xref: /openbmc/linux/fs/nfsd/nfs4callback.c (revision 7490ca1e)
1 /*
2  *  Copyright (c) 2001 The Regents of the University of Michigan.
3  *  All rights reserved.
4  *
5  *  Kendrick Smith <kmsmith@umich.edu>
6  *  Andy Adamson <andros@umich.edu>
7  *
8  *  Redistribution and use in source and binary forms, with or without
9  *  modification, are permitted provided that the following conditions
10  *  are met:
11  *
12  *  1. Redistributions of source code must retain the above copyright
13  *     notice, this list of conditions and the following disclaimer.
14  *  2. Redistributions in binary form must reproduce the above copyright
15  *     notice, this list of conditions and the following disclaimer in the
16  *     documentation and/or other materials provided with the distribution.
17  *  3. Neither the name of the University nor the names of its
18  *     contributors may be used to endorse or promote products derived
19  *     from this software without specific prior written permission.
20  *
21  *  THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
22  *  WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
23  *  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
24  *  DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
25  *  FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
26  *  CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
27  *  SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
28  *  BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
29  *  LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
30  *  NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
31  *  SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
32  */
33 
34 #include <linux/sunrpc/clnt.h>
35 #include <linux/sunrpc/svc_xprt.h>
36 #include <linux/slab.h>
37 #include "nfsd.h"
38 #include "state.h"
39 
40 #define NFSDDBG_FACILITY                NFSDDBG_PROC
41 
42 static void nfsd4_mark_cb_fault(struct nfs4_client *, int reason);
43 
44 #define NFSPROC4_CB_NULL 0
45 #define NFSPROC4_CB_COMPOUND 1
46 
47 /* Index of predefined Linux callback client operations */
48 
49 enum {
50 	NFSPROC4_CLNT_CB_NULL = 0,
51 	NFSPROC4_CLNT_CB_RECALL,
52 	NFSPROC4_CLNT_CB_SEQUENCE,
53 };
54 
55 #define NFS4_MAXTAGLEN		20
56 
57 #define NFS4_enc_cb_null_sz		0
58 #define NFS4_dec_cb_null_sz		0
59 #define cb_compound_enc_hdr_sz		4
60 #define cb_compound_dec_hdr_sz		(3 + (NFS4_MAXTAGLEN >> 2))
61 #define sessionid_sz			(NFS4_MAX_SESSIONID_LEN >> 2)
62 #define cb_sequence_enc_sz		(sessionid_sz + 4 +             \
63 					1 /* no referring calls list yet */)
64 #define cb_sequence_dec_sz		(op_dec_sz + sessionid_sz + 4)
65 
66 #define op_enc_sz			1
67 #define op_dec_sz			2
68 #define enc_nfs4_fh_sz			(1 + (NFS4_FHSIZE >> 2))
69 #define enc_stateid_sz			(NFS4_STATEID_SIZE >> 2)
70 #define NFS4_enc_cb_recall_sz		(cb_compound_enc_hdr_sz +       \
71 					cb_sequence_enc_sz +            \
72 					1 + enc_stateid_sz +            \
73 					enc_nfs4_fh_sz)
74 
75 #define NFS4_dec_cb_recall_sz		(cb_compound_dec_hdr_sz  +      \
76 					cb_sequence_dec_sz +            \
77 					op_dec_sz)
78 
79 struct nfs4_cb_compound_hdr {
80 	/* args */
81 	u32		ident;	/* minorversion 0 only */
82 	u32		nops;
83 	__be32		*nops_p;
84 	u32		minorversion;
85 	/* res */
86 	int		status;
87 };
88 
89 /*
90  * Handle decode buffer overflows out-of-line.
91  */
92 static void print_overflow_msg(const char *func, const struct xdr_stream *xdr)
93 {
94 	dprintk("NFS: %s prematurely hit the end of our receive buffer. "
95 		"Remaining buffer length is %tu words.\n",
96 		func, xdr->end - xdr->p);
97 }
98 
99 static __be32 *xdr_encode_empty_array(__be32 *p)
100 {
101 	*p++ = xdr_zero;
102 	return p;
103 }
104 
105 /*
106  * Encode/decode NFSv4 CB basic data types
107  *
108  * Basic NFSv4 callback data types are defined in section 15 of RFC
109  * 3530: "Network File System (NFS) version 4 Protocol" and section
110  * 20 of RFC 5661: "Network File System (NFS) Version 4 Minor Version
111  * 1 Protocol"
112  */
113 
114 /*
115  *	nfs_cb_opnum4
116  *
117  *	enum nfs_cb_opnum4 {
118  *		OP_CB_GETATTR		= 3,
119  *		  ...
120  *	};
121  */
122 enum nfs_cb_opnum4 {
123 	OP_CB_GETATTR			= 3,
124 	OP_CB_RECALL			= 4,
125 	OP_CB_LAYOUTRECALL		= 5,
126 	OP_CB_NOTIFY			= 6,
127 	OP_CB_PUSH_DELEG		= 7,
128 	OP_CB_RECALL_ANY		= 8,
129 	OP_CB_RECALLABLE_OBJ_AVAIL	= 9,
130 	OP_CB_RECALL_SLOT		= 10,
131 	OP_CB_SEQUENCE			= 11,
132 	OP_CB_WANTS_CANCELLED		= 12,
133 	OP_CB_NOTIFY_LOCK		= 13,
134 	OP_CB_NOTIFY_DEVICEID		= 14,
135 	OP_CB_ILLEGAL			= 10044
136 };
137 
138 static void encode_nfs_cb_opnum4(struct xdr_stream *xdr, enum nfs_cb_opnum4 op)
139 {
140 	__be32 *p;
141 
142 	p = xdr_reserve_space(xdr, 4);
143 	*p = cpu_to_be32(op);
144 }
145 
146 /*
147  * nfs_fh4
148  *
149  *	typedef opaque nfs_fh4<NFS4_FHSIZE>;
150  */
151 static void encode_nfs_fh4(struct xdr_stream *xdr, const struct knfsd_fh *fh)
152 {
153 	u32 length = fh->fh_size;
154 	__be32 *p;
155 
156 	BUG_ON(length > NFS4_FHSIZE);
157 	p = xdr_reserve_space(xdr, 4 + length);
158 	xdr_encode_opaque(p, &fh->fh_base, length);
159 }
160 
161 /*
162  * stateid4
163  *
164  *	struct stateid4 {
165  *		uint32_t	seqid;
166  *		opaque		other[12];
167  *	};
168  */
169 static void encode_stateid4(struct xdr_stream *xdr, const stateid_t *sid)
170 {
171 	__be32 *p;
172 
173 	p = xdr_reserve_space(xdr, NFS4_STATEID_SIZE);
174 	*p++ = cpu_to_be32(sid->si_generation);
175 	xdr_encode_opaque_fixed(p, &sid->si_opaque, NFS4_STATEID_OTHER_SIZE);
176 }
177 
178 /*
179  * sessionid4
180  *
181  *	typedef opaque sessionid4[NFS4_SESSIONID_SIZE];
182  */
183 static void encode_sessionid4(struct xdr_stream *xdr,
184 			      const struct nfsd4_session *session)
185 {
186 	__be32 *p;
187 
188 	p = xdr_reserve_space(xdr, NFS4_MAX_SESSIONID_LEN);
189 	xdr_encode_opaque_fixed(p, session->se_sessionid.data,
190 					NFS4_MAX_SESSIONID_LEN);
191 }
192 
193 /*
194  * nfsstat4
195  */
196 static const struct {
197 	int stat;
198 	int errno;
199 } nfs_cb_errtbl[] = {
200 	{ NFS4_OK,		0		},
201 	{ NFS4ERR_PERM,		-EPERM		},
202 	{ NFS4ERR_NOENT,	-ENOENT		},
203 	{ NFS4ERR_IO,		-EIO		},
204 	{ NFS4ERR_NXIO,		-ENXIO		},
205 	{ NFS4ERR_ACCESS,	-EACCES		},
206 	{ NFS4ERR_EXIST,	-EEXIST		},
207 	{ NFS4ERR_XDEV,		-EXDEV		},
208 	{ NFS4ERR_NOTDIR,	-ENOTDIR	},
209 	{ NFS4ERR_ISDIR,	-EISDIR		},
210 	{ NFS4ERR_INVAL,	-EINVAL		},
211 	{ NFS4ERR_FBIG,		-EFBIG		},
212 	{ NFS4ERR_NOSPC,	-ENOSPC		},
213 	{ NFS4ERR_ROFS,		-EROFS		},
214 	{ NFS4ERR_MLINK,	-EMLINK		},
215 	{ NFS4ERR_NAMETOOLONG,	-ENAMETOOLONG	},
216 	{ NFS4ERR_NOTEMPTY,	-ENOTEMPTY	},
217 	{ NFS4ERR_DQUOT,	-EDQUOT		},
218 	{ NFS4ERR_STALE,	-ESTALE		},
219 	{ NFS4ERR_BADHANDLE,	-EBADHANDLE	},
220 	{ NFS4ERR_BAD_COOKIE,	-EBADCOOKIE	},
221 	{ NFS4ERR_NOTSUPP,	-ENOTSUPP	},
222 	{ NFS4ERR_TOOSMALL,	-ETOOSMALL	},
223 	{ NFS4ERR_SERVERFAULT,	-ESERVERFAULT	},
224 	{ NFS4ERR_BADTYPE,	-EBADTYPE	},
225 	{ NFS4ERR_LOCKED,	-EAGAIN		},
226 	{ NFS4ERR_RESOURCE,	-EREMOTEIO	},
227 	{ NFS4ERR_SYMLINK,	-ELOOP		},
228 	{ NFS4ERR_OP_ILLEGAL,	-EOPNOTSUPP	},
229 	{ NFS4ERR_DEADLOCK,	-EDEADLK	},
230 	{ -1,			-EIO		}
231 };
232 
233 /*
234  * If we cannot translate the error, the recovery routines should
235  * handle it.
236  *
237  * Note: remaining NFSv4 error codes have values > 10000, so should
238  * not conflict with native Linux error codes.
239  */
240 static int nfs_cb_stat_to_errno(int status)
241 {
242 	int i;
243 
244 	for (i = 0; nfs_cb_errtbl[i].stat != -1; i++) {
245 		if (nfs_cb_errtbl[i].stat == status)
246 			return nfs_cb_errtbl[i].errno;
247 	}
248 
249 	dprintk("NFSD: Unrecognized NFS CB status value: %u\n", status);
250 	return -status;
251 }
252 
253 static int decode_cb_op_status(struct xdr_stream *xdr, enum nfs_opnum4 expected,
254 			       enum nfsstat4 *status)
255 {
256 	__be32 *p;
257 	u32 op;
258 
259 	p = xdr_inline_decode(xdr, 4 + 4);
260 	if (unlikely(p == NULL))
261 		goto out_overflow;
262 	op = be32_to_cpup(p++);
263 	if (unlikely(op != expected))
264 		goto out_unexpected;
265 	*status = be32_to_cpup(p);
266 	return 0;
267 out_overflow:
268 	print_overflow_msg(__func__, xdr);
269 	return -EIO;
270 out_unexpected:
271 	dprintk("NFSD: Callback server returned operation %d but "
272 		"we issued a request for %d\n", op, expected);
273 	return -EIO;
274 }
275 
276 /*
277  * CB_COMPOUND4args
278  *
279  *	struct CB_COMPOUND4args {
280  *		utf8str_cs	tag;
281  *		uint32_t	minorversion;
282  *		uint32_t	callback_ident;
283  *		nfs_cb_argop4	argarray<>;
284  *	};
285 */
286 static void encode_cb_compound4args(struct xdr_stream *xdr,
287 				    struct nfs4_cb_compound_hdr *hdr)
288 {
289 	__be32 * p;
290 
291 	p = xdr_reserve_space(xdr, 4 + 4 + 4 + 4);
292 	p = xdr_encode_empty_array(p);		/* empty tag */
293 	*p++ = cpu_to_be32(hdr->minorversion);
294 	*p++ = cpu_to_be32(hdr->ident);
295 
296 	hdr->nops_p = p;
297 	*p = cpu_to_be32(hdr->nops);		/* argarray element count */
298 }
299 
300 /*
301  * Update argarray element count
302  */
303 static void encode_cb_nops(struct nfs4_cb_compound_hdr *hdr)
304 {
305 	BUG_ON(hdr->nops > NFS4_MAX_BACK_CHANNEL_OPS);
306 	*hdr->nops_p = cpu_to_be32(hdr->nops);
307 }
308 
309 /*
310  * CB_COMPOUND4res
311  *
312  *	struct CB_COMPOUND4res {
313  *		nfsstat4	status;
314  *		utf8str_cs	tag;
315  *		nfs_cb_resop4	resarray<>;
316  *	};
317  */
318 static int decode_cb_compound4res(struct xdr_stream *xdr,
319 				  struct nfs4_cb_compound_hdr *hdr)
320 {
321 	u32 length;
322 	__be32 *p;
323 
324 	p = xdr_inline_decode(xdr, 4 + 4);
325 	if (unlikely(p == NULL))
326 		goto out_overflow;
327 	hdr->status = be32_to_cpup(p++);
328 	/* Ignore the tag */
329 	length = be32_to_cpup(p++);
330 	p = xdr_inline_decode(xdr, length + 4);
331 	if (unlikely(p == NULL))
332 		goto out_overflow;
333 	hdr->nops = be32_to_cpup(p);
334 	return 0;
335 out_overflow:
336 	print_overflow_msg(__func__, xdr);
337 	return -EIO;
338 }
339 
340 /*
341  * CB_RECALL4args
342  *
343  *	struct CB_RECALL4args {
344  *		stateid4	stateid;
345  *		bool		truncate;
346  *		nfs_fh4		fh;
347  *	};
348  */
349 static void encode_cb_recall4args(struct xdr_stream *xdr,
350 				  const struct nfs4_delegation *dp,
351 				  struct nfs4_cb_compound_hdr *hdr)
352 {
353 	__be32 *p;
354 
355 	encode_nfs_cb_opnum4(xdr, OP_CB_RECALL);
356 	encode_stateid4(xdr, &dp->dl_stid.sc_stateid);
357 
358 	p = xdr_reserve_space(xdr, 4);
359 	*p++ = xdr_zero;			/* truncate */
360 
361 	encode_nfs_fh4(xdr, &dp->dl_fh);
362 
363 	hdr->nops++;
364 }
365 
366 /*
367  * CB_SEQUENCE4args
368  *
369  *	struct CB_SEQUENCE4args {
370  *		sessionid4		csa_sessionid;
371  *		sequenceid4		csa_sequenceid;
372  *		slotid4			csa_slotid;
373  *		slotid4			csa_highest_slotid;
374  *		bool			csa_cachethis;
375  *		referring_call_list4	csa_referring_call_lists<>;
376  *	};
377  */
378 static void encode_cb_sequence4args(struct xdr_stream *xdr,
379 				    const struct nfsd4_callback *cb,
380 				    struct nfs4_cb_compound_hdr *hdr)
381 {
382 	struct nfsd4_session *session = cb->cb_clp->cl_cb_session;
383 	__be32 *p;
384 
385 	if (hdr->minorversion == 0)
386 		return;
387 
388 	encode_nfs_cb_opnum4(xdr, OP_CB_SEQUENCE);
389 	encode_sessionid4(xdr, session);
390 
391 	p = xdr_reserve_space(xdr, 4 + 4 + 4 + 4 + 4);
392 	*p++ = cpu_to_be32(session->se_cb_seq_nr);	/* csa_sequenceid */
393 	*p++ = xdr_zero;			/* csa_slotid */
394 	*p++ = xdr_zero;			/* csa_highest_slotid */
395 	*p++ = xdr_zero;			/* csa_cachethis */
396 	xdr_encode_empty_array(p);		/* csa_referring_call_lists */
397 
398 	hdr->nops++;
399 }
400 
401 /*
402  * CB_SEQUENCE4resok
403  *
404  *	struct CB_SEQUENCE4resok {
405  *		sessionid4	csr_sessionid;
406  *		sequenceid4	csr_sequenceid;
407  *		slotid4		csr_slotid;
408  *		slotid4		csr_highest_slotid;
409  *		slotid4		csr_target_highest_slotid;
410  *	};
411  *
412  *	union CB_SEQUENCE4res switch (nfsstat4 csr_status) {
413  *	case NFS4_OK:
414  *		CB_SEQUENCE4resok	csr_resok4;
415  *	default:
416  *		void;
417  *	};
418  *
419  * Our current back channel implmentation supports a single backchannel
420  * with a single slot.
421  */
422 static int decode_cb_sequence4resok(struct xdr_stream *xdr,
423 				    struct nfsd4_callback *cb)
424 {
425 	struct nfsd4_session *session = cb->cb_clp->cl_cb_session;
426 	struct nfs4_sessionid id;
427 	int status;
428 	__be32 *p;
429 	u32 dummy;
430 
431 	status = -ESERVERFAULT;
432 
433 	/*
434 	 * If the server returns different values for sessionID, slotID or
435 	 * sequence number, the server is looney tunes.
436 	 */
437 	p = xdr_inline_decode(xdr, NFS4_MAX_SESSIONID_LEN + 4 + 4 + 4 + 4);
438 	if (unlikely(p == NULL))
439 		goto out_overflow;
440 	memcpy(id.data, p, NFS4_MAX_SESSIONID_LEN);
441 	if (memcmp(id.data, session->se_sessionid.data,
442 					NFS4_MAX_SESSIONID_LEN) != 0) {
443 		dprintk("NFS: %s Invalid session id\n", __func__);
444 		goto out;
445 	}
446 	p += XDR_QUADLEN(NFS4_MAX_SESSIONID_LEN);
447 
448 	dummy = be32_to_cpup(p++);
449 	if (dummy != session->se_cb_seq_nr) {
450 		dprintk("NFS: %s Invalid sequence number\n", __func__);
451 		goto out;
452 	}
453 
454 	dummy = be32_to_cpup(p++);
455 	if (dummy != 0) {
456 		dprintk("NFS: %s Invalid slotid\n", __func__);
457 		goto out;
458 	}
459 
460 	/*
461 	 * FIXME: process highest slotid and target highest slotid
462 	 */
463 	status = 0;
464 out:
465 	if (status)
466 		nfsd4_mark_cb_fault(cb->cb_clp, status);
467 	return status;
468 out_overflow:
469 	print_overflow_msg(__func__, xdr);
470 	return -EIO;
471 }
472 
473 static int decode_cb_sequence4res(struct xdr_stream *xdr,
474 				  struct nfsd4_callback *cb)
475 {
476 	enum nfsstat4 nfserr;
477 	int status;
478 
479 	if (cb->cb_minorversion == 0)
480 		return 0;
481 
482 	status = decode_cb_op_status(xdr, OP_CB_SEQUENCE, &nfserr);
483 	if (unlikely(status))
484 		goto out;
485 	if (unlikely(nfserr != NFS4_OK))
486 		goto out_default;
487 	status = decode_cb_sequence4resok(xdr, cb);
488 out:
489 	return status;
490 out_default:
491 	return nfs_cb_stat_to_errno(nfserr);
492 }
493 
494 /*
495  * NFSv4.0 and NFSv4.1 XDR encode functions
496  *
497  * NFSv4.0 callback argument types are defined in section 15 of RFC
498  * 3530: "Network File System (NFS) version 4 Protocol" and section 20
499  * of RFC 5661:  "Network File System (NFS) Version 4 Minor Version 1
500  * Protocol".
501  */
502 
503 /*
504  * NB: Without this zero space reservation, callbacks over krb5p fail
505  */
506 static void nfs4_xdr_enc_cb_null(struct rpc_rqst *req, struct xdr_stream *xdr,
507 				 void *__unused)
508 {
509 	xdr_reserve_space(xdr, 0);
510 }
511 
512 /*
513  * 20.2. Operation 4: CB_RECALL - Recall a Delegation
514  */
515 static void nfs4_xdr_enc_cb_recall(struct rpc_rqst *req, struct xdr_stream *xdr,
516 				   const struct nfsd4_callback *cb)
517 {
518 	const struct nfs4_delegation *args = cb->cb_op;
519 	struct nfs4_cb_compound_hdr hdr = {
520 		.ident = cb->cb_clp->cl_cb_ident,
521 		.minorversion = cb->cb_minorversion,
522 	};
523 
524 	encode_cb_compound4args(xdr, &hdr);
525 	encode_cb_sequence4args(xdr, cb, &hdr);
526 	encode_cb_recall4args(xdr, args, &hdr);
527 	encode_cb_nops(&hdr);
528 }
529 
530 
531 /*
532  * NFSv4.0 and NFSv4.1 XDR decode functions
533  *
534  * NFSv4.0 callback result types are defined in section 15 of RFC
535  * 3530: "Network File System (NFS) version 4 Protocol" and section 20
536  * of RFC 5661:  "Network File System (NFS) Version 4 Minor Version 1
537  * Protocol".
538  */
539 
540 static int nfs4_xdr_dec_cb_null(struct rpc_rqst *req, struct xdr_stream *xdr,
541 				void *__unused)
542 {
543 	return 0;
544 }
545 
546 /*
547  * 20.2. Operation 4: CB_RECALL - Recall a Delegation
548  */
549 static int nfs4_xdr_dec_cb_recall(struct rpc_rqst *rqstp,
550 				  struct xdr_stream *xdr,
551 				  struct nfsd4_callback *cb)
552 {
553 	struct nfs4_cb_compound_hdr hdr;
554 	enum nfsstat4 nfserr;
555 	int status;
556 
557 	status = decode_cb_compound4res(xdr, &hdr);
558 	if (unlikely(status))
559 		goto out;
560 
561 	if (cb != NULL) {
562 		status = decode_cb_sequence4res(xdr, cb);
563 		if (unlikely(status))
564 			goto out;
565 	}
566 
567 	status = decode_cb_op_status(xdr, OP_CB_RECALL, &nfserr);
568 	if (unlikely(status))
569 		goto out;
570 	if (unlikely(nfserr != NFS4_OK))
571 		status = nfs_cb_stat_to_errno(nfserr);
572 out:
573 	return status;
574 }
575 
576 /*
577  * RPC procedure tables
578  */
579 #define PROC(proc, call, argtype, restype)				\
580 [NFSPROC4_CLNT_##proc] = {						\
581 	.p_proc    = NFSPROC4_CB_##call,				\
582 	.p_encode  = (kxdreproc_t)nfs4_xdr_enc_##argtype,		\
583 	.p_decode  = (kxdrdproc_t)nfs4_xdr_dec_##restype,		\
584 	.p_arglen  = NFS4_enc_##argtype##_sz,				\
585 	.p_replen  = NFS4_dec_##restype##_sz,				\
586 	.p_statidx = NFSPROC4_CB_##call,				\
587 	.p_name    = #proc,						\
588 }
589 
590 static struct rpc_procinfo nfs4_cb_procedures[] = {
591 	PROC(CB_NULL,	NULL,		cb_null,	cb_null),
592 	PROC(CB_RECALL,	COMPOUND,	cb_recall,	cb_recall),
593 };
594 
595 static struct rpc_version nfs_cb_version4 = {
596 /*
597  * Note on the callback rpc program version number: despite language in rfc
598  * 5661 section 18.36.3 requiring servers to use 4 in this field, the
599  * official xdr descriptions for both 4.0 and 4.1 specify version 1, and
600  * in practice that appears to be what implementations use.  The section
601  * 18.36.3 language is expected to be fixed in an erratum.
602  */
603 	.number			= 1,
604 	.nrprocs		= ARRAY_SIZE(nfs4_cb_procedures),
605 	.procs			= nfs4_cb_procedures
606 };
607 
608 static struct rpc_version *nfs_cb_version[] = {
609 	&nfs_cb_version4,
610 };
611 
612 static struct rpc_program cb_program;
613 
614 static struct rpc_stat cb_stats = {
615 	.program		= &cb_program
616 };
617 
618 #define NFS4_CALLBACK 0x40000000
619 static struct rpc_program cb_program = {
620 	.name			= "nfs4_cb",
621 	.number			= NFS4_CALLBACK,
622 	.nrvers			= ARRAY_SIZE(nfs_cb_version),
623 	.version		= nfs_cb_version,
624 	.stats			= &cb_stats,
625 	.pipe_dir_name		= "/nfsd4_cb",
626 };
627 
628 static int max_cb_time(void)
629 {
630 	return max(nfsd4_lease/10, (time_t)1) * HZ;
631 }
632 
633 
634 static int setup_callback_client(struct nfs4_client *clp, struct nfs4_cb_conn *conn, struct nfsd4_session *ses)
635 {
636 	struct rpc_timeout	timeparms = {
637 		.to_initval	= max_cb_time(),
638 		.to_retries	= 0,
639 	};
640 	struct rpc_create_args args = {
641 		.net		= &init_net,
642 		.address	= (struct sockaddr *) &conn->cb_addr,
643 		.addrsize	= conn->cb_addrlen,
644 		.saddress	= (struct sockaddr *) &conn->cb_saddr,
645 		.timeout	= &timeparms,
646 		.program	= &cb_program,
647 		.version	= 0,
648 		.authflavor	= clp->cl_flavor,
649 		.flags		= (RPC_CLNT_CREATE_NOPING | RPC_CLNT_CREATE_QUIET),
650 	};
651 	struct rpc_clnt *client;
652 
653 	if (clp->cl_minorversion == 0) {
654 		if (!clp->cl_principal && (clp->cl_flavor >= RPC_AUTH_GSS_KRB5))
655 			return -EINVAL;
656 		args.client_name = clp->cl_principal;
657 		args.prognumber	= conn->cb_prog,
658 		args.protocol = XPRT_TRANSPORT_TCP;
659 		clp->cl_cb_ident = conn->cb_ident;
660 	} else {
661 		if (!conn->cb_xprt)
662 			return -EINVAL;
663 		clp->cl_cb_conn.cb_xprt = conn->cb_xprt;
664 		clp->cl_cb_session = ses;
665 		args.bc_xprt = conn->cb_xprt;
666 		args.prognumber = clp->cl_cb_session->se_cb_prog;
667 		args.protocol = XPRT_TRANSPORT_BC_TCP;
668 	}
669 	/* Create RPC client */
670 	client = rpc_create(&args);
671 	if (IS_ERR(client)) {
672 		dprintk("NFSD: couldn't create callback client: %ld\n",
673 			PTR_ERR(client));
674 		return PTR_ERR(client);
675 	}
676 	clp->cl_cb_client = client;
677 	return 0;
678 
679 }
680 
681 static void warn_no_callback_path(struct nfs4_client *clp, int reason)
682 {
683 	dprintk("NFSD: warning: no callback path to client %.*s: error %d\n",
684 		(int)clp->cl_name.len, clp->cl_name.data, reason);
685 }
686 
687 static void nfsd4_mark_cb_down(struct nfs4_client *clp, int reason)
688 {
689 	clp->cl_cb_state = NFSD4_CB_DOWN;
690 	warn_no_callback_path(clp, reason);
691 }
692 
693 static void nfsd4_mark_cb_fault(struct nfs4_client *clp, int reason)
694 {
695 	clp->cl_cb_state = NFSD4_CB_FAULT;
696 	warn_no_callback_path(clp, reason);
697 }
698 
699 static void nfsd4_cb_probe_done(struct rpc_task *task, void *calldata)
700 {
701 	struct nfs4_client *clp = container_of(calldata, struct nfs4_client, cl_cb_null);
702 
703 	if (task->tk_status)
704 		nfsd4_mark_cb_down(clp, task->tk_status);
705 	else
706 		clp->cl_cb_state = NFSD4_CB_UP;
707 }
708 
709 static const struct rpc_call_ops nfsd4_cb_probe_ops = {
710 	/* XXX: release method to ensure we set the cb channel down if
711 	 * necessary on early failure? */
712 	.rpc_call_done = nfsd4_cb_probe_done,
713 };
714 
715 static struct rpc_cred *callback_cred;
716 
717 int set_callback_cred(void)
718 {
719 	if (callback_cred)
720 		return 0;
721 	callback_cred = rpc_lookup_machine_cred("nfs");
722 	if (!callback_cred)
723 		return -ENOMEM;
724 	return 0;
725 }
726 
727 static struct workqueue_struct *callback_wq;
728 
729 static void run_nfsd4_cb(struct nfsd4_callback *cb)
730 {
731 	queue_work(callback_wq, &cb->cb_work);
732 }
733 
734 static void do_probe_callback(struct nfs4_client *clp)
735 {
736 	struct nfsd4_callback *cb = &clp->cl_cb_null;
737 
738 	cb->cb_op = NULL;
739 	cb->cb_clp = clp;
740 
741 	cb->cb_msg.rpc_proc = &nfs4_cb_procedures[NFSPROC4_CLNT_CB_NULL];
742 	cb->cb_msg.rpc_argp = NULL;
743 	cb->cb_msg.rpc_resp = NULL;
744 	cb->cb_msg.rpc_cred = callback_cred;
745 
746 	cb->cb_ops = &nfsd4_cb_probe_ops;
747 
748 	run_nfsd4_cb(cb);
749 }
750 
751 /*
752  * Poke the callback thread to process any updates to the callback
753  * parameters, and send a null probe.
754  */
755 void nfsd4_probe_callback(struct nfs4_client *clp)
756 {
757 	/* XXX: atomicity?  Also, should we be using cl_cb_flags? */
758 	clp->cl_cb_state = NFSD4_CB_UNKNOWN;
759 	set_bit(NFSD4_CLIENT_CB_UPDATE, &clp->cl_cb_flags);
760 	do_probe_callback(clp);
761 }
762 
763 void nfsd4_probe_callback_sync(struct nfs4_client *clp)
764 {
765 	nfsd4_probe_callback(clp);
766 	flush_workqueue(callback_wq);
767 }
768 
769 void nfsd4_change_callback(struct nfs4_client *clp, struct nfs4_cb_conn *conn)
770 {
771 	clp->cl_cb_state = NFSD4_CB_UNKNOWN;
772 	spin_lock(&clp->cl_lock);
773 	memcpy(&clp->cl_cb_conn, conn, sizeof(struct nfs4_cb_conn));
774 	spin_unlock(&clp->cl_lock);
775 }
776 
777 /*
778  * There's currently a single callback channel slot.
779  * If the slot is available, then mark it busy.  Otherwise, set the
780  * thread for sleeping on the callback RPC wait queue.
781  */
782 static bool nfsd41_cb_get_slot(struct nfs4_client *clp, struct rpc_task *task)
783 {
784 	if (test_and_set_bit(0, &clp->cl_cb_slot_busy) != 0) {
785 		rpc_sleep_on(&clp->cl_cb_waitq, task, NULL);
786 		dprintk("%s slot is busy\n", __func__);
787 		return false;
788 	}
789 	return true;
790 }
791 
792 /*
793  * TODO: cb_sequence should support referring call lists, cachethis, multiple
794  * slots, and mark callback channel down on communication errors.
795  */
796 static void nfsd4_cb_prepare(struct rpc_task *task, void *calldata)
797 {
798 	struct nfsd4_callback *cb = calldata;
799 	struct nfs4_delegation *dp = container_of(cb, struct nfs4_delegation, dl_recall);
800 	struct nfs4_client *clp = dp->dl_stid.sc_client;
801 	u32 minorversion = clp->cl_minorversion;
802 
803 	cb->cb_minorversion = minorversion;
804 	if (minorversion) {
805 		if (!nfsd41_cb_get_slot(clp, task))
806 			return;
807 	}
808 	spin_lock(&clp->cl_lock);
809 	if (list_empty(&cb->cb_per_client)) {
810 		/* This is the first call, not a restart */
811 		cb->cb_done = false;
812 		list_add(&cb->cb_per_client, &clp->cl_callbacks);
813 	}
814 	spin_unlock(&clp->cl_lock);
815 	rpc_call_start(task);
816 }
817 
818 static void nfsd4_cb_done(struct rpc_task *task, void *calldata)
819 {
820 	struct nfsd4_callback *cb = calldata;
821 	struct nfs4_delegation *dp = container_of(cb, struct nfs4_delegation, dl_recall);
822 	struct nfs4_client *clp = dp->dl_stid.sc_client;
823 
824 	dprintk("%s: minorversion=%d\n", __func__,
825 		clp->cl_minorversion);
826 
827 	if (clp->cl_minorversion) {
828 		/* No need for lock, access serialized in nfsd4_cb_prepare */
829 		++clp->cl_cb_session->se_cb_seq_nr;
830 		clear_bit(0, &clp->cl_cb_slot_busy);
831 		rpc_wake_up_next(&clp->cl_cb_waitq);
832 		dprintk("%s: freed slot, new seqid=%d\n", __func__,
833 			clp->cl_cb_session->se_cb_seq_nr);
834 
835 		/* We're done looking into the sequence information */
836 		task->tk_msg.rpc_resp = NULL;
837 	}
838 }
839 
840 
841 static void nfsd4_cb_recall_done(struct rpc_task *task, void *calldata)
842 {
843 	struct nfsd4_callback *cb = calldata;
844 	struct nfs4_delegation *dp = container_of(cb, struct nfs4_delegation, dl_recall);
845 	struct nfs4_client *clp = dp->dl_stid.sc_client;
846 	struct rpc_clnt *current_rpc_client = clp->cl_cb_client;
847 
848 	nfsd4_cb_done(task, calldata);
849 
850 	if (current_rpc_client != task->tk_client) {
851 		/* We're shutting down or changing cl_cb_client; leave
852 		 * it to nfsd4_process_cb_update to restart the call if
853 		 * necessary. */
854 		return;
855 	}
856 
857 	if (cb->cb_done)
858 		return;
859 	switch (task->tk_status) {
860 	case 0:
861 		cb->cb_done = true;
862 		return;
863 	case -EBADHANDLE:
864 	case -NFS4ERR_BAD_STATEID:
865 		/* Race: client probably got cb_recall
866 		 * before open reply granting delegation */
867 		break;
868 	default:
869 		/* Network partition? */
870 		nfsd4_mark_cb_down(clp, task->tk_status);
871 	}
872 	if (dp->dl_retries--) {
873 		rpc_delay(task, 2*HZ);
874 		task->tk_status = 0;
875 		rpc_restart_call_prepare(task);
876 		return;
877 	}
878 	nfsd4_mark_cb_down(clp, task->tk_status);
879 	cb->cb_done = true;
880 }
881 
882 static void nfsd4_cb_recall_release(void *calldata)
883 {
884 	struct nfsd4_callback *cb = calldata;
885 	struct nfs4_client *clp = cb->cb_clp;
886 	struct nfs4_delegation *dp = container_of(cb, struct nfs4_delegation, dl_recall);
887 
888 	if (cb->cb_done) {
889 		spin_lock(&clp->cl_lock);
890 		list_del(&cb->cb_per_client);
891 		spin_unlock(&clp->cl_lock);
892 		nfs4_put_delegation(dp);
893 	}
894 }
895 
896 static const struct rpc_call_ops nfsd4_cb_recall_ops = {
897 	.rpc_call_prepare = nfsd4_cb_prepare,
898 	.rpc_call_done = nfsd4_cb_recall_done,
899 	.rpc_release = nfsd4_cb_recall_release,
900 };
901 
902 int nfsd4_create_callback_queue(void)
903 {
904 	callback_wq = create_singlethread_workqueue("nfsd4_callbacks");
905 	if (!callback_wq)
906 		return -ENOMEM;
907 	return 0;
908 }
909 
910 void nfsd4_destroy_callback_queue(void)
911 {
912 	destroy_workqueue(callback_wq);
913 }
914 
915 /* must be called under the state lock */
916 void nfsd4_shutdown_callback(struct nfs4_client *clp)
917 {
918 	set_bit(NFSD4_CLIENT_KILL, &clp->cl_cb_flags);
919 	/*
920 	 * Note this won't actually result in a null callback;
921 	 * instead, nfsd4_do_callback_rpc() will detect the killed
922 	 * client, destroy the rpc client, and stop:
923 	 */
924 	do_probe_callback(clp);
925 	flush_workqueue(callback_wq);
926 }
927 
928 static void nfsd4_release_cb(struct nfsd4_callback *cb)
929 {
930 	if (cb->cb_ops->rpc_release)
931 		cb->cb_ops->rpc_release(cb);
932 }
933 
934 /* requires cl_lock: */
935 static struct nfsd4_conn * __nfsd4_find_backchannel(struct nfs4_client *clp)
936 {
937 	struct nfsd4_session *s;
938 	struct nfsd4_conn *c;
939 
940 	list_for_each_entry(s, &clp->cl_sessions, se_perclnt) {
941 		list_for_each_entry(c, &s->se_conns, cn_persession) {
942 			if (c->cn_flags & NFS4_CDFC4_BACK)
943 				return c;
944 		}
945 	}
946 	return NULL;
947 }
948 
949 static void nfsd4_process_cb_update(struct nfsd4_callback *cb)
950 {
951 	struct nfs4_cb_conn conn;
952 	struct nfs4_client *clp = cb->cb_clp;
953 	struct nfsd4_session *ses = NULL;
954 	struct nfsd4_conn *c;
955 	int err;
956 
957 	/*
958 	 * This is either an update, or the client dying; in either case,
959 	 * kill the old client:
960 	 */
961 	if (clp->cl_cb_client) {
962 		rpc_shutdown_client(clp->cl_cb_client);
963 		clp->cl_cb_client = NULL;
964 	}
965 	if (clp->cl_cb_conn.cb_xprt) {
966 		svc_xprt_put(clp->cl_cb_conn.cb_xprt);
967 		clp->cl_cb_conn.cb_xprt = NULL;
968 	}
969 	if (test_bit(NFSD4_CLIENT_KILL, &clp->cl_cb_flags))
970 		return;
971 	spin_lock(&clp->cl_lock);
972 	/*
973 	 * Only serialized callback code is allowed to clear these
974 	 * flags; main nfsd code can only set them:
975 	 */
976 	BUG_ON(!clp->cl_cb_flags);
977 	clear_bit(NFSD4_CLIENT_CB_UPDATE, &clp->cl_cb_flags);
978 	memcpy(&conn, &cb->cb_clp->cl_cb_conn, sizeof(struct nfs4_cb_conn));
979 	c = __nfsd4_find_backchannel(clp);
980 	if (c) {
981 		svc_xprt_get(c->cn_xprt);
982 		conn.cb_xprt = c->cn_xprt;
983 		ses = c->cn_session;
984 	}
985 	spin_unlock(&clp->cl_lock);
986 
987 	err = setup_callback_client(clp, &conn, ses);
988 	if (err) {
989 		warn_no_callback_path(clp, err);
990 		return;
991 	}
992 	/* Yay, the callback channel's back! Restart any callbacks: */
993 	list_for_each_entry(cb, &clp->cl_callbacks, cb_per_client)
994 		run_nfsd4_cb(cb);
995 }
996 
997 void nfsd4_do_callback_rpc(struct work_struct *w)
998 {
999 	struct nfsd4_callback *cb = container_of(w, struct nfsd4_callback, cb_work);
1000 	struct nfs4_client *clp = cb->cb_clp;
1001 	struct rpc_clnt *clnt;
1002 
1003 	if (clp->cl_cb_flags)
1004 		nfsd4_process_cb_update(cb);
1005 
1006 	clnt = clp->cl_cb_client;
1007 	if (!clnt) {
1008 		/* Callback channel broken, or client killed; give up: */
1009 		nfsd4_release_cb(cb);
1010 		return;
1011 	}
1012 	rpc_call_async(clnt, &cb->cb_msg, RPC_TASK_SOFT | RPC_TASK_SOFTCONN,
1013 			cb->cb_ops, cb);
1014 }
1015 
1016 void nfsd4_cb_recall(struct nfs4_delegation *dp)
1017 {
1018 	struct nfsd4_callback *cb = &dp->dl_recall;
1019 	struct nfs4_client *clp = dp->dl_stid.sc_client;
1020 
1021 	dp->dl_retries = 1;
1022 	cb->cb_op = dp;
1023 	cb->cb_clp = clp;
1024 	cb->cb_msg.rpc_proc = &nfs4_cb_procedures[NFSPROC4_CLNT_CB_RECALL];
1025 	cb->cb_msg.rpc_argp = cb;
1026 	cb->cb_msg.rpc_resp = cb;
1027 	cb->cb_msg.rpc_cred = callback_cred;
1028 
1029 	cb->cb_ops = &nfsd4_cb_recall_ops;
1030 	dp->dl_retries = 1;
1031 
1032 	INIT_LIST_HEAD(&cb->cb_per_client);
1033 	cb->cb_done = true;
1034 
1035 	run_nfsd4_cb(&dp->dl_recall);
1036 }
1037