summaryrefslogtreecommitdiffstats
path: root/sys/nfsserver/nfs_serv.c
Commit message (Collapse)AuthorAgeFilesLines
* Implement support for RPCSEC_GSS authentication to both the NFS clientdfr2008-11-031-28/+39
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | and server. This replaces the RPC implementation of the NFS client and server with the newer RPC implementation originally developed (actually ported from the userland sunrpc code) to support the NFS Lock Manager. I have tested this code extensively and I believe it is stable and that performance is at least equal to the legacy RPC implementation. The NFS code currently contains support for both the new RPC implementation and the older legacy implementation inherited from the original NFS codebase. The default is to use the new implementation - add the NFS_LEGACYRPC option to fall back to the old code. When I merge this support back to RELENG_7, I will probably change this so that users have to 'opt in' to get the new code. To use RPCSEC_GSS on either client or server, you must build a kernel which includes the KGSSAPI option and the crypto device. On the userland side, you must build at least a new libc, mountd, mount_nfs and gssd. You must install new versions of /etc/rc.d/gssd and /etc/rc.d/nfsd and add 'gssd_enable=YES' to /etc/rc.conf. As long as gssd is running, you should be able to mount an NFS filesystem from a server that requires RPCSEC_GSS authentication. The mount itself can happen without any kerberos credentials but all access to the filesystem will be denied unless the accessing user has a valid ticket file in the standard place (/tmp/krb5cc_<uid>). There is currently no support for situations where the ticket file is in a different place, such as when the user logged in via SSH and has delegated credentials from that login. This restriction is also present in Solaris and Linux. In theory, we could improve this in future, possibly using Brooks Davis' implementation of variant symlinks. Supporting RPCSEC_GSS on a server is nearly as simple. You must create service creds for the server in the form 'nfs/<fqdn>@<REALM>' and install them in /etc/krb5.keytab. The standard heimdal utility ktutil makes this fairly easy. After the service creds have been created, you can add a '-sec=krb5' option to /etc/exports and restart both mountd and nfsd. The only other difference an administrator should notice is that nfsd doesn't fork to create service threads any more. In normal operation, there will be two nfsd processes, one in userland waiting for TCP connections and one in the kernel handling requests. The latter process will create as many kthreads as required - these should be visible via 'top -H'. The code has some support for varying the number of service threads according to load but initially at least, nfsd uses a fixed number of threads according to the value supplied to its '-n' option. Sponsored by: Isilon Systems MFC after: 1 month
* Document a few sysctls in the NFS client and server code.trhodes2008-11-021-2/+4
| | | | | | Minor style(9) where applicable. Approved by: alfred (slightly older version)
* Introduce accmode_t. This is required for NFSv4 ACLs - it will be neccessarytrasz2008-10-281-5/+6
| | | | | | | to add more V* constants, and the variables changed by this patch were often being assigned to mode_t variables, which is 16 bit. Approved by: rwatson (mentor)
* Retire the MALLOC and FREE macros. They are an abomination unto style(9).des2008-10-231-19/+19
| | | | MFC after: 3 months
* Turn XXX's for unlocked writes of NFS server statistics to simple notes,rwatson2008-10-121-2/+2
| | | | | | as we consider it a feature to exchange performance for consistency. MFC after: 3 days
* Remove the suser(9) interface from the kernel. It has been replaced fromattilio2008-09-171-2/+4
| | | | | | | | | | | | | | | | | years by the priv_check(9) interface and just very few places are left. Note that compatibility stub with older FreeBSD version (all above the 8 limit though) are left in order to reduce diffs against old versions. It is responsibility of the maintainers for any module, if they think it is the case, to axe out such cases. This patch breaks KPI so __FreeBSD_version will be bumped into a later commit. This patch needs to be credited 50-50 with rwatson@ as he found time to explain me how the priv_check() works in detail and to review patches. Tested by: Giovanni Trematerra <giovanni dot trematerra at gmail dot com> Reviewed by: rwatson
* Decontext-alize the nfsserver module.attilio2008-09-161-58/+55
| | | | | | | Now, only some few places still require thread passing (mostly the ones which access to VOP_* functions) and will be fixed once the primitive also will be. Tested by: Giovanni Trematerra <giovanni dot trematerra at gmail dot com>
* Decontextualize the couplet VOP_GETATTR / VOP_SETATTR as the passed threadattilio2008-08-281-49/+47
| | | | | | was always curthread and totally unuseful. Tested by: Giovanni Trematerra <giovanni dot trematerra at gmail dot com>
* Change the fix in the rev. 1.179 to use nfsrv_lockedpair_nd().kib2008-05-281-6/+2
| | | | | Tested by: pho MFC after: 3 days
* Initialize vfslocked prior to calling nfsm_srvmtofh where it was forgotten.kib2008-05-281-0/+3
| | | | | | Reported by: Andrew Edwards <aedwards sandvine com> Tested by: pho MFC after: 3 days
* Replaced the misleading uses of a historical artefact M_TRYWAIT with M_WAIT.ru2008-03-251-4/+4
| | | | | | | | | | Removed dead code that assumed that M_TRYWAIT can return NULL; it's not true since the advent of MBUMA. Reviewed by: arch There are ongoing disputes as to whether we want to switch to directly using UMA flags M_WAITOK/M_NOWAIT for mbuf(9) allocation.
* - Complete part of the unfinished bufobj work by consistently usingjeff2008-03-221-8/+7
| | | | | | | | | | | | | | | | | BO_LOCK/UNLOCK/MTX when manipulating the bufobj. - Create a new lock in the bufobj to lock bufobj fields independently. This leaves the vnode interlock as an 'identity' lock while the bufobj is an io lock. The bufobj lock is ordered before the vnode interlock and also before the mnt ilock. - Exploit this new lock order to simplify softdep_check_suspend(). - A few sync related functions are marked with a new XXX to note that we may not properly interlock against a non-zero bv_cnt when attempting to sync all vnodes on a mountlist. I do not believe this race is important. If I'm wrong this will make these locations easier to find. Reviewed by: kib (earlier diff) Tested by: kris, pho (earlier diff)
* Fix the Giant leak in the nfsrv_remove().kib2008-03-041-2/+6
| | | | | Reported by: pluknet <pluknet gmail com> MFC after: 1 week
* VOP_LOCK1() (and so VOP_LOCK()) and VOP_UNLOCK() are only used inattilio2008-01-131-16/+16
| | | | | | | | | | | conjuction with 'thread' argument passing which is always curthread. Remove the unuseful extra-argument and pass explicitly curthread to lower layer functions, when necessary. KPI results broken by this change, which should affect several ports, so version bumping and manpage update will be further committed. Tested by: kris, pho, Diego Sardina <siarodx at gmail dot com>
* vn_lock() is currently only used with the 'curthread' passed as argument.attilio2008-01-101-13/+13
| | | | | | | | | | | | | | | | Remove this argument and pass curthread directly to underlying VOP_LOCK1() VFS method. This modify makes the code cleaner and in particular remove an annoying dependence helping next lockmgr() cleanup. KPI results, obviously, changed. Manpage and FreeBSD_version will be updated through further commits. As a side note, would be valuable to say that next commits will address a similar cleanup about VFS methods, in particular vop_lock1 and vop_unlock. Tested by: Diego Sardina <siarodx at gmail dot com>, Andrea Di Pasquale <whyx dot it at gmail dot com>
* Add a -z flag to nfsstat which zeros the NFS statistics after displayingjhb2007-10-181-1/+1
| | | | | | | | them. MFC after: 1 week Requested by: ps Submitted by: ps (6 years ago)
* Include priv.h to pick up suser(9) definitions, missed in an earlierrwatson2007-06-131-0/+1
| | | | | | commit. Warnings spotted by: kris
* Init timespec to zero fo quiesce warnings.mjacob2007-06-101-1/+1
|
* Initialize vfslocked to 0 before nfsm_srvmtofh() so that the variable isjhb2007-03-261-0/+1
| | | | | | | | not used uninitialized in 'nfsmout' if nfsm_srvmtofh() gets an internal error. CID: 1766 Found by: Coverity Prevent (tm)
* - Turn all explicit giant acquires into conditional VFS_LOCK_GIANTs.jeff2007-03-171-554/+187
| | | | | | | | | | | | | | | Only ops which used namei still remained. - Implement a scheme for reducing the overhead of tracking which vops require giant by constantly reducing the number of recursive giant acquires to one, leaving us with only one vfslocked variable. - Remove all NFSD lock acquisition and release from the individual nfs ops. Careful examination has shown that they are not required. This greatly simplifies the code. Sponsored by: Isilon Systems, Inc. Discussed with: rwatson Tested by: kkenn Approved by: re
* Move vnode-to-file-handle translation from vfs_vptofh to vop_vptofh method.pjd2007-02-151-6/+6
| | | | | | | | | | | | | | | | This way we may support multiple structures in v_data vnode field within one file system without using black magic. Vnode-to-file-handle should be VOP in the first place, but was made VFS operation to keep interface as compatible as possible with SUN's VFS. BTW. Now Solaris also implements vnode-to-file-handle as VOP operation. VFS_VPTOFH() was left for API backward compatibility, but is marked for removal before 8.0-RELEASE. Approved by: mckusick Discussed with: many (on IRC) Tested with: ufs, msdosfs, cd9660, nullfs and zfs
* Get the vfs giant lock before calling nfs_access.mpp2007-02-131-3/+9
| | | | Reviewed by: mohan
* Push Giant a bit further off the NFS server in a number of straightrwatson2006-11-241-213/+263
| | | | | | | | | | | | | | | | | | | | | | | | forward cases by converting from unconditional acquisition of Giant around vnode operations to conditional acquisition: - Remove nfsrv_access_withgiant(), and cause nfsrv_access() to now assert that Giant will be held if it is required for the vnode. - Add nfsrv_fhtovp_locked(), which will drop the NFS server lock if required, and modify nfsrv_fhtovp() to conditionally acquire Giant if required. - In the VOP's not dealing with more than one vnode at a time (i.e., not involving a lookup), conditionally acquire Giant. This removes Giant use for MPSAFE file systems for a number of quite important RPCs, including getattr, read, write. It leaves unconditional Giant acquisitions in vnode operations that interact with the name space or more than one vnode at a time as these require further work. Tested by: kris Reviewed by: kib
* Protect nfsm_srvpathsiz() call with the nfsd_mtx lock.pjd2006-11-201-5/+6
| | | | Reviewed by: mohans
* Fix leak in NAMEI zone caused by nfs server when VOP_RENAME fails.kib2006-10-261-2/+2
| | | | | | | Submitted by: Padma Bhooma <pbhooma at panasas com> Reviewed by: bde Approved by: pjd (mentor) MFC after: 1 week
* Temporary workaround to prevent leak of Giant from nfsd when callingkib2006-06-051-0/+16
| | | | | | | | | lookup(). Reviewed by: tegge Tested by: "Arno J. Klaassen" <arno at heho snv jussieu fr>, "Rong-en Fan" <grafan at gmail com>, Dmitriy Kirhlarov <dimma at higis ru>, Dmitry Pryanishnikov <dmitry at atlantis dp ua> MFC after: 1 week Approved by: kan, pjd (mentors)
* - Release the references acquired by VOP_GETWRITEMOUNT and vfs_getvfs().jeff2006-03-311-0/+11
| | | | | | Discussed with: tegge Tested by: kris Sponsored by: Isilon Systems, Inc.
* - Reorder vrele calls after vput calls to prevent lock order reversalsjeff2006-03-121-26/+17
| | | | | | | between leaf and directory locks. Found by: kris Sponsored by: Isilon Systems, Inc.
* - Reorder calls to vrele() after calls to vput() when the vrele is ajeff2006-02-011-38/+37
| | | | | | | | | | | | directory. vrele() may lock the passed vnode, which in these cases would give an invalid lock order of child -> parent. These situations are deadlock prone although do not typically deadlock because the vrele is typically not releasing the last reference to the vnode. Users of vrele must consider it as a call to vn_lock() and order it appropriately. MFC After: 1 week Sponsored by: Isilon Systems, Inc. Tested by: kkenn
* Manage the ucred for the NFS server using the crget/crfree API defined incsjp2006-01-281-24/+24
| | | | | | | | | | | | | | | | | | | | kern_prot.c. This API handles reference counting among many other things. Notably, if MAC is compiled into the kernel, it will properly initialize the MAC labels when the ucred is allocated. This work is in preparation for a new MAC entry point which will be responsible for properly initializing policy specific labels for the NFS server credential. Utilization of the crfree/crget APIs reduce the complexity associated with this label's management. Submitted by: green (with changes) [1] Obtained from: TrustedBSD Project Discussed with: rwatson, alfred [1] I moved the ucred allocation outside the scope of the NFS server lock to prevent M_WAIKOK allocations from occurring with non-sleep-able locks held. Additionally, to reduce complexity, the ucred persist as long as the NFS server descriptor.
* Revert my previous commit.trhodes2006-01-231-0/+11
| | | | Proved I'm not that bright at times: jhb
* Fix indentation.trhodes2006-01-231-7/+7
| | | | Prodded by: stefanf, ru, njl (in that order)
* Remove some dead code.trhodes2006-01-211-18/+7
| | | | Found with: Coverity Prevent(tm)
* Keep locks consistent before goto.glebius2005-10-271-0/+4
| | | | | Reported by: pho Reviewed by: mohans
* NFS write gathering defers execution of NFS server write requests to waitrwatson2005-04-171-1/+23
| | | | | | | | | | | | | | | | | | to see if additional write requests will arrive that can be coalesced and clustered with earlier ones. When doing so, it must determine whether the two requests are made by credentials with the same access writes, so as not to coalesce improperly. NFSW_SAMECRED() implements a test of two credentials using a binary compare. Replace NFSW_SAMECRED() macro with nfsrv_samecred() function, which is aware of the contents and layout of a struct ucred, rather than a simple binary compare. While the binary compare works when ucred is simply a zero'd and embedded 'struct ucred' in the NFS descriptor, it will work less well when the ucred associated with an NFS descriptor is "real", so has defined and populated reference count, mutex, etc. MFC after: 1 week Obtained from: TrustedBSD Project
* Don't try to create vnode_pager objects on other filesystems vnodes,phk2005-01-241-2/+0
| | | | either they did it themselves or it won't happen.
* Now that we have a non blocking version of nfsm_dissect(), change all theps2005-01-191-21/+21
| | | | | | nfsm_dissect() calls (done under the NFSD lock) to nfsm_dissect_nonblock(). Submitted by: Mohan Srinivasan
* Remove the unused credential argument from VOP_FSYNC() and VFS_SYNC().phk2005-01-111-1/+1
| | | | | | | | | | | | | | | | | | I'm not sure why a credential was added to these in the first place, it is not used anywhere and it doesn't make much sense: The credentials for syncing a file (ability to write to the file) should be checked at the system call level. Credentials for syncing one or more filesystems ("none") should be checked at the system call level as well. If the filesystem implementation needs a particular credential to carry out the syncing it would logically have to the cached mount credential, or a credential cached along with any delayed write data. Discussed with: rwatson
* /* -> /*- for license, minor formatting changesimp2005-01-071-1/+1
|
* Correct a bug in nfsrv_create() where a call to nfsrv_access() mightrwatson2004-11-111-38/+52
| | | | | | | | | | | | | be made holding the NFS server mutex. To clean this up, introduce a version of the function, nfsrv_access_withgiant(), that expects the NFS server mutex to already have been dropped and Giant acquired. Wrap nfsrv_access() around this. This permits callers to more efficiently check access if they're in a code block performing VFS operations, and can be substitited for the nfsrv_access() call that triggered this bug. PR: 73807, 73208 MFC after: 1 week
* Add b_bufobj to struct buf which eventually will eliminate the need for b_vp.phk2004-10-221-1/+1
| | | | | | | | | | | | | | | | | | Initialize b_bufobj for all buffers. Make incore() and gbincore() take a bufobj instead of a vnode. Make inmem() local to vfs_bio.c Change a lot of VI_[UN]LOCK(bp->b_vp) to BO_[UN]LOCK(bp->b_bufobj) also VI_MTX() to BO_MTX(), Make buf_vlist_add() take a bufobj instead of a vnode. Eliminate other uses of bp->b_vp where bp->b_bufobj will do. Various minor polishing: remove "register", turn panic into KASSERT, use new function declarations, TAILQ_FOREACH_SAFE() etc.
* Correct several instances where calls to vfs_getvfs() resulting inrwatson2004-10-181-13/+61
| | | | | | | | | | | failure in the NFS server would result in a leaked instance of the NFS server subsystem lock. Liberally sprinkle assertions in all target labels for error unwinding to assert the desired locking state. RELENG_5_3 candidate. MFC after: 3 days Reported by: Wilkinson, Alex <alex dot wilkinson at dsto dot defence dot gov dot au>
* Convert a mtx_lock(&Giant) to a mtx_unlock(&Giant) in nfsrv_link() torwatson2004-08-251-1/+1
| | | | | | | | | prevent leakage of Giant. With INVARIANTS, this results in an assertion failure following execution of the RPC. Without INVARIANTS, it could result in problems if the NFS server is killed causing nfsd to return to user space holding Giant. Feet provided by: brueffer
* Second half of the dev_t cleanup.phk2004-06-171-1/+1
| | | | | | | | | | | The big lines are: NODEV -> NULL NOUDEV -> NODEV udev_t -> dev_t udev2dev() -> findcdev() Various minor adjustments including handling of userland access to kernel space struct cdev etc.
* Release NFS subsystem lock and acquire Giant when calling intorwatson2004-05-311-0/+4
| | | | vn_start_write().
* One more case where we want to drop the NFS server lock and acquirerwatson2004-05-301-1/+6
| | | | | | | Giant when entering VFS. Discovered by code inspection; still not hit without debug.mpsafenet=1. Reported by: bmilekic
* Acquire Giant around two more cases when calling into VFS to vput()rwatson2004-05-301-13/+22
| | | | | | | | | a vnode. Not bumped into with asserts in the main tree because we run the NFS server with Giant by default. Discovered by inspection. Complete annotations of Giant acquisition/release to note that it's only because of VFS that we acquire Giant in most places in the NFS server.
* Don't release Giant until after the call to vput() in nfsrv_setattr().rwatson2004-05-291-1/+1
| | | | Unless running with debug.mpsafenet=1, this was not actually a problem.
* Call nfsm_clget_nolock() instead of nfsm_clget() when holding the NFSrwatson2004-05-271-1/+1
| | | | | | subsystem lock to avoid tripping over an assertion regarding whether the lock is held or not. This is likely to be the cause of a panic tripped over by Andrea Campi.
* The socket code upcalls into the NFS server using the so_upcallrwatson2004-05-241-26/+406
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | mechanism so that early processing on mbufs can be performed before a context switch to the NFS server threads. Because of this, if the socket code is running without Giant, the NFS server also needs to be able to run the upcall code without relying on the presence on Giant. This change modifies the NFS server to run using a "giant code lock" covering operation of the whole subsystem. Work is in progress to move to data-based locking as part of the NFSv4 server changes. Introduce an NFS server subsystem lock, 'nfsd_mtx', and a set of macros to operate on the lock: NFSD_LOCK_ASSERT() Assert nfsd_mtx owned by current thread NFSD_UNLOCK_ASSERT() Assert nfsd_mtx not owned by current thread NFSD_LOCK_DONTCARE() Advisory: this function doesn't care NFSD_LOCK() Lock nfsd_mtx NFSD_UNLOCK() Unlock nfsd_mtx Constify a number of global variables/structures in the NFS server code, as they are not modified and contain constants only: nfsrvv2_procid nfsrv_nfsv3_procid nonidempotent nfsv2_repstat nfsv2_type nfsrv_nfsv3_procid nfsrvv2_procid nfsrv_v2errmap nfsv3err_null nfsv3err_getattr nfsv3err_setattr nfsv3err_lookup nfsv3err_access nfsv3err_readlink nfsv3err_read nfsv3err_write nfsv3err_create nfsv3err_mkdir nfsv3err_symlink nfsv3err_mknod nfsv3err_remove nfsv3err_rmdir nfsv3err_rename nfsv3err_link nfsv3err_readdir nfsv3err_readdirplus nfsv3err_fsstat nfsv3err_fsinfo nfsv3err_pathconf nfsv3err_commit nfsrv_v3errmap There are additional structures that should be constified but due to their being passed into general purpose functions without const arguments, I have not yet converted. In general, acquire nfsd_mtx when accessing any of the global NFS structures, including struct nfssvc_sock, struct nfsd, struct nfsrv_descript. Release nfsd_mtx whenever calling into VFS, and acquire Giant for calls into VFS. Giant is not required for any part of the operation of the NFS server with the exception of calls into VFS. Giant will never by acquired in the upcall code path. However, it may operate entirely covered by Giant, or not. If debug.mpsafenet is set to 0, the system calls will acquire Giant across all operations, and the upcall will assert Giant. As such, by default, this enables locking and allows us to test assertions, but should not cause any substantial new amount of code to be run without Giant. Bugs should manifest in the form of lock assertion failures for now. This approach is similar (but not identical) to modifications to the BSD/OS NFS server code snapshot provided by BSDi as part of their SMPng snapshot. The strategy is almost the same (single lock over the NFS server), but differs in the following ways: - Our NFS client and server code bases don't overlap, which means both fewer bugs and easier locking (thanks Peter!). Also means NFSD_*() as opposed to NFS_*(). - We make broad use of assertions, whereas the BSD/OS code does not. - Made slightly different choices about how to handle macros building packets but operating with side effects. - We acquire Giant only when entering VFS from the NFS server daemon threads. - Serious bugs in BSD/OS implementation corrected -- the snapshot we received was clearly a work in progress. Based on ideas from: BSDi SMPng Snapshot Reviewed by: rick@snowhite.cis.uoguelph.ca Extensive testing by: kris
OpenPOWER on IntegriCloud