fs/cifs/smb1ops.c - kernel/msm-4.9 - Gitiles

 /*
  *  SMB1 (CIFS) version specific operations
  *
  *  Copyright (c) 2012, Jeff Layton <jlayton@redhat.com>
  *
  *  This library is free software; you can redistribute it and/or modify
  *  it under the terms of the GNU General Public License v2 as published
  *  by the Free Software Foundation.
  *
  *  This library is distributed in the hope that it will be useful,
  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See
  *  the GNU Lesser General Public License for more details.
  *
  *  You should have received a copy of the GNU Lesser General Public License
  *  along with this library; if not, write to the Free Software
  *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
  */

 #include "cifsglob.h"
 #include "cifsproto.h"
 #include "cifs_debug.h"
 #include "cifspdu.h"

 /*
  * An NT cancel request header looks just like the original request except:
  *
  * The Command is SMB_COM_NT_CANCEL
  * The WordCount is zeroed out
  * The ByteCount is zeroed out
  *
  * This function mangles an existing request buffer into a
  * SMB_COM_NT_CANCEL request and then sends it.
  */
 static int
 send_nt_cancel(struct TCP_Server_Info *server, void *buf,
 	       struct mid_q_entry *mid)
 {
 	int rc = 0;
 	struct smb_hdr *in_buf = (struct smb_hdr *)buf;

 	/* -4 for RFC1001 length and +2 for BCC field */
 	in_buf->smb_buf_length = cpu_to_be32(sizeof(struct smb_hdr) - 4  + 2);
 	in_buf->Command = SMB_COM_NT_CANCEL;
 	in_buf->WordCount = 0;
 	put_bcc(0, in_buf);

 	mutex_lock(&server->srv_mutex);
 	rc = cifs_sign_smb(in_buf, server, &mid->sequence_number);
 	if (rc) {
 		mutex_unlock(&server->srv_mutex);
 		return rc;
 	}
 	rc = smb_send(server, in_buf, be32_to_cpu(in_buf->smb_buf_length));
 	mutex_unlock(&server->srv_mutex);

 	cFYI(1, "issued NT_CANCEL for mid %u, rc = %d",
 		in_buf->Mid, rc);

 	return rc;
 }

 static bool
 cifs_compare_fids(struct cifsFileInfo *ob1, struct cifsFileInfo *ob2)
 {
 	return ob1->netfid == ob2->netfid;
 }

 static unsigned int
 cifs_read_data_offset(char *buf)
 {
 	READ_RSP *rsp = (READ_RSP *)buf;
 	return le16_to_cpu(rsp->DataOffset);
 }

 static unsigned int
 cifs_read_data_length(char *buf)
 {
 	READ_RSP *rsp = (READ_RSP *)buf;
 	return (le16_to_cpu(rsp->DataLengthHigh) << 16) +
 	       le16_to_cpu(rsp->DataLength);
 }

 static struct mid_q_entry *
 cifs_find_mid(struct TCP_Server_Info *server, char *buffer)
 {
 	struct smb_hdr *buf = (struct smb_hdr *)buffer;
 	struct mid_q_entry *mid;

 	spin_lock(&GlobalMid_Lock);
 	list_for_each_entry(mid, &server->pending_mid_q, qhead) {
 		if (mid->mid == buf->Mid &&
 		    mid->mid_state == MID_REQUEST_SUBMITTED &&
 		    le16_to_cpu(mid->command) == buf->Command) {
 			spin_unlock(&GlobalMid_Lock);
 			return mid;
 		}
 	}
 	spin_unlock(&GlobalMid_Lock);
 	return NULL;
 }

 static void
 cifs_add_credits(struct TCP_Server_Info *server, const unsigned int add,
 		 const int optype)
 {
 	spin_lock(&server->req_lock);
 	server->credits += add;
 	server->in_flight--;
 	spin_unlock(&server->req_lock);
 	wake_up(&server->request_q);
 }

 static void
 cifs_set_credits(struct TCP_Server_Info *server, const int val)
 {
 	spin_lock(&server->req_lock);
 	server->credits = val;
 	server->oplocks = val > 1 ? enable_oplocks : false;
 	spin_unlock(&server->req_lock);
 }

 static int *
 cifs_get_credits_field(struct TCP_Server_Info *server, const int optype)
 {
 	return &server->credits;
 }

 static unsigned int
 cifs_get_credits(struct mid_q_entry *mid)
 {
 	return 1;
 }

 /*
  * Find a free multiplex id (SMB mid). Otherwise there could be
  * mid collisions which might cause problems, demultiplexing the
  * wrong response to this request. Multiplex ids could collide if
  * one of a series requests takes much longer than the others, or
  * if a very large number of long lived requests (byte range
  * locks or FindNotify requests) are pending. No more than
  * 64K-1 requests can be outstanding at one time. If no
  * mids are available, return zero. A future optimization
  * could make the combination of mids and uid the key we use
  * to demultiplex on (rather than mid alone).
  * In addition to the above check, the cifs demultiplex
  * code already used the command code as a secondary
  * check of the frame and if signing is negotiated the
  * response would be discarded if the mid were the same
  * but the signature was wrong. Since the mid is not put in the
  * pending queue until later (when it is about to be dispatched)
  * we do have to limit the number of outstanding requests
  * to somewhat less than 64K-1 although it is hard to imagine
  * so many threads being in the vfs at one time.
  */
 static __u64
 cifs_get_next_mid(struct TCP_Server_Info *server)
 {
 	__u64 mid = 0;
 	__u16 last_mid, cur_mid;
 	bool collision;

 	spin_lock(&GlobalMid_Lock);

 	/* mid is 16 bit only for CIFS/SMB */
 	cur_mid = (__u16)((server->CurrentMid) & 0xffff);
 	/* we do not want to loop forever */
 	last_mid = cur_mid;
 	cur_mid++;

 	/*
 	 * This nested loop looks more expensive than it is.
 	 * In practice the list of pending requests is short,
 	 * fewer than 50, and the mids are likely to be unique
 	 * on the first pass through the loop unless some request
 	 * takes longer than the 64 thousand requests before it
 	 * (and it would also have to have been a request that
 	 * did not time out).
 	 */
 	while (cur_mid != last_mid) {
 		struct mid_q_entry *mid_entry;
 		unsigned int num_mids;

 		collision = false;
 		if (cur_mid == 0)
 			cur_mid++;

 		num_mids = 0;
 		list_for_each_entry(mid_entry, &server->pending_mid_q, qhead) {
 			++num_mids;
 			if (mid_entry->mid == cur_mid &&
 			    mid_entry->mid_state == MID_REQUEST_SUBMITTED) {
 				/* This mid is in use, try a different one */
 				collision = true;
 				break;
 			}
 		}

 		/*
 		 * if we have more than 32k mids in the list, then something
 		 * is very wrong. Possibly a local user is trying to DoS the
 		 * box by issuing long-running calls and SIGKILL'ing them. If
 		 * we get to 2^16 mids then we're in big trouble as this
 		 * function could loop forever.
 		 *
 		 * Go ahead and assign out the mid in this situation, but force
 		 * an eventual reconnect to clean out the pending_mid_q.
 		 */
 		if (num_mids > 32768)
 			server->tcpStatus = CifsNeedReconnect;

 		if (!collision) {
 			mid = (__u64)cur_mid;
 			server->CurrentMid = mid;
 			break;
 		}
 		cur_mid++;
 	}
 	spin_unlock(&GlobalMid_Lock);
 	return mid;
 }

 /*
 	return codes:
 		0	not a transact2, or all data present
 		>0	transact2 with that much data missing
 		-EINVAL	invalid transact2
  */
 static int
 check2ndT2(char *buf)
 {
 	struct smb_hdr *pSMB = (struct smb_hdr *)buf;
 	struct smb_t2_rsp *pSMBt;
 	int remaining;
 	__u16 total_data_size, data_in_this_rsp;

 	if (pSMB->Command != SMB_COM_TRANSACTION2)
 		return 0;

 	/* check for plausible wct, bcc and t2 data and parm sizes */
 	/* check for parm and data offset going beyond end of smb */
 	if (pSMB->WordCount != 10) { /* coalesce_t2 depends on this */
 		cFYI(1, "invalid transact2 word count");
 		return -EINVAL;
 	}

 	pSMBt = (struct smb_t2_rsp *)pSMB;

 	total_data_size = get_unaligned_le16(&pSMBt->t2_rsp.TotalDataCount);
 	data_in_this_rsp = get_unaligned_le16(&pSMBt->t2_rsp.DataCount);

 	if (total_data_size == data_in_this_rsp)
 		return 0;
 	else if (total_data_size < data_in_this_rsp) {
 		cFYI(1, "total data %d smaller than data in frame %d",
 			total_data_size, data_in_this_rsp);
 		return -EINVAL;
 	}

 	remaining = total_data_size - data_in_this_rsp;

 	cFYI(1, "missing %d bytes from transact2, check next response",
 		remaining);
 	if (total_data_size > CIFSMaxBufSize) {
 		cERROR(1, "TotalDataSize %d is over maximum buffer %d",
 			total_data_size, CIFSMaxBufSize);
 		return -EINVAL;
 	}
 	return remaining;
 }

 static int
 coalesce_t2(char *second_buf, struct smb_hdr *target_hdr)
 {
 	struct smb_t2_rsp *pSMBs = (struct smb_t2_rsp *)second_buf;
 	struct smb_t2_rsp *pSMBt  = (struct smb_t2_rsp *)target_hdr;
 	char *data_area_of_tgt;
 	char *data_area_of_src;
 	int remaining;
 	unsigned int byte_count, total_in_tgt;
 	__u16 tgt_total_cnt, src_total_cnt, total_in_src;

 	src_total_cnt = get_unaligned_le16(&pSMBs->t2_rsp.TotalDataCount);
 	tgt_total_cnt = get_unaligned_le16(&pSMBt->t2_rsp.TotalDataCount);

 	if (tgt_total_cnt != src_total_cnt)
 		cFYI(1, "total data count of primary and secondary t2 differ "
 			"source=%hu target=%hu", src_total_cnt, tgt_total_cnt);

 	total_in_tgt = get_unaligned_le16(&pSMBt->t2_rsp.DataCount);

 	remaining = tgt_total_cnt - total_in_tgt;

 	if (remaining < 0) {
 		cFYI(1, "Server sent too much data. tgt_total_cnt=%hu "
 			"total_in_tgt=%hu", tgt_total_cnt, total_in_tgt);
 		return -EPROTO;
 	}

 	if (remaining == 0) {
 		/* nothing to do, ignore */
 		cFYI(1, "no more data remains");
 		return 0;
 	}

 	total_in_src = get_unaligned_le16(&pSMBs->t2_rsp.DataCount);
 	if (remaining < total_in_src)
 		cFYI(1, "transact2 2nd response contains too much data");

 	/* find end of first SMB data area */
 	data_area_of_tgt = (char *)&pSMBt->hdr.Protocol +
 				get_unaligned_le16(&pSMBt->t2_rsp.DataOffset);

 	/* validate target area */
 	data_area_of_src = (char *)&pSMBs->hdr.Protocol +
 				get_unaligned_le16(&pSMBs->t2_rsp.DataOffset);

 	data_area_of_tgt += total_in_tgt;

 	total_in_tgt += total_in_src;
 	/* is the result too big for the field? */
 	if (total_in_tgt > USHRT_MAX) {
 		cFYI(1, "coalesced DataCount too large (%u)", total_in_tgt);
 		return -EPROTO;
 	}
 	put_unaligned_le16(total_in_tgt, &pSMBt->t2_rsp.DataCount);

 	/* fix up the BCC */
 	byte_count = get_bcc(target_hdr);
 	byte_count += total_in_src;
 	/* is the result too big for the field? */
 	if (byte_count > USHRT_MAX) {
 		cFYI(1, "coalesced BCC too large (%u)", byte_count);
 		return -EPROTO;
 	}
 	put_bcc(byte_count, target_hdr);

 	byte_count = be32_to_cpu(target_hdr->smb_buf_length);
 	byte_count += total_in_src;
 	/* don't allow buffer to overflow */
 	if (byte_count > CIFSMaxBufSize + MAX_CIFS_HDR_SIZE - 4) {
 		cFYI(1, "coalesced BCC exceeds buffer size (%u)", byte_count);
 		return -ENOBUFS;
 	}
 	target_hdr->smb_buf_length = cpu_to_be32(byte_count);

 	/* copy second buffer into end of first buffer */
 	memcpy(data_area_of_tgt, data_area_of_src, total_in_src);

 	if (remaining != total_in_src) {
 		/* more responses to go */
 		cFYI(1, "waiting for more secondary responses");
 		return 1;
 	}

 	/* we are done */
 	cFYI(1, "found the last secondary response");
 	return 0;
 }

 static bool
 cifs_check_trans2(struct mid_q_entry *mid, struct TCP_Server_Info *server,
 		  char *buf, int malformed)
 {
 	if (malformed)
 		return false;
 	if (check2ndT2(buf) <= 0)
 		return false;
 	mid->multiRsp = true;
 	if (mid->resp_buf) {
 		/* merge response - fix up 1st*/
 		malformed = coalesce_t2(buf, mid->resp_buf);
 		if (malformed > 0)
 			return true;
 		/* All parts received or packet is malformed. */
 		mid->multiEnd = true;
 		dequeue_mid(mid, malformed);
 		return true;
 	}
 	if (!server->large_buf) {
 		/*FIXME: switch to already allocated largebuf?*/
 		cERROR(1, "1st trans2 resp needs bigbuf");
 	} else {
 		/* Have first buffer */
 		mid->resp_buf = buf;
 		mid->large_buf = true;
 		server->bigbuf = NULL;
 	}
 	return true;
 }

 static bool
 cifs_need_neg(struct TCP_Server_Info *server)
 {
 	return server->maxBuf == 0;
 }

 static int
 cifs_negotiate(const unsigned int xid, struct cifs_ses *ses)
 {
 	int rc;
 	rc = CIFSSMBNegotiate(xid, ses);
 	if (rc == -EAGAIN) {
 		/* retry only once on 1st time connection */
 		set_credits(ses->server, 1);
 		rc = CIFSSMBNegotiate(xid, ses);
 		if (rc == -EAGAIN)
 			rc = -EHOSTDOWN;
 	}
 	return rc;
 }

 struct smb_version_operations smb1_operations = {
 	.send_cancel = send_nt_cancel,
 	.compare_fids = cifs_compare_fids,
 	.setup_request = cifs_setup_request,
 	.check_receive = cifs_check_receive,
 	.add_credits = cifs_add_credits,
 	.set_credits = cifs_set_credits,
 	.get_credits_field = cifs_get_credits_field,
 	.get_credits = cifs_get_credits,
 	.get_next_mid = cifs_get_next_mid,
 	.read_data_offset = cifs_read_data_offset,
 	.read_data_length = cifs_read_data_length,
 	.map_error = map_smb_to_linux_error,
 	.find_mid = cifs_find_mid,
 	.check_message = checkSMB,
 	.dump_detail = cifs_dump_detail,
 	.is_oplock_break = is_valid_oplock_break,
 	.check_trans2 = cifs_check_trans2,
 	.need_neg = cifs_need_neg,
 	.negotiate = cifs_negotiate,
 };

 struct smb_version_values smb1_values = {
 	.version_string = SMB1_VERSION_STRING,
 	.large_lock_type = LOCKING_ANDX_LARGE_FILES,
 	.exclusive_lock_type = 0,
 	.shared_lock_type = LOCKING_ANDX_SHARED_LOCK,
 	.unlock_lock_type = 0,
 	.header_size = sizeof(struct smb_hdr),
 	.max_header_size = MAX_CIFS_HDR_SIZE,
 	.read_rsp_size = sizeof(READ_RSP),
 };
	/*
	* SMB1 (CIFS) version specific operations
	*
	* Copyright (c) 2012, Jeff Layton <jlayton@redhat.com>
	*
	* This library is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License v2 as published
	* by the Free Software Foundation.
	*
	* This library is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See
	* the GNU Lesser General Public License for more details.
	*
	* You should have received a copy of the GNU Lesser General Public License
	* along with this library; if not, write to the Free Software
	* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
	*/

	#include "cifsglob.h"
	#include "cifsproto.h"
	#include "cifs_debug.h"
	#include "cifspdu.h"

	/*
	* An NT cancel request header looks just like the original request except:
	*
	* The Command is SMB_COM_NT_CANCEL
	* The WordCount is zeroed out
	* The ByteCount is zeroed out
	*
	* This function mangles an existing request buffer into a
	* SMB_COM_NT_CANCEL request and then sends it.
	*/
	static int
	send_nt_cancel(struct TCP_Server_Info server, void buf,
	struct mid_q_entry *mid)
	{
	int rc = 0;
	struct smb_hdr in_buf = (struct smb_hdr )buf;

	/* -4 for RFC1001 length and +2 for BCC field */
	in_buf->smb_buf_length = cpu_to_be32(sizeof(struct smb_hdr) - 4 + 2);
	in_buf->Command = SMB_COM_NT_CANCEL;
	in_buf->WordCount = 0;
	put_bcc(0, in_buf);

	mutex_lock(&server->srv_mutex);
	rc = cifs_sign_smb(in_buf, server, &mid->sequence_number);
	if (rc) {
	mutex_unlock(&server->srv_mutex);
	return rc;
	}
	rc = smb_send(server, in_buf, be32_to_cpu(in_buf->smb_buf_length));
	mutex_unlock(&server->srv_mutex);

	cFYI(1, "issued NT_CANCEL for mid %u, rc = %d",
	in_buf->Mid, rc);

	return rc;
	}

	static bool
	cifs_compare_fids(struct cifsFileInfo ob1, struct cifsFileInfo ob2)
	{
	return ob1->netfid == ob2->netfid;
	}

	static unsigned int
	cifs_read_data_offset(char *buf)
	{
	READ_RSP rsp = (READ_RSP )buf;
	return le16_to_cpu(rsp->DataOffset);
	}

	static unsigned int
	cifs_read_data_length(char *buf)
	{
	READ_RSP rsp = (READ_RSP )buf;
	return (le16_to_cpu(rsp->DataLengthHigh) << 16) +
	le16_to_cpu(rsp->DataLength);
	}

	static struct mid_q_entry *
	cifs_find_mid(struct TCP_Server_Info server, char buffer)
	{
	struct smb_hdr buf = (struct smb_hdr )buffer;
	struct mid_q_entry *mid;

	spin_lock(&GlobalMid_Lock);
	list_for_each_entry(mid, &server->pending_mid_q, qhead) {
	if (mid->mid == buf->Mid &&
	mid->mid_state == MID_REQUEST_SUBMITTED &&
	le16_to_cpu(mid->command) == buf->Command) {
	spin_unlock(&GlobalMid_Lock);
	return mid;
	}
	}
	spin_unlock(&GlobalMid_Lock);
	return NULL;
	}

	static void
	cifs_add_credits(struct TCP_Server_Info *server, const unsigned int add,
	const int optype)
	{
	spin_lock(&server->req_lock);
	server->credits += add;
	server->in_flight--;
	spin_unlock(&server->req_lock);
	wake_up(&server->request_q);
	}

	static void
	cifs_set_credits(struct TCP_Server_Info *server, const int val)
	{
	spin_lock(&server->req_lock);
	server->credits = val;
	server->oplocks = val > 1 ? enable_oplocks : false;
	spin_unlock(&server->req_lock);
	}

	static int *
	cifs_get_credits_field(struct TCP_Server_Info *server, const int optype)
	{
	return &server->credits;
	}

	static unsigned int
	cifs_get_credits(struct mid_q_entry *mid)
	{
	return 1;
	}

	/*
	* Find a free multiplex id (SMB mid). Otherwise there could be
	* mid collisions which might cause problems, demultiplexing the
	* wrong response to this request. Multiplex ids could collide if
	* one of a series requests takes much longer than the others, or
	* if a very large number of long lived requests (byte range
	* locks or FindNotify requests) are pending. No more than
	* 64K-1 requests can be outstanding at one time. If no
	* mids are available, return zero. A future optimization
	* could make the combination of mids and uid the key we use
	* to demultiplex on (rather than mid alone).
	* In addition to the above check, the cifs demultiplex
	* code already used the command code as a secondary
	* check of the frame and if signing is negotiated the
	* response would be discarded if the mid were the same
	* but the signature was wrong. Since the mid is not put in the
	* pending queue until later (when it is about to be dispatched)
	* we do have to limit the number of outstanding requests
	* to somewhat less than 64K-1 although it is hard to imagine
	* so many threads being in the vfs at one time.
	*/
	static __u64
	cifs_get_next_mid(struct TCP_Server_Info *server)
	{
	__u64 mid = 0;
	__u16 last_mid, cur_mid;
	bool collision;

	spin_lock(&GlobalMid_Lock);

	/* mid is 16 bit only for CIFS/SMB */
	cur_mid = (__u16)((server->CurrentMid) & 0xffff);
	/* we do not want to loop forever */
	last_mid = cur_mid;
	cur_mid++;

	/*
	* This nested loop looks more expensive than it is.
	* In practice the list of pending requests is short,
	* fewer than 50, and the mids are likely to be unique
	* on the first pass through the loop unless some request
	* takes longer than the 64 thousand requests before it
	* (and it would also have to have been a request that
	* did not time out).
	*/
	while (cur_mid != last_mid) {
	struct mid_q_entry *mid_entry;
	unsigned int num_mids;

	collision = false;
	if (cur_mid == 0)
	cur_mid++;

	num_mids = 0;
	list_for_each_entry(mid_entry, &server->pending_mid_q, qhead) {
	++num_mids;
	if (mid_entry->mid == cur_mid &&
	mid_entry->mid_state == MID_REQUEST_SUBMITTED) {
	/* This mid is in use, try a different one */
	collision = true;
	break;
	}
	}

	/*
	* if we have more than 32k mids in the list, then something
	* is very wrong. Possibly a local user is trying to DoS the
	* box by issuing long-running calls and SIGKILL'ing them. If
	* we get to 2^16 mids then we're in big trouble as this
	* function could loop forever.
	*
	* Go ahead and assign out the mid in this situation, but force
	* an eventual reconnect to clean out the pending_mid_q.
	*/
	if (num_mids > 32768)
	server->tcpStatus = CifsNeedReconnect;

	if (!collision) {
	mid = (__u64)cur_mid;
	server->CurrentMid = mid;
	break;
	}
	cur_mid++;
	}
	spin_unlock(&GlobalMid_Lock);
	return mid;
	}

	/*
	return codes:
	0 not a transact2, or all data present
	>0 transact2 with that much data missing
	-EINVAL invalid transact2
	*/
	static int
	check2ndT2(char *buf)
	{
	struct smb_hdr pSMB = (struct smb_hdr )buf;
	struct smb_t2_rsp *pSMBt;
	int remaining;
	__u16 total_data_size, data_in_this_rsp;

	if (pSMB->Command != SMB_COM_TRANSACTION2)
	return 0;

	/* check for plausible wct, bcc and t2 data and parm sizes */
	/* check for parm and data offset going beyond end of smb */
	if (pSMB->WordCount != 10) { /* coalesce_t2 depends on this */
	cFYI(1, "invalid transact2 word count");
	return -EINVAL;
	}

	pSMBt = (struct smb_t2_rsp *)pSMB;

	total_data_size = get_unaligned_le16(&pSMBt->t2_rsp.TotalDataCount);
	data_in_this_rsp = get_unaligned_le16(&pSMBt->t2_rsp.DataCount);

	if (total_data_size == data_in_this_rsp)
	return 0;
	else if (total_data_size < data_in_this_rsp) {
	cFYI(1, "total data %d smaller than data in frame %d",
	total_data_size, data_in_this_rsp);
	return -EINVAL;
	}

	remaining = total_data_size - data_in_this_rsp;

	cFYI(1, "missing %d bytes from transact2, check next response",
	remaining);
	if (total_data_size > CIFSMaxBufSize) {
	cERROR(1, "TotalDataSize %d is over maximum buffer %d",
	total_data_size, CIFSMaxBufSize);
	return -EINVAL;
	}
	return remaining;
	}

	static int
	coalesce_t2(char second_buf, struct smb_hdr target_hdr)
	{
	struct smb_t2_rsp pSMBs = (struct smb_t2_rsp )second_buf;
	struct smb_t2_rsp pSMBt = (struct smb_t2_rsp )target_hdr;
	char *data_area_of_tgt;
	char *data_area_of_src;
	int remaining;
	unsigned int byte_count, total_in_tgt;
	__u16 tgt_total_cnt, src_total_cnt, total_in_src;

	src_total_cnt = get_unaligned_le16(&pSMBs->t2_rsp.TotalDataCount);
	tgt_total_cnt = get_unaligned_le16(&pSMBt->t2_rsp.TotalDataCount);

	if (tgt_total_cnt != src_total_cnt)
	cFYI(1, "total data count of primary and secondary t2 differ "
	"source=%hu target=%hu", src_total_cnt, tgt_total_cnt);

	total_in_tgt = get_unaligned_le16(&pSMBt->t2_rsp.DataCount);

	remaining = tgt_total_cnt - total_in_tgt;

	if (remaining < 0) {
	cFYI(1, "Server sent too much data. tgt_total_cnt=%hu "
	"total_in_tgt=%hu", tgt_total_cnt, total_in_tgt);
	return -EPROTO;
	}

	if (remaining == 0) {
	/* nothing to do, ignore */
	cFYI(1, "no more data remains");
	return 0;
	}

	total_in_src = get_unaligned_le16(&pSMBs->t2_rsp.DataCount);
	if (remaining < total_in_src)
	cFYI(1, "transact2 2nd response contains too much data");

	/* find end of first SMB data area */
	data_area_of_tgt = (char *)&pSMBt->hdr.Protocol +
	get_unaligned_le16(&pSMBt->t2_rsp.DataOffset);

	/* validate target area */
	data_area_of_src = (char *)&pSMBs->hdr.Protocol +
	get_unaligned_le16(&pSMBs->t2_rsp.DataOffset);

	data_area_of_tgt += total_in_tgt;

	total_in_tgt += total_in_src;
	/* is the result too big for the field? */
	if (total_in_tgt > USHRT_MAX) {
	cFYI(1, "coalesced DataCount too large (%u)", total_in_tgt);
	return -EPROTO;
	}
	put_unaligned_le16(total_in_tgt, &pSMBt->t2_rsp.DataCount);

	/* fix up the BCC */
	byte_count = get_bcc(target_hdr);
	byte_count += total_in_src;
	/* is the result too big for the field? */
	if (byte_count > USHRT_MAX) {
	cFYI(1, "coalesced BCC too large (%u)", byte_count);
	return -EPROTO;
	}
	put_bcc(byte_count, target_hdr);

	byte_count = be32_to_cpu(target_hdr->smb_buf_length);
	byte_count += total_in_src;
	/* don't allow buffer to overflow */
	if (byte_count > CIFSMaxBufSize + MAX_CIFS_HDR_SIZE - 4) {
	cFYI(1, "coalesced BCC exceeds buffer size (%u)", byte_count);
	return -ENOBUFS;
	}
	target_hdr->smb_buf_length = cpu_to_be32(byte_count);

	/* copy second buffer into end of first buffer */
	memcpy(data_area_of_tgt, data_area_of_src, total_in_src);

	if (remaining != total_in_src) {
	/* more responses to go */
	cFYI(1, "waiting for more secondary responses");
	return 1;
	}

	/* we are done */
	cFYI(1, "found the last secondary response");
	return 0;
	}

	static bool
	cifs_check_trans2(struct mid_q_entry mid, struct TCP_Server_Info server,
	char *buf, int malformed)
	{
	if (malformed)
	return false;
	if (check2ndT2(buf) <= 0)
	return false;
	mid->multiRsp = true;
	if (mid->resp_buf) {
	/* merge response - fix up 1st*/
	malformed = coalesce_t2(buf, mid->resp_buf);
	if (malformed > 0)
	return true;
	/* All parts received or packet is malformed. */
	mid->multiEnd = true;
	dequeue_mid(mid, malformed);
	return true;
	}
	if (!server->large_buf) {
	/FIXME: switch to already allocated largebuf?/
	cERROR(1, "1st trans2 resp needs bigbuf");
	} else {
	/* Have first buffer */
	mid->resp_buf = buf;
	mid->large_buf = true;
	server->bigbuf = NULL;
	}
	return true;
	}

	static bool
	cifs_need_neg(struct TCP_Server_Info *server)
	{
	return server->maxBuf == 0;
	}

	static int
	cifs_negotiate(const unsigned int xid, struct cifs_ses *ses)
	{
	int rc;
	rc = CIFSSMBNegotiate(xid, ses);
	if (rc == -EAGAIN) {
	/* retry only once on 1st time connection */
	set_credits(ses->server, 1);
	rc = CIFSSMBNegotiate(xid, ses);
	if (rc == -EAGAIN)
	rc = -EHOSTDOWN;
	}
	return rc;
	}

	struct smb_version_operations smb1_operations = {
	.send_cancel = send_nt_cancel,
	.compare_fids = cifs_compare_fids,
	.setup_request = cifs_setup_request,
	.check_receive = cifs_check_receive,
	.add_credits = cifs_add_credits,
	.set_credits = cifs_set_credits,
	.get_credits_field = cifs_get_credits_field,
	.get_credits = cifs_get_credits,
	.get_next_mid = cifs_get_next_mid,
	.read_data_offset = cifs_read_data_offset,
	.read_data_length = cifs_read_data_length,
	.map_error = map_smb_to_linux_error,
	.find_mid = cifs_find_mid,
	.check_message = checkSMB,
	.dump_detail = cifs_dump_detail,
	.is_oplock_break = is_valid_oplock_break,
	.check_trans2 = cifs_check_trans2,
	.need_neg = cifs_need_neg,
	.negotiate = cifs_negotiate,
	};

	struct smb_version_values smb1_values = {
	.version_string = SMB1_VERSION_STRING,
	.large_lock_type = LOCKING_ANDX_LARGE_FILES,
	.exclusive_lock_type = 0,
	.shared_lock_type = LOCKING_ANDX_SHARED_LOCK,
	.unlock_lock_type = 0,
	.header_size = sizeof(struct smb_hdr),
	.max_header_size = MAX_CIFS_HDR_SIZE,
	.read_rsp_size = sizeof(READ_RSP),
	};