fs/cifs/transport.c

   1 // SPDX-License-Identifier: LGPL-2.1
   2 /*
   3  *
   4  *   Copyright (C) International Business Machines  Corp., 2002,2008
   5  *   Author(s): Steve French (sfrench@us.ibm.com)
   6  *   Jeremy Allison (jra@samba.org) 2006.
   7  *
   8  */
   9
  10 #include <linux/fs.h>
  11 #include <linux/list.h>
  12 #include <linux/gfp.h>
  13 #include <linux/wait.h>
  14 #include <linux/net.h>
  15 #include <linux/delay.h>
  16 #include <linux/freezer.h>
  17 #include <linux/tcp.h>
  18 #include <linux/bvec.h>
  19 #include <linux/highmem.h>
  20 #include <linux/uaccess.h>
  21 #include <asm/processor.h>
  22 #include <linux/mempool.h>
  23 #include <linux/sched/signal.h>
  24 #include <linux/task_io_accounting_ops.h>
  25 #include "cifspdu.h"
  26 #include "cifsglob.h"
  27 #include "cifsproto.h"
  28 #include "cifs_debug.h"
  29 #include "smb2proto.h"
  30 #include "smbdirect.h"
  31
  32 /* Max number of iovectors we can use off the stack when sending requests. */
  33 #define CIFS_MAX_IOV_SIZE 8
  34
  35 void
  36 cifs_wake_up_task(struct mid_q_entry *mid)
  37 {
  38         wake_up_process(mid->callback_data);
  39 }
  40
  41 static struct mid_q_entry *
  42 alloc_mid(const struct smb_hdr *smb_buffer, struct TCP_Server_Info *server)
  43 {
  44         struct mid_q_entry *temp;
  45
  46         if (server == NULL) {
  47                 cifs_dbg(VFS, "%s: null TCP session\n", __func__);
  48                 return NULL;
  49         }
  50
  51         temp = mempool_alloc(cifs_mid_poolp, GFP_NOFS);
  52         memset(temp, 0, sizeof(struct mid_q_entry));
  53         kref_init(&temp->refcount);
  54         temp->mid = get_mid(smb_buffer);
  55         temp->pid = current->pid;
  56         temp->command = cpu_to_le16(smb_buffer->Command);
  57         cifs_dbg(FYI, "For smb_command %d\n", smb_buffer->Command);
  58         /*      do_gettimeofday(&temp->when_sent);*/ /* easier to use jiffies */
  59         /* when mid allocated can be before when sent */
  60         temp->when_alloc = jiffies;
  61         temp->server = server;
  62
  63         /*
  64          * The default is for the mid to be synchronous, so the
  65          * default callback just wakes up the current task.
  66          */
  67         get_task_struct(current);
  68         temp->creator = current;
  69         temp->callback = cifs_wake_up_task;
  70         temp->callback_data = current;
  71
  72         atomic_inc(&mid_count);
  73         temp->mid_state = MID_REQUEST_ALLOCATED;
  74         return temp;
  75 }
  76
  77 static void __release_mid(struct kref *refcount)
  78 {
  79         struct mid_q_entry *midEntry =
  80                         container_of(refcount, struct mid_q_entry, refcount);
  81 #ifdef CONFIG_CIFS_STATS2
  82         __le16 command = midEntry->server->vals->lock_cmd;
  83         __u16 smb_cmd = le16_to_cpu(midEntry->command);
  84         unsigned long now;
  85         unsigned long roundtrip_time;
  86 #endif
  87         struct TCP_Server_Info *server = midEntry->server;
  88
  89         if (midEntry->resp_buf && (midEntry->mid_flags & MID_WAIT_CANCELLED) &&
  90             midEntry->mid_state == MID_RESPONSE_RECEIVED &&
  91             server->ops->handle_cancelled_mid)
  92                 server->ops->handle_cancelled_mid(midEntry, server);
  93
  94         midEntry->mid_state = MID_FREE;
  95         atomic_dec(&mid_count);
  96         if (midEntry->large_buf)
  97                 cifs_buf_release(midEntry->resp_buf);
  98         else
  99                 cifs_small_buf_release(midEntry->resp_buf);
 100 #ifdef CONFIG_CIFS_STATS2
 101         now = jiffies;
 102         if (now < midEntry->when_alloc)
 103                 cifs_server_dbg(VFS, "Invalid mid allocation time\n");
 104         roundtrip_time = now - midEntry->when_alloc;
 105
 106         if (smb_cmd < NUMBER_OF_SMB2_COMMANDS) {
 107                 if (atomic_read(&server->num_cmds[smb_cmd]) == 0) {
 108                         server->slowest_cmd[smb_cmd] = roundtrip_time;
 109                         server->fastest_cmd[smb_cmd] = roundtrip_time;
 110                 } else {
 111                         if (server->slowest_cmd[smb_cmd] < roundtrip_time)
 112                                 server->slowest_cmd[smb_cmd] = roundtrip_time;
 113                         else if (server->fastest_cmd[smb_cmd] > roundtrip_time)
 114                                 server->fastest_cmd[smb_cmd] = roundtrip_time;
 115                 }
 116                 cifs_stats_inc(&server->num_cmds[smb_cmd]);
 117                 server->time_per_cmd[smb_cmd] += roundtrip_time;
 118         }
 119         /*
 120          * commands taking longer than one second (default) can be indications
 121          * that something is wrong, unless it is quite a slow link or a very
 122          * busy server. Note that this calc is unlikely or impossible to wrap
 123          * as long as slow_rsp_threshold is not set way above recommended max
 124          * value (32767 ie 9 hours) and is generally harmless even if wrong
 125          * since only affects debug counters - so leaving the calc as simple
 126          * comparison rather than doing multiple conversions and overflow
 127          * checks
 128          */
 129         if ((slow_rsp_threshold != 0) &&
 130             time_after(now, midEntry->when_alloc + (slow_rsp_threshold * HZ)) &&
 131             (midEntry->command != command)) {
 132                 /*
 133                  * smb2slowcmd[NUMBER_OF_SMB2_COMMANDS] counts by command
 134                  * NB: le16_to_cpu returns unsigned so can not be negative below
 135                  */
 136                 if (smb_cmd < NUMBER_OF_SMB2_COMMANDS)
 137                         cifs_stats_inc(&server->smb2slowcmd[smb_cmd]);
 138
 139                 trace_smb3_slow_rsp(smb_cmd, midEntry->mid, midEntry->pid,
 140                                midEntry->when_sent, midEntry->when_received);
 141                 if (cifsFYI & CIFS_TIMER) {
 142                         pr_debug("slow rsp: cmd %d mid %llu",
 143                                  midEntry->command, midEntry->mid);
 144                         cifs_info("A: 0x%lx S: 0x%lx R: 0x%lx\n",
 145                                   now - midEntry->when_alloc,
 146                                   now - midEntry->when_sent,
 147                                   now - midEntry->when_received);
 148                 }
 149         }
 150 #endif
 151         put_task_struct(midEntry->creator);
 152
 153         mempool_free(midEntry, cifs_mid_poolp);
 154 }
 155
 156 void release_mid(struct mid_q_entry *mid)
 157 {
 158         struct TCP_Server_Info *server = mid->server;
 159
 160         spin_lock(&server->mid_lock);
 161         kref_put(&mid->refcount, __release_mid);
 162         spin_unlock(&server->mid_lock);
 163 }
 164
 165 void
 166 delete_mid(struct mid_q_entry *mid)
 167 {
 168         spin_lock(&mid->server->mid_lock);
 169         if (!(mid->mid_flags & MID_DELETED)) {
 170                 list_del_init(&mid->qhead);
 171                 mid->mid_flags |= MID_DELETED;
 172         }
 173         spin_unlock(&mid->server->mid_lock);
 174
 175         release_mid(mid);
 176 }
 177
 178 /*
 179  * smb_send_kvec - send an array of kvecs to the server
 180  * @server:     Server to send the data to
 181  * @smb_msg:    Message to send
 182  * @sent:       amount of data sent on socket is stored here
 183  *
 184  * Our basic "send data to server" function. Should be called with srv_mutex
 185  * held. The caller is responsible for handling the results.
 186  */
 187 static int
 188 smb_send_kvec(struct TCP_Server_Info *server, struct msghdr *smb_msg,
 189               size_t *sent)
 190 {
 191         int rc = 0;
 192         int retries = 0;
 193         struct socket *ssocket = server->ssocket;
 194
 195         *sent = 0;
 196
 197         smb_msg->msg_name = (struct sockaddr *) &server->dstaddr;
 198         smb_msg->msg_namelen = sizeof(struct sockaddr);
 199         smb_msg->msg_control = NULL;
 200         smb_msg->msg_controllen = 0;
 201         if (server->noblocksnd)
 202                 smb_msg->msg_flags = MSG_DONTWAIT + MSG_NOSIGNAL;
 203         else
 204                 smb_msg->msg_flags = MSG_NOSIGNAL;
 205
 206         while (msg_data_left(smb_msg)) {
 207                 /*
 208                  * If blocking send, we try 3 times, since each can block
 209                  * for 5 seconds. For nonblocking  we have to try more
 210                  * but wait increasing amounts of time allowing time for
 211                  * socket to clear.  The overall time we wait in either
 212                  * case to send on the socket is about 15 seconds.
 213                  * Similarly we wait for 15 seconds for a response from
 214                  * the server in SendReceive[2] for the server to send
 215                  * a response back for most types of requests (except
 216                  * SMB Write past end of file which can be slow, and
 217                  * blocking lock operations). NFS waits slightly longer
 218                  * than CIFS, but this can make it take longer for
 219                  * nonresponsive servers to be detected and 15 seconds
 220                  * is more than enough time for modern networks to
 221                  * send a packet.  In most cases if we fail to send
 222                  * after the retries we will kill the socket and
 223                  * reconnect which may clear the network problem.
 224                  */
 225                 rc = sock_sendmsg(ssocket, smb_msg);
 226                 if (rc == -EAGAIN) {
 227                         retries++;
 228                         if (retries >= 14 ||
 229                             (!server->noblocksnd && (retries > 2))) {
 230                                 cifs_server_dbg(VFS, "sends on sock %p stuck for 15 seconds\n",
 231                                          ssocket);
 232                                 return -EAGAIN;
 233                         }
 234                         msleep(1 << retries);
 235                         continue;
 236                 }
 237
 238                 if (rc < 0)
 239                         return rc;
 240
 241                 if (rc == 0) {
 242                         /* should never happen, letting socket clear before
 243                            retrying is our only obvious option here */
 244                         cifs_server_dbg(VFS, "tcp sent no data\n");
 245                         msleep(500);
 246                         continue;
 247                 }
 248
 249                 /* send was at least partially successful */
 250                 *sent += rc;
 251                 retries = 0; /* in case we get ENOSPC on the next send */
 252         }
 253         return 0;
 254 }
 255
 256 unsigned long
 257 smb_rqst_len(struct TCP_Server_Info *server, struct smb_rqst *rqst)
 258 {
 259         unsigned int i;
 260         struct kvec *iov;
 261         int nvec;
 262         unsigned long buflen = 0;
 263
 264         if (server->vals->header_preamble_size == 0 &&
 265             rqst->rq_nvec >= 2 && rqst->rq_iov[0].iov_len == 4) {
 266                 iov = &rqst->rq_iov[1];
 267                 nvec = rqst->rq_nvec - 1;
 268         } else {
 269                 iov = rqst->rq_iov;
 270                 nvec = rqst->rq_nvec;
 271         }
 272
 273         /* total up iov array first */
 274         for (i = 0; i < nvec; i++)
 275                 buflen += iov[i].iov_len;
 276
 277         /*
 278          * Add in the page array if there is one. The caller needs to make
 279          * sure rq_offset and rq_tailsz are set correctly. If a buffer of
 280          * multiple pages ends at page boundary, rq_tailsz needs to be set to
 281          * PAGE_SIZE.
 282          */
 283         if (rqst->rq_npages) {
 284                 if (rqst->rq_npages == 1)
 285                         buflen += rqst->rq_tailsz;
 286                 else {
 287                         /*
 288                          * If there is more than one page, calculate the
 289                          * buffer length based on rq_offset and rq_tailsz
 290                          */
 291                         buflen += rqst->rq_pagesz * (rqst->rq_npages - 1) -
 292                                         rqst->rq_offset;
 293                         buflen += rqst->rq_tailsz;
 294                 }
 295         }
 296
 297         return buflen;
 298 }
 299
 300 static int
 301 __smb_send_rqst(struct TCP_Server_Info *server, int num_rqst,
 302                 struct smb_rqst *rqst)
 303 {
 304         int rc = 0;
 305         struct kvec *iov;
 306         int n_vec;
 307         unsigned int send_length = 0;
 308         unsigned int i, j;
 309         sigset_t mask, oldmask;
 310         size_t total_len = 0, sent, size;
 311         struct socket *ssocket = server->ssocket;
 312         struct msghdr smb_msg;
 313         __be32 rfc1002_marker;
 314
 315         if (cifs_rdma_enabled(server)) {
 316                 /* return -EAGAIN when connecting or reconnecting */
 317                 rc = -EAGAIN;
 318                 if (server->smbd_conn)
 319                         rc = smbd_send(server, num_rqst, rqst);
 320                 goto smbd_done;
 321         }
 322
 323         if (ssocket == NULL)
 324                 return -EAGAIN;
 325
 326         if (fatal_signal_pending(current)) {
 327                 cifs_dbg(FYI, "signal pending before send request\n");
 328                 return -ERESTARTSYS;
 329         }
 330
 331         /* cork the socket */
 332         tcp_sock_set_cork(ssocket->sk, true);
 333
 334         for (j = 0; j < num_rqst; j++)
 335                 send_length += smb_rqst_len(server, &rqst[j]);
 336         rfc1002_marker = cpu_to_be32(send_length);
 337
 338         /*
 339          * We should not allow signals to interrupt the network send because
 340          * any partial send will cause session reconnects thus increasing
 341          * latency of system calls and overload a server with unnecessary
 342          * requests.
 343          */
 344
 345         sigfillset(&mask);
 346         sigprocmask(SIG_BLOCK, &mask, &oldmask);
 347
 348         /* Generate a rfc1002 marker for SMB2+ */
 349         if (server->vals->header_preamble_size == 0) {
 350                 struct kvec hiov = {
 351                         .iov_base = &rfc1002_marker,
 352                         .iov_len  = 4
 353                 };
 354                 iov_iter_kvec(&smb_msg.msg_iter, WRITE, &hiov, 1, 4);
 355                 rc = smb_send_kvec(server, &smb_msg, &sent);
 356                 if (rc < 0)
 357                         goto unmask;
 358
 359                 total_len += sent;
 360                 send_length += 4;
 361         }
 362
 363         cifs_dbg(FYI, "Sending smb: smb_len=%u\n", send_length);
 364
 365         for (j = 0; j < num_rqst; j++) {
 366                 iov = rqst[j].rq_iov;
 367                 n_vec = rqst[j].rq_nvec;
 368
 369                 size = 0;
 370                 for (i = 0; i < n_vec; i++) {
 371                         dump_smb(iov[i].iov_base, iov[i].iov_len);
 372                         size += iov[i].iov_len;
 373                 }
 374
 375                 iov_iter_kvec(&smb_msg.msg_iter, WRITE, iov, n_vec, size);
 376
 377                 rc = smb_send_kvec(server, &smb_msg, &sent);
 378                 if (rc < 0)
 379                         goto unmask;
 380
 381                 total_len += sent;
 382
 383                 /* now walk the page array and send each page in it */
 384                 for (i = 0; i < rqst[j].rq_npages; i++) {
 385                         struct bio_vec bvec;
 386
 387                         bvec.bv_page = rqst[j].rq_pages[i];
 388                         rqst_page_get_length(&rqst[j], i, &bvec.bv_len,
 389                                              &bvec.bv_offset);
 390
 391                         iov_iter_bvec(&smb_msg.msg_iter, WRITE,
 392                                       &bvec, 1, bvec.bv_len);
 393                         rc = smb_send_kvec(server, &smb_msg, &sent);
 394                         if (rc < 0)
 395                                 break;
 396
 397                         total_len += sent;
 398                 }
 399         }
 400
 401 unmask:
 402         sigprocmask(SIG_SETMASK, &oldmask, NULL);
 403
 404         /*
 405          * If signal is pending but we have already sent the whole packet to
 406          * the server we need to return success status to allow a corresponding
 407          * mid entry to be kept in the pending requests queue thus allowing
 408          * to handle responses from the server by the client.
 409          *
 410          * If only part of the packet has been sent there is no need to hide
 411          * interrupt because the session will be reconnected anyway, so there
 412          * won't be any response from the server to handle.
 413          */
 414
 415         if (signal_pending(current) && (total_len != send_length)) {
 416                 cifs_dbg(FYI, "signal is pending after attempt to send\n");
 417                 rc = -ERESTARTSYS;
 418         }
 419
 420         /* uncork it */
 421         tcp_sock_set_cork(ssocket->sk, false);
 422
 423         if ((total_len > 0) && (total_len != send_length)) {
 424                 cifs_dbg(FYI, "partial send (wanted=%u sent=%zu): terminating session\n",
 425                          send_length, total_len);
 426                 /*
 427                  * If we have only sent part of an SMB then the next SMB could
 428                  * be taken as the remainder of this one. We need to kill the
 429                  * socket so the server throws away the partial SMB
 430                  */
 431                 cifs_signal_cifsd_for_reconnect(server, false);
 432                 trace_smb3_partial_send_reconnect(server->CurrentMid,
 433                                                   server->conn_id, server->hostname);
 434         }
 435 smbd_done:
 436         if (rc < 0 && rc != -EINTR)
 437                 cifs_server_dbg(VFS, "Error %d sending data on socket to server\n",
 438                          rc);
 439         else if (rc > 0)
 440                 rc = 0;
 441
 442         return rc;
 443 }
 444
 445 static int
 446 smb_send_rqst(struct TCP_Server_Info *server, int num_rqst,
 447               struct smb_rqst *rqst, int flags)
 448 {
 449         struct kvec iov;
 450         struct smb2_transform_hdr *tr_hdr;
 451         struct smb_rqst cur_rqst[MAX_COMPOUND];
 452         int rc;
 453
 454         if (!(flags & CIFS_TRANSFORM_REQ))
 455                 return __smb_send_rqst(server, num_rqst, rqst);
 456
 457         if (num_rqst > MAX_COMPOUND - 1)
 458                 return -ENOMEM;
 459
 460         if (!server->ops->init_transform_rq) {
 461                 cifs_server_dbg(VFS, "Encryption requested but transform callback is missing\n");
 462                 return -EIO;
 463         }
 464
 465         tr_hdr = kzalloc(sizeof(*tr_hdr), GFP_NOFS);
 466         if (!tr_hdr)
 467                 return -ENOMEM;
 468
 469         memset(&cur_rqst[0], 0, sizeof(cur_rqst));
 470         memset(&iov, 0, sizeof(iov));
 471
 472         iov.iov_base = tr_hdr;
 473         iov.iov_len = sizeof(*tr_hdr);
 474         cur_rqst[0].rq_iov = &iov;
 475         cur_rqst[0].rq_nvec = 1;
 476
 477         rc = server->ops->init_transform_rq(server, num_rqst + 1,
 478                                             &cur_rqst[0], rqst);
 479         if (rc)
 480                 goto out;
 481
 482         rc = __smb_send_rqst(server, num_rqst + 1, &cur_rqst[0]);
 483         smb3_free_compound_rqst(num_rqst, &cur_rqst[1]);
 484 out:
 485         kfree(tr_hdr);
 486         return rc;
 487 }
 488
 489 int
 490 smb_send(struct TCP_Server_Info *server, struct smb_hdr *smb_buffer,
 491          unsigned int smb_buf_length)
 492 {
 493         struct kvec iov[2];
 494         struct smb_rqst rqst = { .rq_iov = iov,
 495                                  .rq_nvec = 2 };
 496
 497         iov[0].iov_base = smb_buffer;
 498         iov[0].iov_len = 4;
 499         iov[1].iov_base = (char *)smb_buffer + 4;
 500         iov[1].iov_len = smb_buf_length;
 501
 502         return __smb_send_rqst(server, 1, &rqst);
 503 }
 504
 505 static int
 506 wait_for_free_credits(struct TCP_Server_Info *server, const int num_credits,
 507                       const int timeout, const int flags,
 508                       unsigned int *instance)
 509 {
 510         long rc;
 511         int *credits;
 512         int optype;
 513         long int t;
 514         int scredits, in_flight;
 515
 516         if (timeout < 0)
 517                 t = MAX_JIFFY_OFFSET;
 518         else
 519                 t = msecs_to_jiffies(timeout);
 520
 521         optype = flags & CIFS_OP_MASK;
 522
 523         *instance = 0;
 524
 525         credits = server->ops->get_credits_field(server, optype);
 526         /* Since an echo is already inflight, no need to wait to send another */
 527         if (*credits <= 0 && optype == CIFS_ECHO_OP)
 528                 return -EAGAIN;
 529
 530         spin_lock(&server->req_lock);
 531         if ((flags & CIFS_TIMEOUT_MASK) == CIFS_NON_BLOCKING) {
 532                 /* oplock breaks must not be held up */
 533                 server->in_flight++;
 534                 if (server->in_flight > server->max_in_flight)
 535                         server->max_in_flight = server->in_flight;
 536                 *credits -= 1;
 537                 *instance = server->reconnect_instance;
 538                 scredits = *credits;
 539                 in_flight = server->in_flight;
 540                 spin_unlock(&server->req_lock);
 541
 542                 trace_smb3_nblk_credits(server->CurrentMid,
 543                                 server->conn_id, server->hostname, scredits, -1, in_flight);
 544                 cifs_dbg(FYI, "%s: remove %u credits total=%d\n",
 545                                 __func__, 1, scredits);
 546
 547                 return 0;
 548         }
 549
 550         while (1) {
 551                 if (*credits < num_credits) {
 552                         scredits = *credits;
 553                         spin_unlock(&server->req_lock);
 554
 555                         cifs_num_waiters_inc(server);
 556                         rc = wait_event_killable_timeout(server->request_q,
 557                                 has_credits(server, credits, num_credits), t);
 558                         cifs_num_waiters_dec(server);
 559                         if (!rc) {
 560                                 spin_lock(&server->req_lock);
 561                                 scredits = *credits;
 562                                 in_flight = server->in_flight;
 563                                 spin_unlock(&server->req_lock);
 564
 565                                 trace_smb3_credit_timeout(server->CurrentMid,
 566                                                 server->conn_id, server->hostname, scredits,
 567                                                 num_credits, in_flight);
 568                                 cifs_server_dbg(VFS, "wait timed out after %d ms\n",
 569                                                 timeout);
 570                                 return -EBUSY;
 571                         }
 572                         if (rc == -ERESTARTSYS)
 573                                 return -ERESTARTSYS;
 574                         spin_lock(&server->req_lock);
 575                 } else {
 576                         spin_unlock(&server->req_lock);
 577
 578                         spin_lock(&server->srv_lock);
 579                         if (server->tcpStatus == CifsExiting) {
 580                                 spin_unlock(&server->srv_lock);
 581                                 return -ENOENT;
 582                         }
 583                         spin_unlock(&server->srv_lock);
 584
 585                         /*
 586                          * For normal commands, reserve the last MAX_COMPOUND
 587                          * credits to compound requests.
 588                          * Otherwise these compounds could be permanently
 589                          * starved for credits by single-credit requests.
 590                          *
 591                          * To prevent spinning CPU, block this thread until
 592                          * there are >MAX_COMPOUND credits available.
 593                          * But only do this is we already have a lot of
 594                          * credits in flight to avoid triggering this check
 595                          * for servers that are slow to hand out credits on
 596                          * new sessions.
 597                          */
 598                         spin_lock(&server->req_lock);
 599                         if (!optype && num_credits == 1 &&
 600                             server->in_flight > 2 * MAX_COMPOUND &&
 601                             *credits <= MAX_COMPOUND) {
 602                                 spin_unlock(&server->req_lock);
 603
 604                                 cifs_num_waiters_inc(server);
 605                                 rc = wait_event_killable_timeout(
 606                                         server->request_q,
 607                                         has_credits(server, credits,
 608                                                     MAX_COMPOUND + 1),
 609                                         t);
 610                                 cifs_num_waiters_dec(server);
 611                                 if (!rc) {
 612                                         spin_lock(&server->req_lock);
 613                                         scredits = *credits;
 614                                         in_flight = server->in_flight;
 615                                         spin_unlock(&server->req_lock);
 616
 617                                         trace_smb3_credit_timeout(
 618                                                         server->CurrentMid,
 619                                                         server->conn_id, server->hostname,
 620                                                         scredits, num_credits, in_flight);
 621                                         cifs_server_dbg(VFS, "wait timed out after %d ms\n",
 622                                                         timeout);
 623                                         return -EBUSY;
 624                                 }
 625                                 if (rc == -ERESTARTSYS)
 626                                         return -ERESTARTSYS;
 627                                 spin_lock(&server->req_lock);
 628                                 continue;
 629                         }
 630
 631                         /*
 632                          * Can not count locking commands against total
 633                          * as they are allowed to block on server.
 634                          */
 635
 636                         /* update # of requests on the wire to server */
 637                         if ((flags & CIFS_TIMEOUT_MASK) != CIFS_BLOCKING_OP) {
 638                                 *credits -= num_credits;
 639                                 server->in_flight += num_credits;
 640                                 if (server->in_flight > server->max_in_flight)
 641                                         server->max_in_flight = server->in_flight;
 642                                 *instance = server->reconnect_instance;
 643                         }
 644                         scredits = *credits;
 645                         in_flight = server->in_flight;
 646                         spin_unlock(&server->req_lock);
 647
 648                         trace_smb3_waitff_credits(server->CurrentMid,
 649                                         server->conn_id, server->hostname, scredits,
 650                                         -(num_credits), in_flight);
 651                         cifs_dbg(FYI, "%s: remove %u credits total=%d\n",
 652                                         __func__, num_credits, scredits);
 653                         break;
 654                 }
 655         }
 656         return 0;
 657 }
 658
 659 static int
 660 wait_for_free_request(struct TCP_Server_Info *server, const int flags,
 661                       unsigned int *instance)
 662 {
 663         return wait_for_free_credits(server, 1, -1, flags,
 664                                      instance);
 665 }
 666
 667 static int
 668 wait_for_compound_request(struct TCP_Server_Info *server, int num,
 669                           const int flags, unsigned int *instance)
 670 {
 671         int *credits;
 672         int scredits, in_flight;
 673
 674         credits = server->ops->get_credits_field(server, flags & CIFS_OP_MASK);
 675
 676         spin_lock(&server->req_lock);
 677         scredits = *credits;
 678         in_flight = server->in_flight;
 679
 680         if (*credits < num) {
 681                 /*
 682                  * If the server is tight on resources or just gives us less
 683                  * credits for other reasons (e.g. requests are coming out of
 684                  * order and the server delays granting more credits until it
 685                  * processes a missing mid) and we exhausted most available
 686                  * credits there may be situations when we try to send
 687                  * a compound request but we don't have enough credits. At this
 688                  * point the client needs to decide if it should wait for
 689                  * additional credits or fail the request. If at least one
 690                  * request is in flight there is a high probability that the
 691                  * server will return enough credits to satisfy this compound
 692                  * request.
 693                  *
 694                  * Return immediately if no requests in flight since we will be
 695                  * stuck on waiting for credits.
 696                  */
 697                 if (server->in_flight == 0) {
 698                         spin_unlock(&server->req_lock);
 699                         trace_smb3_insufficient_credits(server->CurrentMid,
 700                                         server->conn_id, server->hostname, scredits,
 701                                         num, in_flight);
 702                         cifs_dbg(FYI, "%s: %d requests in flight, needed %d total=%d\n",
 703                                         __func__, in_flight, num, scredits);
 704                         return -EDEADLK;
 705                 }
 706         }
 707         spin_unlock(&server->req_lock);
 708
 709         return wait_for_free_credits(server, num, 60000, flags,
 710                                      instance);
 711 }
 712
 713 int
 714 cifs_wait_mtu_credits(struct TCP_Server_Info *server, unsigned int size,
 715                       unsigned int *num, struct cifs_credits *credits)
 716 {
 717         *num = size;
 718         credits->value = 0;
 719         credits->instance = server->reconnect_instance;
 720         return 0;
 721 }
 722
 723 static int allocate_mid(struct cifs_ses *ses, struct smb_hdr *in_buf,
 724                         struct mid_q_entry **ppmidQ)
 725 {
 726         spin_lock(&ses->ses_lock);
 727         if (ses->ses_status == SES_NEW) {
 728                 if ((in_buf->Command != SMB_COM_SESSION_SETUP_ANDX) &&
 729                         (in_buf->Command != SMB_COM_NEGOTIATE)) {
 730                         spin_unlock(&ses->ses_lock);
 731                         return -EAGAIN;
 732                 }
 733                 /* else ok - we are setting up session */
 734         }
 735
 736         if (ses->ses_status == SES_EXITING) {
 737                 /* check if SMB session is bad because we are setting it up */
 738                 if (in_buf->Command != SMB_COM_LOGOFF_ANDX) {
 739                         spin_unlock(&ses->ses_lock);
 740                         return -EAGAIN;
 741                 }
 742                 /* else ok - we are shutting down session */
 743         }
 744         spin_unlock(&ses->ses_lock);
 745
 746         *ppmidQ = alloc_mid(in_buf, ses->server);
 747         if (*ppmidQ == NULL)
 748                 return -ENOMEM;
 749         spin_lock(&ses->server->mid_lock);
 750         list_add_tail(&(*ppmidQ)->qhead, &ses->server->pending_mid_q);
 751         spin_unlock(&ses->server->mid_lock);
 752         return 0;
 753 }
 754
 755 static int
 756 wait_for_response(struct TCP_Server_Info *server, struct mid_q_entry *midQ)
 757 {
 758         int error;
 759
 760         error = wait_event_freezekillable_unsafe(server->response_q,
 761                                     midQ->mid_state != MID_REQUEST_SUBMITTED);
 762         if (error < 0)
 763                 return -ERESTARTSYS;
 764
 765         return 0;
 766 }
 767
 768 struct mid_q_entry *
 769 cifs_setup_async_request(struct TCP_Server_Info *server, struct smb_rqst *rqst)
 770 {
 771         int rc;
 772         struct smb_hdr *hdr = (struct smb_hdr *)rqst->rq_iov[0].iov_base;
 773         struct mid_q_entry *mid;
 774
 775         if (rqst->rq_iov[0].iov_len != 4 ||
 776             rqst->rq_iov[0].iov_base + 4 != rqst->rq_iov[1].iov_base)
 777                 return ERR_PTR(-EIO);
 778
 779         /* enable signing if server requires it */
 780         if (server->sign)
 781                 hdr->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
 782
 783         mid = alloc_mid(hdr, server);
 784         if (mid == NULL)
 785                 return ERR_PTR(-ENOMEM);
 786
 787         rc = cifs_sign_rqst(rqst, server, &mid->sequence_number);
 788         if (rc) {
 789                 release_mid(mid);
 790                 return ERR_PTR(rc);
 791         }
 792
 793         return mid;
 794 }
 795
 796 /*
 797  * Send a SMB request and set the callback function in the mid to handle
 798  * the result. Caller is responsible for dealing with timeouts.
 799  */
 800 int
 801 cifs_call_async(struct TCP_Server_Info *server, struct smb_rqst *rqst,
 802                 mid_receive_t *receive, mid_callback_t *callback,
 803                 mid_handle_t *handle, void *cbdata, const int flags,
 804                 const struct cifs_credits *exist_credits)
 805 {
 806         int rc;
 807         struct mid_q_entry *mid;
 808         struct cifs_credits credits = { .value = 0, .instance = 0 };
 809         unsigned int instance;
 810         int optype;
 811
 812         optype = flags & CIFS_OP_MASK;
 813
 814         if ((flags & CIFS_HAS_CREDITS) == 0) {
 815                 rc = wait_for_free_request(server, flags, &instance);
 816                 if (rc)
 817                         return rc;
 818                 credits.value = 1;
 819                 credits.instance = instance;
 820         } else
 821                 instance = exist_credits->instance;
 822
 823         cifs_server_lock(server);
 824
 825         /*
 826          * We can't use credits obtained from the previous session to send this
 827          * request. Check if there were reconnects after we obtained credits and
 828          * return -EAGAIN in such cases to let callers handle it.
 829          */
 830         if (instance != server->reconnect_instance) {
 831                 cifs_server_unlock(server);
 832                 add_credits_and_wake_if(server, &credits, optype);
 833                 return -EAGAIN;
 834         }
 835
 836         mid = server->ops->setup_async_request(server, rqst);
 837         if (IS_ERR(mid)) {
 838                 cifs_server_unlock(server);
 839                 add_credits_and_wake_if(server, &credits, optype);
 840                 return PTR_ERR(mid);
 841         }
 842
 843         mid->receive = receive;
 844         mid->callback = callback;
 845         mid->callback_data = cbdata;
 846         mid->handle = handle;
 847         mid->mid_state = MID_REQUEST_SUBMITTED;
 848
 849         /* put it on the pending_mid_q */
 850         spin_lock(&server->mid_lock);
 851         list_add_tail(&mid->qhead, &server->pending_mid_q);
 852         spin_unlock(&server->mid_lock);
 853
 854         /*
 855          * Need to store the time in mid before calling I/O. For call_async,
 856          * I/O response may come back and free the mid entry on another thread.
 857          */
 858         cifs_save_when_sent(mid);
 859         cifs_in_send_inc(server);
 860         rc = smb_send_rqst(server, 1, rqst, flags);
 861         cifs_in_send_dec(server);
 862
 863         if (rc < 0) {
 864                 revert_current_mid(server, mid->credits);
 865                 server->sequence_number -= 2;
 866                 delete_mid(mid);
 867         }
 868
 869         cifs_server_unlock(server);
 870
 871         if (rc == 0)
 872                 return 0;
 873
 874         add_credits_and_wake_if(server, &credits, optype);
 875         return rc;
 876 }
 877
 878 /*
 879  *
 880  * Send an SMB Request.  No response info (other than return code)
 881  * needs to be parsed.
 882  *
 883  * flags indicate the type of request buffer and how long to wait
 884  * and whether to log NT STATUS code (error) before mapping it to POSIX error
 885  *
 886  */
 887 int
 888 SendReceiveNoRsp(const unsigned int xid, struct cifs_ses *ses,
 889                  char *in_buf, int flags)
 890 {
 891         int rc;
 892         struct kvec iov[1];
 893         struct kvec rsp_iov;
 894         int resp_buf_type;
 895
 896         iov[0].iov_base = in_buf;
 897         iov[0].iov_len = get_rfc1002_length(in_buf) + 4;
 898         flags |= CIFS_NO_RSP_BUF;
 899         rc = SendReceive2(xid, ses, iov, 1, &resp_buf_type, flags, &rsp_iov);
 900         cifs_dbg(NOISY, "SendRcvNoRsp flags %d rc %d\n", flags, rc);
 901
 902         return rc;
 903 }
 904
 905 static int
 906 cifs_sync_mid_result(struct mid_q_entry *mid, struct TCP_Server_Info *server)
 907 {
 908         int rc = 0;
 909
 910         cifs_dbg(FYI, "%s: cmd=%d mid=%llu state=%d\n",
 911                  __func__, le16_to_cpu(mid->command), mid->mid, mid->mid_state);
 912
 913         spin_lock(&server->mid_lock);
 914         switch (mid->mid_state) {
 915         case MID_RESPONSE_RECEIVED:
 916                 spin_unlock(&server->mid_lock);
 917                 return rc;
 918         case MID_RETRY_NEEDED:
 919                 rc = -EAGAIN;
 920                 break;
 921         case MID_RESPONSE_MALFORMED:
 922                 rc = -EIO;
 923                 break;
 924         case MID_SHUTDOWN:
 925                 rc = -EHOSTDOWN;
 926                 break;
 927         default:
 928                 if (!(mid->mid_flags & MID_DELETED)) {
 929                         list_del_init(&mid->qhead);
 930                         mid->mid_flags |= MID_DELETED;
 931                 }
 932                 cifs_server_dbg(VFS, "%s: invalid mid state mid=%llu state=%d\n",
 933                          __func__, mid->mid, mid->mid_state);
 934                 rc = -EIO;
 935         }
 936         spin_unlock(&server->mid_lock);
 937
 938         release_mid(mid);
 939         return rc;
 940 }
 941
 942 static inline int
 943 send_cancel(struct TCP_Server_Info *server, struct smb_rqst *rqst,
 944             struct mid_q_entry *mid)
 945 {
 946         return server->ops->send_cancel ?
 947                                 server->ops->send_cancel(server, rqst, mid) : 0;
 948 }
 949
 950 int
 951 cifs_check_receive(struct mid_q_entry *mid, struct TCP_Server_Info *server,
 952                    bool log_error)
 953 {
 954         unsigned int len = get_rfc1002_length(mid->resp_buf) + 4;
 955
 956         dump_smb(mid->resp_buf, min_t(u32, 92, len));
 957
 958         /* convert the length into a more usable form */
 959         if (server->sign) {
 960                 struct kvec iov[2];
 961                 int rc = 0;
 962                 struct smb_rqst rqst = { .rq_iov = iov,
 963                                          .rq_nvec = 2 };
 964
 965                 iov[0].iov_base = mid->resp_buf;
 966                 iov[0].iov_len = 4;
 967                 iov[1].iov_base = (char *)mid->resp_buf + 4;
 968                 iov[1].iov_len = len - 4;
 969                 /* FIXME: add code to kill session */
 970                 rc = cifs_verify_signature(&rqst, server,
 971                                            mid->sequence_number);
 972                 if (rc)
 973                         cifs_server_dbg(VFS, "SMB signature verification returned error = %d\n",
 974                                  rc);
 975         }
 976
 977         /* BB special case reconnect tid and uid here? */
 978         return map_and_check_smb_error(mid, log_error);
 979 }
 980
 981 struct mid_q_entry *
 982 cifs_setup_request(struct cifs_ses *ses, struct TCP_Server_Info *ignored,
 983                    struct smb_rqst *rqst)
 984 {
 985         int rc;
 986         struct smb_hdr *hdr = (struct smb_hdr *)rqst->rq_iov[0].iov_base;
 987         struct mid_q_entry *mid;
 988
 989         if (rqst->rq_iov[0].iov_len != 4 ||
 990             rqst->rq_iov[0].iov_base + 4 != rqst->rq_iov[1].iov_base)
 991                 return ERR_PTR(-EIO);
 992
 993         rc = allocate_mid(ses, hdr, &mid);
 994         if (rc)
 995                 return ERR_PTR(rc);
 996         rc = cifs_sign_rqst(rqst, ses->server, &mid->sequence_number);
 997         if (rc) {
 998                 delete_mid(mid);
 999                 return ERR_PTR(rc);
1000         }
1001         return mid;
1002 }
1003
1004 static void
1005 cifs_compound_callback(struct mid_q_entry *mid)
1006 {
1007         struct TCP_Server_Info *server = mid->server;
1008         struct cifs_credits credits;
1009
1010         credits.value = server->ops->get_credits(mid);
1011         credits.instance = server->reconnect_instance;
1012
1013         add_credits(server, &credits, mid->optype);
1014 }
1015
1016 static void
1017 cifs_compound_last_callback(struct mid_q_entry *mid)
1018 {
1019         cifs_compound_callback(mid);
1020         cifs_wake_up_task(mid);
1021 }
1022
1023 static void
1024 cifs_cancelled_callback(struct mid_q_entry *mid)
1025 {
1026         cifs_compound_callback(mid);
1027         release_mid(mid);
1028 }
1029
1030 /*
1031  * Return a channel (master if none) of @ses that can be used to send
1032  * regular requests.
1033  *
1034  * If we are currently binding a new channel (negprot/sess.setup),
1035  * return the new incomplete channel.
1036  */
1037 struct TCP_Server_Info *cifs_pick_channel(struct cifs_ses *ses)
1038 {
1039         uint index = 0;
1040
1041         if (!ses)
1042                 return NULL;
1043
1044         /* round robin */
1045         index = (uint)atomic_inc_return(&ses->chan_seq);
1046
1047         spin_lock(&ses->chan_lock);
1048         index %= ses->chan_count;
1049         spin_unlock(&ses->chan_lock);
1050
1051         return ses->chans[index].server;
1052 }
1053
1054 int
1055 compound_send_recv(const unsigned int xid, struct cifs_ses *ses,
1056                    struct TCP_Server_Info *server,
1057                    const int flags, const int num_rqst, struct smb_rqst *rqst,
1058                    int *resp_buf_type, struct kvec *resp_iov)
1059 {
1060         int i, j, optype, rc = 0;
1061         struct mid_q_entry *midQ[MAX_COMPOUND];
1062         bool cancelled_mid[MAX_COMPOUND] = {false};
1063         struct cifs_credits credits[MAX_COMPOUND] = {
1064                 { .value = 0, .instance = 0 }
1065         };
1066         unsigned int instance;
1067         char *buf;
1068
1069         optype = flags & CIFS_OP_MASK;
1070
1071         for (i = 0; i < num_rqst; i++)
1072                 resp_buf_type[i] = CIFS_NO_BUFFER;  /* no response buf yet */
1073
1074         if (!ses || !ses->server || !server) {
1075                 cifs_dbg(VFS, "Null session\n");
1076                 return -EIO;
1077         }
1078
1079         spin_lock(&server->srv_lock);
1080         if (server->tcpStatus == CifsExiting) {
1081                 spin_unlock(&server->srv_lock);
1082                 return -ENOENT;
1083         }
1084         spin_unlock(&server->srv_lock);
1085
1086         /*
1087          * Wait for all the requests to become available.
1088          * This approach still leaves the possibility to be stuck waiting for
1089          * credits if the server doesn't grant credits to the outstanding
1090          * requests and if the client is completely idle, not generating any
1091          * other requests.
1092          * This can be handled by the eventual session reconnect.
1093          */
1094         rc = wait_for_compound_request(server, num_rqst, flags,
1095                                        &instance);
1096         if (rc)
1097                 return rc;
1098
1099         for (i = 0; i < num_rqst; i++) {
1100                 credits[i].value = 1;
1101                 credits[i].instance = instance;
1102         }
1103
1104         /*
1105          * Make sure that we sign in the same order that we send on this socket
1106          * and avoid races inside tcp sendmsg code that could cause corruption
1107          * of smb data.
1108          */
1109
1110         cifs_server_lock(server);
1111
1112         /*
1113          * All the parts of the compound chain belong obtained credits from the
1114          * same session. We can not use credits obtained from the previous
1115          * session to send this request. Check if there were reconnects after
1116          * we obtained credits and return -EAGAIN in such cases to let callers
1117          * handle it.
1118          */
1119         if (instance != server->reconnect_instance) {
1120                 cifs_server_unlock(server);
1121                 for (j = 0; j < num_rqst; j++)
1122                         add_credits(server, &credits[j], optype);
1123                 return -EAGAIN;
1124         }
1125
1126         for (i = 0; i < num_rqst; i++) {
1127                 midQ[i] = server->ops->setup_request(ses, server, &rqst[i]);
1128                 if (IS_ERR(midQ[i])) {
1129                         revert_current_mid(server, i);
1130                         for (j = 0; j < i; j++)
1131                                 delete_mid(midQ[j]);
1132                         cifs_server_unlock(server);
1133
1134                         /* Update # of requests on wire to server */
1135                         for (j = 0; j < num_rqst; j++)
1136                                 add_credits(server, &credits[j], optype);
1137                         return PTR_ERR(midQ[i]);
1138                 }
1139
1140                 midQ[i]->mid_state = MID_REQUEST_SUBMITTED;
1141                 midQ[i]->optype = optype;
1142                 /*
1143                  * Invoke callback for every part of the compound chain
1144                  * to calculate credits properly. Wake up this thread only when
1145                  * the last element is received.
1146                  */
1147                 if (i < num_rqst - 1)
1148                         midQ[i]->callback = cifs_compound_callback;
1149                 else
1150                         midQ[i]->callback = cifs_compound_last_callback;
1151         }
1152         cifs_in_send_inc(server);
1153         rc = smb_send_rqst(server, num_rqst, rqst, flags);
1154         cifs_in_send_dec(server);
1155
1156         for (i = 0; i < num_rqst; i++)
1157                 cifs_save_when_sent(midQ[i]);
1158
1159         if (rc < 0) {
1160                 revert_current_mid(server, num_rqst);
1161                 server->sequence_number -= 2;
1162         }
1163
1164         cifs_server_unlock(server);
1165
1166         /*
1167          * If sending failed for some reason or it is an oplock break that we
1168          * will not receive a response to - return credits back
1169          */
1170         if (rc < 0 || (flags & CIFS_NO_SRV_RSP)) {
1171                 for (i = 0; i < num_rqst; i++)
1172                         add_credits(server, &credits[i], optype);
1173                 goto out;
1174         }
1175
1176         /*
1177          * At this point the request is passed to the network stack - we assume
1178          * that any credits taken from the server structure on the client have
1179          * been spent and we can't return them back. Once we receive responses
1180          * we will collect credits granted by the server in the mid callbacks
1181          * and add those credits to the server structure.
1182          */
1183
1184         /*
1185          * Compounding is never used during session establish.
1186          */
1187         spin_lock(&ses->ses_lock);
1188         if ((ses->ses_status == SES_NEW) || (optype & CIFS_NEG_OP) || (optype & CIFS_SESS_OP)) {
1189                 spin_unlock(&ses->ses_lock);
1190
1191                 cifs_server_lock(server);
1192                 smb311_update_preauth_hash(ses, server, rqst[0].rq_iov, rqst[0].rq_nvec);
1193                 cifs_server_unlock(server);
1194
1195                 spin_lock(&ses->ses_lock);
1196         }
1197         spin_unlock(&ses->ses_lock);
1198
1199         for (i = 0; i < num_rqst; i++) {
1200                 rc = wait_for_response(server, midQ[i]);
1201                 if (rc != 0)
1202                         break;
1203         }
1204         if (rc != 0) {
1205                 for (; i < num_rqst; i++) {
1206                         cifs_server_dbg(FYI, "Cancelling wait for mid %llu cmd: %d\n",
1207                                  midQ[i]->mid, le16_to_cpu(midQ[i]->command));
1208                         send_cancel(server, &rqst[i], midQ[i]);
1209                         spin_lock(&server->mid_lock);
1210                         midQ[i]->mid_flags |= MID_WAIT_CANCELLED;
1211                         if (midQ[i]->mid_state == MID_REQUEST_SUBMITTED) {
1212                                 midQ[i]->callback = cifs_cancelled_callback;
1213                                 cancelled_mid[i] = true;
1214                                 credits[i].value = 0;
1215                         }
1216                         spin_unlock(&server->mid_lock);
1217                 }
1218         }
1219
1220         for (i = 0; i < num_rqst; i++) {
1221                 if (rc < 0)
1222                         goto out;
1223
1224                 rc = cifs_sync_mid_result(midQ[i], server);
1225                 if (rc != 0) {
1226                         /* mark this mid as cancelled to not free it below */
1227                         cancelled_mid[i] = true;
1228                         goto out;
1229                 }
1230
1231                 if (!midQ[i]->resp_buf ||
1232                     midQ[i]->mid_state != MID_RESPONSE_RECEIVED) {
1233                         rc = -EIO;
1234                         cifs_dbg(FYI, "Bad MID state?\n");
1235                         goto out;
1236                 }
1237
1238                 buf = (char *)midQ[i]->resp_buf;
1239                 resp_iov[i].iov_base = buf;
1240                 resp_iov[i].iov_len = midQ[i]->resp_buf_size +
1241                         server->vals->header_preamble_size;
1242
1243                 if (midQ[i]->large_buf)
1244                         resp_buf_type[i] = CIFS_LARGE_BUFFER;
1245                 else
1246                         resp_buf_type[i] = CIFS_SMALL_BUFFER;
1247
1248                 rc = server->ops->check_receive(midQ[i], server,
1249                                                      flags & CIFS_LOG_ERROR);
1250
1251                 /* mark it so buf will not be freed by delete_mid */
1252                 if ((flags & CIFS_NO_RSP_BUF) == 0)
1253                         midQ[i]->resp_buf = NULL;
1254
1255         }
1256
1257         /*
1258          * Compounding is never used during session establish.
1259          */
1260         spin_lock(&ses->ses_lock);
1261         if ((ses->ses_status == SES_NEW) || (optype & CIFS_NEG_OP) || (optype & CIFS_SESS_OP)) {
1262                 struct kvec iov = {
1263                         .iov_base = resp_iov[0].iov_base,
1264                         .iov_len = resp_iov[0].iov_len
1265                 };
1266                 spin_unlock(&ses->ses_lock);
1267                 cifs_server_lock(server);
1268                 smb311_update_preauth_hash(ses, server, &iov, 1);
1269                 cifs_server_unlock(server);
1270                 spin_lock(&ses->ses_lock);
1271         }
1272         spin_unlock(&ses->ses_lock);
1273
1274 out:
1275         /*
1276          * This will dequeue all mids. After this it is important that the
1277          * demultiplex_thread will not process any of these mids any futher.
1278          * This is prevented above by using a noop callback that will not
1279          * wake this thread except for the very last PDU.
1280          */
1281         for (i = 0; i < num_rqst; i++) {
1282                 if (!cancelled_mid[i])
1283                         delete_mid(midQ[i]);
1284         }
1285
1286         return rc;
1287 }
1288
1289 int
1290 cifs_send_recv(const unsigned int xid, struct cifs_ses *ses,
1291                struct TCP_Server_Info *server,
1292                struct smb_rqst *rqst, int *resp_buf_type, const int flags,
1293                struct kvec *resp_iov)
1294 {
1295         return compound_send_recv(xid, ses, server, flags, 1,
1296                                   rqst, resp_buf_type, resp_iov);
1297 }
1298
1299 int
1300 SendReceive2(const unsigned int xid, struct cifs_ses *ses,
1301              struct kvec *iov, int n_vec, int *resp_buf_type /* ret */,
1302              const int flags, struct kvec *resp_iov)
1303 {
1304         struct smb_rqst rqst;
1305         struct kvec s_iov[CIFS_MAX_IOV_SIZE], *new_iov;
1306         int rc;
1307
1308         if (n_vec + 1 > CIFS_MAX_IOV_SIZE) {
1309                 new_iov = kmalloc_array(n_vec + 1, sizeof(struct kvec),
1310                                         GFP_KERNEL);
1311                 if (!new_iov) {
1312                         /* otherwise cifs_send_recv below sets resp_buf_type */
1313                         *resp_buf_type = CIFS_NO_BUFFER;
1314                         return -ENOMEM;
1315                 }
1316         } else
1317                 new_iov = s_iov;
1318
1319         /* 1st iov is a RFC1001 length followed by the rest of the packet */
1320         memcpy(new_iov + 1, iov, (sizeof(struct kvec) * n_vec));
1321
1322         new_iov[0].iov_base = new_iov[1].iov_base;
1323         new_iov[0].iov_len = 4;
1324         new_iov[1].iov_base += 4;
1325         new_iov[1].iov_len -= 4;
1326
1327         memset(&rqst, 0, sizeof(struct smb_rqst));
1328         rqst.rq_iov = new_iov;
1329         rqst.rq_nvec = n_vec + 1;
1330
1331         rc = cifs_send_recv(xid, ses, ses->server,
1332                             &rqst, resp_buf_type, flags, resp_iov);
1333         if (n_vec + 1 > CIFS_MAX_IOV_SIZE)
1334                 kfree(new_iov);
1335         return rc;
1336 }
1337
1338 int
1339 SendReceive(const unsigned int xid, struct cifs_ses *ses,
1340             struct smb_hdr *in_buf, struct smb_hdr *out_buf,
1341             int *pbytes_returned, const int flags)
1342 {
1343         int rc = 0;
1344         struct mid_q_entry *midQ;
1345         unsigned int len = be32_to_cpu(in_buf->smb_buf_length);
1346         struct kvec iov = { .iov_base = in_buf, .iov_len = len };
1347         struct smb_rqst rqst = { .rq_iov = &iov, .rq_nvec = 1 };
1348         struct cifs_credits credits = { .value = 1, .instance = 0 };
1349         struct TCP_Server_Info *server;
1350
1351         if (ses == NULL) {
1352                 cifs_dbg(VFS, "Null smb session\n");
1353                 return -EIO;
1354         }
1355         server = ses->server;
1356         if (server == NULL) {
1357                 cifs_dbg(VFS, "Null tcp session\n");
1358                 return -EIO;
1359         }
1360
1361         spin_lock(&server->srv_lock);
1362         if (server->tcpStatus == CifsExiting) {
1363                 spin_unlock(&server->srv_lock);
1364                 return -ENOENT;
1365         }
1366         spin_unlock(&server->srv_lock);
1367
1368         /* Ensure that we do not send more than 50 overlapping requests
1369            to the same server. We may make this configurable later or
1370            use ses->maxReq */
1371
1372         if (len > CIFSMaxBufSize + MAX_CIFS_HDR_SIZE - 4) {
1373                 cifs_server_dbg(VFS, "Invalid length, greater than maximum frame, %d\n",
1374                                 len);
1375                 return -EIO;
1376         }
1377
1378         rc = wait_for_free_request(server, flags, &credits.instance);
1379         if (rc)
1380                 return rc;
1381
1382         /* make sure that we sign in the same order that we send on this socket
1383            and avoid races inside tcp sendmsg code that could cause corruption
1384            of smb data */
1385
1386         cifs_server_lock(server);
1387
1388         rc = allocate_mid(ses, in_buf, &midQ);
1389         if (rc) {
1390                 cifs_server_unlock(server);
1391                 /* Update # of requests on wire to server */
1392                 add_credits(server, &credits, 0);
1393                 return rc;
1394         }
1395
1396         rc = cifs_sign_smb(in_buf, server, &midQ->sequence_number);
1397         if (rc) {
1398                 cifs_server_unlock(server);
1399                 goto out;
1400         }
1401
1402         midQ->mid_state = MID_REQUEST_SUBMITTED;
1403
1404         cifs_in_send_inc(server);
1405         rc = smb_send(server, in_buf, len);
1406         cifs_in_send_dec(server);
1407         cifs_save_when_sent(midQ);
1408
1409         if (rc < 0)
1410                 server->sequence_number -= 2;
1411
1412         cifs_server_unlock(server);
1413
1414         if (rc < 0)
1415                 goto out;
1416
1417         rc = wait_for_response(server, midQ);
1418         if (rc != 0) {
1419                 send_cancel(server, &rqst, midQ);
1420                 spin_lock(&server->mid_lock);
1421                 if (midQ->mid_state == MID_REQUEST_SUBMITTED) {
1422                         /* no longer considered to be "in-flight" */
1423                         midQ->callback = release_mid;
1424                         spin_unlock(&server->mid_lock);
1425                         add_credits(server, &credits, 0);
1426                         return rc;
1427                 }
1428                 spin_unlock(&server->mid_lock);
1429         }
1430
1431         rc = cifs_sync_mid_result(midQ, server);
1432         if (rc != 0) {
1433                 add_credits(server, &credits, 0);
1434                 return rc;
1435         }
1436
1437         if (!midQ->resp_buf || !out_buf ||
1438             midQ->mid_state != MID_RESPONSE_RECEIVED) {
1439                 rc = -EIO;
1440                 cifs_server_dbg(VFS, "Bad MID state?\n");
1441                 goto out;
1442         }
1443
1444         *pbytes_returned = get_rfc1002_length(midQ->resp_buf);
1445         memcpy(out_buf, midQ->resp_buf, *pbytes_returned + 4);
1446         rc = cifs_check_receive(midQ, server, 0);
1447 out:
1448         delete_mid(midQ);
1449         add_credits(server, &credits, 0);
1450
1451         return rc;
1452 }
1453
1454 /* We send a LOCKINGX_CANCEL_LOCK to cause the Windows
1455    blocking lock to return. */
1456
1457 static int
1458 send_lock_cancel(const unsigned int xid, struct cifs_tcon *tcon,
1459                         struct smb_hdr *in_buf,
1460                         struct smb_hdr *out_buf)
1461 {
1462         int bytes_returned;
1463         struct cifs_ses *ses = tcon->ses;
1464         LOCK_REQ *pSMB = (LOCK_REQ *)in_buf;
1465
1466         /* We just modify the current in_buf to change
1467            the type of lock from LOCKING_ANDX_SHARED_LOCK
1468            or LOCKING_ANDX_EXCLUSIVE_LOCK to
1469            LOCKING_ANDX_CANCEL_LOCK. */
1470
1471         pSMB->LockType = LOCKING_ANDX_CANCEL_LOCK|LOCKING_ANDX_LARGE_FILES;
1472         pSMB->Timeout = 0;
1473         pSMB->hdr.Mid = get_next_mid(ses->server);
1474
1475         return SendReceive(xid, ses, in_buf, out_buf,
1476                         &bytes_returned, 0);
1477 }
1478
1479 int
1480 SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon,
1481             struct smb_hdr *in_buf, struct smb_hdr *out_buf,
1482             int *pbytes_returned)
1483 {
1484         int rc = 0;
1485         int rstart = 0;
1486         struct mid_q_entry *midQ;
1487         struct cifs_ses *ses;
1488         unsigned int len = be32_to_cpu(in_buf->smb_buf_length);
1489         struct kvec iov = { .iov_base = in_buf, .iov_len = len };
1490         struct smb_rqst rqst = { .rq_iov = &iov, .rq_nvec = 1 };
1491         unsigned int instance;
1492         struct TCP_Server_Info *server;
1493
1494         if (tcon == NULL || tcon->ses == NULL) {
1495                 cifs_dbg(VFS, "Null smb session\n");
1496                 return -EIO;
1497         }
1498         ses = tcon->ses;
1499         server = ses->server;
1500
1501         if (server == NULL) {
1502                 cifs_dbg(VFS, "Null tcp session\n");
1503                 return -EIO;
1504         }
1505
1506         spin_lock(&server->srv_lock);
1507         if (server->tcpStatus == CifsExiting) {
1508                 spin_unlock(&server->srv_lock);
1509                 return -ENOENT;
1510         }
1511         spin_unlock(&server->srv_lock);
1512
1513         /* Ensure that we do not send more than 50 overlapping requests
1514            to the same server. We may make this configurable later or
1515            use ses->maxReq */
1516
1517         if (len > CIFSMaxBufSize + MAX_CIFS_HDR_SIZE - 4) {
1518                 cifs_tcon_dbg(VFS, "Invalid length, greater than maximum frame, %d\n",
1519                               len);
1520                 return -EIO;
1521         }
1522
1523         rc = wait_for_free_request(server, CIFS_BLOCKING_OP, &instance);
1524         if (rc)
1525                 return rc;
1526
1527         /* make sure that we sign in the same order that we send on this socket
1528            and avoid races inside tcp sendmsg code that could cause corruption
1529            of smb data */
1530
1531         cifs_server_lock(server);
1532
1533         rc = allocate_mid(ses, in_buf, &midQ);
1534         if (rc) {
1535                 cifs_server_unlock(server);
1536                 return rc;
1537         }
1538
1539         rc = cifs_sign_smb(in_buf, server, &midQ->sequence_number);
1540         if (rc) {
1541                 delete_mid(midQ);
1542                 cifs_server_unlock(server);
1543                 return rc;
1544         }
1545
1546         midQ->mid_state = MID_REQUEST_SUBMITTED;
1547         cifs_in_send_inc(server);
1548         rc = smb_send(server, in_buf, len);
1549         cifs_in_send_dec(server);
1550         cifs_save_when_sent(midQ);
1551
1552         if (rc < 0)
1553                 server->sequence_number -= 2;
1554
1555         cifs_server_unlock(server);
1556
1557         if (rc < 0) {
1558                 delete_mid(midQ);
1559                 return rc;
1560         }
1561
1562         /* Wait for a reply - allow signals to interrupt. */
1563         rc = wait_event_interruptible(server->response_q,
1564                 (!(midQ->mid_state == MID_REQUEST_SUBMITTED)) ||
1565                 ((server->tcpStatus != CifsGood) &&
1566                  (server->tcpStatus != CifsNew)));
1567
1568         /* Were we interrupted by a signal ? */
1569         spin_lock(&server->srv_lock);
1570         if ((rc == -ERESTARTSYS) &&
1571                 (midQ->mid_state == MID_REQUEST_SUBMITTED) &&
1572                 ((server->tcpStatus == CifsGood) ||
1573                  (server->tcpStatus == CifsNew))) {
1574                 spin_unlock(&server->srv_lock);
1575
1576                 if (in_buf->Command == SMB_COM_TRANSACTION2) {
1577                         /* POSIX lock. We send a NT_CANCEL SMB to cause the
1578                            blocking lock to return. */
1579                         rc = send_cancel(server, &rqst, midQ);
1580                         if (rc) {
1581                                 delete_mid(midQ);
1582                                 return rc;
1583                         }
1584                 } else {
1585                         /* Windows lock. We send a LOCKINGX_CANCEL_LOCK
1586                            to cause the blocking lock to return. */
1587
1588                         rc = send_lock_cancel(xid, tcon, in_buf, out_buf);
1589
1590                         /* If we get -ENOLCK back the lock may have
1591                            already been removed. Don't exit in this case. */
1592                         if (rc && rc != -ENOLCK) {
1593                                 delete_mid(midQ);
1594                                 return rc;
1595                         }
1596                 }
1597
1598                 rc = wait_for_response(server, midQ);
1599                 if (rc) {
1600                         send_cancel(server, &rqst, midQ);
1601                         spin_lock(&server->mid_lock);
1602                         if (midQ->mid_state == MID_REQUEST_SUBMITTED) {
1603                                 /* no longer considered to be "in-flight" */
1604                                 midQ->callback = release_mid;
1605                                 spin_unlock(&server->mid_lock);
1606                                 return rc;
1607                         }
1608                         spin_unlock(&server->mid_lock);
1609                 }
1610
1611                 /* We got the response - restart system call. */
1612                 rstart = 1;
1613                 spin_lock(&server->srv_lock);
1614         }
1615         spin_unlock(&server->srv_lock);
1616
1617         rc = cifs_sync_mid_result(midQ, server);
1618         if (rc != 0)
1619                 return rc;
1620
1621         /* rcvd frame is ok */
1622         if (out_buf == NULL || midQ->mid_state != MID_RESPONSE_RECEIVED) {
1623                 rc = -EIO;
1624                 cifs_tcon_dbg(VFS, "Bad MID state?\n");
1625                 goto out;
1626         }
1627
1628         *pbytes_returned = get_rfc1002_length(midQ->resp_buf);
1629         memcpy(out_buf, midQ->resp_buf, *pbytes_returned + 4);
1630         rc = cifs_check_receive(midQ, server, 0);
1631 out:
1632         delete_mid(midQ);
1633         if (rstart && rc == -EACCES)
1634                 return -ERESTARTSYS;
1635         return rc;
1636 }
1637
1638 /*
1639  * Discard any remaining data in the current SMB. To do this, we borrow the
1640  * current bigbuf.
1641  */
1642 int
1643 cifs_discard_remaining_data(struct TCP_Server_Info *server)
1644 {
1645         unsigned int rfclen = server->pdu_size;
1646         int remaining = rfclen + server->vals->header_preamble_size -
1647                 server->total_read;
1648
1649         while (remaining > 0) {
1650                 int length;
1651
1652                 length = cifs_discard_from_socket(server,
1653                                 min_t(size_t, remaining,
1654                                       CIFSMaxBufSize + MAX_HEADER_SIZE(server)));
1655                 if (length < 0)
1656                         return length;
1657                 server->total_read += length;
1658                 remaining -= length;
1659         }
1660
1661         return 0;
1662 }
1663
1664 static int
1665 __cifs_readv_discard(struct TCP_Server_Info *server, struct mid_q_entry *mid,
1666                      bool malformed)
1667 {
1668         int length;
1669
1670         length = cifs_discard_remaining_data(server);
1671         dequeue_mid(mid, malformed);
1672         mid->resp_buf = server->smallbuf;
1673         server->smallbuf = NULL;
1674         return length;
1675 }
1676
1677 static int
1678 cifs_readv_discard(struct TCP_Server_Info *server, struct mid_q_entry *mid)
1679 {
1680         struct cifs_readdata *rdata = mid->callback_data;
1681
1682         return  __cifs_readv_discard(server, mid, rdata->result);
1683 }
1684
1685 int
1686 cifs_readv_receive(struct TCP_Server_Info *server, struct mid_q_entry *mid)
1687 {
1688         int length, len;
1689         unsigned int data_offset, data_len;
1690         struct cifs_readdata *rdata = mid->callback_data;
1691         char *buf = server->smallbuf;
1692         unsigned int buflen = server->pdu_size +
1693                 server->vals->header_preamble_size;
1694         bool use_rdma_mr = false;
1695
1696         cifs_dbg(FYI, "%s: mid=%llu offset=%llu bytes=%u\n",
1697                  __func__, mid->mid, rdata->offset, rdata->bytes);
1698
1699         /*
1700          * read the rest of READ_RSP header (sans Data array), or whatever we
1701          * can if there's not enough data. At this point, we've read down to
1702          * the Mid.
1703          */
1704         len = min_t(unsigned int, buflen, server->vals->read_rsp_size) -
1705                                                         HEADER_SIZE(server) + 1;
1706
1707         length = cifs_read_from_socket(server,
1708                                        buf + HEADER_SIZE(server) - 1, len);
1709         if (length < 0)
1710                 return length;
1711         server->total_read += length;
1712
1713         if (server->ops->is_session_expired &&
1714             server->ops->is_session_expired(buf)) {
1715                 cifs_reconnect(server, true);
1716                 return -1;
1717         }
1718
1719         if (server->ops->is_status_pending &&
1720             server->ops->is_status_pending(buf, server)) {
1721                 cifs_discard_remaining_data(server);
1722                 return -1;
1723         }
1724
1725         /* set up first two iov for signature check and to get credits */
1726         rdata->iov[0].iov_base = buf;
1727         rdata->iov[0].iov_len = server->vals->header_preamble_size;
1728         rdata->iov[1].iov_base = buf + server->vals->header_preamble_size;
1729         rdata->iov[1].iov_len =
1730                 server->total_read - server->vals->header_preamble_size;
1731         cifs_dbg(FYI, "0: iov_base=%p iov_len=%zu\n",
1732                  rdata->iov[0].iov_base, rdata->iov[0].iov_len);
1733         cifs_dbg(FYI, "1: iov_base=%p iov_len=%zu\n",
1734                  rdata->iov[1].iov_base, rdata->iov[1].iov_len);
1735
1736         /* Was the SMB read successful? */
1737         rdata->result = server->ops->map_error(buf, false);
1738         if (rdata->result != 0) {
1739                 cifs_dbg(FYI, "%s: server returned error %d\n",
1740                          __func__, rdata->result);
1741                 /* normal error on read response */
1742                 return __cifs_readv_discard(server, mid, false);
1743         }
1744
1745         /* Is there enough to get to the rest of the READ_RSP header? */
1746         if (server->total_read < server->vals->read_rsp_size) {
1747                 cifs_dbg(FYI, "%s: server returned short header. got=%u expected=%zu\n",
1748                          __func__, server->total_read,
1749                          server->vals->read_rsp_size);
1750                 rdata->result = -EIO;
1751                 return cifs_readv_discard(server, mid);
1752         }
1753
1754         data_offset = server->ops->read_data_offset(buf) +
1755                 server->vals->header_preamble_size;
1756         if (data_offset < server->total_read) {
1757                 /*
1758                  * win2k8 sometimes sends an offset of 0 when the read
1759                  * is beyond the EOF. Treat it as if the data starts just after
1760                  * the header.
1761                  */
1762                 cifs_dbg(FYI, "%s: data offset (%u) inside read response header\n",
1763                          __func__, data_offset);
1764                 data_offset = server->total_read;
1765         } else if (data_offset > MAX_CIFS_SMALL_BUFFER_SIZE) {
1766                 /* data_offset is beyond the end of smallbuf */
1767                 cifs_dbg(FYI, "%s: data offset (%u) beyond end of smallbuf\n",
1768                          __func__, data_offset);
1769                 rdata->result = -EIO;
1770                 return cifs_readv_discard(server, mid);
1771         }
1772
1773         cifs_dbg(FYI, "%s: total_read=%u data_offset=%u\n",
1774                  __func__, server->total_read, data_offset);
1775
1776         len = data_offset - server->total_read;
1777         if (len > 0) {
1778                 /* read any junk before data into the rest of smallbuf */
1779                 length = cifs_read_from_socket(server,
1780                                                buf + server->total_read, len);
1781                 if (length < 0)
1782                         return length;
1783                 server->total_read += length;
1784         }
1785
1786         /* how much data is in the response? */
1787 #ifdef CONFIG_CIFS_SMB_DIRECT
1788         use_rdma_mr = rdata->mr;
1789 #endif
1790         data_len = server->ops->read_data_length(buf, use_rdma_mr);
1791         if (!use_rdma_mr && (data_offset + data_len > buflen)) {
1792                 /* data_len is corrupt -- discard frame */
1793                 rdata->result = -EIO;
1794                 return cifs_readv_discard(server, mid);
1795         }
1796
1797         length = rdata->read_into_pages(server, rdata, data_len);
1798         if (length < 0)
1799                 return length;
1800
1801         server->total_read += length;
1802
1803         cifs_dbg(FYI, "total_read=%u buflen=%u remaining=%u\n",
1804                  server->total_read, buflen, data_len);
1805
1806         /* discard anything left over */
1807         if (server->total_read < buflen)
1808                 return cifs_readv_discard(server, mid);
1809
1810         dequeue_mid(mid, false);
1811         mid->resp_buf = server->smallbuf;
1812         server->smallbuf = NULL;
1813         return length;
1814 }