fs/smb/client/transport.c

   1 // SPDX-License-Identifier: LGPL-2.1
   2 /*
   3  *
   4  *   Copyright (C) International Business Machines  Corp., 2002,2008
   5  *   Author(s): Steve French (sfrench@us.ibm.com)
   6  *   Jeremy Allison (jra@samba.org) 2006.
   7  *
   8  */
   9
  10 #include <linux/fs.h>
  11 #include <linux/list.h>
  12 #include <linux/gfp.h>
  13 #include <linux/wait.h>
  14 #include <linux/net.h>
  15 #include <linux/delay.h>
  16 #include <linux/freezer.h>
  17 #include <linux/tcp.h>
  18 #include <linux/bvec.h>
  19 #include <linux/highmem.h>
  20 #include <linux/uaccess.h>
  21 #include <asm/processor.h>
  22 #include <linux/mempool.h>
  23 #include <linux/sched/signal.h>
  24 #include <linux/task_io_accounting_ops.h>
  25 #include "cifspdu.h"
  26 #include "cifsglob.h"
  27 #include "cifsproto.h"
  28 #include "cifs_debug.h"
  29 #include "smb2proto.h"
  30 #include "smbdirect.h"
  31
  32 /* Max number of iovectors we can use off the stack when sending requests. */
  33 #define CIFS_MAX_IOV_SIZE 8
  34
  35 void
  36 cifs_wake_up_task(struct mid_q_entry *mid)
  37 {
  38         wake_up_process(mid->callback_data);
  39 }
  40
  41 static struct mid_q_entry *
  42 alloc_mid(const struct smb_hdr *smb_buffer, struct TCP_Server_Info *server)
  43 {
  44         struct mid_q_entry *temp;
  45
  46         if (server == NULL) {
  47                 cifs_dbg(VFS, "%s: null TCP session\n", __func__);
  48                 return NULL;
  49         }
  50
  51         temp = mempool_alloc(cifs_mid_poolp, GFP_NOFS);
  52         memset(temp, 0, sizeof(struct mid_q_entry));
  53         kref_init(&temp->refcount);
  54         temp->mid = get_mid(smb_buffer);
  55         temp->pid = current->pid;
  56         temp->command = cpu_to_le16(smb_buffer->Command);
  57         cifs_dbg(FYI, "For smb_command %d\n", smb_buffer->Command);
  58         /*      do_gettimeofday(&temp->when_sent);*/ /* easier to use jiffies */
  59         /* when mid allocated can be before when sent */
  60         temp->when_alloc = jiffies;
  61         temp->server = server;
  62
  63         /*
  64          * The default is for the mid to be synchronous, so the
  65          * default callback just wakes up the current task.
  66          */
  67         get_task_struct(current);
  68         temp->creator = current;
  69         temp->callback = cifs_wake_up_task;
  70         temp->callback_data = current;
  71
  72         atomic_inc(&mid_count);
  73         temp->mid_state = MID_REQUEST_ALLOCATED;
  74         return temp;
  75 }
  76
  77 static void __release_mid(struct kref *refcount)
  78 {
  79         struct mid_q_entry *midEntry =
  80                         container_of(refcount, struct mid_q_entry, refcount);
  81 #ifdef CONFIG_CIFS_STATS2
  82         __le16 command = midEntry->server->vals->lock_cmd;
  83         __u16 smb_cmd = le16_to_cpu(midEntry->command);
  84         unsigned long now;
  85         unsigned long roundtrip_time;
  86 #endif
  87         struct TCP_Server_Info *server = midEntry->server;
  88
  89         if (midEntry->resp_buf && (midEntry->mid_flags & MID_WAIT_CANCELLED) &&
  90             midEntry->mid_state == MID_RESPONSE_RECEIVED &&
  91             server->ops->handle_cancelled_mid)
  92                 server->ops->handle_cancelled_mid(midEntry, server);
  93
  94         midEntry->mid_state = MID_FREE;
  95         atomic_dec(&mid_count);
  96         if (midEntry->large_buf)
  97                 cifs_buf_release(midEntry->resp_buf);
  98         else
  99                 cifs_small_buf_release(midEntry->resp_buf);
 100 #ifdef CONFIG_CIFS_STATS2
 101         now = jiffies;
 102         if (now < midEntry->when_alloc)
 103                 cifs_server_dbg(VFS, "Invalid mid allocation time\n");
 104         roundtrip_time = now - midEntry->when_alloc;
 105
 106         if (smb_cmd < NUMBER_OF_SMB2_COMMANDS) {
 107                 if (atomic_read(&server->num_cmds[smb_cmd]) == 0) {
 108                         server->slowest_cmd[smb_cmd] = roundtrip_time;
 109                         server->fastest_cmd[smb_cmd] = roundtrip_time;
 110                 } else {
 111                         if (server->slowest_cmd[smb_cmd] < roundtrip_time)
 112                                 server->slowest_cmd[smb_cmd] = roundtrip_time;
 113                         else if (server->fastest_cmd[smb_cmd] > roundtrip_time)
 114                                 server->fastest_cmd[smb_cmd] = roundtrip_time;
 115                 }
 116                 cifs_stats_inc(&server->num_cmds[smb_cmd]);
 117                 server->time_per_cmd[smb_cmd] += roundtrip_time;
 118         }
 119         /*
 120          * commands taking longer than one second (default) can be indications
 121          * that something is wrong, unless it is quite a slow link or a very
 122          * busy server. Note that this calc is unlikely or impossible to wrap
 123          * as long as slow_rsp_threshold is not set way above recommended max
 124          * value (32767 ie 9 hours) and is generally harmless even if wrong
 125          * since only affects debug counters - so leaving the calc as simple
 126          * comparison rather than doing multiple conversions and overflow
 127          * checks
 128          */
 129         if ((slow_rsp_threshold != 0) &&
 130             time_after(now, midEntry->when_alloc + (slow_rsp_threshold * HZ)) &&
 131             (midEntry->command != command)) {
 132                 /*
 133                  * smb2slowcmd[NUMBER_OF_SMB2_COMMANDS] counts by command
 134                  * NB: le16_to_cpu returns unsigned so can not be negative below
 135                  */
 136                 if (smb_cmd < NUMBER_OF_SMB2_COMMANDS)
 137                         cifs_stats_inc(&server->smb2slowcmd[smb_cmd]);
 138
 139                 trace_smb3_slow_rsp(smb_cmd, midEntry->mid, midEntry->pid,
 140                                midEntry->when_sent, midEntry->when_received);
 141                 if (cifsFYI & CIFS_TIMER) {
 142                         pr_debug("slow rsp: cmd %d mid %llu",
 143                                  midEntry->command, midEntry->mid);
 144                         cifs_info("A: 0x%lx S: 0x%lx R: 0x%lx\n",
 145                                   now - midEntry->when_alloc,
 146                                   now - midEntry->when_sent,
 147                                   now - midEntry->when_received);
 148                 }
 149         }
 150 #endif
 151         put_task_struct(midEntry->creator);
 152
 153         mempool_free(midEntry, cifs_mid_poolp);
 154 }
 155
 156 void release_mid(struct mid_q_entry *mid)
 157 {
 158         struct TCP_Server_Info *server = mid->server;
 159
 160         spin_lock(&server->mid_lock);
 161         kref_put(&mid->refcount, __release_mid);
 162         spin_unlock(&server->mid_lock);
 163 }
 164
 165 void
 166 delete_mid(struct mid_q_entry *mid)
 167 {
 168         spin_lock(&mid->server->mid_lock);
 169         if (!(mid->mid_flags & MID_DELETED)) {
 170                 list_del_init(&mid->qhead);
 171                 mid->mid_flags |= MID_DELETED;
 172         }
 173         spin_unlock(&mid->server->mid_lock);
 174
 175         release_mid(mid);
 176 }
 177
 178 /*
 179  * smb_send_kvec - send an array of kvecs to the server
 180  * @server:     Server to send the data to
 181  * @smb_msg:    Message to send
 182  * @sent:       amount of data sent on socket is stored here
 183  *
 184  * Our basic "send data to server" function. Should be called with srv_mutex
 185  * held. The caller is responsible for handling the results.
 186  */
 187 static int
 188 smb_send_kvec(struct TCP_Server_Info *server, struct msghdr *smb_msg,
 189               size_t *sent)
 190 {
 191         int rc = 0;
 192         int retries = 0;
 193         struct socket *ssocket = server->ssocket;
 194
 195         *sent = 0;
 196
 197         if (server->noblocksnd)
 198                 smb_msg->msg_flags = MSG_DONTWAIT + MSG_NOSIGNAL;
 199         else
 200                 smb_msg->msg_flags = MSG_NOSIGNAL;
 201
 202         while (msg_data_left(smb_msg)) {
 203                 /*
 204                  * If blocking send, we try 3 times, since each can block
 205                  * for 5 seconds. For nonblocking  we have to try more
 206                  * but wait increasing amounts of time allowing time for
 207                  * socket to clear.  The overall time we wait in either
 208                  * case to send on the socket is about 15 seconds.
 209                  * Similarly we wait for 15 seconds for a response from
 210                  * the server in SendReceive[2] for the server to send
 211                  * a response back for most types of requests (except
 212                  * SMB Write past end of file which can be slow, and
 213                  * blocking lock operations). NFS waits slightly longer
 214                  * than CIFS, but this can make it take longer for
 215                  * nonresponsive servers to be detected and 15 seconds
 216                  * is more than enough time for modern networks to
 217                  * send a packet.  In most cases if we fail to send
 218                  * after the retries we will kill the socket and
 219                  * reconnect which may clear the network problem.
 220                  */
 221                 rc = sock_sendmsg(ssocket, smb_msg);
 222                 if (rc == -EAGAIN) {
 223                         retries++;
 224                         if (retries >= 14 ||
 225                             (!server->noblocksnd && (retries > 2))) {
 226                                 cifs_server_dbg(VFS, "sends on sock %p stuck for 15 seconds\n",
 227                                          ssocket);
 228                                 return -EAGAIN;
 229                         }
 230                         msleep(1 << retries);
 231                         continue;
 232                 }
 233
 234                 if (rc < 0)
 235                         return rc;
 236
 237                 if (rc == 0) {
 238                         /* should never happen, letting socket clear before
 239                            retrying is our only obvious option here */
 240                         cifs_server_dbg(VFS, "tcp sent no data\n");
 241                         msleep(500);
 242                         continue;
 243                 }
 244
 245                 /* send was at least partially successful */
 246                 *sent += rc;
 247                 retries = 0; /* in case we get ENOSPC on the next send */
 248         }
 249         return 0;
 250 }
 251
 252 unsigned long
 253 smb_rqst_len(struct TCP_Server_Info *server, struct smb_rqst *rqst)
 254 {
 255         unsigned int i;
 256         struct kvec *iov;
 257         int nvec;
 258         unsigned long buflen = 0;
 259
 260         if (!is_smb1(server) && rqst->rq_nvec >= 2 &&
 261             rqst->rq_iov[0].iov_len == 4) {
 262                 iov = &rqst->rq_iov[1];
 263                 nvec = rqst->rq_nvec - 1;
 264         } else {
 265                 iov = rqst->rq_iov;
 266                 nvec = rqst->rq_nvec;
 267         }
 268
 269         /* total up iov array first */
 270         for (i = 0; i < nvec; i++)
 271                 buflen += iov[i].iov_len;
 272
 273         buflen += iov_iter_count(&rqst->rq_iter);
 274         return buflen;
 275 }
 276
 277 static int
 278 __smb_send_rqst(struct TCP_Server_Info *server, int num_rqst,
 279                 struct smb_rqst *rqst)
 280 {
 281         int rc;
 282         struct kvec *iov;
 283         int n_vec;
 284         unsigned int send_length = 0;
 285         unsigned int i, j;
 286         sigset_t mask, oldmask;
 287         size_t total_len = 0, sent, size;
 288         struct socket *ssocket = server->ssocket;
 289         struct msghdr smb_msg = {};
 290         __be32 rfc1002_marker;
 291
 292         cifs_in_send_inc(server);
 293         if (cifs_rdma_enabled(server)) {
 294                 /* return -EAGAIN when connecting or reconnecting */
 295                 rc = -EAGAIN;
 296                 if (server->smbd_conn)
 297                         rc = smbd_send(server, num_rqst, rqst);
 298                 goto smbd_done;
 299         }
 300
 301         rc = -EAGAIN;
 302         if (ssocket == NULL)
 303                 goto out;
 304
 305         rc = -ERESTARTSYS;
 306         if (fatal_signal_pending(current)) {
 307                 cifs_dbg(FYI, "signal pending before send request\n");
 308                 goto out;
 309         }
 310
 311         rc = 0;
 312         /* cork the socket */
 313         tcp_sock_set_cork(ssocket->sk, true);
 314
 315         for (j = 0; j < num_rqst; j++)
 316                 send_length += smb_rqst_len(server, &rqst[j]);
 317         rfc1002_marker = cpu_to_be32(send_length);
 318
 319         /*
 320          * We should not allow signals to interrupt the network send because
 321          * any partial send will cause session reconnects thus increasing
 322          * latency of system calls and overload a server with unnecessary
 323          * requests.
 324          */
 325
 326         sigfillset(&mask);
 327         sigprocmask(SIG_BLOCK, &mask, &oldmask);
 328
 329         /* Generate a rfc1002 marker for SMB2+ */
 330         if (!is_smb1(server)) {
 331                 struct kvec hiov = {
 332                         .iov_base = &rfc1002_marker,
 333                         .iov_len  = 4
 334                 };
 335                 iov_iter_kvec(&smb_msg.msg_iter, ITER_SOURCE, &hiov, 1, 4);
 336                 rc = smb_send_kvec(server, &smb_msg, &sent);
 337                 if (rc < 0)
 338                         goto unmask;
 339
 340                 total_len += sent;
 341                 send_length += 4;
 342         }
 343
 344         cifs_dbg(FYI, "Sending smb: smb_len=%u\n", send_length);
 345
 346         for (j = 0; j < num_rqst; j++) {
 347                 iov = rqst[j].rq_iov;
 348                 n_vec = rqst[j].rq_nvec;
 349
 350                 size = 0;
 351                 for (i = 0; i < n_vec; i++) {
 352                         dump_smb(iov[i].iov_base, iov[i].iov_len);
 353                         size += iov[i].iov_len;
 354                 }
 355
 356                 iov_iter_kvec(&smb_msg.msg_iter, ITER_SOURCE, iov, n_vec, size);
 357
 358                 rc = smb_send_kvec(server, &smb_msg, &sent);
 359                 if (rc < 0)
 360                         goto unmask;
 361
 362                 total_len += sent;
 363
 364                 if (iov_iter_count(&rqst[j].rq_iter) > 0) {
 365                         smb_msg.msg_iter = rqst[j].rq_iter;
 366                         rc = smb_send_kvec(server, &smb_msg, &sent);
 367                         if (rc < 0)
 368                                 break;
 369                         total_len += sent;
 370                 }
 371
 372 }
 373
 374 unmask:
 375         sigprocmask(SIG_SETMASK, &oldmask, NULL);
 376
 377         /*
 378          * If signal is pending but we have already sent the whole packet to
 379          * the server we need to return success status to allow a corresponding
 380          * mid entry to be kept in the pending requests queue thus allowing
 381          * to handle responses from the server by the client.
 382          *
 383          * If only part of the packet has been sent there is no need to hide
 384          * interrupt because the session will be reconnected anyway, so there
 385          * won't be any response from the server to handle.
 386          */
 387
 388         if (signal_pending(current) && (total_len != send_length)) {
 389                 cifs_dbg(FYI, "signal is pending after attempt to send\n");
 390                 rc = -ERESTARTSYS;
 391         }
 392
 393         /* uncork it */
 394         tcp_sock_set_cork(ssocket->sk, false);
 395
 396         if ((total_len > 0) && (total_len != send_length)) {
 397                 cifs_dbg(FYI, "partial send (wanted=%u sent=%zu): terminating session\n",
 398                          send_length, total_len);
 399                 /*
 400                  * If we have only sent part of an SMB then the next SMB could
 401                  * be taken as the remainder of this one. We need to kill the
 402                  * socket so the server throws away the partial SMB
 403                  */
 404                 cifs_signal_cifsd_for_reconnect(server, false);
 405                 trace_smb3_partial_send_reconnect(server->CurrentMid,
 406                                                   server->conn_id, server->hostname);
 407         }
 408 smbd_done:
 409         if (rc < 0 && rc != -EINTR)
 410                 cifs_server_dbg(VFS, "Error %d sending data on socket to server\n",
 411                          rc);
 412         else if (rc > 0)
 413                 rc = 0;
 414 out:
 415         cifs_in_send_dec(server);
 416         return rc;
 417 }
 418
 419 static int
 420 smb_send_rqst(struct TCP_Server_Info *server, int num_rqst,
 421               struct smb_rqst *rqst, int flags)
 422 {
 423         struct kvec iov;
 424         struct smb2_transform_hdr *tr_hdr;
 425         struct smb_rqst cur_rqst[MAX_COMPOUND];
 426         int rc;
 427
 428         if (!(flags & CIFS_TRANSFORM_REQ))
 429                 return __smb_send_rqst(server, num_rqst, rqst);
 430
 431         if (num_rqst > MAX_COMPOUND - 1)
 432                 return -ENOMEM;
 433
 434         if (!server->ops->init_transform_rq) {
 435                 cifs_server_dbg(VFS, "Encryption requested but transform callback is missing\n");
 436                 return -EIO;
 437         }
 438
 439         tr_hdr = kzalloc(sizeof(*tr_hdr), GFP_NOFS);
 440         if (!tr_hdr)
 441                 return -ENOMEM;
 442
 443         memset(&cur_rqst[0], 0, sizeof(cur_rqst));
 444         memset(&iov, 0, sizeof(iov));
 445
 446         iov.iov_base = tr_hdr;
 447         iov.iov_len = sizeof(*tr_hdr);
 448         cur_rqst[0].rq_iov = &iov;
 449         cur_rqst[0].rq_nvec = 1;
 450
 451         rc = server->ops->init_transform_rq(server, num_rqst + 1,
 452                                             &cur_rqst[0], rqst);
 453         if (rc)
 454                 goto out;
 455
 456         rc = __smb_send_rqst(server, num_rqst + 1, &cur_rqst[0]);
 457         smb3_free_compound_rqst(num_rqst, &cur_rqst[1]);
 458 out:
 459         kfree(tr_hdr);
 460         return rc;
 461 }
 462
 463 int
 464 smb_send(struct TCP_Server_Info *server, struct smb_hdr *smb_buffer,
 465          unsigned int smb_buf_length)
 466 {
 467         struct kvec iov[2];
 468         struct smb_rqst rqst = { .rq_iov = iov,
 469                                  .rq_nvec = 2 };
 470
 471         iov[0].iov_base = smb_buffer;
 472         iov[0].iov_len = 4;
 473         iov[1].iov_base = (char *)smb_buffer + 4;
 474         iov[1].iov_len = smb_buf_length;
 475
 476         return __smb_send_rqst(server, 1, &rqst);
 477 }
 478
 479 static int
 480 wait_for_free_credits(struct TCP_Server_Info *server, const int num_credits,
 481                       const int timeout, const int flags,
 482                       unsigned int *instance)
 483 {
 484         long rc;
 485         int *credits;
 486         int optype;
 487         long int t;
 488         int scredits, in_flight;
 489
 490         if (timeout < 0)
 491                 t = MAX_JIFFY_OFFSET;
 492         else
 493                 t = msecs_to_jiffies(timeout);
 494
 495         optype = flags & CIFS_OP_MASK;
 496
 497         *instance = 0;
 498
 499         credits = server->ops->get_credits_field(server, optype);
 500         /* Since an echo is already inflight, no need to wait to send another */
 501         if (*credits <= 0 && optype == CIFS_ECHO_OP)
 502                 return -EAGAIN;
 503
 504         spin_lock(&server->req_lock);
 505         if ((flags & CIFS_TIMEOUT_MASK) == CIFS_NON_BLOCKING) {
 506                 /* oplock breaks must not be held up */
 507                 server->in_flight++;
 508                 if (server->in_flight > server->max_in_flight)
 509                         server->max_in_flight = server->in_flight;
 510                 *credits -= 1;
 511                 *instance = server->reconnect_instance;
 512                 scredits = *credits;
 513                 in_flight = server->in_flight;
 514                 spin_unlock(&server->req_lock);
 515
 516                 trace_smb3_nblk_credits(server->CurrentMid,
 517                                 server->conn_id, server->hostname, scredits, -1, in_flight);
 518                 cifs_dbg(FYI, "%s: remove %u credits total=%d\n",
 519                                 __func__, 1, scredits);
 520
 521                 return 0;
 522         }
 523
 524         while (1) {
 525                 if (*credits < num_credits) {
 526                         scredits = *credits;
 527                         spin_unlock(&server->req_lock);
 528
 529                         cifs_num_waiters_inc(server);
 530                         rc = wait_event_killable_timeout(server->request_q,
 531                                 has_credits(server, credits, num_credits), t);
 532                         cifs_num_waiters_dec(server);
 533                         if (!rc) {
 534                                 spin_lock(&server->req_lock);
 535                                 scredits = *credits;
 536                                 in_flight = server->in_flight;
 537                                 spin_unlock(&server->req_lock);
 538
 539                                 trace_smb3_credit_timeout(server->CurrentMid,
 540                                                 server->conn_id, server->hostname, scredits,
 541                                                 num_credits, in_flight);
 542                                 cifs_server_dbg(VFS, "wait timed out after %d ms\n",
 543                                                 timeout);
 544                                 return -EBUSY;
 545                         }
 546                         if (rc == -ERESTARTSYS)
 547                                 return -ERESTARTSYS;
 548                         spin_lock(&server->req_lock);
 549                 } else {
 550                         spin_unlock(&server->req_lock);
 551
 552                         spin_lock(&server->srv_lock);
 553                         if (server->tcpStatus == CifsExiting) {
 554                                 spin_unlock(&server->srv_lock);
 555                                 return -ENOENT;
 556                         }
 557                         spin_unlock(&server->srv_lock);
 558
 559                         /*
 560                          * For normal commands, reserve the last MAX_COMPOUND
 561                          * credits to compound requests.
 562                          * Otherwise these compounds could be permanently
 563                          * starved for credits by single-credit requests.
 564                          *
 565                          * To prevent spinning CPU, block this thread until
 566                          * there are >MAX_COMPOUND credits available.
 567                          * But only do this is we already have a lot of
 568                          * credits in flight to avoid triggering this check
 569                          * for servers that are slow to hand out credits on
 570                          * new sessions.
 571                          */
 572                         spin_lock(&server->req_lock);
 573                         if (!optype && num_credits == 1 &&
 574                             server->in_flight > 2 * MAX_COMPOUND &&
 575                             *credits <= MAX_COMPOUND) {
 576                                 spin_unlock(&server->req_lock);
 577
 578                                 cifs_num_waiters_inc(server);
 579                                 rc = wait_event_killable_timeout(
 580                                         server->request_q,
 581                                         has_credits(server, credits,
 582                                                     MAX_COMPOUND + 1),
 583                                         t);
 584                                 cifs_num_waiters_dec(server);
 585                                 if (!rc) {
 586                                         spin_lock(&server->req_lock);
 587                                         scredits = *credits;
 588                                         in_flight = server->in_flight;
 589                                         spin_unlock(&server->req_lock);
 590
 591                                         trace_smb3_credit_timeout(
 592                                                         server->CurrentMid,
 593                                                         server->conn_id, server->hostname,
 594                                                         scredits, num_credits, in_flight);
 595                                         cifs_server_dbg(VFS, "wait timed out after %d ms\n",
 596                                                         timeout);
 597                                         return -EBUSY;
 598                                 }
 599                                 if (rc == -ERESTARTSYS)
 600                                         return -ERESTARTSYS;
 601                                 spin_lock(&server->req_lock);
 602                                 continue;
 603                         }
 604
 605                         /*
 606                          * Can not count locking commands against total
 607                          * as they are allowed to block on server.
 608                          */
 609
 610                         /* update # of requests on the wire to server */
 611                         if ((flags & CIFS_TIMEOUT_MASK) != CIFS_BLOCKING_OP) {
 612                                 *credits -= num_credits;
 613                                 server->in_flight += num_credits;
 614                                 if (server->in_flight > server->max_in_flight)
 615                                         server->max_in_flight = server->in_flight;
 616                                 *instance = server->reconnect_instance;
 617                         }
 618                         scredits = *credits;
 619                         in_flight = server->in_flight;
 620                         spin_unlock(&server->req_lock);
 621
 622                         trace_smb3_waitff_credits(server->CurrentMid,
 623                                         server->conn_id, server->hostname, scredits,
 624                                         -(num_credits), in_flight);
 625                         cifs_dbg(FYI, "%s: remove %u credits total=%d\n",
 626                                         __func__, num_credits, scredits);
 627                         break;
 628                 }
 629         }
 630         return 0;
 631 }
 632
 633 static int
 634 wait_for_free_request(struct TCP_Server_Info *server, const int flags,
 635                       unsigned int *instance)
 636 {
 637         return wait_for_free_credits(server, 1, -1, flags,
 638                                      instance);
 639 }
 640
 641 static int
 642 wait_for_compound_request(struct TCP_Server_Info *server, int num,
 643                           const int flags, unsigned int *instance)
 644 {
 645         int *credits;
 646         int scredits, in_flight;
 647
 648         credits = server->ops->get_credits_field(server, flags & CIFS_OP_MASK);
 649
 650         spin_lock(&server->req_lock);
 651         scredits = *credits;
 652         in_flight = server->in_flight;
 653
 654         if (*credits < num) {
 655                 /*
 656                  * If the server is tight on resources or just gives us less
 657                  * credits for other reasons (e.g. requests are coming out of
 658                  * order and the server delays granting more credits until it
 659                  * processes a missing mid) and we exhausted most available
 660                  * credits there may be situations when we try to send
 661                  * a compound request but we don't have enough credits. At this
 662                  * point the client needs to decide if it should wait for
 663                  * additional credits or fail the request. If at least one
 664                  * request is in flight there is a high probability that the
 665                  * server will return enough credits to satisfy this compound
 666                  * request.
 667                  *
 668                  * Return immediately if no requests in flight since we will be
 669                  * stuck on waiting for credits.
 670                  */
 671                 if (server->in_flight == 0) {
 672                         spin_unlock(&server->req_lock);
 673                         trace_smb3_insufficient_credits(server->CurrentMid,
 674                                         server->conn_id, server->hostname, scredits,
 675                                         num, in_flight);
 676                         cifs_dbg(FYI, "%s: %d requests in flight, needed %d total=%d\n",
 677                                         __func__, in_flight, num, scredits);
 678                         return -EDEADLK;
 679                 }
 680         }
 681         spin_unlock(&server->req_lock);
 682
 683         return wait_for_free_credits(server, num, 60000, flags,
 684                                      instance);
 685 }
 686
 687 int
 688 cifs_wait_mtu_credits(struct TCP_Server_Info *server, unsigned int size,
 689                       unsigned int *num, struct cifs_credits *credits)
 690 {
 691         *num = size;
 692         credits->value = 0;
 693         credits->instance = server->reconnect_instance;
 694         return 0;
 695 }
 696
 697 static int allocate_mid(struct cifs_ses *ses, struct smb_hdr *in_buf,
 698                         struct mid_q_entry **ppmidQ)
 699 {
 700         spin_lock(&ses->ses_lock);
 701         if (ses->ses_status == SES_NEW) {
 702                 if ((in_buf->Command != SMB_COM_SESSION_SETUP_ANDX) &&
 703                         (in_buf->Command != SMB_COM_NEGOTIATE)) {
 704                         spin_unlock(&ses->ses_lock);
 705                         return -EAGAIN;
 706                 }
 707                 /* else ok - we are setting up session */
 708         }
 709
 710         if (ses->ses_status == SES_EXITING) {
 711                 /* check if SMB session is bad because we are setting it up */
 712                 if (in_buf->Command != SMB_COM_LOGOFF_ANDX) {
 713                         spin_unlock(&ses->ses_lock);
 714                         return -EAGAIN;
 715                 }
 716                 /* else ok - we are shutting down session */
 717         }
 718         spin_unlock(&ses->ses_lock);
 719
 720         *ppmidQ = alloc_mid(in_buf, ses->server);
 721         if (*ppmidQ == NULL)
 722                 return -ENOMEM;
 723         spin_lock(&ses->server->mid_lock);
 724         list_add_tail(&(*ppmidQ)->qhead, &ses->server->pending_mid_q);
 725         spin_unlock(&ses->server->mid_lock);
 726         return 0;
 727 }
 728
 729 static int
 730 wait_for_response(struct TCP_Server_Info *server, struct mid_q_entry *midQ)
 731 {
 732         int error;
 733
 734         error = wait_event_state(server->response_q,
 735                                  midQ->mid_state != MID_REQUEST_SUBMITTED,
 736                                  (TASK_KILLABLE|TASK_FREEZABLE_UNSAFE));
 737         if (error < 0)
 738                 return -ERESTARTSYS;
 739
 740         return 0;
 741 }
 742
 743 struct mid_q_entry *
 744 cifs_setup_async_request(struct TCP_Server_Info *server, struct smb_rqst *rqst)
 745 {
 746         int rc;
 747         struct smb_hdr *hdr = (struct smb_hdr *)rqst->rq_iov[0].iov_base;
 748         struct mid_q_entry *mid;
 749
 750         if (rqst->rq_iov[0].iov_len != 4 ||
 751             rqst->rq_iov[0].iov_base + 4 != rqst->rq_iov[1].iov_base)
 752                 return ERR_PTR(-EIO);
 753
 754         /* enable signing if server requires it */
 755         if (server->sign)
 756                 hdr->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
 757
 758         mid = alloc_mid(hdr, server);
 759         if (mid == NULL)
 760                 return ERR_PTR(-ENOMEM);
 761
 762         rc = cifs_sign_rqst(rqst, server, &mid->sequence_number);
 763         if (rc) {
 764                 release_mid(mid);
 765                 return ERR_PTR(rc);
 766         }
 767
 768         return mid;
 769 }
 770
 771 /*
 772  * Send a SMB request and set the callback function in the mid to handle
 773  * the result. Caller is responsible for dealing with timeouts.
 774  */
 775 int
 776 cifs_call_async(struct TCP_Server_Info *server, struct smb_rqst *rqst,
 777                 mid_receive_t *receive, mid_callback_t *callback,
 778                 mid_handle_t *handle, void *cbdata, const int flags,
 779                 const struct cifs_credits *exist_credits)
 780 {
 781         int rc;
 782         struct mid_q_entry *mid;
 783         struct cifs_credits credits = { .value = 0, .instance = 0 };
 784         unsigned int instance;
 785         int optype;
 786
 787         optype = flags & CIFS_OP_MASK;
 788
 789         if ((flags & CIFS_HAS_CREDITS) == 0) {
 790                 rc = wait_for_free_request(server, flags, &instance);
 791                 if (rc)
 792                         return rc;
 793                 credits.value = 1;
 794                 credits.instance = instance;
 795         } else
 796                 instance = exist_credits->instance;
 797
 798         cifs_server_lock(server);
 799
 800         /*
 801          * We can't use credits obtained from the previous session to send this
 802          * request. Check if there were reconnects after we obtained credits and
 803          * return -EAGAIN in such cases to let callers handle it.
 804          */
 805         if (instance != server->reconnect_instance) {
 806                 cifs_server_unlock(server);
 807                 add_credits_and_wake_if(server, &credits, optype);
 808                 return -EAGAIN;
 809         }
 810
 811         mid = server->ops->setup_async_request(server, rqst);
 812         if (IS_ERR(mid)) {
 813                 cifs_server_unlock(server);
 814                 add_credits_and_wake_if(server, &credits, optype);
 815                 return PTR_ERR(mid);
 816         }
 817
 818         mid->receive = receive;
 819         mid->callback = callback;
 820         mid->callback_data = cbdata;
 821         mid->handle = handle;
 822         mid->mid_state = MID_REQUEST_SUBMITTED;
 823
 824         /* put it on the pending_mid_q */
 825         spin_lock(&server->mid_lock);
 826         list_add_tail(&mid->qhead, &server->pending_mid_q);
 827         spin_unlock(&server->mid_lock);
 828
 829         /*
 830          * Need to store the time in mid before calling I/O. For call_async,
 831          * I/O response may come back and free the mid entry on another thread.
 832          */
 833         cifs_save_when_sent(mid);
 834         rc = smb_send_rqst(server, 1, rqst, flags);
 835
 836         if (rc < 0) {
 837                 revert_current_mid(server, mid->credits);
 838                 server->sequence_number -= 2;
 839                 delete_mid(mid);
 840         }
 841
 842         cifs_server_unlock(server);
 843
 844         if (rc == 0)
 845                 return 0;
 846
 847         add_credits_and_wake_if(server, &credits, optype);
 848         return rc;
 849 }
 850
 851 /*
 852  *
 853  * Send an SMB Request.  No response info (other than return code)
 854  * needs to be parsed.
 855  *
 856  * flags indicate the type of request buffer and how long to wait
 857  * and whether to log NT STATUS code (error) before mapping it to POSIX error
 858  *
 859  */
 860 int
 861 SendReceiveNoRsp(const unsigned int xid, struct cifs_ses *ses,
 862                  char *in_buf, int flags)
 863 {
 864         int rc;
 865         struct kvec iov[1];
 866         struct kvec rsp_iov;
 867         int resp_buf_type;
 868
 869         iov[0].iov_base = in_buf;
 870         iov[0].iov_len = get_rfc1002_length(in_buf) + 4;
 871         flags |= CIFS_NO_RSP_BUF;
 872         rc = SendReceive2(xid, ses, iov, 1, &resp_buf_type, flags, &rsp_iov);
 873         cifs_dbg(NOISY, "SendRcvNoRsp flags %d rc %d\n", flags, rc);
 874
 875         return rc;
 876 }
 877
 878 static int
 879 cifs_sync_mid_result(struct mid_q_entry *mid, struct TCP_Server_Info *server)
 880 {
 881         int rc = 0;
 882
 883         cifs_dbg(FYI, "%s: cmd=%d mid=%llu state=%d\n",
 884                  __func__, le16_to_cpu(mid->command), mid->mid, mid->mid_state);
 885
 886         spin_lock(&server->mid_lock);
 887         switch (mid->mid_state) {
 888         case MID_RESPONSE_RECEIVED:
 889                 spin_unlock(&server->mid_lock);
 890                 return rc;
 891         case MID_RETRY_NEEDED:
 892                 rc = -EAGAIN;
 893                 break;
 894         case MID_RESPONSE_MALFORMED:
 895                 rc = -EIO;
 896                 break;
 897         case MID_SHUTDOWN:
 898                 rc = -EHOSTDOWN;
 899                 break;
 900         default:
 901                 if (!(mid->mid_flags & MID_DELETED)) {
 902                         list_del_init(&mid->qhead);
 903                         mid->mid_flags |= MID_DELETED;
 904                 }
 905                 cifs_server_dbg(VFS, "%s: invalid mid state mid=%llu state=%d\n",
 906                          __func__, mid->mid, mid->mid_state);
 907                 rc = -EIO;
 908         }
 909         spin_unlock(&server->mid_lock);
 910
 911         release_mid(mid);
 912         return rc;
 913 }
 914
 915 static inline int
 916 send_cancel(struct TCP_Server_Info *server, struct smb_rqst *rqst,
 917             struct mid_q_entry *mid)
 918 {
 919         return server->ops->send_cancel ?
 920                                 server->ops->send_cancel(server, rqst, mid) : 0;
 921 }
 922
 923 int
 924 cifs_check_receive(struct mid_q_entry *mid, struct TCP_Server_Info *server,
 925                    bool log_error)
 926 {
 927         unsigned int len = get_rfc1002_length(mid->resp_buf) + 4;
 928
 929         dump_smb(mid->resp_buf, min_t(u32, 92, len));
 930
 931         /* convert the length into a more usable form */
 932         if (server->sign) {
 933                 struct kvec iov[2];
 934                 int rc = 0;
 935                 struct smb_rqst rqst = { .rq_iov = iov,
 936                                          .rq_nvec = 2 };
 937
 938                 iov[0].iov_base = mid->resp_buf;
 939                 iov[0].iov_len = 4;
 940                 iov[1].iov_base = (char *)mid->resp_buf + 4;
 941                 iov[1].iov_len = len - 4;
 942                 /* FIXME: add code to kill session */
 943                 rc = cifs_verify_signature(&rqst, server,
 944                                            mid->sequence_number);
 945                 if (rc)
 946                         cifs_server_dbg(VFS, "SMB signature verification returned error = %d\n",
 947                                  rc);
 948         }
 949
 950         /* BB special case reconnect tid and uid here? */
 951         return map_and_check_smb_error(mid, log_error);
 952 }
 953
 954 struct mid_q_entry *
 955 cifs_setup_request(struct cifs_ses *ses, struct TCP_Server_Info *ignored,
 956                    struct smb_rqst *rqst)
 957 {
 958         int rc;
 959         struct smb_hdr *hdr = (struct smb_hdr *)rqst->rq_iov[0].iov_base;
 960         struct mid_q_entry *mid;
 961
 962         if (rqst->rq_iov[0].iov_len != 4 ||
 963             rqst->rq_iov[0].iov_base + 4 != rqst->rq_iov[1].iov_base)
 964                 return ERR_PTR(-EIO);
 965
 966         rc = allocate_mid(ses, hdr, &mid);
 967         if (rc)
 968                 return ERR_PTR(rc);
 969         rc = cifs_sign_rqst(rqst, ses->server, &mid->sequence_number);
 970         if (rc) {
 971                 delete_mid(mid);
 972                 return ERR_PTR(rc);
 973         }
 974         return mid;
 975 }
 976
 977 static void
 978 cifs_compound_callback(struct mid_q_entry *mid)
 979 {
 980         struct TCP_Server_Info *server = mid->server;
 981         struct cifs_credits credits;
 982
 983         credits.value = server->ops->get_credits(mid);
 984         credits.instance = server->reconnect_instance;
 985
 986         add_credits(server, &credits, mid->optype);
 987 }
 988
 989 static void
 990 cifs_compound_last_callback(struct mid_q_entry *mid)
 991 {
 992         cifs_compound_callback(mid);
 993         cifs_wake_up_task(mid);
 994 }
 995
 996 static void
 997 cifs_cancelled_callback(struct mid_q_entry *mid)
 998 {
 999         cifs_compound_callback(mid);
1000         release_mid(mid);
1001 }
1002
1003 /*
1004  * Return a channel (master if none) of @ses that can be used to send
1005  * regular requests.
1006  *
1007  * If we are currently binding a new channel (negprot/sess.setup),
1008  * return the new incomplete channel.
1009  */
1010 struct TCP_Server_Info *cifs_pick_channel(struct cifs_ses *ses)
1011 {
1012         uint index = 0;
1013         unsigned int min_in_flight = UINT_MAX, max_in_flight = 0;
1014         struct TCP_Server_Info *server = NULL;
1015         int i;
1016
1017         if (!ses)
1018                 return NULL;
1019
1020         spin_lock(&ses->chan_lock);
1021         for (i = 0; i < ses->chan_count; i++) {
1022                 server = ses->chans[i].server;
1023                 if (!server)
1024                         continue;
1025
1026                 /*
1027                  * strictly speaking, we should pick up req_lock to read
1028                  * server->in_flight. But it shouldn't matter much here if we
1029                  * race while reading this data. The worst that can happen is
1030                  * that we could use a channel that's not least loaded. Avoiding
1031                  * taking the lock could help reduce wait time, which is
1032                  * important for this function
1033                  */
1034                 if (server->in_flight < min_in_flight) {
1035                         min_in_flight = server->in_flight;
1036                         index = i;
1037                 }
1038                 if (server->in_flight > max_in_flight)
1039                         max_in_flight = server->in_flight;
1040         }
1041
1042         /* if all channels are equally loaded, fall back to round-robin */
1043         if (min_in_flight == max_in_flight) {
1044                 index = (uint)atomic_inc_return(&ses->chan_seq);
1045                 index %= ses->chan_count;
1046         }
1047         spin_unlock(&ses->chan_lock);
1048
1049         return ses->chans[index].server;
1050 }
1051
1052 int
1053 compound_send_recv(const unsigned int xid, struct cifs_ses *ses,
1054                    struct TCP_Server_Info *server,
1055                    const int flags, const int num_rqst, struct smb_rqst *rqst,
1056                    int *resp_buf_type, struct kvec *resp_iov)
1057 {
1058         int i, j, optype, rc = 0;
1059         struct mid_q_entry *midQ[MAX_COMPOUND];
1060         bool cancelled_mid[MAX_COMPOUND] = {false};
1061         struct cifs_credits credits[MAX_COMPOUND] = {
1062                 { .value = 0, .instance = 0 }
1063         };
1064         unsigned int instance;
1065         char *buf;
1066
1067         optype = flags & CIFS_OP_MASK;
1068
1069         for (i = 0; i < num_rqst; i++)
1070                 resp_buf_type[i] = CIFS_NO_BUFFER;  /* no response buf yet */
1071
1072         if (!ses || !ses->server || !server) {
1073                 cifs_dbg(VFS, "Null session\n");
1074                 return -EIO;
1075         }
1076
1077         spin_lock(&server->srv_lock);
1078         if (server->tcpStatus == CifsExiting) {
1079                 spin_unlock(&server->srv_lock);
1080                 return -ENOENT;
1081         }
1082         spin_unlock(&server->srv_lock);
1083
1084         /*
1085          * Wait for all the requests to become available.
1086          * This approach still leaves the possibility to be stuck waiting for
1087          * credits if the server doesn't grant credits to the outstanding
1088          * requests and if the client is completely idle, not generating any
1089          * other requests.
1090          * This can be handled by the eventual session reconnect.
1091          */
1092         rc = wait_for_compound_request(server, num_rqst, flags,
1093                                        &instance);
1094         if (rc)
1095                 return rc;
1096
1097         for (i = 0; i < num_rqst; i++) {
1098                 credits[i].value = 1;
1099                 credits[i].instance = instance;
1100         }
1101
1102         /*
1103          * Make sure that we sign in the same order that we send on this socket
1104          * and avoid races inside tcp sendmsg code that could cause corruption
1105          * of smb data.
1106          */
1107
1108         cifs_server_lock(server);
1109
1110         /*
1111          * All the parts of the compound chain belong obtained credits from the
1112          * same session. We can not use credits obtained from the previous
1113          * session to send this request. Check if there were reconnects after
1114          * we obtained credits and return -EAGAIN in such cases to let callers
1115          * handle it.
1116          */
1117         if (instance != server->reconnect_instance) {
1118                 cifs_server_unlock(server);
1119                 for (j = 0; j < num_rqst; j++)
1120                         add_credits(server, &credits[j], optype);
1121                 return -EAGAIN;
1122         }
1123
1124         for (i = 0; i < num_rqst; i++) {
1125                 midQ[i] = server->ops->setup_request(ses, server, &rqst[i]);
1126                 if (IS_ERR(midQ[i])) {
1127                         revert_current_mid(server, i);
1128                         for (j = 0; j < i; j++)
1129                                 delete_mid(midQ[j]);
1130                         cifs_server_unlock(server);
1131
1132                         /* Update # of requests on wire to server */
1133                         for (j = 0; j < num_rqst; j++)
1134                                 add_credits(server, &credits[j], optype);
1135                         return PTR_ERR(midQ[i]);
1136                 }
1137
1138                 midQ[i]->mid_state = MID_REQUEST_SUBMITTED;
1139                 midQ[i]->optype = optype;
1140                 /*
1141                  * Invoke callback for every part of the compound chain
1142                  * to calculate credits properly. Wake up this thread only when
1143                  * the last element is received.
1144                  */
1145                 if (i < num_rqst - 1)
1146                         midQ[i]->callback = cifs_compound_callback;
1147                 else
1148                         midQ[i]->callback = cifs_compound_last_callback;
1149         }
1150         rc = smb_send_rqst(server, num_rqst, rqst, flags);
1151
1152         for (i = 0; i < num_rqst; i++)
1153                 cifs_save_when_sent(midQ[i]);
1154
1155         if (rc < 0) {
1156                 revert_current_mid(server, num_rqst);
1157                 server->sequence_number -= 2;
1158         }
1159
1160         cifs_server_unlock(server);
1161
1162         /*
1163          * If sending failed for some reason or it is an oplock break that we
1164          * will not receive a response to - return credits back
1165          */
1166         if (rc < 0 || (flags & CIFS_NO_SRV_RSP)) {
1167                 for (i = 0; i < num_rqst; i++)
1168                         add_credits(server, &credits[i], optype);
1169                 goto out;
1170         }
1171
1172         /*
1173          * At this point the request is passed to the network stack - we assume
1174          * that any credits taken from the server structure on the client have
1175          * been spent and we can't return them back. Once we receive responses
1176          * we will collect credits granted by the server in the mid callbacks
1177          * and add those credits to the server structure.
1178          */
1179
1180         /*
1181          * Compounding is never used during session establish.
1182          */
1183         spin_lock(&ses->ses_lock);
1184         if ((ses->ses_status == SES_NEW) || (optype & CIFS_NEG_OP) || (optype & CIFS_SESS_OP)) {
1185                 spin_unlock(&ses->ses_lock);
1186
1187                 cifs_server_lock(server);
1188                 smb311_update_preauth_hash(ses, server, rqst[0].rq_iov, rqst[0].rq_nvec);
1189                 cifs_server_unlock(server);
1190
1191                 spin_lock(&ses->ses_lock);
1192         }
1193         spin_unlock(&ses->ses_lock);
1194
1195         for (i = 0; i < num_rqst; i++) {
1196                 rc = wait_for_response(server, midQ[i]);
1197                 if (rc != 0)
1198                         break;
1199         }
1200         if (rc != 0) {
1201                 for (; i < num_rqst; i++) {
1202                         cifs_server_dbg(FYI, "Cancelling wait for mid %llu cmd: %d\n",
1203                                  midQ[i]->mid, le16_to_cpu(midQ[i]->command));
1204                         send_cancel(server, &rqst[i], midQ[i]);
1205                         spin_lock(&server->mid_lock);
1206                         midQ[i]->mid_flags |= MID_WAIT_CANCELLED;
1207                         if (midQ[i]->mid_state == MID_REQUEST_SUBMITTED) {
1208                                 midQ[i]->callback = cifs_cancelled_callback;
1209                                 cancelled_mid[i] = true;
1210                                 credits[i].value = 0;
1211                         }
1212                         spin_unlock(&server->mid_lock);
1213                 }
1214         }
1215
1216         for (i = 0; i < num_rqst; i++) {
1217                 if (rc < 0)
1218                         goto out;
1219
1220                 rc = cifs_sync_mid_result(midQ[i], server);
1221                 if (rc != 0) {
1222                         /* mark this mid as cancelled to not free it below */
1223                         cancelled_mid[i] = true;
1224                         goto out;
1225                 }
1226
1227                 if (!midQ[i]->resp_buf ||
1228                     midQ[i]->mid_state != MID_RESPONSE_RECEIVED) {
1229                         rc = -EIO;
1230                         cifs_dbg(FYI, "Bad MID state?\n");
1231                         goto out;
1232                 }
1233
1234                 buf = (char *)midQ[i]->resp_buf;
1235                 resp_iov[i].iov_base = buf;
1236                 resp_iov[i].iov_len = midQ[i]->resp_buf_size +
1237                         HEADER_PREAMBLE_SIZE(server);
1238
1239                 if (midQ[i]->large_buf)
1240                         resp_buf_type[i] = CIFS_LARGE_BUFFER;
1241                 else
1242                         resp_buf_type[i] = CIFS_SMALL_BUFFER;
1243
1244                 rc = server->ops->check_receive(midQ[i], server,
1245                                                      flags & CIFS_LOG_ERROR);
1246
1247                 /* mark it so buf will not be freed by delete_mid */
1248                 if ((flags & CIFS_NO_RSP_BUF) == 0)
1249                         midQ[i]->resp_buf = NULL;
1250
1251         }
1252
1253         /*
1254          * Compounding is never used during session establish.
1255          */
1256         spin_lock(&ses->ses_lock);
1257         if ((ses->ses_status == SES_NEW) || (optype & CIFS_NEG_OP) || (optype & CIFS_SESS_OP)) {
1258                 struct kvec iov = {
1259                         .iov_base = resp_iov[0].iov_base,
1260                         .iov_len = resp_iov[0].iov_len
1261                 };
1262                 spin_unlock(&ses->ses_lock);
1263                 cifs_server_lock(server);
1264                 smb311_update_preauth_hash(ses, server, &iov, 1);
1265                 cifs_server_unlock(server);
1266                 spin_lock(&ses->ses_lock);
1267         }
1268         spin_unlock(&ses->ses_lock);
1269
1270 out:
1271         /*
1272          * This will dequeue all mids. After this it is important that the
1273          * demultiplex_thread will not process any of these mids any futher.
1274          * This is prevented above by using a noop callback that will not
1275          * wake this thread except for the very last PDU.
1276          */
1277         for (i = 0; i < num_rqst; i++) {
1278                 if (!cancelled_mid[i])
1279                         delete_mid(midQ[i]);
1280         }
1281
1282         return rc;
1283 }
1284
1285 int
1286 cifs_send_recv(const unsigned int xid, struct cifs_ses *ses,
1287                struct TCP_Server_Info *server,
1288                struct smb_rqst *rqst, int *resp_buf_type, const int flags,
1289                struct kvec *resp_iov)
1290 {
1291         return compound_send_recv(xid, ses, server, flags, 1,
1292                                   rqst, resp_buf_type, resp_iov);
1293 }
1294
1295 int
1296 SendReceive2(const unsigned int xid, struct cifs_ses *ses,
1297              struct kvec *iov, int n_vec, int *resp_buf_type /* ret */,
1298              const int flags, struct kvec *resp_iov)
1299 {
1300         struct smb_rqst rqst;
1301         struct kvec s_iov[CIFS_MAX_IOV_SIZE], *new_iov;
1302         int rc;
1303
1304         if (n_vec + 1 > CIFS_MAX_IOV_SIZE) {
1305                 new_iov = kmalloc_array(n_vec + 1, sizeof(struct kvec),
1306                                         GFP_KERNEL);
1307                 if (!new_iov) {
1308                         /* otherwise cifs_send_recv below sets resp_buf_type */
1309                         *resp_buf_type = CIFS_NO_BUFFER;
1310                         return -ENOMEM;
1311                 }
1312         } else
1313                 new_iov = s_iov;
1314
1315         /* 1st iov is a RFC1001 length followed by the rest of the packet */
1316         memcpy(new_iov + 1, iov, (sizeof(struct kvec) * n_vec));
1317
1318         new_iov[0].iov_base = new_iov[1].iov_base;
1319         new_iov[0].iov_len = 4;
1320         new_iov[1].iov_base += 4;
1321         new_iov[1].iov_len -= 4;
1322
1323         memset(&rqst, 0, sizeof(struct smb_rqst));
1324         rqst.rq_iov = new_iov;
1325         rqst.rq_nvec = n_vec + 1;
1326
1327         rc = cifs_send_recv(xid, ses, ses->server,
1328                             &rqst, resp_buf_type, flags, resp_iov);
1329         if (n_vec + 1 > CIFS_MAX_IOV_SIZE)
1330                 kfree(new_iov);
1331         return rc;
1332 }
1333
1334 int
1335 SendReceive(const unsigned int xid, struct cifs_ses *ses,
1336             struct smb_hdr *in_buf, struct smb_hdr *out_buf,
1337             int *pbytes_returned, const int flags)
1338 {
1339         int rc = 0;
1340         struct mid_q_entry *midQ;
1341         unsigned int len = be32_to_cpu(in_buf->smb_buf_length);
1342         struct kvec iov = { .iov_base = in_buf, .iov_len = len };
1343         struct smb_rqst rqst = { .rq_iov = &iov, .rq_nvec = 1 };
1344         struct cifs_credits credits = { .value = 1, .instance = 0 };
1345         struct TCP_Server_Info *server;
1346
1347         if (ses == NULL) {
1348                 cifs_dbg(VFS, "Null smb session\n");
1349                 return -EIO;
1350         }
1351         server = ses->server;
1352         if (server == NULL) {
1353                 cifs_dbg(VFS, "Null tcp session\n");
1354                 return -EIO;
1355         }
1356
1357         spin_lock(&server->srv_lock);
1358         if (server->tcpStatus == CifsExiting) {
1359                 spin_unlock(&server->srv_lock);
1360                 return -ENOENT;
1361         }
1362         spin_unlock(&server->srv_lock);
1363
1364         /* Ensure that we do not send more than 50 overlapping requests
1365            to the same server. We may make this configurable later or
1366            use ses->maxReq */
1367
1368         if (len > CIFSMaxBufSize + MAX_CIFS_HDR_SIZE - 4) {
1369                 cifs_server_dbg(VFS, "Invalid length, greater than maximum frame, %d\n",
1370                                 len);
1371                 return -EIO;
1372         }
1373
1374         rc = wait_for_free_request(server, flags, &credits.instance);
1375         if (rc)
1376                 return rc;
1377
1378         /* make sure that we sign in the same order that we send on this socket
1379            and avoid races inside tcp sendmsg code that could cause corruption
1380            of smb data */
1381
1382         cifs_server_lock(server);
1383
1384         rc = allocate_mid(ses, in_buf, &midQ);
1385         if (rc) {
1386                 cifs_server_unlock(server);
1387                 /* Update # of requests on wire to server */
1388                 add_credits(server, &credits, 0);
1389                 return rc;
1390         }
1391
1392         rc = cifs_sign_smb(in_buf, server, &midQ->sequence_number);
1393         if (rc) {
1394                 cifs_server_unlock(server);
1395                 goto out;
1396         }
1397
1398         midQ->mid_state = MID_REQUEST_SUBMITTED;
1399
1400         rc = smb_send(server, in_buf, len);
1401         cifs_save_when_sent(midQ);
1402
1403         if (rc < 0)
1404                 server->sequence_number -= 2;
1405
1406         cifs_server_unlock(server);
1407
1408         if (rc < 0)
1409                 goto out;
1410
1411         rc = wait_for_response(server, midQ);
1412         if (rc != 0) {
1413                 send_cancel(server, &rqst, midQ);
1414                 spin_lock(&server->mid_lock);
1415                 if (midQ->mid_state == MID_REQUEST_SUBMITTED) {
1416                         /* no longer considered to be "in-flight" */
1417                         midQ->callback = release_mid;
1418                         spin_unlock(&server->mid_lock);
1419                         add_credits(server, &credits, 0);
1420                         return rc;
1421                 }
1422                 spin_unlock(&server->mid_lock);
1423         }
1424
1425         rc = cifs_sync_mid_result(midQ, server);
1426         if (rc != 0) {
1427                 add_credits(server, &credits, 0);
1428                 return rc;
1429         }
1430
1431         if (!midQ->resp_buf || !out_buf ||
1432             midQ->mid_state != MID_RESPONSE_RECEIVED) {
1433                 rc = -EIO;
1434                 cifs_server_dbg(VFS, "Bad MID state?\n");
1435                 goto out;
1436         }
1437
1438         *pbytes_returned = get_rfc1002_length(midQ->resp_buf);
1439         memcpy(out_buf, midQ->resp_buf, *pbytes_returned + 4);
1440         rc = cifs_check_receive(midQ, server, 0);
1441 out:
1442         delete_mid(midQ);
1443         add_credits(server, &credits, 0);
1444
1445         return rc;
1446 }
1447
1448 /* We send a LOCKINGX_CANCEL_LOCK to cause the Windows
1449    blocking lock to return. */
1450
1451 static int
1452 send_lock_cancel(const unsigned int xid, struct cifs_tcon *tcon,
1453                         struct smb_hdr *in_buf,
1454                         struct smb_hdr *out_buf)
1455 {
1456         int bytes_returned;
1457         struct cifs_ses *ses = tcon->ses;
1458         LOCK_REQ *pSMB = (LOCK_REQ *)in_buf;
1459
1460         /* We just modify the current in_buf to change
1461            the type of lock from LOCKING_ANDX_SHARED_LOCK
1462            or LOCKING_ANDX_EXCLUSIVE_LOCK to
1463            LOCKING_ANDX_CANCEL_LOCK. */
1464
1465         pSMB->LockType = LOCKING_ANDX_CANCEL_LOCK|LOCKING_ANDX_LARGE_FILES;
1466         pSMB->Timeout = 0;
1467         pSMB->hdr.Mid = get_next_mid(ses->server);
1468
1469         return SendReceive(xid, ses, in_buf, out_buf,
1470                         &bytes_returned, 0);
1471 }
1472
1473 int
1474 SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon,
1475             struct smb_hdr *in_buf, struct smb_hdr *out_buf,
1476             int *pbytes_returned)
1477 {
1478         int rc = 0;
1479         int rstart = 0;
1480         struct mid_q_entry *midQ;
1481         struct cifs_ses *ses;
1482         unsigned int len = be32_to_cpu(in_buf->smb_buf_length);
1483         struct kvec iov = { .iov_base = in_buf, .iov_len = len };
1484         struct smb_rqst rqst = { .rq_iov = &iov, .rq_nvec = 1 };
1485         unsigned int instance;
1486         struct TCP_Server_Info *server;
1487
1488         if (tcon == NULL || tcon->ses == NULL) {
1489                 cifs_dbg(VFS, "Null smb session\n");
1490                 return -EIO;
1491         }
1492         ses = tcon->ses;
1493         server = ses->server;
1494
1495         if (server == NULL) {
1496                 cifs_dbg(VFS, "Null tcp session\n");
1497                 return -EIO;
1498         }
1499
1500         spin_lock(&server->srv_lock);
1501         if (server->tcpStatus == CifsExiting) {
1502                 spin_unlock(&server->srv_lock);
1503                 return -ENOENT;
1504         }
1505         spin_unlock(&server->srv_lock);
1506
1507         /* Ensure that we do not send more than 50 overlapping requests
1508            to the same server. We may make this configurable later or
1509            use ses->maxReq */
1510
1511         if (len > CIFSMaxBufSize + MAX_CIFS_HDR_SIZE - 4) {
1512                 cifs_tcon_dbg(VFS, "Invalid length, greater than maximum frame, %d\n",
1513                               len);
1514                 return -EIO;
1515         }
1516
1517         rc = wait_for_free_request(server, CIFS_BLOCKING_OP, &instance);
1518         if (rc)
1519                 return rc;
1520
1521         /* make sure that we sign in the same order that we send on this socket
1522            and avoid races inside tcp sendmsg code that could cause corruption
1523            of smb data */
1524
1525         cifs_server_lock(server);
1526
1527         rc = allocate_mid(ses, in_buf, &midQ);
1528         if (rc) {
1529                 cifs_server_unlock(server);
1530                 return rc;
1531         }
1532
1533         rc = cifs_sign_smb(in_buf, server, &midQ->sequence_number);
1534         if (rc) {
1535                 delete_mid(midQ);
1536                 cifs_server_unlock(server);
1537                 return rc;
1538         }
1539
1540         midQ->mid_state = MID_REQUEST_SUBMITTED;
1541         rc = smb_send(server, in_buf, len);
1542         cifs_save_when_sent(midQ);
1543
1544         if (rc < 0)
1545                 server->sequence_number -= 2;
1546
1547         cifs_server_unlock(server);
1548
1549         if (rc < 0) {
1550                 delete_mid(midQ);
1551                 return rc;
1552         }
1553
1554         /* Wait for a reply - allow signals to interrupt. */
1555         rc = wait_event_interruptible(server->response_q,
1556                 (!(midQ->mid_state == MID_REQUEST_SUBMITTED)) ||
1557                 ((server->tcpStatus != CifsGood) &&
1558                  (server->tcpStatus != CifsNew)));
1559
1560         /* Were we interrupted by a signal ? */
1561         spin_lock(&server->srv_lock);
1562         if ((rc == -ERESTARTSYS) &&
1563                 (midQ->mid_state == MID_REQUEST_SUBMITTED) &&
1564                 ((server->tcpStatus == CifsGood) ||
1565                  (server->tcpStatus == CifsNew))) {
1566                 spin_unlock(&server->srv_lock);
1567
1568                 if (in_buf->Command == SMB_COM_TRANSACTION2) {
1569                         /* POSIX lock. We send a NT_CANCEL SMB to cause the
1570                            blocking lock to return. */
1571                         rc = send_cancel(server, &rqst, midQ);
1572                         if (rc) {
1573                                 delete_mid(midQ);
1574                                 return rc;
1575                         }
1576                 } else {
1577                         /* Windows lock. We send a LOCKINGX_CANCEL_LOCK
1578                            to cause the blocking lock to return. */
1579
1580                         rc = send_lock_cancel(xid, tcon, in_buf, out_buf);
1581
1582                         /* If we get -ENOLCK back the lock may have
1583                            already been removed. Don't exit in this case. */
1584                         if (rc && rc != -ENOLCK) {
1585                                 delete_mid(midQ);
1586                                 return rc;
1587                         }
1588                 }
1589
1590                 rc = wait_for_response(server, midQ);
1591                 if (rc) {
1592                         send_cancel(server, &rqst, midQ);
1593                         spin_lock(&server->mid_lock);
1594                         if (midQ->mid_state == MID_REQUEST_SUBMITTED) {
1595                                 /* no longer considered to be "in-flight" */
1596                                 midQ->callback = release_mid;
1597                                 spin_unlock(&server->mid_lock);
1598                                 return rc;
1599                         }
1600                         spin_unlock(&server->mid_lock);
1601                 }
1602
1603                 /* We got the response - restart system call. */
1604                 rstart = 1;
1605                 spin_lock(&server->srv_lock);
1606         }
1607         spin_unlock(&server->srv_lock);
1608
1609         rc = cifs_sync_mid_result(midQ, server);
1610         if (rc != 0)
1611                 return rc;
1612
1613         /* rcvd frame is ok */
1614         if (out_buf == NULL || midQ->mid_state != MID_RESPONSE_RECEIVED) {
1615                 rc = -EIO;
1616                 cifs_tcon_dbg(VFS, "Bad MID state?\n");
1617                 goto out;
1618         }
1619
1620         *pbytes_returned = get_rfc1002_length(midQ->resp_buf);
1621         memcpy(out_buf, midQ->resp_buf, *pbytes_returned + 4);
1622         rc = cifs_check_receive(midQ, server, 0);
1623 out:
1624         delete_mid(midQ);
1625         if (rstart && rc == -EACCES)
1626                 return -ERESTARTSYS;
1627         return rc;
1628 }
1629
1630 /*
1631  * Discard any remaining data in the current SMB. To do this, we borrow the
1632  * current bigbuf.
1633  */
1634 int
1635 cifs_discard_remaining_data(struct TCP_Server_Info *server)
1636 {
1637         unsigned int rfclen = server->pdu_size;
1638         size_t remaining = rfclen + HEADER_PREAMBLE_SIZE(server) -
1639                 server->total_read;
1640
1641         while (remaining > 0) {
1642                 ssize_t length;
1643
1644                 length = cifs_discard_from_socket(server,
1645                                 min_t(size_t, remaining,
1646                                       CIFSMaxBufSize + MAX_HEADER_SIZE(server)));
1647                 if (length < 0)
1648                         return length;
1649                 server->total_read += length;
1650                 remaining -= length;
1651         }
1652
1653         return 0;
1654 }
1655
1656 static int
1657 __cifs_readv_discard(struct TCP_Server_Info *server, struct mid_q_entry *mid,
1658                      bool malformed)
1659 {
1660         int length;
1661
1662         length = cifs_discard_remaining_data(server);
1663         dequeue_mid(mid, malformed);
1664         mid->resp_buf = server->smallbuf;
1665         server->smallbuf = NULL;
1666         return length;
1667 }
1668
1669 static int
1670 cifs_readv_discard(struct TCP_Server_Info *server, struct mid_q_entry *mid)
1671 {
1672         struct cifs_readdata *rdata = mid->callback_data;
1673
1674         return  __cifs_readv_discard(server, mid, rdata->result);
1675 }
1676
1677 int
1678 cifs_readv_receive(struct TCP_Server_Info *server, struct mid_q_entry *mid)
1679 {
1680         int length, len;
1681         unsigned int data_offset, data_len;
1682         struct cifs_readdata *rdata = mid->callback_data;
1683         char *buf = server->smallbuf;
1684         unsigned int buflen = server->pdu_size + HEADER_PREAMBLE_SIZE(server);
1685         bool use_rdma_mr = false;
1686
1687         cifs_dbg(FYI, "%s: mid=%llu offset=%llu bytes=%u\n",
1688                  __func__, mid->mid, rdata->offset, rdata->bytes);
1689
1690         /*
1691          * read the rest of READ_RSP header (sans Data array), or whatever we
1692          * can if there's not enough data. At this point, we've read down to
1693          * the Mid.
1694          */
1695         len = min_t(unsigned int, buflen, server->vals->read_rsp_size) -
1696                                                         HEADER_SIZE(server) + 1;
1697
1698         length = cifs_read_from_socket(server,
1699                                        buf + HEADER_SIZE(server) - 1, len);
1700         if (length < 0)
1701                 return length;
1702         server->total_read += length;
1703
1704         if (server->ops->is_session_expired &&
1705             server->ops->is_session_expired(buf)) {
1706                 cifs_reconnect(server, true);
1707                 return -1;
1708         }
1709
1710         if (server->ops->is_status_pending &&
1711             server->ops->is_status_pending(buf, server)) {
1712                 cifs_discard_remaining_data(server);
1713                 return -1;
1714         }
1715
1716         /* set up first two iov for signature check and to get credits */
1717         rdata->iov[0].iov_base = buf;
1718         rdata->iov[0].iov_len = HEADER_PREAMBLE_SIZE(server);
1719         rdata->iov[1].iov_base = buf + HEADER_PREAMBLE_SIZE(server);
1720         rdata->iov[1].iov_len =
1721                 server->total_read - HEADER_PREAMBLE_SIZE(server);
1722         cifs_dbg(FYI, "0: iov_base=%p iov_len=%zu\n",
1723                  rdata->iov[0].iov_base, rdata->iov[0].iov_len);
1724         cifs_dbg(FYI, "1: iov_base=%p iov_len=%zu\n",
1725                  rdata->iov[1].iov_base, rdata->iov[1].iov_len);
1726
1727         /* Was the SMB read successful? */
1728         rdata->result = server->ops->map_error(buf, false);
1729         if (rdata->result != 0) {
1730                 cifs_dbg(FYI, "%s: server returned error %d\n",
1731                          __func__, rdata->result);
1732                 /* normal error on read response */
1733                 return __cifs_readv_discard(server, mid, false);
1734         }
1735
1736         /* Is there enough to get to the rest of the READ_RSP header? */
1737         if (server->total_read < server->vals->read_rsp_size) {
1738                 cifs_dbg(FYI, "%s: server returned short header. got=%u expected=%zu\n",
1739                          __func__, server->total_read,
1740                          server->vals->read_rsp_size);
1741                 rdata->result = -EIO;
1742                 return cifs_readv_discard(server, mid);
1743         }
1744
1745         data_offset = server->ops->read_data_offset(buf) +
1746                 HEADER_PREAMBLE_SIZE(server);
1747         if (data_offset < server->total_read) {
1748                 /*
1749                  * win2k8 sometimes sends an offset of 0 when the read
1750                  * is beyond the EOF. Treat it as if the data starts just after
1751                  * the header.
1752                  */
1753                 cifs_dbg(FYI, "%s: data offset (%u) inside read response header\n",
1754                          __func__, data_offset);
1755                 data_offset = server->total_read;
1756         } else if (data_offset > MAX_CIFS_SMALL_BUFFER_SIZE) {
1757                 /* data_offset is beyond the end of smallbuf */
1758                 cifs_dbg(FYI, "%s: data offset (%u) beyond end of smallbuf\n",
1759                          __func__, data_offset);
1760                 rdata->result = -EIO;
1761                 return cifs_readv_discard(server, mid);
1762         }
1763
1764         cifs_dbg(FYI, "%s: total_read=%u data_offset=%u\n",
1765                  __func__, server->total_read, data_offset);
1766
1767         len = data_offset - server->total_read;
1768         if (len > 0) {
1769                 /* read any junk before data into the rest of smallbuf */
1770                 length = cifs_read_from_socket(server,
1771                                                buf + server->total_read, len);
1772                 if (length < 0)
1773                         return length;
1774                 server->total_read += length;
1775         }
1776
1777         /* how much data is in the response? */
1778 #ifdef CONFIG_CIFS_SMB_DIRECT
1779         use_rdma_mr = rdata->mr;
1780 #endif
1781         data_len = server->ops->read_data_length(buf, use_rdma_mr);
1782         if (!use_rdma_mr && (data_offset + data_len > buflen)) {
1783                 /* data_len is corrupt -- discard frame */
1784                 rdata->result = -EIO;
1785                 return cifs_readv_discard(server, mid);
1786         }
1787
1788 #ifdef CONFIG_CIFS_SMB_DIRECT
1789         if (rdata->mr)
1790                 length = data_len; /* An RDMA read is already done. */
1791         else
1792 #endif
1793                 length = cifs_read_iter_from_socket(server, &rdata->iter,
1794                                                     data_len);
1795         if (length > 0)
1796                 rdata->got_bytes += length;
1797         server->total_read += length;
1798
1799         cifs_dbg(FYI, "total_read=%u buflen=%u remaining=%u\n",
1800                  server->total_read, buflen, data_len);
1801
1802         /* discard anything left over */
1803         if (server->total_read < buflen)
1804                 return cifs_readv_discard(server, mid);
1805
1806         dequeue_mid(mid, false);
1807         mid->resp_buf = server->smallbuf;
1808         server->smallbuf = NULL;
1809         return length;
1810 }