Merge branch 'for-2.6.37' of git://linux-nfs.org/~bfields/linux
[~shefty/rdma-dev.git] / fs / nfsd / nfs4state.c
1 /*
2 *  Copyright (c) 2001 The Regents of the University of Michigan.
3 *  All rights reserved.
4 *
5 *  Kendrick Smith <kmsmith@umich.edu>
6 *  Andy Adamson <kandros@umich.edu>
7 *
8 *  Redistribution and use in source and binary forms, with or without
9 *  modification, are permitted provided that the following conditions
10 *  are met:
11 *
12 *  1. Redistributions of source code must retain the above copyright
13 *     notice, this list of conditions and the following disclaimer.
14 *  2. Redistributions in binary form must reproduce the above copyright
15 *     notice, this list of conditions and the following disclaimer in the
16 *     documentation and/or other materials provided with the distribution.
17 *  3. Neither the name of the University nor the names of its
18 *     contributors may be used to endorse or promote products derived
19 *     from this software without specific prior written permission.
20 *
21 *  THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
22 *  WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
23 *  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
24 *  DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
25 *  FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
26 *  CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
27 *  SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
28 *  BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
29 *  LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
30 *  NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
31 *  SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
32 *
33 */
34
35 #include <linux/file.h>
36 #include <linux/fs.h>
37 #include <linux/slab.h>
38 #include <linux/namei.h>
39 #include <linux/swap.h>
40 #include <linux/sunrpc/svcauth_gss.h>
41 #include <linux/sunrpc/clnt.h>
42 #include "xdr4.h"
43 #include "vfs.h"
44
45 #define NFSDDBG_FACILITY                NFSDDBG_PROC
46
47 /* Globals */
48 time_t nfsd4_lease = 90;     /* default lease time */
49 time_t nfsd4_grace = 90;
50 static time_t boot_time;
51 static u32 current_ownerid = 1;
52 static u32 current_fileid = 1;
53 static u32 current_delegid = 1;
54 static stateid_t zerostateid;             /* bits all 0 */
55 static stateid_t onestateid;              /* bits all 1 */
56 static u64 current_sessionid = 1;
57
58 #define ZERO_STATEID(stateid) (!memcmp((stateid), &zerostateid, sizeof(stateid_t)))
59 #define ONE_STATEID(stateid)  (!memcmp((stateid), &onestateid, sizeof(stateid_t)))
60
61 /* forward declarations */
62 static struct nfs4_stateid * find_stateid(stateid_t *stid, int flags);
63 static struct nfs4_delegation * find_delegation_stateid(struct inode *ino, stateid_t *stid);
64 static char user_recovery_dirname[PATH_MAX] = "/var/lib/nfs/v4recovery";
65 static void nfs4_set_recdir(char *recdir);
66
67 /* Locking: */
68
69 /* Currently used for almost all code touching nfsv4 state: */
70 static DEFINE_MUTEX(client_mutex);
71
72 /*
73  * Currently used for the del_recall_lru and file hash table.  In an
74  * effort to decrease the scope of the client_mutex, this spinlock may
75  * eventually cover more:
76  */
77 static DEFINE_SPINLOCK(recall_lock);
78
79 static struct kmem_cache *stateowner_slab = NULL;
80 static struct kmem_cache *file_slab = NULL;
81 static struct kmem_cache *stateid_slab = NULL;
82 static struct kmem_cache *deleg_slab = NULL;
83
84 void
85 nfs4_lock_state(void)
86 {
87         mutex_lock(&client_mutex);
88 }
89
90 void
91 nfs4_unlock_state(void)
92 {
93         mutex_unlock(&client_mutex);
94 }
95
96 static inline u32
97 opaque_hashval(const void *ptr, int nbytes)
98 {
99         unsigned char *cptr = (unsigned char *) ptr;
100
101         u32 x = 0;
102         while (nbytes--) {
103                 x *= 37;
104                 x += *cptr++;
105         }
106         return x;
107 }
108
109 static struct list_head del_recall_lru;
110
111 static inline void
112 put_nfs4_file(struct nfs4_file *fi)
113 {
114         if (atomic_dec_and_lock(&fi->fi_ref, &recall_lock)) {
115                 list_del(&fi->fi_hash);
116                 spin_unlock(&recall_lock);
117                 iput(fi->fi_inode);
118                 kmem_cache_free(file_slab, fi);
119         }
120 }
121
122 static inline void
123 get_nfs4_file(struct nfs4_file *fi)
124 {
125         atomic_inc(&fi->fi_ref);
126 }
127
128 static int num_delegations;
129 unsigned int max_delegations;
130
131 /*
132  * Open owner state (share locks)
133  */
134
135 /* hash tables for nfs4_stateowner */
136 #define OWNER_HASH_BITS              8
137 #define OWNER_HASH_SIZE             (1 << OWNER_HASH_BITS)
138 #define OWNER_HASH_MASK             (OWNER_HASH_SIZE - 1)
139
140 #define ownerid_hashval(id) \
141         ((id) & OWNER_HASH_MASK)
142 #define ownerstr_hashval(clientid, ownername) \
143         (((clientid) + opaque_hashval((ownername.data), (ownername.len))) & OWNER_HASH_MASK)
144
145 static struct list_head ownerid_hashtbl[OWNER_HASH_SIZE];
146 static struct list_head ownerstr_hashtbl[OWNER_HASH_SIZE];
147
148 /* hash table for nfs4_file */
149 #define FILE_HASH_BITS                   8
150 #define FILE_HASH_SIZE                  (1 << FILE_HASH_BITS)
151 #define FILE_HASH_MASK                  (FILE_HASH_SIZE - 1)
152 /* hash table for (open)nfs4_stateid */
153 #define STATEID_HASH_BITS              10
154 #define STATEID_HASH_SIZE              (1 << STATEID_HASH_BITS)
155 #define STATEID_HASH_MASK              (STATEID_HASH_SIZE - 1)
156
157 #define file_hashval(x) \
158         hash_ptr(x, FILE_HASH_BITS)
159 #define stateid_hashval(owner_id, file_id)  \
160         (((owner_id) + (file_id)) & STATEID_HASH_MASK)
161
162 static struct list_head file_hashtbl[FILE_HASH_SIZE];
163 static struct list_head stateid_hashtbl[STATEID_HASH_SIZE];
164
165 static void __nfs4_file_get_access(struct nfs4_file *fp, int oflag)
166 {
167         BUG_ON(!(fp->fi_fds[oflag] || fp->fi_fds[O_RDWR]));
168         atomic_inc(&fp->fi_access[oflag]);
169 }
170
171 static void nfs4_file_get_access(struct nfs4_file *fp, int oflag)
172 {
173         if (oflag == O_RDWR) {
174                 __nfs4_file_get_access(fp, O_RDONLY);
175                 __nfs4_file_get_access(fp, O_WRONLY);
176         } else
177                 __nfs4_file_get_access(fp, oflag);
178 }
179
180 static void nfs4_file_put_fd(struct nfs4_file *fp, int oflag)
181 {
182         if (fp->fi_fds[oflag]) {
183                 fput(fp->fi_fds[oflag]);
184                 fp->fi_fds[oflag] = NULL;
185         }
186 }
187
188 static void __nfs4_file_put_access(struct nfs4_file *fp, int oflag)
189 {
190         if (atomic_dec_and_test(&fp->fi_access[oflag])) {
191                 nfs4_file_put_fd(fp, O_RDWR);
192                 nfs4_file_put_fd(fp, oflag);
193         }
194 }
195
196 static void nfs4_file_put_access(struct nfs4_file *fp, int oflag)
197 {
198         if (oflag == O_RDWR) {
199                 __nfs4_file_put_access(fp, O_RDONLY);
200                 __nfs4_file_put_access(fp, O_WRONLY);
201         } else
202                 __nfs4_file_put_access(fp, oflag);
203 }
204
205 static struct nfs4_delegation *
206 alloc_init_deleg(struct nfs4_client *clp, struct nfs4_stateid *stp, struct svc_fh *current_fh, u32 type)
207 {
208         struct nfs4_delegation *dp;
209         struct nfs4_file *fp = stp->st_file;
210
211         dprintk("NFSD alloc_init_deleg\n");
212         /*
213          * Major work on the lease subsystem (for example, to support
214          * calbacks on stat) will be required before we can support
215          * write delegations properly.
216          */
217         if (type != NFS4_OPEN_DELEGATE_READ)
218                 return NULL;
219         if (fp->fi_had_conflict)
220                 return NULL;
221         if (num_delegations > max_delegations)
222                 return NULL;
223         dp = kmem_cache_alloc(deleg_slab, GFP_KERNEL);
224         if (dp == NULL)
225                 return dp;
226         num_delegations++;
227         INIT_LIST_HEAD(&dp->dl_perfile);
228         INIT_LIST_HEAD(&dp->dl_perclnt);
229         INIT_LIST_HEAD(&dp->dl_recall_lru);
230         dp->dl_client = clp;
231         get_nfs4_file(fp);
232         dp->dl_file = fp;
233         nfs4_file_get_access(fp, O_RDONLY);
234         dp->dl_flock = NULL;
235         dp->dl_type = type;
236         dp->dl_stateid.si_boot = boot_time;
237         dp->dl_stateid.si_stateownerid = current_delegid++;
238         dp->dl_stateid.si_fileid = 0;
239         dp->dl_stateid.si_generation = 0;
240         fh_copy_shallow(&dp->dl_fh, &current_fh->fh_handle);
241         dp->dl_time = 0;
242         atomic_set(&dp->dl_count, 1);
243         list_add(&dp->dl_perfile, &fp->fi_delegations);
244         list_add(&dp->dl_perclnt, &clp->cl_delegations);
245         INIT_WORK(&dp->dl_recall.cb_work, nfsd4_do_callback_rpc);
246         return dp;
247 }
248
249 void
250 nfs4_put_delegation(struct nfs4_delegation *dp)
251 {
252         if (atomic_dec_and_test(&dp->dl_count)) {
253                 dprintk("NFSD: freeing dp %p\n",dp);
254                 put_nfs4_file(dp->dl_file);
255                 kmem_cache_free(deleg_slab, dp);
256                 num_delegations--;
257         }
258 }
259
260 /* Remove the associated file_lock first, then remove the delegation.
261  * lease_modify() is called to remove the FS_LEASE file_lock from
262  * the i_flock list, eventually calling nfsd's lock_manager
263  * fl_release_callback.
264  */
265 static void
266 nfs4_close_delegation(struct nfs4_delegation *dp)
267 {
268         struct file *filp = find_readable_file(dp->dl_file);
269
270         dprintk("NFSD: close_delegation dp %p\n",dp);
271         if (dp->dl_flock)
272                 vfs_setlease(filp, F_UNLCK, &dp->dl_flock);
273         nfs4_file_put_access(dp->dl_file, O_RDONLY);
274 }
275
276 /* Called under the state lock. */
277 static void
278 unhash_delegation(struct nfs4_delegation *dp)
279 {
280         list_del_init(&dp->dl_perfile);
281         list_del_init(&dp->dl_perclnt);
282         spin_lock(&recall_lock);
283         list_del_init(&dp->dl_recall_lru);
284         spin_unlock(&recall_lock);
285         nfs4_close_delegation(dp);
286         nfs4_put_delegation(dp);
287 }
288
289 /* 
290  * SETCLIENTID state 
291  */
292
293 /* client_lock protects the client lru list and session hash table */
294 static DEFINE_SPINLOCK(client_lock);
295
296 /* Hash tables for nfs4_clientid state */
297 #define CLIENT_HASH_BITS                 4
298 #define CLIENT_HASH_SIZE                (1 << CLIENT_HASH_BITS)
299 #define CLIENT_HASH_MASK                (CLIENT_HASH_SIZE - 1)
300
301 #define clientid_hashval(id) \
302         ((id) & CLIENT_HASH_MASK)
303 #define clientstr_hashval(name) \
304         (opaque_hashval((name), 8) & CLIENT_HASH_MASK)
305 /*
306  * reclaim_str_hashtbl[] holds known client info from previous reset/reboot
307  * used in reboot/reset lease grace period processing
308  *
309  * conf_id_hashtbl[], and conf_str_hashtbl[] hold confirmed
310  * setclientid_confirmed info. 
311  *
312  * unconf_str_hastbl[] and unconf_id_hashtbl[] hold unconfirmed 
313  * setclientid info.
314  *
315  * client_lru holds client queue ordered by nfs4_client.cl_time
316  * for lease renewal.
317  *
318  * close_lru holds (open) stateowner queue ordered by nfs4_stateowner.so_time
319  * for last close replay.
320  */
321 static struct list_head reclaim_str_hashtbl[CLIENT_HASH_SIZE];
322 static int reclaim_str_hashtbl_size = 0;
323 static struct list_head conf_id_hashtbl[CLIENT_HASH_SIZE];
324 static struct list_head conf_str_hashtbl[CLIENT_HASH_SIZE];
325 static struct list_head unconf_str_hashtbl[CLIENT_HASH_SIZE];
326 static struct list_head unconf_id_hashtbl[CLIENT_HASH_SIZE];
327 static struct list_head client_lru;
328 static struct list_head close_lru;
329
330 static void unhash_generic_stateid(struct nfs4_stateid *stp)
331 {
332         list_del(&stp->st_hash);
333         list_del(&stp->st_perfile);
334         list_del(&stp->st_perstateowner);
335 }
336
337 static void free_generic_stateid(struct nfs4_stateid *stp)
338 {
339         put_nfs4_file(stp->st_file);
340         kmem_cache_free(stateid_slab, stp);
341 }
342
343 static void release_lock_stateid(struct nfs4_stateid *stp)
344 {
345         struct file *file;
346
347         unhash_generic_stateid(stp);
348         file = find_any_file(stp->st_file);
349         if (file)
350                 locks_remove_posix(file, (fl_owner_t)stp->st_stateowner);
351         free_generic_stateid(stp);
352 }
353
354 static void unhash_lockowner(struct nfs4_stateowner *sop)
355 {
356         struct nfs4_stateid *stp;
357
358         list_del(&sop->so_idhash);
359         list_del(&sop->so_strhash);
360         list_del(&sop->so_perstateid);
361         while (!list_empty(&sop->so_stateids)) {
362                 stp = list_first_entry(&sop->so_stateids,
363                                 struct nfs4_stateid, st_perstateowner);
364                 release_lock_stateid(stp);
365         }
366 }
367
368 static void release_lockowner(struct nfs4_stateowner *sop)
369 {
370         unhash_lockowner(sop);
371         nfs4_put_stateowner(sop);
372 }
373
374 static void
375 release_stateid_lockowners(struct nfs4_stateid *open_stp)
376 {
377         struct nfs4_stateowner *lock_sop;
378
379         while (!list_empty(&open_stp->st_lockowners)) {
380                 lock_sop = list_entry(open_stp->st_lockowners.next,
381                                 struct nfs4_stateowner, so_perstateid);
382                 /* list_del(&open_stp->st_lockowners);  */
383                 BUG_ON(lock_sop->so_is_open_owner);
384                 release_lockowner(lock_sop);
385         }
386 }
387
388 /*
389  * We store the NONE, READ, WRITE, and BOTH bits separately in the
390  * st_{access,deny}_bmap field of the stateid, in order to track not
391  * only what share bits are currently in force, but also what
392  * combinations of share bits previous opens have used.  This allows us
393  * to enforce the recommendation of rfc 3530 14.2.19 that the server
394  * return an error if the client attempt to downgrade to a combination
395  * of share bits not explicable by closing some of its previous opens.
396  *
397  * XXX: This enforcement is actually incomplete, since we don't keep
398  * track of access/deny bit combinations; so, e.g., we allow:
399  *
400  *      OPEN allow read, deny write
401  *      OPEN allow both, deny none
402  *      DOWNGRADE allow read, deny none
403  *
404  * which we should reject.
405  */
406 static void
407 set_access(unsigned int *access, unsigned long bmap) {
408         int i;
409
410         *access = 0;
411         for (i = 1; i < 4; i++) {
412                 if (test_bit(i, &bmap))
413                         *access |= i;
414         }
415 }
416
417 static void
418 set_deny(unsigned int *deny, unsigned long bmap) {
419         int i;
420
421         *deny = 0;
422         for (i = 0; i < 4; i++) {
423                 if (test_bit(i, &bmap))
424                         *deny |= i ;
425         }
426 }
427
428 static int
429 test_share(struct nfs4_stateid *stp, struct nfsd4_open *open) {
430         unsigned int access, deny;
431
432         set_access(&access, stp->st_access_bmap);
433         set_deny(&deny, stp->st_deny_bmap);
434         if ((access & open->op_share_deny) || (deny & open->op_share_access))
435                 return 0;
436         return 1;
437 }
438
439 static int nfs4_access_to_omode(u32 access)
440 {
441         switch (access & NFS4_SHARE_ACCESS_BOTH) {
442         case NFS4_SHARE_ACCESS_READ:
443                 return O_RDONLY;
444         case NFS4_SHARE_ACCESS_WRITE:
445                 return O_WRONLY;
446         case NFS4_SHARE_ACCESS_BOTH:
447                 return O_RDWR;
448         }
449         BUG();
450 }
451
452 static int nfs4_access_bmap_to_omode(struct nfs4_stateid *stp)
453 {
454         unsigned int access;
455
456         set_access(&access, stp->st_access_bmap);
457         return nfs4_access_to_omode(access);
458 }
459
460 static void release_open_stateid(struct nfs4_stateid *stp)
461 {
462         int oflag = nfs4_access_bmap_to_omode(stp);
463
464         unhash_generic_stateid(stp);
465         release_stateid_lockowners(stp);
466         nfs4_file_put_access(stp->st_file, oflag);
467         free_generic_stateid(stp);
468 }
469
470 static void unhash_openowner(struct nfs4_stateowner *sop)
471 {
472         struct nfs4_stateid *stp;
473
474         list_del(&sop->so_idhash);
475         list_del(&sop->so_strhash);
476         list_del(&sop->so_perclient);
477         list_del(&sop->so_perstateid); /* XXX: necessary? */
478         while (!list_empty(&sop->so_stateids)) {
479                 stp = list_first_entry(&sop->so_stateids,
480                                 struct nfs4_stateid, st_perstateowner);
481                 release_open_stateid(stp);
482         }
483 }
484
485 static void release_openowner(struct nfs4_stateowner *sop)
486 {
487         unhash_openowner(sop);
488         list_del(&sop->so_close_lru);
489         nfs4_put_stateowner(sop);
490 }
491
492 #define SESSION_HASH_SIZE       512
493 static struct list_head sessionid_hashtbl[SESSION_HASH_SIZE];
494
495 static inline int
496 hash_sessionid(struct nfs4_sessionid *sessionid)
497 {
498         struct nfsd4_sessionid *sid = (struct nfsd4_sessionid *)sessionid;
499
500         return sid->sequence % SESSION_HASH_SIZE;
501 }
502
503 static inline void
504 dump_sessionid(const char *fn, struct nfs4_sessionid *sessionid)
505 {
506         u32 *ptr = (u32 *)(&sessionid->data[0]);
507         dprintk("%s: %u:%u:%u:%u\n", fn, ptr[0], ptr[1], ptr[2], ptr[3]);
508 }
509
510 static void
511 gen_sessionid(struct nfsd4_session *ses)
512 {
513         struct nfs4_client *clp = ses->se_client;
514         struct nfsd4_sessionid *sid;
515
516         sid = (struct nfsd4_sessionid *)ses->se_sessionid.data;
517         sid->clientid = clp->cl_clientid;
518         sid->sequence = current_sessionid++;
519         sid->reserved = 0;
520 }
521
522 /*
523  * The protocol defines ca_maxresponssize_cached to include the size of
524  * the rpc header, but all we need to cache is the data starting after
525  * the end of the initial SEQUENCE operation--the rest we regenerate
526  * each time.  Therefore we can advertise a ca_maxresponssize_cached
527  * value that is the number of bytes in our cache plus a few additional
528  * bytes.  In order to stay on the safe side, and not promise more than
529  * we can cache, those additional bytes must be the minimum possible: 24
530  * bytes of rpc header (xid through accept state, with AUTH_NULL
531  * verifier), 12 for the compound header (with zero-length tag), and 44
532  * for the SEQUENCE op response:
533  */
534 #define NFSD_MIN_HDR_SEQ_SZ  (24 + 12 + 44)
535
536 static void
537 free_session_slots(struct nfsd4_session *ses)
538 {
539         int i;
540
541         for (i = 0; i < ses->se_fchannel.maxreqs; i++)
542                 kfree(ses->se_slots[i]);
543 }
544
545 /*
546  * We don't actually need to cache the rpc and session headers, so we
547  * can allocate a little less for each slot:
548  */
549 static inline int slot_bytes(struct nfsd4_channel_attrs *ca)
550 {
551         return ca->maxresp_cached - NFSD_MIN_HDR_SEQ_SZ;
552 }
553
554 static int nfsd4_sanitize_slot_size(u32 size)
555 {
556         size -= NFSD_MIN_HDR_SEQ_SZ; /* We don't cache the rpc header */
557         size = min_t(u32, size, NFSD_SLOT_CACHE_SIZE);
558
559         return size;
560 }
561
562 /*
563  * XXX: If we run out of reserved DRC memory we could (up to a point)
564  * re-negotiate active sessions and reduce their slot usage to make
565  * rooom for new connections. For now we just fail the create session.
566  */
567 static int nfsd4_get_drc_mem(int slotsize, u32 num)
568 {
569         int avail;
570
571         num = min_t(u32, num, NFSD_MAX_SLOTS_PER_SESSION);
572
573         spin_lock(&nfsd_drc_lock);
574         avail = min_t(int, NFSD_MAX_MEM_PER_SESSION,
575                         nfsd_drc_max_mem - nfsd_drc_mem_used);
576         num = min_t(int, num, avail / slotsize);
577         nfsd_drc_mem_used += num * slotsize;
578         spin_unlock(&nfsd_drc_lock);
579
580         return num;
581 }
582
583 static void nfsd4_put_drc_mem(int slotsize, int num)
584 {
585         spin_lock(&nfsd_drc_lock);
586         nfsd_drc_mem_used -= slotsize * num;
587         spin_unlock(&nfsd_drc_lock);
588 }
589
590 static struct nfsd4_session *alloc_session(int slotsize, int numslots)
591 {
592         struct nfsd4_session *new;
593         int mem, i;
594
595         BUILD_BUG_ON(NFSD_MAX_SLOTS_PER_SESSION * sizeof(struct nfsd4_slot *)
596                         + sizeof(struct nfsd4_session) > PAGE_SIZE);
597         mem = numslots * sizeof(struct nfsd4_slot *);
598
599         new = kzalloc(sizeof(*new) + mem, GFP_KERNEL);
600         if (!new)
601                 return NULL;
602         /* allocate each struct nfsd4_slot and data cache in one piece */
603         for (i = 0; i < numslots; i++) {
604                 mem = sizeof(struct nfsd4_slot) + slotsize;
605                 new->se_slots[i] = kzalloc(mem, GFP_KERNEL);
606                 if (!new->se_slots[i])
607                         goto out_free;
608         }
609         return new;
610 out_free:
611         while (i--)
612                 kfree(new->se_slots[i]);
613         kfree(new);
614         return NULL;
615 }
616
617 static void init_forechannel_attrs(struct nfsd4_channel_attrs *new, struct nfsd4_channel_attrs *req, int numslots, int slotsize)
618 {
619         u32 maxrpc = nfsd_serv->sv_max_mesg;
620
621         new->maxreqs = numslots;
622         new->maxresp_cached = slotsize + NFSD_MIN_HDR_SEQ_SZ;
623         new->maxreq_sz = min_t(u32, req->maxreq_sz, maxrpc);
624         new->maxresp_sz = min_t(u32, req->maxresp_sz, maxrpc);
625         new->maxops = min_t(u32, req->maxops, NFSD_MAX_OPS_PER_COMPOUND);
626 }
627
628 static void free_conn(struct nfsd4_conn *c)
629 {
630         svc_xprt_put(c->cn_xprt);
631         kfree(c);
632 }
633
634 static void nfsd4_conn_lost(struct svc_xpt_user *u)
635 {
636         struct nfsd4_conn *c = container_of(u, struct nfsd4_conn, cn_xpt_user);
637         struct nfs4_client *clp = c->cn_session->se_client;
638
639         spin_lock(&clp->cl_lock);
640         if (!list_empty(&c->cn_persession)) {
641                 list_del(&c->cn_persession);
642                 free_conn(c);
643         }
644         spin_unlock(&clp->cl_lock);
645 }
646
647 static struct nfsd4_conn *alloc_conn(struct svc_rqst *rqstp, u32 flags)
648 {
649         struct nfsd4_conn *conn;
650
651         conn = kmalloc(sizeof(struct nfsd4_conn), GFP_KERNEL);
652         if (!conn)
653                 return NULL;
654         svc_xprt_get(rqstp->rq_xprt);
655         conn->cn_xprt = rqstp->rq_xprt;
656         conn->cn_flags = flags;
657         INIT_LIST_HEAD(&conn->cn_xpt_user.list);
658         return conn;
659 }
660
661 static void __nfsd4_hash_conn(struct nfsd4_conn *conn, struct nfsd4_session *ses)
662 {
663         conn->cn_session = ses;
664         list_add(&conn->cn_persession, &ses->se_conns);
665 }
666
667 static void nfsd4_hash_conn(struct nfsd4_conn *conn, struct nfsd4_session *ses)
668 {
669         struct nfs4_client *clp = ses->se_client;
670
671         spin_lock(&clp->cl_lock);
672         __nfsd4_hash_conn(conn, ses);
673         spin_unlock(&clp->cl_lock);
674 }
675
676 static void nfsd4_register_conn(struct nfsd4_conn *conn)
677 {
678         conn->cn_xpt_user.callback = nfsd4_conn_lost;
679         register_xpt_user(conn->cn_xprt, &conn->cn_xpt_user);
680 }
681
682 static __be32 nfsd4_new_conn(struct svc_rqst *rqstp, struct nfsd4_session *ses)
683 {
684         struct nfsd4_conn *conn;
685         u32 flags = NFS4_CDFC4_FORE;
686
687         if (ses->se_flags & SESSION4_BACK_CHAN)
688                 flags |= NFS4_CDFC4_BACK;
689         conn = alloc_conn(rqstp, flags);
690         if (!conn)
691                 return nfserr_jukebox;
692         nfsd4_hash_conn(conn, ses);
693         nfsd4_register_conn(conn);
694         return nfs_ok;
695 }
696
697 static void nfsd4_del_conns(struct nfsd4_session *s)
698 {
699         struct nfs4_client *clp = s->se_client;
700         struct nfsd4_conn *c;
701
702         spin_lock(&clp->cl_lock);
703         while (!list_empty(&s->se_conns)) {
704                 c = list_first_entry(&s->se_conns, struct nfsd4_conn, cn_persession);
705                 list_del_init(&c->cn_persession);
706                 spin_unlock(&clp->cl_lock);
707
708                 unregister_xpt_user(c->cn_xprt, &c->cn_xpt_user);
709                 free_conn(c);
710
711                 spin_lock(&clp->cl_lock);
712         }
713         spin_unlock(&clp->cl_lock);
714 }
715
716 void free_session(struct kref *kref)
717 {
718         struct nfsd4_session *ses;
719         int mem;
720
721         ses = container_of(kref, struct nfsd4_session, se_ref);
722         nfsd4_del_conns(ses);
723         spin_lock(&nfsd_drc_lock);
724         mem = ses->se_fchannel.maxreqs * slot_bytes(&ses->se_fchannel);
725         nfsd_drc_mem_used -= mem;
726         spin_unlock(&nfsd_drc_lock);
727         free_session_slots(ses);
728         kfree(ses);
729 }
730
731 static struct nfsd4_session *alloc_init_session(struct svc_rqst *rqstp, struct nfs4_client *clp, struct nfsd4_create_session *cses)
732 {
733         struct nfsd4_session *new;
734         struct nfsd4_channel_attrs *fchan = &cses->fore_channel;
735         int numslots, slotsize;
736         int status;
737         int idx;
738
739         /*
740          * Note decreasing slot size below client's request may
741          * make it difficult for client to function correctly, whereas
742          * decreasing the number of slots will (just?) affect
743          * performance.  When short on memory we therefore prefer to
744          * decrease number of slots instead of their size.
745          */
746         slotsize = nfsd4_sanitize_slot_size(fchan->maxresp_cached);
747         numslots = nfsd4_get_drc_mem(slotsize, fchan->maxreqs);
748
749         new = alloc_session(slotsize, numslots);
750         if (!new) {
751                 nfsd4_put_drc_mem(slotsize, fchan->maxreqs);
752                 return NULL;
753         }
754         init_forechannel_attrs(&new->se_fchannel, fchan, numslots, slotsize);
755
756         new->se_client = clp;
757         gen_sessionid(new);
758
759         INIT_LIST_HEAD(&new->se_conns);
760
761         new->se_cb_seq_nr = 1;
762         new->se_flags = cses->flags;
763         new->se_cb_prog = cses->callback_prog;
764         kref_init(&new->se_ref);
765         idx = hash_sessionid(&new->se_sessionid);
766         spin_lock(&client_lock);
767         list_add(&new->se_hash, &sessionid_hashtbl[idx]);
768         list_add(&new->se_perclnt, &clp->cl_sessions);
769         spin_unlock(&client_lock);
770
771         status = nfsd4_new_conn(rqstp, new);
772         /* whoops: benny points out, status is ignored! (err, or bogus) */
773         if (status) {
774                 free_session(&new->se_ref);
775                 return NULL;
776         }
777         if (!clp->cl_cb_session && (cses->flags & SESSION4_BACK_CHAN)) {
778                 struct sockaddr *sa = svc_addr(rqstp);
779
780                 clp->cl_cb_session = new;
781                 clp->cl_cb_conn.cb_xprt = rqstp->rq_xprt;
782                 svc_xprt_get(rqstp->rq_xprt);
783                 rpc_copy_addr((struct sockaddr *)&clp->cl_cb_conn.cb_addr, sa);
784                 clp->cl_cb_conn.cb_addrlen = svc_addr_len(sa);
785                 nfsd4_probe_callback(clp);
786         }
787         return new;
788 }
789
790 /* caller must hold client_lock */
791 static struct nfsd4_session *
792 find_in_sessionid_hashtbl(struct nfs4_sessionid *sessionid)
793 {
794         struct nfsd4_session *elem;
795         int idx;
796
797         dump_sessionid(__func__, sessionid);
798         idx = hash_sessionid(sessionid);
799         /* Search in the appropriate list */
800         list_for_each_entry(elem, &sessionid_hashtbl[idx], se_hash) {
801                 if (!memcmp(elem->se_sessionid.data, sessionid->data,
802                             NFS4_MAX_SESSIONID_LEN)) {
803                         return elem;
804                 }
805         }
806
807         dprintk("%s: session not found\n", __func__);
808         return NULL;
809 }
810
811 /* caller must hold client_lock */
812 static void
813 unhash_session(struct nfsd4_session *ses)
814 {
815         list_del(&ses->se_hash);
816         list_del(&ses->se_perclnt);
817 }
818
819 /* must be called under the client_lock */
820 static inline void
821 renew_client_locked(struct nfs4_client *clp)
822 {
823         if (is_client_expired(clp)) {
824                 dprintk("%s: client (clientid %08x/%08x) already expired\n",
825                         __func__,
826                         clp->cl_clientid.cl_boot,
827                         clp->cl_clientid.cl_id);
828                 return;
829         }
830
831         /*
832         * Move client to the end to the LRU list.
833         */
834         dprintk("renewing client (clientid %08x/%08x)\n", 
835                         clp->cl_clientid.cl_boot, 
836                         clp->cl_clientid.cl_id);
837         list_move_tail(&clp->cl_lru, &client_lru);
838         clp->cl_time = get_seconds();
839 }
840
841 static inline void
842 renew_client(struct nfs4_client *clp)
843 {
844         spin_lock(&client_lock);
845         renew_client_locked(clp);
846         spin_unlock(&client_lock);
847 }
848
849 /* SETCLIENTID and SETCLIENTID_CONFIRM Helper functions */
850 static int
851 STALE_CLIENTID(clientid_t *clid)
852 {
853         if (clid->cl_boot == boot_time)
854                 return 0;
855         dprintk("NFSD stale clientid (%08x/%08x) boot_time %08lx\n",
856                 clid->cl_boot, clid->cl_id, boot_time);
857         return 1;
858 }
859
860 /* 
861  * XXX Should we use a slab cache ?
862  * This type of memory management is somewhat inefficient, but we use it
863  * anyway since SETCLIENTID is not a common operation.
864  */
865 static struct nfs4_client *alloc_client(struct xdr_netobj name)
866 {
867         struct nfs4_client *clp;
868
869         clp = kzalloc(sizeof(struct nfs4_client), GFP_KERNEL);
870         if (clp == NULL)
871                 return NULL;
872         clp->cl_name.data = kmalloc(name.len, GFP_KERNEL);
873         if (clp->cl_name.data == NULL) {
874                 kfree(clp);
875                 return NULL;
876         }
877         memcpy(clp->cl_name.data, name.data, name.len);
878         clp->cl_name.len = name.len;
879         return clp;
880 }
881
882 static inline void
883 free_client(struct nfs4_client *clp)
884 {
885         while (!list_empty(&clp->cl_sessions)) {
886                 struct nfsd4_session *ses;
887                 ses = list_entry(clp->cl_sessions.next, struct nfsd4_session,
888                                 se_perclnt);
889                 list_del(&ses->se_perclnt);
890                 nfsd4_put_session(ses);
891         }
892         if (clp->cl_cred.cr_group_info)
893                 put_group_info(clp->cl_cred.cr_group_info);
894         kfree(clp->cl_principal);
895         kfree(clp->cl_name.data);
896         kfree(clp);
897 }
898
899 void
900 release_session_client(struct nfsd4_session *session)
901 {
902         struct nfs4_client *clp = session->se_client;
903
904         if (!atomic_dec_and_lock(&clp->cl_refcount, &client_lock))
905                 return;
906         if (is_client_expired(clp)) {
907                 free_client(clp);
908                 session->se_client = NULL;
909         } else
910                 renew_client_locked(clp);
911         spin_unlock(&client_lock);
912 }
913
914 /* must be called under the client_lock */
915 static inline void
916 unhash_client_locked(struct nfs4_client *clp)
917 {
918         struct nfsd4_session *ses;
919
920         mark_client_expired(clp);
921         list_del(&clp->cl_lru);
922         list_for_each_entry(ses, &clp->cl_sessions, se_perclnt)
923                 list_del_init(&ses->se_hash);
924 }
925
926 static void
927 expire_client(struct nfs4_client *clp)
928 {
929         struct nfs4_stateowner *sop;
930         struct nfs4_delegation *dp;
931         struct list_head reaplist;
932
933         INIT_LIST_HEAD(&reaplist);
934         spin_lock(&recall_lock);
935         while (!list_empty(&clp->cl_delegations)) {
936                 dp = list_entry(clp->cl_delegations.next, struct nfs4_delegation, dl_perclnt);
937                 dprintk("NFSD: expire client. dp %p, fp %p\n", dp,
938                                 dp->dl_flock);
939                 list_del_init(&dp->dl_perclnt);
940                 list_move(&dp->dl_recall_lru, &reaplist);
941         }
942         spin_unlock(&recall_lock);
943         while (!list_empty(&reaplist)) {
944                 dp = list_entry(reaplist.next, struct nfs4_delegation, dl_recall_lru);
945                 list_del_init(&dp->dl_recall_lru);
946                 unhash_delegation(dp);
947         }
948         while (!list_empty(&clp->cl_openowners)) {
949                 sop = list_entry(clp->cl_openowners.next, struct nfs4_stateowner, so_perclient);
950                 release_openowner(sop);
951         }
952         nfsd4_shutdown_callback(clp);
953         if (clp->cl_cb_conn.cb_xprt)
954                 svc_xprt_put(clp->cl_cb_conn.cb_xprt);
955         list_del(&clp->cl_idhash);
956         list_del(&clp->cl_strhash);
957         spin_lock(&client_lock);
958         unhash_client_locked(clp);
959         if (atomic_read(&clp->cl_refcount) == 0)
960                 free_client(clp);
961         spin_unlock(&client_lock);
962 }
963
964 static void copy_verf(struct nfs4_client *target, nfs4_verifier *source)
965 {
966         memcpy(target->cl_verifier.data, source->data,
967                         sizeof(target->cl_verifier.data));
968 }
969
970 static void copy_clid(struct nfs4_client *target, struct nfs4_client *source)
971 {
972         target->cl_clientid.cl_boot = source->cl_clientid.cl_boot; 
973         target->cl_clientid.cl_id = source->cl_clientid.cl_id; 
974 }
975
976 static void copy_cred(struct svc_cred *target, struct svc_cred *source)
977 {
978         target->cr_uid = source->cr_uid;
979         target->cr_gid = source->cr_gid;
980         target->cr_group_info = source->cr_group_info;
981         get_group_info(target->cr_group_info);
982 }
983
984 static int same_name(const char *n1, const char *n2)
985 {
986         return 0 == memcmp(n1, n2, HEXDIR_LEN);
987 }
988
989 static int
990 same_verf(nfs4_verifier *v1, nfs4_verifier *v2)
991 {
992         return 0 == memcmp(v1->data, v2->data, sizeof(v1->data));
993 }
994
995 static int
996 same_clid(clientid_t *cl1, clientid_t *cl2)
997 {
998         return (cl1->cl_boot == cl2->cl_boot) && (cl1->cl_id == cl2->cl_id);
999 }
1000
1001 /* XXX what about NGROUP */
1002 static int
1003 same_creds(struct svc_cred *cr1, struct svc_cred *cr2)
1004 {
1005         return cr1->cr_uid == cr2->cr_uid;
1006 }
1007
1008 static void gen_clid(struct nfs4_client *clp)
1009 {
1010         static u32 current_clientid = 1;
1011
1012         clp->cl_clientid.cl_boot = boot_time;
1013         clp->cl_clientid.cl_id = current_clientid++; 
1014 }
1015
1016 static void gen_confirm(struct nfs4_client *clp)
1017 {
1018         static u32 i;
1019         u32 *p;
1020
1021         p = (u32 *)clp->cl_confirm.data;
1022         *p++ = get_seconds();
1023         *p++ = i++;
1024 }
1025
1026 static struct nfs4_client *create_client(struct xdr_netobj name, char *recdir,
1027                 struct svc_rqst *rqstp, nfs4_verifier *verf)
1028 {
1029         struct nfs4_client *clp;
1030         struct sockaddr *sa = svc_addr(rqstp);
1031         char *princ;
1032
1033         clp = alloc_client(name);
1034         if (clp == NULL)
1035                 return NULL;
1036
1037         INIT_LIST_HEAD(&clp->cl_sessions);
1038
1039         princ = svc_gss_principal(rqstp);
1040         if (princ) {
1041                 clp->cl_principal = kstrdup(princ, GFP_KERNEL);
1042                 if (clp->cl_principal == NULL) {
1043                         free_client(clp);
1044                         return NULL;
1045                 }
1046         }
1047
1048         memcpy(clp->cl_recdir, recdir, HEXDIR_LEN);
1049         atomic_set(&clp->cl_refcount, 0);
1050         atomic_set(&clp->cl_cb_set, 0);
1051         INIT_LIST_HEAD(&clp->cl_idhash);
1052         INIT_LIST_HEAD(&clp->cl_strhash);
1053         INIT_LIST_HEAD(&clp->cl_openowners);
1054         INIT_LIST_HEAD(&clp->cl_delegations);
1055         INIT_LIST_HEAD(&clp->cl_lru);
1056         spin_lock_init(&clp->cl_lock);
1057         INIT_WORK(&clp->cl_cb_null.cb_work, nfsd4_do_callback_rpc);
1058         clp->cl_time = get_seconds();
1059         clear_bit(0, &clp->cl_cb_slot_busy);
1060         rpc_init_wait_queue(&clp->cl_cb_waitq, "Backchannel slot table");
1061         copy_verf(clp, verf);
1062         rpc_copy_addr((struct sockaddr *) &clp->cl_addr, sa);
1063         clp->cl_flavor = rqstp->rq_flavor;
1064         copy_cred(&clp->cl_cred, &rqstp->rq_cred);
1065         gen_confirm(clp);
1066         clp->cl_cb_session = NULL;
1067         return clp;
1068 }
1069
1070 static int check_name(struct xdr_netobj name)
1071 {
1072         if (name.len == 0) 
1073                 return 0;
1074         if (name.len > NFS4_OPAQUE_LIMIT) {
1075                 dprintk("NFSD: check_name: name too long(%d)!\n", name.len);
1076                 return 0;
1077         }
1078         return 1;
1079 }
1080
1081 static void
1082 add_to_unconfirmed(struct nfs4_client *clp, unsigned int strhashval)
1083 {
1084         unsigned int idhashval;
1085
1086         list_add(&clp->cl_strhash, &unconf_str_hashtbl[strhashval]);
1087         idhashval = clientid_hashval(clp->cl_clientid.cl_id);
1088         list_add(&clp->cl_idhash, &unconf_id_hashtbl[idhashval]);
1089         renew_client(clp);
1090 }
1091
1092 static void
1093 move_to_confirmed(struct nfs4_client *clp)
1094 {
1095         unsigned int idhashval = clientid_hashval(clp->cl_clientid.cl_id);
1096         unsigned int strhashval;
1097
1098         dprintk("NFSD: move_to_confirm nfs4_client %p\n", clp);
1099         list_move(&clp->cl_idhash, &conf_id_hashtbl[idhashval]);
1100         strhashval = clientstr_hashval(clp->cl_recdir);
1101         list_move(&clp->cl_strhash, &conf_str_hashtbl[strhashval]);
1102         renew_client(clp);
1103 }
1104
1105 static struct nfs4_client *
1106 find_confirmed_client(clientid_t *clid)
1107 {
1108         struct nfs4_client *clp;
1109         unsigned int idhashval = clientid_hashval(clid->cl_id);
1110
1111         list_for_each_entry(clp, &conf_id_hashtbl[idhashval], cl_idhash) {
1112                 if (same_clid(&clp->cl_clientid, clid))
1113                         return clp;
1114         }
1115         return NULL;
1116 }
1117
1118 static struct nfs4_client *
1119 find_unconfirmed_client(clientid_t *clid)
1120 {
1121         struct nfs4_client *clp;
1122         unsigned int idhashval = clientid_hashval(clid->cl_id);
1123
1124         list_for_each_entry(clp, &unconf_id_hashtbl[idhashval], cl_idhash) {
1125                 if (same_clid(&clp->cl_clientid, clid))
1126                         return clp;
1127         }
1128         return NULL;
1129 }
1130
1131 /*
1132  * Return 1 iff clp's clientid establishment method matches the use_exchange_id
1133  * parameter. Matching is based on the fact the at least one of the
1134  * EXCHGID4_FLAG_USE_{NON_PNFS,PNFS_MDS,PNFS_DS} flags must be set for v4.1
1135  *
1136  * FIXME: we need to unify the clientid namespaces for nfsv4.x
1137  * and correctly deal with client upgrade/downgrade in EXCHANGE_ID
1138  * and SET_CLIENTID{,_CONFIRM}
1139  */
1140 static inline int
1141 match_clientid_establishment(struct nfs4_client *clp, bool use_exchange_id)
1142 {
1143         bool has_exchange_flags = (clp->cl_exchange_flags != 0);
1144         return use_exchange_id == has_exchange_flags;
1145 }
1146
1147 static struct nfs4_client *
1148 find_confirmed_client_by_str(const char *dname, unsigned int hashval,
1149                              bool use_exchange_id)
1150 {
1151         struct nfs4_client *clp;
1152
1153         list_for_each_entry(clp, &conf_str_hashtbl[hashval], cl_strhash) {
1154                 if (same_name(clp->cl_recdir, dname) &&
1155                     match_clientid_establishment(clp, use_exchange_id))
1156                         return clp;
1157         }
1158         return NULL;
1159 }
1160
1161 static struct nfs4_client *
1162 find_unconfirmed_client_by_str(const char *dname, unsigned int hashval,
1163                                bool use_exchange_id)
1164 {
1165         struct nfs4_client *clp;
1166
1167         list_for_each_entry(clp, &unconf_str_hashtbl[hashval], cl_strhash) {
1168                 if (same_name(clp->cl_recdir, dname) &&
1169                     match_clientid_establishment(clp, use_exchange_id))
1170                         return clp;
1171         }
1172         return NULL;
1173 }
1174
1175 static void
1176 gen_callback(struct nfs4_client *clp, struct nfsd4_setclientid *se, u32 scopeid)
1177 {
1178         struct nfs4_cb_conn *conn = &clp->cl_cb_conn;
1179         unsigned short expected_family;
1180
1181         /* Currently, we only support tcp and tcp6 for the callback channel */
1182         if (se->se_callback_netid_len == 3 &&
1183             !memcmp(se->se_callback_netid_val, "tcp", 3))
1184                 expected_family = AF_INET;
1185         else if (se->se_callback_netid_len == 4 &&
1186                  !memcmp(se->se_callback_netid_val, "tcp6", 4))
1187                 expected_family = AF_INET6;
1188         else
1189                 goto out_err;
1190
1191         conn->cb_addrlen = rpc_uaddr2sockaddr(se->se_callback_addr_val,
1192                                             se->se_callback_addr_len,
1193                                             (struct sockaddr *)&conn->cb_addr,
1194                                             sizeof(conn->cb_addr));
1195
1196         if (!conn->cb_addrlen || conn->cb_addr.ss_family != expected_family)
1197                 goto out_err;
1198
1199         if (conn->cb_addr.ss_family == AF_INET6)
1200                 ((struct sockaddr_in6 *)&conn->cb_addr)->sin6_scope_id = scopeid;
1201
1202         conn->cb_prog = se->se_callback_prog;
1203         conn->cb_ident = se->se_callback_ident;
1204         return;
1205 out_err:
1206         conn->cb_addr.ss_family = AF_UNSPEC;
1207         conn->cb_addrlen = 0;
1208         dprintk(KERN_INFO "NFSD: this client (clientid %08x/%08x) "
1209                 "will not receive delegations\n",
1210                 clp->cl_clientid.cl_boot, clp->cl_clientid.cl_id);
1211
1212         return;
1213 }
1214
1215 /*
1216  * Cache a reply. nfsd4_check_drc_limit() has bounded the cache size.
1217  */
1218 void
1219 nfsd4_store_cache_entry(struct nfsd4_compoundres *resp)
1220 {
1221         struct nfsd4_slot *slot = resp->cstate.slot;
1222         unsigned int base;
1223
1224         dprintk("--> %s slot %p\n", __func__, slot);
1225
1226         slot->sl_opcnt = resp->opcnt;
1227         slot->sl_status = resp->cstate.status;
1228
1229         if (nfsd4_not_cached(resp)) {
1230                 slot->sl_datalen = 0;
1231                 return;
1232         }
1233         slot->sl_datalen = (char *)resp->p - (char *)resp->cstate.datap;
1234         base = (char *)resp->cstate.datap -
1235                                         (char *)resp->xbuf->head[0].iov_base;
1236         if (read_bytes_from_xdr_buf(resp->xbuf, base, slot->sl_data,
1237                                     slot->sl_datalen))
1238                 WARN("%s: sessions DRC could not cache compound\n", __func__);
1239         return;
1240 }
1241
1242 /*
1243  * Encode the replay sequence operation from the slot values.
1244  * If cachethis is FALSE encode the uncached rep error on the next
1245  * operation which sets resp->p and increments resp->opcnt for
1246  * nfs4svc_encode_compoundres.
1247  *
1248  */
1249 static __be32
1250 nfsd4_enc_sequence_replay(struct nfsd4_compoundargs *args,
1251                           struct nfsd4_compoundres *resp)
1252 {
1253         struct nfsd4_op *op;
1254         struct nfsd4_slot *slot = resp->cstate.slot;
1255
1256         dprintk("--> %s resp->opcnt %d cachethis %u \n", __func__,
1257                 resp->opcnt, resp->cstate.slot->sl_cachethis);
1258
1259         /* Encode the replayed sequence operation */
1260         op = &args->ops[resp->opcnt - 1];
1261         nfsd4_encode_operation(resp, op);
1262
1263         /* Return nfserr_retry_uncached_rep in next operation. */
1264         if (args->opcnt > 1 && slot->sl_cachethis == 0) {
1265                 op = &args->ops[resp->opcnt++];
1266                 op->status = nfserr_retry_uncached_rep;
1267                 nfsd4_encode_operation(resp, op);
1268         }
1269         return op->status;
1270 }
1271
1272 /*
1273  * The sequence operation is not cached because we can use the slot and
1274  * session values.
1275  */
1276 __be32
1277 nfsd4_replay_cache_entry(struct nfsd4_compoundres *resp,
1278                          struct nfsd4_sequence *seq)
1279 {
1280         struct nfsd4_slot *slot = resp->cstate.slot;
1281         __be32 status;
1282
1283         dprintk("--> %s slot %p\n", __func__, slot);
1284
1285         /* Either returns 0 or nfserr_retry_uncached */
1286         status = nfsd4_enc_sequence_replay(resp->rqstp->rq_argp, resp);
1287         if (status == nfserr_retry_uncached_rep)
1288                 return status;
1289
1290         /* The sequence operation has been encoded, cstate->datap set. */
1291         memcpy(resp->cstate.datap, slot->sl_data, slot->sl_datalen);
1292
1293         resp->opcnt = slot->sl_opcnt;
1294         resp->p = resp->cstate.datap + XDR_QUADLEN(slot->sl_datalen);
1295         status = slot->sl_status;
1296
1297         return status;
1298 }
1299
1300 /*
1301  * Set the exchange_id flags returned by the server.
1302  */
1303 static void
1304 nfsd4_set_ex_flags(struct nfs4_client *new, struct nfsd4_exchange_id *clid)
1305 {
1306         /* pNFS is not supported */
1307         new->cl_exchange_flags |= EXCHGID4_FLAG_USE_NON_PNFS;
1308
1309         /* Referrals are supported, Migration is not. */
1310         new->cl_exchange_flags |= EXCHGID4_FLAG_SUPP_MOVED_REFER;
1311
1312         /* set the wire flags to return to client. */
1313         clid->flags = new->cl_exchange_flags;
1314 }
1315
1316 __be32
1317 nfsd4_exchange_id(struct svc_rqst *rqstp,
1318                   struct nfsd4_compound_state *cstate,
1319                   struct nfsd4_exchange_id *exid)
1320 {
1321         struct nfs4_client *unconf, *conf, *new;
1322         int status;
1323         unsigned int            strhashval;
1324         char                    dname[HEXDIR_LEN];
1325         char                    addr_str[INET6_ADDRSTRLEN];
1326         nfs4_verifier           verf = exid->verifier;
1327         struct sockaddr         *sa = svc_addr(rqstp);
1328
1329         rpc_ntop(sa, addr_str, sizeof(addr_str));
1330         dprintk("%s rqstp=%p exid=%p clname.len=%u clname.data=%p "
1331                 "ip_addr=%s flags %x, spa_how %d\n",
1332                 __func__, rqstp, exid, exid->clname.len, exid->clname.data,
1333                 addr_str, exid->flags, exid->spa_how);
1334
1335         if (!check_name(exid->clname) || (exid->flags & ~EXCHGID4_FLAG_MASK_A))
1336                 return nfserr_inval;
1337
1338         /* Currently only support SP4_NONE */
1339         switch (exid->spa_how) {
1340         case SP4_NONE:
1341                 break;
1342         case SP4_SSV:
1343                 return nfserr_encr_alg_unsupp;
1344         default:
1345                 BUG();                          /* checked by xdr code */
1346         case SP4_MACH_CRED:
1347                 return nfserr_serverfault;      /* no excuse :-/ */
1348         }
1349
1350         status = nfs4_make_rec_clidname(dname, &exid->clname);
1351
1352         if (status)
1353                 goto error;
1354
1355         strhashval = clientstr_hashval(dname);
1356
1357         nfs4_lock_state();
1358         status = nfs_ok;
1359
1360         conf = find_confirmed_client_by_str(dname, strhashval, true);
1361         if (conf) {
1362                 if (!same_verf(&verf, &conf->cl_verifier)) {
1363                         /* 18.35.4 case 8 */
1364                         if (exid->flags & EXCHGID4_FLAG_UPD_CONFIRMED_REC_A) {
1365                                 status = nfserr_not_same;
1366                                 goto out;
1367                         }
1368                         /* Client reboot: destroy old state */
1369                         expire_client(conf);
1370                         goto out_new;
1371                 }
1372                 if (!same_creds(&conf->cl_cred, &rqstp->rq_cred)) {
1373                         /* 18.35.4 case 9 */
1374                         if (exid->flags & EXCHGID4_FLAG_UPD_CONFIRMED_REC_A) {
1375                                 status = nfserr_perm;
1376                                 goto out;
1377                         }
1378                         expire_client(conf);
1379                         goto out_new;
1380                 }
1381                 /*
1382                  * Set bit when the owner id and verifier map to an already
1383                  * confirmed client id (18.35.3).
1384                  */
1385                 exid->flags |= EXCHGID4_FLAG_CONFIRMED_R;
1386
1387                 /*
1388                  * Falling into 18.35.4 case 2, possible router replay.
1389                  * Leave confirmed record intact and return same result.
1390                  */
1391                 copy_verf(conf, &verf);
1392                 new = conf;
1393                 goto out_copy;
1394         }
1395
1396         /* 18.35.4 case 7 */
1397         if (exid->flags & EXCHGID4_FLAG_UPD_CONFIRMED_REC_A) {
1398                 status = nfserr_noent;
1399                 goto out;
1400         }
1401
1402         unconf  = find_unconfirmed_client_by_str(dname, strhashval, true);
1403         if (unconf) {
1404                 /*
1405                  * Possible retry or client restart.  Per 18.35.4 case 4,
1406                  * a new unconfirmed record should be generated regardless
1407                  * of whether any properties have changed.
1408                  */
1409                 expire_client(unconf);
1410         }
1411
1412 out_new:
1413         /* Normal case */
1414         new = create_client(exid->clname, dname, rqstp, &verf);
1415         if (new == NULL) {
1416                 status = nfserr_jukebox;
1417                 goto out;
1418         }
1419
1420         gen_clid(new);
1421         add_to_unconfirmed(new, strhashval);
1422 out_copy:
1423         exid->clientid.cl_boot = new->cl_clientid.cl_boot;
1424         exid->clientid.cl_id = new->cl_clientid.cl_id;
1425
1426         exid->seqid = 1;
1427         nfsd4_set_ex_flags(new, exid);
1428
1429         dprintk("nfsd4_exchange_id seqid %d flags %x\n",
1430                 new->cl_cs_slot.sl_seqid, new->cl_exchange_flags);
1431         status = nfs_ok;
1432
1433 out:
1434         nfs4_unlock_state();
1435 error:
1436         dprintk("nfsd4_exchange_id returns %d\n", ntohl(status));
1437         return status;
1438 }
1439
1440 static int
1441 check_slot_seqid(u32 seqid, u32 slot_seqid, int slot_inuse)
1442 {
1443         dprintk("%s enter. seqid %d slot_seqid %d\n", __func__, seqid,
1444                 slot_seqid);
1445
1446         /* The slot is in use, and no response has been sent. */
1447         if (slot_inuse) {
1448                 if (seqid == slot_seqid)
1449                         return nfserr_jukebox;
1450                 else
1451                         return nfserr_seq_misordered;
1452         }
1453         /* Normal */
1454         if (likely(seqid == slot_seqid + 1))
1455                 return nfs_ok;
1456         /* Replay */
1457         if (seqid == slot_seqid)
1458                 return nfserr_replay_cache;
1459         /* Wraparound */
1460         if (seqid == 1 && (slot_seqid + 1) == 0)
1461                 return nfs_ok;
1462         /* Misordered replay or misordered new request */
1463         return nfserr_seq_misordered;
1464 }
1465
1466 /*
1467  * Cache the create session result into the create session single DRC
1468  * slot cache by saving the xdr structure. sl_seqid has been set.
1469  * Do this for solo or embedded create session operations.
1470  */
1471 static void
1472 nfsd4_cache_create_session(struct nfsd4_create_session *cr_ses,
1473                            struct nfsd4_clid_slot *slot, int nfserr)
1474 {
1475         slot->sl_status = nfserr;
1476         memcpy(&slot->sl_cr_ses, cr_ses, sizeof(*cr_ses));
1477 }
1478
1479 static __be32
1480 nfsd4_replay_create_session(struct nfsd4_create_session *cr_ses,
1481                             struct nfsd4_clid_slot *slot)
1482 {
1483         memcpy(cr_ses, &slot->sl_cr_ses, sizeof(*cr_ses));
1484         return slot->sl_status;
1485 }
1486
1487 __be32
1488 nfsd4_create_session(struct svc_rqst *rqstp,
1489                      struct nfsd4_compound_state *cstate,
1490                      struct nfsd4_create_session *cr_ses)
1491 {
1492         struct sockaddr *sa = svc_addr(rqstp);
1493         struct nfs4_client *conf, *unconf;
1494         struct nfsd4_session *new;
1495         struct nfsd4_clid_slot *cs_slot = NULL;
1496         bool confirm_me = false;
1497         int status = 0;
1498
1499         nfs4_lock_state();
1500         unconf = find_unconfirmed_client(&cr_ses->clientid);
1501         conf = find_confirmed_client(&cr_ses->clientid);
1502
1503         if (conf) {
1504                 cs_slot = &conf->cl_cs_slot;
1505                 status = check_slot_seqid(cr_ses->seqid, cs_slot->sl_seqid, 0);
1506                 if (status == nfserr_replay_cache) {
1507                         dprintk("Got a create_session replay! seqid= %d\n",
1508                                 cs_slot->sl_seqid);
1509                         /* Return the cached reply status */
1510                         status = nfsd4_replay_create_session(cr_ses, cs_slot);
1511                         goto out;
1512                 } else if (cr_ses->seqid != cs_slot->sl_seqid + 1) {
1513                         status = nfserr_seq_misordered;
1514                         dprintk("Sequence misordered!\n");
1515                         dprintk("Expected seqid= %d but got seqid= %d\n",
1516                                 cs_slot->sl_seqid, cr_ses->seqid);
1517                         goto out;
1518                 }
1519         } else if (unconf) {
1520                 if (!same_creds(&unconf->cl_cred, &rqstp->rq_cred) ||
1521                     !rpc_cmp_addr(sa, (struct sockaddr *) &unconf->cl_addr)) {
1522                         status = nfserr_clid_inuse;
1523                         goto out;
1524                 }
1525
1526                 cs_slot = &unconf->cl_cs_slot;
1527                 status = check_slot_seqid(cr_ses->seqid, cs_slot->sl_seqid, 0);
1528                 if (status) {
1529                         /* an unconfirmed replay returns misordered */
1530                         status = nfserr_seq_misordered;
1531                         goto out;
1532                 }
1533
1534                 confirm_me = true;
1535                 conf = unconf;
1536         } else {
1537                 status = nfserr_stale_clientid;
1538                 goto out;
1539         }
1540
1541         /*
1542          * XXX: we should probably set this at creation time, and check
1543          * for consistent minorversion use throughout:
1544          */
1545         conf->cl_minorversion = 1;
1546         /*
1547          * We do not support RDMA or persistent sessions
1548          */
1549         cr_ses->flags &= ~SESSION4_PERSIST;
1550         cr_ses->flags &= ~SESSION4_RDMA;
1551
1552         status = nfserr_jukebox;
1553         new = alloc_init_session(rqstp, conf, cr_ses);
1554         if (!new)
1555                 goto out;
1556         status = nfs_ok;
1557         memcpy(cr_ses->sessionid.data, new->se_sessionid.data,
1558                NFS4_MAX_SESSIONID_LEN);
1559         cs_slot->sl_seqid++;
1560         cr_ses->seqid = cs_slot->sl_seqid;
1561
1562         /* cache solo and embedded create sessions under the state lock */
1563         nfsd4_cache_create_session(cr_ses, cs_slot, status);
1564         if (confirm_me)
1565                 move_to_confirmed(conf);
1566 out:
1567         nfs4_unlock_state();
1568         dprintk("%s returns %d\n", __func__, ntohl(status));
1569         return status;
1570 }
1571
1572 static bool nfsd4_last_compound_op(struct svc_rqst *rqstp)
1573 {
1574         struct nfsd4_compoundres *resp = rqstp->rq_resp;
1575         struct nfsd4_compoundargs *argp = rqstp->rq_argp;
1576
1577         return argp->opcnt == resp->opcnt;
1578 }
1579
1580 static bool nfsd4_compound_in_session(struct nfsd4_session *session, struct nfs4_sessionid *sid)
1581 {
1582         if (!session)
1583                 return 0;
1584         return !memcmp(sid, &session->se_sessionid, sizeof(*sid));
1585 }
1586
1587 __be32
1588 nfsd4_destroy_session(struct svc_rqst *r,
1589                       struct nfsd4_compound_state *cstate,
1590                       struct nfsd4_destroy_session *sessionid)
1591 {
1592         struct nfsd4_session *ses;
1593         u32 status = nfserr_badsession;
1594
1595         /* Notes:
1596          * - The confirmed nfs4_client->cl_sessionid holds destroyed sessinid
1597          * - Should we return nfserr_back_chan_busy if waiting for
1598          *   callbacks on to-be-destroyed session?
1599          * - Do we need to clear any callback info from previous session?
1600          */
1601
1602         if (nfsd4_compound_in_session(cstate->session, &sessionid->sessionid)) {
1603                 if (!nfsd4_last_compound_op(r))
1604                         return nfserr_not_only_op;
1605         }
1606         dump_sessionid(__func__, &sessionid->sessionid);
1607         spin_lock(&client_lock);
1608         ses = find_in_sessionid_hashtbl(&sessionid->sessionid);
1609         if (!ses) {
1610                 spin_unlock(&client_lock);
1611                 goto out;
1612         }
1613
1614         unhash_session(ses);
1615         spin_unlock(&client_lock);
1616
1617         nfs4_lock_state();
1618         /* wait for callbacks */
1619         nfsd4_shutdown_callback(ses->se_client);
1620         nfs4_unlock_state();
1621
1622         nfsd4_del_conns(ses);
1623
1624         nfsd4_put_session(ses);
1625         status = nfs_ok;
1626 out:
1627         dprintk("%s returns %d\n", __func__, ntohl(status));
1628         return status;
1629 }
1630
1631 static struct nfsd4_conn *__nfsd4_find_conn(struct svc_xprt *xpt, struct nfsd4_session *s)
1632 {
1633         struct nfsd4_conn *c;
1634
1635         list_for_each_entry(c, &s->se_conns, cn_persession) {
1636                 if (c->cn_xprt == xpt) {
1637                         return c;
1638                 }
1639         }
1640         return NULL;
1641 }
1642
1643 static void nfsd4_sequence_check_conn(struct nfsd4_conn *new, struct nfsd4_session *ses)
1644 {
1645         struct nfs4_client *clp = ses->se_client;
1646         struct nfsd4_conn *c;
1647
1648         spin_lock(&clp->cl_lock);
1649         c = __nfsd4_find_conn(new->cn_xprt, ses);
1650         if (c) {
1651                 spin_unlock(&clp->cl_lock);
1652                 free_conn(new);
1653                 return;
1654         }
1655         __nfsd4_hash_conn(new, ses);
1656         spin_unlock(&clp->cl_lock);
1657         nfsd4_register_conn(new);
1658         return;
1659 }
1660
1661 __be32
1662 nfsd4_sequence(struct svc_rqst *rqstp,
1663                struct nfsd4_compound_state *cstate,
1664                struct nfsd4_sequence *seq)
1665 {
1666         struct nfsd4_compoundres *resp = rqstp->rq_resp;
1667         struct nfsd4_session *session;
1668         struct nfsd4_slot *slot;
1669         struct nfsd4_conn *conn;
1670         int status;
1671
1672         if (resp->opcnt != 1)
1673                 return nfserr_sequence_pos;
1674
1675         /*
1676          * Will be either used or freed by nfsd4_sequence_check_conn
1677          * below.
1678          */
1679         conn = alloc_conn(rqstp, NFS4_CDFC4_FORE);
1680         if (!conn)
1681                 return nfserr_jukebox;
1682
1683         spin_lock(&client_lock);
1684         status = nfserr_badsession;
1685         session = find_in_sessionid_hashtbl(&seq->sessionid);
1686         if (!session)
1687                 goto out;
1688
1689         status = nfserr_badslot;
1690         if (seq->slotid >= session->se_fchannel.maxreqs)
1691                 goto out;
1692
1693         slot = session->se_slots[seq->slotid];
1694         dprintk("%s: slotid %d\n", __func__, seq->slotid);
1695
1696         /* We do not negotiate the number of slots yet, so set the
1697          * maxslots to the session maxreqs which is used to encode
1698          * sr_highest_slotid and the sr_target_slot id to maxslots */
1699         seq->maxslots = session->se_fchannel.maxreqs;
1700
1701         status = check_slot_seqid(seq->seqid, slot->sl_seqid, slot->sl_inuse);
1702         if (status == nfserr_replay_cache) {
1703                 cstate->slot = slot;
1704                 cstate->session = session;
1705                 /* Return the cached reply status and set cstate->status
1706                  * for nfsd4_proc_compound processing */
1707                 status = nfsd4_replay_cache_entry(resp, seq);
1708                 cstate->status = nfserr_replay_cache;
1709                 goto out;
1710         }
1711         if (status)
1712                 goto out;
1713
1714         nfsd4_sequence_check_conn(conn, session);
1715         conn = NULL;
1716
1717         /* Success! bump slot seqid */
1718         slot->sl_inuse = true;
1719         slot->sl_seqid = seq->seqid;
1720         slot->sl_cachethis = seq->cachethis;
1721
1722         cstate->slot = slot;
1723         cstate->session = session;
1724
1725 out:
1726         /* Hold a session reference until done processing the compound. */
1727         if (cstate->session) {
1728                 nfsd4_get_session(cstate->session);
1729                 atomic_inc(&session->se_client->cl_refcount);
1730         }
1731         kfree(conn);
1732         spin_unlock(&client_lock);
1733         dprintk("%s: return %d\n", __func__, ntohl(status));
1734         return status;
1735 }
1736
1737 __be32
1738 nfsd4_reclaim_complete(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, struct nfsd4_reclaim_complete *rc)
1739 {
1740         if (rc->rca_one_fs) {
1741                 if (!cstate->current_fh.fh_dentry)
1742                         return nfserr_nofilehandle;
1743                 /*
1744                  * We don't take advantage of the rca_one_fs case.
1745                  * That's OK, it's optional, we can safely ignore it.
1746                  */
1747                  return nfs_ok;
1748         }
1749         nfs4_lock_state();
1750         if (is_client_expired(cstate->session->se_client)) {
1751                 nfs4_unlock_state();
1752                 /*
1753                  * The following error isn't really legal.
1754                  * But we only get here if the client just explicitly
1755                  * destroyed the client.  Surely it no longer cares what
1756                  * error it gets back on an operation for the dead
1757                  * client.
1758                  */
1759                 return nfserr_stale_clientid;
1760         }
1761         nfsd4_create_clid_dir(cstate->session->se_client);
1762         nfs4_unlock_state();
1763         return nfs_ok;
1764 }
1765
1766 __be32
1767 nfsd4_setclientid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
1768                   struct nfsd4_setclientid *setclid)
1769 {
1770         struct sockaddr         *sa = svc_addr(rqstp);
1771         struct xdr_netobj       clname = { 
1772                 .len = setclid->se_namelen,
1773                 .data = setclid->se_name,
1774         };
1775         nfs4_verifier           clverifier = setclid->se_verf;
1776         unsigned int            strhashval;
1777         struct nfs4_client      *conf, *unconf, *new;
1778         __be32                  status;
1779         char                    dname[HEXDIR_LEN];
1780         
1781         if (!check_name(clname))
1782                 return nfserr_inval;
1783
1784         status = nfs4_make_rec_clidname(dname, &clname);
1785         if (status)
1786                 return status;
1787
1788         /* 
1789          * XXX The Duplicate Request Cache (DRC) has been checked (??)
1790          * We get here on a DRC miss.
1791          */
1792
1793         strhashval = clientstr_hashval(dname);
1794
1795         nfs4_lock_state();
1796         conf = find_confirmed_client_by_str(dname, strhashval, false);
1797         if (conf) {
1798                 /* RFC 3530 14.2.33 CASE 0: */
1799                 status = nfserr_clid_inuse;
1800                 if (!same_creds(&conf->cl_cred, &rqstp->rq_cred)) {
1801                         char addr_str[INET6_ADDRSTRLEN];
1802                         rpc_ntop((struct sockaddr *) &conf->cl_addr, addr_str,
1803                                  sizeof(addr_str));
1804                         dprintk("NFSD: setclientid: string in use by client "
1805                                 "at %s\n", addr_str);
1806                         goto out;
1807                 }
1808         }
1809         /*
1810          * section 14.2.33 of RFC 3530 (under the heading "IMPLEMENTATION")
1811          * has a description of SETCLIENTID request processing consisting
1812          * of 5 bullet points, labeled as CASE0 - CASE4 below.
1813          */
1814         unconf = find_unconfirmed_client_by_str(dname, strhashval, false);
1815         status = nfserr_resource;
1816         if (!conf) {
1817                 /*
1818                  * RFC 3530 14.2.33 CASE 4:
1819                  * placed first, because it is the normal case
1820                  */
1821                 if (unconf)
1822                         expire_client(unconf);
1823                 new = create_client(clname, dname, rqstp, &clverifier);
1824                 if (new == NULL)
1825                         goto out;
1826                 gen_clid(new);
1827         } else if (same_verf(&conf->cl_verifier, &clverifier)) {
1828                 /*
1829                  * RFC 3530 14.2.33 CASE 1:
1830                  * probable callback update
1831                  */
1832                 if (unconf) {
1833                         /* Note this is removing unconfirmed {*x***},
1834                          * which is stronger than RFC recommended {vxc**}.
1835                          * This has the advantage that there is at most
1836                          * one {*x***} in either list at any time.
1837                          */
1838                         expire_client(unconf);
1839                 }
1840                 new = create_client(clname, dname, rqstp, &clverifier);
1841                 if (new == NULL)
1842                         goto out;
1843                 copy_clid(new, conf);
1844         } else if (!unconf) {
1845                 /*
1846                  * RFC 3530 14.2.33 CASE 2:
1847                  * probable client reboot; state will be removed if
1848                  * confirmed.
1849                  */
1850                 new = create_client(clname, dname, rqstp, &clverifier);
1851                 if (new == NULL)
1852                         goto out;
1853                 gen_clid(new);
1854         } else {
1855                 /*
1856                  * RFC 3530 14.2.33 CASE 3:
1857                  * probable client reboot; state will be removed if
1858                  * confirmed.
1859                  */
1860                 expire_client(unconf);
1861                 new = create_client(clname, dname, rqstp, &clverifier);
1862                 if (new == NULL)
1863                         goto out;
1864                 gen_clid(new);
1865         }
1866         /*
1867          * XXX: we should probably set this at creation time, and check
1868          * for consistent minorversion use throughout:
1869          */
1870         new->cl_minorversion = 0;
1871         gen_callback(new, setclid, rpc_get_scope_id(sa));
1872         add_to_unconfirmed(new, strhashval);
1873         setclid->se_clientid.cl_boot = new->cl_clientid.cl_boot;
1874         setclid->se_clientid.cl_id = new->cl_clientid.cl_id;
1875         memcpy(setclid->se_confirm.data, new->cl_confirm.data, sizeof(setclid->se_confirm.data));
1876         status = nfs_ok;
1877 out:
1878         nfs4_unlock_state();
1879         return status;
1880 }
1881
1882
1883 /*
1884  * Section 14.2.34 of RFC 3530 (under the heading "IMPLEMENTATION") has
1885  * a description of SETCLIENTID_CONFIRM request processing consisting of 4
1886  * bullets, labeled as CASE1 - CASE4 below.
1887  */
1888 __be32
1889 nfsd4_setclientid_confirm(struct svc_rqst *rqstp,
1890                          struct nfsd4_compound_state *cstate,
1891                          struct nfsd4_setclientid_confirm *setclientid_confirm)
1892 {
1893         struct sockaddr *sa = svc_addr(rqstp);
1894         struct nfs4_client *conf, *unconf;
1895         nfs4_verifier confirm = setclientid_confirm->sc_confirm; 
1896         clientid_t * clid = &setclientid_confirm->sc_clientid;
1897         __be32 status;
1898
1899         if (STALE_CLIENTID(clid))
1900                 return nfserr_stale_clientid;
1901         /* 
1902          * XXX The Duplicate Request Cache (DRC) has been checked (??)
1903          * We get here on a DRC miss.
1904          */
1905
1906         nfs4_lock_state();
1907
1908         conf = find_confirmed_client(clid);
1909         unconf = find_unconfirmed_client(clid);
1910
1911         status = nfserr_clid_inuse;
1912         if (conf && !rpc_cmp_addr((struct sockaddr *) &conf->cl_addr, sa))
1913                 goto out;
1914         if (unconf && !rpc_cmp_addr((struct sockaddr *) &unconf->cl_addr, sa))
1915                 goto out;
1916
1917         /*
1918          * section 14.2.34 of RFC 3530 has a description of
1919          * SETCLIENTID_CONFIRM request processing consisting
1920          * of 4 bullet points, labeled as CASE1 - CASE4 below.
1921          */
1922         if (conf && unconf && same_verf(&confirm, &unconf->cl_confirm)) {
1923                 /*
1924                  * RFC 3530 14.2.34 CASE 1:
1925                  * callback update
1926                  */
1927                 if (!same_creds(&conf->cl_cred, &unconf->cl_cred))
1928                         status = nfserr_clid_inuse;
1929                 else {
1930                         atomic_set(&conf->cl_cb_set, 0);
1931                         nfsd4_change_callback(conf, &unconf->cl_cb_conn);
1932                         nfsd4_probe_callback(conf);
1933                         expire_client(unconf);
1934                         status = nfs_ok;
1935
1936                 }
1937         } else if (conf && !unconf) {
1938                 /*
1939                  * RFC 3530 14.2.34 CASE 2:
1940                  * probable retransmitted request; play it safe and
1941                  * do nothing.
1942                  */
1943                 if (!same_creds(&conf->cl_cred, &rqstp->rq_cred))
1944                         status = nfserr_clid_inuse;
1945                 else
1946                         status = nfs_ok;
1947         } else if (!conf && unconf
1948                         && same_verf(&unconf->cl_confirm, &confirm)) {
1949                 /*
1950                  * RFC 3530 14.2.34 CASE 3:
1951                  * Normal case; new or rebooted client:
1952                  */
1953                 if (!same_creds(&unconf->cl_cred, &rqstp->rq_cred)) {
1954                         status = nfserr_clid_inuse;
1955                 } else {
1956                         unsigned int hash =
1957                                 clientstr_hashval(unconf->cl_recdir);
1958                         conf = find_confirmed_client_by_str(unconf->cl_recdir,
1959                                                             hash, false);
1960                         if (conf) {
1961                                 nfsd4_remove_clid_dir(conf);
1962                                 expire_client(conf);
1963                         }
1964                         move_to_confirmed(unconf);
1965                         conf = unconf;
1966                         nfsd4_probe_callback(conf);
1967                         status = nfs_ok;
1968                 }
1969         } else if ((!conf || (conf && !same_verf(&conf->cl_confirm, &confirm)))
1970             && (!unconf || (unconf && !same_verf(&unconf->cl_confirm,
1971                                                                 &confirm)))) {
1972                 /*
1973                  * RFC 3530 14.2.34 CASE 4:
1974                  * Client probably hasn't noticed that we rebooted yet.
1975                  */
1976                 status = nfserr_stale_clientid;
1977         } else {
1978                 /* check that we have hit one of the cases...*/
1979                 status = nfserr_clid_inuse;
1980         }
1981 out:
1982         nfs4_unlock_state();
1983         return status;
1984 }
1985
1986 /* OPEN Share state helper functions */
1987 static inline struct nfs4_file *
1988 alloc_init_file(struct inode *ino)
1989 {
1990         struct nfs4_file *fp;
1991         unsigned int hashval = file_hashval(ino);
1992
1993         fp = kmem_cache_alloc(file_slab, GFP_KERNEL);
1994         if (fp) {
1995                 atomic_set(&fp->fi_ref, 1);
1996                 INIT_LIST_HEAD(&fp->fi_hash);
1997                 INIT_LIST_HEAD(&fp->fi_stateids);
1998                 INIT_LIST_HEAD(&fp->fi_delegations);
1999                 fp->fi_inode = igrab(ino);
2000                 fp->fi_id = current_fileid++;
2001                 fp->fi_had_conflict = false;
2002                 memset(fp->fi_fds, 0, sizeof(fp->fi_fds));
2003                 memset(fp->fi_access, 0, sizeof(fp->fi_access));
2004                 spin_lock(&recall_lock);
2005                 list_add(&fp->fi_hash, &file_hashtbl[hashval]);
2006                 spin_unlock(&recall_lock);
2007                 return fp;
2008         }
2009         return NULL;
2010 }
2011
2012 static void
2013 nfsd4_free_slab(struct kmem_cache **slab)
2014 {
2015         if (*slab == NULL)
2016                 return;
2017         kmem_cache_destroy(*slab);
2018         *slab = NULL;
2019 }
2020
2021 void
2022 nfsd4_free_slabs(void)
2023 {
2024         nfsd4_free_slab(&stateowner_slab);
2025         nfsd4_free_slab(&file_slab);
2026         nfsd4_free_slab(&stateid_slab);
2027         nfsd4_free_slab(&deleg_slab);
2028 }
2029
2030 static int
2031 nfsd4_init_slabs(void)
2032 {
2033         stateowner_slab = kmem_cache_create("nfsd4_stateowners",
2034                         sizeof(struct nfs4_stateowner), 0, 0, NULL);
2035         if (stateowner_slab == NULL)
2036                 goto out_nomem;
2037         file_slab = kmem_cache_create("nfsd4_files",
2038                         sizeof(struct nfs4_file), 0, 0, NULL);
2039         if (file_slab == NULL)
2040                 goto out_nomem;
2041         stateid_slab = kmem_cache_create("nfsd4_stateids",
2042                         sizeof(struct nfs4_stateid), 0, 0, NULL);
2043         if (stateid_slab == NULL)
2044                 goto out_nomem;
2045         deleg_slab = kmem_cache_create("nfsd4_delegations",
2046                         sizeof(struct nfs4_delegation), 0, 0, NULL);
2047         if (deleg_slab == NULL)
2048                 goto out_nomem;
2049         return 0;
2050 out_nomem:
2051         nfsd4_free_slabs();
2052         dprintk("nfsd4: out of memory while initializing nfsv4\n");
2053         return -ENOMEM;
2054 }
2055
2056 void
2057 nfs4_free_stateowner(struct kref *kref)
2058 {
2059         struct nfs4_stateowner *sop =
2060                 container_of(kref, struct nfs4_stateowner, so_ref);
2061         kfree(sop->so_owner.data);
2062         kmem_cache_free(stateowner_slab, sop);
2063 }
2064
2065 static inline struct nfs4_stateowner *
2066 alloc_stateowner(struct xdr_netobj *owner)
2067 {
2068         struct nfs4_stateowner *sop;
2069
2070         if ((sop = kmem_cache_alloc(stateowner_slab, GFP_KERNEL))) {
2071                 if ((sop->so_owner.data = kmalloc(owner->len, GFP_KERNEL))) {
2072                         memcpy(sop->so_owner.data, owner->data, owner->len);
2073                         sop->so_owner.len = owner->len;
2074                         kref_init(&sop->so_ref);
2075                         return sop;
2076                 } 
2077                 kmem_cache_free(stateowner_slab, sop);
2078         }
2079         return NULL;
2080 }
2081
2082 static struct nfs4_stateowner *
2083 alloc_init_open_stateowner(unsigned int strhashval, struct nfs4_client *clp, struct nfsd4_open *open) {
2084         struct nfs4_stateowner *sop;
2085         struct nfs4_replay *rp;
2086         unsigned int idhashval;
2087
2088         if (!(sop = alloc_stateowner(&open->op_owner)))
2089                 return NULL;
2090         idhashval = ownerid_hashval(current_ownerid);
2091         INIT_LIST_HEAD(&sop->so_idhash);
2092         INIT_LIST_HEAD(&sop->so_strhash);
2093         INIT_LIST_HEAD(&sop->so_perclient);
2094         INIT_LIST_HEAD(&sop->so_stateids);
2095         INIT_LIST_HEAD(&sop->so_perstateid);  /* not used */
2096         INIT_LIST_HEAD(&sop->so_close_lru);
2097         sop->so_time = 0;
2098         list_add(&sop->so_idhash, &ownerid_hashtbl[idhashval]);
2099         list_add(&sop->so_strhash, &ownerstr_hashtbl[strhashval]);
2100         list_add(&sop->so_perclient, &clp->cl_openowners);
2101         sop->so_is_open_owner = 1;
2102         sop->so_id = current_ownerid++;
2103         sop->so_client = clp;
2104         sop->so_seqid = open->op_seqid;
2105         sop->so_confirmed = 0;
2106         rp = &sop->so_replay;
2107         rp->rp_status = nfserr_serverfault;
2108         rp->rp_buflen = 0;
2109         rp->rp_buf = rp->rp_ibuf;
2110         return sop;
2111 }
2112
2113 static inline void
2114 init_stateid(struct nfs4_stateid *stp, struct nfs4_file *fp, struct nfsd4_open *open) {
2115         struct nfs4_stateowner *sop = open->op_stateowner;
2116         unsigned int hashval = stateid_hashval(sop->so_id, fp->fi_id);
2117
2118         INIT_LIST_HEAD(&stp->st_hash);
2119         INIT_LIST_HEAD(&stp->st_perstateowner);
2120         INIT_LIST_HEAD(&stp->st_lockowners);
2121         INIT_LIST_HEAD(&stp->st_perfile);
2122         list_add(&stp->st_hash, &stateid_hashtbl[hashval]);
2123         list_add(&stp->st_perstateowner, &sop->so_stateids);
2124         list_add(&stp->st_perfile, &fp->fi_stateids);
2125         stp->st_stateowner = sop;
2126         get_nfs4_file(fp);
2127         stp->st_file = fp;
2128         stp->st_stateid.si_boot = boot_time;
2129         stp->st_stateid.si_stateownerid = sop->so_id;
2130         stp->st_stateid.si_fileid = fp->fi_id;
2131         stp->st_stateid.si_generation = 0;
2132         stp->st_access_bmap = 0;
2133         stp->st_deny_bmap = 0;
2134         __set_bit(open->op_share_access & ~NFS4_SHARE_WANT_MASK,
2135                   &stp->st_access_bmap);
2136         __set_bit(open->op_share_deny, &stp->st_deny_bmap);
2137         stp->st_openstp = NULL;
2138 }
2139
2140 static void
2141 move_to_close_lru(struct nfs4_stateowner *sop)
2142 {
2143         dprintk("NFSD: move_to_close_lru nfs4_stateowner %p\n", sop);
2144
2145         list_move_tail(&sop->so_close_lru, &close_lru);
2146         sop->so_time = get_seconds();
2147 }
2148
2149 static int
2150 same_owner_str(struct nfs4_stateowner *sop, struct xdr_netobj *owner,
2151                                                         clientid_t *clid)
2152 {
2153         return (sop->so_owner.len == owner->len) &&
2154                 0 == memcmp(sop->so_owner.data, owner->data, owner->len) &&
2155                 (sop->so_client->cl_clientid.cl_id == clid->cl_id);
2156 }
2157
2158 static struct nfs4_stateowner *
2159 find_openstateowner_str(unsigned int hashval, struct nfsd4_open *open)
2160 {
2161         struct nfs4_stateowner *so = NULL;
2162
2163         list_for_each_entry(so, &ownerstr_hashtbl[hashval], so_strhash) {
2164                 if (same_owner_str(so, &open->op_owner, &open->op_clientid))
2165                         return so;
2166         }
2167         return NULL;
2168 }
2169
2170 /* search file_hashtbl[] for file */
2171 static struct nfs4_file *
2172 find_file(struct inode *ino)
2173 {
2174         unsigned int hashval = file_hashval(ino);
2175         struct nfs4_file *fp;
2176
2177         spin_lock(&recall_lock);
2178         list_for_each_entry(fp, &file_hashtbl[hashval], fi_hash) {
2179                 if (fp->fi_inode == ino) {
2180                         get_nfs4_file(fp);
2181                         spin_unlock(&recall_lock);
2182                         return fp;
2183                 }
2184         }
2185         spin_unlock(&recall_lock);
2186         return NULL;
2187 }
2188
2189 static inline int access_valid(u32 x, u32 minorversion)
2190 {
2191         if ((x & NFS4_SHARE_ACCESS_MASK) < NFS4_SHARE_ACCESS_READ)
2192                 return 0;
2193         if ((x & NFS4_SHARE_ACCESS_MASK) > NFS4_SHARE_ACCESS_BOTH)
2194                 return 0;
2195         x &= ~NFS4_SHARE_ACCESS_MASK;
2196         if (minorversion && x) {
2197                 if ((x & NFS4_SHARE_WANT_MASK) > NFS4_SHARE_WANT_CANCEL)
2198                         return 0;
2199                 if ((x & NFS4_SHARE_WHEN_MASK) > NFS4_SHARE_PUSH_DELEG_WHEN_UNCONTENDED)
2200                         return 0;
2201                 x &= ~(NFS4_SHARE_WANT_MASK | NFS4_SHARE_WHEN_MASK);
2202         }
2203         if (x)
2204                 return 0;
2205         return 1;
2206 }
2207
2208 static inline int deny_valid(u32 x)
2209 {
2210         /* Note: unlike access bits, deny bits may be zero. */
2211         return x <= NFS4_SHARE_DENY_BOTH;
2212 }
2213
2214 /*
2215  * Called to check deny when READ with all zero stateid or
2216  * WRITE with all zero or all one stateid
2217  */
2218 static __be32
2219 nfs4_share_conflict(struct svc_fh *current_fh, unsigned int deny_type)
2220 {
2221         struct inode *ino = current_fh->fh_dentry->d_inode;
2222         struct nfs4_file *fp;
2223         struct nfs4_stateid *stp;
2224         __be32 ret;
2225
2226         dprintk("NFSD: nfs4_share_conflict\n");
2227
2228         fp = find_file(ino);
2229         if (!fp)
2230                 return nfs_ok;
2231         ret = nfserr_locked;
2232         /* Search for conflicting share reservations */
2233         list_for_each_entry(stp, &fp->fi_stateids, st_perfile) {
2234                 if (test_bit(deny_type, &stp->st_deny_bmap) ||
2235                     test_bit(NFS4_SHARE_DENY_BOTH, &stp->st_deny_bmap))
2236                         goto out;
2237         }
2238         ret = nfs_ok;
2239 out:
2240         put_nfs4_file(fp);
2241         return ret;
2242 }
2243
2244 static inline void
2245 nfs4_file_downgrade(struct nfs4_file *fp, unsigned int share_access)
2246 {
2247         if (share_access & NFS4_SHARE_ACCESS_WRITE)
2248                 nfs4_file_put_access(fp, O_WRONLY);
2249         if (share_access & NFS4_SHARE_ACCESS_READ)
2250                 nfs4_file_put_access(fp, O_RDONLY);
2251 }
2252
2253 /*
2254  * Spawn a thread to perform a recall on the delegation represented
2255  * by the lease (file_lock)
2256  *
2257  * Called from break_lease() with lock_kernel() held.
2258  * Note: we assume break_lease will only call this *once* for any given
2259  * lease.
2260  */
2261 static
2262 void nfsd_break_deleg_cb(struct file_lock *fl)
2263 {
2264         struct nfs4_delegation *dp = (struct nfs4_delegation *)fl->fl_owner;
2265
2266         dprintk("NFSD nfsd_break_deleg_cb: dp %p fl %p\n",dp,fl);
2267         if (!dp)
2268                 return;
2269
2270         /* We're assuming the state code never drops its reference
2271          * without first removing the lease.  Since we're in this lease
2272          * callback (and since the lease code is serialized by the kernel
2273          * lock) we know the server hasn't removed the lease yet, we know
2274          * it's safe to take a reference: */
2275         atomic_inc(&dp->dl_count);
2276
2277         spin_lock(&recall_lock);
2278         list_add_tail(&dp->dl_recall_lru, &del_recall_lru);
2279         spin_unlock(&recall_lock);
2280
2281         /* only place dl_time is set. protected by lock_kernel*/
2282         dp->dl_time = get_seconds();
2283
2284         /*
2285          * We don't want the locks code to timeout the lease for us;
2286          * we'll remove it ourself if the delegation isn't returned
2287          * in time.
2288          */
2289         fl->fl_break_time = 0;
2290
2291         dp->dl_file->fi_had_conflict = true;
2292         nfsd4_cb_recall(dp);
2293 }
2294
2295 /*
2296  * The file_lock is being reapd.
2297  *
2298  * Called by locks_free_lock() with lock_kernel() held.
2299  */
2300 static
2301 void nfsd_release_deleg_cb(struct file_lock *fl)
2302 {
2303         struct nfs4_delegation *dp = (struct nfs4_delegation *)fl->fl_owner;
2304
2305         dprintk("NFSD nfsd_release_deleg_cb: fl %p dp %p dl_count %d\n", fl,dp, atomic_read(&dp->dl_count));
2306
2307         if (!(fl->fl_flags & FL_LEASE) || !dp)
2308                 return;
2309         dp->dl_flock = NULL;
2310 }
2311
2312 /*
2313  * Set the delegation file_lock back pointer.
2314  *
2315  * Called from setlease() with lock_kernel() held.
2316  */
2317 static
2318 void nfsd_copy_lock_deleg_cb(struct file_lock *new, struct file_lock *fl)
2319 {
2320         struct nfs4_delegation *dp = (struct nfs4_delegation *)new->fl_owner;
2321
2322         dprintk("NFSD: nfsd_copy_lock_deleg_cb: new fl %p dp %p\n", new, dp);
2323         if (!dp)
2324                 return;
2325         dp->dl_flock = new;
2326 }
2327
2328 /*
2329  * Called from setlease() with lock_kernel() held
2330  */
2331 static
2332 int nfsd_same_client_deleg_cb(struct file_lock *onlist, struct file_lock *try)
2333 {
2334         struct nfs4_delegation *onlistd =
2335                 (struct nfs4_delegation *)onlist->fl_owner;
2336         struct nfs4_delegation *tryd =
2337                 (struct nfs4_delegation *)try->fl_owner;
2338
2339         if (onlist->fl_lmops != try->fl_lmops)
2340                 return 0;
2341
2342         return onlistd->dl_client == tryd->dl_client;
2343 }
2344
2345
2346 static
2347 int nfsd_change_deleg_cb(struct file_lock **onlist, int arg)
2348 {
2349         if (arg & F_UNLCK)
2350                 return lease_modify(onlist, arg);
2351         else
2352                 return -EAGAIN;
2353 }
2354
2355 static const struct lock_manager_operations nfsd_lease_mng_ops = {
2356         .fl_break = nfsd_break_deleg_cb,
2357         .fl_release_private = nfsd_release_deleg_cb,
2358         .fl_copy_lock = nfsd_copy_lock_deleg_cb,
2359         .fl_mylease = nfsd_same_client_deleg_cb,
2360         .fl_change = nfsd_change_deleg_cb,
2361 };
2362
2363
2364 __be32
2365 nfsd4_process_open1(struct nfsd4_compound_state *cstate,
2366                     struct nfsd4_open *open)
2367 {
2368         clientid_t *clientid = &open->op_clientid;
2369         struct nfs4_client *clp = NULL;
2370         unsigned int strhashval;
2371         struct nfs4_stateowner *sop = NULL;
2372
2373         if (!check_name(open->op_owner))
2374                 return nfserr_inval;
2375
2376         if (STALE_CLIENTID(&open->op_clientid))
2377                 return nfserr_stale_clientid;
2378
2379         strhashval = ownerstr_hashval(clientid->cl_id, open->op_owner);
2380         sop = find_openstateowner_str(strhashval, open);
2381         open->op_stateowner = sop;
2382         if (!sop) {
2383                 /* Make sure the client's lease hasn't expired. */
2384                 clp = find_confirmed_client(clientid);
2385                 if (clp == NULL)
2386                         return nfserr_expired;
2387                 goto renew;
2388         }
2389         /* When sessions are used, skip open sequenceid processing */
2390         if (nfsd4_has_session(cstate))
2391                 goto renew;
2392         if (!sop->so_confirmed) {
2393                 /* Replace unconfirmed owners without checking for replay. */
2394                 clp = sop->so_client;
2395                 release_openowner(sop);
2396                 open->op_stateowner = NULL;
2397                 goto renew;
2398         }
2399         if (open->op_seqid == sop->so_seqid - 1) {
2400                 if (sop->so_replay.rp_buflen)
2401                         return nfserr_replay_me;
2402                 /* The original OPEN failed so spectacularly
2403                  * that we don't even have replay data saved!
2404                  * Therefore, we have no choice but to continue
2405                  * processing this OPEN; presumably, we'll
2406                  * fail again for the same reason.
2407                  */
2408                 dprintk("nfsd4_process_open1: replay with no replay cache\n");
2409                 goto renew;
2410         }
2411         if (open->op_seqid != sop->so_seqid)
2412                 return nfserr_bad_seqid;
2413 renew:
2414         if (open->op_stateowner == NULL) {
2415                 sop = alloc_init_open_stateowner(strhashval, clp, open);
2416                 if (sop == NULL)
2417                         return nfserr_resource;
2418                 open->op_stateowner = sop;
2419         }
2420         list_del_init(&sop->so_close_lru);
2421         renew_client(sop->so_client);
2422         return nfs_ok;
2423 }
2424
2425 static inline __be32
2426 nfs4_check_delegmode(struct nfs4_delegation *dp, int flags)
2427 {
2428         if ((flags & WR_STATE) && (dp->dl_type == NFS4_OPEN_DELEGATE_READ))
2429                 return nfserr_openmode;
2430         else
2431                 return nfs_ok;
2432 }
2433
2434 static struct nfs4_delegation *
2435 find_delegation_file(struct nfs4_file *fp, stateid_t *stid)
2436 {
2437         struct nfs4_delegation *dp;
2438
2439         list_for_each_entry(dp, &fp->fi_delegations, dl_perfile) {
2440                 if (dp->dl_stateid.si_stateownerid == stid->si_stateownerid)
2441                         return dp;
2442         }
2443         return NULL;
2444 }
2445
2446 int share_access_to_flags(u32 share_access)
2447 {
2448         share_access &= ~NFS4_SHARE_WANT_MASK;
2449
2450         return share_access == NFS4_SHARE_ACCESS_READ ? RD_STATE : WR_STATE;
2451 }
2452
2453 static __be32
2454 nfs4_check_deleg(struct nfs4_file *fp, struct nfsd4_open *open,
2455                 struct nfs4_delegation **dp)
2456 {
2457         int flags;
2458         __be32 status = nfserr_bad_stateid;
2459
2460         *dp = find_delegation_file(fp, &open->op_delegate_stateid);
2461         if (*dp == NULL)
2462                 goto out;
2463         flags = share_access_to_flags(open->op_share_access);
2464         status = nfs4_check_delegmode(*dp, flags);
2465         if (status)
2466                 *dp = NULL;
2467 out:
2468         if (open->op_claim_type != NFS4_OPEN_CLAIM_DELEGATE_CUR)
2469                 return nfs_ok;
2470         if (status)
2471                 return status;
2472         open->op_stateowner->so_confirmed = 1;
2473         return nfs_ok;
2474 }
2475
2476 static __be32
2477 nfs4_check_open(struct nfs4_file *fp, struct nfsd4_open *open, struct nfs4_stateid **stpp)
2478 {
2479         struct nfs4_stateid *local;
2480         __be32 status = nfserr_share_denied;
2481         struct nfs4_stateowner *sop = open->op_stateowner;
2482
2483         list_for_each_entry(local, &fp->fi_stateids, st_perfile) {
2484                 /* ignore lock owners */
2485                 if (local->st_stateowner->so_is_open_owner == 0)
2486                         continue;
2487                 /* remember if we have seen this open owner */
2488                 if (local->st_stateowner == sop)
2489                         *stpp = local;
2490                 /* check for conflicting share reservations */
2491                 if (!test_share(local, open))
2492                         goto out;
2493         }
2494         status = 0;
2495 out:
2496         return status;
2497 }
2498
2499 static inline struct nfs4_stateid *
2500 nfs4_alloc_stateid(void)
2501 {
2502         return kmem_cache_alloc(stateid_slab, GFP_KERNEL);
2503 }
2504
2505 static inline int nfs4_access_to_access(u32 nfs4_access)
2506 {
2507         int flags = 0;
2508
2509         if (nfs4_access & NFS4_SHARE_ACCESS_READ)
2510                 flags |= NFSD_MAY_READ;
2511         if (nfs4_access & NFS4_SHARE_ACCESS_WRITE)
2512                 flags |= NFSD_MAY_WRITE;
2513         return flags;
2514 }
2515
2516 static __be32 nfs4_get_vfs_file(struct svc_rqst *rqstp, struct nfs4_file
2517 *fp, struct svc_fh *cur_fh, u32 nfs4_access)
2518 {
2519         __be32 status;
2520         int oflag = nfs4_access_to_omode(nfs4_access);
2521         int access = nfs4_access_to_access(nfs4_access);
2522
2523         if (!fp->fi_fds[oflag]) {
2524                 status = nfsd_open(rqstp, cur_fh, S_IFREG, access,
2525                         &fp->fi_fds[oflag]);
2526                 if (status == nfserr_dropit)
2527                         status = nfserr_jukebox;
2528                 if (status)
2529                         return status;
2530         }
2531         nfs4_file_get_access(fp, oflag);
2532
2533         return nfs_ok;
2534 }
2535
2536 static __be32
2537 nfs4_new_open(struct svc_rqst *rqstp, struct nfs4_stateid **stpp,
2538                 struct nfs4_file *fp, struct svc_fh *cur_fh,
2539                 struct nfsd4_open *open)
2540 {
2541         struct nfs4_stateid *stp;
2542         __be32 status;
2543
2544         stp = nfs4_alloc_stateid();
2545         if (stp == NULL)
2546                 return nfserr_resource;
2547
2548         status = nfs4_get_vfs_file(rqstp, fp, cur_fh, open->op_share_access);
2549         if (status) {
2550                 kmem_cache_free(stateid_slab, stp);
2551                 return status;
2552         }
2553         *stpp = stp;
2554         return 0;
2555 }
2556
2557 static inline __be32
2558 nfsd4_truncate(struct svc_rqst *rqstp, struct svc_fh *fh,
2559                 struct nfsd4_open *open)
2560 {
2561         struct iattr iattr = {
2562                 .ia_valid = ATTR_SIZE,
2563                 .ia_size = 0,
2564         };
2565         if (!open->op_truncate)
2566                 return 0;
2567         if (!(open->op_share_access & NFS4_SHARE_ACCESS_WRITE))
2568                 return nfserr_inval;
2569         return nfsd_setattr(rqstp, fh, &iattr, 0, (time_t)0);
2570 }
2571
2572 static __be32
2573 nfs4_upgrade_open(struct svc_rqst *rqstp, struct nfs4_file *fp, struct svc_fh *cur_fh, struct nfs4_stateid *stp, struct nfsd4_open *open)
2574 {
2575         u32 op_share_access = open->op_share_access & ~NFS4_SHARE_WANT_MASK;
2576         bool new_access;
2577         __be32 status;
2578
2579         new_access = !test_bit(op_share_access, &stp->st_access_bmap);
2580         if (new_access) {
2581                 status = nfs4_get_vfs_file(rqstp, fp, cur_fh, op_share_access);
2582                 if (status)
2583                         return status;
2584         }
2585         status = nfsd4_truncate(rqstp, cur_fh, open);
2586         if (status) {
2587                 if (new_access) {
2588                         int oflag = nfs4_access_to_omode(new_access);
2589                         nfs4_file_put_access(fp, oflag);
2590                 }
2591                 return status;
2592         }
2593         /* remember the open */
2594         __set_bit(op_share_access, &stp->st_access_bmap);
2595         __set_bit(open->op_share_deny, &stp->st_deny_bmap);
2596
2597         return nfs_ok;
2598 }
2599
2600
2601 static void
2602 nfs4_set_claim_prev(struct nfsd4_open *open)
2603 {
2604         open->op_stateowner->so_confirmed = 1;
2605         open->op_stateowner->so_client->cl_firststate = 1;
2606 }
2607
2608 /*
2609  * Attempt to hand out a delegation.
2610  */
2611 static void
2612 nfs4_open_delegation(struct svc_fh *fh, struct nfsd4_open *open, struct nfs4_stateid *stp)
2613 {
2614         struct nfs4_delegation *dp;
2615         struct nfs4_stateowner *sop = stp->st_stateowner;
2616         int cb_up = atomic_read(&sop->so_client->cl_cb_set);
2617         struct file_lock fl, *flp = &fl;
2618         int status, flag = 0;
2619
2620         flag = NFS4_OPEN_DELEGATE_NONE;
2621         open->op_recall = 0;
2622         switch (open->op_claim_type) {
2623                 case NFS4_OPEN_CLAIM_PREVIOUS:
2624                         if (!cb_up)
2625                                 open->op_recall = 1;
2626                         flag = open->op_delegate_type;
2627                         if (flag == NFS4_OPEN_DELEGATE_NONE)
2628                                 goto out;
2629                         break;
2630                 case NFS4_OPEN_CLAIM_NULL:
2631                         /* Let's not give out any delegations till everyone's
2632                          * had the chance to reclaim theirs.... */
2633                         if (locks_in_grace())
2634                                 goto out;
2635                         if (!cb_up || !sop->so_confirmed)
2636                                 goto out;
2637                         if (open->op_share_access & NFS4_SHARE_ACCESS_WRITE)
2638                                 flag = NFS4_OPEN_DELEGATE_WRITE;
2639                         else
2640                                 flag = NFS4_OPEN_DELEGATE_READ;
2641                         break;
2642                 default:
2643                         goto out;
2644         }
2645
2646         dp = alloc_init_deleg(sop->so_client, stp, fh, flag);
2647         if (dp == NULL) {
2648                 flag = NFS4_OPEN_DELEGATE_NONE;
2649                 goto out;
2650         }
2651         locks_init_lock(&fl);
2652         fl.fl_lmops = &nfsd_lease_mng_ops;
2653         fl.fl_flags = FL_LEASE;
2654         fl.fl_type = flag == NFS4_OPEN_DELEGATE_READ? F_RDLCK: F_WRLCK;
2655         fl.fl_end = OFFSET_MAX;
2656         fl.fl_owner =  (fl_owner_t)dp;
2657         fl.fl_file = find_readable_file(stp->st_file);
2658         BUG_ON(!fl.fl_file);
2659         fl.fl_pid = current->tgid;
2660
2661         /* vfs_setlease checks to see if delegation should be handed out.
2662          * the lock_manager callbacks fl_mylease and fl_change are used
2663          */
2664         if ((status = vfs_setlease(fl.fl_file, fl.fl_type, &flp))) {
2665                 dprintk("NFSD: setlease failed [%d], no delegation\n", status);
2666                 unhash_delegation(dp);
2667                 flag = NFS4_OPEN_DELEGATE_NONE;
2668                 goto out;
2669         }
2670
2671         memcpy(&open->op_delegate_stateid, &dp->dl_stateid, sizeof(dp->dl_stateid));
2672
2673         dprintk("NFSD: delegation stateid=" STATEID_FMT "\n",
2674                 STATEID_VAL(&dp->dl_stateid));
2675 out:
2676         if (open->op_claim_type == NFS4_OPEN_CLAIM_PREVIOUS
2677                         && flag == NFS4_OPEN_DELEGATE_NONE
2678                         && open->op_delegate_type != NFS4_OPEN_DELEGATE_NONE)
2679                 dprintk("NFSD: WARNING: refusing delegation reclaim\n");
2680         open->op_delegate_type = flag;
2681 }
2682
2683 /*
2684  * called with nfs4_lock_state() held.
2685  */
2686 __be32
2687 nfsd4_process_open2(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_open *open)
2688 {
2689         struct nfsd4_compoundres *resp = rqstp->rq_resp;
2690         struct nfs4_file *fp = NULL;
2691         struct inode *ino = current_fh->fh_dentry->d_inode;
2692         struct nfs4_stateid *stp = NULL;
2693         struct nfs4_delegation *dp = NULL;
2694         __be32 status;
2695
2696         status = nfserr_inval;
2697         if (!access_valid(open->op_share_access, resp->cstate.minorversion)
2698                         || !deny_valid(open->op_share_deny))
2699                 goto out;
2700         /*
2701          * Lookup file; if found, lookup stateid and check open request,
2702          * and check for delegations in the process of being recalled.
2703          * If not found, create the nfs4_file struct
2704          */
2705         fp = find_file(ino);
2706         if (fp) {
2707                 if ((status = nfs4_check_open(fp, open, &stp)))
2708                         goto out;
2709                 status = nfs4_check_deleg(fp, open, &dp);
2710                 if (status)
2711                         goto out;
2712         } else {
2713                 status = nfserr_bad_stateid;
2714                 if (open->op_claim_type == NFS4_OPEN_CLAIM_DELEGATE_CUR)
2715                         goto out;
2716                 status = nfserr_resource;
2717                 fp = alloc_init_file(ino);
2718                 if (fp == NULL)
2719                         goto out;
2720         }
2721
2722         /*
2723          * OPEN the file, or upgrade an existing OPEN.
2724          * If truncate fails, the OPEN fails.
2725          */
2726         if (stp) {
2727                 /* Stateid was found, this is an OPEN upgrade */
2728                 status = nfs4_upgrade_open(rqstp, fp, current_fh, stp, open);
2729                 if (status)
2730                         goto out;
2731                 update_stateid(&stp->st_stateid);
2732         } else {
2733                 status = nfs4_new_open(rqstp, &stp, fp, current_fh, open);
2734                 if (status)
2735                         goto out;
2736                 init_stateid(stp, fp, open);
2737                 status = nfsd4_truncate(rqstp, current_fh, open);
2738                 if (status) {
2739                         release_open_stateid(stp);
2740                         goto out;
2741                 }
2742                 if (nfsd4_has_session(&resp->cstate))
2743                         update_stateid(&stp->st_stateid);
2744         }
2745         memcpy(&open->op_stateid, &stp->st_stateid, sizeof(stateid_t));
2746
2747         if (nfsd4_has_session(&resp->cstate))
2748                 open->op_stateowner->so_confirmed = 1;
2749
2750         /*
2751         * Attempt to hand out a delegation. No error return, because the
2752         * OPEN succeeds even if we fail.
2753         */
2754         nfs4_open_delegation(current_fh, open, stp);
2755
2756         status = nfs_ok;
2757
2758         dprintk("%s: stateid=" STATEID_FMT "\n", __func__,
2759                 STATEID_VAL(&stp->st_stateid));
2760 out:
2761         if (fp)
2762                 put_nfs4_file(fp);
2763         if (status == 0 && open->op_claim_type == NFS4_OPEN_CLAIM_PREVIOUS)
2764                 nfs4_set_claim_prev(open);
2765         /*
2766         * To finish the open response, we just need to set the rflags.
2767         */
2768         open->op_rflags = NFS4_OPEN_RESULT_LOCKTYPE_POSIX;
2769         if (!open->op_stateowner->so_confirmed &&
2770             !nfsd4_has_session(&resp->cstate))
2771                 open->op_rflags |= NFS4_OPEN_RESULT_CONFIRM;
2772
2773         return status;
2774 }
2775
2776 __be32
2777 nfsd4_renew(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
2778             clientid_t *clid)
2779 {
2780         struct nfs4_client *clp;
2781         __be32 status;
2782
2783         nfs4_lock_state();
2784         dprintk("process_renew(%08x/%08x): starting\n", 
2785                         clid->cl_boot, clid->cl_id);
2786         status = nfserr_stale_clientid;
2787         if (STALE_CLIENTID(clid))
2788                 goto out;
2789         clp = find_confirmed_client(clid);
2790         status = nfserr_expired;
2791         if (clp == NULL) {
2792                 /* We assume the client took too long to RENEW. */
2793                 dprintk("nfsd4_renew: clientid not found!\n");
2794                 goto out;
2795         }
2796         renew_client(clp);
2797         status = nfserr_cb_path_down;
2798         if (!list_empty(&clp->cl_delegations)
2799                         && !atomic_read(&clp->cl_cb_set))
2800                 goto out;
2801         status = nfs_ok;
2802 out:
2803         nfs4_unlock_state();
2804         return status;
2805 }
2806
2807 struct lock_manager nfsd4_manager = {
2808 };
2809
2810 static void
2811 nfsd4_end_grace(void)
2812 {
2813         dprintk("NFSD: end of grace period\n");
2814         nfsd4_recdir_purge_old();
2815         locks_end_grace(&nfsd4_manager);
2816         /*
2817          * Now that every NFSv4 client has had the chance to recover and
2818          * to see the (possibly new, possibly shorter) lease time, we
2819          * can safely set the next grace time to the current lease time:
2820          */
2821         nfsd4_grace = nfsd4_lease;
2822 }
2823
2824 static time_t
2825 nfs4_laundromat(void)
2826 {
2827         struct nfs4_client *clp;
2828         struct nfs4_stateowner *sop;
2829         struct nfs4_delegation *dp;
2830         struct list_head *pos, *next, reaplist;
2831         time_t cutoff = get_seconds() - nfsd4_lease;
2832         time_t t, clientid_val = nfsd4_lease;
2833         time_t u, test_val = nfsd4_lease;
2834
2835         nfs4_lock_state();
2836
2837         dprintk("NFSD: laundromat service - starting\n");
2838         if (locks_in_grace())
2839                 nfsd4_end_grace();
2840         INIT_LIST_HEAD(&reaplist);
2841         spin_lock(&client_lock);
2842         list_for_each_safe(pos, next, &client_lru) {
2843                 clp = list_entry(pos, struct nfs4_client, cl_lru);
2844                 if (time_after((unsigned long)clp->cl_time, (unsigned long)cutoff)) {
2845                         t = clp->cl_time - cutoff;
2846                         if (clientid_val > t)
2847                                 clientid_val = t;
2848                         break;
2849                 }
2850                 if (atomic_read(&clp->cl_refcount)) {
2851                         dprintk("NFSD: client in use (clientid %08x)\n",
2852                                 clp->cl_clientid.cl_id);
2853                         continue;
2854                 }
2855                 unhash_client_locked(clp);
2856                 list_add(&clp->cl_lru, &reaplist);
2857         }
2858         spin_unlock(&client_lock);
2859         list_for_each_safe(pos, next, &reaplist) {
2860                 clp = list_entry(pos, struct nfs4_client, cl_lru);
2861                 dprintk("NFSD: purging unused client (clientid %08x)\n",
2862                         clp->cl_clientid.cl_id);
2863                 nfsd4_remove_clid_dir(clp);
2864                 expire_client(clp);
2865         }
2866         spin_lock(&recall_lock);
2867         list_for_each_safe(pos, next, &del_recall_lru) {
2868                 dp = list_entry (pos, struct nfs4_delegation, dl_recall_lru);
2869                 if (time_after((unsigned long)dp->dl_time, (unsigned long)cutoff)) {
2870                         u = dp->dl_time - cutoff;
2871                         if (test_val > u)
2872                                 test_val = u;
2873                         break;
2874                 }
2875                 dprintk("NFSD: purging unused delegation dp %p, fp %p\n",
2876                                     dp, dp->dl_flock);
2877                 list_move(&dp->dl_recall_lru, &reaplist);
2878         }
2879         spin_unlock(&recall_lock);
2880         list_for_each_safe(pos, next, &reaplist) {
2881                 dp = list_entry (pos, struct nfs4_delegation, dl_recall_lru);
2882                 list_del_init(&dp->dl_recall_lru);
2883                 unhash_delegation(dp);
2884         }
2885         test_val = nfsd4_lease;
2886         list_for_each_safe(pos, next, &close_lru) {
2887                 sop = list_entry(pos, struct nfs4_stateowner, so_close_lru);
2888                 if (time_after((unsigned long)sop->so_time, (unsigned long)cutoff)) {
2889                         u = sop->so_time - cutoff;
2890                         if (test_val > u)
2891                                 test_val = u;
2892                         break;
2893                 }
2894                 dprintk("NFSD: purging unused open stateowner (so_id %d)\n",
2895                         sop->so_id);
2896                 release_openowner(sop);
2897         }
2898         if (clientid_val < NFSD_LAUNDROMAT_MINTIMEOUT)
2899                 clientid_val = NFSD_LAUNDROMAT_MINTIMEOUT;
2900         nfs4_unlock_state();
2901         return clientid_val;
2902 }
2903
2904 static struct workqueue_struct *laundry_wq;
2905 static void laundromat_main(struct work_struct *);
2906 static DECLARE_DELAYED_WORK(laundromat_work, laundromat_main);
2907
2908 static void
2909 laundromat_main(struct work_struct *not_used)
2910 {
2911         time_t t;
2912
2913         t = nfs4_laundromat();
2914         dprintk("NFSD: laundromat_main - sleeping for %ld seconds\n", t);
2915         queue_delayed_work(laundry_wq, &laundromat_work, t*HZ);
2916 }
2917
2918 static struct nfs4_stateowner *
2919 search_close_lru(u32 st_id, int flags)
2920 {
2921         struct nfs4_stateowner *local = NULL;
2922
2923         if (flags & CLOSE_STATE) {
2924                 list_for_each_entry(local, &close_lru, so_close_lru) {
2925                         if (local->so_id == st_id)
2926                                 return local;
2927                 }
2928         }
2929         return NULL;
2930 }
2931
2932 static inline int
2933 nfs4_check_fh(struct svc_fh *fhp, struct nfs4_stateid *stp)
2934 {
2935         return fhp->fh_dentry->d_inode != stp->st_file->fi_inode;
2936 }
2937
2938 static int
2939 STALE_STATEID(stateid_t *stateid)
2940 {
2941         if (stateid->si_boot == boot_time)
2942                 return 0;
2943         dprintk("NFSD: stale stateid " STATEID_FMT "!\n",
2944                 STATEID_VAL(stateid));
2945         return 1;
2946 }
2947
2948 static inline int
2949 access_permit_read(unsigned long access_bmap)
2950 {
2951         return test_bit(NFS4_SHARE_ACCESS_READ, &access_bmap) ||
2952                 test_bit(NFS4_SHARE_ACCESS_BOTH, &access_bmap) ||
2953                 test_bit(NFS4_SHARE_ACCESS_WRITE, &access_bmap);
2954 }
2955
2956 static inline int
2957 access_permit_write(unsigned long access_bmap)
2958 {
2959         return test_bit(NFS4_SHARE_ACCESS_WRITE, &access_bmap) ||
2960                 test_bit(NFS4_SHARE_ACCESS_BOTH, &access_bmap);
2961 }
2962
2963 static
2964 __be32 nfs4_check_openmode(struct nfs4_stateid *stp, int flags)
2965 {
2966         __be32 status = nfserr_openmode;
2967
2968         /* For lock stateid's, we test the parent open, not the lock: */
2969         if (stp->st_openstp)
2970                 stp = stp->st_openstp;
2971         if ((flags & WR_STATE) && (!access_permit_write(stp->st_access_bmap)))
2972                 goto out;
2973         if ((flags & RD_STATE) && (!access_permit_read(stp->st_access_bmap)))
2974                 goto out;
2975         status = nfs_ok;
2976 out:
2977         return status;
2978 }
2979
2980 static inline __be32
2981 check_special_stateids(svc_fh *current_fh, stateid_t *stateid, int flags)
2982 {
2983         if (ONE_STATEID(stateid) && (flags & RD_STATE))
2984                 return nfs_ok;
2985         else if (locks_in_grace()) {
2986                 /* Answer in remaining cases depends on existance of
2987                  * conflicting state; so we must wait out the grace period. */
2988                 return nfserr_grace;
2989         } else if (flags & WR_STATE)
2990                 return nfs4_share_conflict(current_fh,
2991                                 NFS4_SHARE_DENY_WRITE);
2992         else /* (flags & RD_STATE) && ZERO_STATEID(stateid) */
2993                 return nfs4_share_conflict(current_fh,
2994                                 NFS4_SHARE_DENY_READ);
2995 }
2996
2997 /*
2998  * Allow READ/WRITE during grace period on recovered state only for files
2999  * that are not able to provide mandatory locking.
3000  */
3001 static inline int
3002 grace_disallows_io(struct inode *inode)
3003 {
3004         return locks_in_grace() && mandatory_lock(inode);
3005 }
3006
3007 static int check_stateid_generation(stateid_t *in, stateid_t *ref, int flags)
3008 {
3009         /*
3010          * When sessions are used the stateid generation number is ignored
3011          * when it is zero.
3012          */
3013         if ((flags & HAS_SESSION) && in->si_generation == 0)
3014                 goto out;
3015
3016         /* If the client sends us a stateid from the future, it's buggy: */
3017         if (in->si_generation > ref->si_generation)
3018                 return nfserr_bad_stateid;
3019         /*
3020          * The following, however, can happen.  For example, if the
3021          * client sends an open and some IO at the same time, the open
3022          * may bump si_generation while the IO is still in flight.
3023          * Thanks to hard links and renames, the client never knows what
3024          * file an open will affect.  So it could avoid that situation
3025          * only by serializing all opens and IO from the same open
3026          * owner.  To recover from the old_stateid error, the client
3027          * will just have to retry the IO:
3028          */
3029         if (in->si_generation < ref->si_generation)
3030                 return nfserr_old_stateid;
3031 out:
3032         return nfs_ok;
3033 }
3034
3035 static int is_delegation_stateid(stateid_t *stateid)
3036 {
3037         return stateid->si_fileid == 0;
3038 }
3039
3040 /*
3041 * Checks for stateid operations
3042 */
3043 __be32
3044 nfs4_preprocess_stateid_op(struct nfsd4_compound_state *cstate,
3045                            stateid_t *stateid, int flags, struct file **filpp)
3046 {
3047         struct nfs4_stateid *stp = NULL;
3048         struct nfs4_delegation *dp = NULL;
3049         struct svc_fh *current_fh = &cstate->current_fh;
3050         struct inode *ino = current_fh->fh_dentry->d_inode;
3051         __be32 status;
3052
3053         if (filpp)
3054                 *filpp = NULL;
3055
3056         if (grace_disallows_io(ino))
3057                 return nfserr_grace;
3058
3059         if (nfsd4_has_session(cstate))
3060                 flags |= HAS_SESSION;
3061
3062         if (ZERO_STATEID(stateid) || ONE_STATEID(stateid))
3063                 return check_special_stateids(current_fh, stateid, flags);
3064
3065         status = nfserr_stale_stateid;
3066         if (STALE_STATEID(stateid)) 
3067                 goto out;
3068
3069         /*
3070          * We assume that any stateid that has the current boot time,
3071          * but that we can't find, is expired:
3072          */
3073         status = nfserr_expired;
3074         if (is_delegation_stateid(stateid)) {
3075                 dp = find_delegation_stateid(ino, stateid);
3076                 if (!dp)
3077                         goto out;
3078                 status = check_stateid_generation(stateid, &dp->dl_stateid,
3079                                                   flags);
3080                 if (status)
3081                         goto out;
3082                 status = nfs4_check_delegmode(dp, flags);
3083                 if (status)
3084                         goto out;
3085                 renew_client(dp->dl_client);
3086                 if (filpp)
3087                         *filpp = find_readable_file(dp->dl_file);
3088                 BUG_ON(!*filpp);
3089         } else { /* open or lock stateid */
3090                 stp = find_stateid(stateid, flags);
3091                 if (!stp)
3092                         goto out;
3093                 status = nfserr_bad_stateid;
3094                 if (nfs4_check_fh(current_fh, stp))
3095                         goto out;
3096                 if (!stp->st_stateowner->so_confirmed)
3097                         goto out;
3098                 status = check_stateid_generation(stateid, &stp->st_stateid,
3099                                                   flags);
3100                 if (status)
3101                         goto out;
3102                 status = nfs4_check_openmode(stp, flags);
3103                 if (status)
3104                         goto out;
3105                 renew_client(stp->st_stateowner->so_client);
3106                 if (filpp) {
3107                         if (flags & RD_STATE)
3108                                 *filpp = find_readable_file(stp->st_file);
3109                         else
3110                                 *filpp = find_writeable_file(stp->st_file);
3111                 }
3112         }
3113         status = nfs_ok;
3114 out:
3115         return status;
3116 }
3117
3118 static inline int
3119 setlkflg (int type)
3120 {
3121         return (type == NFS4_READW_LT || type == NFS4_READ_LT) ?
3122                 RD_STATE : WR_STATE;
3123 }
3124
3125 /* 
3126  * Checks for sequence id mutating operations. 
3127  */
3128 static __be32
3129 nfs4_preprocess_seqid_op(struct nfsd4_compound_state *cstate, u32 seqid,
3130                          stateid_t *stateid, int flags,
3131                          struct nfs4_stateowner **sopp,
3132                          struct nfs4_stateid **stpp, struct nfsd4_lock *lock)
3133 {
3134         struct nfs4_stateid *stp;
3135         struct nfs4_stateowner *sop;
3136         struct svc_fh *current_fh = &cstate->current_fh;
3137         __be32 status;
3138
3139         dprintk("NFSD: %s: seqid=%d stateid = " STATEID_FMT "\n", __func__,
3140                 seqid, STATEID_VAL(stateid));
3141
3142         *stpp = NULL;
3143         *sopp = NULL;
3144
3145         if (ZERO_STATEID(stateid) || ONE_STATEID(stateid)) {
3146                 dprintk("NFSD: preprocess_seqid_op: magic stateid!\n");
3147                 return nfserr_bad_stateid;
3148         }
3149
3150         if (STALE_STATEID(stateid))
3151                 return nfserr_stale_stateid;
3152
3153         if (nfsd4_has_session(cstate))
3154                 flags |= HAS_SESSION;
3155
3156         /*
3157         * We return BAD_STATEID if filehandle doesn't match stateid, 
3158         * the confirmed flag is incorrecly set, or the generation 
3159         * number is incorrect.  
3160         */
3161         stp = find_stateid(stateid, flags);
3162         if (stp == NULL) {
3163                 /*
3164                  * Also, we should make sure this isn't just the result of
3165                  * a replayed close:
3166                  */
3167                 sop = search_close_lru(stateid->si_stateownerid, flags);
3168                 /* It's not stale; let's assume it's expired: */
3169                 if (sop == NULL)
3170                         return nfserr_expired;
3171                 *sopp = sop;
3172                 goto check_replay;
3173         }
3174
3175         *stpp = stp;
3176         *sopp = sop = stp->st_stateowner;
3177
3178         if (lock) {
3179                 clientid_t *lockclid = &lock->v.new.clientid;
3180                 struct nfs4_client *clp = sop->so_client;
3181                 int lkflg = 0;
3182                 __be32 status;
3183
3184                 lkflg = setlkflg(lock->lk_type);
3185
3186                 if (lock->lk_is_new) {
3187                         if (!sop->so_is_open_owner)
3188                                 return nfserr_bad_stateid;
3189                         if (!(flags & HAS_SESSION) &&
3190                             !same_clid(&clp->cl_clientid, lockclid))
3191                                 return nfserr_bad_stateid;
3192                         /* stp is the open stateid */
3193                         status = nfs4_check_openmode(stp, lkflg);
3194                         if (status)
3195                                 return status;
3196                 } else {
3197                         /* stp is the lock stateid */
3198                         status = nfs4_check_openmode(stp->st_openstp, lkflg);
3199                         if (status)
3200                                 return status;
3201                }
3202         }
3203
3204         if (nfs4_check_fh(current_fh, stp)) {
3205                 dprintk("NFSD: preprocess_seqid_op: fh-stateid mismatch!\n");
3206                 return nfserr_bad_stateid;
3207         }
3208
3209         /*
3210         *  We now validate the seqid and stateid generation numbers.
3211         *  For the moment, we ignore the possibility of 
3212         *  generation number wraparound.
3213         */
3214         if (!(flags & HAS_SESSION) && seqid != sop->so_seqid)
3215                 goto check_replay;
3216
3217         if (sop->so_confirmed && flags & CONFIRM) {
3218                 dprintk("NFSD: preprocess_seqid_op: expected"
3219                                 " unconfirmed stateowner!\n");
3220                 return nfserr_bad_stateid;
3221         }
3222         if (!sop->so_confirmed && !(flags & CONFIRM)) {
3223                 dprintk("NFSD: preprocess_seqid_op: stateowner not"
3224                                 " confirmed yet!\n");
3225                 return nfserr_bad_stateid;
3226         }
3227         status = check_stateid_generation(stateid, &stp->st_stateid, flags);
3228         if (status)
3229                 return status;
3230         renew_client(sop->so_client);
3231         return nfs_ok;
3232
3233 check_replay:
3234         if (seqid == sop->so_seqid - 1) {
3235                 dprintk("NFSD: preprocess_seqid_op: retransmission?\n");
3236                 /* indicate replay to calling function */
3237                 return nfserr_replay_me;
3238         }
3239         dprintk("NFSD: preprocess_seqid_op: bad seqid (expected %d, got %d)\n",
3240                         sop->so_seqid, seqid);
3241         *sopp = NULL;
3242         return nfserr_bad_seqid;
3243 }
3244
3245 __be32
3246 nfsd4_open_confirm(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
3247                    struct nfsd4_open_confirm *oc)
3248 {
3249         __be32 status;
3250         struct nfs4_stateowner *sop;
3251         struct nfs4_stateid *stp;
3252
3253         dprintk("NFSD: nfsd4_open_confirm on file %.*s\n",
3254                         (int)cstate->current_fh.fh_dentry->d_name.len,
3255                         cstate->current_fh.fh_dentry->d_name.name);
3256
3257         status = fh_verify(rqstp, &cstate->current_fh, S_IFREG, 0);
3258         if (status)
3259                 return status;
3260
3261         nfs4_lock_state();
3262
3263         if ((status = nfs4_preprocess_seqid_op(cstate,
3264                                         oc->oc_seqid, &oc->oc_req_stateid,
3265                                         CONFIRM | OPEN_STATE,
3266                                         &oc->oc_stateowner, &stp, NULL)))
3267                 goto out; 
3268
3269         sop = oc->oc_stateowner;
3270         sop->so_confirmed = 1;
3271         update_stateid(&stp->st_stateid);
3272         memcpy(&oc->oc_resp_stateid, &stp->st_stateid, sizeof(stateid_t));
3273         dprintk("NFSD: %s: success, seqid=%d stateid=" STATEID_FMT "\n",
3274                 __func__, oc->oc_seqid, STATEID_VAL(&stp->st_stateid));
3275
3276         nfsd4_create_clid_dir(sop->so_client);
3277 out:
3278         if (oc->oc_stateowner) {
3279                 nfs4_get_stateowner(oc->oc_stateowner);
3280                 cstate->replay_owner = oc->oc_stateowner;
3281         }
3282         nfs4_unlock_state();
3283         return status;
3284 }
3285
3286
3287 /*
3288  * unset all bits in union bitmap (bmap) that
3289  * do not exist in share (from successful OPEN_DOWNGRADE)
3290  */
3291 static void
3292 reset_union_bmap_access(unsigned long access, unsigned long *bmap)
3293 {
3294         int i;
3295         for (i = 1; i < 4; i++) {
3296                 if ((i & access) != i)
3297                         __clear_bit(i, bmap);
3298         }
3299 }
3300
3301 static void
3302 reset_union_bmap_deny(unsigned long deny, unsigned long *bmap)
3303 {
3304         int i;
3305         for (i = 0; i < 4; i++) {
3306                 if ((i & deny) != i)
3307                         __clear_bit(i, bmap);
3308         }
3309 }
3310
3311 __be32
3312 nfsd4_open_downgrade(struct svc_rqst *rqstp,
3313                      struct nfsd4_compound_state *cstate,
3314                      struct nfsd4_open_downgrade *od)
3315 {
3316         __be32 status;
3317         struct nfs4_stateid *stp;
3318         unsigned int share_access;
3319
3320         dprintk("NFSD: nfsd4_open_downgrade on file %.*s\n", 
3321                         (int)cstate->current_fh.fh_dentry->d_name.len,
3322                         cstate->current_fh.fh_dentry->d_name.name);
3323
3324         if (!access_valid(od->od_share_access, cstate->minorversion)
3325                         || !deny_valid(od->od_share_deny))
3326                 return nfserr_inval;
3327
3328         nfs4_lock_state();
3329         if ((status = nfs4_preprocess_seqid_op(cstate,
3330                                         od->od_seqid,
3331                                         &od->od_stateid, 
3332                                         OPEN_STATE,
3333                                         &od->od_stateowner, &stp, NULL)))
3334                 goto out; 
3335
3336         status = nfserr_inval;
3337         if (!test_bit(od->od_share_access, &stp->st_access_bmap)) {
3338                 dprintk("NFSD:access not a subset current bitmap: 0x%lx, input access=%08x\n",
3339                         stp->st_access_bmap, od->od_share_access);
3340                 goto out;
3341         }
3342         if (!test_bit(od->od_share_deny, &stp->st_deny_bmap)) {
3343                 dprintk("NFSD:deny not a subset current bitmap: 0x%lx, input deny=%08x\n",
3344                         stp->st_deny_bmap, od->od_share_deny);
3345                 goto out;
3346         }
3347         set_access(&share_access, stp->st_access_bmap);
3348         nfs4_file_downgrade(stp->st_file, share_access & ~od->od_share_access);
3349
3350         reset_union_bmap_access(od->od_share_access, &stp->st_access_bmap);
3351         reset_union_bmap_deny(od->od_share_deny, &stp->st_deny_bmap);
3352
3353         update_stateid(&stp->st_stateid);
3354         memcpy(&od->od_stateid, &stp->st_stateid, sizeof(stateid_t));
3355         status = nfs_ok;
3356 out:
3357         if (od->od_stateowner) {
3358                 nfs4_get_stateowner(od->od_stateowner);
3359                 cstate->replay_owner = od->od_stateowner;
3360         }
3361         nfs4_unlock_state();
3362         return status;
3363 }
3364
3365 /*
3366  * nfs4_unlock_state() called after encode
3367  */
3368 __be32
3369 nfsd4_close(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
3370             struct nfsd4_close *close)
3371 {
3372         __be32 status;
3373         struct nfs4_stateid *stp;
3374
3375         dprintk("NFSD: nfsd4_close on file %.*s\n", 
3376                         (int)cstate->current_fh.fh_dentry->d_name.len,
3377                         cstate->current_fh.fh_dentry->d_name.name);
3378
3379         nfs4_lock_state();
3380         /* check close_lru for replay */
3381         if ((status = nfs4_preprocess_seqid_op(cstate,
3382                                         close->cl_seqid,
3383                                         &close->cl_stateid, 
3384                                         OPEN_STATE | CLOSE_STATE,
3385                                         &close->cl_stateowner, &stp, NULL)))
3386                 goto out; 
3387         status = nfs_ok;
3388         update_stateid(&stp->st_stateid);
3389         memcpy(&close->cl_stateid, &stp->st_stateid, sizeof(stateid_t));
3390
3391         /* release_stateid() calls nfsd_close() if needed */
3392         release_open_stateid(stp);
3393
3394         /* place unused nfs4_stateowners on so_close_lru list to be
3395          * released by the laundromat service after the lease period
3396          * to enable us to handle CLOSE replay
3397          */
3398         if (list_empty(&close->cl_stateowner->so_stateids))
3399                 move_to_close_lru(close->cl_stateowner);
3400 out:
3401         if (close->cl_stateowner) {
3402                 nfs4_get_stateowner(close->cl_stateowner);
3403                 cstate->replay_owner = close->cl_stateowner;
3404         }
3405         nfs4_unlock_state();
3406         return status;
3407 }
3408
3409 __be32
3410 nfsd4_delegreturn(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
3411                   struct nfsd4_delegreturn *dr)
3412 {
3413         struct nfs4_delegation *dp;
3414         stateid_t *stateid = &dr->dr_stateid;
3415         struct inode *inode;
3416         __be32 status;
3417         int flags = 0;
3418
3419         if ((status = fh_verify(rqstp, &cstate->current_fh, S_IFREG, 0)))
3420                 return status;
3421         inode = cstate->current_fh.fh_dentry->d_inode;
3422
3423         if (nfsd4_has_session(cstate))
3424                 flags |= HAS_SESSION;
3425         nfs4_lock_state();
3426         status = nfserr_bad_stateid;
3427         if (ZERO_STATEID(stateid) || ONE_STATEID(stateid))
3428                 goto out;
3429         status = nfserr_stale_stateid;
3430         if (STALE_STATEID(stateid))
3431                 goto out;
3432         status = nfserr_bad_stateid;
3433         if (!is_delegation_stateid(stateid))
3434                 goto out;
3435         status = nfserr_expired;
3436         dp = find_delegation_stateid(inode, stateid);
3437         if (!dp)
3438                 goto out;
3439         status = check_stateid_generation(stateid, &dp->dl_stateid, flags);
3440         if (status)
3441                 goto out;
3442         renew_client(dp->dl_client);
3443
3444         unhash_delegation(dp);
3445 out:
3446         nfs4_unlock_state();
3447
3448         return status;
3449 }
3450
3451
3452 /* 
3453  * Lock owner state (byte-range locks)
3454  */
3455 #define LOFF_OVERFLOW(start, len)      ((u64)(len) > ~(u64)(start))
3456 #define LOCK_HASH_BITS              8
3457 #define LOCK_HASH_SIZE             (1 << LOCK_HASH_BITS)
3458 #define LOCK_HASH_MASK             (LOCK_HASH_SIZE - 1)
3459
3460 static inline u64
3461 end_offset(u64 start, u64 len)
3462 {
3463         u64 end;
3464
3465         end = start + len;
3466         return end >= start ? end: NFS4_MAX_UINT64;
3467 }
3468
3469 /* last octet in a range */
3470 static inline u64
3471 last_byte_offset(u64 start, u64 len)
3472 {
3473         u64 end;
3474
3475         BUG_ON(!len);
3476         end = start + len;
3477         return end > start ? end - 1: NFS4_MAX_UINT64;
3478 }
3479
3480 #define lockownerid_hashval(id) \
3481         ((id) & LOCK_HASH_MASK)
3482
3483 static inline unsigned int
3484 lock_ownerstr_hashval(struct inode *inode, u32 cl_id,
3485                 struct xdr_netobj *ownername)
3486 {
3487         return (file_hashval(inode) + cl_id
3488                         + opaque_hashval(ownername->data, ownername->len))
3489                 & LOCK_HA