xref: /illumos-gate/usr/src/uts/common/fs/smbsrv/smb_server.c (revision 1160dcf7283d2485f2b9c32da573db0275558d9b)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright (c) 2008, 2010, Oracle and/or its affiliates. All rights reserved.
23  * Copyright 2016 Nexenta Systems, Inc.  All rights reserved.
24  * Copyright (c) 2017 by Delphix. All rights reserved.
25  */
26 
27 /*
28  * General Structures Layout
29  * -------------------------
30  *
31  * This is a simplified diagram showing the relationship between most of the
32  * main structures.
33  *
34  * +-------------------+
35  * |     SMB_SERVER    |
36  * +-------------------+
37  *          |
38  *          |
39  *          v
40  * +-------------------+       +-------------------+      +-------------------+
41  * |     SESSION       |<----->|     SESSION       |......|      SESSION      |
42  * +-------------------+       +-------------------+      +-------------------+
43  *          |
44  *          |
45  *          v
46  * +-------------------+       +-------------------+      +-------------------+
47  * |       USER        |<----->|       USER        |......|       USER        |
48  * +-------------------+       +-------------------+      +-------------------+
49  *          |
50  *          |
51  *          v
52  * +-------------------+       +-------------------+      +-------------------+
53  * |       TREE        |<----->|       TREE        |......|       TREE        |
54  * +-------------------+       +-------------------+      +-------------------+
55  *      |         |
56  *      |         |
57  *      |         v
58  *      |     +-------+       +-------+      +-------+
59  *      |     | OFILE |<----->| OFILE |......| OFILE |
60  *      |     +-------+       +-------+      +-------+
61  *      |
62  *      |
63  *      v
64  *  +-------+       +------+      +------+
65  *  | ODIR  |<----->| ODIR |......| ODIR |
66  *  +-------+       +------+      +------+
67  *
68  *
69  * Module Interface Overview
70  * -------------------------
71  *
72  *
73  *	    +===================================+
74  *	    |		 smbd daemon		|
75  *	    +===================================+
76  *	      |		     |		      ^
77  *	      |		     |		      |
78  * User	      |		     |		      |
79  * -----------|--------------|----------------|--------------------------------
80  * Kernel     |		     |		      |
81  *            |		     |		      |
82  *	      |		     |		      |
83  *  +=========|==============|================|=================+
84  *  |	      v		     v		      |			|
85  *  | +-----------+ +--------------------+ +------------------+ |
86  *  | |     IO    | | Kernel Door Server | | User Door Servers|	|
87  *  | | Interface | |     Interface      | |   Interface      | |
88  *  | +-----------+ +--------------------+ +------------------+ |
89  *  |		|	     |		      ^		^	|
90  *  |		v	     v		      |		|	|    +=========+
91  *  |	     +-----------------------------------+	|	|    |	       |
92  *  |	     + SMB Server Management (this file) |<------------------|	 ZFS   |
93  *  |	     +-----------------------------------+	|	|    |	       |
94  *  |							|	|    |  Module |
95  *  |	     +-----------------------------------+	|	|    |	       |
96  *  |	     +     SMB Server Internal Layers    |------+	|    +=========+
97  *  |	     +-----------------------------------+		|
98  *  |								|
99  *  |								|
100  *  +===========================================================+
101  *
102  *
103  * Server State Machine
104  * --------------------
105  *                                  |
106  *                                  | T0
107  *                                  |
108  *                                  v
109  *                    +-----------------------------+
110  *		      |   SMB_SERVER_STATE_CREATED  |
111  *		      +-----------------------------+
112  *				    |
113  *				    | T1
114  *				    |
115  *				    v
116  *		      +-----------------------------+
117  *		      | SMB_SERVER_STATE_CONFIGURED |
118  *		      +-----------------------------+
119  *				    |
120  *				    | T2
121  *				    |
122  *				    v
123  *		      +-----------------------------+
124  *		      |  SMB_SERVER_STATE_RUNNING / |
125  *		      |  SMB_SERVER_STATE_STOPPING  |
126  *		      +-----------------------------+
127  *				    |
128  *				    | T3
129  *				    |
130  *				    v
131  *		      +-----------------------------+
132  *		      |  SMB_SERVER_STATE_DELETING  |
133  *                    +-----------------------------+
134  *				    |
135  *				    |
136  *				    |
137  *				    v
138  *
139  * States
140  * ------
141  *
142  * SMB_SERVER_STATE_CREATED
143  *
144  *    This is the state of the server just after creation.
145  *
146  * SMB_SERVER_STATE_CONFIGURED
147  *
148  *    The server has been configured.
149  *
150  * SMB_SERVER_STATE_RUNNING
151  *
152  *    The server has been started. While in this state the threads listening on
153  *    the sockets are started.
154  *
155  *    When a client establishes a connection the thread listening dispatches
156  *    a task with the new session as an argument. If the dispatch fails the new
157  *    session context is destroyed.
158  *
159  * SMB_SERVER_STATE_STOPPING
160  *
161  *    The threads listening on the NBT and TCP sockets are being terminated.
162  *
163  *
164  * Transitions
165  * -----------
166  *
167  * Transition T0
168  *
169  *    The daemon smbd triggers its creation by opening the smbsrv device. If
170  *    the zone where the daemon lives doesn't have an smb server yet it is
171  *    created.
172  *
173  *		smb_drv_open() --> smb_server_create()
174  *
175  * Transition T1
176  *
177  *    This transition occurs in smb_server_configure(). It is triggered by the
178  *    daemon through an Ioctl.
179  *
180  *	smb_drv_ioctl(SMB_IOC_CONFIG) --> smb_server_configure()
181  *
182  * Transition T2
183  *
184  *    This transition occurs in smb_server_start(). It is triggered by the
185  *    daemon through an Ioctl.
186  *
187  *	smb_drv_ioctl(SMB_IOC_START) --> smb_server_start()
188  *
189  * Transition T3
190  *
191  *    This transition occurs in smb_server_delete(). It is triggered by the
192  *    daemon when closing the smbsrv device
193  *
194  *		smb_drv_close() --> smb_server_delete()
195  *
196  * Comments
197  * --------
198  *
199  * This files assumes that there will one SMB server per zone. For now the
200  * smb server works only in global zone. There's nothing in this file preventing
201  * an smb server from being created in a non global zone. That limitation is
202  * enforced in user space.
203  */
204 
205 #include <sys/cmn_err.h>
206 #include <sys/priv.h>
207 #include <sys/zone.h>
208 #include <netinet/in.h>
209 #include <netinet/in_systm.h>
210 #include <netinet/ip.h>
211 #include <netinet/ip_icmp.h>
212 #include <netinet/ip_var.h>
213 #include <netinet/tcp.h>
214 #include <smbsrv/smb2_kproto.h>
215 #include <smbsrv/string.h>
216 #include <smbsrv/netbios.h>
217 #include <smbsrv/smb_fsops.h>
218 #include <smbsrv/smb_share.h>
219 #include <smbsrv/smb_door.h>
220 #include <smbsrv/smb_kstat.h>
221 
222 static void smb_server_kstat_init(smb_server_t *);
223 static void smb_server_kstat_fini(smb_server_t *);
224 static void smb_server_timers(smb_thread_t *, void *);
225 static void smb_server_store_cfg(smb_server_t *, smb_ioc_cfg_t *);
226 static void smb_server_shutdown(smb_server_t *);
227 static int smb_server_fsop_start(smb_server_t *);
228 static void smb_server_fsop_stop(smb_server_t *);
229 static void smb_event_cancel(smb_server_t *, uint32_t);
230 static uint32_t smb_event_alloc_txid(void);
231 
232 static void smb_server_disconnect_share(smb_llist_t *, const char *);
233 static void smb_server_enum_users(smb_llist_t *, smb_svcenum_t *);
234 static void smb_server_enum_trees(smb_llist_t *, smb_svcenum_t *);
235 static int smb_server_session_disconnect(smb_llist_t *, const char *,
236     const char *);
237 static int smb_server_fclose(smb_llist_t *, uint32_t);
238 static int smb_server_kstat_update(kstat_t *, int);
239 static int smb_server_legacy_kstat_update(kstat_t *, int);
240 static void smb_server_listener_init(smb_server_t *, smb_listener_daemon_t *,
241     char *, in_port_t, int);
242 static void smb_server_listener_destroy(smb_listener_daemon_t *);
243 static int smb_server_listener_start(smb_listener_daemon_t *);
244 static void smb_server_listener_stop(smb_listener_daemon_t *);
245 static void smb_server_listener(smb_thread_t *, void *);
246 static void smb_server_receiver(void *);
247 static void smb_server_create_session(smb_listener_daemon_t *, ksocket_t);
248 static void smb_server_destroy_session(smb_session_t *);
249 static uint16_t smb_spool_get_fid(smb_server_t *);
250 static boolean_t smb_spool_lookup_doc_byfid(smb_server_t *, uint16_t,
251     smb_kspooldoc_t *);
252 
253 /*
254  * How many "buckets" should our hash tables use?  On a "real" server,
255  * make them much larger than the number of CPUs we're likely to have.
256  * On "fksmbd" make it smaller so dtrace logs are shorter.
257  * These must be powers of two.
258  */
259 #ifdef	_KERNEL
260 #define	DEFAULT_HASH_NBUCKETS	256	/* real server */
261 #else
262 #define	DEFAULT_HASH_NBUCKETS	16	/* for "fksmbd" */
263 #endif
264 uint32_t SMB_OFILE_HASH_NBUCKETS = DEFAULT_HASH_NBUCKETS;
265 uint32_t SMB_LEASE_HASH_NBUCKETS = DEFAULT_HASH_NBUCKETS;
266 
267 int smb_event_debug = 0;
268 
269 static smb_llist_t	smb_servers;
270 
271 kmem_cache_t		*smb_cache_request;
272 kmem_cache_t		*smb_cache_session;
273 kmem_cache_t		*smb_cache_user;
274 kmem_cache_t		*smb_cache_tree;
275 kmem_cache_t		*smb_cache_ofile;
276 kmem_cache_t		*smb_cache_odir;
277 kmem_cache_t		*smb_cache_opipe;
278 kmem_cache_t		*smb_cache_event;
279 kmem_cache_t		*smb_cache_lock;
280 
281 /*
282  * *****************************************************************************
283  * **************** Functions called from the device interface *****************
284  * *****************************************************************************
285  *
286  * These functions typically have to determine the relevant smb server
287  * to which the call applies.
288  */
289 
290 /*
291  * How many zones have an SMB server active?
292  */
293 int
294 smb_server_get_count(void)
295 {
296 	return (smb_llist_get_count(&smb_servers));
297 }
298 
299 /*
300  * smb_server_g_init
301  *
302  * This function must be called from smb_drv_attach().
303  */
304 int
305 smb_server_g_init(void)
306 {
307 	int rc;
308 
309 	if ((rc = smb_vop_init()) != 0)
310 		goto errout;
311 	if ((rc = smb_fem_init()) != 0)
312 		goto errout;
313 
314 	smb_kshare_g_init();
315 	smb_codepage_init();
316 	smb_mbc_init();		/* smb_mbc_cache */
317 	smb_node_init();	/* smb_node_cache, lists */
318 	smb2_lease_init();
319 
320 	smb_cache_request = kmem_cache_create("smb_request_cache",
321 	    sizeof (smb_request_t), 8, NULL, NULL, NULL, NULL, NULL, 0);
322 	smb_cache_session = kmem_cache_create("smb_session_cache",
323 	    sizeof (smb_session_t), 8, NULL, NULL, NULL, NULL, NULL, 0);
324 	smb_cache_user = kmem_cache_create("smb_user_cache",
325 	    sizeof (smb_user_t), 8, NULL, NULL, NULL, NULL, NULL, 0);
326 	smb_cache_tree = kmem_cache_create("smb_tree_cache",
327 	    sizeof (smb_tree_t), 8, NULL, NULL, NULL, NULL, NULL, 0);
328 	smb_cache_ofile = kmem_cache_create("smb_ofile_cache",
329 	    sizeof (smb_ofile_t), 8, NULL, NULL, NULL, NULL, NULL, 0);
330 	smb_cache_odir = kmem_cache_create("smb_odir_cache",
331 	    sizeof (smb_odir_t), 8, NULL, NULL, NULL, NULL, NULL, 0);
332 	smb_cache_opipe = kmem_cache_create("smb_opipe_cache",
333 	    sizeof (smb_opipe_t), 8, NULL, NULL, NULL, NULL, NULL, 0);
334 	smb_cache_event = kmem_cache_create("smb_event_cache",
335 	    sizeof (smb_event_t), 8, NULL, NULL, NULL, NULL, NULL, 0);
336 	smb_cache_lock = kmem_cache_create("smb_lock_cache",
337 	    sizeof (smb_lock_t), 8, NULL, NULL, NULL, NULL, NULL, 0);
338 
339 	smb_llist_init();
340 	smb_llist_constructor(&smb_servers, sizeof (smb_server_t),
341 	    offsetof(smb_server_t, sv_lnd));
342 
343 	return (0);
344 
345 errout:
346 	smb_fem_fini();
347 	smb_vop_fini();
348 	return (rc);
349 }
350 
351 /*
352  * smb_server_g_fini
353  *
354  * This function must called from smb_drv_detach(). It will fail if servers
355  * still exist.
356  */
357 void
358 smb_server_g_fini(void)
359 {
360 
361 	ASSERT(smb_llist_get_count(&smb_servers) == 0);
362 
363 	smb_llist_fini();
364 
365 	kmem_cache_destroy(smb_cache_request);
366 	kmem_cache_destroy(smb_cache_session);
367 	kmem_cache_destroy(smb_cache_user);
368 	kmem_cache_destroy(smb_cache_tree);
369 	kmem_cache_destroy(smb_cache_ofile);
370 	kmem_cache_destroy(smb_cache_odir);
371 	kmem_cache_destroy(smb_cache_opipe);
372 	kmem_cache_destroy(smb_cache_event);
373 	kmem_cache_destroy(smb_cache_lock);
374 
375 	smb2_lease_fini();
376 	smb_node_fini();
377 	smb_mbc_fini();
378 	smb_codepage_fini();
379 	smb_kshare_g_fini();
380 
381 	smb_fem_fini();
382 	smb_vop_fini();
383 
384 	smb_llist_destructor(&smb_servers);
385 }
386 
387 /*
388  * smb_server_create
389  *
390  * This function will fail if there's already a server associated with the
391  * caller's zone.
392  */
393 int
394 smb_server_create(void)
395 {
396 	zoneid_t	zid;
397 	smb_server_t	*sv;
398 
399 	zid = getzoneid();
400 
401 	smb_llist_enter(&smb_servers, RW_WRITER);
402 	sv = smb_llist_head(&smb_servers);
403 	while (sv) {
404 		SMB_SERVER_VALID(sv);
405 		if (sv->sv_zid == zid) {
406 			smb_llist_exit(&smb_servers);
407 			return (EPERM);
408 		}
409 		sv = smb_llist_next(&smb_servers, sv);
410 	}
411 
412 	sv = kmem_zalloc(sizeof (smb_server_t), KM_SLEEP);
413 
414 	sv->sv_magic = SMB_SERVER_MAGIC;
415 	sv->sv_state = SMB_SERVER_STATE_CREATED;
416 	sv->sv_zid = zid;
417 	sv->sv_pid = ddi_get_pid();
418 
419 	mutex_init(&sv->sv_mutex, NULL, MUTEX_DEFAULT, NULL);
420 	cv_init(&sv->sv_cv, NULL, CV_DEFAULT, NULL);
421 	cv_init(&sv->sp_info.sp_cv, NULL, CV_DEFAULT, NULL);
422 
423 	sv->sv_persistid_ht = smb_hash_create(sizeof (smb_ofile_t),
424 	    offsetof(smb_ofile_t, f_dh_lnd), SMB_OFILE_HASH_NBUCKETS);
425 
426 	sv->sv_lease_ht = smb_hash_create(sizeof (smb_lease_t),
427 	    offsetof(smb_lease_t, ls_lnd), SMB_LEASE_HASH_NBUCKETS);
428 
429 	smb_llist_constructor(&sv->sv_session_list, sizeof (smb_session_t),
430 	    offsetof(smb_session_t, s_lnd));
431 
432 	smb_llist_constructor(&sv->sv_event_list, sizeof (smb_event_t),
433 	    offsetof(smb_event_t, se_lnd));
434 
435 	smb_llist_constructor(&sv->sp_info.sp_list, sizeof (smb_kspooldoc_t),
436 	    offsetof(smb_kspooldoc_t, sd_lnd));
437 
438 	smb_llist_constructor(&sv->sp_info.sp_fidlist,
439 	    sizeof (smb_spoolfid_t), offsetof(smb_spoolfid_t, sf_lnd));
440 
441 	sv->sv_disp_stats1 = kmem_zalloc(SMB_COM_NUM *
442 	    sizeof (smb_disp_stats_t), KM_SLEEP);
443 
444 	sv->sv_disp_stats2 = kmem_zalloc(SMB2__NCMDS *
445 	    sizeof (smb_disp_stats_t), KM_SLEEP);
446 
447 	smb_thread_init(&sv->si_thread_timers, "smb_timers",
448 	    smb_server_timers, sv, smbsrv_timer_pri);
449 
450 	smb_srqueue_init(&sv->sv_srqueue);
451 
452 	smb_kdoor_init(sv);
453 	smb_kshare_init(sv);
454 	smb_server_kstat_init(sv);
455 
456 	smb_threshold_init(&sv->sv_ssetup_ct, SMB_SSETUP_CMD,
457 	    smb_ssetup_threshold, smb_ssetup_timeout);
458 	smb_threshold_init(&sv->sv_tcon_ct, SMB_TCON_CMD,
459 	    smb_tcon_threshold, smb_tcon_timeout);
460 	smb_threshold_init(&sv->sv_opipe_ct, SMB_OPIPE_CMD,
461 	    smb_opipe_threshold, smb_opipe_timeout);
462 
463 	smb_llist_insert_tail(&smb_servers, sv);
464 	smb_llist_exit(&smb_servers);
465 
466 	return (0);
467 }
468 
469 /*
470  * smb_server_delete
471  *
472  * This function will delete the server passed in. It will make sure that all
473  * activity associated that server has ceased before destroying it.
474  */
475 int
476 smb_server_delete(void)
477 {
478 	smb_server_t	*sv;
479 	int		rc;
480 
481 	rc = smb_server_lookup(&sv);
482 	if (rc != 0)
483 		return (rc);
484 
485 	mutex_enter(&sv->sv_mutex);
486 	switch (sv->sv_state) {
487 	case SMB_SERVER_STATE_RUNNING:
488 		sv->sv_state = SMB_SERVER_STATE_STOPPING;
489 		mutex_exit(&sv->sv_mutex);
490 		smb_server_shutdown(sv);
491 		mutex_enter(&sv->sv_mutex);
492 		cv_broadcast(&sv->sp_info.sp_cv);
493 		sv->sv_state = SMB_SERVER_STATE_DELETING;
494 		break;
495 	case SMB_SERVER_STATE_STOPPING:
496 		sv->sv_state = SMB_SERVER_STATE_DELETING;
497 		break;
498 	case SMB_SERVER_STATE_CONFIGURED:
499 	case SMB_SERVER_STATE_CREATED:
500 		sv->sv_state = SMB_SERVER_STATE_DELETING;
501 		break;
502 	default:
503 		SMB_SERVER_STATE_VALID(sv->sv_state);
504 		mutex_exit(&sv->sv_mutex);
505 		smb_server_release(sv);
506 		return (ENOTTY);
507 	}
508 
509 	ASSERT(sv->sv_state == SMB_SERVER_STATE_DELETING);
510 
511 	sv->sv_refcnt--;
512 	while (sv->sv_refcnt)
513 		cv_wait(&sv->sv_cv, &sv->sv_mutex);
514 
515 	mutex_exit(&sv->sv_mutex);
516 
517 	smb_llist_enter(&smb_servers, RW_WRITER);
518 	smb_llist_remove(&smb_servers, sv);
519 	smb_llist_exit(&smb_servers);
520 
521 	smb_threshold_fini(&sv->sv_ssetup_ct);
522 	smb_threshold_fini(&sv->sv_tcon_ct);
523 	smb_threshold_fini(&sv->sv_opipe_ct);
524 
525 	smb_server_listener_destroy(&sv->sv_nbt_daemon);
526 	smb_server_listener_destroy(&sv->sv_tcp_daemon);
527 	rw_destroy(&sv->sv_cfg_lock);
528 	smb_server_kstat_fini(sv);
529 	smb_kshare_fini(sv);
530 	smb_kdoor_fini(sv);
531 	smb_llist_destructor(&sv->sv_event_list);
532 	smb_llist_destructor(&sv->sv_session_list);
533 
534 	kmem_free(sv->sv_disp_stats1,
535 	    SMB_COM_NUM * sizeof (smb_disp_stats_t));
536 
537 	kmem_free(sv->sv_disp_stats2,
538 	    SMB2__NCMDS * sizeof (smb_disp_stats_t));
539 
540 	smb_srqueue_destroy(&sv->sv_srqueue);
541 	smb_thread_destroy(&sv->si_thread_timers);
542 
543 	mutex_destroy(&sv->sv_mutex);
544 	smb_hash_destroy(sv->sv_lease_ht);
545 	smb_hash_destroy(sv->sv_persistid_ht);
546 	cv_destroy(&sv->sv_cv);
547 	sv->sv_magic = 0;
548 	kmem_free(sv, sizeof (smb_server_t));
549 
550 	return (0);
551 }
552 
553 /*
554  * smb_server_configure
555  */
556 int
557 smb_server_configure(smb_ioc_cfg_t *ioc)
558 {
559 	int		rc = 0;
560 	smb_server_t	*sv;
561 
562 	/*
563 	 * Reality check negotiation token length vs. #define'd maximum.
564 	 */
565 	if (ioc->negtok_len > SMB_PI_MAX_NEGTOK)
566 		return (EINVAL);
567 
568 	rc = smb_server_lookup(&sv);
569 	if (rc)
570 		return (rc);
571 
572 	mutex_enter(&sv->sv_mutex);
573 	switch (sv->sv_state) {
574 	case SMB_SERVER_STATE_CREATED:
575 		smb_server_store_cfg(sv, ioc);
576 		sv->sv_state = SMB_SERVER_STATE_CONFIGURED;
577 		break;
578 
579 	case SMB_SERVER_STATE_CONFIGURED:
580 		smb_server_store_cfg(sv, ioc);
581 		break;
582 
583 	case SMB_SERVER_STATE_RUNNING:
584 	case SMB_SERVER_STATE_STOPPING:
585 		rw_enter(&sv->sv_cfg_lock, RW_WRITER);
586 		smb_server_store_cfg(sv, ioc);
587 		rw_exit(&sv->sv_cfg_lock);
588 		break;
589 
590 	default:
591 		SMB_SERVER_STATE_VALID(sv->sv_state);
592 		rc = EFAULT;
593 		break;
594 	}
595 	mutex_exit(&sv->sv_mutex);
596 
597 	smb_server_release(sv);
598 
599 	return (rc);
600 }
601 
602 /*
603  * smb_server_start
604  */
605 int
606 smb_server_start(smb_ioc_start_t *ioc)
607 {
608 	int		rc = 0;
609 	int		family;
610 	smb_server_t	*sv;
611 
612 	rc = smb_server_lookup(&sv);
613 	if (rc)
614 		return (rc);
615 
616 	mutex_enter(&sv->sv_mutex);
617 	switch (sv->sv_state) {
618 	case SMB_SERVER_STATE_CONFIGURED:
619 
620 		if ((rc = smb_server_fsop_start(sv)) != 0)
621 			break;
622 
623 		if ((rc = smb_kshare_start(sv)) != 0)
624 			break;
625 
626 		/*
627 		 * NB: the proc passed here has to be a "system" one.
628 		 * Normally that's p0, or the NGZ eqivalent.
629 		 */
630 		sv->sv_worker_pool = taskq_create_proc("smb_workers",
631 		    sv->sv_cfg.skc_maxworkers, smbsrv_worker_pri,
632 		    sv->sv_cfg.skc_maxworkers, INT_MAX,
633 		    curzone->zone_zsched, TASKQ_DYNAMIC);
634 
635 		sv->sv_receiver_pool = taskq_create_proc("smb_receivers",
636 		    sv->sv_cfg.skc_maxconnections, smbsrv_receive_pri,
637 		    sv->sv_cfg.skc_maxconnections, INT_MAX,
638 		    curzone->zone_zsched, TASKQ_DYNAMIC);
639 
640 		sv->sv_session = smb_session_create(NULL, 0, sv, 0);
641 
642 		if (sv->sv_worker_pool == NULL || sv->sv_session == NULL) {
643 			rc = ENOMEM;
644 			break;
645 		}
646 
647 #ifdef	_KERNEL
648 		ASSERT(sv->sv_lmshrd == NULL);
649 		sv->sv_lmshrd = smb_kshare_door_init(ioc->lmshrd);
650 		if (sv->sv_lmshrd == NULL)
651 			break;
652 		if ((rc = smb_kdoor_open(sv, ioc->udoor)) != 0) {
653 			cmn_err(CE_WARN, "Cannot open smbd door");
654 			break;
655 		}
656 #else	/* _KERNEL */
657 		/* Fake kernel does not use the kshare_door */
658 		fksmb_kdoor_open(sv, ioc->udoor_func);
659 #endif	/* _KERNEL */
660 
661 		if ((rc = smb_thread_start(&sv->si_thread_timers)) != 0)
662 			break;
663 
664 		family = AF_INET;
665 		smb_server_listener_init(sv, &sv->sv_nbt_daemon,
666 		    "smb_nbt_listener", IPPORT_NETBIOS_SSN, family);
667 		if (sv->sv_cfg.skc_ipv6_enable)
668 			family = AF_INET6;
669 		smb_server_listener_init(sv, &sv->sv_tcp_daemon,
670 		    "smb_tcp_listener", IPPORT_SMB, family);
671 		rc = smb_server_listener_start(&sv->sv_tcp_daemon);
672 		if (rc != 0)
673 			break;
674 		if (sv->sv_cfg.skc_netbios_enable)
675 			(void) smb_server_listener_start(&sv->sv_nbt_daemon);
676 
677 		sv->sv_state = SMB_SERVER_STATE_RUNNING;
678 		sv->sv_start_time = gethrtime();
679 		mutex_exit(&sv->sv_mutex);
680 		smb_server_release(sv);
681 		smb_export_start(sv);
682 		return (0);
683 	default:
684 		SMB_SERVER_STATE_VALID(sv->sv_state);
685 		mutex_exit(&sv->sv_mutex);
686 		smb_server_release(sv);
687 		return (ENOTTY);
688 	}
689 
690 	mutex_exit(&sv->sv_mutex);
691 	smb_server_shutdown(sv);
692 	smb_server_release(sv);
693 	return (rc);
694 }
695 
696 /*
697  * An smbd is shutting down.
698  */
699 int
700 smb_server_stop(void)
701 {
702 	smb_server_t	*sv;
703 	int		rc;
704 
705 	if ((rc = smb_server_lookup(&sv)) != 0)
706 		return (rc);
707 
708 	mutex_enter(&sv->sv_mutex);
709 	switch (sv->sv_state) {
710 	case SMB_SERVER_STATE_RUNNING:
711 		sv->sv_state = SMB_SERVER_STATE_STOPPING;
712 		mutex_exit(&sv->sv_mutex);
713 		smb_server_shutdown(sv);
714 		mutex_enter(&sv->sv_mutex);
715 		cv_broadcast(&sv->sp_info.sp_cv);
716 		break;
717 	default:
718 		SMB_SERVER_STATE_VALID(sv->sv_state);
719 		break;
720 	}
721 	mutex_exit(&sv->sv_mutex);
722 
723 	smb_server_release(sv);
724 	return (0);
725 }
726 
727 boolean_t
728 smb_server_is_stopping(smb_server_t *sv)
729 {
730 	boolean_t	status;
731 
732 	SMB_SERVER_VALID(sv);
733 
734 	mutex_enter(&sv->sv_mutex);
735 
736 	switch (sv->sv_state) {
737 	case SMB_SERVER_STATE_STOPPING:
738 	case SMB_SERVER_STATE_DELETING:
739 		status = B_TRUE;
740 		break;
741 	default:
742 		status = B_FALSE;
743 		break;
744 	}
745 
746 	mutex_exit(&sv->sv_mutex);
747 	return (status);
748 }
749 
750 void
751 smb_server_cancel_event(smb_server_t *sv, uint32_t txid)
752 {
753 	smb_event_cancel(sv, txid);
754 }
755 
756 int
757 smb_server_notify_event(smb_ioc_event_t *ioc)
758 {
759 	smb_server_t	*sv;
760 	int		rc;
761 
762 	if ((rc = smb_server_lookup(&sv)) == 0) {
763 		smb_event_notify(sv, ioc->txid);
764 		smb_server_release(sv);
765 	}
766 
767 	return (rc);
768 }
769 
770 /*
771  * smb_server_spooldoc
772  *
773  * Waits for print file close broadcast.
774  * Gets the head of the fid list,
775  * then searches the spooldoc list and returns
776  * this info via the ioctl to user land.
777  *
778  * rc - 0 success
779  */
780 
781 int
782 smb_server_spooldoc(smb_ioc_spooldoc_t *ioc)
783 {
784 	smb_server_t	*sv;
785 	int		rc;
786 	smb_kspooldoc_t *spdoc;
787 	uint16_t	fid;
788 
789 	if ((rc = smb_server_lookup(&sv)) != 0)
790 		return (rc);
791 
792 	if (sv->sv_cfg.skc_print_enable == 0) {
793 		rc = ENOTTY;
794 		goto out;
795 	}
796 
797 	mutex_enter(&sv->sv_mutex);
798 	for (;;) {
799 		if (sv->sv_state != SMB_SERVER_STATE_RUNNING) {
800 			rc = ECANCELED;
801 			break;
802 		}
803 		if ((fid = smb_spool_get_fid(sv)) != 0) {
804 			rc = 0;
805 			break;
806 		}
807 		if (cv_wait_sig(&sv->sp_info.sp_cv, &sv->sv_mutex) == 0) {
808 			rc = EINTR;
809 			break;
810 		}
811 	}
812 	mutex_exit(&sv->sv_mutex);
813 	if (rc != 0)
814 		goto out;
815 
816 	spdoc = kmem_zalloc(sizeof (*spdoc), KM_SLEEP);
817 	if (smb_spool_lookup_doc_byfid(sv, fid, spdoc)) {
818 		ioc->spool_num = spdoc->sd_spool_num;
819 		ioc->ipaddr = spdoc->sd_ipaddr;
820 		(void) strlcpy(ioc->path, spdoc->sd_path,
821 		    MAXPATHLEN);
822 		(void) strlcpy(ioc->username,
823 		    spdoc->sd_username, MAXNAMELEN);
824 	} else {
825 		/* Did not find that print job. */
826 		rc = EAGAIN;
827 	}
828 	kmem_free(spdoc, sizeof (*spdoc));
829 
830 out:
831 	smb_server_release(sv);
832 	return (rc);
833 }
834 
835 int
836 smb_server_set_gmtoff(smb_ioc_gmt_t *ioc)
837 {
838 	int		rc;
839 	smb_server_t	*sv;
840 
841 	if ((rc = smb_server_lookup(&sv)) == 0) {
842 		sv->si_gmtoff = ioc->offset;
843 		smb_server_release(sv);
844 	}
845 
846 	return (rc);
847 }
848 
849 int
850 smb_server_numopen(smb_ioc_opennum_t *ioc)
851 {
852 	smb_server_t	*sv;
853 	int		rc;
854 
855 	if ((rc = smb_server_lookup(&sv)) == 0) {
856 		ioc->open_users = sv->sv_users;
857 		ioc->open_trees = sv->sv_trees;
858 		ioc->open_files = sv->sv_files + sv->sv_pipes;
859 		smb_server_release(sv);
860 	}
861 	return (rc);
862 }
863 
864 /*
865  * Enumerate objects within the server.  The svcenum provides the
866  * enumeration context, i.e. what the caller want to get back.
867  */
868 int
869 smb_server_enum(smb_ioc_svcenum_t *ioc)
870 {
871 	smb_svcenum_t	*svcenum = &ioc->svcenum;
872 	smb_server_t	*sv;
873 	int		rc;
874 
875 	/*
876 	 * Reality check that the buffer-length insize the enum doesn't
877 	 * overrun the ioctl's total length.
878 	 */
879 	if (svcenum->se_buflen + sizeof (*ioc) > ioc->hdr.len)
880 		return (EINVAL);
881 
882 	if ((rc = smb_server_lookup(&sv)) != 0)
883 		return (rc);
884 
885 	svcenum->se_bavail = svcenum->se_buflen;
886 	svcenum->se_bused = 0;
887 	svcenum->se_nitems = 0;
888 
889 	switch (svcenum->se_type) {
890 	case SMB_SVCENUM_TYPE_USER:
891 		smb_server_enum_users(&sv->sv_session_list, svcenum);
892 		break;
893 	case SMB_SVCENUM_TYPE_TREE:
894 	case SMB_SVCENUM_TYPE_FILE:
895 		smb_server_enum_trees(&sv->sv_session_list, svcenum);
896 		break;
897 	default:
898 		rc = EINVAL;
899 	}
900 
901 	smb_server_release(sv);
902 	return (rc);
903 }
904 
905 /*
906  * Look for sessions to disconnect by client and user name.
907  */
908 int
909 smb_server_session_close(smb_ioc_session_t *ioc)
910 {
911 	smb_llist_t	*ll;
912 	smb_server_t	*sv;
913 	int		cnt;
914 	int		rc;
915 
916 	if ((rc = smb_server_lookup(&sv)) != 0)
917 		return (rc);
918 
919 	ll = &sv->sv_session_list;
920 	cnt = smb_server_session_disconnect(ll, ioc->client, ioc->username);
921 
922 	smb_server_release(sv);
923 
924 	if (cnt == 0)
925 		return (ENOENT);
926 	return (0);
927 }
928 
929 /*
930  * Close a file by uniqid.
931  */
932 int
933 smb_server_file_close(smb_ioc_fileid_t *ioc)
934 {
935 	uint32_t	uniqid = ioc->uniqid;
936 	smb_llist_t	*ll;
937 	smb_server_t	*sv;
938 	int		rc;
939 
940 	if ((rc = smb_server_lookup(&sv)) != 0)
941 		return (rc);
942 
943 	ll = &sv->sv_session_list;
944 	rc = smb_server_fclose(ll, uniqid);
945 
946 	smb_server_release(sv);
947 	return (rc);
948 }
949 
950 /*
951  * These functions determine the relevant smb server to which the call apply.
952  */
953 
954 uint32_t
955 smb_server_get_session_count(smb_server_t *sv)
956 {
957 	uint32_t	counter = 0;
958 
959 	counter = smb_llist_get_count(&sv->sv_session_list);
960 
961 	return (counter);
962 }
963 
964 /*
965  * Gets the vnode of the specified share path.
966  *
967  * A hold on the returned vnode pointer is taken so the caller
968  * must call VN_RELE.
969  */
970 int
971 smb_server_sharevp(smb_server_t *sv, const char *shr_path, vnode_t **vp)
972 {
973 	smb_request_t	*sr;
974 	smb_node_t	*fnode = NULL;
975 	smb_node_t	*dnode;
976 	char		last_comp[MAXNAMELEN];
977 	int		rc = 0;
978 
979 	ASSERT(shr_path);
980 
981 	mutex_enter(&sv->sv_mutex);
982 	switch (sv->sv_state) {
983 	case SMB_SERVER_STATE_RUNNING:
984 		break;
985 	default:
986 		mutex_exit(&sv->sv_mutex);
987 		return (ENOTACTIVE);
988 	}
989 	mutex_exit(&sv->sv_mutex);
990 
991 	if ((sr = smb_request_alloc(sv->sv_session, 0)) == NULL) {
992 		return (ENOTCONN);
993 	}
994 	sr->user_cr = zone_kcred();
995 
996 	rc = smb_pathname_reduce(sr, sr->user_cr, shr_path,
997 	    NULL, NULL, &dnode, last_comp);
998 
999 	if (rc == 0) {
1000 		rc = smb_fsop_lookup(sr, sr->user_cr, SMB_FOLLOW_LINKS,
1001 		    sv->si_root_smb_node, dnode, last_comp, &fnode);
1002 		smb_node_release(dnode);
1003 	}
1004 
1005 	smb_request_free(sr);
1006 
1007 	if (rc != 0)
1008 		return (rc);
1009 
1010 	ASSERT(fnode->vp && fnode->vp->v_vfsp);
1011 
1012 	VN_HOLD(fnode->vp);
1013 	*vp = fnode->vp;
1014 
1015 	smb_node_release(fnode);
1016 
1017 	return (0);
1018 }
1019 
1020 #ifdef	_KERNEL
1021 /*
1022  * This is a special interface that will be utilized by ZFS to cause a share to
1023  * be added/removed.
1024  *
1025  * arg is either a lmshare_info_t or share_name from userspace.
1026  * It will need to be copied into the kernel.   It is lmshare_info_t
1027  * for add operations and share_name for delete operations.
1028  */
1029 int
1030 smb_server_share(void *arg, boolean_t add_share)
1031 {
1032 	smb_server_t	*sv;
1033 	int		rc;
1034 
1035 	if ((rc = smb_server_lookup(&sv)) == 0) {
1036 		mutex_enter(&sv->sv_mutex);
1037 		switch (sv->sv_state) {
1038 		case SMB_SERVER_STATE_RUNNING:
1039 			mutex_exit(&sv->sv_mutex);
1040 			(void) smb_kshare_upcall(sv->sv_lmshrd, arg, add_share);
1041 			break;
1042 		default:
1043 			mutex_exit(&sv->sv_mutex);
1044 			break;
1045 		}
1046 		smb_server_release(sv);
1047 	}
1048 
1049 	return (rc);
1050 }
1051 #endif	/* _KERNEL */
1052 
1053 int
1054 smb_server_unshare(const char *sharename)
1055 {
1056 	smb_server_t	*sv;
1057 	smb_llist_t	*ll;
1058 	int		rc;
1059 
1060 	if ((rc = smb_server_lookup(&sv)))
1061 		return (rc);
1062 
1063 	mutex_enter(&sv->sv_mutex);
1064 	switch (sv->sv_state) {
1065 	case SMB_SERVER_STATE_RUNNING:
1066 	case SMB_SERVER_STATE_STOPPING:
1067 		break;
1068 	default:
1069 		mutex_exit(&sv->sv_mutex);
1070 		smb_server_release(sv);
1071 		return (ENOTACTIVE);
1072 	}
1073 	mutex_exit(&sv->sv_mutex);
1074 
1075 	ll = &sv->sv_session_list;
1076 	smb_server_disconnect_share(ll, sharename);
1077 
1078 	smb_server_release(sv);
1079 	return (0);
1080 }
1081 
1082 /*
1083  * Disconnect the specified share.
1084  * Typically called when a share has been removed.
1085  */
1086 static void
1087 smb_server_disconnect_share(smb_llist_t *ll, const char *sharename)
1088 {
1089 	smb_session_t	*session;
1090 
1091 	smb_llist_enter(ll, RW_READER);
1092 
1093 	session = smb_llist_head(ll);
1094 	while (session) {
1095 		SMB_SESSION_VALID(session);
1096 		smb_rwx_rwenter(&session->s_lock, RW_READER);
1097 		switch (session->s_state) {
1098 		case SMB_SESSION_STATE_NEGOTIATED:
1099 			smb_rwx_rwexit(&session->s_lock);
1100 			smb_session_disconnect_share(session, sharename);
1101 			break;
1102 		default:
1103 			smb_rwx_rwexit(&session->s_lock);
1104 			break;
1105 		}
1106 		session = smb_llist_next(ll, session);
1107 	}
1108 
1109 	smb_llist_exit(ll);
1110 }
1111 
1112 /*
1113  * *****************************************************************************
1114  * **************** Functions called from the internal layers ******************
1115  * *****************************************************************************
1116  *
1117  * These functions are provided the relevant smb server by the caller.
1118  */
1119 
1120 void
1121 smb_server_get_cfg(smb_server_t *sv, smb_kmod_cfg_t *cfg)
1122 {
1123 	rw_enter(&sv->sv_cfg_lock, RW_READER);
1124 	bcopy(&sv->sv_cfg, cfg, sizeof (*cfg));
1125 	rw_exit(&sv->sv_cfg_lock);
1126 }
1127 
1128 /*
1129  *
1130  */
1131 void
1132 smb_server_inc_nbt_sess(smb_server_t *sv)
1133 {
1134 	SMB_SERVER_VALID(sv);
1135 	atomic_inc_32(&sv->sv_nbt_sess);
1136 }
1137 
1138 void
1139 smb_server_dec_nbt_sess(smb_server_t *sv)
1140 {
1141 	SMB_SERVER_VALID(sv);
1142 	atomic_dec_32(&sv->sv_nbt_sess);
1143 }
1144 
1145 void
1146 smb_server_inc_tcp_sess(smb_server_t *sv)
1147 {
1148 	SMB_SERVER_VALID(sv);
1149 	atomic_inc_32(&sv->sv_tcp_sess);
1150 }
1151 
1152 void
1153 smb_server_dec_tcp_sess(smb_server_t *sv)
1154 {
1155 	SMB_SERVER_VALID(sv);
1156 	atomic_dec_32(&sv->sv_tcp_sess);
1157 }
1158 
1159 void
1160 smb_server_inc_users(smb_server_t *sv)
1161 {
1162 	SMB_SERVER_VALID(sv);
1163 	atomic_inc_32(&sv->sv_users);
1164 }
1165 
1166 void
1167 smb_server_dec_users(smb_server_t *sv)
1168 {
1169 	SMB_SERVER_VALID(sv);
1170 	atomic_dec_32(&sv->sv_users);
1171 }
1172 
1173 void
1174 smb_server_inc_trees(smb_server_t *sv)
1175 {
1176 	SMB_SERVER_VALID(sv);
1177 	atomic_inc_32(&sv->sv_trees);
1178 }
1179 
1180 void
1181 smb_server_dec_trees(smb_server_t *sv)
1182 {
1183 	SMB_SERVER_VALID(sv);
1184 	atomic_dec_32(&sv->sv_trees);
1185 }
1186 
1187 void
1188 smb_server_inc_files(smb_server_t *sv)
1189 {
1190 	SMB_SERVER_VALID(sv);
1191 	atomic_inc_32(&sv->sv_files);
1192 }
1193 
1194 void
1195 smb_server_dec_files(smb_server_t *sv)
1196 {
1197 	SMB_SERVER_VALID(sv);
1198 	atomic_dec_32(&sv->sv_files);
1199 }
1200 
1201 void
1202 smb_server_inc_pipes(smb_server_t *sv)
1203 {
1204 	SMB_SERVER_VALID(sv);
1205 	atomic_inc_32(&sv->sv_pipes);
1206 }
1207 
1208 void
1209 smb_server_dec_pipes(smb_server_t *sv)
1210 {
1211 	SMB_SERVER_VALID(sv);
1212 	atomic_dec_32(&sv->sv_pipes);
1213 }
1214 
1215 void
1216 smb_server_add_rxb(smb_server_t *sv, int64_t value)
1217 {
1218 	SMB_SERVER_VALID(sv);
1219 	atomic_add_64(&sv->sv_rxb, value);
1220 }
1221 
1222 void
1223 smb_server_add_txb(smb_server_t *sv, int64_t value)
1224 {
1225 	SMB_SERVER_VALID(sv);
1226 	atomic_add_64(&sv->sv_txb, value);
1227 }
1228 
1229 void
1230 smb_server_inc_req(smb_server_t *sv)
1231 {
1232 	SMB_SERVER_VALID(sv);
1233 	atomic_inc_64(&sv->sv_nreq);
1234 }
1235 
1236 /*
1237  * *****************************************************************************
1238  * *************************** Static Functions ********************************
1239  * *****************************************************************************
1240  */
1241 
1242 static void
1243 smb_server_timers(smb_thread_t *thread, void *arg)
1244 {
1245 	smb_server_t	*sv = (smb_server_t *)arg;
1246 
1247 	ASSERT(sv != NULL);
1248 
1249 	/*
1250 	 * This kills old inactive sessions and expired durable
1251 	 * handles. The session code expects one call per minute.
1252 	 */
1253 	while (smb_thread_continue_timedwait(thread, 60 /* Seconds */)) {
1254 		if (sv->sv_cfg.skc_keepalive != 0)
1255 			smb_session_timers(sv);
1256 		smb2_durable_timers(sv);
1257 	}
1258 }
1259 
1260 /*
1261  * smb_server_kstat_init
1262  */
1263 static void
1264 smb_server_kstat_init(smb_server_t *sv)
1265 {
1266 
1267 	sv->sv_ksp = kstat_create_zone(SMBSRV_KSTAT_MODULE, 0,
1268 	    SMBSRV_KSTAT_STATISTICS, SMBSRV_KSTAT_CLASS, KSTAT_TYPE_RAW,
1269 	    sizeof (smbsrv_kstats_t), 0, sv->sv_zid);
1270 
1271 	if (sv->sv_ksp != NULL) {
1272 		sv->sv_ksp->ks_update = smb_server_kstat_update;
1273 		sv->sv_ksp->ks_private = sv;
1274 		((smbsrv_kstats_t *)sv->sv_ksp->ks_data)->ks_start_time =
1275 		    sv->sv_start_time;
1276 		smb_dispatch_stats_init(sv);
1277 		smb2_dispatch_stats_init(sv);
1278 		kstat_install(sv->sv_ksp);
1279 	} else {
1280 		cmn_err(CE_WARN, "SMB Server: Statistics unavailable");
1281 	}
1282 
1283 	sv->sv_legacy_ksp = kstat_create_zone(SMBSRV_KSTAT_MODULE, 0,
1284 	    SMBSRV_KSTAT_NAME, SMBSRV_KSTAT_CLASS, KSTAT_TYPE_NAMED,
1285 	    sizeof (smb_server_legacy_kstat_t) / sizeof (kstat_named_t),
1286 	    0, sv->sv_zid);
1287 
1288 	if (sv->sv_legacy_ksp != NULL) {
1289 		smb_server_legacy_kstat_t *ksd;
1290 
1291 		ksd = sv->sv_legacy_ksp->ks_data;
1292 
1293 		(void) strlcpy(ksd->ls_files.name, "open_files",
1294 		    sizeof (ksd->ls_files.name));
1295 		ksd->ls_files.data_type = KSTAT_DATA_UINT32;
1296 
1297 		(void) strlcpy(ksd->ls_trees.name, "connections",
1298 		    sizeof (ksd->ls_trees.name));
1299 		ksd->ls_trees.data_type = KSTAT_DATA_UINT32;
1300 
1301 		(void) strlcpy(ksd->ls_users.name, "connections",
1302 		    sizeof (ksd->ls_users.name));
1303 		ksd->ls_users.data_type = KSTAT_DATA_UINT32;
1304 
1305 		mutex_init(&sv->sv_legacy_ksmtx, NULL, MUTEX_DEFAULT, NULL);
1306 		sv->sv_legacy_ksp->ks_lock = &sv->sv_legacy_ksmtx;
1307 		sv->sv_legacy_ksp->ks_update = smb_server_legacy_kstat_update;
1308 		kstat_install(sv->sv_legacy_ksp);
1309 	}
1310 }
1311 
1312 /*
1313  * smb_server_kstat_fini
1314  */
1315 static void
1316 smb_server_kstat_fini(smb_server_t *sv)
1317 {
1318 	if (sv->sv_legacy_ksp != NULL) {
1319 		kstat_delete(sv->sv_legacy_ksp);
1320 		mutex_destroy(&sv->sv_legacy_ksmtx);
1321 		sv->sv_legacy_ksp = NULL;
1322 	}
1323 
1324 	if (sv->sv_ksp != NULL) {
1325 		kstat_delete(sv->sv_ksp);
1326 		sv->sv_ksp = NULL;
1327 		smb_dispatch_stats_fini(sv);
1328 		smb2_dispatch_stats_fini(sv);
1329 	}
1330 }
1331 
1332 /*
1333  * smb_server_kstat_update
1334  */
1335 static int
1336 smb_server_kstat_update(kstat_t *ksp, int rw)
1337 {
1338 	smb_server_t	*sv;
1339 	smbsrv_kstats_t	*ksd;
1340 
1341 	if (rw == KSTAT_READ) {
1342 		sv = ksp->ks_private;
1343 		SMB_SERVER_VALID(sv);
1344 		ksd = (smbsrv_kstats_t *)ksp->ks_data;
1345 		/*
1346 		 * Counters
1347 		 */
1348 		ksd->ks_nbt_sess = sv->sv_nbt_sess;
1349 		ksd->ks_tcp_sess = sv->sv_tcp_sess;
1350 		ksd->ks_users = sv->sv_users;
1351 		ksd->ks_trees = sv->sv_trees;
1352 		ksd->ks_files = sv->sv_files;
1353 		ksd->ks_pipes = sv->sv_pipes;
1354 		/*
1355 		 * Throughput
1356 		 */
1357 		ksd->ks_txb = sv->sv_txb;
1358 		ksd->ks_rxb = sv->sv_rxb;
1359 		ksd->ks_nreq = sv->sv_nreq;
1360 		/*
1361 		 * Busyness
1362 		 */
1363 		ksd->ks_maxreqs = sv->sv_cfg.skc_maxworkers;
1364 		smb_srqueue_update(&sv->sv_srqueue,
1365 		    &ksd->ks_utilization);
1366 		/*
1367 		 * Latency & Throughput of the requests
1368 		 */
1369 		smb_dispatch_stats_update(sv, ksd->ks_reqs1, 0, SMB_COM_NUM);
1370 		smb2_dispatch_stats_update(sv, ksd->ks_reqs2, 0, SMB2__NCMDS);
1371 		return (0);
1372 	}
1373 	if (rw == KSTAT_WRITE)
1374 		return (EACCES);
1375 
1376 	return (EIO);
1377 }
1378 
1379 static int
1380 smb_server_legacy_kstat_update(kstat_t *ksp, int rw)
1381 {
1382 	smb_server_t			*sv;
1383 	smb_server_legacy_kstat_t	*ksd;
1384 	int				rc;
1385 
1386 	switch (rw) {
1387 	case KSTAT_WRITE:
1388 		rc = EACCES;
1389 		break;
1390 	case KSTAT_READ:
1391 		if (!smb_server_lookup(&sv)) {
1392 			ASSERT(MUTEX_HELD(ksp->ks_lock));
1393 			ASSERT(sv->sv_legacy_ksp == ksp);
1394 			ksd = (smb_server_legacy_kstat_t *)ksp->ks_data;
1395 			ksd->ls_files.value.ui32 = sv->sv_files + sv->sv_pipes;
1396 			ksd->ls_trees.value.ui32 = sv->sv_trees;
1397 			ksd->ls_users.value.ui32 = sv->sv_users;
1398 			smb_server_release(sv);
1399 			rc = 0;
1400 			break;
1401 		}
1402 		/* FALLTHROUGH */
1403 	default:
1404 		rc = EIO;
1405 		break;
1406 	}
1407 	return (rc);
1408 
1409 }
1410 
1411 /*
1412  * smb_server_shutdown
1413  */
1414 static void
1415 smb_server_shutdown(smb_server_t *sv)
1416 {
1417 	smb_llist_t *sl = &sv->sv_session_list;
1418 	smb_session_t *session;
1419 	clock_t	time;
1420 
1421 	SMB_SERVER_VALID(sv);
1422 
1423 	/*
1424 	 * Stop the listeners first, so we don't get any more
1425 	 * new work while we're trying to shut down.
1426 	 */
1427 	smb_server_listener_stop(&sv->sv_nbt_daemon);
1428 	smb_server_listener_stop(&sv->sv_tcp_daemon);
1429 	smb_thread_stop(&sv->si_thread_timers);
1430 
1431 	/* Disconnect all of the sessions */
1432 	smb_llist_enter(sl, RW_READER);
1433 	session = smb_llist_head(sl);
1434 	while (session != NULL) {
1435 		smb_session_disconnect(session);
1436 		session = smb_llist_next(sl, session);
1437 	}
1438 	smb_llist_exit(sl);
1439 
1440 	/*
1441 	 * Wake up any threads we might have blocked.
1442 	 * Must precede kdoor_close etc. because those will
1443 	 * wait for such threads to get out.
1444 	 */
1445 	smb_event_cancel(sv, 0);
1446 	smb_threshold_wake_all(&sv->sv_ssetup_ct);
1447 	smb_threshold_wake_all(&sv->sv_tcon_ct);
1448 	smb_threshold_wake_all(&sv->sv_opipe_ct);
1449 
1450 	/*
1451 	 * Wait for the session list to empty.
1452 	 * (cv_signal in smb_server_destroy_session)
1453 	 *
1454 	 * This should not take long, but if there are any leaked
1455 	 * references to ofiles, trees, or users, there could be a
1456 	 * session hanging around.  If that happens, the ll_count
1457 	 * never gets to zero and we'll never get the sv_signal.
1458 	 * Defend against that problem using timed wait, then
1459 	 * complain if we find sessions left over and continue
1460 	 * with shutdown in spite of any leaked sessions.
1461 	 * That's better than a server that won't reboot.
1462 	 */
1463 	time = SEC_TO_TICK(10) + ddi_get_lbolt();
1464 	mutex_enter(&sv->sv_mutex);
1465 	while (sv->sv_session_list.ll_count != 0) {
1466 		if (cv_timedwait(&sv->sv_cv, &sv->sv_mutex, time) < 0)
1467 			break;
1468 	}
1469 	mutex_exit(&sv->sv_mutex);
1470 #ifdef	DEBUG
1471 	if (sv->sv_session_list.ll_count != 0) {
1472 		cmn_err(CE_NOTE, "shutdown leaked sessions");
1473 		debug_enter("shutdown leaked sessions");
1474 	}
1475 #endif
1476 
1477 	/*
1478 	 * Clean out any durable handles.  After this we should
1479 	 * have no ofiles remaining (and no more oplock breaks).
1480 	 */
1481 	smb2_dh_shutdown(sv);
1482 
1483 	smb_kdoor_close(sv);
1484 #ifdef	_KERNEL
1485 	smb_kshare_door_fini(sv->sv_lmshrd);
1486 #endif	/* _KERNEL */
1487 	sv->sv_lmshrd = NULL;
1488 
1489 	smb_export_stop(sv);
1490 	smb_kshare_stop(sv);
1491 
1492 	/*
1493 	 * Both kshare and the oplock break sub-systems may have
1494 	 * taskq jobs on the spcial "server" session, until we've
1495 	 * closed all ofiles and stopped the kshare exporter.
1496 	 * Now it's safe to destroy the server session, but first
1497 	 * wait for any requests on it to finish.  Note that for
1498 	 * normal sessions, this happens in smb_session_cancel,
1499 	 * but that's not called for the server session.
1500 	 */
1501 	if (sv->sv_session != NULL) {
1502 		smb_slist_wait_for_empty(&sv->sv_session->s_req_list);
1503 
1504 		smb_session_delete(sv->sv_session);
1505 		sv->sv_session = NULL;
1506 	}
1507 
1508 	if (sv->sv_receiver_pool != NULL) {
1509 		taskq_destroy(sv->sv_receiver_pool);
1510 		sv->sv_receiver_pool = NULL;
1511 	}
1512 
1513 	if (sv->sv_worker_pool != NULL) {
1514 		taskq_destroy(sv->sv_worker_pool);
1515 		sv->sv_worker_pool = NULL;
1516 	}
1517 
1518 	smb_server_fsop_stop(sv);
1519 }
1520 
1521 /*
1522  * smb_server_listener_init
1523  *
1524  * Initializes listener contexts.
1525  */
1526 static void
1527 smb_server_listener_init(
1528     smb_server_t		*sv,
1529     smb_listener_daemon_t	*ld,
1530     char			*name,
1531     in_port_t			port,
1532     int				family)
1533 {
1534 	ASSERT(ld->ld_magic != SMB_LISTENER_MAGIC);
1535 
1536 	bzero(ld, sizeof (*ld));
1537 
1538 	ld->ld_sv = sv;
1539 	ld->ld_family = family;
1540 	ld->ld_port = port;
1541 
1542 	if (family == AF_INET) {
1543 		ld->ld_sin.sin_family = (uint32_t)family;
1544 		ld->ld_sin.sin_port = htons(port);
1545 		ld->ld_sin.sin_addr.s_addr = htonl(INADDR_ANY);
1546 	} else {
1547 		ld->ld_sin6.sin6_family = (uint32_t)family;
1548 		ld->ld_sin6.sin6_port = htons(port);
1549 		(void) memset(&ld->ld_sin6.sin6_addr.s6_addr, 0,
1550 		    sizeof (ld->ld_sin6.sin6_addr.s6_addr));
1551 	}
1552 
1553 	smb_thread_init(&ld->ld_thread, name, smb_server_listener, ld,
1554 	    smbsrv_listen_pri);
1555 	ld->ld_magic = SMB_LISTENER_MAGIC;
1556 }
1557 
1558 /*
1559  * smb_server_listener_destroy
1560  *
1561  * Destroyes listener contexts.
1562  */
1563 static void
1564 smb_server_listener_destroy(smb_listener_daemon_t *ld)
1565 {
1566 	/*
1567 	 * Note that if startup fails early, we can legitimately
1568 	 * get here with an all-zeros object.
1569 	 */
1570 	if (ld->ld_magic == 0)
1571 		return;
1572 
1573 	SMB_LISTENER_VALID(ld);
1574 	ASSERT(ld->ld_so == NULL);
1575 	smb_thread_destroy(&ld->ld_thread);
1576 	ld->ld_magic = 0;
1577 }
1578 
1579 /*
1580  * smb_server_listener_start
1581  *
1582  * Starts the listener associated with the context passed in.
1583  *
1584  * Return:	0	Success
1585  *		not 0	Failure
1586  */
1587 static int
1588 smb_server_listener_start(smb_listener_daemon_t *ld)
1589 {
1590 	int		rc;
1591 	uint32_t	on;
1592 	uint32_t	off;
1593 
1594 	SMB_LISTENER_VALID(ld);
1595 
1596 	if (ld->ld_so != NULL)
1597 		return (EINVAL);
1598 
1599 	ld->ld_so = smb_socreate(ld->ld_family, SOCK_STREAM, 0);
1600 	if (ld->ld_so == NULL) {
1601 		cmn_err(CE_WARN, "port %d: socket create failed", ld->ld_port);
1602 		return (ENOMEM);
1603 	}
1604 
1605 	off = 0;
1606 	(void) ksocket_setsockopt(ld->ld_so, SOL_SOCKET,
1607 	    SO_MAC_EXEMPT, &off, sizeof (off), CRED());
1608 
1609 	on = 1;
1610 	(void) ksocket_setsockopt(ld->ld_so, SOL_SOCKET,
1611 	    SO_REUSEADDR, &on, sizeof (on), CRED());
1612 
1613 	if (ld->ld_family == AF_INET) {
1614 		rc = ksocket_bind(ld->ld_so,
1615 		    (struct sockaddr *)&ld->ld_sin,
1616 		    sizeof (ld->ld_sin), CRED());
1617 	} else {
1618 		rc = ksocket_bind(ld->ld_so,
1619 		    (struct sockaddr *)&ld->ld_sin6,
1620 		    sizeof (ld->ld_sin6), CRED());
1621 	}
1622 
1623 	if (rc != 0) {
1624 		cmn_err(CE_WARN, "port %d: bind failed", ld->ld_port);
1625 		return (rc);
1626 	}
1627 
1628 	rc =  ksocket_listen(ld->ld_so, 20, CRED());
1629 	if (rc < 0) {
1630 		cmn_err(CE_WARN, "port %d: listen failed", ld->ld_port);
1631 		return (rc);
1632 	}
1633 
1634 	ksocket_hold(ld->ld_so);
1635 	rc = smb_thread_start(&ld->ld_thread);
1636 	if (rc != 0) {
1637 		ksocket_rele(ld->ld_so);
1638 		cmn_err(CE_WARN, "port %d: listener failed to start",
1639 		    ld->ld_port);
1640 		return (rc);
1641 	}
1642 	return (0);
1643 }
1644 
1645 /*
1646  * smb_server_listener_stop
1647  *
1648  * Stops the listener associated with the context passed in.
1649  */
1650 static void
1651 smb_server_listener_stop(smb_listener_daemon_t *ld)
1652 {
1653 	SMB_LISTENER_VALID(ld);
1654 
1655 	if (ld->ld_so != NULL) {
1656 		smb_soshutdown(ld->ld_so);
1657 		smb_sodestroy(ld->ld_so);
1658 		smb_thread_stop(&ld->ld_thread);
1659 		ld->ld_so = NULL;
1660 	}
1661 }
1662 
1663 /*
1664  * smb_server_listener
1665  *
1666  * Entry point of the listeners.
1667  */
1668 static void
1669 smb_server_listener(smb_thread_t *thread, void *arg)
1670 {
1671 	_NOTE(ARGUNUSED(thread))
1672 	smb_listener_daemon_t	*ld;
1673 	ksocket_t		s_so;
1674 	int			on;
1675 	int			txbuf_size;
1676 
1677 	ld = (smb_listener_daemon_t *)arg;
1678 
1679 	SMB_LISTENER_VALID(ld);
1680 
1681 	DTRACE_PROBE1(so__wait__accept, struct sonode *, ld->ld_so);
1682 
1683 	for (;;) {
1684 		int ret = ksocket_accept(ld->ld_so, NULL, NULL, &s_so, CRED());
1685 
1686 		switch (ret) {
1687 		case 0:
1688 			break;
1689 		case ECONNABORTED:
1690 			continue;
1691 		case EINTR:
1692 		case EBADF:	/* libfakekernel */
1693 			goto out;
1694 		default:
1695 			cmn_err(CE_WARN,
1696 			    "smb_server_listener: ksocket_accept(%d)",
1697 			    ret);
1698 			goto out;
1699 		}
1700 
1701 		DTRACE_PROBE1(so__accept, struct sonode *, s_so);
1702 
1703 		on = 1;
1704 		(void) ksocket_setsockopt(s_so, IPPROTO_TCP, TCP_NODELAY,
1705 		    &on, sizeof (on), CRED());
1706 
1707 		on = 1;
1708 		(void) ksocket_setsockopt(s_so, SOL_SOCKET, SO_KEEPALIVE,
1709 		    &on, sizeof (on), CRED());
1710 
1711 		txbuf_size = 128*1024;
1712 		(void) ksocket_setsockopt(s_so, SOL_SOCKET, SO_SNDBUF,
1713 		    (const void *)&txbuf_size, sizeof (txbuf_size), CRED());
1714 
1715 		/*
1716 		 * Create a session for this connection.
1717 		 */
1718 		smb_server_create_session(ld, s_so);
1719 	}
1720 out:
1721 	ksocket_rele(ld->ld_so);
1722 }
1723 
1724 /*
1725  * smb_server_receiver
1726  *
1727  * Entry point of the receiver threads.
1728  * Also does cleanup when socket disconnected.
1729  */
1730 static void
1731 smb_server_receiver(void *arg)
1732 {
1733 	smb_session_t	*session;
1734 
1735 	session = (smb_session_t *)arg;
1736 
1737 	/* We stay in here until socket disconnect. */
1738 	smb_session_receiver(session);
1739 
1740 	ASSERT(session->s_state == SMB_SESSION_STATE_SHUTDOWN);
1741 	smb_server_destroy_session(session);
1742 }
1743 
1744 /*
1745  * smb_server_lookup
1746  *
1747  * This function finds the server associated with the zone of the
1748  * caller.  Note: requires a fix in the dynamic taskq code:
1749  * 1501 taskq_create_proc ... TQ_DYNAMIC puts tasks in p0
1750  */
1751 int
1752 smb_server_lookup(smb_server_t **psv)
1753 {
1754 	zoneid_t	zid;
1755 	smb_server_t	*sv;
1756 
1757 	zid = getzoneid();
1758 
1759 	smb_llist_enter(&smb_servers, RW_READER);
1760 	sv = smb_llist_head(&smb_servers);
1761 	while (sv) {
1762 		SMB_SERVER_VALID(sv);
1763 		if (sv->sv_zid == zid) {
1764 			mutex_enter(&sv->sv_mutex);
1765 			if (sv->sv_state != SMB_SERVER_STATE_DELETING) {
1766 				sv->sv_refcnt++;
1767 				mutex_exit(&sv->sv_mutex);
1768 				smb_llist_exit(&smb_servers);
1769 				*psv = sv;
1770 				return (0);
1771 			}
1772 			mutex_exit(&sv->sv_mutex);
1773 			break;
1774 		}
1775 		sv = smb_llist_next(&smb_servers, sv);
1776 	}
1777 	smb_llist_exit(&smb_servers);
1778 	return (EPERM);
1779 }
1780 
1781 /*
1782  * smb_server_release
1783  *
1784  * This function decrements the reference count of the server and signals its
1785  * condition variable if the state of the server is SMB_SERVER_STATE_DELETING.
1786  */
1787 void
1788 smb_server_release(smb_server_t *sv)
1789 {
1790 	SMB_SERVER_VALID(sv);
1791 
1792 	mutex_enter(&sv->sv_mutex);
1793 	ASSERT(sv->sv_refcnt);
1794 	sv->sv_refcnt--;
1795 	if ((sv->sv_refcnt == 0) && (sv->sv_state == SMB_SERVER_STATE_DELETING))
1796 		cv_signal(&sv->sv_cv);
1797 	mutex_exit(&sv->sv_mutex);
1798 }
1799 
1800 /*
1801  * Enumerate the users associated with a session list.
1802  */
1803 static void
1804 smb_server_enum_users(smb_llist_t *ll, smb_svcenum_t *svcenum)
1805 {
1806 	smb_session_t	*sn;
1807 	smb_llist_t	*ulist;
1808 	smb_user_t	*user;
1809 	int		rc = 0;
1810 
1811 	smb_llist_enter(ll, RW_READER);
1812 	sn = smb_llist_head(ll);
1813 
1814 	while (sn != NULL) {
1815 		SMB_SESSION_VALID(sn);
1816 		ulist = &sn->s_user_list;
1817 		smb_llist_enter(ulist, RW_READER);
1818 		user = smb_llist_head(ulist);
1819 
1820 		while (user != NULL) {
1821 			if (smb_user_hold(user)) {
1822 				rc = smb_user_enum(user, svcenum);
1823 				smb_user_release(user);
1824 				if (rc != 0)
1825 					break;
1826 			}
1827 
1828 			user = smb_llist_next(ulist, user);
1829 		}
1830 
1831 		smb_llist_exit(ulist);
1832 
1833 		if (rc != 0)
1834 			break;
1835 
1836 		sn = smb_llist_next(ll, sn);
1837 	}
1838 
1839 	smb_llist_exit(ll);
1840 }
1841 
1842 /*
1843  * Enumerate the trees/files associated with a session list.
1844  */
1845 static void
1846 smb_server_enum_trees(smb_llist_t *ll, smb_svcenum_t *svcenum)
1847 {
1848 	smb_session_t	*sn;
1849 	smb_llist_t	*tlist;
1850 	smb_tree_t	*tree;
1851 	int		rc = 0;
1852 
1853 	smb_llist_enter(ll, RW_READER);
1854 	sn = smb_llist_head(ll);
1855 
1856 	while (sn != NULL) {
1857 		SMB_SESSION_VALID(sn);
1858 		tlist = &sn->s_tree_list;
1859 		smb_llist_enter(tlist, RW_READER);
1860 		tree = smb_llist_head(tlist);
1861 
1862 		while (tree != NULL) {
1863 			if (smb_tree_hold(tree)) {
1864 				rc = smb_tree_enum(tree, svcenum);
1865 				smb_tree_release(tree);
1866 				if (rc != 0)
1867 					break;
1868 			}
1869 
1870 			tree = smb_llist_next(tlist, tree);
1871 		}
1872 
1873 		smb_llist_exit(tlist);
1874 
1875 		if (rc != 0)
1876 			break;
1877 
1878 		sn = smb_llist_next(ll, sn);
1879 	}
1880 
1881 	smb_llist_exit(ll);
1882 }
1883 
1884 /*
1885  * Disconnect sessions associated with the specified client and username.
1886  * Empty strings are treated as wildcards.
1887  */
1888 static int
1889 smb_server_session_disconnect(smb_llist_t *ll,
1890     const char *client, const char *name)
1891 {
1892 	smb_session_t	*sn;
1893 	smb_llist_t	*ulist;
1894 	smb_user_t	*user;
1895 	int		count = 0;
1896 
1897 	smb_llist_enter(ll, RW_READER);
1898 
1899 	for (sn = smb_llist_head(ll);
1900 	    sn != NULL;
1901 	    sn = smb_llist_next(ll, sn)) {
1902 		SMB_SESSION_VALID(sn);
1903 
1904 		if (*client != '\0' && !smb_session_isclient(sn, client))
1905 			continue;
1906 
1907 		ulist = &sn->s_user_list;
1908 		smb_llist_enter(ulist, RW_READER);
1909 
1910 		for (user = smb_llist_head(ulist);
1911 		    user != NULL;
1912 		    user = smb_llist_next(ulist, user)) {
1913 			SMB_USER_VALID(user);
1914 
1915 			if (*name != '\0' && !smb_user_namecmp(user, name))
1916 				continue;
1917 
1918 			if (smb_user_hold(user)) {
1919 				smb_user_logoff(user);
1920 				smb_user_release(user);
1921 				count++;
1922 			}
1923 		}
1924 
1925 		smb_llist_exit(ulist);
1926 	}
1927 
1928 	smb_llist_exit(ll);
1929 	return (count);
1930 }
1931 
1932 /*
1933  * Close a file by its unique id.
1934  */
1935 static int
1936 smb_server_fclose(smb_llist_t *ll, uint32_t uniqid)
1937 {
1938 	smb_session_t	*sn;
1939 	smb_llist_t	*tlist;
1940 	smb_tree_t	*tree;
1941 	int		rc = ENOENT;
1942 
1943 	smb_llist_enter(ll, RW_READER);
1944 	sn = smb_llist_head(ll);
1945 
1946 	while ((sn != NULL) && (rc == ENOENT)) {
1947 		SMB_SESSION_VALID(sn);
1948 		tlist = &sn->s_tree_list;
1949 		smb_llist_enter(tlist, RW_READER);
1950 		tree = smb_llist_head(tlist);
1951 
1952 		while ((tree != NULL) && (rc == ENOENT)) {
1953 			if (smb_tree_hold(tree)) {
1954 				rc = smb_tree_fclose(tree, uniqid);
1955 				smb_tree_release(tree);
1956 			}
1957 
1958 			tree = smb_llist_next(tlist, tree);
1959 		}
1960 
1961 		smb_llist_exit(tlist);
1962 		sn = smb_llist_next(ll, sn);
1963 	}
1964 
1965 	smb_llist_exit(ll);
1966 	return (rc);
1967 }
1968 
1969 /*
1970  * This is used by SMB2 session setup to logoff a previous session,
1971  * so it can force a logoff that we haven't noticed yet.
1972  * This is not called frequently, so we just walk the list of
1973  * connections searching for the user.
1974  */
1975 void
1976 smb_server_logoff_ssnid(smb_request_t *sr, uint64_t ssnid)
1977 {
1978 	smb_server_t	*sv = sr->sr_server;
1979 	smb_llist_t	*sess_list;
1980 	smb_session_t	*sess;
1981 
1982 	if (sv->sv_state != SMB_SERVER_STATE_RUNNING)
1983 		return;
1984 
1985 	sess_list = &sv->sv_session_list;
1986 	smb_llist_enter(sess_list, RW_READER);
1987 
1988 	for (sess = smb_llist_head(sess_list);
1989 	    sess != NULL;
1990 	    sess = smb_llist_next(sess_list, sess)) {
1991 
1992 		smb_user_t	*user;
1993 
1994 		SMB_SESSION_VALID(sess);
1995 
1996 		if (sess->dialect < SMB_VERS_2_BASE)
1997 			continue;
1998 
1999 		if (sess->s_state != SMB_SESSION_STATE_NEGOTIATED)
2000 			continue;
2001 
2002 		user = smb_session_lookup_ssnid(sess, ssnid);
2003 		if (user == NULL)
2004 			continue;
2005 
2006 		if (!smb_is_same_user(user->u_cred, sr->user_cr)) {
2007 			smb_user_release(user);
2008 			continue;
2009 		}
2010 
2011 		/* Treat this as if we lost the connection */
2012 		user->preserve_opens = SMB2_DH_PRESERVE_SOME;
2013 		smb_user_logoff(user);
2014 		smb_user_release(user);
2015 
2016 		/*
2017 		 * The above may have left work on the delete queues
2018 		 */
2019 		smb_llist_flush(&sess->s_tree_list);
2020 		smb_llist_flush(&sess->s_user_list);
2021 	}
2022 
2023 	smb_llist_exit(sess_list);
2024 }
2025 
2026 /* See also: libsmb smb_kmod_setcfg */
2027 static void
2028 smb_server_store_cfg(smb_server_t *sv, smb_ioc_cfg_t *ioc)
2029 {
2030 	if (ioc->maxconnections == 0)
2031 		ioc->maxconnections = 0xFFFFFFFF;
2032 
2033 	if (ioc->encrypt == SMB_CONFIG_REQUIRED &&
2034 	    ioc->max_protocol < SMB_VERS_3_0) {
2035 		cmn_err(CE_WARN, "Server set to require encryption; "
2036 		    "forcing max_protocol to 3.0");
2037 		ioc->max_protocol = SMB_VERS_3_0;
2038 	}
2039 
2040 	sv->sv_cfg.skc_maxworkers = ioc->maxworkers;
2041 	sv->sv_cfg.skc_maxconnections = ioc->maxconnections;
2042 	sv->sv_cfg.skc_keepalive = ioc->keepalive;
2043 	sv->sv_cfg.skc_restrict_anon = ioc->restrict_anon;
2044 	sv->sv_cfg.skc_signing_enable = ioc->signing_enable;
2045 	sv->sv_cfg.skc_signing_required = ioc->signing_required;
2046 	sv->sv_cfg.skc_oplock_enable = ioc->oplock_enable;
2047 	sv->sv_cfg.skc_sync_enable = ioc->sync_enable;
2048 	sv->sv_cfg.skc_secmode = ioc->secmode;
2049 	sv->sv_cfg.skc_netbios_enable = ioc->netbios_enable;
2050 	sv->sv_cfg.skc_ipv6_enable = ioc->ipv6_enable;
2051 	sv->sv_cfg.skc_print_enable = ioc->print_enable;
2052 	sv->sv_cfg.skc_traverse_mounts = ioc->traverse_mounts;
2053 	sv->sv_cfg.skc_max_protocol = ioc->max_protocol;
2054 	sv->sv_cfg.skc_encrypt = ioc->encrypt;
2055 	sv->sv_cfg.skc_execflags = ioc->exec_flags;
2056 	sv->sv_cfg.skc_negtok_len = ioc->negtok_len;
2057 	sv->sv_cfg.skc_version = ioc->version;
2058 	sv->sv_cfg.skc_initial_credits = ioc->initial_credits;
2059 	sv->sv_cfg.skc_maximum_credits = ioc->maximum_credits;
2060 
2061 	(void) memcpy(sv->sv_cfg.skc_machine_uuid, ioc->machine_uuid,
2062 	    sizeof (uuid_t));
2063 	(void) memcpy(sv->sv_cfg.skc_negtok, ioc->negtok,
2064 	    sizeof (sv->sv_cfg.skc_negtok));
2065 	(void) memcpy(sv->sv_cfg.skc_native_os, ioc->native_os,
2066 	    sizeof (sv->sv_cfg.skc_native_os));
2067 	(void) memcpy(sv->sv_cfg.skc_native_lm, ioc->native_lm,
2068 	    sizeof (sv->sv_cfg.skc_native_lm));
2069 
2070 	(void) strlcpy(sv->sv_cfg.skc_nbdomain, ioc->nbdomain,
2071 	    sizeof (sv->sv_cfg.skc_nbdomain));
2072 	(void) strlcpy(sv->sv_cfg.skc_fqdn, ioc->fqdn,
2073 	    sizeof (sv->sv_cfg.skc_fqdn));
2074 	(void) strlcpy(sv->sv_cfg.skc_hostname, ioc->hostname,
2075 	    sizeof (sv->sv_cfg.skc_hostname));
2076 	(void) strlcpy(sv->sv_cfg.skc_system_comment, ioc->system_comment,
2077 	    sizeof (sv->sv_cfg.skc_system_comment));
2078 }
2079 
2080 static int
2081 smb_server_fsop_start(smb_server_t *sv)
2082 {
2083 	int	error;
2084 
2085 	error = smb_node_root_init(sv, &sv->si_root_smb_node);
2086 	if (error != 0)
2087 		sv->si_root_smb_node = NULL;
2088 
2089 	return (error);
2090 }
2091 
2092 static void
2093 smb_server_fsop_stop(smb_server_t *sv)
2094 {
2095 	if (sv->si_root_smb_node != NULL) {
2096 		smb_node_release(sv->si_root_smb_node);
2097 		sv->si_root_smb_node = NULL;
2098 	}
2099 }
2100 
2101 smb_event_t *
2102 smb_event_create(smb_server_t *sv, int timeout)
2103 {
2104 	smb_event_t	*event;
2105 
2106 	if (smb_server_is_stopping(sv))
2107 		return (NULL);
2108 
2109 	event = kmem_cache_alloc(smb_cache_event, KM_SLEEP);
2110 
2111 	bzero(event, sizeof (smb_event_t));
2112 	mutex_init(&event->se_mutex, NULL, MUTEX_DEFAULT, NULL);
2113 	cv_init(&event->se_cv, NULL, CV_DEFAULT, NULL);
2114 	event->se_magic = SMB_EVENT_MAGIC;
2115 	event->se_txid = smb_event_alloc_txid();
2116 	event->se_server = sv;
2117 	event->se_timeout = timeout;
2118 
2119 	smb_llist_enter(&sv->sv_event_list, RW_WRITER);
2120 	smb_llist_insert_tail(&sv->sv_event_list, event);
2121 	smb_llist_exit(&sv->sv_event_list);
2122 
2123 	return (event);
2124 }
2125 
2126 void
2127 smb_event_destroy(smb_event_t *event)
2128 {
2129 	smb_server_t	*sv;
2130 
2131 	if (event == NULL)
2132 		return;
2133 
2134 	SMB_EVENT_VALID(event);
2135 	ASSERT(event->se_waittime == 0);
2136 	sv = event->se_server;
2137 	SMB_SERVER_VALID(sv);
2138 
2139 	smb_llist_enter(&sv->sv_event_list, RW_WRITER);
2140 	smb_llist_remove(&sv->sv_event_list, event);
2141 	smb_llist_exit(&sv->sv_event_list);
2142 
2143 	event->se_magic = (uint32_t)~SMB_EVENT_MAGIC;
2144 	cv_destroy(&event->se_cv);
2145 	mutex_destroy(&event->se_mutex);
2146 
2147 	kmem_cache_free(smb_cache_event, event);
2148 }
2149 
2150 /*
2151  * Get the txid for the specified event.
2152  */
2153 uint32_t
2154 smb_event_txid(smb_event_t *event)
2155 {
2156 	if (event != NULL) {
2157 		SMB_EVENT_VALID(event);
2158 		return (event->se_txid);
2159 	}
2160 
2161 	cmn_err(CE_NOTE, "smb_event_txid failed");
2162 	return ((uint32_t)-1);
2163 }
2164 
2165 /*
2166  * Wait for event notification.
2167  */
2168 int
2169 smb_event_wait(smb_event_t *event)
2170 {
2171 	int	seconds = 1;
2172 	int	ticks;
2173 	int	err;
2174 
2175 	if (event == NULL)
2176 		return (EINVAL);
2177 
2178 	SMB_EVENT_VALID(event);
2179 
2180 	mutex_enter(&event->se_mutex);
2181 	event->se_waittime = 1;
2182 	event->se_errno = 0;
2183 
2184 	while (!(event->se_notified)) {
2185 		if (smb_event_debug && ((event->se_waittime % 30) == 0))
2186 			cmn_err(CE_NOTE, "smb_event_wait[%d] (%d sec)",
2187 			    event->se_txid, event->se_waittime);
2188 
2189 		if (event->se_errno != 0)
2190 			break;
2191 
2192 		if (event->se_waittime > event->se_timeout) {
2193 			event->se_errno = ETIME;
2194 			break;
2195 		}
2196 
2197 		ticks = SEC_TO_TICK(seconds);
2198 		(void) cv_reltimedwait(&event->se_cv,
2199 		    &event->se_mutex, (clock_t)ticks, TR_CLOCK_TICK);
2200 		++event->se_waittime;
2201 	}
2202 
2203 	err = event->se_errno;
2204 	event->se_waittime = 0;
2205 	event->se_notified = B_FALSE;
2206 	cv_signal(&event->se_cv);
2207 	mutex_exit(&event->se_mutex);
2208 	return (err);
2209 }
2210 
2211 /*
2212  * If txid is non-zero, cancel the specified event.
2213  * Otherwise, cancel all events.
2214  */
2215 static void
2216 smb_event_cancel(smb_server_t *sv, uint32_t txid)
2217 {
2218 	smb_event_t	*event;
2219 	smb_llist_t	*event_list;
2220 
2221 	SMB_SERVER_VALID(sv);
2222 
2223 	event_list = &sv->sv_event_list;
2224 	smb_llist_enter(event_list, RW_WRITER);
2225 
2226 	event = smb_llist_head(event_list);
2227 	while (event) {
2228 		SMB_EVENT_VALID(event);
2229 
2230 		if (txid == 0 || event->se_txid == txid) {
2231 			mutex_enter(&event->se_mutex);
2232 			event->se_errno = ECANCELED;
2233 			event->se_notified = B_TRUE;
2234 			cv_signal(&event->se_cv);
2235 			mutex_exit(&event->se_mutex);
2236 
2237 			if (txid != 0)
2238 				break;
2239 		}
2240 
2241 		event = smb_llist_next(event_list, event);
2242 	}
2243 
2244 	smb_llist_exit(event_list);
2245 }
2246 
2247 /*
2248  * If txid is non-zero, notify the specified event.
2249  * Otherwise, notify all events.
2250  */
2251 void
2252 smb_event_notify(smb_server_t *sv, uint32_t txid)
2253 {
2254 	smb_event_t	*event;
2255 	smb_llist_t	*event_list;
2256 
2257 	SMB_SERVER_VALID(sv);
2258 
2259 	event_list = &sv->sv_event_list;
2260 	smb_llist_enter(event_list, RW_READER);
2261 
2262 	event = smb_llist_head(event_list);
2263 	while (event) {
2264 		SMB_EVENT_VALID(event);
2265 
2266 		if (txid == 0 || event->se_txid == txid) {
2267 			mutex_enter(&event->se_mutex);
2268 			event->se_notified = B_TRUE;
2269 			cv_signal(&event->se_cv);
2270 			mutex_exit(&event->se_mutex);
2271 
2272 			if (txid != 0)
2273 				break;
2274 		}
2275 
2276 		event = smb_llist_next(event_list, event);
2277 	}
2278 
2279 	smb_llist_exit(event_list);
2280 }
2281 
2282 /*
2283  * Allocate a new transaction id (txid).
2284  *
2285  * 0 or -1 are not assigned because they are used to detect invalid
2286  * conditions or to indicate all open id's.
2287  */
2288 static uint32_t
2289 smb_event_alloc_txid(void)
2290 {
2291 	static kmutex_t	txmutex;
2292 	static uint32_t	txid;
2293 	uint32_t	txid_ret;
2294 
2295 	mutex_enter(&txmutex);
2296 
2297 	if (txid == 0)
2298 		txid = ddi_get_lbolt() << 11;
2299 
2300 	do {
2301 		++txid;
2302 	} while (txid == 0 || txid == (uint32_t)-1);
2303 
2304 	txid_ret = txid;
2305 	mutex_exit(&txmutex);
2306 
2307 	return (txid_ret);
2308 }
2309 
2310 /*
2311  * Called by the ioctl to find the corresponding
2312  * spooldoc node.  removes node on success
2313  *
2314  * Return values
2315  * rc
2316  * B_FALSE - not found
2317  * B_TRUE  - found
2318  *
2319  */
2320 
2321 static boolean_t
2322 smb_spool_lookup_doc_byfid(smb_server_t *sv, uint16_t fid,
2323     smb_kspooldoc_t *spdoc)
2324 {
2325 	smb_kspooldoc_t *sp;
2326 	smb_llist_t	*splist;
2327 
2328 	splist = &sv->sp_info.sp_list;
2329 	smb_llist_enter(splist, RW_WRITER);
2330 	sp = smb_llist_head(splist);
2331 	while (sp != NULL) {
2332 		/*
2333 		 * check for a matching fid
2334 		 */
2335 		if (sp->sd_fid == fid) {
2336 			*spdoc = *sp;
2337 			smb_llist_remove(splist, sp);
2338 			smb_llist_exit(splist);
2339 			kmem_free(sp, sizeof (smb_kspooldoc_t));
2340 			return (B_TRUE);
2341 		}
2342 		sp = smb_llist_next(splist, sp);
2343 	}
2344 	cmn_err(CE_WARN, "smb_spool_lookup_user_byfid: no fid:%d", fid);
2345 	smb_llist_exit(splist);
2346 	return (B_FALSE);
2347 }
2348 
2349 /*
2350  * Adds the spool fid to a linked list to be used
2351  * as a search key in the spooldoc queue
2352  *
2353  * Return values
2354  *      rc non-zero error
2355  *	rc zero success
2356  *
2357  */
2358 
2359 void
2360 smb_spool_add_fid(smb_server_t *sv, uint16_t fid)
2361 {
2362 	smb_llist_t	*fidlist;
2363 	smb_spoolfid_t  *sf;
2364 
2365 	if (sv->sv_cfg.skc_print_enable == 0)
2366 		return;
2367 
2368 	sf = kmem_zalloc(sizeof (smb_spoolfid_t), KM_SLEEP);
2369 	fidlist = &sv->sp_info.sp_fidlist;
2370 	smb_llist_enter(fidlist, RW_WRITER);
2371 	sf->sf_fid = fid;
2372 	smb_llist_insert_tail(fidlist, sf);
2373 	smb_llist_exit(fidlist);
2374 	cv_broadcast(&sv->sp_info.sp_cv);
2375 }
2376 
2377 /*
2378  * Called by the ioctl to get and remove the head of the fid list
2379  *
2380  * Return values
2381  * int fd
2382  * greater than 0 success
2383  * 0 - error
2384  *
2385  */
2386 
2387 static uint16_t
2388 smb_spool_get_fid(smb_server_t *sv)
2389 {
2390 	smb_spoolfid_t	*spfid;
2391 	smb_llist_t	*splist;
2392 	uint16_t	fid;
2393 
2394 	splist = &sv->sp_info.sp_fidlist;
2395 	smb_llist_enter(splist, RW_WRITER);
2396 	spfid = smb_llist_head(splist);
2397 	if (spfid != NULL) {
2398 		fid = spfid->sf_fid;
2399 		smb_llist_remove(&sv->sp_info.sp_fidlist, spfid);
2400 		kmem_free(spfid, sizeof (smb_spoolfid_t));
2401 	} else {
2402 		fid = 0;
2403 	}
2404 	smb_llist_exit(splist);
2405 	return (fid);
2406 }
2407 
2408 /*
2409  * Adds the spooldoc to the tail of the spooldoc list
2410  *
2411  * Return values
2412  *      rc non-zero error
2413  *	rc zero success
2414  */
2415 int
2416 smb_spool_add_doc(smb_tree_t *tree, smb_kspooldoc_t *sp)
2417 {
2418 	smb_llist_t	*splist;
2419 	smb_server_t	*sv = tree->t_server;
2420 	int rc = 0;
2421 
2422 	splist = &sv->sp_info.sp_list;
2423 	smb_llist_enter(splist, RW_WRITER);
2424 	sp->sd_spool_num = atomic_inc_32_nv(&sv->sp_info.sp_cnt);
2425 	smb_llist_insert_tail(splist, sp);
2426 	smb_llist_exit(splist);
2427 
2428 	return (rc);
2429 }
2430 
2431 /*
2432  * smb_server_create_session
2433  */
2434 static void
2435 smb_server_create_session(smb_listener_daemon_t *ld, ksocket_t s_so)
2436 {
2437 	smb_session_t		*session;
2438 	taskqid_t		tqid;
2439 	smb_llist_t		*sl;
2440 	smb_server_t		*sv = ld->ld_sv;
2441 
2442 	session = smb_session_create(s_so, ld->ld_port, sv,
2443 	    ld->ld_family);
2444 
2445 	if (session == NULL) {
2446 		smb_soshutdown(s_so);
2447 		smb_sodestroy(s_so);
2448 		cmn_err(CE_WARN, "SMB Session: alloc failed");
2449 		return;
2450 	}
2451 
2452 	sl = &sv->sv_session_list;
2453 	smb_llist_enter(sl, RW_WRITER);
2454 	smb_llist_insert_tail(sl, session);
2455 	smb_llist_exit(sl);
2456 
2457 	/*
2458 	 * These taskq entries must run independently of one another,
2459 	 * so TQ_NOQUEUE.  TQ_SLEEP (==0) just for clarity.
2460 	 */
2461 	tqid = taskq_dispatch(sv->sv_receiver_pool,
2462 	    smb_server_receiver, session, TQ_NOQUEUE | TQ_SLEEP);
2463 	if (tqid == TASKQID_INVALID) {
2464 		smb_session_disconnect(session);
2465 		smb_server_destroy_session(session);
2466 		cmn_err(CE_WARN, "SMB Session: taskq_dispatch failed");
2467 		return;
2468 	}
2469 	/* handy for debugging */
2470 	session->s_receiver_tqid = tqid;
2471 }
2472 
2473 static void
2474 smb_server_destroy_session(smb_session_t *session)
2475 {
2476 	smb_server_t *sv;
2477 	smb_llist_t *ll;
2478 	uint32_t count;
2479 
2480 	ASSERT(session->s_server != NULL);
2481 	sv = session->s_server;
2482 	ll = &sv->sv_session_list;
2483 
2484 	smb_llist_flush(&session->s_tree_list);
2485 	smb_llist_flush(&session->s_user_list);
2486 
2487 	/*
2488 	 * The user and tree lists should be empty now.
2489 	 */
2490 #ifdef DEBUG
2491 	if (session->s_user_list.ll_count != 0) {
2492 		cmn_err(CE_WARN, "user list not empty?");
2493 		debug_enter("s_user_list");
2494 	}
2495 	if (session->s_tree_list.ll_count != 0) {
2496 		cmn_err(CE_WARN, "tree list not empty?");
2497 		debug_enter("s_tree_list");
2498 	}
2499 #endif
2500 
2501 	smb_llist_enter(ll, RW_WRITER);
2502 	smb_llist_remove(ll, session);
2503 	count = ll->ll_count;
2504 	smb_llist_exit(ll);
2505 
2506 	smb_session_delete(session);
2507 	if (count == 0) {
2508 		/* See smb_server_shutdown */
2509 		cv_signal(&sv->sv_cv);
2510 	}
2511 }
2512