fs/nfsd/nfs4state.c

   1 /*
   2 *  Copyright (c) 2001 The Regents of the University of Michigan.
   3 *  All rights reserved.
   4 *
   5 *  Kendrick Smith <kmsmith@umich.edu>
   6 *  Andy Adamson <kandros@umich.edu>
   7 *
   8 *  Redistribution and use in source and binary forms, with or without
   9 *  modification, are permitted provided that the following conditions
  10 *  are met:
  11 *
  12 *  1. Redistributions of source code must retain the above copyright
  13 *     notice, this list of conditions and the following disclaimer.
  14 *  2. Redistributions in binary form must reproduce the above copyright
  15 *     notice, this list of conditions and the following disclaimer in the
  16 *     documentation and/or other materials provided with the distribution.
  17 *  3. Neither the name of the University nor the names of its
  18 *     contributors may be used to endorse or promote products derived
  19 *     from this software without specific prior written permission.
  20 *
  21 *  THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
  22 *  WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
  23 *  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
  24 *  DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
  25 *  FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  26 *  CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  27 *  SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
  28 *  BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
  29 *  LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
  30 *  NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
  31 *  SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  32 *
  33 */
  34
  35 #include <linux/file.h>
  36 #include <linux/fs.h>
  37 #include <linux/slab.h>
  38 #include <linux/namei.h>
  39 #include <linux/swap.h>
  40 #include <linux/pagemap.h>
  41 #include <linux/ratelimit.h>
  42 #include <linux/sunrpc/svcauth_gss.h>
  43 #include <linux/sunrpc/addr.h>
  44 #include <linux/jhash.h>
  45 #include "xdr4.h"
  46 #include "xdr4cb.h"
  47 #include "vfs.h"
  48 #include "current_stateid.h"
  49
  50 #include "netns.h"
  51 #include "pnfs.h"
  52
  53 #define NFSDDBG_FACILITY                NFSDDBG_PROC
  54
  55 #define all_ones {{~0,~0},~0}
  56 static const stateid_t one_stateid = {
  57         .si_generation = ~0,
  58         .si_opaque = all_ones,
  59 };
  60 static const stateid_t zero_stateid = {
  61         /* all fields zero */
  62 };
  63 static const stateid_t currentstateid = {
  64         .si_generation = 1,
  65 };
  66 static const stateid_t close_stateid = {
  67         .si_generation = 0xffffffffU,
  68 };
  69
  70 static u64 current_sessionid = 1;
  71
  72 #define ZERO_STATEID(stateid) (!memcmp((stateid), &zero_stateid, sizeof(stateid_t)))
  73 #define ONE_STATEID(stateid)  (!memcmp((stateid), &one_stateid, sizeof(stateid_t)))
  74 #define CURRENT_STATEID(stateid) (!memcmp((stateid), &currentstateid, sizeof(stateid_t)))
  75
  76 /* forward declarations */
  77 static bool check_for_locks(struct nfs4_file *fp, struct nfs4_lockowner *lowner);
  78 static void nfs4_free_ol_stateid(struct nfs4_stid *stid);
  79
  80 /* Locking: */
  81
  82 /*
  83  * Currently used for the del_recall_lru and file hash table.  In an
  84  * effort to decrease the scope of the client_mutex, this spinlock may
  85  * eventually cover more:
  86  */
  87 static DEFINE_SPINLOCK(state_lock);
  88
  89 enum nfsd4_st_mutex_lock_subclass {
  90         OPEN_STATEID_MUTEX = 0,
  91         LOCK_STATEID_MUTEX = 1,
  92 };
  93
  94 /*
  95  * A waitqueue for all in-progress 4.0 CLOSE operations that are waiting for
  96  * the refcount on the open stateid to drop.
  97  */
  98 static DECLARE_WAIT_QUEUE_HEAD(close_wq);
  99
 100 static struct kmem_cache *openowner_slab;
 101 static struct kmem_cache *lockowner_slab;
 102 static struct kmem_cache *file_slab;
 103 static struct kmem_cache *stateid_slab;
 104 static struct kmem_cache *deleg_slab;
 105 static struct kmem_cache *odstate_slab;
 106
 107 static void free_session(struct nfsd4_session *);
 108
 109 static const struct nfsd4_callback_ops nfsd4_cb_recall_ops;
 110 static const struct nfsd4_callback_ops nfsd4_cb_notify_lock_ops;
 111
 112 static bool is_session_dead(struct nfsd4_session *ses)
 113 {
 114         return ses->se_flags & NFS4_SESSION_DEAD;
 115 }
 116
 117 static __be32 mark_session_dead_locked(struct nfsd4_session *ses, int ref_held_by_me)
 118 {
 119         if (atomic_read(&ses->se_ref) > ref_held_by_me)
 120                 return nfserr_jukebox;
 121         ses->se_flags |= NFS4_SESSION_DEAD;
 122         return nfs_ok;
 123 }
 124
 125 static bool is_client_expired(struct nfs4_client *clp)
 126 {
 127         return clp->cl_time == 0;
 128 }
 129
 130 static __be32 get_client_locked(struct nfs4_client *clp)
 131 {
 132         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
 133
 134         lockdep_assert_held(&nn->client_lock);
 135
 136         if (is_client_expired(clp))
 137                 return nfserr_expired;
 138         atomic_inc(&clp->cl_refcount);
 139         return nfs_ok;
 140 }
 141
 142 /* must be called under the client_lock */
 143 static inline void
 144 renew_client_locked(struct nfs4_client *clp)
 145 {
 146         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
 147
 148         if (is_client_expired(clp)) {
 149                 WARN_ON(1);
 150                 printk("%s: client (clientid %08x/%08x) already expired\n",
 151                         __func__,
 152                         clp->cl_clientid.cl_boot,
 153                         clp->cl_clientid.cl_id);
 154                 return;
 155         }
 156
 157         dprintk("renewing client (clientid %08x/%08x)\n",
 158                         clp->cl_clientid.cl_boot,
 159                         clp->cl_clientid.cl_id);
 160         list_move_tail(&clp->cl_lru, &nn->client_lru);
 161         clp->cl_time = get_seconds();
 162 }
 163
 164 static void put_client_renew_locked(struct nfs4_client *clp)
 165 {
 166         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
 167
 168         lockdep_assert_held(&nn->client_lock);
 169
 170         if (!atomic_dec_and_test(&clp->cl_refcount))
 171                 return;
 172         if (!is_client_expired(clp))
 173                 renew_client_locked(clp);
 174 }
 175
 176 static void put_client_renew(struct nfs4_client *clp)
 177 {
 178         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
 179
 180         if (!atomic_dec_and_lock(&clp->cl_refcount, &nn->client_lock))
 181                 return;
 182         if (!is_client_expired(clp))
 183                 renew_client_locked(clp);
 184         spin_unlock(&nn->client_lock);
 185 }
 186
 187 static __be32 nfsd4_get_session_locked(struct nfsd4_session *ses)
 188 {
 189         __be32 status;
 190
 191         if (is_session_dead(ses))
 192                 return nfserr_badsession;
 193         status = get_client_locked(ses->se_client);
 194         if (status)
 195                 return status;
 196         atomic_inc(&ses->se_ref);
 197         return nfs_ok;
 198 }
 199
 200 static void nfsd4_put_session_locked(struct nfsd4_session *ses)
 201 {
 202         struct nfs4_client *clp = ses->se_client;
 203         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
 204
 205         lockdep_assert_held(&nn->client_lock);
 206
 207         if (atomic_dec_and_test(&ses->se_ref) && is_session_dead(ses))
 208                 free_session(ses);
 209         put_client_renew_locked(clp);
 210 }
 211
 212 static void nfsd4_put_session(struct nfsd4_session *ses)
 213 {
 214         struct nfs4_client *clp = ses->se_client;
 215         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
 216
 217         spin_lock(&nn->client_lock);
 218         nfsd4_put_session_locked(ses);
 219         spin_unlock(&nn->client_lock);
 220 }
 221
 222 static struct nfsd4_blocked_lock *
 223 find_blocked_lock(struct nfs4_lockowner *lo, struct knfsd_fh *fh,
 224                         struct nfsd_net *nn)
 225 {
 226         struct nfsd4_blocked_lock *cur, *found = NULL;
 227
 228         spin_lock(&nn->blocked_locks_lock);
 229         list_for_each_entry(cur, &lo->lo_blocked, nbl_list) {
 230                 if (fh_match(fh, &cur->nbl_fh)) {
 231                         list_del_init(&cur->nbl_list);
 232                         list_del_init(&cur->nbl_lru);
 233                         found = cur;
 234                         break;
 235                 }
 236         }
 237         spin_unlock(&nn->blocked_locks_lock);
 238         if (found)
 239                 posix_unblock_lock(&found->nbl_lock);
 240         return found;
 241 }
 242
 243 static struct nfsd4_blocked_lock *
 244 find_or_allocate_block(struct nfs4_lockowner *lo, struct knfsd_fh *fh,
 245                         struct nfsd_net *nn)
 246 {
 247         struct nfsd4_blocked_lock *nbl;
 248
 249         nbl = find_blocked_lock(lo, fh, nn);
 250         if (!nbl) {
 251                 nbl= kmalloc(sizeof(*nbl), GFP_KERNEL);
 252                 if (nbl) {
 253                         fh_copy_shallow(&nbl->nbl_fh, fh);
 254                         locks_init_lock(&nbl->nbl_lock);
 255                         nfsd4_init_cb(&nbl->nbl_cb, lo->lo_owner.so_client,
 256                                         &nfsd4_cb_notify_lock_ops,
 257                                         NFSPROC4_CLNT_CB_NOTIFY_LOCK);
 258                 }
 259         }
 260         return nbl;
 261 }
 262
 263 static void
 264 free_blocked_lock(struct nfsd4_blocked_lock *nbl)
 265 {
 266         locks_release_private(&nbl->nbl_lock);
 267         kfree(nbl);
 268 }
 269
 270 static int
 271 nfsd4_cb_notify_lock_done(struct nfsd4_callback *cb, struct rpc_task *task)
 272 {
 273         /*
 274          * Since this is just an optimization, we don't try very hard if it
 275          * turns out not to succeed. We'll requeue it on NFS4ERR_DELAY, and
 276          * just quit trying on anything else.
 277          */
 278         switch (task->tk_status) {
 279         case -NFS4ERR_DELAY:
 280                 rpc_delay(task, 1 * HZ);
 281                 return 0;
 282         default:
 283                 return 1;
 284         }
 285 }
 286
 287 static void
 288 nfsd4_cb_notify_lock_release(struct nfsd4_callback *cb)
 289 {
 290         struct nfsd4_blocked_lock       *nbl = container_of(cb,
 291                                                 struct nfsd4_blocked_lock, nbl_cb);
 292
 293         free_blocked_lock(nbl);
 294 }
 295
 296 static const struct nfsd4_callback_ops nfsd4_cb_notify_lock_ops = {
 297         .done           = nfsd4_cb_notify_lock_done,
 298         .release        = nfsd4_cb_notify_lock_release,
 299 };
 300
 301 static inline struct nfs4_stateowner *
 302 nfs4_get_stateowner(struct nfs4_stateowner *sop)
 303 {
 304         atomic_inc(&sop->so_count);
 305         return sop;
 306 }
 307
 308 static int
 309 same_owner_str(struct nfs4_stateowner *sop, struct xdr_netobj *owner)
 310 {
 311         return (sop->so_owner.len == owner->len) &&
 312                 0 == memcmp(sop->so_owner.data, owner->data, owner->len);
 313 }
 314
 315 static struct nfs4_openowner *
 316 find_openstateowner_str_locked(unsigned int hashval, struct nfsd4_open *open,
 317                         struct nfs4_client *clp)
 318 {
 319         struct nfs4_stateowner *so;
 320
 321         lockdep_assert_held(&clp->cl_lock);
 322
 323         list_for_each_entry(so, &clp->cl_ownerstr_hashtbl[hashval],
 324                             so_strhash) {
 325                 if (!so->so_is_open_owner)
 326                         continue;
 327                 if (same_owner_str(so, &open->op_owner))
 328                         return openowner(nfs4_get_stateowner(so));
 329         }
 330         return NULL;
 331 }
 332
 333 static struct nfs4_openowner *
 334 find_openstateowner_str(unsigned int hashval, struct nfsd4_open *open,
 335                         struct nfs4_client *clp)
 336 {
 337         struct nfs4_openowner *oo;
 338
 339         spin_lock(&clp->cl_lock);
 340         oo = find_openstateowner_str_locked(hashval, open, clp);
 341         spin_unlock(&clp->cl_lock);
 342         return oo;
 343 }
 344
 345 static inline u32
 346 opaque_hashval(const void *ptr, int nbytes)
 347 {
 348         unsigned char *cptr = (unsigned char *) ptr;
 349
 350         u32 x = 0;
 351         while (nbytes--) {
 352                 x *= 37;
 353                 x += *cptr++;
 354         }
 355         return x;
 356 }
 357
 358 static void nfsd4_free_file_rcu(struct rcu_head *rcu)
 359 {
 360         struct nfs4_file *fp = container_of(rcu, struct nfs4_file, fi_rcu);
 361
 362         kmem_cache_free(file_slab, fp);
 363 }
 364
 365 void
 366 put_nfs4_file(struct nfs4_file *fi)
 367 {
 368         might_lock(&state_lock);
 369
 370         if (refcount_dec_and_lock(&fi->fi_ref, &state_lock)) {
 371                 hlist_del_rcu(&fi->fi_hash);
 372                 spin_unlock(&state_lock);
 373                 WARN_ON_ONCE(!list_empty(&fi->fi_clnt_odstate));
 374                 WARN_ON_ONCE(!list_empty(&fi->fi_delegations));
 375                 call_rcu(&fi->fi_rcu, nfsd4_free_file_rcu);
 376         }
 377 }
 378
 379 static struct file *
 380 __nfs4_get_fd(struct nfs4_file *f, int oflag)
 381 {
 382         if (f->fi_fds[oflag])
 383                 return get_file(f->fi_fds[oflag]);
 384         return NULL;
 385 }
 386
 387 static struct file *
 388 find_writeable_file_locked(struct nfs4_file *f)
 389 {
 390         struct file *ret;
 391
 392         lockdep_assert_held(&f->fi_lock);
 393
 394         ret = __nfs4_get_fd(f, O_WRONLY);
 395         if (!ret)
 396                 ret = __nfs4_get_fd(f, O_RDWR);
 397         return ret;
 398 }
 399
 400 static struct file *
 401 find_writeable_file(struct nfs4_file *f)
 402 {
 403         struct file *ret;
 404
 405         spin_lock(&f->fi_lock);
 406         ret = find_writeable_file_locked(f);
 407         spin_unlock(&f->fi_lock);
 408
 409         return ret;
 410 }
 411
 412 static struct file *find_readable_file_locked(struct nfs4_file *f)
 413 {
 414         struct file *ret;
 415
 416         lockdep_assert_held(&f->fi_lock);
 417
 418         ret = __nfs4_get_fd(f, O_RDONLY);
 419         if (!ret)
 420                 ret = __nfs4_get_fd(f, O_RDWR);
 421         return ret;
 422 }
 423
 424 static struct file *
 425 find_readable_file(struct nfs4_file *f)
 426 {
 427         struct file *ret;
 428
 429         spin_lock(&f->fi_lock);
 430         ret = find_readable_file_locked(f);
 431         spin_unlock(&f->fi_lock);
 432
 433         return ret;
 434 }
 435
 436 struct file *
 437 find_any_file(struct nfs4_file *f)
 438 {
 439         struct file *ret;
 440
 441         spin_lock(&f->fi_lock);
 442         ret = __nfs4_get_fd(f, O_RDWR);
 443         if (!ret) {
 444                 ret = __nfs4_get_fd(f, O_WRONLY);
 445                 if (!ret)
 446                         ret = __nfs4_get_fd(f, O_RDONLY);
 447         }
 448         spin_unlock(&f->fi_lock);
 449         return ret;
 450 }
 451
 452 static atomic_long_t num_delegations;
 453 unsigned long max_delegations;
 454
 455 /*
 456  * Open owner state (share locks)
 457  */
 458
 459 /* hash tables for lock and open owners */
 460 #define OWNER_HASH_BITS              8
 461 #define OWNER_HASH_SIZE             (1 << OWNER_HASH_BITS)
 462 #define OWNER_HASH_MASK             (OWNER_HASH_SIZE - 1)
 463
 464 static unsigned int ownerstr_hashval(struct xdr_netobj *ownername)
 465 {
 466         unsigned int ret;
 467
 468         ret = opaque_hashval(ownername->data, ownername->len);
 469         return ret & OWNER_HASH_MASK;
 470 }
 471
 472 /* hash table for nfs4_file */
 473 #define FILE_HASH_BITS                   8
 474 #define FILE_HASH_SIZE                  (1 << FILE_HASH_BITS)
 475
 476 static unsigned int nfsd_fh_hashval(struct knfsd_fh *fh)
 477 {
 478         return jhash2(fh->fh_base.fh_pad, XDR_QUADLEN(fh->fh_size), 0);
 479 }
 480
 481 static unsigned int file_hashval(struct knfsd_fh *fh)
 482 {
 483         return nfsd_fh_hashval(fh) & (FILE_HASH_SIZE - 1);
 484 }
 485
 486 static struct hlist_head file_hashtbl[FILE_HASH_SIZE];
 487
 488 static void
 489 __nfs4_file_get_access(struct nfs4_file *fp, u32 access)
 490 {
 491         lockdep_assert_held(&fp->fi_lock);
 492
 493         if (access & NFS4_SHARE_ACCESS_WRITE)
 494                 atomic_inc(&fp->fi_access[O_WRONLY]);
 495         if (access & NFS4_SHARE_ACCESS_READ)
 496                 atomic_inc(&fp->fi_access[O_RDONLY]);
 497 }
 498
 499 static __be32
 500 nfs4_file_get_access(struct nfs4_file *fp, u32 access)
 501 {
 502         lockdep_assert_held(&fp->fi_lock);
 503
 504         /* Does this access mode make sense? */
 505         if (access & ~NFS4_SHARE_ACCESS_BOTH)
 506                 return nfserr_inval;
 507
 508         /* Does it conflict with a deny mode already set? */
 509         if ((access & fp->fi_share_deny) != 0)
 510                 return nfserr_share_denied;
 511
 512         __nfs4_file_get_access(fp, access);
 513         return nfs_ok;
 514 }
 515
 516 static __be32 nfs4_file_check_deny(struct nfs4_file *fp, u32 deny)
 517 {
 518         /* Common case is that there is no deny mode. */
 519         if (deny) {
 520                 /* Does this deny mode make sense? */
 521                 if (deny & ~NFS4_SHARE_DENY_BOTH)
 522                         return nfserr_inval;
 523
 524                 if ((deny & NFS4_SHARE_DENY_READ) &&
 525                     atomic_read(&fp->fi_access[O_RDONLY]))
 526                         return nfserr_share_denied;
 527
 528                 if ((deny & NFS4_SHARE_DENY_WRITE) &&
 529                     atomic_read(&fp->fi_access[O_WRONLY]))
 530                         return nfserr_share_denied;
 531         }
 532         return nfs_ok;
 533 }
 534
 535 static void __nfs4_file_put_access(struct nfs4_file *fp, int oflag)
 536 {
 537         might_lock(&fp->fi_lock);
 538
 539         if (atomic_dec_and_lock(&fp->fi_access[oflag], &fp->fi_lock)) {
 540                 struct file *f1 = NULL;
 541                 struct file *f2 = NULL;
 542
 543                 swap(f1, fp->fi_fds[oflag]);
 544                 if (atomic_read(&fp->fi_access[1 - oflag]) == 0)
 545                         swap(f2, fp->fi_fds[O_RDWR]);
 546                 spin_unlock(&fp->fi_lock);
 547                 if (f1)
 548                         fput(f1);
 549                 if (f2)
 550                         fput(f2);
 551         }
 552 }
 553
 554 static void nfs4_file_put_access(struct nfs4_file *fp, u32 access)
 555 {
 556         WARN_ON_ONCE(access & ~NFS4_SHARE_ACCESS_BOTH);
 557
 558         if (access & NFS4_SHARE_ACCESS_WRITE)
 559                 __nfs4_file_put_access(fp, O_WRONLY);
 560         if (access & NFS4_SHARE_ACCESS_READ)
 561                 __nfs4_file_put_access(fp, O_RDONLY);
 562 }
 563
 564 /*
 565  * Allocate a new open/delegation state counter. This is needed for
 566  * pNFS for proper return on close semantics.
 567  *
 568  * Note that we only allocate it for pNFS-enabled exports, otherwise
 569  * all pointers to struct nfs4_clnt_odstate are always NULL.
 570  */
 571 static struct nfs4_clnt_odstate *
 572 alloc_clnt_odstate(struct nfs4_client *clp)
 573 {
 574         struct nfs4_clnt_odstate *co;
 575
 576         co = kmem_cache_zalloc(odstate_slab, GFP_KERNEL);
 577         if (co) {
 578                 co->co_client = clp;
 579                 refcount_set(&co->co_odcount, 1);
 580         }
 581         return co;
 582 }
 583
 584 static void
 585 hash_clnt_odstate_locked(struct nfs4_clnt_odstate *co)
 586 {
 587         struct nfs4_file *fp = co->co_file;
 588
 589         lockdep_assert_held(&fp->fi_lock);
 590         list_add(&co->co_perfile, &fp->fi_clnt_odstate);
 591 }
 592
 593 static inline void
 594 get_clnt_odstate(struct nfs4_clnt_odstate *co)
 595 {
 596         if (co)
 597                 refcount_inc(&co->co_odcount);
 598 }
 599
 600 static void
 601 put_clnt_odstate(struct nfs4_clnt_odstate *co)
 602 {
 603         struct nfs4_file *fp;
 604
 605         if (!co)
 606                 return;
 607
 608         fp = co->co_file;
 609         if (refcount_dec_and_lock(&co->co_odcount, &fp->fi_lock)) {
 610                 list_del(&co->co_perfile);
 611                 spin_unlock(&fp->fi_lock);
 612
 613                 nfsd4_return_all_file_layouts(co->co_client, fp);
 614                 kmem_cache_free(odstate_slab, co);
 615         }
 616 }
 617
 618 static struct nfs4_clnt_odstate *
 619 find_or_hash_clnt_odstate(struct nfs4_file *fp, struct nfs4_clnt_odstate *new)
 620 {
 621         struct nfs4_clnt_odstate *co;
 622         struct nfs4_client *cl;
 623
 624         if (!new)
 625                 return NULL;
 626
 627         cl = new->co_client;
 628
 629         spin_lock(&fp->fi_lock);
 630         list_for_each_entry(co, &fp->fi_clnt_odstate, co_perfile) {
 631                 if (co->co_client == cl) {
 632                         get_clnt_odstate(co);
 633                         goto out;
 634                 }
 635         }
 636         co = new;
 637         co->co_file = fp;
 638         hash_clnt_odstate_locked(new);
 639 out:
 640         spin_unlock(&fp->fi_lock);
 641         return co;
 642 }
 643
 644 struct nfs4_stid *nfs4_alloc_stid(struct nfs4_client *cl, struct kmem_cache *slab,
 645                                   void (*sc_free)(struct nfs4_stid *))
 646 {
 647         struct nfs4_stid *stid;
 648         int new_id;
 649
 650         stid = kmem_cache_zalloc(slab, GFP_KERNEL);
 651         if (!stid)
 652                 return NULL;
 653
 654         idr_preload(GFP_KERNEL);
 655         spin_lock(&cl->cl_lock);
 656         new_id = idr_alloc_cyclic(&cl->cl_stateids, stid, 0, 0, GFP_NOWAIT);
 657         spin_unlock(&cl->cl_lock);
 658         idr_preload_end();
 659         if (new_id < 0)
 660                 goto out_free;
 661
 662         stid->sc_free = sc_free;
 663         stid->sc_client = cl;
 664         stid->sc_stateid.si_opaque.so_id = new_id;
 665         stid->sc_stateid.si_opaque.so_clid = cl->cl_clientid;
 666         /* Will be incremented before return to client: */
 667         refcount_set(&stid->sc_count, 1);
 668         spin_lock_init(&stid->sc_lock);
 669
 670         /*
 671          * It shouldn't be a problem to reuse an opaque stateid value.
 672          * I don't think it is for 4.1.  But with 4.0 I worry that, for
 673          * example, a stray write retransmission could be accepted by
 674          * the server when it should have been rejected.  Therefore,
 675          * adopt a trick from the sctp code to attempt to maximize the
 676          * amount of time until an id is reused, by ensuring they always
 677          * "increase" (mod INT_MAX):
 678          */
 679         return stid;
 680 out_free:
 681         kmem_cache_free(slab, stid);
 682         return NULL;
 683 }
 684
 685 static struct nfs4_ol_stateid * nfs4_alloc_open_stateid(struct nfs4_client *clp)
 686 {
 687         struct nfs4_stid *stid;
 688
 689         stid = nfs4_alloc_stid(clp, stateid_slab, nfs4_free_ol_stateid);
 690         if (!stid)
 691                 return NULL;
 692
 693         return openlockstateid(stid);
 694 }
 695
 696 static void nfs4_free_deleg(struct nfs4_stid *stid)
 697 {
 698         kmem_cache_free(deleg_slab, stid);
 699         atomic_long_dec(&num_delegations);
 700 }
 701
 702 /*
 703  * When we recall a delegation, we should be careful not to hand it
 704  * out again straight away.
 705  * To ensure this we keep a pair of bloom filters ('new' and 'old')
 706  * in which the filehandles of recalled delegations are "stored".
 707  * If a filehandle appear in either filter, a delegation is blocked.
 708  * When a delegation is recalled, the filehandle is stored in the "new"
 709  * filter.
 710  * Every 30 seconds we swap the filters and clear the "new" one,
 711  * unless both are empty of course.
 712  *
 713  * Each filter is 256 bits.  We hash the filehandle to 32bit and use the
 714  * low 3 bytes as hash-table indices.
 715  *
 716  * 'blocked_delegations_lock', which is always taken in block_delegations(),
 717  * is used to manage concurrent access.  Testing does not need the lock
 718  * except when swapping the two filters.
 719  */
 720 static DEFINE_SPINLOCK(blocked_delegations_lock);
 721 static struct bloom_pair {
 722         int     entries, old_entries;
 723         time_t  swap_time;
 724         int     new; /* index into 'set' */
 725         DECLARE_BITMAP(set[2], 256);
 726 } blocked_delegations;
 727
 728 static int delegation_blocked(struct knfsd_fh *fh)
 729 {
 730         u32 hash;
 731         struct bloom_pair *bd = &blocked_delegations;
 732
 733         if (bd->entries == 0)
 734                 return 0;
 735         if (seconds_since_boot() - bd->swap_time > 30) {
 736                 spin_lock(&blocked_delegations_lock);
 737                 if (seconds_since_boot() - bd->swap_time > 30) {
 738                         bd->entries -= bd->old_entries;
 739                         bd->old_entries = bd->entries;
 740                         memset(bd->set[bd->new], 0,
 741                                sizeof(bd->set[0]));
 742                         bd->new = 1-bd->new;
 743                         bd->swap_time = seconds_since_boot();
 744                 }
 745                 spin_unlock(&blocked_delegations_lock);
 746         }
 747         hash = jhash(&fh->fh_base, fh->fh_size, 0);
 748         if (test_bit(hash&255, bd->set[0]) &&
 749             test_bit((hash>>8)&255, bd->set[0]) &&
 750             test_bit((hash>>16)&255, bd->set[0]))
 751                 return 1;
 752
 753         if (test_bit(hash&255, bd->set[1]) &&
 754             test_bit((hash>>8)&255, bd->set[1]) &&
 755             test_bit((hash>>16)&255, bd->set[1]))
 756                 return 1;
 757
 758         return 0;
 759 }
 760
 761 static void block_delegations(struct knfsd_fh *fh)
 762 {
 763         u32 hash;
 764         struct bloom_pair *bd = &blocked_delegations;
 765
 766         hash = jhash(&fh->fh_base, fh->fh_size, 0);
 767
 768         spin_lock(&blocked_delegations_lock);
 769         __set_bit(hash&255, bd->set[bd->new]);
 770         __set_bit((hash>>8)&255, bd->set[bd->new]);
 771         __set_bit((hash>>16)&255, bd->set[bd->new]);
 772         if (bd->entries == 0)
 773                 bd->swap_time = seconds_since_boot();
 774         bd->entries += 1;
 775         spin_unlock(&blocked_delegations_lock);
 776 }
 777
 778 static struct nfs4_delegation *
 779 alloc_init_deleg(struct nfs4_client *clp, struct svc_fh *current_fh,
 780                  struct nfs4_clnt_odstate *odstate)
 781 {
 782         struct nfs4_delegation *dp;
 783         long n;
 784
 785         dprintk("NFSD alloc_init_deleg\n");
 786         n = atomic_long_inc_return(&num_delegations);
 787         if (n < 0 || n > max_delegations)
 788                 goto out_dec;
 789         if (delegation_blocked(&current_fh->fh_handle))
 790                 goto out_dec;
 791         dp = delegstateid(nfs4_alloc_stid(clp, deleg_slab, nfs4_free_deleg));
 792         if (dp == NULL)
 793                 goto out_dec;
 794
 795         /*
 796          * delegation seqid's are never incremented.  The 4.1 special
 797          * meaning of seqid 0 isn't meaningful, really, but let's avoid
 798          * 0 anyway just for consistency and use 1:
 799          */
 800         dp->dl_stid.sc_stateid.si_generation = 1;
 801         INIT_LIST_HEAD(&dp->dl_perfile);
 802         INIT_LIST_HEAD(&dp->dl_perclnt);
 803         INIT_LIST_HEAD(&dp->dl_recall_lru);
 804         dp->dl_clnt_odstate = odstate;
 805         get_clnt_odstate(odstate);
 806         dp->dl_type = NFS4_OPEN_DELEGATE_READ;
 807         dp->dl_retries = 1;
 808         nfsd4_init_cb(&dp->dl_recall, dp->dl_stid.sc_client,
 809                       &nfsd4_cb_recall_ops, NFSPROC4_CLNT_CB_RECALL);
 810         return dp;
 811 out_dec:
 812         atomic_long_dec(&num_delegations);
 813         return NULL;
 814 }
 815
 816 void
 817 nfs4_put_stid(struct nfs4_stid *s)
 818 {
 819         struct nfs4_file *fp = s->sc_file;
 820         struct nfs4_client *clp = s->sc_client;
 821
 822         might_lock(&clp->cl_lock);
 823
 824         if (!refcount_dec_and_lock(&s->sc_count, &clp->cl_lock)) {
 825                 wake_up_all(&close_wq);
 826                 return;
 827         }
 828         idr_remove(&clp->cl_stateids, s->sc_stateid.si_opaque.so_id);
 829         spin_unlock(&clp->cl_lock);
 830         s->sc_free(s);
 831         if (fp)
 832                 put_nfs4_file(fp);
 833 }
 834
 835 void
 836 nfs4_inc_and_copy_stateid(stateid_t *dst, struct nfs4_stid *stid)
 837 {
 838         stateid_t *src = &stid->sc_stateid;
 839
 840         spin_lock(&stid->sc_lock);
 841         if (unlikely(++src->si_generation == 0))
 842                 src->si_generation = 1;
 843         memcpy(dst, src, sizeof(*dst));
 844         spin_unlock(&stid->sc_lock);
 845 }
 846
 847 static void nfs4_put_deleg_lease(struct nfs4_file *fp)
 848 {
 849         struct file *filp = NULL;
 850
 851         spin_lock(&fp->fi_lock);
 852         if (fp->fi_deleg_file && --fp->fi_delegees == 0)
 853                 swap(filp, fp->fi_deleg_file);
 854         spin_unlock(&fp->fi_lock);
 855
 856         if (filp) {
 857                 vfs_setlease(filp, F_UNLCK, NULL, (void **)&fp);
 858                 fput(filp);
 859         }
 860 }
 861
 862 void nfs4_unhash_stid(struct nfs4_stid *s)
 863 {
 864         s->sc_type = 0;
 865 }
 866
 867 /**
 868  * nfs4_get_existing_delegation - Discover if this delegation already exists
 869  * @clp:     a pointer to the nfs4_client we're granting a delegation to
 870  * @fp:      a pointer to the nfs4_file we're granting a delegation on
 871  *
 872  * Return:
 873  *      On success: NULL if an existing delegation was not found.
 874  *
 875  *      On error: -EAGAIN if one was previously granted to this nfs4_client
 876  *                 for this nfs4_file.
 877  *
 878  */
 879
 880 static int
 881 nfs4_get_existing_delegation(struct nfs4_client *clp, struct nfs4_file *fp)
 882 {
 883         struct nfs4_delegation *searchdp = NULL;
 884         struct nfs4_client *searchclp = NULL;
 885
 886         lockdep_assert_held(&state_lock);
 887         lockdep_assert_held(&fp->fi_lock);
 888
 889         list_for_each_entry(searchdp, &fp->fi_delegations, dl_perfile) {
 890                 searchclp = searchdp->dl_stid.sc_client;
 891                 if (clp == searchclp) {
 892                         return -EAGAIN;
 893                 }
 894         }
 895         return 0;
 896 }
 897
 898 /**
 899  * hash_delegation_locked - Add a delegation to the appropriate lists
 900  * @dp:     a pointer to the nfs4_delegation we are adding.
 901  * @fp:     a pointer to the nfs4_file we're granting a delegation on
 902  *
 903  * Return:
 904  *      On success: NULL if the delegation was successfully hashed.
 905  *
 906  *      On error: -EAGAIN if one was previously granted to this
 907  *                 nfs4_client for this nfs4_file. Delegation is not hashed.
 908  *
 909  */
 910
 911 static int
 912 hash_delegation_locked(struct nfs4_delegation *dp, struct nfs4_file *fp)
 913 {
 914         int status;
 915         struct nfs4_client *clp = dp->dl_stid.sc_client;
 916
 917         lockdep_assert_held(&state_lock);
 918         lockdep_assert_held(&fp->fi_lock);
 919
 920         status = nfs4_get_existing_delegation(clp, fp);
 921         if (status)
 922                 return status;
 923         ++fp->fi_delegees;
 924         refcount_inc(&dp->dl_stid.sc_count);
 925         dp->dl_stid.sc_type = NFS4_DELEG_STID;
 926         list_add(&dp->dl_perfile, &fp->fi_delegations);
 927         list_add(&dp->dl_perclnt, &clp->cl_delegations);
 928         return 0;
 929 }
 930
 931 static bool
 932 unhash_delegation_locked(struct nfs4_delegation *dp)
 933 {
 934         struct nfs4_file *fp = dp->dl_stid.sc_file;
 935
 936         lockdep_assert_held(&state_lock);
 937
 938         if (list_empty(&dp->dl_perfile))
 939                 return false;
 940
 941         dp->dl_stid.sc_type = NFS4_CLOSED_DELEG_STID;
 942         /* Ensure that deleg break won't try to requeue it */
 943         ++dp->dl_time;
 944         spin_lock(&fp->fi_lock);
 945         list_del_init(&dp->dl_perclnt);
 946         list_del_init(&dp->dl_recall_lru);
 947         list_del_init(&dp->dl_perfile);
 948         spin_unlock(&fp->fi_lock);
 949         return true;
 950 }
 951
 952 static void destroy_delegation(struct nfs4_delegation *dp)
 953 {
 954         bool unhashed;
 955
 956         spin_lock(&state_lock);
 957         unhashed = unhash_delegation_locked(dp);
 958         spin_unlock(&state_lock);
 959         if (unhashed) {
 960                 put_clnt_odstate(dp->dl_clnt_odstate);
 961                 nfs4_put_deleg_lease(dp->dl_stid.sc_file);
 962                 nfs4_put_stid(&dp->dl_stid);
 963         }
 964 }
 965
 966 static void revoke_delegation(struct nfs4_delegation *dp)
 967 {
 968         struct nfs4_client *clp = dp->dl_stid.sc_client;
 969
 970         WARN_ON(!list_empty(&dp->dl_recall_lru));
 971
 972         put_clnt_odstate(dp->dl_clnt_odstate);
 973         nfs4_put_deleg_lease(dp->dl_stid.sc_file);
 974
 975         if (clp->cl_minorversion == 0)
 976                 nfs4_put_stid(&dp->dl_stid);
 977         else {
 978                 dp->dl_stid.sc_type = NFS4_REVOKED_DELEG_STID;
 979                 spin_lock(&clp->cl_lock);
 980                 list_add(&dp->dl_recall_lru, &clp->cl_revoked);
 981                 spin_unlock(&clp->cl_lock);
 982         }
 983 }
 984
 985 /*
 986  * SETCLIENTID state
 987  */
 988
 989 static unsigned int clientid_hashval(u32 id)
 990 {
 991         return id & CLIENT_HASH_MASK;
 992 }
 993
 994 static unsigned int clientstr_hashval(const char *name)
 995 {
 996         return opaque_hashval(name, 8) & CLIENT_HASH_MASK;
 997 }
 998
 999 /*
1000  * We store the NONE, READ, WRITE, and BOTH bits separately in the
1001  * st_{access,deny}_bmap field of the stateid, in order to track not
1002  * only what share bits are currently in force, but also what
1003  * combinations of share bits previous opens have used.  This allows us
1004  * to enforce the recommendation of rfc 3530 14.2.19 that the server
1005  * return an error if the client attempt to downgrade to a combination
1006  * of share bits not explicable by closing some of its previous opens.
1007  *
1008  * XXX: This enforcement is actually incomplete, since we don't keep
1009  * track of access/deny bit combinations; so, e.g., we allow:
1010  *
1011  *      OPEN allow read, deny write
1012  *      OPEN allow both, deny none
1013  *      DOWNGRADE allow read, deny none
1014  *
1015  * which we should reject.
1016  */
1017 static unsigned int
1018 bmap_to_share_mode(unsigned long bmap) {
1019         int i;
1020         unsigned int access = 0;
1021
1022         for (i = 1; i < 4; i++) {
1023                 if (test_bit(i, &bmap))
1024                         access |= i;
1025         }
1026         return access;
1027 }
1028
1029 /* set share access for a given stateid */
1030 static inline void
1031 set_access(u32 access, struct nfs4_ol_stateid *stp)
1032 {
1033         unsigned char mask = 1 << access;
1034
1035         WARN_ON_ONCE(access > NFS4_SHARE_ACCESS_BOTH);
1036         stp->st_access_bmap |= mask;
1037 }
1038
1039 /* clear share access for a given stateid */
1040 static inline void
1041 clear_access(u32 access, struct nfs4_ol_stateid *stp)
1042 {
1043         unsigned char mask = 1 << access;
1044
1045         WARN_ON_ONCE(access > NFS4_SHARE_ACCESS_BOTH);
1046         stp->st_access_bmap &= ~mask;
1047 }
1048
1049 /* test whether a given stateid has access */
1050 static inline bool
1051 test_access(u32 access, struct nfs4_ol_stateid *stp)
1052 {
1053         unsigned char mask = 1 << access;
1054
1055         return (bool)(stp->st_access_bmap & mask);
1056 }
1057
1058 /* set share deny for a given stateid */
1059 static inline void
1060 set_deny(u32 deny, struct nfs4_ol_stateid *stp)
1061 {
1062         unsigned char mask = 1 << deny;
1063
1064         WARN_ON_ONCE(deny > NFS4_SHARE_DENY_BOTH);
1065         stp->st_deny_bmap |= mask;
1066 }
1067
1068 /* clear share deny for a given stateid */
1069 static inline void
1070 clear_deny(u32 deny, struct nfs4_ol_stateid *stp)
1071 {
1072         unsigned char mask = 1 << deny;
1073
1074         WARN_ON_ONCE(deny > NFS4_SHARE_DENY_BOTH);
1075         stp->st_deny_bmap &= ~mask;
1076 }
1077
1078 /* test whether a given stateid is denying specific access */
1079 static inline bool
1080 test_deny(u32 deny, struct nfs4_ol_stateid *stp)
1081 {
1082         unsigned char mask = 1 << deny;
1083
1084         return (bool)(stp->st_deny_bmap & mask);
1085 }
1086
1087 static int nfs4_access_to_omode(u32 access)
1088 {
1089         switch (access & NFS4_SHARE_ACCESS_BOTH) {
1090         case NFS4_SHARE_ACCESS_READ:
1091                 return O_RDONLY;
1092         case NFS4_SHARE_ACCESS_WRITE:
1093                 return O_WRONLY;
1094         case NFS4_SHARE_ACCESS_BOTH:
1095                 return O_RDWR;
1096         }
1097         WARN_ON_ONCE(1);
1098         return O_RDONLY;
1099 }
1100
1101 /*
1102  * A stateid that had a deny mode associated with it is being released
1103  * or downgraded. Recalculate the deny mode on the file.
1104  */
1105 static void
1106 recalculate_deny_mode(struct nfs4_file *fp)
1107 {
1108         struct nfs4_ol_stateid *stp;
1109
1110         spin_lock(&fp->fi_lock);
1111         fp->fi_share_deny = 0;
1112         list_for_each_entry(stp, &fp->fi_stateids, st_perfile)
1113                 fp->fi_share_deny |= bmap_to_share_mode(stp->st_deny_bmap);
1114         spin_unlock(&fp->fi_lock);
1115 }
1116
1117 static void
1118 reset_union_bmap_deny(u32 deny, struct nfs4_ol_stateid *stp)
1119 {
1120         int i;
1121         bool change = false;
1122
1123         for (i = 1; i < 4; i++) {
1124                 if ((i & deny) != i) {
1125                         change = true;
1126                         clear_deny(i, stp);
1127                 }
1128         }
1129
1130         /* Recalculate per-file deny mode if there was a change */
1131         if (change)
1132                 recalculate_deny_mode(stp->st_stid.sc_file);
1133 }
1134
1135 /* release all access and file references for a given stateid */
1136 static void
1137 release_all_access(struct nfs4_ol_stateid *stp)
1138 {
1139         int i;
1140         struct nfs4_file *fp = stp->st_stid.sc_file;
1141
1142         if (fp && stp->st_deny_bmap != 0)
1143                 recalculate_deny_mode(fp);
1144
1145         for (i = 1; i < 4; i++) {
1146                 if (test_access(i, stp))
1147                         nfs4_file_put_access(stp->st_stid.sc_file, i);
1148                 clear_access(i, stp);
1149         }
1150 }
1151
1152 static inline void nfs4_free_stateowner(struct nfs4_stateowner *sop)
1153 {
1154         kfree(sop->so_owner.data);
1155         sop->so_ops->so_free(sop);
1156 }
1157
1158 static void nfs4_put_stateowner(struct nfs4_stateowner *sop)
1159 {
1160         struct nfs4_client *clp = sop->so_client;
1161
1162         might_lock(&clp->cl_lock);
1163
1164         if (!atomic_dec_and_lock(&sop->so_count, &clp->cl_lock))
1165                 return;
1166         sop->so_ops->so_unhash(sop);
1167         spin_unlock(&clp->cl_lock);
1168         nfs4_free_stateowner(sop);
1169 }
1170
1171 static bool unhash_ol_stateid(struct nfs4_ol_stateid *stp)
1172 {
1173         struct nfs4_file *fp = stp->st_stid.sc_file;
1174
1175         lockdep_assert_held(&stp->st_stateowner->so_client->cl_lock);
1176
1177         if (list_empty(&stp->st_perfile))
1178                 return false;
1179
1180         spin_lock(&fp->fi_lock);
1181         list_del_init(&stp->st_perfile);
1182         spin_unlock(&fp->fi_lock);
1183         list_del(&stp->st_perstateowner);
1184         return true;
1185 }
1186
1187 static void nfs4_free_ol_stateid(struct nfs4_stid *stid)
1188 {
1189         struct nfs4_ol_stateid *stp = openlockstateid(stid);
1190
1191         put_clnt_odstate(stp->st_clnt_odstate);
1192         release_all_access(stp);
1193         if (stp->st_stateowner)
1194                 nfs4_put_stateowner(stp->st_stateowner);
1195         kmem_cache_free(stateid_slab, stid);
1196 }
1197
1198 static void nfs4_free_lock_stateid(struct nfs4_stid *stid)
1199 {
1200         struct nfs4_ol_stateid *stp = openlockstateid(stid);
1201         struct nfs4_lockowner *lo = lockowner(stp->st_stateowner);
1202         struct file *file;
1203
1204         file = find_any_file(stp->st_stid.sc_file);
1205         if (file)
1206                 filp_close(file, (fl_owner_t)lo);
1207         nfs4_free_ol_stateid(stid);
1208 }
1209
1210 /*
1211  * Put the persistent reference to an already unhashed generic stateid, while
1212  * holding the cl_lock. If it's the last reference, then put it onto the
1213  * reaplist for later destruction.
1214  */
1215 static void put_ol_stateid_locked(struct nfs4_ol_stateid *stp,
1216                                        struct list_head *reaplist)
1217 {
1218         struct nfs4_stid *s = &stp->st_stid;
1219         struct nfs4_client *clp = s->sc_client;
1220
1221         lockdep_assert_held(&clp->cl_lock);
1222
1223         WARN_ON_ONCE(!list_empty(&stp->st_locks));
1224
1225         if (!refcount_dec_and_test(&s->sc_count)) {
1226                 wake_up_all(&close_wq);
1227                 return;
1228         }
1229
1230         idr_remove(&clp->cl_stateids, s->sc_stateid.si_opaque.so_id);
1231         list_add(&stp->st_locks, reaplist);
1232 }
1233
1234 static bool unhash_lock_stateid(struct nfs4_ol_stateid *stp)
1235 {
1236         lockdep_assert_held(&stp->st_stid.sc_client->cl_lock);
1237
1238         list_del_init(&stp->st_locks);
1239         nfs4_unhash_stid(&stp->st_stid);
1240         return unhash_ol_stateid(stp);
1241 }
1242
1243 static void release_lock_stateid(struct nfs4_ol_stateid *stp)
1244 {
1245         struct nfs4_client *clp = stp->st_stid.sc_client;
1246         bool unhashed;
1247
1248         spin_lock(&clp->cl_lock);
1249         unhashed = unhash_lock_stateid(stp);
1250         spin_unlock(&clp->cl_lock);
1251         if (unhashed)
1252                 nfs4_put_stid(&stp->st_stid);
1253 }
1254
1255 static void unhash_lockowner_locked(struct nfs4_lockowner *lo)
1256 {
1257         struct nfs4_client *clp = lo->lo_owner.so_client;
1258
1259         lockdep_assert_held(&clp->cl_lock);
1260
1261         list_del_init(&lo->lo_owner.so_strhash);
1262 }
1263
1264 /*
1265  * Free a list of generic stateids that were collected earlier after being
1266  * fully unhashed.
1267  */
1268 static void
1269 free_ol_stateid_reaplist(struct list_head *reaplist)
1270 {
1271         struct nfs4_ol_stateid *stp;
1272         struct nfs4_file *fp;
1273
1274         might_sleep();
1275
1276         while (!list_empty(reaplist)) {
1277                 stp = list_first_entry(reaplist, struct nfs4_ol_stateid,
1278                                        st_locks);
1279                 list_del(&stp->st_locks);
1280                 fp = stp->st_stid.sc_file;
1281                 stp->st_stid.sc_free(&stp->st_stid);
1282                 if (fp)
1283                         put_nfs4_file(fp);
1284         }
1285 }
1286
1287 static void release_open_stateid_locks(struct nfs4_ol_stateid *open_stp,
1288                                        struct list_head *reaplist)
1289 {
1290         struct nfs4_ol_stateid *stp;
1291
1292         lockdep_assert_held(&open_stp->st_stid.sc_client->cl_lock);
1293
1294         while (!list_empty(&open_stp->st_locks)) {
1295                 stp = list_entry(open_stp->st_locks.next,
1296                                 struct nfs4_ol_stateid, st_locks);
1297                 WARN_ON(!unhash_lock_stateid(stp));
1298                 put_ol_stateid_locked(stp, reaplist);
1299         }
1300 }
1301
1302 static bool unhash_open_stateid(struct nfs4_ol_stateid *stp,
1303                                 struct list_head *reaplist)
1304 {
1305         bool unhashed;
1306
1307         lockdep_assert_held(&stp->st_stid.sc_client->cl_lock);
1308
1309         unhashed = unhash_ol_stateid(stp);
1310         release_open_stateid_locks(stp, reaplist);
1311         return unhashed;
1312 }
1313
1314 static void release_open_stateid(struct nfs4_ol_stateid *stp)
1315 {
1316         LIST_HEAD(reaplist);
1317
1318         spin_lock(&stp->st_stid.sc_client->cl_lock);
1319         if (unhash_open_stateid(stp, &reaplist))
1320                 put_ol_stateid_locked(stp, &reaplist);
1321         spin_unlock(&stp->st_stid.sc_client->cl_lock);
1322         free_ol_stateid_reaplist(&reaplist);
1323 }
1324
1325 static void unhash_openowner_locked(struct nfs4_openowner *oo)
1326 {
1327         struct nfs4_client *clp = oo->oo_owner.so_client;
1328
1329         lockdep_assert_held(&clp->cl_lock);
1330
1331         list_del_init(&oo->oo_owner.so_strhash);
1332         list_del_init(&oo->oo_perclient);
1333 }
1334
1335 static void release_last_closed_stateid(struct nfs4_openowner *oo)
1336 {
1337         struct nfsd_net *nn = net_generic(oo->oo_owner.so_client->net,
1338                                           nfsd_net_id);
1339         struct nfs4_ol_stateid *s;
1340
1341         spin_lock(&nn->client_lock);
1342         s = oo->oo_last_closed_stid;
1343         if (s) {
1344                 list_del_init(&oo->oo_close_lru);
1345                 oo->oo_last_closed_stid = NULL;
1346         }
1347         spin_unlock(&nn->client_lock);
1348         if (s)
1349                 nfs4_put_stid(&s->st_stid);
1350 }
1351
1352 static void release_openowner(struct nfs4_openowner *oo)
1353 {
1354         struct nfs4_ol_stateid *stp;
1355         struct nfs4_client *clp = oo->oo_owner.so_client;
1356         struct list_head reaplist;
1357
1358         INIT_LIST_HEAD(&reaplist);
1359
1360         spin_lock(&clp->cl_lock);
1361         unhash_openowner_locked(oo);
1362         while (!list_empty(&oo->oo_owner.so_stateids)) {
1363                 stp = list_first_entry(&oo->oo_owner.so_stateids,
1364                                 struct nfs4_ol_stateid, st_perstateowner);
1365                 if (unhash_open_stateid(stp, &reaplist))
1366                         put_ol_stateid_locked(stp, &reaplist);
1367         }
1368         spin_unlock(&clp->cl_lock);
1369         free_ol_stateid_reaplist(&reaplist);
1370         release_last_closed_stateid(oo);
1371         nfs4_put_stateowner(&oo->oo_owner);
1372 }
1373
1374 static inline int
1375 hash_sessionid(struct nfs4_sessionid *sessionid)
1376 {
1377         struct nfsd4_sessionid *sid = (struct nfsd4_sessionid *)sessionid;
1378
1379         return sid->sequence % SESSION_HASH_SIZE;
1380 }
1381
1382 #ifdef CONFIG_SUNRPC_DEBUG
1383 static inline void
1384 dump_sessionid(const char *fn, struct nfs4_sessionid *sessionid)
1385 {
1386         u32 *ptr = (u32 *)(&sessionid->data[0]);
1387         dprintk("%s: %u:%u:%u:%u\n", fn, ptr[0], ptr[1], ptr[2], ptr[3]);
1388 }
1389 #else
1390 static inline void
1391 dump_sessionid(const char *fn, struct nfs4_sessionid *sessionid)
1392 {
1393 }
1394 #endif
1395
1396 /*
1397  * Bump the seqid on cstate->replay_owner, and clear replay_owner if it
1398  * won't be used for replay.
1399  */
1400 void nfsd4_bump_seqid(struct nfsd4_compound_state *cstate, __be32 nfserr)
1401 {
1402         struct nfs4_stateowner *so = cstate->replay_owner;
1403
1404         if (nfserr == nfserr_replay_me)
1405                 return;
1406
1407         if (!seqid_mutating_err(ntohl(nfserr))) {
1408                 nfsd4_cstate_clear_replay(cstate);
1409                 return;
1410         }
1411         if (!so)
1412                 return;
1413         if (so->so_is_open_owner)
1414                 release_last_closed_stateid(openowner(so));
1415         so->so_seqid++;
1416         return;
1417 }
1418
1419 static void
1420 gen_sessionid(struct nfsd4_session *ses)
1421 {
1422         struct nfs4_client *clp = ses->se_client;
1423         struct nfsd4_sessionid *sid;
1424
1425         sid = (struct nfsd4_sessionid *)ses->se_sessionid.data;
1426         sid->clientid = clp->cl_clientid;
1427         sid->sequence = current_sessionid++;
1428         sid->reserved = 0;
1429 }
1430
1431 /*
1432  * The protocol defines ca_maxresponssize_cached to include the size of
1433  * the rpc header, but all we need to cache is the data starting after
1434  * the end of the initial SEQUENCE operation--the rest we regenerate
1435  * each time.  Therefore we can advertise a ca_maxresponssize_cached
1436  * value that is the number of bytes in our cache plus a few additional
1437  * bytes.  In order to stay on the safe side, and not promise more than
1438  * we can cache, those additional bytes must be the minimum possible: 24
1439  * bytes of rpc header (xid through accept state, with AUTH_NULL
1440  * verifier), 12 for the compound header (with zero-length tag), and 44
1441  * for the SEQUENCE op response:
1442  */
1443 #define NFSD_MIN_HDR_SEQ_SZ  (24 + 12 + 44)
1444
1445 static void
1446 free_session_slots(struct nfsd4_session *ses)
1447 {
1448         int i;
1449
1450         for (i = 0; i < ses->se_fchannel.maxreqs; i++) {
1451                 free_svc_cred(&ses->se_slots[i]->sl_cred);
1452                 kfree(ses->se_slots[i]);
1453         }
1454 }
1455
1456 /*
1457  * We don't actually need to cache the rpc and session headers, so we
1458  * can allocate a little less for each slot:
1459  */
1460 static inline u32 slot_bytes(struct nfsd4_channel_attrs *ca)
1461 {
1462         u32 size;
1463
1464         if (ca->maxresp_cached < NFSD_MIN_HDR_SEQ_SZ)
1465                 size = 0;
1466         else
1467                 size = ca->maxresp_cached - NFSD_MIN_HDR_SEQ_SZ;
1468         return size + sizeof(struct nfsd4_slot);
1469 }
1470
1471 /*
1472  * XXX: If we run out of reserved DRC memory we could (up to a point)
1473  * re-negotiate active sessions and reduce their slot usage to make
1474  * room for new connections. For now we just fail the create session.
1475  */
1476 static u32 nfsd4_get_drc_mem(struct nfsd4_channel_attrs *ca)
1477 {
1478         u32 slotsize = slot_bytes(ca);
1479         u32 num = ca->maxreqs;
1480         int avail;
1481
1482         spin_lock(&nfsd_drc_lock);
1483         avail = min((unsigned long)NFSD_MAX_MEM_PER_SESSION,
1484                     nfsd_drc_max_mem - nfsd_drc_mem_used);
1485         /*
1486          * Never use more than a third of the remaining memory,
1487          * unless it's the only way to give this client a slot:
1488          */
1489         avail = clamp_t(int, avail, slotsize, avail/3);
1490         num = min_t(int, num, avail / slotsize);
1491         nfsd_drc_mem_used += num * slotsize;
1492         spin_unlock(&nfsd_drc_lock);
1493
1494         return num;
1495 }
1496
1497 static void nfsd4_put_drc_mem(struct nfsd4_channel_attrs *ca)
1498 {
1499         int slotsize = slot_bytes(ca);
1500
1501         spin_lock(&nfsd_drc_lock);
1502         nfsd_drc_mem_used -= slotsize * ca->maxreqs;
1503         spin_unlock(&nfsd_drc_lock);
1504 }
1505
1506 static struct nfsd4_session *alloc_session(struct nfsd4_channel_attrs *fattrs,
1507                                            struct nfsd4_channel_attrs *battrs)
1508 {
1509         int numslots = fattrs->maxreqs;
1510         int slotsize = slot_bytes(fattrs);
1511         struct nfsd4_session *new;
1512         int mem, i;
1513
1514         BUILD_BUG_ON(NFSD_MAX_SLOTS_PER_SESSION * sizeof(struct nfsd4_slot *)
1515                         + sizeof(struct nfsd4_session) > PAGE_SIZE);
1516         mem = numslots * sizeof(struct nfsd4_slot *);
1517
1518         new = kzalloc(sizeof(*new) + mem, GFP_KERNEL);
1519         if (!new)
1520                 return NULL;
1521         /* allocate each struct nfsd4_slot and data cache in one piece */
1522         for (i = 0; i < numslots; i++) {
1523                 new->se_slots[i] = kzalloc(slotsize, GFP_KERNEL);
1524                 if (!new->se_slots[i])
1525                         goto out_free;
1526         }
1527
1528         memcpy(&new->se_fchannel, fattrs, sizeof(struct nfsd4_channel_attrs));
1529         memcpy(&new->se_bchannel, battrs, sizeof(struct nfsd4_channel_attrs));
1530
1531         return new;
1532 out_free:
1533         while (i--)
1534                 kfree(new->se_slots[i]);
1535         kfree(new);
1536         return NULL;
1537 }
1538
1539 static void free_conn(struct nfsd4_conn *c)
1540 {
1541         svc_xprt_put(c->cn_xprt);
1542         kfree(c);
1543 }
1544
1545 static void nfsd4_conn_lost(struct svc_xpt_user *u)
1546 {
1547         struct nfsd4_conn *c = container_of(u, struct nfsd4_conn, cn_xpt_user);
1548         struct nfs4_client *clp = c->cn_session->se_client;
1549
1550         spin_lock(&clp->cl_lock);
1551         if (!list_empty(&c->cn_persession)) {
1552                 list_del(&c->cn_persession);
1553                 free_conn(c);
1554         }
1555         nfsd4_probe_callback(clp);
1556         spin_unlock(&clp->cl_lock);
1557 }
1558
1559 static struct nfsd4_conn *alloc_conn(struct svc_rqst *rqstp, u32 flags)
1560 {
1561         struct nfsd4_conn *conn;
1562
1563         conn = kmalloc(sizeof(struct nfsd4_conn), GFP_KERNEL);
1564         if (!conn)
1565                 return NULL;
1566         svc_xprt_get(rqstp->rq_xprt);
1567         conn->cn_xprt = rqstp->rq_xprt;
1568         conn->cn_flags = flags;
1569         INIT_LIST_HEAD(&conn->cn_xpt_user.list);
1570         return conn;
1571 }
1572
1573 static void __nfsd4_hash_conn(struct nfsd4_conn *conn, struct nfsd4_session *ses)
1574 {
1575         conn->cn_session = ses;
1576         list_add(&conn->cn_persession, &ses->se_conns);
1577 }
1578
1579 static void nfsd4_hash_conn(struct nfsd4_conn *conn, struct nfsd4_session *ses)
1580 {
1581         struct nfs4_client *clp = ses->se_client;
1582
1583         spin_lock(&clp->cl_lock);
1584         __nfsd4_hash_conn(conn, ses);
1585         spin_unlock(&clp->cl_lock);
1586 }
1587
1588 static int nfsd4_register_conn(struct nfsd4_conn *conn)
1589 {
1590         conn->cn_xpt_user.callback = nfsd4_conn_lost;
1591         return register_xpt_user(conn->cn_xprt, &conn->cn_xpt_user);
1592 }
1593
1594 static void nfsd4_init_conn(struct svc_rqst *rqstp, struct nfsd4_conn *conn, struct nfsd4_session *ses)
1595 {
1596         int ret;
1597
1598         nfsd4_hash_conn(conn, ses);
1599         ret = nfsd4_register_conn(conn);
1600         if (ret)
1601                 /* oops; xprt is already down: */
1602                 nfsd4_conn_lost(&conn->cn_xpt_user);
1603         /* We may have gained or lost a callback channel: */
1604         nfsd4_probe_callback_sync(ses->se_client);
1605 }
1606
1607 static struct nfsd4_conn *alloc_conn_from_crses(struct svc_rqst *rqstp, struct nfsd4_create_session *cses)
1608 {
1609         u32 dir = NFS4_CDFC4_FORE;
1610
1611         if (cses->flags & SESSION4_BACK_CHAN)
1612                 dir |= NFS4_CDFC4_BACK;
1613         return alloc_conn(rqstp, dir);
1614 }
1615
1616 /* must be called under client_lock */
1617 static void nfsd4_del_conns(struct nfsd4_session *s)
1618 {
1619         struct nfs4_client *clp = s->se_client;
1620         struct nfsd4_conn *c;
1621
1622         spin_lock(&clp->cl_lock);
1623         while (!list_empty(&s->se_conns)) {
1624                 c = list_first_entry(&s->se_conns, struct nfsd4_conn, cn_persession);
1625                 list_del_init(&c->cn_persession);
1626                 spin_unlock(&clp->cl_lock);
1627
1628                 unregister_xpt_user(c->cn_xprt, &c->cn_xpt_user);
1629                 free_conn(c);
1630
1631                 spin_lock(&clp->cl_lock);
1632         }
1633         spin_unlock(&clp->cl_lock);
1634 }
1635
1636 static void __free_session(struct nfsd4_session *ses)
1637 {
1638         free_session_slots(ses);
1639         kfree(ses);
1640 }
1641
1642 static void free_session(struct nfsd4_session *ses)
1643 {
1644         nfsd4_del_conns(ses);
1645         nfsd4_put_drc_mem(&ses->se_fchannel);
1646         __free_session(ses);
1647 }
1648
1649 static void init_session(struct svc_rqst *rqstp, struct nfsd4_session *new, struct nfs4_client *clp, struct nfsd4_create_session *cses)
1650 {
1651         int idx;
1652         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
1653
1654         new->se_client = clp;
1655         gen_sessionid(new);
1656
1657         INIT_LIST_HEAD(&new->se_conns);
1658
1659         new->se_cb_seq_nr = 1;
1660         new->se_flags = cses->flags;
1661         new->se_cb_prog = cses->callback_prog;
1662         new->se_cb_sec = cses->cb_sec;
1663         atomic_set(&new->se_ref, 0);
1664         idx = hash_sessionid(&new->se_sessionid);
1665         list_add(&new->se_hash, &nn->sessionid_hashtbl[idx]);
1666         spin_lock(&clp->cl_lock);
1667         list_add(&new->se_perclnt, &clp->cl_sessions);
1668         spin_unlock(&clp->cl_lock);
1669
1670         {
1671                 struct sockaddr *sa = svc_addr(rqstp);
1672                 /*
1673                  * This is a little silly; with sessions there's no real
1674                  * use for the callback address.  Use the peer address
1675                  * as a reasonable default for now, but consider fixing
1676                  * the rpc client not to require an address in the
1677                  * future:
1678                  */
1679                 rpc_copy_addr((struct sockaddr *)&clp->cl_cb_conn.cb_addr, sa);
1680                 clp->cl_cb_conn.cb_addrlen = svc_addr_len(sa);
1681         }
1682 }
1683
1684 /* caller must hold client_lock */
1685 static struct nfsd4_session *
1686 __find_in_sessionid_hashtbl(struct nfs4_sessionid *sessionid, struct net *net)
1687 {
1688         struct nfsd4_session *elem;
1689         int idx;
1690         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
1691
1692         lockdep_assert_held(&nn->client_lock);
1693
1694         dump_sessionid(__func__, sessionid);
1695         idx = hash_sessionid(sessionid);
1696         /* Search in the appropriate list */
1697         list_for_each_entry(elem, &nn->sessionid_hashtbl[idx], se_hash) {
1698                 if (!memcmp(elem->se_sessionid.data, sessionid->data,
1699                             NFS4_MAX_SESSIONID_LEN)) {
1700                         return elem;
1701                 }
1702         }
1703
1704         dprintk("%s: session not found\n", __func__);
1705         return NULL;
1706 }
1707
1708 static struct nfsd4_session *
1709 find_in_sessionid_hashtbl(struct nfs4_sessionid *sessionid, struct net *net,
1710                 __be32 *ret)
1711 {
1712         struct nfsd4_session *session;
1713         __be32 status = nfserr_badsession;
1714
1715         session = __find_in_sessionid_hashtbl(sessionid, net);
1716         if (!session)
1717                 goto out;
1718         status = nfsd4_get_session_locked(session);
1719         if (status)
1720                 session = NULL;
1721 out:
1722         *ret = status;
1723         return session;
1724 }
1725
1726 /* caller must hold client_lock */
1727 static void
1728 unhash_session(struct nfsd4_session *ses)
1729 {
1730         struct nfs4_client *clp = ses->se_client;
1731         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
1732
1733         lockdep_assert_held(&nn->client_lock);
1734
1735         list_del(&ses->se_hash);
1736         spin_lock(&ses->se_client->cl_lock);
1737         list_del(&ses->se_perclnt);
1738         spin_unlock(&ses->se_client->cl_lock);
1739 }
1740
1741 /* SETCLIENTID and SETCLIENTID_CONFIRM Helper functions */
1742 static int
1743 STALE_CLIENTID(clientid_t *clid, struct nfsd_net *nn)
1744 {
1745         /*
1746          * We're assuming the clid was not given out from a boot
1747          * precisely 2^32 (about 136 years) before this one.  That seems
1748          * a safe assumption:
1749          */
1750         if (clid->cl_boot == (u32)nn->boot_time)
1751                 return 0;
1752         dprintk("NFSD stale clientid (%08x/%08x) boot_time %08lx\n",
1753                 clid->cl_boot, clid->cl_id, nn->boot_time);
1754         return 1;
1755 }
1756
1757 /*
1758  * XXX Should we use a slab cache ?
1759  * This type of memory management is somewhat inefficient, but we use it
1760  * anyway since SETCLIENTID is not a common operation.
1761  */
1762 static struct nfs4_client *alloc_client(struct xdr_netobj name)
1763 {
1764         struct nfs4_client *clp;
1765         int i;
1766
1767         clp = kzalloc(sizeof(struct nfs4_client), GFP_KERNEL);
1768         if (clp == NULL)
1769                 return NULL;
1770         clp->cl_name.data = kmemdup(name.data, name.len, GFP_KERNEL);
1771         if (clp->cl_name.data == NULL)
1772                 goto err_no_name;
1773         clp->cl_ownerstr_hashtbl = kmalloc(sizeof(struct list_head) *
1774                         OWNER_HASH_SIZE, GFP_KERNEL);
1775         if (!clp->cl_ownerstr_hashtbl)
1776                 goto err_no_hashtbl;
1777         for (i = 0; i < OWNER_HASH_SIZE; i++)
1778                 INIT_LIST_HEAD(&clp->cl_ownerstr_hashtbl[i]);
1779         clp->cl_name.len = name.len;
1780         INIT_LIST_HEAD(&clp->cl_sessions);
1781         idr_init(&clp->cl_stateids);
1782         atomic_set(&clp->cl_refcount, 0);
1783         clp->cl_cb_state = NFSD4_CB_UNKNOWN;
1784         INIT_LIST_HEAD(&clp->cl_idhash);
1785         INIT_LIST_HEAD(&clp->cl_openowners);
1786         INIT_LIST_HEAD(&clp->cl_delegations);
1787         INIT_LIST_HEAD(&clp->cl_lru);
1788         INIT_LIST_HEAD(&clp->cl_revoked);
1789 #ifdef CONFIG_NFSD_PNFS
1790         INIT_LIST_HEAD(&clp->cl_lo_states);
1791 #endif
1792         spin_lock_init(&clp->cl_lock);
1793         rpc_init_wait_queue(&clp->cl_cb_waitq, "Backchannel slot table");
1794         return clp;
1795 err_no_hashtbl:
1796         kfree(clp->cl_name.data);
1797 err_no_name:
1798         kfree(clp);
1799         return NULL;
1800 }
1801
1802 static void
1803 free_client(struct nfs4_client *clp)
1804 {
1805         while (!list_empty(&clp->cl_sessions)) {
1806                 struct nfsd4_session *ses;
1807                 ses = list_entry(clp->cl_sessions.next, struct nfsd4_session,
1808                                 se_perclnt);
1809                 list_del(&ses->se_perclnt);
1810                 WARN_ON_ONCE(atomic_read(&ses->se_ref));
1811                 free_session(ses);
1812         }
1813         rpc_destroy_wait_queue(&clp->cl_cb_waitq);
1814         free_svc_cred(&clp->cl_cred);
1815         kfree(clp->cl_ownerstr_hashtbl);
1816         kfree(clp->cl_name.data);
1817         idr_destroy(&clp->cl_stateids);
1818         kfree(clp);
1819 }
1820
1821 /* must be called under the client_lock */
1822 static void
1823 unhash_client_locked(struct nfs4_client *clp)
1824 {
1825         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
1826         struct nfsd4_session *ses;
1827
1828         lockdep_assert_held(&nn->client_lock);
1829
1830         /* Mark the client as expired! */
1831         clp->cl_time = 0;
1832         /* Make it invisible */
1833         if (!list_empty(&clp->cl_idhash)) {
1834                 list_del_init(&clp->cl_idhash);
1835                 if (test_bit(NFSD4_CLIENT_CONFIRMED, &clp->cl_flags))
1836                         rb_erase(&clp->cl_namenode, &nn->conf_name_tree);
1837                 else
1838                         rb_erase(&clp->cl_namenode, &nn->unconf_name_tree);
1839         }
1840         list_del_init(&clp->cl_lru);
1841         spin_lock(&clp->cl_lock);
1842         list_for_each_entry(ses, &clp->cl_sessions, se_perclnt)
1843                 list_del_init(&ses->se_hash);
1844         spin_unlock(&clp->cl_lock);
1845 }
1846
1847 static void
1848 unhash_client(struct nfs4_client *clp)
1849 {
1850         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
1851
1852         spin_lock(&nn->client_lock);
1853         unhash_client_locked(clp);
1854         spin_unlock(&nn->client_lock);
1855 }
1856
1857 static __be32 mark_client_expired_locked(struct nfs4_client *clp)
1858 {
1859         if (atomic_read(&clp->cl_refcount))
1860                 return nfserr_jukebox;
1861         unhash_client_locked(clp);
1862         return nfs_ok;
1863 }
1864
1865 static void
1866 __destroy_client(struct nfs4_client *clp)
1867 {
1868         struct nfs4_openowner *oo;
1869         struct nfs4_delegation *dp;
1870         struct list_head reaplist;
1871
1872         INIT_LIST_HEAD(&reaplist);
1873         spin_lock(&state_lock);
1874         while (!list_empty(&clp->cl_delegations)) {
1875                 dp = list_entry(clp->cl_delegations.next, struct nfs4_delegation, dl_perclnt);
1876                 WARN_ON(!unhash_delegation_locked(dp));
1877                 list_add(&dp->dl_recall_lru, &reaplist);
1878         }
1879         spin_unlock(&state_lock);
1880         while (!list_empty(&reaplist)) {
1881                 dp = list_entry(reaplist.next, struct nfs4_delegation, dl_recall_lru);
1882                 list_del_init(&dp->dl_recall_lru);
1883                 put_clnt_odstate(dp->dl_clnt_odstate);
1884                 nfs4_put_deleg_lease(dp->dl_stid.sc_file);
1885                 nfs4_put_stid(&dp->dl_stid);
1886         }
1887         while (!list_empty(&clp->cl_revoked)) {
1888                 dp = list_entry(clp->cl_revoked.next, struct nfs4_delegation, dl_recall_lru);
1889                 list_del_init(&dp->dl_recall_lru);
1890                 nfs4_put_stid(&dp->dl_stid);
1891         }
1892         while (!list_empty(&clp->cl_openowners)) {
1893                 oo = list_entry(clp->cl_openowners.next, struct nfs4_openowner, oo_perclient);
1894                 nfs4_get_stateowner(&oo->oo_owner);
1895                 release_openowner(oo);
1896         }
1897         nfsd4_return_all_client_layouts(clp);
1898         nfsd4_shutdown_callback(clp);
1899         if (clp->cl_cb_conn.cb_xprt)
1900                 svc_xprt_put(clp->cl_cb_conn.cb_xprt);
1901         free_client(clp);
1902 }
1903
1904 static void
1905 destroy_client(struct nfs4_client *clp)
1906 {
1907         unhash_client(clp);
1908         __destroy_client(clp);
1909 }
1910
1911 static void expire_client(struct nfs4_client *clp)
1912 {
1913         unhash_client(clp);
1914         nfsd4_client_record_remove(clp);
1915         __destroy_client(clp);
1916 }
1917
1918 static void copy_verf(struct nfs4_client *target, nfs4_verifier *source)
1919 {
1920         memcpy(target->cl_verifier.data, source->data,
1921                         sizeof(target->cl_verifier.data));
1922 }
1923
1924 static void copy_clid(struct nfs4_client *target, struct nfs4_client *source)
1925 {
1926         target->cl_clientid.cl_boot = source->cl_clientid.cl_boot;
1927         target->cl_clientid.cl_id = source->cl_clientid.cl_id;
1928 }
1929
1930 static int copy_cred(struct svc_cred *target, struct svc_cred *source)
1931 {
1932         target->cr_principal = kstrdup(source->cr_principal, GFP_KERNEL);
1933         target->cr_raw_principal = kstrdup(source->cr_raw_principal,
1934                                                                 GFP_KERNEL);
1935         if ((source->cr_principal && ! target->cr_principal) ||
1936             (source->cr_raw_principal && ! target->cr_raw_principal))
1937                 return -ENOMEM;
1938
1939         target->cr_flavor = source->cr_flavor;
1940         target->cr_uid = source->cr_uid;
1941         target->cr_gid = source->cr_gid;
1942         target->cr_group_info = source->cr_group_info;
1943         get_group_info(target->cr_group_info);
1944         target->cr_gss_mech = source->cr_gss_mech;
1945         if (source->cr_gss_mech)
1946                 gss_mech_get(source->cr_gss_mech);
1947         return 0;
1948 }
1949
1950 static int
1951 compare_blob(const struct xdr_netobj *o1, const struct xdr_netobj *o2)
1952 {
1953         if (o1->len < o2->len)
1954                 return -1;
1955         if (o1->len > o2->len)
1956                 return 1;
1957         return memcmp(o1->data, o2->data, o1->len);
1958 }
1959
1960 static int same_name(const char *n1, const char *n2)
1961 {
1962         return 0 == memcmp(n1, n2, HEXDIR_LEN);
1963 }
1964
1965 static int
1966 same_verf(nfs4_verifier *v1, nfs4_verifier *v2)
1967 {
1968         return 0 == memcmp(v1->data, v2->data, sizeof(v1->data));
1969 }
1970
1971 static int
1972 same_clid(clientid_t *cl1, clientid_t *cl2)
1973 {
1974         return (cl1->cl_boot == cl2->cl_boot) && (cl1->cl_id == cl2->cl_id);
1975 }
1976
1977 static bool groups_equal(struct group_info *g1, struct group_info *g2)
1978 {
1979         int i;
1980
1981         if (g1->ngroups != g2->ngroups)
1982                 return false;
1983         for (i=0; i<g1->ngroups; i++)
1984                 if (!gid_eq(g1->gid[i], g2->gid[i]))
1985                         return false;
1986         return true;
1987 }
1988
1989 /*
1990  * RFC 3530 language requires clid_inuse be returned when the
1991  * "principal" associated with a requests differs from that previously
1992  * used.  We use uid, gid's, and gss principal string as our best
1993  * approximation.  We also don't want to allow non-gss use of a client
1994  * established using gss: in theory cr_principal should catch that
1995  * change, but in practice cr_principal can be null even in the gss case
1996  * since gssd doesn't always pass down a principal string.
1997  */
1998 static bool is_gss_cred(struct svc_cred *cr)
1999 {
2000         /* Is cr_flavor one of the gss "pseudoflavors"?: */
2001         return (cr->cr_flavor > RPC_AUTH_MAXFLAVOR);
2002 }
2003
2004
2005 static bool
2006 same_creds(struct svc_cred *cr1, struct svc_cred *cr2)
2007 {
2008         if ((is_gss_cred(cr1) != is_gss_cred(cr2))
2009                 || (!uid_eq(cr1->cr_uid, cr2->cr_uid))
2010                 || (!gid_eq(cr1->cr_gid, cr2->cr_gid))
2011                 || !groups_equal(cr1->cr_group_info, cr2->cr_group_info))
2012                 return false;
2013         if (cr1->cr_principal == cr2->cr_principal)
2014                 return true;
2015         if (!cr1->cr_principal || !cr2->cr_principal)
2016                 return false;
2017         return 0 == strcmp(cr1->cr_principal, cr2->cr_principal);
2018 }
2019
2020 static bool svc_rqst_integrity_protected(struct svc_rqst *rqstp)
2021 {
2022         struct svc_cred *cr = &rqstp->rq_cred;
2023         u32 service;
2024
2025         if (!cr->cr_gss_mech)
2026                 return false;
2027         service = gss_pseudoflavor_to_service(cr->cr_gss_mech, cr->cr_flavor);
2028         return service == RPC_GSS_SVC_INTEGRITY ||
2029                service == RPC_GSS_SVC_PRIVACY;
2030 }
2031
2032 bool nfsd4_mach_creds_match(struct nfs4_client *cl, struct svc_rqst *rqstp)
2033 {
2034         struct svc_cred *cr = &rqstp->rq_cred;
2035
2036         if (!cl->cl_mach_cred)
2037                 return true;
2038         if (cl->cl_cred.cr_gss_mech != cr->cr_gss_mech)
2039                 return false;
2040         if (!svc_rqst_integrity_protected(rqstp))
2041                 return false;
2042         if (cl->cl_cred.cr_raw_principal)
2043                 return 0 == strcmp(cl->cl_cred.cr_raw_principal,
2044                                                 cr->cr_raw_principal);
2045         if (!cr->cr_principal)
2046                 return false;
2047         return 0 == strcmp(cl->cl_cred.cr_principal, cr->cr_principal);
2048 }
2049
2050 static void gen_confirm(struct nfs4_client *clp, struct nfsd_net *nn)
2051 {
2052         __be32 verf[2];
2053
2054         /*
2055          * This is opaque to client, so no need to byte-swap. Use
2056          * __force to keep sparse happy
2057          */
2058         verf[0] = (__force __be32)get_seconds();
2059         verf[1] = (__force __be32)nn->clverifier_counter++;
2060         memcpy(clp->cl_confirm.data, verf, sizeof(clp->cl_confirm.data));
2061 }
2062
2063 static void gen_clid(struct nfs4_client *clp, struct nfsd_net *nn)
2064 {
2065         clp->cl_clientid.cl_boot = nn->boot_time;
2066         clp->cl_clientid.cl_id = nn->clientid_counter++;
2067         gen_confirm(clp, nn);
2068 }
2069
2070 static struct nfs4_stid *
2071 find_stateid_locked(struct nfs4_client *cl, stateid_t *t)
2072 {
2073         struct nfs4_stid *ret;
2074
2075         ret = idr_find(&cl->cl_stateids, t->si_opaque.so_id);
2076         if (!ret || !ret->sc_type)
2077                 return NULL;
2078         return ret;
2079 }
2080
2081 static struct nfs4_stid *
2082 find_stateid_by_type(struct nfs4_client *cl, stateid_t *t, char typemask)
2083 {
2084         struct nfs4_stid *s;
2085
2086         spin_lock(&cl->cl_lock);
2087         s = find_stateid_locked(cl, t);
2088         if (s != NULL) {
2089                 if (typemask & s->sc_type)
2090                         refcount_inc(&s->sc_count);
2091                 else
2092                         s = NULL;
2093         }
2094         spin_unlock(&cl->cl_lock);
2095         return s;
2096 }
2097
2098 static struct nfs4_client *create_client(struct xdr_netobj name,
2099                 struct svc_rqst *rqstp, nfs4_verifier *verf)
2100 {
2101         struct nfs4_client *clp;
2102         struct sockaddr *sa = svc_addr(rqstp);
2103         int ret;
2104         struct net *net = SVC_NET(rqstp);
2105
2106         clp = alloc_client(name);
2107         if (clp == NULL)
2108                 return NULL;
2109
2110         ret = copy_cred(&clp->cl_cred, &rqstp->rq_cred);
2111         if (ret) {
2112                 free_client(clp);
2113                 return NULL;
2114         }
2115         nfsd4_init_cb(&clp->cl_cb_null, clp, NULL, NFSPROC4_CLNT_CB_NULL);
2116         clp->cl_time = get_seconds();
2117         clear_bit(0, &clp->cl_cb_slot_busy);
2118         copy_verf(clp, verf);
2119         rpc_copy_addr((struct sockaddr *) &clp->cl_addr, sa);
2120         clp->cl_cb_session = NULL;
2121         clp->net = net;
2122         return clp;
2123 }
2124
2125 static void
2126 add_clp_to_name_tree(struct nfs4_client *new_clp, struct rb_root *root)
2127 {
2128         struct rb_node **new = &(root->rb_node), *parent = NULL;
2129         struct nfs4_client *clp;
2130
2131         while (*new) {
2132                 clp = rb_entry(*new, struct nfs4_client, cl_namenode);
2133                 parent = *new;
2134
2135                 if (compare_blob(&clp->cl_name, &new_clp->cl_name) > 0)
2136                         new = &((*new)->rb_left);
2137                 else
2138                         new = &((*new)->rb_right);
2139         }
2140
2141         rb_link_node(&new_clp->cl_namenode, parent, new);
2142         rb_insert_color(&new_clp->cl_namenode, root);
2143 }
2144
2145 static struct nfs4_client *
2146 find_clp_in_name_tree(struct xdr_netobj *name, struct rb_root *root)
2147 {
2148         int cmp;
2149         struct rb_node *node = root->rb_node;
2150         struct nfs4_client *clp;
2151
2152         while (node) {
2153                 clp = rb_entry(node, struct nfs4_client, cl_namenode);
2154                 cmp = compare_blob(&clp->cl_name, name);
2155                 if (cmp > 0)
2156                         node = node->rb_left;
2157                 else if (cmp < 0)
2158                         node = node->rb_right;
2159                 else
2160                         return clp;
2161         }
2162         return NULL;
2163 }
2164
2165 static void
2166 add_to_unconfirmed(struct nfs4_client *clp)
2167 {
2168         unsigned int idhashval;
2169         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
2170
2171         lockdep_assert_held(&nn->client_lock);
2172
2173         clear_bit(NFSD4_CLIENT_CONFIRMED, &clp->cl_flags);
2174         add_clp_to_name_tree(clp, &nn->unconf_name_tree);
2175         idhashval = clientid_hashval(clp->cl_clientid.cl_id);
2176         list_add(&clp->cl_idhash, &nn->unconf_id_hashtbl[idhashval]);
2177         renew_client_locked(clp);
2178 }
2179
2180 static void
2181 move_to_confirmed(struct nfs4_client *clp)
2182 {
2183         unsigned int idhashval = clientid_hashval(clp->cl_clientid.cl_id);
2184         struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
2185
2186         lockdep_assert_held(&nn->client_lock);
2187
2188         dprintk("NFSD: move_to_confirm nfs4_client %p\n", clp);
2189         list_move(&clp->cl_idhash, &nn->conf_id_hashtbl[idhashval]);
2190         rb_erase(&clp->cl_namenode, &nn->unconf_name_tree);
2191         add_clp_to_name_tree(clp, &nn->conf_name_tree);
2192         set_bit(NFSD4_CLIENT_CONFIRMED, &clp->cl_flags);
2193         renew_client_locked(clp);
2194 }
2195
2196 static struct nfs4_client *
2197 find_client_in_id_table(struct list_head *tbl, clientid_t *clid, bool sessions)
2198 {
2199         struct nfs4_client *clp;
2200         unsigned int idhashval = clientid_hashval(clid->cl_id);
2201
2202         list_for_each_entry(clp, &tbl[idhashval], cl_idhash) {
2203                 if (same_clid(&clp->cl_clientid, clid)) {
2204                         if ((bool)clp->cl_minorversion != sessions)
2205                                 return NULL;
2206                         renew_client_locked(clp);
2207                         return clp;
2208                 }
2209         }
2210         return NULL;
2211 }
2212
2213 static struct nfs4_client *
2214 find_confirmed_client(clientid_t *clid, bool sessions, struct nfsd_net *nn)
2215 {
2216         struct list_head *tbl = nn->conf_id_hashtbl;
2217
2218         lockdep_assert_held(&nn->client_lock);
2219         return find_client_in_id_table(tbl, clid, sessions);
2220 }
2221
2222 static struct nfs4_client *
2223 find_unconfirmed_client(clientid_t *clid, bool sessions, struct nfsd_net *nn)
2224 {
2225         struct list_head *tbl = nn->unconf_id_hashtbl;
2226
2227         lockdep_assert_held(&nn->client_lock);
2228         return find_client_in_id_table(tbl, clid, sessions);
2229 }
2230
2231 static bool clp_used_exchangeid(struct nfs4_client *clp)
2232 {
2233         return clp->cl_exchange_flags != 0;
2234 }
2235
2236 static struct nfs4_client *
2237 find_confirmed_client_by_name(struct xdr_netobj *name, struct nfsd_net *nn)
2238 {
2239         lockdep_assert_held(&nn->client_lock);
2240         return find_clp_in_name_tree(name, &nn->conf_name_tree);
2241 }
2242
2243 static struct nfs4_client *
2244 find_unconfirmed_client_by_name(struct xdr_netobj *name, struct nfsd_net *nn)
2245 {
2246         lockdep_assert_held(&nn->client_lock);
2247         return find_clp_in_name_tree(name, &nn->unconf_name_tree);
2248 }
2249
2250 static void
2251 gen_callback(struct nfs4_client *clp, struct nfsd4_setclientid *se, struct svc_rqst *rqstp)
2252 {
2253         struct nfs4_cb_conn *conn = &clp->cl_cb_conn;
2254         struct sockaddr *sa = svc_addr(rqstp);
2255         u32 scopeid = rpc_get_scope_id(sa);
2256         unsigned short expected_family;
2257
2258         /* Currently, we only support tcp and tcp6 for the callback channel */
2259         if (se->se_callback_netid_len == 3 &&
2260             !memcmp(se->se_callback_netid_val, "tcp", 3))
2261                 expected_family = AF_INET;
2262         else if (se->se_callback_netid_len == 4 &&
2263                  !memcmp(se->se_callback_netid_val, "tcp6", 4))
2264                 expected_family = AF_INET6;
2265         else
2266                 goto out_err;
2267
2268         conn->cb_addrlen = rpc_uaddr2sockaddr(clp->net, se->se_callback_addr_val,
2269                                             se->se_callback_addr_len,
2270                                             (struct sockaddr *)&conn->cb_addr,
2271                                             sizeof(conn->cb_addr));
2272
2273         if (!conn->cb_addrlen || conn->cb_addr.ss_family != expected_family)
2274                 goto out_err;
2275
2276         if (conn->cb_addr.ss_family == AF_INET6)
2277                 ((struct sockaddr_in6 *)&conn->cb_addr)->sin6_scope_id = scopeid;
2278
2279         conn->cb_prog = se->se_callback_prog;
2280         conn->cb_ident = se->se_callback_ident;
2281         memcpy(&conn->cb_saddr, &rqstp->rq_daddr, rqstp->rq_daddrlen);
2282         return;
2283 out_err:
2284         conn->cb_addr.ss_family = AF_UNSPEC;
2285         conn->cb_addrlen = 0;
2286         dprintk("NFSD: this client (clientid %08x/%08x) "
2287                 "will not receive delegations\n",
2288                 clp->cl_clientid.cl_boot, clp->cl_clientid.cl_id);
2289
2290         return;
2291 }
2292
2293 /*
2294  * Cache a reply. nfsd4_check_resp_size() has bounded the cache size.
2295  */
2296 static void
2297 nfsd4_store_cache_entry(struct nfsd4_compoundres *resp)
2298 {
2299         struct xdr_buf *buf = resp->xdr.buf;
2300         struct nfsd4_slot *slot = resp->cstate.slot;
2301         unsigned int base;
2302
2303         dprintk("--> %s slot %p\n", __func__, slot);
2304
2305         slot->sl_flags |= NFSD4_SLOT_INITIALIZED;
2306         slot->sl_opcnt = resp->opcnt;
2307         slot->sl_status = resp->cstate.status;
2308         free_svc_cred(&slot->sl_cred);
2309         copy_cred(&slot->sl_cred, &resp->rqstp->rq_cred);
2310
2311         if (!nfsd4_cache_this(resp)) {
2312                 slot->sl_flags &= ~NFSD4_SLOT_CACHED;
2313                 return;
2314         }
2315         slot->sl_flags |= NFSD4_SLOT_CACHED;
2316
2317         base = resp->cstate.data_offset;
2318         slot->sl_datalen = buf->len - base;
2319         if (read_bytes_from_xdr_buf(buf, base, slot->sl_data, slot->sl_datalen))
2320                 WARN(1, "%s: sessions DRC could not cache compound\n",
2321                      __func__);
2322         return;
2323 }
2324
2325 /*
2326  * Encode the replay sequence operation from the slot values.
2327  * If cachethis is FALSE encode the uncached rep error on the next
2328  * operation which sets resp->p and increments resp->opcnt for
2329  * nfs4svc_encode_compoundres.
2330  *
2331  */
2332 static __be32
2333 nfsd4_enc_sequence_replay(struct nfsd4_compoundargs *args,
2334                           struct nfsd4_compoundres *resp)
2335 {
2336         struct nfsd4_op *op;
2337         struct nfsd4_slot *slot = resp->cstate.slot;
2338
2339         /* Encode the replayed sequence operation */
2340         op = &args->ops[resp->opcnt - 1];
2341         nfsd4_encode_operation(resp, op);
2342
2343         if (slot->sl_flags & NFSD4_SLOT_CACHED)
2344                 return op->status;
2345         if (args->opcnt == 1) {
2346                 /*
2347                  * The original operation wasn't a solo sequence--we
2348                  * always cache those--so this retry must not match the
2349                  * original:
2350                  */
2351                 op->status = nfserr_seq_false_retry;
2352         } else {
2353                 op = &args->ops[resp->opcnt++];
2354                 op->status = nfserr_retry_uncached_rep;
2355                 nfsd4_encode_operation(resp, op);
2356         }
2357         return op->status;
2358 }
2359
2360 /*
2361  * The sequence operation is not cached because we can use the slot and
2362  * session values.
2363  */
2364 static __be32
2365 nfsd4_replay_cache_entry(struct nfsd4_compoundres *resp,
2366                          struct nfsd4_sequence *seq)
2367 {
2368         struct nfsd4_slot *slot = resp->cstate.slot;
2369         struct xdr_stream *xdr = &resp->xdr;
2370         __be32 *p;
2371         __be32 status;
2372
2373         dprintk("--> %s slot %p\n", __func__, slot);
2374
2375         status = nfsd4_enc_sequence_replay(resp->rqstp->rq_argp, resp);
2376         if (status)
2377                 return status;
2378
2379         p = xdr_reserve_space(xdr, slot->sl_datalen);
2380         if (!p) {
2381                 WARN_ON_ONCE(1);
2382                 return nfserr_serverfault;
2383         }
2384         xdr_encode_opaque_fixed(p, slot->sl_data, slot->sl_datalen);
2385         xdr_commit_encode(xdr);
2386
2387         resp->opcnt = slot->sl_opcnt;
2388         return slot->sl_status;
2389 }
2390
2391 /*
2392  * Set the exchange_id flags returned by the server.
2393  */
2394 static void
2395 nfsd4_set_ex_flags(struct nfs4_client *new, struct nfsd4_exchange_id *clid)
2396 {
2397 #ifdef CONFIG_NFSD_PNFS
2398         new->cl_exchange_flags |= EXCHGID4_FLAG_USE_PNFS_MDS;
2399 #else
2400         new->cl_exchange_flags |= EXCHGID4_FLAG_USE_NON_PNFS;
2401 #endif
2402
2403         /* Referrals are supported, Migration is not. */
2404         new->cl_exchange_flags |= EXCHGID4_FLAG_SUPP_MOVED_REFER;
2405
2406         /* set the wire flags to return to client. */
2407         clid->flags = new->cl_exchange_flags;
2408 }
2409
2410 static bool client_has_openowners(struct nfs4_client *clp)
2411 {
2412         struct nfs4_openowner *oo;
2413
2414         list_for_each_entry(oo, &clp->cl_openowners, oo_perclient) {
2415                 if (!list_empty(&oo->oo_owner.so_stateids))
2416                         return true;
2417         }
2418         return false;
2419 }
2420
2421 static bool client_has_state(struct nfs4_client *clp)
2422 {
2423         return client_has_openowners(clp)
2424 #ifdef CONFIG_NFSD_PNFS
2425                 || !list_empty(&clp->cl_lo_states)
2426 #endif
2427                 || !list_empty(&clp->cl_delegations)
2428                 || !list_empty(&clp->cl_sessions);
2429 }
2430
2431 __be32
2432 nfsd4_exchange_id(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
2433                 union nfsd4_op_u *u)
2434 {
2435         struct nfsd4_exchange_id *exid = &u->exchange_id;
2436         struct nfs4_client *conf, *new;
2437         struct nfs4_client *unconf = NULL;
2438         __be32 status;
2439         char                    addr_str[INET6_ADDRSTRLEN];
2440         nfs4_verifier           verf = exid->verifier;
2441         struct sockaddr         *sa = svc_addr(rqstp);
2442         bool    update = exid->flags & EXCHGID4_FLAG_UPD_CONFIRMED_REC_A;
2443         struct nfsd_net         *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
2444
2445         rpc_ntop(sa, addr_str, sizeof(addr_str));
2446         dprintk("%s rqstp=%p exid=%p clname.len=%u clname.data=%p "
2447                 "ip_addr=%s flags %x, spa_how %d\n",
2448                 __func__, rqstp, exid, exid->clname.len, exid->clname.data,
2449                 addr_str, exid->flags, exid->spa_how);
2450
2451         if (exid->flags & ~EXCHGID4_FLAG_MASK_A)
2452                 return nfserr_inval;
2453
2454         new = create_client(exid->clname, rqstp, &verf);
2455         if (new == NULL)
2456                 return nfserr_jukebox;
2457
2458         switch (exid->spa_how) {
2459         case SP4_MACH_CRED:
2460                 exid->spo_must_enforce[0] = 0;
2461                 exid->spo_must_enforce[1] = (
2462                         1 << (OP_BIND_CONN_TO_SESSION - 32) |
2463                         1 << (OP_EXCHANGE_ID - 32) |
2464                         1 << (OP_CREATE_SESSION - 32) |
2465                         1 << (OP_DESTROY_SESSION - 32) |
2466                         1 << (OP_DESTROY_CLIENTID - 32));
2467
2468                 exid->spo_must_allow[0] &= (1 << (OP_CLOSE) |
2469                                         1 << (OP_OPEN_DOWNGRADE) |
2470                                         1 << (OP_LOCKU) |
2471                                         1 << (OP_DELEGRETURN));
2472
2473                 exid->spo_must_allow[1] &= (
2474                                         1 << (OP_TEST_STATEID - 32) |
2475                                         1 << (OP_FREE_STATEID - 32));
2476                 if (!svc_rqst_integrity_protected(rqstp)) {
2477                         status = nfserr_inval;
2478                         goto out_nolock;
2479                 }
2480                 /*
2481                  * Sometimes userspace doesn't give us a principal.
2482                  * Which is a bug, really.  Anyway, we can't enforce
2483                  * MACH_CRED in that case, better to give up now:
2484                  */
2485                 if (!new->cl_cred.cr_principal &&
2486                                         !new->cl_cred.cr_raw_principal) {
2487                         status = nfserr_serverfault;
2488                         goto out_nolock;
2489                 }
2490                 new->cl_mach_cred = true;
2491         case SP4_NONE:
2492                 break;
2493         default:                                /* checked by xdr code */
2494                 WARN_ON_ONCE(1);
2495         case SP4_SSV:
2496                 status = nfserr_encr_alg_unsupp;
2497                 goto out_nolock;
2498         }
2499
2500         /* Cases below refer to rfc 5661 section 18.35.4: */
2501         spin_lock(&nn->client_lock);
2502         conf = find_confirmed_client_by_name(&exid->clname, nn);
2503         if (conf) {
2504                 bool creds_match = same_creds(&conf->cl_cred, &rqstp->rq_cred);
2505                 bool verfs_match = same_verf(&verf, &conf->cl_verifier);
2506
2507                 if (update) {
2508                         if (!clp_used_exchangeid(conf)) { /* buggy client */
2509                                 status = nfserr_inval;
2510                                 goto out;
2511                         }
2512                         if (!nfsd4_mach_creds_match(conf, rqstp)) {
2513                                 status = nfserr_wrong_cred;
2514                                 goto out;
2515                         }
2516                         if (!creds_match) { /* case 9 */
2517                                 status = nfserr_perm;
2518                                 goto out;
2519                         }
2520                         if (!verfs_match) { /* case 8 */
2521                                 status = nfserr_not_same;
2522                                 goto out;
2523                         }
2524                         /* case 6 */
2525                         exid->flags |= EXCHGID4_FLAG_CONFIRMED_R;
2526                         goto out_copy;
2527                 }
2528                 if (!creds_match) { /* case 3 */
2529                         if (client_has_state(conf)) {
2530                                 status = nfserr_clid_inuse;
2531                                 goto out;
2532                         }
2533                         goto out_new;
2534                 }
2535                 if (verfs_match) { /* case 2 */
2536                         conf->cl_exchange_flags |= EXCHGID4_FLAG_CONFIRMED_R;
2537                         goto out_copy;
2538                 }
2539                 /* case 5, client reboot */
2540                 conf = NULL;
2541                 goto out_new;
2542         }
2543
2544         if (update) { /* case 7 */
2545                 status = nfserr_noent;
2546                 goto out;
2547         }
2548
2549         unconf  = find_unconfirmed_client_by_name(&exid->clname, nn);
2550         if (unconf) /* case 4, possible retry or client restart */
2551                 unhash_client_locked(unconf);
2552
2553         /* case 1 (normal case) */
2554 out_new:
2555         if (conf) {
2556                 status = mark_client_expired_locked(conf);
2557                 if (status)
2558                         goto out;
2559         }
2560         new->cl_minorversion = cstate->minorversion;
2561         new->cl_spo_must_allow.u.words[0] = exid->spo_must_allow[0];
2562         new->cl_spo_must_allow.u.words[1] = exid->spo_must_allow[1];
2563
2564         gen_clid(new, nn);
2565         add_to_unconfirmed(new);
2566         swap(new, conf);
2567 out_copy:
2568         exid->clientid.cl_boot = conf->cl_clientid.cl_boot;
2569         exid->clientid.cl_id = conf->cl_clientid.cl_id;
2570
2571         exid->seqid = conf->cl_cs_slot.sl_seqid + 1;
2572         nfsd4_set_ex_flags(conf, exid);
2573
2574         dprintk("nfsd4_exchange_id seqid %d flags %x\n",
2575                 conf->cl_cs_slot.sl_seqid, conf->cl_exchange_flags);
2576         status = nfs_ok;
2577
2578 out:
2579         spin_unlock(&nn->client_lock);
2580 out_nolock:
2581         if (new)
2582                 expire_client(new);
2583         if (unconf)
2584                 expire_client(unconf);
2585         return status;
2586 }
2587
2588 static __be32
2589 check_slot_seqid(u32 seqid, u32 slot_seqid, int slot_inuse)
2590 {
2591         dprintk("%s enter. seqid %d slot_seqid %d\n", __func__, seqid,
2592                 slot_seqid);
2593
2594         /* The slot is in use, and no response has been sent. */
2595         if (slot_inuse) {
2596                 if (seqid == slot_seqid)
2597                         return nfserr_jukebox;
2598                 else
2599                         return nfserr_seq_misordered;
2600         }
2601         /* Note unsigned 32-bit arithmetic handles wraparound: */
2602         if (likely(seqid == slot_seqid + 1))
2603                 return nfs_ok;
2604         if (seqid == slot_seqid)
2605                 return nfserr_replay_cache;
2606         return nfserr_seq_misordered;
2607 }
2608
2609 /*
2610  * Cache the create session result into the create session single DRC
2611  * slot cache by saving the xdr structure. sl_seqid has been set.
2612  * Do this for solo or embedded create session operations.
2613  */
2614 static void
2615 nfsd4_cache_create_session(struct nfsd4_create_session *cr_ses,
2616                            struct nfsd4_clid_slot *slot, __be32 nfserr)
2617 {
2618         slot->sl_status = nfserr;
2619         memcpy(&slot->sl_cr_ses, cr_ses, sizeof(*cr_ses));
2620 }
2621
2622 static __be32
2623 nfsd4_replay_create_session(struct nfsd4_create_session *cr_ses,
2624                             struct nfsd4_clid_slot *slot)
2625 {
2626         memcpy(cr_ses, &slot->sl_cr_ses, sizeof(*cr_ses));
2627         return slot->sl_status;
2628 }
2629
2630 #define NFSD_MIN_REQ_HDR_SEQ_SZ ((\
2631                         2 * 2 + /* credential,verifier: AUTH_NULL, length 0 */ \
2632                         1 +     /* MIN tag is length with zero, only length */ \
2633                         3 +     /* version, opcount, opcode */ \
2634                         XDR_QUADLEN(NFS4_MAX_SESSIONID_LEN) + \
2635                                 /* seqid, slotID, slotID, cache */ \
2636                         4 ) * sizeof(__be32))
2637
2638 #define NFSD_MIN_RESP_HDR_SEQ_SZ ((\
2639                         2 +     /* verifier: AUTH_NULL, length 0 */\
2640                         1 +     /* status */ \
2641                         1 +     /* MIN tag is length with zero, only length */ \
2642                         3 +     /* opcount, opcode, opstatus*/ \
2643                         XDR_QUADLEN(NFS4_MAX_SESSIONID_LEN) + \
2644                                 /* seqid, slotID, slotID, slotID, status */ \
2645                         5 ) * sizeof(__be32))
2646
2647 static __be32 check_forechannel_attrs(struct nfsd4_channel_attrs *ca, struct nfsd_net *nn)
2648 {
2649         u32 maxrpc = nn->nfsd_serv->sv_max_mesg;
2650
2651         if (ca->maxreq_sz < NFSD_MIN_REQ_HDR_SEQ_SZ)
2652                 return nfserr_toosmall;
2653         if (ca->maxresp_sz < NFSD_MIN_RESP_HDR_SEQ_SZ)
2654                 return nfserr_toosmall;
2655         ca->headerpadsz = 0;
2656         ca->maxreq_sz = min_t(u32, ca->maxreq_sz, maxrpc);
2657         ca->maxresp_sz = min_t(u32, ca->maxresp_sz, maxrpc);
2658         ca->maxops = min_t(u32, ca->maxops, NFSD_MAX_OPS_PER_COMPOUND);
2659         ca->maxresp_cached = min_t(u32, ca->maxresp_cached,
2660                         NFSD_SLOT_CACHE_SIZE + NFSD_MIN_HDR_SEQ_SZ);
2661         ca->maxreqs = min_t(u32, ca->maxreqs, NFSD_MAX_SLOTS_PER_SESSION);
2662         /*
2663          * Note decreasing slot size below client's request may make it
2664          * difficult for client to function correctly, whereas
2665          * decreasing the number of slots will (just?) affect
2666          * performance.  When short on memory we therefore prefer to
2667          * decrease number of slots instead of their size.  Clients that
2668          * request larger slots than they need will get poor results:
2669          */
2670         ca->maxreqs = nfsd4_get_drc_mem(ca);
2671         if (!ca->maxreqs)
2672                 return nfserr_jukebox;
2673
2674         return nfs_ok;
2675 }
2676
2677 /*
2678  * Server's NFSv4.1 backchannel support is AUTH_SYS-only for now.
2679  * These are based on similar macros in linux/sunrpc/msg_prot.h .
2680  */
2681 #define RPC_MAX_HEADER_WITH_AUTH_SYS \
2682         (RPC_CALLHDRSIZE + 2 * (2 + UNX_CALLSLACK))
2683
2684 #define RPC_MAX_REPHEADER_WITH_AUTH_SYS \
2685         (RPC_REPHDRSIZE + (2 + NUL_REPLYSLACK))
2686
2687 #define NFSD_CB_MAX_REQ_SZ      ((NFS4_enc_cb_recall_sz + \
2688                                  RPC_MAX_HEADER_WITH_AUTH_SYS) * sizeof(__be32))
2689 #define NFSD_CB_MAX_RESP_SZ     ((NFS4_dec_cb_recall_sz + \
2690                                  RPC_MAX_REPHEADER_WITH_AUTH_SYS) * \
2691                                  sizeof(__be32))
2692
2693 static __be32 check_backchannel_attrs(struct nfsd4_channel_attrs *ca)
2694 {
2695         ca->headerpadsz = 0;
2696
2697         if (ca->maxreq_sz < NFSD_CB_MAX_REQ_SZ)
2698                 return nfserr_toosmall;
2699         if (ca->maxresp_sz < NFSD_CB_MAX_RESP_SZ)
2700                 return nfserr_toosmall;
2701         ca->maxresp_cached = 0;
2702         if (ca->maxops < 2)
2703                 return nfserr_toosmall;
2704
2705         return nfs_ok;
2706 }
2707
2708 static __be32 nfsd4_check_cb_sec(struct nfsd4_cb_sec *cbs)
2709 {
2710         switch (cbs->flavor) {
2711         case RPC_AUTH_NULL:
2712         case RPC_AUTH_UNIX:
2713                 return nfs_ok;
2714         default:
2715                 /*
2716                  * GSS case: the spec doesn't allow us to return this
2717                  * error.  But it also doesn't allow us not to support
2718                  * GSS.
2719                  * I'd rather this fail hard than return some error the
2720                  * client might think it can already handle:
2721                  */
2722                 return nfserr_encr_alg_unsupp;
2723         }
2724 }
2725
2726 __be32
2727 nfsd4_create_session(struct svc_rqst *rqstp,
2728                 struct nfsd4_compound_state *cstate, union nfsd4_op_u *u)
2729 {
2730         struct nfsd4_create_session *cr_ses = &u->create_session;
2731         struct sockaddr *sa = svc_addr(rqstp);
2732         struct nfs4_client *conf, *unconf;
2733         struct nfs4_client *old = NULL;
2734         struct nfsd4_session *new;
2735         struct nfsd4_conn *conn;
2736         struct nfsd4_clid_slot *cs_slot = NULL;
2737         __be32 status = 0;
2738         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
2739
2740         if (cr_ses->flags & ~SESSION4_FLAG_MASK_A)
2741                 return nfserr_inval;
2742         status = nfsd4_check_cb_sec(&cr_ses->cb_sec);
2743         if (status)
2744                 return status;
2745         status = check_forechannel_attrs(&cr_ses->fore_channel, nn);
2746         if (status)
2747                 return status;
2748         status = check_backchannel_attrs(&cr_ses->back_channel);
2749         if (status)
2750                 goto out_release_drc_mem;
2751         status = nfserr_jukebox;
2752         new = alloc_session(&cr_ses->fore_channel, &cr_ses->back_channel);
2753         if (!new)
2754                 goto out_release_drc_mem;
2755         conn = alloc_conn_from_crses(rqstp, cr_ses);
2756         if (!conn)
2757                 goto out_free_session;
2758
2759         spin_lock(&nn->client_lock);
2760         unconf = find_unconfirmed_client(&cr_ses->clientid, true, nn);
2761         conf = find_confirmed_client(&cr_ses->clientid, true, nn);
2762         WARN_ON_ONCE(conf && unconf);
2763
2764         if (conf) {
2765                 status = nfserr_wrong_cred;
2766                 if (!nfsd4_mach_creds_match(conf, rqstp))
2767                         goto out_free_conn;
2768                 cs_slot = &conf->cl_cs_slot;
2769                 status = check_slot_seqid(cr_ses->seqid, cs_slot->sl_seqid, 0);
2770                 if (status) {
2771                         if (status == nfserr_replay_cache)
2772                                 status = nfsd4_replay_create_session(cr_ses, cs_slot);
2773                         goto out_free_conn;
2774                 }
2775         } else if (unconf) {
2776                 if (!same_creds(&unconf->cl_cred, &rqstp->rq_cred) ||
2777                     !rpc_cmp_addr(sa, (struct sockaddr *) &unconf->cl_addr)) {
2778                         status = nfserr_clid_inuse;
2779                         goto out_free_conn;
2780                 }
2781                 status = nfserr_wrong_cred;
2782                 if (!nfsd4_mach_creds_match(unconf, rqstp))
2783                         goto out_free_conn;
2784                 cs_slot = &unconf->cl_cs_slot;
2785                 status = check_slot_seqid(cr_ses->seqid, cs_slot->sl_seqid, 0);
2786                 if (status) {
2787                         /* an unconfirmed replay returns misordered */
2788                         status = nfserr_seq_misordered;
2789                         goto out_free_conn;
2790                 }
2791                 old = find_confirmed_client_by_name(&unconf->cl_name, nn);
2792                 if (old) {
2793                         status = mark_client_expired_locked(old);
2794                         if (status) {
2795                                 old = NULL;
2796                                 goto out_free_conn;
2797                         }
2798                 }
2799                 move_to_confirmed(unconf);
2800                 conf = unconf;
2801         } else {
2802                 status = nfserr_stale_clientid;
2803                 goto out_free_conn;
2804         }
2805         status = nfs_ok;
2806         /* Persistent sessions are not supported */
2807         cr_ses->flags &= ~SESSION4_PERSIST;
2808         /* Upshifting from TCP to RDMA is not supported */
2809         cr_ses->flags &= ~SESSION4_RDMA;
2810
2811         init_session(rqstp, new, conf, cr_ses);
2812         nfsd4_get_session_locked(new);
2813
2814         memcpy(cr_ses->sessionid.data, new->se_sessionid.data,
2815                NFS4_MAX_SESSIONID_LEN);
2816         cs_slot->sl_seqid++;
2817         cr_ses->seqid = cs_slot->sl_seqid;
2818
2819         /* cache solo and embedded create sessions under the client_lock */
2820         nfsd4_cache_create_session(cr_ses, cs_slot, status);
2821         spin_unlock(&nn->client_lock);
2822         /* init connection and backchannel */
2823         nfsd4_init_conn(rqstp, conn, new);
2824         nfsd4_put_session(new);
2825         if (old)
2826                 expire_client(old);
2827         return status;
2828 out_free_conn:
2829         spin_unlock(&nn->client_lock);
2830         free_conn(conn);
2831         if (old)
2832                 expire_client(old);
2833 out_free_session:
2834         __free_session(new);
2835 out_release_drc_mem:
2836         nfsd4_put_drc_mem(&cr_ses->fore_channel);
2837         return status;
2838 }
2839
2840 static __be32 nfsd4_map_bcts_dir(u32 *dir)
2841 {
2842         switch (*dir) {
2843         case NFS4_CDFC4_FORE:
2844         case NFS4_CDFC4_BACK:
2845                 return nfs_ok;
2846         case NFS4_CDFC4_FORE_OR_BOTH:
2847         case NFS4_CDFC4_BACK_OR_BOTH:
2848                 *dir = NFS4_CDFC4_BOTH;
2849                 return nfs_ok;
2850         };
2851         return nfserr_inval;
2852 }
2853
2854 __be32 nfsd4_backchannel_ctl(struct svc_rqst *rqstp,
2855                 struct nfsd4_compound_state *cstate,
2856                 union nfsd4_op_u *u)
2857 {
2858         struct nfsd4_backchannel_ctl *bc = &u->backchannel_ctl;
2859         struct nfsd4_session *session = cstate->session;
2860         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
2861         __be32 status;
2862
2863         status = nfsd4_check_cb_sec(&bc->bc_cb_sec);
2864         if (status)
2865                 return status;
2866         spin_lock(&nn->client_lock);
2867         session->se_cb_prog = bc->bc_cb_program;
2868         session->se_cb_sec = bc->bc_cb_sec;
2869         spin_unlock(&nn->client_lock);
2870
2871         nfsd4_probe_callback(session->se_client);
2872
2873         return nfs_ok;
2874 }
2875
2876 __be32 nfsd4_bind_conn_to_session(struct svc_rqst *rqstp,
2877                      struct nfsd4_compound_state *cstate,
2878                      union nfsd4_op_u *u)
2879 {
2880         struct nfsd4_bind_conn_to_session *bcts = &u->bind_conn_to_session;
2881         __be32 status;
2882         struct nfsd4_conn *conn;
2883         struct nfsd4_session *session;
2884         struct net *net = SVC_NET(rqstp);
2885         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
2886
2887         if (!nfsd4_last_compound_op(rqstp))
2888                 return nfserr_not_only_op;
2889         spin_lock(&nn->client_lock);
2890         session = find_in_sessionid_hashtbl(&bcts->sessionid, net, &status);
2891         spin_unlock(&nn->client_lock);
2892         if (!session)
2893                 goto out_no_session;
2894         status = nfserr_wrong_cred;
2895         if (!nfsd4_mach_creds_match(session->se_client, rqstp))
2896                 goto out;
2897         status = nfsd4_map_bcts_dir(&bcts->dir);
2898         if (status)
2899                 goto out;
2900         conn = alloc_conn(rqstp, bcts->dir);
2901         status = nfserr_jukebox;
2902         if (!conn)
2903                 goto out;
2904         nfsd4_init_conn(rqstp, conn, session);
2905         status = nfs_ok;
2906 out:
2907         nfsd4_put_session(session);
2908 out_no_session:
2909         return status;
2910 }
2911
2912 static bool nfsd4_compound_in_session(struct nfsd4_session *session, struct nfs4_sessionid *sid)
2913 {
2914         if (!session)
2915                 return 0;
2916         return !memcmp(sid, &session->se_sessionid, sizeof(*sid));
2917 }
2918
2919 __be32
2920 nfsd4_destroy_session(struct svc_rqst *r, struct nfsd4_compound_state *cstate,
2921                 union nfsd4_op_u *u)
2922 {
2923         struct nfsd4_destroy_session *sessionid = &u->destroy_session;
2924         struct nfsd4_session *ses;
2925         __be32 status;
2926         int ref_held_by_me = 0;
2927         struct net *net = SVC_NET(r);
2928         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
2929
2930         status = nfserr_not_only_op;
2931         if (nfsd4_compound_in_session(cstate->session, &sessionid->sessionid)) {
2932                 if (!nfsd4_last_compound_op(r))
2933                         goto out;
2934                 ref_held_by_me++;
2935         }
2936         dump_sessionid(__func__, &sessionid->sessionid);
2937         spin_lock(&nn->client_lock);
2938         ses = find_in_sessionid_hashtbl(&sessionid->sessionid, net, &status);
2939         if (!ses)
2940                 goto out_client_lock;
2941         status = nfserr_wrong_cred;
2942         if (!nfsd4_mach_creds_match(ses->se_client, r))
2943                 goto out_put_session;
2944         status = mark_session_dead_locked(ses, 1 + ref_held_by_me);
2945         if (status)
2946                 goto out_put_session;
2947         unhash_session(ses);
2948         spin_unlock(&nn->client_lock);
2949
2950         nfsd4_probe_callback_sync(ses->se_client);
2951
2952         spin_lock(&nn->client_lock);
2953         status = nfs_ok;
2954 out_put_session:
2955         nfsd4_put_session_locked(ses);
2956 out_client_lock:
2957         spin_unlock(&nn->client_lock);
2958 out:
2959         return status;
2960 }
2961
2962 static struct nfsd4_conn *__nfsd4_find_conn(struct svc_xprt *xpt, struct nfsd4_session *s)
2963 {
2964         struct nfsd4_conn *c;
2965
2966         list_for_each_entry(c, &s->se_conns, cn_persession) {
2967                 if (c->cn_xprt == xpt) {
2968                         return c;
2969                 }
2970         }
2971         return NULL;
2972 }
2973
2974 static __be32 nfsd4_sequence_check_conn(struct nfsd4_conn *new, struct nfsd4_session *ses)
2975 {
2976         struct nfs4_client *clp = ses->se_client;
2977         struct nfsd4_conn *c;
2978         __be32 status = nfs_ok;
2979         int ret;
2980
2981         spin_lock(&clp->cl_lock);
2982         c = __nfsd4_find_conn(new->cn_xprt, ses);
2983         if (c)
2984                 goto out_free;
2985         status = nfserr_conn_not_bound_to_session;
2986         if (clp->cl_mach_cred)
2987                 goto out_free;
2988         __nfsd4_hash_conn(new, ses);
2989         spin_unlock(&clp->cl_lock);
2990         ret = nfsd4_register_conn(new);
2991         if (ret)
2992                 /* oops; xprt is already down: */
2993                 nfsd4_conn_lost(&new->cn_xpt_user);
2994         return nfs_ok;
2995 out_free:
2996         spin_unlock(&clp->cl_lock);
2997         free_conn(new);
2998         return status;
2999 }
3000
3001 static bool nfsd4_session_too_many_ops(struct svc_rqst *rqstp, struct nfsd4_session *session)
3002 {
3003         struct nfsd4_compoundargs *args = rqstp->rq_argp;
3004
3005         return args->opcnt > session->se_fchannel.maxops;
3006 }
3007
3008 static bool nfsd4_request_too_big(struct svc_rqst *rqstp,
3009                                   struct nfsd4_session *session)
3010 {
3011         struct xdr_buf *xb = &rqstp->rq_arg;
3012
3013         return xb->len > session->se_fchannel.maxreq_sz;
3014 }
3015
3016 static bool replay_matches_cache(struct svc_rqst *rqstp,
3017                  struct nfsd4_sequence *seq, struct nfsd4_slot *slot)
3018 {
3019         struct nfsd4_compoundargs *argp = rqstp->rq_argp;
3020
3021         if ((bool)(slot->sl_flags & NFSD4_SLOT_CACHETHIS) !=
3022             (bool)seq->cachethis)
3023                 return false;
3024         /*
3025          * If there's an error than the reply can have fewer ops than
3026          * the call.  But if we cached a reply with *more* ops than the
3027          * call you're sending us now, then this new call is clearly not
3028          * really a replay of the old one:
3029          */
3030         if (slot->sl_opcnt < argp->opcnt)
3031                 return false;
3032         /* This is the only check explicitly called by spec: */
3033         if (!same_creds(&rqstp->rq_cred, &slot->sl_cred))
3034                 return false;
3035         /*
3036          * There may be more comparisons we could actually do, but the
3037          * spec doesn't require us to catch every case where the calls
3038          * don't match (that would require caching the call as well as
3039          * the reply), so we don't bother.
3040          */
3041         return true;
3042 }
3043
3044 __be32
3045 nfsd4_sequence(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
3046                 union nfsd4_op_u *u)
3047 {
3048         struct nfsd4_sequence *seq = &u->sequence;
3049         struct nfsd4_compoundres *resp = rqstp->rq_resp;
3050         struct xdr_stream *xdr = &resp->xdr;
3051         struct nfsd4_session *session;
3052         struct nfs4_client *clp;
3053         struct nfsd4_slot *slot;
3054         struct nfsd4_conn *conn;
3055         __be32 status;
3056         int buflen;
3057         struct net *net = SVC_NET(rqstp);
3058         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
3059
3060         if (resp->opcnt != 1)
3061                 return nfserr_sequence_pos;
3062
3063         /*
3064          * Will be either used or freed by nfsd4_sequence_check_conn
3065          * below.
3066          */
3067         conn = alloc_conn(rqstp, NFS4_CDFC4_FORE);
3068         if (!conn)
3069                 return nfserr_jukebox;
3070
3071         spin_lock(&nn->client_lock);
3072         session = find_in_sessionid_hashtbl(&seq->sessionid, net, &status);
3073         if (!session)
3074                 goto out_no_session;
3075         clp = session->se_client;
3076
3077         status = nfserr_too_many_ops;
3078         if (nfsd4_session_too_many_ops(rqstp, session))
3079                 goto out_put_session;
3080
3081         status = nfserr_req_too_big;
3082         if (nfsd4_request_too_big(rqstp, session))
3083                 goto out_put_session;
3084
3085         status = nfserr_badslot;
3086         if (seq->slotid >= session->se_fchannel.maxreqs)
3087                 goto out_put_session;
3088
3089         slot = session->se_slots[seq->slotid];
3090         dprintk("%s: slotid %d\n", __func__, seq->slotid);
3091
3092         /* We do not negotiate the number of slots yet, so set the
3093          * maxslots to the session maxreqs which is used to encode
3094          * sr_highest_slotid and the sr_target_slot id to maxslots */
3095         seq->maxslots = session->se_fchannel.maxreqs;
3096
3097         status = check_slot_seqid(seq->seqid, slot->sl_seqid,
3098                                         slot->sl_flags & NFSD4_SLOT_INUSE);
3099         if (status == nfserr_replay_cache) {
3100                 status = nfserr_seq_misordered;
3101                 if (!(slot->sl_flags & NFSD4_SLOT_INITIALIZED))
3102                         goto out_put_session;
3103                 status = nfserr_seq_false_retry;
3104                 if (!replay_matches_cache(rqstp, seq, slot))
3105                         goto out_put_session;
3106                 cstate->slot = slot;
3107                 cstate->session = session;
3108                 cstate->clp = clp;
3109                 /* Return the cached reply status and set cstate->status
3110                  * for nfsd4_proc_compound processing */
3111                 status = nfsd4_replay_cache_entry(resp, seq);
3112                 cstate->status = nfserr_replay_cache;
3113                 goto out;
3114         }
3115         if (status)
3116                 goto out_put_session;
3117
3118         status = nfsd4_sequence_check_conn(conn, session);
3119         conn = NULL;
3120         if (status)
3121                 goto out_put_session;
3122
3123         buflen = (seq->cachethis) ?
3124                         session->se_fchannel.maxresp_cached :
3125                         session->se_fchannel.maxresp_sz;
3126         status = (seq->cachethis) ? nfserr_rep_too_big_to_cache :
3127                                     nfserr_rep_too_big;
3128         if (xdr_restrict_buflen(xdr, buflen - rqstp->rq_auth_slack))
3129                 goto out_put_session;
3130         svc_reserve(rqstp, buflen);
3131
3132         status = nfs_ok;
3133         /* Success! bump slot seqid */
3134         slot->sl_seqid = seq->seqid;
3135         slot->sl_flags |= NFSD4_SLOT_INUSE;
3136         if (seq->cachethis)
3137                 slot->sl_flags |= NFSD4_SLOT_CACHETHIS;
3138         else
3139                 slot->sl_flags &= ~NFSD4_SLOT_CACHETHIS;
3140
3141         cstate->slot = slot;
3142         cstate->session = session;
3143         cstate->clp = clp;
3144
3145 out:
3146         switch (clp->cl_cb_state) {
3147         case NFSD4_CB_DOWN:
3148                 seq->status_flags = SEQ4_STATUS_CB_PATH_DOWN;
3149                 break;
3150         case NFSD4_CB_FAULT:
3151                 seq->status_flags = SEQ4_STATUS_BACKCHANNEL_FAULT;
3152                 break;
3153         default:
3154                 seq->status_flags = 0;
3155         }
3156         if (!list_empty(&clp->cl_revoked))
3157                 seq->status_flags |= SEQ4_STATUS_RECALLABLE_STATE_REVOKED;
3158 out_no_session:
3159         if (conn)
3160                 free_conn(conn);
3161         spin_unlock(&nn->client_lock);
3162         return status;
3163 out_put_session:
3164         nfsd4_put_session_locked(session);
3165         goto out_no_session;
3166 }
3167
3168 void
3169 nfsd4_sequence_done(struct nfsd4_compoundres *resp)
3170 {
3171         struct nfsd4_compound_state *cs = &resp->cstate;
3172
3173         if (nfsd4_has_session(cs)) {
3174                 if (cs->status != nfserr_replay_cache) {
3175                         nfsd4_store_cache_entry(resp);
3176                         cs->slot->sl_flags &= ~NFSD4_SLOT_INUSE;
3177                 }
3178                 /* Drop session reference that was taken in nfsd4_sequence() */
3179                 nfsd4_put_session(cs->session);
3180         } else if (cs->clp)
3181                 put_client_renew(cs->clp);
3182 }
3183
3184 __be32
3185 nfsd4_destroy_clientid(struct svc_rqst *rqstp,
3186                 struct nfsd4_compound_state *cstate,
3187                 union nfsd4_op_u *u)
3188 {
3189         struct nfsd4_destroy_clientid *dc = &u->destroy_clientid;
3190         struct nfs4_client *conf, *unconf;
3191         struct nfs4_client *clp = NULL;
3192         __be32 status = 0;
3193         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
3194
3195         spin_lock(&nn->client_lock);
3196         unconf = find_unconfirmed_client(&dc->clientid, true, nn);
3197         conf = find_confirmed_client(&dc->clientid, true, nn);
3198         WARN_ON_ONCE(conf && unconf);
3199
3200         if (conf) {
3201                 if (client_has_state(conf)) {
3202                         status = nfserr_clientid_busy;
3203                         goto out;
3204                 }
3205                 status = mark_client_expired_locked(conf);
3206                 if (status)
3207                         goto out;
3208                 clp = conf;
3209         } else if (unconf)
3210                 clp = unconf;
3211         else {
3212                 status = nfserr_stale_clientid;
3213                 goto out;
3214         }
3215         if (!nfsd4_mach_creds_match(clp, rqstp)) {
3216                 clp = NULL;
3217                 status = nfserr_wrong_cred;
3218                 goto out;
3219         }
3220         unhash_client_locked(clp);
3221 out:
3222         spin_unlock(&nn->client_lock);
3223         if (clp)
3224                 expire_client(clp);
3225         return status;
3226 }
3227
3228 __be32
3229 nfsd4_reclaim_complete(struct svc_rqst *rqstp,
3230                 struct nfsd4_compound_state *cstate, union nfsd4_op_u *u)
3231 {
3232         struct nfsd4_reclaim_complete *rc = &u->reclaim_complete;
3233         __be32 status = 0;
3234
3235         if (rc->rca_one_fs) {
3236                 if (!cstate->current_fh.fh_dentry)
3237                         return nfserr_nofilehandle;
3238                 /*
3239                  * We don't take advantage of the rca_one_fs case.
3240                  * That's OK, it's optional, we can safely ignore it.
3241                  */
3242                 return nfs_ok;
3243         }
3244
3245         status = nfserr_complete_already;
3246         if (test_and_set_bit(NFSD4_CLIENT_RECLAIM_COMPLETE,
3247                              &cstate->session->se_client->cl_flags))
3248                 goto out;
3249
3250         status = nfserr_stale_clientid;
3251         if (is_client_expired(cstate->session->se_client))
3252                 /*
3253                  * The following error isn't really legal.
3254                  * But we only get here if the client just explicitly
3255                  * destroyed the client.  Surely it no longer cares what
3256                  * error it gets back on an operation for the dead
3257                  * client.
3258                  */
3259                 goto out;
3260
3261         status = nfs_ok;
3262         nfsd4_client_record_create(cstate->session->se_client);
3263 out:
3264         return status;
3265 }
3266
3267 __be32
3268 nfsd4_setclientid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
3269                   union nfsd4_op_u *u)
3270 {
3271         struct nfsd4_setclientid *setclid = &u->setclientid;
3272         struct xdr_netobj       clname = setclid->se_name;
3273         nfs4_verifier           clverifier = setclid->se_verf;
3274         struct nfs4_client      *conf, *new;
3275         struct nfs4_client      *unconf = NULL;
3276         __be32                  status;
3277         struct nfsd_net         *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
3278
3279         new = create_client(clname, rqstp, &clverifier);
3280         if (new == NULL)
3281                 return nfserr_jukebox;
3282         /* Cases below refer to rfc 3530 section 14.2.33: */
3283         spin_lock(&nn->client_lock);
3284         conf = find_confirmed_client_by_name(&clname, nn);
3285         if (conf && client_has_state(conf)) {
3286                 /* case 0: */
3287                 status = nfserr_clid_inuse;
3288                 if (clp_used_exchangeid(conf))
3289                         goto out;
3290                 if (!same_creds(&conf->cl_cred, &rqstp->rq_cred)) {
3291                         char addr_str[INET6_ADDRSTRLEN];
3292                         rpc_ntop((struct sockaddr *) &conf->cl_addr, addr_str,
3293                                  sizeof(addr_str));
3294                         dprintk("NFSD: setclientid: string in use by client "
3295                                 "at %s\n", addr_str);
3296                         goto out;
3297                 }
3298         }
3299         unconf = find_unconfirmed_client_by_name(&clname, nn);
3300         if (unconf)
3301                 unhash_client_locked(unconf);
3302         if (conf && same_verf(&conf->cl_verifier, &clverifier)) {
3303                 /* case 1: probable callback update */
3304                 copy_clid(new, conf);
3305                 gen_confirm(new, nn);
3306         } else /* case 4 (new client) or cases 2, 3 (client reboot): */
3307                 gen_clid(new, nn);
3308         new->cl_minorversion = 0;
3309         gen_callback(new, setclid, rqstp);
3310         add_to_unconfirmed(new);
3311         setclid->se_clientid.cl_boot = new->cl_clientid.cl_boot;
3312         setclid->se_clientid.cl_id = new->cl_clientid.cl_id;
3313         memcpy(setclid->se_confirm.data, new->cl_confirm.data, sizeof(setclid->se_confirm.data));
3314         new = NULL;
3315         status = nfs_ok;
3316 out:
3317         spin_unlock(&nn->client_lock);
3318         if (new)
3319                 free_client(new);
3320         if (unconf)
3321                 expire_client(unconf);
3322         return status;
3323 }
3324
3325
3326 __be32
3327 nfsd4_setclientid_confirm(struct svc_rqst *rqstp,
3328                         struct nfsd4_compound_state *cstate,
3329                         union nfsd4_op_u *u)
3330 {
3331         struct nfsd4_setclientid_confirm *setclientid_confirm =
3332                         &u->setclientid_confirm;
3333         struct nfs4_client *conf, *unconf;
3334         struct nfs4_client *old = NULL;
3335         nfs4_verifier confirm = setclientid_confirm->sc_confirm;
3336         clientid_t * clid = &setclientid_confirm->sc_clientid;
3337         __be32 status;
3338         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
3339
3340         if (STALE_CLIENTID(clid, nn))
3341                 return nfserr_stale_clientid;
3342
3343         spin_lock(&nn->client_lock);
3344         conf = find_confirmed_client(clid, false, nn);
3345         unconf = find_unconfirmed_client(clid, false, nn);
3346         /*
3347          * We try hard to give out unique clientid's, so if we get an
3348          * attempt to confirm the same clientid with a different cred,
3349          * the client may be buggy; this should never happen.
3350          *
3351          * Nevertheless, RFC 7530 recommends INUSE for this case:
3352          */
3353         status = nfserr_clid_inuse;
3354         if (unconf && !same_creds(&unconf->cl_cred, &rqstp->rq_cred))
3355                 goto out;
3356         if (conf && !same_creds(&conf->cl_cred, &rqstp->rq_cred))
3357                 goto out;
3358         /* cases below refer to rfc 3530 section 14.2.34: */
3359         if (!unconf || !same_verf(&confirm, &unconf->cl_confirm)) {
3360                 if (conf && same_verf(&confirm, &conf->cl_confirm)) {
3361                         /* case 2: probable retransmit */
3362                         status = nfs_ok;
3363                 } else /* case 4: client hasn't noticed we rebooted yet? */
3364                         status = nfserr_stale_clientid;
3365                 goto out;
3366         }
3367         status = nfs_ok;
3368         if (conf) { /* case 1: callback update */
3369                 old = unconf;
3370                 unhash_client_locked(old);
3371                 nfsd4_change_callback(conf, &unconf->cl_cb_conn);
3372         } else { /* case 3: normal case; new or rebooted client */
3373                 old = find_confirmed_client_by_name(&unconf->cl_name, nn);
3374                 if (old) {
3375                         status = nfserr_clid_inuse;
3376                         if (client_has_state(old)
3377                                         && !same_creds(&unconf->cl_cred,
3378                                                         &old->cl_cred))
3379                                 goto out;
3380                         status = mark_client_expired_locked(old);
3381                         if (status) {
3382                                 old = NULL;
3383                                 goto out;
3384                         }
3385                 }
3386                 move_to_confirmed(unconf);
3387                 conf = unconf;
3388         }
3389         get_client_locked(conf);
3390         spin_unlock(&nn->client_lock);
3391         nfsd4_probe_callback(conf);
3392         spin_lock(&nn->client_lock);
3393         put_client_renew_locked(conf);
3394 out:
3395         spin_unlock(&nn->client_lock);
3396         if (old)
3397                 expire_client(old);
3398         return status;
3399 }
3400
3401 static struct nfs4_file *nfsd4_alloc_file(void)
3402 {
3403         return kmem_cache_alloc(file_slab, GFP_KERNEL);
3404 }
3405
3406 /* OPEN Share state helper functions */
3407 static void nfsd4_init_file(struct knfsd_fh *fh, unsigned int hashval,
3408                                 struct nfs4_file *fp)
3409 {
3410         lockdep_assert_held(&state_lock);
3411
3412         refcount_set(&fp->fi_ref, 1);
3413         spin_lock_init(&fp->fi_lock);
3414         INIT_LIST_HEAD(&fp->fi_stateids);
3415         INIT_LIST_HEAD(&fp->fi_delegations);
3416         INIT_LIST_HEAD(&fp->fi_clnt_odstate);
3417         fh_copy_shallow(&fp->fi_fhandle, fh);
3418         fp->fi_deleg_file = NULL;
3419         fp->fi_had_conflict = false;
3420         fp->fi_share_deny = 0;
3421         memset(fp->fi_fds, 0, sizeof(fp->fi_fds));
3422         memset(fp->fi_access, 0, sizeof(fp->fi_access));
3423 #ifdef CONFIG_NFSD_PNFS
3424         INIT_LIST_HEAD(&fp->fi_lo_states);
3425         atomic_set(&fp->fi_lo_recalls, 0);
3426 #endif
3427         hlist_add_head_rcu(&fp->fi_hash, &file_hashtbl[hashval]);
3428 }
3429
3430 void
3431 nfsd4_free_slabs(void)
3432 {
3433         kmem_cache_destroy(odstate_slab);
3434         kmem_cache_destroy(openowner_slab);
3435         kmem_cache_destroy(lockowner_slab);
3436         kmem_cache_destroy(file_slab);
3437         kmem_cache_destroy(stateid_slab);
3438         kmem_cache_destroy(deleg_slab);
3439 }
3440
3441 int
3442 nfsd4_init_slabs(void)
3443 {
3444         openowner_slab = kmem_cache_create("nfsd4_openowners",
3445                         sizeof(struct nfs4_openowner), 0, 0, NULL);
3446         if (openowner_slab == NULL)
3447                 goto out;
3448         lockowner_slab = kmem_cache_create("nfsd4_lockowners",
3449                         sizeof(struct nfs4_lockowner), 0, 0, NULL);
3450         if (lockowner_slab == NULL)
3451                 goto out_free_openowner_slab;
3452         file_slab = kmem_cache_create("nfsd4_files",
3453                         sizeof(struct nfs4_file), 0, 0, NULL);
3454         if (file_slab == NULL)
3455                 goto out_free_lockowner_slab;
3456         stateid_slab = kmem_cache_create("nfsd4_stateids",
3457                         sizeof(struct nfs4_ol_stateid), 0, 0, NULL);
3458         if (stateid_slab == NULL)
3459                 goto out_free_file_slab;
3460         deleg_slab = kmem_cache_create("nfsd4_delegations",
3461                         sizeof(struct nfs4_delegation), 0, 0, NULL);
3462         if (deleg_slab == NULL)
3463                 goto out_free_stateid_slab;
3464         odstate_slab = kmem_cache_create("nfsd4_odstate",
3465                         sizeof(struct nfs4_clnt_odstate), 0, 0, NULL);
3466         if (odstate_slab == NULL)
3467                 goto out_free_deleg_slab;
3468         return 0;
3469
3470 out_free_deleg_slab:
3471         kmem_cache_destroy(deleg_slab);
3472 out_free_stateid_slab:
3473         kmem_cache_destroy(stateid_slab);
3474 out_free_file_slab:
3475         kmem_cache_destroy(file_slab);
3476 out_free_lockowner_slab:
3477         kmem_cache_destroy(lockowner_slab);
3478 out_free_openowner_slab:
3479         kmem_cache_destroy(openowner_slab);
3480 out:
3481         dprintk("nfsd4: out of memory while initializing nfsv4\n");
3482         return -ENOMEM;
3483 }
3484
3485 static void init_nfs4_replay(struct nfs4_replay *rp)
3486 {
3487         rp->rp_status = nfserr_serverfault;
3488         rp->rp_buflen = 0;
3489         rp->rp_buf = rp->rp_ibuf;
3490         mutex_init(&rp->rp_mutex);
3491 }
3492
3493 static void nfsd4_cstate_assign_replay(struct nfsd4_compound_state *cstate,
3494                 struct nfs4_stateowner *so)
3495 {
3496         if (!nfsd4_has_session(cstate)) {
3497                 mutex_lock(&so->so_replay.rp_mutex);
3498                 cstate->replay_owner = nfs4_get_stateowner(so);
3499         }
3500 }
3501
3502 void nfsd4_cstate_clear_replay(struct nfsd4_compound_state *cstate)
3503 {
3504         struct nfs4_stateowner *so = cstate->replay_owner;
3505
3506         if (so != NULL) {
3507                 cstate->replay_owner = NULL;
3508                 mutex_unlock(&so->so_replay.rp_mutex);
3509                 nfs4_put_stateowner(so);
3510         }
3511 }
3512
3513 static inline void *alloc_stateowner(struct kmem_cache *slab, struct xdr_netobj *owner, struct nfs4_client *clp)
3514 {
3515         struct nfs4_stateowner *sop;
3516
3517         sop = kmem_cache_alloc(slab, GFP_KERNEL);
3518         if (!sop)
3519                 return NULL;
3520
3521         sop->so_owner.data = kmemdup(owner->data, owner->len, GFP_KERNEL);
3522         if (!sop->so_owner.data) {
3523                 kmem_cache_free(slab, sop);
3524                 return NULL;
3525         }
3526         sop->so_owner.len = owner->len;
3527
3528         INIT_LIST_HEAD(&sop->so_stateids);
3529         sop->so_client = clp;
3530         init_nfs4_replay(&sop->so_replay);
3531         atomic_set(&sop->so_count, 1);
3532         return sop;
3533 }
3534
3535 static void hash_openowner(struct nfs4_openowner *oo, struct nfs4_client *clp, unsigned int strhashval)
3536 {
3537         lockdep_assert_held(&clp->cl_lock);
3538
3539         list_add(&oo->oo_owner.so_strhash,
3540                  &clp->cl_ownerstr_hashtbl[strhashval]);
3541         list_add(&oo->oo_perclient, &clp->cl_openowners);
3542 }
3543
3544 static void nfs4_unhash_openowner(struct nfs4_stateowner *so)
3545 {
3546         unhash_openowner_locked(openowner(so));
3547 }
3548
3549 static void nfs4_free_openowner(struct nfs4_stateowner *so)
3550 {
3551         struct nfs4_openowner *oo = openowner(so);
3552
3553         kmem_cache_free(openowner_slab, oo);
3554 }
3555
3556 static const struct nfs4_stateowner_operations openowner_ops = {
3557         .so_unhash =    nfs4_unhash_openowner,
3558         .so_free =      nfs4_free_openowner,
3559 };
3560
3561 static struct nfs4_ol_stateid *
3562 nfsd4_find_existing_open(struct nfs4_file *fp, struct nfsd4_open *open)
3563 {
3564         struct nfs4_ol_stateid *local, *ret = NULL;
3565         struct nfs4_openowner *oo = open->op_openowner;
3566
3567         lockdep_assert_held(&fp->fi_lock);
3568
3569         list_for_each_entry(local, &fp->fi_stateids, st_perfile) {
3570                 /* ignore lock owners */
3571                 if (local->st_stateowner->so_is_open_owner == 0)
3572                         continue;
3573                 if (local->st_stateowner != &oo->oo_owner)
3574                         continue;
3575                 if (local->st_stid.sc_type == NFS4_OPEN_STID) {
3576                         ret = local;
3577                         refcount_inc(&ret->st_stid.sc_count);
3578                         break;
3579                 }
3580         }
3581         return ret;
3582 }
3583
3584 static __be32
3585 nfsd4_verify_open_stid(struct nfs4_stid *s)
3586 {
3587         __be32 ret = nfs_ok;
3588
3589         switch (s->sc_type) {
3590         default:
3591                 break;
3592         case NFS4_CLOSED_STID:
3593         case NFS4_CLOSED_DELEG_STID:
3594                 ret = nfserr_bad_stateid;
3595                 break;
3596         case NFS4_REVOKED_DELEG_STID:
3597                 ret = nfserr_deleg_revoked;
3598         }
3599         return ret;
3600 }
3601
3602 /* Lock the stateid st_mutex, and deal with races with CLOSE */
3603 static __be32
3604 nfsd4_lock_ol_stateid(struct nfs4_ol_stateid *stp)
3605 {
3606         __be32 ret;
3607
3608         mutex_lock_nested(&stp->st_mutex, LOCK_STATEID_MUTEX);
3609         ret = nfsd4_verify_open_stid(&stp->st_stid);
3610         if (ret != nfs_ok)
3611                 mutex_unlock(&stp->st_mutex);
3612         return ret;
3613 }
3614
3615 static struct nfs4_ol_stateid *
3616 nfsd4_find_and_lock_existing_open(struct nfs4_file *fp, struct nfsd4_open *open)
3617 {
3618         struct nfs4_ol_stateid *stp;
3619         for (;;) {
3620                 spin_lock(&fp->fi_lock);
3621                 stp = nfsd4_find_existing_open(fp, open);
3622                 spin_unlock(&fp->fi_lock);
3623                 if (!stp || nfsd4_lock_ol_stateid(stp) == nfs_ok)
3624                         break;
3625                 nfs4_put_stid(&stp->st_stid);
3626         }
3627         return stp;
3628 }
3629
3630 static struct nfs4_openowner *
3631 alloc_init_open_stateowner(unsigned int strhashval, struct nfsd4_open *open,
3632                            struct nfsd4_compound_state *cstate)
3633 {
3634         struct nfs4_client *clp = cstate->clp;
3635         struct nfs4_openowner *oo, *ret;
3636
3637         oo = alloc_stateowner(openowner_slab, &open->op_owner, clp);
3638         if (!oo)
3639                 return NULL;
3640         oo->oo_owner.so_ops = &openowner_ops;
3641         oo->oo_owner.so_is_open_owner = 1;
3642         oo->oo_owner.so_seqid = open->op_seqid;
3643         oo->oo_flags = 0;
3644         if (nfsd4_has_session(cstate))
3645                 oo->oo_flags |= NFS4_OO_CONFIRMED;
3646         oo->oo_time = 0;
3647         oo->oo_last_closed_stid = NULL;
3648         INIT_LIST_HEAD(&oo->oo_close_lru);
3649         spin_lock(&clp->cl_lock);
3650         ret = find_openstateowner_str_locked(strhashval, open, clp);
3651         if (ret == NULL) {
3652                 hash_openowner(oo, clp, strhashval);
3653                 ret = oo;
3654         } else
3655                 nfs4_free_stateowner(&oo->oo_owner);
3656
3657         spin_unlock(&clp->cl_lock);
3658         return ret;
3659 }
3660
3661 static struct nfs4_ol_stateid *
3662 init_open_stateid(struct nfs4_file *fp, struct nfsd4_open *open)
3663 {
3664
3665         struct nfs4_openowner *oo = open->op_openowner;
3666         struct nfs4_ol_stateid *retstp = NULL;
3667         struct nfs4_ol_stateid *stp;
3668
3669         stp = open->op_stp;
3670         /* We are moving these outside of the spinlocks to avoid the warnings */
3671         mutex_init(&stp->st_mutex);
3672         mutex_lock_nested(&stp->st_mutex, OPEN_STATEID_MUTEX);
3673
3674 retry:
3675         spin_lock(&oo->oo_owner.so_client->cl_lock);
3676         spin_lock(&fp->fi_lock);
3677
3678         retstp = nfsd4_find_existing_open(fp, open);
3679         if (retstp)
3680                 goto out_unlock;
3681
3682         open->op_stp = NULL;
3683         refcount_inc(&stp->st_stid.sc_count);
3684         stp->st_stid.sc_type = NFS4_OPEN_STID;
3685         INIT_LIST_HEAD(&stp->st_locks);
3686         stp->st_stateowner = nfs4_get_stateowner(&oo->oo_owner);
3687         get_nfs4_file(fp);
3688         stp->st_stid.sc_file = fp;
3689         stp->st_access_bmap = 0;
3690         stp->st_deny_bmap = 0;
3691         stp->st_openstp = NULL;
3692         list_add(&stp->st_perstateowner, &oo->oo_owner.so_stateids);
3693         list_add(&stp->st_perfile, &fp->fi_stateids);
3694
3695 out_unlock:
3696         spin_unlock(&fp->fi_lock);
3697         spin_unlock(&oo->oo_owner.so_client->cl_lock);
3698         if (retstp) {
3699                 /* Handle races with CLOSE */
3700                 if (nfsd4_lock_ol_stateid(retstp) != nfs_ok) {
3701                         nfs4_put_stid(&retstp->st_stid);
3702                         goto retry;
3703                 }
3704                 /* To keep mutex tracking happy */
3705                 mutex_unlock(&stp->st_mutex);
3706                 stp = retstp;
3707         }
3708         return stp;
3709 }
3710
3711 /*
3712  * In the 4.0 case we need to keep the owners around a little while to handle
3713  * CLOSE replay. We still do need to release any file access that is held by
3714  * them before returning however.
3715  */
3716 static void
3717 move_to_close_lru(struct nfs4_ol_stateid *s, struct net *net)
3718 {
3719         struct nfs4_ol_stateid *last;
3720         struct nfs4_openowner *oo = openowner(s->st_stateowner);
3721         struct nfsd_net *nn = net_generic(s->st_stid.sc_client->net,
3722                                                 nfsd_net_id);
3723
3724         dprintk("NFSD: move_to_close_lru nfs4_openowner %p\n", oo);
3725
3726         /*
3727          * We know that we hold one reference via nfsd4_close, and another
3728          * "persistent" reference for the client. If the refcount is higher
3729          * than 2, then there are still calls in progress that are using this
3730          * stateid. We can't put the sc_file reference until they are finished.
3731          * Wait for the refcount to drop to 2. Since it has been unhashed,
3732          * there should be no danger of the refcount going back up again at
3733          * this point.
3734          */
3735         wait_event(close_wq, refcount_read(&s->st_stid.sc_count) == 2);
3736
3737         release_all_access(s);
3738         if (s->st_stid.sc_file) {
3739                 put_nfs4_file(s->st_stid.sc_file);
3740                 s->st_stid.sc_file = NULL;
3741         }
3742
3743         spin_lock(&nn->client_lock);
3744         last = oo->oo_last_closed_stid;
3745         oo->oo_last_closed_stid = s;
3746         list_move_tail(&oo->oo_close_lru, &nn->close_lru);
3747         oo->oo_time = get_seconds();
3748         spin_unlock(&nn->client_lock);
3749         if (last)
3750                 nfs4_put_stid(&last->st_stid);
3751 }
3752
3753 /* search file_hashtbl[] for file */
3754 static struct nfs4_file *
3755 find_file_locked(struct knfsd_fh *fh, unsigned int hashval)
3756 {
3757         struct nfs4_file *fp;
3758
3759         hlist_for_each_entry_rcu(fp, &file_hashtbl[hashval], fi_hash) {
3760                 if (fh_match(&fp->fi_fhandle, fh)) {
3761                         if (refcount_inc_not_zero(&fp->fi_ref))
3762                                 return fp;
3763                 }
3764         }
3765         return NULL;
3766 }
3767
3768 struct nfs4_file *
3769 find_file(struct knfsd_fh *fh)
3770 {
3771         struct nfs4_file *fp;
3772         unsigned int hashval = file_hashval(fh);
3773
3774         rcu_read_lock();
3775         fp = find_file_locked(fh, hashval);
3776         rcu_read_unlock();
3777         return fp;
3778 }
3779
3780 static struct nfs4_file *
3781 find_or_add_file(struct nfs4_file *new, struct knfsd_fh *fh)
3782 {
3783         struct nfs4_file *fp;
3784         unsigned int hashval = file_hashval(fh);
3785
3786         rcu_read_lock();
3787         fp = find_file_locked(fh, hashval);
3788         rcu_read_unlock();
3789         if (fp)
3790                 return fp;
3791
3792         spin_lock(&state_lock);
3793         fp = find_file_locked(fh, hashval);
3794         if (likely(fp == NULL)) {
3795                 nfsd4_init_file(fh, hashval, new);
3796                 fp = new;
3797         }
3798         spin_unlock(&state_lock);
3799
3800         return fp;
3801 }
3802
3803 /*
3804  * Called to check deny when READ with all zero stateid or
3805  * WRITE with all zero or all one stateid
3806  */
3807 static __be32
3808 nfs4_share_conflict(struct svc_fh *current_fh, unsigned int deny_type)
3809 {
3810         struct nfs4_file *fp;
3811         __be32 ret = nfs_ok;
3812
3813         fp = find_file(&current_fh->fh_handle);
3814         if (!fp)
3815                 return ret;
3816         /* Check for conflicting share reservations */
3817         spin_lock(&fp->fi_lock);
3818         if (fp->fi_share_deny & deny_type)
3819                 ret = nfserr_locked;
3820         spin_unlock(&fp->fi_lock);
3821         put_nfs4_file(fp);
3822         return ret;
3823 }
3824
3825 static void nfsd4_cb_recall_prepare(struct nfsd4_callback *cb)
3826 {
3827         struct nfs4_delegation *dp = cb_to_delegation(cb);
3828         struct nfsd_net *nn = net_generic(dp->dl_stid.sc_client->net,
3829                                           nfsd_net_id);
3830
3831         block_delegations(&dp->dl_stid.sc_file->fi_fhandle);
3832
3833         /*
3834          * We can't do this in nfsd_break_deleg_cb because it is
3835          * already holding inode->i_lock.
3836          *
3837          * If the dl_time != 0, then we know that it has already been
3838          * queued for a lease break. Don't queue it again.
3839          */
3840         spin_lock(&state_lock);
3841         if (dp->dl_time == 0) {
3842                 dp->dl_time = get_seconds();
3843                 list_add_tail(&dp->dl_recall_lru, &nn->del_recall_lru);
3844         }
3845         spin_unlock(&state_lock);
3846 }
3847
3848 static int nfsd4_cb_recall_done(struct nfsd4_callback *cb,
3849                 struct rpc_task *task)
3850 {
3851         struct nfs4_delegation *dp = cb_to_delegation(cb);
3852
3853         if (dp->dl_stid.sc_type == NFS4_CLOSED_DELEG_STID)
3854                 return 1;
3855
3856         switch (task->tk_status) {
3857         case 0:
3858                 return 1;
3859         case -EBADHANDLE:
3860         case -NFS4ERR_BAD_STATEID:
3861                 /*
3862                  * Race: client probably got cb_recall before open reply
3863                  * granting delegation.
3864                  */
3865                 if (dp->dl_retries--) {
3866                         rpc_delay(task, 2 * HZ);
3867                         return 0;
3868                 }
3869                 /*FALLTHRU*/
3870         default:
3871                 return -1;
3872         }
3873 }
3874
3875 static void nfsd4_cb_recall_release(struct nfsd4_callback *cb)
3876 {
3877         struct nfs4_delegation *dp = cb_to_delegation(cb);
3878
3879         nfs4_put_stid(&dp->dl_stid);
3880 }
3881
3882 static const struct nfsd4_callback_ops nfsd4_cb_recall_ops = {
3883         .prepare        = nfsd4_cb_recall_prepare,
3884         .done           = nfsd4_cb_recall_done,
3885         .release        = nfsd4_cb_recall_release,
3886 };
3887
3888 static void nfsd_break_one_deleg(struct nfs4_delegation *dp)
3889 {
3890         /*
3891          * We're assuming the state code never drops its reference
3892          * without first removing the lease.  Since we're in this lease
3893          * callback (and since the lease code is serialized by the kernel
3894          * lock) we know the server hasn't removed the lease yet, we know
3895          * it's safe to take a reference.
3896          */
3897         refcount_inc(&dp->dl_stid.sc_count);
3898         nfsd4_run_cb(&dp->dl_recall);
3899 }
3900
3901 /* Called from break_lease() with i_lock held. */
3902 static bool
3903 nfsd_break_deleg_cb(struct file_lock *fl)
3904 {
3905         bool ret = false;
3906         struct nfs4_file *fp = (struct nfs4_file *)fl->fl_owner;
3907         struct nfs4_delegation *dp;
3908
3909         if (!fp) {
3910                 WARN(1, "(%p)->fl_owner NULL\n", fl);
3911                 return ret;
3912         }
3913         if (fp->fi_had_conflict) {
3914                 WARN(1, "duplicate break on %p\n", fp);
3915                 return ret;
3916         }
3917         /*
3918          * We don't want the locks code to timeout the lease for us;
3919          * we'll remove it ourself if a delegation isn't returned
3920          * in time:
3921          */
3922         fl->fl_break_time = 0;
3923
3924         spin_lock(&fp->fi_lock);
3925         fp->fi_had_conflict = true;
3926         /*
3927          * If there are no delegations on the list, then return true
3928          * so that the lease code will go ahead and delete it.
3929          */
3930         if (list_empty(&fp->fi_delegations))
3931                 ret = true;
3932         else
3933                 list_for_each_entry(dp, &fp->fi_delegations, dl_perfile)
3934                         nfsd_break_one_deleg(dp);
3935         spin_unlock(&fp->fi_lock);
3936         return ret;
3937 }
3938
3939 static int
3940 nfsd_change_deleg_cb(struct file_lock *onlist, int arg,
3941                      struct list_head *dispose)
3942 {
3943         if (arg & F_UNLCK)
3944                 return lease_modify(onlist, arg, dispose);
3945         else
3946                 return -EAGAIN;
3947 }
3948
3949 static const struct lock_manager_operations nfsd_lease_mng_ops = {
3950         .lm_break = nfsd_break_deleg_cb,
3951         .lm_change = nfsd_change_deleg_cb,
3952 };
3953
3954 static __be32 nfsd4_check_seqid(struct nfsd4_compound_state *cstate, struct nfs4_stateowner *so, u32 seqid)
3955 {
3956         if (nfsd4_has_session(cstate))
3957                 return nfs_ok;
3958         if (seqid == so->so_seqid - 1)
3959                 return nfserr_replay_me;
3960         if (seqid == so->so_seqid)
3961                 return nfs_ok;
3962         return nfserr_bad_seqid;
3963 }
3964
3965 static __be32 lookup_clientid(clientid_t *clid,
3966                 struct nfsd4_compound_state *cstate,
3967                 struct nfsd_net *nn)
3968 {
3969         struct nfs4_client *found;
3970
3971         if (cstate->clp) {
3972                 found = cstate->clp;
3973                 if (!same_clid(&found->cl_clientid, clid))
3974                         return nfserr_stale_clientid;
3975                 return nfs_ok;
3976         }
3977
3978         if (STALE_CLIENTID(clid, nn))
3979                 return nfserr_stale_clientid;
3980
3981         /*
3982          * For v4.1+ we get the client in the SEQUENCE op. If we don't have one
3983          * cached already then we know this is for is for v4.0 and "sessions"
3984          * will be false.
3985          */
3986         WARN_ON_ONCE(cstate->session);
3987         spin_lock(&nn->client_lock);
3988         found = find_confirmed_client(clid, false, nn);
3989         if (!found) {
3990                 spin_unlock(&nn->client_lock);
3991                 return nfserr_expired;
3992         }
3993         atomic_inc(&found->cl_refcount);
3994         spin_unlock(&nn->client_lock);
3995
3996         /* Cache the nfs4_client in cstate! */
3997         cstate->clp = found;
3998         return nfs_ok;
3999 }
4000
4001 __be32
4002 nfsd4_process_open1(struct nfsd4_compound_state *cstate,
4003                     struct nfsd4_open *open, struct nfsd_net *nn)
4004 {
4005         clientid_t *clientid = &open->op_clientid;
4006         struct nfs4_client *clp = NULL;
4007         unsigned int strhashval;
4008         struct nfs4_openowner *oo = NULL;
4009         __be32 status;
4010
4011         if (STALE_CLIENTID(&open->op_clientid, nn))
4012                 return nfserr_stale_clientid;
4013         /*
4014          * In case we need it later, after we've already created the
4015          * file and don't want to risk a further failure:
4016          */
4017         open->op_file = nfsd4_alloc_file();
4018         if (open->op_file == NULL)
4019                 return nfserr_jukebox;
4020
4021         status = lookup_clientid(clientid, cstate, nn);
4022         if (status)
4023                 return status;
4024         clp = cstate->clp;
4025
4026         strhashval = ownerstr_hashval(&open->op_owner);
4027         oo = find_openstateowner_str(strhashval, open, clp);
4028         open->op_openowner = oo;
4029         if (!oo) {
4030                 goto new_owner;
4031         }
4032         if (!(oo->oo_flags & NFS4_OO_CONFIRMED)) {
4033                 /* Replace unconfirmed owners without checking for replay. */
4034                 release_openowner(oo);
4035                 open->op_openowner = NULL;
4036                 goto new_owner;
4037         }
4038         status = nfsd4_check_seqid(cstate, &oo->oo_owner, open->op_seqid);
4039         if (status)
4040                 return status;
4041         goto alloc_stateid;
4042 new_owner:
4043         oo = alloc_init_open_stateowner(strhashval, open, cstate);
4044         if (oo == NULL)
4045                 return nfserr_jukebox;
4046         open->op_openowner = oo;
4047 alloc_stateid:
4048         open->op_stp = nfs4_alloc_open_stateid(clp);
4049         if (!open->op_stp)
4050                 return nfserr_jukebox;
4051
4052         if (nfsd4_has_session(cstate) &&
4053             (cstate->current_fh.fh_export->ex_flags & NFSEXP_PNFS)) {
4054                 open->op_odstate = alloc_clnt_odstate(clp);
4055                 if (!open->op_odstate)
4056                         return nfserr_jukebox;
4057         }
4058
4059         return nfs_ok;
4060 }
4061
4062 static inline __be32
4063 nfs4_check_delegmode(struct nfs4_delegation *dp, int flags)
4064 {
4065         if ((flags & WR_STATE) && (dp->dl_type == NFS4_OPEN_DELEGATE_READ))
4066                 return nfserr_openmode;
4067         else
4068                 return nfs_ok;
4069 }
4070
4071 static int share_access_to_flags(u32 share_access)
4072 {
4073         return share_access == NFS4_SHARE_ACCESS_READ ? RD_STATE : WR_STATE;
4074 }
4075
4076 static struct nfs4_delegation *find_deleg_stateid(struct nfs4_client *cl, stateid_t *s)
4077 {
4078         struct nfs4_stid *ret;
4079
4080         ret = find_stateid_by_type(cl, s,
4081                                 NFS4_DELEG_STID|NFS4_REVOKED_DELEG_STID);
4082         if (!ret)
4083                 return NULL;
4084         return delegstateid(ret);
4085 }
4086
4087 static bool nfsd4_is_deleg_cur(struct nfsd4_open *open)
4088 {
4089         return open->op_claim_type == NFS4_OPEN_CLAIM_DELEGATE_CUR ||
4090                open->op_claim_type == NFS4_OPEN_CLAIM_DELEG_CUR_FH;
4091 }
4092
4093 static __be32
4094 nfs4_check_deleg(struct nfs4_client *cl, struct nfsd4_open *open,
4095                 struct nfs4_delegation **dp)
4096 {
4097         int flags;
4098         __be32 status = nfserr_bad_stateid;
4099         struct nfs4_delegation *deleg;
4100
4101         deleg = find_deleg_stateid(cl, &open->op_delegate_stateid);
4102         if (deleg == NULL)
4103                 goto out;
4104         if (deleg->dl_stid.sc_type == NFS4_REVOKED_DELEG_STID) {
4105                 nfs4_put_stid(&deleg->dl_stid);
4106                 if (cl->cl_minorversion)
4107                         status = nfserr_deleg_revoked;
4108                 goto out;
4109         }
4110         flags = share_access_to_flags(open->op_share_access);
4111         status = nfs4_check_delegmode(deleg, flags);
4112         if (status) {
4113                 nfs4_put_stid(&deleg->dl_stid);
4114                 goto out;
4115         }
4116         *dp = deleg;
4117 out:
4118         if (!nfsd4_is_deleg_cur(open))
4119                 return nfs_ok;
4120         if (status)
4121                 return status;
4122         open->op_openowner->oo_flags |= NFS4_OO_CONFIRMED;
4123         return nfs_ok;
4124 }
4125
4126 static inline int nfs4_access_to_access(u32 nfs4_access)
4127 {
4128         int flags = 0;
4129
4130         if (nfs4_access & NFS4_SHARE_ACCESS_READ)
4131                 flags |= NFSD_MAY_READ;
4132         if (nfs4_access & NFS4_SHARE_ACCESS_WRITE)
4133                 flags |= NFSD_MAY_WRITE;
4134         return flags;
4135 }
4136
4137 static inline __be32
4138 nfsd4_truncate(struct svc_rqst *rqstp, struct svc_fh *fh,
4139                 struct nfsd4_open *open)
4140 {
4141         struct iattr iattr = {
4142                 .ia_valid = ATTR_SIZE,
4143                 .ia_size = 0,
4144         };
4145         if (!open->op_truncate)
4146                 return 0;
4147         if (!(open->op_share_access & NFS4_SHARE_ACCESS_WRITE))
4148                 return nfserr_inval;
4149         return nfsd_setattr(rqstp, fh, &iattr, 0, (time_t)0);
4150 }
4151
4152 static __be32 nfs4_get_vfs_file(struct svc_rqst *rqstp, struct nfs4_file *fp,
4153                 struct svc_fh *cur_fh, struct nfs4_ol_stateid *stp,
4154                 struct nfsd4_open *open)
4155 {
4156         struct file *filp = NULL;
4157         __be32 status;
4158         int oflag = nfs4_access_to_omode(open->op_share_access);
4159         int access = nfs4_access_to_access(open->op_share_access);
4160         unsigned char old_access_bmap, old_deny_bmap;
4161
4162         spin_lock(&fp->fi_lock);
4163
4164         /*
4165          * Are we trying to set a deny mode that would conflict with
4166          * current access?
4167          */
4168         status = nfs4_file_check_deny(fp, open->op_share_deny);
4169         if (status != nfs_ok) {
4170                 spin_unlock(&fp->fi_lock);
4171                 goto out;
4172         }
4173
4174         /* set access to the file */
4175         status = nfs4_file_get_access(fp, open->op_share_access);
4176         if (status != nfs_ok) {
4177                 spin_unlock(&fp->fi_lock);
4178                 goto out;
4179         }
4180
4181         /* Set access bits in stateid */
4182         old_access_bmap = stp->st_access_bmap;
4183         set_access(open->op_share_access, stp);
4184
4185         /* Set new deny mask */
4186         old_deny_bmap = stp->st_deny_bmap;
4187         set_deny(open->op_share_deny, stp);
4188         fp->fi_share_deny |= (open->op_share_deny & NFS4_SHARE_DENY_BOTH);
4189
4190         if (!fp->fi_fds[oflag]) {
4191                 spin_unlock(&fp->fi_lock);
4192                 status = nfsd_open(rqstp, cur_fh, S_IFREG, access, &filp);
4193                 if (status)
4194                         goto out_put_access;
4195                 spin_lock(&fp->fi_lock);
4196                 if (!fp->fi_fds[oflag]) {
4197                         fp->fi_fds[oflag] = filp;
4198                         filp = NULL;
4199                 }
4200         }
4201         spin_unlock(&fp->fi_lock);
4202         if (filp)
4203                 fput(filp);
4204
4205         status = nfsd4_truncate(rqstp, cur_fh, open);
4206         if (status)
4207                 goto out_put_access;
4208 out:
4209         return status;
4210 out_put_access:
4211         stp->st_access_bmap = old_access_bmap;
4212         nfs4_file_put_access(fp, open->op_share_access);
4213         reset_union_bmap_deny(bmap_to_share_mode(old_deny_bmap), stp);
4214         goto out;
4215 }
4216
4217 static __be32
4218 nfs4_upgrade_open(struct svc_rqst *rqstp, struct nfs4_file *fp, struct svc_fh *cur_fh, struct nfs4_ol_stateid *stp, struct nfsd4_open *open)
4219 {
4220         __be32 status;
4221         unsigned char old_deny_bmap = stp->st_deny_bmap;
4222
4223         if (!test_access(open->op_share_access, stp))
4224                 return nfs4_get_vfs_file(rqstp, fp, cur_fh, stp, open);
4225
4226         /* test and set deny mode */
4227         spin_lock(&fp->fi_lock);
4228         status = nfs4_file_check_deny(fp, open->op_share_deny);
4229         if (status == nfs_ok) {
4230                 set_deny(open->op_share_deny, stp);
4231                 fp->fi_share_deny |=
4232                                 (open->op_share_deny & NFS4_SHARE_DENY_BOTH);
4233         }
4234         spin_unlock(&fp->fi_lock);
4235
4236         if (status != nfs_ok)
4237                 return status;
4238
4239         status = nfsd4_truncate(rqstp, cur_fh, open);
4240         if (status != nfs_ok)
4241                 reset_union_bmap_deny(old_deny_bmap, stp);
4242         return status;
4243 }
4244
4245 /* Should we give out recallable state?: */
4246 static bool nfsd4_cb_channel_good(struct nfs4_client *clp)
4247 {
4248         if (clp->cl_cb_state == NFSD4_CB_UP)
4249                 return true;
4250         /*
4251          * In the sessions case, since we don't have to establish a
4252          * separate connection for callbacks, we assume it's OK
4253          * until we hear otherwise:
4254          */
4255         return clp->cl_minorversion && clp->cl_cb_state == NFSD4_CB_UNKNOWN;
4256 }
4257
4258 static struct file_lock *nfs4_alloc_init_lease(struct nfs4_file *fp, int flag)
4259 {
4260         struct file_lock *fl;
4261
4262         fl = locks_alloc_lock();
4263         if (!fl)
4264                 return NULL;
4265         fl->fl_lmops = &nfsd_lease_mng_ops;
4266         fl->fl_flags = FL_DELEG;
4267         fl->fl_type = flag == NFS4_OPEN_DELEGATE_READ? F_RDLCK: F_WRLCK;
4268         fl->fl_end = OFFSET_MAX;
4269         fl->fl_owner = (fl_owner_t)fp;
4270         fl->fl_pid = current->tgid;
4271         return fl;
4272 }
4273
4274 /**
4275  * nfs4_setlease - Obtain a delegation by requesting lease from vfs layer
4276  * @dp:   a pointer to the nfs4_delegation we're adding.
4277  *
4278  * Return:
4279  *      On success: Return code will be 0 on success.
4280  *
4281  *      On error: -EAGAIN if there was an existing delegation.
4282  *                 nonzero if there is an error in other cases.
4283  *
4284  */
4285
4286 static int nfs4_setlease(struct nfs4_delegation *dp)
4287 {
4288         struct nfs4_file *fp = dp->dl_stid.sc_file;
4289         struct file_lock *fl;
4290         struct file *filp;
4291         int status = 0;
4292
4293         fl = nfs4_alloc_init_lease(fp, NFS4_OPEN_DELEGATE_READ);
4294         if (!fl)
4295                 return -ENOMEM;
4296         filp = find_readable_file(fp);
4297         if (!filp) {
4298                 /* We should always have a readable file here */
4299                 WARN_ON_ONCE(1);
4300                 locks_free_lock(fl);
4301                 return -EBADF;
4302         }
4303         fl->fl_file = filp;
4304         status = vfs_setlease(filp, fl->fl_type, &fl, NULL);
4305         if (fl)
4306                 locks_free_lock(fl);
4307         if (status)
4308                 goto out_fput;
4309         spin_lock(&state_lock);
4310         spin_lock(&fp->fi_lock);
4311         /* Did the lease get broken before we took the lock? */
4312         status = -EAGAIN;
4313         if (fp->fi_had_conflict)
4314                 goto out_unlock;
4315         /* Race breaker */
4316         if (fp->fi_deleg_file) {
4317                 status = hash_delegation_locked(dp, fp);
4318                 goto out_unlock;
4319         }
4320         fp->fi_deleg_file = filp;
4321         fp->fi_delegees = 0;
4322         status = hash_delegation_locked(dp, fp);
4323         spin_unlock(&fp->fi_lock);
4324         spin_unlock(&state_lock);
4325         if (status) {
4326                 /* Should never happen, this is a new fi_deleg_file  */
4327                 WARN_ON_ONCE(1);
4328                 goto out_fput;
4329         }
4330         return 0;
4331 out_unlock:
4332         spin_unlock(&fp->fi_lock);
4333         spin_unlock(&state_lock);
4334 out_fput:
4335         fput(filp);
4336         return status;
4337 }
4338
4339 static struct nfs4_delegation *
4340 nfs4_set_delegation(struct nfs4_client *clp, struct svc_fh *fh,
4341                     struct nfs4_file *fp, struct nfs4_clnt_odstate *odstate)
4342 {
4343         int status;
4344         struct nfs4_delegation *dp;
4345
4346         if (fp->fi_had_conflict)
4347                 return ERR_PTR(-EAGAIN);
4348
4349         spin_lock(&state_lock);
4350         spin_lock(&fp->fi_lock);
4351         status = nfs4_get_existing_delegation(clp, fp);
4352         spin_unlock(&fp->fi_lock);
4353         spin_unlock(&state_lock);
4354
4355         if (status)
4356                 return ERR_PTR(status);
4357
4358         dp = alloc_init_deleg(clp, fh, odstate);
4359         if (!dp)
4360                 return ERR_PTR(-ENOMEM);
4361
4362         get_nfs4_file(fp);
4363         spin_lock(&state_lock);
4364         spin_lock(&fp->fi_lock);
4365         dp->dl_stid.sc_file = fp;
4366         if (!fp->fi_deleg_file) {
4367                 spin_unlock(&fp->fi_lock);
4368                 spin_unlock(&state_lock);
4369                 status = nfs4_setlease(dp);
4370                 goto out;
4371         }
4372         if (fp->fi_had_conflict) {
4373                 status = -EAGAIN;
4374                 goto out_unlock;
4375         }
4376         status = hash_delegation_locked(dp, fp);
4377 out_unlock:
4378         spin_unlock(&fp->fi_lock);
4379         spin_unlock(&state_lock);
4380 out:
4381         if (status) {
4382                 put_clnt_odstate(dp->dl_clnt_odstate);
4383                 nfs4_put_stid(&dp->dl_stid);
4384                 return ERR_PTR(status);
4385         }
4386         return dp;
4387 }
4388
4389 static void nfsd4_open_deleg_none_ext(struct nfsd4_open *open, int status)
4390 {
4391         open->op_delegate_type = NFS4_OPEN_DELEGATE_NONE_EXT;
4392         if (status == -EAGAIN)
4393                 open->op_why_no_deleg = WND4_CONTENTION;
4394         else {
4395                 open->op_why_no_deleg = WND4_RESOURCE;
4396                 switch (open->op_deleg_want) {
4397                 case NFS4_SHARE_WANT_READ_DELEG:
4398                 case NFS4_SHARE_WANT_WRITE_DELEG:
4399                 case NFS4_SHARE_WANT_ANY_DELEG:
4400                         break;
4401                 case NFS4_SHARE_WANT_CANCEL:
4402                         open->op_why_no_deleg = WND4_CANCELLED;
4403                         break;
4404                 case NFS4_SHARE_WANT_NO_DELEG:
4405                         WARN_ON_ONCE(1);
4406                 }
4407         }
4408 }
4409
4410 /*
4411  * Attempt to hand out a delegation.
4412  *
4413  * Note we don't support write delegations, and won't until the vfs has
4414  * proper support for them.
4415  */
4416 static void
4417 nfs4_open_delegation(struct svc_fh *fh, struct nfsd4_open *open,
4418                         struct nfs4_ol_stateid *stp)
4419 {
4420         struct nfs4_delegation *dp;
4421         struct nfs4_openowner *oo = openowner(stp->st_stateowner);
4422         struct nfs4_client *clp = stp->st_stid.sc_client;
4423         int cb_up;
4424         int status = 0;
4425
4426         cb_up = nfsd4_cb_channel_good(oo->oo_owner.so_client);
4427         open->op_recall = 0;
4428         switch (open->op_claim_type) {
4429                 case NFS4_OPEN_CLAIM_PREVIOUS:
4430                         if (!cb_up)
4431                                 open->op_recall = 1;
4432                         if (open->op_delegate_type != NFS4_OPEN_DELEGATE_READ)
4433                                 goto out_no_deleg;
4434                         break;
4435                 case NFS4_OPEN_CLAIM_NULL:
4436                 case NFS4_OPEN_CLAIM_FH:
4437                         /*
4438                          * Let's not give out any delegations till everyone's
4439                          * had the chance to reclaim theirs, *and* until
4440                          * NLM locks have all been reclaimed:
4441                          */
4442                         if (locks_in_grace(clp->net))
4443                                 goto out_no_deleg;
4444                         if (!cb_up || !(oo->oo_flags & NFS4_OO_CONFIRMED))
4445                                 goto out_no_deleg;
4446                         /*
4447                          * Also, if the file was opened for write or
4448                          * create, there's a good chance the client's
4449                          * about to write to it, resulting in an
4450                          * immediate recall (since we don't support
4451                          * write delegations):
4452                          */
4453                         if (open->op_share_access & NFS4_SHARE_ACCESS_WRITE)
4454                                 goto out_no_deleg;
4455                         if (open->op_create == NFS4_OPEN_CREATE)
4456                                 goto out_no_deleg;
4457                         break;
4458                 default:
4459                         goto out_no_deleg;
4460         }
4461         dp = nfs4_set_delegation(clp, fh, stp->st_stid.sc_file, stp->st_clnt_odstate);
4462         if (IS_ERR(dp))
4463                 goto out_no_deleg;
4464
4465         memcpy(&open->op_delegate_stateid, &dp->dl_stid.sc_stateid, sizeof(dp->dl_stid.sc_stateid));
4466
4467         dprintk("NFSD: delegation stateid=" STATEID_FMT "\n",
4468                 STATEID_VAL(&dp->dl_stid.sc_stateid));
4469         open->op_delegate_type = NFS4_OPEN_DELEGATE_READ;
4470         nfs4_put_stid(&dp->dl_stid);
4471         return;
4472 out_no_deleg:
4473         open->op_delegate_type = NFS4_OPEN_DELEGATE_NONE;
4474         if (open->op_claim_type == NFS4_OPEN_CLAIM_PREVIOUS &&
4475             open->op_delegate_type != NFS4_OPEN_DELEGATE_NONE) {
4476                 dprintk("NFSD: WARNING: refusing delegation reclaim\n");
4477                 open->op_recall = 1;
4478         }
4479
4480         /* 4.1 client asking for a delegation? */
4481         if (open->op_deleg_want)
4482                 nfsd4_open_deleg_none_ext(open, status);
4483         return;
4484 }
4485
4486 static void nfsd4_deleg_xgrade_none_ext(struct nfsd4_open *open,
4487                                         struct nfs4_delegation *dp)
4488 {
4489         if (open->op_deleg_want == NFS4_SHARE_WANT_READ_DELEG &&
4490             dp->dl_type == NFS4_OPEN_DELEGATE_WRITE) {
4491                 open->op_delegate_type = NFS4_OPEN_DELEGATE_NONE_EXT;
4492                 open->op_why_no_deleg = WND4_NOT_SUPP_DOWNGRADE;
4493         } else if (open->op_deleg_want == NFS4_SHARE_WANT_WRITE_DELEG &&
4494                    dp->dl_type == NFS4_OPEN_DELEGATE_WRITE) {
4495                 open->op_delegate_type = NFS4_OPEN_DELEGATE_NONE_EXT;
4496                 open->op_why_no_deleg = WND4_NOT_SUPP_UPGRADE;
4497         }
4498         /* Otherwise the client must be confused wanting a delegation
4499          * it already has, therefore we don't return
4500          * NFS4_OPEN_DELEGATE_NONE_EXT and reason.
4501          */
4502 }
4503
4504 __be32
4505 nfsd4_process_open2(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_open *open)
4506 {
4507         struct nfsd4_compoundres *resp = rqstp->rq_resp;
4508         struct nfs4_client *cl = open->op_openowner->oo_owner.so_client;
4509         struct nfs4_file *fp = NULL;
4510         struct nfs4_ol_stateid *stp = NULL;
4511         struct nfs4_delegation *dp = NULL;
4512         __be32 status;
4513         bool new_stp = false;
4514
4515         /*
4516          * Lookup file; if found, lookup stateid and check open request,
4517          * and check for delegations in the process of being recalled.
4518          * If not found, create the nfs4_file struct
4519          */
4520         fp = find_or_add_file(open->op_file, &current_fh->fh_handle);
4521         if (fp != open->op_file) {
4522                 status = nfs4_check_deleg(cl, open, &dp);
4523                 if (status)
4524                         goto out;
4525                 stp = nfsd4_find_and_lock_existing_open(fp, open);
4526         } else {
4527                 open->op_file = NULL;
4528                 status = nfserr_bad_stateid;
4529                 if (nfsd4_is_deleg_cur(open))
4530                         goto out;
4531         }
4532
4533         if (!stp) {
4534                 stp = init_open_stateid(fp, open);
4535                 if (!open->op_stp)
4536                         new_stp = true;
4537         }
4538
4539         /*
4540          * OPEN the file, or upgrade an existing OPEN.
4541          * If truncate fails, the OPEN fails.
4542          *
4543          * stp is already locked.
4544          */
4545         if (!new_stp) {
4546                 /* Stateid was found, this is an OPEN upgrade */
4547                 status = nfs4_upgrade_open(rqstp, fp, current_fh, stp, open);
4548                 if (status) {
4549                         mutex_unlock(&stp->st_mutex);
4550                         goto out;
4551                 }
4552         } else {
4553                 status = nfs4_get_vfs_file(rqstp, fp, current_fh, stp, open);
4554                 if (status) {
4555                         stp->st_stid.sc_type = NFS4_CLOSED_STID;
4556                         release_open_stateid(stp);
4557                         mutex_unlock(&stp->st_mutex);
4558                         goto out;
4559                 }
4560
4561                 stp->st_clnt_odstate = find_or_hash_clnt_odstate(fp,
4562                                                         open->op_odstate);
4563                 if (stp->st_clnt_odstate == open->op_odstate)
4564                         open->op_odstate = NULL;
4565         }
4566
4567         nfs4_inc_and_copy_stateid(&open->op_stateid, &stp->st_stid);
4568         mutex_unlock(&stp->st_mutex);
4569
4570         if (nfsd4_has_session(&resp->cstate)) {
4571                 if (open->op_deleg_want & NFS4_SHARE_WANT_NO_DELEG) {
4572                         open->op_delegate_type = NFS4_OPEN_DELEGATE_NONE_EXT;
4573                         open->op_why_no_deleg = WND4_NOT_WANTED;
4574                         goto nodeleg;
4575                 }
4576         }
4577
4578         /*
4579         * Attempt to hand out a delegation. No error return, because the
4580         * OPEN succeeds even if we fail.
4581         */
4582         nfs4_open_delegation(current_fh, open, stp);
4583 nodeleg:
4584         status = nfs_ok;
4585
4586         dprintk("%s: stateid=" STATEID_FMT "\n", __func__,
4587                 STATEID_VAL(&stp->st_stid.sc_stateid));
4588 out:
4589         /* 4.1 client trying to upgrade/downgrade delegation? */
4590         if (open->op_delegate_type == NFS4_OPEN_DELEGATE_NONE && dp &&
4591             open->op_deleg_want)
4592                 nfsd4_deleg_xgrade_none_ext(open, dp);
4593
4594         if (fp)
4595                 put_nfs4_file(fp);
4596         if (status == 0 && open->op_claim_type == NFS4_OPEN_CLAIM_PREVIOUS)
4597                 open->op_openowner->oo_flags |= NFS4_OO_CONFIRMED;
4598         /*
4599         * To finish the open response, we just need to set the rflags.
4600         */
4601         open->op_rflags = NFS4_OPEN_RESULT_LOCKTYPE_POSIX;
4602         if (nfsd4_has_session(&resp->cstate))
4603                 open->op_rflags |= NFS4_OPEN_RESULT_MAY_NOTIFY_LOCK;
4604         else if (!(open->op_openowner->oo_flags & NFS4_OO_CONFIRMED))
4605                 open->op_rflags |= NFS4_OPEN_RESULT_CONFIRM;
4606
4607         if (dp)
4608                 nfs4_put_stid(&dp->dl_stid);
4609         if (stp)
4610                 nfs4_put_stid(&stp->st_stid);
4611
4612         return status;
4613 }
4614
4615 void nfsd4_cleanup_open_state(struct nfsd4_compound_state *cstate,
4616                               struct nfsd4_open *open)
4617 {
4618         if (open->op_openowner) {
4619                 struct nfs4_stateowner *so = &open->op_openowner->oo_owner;
4620
4621                 nfsd4_cstate_assign_replay(cstate, so);
4622                 nfs4_put_stateowner(so);
4623         }
4624         if (open->op_file)
4625                 kmem_cache_free(file_slab, open->op_file);
4626         if (open->op_stp)
4627                 nfs4_put_stid(&open->op_stp->st_stid);
4628         if (open->op_odstate)
4629                 kmem_cache_free(odstate_slab, open->op_odstate);
4630 }
4631
4632 __be32
4633 nfsd4_renew(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
4634             union nfsd4_op_u *u)
4635 {
4636         clientid_t *clid = &u->renew;
4637         struct nfs4_client *clp;
4638         __be32 status;
4639         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
4640
4641         dprintk("process_renew(%08x/%08x): starting\n",
4642                         clid->cl_boot, clid->cl_id);
4643         status = lookup_clientid(clid, cstate, nn);
4644         if (status)
4645                 goto out;
4646         clp = cstate->clp;
4647         status = nfserr_cb_path_down;
4648         if (!list_empty(&clp->cl_delegations)
4649                         && clp->cl_cb_state != NFSD4_CB_UP)
4650                 goto out;
4651         status = nfs_ok;
4652 out:
4653         return status;
4654 }
4655
4656 void
4657 nfsd4_end_grace(struct nfsd_net *nn)
4658 {
4659         /* do nothing if grace period already ended */
4660         if (nn->grace_ended)
4661                 return;
4662
4663         dprintk("NFSD: end of grace period\n");
4664         nn->grace_ended = true;
4665         /*
4666          * If the server goes down again right now, an NFSv4
4667          * client will still be allowed to reclaim after it comes back up,
4668          * even if it hasn't yet had a chance to reclaim state this time.
4669          *
4670          */
4671         nfsd4_record_grace_done(nn);
4672         /*
4673          * At this point, NFSv4 clients can still reclaim.  But if the
4674          * server crashes, any that have not yet reclaimed will be out
4675          * of luck on the next boot.
4676          *
4677          * (NFSv4.1+ clients are considered to have reclaimed once they
4678          * call RECLAIM_COMPLETE.  NFSv4.0 clients are considered to
4679          * have reclaimed after their first OPEN.)
4680          */
4681         locks_end_grace(&nn->nfsd4_manager);
4682         /*
4683          * At this point, and once lockd and/or any other containers
4684          * exit their grace period, further reclaims will fail and
4685          * regular locking can resume.
4686          */
4687 }
4688
4689 static time_t
4690 nfs4_laundromat(struct nfsd_net *nn)
4691 {
4692         struct nfs4_client *clp;
4693         struct nfs4_openowner *oo;
4694         struct nfs4_delegation *dp;
4695         struct nfs4_ol_stateid *stp;
4696         struct nfsd4_blocked_lock *nbl;
4697         struct list_head *pos, *next, reaplist;
4698         time_t cutoff = get_seconds() - nn->nfsd4_lease;
4699         time_t t, new_timeo = nn->nfsd4_lease;
4700
4701         dprintk("NFSD: laundromat service - starting\n");
4702         nfsd4_end_grace(nn);
4703         INIT_LIST_HEAD(&reaplist);
4704         spin_lock(&nn->client_lock);
4705         list_for_each_safe(pos, next, &nn->client_lru) {
4706                 clp = list_entry(pos, struct nfs4_client, cl_lru);
4707                 if (time_after((unsigned long)clp->cl_time, (unsigned long)cutoff)) {
4708                         t = clp->cl_time - cutoff;
4709                         new_timeo = min(new_timeo, t);
4710                         break;
4711                 }
4712                 if (mark_client_expired_locked(clp)) {
4713                         dprintk("NFSD: client in use (clientid %08x)\n",
4714                                 clp->cl_clientid.cl_id);
4715                         continue;
4716                 }
4717                 list_add(&clp->cl_lru, &reaplist);
4718         }
4719         spin_unlock(&nn->client_lock);
4720         list_for_each_safe(pos, next, &reaplist) {
4721                 clp = list_entry(pos, struct nfs4_client, cl_lru);
4722                 dprintk("NFSD: purging unused client (clientid %08x)\n",
4723                         clp->cl_clientid.cl_id);
4724                 list_del_init(&clp->cl_lru);
4725                 expire_client(clp);
4726         }
4727         spin_lock(&state_lock);
4728         list_for_each_safe(pos, next, &nn->del_recall_lru) {
4729                 dp = list_entry (pos, struct nfs4_delegation, dl_recall_lru);
4730                 if (time_after((unsigned long)dp->dl_time, (unsigned long)cutoff)) {
4731                         t = dp->dl_time - cutoff;
4732                         new_timeo = min(new_timeo, t);
4733                         break;
4734                 }
4735                 WARN_ON(!unhash_delegation_locked(dp));
4736                 list_add(&dp->dl_recall_lru, &reaplist);
4737         }
4738         spin_unlock(&state_lock);
4739         while (!list_empty(&reaplist)) {
4740                 dp = list_first_entry(&reaplist, struct nfs4_delegation,
4741                                         dl_recall_lru);
4742                 list_del_init(&dp->dl_recall_lru);
4743                 revoke_delegation(dp);
4744         }
4745
4746         spin_lock(&nn->client_lock);
4747         while (!list_empty(&nn->close_lru)) {
4748                 oo = list_first_entry(&nn->close_lru, struct nfs4_openowner,
4749                                         oo_close_lru);
4750                 if (time_after((unsigned long)oo->oo_time,
4751                                (unsigned long)cutoff)) {
4752                         t = oo->oo_time - cutoff;
4753                         new_timeo = min(new_timeo, t);
4754                         break;
4755                 }
4756                 list_del_init(&oo->oo_close_lru);
4757                 stp = oo->oo_last_closed_stid;
4758                 oo->oo_last_closed_stid = NULL;
4759                 spin_unlock(&nn->client_lock);
4760                 nfs4_put_stid(&stp->st_stid);
4761                 spin_lock(&nn->client_lock);
4762         }
4763         spin_unlock(&nn->client_lock);
4764
4765         /*
4766          * It's possible for a client to try and acquire an already held lock
4767          * that is being held for a long time, and then lose interest in it.
4768          * So, we clean out any un-revisited request after a lease period
4769          * under the assumption that the client is no longer interested.
4770          *
4771          * RFC5661, sec. 9.6 states that the client must not rely on getting
4772          * notifications and must continue to poll for locks, even when the
4773          * server supports them. Thus this shouldn't lead to clients blocking
4774          * indefinitely once the lock does become free.
4775          */
4776         BUG_ON(!list_empty(&reaplist));
4777         spin_lock(&nn->blocked_locks_lock);
4778         while (!list_empty(&nn->blocked_locks_lru)) {
4779                 nbl = list_first_entry(&nn->blocked_locks_lru,
4780                                         struct nfsd4_blocked_lock, nbl_lru);
4781                 if (time_after((unsigned long)nbl->nbl_time,
4782                                (unsigned long)cutoff)) {
4783                         t = nbl->nbl_time - cutoff;
4784                         new_timeo = min(new_timeo, t);
4785                         break;
4786                 }
4787                 list_move(&nbl->nbl_lru, &reaplist);
4788                 list_del_init(&nbl->nbl_list);
4789         }
4790         spin_unlock(&nn->blocked_locks_lock);
4791
4792         while (!list_empty(&reaplist)) {
4793                 nbl = list_first_entry(&reaplist,
4794                                         struct nfsd4_blocked_lock, nbl_lru);
4795                 list_del_init(&nbl->nbl_lru);
4796                 posix_unblock_lock(&nbl->nbl_lock);
4797                 free_blocked_lock(nbl);
4798         }
4799
4800         new_timeo = max_t(time_t, new_timeo, NFSD_LAUNDROMAT_MINTIMEOUT);
4801         return new_timeo;
4802 }
4803
4804 static struct workqueue_struct *laundry_wq;
4805 static void laundromat_main(struct work_struct *);
4806
4807 static void
4808 laundromat_main(struct work_struct *laundry)
4809 {
4810         time_t t;
4811         struct delayed_work *dwork = to_delayed_work(laundry);
4812         struct nfsd_net *nn = container_of(dwork, struct nfsd_net,
4813                                            laundromat_work);
4814
4815         t = nfs4_laundromat(nn);
4816         dprintk("NFSD: laundromat_main - sleeping for %ld seconds\n", t);
4817         queue_delayed_work(laundry_wq, &nn->laundromat_work, t*HZ);
4818 }
4819
4820 static inline __be32 nfs4_check_fh(struct svc_fh *fhp, struct nfs4_stid *stp)
4821 {
4822         if (!fh_match(&fhp->fh_handle, &stp->sc_file->fi_fhandle))
4823                 return nfserr_bad_stateid;
4824         return nfs_ok;
4825 }
4826
4827 static inline int
4828 access_permit_read(struct nfs4_ol_stateid *stp)
4829 {
4830         return test_access(NFS4_SHARE_ACCESS_READ, stp) ||
4831                 test_access(NFS4_SHARE_ACCESS_BOTH, stp) ||
4832                 test_access(NFS4_SHARE_ACCESS_WRITE, stp);
4833 }
4834
4835 static inline int
4836 access_permit_write(struct nfs4_ol_stateid *stp)
4837 {
4838         return test_access(NFS4_SHARE_ACCESS_WRITE, stp) ||
4839                 test_access(NFS4_SHARE_ACCESS_BOTH, stp);
4840 }
4841
4842 static
4843 __be32 nfs4_check_openmode(struct nfs4_ol_stateid *stp, int flags)
4844 {
4845         __be32 status = nfserr_openmode;
4846
4847         /* For lock stateid's, we test the parent open, not the lock: */
4848         if (stp->st_openstp)
4849                 stp = stp->st_openstp;
4850         if ((flags & WR_STATE) && !access_permit_write(stp))
4851                 goto out;
4852         if ((flags & RD_STATE) && !access_permit_read(stp))
4853                 goto out;
4854         status = nfs_ok;
4855 out:
4856         return status;
4857 }
4858
4859 static inline __be32
4860 check_special_stateids(struct net *net, svc_fh *current_fh, stateid_t *stateid, int flags)
4861 {
4862         if (ONE_STATEID(stateid) && (flags & RD_STATE))
4863                 return nfs_ok;
4864         else if (opens_in_grace(net)) {
4865                 /* Answer in remaining cases depends on existence of
4866                  * conflicting state; so we must wait out the grace period. */
4867                 return nfserr_grace;
4868         } else if (flags & WR_STATE)
4869                 return nfs4_share_conflict(current_fh,
4870                                 NFS4_SHARE_DENY_WRITE);
4871         else /* (flags & RD_STATE) && ZERO_STATEID(stateid) */
4872                 return nfs4_share_conflict(current_fh,
4873                                 NFS4_SHARE_DENY_READ);
4874 }
4875
4876 /*
4877  * Allow READ/WRITE during grace period on recovered state only for files
4878  * that are not able to provide mandatory locking.
4879  */
4880 static inline int
4881 grace_disallows_io(struct net *net, struct inode *inode)
4882 {
4883         return opens_in_grace(net) && mandatory_lock(inode);
4884 }
4885
4886 static __be32 check_stateid_generation(stateid_t *in, stateid_t *ref, bool has_session)
4887 {
4888         /*
4889          * When sessions are used the stateid generation number is ignored
4890          * when it is zero.
4891          */
4892         if (has_session && in->si_generation == 0)
4893                 return nfs_ok;
4894
4895         if (in->si_generation == ref->si_generation)
4896                 return nfs_ok;
4897
4898         /* If the client sends us a stateid from the future, it's buggy: */
4899         if (nfsd4_stateid_generation_after(in, ref))
4900                 return nfserr_bad_stateid;
4901         /*
4902          * However, we could see a stateid from the past, even from a
4903          * non-buggy client.  For example, if the client sends a lock
4904          * while some IO is outstanding, the lock may bump si_generation
4905          * while the IO is still in flight.  The client could avoid that
4906          * situation by waiting for responses on all the IO requests,
4907          * but better performance may result in retrying IO that
4908          * receives an old_stateid error if requests are rarely
4909          * reordered in flight:
4910          */
4911         return nfserr_old_stateid;
4912 }
4913
4914 static __be32 nfsd4_stid_check_stateid_generation(stateid_t *in, struct nfs4_stid *s, bool has_session)
4915 {
4916         __be32 ret;
4917
4918         spin_lock(&s->sc_lock);
4919         ret = nfsd4_verify_open_stid(s);
4920         if (ret == nfs_ok)
4921                 ret = check_stateid_generation(in, &s->sc_stateid, has_session);
4922         spin_unlock(&s->sc_lock);
4923         return ret;
4924 }
4925
4926 static __be32 nfsd4_check_openowner_confirmed(struct nfs4_ol_stateid *ols)
4927 {
4928         if (ols->st_stateowner->so_is_open_owner &&
4929             !(openowner(ols->st_stateowner)->oo_flags & NFS4_OO_CONFIRMED))
4930                 return nfserr_bad_stateid;
4931         return nfs_ok;
4932 }
4933
4934 static __be32 nfsd4_validate_stateid(struct nfs4_client *cl, stateid_t *stateid)
4935 {
4936         struct nfs4_stid *s;
4937         __be32 status = nfserr_bad_stateid;
4938
4939         if (ZERO_STATEID(stateid) || ONE_STATEID(stateid))
4940                 return status;
4941         /* Client debugging aid. */
4942         if (!same_clid(&stateid->si_opaque.so_clid, &cl->cl_clientid)) {
4943                 char addr_str[INET6_ADDRSTRLEN];
4944                 rpc_ntop((struct sockaddr *)&cl->cl_addr, addr_str,
4945                                  sizeof(addr_str));
4946                 pr_warn_ratelimited("NFSD: client %s testing state ID "
4947                                         "with incorrect client ID\n", addr_str);
4948                 return status;
4949         }
4950         spin_lock(&cl->cl_lock);
4951         s = find_stateid_locked(cl, stateid);
4952         if (!s)
4953                 goto out_unlock;
4954         status = nfsd4_stid_check_stateid_generation(stateid, s, 1);
4955         if (status)
4956                 goto out_unlock;
4957         switch (s->sc_type) {
4958         case NFS4_DELEG_STID:
4959                 status = nfs_ok;
4960                 break;
4961         case NFS4_REVOKED_DELEG_STID:
4962                 status = nfserr_deleg_revoked;
4963                 break;
4964         case NFS4_OPEN_STID:
4965         case NFS4_LOCK_STID:
4966                 status = nfsd4_check_openowner_confirmed(openlockstateid(s));
4967                 break;
4968         default:
4969                 printk("unknown stateid type %x\n", s->sc_type);
4970                 /* Fallthrough */
4971         case NFS4_CLOSED_STID:
4972         case NFS4_CLOSED_DELEG_STID:
4973                 status = nfserr_bad_stateid;
4974         }
4975 out_unlock:
4976         spin_unlock(&cl->cl_lock);
4977         return status;
4978 }
4979
4980 __be32
4981 nfsd4_lookup_stateid(struct nfsd4_compound_state *cstate,
4982                      stateid_t *stateid, unsigned char typemask,
4983                      struct nfs4_stid **s, struct nfsd_net *nn)
4984 {
4985         __be32 status;
4986         bool return_revoked = false;
4987
4988         /*
4989          *  only return revoked delegations if explicitly asked.
4990          *  otherwise we report revoked or bad_stateid status.
4991          */
4992         if (typemask & NFS4_REVOKED_DELEG_STID)
4993                 return_revoked = true;
4994         else if (typemask & NFS4_DELEG_STID)
4995                 typemask |= NFS4_REVOKED_DELEG_STID;
4996
4997         if (ZERO_STATEID(stateid) || ONE_STATEID(stateid))
4998                 return nfserr_bad_stateid;
4999         status = lookup_clientid(&stateid->si_opaque.so_clid, cstate, nn);
5000         if (status == nfserr_stale_clientid) {
5001                 if (cstate->session)
5002                         return nfserr_bad_stateid;
5003                 return nfserr_stale_stateid;
5004         }
5005         if (status)
5006                 return status;
5007         *s = find_stateid_by_type(cstate->clp, stateid, typemask);
5008         if (!*s)
5009                 return nfserr_bad_stateid;
5010         if (((*s)->sc_type == NFS4_REVOKED_DELEG_STID) && !return_revoked) {
5011                 nfs4_put_stid(*s);
5012                 if (cstate->minorversion)
5013                         return nfserr_deleg_revoked;
5014                 return nfserr_bad_stateid;
5015         }
5016         return nfs_ok;
5017 }
5018
5019 static struct file *
5020 nfs4_find_file(struct nfs4_stid *s, int flags)
5021 {
5022         if (!s)
5023                 return NULL;
5024
5025         switch (s->sc_type) {
5026         case NFS4_DELEG_STID:
5027                 if (WARN_ON_ONCE(!s->sc_file->fi_deleg_file))
5028                         return NULL;
5029                 return get_file(s->sc_file->fi_deleg_file);
5030         case NFS4_OPEN_STID:
5031         case NFS4_LOCK_STID:
5032                 if (flags & RD_STATE)
5033                         return find_readable_file(s->sc_file);
5034                 else
5035                         return find_writeable_file(s->sc_file);
5036                 break;
5037         }
5038
5039         return NULL;
5040 }
5041
5042 static __be32
5043 nfs4_check_olstateid(struct svc_fh *fhp, struct nfs4_ol_stateid *ols, int flags)
5044 {
5045         __be32 status;
5046
5047         status = nfsd4_check_openowner_confirmed(ols);
5048         if (status)
5049                 return status;
5050         return nfs4_check_openmode(ols, flags);
5051 }
5052
5053 static __be32
5054 nfs4_check_file(struct svc_rqst *rqstp, struct svc_fh *fhp, struct nfs4_stid *s,
5055                 struct file **filpp, bool *tmp_file, int flags)
5056 {
5057         int acc = (flags & RD_STATE) ? NFSD_MAY_READ : NFSD_MAY_WRITE;
5058         struct file *file;
5059         __be32 status;
5060
5061         file = nfs4_find_file(s, flags);
5062         if (file) {
5063                 status = nfsd_permission(rqstp, fhp->fh_export, fhp->fh_dentry,
5064                                 acc | NFSD_MAY_OWNER_OVERRIDE);
5065                 if (status) {
5066                         fput(file);
5067                         return status;
5068                 }
5069
5070                 *filpp = file;
5071         } else {
5072                 status = nfsd_open(rqstp, fhp, S_IFREG, acc, filpp);
5073                 if (status)
5074                         return status;
5075
5076                 if (tmp_file)
5077                         *tmp_file = true;
5078         }
5079
5080         return 0;
5081 }
5082
5083 /*
5084  * Checks for stateid operations
5085  */
5086 __be32
5087 nfs4_preprocess_stateid_op(struct svc_rqst *rqstp,
5088                 struct nfsd4_compound_state *cstate, struct svc_fh *fhp,
5089                 stateid_t *stateid, int flags, struct file **filpp, bool *tmp_file)
5090 {
5091         struct inode *ino = d_inode(fhp->fh_dentry);
5092         struct net *net = SVC_NET(rqstp);
5093         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
5094         struct nfs4_stid *s = NULL;
5095         __be32 status;
5096
5097         if (filpp)
5098                 *filpp = NULL;
5099         if (tmp_file)
5100                 *tmp_file = false;
5101
5102         if (grace_disallows_io(net, ino))
5103                 return nfserr_grace;
5104
5105         if (ZERO_STATEID(stateid) || ONE_STATEID(stateid)) {
5106                 status = check_special_stateids(net, fhp, stateid, flags);
5107                 goto done;
5108         }
5109
5110         status = nfsd4_lookup_stateid(cstate, stateid,
5111                                 NFS4_DELEG_STID|NFS4_OPEN_STID|NFS4_LOCK_STID,
5112                                 &s, nn);
5113         if (status)
5114                 return status;
5115         status = nfsd4_stid_check_stateid_generation(stateid, s,
5116                         nfsd4_has_session(cstate));
5117         if (status)
5118                 goto out;
5119
5120         switch (s->sc_type) {
5121         case NFS4_DELEG_STID:
5122                 status = nfs4_check_delegmode(delegstateid(s), flags);
5123                 break;
5124         case NFS4_OPEN_STID:
5125         case NFS4_LOCK_STID:
5126                 status = nfs4_check_olstateid(fhp, openlockstateid(s), flags);
5127                 break;
5128         default:
5129                 status = nfserr_bad_stateid;
5130                 break;
5131         }
5132         if (status)
5133                 goto out;
5134         status = nfs4_check_fh(fhp, s);
5135
5136 done:
5137         if (!status && filpp)
5138                 status = nfs4_check_file(rqstp, fhp, s, filpp, tmp_file, flags);
5139 out:
5140         if (s)
5141                 nfs4_put_stid(s);
5142         return status;
5143 }
5144
5145 /*
5146  * Test if the stateid is valid
5147  */
5148 __be32
5149 nfsd4_test_stateid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
5150                    union nfsd4_op_u *u)
5151 {
5152         struct nfsd4_test_stateid *test_stateid = &u->test_stateid;
5153         struct nfsd4_test_stateid_id *stateid;
5154         struct nfs4_client *cl = cstate->session->se_client;
5155
5156         list_for_each_entry(stateid, &test_stateid->ts_stateid_list, ts_id_list)
5157                 stateid->ts_id_status =
5158                         nfsd4_validate_stateid(cl, &stateid->ts_id_stateid);
5159
5160         return nfs_ok;
5161 }
5162
5163 static __be32
5164 nfsd4_free_lock_stateid(stateid_t *stateid, struct nfs4_stid *s)
5165 {
5166         struct nfs4_ol_stateid *stp = openlockstateid(s);
5167         __be32 ret;
5168
5169         ret = nfsd4_lock_ol_stateid(stp);
5170         if (ret)
5171                 goto out_put_stid;
5172
5173         ret = check_stateid_generation(stateid, &s->sc_stateid, 1);
5174         if (ret)
5175                 goto out;
5176
5177         ret = nfserr_locks_held;
5178         if (check_for_locks(stp->st_stid.sc_file,
5179                             lockowner(stp->st_stateowner)))
5180                 goto out;
5181
5182         stp->st_stid.sc_type = NFS4_CLOSED_STID;
5183         release_lock_stateid(stp);
5184         ret = nfs_ok;
5185
5186 out:
5187         mutex_unlock(&stp->st_mutex);
5188 out_put_stid:
5189         nfs4_put_stid(s);
5190         return ret;
5191 }
5192
5193 __be32
5194 nfsd4_free_stateid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
5195                    union nfsd4_op_u *u)
5196 {
5197         struct nfsd4_free_stateid *free_stateid = &u->free_stateid;
5198         stateid_t *stateid = &free_stateid->fr_stateid;
5199         struct nfs4_stid *s;
5200         struct nfs4_delegation *dp;
5201         struct nfs4_client *cl = cstate->session->se_client;
5202         __be32 ret = nfserr_bad_stateid;
5203
5204         spin_lock(&cl->cl_lock);
5205         s = find_stateid_locked(cl, stateid);
5206         if (!s)
5207                 goto out_unlock;
5208         spin_lock(&s->sc_lock);
5209         switch (s->sc_type) {
5210         case NFS4_DELEG_STID:
5211                 ret = nfserr_locks_held;
5212                 break;
5213         case NFS4_OPEN_STID:
5214                 ret = check_stateid_generation(stateid, &s->sc_stateid, 1);
5215                 if (ret)
5216                         break;
5217                 ret = nfserr_locks_held;
5218                 break;
5219         case NFS4_LOCK_STID:
5220                 spin_unlock(&s->sc_lock);
5221                 refcount_inc(&s->sc_count);
5222                 spin_unlock(&cl->cl_lock);
5223                 ret = nfsd4_free_lock_stateid(stateid, s);
5224                 goto out;
5225         case NFS4_REVOKED_DELEG_STID:
5226                 spin_unlock(&s->sc_lock);
5227                 dp = delegstateid(s);
5228                 list_del_init(&dp->dl_recall_lru);
5229                 spin_unlock(&cl->cl_lock);
5230                 nfs4_put_stid(s);
5231                 ret = nfs_ok;
5232                 goto out;
5233         /* Default falls through and returns nfserr_bad_stateid */
5234         }
5235         spin_unlock(&s->sc_lock);
5236 out_unlock:
5237         spin_unlock(&cl->cl_lock);
5238 out:
5239         return ret;
5240 }
5241
5242 static inline int
5243 setlkflg (int type)
5244 {
5245         return (type == NFS4_READW_LT || type == NFS4_READ_LT) ?
5246                 RD_STATE : WR_STATE;
5247 }
5248
5249 static __be32 nfs4_seqid_op_checks(struct nfsd4_compound_state *cstate, stateid_t *stateid, u32 seqid, struct nfs4_ol_stateid *stp)
5250 {
5251         struct svc_fh *current_fh = &cstate->current_fh;
5252         struct nfs4_stateowner *sop = stp->st_stateowner;
5253         __be32 status;
5254
5255         status = nfsd4_check_seqid(cstate, sop, seqid);
5256         if (status)
5257                 return status;
5258         status = nfsd4_lock_ol_stateid(stp);
5259         if (status != nfs_ok)
5260                 return status;
5261         status = check_stateid_generation(stateid, &stp->st_stid.sc_stateid, nfsd4_has_session(cstate));
5262         if (status == nfs_ok)
5263                 status = nfs4_check_fh(current_fh, &stp->st_stid);
5264         if (status != nfs_ok)
5265                 mutex_unlock(&stp->st_mutex);
5266         return status;
5267 }
5268
5269 /*
5270  * Checks for sequence id mutating operations.
5271  */
5272 static __be32
5273 nfs4_preprocess_seqid_op(struct nfsd4_compound_state *cstate, u32 seqid,
5274                          stateid_t *stateid, char typemask,
5275                          struct nfs4_ol_stateid **stpp,
5276                          struct nfsd_net *nn)
5277 {
5278         __be32 status;
5279         struct nfs4_stid *s;
5280         struct nfs4_ol_stateid *stp = NULL;
5281
5282         dprintk("NFSD: %s: seqid=%d stateid = " STATEID_FMT "\n", __func__,
5283                 seqid, STATEID_VAL(stateid));
5284
5285         *stpp = NULL;
5286         status = nfsd4_lookup_stateid(cstate, stateid, typemask, &s, nn);
5287         if (status)
5288                 return status;
5289         stp = openlockstateid(s);
5290         nfsd4_cstate_assign_replay(cstate, stp->st_stateowner);
5291
5292         status = nfs4_seqid_op_checks(cstate, stateid, seqid, stp);
5293         if (!status)
5294                 *stpp = stp;
5295         else
5296                 nfs4_put_stid(&stp->st_stid);
5297         return status;
5298 }
5299
5300 static __be32 nfs4_preprocess_confirmed_seqid_op(struct nfsd4_compound_state *cstate, u32 seqid,
5301                                                  stateid_t *stateid, struct nfs4_ol_stateid **stpp, struct nfsd_net *nn)
5302 {
5303         __be32 status;
5304         struct nfs4_openowner *oo;
5305         struct nfs4_ol_stateid *stp;
5306
5307         status = nfs4_preprocess_seqid_op(cstate, seqid, stateid,
5308                                                 NFS4_OPEN_STID, &stp, nn);
5309         if (status)
5310                 return status;
5311         oo = openowner(stp->st_stateowner);
5312         if (!(oo->oo_flags & NFS4_OO_CONFIRMED)) {
5313                 mutex_unlock(&stp->st_mutex);
5314                 nfs4_put_stid(&stp->st_stid);
5315                 return nfserr_bad_stateid;
5316         }
5317         *stpp = stp;
5318         return nfs_ok;
5319 }
5320
5321 __be32
5322 nfsd4_open_confirm(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
5323                    union nfsd4_op_u *u)
5324 {
5325         struct nfsd4_open_confirm *oc = &u->open_confirm;
5326         __be32 status;
5327         struct nfs4_openowner *oo;
5328         struct nfs4_ol_stateid *stp;
5329         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
5330
5331         dprintk("NFSD: nfsd4_open_confirm on file %pd\n",
5332                         cstate->current_fh.fh_dentry);
5333
5334         status = fh_verify(rqstp, &cstate->current_fh, S_IFREG, 0);
5335         if (status)
5336                 return status;
5337
5338         status = nfs4_preprocess_seqid_op(cstate,
5339                                         oc->oc_seqid, &oc->oc_req_stateid,
5340                                         NFS4_OPEN_STID, &stp, nn);
5341         if (status)
5342                 goto out;
5343         oo = openowner(stp->st_stateowner);
5344         status = nfserr_bad_stateid;
5345         if (oo->oo_flags & NFS4_OO_CONFIRMED) {
5346                 mutex_unlock(&stp->st_mutex);
5347                 goto put_stateid;
5348         }
5349         oo->oo_flags |= NFS4_OO_CONFIRMED;
5350         nfs4_inc_and_copy_stateid(&oc->oc_resp_stateid, &stp->st_stid);
5351         mutex_unlock(&stp->st_mutex);
5352         dprintk("NFSD: %s: success, seqid=%d stateid=" STATEID_FMT "\n",
5353                 __func__, oc->oc_seqid, STATEID_VAL(&stp->st_stid.sc_stateid));
5354
5355         nfsd4_client_record_create(oo->oo_owner.so_client);
5356         status = nfs_ok;
5357 put_stateid:
5358         nfs4_put_stid(&stp->st_stid);
5359 out:
5360         nfsd4_bump_seqid(cstate, status);
5361         return status;
5362 }
5363
5364 static inline void nfs4_stateid_downgrade_bit(struct nfs4_ol_stateid *stp, u32 access)
5365 {
5366         if (!test_access(access, stp))
5367                 return;
5368         nfs4_file_put_access(stp->st_stid.sc_file, access);
5369         clear_access(access, stp);
5370 }
5371
5372 static inline void nfs4_stateid_downgrade(struct nfs4_ol_stateid *stp, u32 to_access)
5373 {
5374         switch (to_access) {
5375         case NFS4_SHARE_ACCESS_READ:
5376                 nfs4_stateid_downgrade_bit(stp, NFS4_SHARE_ACCESS_WRITE);
5377                 nfs4_stateid_downgrade_bit(stp, NFS4_SHARE_ACCESS_BOTH);
5378                 break;
5379         case NFS4_SHARE_ACCESS_WRITE:
5380                 nfs4_stateid_downgrade_bit(stp, NFS4_SHARE_ACCESS_READ);
5381                 nfs4_stateid_downgrade_bit(stp, NFS4_SHARE_ACCESS_BOTH);
5382                 break;
5383         case NFS4_SHARE_ACCESS_BOTH:
5384                 break;
5385         default:
5386                 WARN_ON_ONCE(1);
5387         }
5388 }
5389
5390 __be32
5391 nfsd4_open_downgrade(struct svc_rqst *rqstp,
5392                      struct nfsd4_compound_state *cstate, union nfsd4_op_u *u)
5393 {
5394         struct nfsd4_open_downgrade *od = &u->open_downgrade;
5395         __be32 status;
5396         struct nfs4_ol_stateid *stp;
5397         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
5398
5399         dprintk("NFSD: nfsd4_open_downgrade on file %pd\n",
5400                         cstate->current_fh.fh_dentry);
5401
5402         /* We don't yet support WANT bits: */
5403         if (od->od_deleg_want)
5404                 dprintk("NFSD: %s: od_deleg_want=0x%x ignored\n", __func__,
5405                         od->od_deleg_want);
5406
5407         status = nfs4_preprocess_confirmed_seqid_op(cstate, od->od_seqid,
5408                                         &od->od_stateid, &stp, nn);
5409         if (status)
5410                 goto out;
5411         status = nfserr_inval;
5412         if (!test_access(od->od_share_access, stp)) {
5413                 dprintk("NFSD: access not a subset of current bitmap: 0x%hhx, input access=%08x\n",
5414                         stp->st_access_bmap, od->od_share_access);
5415                 goto put_stateid;
5416         }
5417         if (!test_deny(od->od_share_deny, stp)) {
5418                 dprintk("NFSD: deny not a subset of current bitmap: 0x%hhx, input deny=%08x\n",
5419                         stp->st_deny_bmap, od->od_share_deny);
5420                 goto put_stateid;
5421         }
5422         nfs4_stateid_downgrade(stp, od->od_share_access);
5423         reset_union_bmap_deny(od->od_share_deny, stp);
5424         nfs4_inc_and_copy_stateid(&od->od_stateid, &stp->st_stid);
5425         status = nfs_ok;
5426 put_stateid:
5427         mutex_unlock(&stp->st_mutex);
5428         nfs4_put_stid(&stp->st_stid);
5429 out:
5430         nfsd4_bump_seqid(cstate, status);
5431         return status;
5432 }
5433
5434 static void nfsd4_close_open_stateid(struct nfs4_ol_stateid *s)
5435 {
5436         struct nfs4_client *clp = s->st_stid.sc_client;
5437         bool unhashed;
5438         LIST_HEAD(reaplist);
5439
5440         spin_lock(&clp->cl_lock);
5441         unhashed = unhash_open_stateid(s, &reaplist);
5442
5443         if (clp->cl_minorversion) {
5444                 if (unhashed)
5445                         put_ol_stateid_locked(s, &reaplist);
5446                 spin_unlock(&clp->cl_lock);
5447                 free_ol_stateid_reaplist(&reaplist);
5448         } else {
5449                 spin_unlock(&clp->cl_lock);
5450                 free_ol_stateid_reaplist(&reaplist);
5451                 if (unhashed)
5452                         move_to_close_lru(s, clp->net);
5453         }
5454 }
5455
5456 /*
5457  * nfs4_unlock_state() called after encode
5458  */
5459 __be32
5460 nfsd4_close(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
5461                 union nfsd4_op_u *u)
5462 {
5463         struct nfsd4_close *close = &u->close;
5464         __be32 status;
5465         struct nfs4_ol_stateid *stp;
5466         struct net *net = SVC_NET(rqstp);
5467         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
5468
5469         dprintk("NFSD: nfsd4_close on file %pd\n",
5470                         cstate->current_fh.fh_dentry);
5471
5472         status = nfs4_preprocess_seqid_op(cstate, close->cl_seqid,
5473                                         &close->cl_stateid,
5474                                         NFS4_OPEN_STID|NFS4_CLOSED_STID,
5475                                         &stp, nn);
5476         nfsd4_bump_seqid(cstate, status);
5477         if (status)
5478                 goto out;
5479
5480         stp->st_stid.sc_type = NFS4_CLOSED_STID;
5481         nfs4_inc_and_copy_stateid(&close->cl_stateid, &stp->st_stid);
5482
5483         nfsd4_close_open_stateid(stp);
5484         mutex_unlock(&stp->st_mutex);
5485
5486         /* See RFC5661 sectionm 18.2.4 */
5487         if (stp->st_stid.sc_client->cl_minorversion)
5488                 memcpy(&close->cl_stateid, &close_stateid,
5489                                 sizeof(close->cl_stateid));
5490
5491         /* put reference from nfs4_preprocess_seqid_op */
5492         nfs4_put_stid(&stp->st_stid);
5493 out:
5494         return status;
5495 }
5496
5497 __be32
5498 nfsd4_delegreturn(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
5499                   union nfsd4_op_u *u)
5500 {
5501         struct nfsd4_delegreturn *dr = &u->delegreturn;
5502         struct nfs4_delegation *dp;
5503         stateid_t *stateid = &dr->dr_stateid;
5504         struct nfs4_stid *s;
5505         __be32 status;
5506         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
5507
5508         if ((status = fh_verify(rqstp, &cstate->current_fh, S_IFREG, 0)))
5509                 return status;
5510
5511         status = nfsd4_lookup_stateid(cstate, stateid, NFS4_DELEG_STID, &s, nn);
5512         if (status)
5513                 goto out;
5514         dp = delegstateid(s);
5515         status = nfsd4_stid_check_stateid_generation(stateid, &dp->dl_stid, nfsd4_has_session(cstate));
5516         if (status)
5517                 goto put_stateid;
5518
5519         destroy_delegation(dp);
5520 put_stateid:
5521         nfs4_put_stid(&dp->dl_stid);
5522 out:
5523         return status;
5524 }
5525
5526 static inline u64
5527 end_offset(u64 start, u64 len)
5528 {
5529         u64 end;
5530
5531         end = start + len;
5532         return end >= start ? end: NFS4_MAX_UINT64;
5533 }
5534
5535 /* last octet in a range */
5536 static inline u64
5537 last_byte_offset(u64 start, u64 len)
5538 {
5539         u64 end;
5540
5541         WARN_ON_ONCE(!len);
5542         end = start + len;
5543         return end > start ? end - 1: NFS4_MAX_UINT64;
5544 }
5545
5546 /*
5547  * TODO: Linux file offsets are _signed_ 64-bit quantities, which means that
5548  * we can't properly handle lock requests that go beyond the (2^63 - 1)-th
5549  * byte, because of sign extension problems.  Since NFSv4 calls for 64-bit
5550  * locking, this prevents us from being completely protocol-compliant.  The
5551  * real solution to this problem is to start using unsigned file offsets in
5552  * the VFS, but this is a very deep change!
5553  */
5554 static inline void
5555 nfs4_transform_lock_offset(struct file_lock *lock)
5556 {
5557         if (lock->fl_start < 0)
5558                 lock->fl_start = OFFSET_MAX;
5559         if (lock->fl_end < 0)
5560                 lock->fl_end = OFFSET_MAX;
5561 }
5562
5563 static fl_owner_t
5564 nfsd4_fl_get_owner(fl_owner_t owner)
5565 {
5566         struct nfs4_lockowner *lo = (struct nfs4_lockowner *)owner;
5567
5568         nfs4_get_stateowner(&lo->lo_owner);
5569         return owner;
5570 }
5571
5572 static void
5573 nfsd4_fl_put_owner(fl_owner_t owner)
5574 {
5575         struct nfs4_lockowner *lo = (struct nfs4_lockowner *)owner;
5576
5577         if (lo)
5578                 nfs4_put_stateowner(&lo->lo_owner);
5579 }
5580
5581 static void
5582 nfsd4_lm_notify(struct file_lock *fl)
5583 {
5584         struct nfs4_lockowner           *lo = (struct nfs4_lockowner *)fl->fl_owner;
5585         struct net                      *net = lo->lo_owner.so_client->net;
5586         struct nfsd_net                 *nn = net_generic(net, nfsd_net_id);
5587         struct nfsd4_blocked_lock       *nbl = container_of(fl,
5588                                                 struct nfsd4_blocked_lock, nbl_lock);
5589         bool queue = false;
5590
5591         /* An empty list means that something else is going to be using it */
5592         spin_lock(&nn->blocked_locks_lock);
5593         if (!list_empty(&nbl->nbl_list)) {
5594                 list_del_init(&nbl->nbl_list);
5595                 list_del_init(&nbl->nbl_lru);
5596                 queue = true;
5597         }
5598         spin_unlock(&nn->blocked_locks_lock);
5599
5600         if (queue)
5601                 nfsd4_run_cb(&nbl->nbl_cb);
5602 }
5603
5604 static const struct lock_manager_operations nfsd_posix_mng_ops  = {
5605         .lm_notify = nfsd4_lm_notify,
5606         .lm_get_owner = nfsd4_fl_get_owner,
5607         .lm_put_owner = nfsd4_fl_put_owner,
5608 };
5609
5610 static inline void
5611 nfs4_set_lock_denied(struct file_lock *fl, struct nfsd4_lock_denied *deny)
5612 {
5613         struct nfs4_lockowner *lo;
5614
5615         if (fl->fl_lmops == &nfsd_posix_mng_ops) {
5616                 lo = (struct nfs4_lockowner *) fl->fl_owner;
5617                 deny->ld_owner.data = kmemdup(lo->lo_owner.so_owner.data,
5618                                         lo->lo_owner.so_owner.len, GFP_KERNEL);
5619                 if (!deny->ld_owner.data)
5620                         /* We just don't care that much */
5621                         goto nevermind;
5622                 deny->ld_owner.len = lo->lo_owner.so_owner.len;
5623                 deny->ld_clientid = lo->lo_owner.so_client->cl_clientid;
5624         } else {
5625 nevermind:
5626                 deny->ld_owner.len = 0;
5627                 deny->ld_owner.data = NULL;
5628                 deny->ld_clientid.cl_boot = 0;
5629                 deny->ld_clientid.cl_id = 0;
5630         }
5631         deny->ld_start = fl->fl_start;
5632         deny->ld_length = NFS4_MAX_UINT64;
5633         if (fl->fl_end != NFS4_MAX_UINT64)
5634                 deny->ld_length = fl->fl_end - fl->fl_start + 1;
5635         deny->ld_type = NFS4_READ_LT;
5636         if (fl->fl_type != F_RDLCK)
5637                 deny->ld_type = NFS4_WRITE_LT;
5638 }
5639
5640 static struct nfs4_lockowner *
5641 find_lockowner_str_locked(struct nfs4_client *clp, struct xdr_netobj *owner)
5642 {
5643         unsigned int strhashval = ownerstr_hashval(owner);
5644         struct nfs4_stateowner *so;
5645
5646         lockdep_assert_held(&clp->cl_lock);
5647
5648         list_for_each_entry(so, &clp->cl_ownerstr_hashtbl[strhashval],
5649                             so_strhash) {
5650                 if (so->so_is_open_owner)
5651                         continue;
5652                 if (same_owner_str(so, owner))
5653                         return lockowner(nfs4_get_stateowner(so));
5654         }
5655         return NULL;
5656 }
5657
5658 static struct nfs4_lockowner *
5659 find_lockowner_str(struct nfs4_client *clp, struct xdr_netobj *owner)
5660 {
5661         struct nfs4_lockowner *lo;
5662
5663         spin_lock(&clp->cl_lock);
5664         lo = find_lockowner_str_locked(clp, owner);
5665         spin_unlock(&clp->cl_lock);
5666         return lo;
5667 }
5668
5669 static void nfs4_unhash_lockowner(struct nfs4_stateowner *sop)
5670 {
5671         unhash_lockowner_locked(lockowner(sop));
5672 }
5673
5674 static void nfs4_free_lockowner(struct nfs4_stateowner *sop)
5675 {
5676         struct nfs4_lockowner *lo = lockowner(sop);
5677
5678         kmem_cache_free(lockowner_slab, lo);
5679 }
5680
5681 static const struct nfs4_stateowner_operations lockowner_ops = {
5682         .so_unhash =    nfs4_unhash_lockowner,
5683         .so_free =      nfs4_free_lockowner,
5684 };
5685
5686 /*
5687  * Alloc a lock owner structure.
5688  * Called in nfsd4_lock - therefore, OPEN and OPEN_CONFIRM (if needed) has
5689  * occurred.
5690  *
5691  * strhashval = ownerstr_hashval
5692  */
5693 static struct nfs4_lockowner *
5694 alloc_init_lock_stateowner(unsigned int strhashval, struct nfs4_client *clp,
5695                            struct nfs4_ol_stateid *open_stp,
5696                            struct nfsd4_lock *lock)
5697 {
5698         struct nfs4_lockowner *lo, *ret;
5699
5700         lo = alloc_stateowner(lockowner_slab, &lock->lk_new_owner, clp);
5701         if (!lo)
5702                 return NULL;
5703         INIT_LIST_HEAD(&lo->lo_blocked);
5704         INIT_LIST_HEAD(&lo->lo_owner.so_stateids);
5705         lo->lo_owner.so_is_open_owner = 0;
5706         lo->lo_owner.so_seqid = lock->lk_new_lock_seqid;
5707         lo->lo_owner.so_ops = &lockowner_ops;
5708         spin_lock(&clp->cl_lock);
5709         ret = find_lockowner_str_locked(clp, &lock->lk_new_owner);
5710         if (ret == NULL) {
5711                 list_add(&lo->lo_owner.so_strhash,
5712                          &clp->cl_ownerstr_hashtbl[strhashval]);
5713                 ret = lo;
5714         } else
5715                 nfs4_free_stateowner(&lo->lo_owner);
5716
5717         spin_unlock(&clp->cl_lock);
5718         return ret;
5719 }
5720
5721 static struct nfs4_ol_stateid *
5722 find_lock_stateid(struct nfs4_lockowner *lo, struct nfs4_file *fp)
5723 {
5724         struct nfs4_ol_stateid *lst;
5725         struct nfs4_client *clp = lo->lo_owner.so_client;
5726
5727         lockdep_assert_held(&clp->cl_lock);
5728
5729         list_for_each_entry(lst, &lo->lo_owner.so_stateids, st_perstateowner) {
5730                 if (lst->st_stid.sc_type != NFS4_LOCK_STID)
5731                         continue;
5732                 if (lst->st_stid.sc_file == fp) {
5733                         refcount_inc(&lst->st_stid.sc_count);
5734                         return lst;
5735                 }
5736         }
5737         return NULL;
5738 }
5739
5740 static struct nfs4_ol_stateid *
5741 init_lock_stateid(struct nfs4_ol_stateid *stp, struct nfs4_lockowner *lo,
5742                   struct nfs4_file *fp, struct inode *inode,
5743                   struct nfs4_ol_stateid *open_stp)
5744 {
5745         struct nfs4_client *clp = lo->lo_owner.so_client;
5746         struct nfs4_ol_stateid *retstp;
5747
5748         mutex_init(&stp->st_mutex);
5749         mutex_lock_nested(&stp->st_mutex, OPEN_STATEID_MUTEX);
5750 retry:
5751         spin_lock(&clp->cl_lock);
5752         spin_lock(&fp->fi_lock);
5753         retstp = find_lock_stateid(lo, fp);
5754         if (retstp)
5755                 goto out_unlock;
5756
5757         refcount_inc(&stp->st_stid.sc_count);
5758         stp->st_stid.sc_type = NFS4_LOCK_STID;
5759         stp->st_stateowner = nfs4_get_stateowner(&lo->lo_owner);
5760         get_nfs4_file(fp);
5761         stp->st_stid.sc_file = fp;
5762         stp->st_access_bmap = 0;
5763         stp->st_deny_bmap = open_stp->st_deny_bmap;
5764         stp->st_openstp = open_stp;
5765         list_add(&stp->st_locks, &open_stp->st_locks);
5766         list_add(&stp->st_perstateowner, &lo->lo_owner.so_stateids);
5767         list_add(&stp->st_perfile, &fp->fi_stateids);
5768 out_unlock:
5769         spin_unlock(&fp->fi_lock);
5770         spin_unlock(&clp->cl_lock);
5771         if (retstp) {
5772                 if (nfsd4_lock_ol_stateid(retstp) != nfs_ok) {
5773                         nfs4_put_stid(&retstp->st_stid);
5774                         goto retry;
5775                 }
5776                 /* To keep mutex tracking happy */
5777                 mutex_unlock(&stp->st_mutex);
5778                 stp = retstp;
5779         }
5780         return stp;
5781 }
5782
5783 static struct nfs4_ol_stateid *
5784 find_or_create_lock_stateid(struct nfs4_lockowner *lo, struct nfs4_file *fi,
5785                             struct inode *inode, struct nfs4_ol_stateid *ost,
5786                             bool *new)
5787 {
5788         struct nfs4_stid *ns = NULL;
5789         struct nfs4_ol_stateid *lst;
5790         struct nfs4_openowner *oo = openowner(ost->st_stateowner);
5791         struct nfs4_client *clp = oo->oo_owner.so_client;
5792
5793         *new = false;
5794         spin_lock(&clp->cl_lock);
5795         lst = find_lock_stateid(lo, fi);
5796         spin_unlock(&clp->cl_lock);
5797         if (lst != NULL) {
5798                 if (nfsd4_lock_ol_stateid(lst) == nfs_ok)
5799                         goto out;
5800                 nfs4_put_stid(&lst->st_stid);
5801         }
5802         ns = nfs4_alloc_stid(clp, stateid_slab, nfs4_free_lock_stateid);
5803         if (ns == NULL)
5804                 return NULL;
5805
5806         lst = init_lock_stateid(openlockstateid(ns), lo, fi, inode, ost);
5807         if (lst == openlockstateid(ns))
5808                 *new = true;
5809         else
5810                 nfs4_put_stid(ns);
5811 out:
5812         return lst;
5813 }
5814
5815 static int
5816 check_lock_length(u64 offset, u64 length)
5817 {
5818         return ((length == 0) || ((length != NFS4_MAX_UINT64) &&
5819                 (length > ~offset)));
5820 }
5821
5822 static void get_lock_access(struct nfs4_ol_stateid *lock_stp, u32 access)
5823 {
5824         struct nfs4_file *fp = lock_stp->st_stid.sc_file;
5825
5826         lockdep_assert_held(&fp->fi_lock);
5827
5828         if (test_access(access, lock_stp))
5829                 return;
5830         __nfs4_file_get_access(fp, access);
5831         set_access(access, lock_stp);
5832 }
5833
5834 static __be32
5835 lookup_or_create_lock_state(struct nfsd4_compound_state *cstate,
5836                             struct nfs4_ol_stateid *ost,
5837                             struct nfsd4_lock *lock,
5838                             struct nfs4_ol_stateid **plst, bool *new)
5839 {
5840         __be32 status;
5841         struct nfs4_file *fi = ost->st_stid.sc_file;
5842         struct nfs4_openowner *oo = openowner(ost->st_stateowner);
5843         struct nfs4_client *cl = oo->oo_owner.so_client;
5844         struct inode *inode = d_inode(cstate->current_fh.fh_dentry);
5845         struct nfs4_lockowner *lo;
5846         struct nfs4_ol_stateid *lst;
5847         unsigned int strhashval;
5848
5849         lo = find_lockowner_str(cl, &lock->lk_new_owner);
5850         if (!lo) {
5851                 strhashval = ownerstr_hashval(&lock->lk_new_owner);
5852                 lo = alloc_init_lock_stateowner(strhashval, cl, ost, lock);
5853                 if (lo == NULL)
5854                         return nfserr_jukebox;
5855         } else {
5856                 /* with an existing lockowner, seqids must be the same */
5857                 status = nfserr_bad_seqid;
5858                 if (!cstate->minorversion &&
5859                     lock->lk_new_lock_seqid != lo->lo_owner.so_seqid)
5860                         goto out;
5861         }
5862
5863         lst = find_or_create_lock_stateid(lo, fi, inode, ost, new);
5864         if (lst == NULL) {
5865                 status = nfserr_jukebox;
5866                 goto out;
5867         }
5868
5869         status = nfs_ok;
5870         *plst = lst;
5871 out:
5872         nfs4_put_stateowner(&lo->lo_owner);
5873         return status;
5874 }
5875
5876 /*
5877  *  LOCK operation
5878  */
5879 __be32
5880 nfsd4_lock(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
5881            union nfsd4_op_u *u)
5882 {
5883         struct nfsd4_lock *lock = &u->lock;
5884         struct nfs4_openowner *open_sop = NULL;
5885         struct nfs4_lockowner *lock_sop = NULL;
5886         struct nfs4_ol_stateid *lock_stp = NULL;
5887         struct nfs4_ol_stateid *open_stp = NULL;
5888         struct nfs4_file *fp;
5889         struct file *filp = NULL;
5890         struct nfsd4_blocked_lock *nbl = NULL;
5891         struct file_lock *file_lock = NULL;
5892         struct file_lock *conflock = NULL;
5893         __be32 status = 0;
5894         int lkflg;
5895         int err;
5896         bool new = false;
5897         unsigned char fl_type;
5898         unsigned int fl_flags = FL_POSIX;
5899         struct net *net = SVC_NET(rqstp);
5900         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
5901
5902         dprintk("NFSD: nfsd4_lock: start=%Ld length=%Ld\n",
5903                 (long long) lock->lk_offset,
5904                 (long long) lock->lk_length);
5905
5906         if (check_lock_length(lock->lk_offset, lock->lk_length))
5907                  return nfserr_inval;
5908
5909         if ((status = fh_verify(rqstp, &cstate->current_fh,
5910                                 S_IFREG, NFSD_MAY_LOCK))) {
5911                 dprintk("NFSD: nfsd4_lock: permission denied!\n");
5912                 return status;
5913         }
5914
5915         if (lock->lk_is_new) {
5916                 if (nfsd4_has_session(cstate))
5917                         /* See rfc 5661 18.10.3: given clientid is ignored: */
5918                         memcpy(&lock->lk_new_clientid,
5919                                 &cstate->session->se_client->cl_clientid,
5920                                 sizeof(clientid_t));
5921
5922                 status = nfserr_stale_clientid;
5923                 if (STALE_CLIENTID(&lock->lk_new_clientid, nn))
5924                         goto out;
5925
5926                 /* validate and update open stateid and open seqid */
5927                 status = nfs4_preprocess_confirmed_seqid_op(cstate,
5928                                         lock->lk_new_open_seqid,
5929                                         &lock->lk_new_open_stateid,
5930                                         &open_stp, nn);
5931                 if (status)
5932                         goto out;
5933                 mutex_unlock(&open_stp->st_mutex);
5934                 open_sop = openowner(open_stp->st_stateowner);
5935                 status = nfserr_bad_stateid;
5936                 if (!same_clid(&open_sop->oo_owner.so_client->cl_clientid,
5937                                                 &lock->lk_new_clientid))
5938                         goto out;
5939                 status = lookup_or_create_lock_state(cstate, open_stp, lock,
5940                                                         &lock_stp, &new);
5941         } else {
5942                 status = nfs4_preprocess_seqid_op(cstate,
5943                                        lock->lk_old_lock_seqid,
5944                                        &lock->lk_old_lock_stateid,
5945                                        NFS4_LOCK_STID, &lock_stp, nn);
5946         }
5947         if (status)
5948                 goto out;
5949         lock_sop = lockowner(lock_stp->st_stateowner);
5950
5951         lkflg = setlkflg(lock->lk_type);
5952         status = nfs4_check_openmode(lock_stp, lkflg);
5953         if (status)
5954                 goto out;
5955
5956         status = nfserr_grace;
5957         if (locks_in_grace(net) && !lock->lk_reclaim)
5958                 goto out;
5959         status = nfserr_no_grace;
5960         if (!locks_in_grace(net) && lock->lk_reclaim)
5961                 goto out;
5962
5963         fp = lock_stp->st_stid.sc_file;
5964         switch (lock->lk_type) {
5965                 case NFS4_READW_LT:
5966                         if (nfsd4_has_session(cstate))
5967                                 fl_flags |= FL_SLEEP;
5968                         /* Fallthrough */
5969                 case NFS4_READ_LT:
5970                         spin_lock(&fp->fi_lock);
5971                         filp = find_readable_file_locked(fp);
5972                         if (filp)
5973                                 get_lock_access(lock_stp, NFS4_SHARE_ACCESS_READ);
5974                         spin_unlock(&fp->fi_lock);
5975                         fl_type = F_RDLCK;
5976                         break;
5977                 case NFS4_WRITEW_LT:
5978                         if (nfsd4_has_session(cstate))
5979                                 fl_flags |= FL_SLEEP;
5980                         /* Fallthrough */
5981                 case NFS4_WRITE_LT:
5982                         spin_lock(&fp->fi_lock);
5983                         filp = find_writeable_file_locked(fp);
5984                         if (filp)
5985                                 get_lock_access(lock_stp, NFS4_SHARE_ACCESS_WRITE);
5986                         spin_unlock(&fp->fi_lock);
5987                         fl_type = F_WRLCK;
5988                         break;
5989                 default:
5990                         status = nfserr_inval;
5991                 goto out;
5992         }
5993
5994         if (!filp) {
5995                 status = nfserr_openmode;
5996                 goto out;
5997         }
5998
5999         nbl = find_or_allocate_block(lock_sop, &fp->fi_fhandle, nn);
6000         if (!nbl) {
6001                 dprintk("NFSD: %s: unable to allocate block!\n", __func__);
6002                 status = nfserr_jukebox;
6003                 goto out;
6004         }
6005
6006         file_lock = &nbl->nbl_lock;
6007         file_lock->fl_type = fl_type;
6008         file_lock->fl_owner = (fl_owner_t)lockowner(nfs4_get_stateowner(&lock_sop->lo_owner));
6009         file_lock->fl_pid = current->tgid;
6010         file_lock->fl_file = filp;
6011         file_lock->fl_flags = fl_flags;
6012         file_lock->fl_lmops = &nfsd_posix_mng_ops;
6013         file_lock->fl_start = lock->lk_offset;
6014         file_lock->fl_end = last_byte_offset(lock->lk_offset, lock->lk_length);
6015         nfs4_transform_lock_offset(file_lock);
6016
6017         conflock = locks_alloc_lock();
6018         if (!conflock) {
6019                 dprintk("NFSD: %s: unable to allocate lock!\n", __func__);
6020                 status = nfserr_jukebox;
6021                 goto out;
6022         }
6023
6024         if (fl_flags & FL_SLEEP) {
6025                 nbl->nbl_time = jiffies;
6026                 spin_lock(&nn->blocked_locks_lock);
6027                 list_add_tail(&nbl->nbl_list, &lock_sop->lo_blocked);
6028                 list_add_tail(&nbl->nbl_lru, &nn->blocked_locks_lru);
6029                 spin_unlock(&nn->blocked_locks_lock);
6030         }
6031
6032         err = vfs_lock_file(filp, F_SETLK, file_lock, conflock);
6033         switch (err) {
6034         case 0: /* success! */
6035                 nfs4_inc_and_copy_stateid(&lock->lk_resp_stateid, &lock_stp->st_stid);
6036                 status = 0;
6037                 break;
6038         case FILE_LOCK_DEFERRED:
6039                 nbl = NULL;
6040                 /* Fallthrough */
6041         case -EAGAIN:           /* conflock holds conflicting lock */
6042                 status = nfserr_denied;
6043                 dprintk("NFSD: nfsd4_lock: conflicting lock found!\n");
6044                 nfs4_set_lock_denied(conflock, &lock->lk_denied);
6045                 break;
6046         case -EDEADLK:
6047                 status = nfserr_deadlock;
6048                 break;
6049         default:
6050                 dprintk("NFSD: nfsd4_lock: vfs_lock_file() failed! status %d\n",err);
6051                 status = nfserrno(err);
6052                 break;
6053         }
6054 out:
6055         if (nbl) {
6056                 /* dequeue it if we queued it before */
6057                 if (fl_flags & FL_SLEEP) {
6058                         spin_lock(&nn->blocked_locks_lock);
6059                         list_del_init(&nbl->nbl_list);
6060                         list_del_init(&nbl->nbl_lru);
6061                         spin_unlock(&nn->blocked_locks_lock);
6062                 }
6063                 free_blocked_lock(nbl);
6064         }
6065         if (filp)
6066                 fput(filp);
6067         if (lock_stp) {
6068                 /* Bump seqid manually if the 4.0 replay owner is openowner */
6069                 if (cstate->replay_owner &&
6070                     cstate->replay_owner != &lock_sop->lo_owner &&
6071                     seqid_mutating_err(ntohl(status)))
6072                         lock_sop->lo_owner.so_seqid++;
6073
6074                 /*
6075                  * If this is a new, never-before-used stateid, and we are
6076                  * returning an error, then just go ahead and release it.
6077                  */
6078                 if (status && new) {
6079                         lock_stp->st_stid.sc_type = NFS4_CLOSED_STID;
6080                         release_lock_stateid(lock_stp);
6081                 }
6082
6083                 mutex_unlock(&lock_stp->st_mutex);
6084
6085                 nfs4_put_stid(&lock_stp->st_stid);
6086         }
6087         if (open_stp)
6088                 nfs4_put_stid(&open_stp->st_stid);
6089         nfsd4_bump_seqid(cstate, status);
6090         if (conflock)
6091                 locks_free_lock(conflock);
6092         return status;
6093 }
6094
6095 /*
6096  * The NFSv4 spec allows a client to do a LOCKT without holding an OPEN,
6097  * so we do a temporary open here just to get an open file to pass to
6098  * vfs_test_lock.  (Arguably perhaps test_lock should be done with an
6099  * inode operation.)
6100  */
6101 static __be32 nfsd_test_lock(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file_lock *lock)
6102 {
6103         struct file *file;
6104         __be32 err = nfsd_open(rqstp, fhp, S_IFREG, NFSD_MAY_READ, &file);
6105         if (!err) {
6106                 err = nfserrno(vfs_test_lock(file, lock));
6107                 fput(file);
6108         }
6109         return err;
6110 }
6111
6112 /*
6113  * LOCKT operation
6114  */
6115 __be32
6116 nfsd4_lockt(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
6117             union nfsd4_op_u *u)
6118 {
6119         struct nfsd4_lockt *lockt = &u->lockt;
6120         struct file_lock *file_lock = NULL;
6121         struct nfs4_lockowner *lo = NULL;
6122         __be32 status;
6123         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
6124
6125         if (locks_in_grace(SVC_NET(rqstp)))
6126                 return nfserr_grace;
6127
6128         if (check_lock_length(lockt->lt_offset, lockt->lt_length))
6129                  return nfserr_inval;
6130
6131         if (!nfsd4_has_session(cstate)) {
6132                 status = lookup_clientid(&lockt->lt_clientid, cstate, nn);
6133                 if (status)
6134                         goto out;
6135         }
6136
6137         if ((status = fh_verify(rqstp, &cstate->current_fh, S_IFREG, 0)))
6138                 goto out;
6139
6140         file_lock = locks_alloc_lock();
6141         if (!file_lock) {
6142                 dprintk("NFSD: %s: unable to allocate lock!\n", __func__);
6143                 status = nfserr_jukebox;
6144                 goto out;
6145         }
6146
6147         switch (lockt->lt_type) {
6148                 case NFS4_READ_LT:
6149                 case NFS4_READW_LT:
6150                         file_lock->fl_type = F_RDLCK;
6151                 break;
6152                 case NFS4_WRITE_LT:
6153                 case NFS4_WRITEW_LT:
6154                         file_lock->fl_type = F_WRLCK;
6155                 break;
6156                 default:
6157                         dprintk("NFSD: nfs4_lockt: bad lock type!\n");
6158                         status = nfserr_inval;
6159                 goto out;
6160         }
6161
6162         lo = find_lockowner_str(cstate->clp, &lockt->lt_owner);
6163         if (lo)
6164                 file_lock->fl_owner = (fl_owner_t)lo;
6165         file_lock->fl_pid = current->tgid;
6166         file_lock->fl_flags = FL_POSIX;
6167
6168         file_lock->fl_start = lockt->lt_offset;
6169         file_lock->fl_end = last_byte_offset(lockt->lt_offset, lockt->lt_length);
6170
6171         nfs4_transform_lock_offset(file_lock);
6172
6173         status = nfsd_test_lock(rqstp, &cstate->current_fh, file_lock);
6174         if (status)
6175                 goto out;
6176
6177         if (file_lock->fl_type != F_UNLCK) {
6178                 status = nfserr_denied;
6179                 nfs4_set_lock_denied(file_lock, &lockt->lt_denied);
6180         }
6181 out:
6182         if (lo)
6183                 nfs4_put_stateowner(&lo->lo_owner);
6184         if (file_lock)
6185                 locks_free_lock(file_lock);
6186         return status;
6187 }
6188
6189 __be32
6190 nfsd4_locku(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
6191             union nfsd4_op_u *u)
6192 {
6193         struct nfsd4_locku *locku = &u->locku;
6194         struct nfs4_ol_stateid *stp;
6195         struct file *filp = NULL;
6196         struct file_lock *file_lock = NULL;
6197         __be32 status;
6198         int err;
6199         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
6200
6201         dprintk("NFSD: nfsd4_locku: start=%Ld length=%Ld\n",
6202                 (long long) locku->lu_offset,
6203                 (long long) locku->lu_length);
6204
6205         if (check_lock_length(locku->lu_offset, locku->lu_length))
6206                  return nfserr_inval;
6207
6208         status = nfs4_preprocess_seqid_op(cstate, locku->lu_seqid,
6209                                         &locku->lu_stateid, NFS4_LOCK_STID,
6210                                         &stp, nn);
6211         if (status)
6212                 goto out;
6213         filp = find_any_file(stp->st_stid.sc_file);
6214         if (!filp) {
6215                 status = nfserr_lock_range;
6216                 goto put_stateid;
6217         }
6218         file_lock = locks_alloc_lock();
6219         if (!file_lock) {
6220                 dprintk("NFSD: %s: unable to allocate lock!\n", __func__);
6221                 status = nfserr_jukebox;
6222                 goto fput;
6223         }
6224
6225         file_lock->fl_type = F_UNLCK;
6226         file_lock->fl_owner = (fl_owner_t)lockowner(nfs4_get_stateowner(stp->st_stateowner));
6227         file_lock->fl_pid = current->tgid;
6228         file_lock->fl_file = filp;
6229         file_lock->fl_flags = FL_POSIX;
6230         file_lock->fl_lmops = &nfsd_posix_mng_ops;
6231         file_lock->fl_start = locku->lu_offset;
6232
6233         file_lock->fl_end = last_byte_offset(locku->lu_offset,
6234                                                 locku->lu_length);
6235         nfs4_transform_lock_offset(file_lock);
6236
6237         err = vfs_lock_file(filp, F_SETLK, file_lock, NULL);
6238         if (err) {
6239                 dprintk("NFSD: nfs4_locku: vfs_lock_file failed!\n");
6240                 goto out_nfserr;
6241         }
6242         nfs4_inc_and_copy_stateid(&locku->lu_stateid, &stp->st_stid);
6243 fput:
6244         fput(filp);
6245 put_stateid:
6246         mutex_unlock(&stp->st_mutex);
6247         nfs4_put_stid(&stp->st_stid);
6248 out:
6249         nfsd4_bump_seqid(cstate, status);
6250         if (file_lock)
6251                 locks_free_lock(file_lock);
6252         return status;
6253
6254 out_nfserr:
6255         status = nfserrno(err);
6256         goto fput;
6257 }
6258
6259 /*
6260  * returns
6261  *      true:  locks held by lockowner
6262  *      false: no locks held by lockowner
6263  */
6264 static bool
6265 check_for_locks(struct nfs4_file *fp, struct nfs4_lockowner *lowner)
6266 {
6267         struct file_lock *fl;
6268         int status = false;
6269         struct file *filp = find_any_file(fp);
6270         struct inode *inode;
6271         struct file_lock_context *flctx;
6272
6273         if (!filp) {
6274                 /* Any valid lock stateid should have some sort of access */
6275                 WARN_ON_ONCE(1);
6276                 return status;
6277         }
6278
6279         inode = file_inode(filp);
6280         flctx = inode->i_flctx;
6281
6282         if (flctx && !list_empty_careful(&flctx->flc_posix)) {
6283                 spin_lock(&flctx->flc_lock);
6284                 list_for_each_entry(fl, &flctx->flc_posix, fl_list) {
6285                         if (fl->fl_owner == (fl_owner_t)lowner) {
6286                                 status = true;
6287                                 break;
6288                         }
6289                 }
6290                 spin_unlock(&flctx->flc_lock);
6291         }
6292         fput(filp);
6293         return status;
6294 }
6295
6296 __be32
6297 nfsd4_release_lockowner(struct svc_rqst *rqstp,
6298                         struct nfsd4_compound_state *cstate,
6299                         union nfsd4_op_u *u)
6300 {
6301         struct nfsd4_release_lockowner *rlockowner = &u->release_lockowner;
6302         clientid_t *clid = &rlockowner->rl_clientid;
6303         struct nfs4_stateowner *sop;
6304         struct nfs4_lockowner *lo = NULL;
6305         struct nfs4_ol_stateid *stp;
6306         struct xdr_netobj *owner = &rlockowner->rl_owner;
6307         unsigned int hashval = ownerstr_hashval(owner);
6308         __be32 status;
6309         struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
6310         struct nfs4_client *clp;
6311         LIST_HEAD (reaplist);
6312
6313         dprintk("nfsd4_release_lockowner clientid: (%08x/%08x):\n",
6314                 clid->cl_boot, clid->cl_id);
6315
6316         status = lookup_clientid(clid, cstate, nn);
6317         if (status)
6318                 return status;
6319
6320         clp = cstate->clp;
6321         /* Find the matching lock stateowner */
6322         spin_lock(&clp->cl_lock);
6323         list_for_each_entry(sop, &clp->cl_ownerstr_hashtbl[hashval],
6324                             so_strhash) {
6325
6326                 if (sop->so_is_open_owner || !same_owner_str(sop, owner))
6327                         continue;
6328
6329                 /* see if there are still any locks associated with it */
6330                 lo = lockowner(sop);
6331                 list_for_each_entry(stp, &sop->so_stateids, st_perstateowner) {
6332                         if (check_for_locks(stp->st_stid.sc_file, lo)) {
6333                                 status = nfserr_locks_held;
6334                                 spin_unlock(&clp->cl_lock);
6335                                 return status;
6336                         }
6337                 }
6338
6339                 nfs4_get_stateowner(sop);
6340                 break;
6341         }
6342         if (!lo) {
6343                 spin_unlock(&clp->cl_lock);
6344                 return status;
6345         }
6346
6347         unhash_lockowner_locked(lo);
6348         while (!list_empty(&lo->lo_owner.so_stateids)) {
6349                 stp = list_first_entry(&lo->lo_owner.so_stateids,
6350                                        struct nfs4_ol_stateid,
6351                                        st_perstateowner);
6352                 WARN_ON(!unhash_lock_stateid(stp));
6353                 put_ol_stateid_locked(stp, &reaplist);
6354         }
6355         spin_unlock(&clp->cl_lock);
6356         free_ol_stateid_reaplist(&reaplist);
6357         nfs4_put_stateowner(&lo->lo_owner);
6358
6359         return status;
6360 }
6361
6362 static inline struct nfs4_client_reclaim *
6363 alloc_reclaim(void)
6364 {
6365         return kmalloc(sizeof(struct nfs4_client_reclaim), GFP_KERNEL);
6366 }
6367
6368 bool
6369 nfs4_has_reclaimed_state(const char *name, struct nfsd_net *nn)
6370 {
6371         struct nfs4_client_reclaim *crp;
6372
6373         crp = nfsd4_find_reclaim_client(name, nn);
6374         return (crp && crp->cr_clp);
6375 }
6376
6377 /*
6378  * failure => all reset bets are off, nfserr_no_grace...
6379  */
6380 struct nfs4_client_reclaim *
6381 nfs4_client_to_reclaim(const char *name, struct nfsd_net *nn)
6382 {
6383         unsigned int strhashval;
6384         struct nfs4_client_reclaim *crp;
6385
6386         dprintk("NFSD nfs4_client_to_reclaim NAME: %.*s\n", HEXDIR_LEN, name);
6387         crp = alloc_reclaim();
6388         if (crp) {
6389                 strhashval = clientstr_hashval(name);
6390                 INIT_LIST_HEAD(&crp->cr_strhash);
6391                 list_add(&crp->cr_strhash, &nn->reclaim_str_hashtbl[strhashval]);
6392                 memcpy(crp->cr_recdir, name, HEXDIR_LEN);
6393                 crp->cr_clp = NULL;
6394                 nn->reclaim_str_hashtbl_size++;
6395         }
6396         return crp;
6397 }
6398
6399 void
6400 nfs4_remove_reclaim_record(struct nfs4_client_reclaim *crp, struct nfsd_net *nn)
6401 {
6402         list_del(&crp->cr_strhash);
6403         kfree(crp);
6404         nn->reclaim_str_hashtbl_size--;
6405 }
6406
6407 void
6408 nfs4_release_reclaim(struct nfsd_net *nn)
6409 {
6410         struct nfs4_client_reclaim *crp = NULL;
6411         int i;
6412
6413         for (i = 0; i < CLIENT_HASH_SIZE; i++) {
6414                 while (!list_empty(&nn->reclaim_str_hashtbl[i])) {
6415                         crp = list_entry(nn->reclaim_str_hashtbl[i].next,
6416                                         struct nfs4_client_reclaim, cr_strhash);
6417                         nfs4_remove_reclaim_record(crp, nn);
6418                 }
6419         }
6420         WARN_ON_ONCE(nn->reclaim_str_hashtbl_size);
6421 }
6422
6423 /*
6424  * called from OPEN, CLAIM_PREVIOUS with a new clientid. */
6425 struct nfs4_client_reclaim *
6426 nfsd4_find_reclaim_client(const char *recdir, struct nfsd_net *nn)
6427 {
6428         unsigned int strhashval;
6429         struct nfs4_client_reclaim *crp = NULL;
6430
6431         dprintk("NFSD: nfs4_find_reclaim_client for recdir %s\n", recdir);
6432
6433         strhashval = clientstr_hashval(recdir);
6434         list_for_each_entry(crp, &nn->reclaim_str_hashtbl[strhashval], cr_strhash) {
6435                 if (same_name(crp->cr_recdir, recdir)) {
6436                         return crp;
6437                 }
6438         }
6439         return NULL;
6440 }
6441
6442 /*
6443 * Called from OPEN. Look for clientid in reclaim list.
6444 */
6445 __be32
6446 nfs4_check_open_reclaim(clientid_t *clid,
6447                 struct nfsd4_compound_state *cstate,
6448                 struct nfsd_net *nn)
6449 {
6450         __be32 status;
6451
6452         /* find clientid in conf_id_hashtbl */
6453         status = lookup_clientid(clid, cstate, nn);
6454         if (status)
6455                 return nfserr_reclaim_bad;
6456
6457         if (test_bit(NFSD4_CLIENT_RECLAIM_COMPLETE, &cstate->clp->cl_flags))
6458                 return nfserr_no_grace;
6459
6460         if (nfsd4_client_record_check(cstate->clp))
6461                 return nfserr_reclaim_bad;
6462
6463         return nfs_ok;
6464 }
6465
6466 #ifdef CONFIG_NFSD_FAULT_INJECTION
6467 static inline void
6468 put_client(struct nfs4_client *clp)
6469 {
6470         atomic_dec(&clp->cl_refcount);
6471 }
6472
6473 static struct nfs4_client *
6474 nfsd_find_client(struct sockaddr_storage *addr, size_t addr_size)
6475 {
6476         struct nfs4_client *clp;
6477         struct nfsd_net *nn = net_generic(current->nsproxy->net_ns,
6478                                           nfsd_net_id);
6479
6480         if (!nfsd_netns_ready(nn))
6481                 return NULL;
6482
6483         list_for_each_entry(clp, &nn->client_lru, cl_lru) {
6484                 if (memcmp(&clp->cl_addr, addr, addr_size) == 0)
6485                         return clp;
6486         }
6487         return NULL;
6488 }
6489
6490 u64
6491 nfsd_inject_print_clients(void)
6492 {
6493         struct nfs4_client *clp;
6494         u64 count = 0;
6495         struct nfsd_net *nn = net_generic(current->nsproxy->net_ns,
6496                                           nfsd_net_id);
6497         char buf[INET6_ADDRSTRLEN];
6498
6499         if (!nfsd_netns_ready(nn))
6500                 return 0;
6501
6502         spin_lock(&nn->client_lock);
6503         list_for_each_entry(clp, &nn->client_lru, cl_lru) {
6504                 rpc_ntop((struct sockaddr *)&clp->cl_addr, buf, sizeof(buf));
6505                 pr_info("NFS Client: %s\n", buf);
6506                 ++count;
6507         }
6508         spin_unlock(&nn->client_lock);
6509
6510         return count;
6511 }
6512
6513 u64
6514 nfsd_inject_forget_client(struct sockaddr_storage *addr, size_t addr_size)
6515 {
6516         u64 count = 0;
6517         struct nfs4_client *clp;
6518         struct nfsd_net *nn = net_generic(current->nsproxy->net_ns,
6519                                           nfsd_net_id);
6520
6521         if (!nfsd_netns_ready(nn))
6522                 return count;
6523
6524         spin_lock(&nn->client_lock);
6525         clp = nfsd_find_client(addr, addr_size);
6526         if (clp) {
6527                 if (mark_client_expired_locked(clp) == nfs_ok)
6528                         ++count;
6529                 else
6530                         clp = NULL;
6531         }
6532         spin_unlock(&nn->client_lock);
6533
6534         if (clp)
6535                 expire_client(clp);
6536
6537         return count;
6538 }
6539
6540 u64
6541 nfsd_inject_forget_clients(u64 max)
6542 {
6543         u64 count = 0;
6544         struct nfs4_client *clp, *next;
6545         struct nfsd_net *nn = net_generic(current->nsproxy->net_ns,
6546                                                 nfsd_net_id);
6547         LIST_HEAD(reaplist);
6548
6549         if (!nfsd_netns_ready(nn))
6550                 return count;
6551
6552         spin_lock(&nn->client_lock);
6553         list_for_each_entry_safe(clp, next, &nn->client_lru, cl_lru) {
6554                 if (mark_client_expired_locked(clp) == nfs_ok) {
6555                         list_add(&clp->cl_lru, &reaplist);
6556                         if (max != 0 && ++count >= max)
6557                                 break;
6558                 }
6559         }
6560         spin_unlock(&nn->client_lock);
6561
6562         list_for_each_entry_safe(clp, next, &reaplist, cl_lru)
6563                 expire_client(clp);
6564
6565         return count;
6566 }
6567
6568 static void nfsd_print_count(struct nfs4_client *clp, unsigned int count,
6569                              const char *type)
6570 {
6571         char buf[INET6_ADDRSTRLEN];
6572         rpc_ntop((struct sockaddr *)&clp->cl_addr, buf, sizeof(buf));
6573         printk(KERN_INFO "NFS Client: %s has %u %s\n", buf, count, type);
6574 }
6575
6576 static void
6577 nfsd_inject_add_lock_to_list(struct nfs4_ol_stateid *lst,
6578                              struct list_head *collect)
6579 {
6580         struct nfs4_client *clp = lst->st_stid.sc_client;
6581         struct nfsd_net *nn = net_generic(current->nsproxy->net_ns,
6582                                           nfsd_net_id);
6583
6584         if (!collect)
6585                 return;
6586
6587         lockdep_assert_held(&nn->client_lock);
6588         atomic_inc(&clp->cl_refcount);
6589         list_add(&lst->st_locks, collect);
6590 }
6591
6592 static u64 nfsd_foreach_client_lock(struct nfs4_client *clp, u64 max,
6593                                     struct list_head *collect,
6594                                     bool (*func)(struct nfs4_ol_stateid *))
6595 {
6596         struct nfs4_openowner *oop;
6597         struct nfs4_ol_stateid *stp, *st_next;
6598         struct nfs4_ol_stateid *lst, *lst_next;
6599         u64 count = 0;
6600
6601         spin_lock(&clp->cl_lock);
6602         list_for_each_entry(oop, &clp->cl_openowners, oo_perclient) {
6603                 list_for_each_entry_safe(stp, st_next,
6604                                 &oop->oo_owner.so_stateids, st_perstateowner) {
6605                         list_for_each_entry_safe(lst, lst_next,
6606                                         &stp->st_locks, st_locks) {
6607                                 if (func) {
6608                                         if (func(lst))
6609                                                 nfsd_inject_add_lock_to_list(lst,
6610                                                                         collect);
6611                                 }
6612                                 ++count;
6613                                 /*
6614                                  * Despite the fact that these functions deal
6615                                  * with 64-bit integers for "count", we must
6616                                  * ensure that it doesn't blow up the
6617                                  * clp->cl_refcount. Throw a warning if we
6618                                  * start to approach INT_MAX here.
6619                                  */
6620                                 WARN_ON_ONCE(count == (INT_MAX / 2));
6621                                 if (count == max)
6622                                         goto out;
6623                         }
6624                 }
6625         }
6626 out:
6627         spin_unlock(&clp->cl_lock);
6628
6629         return count;
6630 }
6631
6632 static u64
6633 nfsd_collect_client_locks(struct nfs4_client *clp, struct list_head *collect,
6634                           u64 max)
6635 {
6636         return nfsd_foreach_client_lock(clp, max, collect, unhash_lock_stateid);
6637 }
6638
6639 static u64
6640 nfsd_print_client_locks(struct nfs4_client *clp)
6641 {
6642         u64 count = nfsd_foreach_client_lock(clp, 0, NULL, NULL);
6643         nfsd_print_count(clp, count, "locked files");
6644         return count;
6645 }
6646
6647 u64
6648 nfsd_inject_print_locks(void)
6649 {
6650         struct nfs4_client *clp;
6651         u64 count = 0;
6652         struct nfsd_net *nn = net_generic(current->nsproxy->net_ns,
6653                                                 nfsd_net_id);
6654
6655         if (!nfsd_netns_ready(nn))
6656                 return 0;
6657
6658         spin_lock(&nn->client_lock);
6659         list_for_each_entry(clp, &nn->client_lru, cl_lru)
6660                 count += nfsd_print_client_locks(clp);
6661         spin_unlock(&nn->client_lock);
6662
6663         return count;
6664 }
6665
6666 static void
6667 nfsd_reap_locks(struct list_head *reaplist)
6668 {
6669         struct nfs4_client *clp;
6670         struct nfs4_ol_stateid *stp, *next;
6671
6672         list_for_each_entry_safe(stp, next, reaplist, st_locks) {
6673                 list_del_init(&stp->st_locks);
6674                 clp = stp->st_stid.sc_client;
6675                 nfs4_put_stid(&stp->st_stid);
6676                 put_client(clp);
6677         }
6678 }
6679
6680 u64
6681 nfsd_inject_forget_client_locks(struct sockaddr_storage *addr, size_t addr_size)
6682 {
6683         unsigned int count = 0;
6684         struct nfs4_client *clp;
6685         struct nfsd_net *nn = net_generic(current->nsproxy->net_ns,
6686                                                 nfsd_net_id);
6687         LIST_HEAD(reaplist);
6688
6689         if (!nfsd_netns_ready(nn))
6690                 return count;
6691
6692         spin_lock(&nn->client_lock);
6693         clp = nfsd_find_client(addr, addr_size);
6694         if (clp)
6695                 count = nfsd_collect_client_locks(clp, &reaplist, 0);
6696         spin_unlock(&nn->client_lock);
6697         nfsd_reap_locks(&reaplist);
6698         return count;
6699 }
6700
6701 u64
6702 nfsd_inject_forget_locks(u64 max)
6703 {
6704         u64 count = 0;
6705         struct nfs4_client *clp;
6706         struct nfsd_net *nn = net_generic(current->nsproxy->net_ns,
6707                                                 nfsd_net_id);
6708         LIST_HEAD(reaplist);
6709
6710         if (!nfsd_netns_ready(nn))
6711                 return count;
6712
6713         spin_lock(&nn->client_lock);
6714         list_for_each_entry(clp, &nn->client_lru, cl_lru) {
6715                 count += nfsd_collect_client_locks(clp, &reaplist, max - count);
6716                 if (max != 0 && count >= max)
6717                         break;
6718         }
6719         spin_unlock(&nn->client_lock);
6720         nfsd_reap_locks(&reaplist);
6721         return count;
6722 }
6723
6724 static u64
6725 nfsd_foreach_client_openowner(struct nfs4_client *clp, u64 max,
6726                               struct list_head *collect,
6727                               void (*func)(struct nfs4_openowner *))
6728 {
6729         struct nfs4_openowner *oop, *next;
6730         struct nfsd_net *nn = net_generic(current->nsproxy->net_ns,
6731                                                 nfsd_net_id);
6732         u64 count = 0;
6733
6734         lockdep_assert_held(&nn->client_lock);
6735
6736         spin_lock(&clp->cl_lock);
6737         list_for_each_entry_safe(oop, next, &clp->cl_openowners, oo_perclient) {
6738                 if (func) {
6739                         func(oop);
6740                         if (collect) {
6741                                 atomic_inc(&clp->cl_refcount);
6742                                 list_add(&oop->oo_perclient, collect);
6743                         }
6744                 }
6745                 ++count;
6746                 /*
6747                  * Despite the fact that these functions deal with
6748                  * 64-bit integers for "count", we must ensure that
6749                  * it doesn't blow up the clp->cl_refcount. Throw a
6750                  * warning if we start to approach INT_MAX here.
6751                  */
6752                 WARN_ON_ONCE(count == (INT_MAX / 2));
6753                 if (count == max)
6754                         break;
6755         }
6756         spin_unlock(&clp->cl_lock);
6757
6758         return count;
6759 }
6760
6761 static u64
6762 nfsd_print_client_openowners(struct nfs4_client *clp)
6763 {
6764         u64 count = nfsd_foreach_client_openowner(clp, 0, NULL, NULL);
6765
6766         nfsd_print_count(clp, count, "openowners");
6767         return count;
6768 }
6769
6770 static u64
6771 nfsd_collect_client_openowners(struct nfs4_client *clp,
6772                                struct list_head *collect, u64 max)
6773 {
6774         return nfsd_foreach_client_openowner(clp, max, collect,
6775                                                 unhash_openowner_locked);
6776 }
6777
6778 u64
6779 nfsd_inject_print_openowners(void)
6780 {
6781         struct nfs4_client *clp;
6782         u64 count = 0;
6783         struct nfsd_net *nn = net_generic(current->nsproxy->net_ns,
6784                                                 nfsd_net_id);
6785
6786         if (!nfsd_netns_ready(nn))
6787                 return 0;
6788
6789         spin_lock(&nn->client_lock);
6790         list_for_each_entry(clp, &nn->client_lru, cl_lru)
6791                 count += nfsd_print_client_openowners(clp);
6792         spin_unlock(&nn->client_lock);
6793
6794         return count;
6795 }
6796
6797 static void
6798 nfsd_reap_openowners(struct list_head *reaplist)
6799 {
6800         struct nfs4_client *clp;
6801         struct nfs4_openowner *oop, *next;
6802
6803         list_for_each_entry_safe(oop, next, reaplist, oo_perclient) {
6804                 list_del_init(&oop->oo_perclient);
6805                 clp = oop->oo_owner.so_client;
6806                 release_openowner(oop);
6807                 put_client(clp);
6808         }
6809 }
6810
6811 u64
6812 nfsd_inject_forget_client_openowners(struct sockaddr_storage *addr,
6813                                      size_t addr_size)
6814 {
6815         unsigned int count = 0;
6816         struct nfs4_client *clp;
6817         struct nfsd_net *nn = net_generic(current->nsproxy->net_ns,
6818                                                 nfsd_net_id);
6819         LIST_HEAD(reaplist);
6820
6821         if (!nfsd_netns_ready(nn))
6822                 return count;
6823
6824         spin_lock(&nn->client_lock);
6825         clp = nfsd_find_client(addr, addr_size);
6826         if (clp)
6827                 count = nfsd_collect_client_openowners(clp, &reaplist, 0);
6828         spin_unlock(&nn->client_lock);
6829         nfsd_reap_openowners(&reaplist);
6830         return count;
6831 }
6832
6833 u64
6834 nfsd_inject_forget_openowners(u64 max)
6835 {
6836         u64 count = 0;
6837         struct nfs4_client *clp;
6838         struct nfsd_net *nn = net_generic(current->nsproxy->net_ns,
6839                                                 nfsd_net_id);
6840         LIST_HEAD(reaplist);
6841
6842         if (!nfsd_netns_ready(nn))
6843                 return count;
6844
6845         spin_lock(&nn->client_lock);
6846         list_for_each_entry(clp, &nn->client_lru, cl_lru) {
6847                 count += nfsd_collect_client_openowners(clp, &reaplist,
6848                                                         max - count);
6849                 if (max != 0 && count >= max)
6850                         break;
6851         }
6852         spin_unlock(&nn->client_lock);
6853         nfsd_reap_openowners(&reaplist);
6854         return count;
6855 }
6856
6857 static u64 nfsd_find_all_delegations(struct nfs4_client *clp, u64 max,
6858                                      struct list_head *victims)
6859 {
6860         struct nfs4_delegation *dp, *next;
6861         struct nfsd_net *nn = net_generic(current->nsproxy->net_ns,
6862                                                 nfsd_net_id);
6863         u64 count = 0;
6864
6865         lockdep_assert_held(&nn->client_lock);
6866
6867         spin_lock(&state_lock);
6868         list_for_each_entry_safe(dp, next, &clp->cl_delegations, dl_perclnt) {
6869                 if (victims) {
6870                         /*
6871                          * It's not safe to mess with delegations that have a
6872                          * non-zero dl_time. They might have already been broken
6873                          * and could be processed by the laundromat outside of
6874                          * the state_lock. Just leave them be.
6875                          */
6876                         if (dp->dl_time != 0)
6877                                 continue;
6878
6879                         atomic_inc(&clp->cl_refcount);
6880                         WARN_ON(!unhash_delegation_locked(dp));
6881                         list_add(&dp->dl_recall_lru, victims);
6882                 }
6883                 ++count;
6884                 /*
6885                  * Despite the fact that these functions deal with
6886                  * 64-bit integers for "count", we must ensure that
6887                  * it doesn't blow up the clp->cl_refcount. Throw a
6888                  * warning if we start to approach INT_MAX here.
6889                  */
6890                 WARN_ON_ONCE(count == (INT_MAX / 2));
6891                 if (count == max)
6892                         break;
6893         }
6894         spin_unlock(&state_lock);
6895         return count;
6896 }
6897
6898 static u64
6899 nfsd_print_client_delegations(struct nfs4_client *clp)
6900 {
6901         u64 count = nfsd_find_all_delegations(clp, 0, NULL);
6902
6903         nfsd_print_count(clp, count, "delegations");
6904         return count;
6905 }
6906
6907 u64
6908 nfsd_inject_print_delegations(void)
6909 {
6910         struct nfs4_client *clp;
6911         u64 count = 0;
6912         struct nfsd_net *nn = net_generic(current->nsproxy->net_ns,
6913                                                 nfsd_net_id);
6914
6915         if (!nfsd_netns_ready(nn))
6916                 return 0;
6917
6918         spin_lock(&nn->client_lock);
6919         list_for_each_entry(clp, &nn->client_lru, cl_lru)
6920                 count += nfsd_print_client_delegations(clp);
6921         spin_unlock(&nn->client_lock);
6922
6923         return count;
6924 }
6925
6926 static void
6927 nfsd_forget_delegations(struct list_head *reaplist)
6928 {
6929         struct nfs4_client *clp;
6930         struct nfs4_delegation *dp, *next;
6931
6932         list_for_each_entry_safe(dp, next, reaplist, dl_recall_lru) {
6933                 list_del_init(&dp->dl_recall_lru);
6934                 clp = dp->dl_stid.sc_client;
6935                 revoke_delegation(dp);
6936                 put_client(clp);
6937         }
6938 }
6939
6940 u64
6941 nfsd_inject_forget_client_delegations(struct sockaddr_storage *addr,
6942                                       size_t addr_size)
6943 {
6944         u64 count = 0;
6945         struct nfs4_client *clp;
6946         struct nfsd_net *nn = net_generic(current->nsproxy->net_ns,
6947                                                 nfsd_net_id);
6948         LIST_HEAD(reaplist);
6949
6950         if (!nfsd_netns_ready(nn))
6951                 return count;
6952
6953         spin_lock(&nn->client_lock);
6954         clp = nfsd_find_client(addr, addr_size);
6955         if (clp)
6956                 count = nfsd_find_all_delegations(clp, 0, &reaplist);
6957         spin_unlock(&nn->client_lock);
6958
6959         nfsd_forget_delegations(&reaplist);
6960         return count;
6961 }
6962
6963 u64
6964 nfsd_inject_forget_delegations(u64 max)
6965 {
6966         u64 count = 0;
6967         struct nfs4_client *clp;
6968         struct nfsd_net *nn = net_generic(current->nsproxy->net_ns,
6969                                                 nfsd_net_id);
6970         LIST_HEAD(reaplist);
6971
6972         if (!nfsd_netns_ready(nn))
6973                 return count;
6974
6975         spin_lock(&nn->client_lock);
6976         list_for_each_entry(clp, &nn->client_lru, cl_lru) {
6977                 count += nfsd_find_all_delegations(clp, max - count, &reaplist);
6978                 if (max != 0 && count >= max)
6979                         break;
6980         }
6981         spin_unlock(&nn->client_lock);
6982         nfsd_forget_delegations(&reaplist);
6983         return count;
6984 }
6985
6986 static void
6987 nfsd_recall_delegations(struct list_head *reaplist)
6988 {
6989         struct nfs4_client *clp;
6990         struct nfs4_delegation *dp, *next;
6991
6992         list_for_each_entry_safe(dp, next, reaplist, dl_recall_lru) {
6993                 list_del_init(&dp->dl_recall_lru);
6994                 clp = dp->dl_stid.sc_client;
6995                 /*
6996                  * We skipped all entries that had a zero dl_time before,
6997                  * so we can now reset the dl_time back to 0. If a delegation
6998                  * break comes in now, then it won't make any difference since
6999                  * we're recalling it either way.
7000                  */
7001                 spin_lock(&state_lock);
7002                 dp->dl_time = 0;
7003                 spin_unlock(&state_lock);
7004                 nfsd_break_one_deleg(dp);
7005                 put_client(clp);
7006         }
7007 }
7008
7009 u64
7010 nfsd_inject_recall_client_delegations(struct sockaddr_storage *addr,
7011                                       size_t addr_size)
7012 {
7013         u64 count = 0;
7014         struct nfs4_client *clp;
7015         struct nfsd_net *nn = net_generic(current->nsproxy->net_ns,
7016                                                 nfsd_net_id);
7017         LIST_HEAD(reaplist);
7018
7019         if (!nfsd_netns_ready(nn))
7020                 return count;
7021
7022         spin_lock(&nn->client_lock);
7023         clp = nfsd_find_client(addr, addr_size);
7024         if (clp)
7025                 count = nfsd_find_all_delegations(clp, 0, &reaplist);
7026         spin_unlock(&nn->client_lock);
7027
7028         nfsd_recall_delegations(&reaplist);
7029         return count;
7030 }
7031
7032 u64
7033 nfsd_inject_recall_delegations(u64 max)
7034 {
7035         u64 count = 0;
7036         struct nfs4_client *clp, *next;
7037         struct nfsd_net *nn = net_generic(current->nsproxy->net_ns,
7038                                                 nfsd_net_id);
7039         LIST_HEAD(reaplist);
7040
7041         if (!nfsd_netns_ready(nn))
7042                 return count;
7043
7044         spin_lock(&nn->client_lock);
7045         list_for_each_entry_safe(clp, next, &nn->client_lru, cl_lru) {
7046                 count += nfsd_find_all_delegations(clp, max - count, &reaplist);
7047                 if (max != 0 && ++count >= max)
7048                         break;
7049         }
7050         spin_unlock(&nn->client_lock);
7051         nfsd_recall_delegations(&reaplist);
7052         return count;
7053 }
7054 #endif /* CONFIG_NFSD_FAULT_INJECTION */
7055
7056 /*
7057  * Since the lifetime of a delegation isn't limited to that of an open, a
7058  * client may quite reasonably hang on to a delegation as long as it has
7059  * the inode cached.  This becomes an obvious problem the first time a
7060  * client's inode cache approaches the size of the server's total memory.
7061  *
7062  * For now we avoid this problem by imposing a hard limit on the number
7063  * of delegations, which varies according to the server's memory size.
7064  */
7065 static void
7066 set_max_delegations(void)
7067 {
7068         /*
7069          * Allow at most 4 delegations per megabyte of RAM.  Quick
7070          * estimates suggest that in the worst case (where every delegation
7071          * is for a different inode), a delegation could take about 1.5K,
7072          * giving a worst case usage of about 6% of memory.
7073          */
7074         max_delegations = nr_free_buffer_pages() >> (20 - 2 - PAGE_SHIFT);
7075 }
7076
7077 static int nfs4_state_create_net(struct net *net)
7078 {
7079         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
7080         int i;
7081
7082         nn->conf_id_hashtbl = kmalloc(sizeof(struct list_head) *
7083                         CLIENT_HASH_SIZE, GFP_KERNEL);
7084         if (!nn->conf_id_hashtbl)
7085                 goto err;
7086         nn->unconf_id_hashtbl = kmalloc(sizeof(struct list_head) *
7087                         CLIENT_HASH_SIZE, GFP_KERNEL);
7088         if (!nn->unconf_id_hashtbl)
7089                 goto err_unconf_id;
7090         nn->sessionid_hashtbl = kmalloc(sizeof(struct list_head) *
7091                         SESSION_HASH_SIZE, GFP_KERNEL);
7092         if (!nn->sessionid_hashtbl)
7093                 goto err_sessionid;
7094
7095         for (i = 0; i < CLIENT_HASH_SIZE; i++) {
7096                 INIT_LIST_HEAD(&nn->conf_id_hashtbl[i]);
7097                 INIT_LIST_HEAD(&nn->unconf_id_hashtbl[i]);
7098         }
7099         for (i = 0; i < SESSION_HASH_SIZE; i++)
7100                 INIT_LIST_HEAD(&nn->sessionid_hashtbl[i]);
7101         nn->conf_name_tree = RB_ROOT;
7102         nn->unconf_name_tree = RB_ROOT;
7103         INIT_LIST_HEAD(&nn->client_lru);
7104         INIT_LIST_HEAD(&nn->close_lru);
7105         INIT_LIST_HEAD(&nn->del_recall_lru);
7106         spin_lock_init(&nn->client_lock);
7107
7108         spin_lock_init(&nn->blocked_locks_lock);
7109         INIT_LIST_HEAD(&nn->blocked_locks_lru);
7110
7111         INIT_DELAYED_WORK(&nn->laundromat_work, laundromat_main);
7112         get_net(net);
7113
7114         return 0;
7115
7116 err_sessionid:
7117         kfree(nn->unconf_id_hashtbl);
7118 err_unconf_id:
7119         kfree(nn->conf_id_hashtbl);
7120 err:
7121         return -ENOMEM;
7122 }
7123
7124 static void
7125 nfs4_state_destroy_net(struct net *net)
7126 {
7127         int i;
7128         struct nfs4_client *clp = NULL;
7129         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
7130
7131         for (i = 0; i < CLIENT_HASH_SIZE; i++) {
7132                 while (!list_empty(&nn->conf_id_hashtbl[i])) {
7133                         clp = list_entry(nn->conf_id_hashtbl[i].next, struct nfs4_client, cl_idhash);
7134                         destroy_client(clp);
7135                 }
7136         }
7137
7138         for (i = 0; i < CLIENT_HASH_SIZE; i++) {
7139                 while (!list_empty(&nn->unconf_id_hashtbl[i])) {
7140                         clp = list_entry(nn->unconf_id_hashtbl[i].next, struct nfs4_client, cl_idhash);
7141                         destroy_client(clp);
7142                 }
7143         }
7144
7145         kfree(nn->sessionid_hashtbl);
7146         kfree(nn->unconf_id_hashtbl);
7147         kfree(nn->conf_id_hashtbl);
7148         put_net(net);
7149 }
7150
7151 int
7152 nfs4_state_start_net(struct net *net)
7153 {
7154         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
7155         int ret;
7156
7157         ret = nfs4_state_create_net(net);
7158         if (ret)
7159                 return ret;
7160         nn->boot_time = get_seconds();
7161         nn->grace_ended = false;
7162         nn->nfsd4_manager.block_opens = true;
7163         locks_start_grace(net, &nn->nfsd4_manager);
7164         nfsd4_client_tracking_init(net);
7165         printk(KERN_INFO "NFSD: starting %ld-second grace period (net %x)\n",
7166                nn->nfsd4_grace, net->ns.inum);
7167         queue_delayed_work(laundry_wq, &nn->laundromat_work, nn->nfsd4_grace * HZ);
7168         return 0;
7169 }
7170
7171 /* initialization to perform when the nfsd service is started: */
7172
7173 int
7174 nfs4_state_start(void)
7175 {
7176         int ret;
7177
7178         ret = set_callback_cred();
7179         if (ret)
7180                 return ret;
7181
7182         laundry_wq = alloc_workqueue("%s", WQ_UNBOUND, 0, "nfsd4");
7183         if (laundry_wq == NULL) {
7184                 ret = -ENOMEM;
7185                 goto out_cleanup_cred;
7186         }
7187         ret = nfsd4_create_callback_queue();
7188         if (ret)
7189                 goto out_free_laundry;
7190
7191         set_max_delegations();
7192         return 0;
7193
7194 out_free_laundry:
7195         destroy_workqueue(laundry_wq);
7196 out_cleanup_cred:
7197         cleanup_callback_cred();
7198         return ret;
7199 }
7200
7201 void
7202 nfs4_state_shutdown_net(struct net *net)
7203 {
7204         struct nfs4_delegation *dp = NULL;
7205         struct list_head *pos, *next, reaplist;
7206         struct nfsd_net *nn = net_generic(net, nfsd_net_id);
7207         struct nfsd4_blocked_lock *nbl;
7208
7209         cancel_delayed_work_sync(&nn->laundromat_work);
7210         locks_end_grace(&nn->nfsd4_manager);
7211
7212         INIT_LIST_HEAD(&reaplist);
7213         spin_lock(&state_lock);
7214         list_for_each_safe(pos, next, &nn->del_recall_lru) {
7215                 dp = list_entry (pos, struct nfs4_delegation, dl_recall_lru);
7216                 WARN_ON(!unhash_delegation_locked(dp));
7217                 list_add(&dp->dl_recall_lru, &reaplist);
7218         }
7219         spin_unlock(&state_lock);
7220         list_for_each_safe(pos, next, &reaplist) {
7221                 dp = list_entry (pos, struct nfs4_delegation, dl_recall_lru);
7222                 list_del_init(&dp->dl_recall_lru);
7223                 put_clnt_odstate(dp->dl_clnt_odstate);
7224                 nfs4_put_deleg_lease(dp->dl_stid.sc_file);
7225                 nfs4_put_stid(&dp->dl_stid);
7226         }
7227
7228         BUG_ON(!list_empty(&reaplist));
7229         spin_lock(&nn->blocked_locks_lock);
7230         while (!list_empty(&nn->blocked_locks_lru)) {
7231                 nbl = list_first_entry(&nn->blocked_locks_lru,
7232                                         struct nfsd4_blocked_lock, nbl_lru);
7233                 list_move(&nbl->nbl_lru, &reaplist);
7234                 list_del_init(&nbl->nbl_list);
7235         }
7236         spin_unlock(&nn->blocked_locks_lock);
7237
7238         while (!list_empty(&reaplist)) {
7239                 nbl = list_first_entry(&reaplist,
7240                                         struct nfsd4_blocked_lock, nbl_lru);
7241                 list_del_init(&nbl->nbl_lru);
7242                 posix_unblock_lock(&nbl->nbl_lock);
7243                 free_blocked_lock(nbl);
7244         }
7245
7246         nfsd4_client_tracking_exit(net);
7247         nfs4_state_destroy_net(net);
7248 }
7249
7250 void
7251 nfs4_state_shutdown(void)
7252 {
7253         destroy_workqueue(laundry_wq);
7254         nfsd4_destroy_callback_queue();
7255         cleanup_callback_cred();
7256 }
7257
7258 static void
7259 get_stateid(struct nfsd4_compound_state *cstate, stateid_t *stateid)
7260 {
7261         if (HAS_STATE_ID(cstate, CURRENT_STATE_ID_FLAG) && CURRENT_STATEID(stateid))
7262                 memcpy(stateid, &cstate->current_stateid, sizeof(stateid_t));
7263 }
7264
7265 static void
7266 put_stateid(struct nfsd4_compound_state *cstate, stateid_t *stateid)
7267 {
7268         if (cstate->minorversion) {
7269                 memcpy(&cstate->current_stateid, stateid, sizeof(stateid_t));
7270                 SET_STATE_ID(cstate, CURRENT_STATE_ID_FLAG);
7271         }
7272 }
7273
7274 void
7275 clear_current_stateid(struct nfsd4_compound_state *cstate)
7276 {
7277         CLEAR_STATE_ID(cstate, CURRENT_STATE_ID_FLAG);
7278 }
7279
7280 /*
7281  * functions to set current state id
7282  */
7283 void
7284 nfsd4_set_opendowngradestateid(struct nfsd4_compound_state *cstate,
7285                 union nfsd4_op_u *u)
7286 {
7287         put_stateid(cstate, &u->open_downgrade.od_stateid);
7288 }
7289
7290 void
7291 nfsd4_set_openstateid(struct nfsd4_compound_state *cstate,
7292                 union nfsd4_op_u *u)
7293 {
7294         put_stateid(cstate, &u->open.op_stateid);
7295 }
7296
7297 void
7298 nfsd4_set_closestateid(struct nfsd4_compound_state *cstate,
7299                 union nfsd4_op_u *u)
7300 {
7301         put_stateid(cstate, &u->close.cl_stateid);
7302 }
7303
7304 void
7305 nfsd4_set_lockstateid(struct nfsd4_compound_state *cstate,
7306                 union nfsd4_op_u *u)
7307 {
7308         put_stateid(cstate, &u->lock.lk_resp_stateid);
7309 }
7310
7311 /*
7312  * functions to consume current state id
7313  */
7314
7315 void
7316 nfsd4_get_opendowngradestateid(struct nfsd4_compound_state *cstate,
7317                 union nfsd4_op_u *u)
7318 {
7319         get_stateid(cstate, &u->open_downgrade.od_stateid);
7320 }
7321
7322 void
7323 nfsd4_get_delegreturnstateid(struct nfsd4_compound_state *cstate,
7324                 union nfsd4_op_u *u)
7325 {
7326         get_stateid(cstate, &u->delegreturn.dr_stateid);
7327 }
7328
7329 void
7330 nfsd4_get_freestateid(struct nfsd4_compound_state *cstate,
7331                 union nfsd4_op_u *u)
7332 {
7333         get_stateid(cstate, &u->free_stateid.fr_stateid);
7334 }
7335
7336 void
7337 nfsd4_get_setattrstateid(struct nfsd4_compound_state *cstate,
7338                 union nfsd4_op_u *u)
7339 {
7340         get_stateid(cstate, &u->setattr.sa_stateid);
7341 }
7342
7343 void
7344 nfsd4_get_closestateid(struct nfsd4_compound_state *cstate,
7345                 union nfsd4_op_u *u)
7346 {
7347         get_stateid(cstate, &u->close.cl_stateid);
7348 }
7349
7350 void
7351 nfsd4_get_lockustateid(struct nfsd4_compound_state *cstate,
7352                 union nfsd4_op_u *u)
7353 {
7354         get_stateid(cstate, &u->locku.lu_stateid);
7355 }
7356
7357 void
7358 nfsd4_get_readstateid(struct nfsd4_compound_state *cstate,
7359                 union nfsd4_op_u *u)
7360 {
7361         get_stateid(cstate, &u->read.rd_stateid);
7362 }
7363
7364 void
7365 nfsd4_get_writestateid(struct nfsd4_compound_state *cstate,
7366                 union nfsd4_op_u *u)
7367 {
7368         get_stateid(cstate, &u->write.wr_stateid);
7369 }