296eded356b67b8afba95c61e6d9b2d4877efd86
[safe/jmp/linux-2.6] / fs / nfsd / nfs4state.c
1 /*
2 *  Copyright (c) 2001 The Regents of the University of Michigan.
3 *  All rights reserved.
4 *
5 *  Kendrick Smith <kmsmith@umich.edu>
6 *  Andy Adamson <kandros@umich.edu>
7 *
8 *  Redistribution and use in source and binary forms, with or without
9 *  modification, are permitted provided that the following conditions
10 *  are met:
11 *
12 *  1. Redistributions of source code must retain the above copyright
13 *     notice, this list of conditions and the following disclaimer.
14 *  2. Redistributions in binary form must reproduce the above copyright
15 *     notice, this list of conditions and the following disclaimer in the
16 *     documentation and/or other materials provided with the distribution.
17 *  3. Neither the name of the University nor the names of its
18 *     contributors may be used to endorse or promote products derived
19 *     from this software without specific prior written permission.
20 *
21 *  THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
22 *  WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
23 *  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
24 *  DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
25 *  FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
26 *  CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
27 *  SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
28 *  BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
29 *  LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
30 *  NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
31 *  SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
32 *
33 */
34
35 #include <linux/file.h>
36 #include <linux/smp_lock.h>
37 #include <linux/slab.h>
38 #include <linux/namei.h>
39 #include <linux/swap.h>
40 #include <linux/sunrpc/svcauth_gss.h>
41 #include <linux/sunrpc/clnt.h>
42 #include "xdr4.h"
43 #include "vfs.h"
44
45 #define NFSDDBG_FACILITY                NFSDDBG_PROC
46
47 /* Globals */
48 time_t nfsd4_lease = 90;     /* default lease time */
49 time_t nfsd4_grace = 90;
50 static time_t boot_time;
51 static u32 current_ownerid = 1;
52 static u32 current_fileid = 1;
53 static u32 current_delegid = 1;
54 static u32 nfs4_init;
55 static stateid_t zerostateid;             /* bits all 0 */
56 static stateid_t onestateid;              /* bits all 1 */
57 static u64 current_sessionid = 1;
58
59 #define ZERO_STATEID(stateid) (!memcmp((stateid), &zerostateid, sizeof(stateid_t)))
60 #define ONE_STATEID(stateid)  (!memcmp((stateid), &onestateid, sizeof(stateid_t)))
61
62 /* forward declarations */
63 static struct nfs4_stateid * find_stateid(stateid_t *stid, int flags);
64 static struct nfs4_delegation * find_delegation_stateid(struct inode *ino, stateid_t *stid);
65 static char user_recovery_dirname[PATH_MAX] = "/var/lib/nfs/v4recovery";
66 static void nfs4_set_recdir(char *recdir);
67
68 /* Locking: */
69
70 /* Currently used for almost all code touching nfsv4 state: */
71 static DEFINE_MUTEX(client_mutex);
72
73 /*
74  * Currently used for the del_recall_lru and file hash table.  In an
75  * effort to decrease the scope of the client_mutex, this spinlock may
76  * eventually cover more:
77  */
78 static DEFINE_SPINLOCK(recall_lock);
79
80 static struct kmem_cache *stateowner_slab = NULL;
81 static struct kmem_cache *file_slab = NULL;
82 static struct kmem_cache *stateid_slab = NULL;
83 static struct kmem_cache *deleg_slab = NULL;
84
85 void
86 nfs4_lock_state(void)
87 {
88         mutex_lock(&client_mutex);
89 }
90
91 void
92 nfs4_unlock_state(void)
93 {
94         mutex_unlock(&client_mutex);
95 }
96
97 static inline u32
98 opaque_hashval(const void *ptr, int nbytes)
99 {
100         unsigned char *cptr = (unsigned char *) ptr;
101
102         u32 x = 0;
103         while (nbytes--) {
104                 x *= 37;
105                 x += *cptr++;
106         }
107         return x;
108 }
109
110 static struct list_head del_recall_lru;
111
112 static inline void
113 put_nfs4_file(struct nfs4_file *fi)
114 {
115         if (atomic_dec_and_lock(&fi->fi_ref, &recall_lock)) {
116                 list_del(&fi->fi_hash);
117                 spin_unlock(&recall_lock);
118                 iput(fi->fi_inode);
119                 kmem_cache_free(file_slab, fi);
120         }
121 }
122
123 static inline void
124 get_nfs4_file(struct nfs4_file *fi)
125 {
126         atomic_inc(&fi->fi_ref);
127 }
128
129 static int num_delegations;
130 unsigned int max_delegations;
131
132 /*
133  * Open owner state (share locks)
134  */
135
136 /* hash tables for nfs4_stateowner */
137 #define OWNER_HASH_BITS              8
138 #define OWNER_HASH_SIZE             (1 << OWNER_HASH_BITS)
139 #define OWNER_HASH_MASK             (OWNER_HASH_SIZE - 1)
140
141 #define ownerid_hashval(id) \
142         ((id) & OWNER_HASH_MASK)
143 #define ownerstr_hashval(clientid, ownername) \
144         (((clientid) + opaque_hashval((ownername.data), (ownername.len))) & OWNER_HASH_MASK)
145
146 static struct list_head ownerid_hashtbl[OWNER_HASH_SIZE];
147 static struct list_head ownerstr_hashtbl[OWNER_HASH_SIZE];
148
149 /* hash table for nfs4_file */
150 #define FILE_HASH_BITS                   8
151 #define FILE_HASH_SIZE                  (1 << FILE_HASH_BITS)
152 #define FILE_HASH_MASK                  (FILE_HASH_SIZE - 1)
153 /* hash table for (open)nfs4_stateid */
154 #define STATEID_HASH_BITS              10
155 #define STATEID_HASH_SIZE              (1 << STATEID_HASH_BITS)
156 #define STATEID_HASH_MASK              (STATEID_HASH_SIZE - 1)
157
158 #define file_hashval(x) \
159         hash_ptr(x, FILE_HASH_BITS)
160 #define stateid_hashval(owner_id, file_id)  \
161         (((owner_id) + (file_id)) & STATEID_HASH_MASK)
162
163 static struct list_head file_hashtbl[FILE_HASH_SIZE];
164 static struct list_head stateid_hashtbl[STATEID_HASH_SIZE];
165
166 static struct nfs4_delegation *
167 alloc_init_deleg(struct nfs4_client *clp, struct nfs4_stateid *stp, struct svc_fh *current_fh, u32 type)
168 {
169         struct nfs4_delegation *dp;
170         struct nfs4_file *fp = stp->st_file;
171         struct nfs4_cb_conn *cb = &stp->st_stateowner->so_client->cl_cb_conn;
172
173         dprintk("NFSD alloc_init_deleg\n");
174         if (fp->fi_had_conflict)
175                 return NULL;
176         if (num_delegations > max_delegations)
177                 return NULL;
178         dp = kmem_cache_alloc(deleg_slab, GFP_KERNEL);
179         if (dp == NULL)
180                 return dp;
181         num_delegations++;
182         INIT_LIST_HEAD(&dp->dl_perfile);
183         INIT_LIST_HEAD(&dp->dl_perclnt);
184         INIT_LIST_HEAD(&dp->dl_recall_lru);
185         dp->dl_client = clp;
186         get_nfs4_file(fp);
187         dp->dl_file = fp;
188         dp->dl_flock = NULL;
189         get_file(stp->st_vfs_file);
190         dp->dl_vfs_file = stp->st_vfs_file;
191         dp->dl_type = type;
192         dp->dl_ident = cb->cb_ident;
193         dp->dl_stateid.si_boot = get_seconds();
194         dp->dl_stateid.si_stateownerid = current_delegid++;
195         dp->dl_stateid.si_fileid = 0;
196         dp->dl_stateid.si_generation = 0;
197         fh_copy_shallow(&dp->dl_fh, &current_fh->fh_handle);
198         dp->dl_time = 0;
199         atomic_set(&dp->dl_count, 1);
200         list_add(&dp->dl_perfile, &fp->fi_delegations);
201         list_add(&dp->dl_perclnt, &clp->cl_delegations);
202         INIT_WORK(&dp->dl_recall.cb_work, nfsd4_do_callback_rpc);
203         return dp;
204 }
205
206 void
207 nfs4_put_delegation(struct nfs4_delegation *dp)
208 {
209         if (atomic_dec_and_test(&dp->dl_count)) {
210                 dprintk("NFSD: freeing dp %p\n",dp);
211                 put_nfs4_file(dp->dl_file);
212                 kmem_cache_free(deleg_slab, dp);
213                 num_delegations--;
214         }
215 }
216
217 /* Remove the associated file_lock first, then remove the delegation.
218  * lease_modify() is called to remove the FS_LEASE file_lock from
219  * the i_flock list, eventually calling nfsd's lock_manager
220  * fl_release_callback.
221  */
222 static void
223 nfs4_close_delegation(struct nfs4_delegation *dp)
224 {
225         struct file *filp = dp->dl_vfs_file;
226
227         dprintk("NFSD: close_delegation dp %p\n",dp);
228         dp->dl_vfs_file = NULL;
229         /* The following nfsd_close may not actually close the file,
230          * but we want to remove the lease in any case. */
231         if (dp->dl_flock)
232                 vfs_setlease(filp, F_UNLCK, &dp->dl_flock);
233         nfsd_close(filp);
234 }
235
236 /* Called under the state lock. */
237 static void
238 unhash_delegation(struct nfs4_delegation *dp)
239 {
240         list_del_init(&dp->dl_perfile);
241         list_del_init(&dp->dl_perclnt);
242         spin_lock(&recall_lock);
243         list_del_init(&dp->dl_recall_lru);
244         spin_unlock(&recall_lock);
245         nfs4_close_delegation(dp);
246         nfs4_put_delegation(dp);
247 }
248
249 /* 
250  * SETCLIENTID state 
251  */
252
253 /* client_lock protects the client lru list and session hash table */
254 static DEFINE_SPINLOCK(client_lock);
255
256 /* Hash tables for nfs4_clientid state */
257 #define CLIENT_HASH_BITS                 4
258 #define CLIENT_HASH_SIZE                (1 << CLIENT_HASH_BITS)
259 #define CLIENT_HASH_MASK                (CLIENT_HASH_SIZE - 1)
260
261 #define clientid_hashval(id) \
262         ((id) & CLIENT_HASH_MASK)
263 #define clientstr_hashval(name) \
264         (opaque_hashval((name), 8) & CLIENT_HASH_MASK)
265 /*
266  * reclaim_str_hashtbl[] holds known client info from previous reset/reboot
267  * used in reboot/reset lease grace period processing
268  *
269  * conf_id_hashtbl[], and conf_str_hashtbl[] hold confirmed
270  * setclientid_confirmed info. 
271  *
272  * unconf_str_hastbl[] and unconf_id_hashtbl[] hold unconfirmed 
273  * setclientid info.
274  *
275  * client_lru holds client queue ordered by nfs4_client.cl_time
276  * for lease renewal.
277  *
278  * close_lru holds (open) stateowner queue ordered by nfs4_stateowner.so_time
279  * for last close replay.
280  */
281 static struct list_head reclaim_str_hashtbl[CLIENT_HASH_SIZE];
282 static int reclaim_str_hashtbl_size = 0;
283 static struct list_head conf_id_hashtbl[CLIENT_HASH_SIZE];
284 static struct list_head conf_str_hashtbl[CLIENT_HASH_SIZE];
285 static struct list_head unconf_str_hashtbl[CLIENT_HASH_SIZE];
286 static struct list_head unconf_id_hashtbl[CLIENT_HASH_SIZE];
287 static struct list_head client_lru;
288 static struct list_head close_lru;
289
290 static void unhash_generic_stateid(struct nfs4_stateid *stp)
291 {
292         list_del(&stp->st_hash);
293         list_del(&stp->st_perfile);
294         list_del(&stp->st_perstateowner);
295 }
296
297 static void free_generic_stateid(struct nfs4_stateid *stp)
298 {
299         put_nfs4_file(stp->st_file);
300         kmem_cache_free(stateid_slab, stp);
301 }
302
303 static void release_lock_stateid(struct nfs4_stateid *stp)
304 {
305         unhash_generic_stateid(stp);
306         locks_remove_posix(stp->st_vfs_file, (fl_owner_t)stp->st_stateowner);
307         free_generic_stateid(stp);
308 }
309
310 static void unhash_lockowner(struct nfs4_stateowner *sop)
311 {
312         struct nfs4_stateid *stp;
313
314         list_del(&sop->so_idhash);
315         list_del(&sop->so_strhash);
316         list_del(&sop->so_perstateid);
317         while (!list_empty(&sop->so_stateids)) {
318                 stp = list_first_entry(&sop->so_stateids,
319                                 struct nfs4_stateid, st_perstateowner);
320                 release_lock_stateid(stp);
321         }
322 }
323
324 static void release_lockowner(struct nfs4_stateowner *sop)
325 {
326         unhash_lockowner(sop);
327         nfs4_put_stateowner(sop);
328 }
329
330 static void
331 release_stateid_lockowners(struct nfs4_stateid *open_stp)
332 {
333         struct nfs4_stateowner *lock_sop;
334
335         while (!list_empty(&open_stp->st_lockowners)) {
336                 lock_sop = list_entry(open_stp->st_lockowners.next,
337                                 struct nfs4_stateowner, so_perstateid);
338                 /* list_del(&open_stp->st_lockowners);  */
339                 BUG_ON(lock_sop->so_is_open_owner);
340                 release_lockowner(lock_sop);
341         }
342 }
343
344 static void release_open_stateid(struct nfs4_stateid *stp)
345 {
346         unhash_generic_stateid(stp);
347         release_stateid_lockowners(stp);
348         nfsd_close(stp->st_vfs_file);
349         free_generic_stateid(stp);
350 }
351
352 static void unhash_openowner(struct nfs4_stateowner *sop)
353 {
354         struct nfs4_stateid *stp;
355
356         list_del(&sop->so_idhash);
357         list_del(&sop->so_strhash);
358         list_del(&sop->so_perclient);
359         list_del(&sop->so_perstateid); /* XXX: necessary? */
360         while (!list_empty(&sop->so_stateids)) {
361                 stp = list_first_entry(&sop->so_stateids,
362                                 struct nfs4_stateid, st_perstateowner);
363                 release_open_stateid(stp);
364         }
365 }
366
367 static void release_openowner(struct nfs4_stateowner *sop)
368 {
369         unhash_openowner(sop);
370         list_del(&sop->so_close_lru);
371         nfs4_put_stateowner(sop);
372 }
373
374 #define SESSION_HASH_SIZE       512
375 static struct list_head sessionid_hashtbl[SESSION_HASH_SIZE];
376
377 static inline int
378 hash_sessionid(struct nfs4_sessionid *sessionid)
379 {
380         struct nfsd4_sessionid *sid = (struct nfsd4_sessionid *)sessionid;
381
382         return sid->sequence % SESSION_HASH_SIZE;
383 }
384
385 static inline void
386 dump_sessionid(const char *fn, struct nfs4_sessionid *sessionid)
387 {
388         u32 *ptr = (u32 *)(&sessionid->data[0]);
389         dprintk("%s: %u:%u:%u:%u\n", fn, ptr[0], ptr[1], ptr[2], ptr[3]);
390 }
391
392 static void
393 gen_sessionid(struct nfsd4_session *ses)
394 {
395         struct nfs4_client *clp = ses->se_client;
396         struct nfsd4_sessionid *sid;
397
398         sid = (struct nfsd4_sessionid *)ses->se_sessionid.data;
399         sid->clientid = clp->cl_clientid;
400         sid->sequence = current_sessionid++;
401         sid->reserved = 0;
402 }
403
404 /*
405  * The protocol defines ca_maxresponssize_cached to include the size of
406  * the rpc header, but all we need to cache is the data starting after
407  * the end of the initial SEQUENCE operation--the rest we regenerate
408  * each time.  Therefore we can advertise a ca_maxresponssize_cached
409  * value that is the number of bytes in our cache plus a few additional
410  * bytes.  In order to stay on the safe side, and not promise more than
411  * we can cache, those additional bytes must be the minimum possible: 24
412  * bytes of rpc header (xid through accept state, with AUTH_NULL
413  * verifier), 12 for the compound header (with zero-length tag), and 44
414  * for the SEQUENCE op response:
415  */
416 #define NFSD_MIN_HDR_SEQ_SZ  (24 + 12 + 44)
417
418 /*
419  * Give the client the number of ca_maxresponsesize_cached slots it
420  * requests, of size bounded by NFSD_SLOT_CACHE_SIZE,
421  * NFSD_MAX_MEM_PER_SESSION, and nfsd_drc_max_mem. Do not allow more
422  * than NFSD_MAX_SLOTS_PER_SESSION.
423  *
424  * If we run out of reserved DRC memory we should (up to a point)
425  * re-negotiate active sessions and reduce their slot usage to make
426  * rooom for new connections. For now we just fail the create session.
427  */
428 static int set_forechannel_drc_size(struct nfsd4_channel_attrs *fchan)
429 {
430         int mem, size = fchan->maxresp_cached;
431
432         if (fchan->maxreqs < 1)
433                 return nfserr_inval;
434
435         if (size < NFSD_MIN_HDR_SEQ_SZ)
436                 size = NFSD_MIN_HDR_SEQ_SZ;
437         size -= NFSD_MIN_HDR_SEQ_SZ;
438         if (size > NFSD_SLOT_CACHE_SIZE)
439                 size = NFSD_SLOT_CACHE_SIZE;
440
441         /* bound the maxreqs by NFSD_MAX_MEM_PER_SESSION */
442         mem = fchan->maxreqs * size;
443         if (mem > NFSD_MAX_MEM_PER_SESSION) {
444                 fchan->maxreqs = NFSD_MAX_MEM_PER_SESSION / size;
445                 if (fchan->maxreqs > NFSD_MAX_SLOTS_PER_SESSION)
446                         fchan->maxreqs = NFSD_MAX_SLOTS_PER_SESSION;
447                 mem = fchan->maxreqs * size;
448         }
449
450         spin_lock(&nfsd_drc_lock);
451         /* bound the total session drc memory ussage */
452         if (mem + nfsd_drc_mem_used > nfsd_drc_max_mem) {
453                 fchan->maxreqs = (nfsd_drc_max_mem - nfsd_drc_mem_used) / size;
454                 mem = fchan->maxreqs * size;
455         }
456         nfsd_drc_mem_used += mem;
457         spin_unlock(&nfsd_drc_lock);
458
459         if (fchan->maxreqs == 0)
460                 return nfserr_serverfault;
461
462         fchan->maxresp_cached = size + NFSD_MIN_HDR_SEQ_SZ;
463         return 0;
464 }
465
466 /*
467  * fchan holds the client values on input, and the server values on output
468  * sv_max_mesg is the maximum payload plus one page for overhead.
469  */
470 static int init_forechannel_attrs(struct svc_rqst *rqstp,
471                                   struct nfsd4_channel_attrs *session_fchan,
472                                   struct nfsd4_channel_attrs *fchan)
473 {
474         int status = 0;
475         __u32   maxcount = nfsd_serv->sv_max_mesg;
476
477         /* headerpadsz set to zero in encode routine */
478
479         /* Use the client's max request and max response size if possible */
480         if (fchan->maxreq_sz > maxcount)
481                 fchan->maxreq_sz = maxcount;
482         session_fchan->maxreq_sz = fchan->maxreq_sz;
483
484         if (fchan->maxresp_sz > maxcount)
485                 fchan->maxresp_sz = maxcount;
486         session_fchan->maxresp_sz = fchan->maxresp_sz;
487
488         /* Use the client's maxops if possible */
489         if (fchan->maxops > NFSD_MAX_OPS_PER_COMPOUND)
490                 fchan->maxops = NFSD_MAX_OPS_PER_COMPOUND;
491         session_fchan->maxops = fchan->maxops;
492
493         /* FIXME: Error means no more DRC pages so the server should
494          * recover pages from existing sessions. For now fail session
495          * creation.
496          */
497         status = set_forechannel_drc_size(fchan);
498
499         session_fchan->maxresp_cached = fchan->maxresp_cached;
500         session_fchan->maxreqs = fchan->maxreqs;
501
502         dprintk("%s status %d\n", __func__, status);
503         return status;
504 }
505
506 static void
507 free_session_slots(struct nfsd4_session *ses)
508 {
509         int i;
510
511         for (i = 0; i < ses->se_fchannel.maxreqs; i++)
512                 kfree(ses->se_slots[i]);
513 }
514
515 /*
516  * We don't actually need to cache the rpc and session headers, so we
517  * can allocate a little less for each slot:
518  */
519 static inline int slot_bytes(struct nfsd4_channel_attrs *ca)
520 {
521         return ca->maxresp_cached - NFSD_MIN_HDR_SEQ_SZ;
522 }
523
524 static int
525 alloc_init_session(struct svc_rqst *rqstp, struct nfs4_client *clp,
526                    struct nfsd4_create_session *cses)
527 {
528         struct nfsd4_session *new, tmp;
529         struct nfsd4_slot *sp;
530         int idx, slotsize, cachesize, i;
531         int status;
532
533         memset(&tmp, 0, sizeof(tmp));
534
535         /* FIXME: For now, we just accept the client back channel attributes. */
536         tmp.se_bchannel = cses->back_channel;
537         status = init_forechannel_attrs(rqstp, &tmp.se_fchannel,
538                                         &cses->fore_channel);
539         if (status)
540                 goto out;
541
542         BUILD_BUG_ON(NFSD_MAX_SLOTS_PER_SESSION * sizeof(struct nfsd4_slot)
543                      + sizeof(struct nfsd4_session) > PAGE_SIZE);
544
545         status = nfserr_serverfault;
546         /* allocate struct nfsd4_session and slot table pointers in one piece */
547         slotsize = tmp.se_fchannel.maxreqs * sizeof(struct nfsd4_slot *);
548         new = kzalloc(sizeof(*new) + slotsize, GFP_KERNEL);
549         if (!new)
550                 goto out;
551
552         memcpy(new, &tmp, sizeof(*new));
553
554         /* allocate each struct nfsd4_slot and data cache in one piece */
555         cachesize = slot_bytes(&new->se_fchannel);
556         for (i = 0; i < new->se_fchannel.maxreqs; i++) {
557                 sp = kzalloc(sizeof(*sp) + cachesize, GFP_KERNEL);
558                 if (!sp)
559                         goto out_free;
560                 new->se_slots[i] = sp;
561         }
562
563         new->se_client = clp;
564         gen_sessionid(new);
565         idx = hash_sessionid(&new->se_sessionid);
566         memcpy(clp->cl_sessionid.data, new->se_sessionid.data,
567                NFS4_MAX_SESSIONID_LEN);
568
569         new->se_flags = cses->flags;
570         kref_init(&new->se_ref);
571         spin_lock(&client_lock);
572         list_add(&new->se_hash, &sessionid_hashtbl[idx]);
573         list_add(&new->se_perclnt, &clp->cl_sessions);
574         spin_unlock(&client_lock);
575
576         status = nfs_ok;
577 out:
578         return status;
579 out_free:
580         free_session_slots(new);
581         kfree(new);
582         goto out;
583 }
584
585 /* caller must hold client_lock */
586 static struct nfsd4_session *
587 find_in_sessionid_hashtbl(struct nfs4_sessionid *sessionid)
588 {
589         struct nfsd4_session *elem;
590         int idx;
591
592         dump_sessionid(__func__, sessionid);
593         idx = hash_sessionid(sessionid);
594         dprintk("%s: idx is %d\n", __func__, idx);
595         /* Search in the appropriate list */
596         list_for_each_entry(elem, &sessionid_hashtbl[idx], se_hash) {
597                 dump_sessionid("list traversal", &elem->se_sessionid);
598                 if (!memcmp(elem->se_sessionid.data, sessionid->data,
599                             NFS4_MAX_SESSIONID_LEN)) {
600                         return elem;
601                 }
602         }
603
604         dprintk("%s: session not found\n", __func__);
605         return NULL;
606 }
607
608 /* caller must hold client_lock */
609 static void
610 unhash_session(struct nfsd4_session *ses)
611 {
612         list_del(&ses->se_hash);
613         list_del(&ses->se_perclnt);
614 }
615
616 void
617 free_session(struct kref *kref)
618 {
619         struct nfsd4_session *ses;
620         int mem;
621
622         ses = container_of(kref, struct nfsd4_session, se_ref);
623         spin_lock(&nfsd_drc_lock);
624         mem = ses->se_fchannel.maxreqs * slot_bytes(&ses->se_fchannel);
625         nfsd_drc_mem_used -= mem;
626         spin_unlock(&nfsd_drc_lock);
627         free_session_slots(ses);
628         kfree(ses);
629 }
630
631 /* must be called under the client_lock */
632 static inline void
633 renew_client_locked(struct nfs4_client *clp)
634 {
635         if (is_client_expired(clp)) {
636                 dprintk("%s: client (clientid %08x/%08x) already expired\n",
637                         __func__,
638                         clp->cl_clientid.cl_boot,
639                         clp->cl_clientid.cl_id);
640                 return;
641         }
642
643         /*
644         * Move client to the end to the LRU list.
645         */
646         dprintk("renewing client (clientid %08x/%08x)\n", 
647                         clp->cl_clientid.cl_boot, 
648                         clp->cl_clientid.cl_id);
649         list_move_tail(&clp->cl_lru, &client_lru);
650         clp->cl_time = get_seconds();
651 }
652
653 static inline void
654 renew_client(struct nfs4_client *clp)
655 {
656         spin_lock(&client_lock);
657         renew_client_locked(clp);
658         spin_unlock(&client_lock);
659 }
660
661 /* SETCLIENTID and SETCLIENTID_CONFIRM Helper functions */
662 static int
663 STALE_CLIENTID(clientid_t *clid)
664 {
665         if (clid->cl_boot == boot_time)
666                 return 0;
667         dprintk("NFSD stale clientid (%08x/%08x) boot_time %08lx\n",
668                 clid->cl_boot, clid->cl_id, boot_time);
669         return 1;
670 }
671
672 /* 
673  * XXX Should we use a slab cache ?
674  * This type of memory management is somewhat inefficient, but we use it
675  * anyway since SETCLIENTID is not a common operation.
676  */
677 static struct nfs4_client *alloc_client(struct xdr_netobj name)
678 {
679         struct nfs4_client *clp;
680
681         clp = kzalloc(sizeof(struct nfs4_client), GFP_KERNEL);
682         if (clp == NULL)
683                 return NULL;
684         clp->cl_name.data = kmalloc(name.len, GFP_KERNEL);
685         if (clp->cl_name.data == NULL) {
686                 kfree(clp);
687                 return NULL;
688         }
689         memcpy(clp->cl_name.data, name.data, name.len);
690         clp->cl_name.len = name.len;
691         return clp;
692 }
693
694 static inline void
695 free_client(struct nfs4_client *clp)
696 {
697         if (clp->cl_cred.cr_group_info)
698                 put_group_info(clp->cl_cred.cr_group_info);
699         kfree(clp->cl_principal);
700         kfree(clp->cl_name.data);
701         kfree(clp);
702 }
703
704 void
705 release_session_client(struct nfsd4_session *session)
706 {
707         struct nfs4_client *clp = session->se_client;
708
709         if (!atomic_dec_and_lock(&clp->cl_refcount, &client_lock))
710                 return;
711         if (is_client_expired(clp)) {
712                 free_client(clp);
713                 session->se_client = NULL;
714         } else
715                 renew_client_locked(clp);
716         spin_unlock(&client_lock);
717         nfsd4_put_session(session);
718 }
719
720 /* must be called under the client_lock */
721 static inline void
722 unhash_client_locked(struct nfs4_client *clp)
723 {
724         mark_client_expired(clp);
725         list_del(&clp->cl_lru);
726         while (!list_empty(&clp->cl_sessions)) {
727                 struct nfsd4_session  *ses;
728                 ses = list_entry(clp->cl_sessions.next, struct nfsd4_session,
729                                  se_perclnt);
730                 unhash_session(ses);
731                 nfsd4_put_session(ses);
732         }
733 }
734
735 static void
736 expire_client(struct nfs4_client *clp)
737 {
738         struct nfs4_stateowner *sop;
739         struct nfs4_delegation *dp;
740         struct list_head reaplist;
741
742         INIT_LIST_HEAD(&reaplist);
743         spin_lock(&recall_lock);
744         while (!list_empty(&clp->cl_delegations)) {
745                 dp = list_entry(clp->cl_delegations.next, struct nfs4_delegation, dl_perclnt);
746                 dprintk("NFSD: expire client. dp %p, fp %p\n", dp,
747                                 dp->dl_flock);
748                 list_del_init(&dp->dl_perclnt);
749                 list_move(&dp->dl_recall_lru, &reaplist);
750         }
751         spin_unlock(&recall_lock);
752         while (!list_empty(&reaplist)) {
753                 dp = list_entry(reaplist.next, struct nfs4_delegation, dl_recall_lru);
754                 list_del_init(&dp->dl_recall_lru);
755                 unhash_delegation(dp);
756         }
757         while (!list_empty(&clp->cl_openowners)) {
758                 sop = list_entry(clp->cl_openowners.next, struct nfs4_stateowner, so_perclient);
759                 release_openowner(sop);
760         }
761         nfsd4_set_callback_client(clp, NULL);
762         if (clp->cl_cb_conn.cb_xprt)
763                 svc_xprt_put(clp->cl_cb_conn.cb_xprt);
764         list_del(&clp->cl_idhash);
765         list_del(&clp->cl_strhash);
766         spin_lock(&client_lock);
767         unhash_client_locked(clp);
768         if (atomic_read(&clp->cl_refcount) == 0)
769                 free_client(clp);
770         spin_unlock(&client_lock);
771 }
772
773 static void copy_verf(struct nfs4_client *target, nfs4_verifier *source)
774 {
775         memcpy(target->cl_verifier.data, source->data,
776                         sizeof(target->cl_verifier.data));
777 }
778
779 static void copy_clid(struct nfs4_client *target, struct nfs4_client *source)
780 {
781         target->cl_clientid.cl_boot = source->cl_clientid.cl_boot; 
782         target->cl_clientid.cl_id = source->cl_clientid.cl_id; 
783 }
784
785 static void copy_cred(struct svc_cred *target, struct svc_cred *source)
786 {
787         target->cr_uid = source->cr_uid;
788         target->cr_gid = source->cr_gid;
789         target->cr_group_info = source->cr_group_info;
790         get_group_info(target->cr_group_info);
791 }
792
793 static int same_name(const char *n1, const char *n2)
794 {
795         return 0 == memcmp(n1, n2, HEXDIR_LEN);
796 }
797
798 static int
799 same_verf(nfs4_verifier *v1, nfs4_verifier *v2)
800 {
801         return 0 == memcmp(v1->data, v2->data, sizeof(v1->data));
802 }
803
804 static int
805 same_clid(clientid_t *cl1, clientid_t *cl2)
806 {
807         return (cl1->cl_boot == cl2->cl_boot) && (cl1->cl_id == cl2->cl_id);
808 }
809
810 /* XXX what about NGROUP */
811 static int
812 same_creds(struct svc_cred *cr1, struct svc_cred *cr2)
813 {
814         return cr1->cr_uid == cr2->cr_uid;
815 }
816
817 static void gen_clid(struct nfs4_client *clp)
818 {
819         static u32 current_clientid = 1;
820
821         clp->cl_clientid.cl_boot = boot_time;
822         clp->cl_clientid.cl_id = current_clientid++; 
823 }
824
825 static void gen_confirm(struct nfs4_client *clp)
826 {
827         static u32 i;
828         u32 *p;
829
830         p = (u32 *)clp->cl_confirm.data;
831         *p++ = get_seconds();
832         *p++ = i++;
833 }
834
835 static struct nfs4_client *create_client(struct xdr_netobj name, char *recdir,
836                 struct svc_rqst *rqstp, nfs4_verifier *verf)
837 {
838         struct nfs4_client *clp;
839         struct sockaddr *sa = svc_addr(rqstp);
840         char *princ;
841
842         clp = alloc_client(name);
843         if (clp == NULL)
844                 return NULL;
845
846         princ = svc_gss_principal(rqstp);
847         if (princ) {
848                 clp->cl_principal = kstrdup(princ, GFP_KERNEL);
849                 if (clp->cl_principal == NULL) {
850                         free_client(clp);
851                         return NULL;
852                 }
853         }
854
855         memcpy(clp->cl_recdir, recdir, HEXDIR_LEN);
856         atomic_set(&clp->cl_refcount, 0);
857         atomic_set(&clp->cl_cb_set, 0);
858         INIT_LIST_HEAD(&clp->cl_idhash);
859         INIT_LIST_HEAD(&clp->cl_strhash);
860         INIT_LIST_HEAD(&clp->cl_openowners);
861         INIT_LIST_HEAD(&clp->cl_delegations);
862         INIT_LIST_HEAD(&clp->cl_sessions);
863         INIT_LIST_HEAD(&clp->cl_lru);
864         clp->cl_time = get_seconds();
865         clear_bit(0, &clp->cl_cb_slot_busy);
866         rpc_init_wait_queue(&clp->cl_cb_waitq, "Backchannel slot table");
867         copy_verf(clp, verf);
868         rpc_copy_addr((struct sockaddr *) &clp->cl_addr, sa);
869         clp->cl_flavor = rqstp->rq_flavor;
870         copy_cred(&clp->cl_cred, &rqstp->rq_cred);
871         gen_confirm(clp);
872
873         return clp;
874 }
875
876 static int check_name(struct xdr_netobj name)
877 {
878         if (name.len == 0) 
879                 return 0;
880         if (name.len > NFS4_OPAQUE_LIMIT) {
881                 dprintk("NFSD: check_name: name too long(%d)!\n", name.len);
882                 return 0;
883         }
884         return 1;
885 }
886
887 static void
888 add_to_unconfirmed(struct nfs4_client *clp, unsigned int strhashval)
889 {
890         unsigned int idhashval;
891
892         list_add(&clp->cl_strhash, &unconf_str_hashtbl[strhashval]);
893         idhashval = clientid_hashval(clp->cl_clientid.cl_id);
894         list_add(&clp->cl_idhash, &unconf_id_hashtbl[idhashval]);
895         renew_client(clp);
896 }
897
898 static void
899 move_to_confirmed(struct nfs4_client *clp)
900 {
901         unsigned int idhashval = clientid_hashval(clp->cl_clientid.cl_id);
902         unsigned int strhashval;
903
904         dprintk("NFSD: move_to_confirm nfs4_client %p\n", clp);
905         list_move(&clp->cl_idhash, &conf_id_hashtbl[idhashval]);
906         strhashval = clientstr_hashval(clp->cl_recdir);
907         list_move(&clp->cl_strhash, &conf_str_hashtbl[strhashval]);
908         renew_client(clp);
909 }
910
911 static struct nfs4_client *
912 find_confirmed_client(clientid_t *clid)
913 {
914         struct nfs4_client *clp;
915         unsigned int idhashval = clientid_hashval(clid->cl_id);
916
917         list_for_each_entry(clp, &conf_id_hashtbl[idhashval], cl_idhash) {
918                 if (same_clid(&clp->cl_clientid, clid))
919                         return clp;
920         }
921         return NULL;
922 }
923
924 static struct nfs4_client *
925 find_unconfirmed_client(clientid_t *clid)
926 {
927         struct nfs4_client *clp;
928         unsigned int idhashval = clientid_hashval(clid->cl_id);
929
930         list_for_each_entry(clp, &unconf_id_hashtbl[idhashval], cl_idhash) {
931                 if (same_clid(&clp->cl_clientid, clid))
932                         return clp;
933         }
934         return NULL;
935 }
936
937 /*
938  * Return 1 iff clp's clientid establishment method matches the use_exchange_id
939  * parameter. Matching is based on the fact the at least one of the
940  * EXCHGID4_FLAG_USE_{NON_PNFS,PNFS_MDS,PNFS_DS} flags must be set for v4.1
941  *
942  * FIXME: we need to unify the clientid namespaces for nfsv4.x
943  * and correctly deal with client upgrade/downgrade in EXCHANGE_ID
944  * and SET_CLIENTID{,_CONFIRM}
945  */
946 static inline int
947 match_clientid_establishment(struct nfs4_client *clp, bool use_exchange_id)
948 {
949         bool has_exchange_flags = (clp->cl_exchange_flags != 0);
950         return use_exchange_id == has_exchange_flags;
951 }
952
953 static struct nfs4_client *
954 find_confirmed_client_by_str(const char *dname, unsigned int hashval,
955                              bool use_exchange_id)
956 {
957         struct nfs4_client *clp;
958
959         list_for_each_entry(clp, &conf_str_hashtbl[hashval], cl_strhash) {
960                 if (same_name(clp->cl_recdir, dname) &&
961                     match_clientid_establishment(clp, use_exchange_id))
962                         return clp;
963         }
964         return NULL;
965 }
966
967 static struct nfs4_client *
968 find_unconfirmed_client_by_str(const char *dname, unsigned int hashval,
969                                bool use_exchange_id)
970 {
971         struct nfs4_client *clp;
972
973         list_for_each_entry(clp, &unconf_str_hashtbl[hashval], cl_strhash) {
974                 if (same_name(clp->cl_recdir, dname) &&
975                     match_clientid_establishment(clp, use_exchange_id))
976                         return clp;
977         }
978         return NULL;
979 }
980
981 static void
982 gen_callback(struct nfs4_client *clp, struct nfsd4_setclientid *se, u32 scopeid)
983 {
984         struct nfs4_cb_conn *cb = &clp->cl_cb_conn;
985         unsigned short expected_family;
986
987         /* Currently, we only support tcp and tcp6 for the callback channel */
988         if (se->se_callback_netid_len == 3 &&
989             !memcmp(se->se_callback_netid_val, "tcp", 3))
990                 expected_family = AF_INET;
991         else if (se->se_callback_netid_len == 4 &&
992                  !memcmp(se->se_callback_netid_val, "tcp6", 4))
993                 expected_family = AF_INET6;
994         else
995                 goto out_err;
996
997         cb->cb_addrlen = rpc_uaddr2sockaddr(se->se_callback_addr_val,
998                                             se->se_callback_addr_len,
999                                             (struct sockaddr *) &cb->cb_addr,
1000                                             sizeof(cb->cb_addr));
1001
1002         if (!cb->cb_addrlen || cb->cb_addr.ss_family != expected_family)
1003                 goto out_err;
1004
1005         if (cb->cb_addr.ss_family == AF_INET6)
1006                 ((struct sockaddr_in6 *) &cb->cb_addr)->sin6_scope_id = scopeid;
1007
1008         cb->cb_minorversion = 0;
1009         cb->cb_prog = se->se_callback_prog;
1010         cb->cb_ident = se->se_callback_ident;
1011         return;
1012 out_err:
1013         cb->cb_addr.ss_family = AF_UNSPEC;
1014         cb->cb_addrlen = 0;
1015         dprintk(KERN_INFO "NFSD: this client (clientid %08x/%08x) "
1016                 "will not receive delegations\n",
1017                 clp->cl_clientid.cl_boot, clp->cl_clientid.cl_id);
1018
1019         return;
1020 }
1021
1022 /*
1023  * Cache a reply. nfsd4_check_drc_limit() has bounded the cache size.
1024  */
1025 void
1026 nfsd4_store_cache_entry(struct nfsd4_compoundres *resp)
1027 {
1028         struct nfsd4_slot *slot = resp->cstate.slot;
1029         unsigned int base;
1030
1031         dprintk("--> %s slot %p\n", __func__, slot);
1032
1033         slot->sl_opcnt = resp->opcnt;
1034         slot->sl_status = resp->cstate.status;
1035
1036         if (nfsd4_not_cached(resp)) {
1037                 slot->sl_datalen = 0;
1038                 return;
1039         }
1040         slot->sl_datalen = (char *)resp->p - (char *)resp->cstate.datap;
1041         base = (char *)resp->cstate.datap -
1042                                         (char *)resp->xbuf->head[0].iov_base;
1043         if (read_bytes_from_xdr_buf(resp->xbuf, base, slot->sl_data,
1044                                     slot->sl_datalen))
1045                 WARN("%s: sessions DRC could not cache compound\n", __func__);
1046         return;
1047 }
1048
1049 /*
1050  * Encode the replay sequence operation from the slot values.
1051  * If cachethis is FALSE encode the uncached rep error on the next
1052  * operation which sets resp->p and increments resp->opcnt for
1053  * nfs4svc_encode_compoundres.
1054  *
1055  */
1056 static __be32
1057 nfsd4_enc_sequence_replay(struct nfsd4_compoundargs *args,
1058                           struct nfsd4_compoundres *resp)
1059 {
1060         struct nfsd4_op *op;
1061         struct nfsd4_slot *slot = resp->cstate.slot;
1062
1063         dprintk("--> %s resp->opcnt %d cachethis %u \n", __func__,
1064                 resp->opcnt, resp->cstate.slot->sl_cachethis);
1065
1066         /* Encode the replayed sequence operation */
1067         op = &args->ops[resp->opcnt - 1];
1068         nfsd4_encode_operation(resp, op);
1069
1070         /* Return nfserr_retry_uncached_rep in next operation. */
1071         if (args->opcnt > 1 && slot->sl_cachethis == 0) {
1072                 op = &args->ops[resp->opcnt++];
1073                 op->status = nfserr_retry_uncached_rep;
1074                 nfsd4_encode_operation(resp, op);
1075         }
1076         return op->status;
1077 }
1078
1079 /*
1080  * The sequence operation is not cached because we can use the slot and
1081  * session values.
1082  */
1083 __be32
1084 nfsd4_replay_cache_entry(struct nfsd4_compoundres *resp,
1085                          struct nfsd4_sequence *seq)
1086 {
1087         struct nfsd4_slot *slot = resp->cstate.slot;
1088         __be32 status;
1089
1090         dprintk("--> %s slot %p\n", __func__, slot);
1091
1092         /* Either returns 0 or nfserr_retry_uncached */
1093         status = nfsd4_enc_sequence_replay(resp->rqstp->rq_argp, resp);
1094         if (status == nfserr_retry_uncached_rep)
1095                 return status;
1096
1097         /* The sequence operation has been encoded, cstate->datap set. */
1098         memcpy(resp->cstate.datap, slot->sl_data, slot->sl_datalen);
1099
1100         resp->opcnt = slot->sl_opcnt;
1101         resp->p = resp->cstate.datap + XDR_QUADLEN(slot->sl_datalen);
1102         status = slot->sl_status;
1103
1104         return status;
1105 }
1106
1107 /*
1108  * Set the exchange_id flags returned by the server.
1109  */
1110 static void
1111 nfsd4_set_ex_flags(struct nfs4_client *new, struct nfsd4_exchange_id *clid)
1112 {
1113         /* pNFS is not supported */
1114         new->cl_exchange_flags |= EXCHGID4_FLAG_USE_NON_PNFS;
1115
1116         /* Referrals are supported, Migration is not. */
1117         new->cl_exchange_flags |= EXCHGID4_FLAG_SUPP_MOVED_REFER;
1118
1119         /* set the wire flags to return to client. */
1120         clid->flags = new->cl_exchange_flags;
1121 }
1122
1123 __be32
1124 nfsd4_exchange_id(struct svc_rqst *rqstp,
1125                   struct nfsd4_compound_state *cstate,
1126                   struct nfsd4_exchange_id *exid)
1127 {
1128         struct nfs4_client *unconf, *conf, *new;
1129         int status;
1130         unsigned int            strhashval;
1131         char                    dname[HEXDIR_LEN];
1132         char                    addr_str[INET6_ADDRSTRLEN];
1133         nfs4_verifier           verf = exid->verifier;
1134         struct sockaddr         *sa = svc_addr(rqstp);
1135
1136         rpc_ntop(sa, addr_str, sizeof(addr_str));
1137         dprintk("%s rqstp=%p exid=%p clname.len=%u clname.data=%p "
1138                 "ip_addr=%s flags %x, spa_how %d\n",
1139                 __func__, rqstp, exid, exid->clname.len, exid->clname.data,
1140                 addr_str, exid->flags, exid->spa_how);
1141
1142         if (!check_name(exid->clname) || (exid->flags & ~EXCHGID4_FLAG_MASK_A))
1143                 return nfserr_inval;
1144
1145         /* Currently only support SP4_NONE */
1146         switch (exid->spa_how) {
1147         case SP4_NONE:
1148                 break;
1149         case SP4_SSV:
1150                 return nfserr_encr_alg_unsupp;
1151         default:
1152                 BUG();                          /* checked by xdr code */
1153         case SP4_MACH_CRED:
1154                 return nfserr_serverfault;      /* no excuse :-/ */
1155         }
1156
1157         status = nfs4_make_rec_clidname(dname, &exid->clname);
1158
1159         if (status)
1160                 goto error;
1161
1162         strhashval = clientstr_hashval(dname);
1163
1164         nfs4_lock_state();
1165         status = nfs_ok;
1166
1167         conf = find_confirmed_client_by_str(dname, strhashval, true);
1168         if (conf) {
1169                 if (!same_verf(&verf, &conf->cl_verifier)) {
1170                         /* 18.35.4 case 8 */
1171                         if (exid->flags & EXCHGID4_FLAG_UPD_CONFIRMED_REC_A) {
1172                                 status = nfserr_not_same;
1173                                 goto out;
1174                         }
1175                         /* Client reboot: destroy old state */
1176                         expire_client(conf);
1177                         goto out_new;
1178                 }
1179                 if (!same_creds(&conf->cl_cred, &rqstp->rq_cred)) {
1180                         /* 18.35.4 case 9 */
1181                         if (exid->flags & EXCHGID4_FLAG_UPD_CONFIRMED_REC_A) {
1182                                 status = nfserr_perm;
1183                                 goto out;
1184                         }
1185                         expire_client(conf);
1186                         goto out_new;
1187                 }
1188                 /*
1189                  * Set bit when the owner id and verifier map to an already
1190                  * confirmed client id (18.35.3).
1191                  */
1192                 exid->flags |= EXCHGID4_FLAG_CONFIRMED_R;
1193
1194                 /*
1195                  * Falling into 18.35.4 case 2, possible router replay.
1196                  * Leave confirmed record intact and return same result.
1197                  */
1198                 copy_verf(conf, &verf);
1199                 new = conf;
1200                 goto out_copy;
1201         }
1202
1203         /* 18.35.4 case 7 */
1204         if (exid->flags & EXCHGID4_FLAG_UPD_CONFIRMED_REC_A) {
1205                 status = nfserr_noent;
1206                 goto out;
1207         }
1208
1209         unconf  = find_unconfirmed_client_by_str(dname, strhashval, true);
1210         if (unconf) {
1211                 /*
1212                  * Possible retry or client restart.  Per 18.35.4 case 4,
1213                  * a new unconfirmed record should be generated regardless
1214                  * of whether any properties have changed.
1215                  */
1216                 expire_client(unconf);
1217         }
1218
1219 out_new:
1220         /* Normal case */
1221         new = create_client(exid->clname, dname, rqstp, &verf);
1222         if (new == NULL) {
1223                 status = nfserr_serverfault;
1224                 goto out;
1225         }
1226
1227         gen_clid(new);
1228         add_to_unconfirmed(new, strhashval);
1229 out_copy:
1230         exid->clientid.cl_boot = new->cl_clientid.cl_boot;
1231         exid->clientid.cl_id = new->cl_clientid.cl_id;
1232
1233         exid->seqid = 1;
1234         nfsd4_set_ex_flags(new, exid);
1235
1236         dprintk("nfsd4_exchange_id seqid %d flags %x\n",
1237                 new->cl_cs_slot.sl_seqid, new->cl_exchange_flags);
1238         status = nfs_ok;
1239
1240 out:
1241         nfs4_unlock_state();
1242 error:
1243         dprintk("nfsd4_exchange_id returns %d\n", ntohl(status));
1244         return status;
1245 }
1246
1247 static int
1248 check_slot_seqid(u32 seqid, u32 slot_seqid, int slot_inuse)
1249 {
1250         dprintk("%s enter. seqid %d slot_seqid %d\n", __func__, seqid,
1251                 slot_seqid);
1252
1253         /* The slot is in use, and no response has been sent. */
1254         if (slot_inuse) {
1255                 if (seqid == slot_seqid)
1256                         return nfserr_jukebox;
1257                 else
1258                         return nfserr_seq_misordered;
1259         }
1260         /* Normal */
1261         if (likely(seqid == slot_seqid + 1))
1262                 return nfs_ok;
1263         /* Replay */
1264         if (seqid == slot_seqid)
1265                 return nfserr_replay_cache;
1266         /* Wraparound */
1267         if (seqid == 1 && (slot_seqid + 1) == 0)
1268                 return nfs_ok;
1269         /* Misordered replay or misordered new request */
1270         return nfserr_seq_misordered;
1271 }
1272
1273 /*
1274  * Cache the create session result into the create session single DRC
1275  * slot cache by saving the xdr structure. sl_seqid has been set.
1276  * Do this for solo or embedded create session operations.
1277  */
1278 static void
1279 nfsd4_cache_create_session(struct nfsd4_create_session *cr_ses,
1280                            struct nfsd4_clid_slot *slot, int nfserr)
1281 {
1282         slot->sl_status = nfserr;
1283         memcpy(&slot->sl_cr_ses, cr_ses, sizeof(*cr_ses));
1284 }
1285
1286 static __be32
1287 nfsd4_replay_create_session(struct nfsd4_create_session *cr_ses,
1288                             struct nfsd4_clid_slot *slot)
1289 {
1290         memcpy(cr_ses, &slot->sl_cr_ses, sizeof(*cr_ses));
1291         return slot->sl_status;
1292 }
1293
1294 __be32
1295 nfsd4_create_session(struct svc_rqst *rqstp,
1296                      struct nfsd4_compound_state *cstate,
1297                      struct nfsd4_create_session *cr_ses)
1298 {
1299         struct sockaddr *sa = svc_addr(rqstp);
1300         struct nfs4_client *conf, *unconf;
1301         struct nfsd4_clid_slot *cs_slot = NULL;
1302         int status = 0;
1303
1304         nfs4_lock_state();
1305         unconf = find_unconfirmed_client(&cr_ses->clientid);
1306         conf = find_confirmed_client(&cr_ses->clientid);
1307
1308         if (conf) {
1309                 cs_slot = &conf->cl_cs_slot;
1310                 status = check_slot_seqid(cr_ses->seqid, cs_slot->sl_seqid, 0);
1311                 if (status == nfserr_replay_cache) {
1312                         dprintk("Got a create_session replay! seqid= %d\n",
1313                                 cs_slot->sl_seqid);
1314                         /* Return the cached reply status */
1315                         status = nfsd4_replay_create_session(cr_ses, cs_slot);
1316                         goto out;
1317                 } else if (cr_ses->seqid != cs_slot->sl_seqid + 1) {
1318                         status = nfserr_seq_misordered;
1319                         dprintk("Sequence misordered!\n");
1320                         dprintk("Expected seqid= %d but got seqid= %d\n",
1321                                 cs_slot->sl_seqid, cr_ses->seqid);
1322                         goto out;
1323                 }
1324                 cs_slot->sl_seqid++;
1325         } else if (unconf) {
1326                 if (!same_creds(&unconf->cl_cred, &rqstp->rq_cred) ||
1327                     !rpc_cmp_addr(sa, (struct sockaddr *) &unconf->cl_addr)) {
1328                         status = nfserr_clid_inuse;
1329                         goto out;
1330                 }
1331
1332                 cs_slot = &unconf->cl_cs_slot;
1333                 status = check_slot_seqid(cr_ses->seqid, cs_slot->sl_seqid, 0);
1334                 if (status) {
1335                         /* an unconfirmed replay returns misordered */
1336                         status = nfserr_seq_misordered;
1337                         goto out_cache;
1338                 }
1339
1340                 cs_slot->sl_seqid++; /* from 0 to 1 */
1341                 move_to_confirmed(unconf);
1342
1343                 if (cr_ses->flags & SESSION4_BACK_CHAN) {
1344                         unconf->cl_cb_conn.cb_xprt = rqstp->rq_xprt;
1345                         svc_xprt_get(rqstp->rq_xprt);
1346                         rpc_copy_addr(
1347                                 (struct sockaddr *)&unconf->cl_cb_conn.cb_addr,
1348                                 sa);
1349                         unconf->cl_cb_conn.cb_addrlen = svc_addr_len(sa);
1350                         unconf->cl_cb_conn.cb_minorversion =
1351                                 cstate->minorversion;
1352                         unconf->cl_cb_conn.cb_prog = cr_ses->callback_prog;
1353                         unconf->cl_cb_seq_nr = 1;
1354                         nfsd4_probe_callback(unconf, &unconf->cl_cb_conn);
1355                 }
1356                 conf = unconf;
1357         } else {
1358                 status = nfserr_stale_clientid;
1359                 goto out;
1360         }
1361
1362         /*
1363          * We do not support RDMA or persistent sessions
1364          */
1365         cr_ses->flags &= ~SESSION4_PERSIST;
1366         cr_ses->flags &= ~SESSION4_RDMA;
1367
1368         status = alloc_init_session(rqstp, conf, cr_ses);
1369         if (status)
1370                 goto out;
1371
1372         memcpy(cr_ses->sessionid.data, conf->cl_sessionid.data,
1373                NFS4_MAX_SESSIONID_LEN);
1374         cr_ses->seqid = cs_slot->sl_seqid;
1375
1376 out_cache:
1377         /* cache solo and embedded create sessions under the state lock */
1378         nfsd4_cache_create_session(cr_ses, cs_slot, status);
1379 out:
1380         nfs4_unlock_state();
1381         dprintk("%s returns %d\n", __func__, ntohl(status));
1382         return status;
1383 }
1384
1385 static bool nfsd4_last_compound_op(struct svc_rqst *rqstp)
1386 {
1387         struct nfsd4_compoundres *resp = rqstp->rq_resp;
1388         struct nfsd4_compoundargs *argp = rqstp->rq_argp;
1389
1390         return argp->opcnt == resp->opcnt;
1391 }
1392
1393 static bool nfsd4_compound_in_session(struct nfsd4_session *session, struct nfs4_sessionid *sid)
1394 {
1395         if (!session)
1396                 return 0;
1397         return !memcmp(sid, &session->se_sessionid, sizeof(*sid));
1398 }
1399
1400 __be32
1401 nfsd4_destroy_session(struct svc_rqst *r,
1402                       struct nfsd4_compound_state *cstate,
1403                       struct nfsd4_destroy_session *sessionid)
1404 {
1405         struct nfsd4_session *ses;
1406         u32 status = nfserr_badsession;
1407
1408         /* Notes:
1409          * - The confirmed nfs4_client->cl_sessionid holds destroyed sessinid
1410          * - Should we return nfserr_back_chan_busy if waiting for
1411          *   callbacks on to-be-destroyed session?
1412          * - Do we need to clear any callback info from previous session?
1413          */
1414
1415         if (nfsd4_compound_in_session(cstate->session, &sessionid->sessionid)) {
1416                 if (!nfsd4_last_compound_op(r))
1417                         return nfserr_not_only_op;
1418         }
1419         dump_sessionid(__func__, &sessionid->sessionid);
1420         spin_lock(&client_lock);
1421         ses = find_in_sessionid_hashtbl(&sessionid->sessionid);
1422         if (!ses) {
1423                 spin_unlock(&client_lock);
1424                 goto out;
1425         }
1426
1427         unhash_session(ses);
1428         spin_unlock(&client_lock);
1429
1430         nfs4_lock_state();
1431         /* wait for callbacks */
1432         nfsd4_set_callback_client(ses->se_client, NULL);
1433         nfs4_unlock_state();
1434         nfsd4_put_session(ses);
1435         status = nfs_ok;
1436 out:
1437         dprintk("%s returns %d\n", __func__, ntohl(status));
1438         return status;
1439 }
1440
1441 __be32
1442 nfsd4_sequence(struct svc_rqst *rqstp,
1443                struct nfsd4_compound_state *cstate,
1444                struct nfsd4_sequence *seq)
1445 {
1446         struct nfsd4_compoundres *resp = rqstp->rq_resp;
1447         struct nfsd4_session *session;
1448         struct nfsd4_slot *slot;
1449         int status;
1450
1451         if (resp->opcnt != 1)
1452                 return nfserr_sequence_pos;
1453
1454         spin_lock(&client_lock);
1455         status = nfserr_badsession;
1456         session = find_in_sessionid_hashtbl(&seq->sessionid);
1457         if (!session)
1458                 goto out;
1459
1460         status = nfserr_badslot;
1461         if (seq->slotid >= session->se_fchannel.maxreqs)
1462                 goto out;
1463
1464         slot = session->se_slots[seq->slotid];
1465         dprintk("%s: slotid %d\n", __func__, seq->slotid);
1466
1467         /* We do not negotiate the number of slots yet, so set the
1468          * maxslots to the session maxreqs which is used to encode
1469          * sr_highest_slotid and the sr_target_slot id to maxslots */
1470         seq->maxslots = session->se_fchannel.maxreqs;
1471
1472         status = check_slot_seqid(seq->seqid, slot->sl_seqid, slot->sl_inuse);
1473         if (status == nfserr_replay_cache) {
1474                 cstate->slot = slot;
1475                 cstate->session = session;
1476                 /* Return the cached reply status and set cstate->status
1477                  * for nfsd4_proc_compound processing */
1478                 status = nfsd4_replay_cache_entry(resp, seq);
1479                 cstate->status = nfserr_replay_cache;
1480                 goto out;
1481         }
1482         if (status)
1483                 goto out;
1484
1485         /* Success! bump slot seqid */
1486         slot->sl_inuse = true;
1487         slot->sl_seqid = seq->seqid;
1488         slot->sl_cachethis = seq->cachethis;
1489
1490         cstate->slot = slot;
1491         cstate->session = session;
1492
1493 out:
1494         /* Hold a session reference until done processing the compound. */
1495         if (cstate->session) {
1496                 nfsd4_get_session(cstate->session);
1497                 atomic_inc(&session->se_client->cl_refcount);
1498         }
1499         spin_unlock(&client_lock);
1500         dprintk("%s: return %d\n", __func__, ntohl(status));
1501         return status;
1502 }
1503
1504 __be32
1505 nfsd4_reclaim_complete(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, struct nfsd4_reclaim_complete *rc)
1506 {
1507         if (rc->rca_one_fs) {
1508                 if (!cstate->current_fh.fh_dentry)
1509                         return nfserr_nofilehandle;
1510                 /*
1511                  * We don't take advantage of the rca_one_fs case.
1512                  * That's OK, it's optional, we can safely ignore it.
1513                  */
1514                  return nfs_ok;
1515         }
1516         nfs4_lock_state();
1517         if (is_client_expired(cstate->session->se_client)) {
1518                 nfs4_unlock_state();
1519                 /*
1520                  * The following error isn't really legal.
1521                  * But we only get here if the client just explicitly
1522                  * destroyed the client.  Surely it no longer cares what
1523                  * error it gets back on an operation for the dead
1524                  * client.
1525                  */
1526                 return nfserr_stale_clientid;
1527         }
1528         nfsd4_create_clid_dir(cstate->session->se_client);
1529         nfs4_unlock_state();
1530         return nfs_ok;
1531 }
1532
1533 __be32
1534 nfsd4_setclientid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
1535                   struct nfsd4_setclientid *setclid)
1536 {
1537         struct sockaddr         *sa = svc_addr(rqstp);
1538         struct xdr_netobj       clname = { 
1539                 .len = setclid->se_namelen,
1540                 .data = setclid->se_name,
1541         };
1542         nfs4_verifier           clverifier = setclid->se_verf;
1543         unsigned int            strhashval;
1544         struct nfs4_client      *conf, *unconf, *new;
1545         __be32                  status;
1546         char                    dname[HEXDIR_LEN];
1547         
1548         if (!check_name(clname))
1549                 return nfserr_inval;
1550
1551         status = nfs4_make_rec_clidname(dname, &clname);
1552         if (status)
1553                 return status;
1554
1555         /* 
1556          * XXX The Duplicate Request Cache (DRC) has been checked (??)
1557          * We get here on a DRC miss.
1558          */
1559
1560         strhashval = clientstr_hashval(dname);
1561
1562         nfs4_lock_state();
1563         conf = find_confirmed_client_by_str(dname, strhashval, false);
1564         if (conf) {
1565                 /* RFC 3530 14.2.33 CASE 0: */
1566                 status = nfserr_clid_inuse;
1567                 if (!same_creds(&conf->cl_cred, &rqstp->rq_cred)) {
1568                         char addr_str[INET6_ADDRSTRLEN];
1569                         rpc_ntop((struct sockaddr *) &conf->cl_addr, addr_str,
1570                                  sizeof(addr_str));
1571                         dprintk("NFSD: setclientid: string in use by client "
1572                                 "at %s\n", addr_str);
1573                         goto out;
1574                 }
1575         }
1576         /*
1577          * section 14.2.33 of RFC 3530 (under the heading "IMPLEMENTATION")
1578          * has a description of SETCLIENTID request processing consisting
1579          * of 5 bullet points, labeled as CASE0 - CASE4 below.
1580          */
1581         unconf = find_unconfirmed_client_by_str(dname, strhashval, false);
1582         status = nfserr_resource;
1583         if (!conf) {
1584                 /*
1585                  * RFC 3530 14.2.33 CASE 4:
1586                  * placed first, because it is the normal case
1587                  */
1588                 if (unconf)
1589                         expire_client(unconf);
1590                 new = create_client(clname, dname, rqstp, &clverifier);
1591                 if (new == NULL)
1592                         goto out;
1593                 gen_clid(new);
1594         } else if (same_verf(&conf->cl_verifier, &clverifier)) {
1595                 /*
1596                  * RFC 3530 14.2.33 CASE 1:
1597                  * probable callback update
1598                  */
1599                 if (unconf) {
1600                         /* Note this is removing unconfirmed {*x***},
1601                          * which is stronger than RFC recommended {vxc**}.
1602                          * This has the advantage that there is at most
1603                          * one {*x***} in either list at any time.
1604                          */
1605                         expire_client(unconf);
1606                 }
1607                 new = create_client(clname, dname, rqstp, &clverifier);
1608                 if (new == NULL)
1609                         goto out;
1610                 copy_clid(new, conf);
1611         } else if (!unconf) {
1612                 /*
1613                  * RFC 3530 14.2.33 CASE 2:
1614                  * probable client reboot; state will be removed if
1615                  * confirmed.
1616                  */
1617                 new = create_client(clname, dname, rqstp, &clverifier);
1618                 if (new == NULL)
1619                         goto out;
1620                 gen_clid(new);
1621         } else {
1622                 /*
1623                  * RFC 3530 14.2.33 CASE 3:
1624                  * probable client reboot; state will be removed if
1625                  * confirmed.
1626                  */
1627                 expire_client(unconf);
1628                 new = create_client(clname, dname, rqstp, &clverifier);
1629                 if (new == NULL)
1630                         goto out;
1631                 gen_clid(new);
1632         }
1633         gen_callback(new, setclid, rpc_get_scope_id(sa));
1634         add_to_unconfirmed(new, strhashval);
1635         setclid->se_clientid.cl_boot = new->cl_clientid.cl_boot;
1636         setclid->se_clientid.cl_id = new->cl_clientid.cl_id;
1637         memcpy(setclid->se_confirm.data, new->cl_confirm.data, sizeof(setclid->se_confirm.data));
1638         status = nfs_ok;
1639 out:
1640         nfs4_unlock_state();
1641         return status;
1642 }
1643
1644
1645 /*
1646  * Section 14.2.34 of RFC 3530 (under the heading "IMPLEMENTATION") has
1647  * a description of SETCLIENTID_CONFIRM request processing consisting of 4
1648  * bullets, labeled as CASE1 - CASE4 below.
1649  */
1650 __be32
1651 nfsd4_setclientid_confirm(struct svc_rqst *rqstp,
1652                          struct nfsd4_compound_state *cstate,
1653                          struct nfsd4_setclientid_confirm *setclientid_confirm)
1654 {
1655         struct sockaddr *sa = svc_addr(rqstp);
1656         struct nfs4_client *conf, *unconf;
1657         nfs4_verifier confirm = setclientid_confirm->sc_confirm; 
1658         clientid_t * clid = &setclientid_confirm->sc_clientid;
1659         __be32 status;
1660
1661         if (STALE_CLIENTID(clid))
1662                 return nfserr_stale_clientid;
1663         /* 
1664          * XXX The Duplicate Request Cache (DRC) has been checked (??)
1665          * We get here on a DRC miss.
1666          */
1667
1668         nfs4_lock_state();
1669
1670         conf = find_confirmed_client(clid);
1671         unconf = find_unconfirmed_client(clid);
1672
1673         status = nfserr_clid_inuse;
1674         if (conf && !rpc_cmp_addr((struct sockaddr *) &conf->cl_addr, sa))
1675                 goto out;
1676         if (unconf && !rpc_cmp_addr((struct sockaddr *) &unconf->cl_addr, sa))
1677                 goto out;
1678
1679         /*
1680          * section 14.2.34 of RFC 3530 has a description of
1681          * SETCLIENTID_CONFIRM request processing consisting
1682          * of 4 bullet points, labeled as CASE1 - CASE4 below.
1683          */
1684         if (conf && unconf && same_verf(&confirm, &unconf->cl_confirm)) {
1685                 /*
1686                  * RFC 3530 14.2.34 CASE 1:
1687                  * callback update
1688                  */
1689                 if (!same_creds(&conf->cl_cred, &unconf->cl_cred))
1690                         status = nfserr_clid_inuse;
1691                 else {
1692                         atomic_set(&conf->cl_cb_set, 0);
1693                         nfsd4_probe_callback(conf, &unconf->cl_cb_conn);
1694                         expire_client(unconf);
1695                         status = nfs_ok;
1696
1697                 }
1698         } else if (conf && !unconf) {
1699                 /*
1700                  * RFC 3530 14.2.34 CASE 2:
1701                  * probable retransmitted request; play it safe and
1702                  * do nothing.
1703                  */
1704                 if (!same_creds(&conf->cl_cred, &rqstp->rq_cred))
1705                         status = nfserr_clid_inuse;
1706                 else
1707                         status = nfs_ok;
1708         } else if (!conf && unconf
1709                         && same_verf(&unconf->cl_confirm, &confirm)) {
1710                 /*
1711                  * RFC 3530 14.2.34 CASE 3:
1712                  * Normal case; new or rebooted client:
1713                  */
1714                 if (!same_creds(&unconf->cl_cred, &rqstp->rq_cred)) {
1715                         status = nfserr_clid_inuse;
1716                 } else {
1717                         unsigned int hash =
1718                                 clientstr_hashval(unconf->cl_recdir);
1719                         conf = find_confirmed_client_by_str(unconf->cl_recdir,
1720                                                             hash, false);
1721                         if (conf) {
1722                                 nfsd4_remove_clid_dir(conf);
1723                                 expire_client(conf);
1724                         }
1725                         move_to_confirmed(unconf);
1726                         conf = unconf;
1727                         nfsd4_probe_callback(conf, &conf->cl_cb_conn);
1728                         status = nfs_ok;
1729                 }
1730         } else if ((!conf || (conf && !same_verf(&conf->cl_confirm, &confirm)))
1731             && (!unconf || (unconf && !same_verf(&unconf->cl_confirm,
1732                                                                 &confirm)))) {
1733                 /*
1734                  * RFC 3530 14.2.34 CASE 4:
1735                  * Client probably hasn't noticed that we rebooted yet.
1736                  */
1737                 status = nfserr_stale_clientid;
1738         } else {
1739                 /* check that we have hit one of the cases...*/
1740                 status = nfserr_clid_inuse;
1741         }
1742 out:
1743         nfs4_unlock_state();
1744         return status;
1745 }
1746
1747 /* OPEN Share state helper functions */
1748 static inline struct nfs4_file *
1749 alloc_init_file(struct inode *ino)
1750 {
1751         struct nfs4_file *fp;
1752         unsigned int hashval = file_hashval(ino);
1753
1754         fp = kmem_cache_alloc(file_slab, GFP_KERNEL);
1755         if (fp) {
1756                 atomic_set(&fp->fi_ref, 1);
1757                 INIT_LIST_HEAD(&fp->fi_hash);
1758                 INIT_LIST_HEAD(&fp->fi_stateids);
1759                 INIT_LIST_HEAD(&fp->fi_delegations);
1760                 fp->fi_inode = igrab(ino);
1761                 fp->fi_id = current_fileid++;
1762                 fp->fi_had_conflict = false;
1763                 spin_lock(&recall_lock);
1764                 list_add(&fp->fi_hash, &file_hashtbl[hashval]);
1765                 spin_unlock(&recall_lock);
1766                 return fp;
1767         }
1768         return NULL;
1769 }
1770
1771 static void
1772 nfsd4_free_slab(struct kmem_cache **slab)
1773 {
1774         if (*slab == NULL)
1775                 return;
1776         kmem_cache_destroy(*slab);
1777         *slab = NULL;
1778 }
1779
1780 void
1781 nfsd4_free_slabs(void)
1782 {
1783         nfsd4_free_slab(&stateowner_slab);
1784         nfsd4_free_slab(&file_slab);
1785         nfsd4_free_slab(&stateid_slab);
1786         nfsd4_free_slab(&deleg_slab);
1787 }
1788
1789 static int
1790 nfsd4_init_slabs(void)
1791 {
1792         stateowner_slab = kmem_cache_create("nfsd4_stateowners",
1793                         sizeof(struct nfs4_stateowner), 0, 0, NULL);
1794         if (stateowner_slab == NULL)
1795                 goto out_nomem;
1796         file_slab = kmem_cache_create("nfsd4_files",
1797                         sizeof(struct nfs4_file), 0, 0, NULL);
1798         if (file_slab == NULL)
1799                 goto out_nomem;
1800         stateid_slab = kmem_cache_create("nfsd4_stateids",
1801                         sizeof(struct nfs4_stateid), 0, 0, NULL);
1802         if (stateid_slab == NULL)
1803                 goto out_nomem;
1804         deleg_slab = kmem_cache_create("nfsd4_delegations",
1805                         sizeof(struct nfs4_delegation), 0, 0, NULL);
1806         if (deleg_slab == NULL)
1807                 goto out_nomem;
1808         return 0;
1809 out_nomem:
1810         nfsd4_free_slabs();
1811         dprintk("nfsd4: out of memory while initializing nfsv4\n");
1812         return -ENOMEM;
1813 }
1814
1815 void
1816 nfs4_free_stateowner(struct kref *kref)
1817 {
1818         struct nfs4_stateowner *sop =
1819                 container_of(kref, struct nfs4_stateowner, so_ref);
1820         kfree(sop->so_owner.data);
1821         kmem_cache_free(stateowner_slab, sop);
1822 }
1823
1824 static inline struct nfs4_stateowner *
1825 alloc_stateowner(struct xdr_netobj *owner)
1826 {
1827         struct nfs4_stateowner *sop;
1828
1829         if ((sop = kmem_cache_alloc(stateowner_slab, GFP_KERNEL))) {
1830                 if ((sop->so_owner.data = kmalloc(owner->len, GFP_KERNEL))) {
1831                         memcpy(sop->so_owner.data, owner->data, owner->len);
1832                         sop->so_owner.len = owner->len;
1833                         kref_init(&sop->so_ref);
1834                         return sop;
1835                 } 
1836                 kmem_cache_free(stateowner_slab, sop);
1837         }
1838         return NULL;
1839 }
1840
1841 static struct nfs4_stateowner *
1842 alloc_init_open_stateowner(unsigned int strhashval, struct nfs4_client *clp, struct nfsd4_open *open) {
1843         struct nfs4_stateowner *sop;
1844         struct nfs4_replay *rp;
1845         unsigned int idhashval;
1846
1847         if (!(sop = alloc_stateowner(&open->op_owner)))
1848                 return NULL;
1849         idhashval = ownerid_hashval(current_ownerid);
1850         INIT_LIST_HEAD(&sop->so_idhash);
1851         INIT_LIST_HEAD(&sop->so_strhash);
1852         INIT_LIST_HEAD(&sop->so_perclient);
1853         INIT_LIST_HEAD(&sop->so_stateids);
1854         INIT_LIST_HEAD(&sop->so_perstateid);  /* not used */
1855         INIT_LIST_HEAD(&sop->so_close_lru);
1856         sop->so_time = 0;
1857         list_add(&sop->so_idhash, &ownerid_hashtbl[idhashval]);
1858         list_add(&sop->so_strhash, &ownerstr_hashtbl[strhashval]);
1859         list_add(&sop->so_perclient, &clp->cl_openowners);
1860         sop->so_is_open_owner = 1;
1861         sop->so_id = current_ownerid++;
1862         sop->so_client = clp;
1863         sop->so_seqid = open->op_seqid;
1864         sop->so_confirmed = 0;
1865         rp = &sop->so_replay;
1866         rp->rp_status = nfserr_serverfault;
1867         rp->rp_buflen = 0;
1868         rp->rp_buf = rp->rp_ibuf;
1869         return sop;
1870 }
1871
1872 static inline void
1873 init_stateid(struct nfs4_stateid *stp, struct nfs4_file *fp, struct nfsd4_open *open) {
1874         struct nfs4_stateowner *sop = open->op_stateowner;
1875         unsigned int hashval = stateid_hashval(sop->so_id, fp->fi_id);
1876
1877         INIT_LIST_HEAD(&stp->st_hash);
1878         INIT_LIST_HEAD(&stp->st_perstateowner);
1879         INIT_LIST_HEAD(&stp->st_lockowners);
1880         INIT_LIST_HEAD(&stp->st_perfile);
1881         list_add(&stp->st_hash, &stateid_hashtbl[hashval]);
1882         list_add(&stp->st_perstateowner, &sop->so_stateids);
1883         list_add(&stp->st_perfile, &fp->fi_stateids);
1884         stp->st_stateowner = sop;
1885         get_nfs4_file(fp);
1886         stp->st_file = fp;
1887         stp->st_stateid.si_boot = get_seconds();
1888         stp->st_stateid.si_stateownerid = sop->so_id;
1889         stp->st_stateid.si_fileid = fp->fi_id;
1890         stp->st_stateid.si_generation = 0;
1891         stp->st_access_bmap = 0;
1892         stp->st_deny_bmap = 0;
1893         __set_bit(open->op_share_access & ~NFS4_SHARE_WANT_MASK,
1894                   &stp->st_access_bmap);
1895         __set_bit(open->op_share_deny, &stp->st_deny_bmap);
1896         stp->st_openstp = NULL;
1897 }
1898
1899 static void
1900 move_to_close_lru(struct nfs4_stateowner *sop)
1901 {
1902         dprintk("NFSD: move_to_close_lru nfs4_stateowner %p\n", sop);
1903
1904         list_move_tail(&sop->so_close_lru, &close_lru);
1905         sop->so_time = get_seconds();
1906 }
1907
1908 static int
1909 same_owner_str(struct nfs4_stateowner *sop, struct xdr_netobj *owner,
1910                                                         clientid_t *clid)
1911 {
1912         return (sop->so_owner.len == owner->len) &&
1913                 0 == memcmp(sop->so_owner.data, owner->data, owner->len) &&
1914                 (sop->so_client->cl_clientid.cl_id == clid->cl_id);
1915 }
1916
1917 static struct nfs4_stateowner *
1918 find_openstateowner_str(unsigned int hashval, struct nfsd4_open *open)
1919 {
1920         struct nfs4_stateowner *so = NULL;
1921
1922         list_for_each_entry(so, &ownerstr_hashtbl[hashval], so_strhash) {
1923                 if (same_owner_str(so, &open->op_owner, &open->op_clientid))
1924                         return so;
1925         }
1926         return NULL;
1927 }
1928
1929 /* search file_hashtbl[] for file */
1930 static struct nfs4_file *
1931 find_file(struct inode *ino)
1932 {
1933         unsigned int hashval = file_hashval(ino);
1934         struct nfs4_file *fp;
1935
1936         spin_lock(&recall_lock);
1937         list_for_each_entry(fp, &file_hashtbl[hashval], fi_hash) {
1938                 if (fp->fi_inode == ino) {
1939                         get_nfs4_file(fp);
1940                         spin_unlock(&recall_lock);
1941                         return fp;
1942                 }
1943         }
1944         spin_unlock(&recall_lock);
1945         return NULL;
1946 }
1947
1948 static inline int access_valid(u32 x, u32 minorversion)
1949 {
1950         if ((x & NFS4_SHARE_ACCESS_MASK) < NFS4_SHARE_ACCESS_READ)
1951                 return 0;
1952         if ((x & NFS4_SHARE_ACCESS_MASK) > NFS4_SHARE_ACCESS_BOTH)
1953                 return 0;
1954         x &= ~NFS4_SHARE_ACCESS_MASK;
1955         if (minorversion && x) {
1956                 if ((x & NFS4_SHARE_WANT_MASK) > NFS4_SHARE_WANT_CANCEL)
1957                         return 0;
1958                 if ((x & NFS4_SHARE_WHEN_MASK) > NFS4_SHARE_PUSH_DELEG_WHEN_UNCONTENDED)
1959                         return 0;
1960                 x &= ~(NFS4_SHARE_WANT_MASK | NFS4_SHARE_WHEN_MASK);
1961         }
1962         if (x)
1963                 return 0;
1964         return 1;
1965 }
1966
1967 static inline int deny_valid(u32 x)
1968 {
1969         /* Note: unlike access bits, deny bits may be zero. */
1970         return x <= NFS4_SHARE_DENY_BOTH;
1971 }
1972
1973 /*
1974  * We store the NONE, READ, WRITE, and BOTH bits separately in the
1975  * st_{access,deny}_bmap field of the stateid, in order to track not
1976  * only what share bits are currently in force, but also what
1977  * combinations of share bits previous opens have used.  This allows us
1978  * to enforce the recommendation of rfc 3530 14.2.19 that the server
1979  * return an error if the client attempt to downgrade to a combination
1980  * of share bits not explicable by closing some of its previous opens.
1981  *
1982  * XXX: This enforcement is actually incomplete, since we don't keep
1983  * track of access/deny bit combinations; so, e.g., we allow:
1984  *
1985  *      OPEN allow read, deny write
1986  *      OPEN allow both, deny none
1987  *      DOWNGRADE allow read, deny none
1988  *
1989  * which we should reject.
1990  */
1991 static void
1992 set_access(unsigned int *access, unsigned long bmap) {
1993         int i;
1994
1995         *access = 0;
1996         for (i = 1; i < 4; i++) {
1997                 if (test_bit(i, &bmap))
1998                         *access |= i;
1999         }
2000 }
2001
2002 static void
2003 set_deny(unsigned int *deny, unsigned long bmap) {
2004         int i;
2005
2006         *deny = 0;
2007         for (i = 0; i < 4; i++) {
2008                 if (test_bit(i, &bmap))
2009                         *deny |= i ;
2010         }
2011 }
2012
2013 static int
2014 test_share(struct nfs4_stateid *stp, struct nfsd4_open *open) {
2015         unsigned int access, deny;
2016
2017         set_access(&access, stp->st_access_bmap);
2018         set_deny(&deny, stp->st_deny_bmap);
2019         if ((access & open->op_share_deny) || (deny & open->op_share_access))
2020                 return 0;
2021         return 1;
2022 }
2023
2024 /*
2025  * Called to check deny when READ with all zero stateid or
2026  * WRITE with all zero or all one stateid
2027  */
2028 static __be32
2029 nfs4_share_conflict(struct svc_fh *current_fh, unsigned int deny_type)
2030 {
2031         struct inode *ino = current_fh->fh_dentry->d_inode;
2032         struct nfs4_file *fp;
2033         struct nfs4_stateid *stp;
2034         __be32 ret;
2035
2036         dprintk("NFSD: nfs4_share_conflict\n");
2037
2038         fp = find_file(ino);
2039         if (!fp)
2040                 return nfs_ok;
2041         ret = nfserr_locked;
2042         /* Search for conflicting share reservations */
2043         list_for_each_entry(stp, &fp->fi_stateids, st_perfile) {
2044                 if (test_bit(deny_type, &stp->st_deny_bmap) ||
2045                     test_bit(NFS4_SHARE_DENY_BOTH, &stp->st_deny_bmap))
2046                         goto out;
2047         }
2048         ret = nfs_ok;
2049 out:
2050         put_nfs4_file(fp);
2051         return ret;
2052 }
2053
2054 static inline void
2055 nfs4_file_downgrade(struct file *filp, unsigned int share_access)
2056 {
2057         if (share_access & NFS4_SHARE_ACCESS_WRITE) {
2058                 drop_file_write_access(filp);
2059                 spin_lock(&filp->f_lock);
2060                 filp->f_mode = (filp->f_mode | FMODE_READ) & ~FMODE_WRITE;
2061                 spin_unlock(&filp->f_lock);
2062         }
2063 }
2064
2065 /*
2066  * Spawn a thread to perform a recall on the delegation represented
2067  * by the lease (file_lock)
2068  *
2069  * Called from break_lease() with lock_kernel() held.
2070  * Note: we assume break_lease will only call this *once* for any given
2071  * lease.
2072  */
2073 static
2074 void nfsd_break_deleg_cb(struct file_lock *fl)
2075 {
2076         struct nfs4_delegation *dp = (struct nfs4_delegation *)fl->fl_owner;
2077
2078         dprintk("NFSD nfsd_break_deleg_cb: dp %p fl %p\n",dp,fl);
2079         if (!dp)
2080                 return;
2081
2082         /* We're assuming the state code never drops its reference
2083          * without first removing the lease.  Since we're in this lease
2084          * callback (and since the lease code is serialized by the kernel
2085          * lock) we know the server hasn't removed the lease yet, we know
2086          * it's safe to take a reference: */
2087         atomic_inc(&dp->dl_count);
2088
2089         spin_lock(&recall_lock);
2090         list_add_tail(&dp->dl_recall_lru, &del_recall_lru);
2091         spin_unlock(&recall_lock);
2092
2093         /* only place dl_time is set. protected by lock_kernel*/
2094         dp->dl_time = get_seconds();
2095
2096         /*
2097          * We don't want the locks code to timeout the lease for us;
2098          * we'll remove it ourself if the delegation isn't returned
2099          * in time.
2100          */
2101         fl->fl_break_time = 0;
2102
2103         dp->dl_file->fi_had_conflict = true;
2104         nfsd4_cb_recall(dp);
2105 }
2106
2107 /*
2108  * The file_lock is being reapd.
2109  *
2110  * Called by locks_free_lock() with lock_kernel() held.
2111  */
2112 static
2113 void nfsd_release_deleg_cb(struct file_lock *fl)
2114 {
2115         struct nfs4_delegation *dp = (struct nfs4_delegation *)fl->fl_owner;
2116
2117         dprintk("NFSD nfsd_release_deleg_cb: fl %p dp %p dl_count %d\n", fl,dp, atomic_read(&dp->dl_count));
2118
2119         if (!(fl->fl_flags & FL_LEASE) || !dp)
2120                 return;
2121         dp->dl_flock = NULL;
2122 }
2123
2124 /*
2125  * Set the delegation file_lock back pointer.
2126  *
2127  * Called from setlease() with lock_kernel() held.
2128  */
2129 static
2130 void nfsd_copy_lock_deleg_cb(struct file_lock *new, struct file_lock *fl)
2131 {
2132         struct nfs4_delegation *dp = (struct nfs4_delegation *)new->fl_owner;
2133
2134         dprintk("NFSD: nfsd_copy_lock_deleg_cb: new fl %p dp %p\n", new, dp);
2135         if (!dp)
2136                 return;
2137         dp->dl_flock = new;
2138 }
2139
2140 /*
2141  * Called from setlease() with lock_kernel() held
2142  */
2143 static
2144 int nfsd_same_client_deleg_cb(struct file_lock *onlist, struct file_lock *try)
2145 {
2146         struct nfs4_delegation *onlistd =
2147                 (struct nfs4_delegation *)onlist->fl_owner;
2148         struct nfs4_delegation *tryd =
2149                 (struct nfs4_delegation *)try->fl_owner;
2150
2151         if (onlist->fl_lmops != try->fl_lmops)
2152                 return 0;
2153
2154         return onlistd->dl_client == tryd->dl_client;
2155 }
2156
2157
2158 static
2159 int nfsd_change_deleg_cb(struct file_lock **onlist, int arg)
2160 {
2161         if (arg & F_UNLCK)
2162                 return lease_modify(onlist, arg);
2163         else
2164                 return -EAGAIN;
2165 }
2166
2167 static const struct lock_manager_operations nfsd_lease_mng_ops = {
2168         .fl_break = nfsd_break_deleg_cb,
2169         .fl_release_private = nfsd_release_deleg_cb,
2170         .fl_copy_lock = nfsd_copy_lock_deleg_cb,
2171         .fl_mylease = nfsd_same_client_deleg_cb,
2172         .fl_change = nfsd_change_deleg_cb,
2173 };
2174
2175
2176 __be32
2177 nfsd4_process_open1(struct nfsd4_compound_state *cstate,
2178                     struct nfsd4_open *open)
2179 {
2180         clientid_t *clientid = &open->op_clientid;
2181         struct nfs4_client *clp = NULL;
2182         unsigned int strhashval;
2183         struct nfs4_stateowner *sop = NULL;
2184
2185         if (!check_name(open->op_owner))
2186                 return nfserr_inval;
2187
2188         if (STALE_CLIENTID(&open->op_clientid))
2189                 return nfserr_stale_clientid;
2190
2191         strhashval = ownerstr_hashval(clientid->cl_id, open->op_owner);
2192         sop = find_openstateowner_str(strhashval, open);
2193         open->op_stateowner = sop;
2194         if (!sop) {
2195                 /* Make sure the client's lease hasn't expired. */
2196                 clp = find_confirmed_client(clientid);
2197                 if (clp == NULL)
2198                         return nfserr_expired;
2199                 goto renew;
2200         }
2201         /* When sessions are used, skip open sequenceid processing */
2202         if (nfsd4_has_session(cstate))
2203                 goto renew;
2204         if (!sop->so_confirmed) {
2205                 /* Replace unconfirmed owners without checking for replay. */
2206                 clp = sop->so_client;
2207                 release_openowner(sop);
2208                 open->op_stateowner = NULL;
2209                 goto renew;
2210         }
2211         if (open->op_seqid == sop->so_seqid - 1) {
2212                 if (sop->so_replay.rp_buflen)
2213                         return nfserr_replay_me;
2214                 /* The original OPEN failed so spectacularly
2215                  * that we don't even have replay data saved!
2216                  * Therefore, we have no choice but to continue
2217                  * processing this OPEN; presumably, we'll
2218                  * fail again for the same reason.
2219                  */
2220                 dprintk("nfsd4_process_open1: replay with no replay cache\n");
2221                 goto renew;
2222         }
2223         if (open->op_seqid != sop->so_seqid)
2224                 return nfserr_bad_seqid;
2225 renew:
2226         if (open->op_stateowner == NULL) {
2227                 sop = alloc_init_open_stateowner(strhashval, clp, open);
2228                 if (sop == NULL)
2229                         return nfserr_resource;
2230                 open->op_stateowner = sop;
2231         }
2232         list_del_init(&sop->so_close_lru);
2233         renew_client(sop->so_client);
2234         return nfs_ok;
2235 }
2236
2237 static inline __be32
2238 nfs4_check_delegmode(struct nfs4_delegation *dp, int flags)
2239 {
2240         if ((flags & WR_STATE) && (dp->dl_type == NFS4_OPEN_DELEGATE_READ))
2241                 return nfserr_openmode;
2242         else
2243                 return nfs_ok;
2244 }
2245
2246 static struct nfs4_delegation *
2247 find_delegation_file(struct nfs4_file *fp, stateid_t *stid)
2248 {
2249         struct nfs4_delegation *dp;
2250
2251         list_for_each_entry(dp, &fp->fi_delegations, dl_perfile) {
2252                 if (dp->dl_stateid.si_stateownerid == stid->si_stateownerid)
2253                         return dp;
2254         }
2255         return NULL;
2256 }
2257
2258 static __be32
2259 nfs4_check_deleg(struct nfs4_file *fp, struct nfsd4_open *open,
2260                 struct nfs4_delegation **dp)
2261 {
2262         int flags;
2263         __be32 status = nfserr_bad_stateid;
2264
2265         *dp = find_delegation_file(fp, &open->op_delegate_stateid);
2266         if (*dp == NULL)
2267                 goto out;
2268         flags = open->op_share_access == NFS4_SHARE_ACCESS_READ ?
2269                                                 RD_STATE : WR_STATE;
2270         status = nfs4_check_delegmode(*dp, flags);
2271         if (status)
2272                 *dp = NULL;
2273 out:
2274         if (open->op_claim_type != NFS4_OPEN_CLAIM_DELEGATE_CUR)
2275                 return nfs_ok;
2276         if (status)
2277                 return status;
2278         open->op_stateowner->so_confirmed = 1;
2279         return nfs_ok;
2280 }
2281
2282 static __be32
2283 nfs4_check_open(struct nfs4_file *fp, struct nfsd4_open *open, struct nfs4_stateid **stpp)
2284 {
2285         struct nfs4_stateid *local;
2286         __be32 status = nfserr_share_denied;
2287         struct nfs4_stateowner *sop = open->op_stateowner;
2288
2289         list_for_each_entry(local, &fp->fi_stateids, st_perfile) {
2290                 /* ignore lock owners */
2291                 if (local->st_stateowner->so_is_open_owner == 0)
2292                         continue;
2293                 /* remember if we have seen this open owner */
2294                 if (local->st_stateowner == sop)
2295                         *stpp = local;
2296                 /* check for conflicting share reservations */
2297                 if (!test_share(local, open))
2298                         goto out;
2299         }
2300         status = 0;
2301 out:
2302         return status;
2303 }
2304
2305 static inline struct nfs4_stateid *
2306 nfs4_alloc_stateid(void)
2307 {
2308         return kmem_cache_alloc(stateid_slab, GFP_KERNEL);
2309 }
2310
2311 static __be32
2312 nfs4_new_open(struct svc_rqst *rqstp, struct nfs4_stateid **stpp,
2313                 struct nfs4_delegation *dp,
2314                 struct svc_fh *cur_fh, int flags)
2315 {
2316         struct nfs4_stateid *stp;
2317
2318         stp = nfs4_alloc_stateid();
2319         if (stp == NULL)
2320                 return nfserr_resource;
2321
2322         if (dp) {
2323                 get_file(dp->dl_vfs_file);
2324                 stp->st_vfs_file = dp->dl_vfs_file;
2325         } else {
2326                 __be32 status;
2327                 status = nfsd_open(rqstp, cur_fh, S_IFREG, flags,
2328                                 &stp->st_vfs_file);
2329                 if (status) {
2330                         if (status == nfserr_dropit)
2331                                 status = nfserr_jukebox;
2332                         kmem_cache_free(stateid_slab, stp);
2333                         return status;
2334                 }
2335         }
2336         *stpp = stp;
2337         return 0;
2338 }
2339
2340 static inline __be32
2341 nfsd4_truncate(struct svc_rqst *rqstp, struct svc_fh *fh,
2342                 struct nfsd4_open *open)
2343 {
2344         struct iattr iattr = {
2345                 .ia_valid = ATTR_SIZE,
2346                 .ia_size = 0,
2347         };
2348         if (!open->op_truncate)
2349                 return 0;
2350         if (!(open->op_share_access & NFS4_SHARE_ACCESS_WRITE))
2351                 return nfserr_inval;
2352         return nfsd_setattr(rqstp, fh, &iattr, 0, (time_t)0);
2353 }
2354
2355 static __be32
2356 nfs4_upgrade_open(struct svc_rqst *rqstp, struct svc_fh *cur_fh, struct nfs4_stateid *stp, struct nfsd4_open *open)
2357 {
2358         struct file *filp = stp->st_vfs_file;
2359         struct inode *inode = filp->f_path.dentry->d_inode;
2360         unsigned int share_access, new_writer;
2361         __be32 status;
2362
2363         set_access(&share_access, stp->st_access_bmap);
2364         new_writer = (~share_access) & open->op_share_access
2365                         & NFS4_SHARE_ACCESS_WRITE;
2366
2367         if (new_writer) {
2368                 int err = get_write_access(inode);
2369                 if (err)
2370                         return nfserrno(err);
2371                 err = mnt_want_write(cur_fh->fh_export->ex_path.mnt);
2372                 if (err)
2373                         return nfserrno(err);
2374                 file_take_write(filp);
2375         }
2376         status = nfsd4_truncate(rqstp, cur_fh, open);
2377         if (status) {
2378                 if (new_writer)
2379                         put_write_access(inode);
2380                 return status;
2381         }
2382         /* remember the open */
2383         filp->f_mode |= open->op_share_access;
2384         __set_bit(open->op_share_access, &stp->st_access_bmap);
2385         __set_bit(open->op_share_deny, &stp->st_deny_bmap);
2386
2387         return nfs_ok;
2388 }
2389
2390
2391 static void
2392 nfs4_set_claim_prev(struct nfsd4_open *open)
2393 {
2394         open->op_stateowner->so_confirmed = 1;
2395         open->op_stateowner->so_client->cl_firststate = 1;
2396 }
2397
2398 /*
2399  * Attempt to hand out a delegation.
2400  */
2401 static void
2402 nfs4_open_delegation(struct svc_fh *fh, struct nfsd4_open *open, struct nfs4_stateid *stp)
2403 {
2404         struct nfs4_delegation *dp;
2405         struct nfs4_stateowner *sop = stp->st_stateowner;
2406         int cb_up = atomic_read(&sop->so_client->cl_cb_set);
2407         struct file_lock fl, *flp = &fl;
2408         int status, flag = 0;
2409
2410         flag = NFS4_OPEN_DELEGATE_NONE;
2411         open->op_recall = 0;
2412         switch (open->op_claim_type) {
2413                 case NFS4_OPEN_CLAIM_PREVIOUS:
2414                         if (!cb_up)
2415                                 open->op_recall = 1;
2416                         flag = open->op_delegate_type;
2417                         if (flag == NFS4_OPEN_DELEGATE_NONE)
2418                                 goto out;
2419                         break;
2420                 case NFS4_OPEN_CLAIM_NULL:
2421                         /* Let's not give out any delegations till everyone's
2422                          * had the chance to reclaim theirs.... */
2423                         if (locks_in_grace())
2424                                 goto out;
2425                         if (!cb_up || !sop->so_confirmed)
2426                                 goto out;
2427                         if (open->op_share_access & NFS4_SHARE_ACCESS_WRITE)
2428                                 flag = NFS4_OPEN_DELEGATE_WRITE;
2429                         else
2430                                 flag = NFS4_OPEN_DELEGATE_READ;
2431                         break;
2432                 default:
2433                         goto out;
2434         }
2435
2436         dp = alloc_init_deleg(sop->so_client, stp, fh, flag);
2437         if (dp == NULL) {
2438                 flag = NFS4_OPEN_DELEGATE_NONE;
2439                 goto out;
2440         }
2441         locks_init_lock(&fl);
2442         fl.fl_lmops = &nfsd_lease_mng_ops;
2443         fl.fl_flags = FL_LEASE;
2444         fl.fl_type = flag == NFS4_OPEN_DELEGATE_READ? F_RDLCK: F_WRLCK;
2445         fl.fl_end = OFFSET_MAX;
2446         fl.fl_owner =  (fl_owner_t)dp;
2447         fl.fl_file = stp->st_vfs_file;
2448         fl.fl_pid = current->tgid;
2449
2450         /* vfs_setlease checks to see if delegation should be handed out.
2451          * the lock_manager callbacks fl_mylease and fl_change are used
2452          */
2453         if ((status = vfs_setlease(stp->st_vfs_file, fl.fl_type, &flp))) {
2454                 dprintk("NFSD: setlease failed [%d], no delegation\n", status);
2455                 unhash_delegation(dp);
2456                 flag = NFS4_OPEN_DELEGATE_NONE;
2457                 goto out;
2458         }
2459
2460         memcpy(&open->op_delegate_stateid, &dp->dl_stateid, sizeof(dp->dl_stateid));
2461
2462         dprintk("NFSD: delegation stateid=" STATEID_FMT "\n",
2463                 STATEID_VAL(&dp->dl_stateid));
2464 out:
2465         if (open->op_claim_type == NFS4_OPEN_CLAIM_PREVIOUS
2466                         && flag == NFS4_OPEN_DELEGATE_NONE
2467                         && open->op_delegate_type != NFS4_OPEN_DELEGATE_NONE)
2468                 dprintk("NFSD: WARNING: refusing delegation reclaim\n");
2469         open->op_delegate_type = flag;
2470 }
2471
2472 /*
2473  * called with nfs4_lock_state() held.
2474  */
2475 __be32
2476 nfsd4_process_open2(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_open *open)
2477 {
2478         struct nfsd4_compoundres *resp = rqstp->rq_resp;
2479         struct nfs4_file *fp = NULL;
2480         struct inode *ino = current_fh->fh_dentry->d_inode;
2481         struct nfs4_stateid *stp = NULL;
2482         struct nfs4_delegation *dp = NULL;
2483         __be32 status;
2484
2485         status = nfserr_inval;
2486         if (!access_valid(open->op_share_access, resp->cstate.minorversion)
2487                         || !deny_valid(open->op_share_deny))
2488                 goto out;
2489         /*
2490          * Lookup file; if found, lookup stateid and check open request,
2491          * and check for delegations in the process of being recalled.
2492          * If not found, create the nfs4_file struct
2493          */
2494         fp = find_file(ino);
2495         if (fp) {
2496                 if ((status = nfs4_check_open(fp, open, &stp)))
2497                         goto out;
2498                 status = nfs4_check_deleg(fp, open, &dp);
2499                 if (status)
2500                         goto out;
2501         } else {
2502                 status = nfserr_bad_stateid;
2503                 if (open->op_claim_type == NFS4_OPEN_CLAIM_DELEGATE_CUR)
2504                         goto out;
2505                 status = nfserr_resource;
2506                 fp = alloc_init_file(ino);
2507                 if (fp == NULL)
2508                         goto out;
2509         }
2510
2511         /*
2512          * OPEN the file, or upgrade an existing OPEN.
2513          * If truncate fails, the OPEN fails.
2514          */
2515         if (stp) {
2516                 /* Stateid was found, this is an OPEN upgrade */
2517                 status = nfs4_upgrade_open(rqstp, current_fh, stp, open);
2518                 if (status)
2519                         goto out;
2520                 update_stateid(&stp->st_stateid);
2521         } else {
2522                 /* Stateid was not found, this is a new OPEN */
2523                 int flags = 0;
2524                 if (open->op_share_access & NFS4_SHARE_ACCESS_READ)
2525                         flags |= NFSD_MAY_READ;
2526                 if (open->op_share_access & NFS4_SHARE_ACCESS_WRITE)
2527                         flags |= NFSD_MAY_WRITE;
2528                 status = nfs4_new_open(rqstp, &stp, dp, current_fh, flags);
2529                 if (status)
2530                         goto out;
2531                 init_stateid(stp, fp, open);
2532                 status = nfsd4_truncate(rqstp, current_fh, open);
2533                 if (status) {
2534                         release_open_stateid(stp);
2535                         goto out;
2536                 }
2537                 if (nfsd4_has_session(&resp->cstate))
2538                         update_stateid(&stp->st_stateid);
2539         }
2540         memcpy(&open->op_stateid, &stp->st_stateid, sizeof(stateid_t));
2541
2542         if (nfsd4_has_session(&resp->cstate))
2543                 open->op_stateowner->so_confirmed = 1;
2544
2545         /*
2546         * Attempt to hand out a delegation. No error return, because the
2547         * OPEN succeeds even if we fail.
2548         */
2549         nfs4_open_delegation(current_fh, open, stp);
2550
2551         status = nfs_ok;
2552
2553         dprintk("%s: stateid=" STATEID_FMT "\n", __func__,
2554                 STATEID_VAL(&stp->st_stateid));
2555 out:
2556         if (fp)
2557                 put_nfs4_file(fp);
2558         if (status == 0 && open->op_claim_type == NFS4_OPEN_CLAIM_PREVIOUS)
2559                 nfs4_set_claim_prev(open);
2560         /*
2561         * To finish the open response, we just need to set the rflags.
2562         */
2563         open->op_rflags = NFS4_OPEN_RESULT_LOCKTYPE_POSIX;
2564         if (!open->op_stateowner->so_confirmed &&
2565             !nfsd4_has_session(&resp->cstate))
2566                 open->op_rflags |= NFS4_OPEN_RESULT_CONFIRM;
2567
2568         return status;
2569 }
2570
2571 __be32
2572 nfsd4_renew(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
2573             clientid_t *clid)
2574 {
2575         struct nfs4_client *clp;
2576         __be32 status;
2577
2578         nfs4_lock_state();
2579         dprintk("process_renew(%08x/%08x): starting\n", 
2580                         clid->cl_boot, clid->cl_id);
2581         status = nfserr_stale_clientid;
2582         if (STALE_CLIENTID(clid))
2583                 goto out;
2584         clp = find_confirmed_client(clid);
2585         status = nfserr_expired;
2586         if (clp == NULL) {
2587                 /* We assume the client took too long to RENEW. */
2588                 dprintk("nfsd4_renew: clientid not found!\n");
2589                 goto out;
2590         }
2591         renew_client(clp);
2592         status = nfserr_cb_path_down;
2593         if (!list_empty(&clp->cl_delegations)
2594                         && !atomic_read(&clp->cl_cb_set))
2595                 goto out;
2596         status = nfs_ok;
2597 out:
2598         nfs4_unlock_state();
2599         return status;
2600 }
2601
2602 struct lock_manager nfsd4_manager = {
2603 };
2604
2605 static void
2606 nfsd4_end_grace(void)
2607 {
2608         dprintk("NFSD: end of grace period\n");
2609         nfsd4_recdir_purge_old();
2610         locks_end_grace(&nfsd4_manager);
2611         /*
2612          * Now that every NFSv4 client has had the chance to recover and
2613          * to see the (possibly new, possibly shorter) lease time, we
2614          * can safely set the next grace time to the current lease time:
2615          */
2616         nfsd4_grace = nfsd4_lease;
2617 }
2618
2619 static time_t
2620 nfs4_laundromat(void)
2621 {
2622         struct nfs4_client *clp;
2623         struct nfs4_stateowner *sop;
2624         struct nfs4_delegation *dp;
2625         struct list_head *pos, *next, reaplist;
2626         time_t cutoff = get_seconds() - nfsd4_lease;
2627         time_t t, clientid_val = nfsd4_lease;
2628         time_t u, test_val = nfsd4_lease;
2629
2630         nfs4_lock_state();
2631
2632         dprintk("NFSD: laundromat service - starting\n");
2633         if (locks_in_grace())
2634                 nfsd4_end_grace();
2635         INIT_LIST_HEAD(&reaplist);
2636         spin_lock(&client_lock);
2637         list_for_each_safe(pos, next, &client_lru) {
2638                 clp = list_entry(pos, struct nfs4_client, cl_lru);
2639                 if (time_after((unsigned long)clp->cl_time, (unsigned long)cutoff)) {
2640                         t = clp->cl_time - cutoff;
2641                         if (clientid_val > t)
2642                                 clientid_val = t;
2643                         break;
2644                 }
2645                 if (atomic_read(&clp->cl_refcount)) {
2646                         dprintk("NFSD: client in use (clientid %08x)\n",
2647                                 clp->cl_clientid.cl_id);
2648                         continue;
2649                 }
2650                 unhash_client_locked(clp);
2651                 list_add(&clp->cl_lru, &reaplist);
2652         }
2653         spin_unlock(&client_lock);
2654         list_for_each_safe(pos, next, &reaplist) {
2655                 clp = list_entry(pos, struct nfs4_client, cl_lru);
2656                 dprintk("NFSD: purging unused client (clientid %08x)\n",
2657                         clp->cl_clientid.cl_id);
2658                 nfsd4_remove_clid_dir(clp);
2659                 expire_client(clp);
2660         }
2661         spin_lock(&recall_lock);
2662         list_for_each_safe(pos, next, &del_recall_lru) {
2663                 dp = list_entry (pos, struct nfs4_delegation, dl_recall_lru);
2664                 if (time_after((unsigned long)dp->dl_time, (unsigned long)cutoff)) {
2665                         u = dp->dl_time - cutoff;
2666                         if (test_val > u)
2667                                 test_val = u;
2668                         break;
2669                 }
2670                 dprintk("NFSD: purging unused delegation dp %p, fp %p\n",
2671                                     dp, dp->dl_flock);
2672                 list_move(&dp->dl_recall_lru, &reaplist);
2673         }
2674         spin_unlock(&recall_lock);
2675         list_for_each_safe(pos, next, &reaplist) {
2676                 dp = list_entry (pos, struct nfs4_delegation, dl_recall_lru);
2677                 list_del_init(&dp->dl_recall_lru);
2678                 unhash_delegation(dp);
2679         }
2680         test_val = nfsd4_lease;
2681         list_for_each_safe(pos, next, &close_lru) {
2682                 sop = list_entry(pos, struct nfs4_stateowner, so_close_lru);
2683                 if (time_after((unsigned long)sop->so_time, (unsigned long)cutoff)) {
2684                         u = sop->so_time - cutoff;
2685                         if (test_val > u)
2686                                 test_val = u;
2687                         break;
2688                 }
2689                 dprintk("NFSD: purging unused open stateowner (so_id %d)\n",
2690                         sop->so_id);
2691                 release_openowner(sop);
2692         }
2693         if (clientid_val < NFSD_LAUNDROMAT_MINTIMEOUT)
2694                 clientid_val = NFSD_LAUNDROMAT_MINTIMEOUT;
2695         nfs4_unlock_state();
2696         return clientid_val;
2697 }
2698
2699 static struct workqueue_struct *laundry_wq;
2700 static void laundromat_main(struct work_struct *);
2701 static DECLARE_DELAYED_WORK(laundromat_work, laundromat_main);
2702
2703 static void
2704 laundromat_main(struct work_struct *not_used)
2705 {
2706         time_t t;
2707
2708         t = nfs4_laundromat();
2709         dprintk("NFSD: laundromat_main - sleeping for %ld seconds\n", t);
2710         queue_delayed_work(laundry_wq, &laundromat_work, t*HZ);
2711 }
2712
2713 static struct nfs4_stateowner *
2714 search_close_lru(u32 st_id, int flags)
2715 {
2716         struct nfs4_stateowner *local = NULL;
2717
2718         if (flags & CLOSE_STATE) {
2719                 list_for_each_entry(local, &close_lru, so_close_lru) {
2720                         if (local->so_id == st_id)
2721                                 return local;
2722                 }
2723         }
2724         return NULL;
2725 }
2726
2727 static inline int
2728 nfs4_check_fh(struct svc_fh *fhp, struct nfs4_stateid *stp)
2729 {
2730         return fhp->fh_dentry->d_inode != stp->st_vfs_file->f_path.dentry->d_inode;
2731 }
2732
2733 static int
2734 STALE_STATEID(stateid_t *stateid)
2735 {
2736         if (time_after((unsigned long)boot_time,
2737                         (unsigned long)stateid->si_boot)) {
2738                 dprintk("NFSD: stale stateid " STATEID_FMT "!\n",
2739                         STATEID_VAL(stateid));
2740                 return 1;
2741         }
2742         return 0;
2743 }
2744
2745 static int
2746 EXPIRED_STATEID(stateid_t *stateid)
2747 {
2748         if (time_before((unsigned long)boot_time,
2749                         ((unsigned long)stateid->si_boot)) &&
2750             time_before((unsigned long)(stateid->si_boot + nfsd4_lease), get_seconds())) {
2751                 dprintk("NFSD: expired stateid " STATEID_FMT "!\n",
2752                         STATEID_VAL(stateid));
2753                 return 1;
2754         }
2755         return 0;
2756 }
2757
2758 static __be32
2759 stateid_error_map(stateid_t *stateid)
2760 {
2761         if (STALE_STATEID(stateid))
2762                 return nfserr_stale_stateid;
2763         if (EXPIRED_STATEID(stateid))
2764                 return nfserr_expired;
2765
2766         dprintk("NFSD: bad stateid " STATEID_FMT "!\n",
2767                 STATEID_VAL(stateid));
2768         return nfserr_bad_stateid;
2769 }
2770
2771 static inline int
2772 access_permit_read(unsigned long access_bmap)
2773 {
2774         return test_bit(NFS4_SHARE_ACCESS_READ, &access_bmap) ||
2775                 test_bit(NFS4_SHARE_ACCESS_BOTH, &access_bmap) ||
2776                 test_bit(NFS4_SHARE_ACCESS_WRITE, &access_bmap);
2777 }
2778
2779 static inline int
2780 access_permit_write(unsigned long access_bmap)
2781 {
2782         return test_bit(NFS4_SHARE_ACCESS_WRITE, &access_bmap) ||
2783                 test_bit(NFS4_SHARE_ACCESS_BOTH, &access_bmap);
2784 }
2785
2786 static
2787 __be32 nfs4_check_openmode(struct nfs4_stateid *stp, int flags)
2788 {
2789         __be32 status = nfserr_openmode;
2790
2791         if ((flags & WR_STATE) && (!access_permit_write(stp->st_access_bmap)))
2792                 goto out;
2793         if ((flags & RD_STATE) && (!access_permit_read(stp->st_access_bmap)))
2794                 goto out;
2795         status = nfs_ok;
2796 out:
2797         return status;
2798 }
2799
2800 static inline __be32
2801 check_special_stateids(svc_fh *current_fh, stateid_t *stateid, int flags)
2802 {
2803         if (ONE_STATEID(stateid) && (flags & RD_STATE))
2804                 return nfs_ok;
2805         else if (locks_in_grace()) {
2806                 /* Answer in remaining cases depends on existance of
2807                  * conflicting state; so we must wait out the grace period. */
2808                 return nfserr_grace;
2809         } else if (flags & WR_STATE)
2810                 return nfs4_share_conflict(current_fh,
2811                                 NFS4_SHARE_DENY_WRITE);
2812         else /* (flags & RD_STATE) && ZERO_STATEID(stateid) */
2813                 return nfs4_share_conflict(current_fh,
2814                                 NFS4_SHARE_DENY_READ);
2815 }
2816
2817 /*
2818  * Allow READ/WRITE during grace period on recovered state only for files
2819  * that are not able to provide mandatory locking.
2820  */
2821 static inline int
2822 grace_disallows_io(struct inode *inode)
2823 {
2824         return locks_in_grace() && mandatory_lock(inode);
2825 }
2826
2827 static int check_stateid_generation(stateid_t *in, stateid_t *ref, int flags)
2828 {
2829         /*
2830          * When sessions are used the stateid generation number is ignored
2831          * when it is zero.
2832          */
2833         if ((flags & HAS_SESSION) && in->si_generation == 0)
2834                 goto out;
2835
2836         /* If the client sends us a stateid from the future, it's buggy: */
2837         if (in->si_generation > ref->si_generation)
2838                 return nfserr_bad_stateid;
2839         /*
2840          * The following, however, can happen.  For example, if the
2841          * client sends an open and some IO at the same time, the open
2842          * may bump si_generation while the IO is still in flight.
2843          * Thanks to hard links and renames, the client never knows what
2844          * file an open will affect.  So it could avoid that situation
2845          * only by serializing all opens and IO from the same open
2846          * owner.  To recover from the old_stateid error, the client
2847          * will just have to retry the IO:
2848          */
2849         if (in->si_generation < ref->si_generation)
2850                 return nfserr_old_stateid;
2851 out:
2852         return nfs_ok;
2853 }
2854
2855 static int is_delegation_stateid(stateid_t *stateid)
2856 {
2857         return stateid->si_fileid == 0;
2858 }
2859
2860 /*
2861 * Checks for stateid operations
2862 */
2863 __be32
2864 nfs4_preprocess_stateid_op(struct nfsd4_compound_state *cstate,
2865                            stateid_t *stateid, int flags, struct file **filpp)
2866 {
2867         struct nfs4_stateid *stp = NULL;
2868         struct nfs4_delegation *dp = NULL;
2869         struct svc_fh *current_fh = &cstate->current_fh;
2870         struct inode *ino = current_fh->fh_dentry->d_inode;
2871         __be32 status;
2872
2873         if (filpp)
2874                 *filpp = NULL;
2875
2876         if (grace_disallows_io(ino))
2877                 return nfserr_grace;
2878
2879         if (nfsd4_has_session(cstate))
2880                 flags |= HAS_SESSION;
2881
2882         if (ZERO_STATEID(stateid) || ONE_STATEID(stateid))
2883                 return check_special_stateids(current_fh, stateid, flags);
2884
2885         status = nfserr_stale_stateid;
2886         if (STALE_STATEID(stateid)) 
2887                 goto out;
2888
2889         status = nfserr_bad_stateid;
2890         if (is_delegation_stateid(stateid)) {
2891                 dp = find_delegation_stateid(ino, stateid);
2892                 if (!dp) {
2893                         status = stateid_error_map(stateid);
2894                         goto out;
2895                 }
2896                 status = check_stateid_generation(stateid, &dp->dl_stateid,
2897                                                   flags);
2898                 if (status)
2899                         goto out;
2900                 status = nfs4_check_delegmode(dp, flags);
2901                 if (status)
2902                         goto out;
2903                 renew_client(dp->dl_client);
2904                 if (filpp)
2905                         *filpp = dp->dl_vfs_file;
2906         } else { /* open or lock stateid */
2907                 stp = find_stateid(stateid, flags);
2908                 if (!stp) {
2909                         status = stateid_error_map(stateid);
2910                         goto out;
2911                 }
2912                 if (nfs4_check_fh(current_fh, stp))
2913                         goto out;
2914                 if (!stp->st_stateowner->so_confirmed)
2915                         goto out;
2916                 status = check_stateid_generation(stateid, &stp->st_stateid,
2917                                                   flags);
2918                 if (status)
2919                         goto out;
2920                 status = nfs4_check_openmode(stp, flags);
2921                 if (status)
2922                         goto out;
2923                 renew_client(stp->st_stateowner->so_client);
2924                 if (filpp)
2925                         *filpp = stp->st_vfs_file;
2926         }
2927         status = nfs_ok;
2928 out:
2929         return status;
2930 }
2931
2932 static inline int
2933 setlkflg (int type)
2934 {
2935         return (type == NFS4_READW_LT || type == NFS4_READ_LT) ?
2936                 RD_STATE : WR_STATE;
2937 }
2938
2939 /* 
2940  * Checks for sequence id mutating operations. 
2941  */
2942 static __be32
2943 nfs4_preprocess_seqid_op(struct nfsd4_compound_state *cstate, u32 seqid,
2944                          stateid_t *stateid, int flags,
2945                          struct nfs4_stateowner **sopp,
2946                          struct nfs4_stateid **stpp, struct nfsd4_lock *lock)
2947 {
2948         struct nfs4_stateid *stp;
2949         struct nfs4_stateowner *sop;
2950         struct svc_fh *current_fh = &cstate->current_fh;
2951         __be32 status;
2952
2953         dprintk("NFSD: %s: seqid=%d stateid = " STATEID_FMT "\n", __func__,
2954                 seqid, STATEID_VAL(stateid));
2955
2956         *stpp = NULL;
2957         *sopp = NULL;
2958
2959         if (ZERO_STATEID(stateid) || ONE_STATEID(stateid)) {
2960                 dprintk("NFSD: preprocess_seqid_op: magic stateid!\n");
2961                 return nfserr_bad_stateid;
2962         }
2963
2964         if (STALE_STATEID(stateid))
2965                 return nfserr_stale_stateid;
2966
2967         if (nfsd4_has_session(cstate))
2968                 flags |= HAS_SESSION;
2969
2970         /*
2971         * We return BAD_STATEID if filehandle doesn't match stateid, 
2972         * the confirmed flag is incorrecly set, or the generation 
2973         * number is incorrect.  
2974         */
2975         stp = find_stateid(stateid, flags);
2976         if (stp == NULL) {
2977                 /*
2978                  * Also, we should make sure this isn't just the result of
2979                  * a replayed close:
2980                  */
2981                 sop = search_close_lru(stateid->si_stateownerid, flags);
2982                 if (sop == NULL)
2983                         return stateid_error_map(stateid);
2984                 *sopp = sop;
2985                 goto check_replay;
2986         }
2987
2988         *stpp = stp;
2989         *sopp = sop = stp->st_stateowner;
2990
2991         if (lock) {
2992                 clientid_t *lockclid = &lock->v.new.clientid;
2993                 struct nfs4_client *clp = sop->so_client;
2994                 int lkflg = 0;
2995                 __be32 status;
2996
2997                 lkflg = setlkflg(lock->lk_type);
2998
2999                 if (lock->lk_is_new) {
3000                         if (!sop->so_is_open_owner)
3001                                 return nfserr_bad_stateid;
3002                         if (!(flags & HAS_SESSION) &&
3003                             !same_clid(&clp->cl_clientid, lockclid))
3004                                 return nfserr_bad_stateid;
3005                         /* stp is the open stateid */
3006                         status = nfs4_check_openmode(stp, lkflg);
3007                         if (status)
3008                                 return status;
3009                 } else {
3010                         /* stp is the lock stateid */
3011                         status = nfs4_check_openmode(stp->st_openstp, lkflg);
3012                         if (status)
3013                                 return status;
3014                }
3015         }
3016
3017         if (nfs4_check_fh(current_fh, stp)) {
3018                 dprintk("NFSD: preprocess_seqid_op: fh-stateid mismatch!\n");
3019                 return nfserr_bad_stateid;
3020         }
3021
3022         /*
3023         *  We now validate the seqid and stateid generation numbers.
3024         *  For the moment, we ignore the possibility of 
3025         *  generation number wraparound.
3026         */
3027         if (!(flags & HAS_SESSION) && seqid != sop->so_seqid)
3028                 goto check_replay;
3029
3030         if (sop->so_confirmed && flags & CONFIRM) {
3031                 dprintk("NFSD: preprocess_seqid_op: expected"
3032                                 " unconfirmed stateowner!\n");
3033                 return nfserr_bad_stateid;
3034         }
3035         if (!sop->so_confirmed && !(flags & CONFIRM)) {
3036                 dprintk("NFSD: preprocess_seqid_op: stateowner not"
3037                                 " confirmed yet!\n");
3038                 return nfserr_bad_stateid;
3039         }
3040         status = check_stateid_generation(stateid, &stp->st_stateid, flags);
3041         if (status)
3042                 return status;
3043         renew_client(sop->so_client);
3044         return nfs_ok;
3045
3046 check_replay:
3047         if (seqid == sop->so_seqid - 1) {
3048                 dprintk("NFSD: preprocess_seqid_op: retransmission?\n");
3049                 /* indicate replay to calling function */
3050                 return nfserr_replay_me;
3051         }
3052         dprintk("NFSD: preprocess_seqid_op: bad seqid (expected %d, got %d)\n",
3053                         sop->so_seqid, seqid);
3054         *sopp = NULL;
3055         return nfserr_bad_seqid;
3056 }
3057
3058 __be32
3059 nfsd4_open_confirm(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
3060                    struct nfsd4_open_confirm *oc)
3061 {
3062         __be32 status;
3063         struct nfs4_stateowner *sop;
3064         struct nfs4_stateid *stp;
3065
3066         dprintk("NFSD: nfsd4_open_confirm on file %.*s\n",
3067                         (int)cstate->current_fh.fh_dentry->d_name.len,
3068                         cstate->current_fh.fh_dentry->d_name.name);
3069
3070         status = fh_verify(rqstp, &cstate->current_fh, S_IFREG, 0);
3071         if (status)
3072                 return status;
3073
3074         nfs4_lock_state();
3075
3076         if ((status = nfs4_preprocess_seqid_op(cstate,
3077                                         oc->oc_seqid, &oc->oc_req_stateid,
3078                                         CONFIRM | OPEN_STATE,
3079                                         &oc->oc_stateowner, &stp, NULL)))
3080                 goto out; 
3081
3082         sop = oc->oc_stateowner;
3083         sop->so_confirmed = 1;
3084         update_stateid(&stp->st_stateid);
3085         memcpy(&oc->oc_resp_stateid, &stp->st_stateid, sizeof(stateid_t));
3086         dprintk("NFSD: %s: success, seqid=%d stateid=" STATEID_FMT "\n",
3087                 __func__, oc->oc_seqid, STATEID_VAL(&stp->st_stateid));
3088
3089         nfsd4_create_clid_dir(sop->so_client);
3090 out:
3091         if (oc->oc_stateowner) {
3092                 nfs4_get_stateowner(oc->oc_stateowner);
3093                 cstate->replay_owner = oc->oc_stateowner;
3094         }
3095         nfs4_unlock_state();
3096         return status;
3097 }
3098
3099
3100 /*
3101  * unset all bits in union bitmap (bmap) that
3102  * do not exist in share (from successful OPEN_DOWNGRADE)
3103  */
3104 static void
3105 reset_union_bmap_access(unsigned long access, unsigned long *bmap)
3106 {
3107         int i;
3108         for (i = 1; i < 4; i++) {
3109                 if ((i & access) != i)
3110                         __clear_bit(i, bmap);
3111         }
3112 }
3113
3114 static void
3115 reset_union_bmap_deny(unsigned long deny, unsigned long *bmap)
3116 {
3117         int i;
3118         for (i = 0; i < 4; i++) {
3119                 if ((i & deny) != i)
3120                         __clear_bit(i, bmap);
3121         }
3122 }
3123
3124 __be32
3125 nfsd4_open_downgrade(struct svc_rqst *rqstp,
3126                      struct nfsd4_compound_state *cstate,
3127                      struct nfsd4_open_downgrade *od)
3128 {
3129         __be32 status;
3130         struct nfs4_stateid *stp;
3131         unsigned int share_access;
3132
3133         dprintk("NFSD: nfsd4_open_downgrade on file %.*s\n", 
3134                         (int)cstate->current_fh.fh_dentry->d_name.len,
3135                         cstate->current_fh.fh_dentry->d_name.name);
3136
3137         if (!access_valid(od->od_share_access, cstate->minorversion)
3138                         || !deny_valid(od->od_share_deny))
3139                 return nfserr_inval;
3140
3141         nfs4_lock_state();
3142         if ((status = nfs4_preprocess_seqid_op(cstate,
3143                                         od->od_seqid,
3144                                         &od->od_stateid, 
3145                                         OPEN_STATE,
3146                                         &od->od_stateowner, &stp, NULL)))
3147                 goto out; 
3148
3149         status = nfserr_inval;
3150         if (!test_bit(od->od_share_access, &stp->st_access_bmap)) {
3151                 dprintk("NFSD:access not a subset current bitmap: 0x%lx, input access=%08x\n",
3152                         stp->st_access_bmap, od->od_share_access);
3153                 goto out;
3154         }
3155         if (!test_bit(od->od_share_deny, &stp->st_deny_bmap)) {
3156                 dprintk("NFSD:deny not a subset current bitmap: 0x%lx, input deny=%08x\n",
3157                         stp->st_deny_bmap, od->od_share_deny);
3158                 goto out;
3159         }
3160         set_access(&share_access, stp->st_access_bmap);
3161         nfs4_file_downgrade(stp->st_vfs_file,
3162                             share_access & ~od->od_share_access);
3163
3164         reset_union_bmap_access(od->od_share_access, &stp->st_access_bmap);
3165         reset_union_bmap_deny(od->od_share_deny, &stp->st_deny_bmap);
3166
3167         update_stateid(&stp->st_stateid);
3168         memcpy(&od->od_stateid, &stp->st_stateid, sizeof(stateid_t));
3169         status = nfs_ok;
3170 out:
3171         if (od->od_stateowner) {
3172                 nfs4_get_stateowner(od->od_stateowner);
3173                 cstate->replay_owner = od->od_stateowner;
3174         }
3175         nfs4_unlock_state();
3176         return status;
3177 }
3178
3179 /*
3180  * nfs4_unlock_state() called after encode
3181  */
3182 __be32
3183 nfsd4_close(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
3184             struct nfsd4_close *close)
3185 {
3186         __be32 status;
3187         struct nfs4_stateid *stp;
3188
3189         dprintk("NFSD: nfsd4_close on file %.*s\n", 
3190                         (int)cstate->current_fh.fh_dentry->d_name.len,
3191                         cstate->current_fh.fh_dentry->d_name.name);
3192
3193         nfs4_lock_state();
3194         /* check close_lru for replay */
3195         if ((status = nfs4_preprocess_seqid_op(cstate,
3196                                         close->cl_seqid,
3197                                         &close->cl_stateid, 
3198                                         OPEN_STATE | CLOSE_STATE,
3199                                         &close->cl_stateowner, &stp, NULL)))
3200                 goto out; 
3201         status = nfs_ok;
3202         update_stateid(&stp->st_stateid);
3203         memcpy(&close->cl_stateid, &stp->st_stateid, sizeof(stateid_t));
3204
3205         /* release_stateid() calls nfsd_close() if needed */
3206         release_open_stateid(stp);
3207
3208         /* place unused nfs4_stateowners on so_close_lru list to be
3209          * released by the laundromat service after the lease period
3210          * to enable us to handle CLOSE replay
3211          */
3212         if (list_empty(&close->cl_stateowner->so_stateids))
3213                 move_to_close_lru(close->cl_stateowner);
3214 out:
3215         if (close->cl_stateowner) {
3216                 nfs4_get_stateowner(close->cl_stateowner);
3217                 cstate->replay_owner = close->cl_stateowner;
3218         }
3219         nfs4_unlock_state();
3220         return status;
3221 }
3222
3223 __be32
3224 nfsd4_delegreturn(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
3225                   struct nfsd4_delegreturn *dr)
3226 {
3227         struct nfs4_delegation *dp;
3228         stateid_t *stateid = &dr->dr_stateid;
3229         struct inode *inode;
3230         __be32 status;
3231         int flags = 0;
3232
3233         if ((status = fh_verify(rqstp, &cstate->current_fh, S_IFREG, 0)))
3234                 return status;
3235         inode = cstate->current_fh.fh_dentry->d_inode;
3236
3237         if (nfsd4_has_session(cstate))
3238                 flags |= HAS_SESSION;
3239         nfs4_lock_state();
3240         status = nfserr_bad_stateid;
3241         if (ZERO_STATEID(stateid) || ONE_STATEID(stateid))
3242                 goto out;
3243         status = nfserr_stale_stateid;
3244         if (STALE_STATEID(stateid))
3245                 goto out;
3246         status = nfserr_bad_stateid;
3247         if (!is_delegation_stateid(stateid))
3248                 goto out;
3249         dp = find_delegation_stateid(inode, stateid);
3250         if (!dp) {
3251                 status = stateid_error_map(stateid);
3252                 goto out;
3253         }
3254         status = check_stateid_generation(stateid, &dp->dl_stateid, flags);
3255         if (status)
3256                 goto out;
3257         renew_client(dp->dl_client);
3258
3259         unhash_delegation(dp);
3260 out:
3261         nfs4_unlock_state();
3262
3263         return status;
3264 }
3265
3266
3267 /* 
3268  * Lock owner state (byte-range locks)
3269  */
3270 #define LOFF_OVERFLOW(start, len)      ((u64)(len) > ~(u64)(start))
3271 #define LOCK_HASH_BITS              8
3272 #define LOCK_HASH_SIZE             (1 << LOCK_HASH_BITS)
3273 #define LOCK_HASH_MASK             (LOCK_HASH_SIZE - 1)
3274
3275 static inline u64
3276 end_offset(u64 start, u64 len)
3277 {
3278         u64 end;
3279
3280         end = start + len;
3281         return end >= start ? end: NFS4_MAX_UINT64;
3282 }
3283
3284 /* last octet in a range */
3285 static inline u64
3286 last_byte_offset(u64 start, u64 len)
3287 {
3288         u64 end;
3289
3290         BUG_ON(!len);
3291         end = start + len;
3292         return end > start ? end - 1: NFS4_MAX_UINT64;
3293 }
3294
3295 #define lockownerid_hashval(id) \
3296         ((id) & LOCK_HASH_MASK)
3297
3298 static inline unsigned int
3299 lock_ownerstr_hashval(struct inode *inode, u32 cl_id,
3300                 struct xdr_netobj *ownername)
3301 {
3302         return (file_hashval(inode) + cl_id
3303                         + opaque_hashval(ownername->data, ownername->len))
3304                 & LOCK_HASH_MASK;
3305 }
3306
3307 static struct list_head lock_ownerid_hashtbl[LOCK_HASH_SIZE];
3308 static struct list_head lock_ownerstr_hashtbl[LOCK_HASH_SIZE];
3309 static struct list_head lockstateid_hashtbl[STATEID_HASH_SIZE];
3310
3311 static struct nfs4_stateid *
3312 find_stateid(stateid_t *stid, int flags)
3313 {
3314         struct nfs4_stateid *local;
3315         u32 st_id = stid->si_stateownerid;
3316         u32 f_id = stid->si_fileid;
3317         unsigned int hashval;
3318
3319         dprintk("NFSD: find_stateid flags 0x%x\n",flags);
3320         if (flags & (LOCK_STATE | RD_STATE | WR_STATE)) {
3321                 hashval = stateid_hashval(st_id, f_id);
3322                 list_for_each_entry(local, &lockstateid_hashtbl[hashval], st_hash) {
3323                         if ((local->st_stateid.si_stateownerid == st_id) &&
3324                             (local->st_stateid.si_fileid == f_id))
3325                                 return local;
3326                 }
3327         } 
3328
3329         if (flags & (OPEN_STATE | RD_STATE | WR_STATE)) {
3330                 hashval = stateid_hashval(st_id, f_id);
3331                 list_for_each_entry(local, &stateid_hashtbl[hashval], st_hash) {
3332                         if ((local->st_stateid.si_stateownerid == st_id) &&
3333                             (local->st_stateid.si_fileid == f_id))
3334                                 return local;
3335                 }
3336         }
3337         return NULL;
3338 }
3339
3340 static struct nfs4_delegation *
3341 find_delegation_stateid(struct inode *ino, stateid_t *stid)
3342 {
3343         struct nfs4_file *fp;
3344         struct nfs4_delegation *dl;
3345
3346         dprintk("NFSD: %s: stateid=" STATEID_FMT "\n", __func__,
3347                 STATEID_VAL(stid));
3348
3349         fp = find_file(ino);
3350         if (!fp)
3351                 return NULL;
3352         dl = find_delegation_file(fp, stid);
3353         put_nfs4_file(fp);
3354         return dl;
3355 }
3356
3357 /*
3358  * TODO: Linux file offsets are _signed_ 64-bit quantities, which means that
3359  * we can't properly handle lock requests that go beyond the (2^63 - 1)-th
3360  * byte, because of sign extension problems.  Since NFSv4 calls for 64-bit
3361  * locking, this prevents us from being completely protocol-compliant.  The
3362  * real solution to this problem is to start using unsigned file offsets in
3363  * the VFS, but this is a very deep change!
3364  */
3365 static inline void
3366 nfs4_transform_lock_offset(struct file_lock *lock)
3367 {
3368         if (lock->fl_start < 0)
3369                 lock->fl_start = OFFSET_MAX;
3370         if (lock->fl_end < 0)
3371                 lock->fl_end = OFFSET_MAX;
3372 }
3373
3374 /* Hack!: For now, we're defining this just so we can use a pointer to it
3375  * as a unique cookie to identify our (NFSv4's) posix locks. */
3376 static const struct lock_manager_operations nfsd_posix_mng_ops  = {
3377 };
3378
3379 static inline void
3380 nfs4_set_lock_denied(struct file_lock *fl, struct nfsd4_lock_denied *deny)
3381 {
3382         struct nfs4_stateowner *sop;
3383         unsigned int hval;
3384
3385         if (fl->fl_lmops == &nfsd_posix_mng_ops) {
3386                 sop = (struct nfs4_stateowner *) fl->fl_owner;
3387                 hval = lockownerid_hashval(sop->so_id);
3388                 kref_get(&sop->so_ref);
3389                 deny->ld_sop = sop;
3390                 deny->ld_clientid = sop->so_client->cl_clientid;
3391         } else {
3392                 deny->ld_sop = NULL;
3393                 deny->ld_clientid.cl_boot = 0;
3394                 deny->ld_clientid.cl_id = 0;
3395         }
3396         deny->ld_start = fl->fl_start;
3397         deny->ld_length = NFS4_MAX_UINT64;
3398         if (fl->fl_end != NFS4_MAX_UINT64)
3399                 deny->ld_length = fl->fl_end - fl->fl_start + 1;        
3400         deny->ld_type = NFS4_READ_LT;
3401         if (fl->fl_type != F_RDLCK)
3402                 deny->ld_type = NFS4_WRITE_LT;
3403 }
3404
3405 static struct nfs4_stateowner *
3406 find_lockstateowner_str(struct inode *inode, clientid_t *clid,
3407                 struct xdr_netobj *owner)
3408 {
3409         unsigned int hashval = lock_ownerstr_hashval(inode, clid->cl_id, owner);
3410         struct nfs4_stateowner *op;
3411
3412         list_for_each_entry(op, &lock_ownerstr_hashtbl[hashval], so_strhash) {
3413                 if (same_owner_str(op, owner, clid))
3414                         return op;
3415         }
3416         return NULL;
3417 }
3418
3419 /*
3420  * Alloc a lock owner structure.
3421  * Called in nfsd4_lock - therefore, OPEN and OPEN_CONFIRM (if needed) has 
3422  * occured. 
3423  *
3424  * strhashval = lock_ownerstr_hashval 
3425  */
3426
3427 static struct nfs4_stateowner *
3428 alloc_init_lock_stateowner(unsigned int strhashval, struct nfs4_client *clp, struct nfs4_stateid *open_stp, struct nfsd4_lock *lock) {
3429         struct nfs4_stateowner *sop;
3430         struct nfs4_replay *rp;
3431         unsigned int idhashval;
3432
3433         if (!(sop = alloc_stateowner(&lock->lk_new_owner)))
3434                 return NULL;
3435         idhashval = lockownerid_hashval(current_ownerid);
3436         INIT_LIST_HEAD(&sop->so_idhash);
3437         INIT_LIST_HEAD(&sop->so_strhash);
3438         INIT_LIST_HEAD(&sop->so_perclient);
3439         INIT_LIST_HEAD(&sop->so_stateids);
3440         INIT_LIST_HEAD(&sop->so_perstateid);
3441         INIT_LIST_HEAD(&sop->so_close_lru); /* not used */
3442         sop->so_time = 0;
3443         list_add(&sop->so_idhash, &lock_ownerid_hashtbl[idhashval]);
3444         list_add(&sop->so_strhash, &lock_ownerstr_hashtbl[strhashval]);
3445         list_add(&sop->so_perstateid, &open_stp->st_lockowners);
3446         sop->so_is_open_owner = 0;
3447         sop->so_id = current_ownerid++;
3448         sop->so_client = clp;
3449         /* It is the openowner seqid that will be incremented in encode in the
3450          * case of new lockowners; so increment the lock seqid manually: */
3451         sop->so_seqid = lock->lk_new_lock_seqid + 1;
3452         sop->so_confirmed = 1;
3453         rp = &sop->so_replay;
3454         rp->rp_status = nfserr_serverfault;
3455         rp->rp_buflen = 0;
3456         rp->rp_buf = rp->rp_ibuf;
3457         return sop;
3458 }
3459
3460 static struct nfs4_stateid *
3461 alloc_init_lock_stateid(struct nfs4_stateowner *sop, struct nfs4_file *fp, struct nfs4_stateid *open_stp)
3462 {
3463         struct nfs4_stateid *stp;
3464         unsigned int hashval = stateid_hashval(sop->so_id, fp->fi_id);
3465
3466         stp = nfs4_alloc_stateid();
3467         if (stp == NULL)
3468                 goto out;
3469         INIT_LIST_HEAD(&stp->st_hash);
3470         INIT_LIST_HEAD(&stp->st_perfile);
3471         INIT_LIST_HEAD(&stp->st_perstateowner);
3472         INIT_LIST_HEAD(&stp->st_lockowners); /* not used */
3473         list_add(&stp->st_hash, &lockstateid_hashtbl[hashval]);
3474         list_add(&stp->st_perfile, &fp->fi_stateids);
3475         list_add(&stp->st_perstateowner, &sop->so_stateids);
3476         stp->st_stateowner = sop;
3477         get_nfs4_file(fp);
3478         stp->st_file = fp;
3479         stp->st_stateid.si_boot = get_seconds();
3480         stp->st_stateid.si_stateownerid = sop->so_id;
3481         stp->st_stateid.si_fileid = fp->fi_id;
3482         stp->st_stateid.si_generation = 0;
3483         stp->st_vfs_file = open_stp->st_vfs_file; /* FIXME refcount?? */
3484         stp->st_access_bmap = open_stp->st_access_bmap;
3485         stp->st_deny_bmap = open_stp->st_deny_bmap;
3486         stp->st_openstp = open_stp;
3487
3488 out:
3489         return stp;
3490 }
3491
3492 static int
3493 check_lock_length(u64 offset, u64 length)
3494 {
3495         return ((length == 0)  || ((length != NFS4_MAX_UINT64) &&
3496              LOFF_OVERFLOW(offset, length)));
3497 }
3498
3499 /*
3500  *  LOCK operation 
3501  */
3502 __be32
3503 nfsd4_lock(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
3504            struct nfsd4_lock *lock)
3505 {
3506         struct nfs4_stateowner *open_sop = NULL;
3507         struct nfs4_stateowner *lock_sop = NULL;
3508         struct nfs4_stateid *lock_stp;
3509         struct file *filp;
3510         struct file_lock file_lock;
3511         struct file_lock conflock;
3512         __be32 status = 0;
3513         unsigned int strhashval;
3514         unsigned int cmd;
3515         int err;
3516
3517         dprintk("NFSD: nfsd4_lock: start=%Ld length=%Ld\n",
3518                 (long long) lock->lk_offset,
3519                 (long long) lock->lk_length);
3520
3521         if (check_lock_length(lock->lk_offset, lock->lk_length))
3522                  return nfserr_inval;
3523
3524         if ((status = fh_verify(rqstp, &cstate->current_fh,
3525                                 S_IFREG, NFSD_MAY_LOCK))) {
3526                 dprintk("NFSD: nfsd4_lock: permission denied!\n");
3527                 return status;
3528         }
3529
3530         nfs4_lock_state();
3531
3532         if (lock->lk_is_new) {
3533                 /*
3534                  * Client indicates that this is a new lockowner.
3535                  * Use open owner and open stateid to create lock owner and
3536                  * lock stateid.
3537                  */
3538                 struct nfs4_stateid *open_stp = NULL;
3539                 struct nfs4_file *fp;
3540                 
3541                 status = nfserr_stale_clientid;
3542                 if (!nfsd4_has_session(cstate) &&
3543                     STALE_CLIENTID(&lock->lk_new_clientid))
3544                         goto out;
3545
3546                 /* validate and update open stateid and open seqid */
3547                 status = nfs4_preprocess_seqid_op(cstate,
3548                                         lock->lk_new_open_seqid,
3549                                         &lock->lk_new_open_stateid,
3550                                         OPEN_STATE,
3551                                         &lock->lk_replay_owner, &open_stp,
3552                                         lock);
3553                 if (status)
3554                         goto out;
3555                 open_sop = lock->lk_replay_owner;
3556                 /* create lockowner and lock stateid */
3557                 fp = open_stp->st_file;
3558                 strhashval = lock_ownerstr_hashval(fp->fi_inode, 
3559                                 open_sop->so_client->cl_clientid.cl_id, 
3560                                 &lock->v.new.owner);
3561                 /* XXX: Do we need to check for duplicate stateowners on
3562                  * the same file, or should they just be allowed (and
3563                  * create new stateids)? */
3564                 status = nfserr_resource;
3565                 lock_sop = alloc_init_lock_stateowner(strhashval,
3566                                 open_sop->so_client, open_stp, lock);
3567                 if (lock_sop == NULL)
3568                         goto out;
3569                 lock_stp = alloc_init_lock_stateid(lock_sop, fp, open_stp);
3570                 if (lock_stp == NULL)
3571                         goto out;
3572         } else {
3573                 /* lock (lock owner + lock stateid) already exists */
3574                 status = nfs4_preprocess_seqid_op(cstate,
3575                                        lock->lk_old_lock_seqid, 
3576                                        &lock->lk_old_lock_stateid, 
3577                                        LOCK_STATE,
3578                                        &lock->lk_replay_owner, &lock_stp, lock);
3579                 if (status)
3580                         goto out;
3581                 lock_sop = lock->lk_replay_owner;
3582         }
3583         /* lock->lk_replay_owner and lock_stp have been created or found */
3584         filp = lock_stp->st_vfs_file;
3585
3586         status = nfserr_grace;
3587         if (locks_in_grace() && !lock->lk_reclaim)
3588                 goto out;
3589         status = nfserr_no_grace;
3590         if (!locks_in_grace() && lock->lk_reclaim)
3591                 goto out;
3592
3593         locks_init_lock(&file_lock);
3594         switch (lock->lk_type) {
3595                 case NFS4_READ_LT:
3596                 case NFS4_READW_LT:
3597                         file_lock.fl_type = F_RDLCK;
3598                         cmd = F_SETLK;
3599                 break;
3600                 case NFS4_WRITE_LT:
3601                 case NFS4_WRITEW_LT:
3602                         file_lock.fl_type = F_WRLCK;
3603                         cmd = F_SETLK;
3604                 break;
3605                 default:
3606                         status = nfserr_inval;
3607                 goto out;
3608         }
3609         file_lock.fl_owner = (fl_owner_t)lock_sop;
3610         file_lock.fl_pid = current->tgid;
3611         file_lock.fl_file = filp;
3612         file_lock.fl_flags = FL_POSIX;
3613         file_lock.fl_lmops = &nfsd_posix_mng_ops;
3614
3615         file_lock.fl_start = lock->lk_offset;
3616         file_lock.fl_end = last_byte_offset(lock->lk_offset, lock->lk_length);
3617         nfs4_transform_lock_offset(&file_lock);
3618
3619         /*
3620         * Try to lock the file in the VFS.
3621         * Note: locks.c uses the BKL to protect the inode's lock list.
3622         */
3623
3624         err = vfs_lock_file(filp, cmd, &file_lock, &conflock);
3625         switch (-err) {
3626         case 0: /* success! */
3627                 update_stateid(&lock_stp->st_stateid);
3628                 memcpy(&lock->lk_resp_stateid, &lock_stp->st_stateid, 
3629                                 sizeof(stateid_t));
3630                 status = 0;
3631                 break;
3632         case (EAGAIN):          /* conflock holds conflicting lock */
3633                 status = nfserr_denied;
3634                 dprintk("NFSD: nfsd4_lock: conflicting lock found!\n");
3635                 nfs4_set_lock_denied(&conflock, &lock->lk_denied);
3636                 break;
3637         case (EDEADLK):
3638                 status = nfserr_deadlock;
3639                 break;
3640         default:        
3641                 dprintk("NFSD: nfsd4_lock: vfs_lock_file() failed! status %d\n",err);
3642                 status = nfserr_resource;
3643                 break;
3644         }
3645 out:
3646         if (status && lock->lk_is_new && lock_sop)
3647                 release_lockowner(lock_sop);
3648         if (lock->lk_replay_owner) {
3649                 nfs4_get_stateowner(lock->lk_replay_owner);
3650                 cstate->replay_owner = lock->lk_replay_owner;
3651         }
3652         nfs4_unlock_state();
3653         return status;
3654 }
3655
3656 /*
3657  * The NFSv4 spec allows a client to do a LOCKT without holding an OPEN,
3658  * so we do a temporary open here just to get an open file to pass to
3659  * vfs_test_lock.  (Arguably perhaps test_lock should be done with an
3660  * inode operation.)
3661  */
3662 static int nfsd_test_lock(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file_lock *lock)
3663 {
3664         struct file *file;
3665         int err;
3666
3667         err = nfsd_open(rqstp, fhp, S_IFREG, NFSD_MAY_READ, &file);
3668         if (err)
3669                 return err;
3670         err = vfs_test_lock(file, lock);
3671         nfsd_close(file);
3672         return err;
3673 }
3674
3675 /*
3676  * LOCKT operation
3677  */
3678 __be32
3679 nfsd4_lockt(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
3680             struct nfsd4_lockt *lockt)
3681 {
3682         struct inode *inode;
3683         struct file_lock file_lock;
3684         int error;
3685         __be32 status;
3686
3687         if (locks_in_grace())
3688                 return nfserr_grace;
3689
3690         if (check_lock_length(lockt->lt_offset, lockt->lt_length))
3691                  return nfserr_inval;
3692
3693         lockt->lt_stateowner = NULL;
3694         nfs4_lock_state();
3695
3696         status = nfserr_stale_clientid;
3697         if (!nfsd4_has_session(cstate) && STALE_CLIENTID(&lockt->lt_clientid))
3698                 goto out;
3699
3700         if ((status = fh_verify(rqstp, &cstate->current_fh, S_IFREG, 0))) {
3701                 dprintk("NFSD: nfsd4_lockt: fh_verify() failed!\n");
3702                 if (status == nfserr_symlink)
3703                         status = nfserr_inval;
3704                 goto out;
3705         }
3706
3707         inode = cstate->current_fh.fh_dentry->d_inode;
3708         locks_init_lock(&file_lock);
3709         switch (lockt->lt_type) {
3710                 case NFS4_READ_LT:
3711                 case NFS4_READW_LT:
3712                         file_lock.fl_type = F_RDLCK;
3713                 break;
3714                 case NFS4_WRITE_LT:
3715                 case NFS4_WRITEW_LT:
3716                         file_lock.fl_type = F_WRLCK;
3717                 break;
3718                 default:
3719                         dprintk("NFSD: nfs4_lockt: bad lock type!\n");
3720                         status = nfserr_inval;
3721                 goto out;
3722         }
3723
3724         lockt->lt_stateowner = find_lockstateowner_str(inode,
3725                         &lockt->lt_clientid, &lockt->lt_owner);
3726         if (lockt->lt_stateowner)
3727                 file_lock.fl_owner = (fl_owner_t)lockt->lt_stateowner;
3728         file_lock.fl_pid = current->tgid;
3729         file_lock.fl_flags = FL_POSIX;
3730
3731         file_lock.fl_start = lockt->lt_offset;
3732         file_lock.fl_end = last_byte_offset(lockt->lt_offset, lockt->lt_length);
3733
3734         nfs4_transform_lock_offset(&file_lock);
3735
3736         status = nfs_ok;
3737         error = nfsd_test_lock(rqstp, &cstate->current_fh, &file_lock);
3738         if (error) {
3739                 status = nfserrno(error);
3740                 goto out;
3741         }
3742         if (file_lock.fl_type != F_UNLCK) {
3743                 status = nfserr_denied;
3744                 nfs4_set_lock_denied(&file_lock, &lockt->lt_denied);
3745         }
3746 out:
3747         nfs4_unlock_state();
3748         return status;
3749 }
3750
3751 __be32
3752 nfsd4_locku(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
3753             struct nfsd4_locku *locku)
3754 {
3755         struct nfs4_stateid *stp;
3756         struct file *filp = NULL;
3757         struct file_lock file_lock;
3758         __be32 status;
3759         int err;
3760                                                         
3761         dprintk("NFSD: nfsd4_locku: start=%Ld length=%Ld\n",
3762                 (long long) locku->lu_offset,
3763                 (long long) locku->lu_length);
3764
3765         if (check_lock_length(locku->lu_offset, locku->lu_length))
3766                  return nfserr_inval;
3767
3768         nfs4_lock_state();
3769                                                                                 
3770         if ((status = nfs4_preprocess_seqid_op(cstate,
3771                                         locku->lu_seqid, 
3772                                         &locku->lu_stateid, 
3773                                         LOCK_STATE,
3774                                         &locku->lu_stateowner, &stp, NULL)))
3775                 goto out;
3776
3777         filp = stp->st_vfs_file;
3778         BUG_ON(!filp);
3779         locks_init_lock(&file_lock);
3780         file_lock.fl_type = F_UNLCK;
3781         file_lock.fl_owner = (fl_owner_t) locku->lu_stateowner;
3782         file_lock.fl_pid = current->tgid;
3783         file_lock.fl_file = filp;
3784         file_lock.fl_flags = FL_POSIX; 
3785         file_lock.fl_lmops = &nfsd_posix_mng_ops;
3786         file_lock.fl_start = locku->lu_offset;
3787
3788         file_lock.fl_end = last_byte_offset(locku->lu_offset, locku->lu_length);
3789         nfs4_transform_lock_offset(&file_lock);
3790
3791         /*
3792         *  Try to unlock the file in the VFS.
3793         */
3794         err = vfs_lock_file(filp, F_SETLK, &file_lock, NULL);
3795         if (err) {
3796                 dprintk("NFSD: nfs4_locku: vfs_lock_file failed!\n");
3797                 goto out_nfserr;
3798         }
3799         /*
3800         * OK, unlock succeeded; the only thing left to do is update the stateid.
3801         */
3802         update_stateid(&stp->st_stateid);
3803         memcpy(&locku->lu_stateid, &stp->st_stateid, sizeof(stateid_t));
3804
3805 out:
3806         if (locku->lu_stateowner) {
3807                 nfs4_get_stateowner(locku->lu_stateowner);
3808                 cstate->replay_owner = locku->lu_stateowner;
3809         }
3810         nfs4_unlock_state();
3811         return status;
3812
3813 out_nfserr:
3814         status = nfserrno(err);
3815         goto out;
3816 }
3817
3818 /*
3819  * returns
3820  *      1: locks held by lockowner
3821  *      0: no locks held by lockowner
3822  */
3823 static int
3824 check_for_locks(struct file *filp, struct nfs4_stateowner *lowner)
3825 {
3826         struct file_lock **flpp;
3827         struct inode *inode = filp->f_path.dentry->d_inode;
3828         int status = 0;
3829
3830         lock_kernel();
3831         for (flpp = &inode->i_flock; *flpp != NULL; flpp = &(*flpp)->fl_next) {
3832                 if ((*flpp)->fl_owner == (fl_owner_t)lowner) {
3833                         status = 1;
3834                         goto out;
3835                 }
3836         }
3837 out:
3838         unlock_kernel();
3839         return status;
3840 }
3841
3842 __be32
3843 nfsd4_release_lockowner(struct svc_rqst *rqstp,
3844                         struct nfsd4_compound_state *cstate,
3845                         struct nfsd4_release_lockowner *rlockowner)
3846 {
3847         clientid_t *clid = &rlockowner->rl_clientid;
3848         struct nfs4_stateowner *sop;
3849         struct nfs4_stateid *stp;
3850         struct xdr_netobj *owner = &rlockowner->rl_owner;
3851         struct list_head matches;
3852         int i;
3853         __be32 status;
3854
3855         dprintk("nfsd4_release_lockowner clientid: (%08x/%08x):\n",
3856                 clid->cl_boot, clid->cl_id);
3857
3858         /* XXX check for lease expiration */
3859
3860         status = nfserr_stale_clientid;
3861         if (STALE_CLIENTID(clid))
3862                 return status;
3863
3864         nfs4_lock_state();
3865
3866         status = nfserr_locks_held;
3867         /* XXX: we're doing a linear search through all the lockowners.
3868          * Yipes!  For now we'll just hope clients aren't really using
3869          * release_lockowner much, but eventually we have to fix these
3870          * data structures. */
3871         INIT_LIST_HEAD(&matches);
3872         for (i = 0; i < LOCK_HASH_SIZE; i++) {
3873                 list_for_each_entry(sop, &lock_ownerid_hashtbl[i], so_idhash) {
3874                         if (!same_owner_str(sop, owner, clid))
3875                                 continue;
3876                         list_for_each_entry(stp, &sop->so_stateids,
3877                                         st_perstateowner) {
3878                                 if (check_for_locks(stp->st_vfs_file, sop))
3879                                         goto out;
3880                                 /* Note: so_perclient unused for lockowners,
3881                                  * so it's OK to fool with here. */
3882                                 list_add(&sop->so_perclient, &matches);
3883                         }
3884                 }
3885         }
3886         /* Clients probably won't expect us to return with some (but not all)
3887          * of the lockowner state released; so don't release any until all
3888          * have been checked. */
3889         status = nfs_ok;
3890         while (!list_empty(&matches)) {
3891                 sop = list_entry(matches.next, struct nfs4_stateowner,
3892                                                                 so_perclient);
3893                 /* unhash_stateowner deletes so_perclient only
3894                  * for openowners. */
3895                 list_del(&sop->so_perclient);
3896                 release_lockowner(sop);
3897         }
3898 out:
3899         nfs4_unlock_state();
3900         return status;
3901 }
3902
3903 static inline struct nfs4_client_reclaim *
3904 alloc_reclaim(void)
3905 {
3906         return kmalloc(sizeof(struct nfs4_client_reclaim), GFP_KERNEL);
3907 }
3908
3909 int
3910 nfs4_has_reclaimed_state(const char *name, bool use_exchange_id)
3911 {
3912         unsigned int strhashval = clientstr_hashval(name);
3913         struct nfs4_client *clp;
3914
3915         clp = find_confirmed_client_by_str(name, strhashval, use_exchange_id);
3916         return clp ? 1 : 0;
3917 }
3918
3919 /*
3920  * failure => all reset bets are off, nfserr_no_grace...
3921  */
3922 int
3923 nfs4_client_to_reclaim(const char *name)
3924 {
3925         unsigned int strhashval;
3926         struct nfs4_client_reclaim *crp = NULL;
3927
3928         dprintk("NFSD nfs4_client_to_reclaim NAME: %.*s\n", HEXDIR_LEN, name);
3929         crp = alloc_reclaim();
3930         if (!crp)
3931                 return 0;
3932         strhashval = clientstr_hashval(name);
3933         INIT_LIST_HEAD(&crp->cr_strhash);
3934         list_add(&crp->cr_strhash, &reclaim_str_hashtbl[strhashval]);
3935         memcpy(crp->cr_recdir, name, HEXDIR_LEN);
3936         reclaim_str_hashtbl_size++;
3937         return 1;
3938 }
3939
3940 static void
3941 nfs4_release_reclaim(void)
3942 {
3943         struct nfs4_client_reclaim *crp = NULL;
3944         int i;
3945
3946         for (i = 0; i < CLIENT_HASH_SIZE; i++) {
3947                 while (!list_empty(&reclaim_str_hashtbl[i])) {
3948                         crp = list_entry(reclaim_str_hashtbl[i].next,
3949                                         struct nfs4_client_reclaim, cr_strhash);
3950                         list_del(&crp->cr_strhash);
3951                         kfree(crp);
3952                         reclaim_str_hashtbl_size--;
3953                 }
3954         }
3955         BUG_ON(reclaim_str_hashtbl_size);
3956 }
3957
3958 /*
3959  * called from OPEN, CLAIM_PREVIOUS with a new clientid. */
3960 static struct nfs4_client_reclaim *
3961 nfs4_find_reclaim_client(clientid_t *clid)
3962 {
3963         unsigned int strhashval;
3964         struct nfs4_client *clp;
3965         struct nfs4_client_reclaim *crp = NULL;
3966
3967
3968         /* find clientid in conf_id_hashtbl */
3969         clp = find_confirmed_client(clid);
3970         if (clp == NULL)
3971                 return NULL;
3972
3973         dprintk("NFSD: nfs4_find_reclaim_client for %.*s with recdir %s\n",
3974                             clp->cl_name.len, clp->cl_name.data,
3975                             clp->cl_recdir);
3976
3977         /* find clp->cl_name in reclaim_str_hashtbl */
3978         strhashval = clientstr_hashval(clp->cl_recdir);
3979         list_for_each_entry(crp, &reclaim_str_hashtbl[strhashval], cr_strhash) {
3980                 if (same_name(crp->cr_recdir, clp->cl_recdir)) {
3981                         return crp;
3982                 }
3983         }
3984         return NULL;
3985 }
3986
3987 /*
3988 * Called from OPEN. Look for clientid in reclaim list.
3989 */
3990 __be32
3991 nfs4_check_open_reclaim(clientid_t *clid)
3992 {
3993         return nfs4_find_reclaim_client(clid) ? nfs_ok : nfserr_reclaim_bad;
3994 }
3995
3996 /* initialization to perform at module load time: */
3997
3998 int
3999 nfs4_state_init(void)
4000 {
4001         int i, status;
4002
4003         status = nfsd4_init_slabs();
4004         if (status)
4005                 return status;
4006         for (i = 0; i < CLIENT_HASH_SIZE; i++) {
4007                 INIT_LIST_HEAD(&conf_id_hashtbl[i]);
4008                 INIT_LIST_HEAD(&conf_str_hashtbl[i]);
4009                 INIT_LIST_HEAD(&unconf_str_hashtbl[i]);
4010                 INIT_LIST_HEAD(&unconf_id_hashtbl[i]);
4011                 INIT_LIST_HEAD(&reclaim_str_hashtbl[i]);
4012         }
4013         for (i = 0; i < SESSION_HASH_SIZE; i++)
4014                 INIT_LIST_HEAD(&sessionid_hashtbl[i]);
4015         for (i = 0; i < FILE_HASH_SIZE; i++) {
4016                 INIT_LIST_HEAD(&file_hashtbl[i]);
4017         }
4018         for (i = 0; i < OWNER_HASH_SIZE; i++) {
4019                 INIT_LIST_HEAD(&ownerstr_hashtbl[i]);
4020                 INIT_LIST_HEAD(&ownerid_hashtbl[i]);
4021         }
4022         for (i = 0; i < STATEID_HASH_SIZE; i++) {
4023                 INIT_LIST_HEAD(&stateid_hashtbl[i]);
4024                 INIT_LIST_HEAD(&lockstateid_hashtbl[i]);
4025         }
4026         for (i = 0; i < LOCK_HASH_SIZE; i++) {
4027                 INIT_LIST_HEAD(&lock_ownerid_hashtbl[i]);
4028                 INIT_LIST_HEAD(&lock_ownerstr_hashtbl[i]);
4029         }
4030         memset(&onestateid, ~0, sizeof(stateid_t));
4031         INIT_LIST_HEAD(&close_lru);
4032         INIT_LIST_HEAD(&client_lru);
4033         INIT_LIST_HEAD(&del_recall_lru);
4034         reclaim_str_hashtbl_size = 0;
4035         return 0;
4036 }
4037
4038 static void
4039 nfsd4_load_reboot_recovery_data(void)
4040 {
4041         int status;
4042
4043         nfs4_lock_state();
4044         nfsd4_init_recdir(user_recovery_dirname);
4045         status = nfsd4_recdir_load();
4046         nfs4_unlock_state();
4047         if (status)
4048                 printk("NFSD: Failure reading reboot recovery data\n");
4049 }
4050
4051 /*
4052  * Since the lifetime of a delegation isn't limited to that of an open, a
4053  * client may quite reasonably hang on to a delegation as long as it has
4054  * the inode cached.  This becomes an obvious problem the first time a
4055  * client's inode cache approaches the size of the server's total memory.
4056  *
4057  * For now we avoid this problem by imposing a hard limit on the number
4058  * of delegations, which varies according to the server's memory size.
4059  */
4060 static void
4061 set_max_delegations(void)
4062 {
4063         /*
4064          * Allow at most 4 delegations per megabyte of RAM.  Quick
4065          * estimates suggest that in the worst case (where every delegation
4066          * is for a different inode), a delegation could take about 1.5K,
4067          * giving a worst case usage of about 6% of memory.
4068          */
4069         max_delegations = nr_free_buffer_pages() >> (20 - 2 - PAGE_SHIFT);
4070 }
4071
4072 /* initialization to perform when the nfsd service is started: */
4073