fs/cifs/transport.c

   1 /*
   2  *   fs/cifs/transport.c
   3  *
   4  *   Copyright (C) International Business Machines  Corp., 2002,2008
   5  *   Author(s): Steve French (sfrench@us.ibm.com)
   6  *   Jeremy Allison (jra@samba.org) 2006.
   7  *
   8  *   This library is free software; you can redistribute it and/or modify
   9  *   it under the terms of the GNU Lesser General Public License as published
  10  *   by the Free Software Foundation; either version 2.1 of the License, or
  11  *   (at your option) any later version.
  12  *
  13  *   This library is distributed in the hope that it will be useful,
  14  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See
  16  *   the GNU Lesser General Public License for more details.
  17  *
  18  *   You should have received a copy of the GNU Lesser General Public License
  19  *   along with this library; if not, write to the Free Software
  20  *   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
  21  */
  22
  23 #include <linux/fs.h>
  24 #include <linux/list.h>
  25 #include <linux/gfp.h>
  26 #include <linux/wait.h>
  27 #include <linux/net.h>
  28 #include <linux/delay.h>
  29 #include <asm/uaccess.h>
  30 #include <asm/processor.h>
  31 #include <linux/mempool.h>
  32 #include "cifspdu.h"
  33 #include "cifsglob.h"
  34 #include "cifsproto.h"
  35 #include "cifs_debug.h"
  36
  37 extern mempool_t *cifs_mid_poolp;
  38
  39 static void
  40 wake_up_task(struct mid_q_entry *mid)
  41 {
  42         wake_up_process(mid->callback_data);
  43 }
  44
  45 struct mid_q_entry *
  46 AllocMidQEntry(const struct smb_hdr *smb_buffer, struct TCP_Server_Info *server)
  47 {
  48         struct mid_q_entry *temp;
  49
  50         if (server == NULL) {
  51                 cERROR(1, "Null TCP session in AllocMidQEntry");
  52                 return NULL;
  53         }
  54
  55         temp = mempool_alloc(cifs_mid_poolp, GFP_NOFS);
  56         if (temp == NULL)
  57                 return temp;
  58         else {
  59                 memset(temp, 0, sizeof(struct mid_q_entry));
  60                 temp->mid = smb_buffer->Mid;    /* always LE */
  61                 temp->pid = current->pid;
  62                 temp->command = smb_buffer->Command;
  63                 cFYI(1, "For smb_command %d", temp->command);
  64         /*      do_gettimeofday(&temp->when_sent);*/ /* easier to use jiffies */
  65                 /* when mid allocated can be before when sent */
  66                 temp->when_alloc = jiffies;
  67
  68                 /*
  69                  * The default is for the mid to be synchronous, so the
  70                  * default callback just wakes up the current task.
  71                  */
  72                 temp->callback = wake_up_task;
  73                 temp->callback_data = current;
  74         }
  75
  76         atomic_inc(&midCount);
  77         temp->midState = MID_REQUEST_ALLOCATED;
  78         return temp;
  79 }
  80
  81 void
  82 DeleteMidQEntry(struct mid_q_entry *midEntry)
  83 {
  84 #ifdef CONFIG_CIFS_STATS2
  85         unsigned long now;
  86 #endif
  87         midEntry->midState = MID_FREE;
  88         atomic_dec(&midCount);
  89         if (midEntry->largeBuf)
  90                 cifs_buf_release(midEntry->resp_buf);
  91         else
  92                 cifs_small_buf_release(midEntry->resp_buf);
  93 #ifdef CONFIG_CIFS_STATS2
  94         now = jiffies;
  95         /* commands taking longer than one second are indications that
  96            something is wrong, unless it is quite a slow link or server */
  97         if ((now - midEntry->when_alloc) > HZ) {
  98                 if ((cifsFYI & CIFS_TIMER) &&
  99                    (midEntry->command != SMB_COM_LOCKING_ANDX)) {
 100                         printk(KERN_DEBUG " CIFS slow rsp: cmd %d mid %d",
 101                                midEntry->command, midEntry->mid);
 102                         printk(" A: 0x%lx S: 0x%lx R: 0x%lx\n",
 103                                now - midEntry->when_alloc,
 104                                now - midEntry->when_sent,
 105                                now - midEntry->when_received);
 106                 }
 107         }
 108 #endif
 109         mempool_free(midEntry, cifs_mid_poolp);
 110 }
 111
 112 static void
 113 delete_mid(struct mid_q_entry *mid)
 114 {
 115         spin_lock(&GlobalMid_Lock);
 116         list_del(&mid->qhead);
 117         spin_unlock(&GlobalMid_Lock);
 118
 119         DeleteMidQEntry(mid);
 120 }
 121
 122 static int
 123 smb_sendv(struct TCP_Server_Info *server, struct kvec *iov, int n_vec)
 124 {
 125         int rc = 0;
 126         int i = 0;
 127         struct msghdr smb_msg;
 128         struct smb_hdr *smb_buffer = iov[0].iov_base;
 129         unsigned int len = iov[0].iov_len;
 130         unsigned int total_len;
 131         int first_vec = 0;
 132         unsigned int smb_buf_length = smb_buffer->smb_buf_length;
 133         struct socket *ssocket = server->ssocket;
 134
 135         if (ssocket == NULL)
 136                 return -ENOTSOCK; /* BB eventually add reconnect code here */
 137
 138         smb_msg.msg_name = (struct sockaddr *) &server->dstaddr;
 139         smb_msg.msg_namelen = sizeof(struct sockaddr);
 140         smb_msg.msg_control = NULL;
 141         smb_msg.msg_controllen = 0;
 142         if (server->noblocksnd)
 143                 smb_msg.msg_flags = MSG_DONTWAIT + MSG_NOSIGNAL;
 144         else
 145                 smb_msg.msg_flags = MSG_NOSIGNAL;
 146
 147         /* smb header is converted in header_assemble. bcc and rest of SMB word
 148            area, and byte area if necessary, is converted to littleendian in
 149            cifssmb.c and RFC1001 len is converted to bigendian in smb_send
 150            Flags2 is converted in SendReceive */
 151
 152
 153         total_len = 0;
 154         for (i = 0; i < n_vec; i++)
 155                 total_len += iov[i].iov_len;
 156
 157         smb_buffer->smb_buf_length = cpu_to_be32(smb_buffer->smb_buf_length);
 158         cFYI(1, "Sending smb:  total_len %d", total_len);
 159         dump_smb(smb_buffer, len);
 160
 161         i = 0;
 162         while (total_len) {
 163                 rc = kernel_sendmsg(ssocket, &smb_msg, &iov[first_vec],
 164                                     n_vec - first_vec, total_len);
 165                 if ((rc == -ENOSPC) || (rc == -EAGAIN)) {
 166                         i++;
 167                         /* if blocking send we try 3 times, since each can block
 168                            for 5 seconds. For nonblocking  we have to try more
 169                            but wait increasing amounts of time allowing time for
 170                            socket to clear.  The overall time we wait in either
 171                            case to send on the socket is about 15 seconds.
 172                            Similarly we wait for 15 seconds for
 173                            a response from the server in SendReceive[2]
 174                            for the server to send a response back for
 175                            most types of requests (except SMB Write
 176                            past end of file which can be slow, and
 177                            blocking lock operations). NFS waits slightly longer
 178                            than CIFS, but this can make it take longer for
 179                            nonresponsive servers to be detected and 15 seconds
 180                            is more than enough time for modern networks to
 181                            send a packet.  In most cases if we fail to send
 182                            after the retries we will kill the socket and
 183                            reconnect which may clear the network problem.
 184                         */
 185                         if ((i >= 14) || (!server->noblocksnd && (i > 2))) {
 186                                 cERROR(1, "sends on sock %p stuck for 15 seconds",
 187                                     ssocket);
 188                                 rc = -EAGAIN;
 189                                 break;
 190                         }
 191                         msleep(1 << i);
 192                         continue;
 193                 }
 194                 if (rc < 0)
 195                         break;
 196
 197                 if (rc == total_len) {
 198                         total_len = 0;
 199                         break;
 200                 } else if (rc > total_len) {
 201                         cERROR(1, "sent %d requested %d", rc, total_len);
 202                         break;
 203                 }
 204                 if (rc == 0) {
 205                         /* should never happen, letting socket clear before
 206                            retrying is our only obvious option here */
 207                         cERROR(1, "tcp sent no data");
 208                         msleep(500);
 209                         continue;
 210                 }
 211                 total_len -= rc;
 212                 /* the line below resets i */
 213                 for (i = first_vec; i < n_vec; i++) {
 214                         if (iov[i].iov_len) {
 215                                 if (rc > iov[i].iov_len) {
 216                                         rc -= iov[i].iov_len;
 217                                         iov[i].iov_len = 0;
 218                                 } else {
 219                                         iov[i].iov_base += rc;
 220                                         iov[i].iov_len -= rc;
 221                                         first_vec = i;
 222                                         break;
 223                                 }
 224                         }
 225                 }
 226                 i = 0; /* in case we get ENOSPC on the next send */
 227         }
 228
 229         if ((total_len > 0) && (total_len != smb_buf_length + 4)) {
 230                 cFYI(1, "partial send (%d remaining), terminating session",
 231                         total_len);
 232                 /* If we have only sent part of an SMB then the next SMB
 233                    could be taken as the remainder of this one.  We need
 234                    to kill the socket so the server throws away the partial
 235                    SMB */
 236                 server->tcpStatus = CifsNeedReconnect;
 237         }
 238
 239         if (rc < 0) {
 240                 cERROR(1, "Error %d sending data on socket to server", rc);
 241         } else
 242                 rc = 0;
 243
 244         /* Don't want to modify the buffer as a
 245            side effect of this call. */
 246         smb_buffer->smb_buf_length = smb_buf_length;
 247
 248         return rc;
 249 }
 250
 251 int
 252 smb_send(struct TCP_Server_Info *server, struct smb_hdr *smb_buffer,
 253          unsigned int smb_buf_length)
 254 {
 255         struct kvec iov;
 256
 257         iov.iov_base = smb_buffer;
 258         iov.iov_len = smb_buf_length + 4;
 259
 260         return smb_sendv(server, &iov, 1);
 261 }
 262
 263 static int wait_for_free_request(struct TCP_Server_Info *server,
 264                                  const int long_op)
 265 {
 266         if (long_op == CIFS_ASYNC_OP) {
 267                 /* oplock breaks must not be held up */
 268                 atomic_inc(&server->inFlight);
 269                 return 0;
 270         }
 271
 272         spin_lock(&GlobalMid_Lock);
 273         while (1) {
 274                 if (atomic_read(&server->inFlight) >= cifs_max_pending) {
 275                         spin_unlock(&GlobalMid_Lock);
 276 #ifdef CONFIG_CIFS_STATS2
 277                         atomic_inc(&server->num_waiters);
 278 #endif
 279                         wait_event(server->request_q,
 280                                    atomic_read(&server->inFlight)
 281                                      < cifs_max_pending);
 282 #ifdef CONFIG_CIFS_STATS2
 283                         atomic_dec(&server->num_waiters);
 284 #endif
 285                         spin_lock(&GlobalMid_Lock);
 286                 } else {
 287                         if (server->tcpStatus == CifsExiting) {
 288                                 spin_unlock(&GlobalMid_Lock);
 289                                 return -ENOENT;
 290                         }
 291
 292                         /* can not count locking commands against total
 293                            as they are allowed to block on server */
 294
 295                         /* update # of requests on the wire to server */
 296                         if (long_op != CIFS_BLOCKING_OP)
 297                                 atomic_inc(&server->inFlight);
 298                         spin_unlock(&GlobalMid_Lock);
 299                         break;
 300                 }
 301         }
 302         return 0;
 303 }
 304
 305 static int allocate_mid(struct cifsSesInfo *ses, struct smb_hdr *in_buf,
 306                         struct mid_q_entry **ppmidQ)
 307 {
 308         if (ses->server->tcpStatus == CifsExiting) {
 309                 return -ENOENT;
 310         }
 311
 312         if (ses->server->tcpStatus == CifsNeedReconnect) {
 313                 cFYI(1, "tcp session dead - return to caller to retry");
 314                 return -EAGAIN;
 315         }
 316
 317         if (ses->status != CifsGood) {
 318                 /* check if SMB session is bad because we are setting it up */
 319                 if ((in_buf->Command != SMB_COM_SESSION_SETUP_ANDX) &&
 320                         (in_buf->Command != SMB_COM_NEGOTIATE))
 321                         return -EAGAIN;
 322                 /* else ok - we are setting up session */
 323         }
 324         *ppmidQ = AllocMidQEntry(in_buf, ses->server);
 325         if (*ppmidQ == NULL)
 326                 return -ENOMEM;
 327         spin_lock(&GlobalMid_Lock);
 328         list_add_tail(&(*ppmidQ)->qhead, &ses->server->pending_mid_q);
 329         spin_unlock(&GlobalMid_Lock);
 330         return 0;
 331 }
 332
 333 static int
 334 wait_for_response(struct TCP_Server_Info *server, struct mid_q_entry *midQ)
 335 {
 336         int error;
 337
 338         error = wait_event_killable(server->response_q,
 339                                     midQ->midState != MID_REQUEST_SUBMITTED);
 340         if (error < 0)
 341                 return -ERESTARTSYS;
 342
 343         return 0;
 344 }
 345
 346
 347 /*
 348  * Send a SMB request and set the callback function in the mid to handle
 349  * the result. Caller is responsible for dealing with timeouts.
 350  */
 351 int
 352 cifs_call_async(struct TCP_Server_Info *server, struct smb_hdr *in_buf,
 353                 mid_callback_t *callback, void *cbdata)
 354 {
 355         int rc;
 356         struct mid_q_entry *mid;
 357
 358         rc = wait_for_free_request(server, CIFS_ASYNC_OP);
 359         if (rc)
 360                 return rc;
 361
 362         mutex_lock(&server->srv_mutex);
 363         mid = AllocMidQEntry(in_buf, server);
 364         if (mid == NULL) {
 365                 mutex_unlock(&server->srv_mutex);
 366                 return -ENOMEM;
 367         }
 368
 369         /* put it on the pending_mid_q */
 370         spin_lock(&GlobalMid_Lock);
 371         list_add_tail(&mid->qhead, &server->pending_mid_q);
 372         spin_unlock(&GlobalMid_Lock);
 373
 374         rc = cifs_sign_smb(in_buf, server, &mid->sequence_number);
 375         if (rc) {
 376                 mutex_unlock(&server->srv_mutex);
 377                 goto out_err;
 378         }
 379
 380         mid->callback = callback;
 381         mid->callback_data = cbdata;
 382         mid->midState = MID_REQUEST_SUBMITTED;
 383 #ifdef CONFIG_CIFS_STATS2
 384         atomic_inc(&server->inSend);
 385 #endif
 386         rc = smb_send(server, in_buf, in_buf->smb_buf_length);
 387 #ifdef CONFIG_CIFS_STATS2
 388         atomic_dec(&server->inSend);
 389         mid->when_sent = jiffies;
 390 #endif
 391         mutex_unlock(&server->srv_mutex);
 392         if (rc)
 393                 goto out_err;
 394
 395         return rc;
 396 out_err:
 397         delete_mid(mid);
 398         atomic_dec(&server->inFlight);
 399         wake_up(&server->request_q);
 400         return rc;
 401 }
 402
 403 /*
 404  *
 405  * Send an SMB Request.  No response info (other than return code)
 406  * needs to be parsed.
 407  *
 408  * flags indicate the type of request buffer and how long to wait
 409  * and whether to log NT STATUS code (error) before mapping it to POSIX error
 410  *
 411  */
 412 int
 413 SendReceiveNoRsp(const unsigned int xid, struct cifsSesInfo *ses,
 414                 struct smb_hdr *in_buf, int flags)
 415 {
 416         int rc;
 417         struct kvec iov[1];
 418         int resp_buf_type;
 419
 420         iov[0].iov_base = (char *)in_buf;
 421         iov[0].iov_len = in_buf->smb_buf_length + 4;
 422         flags |= CIFS_NO_RESP;
 423         rc = SendReceive2(xid, ses, iov, 1, &resp_buf_type, flags);
 424         cFYI(DBG2, "SendRcvNoRsp flags %d rc %d", flags, rc);
 425
 426         return rc;
 427 }
 428
 429 static int
 430 sync_mid_result(struct mid_q_entry *mid, struct TCP_Server_Info *server)
 431 {
 432         int rc = 0;
 433
 434         cFYI(1, "%s: cmd=%d mid=%d state=%d", __func__, mid->command,
 435                 mid->mid, mid->midState);
 436
 437         spin_lock(&GlobalMid_Lock);
 438         /* ensure that it's no longer on the pending_mid_q */
 439         list_del_init(&mid->qhead);
 440
 441         switch (mid->midState) {
 442         case MID_RESPONSE_RECEIVED:
 443                 spin_unlock(&GlobalMid_Lock);
 444                 return rc;
 445         case MID_REQUEST_SUBMITTED:
 446                 /* socket is going down, reject all calls */
 447                 if (server->tcpStatus == CifsExiting) {
 448                         cERROR(1, "%s: canceling mid=%d cmd=0x%x state=%d",
 449                                __func__, mid->mid, mid->command, mid->midState);
 450                         rc = -EHOSTDOWN;
 451                         break;
 452                 }
 453         case MID_RETRY_NEEDED:
 454                 rc = -EAGAIN;
 455                 break;
 456         default:
 457                 cERROR(1, "%s: invalid mid state mid=%d state=%d", __func__,
 458                         mid->mid, mid->midState);
 459                 rc = -EIO;
 460         }
 461         spin_unlock(&GlobalMid_Lock);
 462
 463         DeleteMidQEntry(mid);
 464         return rc;
 465 }
 466
 467 /*
 468  * An NT cancel request header looks just like the original request except:
 469  *
 470  * The Command is SMB_COM_NT_CANCEL
 471  * The WordCount is zeroed out
 472  * The ByteCount is zeroed out
 473  *
 474  * This function mangles an existing request buffer into a
 475  * SMB_COM_NT_CANCEL request and then sends it.
 476  */
 477 static int
 478 send_nt_cancel(struct TCP_Server_Info *server, struct smb_hdr *in_buf,
 479                 struct mid_q_entry *mid)
 480 {
 481         int rc = 0;
 482
 483         /* -4 for RFC1001 length and +2 for BCC field */
 484         in_buf->smb_buf_length = sizeof(struct smb_hdr) - 4  + 2;
 485         in_buf->Command = SMB_COM_NT_CANCEL;
 486         in_buf->WordCount = 0;
 487         put_bcc_le(0, in_buf);
 488
 489         mutex_lock(&server->srv_mutex);
 490         rc = cifs_sign_smb(in_buf, server, &mid->sequence_number);
 491         if (rc) {
 492                 mutex_unlock(&server->srv_mutex);
 493                 return rc;
 494         }
 495         rc = smb_send(server, in_buf, in_buf->smb_buf_length);
 496         mutex_unlock(&server->srv_mutex);
 497
 498         cFYI(1, "issued NT_CANCEL for mid %u, rc = %d",
 499                 in_buf->Mid, rc);
 500
 501         return rc;
 502 }
 503
 504 int
 505 SendReceive2(const unsigned int xid, struct cifsSesInfo *ses,
 506              struct kvec *iov, int n_vec, int *pRespBufType /* ret */,
 507              const int flags)
 508 {
 509         int rc = 0;
 510         int long_op;
 511         unsigned int receive_len;
 512         struct mid_q_entry *midQ;
 513         struct smb_hdr *in_buf = iov[0].iov_base;
 514
 515         long_op = flags & CIFS_TIMEOUT_MASK;
 516
 517         *pRespBufType = CIFS_NO_BUFFER;  /* no response buf yet */
 518
 519         if ((ses == NULL) || (ses->server == NULL)) {
 520                 cifs_small_buf_release(in_buf);
 521                 cERROR(1, "Null session");
 522                 return -EIO;
 523         }
 524
 525         if (ses->server->tcpStatus == CifsExiting) {
 526                 cifs_small_buf_release(in_buf);
 527                 return -ENOENT;
 528         }
 529
 530         /* Ensure that we do not send more than 50 overlapping requests
 531            to the same server. We may make this configurable later or
 532            use ses->maxReq */
 533
 534         rc = wait_for_free_request(ses->server, long_op);
 535         if (rc) {
 536                 cifs_small_buf_release(in_buf);
 537                 return rc;
 538         }
 539
 540         /* make sure that we sign in the same order that we send on this socket
 541            and avoid races inside tcp sendmsg code that could cause corruption
 542            of smb data */
 543
 544         mutex_lock(&ses->server->srv_mutex);
 545
 546         rc = allocate_mid(ses, in_buf, &midQ);
 547         if (rc) {
 548                 mutex_unlock(&ses->server->srv_mutex);
 549                 cifs_small_buf_release(in_buf);
 550                 /* Update # of requests on wire to server */
 551                 atomic_dec(&ses->server->inFlight);
 552                 wake_up(&ses->server->request_q);
 553                 return rc;
 554         }
 555         rc = cifs_sign_smb2(iov, n_vec, ses->server, &midQ->sequence_number);
 556         if (rc) {
 557                 mutex_unlock(&ses->server->srv_mutex);
 558                 cifs_small_buf_release(in_buf);
 559                 goto out;
 560         }
 561
 562         midQ->midState = MID_REQUEST_SUBMITTED;
 563 #ifdef CONFIG_CIFS_STATS2
 564         atomic_inc(&ses->server->inSend);
 565 #endif
 566         rc = smb_sendv(ses->server, iov, n_vec);
 567 #ifdef CONFIG_CIFS_STATS2
 568         atomic_dec(&ses->server->inSend);
 569         midQ->when_sent = jiffies;
 570 #endif
 571
 572         mutex_unlock(&ses->server->srv_mutex);
 573
 574         if (rc < 0) {
 575                 cifs_small_buf_release(in_buf);
 576                 goto out;
 577         }
 578
 579         if (long_op == CIFS_ASYNC_OP) {
 580                 cifs_small_buf_release(in_buf);
 581                 goto out;
 582         }
 583
 584         rc = wait_for_response(ses->server, midQ);
 585         if (rc != 0) {
 586                 send_nt_cancel(ses->server, in_buf, midQ);
 587                 spin_lock(&GlobalMid_Lock);
 588                 if (midQ->midState == MID_REQUEST_SUBMITTED) {
 589                         midQ->callback = DeleteMidQEntry;
 590                         spin_unlock(&GlobalMid_Lock);
 591                         cifs_small_buf_release(in_buf);
 592                         atomic_dec(&ses->server->inFlight);
 593                         wake_up(&ses->server->request_q);
 594                         return rc;
 595                 }
 596                 spin_unlock(&GlobalMid_Lock);
 597         }
 598
 599         cifs_small_buf_release(in_buf);
 600
 601         rc = sync_mid_result(midQ, ses->server);
 602         if (rc != 0) {
 603                 atomic_dec(&ses->server->inFlight);
 604                 wake_up(&ses->server->request_q);
 605                 return rc;
 606         }
 607
 608         receive_len = midQ->resp_buf->smb_buf_length;
 609
 610         if (receive_len > CIFSMaxBufSize + MAX_CIFS_HDR_SIZE) {
 611                 cERROR(1, "Frame too large received.  Length: %d  Xid: %d",
 612                         receive_len, xid);
 613                 rc = -EIO;
 614                 goto out;
 615         }
 616
 617         /* rcvd frame is ok */
 618
 619         if (midQ->resp_buf &&
 620             (midQ->midState == MID_RESPONSE_RECEIVED)) {
 621
 622                 iov[0].iov_base = (char *)midQ->resp_buf;
 623                 if (midQ->largeBuf)
 624                         *pRespBufType = CIFS_LARGE_BUFFER;
 625                 else
 626                         *pRespBufType = CIFS_SMALL_BUFFER;
 627                 iov[0].iov_len = receive_len + 4;
 628
 629                 dump_smb(midQ->resp_buf, 80);
 630                 /* convert the length into a more usable form */
 631                 if ((receive_len > 24) &&
 632                     (ses->server->secMode & (SECMODE_SIGN_REQUIRED |
 633                                              SECMODE_SIGN_ENABLED))) {
 634                         rc = cifs_verify_signature(midQ->resp_buf,
 635                                                 ses->server,
 636                                                 midQ->sequence_number+1);
 637                         if (rc) {
 638                                 cERROR(1, "Unexpected SMB signature");
 639                                 /* BB FIXME add code to kill session */
 640                         }
 641                 }
 642
 643                 /* BB special case reconnect tid and uid here? */
 644                 rc = map_smb_to_linux_error(midQ->resp_buf,
 645                                             flags & CIFS_LOG_ERROR);
 646
 647                 /* convert ByteCount if necessary */
 648                 if (receive_len >= sizeof(struct smb_hdr) - 4
 649                     /* do not count RFC1001 header */  +
 650                     (2 * midQ->resp_buf->WordCount) + 2 /* bcc */ )
 651                         put_bcc(get_bcc_le(midQ->resp_buf), midQ->resp_buf);
 652                 if ((flags & CIFS_NO_RESP) == 0)
 653                         midQ->resp_buf = NULL;  /* mark it so buf will
 654                                                    not be freed by
 655                                                    delete_mid */
 656         } else {
 657                 rc = -EIO;
 658                 cFYI(1, "Bad MID state?");
 659         }
 660
 661 out:
 662         delete_mid(midQ);
 663         atomic_dec(&ses->server->inFlight);
 664         wake_up(&ses->server->request_q);
 665
 666         return rc;
 667 }
 668
 669 int
 670 SendReceive(const unsigned int xid, struct cifsSesInfo *ses,
 671             struct smb_hdr *in_buf, struct smb_hdr *out_buf,
 672             int *pbytes_returned, const int long_op)
 673 {
 674         int rc = 0;
 675         unsigned int receive_len;
 676         struct mid_q_entry *midQ;
 677
 678         if (ses == NULL) {
 679                 cERROR(1, "Null smb session");
 680                 return -EIO;
 681         }
 682         if (ses->server == NULL) {
 683                 cERROR(1, "Null tcp session");
 684                 return -EIO;
 685         }
 686
 687         if (ses->server->tcpStatus == CifsExiting)
 688                 return -ENOENT;
 689
 690         /* Ensure that we do not send more than 50 overlapping requests
 691            to the same server. We may make this configurable later or
 692            use ses->maxReq */
 693
 694         if (in_buf->smb_buf_length > CIFSMaxBufSize + MAX_CIFS_HDR_SIZE - 4) {
 695                 cERROR(1, "Illegal length, greater than maximum frame, %d",
 696                            in_buf->smb_buf_length);
 697                 return -EIO;
 698         }
 699
 700         rc = wait_for_free_request(ses->server, long_op);
 701         if (rc)
 702                 return rc;
 703
 704         /* make sure that we sign in the same order that we send on this socket
 705            and avoid races inside tcp sendmsg code that could cause corruption
 706            of smb data */
 707
 708         mutex_lock(&ses->server->srv_mutex);
 709
 710         rc = allocate_mid(ses, in_buf, &midQ);
 711         if (rc) {
 712                 mutex_unlock(&ses->server->srv_mutex);
 713                 /* Update # of requests on wire to server */
 714                 atomic_dec(&ses->server->inFlight);
 715                 wake_up(&ses->server->request_q);
 716                 return rc;
 717         }
 718
 719         rc = cifs_sign_smb(in_buf, ses->server, &midQ->sequence_number);
 720         if (rc) {
 721                 mutex_unlock(&ses->server->srv_mutex);
 722                 goto out;
 723         }
 724
 725         midQ->midState = MID_REQUEST_SUBMITTED;
 726 #ifdef CONFIG_CIFS_STATS2
 727         atomic_inc(&ses->server->inSend);
 728 #endif
 729         rc = smb_send(ses->server, in_buf, in_buf->smb_buf_length);
 730 #ifdef CONFIG_CIFS_STATS2
 731         atomic_dec(&ses->server->inSend);
 732         midQ->when_sent = jiffies;
 733 #endif
 734         mutex_unlock(&ses->server->srv_mutex);
 735
 736         if (rc < 0)
 737                 goto out;
 738
 739         if (long_op == CIFS_ASYNC_OP)
 740                 goto out;
 741
 742         rc = wait_for_response(ses->server, midQ);
 743         if (rc != 0) {
 744                 send_nt_cancel(ses->server, in_buf, midQ);
 745                 spin_lock(&GlobalMid_Lock);
 746                 if (midQ->midState == MID_REQUEST_SUBMITTED) {
 747                         /* no longer considered to be "in-flight" */
 748                         midQ->callback = DeleteMidQEntry;
 749                         spin_unlock(&GlobalMid_Lock);
 750                         atomic_dec(&ses->server->inFlight);
 751                         wake_up(&ses->server->request_q);
 752                         return rc;
 753                 }
 754                 spin_unlock(&GlobalMid_Lock);
 755         }
 756
 757         rc = sync_mid_result(midQ, ses->server);
 758         if (rc != 0) {
 759                 atomic_dec(&ses->server->inFlight);
 760                 wake_up(&ses->server->request_q);
 761                 return rc;
 762         }
 763
 764         receive_len = midQ->resp_buf->smb_buf_length;
 765
 766         if (receive_len > CIFSMaxBufSize + MAX_CIFS_HDR_SIZE) {
 767                 cERROR(1, "Frame too large received.  Length: %d  Xid: %d",
 768                         receive_len, xid);
 769                 rc = -EIO;
 770                 goto out;
 771         }
 772
 773         /* rcvd frame is ok */
 774
 775         if (midQ->resp_buf && out_buf
 776             && (midQ->midState == MID_RESPONSE_RECEIVED)) {
 777                 out_buf->smb_buf_length = receive_len;
 778                 memcpy((char *)out_buf + 4,
 779                        (char *)midQ->resp_buf + 4,
 780                        receive_len);
 781
 782                 dump_smb(out_buf, 92);
 783                 /* convert the length into a more usable form */
 784                 if ((receive_len > 24) &&
 785                     (ses->server->secMode & (SECMODE_SIGN_REQUIRED |
 786                                              SECMODE_SIGN_ENABLED))) {
 787                         rc = cifs_verify_signature(out_buf,
 788                                                 ses->server,
 789                                                 midQ->sequence_number+1);
 790                         if (rc) {
 791                                 cERROR(1, "Unexpected SMB signature");
 792                                 /* BB FIXME add code to kill session */
 793                         }
 794                 }
 795
 796                 *pbytes_returned = out_buf->smb_buf_length;
 797
 798                 /* BB special case reconnect tid and uid here? */
 799                 rc = map_smb_to_linux_error(out_buf, 0 /* no log */ );
 800
 801                 /* convert ByteCount if necessary */
 802                 if (receive_len >= sizeof(struct smb_hdr) - 4
 803                     /* do not count RFC1001 header */  +
 804                     (2 * out_buf->WordCount) + 2 /* bcc */ )
 805                         put_bcc(get_bcc_le(midQ->resp_buf), midQ->resp_buf);
 806         } else {
 807                 rc = -EIO;
 808                 cERROR(1, "Bad MID state?");
 809         }
 810
 811 out:
 812         delete_mid(midQ);
 813         atomic_dec(&ses->server->inFlight);
 814         wake_up(&ses->server->request_q);
 815
 816         return rc;
 817 }
 818
 819 /* We send a LOCKINGX_CANCEL_LOCK to cause the Windows
 820    blocking lock to return. */
 821
 822 static int
 823 send_lock_cancel(const unsigned int xid, struct cifsTconInfo *tcon,
 824                         struct smb_hdr *in_buf,
 825                         struct smb_hdr *out_buf)
 826 {
 827         int bytes_returned;
 828         struct cifsSesInfo *ses = tcon->ses;
 829         LOCK_REQ *pSMB = (LOCK_REQ *)in_buf;
 830
 831         /* We just modify the current in_buf to change
 832            the type of lock from LOCKING_ANDX_SHARED_LOCK
 833            or LOCKING_ANDX_EXCLUSIVE_LOCK to
 834            LOCKING_ANDX_CANCEL_LOCK. */
 835
 836         pSMB->LockType = LOCKING_ANDX_CANCEL_LOCK|LOCKING_ANDX_LARGE_FILES;
 837         pSMB->Timeout = 0;
 838         pSMB->hdr.Mid = GetNextMid(ses->server);
 839
 840         return SendReceive(xid, ses, in_buf, out_buf,
 841                         &bytes_returned, 0);
 842 }
 843
 844 int
 845 SendReceiveBlockingLock(const unsigned int xid, struct cifsTconInfo *tcon,
 846             struct smb_hdr *in_buf, struct smb_hdr *out_buf,
 847             int *pbytes_returned)
 848 {
 849         int rc = 0;
 850         int rstart = 0;
 851         unsigned int receive_len;
 852         struct mid_q_entry *midQ;
 853         struct cifsSesInfo *ses;
 854
 855         if (tcon == NULL || tcon->ses == NULL) {
 856                 cERROR(1, "Null smb session");
 857                 return -EIO;
 858         }
 859         ses = tcon->ses;
 860
 861         if (ses->server == NULL) {
 862                 cERROR(1, "Null tcp session");
 863                 return -EIO;
 864         }
 865
 866         if (ses->server->tcpStatus == CifsExiting)
 867                 return -ENOENT;
 868
 869         /* Ensure that we do not send more than 50 overlapping requests
 870            to the same server. We may make this configurable later or
 871            use ses->maxReq */
 872
 873         if (in_buf->smb_buf_length > CIFSMaxBufSize + MAX_CIFS_HDR_SIZE - 4) {
 874                 cERROR(1, "Illegal length, greater than maximum frame, %d",
 875                            in_buf->smb_buf_length);
 876                 return -EIO;
 877         }
 878
 879         rc = wait_for_free_request(ses->server, CIFS_BLOCKING_OP);
 880         if (rc)
 881                 return rc;
 882
 883         /* make sure that we sign in the same order that we send on this socket
 884            and avoid races inside tcp sendmsg code that could cause corruption
 885            of smb data */
 886
 887         mutex_lock(&ses->server->srv_mutex);
 888
 889         rc = allocate_mid(ses, in_buf, &midQ);
 890         if (rc) {
 891                 mutex_unlock(&ses->server->srv_mutex);
 892                 return rc;
 893         }
 894
 895         rc = cifs_sign_smb(in_buf, ses->server, &midQ->sequence_number);
 896         if (rc) {
 897                 delete_mid(midQ);
 898                 mutex_unlock(&ses->server->srv_mutex);
 899                 return rc;
 900         }
 901
 902         midQ->midState = MID_REQUEST_SUBMITTED;
 903 #ifdef CONFIG_CIFS_STATS2
 904         atomic_inc(&ses->server->inSend);
 905 #endif
 906         rc = smb_send(ses->server, in_buf, in_buf->smb_buf_length);
 907 #ifdef CONFIG_CIFS_STATS2
 908         atomic_dec(&ses->server->inSend);
 909         midQ->when_sent = jiffies;
 910 #endif
 911         mutex_unlock(&ses->server->srv_mutex);
 912
 913         if (rc < 0) {
 914                 delete_mid(midQ);
 915                 return rc;
 916         }
 917
 918         /* Wait for a reply - allow signals to interrupt. */
 919         rc = wait_event_interruptible(ses->server->response_q,
 920                 (!(midQ->midState == MID_REQUEST_SUBMITTED)) ||
 921                 ((ses->server->tcpStatus != CifsGood) &&
 922                  (ses->server->tcpStatus != CifsNew)));
 923
 924         /* Were we interrupted by a signal ? */
 925         if ((rc == -ERESTARTSYS) &&
 926                 (midQ->midState == MID_REQUEST_SUBMITTED) &&
 927                 ((ses->server->tcpStatus == CifsGood) ||
 928                  (ses->server->tcpStatus == CifsNew))) {
 929
 930                 if (in_buf->Command == SMB_COM_TRANSACTION2) {
 931                         /* POSIX lock. We send a NT_CANCEL SMB to cause the
 932                            blocking lock to return. */
 933                         rc = send_nt_cancel(ses->server, in_buf, midQ);
 934                         if (rc) {
 935                                 delete_mid(midQ);
 936                                 return rc;
 937                         }
 938                 } else {
 939                         /* Windows lock. We send a LOCKINGX_CANCEL_LOCK
 940                            to cause the blocking lock to return. */
 941
 942                         rc = send_lock_cancel(xid, tcon, in_buf, out_buf);
 943
 944                         /* If we get -ENOLCK back the lock may have
 945                            already been removed. Don't exit in this case. */
 946                         if (rc && rc != -ENOLCK) {
 947                                 delete_mid(midQ);
 948                                 return rc;
 949                         }
 950                 }
 951
 952                 rc = wait_for_response(ses->server, midQ);
 953                 if (rc) {
 954                         send_nt_cancel(ses->server, in_buf, midQ);
 955                         spin_lock(&GlobalMid_Lock);
 956                         if (midQ->midState == MID_REQUEST_SUBMITTED) {
 957                                 /* no longer considered to be "in-flight" */
 958                                 midQ->callback = DeleteMidQEntry;
 959                                 spin_unlock(&GlobalMid_Lock);
 960                                 return rc;
 961                         }
 962                         spin_unlock(&GlobalMid_Lock);
 963                 }
 964
 965                 /* We got the response - restart system call. */
 966                 rstart = 1;
 967         }
 968
 969         rc = sync_mid_result(midQ, ses->server);
 970         if (rc != 0)
 971                 return rc;
 972
 973         receive_len = midQ->resp_buf->smb_buf_length;
 974         if (receive_len > CIFSMaxBufSize + MAX_CIFS_HDR_SIZE) {
 975                 cERROR(1, "Frame too large received.  Length: %d  Xid: %d",
 976                         receive_len, xid);
 977                 rc = -EIO;
 978                 goto out;
 979         }
 980
 981         /* rcvd frame is ok */
 982
 983         if ((out_buf == NULL) || (midQ->midState != MID_RESPONSE_RECEIVED)) {
 984                 rc = -EIO;
 985                 cERROR(1, "Bad MID state?");
 986                 goto out;
 987         }
 988
 989         out_buf->smb_buf_length = receive_len;
 990         memcpy((char *)out_buf + 4,
 991                (char *)midQ->resp_buf + 4,
 992                receive_len);
 993
 994         dump_smb(out_buf, 92);
 995         /* convert the length into a more usable form */
 996         if ((receive_len > 24) &&
 997             (ses->server->secMode & (SECMODE_SIGN_REQUIRED |
 998                                      SECMODE_SIGN_ENABLED))) {
 999                 rc = cifs_verify_signature(out_buf,
1000                                            ses->server,
1001                                            midQ->sequence_number+1);
1002                 if (rc) {
1003                         cERROR(1, "Unexpected SMB signature");
1004                         /* BB FIXME add code to kill session */
1005                 }
1006         }
1007
1008         *pbytes_returned = out_buf->smb_buf_length;
1009
1010         /* BB special case reconnect tid and uid here? */
1011         rc = map_smb_to_linux_error(out_buf, 0 /* no log */ );
1012
1013         /* convert ByteCount if necessary */
1014         if (receive_len >= sizeof(struct smb_hdr) - 4
1015             /* do not count RFC1001 header */  +
1016             (2 * out_buf->WordCount) + 2 /* bcc */ )
1017                 put_bcc(get_bcc_le(out_buf), out_buf);
1018
1019 out:
1020         delete_mid(midQ);
1021         if (rstart && rc == -EACCES)
1022                 return -ERESTARTSYS;
1023         return rc;
1024 }