/*++ Copyright (c) 1989, 1990, 1991 Microsoft Corporation Module Name: connobj.c Abstract: This module contains code which implements the TP_CONNECTION object. Routines are provided to create, destroy, reference, and dereference, transport connection objects. A word about connection reference counts: With TDI version 2, connections live on even after they have been stopped. This necessitated changing the way NBF handles connection reference counts, making the stopping of a connection only another way station in the life of a connection, rather than its demise. Reference counts now work like this: Connection State Reference Count Flags ------------------ ----------------- -------- Opened, no activity 1 0 Open, Associated 2 FLAGS2_ASSOCIATED Open, Assoc., Connected 3 FLAGS_READY Above + activity >3 varies Open, Assoc., Stopping >3 FLAGS_STOPPING Open, Assoc., Stopped 3 FLAGS_STOPPING Open, Disassoc. Complete 2 FLAGS_STOPPING FLAGS2_ASSOCIATED == 0 Closing 1 FLAGS2_CLOSING Closed 0 FLAGS2_CLOSING Note that keeping the stopping flag set when the connection has fully stopped avoids using the connection until it is connected again; the CLOSING flag serves the same purpose. This allows a connection to run down in its own time. Author: David Beaver (dbeaver) 1 July 1991 Environment: Kernel mode Revision History: --*/ #include "precomp.h" #pragma hdrstop #ifdef RASAUTODIAL #include #include #endif // RASAUTODIAL #ifdef RASAUTODIAL extern BOOLEAN fAcdLoadedG; extern ACD_DRIVER AcdDriverG; // // Imported routines // BOOLEAN NbfAttemptAutoDial( IN PTP_CONNECTION Connection, IN ULONG ulFlags, IN ACD_CONNECT_CALLBACK pProc, IN PVOID pArg ); VOID NbfRetryTdiConnect( IN BOOLEAN fSuccess, IN PVOID *pArgs ); BOOLEAN NbfCancelTdiConnect( IN PDEVICE_OBJECT pDeviceObject, IN PIRP pIrp ); #endif // RASAUTODIAL VOID ConnectionEstablishmentTimeout( IN PKDPC Dpc, IN PVOID DeferredContext, IN PVOID SystemArgument1, IN PVOID SystemArgument2 ) /*++ Routine Description: This routine is executed as a DPC at DISPATCH_LEVEL when the timeout period for the NAME_QUERY/NAME_RECOGNIZED protocol expires. The retry count in the Connection object is decremented, and if it reaches 0, the connection is aborted. If the retry count has not reached zero, then the NAME QUERY is retried. The following cases are covered by this routine: 1. Initial NAME_QUERY timeout for find_name portion of connection setup. NQ(find_name) -------------------> [TIMEOUT] NQ(find_name) -------------------> <------------------- NR(find_name) 2. Secondary NAME_QUERY timeout for connection setup. NQ(connection) -------------------> [TIMEOUT] NQ(connection) -------------------> <------------------- NR(connection) There is another case where the data link connection does not get established within a reasonable amount of time. This is handled by the link layer routines. Arguments: Dpc - Pointer to a system DPC object. DeferredContext - Pointer to the TP_CONNECTION block representing the request that has timed out. SystemArgument1 - Not used. SystemArgument2 - Not used. Return Value: none. --*/ { PTP_CONNECTION Connection; Dpc, SystemArgument1, SystemArgument2; // prevent compiler warnings ENTER_NBF; Connection = (PTP_CONNECTION)DeferredContext; IF_NBFDBG (NBF_DEBUG_CONNOBJ) { NbfPrint1 ("ConnectionEstablishmentTimeout: Entered for connection %lx.\n", Connection); } // // If this connection is being run down, then we can't do anything. // ACQUIRE_DPC_C_SPIN_LOCK (&Connection->SpinLock); if (Connection->Flags2 & CONNECTION_FLAGS2_STOPPING) { RELEASE_DPC_C_SPIN_LOCK (&Connection->SpinLock); NbfDereferenceConnection ("Connect timed out", Connection, CREF_TIMER); LEAVE_NBF; return; } if (Connection->Flags2 & (CONNECTION_FLAGS2_WAIT_NR_FN | CONNECTION_FLAGS2_WAIT_NR)) { // // We are waiting for a commital or non-commital NAME_RECOGNIZED frame. // Decrement the retry count, and possibly resend the NAME_QUERY. // if (--(Connection->Retries) == 0) { // if retry count exhausted. NTSTATUS StopStatus; // // See if we got a no listens response, or just // nothing. // if ((Connection->Flags2 & CONNECTION_FLAGS2_NO_LISTEN) != 0) { Connection->Flags2 &= ~CONNECTION_FLAGS2_NO_LISTEN; StopStatus = STATUS_REMOTE_NOT_LISTENING; // no listens } else { StopStatus = STATUS_BAD_NETWORK_PATH; // name not found. } #ifdef RASAUTODIAL // // If this is a connect operation that has // returned with STATUS_BAD_NETWORK_PATH, then // attempt to create an automatic connection. // if (fAcdLoadedG && StopStatus == STATUS_BAD_NETWORK_PATH) { KIRQL adirql; BOOLEAN fEnabled; ACQUIRE_SPIN_LOCK(&AcdDriverG.SpinLock, &adirql); fEnabled = AcdDriverG.fEnabled; RELEASE_SPIN_LOCK(&AcdDriverG.SpinLock, adirql); if (fEnabled && NbfAttemptAutoDial( Connection, 0, NbfRetryTdiConnect, Connection)) { RELEASE_DPC_C_SPIN_LOCK (&Connection->SpinLock); goto done; } } #endif // RASAUTODIAL RELEASE_DPC_C_SPIN_LOCK (&Connection->SpinLock); NbfStopConnection (Connection, StopStatus); } else { RELEASE_DPC_C_SPIN_LOCK (&Connection->SpinLock); // // We make source routing optional on every second // name query (whenever Retries is even). // NbfSendNameQuery ( Connection, (BOOLEAN)((Connection->Retries & 1) ? FALSE : TRUE)); NbfStartConnectionTimer ( Connection, ConnectionEstablishmentTimeout, Connection->Provider->NameQueryTimeout); } } else { RELEASE_DPC_C_SPIN_LOCK (&Connection->SpinLock); } // // Dereference the connection, to account for the fact that the // timer went off. Note that if we restarted the timer using // NbfStartConnectionTimer, the reference count has already been // incremented to account for the new timer. // done: NbfDereferenceConnection ("Timer timed out",Connection, CREF_TIMER); LEAVE_NBF; return; } /* ConnectionEstablishmentTimeout */ VOID NbfAllocateConnection( IN PDEVICE_CONTEXT DeviceContext, OUT PTP_CONNECTION *TransportConnection ) /*++ Routine Description: This routine allocates storage for a transport connection. Some minimal initialization is done. NOTE: This routine is called with the device context spinlock held, or at such a time as synchronization is unnecessary. Arguments: DeviceContext - the device context for this connection to be associated with. TransportConnection - Pointer to a place where this routine will return a pointer to a transport connection structure. Returns NULL if the storage cannot be allocated. Return Value: None. --*/ { PTP_CONNECTION Connection; if ((DeviceContext->MemoryLimit != 0) && ((DeviceContext->MemoryUsage + sizeof(TP_CONNECTION)) > DeviceContext->MemoryLimit)) { PANIC("NBF: Could not allocate connection: limit\n"); NbfWriteResourceErrorLog( DeviceContext, EVENT_TRANSPORT_RESOURCE_LIMIT, 103, sizeof(TP_CONNECTION), CONNECTION_RESOURCE_ID); *TransportConnection = NULL; return; } Connection = (PTP_CONNECTION)ExAllocatePoolWithTag ( NonPagedPool, sizeof (TP_CONNECTION), NBF_MEM_TAG_TP_CONNECTION); if (Connection == NULL) { PANIC("NBF: Could not allocate connection: no pool\n"); NbfWriteResourceErrorLog( DeviceContext, EVENT_TRANSPORT_RESOURCE_POOL, 203, sizeof(TP_CONNECTION), CONNECTION_RESOURCE_ID); *TransportConnection = NULL; return; } RtlZeroMemory (Connection, sizeof(TP_CONNECTION)); IF_NBFDBG (NBF_DEBUG_DYNAMIC) { NbfPrint1 ("ExAllocatePool Connection %08x\n", Connection); } DeviceContext->MemoryUsage += sizeof(TP_CONNECTION); ++DeviceContext->ConnectionAllocated; Connection->Type = NBF_CONNECTION_SIGNATURE; Connection->Size = sizeof (TP_CONNECTION); Connection->Provider = DeviceContext; Connection->ProviderInterlock = &DeviceContext->Interlock; KeInitializeSpinLock (&Connection->SpinLock); KeInitializeDpc ( &Connection->Dpc, ConnectionEstablishmentTimeout, (PVOID)Connection); KeInitializeTimer (&Connection->Timer); InitializeListHead (&Connection->LinkList); InitializeListHead (&Connection->AddressFileList); InitializeListHead (&Connection->AddressList); InitializeListHead (&Connection->PacketWaitLinkage); InitializeListHead (&Connection->PacketizeLinkage); InitializeListHead (&Connection->SendQueue); InitializeListHead (&Connection->ReceiveQueue); InitializeListHead (&Connection->InProgressRequest); InitializeListHead (&Connection->DeferredQueue); NbfAddSendPacket (DeviceContext); NbfAddSendPacket (DeviceContext); NbfAddUIFrame (DeviceContext); *TransportConnection = Connection; } /* NbfAllocateConnection */ VOID NbfDeallocateConnection( IN PDEVICE_CONTEXT DeviceContext, IN PTP_CONNECTION TransportConnection ) /*++ Routine Description: This routine frees storage for a transport connection. NOTE: This routine is called with the device context spinlock held, or at such a time as synchronization is unnecessary. Arguments: DeviceContext - the device context for this connection to be associated with. TransportConnection - Pointer to a transport connection structure. Return Value: None. --*/ { IF_NBFDBG (NBF_DEBUG_DYNAMIC) { NbfPrint1 ("ExFreePool Connection: %08x\n", TransportConnection); } ExFreePool (TransportConnection); --DeviceContext->ConnectionAllocated; DeviceContext->MemoryUsage -= sizeof(TP_CONNECTION); NbfRemoveSendPacket (DeviceContext); NbfRemoveSendPacket (DeviceContext); NbfRemoveUIFrame (DeviceContext); } /* NbfDeallocateConnection */ NTSTATUS NbfCreateConnection( IN PDEVICE_CONTEXT DeviceContext, OUT PTP_CONNECTION *TransportConnection ) /*++ Routine Description: This routine creates a transport connection. The reference count in the connection is automatically set to 1, and the reference count in the DeviceContext is incremented. Arguments: Address - the address for this connection to be associated with. TransportConnection - Pointer to a place where this routine will return a pointer to a transport connection structure. Return Value: NTSTATUS - status of operation. --*/ { PTP_CONNECTION Connection; KIRQL oldirql; PLIST_ENTRY p; IF_NBFDBG (NBF_DEBUG_CONNOBJ) { NbfPrint0 ("NbfCreateConnection: Entered.\n"); } ACQUIRE_SPIN_LOCK (&DeviceContext->SpinLock, &oldirql); p = RemoveHeadList (&DeviceContext->ConnectionPool); if (p == &DeviceContext->ConnectionPool) { if ((DeviceContext->ConnectionMaxAllocated == 0) || (DeviceContext->ConnectionAllocated < DeviceContext->ConnectionMaxAllocated)) { NbfAllocateConnection (DeviceContext, &Connection); IF_NBFDBG (NBF_DEBUG_DYNAMIC) { NbfPrint1 ("NBF: Allocated connection at %lx\n", Connection); } } else { NbfWriteResourceErrorLog( DeviceContext, EVENT_TRANSPORT_RESOURCE_SPECIFIC, 403, sizeof(TP_CONNECTION), CONNECTION_RESOURCE_ID); Connection = NULL; } if (Connection == NULL) { ++DeviceContext->ConnectionExhausted; RELEASE_SPIN_LOCK (&DeviceContext->SpinLock, oldirql); PANIC ("NbfCreateConnection: Could not allocate connection object!\n"); return STATUS_INSUFFICIENT_RESOURCES; } } else { Connection = CONTAINING_RECORD (p, TP_CONNECTION, LinkList); #if DBG InitializeListHead (p); #endif } ++DeviceContext->ConnectionInUse; if (DeviceContext->ConnectionInUse > DeviceContext->ConnectionMaxInUse) { ++DeviceContext->ConnectionMaxInUse; } DeviceContext->ConnectionTotal += DeviceContext->ConnectionInUse; ++DeviceContext->ConnectionSamples; RELEASE_SPIN_LOCK (&DeviceContext->SpinLock, oldirql); IF_NBFDBG (NBF_DEBUG_TEARDOWN) { NbfPrint1 ("NbfCreateConnection: Connection at %lx.\n", Connection); } // // We have two references; one is for creation, and the // other is a temporary one so that the connection won't // go away before the creator has a chance to access it. // Connection->SpecialRefCount = 1; Connection->ReferenceCount = -1; // this is -1 based #if DBG { UINT Counter; for (Counter = 0; Counter < NUMBER_OF_CREFS; Counter++) { Connection->RefTypes[Counter] = 0; } // This reference is removed by NbfCloseConnection Connection->RefTypes[CREF_SPECIAL_CREATION] = 1; } #endif // // Initialize the request queues & components of this connection. // InitializeListHead (&Connection->SendQueue); InitializeListHead (&Connection->ReceiveQueue); InitializeListHead (&Connection->InProgressRequest); InitializeListHead (&Connection->AddressList); InitializeListHead (&Connection->AddressFileList); Connection->SpecialReceiveIrp = (PIRP)NULL; Connection->Flags = 0; Connection->Flags2 = 0; Connection->DeferredFlags = 0; Connection->Lsn = 0; Connection->Rsn = 0; Connection->Retries = 0; // no retries yet. Connection->MessageBytesReceived = 0; // no data yet Connection->MessageBytesAcked = 0; Connection->MessageInitAccepted = 0; Connection->ReceiveBytesUnaccepted = 0; Connection->CurrentReceiveAckQueueable = FALSE; Connection->CurrentReceiveSynchronous = FALSE; Connection->ConsecutiveSends = 0; Connection->ConsecutiveReceives = 0; Connection->Link = NULL; // no datalink connection yet. Connection->LinkSpinLock = NULL; Connection->Context = NULL; // no context yet. Connection->Status = STATUS_PENDING; // default NbfStopConnection status. Connection->SendState = CONNECTION_SENDSTATE_IDLE; Connection->CurrentReceiveIrp = (PIRP)NULL; Connection->DisconnectIrp = (PIRP)NULL; Connection->CloseIrp = (PIRP)NULL; Connection->AddressFile = NULL; Connection->IndicationInProgress = FALSE; Connection->OnDataAckQueue = FALSE; Connection->OnPacketWaitQueue = FALSE; Connection->TransferBytesPending = 0; Connection->TotalTransferBytesPending = 0; RtlZeroMemory (&Connection->NetbiosHeader, sizeof(NBF_HDR_CONNECTION)); #if PKT_LOG RtlZeroMemory (&Connection->LastNRecvs, sizeof(PKT_LOG_QUE)); RtlZeroMemory (&Connection->LastNSends, sizeof(PKT_LOG_QUE)); RtlZeroMemory (&Connection->LastNIndcs, sizeof(PKT_IND_QUE)); #endif // PKT_LOG #if DBG Connection->Destroyed = FALSE; Connection->TotalReferences = 0; Connection->TotalDereferences = 0; Connection->NextRefLoc = 0; ExInterlockedInsertHeadList (&NbfGlobalConnectionList, &Connection->GlobalLinkage, &NbfGlobalInterlock); StoreConnectionHistory (Connection, TRUE); #endif // // Now assign this connection an ID. This is used later to identify the // connection across multiple processes. // // The high bit of the ID is not user, it is off for connection // initiating NAME.QUERY frames and on for ones that are the result // of a FIND.NAME request. // ACQUIRE_SPIN_LOCK (&DeviceContext->SpinLock, &oldirql); Connection->ConnectionId = DeviceContext->UniqueIdentifier; ++DeviceContext->UniqueIdentifier; if (DeviceContext->UniqueIdentifier == 0x8000) { DeviceContext->UniqueIdentifier = 1; } NbfReferenceDeviceContext ("Create Connection", DeviceContext, DCREF_CONNECTION); RELEASE_SPIN_LOCK (&DeviceContext->SpinLock, oldirql); *TransportConnection = Connection; // return the connection. return STATUS_SUCCESS; } /* NbfCreateConnection */ NTSTATUS NbfVerifyConnectionObject ( IN PTP_CONNECTION Connection ) /*++ Routine Description: This routine is called to verify that the pointer given us in a file object is in fact a valid connection object. Arguments: Connection - potential pointer to a TP_CONNECTION object. Return Value: STATUS_SUCCESS if all is well; STATUS_INVALID_CONNECTION otherwise --*/ { KIRQL oldirql; NTSTATUS status = STATUS_SUCCESS; // // try to verify the connection signature. If the signature is valid, // get the connection spinlock, check its state, and increment the // reference count if it's ok to use it. Note that being in the stopping // state is an OK place to be and reference the connection; we can // disassociate the address while running down. // try { if ((Connection != (PTP_CONNECTION)NULL) && (Connection->Size == sizeof (TP_CONNECTION)) && (Connection->Type == NBF_CONNECTION_SIGNATURE)) { ACQUIRE_C_SPIN_LOCK (&Connection->SpinLock, &oldirql); if ((Connection->Flags2 & CONNECTION_FLAGS2_CLOSING) == 0) { NbfReferenceConnection ("Verify Temp Use", Connection, CREF_BY_ID); } else { status = STATUS_INVALID_CONNECTION; } RELEASE_C_SPIN_LOCK (&Connection->SpinLock, oldirql); } else { status = STATUS_INVALID_CONNECTION; } } except(EXCEPTION_EXECUTE_HANDLER) { return GetExceptionCode(); } return status; } NTSTATUS NbfDestroyAssociation( IN PTP_CONNECTION TransportConnection ) /*++ Routine Description: This routine destroys the association between a transport connection and the address it was formerly associated with. The only action taken is to disassociate the address and remove the connection from all address queues. This routine is only called by NbfDereferenceConnection. The reason for this is that there may be multiple streams of execution which are simultaneously referencing the same connection object, and it should not be deleted out from under an interested stream of execution. Arguments: TransportConnection - Pointer to a transport connection structure to be destroyed. Return Value: NTSTATUS - status of operation. --*/ { KIRQL oldirql, oldirql2; PTP_ADDRESS address; PTP_ADDRESS_FILE addressFile; BOOLEAN NotAssociated = FALSE; IF_NBFDBG (NBF_DEBUG_CONNOBJ) { NbfPrint1 ("NbfDestroyAssociation: Entered for connection %lx.\n", TransportConnection); } try { ACQUIRE_C_SPIN_LOCK (&TransportConnection->SpinLock, &oldirql2); if ((TransportConnection->Flags2 & CONNECTION_FLAGS2_ASSOCIATED) == 0) { #if DBG if (!(IsListEmpty(&TransportConnection->AddressList)) || !(IsListEmpty(&TransportConnection->AddressFileList))) { DbgPrint ("NBF: C %lx, AF %lx, freed while still queued\n", TransportConnection, TransportConnection->AddressFile); DbgBreakPoint(); } #endif RELEASE_C_SPIN_LOCK (&TransportConnection->SpinLock, oldirql2); NotAssociated = TRUE; } else { TransportConnection->Flags2 &= ~CONNECTION_FLAGS2_ASSOCIATED; RELEASE_C_SPIN_LOCK (&TransportConnection->SpinLock, oldirql2); } } except(EXCEPTION_EXECUTE_HANDLER) { DbgPrint ("NBF: Got exception 1 in NbfDestroyAssociation\n"); DbgBreakPoint(); RELEASE_C_SPIN_LOCK (&TransportConnection->SpinLock, oldirql2); } if (NotAssociated) { return STATUS_SUCCESS; } addressFile = TransportConnection->AddressFile; address = addressFile->Address; // // Delink this connection from its associated address connection // database. To do this we must spin lock on the address object as // well as on the connection, // ACQUIRE_SPIN_LOCK (&address->SpinLock, &oldirql); try { ACQUIRE_C_SPIN_LOCK (&TransportConnection->SpinLock, &oldirql2); RemoveEntryList (&TransportConnection->AddressFileList); RemoveEntryList (&TransportConnection->AddressList); InitializeListHead (&TransportConnection->AddressList); InitializeListHead (&TransportConnection->AddressFileList); // // remove the association between the address and the connection. // TransportConnection->AddressFile = NULL; RELEASE_C_SPIN_LOCK (&TransportConnection->SpinLock, oldirql2); } except(EXCEPTION_EXECUTE_HANDLER) { DbgPrint ("NBF: Got exception 2 in NbfDestroyAssociation\n"); DbgBreakPoint(); RELEASE_C_SPIN_LOCK (&TransportConnection->SpinLock, oldirql2); } RELEASE_SPIN_LOCK (&address->SpinLock, oldirql); // // and remove a reference to the address // NbfDereferenceAddress ("Destroy association", address, AREF_CONNECTION); return STATUS_SUCCESS; } /* NbfDestroyAssociation */ NTSTATUS NbfIndicateDisconnect( IN PTP_CONNECTION TransportConnection ) /*++ Routine Description: This routine indicates a remote disconnection on this connection if it is necessary to do so. No other action is taken here. This routine is only called by NbfDereferenceConnection. The reason for this is that there may be multiple streams of execution which are simultaneously referencing the same connection object, and it should not be deleted out from under an interested stream of execution. Arguments: TransportConnection - Pointer to a transport connection structure to be destroyed. Return Value: NTSTATUS - status of operation. --*/ { PTP_ADDRESS_FILE addressFile; PDEVICE_CONTEXT DeviceContext; ULONG DisconnectReason; PIRP DisconnectIrp; KIRQL oldirql; ULONG Lflags2; IF_NBFDBG (NBF_DEBUG_CONNOBJ) { NbfPrint1 ("NbfIndicateDisconnect: Entered for connection %lx.\n", TransportConnection); } try { ACQUIRE_C_SPIN_LOCK (&TransportConnection->SpinLock, &oldirql); if (((TransportConnection->Flags2 & CONNECTION_FLAGS2_REQ_COMPLETED) != 0)) { ASSERT (TransportConnection->Lsn == 0); // // Turn off all but the still-relevant bits in the flags. // Lflags2 = TransportConnection->Flags2; TransportConnection->Flags2 &= (CONNECTION_FLAGS2_ASSOCIATED | CONNECTION_FLAGS2_DISASSOCIATED | CONNECTION_FLAGS2_CLOSING); TransportConnection->Flags2 |= CONNECTION_FLAGS2_STOPPING; // // Clean up other stuff -- basically everything gets // done here except for the flags and the status, since // they are used to block other requests. When the connection // is given back to us (in Accept, Connect, or Listen) // they are cleared. // TransportConnection->NetbiosHeader.TransmitCorrelator = 0; TransportConnection->Retries = 0; // no retries yet. TransportConnection->MessageBytesReceived = 0; // no data yet TransportConnection->MessageBytesAcked = 0; TransportConnection->MessageInitAccepted = 0; TransportConnection->ReceiveBytesUnaccepted = 0; TransportConnection->ConsecutiveSends = 0; TransportConnection->ConsecutiveReceives = 0; TransportConnection->SendState = CONNECTION_SENDSTATE_IDLE; TransportConnection->TransmittedTsdus = 0; TransportConnection->ReceivedTsdus = 0; TransportConnection->CurrentReceiveIrp = (PIRP)NULL; DisconnectIrp = TransportConnection->DisconnectIrp; TransportConnection->DisconnectIrp = (PIRP)NULL; if ((TransportConnection->Flags2 & CONNECTION_FLAGS2_ASSOCIATED) != 0) { addressFile = TransportConnection->AddressFile; } else { addressFile = NULL; } RELEASE_C_SPIN_LOCK (&TransportConnection->SpinLock, oldirql); DeviceContext = TransportConnection->Provider; // // If this connection was stopped by a call to TdiDisconnect, // we have to complete that. We save the Irp so we can return // the connection to the pool before we complete the request. // if (DisconnectIrp != (PIRP)NULL || (Lflags2 & CONNECTION_FLAGS2_LDISC) != 0) { if (DisconnectIrp != (PIRP)NULL) { IF_NBFDBG (NBF_DEBUG_SETUP) { NbfPrint1("IndicateDisconnect %lx, complete IRP\n", TransportConnection); } // // Now complete the IRP if needed. This will be non-null // only if TdiDisconnect was called, and we have not // yet completed it. // DisconnectIrp->IoStatus.Information = 0; DisconnectIrp->IoStatus.Status = STATUS_SUCCESS; IoCompleteRequest (DisconnectIrp, IO_NETWORK_INCREMENT); } } else if ((TransportConnection->Status != STATUS_LOCAL_DISCONNECT) && (addressFile != NULL) && (addressFile->RegisteredDisconnectHandler == TRUE)) { // // This was a remotely spawned disconnect, so indicate that // to our client. Note that in the comparison above we // check the status first, since if it is LOCAL_DISCONNECT // addressFile may be NULL (This is sort of a hack // for PDK2, we should really indicate the disconnect inside // NbfStopConnection, where we know addressFile is valid). // IF_NBFDBG (NBF_DEBUG_SETUP) { NbfPrint1("IndicateDisconnect %lx, indicate\n", TransportConnection); } // // if the disconnection was remotely spawned, then indicate // disconnect. In the case that a disconnect was issued at // the same time as the connection went down remotely, we // won't do this because DisconnectIrp will be non-NULL. // IF_NBFDBG (NBF_DEBUG_TEARDOWN) { NbfPrint1 ("NbfIndicateDisconnect calling DisconnectHandler, refcnt=%ld\n", TransportConnection->ReferenceCount); } // // Invoke the user's disconnection event handler, if any. We do this here // so that any outstanding sends will complete before we tear down the // connection. // DisconnectReason = 0; if (TransportConnection->Flags2 & CONNECTION_FLAGS2_ABORT) { DisconnectReason |= TDI_DISCONNECT_ABORT; } if (TransportConnection->Flags2 & CONNECTION_FLAGS2_DESTROY) { DisconnectReason |= TDI_DISCONNECT_RELEASE; } (*addressFile->DisconnectHandler)( addressFile->DisconnectHandlerContext, TransportConnection->Context, 0, NULL, 0, NULL, TDI_DISCONNECT_ABORT); #if MAGIC if (NbfEnableMagic) { extern VOID NbfSendMagicBullet (PDEVICE_CONTEXT, PTP_LINK); NbfSendMagicBullet (DeviceContext, NULL); } #endif } } else { // // The client does not yet think that this connection // is up...generally this happens due to request count // fluctuation during connection setup. // RELEASE_C_SPIN_LOCK (&TransportConnection->SpinLock, oldirql); } } except(EXCEPTION_EXECUTE_HANDLER) { DbgPrint ("NBF: Got exception in NbfIndicateDisconnect\n"); DbgBreakPoint(); RELEASE_C_SPIN_LOCK (&TransportConnection->SpinLock, oldirql); } return STATUS_SUCCESS; } /* NbfIndicateDisconnect */ NTSTATUS NbfDestroyConnection( IN PTP_CONNECTION TransportConnection ) /*++ Routine Description: This routine destroys a transport connection and removes all references made by it to other objects in the transport. The connection structure is returned to our lookaside list. It is assumed that the caller has removed all IRPs from the connections's queues first. This routine is only called by NbfDereferenceConnection. The reason for this is that there may be multiple streams of execution which are simultaneously referencing the same connection object, and it should not be deleted out from under an interested stream of execution. Arguments: TransportConnection - Pointer to a transport connection structure to be destroyed. Return Value: NTSTATUS - status of operation. --*/ { KIRQL oldirql; PDEVICE_CONTEXT DeviceContext; PIRP CloseIrp; IF_NBFDBG (NBF_DEBUG_CONNOBJ) { NbfPrint1 ("NbfDestroyConnection: Entered for connection %lx.\n", TransportConnection); } #if DBG if (TransportConnection->Destroyed) { NbfPrint1 ("attempt to destroy already-destroyed connection 0x%lx\n", TransportConnection); DbgBreakPoint (); } if (!(TransportConnection->Flags2 & CONNECTION_FLAGS2_STOPPING)) { NbfPrint1 ("attempt to destroy unstopped connection 0x%lx\n", TransportConnection); DbgBreakPoint (); } TransportConnection->Destroyed = TRUE; ACQUIRE_SPIN_LOCK (&NbfGlobalInterlock, &oldirql); RemoveEntryList (&TransportConnection->GlobalLinkage); RELEASE_SPIN_LOCK (&NbfGlobalInterlock, oldirql); #endif DeviceContext = TransportConnection->Provider; // // Destroy any association that this connection has. // NbfDestroyAssociation (TransportConnection); // // Clear out any associated nasties hanging around the connection. Note // that the current flags are set to STOPPING; this way anyone that may // maliciously try to use the connection after it's dead and gone will // just get ignored. // ASSERT (TransportConnection->Lsn == 0); TransportConnection->Flags = 0; TransportConnection->Flags2 = CONNECTION_FLAGS2_CLOSING; TransportConnection->NetbiosHeader.TransmitCorrelator = 0; TransportConnection->Retries = 0; // no retries yet. TransportConnection->MessageBytesReceived = 0; // no data yet TransportConnection->MessageBytesAcked = 0; TransportConnection->MessageInitAccepted = 0; TransportConnection->ReceiveBytesUnaccepted = 0; // // Now complete the close IRP. This will be set to non-null // when CloseConnection was called. // CloseIrp = TransportConnection->CloseIrp; if (CloseIrp != (PIRP)NULL) { TransportConnection->CloseIrp = (PIRP)NULL; CloseIrp->IoStatus.Information = 0; CloseIrp->IoStatus.Status = STATUS_SUCCESS; IoCompleteRequest (CloseIrp, IO_NETWORK_INCREMENT); } else { #if DBG NbfPrint1("Connection %x destroyed, no CloseIrp!!\n", TransportConnection); #endif } // // Return the connection to the provider's pool. // ACQUIRE_SPIN_LOCK (&DeviceContext->SpinLock, &oldirql); DeviceContext->ConnectionTotal += DeviceContext->ConnectionInUse; ++DeviceContext->ConnectionSamples; --DeviceContext->ConnectionInUse; if ((DeviceContext->ConnectionAllocated - DeviceContext->ConnectionInUse) > DeviceContext->ConnectionInitAllocated) { NbfDeallocateConnection (DeviceContext, TransportConnection); IF_NBFDBG (NBF_DEBUG_DYNAMIC) { NbfPrint1 ("NBF: Deallocated connection at %lx\n", TransportConnection); } } else { InsertTailList (&DeviceContext->ConnectionPool, &TransportConnection->LinkList); } RELEASE_SPIN_LOCK (&DeviceContext->SpinLock, oldirql); NbfDereferenceDeviceContext ("Destroy Connection", DeviceContext, DCREF_CONNECTION); return STATUS_SUCCESS; } /* NbfDestroyConnection */ #if DBG VOID NbfRefConnection( IN PTP_CONNECTION TransportConnection ) /*++ Routine Description: This routine increments the reference count on a transport connection. Arguments: TransportConnection - Pointer to a transport connection object. Return Value: none. --*/ { LONG result; IF_NBFDBG (NBF_DEBUG_CONNOBJ) { NbfPrint2 ("NbfReferenceConnection: entered for connection %lx, " "current level=%ld.\n", TransportConnection, TransportConnection->ReferenceCount); } #if DBG StoreConnectionHistory( TransportConnection, TRUE ); #endif result = InterlockedIncrement (&TransportConnection->ReferenceCount); if (result == 0) { // // The first increment causes us to increment the // "ref count is not zero" special ref. // ExInterlockedAddUlong( (PULONG)(&TransportConnection->SpecialRefCount), 1, TransportConnection->ProviderInterlock); #if DBG ++TransportConnection->RefTypes[CREF_SPECIAL_TEMP]; #endif } ASSERT (result >= 0); } /* NbfRefConnection */ #endif VOID NbfDerefConnection( IN PTP_CONNECTION TransportConnection ) /*++ Routine Description: This routine dereferences a transport connection by decrementing the reference count contained in the structure. If, after being decremented, the reference count is zero, then this routine calls NbfDestroyConnection to remove it from the system. Arguments: TransportConnection - Pointer to a transport connection object. Return Value: none. --*/ { LONG result; IF_NBFDBG (NBF_DEBUG_CONNOBJ) { NbfPrint2 ("NbfDereferenceConnection: entered for connection %lx, " "current level=%ld.\n", TransportConnection, TransportConnection->ReferenceCount); } #if DBG StoreConnectionHistory( TransportConnection, FALSE ); #endif result = InterlockedDecrement (&TransportConnection->ReferenceCount); // // If all the normal references to this connection are gone, then // we can remove the special reference that stood for // "the regular ref count is non-zero". // if (result < 0) { // // If the refcount is -1, then we need to disconnect from // the link and indicate disconnect. However, we need to // do this before we actually do the special deref, since // otherwise the connection might go away while we // are doing that. // // Note that both these routines are protected in that if they // are called twice, the second call will have no effect. // // // If both the connection and its link are active, then they have // mutual references to each other. We remove the link's // reference to the connection in NbfStopConnection, now // the reference count has fallen enough that we know it // is okay to remove the connection's reference to the // link. // if (NbfDisconnectFromLink (TransportConnection, TRUE)) { // // if the reference count goes to one, we can safely indicate the // user about disconnect states. That reference should // be for the connection's creation. // NbfIndicateDisconnect (TransportConnection); } // // Now it is OK to let the connection go away. // NbfDereferenceConnectionSpecial ("Regular ref gone", TransportConnection, CREF_SPECIAL_TEMP); } } /* NbfDerefConnection */ VOID NbfDerefConnectionSpecial( IN PTP_CONNECTION TransportConnection ) /*++ Routine Description: This routines completes the dereferencing of a connection. It may be called any time, but it does not do its work until the regular reference count is also 0. Arguments: TransportConnection - Pointer to a transport connection object. Return Value: none. --*/ { KIRQL oldirql; IF_NBFDBG (NBF_DEBUG_CONNOBJ) { NbfPrint3 ("NbfDereferenceConnectionSpecial: entered for connection %lx, " "current level=%ld (%ld).\n", TransportConnection, TransportConnection->ReferenceCount, TransportConnection->SpecialRefCount); } #if DBG StoreConnectionHistory( TransportConnection, FALSE ); #endif ACQUIRE_SPIN_LOCK (TransportConnection->ProviderInterlock, &oldirql); --TransportConnection->SpecialRefCount; if ((TransportConnection->SpecialRefCount == 0) && (TransportConnection->ReferenceCount == -1)) { // // If we have deleted all references to this connection, then we can // destroy the object. It is okay to have already released the spin // lock at this point because there is no possible way that another // stream of execution has access to the connection any longer. // #if DBG { BOOLEAN TimerCancelled; TimerCancelled = KeCancelTimer (&TransportConnection->Timer); // ASSERT (TimerCancelled); } #endif RELEASE_SPIN_LOCK (TransportConnection->ProviderInterlock, oldirql); NbfDestroyConnection (TransportConnection); } else { RELEASE_SPIN_LOCK (TransportConnection->ProviderInterlock, oldirql); } } /* NbfDerefConnectionSpecial */ VOID NbfClearConnectionLsn( IN PTP_CONNECTION TransportConnection ) /*++ Routine Description: This routine clears the LSN field in a connection. To do this is acquires the device context lock, and modifies the table value for that LSN depending on the type of the connection. NOTE: This routine is called with the connection spinlock held, or in a state where nobody else will be accessing the connection. Arguments: TransportConnection - Pointer to a transport connection object. Return Value: none. --*/ { PDEVICE_CONTEXT DeviceContext; KIRQL oldirql; DeviceContext = TransportConnection->Provider; ACQUIRE_SPIN_LOCK (&DeviceContext->SpinLock, &oldirql); if (TransportConnection->Lsn != 0) { if (TransportConnection->Flags2 & CONNECTION_FLAGS2_GROUP_LSN) { // // It was to a group address; the count should be // LSN_TABLE_MAX. // ASSERT(DeviceContext->LsnTable[TransportConnection->Lsn] == LSN_TABLE_MAX); DeviceContext->LsnTable[TransportConnection->Lsn] = 0; TransportConnection->Flags2 &= ~CONNECTION_FLAGS2_GROUP_LSN; } else { ASSERT(DeviceContext->LsnTable[TransportConnection->Lsn] > 0); --(DeviceContext->LsnTable[TransportConnection->Lsn]); } TransportConnection->Lsn = 0; } RELEASE_SPIN_LOCK (&DeviceContext->SpinLock, oldirql); } PTP_CONNECTION NbfLookupConnectionById( IN PTP_ADDRESS Address, IN USHORT ConnectionId ) /*++ Routine Description: This routine accepts a connection identifier and an address and returns a pointer to the connection object, TP_CONNECTION. If the connection identifier is not found on the address, then NULL is returned. This routine automatically increments the reference count of the TP_CONNECTION structure if it is found. It is assumed that the TP_ADDRESS structure is already held with a reference count. Arguments: Address - Pointer to a transport address object. ConnectionId - Identifier of the connection for this address. Return Value: A pointer to the connection we found --*/ { KIRQL oldirql, oldirql1; PLIST_ENTRY p; PTP_CONNECTION Connection; BOOLEAN Found = FALSE; IF_NBFDBG (NBF_DEBUG_CONNOBJ) { NbfPrint2 ("NbfLookupConnectionById: entered, Address: %lx ID: %lx\n", Address, ConnectionId); } // // Currently, this implementation is inefficient, but brute force so // that a system can get up and running. Later, a cache of the mappings // of popular connection id's and pointers to their TP_CONNECTION structures // will be searched first. // ACQUIRE_SPIN_LOCK (&Address->SpinLock, &oldirql); for (p=Address->ConnectionDatabase.Flink; p != &Address->ConnectionDatabase; p=p->Flink) { Connection = CONTAINING_RECORD (p, TP_CONNECTION, AddressList); try { ACQUIRE_C_SPIN_LOCK (&Connection->SpinLock, &oldirql1); if (((Connection->Flags2 & CONNECTION_FLAGS2_STOPPING) == 0) && (Connection->ConnectionId == ConnectionId)) { // This reference is removed by the calling function NbfReferenceConnection ("Lookup up for request", Connection, CREF_BY_ID); Found = TRUE; } RELEASE_C_SPIN_LOCK (&Connection->SpinLock, oldirql1); } except(EXCEPTION_EXECUTE_HANDLER) { DbgPrint ("NBF: Got exception in NbfLookupConnectionById\n"); DbgBreakPoint(); RELEASE_C_SPIN_LOCK (&Connection->SpinLock, oldirql1); } if (Found) { RELEASE_SPIN_LOCK (&Address->SpinLock, oldirql); return Connection; } } RELEASE_SPIN_LOCK (&Address->SpinLock, oldirql); return NULL; } /* NbfLookupConnectionById */ PTP_CONNECTION NbfLookupConnectionByContext( IN PTP_ADDRESS Address, IN CONNECTION_CONTEXT ConnectionContext ) /*++ Routine Description: This routine accepts a connection identifier and an address and returns a pointer to the connection object, TP_CONNECTION. If the connection identifier is not found on the address, then NULL is returned. This routine automatically increments the reference count of the TP_CONNECTION structure if it is found. It is assumed that the TP_ADDRESS structure is already held with a reference count. Should the ConnectionDatabase go in the address file? Arguments: Address - Pointer to a transport address object. ConnectionContext - Connection Context for this address. Return Value: A pointer to the connection we found --*/ { KIRQL oldirql, oldirql1; PLIST_ENTRY p; BOOLEAN Found = FALSE; PTP_CONNECTION Connection; IF_NBFDBG (NBF_DEBUG_CONNOBJ) { NbfPrint2 ("NbfLookupConnectionByContext: entered, Address: %lx Context: %lx\n", Address, ConnectionContext); } // // Currently, this implementation is inefficient, but brute force so // that a system can get up and running. Later, a cache of the mappings // of popular connection id's and pointers to their TP_CONNECTION structures // will be searched first. // ACQUIRE_SPIN_LOCK (&Address->SpinLock, &oldirql); for (p=Address->ConnectionDatabase.Flink; p != &Address->ConnectionDatabase; p=p->Flink) { Connection = CONTAINING_RECORD (p, TP_CONNECTION, AddressList); try { ACQUIRE_C_SPIN_LOCK (&Connection->SpinLock, &oldirql1); if (Connection->Context == ConnectionContext) { // This reference is removed by the calling function NbfReferenceConnection ("Lookup up for request", Connection, CREF_LISTENING); Found = TRUE; } RELEASE_C_SPIN_LOCK (&Connection->SpinLock, oldirql1); } except(EXCEPTION_EXECUTE_HANDLER) { DbgPrint ("NBF: Got exception in NbfLookupConnectionById\n"); DbgBreakPoint(); RELEASE_C_SPIN_LOCK (&Connection->SpinLock, oldirql1); } if (Found) { RELEASE_SPIN_LOCK (&Address->SpinLock, oldirql); return Connection; } } RELEASE_SPIN_LOCK (&Address->SpinLock, oldirql); return NULL; } /* NbfLookupConnectionByContext */ PTP_CONNECTION NbfLookupListeningConnection( IN PTP_ADDRESS Address, IN PUCHAR RemoteName ) /*++ Routine Description: This routine scans the connection database on an address to find a TP_CONNECTION object which has LSN=0 and CONNECTION_FLAGS_WAIT_NQ flag set. It returns a pointer to the found connection object (and simultaneously resets the flag) or NULL if it could not be found. The reference count is also incremented atomically on the connection. The list is scanned for listens posted to this specific remote name, or to those with no remote name specified. Arguments: Address - Pointer to a transport address object. RemoteName - The name of the remote. Return Value: NTSTATUS - status of operation. --*/ { KIRQL oldirql, oldirql1; PTP_CONNECTION Connection; PLIST_ENTRY p, q; PTP_REQUEST ListenRequest; IF_NBFDBG (NBF_DEBUG_CONNOBJ) { NbfPrint0 ("NbfLookupListeningConnection: Entered.\n"); } // // Currently, this implementation is inefficient, but brute force so // that a system can get up and running. Later, a cache of the mappings // of popular connection id's and pointers to their TP_CONNECTION structures // will be searched first. // ACQUIRE_SPIN_LOCK (&Address->SpinLock, &oldirql); for (p=Address->ConnectionDatabase.Flink; p != &Address->ConnectionDatabase; p=p->Flink) { Connection = CONTAINING_RECORD (p, TP_CONNECTION, AddressList); ACQUIRE_C_SPIN_LOCK (&Connection->SpinLock, &oldirql1); if ((Connection->Lsn == 0) && (Connection->Flags2 & CONNECTION_FLAGS2_WAIT_NQ)) { q = Connection->InProgressRequest.Flink; if (q != &Connection->InProgressRequest) { ListenRequest = CONTAINING_RECORD (q, TP_REQUEST, Linkage); if ((ListenRequest->Buffer2 != NULL) && (!RtlEqualMemory( ListenRequest->Buffer2, RemoteName, NETBIOS_NAME_LENGTH))) { RELEASE_C_SPIN_LOCK (&Connection->SpinLock, oldirql1); continue; } } else { RELEASE_C_SPIN_LOCK (&Connection->SpinLock, oldirql1); continue; } // This reference is removed by the calling function NbfReferenceConnection ("Found Listening", Connection, CREF_LISTENING); Connection->Flags2 &= ~CONNECTION_FLAGS2_WAIT_NQ; RELEASE_C_SPIN_LOCK (&Connection->SpinLock, oldirql1); RELEASE_SPIN_LOCK (&Address->SpinLock, oldirql); IF_NBFDBG (NBF_DEBUG_TEARDOWN) { NbfPrint1 ("NbfLookupListeningConnection: Found Connection %lx\n",Connection); } return Connection; } RELEASE_C_SPIN_LOCK (&Connection->SpinLock, oldirql1); } RELEASE_SPIN_LOCK (&Address->SpinLock, oldirql); IF_NBFDBG (NBF_DEBUG_TEARDOWN) { NbfPrint0 ("NbfLookupListeningConnection: Found No Connection!\n"); } return NULL; } /* NbfLookupListeningConnection */ VOID NbfStopConnection( IN PTP_CONNECTION Connection, IN NTSTATUS Status ) /*++ Routine Description: This routine is called to terminate all activity on a connection and destroy the object. This is done in a graceful manner; i.e., all outstanding requests are terminated by cancelling them, etc. It is assumed that the caller has a reference to this connection object, but this routine will do the dereference for the one issued at creation time. Orderly release is a function of this routine, but it is not a provided service of this transport provider, so there is no code to do it here. NOTE: THIS ROUTINE MUST BE CALLED AT DPC LEVEL. Arguments: Connection - Pointer to a TP_CONNECTION object. Status - The status that caused us to stop the connection. This will determine what status pending requests are aborted with, and also how we proceed during the stop (whether to send a session end, and whether to indicate disconnect). Return Value: none. --*/ { KIRQL cancelirql; PLIST_ENTRY p; PIRP Irp; PTP_REQUEST Request; BOOLEAN TimerWasCleared; ULONG DisconnectReason; PULONG StopCounter; PDEVICE_CONTEXT DeviceContext; IF_NBFDBG (NBF_DEBUG_TEARDOWN | NBF_DEBUG_PNP) { NbfPrint3 ("NbfStopConnection: Entered for connection %lx LSN %x RSN %x.\n", Connection, Connection->Lsn, Connection->Rsn); } ASSERT (KeGetCurrentIrql() == DISPATCH_LEVEL); DeviceContext = Connection->Provider; ACQUIRE_DPC_C_SPIN_LOCK (&Connection->SpinLock); if (!(Connection->Flags2 & CONNECTION_FLAGS2_STOPPING)) { // // We are stopping the connection, record statistics // about it. // if (Connection->Flags & CONNECTION_FLAGS_READY) { DECREMENT_COUNTER (DeviceContext, OpenConnections); } Connection->Flags2 |= CONNECTION_FLAGS2_STOPPING; Connection->Flags2 &= ~CONNECTION_FLAGS2_REMOTE_VALID; Connection->Status = Status; if (Connection->Link != NULL) { ACQUIRE_DPC_SPIN_LOCK (Connection->LinkSpinLock); Connection->Flags &= ~(CONNECTION_FLAGS_READY| CONNECTION_FLAGS_WAIT_SI| CONNECTION_FLAGS_WAIT_SC); // no longer open for business Connection->SendState = CONNECTION_SENDSTATE_IDLE; RELEASE_DPC_SPIN_LOCK (Connection->LinkSpinLock); } // // If this flag was on, turn it off. // Connection->Flags &= ~CONNECTION_FLAGS_W_RESYNCH; // // Stop the timer if it was running. // TimerWasCleared = KeCancelTimer (&Connection->Timer); IF_NBFDBG (NBF_DEBUG_CONNOBJ) { NbfPrint2 ("NbfStopConnection: Timer for connection %lx " "%s canceled.\n", Connection, TimerWasCleared ? "was" : "was NOT" ); } switch (Status) { case STATUS_LOCAL_DISCONNECT: StopCounter = &DeviceContext->Statistics.LocalDisconnects; break; case STATUS_REMOTE_DISCONNECT: StopCounter = &DeviceContext->Statistics.RemoteDisconnects; break; case STATUS_LINK_FAILED: StopCounter = &DeviceContext->Statistics.LinkFailures; break; case STATUS_IO_TIMEOUT: StopCounter = &DeviceContext->Statistics.SessionTimeouts; break; case STATUS_CANCELLED: StopCounter = &DeviceContext->Statistics.CancelledConnections; break; case STATUS_REMOTE_RESOURCES: StopCounter = &DeviceContext->Statistics.RemoteResourceFailures; break; case STATUS_INSUFFICIENT_RESOURCES: StopCounter = &DeviceContext->Statistics.LocalResourceFailures; break; case STATUS_BAD_NETWORK_PATH: StopCounter = &DeviceContext->Statistics.NotFoundFailures; break; case STATUS_REMOTE_NOT_LISTENING: StopCounter = &DeviceContext->Statistics.NoListenFailures; break; default: StopCounter = NULL; break; } if (StopCounter != NULL) { (*StopCounter)++; } RELEASE_DPC_C_SPIN_LOCK (&Connection->SpinLock); // // Run down all TdiConnect/TdiDisconnect/TdiListen requests. // IoAcquireCancelSpinLock(&cancelirql); ACQUIRE_DPC_C_SPIN_LOCK (&Connection->SpinLock); while (TRUE) { p = RemoveHeadList (&Connection->InProgressRequest); if (p == &Connection->InProgressRequest) { break; } RELEASE_DPC_C_SPIN_LOCK (&Connection->SpinLock); Request = CONTAINING_RECORD (p, TP_REQUEST, Linkage); IoSetCancelRoutine(Request->IoRequestPacket, NULL); IoReleaseCancelSpinLock(cancelirql); #if DBG IF_NBFDBG (NBF_DEBUG_TEARDOWN) { LARGE_INTEGER MilliSeconds, Time; ULONG junk; KeQuerySystemTime (&Time); MilliSeconds.LowPart = Time.LowPart; MilliSeconds.HighPart = Time.HighPart; MilliSeconds.QuadPart = MilliSeconds.QuadPart - (Request->Time).QuadPart; MilliSeconds = RtlExtendedLargeIntegerDivide (MilliSeconds, 10000L, &junk); NbfPrint3 ("NbfStopConnection: Canceling pending CONNECT, Irp: %lx Time Pending: %ld%ld msec\n", Request->IoRequestPacket, MilliSeconds.HighPart, MilliSeconds.LowPart); } #endif NbfCompleteRequest (Request, Connection->Status, 0); IoAcquireCancelSpinLock(&cancelirql); ACQUIRE_DPC_C_SPIN_LOCK (&Connection->SpinLock); } if (Connection->Link == NULL) { // // We are stopping early on. // RELEASE_DPC_C_SPIN_LOCK (&Connection->SpinLock); IoReleaseCancelSpinLock (cancelirql); if (TimerWasCleared) { NbfDereferenceConnection ("Stopping timer", Connection, CREF_TIMER); // account for timer reference. } ASSERT (Connection->SendState == CONNECTION_SENDSTATE_IDLE); ASSERT (!Connection->OnPacketWaitQueue); ASSERT (!Connection->OnDataAckQueue); ASSERT (!(Connection->DeferredFlags & CONNECTION_FLAGS_DEFERRED_ACK)); ASSERT (IsListEmpty(&Connection->SendQueue)); ASSERT (IsListEmpty(&Connection->ReceiveQueue)); return; } RELEASE_DPC_C_SPIN_LOCK (&Connection->SpinLock); IoReleaseCancelSpinLock (cancelirql); ACQUIRE_DPC_SPIN_LOCK (Connection->LinkSpinLock); // // If this connection is waiting to packetize, // remove it from the device context queue it is on. // // NOTE: If the connection is currently in the // packetize queue, it will eventually go to get // packetized and at that point it will get // removed. // if (Connection->OnPacketWaitQueue) { IF_NBFDBG (NBF_DEBUG_CONNOBJ) { NbfPrint1("Stop waiting connection, flags %lx\n", Connection->Flags); } ACQUIRE_DPC_SPIN_LOCK (&DeviceContext->SpinLock); Connection->OnPacketWaitQueue = FALSE; ASSERT ((Connection->Flags & CONNECTION_FLAGS_SEND_SE) == 0); Connection->Flags &= ~(CONNECTION_FLAGS_STARVED|CONNECTION_FLAGS_W_PACKETIZE); RemoveEntryList (&Connection->PacketWaitLinkage); RELEASE_DPC_SPIN_LOCK (&DeviceContext->SpinLock); } // // If we are on the data ack queue, then take ourselves off. // ACQUIRE_DPC_SPIN_LOCK (&DeviceContext->TimerSpinLock); if (Connection->OnDataAckQueue) { RemoveEntryList (&Connection->DataAckLinkage); Connection->OnDataAckQueue = FALSE; DeviceContext->DataAckQueueChanged = TRUE; } RELEASE_DPC_SPIN_LOCK (&DeviceContext->TimerSpinLock); // // If this connection is waiting to send a piggyback ack, // remove it from the device context queue for that, and // send a data ack (which will get there before the // SessionEnd). // if ((Connection->DeferredFlags & CONNECTION_FLAGS_DEFERRED_ACK) != 0) { #if DBG { extern ULONG NbfDebugPiggybackAcks; if (NbfDebugPiggybackAcks) { NbfPrint1("Stop waiting connection, deferred flags %lx\n", Connection->DeferredFlags); } } #endif Connection->DeferredFlags &= ~(CONNECTION_FLAGS_DEFERRED_ACK | CONNECTION_FLAGS_DEFERRED_NOT_Q); RELEASE_DPC_SPIN_LOCK (Connection->LinkSpinLock); NbfSendDataAck (Connection); ACQUIRE_DPC_SPIN_LOCK (Connection->LinkSpinLock); } RELEASE_DPC_SPIN_LOCK (Connection->LinkSpinLock); if (TimerWasCleared) { NbfDereferenceConnection ("Stopping timer", Connection, CREF_TIMER); // account for timer reference. } IoAcquireCancelSpinLock(&cancelirql); ACQUIRE_DPC_SPIN_LOCK (Connection->LinkSpinLock); // // Run down all TdiSend requests on this connection. // while (TRUE) { p = RemoveHeadList (&Connection->SendQueue); if (p == &Connection->SendQueue) { break; } RELEASE_DPC_SPIN_LOCK (Connection->LinkSpinLock); Irp = CONTAINING_RECORD (p, IRP, Tail.Overlay.ListEntry); IoSetCancelRoutine(Irp, NULL); IoReleaseCancelSpinLock(cancelirql); #if DBG IF_NBFDBG (NBF_DEBUG_TEARDOWN) { NbfPrint1("NbfStopConnection: Canceling pending SEND, Irp: %lx\n", Irp); } #endif NbfCompleteSendIrp (Irp, Connection->Status, 0); IoAcquireCancelSpinLock(&cancelirql); ACQUIRE_DPC_SPIN_LOCK (Connection->LinkSpinLock); ++Connection->TransmissionErrors; } // // NOTE: We hold the connection spinlock AND the // cancel spinlock here. // Connection->Flags &= ~CONNECTION_FLAGS_ACTIVE_RECEIVE; // // Run down all TdiReceive requests on this connection. // while (TRUE) { p = RemoveHeadList (&Connection->ReceiveQueue); if (p == &Connection->ReceiveQueue) { break; } Irp = CONTAINING_RECORD (p, IRP, Tail.Overlay.ListEntry); IoSetCancelRoutine(Irp, NULL); #if DBG IF_NBFDBG (NBF_DEBUG_TEARDOWN) { NbfPrint1 ("NbfStopConnection: Canceling pending RECEIVE, Irp: %lx\n", Irp); } #endif // // It is OK to call this with the locks held. // NbfCompleteReceiveIrp (Irp, Connection->Status, 0); ++Connection->ReceiveErrors; } // // NOTE: We hold the connection spinlock AND the // cancel spinlock here. // RELEASE_DPC_SPIN_LOCK (Connection->LinkSpinLock); IoReleaseCancelSpinLock(cancelirql); // // If we aren't DESTROYing the link, then send a SESSION_END frame // to the remote side. When the SESSION_END frame is acknowleged, // we will decrement the connection's reference count by one, removing // its creation reference. This will cause the connection object to // be disposed of, and will begin running down the link. // DGB: add logic to avoid blowing away link if one doesn't exist yet. // ACQUIRE_DPC_C_SPIN_LOCK (&Connection->SpinLock); DisconnectReason = 0; if (Connection->Flags2 & CONNECTION_FLAGS2_ABORT) { DisconnectReason |= TDI_DISCONNECT_ABORT; } if (Connection->Flags2 & CONNECTION_FLAGS2_DESTROY) { DisconnectReason |= TDI_DISCONNECT_RELEASE; } if (Connection->Link != NULL) { RELEASE_DPC_C_SPIN_LOCK (&Connection->SpinLock); if ((Status == STATUS_LOCAL_DISCONNECT) || (Status == STATUS_CANCELLED)) { // // (note that a connection should only get stopped // with STATUS_INSUFFICIENT_RESOURCES if it is not // yet connected to the remote). // // // If this is done, when this packet is destroyed // it will dereference the connection for CREF_LINK. // NbfSendSessionEnd ( Connection, (BOOLEAN)((DisconnectReason & TDI_DISCONNECT_ABORT) != 0)); } else { // // Not attached to the link anymore; this dereference // will allow our reference to fall below 3, which // will cause NbfDisconnectFromLink to be called. // NbfDereferenceConnection("Stopped", Connection, CREF_LINK); } } else { RELEASE_DPC_C_SPIN_LOCK (&Connection->SpinLock); } // // Note that we've blocked all new requests being queued during the // time we have been in this teardown code; NbfDestroyConnection also // sets the connection flags to STOPPING when returning the // connection to the queue. This avoids lingerers using non-existent // connections. // } else { // // The connection was already stopping; it may have a // SESSION_END pending in which case we should kill // it. // if ((Status != STATUS_LOCAL_DISCONNECT) && (Status != STATUS_CANCELLED)) { if (Connection->Flags & CONNECTION_FLAGS_SEND_SE) { ASSERT (Connection->Link != NULL); ACQUIRE_DPC_SPIN_LOCK (Connection->LinkSpinLock); Connection->Flags &= ~CONNECTION_FLAGS_SEND_SE; if (Connection->OnPacketWaitQueue) { ACQUIRE_DPC_SPIN_LOCK (&DeviceContext->SpinLock); #if DBG DbgPrint ("NBF: Removing connection %lx from PacketWait for SESSION_END\n", Connection); #endif Connection->OnPacketWaitQueue = FALSE; RemoveEntryList (&Connection->PacketWaitLinkage); RELEASE_DPC_SPIN_LOCK (&DeviceContext->SpinLock); } RELEASE_DPC_SPIN_LOCK (Connection->LinkSpinLock); RELEASE_DPC_C_SPIN_LOCK (&Connection->SpinLock); NbfDereferenceConnection("Stopped again", Connection, CREF_LINK); return; } } RELEASE_DPC_C_SPIN_LOCK (&Connection->SpinLock); } } /* NbfStopConnection */ VOID NbfCancelConnection( IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp ) /*++ Routine Description: This routine is called by the I/O system to cancel a connect or a listen. It is simple since there can only be one of these active on a connection; we just stop the connection, the IRP will get completed as part of normal session teardown. NOTE: This routine is called with the CancelSpinLock held and is responsible for releasing it. Arguments: DeviceObject - Pointer to the device object for this driver. Irp - Pointer to the request packet representing the I/O request. Return Value: none. --*/ { KIRQL oldirql; PIO_STACK_LOCATION IrpSp; PTP_CONNECTION Connection; PTP_REQUEST Request; PLIST_ENTRY p; BOOLEAN fCanceled = TRUE; UNREFERENCED_PARAMETER (DeviceObject); // // Get a pointer to the current stack location in the IRP. This is where // the function codes and parameters are stored. // IrpSp = IoGetCurrentIrpStackLocation (Irp); ASSERT ((IrpSp->MajorFunction == IRP_MJ_INTERNAL_DEVICE_CONTROL) && (IrpSp->MinorFunction == TDI_CONNECT || IrpSp->MinorFunction == TDI_LISTEN)); Connection = IrpSp->FileObject->FsContext; // // Since this IRP is still in the cancellable state, we know // that the connection is still around (although it may be in // the process of being torn down). // ACQUIRE_C_SPIN_LOCK (&Connection->SpinLock, &oldirql); NbfReferenceConnection ("Cancelling Send", Connection, CREF_TEMP); p = RemoveHeadList (&Connection->InProgressRequest); ASSERT (p != &Connection->InProgressRequest); RELEASE_C_SPIN_LOCK (&Connection->SpinLock, oldirql); Request = CONTAINING_RECORD (p, TP_REQUEST, Linkage); ASSERT (Request->IoRequestPacket == Irp); #ifdef RASAUTODIAL // // If there's an automatic connection in // progress, cancel it. // if (Connection->Flags2 & CONNECTION_FLAGS2_AUTOCONNECTING) fCanceled = NbfCancelTdiConnect(NULL, Irp); #endif // RASAUTODIAL if (fCanceled) IoSetCancelRoutine(Request->IoRequestPacket, NULL); IoReleaseCancelSpinLock(Irp->CancelIrql); if (fCanceled) { IF_NBFDBG (NBF_DEBUG_CONNOBJ) { NbfPrint2("NBF: Cancelled in-progress connect/listen %lx on %lx\n", Request->IoRequestPacket, Connection); } KeRaiseIrql (DISPATCH_LEVEL, &oldirql); NbfCompleteRequest (Request, STATUS_CANCELLED, 0); NbfStopConnection (Connection, STATUS_LOCAL_DISCONNECT); // prevent indication to clients KeLowerIrql (oldirql); } NbfDereferenceConnection ("Cancel done", Connection, CREF_TEMP); } #if 0 VOID NbfWaitConnectionOnLink( IN PTP_CONNECTION Connection, IN ULONG Flags ) /*++ Routine Description: This routine is called to suspend a connection's activities because the specified session-oriented frame could not be sent due to link problems. Routines in FRAMESND.C call this. NOTE: THIS ROUTINE MUST BE CALLED AT DPC LEVEL. Arguments: Connection - Pointer to a TP_CONNECTION object. Flags - Field containing bitflag set to indicate starved frame to be sent. Return Value: none. --*/ { IF_NBFDBG (NBF_DEBUG_CONNOBJ) { NbfPrint0 ("NbfWaitConnectionOnLink: Entered.\n"); } ACQUIRE_DPC_C_SPIN_LOCK (&Connection->SpinLock); if (((Connection->Flags2 & CONNECTION_FLAGS2_STOPPING) == 0) || (Flags == CONNECTION_FLAGS_SEND_SE)) { ACQUIRE_DPC_SPIN_LOCK (Connection->LinkSpinLock); Connection->Flags |= Flags; RELEASE_DPC_SPIN_LOCK (Connection->LinkSpinLock); } RELEASE_DPC_C_SPIN_LOCK (&Connection->SpinLock); } /* NbfWaitConnectionOnLink */ #endif VOID NbfStartConnectionTimer( IN PTP_CONNECTION Connection, IN PKDEFERRED_ROUTINE TimeoutFunction, IN ULONG WaitTime ) /*++ Routine Description: This routine is called to start a timeout on NAME_QUERY/NAME_RECOGNIZED activities on a connection. Arguments: TransportConnection - Pointer to a TP_CONNECTION object. TimeoutFunction - The function to call when the timer fires. WaitTime - a longword containing the low order time to wait. Return Value: none. --*/ { LARGE_INTEGER Timeout; BOOLEAN AlreadyInserted; IF_NBFDBG (NBF_DEBUG_CONNOBJ) { NbfPrint1 ("NbfStartConnectionTimer: Entered for connection %lx.\n", Connection ); } // // Start the timer. Unlike the link timers, this is simply a kernel- // managed object. // Timeout.LowPart = (ULONG)(-(LONG)WaitTime); Timeout.HighPart = -1; // // Take the lock so we synchronize the cancelling with // restarting the timer. This is so two threads won't // both fail to cancel and then start the timer at the // same time (it messes up the reference count). // ACQUIRE_DPC_C_SPIN_LOCK (&Connection->SpinLock); AlreadyInserted = KeCancelTimer (&Connection->Timer); KeInitializeDpc ( &Connection->Dpc, TimeoutFunction, (PVOID)Connection); KeSetTimer ( &Connection->Timer, Timeout, &Connection->Dpc); RELEASE_DPC_C_SPIN_LOCK (&Connection->SpinLock); // // If the timer wasn't already running, reference the connection to // account for the new timer. If the timer was already started, // then KeCancelTimer will have returned TRUE. In this // case, the prior call to NbfStartConnectionTimer referenced the // connection, so we don't do it again here. // if ( !AlreadyInserted ) { // This reference is removed in ConnectionEstablishmentTimeout, // or when the timer is cancelled. NbfReferenceConnection ("starting timer", Connection, CREF_TIMER); } } /* NbfStartConnectionTimer */