1/*
2 *  Copyright (c) 2001 The Regents of the University of Michigan.
3 *  All rights reserved.
4 *
5 *  Kendrick Smith <kmsmith@umich.edu>
6 *  Andy Adamson <andros@umich.edu>
7 *
8 *  Redistribution and use in source and binary forms, with or without
9 *  modification, are permitted provided that the following conditions
10 *  are met:
11 *
12 *  1. Redistributions of source code must retain the above copyright
13 *     notice, this list of conditions and the following disclaimer.
14 *  2. Redistributions in binary form must reproduce the above copyright
15 *     notice, this list of conditions and the following disclaimer in the
16 *     documentation and/or other materials provided with the distribution.
17 *  3. Neither the name of the University nor the names of its
18 *     contributors may be used to endorse or promote products derived
19 *     from this software without specific prior written permission.
20 *
21 *  THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
22 *  WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
23 *  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
24 *  DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
25 *  FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
26 *  CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
27 *  SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
28 *  BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
29 *  LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
30 *  NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
31 *  SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
32 */
33
34#include <linux/sunrpc/clnt.h>
35#include <linux/sunrpc/xprt.h>
36#include <linux/sunrpc/svc_xprt.h>
37#include <linux/slab.h>
38#include "nfsd.h"
39#include "state.h"
40#include "netns.h"
41#include "xdr4cb.h"
42
43#define NFSDDBG_FACILITY                NFSDDBG_PROC
44
45static void nfsd4_mark_cb_fault(struct nfs4_client *, int reason);
46
47#define NFSPROC4_CB_NULL 0
48#define NFSPROC4_CB_COMPOUND 1
49
50/* Index of predefined Linux callback client operations */
51
52struct nfs4_cb_compound_hdr {
53	/* args */
54	u32		ident;	/* minorversion 0 only */
55	u32		nops;
56	__be32		*nops_p;
57	u32		minorversion;
58	/* res */
59	int		status;
60};
61
62/*
63 * Handle decode buffer overflows out-of-line.
64 */
65static void print_overflow_msg(const char *func, const struct xdr_stream *xdr)
66{
67	dprintk("NFS: %s prematurely hit the end of our receive buffer. "
68		"Remaining buffer length is %tu words.\n",
69		func, xdr->end - xdr->p);
70}
71
72static __be32 *xdr_encode_empty_array(__be32 *p)
73{
74	*p++ = xdr_zero;
75	return p;
76}
77
78/*
79 * Encode/decode NFSv4 CB basic data types
80 *
81 * Basic NFSv4 callback data types are defined in section 15 of RFC
82 * 3530: "Network File System (NFS) version 4 Protocol" and section
83 * 20 of RFC 5661: "Network File System (NFS) Version 4 Minor Version
84 * 1 Protocol"
85 */
86
87/*
88 *	nfs_cb_opnum4
89 *
90 *	enum nfs_cb_opnum4 {
91 *		OP_CB_GETATTR		= 3,
92 *		  ...
93 *	};
94 */
95enum nfs_cb_opnum4 {
96	OP_CB_GETATTR			= 3,
97	OP_CB_RECALL			= 4,
98	OP_CB_LAYOUTRECALL		= 5,
99	OP_CB_NOTIFY			= 6,
100	OP_CB_PUSH_DELEG		= 7,
101	OP_CB_RECALL_ANY		= 8,
102	OP_CB_RECALLABLE_OBJ_AVAIL	= 9,
103	OP_CB_RECALL_SLOT		= 10,
104	OP_CB_SEQUENCE			= 11,
105	OP_CB_WANTS_CANCELLED		= 12,
106	OP_CB_NOTIFY_LOCK		= 13,
107	OP_CB_NOTIFY_DEVICEID		= 14,
108	OP_CB_ILLEGAL			= 10044
109};
110
111static void encode_nfs_cb_opnum4(struct xdr_stream *xdr, enum nfs_cb_opnum4 op)
112{
113	__be32 *p;
114
115	p = xdr_reserve_space(xdr, 4);
116	*p = cpu_to_be32(op);
117}
118
119/*
120 * nfs_fh4
121 *
122 *	typedef opaque nfs_fh4<NFS4_FHSIZE>;
123 */
124static void encode_nfs_fh4(struct xdr_stream *xdr, const struct knfsd_fh *fh)
125{
126	u32 length = fh->fh_size;
127	__be32 *p;
128
129	BUG_ON(length > NFS4_FHSIZE);
130	p = xdr_reserve_space(xdr, 4 + length);
131	xdr_encode_opaque(p, &fh->fh_base, length);
132}
133
134/*
135 * stateid4
136 *
137 *	struct stateid4 {
138 *		uint32_t	seqid;
139 *		opaque		other[12];
140 *	};
141 */
142static void encode_stateid4(struct xdr_stream *xdr, const stateid_t *sid)
143{
144	__be32 *p;
145
146	p = xdr_reserve_space(xdr, NFS4_STATEID_SIZE);
147	*p++ = cpu_to_be32(sid->si_generation);
148	xdr_encode_opaque_fixed(p, &sid->si_opaque, NFS4_STATEID_OTHER_SIZE);
149}
150
151/*
152 * sessionid4
153 *
154 *	typedef opaque sessionid4[NFS4_SESSIONID_SIZE];
155 */
156static void encode_sessionid4(struct xdr_stream *xdr,
157			      const struct nfsd4_session *session)
158{
159	__be32 *p;
160
161	p = xdr_reserve_space(xdr, NFS4_MAX_SESSIONID_LEN);
162	xdr_encode_opaque_fixed(p, session->se_sessionid.data,
163					NFS4_MAX_SESSIONID_LEN);
164}
165
166/*
167 * nfsstat4
168 */
169static const struct {
170	int stat;
171	int errno;
172} nfs_cb_errtbl[] = {
173	{ NFS4_OK,		0		},
174	{ NFS4ERR_PERM,		-EPERM		},
175	{ NFS4ERR_NOENT,	-ENOENT		},
176	{ NFS4ERR_IO,		-EIO		},
177	{ NFS4ERR_NXIO,		-ENXIO		},
178	{ NFS4ERR_ACCESS,	-EACCES		},
179	{ NFS4ERR_EXIST,	-EEXIST		},
180	{ NFS4ERR_XDEV,		-EXDEV		},
181	{ NFS4ERR_NOTDIR,	-ENOTDIR	},
182	{ NFS4ERR_ISDIR,	-EISDIR		},
183	{ NFS4ERR_INVAL,	-EINVAL		},
184	{ NFS4ERR_FBIG,		-EFBIG		},
185	{ NFS4ERR_NOSPC,	-ENOSPC		},
186	{ NFS4ERR_ROFS,		-EROFS		},
187	{ NFS4ERR_MLINK,	-EMLINK		},
188	{ NFS4ERR_NAMETOOLONG,	-ENAMETOOLONG	},
189	{ NFS4ERR_NOTEMPTY,	-ENOTEMPTY	},
190	{ NFS4ERR_DQUOT,	-EDQUOT		},
191	{ NFS4ERR_STALE,	-ESTALE		},
192	{ NFS4ERR_BADHANDLE,	-EBADHANDLE	},
193	{ NFS4ERR_BAD_COOKIE,	-EBADCOOKIE	},
194	{ NFS4ERR_NOTSUPP,	-ENOTSUPP	},
195	{ NFS4ERR_TOOSMALL,	-ETOOSMALL	},
196	{ NFS4ERR_SERVERFAULT,	-ESERVERFAULT	},
197	{ NFS4ERR_BADTYPE,	-EBADTYPE	},
198	{ NFS4ERR_LOCKED,	-EAGAIN		},
199	{ NFS4ERR_RESOURCE,	-EREMOTEIO	},
200	{ NFS4ERR_SYMLINK,	-ELOOP		},
201	{ NFS4ERR_OP_ILLEGAL,	-EOPNOTSUPP	},
202	{ NFS4ERR_DEADLOCK,	-EDEADLK	},
203	{ -1,			-EIO		}
204};
205
206/*
207 * If we cannot translate the error, the recovery routines should
208 * handle it.
209 *
210 * Note: remaining NFSv4 error codes have values > 10000, so should
211 * not conflict with native Linux error codes.
212 */
213static int nfs_cb_stat_to_errno(int status)
214{
215	int i;
216
217	for (i = 0; nfs_cb_errtbl[i].stat != -1; i++) {
218		if (nfs_cb_errtbl[i].stat == status)
219			return nfs_cb_errtbl[i].errno;
220	}
221
222	dprintk("NFSD: Unrecognized NFS CB status value: %u\n", status);
223	return -status;
224}
225
226static int decode_cb_op_status(struct xdr_stream *xdr, enum nfs_opnum4 expected,
227			       int *status)
228{
229	__be32 *p;
230	u32 op;
231
232	p = xdr_inline_decode(xdr, 4 + 4);
233	if (unlikely(p == NULL))
234		goto out_overflow;
235	op = be32_to_cpup(p++);
236	if (unlikely(op != expected))
237		goto out_unexpected;
238	*status = nfs_cb_stat_to_errno(be32_to_cpup(p));
239	return 0;
240out_overflow:
241	print_overflow_msg(__func__, xdr);
242	return -EIO;
243out_unexpected:
244	dprintk("NFSD: Callback server returned operation %d but "
245		"we issued a request for %d\n", op, expected);
246	return -EIO;
247}
248
249/*
250 * CB_COMPOUND4args
251 *
252 *	struct CB_COMPOUND4args {
253 *		utf8str_cs	tag;
254 *		uint32_t	minorversion;
255 *		uint32_t	callback_ident;
256 *		nfs_cb_argop4	argarray<>;
257 *	};
258*/
259static void encode_cb_compound4args(struct xdr_stream *xdr,
260				    struct nfs4_cb_compound_hdr *hdr)
261{
262	__be32 * p;
263
264	p = xdr_reserve_space(xdr, 4 + 4 + 4 + 4);
265	p = xdr_encode_empty_array(p);		/* empty tag */
266	*p++ = cpu_to_be32(hdr->minorversion);
267	*p++ = cpu_to_be32(hdr->ident);
268
269	hdr->nops_p = p;
270	*p = cpu_to_be32(hdr->nops);		/* argarray element count */
271}
272
273/*
274 * Update argarray element count
275 */
276static void encode_cb_nops(struct nfs4_cb_compound_hdr *hdr)
277{
278	BUG_ON(hdr->nops > NFS4_MAX_BACK_CHANNEL_OPS);
279	*hdr->nops_p = cpu_to_be32(hdr->nops);
280}
281
282/*
283 * CB_COMPOUND4res
284 *
285 *	struct CB_COMPOUND4res {
286 *		nfsstat4	status;
287 *		utf8str_cs	tag;
288 *		nfs_cb_resop4	resarray<>;
289 *	};
290 */
291static int decode_cb_compound4res(struct xdr_stream *xdr,
292				  struct nfs4_cb_compound_hdr *hdr)
293{
294	u32 length;
295	__be32 *p;
296
297	p = xdr_inline_decode(xdr, 4 + 4);
298	if (unlikely(p == NULL))
299		goto out_overflow;
300	hdr->status = be32_to_cpup(p++);
301	/* Ignore the tag */
302	length = be32_to_cpup(p++);
303	p = xdr_inline_decode(xdr, length + 4);
304	if (unlikely(p == NULL))
305		goto out_overflow;
306	hdr->nops = be32_to_cpup(p);
307	return 0;
308out_overflow:
309	print_overflow_msg(__func__, xdr);
310	return -EIO;
311}
312
313/*
314 * CB_RECALL4args
315 *
316 *	struct CB_RECALL4args {
317 *		stateid4	stateid;
318 *		bool		truncate;
319 *		nfs_fh4		fh;
320 *	};
321 */
322static void encode_cb_recall4args(struct xdr_stream *xdr,
323				  const struct nfs4_delegation *dp,
324				  struct nfs4_cb_compound_hdr *hdr)
325{
326	__be32 *p;
327
328	encode_nfs_cb_opnum4(xdr, OP_CB_RECALL);
329	encode_stateid4(xdr, &dp->dl_stid.sc_stateid);
330
331	p = xdr_reserve_space(xdr, 4);
332	*p++ = xdr_zero;			/* truncate */
333
334	encode_nfs_fh4(xdr, &dp->dl_stid.sc_file->fi_fhandle);
335
336	hdr->nops++;
337}
338
339/*
340 * CB_SEQUENCE4args
341 *
342 *	struct CB_SEQUENCE4args {
343 *		sessionid4		csa_sessionid;
344 *		sequenceid4		csa_sequenceid;
345 *		slotid4			csa_slotid;
346 *		slotid4			csa_highest_slotid;
347 *		bool			csa_cachethis;
348 *		referring_call_list4	csa_referring_call_lists<>;
349 *	};
350 */
351static void encode_cb_sequence4args(struct xdr_stream *xdr,
352				    const struct nfsd4_callback *cb,
353				    struct nfs4_cb_compound_hdr *hdr)
354{
355	struct nfsd4_session *session = cb->cb_clp->cl_cb_session;
356	__be32 *p;
357
358	if (hdr->minorversion == 0)
359		return;
360
361	encode_nfs_cb_opnum4(xdr, OP_CB_SEQUENCE);
362	encode_sessionid4(xdr, session);
363
364	p = xdr_reserve_space(xdr, 4 + 4 + 4 + 4 + 4);
365	*p++ = cpu_to_be32(session->se_cb_seq_nr);	/* csa_sequenceid */
366	*p++ = xdr_zero;			/* csa_slotid */
367	*p++ = xdr_zero;			/* csa_highest_slotid */
368	*p++ = xdr_zero;			/* csa_cachethis */
369	xdr_encode_empty_array(p);		/* csa_referring_call_lists */
370
371	hdr->nops++;
372}
373
374/*
375 * CB_SEQUENCE4resok
376 *
377 *	struct CB_SEQUENCE4resok {
378 *		sessionid4	csr_sessionid;
379 *		sequenceid4	csr_sequenceid;
380 *		slotid4		csr_slotid;
381 *		slotid4		csr_highest_slotid;
382 *		slotid4		csr_target_highest_slotid;
383 *	};
384 *
385 *	union CB_SEQUENCE4res switch (nfsstat4 csr_status) {
386 *	case NFS4_OK:
387 *		CB_SEQUENCE4resok	csr_resok4;
388 *	default:
389 *		void;
390 *	};
391 *
392 * Our current back channel implmentation supports a single backchannel
393 * with a single slot.
394 */
395static int decode_cb_sequence4resok(struct xdr_stream *xdr,
396				    struct nfsd4_callback *cb)
397{
398	struct nfsd4_session *session = cb->cb_clp->cl_cb_session;
399	struct nfs4_sessionid id;
400	int status;
401	__be32 *p;
402	u32 dummy;
403
404	status = -ESERVERFAULT;
405
406	/*
407	 * If the server returns different values for sessionID, slotID or
408	 * sequence number, the server is looney tunes.
409	 */
410	p = xdr_inline_decode(xdr, NFS4_MAX_SESSIONID_LEN + 4 + 4 + 4 + 4);
411	if (unlikely(p == NULL))
412		goto out_overflow;
413	memcpy(id.data, p, NFS4_MAX_SESSIONID_LEN);
414	if (memcmp(id.data, session->se_sessionid.data,
415					NFS4_MAX_SESSIONID_LEN) != 0) {
416		dprintk("NFS: %s Invalid session id\n", __func__);
417		goto out;
418	}
419	p += XDR_QUADLEN(NFS4_MAX_SESSIONID_LEN);
420
421	dummy = be32_to_cpup(p++);
422	if (dummy != session->se_cb_seq_nr) {
423		dprintk("NFS: %s Invalid sequence number\n", __func__);
424		goto out;
425	}
426
427	dummy = be32_to_cpup(p++);
428	if (dummy != 0) {
429		dprintk("NFS: %s Invalid slotid\n", __func__);
430		goto out;
431	}
432
433	/*
434	 * FIXME: process highest slotid and target highest slotid
435	 */
436	status = 0;
437out:
438	if (status)
439		nfsd4_mark_cb_fault(cb->cb_clp, status);
440	return status;
441out_overflow:
442	print_overflow_msg(__func__, xdr);
443	return -EIO;
444}
445
446static int decode_cb_sequence4res(struct xdr_stream *xdr,
447				  struct nfsd4_callback *cb)
448{
449	int status;
450
451	if (cb->cb_minorversion == 0)
452		return 0;
453
454	status = decode_cb_op_status(xdr, OP_CB_SEQUENCE, &cb->cb_status);
455	if (unlikely(status || cb->cb_status))
456		return status;
457
458	return decode_cb_sequence4resok(xdr, cb);
459}
460
461/*
462 * NFSv4.0 and NFSv4.1 XDR encode functions
463 *
464 * NFSv4.0 callback argument types are defined in section 15 of RFC
465 * 3530: "Network File System (NFS) version 4 Protocol" and section 20
466 * of RFC 5661:  "Network File System (NFS) Version 4 Minor Version 1
467 * Protocol".
468 */
469
470/*
471 * NB: Without this zero space reservation, callbacks over krb5p fail
472 */
473static void nfs4_xdr_enc_cb_null(struct rpc_rqst *req, struct xdr_stream *xdr,
474				 void *__unused)
475{
476	xdr_reserve_space(xdr, 0);
477}
478
479/*
480 * 20.2. Operation 4: CB_RECALL - Recall a Delegation
481 */
482static void nfs4_xdr_enc_cb_recall(struct rpc_rqst *req, struct xdr_stream *xdr,
483				   const struct nfsd4_callback *cb)
484{
485	const struct nfs4_delegation *dp = cb_to_delegation(cb);
486	struct nfs4_cb_compound_hdr hdr = {
487		.ident = cb->cb_clp->cl_cb_ident,
488		.minorversion = cb->cb_minorversion,
489	};
490
491	encode_cb_compound4args(xdr, &hdr);
492	encode_cb_sequence4args(xdr, cb, &hdr);
493	encode_cb_recall4args(xdr, dp, &hdr);
494	encode_cb_nops(&hdr);
495}
496
497
498/*
499 * NFSv4.0 and NFSv4.1 XDR decode functions
500 *
501 * NFSv4.0 callback result types are defined in section 15 of RFC
502 * 3530: "Network File System (NFS) version 4 Protocol" and section 20
503 * of RFC 5661:  "Network File System (NFS) Version 4 Minor Version 1
504 * Protocol".
505 */
506
507static int nfs4_xdr_dec_cb_null(struct rpc_rqst *req, struct xdr_stream *xdr,
508				void *__unused)
509{
510	return 0;
511}
512
513/*
514 * 20.2. Operation 4: CB_RECALL - Recall a Delegation
515 */
516static int nfs4_xdr_dec_cb_recall(struct rpc_rqst *rqstp,
517				  struct xdr_stream *xdr,
518				  struct nfsd4_callback *cb)
519{
520	struct nfs4_cb_compound_hdr hdr;
521	int status;
522
523	status = decode_cb_compound4res(xdr, &hdr);
524	if (unlikely(status))
525		return status;
526
527	if (cb != NULL) {
528		status = decode_cb_sequence4res(xdr, cb);
529		if (unlikely(status || cb->cb_status))
530			return status;
531	}
532
533	return decode_cb_op_status(xdr, OP_CB_RECALL, &cb->cb_status);
534}
535
536#ifdef CONFIG_NFSD_PNFS
537/*
538 * CB_LAYOUTRECALL4args
539 *
540 *	struct layoutrecall_file4 {
541 *		nfs_fh4         lor_fh;
542 *		offset4         lor_offset;
543 *		length4         lor_length;
544 *		stateid4        lor_stateid;
545 *	};
546 *
547 *	union layoutrecall4 switch(layoutrecall_type4 lor_recalltype) {
548 *	case LAYOUTRECALL4_FILE:
549 *		layoutrecall_file4 lor_layout;
550 *	case LAYOUTRECALL4_FSID:
551 *		fsid4              lor_fsid;
552 *	case LAYOUTRECALL4_ALL:
553 *		void;
554 *	};
555 *
556 *	struct CB_LAYOUTRECALL4args {
557 *		layouttype4             clora_type;
558 *		layoutiomode4           clora_iomode;
559 *		bool                    clora_changed;
560 *		layoutrecall4           clora_recall;
561 *	};
562 */
563static void encode_cb_layout4args(struct xdr_stream *xdr,
564				  const struct nfs4_layout_stateid *ls,
565				  struct nfs4_cb_compound_hdr *hdr)
566{
567	__be32 *p;
568
569	BUG_ON(hdr->minorversion == 0);
570
571	p = xdr_reserve_space(xdr, 5 * 4);
572	*p++ = cpu_to_be32(OP_CB_LAYOUTRECALL);
573	*p++ = cpu_to_be32(ls->ls_layout_type);
574	*p++ = cpu_to_be32(IOMODE_ANY);
575	*p++ = cpu_to_be32(1);
576	*p = cpu_to_be32(RETURN_FILE);
577
578	encode_nfs_fh4(xdr, &ls->ls_stid.sc_file->fi_fhandle);
579
580	p = xdr_reserve_space(xdr, 2 * 8);
581	p = xdr_encode_hyper(p, 0);
582	xdr_encode_hyper(p, NFS4_MAX_UINT64);
583
584	encode_stateid4(xdr, &ls->ls_recall_sid);
585
586	hdr->nops++;
587}
588
589static void nfs4_xdr_enc_cb_layout(struct rpc_rqst *req,
590				   struct xdr_stream *xdr,
591				   const struct nfsd4_callback *cb)
592{
593	const struct nfs4_layout_stateid *ls =
594		container_of(cb, struct nfs4_layout_stateid, ls_recall);
595	struct nfs4_cb_compound_hdr hdr = {
596		.ident = 0,
597		.minorversion = cb->cb_minorversion,
598	};
599
600	encode_cb_compound4args(xdr, &hdr);
601	encode_cb_sequence4args(xdr, cb, &hdr);
602	encode_cb_layout4args(xdr, ls, &hdr);
603	encode_cb_nops(&hdr);
604}
605
606static int nfs4_xdr_dec_cb_layout(struct rpc_rqst *rqstp,
607				  struct xdr_stream *xdr,
608				  struct nfsd4_callback *cb)
609{
610	struct nfs4_cb_compound_hdr hdr;
611	int status;
612
613	status = decode_cb_compound4res(xdr, &hdr);
614	if (unlikely(status))
615		return status;
616
617	if (cb) {
618		status = decode_cb_sequence4res(xdr, cb);
619		if (unlikely(status || cb->cb_status))
620			return status;
621	}
622	return decode_cb_op_status(xdr, OP_CB_LAYOUTRECALL, &cb->cb_status);
623}
624#endif /* CONFIG_NFSD_PNFS */
625
626/*
627 * RPC procedure tables
628 */
629#define PROC(proc, call, argtype, restype)				\
630[NFSPROC4_CLNT_##proc] = {						\
631	.p_proc    = NFSPROC4_CB_##call,				\
632	.p_encode  = (kxdreproc_t)nfs4_xdr_enc_##argtype,		\
633	.p_decode  = (kxdrdproc_t)nfs4_xdr_dec_##restype,		\
634	.p_arglen  = NFS4_enc_##argtype##_sz,				\
635	.p_replen  = NFS4_dec_##restype##_sz,				\
636	.p_statidx = NFSPROC4_CB_##call,				\
637	.p_name    = #proc,						\
638}
639
640static struct rpc_procinfo nfs4_cb_procedures[] = {
641	PROC(CB_NULL,	NULL,		cb_null,	cb_null),
642	PROC(CB_RECALL,	COMPOUND,	cb_recall,	cb_recall),
643#ifdef CONFIG_NFSD_PNFS
644	PROC(CB_LAYOUT,	COMPOUND,	cb_layout,	cb_layout),
645#endif
646};
647
648static struct rpc_version nfs_cb_version4 = {
649/*
650 * Note on the callback rpc program version number: despite language in rfc
651 * 5661 section 18.36.3 requiring servers to use 4 in this field, the
652 * official xdr descriptions for both 4.0 and 4.1 specify version 1, and
653 * in practice that appears to be what implementations use.  The section
654 * 18.36.3 language is expected to be fixed in an erratum.
655 */
656	.number			= 1,
657	.nrprocs		= ARRAY_SIZE(nfs4_cb_procedures),
658	.procs			= nfs4_cb_procedures
659};
660
661static const struct rpc_version *nfs_cb_version[] = {
662	&nfs_cb_version4,
663};
664
665static const struct rpc_program cb_program;
666
667static struct rpc_stat cb_stats = {
668	.program		= &cb_program
669};
670
671#define NFS4_CALLBACK 0x40000000
672static const struct rpc_program cb_program = {
673	.name			= "nfs4_cb",
674	.number			= NFS4_CALLBACK,
675	.nrvers			= ARRAY_SIZE(nfs_cb_version),
676	.version		= nfs_cb_version,
677	.stats			= &cb_stats,
678	.pipe_dir_name		= "nfsd4_cb",
679};
680
681static int max_cb_time(struct net *net)
682{
683	struct nfsd_net *nn = net_generic(net, nfsd_net_id);
684	return max(nn->nfsd4_lease/10, (time_t)1) * HZ;
685}
686
687static struct rpc_cred *callback_cred;
688
689int set_callback_cred(void)
690{
691	if (callback_cred)
692		return 0;
693	callback_cred = rpc_lookup_machine_cred("nfs");
694	if (!callback_cred)
695		return -ENOMEM;
696	return 0;
697}
698
699static struct rpc_cred *get_backchannel_cred(struct nfs4_client *clp, struct rpc_clnt *client, struct nfsd4_session *ses)
700{
701	if (clp->cl_minorversion == 0) {
702		return get_rpccred(callback_cred);
703	} else {
704		struct rpc_auth *auth = client->cl_auth;
705		struct auth_cred acred = {};
706
707		acred.uid = ses->se_cb_sec.uid;
708		acred.gid = ses->se_cb_sec.gid;
709		return auth->au_ops->lookup_cred(client->cl_auth, &acred, 0);
710	}
711}
712
713static struct rpc_clnt *create_backchannel_client(struct rpc_create_args *args)
714{
715	struct rpc_xprt *xprt;
716
717	if (args->protocol != XPRT_TRANSPORT_BC_TCP)
718		return rpc_create(args);
719
720	xprt = args->bc_xprt->xpt_bc_xprt;
721	if (xprt) {
722		xprt_get(xprt);
723		return rpc_create_xprt(args, xprt);
724	}
725
726	return rpc_create(args);
727}
728
729static int setup_callback_client(struct nfs4_client *clp, struct nfs4_cb_conn *conn, struct nfsd4_session *ses)
730{
731	int maxtime = max_cb_time(clp->net);
732	struct rpc_timeout	timeparms = {
733		.to_initval	= maxtime,
734		.to_retries	= 0,
735		.to_maxval	= maxtime,
736	};
737	struct rpc_create_args args = {
738		.net		= clp->net,
739		.address	= (struct sockaddr *) &conn->cb_addr,
740		.addrsize	= conn->cb_addrlen,
741		.saddress	= (struct sockaddr *) &conn->cb_saddr,
742		.timeout	= &timeparms,
743		.program	= &cb_program,
744		.version	= 0,
745		.flags		= (RPC_CLNT_CREATE_NOPING | RPC_CLNT_CREATE_QUIET),
746	};
747	struct rpc_clnt *client;
748	struct rpc_cred *cred;
749
750	if (clp->cl_minorversion == 0) {
751		if (!clp->cl_cred.cr_principal &&
752				(clp->cl_cred.cr_flavor >= RPC_AUTH_GSS_KRB5))
753			return -EINVAL;
754		args.client_name = clp->cl_cred.cr_principal;
755		args.prognumber	= conn->cb_prog;
756		args.protocol = XPRT_TRANSPORT_TCP;
757		args.authflavor = clp->cl_cred.cr_flavor;
758		clp->cl_cb_ident = conn->cb_ident;
759	} else {
760		if (!conn->cb_xprt)
761			return -EINVAL;
762		clp->cl_cb_conn.cb_xprt = conn->cb_xprt;
763		clp->cl_cb_session = ses;
764		args.bc_xprt = conn->cb_xprt;
765		args.prognumber = clp->cl_cb_session->se_cb_prog;
766		args.protocol = conn->cb_xprt->xpt_class->xcl_ident |
767				XPRT_TRANSPORT_BC;
768		args.authflavor = ses->se_cb_sec.flavor;
769	}
770	/* Create RPC client */
771	client = create_backchannel_client(&args);
772	if (IS_ERR(client)) {
773		dprintk("NFSD: couldn't create callback client: %ld\n",
774			PTR_ERR(client));
775		return PTR_ERR(client);
776	}
777	cred = get_backchannel_cred(clp, client, ses);
778	if (IS_ERR(cred)) {
779		rpc_shutdown_client(client);
780		return PTR_ERR(cred);
781	}
782	clp->cl_cb_client = client;
783	clp->cl_cb_cred = cred;
784	return 0;
785}
786
787static void warn_no_callback_path(struct nfs4_client *clp, int reason)
788{
789	dprintk("NFSD: warning: no callback path to client %.*s: error %d\n",
790		(int)clp->cl_name.len, clp->cl_name.data, reason);
791}
792
793static void nfsd4_mark_cb_down(struct nfs4_client *clp, int reason)
794{
795	clp->cl_cb_state = NFSD4_CB_DOWN;
796	warn_no_callback_path(clp, reason);
797}
798
799static void nfsd4_mark_cb_fault(struct nfs4_client *clp, int reason)
800{
801	clp->cl_cb_state = NFSD4_CB_FAULT;
802	warn_no_callback_path(clp, reason);
803}
804
805static void nfsd4_cb_probe_done(struct rpc_task *task, void *calldata)
806{
807	struct nfs4_client *clp = container_of(calldata, struct nfs4_client, cl_cb_null);
808
809	if (task->tk_status)
810		nfsd4_mark_cb_down(clp, task->tk_status);
811	else
812		clp->cl_cb_state = NFSD4_CB_UP;
813}
814
815static const struct rpc_call_ops nfsd4_cb_probe_ops = {
816	/* XXX: release method to ensure we set the cb channel down if
817	 * necessary on early failure? */
818	.rpc_call_done = nfsd4_cb_probe_done,
819};
820
821static struct workqueue_struct *callback_wq;
822
823/*
824 * Poke the callback thread to process any updates to the callback
825 * parameters, and send a null probe.
826 */
827void nfsd4_probe_callback(struct nfs4_client *clp)
828{
829	clp->cl_cb_state = NFSD4_CB_UNKNOWN;
830	set_bit(NFSD4_CLIENT_CB_UPDATE, &clp->cl_flags);
831	nfsd4_run_cb(&clp->cl_cb_null);
832}
833
834void nfsd4_probe_callback_sync(struct nfs4_client *clp)
835{
836	nfsd4_probe_callback(clp);
837	flush_workqueue(callback_wq);
838}
839
840void nfsd4_change_callback(struct nfs4_client *clp, struct nfs4_cb_conn *conn)
841{
842	clp->cl_cb_state = NFSD4_CB_UNKNOWN;
843	spin_lock(&clp->cl_lock);
844	memcpy(&clp->cl_cb_conn, conn, sizeof(struct nfs4_cb_conn));
845	spin_unlock(&clp->cl_lock);
846}
847
848/*
849 * There's currently a single callback channel slot.
850 * If the slot is available, then mark it busy.  Otherwise, set the
851 * thread for sleeping on the callback RPC wait queue.
852 */
853static bool nfsd41_cb_get_slot(struct nfs4_client *clp, struct rpc_task *task)
854{
855	if (test_and_set_bit(0, &clp->cl_cb_slot_busy) != 0) {
856		rpc_sleep_on(&clp->cl_cb_waitq, task, NULL);
857		/* Race breaker */
858		if (test_and_set_bit(0, &clp->cl_cb_slot_busy) != 0) {
859			dprintk("%s slot is busy\n", __func__);
860			return false;
861		}
862		rpc_wake_up_queued_task(&clp->cl_cb_waitq, task);
863	}
864	return true;
865}
866
867/*
868 * TODO: cb_sequence should support referring call lists, cachethis, multiple
869 * slots, and mark callback channel down on communication errors.
870 */
871static void nfsd4_cb_prepare(struct rpc_task *task, void *calldata)
872{
873	struct nfsd4_callback *cb = calldata;
874	struct nfs4_client *clp = cb->cb_clp;
875	u32 minorversion = clp->cl_minorversion;
876
877	cb->cb_minorversion = minorversion;
878	if (minorversion) {
879		if (!nfsd41_cb_get_slot(clp, task))
880			return;
881	}
882	rpc_call_start(task);
883}
884
885static void nfsd4_cb_done(struct rpc_task *task, void *calldata)
886{
887	struct nfsd4_callback *cb = calldata;
888	struct nfs4_client *clp = cb->cb_clp;
889
890	dprintk("%s: minorversion=%d\n", __func__,
891		clp->cl_minorversion);
892
893	if (clp->cl_minorversion) {
894		/* No need for lock, access serialized in nfsd4_cb_prepare */
895		if (!task->tk_status)
896			++clp->cl_cb_session->se_cb_seq_nr;
897		clear_bit(0, &clp->cl_cb_slot_busy);
898		rpc_wake_up_next(&clp->cl_cb_waitq);
899		dprintk("%s: freed slot, new seqid=%d\n", __func__,
900			clp->cl_cb_session->se_cb_seq_nr);
901	}
902
903	/*
904	 * If the backchannel connection was shut down while this
905	 * task was queued, we need to resubmit it after setting up
906	 * a new backchannel connection.
907	 *
908	 * Note that if we lost our callback connection permanently
909	 * the submission code will error out, so we don't need to
910	 * handle that case here.
911	 */
912	if (task->tk_flags & RPC_TASK_KILLED) {
913		task->tk_status = 0;
914		cb->cb_need_restart = true;
915		return;
916	}
917
918	if (cb->cb_status) {
919		WARN_ON_ONCE(task->tk_status);
920		task->tk_status = cb->cb_status;
921	}
922
923	switch (cb->cb_ops->done(cb, task)) {
924	case 0:
925		task->tk_status = 0;
926		rpc_restart_call_prepare(task);
927		return;
928	case 1:
929		break;
930	case -1:
931		/* Network partition? */
932		nfsd4_mark_cb_down(clp, task->tk_status);
933		break;
934	default:
935		BUG();
936	}
937}
938
939static void nfsd4_cb_release(void *calldata)
940{
941	struct nfsd4_callback *cb = calldata;
942
943	if (cb->cb_need_restart)
944		nfsd4_run_cb(cb);
945	else
946		cb->cb_ops->release(cb);
947
948}
949
950static const struct rpc_call_ops nfsd4_cb_ops = {
951	.rpc_call_prepare = nfsd4_cb_prepare,
952	.rpc_call_done = nfsd4_cb_done,
953	.rpc_release = nfsd4_cb_release,
954};
955
956int nfsd4_create_callback_queue(void)
957{
958	callback_wq = create_singlethread_workqueue("nfsd4_callbacks");
959	if (!callback_wq)
960		return -ENOMEM;
961	return 0;
962}
963
964void nfsd4_destroy_callback_queue(void)
965{
966	destroy_workqueue(callback_wq);
967}
968
969/* must be called under the state lock */
970void nfsd4_shutdown_callback(struct nfs4_client *clp)
971{
972	set_bit(NFSD4_CLIENT_CB_KILL, &clp->cl_flags);
973	/*
974	 * Note this won't actually result in a null callback;
975	 * instead, nfsd4_run_cb_null() will detect the killed
976	 * client, destroy the rpc client, and stop:
977	 */
978	nfsd4_run_cb(&clp->cl_cb_null);
979	flush_workqueue(callback_wq);
980}
981
982/* requires cl_lock: */
983static struct nfsd4_conn * __nfsd4_find_backchannel(struct nfs4_client *clp)
984{
985	struct nfsd4_session *s;
986	struct nfsd4_conn *c;
987
988	list_for_each_entry(s, &clp->cl_sessions, se_perclnt) {
989		list_for_each_entry(c, &s->se_conns, cn_persession) {
990			if (c->cn_flags & NFS4_CDFC4_BACK)
991				return c;
992		}
993	}
994	return NULL;
995}
996
997static void nfsd4_process_cb_update(struct nfsd4_callback *cb)
998{
999	struct nfs4_cb_conn conn;
1000	struct nfs4_client *clp = cb->cb_clp;
1001	struct nfsd4_session *ses = NULL;
1002	struct nfsd4_conn *c;
1003	int err;
1004
1005	/*
1006	 * This is either an update, or the client dying; in either case,
1007	 * kill the old client:
1008	 */
1009	if (clp->cl_cb_client) {
1010		rpc_shutdown_client(clp->cl_cb_client);
1011		clp->cl_cb_client = NULL;
1012		put_rpccred(clp->cl_cb_cred);
1013		clp->cl_cb_cred = NULL;
1014	}
1015	if (clp->cl_cb_conn.cb_xprt) {
1016		svc_xprt_put(clp->cl_cb_conn.cb_xprt);
1017		clp->cl_cb_conn.cb_xprt = NULL;
1018	}
1019	if (test_bit(NFSD4_CLIENT_CB_KILL, &clp->cl_flags))
1020		return;
1021	spin_lock(&clp->cl_lock);
1022	/*
1023	 * Only serialized callback code is allowed to clear these
1024	 * flags; main nfsd code can only set them:
1025	 */
1026	BUG_ON(!(clp->cl_flags & NFSD4_CLIENT_CB_FLAG_MASK));
1027	clear_bit(NFSD4_CLIENT_CB_UPDATE, &clp->cl_flags);
1028	memcpy(&conn, &cb->cb_clp->cl_cb_conn, sizeof(struct nfs4_cb_conn));
1029	c = __nfsd4_find_backchannel(clp);
1030	if (c) {
1031		svc_xprt_get(c->cn_xprt);
1032		conn.cb_xprt = c->cn_xprt;
1033		ses = c->cn_session;
1034	}
1035	spin_unlock(&clp->cl_lock);
1036
1037	err = setup_callback_client(clp, &conn, ses);
1038	if (err) {
1039		nfsd4_mark_cb_down(clp, err);
1040		return;
1041	}
1042}
1043
1044static void
1045nfsd4_run_cb_work(struct work_struct *work)
1046{
1047	struct nfsd4_callback *cb =
1048		container_of(work, struct nfsd4_callback, cb_work);
1049	struct nfs4_client *clp = cb->cb_clp;
1050	struct rpc_clnt *clnt;
1051
1052	if (cb->cb_need_restart) {
1053		cb->cb_need_restart = false;
1054	} else {
1055		if (cb->cb_ops && cb->cb_ops->prepare)
1056			cb->cb_ops->prepare(cb);
1057	}
1058
1059	if (clp->cl_flags & NFSD4_CLIENT_CB_FLAG_MASK)
1060		nfsd4_process_cb_update(cb);
1061
1062	clnt = clp->cl_cb_client;
1063	if (!clnt) {
1064		/* Callback channel broken, or client killed; give up: */
1065		if (cb->cb_ops && cb->cb_ops->release)
1066			cb->cb_ops->release(cb);
1067		return;
1068	}
1069
1070	/*
1071	 * Don't send probe messages for 4.1 or later.
1072	 */
1073	if (!cb->cb_ops && clp->cl_minorversion) {
1074		clp->cl_cb_state = NFSD4_CB_UP;
1075		return;
1076	}
1077
1078	cb->cb_msg.rpc_cred = clp->cl_cb_cred;
1079	rpc_call_async(clnt, &cb->cb_msg, RPC_TASK_SOFT | RPC_TASK_SOFTCONN,
1080			cb->cb_ops ? &nfsd4_cb_ops : &nfsd4_cb_probe_ops, cb);
1081}
1082
1083void nfsd4_init_cb(struct nfsd4_callback *cb, struct nfs4_client *clp,
1084		struct nfsd4_callback_ops *ops, enum nfsd4_cb_op op)
1085{
1086	cb->cb_clp = clp;
1087	cb->cb_msg.rpc_proc = &nfs4_cb_procedures[op];
1088	cb->cb_msg.rpc_argp = cb;
1089	cb->cb_msg.rpc_resp = cb;
1090	cb->cb_ops = ops;
1091	INIT_WORK(&cb->cb_work, nfsd4_run_cb_work);
1092	cb->cb_status = 0;
1093	cb->cb_need_restart = false;
1094}
1095
1096void nfsd4_run_cb(struct nfsd4_callback *cb)
1097{
1098	queue_work(callback_wq, &cb->cb_work);
1099}
1100