fs/nfsd/nfs4state.c

   1 /*
   2 *  Copyright (c) 2001 The Regents of the University of Michigan.
   3 *  All rights reserved.
   4 *
   5 *  Kendrick Smith <kmsmith@umich.edu>
   6 *  Andy Adamson <kandros@umich.edu>
   7 *
   8 *  Redistribution and use in source and binary forms, with or without
   9 *  modification, are permitted provided that the following conditions
  10 *  are met:
  11 *
  12 *  1. Redistributions of source code must retain the above copyright
  13 *     notice, this list of conditions and the following disclaimer.
  14 *  2. Redistributions in binary form must reproduce the above copyright
  15 *     notice, this list of conditions and the following disclaimer in the
  16 *     documentation and/or other materials provided with the distribution.
  17 *  3. Neither the name of the University nor the names of its
  18 *     contributors may be used to endorse or promote products derived
  19 *     from this software without specific prior written permission.
  20 *
  21 *  THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
  22 *  WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
  23 *  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
  24 *  DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
  25 *  FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  26 *  CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  27 *  SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
  28 *  BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
  29 *  LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
  30 *  NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
  31 *  SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  32 *
  33 */
  34
  35 #include <linux/file.h>
  36 #include <linux/fs.h>
  37 #include <linux/slab.h>
  38 #include <linux/namei.h>
  39 #include <linux/swap.h>
  40 #include <linux/pagemap.h>
  41 #include <linux/ratelimit.h>
  42 #include <linux/sunrpc/svcauth_gss.h>
  43 #include <linux/sunrpc/addr.h>
  44 #include <linux/hash.h>
  45 #include "xdr4.h"
  46 #include "xdr4cb.h"
  47 #include "vfs.h"
  48 #include "current_stateid.h"
  49
  50 #include "netns.h"
  51
  52 #define NFSDDBG_FACILITY                NFSDDBG_PROC
  53
  54 #define all_ones {{~0,~0},~0}
  55 static const stateid_t one_stateid = {
  56         .si_generation = ~0,
  57         .si_opaque = all_ones,
  58 };
  59 static const stateid_t zero_stateid = {
  60         /* all fields zero */
  61 };
  62 static const stateid_t currentstateid = {
  63         .si_generation = 1,
  64 };
  65
  66 static u64 current_sessionid = 1;
  67
  68 #define ZERO_STATEID(stateid) (!memcmp((stateid), &zero_stateid, sizeof(stateid_t)))
  69 #define ONE_STATEID(stateid)  (!memcmp((stateid), &one_stateid, sizeof(stateid_t)))
  70 #define CURRENT_STATEID(stateid) (!memcmp((stateid), &currentstateid, sizeof(stateid_t)))
  71
  72 /* forward declarations */
  73 static int check_for_locks(struct nfs4_file *filp, struct nfs4_lockowner *lowner);
  74
  75 /* Locking: */
  76
  77 /* Currently used for almost all code touching nfsv4 state: */
  78 static DEFINE_MUTEX(client_mutex);
  79
  80 /*
  81  * Currently used for the del_recall_lru and file hash table.  In an
  82  * effort to decrease the scope of the client_mutex, this spinlock may
  83  * eventually cover more:
  84  */
  85 static DEFINE_SPINLOCK(state_lock);
  86
  87 static struct kmem_cache *openowner_slab;
  88 static struct kmem_cache *lockowner_slab;
  89 static struct kmem_cache *file_slab;
  90 static struct kmem_cache *stateid_slab;
  91 static struct kmem_cache *deleg_slab;
  92
  93 void
  94 nfs4_lock_state(void)
  95 {
  96         mutex_lock(&client_mutex);
  97 }
  98
  99 static void free_session(struct nfsd4_session *);
 100
 101 static bool is_session_dead(struct nfsd4_session *ses)
 102 {
 103         return ses->se_flags & NFS4_SESSION_DEAD;
 104 }
 105
 106 static __be32 mark_session_dead_locked(struct nfsd4_session *ses, int ref_held_by_me)
 107 {
 108         if (atomic_read(&ses->se_ref) > ref_held_by_me)
 109                 return nfserr_jukebox;
 110         ses->se_flags |= NFS4_SESSION_DEAD;
 111         return nfs_ok;
 112 }
 113
 114 void
 115 nfs4_unlock_state(void)
 116 {
 117         mutex_unlock(&client_mutex);
 118 }
 119
 120 static bool is_client_expired(struct nfs4_client *clp)
 121 {
 122         return clp->cl_time == 0;
 123 }
 124
 125 static __be32 mark_client_expired_locked(struct nfs4_client *clp)
 126 {
 127         if (atomic_read(&clp->cl_refcount))
 128                 return nfserr_jukebox;
 129         clp->cl_time = 0;
 130         return nfs_ok;
 131 }
 132
 133 static __be32 mark_client_expired(struct nfs4_client *clp)
 134 {
 135         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
 136         __be32 ret;
 137
 138         spin_lock(&nn->client_lock);
 139         ret = mark_client_expired_locked(clp);
 140         spin_unlock(&nn->client_lock);
 141         return ret;
 142 }
 143
 144 static __be32 get_client_locked(struct nfs4_client *clp)
 145 {
 146         if (is_client_expired(clp))
 147                 return nfserr_expired;
 148         atomic_inc(&clp->cl_refcount);
 149         return nfs_ok;
 150 }
 151
 152 /* must be called under the client_lock */
 153 static inline void
 154 renew_client_locked(struct nfs4_client *clp)
 155 {
 156         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
 157
 158         if (is_client_expired(clp)) {
 159                 WARN_ON(1);
 160                 printk("%s: client (clientid %08x/%08x) already expired\n",
 161                         __func__,
 162                         clp->cl_clientid.cl_boot,
 163                         clp->cl_clientid.cl_id);
 164                 return;
 165         }
 166
 167         dprintk("renewing client (clientid %08x/%08x)\n",
 168                         clp->cl_clientid.cl_boot,
 169                         clp->cl_clientid.cl_id);
 170         list_move_tail(&clp->cl_lru, &nn->client_lru);
 171         clp->cl_time = get_seconds();
 172 }
 173
 174 static inline void
 175 renew_client(struct nfs4_client *clp)
 176 {
 177         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
 178
 179         spin_lock(&nn->client_lock);
 180         renew_client_locked(clp);
 181         spin_unlock(&nn->client_lock);
 182 }
 183
 184 static void put_client_renew_locked(struct nfs4_client *clp)
 185 {
 186         if (!atomic_dec_and_test(&clp->cl_refcount))
 187                 return;
 188         if (!is_client_expired(clp))
 189                 renew_client_locked(clp);
 190 }
 191
 192 static void put_client_renew(struct nfs4_client *clp)
 193 {
 194         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
 195
 196         spin_lock(&nn->client_lock);
 197         put_client_renew_locked(clp);
 198         spin_unlock(&nn->client_lock);
 199 }
 200
 201 static __be32 nfsd4_get_session_locked(struct nfsd4_session *ses)
 202 {
 203         __be32 status;
 204
 205         if (is_session_dead(ses))
 206                 return nfserr_badsession;
 207         status = get_client_locked(ses->se_client);
 208         if (status)
 209                 return status;
 210         atomic_inc(&ses->se_ref);
 211         return nfs_ok;
 212 }
 213
 214 static void nfsd4_put_session_locked(struct nfsd4_session *ses)
 215 {
 216         struct nfs4_client *clp = ses->se_client;
 217
 218         if (atomic_dec_and_test(&ses->se_ref) && is_session_dead(ses))
 219                 free_session(ses);
 220         put_client_renew_locked(clp);
 221 }
 222
 223 static void nfsd4_put_session(struct nfsd4_session *ses)
 224 {
 225         struct nfs4_client *clp = ses->se_client;
 226         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
 227
 228         spin_lock(&nn->client_lock);
 229         nfsd4_put_session_locked(ses);
 230         spin_unlock(&nn->client_lock);
 231 }
 232
 233
 234 static inline u32
 235 opaque_hashval(const void *ptr, int nbytes)
 236 {
 237         unsigned char *cptr = (unsigned char *) ptr;
 238
 239         u32 x = 0;
 240         while (nbytes--) {
 241                 x *= 37;
 242                 x += *cptr++;
 243         }
 244         return x;
 245 }
 246
 247 static void nfsd4_free_file(struct nfs4_file *f)
 248 {
 249         kmem_cache_free(file_slab, f);
 250 }
 251
 252 static inline void
 253 put_nfs4_file(struct nfs4_file *fi)
 254 {
 255         if (atomic_dec_and_lock(&fi->fi_ref, &state_lock)) {
 256                 hlist_del(&fi->fi_hash);
 257                 spin_unlock(&state_lock);
 258                 iput(fi->fi_inode);
 259                 nfsd4_free_file(fi);
 260         }
 261 }
 262
 263 static inline void
 264 get_nfs4_file(struct nfs4_file *fi)
 265 {
 266         atomic_inc(&fi->fi_ref);
 267 }
 268
 269 static int num_delegations;
 270 unsigned long max_delegations;
 271
 272 /*
 273  * Open owner state (share locks)
 274  */
 275
 276 /* hash tables for lock and open owners */
 277 #define OWNER_HASH_BITS              8
 278 #define OWNER_HASH_SIZE             (1 << OWNER_HASH_BITS)
 279 #define OWNER_HASH_MASK             (OWNER_HASH_SIZE - 1)
 280
 281 static unsigned int ownerstr_hashval(u32 clientid, struct xdr_netobj *ownername)
 282 {
 283         unsigned int ret;
 284
 285         ret = opaque_hashval(ownername->data, ownername->len);
 286         ret += clientid;
 287         return ret & OWNER_HASH_MASK;
 288 }
 289
 290 /* hash table for nfs4_file */
 291 #define FILE_HASH_BITS                   8
 292 #define FILE_HASH_SIZE                  (1 << FILE_HASH_BITS)
 293
 294 static unsigned int file_hashval(struct inode *ino)
 295 {
 296         /* XXX: why are we hashing on inode pointer, anyway? */
 297         return hash_ptr(ino, FILE_HASH_BITS);
 298 }
 299
 300 static struct hlist_head file_hashtbl[FILE_HASH_SIZE];
 301
 302 static void __nfs4_file_get_access(struct nfs4_file *fp, int oflag)
 303 {
 304         WARN_ON_ONCE(!(fp->fi_fds[oflag] || fp->fi_fds[O_RDWR]));
 305         atomic_inc(&fp->fi_access[oflag]);
 306 }
 307
 308 static void nfs4_file_get_access(struct nfs4_file *fp, int oflag)
 309 {
 310         if (oflag == O_RDWR) {
 311                 __nfs4_file_get_access(fp, O_RDONLY);
 312                 __nfs4_file_get_access(fp, O_WRONLY);
 313         } else
 314                 __nfs4_file_get_access(fp, oflag);
 315 }
 316
 317 static void nfs4_file_put_fd(struct nfs4_file *fp, int oflag)
 318 {
 319         if (fp->fi_fds[oflag]) {
 320                 fput(fp->fi_fds[oflag]);
 321                 fp->fi_fds[oflag] = NULL;
 322         }
 323 }
 324
 325 static void __nfs4_file_put_access(struct nfs4_file *fp, int oflag)
 326 {
 327         if (atomic_dec_and_test(&fp->fi_access[oflag])) {
 328                 nfs4_file_put_fd(fp, oflag);
 329                 if (atomic_read(&fp->fi_access[1 - oflag]) == 0)
 330                         nfs4_file_put_fd(fp, O_RDWR);
 331         }
 332 }
 333
 334 static void nfs4_file_put_access(struct nfs4_file *fp, int oflag)
 335 {
 336         if (oflag == O_RDWR) {
 337                 __nfs4_file_put_access(fp, O_RDONLY);
 338                 __nfs4_file_put_access(fp, O_WRONLY);
 339         } else
 340                 __nfs4_file_put_access(fp, oflag);
 341 }
 342
 343 static struct nfs4_stid *nfs4_alloc_stid(struct nfs4_client *cl, struct
 344 kmem_cache *slab)
 345 {
 346         struct idr *stateids = &cl->cl_stateids;
 347         struct nfs4_stid *stid;
 348         int new_id;
 349
 350         stid = kmem_cache_alloc(slab, GFP_KERNEL);
 351         if (!stid)
 352                 return NULL;
 353
 354         new_id = idr_alloc_cyclic(stateids, stid, 0, 0, GFP_KERNEL);
 355         if (new_id < 0)
 356                 goto out_free;
 357         stid->sc_client = cl;
 358         stid->sc_type = 0;
 359         stid->sc_stateid.si_opaque.so_id = new_id;
 360         stid->sc_stateid.si_opaque.so_clid = cl->cl_clientid;
 361         /* Will be incremented before return to client: */
 362         stid->sc_stateid.si_generation = 0;
 363
 364         /*
 365          * It shouldn't be a problem to reuse an opaque stateid value.
 366          * I don't think it is for 4.1.  But with 4.0 I worry that, for
 367          * example, a stray write retransmission could be accepted by
 368          * the server when it should have been rejected.  Therefore,
 369          * adopt a trick from the sctp code to attempt to maximize the
 370          * amount of time until an id is reused, by ensuring they always
 371          * "increase" (mod INT_MAX):
 372          */
 373         return stid;
 374 out_free:
 375         kmem_cache_free(slab, stid);
 376         return NULL;
 377 }
 378
 379 static struct nfs4_ol_stateid * nfs4_alloc_stateid(struct nfs4_client *clp)
 380 {
 381         return openlockstateid(nfs4_alloc_stid(clp, stateid_slab));
 382 }
 383
 384 /*
 385  * When we recall a delegation, we should be careful not to hand it
 386  * out again straight away.
 387  * To ensure this we keep a pair of bloom filters ('new' and 'old')
 388  * in which the filehandles of recalled delegations are "stored".
 389  * If a filehandle appear in either filter, a delegation is blocked.
 390  * When a delegation is recalled, the filehandle is stored in the "new"
 391  * filter.
 392  * Every 30 seconds we swap the filters and clear the "new" one,
 393  * unless both are empty of course.
 394  *
 395  * Each filter is 256 bits.  We hash the filehandle to 32bit and use the
 396  * low 3 bytes as hash-table indices.
 397  *
 398  * 'state_lock', which is always held when block_delegations() is called,
 399  * is used to manage concurrent access.  Testing does not need the lock
 400  * except when swapping the two filters.
 401  */
 402 static struct bloom_pair {
 403         int     entries, old_entries;
 404         time_t  swap_time;
 405         int     new; /* index into 'set' */
 406         DECLARE_BITMAP(set[2], 256);
 407 } blocked_delegations;
 408
 409 static int delegation_blocked(struct knfsd_fh *fh)
 410 {
 411         u32 hash;
 412         struct bloom_pair *bd = &blocked_delegations;
 413
 414         if (bd->entries == 0)
 415                 return 0;
 416         if (seconds_since_boot() - bd->swap_time > 30) {
 417                 spin_lock(&state_lock);
 418                 if (seconds_since_boot() - bd->swap_time > 30) {
 419                         bd->entries -= bd->old_entries;
 420                         bd->old_entries = bd->entries;
 421                         memset(bd->set[bd->new], 0,
 422                                sizeof(bd->set[0]));
 423                         bd->new = 1-bd->new;
 424                         bd->swap_time = seconds_since_boot();
 425                 }
 426                 spin_unlock(&state_lock);
 427         }
 428         hash = arch_fast_hash(&fh->fh_base, fh->fh_size, 0);
 429         if (test_bit(hash&255, bd->set[0]) &&
 430             test_bit((hash>>8)&255, bd->set[0]) &&
 431             test_bit((hash>>16)&255, bd->set[0]))
 432                 return 1;
 433
 434         if (test_bit(hash&255, bd->set[1]) &&
 435             test_bit((hash>>8)&255, bd->set[1]) &&
 436             test_bit((hash>>16)&255, bd->set[1]))
 437                 return 1;
 438
 439         return 0;
 440 }
 441
 442 static void block_delegations(struct knfsd_fh *fh)
 443 {
 444         u32 hash;
 445         struct bloom_pair *bd = &blocked_delegations;
 446
 447         hash = arch_fast_hash(&fh->fh_base, fh->fh_size, 0);
 448
 449         __set_bit(hash&255, bd->set[bd->new]);
 450         __set_bit((hash>>8)&255, bd->set[bd->new]);
 451         __set_bit((hash>>16)&255, bd->set[bd->new]);
 452         if (bd->entries == 0)
 453                 bd->swap_time = seconds_since_boot();
 454         bd->entries += 1;
 455 }
 456
 457 static struct nfs4_delegation *
 458 alloc_init_deleg(struct nfs4_client *clp, struct nfs4_ol_stateid *stp, struct svc_fh *current_fh)
 459 {
 460         struct nfs4_delegation *dp;
 461
 462         dprintk("NFSD alloc_init_deleg\n");
 463         if (num_delegations > max_delegations)
 464                 return NULL;
 465         if (delegation_blocked(&current_fh->fh_handle))
 466                 return NULL;
 467         dp = delegstateid(nfs4_alloc_stid(clp, deleg_slab));
 468         if (dp == NULL)
 469                 return dp;
 470         /*
 471          * delegation seqid's are never incremented.  The 4.1 special
 472          * meaning of seqid 0 isn't meaningful, really, but let's avoid
 473          * 0 anyway just for consistency and use 1:
 474          */
 475         dp->dl_stid.sc_stateid.si_generation = 1;
 476         num_delegations++;
 477         INIT_LIST_HEAD(&dp->dl_perfile);
 478         INIT_LIST_HEAD(&dp->dl_perclnt);
 479         INIT_LIST_HEAD(&dp->dl_recall_lru);
 480         dp->dl_file = NULL;
 481         dp->dl_type = NFS4_OPEN_DELEGATE_READ;
 482         fh_copy_shallow(&dp->dl_fh, &current_fh->fh_handle);
 483         dp->dl_time = 0;
 484         atomic_set(&dp->dl_count, 1);
 485         nfsd4_init_callback(&dp->dl_recall);
 486         return dp;
 487 }
 488
 489 static void remove_stid(struct nfs4_stid *s)
 490 {
 491         struct idr *stateids = &s->sc_client->cl_stateids;
 492
 493         idr_remove(stateids, s->sc_stateid.si_opaque.so_id);
 494 }
 495
 496 static void nfs4_free_stid(struct kmem_cache *slab, struct nfs4_stid *s)
 497 {
 498         kmem_cache_free(slab, s);
 499 }
 500
 501 void
 502 nfs4_put_delegation(struct nfs4_delegation *dp)
 503 {
 504         if (atomic_dec_and_test(&dp->dl_count)) {
 505                 nfs4_free_stid(deleg_slab, &dp->dl_stid);
 506                 num_delegations--;
 507         }
 508 }
 509
 510 static void nfs4_put_deleg_lease(struct nfs4_file *fp)
 511 {
 512         if (!fp->fi_lease)
 513                 return;
 514         if (atomic_dec_and_test(&fp->fi_delegees)) {
 515                 vfs_setlease(fp->fi_deleg_file, F_UNLCK, &fp->fi_lease);
 516                 fp->fi_lease = NULL;
 517                 fput(fp->fi_deleg_file);
 518                 fp->fi_deleg_file = NULL;
 519         }
 520 }
 521
 522 static void unhash_stid(struct nfs4_stid *s)
 523 {
 524         s->sc_type = 0;
 525 }
 526
 527 static void
 528 hash_delegation_locked(struct nfs4_delegation *dp, struct nfs4_file *fp)
 529 {
 530         lockdep_assert_held(&state_lock);
 531
 532         dp->dl_stid.sc_type = NFS4_DELEG_STID;
 533         list_add(&dp->dl_perfile, &fp->fi_delegations);
 534         list_add(&dp->dl_perclnt, &dp->dl_stid.sc_client->cl_delegations);
 535 }
 536
 537 /* Called under the state lock. */
 538 static void
 539 unhash_delegation(struct nfs4_delegation *dp)
 540 {
 541         spin_lock(&state_lock);
 542         list_del_init(&dp->dl_perclnt);
 543         list_del_init(&dp->dl_perfile);
 544         list_del_init(&dp->dl_recall_lru);
 545         spin_unlock(&state_lock);
 546         if (dp->dl_file) {
 547                 nfs4_put_deleg_lease(dp->dl_file);
 548                 put_nfs4_file(dp->dl_file);
 549                 dp->dl_file = NULL;
 550         }
 551 }
 552
 553
 554
 555 static void destroy_revoked_delegation(struct nfs4_delegation *dp)
 556 {
 557         list_del_init(&dp->dl_recall_lru);
 558         remove_stid(&dp->dl_stid);
 559         nfs4_put_delegation(dp);
 560 }
 561
 562 static void destroy_delegation(struct nfs4_delegation *dp)
 563 {
 564         unhash_delegation(dp);
 565         remove_stid(&dp->dl_stid);
 566         nfs4_put_delegation(dp);
 567 }
 568
 569 static void revoke_delegation(struct nfs4_delegation *dp)
 570 {
 571         struct nfs4_client *clp = dp->dl_stid.sc_client;
 572
 573         if (clp->cl_minorversion == 0)
 574                 destroy_delegation(dp);
 575         else {
 576                 unhash_delegation(dp);
 577                 dp->dl_stid.sc_type = NFS4_REVOKED_DELEG_STID;
 578                 list_add(&dp->dl_recall_lru, &clp->cl_revoked);
 579         }
 580 }
 581
 582 /*
 583  * SETCLIENTID state
 584  */
 585
 586 static unsigned int clientid_hashval(u32 id)
 587 {
 588         return id & CLIENT_HASH_MASK;
 589 }
 590
 591 static unsigned int clientstr_hashval(const char *name)
 592 {
 593         return opaque_hashval(name, 8) & CLIENT_HASH_MASK;
 594 }
 595
 596 /*
 597  * We store the NONE, READ, WRITE, and BOTH bits separately in the
 598  * st_{access,deny}_bmap field of the stateid, in order to track not
 599  * only what share bits are currently in force, but also what
 600  * combinations of share bits previous opens have used.  This allows us
 601  * to enforce the recommendation of rfc 3530 14.2.19 that the server
 602  * return an error if the client attempt to downgrade to a combination
 603  * of share bits not explicable by closing some of its previous opens.
 604  *
 605  * XXX: This enforcement is actually incomplete, since we don't keep
 606  * track of access/deny bit combinations; so, e.g., we allow:
 607  *
 608  *      OPEN allow read, deny write
 609  *      OPEN allow both, deny none
 610  *      DOWNGRADE allow read, deny none
 611  *
 612  * which we should reject.
 613  */
 614 static unsigned int
 615 bmap_to_share_mode(unsigned long bmap) {
 616         int i;
 617         unsigned int access = 0;
 618
 619         for (i = 1; i < 4; i++) {
 620                 if (test_bit(i, &bmap))
 621                         access |= i;
 622         }
 623         return access;
 624 }
 625
 626 static bool
 627 test_share(struct nfs4_ol_stateid *stp, struct nfsd4_open *open) {
 628         unsigned int access, deny;
 629
 630         access = bmap_to_share_mode(stp->st_access_bmap);
 631         deny = bmap_to_share_mode(stp->st_deny_bmap);
 632         if ((access & open->op_share_deny) || (deny & open->op_share_access))
 633                 return false;
 634         return true;
 635 }
 636
 637 /* set share access for a given stateid */
 638 static inline void
 639 set_access(u32 access, struct nfs4_ol_stateid *stp)
 640 {
 641         __set_bit(access, &stp->st_access_bmap);
 642 }
 643
 644 /* clear share access for a given stateid */
 645 static inline void
 646 clear_access(u32 access, struct nfs4_ol_stateid *stp)
 647 {
 648         __clear_bit(access, &stp->st_access_bmap);
 649 }
 650
 651 /* test whether a given stateid has access */
 652 static inline bool
 653 test_access(u32 access, struct nfs4_ol_stateid *stp)
 654 {
 655         return test_bit(access, &stp->st_access_bmap);
 656 }
 657
 658 /* set share deny for a given stateid */
 659 static inline void
 660 set_deny(u32 access, struct nfs4_ol_stateid *stp)
 661 {
 662         __set_bit(access, &stp->st_deny_bmap);
 663 }
 664
 665 /* clear share deny for a given stateid */
 666 static inline void
 667 clear_deny(u32 access, struct nfs4_ol_stateid *stp)
 668 {
 669         __clear_bit(access, &stp->st_deny_bmap);
 670 }
 671
 672 /* test whether a given stateid is denying specific access */
 673 static inline bool
 674 test_deny(u32 access, struct nfs4_ol_stateid *stp)
 675 {
 676         return test_bit(access, &stp->st_deny_bmap);
 677 }
 678
 679 static int nfs4_access_to_omode(u32 access)
 680 {
 681         switch (access & NFS4_SHARE_ACCESS_BOTH) {
 682         case NFS4_SHARE_ACCESS_READ:
 683                 return O_RDONLY;
 684         case NFS4_SHARE_ACCESS_WRITE:
 685                 return O_WRONLY;
 686         case NFS4_SHARE_ACCESS_BOTH:
 687                 return O_RDWR;
 688         }
 689         WARN_ON_ONCE(1);
 690         return O_RDONLY;
 691 }
 692
 693 /* release all access and file references for a given stateid */
 694 static void
 695 release_all_access(struct nfs4_ol_stateid *stp)
 696 {
 697         int i;
 698
 699         for (i = 1; i < 4; i++) {
 700                 if (test_access(i, stp))
 701                         nfs4_file_put_access(stp->st_file,
 702                                              nfs4_access_to_omode(i));
 703                 clear_access(i, stp);
 704         }
 705 }
 706
 707 static void unhash_generic_stateid(struct nfs4_ol_stateid *stp)
 708 {
 709         list_del(&stp->st_perfile);
 710         list_del(&stp->st_perstateowner);
 711 }
 712
 713 static void close_generic_stateid(struct nfs4_ol_stateid *stp)
 714 {
 715         release_all_access(stp);
 716         put_nfs4_file(stp->st_file);
 717         stp->st_file = NULL;
 718 }
 719
 720 static void free_generic_stateid(struct nfs4_ol_stateid *stp)
 721 {
 722         remove_stid(&stp->st_stid);
 723         nfs4_free_stid(stateid_slab, &stp->st_stid);
 724 }
 725
 726 static void __release_lock_stateid(struct nfs4_ol_stateid *stp)
 727 {
 728         struct file *file;
 729
 730         list_del(&stp->st_locks);
 731         unhash_generic_stateid(stp);
 732         unhash_stid(&stp->st_stid);
 733         file = find_any_file(stp->st_file);
 734         if (file)
 735                 locks_remove_posix(file, (fl_owner_t)lockowner(stp->st_stateowner));
 736         close_generic_stateid(stp);
 737         free_generic_stateid(stp);
 738 }
 739
 740 static void unhash_lockowner(struct nfs4_lockowner *lo)
 741 {
 742         struct nfs4_ol_stateid *stp;
 743
 744         list_del(&lo->lo_owner.so_strhash);
 745         while (!list_empty(&lo->lo_owner.so_stateids)) {
 746                 stp = list_first_entry(&lo->lo_owner.so_stateids,
 747                                 struct nfs4_ol_stateid, st_perstateowner);
 748                 __release_lock_stateid(stp);
 749         }
 750 }
 751
 752 static void nfs4_free_lockowner(struct nfs4_lockowner *lo)
 753 {
 754         kfree(lo->lo_owner.so_owner.data);
 755         kmem_cache_free(lockowner_slab, lo);
 756 }
 757
 758 static void release_lockowner(struct nfs4_lockowner *lo)
 759 {
 760         unhash_lockowner(lo);
 761         nfs4_free_lockowner(lo);
 762 }
 763
 764 static void release_lockowner_if_empty(struct nfs4_lockowner *lo)
 765 {
 766         if (list_empty(&lo->lo_owner.so_stateids))
 767                 release_lockowner(lo);
 768 }
 769
 770 static void release_lock_stateid(struct nfs4_ol_stateid *stp)
 771 {
 772         struct nfs4_lockowner *lo;
 773
 774         lo = lockowner(stp->st_stateowner);
 775         __release_lock_stateid(stp);
 776         release_lockowner_if_empty(lo);
 777 }
 778
 779 static void release_open_stateid_locks(struct nfs4_ol_stateid *open_stp)
 780 {
 781         struct nfs4_ol_stateid *stp;
 782
 783         while (!list_empty(&open_stp->st_locks)) {
 784                 stp = list_entry(open_stp->st_locks.next,
 785                                 struct nfs4_ol_stateid, st_locks);
 786                 release_lock_stateid(stp);
 787         }
 788 }
 789
 790 static void unhash_open_stateid(struct nfs4_ol_stateid *stp)
 791 {
 792         unhash_generic_stateid(stp);
 793         release_open_stateid_locks(stp);
 794         close_generic_stateid(stp);
 795 }
 796
 797 static void release_open_stateid(struct nfs4_ol_stateid *stp)
 798 {
 799         unhash_open_stateid(stp);
 800         free_generic_stateid(stp);
 801 }
 802
 803 static void unhash_openowner(struct nfs4_openowner *oo)
 804 {
 805         struct nfs4_ol_stateid *stp;
 806
 807         list_del(&oo->oo_owner.so_strhash);
 808         list_del(&oo->oo_perclient);
 809         while (!list_empty(&oo->oo_owner.so_stateids)) {
 810                 stp = list_first_entry(&oo->oo_owner.so_stateids,
 811                                 struct nfs4_ol_stateid, st_perstateowner);
 812                 release_open_stateid(stp);
 813         }
 814 }
 815
 816 static void release_last_closed_stateid(struct nfs4_openowner *oo)
 817 {
 818         struct nfs4_ol_stateid *s = oo->oo_last_closed_stid;
 819
 820         if (s) {
 821                 free_generic_stateid(s);
 822                 oo->oo_last_closed_stid = NULL;
 823         }
 824 }
 825
 826 static void nfs4_free_openowner(struct nfs4_openowner *oo)
 827 {
 828         kfree(oo->oo_owner.so_owner.data);
 829         kmem_cache_free(openowner_slab, oo);
 830 }
 831
 832 static void release_openowner(struct nfs4_openowner *oo)
 833 {
 834         unhash_openowner(oo);
 835         list_del(&oo->oo_close_lru);
 836         release_last_closed_stateid(oo);
 837         nfs4_free_openowner(oo);
 838 }
 839
 840 static inline int
 841 hash_sessionid(struct nfs4_sessionid *sessionid)
 842 {
 843         struct nfsd4_sessionid *sid = (struct nfsd4_sessionid *)sessionid;
 844
 845         return sid->sequence % SESSION_HASH_SIZE;
 846 }
 847
 848 #ifdef NFSD_DEBUG
 849 static inline void
 850 dump_sessionid(const char *fn, struct nfs4_sessionid *sessionid)
 851 {
 852         u32 *ptr = (u32 *)(&sessionid->data[0]);
 853         dprintk("%s: %u:%u:%u:%u\n", fn, ptr[0], ptr[1], ptr[2], ptr[3]);
 854 }
 855 #else
 856 static inline void
 857 dump_sessionid(const char *fn, struct nfs4_sessionid *sessionid)
 858 {
 859 }
 860 #endif
 861
 862 /*
 863  * Bump the seqid on cstate->replay_owner, and clear replay_owner if it
 864  * won't be used for replay.
 865  */
 866 void nfsd4_bump_seqid(struct nfsd4_compound_state *cstate, __be32 nfserr)
 867 {
 868         struct nfs4_stateowner *so = cstate->replay_owner;
 869
 870         if (nfserr == nfserr_replay_me)
 871                 return;
 872
 873         if (!seqid_mutating_err(ntohl(nfserr))) {
 874                 cstate->replay_owner = NULL;
 875                 return;
 876         }
 877         if (!so)
 878                 return;
 879         if (so->so_is_open_owner)
 880                 release_last_closed_stateid(openowner(so));
 881         so->so_seqid++;
 882         return;
 883 }
 884
 885 static void
 886 gen_sessionid(struct nfsd4_session *ses)
 887 {
 888         struct nfs4_client *clp = ses->se_client;
 889         struct nfsd4_sessionid *sid;
 890
 891         sid = (struct nfsd4_sessionid *)ses->se_sessionid.data;
 892         sid->clientid = clp->cl_clientid;
 893         sid->sequence = current_sessionid++;
 894         sid->reserved = 0;
 895 }
 896
 897 /*
 898  * The protocol defines ca_maxresponssize_cached to include the size of
 899  * the rpc header, but all we need to cache is the data starting after
 900  * the end of the initial SEQUENCE operation--the rest we regenerate
 901  * each time.  Therefore we can advertise a ca_maxresponssize_cached
 902  * value that is the number of bytes in our cache plus a few additional
 903  * bytes.  In order to stay on the safe side, and not promise more than
 904  * we can cache, those additional bytes must be the minimum possible: 24
 905  * bytes of rpc header (xid through accept state, with AUTH_NULL
 906  * verifier), 12 for the compound header (with zero-length tag), and 44
 907  * for the SEQUENCE op response:
 908  */
 909 #define NFSD_MIN_HDR_SEQ_SZ  (24 + 12 + 44)
 910
 911 static void
 912 free_session_slots(struct nfsd4_session *ses)
 913 {
 914         int i;
 915
 916         for (i = 0; i < ses->se_fchannel.maxreqs; i++)
 917                 kfree(ses->se_slots[i]);
 918 }
 919
 920 /*
 921  * We don't actually need to cache the rpc and session headers, so we
 922  * can allocate a little less for each slot:
 923  */
 924 static inline u32 slot_bytes(struct nfsd4_channel_attrs *ca)
 925 {
 926         u32 size;
 927
 928         if (ca->maxresp_cached < NFSD_MIN_HDR_SEQ_SZ)
 929                 size = 0;
 930         else
 931                 size = ca->maxresp_cached - NFSD_MIN_HDR_SEQ_SZ;
 932         return size + sizeof(struct nfsd4_slot);
 933 }
 934
 935 /*
 936  * XXX: If we run out of reserved DRC memory we could (up to a point)
 937  * re-negotiate active sessions and reduce their slot usage to make
 938  * room for new connections. For now we just fail the create session.
 939  */
 940 static u32 nfsd4_get_drc_mem(struct nfsd4_channel_attrs *ca)
 941 {
 942         u32 slotsize = slot_bytes(ca);
 943         u32 num = ca->maxreqs;
 944         int avail;
 945
 946         spin_lock(&nfsd_drc_lock);
 947         avail = min((unsigned long)NFSD_MAX_MEM_PER_SESSION,
 948                     nfsd_drc_max_mem - nfsd_drc_mem_used);
 949         num = min_t(int, num, avail / slotsize);
 950         nfsd_drc_mem_used += num * slotsize;
 951         spin_unlock(&nfsd_drc_lock);
 952
 953         return num;
 954 }
 955
 956 static void nfsd4_put_drc_mem(struct nfsd4_channel_attrs *ca)
 957 {
 958         int slotsize = slot_bytes(ca);
 959
 960         spin_lock(&nfsd_drc_lock);
 961         nfsd_drc_mem_used -= slotsize * ca->maxreqs;
 962         spin_unlock(&nfsd_drc_lock);
 963 }
 964
 965 static struct nfsd4_session *alloc_session(struct nfsd4_channel_attrs *fattrs,
 966                                            struct nfsd4_channel_attrs *battrs)
 967 {
 968         int numslots = fattrs->maxreqs;
 969         int slotsize = slot_bytes(fattrs);
 970         struct nfsd4_session *new;
 971         int mem, i;
 972
 973         BUILD_BUG_ON(NFSD_MAX_SLOTS_PER_SESSION * sizeof(struct nfsd4_slot *)
 974                         + sizeof(struct nfsd4_session) > PAGE_SIZE);
 975         mem = numslots * sizeof(struct nfsd4_slot *);
 976
 977         new = kzalloc(sizeof(*new) + mem, GFP_KERNEL);
 978         if (!new)
 979                 return NULL;
 980         /* allocate each struct nfsd4_slot and data cache in one piece */
 981         for (i = 0; i < numslots; i++) {
 982                 new->se_slots[i] = kzalloc(slotsize, GFP_KERNEL);
 983                 if (!new->se_slots[i])
 984                         goto out_free;
 985         }
 986
 987         memcpy(&new->se_fchannel, fattrs, sizeof(struct nfsd4_channel_attrs));
 988         memcpy(&new->se_bchannel, battrs, sizeof(struct nfsd4_channel_attrs));
 989
 990         return new;
 991 out_free:
 992         while (i--)
 993                 kfree(new->se_slots[i]);
 994         kfree(new);
 995         return NULL;
 996 }
 997
 998 static void free_conn(struct nfsd4_conn *c)
 999 {
1000         svc_xprt_put(c->cn_xprt);
1001         kfree(c);
1002 }
1003
1004 static void nfsd4_conn_lost(struct svc_xpt_user *u)
1005 {
1006         struct nfsd4_conn *c = container_of(u, struct nfsd4_conn, cn_xpt_user);
1007         struct nfs4_client *clp = c->cn_session->se_client;
1008
1009         spin_lock(&clp->cl_lock);
1010         if (!list_empty(&c->cn_persession)) {
1011                 list_del(&c->cn_persession);
1012                 free_conn(c);
1013         }
1014         nfsd4_probe_callback(clp);
1015         spin_unlock(&clp->cl_lock);
1016 }
1017
1018 static struct nfsd4_conn *alloc_conn(struct svc_rqst *rqstp, u32 flags)
1019 {
1020         struct nfsd4_conn *conn;
1021
1022         conn = kmalloc(sizeof(struct nfsd4_conn), GFP_KERNEL);
1023         if (!conn)
1024                 return NULL;
1025         svc_xprt_get(rqstp->rq_xprt);
1026         conn->cn_xprt = rqstp->rq_xprt;
1027         conn->cn_flags = flags;
1028         INIT_LIST_HEAD(&conn->cn_xpt_user.list);
1029         return conn;
1030 }
1031
1032 static void __nfsd4_hash_conn(struct nfsd4_conn *conn, struct nfsd4_session *ses)
1033 {
1034         conn->cn_session = ses;
1035         list_add(&conn->cn_persession, &ses->se_conns);
1036 }
1037
1038 static void nfsd4_hash_conn(struct nfsd4_conn *conn, struct nfsd4_session *ses)
1039 {
1040         struct nfs4_client *clp = ses->se_client;
1041
1042         spin_lock(&clp->cl_lock);
1043         __nfsd4_hash_conn(conn, ses);
1044         spin_unlock(&clp->cl_lock);
1045 }
1046
1047 static int nfsd4_register_conn(struct nfsd4_conn *conn)
1048 {
1049         conn->cn_xpt_user.callback = nfsd4_conn_lost;
1050         return register_xpt_user(conn->cn_xprt, &conn->cn_xpt_user);
1051 }
1052
1053 static void nfsd4_init_conn(struct svc_rqst *rqstp, struct nfsd4_conn *conn, struct nfsd4_session *ses)
1054 {
1055         int ret;
1056
1057         nfsd4_hash_conn(conn, ses);
1058         ret = nfsd4_register_conn(conn);
1059         if (ret)
1060                 /* oops; xprt is already down: */
1061                 nfsd4_conn_lost(&conn->cn_xpt_user);
1062         if (conn->cn_flags & NFS4_CDFC4_BACK) {
1063                 /* callback channel may be back up */
1064                 nfsd4_probe_callback(ses->se_client);
1065         }
1066 }
1067
1068 static struct nfsd4_conn *alloc_conn_from_crses(struct svc_rqst *rqstp, struct nfsd4_create_session *cses)
1069 {
1070         u32 dir = NFS4_CDFC4_FORE;
1071
1072         if (cses->flags & SESSION4_BACK_CHAN)
1073                 dir |= NFS4_CDFC4_BACK;
1074         return alloc_conn(rqstp, dir);
1075 }
1076
1077 /* must be called under client_lock */
1078 static void nfsd4_del_conns(struct nfsd4_session *s)
1079 {
1080         struct nfs4_client *clp = s->se_client;
1081         struct nfsd4_conn *c;
1082
1083         spin_lock(&clp->cl_lock);
1084         while (!list_empty(&s->se_conns)) {
1085                 c = list_first_entry(&s->se_conns, struct nfsd4_conn, cn_persession);
1086                 list_del_init(&c->cn_persession);
1087                 spin_unlock(&clp->cl_lock);
1088
1089                 unregister_xpt_user(c->cn_xprt, &c->cn_xpt_user);
1090                 free_conn(c);
1091
1092                 spin_lock(&clp->cl_lock);
1093         }
1094         spin_unlock(&clp->cl_lock);
1095 }
1096
1097 static void __free_session(struct nfsd4_session *ses)
1098 {
1099         free_session_slots(ses);
1100         kfree(ses);
1101 }
1102
1103 static void free_session(struct nfsd4_session *ses)
1104 {
1105         struct nfsd_net *nn = net_generic(ses->se_client->net, nfsd_net_id);
1106
1107         lockdep_assert_held(&nn->client_lock);
1108         nfsd4_del_conns(ses);
1109         nfsd4_put_drc_mem(&ses->se_fchannel);
1110         __free_session(ses);
1111 }
1112
1113 static void init_session(struct svc_rqst *rqstp, struct nfsd4_session *new, struct nfs4_client *clp, struct nfsd4_create_session *cses)
1114 {
1115         int idx;
1116         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
1117
1118         new->se_client = clp;
1119         gen_sessionid(new);
1120
1121         INIT_LIST_HEAD(&new->se_conns);
1122
1123         new->se_cb_seq_nr = 1;
1124         new->se_flags = cses->flags;
1125         new->se_cb_prog = cses->callback_prog;
1126         new->se_cb_sec = cses->cb_sec;
1127         atomic_set(&new->se_ref, 0);
1128         idx = hash_sessionid(&new->se_sessionid);
1129         spin_lock(&nn->client_lock);
1130         list_add(&new->se_hash, &nn->sessionid_hashtbl[idx]);
1131         spin_lock(&clp->cl_lock);
1132         list_add(&new->se_perclnt, &clp->cl_sessions);
1133         spin_unlock(&clp->cl_lock);
1134         spin_unlock(&nn->client_lock);
1135
1136         if (cses->flags & SESSION4_BACK_CHAN) {
1137                 struct sockaddr *sa = svc_addr(rqstp);
1138                 /*
1139                  * This is a little silly; with sessions there's no real
1140                  * use for the callback address.  Use the peer address
1141                  * as a reasonable default for now, but consider fixing
1142                  * the rpc client not to require an address in the
1143                  * future:
1144                  */
1145                 rpc_copy_addr((struct sockaddr *)&clp->cl_cb_conn.cb_addr, sa);
1146                 clp->cl_cb_conn.cb_addrlen = svc_addr_len(sa);
1147         }
1148 }
1149
1150 /* caller must hold client_lock */
1151 static struct nfsd4_session *
1152 __find_in_sessionid_hashtbl(struct nfs4_sessionid *sessionid, struct net *net)
1153 {
1154         struct nfsd4_session *elem;
1155         int idx;
1156         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
1157
1158         dump_sessionid(__func__, sessionid);
1159         idx = hash_sessionid(sessionid);
1160         /* Search in the appropriate list */
1161         list_for_each_entry(elem, &nn->sessionid_hashtbl[idx], se_hash) {
1162                 if (!memcmp(elem->se_sessionid.data, sessionid->data,
1163                             NFS4_MAX_SESSIONID_LEN)) {
1164                         return elem;
1165                 }
1166         }
1167
1168         dprintk("%s: session not found\n", __func__);
1169         return NULL;
1170 }
1171
1172 static struct nfsd4_session *
1173 find_in_sessionid_hashtbl(struct nfs4_sessionid *sessionid, struct net *net,
1174                 __be32 *ret)
1175 {
1176         struct nfsd4_session *session;
1177         __be32 status = nfserr_badsession;
1178
1179         session = __find_in_sessionid_hashtbl(sessionid, net);
1180         if (!session)
1181                 goto out;
1182         status = nfsd4_get_session_locked(session);
1183         if (status)
1184                 session = NULL;
1185 out:
1186         *ret = status;
1187         return session;
1188 }
1189
1190 /* caller must hold client_lock */
1191 static void
1192 unhash_session(struct nfsd4_session *ses)
1193 {
1194         list_del(&ses->se_hash);
1195         spin_lock(&ses->se_client->cl_lock);
1196         list_del(&ses->se_perclnt);
1197         spin_unlock(&ses->se_client->cl_lock);
1198 }
1199
1200 /* SETCLIENTID and SETCLIENTID_CONFIRM Helper functions */
1201 static int
1202 STALE_CLIENTID(clientid_t *clid, struct nfsd_net *nn)
1203 {
1204         if (clid->cl_boot == nn->boot_time)
1205                 return 0;
1206         dprintk("NFSD stale clientid (%08x/%08x) boot_time %08lx\n",
1207                 clid->cl_boot, clid->cl_id, nn->boot_time);
1208         return 1;
1209 }
1210
1211 /*
1212  * XXX Should we use a slab cache ?
1213  * This type of memory management is somewhat inefficient, but we use it
1214  * anyway since SETCLIENTID is not a common operation.
1215  */
1216 static struct nfs4_client *alloc_client(struct xdr_netobj name)
1217 {
1218         struct nfs4_client *clp;
1219
1220         clp = kzalloc(sizeof(struct nfs4_client), GFP_KERNEL);
1221         if (clp == NULL)
1222                 return NULL;
1223         clp->cl_name.data = kmemdup(name.data, name.len, GFP_KERNEL);
1224         if (clp->cl_name.data == NULL) {
1225                 kfree(clp);
1226                 return NULL;
1227         }
1228         clp->cl_name.len = name.len;
1229         INIT_LIST_HEAD(&clp->cl_sessions);
1230         idr_init(&clp->cl_stateids);
1231         atomic_set(&clp->cl_refcount, 0);
1232         clp->cl_cb_state = NFSD4_CB_UNKNOWN;
1233         INIT_LIST_HEAD(&clp->cl_idhash);
1234         INIT_LIST_HEAD(&clp->cl_openowners);
1235         INIT_LIST_HEAD(&clp->cl_delegations);
1236         INIT_LIST_HEAD(&clp->cl_lru);
1237         INIT_LIST_HEAD(&clp->cl_callbacks);
1238         INIT_LIST_HEAD(&clp->cl_revoked);
1239         spin_lock_init(&clp->cl_lock);
1240         rpc_init_wait_queue(&clp->cl_cb_waitq, "Backchannel slot table");
1241         return clp;
1242 }
1243
1244 static void
1245 free_client(struct nfs4_client *clp)
1246 {
1247         struct nfsd_net __maybe_unused *nn = net_generic(clp->net, nfsd_net_id);
1248
1249         lockdep_assert_held(&nn->client_lock);
1250         while (!list_empty(&clp->cl_sessions)) {
1251                 struct nfsd4_session *ses;
1252                 ses = list_entry(clp->cl_sessions.next, struct nfsd4_session,
1253                                 se_perclnt);
1254                 list_del(&ses->se_perclnt);
1255                 WARN_ON_ONCE(atomic_read(&ses->se_ref));
1256                 free_session(ses);
1257         }
1258         rpc_destroy_wait_queue(&clp->cl_cb_waitq);
1259         free_svc_cred(&clp->cl_cred);
1260         kfree(clp->cl_name.data);
1261         idr_destroy(&clp->cl_stateids);
1262         kfree(clp);
1263 }
1264
1265 /* must be called under the client_lock */
1266 static inline void
1267 unhash_client_locked(struct nfs4_client *clp)
1268 {
1269         struct nfsd4_session *ses;
1270
1271         list_del(&clp->cl_lru);
1272         spin_lock(&clp->cl_lock);
1273         list_for_each_entry(ses, &clp->cl_sessions, se_perclnt)
1274                 list_del_init(&ses->se_hash);
1275         spin_unlock(&clp->cl_lock);
1276 }
1277
1278 static void
1279 destroy_client(struct nfs4_client *clp)
1280 {
1281         struct nfs4_openowner *oo;
1282         struct nfs4_delegation *dp;
1283         struct list_head reaplist;
1284         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
1285
1286         INIT_LIST_HEAD(&reaplist);
1287         spin_lock(&state_lock);
1288         while (!list_empty(&clp->cl_delegations)) {
1289                 dp = list_entry(clp->cl_delegations.next, struct nfs4_delegation, dl_perclnt);
1290                 list_del_init(&dp->dl_perclnt);
1291                 /* Ensure that deleg break won't try to requeue it */
1292                 ++dp->dl_time;
1293                 list_move(&dp->dl_recall_lru, &reaplist);
1294         }
1295         spin_unlock(&state_lock);
1296         while (!list_empty(&reaplist)) {
1297                 dp = list_entry(reaplist.next, struct nfs4_delegation, dl_recall_lru);
1298                 destroy_delegation(dp);
1299         }
1300         list_splice_init(&clp->cl_revoked, &reaplist);
1301         while (!list_empty(&reaplist)) {
1302                 dp = list_entry(reaplist.next, struct nfs4_delegation, dl_recall_lru);
1303                 destroy_revoked_delegation(dp);
1304         }
1305         while (!list_empty(&clp->cl_openowners)) {
1306                 oo = list_entry(clp->cl_openowners.next, struct nfs4_openowner, oo_perclient);
1307                 release_openowner(oo);
1308         }
1309         nfsd4_shutdown_callback(clp);
1310         if (clp->cl_cb_conn.cb_xprt)
1311                 svc_xprt_put(clp->cl_cb_conn.cb_xprt);
1312         list_del(&clp->cl_idhash);
1313         if (test_bit(NFSD4_CLIENT_CONFIRMED, &clp->cl_flags))
1314                 rb_erase(&clp->cl_namenode, &nn->conf_name_tree);
1315         else
1316                 rb_erase(&clp->cl_namenode, &nn->unconf_name_tree);
1317         spin_lock(&nn->client_lock);
1318         unhash_client_locked(clp);
1319         WARN_ON_ONCE(atomic_read(&clp->cl_refcount));
1320         free_client(clp);
1321         spin_unlock(&nn->client_lock);
1322 }
1323
1324 static void expire_client(struct nfs4_client *clp)
1325 {
1326         nfsd4_client_record_remove(clp);
1327         destroy_client(clp);
1328 }
1329
1330 static void copy_verf(struct nfs4_client *target, nfs4_verifier *source)
1331 {
1332         memcpy(target->cl_verifier.data, source->data,
1333                         sizeof(target->cl_verifier.data));
1334 }
1335
1336 static void copy_clid(struct nfs4_client *target, struct nfs4_client *source)
1337 {
1338         target->cl_clientid.cl_boot = source->cl_clientid.cl_boot;
1339         target->cl_clientid.cl_id = source->cl_clientid.cl_id;
1340 }
1341
1342 static int copy_cred(struct svc_cred *target, struct svc_cred *source)
1343 {
1344         if (source->cr_principal) {
1345                 target->cr_principal =
1346                                 kstrdup(source->cr_principal, GFP_KERNEL);
1347                 if (target->cr_principal == NULL)
1348                         return -ENOMEM;
1349         } else
1350                 target->cr_principal = NULL;
1351         target->cr_flavor = source->cr_flavor;
1352         target->cr_uid = source->cr_uid;
1353         target->cr_gid = source->cr_gid;
1354         target->cr_group_info = source->cr_group_info;
1355         get_group_info(target->cr_group_info);
1356         target->cr_gss_mech = source->cr_gss_mech;
1357         if (source->cr_gss_mech)
1358                 gss_mech_get(source->cr_gss_mech);
1359         return 0;
1360 }
1361
1362 static long long
1363 compare_blob(const struct xdr_netobj *o1, const struct xdr_netobj *o2)
1364 {
1365         long long res;
1366
1367         res = o1->len - o2->len;
1368         if (res)
1369                 return res;
1370         return (long long)memcmp(o1->data, o2->data, o1->len);
1371 }
1372
1373 static int same_name(const char *n1, const char *n2)
1374 {
1375         return 0 == memcmp(n1, n2, HEXDIR_LEN);
1376 }
1377
1378 static int
1379 same_verf(nfs4_verifier *v1, nfs4_verifier *v2)
1380 {
1381         return 0 == memcmp(v1->data, v2->data, sizeof(v1->data));
1382 }
1383
1384 static int
1385 same_clid(clientid_t *cl1, clientid_t *cl2)
1386 {
1387         return (cl1->cl_boot == cl2->cl_boot) && (cl1->cl_id == cl2->cl_id);
1388 }
1389
1390 static bool groups_equal(struct group_info *g1, struct group_info *g2)
1391 {
1392         int i;
1393
1394         if (g1->ngroups != g2->ngroups)
1395                 return false;
1396         for (i=0; i<g1->ngroups; i++)
1397                 if (!gid_eq(GROUP_AT(g1, i), GROUP_AT(g2, i)))
1398                         return false;
1399         return true;
1400 }
1401
1402 /*
1403  * RFC 3530 language requires clid_inuse be returned when the
1404  * "principal" associated with a requests differs from that previously
1405  * used.  We use uid, gid's, and gss principal string as our best
1406  * approximation.  We also don't want to allow non-gss use of a client
1407  * established using gss: in theory cr_principal should catch that
1408  * change, but in practice cr_principal can be null even in the gss case
1409  * since gssd doesn't always pass down a principal string.
1410  */
1411 static bool is_gss_cred(struct svc_cred *cr)
1412 {
1413         /* Is cr_flavor one of the gss "pseudoflavors"?: */
1414         return (cr->cr_flavor > RPC_AUTH_MAXFLAVOR);
1415 }
1416
1417
1418 static bool
1419 same_creds(struct svc_cred *cr1, struct svc_cred *cr2)
1420 {
1421         if ((is_gss_cred(cr1) != is_gss_cred(cr2))
1422                 || (!uid_eq(cr1->cr_uid, cr2->cr_uid))
1423                 || (!gid_eq(cr1->cr_gid, cr2->cr_gid))
1424                 || !groups_equal(cr1->cr_group_info, cr2->cr_group_info))
1425                 return false;
1426         if (cr1->cr_principal == cr2->cr_principal)
1427                 return true;
1428         if (!cr1->cr_principal || !cr2->cr_principal)
1429                 return false;
1430         return 0 == strcmp(cr1->cr_principal, cr2->cr_principal);
1431 }
1432
1433 static bool svc_rqst_integrity_protected(struct svc_rqst *rqstp)
1434 {
1435         struct svc_cred *cr = &rqstp->rq_cred;
1436         u32 service;
1437
1438         if (!cr->cr_gss_mech)
1439                 return false;
1440         service = gss_pseudoflavor_to_service(cr->cr_gss_mech, cr->cr_flavor);
1441         return service == RPC_GSS_SVC_INTEGRITY ||
1442                service == RPC_GSS_SVC_PRIVACY;
1443 }
1444
1445 static bool mach_creds_match(struct nfs4_client *cl, struct svc_rqst *rqstp)
1446 {
1447         struct svc_cred *cr = &rqstp->rq_cred;
1448
1449         if (!cl->cl_mach_cred)
1450                 return true;
1451         if (cl->cl_cred.cr_gss_mech != cr->cr_gss_mech)
1452                 return false;
1453         if (!svc_rqst_integrity_protected(rqstp))
1454                 return false;
1455         if (!cr->cr_principal)
1456                 return false;
1457         return 0 == strcmp(cl->cl_cred.cr_principal, cr->cr_principal);
1458 }
1459
1460 static void gen_clid(struct nfs4_client *clp, struct nfsd_net *nn)
1461 {
1462         static u32 current_clientid = 1;
1463
1464         clp->cl_clientid.cl_boot = nn->boot_time;
1465         clp->cl_clientid.cl_id = current_clientid++;
1466 }
1467
1468 static void gen_confirm(struct nfs4_client *clp)
1469 {
1470         __be32 verf[2];
1471         static u32 i;
1472
1473         /*
1474          * This is opaque to client, so no need to byte-swap. Use
1475          * __force to keep sparse happy
1476          */
1477         verf[0] = (__force __be32)get_seconds();
1478         verf[1] = (__force __be32)i++;
1479         memcpy(clp->cl_confirm.data, verf, sizeof(clp->cl_confirm.data));
1480 }
1481
1482 static struct nfs4_stid *find_stateid(struct nfs4_client *cl, stateid_t *t)
1483 {
1484         struct nfs4_stid *ret;
1485
1486         ret = idr_find(&cl->cl_stateids, t->si_opaque.so_id);
1487         if (!ret || !ret->sc_type)
1488                 return NULL;
1489         return ret;
1490 }
1491
1492 static struct nfs4_stid *find_stateid_by_type(struct nfs4_client *cl, stateid_t *t, char typemask)
1493 {
1494         struct nfs4_stid *s;
1495
1496         s = find_stateid(cl, t);
1497         if (!s)
1498                 return NULL;
1499         if (typemask & s->sc_type)
1500                 return s;
1501         return NULL;
1502 }
1503
1504 static struct nfs4_client *create_client(struct xdr_netobj name,
1505                 struct svc_rqst *rqstp, nfs4_verifier *verf)
1506 {
1507         struct nfs4_client *clp;
1508         struct sockaddr *sa = svc_addr(rqstp);
1509         int ret;
1510         struct net *net = SVC_NET(rqstp);
1511         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
1512
1513         clp = alloc_client(name);
1514         if (clp == NULL)
1515                 return NULL;
1516
1517         ret = copy_cred(&clp->cl_cred, &rqstp->rq_cred);
1518         if (ret) {
1519                 spin_lock(&nn->client_lock);
1520                 free_client(clp);
1521                 spin_unlock(&nn->client_lock);
1522                 return NULL;
1523         }
1524         nfsd4_init_callback(&clp->cl_cb_null);
1525         clp->cl_time = get_seconds();
1526         clear_bit(0, &clp->cl_cb_slot_busy);
1527         copy_verf(clp, verf);
1528         rpc_copy_addr((struct sockaddr *) &clp->cl_addr, sa);
1529         gen_confirm(clp);
1530         clp->cl_cb_session = NULL;
1531         clp->net = net;
1532         return clp;
1533 }
1534
1535 static void
1536 add_clp_to_name_tree(struct nfs4_client *new_clp, struct rb_root *root)
1537 {
1538         struct rb_node **new = &(root->rb_node), *parent = NULL;
1539         struct nfs4_client *clp;
1540
1541         while (*new) {
1542                 clp = rb_entry(*new, struct nfs4_client, cl_namenode);
1543                 parent = *new;
1544
1545                 if (compare_blob(&clp->cl_name, &new_clp->cl_name) > 0)
1546                         new = &((*new)->rb_left);
1547                 else
1548                         new = &((*new)->rb_right);
1549         }
1550
1551         rb_link_node(&new_clp->cl_namenode, parent, new);
1552         rb_insert_color(&new_clp->cl_namenode, root);
1553 }
1554
1555 static struct nfs4_client *
1556 find_clp_in_name_tree(struct xdr_netobj *name, struct rb_root *root)
1557 {
1558         long long cmp;
1559         struct rb_node *node = root->rb_node;
1560         struct nfs4_client *clp;
1561
1562         while (node) {
1563                 clp = rb_entry(node, struct nfs4_client, cl_namenode);
1564                 cmp = compare_blob(&clp->cl_name, name);
1565                 if (cmp > 0)
1566                         node = node->rb_left;
1567                 else if (cmp < 0)
1568                         node = node->rb_right;
1569                 else
1570                         return clp;
1571         }
1572         return NULL;
1573 }
1574
1575 static void
1576 add_to_unconfirmed(struct nfs4_client *clp)
1577 {
1578         unsigned int idhashval;
1579         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
1580
1581         clear_bit(NFSD4_CLIENT_CONFIRMED, &clp->cl_flags);
1582         add_clp_to_name_tree(clp, &nn->unconf_name_tree);
1583         idhashval = clientid_hashval(clp->cl_clientid.cl_id);
1584         list_add(&clp->cl_idhash, &nn->unconf_id_hashtbl[idhashval]);
1585         renew_client(clp);
1586 }
1587
1588 static void
1589 move_to_confirmed(struct nfs4_client *clp)
1590 {
1591         unsigned int idhashval = clientid_hashval(clp->cl_clientid.cl_id);
1592         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
1593
1594         dprintk("NFSD: move_to_confirm nfs4_client %p\n", clp);
1595         list_move(&clp->cl_idhash, &nn->conf_id_hashtbl[idhashval]);
1596         rb_erase(&clp->cl_namenode, &nn->unconf_name_tree);
1597         add_clp_to_name_tree(clp, &nn->conf_name_tree);
1598         set_bit(NFSD4_CLIENT_CONFIRMED, &clp->cl_flags);
1599         renew_client(clp);
1600 }
1601
1602 static struct nfs4_client *
1603 find_client_in_id_table(struct list_head *tbl, clientid_t *clid, bool sessions)
1604 {
1605         struct nfs4_client *clp;
1606         unsigned int idhashval = clientid_hashval(clid->cl_id);
1607
1608         list_for_each_entry(clp, &tbl[idhashval], cl_idhash) {
1609                 if (same_clid(&clp->cl_clientid, clid)) {
1610                         if ((bool)clp->cl_minorversion != sessions)
1611                                 return NULL;
1612                         renew_client(clp);
1613                         return clp;
1614                 }
1615         }
1616         return NULL;
1617 }
1618
1619 static struct nfs4_client *
1620 find_confirmed_client(clientid_t *clid, bool sessions, struct nfsd_net *nn)
1621 {
1622         struct list_head *tbl = nn->conf_id_hashtbl;
1623
1624         return find_client_in_id_table(tbl, clid, sessions);
1625 }
1626
1627 static struct nfs4_client *
1628 find_unconfirmed_client(clientid_t *clid, bool sessions, struct nfsd_net *nn)
1629 {
1630         struct list_head *tbl = nn->unconf_id_hashtbl;
1631
1632         return find_client_in_id_table(tbl, clid, sessions);
1633 }
1634
1635 static bool clp_used_exchangeid(struct nfs4_client *clp)
1636 {
1637         return clp->cl_exchange_flags != 0;
1638 }
1639
1640 static struct nfs4_client *
1641 find_confirmed_client_by_name(struct xdr_netobj *name, struct nfsd_net *nn)
1642 {
1643         return find_clp_in_name_tree(name, &nn->conf_name_tree);
1644 }
1645
1646 static struct nfs4_client *
1647 find_unconfirmed_client_by_name(struct xdr_netobj *name, struct nfsd_net *nn)
1648 {
1649         return find_clp_in_name_tree(name, &nn->unconf_name_tree);
1650 }
1651
1652 static void
1653 gen_callback(struct nfs4_client *clp, struct nfsd4_setclientid *se, struct svc_rqst *rqstp)
1654 {
1655         struct nfs4_cb_conn *conn = &clp->cl_cb_conn;
1656         struct sockaddr *sa = svc_addr(rqstp);
1657         u32 scopeid = rpc_get_scope_id(sa);
1658         unsigned short expected_family;
1659
1660         /* Currently, we only support tcp and tcp6 for the callback channel */
1661         if (se->se_callback_netid_len == 3 &&
1662             !memcmp(se->se_callback_netid_val, "tcp", 3))
1663                 expected_family = AF_INET;
1664         else if (se->se_callback_netid_len == 4 &&
1665                  !memcmp(se->se_callback_netid_val, "tcp6", 4))
1666                 expected_family = AF_INET6;
1667         else
1668                 goto out_err;
1669
1670         conn->cb_addrlen = rpc_uaddr2sockaddr(clp->net, se->se_callback_addr_val,
1671                                             se->se_callback_addr_len,
1672                                             (struct sockaddr *)&conn->cb_addr,
1673                                             sizeof(conn->cb_addr));
1674
1675         if (!conn->cb_addrlen || conn->cb_addr.ss_family != expected_family)
1676                 goto out_err;
1677
1678         if (conn->cb_addr.ss_family == AF_INET6)
1679                 ((struct sockaddr_in6 *)&conn->cb_addr)->sin6_scope_id = scopeid;
1680
1681         conn->cb_prog = se->se_callback_prog;
1682         conn->cb_ident = se->se_callback_ident;
1683         memcpy(&conn->cb_saddr, &rqstp->rq_daddr, rqstp->rq_daddrlen);
1684         return;
1685 out_err:
1686         conn->cb_addr.ss_family = AF_UNSPEC;
1687         conn->cb_addrlen = 0;
1688         dprintk(KERN_INFO "NFSD: this client (clientid %08x/%08x) "
1689                 "will not receive delegations\n",
1690                 clp->cl_clientid.cl_boot, clp->cl_clientid.cl_id);
1691
1692         return;
1693 }
1694
1695 /*
1696  * Cache a reply. nfsd4_check_resp_size() has bounded the cache size.
1697  */
1698 static void
1699 nfsd4_store_cache_entry(struct nfsd4_compoundres *resp)
1700 {
1701         struct xdr_buf *buf = resp->xdr.buf;
1702         struct nfsd4_slot *slot = resp->cstate.slot;
1703         unsigned int base;
1704
1705         dprintk("--> %s slot %p\n", __func__, slot);
1706
1707         slot->sl_opcnt = resp->opcnt;
1708         slot->sl_status = resp->cstate.status;
1709
1710         slot->sl_flags |= NFSD4_SLOT_INITIALIZED;
1711         if (nfsd4_not_cached(resp)) {
1712                 slot->sl_datalen = 0;
1713                 return;
1714         }
1715         base = resp->cstate.data_offset;
1716         slot->sl_datalen = buf->len - base;
1717         if (read_bytes_from_xdr_buf(buf, base, slot->sl_data, slot->sl_datalen))
1718                 WARN("%s: sessions DRC could not cache compound\n", __func__);
1719         return;
1720 }
1721
1722 /*
1723  * Encode the replay sequence operation from the slot values.
1724  * If cachethis is FALSE encode the uncached rep error on the next
1725  * operation which sets resp->p and increments resp->opcnt for
1726  * nfs4svc_encode_compoundres.
1727  *
1728  */
1729 static __be32
1730 nfsd4_enc_sequence_replay(struct nfsd4_compoundargs *args,
1731                           struct nfsd4_compoundres *resp)
1732 {
1733         struct nfsd4_op *op;
1734         struct nfsd4_slot *slot = resp->cstate.slot;
1735
1736         /* Encode the replayed sequence operation */
1737         op = &args->ops[resp->opcnt - 1];
1738         nfsd4_encode_operation(resp, op);
1739
1740         /* Return nfserr_retry_uncached_rep in next operation. */
1741         if (args->opcnt > 1 && !(slot->sl_flags & NFSD4_SLOT_CACHETHIS)) {
1742                 op = &args->ops[resp->opcnt++];
1743                 op->status = nfserr_retry_uncached_rep;
1744                 nfsd4_encode_operation(resp, op);
1745         }
1746         return op->status;
1747 }
1748
1749 /*
1750  * The sequence operation is not cached because we can use the slot and
1751  * session values.
1752  */
1753 static __be32
1754 nfsd4_replay_cache_entry(struct nfsd4_compoundres *resp,
1755                          struct nfsd4_sequence *seq)
1756 {
1757         struct nfsd4_slot *slot = resp->cstate.slot;
1758         struct xdr_stream *xdr = &resp->xdr;
1759         __be32 *p;
1760         __be32 status;
1761
1762         dprintk("--> %s slot %p\n", __func__, slot);
1763
1764         status = nfsd4_enc_sequence_replay(resp->rqstp->rq_argp, resp);
1765         if (status)
1766                 return status;
1767
1768         p = xdr_reserve_space(xdr, slot->sl_datalen);
1769         if (!p) {
1770                 WARN_ON_ONCE(1);
1771                 return nfserr_serverfault;
1772         }
1773         xdr_encode_opaque_fixed(p, slot->sl_data, slot->sl_datalen);
1774         xdr_commit_encode(xdr);
1775
1776         resp->opcnt = slot->sl_opcnt;
1777         return slot->sl_status;
1778 }
1779
1780 /*
1781  * Set the exchange_id flags returned by the server.
1782  */
1783 static void
1784 nfsd4_set_ex_flags(struct nfs4_client *new, struct nfsd4_exchange_id *clid)
1785 {
1786         /* pNFS is not supported */
1787         new->cl_exchange_flags |= EXCHGID4_FLAG_USE_NON_PNFS;
1788
1789         /* Referrals are supported, Migration is not. */
1790         new->cl_exchange_flags |= EXCHGID4_FLAG_SUPP_MOVED_REFER;
1791
1792         /* set the wire flags to return to client. */
1793         clid->flags = new->cl_exchange_flags;
1794 }
1795
1796 static bool client_has_state(struct nfs4_client *clp)
1797 {
1798         /*
1799          * Note clp->cl_openowners check isn't quite right: there's no
1800          * need to count owners without stateid's.
1801          *
1802          * Also note we should probably be using this in 4.0 case too.
1803          */
1804         return !list_empty(&clp->cl_openowners)
1805                 || !list_empty(&clp->cl_delegations)
1806                 || !list_empty(&clp->cl_sessions);
1807 }
1808
1809 __be32
1810 nfsd4_exchange_id(struct svc_rqst *rqstp,
1811                   struct nfsd4_compound_state *cstate,
1812                   struct nfsd4_exchange_id *exid)
1813 {
1814         struct nfs4_client *unconf, *conf, *new;
1815         __be32 status;
1816         char                    addr_str[INET6_ADDRSTRLEN];
1817         nfs4_verifier           verf = exid->verifier;
1818         struct sockaddr         *sa = svc_addr(rqstp);
1819         bool    update = exid->flags & EXCHGID4_FLAG_UPD_CONFIRMED_REC_A;
1820         struct nfsd_net         *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
1821
1822         rpc_ntop(sa, addr_str, sizeof(addr_str));
1823         dprintk("%s rqstp=%p exid=%p clname.len=%u clname.data=%p "
1824                 "ip_addr=%s flags %x, spa_how %d\n",
1825                 __func__, rqstp, exid, exid->clname.len, exid->clname.data,
1826                 addr_str, exid->flags, exid->spa_how);
1827
1828         if (exid->flags & ~EXCHGID4_FLAG_MASK_A)
1829                 return nfserr_inval;
1830
1831         switch (exid->spa_how) {
1832         case SP4_MACH_CRED:
1833                 if (!svc_rqst_integrity_protected(rqstp))
1834                         return nfserr_inval;
1835         case SP4_NONE:
1836                 break;
1837         default:                                /* checked by xdr code */
1838                 WARN_ON_ONCE(1);
1839         case SP4_SSV:
1840                 return nfserr_encr_alg_unsupp;
1841         }
1842
1843         /* Cases below refer to rfc 5661 section 18.35.4: */
1844         nfs4_lock_state();
1845         conf = find_confirmed_client_by_name(&exid->clname, nn);
1846         if (conf) {
1847                 bool creds_match = same_creds(&conf->cl_cred, &rqstp->rq_cred);
1848                 bool verfs_match = same_verf(&verf, &conf->cl_verifier);
1849
1850                 if (update) {
1851                         if (!clp_used_exchangeid(conf)) { /* buggy client */
1852                                 status = nfserr_inval;
1853                                 goto out;
1854                         }
1855                         if (!mach_creds_match(conf, rqstp)) {
1856                                 status = nfserr_wrong_cred;
1857                                 goto out;
1858                         }
1859                         if (!creds_match) { /* case 9 */
1860                                 status = nfserr_perm;
1861                                 goto out;
1862                         }
1863                         if (!verfs_match) { /* case 8 */
1864                                 status = nfserr_not_same;
1865                                 goto out;
1866                         }
1867                         /* case 6 */
1868                         exid->flags |= EXCHGID4_FLAG_CONFIRMED_R;
1869                         new = conf;
1870                         goto out_copy;
1871                 }
1872                 if (!creds_match) { /* case 3 */
1873                         if (client_has_state(conf)) {
1874                                 status = nfserr_clid_inuse;
1875                                 goto out;
1876                         }
1877                         expire_client(conf);
1878                         goto out_new;
1879                 }
1880                 if (verfs_match) { /* case 2 */
1881                         conf->cl_exchange_flags |= EXCHGID4_FLAG_CONFIRMED_R;
1882                         new = conf;
1883                         goto out_copy;
1884                 }
1885                 /* case 5, client reboot */
1886                 goto out_new;
1887         }
1888
1889         if (update) { /* case 7 */
1890                 status = nfserr_noent;
1891                 goto out;
1892         }
1893
1894         unconf  = find_unconfirmed_client_by_name(&exid->clname, nn);
1895         if (unconf) /* case 4, possible retry or client restart */
1896                 expire_client(unconf);
1897
1898         /* case 1 (normal case) */
1899 out_new:
1900         new = create_client(exid->clname, rqstp, &verf);
1901         if (new == NULL) {
1902                 status = nfserr_jukebox;
1903                 goto out;
1904         }
1905         new->cl_minorversion = cstate->minorversion;
1906         new->cl_mach_cred = (exid->spa_how == SP4_MACH_CRED);
1907
1908         gen_clid(new, nn);
1909         add_to_unconfirmed(new);
1910 out_copy:
1911         exid->clientid.cl_boot = new->cl_clientid.cl_boot;
1912         exid->clientid.cl_id = new->cl_clientid.cl_id;
1913
1914         exid->seqid = new->cl_cs_slot.sl_seqid + 1;
1915         nfsd4_set_ex_flags(new, exid);
1916
1917         dprintk("nfsd4_exchange_id seqid %d flags %x\n",
1918                 new->cl_cs_slot.sl_seqid, new->cl_exchange_flags);
1919         status = nfs_ok;
1920
1921 out:
1922         nfs4_unlock_state();
1923         return status;
1924 }
1925
1926 static __be32
1927 check_slot_seqid(u32 seqid, u32 slot_seqid, int slot_inuse)
1928 {
1929         dprintk("%s enter. seqid %d slot_seqid %d\n", __func__, seqid,
1930                 slot_seqid);
1931
1932         /* The slot is in use, and no response has been sent. */
1933         if (slot_inuse) {
1934                 if (seqid == slot_seqid)
1935                         return nfserr_jukebox;
1936                 else
1937                         return nfserr_seq_misordered;
1938         }
1939         /* Note unsigned 32-bit arithmetic handles wraparound: */
1940         if (likely(seqid == slot_seqid + 1))
1941                 return nfs_ok;
1942         if (seqid == slot_seqid)
1943                 return nfserr_replay_cache;
1944         return nfserr_seq_misordered;
1945 }
1946
1947 /*
1948  * Cache the create session result into the create session single DRC
1949  * slot cache by saving the xdr structure. sl_seqid has been set.
1950  * Do this for solo or embedded create session operations.
1951  */
1952 static void
1953 nfsd4_cache_create_session(struct nfsd4_create_session *cr_ses,
1954                            struct nfsd4_clid_slot *slot, __be32 nfserr)
1955 {
1956         slot->sl_status = nfserr;
1957         memcpy(&slot->sl_cr_ses, cr_ses, sizeof(*cr_ses));
1958 }
1959
1960 static __be32
1961 nfsd4_replay_create_session(struct nfsd4_create_session *cr_ses,
1962                             struct nfsd4_clid_slot *slot)
1963 {
1964         memcpy(cr_ses, &slot->sl_cr_ses, sizeof(*cr_ses));
1965         return slot->sl_status;
1966 }
1967
1968 #define NFSD_MIN_REQ_HDR_SEQ_SZ ((\
1969                         2 * 2 + /* credential,verifier: AUTH_NULL, length 0 */ \
1970                         1 +     /* MIN tag is length with zero, only length */ \
1971                         3 +     /* version, opcount, opcode */ \
1972                         XDR_QUADLEN(NFS4_MAX_SESSIONID_LEN) + \
1973                                 /* seqid, slotID, slotID, cache */ \
1974                         4 ) * sizeof(__be32))
1975
1976 #define NFSD_MIN_RESP_HDR_SEQ_SZ ((\
1977                         2 +     /* verifier: AUTH_NULL, length 0 */\
1978                         1 +     /* status */ \
1979                         1 +     /* MIN tag is length with zero, only length */ \
1980                         3 +     /* opcount, opcode, opstatus*/ \
1981                         XDR_QUADLEN(NFS4_MAX_SESSIONID_LEN) + \
1982                                 /* seqid, slotID, slotID, slotID, status */ \
1983                         5 ) * sizeof(__be32))
1984
1985 static __be32 check_forechannel_attrs(struct nfsd4_channel_attrs *ca, struct nfsd_net *nn)
1986 {
1987         u32 maxrpc = nn->nfsd_serv->sv_max_mesg;
1988
1989         if (ca->maxreq_sz < NFSD_MIN_REQ_HDR_SEQ_SZ)
1990                 return nfserr_toosmall;
1991         if (ca->maxresp_sz < NFSD_MIN_RESP_HDR_SEQ_SZ)
1992                 return nfserr_toosmall;
1993         ca->headerpadsz = 0;
1994         ca->maxreq_sz = min_t(u32, ca->maxreq_sz, maxrpc);
1995         ca->maxresp_sz = min_t(u32, ca->maxresp_sz, maxrpc);
1996         ca->maxops = min_t(u32, ca->maxops, NFSD_MAX_OPS_PER_COMPOUND);
1997         ca->maxresp_cached = min_t(u32, ca->maxresp_cached,
1998                         NFSD_SLOT_CACHE_SIZE + NFSD_MIN_HDR_SEQ_SZ);
1999         ca->maxreqs = min_t(u32, ca->maxreqs, NFSD_MAX_SLOTS_PER_SESSION);
2000         /*
2001          * Note decreasing slot size below client's request may make it
2002          * difficult for client to function correctly, whereas
2003          * decreasing the number of slots will (just?) affect
2004          * performance.  When short on memory we therefore prefer to
2005          * decrease number of slots instead of their size.  Clients that
2006          * request larger slots than they need will get poor results:
2007          */
2008         ca->maxreqs = nfsd4_get_drc_mem(ca);
2009         if (!ca->maxreqs)
2010                 return nfserr_jukebox;
2011
2012         return nfs_ok;
2013 }
2014
2015 #define NFSD_CB_MAX_REQ_SZ      ((NFS4_enc_cb_recall_sz + \
2016                                  RPC_MAX_HEADER_WITH_AUTH) * sizeof(__be32))
2017 #define NFSD_CB_MAX_RESP_SZ     ((NFS4_dec_cb_recall_sz + \
2018                                  RPC_MAX_REPHEADER_WITH_AUTH) * sizeof(__be32))
2019
2020 static __be32 check_backchannel_attrs(struct nfsd4_channel_attrs *ca)
2021 {
2022         ca->headerpadsz = 0;
2023
2024         /*
2025          * These RPC_MAX_HEADER macros are overkill, especially since we
2026          * don't even do gss on the backchannel yet.  But this is still
2027          * less than 1k.  Tighten up this estimate in the unlikely event
2028          * it turns out to be a problem for some client:
2029          */
2030         if (ca->maxreq_sz < NFSD_CB_MAX_REQ_SZ)
2031                 return nfserr_toosmall;
2032         if (ca->maxresp_sz < NFSD_CB_MAX_RESP_SZ)
2033                 return nfserr_toosmall;
2034         ca->maxresp_cached = 0;
2035         if (ca->maxops < 2)
2036                 return nfserr_toosmall;
2037
2038         return nfs_ok;
2039 }
2040
2041 static __be32 nfsd4_check_cb_sec(struct nfsd4_cb_sec *cbs)
2042 {
2043         switch (cbs->flavor) {
2044         case RPC_AUTH_NULL:
2045         case RPC_AUTH_UNIX:
2046                 return nfs_ok;
2047         default:
2048                 /*
2049                  * GSS case: the spec doesn't allow us to return this
2050                  * error.  But it also doesn't allow us not to support
2051                  * GSS.
2052                  * I'd rather this fail hard than return some error the
2053                  * client might think it can already handle:
2054                  */
2055                 return nfserr_encr_alg_unsupp;
2056         }
2057 }
2058
2059 __be32
2060 nfsd4_create_session(struct svc_rqst *rqstp,
2061                      struct nfsd4_compound_state *cstate,
2062                      struct nfsd4_create_session *cr_ses)
2063 {
2064         struct sockaddr *sa = svc_addr(rqstp);
2065         struct nfs4_client *conf, *unconf;
2066         struct nfsd4_session *new;
2067         struct nfsd4_conn *conn;
2068         struct nfsd4_clid_slot *cs_slot = NULL;
2069         __be32 status = 0;
2070         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
2071
2072         if (cr_ses->flags & ~SESSION4_FLAG_MASK_A)
2073                 return nfserr_inval;
2074         status = nfsd4_check_cb_sec(&cr_ses->cb_sec);
2075         if (status)
2076                 return status;
2077         status = check_forechannel_attrs(&cr_ses->fore_channel, nn);
2078         if (status)
2079                 return status;
2080         status = check_backchannel_attrs(&cr_ses->back_channel);
2081         if (status)
2082                 goto out_release_drc_mem;
2083         status = nfserr_jukebox;
2084         new = alloc_session(&cr_ses->fore_channel, &cr_ses->back_channel);
2085         if (!new)
2086                 goto out_release_drc_mem;
2087         conn = alloc_conn_from_crses(rqstp, cr_ses);
2088         if (!conn)
2089                 goto out_free_session;
2090
2091         nfs4_lock_state();
2092         unconf = find_unconfirmed_client(&cr_ses->clientid, true, nn);
2093         conf = find_confirmed_client(&cr_ses->clientid, true, nn);
2094         WARN_ON_ONCE(conf && unconf);
2095
2096         if (conf) {
2097                 status = nfserr_wrong_cred;
2098                 if (!mach_creds_match(conf, rqstp))
2099                         goto out_free_conn;
2100                 cs_slot = &conf->cl_cs_slot;
2101                 status = check_slot_seqid(cr_ses->seqid, cs_slot->sl_seqid, 0);
2102                 if (status == nfserr_replay_cache) {
2103                         status = nfsd4_replay_create_session(cr_ses, cs_slot);
2104                         goto out_free_conn;
2105                 } else if (cr_ses->seqid != cs_slot->sl_seqid + 1) {
2106                         status = nfserr_seq_misordered;
2107                         goto out_free_conn;
2108                 }
2109         } else if (unconf) {
2110                 struct nfs4_client *old;
2111                 if (!same_creds(&unconf->cl_cred, &rqstp->rq_cred) ||
2112                     !rpc_cmp_addr(sa, (struct sockaddr *) &unconf->cl_addr)) {
2113                         status = nfserr_clid_inuse;
2114                         goto out_free_conn;
2115                 }
2116                 status = nfserr_wrong_cred;
2117                 if (!mach_creds_match(unconf, rqstp))
2118                         goto out_free_conn;
2119                 cs_slot = &unconf->cl_cs_slot;
2120                 status = check_slot_seqid(cr_ses->seqid, cs_slot->sl_seqid, 0);
2121                 if (status) {
2122                         /* an unconfirmed replay returns misordered */
2123                         status = nfserr_seq_misordered;
2124                         goto out_free_conn;
2125                 }
2126                 old = find_confirmed_client_by_name(&unconf->cl_name, nn);
2127                 if (old) {
2128                         status = mark_client_expired(old);
2129                         if (status)
2130                                 goto out_free_conn;
2131                         expire_client(old);
2132                 }
2133                 move_to_confirmed(unconf);
2134                 conf = unconf;
2135         } else {
2136                 status = nfserr_stale_clientid;
2137                 goto out_free_conn;
2138         }
2139         status = nfs_ok;
2140         /*
2141          * We do not support RDMA or persistent sessions
2142          */
2143         cr_ses->flags &= ~SESSION4_PERSIST;
2144         cr_ses->flags &= ~SESSION4_RDMA;
2145
2146         init_session(rqstp, new, conf, cr_ses);
2147         nfsd4_init_conn(rqstp, conn, new);
2148
2149         memcpy(cr_ses->sessionid.data, new->se_sessionid.data,
2150                NFS4_MAX_SESSIONID_LEN);
2151         cs_slot->sl_seqid++;
2152         cr_ses->seqid = cs_slot->sl_seqid;
2153
2154         /* cache solo and embedded create sessions under the state lock */
2155         nfsd4_cache_create_session(cr_ses, cs_slot, status);
2156         nfs4_unlock_state();
2157         return status;
2158 out_free_conn:
2159         nfs4_unlock_state();
2160         free_conn(conn);
2161 out_free_session:
2162         __free_session(new);
2163 out_release_drc_mem:
2164         nfsd4_put_drc_mem(&cr_ses->fore_channel);
2165         return status;
2166 }
2167
2168 static __be32 nfsd4_map_bcts_dir(u32 *dir)
2169 {
2170         switch (*dir) {
2171         case NFS4_CDFC4_FORE:
2172         case NFS4_CDFC4_BACK:
2173                 return nfs_ok;
2174         case NFS4_CDFC4_FORE_OR_BOTH:
2175         case NFS4_CDFC4_BACK_OR_BOTH:
2176                 *dir = NFS4_CDFC4_BOTH;
2177                 return nfs_ok;
2178         };
2179         return nfserr_inval;
2180 }
2181
2182 __be32 nfsd4_backchannel_ctl(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, struct nfsd4_backchannel_ctl *bc)
2183 {
2184         struct nfsd4_session *session = cstate->session;
2185         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
2186         __be32 status;
2187
2188         status = nfsd4_check_cb_sec(&bc->bc_cb_sec);
2189         if (status)
2190                 return status;
2191         spin_lock(&nn->client_lock);
2192         session->se_cb_prog = bc->bc_cb_program;
2193         session->se_cb_sec = bc->bc_cb_sec;
2194         spin_unlock(&nn->client_lock);
2195
2196         nfsd4_probe_callback(session->se_client);
2197
2198         return nfs_ok;
2199 }
2200
2201 __be32 nfsd4_bind_conn_to_session(struct svc_rqst *rqstp,
2202                      struct nfsd4_compound_state *cstate,
2203                      struct nfsd4_bind_conn_to_session *bcts)
2204 {
2205         __be32 status;
2206         struct nfsd4_conn *conn;
2207         struct nfsd4_session *session;
2208         struct net *net = SVC_NET(rqstp);
2209         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
2210
2211         if (!nfsd4_last_compound_op(rqstp))
2212                 return nfserr_not_only_op;
2213         nfs4_lock_state();
2214         spin_lock(&nn->client_lock);
2215         session = find_in_sessionid_hashtbl(&bcts->sessionid, net, &status);
2216         spin_unlock(&nn->client_lock);
2217         if (!session)
2218                 goto out_no_session;
2219         status = nfserr_wrong_cred;
2220         if (!mach_creds_match(session->se_client, rqstp))
2221                 goto out;
2222         status = nfsd4_map_bcts_dir(&bcts->dir);
2223         if (status)
2224                 goto out;
2225         conn = alloc_conn(rqstp, bcts->dir);
2226         status = nfserr_jukebox;
2227         if (!conn)
2228                 goto out;
2229         nfsd4_init_conn(rqstp, conn, session);
2230         status = nfs_ok;
2231 out:
2232         nfsd4_put_session(session);
2233 out_no_session:
2234         nfs4_unlock_state();
2235         return status;
2236 }
2237
2238 static bool nfsd4_compound_in_session(struct nfsd4_session *session, struct nfs4_sessionid *sid)
2239 {
2240         if (!session)
2241                 return 0;
2242         return !memcmp(sid, &session->se_sessionid, sizeof(*sid));
2243 }
2244
2245 __be32
2246 nfsd4_destroy_session(struct svc_rqst *r,
2247                       struct nfsd4_compound_state *cstate,
2248                       struct nfsd4_destroy_session *sessionid)
2249 {
2250         struct nfsd4_session *ses;
2251         __be32 status;
2252         int ref_held_by_me = 0;
2253         struct net *net = SVC_NET(r);
2254         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
2255
2256         nfs4_lock_state();
2257         status = nfserr_not_only_op;
2258         if (nfsd4_compound_in_session(cstate->session, &sessionid->sessionid)) {
2259                 if (!nfsd4_last_compound_op(r))
2260                         goto out;
2261                 ref_held_by_me++;
2262         }
2263         dump_sessionid(__func__, &sessionid->sessionid);
2264         spin_lock(&nn->client_lock);
2265         ses = find_in_sessionid_hashtbl(&sessionid->sessionid, net, &status);
2266         if (!ses)
2267                 goto out_client_lock;
2268         status = nfserr_wrong_cred;
2269         if (!mach_creds_match(ses->se_client, r))
2270                 goto out_put_session;
2271         status = mark_session_dead_locked(ses, 1 + ref_held_by_me);
2272         if (status)
2273                 goto out_put_session;
2274         unhash_session(ses);
2275         spin_unlock(&nn->client_lock);
2276
2277         nfsd4_probe_callback_sync(ses->se_client);
2278
2279         spin_lock(&nn->client_lock);
2280         status = nfs_ok;
2281 out_put_session:
2282         nfsd4_put_session_locked(ses);
2283 out_client_lock:
2284         spin_unlock(&nn->client_lock);
2285 out:
2286         nfs4_unlock_state();
2287         return status;
2288 }
2289
2290 static struct nfsd4_conn *__nfsd4_find_conn(struct svc_xprt *xpt, struct nfsd4_session *s)
2291 {
2292         struct nfsd4_conn *c;
2293
2294         list_for_each_entry(c, &s->se_conns, cn_persession) {
2295                 if (c->cn_xprt == xpt) {
2296                         return c;
2297                 }
2298         }
2299         return NULL;
2300 }
2301
2302 static __be32 nfsd4_sequence_check_conn(struct nfsd4_conn *new, struct nfsd4_session *ses)
2303 {
2304         struct nfs4_client *clp = ses->se_client;
2305         struct nfsd4_conn *c;
2306         __be32 status = nfs_ok;
2307         int ret;
2308
2309         spin_lock(&clp->cl_lock);
2310         c = __nfsd4_find_conn(new->cn_xprt, ses);
2311         if (c)
2312                 goto out_free;
2313         status = nfserr_conn_not_bound_to_session;
2314         if (clp->cl_mach_cred)
2315                 goto out_free;
2316         __nfsd4_hash_conn(new, ses);
2317         spin_unlock(&clp->cl_lock);
2318         ret = nfsd4_register_conn(new);
2319         if (ret)
2320                 /* oops; xprt is already down: */
2321                 nfsd4_conn_lost(&new->cn_xpt_user);
2322         return nfs_ok;
2323 out_free:
2324         spin_unlock(&clp->cl_lock);
2325         free_conn(new);
2326         return status;
2327 }
2328
2329 static bool nfsd4_session_too_many_ops(struct svc_rqst *rqstp, struct nfsd4_session *session)
2330 {
2331         struct nfsd4_compoundargs *args = rqstp->rq_argp;
2332
2333         return args->opcnt > session->se_fchannel.maxops;
2334 }
2335
2336 static bool nfsd4_request_too_big(struct svc_rqst *rqstp,
2337                                   struct nfsd4_session *session)
2338 {
2339         struct xdr_buf *xb = &rqstp->rq_arg;
2340
2341         return xb->len > session->se_fchannel.maxreq_sz;
2342 }
2343
2344 __be32
2345 nfsd4_sequence(struct svc_rqst *rqstp,
2346                struct nfsd4_compound_state *cstate,
2347                struct nfsd4_sequence *seq)
2348 {
2349         struct nfsd4_compoundres *resp = rqstp->rq_resp;
2350         struct xdr_stream *xdr = &resp->xdr;
2351         struct nfsd4_session *session;
2352         struct nfs4_client *clp;
2353         struct nfsd4_slot *slot;
2354         struct nfsd4_conn *conn;
2355         __be32 status;
2356         int buflen;
2357         struct net *net = SVC_NET(rqstp);
2358         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
2359
2360         if (resp->opcnt != 1)
2361                 return nfserr_sequence_pos;
2362
2363         /*
2364          * Will be either used or freed by nfsd4_sequence_check_conn
2365          * below.
2366          */
2367         conn = alloc_conn(rqstp, NFS4_CDFC4_FORE);
2368         if (!conn)
2369                 return nfserr_jukebox;
2370
2371         spin_lock(&nn->client_lock);
2372         session = find_in_sessionid_hashtbl(&seq->sessionid, net, &status);
2373         if (!session)
2374                 goto out_no_session;
2375         clp = session->se_client;
2376
2377         status = nfserr_too_many_ops;
2378         if (nfsd4_session_too_many_ops(rqstp, session))
2379                 goto out_put_session;
2380
2381         status = nfserr_req_too_big;
2382         if (nfsd4_request_too_big(rqstp, session))
2383                 goto out_put_session;
2384
2385         status = nfserr_badslot;
2386         if (seq->slotid >= session->se_fchannel.maxreqs)
2387                 goto out_put_session;
2388
2389         slot = session->se_slots[seq->slotid];
2390         dprintk("%s: slotid %d\n", __func__, seq->slotid);
2391
2392         /* We do not negotiate the number of slots yet, so set the
2393          * maxslots to the session maxreqs which is used to encode
2394          * sr_highest_slotid and the sr_target_slot id to maxslots */
2395         seq->maxslots = session->se_fchannel.maxreqs;
2396
2397         status = check_slot_seqid(seq->seqid, slot->sl_seqid,
2398                                         slot->sl_flags & NFSD4_SLOT_INUSE);
2399         if (status == nfserr_replay_cache) {
2400                 status = nfserr_seq_misordered;
2401                 if (!(slot->sl_flags & NFSD4_SLOT_INITIALIZED))
2402                         goto out_put_session;
2403                 cstate->slot = slot;
2404                 cstate->session = session;
2405                 cstate->clp = clp;
2406                 /* Return the cached reply status and set cstate->status
2407                  * for nfsd4_proc_compound processing */
2408                 status = nfsd4_replay_cache_entry(resp, seq);
2409                 cstate->status = nfserr_replay_cache;
2410                 goto out;
2411         }
2412         if (status)
2413                 goto out_put_session;
2414
2415         status = nfsd4_sequence_check_conn(conn, session);
2416         conn = NULL;
2417         if (status)
2418                 goto out_put_session;
2419
2420         buflen = (seq->cachethis) ?
2421                         session->se_fchannel.maxresp_cached :
2422                         session->se_fchannel.maxresp_sz;
2423         status = (seq->cachethis) ? nfserr_rep_too_big_to_cache :
2424                                     nfserr_rep_too_big;
2425         if (xdr_restrict_buflen(xdr, buflen - rqstp->rq_auth_slack))
2426                 goto out_put_session;
2427         svc_reserve(rqstp, buflen);
2428
2429         status = nfs_ok;
2430         /* Success! bump slot seqid */
2431         slot->sl_seqid = seq->seqid;
2432         slot->sl_flags |= NFSD4_SLOT_INUSE;
2433         if (seq->cachethis)
2434                 slot->sl_flags |= NFSD4_SLOT_CACHETHIS;
2435         else
2436                 slot->sl_flags &= ~NFSD4_SLOT_CACHETHIS;
2437
2438         cstate->slot = slot;
2439         cstate->session = session;
2440         cstate->clp = clp;
2441
2442 out:
2443         switch (clp->cl_cb_state) {
2444         case NFSD4_CB_DOWN:
2445                 seq->status_flags = SEQ4_STATUS_CB_PATH_DOWN;
2446                 break;
2447         case NFSD4_CB_FAULT:
2448                 seq->status_flags = SEQ4_STATUS_BACKCHANNEL_FAULT;
2449                 break;
2450         default:
2451                 seq->status_flags = 0;
2452         }
2453         if (!list_empty(&clp->cl_revoked))
2454                 seq->status_flags |= SEQ4_STATUS_RECALLABLE_STATE_REVOKED;
2455 out_no_session:
2456         if (conn)
2457                 free_conn(conn);
2458         spin_unlock(&nn->client_lock);
2459         return status;
2460 out_put_session:
2461         nfsd4_put_session_locked(session);
2462         goto out_no_session;
2463 }
2464
2465 void
2466 nfsd4_sequence_done(struct nfsd4_compoundres *resp)
2467 {
2468         struct nfsd4_compound_state *cs = &resp->cstate;
2469
2470         if (nfsd4_has_session(cs)) {
2471                 if (cs->status != nfserr_replay_cache) {
2472                         nfsd4_store_cache_entry(resp);
2473                         cs->slot->sl_flags &= ~NFSD4_SLOT_INUSE;
2474                 }
2475                 /* Drop session reference that was taken in nfsd4_sequence() */
2476                 nfsd4_put_session(cs->session);
2477         } else if (cs->clp)
2478                 put_client_renew(cs->clp);
2479 }
2480
2481 __be32
2482 nfsd4_destroy_clientid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, struct nfsd4_destroy_clientid *dc)
2483 {
2484         struct nfs4_client *conf, *unconf, *clp;
2485         __be32 status = 0;
2486         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
2487
2488         nfs4_lock_state();
2489         unconf = find_unconfirmed_client(&dc->clientid, true, nn);
2490         conf = find_confirmed_client(&dc->clientid, true, nn);
2491         WARN_ON_ONCE(conf && unconf);
2492
2493         if (conf) {
2494                 clp = conf;
2495
2496                 if (client_has_state(conf)) {
2497                         status = nfserr_clientid_busy;
2498                         goto out;
2499                 }
2500         } else if (unconf)
2501                 clp = unconf;
2502         else {
2503                 status = nfserr_stale_clientid;
2504                 goto out;
2505         }
2506         if (!mach_creds_match(clp, rqstp)) {
2507                 status = nfserr_wrong_cred;
2508                 goto out;
2509         }
2510         expire_client(clp);
2511 out:
2512         nfs4_unlock_state();
2513         return status;
2514 }
2515
2516 __be32
2517 nfsd4_reclaim_complete(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, struct nfsd4_reclaim_complete *rc)
2518 {
2519         __be32 status = 0;
2520
2521         if (rc->rca_one_fs) {
2522                 if (!cstate->current_fh.fh_dentry)
2523                         return nfserr_nofilehandle;
2524                 /*
2525                  * We don't take advantage of the rca_one_fs case.
2526                  * That's OK, it's optional, we can safely ignore it.
2527                  */
2528                  return nfs_ok;
2529         }
2530
2531         nfs4_lock_state();
2532         status = nfserr_complete_already;
2533         if (test_and_set_bit(NFSD4_CLIENT_RECLAIM_COMPLETE,
2534                              &cstate->session->se_client->cl_flags))
2535                 goto out;
2536
2537         status = nfserr_stale_clientid;
2538         if (is_client_expired(cstate->session->se_client))
2539                 /*
2540                  * The following error isn't really legal.
2541                  * But we only get here if the client just explicitly
2542                  * destroyed the client.  Surely it no longer cares what
2543                  * error it gets back on an operation for the dead
2544                  * client.
2545                  */
2546                 goto out;
2547
2548         status = nfs_ok;
2549         nfsd4_client_record_create(cstate->session->se_client);
2550 out:
2551         nfs4_unlock_state();
2552         return status;
2553 }
2554
2555 __be32
2556 nfsd4_setclientid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
2557                   struct nfsd4_setclientid *setclid)
2558 {
2559         struct xdr_netobj       clname = setclid->se_name;
2560         nfs4_verifier           clverifier = setclid->se_verf;
2561         struct nfs4_client      *conf, *unconf, *new;
2562         __be32                  status;
2563         struct nfsd_net         *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
2564
2565         /* Cases below refer to rfc 3530 section 14.2.33: */
2566         nfs4_lock_state();
2567         conf = find_confirmed_client_by_name(&clname, nn);
2568         if (conf) {
2569                 /* case 0: */
2570                 status = nfserr_clid_inuse;
2571                 if (clp_used_exchangeid(conf))
2572                         goto out;
2573                 if (!same_creds(&conf->cl_cred, &rqstp->rq_cred)) {
2574                         char addr_str[INET6_ADDRSTRLEN];
2575                         rpc_ntop((struct sockaddr *) &conf->cl_addr, addr_str,
2576                                  sizeof(addr_str));
2577                         dprintk("NFSD: setclientid: string in use by client "
2578                                 "at %s\n", addr_str);
2579                         goto out;
2580                 }
2581         }
2582         unconf = find_unconfirmed_client_by_name(&clname, nn);
2583         if (unconf)
2584                 expire_client(unconf);
2585         status = nfserr_jukebox;
2586         new = create_client(clname, rqstp, &clverifier);
2587         if (new == NULL)
2588                 goto out;
2589         if (conf && same_verf(&conf->cl_verifier, &clverifier))
2590                 /* case 1: probable callback update */
2591                 copy_clid(new, conf);
2592         else /* case 4 (new client) or cases 2, 3 (client reboot): */
2593                 gen_clid(new, nn);
2594         new->cl_minorversion = 0;
2595         gen_callback(new, setclid, rqstp);
2596         add_to_unconfirmed(new);
2597         setclid->se_clientid.cl_boot = new->cl_clientid.cl_boot;
2598         setclid->se_clientid.cl_id = new->cl_clientid.cl_id;
2599         memcpy(setclid->se_confirm.data, new->cl_confirm.data, sizeof(setclid->se_confirm.data));
2600         status = nfs_ok;
2601 out:
2602         nfs4_unlock_state();
2603         return status;
2604 }
2605
2606
2607 __be32
2608 nfsd4_setclientid_confirm(struct svc_rqst *rqstp,
2609                          struct nfsd4_compound_state *cstate,
2610                          struct nfsd4_setclientid_confirm *setclientid_confirm)
2611 {
2612         struct nfs4_client *conf, *unconf;
2613         nfs4_verifier confirm = setclientid_confirm->sc_confirm;
2614         clientid_t * clid = &setclientid_confirm->sc_clientid;
2615         __be32 status;
2616         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
2617
2618         if (STALE_CLIENTID(clid, nn))
2619                 return nfserr_stale_clientid;
2620         nfs4_lock_state();
2621
2622         conf = find_confirmed_client(clid, false, nn);
2623         unconf = find_unconfirmed_client(clid, false, nn);
2624         /*
2625          * We try hard to give out unique clientid's, so if we get an
2626          * attempt to confirm the same clientid with a different cred,
2627          * there's a bug somewhere.  Let's charitably assume it's our
2628          * bug.
2629          */
2630         status = nfserr_serverfault;
2631         if (unconf && !same_creds(&unconf->cl_cred, &rqstp->rq_cred))
2632                 goto out;
2633         if (conf && !same_creds(&conf->cl_cred, &rqstp->rq_cred))
2634                 goto out;
2635         /* cases below refer to rfc 3530 section 14.2.34: */
2636         if (!unconf || !same_verf(&confirm, &unconf->cl_confirm)) {
2637                 if (conf && !unconf) /* case 2: probable retransmit */
2638                         status = nfs_ok;
2639                 else /* case 4: client hasn't noticed we rebooted yet? */
2640                         status = nfserr_stale_clientid;
2641                 goto out;
2642         }
2643         status = nfs_ok;
2644         if (conf) { /* case 1: callback update */
2645                 nfsd4_change_callback(conf, &unconf->cl_cb_conn);
2646                 nfsd4_probe_callback(conf);
2647                 expire_client(unconf);
2648         } else { /* case 3: normal case; new or rebooted client */
2649                 conf = find_confirmed_client_by_name(&unconf->cl_name, nn);
2650                 if (conf) {
2651                         status = mark_client_expired(conf);
2652                         if (status)
2653                                 goto out;
2654                         expire_client(conf);
2655                 }
2656                 move_to_confirmed(unconf);
2657                 nfsd4_probe_callback(unconf);
2658         }
2659 out:
2660         nfs4_unlock_state();
2661         return status;
2662 }
2663
2664 static struct nfs4_file *nfsd4_alloc_file(void)
2665 {
2666         return kmem_cache_alloc(file_slab, GFP_KERNEL);
2667 }
2668
2669 /* OPEN Share state helper functions */
2670 static void nfsd4_init_file(struct nfs4_file *fp, struct inode *ino)
2671 {
2672         unsigned int hashval = file_hashval(ino);
2673
2674         lockdep_assert_held(&state_lock);
2675
2676         atomic_set(&fp->fi_ref, 1);
2677         INIT_LIST_HEAD(&fp->fi_stateids);
2678         INIT_LIST_HEAD(&fp->fi_delegations);
2679         ihold(ino);
2680         fp->fi_inode = ino;
2681         fp->fi_had_conflict = false;
2682         fp->fi_lease = NULL;
2683         memset(fp->fi_fds, 0, sizeof(fp->fi_fds));
2684         memset(fp->fi_access, 0, sizeof(fp->fi_access));
2685         hlist_add_head(&fp->fi_hash, &file_hashtbl[hashval]);
2686 }
2687
2688 void
2689 nfsd4_free_slabs(void)
2690 {
2691         kmem_cache_destroy(openowner_slab);
2692         kmem_cache_destroy(lockowner_slab);
2693         kmem_cache_destroy(file_slab);
2694         kmem_cache_destroy(stateid_slab);
2695         kmem_cache_destroy(deleg_slab);
2696 }
2697
2698 int
2699 nfsd4_init_slabs(void)
2700 {
2701         openowner_slab = kmem_cache_create("nfsd4_openowners",
2702                         sizeof(struct nfs4_openowner), 0, 0, NULL);
2703         if (openowner_slab == NULL)
2704                 goto out;
2705         lockowner_slab = kmem_cache_create("nfsd4_lockowners",
2706                         sizeof(struct nfs4_lockowner), 0, 0, NULL);
2707         if (lockowner_slab == NULL)
2708                 goto out_free_openowner_slab;
2709         file_slab = kmem_cache_create("nfsd4_files",
2710                         sizeof(struct nfs4_file), 0, 0, NULL);
2711         if (file_slab == NULL)
2712                 goto out_free_lockowner_slab;
2713         stateid_slab = kmem_cache_create("nfsd4_stateids",
2714                         sizeof(struct nfs4_ol_stateid), 0, 0, NULL);
2715         if (stateid_slab == NULL)
2716                 goto out_free_file_slab;
2717         deleg_slab = kmem_cache_create("nfsd4_delegations",
2718                         sizeof(struct nfs4_delegation), 0, 0, NULL);
2719         if (deleg_slab == NULL)
2720                 goto out_free_stateid_slab;
2721         return 0;
2722
2723 out_free_stateid_slab:
2724         kmem_cache_destroy(stateid_slab);
2725 out_free_file_slab:
2726         kmem_cache_destroy(file_slab);
2727 out_free_lockowner_slab:
2728         kmem_cache_destroy(lockowner_slab);
2729 out_free_openowner_slab:
2730         kmem_cache_destroy(openowner_slab);
2731 out:
2732         dprintk("nfsd4: out of memory while initializing nfsv4\n");
2733         return -ENOMEM;
2734 }
2735
2736 static void init_nfs4_replay(struct nfs4_replay *rp)
2737 {
2738         rp->rp_status = nfserr_serverfault;
2739         rp->rp_buflen = 0;
2740         rp->rp_buf = rp->rp_ibuf;
2741 }
2742
2743 static inline void *alloc_stateowner(struct kmem_cache *slab, struct xdr_netobj *owner, struct nfs4_client *clp)
2744 {
2745         struct nfs4_stateowner *sop;
2746
2747         sop = kmem_cache_alloc(slab, GFP_KERNEL);
2748         if (!sop)
2749                 return NULL;
2750
2751         sop->so_owner.data = kmemdup(owner->data, owner->len, GFP_KERNEL);
2752         if (!sop->so_owner.data) {
2753                 kmem_cache_free(slab, sop);
2754                 return NULL;
2755         }
2756         sop->so_owner.len = owner->len;
2757
2758         INIT_LIST_HEAD(&sop->so_stateids);
2759         sop->so_client = clp;
2760         init_nfs4_replay(&sop->so_replay);
2761         return sop;
2762 }
2763
2764 static void hash_openowner(struct nfs4_openowner *oo, struct nfs4_client *clp, unsigned int strhashval)
2765 {
2766         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
2767
2768         list_add(&oo->oo_owner.so_strhash, &nn->ownerstr_hashtbl[strhashval]);
2769         list_add(&oo->oo_perclient, &clp->cl_openowners);
2770 }
2771
2772 static struct nfs4_openowner *
2773 alloc_init_open_stateowner(unsigned int strhashval, struct nfsd4_open *open,
2774                            struct nfsd4_compound_state *cstate)
2775 {
2776         struct nfs4_client *clp = cstate->clp;
2777         struct nfs4_openowner *oo;
2778
2779         oo = alloc_stateowner(openowner_slab, &open->op_owner, clp);
2780         if (!oo)
2781                 return NULL;
2782         oo->oo_owner.so_is_open_owner = 1;
2783         oo->oo_owner.so_seqid = open->op_seqid;
2784         oo->oo_flags = NFS4_OO_NEW;
2785         if (nfsd4_has_session(cstate))
2786                 oo->oo_flags |= NFS4_OO_CONFIRMED;
2787         oo->oo_time = 0;
2788         oo->oo_last_closed_stid = NULL;
2789         INIT_LIST_HEAD(&oo->oo_close_lru);
2790         hash_openowner(oo, clp, strhashval);
2791         return oo;
2792 }
2793
2794 static void init_open_stateid(struct nfs4_ol_stateid *stp, struct nfs4_file *fp, struct nfsd4_open *open) {
2795         struct nfs4_openowner *oo = open->op_openowner;
2796
2797         stp->st_stid.sc_type = NFS4_OPEN_STID;
2798         INIT_LIST_HEAD(&stp->st_locks);
2799         list_add(&stp->st_perstateowner, &oo->oo_owner.so_stateids);
2800         list_add(&stp->st_perfile, &fp->fi_stateids);
2801         stp->st_stateowner = &oo->oo_owner;
2802         get_nfs4_file(fp);
2803         stp->st_file = fp;
2804         stp->st_access_bmap = 0;
2805         stp->st_deny_bmap = 0;
2806         set_access(open->op_share_access, stp);
2807         set_deny(open->op_share_deny, stp);
2808         stp->st_openstp = NULL;
2809 }
2810
2811 static void
2812 move_to_close_lru(struct nfs4_openowner *oo, struct net *net)
2813 {
2814         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
2815
2816         dprintk("NFSD: move_to_close_lru nfs4_openowner %p\n", oo);
2817
2818         list_move_tail(&oo->oo_close_lru, &nn->close_lru);
2819         oo->oo_time = get_seconds();
2820 }
2821
2822 static int
2823 same_owner_str(struct nfs4_stateowner *sop, struct xdr_netobj *owner,
2824                                                         clientid_t *clid)
2825 {
2826         return (sop->so_owner.len == owner->len) &&
2827                 0 == memcmp(sop->so_owner.data, owner->data, owner->len) &&
2828                 (sop->so_client->cl_clientid.cl_id == clid->cl_id);
2829 }
2830
2831 static struct nfs4_openowner *
2832 find_openstateowner_str(unsigned int hashval, struct nfsd4_open *open,
2833                         bool sessions, struct nfsd_net *nn)
2834 {
2835         struct nfs4_stateowner *so;
2836         struct nfs4_openowner *oo;
2837         struct nfs4_client *clp;
2838
2839         list_for_each_entry(so, &nn->ownerstr_hashtbl[hashval], so_strhash) {
2840                 if (!so->so_is_open_owner)
2841                         continue;
2842                 if (same_owner_str(so, &open->op_owner, &open->op_clientid)) {
2843                         oo = openowner(so);
2844                         clp = oo->oo_owner.so_client;
2845                         if ((bool)clp->cl_minorversion != sessions)
2846                                 return NULL;
2847                         renew_client(oo->oo_owner.so_client);
2848                         return oo;
2849                 }
2850         }
2851         return NULL;
2852 }
2853
2854 /* search file_hashtbl[] for file */
2855 static struct nfs4_file *
2856 find_file_locked(struct inode *ino)
2857 {
2858         unsigned int hashval = file_hashval(ino);
2859         struct nfs4_file *fp;
2860
2861         lockdep_assert_held(&state_lock);
2862
2863         hlist_for_each_entry(fp, &file_hashtbl[hashval], fi_hash) {
2864                 if (fp->fi_inode == ino) {
2865                         get_nfs4_file(fp);
2866                         return fp;
2867                 }
2868         }
2869         return NULL;
2870 }
2871
2872 static struct nfs4_file *
2873 find_file(struct inode *ino)
2874 {
2875         struct nfs4_file *fp;
2876
2877         spin_lock(&state_lock);
2878         fp = find_file_locked(ino);
2879         spin_unlock(&state_lock);
2880         return fp;
2881 }
2882
2883 static struct nfs4_file *
2884 find_or_add_file(struct inode *ino, struct nfs4_file *new)
2885 {
2886         struct nfs4_file *fp;
2887
2888         spin_lock(&state_lock);
2889         fp = find_file_locked(ino);
2890         if (fp == NULL) {
2891                 nfsd4_init_file(new, ino);
2892                 fp = new;
2893         }
2894         spin_unlock(&state_lock);
2895
2896         return fp;
2897 }
2898
2899 /*
2900  * Called to check deny when READ with all zero stateid or
2901  * WRITE with all zero or all one stateid
2902  */
2903 static __be32
2904 nfs4_share_conflict(struct svc_fh *current_fh, unsigned int deny_type)
2905 {
2906         struct inode *ino = current_fh->fh_dentry->d_inode;
2907         struct nfs4_file *fp;
2908         struct nfs4_ol_stateid *stp;
2909         __be32 ret;
2910
2911         fp = find_file(ino);
2912         if (!fp)
2913                 return nfs_ok;
2914         ret = nfserr_locked;
2915         /* Search for conflicting share reservations */
2916         list_for_each_entry(stp, &fp->fi_stateids, st_perfile) {
2917                 if (test_deny(deny_type, stp) ||
2918                     test_deny(NFS4_SHARE_DENY_BOTH, stp))
2919                         goto out;
2920         }
2921         ret = nfs_ok;
2922 out:
2923         put_nfs4_file(fp);
2924         return ret;
2925 }
2926
2927 static void nfsd_break_one_deleg(struct nfs4_delegation *dp)
2928 {
2929         struct nfs4_client *clp = dp->dl_stid.sc_client;
2930         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
2931
2932         lockdep_assert_held(&state_lock);
2933         /* We're assuming the state code never drops its reference
2934          * without first removing the lease.  Since we're in this lease
2935          * callback (and since the lease code is serialized by the kernel
2936          * lock) we know the server hasn't removed the lease yet, we know
2937          * it's safe to take a reference: */
2938         atomic_inc(&dp->dl_count);
2939
2940         /*
2941          * If the dl_time != 0, then we know that it has already been
2942          * queued for a lease break. Don't queue it again.
2943          */
2944         if (dp->dl_time == 0) {
2945                 list_add_tail(&dp->dl_recall_lru, &nn->del_recall_lru);
2946                 dp->dl_time = get_seconds();
2947         }
2948
2949         block_delegations(&dp->dl_fh);
2950
2951         nfsd4_cb_recall(dp);
2952 }
2953
2954 /* Called from break_lease() with i_lock held. */
2955 static void nfsd_break_deleg_cb(struct file_lock *fl)
2956 {
2957         struct nfs4_file *fp = (struct nfs4_file *)fl->fl_owner;
2958         struct nfs4_delegation *dp;
2959
2960         if (!fp) {
2961                 WARN(1, "(%p)->fl_owner NULL\n", fl);
2962                 return;
2963         }
2964         if (fp->fi_had_conflict) {
2965                 WARN(1, "duplicate break on %p\n", fp);
2966                 return;
2967         }
2968         /*
2969          * We don't want the locks code to timeout the lease for us;
2970          * we'll remove it ourself if a delegation isn't returned
2971          * in time:
2972          */
2973         fl->fl_break_time = 0;
2974
2975         spin_lock(&state_lock);
2976         fp->fi_had_conflict = true;
2977         list_for_each_entry(dp, &fp->fi_delegations, dl_perfile)
2978                 nfsd_break_one_deleg(dp);
2979         spin_unlock(&state_lock);
2980 }
2981
2982 static
2983 int nfsd_change_deleg_cb(struct file_lock **onlist, int arg)
2984 {
2985         if (arg & F_UNLCK)
2986                 return lease_modify(onlist, arg);
2987         else
2988                 return -EAGAIN;
2989 }
2990
2991 static const struct lock_manager_operations nfsd_lease_mng_ops = {
2992         .lm_break = nfsd_break_deleg_cb,
2993         .lm_change = nfsd_change_deleg_cb,
2994 };
2995
2996 static __be32 nfsd4_check_seqid(struct nfsd4_compound_state *cstate, struct nfs4_stateowner *so, u32 seqid)
2997 {
2998         if (nfsd4_has_session(cstate))
2999                 return nfs_ok;
3000         if (seqid == so->so_seqid - 1)
3001                 return nfserr_replay_me;
3002         if (seqid == so->so_seqid)
3003                 return nfs_ok;
3004         return nfserr_bad_seqid;
3005 }
3006
3007 static __be32 lookup_clientid(clientid_t *clid,
3008                 struct nfsd4_compound_state *cstate,
3009                 struct nfsd_net *nn)
3010 {
3011         struct nfs4_client *found;
3012
3013         if (cstate->clp) {
3014                 found = cstate->clp;
3015                 if (!same_clid(&found->cl_clientid, clid))
3016                         return nfserr_stale_clientid;
3017                 return nfs_ok;
3018         }
3019
3020         if (STALE_CLIENTID(clid, nn))
3021                 return nfserr_stale_clientid;
3022
3023         /*
3024          * For v4.1+ we get the client in the SEQUENCE op. If we don't have one
3025          * cached already then we know this is for is for v4.0 and "sessions"
3026          * will be false.
3027          */
3028         WARN_ON_ONCE(cstate->session);
3029         found = find_confirmed_client(clid, false, nn);
3030         if (!found)
3031                 return nfserr_expired;
3032
3033         /* Cache the nfs4_client in cstate! */
3034         cstate->clp = found;
3035         atomic_inc(&found->cl_refcount);
3036         return nfs_ok;
3037 }
3038
3039 __be32
3040 nfsd4_process_open1(struct nfsd4_compound_state *cstate,
3041                     struct nfsd4_open *open, struct nfsd_net *nn)
3042 {
3043         clientid_t *clientid = &open->op_clientid;
3044         struct nfs4_client *clp = NULL;
3045         unsigned int strhashval;
3046         struct nfs4_openowner *oo = NULL;
3047         __be32 status;
3048
3049         if (STALE_CLIENTID(&open->op_clientid, nn))
3050                 return nfserr_stale_clientid;
3051         /*
3052          * In case we need it later, after we've already created the
3053          * file and don't want to risk a further failure:
3054          */
3055         open->op_file = nfsd4_alloc_file();
3056         if (open->op_file == NULL)
3057                 return nfserr_jukebox;
3058
3059         status = lookup_clientid(clientid, cstate, nn);
3060         if (status)
3061                 return status;
3062         clp = cstate->clp;
3063
3064         strhashval = ownerstr_hashval(clientid->cl_id, &open->op_owner);
3065         oo = find_openstateowner_str(strhashval, open, cstate->minorversion, nn);
3066         open->op_openowner = oo;
3067         if (!oo) {
3068                 goto new_owner;
3069         }
3070         if (!(oo->oo_flags & NFS4_OO_CONFIRMED)) {
3071                 /* Replace unconfirmed owners without checking for replay. */
3072                 release_openowner(oo);
3073                 open->op_openowner = NULL;
3074                 goto new_owner;
3075         }
3076         status = nfsd4_check_seqid(cstate, &oo->oo_owner, open->op_seqid);
3077         if (status)
3078                 return status;
3079         goto alloc_stateid;
3080 new_owner:
3081         oo = alloc_init_open_stateowner(strhashval, open, cstate);
3082         if (oo == NULL)
3083                 return nfserr_jukebox;
3084         open->op_openowner = oo;
3085 alloc_stateid:
3086         open->op_stp = nfs4_alloc_stateid(clp);
3087         if (!open->op_stp)
3088                 return nfserr_jukebox;
3089         return nfs_ok;
3090 }
3091
3092 static inline __be32
3093 nfs4_check_delegmode(struct nfs4_delegation *dp, int flags)
3094 {
3095         if ((flags & WR_STATE) && (dp->dl_type == NFS4_OPEN_DELEGATE_READ))
3096                 return nfserr_openmode;
3097         else
3098                 return nfs_ok;
3099 }
3100
3101 static int share_access_to_flags(u32 share_access)
3102 {
3103         return share_access == NFS4_SHARE_ACCESS_READ ? RD_STATE : WR_STATE;
3104 }
3105
3106 static struct nfs4_delegation *find_deleg_stateid(struct nfs4_client *cl, stateid_t *s)
3107 {
3108         struct nfs4_stid *ret;
3109
3110         ret = find_stateid_by_type(cl, s, NFS4_DELEG_STID);
3111         if (!ret)
3112                 return NULL;
3113         return delegstateid(ret);
3114 }
3115
3116 static bool nfsd4_is_deleg_cur(struct nfsd4_open *open)
3117 {
3118         return open->op_claim_type == NFS4_OPEN_CLAIM_DELEGATE_CUR ||
3119                open->op_claim_type == NFS4_OPEN_CLAIM_DELEG_CUR_FH;
3120 }
3121
3122 static __be32
3123 nfs4_check_deleg(struct nfs4_client *cl, struct nfsd4_open *open,
3124                 struct nfs4_delegation **dp)
3125 {
3126         int flags;
3127         __be32 status = nfserr_bad_stateid;
3128
3129         *dp = find_deleg_stateid(cl, &open->op_delegate_stateid);
3130         if (*dp == NULL)
3131                 goto out;
3132         flags = share_access_to_flags(open->op_share_access);
3133         status = nfs4_check_delegmode(*dp, flags);
3134         if (status)
3135                 *dp = NULL;
3136 out:
3137         if (!nfsd4_is_deleg_cur(open))
3138                 return nfs_ok;
3139         if (status)
3140                 return status;
3141         open->op_openowner->oo_flags |= NFS4_OO_CONFIRMED;
3142         return nfs_ok;
3143 }
3144
3145 static __be32
3146 nfs4_check_open(struct nfs4_file *fp, struct nfsd4_open *open, struct nfs4_ol_stateid **stpp)
3147 {
3148         struct nfs4_ol_stateid *local;
3149         struct nfs4_openowner *oo = open->op_openowner;
3150
3151         list_for_each_entry(local, &fp->fi_stateids, st_perfile) {
3152                 /* ignore lock owners */
3153                 if (local->st_stateowner->so_is_open_owner == 0)
3154                         continue;
3155                 /* remember if we have seen this open owner */
3156                 if (local->st_stateowner == &oo->oo_owner)
3157                         *stpp = local;
3158                 /* check for conflicting share reservations */
3159                 if (!test_share(local, open))
3160                         return nfserr_share_denied;
3161         }
3162         return nfs_ok;
3163 }
3164
3165 static inline int nfs4_access_to_access(u32 nfs4_access)
3166 {
3167         int flags = 0;
3168
3169         if (nfs4_access & NFS4_SHARE_ACCESS_READ)
3170                 flags |= NFSD_MAY_READ;
3171         if (nfs4_access & NFS4_SHARE_ACCESS_WRITE)
3172                 flags |= NFSD_MAY_WRITE;
3173         return flags;
3174 }
3175
3176 static inline __be32
3177 nfsd4_truncate(struct svc_rqst *rqstp, struct svc_fh *fh,
3178                 struct nfsd4_open *open)
3179 {
3180         struct iattr iattr = {
3181                 .ia_valid = ATTR_SIZE,
3182                 .ia_size = 0,
3183         };
3184         if (!open->op_truncate)
3185                 return 0;
3186         if (!(open->op_share_access & NFS4_SHARE_ACCESS_WRITE))
3187                 return nfserr_inval;
3188         return nfsd_setattr(rqstp, fh, &iattr, 0, (time_t)0);
3189 }
3190
3191 static __be32 nfs4_get_vfs_file(struct svc_rqst *rqstp, struct nfs4_file *fp,
3192                 struct svc_fh *cur_fh, struct nfsd4_open *open)
3193 {
3194         __be32 status;
3195         int oflag = nfs4_access_to_omode(open->op_share_access);
3196         int access = nfs4_access_to_access(open->op_share_access);
3197
3198         if (!fp->fi_fds[oflag]) {
3199                 status = nfsd_open(rqstp, cur_fh, S_IFREG, access,
3200                         &fp->fi_fds[oflag]);
3201                 if (status)
3202                         goto out;
3203         }
3204         nfs4_file_get_access(fp, oflag);
3205
3206         status = nfsd4_truncate(rqstp, cur_fh, open);
3207         if (status)
3208                 goto out_put_access;
3209
3210         return nfs_ok;
3211
3212 out_put_access:
3213         nfs4_file_put_access(fp, oflag);
3214 out:
3215         return status;
3216 }
3217
3218 static __be32
3219 nfs4_upgrade_open(struct svc_rqst *rqstp, struct nfs4_file *fp, struct svc_fh *cur_fh, struct nfs4_ol_stateid *stp, struct nfsd4_open *open)
3220 {
3221         u32 op_share_access = open->op_share_access;
3222         __be32 status;
3223
3224         if (!test_access(op_share_access, stp))
3225                 status = nfs4_get_vfs_file(rqstp, fp, cur_fh, open);
3226         else
3227                 status = nfsd4_truncate(rqstp, cur_fh, open);
3228
3229         if (status)
3230                 return status;
3231
3232         /* remember the open */
3233         set_access(op_share_access, stp);
3234         set_deny(open->op_share_deny, stp);
3235         return nfs_ok;
3236 }
3237
3238
3239 static void
3240 nfs4_set_claim_prev(struct nfsd4_open *open, bool has_session)
3241 {
3242         open->op_openowner->oo_flags |= NFS4_OO_CONFIRMED;
3243 }
3244
3245 /* Should we give out recallable state?: */
3246 static bool nfsd4_cb_channel_good(struct nfs4_client *clp)
3247 {
3248         if (clp->cl_cb_state == NFSD4_CB_UP)
3249                 return true;
3250         /*
3251          * In the sessions case, since we don't have to establish a
3252          * separate connection for callbacks, we assume it's OK
3253          * until we hear otherwise:
3254          */
3255         return clp->cl_minorversion && clp->cl_cb_state == NFSD4_CB_UNKNOWN;
3256 }
3257
3258 static struct file_lock *nfs4_alloc_init_lease(struct nfs4_delegation *dp, int flag)
3259 {
3260         struct file_lock *fl;
3261
3262         fl = locks_alloc_lock();
3263         if (!fl)
3264                 return NULL;
3265         locks_init_lock(fl);
3266         fl->fl_lmops = &nfsd_lease_mng_ops;
3267         fl->fl_flags = FL_DELEG;
3268         fl->fl_type = flag == NFS4_OPEN_DELEGATE_READ? F_RDLCK: F_WRLCK;
3269         fl->fl_end = OFFSET_MAX;
3270         fl->fl_owner = (fl_owner_t)(dp->dl_file);
3271         fl->fl_pid = current->tgid;
3272         return fl;
3273 }
3274
3275 static int nfs4_setlease(struct nfs4_delegation *dp)
3276 {
3277         struct nfs4_file *fp = dp->dl_file;
3278         struct file_lock *fl;
3279         int status;
3280
3281         fl = nfs4_alloc_init_lease(dp, NFS4_OPEN_DELEGATE_READ);
3282         if (!fl)
3283                 return -ENOMEM;
3284         fl->fl_file = find_readable_file(fp);
3285         status = vfs_setlease(fl->fl_file, fl->fl_type, &fl);
3286         if (status)
3287                 goto out_free;
3288         fp->fi_lease = fl;
3289         fp->fi_deleg_file = get_file(fl->fl_file);
3290         atomic_set(&fp->fi_delegees, 1);
3291         spin_lock(&state_lock);
3292         hash_delegation_locked(dp, fp);
3293         spin_unlock(&state_lock);
3294         return 0;
3295 out_free:
3296         locks_free_lock(fl);
3297         return status;
3298 }
3299
3300 static int nfs4_set_delegation(struct nfs4_delegation *dp, struct nfs4_file *fp)
3301 {
3302         if (fp->fi_had_conflict)
3303                 return -EAGAIN;
3304         get_nfs4_file(fp);
3305         dp->dl_file = fp;
3306         if (!fp->fi_lease)
3307                 return nfs4_setlease(dp);
3308         spin_lock(&state_lock);
3309         atomic_inc(&fp->fi_delegees);
3310         if (fp->fi_had_conflict) {
3311                 spin_unlock(&state_lock);
3312                 return -EAGAIN;
3313         }
3314         hash_delegation_locked(dp, fp);
3315         spin_unlock(&state_lock);
3316         return 0;
3317 }
3318
3319 static void nfsd4_open_deleg_none_ext(struct nfsd4_open *open, int status)
3320 {
3321         open->op_delegate_type = NFS4_OPEN_DELEGATE_NONE_EXT;
3322         if (status == -EAGAIN)
3323                 open->op_why_no_deleg = WND4_CONTENTION;
3324         else {
3325                 open->op_why_no_deleg = WND4_RESOURCE;
3326                 switch (open->op_deleg_want) {
3327                 case NFS4_SHARE_WANT_READ_DELEG:
3328                 case NFS4_SHARE_WANT_WRITE_DELEG:
3329                 case NFS4_SHARE_WANT_ANY_DELEG:
3330                         break;
3331                 case NFS4_SHARE_WANT_CANCEL:
3332                         open->op_why_no_deleg = WND4_CANCELLED;
3333                         break;
3334                 case NFS4_SHARE_WANT_NO_DELEG:
3335                         WARN_ON_ONCE(1);
3336                 }
3337         }
3338 }
3339
3340 /*
3341  * Attempt to hand out a delegation.
3342  *
3343  * Note we don't support write delegations, and won't until the vfs has
3344  * proper support for them.
3345  */
3346 static void
3347 nfs4_open_delegation(struct net *net, struct svc_fh *fh,
3348                      struct nfsd4_open *open, struct nfs4_ol_stateid *stp)
3349 {
3350         struct nfs4_delegation *dp;
3351         struct nfs4_openowner *oo = container_of(stp->st_stateowner, struct nfs4_openowner, oo_owner);
3352         int cb_up;
3353         int status = 0;
3354
3355         cb_up = nfsd4_cb_channel_good(oo->oo_owner.so_client);
3356         open->op_recall = 0;
3357         switch (open->op_claim_type) {
3358                 case NFS4_OPEN_CLAIM_PREVIOUS:
3359                         if (!cb_up)
3360                                 open->op_recall = 1;
3361                         if (open->op_delegate_type != NFS4_OPEN_DELEGATE_READ)
3362                                 goto out_no_deleg;
3363                         break;
3364                 case NFS4_OPEN_CLAIM_NULL:
3365                 case NFS4_OPEN_CLAIM_FH:
3366                         /*
3367                          * Let's not give out any delegations till everyone's
3368                          * had the chance to reclaim theirs....
3369                          */
3370                         if (locks_in_grace(net))
3371                                 goto out_no_deleg;
3372                         if (!cb_up || !(oo->oo_flags & NFS4_OO_CONFIRMED))
3373                                 goto out_no_deleg;
3374                         /*
3375                          * Also, if the file was opened for write or
3376                          * create, there's a good chance the client's
3377                          * about to write to it, resulting in an
3378                          * immediate recall (since we don't support
3379                          * write delegations):
3380                          */
3381                         if (open->op_share_access & NFS4_SHARE_ACCESS_WRITE)
3382                                 goto out_no_deleg;
3383                         if (open->op_create == NFS4_OPEN_CREATE)
3384                                 goto out_no_deleg;
3385                         break;
3386                 default:
3387                         goto out_no_deleg;
3388         }
3389         dp = alloc_init_deleg(oo->oo_owner.so_client, stp, fh);
3390         if (dp == NULL)
3391                 goto out_no_deleg;
3392         status = nfs4_set_delegation(dp, stp->st_file);
3393         if (status)
3394                 goto out_free;
3395
3396         memcpy(&open->op_delegate_stateid, &dp->dl_stid.sc_stateid, sizeof(dp->dl_stid.sc_stateid));
3397
3398         dprintk("NFSD: delegation stateid=" STATEID_FMT "\n",
3399                 STATEID_VAL(&dp->dl_stid.sc_stateid));
3400         open->op_delegate_type = NFS4_OPEN_DELEGATE_READ;
3401         return;
3402 out_free:
3403         destroy_delegation(dp);
3404 out_no_deleg:
3405         open->op_delegate_type = NFS4_OPEN_DELEGATE_NONE;
3406         if (open->op_claim_type == NFS4_OPEN_CLAIM_PREVIOUS &&
3407             open->op_delegate_type != NFS4_OPEN_DELEGATE_NONE) {
3408                 dprintk("NFSD: WARNING: refusing delegation reclaim\n");
3409                 open->op_recall = 1;
3410         }
3411
3412         /* 4.1 client asking for a delegation? */
3413         if (open->op_deleg_want)
3414                 nfsd4_open_deleg_none_ext(open, status);
3415         return;
3416 }
3417
3418 static void nfsd4_deleg_xgrade_none_ext(struct nfsd4_open *open,
3419                                         struct nfs4_delegation *dp)
3420 {
3421         if (open->op_deleg_want == NFS4_SHARE_WANT_READ_DELEG &&
3422             dp->dl_type == NFS4_OPEN_DELEGATE_WRITE) {
3423                 open->op_delegate_type = NFS4_OPEN_DELEGATE_NONE_EXT;
3424                 open->op_why_no_deleg = WND4_NOT_SUPP_DOWNGRADE;
3425         } else if (open->op_deleg_want == NFS4_SHARE_WANT_WRITE_DELEG &&
3426                    dp->dl_type == NFS4_OPEN_DELEGATE_WRITE) {
3427                 open->op_delegate_type = NFS4_OPEN_DELEGATE_NONE_EXT;
3428                 open->op_why_no_deleg = WND4_NOT_SUPP_UPGRADE;
3429         }
3430         /* Otherwise the client must be confused wanting a delegation
3431          * it already has, therefore we don't return
3432          * NFS4_OPEN_DELEGATE_NONE_EXT and reason.
3433          */
3434 }
3435
3436 /*
3437  * called with nfs4_lock_state() held.
3438  */
3439 __be32
3440 nfsd4_process_open2(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_open *open)
3441 {
3442         struct nfsd4_compoundres *resp = rqstp->rq_resp;
3443         struct nfs4_client *cl = open->op_openowner->oo_owner.so_client;
3444         struct nfs4_file *fp = NULL;
3445         struct inode *ino = current_fh->fh_dentry->d_inode;
3446         struct nfs4_ol_stateid *stp = NULL;
3447         struct nfs4_delegation *dp = NULL;
3448         __be32 status;
3449
3450         /*
3451          * Lookup file; if found, lookup stateid and check open request,
3452          * and check for delegations in the process of being recalled.
3453          * If not found, create the nfs4_file struct
3454          */
3455         fp = find_or_add_file(ino, open->op_file);
3456         if (fp != open->op_file) {
3457                 if ((status = nfs4_check_open(fp, open, &stp)))
3458                         goto out;
3459                 status = nfs4_check_deleg(cl, open, &dp);
3460                 if (status)
3461                         goto out;
3462         } else {
3463                 open->op_file = NULL;
3464                 status = nfserr_bad_stateid;
3465                 if (nfsd4_is_deleg_cur(open))
3466                         goto out;
3467                 status = nfserr_jukebox;
3468         }
3469
3470         /*
3471          * OPEN the file, or upgrade an existing OPEN.
3472          * If truncate fails, the OPEN fails.
3473          */
3474         if (stp) {
3475                 /* Stateid was found, this is an OPEN upgrade */
3476                 status = nfs4_upgrade_open(rqstp, fp, current_fh, stp, open);
3477                 if (status)
3478                         goto out;
3479         } else {
3480                 status = nfs4_get_vfs_file(rqstp, fp, current_fh, open);
3481                 if (status)
3482                         goto out;
3483                 stp = open->op_stp;
3484                 open->op_stp = NULL;
3485                 init_open_stateid(stp, fp, open);
3486         }
3487         update_stateid(&stp->st_stid.sc_stateid);
3488         memcpy(&open->op_stateid, &stp->st_stid.sc_stateid, sizeof(stateid_t));
3489
3490         if (nfsd4_has_session(&resp->cstate)) {
3491                 if (open->op_deleg_want & NFS4_SHARE_WANT_NO_DELEG) {
3492                         open->op_delegate_type = NFS4_OPEN_DELEGATE_NONE_EXT;
3493                         open->op_why_no_deleg = WND4_NOT_WANTED;
3494                         goto nodeleg;
3495                 }
3496         }
3497
3498         /*
3499         * Attempt to hand out a delegation. No error return, because the
3500         * OPEN succeeds even if we fail.
3501         */
3502         nfs4_open_delegation(SVC_NET(rqstp), current_fh, open, stp);
3503 nodeleg:
3504         status = nfs_ok;
3505
3506         dprintk("%s: stateid=" STATEID_FMT "\n", __func__,
3507                 STATEID_VAL(&stp->st_stid.sc_stateid));
3508 out:
3509         /* 4.1 client trying to upgrade/downgrade delegation? */
3510         if (open->op_delegate_type == NFS4_OPEN_DELEGATE_NONE && dp &&
3511             open->op_deleg_want)
3512                 nfsd4_deleg_xgrade_none_ext(open, dp);
3513
3514         if (fp)
3515                 put_nfs4_file(fp);
3516         if (status == 0 && open->op_claim_type == NFS4_OPEN_CLAIM_PREVIOUS)
3517                 nfs4_set_claim_prev(open, nfsd4_has_session(&resp->cstate));
3518         /*
3519         * To finish the open response, we just need to set the rflags.
3520         */
3521         open->op_rflags = NFS4_OPEN_RESULT_LOCKTYPE_POSIX;
3522         if (!(open->op_openowner->oo_flags & NFS4_OO_CONFIRMED) &&
3523             !nfsd4_has_session(&resp->cstate))
3524                 open->op_rflags |= NFS4_OPEN_RESULT_CONFIRM;
3525
3526         return status;
3527 }
3528
3529 void nfsd4_cleanup_open_state(struct nfsd4_open *open, __be32 status)
3530 {
3531         if (open->op_openowner) {
3532                 struct nfs4_openowner *oo = open->op_openowner;
3533
3534                 if (!list_empty(&oo->oo_owner.so_stateids))
3535                         list_del_init(&oo->oo_close_lru);
3536                 if (oo->oo_flags & NFS4_OO_NEW) {
3537                         if (status) {
3538                                 release_openowner(oo);
3539                                 open->op_openowner = NULL;
3540                         } else
3541                                 oo->oo_flags &= ~NFS4_OO_NEW;
3542                 }
3543         }
3544         if (open->op_file)
3545                 nfsd4_free_file(open->op_file);
3546         if (open->op_stp)
3547                 free_generic_stateid(open->op_stp);
3548 }
3549
3550 __be32
3551 nfsd4_renew(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
3552             clientid_t *clid)
3553 {
3554         struct nfs4_client *clp;
3555         __be32 status;
3556         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
3557
3558         nfs4_lock_state();
3559         dprintk("process_renew(%08x/%08x): starting\n",
3560                         clid->cl_boot, clid->cl_id);
3561         status = lookup_clientid(clid, cstate, nn);
3562         if (status)
3563                 goto out;
3564         clp = cstate->clp;
3565         status = nfserr_cb_path_down;
3566         if (!list_empty(&clp->cl_delegations)
3567                         && clp->cl_cb_state != NFSD4_CB_UP)
3568                 goto out;
3569         status = nfs_ok;
3570 out:
3571         nfs4_unlock_state();
3572         return status;
3573 }
3574
3575 static void
3576 nfsd4_end_grace(struct nfsd_net *nn)
3577 {
3578         /* do nothing if grace period already ended */
3579         if (nn->grace_ended)
3580                 return;
3581
3582         dprintk("NFSD: end of grace period\n");
3583         nn->grace_ended = true;
3584         nfsd4_record_grace_done(nn, nn->boot_time);
3585         locks_end_grace(&nn->nfsd4_manager);
3586         /*
3587          * Now that every NFSv4 client has had the chance to recover and
3588          * to see the (possibly new, possibly shorter) lease time, we
3589          * can safely set the next grace time to the current lease time:
3590          */
3591         nn->nfsd4_grace = nn->nfsd4_lease;
3592 }
3593
3594 static time_t
3595 nfs4_laundromat(struct nfsd_net *nn)
3596 {
3597         struct nfs4_client *clp;
3598         struct nfs4_openowner *oo;
3599         struct nfs4_delegation *dp;
3600         struct list_head *pos, *next, reaplist;
3601         time_t cutoff = get_seconds() - nn->nfsd4_lease;
3602         time_t t, new_timeo = nn->nfsd4_lease;
3603
3604         nfs4_lock_state();
3605
3606         dprintk("NFSD: laundromat service - starting\n");
3607         nfsd4_end_grace(nn);
3608         INIT_LIST_HEAD(&reaplist);
3609         spin_lock(&nn->client_lock);
3610         list_for_each_safe(pos, next, &nn->client_lru) {
3611                 clp = list_entry(pos, struct nfs4_client, cl_lru);
3612                 if (time_after((unsigned long)clp->cl_time, (unsigned long)cutoff)) {
3613                         t = clp->cl_time - cutoff;
3614                         new_timeo = min(new_timeo, t);
3615                         break;
3616                 }
3617                 if (mark_client_expired_locked(clp)) {
3618                         dprintk("NFSD: client in use (clientid %08x)\n",
3619                                 clp->cl_clientid.cl_id);
3620                         continue;
3621                 }
3622                 list_move(&clp->cl_lru, &reaplist);
3623         }
3624         spin_unlock(&nn->client_lock);
3625         list_for_each_safe(pos, next, &reaplist) {
3626                 clp = list_entry(pos, struct nfs4_client, cl_lru);
3627                 dprintk("NFSD: purging unused client (clientid %08x)\n",
3628                         clp->cl_clientid.cl_id);
3629                 expire_client(clp);
3630         }
3631         spin_lock(&state_lock);
3632         list_for_each_safe(pos, next, &nn->del_recall_lru) {
3633                 dp = list_entry (pos, struct nfs4_delegation, dl_recall_lru);
3634                 if (net_generic(dp->dl_stid.sc_client->net, nfsd_net_id) != nn)
3635                         continue;
3636                 if (time_after((unsigned long)dp->dl_time, (unsigned long)cutoff)) {
3637                         t = dp->dl_time - cutoff;
3638                         new_timeo = min(new_timeo, t);
3639                         break;
3640                 }
3641                 list_move(&dp->dl_recall_lru, &reaplist);
3642         }
3643         spin_unlock(&state_lock);
3644         list_for_each_safe(pos, next, &reaplist) {
3645                 dp = list_entry (pos, struct nfs4_delegation, dl_recall_lru);
3646                 revoke_delegation(dp);
3647         }
3648         list_for_each_safe(pos, next, &nn->close_lru) {
3649                 oo = container_of(pos, struct nfs4_openowner, oo_close_lru);
3650                 if (time_after((unsigned long)oo->oo_time, (unsigned long)cutoff)) {
3651                         t = oo->oo_time - cutoff;
3652                         new_timeo = min(new_timeo, t);
3653                         break;
3654                 }
3655                 release_openowner(oo);
3656         }
3657         new_timeo = max_t(time_t, new_timeo, NFSD_LAUNDROMAT_MINTIMEOUT);
3658         nfs4_unlock_state();
3659         return new_timeo;
3660 }
3661
3662 static struct workqueue_struct *laundry_wq;
3663 static void laundromat_main(struct work_struct *);
3664
3665 static void
3666 laundromat_main(struct work_struct *laundry)
3667 {
3668         time_t t;
3669         struct delayed_work *dwork = container_of(laundry, struct delayed_work,
3670                                                   work);
3671         struct nfsd_net *nn = container_of(dwork, struct nfsd_net,
3672                                            laundromat_work);
3673
3674         t = nfs4_laundromat(nn);
3675         dprintk("NFSD: laundromat_main - sleeping for %ld seconds\n", t);
3676         queue_delayed_work(laundry_wq, &nn->laundromat_work, t*HZ);
3677 }
3678
3679 static inline __be32 nfs4_check_fh(struct svc_fh *fhp, struct nfs4_ol_stateid *stp)
3680 {
3681         if (fhp->fh_dentry->d_inode != stp->st_file->fi_inode)
3682                 return nfserr_bad_stateid;
3683         return nfs_ok;
3684 }
3685
3686 static inline int
3687 access_permit_read(struct nfs4_ol_stateid *stp)
3688 {
3689         return test_access(NFS4_SHARE_ACCESS_READ, stp) ||
3690                 test_access(NFS4_SHARE_ACCESS_BOTH, stp) ||
3691                 test_access(NFS4_SHARE_ACCESS_WRITE, stp);
3692 }
3693
3694 static inline int
3695 access_permit_write(struct nfs4_ol_stateid *stp)
3696 {
3697         return test_access(NFS4_SHARE_ACCESS_WRITE, stp) ||
3698                 test_access(NFS4_SHARE_ACCESS_BOTH, stp);
3699 }
3700
3701 static
3702 __be32 nfs4_check_openmode(struct nfs4_ol_stateid *stp, int flags)
3703 {
3704         __be32 status = nfserr_openmode;
3705
3706         /* For lock stateid's, we test the parent open, not the lock: */
3707         if (stp->st_openstp)
3708                 stp = stp->st_openstp;
3709         if ((flags & WR_STATE) && !access_permit_write(stp))
3710                 goto out;
3711         if ((flags & RD_STATE) && !access_permit_read(stp))
3712                 goto out;
3713         status = nfs_ok;
3714 out:
3715         return status;
3716 }
3717
3718 static inline __be32
3719 check_special_stateids(struct net *net, svc_fh *current_fh, stateid_t *stateid, int flags)
3720 {
3721         if (ONE_STATEID(stateid) && (flags & RD_STATE))
3722                 return nfs_ok;
3723         else if (locks_in_grace(net)) {
3724                 /* Answer in remaining cases depends on existence of
3725                  * conflicting state; so we must wait out the grace period. */
3726                 return nfserr_grace;
3727         } else if (flags & WR_STATE)
3728                 return nfs4_share_conflict(current_fh,
3729                                 NFS4_SHARE_DENY_WRITE);
3730         else /* (flags & RD_STATE) && ZERO_STATEID(stateid) */
3731                 return nfs4_share_conflict(current_fh,
3732                                 NFS4_SHARE_DENY_READ);
3733 }
3734
3735 /*
3736  * Allow READ/WRITE during grace period on recovered state only for files
3737  * that are not able to provide mandatory locking.
3738  */
3739 static inline int
3740 grace_disallows_io(struct net *net, struct inode *inode)
3741 {
3742         return locks_in_grace(net) && mandatory_lock(inode);
3743 }
3744
3745 /* Returns true iff a is later than b: */
3746 static bool stateid_generation_after(stateid_t *a, stateid_t *b)
3747 {
3748         return (s32)(a->si_generation - b->si_generation) > 0;
3749 }
3750
3751 static __be32 check_stateid_generation(stateid_t *in, stateid_t *ref, bool has_session)
3752 {
3753         /*
3754          * When sessions are used the stateid generation number is ignored
3755          * when it is zero.
3756          */
3757         if (has_session && in->si_generation == 0)
3758                 return nfs_ok;
3759
3760         if (in->si_generation == ref->si_generation)
3761                 return nfs_ok;
3762
3763         /* If the client sends us a stateid from the future, it's buggy: */
3764         if (stateid_generation_after(in, ref))
3765                 return nfserr_bad_stateid;
3766         /*
3767          * However, we could see a stateid from the past, even from a
3768          * non-buggy client.  For example, if the client sends a lock
3769          * while some IO is outstanding, the lock may bump si_generation
3770          * while the IO is still in flight.  The client could avoid that
3771          * situation by waiting for responses on all the IO requests,
3772          * but better performance may result in retrying IO that
3773          * receives an old_stateid error if requests are rarely
3774          * reordered in flight:
3775          */
3776         return nfserr_old_stateid;
3777 }
3778
3779 static __be32 nfsd4_validate_stateid(struct nfs4_client *cl, stateid_t *stateid)
3780 {
3781         struct nfs4_stid *s;
3782         struct nfs4_ol_stateid *ols;
3783         __be32 status;
3784
3785         if (ZERO_STATEID(stateid) || ONE_STATEID(stateid))
3786                 return nfserr_bad_stateid;
3787         /* Client debugging aid. */
3788         if (!same_clid(&stateid->si_opaque.so_clid, &cl->cl_clientid)) {
3789                 char addr_str[INET6_ADDRSTRLEN];
3790                 rpc_ntop((struct sockaddr *)&cl->cl_addr, addr_str,
3791                                  sizeof(addr_str));
3792                 pr_warn_ratelimited("NFSD: client %s testing state ID "
3793                                         "with incorrect client ID\n", addr_str);
3794                 return nfserr_bad_stateid;
3795         }
3796         s = find_stateid(cl, stateid);
3797         if (!s)
3798                 return nfserr_bad_stateid;
3799         status = check_stateid_generation(stateid, &s->sc_stateid, 1);
3800         if (status)
3801                 return status;
3802         switch (s->sc_type) {
3803         case NFS4_DELEG_STID:
3804                 return nfs_ok;
3805         case NFS4_REVOKED_DELEG_STID:
3806                 return nfserr_deleg_revoked;
3807         case NFS4_OPEN_STID:
3808         case NFS4_LOCK_STID:
3809                 ols = openlockstateid(s);
3810                 if (ols->st_stateowner->so_is_open_owner
3811                                 && !(openowner(ols->st_stateowner)->oo_flags
3812                                                 & NFS4_OO_CONFIRMED))
3813                         return nfserr_bad_stateid;
3814                 return nfs_ok;
3815         default:
3816                 printk("unknown stateid type %x\n", s->sc_type);
3817         case NFS4_CLOSED_STID:
3818                 return nfserr_bad_stateid;
3819         }
3820 }
3821
3822 static __be32
3823 nfsd4_lookup_stateid(struct nfsd4_compound_state *cstate,
3824                      stateid_t *stateid, unsigned char typemask,
3825                      struct nfs4_stid **s, struct nfsd_net *nn)
3826 {
3827         __be32 status;
3828
3829         if (ZERO_STATEID(stateid) || ONE_STATEID(stateid))
3830                 return nfserr_bad_stateid;
3831         status = lookup_clientid(&stateid->si_opaque.so_clid, cstate, nn);
3832         if (status == nfserr_stale_clientid) {
3833                 if (cstate->session)
3834                         return nfserr_bad_stateid;
3835                 return nfserr_stale_stateid;
3836         }
3837         if (status)
3838                 return status;
3839         *s = find_stateid_by_type(cstate->clp, stateid, typemask);
3840         if (!*s)
3841                 return nfserr_bad_stateid;
3842         return nfs_ok;
3843 }
3844
3845 /*
3846 * Checks for stateid operations
3847 */
3848 __be32
3849 nfs4_preprocess_stateid_op(struct net *net, struct nfsd4_compound_state *cstate,
3850                            stateid_t *stateid, int flags, struct file **filpp)
3851 {
3852         struct nfs4_stid *s;
3853         struct nfs4_ol_stateid *stp = NULL;
3854         struct nfs4_delegation *dp = NULL;
3855         struct svc_fh *current_fh = &cstate->current_fh;
3856         struct inode *ino = current_fh->fh_dentry->d_inode;
3857         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
3858         struct file *file = NULL;
3859         __be32 status;
3860
3861         if (filpp)
3862                 *filpp = NULL;
3863
3864         if (grace_disallows_io(net, ino))
3865                 return nfserr_grace;
3866
3867         if (ZERO_STATEID(stateid) || ONE_STATEID(stateid))
3868                 return check_special_stateids(net, current_fh, stateid, flags);
3869
3870         nfs4_lock_state();
3871
3872         status = nfsd4_lookup_stateid(cstate, stateid,
3873                                 NFS4_DELEG_STID|NFS4_OPEN_STID|NFS4_LOCK_STID,
3874                                 &s, nn);
3875         if (status)
3876                 goto out;
3877         status = check_stateid_generation(stateid, &s->sc_stateid, nfsd4_has_session(cstate));
3878         if (status)
3879                 goto out;
3880         switch (s->sc_type) {
3881         case NFS4_DELEG_STID:
3882                 dp = delegstateid(s);
3883                 status = nfs4_check_delegmode(dp, flags);
3884                 if (status)
3885                         goto out;
3886                 if (filpp) {
3887                         file = dp->dl_file->fi_deleg_file;
3888                         if (!file) {
3889                                 WARN_ON_ONCE(1);
3890                                 status = nfserr_serverfault;
3891                                 goto out;
3892                         }
3893                 }
3894                 break;
3895         case NFS4_OPEN_STID:
3896         case NFS4_LOCK_STID:
3897                 stp = openlockstateid(s);
3898                 status = nfs4_check_fh(current_fh, stp);
3899                 if (status)
3900                         goto out;
3901                 if (stp->st_stateowner->so_is_open_owner
3902                     && !(openowner(stp->st_stateowner)->oo_flags & NFS4_OO_CONFIRMED))
3903                         goto out;
3904                 status = nfs4_check_openmode(stp, flags);
3905                 if (status)
3906                         goto out;
3907                 if (filpp) {
3908                         if (flags & RD_STATE)
3909                                 file = find_readable_file(stp->st_file);
3910                         else
3911                                 file = find_writeable_file(stp->st_file);
3912                 }
3913                 break;
3914         default:
3915                 status = nfserr_bad_stateid;
3916                 goto out;
3917         }
3918         status = nfs_ok;
3919         if (file)
3920                 *filpp = get_file(file);
3921 out:
3922         nfs4_unlock_state();
3923         return status;
3924 }
3925
3926 static __be32
3927 nfsd4_free_lock_stateid(struct nfs4_ol_stateid *stp)
3928 {
3929         struct nfs4_lockowner *lo = lockowner(stp->st_stateowner);
3930
3931         if (check_for_locks(stp->st_file, lo))
3932                 return nfserr_locks_held;
3933         release_lockowner_if_empty(lo);
3934         return nfs_ok;
3935 }
3936
3937 /*
3938  * Test if the stateid is valid
3939  */
3940 __be32
3941 nfsd4_test_stateid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
3942                    struct nfsd4_test_stateid *test_stateid)
3943 {
3944         struct nfsd4_test_stateid_id *stateid;
3945         struct nfs4_client *cl = cstate->session->se_client;
3946
3947         nfs4_lock_state();
3948         list_for_each_entry(stateid, &test_stateid->ts_stateid_list, ts_id_list)
3949                 stateid->ts_id_status =
3950                         nfsd4_validate_stateid(cl, &stateid->ts_id_stateid);
3951         nfs4_unlock_state();
3952
3953         return nfs_ok;
3954 }
3955
3956 __be32
3957 nfsd4_free_stateid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
3958                    struct nfsd4_free_stateid *free_stateid)
3959 {
3960         stateid_t *stateid = &free_stateid->fr_stateid;
3961         struct nfs4_stid *s;
3962         struct nfs4_delegation *dp;
3963         struct nfs4_client *cl = cstate->session->se_client;
3964         __be32 ret = nfserr_bad_stateid;
3965
3966         nfs4_lock_state();
3967         s = find_stateid(cl, stateid);
3968         if (!s)
3969                 goto out;
3970         switch (s->sc_type) {
3971         case NFS4_DELEG_STID:
3972                 ret = nfserr_locks_held;
3973                 goto out;
3974         case NFS4_OPEN_STID:
3975         case NFS4_LOCK_STID:
3976                 ret = check_stateid_generation(stateid, &s->sc_stateid, 1);
3977                 if (ret)
3978                         goto out;
3979                 if (s->sc_type == NFS4_LOCK_STID)
3980                         ret = nfsd4_free_lock_stateid(openlockstateid(s));
3981                 else
3982                         ret = nfserr_locks_held;
3983                 break;
3984         case NFS4_REVOKED_DELEG_STID:
3985                 dp = delegstateid(s);
3986                 destroy_revoked_delegation(dp);
3987                 ret = nfs_ok;
3988                 break;
3989         default:
3990                 ret = nfserr_bad_stateid;
3991         }
3992 out:
3993         nfs4_unlock_state();
3994         return ret;
3995 }
3996
3997 static inline int
3998 setlkflg (int type)
3999 {
4000         return (type == NFS4_READW_LT || type == NFS4_READ_LT) ?
4001                 RD_STATE : WR_STATE;
4002 }
4003
4004 static __be32 nfs4_seqid_op_checks(struct nfsd4_compound_state *cstate, stateid_t *stateid, u32 seqid, struct nfs4_ol_stateid *stp)
4005 {
4006         struct svc_fh *current_fh = &cstate->current_fh;
4007         struct nfs4_stateowner *sop = stp->st_stateowner;
4008         __be32 status;
4009
4010         status = nfsd4_check_seqid(cstate, sop, seqid);
4011         if (status)
4012                 return status;
4013         if (stp->st_stid.sc_type == NFS4_CLOSED_STID
4014                 || stp->st_stid.sc_type == NFS4_REVOKED_DELEG_STID)
4015                 /*
4016                  * "Closed" stateid's exist *only* to return
4017                  * nfserr_replay_me from the previous step, and
4018                  * revoked delegations are kept only for free_stateid.
4019                  */
4020                 return nfserr_bad_stateid;
4021         status = check_stateid_generation(stateid, &stp->st_stid.sc_stateid, nfsd4_has_session(cstate));
4022         if (status)
4023                 return status;
4024         return nfs4_check_fh(current_fh, stp);
4025 }
4026
4027 /*
4028  * Checks for sequence id mutating operations.
4029  */
4030 static __be32
4031 nfs4_preprocess_seqid_op(struct nfsd4_compound_state *cstate, u32 seqid,
4032                          stateid_t *stateid, char typemask,
4033                          struct nfs4_ol_stateid **stpp,
4034                          struct nfsd_net *nn)
4035 {
4036         __be32 status;
4037         struct nfs4_stid *s;
4038         struct nfs4_ol_stateid *stp = NULL;
4039
4040         dprintk("NFSD: %s: seqid=%d stateid = " STATEID_FMT "\n", __func__,
4041                 seqid, STATEID_VAL(stateid));
4042
4043         *stpp = NULL;
4044         status = nfsd4_lookup_stateid(cstate, stateid, typemask, &s, nn);
4045         if (status)
4046                 return status;
4047         stp = openlockstateid(s);
4048         if (!nfsd4_has_session(cstate))
4049                 cstate->replay_owner = stp->st_stateowner;
4050
4051         status = nfs4_seqid_op_checks(cstate, stateid, seqid, stp);
4052         if (!status)
4053                 *stpp = stp;
4054         return status;
4055 }
4056
4057 static __be32 nfs4_preprocess_confirmed_seqid_op(struct nfsd4_compound_state *cstate, u32 seqid,
4058                                                  stateid_t *stateid, struct nfs4_ol_stateid **stpp, struct nfsd_net *nn)
4059 {
4060         __be32 status;
4061         struct nfs4_openowner *oo;
4062
4063         status = nfs4_preprocess_seqid_op(cstate, seqid, stateid,
4064                                                 NFS4_OPEN_STID, stpp, nn);
4065         if (status)
4066                 return status;
4067         oo = openowner((*stpp)->st_stateowner);
4068         if (!(oo->oo_flags & NFS4_OO_CONFIRMED))
4069                 return nfserr_bad_stateid;
4070         return nfs_ok;
4071 }
4072
4073 __be32
4074 nfsd4_open_confirm(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
4075                    struct nfsd4_open_confirm *oc)
4076 {
4077         __be32 status;
4078         struct nfs4_openowner *oo;
4079         struct nfs4_ol_stateid *stp;
4080         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
4081
4082         dprintk("NFSD: nfsd4_open_confirm on file %pd\n",
4083                         cstate->current_fh.fh_dentry);
4084
4085         status = fh_verify(rqstp, &cstate->current_fh, S_IFREG, 0);
4086         if (status)
4087                 return status;
4088
4089         nfs4_lock_state();
4090
4091         status = nfs4_preprocess_seqid_op(cstate,
4092                                         oc->oc_seqid, &oc->oc_req_stateid,
4093                                         NFS4_OPEN_STID, &stp, nn);
4094         if (status)
4095                 goto out;
4096         oo = openowner(stp->st_stateowner);
4097         status = nfserr_bad_stateid;
4098         if (oo->oo_flags & NFS4_OO_CONFIRMED)
4099                 goto out;
4100         oo->oo_flags |= NFS4_OO_CONFIRMED;
4101         update_stateid(&stp->st_stid.sc_stateid);
4102         memcpy(&oc->oc_resp_stateid, &stp->st_stid.sc_stateid, sizeof(stateid_t));
4103         dprintk("NFSD: %s: success, seqid=%d stateid=" STATEID_FMT "\n",
4104                 __func__, oc->oc_seqid, STATEID_VAL(&stp->st_stid.sc_stateid));
4105
4106         nfsd4_client_record_create(oo->oo_owner.so_client);
4107         status = nfs_ok;
4108 out:
4109         nfsd4_bump_seqid(cstate, status);
4110         if (!cstate->replay_owner)
4111                 nfs4_unlock_state();
4112         return status;
4113 }
4114
4115 static inline void nfs4_stateid_downgrade_bit(struct nfs4_ol_stateid *stp, u32 access)
4116 {
4117         if (!test_access(access, stp))
4118                 return;
4119         nfs4_file_put_access(stp->st_file, nfs4_access_to_omode(access));
4120         clear_access(access, stp);
4121 }
4122
4123 static inline void nfs4_stateid_downgrade(struct nfs4_ol_stateid *stp, u32 to_access)
4124 {
4125         switch (to_access) {
4126         case NFS4_SHARE_ACCESS_READ:
4127                 nfs4_stateid_downgrade_bit(stp, NFS4_SHARE_ACCESS_WRITE);
4128                 nfs4_stateid_downgrade_bit(stp, NFS4_SHARE_ACCESS_BOTH);
4129                 break;
4130         case NFS4_SHARE_ACCESS_WRITE:
4131                 nfs4_stateid_downgrade_bit(stp, NFS4_SHARE_ACCESS_READ);
4132                 nfs4_stateid_downgrade_bit(stp, NFS4_SHARE_ACCESS_BOTH);
4133                 break;
4134         case NFS4_SHARE_ACCESS_BOTH:
4135                 break;
4136         default:
4137                 WARN_ON_ONCE(1);
4138         }
4139 }
4140
4141 static void
4142 reset_union_bmap_deny(unsigned long deny, struct nfs4_ol_stateid *stp)
4143 {
4144         int i;
4145         for (i = 0; i < 4; i++) {
4146                 if ((i & deny) != i)
4147                         clear_deny(i, stp);
4148         }
4149 }
4150
4151 __be32
4152 nfsd4_open_downgrade(struct svc_rqst *rqstp,
4153                      struct nfsd4_compound_state *cstate,
4154                      struct nfsd4_open_downgrade *od)
4155 {
4156         __be32 status;
4157         struct nfs4_ol_stateid *stp;
4158         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
4159
4160         dprintk("NFSD: nfsd4_open_downgrade on file %pd\n",
4161                         cstate->current_fh.fh_dentry);
4162
4163         /* We don't yet support WANT bits: */
4164         if (od->od_deleg_want)
4165                 dprintk("NFSD: %s: od_deleg_want=0x%x ignored\n", __func__,
4166                         od->od_deleg_want);
4167
4168         nfs4_lock_state();
4169         status = nfs4_preprocess_confirmed_seqid_op(cstate, od->od_seqid,
4170                                         &od->od_stateid, &stp, nn);
4171         if (status)
4172                 goto out;
4173         status = nfserr_inval;
4174         if (!test_access(od->od_share_access, stp)) {
4175                 dprintk("NFSD: access not a subset current bitmap: 0x%lx, input access=%08x\n",
4176                         stp->st_access_bmap, od->od_share_access);
4177                 goto out;
4178         }
4179         if (!test_deny(od->od_share_deny, stp)) {
4180                 dprintk("NFSD:deny not a subset current bitmap: 0x%lx, input deny=%08x\n",
4181                         stp->st_deny_bmap, od->od_share_deny);
4182                 goto out;
4183         }
4184         nfs4_stateid_downgrade(stp, od->od_share_access);
4185
4186         reset_union_bmap_deny(od->od_share_deny, stp);
4187
4188         update_stateid(&stp->st_stid.sc_stateid);
4189         memcpy(&od->od_stateid, &stp->st_stid.sc_stateid, sizeof(stateid_t));
4190         status = nfs_ok;
4191 out:
4192         nfsd4_bump_seqid(cstate, status);
4193         if (!cstate->replay_owner)
4194                 nfs4_unlock_state();
4195         return status;
4196 }
4197
4198 static void nfsd4_close_open_stateid(struct nfs4_ol_stateid *s)
4199 {
4200         struct nfs4_client *clp = s->st_stid.sc_client;
4201         struct nfs4_openowner *oo = openowner(s->st_stateowner);
4202
4203         s->st_stid.sc_type = NFS4_CLOSED_STID;
4204         unhash_open_stateid(s);
4205
4206         if (clp->cl_minorversion) {
4207                 free_generic_stateid(s);
4208                 if (list_empty(&oo->oo_owner.so_stateids))
4209                         release_openowner(oo);
4210         } else {
4211                 oo->oo_last_closed_stid = s;
4212                 /*
4213                  * In the 4.0 case we need to keep the owners around a
4214                  * little while to handle CLOSE replay.
4215                  */
4216                 if (list_empty(&oo->oo_owner.so_stateids))
4217                         move_to_close_lru(oo, clp->net);
4218         }
4219 }
4220
4221 /*
4222  * nfs4_unlock_state() called after encode
4223  */
4224 __be32
4225 nfsd4_close(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
4226             struct nfsd4_close *close)
4227 {
4228         __be32 status;
4229         struct nfs4_ol_stateid *stp;
4230         struct net *net = SVC_NET(rqstp);
4231         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
4232
4233         dprintk("NFSD: nfsd4_close on file %pd\n",
4234                         cstate->current_fh.fh_dentry);
4235
4236         nfs4_lock_state();
4237         status = nfs4_preprocess_seqid_op(cstate, close->cl_seqid,
4238                                         &close->cl_stateid,
4239                                         NFS4_OPEN_STID|NFS4_CLOSED_STID,
4240                                         &stp, nn);
4241         nfsd4_bump_seqid(cstate, status);
4242         if (status)
4243                 goto out;
4244         update_stateid(&stp->st_stid.sc_stateid);
4245         memcpy(&close->cl_stateid, &stp->st_stid.sc_stateid, sizeof(stateid_t));
4246
4247         nfsd4_close_open_stateid(stp);
4248 out:
4249         if (!cstate->replay_owner)
4250                 nfs4_unlock_state();
4251         return status;
4252 }
4253
4254 __be32
4255 nfsd4_delegreturn(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
4256                   struct nfsd4_delegreturn *dr)
4257 {
4258         struct nfs4_delegation *dp;
4259         stateid_t *stateid = &dr->dr_stateid;
4260         struct nfs4_stid *s;
4261         __be32 status;
4262         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
4263
4264         if ((status = fh_verify(rqstp, &cstate->current_fh, S_IFREG, 0)))
4265                 return status;
4266
4267         nfs4_lock_state();
4268         status = nfsd4_lookup_stateid(cstate, stateid, NFS4_DELEG_STID, &s, nn);
4269         if (status)
4270                 goto out;
4271         dp = delegstateid(s);
4272         status = check_stateid_generation(stateid, &dp->dl_stid.sc_stateid, nfsd4_has_session(cstate));
4273         if (status)
4274                 goto out;
4275
4276         destroy_delegation(dp);
4277 out:
4278         nfs4_unlock_state();
4279
4280         return status;
4281 }
4282
4283
4284 #define LOFF_OVERFLOW(start, len)      ((u64)(len) > ~(u64)(start))
4285
4286 static inline u64
4287 end_offset(u64 start, u64 len)
4288 {
4289         u64 end;
4290
4291         end = start + len;
4292         return end >= start ? end: NFS4_MAX_UINT64;
4293 }
4294
4295 /* last octet in a range */
4296 static inline u64
4297 last_byte_offset(u64 start, u64 len)
4298 {
4299         u64 end;
4300
4301         WARN_ON_ONCE(!len);
4302         end = start + len;
4303         return end > start ? end - 1: NFS4_MAX_UINT64;
4304 }
4305
4306 /*
4307  * TODO: Linux file offsets are _signed_ 64-bit quantities, which means that
4308  * we can't properly handle lock requests that go beyond the (2^63 - 1)-th
4309  * byte, because of sign extension problems.  Since NFSv4 calls for 64-bit
4310  * locking, this prevents us from being completely protocol-compliant.  The
4311  * real solution to this problem is to start using unsigned file offsets in
4312  * the VFS, but this is a very deep change!
4313  */
4314 static inline void
4315 nfs4_transform_lock_offset(struct file_lock *lock)
4316 {
4317         if (lock->fl_start < 0)
4318                 lock->fl_start = OFFSET_MAX;
4319         if (lock->fl_end < 0)
4320                 lock->fl_end = OFFSET_MAX;
4321 }
4322
4323 /* Hack!: For now, we're defining this just so we can use a pointer to it
4324  * as a unique cookie to identify our (NFSv4's) posix locks. */
4325 static const struct lock_manager_operations nfsd_posix_mng_ops  = {
4326 };
4327
4328 static inline void
4329 nfs4_set_lock_denied(struct file_lock *fl, struct nfsd4_lock_denied *deny)
4330 {
4331         struct nfs4_lockowner *lo;
4332
4333         if (fl->fl_lmops == &nfsd_posix_mng_ops) {
4334                 lo = (struct nfs4_lockowner *) fl->fl_owner;
4335                 deny->ld_owner.data = kmemdup(lo->lo_owner.so_owner.data,
4336                                         lo->lo_owner.so_owner.len, GFP_KERNEL);
4337                 if (!deny->ld_owner.data)
4338                         /* We just don't care that much */
4339                         goto nevermind;
4340                 deny->ld_owner.len = lo->lo_owner.so_owner.len;
4341                 deny->ld_clientid = lo->lo_owner.so_client->cl_clientid;
4342         } else {
4343 nevermind:
4344                 deny->ld_owner.len = 0;
4345                 deny->ld_owner.data = NULL;
4346                 deny->ld_clientid.cl_boot = 0;
4347                 deny->ld_clientid.cl_id = 0;
4348         }
4349         deny->ld_start = fl->fl_start;
4350         deny->ld_length = NFS4_MAX_UINT64;
4351         if (fl->fl_end != NFS4_MAX_UINT64)
4352                 deny->ld_length = fl->fl_end - fl->fl_start + 1;
4353         deny->ld_type = NFS4_READ_LT;
4354         if (fl->fl_type != F_RDLCK)
4355                 deny->ld_type = NFS4_WRITE_LT;
4356 }
4357
4358 static struct nfs4_lockowner *
4359 find_lockowner_str(clientid_t *clid, struct xdr_netobj *owner,
4360                 struct nfsd_net *nn)
4361 {
4362         unsigned int strhashval = ownerstr_hashval(clid->cl_id, owner);
4363         struct nfs4_stateowner *so;
4364
4365         list_for_each_entry(so, &nn->ownerstr_hashtbl[strhashval], so_strhash) {
4366                 if (so->so_is_open_owner)
4367                         continue;
4368                 if (!same_owner_str(so, owner, clid))
4369                         continue;
4370                 return lockowner(so);
4371         }
4372         return NULL;
4373 }
4374
4375 /*
4376  * Alloc a lock owner structure.
4377  * Called in nfsd4_lock - therefore, OPEN and OPEN_CONFIRM (if needed) has
4378  * occurred.
4379  *
4380  * strhashval = ownerstr_hashval
4381  */
4382 static struct nfs4_lockowner *
4383 alloc_init_lock_stateowner(unsigned int strhashval, struct nfs4_client *clp, struct nfs4_ol_stateid *open_stp, struct nfsd4_lock *lock) {
4384         struct nfs4_lockowner *lo;
4385         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
4386
4387         lo = alloc_stateowner(lockowner_slab, &lock->lk_new_owner, clp);
4388         if (!lo)
4389                 return NULL;
4390         INIT_LIST_HEAD(&lo->lo_owner.so_stateids);
4391         lo->lo_owner.so_is_open_owner = 0;
4392         /* It is the openowner seqid that will be incremented in encode in the
4393          * case of new lockowners; so increment the lock seqid manually: */
4394         lo->lo_owner.so_seqid = lock->lk_new_lock_seqid + 1;
4395         list_add(&lo->lo_owner.so_strhash, &nn->ownerstr_hashtbl[strhashval]);
4396         return lo;
4397 }
4398
4399 static struct nfs4_ol_stateid *
4400 alloc_init_lock_stateid(struct nfs4_lockowner *lo, struct nfs4_file *fp, struct nfs4_ol_stateid *open_stp)
4401 {
4402         struct nfs4_ol_stateid *stp;
4403         struct nfs4_client *clp = lo->lo_owner.so_client;
4404
4405         stp = nfs4_alloc_stateid(clp);
4406         if (stp == NULL)
4407                 return NULL;
4408         stp->st_stid.sc_type = NFS4_LOCK_STID;
4409         list_add(&stp->st_perfile, &fp->fi_stateids);
4410         list_add(&stp->st_perstateowner, &lo->lo_owner.so_stateids);
4411         stp->st_stateowner = &lo->lo_owner;
4412         get_nfs4_file(fp);
4413         stp->st_file = fp;
4414         stp->st_access_bmap = 0;
4415         stp->st_deny_bmap = open_stp->st_deny_bmap;
4416         stp->st_openstp = open_stp;
4417         list_add(&stp->st_locks, &open_stp->st_locks);
4418         return stp;
4419 }
4420
4421 static struct nfs4_ol_stateid *
4422 find_lock_stateid(struct nfs4_lockowner *lo, struct nfs4_file *fp)
4423 {
4424         struct nfs4_ol_stateid *lst;
4425
4426         list_for_each_entry(lst, &lo->lo_owner.so_stateids, st_perstateowner) {
4427                 if (lst->st_file == fp)
4428                         return lst;
4429         }
4430         return NULL;
4431 }
4432
4433
4434 static int
4435 check_lock_length(u64 offset, u64 length)
4436 {
4437         return ((length == 0)  || ((length != NFS4_MAX_UINT64) &&
4438              LOFF_OVERFLOW(offset, length)));
4439 }
4440
4441 static void get_lock_access(struct nfs4_ol_stateid *lock_stp, u32 access)
4442 {
4443         struct nfs4_file *fp = lock_stp->st_file;
4444         int oflag = nfs4_access_to_omode(access);
4445
4446         if (test_access(access, lock_stp))
4447                 return;
4448         nfs4_file_get_access(fp, oflag);
4449         set_access(access, lock_stp);
4450 }
4451
4452 static __be32 lookup_or_create_lock_state(struct nfsd4_compound_state *cstate, struct nfs4_ol_stateid *ost, struct nfsd4_lock *lock, struct nfs4_ol_stateid **lst, bool *new)
4453 {
4454         struct nfs4_file *fi = ost->st_file;
4455         struct nfs4_openowner *oo = openowner(ost->st_stateowner);
4456         struct nfs4_client *cl = oo->oo_owner.so_client;
4457         struct nfs4_lockowner *lo;
4458         unsigned int strhashval;
4459         struct nfsd_net *nn = net_generic(cl->net, nfsd_net_id);
4460
4461         lo = find_lockowner_str(&cl->cl_clientid, &lock->v.new.owner, nn);
4462         if (!lo) {
4463                 strhashval = ownerstr_hashval(cl->cl_clientid.cl_id,
4464                                 &lock->v.new.owner);
4465                 lo = alloc_init_lock_stateowner(strhashval, cl, ost, lock);
4466                 if (lo == NULL)
4467                         return nfserr_jukebox;
4468         } else {
4469                 /* with an existing lockowner, seqids must be the same */
4470                 if (!cstate->minorversion &&
4471                     lock->lk_new_lock_seqid != lo->lo_owner.so_seqid)
4472                         return nfserr_bad_seqid;
4473         }
4474
4475         *lst = find_lock_stateid(lo, fi);
4476         if (*lst == NULL) {
4477                 *lst = alloc_init_lock_stateid(lo, fi, ost);
4478                 if (*lst == NULL) {
4479                         release_lockowner_if_empty(lo);
4480                         return nfserr_jukebox;
4481                 }
4482                 *new = true;
4483         }
4484         return nfs_ok;
4485 }
4486
4487 /*
4488  *  LOCK operation
4489  */
4490 __be32
4491 nfsd4_lock(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
4492            struct nfsd4_lock *lock)
4493 {
4494         struct nfs4_openowner *open_sop = NULL;
4495         struct nfs4_lockowner *lock_sop = NULL;
4496         struct nfs4_ol_stateid *lock_stp;
4497         struct file *filp = NULL;
4498         struct file_lock *file_lock = NULL;
4499         struct file_lock *conflock = NULL;
4500         __be32 status = 0;
4501         bool new_state = false;
4502         int lkflg;
4503         int err;
4504         struct net *net = SVC_NET(rqstp);
4505         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
4506
4507         dprintk("NFSD: nfsd4_lock: start=%Ld length=%Ld\n",
4508                 (long long) lock->lk_offset,
4509                 (long long) lock->lk_length);
4510
4511         if (check_lock_length(lock->lk_offset, lock->lk_length))
4512                  return nfserr_inval;
4513
4514         if ((status = fh_verify(rqstp, &cstate->current_fh,
4515                                 S_IFREG, NFSD_MAY_LOCK))) {
4516                 dprintk("NFSD: nfsd4_lock: permission denied!\n");
4517                 return status;
4518         }
4519
4520         nfs4_lock_state();
4521
4522         if (lock->lk_is_new) {
4523                 struct nfs4_ol_stateid *open_stp = NULL;
4524
4525                 if (nfsd4_has_session(cstate))
4526                         /* See rfc 5661 18.10.3: given clientid is ignored: */
4527                         memcpy(&lock->v.new.clientid,
4528                                 &cstate->session->se_client->cl_clientid,
4529                                 sizeof(clientid_t));
4530
4531                 status = nfserr_stale_clientid;
4532                 if (STALE_CLIENTID(&lock->lk_new_clientid, nn))
4533                         goto out;
4534
4535                 /* validate and update open stateid and open seqid */
4536                 status = nfs4_preprocess_confirmed_seqid_op(cstate,
4537                                         lock->lk_new_open_seqid,
4538                                         &lock->lk_new_open_stateid,
4539                                         &open_stp, nn);
4540                 if (status)
4541                         goto out;
4542                 open_sop = openowner(open_stp->st_stateowner);
4543                 status = nfserr_bad_stateid;
4544                 if (!same_clid(&open_sop->oo_owner.so_client->cl_clientid,
4545                                                 &lock->v.new.clientid))
4546                         goto out;
4547                 status = lookup_or_create_lock_state(cstate, open_stp, lock,
4548                                                         &lock_stp, &new_state);
4549         } else
4550                 status = nfs4_preprocess_seqid_op(cstate,
4551                                        lock->lk_old_lock_seqid,
4552                                        &lock->lk_old_lock_stateid,
4553                                        NFS4_LOCK_STID, &lock_stp, nn);
4554         if (status)
4555                 goto out;
4556         lock_sop = lockowner(lock_stp->st_stateowner);
4557
4558         lkflg = setlkflg(lock->lk_type);
4559         status = nfs4_check_openmode(lock_stp, lkflg);
4560         if (status)
4561                 goto out;
4562
4563         status = nfserr_grace;
4564         if (locks_in_grace(net) && !lock->lk_reclaim)
4565                 goto out;
4566         status = nfserr_no_grace;
4567         if (!locks_in_grace(net) && lock->lk_reclaim)
4568                 goto out;
4569
4570         file_lock = locks_alloc_lock();
4571         if (!file_lock) {
4572                 dprintk("NFSD: %s: unable to allocate lock!\n", __func__);
4573                 status = nfserr_jukebox;
4574                 goto out;
4575         }
4576
4577         locks_init_lock(file_lock);
4578         switch (lock->lk_type) {
4579                 case NFS4_READ_LT:
4580                 case NFS4_READW_LT:
4581                         filp = find_readable_file(lock_stp->st_file);
4582                         if (filp)
4583                                 get_lock_access(lock_stp, NFS4_SHARE_ACCESS_READ);
4584                         file_lock->fl_type = F_RDLCK;
4585                         break;
4586                 case NFS4_WRITE_LT:
4587                 case NFS4_WRITEW_LT:
4588                         filp = find_writeable_file(lock_stp->st_file);
4589                         if (filp)
4590                                 get_lock_access(lock_stp, NFS4_SHARE_ACCESS_WRITE);
4591                         file_lock->fl_type = F_WRLCK;
4592                         break;
4593                 default:
4594                         status = nfserr_inval;
4595                 goto out;
4596         }
4597         if (!filp) {
4598                 status = nfserr_openmode;
4599                 goto out;
4600         }
4601         file_lock->fl_owner = (fl_owner_t)lock_sop;
4602         file_lock->fl_pid = current->tgid;
4603         file_lock->fl_file = filp;
4604         file_lock->fl_flags = FL_POSIX;
4605         file_lock->fl_lmops = &nfsd_posix_mng_ops;
4606         file_lock->fl_start = lock->lk_offset;
4607         file_lock->fl_end = last_byte_offset(lock->lk_offset, lock->lk_length);
4608         nfs4_transform_lock_offset(file_lock);
4609
4610         conflock = locks_alloc_lock();
4611         if (!conflock) {
4612                 dprintk("NFSD: %s: unable to allocate lock!\n", __func__);
4613                 status = nfserr_jukebox;
4614                 goto out;
4615         }
4616
4617         err = vfs_lock_file(filp, F_SETLK, file_lock, conflock);
4618         switch (-err) {
4619         case 0: /* success! */
4620                 update_stateid(&lock_stp->st_stid.sc_stateid);
4621                 memcpy(&lock->lk_resp_stateid, &lock_stp->st_stid.sc_stateid,
4622                                 sizeof(stateid_t));
4623                 status = 0;
4624                 break;
4625         case (EAGAIN):          /* conflock holds conflicting lock */
4626                 status = nfserr_denied;
4627                 dprintk("NFSD: nfsd4_lock: conflicting lock found!\n");
4628                 nfs4_set_lock_denied(conflock, &lock->lk_denied);
4629                 break;
4630         case (EDEADLK):
4631                 status = nfserr_deadlock;
4632                 break;
4633         default:
4634                 dprintk("NFSD: nfsd4_lock: vfs_lock_file() failed! status %d\n",err);
4635                 status = nfserrno(err);
4636                 break;
4637         }
4638 out:
4639         if (status && new_state)
4640                 release_lock_stateid(lock_stp);
4641         nfsd4_bump_seqid(cstate, status);
4642         if (!cstate->replay_owner)
4643                 nfs4_unlock_state();
4644         if (file_lock)
4645                 locks_free_lock(file_lock);
4646         if (conflock)
4647                 locks_free_lock(conflock);
4648         return status;
4649 }
4650
4651 /*
4652  * The NFSv4 spec allows a client to do a LOCKT without holding an OPEN,
4653  * so we do a temporary open here just to get an open file to pass to
4654  * vfs_test_lock.  (Arguably perhaps test_lock should be done with an
4655  * inode operation.)
4656  */
4657 static __be32 nfsd_test_lock(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file_lock *lock)
4658 {
4659         struct file *file;
4660         __be32 err = nfsd_open(rqstp, fhp, S_IFREG, NFSD_MAY_READ, &file);
4661         if (!err) {
4662                 err = nfserrno(vfs_test_lock(file, lock));
4663                 nfsd_close(file);
4664         }
4665         return err;
4666 }
4667
4668 /*
4669  * LOCKT operation
4670  */
4671 __be32
4672 nfsd4_lockt(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
4673             struct nfsd4_lockt *lockt)
4674 {
4675         struct file_lock *file_lock = NULL;
4676         struct nfs4_lockowner *lo;
4677         __be32 status;
4678         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
4679
4680         if (locks_in_grace(SVC_NET(rqstp)))
4681                 return nfserr_grace;
4682
4683         if (check_lock_length(lockt->lt_offset, lockt->lt_length))
4684                  return nfserr_inval;
4685
4686         nfs4_lock_state();
4687
4688         if (!nfsd4_has_session(cstate)) {
4689                 status = lookup_clientid(&lockt->lt_clientid, cstate, nn);
4690                 if (status)
4691                         goto out;
4692         }
4693
4694         if ((status = fh_verify(rqstp, &cstate->current_fh, S_IFREG, 0)))
4695                 goto out;
4696
4697         file_lock = locks_alloc_lock();
4698         if (!file_lock) {
4699                 dprintk("NFSD: %s: unable to allocate lock!\n", __func__);
4700                 status = nfserr_jukebox;
4701                 goto out;
4702         }
4703         locks_init_lock(file_lock);
4704         switch (lockt->lt_type) {
4705                 case NFS4_READ_LT:
4706                 case NFS4_READW_LT:
4707                         file_lock->fl_type = F_RDLCK;
4708                 break;
4709                 case NFS4_WRITE_LT:
4710                 case NFS4_WRITEW_LT:
4711                         file_lock->fl_type = F_WRLCK;
4712                 break;
4713                 default:
4714                         dprintk("NFSD: nfs4_lockt: bad lock type!\n");
4715                         status = nfserr_inval;
4716                 goto out;
4717         }
4718
4719         lo = find_lockowner_str(&lockt->lt_clientid, &lockt->lt_owner, nn);
4720         if (lo)
4721                 file_lock->fl_owner = (fl_owner_t)lo;
4722         file_lock->fl_pid = current->tgid;
4723         file_lock->fl_flags = FL_POSIX;
4724
4725         file_lock->fl_start = lockt->lt_offset;
4726         file_lock->fl_end = last_byte_offset(lockt->lt_offset, lockt->lt_length);
4727
4728         nfs4_transform_lock_offset(file_lock);
4729
4730         status = nfsd_test_lock(rqstp, &cstate->current_fh, file_lock);
4731         if (status)
4732                 goto out;
4733
4734         if (file_lock->fl_type != F_UNLCK) {
4735                 status = nfserr_denied;
4736                 nfs4_set_lock_denied(file_lock, &lockt->lt_denied);
4737         }
4738 out:
4739         nfs4_unlock_state();
4740         if (file_lock)
4741                 locks_free_lock(file_lock);
4742         return status;
4743 }
4744
4745 __be32
4746 nfsd4_locku(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
4747             struct nfsd4_locku *locku)
4748 {
4749         struct nfs4_ol_stateid *stp;
4750         struct file *filp = NULL;
4751         struct file_lock *file_lock = NULL;
4752         __be32 status;
4753         int err;
4754         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
4755
4756         dprintk("NFSD: nfsd4_locku: start=%Ld length=%Ld\n",
4757                 (long long) locku->lu_offset,
4758                 (long long) locku->lu_length);
4759
4760         if (check_lock_length(locku->lu_offset, locku->lu_length))
4761                  return nfserr_inval;
4762
4763         nfs4_lock_state();
4764
4765         status = nfs4_preprocess_seqid_op(cstate, locku->lu_seqid,
4766                                         &locku->lu_stateid, NFS4_LOCK_STID,
4767                                         &stp, nn);
4768         if (status)
4769                 goto out;
4770         filp = find_any_file(stp->st_file);
4771         if (!filp) {
4772                 status = nfserr_lock_range;
4773                 goto out;
4774         }
4775         file_lock = locks_alloc_lock();
4776         if (!file_lock) {
4777                 dprintk("NFSD: %s: unable to allocate lock!\n", __func__);
4778                 status = nfserr_jukebox;
4779                 goto out;
4780         }
4781         locks_init_lock(file_lock);
4782         file_lock->fl_type = F_UNLCK;
4783         file_lock->fl_owner = (fl_owner_t)lockowner(stp->st_stateowner);
4784         file_lock->fl_pid = current->tgid;
4785         file_lock->fl_file = filp;
4786         file_lock->fl_flags = FL_POSIX;
4787         file_lock->fl_lmops = &nfsd_posix_mng_ops;
4788         file_lock->fl_start = locku->lu_offset;
4789
4790         file_lock->fl_end = last_byte_offset(locku->lu_offset,
4791                                                 locku->lu_length);
4792         nfs4_transform_lock_offset(file_lock);
4793
4794         err = vfs_lock_file(filp, F_SETLK, file_lock, NULL);
4795         if (err) {
4796                 dprintk("NFSD: nfs4_locku: vfs_lock_file failed!\n");
4797                 goto out_nfserr;
4798         }
4799         update_stateid(&stp->st_stid.sc_stateid);
4800         memcpy(&locku->lu_stateid, &stp->st_stid.sc_stateid, sizeof(stateid_t));
4801
4802 out:
4803         nfsd4_bump_seqid(cstate, status);
4804         if (!cstate->replay_owner)
4805                 nfs4_unlock_state();
4806         if (file_lock)
4807                 locks_free_lock(file_lock);
4808         return status;
4809
4810 out_nfserr:
4811         status = nfserrno(err);
4812         goto out;
4813 }
4814
4815 /*
4816  * returns
4817  *      1: locks held by lockowner
4818  *      0: no locks held by lockowner
4819  */
4820 static int
4821 check_for_locks(struct nfs4_file *filp, struct nfs4_lockowner *lowner)
4822 {
4823         struct file_lock **flpp;
4824         struct inode *inode = filp->fi_inode;
4825         int status = 0;
4826
4827         spin_lock(&inode->i_lock);
4828         for (flpp = &inode->i_flock; *flpp != NULL; flpp = &(*flpp)->fl_next) {
4829                 if ((*flpp)->fl_owner == (fl_owner_t)lowner) {
4830                         status = 1;
4831                         goto out;
4832                 }
4833         }
4834 out:
4835         spin_unlock(&inode->i_lock);
4836         return status;
4837 }
4838
4839 __be32
4840 nfsd4_release_lockowner(struct svc_rqst *rqstp,
4841                         struct nfsd4_compound_state *cstate,
4842                         struct nfsd4_release_lockowner *rlockowner)
4843 {
4844         clientid_t *clid = &rlockowner->rl_clientid;
4845         struct nfs4_stateowner *sop = NULL, *tmp;
4846         struct nfs4_lockowner *lo;
4847         struct nfs4_ol_stateid *stp;
4848         struct xdr_netobj *owner = &rlockowner->rl_owner;
4849         unsigned int hashval = ownerstr_hashval(clid->cl_id, owner);
4850         __be32 status;
4851         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
4852
4853         dprintk("nfsd4_release_lockowner clientid: (%08x/%08x):\n",
4854                 clid->cl_boot, clid->cl_id);
4855
4856         nfs4_lock_state();
4857
4858         status = lookup_clientid(clid, cstate, nn);
4859         if (status)
4860                 goto out;
4861
4862         status = nfserr_locks_held;
4863
4864         /* Find the matching lock stateowner */
4865         list_for_each_entry(tmp, &nn->ownerstr_hashtbl[hashval], so_strhash) {
4866                 if (tmp->so_is_open_owner)
4867                         continue;
4868                 if (same_owner_str(tmp, owner, clid)) {
4869                         sop = tmp;
4870                         break;
4871                 }
4872         }
4873
4874         /* No matching owner found, maybe a replay? Just declare victory... */
4875         if (!sop) {
4876                 status = nfs_ok;
4877                 goto out;
4878         }
4879
4880         lo = lockowner(sop);
4881         /* see if there are still any locks associated with it */
4882         list_for_each_entry(stp, &sop->so_stateids, st_perstateowner) {
4883                 if (check_for_locks(stp->st_file, lo))
4884                         goto out;
4885         }
4886
4887         status = nfs_ok;
4888         release_lockowner(lo);
4889 out:
4890         nfs4_unlock_state();
4891         return status;
4892 }
4893
4894 static inline struct nfs4_client_reclaim *
4895 alloc_reclaim(void)
4896 {
4897         return kmalloc(sizeof(struct nfs4_client_reclaim), GFP_KERNEL);
4898 }
4899
4900 bool
4901 nfs4_has_reclaimed_state(const char *name, struct nfsd_net *nn)
4902 {
4903         struct nfs4_client_reclaim *crp;
4904
4905         crp = nfsd4_find_reclaim_client(name, nn);
4906         return (crp && crp->cr_clp);
4907 }
4908
4909 /*
4910  * failure => all reset bets are off, nfserr_no_grace...
4911  */
4912 struct nfs4_client_reclaim *
4913 nfs4_client_to_reclaim(const char *name, struct nfsd_net *nn)
4914 {
4915         unsigned int strhashval;
4916         struct nfs4_client_reclaim *crp;
4917
4918         dprintk("NFSD nfs4_client_to_reclaim NAME: %.*s\n", HEXDIR_LEN, name);
4919         crp = alloc_reclaim();
4920         if (crp) {
4921                 strhashval = clientstr_hashval(name);
4922                 INIT_LIST_HEAD(&crp->cr_strhash);
4923                 list_add(&crp->cr_strhash, &nn->reclaim_str_hashtbl[strhashval]);
4924                 memcpy(crp->cr_recdir, name, HEXDIR_LEN);
4925                 crp->cr_clp = NULL;
4926                 nn->reclaim_str_hashtbl_size++;
4927         }
4928         return crp;
4929 }
4930
4931 void
4932 nfs4_remove_reclaim_record(struct nfs4_client_reclaim *crp, struct nfsd_net *nn)
4933 {
4934         list_del(&crp->cr_strhash);
4935         kfree(crp);
4936         nn->reclaim_str_hashtbl_size--;
4937 }
4938
4939 void
4940 nfs4_release_reclaim(struct nfsd_net *nn)
4941 {
4942         struct nfs4_client_reclaim *crp = NULL;
4943         int i;
4944
4945         for (i = 0; i < CLIENT_HASH_SIZE; i++) {
4946                 while (!list_empty(&nn->reclaim_str_hashtbl[i])) {
4947                         crp = list_entry(nn->reclaim_str_hashtbl[i].next,
4948                                         struct nfs4_client_reclaim, cr_strhash);
4949                         nfs4_remove_reclaim_record(crp, nn);
4950                 }
4951         }
4952         WARN_ON_ONCE(nn->reclaim_str_hashtbl_size);
4953 }
4954
4955 /*
4956  * called from OPEN, CLAIM_PREVIOUS with a new clientid. */
4957 struct nfs4_client_reclaim *
4958 nfsd4_find_reclaim_client(const char *recdir, struct nfsd_net *nn)
4959 {
4960         unsigned int strhashval;
4961         struct nfs4_client_reclaim *crp = NULL;
4962
4963         dprintk("NFSD: nfs4_find_reclaim_client for recdir %s\n", recdir);
4964
4965         strhashval = clientstr_hashval(recdir);
4966         list_for_each_entry(crp, &nn->reclaim_str_hashtbl[strhashval], cr_strhash) {
4967                 if (same_name(crp->cr_recdir, recdir)) {
4968                         return crp;
4969                 }
4970         }
4971         return NULL;
4972 }
4973
4974 /*
4975 * Called from OPEN. Look for clientid in reclaim list.
4976 */
4977 __be32
4978 nfs4_check_open_reclaim(clientid_t *clid,
4979                 struct nfsd4_compound_state *cstate,
4980                 struct nfsd_net *nn)
4981 {
4982         __be32 status;
4983
4984         /* find clientid in conf_id_hashtbl */
4985         status = lookup_clientid(clid, cstate, nn);
4986         if (status)
4987                 return nfserr_reclaim_bad;
4988
4989         if (nfsd4_client_record_check(cstate->clp))
4990                 return nfserr_reclaim_bad;
4991
4992         return nfs_ok;
4993 }
4994
4995 #ifdef CONFIG_NFSD_FAULT_INJECTION
4996
4997 u64 nfsd_forget_client(struct nfs4_client *clp, u64 max)
4998 {
4999         if (mark_client_expired(clp))
5000                 return 0;
5001         expire_client(clp);
5002         return 1;
5003 }
5004
5005 u64 nfsd_print_client(struct nfs4_client *clp, u64 num)
5006 {
5007         char buf[INET6_ADDRSTRLEN];
5008         rpc_ntop((struct sockaddr *)&clp->cl_addr, buf, sizeof(buf));
5009         printk(KERN_INFO "NFS Client: %s\n", buf);
5010         return 1;
5011 }
5012
5013 static void nfsd_print_count(struct nfs4_client *clp, unsigned int count,
5014                              const char *type)
5015 {
5016         char buf[INET6_ADDRSTRLEN];
5017         rpc_ntop((struct sockaddr *)&clp->cl_addr, buf, sizeof(buf));
5018         printk(KERN_INFO "NFS Client: %s has %u %s\n", buf, count, type);
5019 }
5020
5021 static u64 nfsd_foreach_client_lock(struct nfs4_client *clp, u64 max,
5022                                     void (*func)(struct nfs4_ol_stateid *))
5023 {
5024         struct nfs4_openowner *oop;
5025         struct nfs4_ol_stateid *stp, *st_next;
5026         struct nfs4_ol_stateid *lst, *lst_next;
5027         u64 count = 0;
5028
5029         list_for_each_entry(oop, &clp->cl_openowners, oo_perclient) {
5030                 list_for_each_entry_safe(stp, st_next,
5031                                 &oop->oo_owner.so_stateids, st_perstateowner) {
5032                         list_for_each_entry_safe(lst, lst_next,
5033                                         &stp->st_locks, st_locks) {
5034                                 if (func)
5035                                         func(lst);
5036                                 if (++count == max)
5037                                         return count;
5038                         }
5039                 }
5040         }
5041
5042         return count;
5043 }
5044
5045 u64 nfsd_forget_client_locks(struct nfs4_client *clp, u64 max)
5046 {
5047         return nfsd_foreach_client_lock(clp, max, release_lock_stateid);
5048 }
5049
5050 u64 nfsd_print_client_locks(struct nfs4_client *clp, u64 max)
5051 {
5052         u64 count = nfsd_foreach_client_lock(clp, max, NULL);
5053         nfsd_print_count(clp, count, "locked files");
5054         return count;
5055 }
5056
5057 static u64 nfsd_foreach_client_open(struct nfs4_client *clp, u64 max, void (*func)(struct nfs4_openowner *))
5058 {
5059         struct nfs4_openowner *oop, *next;
5060         u64 count = 0;
5061
5062         list_for_each_entry_safe(oop, next, &clp->cl_openowners, oo_perclient) {
5063                 if (func)
5064                         func(oop);
5065                 if (++count == max)
5066                         break;
5067         }
5068
5069         return count;
5070 }
5071
5072 u64 nfsd_forget_client_openowners(struct nfs4_client *clp, u64 max)
5073 {
5074         return nfsd_foreach_client_open(clp, max, release_openowner);
5075 }
5076
5077 u64 nfsd_print_client_openowners(struct nfs4_client *clp, u64 max)
5078 {
5079         u64 count = nfsd_foreach_client_open(clp, max, NULL);
5080         nfsd_print_count(clp, count, "open files");
5081         return count;
5082 }
5083
5084 static u64 nfsd_find_all_delegations(struct nfs4_client *clp, u64 max,
5085                                      struct list_head *victims)
5086 {
5087         struct nfs4_delegation *dp, *next;
5088         u64 count = 0;
5089
5090         lockdep_assert_held(&state_lock);
5091         list_for_each_entry_safe(dp, next, &clp->cl_delegations, dl_perclnt) {
5092                 if (victims) {
5093                         /*
5094                          * It's not safe to mess with delegations that have a
5095                          * non-zero dl_time. They might have already been broken
5096                          * and could be processed by the laundromat outside of
5097                          * the state_lock. Just leave them be.
5098                          */
5099                         if (dp->dl_time != 0)
5100                                 continue;
5101
5102                         /*
5103                          * Increment dl_time to ensure that delegation breaks
5104                          * don't monkey with it now that we are.
5105                          */
5106                         ++dp->dl_time;
5107                         list_move(&dp->dl_recall_lru, victims);
5108                 }
5109                 if (++count == max)
5110                         break;
5111         }
5112         return count;
5113 }
5114
5115 u64 nfsd_forget_client_delegations(struct nfs4_client *clp, u64 max)
5116 {
5117         struct nfs4_delegation *dp, *next;
5118         LIST_HEAD(victims);
5119         u64 count;
5120
5121         spin_lock(&state_lock);
5122         count = nfsd_find_all_delegations(clp, max, &victims);
5123         spin_unlock(&state_lock);
5124
5125         list_for_each_entry_safe(dp, next, &victims, dl_recall_lru)
5126                 revoke_delegation(dp);
5127
5128         return count;
5129 }
5130
5131 u64 nfsd_recall_client_delegations(struct nfs4_client *clp, u64 max)
5132 {
5133         struct nfs4_delegation *dp;
5134         LIST_HEAD(victims);
5135         u64 count;
5136
5137         spin_lock(&state_lock);
5138         count = nfsd_find_all_delegations(clp, max, &victims);
5139         while (!list_empty(&victims)) {
5140                 dp = list_first_entry(&victims, struct nfs4_delegation,
5141                                         dl_recall_lru);
5142                 list_del_init(&dp->dl_recall_lru);
5143                 dp->dl_time = 0;
5144                 nfsd_break_one_deleg(dp);
5145         }
5146         spin_unlock(&state_lock);
5147
5148         return count;
5149 }
5150
5151 u64 nfsd_print_client_delegations(struct nfs4_client *clp, u64 max)
5152 {
5153         u64 count = 0;
5154
5155         spin_lock(&state_lock);
5156         count = nfsd_find_all_delegations(clp, max, NULL);
5157         spin_unlock(&state_lock);
5158
5159         nfsd_print_count(clp, count, "delegations");
5160         return count;
5161 }
5162
5163 u64 nfsd_for_n_state(u64 max, u64 (*func)(struct nfs4_client *, u64))
5164 {
5165         struct nfs4_client *clp, *next;
5166         u64 count = 0;
5167         struct nfsd_net *nn = net_generic(current->nsproxy->net_ns, nfsd_net_id);
5168
5169         if (!nfsd_netns_ready(nn))
5170                 return 0;
5171
5172         list_for_each_entry_safe(clp, next, &nn->client_lru, cl_lru) {
5173                 count += func(clp, max - count);
5174                 if ((max != 0) && (count >= max))
5175                         break;
5176         }
5177
5178         return count;
5179 }
5180
5181 struct nfs4_client *nfsd_find_client(struct sockaddr_storage *addr, size_t addr_size)
5182 {
5183         struct nfs4_client *clp;
5184         struct nfsd_net *nn = net_generic(current->nsproxy->net_ns, nfsd_net_id);
5185
5186         if (!nfsd_netns_ready(nn))
5187                 return NULL;
5188
5189         list_for_each_entry(clp, &nn->client_lru, cl_lru) {
5190                 if (memcmp(&clp->cl_addr, addr, addr_size) == 0)
5191                         return clp;
5192         }
5193         return NULL;
5194 }
5195
5196 #endif /* CONFIG_NFSD_FAULT_INJECTION */
5197
5198 /*
5199  * Since the lifetime of a delegation isn't limited to that of an open, a
5200  * client may quite reasonably hang on to a delegation as long as it has
5201  * the inode cached.  This becomes an obvious problem the first time a
5202  * client's inode cache approaches the size of the server's total memory.
5203  *
5204  * For now we avoid this problem by imposing a hard limit on the number
5205  * of delegations, which varies according to the server's memory size.
5206  */
5207 static void
5208 set_max_delegations(void)
5209 {
5210         /*
5211          * Allow at most 4 delegations per megabyte of RAM.  Quick
5212          * estimates suggest that in the worst case (where every delegation
5213          * is for a different inode), a delegation could take about 1.5K,
5214          * giving a worst case usage of about 6% of memory.
5215          */
5216         max_delegations = nr_free_buffer_pages() >> (20 - 2 - PAGE_SHIFT);
5217 }
5218
5219 static int nfs4_state_create_net(struct net *net)
5220 {
5221         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
5222         int i;
5223
5224         nn->conf_id_hashtbl = kmalloc(sizeof(struct list_head) *
5225                         CLIENT_HASH_SIZE, GFP_KERNEL);
5226         if (!nn->conf_id_hashtbl)
5227                 goto err;
5228         nn->unconf_id_hashtbl = kmalloc(sizeof(struct list_head) *
5229                         CLIENT_HASH_SIZE, GFP_KERNEL);
5230         if (!nn->unconf_id_hashtbl)
5231                 goto err_unconf_id;
5232         nn->ownerstr_hashtbl = kmalloc(sizeof(struct list_head) *
5233                         OWNER_HASH_SIZE, GFP_KERNEL);
5234         if (!nn->ownerstr_hashtbl)
5235                 goto err_ownerstr;
5236         nn->sessionid_hashtbl = kmalloc(sizeof(struct list_head) *
5237                         SESSION_HASH_SIZE, GFP_KERNEL);
5238         if (!nn->sessionid_hashtbl)
5239                 goto err_sessionid;
5240
5241         for (i = 0; i < CLIENT_HASH_SIZE; i++) {
5242                 INIT_LIST_HEAD(&nn->conf_id_hashtbl[i]);
5243                 INIT_LIST_HEAD(&nn->unconf_id_hashtbl[i]);
5244         }
5245         for (i = 0; i < OWNER_HASH_SIZE; i++)
5246                 INIT_LIST_HEAD(&nn->ownerstr_hashtbl[i]);
5247         for (i = 0; i < SESSION_HASH_SIZE; i++)
5248                 INIT_LIST_HEAD(&nn->sessionid_hashtbl[i]);
5249         nn->conf_name_tree = RB_ROOT;
5250         nn->unconf_name_tree = RB_ROOT;
5251         INIT_LIST_HEAD(&nn->client_lru);
5252         INIT_LIST_HEAD(&nn->close_lru);
5253         INIT_LIST_HEAD(&nn->del_recall_lru);
5254         spin_lock_init(&nn->client_lock);
5255
5256         INIT_DELAYED_WORK(&nn->laundromat_work, laundromat_main);
5257         get_net(net);
5258
5259         return 0;
5260
5261 err_sessionid:
5262         kfree(nn->ownerstr_hashtbl);
5263 err_ownerstr:
5264         kfree(nn->unconf_id_hashtbl);
5265 err_unconf_id:
5266         kfree(nn->conf_id_hashtbl);
5267 err:
5268         return -ENOMEM;
5269 }
5270
5271 static void
5272 nfs4_state_destroy_net(struct net *net)
5273 {
5274         int i;
5275         struct nfs4_client *clp = NULL;
5276         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
5277
5278         for (i = 0; i < CLIENT_HASH_SIZE; i++) {
5279                 while (!list_empty(&nn->conf_id_hashtbl[i])) {
5280                         clp = list_entry(nn->conf_id_hashtbl[i].next, struct nfs4_client, cl_idhash);
5281                         destroy_client(clp);
5282                 }
5283         }
5284
5285         for (i = 0; i < CLIENT_HASH_SIZE; i++) {
5286                 while (!list_empty(&nn->unconf_id_hashtbl[i])) {
5287                         clp = list_entry(nn->unconf_id_hashtbl[i].next, struct nfs4_client, cl_idhash);
5288                         destroy_client(clp);
5289                 }
5290         }
5291
5292         kfree(nn->sessionid_hashtbl);
5293         kfree(nn->ownerstr_hashtbl);
5294         kfree(nn->unconf_id_hashtbl);
5295         kfree(nn->conf_id_hashtbl);
5296         put_net(net);
5297 }
5298
5299 int
5300 nfs4_state_start_net(struct net *net)
5301 {
5302         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
5303         int ret;
5304
5305         ret = nfs4_state_create_net(net);
5306         if (ret)
5307                 return ret;
5308         nfsd4_client_tracking_init(net);
5309         nn->boot_time = get_seconds();
5310         locks_start_grace(net, &nn->nfsd4_manager);
5311         nn->grace_ended = false;
5312         printk(KERN_INFO "NFSD: starting %ld-second grace period (net %p)\n",
5313                nn->nfsd4_grace, net);
5314         queue_delayed_work(laundry_wq, &nn->laundromat_work, nn->nfsd4_grace * HZ);
5315         return 0;
5316 }
5317
5318 /* initialization to perform when the nfsd service is started: */
5319
5320 int
5321 nfs4_state_start(void)
5322 {
5323         int ret;
5324
5325         ret = set_callback_cred();
5326         if (ret)
5327                 return -ENOMEM;
5328         laundry_wq = create_singlethread_workqueue("nfsd4");
5329         if (laundry_wq == NULL) {
5330                 ret = -ENOMEM;
5331                 goto out_recovery;
5332         }
5333         ret = nfsd4_create_callback_queue();
5334         if (ret)
5335                 goto out_free_laundry;
5336
5337         set_max_delegations();
5338
5339         return 0;
5340
5341 out_free_laundry:
5342         destroy_workqueue(laundry_wq);
5343 out_recovery:
5344         return ret;
5345 }
5346
5347 void
5348 nfs4_state_shutdown_net(struct net *net)
5349 {
5350         struct nfs4_delegation *dp = NULL;
5351         struct list_head *pos, *next, reaplist;
5352         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
5353
5354         cancel_delayed_work_sync(&nn->laundromat_work);
5355         locks_end_grace(&nn->nfsd4_manager);
5356
5357         nfs4_lock_state();
5358         INIT_LIST_HEAD(&reaplist);
5359         spin_lock(&state_lock);
5360         list_for_each_safe(pos, next, &nn->del_recall_lru) {
5361                 dp = list_entry (pos, struct nfs4_delegation, dl_recall_lru);
5362                 list_move(&dp->dl_recall_lru, &reaplist);
5363         }
5364         spin_unlock(&state_lock);
5365         list_for_each_safe(pos, next, &reaplist) {
5366                 dp = list_entry (pos, struct nfs4_delegation, dl_recall_lru);
5367                 destroy_delegation(dp);
5368         }
5369
5370         nfsd4_client_tracking_exit(net);
5371         nfs4_state_destroy_net(net);
5372         nfs4_unlock_state();
5373 }
5374
5375 void
5376 nfs4_state_shutdown(void)
5377 {
5378         destroy_workqueue(laundry_wq);
5379         nfsd4_destroy_callback_queue();
5380 }
5381
5382 static void
5383 get_stateid(struct nfsd4_compound_state *cstate, stateid_t *stateid)
5384 {
5385         if (HAS_STATE_ID(cstate, CURRENT_STATE_ID_FLAG) && CURRENT_STATEID(stateid))
5386                 memcpy(stateid, &cstate->current_stateid, sizeof(stateid_t));
5387 }
5388
5389 static void
5390 put_stateid(struct nfsd4_compound_state *cstate, stateid_t *stateid)
5391 {
5392         if (cstate->minorversion) {
5393                 memcpy(&cstate->current_stateid, stateid, sizeof(stateid_t));
5394                 SET_STATE_ID(cstate, CURRENT_STATE_ID_FLAG);
5395         }
5396 }
5397
5398 void
5399 clear_current_stateid(struct nfsd4_compound_state *cstate)
5400 {
5401         CLEAR_STATE_ID(cstate, CURRENT_STATE_ID_FLAG);
5402 }
5403
5404 /*
5405  * functions to set current state id
5406  */
5407 void
5408 nfsd4_set_opendowngradestateid(struct nfsd4_compound_state *cstate, struct nfsd4_open_downgrade *odp)
5409 {
5410         put_stateid(cstate, &odp->od_stateid);
5411 }
5412
5413 void
5414 nfsd4_set_openstateid(struct nfsd4_compound_state *cstate, struct nfsd4_open *open)
5415 {
5416         put_stateid(cstate, &open->op_stateid);
5417 }
5418
5419 void
5420 nfsd4_set_closestateid(struct nfsd4_compound_state *cstate, struct nfsd4_close *close)
5421 {
5422         put_stateid(cstate, &close->cl_stateid);
5423 }
5424
5425 void
5426 nfsd4_set_lockstateid(struct nfsd4_compound_state *cstate, struct nfsd4_lock *lock)
5427 {
5428         put_stateid(cstate, &lock->lk_resp_stateid);
5429 }
5430
5431 /*
5432  * functions to consume current state id
5433  */
5434
5435 void
5436 nfsd4_get_opendowngradestateid(struct nfsd4_compound_state *cstate, struct nfsd4_open_downgrade *odp)
5437 {
5438         get_stateid(cstate, &odp->od_stateid);
5439 }
5440
5441 void
5442 nfsd4_get_delegreturnstateid(struct nfsd4_compound_state *cstate, struct nfsd4_delegreturn *drp)
5443 {
5444         get_stateid(cstate, &drp->dr_stateid);
5445 }
5446
5447 void
5448 nfsd4_get_freestateid(struct nfsd4_compound_state *cstate, struct nfsd4_free_stateid *fsp)
5449 {
5450         get_stateid(cstate, &fsp->fr_stateid);
5451 }
5452
5453 void
5454 nfsd4_get_setattrstateid(struct nfsd4_compound_state *cstate, struct nfsd4_setattr *setattr)
5455 {
5456         get_stateid(cstate, &setattr->sa_stateid);
5457 }
5458
5459 void
5460 nfsd4_get_closestateid(struct nfsd4_compound_state *cstate, struct nfsd4_close *close)
5461 {
5462         get_stateid(cstate, &close->cl_stateid);
5463 }
5464
5465 void
5466 nfsd4_get_lockustateid(struct nfsd4_compound_state *cstate, struct nfsd4_locku *locku)
5467 {
5468         get_stateid(cstate, &locku->lu_stateid);
5469 }
5470
5471 void
5472 nfsd4_get_readstateid(struct nfsd4_compound_state *cstate, struct nfsd4_read *read)
5473 {
5474         get_stateid(cstate, &read->rd_stateid);
5475 }
5476
5477 void
5478 nfsd4_get_writestateid(struct nfsd4_compound_state *cstate, struct nfsd4_write *write)
5479 {
5480         get_stateid(cstate, &write->wr_stateid);
5481 }