fs/smb/client/transport.c

   1 // SPDX-License-Identifier: LGPL-2.1
   2 /*
   3  *
   4  *   Copyright (C) International Business Machines  Corp., 2002,2008
   5  *   Author(s): Steve French (sfrench@us.ibm.com)
   6  *   Jeremy Allison (jra@samba.org) 2006.
   7  *
   8  */
   9
  10 #include <linux/fs.h>
  11 #include <linux/list.h>
  12 #include <linux/gfp.h>
  13 #include <linux/wait.h>
  14 #include <linux/net.h>
  15 #include <linux/delay.h>
  16 #include <linux/freezer.h>
  17 #include <linux/tcp.h>
  18 #include <linux/bvec.h>
  19 #include <linux/highmem.h>
  20 #include <linux/uaccess.h>
  21 #include <linux/processor.h>
  22 #include <linux/mempool.h>
  23 #include <linux/sched/signal.h>
  24 #include <linux/task_io_accounting_ops.h>
  25 #include "cifspdu.h"
  26 #include "cifsglob.h"
  27 #include "cifsproto.h"
  28 #include "cifs_debug.h"
  29 #include "smb2proto.h"
  30 #include "smbdirect.h"
  31
  32 /* Max number of iovectors we can use off the stack when sending requests. */
  33 #define CIFS_MAX_IOV_SIZE 8
  34
  35 void
  36 cifs_wake_up_task(struct mid_q_entry *mid)
  37 {
  38         if (mid->mid_state == MID_RESPONSE_RECEIVED)
  39                 mid->mid_state = MID_RESPONSE_READY;
  40         wake_up_process(mid->callback_data);
  41 }
  42
  43 static struct mid_q_entry *
  44 alloc_mid(const struct smb_hdr *smb_buffer, struct TCP_Server_Info *server)
  45 {
  46         struct mid_q_entry *temp;
  47
  48         if (server == NULL) {
  49                 cifs_dbg(VFS, "%s: null TCP session\n", __func__);
  50                 return NULL;
  51         }
  52
  53         temp = mempool_alloc(cifs_mid_poolp, GFP_NOFS);
  54         memset(temp, 0, sizeof(struct mid_q_entry));
  55         kref_init(&temp->refcount);
  56         temp->mid = get_mid(smb_buffer);
  57         temp->pid = current->pid;
  58         temp->command = cpu_to_le16(smb_buffer->Command);
  59         cifs_dbg(FYI, "For smb_command %d\n", smb_buffer->Command);
  60         /* easier to use jiffies */
  61         /* when mid allocated can be before when sent */
  62         temp->when_alloc = jiffies;
  63         temp->server = server;
  64
  65         /*
  66          * The default is for the mid to be synchronous, so the
  67          * default callback just wakes up the current task.
  68          */
  69         get_task_struct(current);
  70         temp->creator = current;
  71         temp->callback = cifs_wake_up_task;
  72         temp->callback_data = current;
  73
  74         atomic_inc(&mid_count);
  75         temp->mid_state = MID_REQUEST_ALLOCATED;
  76         return temp;
  77 }
  78
  79 void __release_mid(struct kref *refcount)
  80 {
  81         struct mid_q_entry *midEntry =
  82                         container_of(refcount, struct mid_q_entry, refcount);
  83 #ifdef CONFIG_CIFS_STATS2
  84         __le16 command = midEntry->server->vals->lock_cmd;
  85         __u16 smb_cmd = le16_to_cpu(midEntry->command);
  86         unsigned long now;
  87         unsigned long roundtrip_time;
  88 #endif
  89         struct TCP_Server_Info *server = midEntry->server;
  90
  91         if (midEntry->resp_buf && (midEntry->mid_flags & MID_WAIT_CANCELLED) &&
  92             (midEntry->mid_state == MID_RESPONSE_RECEIVED ||
  93              midEntry->mid_state == MID_RESPONSE_READY) &&
  94             server->ops->handle_cancelled_mid)
  95                 server->ops->handle_cancelled_mid(midEntry, server);
  96
  97         midEntry->mid_state = MID_FREE;
  98         atomic_dec(&mid_count);
  99         if (midEntry->large_buf)
 100                 cifs_buf_release(midEntry->resp_buf);
 101         else
 102                 cifs_small_buf_release(midEntry->resp_buf);
 103 #ifdef CONFIG_CIFS_STATS2
 104         now = jiffies;
 105         if (now < midEntry->when_alloc)
 106                 cifs_server_dbg(VFS, "Invalid mid allocation time\n");
 107         roundtrip_time = now - midEntry->when_alloc;
 108
 109         if (smb_cmd < NUMBER_OF_SMB2_COMMANDS) {
 110                 if (atomic_read(&server->num_cmds[smb_cmd]) == 0) {
 111                         server->slowest_cmd[smb_cmd] = roundtrip_time;
 112                         server->fastest_cmd[smb_cmd] = roundtrip_time;
 113                 } else {
 114                         if (server->slowest_cmd[smb_cmd] < roundtrip_time)
 115                                 server->slowest_cmd[smb_cmd] = roundtrip_time;
 116                         else if (server->fastest_cmd[smb_cmd] > roundtrip_time)
 117                                 server->fastest_cmd[smb_cmd] = roundtrip_time;
 118                 }
 119                 cifs_stats_inc(&server->num_cmds[smb_cmd]);
 120                 server->time_per_cmd[smb_cmd] += roundtrip_time;
 121         }
 122         /*
 123          * commands taking longer than one second (default) can be indications
 124          * that something is wrong, unless it is quite a slow link or a very
 125          * busy server. Note that this calc is unlikely or impossible to wrap
 126          * as long as slow_rsp_threshold is not set way above recommended max
 127          * value (32767 ie 9 hours) and is generally harmless even if wrong
 128          * since only affects debug counters - so leaving the calc as simple
 129          * comparison rather than doing multiple conversions and overflow
 130          * checks
 131          */
 132         if ((slow_rsp_threshold != 0) &&
 133             time_after(now, midEntry->when_alloc + (slow_rsp_threshold * HZ)) &&
 134             (midEntry->command != command)) {
 135                 /*
 136                  * smb2slowcmd[NUMBER_OF_SMB2_COMMANDS] counts by command
 137                  * NB: le16_to_cpu returns unsigned so can not be negative below
 138                  */
 139                 if (smb_cmd < NUMBER_OF_SMB2_COMMANDS)
 140                         cifs_stats_inc(&server->smb2slowcmd[smb_cmd]);
 141
 142                 trace_smb3_slow_rsp(smb_cmd, midEntry->mid, midEntry->pid,
 143                                midEntry->when_sent, midEntry->when_received);
 144                 if (cifsFYI & CIFS_TIMER) {
 145                         pr_debug("slow rsp: cmd %d mid %llu",
 146                                  midEntry->command, midEntry->mid);
 147                         cifs_info("A: 0x%lx S: 0x%lx R: 0x%lx\n",
 148                                   now - midEntry->when_alloc,
 149                                   now - midEntry->when_sent,
 150                                   now - midEntry->when_received);
 151                 }
 152         }
 153 #endif
 154         put_task_struct(midEntry->creator);
 155
 156         mempool_free(midEntry, cifs_mid_poolp);
 157 }
 158
 159 void
 160 delete_mid(struct mid_q_entry *mid)
 161 {
 162         spin_lock(&mid->server->mid_lock);
 163         if (!(mid->mid_flags & MID_DELETED)) {
 164                 list_del_init(&mid->qhead);
 165                 mid->mid_flags |= MID_DELETED;
 166         }
 167         spin_unlock(&mid->server->mid_lock);
 168
 169         release_mid(mid);
 170 }
 171
 172 /*
 173  * smb_send_kvec - send an array of kvecs to the server
 174  * @server:     Server to send the data to
 175  * @smb_msg:    Message to send
 176  * @sent:       amount of data sent on socket is stored here
 177  *
 178  * Our basic "send data to server" function. Should be called with srv_mutex
 179  * held. The caller is responsible for handling the results.
 180  */
 181 static int
 182 smb_send_kvec(struct TCP_Server_Info *server, struct msghdr *smb_msg,
 183               size_t *sent)
 184 {
 185         int rc = 0;
 186         int retries = 0;
 187         struct socket *ssocket = server->ssocket;
 188
 189         *sent = 0;
 190
 191         if (server->noblocksnd)
 192                 smb_msg->msg_flags = MSG_DONTWAIT + MSG_NOSIGNAL;
 193         else
 194                 smb_msg->msg_flags = MSG_NOSIGNAL;
 195
 196         while (msg_data_left(smb_msg)) {
 197                 /*
 198                  * If blocking send, we try 3 times, since each can block
 199                  * for 5 seconds. For nonblocking  we have to try more
 200                  * but wait increasing amounts of time allowing time for
 201                  * socket to clear.  The overall time we wait in either
 202                  * case to send on the socket is about 15 seconds.
 203                  * Similarly we wait for 15 seconds for a response from
 204                  * the server in SendReceive[2] for the server to send
 205                  * a response back for most types of requests (except
 206                  * SMB Write past end of file which can be slow, and
 207                  * blocking lock operations). NFS waits slightly longer
 208                  * than CIFS, but this can make it take longer for
 209                  * nonresponsive servers to be detected and 15 seconds
 210                  * is more than enough time for modern networks to
 211                  * send a packet.  In most cases if we fail to send
 212                  * after the retries we will kill the socket and
 213                  * reconnect which may clear the network problem.
 214                  */
 215                 rc = sock_sendmsg(ssocket, smb_msg);
 216                 if (rc == -EAGAIN) {
 217                         retries++;
 218                         if (retries >= 14 ||
 219                             (!server->noblocksnd && (retries > 2))) {
 220                                 cifs_server_dbg(VFS, "sends on sock %p stuck for 15 seconds\n",
 221                                          ssocket);
 222                                 return -EAGAIN;
 223                         }
 224                         msleep(1 << retries);
 225                         continue;
 226                 }
 227
 228                 if (rc < 0)
 229                         return rc;
 230
 231                 if (rc == 0) {
 232                         /* should never happen, letting socket clear before
 233                            retrying is our only obvious option here */
 234                         cifs_server_dbg(VFS, "tcp sent no data\n");
 235                         msleep(500);
 236                         continue;
 237                 }
 238
 239                 /* send was at least partially successful */
 240                 *sent += rc;
 241                 retries = 0; /* in case we get ENOSPC on the next send */
 242         }
 243         return 0;
 244 }
 245
 246 unsigned long
 247 smb_rqst_len(struct TCP_Server_Info *server, struct smb_rqst *rqst)
 248 {
 249         unsigned int i;
 250         struct kvec *iov;
 251         int nvec;
 252         unsigned long buflen = 0;
 253
 254         if (!is_smb1(server) && rqst->rq_nvec >= 2 &&
 255             rqst->rq_iov[0].iov_len == 4) {
 256                 iov = &rqst->rq_iov[1];
 257                 nvec = rqst->rq_nvec - 1;
 258         } else {
 259                 iov = rqst->rq_iov;
 260                 nvec = rqst->rq_nvec;
 261         }
 262
 263         /* total up iov array first */
 264         for (i = 0; i < nvec; i++)
 265                 buflen += iov[i].iov_len;
 266
 267         buflen += iov_iter_count(&rqst->rq_iter);
 268         return buflen;
 269 }
 270
 271 static int
 272 __smb_send_rqst(struct TCP_Server_Info *server, int num_rqst,
 273                 struct smb_rqst *rqst)
 274 {
 275         int rc;
 276         struct kvec *iov;
 277         int n_vec;
 278         unsigned int send_length = 0;
 279         unsigned int i, j;
 280         sigset_t mask, oldmask;
 281         size_t total_len = 0, sent, size;
 282         struct socket *ssocket = server->ssocket;
 283         struct msghdr smb_msg = {};
 284         __be32 rfc1002_marker;
 285
 286         cifs_in_send_inc(server);
 287         if (cifs_rdma_enabled(server)) {
 288                 /* return -EAGAIN when connecting or reconnecting */
 289                 rc = -EAGAIN;
 290                 if (server->smbd_conn)
 291                         rc = smbd_send(server, num_rqst, rqst);
 292                 goto smbd_done;
 293         }
 294
 295         rc = -EAGAIN;
 296         if (ssocket == NULL)
 297                 goto out;
 298
 299         rc = -ERESTARTSYS;
 300         if (fatal_signal_pending(current)) {
 301                 cifs_dbg(FYI, "signal pending before send request\n");
 302                 goto out;
 303         }
 304
 305         rc = 0;
 306         /* cork the socket */
 307         tcp_sock_set_cork(ssocket->sk, true);
 308
 309         for (j = 0; j < num_rqst; j++)
 310                 send_length += smb_rqst_len(server, &rqst[j]);
 311         rfc1002_marker = cpu_to_be32(send_length);
 312
 313         /*
 314          * We should not allow signals to interrupt the network send because
 315          * any partial send will cause session reconnects thus increasing
 316          * latency of system calls and overload a server with unnecessary
 317          * requests.
 318          */
 319
 320         sigfillset(&mask);
 321         sigprocmask(SIG_BLOCK, &mask, &oldmask);
 322
 323         /* Generate a rfc1002 marker for SMB2+ */
 324         if (!is_smb1(server)) {
 325                 struct kvec hiov = {
 326                         .iov_base = &rfc1002_marker,
 327                         .iov_len  = 4
 328                 };
 329                 iov_iter_kvec(&smb_msg.msg_iter, ITER_SOURCE, &hiov, 1, 4);
 330                 rc = smb_send_kvec(server, &smb_msg, &sent);
 331                 if (rc < 0)
 332                         goto unmask;
 333
 334                 total_len += sent;
 335                 send_length += 4;
 336         }
 337
 338         cifs_dbg(FYI, "Sending smb: smb_len=%u\n", send_length);
 339
 340         for (j = 0; j < num_rqst; j++) {
 341                 iov = rqst[j].rq_iov;
 342                 n_vec = rqst[j].rq_nvec;
 343
 344                 size = 0;
 345                 for (i = 0; i < n_vec; i++) {
 346                         dump_smb(iov[i].iov_base, iov[i].iov_len);
 347                         size += iov[i].iov_len;
 348                 }
 349
 350                 iov_iter_kvec(&smb_msg.msg_iter, ITER_SOURCE, iov, n_vec, size);
 351
 352                 rc = smb_send_kvec(server, &smb_msg, &sent);
 353                 if (rc < 0)
 354                         goto unmask;
 355
 356                 total_len += sent;
 357
 358                 if (iov_iter_count(&rqst[j].rq_iter) > 0) {
 359                         smb_msg.msg_iter = rqst[j].rq_iter;
 360                         rc = smb_send_kvec(server, &smb_msg, &sent);
 361                         if (rc < 0)
 362                                 break;
 363                         total_len += sent;
 364                 }
 365
 366 }
 367
 368 unmask:
 369         sigprocmask(SIG_SETMASK, &oldmask, NULL);
 370
 371         /*
 372          * If signal is pending but we have already sent the whole packet to
 373          * the server we need to return success status to allow a corresponding
 374          * mid entry to be kept in the pending requests queue thus allowing
 375          * to handle responses from the server by the client.
 376          *
 377          * If only part of the packet has been sent there is no need to hide
 378          * interrupt because the session will be reconnected anyway, so there
 379          * won't be any response from the server to handle.
 380          */
 381
 382         if (signal_pending(current) && (total_len != send_length)) {
 383                 cifs_dbg(FYI, "signal is pending after attempt to send\n");
 384                 rc = -ERESTARTSYS;
 385         }
 386
 387         /* uncork it */
 388         tcp_sock_set_cork(ssocket->sk, false);
 389
 390         if ((total_len > 0) && (total_len != send_length)) {
 391                 cifs_dbg(FYI, "partial send (wanted=%u sent=%zu): terminating session\n",
 392                          send_length, total_len);
 393                 /*
 394                  * If we have only sent part of an SMB then the next SMB could
 395                  * be taken as the remainder of this one. We need to kill the
 396                  * socket so the server throws away the partial SMB
 397                  */
 398                 cifs_signal_cifsd_for_reconnect(server, false);
 399                 trace_smb3_partial_send_reconnect(server->CurrentMid,
 400                                                   server->conn_id, server->hostname);
 401         }
 402 smbd_done:
 403         if (rc < 0 && rc != -EINTR)
 404                 cifs_server_dbg(VFS, "Error %d sending data on socket to server\n",
 405                          rc);
 406         else if (rc > 0)
 407                 rc = 0;
 408 out:
 409         cifs_in_send_dec(server);
 410         return rc;
 411 }
 412
 413 struct send_req_vars {
 414         struct smb2_transform_hdr tr_hdr;
 415         struct smb_rqst rqst[MAX_COMPOUND];
 416         struct kvec iov;
 417 };
 418
 419 static int
 420 smb_send_rqst(struct TCP_Server_Info *server, int num_rqst,
 421               struct smb_rqst *rqst, int flags)
 422 {
 423         struct send_req_vars *vars;
 424         struct smb_rqst *cur_rqst;
 425         struct kvec *iov;
 426         int rc;
 427
 428         if (!(flags & CIFS_TRANSFORM_REQ))
 429                 return __smb_send_rqst(server, num_rqst, rqst);
 430
 431         if (num_rqst > MAX_COMPOUND - 1)
 432                 return -ENOMEM;
 433
 434         if (!server->ops->init_transform_rq) {
 435                 cifs_server_dbg(VFS, "Encryption requested but transform callback is missing\n");
 436                 return -EIO;
 437         }
 438
 439         vars = kzalloc(sizeof(*vars), GFP_NOFS);
 440         if (!vars)
 441                 return -ENOMEM;
 442         cur_rqst = vars->rqst;
 443         iov = &vars->iov;
 444
 445         iov->iov_base = &vars->tr_hdr;
 446         iov->iov_len = sizeof(vars->tr_hdr);
 447         cur_rqst[0].rq_iov = iov;
 448         cur_rqst[0].rq_nvec = 1;
 449
 450         rc = server->ops->init_transform_rq(server, num_rqst + 1,
 451                                             &cur_rqst[0], rqst);
 452         if (rc)
 453                 goto out;
 454
 455         rc = __smb_send_rqst(server, num_rqst + 1, &cur_rqst[0]);
 456         smb3_free_compound_rqst(num_rqst, &cur_rqst[1]);
 457 out:
 458         kfree(vars);
 459         return rc;
 460 }
 461
 462 int
 463 smb_send(struct TCP_Server_Info *server, struct smb_hdr *smb_buffer,
 464          unsigned int smb_buf_length)
 465 {
 466         struct kvec iov[2];
 467         struct smb_rqst rqst = { .rq_iov = iov,
 468                                  .rq_nvec = 2 };
 469
 470         iov[0].iov_base = smb_buffer;
 471         iov[0].iov_len = 4;
 472         iov[1].iov_base = (char *)smb_buffer + 4;
 473         iov[1].iov_len = smb_buf_length;
 474
 475         return __smb_send_rqst(server, 1, &rqst);
 476 }
 477
 478 static int
 479 wait_for_free_credits(struct TCP_Server_Info *server, const int num_credits,
 480                       const int timeout, const int flags,
 481                       unsigned int *instance)
 482 {
 483         long rc;
 484         int *credits;
 485         int optype;
 486         long int t;
 487         int scredits, in_flight;
 488
 489         if (timeout < 0)
 490                 t = MAX_JIFFY_OFFSET;
 491         else
 492                 t = msecs_to_jiffies(timeout);
 493
 494         optype = flags & CIFS_OP_MASK;
 495
 496         *instance = 0;
 497
 498         credits = server->ops->get_credits_field(server, optype);
 499         /* Since an echo is already inflight, no need to wait to send another */
 500         if (*credits <= 0 && optype == CIFS_ECHO_OP)
 501                 return -EAGAIN;
 502
 503         spin_lock(&server->req_lock);
 504         if ((flags & CIFS_TIMEOUT_MASK) == CIFS_NON_BLOCKING) {
 505                 /* oplock breaks must not be held up */
 506                 server->in_flight++;
 507                 if (server->in_flight > server->max_in_flight)
 508                         server->max_in_flight = server->in_flight;
 509                 *credits -= 1;
 510                 *instance = server->reconnect_instance;
 511                 scredits = *credits;
 512                 in_flight = server->in_flight;
 513                 spin_unlock(&server->req_lock);
 514
 515                 trace_smb3_nblk_credits(server->CurrentMid,
 516                                 server->conn_id, server->hostname, scredits, -1, in_flight);
 517                 cifs_dbg(FYI, "%s: remove %u credits total=%d\n",
 518                                 __func__, 1, scredits);
 519
 520                 return 0;
 521         }
 522
 523         while (1) {
 524                 spin_unlock(&server->req_lock);
 525
 526                 spin_lock(&server->srv_lock);
 527                 if (server->tcpStatus == CifsExiting) {
 528                         spin_unlock(&server->srv_lock);
 529                         return -ENOENT;
 530                 }
 531                 spin_unlock(&server->srv_lock);
 532
 533                 spin_lock(&server->req_lock);
 534                 if (*credits < num_credits) {
 535                         scredits = *credits;
 536                         spin_unlock(&server->req_lock);
 537
 538                         cifs_num_waiters_inc(server);
 539                         rc = wait_event_killable_timeout(server->request_q,
 540                                 has_credits(server, credits, num_credits), t);
 541                         cifs_num_waiters_dec(server);
 542                         if (!rc) {
 543                                 spin_lock(&server->req_lock);
 544                                 scredits = *credits;
 545                                 in_flight = server->in_flight;
 546                                 spin_unlock(&server->req_lock);
 547
 548                                 trace_smb3_credit_timeout(server->CurrentMid,
 549                                                 server->conn_id, server->hostname, scredits,
 550                                                 num_credits, in_flight);
 551                                 cifs_server_dbg(VFS, "wait timed out after %d ms\n",
 552                                                 timeout);
 553                                 return -EBUSY;
 554                         }
 555                         if (rc == -ERESTARTSYS)
 556                                 return -ERESTARTSYS;
 557                         spin_lock(&server->req_lock);
 558                 } else {
 559                         /*
 560                          * For normal commands, reserve the last MAX_COMPOUND
 561                          * credits to compound requests.
 562                          * Otherwise these compounds could be permanently
 563                          * starved for credits by single-credit requests.
 564                          *
 565                          * To prevent spinning CPU, block this thread until
 566                          * there are >MAX_COMPOUND credits available.
 567                          * But only do this is we already have a lot of
 568                          * credits in flight to avoid triggering this check
 569                          * for servers that are slow to hand out credits on
 570                          * new sessions.
 571                          */
 572                         if (!optype && num_credits == 1 &&
 573                             server->in_flight > 2 * MAX_COMPOUND &&
 574                             *credits <= MAX_COMPOUND) {
 575                                 spin_unlock(&server->req_lock);
 576
 577                                 cifs_num_waiters_inc(server);
 578                                 rc = wait_event_killable_timeout(
 579                                         server->request_q,
 580                                         has_credits(server, credits,
 581                                                     MAX_COMPOUND + 1),
 582                                         t);
 583                                 cifs_num_waiters_dec(server);
 584                                 if (!rc) {
 585                                         spin_lock(&server->req_lock);
 586                                         scredits = *credits;
 587                                         in_flight = server->in_flight;
 588                                         spin_unlock(&server->req_lock);
 589
 590                                         trace_smb3_credit_timeout(
 591                                                         server->CurrentMid,
 592                                                         server->conn_id, server->hostname,
 593                                                         scredits, num_credits, in_flight);
 594                                         cifs_server_dbg(VFS, "wait timed out after %d ms\n",
 595                                                         timeout);
 596                                         return -EBUSY;
 597                                 }
 598                                 if (rc == -ERESTARTSYS)
 599                                         return -ERESTARTSYS;
 600                                 spin_lock(&server->req_lock);
 601                                 continue;
 602                         }
 603
 604                         /*
 605                          * Can not count locking commands against total
 606                          * as they are allowed to block on server.
 607                          */
 608
 609                         /* update # of requests on the wire to server */
 610                         if ((flags & CIFS_TIMEOUT_MASK) != CIFS_BLOCKING_OP) {
 611                                 *credits -= num_credits;
 612                                 server->in_flight += num_credits;
 613                                 if (server->in_flight > server->max_in_flight)
 614                                         server->max_in_flight = server->in_flight;
 615                                 *instance = server->reconnect_instance;
 616                         }
 617                         scredits = *credits;
 618                         in_flight = server->in_flight;
 619                         spin_unlock(&server->req_lock);
 620
 621                         trace_smb3_waitff_credits(server->CurrentMid,
 622                                         server->conn_id, server->hostname, scredits,
 623                                         -(num_credits), in_flight);
 624                         cifs_dbg(FYI, "%s: remove %u credits total=%d\n",
 625                                         __func__, num_credits, scredits);
 626                         break;
 627                 }
 628         }
 629         return 0;
 630 }
 631
 632 static int
 633 wait_for_free_request(struct TCP_Server_Info *server, const int flags,
 634                       unsigned int *instance)
 635 {
 636         return wait_for_free_credits(server, 1, -1, flags,
 637                                      instance);
 638 }
 639
 640 static int
 641 wait_for_compound_request(struct TCP_Server_Info *server, int num,
 642                           const int flags, unsigned int *instance)
 643 {
 644         int *credits;
 645         int scredits, in_flight;
 646
 647         credits = server->ops->get_credits_field(server, flags & CIFS_OP_MASK);
 648
 649         spin_lock(&server->req_lock);
 650         scredits = *credits;
 651         in_flight = server->in_flight;
 652
 653         if (*credits < num) {
 654                 /*
 655                  * If the server is tight on resources or just gives us less
 656                  * credits for other reasons (e.g. requests are coming out of
 657                  * order and the server delays granting more credits until it
 658                  * processes a missing mid) and we exhausted most available
 659                  * credits there may be situations when we try to send
 660                  * a compound request but we don't have enough credits. At this
 661                  * point the client needs to decide if it should wait for
 662                  * additional credits or fail the request. If at least one
 663                  * request is in flight there is a high probability that the
 664                  * server will return enough credits to satisfy this compound
 665                  * request.
 666                  *
 667                  * Return immediately if no requests in flight since we will be
 668                  * stuck on waiting for credits.
 669                  */
 670                 if (server->in_flight == 0) {
 671                         spin_unlock(&server->req_lock);
 672                         trace_smb3_insufficient_credits(server->CurrentMid,
 673                                         server->conn_id, server->hostname, scredits,
 674                                         num, in_flight);
 675                         cifs_dbg(FYI, "%s: %d requests in flight, needed %d total=%d\n",
 676                                         __func__, in_flight, num, scredits);
 677                         return -EDEADLK;
 678                 }
 679         }
 680         spin_unlock(&server->req_lock);
 681
 682         return wait_for_free_credits(server, num, 60000, flags,
 683                                      instance);
 684 }
 685
 686 int
 687 cifs_wait_mtu_credits(struct TCP_Server_Info *server, unsigned int size,
 688                       unsigned int *num, struct cifs_credits *credits)
 689 {
 690         *num = size;
 691         credits->value = 0;
 692         credits->instance = server->reconnect_instance;
 693         return 0;
 694 }
 695
 696 static int allocate_mid(struct cifs_ses *ses, struct smb_hdr *in_buf,
 697                         struct mid_q_entry **ppmidQ)
 698 {
 699         spin_lock(&ses->ses_lock);
 700         if (ses->ses_status == SES_NEW) {
 701                 if ((in_buf->Command != SMB_COM_SESSION_SETUP_ANDX) &&
 702                         (in_buf->Command != SMB_COM_NEGOTIATE)) {
 703                         spin_unlock(&ses->ses_lock);
 704                         return -EAGAIN;
 705                 }
 706                 /* else ok - we are setting up session */
 707         }
 708
 709         if (ses->ses_status == SES_EXITING) {
 710                 /* check if SMB session is bad because we are setting it up */
 711                 if (in_buf->Command != SMB_COM_LOGOFF_ANDX) {
 712                         spin_unlock(&ses->ses_lock);
 713                         return -EAGAIN;
 714                 }
 715                 /* else ok - we are shutting down session */
 716         }
 717         spin_unlock(&ses->ses_lock);
 718
 719         *ppmidQ = alloc_mid(in_buf, ses->server);
 720         if (*ppmidQ == NULL)
 721                 return -ENOMEM;
 722         spin_lock(&ses->server->mid_lock);
 723         list_add_tail(&(*ppmidQ)->qhead, &ses->server->pending_mid_q);
 724         spin_unlock(&ses->server->mid_lock);
 725         return 0;
 726 }
 727
 728 static int
 729 wait_for_response(struct TCP_Server_Info *server, struct mid_q_entry *midQ)
 730 {
 731         int error;
 732
 733         error = wait_event_state(server->response_q,
 734                                  midQ->mid_state != MID_REQUEST_SUBMITTED &&
 735                                  midQ->mid_state != MID_RESPONSE_RECEIVED,
 736                                  (TASK_KILLABLE|TASK_FREEZABLE_UNSAFE));
 737         if (error < 0)
 738                 return -ERESTARTSYS;
 739
 740         return 0;
 741 }
 742
 743 struct mid_q_entry *
 744 cifs_setup_async_request(struct TCP_Server_Info *server, struct smb_rqst *rqst)
 745 {
 746         int rc;
 747         struct smb_hdr *hdr = (struct smb_hdr *)rqst->rq_iov[0].iov_base;
 748         struct mid_q_entry *mid;
 749
 750         if (rqst->rq_iov[0].iov_len != 4 ||
 751             rqst->rq_iov[0].iov_base + 4 != rqst->rq_iov[1].iov_base)
 752                 return ERR_PTR(-EIO);
 753
 754         /* enable signing if server requires it */
 755         if (server->sign)
 756                 hdr->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
 757
 758         mid = alloc_mid(hdr, server);
 759         if (mid == NULL)
 760                 return ERR_PTR(-ENOMEM);
 761
 762         rc = cifs_sign_rqst(rqst, server, &mid->sequence_number);
 763         if (rc) {
 764                 release_mid(mid);
 765                 return ERR_PTR(rc);
 766         }
 767
 768         return mid;
 769 }
 770
 771 /*
 772  * Send a SMB request and set the callback function in the mid to handle
 773  * the result. Caller is responsible for dealing with timeouts.
 774  */
 775 int
 776 cifs_call_async(struct TCP_Server_Info *server, struct smb_rqst *rqst,
 777                 mid_receive_t *receive, mid_callback_t *callback,
 778                 mid_handle_t *handle, void *cbdata, const int flags,
 779                 const struct cifs_credits *exist_credits)
 780 {
 781         int rc;
 782         struct mid_q_entry *mid;
 783         struct cifs_credits credits = { .value = 0, .instance = 0 };
 784         unsigned int instance;
 785         int optype;
 786
 787         optype = flags & CIFS_OP_MASK;
 788
 789         if ((flags & CIFS_HAS_CREDITS) == 0) {
 790                 rc = wait_for_free_request(server, flags, &instance);
 791                 if (rc)
 792                         return rc;
 793                 credits.value = 1;
 794                 credits.instance = instance;
 795         } else
 796                 instance = exist_credits->instance;
 797
 798         cifs_server_lock(server);
 799
 800         /*
 801          * We can't use credits obtained from the previous session to send this
 802          * request. Check if there were reconnects after we obtained credits and
 803          * return -EAGAIN in such cases to let callers handle it.
 804          */
 805         if (instance != server->reconnect_instance) {
 806                 cifs_server_unlock(server);
 807                 add_credits_and_wake_if(server, &credits, optype);
 808                 return -EAGAIN;
 809         }
 810
 811         mid = server->ops->setup_async_request(server, rqst);
 812         if (IS_ERR(mid)) {
 813                 cifs_server_unlock(server);
 814                 add_credits_and_wake_if(server, &credits, optype);
 815                 return PTR_ERR(mid);
 816         }
 817
 818         mid->receive = receive;
 819         mid->callback = callback;
 820         mid->callback_data = cbdata;
 821         mid->handle = handle;
 822         mid->mid_state = MID_REQUEST_SUBMITTED;
 823
 824         /* put it on the pending_mid_q */
 825         spin_lock(&server->mid_lock);
 826         list_add_tail(&mid->qhead, &server->pending_mid_q);
 827         spin_unlock(&server->mid_lock);
 828
 829         /*
 830          * Need to store the time in mid before calling I/O. For call_async,
 831          * I/O response may come back and free the mid entry on another thread.
 832          */
 833         cifs_save_when_sent(mid);
 834         rc = smb_send_rqst(server, 1, rqst, flags);
 835
 836         if (rc < 0) {
 837                 revert_current_mid(server, mid->credits);
 838                 server->sequence_number -= 2;
 839                 delete_mid(mid);
 840         }
 841
 842         cifs_server_unlock(server);
 843
 844         if (rc == 0)
 845                 return 0;
 846
 847         add_credits_and_wake_if(server, &credits, optype);
 848         return rc;
 849 }
 850
 851 /*
 852  *
 853  * Send an SMB Request.  No response info (other than return code)
 854  * needs to be parsed.
 855  *
 856  * flags indicate the type of request buffer and how long to wait
 857  * and whether to log NT STATUS code (error) before mapping it to POSIX error
 858  *
 859  */
 860 int
 861 SendReceiveNoRsp(const unsigned int xid, struct cifs_ses *ses,
 862                  char *in_buf, int flags)
 863 {
 864         int rc;
 865         struct kvec iov[1];
 866         struct kvec rsp_iov;
 867         int resp_buf_type;
 868
 869         iov[0].iov_base = in_buf;
 870         iov[0].iov_len = get_rfc1002_length(in_buf) + 4;
 871         flags |= CIFS_NO_RSP_BUF;
 872         rc = SendReceive2(xid, ses, iov, 1, &resp_buf_type, flags, &rsp_iov);
 873         cifs_dbg(NOISY, "SendRcvNoRsp flags %d rc %d\n", flags, rc);
 874
 875         return rc;
 876 }
 877
 878 static int
 879 cifs_sync_mid_result(struct mid_q_entry *mid, struct TCP_Server_Info *server)
 880 {
 881         int rc = 0;
 882
 883         cifs_dbg(FYI, "%s: cmd=%d mid=%llu state=%d\n",
 884                  __func__, le16_to_cpu(mid->command), mid->mid, mid->mid_state);
 885
 886         spin_lock(&server->mid_lock);
 887         switch (mid->mid_state) {
 888         case MID_RESPONSE_READY:
 889                 spin_unlock(&server->mid_lock);
 890                 return rc;
 891         case MID_RETRY_NEEDED:
 892                 rc = -EAGAIN;
 893                 break;
 894         case MID_RESPONSE_MALFORMED:
 895                 rc = -EIO;
 896                 break;
 897         case MID_SHUTDOWN:
 898                 rc = -EHOSTDOWN;
 899                 break;
 900         default:
 901                 if (!(mid->mid_flags & MID_DELETED)) {
 902                         list_del_init(&mid->qhead);
 903                         mid->mid_flags |= MID_DELETED;
 904                 }
 905                 cifs_server_dbg(VFS, "%s: invalid mid state mid=%llu state=%d\n",
 906                          __func__, mid->mid, mid->mid_state);
 907                 rc = -EIO;
 908         }
 909         spin_unlock(&server->mid_lock);
 910
 911         release_mid(mid);
 912         return rc;
 913 }
 914
 915 static inline int
 916 send_cancel(struct TCP_Server_Info *server, struct smb_rqst *rqst,
 917             struct mid_q_entry *mid)
 918 {
 919         return server->ops->send_cancel ?
 920                                 server->ops->send_cancel(server, rqst, mid) : 0;
 921 }
 922
 923 int
 924 cifs_check_receive(struct mid_q_entry *mid, struct TCP_Server_Info *server,
 925                    bool log_error)
 926 {
 927         unsigned int len = get_rfc1002_length(mid->resp_buf) + 4;
 928
 929         dump_smb(mid->resp_buf, min_t(u32, 92, len));
 930
 931         /* convert the length into a more usable form */
 932         if (server->sign) {
 933                 struct kvec iov[2];
 934                 int rc = 0;
 935                 struct smb_rqst rqst = { .rq_iov = iov,
 936                                          .rq_nvec = 2 };
 937
 938                 iov[0].iov_base = mid->resp_buf;
 939                 iov[0].iov_len = 4;
 940                 iov[1].iov_base = (char *)mid->resp_buf + 4;
 941                 iov[1].iov_len = len - 4;
 942                 /* FIXME: add code to kill session */
 943                 rc = cifs_verify_signature(&rqst, server,
 944                                            mid->sequence_number);
 945                 if (rc)
 946                         cifs_server_dbg(VFS, "SMB signature verification returned error = %d\n",
 947                                  rc);
 948         }
 949
 950         /* BB special case reconnect tid and uid here? */
 951         return map_and_check_smb_error(mid, log_error);
 952 }
 953
 954 struct mid_q_entry *
 955 cifs_setup_request(struct cifs_ses *ses, struct TCP_Server_Info *ignored,
 956                    struct smb_rqst *rqst)
 957 {
 958         int rc;
 959         struct smb_hdr *hdr = (struct smb_hdr *)rqst->rq_iov[0].iov_base;
 960         struct mid_q_entry *mid;
 961
 962         if (rqst->rq_iov[0].iov_len != 4 ||
 963             rqst->rq_iov[0].iov_base + 4 != rqst->rq_iov[1].iov_base)
 964                 return ERR_PTR(-EIO);
 965
 966         rc = allocate_mid(ses, hdr, &mid);
 967         if (rc)
 968                 return ERR_PTR(rc);
 969         rc = cifs_sign_rqst(rqst, ses->server, &mid->sequence_number);
 970         if (rc) {
 971                 delete_mid(mid);
 972                 return ERR_PTR(rc);
 973         }
 974         return mid;
 975 }
 976
 977 static void
 978 cifs_compound_callback(struct mid_q_entry *mid)
 979 {
 980         struct TCP_Server_Info *server = mid->server;
 981         struct cifs_credits credits;
 982
 983         credits.value = server->ops->get_credits(mid);
 984         credits.instance = server->reconnect_instance;
 985
 986         add_credits(server, &credits, mid->optype);
 987
 988         if (mid->mid_state == MID_RESPONSE_RECEIVED)
 989                 mid->mid_state = MID_RESPONSE_READY;
 990 }
 991
 992 static void
 993 cifs_compound_last_callback(struct mid_q_entry *mid)
 994 {
 995         cifs_compound_callback(mid);
 996         cifs_wake_up_task(mid);
 997 }
 998
 999 static void
1000 cifs_cancelled_callback(struct mid_q_entry *mid)
1001 {
1002         cifs_compound_callback(mid);
1003         release_mid(mid);
1004 }
1005
1006 /*
1007  * Return a channel (master if none) of @ses that can be used to send
1008  * regular requests.
1009  *
1010  * If we are currently binding a new channel (negprot/sess.setup),
1011  * return the new incomplete channel.
1012  */
1013 struct TCP_Server_Info *cifs_pick_channel(struct cifs_ses *ses)
1014 {
1015         uint index = 0;
1016         unsigned int min_in_flight = UINT_MAX, max_in_flight = 0;
1017         struct TCP_Server_Info *server = NULL;
1018         int i;
1019
1020         if (!ses)
1021                 return NULL;
1022
1023         spin_lock(&ses->chan_lock);
1024         for (i = 0; i < ses->chan_count; i++) {
1025                 server = ses->chans[i].server;
1026                 if (!server || server->terminate)
1027                         continue;
1028
1029                 /*
1030                  * strictly speaking, we should pick up req_lock to read
1031                  * server->in_flight. But it shouldn't matter much here if we
1032                  * race while reading this data. The worst that can happen is
1033                  * that we could use a channel that's not least loaded. Avoiding
1034                  * taking the lock could help reduce wait time, which is
1035                  * important for this function
1036                  */
1037                 if (server->in_flight < min_in_flight) {
1038                         min_in_flight = server->in_flight;
1039                         index = i;
1040                 }
1041                 if (server->in_flight > max_in_flight)
1042                         max_in_flight = server->in_flight;
1043         }
1044
1045         /* if all channels are equally loaded, fall back to round-robin */
1046         if (min_in_flight == max_in_flight) {
1047                 index = (uint)atomic_inc_return(&ses->chan_seq);
1048                 index %= ses->chan_count;
1049         }
1050         spin_unlock(&ses->chan_lock);
1051
1052         return ses->chans[index].server;
1053 }
1054
1055 int
1056 compound_send_recv(const unsigned int xid, struct cifs_ses *ses,
1057                    struct TCP_Server_Info *server,
1058                    const int flags, const int num_rqst, struct smb_rqst *rqst,
1059                    int *resp_buf_type, struct kvec *resp_iov)
1060 {
1061         int i, j, optype, rc = 0;
1062         struct mid_q_entry *midQ[MAX_COMPOUND];
1063         bool cancelled_mid[MAX_COMPOUND] = {false};
1064         struct cifs_credits credits[MAX_COMPOUND] = {
1065                 { .value = 0, .instance = 0 }
1066         };
1067         unsigned int instance;
1068         char *buf;
1069
1070         optype = flags & CIFS_OP_MASK;
1071
1072         for (i = 0; i < num_rqst; i++)
1073                 resp_buf_type[i] = CIFS_NO_BUFFER;  /* no response buf yet */
1074
1075         if (!ses || !ses->server || !server) {
1076                 cifs_dbg(VFS, "Null session\n");
1077                 return -EIO;
1078         }
1079
1080         spin_lock(&server->srv_lock);
1081         if (server->tcpStatus == CifsExiting) {
1082                 spin_unlock(&server->srv_lock);
1083                 return -ENOENT;
1084         }
1085         spin_unlock(&server->srv_lock);
1086
1087         /*
1088          * Wait for all the requests to become available.
1089          * This approach still leaves the possibility to be stuck waiting for
1090          * credits if the server doesn't grant credits to the outstanding
1091          * requests and if the client is completely idle, not generating any
1092          * other requests.
1093          * This can be handled by the eventual session reconnect.
1094          */
1095         rc = wait_for_compound_request(server, num_rqst, flags,
1096                                        &instance);
1097         if (rc)
1098                 return rc;
1099
1100         for (i = 0; i < num_rqst; i++) {
1101                 credits[i].value = 1;
1102                 credits[i].instance = instance;
1103         }
1104
1105         /*
1106          * Make sure that we sign in the same order that we send on this socket
1107          * and avoid races inside tcp sendmsg code that could cause corruption
1108          * of smb data.
1109          */
1110
1111         cifs_server_lock(server);
1112
1113         /*
1114          * All the parts of the compound chain belong obtained credits from the
1115          * same session. We can not use credits obtained from the previous
1116          * session to send this request. Check if there were reconnects after
1117          * we obtained credits and return -EAGAIN in such cases to let callers
1118          * handle it.
1119          */
1120         if (instance != server->reconnect_instance) {
1121                 cifs_server_unlock(server);
1122                 for (j = 0; j < num_rqst; j++)
1123                         add_credits(server, &credits[j], optype);
1124                 return -EAGAIN;
1125         }
1126
1127         for (i = 0; i < num_rqst; i++) {
1128                 midQ[i] = server->ops->setup_request(ses, server, &rqst[i]);
1129                 if (IS_ERR(midQ[i])) {
1130                         revert_current_mid(server, i);
1131                         for (j = 0; j < i; j++)
1132                                 delete_mid(midQ[j]);
1133                         cifs_server_unlock(server);
1134
1135                         /* Update # of requests on wire to server */
1136                         for (j = 0; j < num_rqst; j++)
1137                                 add_credits(server, &credits[j], optype);
1138                         return PTR_ERR(midQ[i]);
1139                 }
1140
1141                 midQ[i]->mid_state = MID_REQUEST_SUBMITTED;
1142                 midQ[i]->optype = optype;
1143                 /*
1144                  * Invoke callback for every part of the compound chain
1145                  * to calculate credits properly. Wake up this thread only when
1146                  * the last element is received.
1147                  */
1148                 if (i < num_rqst - 1)
1149                         midQ[i]->callback = cifs_compound_callback;
1150                 else
1151                         midQ[i]->callback = cifs_compound_last_callback;
1152         }
1153         rc = smb_send_rqst(server, num_rqst, rqst, flags);
1154
1155         for (i = 0; i < num_rqst; i++)
1156                 cifs_save_when_sent(midQ[i]);
1157
1158         if (rc < 0) {
1159                 revert_current_mid(server, num_rqst);
1160                 server->sequence_number -= 2;
1161         }
1162
1163         cifs_server_unlock(server);
1164
1165         /*
1166          * If sending failed for some reason or it is an oplock break that we
1167          * will not receive a response to - return credits back
1168          */
1169         if (rc < 0 || (flags & CIFS_NO_SRV_RSP)) {
1170                 for (i = 0; i < num_rqst; i++)
1171                         add_credits(server, &credits[i], optype);
1172                 goto out;
1173         }
1174
1175         /*
1176          * At this point the request is passed to the network stack - we assume
1177          * that any credits taken from the server structure on the client have
1178          * been spent and we can't return them back. Once we receive responses
1179          * we will collect credits granted by the server in the mid callbacks
1180          * and add those credits to the server structure.
1181          */
1182
1183         /*
1184          * Compounding is never used during session establish.
1185          */
1186         spin_lock(&ses->ses_lock);
1187         if ((ses->ses_status == SES_NEW) || (optype & CIFS_NEG_OP) || (optype & CIFS_SESS_OP)) {
1188                 spin_unlock(&ses->ses_lock);
1189
1190                 cifs_server_lock(server);
1191                 smb311_update_preauth_hash(ses, server, rqst[0].rq_iov, rqst[0].rq_nvec);
1192                 cifs_server_unlock(server);
1193
1194                 spin_lock(&ses->ses_lock);
1195         }
1196         spin_unlock(&ses->ses_lock);
1197
1198         for (i = 0; i < num_rqst; i++) {
1199                 rc = wait_for_response(server, midQ[i]);
1200                 if (rc != 0)
1201                         break;
1202         }
1203         if (rc != 0) {
1204                 for (; i < num_rqst; i++) {
1205                         cifs_server_dbg(FYI, "Cancelling wait for mid %llu cmd: %d\n",
1206                                  midQ[i]->mid, le16_to_cpu(midQ[i]->command));
1207                         send_cancel(server, &rqst[i], midQ[i]);
1208                         spin_lock(&server->mid_lock);
1209                         midQ[i]->mid_flags |= MID_WAIT_CANCELLED;
1210                         if (midQ[i]->mid_state == MID_REQUEST_SUBMITTED ||
1211                             midQ[i]->mid_state == MID_RESPONSE_RECEIVED) {
1212                                 midQ[i]->callback = cifs_cancelled_callback;
1213                                 cancelled_mid[i] = true;
1214                                 credits[i].value = 0;
1215                         }
1216                         spin_unlock(&server->mid_lock);
1217                 }
1218         }
1219
1220         for (i = 0; i < num_rqst; i++) {
1221                 if (rc < 0)
1222                         goto out;
1223
1224                 rc = cifs_sync_mid_result(midQ[i], server);
1225                 if (rc != 0) {
1226                         /* mark this mid as cancelled to not free it below */
1227                         cancelled_mid[i] = true;
1228                         goto out;
1229                 }
1230
1231                 if (!midQ[i]->resp_buf ||
1232                     midQ[i]->mid_state != MID_RESPONSE_READY) {
1233                         rc = -EIO;
1234                         cifs_dbg(FYI, "Bad MID state?\n");
1235                         goto out;
1236                 }
1237
1238                 buf = (char *)midQ[i]->resp_buf;
1239                 resp_iov[i].iov_base = buf;
1240                 resp_iov[i].iov_len = midQ[i]->resp_buf_size +
1241                         HEADER_PREAMBLE_SIZE(server);
1242
1243                 if (midQ[i]->large_buf)
1244                         resp_buf_type[i] = CIFS_LARGE_BUFFER;
1245                 else
1246                         resp_buf_type[i] = CIFS_SMALL_BUFFER;
1247
1248                 rc = server->ops->check_receive(midQ[i], server,
1249                                                      flags & CIFS_LOG_ERROR);
1250
1251                 /* mark it so buf will not be freed by delete_mid */
1252                 if ((flags & CIFS_NO_RSP_BUF) == 0)
1253                         midQ[i]->resp_buf = NULL;
1254
1255         }
1256
1257         /*
1258          * Compounding is never used during session establish.
1259          */
1260         spin_lock(&ses->ses_lock);
1261         if ((ses->ses_status == SES_NEW) || (optype & CIFS_NEG_OP) || (optype & CIFS_SESS_OP)) {
1262                 struct kvec iov = {
1263                         .iov_base = resp_iov[0].iov_base,
1264                         .iov_len = resp_iov[0].iov_len
1265                 };
1266                 spin_unlock(&ses->ses_lock);
1267                 cifs_server_lock(server);
1268                 smb311_update_preauth_hash(ses, server, &iov, 1);
1269                 cifs_server_unlock(server);
1270                 spin_lock(&ses->ses_lock);
1271         }
1272         spin_unlock(&ses->ses_lock);
1273
1274 out:
1275         /*
1276          * This will dequeue all mids. After this it is important that the
1277          * demultiplex_thread will not process any of these mids any futher.
1278          * This is prevented above by using a noop callback that will not
1279          * wake this thread except for the very last PDU.
1280          */
1281         for (i = 0; i < num_rqst; i++) {
1282                 if (!cancelled_mid[i])
1283                         delete_mid(midQ[i]);
1284         }
1285
1286         return rc;
1287 }
1288
1289 int
1290 cifs_send_recv(const unsigned int xid, struct cifs_ses *ses,
1291                struct TCP_Server_Info *server,
1292                struct smb_rqst *rqst, int *resp_buf_type, const int flags,
1293                struct kvec *resp_iov)
1294 {
1295         return compound_send_recv(xid, ses, server, flags, 1,
1296                                   rqst, resp_buf_type, resp_iov);
1297 }
1298
1299 int
1300 SendReceive2(const unsigned int xid, struct cifs_ses *ses,
1301              struct kvec *iov, int n_vec, int *resp_buf_type /* ret */,
1302              const int flags, struct kvec *resp_iov)
1303 {
1304         struct smb_rqst rqst;
1305         struct kvec s_iov[CIFS_MAX_IOV_SIZE], *new_iov;
1306         int rc;
1307
1308         if (n_vec + 1 > CIFS_MAX_IOV_SIZE) {
1309                 new_iov = kmalloc_array(n_vec + 1, sizeof(struct kvec),
1310                                         GFP_KERNEL);
1311                 if (!new_iov) {
1312                         /* otherwise cifs_send_recv below sets resp_buf_type */
1313                         *resp_buf_type = CIFS_NO_BUFFER;
1314                         return -ENOMEM;
1315                 }
1316         } else
1317                 new_iov = s_iov;
1318
1319         /* 1st iov is a RFC1001 length followed by the rest of the packet */
1320         memcpy(new_iov + 1, iov, (sizeof(struct kvec) * n_vec));
1321
1322         new_iov[0].iov_base = new_iov[1].iov_base;
1323         new_iov[0].iov_len = 4;
1324         new_iov[1].iov_base += 4;
1325         new_iov[1].iov_len -= 4;
1326
1327         memset(&rqst, 0, sizeof(struct smb_rqst));
1328         rqst.rq_iov = new_iov;
1329         rqst.rq_nvec = n_vec + 1;
1330
1331         rc = cifs_send_recv(xid, ses, ses->server,
1332                             &rqst, resp_buf_type, flags, resp_iov);
1333         if (n_vec + 1 > CIFS_MAX_IOV_SIZE)
1334                 kfree(new_iov);
1335         return rc;
1336 }
1337
1338 int
1339 SendReceive(const unsigned int xid, struct cifs_ses *ses,
1340             struct smb_hdr *in_buf, struct smb_hdr *out_buf,
1341             int *pbytes_returned, const int flags)
1342 {
1343         int rc = 0;
1344         struct mid_q_entry *midQ;
1345         unsigned int len = be32_to_cpu(in_buf->smb_buf_length);
1346         struct kvec iov = { .iov_base = in_buf, .iov_len = len };
1347         struct smb_rqst rqst = { .rq_iov = &iov, .rq_nvec = 1 };
1348         struct cifs_credits credits = { .value = 1, .instance = 0 };
1349         struct TCP_Server_Info *server;
1350
1351         if (ses == NULL) {
1352                 cifs_dbg(VFS, "Null smb session\n");
1353                 return -EIO;
1354         }
1355         server = ses->server;
1356         if (server == NULL) {
1357                 cifs_dbg(VFS, "Null tcp session\n");
1358                 return -EIO;
1359         }
1360
1361         spin_lock(&server->srv_lock);
1362         if (server->tcpStatus == CifsExiting) {
1363                 spin_unlock(&server->srv_lock);
1364                 return -ENOENT;
1365         }
1366         spin_unlock(&server->srv_lock);
1367
1368         /* Ensure that we do not send more than 50 overlapping requests
1369            to the same server. We may make this configurable later or
1370            use ses->maxReq */
1371
1372         if (len > CIFSMaxBufSize + MAX_CIFS_HDR_SIZE - 4) {
1373                 cifs_server_dbg(VFS, "Invalid length, greater than maximum frame, %d\n",
1374                                 len);
1375                 return -EIO;
1376         }
1377
1378         rc = wait_for_free_request(server, flags, &credits.instance);
1379         if (rc)
1380                 return rc;
1381
1382         /* make sure that we sign in the same order that we send on this socket
1383            and avoid races inside tcp sendmsg code that could cause corruption
1384            of smb data */
1385
1386         cifs_server_lock(server);
1387
1388         rc = allocate_mid(ses, in_buf, &midQ);
1389         if (rc) {
1390                 cifs_server_unlock(server);
1391                 /* Update # of requests on wire to server */
1392                 add_credits(server, &credits, 0);
1393                 return rc;
1394         }
1395
1396         rc = cifs_sign_smb(in_buf, server, &midQ->sequence_number);
1397         if (rc) {
1398                 cifs_server_unlock(server);
1399                 goto out;
1400         }
1401
1402         midQ->mid_state = MID_REQUEST_SUBMITTED;
1403
1404         rc = smb_send(server, in_buf, len);
1405         cifs_save_when_sent(midQ);
1406
1407         if (rc < 0)
1408                 server->sequence_number -= 2;
1409
1410         cifs_server_unlock(server);
1411
1412         if (rc < 0)
1413                 goto out;
1414
1415         rc = wait_for_response(server, midQ);
1416         if (rc != 0) {
1417                 send_cancel(server, &rqst, midQ);
1418                 spin_lock(&server->mid_lock);
1419                 if (midQ->mid_state == MID_REQUEST_SUBMITTED ||
1420                     midQ->mid_state == MID_RESPONSE_RECEIVED) {
1421                         /* no longer considered to be "in-flight" */
1422                         midQ->callback = release_mid;
1423                         spin_unlock(&server->mid_lock);
1424                         add_credits(server, &credits, 0);
1425                         return rc;
1426                 }
1427                 spin_unlock(&server->mid_lock);
1428         }
1429
1430         rc = cifs_sync_mid_result(midQ, server);
1431         if (rc != 0) {
1432                 add_credits(server, &credits, 0);
1433                 return rc;
1434         }
1435
1436         if (!midQ->resp_buf || !out_buf ||
1437             midQ->mid_state != MID_RESPONSE_READY) {
1438                 rc = -EIO;
1439                 cifs_server_dbg(VFS, "Bad MID state?\n");
1440                 goto out;
1441         }
1442
1443         *pbytes_returned = get_rfc1002_length(midQ->resp_buf);
1444         memcpy(out_buf, midQ->resp_buf, *pbytes_returned + 4);
1445         rc = cifs_check_receive(midQ, server, 0);
1446 out:
1447         delete_mid(midQ);
1448         add_credits(server, &credits, 0);
1449
1450         return rc;
1451 }
1452
1453 /* We send a LOCKINGX_CANCEL_LOCK to cause the Windows
1454    blocking lock to return. */
1455
1456 static int
1457 send_lock_cancel(const unsigned int xid, struct cifs_tcon *tcon,
1458                         struct smb_hdr *in_buf,
1459                         struct smb_hdr *out_buf)
1460 {
1461         int bytes_returned;
1462         struct cifs_ses *ses = tcon->ses;
1463         LOCK_REQ *pSMB = (LOCK_REQ *)in_buf;
1464
1465         /* We just modify the current in_buf to change
1466            the type of lock from LOCKING_ANDX_SHARED_LOCK
1467            or LOCKING_ANDX_EXCLUSIVE_LOCK to
1468            LOCKING_ANDX_CANCEL_LOCK. */
1469
1470         pSMB->LockType = LOCKING_ANDX_CANCEL_LOCK|LOCKING_ANDX_LARGE_FILES;
1471         pSMB->Timeout = 0;
1472         pSMB->hdr.Mid = get_next_mid(ses->server);
1473
1474         return SendReceive(xid, ses, in_buf, out_buf,
1475                         &bytes_returned, 0);
1476 }
1477
1478 int
1479 SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon,
1480             struct smb_hdr *in_buf, struct smb_hdr *out_buf,
1481             int *pbytes_returned)
1482 {
1483         int rc = 0;
1484         int rstart = 0;
1485         struct mid_q_entry *midQ;
1486         struct cifs_ses *ses;
1487         unsigned int len = be32_to_cpu(in_buf->smb_buf_length);
1488         struct kvec iov = { .iov_base = in_buf, .iov_len = len };
1489         struct smb_rqst rqst = { .rq_iov = &iov, .rq_nvec = 1 };
1490         unsigned int instance;
1491         struct TCP_Server_Info *server;
1492
1493         if (tcon == NULL || tcon->ses == NULL) {
1494                 cifs_dbg(VFS, "Null smb session\n");
1495                 return -EIO;
1496         }
1497         ses = tcon->ses;
1498         server = ses->server;
1499
1500         if (server == NULL) {
1501                 cifs_dbg(VFS, "Null tcp session\n");
1502                 return -EIO;
1503         }
1504
1505         spin_lock(&server->srv_lock);
1506         if (server->tcpStatus == CifsExiting) {
1507                 spin_unlock(&server->srv_lock);
1508                 return -ENOENT;
1509         }
1510         spin_unlock(&server->srv_lock);
1511
1512         /* Ensure that we do not send more than 50 overlapping requests
1513            to the same server. We may make this configurable later or
1514            use ses->maxReq */
1515
1516         if (len > CIFSMaxBufSize + MAX_CIFS_HDR_SIZE - 4) {
1517                 cifs_tcon_dbg(VFS, "Invalid length, greater than maximum frame, %d\n",
1518                               len);
1519                 return -EIO;
1520         }
1521
1522         rc = wait_for_free_request(server, CIFS_BLOCKING_OP, &instance);
1523         if (rc)
1524                 return rc;
1525
1526         /* make sure that we sign in the same order that we send on this socket
1527            and avoid races inside tcp sendmsg code that could cause corruption
1528            of smb data */
1529
1530         cifs_server_lock(server);
1531
1532         rc = allocate_mid(ses, in_buf, &midQ);
1533         if (rc) {
1534                 cifs_server_unlock(server);
1535                 return rc;
1536         }
1537
1538         rc = cifs_sign_smb(in_buf, server, &midQ->sequence_number);
1539         if (rc) {
1540                 delete_mid(midQ);
1541                 cifs_server_unlock(server);
1542                 return rc;
1543         }
1544
1545         midQ->mid_state = MID_REQUEST_SUBMITTED;
1546         rc = smb_send(server, in_buf, len);
1547         cifs_save_when_sent(midQ);
1548
1549         if (rc < 0)
1550                 server->sequence_number -= 2;
1551
1552         cifs_server_unlock(server);
1553
1554         if (rc < 0) {
1555                 delete_mid(midQ);
1556                 return rc;
1557         }
1558
1559         /* Wait for a reply - allow signals to interrupt. */
1560         rc = wait_event_interruptible(server->response_q,
1561                 (!(midQ->mid_state == MID_REQUEST_SUBMITTED ||
1562                    midQ->mid_state == MID_RESPONSE_RECEIVED)) ||
1563                 ((server->tcpStatus != CifsGood) &&
1564                  (server->tcpStatus != CifsNew)));
1565
1566         /* Were we interrupted by a signal ? */
1567         spin_lock(&server->srv_lock);
1568         if ((rc == -ERESTARTSYS) &&
1569                 (midQ->mid_state == MID_REQUEST_SUBMITTED ||
1570                  midQ->mid_state == MID_RESPONSE_RECEIVED) &&
1571                 ((server->tcpStatus == CifsGood) ||
1572                  (server->tcpStatus == CifsNew))) {
1573                 spin_unlock(&server->srv_lock);
1574
1575                 if (in_buf->Command == SMB_COM_TRANSACTION2) {
1576                         /* POSIX lock. We send a NT_CANCEL SMB to cause the
1577                            blocking lock to return. */
1578                         rc = send_cancel(server, &rqst, midQ);
1579                         if (rc) {
1580                                 delete_mid(midQ);
1581                                 return rc;
1582                         }
1583                 } else {
1584                         /* Windows lock. We send a LOCKINGX_CANCEL_LOCK
1585                            to cause the blocking lock to return. */
1586
1587                         rc = send_lock_cancel(xid, tcon, in_buf, out_buf);
1588
1589                         /* If we get -ENOLCK back the lock may have
1590                            already been removed. Don't exit in this case. */
1591                         if (rc && rc != -ENOLCK) {
1592                                 delete_mid(midQ);
1593                                 return rc;
1594                         }
1595                 }
1596
1597                 rc = wait_for_response(server, midQ);
1598                 if (rc) {
1599                         send_cancel(server, &rqst, midQ);
1600                         spin_lock(&server->mid_lock);
1601                         if (midQ->mid_state == MID_REQUEST_SUBMITTED ||
1602                             midQ->mid_state == MID_RESPONSE_RECEIVED) {
1603                                 /* no longer considered to be "in-flight" */
1604                                 midQ->callback = release_mid;
1605                                 spin_unlock(&server->mid_lock);
1606                                 return rc;
1607                         }
1608                         spin_unlock(&server->mid_lock);
1609                 }
1610
1611                 /* We got the response - restart system call. */
1612                 rstart = 1;
1613                 spin_lock(&server->srv_lock);
1614         }
1615         spin_unlock(&server->srv_lock);
1616
1617         rc = cifs_sync_mid_result(midQ, server);
1618         if (rc != 0)
1619                 return rc;
1620
1621         /* rcvd frame is ok */
1622         if (out_buf == NULL || midQ->mid_state != MID_RESPONSE_READY) {
1623                 rc = -EIO;
1624                 cifs_tcon_dbg(VFS, "Bad MID state?\n");
1625                 goto out;
1626         }
1627
1628         *pbytes_returned = get_rfc1002_length(midQ->resp_buf);
1629         memcpy(out_buf, midQ->resp_buf, *pbytes_returned + 4);
1630         rc = cifs_check_receive(midQ, server, 0);
1631 out:
1632         delete_mid(midQ);
1633         if (rstart && rc == -EACCES)
1634                 return -ERESTARTSYS;
1635         return rc;
1636 }
1637
1638 /*
1639  * Discard any remaining data in the current SMB. To do this, we borrow the
1640  * current bigbuf.
1641  */
1642 int
1643 cifs_discard_remaining_data(struct TCP_Server_Info *server)
1644 {
1645         unsigned int rfclen = server->pdu_size;
1646         size_t remaining = rfclen + HEADER_PREAMBLE_SIZE(server) -
1647                 server->total_read;
1648
1649         while (remaining > 0) {
1650                 ssize_t length;
1651
1652                 length = cifs_discard_from_socket(server,
1653                                 min_t(size_t, remaining,
1654                                       CIFSMaxBufSize + MAX_HEADER_SIZE(server)));
1655                 if (length < 0)
1656                         return length;
1657                 server->total_read += length;
1658                 remaining -= length;
1659         }
1660
1661         return 0;
1662 }
1663
1664 static int
1665 __cifs_readv_discard(struct TCP_Server_Info *server, struct mid_q_entry *mid,
1666                      bool malformed)
1667 {
1668         int length;
1669
1670         length = cifs_discard_remaining_data(server);
1671         dequeue_mid(mid, malformed);
1672         mid->resp_buf = server->smallbuf;
1673         server->smallbuf = NULL;
1674         return length;
1675 }
1676
1677 static int
1678 cifs_readv_discard(struct TCP_Server_Info *server, struct mid_q_entry *mid)
1679 {
1680         struct cifs_readdata *rdata = mid->callback_data;
1681
1682         return  __cifs_readv_discard(server, mid, rdata->result);
1683 }
1684
1685 int
1686 cifs_readv_receive(struct TCP_Server_Info *server, struct mid_q_entry *mid)
1687 {
1688         int length, len;
1689         unsigned int data_offset, data_len;
1690         struct cifs_readdata *rdata = mid->callback_data;
1691         char *buf = server->smallbuf;
1692         unsigned int buflen = server->pdu_size + HEADER_PREAMBLE_SIZE(server);
1693         bool use_rdma_mr = false;
1694
1695         cifs_dbg(FYI, "%s: mid=%llu offset=%llu bytes=%u\n",
1696                  __func__, mid->mid, rdata->offset, rdata->bytes);
1697
1698         /*
1699          * read the rest of READ_RSP header (sans Data array), or whatever we
1700          * can if there's not enough data. At this point, we've read down to
1701          * the Mid.
1702          */
1703         len = min_t(unsigned int, buflen, server->vals->read_rsp_size) -
1704                                                         HEADER_SIZE(server) + 1;
1705
1706         length = cifs_read_from_socket(server,
1707                                        buf + HEADER_SIZE(server) - 1, len);
1708         if (length < 0)
1709                 return length;
1710         server->total_read += length;
1711
1712         if (server->ops->is_session_expired &&
1713             server->ops->is_session_expired(buf)) {
1714                 cifs_reconnect(server, true);
1715                 return -1;
1716         }
1717
1718         if (server->ops->is_status_pending &&
1719             server->ops->is_status_pending(buf, server)) {
1720                 cifs_discard_remaining_data(server);
1721                 return -1;
1722         }
1723
1724         /* set up first two iov for signature check and to get credits */
1725         rdata->iov[0].iov_base = buf;
1726         rdata->iov[0].iov_len = HEADER_PREAMBLE_SIZE(server);
1727         rdata->iov[1].iov_base = buf + HEADER_PREAMBLE_SIZE(server);
1728         rdata->iov[1].iov_len =
1729                 server->total_read - HEADER_PREAMBLE_SIZE(server);
1730         cifs_dbg(FYI, "0: iov_base=%p iov_len=%zu\n",
1731                  rdata->iov[0].iov_base, rdata->iov[0].iov_len);
1732         cifs_dbg(FYI, "1: iov_base=%p iov_len=%zu\n",
1733                  rdata->iov[1].iov_base, rdata->iov[1].iov_len);
1734
1735         /* Was the SMB read successful? */
1736         rdata->result = server->ops->map_error(buf, false);
1737         if (rdata->result != 0) {
1738                 cifs_dbg(FYI, "%s: server returned error %d\n",
1739                          __func__, rdata->result);
1740                 /* normal error on read response */
1741                 return __cifs_readv_discard(server, mid, false);
1742         }
1743
1744         /* Is there enough to get to the rest of the READ_RSP header? */
1745         if (server->total_read < server->vals->read_rsp_size) {
1746                 cifs_dbg(FYI, "%s: server returned short header. got=%u expected=%zu\n",
1747                          __func__, server->total_read,
1748                          server->vals->read_rsp_size);
1749                 rdata->result = -EIO;
1750                 return cifs_readv_discard(server, mid);
1751         }
1752
1753         data_offset = server->ops->read_data_offset(buf) +
1754                 HEADER_PREAMBLE_SIZE(server);
1755         if (data_offset < server->total_read) {
1756                 /*
1757                  * win2k8 sometimes sends an offset of 0 when the read
1758                  * is beyond the EOF. Treat it as if the data starts just after
1759                  * the header.
1760                  */
1761                 cifs_dbg(FYI, "%s: data offset (%u) inside read response header\n",
1762                          __func__, data_offset);
1763                 data_offset = server->total_read;
1764         } else if (data_offset > MAX_CIFS_SMALL_BUFFER_SIZE) {
1765                 /* data_offset is beyond the end of smallbuf */
1766                 cifs_dbg(FYI, "%s: data offset (%u) beyond end of smallbuf\n",
1767                          __func__, data_offset);
1768                 rdata->result = -EIO;
1769                 return cifs_readv_discard(server, mid);
1770         }
1771
1772         cifs_dbg(FYI, "%s: total_read=%u data_offset=%u\n",
1773                  __func__, server->total_read, data_offset);
1774
1775         len = data_offset - server->total_read;
1776         if (len > 0) {
1777                 /* read any junk before data into the rest of smallbuf */
1778                 length = cifs_read_from_socket(server,
1779                                                buf + server->total_read, len);
1780                 if (length < 0)
1781                         return length;
1782                 server->total_read += length;
1783         }
1784
1785         /* how much data is in the response? */
1786 #ifdef CONFIG_CIFS_SMB_DIRECT
1787         use_rdma_mr = rdata->mr;
1788 #endif
1789         data_len = server->ops->read_data_length(buf, use_rdma_mr);
1790         if (!use_rdma_mr && (data_offset + data_len > buflen)) {
1791                 /* data_len is corrupt -- discard frame */
1792                 rdata->result = -EIO;
1793                 return cifs_readv_discard(server, mid);
1794         }
1795
1796 #ifdef CONFIG_CIFS_SMB_DIRECT
1797         if (rdata->mr)
1798                 length = data_len; /* An RDMA read is already done. */
1799         else
1800 #endif
1801                 length = cifs_read_iter_from_socket(server, &rdata->iter,
1802                                                     data_len);
1803         if (length > 0)
1804                 rdata->got_bytes += length;
1805         server->total_read += length;
1806
1807         cifs_dbg(FYI, "total_read=%u buflen=%u remaining=%u\n",
1808                  server->total_read, buflen, data_len);
1809
1810         /* discard anything left over */
1811         if (server->total_read < buflen)
1812                 return cifs_readv_discard(server, mid);
1813
1814         dequeue_mid(mid, false);
1815         mid->resp_buf = server->smallbuf;
1816         server->smallbuf = NULL;
1817         return length;
1818 }