = NULL;
3375         __be32 status;
3376
3377         /*
3378          * Lookup file; if found, lookup stateid and check open request,
3379          * and check for delegations in the process of being recalled.
3380          * If not found, create the nfs4_file struct
3381          */
3382         fp = find_or_add_file(ino, open->op_file);
3383         if (fp != open->op_file) {
3384                 if ((status = nfs4_check_open(fp, open, &stp)))
3385                         goto out;
3386                 status = nfs4_check_deleg(cl, open, &dp);
3387                 if (status)
3388                         goto out;
3389         } else {
3390                 open->op_file = NULL;
3391                 status = nfserr_bad_stateid;
3392                 if (nfsd4_is_deleg_cur(open))
3393                         goto out;
3394                 status = nfserr_jukebox;
3395         }
3396
3397         /*
3398          * OPEN the file, or upgrade an existing OPEN.
3399          * If truncate fails, the OPEN fails.
3400          */
3401         if (stp) {
3402                 /* Stateid was found, this is an OPEN upgrade */
3403                 status = nfs4_upgrade_open(rqstp, fp, current_fh, stp, open);
3404                 if (status)
3405                         goto out;
3406         } else {
3407                 status = nfs4_get_vfs_file(rqstp, fp, current_fh, open);
3408                 if (status)
3409                         goto out;
3410                 stp = open->op_stp;
3411                 open->op_stp = NULL;
3412                 init_open_stateid(stp, fp, open);
3413         }
3414         update_stateid(&stp->st_stid.sc_stateid);
3415         memcpy(&open->op_stateid, &stp->st_stid.sc_stateid, sizeof(stateid_t));
3416
3417         if (nfsd4_has_session(&resp->cstate)) {
3418                 if (open->op_deleg_want & NFS4_SHARE_WANT_NO_DELEG) {
3419                         open->op_delegate_type = NFS4_OPEN_DELEGATE_NONE_EXT;
3420                         open->op_why_no_deleg = WND4_NOT_WANTED;
3421                         goto nodeleg;
3422                 }
3423         }
3424
3425         /*
3426         * Attempt to hand out a delegation. No error return, because the
3427         * OPEN succeeds even if we fail.
3428         */
3429         nfs4_open_delegation(SVC_NET(rqstp), current_fh, open, stp);
3430 nodeleg:
3431         status = nfs_ok;
3432
3433         dprintk("%s: stateid=" STATEID_FMT "\n", __func__,
3434                 STATEID_VAL(&stp->st_stid.sc_stateid));
3435 out:
3436         /* 4.1 client trying to upgrade/downgrade delegation? */
3437         if (open->op_delegate_type == NFS4_OPEN_DELEGATE_NONE && dp &&
3438             open->op_deleg_want)
3439                 nfsd4_deleg_xgrade_none_ext(open, dp);
3440
3441         if (fp)
3442                 put_nfs4_file(fp);
3443         if (status == 0 && open->op_claim_type == NFS4_OPEN_CLAIM_PREVIOUS)
3444                 nfs4_set_claim_prev(open, nfsd4_has_session(&resp->cstate));
3445         /*
3446         * To finish the open response, we just need to set the rflags.
3447         */
3448         open->op_rflags = NFS4_OPEN_RESULT_LOCKTYPE_POSIX;
3449         if (!(open->op_openowner->oo_flags & NFS4_OO_CONFIRMED) &&
3450             !nfsd4_has_session(&resp->cstate))
3451                 open->op_rflags |= NFS4_OPEN_RESULT_CONFIRM;
3452
3453         return status;
3454 }
3455
3456 void nfsd4_cleanup_open_state(struct nfsd4_open *open, __be32 status)
3457 {
3458         if (open->op_openowner) {
3459                 struct nfs4_openowner *oo = open->op_openowner;
3460
3461                 if (!list_empty(&oo->oo_owner.so_stateids))
3462                         list_del_init(&oo->oo_close_lru);
3463                 if (oo->oo_flags & NFS4_OO_NEW) {
3464                         if (status) {
3465                                 release_openowner(oo);
3466                                 open->op_openowner = NULL;
3467                         } else
3468                                 oo->oo_flags &= ~NFS4_OO_NEW;
3469                 }
3470         }
3471         if (open->op_file)
3472                 nfsd4_free_file(open->op_file);
3473         if (open->op_stp)
3474                 free_generic_stateid(open->op_stp);
3475 }
3476
3477 static __be32 lookup_clientid(clientid_t *clid, bool session, struct nfsd_net *nn, struct nfs4_client **clp)
3478 {
3479         struct nfs4_client *found;
3480
3481         if (STALE_CLIENTID(clid, nn))
3482                 return nfserr_stale_clientid;
3483         found = find_confirmed_client(clid, session, nn);
3484         if (clp)
3485                 *clp = found;
3486         return found ? nfs_ok : nfserr_expired;
3487 }
3488
3489 __be32
3490 nfsd4_renew(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
3491             clientid_t *clid)
3492 {
3493         struct nfs4_client *clp;
3494         __be32 status;
3495         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
3496
3497         nfs4_lock_state();
3498         dprintk("process_renew(%08x/%08x): starting\n",
3499                         clid->cl_boot, clid->cl_id);
3500         status = lookup_clientid(clid, cstate->minorversion, nn, &clp);
3501         if (status)
3502                 goto out;
3503         status = nfserr_cb_path_down;
3504         if (!list_empty(&clp->cl_delegations)
3505                         && clp->cl_cb_state != NFSD4_CB_UP)
3506                 goto out;
3507         status = nfs_ok;
3508 out:
3509         nfs4_unlock_state();
3510         return status;
3511 }
3512
3513 static void
3514 nfsd4_end_grace(struct nfsd_net *nn)
3515 {
3516         /* do nothing if grace period already ended */
3517         if (nn->grace_ended)
3518                 return;
3519
3520         dprintk("NFSD: end of grace period\n");
3521         nn->grace_ended = true;
3522         nfsd4_record_grace_done(nn, nn->boot_time);
3523         locks_end_grace(&nn->nfsd4_manager);
3524         /*
3525          * Now that every NFSv4 client has had the chance to recover and
3526          * to see the (possibly new, possibly shorter) lease time, we
3527          * can safely set the next grace time to the current lease time:
3528          */
3529         nn->nfsd4_grace = nn->nfsd4_lease;
3530 }
3531
3532 static time_t
3533 nfs4_laundromat(struct nfsd_net *nn)
3534 {
3535         struct nfs4_client *clp;
3536         struct nfs4_openowner *oo;
3537         struct nfs4_delegation *dp;
3538         struct list_head *pos, *next, reaplist;
3539         time_t cutoff = get_seconds() - nn->nfsd4_lease;
3540         time_t t, new_timeo = nn->nfsd4_lease;
3541
3542         nfs4_lock_state();
3543
3544         dprintk("NFSD: laundromat service - starting\n");
3545         nfsd4_end_grace(nn);
3546         INIT_LIST_HEAD(&reaplist);
3547         spin_lock(&nn->client_lock);
3548         list_for_each_safe(pos, next, &nn->client_lru) {
3549                 clp = list_entry(pos, struct nfs4_client, cl_lru);
3550                 if (time_after((unsigned long)clp->cl_time, (unsigned long)cutoff)) {
3551                         t = clp->cl_time - cutoff;
3552                         new_timeo = min(new_timeo, t);
3553                         break;
3554                 }
3555                 if (mark_client_expired_locked(clp)) {
3556                         dprintk("NFSD: client in use (clientid %08x)\n",
3557                                 clp->cl_clientid.cl_id);
3558                         continue;
3559                 }
3560                 list_move(&clp->cl_lru, &reaplist);
3561         }
3562         spin_unlock(&nn->client_lock);
3563         list_for_each_safe(pos, next, &reaplist) {
3564                 clp = list_entry(pos, struct nfs4_client, cl_lru);
3565                 dprintk("NFSD: purging unused client (clientid %08x)\n",
3566                         clp->cl_clientid.cl_id);
3567                 expire_client(clp);
3568         }
3569         spin_lock(&state_lock);
3570         list_for_each_safe(pos, next, &nn->del_recall_lru) {
3571                 dp = list_entry (pos, struct nfs4_delegation, dl_recall_lru);
3572                 if (net_generic(dp->dl_stid.sc_client->net, nfsd_net_id) != nn)
3573                         continue;
3574                 if (time_after((unsigned long)dp->dl_time, (unsigned long)cutoff)) {
3575                         t = dp->dl_time - cutoff;
3576                         new_timeo = min(new_timeo, t);
3577                         break;
3578                 }
3579                 list_move(&dp->dl_recall_lru, &reaplist);
3580         }
3581         spin_unlock(&state_lock);
3582         list_for_each_safe(pos, next, &reaplist) {
3583                 dp = list_entry (pos, struct nfs4_delegation, dl_recall_lru);
3584                 revoke_delegation(dp);
3585         }
3586         list_for_each_safe(pos, next, &nn->close_lru) {
3587                 oo = container_of(pos, struct nfs4_openowner, oo_close_lru);
3588                 if (time_after((unsigned long)oo->oo_time, (unsigned long)cutoff)) {
3589                         t = oo->oo_time - cutoff;
3590                         new_timeo = min(new_timeo, t);
3591                         break;
3592                 }
3593                 release_openowner(oo);
3594         }
3595         new_timeo = max_t(time_t, new_timeo, NFSD_LAUNDROMAT_MINTIMEOUT);
3596         nfs4_unlock_state();
3597         return new_timeo;
3598 }
3599
3600 static struct workqueue_struct *laundry_wq;
3601 static void laundromat_main(struct work_struct *);
3602
3603 static void
3604 laundromat_main(struct work_struct *laundry)
3605 {
3606         time_t t;
3607         struct delayed_work *dwork = container_of(laundry, struct delayed_work,
3608                                                   work);
3609         struct nfsd_net *nn = container_of(dwork, struct nfsd_net,
3610                                            laundromat_work);
3611
3612         t = nfs4_laundromat(nn);
3613         dprintk("NFSD: laundromat_main - sleeping for %ld seconds\n", t);
3614         queue_delayed_work(laundry_wq, &nn->laundromat_work, t*HZ);
3615 }
3616
3617 static inline __be32 nfs4_check_fh(struct svc_fh *fhp, struct nfs4_ol_stateid *stp)
3618 {
3619         if (fhp->fh_dentry->d_inode != stp->st_file->fi_inode)
3620                 return nfserr_bad_stateid;
3621         return nfs_ok;
3622 }
3623
3624 static inline int
3625 access_permit_read(struct nfs4_ol_stateid *stp)
3626 {
3627         return test_access(NFS4_SHARE_ACCESS_READ, stp) ||
3628                 test_access(NFS4_SHARE_ACCESS_BOTH, stp) ||
3629                 test_access(NFS4_SHARE_ACCESS_WRITE, stp);
3630 }
3631
3632 static inline int
3633 access_permit_write(struct nfs4_ol_stateid *stp)
3634 {
3635         return test_access(NFS4_SHARE_ACCESS_WRITE, stp) ||
3636                 test_access(NFS4_SHARE_ACCESS_BOTH, stp);
3637 }
3638
3639 static
3640 __be32 nfs4_check_openmode(struct nfs4_ol_stateid *stp, int flags)
3641 {
3642         __be32 status = nfserr_openmode;
3643
3644         /* For lock stateid's, we test the parent open, not the lock: */
3645         if (stp->st_openstp)
3646                 stp = stp->st_openstp;
3647         if ((flags & WR_STATE) && !access_permit_write(stp))
3648                 goto out;
3649         if ((flags & RD_STATE) && !access_permit_read(stp))
3650                 goto out;
3651         status = nfs_ok;
3652 out:
3653         return status;
3654 }
3655
3656 static inline __be32
3657 check_special_stateids(struct net *net, svc_fh *current_fh, stateid_t *stateid, int flags)
3658 {
3659         if (ONE_STATEID(stateid) && (flags & RD_STATE))
3660                 return nfs_ok;
3661         else if (locks_in_grace(net)) {
3662                 /* Answer in remaining cases depends on existence of
3663                  * conflicting state; so we must wait out the grace period. */
3664                 return nfserr_grace;
3665         } else if (flags & WR_STATE)
3666                 return nfs4_share_conflict(current_fh,
3667                                 NFS4_SHARE_DENY_WRITE);
3668         else /* (flags & RD_STATE) && ZERO_STATEID(stateid) */
3669                 return nfs4_share_conflict(current_fh,
3670                                 NFS4_SHARE_DENY_READ);
3671 }
3672
3673 /*
3674  * Allow READ/WRITE during grace period on recovered state only for files
3675  * that are not able to provide mandatory locking.
3676  */
3677 static inline int
3678 grace_disallows_io(struct net *net, struct inode *inode)
3679 {
3680         return locks_in_grace(net) && mandatory_lock(inode);
3681 }
3682
3683 /* Returns true iff a is later than b: */
3684 static bool stateid_generation_after(stateid_t *a, stateid_t *b)
3685 {
3686         return (s32)(a->si_generation - b->si_generation) > 0;
3687 }
3688
3689 static __be32 check_stateid_generation(stateid_t *in, stateid_t *ref, bool has_session)
3690 {
3691         /*
3692          * When sessions are used the stateid generation number is ignored
3693          * when it is zero.
3694          */
3695         if (has_session && in->si_generation == 0)
3696                 return nfs_ok;
3697
3698         if (in->si_generation == ref->si_generation)
3699                 return nfs_ok;
3700
3701         /* If the client sends us a stateid from the future, it's buggy: */
3702         if (stateid_generation_after(in, ref))
3703                 return nfserr_bad_stateid;
3704         /*
3705          * However, we could see a stateid from the past, even from a
3706          * non-buggy client.  For example, if the client sends a lock
3707          * while some IO is outstanding, the lock may bump si_generation
3708          * while the IO is still in flight.  The client could avoid that
3709          * situation by waiting for responses on all the IO requests,
3710          * but better performance may result in retrying IO that
3711          * receives an old_stateid error if requests are rarely
3712          * reordered in flight:
3713          */
3714         return nfserr_old_stateid;
3715 }
3716
3717 static __be32 nfsd4_validate_stateid(struct nfs4_client *cl, stateid_t *stateid)
3718 {
3719         struct nfs4_stid *s;
3720         struct nfs4_ol_stateid *ols;
3721         __be32 status;
3722
3723         if (ZERO_STATEID(stateid) || ONE_STATEID(stateid))
3724                 return nfserr_bad_stateid;
3725         /* Client debugging aid. */
3726         if (!same_clid(&stateid->si_opaque.so_clid, &cl->cl_clientid)) {
3727                 char addr_str[INET6_ADDRSTRLEN];
3728                 rpc_ntop((struct sockaddr *)&cl->cl_addr, addr_str,
3729                                  sizeof(addr_str));
3730                 pr_warn_ratelimited("NFSD: client %s testing state ID "
3731                                         "with incorrect client ID\n", addr_str);
3732                 return nfserr_bad_stateid;
3733         }
3734         s = find_stateid(cl, stateid);
3735         if (!s)
3736                 return nfserr_bad_stateid;
3737         status = check_stateid_generation(stateid, &s->sc_stateid, 1);
3738         if (status)
3739                 return status;
3740         switch (s->sc_type) {
3741         case NFS4_DELEG_STID:
3742                 return nfs_ok;
3743         case NFS4_REVOKED_DELEG_STID:
3744                 return nfserr_deleg_revoked;
3745         case NFS4_OPEN_STID:
3746         case NFS4_LOCK_STID:
3747                 ols = openlockstateid(s);
3748                 if (ols->st_stateowner->so_is_open_owner
3749                                 && !(openowner(ols->st_stateowner)->oo_flags
3750                                                 & NFS4_OO_CONFIRMED))
3751                         return nfserr_bad_stateid;
3752                 return nfs_ok;
3753         default:
3754                 printk("unknown stateid type %x\n", s->sc_type);
3755         case NFS4_CLOSED_STID:
3756                 return nfserr_bad_stateid;
3757         }
3758 }
3759
3760 static __be32 nfsd4_lookup_stateid(stateid_t *stateid, unsigned char typemask,
3761                                    struct nfs4_stid **s, bool sessions,
3762                                    struct nfsd_net *nn)
3763 {
3764         struct nfs4_client *cl;
3765         __be32 status;
3766
3767         if (ZERO_STATEID(stateid) || ONE_STATEID(stateid))
3768                 return nfserr_bad_stateid;
3769         status = lookup_clientid(&stateid->si_opaque.so_clid, sessions,
3770                                                         nn, &cl);
3771         if (status == nfserr_stale_clientid) {
3772                 if (sessions)
3773                         return nfserr_bad_stateid;
3774                 return nfserr_stale_stateid;
3775         }
3776         if (status)
3777                 return status;
3778         *s = find_stateid_by_type(cl, stateid, typemask);
3779         if (!*s)
3780                 return nfserr_bad_stateid;
3781         return nfs_ok;
3782 }
3783
3784 /*
3785 * Checks for stateid operations
3786 */
3787 __be32
3788 nfs4_preprocess_stateid_op(struct net *net, struct nfsd4_compound_state *cstate,
3789                            stateid_t *stateid, int flags, struct file **filpp)
3790 {
3791         struct nfs4_stid *s;
3792         struct nfs4_ol_stateid *stp = NULL;
3793         struct nfs4_delegation *dp = NULL;
3794         struct svc_fh *current_fh = &cstate->current_fh;
3795         struct inode *ino = current_fh->fh_dentry->d_inode;
3796         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
3797         struct file *file = NULL;
3798         __be32 status;
3799
3800         if (filpp)
3801                 *filpp = NULL;
3802
3803         if (grace_disallows_io(net, ino))
3804                 return nfserr_grace;
3805
3806         if (ZERO_STATEID(stateid) || ONE_STATEID(stateid))
3807                 return check_special_stateids(net, current_fh, stateid, flags);
3808
3809         nfs4_lock_state();
3810
3811         status = nfsd4_lookup_stateid(stateid,
3812                                 NFS4_DELEG_STID|NFS4_OPEN_STID|NFS4_LOCK_STID,
3813                                 &s, cstate->minorversion, nn);
3814         if (status)
3815                 goto out;
3816         status = check_stateid_generation(stateid, &s->sc_stateid, nfsd4_has_session(cstate));
3817         if (status)
3818                 goto out;
3819         switch (s->sc_type) {
3820         case NFS4_DELEG_STID:
3821                 dp = delegstateid(s);
3822                 status = nfs4_check_delegmode(dp, flags);
3823                 if (status)
3824                         goto out;
3825                 if (filpp) {
3826                         file = dp->dl_file->fi_deleg_file;
3827                         if (!file) {
3828                                 WARN_ON_ONCE(1);
3829                                 status = nfserr_serverfault;
3830                                 goto out;
3831                         }
3832                 }
3833                 break;
3834         case NFS4_OPEN_STID:
3835         case NFS4_LOCK_STID:
3836                 stp = openlockstateid(s);
3837                 status = nfs4_check_fh(current_fh, stp);
3838                 if (status)
3839                         goto out;
3840                 if (stp->st_stateowner->so_is_open_owner
3841                     && !(openowner(stp->st_stateowner)->oo_flags & NFS4_OO_CONFIRMED))
3842                         goto out;
3843                 status = nfs4_check_openmode(stp, flags);
3844                 if (status)
3845                         goto out;
3846                 if (filpp) {
3847                         if (flags & RD_STATE)
3848                                 file = find_readable_file(stp->st_file);
3849                         else
3850                                 file = find_writeable_file(stp->st_file);
3851                 }
3852                 break;
3853         default:
3854                 status = nfserr_bad_stateid;
3855                 goto out;
3856         }
3857         status = nfs_ok;
3858         if (file)
3859                 *filpp = get_file(file);
3860 out:
3861         nfs4_unlock_state();
3862         return status;
3863 }
3864
3865 static __be32
3866 nfsd4_free_lock_stateid(struct nfs4_ol_stateid *stp)
3867 {
3868         struct nfs4_lockowner *lo = lockowner(stp->st_stateowner);
3869
3870         if (check_for_locks(stp->st_file, lo))
3871                 return nfserr_locks_held;
3872         release_lockowner_if_empty(lo);
3873         return nfs_ok;
3874 }
3875
3876 /*
3877  * Test if the stateid is valid
3878  */
3879 __be32
3880 nfsd4_test_stateid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
3881                    struct nfsd4_test_stateid *test_stateid)
3882 {
3883         struct nfsd4_test_stateid_id *stateid;
3884         struct nfs4_client *cl = cstate->session->se_client;
3885
3886         nfs4_lock_state();
3887         list_for_each_entry(stateid, &test_stateid->ts_stateid_list, ts_id_list)
3888                 stateid->ts_id_status =
3889                         nfsd4_validate_stateid(cl, &stateid->ts_id_stateid);
3890         nfs4_unlock_state();
3891
3892         return nfs_ok;
3893 }
3894
3895 __be32
3896 nfsd4_free_stateid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
3897                    struct nfsd4_free_stateid *free_stateid)
3898 {
3899         stateid_t *stateid = &free_stateid->fr_stateid;
3900         struct nfs4_stid *s;
3901         struct nfs4_delegation *dp;
3902         struct nfs4_client *cl = cstate->session->se_client;
3903         __be32 ret = nfserr_bad_stateid;
3904
3905         nfs4_lock_state();
3906         s = find_stateid(cl, stateid);
3907         if (!s)
3908                 goto out;
3909         switch (s->sc_type) {
3910         case NFS4_DELEG_STID:
3911                 ret = nfserr_locks_held;
3912                 goto out;
3913         case NFS4_OPEN_STID:
3914         case NFS4_LOCK_STID:
3915                 ret = check_stateid_generation(stateid, &s->sc_stateid, 1);
3916                 if (ret)
3917                         goto out;
3918                 if (s->sc_type == NFS4_LOCK_STID)
3919                         ret = nfsd4_free_lock_stateid(openlockstateid(s));
3920                 else
3921                         ret = nfserr_locks_held;
3922                 break;
3923         case NFS4_REVOKED_DELEG_STID:
3924                 dp = delegstateid(s);
3925                 destroy_revoked_delegation(dp);
3926                 ret = nfs_ok;
3927                 break;
3928         default:
3929                 ret = nfserr_bad_stateid;
3930         }
3931 out:
3932         nfs4_unlock_state();
3933         return ret;
3934 }
3935
3936 static inline int
3937 setlkflg (int type)
3938 {
3939         return (type == NFS4_READW_LT || type == NFS4_READ_LT) ?
3940                 RD_STATE : WR_STATE;
3941 }
3942
3943 static __be32 nfs4_seqid_op_checks(struct nfsd4_compound_state *cstate, stateid_t *stateid, u32 seqid, struct nfs4_ol_stateid *stp)
3944 {
3945         struct svc_fh *current_fh = &cstate->current_fh;
3946         struct nfs4_stateowner *sop = stp->st_stateowner;
3947         __be32 status;
3948
3949         status = nfsd4_check_seqid(cstate, sop, seqid);
3950         if (status)
3951                 return status;
3952         if (stp->st_stid.sc_type == NFS4_CLOSED_STID
3953                 || stp->st_stid.sc_type == NFS4_REVOKED_DELEG_STID)
3954                 /*
3955                  * "Closed" stateid's exist *only* to return
3956                  * nfserr_replay_me from the previous step, and
3957                  * revoked delegations are kept only for free_stateid.
3958                  */
3959                 return nfserr_bad_stateid;
3960         status = check_stateid_generation(stateid, &stp->st_stid.sc_stateid, nfsd4_has_session(cstate));
3961         if (status)
3962                 return status;
3963         return nfs4_check_fh(current_fh, stp);
3964 }
3965
3966 /*
3967  * Checks for sequence id mutating operations.
3968  */
3969 static __be32
3970 nfs4_preprocess_seqid_op(struct nfsd4_compound_state *cstate, u32 seqid,
3971                          stateid_t *stateid, char typemask,
3972                          struct nfs4_ol_stateid **stpp,
3973                          struct nfsd_net *nn)
3974 {
3975         __be32 status;
3976         struct nfs4_stid *s;
3977         struct nfs4_ol_stateid *stp = NULL;
3978
3979         dprintk("NFSD: %s: seqid=%d stateid = " STATEID_FMT "\n", __func__,
3980                 seqid, STATEID_VAL(stateid));
3981
3982         *stpp = NULL;
3983         status = nfsd4_lookup_stateid(stateid, typemask, &s,
3984                                       cstate->minorversion, nn);
3985         if (status)
3986                 return status;
3987         stp = openlockstateid(s);
3988         if (!nfsd4_has_session(cstate))
3989                 cstate->replay_owner = stp->st_stateowner;
3990
3991         status = nfs4_seqid_op_checks(cstate, stateid, seqid, stp);
3992         if (!status)
3993                 *stpp = stp;
3994         return status;
3995 }
3996
3997 static __be32 nfs4_preprocess_confirmed_seqid_op(struct nfsd4_compound_state *cstate, u32 seqid,
3998                                                  stateid_t *stateid, struct nfs4_ol_stateid **stpp, struct nfsd_net *nn)
3999 {
4000         __be32 status;
4001         struct nfs4_openowner *oo;
4002
4003         status = nfs4_preprocess_seqid_op(cstate, seqid, stateid,
4004                                                 NFS4_OPEN_STID, stpp, nn);
4005         if (status)
4006                 return status;
4007         oo = openowner((*stpp)->st_stateowner);
4008         if (!(oo->oo_flags & NFS4_OO_CONFIRMED))
4009                 return nfserr_bad_stateid;
4010         return nfs_ok;
4011 }
4012
4013 __be32
4014 nfsd4_open_confirm(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
4015                    struct nfsd4_open_confirm *oc)
4016 {
4017         __be32 status;
4018         struct nfs4_openowner *oo;
4019         struct nfs4_ol_stateid *stp;
4020         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
4021
4022         dprintk("NFSD: nfsd4_open_confirm on file %pd\n",
4023                         cstate->current_fh.fh_dentry);
4024
4025         status = fh_verify(rqstp, &cstate->current_fh, S_IFREG, 0);
4026         if (status)
4027                 return status;
4028
4029         nfs4_lock_state();
4030
4031         status = nfs4_preprocess_seqid_op(cstate,
4032                                         oc->oc_seqid, &oc->oc_req_stateid,
4033                                         NFS4_OPEN_STID, &stp, nn);
4034         if (status)
4035                 goto out;
4036         oo = openowner(stp->st_stateowner);
4037         status = nfserr_bad_stateid;
4038         if (oo->oo_flags & NFS4_OO_CONFIRMED)
4039                 goto out;
4040         oo->oo_flags |= NFS4_OO_CONFIRMED;
4041         update_stateid(&stp->st_stid.sc_stateid);
4042         memcpy(&oc->oc_resp_stateid, &stp->st_stid.sc_stateid, sizeof(stateid_t));
4043         dprintk("NFSD: %s: success, seqid=%d stateid=" STATEID_FMT "\n",
4044                 __func__, oc->oc_seqid, STATEID_VAL(&stp->st_stid.sc_stateid));
4045
4046         nfsd4_client_record_create(oo->oo_owner.so_client);
4047         status = nfs_ok;
4048 out:
4049         nfsd4_bump_seqid(cstate, status);
4050         if (!cstate->replay_owner)
4051                 nfs4_unlock_state();
4052         return status;
4053 }
4054
4055 static inline void nfs4_stateid_downgrade_bit(struct nfs4_ol_stateid *stp, u32 access)
4056 {
4057         if (!test_access(access, stp))
4058                 return;
4059         nfs4_file_put_access(stp->st_file, nfs4_access_to_omode(access));
4060         clear_access(access, stp);
4061 }
4062
4063 static inline void nfs4_stateid_downgrade(struct nfs4_ol_stateid *stp, u32 to_access)
4064 {
4065         switch (to_access) {
4066         case NFS4_SHARE_ACCESS_READ:
4067                 nfs4_stateid_downgrade_bit(stp, NFS4_SHARE_ACCESS_WRITE);
4068                 nfs4_stateid_downgrade_bit(stp, NFS4_SHARE_ACCESS_BOTH);
4069                 break;
4070         case NFS4_SHARE_ACCESS_WRITE:
4071                 nfs4_stateid_downgrade_bit(stp, NFS4_SHARE_ACCESS_READ);
4072                 nfs4_stateid_downgrade_bit(stp, NFS4_SHARE_ACCESS_BOTH);
4073                 break;
4074         case NFS4_SHARE_ACCESS_BOTH:
4075                 break;
4076         default:
4077                 WARN_ON_ONCE(1);
4078         }
4079 }
4080
4081 static void
4082 reset_union_bmap_deny(unsigned long deny, struct nfs4_ol_stateid *stp)
4083 {
4084         int i;
4085         for (i = 0; i < 4; i++) {
4086                 if ((i & deny) != i)
4087                         clear_deny(i, stp);
4088         }
4089 }
4090
4091 __be32
4092 nfsd4_open_downgrade(struct svc_rqst *rqstp,
4093                      struct nfsd4_compound_state *cstate,
4094                      struct nfsd4_open_downgrade *od)
4095 {
4096         __be32 status;
4097         struct nfs4_ol_stateid *stp;
4098         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
4099
4100         dprintk("NFSD: nfsd4_open_downgrade on file %pd\n",
4101                         cstate->current_fh.fh_dentry);
4102
4103         /* We don't yet support WANT bits: */
4104         if (od->od_deleg_want)
4105                 dprintk("NFSD: %s: od_deleg_want=0x%x ignored\n", __func__,
4106                         od->od_deleg_want);
4107
4108         nfs4_lock_state();
4109         status = nfs4_preprocess_confirmed_seqid_op(cstate, od->od_seqid,
4110                                         &od->od_stateid, &stp, nn);
4111         if (status)
4112                 goto out;
4113         status = nfserr_inval;
4114         if (!test_access(od->od_share_access, stp)) {
4115                 dprintk("NFSD: access not a subset current bitmap: 0x%lx, input access=%08x\n",
4116                         stp->st_access_bmap, od->od_share_access);
4117                 goto out;
4118         }
4119         if (!test_deny(od->od_share_deny, stp)) {
4120                 dprintk("NFSD:deny not a subset current bitmap: 0x%lx, input deny=%08x\n",
4121                         stp->st_deny_bmap, od->od_share_deny);
4122                 goto out;
4123         }
4124         nfs4_stateid_downgrade(stp, od->od_share_access);
4125
4126         reset_union_bmap_deny(od->od_share_deny, stp);
4127
4128         update_stateid(&stp->st_stid.sc_stateid);
4129         memcpy(&od->od_stateid, &stp->st_stid.sc_stateid, sizeof(stateid_t));
4130         status = nfs_ok;
4131 out:
4132         nfsd4_bump_seqid(cstate, status);
4133         if (!cstate->replay_owner)
4134                 nfs4_unlock_state();
4135         return status;
4136 }
4137
4138 static void nfsd4_close_open_stateid(struct nfs4_ol_stateid *s)
4139 {
4140         struct nfs4_client *clp = s->st_stid.sc_client;
4141         struct nfs4_openowner *oo = openowner(s->st_stateowner);
4142
4143         s->st_stid.sc_type = NFS4_CLOSED_STID;
4144         unhash_open_stateid(s);
4145
4146         if (clp->cl_minorversion) {
4147                 free_generic_stateid(s);
4148                 if (list_empty(&oo->oo_owner.so_stateids))
4149                         release_openowner(oo);
4150         } else {
4151                 oo->oo_last_closed_stid = s;
4152                 /*
4153                  * In the 4.0 case we need to keep the owners around a
4154                  * little while to handle CLOSE replay.
4155                  */
4156                 if (list_empty(&oo->oo_owner.so_stateids))
4157                         move_to_close_lru(oo, clp->net);
4158         }
4159 }
4160
4161 /*
4162  * nfs4_unlock_state() called after encode
4163  */
4164 __be32
4165 nfsd4_close(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
4166             struct nfsd4_close *close)
4167 {
4168         __be32 status;
4169         struct nfs4_ol_stateid *stp;
4170         struct net *net = SVC_NET(rqstp);
4171         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
4172
4173         dprintk("NFSD: nfsd4_close on file %pd\n",
4174                         cstate->current_fh.fh_dentry);
4175
4176         nfs4_lock_state();
4177         status = nfs4_preprocess_seqid_op(cstate, close->cl_seqid,
4178                                         &close->cl_stateid,
4179                                         NFS4_OPEN_STID|NFS4_CLOSED_STID,
4180                                         &stp, nn);
4181         nfsd4_bump_seqid(cstate, status);
4182         if (status)
4183                 goto out;
4184         update_stateid(&stp->st_stid.sc_stateid);
4185         memcpy(&close->cl_stateid, &stp->st_stid.sc_stateid, sizeof(stateid_t));
4186
4187         nfsd4_close_open_stateid(stp);
4188 out:
4189         if (!cstate->replay_owner)
4190                 nfs4_unlock_state();
4191         return status;
4192 }
4193
4194 __be32
4195 nfsd4_delegreturn(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
4196                   struct nfsd4_delegreturn *dr)
4197 {
4198         struct nfs4_delegation *dp;
4199         stateid_t *stateid = &dr->dr_stateid;
4200         struct nfs4_stid *s;
4201         __be32 status;
4202         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
4203
4204         if ((status = fh_verify(rqstp, &cstate->current_fh, S_IFREG, 0)))
4205                 return status;
4206
4207         nfs4_lock_state();
4208         status = nfsd4_lookup_stateid(stateid, NFS4_DELEG_STID, &s,
4209                                       cstate->minorversion, nn);
4210         if (status)
4211                 goto out;
4212         dp = delegstateid(s);
4213         status = check_stateid_generation(stateid, &dp->dl_stid.sc_stateid, nfsd4_has_session(cstate));
4214         if (status)
4215                 goto out;
4216
4217         destroy_delegation(dp);
4218 out:
4219         nfs4_unlock_state();
4220
4221         return status;
4222 }
4223
4224
4225 #define LOFF_OVERFLOW(start, len)      ((u64)(len) > ~(u64)(start))
4226
4227 static inline u64
4228 end_offset(u64 start, u64 len)
4229 {
4230         u64 end;
4231
4232         end = start + len;
4233         return end >= start ? end: NFS4_MAX_UINT64;
4234 }
4235
4236 /* last octet in a range */
4237 static inline u64
4238 last_byte_offset(u64 start, u64 len)
4239 {
4240         u64 end;
4241
4242         WARN_ON_ONCE(!len);
4243         end = start + len;
4244         return end > start ? end - 1: NFS4_MAX_UINT64;
4245 }
4246
4247 /*
4248  * TODO: Linux file offsets are _signed_ 64-bit quantities, which means that
4249  * we can't properly handle lock requests that go beyond the (2^63 - 1)-th
4250  * byte, because of sign extension problems.  Since NFSv4 calls for 64-bit
4251  * locking, this prevents us from being completely protocol-compliant.  The
4252  * real solution to this problem is to start using unsigned file offsets in
4253  * the VFS, but this is a very deep change!
4254  */
4255 static inline void
4256 nfs4_transform_lock_offset(struct file_lock *lock)
4257 {
4258         if (lock->fl_start < 0)
4259                 lock->fl_start = OFFSET_MAX;
4260         if (lock->fl_end < 0)
4261                 lock->fl_end = OFFSET_MAX;
4262 }
4263
4264 /* Hack!: For now, we're defining this just so we can use a pointer to it
4265  * as a unique cookie to identify our (NFSv4's) posix locks. */
4266 static const struct lock_manager_operations nfsd_posix_mng_ops  = {
4267 };
4268
4269 static inline void
4270 nfs4_set_lock_denied(struct file_lock *fl, struct nfsd4_lock_denied *deny)
4271 {
4272         struct nfs4_lockowner *lo;
4273
4274         if (fl->fl_lmops == &nfsd_posix_mng_ops) {
4275                 lo = (struct nfs4_lockowner *) fl->fl_owner;
4276                 deny->ld_owner.data = kmemdup(lo->lo_owner.so_owner.data,
4277                                         lo->lo_owner.so_owner.len, GFP_KERNEL);
4278                 if (!deny->ld_owner.data)
4279                         /* We just don't care that much */
4280                         goto nevermind;
4281                 deny->ld_owner.len = lo->lo_owner.so_owner.len;
4282                 deny->ld_clientid = lo->lo_owner.so_client->cl_clientid;
4283         } else {
4284 nevermind:
4285                 deny->ld_owner.len = 0;
4286                 deny->ld_owner.data = NULL;
4287                 deny->ld_clientid.cl_boot = 0;
4288                 deny->ld_clientid.cl_id = 0;
4289         }
4290         deny->ld_start = fl->fl_start;
4291         deny->ld_length = NFS4_MAX_UINT64;
4292         if (fl->fl_end != NFS4_MAX_UINT64)
4293                 deny->ld_length = fl->fl_end - fl->fl_start + 1;
4294         deny->ld_type = NFS4_READ_LT;
4295         if (fl->fl_type != F_RDLCK)
4296                 deny->ld_type = NFS4_WRITE_LT;
4297 }
4298
4299 static struct nfs4_lockowner *
4300 find_lockowner_str(clientid_t *clid, struct xdr_netobj *owner,
4301                 struct nfsd_net *nn)
4302 {
4303         unsigned int strhashval = ownerstr_hashval(clid->cl_id, owner);
4304         struct nfs4_stateowner *so;
4305
4306         list_for_each_entry(so, &nn->ownerstr_hashtbl[strhashval], so_strhash) {
4307                 if (so->so_is_open_owner)
4308                         continue;
4309                 if (!same_owner_str(so, owner, clid))
4310                         continue;
4311                 return lockowner(so);
4312         }
4313         return NULL;
4314 }
4315
4316 /*
4317  * Alloc a lock owner structure.
4318  * Called in nfsd4_lock - therefore, OPEN and OPEN_CONFIRM (if needed) has
4319  * occurred.
4320  *
4321  * strhashval = ownerstr_hashval
4322  */
4323 static struct nfs4_lockowner *
4324 alloc_init_lock_stateowner(unsigned int strhashval, struct nfs4_client *clp, struct nfs4_ol_stateid *open_stp, struct nfsd4_lock *lock) {
4325         struct nfs4_lockowner *lo;
4326         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
4327
4328         lo = alloc_stateowner(lockowner_slab, &lock->lk_new_owner, clp);
4329         if (!lo)
4330                 return NULL;
4331         INIT_LIST_HEAD(&lo->lo_owner.so_stateids);
4332         lo->lo_owner.so_is_open_owner = 0;
4333         /* It is the openowner seqid that will be incremented in encode in the
4334          * case of new lockowners; so increment the lock seqid manually: */
4335         lo->lo_owner.so_seqid = lock->lk_new_lock_seqid + 1;
4336         list_add(&lo->lo_owner.so_strhash, &nn->ownerstr_hashtbl[strhashval]);
4337         return lo;
4338 }
4339
4340 static struct nfs4_ol_stateid *
4341 alloc_init_lock_stateid(struct nfs4_lockowner *lo, struct nfs4_file *fp, struct nfs4_ol_stateid *open_stp)
4342 {
4343         struct nfs4_ol_stateid *stp;
4344         struct nfs4_client *clp = lo->lo_owner.so_client;
4345
4346         stp = nfs4_alloc_stateid(clp);
4347         if (stp == NULL)
4348                 return NULL;
4349         stp->st_stid.sc_type = NFS4_LOCK_STID;
4350         list_add(&stp->st_perfile, &fp->fi_stateids);
4351         list_add(&stp->st_perstateowner, &lo->lo_owner.so_stateids);
4352         stp->st_stateowner = &lo->lo_owner;
4353         get_nfs4_file(fp);
4354         stp->st_file = fp;
4355         stp->st_access_bmap = 0;
4356         stp->st_deny_bmap = open_stp->st_deny_bmap;
4357         stp->st_openstp = open_stp;
4358         list_add(&stp->st_locks, &open_stp->st_locks);
4359         return stp;
4360 }
4361
4362 static struct nfs4_ol_stateid *
4363 find_lock_stateid(struct nfs4_lockowner *lo, struct nfs4_file *fp)
4364 {
4365         struct nfs4_ol_stateid *lst;
4366
4367         list_for_each_entry(lst, &lo->lo_owner.so_stateids, st_perstateowner) {
4368                 if (lst->st_file == fp)
4369                         return lst;
4370         }
4371         return NULL;
4372 }
4373
4374
4375 static int
4376 check_lock_length(u64 offset, u64 length)
4377 {
4378         return ((length == 0)  || ((length != NFS4_MAX_UINT64) &&
4379              LOFF_OVERFLOW(offset, length)));
4380 }
4381
4382 static void get_lock_access(struct nfs4_ol_stateid *lock_stp, u32 access)
4383 {
4384         struct nfs4_file *fp = lock_stp->st_file;
4385         int oflag = nfs4_access_to_omode(access);
4386
4387         if (test_access(access, lock_stp))
4388                 return;
4389         nfs4_file_get_access(fp, oflag);
4390         set_access(access, lock_stp);
4391 }
4392
4393 static __be32 lookup_or_create_lock_state(struct nfsd4_compound_state *cstate, struct nfs4_ol_stateid *ost, struct nfsd4_lock *lock, struct nfs4_ol_stateid **lst, bool *new)
4394 {
4395         struct nfs4_file *fi = ost->st_file;
4396         struct nfs4_openowner *oo = openowner(ost->st_stateowner);
4397         struct nfs4_client *cl = oo->oo_owner.so_client;
4398         struct nfs4_lockowner *lo;
4399         unsigned int strhashval;
4400         struct nfsd_net *nn = net_generic(cl->net, nfsd_net_id);
4401
4402         lo = find_lockowner_str(&cl->cl_clientid, &lock->v.new.owner, nn);
4403         if (!lo) {
4404                 strhashval = ownerstr_hashval(cl->cl_clientid.cl_id,
4405                                 &lock->v.new.owner);
4406                 lo = alloc_init_lock_stateowner(strhashval, cl, ost, lock);
4407                 if (lo == NULL)
4408                         return nfserr_jukebox;
4409         } else {
4410                 /* with an existing lockowner, seqids must be the same */
4411                 if (!cstate->minorversion &&
4412                     lock->lk_new_lock_seqid != lo->lo_owner.so_seqid)
4413                         return nfserr_bad_seqid;
4414         }
4415
4416         *lst = find_lock_stateid(lo, fi);
4417         if (*lst == NULL) {
4418                 *lst = alloc_init_lock_stateid(lo, fi, ost);
4419                 if (*lst == NULL) {
4420                         release_lockowner_if_empty(lo);
4421                         return nfserr_jukebox;
4422                 }
4423                 *new = true;
4424         }
4425         return nfs_ok;
4426 }
4427
4428 /*
4429  *  LOCK operation
4430  */
4431 __be32
4432 nfsd4_lock(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
4433            struct nfsd4_lock *lock)
4434 {
4435         struct nfs4_openowner *open_sop = NULL;
4436         struct nfs4_lockowner *lock_sop = NULL;
4437         struct nfs4_ol_stateid *lock_stp;
4438         struct file *filp = NULL;
4439         struct file_lock *file_lock = NULL;
4440         struct file_lock *conflock = NULL;
4441         __be32 status = 0;
4442         bool new_state = false;
4443         int lkflg;
4444         int err;
4445         struct net *net = SVC_NET(rqstp);
4446         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
4447
4448         dprintk("NFSD: nfsd4_lock: start=%Ld length=%Ld\n",
4449                 (long long) lock->lk_offset,
4450                 (long long) lock->lk_length);
4451
4452         if (check_lock_length(lock->lk_offset, lock->lk_length))
4453                  return nfserr_inval;
4454
4455         if ((status = fh_verify(rqstp, &cstate->current_fh,
4456                                 S_IFREG, NFSD_MAY_LOCK))) {
4457                 dprintk("NFSD: nfsd4_lock: permission denied!\n");
4458                 return status;
4459         }
4460
4461         nfs4_lock_state();
4462
4463         if (lock->lk_is_new) {
4464                 struct nfs4_ol_stateid *open_stp = NULL;
4465
4466                 if (nfsd4_has_session(cstate))
4467                         /* See rfc 5661 18.10.3: given clientid is ignored: */
4468                         memcpy(&lock->v.new.clientid,
4469                                 &cstate->session->se_client->cl_clientid,
4470                                 sizeof(clientid_t));
4471
4472                 status = nfserr_stale_clientid;
4473                 if (STALE_CLIENTID(&lock->lk_new_clientid, nn))
4474                         goto out;
4475
4476                 /* validate and update open stateid and open seqid */
4477                 status = nfs4_preprocess_confirmed_seqid_op(cstate,
4478                                         lock->lk_new_open_seqid,
4479                                         &lock->lk_new_open_stateid,
4480                                         &open_stp, nn);
4481                 if (status)
4482                         goto out;
4483                 open_sop = openowner(open_stp->st_stateowner);
4484                 status = nfserr_bad_stateid;
4485                 if (!same_clid(&open_sop->oo_owner.so_client->cl_clientid,
4486                                                 &lock->v.new.clientid))
4487                         goto out;
4488                 status = lookup_or_create_lock_state(cstate, open_stp, lock,
4489                                                         &lock_stp, &new_state);
4490         } else
4491                 status = nfs4_preprocess_seqid_op(cstate,
4492                                        lock->lk_old_lock_seqid,
4493                                        &lock->lk_old_lock_stateid,
4494                                        NFS4_LOCK_STID, &lock_stp, nn);
4495         if (status)
4496                 goto out;
4497         lock_sop = lockowner(lock_stp->st_stateowner);
4498
4499         lkflg = setlkflg(lock->lk_type);
4500         status = nfs4_check_openmode(lock_stp, lkflg);
4501         if (status)
4502                 goto out;
4503
4504         status = nfserr_grace;
4505         if (locks_in_grace(net) && !lock->lk_reclaim)
4506                 goto out;
4507         status = nfserr_no_grace;
4508         if (!locks_in_grace(net) && lock->lk_reclaim)
4509                 goto out;
4510
4511         file_lock = locks_alloc_lock();
4512         if (!file_lock) {
4513                 dprintk("NFSD: %s: unable to allocate lock!\n", __func__);
4514                 status = nfserr_jukebox;
4515                 goto out;
4516         }
4517
4518         locks_init_lock(file_lock);
4519         switch (lock->lk_type) {
4520                 case NFS4_READ_LT:
4521                 case NFS4_READW_LT:
4522                         filp = find_readable_file(lock_stp->st_file);
4523                         if (filp)
4524                                 get_lock_access(lock_stp, NFS4_SHARE_ACCESS_READ);
4525                         file_lock->fl_type = F_RDLCK;
4526                         break;
4527                 case NFS4_WRITE_LT:
4528                 case NFS4_WRITEW_LT:
4529                         filp = find_writeable_file(lock_stp->st_file);
4530                         if (filp)
4531                                 get_lock_access(lock_stp, NFS4_SHARE_ACCESS_WRITE);
4532                         file_lock->fl_type = F_WRLCK;
4533                         break;
4534                 default:
4535                         status = nfserr_inval;
4536                 goto out;
4537         }
4538         if (!filp) {
4539                 status = nfserr_openmode;
4540                 goto out;
4541         }
4542         file_lock->fl_owner = (fl_owner_t)lock_sop;
4543         file_lock->fl_pid = current->tgid;
4544         file_lock->fl_file = filp;
4545         file_lock->fl_flags = FL_POSIX;
4546         file_lock->fl_lmops = &nfsd_posix_mng_ops;
4547         file_lock->fl_start = lock->lk_offset;
4548         file_lock->fl_end = last_byte_offset(lock->lk_offset, lock->lk_length);
4549         nfs4_transform_lock_offset(file_lock);
4550
4551         conflock = locks_alloc_lock();
4552         if (!conflock) {
4553                 dprintk("NFSD: %s: unable to allocate lock!\n", __func__);
4554                 status = nfserr_jukebox;
4555                 goto out;
4556         }
4557
4558         err = vfs_lock_file(filp, F_SETLK, file_lock, conflock);
4559         switch (-err) {
4560         case 0: /* success! */
4561                 update_stateid(&lock_stp->st_stid.sc_stateid);
4562                 memcpy(&lock->lk_resp_stateid, &lock_stp->st_stid.sc_stateid,
4563                                 sizeof(stateid_t));
4564                 status = 0;
4565                 break;
4566         case (EAGAIN):          /* conflock holds conflicting lock */
4567                 status = nfserr_denied;
4568                 dprintk("NFSD: nfsd4_lock: conflicting lock found!\n");
4569                 nfs4_set_lock_denied(conflock, &lock->lk_denied);
4570                 break;
4571         case (EDEADLK):
4572                 status = nfserr_deadlock;
4573                 break;
4574         default:
4575                 dprintk("NFSD: nfsd4_lock: vfs_lock_file() failed! status %d\n",err);
4576                 status = nfserrno(err);
4577                 break;
4578         }
4579 out:
4580         if (status && new_state)
4581                 release_lock_stateid(lock_stp);
4582         nfsd4_bump_seqid(cstate, status);
4583         if (!cstate->replay_owner)
4584                 nfs4_unlock_state();
4585         if (file_lock)
4586                 locks_free_lock(file_lock);
4587         if (conflock)
4588                 locks_free_lock(conflock);
4589         return status;
4590 }
4591
4592 /*
4593  * The NFSv4 spec allows a client to do a LOCKT without holding an OPEN,
4594  * so we do a temporary open here just to get an open file to pass to
4595  * vfs_test_lock.  (Arguably perhaps test_lock should be done with an
4596  * inode operation.)
4597  */
4598 static __be32 nfsd_test_lock(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file_lock *lock)
4599 {
4600         struct file *file;
4601         __be32 err = nfsd_open(rqstp, fhp, S_IFREG, NFSD_MAY_READ, &file);
4602         if (!err) {
4603                 err = nfserrno(vfs_test_lock(file, lock));
4604                 nfsd_close(file);
4605         }
4606         return err;
4607 }
4608
4609 /*
4610  * LOCKT operation
4611  */
4612 __be32
4613 nfsd4_lockt(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
4614             struct nfsd4_lockt *lockt)
4615 {
4616         struct file_lock *file_lock = NULL;
4617         struct nfs4_lockowner *lo;
4618         __be32 status;
4619         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
4620
4621         if (locks_in_grace(SVC_NET(rqstp)))
4622                 return nfserr_grace;
4623
4624         if (check_lock_length(lockt->lt_offset, lockt->lt_length))
4625                  return nfserr_inval;
4626
4627         nfs4_lock_state();
4628
4629         if (!nfsd4_has_session(cstate)) {
4630                 status = lookup_clientid(&lockt->lt_clientid, false, nn, NULL);
4631                 if (status)
4632                         goto out;
4633         }
4634
4635         if ((status = fh_verify(rqstp, &cstate->current_fh, S_IFREG, 0)))
4636                 goto out;
4637
4638         file_lock = locks_alloc_lock();
4639         if (!file_lock) {
4640                 dprintk("NFSD: %s: unable to allocate lock!\n", __func__);
4641                 status = nfserr_jukebox;
4642                 goto out;
4643         }
4644         locks_init_lock(file_lock);
4645         switch (lockt->lt_type) {
4646                 case NFS4_READ_LT:
4647                 case NFS4_READW_LT:
4648                         file_lock->fl_type = F_RDLCK;
4649                 break;
4650                 case NFS4_WRITE_LT:
4651                 case NFS4_WRITEW_LT:
4652                         file_lock->fl_type = F_WRLCK;
4653                 break;
4654                 default:
4655                         dprintk("NFSD: nfs4_lockt: bad lock type!\n");
4656                         status = nfserr_inval;
4657                 goto out;
4658         }
4659
4660         lo = find_lockowner_str(&lockt->lt_clientid, &lockt->lt_owner, nn);
4661         if (lo)
4662                 file_lock->fl_owner = (fl_owner_t)lo;
4663         file_lock->fl_pid = current->tgid;
4664         file_lock->fl_flags = FL_POSIX;
4665
4666         file_lock->fl_start = lockt->lt_offset;
4667         file_lock->fl_end = last_byte_offset(lockt->lt_offset, lockt->lt_length);
4668
4669         nfs4_transform_lock_offset(file_lock);
4670
4671         status = nfsd_test_lock(rqstp, &cstate->current_fh, file_lock);
4672         if (status)
4673                 goto out;
4674
4675         if (file_lock->fl_type != F_UNLCK) {
4676                 status = nfserr_denied;
4677                 nfs4_set_lock_denied(file_lock, &lockt->lt_denied);
4678         }
4679 out:
4680         nfs4_unlock_state();
4681         if (file_lock)
4682                 locks_free_lock(file_lock);
4683         return status;
4684 }
4685
4686 __be32
4687 nfsd4_locku(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
4688             struct nfsd4_locku *locku)
4689 {
4690         struct nfs4_ol_stateid *stp;
4691         struct file *filp = NULL;
4692         struct file_lock *file_lock = NULL;
4693         __be32 status;
4694         int err;
4695         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
4696
4697         dprintk("NFSD: nfsd4_locku: start=%Ld length=%Ld\n",
4698                 (long long) locku->lu_offset,
4699                 (long long) locku->lu_length);
4700
4701         if (check_lock_length(locku->lu_offset, locku->lu_length))
4702                  return nfserr_inval;
4703
4704         nfs4_lock_state();
4705
4706         status = nfs4_preprocess_seqid_op(cstate, locku->lu_seqid,
4707                                         &locku->lu_stateid, NFS4_LOCK_STID,
4708                                         &stp, nn);
4709         if (status)
4710                 goto out;
4711         filp = find_any_file(stp->st_file);
4712         if (!filp) {
4713                 status = nfserr_lock_range;
4714                 goto out;
4715         }
4716         file_lock = locks_alloc_lock();
4717         if (!file_lock) {
4718                 dprintk("NFSD: %s: unable to allocate lock!\n", __func__);
4719                 status = nfserr_jukebox;
4720                 goto out;
4721         }
4722         locks_init_lock(file_lock);
4723         file_lock->fl_type = F_UNLCK;
4724         file_lock->fl_owner = (fl_owner_t)lockowner(stp->st_stateowner);
4725         file_lock->fl_pid = current->tgid;
4726         file_lock->fl_file = filp;
4727         file_lock->fl_flags = FL_POSIX;
4728         file_lock->fl_lmops = &nfsd_posix_mng_ops;
4729         file_lock->fl_start = locku->lu_offset;
4730
4731         file_lock->fl_end = last_byte_offset(locku->lu_offset,
4732                                                 locku->lu_length);
4733         nfs4_transform_lock_offset(file_lock);
4734
4735         err = vfs_lock_file(filp, F_SETLK, file_lock, NULL);
4736         if (err) {
4737                 dprintk("NFSD: nfs4_locku: vfs_lock_file failed!\n");
4738                 goto out_nfserr;
4739         }
4740         update_stateid(&stp->st_stid.sc_stateid);
4741         memcpy(&locku->lu_stateid, &stp->st_stid.sc_stateid, sizeof(stateid_t));
4742
4743 out:
4744         nfsd4_bump_seqid(cstate, status);
4745         if (!cstate->replay_owner)
4746                 nfs4_unlock_state();
4747         if (file_lock)
4748                 locks_free_lock(file_lock);
4749         return status;
4750
4751 out_nfserr:
4752         status = nfserrno(err);
4753         goto out;
4754 }
4755
4756 /*
4757  * returns
4758  *      1: locks held by lockowner
4759  *      0: no locks held by lockowner
4760  */
4761 static int
4762 check_for_locks(struct nfs4_file *filp, struct nfs4_lockowner *lowner)
4763 {
4764         struct file_lock **flpp;
4765         struct inode *inode = filp->fi_inode;
4766         int status = 0;
4767
4768         spin_lock(&inode->i_lock);
4769         for (flpp = &inode->i_flock; *flpp != NULL; flpp = &(*flpp)->fl_next) {
4770                 if ((*flpp)->fl_owner == (fl_owner_t)lowner) {
4771                         status = 1;
4772                         goto out;
4773                 }
4774         }
4775 out:
4776         spin_unlock(&inode->i_lock);
4777         return status;
4778 }
4779
4780 __be32
4781 nfsd4_release_lockowner(struct svc_rqst *rqstp,
4782                         struct nfsd4_compound_state *cstate,
4783                         struct nfsd4_release_lockowner *rlockowner)
4784 {
4785         clientid_t *clid = &rlockowner->rl_clientid;
4786         struct nfs4_stateowner *sop;
4787         struct nfs4_lockowner *lo;
4788         struct nfs4_ol_stateid *stp;
4789         struct xdr_netobj *owner = &rlockowner->rl_owner;
4790         struct list_head matches;
4791         unsigned int hashval = ownerstr_hashval(clid->cl_id, owner);
4792         __be32 status;
4793         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
4794
4795         dprintk("nfsd4_release_lockowner clientid: (%08x/%08x):\n",
4796                 clid->cl_boot, clid->cl_id);
4797
4798         nfs4_lock_state();
4799
4800         status = lookup_clientid(clid, cstate->minorversion, nn, NULL);
4801         if (status)
4802                 goto out;
4803
4804         status = nfserr_locks_held;
4805         INIT_LIST_HEAD(&matches);
4806
4807         list_for_each_entry(sop, &nn->ownerstr_hashtbl[hashval], so_strhash) {
4808                 if (sop->so_is_open_owner)
4809                         continue;
4810                 if (!same_owner_str(sop, owner, clid))
4811                         continue;
4812                 list_for_each_entry(stp, &sop->so_stateids,
4813                                 st_perstateowner) {
4814                         lo = lockowner(sop);
4815                         if (check_for_locks(stp->st_file, lo))
4816                                 goto out;
4817                         list_add(&lo->lo_list, &matches);
4818                 }
4819         }
4820         /* Clients probably won't expect us to return with some (but not all)
4821          * of the lockowner state released; so don't release any until all
4822          * have been checked. */
4823         status = nfs_ok;
4824         while (!list_empty(&matches)) {
4825                 lo = list_entry(matches.next, struct nfs4_lockowner,
4826                                                                 lo_list);
4827                 /* unhash_stateowner deletes so_perclient only
4828                  * for openowners. */
4829                 list_del(&lo->lo_list);
4830                 release_lockowner(lo);
4831         }
4832 out:
4833         nfs4_unlock_state();
4834         return status;
4835 }
4836
4837 static inline struct nfs4_client_reclaim *
4838 alloc_reclaim(void)
4839 {
4840         return kmalloc(sizeof(struct nfs4_client_reclaim), GFP_KERNEL);
4841 }
4842
4843 bool
4844 nfs4_has_reclaimed_state(const char *name, struct nfsd_net *nn)
4845 {
4846         struct nfs4_client_reclaim *crp;
4847
4848         crp = nfsd4_find_reclaim_client(name, nn);
4849         return (crp && crp->cr_clp);
4850 }
4851
4852 /*
4853  * failure => all reset bets are off, nfserr_no_grace...
4854  */
4855 struct nfs4_client_reclaim *
4856 nfs4_client_to_reclaim(const char *name, struct nfsd_net *nn)
4857 {
4858         unsigned int strhashval;
4859         struct nfs4_client_reclaim *crp;
4860
4861         dprintk("NFSD nfs4_client_to_reclaim NAME: %.*s\n", HEXDIR_LEN, name);
4862         crp = alloc_reclaim();
4863         if (crp) {
4864                 strhashval = clientstr_hashval(name);
4865                 INIT_LIST_HEAD(&crp->cr_strhash);
4866                 list_add(&crp->cr_strhash, &nn->reclaim_str_hashtbl[strhashval]);
4867                 memcpy(crp->cr_recdir, name, HEXDIR_LEN);
4868                 crp->cr_clp = NULL;
4869                 nn->reclaim_str_hashtbl_size++;
4870         }
4871         return crp;
4872 }
4873
4874 void
4875 nfs4_remove_reclaim_record(struct nfs4_client_reclaim *crp, struct nfsd_net *nn)
4876 {
4877         list_del(&crp->cr_strhash);
4878         kfree(crp);
4879         nn->reclaim_str_hashtbl_size--;
4880 }
4881
4882 void
4883 nfs4_release_reclaim(struct nfsd_net *nn)
4884 {
4885         struct nfs4_client_reclaim *crp = NULL;
4886         int i;
4887
4888         for (i = 0; i < CLIENT_HASH_SIZE; i++) {
4889                 while (!list_empty(&nn->reclaim_str_hashtbl[i])) {
4890                         crp = list_entry(nn->reclaim_str_hashtbl[i].next,
4891                                         struct nfs4_client_reclaim, cr_strhash);
4892                         nfs4_remove_reclaim_record(crp, nn);
4893                 }
4894         }
4895         WARN_ON_ONCE(nn->reclaim_str_hashtbl_size);
4896 }
4897
4898 /*
4899  * called from OPEN, CLAIM_PREVIOUS with a new clientid. */
4900 struct nfs4_client_reclaim *
4901 nfsd4_find_reclaim_client(const char *recdir, struct nfsd_net *nn)
4902 {
4903         unsigned int strhashval;
4904         struct nfs4_client_reclaim *crp = NULL;
4905
4906         dprintk("NFSD: nfs4_find_reclaim_client for recdir %s\n", recdir);
4907
4908         strhashval = clientstr_hashval(recdir);
4909         list_for_each_entry(crp, &nn->reclaim_str_hashtbl[strhashval], cr_strhash) {
4910                 if (same_name(crp->cr_recdir, recdir)) {
4911                         return crp;
4912                 }
4913         }
4914         return NULL;
4915 }
4916
4917 /*
4918 * Called from OPEN. Look for clientid in reclaim list.
4919 */
4920 __be32
4921 nfs4_check_open_reclaim(clientid_t *clid, bool sessions, struct nfsd_net *nn)
4922 {
4923         struct nfs4_client *clp;
4924
4925         /* find clientid in conf_id_hashtbl */
4926         clp = find_confirmed_client(clid, sessions, nn);
4927         if (clp == NULL)
4928                 return nfserr_reclaim_bad;
4929
4930         return nfsd4_client_record_check(clp) ? nfserr_reclaim_bad : nfs_ok;
4931 }
4932
4933 #ifdef CONFIG_NFSD_FAULT_INJECTION
4934
4935 u64 nfsd_forget_client(struct nfs4_client *clp, u64 max)
4936 {
4937         if (mark_client_expired(clp))
4938                 return 0;
4939         expire_client(clp);
4940         return 1;
4941 }
4942
4943 u64 nfsd_print_client(struct nfs4_client *clp, u64 num)
4944 {
4945         char buf[INET6_ADDRSTRLEN];
4946         rpc_ntop((struct sockaddr *)&clp->cl_addr, buf, sizeof(buf));
4947         printk(KERN_INFO "NFS Client: %s\n", buf);
4948         return 1;
4949 }
4950
4951 static void nfsd_print_count(struct nfs4_client *clp, unsigned int count,
4952                              const char *type)
4953 {
4954         char buf[INET6_ADDRSTRLEN];
4955         rpc_ntop((struct sockaddr *)&clp->cl_addr, buf, sizeof(buf));
4956         printk(KERN_INFO "NFS Client: %s has %u %s\n", buf, count, type);
4957 }
4958
4959 static u64 nfsd_foreach_client_lock(struct nfs4_client *clp, u64 max,
4960                                     void (*func)(struct nfs4_ol_stateid *))
4961 {
4962         struct nfs4_openowner *oop;
4963         struct nfs4_ol_stateid *stp, *st_next;
4964         struct nfs4_ol_stateid *lst, *lst_next;
4965         u64 count = 0;
4966
4967         list_for_each_entry(oop, &clp->cl_openowners, oo_perclient) {
4968                 list_for_each_entry_safe(stp, st_next,
4969                                 &oop->oo_owner.so_stateids, st_perstateowner) {
4970                         list_for_each_entry_safe(lst, lst_next,
4971                                         &stp->st_locks, st_locks) {
4972                                 if (func)
4973                                         func(lst);
4974                                 if (++count == max)
4975                                         return count;
4976                         }
4977                 }
4978         }
4979
4980         return count;
4981 }
4982
4983 u64 nfsd_forget_client_locks(struct nfs4_client *clp, u64 max)
4984 {
4985         return nfsd_foreach_client_lock(clp, max, release_lock_stateid);
4986 }
4987
4988 u64 nfsd_print_client_locks(struct nfs4_client *clp, u64 max)
4989 {
4990         u64 count = nfsd_foreach_client_lock(clp, max, NULL);
4991         nfsd_print_count(clp, count, "locked files");
4992         return count;
4993 }
4994
4995 static u64 nfsd_foreach_client_open(struct nfs4_client *clp, u64 max, void (*func)(struct nfs4_openowner *))
4996 {
4997         struct nfs4_openowner *oop, *next;
4998         u64 count = 0;
4999
5000         list_for_each_entry_safe(oop, next, &clp->cl_openowners, oo_perclient) {
5001                 if (func)
5002                         func(oop);
5003                 if (++count == max)
5004                         break;
5005         }
5006
5007         return count;
5008 }
5009
5010 u64 nfsd_forget_client_openowners(struct nfs4_client *clp, u64 max)
5011 {
5012         return nfsd_foreach_client_open(clp, max, release_openowner);
5013 }
5014
5015 u64 nfsd_print_client_openowners(struct nfs4_client *clp, u64 max)
5016 {
5017         u64 count = nfsd_foreach_client_open(clp, max, NULL);
5018         nfsd_print_count(clp, count, "open files");
5019         return count;
5020 }
5021
5022 static u64 nfsd_find_all_delegations(struct nfs4_client *clp, u64 max,
5023                                      struct list_head *victims)
5024 {
5025         struct nfs4_delegation *dp, *next;
5026         u64 count = 0;
5027
5028         lockdep_assert_held(&state_lock);
5029         list_for_each_entry_safe(dp, next, &clp->cl_delegations, dl_perclnt) {
5030                 if (victims)
5031                         list_move(&dp->dl_recall_lru, victims);
5032                 if (++count == max)
5033                         break;
5034         }
5035         return count;
5036 }
5037
5038 u64 nfsd_forget_client_delegations(struct nfs4_client *clp, u64 max)
5039 {
5040         struct nfs4_delegation *dp, *next;
5041         LIST_HEAD(victims);
5042         u64 count;
5043
5044         spin_lock(&state_lock);
5045         count = nfsd_find_all_delegations(clp, max, &victims);
5046         spin_unlock(&state_lock);
5047
5048         list_for_each_entry_safe(dp, next, &victims, dl_recall_lru)
5049                 revoke_delegation(dp);
5050
5051         return count;
5052 }
5053
5054 u64 nfsd_recall_client_delegations(struct nfs4_client *clp, u64 max)
5055 {
5056         struct nfs4_delegation *dp, *next;
5057         LIST_HEAD(victims);
5058         u64 count;
5059
5060         spin_lock(&state_lock);
5061         count = nfsd_find_all_delegations(clp, max, &victims);
5062         list_for_each_entry_safe(dp, next, &victims, dl_recall_lru)
5063                 nfsd_break_one_deleg(dp);
5064         spin_unlock(&state_lock);
5065
5066         return count;
5067 }
5068
5069 u64 nfsd_print_client_delegations(struct nfs4_client *clp, u64 max)
5070 {
5071         u64 count = 0;
5072
5073         spin_lock(&state_lock);
5074         count = nfsd_find_all_delegations(clp, max, NULL);
5075         spin_unlock(&state_lock);
5076
5077         nfsd_print_count(clp, count, "delegations");
5078         return count;
5079 }
5080
5081 u64 nfsd_for_n_state(u64 max, u64 (*func)(struct nfs4_client *, u64))
5082 {
5083         struct nfs4_client *clp, *next;
5084         u64 count = 0;
5085         struct nfsd_net *nn = net_generic(current->nsproxy->net_ns, nfsd_net_id);
5086
5087         if (!nfsd_netns_ready(nn))
5088                 return 0;
5089
5090         list_for_each_entry_safe(clp, next, &nn->client_lru, cl_lru) {
5091                 count += func(clp, max - count);
5092                 if ((max != 0) && (count >= max))
5093                         break;
5094         }
5095
5096         return count;
5097 }
5098
5099 struct nfs4_client *nfsd_find_client(struct sockaddr_storage *addr, size_t addr_size)
5100 {
5101         struct nfs4_client *clp;
5102         struct nfsd_net *nn = net_generic(current->nsproxy->net_ns, nfsd_net_id);
5103
5104         if (!nfsd_netns_ready(nn))
5105                 return NULL;
5106
5107         list_for_each_entry(clp, &nn->client_lru, cl_lru) {
5108                 if (memcmp(&clp->cl_addr, addr, addr_size) == 0)
5109                         return clp;
5110         }
5111         return NULL;
5112 }
5113
5114 #endif /* CONFIG_NFSD_FAULT_INJECTION */
5115
5116 /*
5117  * Since the lifetime of a delegation isn't limited to that of an open, a
5118  * client may quite reasonably hang on to a delegation as long as it has
5119  * the inode cached.  This becomes an obvious problem the first time a
5120  * client's inode cache approaches the size of the server's total memory.
5121  *
5122  * For now we avoid this problem by imposing a hard limit on the number
5123  * of delegations, which varies according to the server's memory size.
5124  */
5125 static void
5126 set_max_delegations(void)
5127 {
5128         /*
5129          * Allow at most 4 delegations per megabyte of RAM.  Quick
5130          * estimates suggest that in the worst case (where every delegation
5131          * is for a different inode), a delegation could take about 1.5K,
5132          * giving a worst case usage of about 6% of memory.
5133          */
5134         max_delegations = nr_free_buffer_pages() >> (20 - 2 - PAGE_SHIFT);
5135 }
5136
5137 static int nfs4_state_create_net(struct net *net)
5138 {
5139         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
5140         int i;
5141
5142         nn->conf_id_hashtbl = kmalloc(sizeof(struct list_head) *
5143                         CLIENT_HASH_SIZE, GFP_KERNEL);
5144         if (!nn->conf_id_hashtbl)
5145                 goto err;
5146         nn->unconf_id_hashtbl = kmalloc(sizeof(struct list_head) *
5147                         CLIENT_HASH_SIZE, GFP_KERNEL);
5148         if (!nn->unconf_id_hashtbl)
5149                 goto err_unconf_id;
5150         nn->ownerstr_hashtbl = kmalloc(sizeof(struct list_head) *
5151                         OWNER_HASH_SIZE, GFP_KERNEL);
5152         if (!nn->ownerstr_hashtbl)
5153                 goto err_ownerstr;
5154         nn->sessionid_hashtbl = kmalloc(sizeof(struct list_head) *
5155                         SESSION_HASH_SIZE, GFP_KERNEL);
5156         if (!nn->sessionid_hashtbl)
5157                 goto err_sessionid;
5158
5159         for (i = 0; i < CLIENT_HASH_SIZE; i++) {
5160                 INIT_LIST_HEAD(&nn->conf_id_hashtbl[i]);
5161                 INIT_LIST_HEAD(&nn->unconf_id_hashtbl[i]);
5162         }
5163         for (i = 0; i < OWNER_HASH_SIZE; i++)
5164                 INIT_LIST_HEAD(&nn->ownerstr_hashtbl[i]);
5165         for (i = 0; i < SESSION_HASH_SIZE; i++)
5166                 INIT_LIST_HEAD(&nn->sessionid_hashtbl[i]);
5167         nn->conf_name_tree = RB_ROOT;
5168         nn->unconf_name_tree = RB_ROOT;
5169         INIT_LIST_HEAD(&nn->client_lru);
5170         INIT_LIST_HEAD(&nn->close_lru);
5171         INIT_LIST_HEAD(&nn->del_recall_lru);
5172         spin_lock_init(&nn->client_lock);
5173
5174         INIT_DELAYED_WORK(&nn->laundromat_work, laundromat_main);
5175         get_net(net);
5176
5177         return 0;
5178
5179 err_sessionid:
5180         kfree(nn->ownerstr_hashtbl);
5181 err_ownerstr:
5182         kfree(nn->unconf_id_hashtbl);
5183 err_unconf_id:
5184         kfree(nn->conf_id_hashtbl);
5185 err:
5186         return -ENOMEM;
5187 }
5188
5189 static void
5190 nfs4_state_destroy_net(struct net *net)
5191 {
5192         int i;
5193         struct nfs4_client *clp = NULL;
5194         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
5195
5196         for (i = 0; i < CLIENT_HASH_SIZE; i++) {
5197                 while (!list_empty(&nn->conf_id_hashtbl[i])) {
5198                         clp = list_entry(nn->conf_id_hashtbl[i].next, struct nfs4_client, cl_idhash);
5199                         destroy_client(clp);
5200                 }
5201         }
5202
5203         for (i = 0; i < CLIENT_HASH_SIZE; i++) {
5204                 while (!list_empty(&nn->unconf_id_hashtbl[i])) {
5205                         clp = list_entry(nn->unconf_id_hashtbl[i].next, struct nfs4_client, cl_idhash);
5206                         destroy_client(clp);
5207                 }
5208         }
5209
5210         kfree(nn->sessionid_hashtbl);
5211         kfree(nn->ownerstr_hashtbl);
5212         kfree(nn->unconf_id_hashtbl);
5213         kfree(nn->conf_id_hashtbl);
5214         put_net(net);
5215 }
5216
5217 int
5218 nfs4_state_start_net(struct net *net)
5219 {
5220         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
5221         int ret;
5222
5223         ret = nfs4_state_create_net(net);
5224         if (ret)
5225                 return ret;
5226         nfsd4_client_tracking_init(net);
5227         nn->boot_time = get_seconds();
5228         locks_start_grace(net, &nn->nfsd4_manager);
5229         nn->grace_ended = false;
5230         printk(KERN_INFO "NFSD: starting %ld-second grace period (net %p)\n",
5231                nn->nfsd4_grace, net);
5232         queue_delayed_work(laundry_wq, &nn->laundromat_work, nn->nfsd4_grace * HZ);
5233         return 0;
5234 }
5235
5236 /* initialization to perform when the nfsd service is started: */
5237
5238 int
5239 nfs4_state_start(void)
5240 {
5241         int ret;
5242
5243         ret = set_callback_cred();
5244         if (ret)
5245                 return -ENOMEM;
5246         laundry_wq = create_singlethread_workqueue("nfsd4");
5247         if (laundry_wq == NULL) {
5248                 ret = -ENOMEM;
5249                 goto out_recovery;
5250         }
5251         ret = nfsd4_create_callback_queue();
5252         if (ret)
5253                 goto out_free_laundry;
5254
5255         set_max_delegations();
5256
5257         return 0;
5258
5259 out_free_laundry:
5260         destroy_workqueue(laundry_wq);
5261 out_recovery:
5262         return ret;
5263 }
5264
5265 void
5266 nfs4_state_shutdown_net(struct net *net)
5267 {
5268         struct nfs4_delegation *dp = NULL;
5269         struct list_head *pos, *next, reaplist;
5270         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
5271
5272         cancel_delayed_work_sync(&nn->laundromat_work);
5273         locks_end_grace(&nn->nfsd4_manager);
5274
5275         nfs4_lock_state();
5276         INIT_LIST_HEAD(&reaplist);
5277         spin_lock(&state_lock);
5278         list_for_each_safe(pos, next, &nn->del_recall_lru) {
5279                 dp = list_entry (pos, struct nfs4_delegation, dl_recall_lru);
5280                 list_move(&dp->dl_recall_lru, &reaplist);
5281         }
5282         spin_unlock(&state_lock);
5283         list_for_each_safe(pos, next, &reaplist) {
5284                 dp = list_entry (pos, struct nfs4_delegation, dl_recall_lru);
5285                 destroy_delegation(dp);
5286         }
5287
5288         nfsd4_client_tracking_exit(net);
5289         nfs4_state_destroy_net(net);
5290         nfs4_unlock_state();
5291 }
5292
5293 void
5294 nfs4_state_shutdown(void)
5295 {
5296         destroy_workqueue(laundry_wq);
5297         nfsd4_destroy_callback_queue();
5298 }
5299
5300 static void
5301 get_stateid(struct nfsd4_compound_state *cstate, stateid_t *stateid)
5302 {
5303         if (HAS_STATE_ID(cstate, CURRENT_STATE_ID_FLAG) && CURRENT_STATEID(stateid))
5304                 memcpy(stateid, &cstate->current_stateid, sizeof(stateid_t));
5305 }
5306
5307 static void
5308 put_stateid(struct nfsd4_compound_state *cstate, stateid_t *stateid)
5309 {
5310         if (cstate->minorversion) {
5311                 memcpy(&cstate->current_stateid, stateid, sizeof(stateid_t));
5312                 SET_STATE_ID(cstate, CURRENT_STATE_ID_FLAG);
5313         }
5314 }
5315
5316 void
5317 clear_current_stateid(struct nfsd4_compound_state *cstate)
5318 {
5319         CLEAR_STATE_ID(cstate, CURRENT_STATE_ID_FLAG);
5320 }
5321
5322 /*
5323  * functions to set current state id
5324  */
5325 void
5326 nfsd4_set_opendowngradestateid(struct nfsd4_compound_state *cstate, struct nfsd4_open_downgrade *odp)
5327 {
5328         put_stateid(cstate, &odp->od_stateid);
5329 }
5330
5331 void
5332 nfsd4_set_openstateid(struct nfsd4_compound_state *cstate, struct nfsd4_open *open)
5333 {
5334         put_stateid(cstate, &open->op_stateid);
5335 }
5336
5337 void
5338 nfsd4_set_closestateid(struct nfsd4_compound_state *cstate, struct nfsd4_close *close)
5339 {
5340         put_stateid(cstate, &close->cl_stateid);
5341 }
5342
5343 void
5344 nfsd4_set_lockstateid(struct nfsd4_compound_state *cstate, struct nfsd4_lock *lock)
5345 {
5346         put_stateid(cstate, &lock->lk_resp_stateid);
5347 }
5348
5349 /*
5350  * functions to consume current state id
5351  */
5352
5353 void
5354 nfsd4_get_opendowngradestateid(struct nfsd4_compound_state *cstate, struct nfsd4_open_downgrade *odp)
5355 {
5356         get_stateid(cstate, &odp->od_stateid);
5357 }
5358
5359 void
5360 nfsd4_get_delegreturnstateid(struct nfsd4_compound_state *cstate, struct nfsd4_delegreturn *drp)
5361 {
5362         get_stateid(cstate, &drp->dr_stateid);
5363 }
5364
5365 void
5366 nfsd4_get_freestateid(struct nfsd4_compound_state *cstate, struct nfsd4_free_stateid *fsp)
5367 {
5368         get_stateid(cstate, &fsp->fr_stateid);
5369 }
5370
5371 void
5372 nfsd4_get_setattrstateid(struct nfsd4_compound_state *cstate, struct nfsd4_setattr *setattr)
5373 {
5374         get_stateid(cstate, &setattr->sa_stateid);
5375 }
5376
5377 void
5378 nfsd4_get_closestateid(struct nfsd4_compound_state *cstate, struct nfsd4_close *close)
5379 {
5380         get_stateid(cstate, &close->cl_stateid);
5381 }
5382
5383 void
5384 nfsd4_get_lockustateid(struct nfsd4_compound_state *cstate, struct nfsd4_locku *locku)
5385 {
5386         get_stateid(cstate, &locku->lu_stateid);
5387 }
5388
5389 void
5390 nfsd4_get_readstateid(struct nfsd4_compound_state *cstate, struct nfsd4_read *read)
5391 {
5392         get_stateid(cstate, &read->rd_stateid);
5393 }
5394
5395 void
5396 nfsd4_get_writestateid(struct nfsd4_compound_state *cstate, struct nfsd4_write *write)
5397 {
5398         get_stateid(cstate, &write->wr_stateid);
5399 }