CIFS: Move async write to ops struct
[linux-3.10.git] / fs / cifs / smb2pdu.c
1 /*
2  *   fs/cifs/smb2pdu.c
3  *
4  *   Copyright (C) International Business Machines  Corp., 2009, 2011
5  *                 Etersoft, 2012
6  *   Author(s): Steve French (sfrench@us.ibm.com)
7  *              Pavel Shilovsky (pshilovsky@samba.org) 2012
8  *
9  *   Contains the routines for constructing the SMB2 PDUs themselves
10  *
11  *   This library is free software; you can redistribute it and/or modify
12  *   it under the terms of the GNU Lesser General Public License as published
13  *   by the Free Software Foundation; either version 2.1 of the License, or
14  *   (at your option) any later version.
15  *
16  *   This library is distributed in the hope that it will be useful,
17  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
18  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See
19  *   the GNU Lesser General Public License for more details.
20  *
21  *   You should have received a copy of the GNU Lesser General Public License
22  *   along with this library; if not, write to the Free Software
23  *   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
24  */
25
26  /* SMB2 PDU handling routines here - except for leftovers (eg session setup) */
27  /* Note that there are handle based routines which must be                   */
28  /* treated slightly differently for reconnection purposes since we never     */
29  /* want to reuse a stale file handle and only the caller knows the file info */
30
31 #include <linux/fs.h>
32 #include <linux/kernel.h>
33 #include <linux/vfs.h>
34 #include <linux/task_io_accounting_ops.h>
35 #include <linux/uaccess.h>
36 #include <linux/xattr.h>
37 #include "smb2pdu.h"
38 #include "cifsglob.h"
39 #include "cifsacl.h"
40 #include "cifsproto.h"
41 #include "smb2proto.h"
42 #include "cifs_unicode.h"
43 #include "cifs_debug.h"
44 #include "ntlmssp.h"
45 #include "smb2status.h"
46 #include "smb2glob.h"
47
48 /*
49  *  The following table defines the expected "StructureSize" of SMB2 requests
50  *  in order by SMB2 command.  This is similar to "wct" in SMB/CIFS requests.
51  *
52  *  Note that commands are defined in smb2pdu.h in le16 but the array below is
53  *  indexed by command in host byte order.
54  */
55 static const int smb2_req_struct_sizes[NUMBER_OF_SMB2_COMMANDS] = {
56         /* SMB2_NEGOTIATE */ 36,
57         /* SMB2_SESSION_SETUP */ 25,
58         /* SMB2_LOGOFF */ 4,
59         /* SMB2_TREE_CONNECT */ 9,
60         /* SMB2_TREE_DISCONNECT */ 4,
61         /* SMB2_CREATE */ 57,
62         /* SMB2_CLOSE */ 24,
63         /* SMB2_FLUSH */ 24,
64         /* SMB2_READ */ 49,
65         /* SMB2_WRITE */ 49,
66         /* SMB2_LOCK */ 48,
67         /* SMB2_IOCTL */ 57,
68         /* SMB2_CANCEL */ 4,
69         /* SMB2_ECHO */ 4,
70         /* SMB2_QUERY_DIRECTORY */ 33,
71         /* SMB2_CHANGE_NOTIFY */ 32,
72         /* SMB2_QUERY_INFO */ 41,
73         /* SMB2_SET_INFO */ 33,
74         /* SMB2_OPLOCK_BREAK */ 24 /* BB this is 36 for LEASE_BREAK variant */
75 };
76
77
78 static void
79 smb2_hdr_assemble(struct smb2_hdr *hdr, __le16 smb2_cmd /* command */ ,
80                   const struct cifs_tcon *tcon)
81 {
82         struct smb2_pdu *pdu = (struct smb2_pdu *)hdr;
83         char *temp = (char *)hdr;
84         /* lookup word count ie StructureSize from table */
85         __u16 parmsize = smb2_req_struct_sizes[le16_to_cpu(smb2_cmd)];
86
87         /*
88          * smaller than SMALL_BUFFER_SIZE but bigger than fixed area of
89          * largest operations (Create)
90          */
91         memset(temp, 0, 256);
92
93         /* Note this is only network field converted to big endian */
94         hdr->smb2_buf_length = cpu_to_be32(parmsize + sizeof(struct smb2_hdr)
95                         - 4 /*  RFC 1001 length field itself not counted */);
96
97         hdr->ProtocolId[0] = 0xFE;
98         hdr->ProtocolId[1] = 'S';
99         hdr->ProtocolId[2] = 'M';
100         hdr->ProtocolId[3] = 'B';
101         hdr->StructureSize = cpu_to_le16(64);
102         hdr->Command = smb2_cmd;
103         hdr->CreditRequest = cpu_to_le16(2); /* BB make this dynamic */
104         hdr->ProcessId = cpu_to_le32((__u16)current->tgid);
105
106         if (!tcon)
107                 goto out;
108
109         hdr->TreeId = tcon->tid;
110         /* Uid is not converted */
111         if (tcon->ses)
112                 hdr->SessionId = tcon->ses->Suid;
113         /* BB check following DFS flags BB */
114         /* BB do we have to add check for SHI1005_FLAGS_DFS_ROOT too? */
115         if (tcon->share_flags & SHI1005_FLAGS_DFS)
116                 hdr->Flags |= SMB2_FLAGS_DFS_OPERATIONS;
117         /* BB how does SMB2 do case sensitive? */
118         /* if (tcon->nocase)
119                 hdr->Flags |= SMBFLG_CASELESS; */
120         /* if (tcon->ses && tcon->ses->server &&
121             (tcon->ses->server->sec_mode & SECMODE_SIGN_REQUIRED))
122                 hdr->Flags |= SMB2_FLAGS_SIGNED; */
123 out:
124         pdu->StructureSize2 = cpu_to_le16(parmsize);
125         return;
126 }
127
128 static int
129 smb2_reconnect(__le16 smb2_command, struct cifs_tcon *tcon)
130 {
131         int rc = 0;
132         struct nls_table *nls_codepage;
133         struct cifs_ses *ses;
134         struct TCP_Server_Info *server;
135
136         /*
137          * SMB2s NegProt, SessSetup, Logoff do not have tcon yet so
138          * check for tcp and smb session status done differently
139          * for those three - in the calling routine.
140          */
141         if (tcon == NULL)
142                 return rc;
143
144         if (smb2_command == SMB2_TREE_CONNECT)
145                 return rc;
146
147         if (tcon->tidStatus == CifsExiting) {
148                 /*
149                  * only tree disconnect, open, and write,
150                  * (and ulogoff which does not have tcon)
151                  * are allowed as we start force umount.
152                  */
153                 if ((smb2_command != SMB2_WRITE) &&
154                    (smb2_command != SMB2_CREATE) &&
155                    (smb2_command != SMB2_TREE_DISCONNECT)) {
156                         cFYI(1, "can not send cmd %d while umounting",
157                                 smb2_command);
158                         return -ENODEV;
159                 }
160         }
161         if ((!tcon->ses) || (tcon->ses->status == CifsExiting) ||
162             (!tcon->ses->server))
163                 return -EIO;
164
165         ses = tcon->ses;
166         server = ses->server;
167
168         /*
169          * Give demultiplex thread up to 10 seconds to reconnect, should be
170          * greater than cifs socket timeout which is 7 seconds
171          */
172         while (server->tcpStatus == CifsNeedReconnect) {
173                 /*
174                  * Return to caller for TREE_DISCONNECT and LOGOFF and CLOSE
175                  * here since they are implicitly done when session drops.
176                  */
177                 switch (smb2_command) {
178                 /*
179                  * BB Should we keep oplock break and add flush to exceptions?
180                  */
181                 case SMB2_TREE_DISCONNECT:
182                 case SMB2_CANCEL:
183                 case SMB2_CLOSE:
184                 case SMB2_OPLOCK_BREAK:
185                         return -EAGAIN;
186                 }
187
188                 wait_event_interruptible_timeout(server->response_q,
189                         (server->tcpStatus != CifsNeedReconnect), 10 * HZ);
190
191                 /* are we still trying to reconnect? */
192                 if (server->tcpStatus != CifsNeedReconnect)
193                         break;
194
195                 /*
196                  * on "soft" mounts we wait once. Hard mounts keep
197                  * retrying until process is killed or server comes
198                  * back on-line
199                  */
200                 if (!tcon->retry) {
201                         cFYI(1, "gave up waiting on reconnect in smb_init");
202                         return -EHOSTDOWN;
203                 }
204         }
205
206         if (!tcon->ses->need_reconnect && !tcon->need_reconnect)
207                 return rc;
208
209         nls_codepage = load_nls_default();
210
211         /*
212          * need to prevent multiple threads trying to simultaneously reconnect
213          * the same SMB session
214          */
215         mutex_lock(&tcon->ses->session_mutex);
216         rc = cifs_negotiate_protocol(0, tcon->ses);
217         if (!rc && tcon->ses->need_reconnect)
218                 rc = cifs_setup_session(0, tcon->ses, nls_codepage);
219
220         if (rc || !tcon->need_reconnect) {
221                 mutex_unlock(&tcon->ses->session_mutex);
222                 goto out;
223         }
224
225         cifs_mark_open_files_invalid(tcon);
226         rc = SMB2_tcon(0, tcon->ses, tcon->treeName, tcon, nls_codepage);
227         mutex_unlock(&tcon->ses->session_mutex);
228         cFYI(1, "reconnect tcon rc = %d", rc);
229         if (rc)
230                 goto out;
231         atomic_inc(&tconInfoReconnectCount);
232         /*
233          * BB FIXME add code to check if wsize needs update due to negotiated
234          * smb buffer size shrinking.
235          */
236 out:
237         /*
238          * Check if handle based operation so we know whether we can continue
239          * or not without returning to caller to reset file handle.
240          */
241         /*
242          * BB Is flush done by server on drop of tcp session? Should we special
243          * case it and skip above?
244          */
245         switch (smb2_command) {
246         case SMB2_FLUSH:
247         case SMB2_READ:
248         case SMB2_WRITE:
249         case SMB2_LOCK:
250         case SMB2_IOCTL:
251         case SMB2_QUERY_DIRECTORY:
252         case SMB2_CHANGE_NOTIFY:
253         case SMB2_QUERY_INFO:
254         case SMB2_SET_INFO:
255                 return -EAGAIN;
256         }
257         unload_nls(nls_codepage);
258         return rc;
259 }
260
261 /*
262  * Allocate and return pointer to an SMB request hdr, and set basic
263  * SMB information in the SMB header. If the return code is zero, this
264  * function must have filled in request_buf pointer.
265  */
266 static int
267 small_smb2_init(__le16 smb2_command, struct cifs_tcon *tcon,
268                 void **request_buf)
269 {
270         int rc = 0;
271
272         rc = smb2_reconnect(smb2_command, tcon);
273         if (rc)
274                 return rc;
275
276         /* BB eventually switch this to SMB2 specific small buf size */
277         *request_buf = cifs_small_buf_get();
278         if (*request_buf == NULL) {
279                 /* BB should we add a retry in here if not a writepage? */
280                 return -ENOMEM;
281         }
282
283         smb2_hdr_assemble((struct smb2_hdr *) *request_buf, smb2_command, tcon);
284
285         if (tcon != NULL) {
286 #ifdef CONFIG_CIFS_STATS2
287                 uint16_t com_code = le16_to_cpu(smb2_command);
288                 cifs_stats_inc(&tcon->stats.smb2_stats.smb2_com_sent[com_code]);
289 #endif
290                 cifs_stats_inc(&tcon->num_smbs_sent);
291         }
292
293         return rc;
294 }
295
296 static void
297 free_rsp_buf(int resp_buftype, void *rsp)
298 {
299         if (resp_buftype == CIFS_SMALL_BUFFER)
300                 cifs_small_buf_release(rsp);
301         else if (resp_buftype == CIFS_LARGE_BUFFER)
302                 cifs_buf_release(rsp);
303 }
304
305 #define SMB2_NUM_PROT 1
306
307 #define SMB2_PROT   0
308 #define SMB21_PROT  1
309 #define BAD_PROT 0xFFFF
310
311 #define SMB2_PROT_ID  0x0202
312 #define SMB21_PROT_ID 0x0210
313 #define BAD_PROT_ID   0xFFFF
314
315 static struct {
316         int index;
317         __le16 name;
318 } smb2protocols[] = {
319         {SMB2_PROT,  cpu_to_le16(SMB2_PROT_ID)},
320         {SMB21_PROT, cpu_to_le16(SMB21_PROT_ID)},
321         {BAD_PROT,   cpu_to_le16(BAD_PROT_ID)}
322 };
323
324 /*
325  *
326  *      SMB2 Worker functions follow:
327  *
328  *      The general structure of the worker functions is:
329  *      1) Call smb2_init (assembles SMB2 header)
330  *      2) Initialize SMB2 command specific fields in fixed length area of SMB
331  *      3) Call smb_sendrcv2 (sends request on socket and waits for response)
332  *      4) Decode SMB2 command specific fields in the fixed length area
333  *      5) Decode variable length data area (if any for this SMB2 command type)
334  *      6) Call free smb buffer
335  *      7) return
336  *
337  */
338
339 int
340 SMB2_negotiate(const unsigned int xid, struct cifs_ses *ses)
341 {
342         struct smb2_negotiate_req *req;
343         struct smb2_negotiate_rsp *rsp;
344         struct kvec iov[1];
345         int rc = 0;
346         int resp_buftype;
347         struct TCP_Server_Info *server;
348         unsigned int sec_flags;
349         u16 i;
350         u16 temp = 0;
351         int blob_offset, blob_length;
352         char *security_blob;
353         int flags = CIFS_NEG_OP;
354
355         cFYI(1, "Negotiate protocol");
356
357         if (ses->server)
358                 server = ses->server;
359         else {
360                 rc = -EIO;
361                 return rc;
362         }
363
364         rc = small_smb2_init(SMB2_NEGOTIATE, NULL, (void **) &req);
365         if (rc)
366                 return rc;
367
368         /* if any of auth flags (ie not sign or seal) are overriden use them */
369         if (ses->overrideSecFlg & (~(CIFSSEC_MUST_SIGN | CIFSSEC_MUST_SEAL)))
370                 sec_flags = ses->overrideSecFlg;  /* BB FIXME fix sign flags?*/
371         else /* if override flags set only sign/seal OR them with global auth */
372                 sec_flags = global_secflags | ses->overrideSecFlg;
373
374         cFYI(1, "sec_flags 0x%x", sec_flags);
375
376         req->hdr.SessionId = 0;
377
378         for (i = 0; i < SMB2_NUM_PROT; i++)
379                 req->Dialects[i] = smb2protocols[i].name;
380
381         req->DialectCount = cpu_to_le16(i);
382         inc_rfc1001_len(req, i * 2);
383
384         /* only one of SMB2 signing flags may be set in SMB2 request */
385         if ((sec_flags & CIFSSEC_MUST_SIGN) == CIFSSEC_MUST_SIGN)
386                 temp = SMB2_NEGOTIATE_SIGNING_REQUIRED;
387         else if (sec_flags & CIFSSEC_MAY_SIGN) /* MAY_SIGN is a single flag */
388                 temp = SMB2_NEGOTIATE_SIGNING_ENABLED;
389
390         req->SecurityMode = cpu_to_le16(temp);
391
392         req->Capabilities = cpu_to_le32(SMB2_GLOBAL_CAP_DFS);
393
394         iov[0].iov_base = (char *)req;
395         /* 4 for rfc1002 length field */
396         iov[0].iov_len = get_rfc1002_length(req) + 4;
397
398         rc = SendReceive2(xid, ses, iov, 1, &resp_buftype, flags);
399
400         rsp = (struct smb2_negotiate_rsp *)iov[0].iov_base;
401         /*
402          * No tcon so can't do
403          * cifs_stats_inc(&tcon->stats.smb2_stats.smb2_com_fail[SMB2...]);
404          */
405         if (rc != 0)
406                 goto neg_exit;
407
408         if (rsp == NULL) {
409                 rc = -EIO;
410                 goto neg_exit;
411         }
412
413         cFYI(1, "mode 0x%x", rsp->SecurityMode);
414
415         if (rsp->DialectRevision == smb2protocols[SMB21_PROT].name)
416                 cFYI(1, "negotiated smb2.1 dialect");
417         else if (rsp->DialectRevision == smb2protocols[SMB2_PROT].name)
418                 cFYI(1, "negotiated smb2 dialect");
419         else {
420                 cERROR(1, "Illegal dialect returned by server %d",
421                            le16_to_cpu(rsp->DialectRevision));
422                 rc = -EIO;
423                 goto neg_exit;
424         }
425         server->dialect = le16_to_cpu(rsp->DialectRevision);
426
427         server->maxBuf = le32_to_cpu(rsp->MaxTransactSize);
428         server->max_read = le32_to_cpu(rsp->MaxReadSize);
429         server->max_write = le32_to_cpu(rsp->MaxWriteSize);
430         /* BB Do we need to validate the SecurityMode? */
431         server->sec_mode = le16_to_cpu(rsp->SecurityMode);
432         server->capabilities = le32_to_cpu(rsp->Capabilities);
433         /* Internal types */
434         server->capabilities |= SMB2_NT_FIND | SMB2_LARGE_FILES;
435
436         security_blob = smb2_get_data_area_len(&blob_offset, &blob_length,
437                                                &rsp->hdr);
438         if (blob_length == 0) {
439                 cERROR(1, "missing security blob on negprot");
440                 rc = -EIO;
441                 goto neg_exit;
442         }
443 #ifdef CONFIG_SMB2_ASN1  /* BB REMOVEME when updated asn1.c ready */
444         rc = decode_neg_token_init(security_blob, blob_length,
445                                    &server->sec_type);
446         if (rc == 1)
447                 rc = 0;
448         else if (rc == 0) {
449                 rc = -EIO;
450                 goto neg_exit;
451         }
452 #endif
453
454 neg_exit:
455         free_rsp_buf(resp_buftype, rsp);
456         return rc;
457 }
458
459 int
460 SMB2_sess_setup(const unsigned int xid, struct cifs_ses *ses,
461                 const struct nls_table *nls_cp)
462 {
463         struct smb2_sess_setup_req *req;
464         struct smb2_sess_setup_rsp *rsp = NULL;
465         struct kvec iov[2];
466         int rc = 0;
467         int resp_buftype;
468         __le32 phase = NtLmNegotiate; /* NTLMSSP, if needed, is multistage */
469         struct TCP_Server_Info *server;
470         unsigned int sec_flags;
471         u8 temp = 0;
472         u16 blob_length = 0;
473         char *security_blob;
474         char *ntlmssp_blob = NULL;
475         bool use_spnego = false; /* else use raw ntlmssp */
476
477         cFYI(1, "Session Setup");
478
479         if (ses->server)
480                 server = ses->server;
481         else {
482                 rc = -EIO;
483                 return rc;
484         }
485
486         /*
487          * If memory allocation is successful, caller of this function
488          * frees it.
489          */
490         ses->ntlmssp = kmalloc(sizeof(struct ntlmssp_auth), GFP_KERNEL);
491         if (!ses->ntlmssp)
492                 return -ENOMEM;
493
494         ses->server->secType = RawNTLMSSP;
495
496 ssetup_ntlmssp_authenticate:
497         if (phase == NtLmChallenge)
498                 phase = NtLmAuthenticate; /* if ntlmssp, now final phase */
499
500         rc = small_smb2_init(SMB2_SESSION_SETUP, NULL, (void **) &req);
501         if (rc)
502                 return rc;
503
504         /* if any of auth flags (ie not sign or seal) are overriden use them */
505         if (ses->overrideSecFlg & (~(CIFSSEC_MUST_SIGN | CIFSSEC_MUST_SEAL)))
506                 sec_flags = ses->overrideSecFlg;  /* BB FIXME fix sign flags?*/
507         else /* if override flags set only sign/seal OR them with global auth */
508                 sec_flags = global_secflags | ses->overrideSecFlg;
509
510         cFYI(1, "sec_flags 0x%x", sec_flags);
511
512         req->hdr.SessionId = 0; /* First session, not a reauthenticate */
513         req->VcNumber = 0; /* MBZ */
514         /* to enable echos and oplocks */
515         req->hdr.CreditRequest = cpu_to_le16(3);
516
517         /* only one of SMB2 signing flags may be set in SMB2 request */
518         if ((sec_flags & CIFSSEC_MUST_SIGN) == CIFSSEC_MUST_SIGN)
519                 temp = SMB2_NEGOTIATE_SIGNING_REQUIRED;
520         else if (ses->server->sec_mode & SMB2_NEGOTIATE_SIGNING_REQUIRED)
521                 temp = SMB2_NEGOTIATE_SIGNING_REQUIRED;
522         else if (sec_flags & CIFSSEC_MAY_SIGN) /* MAY_SIGN is a single flag */
523                 temp = SMB2_NEGOTIATE_SIGNING_ENABLED;
524
525         req->SecurityMode = temp;
526         req->Capabilities = 0;
527         req->Channel = 0; /* MBZ */
528
529         iov[0].iov_base = (char *)req;
530         /* 4 for rfc1002 length field and 1 for pad */
531         iov[0].iov_len = get_rfc1002_length(req) + 4 - 1;
532         if (phase == NtLmNegotiate) {
533                 ntlmssp_blob = kmalloc(sizeof(struct _NEGOTIATE_MESSAGE),
534                                        GFP_KERNEL);
535                 if (ntlmssp_blob == NULL) {
536                         rc = -ENOMEM;
537                         goto ssetup_exit;
538                 }
539                 build_ntlmssp_negotiate_blob(ntlmssp_blob, ses);
540                 if (use_spnego) {
541                         /* blob_length = build_spnego_ntlmssp_blob(
542                                         &security_blob,
543                                         sizeof(struct _NEGOTIATE_MESSAGE),
544                                         ntlmssp_blob); */
545                         /* BB eventually need to add this */
546                         cERROR(1, "spnego not supported for SMB2 yet");
547                         rc = -EOPNOTSUPP;
548                         kfree(ntlmssp_blob);
549                         goto ssetup_exit;
550                 } else {
551                         blob_length = sizeof(struct _NEGOTIATE_MESSAGE);
552                         /* with raw NTLMSSP we don't encapsulate in SPNEGO */
553                         security_blob = ntlmssp_blob;
554                 }
555         } else if (phase == NtLmAuthenticate) {
556                 req->hdr.SessionId = ses->Suid;
557                 ntlmssp_blob = kzalloc(sizeof(struct _NEGOTIATE_MESSAGE) + 500,
558                                        GFP_KERNEL);
559                 if (ntlmssp_blob == NULL) {
560                         cERROR(1, "failed to malloc ntlmssp blob");
561                         rc = -ENOMEM;
562                         goto ssetup_exit;
563                 }
564                 rc = build_ntlmssp_auth_blob(ntlmssp_blob, &blob_length, ses,
565                                              nls_cp);
566                 if (rc) {
567                         cFYI(1, "build_ntlmssp_auth_blob failed %d", rc);
568                         goto ssetup_exit; /* BB double check error handling */
569                 }
570                 if (use_spnego) {
571                         /* blob_length = build_spnego_ntlmssp_blob(
572                                                         &security_blob,
573                                                         blob_length,
574                                                         ntlmssp_blob); */
575                         cERROR(1, "spnego not supported for SMB2 yet");
576                         rc = -EOPNOTSUPP;
577                         kfree(ntlmssp_blob);
578                         goto ssetup_exit;
579                 } else {
580                         security_blob = ntlmssp_blob;
581                 }
582         } else {
583                 cERROR(1, "illegal ntlmssp phase");
584                 rc = -EIO;
585                 goto ssetup_exit;
586         }
587
588         /* Testing shows that buffer offset must be at location of Buffer[0] */
589         req->SecurityBufferOffset =
590                                 cpu_to_le16(sizeof(struct smb2_sess_setup_req) -
591                                             1 /* pad */ - 4 /* rfc1001 len */);
592         req->SecurityBufferLength = cpu_to_le16(blob_length);
593         iov[1].iov_base = security_blob;
594         iov[1].iov_len = blob_length;
595
596         inc_rfc1001_len(req, blob_length - 1 /* pad */);
597
598         /* BB add code to build os and lm fields */
599
600         rc = SendReceive2(xid, ses, iov, 2, &resp_buftype, CIFS_LOG_ERROR);
601
602         kfree(security_blob);
603         rsp = (struct smb2_sess_setup_rsp *)iov[0].iov_base;
604         if (rsp->hdr.Status == STATUS_MORE_PROCESSING_REQUIRED) {
605                 if (phase != NtLmNegotiate) {
606                         cERROR(1, "Unexpected more processing error");
607                         goto ssetup_exit;
608                 }
609                 if (offsetof(struct smb2_sess_setup_rsp, Buffer) - 4 !=
610                         le16_to_cpu(rsp->SecurityBufferOffset)) {
611                         cERROR(1, "Invalid security buffer offset %d",
612                                   le16_to_cpu(rsp->SecurityBufferOffset));
613                         rc = -EIO;
614                         goto ssetup_exit;
615                 }
616
617                 /* NTLMSSP Negotiate sent now processing challenge (response) */
618                 phase = NtLmChallenge; /* process ntlmssp challenge */
619                 rc = 0; /* MORE_PROCESSING is not an error here but expected */
620                 ses->Suid = rsp->hdr.SessionId;
621                 rc = decode_ntlmssp_challenge(rsp->Buffer,
622                                 le16_to_cpu(rsp->SecurityBufferLength), ses);
623         }
624
625         /*
626          * BB eventually add code for SPNEGO decoding of NtlmChallenge blob,
627          * but at least the raw NTLMSSP case works.
628          */
629         /*
630          * No tcon so can't do
631          * cifs_stats_inc(&tcon->stats.smb2_stats.smb2_com_fail[SMB2...]);
632          */
633         if (rc != 0)
634                 goto ssetup_exit;
635
636         if (rsp == NULL) {
637                 rc = -EIO;
638                 goto ssetup_exit;
639         }
640
641         ses->session_flags = le16_to_cpu(rsp->SessionFlags);
642 ssetup_exit:
643         free_rsp_buf(resp_buftype, rsp);
644
645         /* if ntlmssp, and negotiate succeeded, proceed to authenticate phase */
646         if ((phase == NtLmChallenge) && (rc == 0))
647                 goto ssetup_ntlmssp_authenticate;
648         return rc;
649 }
650
651 int
652 SMB2_logoff(const unsigned int xid, struct cifs_ses *ses)
653 {
654         struct smb2_logoff_req *req; /* response is also trivial struct */
655         int rc = 0;
656         struct TCP_Server_Info *server;
657
658         cFYI(1, "disconnect session %p", ses);
659
660         if (ses && (ses->server))
661                 server = ses->server;
662         else
663                 return -EIO;
664
665         rc = small_smb2_init(SMB2_LOGOFF, NULL, (void **) &req);
666         if (rc)
667                 return rc;
668
669          /* since no tcon, smb2_init can not do this, so do here */
670         req->hdr.SessionId = ses->Suid;
671
672         rc = SendReceiveNoRsp(xid, ses, (char *) &req->hdr, 0);
673         /*
674          * No tcon so can't do
675          * cifs_stats_inc(&tcon->stats.smb2_stats.smb2_com_fail[SMB2...]);
676          */
677         return rc;
678 }
679
680 static inline void cifs_stats_fail_inc(struct cifs_tcon *tcon, uint16_t code)
681 {
682         cifs_stats_inc(&tcon->stats.smb2_stats.smb2_com_failed[code]);
683 }
684
685 #define MAX_SHARENAME_LENGTH (255 /* server */ + 80 /* share */ + 1 /* NULL */)
686
687 int
688 SMB2_tcon(const unsigned int xid, struct cifs_ses *ses, const char *tree,
689           struct cifs_tcon *tcon, const struct nls_table *cp)
690 {
691         struct smb2_tree_connect_req *req;
692         struct smb2_tree_connect_rsp *rsp = NULL;
693         struct kvec iov[2];
694         int rc = 0;
695         int resp_buftype;
696         int unc_path_len;
697         struct TCP_Server_Info *server;
698         __le16 *unc_path = NULL;
699
700         cFYI(1, "TCON");
701
702         if ((ses->server) && tree)
703                 server = ses->server;
704         else
705                 return -EIO;
706
707         if (tcon && tcon->bad_network_name)
708                 return -ENOENT;
709
710         unc_path = kmalloc(MAX_SHARENAME_LENGTH * 2, GFP_KERNEL);
711         if (unc_path == NULL)
712                 return -ENOMEM;
713
714         unc_path_len = cifs_strtoUTF16(unc_path, tree, strlen(tree), cp) + 1;
715         unc_path_len *= 2;
716         if (unc_path_len < 2) {
717                 kfree(unc_path);
718                 return -EINVAL;
719         }
720
721         rc = small_smb2_init(SMB2_TREE_CONNECT, tcon, (void **) &req);
722         if (rc) {
723                 kfree(unc_path);
724                 return rc;
725         }
726
727         if (tcon == NULL) {
728                 /* since no tcon, smb2_init can not do this, so do here */
729                 req->hdr.SessionId = ses->Suid;
730                 /* if (ses->server->sec_mode & SECMODE_SIGN_REQUIRED)
731                         req->hdr.Flags |= SMB2_FLAGS_SIGNED; */
732         }
733
734         iov[0].iov_base = (char *)req;
735         /* 4 for rfc1002 length field and 1 for pad */
736         iov[0].iov_len = get_rfc1002_length(req) + 4 - 1;
737
738         /* Testing shows that buffer offset must be at location of Buffer[0] */
739         req->PathOffset = cpu_to_le16(sizeof(struct smb2_tree_connect_req)
740                         - 1 /* pad */ - 4 /* do not count rfc1001 len field */);
741         req->PathLength = cpu_to_le16(unc_path_len - 2);
742         iov[1].iov_base = unc_path;
743         iov[1].iov_len = unc_path_len;
744
745         inc_rfc1001_len(req, unc_path_len - 1 /* pad */);
746
747         rc = SendReceive2(xid, ses, iov, 2, &resp_buftype, 0);
748         rsp = (struct smb2_tree_connect_rsp *)iov[0].iov_base;
749
750         if (rc != 0) {
751                 if (tcon) {
752                         cifs_stats_fail_inc(tcon, SMB2_TREE_CONNECT_HE);
753                         tcon->need_reconnect = true;
754                 }
755                 goto tcon_error_exit;
756         }
757
758         if (rsp == NULL) {
759                 rc = -EIO;
760                 goto tcon_exit;
761         }
762
763         if (tcon == NULL) {
764                 ses->ipc_tid = rsp->hdr.TreeId;
765                 goto tcon_exit;
766         }
767
768         if (rsp->ShareType & SMB2_SHARE_TYPE_DISK)
769                 cFYI(1, "connection to disk share");
770         else if (rsp->ShareType & SMB2_SHARE_TYPE_PIPE) {
771                 tcon->ipc = true;
772                 cFYI(1, "connection to pipe share");
773         } else if (rsp->ShareType & SMB2_SHARE_TYPE_PRINT) {
774                 tcon->print = true;
775                 cFYI(1, "connection to printer");
776         } else {
777                 cERROR(1, "unknown share type %d", rsp->ShareType);
778                 rc = -EOPNOTSUPP;
779                 goto tcon_error_exit;
780         }
781
782         tcon->share_flags = le32_to_cpu(rsp->ShareFlags);
783         tcon->maximal_access = le32_to_cpu(rsp->MaximalAccess);
784         tcon->tidStatus = CifsGood;
785         tcon->need_reconnect = false;
786         tcon->tid = rsp->hdr.TreeId;
787         strncpy(tcon->treeName, tree, MAX_TREE_SIZE);
788
789         if ((rsp->Capabilities & SMB2_SHARE_CAP_DFS) &&
790             ((tcon->share_flags & SHI1005_FLAGS_DFS) == 0))
791                 cERROR(1, "DFS capability contradicts DFS flag");
792
793 tcon_exit:
794         free_rsp_buf(resp_buftype, rsp);
795         kfree(unc_path);
796         return rc;
797
798 tcon_error_exit:
799         if (rsp->hdr.Status == STATUS_BAD_NETWORK_NAME) {
800                 cERROR(1, "BAD_NETWORK_NAME: %s", tree);
801                 tcon->bad_network_name = true;
802         }
803         goto tcon_exit;
804 }
805
806 int
807 SMB2_tdis(const unsigned int xid, struct cifs_tcon *tcon)
808 {
809         struct smb2_tree_disconnect_req *req; /* response is trivial */
810         int rc = 0;
811         struct TCP_Server_Info *server;
812         struct cifs_ses *ses = tcon->ses;
813
814         cFYI(1, "Tree Disconnect");
815
816         if (ses && (ses->server))
817                 server = ses->server;
818         else
819                 return -EIO;
820
821         if ((tcon->need_reconnect) || (tcon->ses->need_reconnect))
822                 return 0;
823
824         rc = small_smb2_init(SMB2_TREE_DISCONNECT, tcon, (void **) &req);
825         if (rc)
826                 return rc;
827
828         rc = SendReceiveNoRsp(xid, ses, (char *)&req->hdr, 0);
829         if (rc)
830                 cifs_stats_fail_inc(tcon, SMB2_TREE_DISCONNECT_HE);
831
832         return rc;
833 }
834
835 int
836 SMB2_open(const unsigned int xid, struct cifs_tcon *tcon, __le16 *path,
837           u64 *persistent_fid, u64 *volatile_fid, __u32 desired_access,
838           __u32 create_disposition, __u32 file_attributes, __u32 create_options,
839           struct smb2_file_all_info *buf)
840 {
841         struct smb2_create_req *req;
842         struct smb2_create_rsp *rsp;
843         struct TCP_Server_Info *server;
844         struct cifs_ses *ses = tcon->ses;
845         struct kvec iov[2];
846         int resp_buftype;
847         int uni_path_len;
848         int rc = 0;
849         int num_iovecs = 2;
850
851         cFYI(1, "create/open");
852
853         if (ses && (ses->server))
854                 server = ses->server;
855         else
856                 return -EIO;
857
858         rc = small_smb2_init(SMB2_CREATE, tcon, (void **) &req);
859         if (rc)
860                 return rc;
861
862         /* if (server->oplocks)
863                 req->RequestedOplockLevel = SMB2_OPLOCK_LEVEL_BATCH;
864         else */
865                 req->RequestedOplockLevel = SMB2_OPLOCK_LEVEL_NONE;
866         req->ImpersonationLevel = IL_IMPERSONATION;
867         req->DesiredAccess = cpu_to_le32(desired_access);
868         /* File attributes ignored on open (used in create though) */
869         req->FileAttributes = cpu_to_le32(file_attributes);
870         req->ShareAccess = FILE_SHARE_ALL_LE;
871         req->CreateDisposition = cpu_to_le32(create_disposition);
872         req->CreateOptions = cpu_to_le32(create_options);
873         uni_path_len = (2 * UniStrnlen((wchar_t *)path, PATH_MAX)) + 2;
874         req->NameOffset = cpu_to_le16(sizeof(struct smb2_create_req)
875                         - 1 /* pad */ - 4 /* do not count rfc1001 len field */);
876
877         iov[0].iov_base = (char *)req;
878         /* 4 for rfc1002 length field */
879         iov[0].iov_len = get_rfc1002_length(req) + 4;
880
881         /* MUST set path len (NameLength) to 0 opening root of share */
882         if (uni_path_len >= 4) {
883                 req->NameLength = cpu_to_le16(uni_path_len - 2);
884                 /* -1 since last byte is buf[0] which is sent below (path) */
885                 iov[0].iov_len--;
886                 iov[1].iov_len = uni_path_len;
887                 iov[1].iov_base = path;
888                 /*
889                  * -1 since last byte is buf[0] which was counted in
890                  * smb2_buf_len.
891                  */
892                 inc_rfc1001_len(req, uni_path_len - 1);
893         } else {
894                 num_iovecs = 1;
895                 req->NameLength = 0;
896         }
897
898         rc = SendReceive2(xid, ses, iov, num_iovecs, &resp_buftype, 0);
899         rsp = (struct smb2_create_rsp *)iov[0].iov_base;
900
901         if (rc != 0) {
902                 cifs_stats_fail_inc(tcon, SMB2_CREATE_HE);
903                 goto creat_exit;
904         }
905
906         if (rsp == NULL) {
907                 rc = -EIO;
908                 goto creat_exit;
909         }
910         *persistent_fid = rsp->PersistentFileId;
911         *volatile_fid = rsp->VolatileFileId;
912
913         if (buf) {
914                 memcpy(buf, &rsp->CreationTime, 32);
915                 buf->AllocationSize = rsp->AllocationSize;
916                 buf->EndOfFile = rsp->EndofFile;
917                 buf->Attributes = rsp->FileAttributes;
918                 buf->NumberOfLinks = cpu_to_le32(1);
919                 buf->DeletePending = 0;
920         }
921 creat_exit:
922         free_rsp_buf(resp_buftype, rsp);
923         return rc;
924 }
925
926 int
927 SMB2_close(const unsigned int xid, struct cifs_tcon *tcon,
928            u64 persistent_fid, u64 volatile_fid)
929 {
930         struct smb2_close_req *req;
931         struct smb2_close_rsp *rsp;
932         struct TCP_Server_Info *server;
933         struct cifs_ses *ses = tcon->ses;
934         struct kvec iov[1];
935         int resp_buftype;
936         int rc = 0;
937
938         cFYI(1, "Close");
939
940         if (ses && (ses->server))
941                 server = ses->server;
942         else
943                 return -EIO;
944
945         rc = small_smb2_init(SMB2_CLOSE, tcon, (void **) &req);
946         if (rc)
947                 return rc;
948
949         req->PersistentFileId = persistent_fid;
950         req->VolatileFileId = volatile_fid;
951
952         iov[0].iov_base = (char *)req;
953         /* 4 for rfc1002 length field */
954         iov[0].iov_len = get_rfc1002_length(req) + 4;
955
956         rc = SendReceive2(xid, ses, iov, 1, &resp_buftype, 0);
957         rsp = (struct smb2_close_rsp *)iov[0].iov_base;
958
959         if (rc != 0) {
960                 if (tcon)
961                         cifs_stats_fail_inc(tcon, SMB2_CLOSE_HE);
962                 goto close_exit;
963         }
964
965         if (rsp == NULL) {
966                 rc = -EIO;
967                 goto close_exit;
968         }
969
970         /* BB FIXME - decode close response, update inode for caching */
971
972 close_exit:
973         free_rsp_buf(resp_buftype, rsp);
974         return rc;
975 }
976
977 static int
978 validate_buf(unsigned int offset, unsigned int buffer_length,
979              struct smb2_hdr *hdr, unsigned int min_buf_size)
980
981 {
982         unsigned int smb_len = be32_to_cpu(hdr->smb2_buf_length);
983         char *end_of_smb = smb_len + 4 /* RFC1001 length field */ + (char *)hdr;
984         char *begin_of_buf = 4 /* RFC1001 len field */ + offset + (char *)hdr;
985         char *end_of_buf = begin_of_buf + buffer_length;
986
987
988         if (buffer_length < min_buf_size) {
989                 cERROR(1, "buffer length %d smaller than minimum size %d",
990                            buffer_length, min_buf_size);
991                 return -EINVAL;
992         }
993
994         /* check if beyond RFC1001 maximum length */
995         if ((smb_len > 0x7FFFFF) || (buffer_length > 0x7FFFFF)) {
996                 cERROR(1, "buffer length %d or smb length %d too large",
997                            buffer_length, smb_len);
998                 return -EINVAL;
999         }
1000
1001         if ((begin_of_buf > end_of_smb) || (end_of_buf > end_of_smb)) {
1002                 cERROR(1, "illegal server response, bad offset to data");
1003                 return -EINVAL;
1004         }
1005
1006         return 0;
1007 }
1008
1009 /*
1010  * If SMB buffer fields are valid, copy into temporary buffer to hold result.
1011  * Caller must free buffer.
1012  */
1013 static int
1014 validate_and_copy_buf(unsigned int offset, unsigned int buffer_length,
1015                       struct smb2_hdr *hdr, unsigned int minbufsize,
1016                       char *data)
1017
1018 {
1019         char *begin_of_buf = 4 /* RFC1001 len field */ + offset + (char *)hdr;
1020         int rc;
1021
1022         if (!data)
1023                 return -EINVAL;
1024
1025         rc = validate_buf(offset, buffer_length, hdr, minbufsize);
1026         if (rc)
1027                 return rc;
1028
1029         memcpy(data, begin_of_buf, buffer_length);
1030
1031         return 0;
1032 }
1033
1034 static int
1035 query_info(const unsigned int xid, struct cifs_tcon *tcon,
1036            u64 persistent_fid, u64 volatile_fid, u8 info_class,
1037            size_t output_len, size_t min_len, void *data)
1038 {
1039         struct smb2_query_info_req *req;
1040         struct smb2_query_info_rsp *rsp = NULL;
1041         struct kvec iov[2];
1042         int rc = 0;
1043         int resp_buftype;
1044         struct TCP_Server_Info *server;
1045         struct cifs_ses *ses = tcon->ses;
1046
1047         cFYI(1, "Query Info");
1048
1049         if (ses && (ses->server))
1050                 server = ses->server;
1051         else
1052                 return -EIO;
1053
1054         rc = small_smb2_init(SMB2_QUERY_INFO, tcon, (void **) &req);
1055         if (rc)
1056                 return rc;
1057
1058         req->InfoType = SMB2_O_INFO_FILE;
1059         req->FileInfoClass = info_class;
1060         req->PersistentFileId = persistent_fid;
1061         req->VolatileFileId = volatile_fid;
1062         /* 4 for rfc1002 length field and 1 for Buffer */
1063         req->InputBufferOffset =
1064                 cpu_to_le16(sizeof(struct smb2_query_info_req) - 1 - 4);
1065         req->OutputBufferLength = cpu_to_le32(output_len);
1066
1067         iov[0].iov_base = (char *)req;
1068         /* 4 for rfc1002 length field */
1069         iov[0].iov_len = get_rfc1002_length(req) + 4;
1070
1071         rc = SendReceive2(xid, ses, iov, 1, &resp_buftype, 0);
1072         if (rc) {
1073                 cifs_stats_fail_inc(tcon, SMB2_QUERY_INFO_HE);
1074                 goto qinf_exit;
1075         }
1076
1077         rsp = (struct smb2_query_info_rsp *)iov[0].iov_base;
1078
1079         rc = validate_and_copy_buf(le16_to_cpu(rsp->OutputBufferOffset),
1080                                    le32_to_cpu(rsp->OutputBufferLength),
1081                                    &rsp->hdr, min_len, data);
1082
1083 qinf_exit:
1084         free_rsp_buf(resp_buftype, rsp);
1085         return rc;
1086 }
1087
1088 int
1089 SMB2_query_info(const unsigned int xid, struct cifs_tcon *tcon,
1090                 u64 persistent_fid, u64 volatile_fid,
1091                 struct smb2_file_all_info *data)
1092 {
1093         return query_info(xid, tcon, persistent_fid, volatile_fid,
1094                           FILE_ALL_INFORMATION,
1095                           sizeof(struct smb2_file_all_info) + MAX_NAME * 2,
1096                           sizeof(struct smb2_file_all_info), data);
1097 }
1098
1099 int
1100 SMB2_get_srv_num(const unsigned int xid, struct cifs_tcon *tcon,
1101                  u64 persistent_fid, u64 volatile_fid, __le64 *uniqueid)
1102 {
1103         return query_info(xid, tcon, persistent_fid, volatile_fid,
1104                           FILE_INTERNAL_INFORMATION,
1105                           sizeof(struct smb2_file_internal_info),
1106                           sizeof(struct smb2_file_internal_info), uniqueid);
1107 }
1108
1109 /*
1110  * This is a no-op for now. We're not really interested in the reply, but
1111  * rather in the fact that the server sent one and that server->lstrp
1112  * gets updated.
1113  *
1114  * FIXME: maybe we should consider checking that the reply matches request?
1115  */
1116 static void
1117 smb2_echo_callback(struct mid_q_entry *mid)
1118 {
1119         struct TCP_Server_Info *server = mid->callback_data;
1120         struct smb2_echo_rsp *smb2 = (struct smb2_echo_rsp *)mid->resp_buf;
1121         unsigned int credits_received = 1;
1122
1123         if (mid->mid_state == MID_RESPONSE_RECEIVED)
1124                 credits_received = le16_to_cpu(smb2->hdr.CreditRequest);
1125
1126         DeleteMidQEntry(mid);
1127         add_credits(server, credits_received, CIFS_ECHO_OP);
1128 }
1129
1130 int
1131 SMB2_echo(struct TCP_Server_Info *server)
1132 {
1133         struct smb2_echo_req *req;
1134         int rc = 0;
1135         struct kvec iov;
1136
1137         cFYI(1, "In echo request");
1138
1139         rc = small_smb2_init(SMB2_ECHO, NULL, (void **)&req);
1140         if (rc)
1141                 return rc;
1142
1143         req->hdr.CreditRequest = cpu_to_le16(1);
1144
1145         iov.iov_base = (char *)req;
1146         /* 4 for rfc1002 length field */
1147         iov.iov_len = get_rfc1002_length(req) + 4;
1148
1149         rc = cifs_call_async(server, &iov, 1, NULL, smb2_echo_callback, server,
1150                              CIFS_ECHO_OP);
1151         if (rc)
1152                 cFYI(1, "Echo request failed: %d", rc);
1153
1154         cifs_small_buf_release(req);
1155         return rc;
1156 }
1157
1158 int
1159 SMB2_flush(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid,
1160            u64 volatile_fid)
1161 {
1162         struct smb2_flush_req *req;
1163         struct TCP_Server_Info *server;
1164         struct cifs_ses *ses = tcon->ses;
1165         struct kvec iov[1];
1166         int resp_buftype;
1167         int rc = 0;
1168
1169         cFYI(1, "Flush");
1170
1171         if (ses && (ses->server))
1172                 server = ses->server;
1173         else
1174                 return -EIO;
1175
1176         rc = small_smb2_init(SMB2_FLUSH, tcon, (void **) &req);
1177         if (rc)
1178                 return rc;
1179
1180         req->PersistentFileId = persistent_fid;
1181         req->VolatileFileId = volatile_fid;
1182
1183         iov[0].iov_base = (char *)req;
1184         /* 4 for rfc1002 length field */
1185         iov[0].iov_len = get_rfc1002_length(req) + 4;
1186
1187         rc = SendReceive2(xid, ses, iov, 1, &resp_buftype, 0);
1188
1189         if ((rc != 0) && tcon)
1190                 cifs_stats_fail_inc(tcon, SMB2_FLUSH_HE);
1191
1192         free_rsp_buf(resp_buftype, iov[0].iov_base);
1193         return rc;
1194 }
1195
1196 /*
1197  * To form a chain of read requests, any read requests after the first should
1198  * have the end_of_chain boolean set to true.
1199  */
1200 static int
1201 smb2_new_read_req(struct kvec *iov, struct cifs_io_parms *io_parms,
1202                   unsigned int remaining_bytes, int request_type)
1203 {
1204         int rc = -EACCES;
1205         struct smb2_read_req *req = NULL;
1206
1207         rc = small_smb2_init(SMB2_READ, io_parms->tcon, (void **) &req);
1208         if (rc)
1209                 return rc;
1210         if (io_parms->tcon->ses->server == NULL)
1211                 return -ECONNABORTED;
1212
1213         req->hdr.ProcessId = cpu_to_le32(io_parms->pid);
1214
1215         req->PersistentFileId = io_parms->persistent_fid;
1216         req->VolatileFileId = io_parms->volatile_fid;
1217         req->ReadChannelInfoOffset = 0; /* reserved */
1218         req->ReadChannelInfoLength = 0; /* reserved */
1219         req->Channel = 0; /* reserved */
1220         req->MinimumCount = 0;
1221         req->Length = cpu_to_le32(io_parms->length);
1222         req->Offset = cpu_to_le64(io_parms->offset);
1223
1224         if (request_type & CHAINED_REQUEST) {
1225                 if (!(request_type & END_OF_CHAIN)) {
1226                         /* 4 for rfc1002 length field */
1227                         req->hdr.NextCommand =
1228                                 cpu_to_le32(get_rfc1002_length(req) + 4);
1229                 } else /* END_OF_CHAIN */
1230                         req->hdr.NextCommand = 0;
1231                 if (request_type & RELATED_REQUEST) {
1232                         req->hdr.Flags |= SMB2_FLAGS_RELATED_OPERATIONS;
1233                         /*
1234                          * Related requests use info from previous read request
1235                          * in chain.
1236                          */
1237                         req->hdr.SessionId = 0xFFFFFFFF;
1238                         req->hdr.TreeId = 0xFFFFFFFF;
1239                         req->PersistentFileId = 0xFFFFFFFF;
1240                         req->VolatileFileId = 0xFFFFFFFF;
1241                 }
1242         }
1243         if (remaining_bytes > io_parms->length)
1244                 req->RemainingBytes = cpu_to_le32(remaining_bytes);
1245         else
1246                 req->RemainingBytes = 0;
1247
1248         iov[0].iov_base = (char *)req;
1249         /* 4 for rfc1002 length field */
1250         iov[0].iov_len = get_rfc1002_length(req) + 4;
1251         return rc;
1252 }
1253
1254 static void
1255 smb2_readv_callback(struct mid_q_entry *mid)
1256 {
1257         struct cifs_readdata *rdata = mid->callback_data;
1258         struct cifs_tcon *tcon = tlink_tcon(rdata->cfile->tlink);
1259         struct TCP_Server_Info *server = tcon->ses->server;
1260         struct smb2_hdr *buf = (struct smb2_hdr *)rdata->iov[0].iov_base;
1261         unsigned int credits_received = 1;
1262
1263         cFYI(1, "%s: mid=%llu state=%d result=%d bytes=%u", __func__,
1264                 mid->mid, mid->mid_state, rdata->result, rdata->bytes);
1265
1266         switch (mid->mid_state) {
1267         case MID_RESPONSE_RECEIVED:
1268                 credits_received = le16_to_cpu(buf->CreditRequest);
1269                 /* result already set, check signature */
1270                 /* if (server->sec_mode &
1271                     (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
1272                         if (smb2_verify_signature(mid->resp_buf, server))
1273                                 cERROR(1, "Unexpected SMB signature"); */
1274                 /* FIXME: should this be counted toward the initiating task? */
1275                 task_io_account_read(rdata->bytes);
1276                 cifs_stats_bytes_read(tcon, rdata->bytes);
1277                 break;
1278         case MID_REQUEST_SUBMITTED:
1279         case MID_RETRY_NEEDED:
1280                 rdata->result = -EAGAIN;
1281                 break;
1282         default:
1283                 if (rdata->result != -ENODATA)
1284                         rdata->result = -EIO;
1285         }
1286
1287         if (rdata->result)
1288                 cifs_stats_fail_inc(tcon, SMB2_READ_HE);
1289
1290         queue_work(cifsiod_wq, &rdata->work);
1291         DeleteMidQEntry(mid);
1292         add_credits(server, credits_received, 0);
1293 }
1294
1295 /* smb2_async_readv - send an async write, and set up mid to handle result */
1296 int
1297 smb2_async_readv(struct cifs_readdata *rdata)
1298 {
1299         int rc;
1300         struct smb2_hdr *buf;
1301         struct cifs_io_parms io_parms;
1302
1303         cFYI(1, "%s: offset=%llu bytes=%u", __func__,
1304                 rdata->offset, rdata->bytes);
1305
1306         io_parms.tcon = tlink_tcon(rdata->cfile->tlink);
1307         io_parms.offset = rdata->offset;
1308         io_parms.length = rdata->bytes;
1309         io_parms.persistent_fid = rdata->cfile->fid.persistent_fid;
1310         io_parms.volatile_fid = rdata->cfile->fid.volatile_fid;
1311         io_parms.pid = rdata->pid;
1312         rc = smb2_new_read_req(&rdata->iov[0], &io_parms, 0, 0);
1313         if (rc)
1314                 return rc;
1315
1316         buf = (struct smb2_hdr *)rdata->iov[0].iov_base;
1317         /* 4 for rfc1002 length field */
1318         rdata->iov[0].iov_len = get_rfc1002_length(rdata->iov[0].iov_base) + 4;
1319
1320         kref_get(&rdata->refcount);
1321         rc = cifs_call_async(io_parms.tcon->ses->server, rdata->iov, 1,
1322                              cifs_readv_receive, smb2_readv_callback,
1323                              rdata, 0);
1324         if (rc)
1325                 kref_put(&rdata->refcount, cifs_readdata_release);
1326
1327         cifs_small_buf_release(buf);
1328         return rc;
1329 }