~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/fs/cifs/smb2pdu.c

Version: ~ [ linux-4.17-rc6 ] ~ [ linux-4.16.10 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.42 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.101 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.132 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.51 ] ~ [ linux-4.0.9 ] ~ [ linux-3.19.8 ] ~ [ linux-3.18.109 ] ~ [ linux-3.17.8 ] ~ [ linux-3.16.56 ] ~ [ linux-3.15.10 ] ~ [ linux-3.14.79 ] ~ [ linux-3.13.11 ] ~ [ linux-3.12.74 ] ~ [ linux-3.11.10 ] ~ [ linux-3.10.108 ] ~ [ linux-3.9.11 ] ~ [ linux-3.8.13 ] ~ [ linux-3.7.10 ] ~ [ linux-3.6.11 ] ~ [ linux-3.5.7 ] ~ [ linux-3.4.113 ] ~ [ linux-3.3.8 ] ~ [ linux-3.2.101 ] ~ [ linux-3.1.10 ] ~ [ linux-3.0.101 ] ~ [ linux-2.6.39.4 ] ~ [ linux-2.6.38.8 ] ~ [ linux-2.6.37.6 ] ~ [ linux-2.6.36.4 ] ~ [ linux-2.6.35.14 ] ~ [ linux-2.6.34.15 ] ~ [ linux-2.6.33.20 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.27.62 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 /*
  2  *   fs/cifs/smb2pdu.c
  3  *
  4  *   Copyright (C) International Business Machines  Corp., 2009, 2013
  5  *                 Etersoft, 2012
  6  *   Author(s): Steve French (sfrench@us.ibm.com)
  7  *              Pavel Shilovsky (pshilovsky@samba.org) 2012
  8  *
  9  *   Contains the routines for constructing the SMB2 PDUs themselves
 10  *
 11  *   This library is free software; you can redistribute it and/or modify
 12  *   it under the terms of the GNU Lesser General Public License as published
 13  *   by the Free Software Foundation; either version 2.1 of the License, or
 14  *   (at your option) any later version.
 15  *
 16  *   This library is distributed in the hope that it will be useful,
 17  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
 18  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See
 19  *   the GNU Lesser General Public License for more details.
 20  *
 21  *   You should have received a copy of the GNU Lesser General Public License
 22  *   along with this library; if not, write to the Free Software
 23  *   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
 24  */
 25 
 26  /* SMB2 PDU handling routines here - except for leftovers (eg session setup) */
 27  /* Note that there are handle based routines which must be                   */
 28  /* treated slightly differently for reconnection purposes since we never     */
 29  /* want to reuse a stale file handle and only the caller knows the file info */
 30 
 31 #include <linux/fs.h>
 32 #include <linux/kernel.h>
 33 #include <linux/vfs.h>
 34 #include <linux/task_io_accounting_ops.h>
 35 #include <linux/uaccess.h>
 36 #include <linux/uuid.h>
 37 #include <linux/pagemap.h>
 38 #include <linux/xattr.h>
 39 #include "smb2pdu.h"
 40 #include "cifsglob.h"
 41 #include "cifsacl.h"
 42 #include "cifsproto.h"
 43 #include "smb2proto.h"
 44 #include "cifs_unicode.h"
 45 #include "cifs_debug.h"
 46 #include "ntlmssp.h"
 47 #include "smb2status.h"
 48 #include "smb2glob.h"
 49 #include "cifspdu.h"
 50 #include "cifs_spnego.h"
 51 #include "smbdirect.h"
 52 
 53 /*
 54  *  The following table defines the expected "StructureSize" of SMB2 requests
 55  *  in order by SMB2 command.  This is similar to "wct" in SMB/CIFS requests.
 56  *
 57  *  Note that commands are defined in smb2pdu.h in le16 but the array below is
 58  *  indexed by command in host byte order.
 59  */
 60 static const int smb2_req_struct_sizes[NUMBER_OF_SMB2_COMMANDS] = {
 61         /* SMB2_NEGOTIATE */ 36,
 62         /* SMB2_SESSION_SETUP */ 25,
 63         /* SMB2_LOGOFF */ 4,
 64         /* SMB2_TREE_CONNECT */ 9,
 65         /* SMB2_TREE_DISCONNECT */ 4,
 66         /* SMB2_CREATE */ 57,
 67         /* SMB2_CLOSE */ 24,
 68         /* SMB2_FLUSH */ 24,
 69         /* SMB2_READ */ 49,
 70         /* SMB2_WRITE */ 49,
 71         /* SMB2_LOCK */ 48,
 72         /* SMB2_IOCTL */ 57,
 73         /* SMB2_CANCEL */ 4,
 74         /* SMB2_ECHO */ 4,
 75         /* SMB2_QUERY_DIRECTORY */ 33,
 76         /* SMB2_CHANGE_NOTIFY */ 32,
 77         /* SMB2_QUERY_INFO */ 41,
 78         /* SMB2_SET_INFO */ 33,
 79         /* SMB2_OPLOCK_BREAK */ 24 /* BB this is 36 for LEASE_BREAK variant */
 80 };
 81 
 82 static int encryption_required(const struct cifs_tcon *tcon)
 83 {
 84         if (!tcon)
 85                 return 0;
 86         if ((tcon->ses->session_flags & SMB2_SESSION_FLAG_ENCRYPT_DATA) ||
 87             (tcon->share_flags & SHI1005_FLAGS_ENCRYPT_DATA))
 88                 return 1;
 89         if (tcon->seal &&
 90             (tcon->ses->server->capabilities & SMB2_GLOBAL_CAP_ENCRYPTION))
 91                 return 1;
 92         return 0;
 93 }
 94 
 95 static void
 96 smb2_hdr_assemble(struct smb2_sync_hdr *shdr, __le16 smb2_cmd,
 97                   const struct cifs_tcon *tcon)
 98 {
 99         shdr->ProtocolId = SMB2_PROTO_NUMBER;
100         shdr->StructureSize = cpu_to_le16(64);
101         shdr->Command = smb2_cmd;
102         if (tcon && tcon->ses && tcon->ses->server) {
103                 struct TCP_Server_Info *server = tcon->ses->server;
104 
105                 spin_lock(&server->req_lock);
106                 /* Request up to 2 credits but don't go over the limit. */
107                 if (server->credits >= server->max_credits)
108                         shdr->CreditRequest = cpu_to_le16(0);
109                 else
110                         shdr->CreditRequest = cpu_to_le16(
111                                 min_t(int, server->max_credits -
112                                                 server->credits, 2));
113                 spin_unlock(&server->req_lock);
114         } else {
115                 shdr->CreditRequest = cpu_to_le16(2);
116         }
117         shdr->ProcessId = cpu_to_le32((__u16)current->tgid);
118 
119         if (!tcon)
120                 goto out;
121 
122         /* GLOBAL_CAP_LARGE_MTU will only be set if dialect > SMB2.02 */
123         /* See sections 2.2.4 and 3.2.4.1.5 of MS-SMB2 */
124         if ((tcon->ses) && (tcon->ses->server) &&
125             (tcon->ses->server->capabilities & SMB2_GLOBAL_CAP_LARGE_MTU))
126                 shdr->CreditCharge = cpu_to_le16(1);
127         /* else CreditCharge MBZ */
128 
129         shdr->TreeId = tcon->tid;
130         /* Uid is not converted */
131         if (tcon->ses)
132                 shdr->SessionId = tcon->ses->Suid;
133 
134         /*
135          * If we would set SMB2_FLAGS_DFS_OPERATIONS on open we also would have
136          * to pass the path on the Open SMB prefixed by \\server\share.
137          * Not sure when we would need to do the augmented path (if ever) and
138          * setting this flag breaks the SMB2 open operation since it is
139          * illegal to send an empty path name (without \\server\share prefix)
140          * when the DFS flag is set in the SMB open header. We could
141          * consider setting the flag on all operations other than open
142          * but it is safer to net set it for now.
143          */
144 /*      if (tcon->share_flags & SHI1005_FLAGS_DFS)
145                 shdr->Flags |= SMB2_FLAGS_DFS_OPERATIONS; */
146 
147         if (tcon->ses && tcon->ses->server && tcon->ses->server->sign &&
148             !encryption_required(tcon))
149                 shdr->Flags |= SMB2_FLAGS_SIGNED;
150 out:
151         return;
152 }
153 
154 static int
155 smb2_reconnect(__le16 smb2_command, struct cifs_tcon *tcon)
156 {
157         int rc = 0;
158         struct nls_table *nls_codepage;
159         struct cifs_ses *ses;
160         struct TCP_Server_Info *server;
161 
162         /*
163          * SMB2s NegProt, SessSetup, Logoff do not have tcon yet so
164          * check for tcp and smb session status done differently
165          * for those three - in the calling routine.
166          */
167         if (tcon == NULL)
168                 return rc;
169 
170         if (smb2_command == SMB2_TREE_CONNECT)
171                 return rc;
172 
173         if (tcon->tidStatus == CifsExiting) {
174                 /*
175                  * only tree disconnect, open, and write,
176                  * (and ulogoff which does not have tcon)
177                  * are allowed as we start force umount.
178                  */
179                 if ((smb2_command != SMB2_WRITE) &&
180                    (smb2_command != SMB2_CREATE) &&
181                    (smb2_command != SMB2_TREE_DISCONNECT)) {
182                         cifs_dbg(FYI, "can not send cmd %d while umounting\n",
183                                  smb2_command);
184                         return -ENODEV;
185                 }
186         }
187         if ((!tcon->ses) || (tcon->ses->status == CifsExiting) ||
188             (!tcon->ses->server))
189                 return -EIO;
190 
191         ses = tcon->ses;
192         server = ses->server;
193 
194         /*
195          * Give demultiplex thread up to 10 seconds to reconnect, should be
196          * greater than cifs socket timeout which is 7 seconds
197          */
198         while (server->tcpStatus == CifsNeedReconnect) {
199                 /*
200                  * Return to caller for TREE_DISCONNECT and LOGOFF and CLOSE
201                  * here since they are implicitly done when session drops.
202                  */
203                 switch (smb2_command) {
204                 /*
205                  * BB Should we keep oplock break and add flush to exceptions?
206                  */
207                 case SMB2_TREE_DISCONNECT:
208                 case SMB2_CANCEL:
209                 case SMB2_CLOSE:
210                 case SMB2_OPLOCK_BREAK:
211                         return -EAGAIN;
212                 }
213 
214                 wait_event_interruptible_timeout(server->response_q,
215                         (server->tcpStatus != CifsNeedReconnect), 10 * HZ);
216 
217                 /* are we still trying to reconnect? */
218                 if (server->tcpStatus != CifsNeedReconnect)
219                         break;
220 
221                 /*
222                  * on "soft" mounts we wait once. Hard mounts keep
223                  * retrying until process is killed or server comes
224                  * back on-line
225                  */
226                 if (!tcon->retry) {
227                         cifs_dbg(FYI, "gave up waiting on reconnect in smb_init\n");
228                         return -EHOSTDOWN;
229                 }
230         }
231 
232         if (!tcon->ses->need_reconnect && !tcon->need_reconnect)
233                 return rc;
234 
235         nls_codepage = load_nls_default();
236 
237         /*
238          * need to prevent multiple threads trying to simultaneously reconnect
239          * the same SMB session
240          */
241         mutex_lock(&tcon->ses->session_mutex);
242 
243         /*
244          * Recheck after acquire mutex. If another thread is negotiating
245          * and the server never sends an answer the socket will be closed
246          * and tcpStatus set to reconnect.
247          */
248         if (server->tcpStatus == CifsNeedReconnect) {
249                 rc = -EHOSTDOWN;
250                 mutex_unlock(&tcon->ses->session_mutex);
251                 goto out;
252         }
253 
254         rc = cifs_negotiate_protocol(0, tcon->ses);
255         if (!rc && tcon->ses->need_reconnect)
256                 rc = cifs_setup_session(0, tcon->ses, nls_codepage);
257 
258         if (rc || !tcon->need_reconnect) {
259                 mutex_unlock(&tcon->ses->session_mutex);
260                 goto out;
261         }
262 
263         cifs_mark_open_files_invalid(tcon);
264         if (tcon->use_persistent)
265                 tcon->need_reopen_files = true;
266 
267         rc = SMB2_tcon(0, tcon->ses, tcon->treeName, tcon, nls_codepage);
268         mutex_unlock(&tcon->ses->session_mutex);
269 
270         cifs_dbg(FYI, "reconnect tcon rc = %d\n", rc);
271         if (rc) {
272                 /* If sess reconnected but tcon didn't, something strange ... */
273                 printk_once(KERN_WARNING "reconnect tcon failed rc = %d\n", rc);
274                 goto out;
275         }
276 
277         if (smb2_command != SMB2_INTERNAL_CMD)
278                 queue_delayed_work(cifsiod_wq, &server->reconnect, 0);
279 
280         atomic_inc(&tconInfoReconnectCount);
281 out:
282         /*
283          * Check if handle based operation so we know whether we can continue
284          * or not without returning to caller to reset file handle.
285          */
286         /*
287          * BB Is flush done by server on drop of tcp session? Should we special
288          * case it and skip above?
289          */
290         switch (smb2_command) {
291         case SMB2_FLUSH:
292         case SMB2_READ:
293         case SMB2_WRITE:
294         case SMB2_LOCK:
295         case SMB2_IOCTL:
296         case SMB2_QUERY_DIRECTORY:
297         case SMB2_CHANGE_NOTIFY:
298         case SMB2_QUERY_INFO:
299         case SMB2_SET_INFO:
300                 rc = -EAGAIN;
301         }
302         unload_nls(nls_codepage);
303         return rc;
304 }
305 
306 static void
307 fill_small_buf(__le16 smb2_command, struct cifs_tcon *tcon, void *buf,
308                unsigned int *total_len)
309 {
310         struct smb2_sync_pdu *spdu = (struct smb2_sync_pdu *)buf;
311         /* lookup word count ie StructureSize from table */
312         __u16 parmsize = smb2_req_struct_sizes[le16_to_cpu(smb2_command)];
313 
314         /*
315          * smaller than SMALL_BUFFER_SIZE but bigger than fixed area of
316          * largest operations (Create)
317          */
318         memset(buf, 0, 256);
319 
320         smb2_hdr_assemble(&spdu->sync_hdr, smb2_command, tcon);
321         spdu->StructureSize2 = cpu_to_le16(parmsize);
322 
323         *total_len = parmsize + sizeof(struct smb2_sync_hdr);
324 }
325 
326 /*
327  * Allocate and return pointer to an SMB request hdr, and set basic
328  * SMB information in the SMB header. If the return code is zero, this
329  * function must have filled in request_buf pointer.
330  */
331 static int
332 smb2_plain_req_init(__le16 smb2_command, struct cifs_tcon *tcon,
333                     void **request_buf, unsigned int *total_len)
334 {
335         int rc;
336 
337         rc = smb2_reconnect(smb2_command, tcon);
338         if (rc)
339                 return rc;
340 
341         /* BB eventually switch this to SMB2 specific small buf size */
342         *request_buf = cifs_small_buf_get();
343         if (*request_buf == NULL) {
344                 /* BB should we add a retry in here if not a writepage? */
345                 return -ENOMEM;
346         }
347 
348         fill_small_buf(smb2_command, tcon,
349                        (struct smb2_sync_hdr *)(*request_buf),
350                        total_len);
351 
352         if (tcon != NULL) {
353 #ifdef CONFIG_CIFS_STATS2
354                 uint16_t com_code = le16_to_cpu(smb2_command);
355                 cifs_stats_inc(&tcon->stats.smb2_stats.smb2_com_sent[com_code]);
356 #endif
357                 cifs_stats_inc(&tcon->num_smbs_sent);
358         }
359 
360         return rc;
361 }
362 
363 #ifdef CONFIG_CIFS_SMB311
364 /* offset is sizeof smb2_negotiate_req but rounded up to 8 bytes */
365 #define OFFSET_OF_NEG_CONTEXT 0x68  /* sizeof(struct smb2_negotiate_req) */
366 
367 
368 #define SMB2_PREAUTH_INTEGRITY_CAPABILITIES     cpu_to_le16(1)
369 #define SMB2_ENCRYPTION_CAPABILITIES            cpu_to_le16(2)
370 
371 static void
372 build_preauth_ctxt(struct smb2_preauth_neg_context *pneg_ctxt)
373 {
374         pneg_ctxt->ContextType = SMB2_PREAUTH_INTEGRITY_CAPABILITIES;
375         pneg_ctxt->DataLength = cpu_to_le16(38);
376         pneg_ctxt->HashAlgorithmCount = cpu_to_le16(1);
377         pneg_ctxt->SaltLength = cpu_to_le16(SMB311_SALT_SIZE);
378         get_random_bytes(pneg_ctxt->Salt, SMB311_SALT_SIZE);
379         pneg_ctxt->HashAlgorithms = SMB2_PREAUTH_INTEGRITY_SHA512;
380 }
381 
382 static void
383 build_encrypt_ctxt(struct smb2_encryption_neg_context *pneg_ctxt)
384 {
385         pneg_ctxt->ContextType = SMB2_ENCRYPTION_CAPABILITIES;
386         pneg_ctxt->DataLength = cpu_to_le16(4); /* Cipher Count + le16 cipher */
387         pneg_ctxt->CipherCount = cpu_to_le16(1);
388 /* pneg_ctxt->Ciphers[0] = SMB2_ENCRYPTION_AES128_GCM;*/ /* not supported yet */
389         pneg_ctxt->Ciphers[0] = SMB2_ENCRYPTION_AES128_CCM;
390 }
391 
392 static void
393 assemble_neg_contexts(struct smb2_negotiate_req *req,
394                       unsigned int *total_len)
395 {
396         char *pneg_ctxt = (char *)req + OFFSET_OF_NEG_CONTEXT;
397 
398         build_preauth_ctxt((struct smb2_preauth_neg_context *)pneg_ctxt);
399         /* Add 2 to size to round to 8 byte boundary */
400 
401         pneg_ctxt += 2 + sizeof(struct smb2_preauth_neg_context);
402         build_encrypt_ctxt((struct smb2_encryption_neg_context *)pneg_ctxt);
403         req->NegotiateContextOffset = cpu_to_le32(OFFSET_OF_NEG_CONTEXT);
404         req->NegotiateContextCount = cpu_to_le16(2);
405 
406         *total_len += 4 + sizeof(struct smb2_preauth_neg_context)
407                 + sizeof(struct smb2_encryption_neg_context);
408 }
409 
410 static void decode_preauth_context(struct smb2_preauth_neg_context *ctxt)
411 {
412         unsigned int len = le16_to_cpu(ctxt->DataLength);
413 
414         /* If invalid preauth context warn but use what we requested, SHA-512 */
415         if (len < MIN_PREAUTH_CTXT_DATA_LEN) {
416                 printk_once(KERN_WARNING "server sent bad preauth context\n");
417                 return;
418         }
419         if (le16_to_cpu(ctxt->HashAlgorithmCount) != 1)
420                 printk_once(KERN_WARNING "illegal SMB3 hash algorithm count\n");
421         if (ctxt->HashAlgorithms != SMB2_PREAUTH_INTEGRITY_SHA512)
422                 printk_once(KERN_WARNING "unknown SMB3 hash algorithm\n");
423 }
424 
425 static int decode_encrypt_ctx(struct TCP_Server_Info *server,
426                               struct smb2_encryption_neg_context *ctxt)
427 {
428         unsigned int len = le16_to_cpu(ctxt->DataLength);
429 
430         cifs_dbg(FYI, "decode SMB3.11 encryption neg context of len %d\n", len);
431         if (len < MIN_ENCRYPT_CTXT_DATA_LEN) {
432                 printk_once(KERN_WARNING "server sent bad crypto ctxt len\n");
433                 return -EINVAL;
434         }
435 
436         if (le16_to_cpu(ctxt->CipherCount) != 1) {
437                 printk_once(KERN_WARNING "illegal SMB3.11 cipher count\n");
438                 return -EINVAL;
439         }
440         cifs_dbg(FYI, "SMB311 cipher type:%d\n", le16_to_cpu(ctxt->Ciphers[0]));
441         if ((ctxt->Ciphers[0] != SMB2_ENCRYPTION_AES128_CCM) &&
442             (ctxt->Ciphers[0] != SMB2_ENCRYPTION_AES128_GCM)) {
443                 printk_once(KERN_WARNING "invalid SMB3.11 cipher returned\n");
444                 return -EINVAL;
445         }
446         server->cipher_type = ctxt->Ciphers[0];
447         server->capabilities |= SMB2_GLOBAL_CAP_ENCRYPTION;
448         return 0;
449 }
450 
451 static int smb311_decode_neg_context(struct smb2_negotiate_rsp *rsp,
452                                      struct TCP_Server_Info *server)
453 {
454         struct smb2_neg_context *pctx;
455         unsigned int offset = le32_to_cpu(rsp->NegotiateContextOffset);
456         unsigned int ctxt_cnt = le16_to_cpu(rsp->NegotiateContextCount);
457         unsigned int len_of_smb = be32_to_cpu(rsp->hdr.smb2_buf_length);
458         unsigned int len_of_ctxts, i;
459         int rc = 0;
460 
461         cifs_dbg(FYI, "decoding %d negotiate contexts\n", ctxt_cnt);
462         if (len_of_smb <= offset) {
463                 cifs_dbg(VFS, "Invalid response: negotiate context offset\n");
464                 return -EINVAL;
465         }
466 
467         len_of_ctxts = len_of_smb - offset;
468 
469         for (i = 0; i < ctxt_cnt; i++) {
470                 int clen;
471                 /* check that offset is not beyond end of SMB */
472                 if (len_of_ctxts == 0)
473                         break;
474 
475                 if (len_of_ctxts < sizeof(struct smb2_neg_context))
476                         break;
477 
478                 pctx = (struct smb2_neg_context *)(offset +
479                         server->vals->header_preamble_size + (char *)rsp);
480                 clen = le16_to_cpu(pctx->DataLength);
481                 if (clen > len_of_ctxts)
482                         break;
483 
484                 if (pctx->ContextType == SMB2_PREAUTH_INTEGRITY_CAPABILITIES)
485                         decode_preauth_context(
486                                 (struct smb2_preauth_neg_context *)pctx);
487                 else if (pctx->ContextType == SMB2_ENCRYPTION_CAPABILITIES)
488                         rc = decode_encrypt_ctx(server,
489                                 (struct smb2_encryption_neg_context *)pctx);
490                 else
491                         cifs_dbg(VFS, "unknown negcontext of type %d ignored\n",
492                                 le16_to_cpu(pctx->ContextType));
493 
494                 if (rc)
495                         break;
496                 /* offsets must be 8 byte aligned */
497                 clen = (clen + 7) & ~0x7;
498                 offset += clen + sizeof(struct smb2_neg_context);
499                 len_of_ctxts -= clen;
500         }
501         return rc;
502 }
503 
504 #else
505 static void assemble_neg_contexts(struct smb2_negotiate_req *req,
506                                   unsigned int *total_len)
507 {
508         return;
509 }
510 #endif /* SMB311 */
511 
512 /*
513  *
514  *      SMB2 Worker functions follow:
515  *
516  *      The general structure of the worker functions is:
517  *      1) Call smb2_init (assembles SMB2 header)
518  *      2) Initialize SMB2 command specific fields in fixed length area of SMB
519  *      3) Call smb_sendrcv2 (sends request on socket and waits for response)
520  *      4) Decode SMB2 command specific fields in the fixed length area
521  *      5) Decode variable length data area (if any for this SMB2 command type)
522  *      6) Call free smb buffer
523  *      7) return
524  *
525  */
526 
527 int
528 SMB2_negotiate(const unsigned int xid, struct cifs_ses *ses)
529 {
530         struct smb2_negotiate_req *req;
531         struct smb2_negotiate_rsp *rsp;
532         struct kvec iov[1];
533         struct kvec rsp_iov;
534         int rc = 0;
535         int resp_buftype;
536         struct TCP_Server_Info *server = ses->server;
537         int blob_offset, blob_length;
538         char *security_blob;
539         int flags = CIFS_NEG_OP;
540         unsigned int total_len;
541 
542         cifs_dbg(FYI, "Negotiate protocol\n");
543 
544         if (!server) {
545                 WARN(1, "%s: server is NULL!\n", __func__);
546                 return -EIO;
547         }
548 
549         rc = smb2_plain_req_init(SMB2_NEGOTIATE, NULL, (void **) &req, &total_len);
550         if (rc)
551                 return rc;
552 
553         req->sync_hdr.SessionId = 0;
554 #ifdef CONFIG_CIFS_SMB311
555         memset(server->preauth_sha_hash, 0, SMB2_PREAUTH_HASH_SIZE);
556         memset(ses->preauth_sha_hash, 0, SMB2_PREAUTH_HASH_SIZE);
557 #endif
558 
559         if (strcmp(ses->server->vals->version_string,
560                    SMB3ANY_VERSION_STRING) == 0) {
561                 req->Dialects[0] = cpu_to_le16(SMB30_PROT_ID);
562                 req->Dialects[1] = cpu_to_le16(SMB302_PROT_ID);
563                 req->DialectCount = cpu_to_le16(2);
564                 total_len += 4;
565         } else if (strcmp(ses->server->vals->version_string,
566                    SMBDEFAULT_VERSION_STRING) == 0) {
567                 req->Dialects[0] = cpu_to_le16(SMB21_PROT_ID);
568                 req->Dialects[1] = cpu_to_le16(SMB30_PROT_ID);
569                 req->Dialects[2] = cpu_to_le16(SMB302_PROT_ID);
570                 req->DialectCount = cpu_to_le16(3);
571                 total_len += 6;
572         } else {
573                 /* otherwise send specific dialect */
574                 req->Dialects[0] = cpu_to_le16(ses->server->vals->protocol_id);
575                 req->DialectCount = cpu_to_le16(1);
576                 total_len += 2;
577         }
578 
579         /* only one of SMB2 signing flags may be set in SMB2 request */
580         if (ses->sign)
581                 req->SecurityMode = cpu_to_le16(SMB2_NEGOTIATE_SIGNING_REQUIRED);
582         else if (global_secflags & CIFSSEC_MAY_SIGN)
583                 req->SecurityMode = cpu_to_le16(SMB2_NEGOTIATE_SIGNING_ENABLED);
584         else
585                 req->SecurityMode = 0;
586 
587         req->Capabilities = cpu_to_le32(ses->server->vals->req_capabilities);
588 
589         /* ClientGUID must be zero for SMB2.02 dialect */
590         if (ses->server->vals->protocol_id == SMB20_PROT_ID)
591                 memset(req->ClientGUID, 0, SMB2_CLIENT_GUID_SIZE);
592         else {
593                 memcpy(req->ClientGUID, server->client_guid,
594                         SMB2_CLIENT_GUID_SIZE);
595                 if (ses->server->vals->protocol_id == SMB311_PROT_ID)
596                         assemble_neg_contexts(req, &total_len);
597         }
598         iov[0].iov_base = (char *)req;
599         iov[0].iov_len = total_len;
600 
601         rc = smb2_send_recv(xid, ses, iov, 1, &resp_buftype, flags, &rsp_iov);
602         cifs_small_buf_release(req);
603         rsp = (struct smb2_negotiate_rsp *)rsp_iov.iov_base;
604         /*
605          * No tcon so can't do
606          * cifs_stats_inc(&tcon->stats.smb2_stats.smb2_com_fail[SMB2...]);
607          */
608         if (rc == -EOPNOTSUPP) {
609                 cifs_dbg(VFS, "Dialect not supported by server. Consider "
610                         "specifying vers=1.0 or vers=2.0 on mount for accessing"
611                         " older servers\n");
612                 goto neg_exit;
613         } else if (rc != 0)
614                 goto neg_exit;
615 
616         if (strcmp(ses->server->vals->version_string,
617                    SMB3ANY_VERSION_STRING) == 0) {
618                 if (rsp->DialectRevision == cpu_to_le16(SMB20_PROT_ID)) {
619                         cifs_dbg(VFS,
620                                 "SMB2 dialect returned but not requested\n");
621                         return -EIO;
622                 } else if (rsp->DialectRevision == cpu_to_le16(SMB21_PROT_ID)) {
623                         cifs_dbg(VFS,
624                                 "SMB2.1 dialect returned but not requested\n");
625                         return -EIO;
626                 }
627         } else if (strcmp(ses->server->vals->version_string,
628                    SMBDEFAULT_VERSION_STRING) == 0) {
629                 if (rsp->DialectRevision == cpu_to_le16(SMB20_PROT_ID)) {
630                         cifs_dbg(VFS,
631                                 "SMB2 dialect returned but not requested\n");
632                         return -EIO;
633                 } else if (rsp->DialectRevision == cpu_to_le16(SMB21_PROT_ID)) {
634                         /* ops set to 3.0 by default for default so update */
635                         ses->server->ops = &smb21_operations;
636                 }
637         } else if (le16_to_cpu(rsp->DialectRevision) !=
638                                 ses->server->vals->protocol_id) {
639                 /* if requested single dialect ensure returned dialect matched */
640                 cifs_dbg(VFS, "Illegal 0x%x dialect returned: not requested\n",
641                         le16_to_cpu(rsp->DialectRevision));
642                 return -EIO;
643         }
644 
645         cifs_dbg(FYI, "mode 0x%x\n", rsp->SecurityMode);
646 
647         if (rsp->DialectRevision == cpu_to_le16(SMB20_PROT_ID))
648                 cifs_dbg(FYI, "negotiated smb2.0 dialect\n");
649         else if (rsp->DialectRevision == cpu_to_le16(SMB21_PROT_ID))
650                 cifs_dbg(FYI, "negotiated smb2.1 dialect\n");
651         else if (rsp->DialectRevision == cpu_to_le16(SMB30_PROT_ID))
652                 cifs_dbg(FYI, "negotiated smb3.0 dialect\n");
653         else if (rsp->DialectRevision == cpu_to_le16(SMB302_PROT_ID))
654                 cifs_dbg(FYI, "negotiated smb3.02 dialect\n");
655 #ifdef CONFIG_CIFS_SMB311
656         else if (rsp->DialectRevision == cpu_to_le16(SMB311_PROT_ID))
657                 cifs_dbg(FYI, "negotiated smb3.1.1 dialect\n");
658 #endif /* SMB311 */
659         else {
660                 cifs_dbg(VFS, "Illegal dialect returned by server 0x%x\n",
661                          le16_to_cpu(rsp->DialectRevision));
662                 rc = -EIO;
663                 goto neg_exit;
664         }
665         server->dialect = le16_to_cpu(rsp->DialectRevision);
666 
667         /* BB: add check that dialect was valid given dialect(s) we asked for */
668 
669 #ifdef CONFIG_CIFS_SMB311
670         /*
671          * Keep a copy of the hash after negprot. This hash will be
672          * the starting hash value for all sessions made from this
673          * server.
674          */
675         memcpy(server->preauth_sha_hash, ses->preauth_sha_hash,
676                SMB2_PREAUTH_HASH_SIZE);
677 #endif
678         /* SMB2 only has an extended negflavor */
679         server->negflavor = CIFS_NEGFLAVOR_EXTENDED;
680         /* set it to the maximum buffer size value we can send with 1 credit */
681         server->maxBuf = min_t(unsigned int, le32_to_cpu(rsp->MaxTransactSize),
682                                SMB2_MAX_BUFFER_SIZE);
683         server->max_read = le32_to_cpu(rsp->MaxReadSize);
684         server->max_write = le32_to_cpu(rsp->MaxWriteSize);
685         server->sec_mode = le16_to_cpu(rsp->SecurityMode);
686         if ((server->sec_mode & SMB2_SEC_MODE_FLAGS_ALL) != server->sec_mode)
687                 cifs_dbg(FYI, "Server returned unexpected security mode 0x%x\n",
688                                 server->sec_mode);
689         server->capabilities = le32_to_cpu(rsp->Capabilities);
690         /* Internal types */
691         server->capabilities |= SMB2_NT_FIND | SMB2_LARGE_FILES;
692 
693         security_blob = smb2_get_data_area_len(&blob_offset, &blob_length,
694                                                &rsp->hdr);
695         /*
696          * See MS-SMB2 section 2.2.4: if no blob, client picks default which
697          * for us will be
698          *      ses->sectype = RawNTLMSSP;
699          * but for time being this is our only auth choice so doesn't matter.
700          * We just found a server which sets blob length to zero expecting raw.
701          */
702         if (blob_length == 0) {
703                 cifs_dbg(FYI, "missing security blob on negprot\n");
704                 server->sec_ntlmssp = true;
705         }
706 
707         rc = cifs_enable_signing(server, ses->sign);
708         if (rc)
709                 goto neg_exit;
710         if (blob_length) {
711                 rc = decode_negTokenInit(security_blob, blob_length, server);
712                 if (rc == 1)
713                         rc = 0;
714                 else if (rc == 0)
715                         rc = -EIO;
716         }
717 
718 #ifdef CONFIG_CIFS_SMB311
719         if (rsp->DialectRevision == cpu_to_le16(SMB311_PROT_ID)) {
720                 if (rsp->NegotiateContextCount)
721                         rc = smb311_decode_neg_context(rsp, server);
722                 else
723                         cifs_dbg(VFS, "Missing expected negotiate contexts\n");
724         }
725 #endif /* CONFIG_CIFS_SMB311 */
726 neg_exit:
727         free_rsp_buf(resp_buftype, rsp);
728         return rc;
729 }
730 
731 int smb3_validate_negotiate(const unsigned int xid, struct cifs_tcon *tcon)
732 {
733         int rc;
734         struct validate_negotiate_info_req *pneg_inbuf;
735         struct validate_negotiate_info_rsp *pneg_rsp = NULL;
736         u32 rsplen;
737         u32 inbuflen; /* max of 4 dialects */
738 
739         cifs_dbg(FYI, "validate negotiate\n");
740 
741         /* In SMB3.11 preauth integrity supersedes validate negotiate */
742         if (tcon->ses->server->dialect == SMB311_PROT_ID)
743                 return 0;
744 
745         /*
746          * validation ioctl must be signed, so no point sending this if we
747          * can not sign it (ie are not known user).  Even if signing is not
748          * required (enabled but not negotiated), in those cases we selectively
749          * sign just this, the first and only signed request on a connection.
750          * Having validation of negotiate info  helps reduce attack vectors.
751          */
752         if (tcon->ses->session_flags & SMB2_SESSION_FLAG_IS_GUEST)
753                 return 0; /* validation requires signing */
754 
755         if (tcon->ses->user_name == NULL) {
756                 cifs_dbg(FYI, "Can't validate negotiate: null user mount\n");
757                 return 0; /* validation requires signing */
758         }
759 
760         if (tcon->ses->session_flags & SMB2_SESSION_FLAG_IS_NULL)
761                 cifs_dbg(VFS, "Unexpected null user (anonymous) auth flag sent by server\n");
762 
763         pneg_inbuf = kmalloc(sizeof(*pneg_inbuf), GFP_NOFS);
764         if (!pneg_inbuf)
765                 return -ENOMEM;
766 
767         pneg_inbuf->Capabilities =
768                         cpu_to_le32(tcon->ses->server->vals->req_capabilities);
769         memcpy(pneg_inbuf->Guid, tcon->ses->server->client_guid,
770                                         SMB2_CLIENT_GUID_SIZE);
771 
772         if (tcon->ses->sign)
773                 pneg_inbuf->SecurityMode =
774                         cpu_to_le16(SMB2_NEGOTIATE_SIGNING_REQUIRED);
775         else if (global_secflags & CIFSSEC_MAY_SIGN)
776                 pneg_inbuf->SecurityMode =
777                         cpu_to_le16(SMB2_NEGOTIATE_SIGNING_ENABLED);
778         else
779                 pneg_inbuf->SecurityMode = 0;
780 
781 
782         if (strcmp(tcon->ses->server->vals->version_string,
783                 SMB3ANY_VERSION_STRING) == 0) {
784                 pneg_inbuf->Dialects[0] = cpu_to_le16(SMB30_PROT_ID);
785                 pneg_inbuf->Dialects[1] = cpu_to_le16(SMB302_PROT_ID);
786                 pneg_inbuf->DialectCount = cpu_to_le16(2);
787                 /* structure is big enough for 3 dialects, sending only 2 */
788                 inbuflen = sizeof(*pneg_inbuf) -
789                                 sizeof(pneg_inbuf->Dialects[0]);
790         } else if (strcmp(tcon->ses->server->vals->version_string,
791                 SMBDEFAULT_VERSION_STRING) == 0) {
792                 pneg_inbuf->Dialects[0] = cpu_to_le16(SMB21_PROT_ID);
793                 pneg_inbuf->Dialects[1] = cpu_to_le16(SMB30_PROT_ID);
794                 pneg_inbuf->Dialects[2] = cpu_to_le16(SMB302_PROT_ID);
795                 pneg_inbuf->DialectCount = cpu_to_le16(3);
796                 /* structure is big enough for 3 dialects */
797                 inbuflen = sizeof(*pneg_inbuf);
798         } else {
799                 /* otherwise specific dialect was requested */
800                 pneg_inbuf->Dialects[0] =
801                         cpu_to_le16(tcon->ses->server->vals->protocol_id);
802                 pneg_inbuf->DialectCount = cpu_to_le16(1);
803                 /* structure is big enough for 3 dialects, sending only 1 */
804                 inbuflen = sizeof(*pneg_inbuf) -
805                                 sizeof(pneg_inbuf->Dialects[0]) * 2;
806         }
807 
808         rc = SMB2_ioctl(xid, tcon, NO_FILE_ID, NO_FILE_ID,
809                 FSCTL_VALIDATE_NEGOTIATE_INFO, true /* is_fsctl */,
810                 (char *)pneg_inbuf, inbuflen, (char **)&pneg_rsp, &rsplen);
811 
812         if (rc != 0) {
813                 cifs_dbg(VFS, "validate protocol negotiate failed: %d\n", rc);
814                 rc = -EIO;
815                 goto out_free_inbuf;
816         }
817 
818         rc = -EIO;
819         if (rsplen != sizeof(*pneg_rsp)) {
820                 cifs_dbg(VFS, "invalid protocol negotiate response size: %d\n",
821                          rsplen);
822 
823                 /* relax check since Mac returns max bufsize allowed on ioctl */
824                 if (rsplen > CIFSMaxBufSize || rsplen < sizeof(*pneg_rsp))
825                         goto out_free_rsp;
826         }
827 
828         /* check validate negotiate info response matches what we got earlier */
829         if (pneg_rsp->Dialect != cpu_to_le16(tcon->ses->server->dialect))
830                 goto vneg_out;
831 
832         if (pneg_rsp->SecurityMode != cpu_to_le16(tcon->ses->server->sec_mode))
833                 goto vneg_out;
834 
835         /* do not validate server guid because not saved at negprot time yet */
836 
837         if ((le32_to_cpu(pneg_rsp->Capabilities) | SMB2_NT_FIND |
838               SMB2_LARGE_FILES) != tcon->ses->server->capabilities)
839                 goto vneg_out;
840 
841         /* validate negotiate successful */
842         rc = 0;
843         cifs_dbg(FYI, "validate negotiate info successful\n");
844         goto out_free_rsp;
845 
846 vneg_out:
847         cifs_dbg(VFS, "protocol revalidation - security settings mismatch\n");
848 out_free_rsp:
849         kfree(pneg_rsp);
850 out_free_inbuf:
851         kfree(pneg_inbuf);
852         return rc;
853 }
854 
855 enum securityEnum
856 smb2_select_sectype(struct TCP_Server_Info *server, enum securityEnum requested)
857 {
858         switch (requested) {
859         case Kerberos:
860         case RawNTLMSSP:
861                 return requested;
862         case NTLMv2:
863                 return RawNTLMSSP;
864         case Unspecified:
865                 if (server->sec_ntlmssp &&
866                         (global_secflags & CIFSSEC_MAY_NTLMSSP))
867                         return RawNTLMSSP;
868                 if ((server->sec_kerberos || server->sec_mskerberos) &&
869                         (global_secflags & CIFSSEC_MAY_KRB5))
870                         return Kerberos;
871                 /* Fallthrough */
872         default:
873                 return Unspecified;
874         }
875 }
876 
877 struct SMB2_sess_data {
878         unsigned int xid;
879         struct cifs_ses *ses;
880         struct nls_table *nls_cp;
881         void (*func)(struct SMB2_sess_data *);
882         int result;
883         u64 previous_session;
884 
885         /* we will send the SMB in three pieces:
886          * a fixed length beginning part, an optional
887          * SPNEGO blob (which can be zero length), and a
888          * last part which will include the strings
889          * and rest of bcc area. This allows us to avoid
890          * a large buffer 17K allocation
891          */
892         int buf0_type;
893         struct kvec iov[2];
894 };
895 
896 static int
897 SMB2_sess_alloc_buffer(struct SMB2_sess_data *sess_data)
898 {
899         int rc;
900         struct cifs_ses *ses = sess_data->ses;
901         struct smb2_sess_setup_req *req;
902         struct TCP_Server_Info *server = ses->server;
903         unsigned int total_len;
904 
905         rc = smb2_plain_req_init(SMB2_SESSION_SETUP, NULL, (void **) &req,
906                              &total_len);
907         if (rc)
908                 return rc;
909 
910         /* First session, not a reauthenticate */
911         req->sync_hdr.SessionId = 0;
912 
913         /* if reconnect, we need to send previous sess id, otherwise it is 0 */
914         req->PreviousSessionId = sess_data->previous_session;
915 
916         req->Flags = 0; /* MBZ */
917         /* to enable echos and oplocks */
918         req->sync_hdr.CreditRequest = cpu_to_le16(3);
919 
920         /* only one of SMB2 signing flags may be set in SMB2 request */
921         if (server->sign)
922                 req->SecurityMode = SMB2_NEGOTIATE_SIGNING_REQUIRED;
923         else if (global_secflags & CIFSSEC_MAY_SIGN) /* one flag unlike MUST_ */
924                 req->SecurityMode = SMB2_NEGOTIATE_SIGNING_ENABLED;
925         else
926                 req->SecurityMode = 0;
927 
928         req->Capabilities = 0;
929         req->Channel = 0; /* MBZ */
930 
931         sess_data->iov[0].iov_base = (char *)req;
932         /* 1 for pad */
933         sess_data->iov[0].iov_len = total_len - 1;
934         /*
935          * This variable will be used to clear the buffer
936          * allocated above in case of any error in the calling function.
937          */
938         sess_data->buf0_type = CIFS_SMALL_BUFFER;
939 
940         return 0;
941 }
942 
943 static void
944 SMB2_sess_free_buffer(struct SMB2_sess_data *sess_data)
945 {
946         free_rsp_buf(sess_data->buf0_type, sess_data->iov[0].iov_base);
947         sess_data->buf0_type = CIFS_NO_BUFFER;
948 }
949 
950 static int
951 SMB2_sess_sendreceive(struct SMB2_sess_data *sess_data)
952 {
953         int rc;
954         struct smb2_sess_setup_req *req = sess_data->iov[0].iov_base;
955         struct kvec rsp_iov = { NULL, 0 };
956 
957         /* Testing shows that buffer offset must be at location of Buffer[0] */
958         req->SecurityBufferOffset =
959                 cpu_to_le16(sizeof(struct smb2_sess_setup_req) - 1 /* pad */);
960         req->SecurityBufferLength = cpu_to_le16(sess_data->iov[1].iov_len);
961 
962         /* BB add code to build os and lm fields */
963 
964         rc = smb2_send_recv(sess_data->xid, sess_data->ses,
965                             sess_data->iov, 2,
966                             &sess_data->buf0_type,
967                             CIFS_LOG_ERROR | CIFS_NEG_OP, &rsp_iov);
968         cifs_small_buf_release(sess_data->iov[0].iov_base);
969         memcpy(&sess_data->iov[0], &rsp_iov, sizeof(struct kvec));
970 
971         return rc;
972 }
973 
974 static int
975 SMB2_sess_establish_session(struct SMB2_sess_data *sess_data)
976 {
977         int rc = 0;
978         struct cifs_ses *ses = sess_data->ses;
979 
980         mutex_lock(&ses->server->srv_mutex);
981         if (ses->server->ops->generate_signingkey) {
982                 rc = ses->server->ops->generate_signingkey(ses);
983                 if (rc) {
984                         cifs_dbg(FYI,
985                                 "SMB3 session key generation failed\n");
986                         mutex_unlock(&ses->server->srv_mutex);
987                         return rc;
988                 }
989         }
990         if (!ses->server->session_estab) {
991                 ses->server->sequence_number = 0x2;
992                 ses->server->session_estab = true;
993         }
994         mutex_unlock(&ses->server->srv_mutex);
995 
996         cifs_dbg(FYI, "SMB2/3 session established successfully\n");
997         spin_lock(&GlobalMid_Lock);
998         ses->status = CifsGood;
999         ses->need_reconnect = false;
1000         spin_unlock(&GlobalMid_Lock);
1001         return rc;
1002 }
1003 
1004 #ifdef CONFIG_CIFS_UPCALL
1005 static void
1006 SMB2_auth_kerberos(struct SMB2_sess_data *sess_data)
1007 {
1008         int rc;
1009         struct cifs_ses *ses = sess_data->ses;
1010         struct cifs_spnego_msg *msg;
1011         struct key *spnego_key = NULL;
1012         struct smb2_sess_setup_rsp *rsp = NULL;
1013 
1014         rc = SMB2_sess_alloc_buffer(sess_data);
1015         if (rc)
1016                 goto out;
1017 
1018         spnego_key = cifs_get_spnego_key(ses);
1019         if (IS_ERR(spnego_key)) {
1020                 rc = PTR_ERR(spnego_key);
1021                 spnego_key = NULL;
1022                 goto out;
1023         }
1024 
1025         msg = spnego_key->payload.data[0];
1026         /*
1027          * check version field to make sure that cifs.upcall is
1028          * sending us a response in an expected form
1029          */
1030         if (msg->version != CIFS_SPNEGO_UPCALL_VERSION) {
1031                 cifs_dbg(VFS,
1032                           "bad cifs.upcall version. Expected %d got %d",
1033                           CIFS_SPNEGO_UPCALL_VERSION, msg->version);
1034                 rc = -EKEYREJECTED;
1035                 goto out_put_spnego_key;
1036         }
1037 
1038         ses->auth_key.response = kmemdup(msg->data, msg->sesskey_len,
1039                                          GFP_KERNEL);
1040         if (!ses->auth_key.response) {
1041                 cifs_dbg(VFS,
1042                         "Kerberos can't allocate (%u bytes) memory",
1043                         msg->sesskey_len);
1044                 rc = -ENOMEM;
1045                 goto out_put_spnego_key;
1046         }
1047         ses->auth_key.len = msg->sesskey_len;
1048 
1049         sess_data->iov[1].iov_base = msg->data + msg->sesskey_len;
1050         sess_data->iov[1].iov_len = msg->secblob_len;
1051 
1052         rc = SMB2_sess_sendreceive(sess_data);
1053         if (rc)
1054                 goto out_put_spnego_key;
1055 
1056         rsp = (struct smb2_sess_setup_rsp *)sess_data->iov[0].iov_base;
1057         ses->Suid = rsp->hdr.sync_hdr.SessionId;
1058 
1059         ses->session_flags = le16_to_cpu(rsp->SessionFlags);
1060 
1061         rc = SMB2_sess_establish_session(sess_data);
1062 out_put_spnego_key:
1063         key_invalidate(spnego_key);
1064         key_put(spnego_key);
1065 out:
1066         sess_data->result = rc;
1067         sess_data->func = NULL;
1068         SMB2_sess_free_buffer(sess_data);
1069 }
1070 #else
1071 static void
1072 SMB2_auth_kerberos(struct SMB2_sess_data *sess_data)
1073 {
1074         cifs_dbg(VFS, "Kerberos negotiated but upcall support disabled!\n");
1075         sess_data->result = -EOPNOTSUPP;
1076         sess_data->func = NULL;
1077 }
1078 #endif
1079 
1080 static void
1081 SMB2_sess_auth_rawntlmssp_authenticate(struct SMB2_sess_data *sess_data);
1082 
1083 static void
1084 SMB2_sess_auth_rawntlmssp_negotiate(struct SMB2_sess_data *sess_data)
1085 {
1086         int rc;
1087         struct cifs_ses *ses = sess_data->ses;
1088         struct smb2_sess_setup_rsp *rsp = NULL;
1089         char *ntlmssp_blob = NULL;
1090         bool use_spnego = false; /* else use raw ntlmssp */
1091         u16 blob_length = 0;
1092 
1093         /*
1094          * If memory allocation is successful, caller of this function
1095          * frees it.
1096          */
1097         ses->ntlmssp = kmalloc(sizeof(struct ntlmssp_auth), GFP_KERNEL);
1098         if (!ses->ntlmssp) {
1099                 rc = -ENOMEM;
1100                 goto out_err;
1101         }
1102         ses->ntlmssp->sesskey_per_smbsess = true;
1103 
1104         rc = SMB2_sess_alloc_buffer(sess_data);
1105         if (rc)
1106                 goto out_err;
1107 
1108         ntlmssp_blob = kmalloc(sizeof(struct _NEGOTIATE_MESSAGE),
1109                                GFP_KERNEL);
1110         if (ntlmssp_blob == NULL) {
1111                 rc = -ENOMEM;
1112                 goto out;
1113         }
1114 
1115         build_ntlmssp_negotiate_blob(ntlmssp_blob, ses);
1116         if (use_spnego) {
1117                 /* BB eventually need to add this */
1118                 cifs_dbg(VFS, "spnego not supported for SMB2 yet\n");
1119                 rc = -EOPNOTSUPP;
1120                 goto out;
1121         } else {
1122                 blob_length = sizeof(struct _NEGOTIATE_MESSAGE);
1123                 /* with raw NTLMSSP we don't encapsulate in SPNEGO */
1124         }
1125         sess_data->iov[1].iov_base = ntlmssp_blob;
1126         sess_data->iov[1].iov_len = blob_length;
1127 
1128         rc = SMB2_sess_sendreceive(sess_data);
1129         rsp = (struct smb2_sess_setup_rsp *)sess_data->iov[0].iov_base;
1130 
1131         /* If true, rc here is expected and not an error */
1132         if (sess_data->buf0_type != CIFS_NO_BUFFER &&
1133                 rsp->hdr.sync_hdr.Status == STATUS_MORE_PROCESSING_REQUIRED)
1134                 rc = 0;
1135 
1136         if (rc)
1137                 goto out;
1138 
1139         if (offsetof(struct smb2_sess_setup_rsp, Buffer) - ses->server->vals->header_preamble_size !=
1140                         le16_to_cpu(rsp->SecurityBufferOffset)) {
1141                 cifs_dbg(VFS, "Invalid security buffer offset %d\n",
1142                         le16_to_cpu(rsp->SecurityBufferOffset));
1143                 rc = -EIO;
1144                 goto out;
1145         }
1146         rc = decode_ntlmssp_challenge(rsp->Buffer,
1147                         le16_to_cpu(rsp->SecurityBufferLength), ses);
1148         if (rc)
1149                 goto out;
1150 
1151         cifs_dbg(FYI, "rawntlmssp session setup challenge phase\n");
1152 
1153 
1154         ses->Suid = rsp->hdr.sync_hdr.SessionId;
1155         ses->session_flags = le16_to_cpu(rsp->SessionFlags);
1156 
1157 out:
1158         kfree(ntlmssp_blob);
1159         SMB2_sess_free_buffer(sess_data);
1160         if (!rc) {
1161                 sess_data->result = 0;
1162                 sess_data->func = SMB2_sess_auth_rawntlmssp_authenticate;
1163                 return;
1164         }
1165 out_err:
1166         kfree(ses->ntlmssp);
1167         ses->ntlmssp = NULL;
1168         sess_data->result = rc;
1169         sess_data->func = NULL;
1170 }
1171 
1172 static void
1173 SMB2_sess_auth_rawntlmssp_authenticate(struct SMB2_sess_data *sess_data)
1174 {
1175         int rc;
1176         struct cifs_ses *ses = sess_data->ses;
1177         struct smb2_sess_setup_req *req;
1178         struct smb2_sess_setup_rsp *rsp = NULL;
1179         unsigned char *ntlmssp_blob = NULL;
1180         bool use_spnego = false; /* else use raw ntlmssp */
1181         u16 blob_length = 0;
1182 
1183         rc = SMB2_sess_alloc_buffer(sess_data);
1184         if (rc)
1185                 goto out;
1186 
1187         req = (struct smb2_sess_setup_req *) sess_data->iov[0].iov_base;
1188         req->sync_hdr.SessionId = ses->Suid;
1189 
1190         rc = build_ntlmssp_auth_blob(&ntlmssp_blob, &blob_length, ses,
1191                                         sess_data->nls_cp);
1192         if (rc) {
1193                 cifs_dbg(FYI, "build_ntlmssp_auth_blob failed %d\n", rc);
1194                 goto out;
1195         }
1196 
1197         if (use_spnego) {
1198                 /* BB eventually need to add this */
1199                 cifs_dbg(VFS, "spnego not supported for SMB2 yet\n");
1200                 rc = -EOPNOTSUPP;
1201                 goto out;
1202         }
1203         sess_data->iov[1].iov_base = ntlmssp_blob;
1204         sess_data->iov[1].iov_len = blob_length;
1205 
1206         rc = SMB2_sess_sendreceive(sess_data);
1207         if (rc)
1208                 goto out;
1209 
1210         rsp = (struct smb2_sess_setup_rsp *)sess_data->iov[0].iov_base;
1211 
1212         ses->Suid = rsp->hdr.sync_hdr.SessionId;
1213         ses->session_flags = le16_to_cpu(rsp->SessionFlags);
1214 
1215         rc = SMB2_sess_establish_session(sess_data);
1216 out:
1217         kfree(ntlmssp_blob);
1218         SMB2_sess_free_buffer(sess_data);
1219         kfree(ses->ntlmssp);
1220         ses->ntlmssp = NULL;
1221         sess_data->result = rc;
1222         sess_data->func = NULL;
1223 }
1224 
1225 static int
1226 SMB2_select_sec(struct cifs_ses *ses, struct SMB2_sess_data *sess_data)
1227 {
1228         int type;
1229 
1230         type = smb2_select_sectype(ses->server, ses->sectype);
1231         cifs_dbg(FYI, "sess setup type %d\n", type);
1232         if (type == Unspecified) {
1233                 cifs_dbg(VFS,
1234                         "Unable to select appropriate authentication method!");
1235                 return -EINVAL;
1236         }
1237 
1238         switch (type) {
1239         case Kerberos:
1240                 sess_data->func = SMB2_auth_kerberos;
1241                 break;
1242         case RawNTLMSSP:
1243                 sess_data->func = SMB2_sess_auth_rawntlmssp_negotiate;
1244                 break;
1245         default:
1246                 cifs_dbg(VFS, "secType %d not supported!\n", type);
1247                 return -EOPNOTSUPP;
1248         }
1249 
1250         return 0;
1251 }
1252 
1253 int
1254 SMB2_sess_setup(const unsigned int xid, struct cifs_ses *ses,
1255                 const struct nls_table *nls_cp)
1256 {
1257         int rc = 0;
1258         struct TCP_Server_Info *server = ses->server;
1259         struct SMB2_sess_data *sess_data;
1260 
1261         cifs_dbg(FYI, "Session Setup\n");
1262 
1263         if (!server) {
1264                 WARN(1, "%s: server is NULL!\n", __func__);
1265                 return -EIO;
1266         }
1267 
1268         sess_data = kzalloc(sizeof(struct SMB2_sess_data), GFP_KERNEL);
1269         if (!sess_data)
1270                 return -ENOMEM;
1271 
1272         rc = SMB2_select_sec(ses, sess_data);
1273         if (rc)
1274                 goto out;
1275         sess_data->xid = xid;
1276         sess_data->ses = ses;
1277         sess_data->buf0_type = CIFS_NO_BUFFER;
1278         sess_data->nls_cp = (struct nls_table *) nls_cp;
1279 
1280 #ifdef CONFIG_CIFS_SMB311
1281         /*
1282          * Initialize the session hash with the server one.
1283          */
1284         memcpy(ses->preauth_sha_hash, ses->server->preauth_sha_hash,
1285                SMB2_PREAUTH_HASH_SIZE);
1286 #endif
1287 
1288         while (sess_data->func)
1289                 sess_data->func(sess_data);
1290 
1291         if ((ses->session_flags & SMB2_SESSION_FLAG_IS_GUEST) && (ses->sign))
1292                 cifs_dbg(VFS, "signing requested but authenticated as guest\n");
1293         rc = sess_data->result;
1294 out:
1295         kfree(sess_data);
1296         return rc;
1297 }
1298 
1299 int
1300 SMB2_logoff(const unsigned int xid, struct cifs_ses *ses)
1301 {
1302         struct smb2_logoff_req *req; /* response is also trivial struct */
1303         int rc = 0;
1304         struct TCP_Server_Info *server;
1305         int flags = 0;
1306         unsigned int total_len;
1307         struct kvec iov[1];
1308         struct kvec rsp_iov;
1309         int resp_buf_type;
1310 
1311         cifs_dbg(FYI, "disconnect session %p\n", ses);
1312 
1313         if (ses && (ses->server))
1314                 server = ses->server;
1315         else
1316                 return -EIO;
1317 
1318         /* no need to send SMB logoff if uid already closed due to reconnect */
1319         if (ses->need_reconnect)
1320                 goto smb2_session_already_dead;
1321 
1322         rc = smb2_plain_req_init(SMB2_LOGOFF, NULL, (void **) &req, &total_len);
1323         if (rc)
1324                 return rc;
1325 
1326          /* since no tcon, smb2_init can not do this, so do here */
1327         req->sync_hdr.SessionId = ses->Suid;
1328 
1329         if (ses->session_flags & SMB2_SESSION_FLAG_ENCRYPT_DATA)
1330                 flags |= CIFS_TRANSFORM_REQ;
1331         else if (server->sign)
1332                 req->sync_hdr.Flags |= SMB2_FLAGS_SIGNED;
1333 
1334         flags |= CIFS_NO_RESP;
1335 
1336         iov[0].iov_base = (char *)req;
1337         iov[0].iov_len = total_len;
1338 
1339         rc = smb2_send_recv(xid, ses, iov, 1, &resp_buf_type, flags, &rsp_iov);
1340         cifs_small_buf_release(req);
1341         /*
1342          * No tcon so can't do
1343          * cifs_stats_inc(&tcon->stats.smb2_stats.smb2_com_fail[SMB2...]);
1344          */
1345 
1346 smb2_session_already_dead:
1347         return rc;
1348 }
1349 
1350 static inline void cifs_stats_fail_inc(struct cifs_tcon *tcon, uint16_t code)
1351 {
1352         cifs_stats_inc(&tcon->stats.smb2_stats.smb2_com_failed[code]);
1353 }
1354 
1355 #define MAX_SHARENAME_LENGTH (255 /* server */ + 80 /* share */ + 1 /* NULL */)
1356 
1357 /* These are similar values to what Windows uses */
1358 static inline void init_copy_chunk_defaults(struct cifs_tcon *tcon)
1359 {
1360         tcon->max_chunks = 256;
1361         tcon->max_bytes_chunk = 1048576;
1362         tcon->max_bytes_copy = 16777216;
1363 }
1364 
1365 int
1366 SMB2_tcon(const unsigned int xid, struct cifs_ses *ses, const char *tree,
1367           struct cifs_tcon *tcon, const struct nls_table *cp)
1368 {
1369         struct smb2_tree_connect_req *req;
1370         struct smb2_tree_connect_rsp *rsp = NULL;
1371         struct kvec iov[2];
1372         struct kvec rsp_iov = { NULL, 0 };
1373         int rc = 0;
1374         int resp_buftype;
1375         int unc_path_len;
1376         __le16 *unc_path = NULL;
1377         int flags = 0;
1378         unsigned int total_len;
1379 
1380         cifs_dbg(FYI, "TCON\n");
1381 
1382         if (!(ses->server) || !tree)
1383                 return -EIO;
1384 
1385         unc_path = kmalloc(MAX_SHARENAME_LENGTH * 2, GFP_KERNEL);
1386         if (unc_path == NULL)
1387                 return -ENOMEM;
1388 
1389         unc_path_len = cifs_strtoUTF16(unc_path, tree, strlen(tree), cp) + 1;
1390         unc_path_len *= 2;
1391         if (unc_path_len < 2) {
1392                 kfree(unc_path);
1393                 return -EINVAL;
1394         }
1395 
1396         /* SMB2 TREE_CONNECT request must be called with TreeId == 0 */
1397         tcon->tid = 0;
1398 
1399         rc = smb2_plain_req_init(SMB2_TREE_CONNECT, tcon, (void **) &req,
1400                              &total_len);
1401         if (rc) {
1402                 kfree(unc_path);
1403                 return rc;
1404         }
1405 
1406         if (encryption_required(tcon))
1407                 flags |= CIFS_TRANSFORM_REQ;
1408 
1409         iov[0].iov_base = (char *)req;
1410         /* 1 for pad */
1411         iov[0].iov_len = total_len - 1;
1412 
1413         /* Testing shows that buffer offset must be at location of Buffer[0] */
1414         req->PathOffset = cpu_to_le16(sizeof(struct smb2_tree_connect_req)
1415                         - 1 /* pad */);
1416         req->PathLength = cpu_to_le16(unc_path_len - 2);
1417         iov[1].iov_base = unc_path;
1418         iov[1].iov_len = unc_path_len;
1419 
1420         /* 3.11 tcon req must be signed if not encrypted. See MS-SMB2 3.2.4.1.1 */
1421         if ((ses->server->dialect == SMB311_PROT_ID) &&
1422             !encryption_required(tcon))
1423                 req->sync_hdr.Flags |= SMB2_FLAGS_SIGNED;
1424 
1425         rc = smb2_send_recv(xid, ses, iov, 2, &resp_buftype, flags, &rsp_iov);
1426         cifs_small_buf_release(req);
1427         rsp = (struct smb2_tree_connect_rsp *)rsp_iov.iov_base;
1428 
1429         if (rc != 0) {
1430                 if (tcon) {
1431                         cifs_stats_fail_inc(tcon, SMB2_TREE_CONNECT_HE);
1432                         tcon->need_reconnect = true;
1433                 }
1434                 goto tcon_error_exit;
1435         }
1436 
1437         switch (rsp->ShareType) {
1438         case SMB2_SHARE_TYPE_DISK:
1439                 cifs_dbg(FYI, "connection to disk share\n");
1440                 break;
1441         case SMB2_SHARE_TYPE_PIPE:
1442                 tcon->pipe = true;
1443                 cifs_dbg(FYI, "connection to pipe share\n");
1444                 break;
1445         case SMB2_SHARE_TYPE_PRINT:
1446                 tcon->print = true;
1447                 cifs_dbg(FYI, "connection to printer\n");
1448                 break;
1449         default:
1450                 cifs_dbg(VFS, "unknown share type %d\n", rsp->ShareType);
1451                 rc = -EOPNOTSUPP;
1452                 goto tcon_error_exit;
1453         }
1454 
1455         tcon->share_flags = le32_to_cpu(rsp->ShareFlags);
1456         tcon->capabilities = rsp->Capabilities; /* we keep caps little endian */
1457         tcon->maximal_access = le32_to_cpu(rsp->MaximalAccess);
1458         tcon->tidStatus = CifsGood;
1459         tcon->need_reconnect = false;
1460         tcon->tid = rsp->hdr.sync_hdr.TreeId;
1461         strlcpy(tcon->treeName, tree, sizeof(tcon->treeName));
1462 
1463         if ((rsp->Capabilities & SMB2_SHARE_CAP_DFS) &&
1464             ((tcon->share_flags & SHI1005_FLAGS_DFS) == 0))
1465                 cifs_dbg(VFS, "DFS capability contradicts DFS flag\n");
1466 
1467         if (tcon->seal &&
1468             !(tcon->ses->server->capabilities & SMB2_GLOBAL_CAP_ENCRYPTION))
1469                 cifs_dbg(VFS, "Encryption is requested but not supported\n");
1470 
1471         init_copy_chunk_defaults(tcon);
1472         if (tcon->ses->server->ops->validate_negotiate)
1473                 rc = tcon->ses->server->ops->validate_negotiate(xid, tcon);
1474 tcon_exit:
1475         free_rsp_buf(resp_buftype, rsp);
1476         kfree(unc_path);
1477         return rc;
1478 
1479 tcon_error_exit:
1480         if (rsp && rsp->hdr.sync_hdr.Status == STATUS_BAD_NETWORK_NAME) {
1481                 cifs_dbg(VFS, "BAD_NETWORK_NAME: %s\n", tree);
1482         }
1483         goto tcon_exit;
1484 }
1485 
1486 int
1487 SMB2_tdis(const unsigned int xid, struct cifs_tcon *tcon)
1488 {
1489         struct smb2_tree_disconnect_req *req; /* response is trivial */
1490         int rc = 0;
1491         struct cifs_ses *ses = tcon->ses;
1492         int flags = 0;
1493         unsigned int total_len;
1494         struct kvec iov[1];
1495         struct kvec rsp_iov;
1496         int resp_buf_type;
1497 
1498         cifs_dbg(FYI, "Tree Disconnect\n");
1499 
1500         if (!ses || !(ses->server))
1501                 return -EIO;
1502 
1503         if ((tcon->need_reconnect) || (tcon->ses->need_reconnect))
1504                 return 0;
1505 
1506         rc = smb2_plain_req_init(SMB2_TREE_DISCONNECT, tcon, (void **) &req,
1507                              &total_len);
1508         if (rc)
1509                 return rc;
1510 
1511         if (encryption_required(tcon))
1512                 flags |= CIFS_TRANSFORM_REQ;
1513 
1514         flags |= CIFS_NO_RESP;
1515 
1516         iov[0].iov_base = (char *)req;
1517         iov[0].iov_len = total_len;
1518 
1519         rc = smb2_send_recv(xid, ses, iov, 1, &resp_buf_type, flags, &rsp_iov);
1520         cifs_small_buf_release(req);
1521         if (rc)
1522                 cifs_stats_fail_inc(tcon, SMB2_TREE_DISCONNECT_HE);
1523 
1524         return rc;
1525 }
1526 
1527 
1528 static struct create_durable *
1529 create_durable_buf(void)
1530 {
1531         struct create_durable *buf;
1532 
1533         buf = kzalloc(sizeof(struct create_durable), GFP_KERNEL);
1534         if (!buf)
1535                 return NULL;
1536 
1537         buf->ccontext.DataOffset = cpu_to_le16(offsetof
1538                                         (struct create_durable, Data));
1539         buf->ccontext.DataLength = cpu_to_le32(16);
1540         buf->ccontext.NameOffset = cpu_to_le16(offsetof
1541                                 (struct create_durable, Name));
1542         buf->ccontext.NameLength = cpu_to_le16(4);
1543         /* SMB2_CREATE_DURABLE_HANDLE_REQUEST is "DHnQ" */
1544         buf->Name[0] = 'D';
1545         buf->Name[1] = 'H';
1546         buf->Name[2] = 'n';
1547         buf->Name[3] = 'Q';
1548         return buf;
1549 }
1550 
1551 static struct create_durable *
1552 create_reconnect_durable_buf(struct cifs_fid *fid)
1553 {
1554         struct create_durable *buf;
1555 
1556         buf = kzalloc(sizeof(struct create_durable), GFP_KERNEL);
1557         if (!buf)
1558                 return NULL;
1559 
1560         buf->ccontext.DataOffset = cpu_to_le16(offsetof
1561                                         (struct create_durable, Data));
1562         buf->ccontext.DataLength = cpu_to_le32(16);
1563         buf->ccontext.NameOffset = cpu_to_le16(offsetof
1564                                 (struct create_durable, Name));
1565         buf->ccontext.NameLength = cpu_to_le16(4);
1566         buf->Data.Fid.PersistentFileId = fid->persistent_fid;
1567         buf->Data.Fid.VolatileFileId = fid->volatile_fid;
1568         /* SMB2_CREATE_DURABLE_HANDLE_RECONNECT is "DHnC" */
1569         buf->Name[0] = 'D';
1570         buf->Name[1] = 'H';
1571         buf->Name[2] = 'n';
1572         buf->Name[3] = 'C';
1573         return buf;
1574 }
1575 
1576 static __u8
1577 parse_lease_state(struct TCP_Server_Info *server, struct smb2_create_rsp *rsp,
1578                   unsigned int *epoch)
1579 {
1580         char *data_offset;
1581         struct create_context *cc;
1582         unsigned int next;
1583         unsigned int remaining;
1584         char *name;
1585 
1586         data_offset = (char *)rsp + server->vals->header_preamble_size + le32_to_cpu(rsp->CreateContextsOffset);
1587         remaining = le32_to_cpu(rsp->CreateContextsLength);
1588         cc = (struct create_context *)data_offset;
1589         while (remaining >= sizeof(struct create_context)) {
1590                 name = le16_to_cpu(cc->NameOffset) + (char *)cc;
1591                 if (le16_to_cpu(cc->NameLength) == 4 &&
1592                     strncmp(name, "RqLs", 4) == 0)
1593                         return server->ops->parse_lease_buf(cc, epoch);
1594 
1595                 next = le32_to_cpu(cc->Next);
1596                 if (!next)
1597                         break;
1598                 remaining -= next;
1599                 cc = (struct create_context *)((char *)cc + next);
1600         }
1601 
1602         return 0;
1603 }
1604 
1605 static int
1606 add_lease_context(struct TCP_Server_Info *server, struct kvec *iov,
1607                   unsigned int *num_iovec, __u8 *oplock)
1608 {
1609         struct smb2_create_req *req = iov[0].iov_base;
1610         unsigned int num = *num_iovec;
1611 
1612         iov[num].iov_base = server->ops->create_lease_buf(oplock+1, *oplock);
1613         if (iov[num].iov_base == NULL)
1614                 return -ENOMEM;
1615         iov[num].iov_len = server->vals->create_lease_size;
1616         req->RequestedOplockLevel = SMB2_OPLOCK_LEVEL_LEASE;
1617         if (!req->CreateContextsOffset)
1618                 req->CreateContextsOffset = cpu_to_le32(
1619                                 sizeof(struct smb2_create_req) +
1620                                 iov[num - 1].iov_len);
1621         le32_add_cpu(&req->CreateContextsLength,
1622                      server->vals->create_lease_size);
1623         *num_iovec = num + 1;
1624         return 0;
1625 }
1626 
1627 static struct create_durable_v2 *
1628 create_durable_v2_buf(struct cifs_fid *pfid)
1629 {
1630         struct create_durable_v2 *buf;
1631 
1632         buf = kzalloc(sizeof(struct create_durable_v2), GFP_KERNEL);
1633         if (!buf)
1634                 return NULL;
1635 
1636         buf->ccontext.DataOffset = cpu_to_le16(offsetof
1637                                         (struct create_durable_v2, dcontext));
1638         buf->ccontext.DataLength = cpu_to_le32(sizeof(struct durable_context_v2));
1639         buf->ccontext.NameOffset = cpu_to_le16(offsetof
1640                                 (struct create_durable_v2, Name));
1641         buf->ccontext.NameLength = cpu_to_le16(4);
1642 
1643         buf->dcontext.Timeout = 0; /* Should this be configurable by workload */
1644         buf->dcontext.Flags = cpu_to_le32(SMB2_DHANDLE_FLAG_PERSISTENT);
1645         generate_random_uuid(buf->dcontext.CreateGuid);
1646         memcpy(pfid->create_guid, buf->dcontext.CreateGuid, 16);
1647 
1648         /* SMB2_CREATE_DURABLE_HANDLE_REQUEST is "DH2Q" */
1649         buf->Name[0] = 'D';
1650         buf->Name[1] = 'H';
1651         buf->Name[2] = '2';
1652         buf->Name[3] = 'Q';
1653         return buf;
1654 }
1655 
1656 static struct create_durable_handle_reconnect_v2 *
1657 create_reconnect_durable_v2_buf(struct cifs_fid *fid)
1658 {
1659         struct create_durable_handle_reconnect_v2 *buf;
1660 
1661         buf = kzalloc(sizeof(struct create_durable_handle_reconnect_v2),
1662                         GFP_KERNEL);
1663         if (!buf)
1664                 return NULL;
1665 
1666         buf->ccontext.DataOffset =
1667                 cpu_to_le16(offsetof(struct create_durable_handle_reconnect_v2,
1668                                      dcontext));
1669         buf->ccontext.DataLength =
1670                 cpu_to_le32(sizeof(struct durable_reconnect_context_v2));
1671         buf->ccontext.NameOffset =
1672                 cpu_to_le16(offsetof(struct create_durable_handle_reconnect_v2,
1673                             Name));
1674         buf->ccontext.NameLength = cpu_to_le16(4);
1675 
1676         buf->dcontext.Fid.PersistentFileId = fid->persistent_fid;
1677         buf->dcontext.Fid.VolatileFileId = fid->volatile_fid;
1678         buf->dcontext.Flags = cpu_to_le32(SMB2_DHANDLE_FLAG_PERSISTENT);
1679         memcpy(buf->dcontext.CreateGuid, fid->create_guid, 16);
1680 
1681         /* SMB2_CREATE_DURABLE_HANDLE_RECONNECT_V2 is "DH2C" */
1682         buf->Name[0] = 'D';
1683         buf->Name[1] = 'H';
1684         buf->Name[2] = '2';
1685         buf->Name[3] = 'C';
1686         return buf;
1687 }
1688 
1689 static int
1690 add_durable_v2_context(struct kvec *iov, unsigned int *num_iovec,
1691                     struct cifs_open_parms *oparms)
1692 {
1693         struct smb2_create_req *req = iov[0].iov_base;
1694         unsigned int num = *num_iovec;
1695 
1696         iov[num].iov_base = create_durable_v2_buf(oparms->fid);
1697         if (iov[num].iov_base == NULL)
1698                 return -ENOMEM;
1699         iov[num].iov_len = sizeof(struct create_durable_v2);
1700         if (!req->CreateContextsOffset)
1701                 req->CreateContextsOffset =
1702                         cpu_to_le32(sizeof(struct smb2_create_req) +
1703                                                                 iov[1].iov_len);
1704         le32_add_cpu(&req->CreateContextsLength, sizeof(struct create_durable_v2));
1705         *num_iovec = num + 1;
1706         return 0;
1707 }
1708 
1709 static int
1710 add_durable_reconnect_v2_context(struct kvec *iov, unsigned int *num_iovec,
1711                     struct cifs_open_parms *oparms)
1712 {
1713         struct smb2_create_req *req = iov[0].iov_base;
1714         unsigned int num = *num_iovec;
1715 
1716         /* indicate that we don't need to relock the file */
1717         oparms->reconnect = false;
1718 
1719         iov[num].iov_base = create_reconnect_durable_v2_buf(oparms->fid);
1720         if (iov[num].iov_base == NULL)
1721                 return -ENOMEM;
1722         iov[num].iov_len = sizeof(struct create_durable_handle_reconnect_v2);
1723         if (!req->CreateContextsOffset)
1724                 req->CreateContextsOffset =
1725                         cpu_to_le32(sizeof(struct smb2_create_req) +
1726                                                                 iov[1].iov_len);
1727         le32_add_cpu(&req->CreateContextsLength,
1728                         sizeof(struct create_durable_handle_reconnect_v2));
1729         *num_iovec = num + 1;
1730         return 0;
1731 }
1732 
1733 static int
1734 add_durable_context(struct kvec *iov, unsigned int *num_iovec,
1735                     struct cifs_open_parms *oparms, bool use_persistent)
1736 {
1737         struct smb2_create_req *req = iov[0].iov_base;
1738         unsigned int num = *num_iovec;
1739 
1740         if (use_persistent) {
1741                 if (oparms->reconnect)
1742                         return add_durable_reconnect_v2_context(iov, num_iovec,
1743                                                                 oparms);
1744                 else
1745                         return add_durable_v2_context(iov, num_iovec, oparms);
1746         }
1747 
1748         if (oparms->reconnect) {
1749                 iov[num].iov_base = create_reconnect_durable_buf(oparms->fid);
1750                 /* indicate that we don't need to relock the file */
1751                 oparms->reconnect = false;
1752         } else
1753                 iov[num].iov_base = create_durable_buf();
1754         if (iov[num].iov_base == NULL)
1755                 return -ENOMEM;
1756         iov[num].iov_len = sizeof(struct create_durable);
1757         if (!req->CreateContextsOffset)
1758                 req->CreateContextsOffset =
1759                         cpu_to_le32(sizeof(struct smb2_create_req) +
1760                                                                 iov[1].iov_len);
1761         le32_add_cpu(&req->CreateContextsLength, sizeof(struct create_durable));
1762         *num_iovec = num + 1;
1763         return 0;
1764 }
1765 
1766 static int
1767 alloc_path_with_tree_prefix(__le16 **out_path, int *out_size, int *out_len,
1768                             const char *treename, const __le16 *path)
1769 {
1770         int treename_len, path_len;
1771         struct nls_table *cp;
1772         const __le16 sep[] = {cpu_to_le16('\\'), cpu_to_le16(0x0000)};
1773 
1774         /*
1775          * skip leading "\\"
1776          */
1777         treename_len = strlen(treename);
1778         if (treename_len < 2 || !(treename[0] == '\\' && treename[1] == '\\'))
1779                 return -EINVAL;
1780 
1781         treename += 2;
1782         treename_len -= 2;
1783 
1784         path_len = UniStrnlen((wchar_t *)path, PATH_MAX);
1785 
1786         /*
1787          * make room for one path separator between the treename and
1788          * path
1789          */
1790         *out_len = treename_len + 1 + path_len;
1791 
1792         /*
1793          * final path needs to be null-terminated UTF16 with a
1794          * size aligned to 8
1795          */
1796 
1797         *out_size = roundup((*out_len+1)*2, 8);
1798         *out_path = kzalloc(*out_size, GFP_KERNEL);
1799         if (!*out_path)
1800                 return -ENOMEM;
1801 
1802         cp = load_nls_default();
1803         cifs_strtoUTF16(*out_path, treename, treename_len, cp);
1804         UniStrcat(*out_path, sep);
1805         UniStrcat(*out_path, path);
1806         unload_nls(cp);
1807 
1808         return 0;
1809 }
1810 
1811 int
1812 SMB2_open(const unsigned int xid, struct cifs_open_parms *oparms, __le16 *path,
1813           __u8 *oplock, struct smb2_file_all_info *buf,
1814           struct kvec *err_iov)
1815 {
1816         struct smb2_create_req *req;
1817         struct smb2_create_rsp *rsp;
1818         struct TCP_Server_Info *server;
1819         struct cifs_tcon *tcon = oparms->tcon;
1820         struct cifs_ses *ses = tcon->ses;
1821         struct kvec iov[4];
1822         struct kvec rsp_iov = {NULL, 0};
1823         int resp_buftype;
1824         int uni_path_len;
1825         __le16 *copy_path = NULL;
1826         int copy_size;
1827         int rc = 0;
1828         unsigned int n_iov = 2;
1829         __u32 file_attributes = 0;
1830         char *dhc_buf = NULL, *lc_buf = NULL;
1831         int flags = 0;
1832         unsigned int total_len;
1833 
1834         cifs_dbg(FYI, "create/open\n");
1835 
1836         if (ses && (ses->server))
1837                 server = ses->server;
1838         else
1839                 return -EIO;
1840 
1841         rc = smb2_plain_req_init(SMB2_CREATE, tcon, (void **) &req, &total_len);
1842 
1843         if (rc)
1844                 return rc;
1845 
1846         if (encryption_required(tcon))
1847                 flags |= CIFS_TRANSFORM_REQ;
1848 
1849         if (oparms->create_options & CREATE_OPTION_READONLY)
1850                 file_attributes |= ATTR_READONLY;
1851         if (oparms->create_options & CREATE_OPTION_SPECIAL)
1852                 file_attributes |= ATTR_SYSTEM;
1853 
1854         req->ImpersonationLevel = IL_IMPERSONATION;
1855         req->DesiredAccess = cpu_to_le32(oparms->desired_access);
1856         /* File attributes ignored on open (used in create though) */
1857         req->FileAttributes = cpu_to_le32(file_attributes);
1858         req->ShareAccess = FILE_SHARE_ALL_LE;
1859         req->CreateDisposition = cpu_to_le32(oparms->disposition);
1860         req->CreateOptions = cpu_to_le32(oparms->create_options & CREATE_OPTIONS_MASK);
1861 
1862         iov[0].iov_base = (char *)req;
1863         /* -1 since last byte is buf[0] which is sent below (path) */
1864         iov[0].iov_len = total_len - 1;
1865 
1866         req->NameOffset = cpu_to_le16(sizeof(struct smb2_create_req));
1867 
1868         /* [MS-SMB2] 2.2.13 NameOffset:
1869          * If SMB2_FLAGS_DFS_OPERATIONS is set in the Flags field of
1870          * the SMB2 header, the file name includes a prefix that will
1871          * be processed during DFS name normalization as specified in
1872          * section 3.3.5.9. Otherwise, the file name is relative to
1873          * the share that is identified by the TreeId in the SMB2
1874          * header.
1875          */
1876         if (tcon->share_flags & SHI1005_FLAGS_DFS) {
1877                 int name_len;
1878 
1879                 req->sync_hdr.Flags |= SMB2_FLAGS_DFS_OPERATIONS;
1880                 rc = alloc_path_with_tree_prefix(&copy_path, &copy_size,
1881                                                  &name_len,
1882                                                  tcon->treeName, path);
1883                 if (rc) {
1884                         cifs_small_buf_release(req);
1885                         return rc;
1886                 }
1887                 req->NameLength = cpu_to_le16(name_len * 2);
1888                 uni_path_len = copy_size;
1889                 path = copy_path;
1890         } else {
1891                 uni_path_len = (2 * UniStrnlen((wchar_t *)path, PATH_MAX)) + 2;
1892                 /* MUST set path len (NameLength) to 0 opening root of share */
1893                 req->NameLength = cpu_to_le16(uni_path_len - 2);
1894                 if (uni_path_len % 8 != 0) {
1895                         copy_size = roundup(uni_path_len, 8);
1896                         copy_path = kzalloc(copy_size, GFP_KERNEL);
1897                         if (!copy_path) {
1898                                 cifs_small_buf_release(req);
1899                                 return -ENOMEM;
1900                         }
1901                         memcpy((char *)copy_path, (const char *)path,
1902                                uni_path_len);
1903                         uni_path_len = copy_size;
1904                         path = copy_path;
1905                 }
1906         }
1907 
1908         iov[1].iov_len = uni_path_len;
1909         iov[1].iov_base = path;
1910 
1911         if (!server->oplocks)
1912                 *oplock = SMB2_OPLOCK_LEVEL_NONE;
1913 
1914         if (!(server->capabilities & SMB2_GLOBAL_CAP_LEASING) ||
1915             *oplock == SMB2_OPLOCK_LEVEL_NONE)
1916                 req->RequestedOplockLevel = *oplock;
1917         else {
1918                 rc = add_lease_context(server, iov, &n_iov, oplock);
1919                 if (rc) {
1920                         cifs_small_buf_release(req);
1921                         kfree(copy_path);
1922                         return rc;
1923                 }
1924                 lc_buf = iov[n_iov-1].iov_base;
1925         }
1926 
1927         if (*oplock == SMB2_OPLOCK_LEVEL_BATCH) {
1928                 /* need to set Next field of lease context if we request it */
1929                 if (server->capabilities & SMB2_GLOBAL_CAP_LEASING) {
1930                         struct create_context *ccontext =
1931                             (struct create_context *)iov[n_iov-1].iov_base;
1932                         ccontext->Next =
1933                                 cpu_to_le32(server->vals->create_lease_size);
1934                 }
1935 
1936                 rc = add_durable_context(iov, &n_iov, oparms,
1937                                         tcon->use_persistent);
1938                 if (rc) {
1939                         cifs_small_buf_release(req);
1940                         kfree(copy_path);
1941                         kfree(lc_buf);
1942                         return rc;
1943                 }
1944                 dhc_buf = iov[n_iov-1].iov_base;
1945         }
1946 
1947         rc = smb2_send_recv(xid, ses, iov, n_iov, &resp_buftype, flags,
1948                             &rsp_iov);
1949         cifs_small_buf_release(req);
1950         rsp = (struct smb2_create_rsp *)rsp_iov.iov_base;
1951 
1952         if (rc != 0) {
1953                 cifs_stats_fail_inc(tcon, SMB2_CREATE_HE);
1954                 if (err_iov && rsp) {
1955                         *err_iov = rsp_iov;
1956                         resp_buftype = CIFS_NO_BUFFER;
1957                         rsp = NULL;
1958                 }
1959                 goto creat_exit;
1960         }
1961 
1962         oparms->fid->persistent_fid = rsp->PersistentFileId;
1963         oparms->fid->volatile_fid = rsp->VolatileFileId;
1964 
1965         if (buf) {
1966                 memcpy(buf, &rsp->CreationTime, 32);
1967                 buf->AllocationSize = rsp->AllocationSize;
1968                 buf->EndOfFile = rsp->EndofFile;
1969                 buf->Attributes = rsp->FileAttributes;
1970                 buf->NumberOfLinks = cpu_to_le32(1);
1971                 buf->DeletePending = 0;
1972         }
1973 
1974         if (rsp->OplockLevel == SMB2_OPLOCK_LEVEL_LEASE)
1975                 *oplock = parse_lease_state(server, rsp, &oparms->fid->epoch);
1976         else
1977                 *oplock = rsp->OplockLevel;
1978 creat_exit:
1979         kfree(copy_path);
1980         kfree(lc_buf);
1981         kfree(dhc_buf);
1982         free_rsp_buf(resp_buftype, rsp);
1983         return rc;
1984 }
1985 
1986 /*
1987  *      SMB2 IOCTL is used for both IOCTLs and FSCTLs
1988  */
1989 int
1990 SMB2_ioctl(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid,
1991            u64 volatile_fid, u32 opcode, bool is_fsctl,
1992            char *in_data, u32 indatalen,
1993            char **out_data, u32 *plen /* returned data len */)
1994 {
1995         struct smb2_ioctl_req *req;
1996         struct smb2_ioctl_rsp *rsp;
1997         struct smb2_sync_hdr *shdr;
1998         struct cifs_ses *ses;
1999         struct kvec iov[2];
2000         struct kvec rsp_iov;
2001         int resp_buftype;
2002         int n_iov;
2003         int rc = 0;
2004         int flags = 0;
2005         unsigned int total_len;
2006 
2007         cifs_dbg(FYI, "SMB2 IOCTL\n");
2008 
2009         if (out_data != NULL)
2010                 *out_data = NULL;
2011 
2012         /* zero out returned data len, in case of error */
2013         if (plen)
2014                 *plen = 0;
2015 
2016         if (tcon)
2017                 ses = tcon->ses;
2018         else
2019                 return -EIO;
2020 
2021         if (!ses || !(ses->server))
2022                 return -EIO;
2023 
2024         rc = smb2_plain_req_init(SMB2_IOCTL, tcon, (void **) &req, &total_len);
2025         if (rc)
2026                 return rc;
2027 
2028         if (encryption_required(tcon))
2029                 flags |= CIFS_TRANSFORM_REQ;
2030 
2031         req->CtlCode = cpu_to_le32(opcode);
2032         req->PersistentFileId = persistent_fid;
2033         req->VolatileFileId = volatile_fid;
2034 
2035         if (indatalen) {
2036                 req->InputCount = cpu_to_le32(indatalen);
2037                 /* do not set InputOffset if no input data */
2038                 req->InputOffset =
2039                        cpu_to_le32(offsetof(struct smb2_ioctl_req, Buffer));
2040                 iov[1].iov_base = in_data;
2041                 iov[1].iov_len = indatalen;
2042                 n_iov = 2;
2043         } else
2044                 n_iov = 1;
2045 
2046         req->OutputOffset = 0;
2047         req->OutputCount = 0; /* MBZ */
2048 
2049         /*
2050          * Could increase MaxOutputResponse, but that would require more
2051          * than one credit. Windows typically sets this smaller, but for some
2052          * ioctls it may be useful to allow server to send more. No point
2053          * limiting what the server can send as long as fits in one credit
2054          * Unfortunately - we can not handle more than CIFS_MAX_MSG_SIZE
2055          * (by default, note that it can be overridden to make max larger)
2056          * in responses (except for read responses which can be bigger.
2057          * We may want to bump this limit up
2058          */
2059         req->MaxOutputResponse = cpu_to_le32(CIFSMaxBufSize);
2060 
2061         if (is_fsctl)
2062                 req->Flags = cpu_to_le32(SMB2_0_IOCTL_IS_FSCTL);
2063         else
2064                 req->Flags = 0;
2065 
2066         iov[0].iov_base = (char *)req;
2067 
2068         /*
2069          * If no input data, the size of ioctl struct in
2070          * protocol spec still includes a 1 byte data buffer,
2071          * but if input data passed to ioctl, we do not
2072          * want to double count this, so we do not send
2073          * the dummy one byte of data in iovec[0] if sending
2074          * input data (in iovec[1]).
2075          */
2076 
2077         if (indatalen) {
2078                 iov[0].iov_len = total_len - 1;
2079         } else
2080                 iov[0].iov_len = total_len;
2081 
2082         /* validate negotiate request must be signed - see MS-SMB2 3.2.5.5 */
2083         if (opcode == FSCTL_VALIDATE_NEGOTIATE_INFO)
2084                 req->sync_hdr.Flags |= SMB2_FLAGS_SIGNED;
2085 
2086         rc = smb2_send_recv(xid, ses, iov, n_iov, &resp_buftype, flags,
2087                             &rsp_iov);
2088         cifs_small_buf_release(req);
2089         rsp = (struct smb2_ioctl_rsp *)rsp_iov.iov_base;
2090 
2091         if ((rc != 0) && (rc != -EINVAL)) {
2092                 cifs_stats_fail_inc(tcon, SMB2_IOCTL_HE);
2093                 goto ioctl_exit;
2094         } else if (rc == -EINVAL) {
2095                 if ((opcode != FSCTL_SRV_COPYCHUNK_WRITE) &&
2096                     (opcode != FSCTL_SRV_COPYCHUNK)) {
2097                         cifs_stats_fail_inc(tcon, SMB2_IOCTL_HE);
2098                         goto ioctl_exit;
2099                 }
2100         }
2101 
2102         /* check if caller wants to look at return data or just return rc */
2103         if ((plen == NULL) || (out_data == NULL))
2104                 goto ioctl_exit;
2105 
2106         *plen = le32_to_cpu(rsp->OutputCount);
2107 
2108         /* We check for obvious errors in the output buffer length and offset */
2109         if (*plen == 0)
2110                 goto ioctl_exit; /* server returned no data */
2111         else if (*plen > 0xFF00) {
2112                 cifs_dbg(VFS, "srv returned invalid ioctl length: %d\n", *plen);
2113                 *plen = 0;
2114                 rc = -EIO;
2115                 goto ioctl_exit;
2116         }
2117 
2118         if (get_rfc1002_length(rsp) < le32_to_cpu(rsp->OutputOffset) + *plen) {
2119                 cifs_dbg(VFS, "Malformed ioctl resp: len %d offset %d\n", *plen,
2120                         le32_to_cpu(rsp->OutputOffset));
2121                 *plen = 0;
2122                 rc = -EIO;
2123                 goto ioctl_exit;
2124         }
2125 
2126         *out_data = kmalloc(*plen, GFP_KERNEL);
2127         if (*out_data == NULL) {
2128                 rc = -ENOMEM;
2129                 goto ioctl_exit;
2130         }
2131 
2132         shdr = get_sync_hdr(rsp);
2133         memcpy(*out_data, (char *)shdr + le32_to_cpu(rsp->OutputOffset), *plen);
2134 ioctl_exit:
2135         free_rsp_buf(resp_buftype, rsp);
2136         return rc;
2137 }
2138 
2139 /*
2140  *   Individual callers to ioctl worker function follow
2141  */
2142 
2143 int
2144 SMB2_set_compression(const unsigned int xid, struct cifs_tcon *tcon,
2145                      u64 persistent_fid, u64 volatile_fid)
2146 {
2147         int rc;
2148         struct  compress_ioctl fsctl_input;
2149         char *ret_data = NULL;
2150 
2151         fsctl_input.CompressionState =
2152                         cpu_to_le16(COMPRESSION_FORMAT_DEFAULT);
2153 
2154         rc = SMB2_ioctl(xid, tcon, persistent_fid, volatile_fid,
2155                         FSCTL_SET_COMPRESSION, true /* is_fsctl */,
2156                         (char *)&fsctl_input /* data input */,
2157                         2 /* in data len */, &ret_data /* out data */, NULL);
2158 
2159         cifs_dbg(FYI, "set compression rc %d\n", rc);
2160 
2161         return rc;
2162 }
2163 
2164 int
2165 SMB2_close(const unsigned int xid, struct cifs_tcon *tcon,
2166            u64 persistent_fid, u64 volatile_fid)
2167 {
2168         struct smb2_close_req *req;
2169         struct smb2_close_rsp *rsp;
2170         struct cifs_ses *ses = tcon->ses;
2171         struct kvec iov[1];
2172         struct kvec rsp_iov;
2173         int resp_buftype;
2174         int rc = 0;
2175         int flags = 0;
2176         unsigned int total_len;
2177 
2178         cifs_dbg(FYI, "Close\n");
2179 
2180         if (!ses || !(ses->server))
2181                 return -EIO;
2182 
2183         rc = smb2_plain_req_init(SMB2_CLOSE, tcon, (void **) &req, &total_len);
2184         if (rc)
2185                 return rc;
2186 
2187         if (encryption_required(tcon))
2188                 flags |= CIFS_TRANSFORM_REQ;
2189 
2190         req->PersistentFileId = persistent_fid;
2191         req->VolatileFileId = volatile_fid;
2192 
2193         iov[0].iov_base = (char *)req;
2194         iov[0].iov_len = total_len;
2195 
2196         rc = smb2_send_recv(xid, ses, iov, 1, &resp_buftype, flags, &rsp_iov);
2197         cifs_small_buf_release(req);
2198         rsp = (struct smb2_close_rsp *)rsp_iov.iov_base;
2199 
2200         if (rc != 0) {
2201                 cifs_stats_fail_inc(tcon, SMB2_CLOSE_HE);
2202                 goto close_exit;
2203         }
2204 
2205         /* BB FIXME - decode close response, update inode for caching */
2206 
2207 close_exit:
2208         free_rsp_buf(resp_buftype, rsp);
2209         return rc;
2210 }
2211 
2212 static int
2213 validate_iov(struct TCP_Server_Info *server,
2214              unsigned int offset, unsigned int buffer_length,
2215              struct kvec *iov, unsigned int min_buf_size)
2216 {
2217         unsigned int smb_len = iov->iov_len;
2218         char *end_of_smb = smb_len + server->vals->header_preamble_size + (char *)iov->iov_base;
2219         char *begin_of_buf = server->vals->header_preamble_size + offset + (char *)iov->iov_base;
2220         char *end_of_buf = begin_of_buf + buffer_length;
2221 
2222 
2223         if (buffer_length < min_buf_size) {
2224                 cifs_dbg(VFS, "buffer length %d smaller than minimum size %d\n",
2225                          buffer_length, min_buf_size);
2226                 return -EINVAL;
2227         }
2228 
2229         /* check if beyond RFC1001 maximum length */
2230         if ((smb_len > 0x7FFFFF) || (buffer_length > 0x7FFFFF)) {
2231                 cifs_dbg(VFS, "buffer length %d or smb length %d too large\n",
2232                          buffer_length, smb_len);
2233                 return -EINVAL;
2234         }
2235 
2236         if ((begin_of_buf > end_of_smb) || (end_of_buf > end_of_smb)) {
2237                 cifs_dbg(VFS, "illegal server response, bad offset to data\n");
2238                 return -EINVAL;
2239         }
2240 
2241         return 0;
2242 }
2243 
2244 /*
2245  * If SMB buffer fields are valid, copy into temporary buffer to hold result.
2246  * Caller must free buffer.
2247  */
2248 static int
2249 validate_and_copy_iov(struct TCP_Server_Info *server,
2250                       unsigned int offset, unsigned int buffer_length,
2251                       struct kvec *iov, unsigned int minbufsize,
2252                       char *data)
2253 {
2254         char *begin_of_buf = server->vals->header_preamble_size + offset + (char *)(iov->iov_base);
2255         int rc;
2256 
2257         if (!data)
2258                 return -EINVAL;
2259 
2260         rc = validate_iov(server, offset, buffer_length, iov, minbufsize);
2261         if (rc)
2262                 return rc;
2263 
2264         memcpy(data, begin_of_buf, buffer_length);
2265 
2266         return 0;
2267 }
2268 
2269 static int
2270 query_info(const unsigned int xid, struct cifs_tcon *tcon,
2271            u64 persistent_fid, u64 volatile_fid, u8 info_class, u8 info_type,
2272            u32 additional_info, size_t output_len, size_t min_len, void **data,
2273                 u32 *dlen)
2274 {
2275         struct smb2_query_info_req *req;
2276         struct smb2_query_info_rsp *rsp = NULL;
2277         struct kvec iov[2];
2278         struct kvec rsp_iov;
2279         int rc = 0;
2280         int resp_buftype;
2281         struct cifs_ses *ses = tcon->ses;
2282         int flags = 0;
2283         unsigned int total_len;
2284 
2285         cifs_dbg(FYI, "Query Info\n");
2286 
2287         if (!ses || !(ses->server))
2288                 return -EIO;
2289 
2290         rc = smb2_plain_req_init(SMB2_QUERY_INFO, tcon, (void **) &req,
2291                              &total_len);
2292         if (rc)
2293                 return rc;
2294 
2295         if (encryption_required(tcon))
2296                 flags |= CIFS_TRANSFORM_REQ;
2297 
2298         req->InfoType = info_type;
2299         req->FileInfoClass = info_class;
2300         req->PersistentFileId = persistent_fid;
2301         req->VolatileFileId = volatile_fid;
2302         req->AdditionalInformation = cpu_to_le32(additional_info);
2303 
2304         /*
2305          * We do not use the input buffer (do not send extra byte)
2306          */
2307         req->InputBufferOffset = 0;
2308 
2309         req->OutputBufferLength = cpu_to_le32(output_len);
2310 
2311         iov[0].iov_base = (char *)req;
2312         /* 1 for Buffer */
2313         iov[0].iov_len = total_len - 1;
2314 
2315         rc = smb2_send_recv(xid, ses, iov, 1, &resp_buftype, flags, &rsp_iov);
2316         cifs_small_buf_release(req);
2317         rsp = (struct smb2_query_info_rsp *)rsp_iov.iov_base;
2318 
2319         if (rc) {
2320                 cifs_stats_fail_inc(tcon, SMB2_QUERY_INFO_HE);
2321                 goto qinf_exit;
2322         }
2323 
2324         if (dlen) {
2325                 *dlen = le32_to_cpu(rsp->OutputBufferLength);
2326                 if (!*data) {
2327                         *data = kmalloc(*dlen, GFP_KERNEL);
2328                         if (!*data) {
2329                                 cifs_dbg(VFS,
2330                                         "Error %d allocating memory for acl\n",
2331                                         rc);
2332                                 *dlen = 0;
2333                                 goto qinf_exit;
2334                         }
2335                 }
2336         }
2337 
2338         rc = validate_and_copy_iov(ses->server,
2339                                    le16_to_cpu(rsp->OutputBufferOffset),
2340                                    le32_to_cpu(rsp->OutputBufferLength),
2341                                    &rsp_iov, min_len, *data);
2342 
2343 qinf_exit:
2344         free_rsp_buf(resp_buftype, rsp);
2345         return rc;
2346 }
2347 
2348 int SMB2_query_eas(const unsigned int xid, struct cifs_tcon *tcon,
2349                    u64 persistent_fid, u64 volatile_fid,
2350                    int ea_buf_size, struct smb2_file_full_ea_info *data)
2351 {
2352         return query_info(xid, tcon, persistent_fid, volatile_fid,
2353                           FILE_FULL_EA_INFORMATION, SMB2_O_INFO_FILE, 0,
2354                           ea_buf_size,
2355                           sizeof(struct smb2_file_full_ea_info),
2356                           (void **)&data,
2357                           NULL);
2358 }
2359 
2360 int SMB2_query_info(const unsigned int xid, struct cifs_tcon *tcon,
2361         u64 persistent_fid, u64 volatile_fid, struct smb2_file_all_info *data)
2362 {
2363         return query_info(xid, tcon, persistent_fid, volatile_fid,
2364                           FILE_ALL_INFORMATION, SMB2_O_INFO_FILE, 0,
2365                           sizeof(struct smb2_file_all_info) + PATH_MAX * 2,
2366                           sizeof(struct smb2_file_all_info), (void **)&data,
2367                           NULL);
2368 }
2369 
2370 int
2371 SMB2_query_acl(const unsigned int xid, struct cifs_tcon *tcon,
2372                 u64 persistent_fid, u64 volatile_fid,
2373                 void **data, u32 *plen)
2374 {
2375         __u32 additional_info = OWNER_SECINFO | GROUP_SECINFO | DACL_SECINFO;
2376         *plen = 0;
2377 
2378         return query_info(xid, tcon, persistent_fid, volatile_fid,
2379                           0, SMB2_O_INFO_SECURITY, additional_info,
2380                           SMB2_MAX_BUFFER_SIZE,
2381                           sizeof(struct smb2_file_all_info), data, plen);
2382 }
2383 
2384 int
2385 SMB2_get_srv_num(const unsigned int xid, struct cifs_tcon *tcon,
2386                  u64 persistent_fid, u64 volatile_fid, __le64 *uniqueid)
2387 {
2388         return query_info(xid, tcon, persistent_fid, volatile_fid,
2389                           FILE_INTERNAL_INFORMATION, SMB2_O_INFO_FILE, 0,
2390                           sizeof(struct smb2_file_internal_info),
2391                           sizeof(struct smb2_file_internal_info),
2392                           (void **)&uniqueid, NULL);
2393 }
2394 
2395 /*
2396  * This is a no-op for now. We're not really interested in the reply, but
2397  * rather in the fact that the server sent one and that server->lstrp
2398  * gets updated.
2399  *
2400  * FIXME: maybe we should consider checking that the reply matches request?
2401  */
2402 static void
2403 smb2_echo_callback(struct mid_q_entry *mid)
2404 {
2405         struct TCP_Server_Info *server = mid->callback_data;
2406         struct smb2_echo_rsp *rsp = (struct smb2_echo_rsp *)mid->resp_buf;
2407         unsigned int credits_received = 1;
2408 
2409         if (mid->mid_state == MID_RESPONSE_RECEIVED)
2410                 credits_received = le16_to_cpu(rsp->hdr.sync_hdr.CreditRequest);
2411 
2412         DeleteMidQEntry(mid);
2413         add_credits(server, credits_received, CIFS_ECHO_OP);
2414 }
2415 
2416 void smb2_reconnect_server(struct work_struct *work)
2417 {
2418         struct TCP_Server_Info *server = container_of(work,
2419                                         struct TCP_Server_Info, reconnect.work);
2420         struct cifs_ses *ses;
2421         struct cifs_tcon *tcon, *tcon2;
2422         struct list_head tmp_list;
2423         int tcon_exist = false;
2424         int rc;
2425         int resched = false;
2426 
2427 
2428         /* Prevent simultaneous reconnects that can corrupt tcon->rlist list */
2429         mutex_lock(&server->reconnect_mutex);
2430 
2431         INIT_LIST_HEAD(&tmp_list);
2432         cifs_dbg(FYI, "Need negotiate, reconnecting tcons\n");
2433 
2434         spin_lock(&cifs_tcp_ses_lock);
2435         list_for_each_entry(ses, &server->smb_ses_list, smb_ses_list) {
2436                 list_for_each_entry(tcon, &ses->tcon_list, tcon_list) {
2437                         if (tcon->need_reconnect || tcon->need_reopen_files) {
2438                                 tcon->tc_count++;
2439                                 list_add_tail(&tcon->rlist, &tmp_list);
2440                                 tcon_exist = true;
2441                         }
2442                 }
2443                 if (ses->tcon_ipc && ses->tcon_ipc->need_reconnect) {
2444                         list_add_tail(&ses->tcon_ipc->rlist, &tmp_list);
2445                         tcon_exist = true;
2446                 }
2447         }
2448         /*
2449          * Get the reference to server struct to be sure that the last call of
2450          * cifs_put_tcon() in the loop below won't release the server pointer.
2451          */
2452         if (tcon_exist)
2453                 server->srv_count++;
2454 
2455         spin_unlock(&cifs_tcp_ses_lock);
2456 
2457         list_for_each_entry_safe(tcon, tcon2, &tmp_list, rlist) {
2458                 rc = smb2_reconnect(SMB2_INTERNAL_CMD, tcon);
2459                 if (!rc)
2460                         cifs_reopen_persistent_handles(tcon);
2461                 else
2462                         resched = true;
2463                 list_del_init(&tcon->rlist);
2464                 cifs_put_tcon(tcon);
2465         }
2466 
2467         cifs_dbg(FYI, "Reconnecting tcons finished\n");
2468         if (resched)
2469                 queue_delayed_work(cifsiod_wq, &server->reconnect, 2 * HZ);
2470         mutex_unlock(&server->reconnect_mutex);
2471 
2472         /* now we can safely release srv struct */
2473         if (tcon_exist)
2474                 cifs_put_tcp_session(server, 1);
2475 }
2476 
2477 int
2478 SMB2_echo(struct TCP_Server_Info *server)
2479 {
2480         struct smb2_echo_req *req;
2481         int rc = 0;
2482         struct kvec iov[2];
2483         struct smb_rqst rqst = { .rq_iov = iov,
2484                                  .rq_nvec = 2 };
2485         unsigned int total_len;
2486         __be32 rfc1002_marker;
2487 
2488         cifs_dbg(FYI, "In echo request\n");
2489 
2490         if (server->tcpStatus == CifsNeedNegotiate) {
2491                 /* No need to send echo on newly established connections */
2492                 queue_delayed_work(cifsiod_wq, &server->reconnect, 0);
2493                 return rc;
2494         }
2495 
2496         rc = smb2_plain_req_init(SMB2_ECHO, NULL, (void **)&req, &total_len);
2497         if (rc)
2498                 return rc;
2499 
2500         req->sync_hdr.CreditRequest = cpu_to_le16(1);
2501 
2502         iov[0].iov_len = 4;
2503         rfc1002_marker = cpu_to_be32(total_len);
2504         iov[0].iov_base = &rfc1002_marker;
2505         iov[1].iov_len = total_len;
2506         iov[1].iov_base = (char *)req;
2507 
2508         rc = cifs_call_async(server, &rqst, NULL, smb2_echo_callback, NULL,
2509                              server, CIFS_ECHO_OP);
2510         if (rc)
2511                 cifs_dbg(FYI, "Echo request failed: %d\n", rc);
2512 
2513         cifs_small_buf_release(req);
2514         return rc;
2515 }
2516 
2517 int
2518 SMB2_flush(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid,
2519            u64 volatile_fid)
2520 {
2521         struct smb2_flush_req *req;
2522         struct cifs_ses *ses = tcon->ses;
2523         struct kvec iov[1];
2524         struct kvec rsp_iov;
2525         int resp_buftype;
2526         int rc = 0;
2527         int flags = 0;
2528         unsigned int total_len;
2529 
2530         cifs_dbg(FYI, "Flush\n");
2531 
2532         if (!ses || !(ses->server))
2533                 return -EIO;
2534 
2535         rc = smb2_plain_req_init(SMB2_FLUSH, tcon, (void **) &req, &total_len);
2536         if (rc)
2537                 return rc;
2538 
2539         if (encryption_required(tcon))
2540                 flags |= CIFS_TRANSFORM_REQ;
2541 
2542         req->PersistentFileId = persistent_fid;
2543         req->VolatileFileId = volatile_fid;
2544 
2545         iov[0].iov_base = (char *)req;
2546         iov[0].iov_len = total_len;
2547 
2548         rc = smb2_send_recv(xid, ses, iov, 1, &resp_buftype, flags, &rsp_iov);
2549         cifs_small_buf_release(req);
2550 
2551         if (rc != 0)
2552                 cifs_stats_fail_inc(tcon, SMB2_FLUSH_HE);
2553 
2554         free_rsp_buf(resp_buftype, rsp_iov.iov_base);
2555         return rc;
2556 }
2557 
2558 /*
2559  * To form a chain of read requests, any read requests after the first should
2560  * have the end_of_chain boolean set to true.
2561  */
2562 static int
2563 smb2_new_read_req(void **buf, unsigned int *total_len,
2564         struct cifs_io_parms *io_parms, struct cifs_readdata *rdata,
2565         unsigned int remaining_bytes, int request_type)
2566 {
2567         int rc = -EACCES;
2568         struct smb2_read_plain_req *req = NULL;
2569         struct smb2_sync_hdr *shdr;
2570         struct TCP_Server_Info *server;
2571 
2572         rc = smb2_plain_req_init(SMB2_READ, io_parms->tcon, (void **) &req,
2573                                  total_len);
2574         if (rc)
2575                 return rc;
2576 
2577         server = io_parms->tcon->ses->server;
2578         if (server == NULL)
2579                 return -ECONNABORTED;
2580 
2581         shdr = &req->sync_hdr;
2582         shdr->ProcessId = cpu_to_le32(io_parms->pid);
2583 
2584         req->PersistentFileId = io_parms->persistent_fid;
2585         req->VolatileFileId = io_parms->volatile_fid;
2586         req->ReadChannelInfoOffset = 0; /* reserved */
2587         req->ReadChannelInfoLength = 0; /* reserved */
2588         req->Channel = 0; /* reserved */
2589         req->MinimumCount = 0;
2590         req->Length = cpu_to_le32(io_parms->length);
2591         req->Offset = cpu_to_le64(io_parms->offset);
2592 #ifdef CONFIG_CIFS_SMB_DIRECT
2593         /*
2594          * If we want to do a RDMA write, fill in and append
2595          * smbd_buffer_descriptor_v1 to the end of read request
2596          */
2597         if (server->rdma && rdata && !server->sign &&
2598                 rdata->bytes >= server->smbd_conn->rdma_readwrite_threshold) {
2599 
2600                 struct smbd_buffer_descriptor_v1 *v1;
2601                 bool need_invalidate =
2602                         io_parms->tcon->ses->server->dialect == SMB30_PROT_ID;
2603 
2604                 rdata->mr = smbd_register_mr(
2605                                 server->smbd_conn, rdata->pages,
2606                                 rdata->nr_pages, rdata->tailsz,
2607                                 true, need_invalidate);
2608                 if (!rdata->mr)
2609                         return -ENOBUFS;
2610 
2611                 req->Channel = SMB2_CHANNEL_RDMA_V1_INVALIDATE;
2612                 if (need_invalidate)
2613                         req->Channel = SMB2_CHANNEL_RDMA_V1;
2614                 req->ReadChannelInfoOffset =
2615                         cpu_to_le16(offsetof(struct smb2_read_plain_req, Buffer));
2616                 req->ReadChannelInfoLength =
2617                         cpu_to_le16(sizeof(struct smbd_buffer_descriptor_v1));
2618                 v1 = (struct smbd_buffer_descriptor_v1 *) &req->Buffer[0];
2619                 v1->offset = cpu_to_le64(rdata->mr->mr->iova);
2620                 v1->token = cpu_to_le32(rdata->mr->mr->rkey);
2621                 v1->length = cpu_to_le32(rdata->mr->mr->length);
2622 
2623                 *total_len += sizeof(*v1) - 1;
2624         }
2625 #endif
2626         if (request_type & CHAINED_REQUEST) {
2627                 if (!(request_type & END_OF_CHAIN)) {
2628                         /* next 8-byte aligned request */
2629                         *total_len = DIV_ROUND_UP(*total_len, 8) * 8;
2630                         shdr->NextCommand = cpu_to_le32(*total_len);
2631                 } else /* END_OF_CHAIN */
2632                         shdr->NextCommand = 0;
2633                 if (request_type & RELATED_REQUEST) {
2634                         shdr->Flags |= SMB2_FLAGS_RELATED_OPERATIONS;
2635                         /*
2636                          * Related requests use info from previous read request
2637                          * in chain.
2638                          */
2639                         shdr->SessionId = 0xFFFFFFFF;
2640                         shdr->TreeId = 0xFFFFFFFF;
2641                         req->PersistentFileId = 0xFFFFFFFF;
2642                         req->VolatileFileId = 0xFFFFFFFF;
2643                 }
2644         }
2645         if (remaining_bytes > io_parms->length)
2646                 req->RemainingBytes = cpu_to_le32(remaining_bytes);
2647         else
2648                 req->RemainingBytes = 0;
2649 
2650         *buf = req;
2651         return rc;
2652 }
2653 
2654 static void
2655 smb2_readv_callback(struct mid_q_entry *mid)
2656 {
2657         struct cifs_readdata *rdata = mid->callback_data;
2658         struct cifs_tcon *tcon = tlink_tcon(rdata->cfile->tlink);
2659         struct TCP_Server_Info *server = tcon->ses->server;
2660         struct smb2_sync_hdr *shdr =
2661                                 (struct smb2_sync_hdr *)rdata->iov[1].iov_base;
2662         unsigned int credits_received = 1;
2663         struct smb_rqst rqst = { .rq_iov = rdata->iov,
2664                                  .rq_nvec = 2,
2665                                  .rq_pages = rdata->pages,
2666                                  .rq_npages = rdata->nr_pages,
2667                                  .rq_pagesz = rdata->pagesz,
2668                                  .rq_tailsz = rdata->tailsz };
2669 
2670         cifs_dbg(FYI, "%s: mid=%llu state=%d result=%d bytes=%u\n",
2671                  __func__, mid->mid, mid->mid_state, rdata->result,
2672                  rdata->bytes);
2673 
2674         switch (mid->mid_state) {
2675         case MID_RESPONSE_RECEIVED:
2676                 credits_received = le16_to_cpu(shdr->CreditRequest);
2677                 /* result already set, check signature */
2678                 if (server->sign && !mid->decrypted) {
2679                         int rc;
2680 
2681                         rc = smb2_verify_signature(&rqst, server);
2682                         if (rc)
2683                                 cifs_dbg(VFS, "SMB signature verification returned error = %d\n",
2684                                          rc);
2685                 }
2686                 /* FIXME: should this be counted toward the initiating task? */
2687                 task_io_account_read(rdata->got_bytes);
2688                 cifs_stats_bytes_read(tcon, rdata->got_bytes);
2689                 break;
2690         case MID_REQUEST_SUBMITTED:
2691         case MID_RETRY_NEEDED:
2692                 rdata->result = -EAGAIN;
2693                 if (server->sign && rdata->got_bytes)
2694                         /* reset bytes number since we can not check a sign */
2695                         rdata->got_bytes = 0;
2696                 /* FIXME: should this be counted toward the initiating task? */
2697                 task_io_account_read(rdata->got_bytes);
2698                 cifs_stats_bytes_read(tcon, rdata->got_bytes);
2699                 break;
2700         default:
2701                 if (rdata->result != -ENODATA)
2702                         rdata->result = -EIO;
2703         }
2704 #ifdef CONFIG_CIFS_SMB_DIRECT
2705         /*
2706          * If this rdata has a memmory registered, the MR can be freed
2707          * MR needs to be freed as soon as I/O finishes to prevent deadlock
2708          * because they have limited number and are used for future I/Os
2709          */
2710         if (rdata->mr) {
2711                 smbd_deregister_mr(rdata->mr);
2712                 rdata->mr = NULL;
2713         }
2714 #endif
2715         if (rdata->result)
2716                 cifs_stats_fail_inc(tcon, SMB2_READ_HE);
2717 
2718         queue_work(cifsiod_wq, &rdata->work);
2719         DeleteMidQEntry(mid);
2720         add_credits(server, credits_received, 0);
2721 }
2722 
2723 /* smb2_async_readv - send an async read, and set up mid to handle result */
2724 int
2725 smb2_async_readv(struct cifs_readdata *rdata)
2726 {
2727         int rc, flags = 0;
2728         char *buf;
2729         struct smb2_sync_hdr *shdr;
2730         struct cifs_io_parms io_parms;
2731         struct smb_rqst rqst = { .rq_iov = rdata->iov,
2732                                  .rq_nvec = 2 };
2733         struct TCP_Server_Info *server;
2734         unsigned int total_len;
2735         __be32 req_len;
2736 
2737         cifs_dbg(FYI, "%s: offset=%llu bytes=%u\n",
2738                  __func__, rdata->offset, rdata->bytes);
2739 
2740         io_parms.tcon = tlink_tcon(rdata->cfile->tlink);
2741         io_parms.offset = rdata->offset;
2742         io_parms.length = rdata->bytes;
2743         io_parms.persistent_fid = rdata->cfile->fid.persistent_fid;
2744         io_parms.volatile_fid = rdata->cfile->fid.volatile_fid;
2745         io_parms.pid = rdata->pid;
2746 
2747         server = io_parms.tcon->ses->server;
2748 
2749         rc = smb2_new_read_req(
2750                 (void **) &buf, &total_len, &io_parms, rdata, 0, 0);
2751         if (rc) {
2752                 if (rc == -EAGAIN && rdata->credits) {
2753                         /* credits was reset by reconnect */
2754                         rdata->credits = 0;
2755                         /* reduce in_flight value since we won't send the req */
2756                         spin_lock(&server->req_lock);
2757                         server->in_flight--;
2758                         spin_unlock(&server->req_lock);
2759                 }
2760                 return rc;
2761         }
2762 
2763         if (encryption_required(io_parms.tcon))
2764                 flags |= CIFS_TRANSFORM_REQ;
2765 
2766         req_len = cpu_to_be32(total_len);
2767 
2768         rdata->iov[0].iov_base = &req_len;
2769         rdata->iov[0].iov_len = sizeof(__be32);
2770         rdata->iov[1].iov_base = buf;
2771         rdata->iov[1].iov_len = total_len;
2772 
2773         shdr = (struct smb2_sync_hdr *)buf;
2774 
2775         if (rdata->credits) {
2776                 shdr->CreditCharge = cpu_to_le16(DIV_ROUND_UP(rdata->bytes,
2777                                                 SMB2_MAX_BUFFER_SIZE));
2778                 shdr->CreditRequest = shdr->CreditCharge;
2779                 spin_lock(&server->req_lock);
2780                 server->credits += rdata->credits -
2781                                                 le16_to_cpu(shdr->CreditCharge);
2782                 spin_unlock(&server->req_lock);
2783                 wake_up(&server->request_q);
2784                 flags |= CIFS_HAS_CREDITS;
2785         }
2786 
2787         kref_get(&rdata->refcount);
2788         rc = cifs_call_async(io_parms.tcon->ses->server, &rqst,
2789                              cifs_readv_receive, smb2_readv_callback,
2790                              smb3_handle_read_data, rdata, flags);
2791         if (rc) {
2792                 kref_put(&rdata->refcount, cifs_readdata_release);
2793                 cifs_stats_fail_inc(io_parms.tcon, SMB2_READ_HE);
2794         }
2795 
2796         cifs_small_buf_release(buf);
2797         return rc;
2798 }
2799 
2800 int
2801 SMB2_read(const unsigned int xid, struct cifs_io_parms *io_parms,
2802           unsigned int *nbytes, char **buf, int *buf_type)
2803 {
2804         int resp_buftype, rc = -EACCES;
2805         struct smb2_read_plain_req *req = NULL;
2806         struct smb2_read_rsp *rsp = NULL;
2807         struct smb2_sync_hdr *shdr;
2808         struct kvec iov[1];
2809         struct kvec rsp_iov;
2810         unsigned int total_len;
2811         int flags = CIFS_LOG_ERROR;
2812         struct cifs_ses *ses = io_parms->tcon->ses;
2813 
2814         *nbytes = 0;
2815         rc = smb2_new_read_req((void **)&req, &total_len, io_parms, NULL, 0, 0);
2816         if (rc)
2817                 return rc;
2818 
2819         if (encryption_required(io_parms->tcon))
2820                 flags |= CIFS_TRANSFORM_REQ;
2821 
2822         iov[0].iov_base = (char *)req;
2823         iov[0].iov_len = total_len;
2824 
2825         rc = smb2_send_recv(xid, ses, iov, 1, &resp_buftype, flags, &rsp_iov);
2826         cifs_small_buf_release(req);
2827 
2828         rsp = (struct smb2_read_rsp *)rsp_iov.iov_base;
2829 
2830         if (rc) {
2831                 if (rc != -ENODATA) {
2832                         cifs_stats_fail_inc(io_parms->tcon, SMB2_READ_HE);
2833                         cifs_dbg(VFS, "Send error in read = %d\n", rc);
2834                 }
2835                 free_rsp_buf(resp_buftype, rsp_iov.iov_base);
2836                 return rc == -ENODATA ? 0 : rc;
2837         }
2838 
2839         *nbytes = le32_to_cpu(rsp->DataLength);
2840         if ((*nbytes > CIFS_MAX_MSGSIZE) ||
2841             (*nbytes > io_parms->length)) {
2842                 cifs_dbg(FYI, "bad length %d for count %d\n",
2843                          *nbytes, io_parms->length);
2844                 rc = -EIO;
2845                 *nbytes = 0;
2846         }
2847 
2848         shdr = get_sync_hdr(rsp);
2849 
2850         if (*buf) {
2851                 memcpy(*buf, (char *)shdr + rsp->DataOffset, *nbytes);
2852                 free_rsp_buf(resp_buftype, rsp_iov.iov_base);
2853         } else if (resp_buftype != CIFS_NO_BUFFER) {
2854                 *buf = rsp_iov.iov_base;
2855                 if (resp_buftype == CIFS_SMALL_BUFFER)
2856                         *buf_type = CIFS_SMALL_BUFFER;
2857                 else if (resp_buftype == CIFS_LARGE_BUFFER)
2858                         *buf_type = CIFS_LARGE_BUFFER;
2859         }
2860         return rc;
2861 }
2862 
2863 /*
2864  * Check the mid_state and signature on received buffer (if any), and queue the
2865  * workqueue completion task.
2866  */
2867 static void
2868 smb2_writev_callback(struct mid_q_entry *mid)
2869 {
2870         struct cifs_writedata *wdata = mid->callback_data;
2871         struct cifs_tcon *tcon = tlink_tcon(wdata->cfile->tlink);
2872         unsigned int written;
2873         struct smb2_write_rsp *rsp = (struct smb2_write_rsp *)mid->resp_buf;
2874         unsigned int credits_received = 1;
2875 
2876         switch (mid->mid_state) {
2877         case MID_RESPONSE_RECEIVED:
2878                 credits_received = le16_to_cpu(rsp->hdr.sync_hdr.CreditRequest);
2879                 wdata->result = smb2_check_receive(mid, tcon->ses->server, 0);
2880                 if (wdata->result != 0)
2881                         break;
2882 
2883                 written = le32_to_cpu(rsp->DataLength);
2884                 /*
2885                  * Mask off high 16 bits when bytes written as returned
2886                  * by the server is greater than bytes requested by the
2887                  * client. OS/2 servers are known to set incorrect
2888                  * CountHigh values.
2889                  */
2890                 if (written > wdata->bytes)
2891                         written &= 0xFFFF;
2892 
2893                 if (written < wdata->bytes)
2894                         wdata->result = -ENOSPC;
2895                 else
2896                         wdata->bytes = written;
2897                 break;
2898         case MID_REQUEST_SUBMITTED:
2899         case MID_RETRY_NEEDED:
2900                 wdata->result = -EAGAIN;
2901                 break;
2902         default:
2903                 wdata->result = -EIO;
2904                 break;
2905         }
2906 #ifdef CONFIG_CIFS_SMB_DIRECT
2907         /*
2908          * If this wdata has a memory registered, the MR can be freed
2909          * The number of MRs available is limited, it's important to recover
2910          * used MR as soon as I/O is finished. Hold MR longer in the later
2911          * I/O process can possibly result in I/O deadlock due to lack of MR
2912          * to send request on I/O retry
2913          */
2914         if (wdata->mr) {
2915                 smbd_deregister_mr(wdata->mr);
2916                 wdata->mr = NULL;
2917         }
2918 #endif
2919         if (wdata->result)
2920                 cifs_stats_fail_inc(tcon, SMB2_WRITE_HE);
2921 
2922         queue_work(cifsiod_wq, &wdata->work);
2923         DeleteMidQEntry(mid);
2924         add_credits(tcon->ses->server, credits_received, 0);
2925 }
2926 
2927 /* smb2_async_writev - send an async write, and set up mid to handle result */
2928 int
2929 smb2_async_writev(struct cifs_writedata *wdata,
2930                   void (*release)(struct kref *kref))
2931 {
2932         int rc = -EACCES, flags = 0;
2933         struct smb2_write_req *req = NULL;
2934         struct smb2_sync_hdr *shdr;
2935         struct cifs_tcon *tcon = tlink_tcon(wdata->cfile->tlink);
2936         struct TCP_Server_Info *server = tcon->ses->server;
2937         struct kvec iov[2];
2938         struct smb_rqst rqst = { };
2939         unsigned int total_len;
2940         __be32 rfc1002_marker;
2941 
2942         rc = smb2_plain_req_init(SMB2_WRITE, tcon, (void **) &req, &total_len);
2943         if (rc) {
2944                 if (rc == -EAGAIN && wdata->credits) {
2945                         /* credits was reset by reconnect */
2946                         wdata->credits = 0;
2947                         /* reduce in_flight value since we won't send the req */
2948                         spin_lock(&server->req_lock);
2949                         server->in_flight--;
2950                         spin_unlock(&server->req_lock);
2951                 }
2952                 goto async_writev_out;
2953         }
2954 
2955         if (encryption_required(tcon))
2956                 flags |= CIFS_TRANSFORM_REQ;
2957 
2958         shdr = (struct smb2_sync_hdr *)req;
2959         shdr->ProcessId = cpu_to_le32(wdata->cfile->pid);
2960 
2961         req->PersistentFileId = wdata->cfile->fid.persistent_fid;
2962         req->VolatileFileId = wdata->cfile->fid.volatile_fid;
2963         req->WriteChannelInfoOffset = 0;
2964         req->WriteChannelInfoLength = 0;
2965         req->Channel = 0;
2966         req->Offset = cpu_to_le64(wdata->offset);
2967         req->DataOffset = cpu_to_le16(
2968                                 offsetof(struct smb2_write_req, Buffer));
2969         req->RemainingBytes = 0;
2970 #ifdef CONFIG_CIFS_SMB_DIRECT
2971         /*
2972          * If we want to do a server RDMA read, fill in and append
2973          * smbd_buffer_descriptor_v1 to the end of write request
2974          */
2975         if (server->rdma && !server->sign && wdata->bytes >=
2976                 server->smbd_conn->rdma_readwrite_threshold) {
2977 
2978                 struct smbd_buffer_descriptor_v1 *v1;
2979                 bool need_invalidate = server->dialect == SMB30_PROT_ID;
2980 
2981                 wdata->mr = smbd_register_mr(
2982                                 server->smbd_conn, wdata->pages,
2983                                 wdata->nr_pages, wdata->tailsz,
2984                                 false, need_invalidate);
2985                 if (!wdata->mr) {
2986                         rc = -ENOBUFS;
2987                         goto async_writev_out;
2988                 }
2989                 req->Length = 0;
2990                 req->DataOffset = 0;
2991                 req->RemainingBytes =
2992                         cpu_to_le32((wdata->nr_pages-1)*PAGE_SIZE + wdata->tailsz);
2993                 req->Channel = SMB2_CHANNEL_RDMA_V1_INVALIDATE;
2994                 if (need_invalidate)
2995                         req->Channel = SMB2_CHANNEL_RDMA_V1;
2996                 req->WriteChannelInfoOffset =
2997                         cpu_to_le16(offsetof(struct smb2_write_req, Buffer));
2998                 req->WriteChannelInfoLength =
2999                         cpu_to_le16(sizeof(struct smbd_buffer_descriptor_v1));
3000                 v1 = (struct smbd_buffer_descriptor_v1 *) &req->Buffer[0];
3001                 v1->offset = cpu_to_le64(wdata->mr->mr->iova);
3002                 v1->token = cpu_to_le32(wdata->mr->mr->rkey);
3003                 v1->length = cpu_to_le32(wdata->mr->mr->length);
3004         }
3005 #endif
3006         /* 4 for rfc1002 length field and 1 for Buffer */
3007         iov[0].iov_len = 4;
3008         rfc1002_marker = cpu_to_be32(total_len - 1 + wdata->bytes);
3009         iov[0].iov_base = &rfc1002_marker;
3010         iov[1].iov_len = total_len - 1;
3011         iov[1].iov_base = (char *)req;
3012 
3013         rqst.rq_iov = iov;
3014         rqst.rq_nvec = 2;
3015         rqst.rq_pages = wdata->pages;
3016         rqst.rq_npages = wdata->nr_pages;
3017         rqst.rq_pagesz = wdata->pagesz;
3018         rqst.rq_tailsz = wdata->tailsz;
3019 #ifdef CONFIG_CIFS_SMB_DIRECT
3020         if (wdata->mr) {
3021                 iov[1].iov_len += sizeof(struct smbd_buffer_descriptor_v1);
3022                 rqst.rq_npages = 0;
3023         }
3024 #endif
3025         cifs_dbg(FYI, "async write at %llu %u bytes\n",
3026                  wdata->offset, wdata->bytes);
3027 
3028 #ifdef CONFIG_CIFS_SMB_DIRECT
3029         /* For RDMA read, I/O size is in RemainingBytes not in Length */
3030         if (!wdata->mr)
3031                 req->Length = cpu_to_le32(wdata->bytes);
3032 #else
3033         req->Length = cpu_to_le32(wdata->bytes);
3034 #endif
3035 
3036         if (wdata->credits) {
3037                 shdr->CreditCharge = cpu_to_le16(DIV_ROUND_UP(wdata->bytes,
3038                                                     SMB2_MAX_BUFFER_SIZE));
3039                 shdr->CreditRequest = shdr->CreditCharge;
3040                 spin_lock(&server->req_lock);
3041                 server->credits += wdata->credits -
3042                                                 le16_to_cpu(shdr->CreditCharge);
3043                 spin_unlock(&server->req_lock);
3044                 wake_up(&server->request_q);
3045                 flags |= CIFS_HAS_CREDITS;
3046         }
3047 
3048         kref_get(&wdata->refcount);
3049         rc = cifs_call_async(server, &rqst, NULL, smb2_writev_callback, NULL,
3050                              wdata, flags);
3051 
3052         if (rc) {
3053                 kref_put(&wdata->refcount, release);
3054                 cifs_stats_fail_inc(tcon, SMB2_WRITE_HE);
3055         }
3056 
3057 async_writev_out:
3058         cifs_small_buf_release(req);
3059         return rc;
3060 }
3061 
3062 /*
3063  * SMB2_write function gets iov pointer to kvec array with n_vec as a length.
3064  * The length field from io_parms must be at least 1 and indicates a number of
3065  * elements with data to write that begins with position 1 in iov array. All
3066  * data length is specified by count.
3067  */
3068 int
3069 SMB2_write(const unsigned int xid, struct cifs_io_parms *io_parms,
3070            unsigned int *nbytes, struct kvec *iov, int n_vec)
3071 {
3072         int rc = 0;
3073         struct smb2_write_req *req = NULL;
3074         struct smb2_write_rsp *rsp = NULL;
3075         int resp_buftype;
3076         struct kvec rsp_iov;
3077         int flags = 0;
3078         unsigned int total_len;
3079 
3080         *nbytes = 0;
3081 
3082         if (n_vec < 1)
3083                 return rc;
3084 
3085         rc = smb2_plain_req_init(SMB2_WRITE, io_parms->tcon, (void **) &req,
3086                              &total_len);
3087         if (rc)
3088                 return rc;
3089 
3090         if (io_parms->tcon->ses->server == NULL)
3091                 return -ECONNABORTED;
3092 
3093         if (encryption_required(io_parms->tcon))
3094                 flags |= CIFS_TRANSFORM_REQ;
3095 
3096         req->sync_hdr.ProcessId = cpu_to_le32(io_parms->pid);
3097 
3098         req->PersistentFileId = io_parms->persistent_fid;
3099         req->VolatileFileId = io_parms->volatile_fid;
3100         req->WriteChannelInfoOffset = 0;
3101         req->WriteChannelInfoLength = 0;
3102         req->Channel = 0;
3103         req->Length = cpu_to_le32(io_parms->length);
3104         req->Offset = cpu_to_le64(io_parms->offset);
3105         req->DataOffset = cpu_to_le16(
3106                                 offsetof(struct smb2_write_req, Buffer));
3107         req->RemainingBytes = 0;
3108 
3109         iov[0].iov_base = (char *)req;
3110         /* 1 for Buffer */
3111         iov[0].iov_len = total_len - 1;
3112 
3113         rc = smb2_send_recv(xid, io_parms->tcon->ses, iov, n_vec + 1,
3114                             &resp_buftype, flags, &rsp_iov);
3115         cifs_small_buf_release(req);
3116         rsp = (struct smb2_write_rsp *)rsp_iov.iov_base;
3117 
3118         if (rc) {
3119                 cifs_stats_fail_inc(io_parms->tcon, SMB2_WRITE_HE);
3120                 cifs_dbg(VFS, "Send error in write = %d\n", rc);
3121         } else
3122                 *nbytes = le32_to_cpu(rsp->DataLength);
3123 
3124         free_rsp_buf(resp_buftype, rsp);
3125         return rc;
3126 }
3127 
3128 static unsigned int
3129 num_entries(char *bufstart, char *end_of_buf, char **lastentry, size_t size)
3130 {
3131         int len;
3132         unsigned int entrycount = 0;
3133         unsigned int next_offset = 0;
3134         FILE_DIRECTORY_INFO *entryptr;
3135 
3136         if (bufstart == NULL)
3137                 return 0;
3138 
3139         entryptr = (FILE_DIRECTORY_INFO *)bufstart;
3140 
3141         while (1) {
3142                 entryptr = (FILE_DIRECTORY_INFO *)
3143                                         ((char *)entryptr + next_offset);
3144 
3145                 if ((char *)entryptr + size > end_of_buf) {
3146                         cifs_dbg(VFS, "malformed search entry would overflow\n");
3147                         break;
3148                 }
3149 
3150                 len = le32_to_cpu(entryptr->FileNameLength);
3151                 if ((char *)entryptr + len + size > end_of_buf) {
3152                         cifs_dbg(VFS, "directory entry name would overflow frame end of buf %p\n",
3153                                  end_of_buf);
3154                         break;
3155                 }
3156 
3157                 *lastentry = (char *)entryptr;
3158                 entrycount++;
3159 
3160                 next_offset = le32_to_cpu(entryptr->NextEntryOffset);
3161                 if (!next_offset)
3162                         break;
3163         }
3164 
3165         return entrycount;
3166 }
3167 
3168 /*
3169  * Readdir/FindFirst
3170  */
3171 int
3172 SMB2_query_directory(const unsigned int xid, struct cifs_tcon *tcon,
3173                      u64 persistent_fid, u64 volatile_fid, int index,
3174                      struct cifs_search_info *srch_inf)
3175 {
3176         struct smb2_query_directory_req *req;
3177         struct smb2_query_directory_rsp *rsp = NULL;
3178         struct kvec iov[2];
3179         struct kvec rsp_iov;
3180         int rc = 0;
3181         int len;
3182         int resp_buftype = CIFS_NO_BUFFER;
3183         unsigned char *bufptr;
3184         struct TCP_Server_Info *server;
3185         struct cifs_ses *ses = tcon->ses;
3186         __le16 asteriks = cpu_to_le16('*');
3187         char *end_of_smb;
3188         unsigned int output_size = CIFSMaxBufSize;
3189         size_t info_buf_size;
3190         int flags = 0;
3191         unsigned int total_len;
3192 
3193         if (ses && (ses->server))
3194                 server = ses->server;
3195         else
3196                 return -EIO;
3197 
3198         rc = smb2_plain_req_init(SMB2_QUERY_DIRECTORY, tcon, (void **) &req,
3199                              &total_len);
3200         if (rc)
3201                 return rc;
3202 
3203         if (encryption_required(tcon))
3204                 flags |= CIFS_TRANSFORM_REQ;
3205 
3206         switch (srch_inf->info_level) {
3207         case SMB_FIND_FILE_DIRECTORY_INFO:
3208                 req->FileInformationClass = FILE_DIRECTORY_INFORMATION;
3209                 info_buf_size = sizeof(FILE_DIRECTORY_INFO) - 1;
3210                 break;
3211         case SMB_FIND_FILE_ID_FULL_DIR_INFO:
3212                 req->FileInformationClass = FILEID_FULL_DIRECTORY_INFORMATION;
3213                 info_buf_size = sizeof(SEARCH_ID_FULL_DIR_INFO) - 1;
3214                 break;
3215         default:
3216                 cifs_dbg(VFS, "info level %u isn't supported\n",
3217                          srch_inf->info_level);
3218                 rc = -EINVAL;
3219                 goto qdir_exit;
3220         }
3221 
3222         req->FileIndex = cpu_to_le32(index);
3223         req->PersistentFileId = persistent_fid;
3224         req->VolatileFileId = volatile_fid;
3225 
3226         len = 0x2;
3227         bufptr = req->Buffer;
3228         memcpy(bufptr, &asteriks, len);
3229 
3230         req->FileNameOffset =
3231                 cpu_to_le16(sizeof(struct smb2_query_directory_req) - 1);
3232         req->FileNameLength = cpu_to_le16(len);
3233         /*
3234          * BB could be 30 bytes or so longer if we used SMB2 specific
3235          * buffer lengths, but this is safe and close enough.
3236          */
3237         output_size = min_t(unsigned int, output_size, server->maxBuf);
3238         output_size = min_t(unsigned int, output_size, 2 << 15);
3239         req->OutputBufferLength = cpu_to_le32(output_size);
3240 
3241         iov[0].iov_base = (char *)req;
3242         /* 1 for Buffer */
3243         iov[0].iov_len = total_len - 1;
3244 
3245         iov[1].iov_base = (char *)(req->Buffer);
3246         iov[1].iov_len = len;
3247 
3248         rc = smb2_send_recv(xid, ses, iov, 2, &resp_buftype, flags, &rsp_iov);
3249         cifs_small_buf_release(req);
3250         rsp = (struct smb2_query_directory_rsp *)rsp_iov.iov_base;
3251 
3252         if (rc) {
3253                 if (rc == -ENODATA &&
3254                     rsp->hdr.sync_hdr.Status == STATUS_NO_MORE_FILES) {
3255                         srch_inf->endOfSearch = true;
3256                         rc = 0;
3257                 }
3258                 cifs_stats_fail_inc(tcon, SMB2_QUERY_DIRECTORY_HE);
3259                 goto qdir_exit;
3260         }
3261 
3262         rc = validate_iov(server,
3263                           le16_to_cpu(rsp->OutputBufferOffset),
3264                           le32_to_cpu(rsp->OutputBufferLength), &rsp_iov,
3265                           info_buf_size);
3266         if (rc)
3267                 goto qdir_exit;
3268 
3269         srch_inf->unicode = true;
3270 
3271         if (srch_inf->ntwrk_buf_start) {
3272                 if (srch_inf->smallBuf)
3273                         cifs_small_buf_release(srch_inf->ntwrk_buf_start);
3274                 else
3275                         cifs_buf_release(srch_inf->ntwrk_buf_start);
3276         }
3277         srch_inf->ntwrk_buf_start = (char *)rsp;
3278         srch_inf->srch_entries_start = srch_inf->last_entry = 4 /* rfclen */ +
3279                 (char *)&rsp->hdr + le16_to_cpu(rsp->OutputBufferOffset);
3280         /* 4 for rfc1002 length field */
3281         end_of_smb = get_rfc1002_length(rsp) + 4 + (char *)&rsp->hdr;
3282         srch_inf->entries_in_buffer =
3283                         num_entries(srch_inf->srch_entries_start, end_of_smb,
3284                                     &srch_inf->last_entry, info_buf_size);
3285         srch_inf->index_of_last_entry += srch_inf->entries_in_buffer;
3286         cifs_dbg(FYI, "num entries %d last_index %lld srch start %p srch end %p\n",
3287                  srch_inf->entries_in_buffer, srch_inf->index_of_last_entry,
3288                  srch_inf->srch_entries_start, srch_inf->last_entry);
3289         if (resp_buftype == CIFS_LARGE_BUFFER)
3290                 srch_inf->smallBuf = false;
3291         else if (resp_buftype == CIFS_SMALL_BUFFER)
3292                 srch_inf->smallBuf = true;
3293         else
3294                 cifs_dbg(VFS, "illegal search buffer type\n");
3295 
3296         return rc;
3297 
3298 qdir_exit:
3299         free_rsp_buf(resp_buftype, rsp);
3300         return rc;
3301 }
3302 
3303 static int
3304 send_set_info(const unsigned int xid, struct cifs_tcon *tcon,
3305                u64 persistent_fid, u64 volatile_fid, u32 pid, u8 info_class,
3306                u8 info_type, u32 additional_info, unsigned int num,
3307                 void **data, unsigned int *size)
3308 {
3309         struct smb2_set_info_req *req;
3310         struct smb2_set_info_rsp *rsp = NULL;
3311         struct kvec *iov;
3312         struct kvec rsp_iov;
3313         int rc = 0;
3314         int resp_buftype;
3315         unsigned int i;
3316         struct cifs_ses *ses = tcon->ses;
3317         int flags = 0;
3318         unsigned int total_len;
3319 
3320         if (!ses || !(ses->server))
3321                 return -EIO;
3322 
3323         if (!num)
3324                 return -EINVAL;
3325 
3326         iov = kmalloc(sizeof(struct kvec) * num, GFP_KERNEL);
3327         if (!iov)
3328                 return -ENOMEM;
3329 
3330         rc = smb2_plain_req_init(SMB2_SET_INFO, tcon, (void **) &req, &total_len);
3331         if (rc) {
3332                 kfree(iov);
3333                 return rc;
3334         }
3335 
3336         if (encryption_required(tcon))
3337                 flags |= CIFS_TRANSFORM_REQ;
3338 
3339         req->sync_hdr.ProcessId = cpu_to_le32(pid);
3340 
3341         req->InfoType = info_type;
3342         req->FileInfoClass = info_class;
3343         req->PersistentFileId = persistent_fid;
3344         req->VolatileFileId = volatile_fid;
3345         req->AdditionalInformation = cpu_to_le32(additional_info);
3346 
3347         req->BufferOffset =
3348                         cpu_to_le16(sizeof(struct smb2_set_info_req) - 1);
3349         req->BufferLength = cpu_to_le32(*size);
3350 
3351         memcpy(req->Buffer, *data, *size);
3352         total_len += *size;
3353 
3354         iov[0].iov_base = (char *)req;
3355         /* 1 for Buffer */
3356         iov[0].iov_len = total_len - 1;
3357 
3358         for (i = 1; i < num; i++) {
3359                 le32_add_cpu(&req->BufferLength, size[i]);
3360                 iov[i].iov_base = (char *)data[i];
3361                 iov[i].iov_len = size[i];
3362         }
3363 
3364         rc = smb2_send_recv(xid, ses, iov, num, &resp_buftype, flags,
3365                             &rsp_iov);
3366         cifs_small_buf_release(req);
3367         rsp = (struct smb2_set_info_rsp *)rsp_iov.iov_base;
3368 
3369         if (rc != 0)
3370                 cifs_stats_fail_inc(tcon, SMB2_SET_INFO_HE);
3371 
3372         free_rsp_buf(resp_buftype, rsp);
3373         kfree(iov);
3374         return rc;
3375 }
3376 
3377 int
3378 SMB2_rename(const unsigned int xid, struct cifs_tcon *tcon,
3379             u64 persistent_fid, u64 volatile_fid, __le16 *target_file)
3380 {
3381         struct smb2_file_rename_info info;
3382         void **data;
3383         unsigned int size[2];
3384         int rc;
3385         int len = (2 * UniStrnlen((wchar_t *)target_file, PATH_MAX));
3386 
3387         data = kmalloc(sizeof(void *) * 2, GFP_KERNEL);
3388         if (!data)
3389                 return -ENOMEM;
3390 
3391         info.ReplaceIfExists = 1; /* 1 = replace existing target with new */
3392                               /* 0 = fail if target already exists */
3393         info.RootDirectory = 0;  /* MBZ for network ops (why does spec say?) */
3394         info.FileNameLength = cpu_to_le32(len);
3395 
3396         data[0] = &info;
3397         size[0] = sizeof(struct smb2_file_rename_info);
3398 
3399         data[1] = target_file;
3400         size[1] = len + 2 /* null */;
3401 
3402         rc = send_set_info(xid, tcon, persistent_fid, volatile_fid,
3403                 current->tgid, FILE_RENAME_INFORMATION, SMB2_O_INFO_FILE,
3404                 0, 2, data, size);
3405         kfree(data);
3406         return rc;
3407 }
3408 
3409 int
3410 SMB2_rmdir(const unsigned int xid, struct cifs_tcon *tcon,
3411                   u64 persistent_fid, u64 volatile_fid)
3412 {
3413         __u8 delete_pending = 1;
3414         void *data;
3415         unsigned int size;
3416 
3417         data = &delete_pending;
3418         size = 1; /* sizeof __u8 */
3419 
3420         return send_set_info(xid, tcon, persistent_fid, volatile_fid,
3421                 current->tgid, FILE_DISPOSITION_INFORMATION, SMB2_O_INFO_FILE,
3422                 0, 1, &data, &size);
3423 }
3424 
3425 int
3426 SMB2_set_hardlink(const unsigned int xid, struct cifs_tcon *tcon,
3427                   u64 persistent_fid, u64 volatile_fid, __le16 *target_file)
3428 {
3429         struct smb2_file_link_info info;
3430         void **data;
3431         unsigned int size[2];
3432         int rc;
3433         int len = (2 * UniStrnlen((wchar_t *)target_file, PATH_MAX));
3434 
3435         data = kmalloc(sizeof(void *) * 2, GFP_KERNEL);
3436         if (!data)
3437                 return -ENOMEM;
3438 
3439         info.ReplaceIfExists = 0; /* 1 = replace existing link with new */
3440                               /* 0 = fail if link already exists */
3441         info.RootDirectory = 0;  /* MBZ for network ops (why does spec say?) */
3442         info.FileNameLength = cpu_to_le32(len);
3443 
3444         data[0] = &info;
3445         size[0] = sizeof(struct smb2_file_link_info);
3446 
3447         data[1] = target_file;
3448         size[1] = len + 2 /* null */;
3449 
3450         rc = send_set_info(xid, tcon, persistent_fid, volatile_fid,
3451                         current->tgid, FILE_LINK_INFORMATION, SMB2_O_INFO_FILE,
3452                         0, 2, data, size);
3453         kfree(data);
3454         return rc;
3455 }
3456 
3457 int
3458 SMB2_set_eof(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid,
3459              u64 volatile_fid, u32 pid, __le64 *eof, bool is_falloc)
3460 {
3461         struct smb2_file_eof_info info;
3462         void *data;
3463         unsigned int size;
3464 
3465         info.EndOfFile = *eof;
3466 
3467         data = &info;
3468         size = sizeof(struct smb2_file_eof_info);
3469 
3470         if (is_falloc)
3471                 return send_set_info(xid, tcon, persistent_fid, volatile_fid,
3472                         pid, FILE_ALLOCATION_INFORMATION, SMB2_O_INFO_FILE,
3473                         0, 1, &data, &size);
3474         else
3475                 return send_set_info(xid, tcon, persistent_fid, volatile_fid,
3476                         pid, FILE_END_OF_FILE_INFORMATION, SMB2_O_INFO_FILE,
3477                         0, 1, &data, &size);
3478 }
3479 
3480 int
3481 SMB2_set_info(const unsigned int xid, struct cifs_tcon *tcon,
3482               u64 persistent_fid, u64 volatile_fid, FILE_BASIC_INFO *buf)
3483 {
3484         unsigned int size;
3485         size = sizeof(FILE_BASIC_INFO);
3486         return send_set_info(xid, tcon, persistent_fid, volatile_fid,
3487                 current->tgid, FILE_BASIC_INFORMATION, SMB2_O_INFO_FILE,
3488                 0, 1, (void **)&buf, &size);
3489 }
3490 
3491 int
3492 SMB2_set_acl(const unsigned int xid, struct cifs_tcon *tcon,
3493                 u64 persistent_fid, u64 volatile_fid,
3494                 struct cifs_ntsd *pnntsd, int pacllen, int aclflag)
3495 {
3496         return send_set_info(xid, tcon, persistent_fid, volatile_fid,
3497                         current->tgid, 0, SMB2_O_INFO_SECURITY, aclflag,
3498                         1, (void **)&pnntsd, &pacllen);
3499 }
3500 
3501 int
3502 SMB2_set_ea(const unsigned int xid, struct cifs_tcon *tcon,
3503             u64 persistent_fid, u64 volatile_fid,
3504             struct smb2_file_full_ea_info *buf, int len)
3505 {
3506         return send_set_info(xid, tcon, persistent_fid, volatile_fid,
3507                 current->tgid, FILE_FULL_EA_INFORMATION, SMB2_O_INFO_FILE,
3508                 0, 1, (void **)&buf, &len);
3509 }
3510 
3511 int
3512 SMB2_oplock_break(const unsigned int xid, struct cifs_tcon *tcon,
3513                   const u64 persistent_fid, const u64 volatile_fid,
3514                   __u8 oplock_level)
3515 {
3516         int rc;
3517         struct smb2_oplock_break_req *req = NULL;
3518         struct cifs_ses *ses = tcon->ses;
3519         int flags = CIFS_OBREAK_OP;
3520         unsigned int total_len;
3521         struct kvec iov[1];
3522         struct kvec rsp_iov;
3523         int resp_buf_type;
3524 
3525         cifs_dbg(FYI, "SMB2_oplock_break\n");
3526         rc = smb2_plain_req_init(SMB2_OPLOCK_BREAK, tcon, (void **) &req,
3527                              &total_len);
3528         if (rc)
3529                 return rc;
3530 
3531         if (encryption_required(tcon))
3532                 flags |= CIFS_TRANSFORM_REQ;
3533 
3534         req->VolatileFid = volatile_fid;
3535         req->PersistentFid = persistent_fid;
3536         req->OplockLevel = oplock_level;
3537         req->sync_hdr.CreditRequest = cpu_to_le16(1);
3538 
3539         flags |= CIFS_NO_RESP;
3540 
3541         iov[0].iov_base = (char *)req;
3542         iov[0].iov_len = total_len;
3543 
3544         rc = smb2_send_recv(xid, ses, iov, 1, &resp_buf_type, flags, &rsp_iov);
3545         cifs_small_buf_release(req);
3546 
3547         if (rc) {
3548                 cifs_stats_fail_inc(tcon, SMB2_OPLOCK_BREAK_HE);
3549                 cifs_dbg(FYI, "Send error in Oplock Break = %d\n", rc);
3550         }
3551 
3552         return rc;
3553 }
3554 
3555 static void
3556 copy_fs_info_to_kstatfs(struct smb2_fs_full_size_info *pfs_inf,
3557                         struct kstatfs *kst)
3558 {
3559         kst->f_bsize = le32_to_cpu(pfs_inf->BytesPerSector) *
3560                           le32_to_cpu(pfs_inf->SectorsPerAllocationUnit);
3561         kst->f_blocks = le64_to_cpu(pfs_inf->TotalAllocationUnits);
3562         kst->f_bfree  = kst->f_bavail =
3563                         le64_to_cpu(pfs_inf->CallerAvailableAllocationUnits);
3564         return;
3565 }
3566 
3567 static int
3568 build_qfs_info_req(struct kvec *iov, struct cifs_tcon *tcon, int level,
3569                    int outbuf_len, u64 persistent_fid, u64 volatile_fid)
3570 {
3571         struct TCP_Server_Info *server;
3572         int rc;
3573         struct smb2_query_info_req *req;
3574         unsigned int total_len;
3575 
3576         cifs_dbg(FYI, "Query FSInfo level %d\n", level);
3577 
3578         if ((tcon->ses == NULL) || (tcon->ses->server == NULL))
3579                 return -EIO;
3580 
3581         server = tcon->ses->server;
3582 
3583         rc = smb2_plain_req_init(SMB2_QUERY_INFO, tcon, (void **) &req,
3584                              &total_len);
3585         if (rc)
3586                 return rc;
3587 
3588         req->InfoType = SMB2_O_INFO_FILESYSTEM;
3589         req->FileInfoClass = level;
3590         req->PersistentFileId = persistent_fid;
3591         req->VolatileFileId = volatile_fid;
3592         /* 1 for pad */
3593         req->InputBufferOffset =
3594                         cpu_to_le16(sizeof(struct smb2_query_info_req) - 1);
3595         req->OutputBufferLength = cpu_to_le32(
3596                 outbuf_len + sizeof(struct smb2_query_info_rsp) - 1 - server->vals->header_preamble_size);
3597 
3598         iov->iov_base = (char *)req;
3599         iov->iov_len = total_len;
3600         return 0;
3601 }
3602 
3603 int
3604 SMB2_QFS_info(const unsigned int xid, struct cifs_tcon *tcon,
3605               u64 persistent_fid, u64 volatile_fid, struct kstatfs *fsdata)
3606 {
3607         struct smb2_query_info_rsp *rsp = NULL;
3608         struct kvec iov;
3609         struct kvec rsp_iov;
3610         int rc = 0;
3611         int resp_buftype;
3612         struct cifs_ses *ses = tcon->ses;
3613         struct TCP_Server_Info *server = ses->server;
3614         struct smb2_fs_full_size_info *info = NULL;
3615         int flags = 0;
3616 
3617         rc = build_qfs_info_req(&iov, tcon, FS_FULL_SIZE_INFORMATION,
3618                                 sizeof(struct smb2_fs_full_size_info),
3619                                 persistent_fid, volatile_fid);
3620         if (rc)
3621                 return rc;
3622 
3623         if (encryption_required(tcon))
3624                 flags |= CIFS_TRANSFORM_REQ;
3625 
3626         rc = smb2_send_recv(xid, ses, &iov, 1, &resp_buftype, flags, &rsp_iov);
3627         cifs_small_buf_release(iov.iov_base);
3628         if (rc) {
3629                 cifs_stats_fail_inc(tcon, SMB2_QUERY_INFO_HE);
3630                 goto qfsinf_exit;
3631         }
3632         rsp = (struct smb2_query_info_rsp *)rsp_iov.iov_base;
3633 
3634         info = (struct smb2_fs_full_size_info *)(server->vals->header_preamble_size +
3635                 le16_to_cpu(rsp->OutputBufferOffset) + (char *)&rsp->hdr);
3636         rc = validate_iov(server,
3637                           le16_to_cpu(rsp->OutputBufferOffset),
3638                           le32_to_cpu(rsp->OutputBufferLength), &rsp_iov,
3639                           sizeof(struct smb2_fs_full_size_info));
3640         if (!rc)
3641                 copy_fs_info_to_kstatfs(info, fsdata);
3642 
3643 qfsinf_exit:
3644         free_rsp_buf(resp_buftype, rsp_iov.iov_base);
3645         return rc;
3646 }
3647 
3648 int
3649 SMB2_QFS_attr(const unsigned int xid, struct cifs_tcon *tcon,
3650               u64 persistent_fid, u64 volatile_fid, int level)
3651 {
3652         struct smb2_query_info_rsp *rsp = NULL;
3653         struct kvec iov;
3654         struct kvec rsp_iov;
3655         int rc = 0;
3656         int resp_buftype, max_len, min_len;
3657         struct cifs_ses *ses = tcon->ses;
3658         struct TCP_Server_Info *server = ses->server;
3659         unsigned int rsp_len, offset;
3660         int flags = 0;
3661 
3662         if (level == FS_DEVICE_INFORMATION) {
3663                 max_len = sizeof(FILE_SYSTEM_DEVICE_INFO);
3664                 min_len = sizeof(FILE_SYSTEM_DEVICE_INFO);
3665         } else if (level == FS_ATTRIBUTE_INFORMATION) {
3666                 max_len = sizeof(FILE_SYSTEM_ATTRIBUTE_INFO);
3667                 min_len = MIN_FS_ATTR_INFO_SIZE;
3668         } else if (level == FS_SECTOR_SIZE_INFORMATION) {
3669                 max_len = sizeof(struct smb3_fs_ss_info);
3670                 min_len = sizeof(struct smb3_fs_ss_info);
3671         } else {
3672                 cifs_dbg(FYI, "Invalid qfsinfo level %d\n", level);
3673                 return -EINVAL;
3674         }
3675 
3676         rc = build_qfs_info_req(&iov, tcon, level, max_len,
3677                                 persistent_fid, volatile_fid);
3678         if (rc)
3679                 return rc;
3680 
3681         if (encryption_required(tcon))
3682                 flags |= CIFS_TRANSFORM_REQ;
3683 
3684         rc = smb2_send_recv(xid, ses, &iov, 1, &resp_buftype, flags, &rsp_iov);
3685         cifs_small_buf_release(iov.iov_base);
3686         if (rc) {
3687                 cifs_stats_fail_inc(tcon, SMB2_QUERY_INFO_HE);
3688                 goto qfsattr_exit;
3689         }
3690         rsp = (struct smb2_query_info_rsp *)rsp_iov.iov_base;
3691 
3692         rsp_len = le32_to_cpu(rsp->OutputBufferLength);
3693         offset = le16_to_cpu(rsp->OutputBufferOffset);
3694         rc = validate_iov(server, offset, rsp_len, &rsp_iov, min_len);
3695         if (rc)
3696                 goto qfsattr_exit;
3697 
3698         if (level == FS_ATTRIBUTE_INFORMATION)
3699                 memcpy(&tcon->fsAttrInfo, server->vals->header_preamble_size + offset
3700                         + (char *)&rsp->hdr, min_t(unsigned int,
3701                         rsp_len, max_len));
3702         else if (level == FS_DEVICE_INFORMATION)
3703                 memcpy(&tcon->fsDevInfo, server->vals->header_preamble_size + offset
3704                         + (char *)&rsp->hdr, sizeof(FILE_SYSTEM_DEVICE_INFO));
3705         else if (level == FS_SECTOR_SIZE_INFORMATION) {
3706                 struct smb3_fs_ss_info *ss_info = (struct smb3_fs_ss_info *)
3707                         (server->vals->header_preamble_size + offset + (char *)&rsp->hdr);
3708                 tcon->ss_flags = le32_to_cpu(ss_info->Flags);
3709                 tcon->perf_sector_size =
3710                         le32_to_cpu(ss_info->PhysicalBytesPerSectorForPerf);
3711         }
3712 
3713 qfsattr_exit:
3714         free_rsp_buf(resp_buftype, rsp_iov.iov_base);
3715         return rc;
3716 }
3717 
3718 int
3719 smb2_lockv(const unsigned int xid, struct cifs_tcon *tcon,
3720            const __u64 persist_fid, const __u64 volatile_fid, const __u32 pid,
3721            const __u32 num_lock, struct smb2_lock_element *buf)
3722 {
3723         int rc = 0;
3724         struct smb2_lock_req *req = NULL;
3725         struct kvec iov[2];
3726         struct kvec rsp_iov;
3727         int resp_buf_type;
3728         unsigned int count;
3729         int flags = CIFS_NO_RESP;
3730         unsigned int total_len;
3731 
3732         cifs_dbg(FYI, "smb2_lockv num lock %d\n", num_lock);
3733 
3734         rc = smb2_plain_req_init(SMB2_LOCK, tcon, (void **) &req, &total_len);
3735         if (rc)
3736                 return rc;
3737 
3738         if (encryption_required(tcon))
3739                 flags |= CIFS_TRANSFORM_REQ;
3740 
3741         req->sync_hdr.ProcessId = cpu_to_le32(pid);
3742         req->LockCount = cpu_to_le16(num_lock);
3743 
3744         req->PersistentFileId = persist_fid;
3745         req->VolatileFileId = volatile_fid;
3746 
3747         count = num_lock * sizeof(struct smb2_lock_element);
3748 
3749         iov[0].iov_base = (char *)req;
3750         iov[0].iov_len = total_len - sizeof(struct smb2_lock_element);
3751         iov[1].iov_base = (char *)buf;
3752         iov[1].iov_len = count;
3753 
3754         cifs_stats_inc(&tcon->stats.cifs_stats.num_locks);
3755         rc = smb2_send_recv(xid, tcon->ses, iov, 2, &resp_buf_type, flags,
3756                             &rsp_iov);
3757         cifs_small_buf_release(req);
3758         if (rc) {
3759                 cifs_dbg(FYI, "Send error in smb2_lockv = %d\n", rc);
3760                 cifs_stats_fail_inc(tcon, SMB2_LOCK_HE);
3761         }
3762 
3763         return rc;
3764 }
3765 
3766 int
3767 SMB2_lock(const unsigned int xid, struct cifs_tcon *tcon,
3768           const __u64 persist_fid, const __u64 volatile_fid, const __u32 pid,
3769           const __u64 length, const __u64 offset, const __u32 lock_flags,
3770           const bool wait)
3771 {
3772         struct smb2_lock_element lock;
3773 
3774         lock.Offset = cpu_to_le64(offset);
3775         lock.Length = cpu_to_le64(length);
3776         lock.Flags = cpu_to_le32(lock_flags);
3777         if (!wait && lock_flags != SMB2_LOCKFLAG_UNLOCK)
3778                 lock.Flags |= cpu_to_le32(SMB2_LOCKFLAG_FAIL_IMMEDIATELY);
3779 
3780         return smb2_lockv(xid, tcon, persist_fid, volatile_fid, pid, 1, &lock);
3781 }
3782 
3783 int
3784 SMB2_lease_break(const unsigned int xid, struct cifs_tcon *tcon,
3785                  __u8 *lease_key, const __le32 lease_state)
3786 {
3787         int rc;
3788         struct smb2_lease_ack *req = NULL;
3789         struct cifs_ses *ses = tcon->ses;
3790         int flags = CIFS_OBREAK_OP;
3791         unsigned int total_len;
3792         struct kvec iov[1];
3793         struct kvec rsp_iov;
3794         int resp_buf_type;
3795 
3796         cifs_dbg(FYI, "SMB2_lease_break\n");
3797         rc = smb2_plain_req_init(SMB2_OPLOCK_BREAK, tcon, (void **) &req,
3798                              &total_len);
3799         if (rc)
3800                 return rc;
3801 
3802         if (encryption_required(tcon))
3803                 flags |= CIFS_TRANSFORM_REQ;
3804 
3805         req->sync_hdr.CreditRequest = cpu_to_le16(1);
3806         req->StructureSize = cpu_to_le16(36);
3807         total_len += 12;
3808 
3809         memcpy(req->LeaseKey, lease_key, 16);
3810         req->LeaseState = lease_state;
3811 
3812         flags |= CIFS_NO_RESP;
3813 
3814         iov[0].iov_base = (char *)req;
3815         iov[0].iov_len = total_len;
3816 
3817         rc = smb2_send_recv(xid, ses, iov, 1, &resp_buf_type, flags, &rsp_iov);
3818         cifs_small_buf_release(req);
3819 
3820         if (rc) {
3821                 cifs_stats_fail_inc(tcon, SMB2_OPLOCK_BREAK_HE);
3822                 cifs_dbg(FYI, "Send error in Lease Break = %d\n", rc);
3823         }
3824 
3825         return rc;
3826 }
3827 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp