xref: /linux/fs/nfsd/nfs4callback.c (revision 04939a570726eb841b63618aac8ee7d5cf4ff3cd)
1 /*
2  *  Copyright (c) 2001 The Regents of the University of Michigan.
3  *  All rights reserved.
4  *
5  *  Kendrick Smith <kmsmith@umich.edu>
6  *  Andy Adamson <andros@umich.edu>
7  *
8  *  Redistribution and use in source and binary forms, with or without
9  *  modification, are permitted provided that the following conditions
10  *  are met:
11  *
12  *  1. Redistributions of source code must retain the above copyright
13  *     notice, this list of conditions and the following disclaimer.
14  *  2. Redistributions in binary form must reproduce the above copyright
15  *     notice, this list of conditions and the following disclaimer in the
16  *     documentation and/or other materials provided with the distribution.
17  *  3. Neither the name of the University nor the names of its
18  *     contributors may be used to endorse or promote products derived
19  *     from this software without specific prior written permission.
20  *
21  *  THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
22  *  WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
23  *  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
24  *  DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
25  *  FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
26  *  CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
27  *  SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
28  *  BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
29  *  LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
30  *  NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
31  *  SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
32  */
33 
34 #include <linux/nfs4.h>
35 #include <linux/sunrpc/clnt.h>
36 #include <linux/sunrpc/xprt.h>
37 #include <linux/sunrpc/svc_xprt.h>
38 #include <linux/slab.h>
39 #include "nfsd.h"
40 #include "state.h"
41 #include "netns.h"
42 #include "trace.h"
43 #include "xdr4cb.h"
44 #include "xdr4.h"
45 #include "nfs4xdr_gen.h"
46 
47 #define NFSDDBG_FACILITY                NFSDDBG_PROC
48 
49 #define NFSPROC4_CB_NULL 0
50 #define NFSPROC4_CB_COMPOUND 1
51 
52 /* Index of predefined Linux callback client operations */
53 
54 struct nfs4_cb_compound_hdr {
55 	/* args */
56 	u32		ident;	/* minorversion 0 only */
57 	u32		nops;
58 	__be32		*nops_p;
59 	u32		minorversion;
60 	/* res */
61 	int		status;
62 };
63 
64 static __be32 *xdr_encode_empty_array(__be32 *p)
65 {
66 	*p++ = xdr_zero;
67 	return p;
68 }
69 
70 /*
71  * Encode/decode NFSv4 CB basic data types
72  *
73  * Basic NFSv4 callback data types are defined in section 15 of RFC
74  * 3530: "Network File System (NFS) version 4 Protocol" and section
75  * 20 of RFC 5661: "Network File System (NFS) Version 4 Minor Version
76  * 1 Protocol"
77  */
78 
79 static void encode_uint32(struct xdr_stream *xdr, u32 n)
80 {
81 	WARN_ON_ONCE(xdr_stream_encode_u32(xdr, n) < 0);
82 }
83 
84 static void encode_bitmap4(struct xdr_stream *xdr, const __u32 *bitmap,
85 			   size_t len)
86 {
87 	xdr_stream_encode_uint32_array(xdr, bitmap, len);
88 }
89 
90 static int decode_cb_fattr4(struct xdr_stream *xdr, uint32_t *bitmap,
91 				struct nfs4_cb_fattr *fattr)
92 {
93 	fattr->ncf_cb_change = 0;
94 	fattr->ncf_cb_fsize = 0;
95 	fattr->ncf_cb_atime.tv_sec = 0;
96 	fattr->ncf_cb_atime.tv_nsec = 0;
97 	fattr->ncf_cb_mtime.tv_sec = 0;
98 	fattr->ncf_cb_mtime.tv_nsec = 0;
99 
100 	if (bitmap[0] & FATTR4_WORD0_CHANGE)
101 		if (xdr_stream_decode_u64(xdr, &fattr->ncf_cb_change) < 0)
102 			return -EIO;
103 	if (bitmap[0] & FATTR4_WORD0_SIZE)
104 		if (xdr_stream_decode_u64(xdr, &fattr->ncf_cb_fsize) < 0)
105 			return -EIO;
106 	if (bitmap[2] & FATTR4_WORD2_TIME_DELEG_ACCESS) {
107 		fattr4_time_deleg_access access;
108 
109 		if (!xdrgen_decode_fattr4_time_deleg_access(xdr, &access))
110 			return -EIO;
111 		if (access.nseconds >= NSEC_PER_SEC)
112 			return -EIO;
113 		fattr->ncf_cb_atime.tv_sec = access.seconds;
114 		fattr->ncf_cb_atime.tv_nsec = access.nseconds;
115 
116 	}
117 	if (bitmap[2] & FATTR4_WORD2_TIME_DELEG_MODIFY) {
118 		fattr4_time_deleg_modify modify;
119 
120 		if (!xdrgen_decode_fattr4_time_deleg_modify(xdr, &modify))
121 			return -EIO;
122 		if (modify.nseconds >= NSEC_PER_SEC)
123 			return -EIO;
124 		fattr->ncf_cb_mtime.tv_sec = modify.seconds;
125 		fattr->ncf_cb_mtime.tv_nsec = modify.nseconds;
126 
127 	}
128 	return 0;
129 }
130 
131 static void encode_nfs_cb_opnum4(struct xdr_stream *xdr, enum nfs_cb_opnum4 op)
132 {
133 	__be32 *p;
134 
135 	p = xdr_reserve_space(xdr, 4);
136 	*p = cpu_to_be32(op);
137 }
138 
139 /*
140  * nfs_fh4
141  *
142  *	typedef opaque nfs_fh4<NFS4_FHSIZE>;
143  */
144 static void encode_nfs_fh4(struct xdr_stream *xdr, const struct knfsd_fh *fh)
145 {
146 	u32 length = fh->fh_size;
147 	__be32 *p;
148 
149 	BUG_ON(length > NFS4_FHSIZE);
150 	p = xdr_reserve_space(xdr, 4 + length);
151 	xdr_encode_opaque(p, &fh->fh_raw, length);
152 }
153 
154 /*
155  * stateid4
156  *
157  *	struct stateid4 {
158  *		uint32_t	seqid;
159  *		opaque		other[12];
160  *	};
161  */
162 static void encode_stateid4(struct xdr_stream *xdr, const stateid_t *sid)
163 {
164 	__be32 *p;
165 
166 	p = xdr_reserve_space(xdr, NFS4_STATEID_SIZE);
167 	*p++ = cpu_to_be32(sid->si_generation);
168 	xdr_encode_opaque_fixed(p, &sid->si_opaque, NFS4_STATEID_OTHER_SIZE);
169 }
170 
171 /*
172  * sessionid4
173  *
174  *	typedef opaque sessionid4[NFS4_SESSIONID_SIZE];
175  */
176 static void encode_sessionid4(struct xdr_stream *xdr,
177 			      const struct nfsd4_session *session)
178 {
179 	__be32 *p;
180 
181 	p = xdr_reserve_space(xdr, NFS4_MAX_SESSIONID_LEN);
182 	xdr_encode_opaque_fixed(p, session->se_sessionid.data,
183 					NFS4_MAX_SESSIONID_LEN);
184 }
185 
186 /*
187  * nfsstat4
188  */
189 static const struct {
190 	int stat;
191 	int errno;
192 } nfs_cb_errtbl[] = {
193 	{ NFS4_OK,		0		},
194 	{ NFS4ERR_PERM,		-EPERM		},
195 	{ NFS4ERR_NOENT,	-ENOENT		},
196 	{ NFS4ERR_IO,		-EIO		},
197 	{ NFS4ERR_NXIO,		-ENXIO		},
198 	{ NFS4ERR_ACCESS,	-EACCES		},
199 	{ NFS4ERR_EXIST,	-EEXIST		},
200 	{ NFS4ERR_XDEV,		-EXDEV		},
201 	{ NFS4ERR_NOTDIR,	-ENOTDIR	},
202 	{ NFS4ERR_ISDIR,	-EISDIR		},
203 	{ NFS4ERR_INVAL,	-EINVAL		},
204 	{ NFS4ERR_FBIG,		-EFBIG		},
205 	{ NFS4ERR_NOSPC,	-ENOSPC		},
206 	{ NFS4ERR_ROFS,		-EROFS		},
207 	{ NFS4ERR_MLINK,	-EMLINK		},
208 	{ NFS4ERR_NAMETOOLONG,	-ENAMETOOLONG	},
209 	{ NFS4ERR_NOTEMPTY,	-ENOTEMPTY	},
210 	{ NFS4ERR_DQUOT,	-EDQUOT		},
211 	{ NFS4ERR_STALE,	-ESTALE		},
212 	{ NFS4ERR_BADHANDLE,	-EBADHANDLE	},
213 	{ NFS4ERR_BAD_COOKIE,	-EBADCOOKIE	},
214 	{ NFS4ERR_NOTSUPP,	-ENOTSUPP	},
215 	{ NFS4ERR_TOOSMALL,	-ETOOSMALL	},
216 	{ NFS4ERR_SERVERFAULT,	-ESERVERFAULT	},
217 	{ NFS4ERR_BADTYPE,	-EBADTYPE	},
218 	{ NFS4ERR_LOCKED,	-EAGAIN		},
219 	{ NFS4ERR_RESOURCE,	-EREMOTEIO	},
220 	{ NFS4ERR_SYMLINK,	-ELOOP		},
221 	{ NFS4ERR_OP_ILLEGAL,	-EOPNOTSUPP	},
222 	{ NFS4ERR_DEADLOCK,	-EDEADLK	},
223 	{ -1,			-EIO		}
224 };
225 
226 /*
227  * If we cannot translate the error, the recovery routines should
228  * handle it.
229  *
230  * Note: remaining NFSv4 error codes have values > 10000, so should
231  * not conflict with native Linux error codes.
232  */
233 static int nfs_cb_stat_to_errno(int status)
234 {
235 	int i;
236 
237 	for (i = 0; nfs_cb_errtbl[i].stat != -1; i++) {
238 		if (nfs_cb_errtbl[i].stat == status)
239 			return nfs_cb_errtbl[i].errno;
240 	}
241 
242 	dprintk("NFSD: Unrecognized NFS CB status value: %u\n", status);
243 	return -status;
244 }
245 
246 static int decode_cb_op_status(struct xdr_stream *xdr,
247 			       enum nfs_cb_opnum4 expected, int *status)
248 {
249 	__be32 *p;
250 	u32 op;
251 
252 	p = xdr_inline_decode(xdr, 4 + 4);
253 	if (unlikely(p == NULL))
254 		goto out_overflow;
255 	op = be32_to_cpup(p++);
256 	if (unlikely(op != expected))
257 		goto out_unexpected;
258 	*status = nfs_cb_stat_to_errno(be32_to_cpup(p));
259 	return 0;
260 out_overflow:
261 	return -EIO;
262 out_unexpected:
263 	dprintk("NFSD: Callback server returned operation %d but "
264 		"we issued a request for %d\n", op, expected);
265 	return -EIO;
266 }
267 
268 /*
269  * CB_COMPOUND4args
270  *
271  *	struct CB_COMPOUND4args {
272  *		utf8str_cs	tag;
273  *		uint32_t	minorversion;
274  *		uint32_t	callback_ident;
275  *		nfs_cb_argop4	argarray<>;
276  *	};
277 */
278 static void encode_cb_compound4args(struct xdr_stream *xdr,
279 				    struct nfs4_cb_compound_hdr *hdr)
280 {
281 	__be32 * p;
282 
283 	p = xdr_reserve_space(xdr, 4 + 4 + 4 + 4);
284 	p = xdr_encode_empty_array(p);		/* empty tag */
285 	*p++ = cpu_to_be32(hdr->minorversion);
286 	*p++ = cpu_to_be32(hdr->ident);
287 
288 	hdr->nops_p = p;
289 	*p = cpu_to_be32(hdr->nops);		/* argarray element count */
290 }
291 
292 /*
293  * Update argarray element count
294  */
295 static void encode_cb_nops(struct nfs4_cb_compound_hdr *hdr)
296 {
297 	BUG_ON(hdr->nops > NFS4_MAX_BACK_CHANNEL_OPS);
298 	*hdr->nops_p = cpu_to_be32(hdr->nops);
299 }
300 
301 /*
302  * CB_COMPOUND4res
303  *
304  *	struct CB_COMPOUND4res {
305  *		nfsstat4	status;
306  *		utf8str_cs	tag;
307  *		nfs_cb_resop4	resarray<>;
308  *	};
309  */
310 static int decode_cb_compound4res(struct xdr_stream *xdr,
311 				  struct nfs4_cb_compound_hdr *hdr)
312 {
313 	u32 length;
314 	__be32 *p;
315 
316 	p = xdr_inline_decode(xdr, XDR_UNIT);
317 	if (unlikely(p == NULL))
318 		goto out_overflow;
319 	hdr->status = be32_to_cpup(p);
320 	/* Ignore the tag */
321 	if (xdr_stream_decode_u32(xdr, &length) < 0)
322 		goto out_overflow;
323 	if (xdr_inline_decode(xdr, length) == NULL)
324 		goto out_overflow;
325 	if (xdr_stream_decode_u32(xdr, &hdr->nops) < 0)
326 		goto out_overflow;
327 	return 0;
328 out_overflow:
329 	return -EIO;
330 }
331 
332 /*
333  * CB_RECALL4args
334  *
335  *	struct CB_RECALL4args {
336  *		stateid4	stateid;
337  *		bool		truncate;
338  *		nfs_fh4		fh;
339  *	};
340  */
341 static void encode_cb_recall4args(struct xdr_stream *xdr,
342 				  const struct nfs4_delegation *dp,
343 				  struct nfs4_cb_compound_hdr *hdr)
344 {
345 	__be32 *p;
346 
347 	encode_nfs_cb_opnum4(xdr, OP_CB_RECALL);
348 	encode_stateid4(xdr, &dp->dl_stid.sc_stateid);
349 
350 	p = xdr_reserve_space(xdr, 4);
351 	*p++ = xdr_zero;			/* truncate */
352 
353 	encode_nfs_fh4(xdr, &dp->dl_stid.sc_file->fi_fhandle);
354 
355 	hdr->nops++;
356 }
357 
358 /*
359  * CB_RECALLANY4args
360  *
361  *	struct CB_RECALLANY4args {
362  *		uint32_t	craa_objects_to_keep;
363  *		bitmap4		craa_type_mask;
364  *	};
365  */
366 static void
367 encode_cb_recallany4args(struct xdr_stream *xdr,
368 	struct nfs4_cb_compound_hdr *hdr, struct nfsd4_cb_recall_any *ra)
369 {
370 	encode_nfs_cb_opnum4(xdr, OP_CB_RECALL_ANY);
371 	encode_uint32(xdr, ra->ra_keep);
372 	encode_bitmap4(xdr, ra->ra_bmval, ARRAY_SIZE(ra->ra_bmval));
373 	hdr->nops++;
374 }
375 
376 /*
377  * CB_GETATTR4args
378  *	struct CB_GETATTR4args {
379  *	   nfs_fh4 fh;
380  *	   bitmap4 attr_request;
381  *	};
382  *
383  * The size and change attributes are the only one
384  * guaranteed to be serviced by the client.
385  */
386 static void
387 encode_cb_getattr4args(struct xdr_stream *xdr, struct nfs4_cb_compound_hdr *hdr,
388 			struct nfs4_cb_fattr *fattr)
389 {
390 	struct nfs4_delegation *dp = container_of(fattr, struct nfs4_delegation, dl_cb_fattr);
391 	struct knfsd_fh *fh = &dp->dl_stid.sc_file->fi_fhandle;
392 	struct nfs4_cb_fattr *ncf = &dp->dl_cb_fattr;
393 	u32 bmap_size = 1;
394 	u32 bmap[3];
395 
396 	bmap[0] = FATTR4_WORD0_SIZE;
397 	if (!ncf->ncf_file_modified)
398 		bmap[0] |= FATTR4_WORD0_CHANGE;
399 
400 	if (deleg_attrs_deleg(dp->dl_type)) {
401 		bmap[1] = 0;
402 		bmap[2] = FATTR4_WORD2_TIME_DELEG_ACCESS | FATTR4_WORD2_TIME_DELEG_MODIFY;
403 		bmap_size = 3;
404 	}
405 	encode_nfs_cb_opnum4(xdr, OP_CB_GETATTR);
406 	encode_nfs_fh4(xdr, fh);
407 	encode_bitmap4(xdr, bmap, bmap_size);
408 	hdr->nops++;
409 }
410 
411 static u32 highest_slotid(struct nfsd4_session *ses)
412 {
413 	u32 idx;
414 
415 	spin_lock(&ses->se_lock);
416 	idx = fls(~ses->se_cb_slot_avail);
417 	if (idx > 0)
418 		--idx;
419 	idx = max(idx, ses->se_cb_highest_slot);
420 	spin_unlock(&ses->se_lock);
421 	return idx;
422 }
423 
424 static void
425 encode_referring_call4(struct xdr_stream *xdr,
426 		       const struct nfsd4_referring_call *rc)
427 {
428 	encode_uint32(xdr, rc->rc_sequenceid);
429 	encode_uint32(xdr, rc->rc_slotid);
430 }
431 
432 static void
433 encode_referring_call_list4(struct xdr_stream *xdr,
434 			    const struct nfsd4_referring_call_list *rcl)
435 {
436 	struct nfsd4_referring_call *rc;
437 	__be32 *p;
438 
439 	p = xdr_reserve_space(xdr, NFS4_MAX_SESSIONID_LEN);
440 	xdr_encode_opaque_fixed(p, rcl->rcl_sessionid.data,
441 					NFS4_MAX_SESSIONID_LEN);
442 	encode_uint32(xdr, rcl->__nr_referring_calls);
443 	list_for_each_entry(rc, &rcl->rcl_referring_calls, __list)
444 		encode_referring_call4(xdr, rc);
445 }
446 
447 /*
448  * CB_SEQUENCE4args
449  *
450  *	struct CB_SEQUENCE4args {
451  *		sessionid4		csa_sessionid;
452  *		sequenceid4		csa_sequenceid;
453  *		slotid4			csa_slotid;
454  *		slotid4			csa_highest_slotid;
455  *		bool			csa_cachethis;
456  *		referring_call_list4	csa_referring_call_lists<>;
457  *	};
458  */
459 static void encode_cb_sequence4args(struct xdr_stream *xdr,
460 				    const struct nfsd4_callback *cb,
461 				    struct nfs4_cb_compound_hdr *hdr)
462 {
463 	struct nfsd4_session *session;
464 	struct nfsd4_referring_call_list *rcl;
465 	__be32 *p;
466 
467 	if (hdr->minorversion == 0)
468 		return;
469 
470 	rcu_read_lock();
471 	session = rcu_dereference(cb->cb_clp->cl_cb_session);
472 	if (!session) {
473 		rcu_read_unlock();
474 		return;
475 	}
476 
477 	encode_nfs_cb_opnum4(xdr, OP_CB_SEQUENCE);
478 	encode_sessionid4(xdr, session);
479 
480 	p = xdr_reserve_space(xdr, XDR_UNIT * 4);
481 	*p++ = cpu_to_be32(session->se_cb_seq_nr[cb->cb_held_slot]);	/* csa_sequenceid */
482 	*p++ = cpu_to_be32(cb->cb_held_slot);		/* csa_slotid */
483 	*p++ = cpu_to_be32(highest_slotid(session)); /* csa_highest_slotid */
484 	*p++ = xdr_zero;			/* csa_cachethis */
485 
486 	/* csa_referring_call_lists */
487 	encode_uint32(xdr, cb->cb_nr_referring_call_list);
488 	list_for_each_entry(rcl, &cb->cb_referring_call_list, __list)
489 		encode_referring_call_list4(xdr, rcl);
490 
491 	hdr->nops++;
492 	rcu_read_unlock();
493 }
494 
495 static void update_cb_slot_table(struct nfsd4_session *ses, u32 target)
496 {
497 	/* No need to do anything if nothing changed */
498 	if (likely(target == READ_ONCE(ses->se_cb_highest_slot)))
499 		return;
500 
501 	spin_lock(&ses->se_lock);
502 	if (target > ses->se_cb_highest_slot) {
503 		int i;
504 
505 		target = min(target, NFSD_BC_SLOT_TABLE_SIZE - 1);
506 
507 		/*
508 		 * Growing the slot table. Reset any new sequences to 1.
509 		 *
510 		 * NB: There is some debate about whether the RFC requires this,
511 		 *     but the Linux client expects it.
512 		 */
513 		for (i = ses->se_cb_highest_slot + 1; i <= target; ++i)
514 			ses->se_cb_seq_nr[i] = 1;
515 	}
516 	ses->se_cb_highest_slot = target;
517 	spin_unlock(&ses->se_lock);
518 }
519 
520 /*
521  * CB_SEQUENCE4resok
522  *
523  *	struct CB_SEQUENCE4resok {
524  *		sessionid4	csr_sessionid;
525  *		sequenceid4	csr_sequenceid;
526  *		slotid4		csr_slotid;
527  *		slotid4		csr_highest_slotid;
528  *		slotid4		csr_target_highest_slotid;
529  *	};
530  *
531  *	union CB_SEQUENCE4res switch (nfsstat4 csr_status) {
532  *	case NFS4_OK:
533  *		CB_SEQUENCE4resok	csr_resok4;
534  *	default:
535  *		void;
536  *	};
537  *
538  * Our current back channel implmentation supports a single backchannel
539  * with a single slot.
540  */
541 static int decode_cb_sequence4resok(struct xdr_stream *xdr,
542 				    struct nfsd4_callback *cb)
543 {
544 	struct nfsd4_session *session;
545 	int status = -ESERVERFAULT;
546 	__be32 *p;
547 	u32 seqid, slotid, target;
548 
549 	rcu_read_lock();
550 	session = rcu_dereference(cb->cb_clp->cl_cb_session);
551 	if (!session) {
552 		rcu_read_unlock();
553 		cb->cb_seq_status = -NFS4ERR_BADSESSION;
554 		return -NFS4ERR_BADSESSION;
555 	}
556 
557 	/*
558 	 * If the server returns different values for sessionID, slotID or
559 	 * sequence number, the server is looney tunes.
560 	 */
561 	p = xdr_inline_decode(xdr, NFS4_MAX_SESSIONID_LEN + 4 + 4 + 4 + 4);
562 	if (unlikely(p == NULL)) {
563 		rcu_read_unlock();
564 		goto out_overflow;
565 	}
566 
567 	if (memcmp(p, session->se_sessionid.data, NFS4_MAX_SESSIONID_LEN)) {
568 		dprintk("NFS: %s Invalid session id\n", __func__);
569 		rcu_read_unlock();
570 		goto out;
571 	}
572 	p += XDR_QUADLEN(NFS4_MAX_SESSIONID_LEN);
573 
574 	seqid = be32_to_cpup(p++);
575 	if (seqid != session->se_cb_seq_nr[cb->cb_held_slot]) {
576 		dprintk("NFS: %s Invalid sequence number\n", __func__);
577 		rcu_read_unlock();
578 		goto out;
579 	}
580 
581 	slotid = be32_to_cpup(p++);
582 	if (slotid != cb->cb_held_slot) {
583 		dprintk("NFS: %s Invalid slotid\n", __func__);
584 		rcu_read_unlock();
585 		goto out;
586 	}
587 
588 	p++; // ignore current highest slot value
589 
590 	target = be32_to_cpup(p++);
591 	update_cb_slot_table(session, target);
592 	rcu_read_unlock();
593 	status = 0;
594 out:
595 	cb->cb_seq_status = status;
596 	return status;
597 out_overflow:
598 	status = -EIO;
599 	goto out;
600 }
601 
602 static int decode_cb_sequence4res(struct xdr_stream *xdr,
603 				  struct nfsd4_callback *cb)
604 {
605 	int status;
606 
607 	if (cb->cb_clp->cl_minorversion == 0)
608 		return 0;
609 
610 	status = decode_cb_op_status(xdr, OP_CB_SEQUENCE, &cb->cb_seq_status);
611 	if (unlikely(status || cb->cb_seq_status))
612 		return status;
613 
614 	return decode_cb_sequence4resok(xdr, cb);
615 }
616 
617 /*
618  * NFSv4.0 and NFSv4.1 XDR encode functions
619  *
620  * NFSv4.0 callback argument types are defined in section 15 of RFC
621  * 3530: "Network File System (NFS) version 4 Protocol" and section 20
622  * of RFC 5661:  "Network File System (NFS) Version 4 Minor Version 1
623  * Protocol".
624  */
625 
626 /*
627  * NB: Without this zero space reservation, callbacks over krb5p fail
628  */
629 static void nfs4_xdr_enc_cb_null(struct rpc_rqst *req, struct xdr_stream *xdr,
630 				 const void *__unused)
631 {
632 	xdr_reserve_space(xdr, 0);
633 }
634 
635 /*
636  * 20.1.  Operation 3: CB_GETATTR - Get Attributes
637  */
638 static void nfs4_xdr_enc_cb_getattr(struct rpc_rqst *req,
639 		struct xdr_stream *xdr, const void *data)
640 {
641 	const struct nfsd4_callback *cb = data;
642 	struct nfs4_cb_fattr *ncf =
643 		container_of(cb, struct nfs4_cb_fattr, ncf_getattr);
644 	struct nfs4_cb_compound_hdr hdr = {
645 		.ident = cb->cb_clp->cl_cb_ident,
646 		.minorversion = cb->cb_clp->cl_minorversion,
647 	};
648 
649 	encode_cb_compound4args(xdr, &hdr);
650 	encode_cb_sequence4args(xdr, cb, &hdr);
651 	encode_cb_getattr4args(xdr, &hdr, ncf);
652 	encode_cb_nops(&hdr);
653 }
654 
655 /*
656  * 20.2. Operation 4: CB_RECALL - Recall a Delegation
657  */
658 static void nfs4_xdr_enc_cb_recall(struct rpc_rqst *req, struct xdr_stream *xdr,
659 				   const void *data)
660 {
661 	const struct nfsd4_callback *cb = data;
662 	const struct nfs4_delegation *dp = cb_to_delegation(cb);
663 	struct nfs4_cb_compound_hdr hdr = {
664 		.ident = cb->cb_clp->cl_cb_ident,
665 		.minorversion = cb->cb_clp->cl_minorversion,
666 	};
667 
668 	encode_cb_compound4args(xdr, &hdr);
669 	encode_cb_sequence4args(xdr, cb, &hdr);
670 	encode_cb_recall4args(xdr, dp, &hdr);
671 	encode_cb_nops(&hdr);
672 }
673 
674 /*
675  * 20.6. Operation 8: CB_RECALL_ANY - Keep Any N Recallable Objects
676  */
677 static void
678 nfs4_xdr_enc_cb_recall_any(struct rpc_rqst *req,
679 		struct xdr_stream *xdr, const void *data)
680 {
681 	const struct nfsd4_callback *cb = data;
682 	struct nfsd4_cb_recall_any *ra;
683 	struct nfs4_cb_compound_hdr hdr = {
684 		.ident = cb->cb_clp->cl_cb_ident,
685 		.minorversion = cb->cb_clp->cl_minorversion,
686 	};
687 
688 	ra = container_of(cb, struct nfsd4_cb_recall_any, ra_cb);
689 	encode_cb_compound4args(xdr, &hdr);
690 	encode_cb_sequence4args(xdr, cb, &hdr);
691 	encode_cb_recallany4args(xdr, &hdr, ra);
692 	encode_cb_nops(&hdr);
693 }
694 
695 /*
696  * NFSv4.0 and NFSv4.1 XDR decode functions
697  *
698  * NFSv4.0 callback result types are defined in section 15 of RFC
699  * 3530: "Network File System (NFS) version 4 Protocol" and section 20
700  * of RFC 5661:  "Network File System (NFS) Version 4 Minor Version 1
701  * Protocol".
702  */
703 
704 static int nfs4_xdr_dec_cb_null(struct rpc_rqst *req, struct xdr_stream *xdr,
705 				void *__unused)
706 {
707 	return 0;
708 }
709 
710 /*
711  * 20.1.  Operation 3: CB_GETATTR - Get Attributes
712  */
713 static int nfs4_xdr_dec_cb_getattr(struct rpc_rqst *rqstp,
714 				  struct xdr_stream *xdr,
715 				  void *data)
716 {
717 	struct nfsd4_callback *cb = data;
718 	struct nfs4_cb_compound_hdr hdr;
719 	int status;
720 	u32 bitmap[3] = {0};
721 	u32 attrlen, maxlen;
722 	struct nfs4_cb_fattr *ncf =
723 		container_of(cb, struct nfs4_cb_fattr, ncf_getattr);
724 
725 	status = decode_cb_compound4res(xdr, &hdr);
726 	if (unlikely(status))
727 		return status;
728 
729 	status = decode_cb_sequence4res(xdr, cb);
730 	if (unlikely(status || cb->cb_seq_status))
731 		return status;
732 
733 	status = decode_cb_op_status(xdr, OP_CB_GETATTR, &cb->cb_status);
734 	if (unlikely(status || cb->cb_status))
735 		return status;
736 	if (xdr_stream_decode_uint32_array(xdr, bitmap, 3) < 0)
737 		return -EIO;
738 	if (xdr_stream_decode_u32(xdr, &attrlen) < 0)
739 		return -EIO;
740 	maxlen = sizeof(ncf->ncf_cb_change) + sizeof(ncf->ncf_cb_fsize);
741 	if (bitmap[2] != 0)
742 		maxlen += (sizeof(ncf->ncf_cb_mtime.tv_sec) +
743 			   sizeof(ncf->ncf_cb_mtime.tv_nsec)) * 2;
744 	if (attrlen > maxlen)
745 		return -EIO;
746 	status = decode_cb_fattr4(xdr, bitmap, ncf);
747 	return status;
748 }
749 
750 /*
751  * 20.2. Operation 4: CB_RECALL - Recall a Delegation
752  */
753 static int nfs4_xdr_dec_cb_recall(struct rpc_rqst *rqstp,
754 				  struct xdr_stream *xdr,
755 				  void *data)
756 {
757 	struct nfsd4_callback *cb = data;
758 	struct nfs4_cb_compound_hdr hdr;
759 	int status;
760 
761 	status = decode_cb_compound4res(xdr, &hdr);
762 	if (unlikely(status))
763 		return status;
764 
765 	status = decode_cb_sequence4res(xdr, cb);
766 	if (unlikely(status || cb->cb_seq_status))
767 		return status;
768 
769 	return decode_cb_op_status(xdr, OP_CB_RECALL, &cb->cb_status);
770 }
771 
772 /*
773  * 20.6. Operation 8: CB_RECALL_ANY - Keep Any N Recallable Objects
774  */
775 static int
776 nfs4_xdr_dec_cb_recall_any(struct rpc_rqst *rqstp,
777 				  struct xdr_stream *xdr,
778 				  void *data)
779 {
780 	struct nfsd4_callback *cb = data;
781 	struct nfs4_cb_compound_hdr hdr;
782 	int status;
783 
784 	status = decode_cb_compound4res(xdr, &hdr);
785 	if (unlikely(status))
786 		return status;
787 	status = decode_cb_sequence4res(xdr, cb);
788 	if (unlikely(status || cb->cb_seq_status))
789 		return status;
790 	status =  decode_cb_op_status(xdr, OP_CB_RECALL_ANY, &cb->cb_status);
791 	return status;
792 }
793 
794 #ifdef CONFIG_NFSD_PNFS
795 /*
796  * CB_LAYOUTRECALL4args
797  *
798  *	struct layoutrecall_file4 {
799  *		nfs_fh4         lor_fh;
800  *		offset4         lor_offset;
801  *		length4         lor_length;
802  *		stateid4        lor_stateid;
803  *	};
804  *
805  *	union layoutrecall4 switch(layoutrecall_type4 lor_recalltype) {
806  *	case LAYOUTRECALL4_FILE:
807  *		layoutrecall_file4 lor_layout;
808  *	case LAYOUTRECALL4_FSID:
809  *		fsid4              lor_fsid;
810  *	case LAYOUTRECALL4_ALL:
811  *		void;
812  *	};
813  *
814  *	struct CB_LAYOUTRECALL4args {
815  *		layouttype4             clora_type;
816  *		layoutiomode4           clora_iomode;
817  *		bool                    clora_changed;
818  *		layoutrecall4           clora_recall;
819  *	};
820  */
821 static void encode_cb_layout4args(struct xdr_stream *xdr,
822 				  const struct nfs4_layout_stateid *ls,
823 				  struct nfs4_cb_compound_hdr *hdr)
824 {
825 	__be32 *p;
826 
827 	BUG_ON(hdr->minorversion == 0);
828 
829 	p = xdr_reserve_space(xdr, 5 * 4);
830 	*p++ = cpu_to_be32(OP_CB_LAYOUTRECALL);
831 	*p++ = cpu_to_be32(ls->ls_layout_type);
832 	*p++ = cpu_to_be32(IOMODE_ANY);
833 	*p++ = cpu_to_be32(1);
834 	*p = cpu_to_be32(RETURN_FILE);
835 
836 	encode_nfs_fh4(xdr, &ls->ls_stid.sc_file->fi_fhandle);
837 
838 	p = xdr_reserve_space(xdr, 2 * 8);
839 	p = xdr_encode_hyper(p, 0);
840 	xdr_encode_hyper(p, NFS4_MAX_UINT64);
841 
842 	encode_stateid4(xdr, &ls->ls_recall_sid);
843 
844 	hdr->nops++;
845 }
846 
847 static void nfs4_xdr_enc_cb_layout(struct rpc_rqst *req,
848 				   struct xdr_stream *xdr,
849 				   const void *data)
850 {
851 	const struct nfsd4_callback *cb = data;
852 	const struct nfs4_layout_stateid *ls =
853 		container_of(cb, struct nfs4_layout_stateid, ls_recall);
854 	struct nfs4_cb_compound_hdr hdr = {
855 		.ident = 0,
856 		.minorversion = cb->cb_clp->cl_minorversion,
857 	};
858 
859 	encode_cb_compound4args(xdr, &hdr);
860 	encode_cb_sequence4args(xdr, cb, &hdr);
861 	encode_cb_layout4args(xdr, ls, &hdr);
862 	encode_cb_nops(&hdr);
863 }
864 
865 static int nfs4_xdr_dec_cb_layout(struct rpc_rqst *rqstp,
866 				  struct xdr_stream *xdr,
867 				  void *data)
868 {
869 	struct nfsd4_callback *cb = data;
870 	struct nfs4_cb_compound_hdr hdr;
871 	int status;
872 
873 	status = decode_cb_compound4res(xdr, &hdr);
874 	if (unlikely(status))
875 		return status;
876 
877 	status = decode_cb_sequence4res(xdr, cb);
878 	if (unlikely(status || cb->cb_seq_status))
879 		return status;
880 
881 	return decode_cb_op_status(xdr, OP_CB_LAYOUTRECALL, &cb->cb_status);
882 }
883 #endif /* CONFIG_NFSD_PNFS */
884 
885 static void encode_stateowner(struct xdr_stream *xdr, struct nfs4_stateowner *so)
886 {
887 	__be32	*p;
888 
889 	p = xdr_reserve_space(xdr, 8 + 4 + so->so_owner.len);
890 	p = xdr_encode_opaque_fixed(p, &so->so_client->cl_clientid, 8);
891 	xdr_encode_opaque(p, so->so_owner.data, so->so_owner.len);
892 }
893 
894 static void nfs4_xdr_enc_cb_notify(struct rpc_rqst *req,
895 				   struct xdr_stream *xdr,
896 				   const void *data)
897 {
898 	const struct nfsd4_callback *cb = data;
899 	struct nfs4_cb_compound_hdr hdr = {
900 		.ident = 0,
901 		.minorversion = cb->cb_clp->cl_minorversion,
902 	};
903 	struct CB_NOTIFY4args args = { };
904 
905 	WARN_ON_ONCE(hdr.minorversion == 0);
906 
907 	encode_cb_compound4args(xdr, &hdr);
908 	encode_cb_sequence4args(xdr, cb, &hdr);
909 
910 	/*
911 	 * FIXME: get stateid and fh from delegation. Inline the cna_changes
912 	 * buffer, and zero it.
913 	 */
914 	xdrgen_encode_CB_NOTIFY4args(xdr, &args);
915 
916 	hdr.nops++;
917 	encode_cb_nops(&hdr);
918 }
919 
920 static int nfs4_xdr_dec_cb_notify(struct rpc_rqst *rqstp,
921 				  struct xdr_stream *xdr,
922 				  void *data)
923 {
924 	struct nfsd4_callback *cb = data;
925 	struct nfs4_cb_compound_hdr hdr;
926 	int status;
927 
928 	status = decode_cb_compound4res(xdr, &hdr);
929 	if (unlikely(status))
930 		return status;
931 
932 	status = decode_cb_sequence4res(xdr, cb);
933 	if (unlikely(status || cb->cb_seq_status))
934 		return status;
935 
936 	return decode_cb_op_status(xdr, OP_CB_NOTIFY, &cb->cb_status);
937 }
938 
939 static void nfs4_xdr_enc_cb_notify_lock(struct rpc_rqst *req,
940 					struct xdr_stream *xdr,
941 					const void *data)
942 {
943 	const struct nfsd4_callback *cb = data;
944 	const struct nfsd4_blocked_lock *nbl =
945 		container_of(cb, struct nfsd4_blocked_lock, nbl_cb);
946 	struct nfs4_lockowner *lo = (struct nfs4_lockowner *)nbl->nbl_lock.c.flc_owner;
947 	struct nfs4_cb_compound_hdr hdr = {
948 		.ident = 0,
949 		.minorversion = cb->cb_clp->cl_minorversion,
950 	};
951 
952 	__be32 *p;
953 
954 	BUG_ON(hdr.minorversion == 0);
955 
956 	encode_cb_compound4args(xdr, &hdr);
957 	encode_cb_sequence4args(xdr, cb, &hdr);
958 
959 	p = xdr_reserve_space(xdr, 4);
960 	*p = cpu_to_be32(OP_CB_NOTIFY_LOCK);
961 	encode_nfs_fh4(xdr, &nbl->nbl_fh);
962 	encode_stateowner(xdr, &lo->lo_owner);
963 	hdr.nops++;
964 
965 	encode_cb_nops(&hdr);
966 }
967 
968 static int nfs4_xdr_dec_cb_notify_lock(struct rpc_rqst *rqstp,
969 					struct xdr_stream *xdr,
970 					void *data)
971 {
972 	struct nfsd4_callback *cb = data;
973 	struct nfs4_cb_compound_hdr hdr;
974 	int status;
975 
976 	status = decode_cb_compound4res(xdr, &hdr);
977 	if (unlikely(status))
978 		return status;
979 
980 	status = decode_cb_sequence4res(xdr, cb);
981 	if (unlikely(status || cb->cb_seq_status))
982 		return status;
983 
984 	return decode_cb_op_status(xdr, OP_CB_NOTIFY_LOCK, &cb->cb_status);
985 }
986 
987 /*
988  * struct write_response4 {
989  *	stateid4	wr_callback_id<1>;
990  *	length4		wr_count;
991  *	stable_how4	wr_committed;
992  *	verifier4	wr_writeverf;
993  * };
994  * union offload_info4 switch (nfsstat4 coa_status) {
995  *	case NFS4_OK:
996  *		write_response4	coa_resok4;
997  *	default:
998  *		length4		coa_bytes_copied;
999  * };
1000  * struct CB_OFFLOAD4args {
1001  *	nfs_fh4		coa_fh;
1002  *	stateid4	coa_stateid;
1003  *	offload_info4	coa_offload_info;
1004  * };
1005  */
1006 static void encode_offload_info4(struct xdr_stream *xdr,
1007 				 const struct nfsd4_cb_offload *cbo)
1008 {
1009 	__be32 *p;
1010 
1011 	p = xdr_reserve_space(xdr, 4);
1012 	*p = cbo->co_nfserr;
1013 	switch (cbo->co_nfserr) {
1014 	case nfs_ok:
1015 		p = xdr_reserve_space(xdr, 4 + 8 + 4 + NFS4_VERIFIER_SIZE);
1016 		p = xdr_encode_empty_array(p);
1017 		p = xdr_encode_hyper(p, cbo->co_res.wr_bytes_written);
1018 		*p++ = cpu_to_be32(cbo->co_res.wr_stable_how);
1019 		p = xdr_encode_opaque_fixed(p, cbo->co_res.wr_verifier.data,
1020 					    NFS4_VERIFIER_SIZE);
1021 		break;
1022 	default:
1023 		p = xdr_reserve_space(xdr, 8);
1024 		/* We always return success if bytes were written */
1025 		p = xdr_encode_hyper(p, 0);
1026 	}
1027 }
1028 
1029 static void encode_cb_offload4args(struct xdr_stream *xdr,
1030 				   const struct nfsd4_cb_offload *cbo,
1031 				   struct nfs4_cb_compound_hdr *hdr)
1032 {
1033 	__be32 *p;
1034 
1035 	p = xdr_reserve_space(xdr, 4);
1036 	*p = cpu_to_be32(OP_CB_OFFLOAD);
1037 	encode_nfs_fh4(xdr, &cbo->co_fh);
1038 	encode_stateid4(xdr, &cbo->co_res.cb_stateid);
1039 	encode_offload_info4(xdr, cbo);
1040 
1041 	hdr->nops++;
1042 }
1043 
1044 static void nfs4_xdr_enc_cb_offload(struct rpc_rqst *req,
1045 				    struct xdr_stream *xdr,
1046 				    const void *data)
1047 {
1048 	const struct nfsd4_callback *cb = data;
1049 	const struct nfsd4_cb_offload *cbo =
1050 		container_of(cb, struct nfsd4_cb_offload, co_cb);
1051 	struct nfs4_cb_compound_hdr hdr = {
1052 		.ident = 0,
1053 		.minorversion = cb->cb_clp->cl_minorversion,
1054 	};
1055 
1056 	encode_cb_compound4args(xdr, &hdr);
1057 	encode_cb_sequence4args(xdr, cb, &hdr);
1058 	encode_cb_offload4args(xdr, cbo, &hdr);
1059 	encode_cb_nops(&hdr);
1060 }
1061 
1062 static int nfs4_xdr_dec_cb_offload(struct rpc_rqst *rqstp,
1063 				   struct xdr_stream *xdr,
1064 				   void *data)
1065 {
1066 	struct nfsd4_callback *cb = data;
1067 	struct nfs4_cb_compound_hdr hdr;
1068 	int status;
1069 
1070 	status = decode_cb_compound4res(xdr, &hdr);
1071 	if (unlikely(status))
1072 		return status;
1073 
1074 	status = decode_cb_sequence4res(xdr, cb);
1075 	if (unlikely(status || cb->cb_seq_status))
1076 		return status;
1077 
1078 	return decode_cb_op_status(xdr, OP_CB_OFFLOAD, &cb->cb_status);
1079 }
1080 /*
1081  * RPC procedure tables
1082  */
1083 #define PROC(proc, call, argtype, restype)				\
1084 [NFSPROC4_CLNT_##proc] = {						\
1085 	.p_proc    = NFSPROC4_CB_##call,				\
1086 	.p_encode  = nfs4_xdr_enc_##argtype,		\
1087 	.p_decode  = nfs4_xdr_dec_##restype,				\
1088 	.p_arglen  = NFS4_enc_##argtype##_sz,				\
1089 	.p_replen  = NFS4_dec_##restype##_sz,				\
1090 	.p_statidx = NFSPROC4_CLNT_##proc,				\
1091 	.p_name    = #proc,						\
1092 }
1093 
1094 static const struct rpc_procinfo nfs4_cb_procedures[] = {
1095 	PROC(CB_NULL,	NULL,		cb_null,	cb_null),
1096 	PROC(CB_RECALL,	COMPOUND,	cb_recall,	cb_recall),
1097 #ifdef CONFIG_NFSD_PNFS
1098 	PROC(CB_LAYOUT,	COMPOUND,	cb_layout,	cb_layout),
1099 #endif
1100 	PROC(CB_NOTIFY,		COMPOUND,	cb_notify,	cb_notify),
1101 	PROC(CB_NOTIFY_LOCK,	COMPOUND,	cb_notify_lock,	cb_notify_lock),
1102 	PROC(CB_OFFLOAD,	COMPOUND,	cb_offload,	cb_offload),
1103 	PROC(CB_RECALL_ANY,	COMPOUND,	cb_recall_any,	cb_recall_any),
1104 	PROC(CB_GETATTR,	COMPOUND,	cb_getattr,	cb_getattr),
1105 };
1106 
1107 #define NFS4_CB_PROGRAM	0x40000000
1108 #define NFS4_CB_VERSION	1
1109 
1110 struct nfsd_net_cb {
1111 	struct rpc_version	version4;
1112 	const struct rpc_version *versions[NFS4_CB_VERSION + 1];
1113 	struct rpc_program	program;
1114 	struct rpc_stat		stat;
1115 };
1116 
1117 static int max_cb_time(struct net *net)
1118 {
1119 	struct nfsd_net *nn = net_generic(net, nfsd_net_id);
1120 
1121 	/*
1122 	 * nfsd4_lease is set to at most one hour in __nfsd4_write_time,
1123 	 * so we can use 32-bit math on it. Warn if that assumption
1124 	 * ever stops being true.
1125 	 */
1126 	if (WARN_ON_ONCE(nn->nfsd4_lease > 3600))
1127 		return 360 * HZ;
1128 
1129 	return max(((u32)nn->nfsd4_lease)/10, 1u) * HZ;
1130 }
1131 
1132 static bool nfsd4_queue_cb(struct nfsd4_callback *cb)
1133 {
1134 	struct nfs4_client *clp = cb->cb_clp;
1135 
1136 	trace_nfsd_cb_queue(clp, cb);
1137 	return queue_work(clp->cl_callback_wq, &cb->cb_work);
1138 }
1139 
1140 static void nfsd4_requeue_cb(struct rpc_task *task, struct nfsd4_callback *cb)
1141 {
1142 	struct nfs4_client *clp = cb->cb_clp;
1143 
1144 	if (!test_bit(NFSD4_CLIENT_CB_KILL, &clp->cl_flags)) {
1145 		trace_nfsd_cb_restart(clp, cb);
1146 		task->tk_status = 0;
1147 		set_bit(NFSD4_CALLBACK_REQUEUE, &cb->cb_flags);
1148 	}
1149 }
1150 
1151 static void nfsd41_cb_inflight_begin(struct nfs4_client *clp)
1152 {
1153 	atomic_inc(&clp->cl_cb_inflight);
1154 }
1155 
1156 static void nfsd41_cb_inflight_end(struct nfs4_client *clp)
1157 {
1158 
1159 	atomic_dec_and_wake_up(&clp->cl_cb_inflight);
1160 }
1161 
1162 static void nfsd41_cb_inflight_wait_complete(struct nfs4_client *clp)
1163 {
1164 	wait_var_event(&clp->cl_cb_inflight,
1165 			!atomic_read(&clp->cl_cb_inflight));
1166 }
1167 
1168 static const struct cred *get_backchannel_cred(struct nfs4_client *clp, struct rpc_clnt *client, struct nfsd4_session *ses)
1169 {
1170 	if (clp->cl_minorversion == 0) {
1171 		client->cl_principal = clp->cl_cred.cr_targ_princ ?
1172 			clp->cl_cred.cr_targ_princ : "nfs";
1173 
1174 		return get_cred(rpc_machine_cred());
1175 	} else {
1176 		struct cred *kcred;
1177 
1178 		kcred = prepare_kernel_cred(&init_task);
1179 		if (!kcred)
1180 			return NULL;
1181 
1182 		kcred->fsuid = ses->se_cb_sec.uid;
1183 		kcred->fsgid = ses->se_cb_sec.gid;
1184 		return kcred;
1185 	}
1186 }
1187 
1188 static int setup_callback_client(struct nfs4_client *clp, struct nfs4_cb_conn *conn, struct nfsd4_session *ses)
1189 {
1190 	struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
1191 	int maxtime = max_cb_time(clp->net);
1192 	struct rpc_timeout	timeparms = {
1193 		.to_initval	= maxtime,
1194 		.to_retries	= 0,
1195 		.to_maxval	= maxtime,
1196 	};
1197 	struct rpc_create_args args = {
1198 		.net		= clp->net,
1199 		.address	= (struct sockaddr *) &conn->cb_addr,
1200 		.addrsize	= conn->cb_addrlen,
1201 		.saddress	= (struct sockaddr *) &conn->cb_saddr,
1202 		.timeout	= &timeparms,
1203 		.version	= NFS4_CB_VERSION,
1204 		.flags		= (RPC_CLNT_CREATE_NOPING | RPC_CLNT_CREATE_QUIET),
1205 		.cred		= current_cred(),
1206 	};
1207 	struct rpc_clnt *client;
1208 	const struct cred *cred;
1209 
1210 	args.program = &nn->nfsd_cb->program;
1211 	if (clp->cl_minorversion == 0) {
1212 		if (!clp->cl_cred.cr_principal &&
1213 		    (clp->cl_cred.cr_flavor >= RPC_AUTH_GSS_KRB5)) {
1214 			trace_nfsd_cb_setup_err(clp, -EINVAL);
1215 			return -EINVAL;
1216 		}
1217 		args.client_name = clp->cl_cred.cr_principal;
1218 		args.prognumber	= conn->cb_prog;
1219 		args.protocol = XPRT_TRANSPORT_TCP;
1220 		args.authflavor = clp->cl_cred.cr_flavor;
1221 		clp->cl_cb_ident = conn->cb_ident;
1222 	} else {
1223 		if (!conn->cb_xprt || !ses)
1224 			return -EINVAL;
1225 		args.bc_xprt = conn->cb_xprt;
1226 		args.prognumber = ses->se_cb_prog;
1227 		args.protocol = conn->cb_xprt->xpt_class->xcl_ident |
1228 				XPRT_TRANSPORT_BC;
1229 		args.authflavor = ses->se_cb_sec.flavor;
1230 	}
1231 	/* Create RPC client */
1232 	client = rpc_create(&args);
1233 	if (IS_ERR(client)) {
1234 		trace_nfsd_cb_setup_err(clp, PTR_ERR(client));
1235 		return PTR_ERR(client);
1236 	}
1237 	cred = get_backchannel_cred(clp, client, ses);
1238 	if (!cred) {
1239 		trace_nfsd_cb_setup_err(clp, -ENOMEM);
1240 		rpc_shutdown_client(client);
1241 		return -ENOMEM;
1242 	}
1243 
1244 	if (clp->cl_minorversion != 0) {
1245 		clp->cl_cb_conn.cb_xprt = conn->cb_xprt;
1246 		rcu_assign_pointer(clp->cl_cb_session, ses);
1247 	}
1248 	clp->cl_cb_client = client;
1249 	clp->cl_cb_cred = cred;
1250 	rcu_read_lock();
1251 	trace_nfsd_cb_setup(clp, rpc_peeraddr2str(client, RPC_DISPLAY_NETID),
1252 			    args.authflavor);
1253 	rcu_read_unlock();
1254 	return 0;
1255 }
1256 
1257 static void nfsd4_mark_cb_state(struct nfs4_client *clp, int newstate)
1258 {
1259 	if (clp->cl_cb_state != newstate) {
1260 		clp->cl_cb_state = newstate;
1261 		trace_nfsd_cb_new_state(clp);
1262 	}
1263 }
1264 
1265 static void nfsd4_mark_cb_down(struct nfs4_client *clp)
1266 {
1267 	if (test_bit(NFSD4_CLIENT_CB_UPDATE, &clp->cl_flags))
1268 		return;
1269 	nfsd4_mark_cb_state(clp, NFSD4_CB_DOWN);
1270 }
1271 
1272 static void nfsd4_mark_cb_fault(struct nfs4_client *clp)
1273 {
1274 	if (test_bit(NFSD4_CLIENT_CB_UPDATE, &clp->cl_flags))
1275 		return;
1276 	nfsd4_mark_cb_state(clp, NFSD4_CB_FAULT);
1277 }
1278 
1279 static void nfsd4_cb_probe_done(struct rpc_task *task, void *calldata)
1280 {
1281 	struct nfs4_client *clp = container_of(calldata, struct nfs4_client, cl_cb_null);
1282 
1283 	if (task->tk_status)
1284 		nfsd4_mark_cb_down(clp);
1285 	else
1286 		nfsd4_mark_cb_state(clp, NFSD4_CB_UP);
1287 }
1288 
1289 static void nfsd4_cb_probe_release(void *calldata)
1290 {
1291 	struct nfs4_client *clp = container_of(calldata, struct nfs4_client, cl_cb_null);
1292 
1293 	nfsd41_cb_inflight_end(clp);
1294 
1295 }
1296 
1297 static const struct rpc_call_ops nfsd4_cb_probe_ops = {
1298 	/* XXX: release method to ensure we set the cb channel down if
1299 	 * necessary on early failure? */
1300 	.rpc_call_done = nfsd4_cb_probe_done,
1301 	.rpc_release = nfsd4_cb_probe_release,
1302 };
1303 
1304 /*
1305  * Poke the callback thread to process any updates to the callback
1306  * parameters, and send a null probe.
1307  */
1308 void nfsd4_probe_callback(struct nfs4_client *clp)
1309 {
1310 	trace_nfsd_cb_probe(clp);
1311 	nfsd4_mark_cb_state(clp, NFSD4_CB_UNKNOWN);
1312 	set_bit(NFSD4_CLIENT_CB_UPDATE, &clp->cl_flags);
1313 	nfsd4_run_cb(&clp->cl_cb_null);
1314 }
1315 
1316 void nfsd4_probe_callback_sync(struct nfs4_client *clp)
1317 {
1318 	nfsd4_probe_callback(clp);
1319 	flush_workqueue(clp->cl_callback_wq);
1320 }
1321 
1322 void nfsd4_change_callback(struct nfs4_client *clp, struct nfs4_cb_conn *conn)
1323 {
1324 	nfsd4_mark_cb_state(clp, NFSD4_CB_UNKNOWN);
1325 	spin_lock(&clp->cl_lock);
1326 	memcpy(&clp->cl_cb_conn, conn, sizeof(struct nfs4_cb_conn));
1327 	spin_unlock(&clp->cl_lock);
1328 }
1329 
1330 static int grab_slot(struct nfsd4_session *ses)
1331 {
1332 	int idx;
1333 
1334 	spin_lock(&ses->se_lock);
1335 	idx = ffs(ses->se_cb_slot_avail) - 1;
1336 	if (idx < 0 || idx > ses->se_cb_highest_slot) {
1337 		spin_unlock(&ses->se_lock);
1338 		return -1;
1339 	}
1340 	/* clear the bit for the slot */
1341 	ses->se_cb_slot_avail &= ~BIT(idx);
1342 	spin_unlock(&ses->se_lock);
1343 	return idx;
1344 }
1345 
1346 /*
1347  * There's currently a single callback channel slot.
1348  * If the slot is available, then mark it busy.  Otherwise, set the
1349  * thread for sleeping on the callback RPC wait queue.
1350  */
1351 static bool nfsd41_cb_get_slot(struct nfsd4_callback *cb, struct rpc_task *task)
1352 {
1353 	struct nfs4_client *clp = cb->cb_clp;
1354 	struct nfsd4_session *ses;
1355 
1356 	if (cb->cb_held_slot >= 0)
1357 		return true;
1358 
1359 	rcu_read_lock();
1360 	ses = rcu_dereference(clp->cl_cb_session);
1361 	if (!ses) {
1362 		rcu_read_unlock();
1363 		rpc_sleep_on(&clp->cl_cb_waitq, task, NULL);
1364 		return false;
1365 	}
1366 	cb->cb_held_slot = grab_slot(ses);
1367 	if (cb->cb_held_slot < 0) {
1368 		rcu_read_unlock();
1369 		rpc_sleep_on(&clp->cl_cb_waitq, task, NULL);
1370 		/* Race breaker */
1371 		rcu_read_lock();
1372 		ses = rcu_dereference(clp->cl_cb_session);
1373 		if (ses)
1374 			cb->cb_held_slot = grab_slot(ses);
1375 		rcu_read_unlock();
1376 		if (cb->cb_held_slot < 0)
1377 			return false;
1378 		rpc_wake_up_queued_task(&clp->cl_cb_waitq, task);
1379 	} else {
1380 		rcu_read_unlock();
1381 	}
1382 	return true;
1383 }
1384 
1385 static void nfsd41_cb_release_slot(struct nfsd4_callback *cb)
1386 {
1387 	struct nfs4_client *clp = cb->cb_clp;
1388 	struct nfsd4_session *ses;
1389 
1390 	if (cb->cb_held_slot >= 0) {
1391 		rcu_read_lock();
1392 		ses = rcu_dereference(clp->cl_cb_session);
1393 		if (ses) {
1394 			spin_lock(&ses->se_lock);
1395 			ses->se_cb_slot_avail |= BIT(cb->cb_held_slot);
1396 			spin_unlock(&ses->se_lock);
1397 		}
1398 		rcu_read_unlock();
1399 		cb->cb_held_slot = -1;
1400 		rpc_wake_up_next(&clp->cl_cb_waitq);
1401 	}
1402 }
1403 
1404 static void nfsd41_destroy_cb(struct nfsd4_callback *cb)
1405 {
1406 	struct nfs4_client *clp = cb->cb_clp;
1407 
1408 	trace_nfsd_cb_destroy(clp, cb);
1409 	nfsd41_cb_release_slot(cb);
1410 	if (test_bit(NFSD4_CALLBACK_WAKE, &cb->cb_flags))
1411 		clear_and_wake_up_bit(NFSD4_CALLBACK_RUNNING, &cb->cb_flags);
1412 	else
1413 		clear_bit(NFSD4_CALLBACK_RUNNING, &cb->cb_flags);
1414 
1415 	if (cb->cb_ops && cb->cb_ops->release)
1416 		cb->cb_ops->release(cb);
1417 	nfsd41_cb_inflight_end(clp);
1418 }
1419 
1420 /**
1421  * nfsd41_cb_referring_call - add a referring call to a callback operation
1422  * @cb: context of callback to add the rc to
1423  * @sessionid: referring call's session ID
1424  * @slotid: referring call's session slot index
1425  * @seqno: referring call's slot sequence number
1426  *
1427  * Caller serializes access to @cb.
1428  *
1429  * NB: If memory allocation fails, the referring call is not added.
1430  */
1431 void nfsd41_cb_referring_call(struct nfsd4_callback *cb,
1432 			      struct nfs4_sessionid *sessionid,
1433 			      u32 slotid, u32 seqno)
1434 {
1435 	struct nfsd4_referring_call_list *rcl;
1436 	struct nfsd4_referring_call *rc;
1437 	bool found;
1438 
1439 	might_sleep();
1440 
1441 	found = false;
1442 	list_for_each_entry(rcl, &cb->cb_referring_call_list, __list) {
1443 		if (!memcmp(rcl->rcl_sessionid.data, sessionid->data,
1444 			   NFS4_MAX_SESSIONID_LEN)) {
1445 			found = true;
1446 			break;
1447 		}
1448 	}
1449 	if (!found) {
1450 		rcl = kmalloc_obj(*rcl);
1451 		if (!rcl)
1452 			return;
1453 		memcpy(rcl->rcl_sessionid.data, sessionid->data,
1454 		       NFS4_MAX_SESSIONID_LEN);
1455 		rcl->__nr_referring_calls = 0;
1456 		INIT_LIST_HEAD(&rcl->rcl_referring_calls);
1457 		list_add(&rcl->__list, &cb->cb_referring_call_list);
1458 		cb->cb_nr_referring_call_list++;
1459 	}
1460 
1461 	found = false;
1462 	list_for_each_entry(rc, &rcl->rcl_referring_calls, __list) {
1463 		if (rc->rc_sequenceid == seqno && rc->rc_slotid == slotid) {
1464 			found = true;
1465 			break;
1466 		}
1467 	}
1468 	if (!found) {
1469 		rc = kmalloc_obj(*rc);
1470 		if (!rc)
1471 			goto out;
1472 		rc->rc_sequenceid = seqno;
1473 		rc->rc_slotid = slotid;
1474 		rcl->__nr_referring_calls++;
1475 		list_add(&rc->__list, &rcl->rcl_referring_calls);
1476 	}
1477 
1478 out:
1479 	if (!rcl->__nr_referring_calls) {
1480 		cb->cb_nr_referring_call_list--;
1481 		list_del(&rcl->__list);
1482 		kfree(rcl);
1483 	}
1484 }
1485 
1486 /**
1487  * nfsd41_cb_destroy_referring_call_list - release referring call info
1488  * @cb: context of a callback that has completed
1489  *
1490  * Callers who allocate referring calls using nfsd41_cb_referring_call() must
1491  * release those resources by calling nfsd41_cb_destroy_referring_call_list.
1492  *
1493  * Caller serializes access to @cb.
1494  */
1495 void nfsd41_cb_destroy_referring_call_list(struct nfsd4_callback *cb)
1496 {
1497 	struct nfsd4_referring_call_list *rcl;
1498 	struct nfsd4_referring_call *rc;
1499 
1500 	while (!list_empty(&cb->cb_referring_call_list)) {
1501 		rcl = list_first_entry(&cb->cb_referring_call_list,
1502 				       struct nfsd4_referring_call_list,
1503 				       __list);
1504 
1505 		while (!list_empty(&rcl->rcl_referring_calls)) {
1506 			rc = list_first_entry(&rcl->rcl_referring_calls,
1507 					      struct nfsd4_referring_call,
1508 					      __list);
1509 			list_del(&rc->__list);
1510 			kfree(rc);
1511 		}
1512 		list_del(&rcl->__list);
1513 		kfree(rcl);
1514 	}
1515 }
1516 
1517 static void nfsd4_cb_prepare(struct rpc_task *task, void *calldata)
1518 {
1519 	struct nfsd4_callback *cb = calldata;
1520 	struct nfs4_client *clp = cb->cb_clp;
1521 	u32 minorversion = clp->cl_minorversion;
1522 
1523 	/*
1524 	 * cb_seq_status is only set in decode_cb_sequence4res,
1525 	 * and so will remain 1 if an rpc level failure occurs.
1526 	 */
1527 	trace_nfsd_cb_rpc_prepare(clp);
1528 	cb->cb_seq_status = 1;
1529 	cb->cb_status = 0;
1530 	if (minorversion) {
1531 		if (!rcu_access_pointer(clp->cl_cb_session)) {
1532 			rpc_exit(task, -EIO);
1533 			return;
1534 		}
1535 		if (!nfsd41_cb_get_slot(cb, task))
1536 			return;
1537 	}
1538 	rpc_call_start(task);
1539 }
1540 
1541 /* Returns true if CB_COMPOUND processing should continue */
1542 static bool nfsd4_cb_sequence_done(struct rpc_task *task, struct nfsd4_callback *cb)
1543 {
1544 	struct nfsd4_session *session;
1545 	bool ret = false;
1546 
1547 	if (cb->cb_held_slot < 0)
1548 		goto requeue;
1549 
1550 	rcu_read_lock();
1551 	session = rcu_dereference(cb->cb_clp->cl_cb_session);
1552 	if (!session) {
1553 		rcu_read_unlock();
1554 		goto requeue;
1555 	}
1556 
1557 	/* This is the operation status code for CB_SEQUENCE */
1558 	trace_nfsd_cb_seq_status(task, cb, session);
1559 	switch (cb->cb_seq_status) {
1560 	case 0:
1561 		/*
1562 		 * No need for lock, access serialized in nfsd4_cb_prepare
1563 		 *
1564 		 * RFC5661 20.9.3
1565 		 * If CB_SEQUENCE returns an error, then the state of the slot
1566 		 * (sequence ID, cached reply) MUST NOT change.
1567 		 */
1568 		++session->se_cb_seq_nr[cb->cb_held_slot];
1569 		ret = true;
1570 		break;
1571 	case -ESERVERFAULT:
1572 		/*
1573 		 * Call succeeded, but the session, slot index, or slot
1574 		 * sequence number in the response do not match the same
1575 		 * in the server's call. The sequence information is thus
1576 		 * untrustworthy.
1577 		 */
1578 		nfsd4_mark_cb_fault(cb->cb_clp);
1579 		break;
1580 	case 1:
1581 		/*
1582 		 * cb_seq_status remains 1 if an RPC Reply was never
1583 		 * received. NFSD can't know if the client processed
1584 		 * the CB_SEQUENCE operation. Ask the client to send a
1585 		 * DESTROY_SESSION to recover.
1586 		 */
1587 		fallthrough;
1588 	case -NFS4ERR_BADSESSION:
1589 		nfsd4_mark_cb_fault(cb->cb_clp);
1590 		rcu_read_unlock();
1591 		goto requeue;
1592 	case -NFS4ERR_DELAY:
1593 		cb->cb_seq_status = 1;
1594 		if (RPC_SIGNALLED(task) || !rpc_restart_call(task)) {
1595 			rcu_read_unlock();
1596 			goto requeue;
1597 		}
1598 		rpc_delay(task, 2 * HZ);
1599 		rcu_read_unlock();
1600 		return false;
1601 	case -NFS4ERR_SEQ_MISORDERED:
1602 	case -NFS4ERR_BADSLOT:
1603 		/*
1604 		 * A SEQ_MISORDERED or BADSLOT error means that the client and
1605 		 * server are out of sync as to the backchannel parameters. Mark
1606 		 * the backchannel faulty and restart the RPC, but leak the slot
1607 		 * so that it's no longer used.
1608 		 */
1609 		nfsd4_mark_cb_fault(cb->cb_clp);
1610 		cb->cb_held_slot = -1;
1611 		rcu_read_unlock();
1612 		goto retry_nowait;
1613 	default:
1614 		nfsd4_mark_cb_fault(cb->cb_clp);
1615 	}
1616 	trace_nfsd_cb_free_slot(task, cb, session);
1617 	rcu_read_unlock();
1618 	nfsd41_cb_release_slot(cb);
1619 	return ret;
1620 retry_nowait:
1621 	/*
1622 	 * RPC_SIGNALLED() means that the rpc_client is being torn down and
1623 	 * (possibly) recreated. Requeue the call in that case.
1624 	 */
1625 	if (!RPC_SIGNALLED(task)) {
1626 		if (rpc_restart_call_prepare(task))
1627 			return false;
1628 	}
1629 requeue:
1630 	nfsd41_cb_release_slot(cb);
1631 	nfsd4_requeue_cb(task, cb);
1632 	return false;
1633 }
1634 
1635 static void nfsd4_cb_done(struct rpc_task *task, void *calldata)
1636 {
1637 	struct nfsd4_callback *cb = calldata;
1638 	struct nfs4_client *clp = cb->cb_clp;
1639 
1640 	trace_nfsd_cb_rpc_done(clp);
1641 
1642 	if (!clp->cl_minorversion) {
1643 		/*
1644 		 * If the backchannel connection was shut down while this
1645 		 * task was queued, we need to resubmit it after setting up
1646 		 * a new backchannel connection.
1647 		 *
1648 		 * Note that if we lost our callback connection permanently
1649 		 * the submission code will error out, so we don't need to
1650 		 * handle that case here.
1651 		 */
1652 		if (RPC_SIGNALLED(task))
1653 			nfsd4_requeue_cb(task, cb);
1654 	} else if (!nfsd4_cb_sequence_done(task, cb)) {
1655 		return;
1656 	}
1657 
1658 	if (cb->cb_status) {
1659 		WARN_ONCE(task->tk_status,
1660 			  "cb_status=%d tk_status=%d cb_opcode=%d",
1661 			  cb->cb_status, task->tk_status, cb->cb_ops->opcode);
1662 		task->tk_status = cb->cb_status;
1663 	}
1664 
1665 	switch (cb->cb_ops->done(cb, task)) {
1666 	case 0:
1667 		task->tk_status = 0;
1668 		rpc_restart_call_prepare(task);
1669 		return;
1670 	case 1:
1671 		switch (task->tk_status) {
1672 		case -EIO:
1673 		case -ETIMEDOUT:
1674 		case -EACCES:
1675 			nfsd4_mark_cb_down(clp);
1676 		}
1677 		break;
1678 	default:
1679 		BUG();
1680 	}
1681 }
1682 
1683 static void nfsd4_cb_release(void *calldata)
1684 {
1685 	struct nfsd4_callback *cb = calldata;
1686 
1687 	trace_nfsd_cb_rpc_release(cb->cb_clp);
1688 
1689 	if (test_bit(NFSD4_CALLBACK_REQUEUE, &cb->cb_flags))
1690 		nfsd4_queue_cb(cb);
1691 	else
1692 		nfsd41_destroy_cb(cb);
1693 
1694 }
1695 
1696 static const struct rpc_call_ops nfsd4_cb_ops = {
1697 	.rpc_call_prepare = nfsd4_cb_prepare,
1698 	.rpc_call_done = nfsd4_cb_done,
1699 	.rpc_release = nfsd4_cb_release,
1700 };
1701 
1702 /* must be called under the state lock */
1703 void nfsd4_shutdown_callback(struct nfs4_client *clp)
1704 {
1705 	if (clp->cl_cb_state != NFSD4_CB_UNKNOWN)
1706 		trace_nfsd_cb_shutdown(clp);
1707 
1708 	set_bit(NFSD4_CLIENT_CB_KILL, &clp->cl_flags);
1709 	/*
1710 	 * Note this won't actually result in a null callback;
1711 	 * instead, nfsd4_run_cb_null() will detect the killed
1712 	 * client, destroy the rpc client, and stop:
1713 	 */
1714 	nfsd4_run_cb(&clp->cl_cb_null);
1715 	flush_workqueue(clp->cl_callback_wq);
1716 	nfsd41_cb_inflight_wait_complete(clp);
1717 }
1718 
1719 static struct nfsd4_conn * __nfsd4_find_backchannel(struct nfs4_client *clp)
1720 {
1721 	struct nfsd4_session *s;
1722 	struct nfsd4_conn *c;
1723 
1724 	lockdep_assert_held(&clp->cl_lock);
1725 
1726 	list_for_each_entry(s, &clp->cl_sessions, se_perclnt) {
1727 		list_for_each_entry(c, &s->se_conns, cn_persession) {
1728 			if (c->cn_flags & NFS4_CDFC4_BACK)
1729 				return c;
1730 		}
1731 	}
1732 	return NULL;
1733 }
1734 
1735 /*
1736  * Note there isn't a lot of locking in this code; instead we depend on
1737  * the fact that it is run from clp->cl_callback_wq, which won't run two
1738  * work items at once.  So, for example, clp->cl_callback_wq handles all
1739  * access of cl_cb_client, and all calls to rpc_create or
1740  * rpc_shutdown_client.
1741  *
1742  * cl_cb_session is written only from cl_callback_wq (via
1743  * rcu_assign_pointer) and read from rpciod under rcu_read_lock (via
1744  * rcu_dereference) by encode_cb_sequence4args(), decode_cb_sequence4resok(),
1745  * nfsd4_cb_sequence_done(), and the cb-slot helpers.  Sessions are freed
1746  * with kfree_rcu() so that rpciod readers in an RCU read-side critical
1747  * section never dereference a freed session.
1748  */
1749 static void nfsd4_process_cb_update(struct nfsd4_callback *cb)
1750 {
1751 	struct nfs4_cb_conn conn;
1752 	struct nfs4_client *clp = cb->cb_clp;
1753 	struct nfsd4_session *ses = NULL;
1754 	struct nfsd4_conn *c;
1755 	int err;
1756 
1757 	trace_nfsd_cb_bc_update(clp, cb);
1758 
1759 	/*
1760 	 * This is either an update, or the client dying; in either case,
1761 	 * kill the old client:
1762 	 */
1763 	if (clp->cl_cb_client) {
1764 		trace_nfsd_cb_bc_shutdown(clp, cb);
1765 		rpc_shutdown_client(clp->cl_cb_client);
1766 		clp->cl_cb_client = NULL;
1767 		put_cred(clp->cl_cb_cred);
1768 		clp->cl_cb_cred = NULL;
1769 	}
1770 	if (clp->cl_cb_conn.cb_xprt) {
1771 		svc_xprt_put(clp->cl_cb_conn.cb_xprt);
1772 		clp->cl_cb_conn.cb_xprt = NULL;
1773 	}
1774 	if (test_bit(NFSD4_CLIENT_CB_KILL, &clp->cl_flags))
1775 		return;
1776 
1777 	spin_lock(&clp->cl_lock);
1778 	/*
1779 	 * Only serialized callback code is allowed to clear these
1780 	 * flags; main nfsd code can only set them:
1781 	 */
1782 	WARN_ON(!(clp->cl_flags & NFSD4_CLIENT_CB_FLAG_MASK));
1783 	clear_bit(NFSD4_CLIENT_CB_UPDATE, &clp->cl_flags);
1784 
1785 	memcpy(&conn, &cb->cb_clp->cl_cb_conn, sizeof(struct nfs4_cb_conn));
1786 	c = __nfsd4_find_backchannel(clp);
1787 	if (c) {
1788 		svc_xprt_get(c->cn_xprt);
1789 		conn.cb_xprt = c->cn_xprt;
1790 		ses = c->cn_session;
1791 	}
1792 	spin_unlock(&clp->cl_lock);
1793 
1794 	err = setup_callback_client(clp, &conn, ses);
1795 	if (err) {
1796 		nfsd4_mark_cb_down(clp);
1797 		if (c)
1798 			svc_xprt_put(c->cn_xprt);
1799 		rcu_assign_pointer(clp->cl_cb_session, ses);
1800 		return;
1801 	}
1802 }
1803 
1804 static void
1805 nfsd4_run_cb_work(struct work_struct *work)
1806 {
1807 	struct nfsd4_callback *cb =
1808 		container_of(work, struct nfsd4_callback, cb_work);
1809 	struct nfs4_client *clp = cb->cb_clp;
1810 	struct rpc_clnt *clnt;
1811 	int flags, ret;
1812 
1813 	trace_nfsd_cb_start(clp);
1814 
1815 	if (clp->cl_flags & NFSD4_CLIENT_CB_FLAG_MASK)
1816 		nfsd4_process_cb_update(cb);
1817 
1818 	clnt = clp->cl_cb_client;
1819 	if (!clnt || clp->cl_state == NFSD4_COURTESY) {
1820 		/*
1821 		 * Callback channel broken, client killed or
1822 		 * nfs4_client in courtesy state; give up.
1823 		 */
1824 		nfsd41_destroy_cb(cb);
1825 		return;
1826 	}
1827 
1828 	/*
1829 	 * Don't send probe messages for 4.1 or later.
1830 	 */
1831 	if (!cb->cb_ops && clp->cl_minorversion) {
1832 		nfsd4_mark_cb_state(clp, NFSD4_CB_UP);
1833 		nfsd41_destroy_cb(cb);
1834 		return;
1835 	}
1836 
1837 	if (!test_and_clear_bit(NFSD4_CALLBACK_REQUEUE, &cb->cb_flags)) {
1838 		if (cb->cb_ops && cb->cb_ops->prepare)
1839 			if (!cb->cb_ops->prepare(cb)) {
1840 				nfsd41_destroy_cb(cb);
1841 				return;
1842 			}
1843 	}
1844 
1845 	cb->cb_msg.rpc_cred = clp->cl_cb_cred;
1846 	flags = clp->cl_minorversion ? RPC_TASK_NOCONNECT : RPC_TASK_SOFTCONN;
1847 	ret = rpc_call_async(clnt, &cb->cb_msg, RPC_TASK_SOFT | flags,
1848 			     cb->cb_ops ? &nfsd4_cb_ops : &nfsd4_cb_probe_ops, cb);
1849 	if (ret != 0) {
1850 		set_bit(NFSD4_CALLBACK_REQUEUE, &cb->cb_flags);
1851 		nfsd4_queue_cb(cb);
1852 	}
1853 }
1854 
1855 void nfsd4_init_cb(struct nfsd4_callback *cb, struct nfs4_client *clp,
1856 		const struct nfsd4_callback_ops *ops, enum nfsd4_cb_op op)
1857 {
1858 	cb->cb_clp = clp;
1859 	cb->cb_msg.rpc_proc = &nfs4_cb_procedures[op];
1860 	cb->cb_msg.rpc_argp = cb;
1861 	cb->cb_msg.rpc_resp = cb;
1862 	cb->cb_flags = 0;
1863 	cb->cb_ops = ops;
1864 	INIT_WORK(&cb->cb_work, nfsd4_run_cb_work);
1865 	cb->cb_status = 0;
1866 	cb->cb_held_slot = -1;
1867 	cb->cb_nr_referring_call_list = 0;
1868 	INIT_LIST_HEAD(&cb->cb_referring_call_list);
1869 }
1870 
1871 /**
1872  * nfsd4_run_cb - queue up a callback job to run
1873  * @cb: callback to queue
1874  *
1875  * Kick off a callback to do its thing. Returns false if it was already
1876  * on a queue, true otherwise.
1877  */
1878 bool nfsd4_run_cb(struct nfsd4_callback *cb)
1879 {
1880 	struct nfs4_client *clp = cb->cb_clp;
1881 	bool queued;
1882 
1883 	nfsd41_cb_inflight_begin(clp);
1884 	queued = nfsd4_queue_cb(cb);
1885 	if (!queued)
1886 		nfsd41_cb_inflight_end(clp);
1887 	return queued;
1888 }
1889 
1890 /**
1891  * nfsd_net_cb_shutdown - release per-netns callback RPC program resources
1892  * @nn: NFS server network namespace
1893  *
1894  * Frees resources allocated by nfsd_net_cb_init().
1895  */
1896 void nfsd_net_cb_shutdown(struct nfsd_net *nn)
1897 {
1898 	struct nfsd_net_cb *cb = nn->nfsd_cb;
1899 
1900 	if (cb) {
1901 		kfree(cb->version4.counts);
1902 		kfree(cb);
1903 		nn->nfsd_cb = NULL;
1904 	}
1905 }
1906 
1907 /**
1908  * nfsd_net_cb_init - initialize per-netns callback RPC program
1909  * @nn: NFS server network namespace
1910  *
1911  * Sets up the callback RPC program, version table, procedure
1912  * counts, and statistics structure for @nn. Caller must release
1913  * these resources using nfsd_net_cb_shutdown().
1914  *
1915  * Return: 0 on success, or -ENOMEM if allocation fails.
1916  */
1917 int nfsd_net_cb_init(struct nfsd_net *nn)
1918 {
1919 	struct nfsd_net_cb *cb;
1920 
1921 	cb = kzalloc(sizeof(*cb), GFP_KERNEL);
1922 	if (!cb)
1923 		return -ENOMEM;
1924 
1925 	cb->version4.counts = kzalloc_objs(unsigned int,
1926 			ARRAY_SIZE(nfs4_cb_procedures), GFP_KERNEL);
1927 	if (!cb->version4.counts) {
1928 		kfree(cb);
1929 		return -ENOMEM;
1930 	}
1931 	/*
1932 	 * Note on the callback rpc program version number: despite language
1933 	 * in rfc 5661 section 18.36.3 requiring servers to use 4 in this
1934 	 * field, the official xdr descriptions for both 4.0 and 4.1 specify
1935 	 * version 1, and in practice that appears to be what implementations
1936 	 * use. The section 18.36.3 language is expected to be fixed in an
1937 	 * erratum.
1938 	 */
1939 	cb->version4.number = NFS4_CB_VERSION;
1940 	cb->version4.nrprocs = ARRAY_SIZE(nfs4_cb_procedures);
1941 	cb->version4.procs = nfs4_cb_procedures;
1942 	cb->versions[NFS4_CB_VERSION] = &cb->version4;
1943 
1944 	cb->program.name = "nfs4_cb";
1945 	cb->program.number = NFS4_CB_PROGRAM;
1946 	cb->program.nrvers = ARRAY_SIZE(cb->versions);
1947 	cb->program.version = &cb->versions[0];
1948 	cb->program.pipe_dir_name = "nfsd4_cb";
1949 	cb->program.stats = &cb->stat;
1950 	cb->stat.program = &cb->program;
1951 
1952 	nn->nfsd_cb = cb;
1953 
1954 	return 0;
1955 }
1956