fs/cifs/transport.c

   1 /*
   2  *   fs/cifs/transport.c
   3  *
   4  *   Copyright (C) International Business Machines  Corp., 2002,2008
   5  *   Author(s): Steve French (sfrench@us.ibm.com)
   6  *   Jeremy Allison (jra@samba.org) 2006.
   7  *
   8  *   This library is free software; you can redistribute it and/or modify
   9  *   it under the terms of the GNU Lesser General Public License as published
  10  *   by the Free Software Foundation; either version 2.1 of the License, or
  11  *   (at your option) any later version.
  12  *
  13  *   This library is distributed in the hope that it will be useful,
  14  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See
  16  *   the GNU Lesser General Public License for more details.
  17  *
  18  *   You should have received a copy of the GNU Lesser General Public License
  19  *   along with this library; if not, write to the Free Software
  20  *   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
  21  */
  22
  23 #include <linux/fs.h>
  24 #include <linux/list.h>
  25 #include <linux/gfp.h>
  26 #include <linux/wait.h>
  27 #include <linux/net.h>
  28 #include <linux/delay.h>
  29 #include <asm/uaccess.h>
  30 #include <asm/processor.h>
  31 #include <linux/mempool.h>
  32 #include "cifspdu.h"
  33 #include "cifsglob.h"
  34 #include "cifsproto.h"
  35 #include "cifs_debug.h"
  36
  37 extern mempool_t *cifs_mid_poolp;
  38
  39 static void
  40 wake_up_task(struct mid_q_entry *mid)
  41 {
  42         wake_up_process(mid->callback_data);
  43 }
  44
  45 struct mid_q_entry *
  46 AllocMidQEntry(const struct smb_hdr *smb_buffer, struct TCP_Server_Info *server)
  47 {
  48         struct mid_q_entry *temp;
  49
  50         if (server == NULL) {
  51                 cERROR(1, "Null TCP session in AllocMidQEntry");
  52                 return NULL;
  53         }
  54
  55         temp = mempool_alloc(cifs_mid_poolp, GFP_NOFS);
  56         if (temp == NULL)
  57                 return temp;
  58         else {
  59                 memset(temp, 0, sizeof(struct mid_q_entry));
  60                 temp->mid = smb_buffer->Mid;    /* always LE */
  61                 temp->pid = current->pid;
  62                 temp->command = smb_buffer->Command;
  63                 cFYI(1, "For smb_command %d", temp->command);
  64         /*      do_gettimeofday(&temp->when_sent);*/ /* easier to use jiffies */
  65                 /* when mid allocated can be before when sent */
  66                 temp->when_alloc = jiffies;
  67
  68                 /*
  69                  * The default is for the mid to be synchronous, so the
  70                  * default callback just wakes up the current task.
  71                  */
  72                 temp->callback = wake_up_task;
  73                 temp->callback_data = current;
  74         }
  75
  76         atomic_inc(&midCount);
  77         temp->midState = MID_REQUEST_ALLOCATED;
  78         return temp;
  79 }
  80
  81 void
  82 DeleteMidQEntry(struct mid_q_entry *midEntry)
  83 {
  84 #ifdef CONFIG_CIFS_STATS2
  85         unsigned long now;
  86 #endif
  87         midEntry->midState = MID_FREE;
  88         atomic_dec(&midCount);
  89         if (midEntry->largeBuf)
  90                 cifs_buf_release(midEntry->resp_buf);
  91         else
  92                 cifs_small_buf_release(midEntry->resp_buf);
  93 #ifdef CONFIG_CIFS_STATS2
  94         now = jiffies;
  95         /* commands taking longer than one second are indications that
  96            something is wrong, unless it is quite a slow link or server */
  97         if ((now - midEntry->when_alloc) > HZ) {
  98                 if ((cifsFYI & CIFS_TIMER) &&
  99                    (midEntry->command != SMB_COM_LOCKING_ANDX)) {
 100                         printk(KERN_DEBUG " CIFS slow rsp: cmd %d mid %d",
 101                                midEntry->command, midEntry->mid);
 102                         printk(" A: 0x%lx S: 0x%lx R: 0x%lx\n",
 103                                now - midEntry->when_alloc,
 104                                now - midEntry->when_sent,
 105                                now - midEntry->when_received);
 106                 }
 107         }
 108 #endif
 109         mempool_free(midEntry, cifs_mid_poolp);
 110 }
 111
 112 static void
 113 delete_mid(struct mid_q_entry *mid)
 114 {
 115         spin_lock(&GlobalMid_Lock);
 116         list_del(&mid->qhead);
 117         spin_unlock(&GlobalMid_Lock);
 118
 119         DeleteMidQEntry(mid);
 120 }
 121
 122 static int
 123 smb_sendv(struct TCP_Server_Info *server, struct kvec *iov, int n_vec)
 124 {
 125         int rc = 0;
 126         int i = 0;
 127         struct msghdr smb_msg;
 128         struct smb_hdr *smb_buffer = iov[0].iov_base;
 129         unsigned int len = iov[0].iov_len;
 130         unsigned int total_len;
 131         int first_vec = 0;
 132         unsigned int smb_buf_length = be32_to_cpu(smb_buffer->smb_buf_length);
 133         struct socket *ssocket = server->ssocket;
 134
 135         if (ssocket == NULL)
 136                 return -ENOTSOCK; /* BB eventually add reconnect code here */
 137
 138         smb_msg.msg_name = (struct sockaddr *) &server->dstaddr;
 139         smb_msg.msg_namelen = sizeof(struct sockaddr);
 140         smb_msg.msg_control = NULL;
 141         smb_msg.msg_controllen = 0;
 142         if (server->noblocksnd)
 143                 smb_msg.msg_flags = MSG_DONTWAIT + MSG_NOSIGNAL;
 144         else
 145                 smb_msg.msg_flags = MSG_NOSIGNAL;
 146
 147         total_len = 0;
 148         for (i = 0; i < n_vec; i++)
 149                 total_len += iov[i].iov_len;
 150
 151         cFYI(1, "Sending smb:  total_len %d", total_len);
 152         dump_smb(smb_buffer, len);
 153
 154         i = 0;
 155         while (total_len) {
 156                 rc = kernel_sendmsg(ssocket, &smb_msg, &iov[first_vec],
 157                                     n_vec - first_vec, total_len);
 158                 if ((rc == -ENOSPC) || (rc == -EAGAIN)) {
 159                         i++;
 160                         /* if blocking send we try 3 times, since each can block
 161                            for 5 seconds. For nonblocking  we have to try more
 162                            but wait increasing amounts of time allowing time for
 163                            socket to clear.  The overall time we wait in either
 164                            case to send on the socket is about 15 seconds.
 165                            Similarly we wait for 15 seconds for
 166                            a response from the server in SendReceive[2]
 167                            for the server to send a response back for
 168                            most types of requests (except SMB Write
 169                            past end of file which can be slow, and
 170                            blocking lock operations). NFS waits slightly longer
 171                            than CIFS, but this can make it take longer for
 172                            nonresponsive servers to be detected and 15 seconds
 173                            is more than enough time for modern networks to
 174                            send a packet.  In most cases if we fail to send
 175                            after the retries we will kill the socket and
 176                            reconnect which may clear the network problem.
 177                         */
 178                         if ((i >= 14) || (!server->noblocksnd && (i > 2))) {
 179                                 cERROR(1, "sends on sock %p stuck for 15 seconds",
 180                                     ssocket);
 181                                 rc = -EAGAIN;
 182                                 break;
 183                         }
 184                         msleep(1 << i);
 185                         continue;
 186                 }
 187                 if (rc < 0)
 188                         break;
 189
 190                 if (rc == total_len) {
 191                         total_len = 0;
 192                         break;
 193                 } else if (rc > total_len) {
 194                         cERROR(1, "sent %d requested %d", rc, total_len);
 195                         break;
 196                 }
 197                 if (rc == 0) {
 198                         /* should never happen, letting socket clear before
 199                            retrying is our only obvious option here */
 200                         cERROR(1, "tcp sent no data");
 201                         msleep(500);
 202                         continue;
 203                 }
 204                 total_len -= rc;
 205                 /* the line below resets i */
 206                 for (i = first_vec; i < n_vec; i++) {
 207                         if (iov[i].iov_len) {
 208                                 if (rc > iov[i].iov_len) {
 209                                         rc -= iov[i].iov_len;
 210                                         iov[i].iov_len = 0;
 211                                 } else {
 212                                         iov[i].iov_base += rc;
 213                                         iov[i].iov_len -= rc;
 214                                         first_vec = i;
 215                                         break;
 216                                 }
 217                         }
 218                 }
 219                 i = 0; /* in case we get ENOSPC on the next send */
 220         }
 221
 222         if ((total_len > 0) && (total_len != smb_buf_length + 4)) {
 223                 cFYI(1, "partial send (%d remaining), terminating session",
 224                         total_len);
 225                 /* If we have only sent part of an SMB then the next SMB
 226                    could be taken as the remainder of this one.  We need
 227                    to kill the socket so the server throws away the partial
 228                    SMB */
 229                 server->tcpStatus = CifsNeedReconnect;
 230         }
 231
 232         if (rc < 0 && rc != -EINTR)
 233                 cERROR(1, "Error %d sending data on socket to server", rc);
 234         else
 235                 rc = 0;
 236
 237         /* Don't want to modify the buffer as a
 238            side effect of this call. */
 239         smb_buffer->smb_buf_length = cpu_to_be32(smb_buf_length);
 240
 241         return rc;
 242 }
 243
 244 int
 245 smb_send(struct TCP_Server_Info *server, struct smb_hdr *smb_buffer,
 246          unsigned int smb_buf_length)
 247 {
 248         struct kvec iov;
 249
 250         iov.iov_base = smb_buffer;
 251         iov.iov_len = smb_buf_length + 4;
 252
 253         return smb_sendv(server, &iov, 1);
 254 }
 255
 256 static int wait_for_free_request(struct TCP_Server_Info *server,
 257                                  const int long_op)
 258 {
 259         if (long_op == CIFS_ASYNC_OP) {
 260                 /* oplock breaks must not be held up */
 261                 atomic_inc(&server->inFlight);
 262                 return 0;
 263         }
 264
 265         spin_lock(&GlobalMid_Lock);
 266         while (1) {
 267                 if (atomic_read(&server->inFlight) >= cifs_max_pending) {
 268                         spin_unlock(&GlobalMid_Lock);
 269                         cifs_num_waiters_inc(server);
 270                         wait_event(server->request_q,
 271                                    atomic_read(&server->inFlight)
 272                                      < cifs_max_pending);
 273                         cifs_num_waiters_dec(server);
 274                         spin_lock(&GlobalMid_Lock);
 275                 } else {
 276                         if (server->tcpStatus == CifsExiting) {
 277                                 spin_unlock(&GlobalMid_Lock);
 278                                 return -ENOENT;
 279                         }
 280
 281                         /* can not count locking commands against total
 282                            as they are allowed to block on server */
 283
 284                         /* update # of requests on the wire to server */
 285                         if (long_op != CIFS_BLOCKING_OP)
 286                                 atomic_inc(&server->inFlight);
 287                         spin_unlock(&GlobalMid_Lock);
 288                         break;
 289                 }
 290         }
 291         return 0;
 292 }
 293
 294 static int allocate_mid(struct cifs_ses *ses, struct smb_hdr *in_buf,
 295                         struct mid_q_entry **ppmidQ)
 296 {
 297         if (ses->server->tcpStatus == CifsExiting) {
 298                 return -ENOENT;
 299         }
 300
 301         if (ses->server->tcpStatus == CifsNeedReconnect) {
 302                 cFYI(1, "tcp session dead - return to caller to retry");
 303                 return -EAGAIN;
 304         }
 305
 306         if (ses->status != CifsGood) {
 307                 /* check if SMB session is bad because we are setting it up */
 308                 if ((in_buf->Command != SMB_COM_SESSION_SETUP_ANDX) &&
 309                         (in_buf->Command != SMB_COM_NEGOTIATE))
 310                         return -EAGAIN;
 311                 /* else ok - we are setting up session */
 312         }
 313         *ppmidQ = AllocMidQEntry(in_buf, ses->server);
 314         if (*ppmidQ == NULL)
 315                 return -ENOMEM;
 316         spin_lock(&GlobalMid_Lock);
 317         list_add_tail(&(*ppmidQ)->qhead, &ses->server->pending_mid_q);
 318         spin_unlock(&GlobalMid_Lock);
 319         return 0;
 320 }
 321
 322 static int
 323 wait_for_response(struct TCP_Server_Info *server, struct mid_q_entry *midQ)
 324 {
 325         int error;
 326
 327         error = wait_event_killable(server->response_q,
 328                                     midQ->midState != MID_REQUEST_SUBMITTED);
 329         if (error < 0)
 330                 return -ERESTARTSYS;
 331
 332         return 0;
 333 }
 334
 335
 336 /*
 337  * Send a SMB request and set the callback function in the mid to handle
 338  * the result. Caller is responsible for dealing with timeouts.
 339  */
 340 int
 341 cifs_call_async(struct TCP_Server_Info *server, struct kvec *iov,
 342                 unsigned int nvec, mid_receive_t *receive,
 343                 mid_callback_t *callback, void *cbdata, bool ignore_pend)
 344 {
 345         int rc;
 346         struct mid_q_entry *mid;
 347         struct smb_hdr *hdr = (struct smb_hdr *)iov[0].iov_base;
 348
 349         rc = wait_for_free_request(server, ignore_pend ? CIFS_ASYNC_OP : 0);
 350         if (rc)
 351                 return rc;
 352
 353         /* enable signing if server requires it */
 354         if (server->sec_mode & (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
 355                 hdr->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
 356
 357         mutex_lock(&server->srv_mutex);
 358         mid = AllocMidQEntry(hdr, server);
 359         if (mid == NULL) {
 360                 mutex_unlock(&server->srv_mutex);
 361                 atomic_dec(&server->inFlight);
 362                 wake_up(&server->request_q);
 363                 return -ENOMEM;
 364         }
 365
 366         /* put it on the pending_mid_q */
 367         spin_lock(&GlobalMid_Lock);
 368         list_add_tail(&mid->qhead, &server->pending_mid_q);
 369         spin_unlock(&GlobalMid_Lock);
 370
 371         rc = cifs_sign_smb2(iov, nvec, server, &mid->sequence_number);
 372         if (rc) {
 373                 mutex_unlock(&server->srv_mutex);
 374                 goto out_err;
 375         }
 376
 377         mid->receive = receive;
 378         mid->callback = callback;
 379         mid->callback_data = cbdata;
 380         mid->midState = MID_REQUEST_SUBMITTED;
 381
 382         cifs_in_send_inc(server);
 383         rc = smb_sendv(server, iov, nvec);
 384         cifs_in_send_dec(server);
 385         cifs_save_when_sent(mid);
 386         mutex_unlock(&server->srv_mutex);
 387
 388         if (rc)
 389                 goto out_err;
 390
 391         return rc;
 392 out_err:
 393         delete_mid(mid);
 394         atomic_dec(&server->inFlight);
 395         wake_up(&server->request_q);
 396         return rc;
 397 }
 398
 399 /*
 400  *
 401  * Send an SMB Request.  No response info (other than return code)
 402  * needs to be parsed.
 403  *
 404  * flags indicate the type of request buffer and how long to wait
 405  * and whether to log NT STATUS code (error) before mapping it to POSIX error
 406  *
 407  */
 408 int
 409 SendReceiveNoRsp(const unsigned int xid, struct cifs_ses *ses,
 410                 struct smb_hdr *in_buf, int flags)
 411 {
 412         int rc;
 413         struct kvec iov[1];
 414         int resp_buf_type;
 415
 416         iov[0].iov_base = (char *)in_buf;
 417         iov[0].iov_len = be32_to_cpu(in_buf->smb_buf_length) + 4;
 418         flags |= CIFS_NO_RESP;
 419         rc = SendReceive2(xid, ses, iov, 1, &resp_buf_type, flags);
 420         cFYI(DBG2, "SendRcvNoRsp flags %d rc %d", flags, rc);
 421
 422         return rc;
 423 }
 424
 425 static int
 426 cifs_sync_mid_result(struct mid_q_entry *mid, struct TCP_Server_Info *server)
 427 {
 428         int rc = 0;
 429
 430         cFYI(1, "%s: cmd=%d mid=%d state=%d", __func__, mid->command,
 431                 mid->mid, mid->midState);
 432
 433         spin_lock(&GlobalMid_Lock);
 434         switch (mid->midState) {
 435         case MID_RESPONSE_RECEIVED:
 436                 spin_unlock(&GlobalMid_Lock);
 437                 return rc;
 438         case MID_RETRY_NEEDED:
 439                 rc = -EAGAIN;
 440                 break;
 441         case MID_RESPONSE_MALFORMED:
 442                 rc = -EIO;
 443                 break;
 444         case MID_SHUTDOWN:
 445                 rc = -EHOSTDOWN;
 446                 break;
 447         default:
 448                 list_del_init(&mid->qhead);
 449                 cERROR(1, "%s: invalid mid state mid=%d state=%d", __func__,
 450                         mid->mid, mid->midState);
 451                 rc = -EIO;
 452         }
 453         spin_unlock(&GlobalMid_Lock);
 454
 455         DeleteMidQEntry(mid);
 456         return rc;
 457 }
 458
 459 /*
 460  * An NT cancel request header looks just like the original request except:
 461  *
 462  * The Command is SMB_COM_NT_CANCEL
 463  * The WordCount is zeroed out
 464  * The ByteCount is zeroed out
 465  *
 466  * This function mangles an existing request buffer into a
 467  * SMB_COM_NT_CANCEL request and then sends it.
 468  */
 469 static int
 470 send_nt_cancel(struct TCP_Server_Info *server, struct smb_hdr *in_buf,
 471                 struct mid_q_entry *mid)
 472 {
 473         int rc = 0;
 474
 475         /* -4 for RFC1001 length and +2 for BCC field */
 476         in_buf->smb_buf_length = cpu_to_be32(sizeof(struct smb_hdr) - 4  + 2);
 477         in_buf->Command = SMB_COM_NT_CANCEL;
 478         in_buf->WordCount = 0;
 479         put_bcc(0, in_buf);
 480
 481         mutex_lock(&server->srv_mutex);
 482         rc = cifs_sign_smb(in_buf, server, &mid->sequence_number);
 483         if (rc) {
 484                 mutex_unlock(&server->srv_mutex);
 485                 return rc;
 486         }
 487         rc = smb_send(server, in_buf, be32_to_cpu(in_buf->smb_buf_length));
 488         mutex_unlock(&server->srv_mutex);
 489
 490         cFYI(1, "issued NT_CANCEL for mid %u, rc = %d",
 491                 in_buf->Mid, rc);
 492
 493         return rc;
 494 }
 495
 496 int
 497 cifs_check_receive(struct mid_q_entry *mid, struct TCP_Server_Info *server,
 498                    bool log_error)
 499 {
 500         unsigned int len = be32_to_cpu(mid->resp_buf->smb_buf_length) + 4;
 501
 502         dump_smb(mid->resp_buf, min_t(u32, 92, len));
 503
 504         /* convert the length into a more usable form */
 505         if (server->sec_mode & (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED)) {
 506                 struct kvec iov;
 507
 508                 iov.iov_base = mid->resp_buf;
 509                 iov.iov_len = len;
 510                 /* FIXME: add code to kill session */
 511                 if (cifs_verify_signature(&iov, 1, server,
 512                                           mid->sequence_number + 1) != 0)
 513                         cERROR(1, "Unexpected SMB signature");
 514         }
 515
 516         /* BB special case reconnect tid and uid here? */
 517         return map_smb_to_linux_error(mid->resp_buf, log_error);
 518 }
 519
 520 int
 521 SendReceive2(const unsigned int xid, struct cifs_ses *ses,
 522              struct kvec *iov, int n_vec, int *pRespBufType /* ret */,
 523              const int flags)
 524 {
 525         int rc = 0;
 526         int long_op;
 527         struct mid_q_entry *midQ;
 528         struct smb_hdr *in_buf = iov[0].iov_base;
 529
 530         long_op = flags & CIFS_TIMEOUT_MASK;
 531
 532         *pRespBufType = CIFS_NO_BUFFER;  /* no response buf yet */
 533
 534         if ((ses == NULL) || (ses->server == NULL)) {
 535                 cifs_small_buf_release(in_buf);
 536                 cERROR(1, "Null session");
 537                 return -EIO;
 538         }
 539
 540         if (ses->server->tcpStatus == CifsExiting) {
 541                 cifs_small_buf_release(in_buf);
 542                 return -ENOENT;
 543         }
 544
 545         /* Ensure that we do not send more than 50 overlapping requests
 546            to the same server. We may make this configurable later or
 547            use ses->maxReq */
 548
 549         rc = wait_for_free_request(ses->server, long_op);
 550         if (rc) {
 551                 cifs_small_buf_release(in_buf);
 552                 return rc;
 553         }
 554
 555         /* make sure that we sign in the same order that we send on this socket
 556            and avoid races inside tcp sendmsg code that could cause corruption
 557            of smb data */
 558
 559         mutex_lock(&ses->server->srv_mutex);
 560
 561         rc = allocate_mid(ses, in_buf, &midQ);
 562         if (rc) {
 563                 mutex_unlock(&ses->server->srv_mutex);
 564                 cifs_small_buf_release(in_buf);
 565                 /* Update # of requests on wire to server */
 566                 atomic_dec(&ses->server->inFlight);
 567                 wake_up(&ses->server->request_q);
 568                 return rc;
 569         }
 570         rc = cifs_sign_smb2(iov, n_vec, ses->server, &midQ->sequence_number);
 571         if (rc) {
 572                 mutex_unlock(&ses->server->srv_mutex);
 573                 cifs_small_buf_release(in_buf);
 574                 goto out;
 575         }
 576
 577         midQ->midState = MID_REQUEST_SUBMITTED;
 578         cifs_in_send_inc(ses->server);
 579         rc = smb_sendv(ses->server, iov, n_vec);
 580         cifs_in_send_dec(ses->server);
 581         cifs_save_when_sent(midQ);
 582
 583         mutex_unlock(&ses->server->srv_mutex);
 584
 585         if (rc < 0) {
 586                 cifs_small_buf_release(in_buf);
 587                 goto out;
 588         }
 589
 590         if (long_op == CIFS_ASYNC_OP) {
 591                 cifs_small_buf_release(in_buf);
 592                 goto out;
 593         }
 594
 595         rc = wait_for_response(ses->server, midQ);
 596         if (rc != 0) {
 597                 send_nt_cancel(ses->server, in_buf, midQ);
 598                 spin_lock(&GlobalMid_Lock);
 599                 if (midQ->midState == MID_REQUEST_SUBMITTED) {
 600                         midQ->callback = DeleteMidQEntry;
 601                         spin_unlock(&GlobalMid_Lock);
 602                         cifs_small_buf_release(in_buf);
 603                         atomic_dec(&ses->server->inFlight);
 604                         wake_up(&ses->server->request_q);
 605                         return rc;
 606                 }
 607                 spin_unlock(&GlobalMid_Lock);
 608         }
 609
 610         cifs_small_buf_release(in_buf);
 611
 612         rc = cifs_sync_mid_result(midQ, ses->server);
 613         if (rc != 0) {
 614                 atomic_dec(&ses->server->inFlight);
 615                 wake_up(&ses->server->request_q);
 616                 return rc;
 617         }
 618
 619         if (!midQ->resp_buf || midQ->midState != MID_RESPONSE_RECEIVED) {
 620                 rc = -EIO;
 621                 cFYI(1, "Bad MID state?");
 622                 goto out;
 623         }
 624
 625         iov[0].iov_base = (char *)midQ->resp_buf;
 626         iov[0].iov_len = be32_to_cpu(midQ->resp_buf->smb_buf_length) + 4;
 627         if (midQ->largeBuf)
 628                 *pRespBufType = CIFS_LARGE_BUFFER;
 629         else
 630                 *pRespBufType = CIFS_SMALL_BUFFER;
 631
 632         rc = cifs_check_receive(midQ, ses->server, flags & CIFS_LOG_ERROR);
 633
 634         /* mark it so buf will not be freed by delete_mid */
 635         if ((flags & CIFS_NO_RESP) == 0)
 636                 midQ->resp_buf = NULL;
 637 out:
 638         delete_mid(midQ);
 639         atomic_dec(&ses->server->inFlight);
 640         wake_up(&ses->server->request_q);
 641
 642         return rc;
 643 }
 644
 645 int
 646 SendReceive(const unsigned int xid, struct cifs_ses *ses,
 647             struct smb_hdr *in_buf, struct smb_hdr *out_buf,
 648             int *pbytes_returned, const int long_op)
 649 {
 650         int rc = 0;
 651         struct mid_q_entry *midQ;
 652
 653         if (ses == NULL) {
 654                 cERROR(1, "Null smb session");
 655                 return -EIO;
 656         }
 657         if (ses->server == NULL) {
 658                 cERROR(1, "Null tcp session");
 659                 return -EIO;
 660         }
 661
 662         if (ses->server->tcpStatus == CifsExiting)
 663                 return -ENOENT;
 664
 665         /* Ensure that we do not send more than 50 overlapping requests
 666            to the same server. We may make this configurable later or
 667            use ses->maxReq */
 668
 669         if (be32_to_cpu(in_buf->smb_buf_length) > CIFSMaxBufSize +
 670                         MAX_CIFS_HDR_SIZE - 4) {
 671                 cERROR(1, "Illegal length, greater than maximum frame, %d",
 672                            be32_to_cpu(in_buf->smb_buf_length));
 673                 return -EIO;
 674         }
 675
 676         rc = wait_for_free_request(ses->server, long_op);
 677         if (rc)
 678                 return rc;
 679
 680         /* make sure that we sign in the same order that we send on this socket
 681            and avoid races inside tcp sendmsg code that could cause corruption
 682            of smb data */
 683
 684         mutex_lock(&ses->server->srv_mutex);
 685
 686         rc = allocate_mid(ses, in_buf, &midQ);
 687         if (rc) {
 688                 mutex_unlock(&ses->server->srv_mutex);
 689                 /* Update # of requests on wire to server */
 690                 atomic_dec(&ses->server->inFlight);
 691                 wake_up(&ses->server->request_q);
 692                 return rc;
 693         }
 694
 695         rc = cifs_sign_smb(in_buf, ses->server, &midQ->sequence_number);
 696         if (rc) {
 697                 mutex_unlock(&ses->server->srv_mutex);
 698                 goto out;
 699         }
 700
 701         midQ->midState = MID_REQUEST_SUBMITTED;
 702
 703         cifs_in_send_inc(ses->server);
 704         rc = smb_send(ses->server, in_buf, be32_to_cpu(in_buf->smb_buf_length));
 705         cifs_in_send_dec(ses->server);
 706         cifs_save_when_sent(midQ);
 707         mutex_unlock(&ses->server->srv_mutex);
 708
 709         if (rc < 0)
 710                 goto out;
 711
 712         if (long_op == CIFS_ASYNC_OP)
 713                 goto out;
 714
 715         rc = wait_for_response(ses->server, midQ);
 716         if (rc != 0) {
 717                 send_nt_cancel(ses->server, in_buf, midQ);
 718                 spin_lock(&GlobalMid_Lock);
 719                 if (midQ->midState == MID_REQUEST_SUBMITTED) {
 720                         /* no longer considered to be "in-flight" */
 721                         midQ->callback = DeleteMidQEntry;
 722                         spin_unlock(&GlobalMid_Lock);
 723                         atomic_dec(&ses->server->inFlight);
 724                         wake_up(&ses->server->request_q);
 725                         return rc;
 726                 }
 727                 spin_unlock(&GlobalMid_Lock);
 728         }
 729
 730         rc = cifs_sync_mid_result(midQ, ses->server);
 731         if (rc != 0) {
 732                 atomic_dec(&ses->server->inFlight);
 733                 wake_up(&ses->server->request_q);
 734                 return rc;
 735         }
 736
 737         if (!midQ->resp_buf || !out_buf ||
 738             midQ->midState != MID_RESPONSE_RECEIVED) {
 739                 rc = -EIO;
 740                 cERROR(1, "Bad MID state?");
 741                 goto out;
 742         }
 743
 744         *pbytes_returned = be32_to_cpu(midQ->resp_buf->smb_buf_length);
 745         memcpy(out_buf, midQ->resp_buf, *pbytes_returned + 4);
 746         rc = cifs_check_receive(midQ, ses->server, 0);
 747 out:
 748         delete_mid(midQ);
 749         atomic_dec(&ses->server->inFlight);
 750         wake_up(&ses->server->request_q);
 751
 752         return rc;
 753 }
 754
 755 /* We send a LOCKINGX_CANCEL_LOCK to cause the Windows
 756    blocking lock to return. */
 757
 758 static int
 759 send_lock_cancel(const unsigned int xid, struct cifs_tcon *tcon,
 760                         struct smb_hdr *in_buf,
 761                         struct smb_hdr *out_buf)
 762 {
 763         int bytes_returned;
 764         struct cifs_ses *ses = tcon->ses;
 765         LOCK_REQ *pSMB = (LOCK_REQ *)in_buf;
 766
 767         /* We just modify the current in_buf to change
 768            the type of lock from LOCKING_ANDX_SHARED_LOCK
 769            or LOCKING_ANDX_EXCLUSIVE_LOCK to
 770            LOCKING_ANDX_CANCEL_LOCK. */
 771
 772         pSMB->LockType = LOCKING_ANDX_CANCEL_LOCK|LOCKING_ANDX_LARGE_FILES;
 773         pSMB->Timeout = 0;
 774         pSMB->hdr.Mid = GetNextMid(ses->server);
 775
 776         return SendReceive(xid, ses, in_buf, out_buf,
 777                         &bytes_returned, 0);
 778 }
 779
 780 int
 781 SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon,
 782             struct smb_hdr *in_buf, struct smb_hdr *out_buf,
 783             int *pbytes_returned)
 784 {
 785         int rc = 0;
 786         int rstart = 0;
 787         struct mid_q_entry *midQ;
 788         struct cifs_ses *ses;
 789
 790         if (tcon == NULL || tcon->ses == NULL) {
 791                 cERROR(1, "Null smb session");
 792                 return -EIO;
 793         }
 794         ses = tcon->ses;
 795
 796         if (ses->server == NULL) {
 797                 cERROR(1, "Null tcp session");
 798                 return -EIO;
 799         }
 800
 801         if (ses->server->tcpStatus == CifsExiting)
 802                 return -ENOENT;
 803
 804         /* Ensure that we do not send more than 50 overlapping requests
 805            to the same server. We may make this configurable later or
 806            use ses->maxReq */
 807
 808         if (be32_to_cpu(in_buf->smb_buf_length) > CIFSMaxBufSize +
 809                         MAX_CIFS_HDR_SIZE - 4) {
 810                 cERROR(1, "Illegal length, greater than maximum frame, %d",
 811                            be32_to_cpu(in_buf->smb_buf_length));
 812                 return -EIO;
 813         }
 814
 815         rc = wait_for_free_request(ses->server, CIFS_BLOCKING_OP);
 816         if (rc)
 817                 return rc;
 818
 819         /* make sure that we sign in the same order that we send on this socket
 820            and avoid races inside tcp sendmsg code that could cause corruption
 821            of smb data */
 822
 823         mutex_lock(&ses->server->srv_mutex);
 824
 825         rc = allocate_mid(ses, in_buf, &midQ);
 826         if (rc) {
 827                 mutex_unlock(&ses->server->srv_mutex);
 828                 return rc;
 829         }
 830
 831         rc = cifs_sign_smb(in_buf, ses->server, &midQ->sequence_number);
 832         if (rc) {
 833                 delete_mid(midQ);
 834                 mutex_unlock(&ses->server->srv_mutex);
 835                 return rc;
 836         }
 837
 838         midQ->midState = MID_REQUEST_SUBMITTED;
 839         cifs_in_send_inc(ses->server);
 840         rc = smb_send(ses->server, in_buf, be32_to_cpu(in_buf->smb_buf_length));
 841         cifs_in_send_dec(ses->server);
 842         cifs_save_when_sent(midQ);
 843         mutex_unlock(&ses->server->srv_mutex);
 844
 845         if (rc < 0) {
 846                 delete_mid(midQ);
 847                 return rc;
 848         }
 849
 850         /* Wait for a reply - allow signals to interrupt. */
 851         rc = wait_event_interruptible(ses->server->response_q,
 852                 (!(midQ->midState == MID_REQUEST_SUBMITTED)) ||
 853                 ((ses->server->tcpStatus != CifsGood) &&
 854                  (ses->server->tcpStatus != CifsNew)));
 855
 856         /* Were we interrupted by a signal ? */
 857         if ((rc == -ERESTARTSYS) &&
 858                 (midQ->midState == MID_REQUEST_SUBMITTED) &&
 859                 ((ses->server->tcpStatus == CifsGood) ||
 860                  (ses->server->tcpStatus == CifsNew))) {
 861
 862                 if (in_buf->Command == SMB_COM_TRANSACTION2) {
 863                         /* POSIX lock. We send a NT_CANCEL SMB to cause the
 864                            blocking lock to return. */
 865                         rc = send_nt_cancel(ses->server, in_buf, midQ);
 866                         if (rc) {
 867                                 delete_mid(midQ);
 868                                 return rc;
 869                         }
 870                 } else {
 871                         /* Windows lock. We send a LOCKINGX_CANCEL_LOCK
 872                            to cause the blocking lock to return. */
 873
 874                         rc = send_lock_cancel(xid, tcon, in_buf, out_buf);
 875
 876                         /* If we get -ENOLCK back the lock may have
 877                            already been removed. Don't exit in this case. */
 878                         if (rc && rc != -ENOLCK) {
 879                                 delete_mid(midQ);
 880                                 return rc;
 881                         }
 882                 }
 883
 884                 rc = wait_for_response(ses->server, midQ);
 885                 if (rc) {
 886                         send_nt_cancel(ses->server, in_buf, midQ);
 887                         spin_lock(&GlobalMid_Lock);
 888                         if (midQ->midState == MID_REQUEST_SUBMITTED) {
 889                                 /* no longer considered to be "in-flight" */
 890                                 midQ->callback = DeleteMidQEntry;
 891                                 spin_unlock(&GlobalMid_Lock);
 892                                 return rc;
 893                         }
 894                         spin_unlock(&GlobalMid_Lock);
 895                 }
 896
 897                 /* We got the response - restart system call. */
 898                 rstart = 1;
 899         }
 900
 901         rc = cifs_sync_mid_result(midQ, ses->server);
 902         if (rc != 0)
 903                 return rc;
 904
 905         /* rcvd frame is ok */
 906         if (out_buf == NULL || midQ->midState != MID_RESPONSE_RECEIVED) {
 907                 rc = -EIO;
 908                 cERROR(1, "Bad MID state?");
 909                 goto out;
 910         }
 911
 912         *pbytes_returned = be32_to_cpu(midQ->resp_buf->smb_buf_length);
 913         memcpy(out_buf, midQ->resp_buf, *pbytes_returned + 4);
 914         rc = cifs_check_receive(midQ, ses->server, 0);
 915 out:
 916         delete_mid(midQ);
 917         if (rstart && rc == -EACCES)
 918                 return -ERESTARTSYS;
 919         return rc;
 920 }