1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /* Maintain an RxRPC server socket to do AFS communications through
3 *
4 * Copyright (C) 2007 Red Hat, Inc. All Rights Reserved.
5 * Written by David Howells (dhowells@redhat.com)
6 */
7
8 #include <linux/slab.h>
9 #include <linux/sched/signal.h>
10
11 #include <net/sock.h>
12 #include <net/af_rxrpc.h>
13 #include "internal.h"
14 #include "afs_cm.h"
15 #include "protocol_yfs.h"
16 #define RXRPC_TRACE_ONLY_DEFINE_ENUMS
17 #include <trace/events/rxrpc.h>
18
19 struct workqueue_struct *afs_async_calls;
20
21 static void afs_deferred_free_worker(struct work_struct *work);
22 static void afs_wake_up_call_waiter(struct sock *, struct rxrpc_call *, unsigned long);
23 static void afs_wake_up_async_call(struct sock *, struct rxrpc_call *, unsigned long);
24 static void afs_process_async_call(struct work_struct *);
25 static void afs_rx_new_call(struct sock *, struct rxrpc_call *, unsigned long);
26 static void afs_rx_discard_new_call(struct rxrpc_call *, unsigned long);
27 static int afs_deliver_cm_op_id(struct afs_call *);
28
29 /* asynchronous incoming call initial processing */
30 static const struct afs_call_type afs_RXCMxxxx = {
31 .name = "CB.xxxx",
32 .deliver = afs_deliver_cm_op_id,
33 };
34
35 /*
36 * open an RxRPC socket and bind it to be a server for callback notifications
37 * - the socket is left in blocking mode and non-blocking ops use MSG_DONTWAIT
38 */
afs_open_socket(struct afs_net * net)39 int afs_open_socket(struct afs_net *net)
40 {
41 struct sockaddr_rxrpc srx;
42 struct socket *socket;
43 int ret;
44
45 _enter("");
46
47 ret = sock_create_kern(net->net, AF_RXRPC, SOCK_DGRAM, PF_INET6, &socket);
48 if (ret < 0)
49 goto error_1;
50
51 socket->sk->sk_allocation = GFP_NOFS;
52
53 /* bind the callback manager's address to make this a server socket */
54 memset(&srx, 0, sizeof(srx));
55 srx.srx_family = AF_RXRPC;
56 srx.srx_service = CM_SERVICE;
57 srx.transport_type = SOCK_DGRAM;
58 srx.transport_len = sizeof(srx.transport.sin6);
59 srx.transport.sin6.sin6_family = AF_INET6;
60 srx.transport.sin6.sin6_port = htons(AFS_CM_PORT);
61
62 ret = rxrpc_sock_set_min_security_level(socket->sk,
63 RXRPC_SECURITY_ENCRYPT);
64 if (ret < 0)
65 goto error_2;
66
67 ret = kernel_bind(socket, (struct sockaddr *) &srx, sizeof(srx));
68 if (ret == -EADDRINUSE) {
69 srx.transport.sin6.sin6_port = 0;
70 ret = kernel_bind(socket, (struct sockaddr *) &srx, sizeof(srx));
71 }
72 if (ret < 0)
73 goto error_2;
74
75 srx.srx_service = YFS_CM_SERVICE;
76 ret = kernel_bind(socket, (struct sockaddr *) &srx, sizeof(srx));
77 if (ret < 0)
78 goto error_2;
79
80 /* Ideally, we'd turn on service upgrade here, but we can't because
81 * OpenAFS is buggy and leaks the userStatus field from packet to
82 * packet and between FS packets and CB packets - so if we try to do an
83 * upgrade on an FS packet, OpenAFS will leak that into the CB packet
84 * it sends back to us.
85 */
86
87 rxrpc_kernel_new_call_notification(socket, afs_rx_new_call,
88 afs_rx_discard_new_call);
89
90 ret = kernel_listen(socket, INT_MAX);
91 if (ret < 0)
92 goto error_2;
93
94 net->socket = socket;
95 afs_charge_preallocation(&net->charge_preallocation_work);
96 _leave(" = 0");
97 return 0;
98
99 error_2:
100 sock_release(socket);
101 error_1:
102 _leave(" = %d", ret);
103 return ret;
104 }
105
106 /*
107 * close the RxRPC socket AFS was using
108 */
afs_close_socket(struct afs_net * net)109 void afs_close_socket(struct afs_net *net)
110 {
111 _enter("");
112
113 kernel_listen(net->socket, 0);
114 flush_workqueue(afs_async_calls);
115
116 if (net->spare_incoming_call) {
117 afs_put_call(net->spare_incoming_call);
118 net->spare_incoming_call = NULL;
119 }
120
121 _debug("outstanding %u", atomic_read(&net->nr_outstanding_calls));
122 wait_var_event(&net->nr_outstanding_calls,
123 !atomic_read(&net->nr_outstanding_calls));
124 _debug("no outstanding calls");
125
126 kernel_sock_shutdown(net->socket, SHUT_RDWR);
127 flush_workqueue(afs_async_calls);
128 sock_release(net->socket);
129
130 _debug("dework");
131 _leave("");
132 }
133
134 /*
135 * Allocate a call.
136 */
afs_alloc_call(struct afs_net * net,const struct afs_call_type * type,gfp_t gfp)137 static struct afs_call *afs_alloc_call(struct afs_net *net,
138 const struct afs_call_type *type,
139 gfp_t gfp)
140 {
141 struct afs_call *call;
142 int o;
143
144 call = kzalloc(sizeof(*call), gfp);
145 if (!call)
146 return NULL;
147
148 call->type = type;
149 call->net = net;
150 call->debug_id = atomic_inc_return(&rxrpc_debug_id);
151 refcount_set(&call->ref, 1);
152 INIT_WORK(&call->async_work, afs_process_async_call);
153 INIT_WORK(&call->free_work, afs_deferred_free_worker);
154 init_waitqueue_head(&call->waitq);
155 spin_lock_init(&call->state_lock);
156 call->iter = &call->def_iter;
157
158 o = atomic_inc_return(&net->nr_outstanding_calls);
159 trace_afs_call(call->debug_id, afs_call_trace_alloc, 1, o,
160 __builtin_return_address(0));
161 return call;
162 }
163
afs_free_call(struct afs_call * call)164 static void afs_free_call(struct afs_call *call)
165 {
166 struct afs_net *net = call->net;
167 int o;
168
169 ASSERT(!work_pending(&call->async_work));
170
171 rxrpc_kernel_put_peer(call->peer);
172
173 if (call->rxcall) {
174 rxrpc_kernel_shutdown_call(net->socket, call->rxcall);
175 rxrpc_kernel_put_call(net->socket, call->rxcall);
176 call->rxcall = NULL;
177 }
178 if (call->type->destructor)
179 call->type->destructor(call);
180
181 afs_unuse_server_notime(call->net, call->server, afs_server_trace_put_call);
182 kfree(call->request);
183
184 o = atomic_read(&net->nr_outstanding_calls);
185 trace_afs_call(call->debug_id, afs_call_trace_free, 0, o,
186 __builtin_return_address(0));
187 kfree(call);
188
189 o = atomic_dec_return(&net->nr_outstanding_calls);
190 if (o == 0)
191 wake_up_var(&net->nr_outstanding_calls);
192 }
193
194 /*
195 * Dispose of a reference on a call.
196 */
afs_put_call(struct afs_call * call)197 void afs_put_call(struct afs_call *call)
198 {
199 struct afs_net *net = call->net;
200 unsigned int debug_id = call->debug_id;
201 bool zero;
202 int r, o;
203
204 zero = __refcount_dec_and_test(&call->ref, &r);
205 o = atomic_read(&net->nr_outstanding_calls);
206 trace_afs_call(debug_id, afs_call_trace_put, r - 1, o,
207 __builtin_return_address(0));
208 if (zero)
209 afs_free_call(call);
210 }
211
afs_deferred_free_worker(struct work_struct * work)212 static void afs_deferred_free_worker(struct work_struct *work)
213 {
214 struct afs_call *call = container_of(work, struct afs_call, free_work);
215
216 afs_free_call(call);
217 }
218
219 /*
220 * Dispose of a reference on a call, deferring the cleanup to a workqueue
221 * to avoid lock recursion.
222 */
afs_deferred_put_call(struct afs_call * call)223 void afs_deferred_put_call(struct afs_call *call)
224 {
225 struct afs_net *net = call->net;
226 unsigned int debug_id = call->debug_id;
227 bool zero;
228 int r, o;
229
230 zero = __refcount_dec_and_test(&call->ref, &r);
231 o = atomic_read(&net->nr_outstanding_calls);
232 trace_afs_call(debug_id, afs_call_trace_put, r - 1, o,
233 __builtin_return_address(0));
234 if (zero)
235 schedule_work(&call->free_work);
236 }
237
afs_get_call(struct afs_call * call,enum afs_call_trace why)238 static struct afs_call *afs_get_call(struct afs_call *call,
239 enum afs_call_trace why)
240 {
241 int r;
242
243 __refcount_inc(&call->ref, &r);
244
245 trace_afs_call(call->debug_id, why, r + 1,
246 atomic_read(&call->net->nr_outstanding_calls),
247 __builtin_return_address(0));
248 return call;
249 }
250
251 /*
252 * Queue the call for actual work.
253 */
afs_queue_call_work(struct afs_call * call)254 static void afs_queue_call_work(struct afs_call *call)
255 {
256 if (call->type->work) {
257 INIT_WORK(&call->work, call->type->work);
258
259 afs_get_call(call, afs_call_trace_work);
260 if (!queue_work(afs_wq, &call->work))
261 afs_put_call(call);
262 }
263 }
264
265 /*
266 * allocate a call with flat request and reply buffers
267 */
afs_alloc_flat_call(struct afs_net * net,const struct afs_call_type * type,size_t request_size,size_t reply_max)268 struct afs_call *afs_alloc_flat_call(struct afs_net *net,
269 const struct afs_call_type *type,
270 size_t request_size, size_t reply_max)
271 {
272 struct afs_call *call;
273
274 call = afs_alloc_call(net, type, GFP_NOFS);
275 if (!call)
276 goto nomem_call;
277
278 if (request_size) {
279 call->request_size = request_size;
280 call->request = kmalloc(request_size, GFP_NOFS);
281 if (!call->request)
282 goto nomem_free;
283 }
284
285 if (reply_max) {
286 call->reply_max = reply_max;
287 call->buffer = kmalloc(reply_max, GFP_NOFS);
288 if (!call->buffer)
289 goto nomem_free;
290 }
291
292 afs_extract_to_buf(call, call->reply_max);
293 call->operation_ID = type->op;
294 init_waitqueue_head(&call->waitq);
295 return call;
296
297 nomem_free:
298 afs_put_call(call);
299 nomem_call:
300 return NULL;
301 }
302
303 /*
304 * clean up a call with flat buffer
305 */
afs_flat_call_destructor(struct afs_call * call)306 void afs_flat_call_destructor(struct afs_call *call)
307 {
308 _enter("");
309
310 kfree(call->request);
311 call->request = NULL;
312 kfree(call->buffer);
313 call->buffer = NULL;
314 }
315
316 /*
317 * Advance the AFS call state when the RxRPC call ends the transmit phase.
318 */
afs_notify_end_request_tx(struct sock * sock,struct rxrpc_call * rxcall,unsigned long call_user_ID)319 static void afs_notify_end_request_tx(struct sock *sock,
320 struct rxrpc_call *rxcall,
321 unsigned long call_user_ID)
322 {
323 struct afs_call *call = (struct afs_call *)call_user_ID;
324
325 afs_set_call_state(call, AFS_CALL_CL_REQUESTING, AFS_CALL_CL_AWAIT_REPLY);
326 }
327
328 /*
329 * Initiate a call and synchronously queue up the parameters for dispatch. Any
330 * error is stored into the call struct, which the caller must check for.
331 */
afs_make_call(struct afs_call * call,gfp_t gfp)332 void afs_make_call(struct afs_call *call, gfp_t gfp)
333 {
334 struct rxrpc_call *rxcall;
335 struct msghdr msg;
336 struct kvec iov[1];
337 size_t len;
338 s64 tx_total_len;
339 int ret;
340
341 _enter(",{%pISp+%u},", rxrpc_kernel_remote_addr(call->peer), call->service_id);
342
343 ASSERT(call->type != NULL);
344 ASSERT(call->type->name != NULL);
345
346 _debug("____MAKE %p{%s,%x} [%d]____",
347 call, call->type->name, key_serial(call->key),
348 atomic_read(&call->net->nr_outstanding_calls));
349
350 trace_afs_make_call(call);
351
352 /* Work out the length we're going to transmit. This is awkward for
353 * calls such as FS.StoreData where there's an extra injection of data
354 * after the initial fixed part.
355 */
356 tx_total_len = call->request_size;
357 if (call->write_iter)
358 tx_total_len += iov_iter_count(call->write_iter);
359
360 /* If the call is going to be asynchronous, we need an extra ref for
361 * the call to hold itself so the caller need not hang on to its ref.
362 */
363 if (call->async) {
364 afs_get_call(call, afs_call_trace_get);
365 call->drop_ref = true;
366 }
367
368 /* create a call */
369 rxcall = rxrpc_kernel_begin_call(call->net->socket, call->peer, call->key,
370 (unsigned long)call,
371 tx_total_len,
372 call->max_lifespan,
373 gfp,
374 (call->async ?
375 afs_wake_up_async_call :
376 afs_wake_up_call_waiter),
377 call->service_id,
378 call->upgrade,
379 (call->intr ? RXRPC_PREINTERRUPTIBLE :
380 RXRPC_UNINTERRUPTIBLE),
381 call->debug_id);
382 if (IS_ERR(rxcall)) {
383 ret = PTR_ERR(rxcall);
384 call->error = ret;
385 goto error_kill_call;
386 }
387
388 call->rxcall = rxcall;
389 call->issue_time = ktime_get_real();
390
391 /* send the request */
392 iov[0].iov_base = call->request;
393 iov[0].iov_len = call->request_size;
394
395 msg.msg_name = NULL;
396 msg.msg_namelen = 0;
397 iov_iter_kvec(&msg.msg_iter, ITER_SOURCE, iov, 1, call->request_size);
398 msg.msg_control = NULL;
399 msg.msg_controllen = 0;
400 msg.msg_flags = MSG_WAITALL | (call->write_iter ? MSG_MORE : 0);
401
402 ret = rxrpc_kernel_send_data(call->net->socket, rxcall,
403 &msg, call->request_size,
404 afs_notify_end_request_tx);
405 if (ret < 0)
406 goto error_do_abort;
407
408 if (call->write_iter) {
409 msg.msg_iter = *call->write_iter;
410 msg.msg_flags &= ~MSG_MORE;
411 trace_afs_send_data(call, &msg);
412
413 ret = rxrpc_kernel_send_data(call->net->socket,
414 call->rxcall, &msg,
415 iov_iter_count(&msg.msg_iter),
416 afs_notify_end_request_tx);
417 *call->write_iter = msg.msg_iter;
418
419 trace_afs_sent_data(call, &msg, ret);
420 if (ret < 0)
421 goto error_do_abort;
422 }
423
424 /* Note that at this point, we may have received the reply or an abort
425 * - and an asynchronous call may already have completed.
426 *
427 * afs_wait_for_call_to_complete(call)
428 * must be called to synchronously clean up.
429 */
430 return;
431
432 error_do_abort:
433 if (ret != -ECONNABORTED)
434 rxrpc_kernel_abort_call(call->net->socket, rxcall,
435 RX_USER_ABORT, ret,
436 afs_abort_send_data_error);
437 if (call->async) {
438 afs_see_call(call, afs_call_trace_async_abort);
439 return;
440 }
441
442 if (ret == -ECONNABORTED) {
443 len = 0;
444 iov_iter_kvec(&msg.msg_iter, ITER_DEST, NULL, 0, 0);
445 rxrpc_kernel_recv_data(call->net->socket, rxcall,
446 &msg.msg_iter, &len, false,
447 &call->abort_code, &call->service_id);
448 call->responded = true;
449 }
450 call->error = ret;
451 trace_afs_call_done(call);
452 error_kill_call:
453 if (call->async)
454 afs_see_call(call, afs_call_trace_async_kill);
455 if (call->type->done)
456 call->type->done(call);
457
458 /* We need to dispose of the extra ref we grabbed for an async call.
459 * The call, however, might be queued on afs_async_calls and we need to
460 * make sure we don't get any more notifications that might requeue it.
461 */
462 if (call->rxcall)
463 rxrpc_kernel_shutdown_call(call->net->socket, call->rxcall);
464 if (call->async) {
465 if (cancel_work_sync(&call->async_work))
466 afs_put_call(call);
467 afs_set_call_complete(call, ret, 0);
468 }
469
470 call->error = ret;
471 call->state = AFS_CALL_COMPLETE;
472 _leave(" = %d", ret);
473 }
474
475 /*
476 * Log remote abort codes that indicate that we have a protocol disagreement
477 * with the server.
478 */
afs_log_error(struct afs_call * call,s32 remote_abort)479 static void afs_log_error(struct afs_call *call, s32 remote_abort)
480 {
481 static int max = 0;
482 const char *msg;
483 int m;
484
485 switch (remote_abort) {
486 case RX_EOF: msg = "unexpected EOF"; break;
487 case RXGEN_CC_MARSHAL: msg = "client marshalling"; break;
488 case RXGEN_CC_UNMARSHAL: msg = "client unmarshalling"; break;
489 case RXGEN_SS_MARSHAL: msg = "server marshalling"; break;
490 case RXGEN_SS_UNMARSHAL: msg = "server unmarshalling"; break;
491 case RXGEN_DECODE: msg = "opcode decode"; break;
492 case RXGEN_SS_XDRFREE: msg = "server XDR cleanup"; break;
493 case RXGEN_CC_XDRFREE: msg = "client XDR cleanup"; break;
494 case -32: msg = "insufficient data"; break;
495 default:
496 return;
497 }
498
499 m = max;
500 if (m < 3) {
501 max = m + 1;
502 pr_notice("kAFS: Peer reported %s failure on %s [%pISp]\n",
503 msg, call->type->name,
504 rxrpc_kernel_remote_addr(call->peer));
505 }
506 }
507
508 /*
509 * deliver messages to a call
510 */
afs_deliver_to_call(struct afs_call * call)511 static void afs_deliver_to_call(struct afs_call *call)
512 {
513 enum afs_call_state state;
514 size_t len;
515 u32 abort_code, remote_abort = 0;
516 int ret;
517
518 _enter("%s", call->type->name);
519
520 while (state = READ_ONCE(call->state),
521 state == AFS_CALL_CL_AWAIT_REPLY ||
522 state == AFS_CALL_SV_AWAIT_OP_ID ||
523 state == AFS_CALL_SV_AWAIT_REQUEST ||
524 state == AFS_CALL_SV_AWAIT_ACK
525 ) {
526 if (state == AFS_CALL_SV_AWAIT_ACK) {
527 len = 0;
528 iov_iter_kvec(&call->def_iter, ITER_DEST, NULL, 0, 0);
529 ret = rxrpc_kernel_recv_data(call->net->socket,
530 call->rxcall, &call->def_iter,
531 &len, false, &remote_abort,
532 &call->service_id);
533 trace_afs_receive_data(call, &call->def_iter, false, ret);
534
535 if (ret == -EINPROGRESS || ret == -EAGAIN)
536 return;
537 if (ret < 0 || ret == 1) {
538 if (ret == 1)
539 ret = 0;
540 goto call_complete;
541 }
542 return;
543 }
544
545 ret = call->type->deliver(call);
546 state = READ_ONCE(call->state);
547 if (ret == 0 && call->unmarshalling_error)
548 ret = -EBADMSG;
549 switch (ret) {
550 case 0:
551 call->responded = true;
552 afs_queue_call_work(call);
553 if (state == AFS_CALL_CL_PROC_REPLY) {
554 if (call->op)
555 set_bit(AFS_SERVER_FL_MAY_HAVE_CB,
556 &call->op->server->flags);
557 goto call_complete;
558 }
559 ASSERTCMP(state, >, AFS_CALL_CL_PROC_REPLY);
560 goto done;
561 case -EINPROGRESS:
562 case -EAGAIN:
563 goto out;
564 case -ECONNABORTED:
565 ASSERTCMP(state, ==, AFS_CALL_COMPLETE);
566 call->responded = true;
567 afs_log_error(call, call->abort_code);
568 goto done;
569 case -ENOTSUPP:
570 call->responded = true;
571 abort_code = RXGEN_OPCODE;
572 rxrpc_kernel_abort_call(call->net->socket, call->rxcall,
573 abort_code, ret,
574 afs_abort_op_not_supported);
575 goto local_abort;
576 case -EIO:
577 pr_err("kAFS: Call %u in bad state %u\n",
578 call->debug_id, state);
579 fallthrough;
580 case -ENODATA:
581 case -EBADMSG:
582 case -EMSGSIZE:
583 case -ENOMEM:
584 case -EFAULT:
585 abort_code = RXGEN_CC_UNMARSHAL;
586 if (state != AFS_CALL_CL_AWAIT_REPLY)
587 abort_code = RXGEN_SS_UNMARSHAL;
588 rxrpc_kernel_abort_call(call->net->socket, call->rxcall,
589 abort_code, ret,
590 afs_abort_unmarshal_error);
591 goto local_abort;
592 default:
593 abort_code = RX_CALL_DEAD;
594 rxrpc_kernel_abort_call(call->net->socket, call->rxcall,
595 abort_code, ret,
596 afs_abort_general_error);
597 goto local_abort;
598 }
599 }
600
601 done:
602 if (call->type->done)
603 call->type->done(call);
604 out:
605 _leave("");
606 return;
607
608 local_abort:
609 abort_code = 0;
610 call_complete:
611 afs_set_call_complete(call, ret, remote_abort);
612 goto done;
613 }
614
615 /*
616 * Wait synchronously for a call to complete.
617 */
afs_wait_for_call_to_complete(struct afs_call * call)618 void afs_wait_for_call_to_complete(struct afs_call *call)
619 {
620 bool rxrpc_complete = false;
621
622 _enter("");
623
624 if (!afs_check_call_state(call, AFS_CALL_COMPLETE)) {
625 DECLARE_WAITQUEUE(myself, current);
626
627 add_wait_queue(&call->waitq, &myself);
628 for (;;) {
629 set_current_state(TASK_UNINTERRUPTIBLE);
630
631 /* deliver any messages that are in the queue */
632 if (!afs_check_call_state(call, AFS_CALL_COMPLETE) &&
633 call->need_attention) {
634 call->need_attention = false;
635 __set_current_state(TASK_RUNNING);
636 afs_deliver_to_call(call);
637 continue;
638 }
639
640 if (afs_check_call_state(call, AFS_CALL_COMPLETE))
641 break;
642
643 if (!rxrpc_kernel_check_life(call->net->socket, call->rxcall)) {
644 /* rxrpc terminated the call. */
645 rxrpc_complete = true;
646 break;
647 }
648
649 schedule();
650 }
651
652 remove_wait_queue(&call->waitq, &myself);
653 __set_current_state(TASK_RUNNING);
654 }
655
656 if (!afs_check_call_state(call, AFS_CALL_COMPLETE)) {
657 if (rxrpc_complete) {
658 afs_set_call_complete(call, call->error, call->abort_code);
659 } else {
660 /* Kill off the call if it's still live. */
661 _debug("call interrupted");
662 if (rxrpc_kernel_abort_call(call->net->socket, call->rxcall,
663 RX_USER_ABORT, -EINTR,
664 afs_abort_interrupted))
665 afs_set_call_complete(call, -EINTR, 0);
666 }
667 }
668 }
669
670 /*
671 * wake up a waiting call
672 */
afs_wake_up_call_waiter(struct sock * sk,struct rxrpc_call * rxcall,unsigned long call_user_ID)673 static void afs_wake_up_call_waiter(struct sock *sk, struct rxrpc_call *rxcall,
674 unsigned long call_user_ID)
675 {
676 struct afs_call *call = (struct afs_call *)call_user_ID;
677
678 call->need_attention = true;
679 wake_up(&call->waitq);
680 }
681
682 /*
683 * Wake up an asynchronous call. The caller is holding the call notify
684 * spinlock around this, so we can't call afs_put_call().
685 */
afs_wake_up_async_call(struct sock * sk,struct rxrpc_call * rxcall,unsigned long call_user_ID)686 static void afs_wake_up_async_call(struct sock *sk, struct rxrpc_call *rxcall,
687 unsigned long call_user_ID)
688 {
689 struct afs_call *call = (struct afs_call *)call_user_ID;
690 int r;
691
692 trace_afs_notify_call(rxcall, call);
693 call->need_attention = true;
694
695 if (__refcount_inc_not_zero(&call->ref, &r)) {
696 trace_afs_call(call->debug_id, afs_call_trace_wake, r + 1,
697 atomic_read(&call->net->nr_outstanding_calls),
698 __builtin_return_address(0));
699
700 if (!queue_work(afs_async_calls, &call->async_work))
701 afs_deferred_put_call(call);
702 }
703 }
704
705 /*
706 * Perform I/O processing on an asynchronous call. The work item carries a ref
707 * to the call struct that we either need to release or to pass on.
708 */
afs_process_async_call(struct work_struct * work)709 static void afs_process_async_call(struct work_struct *work)
710 {
711 struct afs_call *call = container_of(work, struct afs_call, async_work);
712
713 _enter("");
714
715 if (call->state < AFS_CALL_COMPLETE && call->need_attention) {
716 call->need_attention = false;
717 afs_deliver_to_call(call);
718 }
719
720 afs_put_call(call);
721 _leave("");
722 }
723
afs_rx_attach(struct rxrpc_call * rxcall,unsigned long user_call_ID)724 static void afs_rx_attach(struct rxrpc_call *rxcall, unsigned long user_call_ID)
725 {
726 struct afs_call *call = (struct afs_call *)user_call_ID;
727
728 call->rxcall = rxcall;
729 }
730
731 /*
732 * Charge the incoming call preallocation.
733 */
afs_charge_preallocation(struct work_struct * work)734 void afs_charge_preallocation(struct work_struct *work)
735 {
736 struct afs_net *net =
737 container_of(work, struct afs_net, charge_preallocation_work);
738 struct afs_call *call = net->spare_incoming_call;
739
740 for (;;) {
741 if (!call) {
742 call = afs_alloc_call(net, &afs_RXCMxxxx, GFP_KERNEL);
743 if (!call)
744 break;
745
746 call->drop_ref = true;
747 call->async = true;
748 call->state = AFS_CALL_SV_AWAIT_OP_ID;
749 init_waitqueue_head(&call->waitq);
750 afs_extract_to_tmp(call);
751 }
752
753 if (rxrpc_kernel_charge_accept(net->socket,
754 afs_wake_up_async_call,
755 afs_rx_attach,
756 (unsigned long)call,
757 GFP_KERNEL,
758 call->debug_id) < 0)
759 break;
760 call = NULL;
761 }
762 net->spare_incoming_call = call;
763 }
764
765 /*
766 * Discard a preallocated call when a socket is shut down.
767 */
afs_rx_discard_new_call(struct rxrpc_call * rxcall,unsigned long user_call_ID)768 static void afs_rx_discard_new_call(struct rxrpc_call *rxcall,
769 unsigned long user_call_ID)
770 {
771 struct afs_call *call = (struct afs_call *)user_call_ID;
772
773 call->rxcall = NULL;
774 afs_put_call(call);
775 }
776
777 /*
778 * Notification of an incoming call.
779 */
afs_rx_new_call(struct sock * sk,struct rxrpc_call * rxcall,unsigned long user_call_ID)780 static void afs_rx_new_call(struct sock *sk, struct rxrpc_call *rxcall,
781 unsigned long user_call_ID)
782 {
783 struct afs_net *net = afs_sock2net(sk);
784
785 queue_work(afs_wq, &net->charge_preallocation_work);
786 }
787
788 /*
789 * Grab the operation ID from an incoming cache manager call. The socket
790 * buffer is discarded on error or if we don't yet have sufficient data.
791 */
afs_deliver_cm_op_id(struct afs_call * call)792 static int afs_deliver_cm_op_id(struct afs_call *call)
793 {
794 int ret;
795
796 _enter("{%zu}", iov_iter_count(call->iter));
797
798 /* the operation ID forms the first four bytes of the request data */
799 ret = afs_extract_data(call, true);
800 if (ret < 0)
801 return ret;
802
803 call->operation_ID = ntohl(call->tmp);
804 afs_set_call_state(call, AFS_CALL_SV_AWAIT_OP_ID, AFS_CALL_SV_AWAIT_REQUEST);
805
806 /* ask the cache manager to route the call (it'll change the call type
807 * if successful) */
808 if (!afs_cm_incoming_call(call))
809 return -ENOTSUPP;
810
811 trace_afs_cb_call(call);
812
813 /* pass responsibility for the remainer of this message off to the
814 * cache manager op */
815 return call->type->deliver(call);
816 }
817
818 /*
819 * Advance the AFS call state when an RxRPC service call ends the transmit
820 * phase.
821 */
afs_notify_end_reply_tx(struct sock * sock,struct rxrpc_call * rxcall,unsigned long call_user_ID)822 static void afs_notify_end_reply_tx(struct sock *sock,
823 struct rxrpc_call *rxcall,
824 unsigned long call_user_ID)
825 {
826 struct afs_call *call = (struct afs_call *)call_user_ID;
827
828 afs_set_call_state(call, AFS_CALL_SV_REPLYING, AFS_CALL_SV_AWAIT_ACK);
829 }
830
831 /*
832 * send an empty reply
833 */
afs_send_empty_reply(struct afs_call * call)834 void afs_send_empty_reply(struct afs_call *call)
835 {
836 struct afs_net *net = call->net;
837 struct msghdr msg;
838
839 _enter("");
840
841 rxrpc_kernel_set_tx_length(net->socket, call->rxcall, 0);
842
843 msg.msg_name = NULL;
844 msg.msg_namelen = 0;
845 iov_iter_kvec(&msg.msg_iter, ITER_SOURCE, NULL, 0, 0);
846 msg.msg_control = NULL;
847 msg.msg_controllen = 0;
848 msg.msg_flags = 0;
849
850 switch (rxrpc_kernel_send_data(net->socket, call->rxcall, &msg, 0,
851 afs_notify_end_reply_tx)) {
852 case 0:
853 _leave(" [replied]");
854 return;
855
856 case -ENOMEM:
857 _debug("oom");
858 rxrpc_kernel_abort_call(net->socket, call->rxcall,
859 RXGEN_SS_MARSHAL, -ENOMEM,
860 afs_abort_oom);
861 fallthrough;
862 default:
863 _leave(" [error]");
864 return;
865 }
866 }
867
868 /*
869 * send a simple reply
870 */
afs_send_simple_reply(struct afs_call * call,const void * buf,size_t len)871 void afs_send_simple_reply(struct afs_call *call, const void *buf, size_t len)
872 {
873 struct afs_net *net = call->net;
874 struct msghdr msg;
875 struct kvec iov[1];
876 int n;
877
878 _enter("");
879
880 rxrpc_kernel_set_tx_length(net->socket, call->rxcall, len);
881
882 iov[0].iov_base = (void *) buf;
883 iov[0].iov_len = len;
884 msg.msg_name = NULL;
885 msg.msg_namelen = 0;
886 iov_iter_kvec(&msg.msg_iter, ITER_SOURCE, iov, 1, len);
887 msg.msg_control = NULL;
888 msg.msg_controllen = 0;
889 msg.msg_flags = 0;
890
891 n = rxrpc_kernel_send_data(net->socket, call->rxcall, &msg, len,
892 afs_notify_end_reply_tx);
893 if (n >= 0) {
894 /* Success */
895 _leave(" [replied]");
896 return;
897 }
898
899 if (n == -ENOMEM) {
900 _debug("oom");
901 rxrpc_kernel_abort_call(net->socket, call->rxcall,
902 RXGEN_SS_MARSHAL, -ENOMEM,
903 afs_abort_oom);
904 }
905 _leave(" [error]");
906 }
907
908 /*
909 * Extract a piece of data from the received data socket buffers.
910 */
afs_extract_data(struct afs_call * call,bool want_more)911 int afs_extract_data(struct afs_call *call, bool want_more)
912 {
913 struct afs_net *net = call->net;
914 struct iov_iter *iter = call->iter;
915 enum afs_call_state state;
916 u32 remote_abort = 0;
917 int ret;
918
919 _enter("{%s,%zu,%zu},%d",
920 call->type->name, call->iov_len, iov_iter_count(iter), want_more);
921
922 ret = rxrpc_kernel_recv_data(net->socket, call->rxcall, iter,
923 &call->iov_len, want_more, &remote_abort,
924 &call->service_id);
925 trace_afs_receive_data(call, call->iter, want_more, ret);
926 if (ret == 0 || ret == -EAGAIN)
927 return ret;
928
929 state = READ_ONCE(call->state);
930 if (ret == 1) {
931 switch (state) {
932 case AFS_CALL_CL_AWAIT_REPLY:
933 afs_set_call_state(call, state, AFS_CALL_CL_PROC_REPLY);
934 break;
935 case AFS_CALL_SV_AWAIT_REQUEST:
936 afs_set_call_state(call, state, AFS_CALL_SV_REPLYING);
937 break;
938 case AFS_CALL_COMPLETE:
939 kdebug("prem complete %d", call->error);
940 return afs_io_error(call, afs_io_error_extract);
941 default:
942 break;
943 }
944 return 0;
945 }
946
947 afs_set_call_complete(call, ret, remote_abort);
948 return ret;
949 }
950
951 /*
952 * Log protocol error production.
953 */
afs_protocol_error(struct afs_call * call,enum afs_eproto_cause cause)954 noinline int afs_protocol_error(struct afs_call *call,
955 enum afs_eproto_cause cause)
956 {
957 trace_afs_protocol_error(call, cause);
958 if (call)
959 call->unmarshalling_error = true;
960 return -EBADMSG;
961 }
962