1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright (c) 2008, 2010, Oracle and/or its affiliates. All rights reserved.
23  * Copyright (c) 2017 by Delphix. All rights reserved.
24  * Copyright 2019 Nexenta by DDN, Inc. All rights reserved.
25  * Copyright 2021-2023 RackTop Systems, Inc.
26  */
27 
28 /*
29  * General Structures Layout
30  * -------------------------
31  *
32  * This is a simplified diagram showing the relationship between most of the
33  * main structures.
34  *
35  * +-------------------+
36  * |     SMB_SERVER    |
37  * +-------------------+
38  *          |
39  *          |
40  *          v
41  * +-------------------+       +-------------------+      +-------------------+
42  * |     SESSION       |<----->|     SESSION       |......|      SESSION      |
43  * +-------------------+       +-------------------+      +-------------------+
44  *          |
45  *          |
46  *          v
47  * +-------------------+       +-------------------+      +-------------------+
48  * |       USER        |<----->|       USER        |......|       USER        |
49  * +-------------------+       +-------------------+      +-------------------+
50  *          |
51  *          |
52  *          v
53  * +-------------------+       +-------------------+      +-------------------+
54  * |       TREE        |<----->|       TREE        |......|       TREE        |
55  * +-------------------+       +-------------------+      +-------------------+
56  *      |         |
57  *      |         |
58  *      |         v
59  *      |     +-------+       +-------+      +-------+
60  *      |     | OFILE |<----->| OFILE |......| OFILE |
61  *      |     +-------+       +-------+      +-------+
62  *      |
63  *      |
64  *      v
65  *  +-------+       +------+      +------+
66  *  | ODIR  |<----->| ODIR |......| ODIR |
67  *  +-------+       +------+      +------+
68  *
69  *
70  * Module Interface Overview
71  * -------------------------
72  *
73  *
74  *	    +===================================+
75  *	    |		 smbd daemon		|
76  *	    +===================================+
77  *	      |		     |		      ^
78  *	      |		     |		      |
79  * User	      |		     |		      |
80  * -----------|--------------|----------------|--------------------------------
81  * Kernel     |		     |		      |
82  *            |		     |		      |
83  *	      |		     |		      |
84  *  +=========|==============|================|=================+
85  *  |	      v		     v		      |			|
86  *  | +-----------+ +--------------------+ +------------------+ |
87  *  | |     IO    | | Kernel Door Server | | User Door Servers|	|
88  *  | | Interface | |     Interface      | |   Interface      | |
89  *  | +-----------+ +--------------------+ +------------------+ |
90  *  |		|	     |		      ^		^	|
91  *  |		v	     v		      |		|	|    +=========+
92  *  |	     +-----------------------------------+	|	|    |	       |
93  *  |	     + SMB Server Management (this file) |<------------------|	 ZFS   |
94  *  |	     +-----------------------------------+	|	|    |	       |
95  *  |							|	|    |  Module |
96  *  |	     +-----------------------------------+	|	|    |	       |
97  *  |	     +     SMB Server Internal Layers    |------+	|    +=========+
98  *  |	     +-----------------------------------+		|
99  *  |								|
100  *  |								|
101  *  +===========================================================+
102  *
103  *
104  * Server State Machine
105  * --------------------
106  *                                  |
107  *                                  | T0
108  *                                  |
109  *                                  v
110  *                    +-----------------------------+
111  *		      |   SMB_SERVER_STATE_CREATED  |
112  *		      +-----------------------------+
113  *				    |
114  *				    | T1
115  *				    |
116  *				    v
117  *		      +-----------------------------+
118  *		      | SMB_SERVER_STATE_CONFIGURED |
119  *		      +-----------------------------+
120  *				    |
121  *				    | T2
122  *				    |
123  *				    v
124  *		      +-----------------------------+
125  *		      |  SMB_SERVER_STATE_RUNNING / |
126  *		      |  SMB_SERVER_STATE_STOPPING  |
127  *		      +-----------------------------+
128  *				    |
129  *				    | T3
130  *				    |
131  *				    v
132  *		      +-----------------------------+
133  *		      |  SMB_SERVER_STATE_DELETING  |
134  *                    +-----------------------------+
135  *				    |
136  *				    |
137  *				    |
138  *				    v
139  *
140  * States
141  * ------
142  *
143  * SMB_SERVER_STATE_CREATED
144  *
145  *    This is the state of the server just after creation.
146  *
147  * SMB_SERVER_STATE_CONFIGURED
148  *
149  *    The server has been configured.
150  *
151  * SMB_SERVER_STATE_RUNNING
152  *
153  *    The server has been started. While in this state the threads listening on
154  *    the sockets are started.
155  *
156  *    When a client establishes a connection the thread listening dispatches
157  *    a task with the new session as an argument. If the dispatch fails the new
158  *    session context is destroyed.
159  *
160  * SMB_SERVER_STATE_STOPPING
161  *
162  *    The threads listening on the NBT and TCP sockets are being terminated.
163  *
164  *
165  * Transitions
166  * -----------
167  *
168  * Transition T0
169  *
170  *    The daemon smbd triggers its creation by opening the smbsrv device. If
171  *    the zone where the daemon lives doesn't have an smb server yet it is
172  *    created.
173  *
174  *		smb_drv_open() --> smb_server_create()
175  *
176  * Transition T1
177  *
178  *    This transition occurs in smb_server_configure(). It is triggered by the
179  *    daemon through an Ioctl.
180  *
181  *	smb_drv_ioctl(SMB_IOC_CONFIG) --> smb_server_configure()
182  *
183  * Transition T2
184  *
185  *    This transition occurs in smb_server_start(). It is triggered by the
186  *    daemon through an Ioctl.
187  *
188  *	smb_drv_ioctl(SMB_IOC_START) --> smb_server_start()
189  *
190  * Transition T3
191  *
192  *    This transition occurs in smb_server_delete(). It is triggered by the
193  *    daemon when closing the smbsrv device
194  *
195  *		smb_drv_close() --> smb_server_delete()
196  *
197  * Comments
198  * --------
199  *
200  * This files assumes that there will one SMB server per zone. For now the
201  * smb server works only in global zone. There's nothing in this file preventing
202  * an smb server from being created in a non global zone. That limitation is
203  * enforced in user space.
204  */
205 
206 #include <sys/cmn_err.h>
207 #include <sys/priv.h>
208 #include <sys/zone.h>
209 #include <sys/sysmacros.h>
210 #include <sys/callb.h>
211 #include <sys/class.h>
212 #include <sys/disp.h>
213 #include <netinet/in.h>
214 #include <netinet/in_systm.h>
215 #include <netinet/ip.h>
216 #include <netinet/ip_icmp.h>
217 #include <netinet/ip_var.h>
218 #include <netinet/tcp.h>
219 #include <smbsrv/smb2_kproto.h>
220 #include <smbsrv/string.h>
221 #include <smbsrv/netbios.h>
222 #include <smbsrv/smb_fsops.h>
223 #include <smbsrv/smb_share.h>
224 #include <smbsrv/smb_door.h>
225 #include <smbsrv/smb_kstat.h>
226 
227 static void smb_server_kstat_init(smb_server_t *);
228 static void smb_server_kstat_fini(smb_server_t *);
229 static void smb_server_timers(smb_thread_t *, void *);
230 static void smb_server_store_cfg(smb_server_t *, smb_ioc_cfg_t *);
231 static void smb_server_shutdown(smb_server_t *);
232 static int smb_server_fsop_start(smb_server_t *);
233 static void smb_server_fsop_stop(smb_server_t *);
234 static void smb_event_cancel(smb_server_t *, uint32_t);
235 static uint32_t smb_event_alloc_txid(void);
236 
237 static void smb_server_disconnect_share(smb_server_t *, const char *);
238 static void smb_server_enum_users(smb_server_t *, smb_svcenum_t *);
239 static void smb_server_enum_trees(smb_server_t *, smb_svcenum_t *);
240 static int smb_server_session_disconnect(smb_server_t *, const char *,
241     const char *);
242 static int smb_server_fclose(smb_server_t *, uint32_t);
243 static int smb_server_kstat_update(kstat_t *, int);
244 static int smb_server_legacy_kstat_update(kstat_t *, int);
245 static void smb_server_listener_init(smb_server_t *, smb_listener_daemon_t *,
246     char *, in_port_t, int);
247 static void smb_server_listener_destroy(smb_listener_daemon_t *);
248 static int smb_server_listener_start(smb_listener_daemon_t *);
249 static void smb_server_listener_stop(smb_listener_daemon_t *);
250 static void smb_server_listener(smb_thread_t *, void *);
251 static void smb_server_receiver(void *);
252 static void smb_server_create_session(smb_listener_daemon_t *, ksocket_t);
253 static void smb_server_destroy_session(smb_session_t *);
254 static uint16_t smb_spool_get_fid(smb_server_t *);
255 static boolean_t smb_spool_lookup_doc_byfid(smb_server_t *, uint16_t,
256     smb_kspooldoc_t *);
257 
258 #ifdef	_KERNEL
259 int smb_create_process = 1;
260 static void smb_server_delproc(smb_server_t *);
261 static int smb_server_newproc(smb_server_t *);
262 static void smb_server_proc_main(void *);
263 #endif
264 
265 /*
266  * How many "buckets" should our hash tables use?  On a "real" server,
267  * make them much larger than the number of CPUs we're likely to have.
268  * On "fksmbd" make it smaller so dtrace logs are shorter.
269  * These must be powers of two.
270  */
271 #ifdef	_KERNEL
272 #define	DEFAULT_HASH_NBUCKETS	256	/* real server */
273 #else
274 #define	DEFAULT_HASH_NBUCKETS	16	/* for "fksmbd" */
275 #endif
276 uint32_t SMB_OFILE_HASH_NBUCKETS = DEFAULT_HASH_NBUCKETS;
277 uint32_t SMB_LEASE_HASH_NBUCKETS = DEFAULT_HASH_NBUCKETS;
278 
279 int smb_event_debug = 0;
280 
281 static smb_llist_t	smb_servers;
282 
283 /* for smb_server_destroy_session() */
284 static smb_llist_t smb_server_session_zombies;
285 
286 kmem_cache_t		*smb_cache_request;
287 kmem_cache_t		*smb_cache_session;
288 kmem_cache_t		*smb_cache_user;
289 kmem_cache_t		*smb_cache_tree;
290 kmem_cache_t		*smb_cache_ofile;
291 kmem_cache_t		*smb_cache_odir;
292 kmem_cache_t		*smb_cache_opipe;
293 kmem_cache_t		*smb_cache_event;
294 kmem_cache_t		*smb_cache_lock;
295 
296 /*
297  * *****************************************************************************
298  * **************** Functions called from the device interface *****************
299  * *****************************************************************************
300  *
301  * These functions typically have to determine the relevant smb server
302  * to which the call applies.
303  */
304 
305 /*
306  * How many zones have an SMB server active?
307  */
308 int
309 smb_server_get_count(void)
310 {
311 	return (smb_llist_get_count(&smb_servers));
312 }
313 
314 /*
315  * smb_server_g_init
316  *
317  * This function must be called from smb_drv_attach().
318  */
319 int
320 smb_server_g_init(void)
321 {
322 	int rc;
323 
324 	if ((rc = smb_vop_init()) != 0)
325 		goto errout;
326 	if ((rc = smb_fem_init()) != 0)
327 		goto errout;
328 
329 	smb_kshare_g_init();
330 	smb_codepage_init();
331 	smb_mbc_init();		/* smb_mbc_cache */
332 	smb_node_init();	/* smb_node_cache, lists */
333 	smb2_lease_init();
334 
335 	smb_cache_request = kmem_cache_create("smb_request_cache",
336 	    sizeof (smb_request_t), 8, NULL, NULL, NULL, NULL, NULL, 0);
337 	smb_cache_session = kmem_cache_create("smb_session_cache",
338 	    sizeof (smb_session_t), 8, NULL, NULL, NULL, NULL, NULL, 0);
339 	smb_cache_user = kmem_cache_create("smb_user_cache",
340 	    sizeof (smb_user_t), 8, NULL, NULL, NULL, NULL, NULL, 0);
341 	smb_cache_tree = kmem_cache_create("smb_tree_cache",
342 	    sizeof (smb_tree_t), 8, NULL, NULL, NULL, NULL, NULL, 0);
343 	smb_cache_ofile = kmem_cache_create("smb_ofile_cache",
344 	    sizeof (smb_ofile_t), 8, NULL, NULL, NULL, NULL, NULL, 0);
345 	smb_cache_odir = kmem_cache_create("smb_odir_cache",
346 	    sizeof (smb_odir_t), 8, NULL, NULL, NULL, NULL, NULL, 0);
347 	smb_cache_opipe = kmem_cache_create("smb_opipe_cache",
348 	    sizeof (smb_opipe_t), 8, NULL, NULL, NULL, NULL, NULL, 0);
349 	smb_cache_event = kmem_cache_create("smb_event_cache",
350 	    sizeof (smb_event_t), 8, NULL, NULL, NULL, NULL, NULL, 0);
351 	smb_cache_lock = kmem_cache_create("smb_lock_cache",
352 	    sizeof (smb_lock_t), 8, NULL, NULL, NULL, NULL, NULL, 0);
353 
354 	smb_llist_init();
355 	smb_llist_constructor(&smb_servers, sizeof (smb_server_t),
356 	    offsetof(smb_server_t, sv_lnd));
357 
358 	smb_llist_constructor(&smb_server_session_zombies,
359 	    sizeof (smb_session_t), offsetof(smb_session_t, s_lnd));
360 
361 	return (0);
362 
363 errout:
364 	smb_fem_fini();
365 	smb_vop_fini();
366 	return (rc);
367 }
368 
369 /*
370  * smb_server_g_fini
371  *
372  * This function must called from smb_drv_detach(). It will fail if servers
373  * still exist.
374  */
375 void
376 smb_server_g_fini(void)
377 {
378 
379 	ASSERT(smb_llist_get_count(&smb_servers) == 0);
380 
381 	smb_llist_fini();
382 
383 	kmem_cache_destroy(smb_cache_request);
384 	kmem_cache_destroy(smb_cache_session);
385 	kmem_cache_destroy(smb_cache_user);
386 	kmem_cache_destroy(smb_cache_tree);
387 	kmem_cache_destroy(smb_cache_ofile);
388 	kmem_cache_destroy(smb_cache_odir);
389 	kmem_cache_destroy(smb_cache_opipe);
390 	kmem_cache_destroy(smb_cache_event);
391 	kmem_cache_destroy(smb_cache_lock);
392 
393 	smb2_lease_fini();
394 	smb_node_fini();
395 	smb_mbc_fini();
396 	smb_codepage_fini();
397 	smb_kshare_g_fini();
398 
399 	smb_fem_fini();
400 	smb_vop_fini();
401 
402 	smb_llist_destructor(&smb_servers);
403 }
404 
405 /*
406  * smb_server_create
407  *
408  * Called by driver open
409  *
410  * This function will fail if there's already a server associated with the
411  * caller's zone.
412  *
413  * This object is one-to-one with zones, so we could instead
414  * create/destroy this via zone_key_create callbacks.
415  * See smb_server_delete() for destruction.
416  */
417 int
418 smb_server_create(void)
419 {
420 	zoneid_t	zid;
421 	smb_server_t	*sv;
422 
423 	zid = getzoneid();
424 
425 	smb_llist_enter(&smb_servers, RW_WRITER);
426 	sv = smb_llist_head(&smb_servers);
427 	while (sv) {
428 		SMB_SERVER_VALID(sv);
429 		if (sv->sv_zid == zid) {
430 			smb_llist_exit(&smb_servers);
431 			return (EPERM);
432 		}
433 		sv = smb_llist_next(&smb_servers, sv);
434 	}
435 
436 	sv = kmem_zalloc(sizeof (smb_server_t), KM_SLEEP);
437 
438 	sv->sv_magic = SMB_SERVER_MAGIC;
439 	sv->sv_state = SMB_SERVER_STATE_CREATED;
440 	sv->sv_zid = zid;
441 	sv->sv_pid = ddi_get_pid();
442 	sv->sv_proc_state = SMB_THREAD_STATE_EXITED;
443 
444 	mutex_init(&sv->sv_mutex, NULL, MUTEX_DEFAULT, NULL);
445 	cv_init(&sv->sv_cv, NULL, CV_DEFAULT, NULL);
446 	cv_init(&sv->sp_info.sp_cv, NULL, CV_DEFAULT, NULL);
447 
448 	sv->sv_persistid_ht = smb_hash_create(sizeof (smb_ofile_t),
449 	    offsetof(smb_ofile_t, f_dh_lnd), SMB_OFILE_HASH_NBUCKETS);
450 
451 	sv->sv_lease_ht = smb_hash_create(sizeof (smb_lease_t),
452 	    offsetof(smb_lease_t, ls_lnd), SMB_LEASE_HASH_NBUCKETS);
453 
454 	smb_llist_constructor(&sv->sv_session_list, sizeof (smb_session_t),
455 	    offsetof(smb_session_t, s_lnd));
456 
457 	smb_llist_constructor(&sv->sv_event_list, sizeof (smb_event_t),
458 	    offsetof(smb_event_t, se_lnd));
459 
460 	smb_llist_constructor(&sv->sp_info.sp_list, sizeof (smb_kspooldoc_t),
461 	    offsetof(smb_kspooldoc_t, sd_lnd));
462 
463 	smb_llist_constructor(&sv->sp_info.sp_fidlist,
464 	    sizeof (smb_spoolfid_t), offsetof(smb_spoolfid_t, sf_lnd));
465 
466 	sv->sv_disp_stats1 = kmem_zalloc(SMB_COM_NUM *
467 	    sizeof (smb_disp_stats_t), KM_SLEEP);
468 
469 	sv->sv_disp_stats2 = kmem_zalloc(SMB2__NCMDS *
470 	    sizeof (smb_disp_stats_t), KM_SLEEP);
471 
472 	smb_thread_init(&sv->si_thread_timers, "smb_timers",
473 	    smb_server_timers, sv, smbsrv_timer_pri, sv);
474 
475 	smb_srqueue_init(&sv->sv_srqueue);
476 
477 	smb_kdoor_init(sv);
478 	smb_kshare_init(sv);
479 	smb_server_kstat_init(sv);
480 
481 	smb_threshold_init(&sv->sv_ssetup_ct, SMB_SSETUP_CMD,
482 	    smb_ssetup_threshold, smb_ssetup_timeout);
483 	smb_threshold_init(&sv->sv_tcon_ct, SMB_TCON_CMD,
484 	    smb_tcon_threshold, smb_tcon_timeout);
485 	smb_threshold_init(&sv->sv_opipe_ct, SMB_OPIPE_CMD,
486 	    smb_opipe_threshold, smb_opipe_timeout);
487 
488 	smb_llist_insert_tail(&smb_servers, sv);
489 	smb_llist_exit(&smb_servers);
490 
491 	return (0);
492 }
493 
494 /*
495  * smb_server_delete
496  *
497  * Called by driver close
498  *
499  * This function will delete the server passed in. It will make sure that all
500  * activity associated that server has ceased before destroying it.
501  */
502 int
503 smb_server_delete(smb_server_t	*sv)
504 {
505 
506 	mutex_enter(&sv->sv_mutex);
507 	switch (sv->sv_state) {
508 	case SMB_SERVER_STATE_RUNNING:
509 		sv->sv_state = SMB_SERVER_STATE_STOPPING;
510 		mutex_exit(&sv->sv_mutex);
511 		smb_server_shutdown(sv);
512 		mutex_enter(&sv->sv_mutex);
513 		cv_broadcast(&sv->sp_info.sp_cv);
514 		sv->sv_state = SMB_SERVER_STATE_DELETING;
515 		break;
516 	case SMB_SERVER_STATE_STOPPING:
517 		sv->sv_state = SMB_SERVER_STATE_DELETING;
518 		break;
519 	case SMB_SERVER_STATE_CONFIGURED:
520 	case SMB_SERVER_STATE_CREATED:
521 		sv->sv_state = SMB_SERVER_STATE_DELETING;
522 		break;
523 	default:
524 		SMB_SERVER_STATE_VALID(sv->sv_state);
525 		mutex_exit(&sv->sv_mutex);
526 		smb_server_release(sv);
527 		return (ENOTTY);
528 	}
529 
530 	ASSERT(sv->sv_state == SMB_SERVER_STATE_DELETING);
531 
532 	sv->sv_refcnt--;
533 	while (sv->sv_refcnt)
534 		cv_wait(&sv->sv_cv, &sv->sv_mutex);
535 
536 	mutex_exit(&sv->sv_mutex);
537 
538 	smb_llist_enter(&smb_servers, RW_WRITER);
539 	smb_llist_remove(&smb_servers, sv);
540 	smb_llist_exit(&smb_servers);
541 
542 	smb_threshold_fini(&sv->sv_ssetup_ct);
543 	smb_threshold_fini(&sv->sv_tcon_ct);
544 	smb_threshold_fini(&sv->sv_opipe_ct);
545 
546 	smb_server_listener_destroy(&sv->sv_nbt_daemon);
547 	smb_server_listener_destroy(&sv->sv_tcp_daemon);
548 	rw_destroy(&sv->sv_cfg_lock);
549 	smb_server_kstat_fini(sv);
550 	smb_kshare_fini(sv);
551 	smb_kdoor_fini(sv);
552 	smb_llist_destructor(&sv->sv_event_list);
553 	smb_llist_destructor(&sv->sv_session_list);
554 
555 	kmem_free(sv->sv_disp_stats1,
556 	    SMB_COM_NUM * sizeof (smb_disp_stats_t));
557 
558 	kmem_free(sv->sv_disp_stats2,
559 	    SMB2__NCMDS * sizeof (smb_disp_stats_t));
560 
561 	smb_srqueue_destroy(&sv->sv_srqueue);
562 	smb_thread_destroy(&sv->si_thread_timers);
563 
564 	mutex_destroy(&sv->sv_mutex);
565 	smb_hash_destroy(sv->sv_lease_ht);
566 	smb_hash_destroy(sv->sv_persistid_ht);
567 	cv_destroy(&sv->sv_cv);
568 	sv->sv_magic = 0;
569 	kmem_free(sv, sizeof (smb_server_t));
570 
571 	return (0);
572 }
573 
574 /*
575  * smb_server_configure
576  *
577  * Called via SMB_IOC_CONFIG, for smbd startup or refresh.
578  */
579 int
580 smb_server_configure(smb_ioc_cfg_t *ioc)
581 {
582 	int		rc = 0;
583 	smb_server_t	*sv;
584 
585 	/*
586 	 * Reality check negotiation token length vs. #define'd maximum.
587 	 */
588 	if (ioc->negtok_len > SMB_PI_MAX_NEGTOK)
589 		return (EINVAL);
590 
591 	rc = smb_server_lookup(&sv);
592 	if (rc)
593 		return (rc);
594 
595 	mutex_enter(&sv->sv_mutex);
596 	switch (sv->sv_state) {
597 	case SMB_SERVER_STATE_CREATED:
598 		smb_server_store_cfg(sv, ioc);
599 		sv->sv_state = SMB_SERVER_STATE_CONFIGURED;
600 		break;
601 
602 	case SMB_SERVER_STATE_CONFIGURED:
603 		smb_server_store_cfg(sv, ioc);
604 		break;
605 
606 	case SMB_SERVER_STATE_RUNNING:
607 	case SMB_SERVER_STATE_STOPPING:
608 		rw_enter(&sv->sv_cfg_lock, RW_WRITER);
609 		smb_server_store_cfg(sv, ioc);
610 		rw_exit(&sv->sv_cfg_lock);
611 		break;
612 
613 	default:
614 		SMB_SERVER_STATE_VALID(sv->sv_state);
615 		rc = EFAULT;
616 		break;
617 	}
618 	mutex_exit(&sv->sv_mutex);
619 
620 	smb_server_release(sv);
621 
622 	return (rc);
623 }
624 
625 /*
626  * smb_server_start
627  *
628  * Called via SMB_IOC_START during smbd startup.
629  * Bring up the activities requried for SMB service.
630  */
631 int
632 smb_server_start(smb_ioc_start_t *ioc)
633 {
634 	int		rc = 0;
635 	int		family;
636 	smb_server_t	*sv;
637 	cred_t		*ucr;
638 	struct proc	*tqproc;
639 
640 	rc = smb_server_lookup(&sv);
641 	if (rc)
642 		return (rc);
643 
644 	mutex_enter(&sv->sv_mutex);
645 	switch (sv->sv_state) {
646 	case SMB_SERVER_STATE_CONFIGURED:
647 
648 #ifdef	_KERNEL
649 		if (smb_create_process) {
650 			rc = smb_server_newproc(sv);
651 			if (rc != 0)
652 				break;
653 		}
654 #endif	/* _KERNEL */
655 
656 		if ((rc = smb_server_fsop_start(sv)) != 0)
657 			break;
658 
659 		/*
660 		 * Note: smb_kshare_start needs sv_session.
661 		 */
662 		sv->sv_session = smb_session_create(NULL, 0, sv, 0);
663 		if (sv->sv_session == NULL) {
664 			rc = ENOMEM;
665 			break;
666 		}
667 
668 		/*
669 		 * Create a logon on the server session,
670 		 * used when importing CA shares.
671 		 */
672 		sv->sv_rootuser = smb_user_new(sv->sv_session);
673 		ucr = smb_kcred_create();
674 		rc = smb_user_logon(sv->sv_rootuser, ucr, "", "root",
675 		    SMB_USER_FLAG_ADMIN, 0, 0);
676 		crfree(ucr);
677 		ucr = NULL;
678 		if (rc != 0) {
679 			cmn_err(CE_NOTE, "smb_server_start: "
680 			    "failed to create root user");
681 			break;
682 		}
683 
684 		if ((rc = smb_kshare_start(sv)) != 0)
685 			break;
686 
687 		/*
688 		 * NB: the proc passed here has to be a "system" one.
689 		 * Normally that's p0, or the NGZ eqivalent.
690 		 */
691 		tqproc = (sv->sv_proc_p != NULL) ?
692 		    sv->sv_proc_p : curzone->zone_zsched;
693 
694 		sv->sv_worker_pool = taskq_create_proc("smb_workers",
695 		    sv->sv_cfg.skc_maxworkers, smbsrv_worker_pri,
696 		    sv->sv_cfg.skc_maxworkers, INT_MAX,
697 		    tqproc, TASKQ_DYNAMIC);
698 
699 		sv->sv_receiver_pool = taskq_create_proc("smb_receivers",
700 		    sv->sv_cfg.skc_maxconnections, smbsrv_receive_pri,
701 		    sv->sv_cfg.skc_maxconnections, INT_MAX,
702 		    tqproc, TASKQ_DYNAMIC);
703 
704 		if (sv->sv_worker_pool == NULL ||
705 		    sv->sv_receiver_pool == NULL) {
706 			rc = ENOMEM;
707 			break;
708 		}
709 
710 #ifdef	_KERNEL
711 		ASSERT(sv->sv_lmshrd == NULL);
712 		sv->sv_lmshrd = smb_kshare_door_init(ioc->lmshrd);
713 		if (sv->sv_lmshrd == NULL)
714 			break;
715 		if ((rc = smb_kdoor_open(sv, ioc->udoor)) != 0) {
716 			cmn_err(CE_WARN, "Cannot open smbd door");
717 			break;
718 		}
719 #else	/* _KERNEL */
720 		/* Fake kernel does not use the kshare_door */
721 		fksmb_kdoor_open(sv, ioc->udoor_func);
722 #endif	/* _KERNEL */
723 
724 		if ((rc = smb_thread_start(&sv->si_thread_timers)) != 0)
725 			break;
726 
727 		family = AF_INET;
728 		smb_server_listener_init(sv, &sv->sv_nbt_daemon,
729 		    "smb_nbt_listener", IPPORT_NETBIOS_SSN, family);
730 		if (sv->sv_cfg.skc_ipv6_enable)
731 			family = AF_INET6;
732 		smb_server_listener_init(sv, &sv->sv_tcp_daemon,
733 		    "smb_tcp_listener", IPPORT_SMB, family);
734 		rc = smb_server_listener_start(&sv->sv_tcp_daemon);
735 		if (rc != 0)
736 			break;
737 		if (sv->sv_cfg.skc_netbios_enable)
738 			(void) smb_server_listener_start(&sv->sv_nbt_daemon);
739 
740 		sv->sv_state = SMB_SERVER_STATE_RUNNING;
741 		sv->sv_start_time = gethrtime();
742 		mutex_exit(&sv->sv_mutex);
743 		smb_server_release(sv);
744 		smb_export_start(sv);
745 		return (0);
746 	default:
747 		SMB_SERVER_STATE_VALID(sv->sv_state);
748 		mutex_exit(&sv->sv_mutex);
749 		smb_server_release(sv);
750 		return (ENOTTY);
751 	}
752 
753 	mutex_exit(&sv->sv_mutex);
754 	smb_server_shutdown(sv);
755 	smb_server_release(sv);
756 	return (rc);
757 }
758 
759 /*
760  * An smbd is shutting down.
761  */
762 int
763 smb_server_stop(void)
764 {
765 	smb_server_t	*sv;
766 	int		rc;
767 
768 	if ((rc = smb_server_lookup(&sv)) != 0)
769 		return (rc);
770 
771 	mutex_enter(&sv->sv_mutex);
772 	switch (sv->sv_state) {
773 	case SMB_SERVER_STATE_RUNNING:
774 		sv->sv_state = SMB_SERVER_STATE_STOPPING;
775 		mutex_exit(&sv->sv_mutex);
776 		smb_server_shutdown(sv);
777 		mutex_enter(&sv->sv_mutex);
778 		cv_broadcast(&sv->sp_info.sp_cv);
779 		break;
780 	default:
781 		SMB_SERVER_STATE_VALID(sv->sv_state);
782 		break;
783 	}
784 	mutex_exit(&sv->sv_mutex);
785 
786 	smb_server_release(sv);
787 	return (0);
788 }
789 
790 boolean_t
791 smb_server_is_stopping(smb_server_t *sv)
792 {
793 	boolean_t	status;
794 
795 	SMB_SERVER_VALID(sv);
796 
797 	mutex_enter(&sv->sv_mutex);
798 
799 	switch (sv->sv_state) {
800 	case SMB_SERVER_STATE_STOPPING:
801 	case SMB_SERVER_STATE_DELETING:
802 		status = B_TRUE;
803 		break;
804 	default:
805 		status = B_FALSE;
806 		break;
807 	}
808 
809 	mutex_exit(&sv->sv_mutex);
810 	return (status);
811 }
812 
813 void
814 smb_server_cancel_event(smb_server_t *sv, uint32_t txid)
815 {
816 	smb_event_cancel(sv, txid);
817 }
818 
819 int
820 smb_server_notify_event(smb_ioc_event_t *ioc)
821 {
822 	smb_server_t	*sv;
823 	int		rc;
824 
825 	if ((rc = smb_server_lookup(&sv)) == 0) {
826 		smb_event_notify(sv, ioc->txid);
827 		smb_server_release(sv);
828 	}
829 
830 	return (rc);
831 }
832 
833 /*
834  * smb_server_spooldoc
835  *
836  * Waits for print file close broadcast.
837  * Gets the head of the fid list,
838  * then searches the spooldoc list and returns
839  * this info via the ioctl to user land.
840  *
841  * rc - 0 success
842  */
843 
844 int
845 smb_server_spooldoc(smb_ioc_spooldoc_t *ioc)
846 {
847 	smb_server_t	*sv;
848 	int		rc;
849 	smb_kspooldoc_t *spdoc;
850 	uint16_t	fid;
851 
852 	if ((rc = smb_server_lookup(&sv)) != 0)
853 		return (rc);
854 
855 	if (sv->sv_cfg.skc_print_enable == 0) {
856 		rc = ENOTTY;
857 		goto out;
858 	}
859 
860 	mutex_enter(&sv->sv_mutex);
861 	for (;;) {
862 		if (sv->sv_state != SMB_SERVER_STATE_RUNNING) {
863 			rc = ECANCELED;
864 			break;
865 		}
866 		if ((fid = smb_spool_get_fid(sv)) != 0) {
867 			rc = 0;
868 			break;
869 		}
870 		if (cv_wait_sig(&sv->sp_info.sp_cv, &sv->sv_mutex) == 0) {
871 			rc = EINTR;
872 			break;
873 		}
874 	}
875 	mutex_exit(&sv->sv_mutex);
876 	if (rc != 0)
877 		goto out;
878 
879 	spdoc = kmem_zalloc(sizeof (*spdoc), KM_SLEEP);
880 	if (smb_spool_lookup_doc_byfid(sv, fid, spdoc)) {
881 		ioc->spool_num = spdoc->sd_spool_num;
882 		ioc->ipaddr = spdoc->sd_ipaddr;
883 		(void) strlcpy(ioc->path, spdoc->sd_path,
884 		    MAXPATHLEN);
885 		(void) strlcpy(ioc->username,
886 		    spdoc->sd_username, MAXNAMELEN);
887 	} else {
888 		/* Did not find that print job. */
889 		rc = EAGAIN;
890 	}
891 	kmem_free(spdoc, sizeof (*spdoc));
892 
893 out:
894 	smb_server_release(sv);
895 	return (rc);
896 }
897 
898 int
899 smb_server_set_gmtoff(smb_ioc_gmt_t *ioc)
900 {
901 	int		rc;
902 	smb_server_t	*sv;
903 
904 	if ((rc = smb_server_lookup(&sv)) == 0) {
905 		sv->si_gmtoff = ioc->offset;
906 		smb_server_release(sv);
907 	}
908 
909 	return (rc);
910 }
911 
912 int
913 smb_server_numopen(smb_ioc_opennum_t *ioc)
914 {
915 	smb_server_t	*sv;
916 	int		rc;
917 
918 	if ((rc = smb_server_lookup(&sv)) == 0) {
919 		ioc->open_users = sv->sv_users;
920 		ioc->open_trees = sv->sv_trees;
921 		ioc->open_files = sv->sv_files + sv->sv_pipes;
922 		smb_server_release(sv);
923 	}
924 	return (rc);
925 }
926 
927 /*
928  * Enumerate objects within the server.  The svcenum provides the
929  * enumeration context, i.e. what the caller want to get back.
930  */
931 int
932 smb_server_enum(smb_ioc_svcenum_t *ioc)
933 {
934 	smb_svcenum_t	*svcenum = &ioc->svcenum;
935 	smb_server_t	*sv;
936 	int		rc;
937 
938 	/*
939 	 * Reality check that the buffer-length insize the enum doesn't
940 	 * overrun the ioctl's total length.
941 	 */
942 	if (svcenum->se_buflen + sizeof (*ioc) > ioc->hdr.len)
943 		return (EINVAL);
944 
945 	if ((rc = smb_server_lookup(&sv)) != 0)
946 		return (rc);
947 
948 	svcenum->se_bavail = svcenum->se_buflen;
949 	svcenum->se_bused = 0;
950 	svcenum->se_nitems = 0;
951 
952 	switch (svcenum->se_type) {
953 	case SMB_SVCENUM_TYPE_USER:
954 		smb_server_enum_users(sv, svcenum);
955 		break;
956 	case SMB_SVCENUM_TYPE_TREE:
957 	case SMB_SVCENUM_TYPE_FILE:
958 		smb_server_enum_trees(sv, svcenum);
959 		break;
960 	default:
961 		rc = EINVAL;
962 	}
963 
964 	smb_server_release(sv);
965 	return (rc);
966 }
967 
968 /*
969  * Look for sessions to disconnect by client and user name.
970  */
971 int
972 smb_server_session_close(smb_ioc_session_t *ioc)
973 {
974 	smb_server_t	*sv;
975 	int		cnt;
976 	int		rc;
977 
978 	if ((rc = smb_server_lookup(&sv)) != 0)
979 		return (rc);
980 
981 	cnt = smb_server_session_disconnect(sv, ioc->client, ioc->username);
982 
983 	smb_server_release(sv);
984 
985 	if (cnt == 0)
986 		return (ENOENT);
987 	return (0);
988 }
989 
990 /*
991  * Close a file by uniqid.
992  */
993 int
994 smb_server_file_close(smb_ioc_fileid_t *ioc)
995 {
996 	uint32_t	uniqid = ioc->uniqid;
997 	smb_server_t	*sv;
998 	int		rc;
999 
1000 	if ((rc = smb_server_lookup(&sv)) != 0)
1001 		return (rc);
1002 
1003 	rc = smb_server_fclose(sv, uniqid);
1004 
1005 	smb_server_release(sv);
1006 	return (rc);
1007 }
1008 
1009 /*
1010  * These functions determine the relevant smb server to which the call apply.
1011  */
1012 
1013 uint32_t
1014 smb_server_get_session_count(smb_server_t *sv)
1015 {
1016 	uint32_t	counter = 0;
1017 
1018 	counter = smb_llist_get_count(&sv->sv_session_list);
1019 
1020 	return (counter);
1021 }
1022 
1023 /*
1024  * Gets the smb_node of the specified share path.
1025  * Node is returned held (caller must rele.)
1026  */
1027 int
1028 smb_server_share_lookup(smb_server_t *sv, const char *shr_path,
1029     smb_node_t **nodepp)
1030 {
1031 	smb_request_t	*sr;
1032 	smb_node_t	*fnode = NULL;
1033 	smb_node_t	*dnode = NULL;
1034 	char		last_comp[MAXNAMELEN];
1035 	int		rc = 0;
1036 
1037 	ASSERT(shr_path);
1038 
1039 	mutex_enter(&sv->sv_mutex);
1040 	switch (sv->sv_state) {
1041 	case SMB_SERVER_STATE_RUNNING:
1042 		break;
1043 	default:
1044 		mutex_exit(&sv->sv_mutex);
1045 		return (ENOTACTIVE);
1046 	}
1047 	mutex_exit(&sv->sv_mutex);
1048 
1049 	if ((sr = smb_request_alloc(sv->sv_session, 0)) == NULL) {
1050 		return (ENOTCONN);
1051 	}
1052 	sr->user_cr = zone_kcred();
1053 
1054 	rc = smb_pathname_reduce(sr, sr->user_cr, shr_path,
1055 	    NULL, NULL, &dnode, last_comp);
1056 
1057 	if (rc == 0) {
1058 		rc = smb_fsop_lookup(sr, sr->user_cr, SMB_FOLLOW_LINKS,
1059 		    sv->si_root_smb_node, dnode, last_comp, &fnode);
1060 		smb_node_release(dnode);
1061 	}
1062 
1063 	smb_request_free(sr);
1064 
1065 	if (rc != 0)
1066 		return (rc);
1067 
1068 	ASSERT(fnode->vp && fnode->vp->v_vfsp);
1069 
1070 	*nodepp = fnode;
1071 
1072 	return (0);
1073 }
1074 
1075 #ifdef	_KERNEL
1076 /*
1077  * This is a special interface that will be utilized by ZFS to cause a share to
1078  * be added/removed.
1079  *
1080  * arg is either a lmshare_info_t or share_name from userspace.
1081  * It will need to be copied into the kernel.   It is lmshare_info_t
1082  * for add operations and share_name for delete operations.
1083  */
1084 int
1085 smb_server_share(void *arg, boolean_t add_share)
1086 {
1087 	smb_server_t	*sv;
1088 	int		rc;
1089 
1090 	if ((rc = smb_server_lookup(&sv)) == 0) {
1091 		mutex_enter(&sv->sv_mutex);
1092 		switch (sv->sv_state) {
1093 		case SMB_SERVER_STATE_RUNNING:
1094 			mutex_exit(&sv->sv_mutex);
1095 			(void) smb_kshare_upcall(sv->sv_lmshrd, arg, add_share);
1096 			break;
1097 		default:
1098 			mutex_exit(&sv->sv_mutex);
1099 			break;
1100 		}
1101 		smb_server_release(sv);
1102 	}
1103 
1104 	return (rc);
1105 }
1106 #endif	/* _KERNEL */
1107 
1108 int
1109 smb_server_unshare(const char *sharename)
1110 {
1111 	smb_server_t	*sv;
1112 	int		rc;
1113 
1114 	if ((rc = smb_server_lookup(&sv)))
1115 		return (rc);
1116 
1117 	mutex_enter(&sv->sv_mutex);
1118 	switch (sv->sv_state) {
1119 	case SMB_SERVER_STATE_RUNNING:
1120 	case SMB_SERVER_STATE_STOPPING:
1121 		break;
1122 	default:
1123 		mutex_exit(&sv->sv_mutex);
1124 		smb_server_release(sv);
1125 		return (ENOTACTIVE);
1126 	}
1127 	mutex_exit(&sv->sv_mutex);
1128 
1129 	smb_server_disconnect_share(sv, sharename);
1130 
1131 	smb_server_release(sv);
1132 	return (0);
1133 }
1134 
1135 /*
1136  * Disconnect the specified share.
1137  * Typically called when a share has been removed.
1138  */
1139 static void
1140 smb_server_disconnect_share(smb_server_t *sv, const char *sharename)
1141 {
1142 	smb_llist_t	*ll;
1143 	smb_session_t	*session;
1144 
1145 	ll = &sv->sv_session_list;
1146 	smb_llist_enter(ll, RW_READER);
1147 
1148 	session = smb_llist_head(ll);
1149 	while (session) {
1150 		SMB_SESSION_VALID(session);
1151 		smb_rwx_rwenter(&session->s_lock, RW_READER);
1152 		switch (session->s_state) {
1153 		case SMB_SESSION_STATE_NEGOTIATED:
1154 			smb_rwx_rwexit(&session->s_lock);
1155 			smb_session_disconnect_share(session, sharename);
1156 			break;
1157 		default:
1158 			smb_rwx_rwexit(&session->s_lock);
1159 			break;
1160 		}
1161 		session = smb_llist_next(ll, session);
1162 	}
1163 
1164 	smb_llist_exit(ll);
1165 }
1166 
1167 #ifdef	_KERNEL
1168 
1169 /*
1170  * Create a process to own SMB server threads.
1171  */
1172 static int
1173 smb_server_newproc(smb_server_t *sv)
1174 {
1175 	int rc;
1176 
1177 	mutex_enter(&sv->sv_proc_lock);
1178 	if (sv->sv_proc_p != NULL) {
1179 		/* restart? re-use proc */
1180 		rc = 0;
1181 		goto out;
1182 	}
1183 
1184 	sv->sv_proc_state = SMB_THREAD_STATE_STARTING;
1185 	rc = newproc(smb_server_proc_main, (caddr_t)sv,
1186 	    syscid, smbsrv_base_pri, NULL, 0);
1187 	if (rc != 0) {
1188 		cmn_err(CE_WARN, "newproc failed, rc=%d", rc);
1189 		goto out;
1190 	}
1191 
1192 	/* Rendez-vous with new proc thread. */
1193 	while (sv->sv_proc_state == SMB_THREAD_STATE_STARTING) {
1194 		cv_wait(&sv->sv_proc_cv, &sv->sv_proc_lock);
1195 
1196 	}
1197 	if (sv->sv_proc_state != SMB_THREAD_STATE_RUNNING) {
1198 		rc = ESRCH;
1199 		goto out;
1200 	}
1201 	ASSERT(sv->sv_proc_p != NULL);
1202 
1203 out:
1204 	mutex_exit(&sv->sv_proc_lock);
1205 	return (rc);
1206 }
1207 
1208 /*
1209  * Main thread for the process we create to own SMB server threads.
1210  */
1211 static void
1212 smb_server_proc_main(void *arg)
1213 {
1214 	callb_cpr_t	cprinfo;
1215 	smb_server_t	*sv = arg;
1216 	user_t		*pu = PTOU(curproc);
1217 	zoneid_t	zid = getzoneid();
1218 
1219 	ASSERT(curproc != &p0);
1220 	ASSERT(zid == sv->sv_zid);
1221 
1222 	(void) strlcpy(pu->u_comm, "smbsrv", sizeof (pu->u_comm));
1223 	(void) snprintf(pu->u_psargs, sizeof (pu->u_psargs),
1224 	    "smbsrv %d", (int)zid);
1225 
1226 	CALLB_CPR_INIT(&cprinfo, &sv->sv_proc_lock, callb_generic_cpr,
1227 	    pu->u_psargs);
1228 
1229 	mutex_enter(&sv->sv_proc_lock);
1230 	ASSERT(sv->sv_proc_state == SMB_THREAD_STATE_STARTING);
1231 
1232 	sv->sv_proc_p = curproc;
1233 	sv->sv_proc_did = curthread->t_did;
1234 
1235 	sv->sv_proc_state = SMB_THREAD_STATE_RUNNING;
1236 	cv_broadcast(&sv->sv_proc_cv);
1237 
1238 	CALLB_CPR_SAFE_BEGIN(&cprinfo);
1239 	while (sv->sv_proc_state == SMB_THREAD_STATE_RUNNING)
1240 		cv_wait(&sv->sv_proc_cv, &sv->sv_proc_lock);
1241 	CALLB_CPR_SAFE_END(&cprinfo, &sv->sv_proc_lock);
1242 
1243 	ASSERT(sv->sv_proc_state == SMB_THREAD_STATE_EXITING);
1244 	sv->sv_proc_state = SMB_THREAD_STATE_EXITED;
1245 	sv->sv_proc_p = NULL;
1246 	cv_broadcast(&sv->sv_proc_cv);
1247 	CALLB_CPR_EXIT(&cprinfo);	/* mutex_exit sv_proc_lock */
1248 
1249 	/* Note: lwp_exit() expects p_lock entered. */
1250 	mutex_enter(&curproc->p_lock);
1251 	lwp_exit();
1252 }
1253 
1254 /*
1255  * Delete the server proc (if any)
1256  */
1257 static void
1258 smb_server_delproc(smb_server_t *sv)
1259 {
1260 
1261 	mutex_enter(&sv->sv_proc_lock);
1262 
1263 	if (sv->sv_proc_state != SMB_THREAD_STATE_RUNNING)
1264 		goto out;
1265 	ASSERT(sv->sv_proc_p != NULL);
1266 
1267 	sv->sv_proc_state = SMB_THREAD_STATE_EXITING;
1268 	cv_broadcast(&sv->sv_proc_cv);
1269 
1270 	/* Rendez-vous with proc thread. */
1271 	while (sv->sv_proc_state == SMB_THREAD_STATE_EXITING) {
1272 		cv_wait(&sv->sv_proc_cv, &sv->sv_proc_lock);
1273 
1274 	}
1275 	if (sv->sv_proc_state != SMB_THREAD_STATE_EXITED) {
1276 		cmn_err(CE_WARN, "smb_server_delproc, state=%d",
1277 		    sv->sv_proc_state);
1278 		goto out;
1279 	}
1280 	if (sv->sv_proc_did != 0) {
1281 		thread_join(sv->sv_proc_did);
1282 		sv->sv_proc_did = 0;
1283 	}
1284 
1285 out:
1286 	mutex_exit(&sv->sv_proc_lock);
1287 }
1288 
1289 #endif	/* _KERNEL */
1290 
1291 /*
1292  * *****************************************************************************
1293  * **************** Functions called from the internal layers ******************
1294  * *****************************************************************************
1295  *
1296  * These functions are provided the relevant smb server by the caller.
1297  */
1298 
1299 void
1300 smb_server_get_cfg(smb_server_t *sv, smb_kmod_cfg_t *cfg)
1301 {
1302 	rw_enter(&sv->sv_cfg_lock, RW_READER);
1303 	bcopy(&sv->sv_cfg, cfg, sizeof (*cfg));
1304 	rw_exit(&sv->sv_cfg_lock);
1305 }
1306 
1307 /*
1308  *
1309  */
1310 void
1311 smb_server_inc_nbt_sess(smb_server_t *sv)
1312 {
1313 	SMB_SERVER_VALID(sv);
1314 	atomic_inc_32(&sv->sv_nbt_sess);
1315 }
1316 
1317 void
1318 smb_server_dec_nbt_sess(smb_server_t *sv)
1319 {
1320 	SMB_SERVER_VALID(sv);
1321 	atomic_dec_32(&sv->sv_nbt_sess);
1322 }
1323 
1324 void
1325 smb_server_inc_tcp_sess(smb_server_t *sv)
1326 {
1327 	SMB_SERVER_VALID(sv);
1328 	atomic_inc_32(&sv->sv_tcp_sess);
1329 }
1330 
1331 void
1332 smb_server_dec_tcp_sess(smb_server_t *sv)
1333 {
1334 	SMB_SERVER_VALID(sv);
1335 	atomic_dec_32(&sv->sv_tcp_sess);
1336 }
1337 
1338 void
1339 smb_server_inc_users(smb_server_t *sv)
1340 {
1341 	SMB_SERVER_VALID(sv);
1342 	atomic_inc_32(&sv->sv_users);
1343 }
1344 
1345 void
1346 smb_server_dec_users(smb_server_t *sv)
1347 {
1348 	SMB_SERVER_VALID(sv);
1349 	atomic_dec_32(&sv->sv_users);
1350 }
1351 
1352 void
1353 smb_server_inc_trees(smb_server_t *sv)
1354 {
1355 	SMB_SERVER_VALID(sv);
1356 	atomic_inc_32(&sv->sv_trees);
1357 }
1358 
1359 void
1360 smb_server_dec_trees(smb_server_t *sv)
1361 {
1362 	SMB_SERVER_VALID(sv);
1363 	atomic_dec_32(&sv->sv_trees);
1364 }
1365 
1366 void
1367 smb_server_inc_files(smb_server_t *sv)
1368 {
1369 	SMB_SERVER_VALID(sv);
1370 	atomic_inc_32(&sv->sv_files);
1371 }
1372 
1373 void
1374 smb_server_dec_files(smb_server_t *sv)
1375 {
1376 	SMB_SERVER_VALID(sv);
1377 	atomic_dec_32(&sv->sv_files);
1378 }
1379 
1380 void
1381 smb_server_inc_pipes(smb_server_t *sv)
1382 {
1383 	SMB_SERVER_VALID(sv);
1384 	atomic_inc_32(&sv->sv_pipes);
1385 }
1386 
1387 void
1388 smb_server_dec_pipes(smb_server_t *sv)
1389 {
1390 	SMB_SERVER_VALID(sv);
1391 	atomic_dec_32(&sv->sv_pipes);
1392 }
1393 
1394 void
1395 smb_server_add_rxb(smb_server_t *sv, int64_t value)
1396 {
1397 	SMB_SERVER_VALID(sv);
1398 	atomic_add_64(&sv->sv_rxb, value);
1399 }
1400 
1401 void
1402 smb_server_add_txb(smb_server_t *sv, int64_t value)
1403 {
1404 	SMB_SERVER_VALID(sv);
1405 	atomic_add_64(&sv->sv_txb, value);
1406 }
1407 
1408 void
1409 smb_server_inc_req(smb_server_t *sv)
1410 {
1411 	SMB_SERVER_VALID(sv);
1412 	atomic_inc_64(&sv->sv_nreq);
1413 }
1414 
1415 /*
1416  * *****************************************************************************
1417  * *************************** Static Functions ********************************
1418  * *****************************************************************************
1419  */
1420 
1421 static void
1422 smb_server_timers(smb_thread_t *thread, void *arg)
1423 {
1424 	smb_server_t	*sv = (smb_server_t *)arg;
1425 
1426 	ASSERT(sv != NULL);
1427 
1428 	/*
1429 	 * This kills old inactive sessions and expired durable
1430 	 * handles. The session code expects one call per minute.
1431 	 */
1432 	while (smb_thread_continue_timedwait(thread, 60 /* Seconds */)) {
1433 		if (sv->sv_cfg.skc_keepalive != 0)
1434 			smb_session_timers(sv);
1435 		smb2_durable_timers(sv);
1436 	}
1437 }
1438 
1439 /*
1440  * smb_server_kstat_init
1441  */
1442 static void
1443 smb_server_kstat_init(smb_server_t *sv)
1444 {
1445 
1446 	sv->sv_ksp = kstat_create_zone(SMBSRV_KSTAT_MODULE, 0,
1447 	    SMBSRV_KSTAT_STATISTICS, SMBSRV_KSTAT_CLASS, KSTAT_TYPE_RAW,
1448 	    sizeof (smbsrv_kstats_t), 0, sv->sv_zid);
1449 
1450 	if (sv->sv_ksp != NULL) {
1451 		sv->sv_ksp->ks_update = smb_server_kstat_update;
1452 		sv->sv_ksp->ks_private = sv;
1453 		((smbsrv_kstats_t *)sv->sv_ksp->ks_data)->ks_start_time =
1454 		    sv->sv_start_time;
1455 		smb_dispatch_stats_init(sv);
1456 		smb2_dispatch_stats_init(sv);
1457 		kstat_install(sv->sv_ksp);
1458 	} else {
1459 		cmn_err(CE_WARN, "SMB Server: Statistics unavailable");
1460 	}
1461 
1462 	sv->sv_legacy_ksp = kstat_create_zone(SMBSRV_KSTAT_MODULE, 0,
1463 	    SMBSRV_KSTAT_NAME, SMBSRV_KSTAT_CLASS, KSTAT_TYPE_NAMED,
1464 	    sizeof (smb_server_legacy_kstat_t) / sizeof (kstat_named_t),
1465 	    0, sv->sv_zid);
1466 
1467 	if (sv->sv_legacy_ksp != NULL) {
1468 		smb_server_legacy_kstat_t *ksd;
1469 
1470 		ksd = sv->sv_legacy_ksp->ks_data;
1471 
1472 		(void) strlcpy(ksd->ls_files.name, "open_files",
1473 		    sizeof (ksd->ls_files.name));
1474 		ksd->ls_files.data_type = KSTAT_DATA_UINT32;
1475 
1476 		(void) strlcpy(ksd->ls_trees.name, "connections",
1477 		    sizeof (ksd->ls_trees.name));
1478 		ksd->ls_trees.data_type = KSTAT_DATA_UINT32;
1479 
1480 		(void) strlcpy(ksd->ls_users.name, "connections",
1481 		    sizeof (ksd->ls_users.name));
1482 		ksd->ls_users.data_type = KSTAT_DATA_UINT32;
1483 
1484 		mutex_init(&sv->sv_legacy_ksmtx, NULL, MUTEX_DEFAULT, NULL);
1485 		sv->sv_legacy_ksp->ks_lock = &sv->sv_legacy_ksmtx;
1486 		sv->sv_legacy_ksp->ks_update = smb_server_legacy_kstat_update;
1487 		kstat_install(sv->sv_legacy_ksp);
1488 	}
1489 }
1490 
1491 /*
1492  * smb_server_kstat_fini
1493  */
1494 static void
1495 smb_server_kstat_fini(smb_server_t *sv)
1496 {
1497 	if (sv->sv_legacy_ksp != NULL) {
1498 		kstat_delete(sv->sv_legacy_ksp);
1499 		mutex_destroy(&sv->sv_legacy_ksmtx);
1500 		sv->sv_legacy_ksp = NULL;
1501 	}
1502 
1503 	if (sv->sv_ksp != NULL) {
1504 		kstat_delete(sv->sv_ksp);
1505 		sv->sv_ksp = NULL;
1506 		smb_dispatch_stats_fini(sv);
1507 		smb2_dispatch_stats_fini(sv);
1508 	}
1509 }
1510 
1511 /*
1512  * Verify the defines in smb_kstat.h used by ks_reqs1 ks_reqs2
1513  */
1514 CTASSERT(SMBSRV_KS_NREQS1 == SMB_COM_NUM);
1515 CTASSERT(SMBSRV_KS_NREQS2 == SMB2__NCMDS);
1516 
1517 /*
1518  * smb_server_kstat_update
1519  */
1520 static int
1521 smb_server_kstat_update(kstat_t *ksp, int rw)
1522 {
1523 	smb_server_t	*sv;
1524 	smbsrv_kstats_t	*ksd;
1525 
1526 	if (rw == KSTAT_READ) {
1527 		sv = ksp->ks_private;
1528 		SMB_SERVER_VALID(sv);
1529 		ksd = (smbsrv_kstats_t *)ksp->ks_data;
1530 		/*
1531 		 * Counters
1532 		 */
1533 		ksd->ks_nbt_sess = sv->sv_nbt_sess;
1534 		ksd->ks_tcp_sess = sv->sv_tcp_sess;
1535 		ksd->ks_users = sv->sv_users;
1536 		ksd->ks_trees = sv->sv_trees;
1537 		ksd->ks_files = sv->sv_files;
1538 		ksd->ks_pipes = sv->sv_pipes;
1539 		/*
1540 		 * Throughput
1541 		 */
1542 		ksd->ks_txb = sv->sv_txb;
1543 		ksd->ks_rxb = sv->sv_rxb;
1544 		ksd->ks_nreq = sv->sv_nreq;
1545 		/*
1546 		 * Busyness
1547 		 */
1548 		ksd->ks_maxreqs = sv->sv_cfg.skc_maxworkers;
1549 		smb_srqueue_update(&sv->sv_srqueue,
1550 		    &ksd->ks_utilization);
1551 		/*
1552 		 * Latency & Throughput of the requests
1553 		 */
1554 		smb_dispatch_stats_update(sv, ksd->ks_reqs1, 0, SMB_COM_NUM);
1555 		smb2_dispatch_stats_update(sv, ksd->ks_reqs2, 0, SMB2__NCMDS);
1556 		return (0);
1557 	}
1558 	if (rw == KSTAT_WRITE)
1559 		return (EACCES);
1560 
1561 	return (EIO);
1562 }
1563 
1564 static int
1565 smb_server_legacy_kstat_update(kstat_t *ksp, int rw)
1566 {
1567 	smb_server_t			*sv;
1568 	smb_server_legacy_kstat_t	*ksd;
1569 	int				rc;
1570 
1571 	switch (rw) {
1572 	case KSTAT_WRITE:
1573 		rc = EACCES;
1574 		break;
1575 	case KSTAT_READ:
1576 		if (!smb_server_lookup(&sv)) {
1577 			ASSERT(MUTEX_HELD(ksp->ks_lock));
1578 			ASSERT(sv->sv_legacy_ksp == ksp);
1579 			ksd = (smb_server_legacy_kstat_t *)ksp->ks_data;
1580 			ksd->ls_files.value.ui32 = sv->sv_files + sv->sv_pipes;
1581 			ksd->ls_trees.value.ui32 = sv->sv_trees;
1582 			ksd->ls_users.value.ui32 = sv->sv_users;
1583 			smb_server_release(sv);
1584 			rc = 0;
1585 			break;
1586 		}
1587 		/* FALLTHROUGH */
1588 	default:
1589 		rc = EIO;
1590 		break;
1591 	}
1592 	return (rc);
1593 
1594 }
1595 
1596 int smb_server_shutdown_wait1 = 15;	/* seconds */
1597 
1598 /*
1599  * smb_server_shutdown
1600  */
1601 static void
1602 smb_server_shutdown(smb_server_t *sv)
1603 {
1604 	smb_llist_t *sl = &sv->sv_session_list;
1605 	smb_session_t *session;
1606 	clock_t	time0, time1, time2;
1607 
1608 	SMB_SERVER_VALID(sv);
1609 
1610 	/*
1611 	 * Stop the listeners first, so we can't get any more
1612 	 * new sessions while we're trying to shut down.
1613 	 */
1614 	smb_server_listener_stop(&sv->sv_nbt_daemon);
1615 	smb_server_listener_stop(&sv->sv_tcp_daemon);
1616 
1617 	/*
1618 	 * Disconnect all of the sessions. This causes all the
1619 	 * smb_server_receiver threads to see a disconnect and
1620 	 * begin tear-down (in parallel) in smb_session_cancel.
1621 	 */
1622 	smb_llist_enter(sl, RW_READER);
1623 	session = smb_llist_head(sl);
1624 	while (session != NULL) {
1625 		smb_session_disconnect(session);
1626 		session = smb_llist_next(sl, session);
1627 	}
1628 	smb_llist_exit(sl);
1629 
1630 	/*
1631 	 * Wake up any threads we might have blocked.
1632 	 * Must precede kdoor_close etc. because those will
1633 	 * wait for such threads to get out.
1634 	 */
1635 	smb_event_cancel(sv, 0);
1636 	smb_threshold_wake_all(&sv->sv_ssetup_ct);
1637 	smb_threshold_wake_all(&sv->sv_tcon_ct);
1638 	smb_threshold_wake_all(&sv->sv_opipe_ct);
1639 
1640 	/*
1641 	 * Wait for the session list to empty.
1642 	 * (cv_signal in smb_server_destroy_session)
1643 	 *
1644 	 * We must wait for all the SMB session readers to finish, or
1645 	 * we could proceed here while there might be worker threads
1646 	 * running in any of those sessions.  See smb_session_logoff
1647 	 * for timeouts applied to session tear-down. If this takes
1648 	 * longer than expected, make some noise, and fire a dtrace
1649 	 * probe one might use to investigate.
1650 	 */
1651 	time0 = ddi_get_lbolt();
1652 	time1 = SEC_TO_TICK(smb_server_shutdown_wait1) + time0;
1653 	mutex_enter(&sv->sv_mutex);
1654 	while (sv->sv_session_list.ll_count != 0) {
1655 		if (cv_timedwait(&sv->sv_cv, &sv->sv_mutex, time1) < 0) {
1656 			cmn_err(CE_NOTE, "!shutdown waited %d seconds"
1657 			    " with %d sessions still remaining",
1658 			    smb_server_shutdown_wait1,
1659 			    sv->sv_session_list.ll_count);
1660 			DTRACE_PROBE1(max__wait, smb_server_t *, sv);
1661 			break;
1662 		}
1663 	}
1664 	while (sv->sv_session_list.ll_count != 0) {
1665 		cv_wait(&sv->sv_cv, &sv->sv_mutex);
1666 	}
1667 	mutex_exit(&sv->sv_mutex);
1668 
1669 	time2 = ddi_get_lbolt();
1670 	if (time2 > time1) {
1671 		cmn_err(CE_NOTE, "!shutdown waited %d seconds"
1672 		    " for all sessions to finish",
1673 		    (int)TICK_TO_SEC(time2 - time0));
1674 	}
1675 
1676 	smb_kdoor_close(sv);
1677 #ifdef	_KERNEL
1678 	smb_kshare_door_fini(sv->sv_lmshrd);
1679 #endif	/* _KERNEL */
1680 	sv->sv_lmshrd = NULL;
1681 
1682 	smb_export_stop(sv);
1683 	smb_kshare_stop(sv);
1684 	smb_thread_stop(&sv->si_thread_timers);
1685 
1686 	/*
1687 	 * Both kshare and the oplock break sub-systems may have
1688 	 * taskq jobs on the spcial "server" session, until we've
1689 	 * closed all ofiles and stopped the kshare exporter.
1690 	 * Now it's safe to destroy the server session, but first
1691 	 * wait for any requests on it to finish.  Note that for
1692 	 * normal sessions, this happens in smb_session_cancel,
1693 	 * but that's not called for the server session.
1694 	 */
1695 	if (sv->sv_rootuser != NULL) {
1696 		smb_user_logoff(sv->sv_rootuser);
1697 		smb_user_release(sv->sv_rootuser);
1698 		sv->sv_rootuser = NULL;
1699 	}
1700 	if (sv->sv_session != NULL) {
1701 		smb_session_cancel_requests(sv->sv_session, NULL, NULL);
1702 		smb_slist_wait_for_empty(&sv->sv_session->s_req_list);
1703 
1704 		/* Just in case import left users and trees */
1705 		smb_session_logoff(sv->sv_session);
1706 
1707 		smb_session_delete(sv->sv_session);
1708 		sv->sv_session = NULL;
1709 	}
1710 
1711 	if (sv->sv_receiver_pool != NULL) {
1712 		taskq_destroy(sv->sv_receiver_pool);
1713 		sv->sv_receiver_pool = NULL;
1714 	}
1715 
1716 	if (sv->sv_worker_pool != NULL) {
1717 		taskq_destroy(sv->sv_worker_pool);
1718 		sv->sv_worker_pool = NULL;
1719 	}
1720 
1721 	/*
1722 	 * Clean out any durable handles.  After this we should
1723 	 * have no ofiles remaining (and no more oplock breaks).
1724 	 */
1725 	smb2_dh_shutdown(sv);
1726 
1727 	smb_server_fsop_stop(sv);
1728 
1729 #ifdef	_KERNEL
1730 	if (sv->sv_proc_p != NULL) {
1731 		smb_server_delproc(sv);
1732 	}
1733 #endif
1734 }
1735 
1736 /*
1737  * smb_server_listener_init
1738  *
1739  * Initializes listener contexts.
1740  */
1741 static void
1742 smb_server_listener_init(
1743     smb_server_t		*sv,
1744     smb_listener_daemon_t	*ld,
1745     char			*name,
1746     in_port_t			port,
1747     int				family)
1748 {
1749 	ASSERT(ld->ld_magic != SMB_LISTENER_MAGIC);
1750 
1751 	bzero(ld, sizeof (*ld));
1752 
1753 	ld->ld_sv = sv;
1754 	ld->ld_family = family;
1755 	ld->ld_port = port;
1756 
1757 	if (family == AF_INET) {
1758 		ld->ld_sin.sin_family = (uint32_t)family;
1759 		ld->ld_sin.sin_port = htons(port);
1760 		ld->ld_sin.sin_addr.s_addr = htonl(INADDR_ANY);
1761 	} else {
1762 		ld->ld_sin6.sin6_family = (uint32_t)family;
1763 		ld->ld_sin6.sin6_port = htons(port);
1764 		(void) memset(&ld->ld_sin6.sin6_addr.s6_addr, 0,
1765 		    sizeof (ld->ld_sin6.sin6_addr.s6_addr));
1766 	}
1767 
1768 	smb_thread_init(&ld->ld_thread, name, smb_server_listener, ld,
1769 	    smbsrv_listen_pri, sv);
1770 	ld->ld_magic = SMB_LISTENER_MAGIC;
1771 }
1772 
1773 /*
1774  * smb_server_listener_destroy
1775  *
1776  * Destroyes listener contexts.
1777  */
1778 static void
1779 smb_server_listener_destroy(smb_listener_daemon_t *ld)
1780 {
1781 	/*
1782 	 * Note that if startup fails early, we can legitimately
1783 	 * get here with an all-zeros object.
1784 	 */
1785 	if (ld->ld_magic == 0)
1786 		return;
1787 
1788 	SMB_LISTENER_VALID(ld);
1789 	ASSERT(ld->ld_so == NULL);
1790 	smb_thread_destroy(&ld->ld_thread);
1791 	ld->ld_magic = 0;
1792 }
1793 
1794 /*
1795  * smb_server_listener_start
1796  *
1797  * Starts the listener associated with the context passed in.
1798  *
1799  * Return:	0	Success
1800  *		not 0	Failure
1801  */
1802 static int
1803 smb_server_listener_start(smb_listener_daemon_t *ld)
1804 {
1805 	int		rc;
1806 	uint32_t	on;
1807 	uint32_t	off;
1808 
1809 	SMB_LISTENER_VALID(ld);
1810 
1811 	if (ld->ld_so != NULL)
1812 		return (EINVAL);
1813 
1814 	ld->ld_so = smb_socreate(ld->ld_family, SOCK_STREAM, 0);
1815 	if (ld->ld_so == NULL) {
1816 		cmn_err(CE_WARN, "port %d: socket create failed", ld->ld_port);
1817 		return (ENOMEM);
1818 	}
1819 
1820 	off = 0;
1821 	(void) ksocket_setsockopt(ld->ld_so, SOL_SOCKET,
1822 	    SO_MAC_EXEMPT, &off, sizeof (off), CRED());
1823 
1824 	on = 1;
1825 	(void) ksocket_setsockopt(ld->ld_so, SOL_SOCKET,
1826 	    SO_REUSEADDR, &on, sizeof (on), CRED());
1827 
1828 	if (ld->ld_family == AF_INET) {
1829 		rc = ksocket_bind(ld->ld_so,
1830 		    (struct sockaddr *)&ld->ld_sin,
1831 		    sizeof (ld->ld_sin), CRED());
1832 	} else {
1833 		rc = ksocket_bind(ld->ld_so,
1834 		    (struct sockaddr *)&ld->ld_sin6,
1835 		    sizeof (ld->ld_sin6), CRED());
1836 	}
1837 
1838 	if (rc != 0) {
1839 		cmn_err(CE_WARN, "port %d: bind failed", ld->ld_port);
1840 		return (rc);
1841 	}
1842 
1843 	rc =  ksocket_listen(ld->ld_so, 20, CRED());
1844 	if (rc < 0) {
1845 		cmn_err(CE_WARN, "port %d: listen failed", ld->ld_port);
1846 		return (rc);
1847 	}
1848 
1849 	ksocket_hold(ld->ld_so);
1850 	rc = smb_thread_start(&ld->ld_thread);
1851 	if (rc != 0) {
1852 		ksocket_rele(ld->ld_so);
1853 		cmn_err(CE_WARN, "port %d: listener failed to start",
1854 		    ld->ld_port);
1855 		return (rc);
1856 	}
1857 	return (0);
1858 }
1859 
1860 /*
1861  * smb_server_listener_stop
1862  *
1863  * Stops the listener associated with the context passed in.
1864  */
1865 static void
1866 smb_server_listener_stop(smb_listener_daemon_t *ld)
1867 {
1868 	SMB_LISTENER_VALID(ld);
1869 
1870 	if (ld->ld_so != NULL) {
1871 		smb_soshutdown(ld->ld_so);
1872 		smb_sodestroy(ld->ld_so);
1873 		smb_thread_stop(&ld->ld_thread);
1874 		ld->ld_so = NULL;
1875 	}
1876 }
1877 
1878 /*
1879  * smb_server_listener
1880  *
1881  * Entry point of the listeners.
1882  */
1883 static void
1884 smb_server_listener(smb_thread_t *thread, void *arg)
1885 {
1886 	_NOTE(ARGUNUSED(thread))
1887 	smb_listener_daemon_t	*ld;
1888 	ksocket_t		s_so;
1889 	int			on;
1890 	int			txbuf_size;
1891 
1892 	ld = (smb_listener_daemon_t *)arg;
1893 
1894 	SMB_LISTENER_VALID(ld);
1895 
1896 	DTRACE_PROBE1(so__wait__accept, struct sonode *, ld->ld_so);
1897 
1898 	while (smb_thread_continue_nowait(&ld->ld_thread) &&
1899 	    ld->ld_sv->sv_state != SMB_SERVER_STATE_STOPPING) {
1900 		int ret = ksocket_accept(ld->ld_so, NULL, NULL, &s_so, CRED());
1901 
1902 		switch (ret) {
1903 		case 0:
1904 			break;
1905 		case ECONNABORTED:
1906 			continue;
1907 
1908 		case EINTR:
1909 		case EBADF:
1910 		case ENOTSOCK:
1911 			/* These are normal during shutdown. Silence. */
1912 			if (ld->ld_sv->sv_state == SMB_SERVER_STATE_STOPPING)
1913 				goto out;
1914 			/* FALLTHROUGH */
1915 		default:
1916 			cmn_err(CE_WARN,
1917 			    "smb_server_listener: ksocket_accept failed (%d)",
1918 			    ret);
1919 			/* avoid a tight CPU-burn loop here */
1920 			delay(MSEC_TO_TICK(10));
1921 			continue;
1922 		}
1923 
1924 		DTRACE_PROBE1(so__accept, struct sonode *, s_so);
1925 
1926 		on = 1;
1927 		(void) ksocket_setsockopt(s_so, IPPROTO_TCP, TCP_NODELAY,
1928 		    &on, sizeof (on), CRED());
1929 
1930 		on = 1;
1931 		(void) ksocket_setsockopt(s_so, SOL_SOCKET, SO_KEEPALIVE,
1932 		    &on, sizeof (on), CRED());
1933 
1934 		txbuf_size = 128*1024;
1935 		(void) ksocket_setsockopt(s_so, SOL_SOCKET, SO_SNDBUF,
1936 		    (const void *)&txbuf_size, sizeof (txbuf_size), CRED());
1937 
1938 		/*
1939 		 * Create a session for this connection.
1940 		 */
1941 		smb_server_create_session(ld, s_so);
1942 	}
1943 out:
1944 	ksocket_rele(ld->ld_so);
1945 }
1946 
1947 /*
1948  * smb_server_receiver
1949  *
1950  * Entry point of the receiver threads.
1951  * Also does cleanup when socket disconnected.
1952  */
1953 static void
1954 smb_server_receiver(void *arg)
1955 {
1956 	smb_session_t	*session;
1957 
1958 	session = (smb_session_t *)arg;
1959 
1960 	/* We stay in here until socket disconnect. */
1961 	smb_session_receiver(session);
1962 
1963 	smb_server_destroy_session(session);
1964 }
1965 
1966 /*
1967  * smb_server_lookup
1968  *
1969  * This function finds the server associated with the zone of the
1970  * caller.  Note: requires a fix in the dynamic taskq code:
1971  * 1501 taskq_create_proc ... TQ_DYNAMIC puts tasks in p0
1972  */
1973 int
1974 smb_server_lookup(smb_server_t **psv)
1975 {
1976 	zoneid_t	zid;
1977 	smb_server_t	*sv;
1978 
1979 	zid = getzoneid();
1980 
1981 	smb_llist_enter(&smb_servers, RW_READER);
1982 	sv = smb_llist_head(&smb_servers);
1983 	while (sv) {
1984 		SMB_SERVER_VALID(sv);
1985 		if (sv->sv_zid == zid) {
1986 			mutex_enter(&sv->sv_mutex);
1987 			if (sv->sv_state != SMB_SERVER_STATE_DELETING) {
1988 				sv->sv_refcnt++;
1989 				mutex_exit(&sv->sv_mutex);
1990 				smb_llist_exit(&smb_servers);
1991 				*psv = sv;
1992 				return (0);
1993 			}
1994 			mutex_exit(&sv->sv_mutex);
1995 			break;
1996 		}
1997 		sv = smb_llist_next(&smb_servers, sv);
1998 	}
1999 	smb_llist_exit(&smb_servers);
2000 	return (EPERM);
2001 }
2002 
2003 /*
2004  * smb_server_release
2005  *
2006  * This function decrements the reference count of the server and signals its
2007  * condition variable if the state of the server is SMB_SERVER_STATE_DELETING.
2008  */
2009 void
2010 smb_server_release(smb_server_t *sv)
2011 {
2012 	SMB_SERVER_VALID(sv);
2013 
2014 	mutex_enter(&sv->sv_mutex);
2015 	ASSERT(sv->sv_refcnt);
2016 	sv->sv_refcnt--;
2017 	if ((sv->sv_refcnt == 0) && (sv->sv_state == SMB_SERVER_STATE_DELETING))
2018 		cv_signal(&sv->sv_cv);
2019 	mutex_exit(&sv->sv_mutex);
2020 }
2021 
2022 /*
2023  * smb_server_lookup_user
2024  *
2025  * Find an smb_user by its user_id
2026  * Optional ssn_id (if non-zero) restricts search to a specific session.
2027  *
2028  * Returns smb_user_t * held. Caller must smb_user_rele(user)
2029  * Returns NULL if not found.
2030  */
2031 smb_user_t *
2032 smb_server_lookup_user(smb_server_t *sv, uint64_t ssn_id, uint64_t user_id)
2033 {
2034 	smb_llist_t	*slist = &sv->sv_session_list;
2035 	smb_session_t	*sn;
2036 	smb_user_t	*user = NULL;
2037 
2038 	smb_llist_enter(slist, RW_READER);
2039 
2040 	for (sn = smb_llist_head(slist);
2041 	    sn != NULL && user == NULL;
2042 	    sn = smb_llist_next(slist, sn)) {
2043 		SMB_SESSION_VALID(sn);
2044 
2045 		if (ssn_id != 0 && ssn_id != sn->s_kid)
2046 			continue;
2047 		if (sn->s_state != SMB_SESSION_STATE_NEGOTIATED)
2048 			continue;
2049 
2050 		user = smb_session_lookup_ssnid(sn, user_id);
2051 	}
2052 	smb_llist_exit(slist);
2053 
2054 	return (user);
2055 }
2056 
2057 /*
2058  * Enumerate the users associated with a session list.
2059  */
2060 static void
2061 smb_server_enum_users(smb_server_t *sv, smb_svcenum_t *svcenum)
2062 {
2063 	smb_llist_t	*ll = &sv->sv_session_list;
2064 	smb_session_t	*sn;
2065 	smb_llist_t	*ulist;
2066 	smb_user_t	*user;
2067 	int		rc = 0;
2068 
2069 	smb_llist_enter(ll, RW_READER);
2070 	sn = smb_llist_head(ll);
2071 
2072 	while (sn != NULL) {
2073 		SMB_SESSION_VALID(sn);
2074 		ulist = &sn->s_user_list;
2075 		smb_llist_enter(ulist, RW_READER);
2076 		user = smb_llist_head(ulist);
2077 
2078 		while (user != NULL) {
2079 			if (smb_user_hold(user)) {
2080 				rc = smb_user_enum(user, svcenum);
2081 				smb_user_release(user);
2082 				if (rc != 0)
2083 					break;
2084 			}
2085 
2086 			user = smb_llist_next(ulist, user);
2087 		}
2088 
2089 		smb_llist_exit(ulist);
2090 
2091 		if (rc != 0)
2092 			break;
2093 
2094 		sn = smb_llist_next(ll, sn);
2095 	}
2096 
2097 	smb_llist_exit(ll);
2098 }
2099 
2100 /*
2101  * Enumerate the trees/files associated with a session list.
2102  */
2103 static void
2104 smb_server_enum_trees(smb_server_t *sv, smb_svcenum_t *svcenum)
2105 {
2106 	smb_llist_t	*ll = &sv->sv_session_list;
2107 	smb_session_t	*sn;
2108 	smb_llist_t	*tlist;
2109 	smb_tree_t	*tree;
2110 	int		rc = 0;
2111 
2112 	smb_llist_enter(ll, RW_READER);
2113 	sn = smb_llist_head(ll);
2114 
2115 	while (sn != NULL) {
2116 		SMB_SESSION_VALID(sn);
2117 		tlist = &sn->s_tree_list;
2118 		smb_llist_enter(tlist, RW_READER);
2119 		tree = smb_llist_head(tlist);
2120 
2121 		while (tree != NULL) {
2122 			if (smb_tree_hold(tree)) {
2123 				rc = smb_tree_enum(tree, svcenum);
2124 				smb_tree_release(tree);
2125 				if (rc != 0)
2126 					break;
2127 			}
2128 
2129 			tree = smb_llist_next(tlist, tree);
2130 		}
2131 
2132 		smb_llist_exit(tlist);
2133 
2134 		if (rc != 0)
2135 			break;
2136 
2137 		sn = smb_llist_next(ll, sn);
2138 	}
2139 
2140 	smb_llist_exit(ll);
2141 }
2142 
2143 /*
2144  * Disconnect sessions associated with the specified client and username.
2145  * Empty strings are treated as wildcards.
2146  */
2147 static int
2148 smb_server_session_disconnect(smb_server_t *sv,
2149     const char *client, const char *name)
2150 {
2151 	smb_llist_t	*ll = &sv->sv_session_list;
2152 	smb_session_t	*sn;
2153 	smb_llist_t	*ulist;
2154 	smb_user_t	*user;
2155 	int		count = 0;
2156 
2157 	smb_llist_enter(ll, RW_READER);
2158 
2159 	for (sn = smb_llist_head(ll);
2160 	    sn != NULL;
2161 	    sn = smb_llist_next(ll, sn)) {
2162 		SMB_SESSION_VALID(sn);
2163 
2164 		if (*client != '\0' && !smb_session_isclient(sn, client))
2165 			continue;
2166 
2167 		ulist = &sn->s_user_list;
2168 		smb_llist_enter(ulist, RW_READER);
2169 
2170 		for (user = smb_llist_head(ulist);
2171 		    user != NULL;
2172 		    user = smb_llist_next(ulist, user)) {
2173 
2174 			if (smb_user_hold(user)) {
2175 
2176 				if (*name == '\0' ||
2177 				    smb_user_namecmp(user, name)) {
2178 					smb_user_logoff(user);
2179 					count++;
2180 				}
2181 
2182 				smb_user_release(user);
2183 			}
2184 		}
2185 
2186 		smb_llist_exit(ulist);
2187 	}
2188 
2189 	smb_llist_exit(ll);
2190 	return (count);
2191 }
2192 
2193 /*
2194  * Close a file by its unique id.
2195  */
2196 static int
2197 smb_server_fclose(smb_server_t *sv, uint32_t uniqid)
2198 {
2199 	smb_llist_t	*ll;
2200 	smb_session_t	*sn;
2201 	smb_llist_t	*tlist;
2202 	smb_tree_t	*tree;
2203 	int		rc = ENOENT;
2204 
2205 	ll = &sv->sv_session_list;
2206 	smb_llist_enter(ll, RW_READER);
2207 	sn = smb_llist_head(ll);
2208 
2209 	while ((sn != NULL) && (rc == ENOENT)) {
2210 		SMB_SESSION_VALID(sn);
2211 		tlist = &sn->s_tree_list;
2212 		smb_llist_enter(tlist, RW_READER);
2213 		tree = smb_llist_head(tlist);
2214 
2215 		while ((tree != NULL) && (rc == ENOENT)) {
2216 			if (smb_tree_hold(tree)) {
2217 				rc = smb_tree_fclose(tree, uniqid);
2218 				smb_tree_release(tree);
2219 			}
2220 
2221 			tree = smb_llist_next(tlist, tree);
2222 		}
2223 
2224 		smb_llist_exit(tlist);
2225 		sn = smb_llist_next(ll, sn);
2226 	}
2227 
2228 	smb_llist_exit(ll);
2229 	return (rc);
2230 }
2231 
2232 /*
2233  * This is used by SMB2 session setup to logoff a previous session,
2234  * so it can force a logoff that we haven't noticed yet.
2235  * This is not called frequently, so we just walk the list of
2236  * connections searching for the user.
2237  *
2238  * Note that this must wait for any durable handles (ofiles)
2239  * owned by this user to become "orphaned", so that a reconnect
2240  * that may immediately follow can find and use such ofiles.
2241  */
2242 void
2243 smb_server_logoff_ssnid(smb_request_t *sr, uint64_t ssnid)
2244 {
2245 	smb_server_t	*sv = sr->sr_server;
2246 	smb_llist_t	*sess_list;
2247 	smb_session_t	*sess;
2248 	smb_user_t	*user = NULL;
2249 	boolean_t	do_logoff = B_FALSE;
2250 
2251 	SMB_SERVER_VALID(sv);
2252 
2253 	if (sv->sv_state != SMB_SERVER_STATE_RUNNING)
2254 		return;
2255 
2256 	sess_list = &sv->sv_session_list;
2257 	smb_llist_enter(sess_list, RW_READER);
2258 
2259 	for (sess = smb_llist_head(sess_list);
2260 	    sess != NULL;
2261 	    sess = smb_llist_next(sess_list, sess)) {
2262 
2263 		SMB_SESSION_VALID(sess);
2264 
2265 		if (sess->dialect < SMB_VERS_2_BASE)
2266 			continue;
2267 
2268 		switch (sess->s_state) {
2269 		case SMB_SESSION_STATE_NEGOTIATED:
2270 		case SMB_SESSION_STATE_TERMINATED:
2271 		case SMB_SESSION_STATE_DISCONNECTED:
2272 			break;
2273 		default:
2274 			continue;
2275 		}
2276 
2277 		/*
2278 		 * Normal situation is to find a LOGGED_ON user.
2279 		 */
2280 		user = smb_session_lookup_uid_st(sess, ssnid, 0,
2281 		    SMB_USER_STATE_LOGGED_ON);
2282 		if (user != NULL) {
2283 			if (smb_is_same_user(user->u_cred, sr->user_cr)) {
2284 				do_logoff = B_TRUE;
2285 				break;
2286 			}
2287 			smb_user_release(user);
2288 			user = NULL;
2289 		}
2290 
2291 		/*
2292 		 * If we raced with disconnect, may find LOGGING_OFF,
2293 		 * in which case we want to just wait for it.
2294 		 */
2295 		user = smb_session_lookup_uid_st(sess, ssnid, 0,
2296 		    SMB_USER_STATE_LOGGING_OFF);
2297 		if (user != NULL) {
2298 			if (smb_is_same_user(user->u_cred, sr->user_cr))
2299 				break;
2300 			smb_user_release(user);
2301 			user = NULL;
2302 		}
2303 	}
2304 
2305 	smb_llist_exit(sess_list);
2306 
2307 	/*
2308 	 * Note that smb_user_logoff() can block for a while if
2309 	 * smb_session_disconnect_owned_trees, smb_ofile_close_all
2310 	 * ends up blocked on locks held by running requests.
2311 	 * Do that while not holding the session list rwlock.
2312 	 */
2313 	if (user != NULL) {
2314 		if (do_logoff) {
2315 			/* Treat this as if we lost the connection */
2316 			user->preserve_opens = SMB2_DH_PRESERVE_SOME;
2317 			smb_user_logoff(user);
2318 		}
2319 
2320 		/*
2321 		 * Wait for durable handles to be orphaned.
2322 		 * Note: not holding the sess list rwlock.
2323 		 */
2324 		smb_user_wait_trees(user);
2325 
2326 		/*
2327 		 * Could be doing the last release on a user below,
2328 		 * which can leave work on the delete queues for
2329 		 * s_user_list or s_tree_list so flush those.
2330 		 * Must hold the session list after the user release
2331 		 * so that the session can't go away while we flush.
2332 		 */
2333 		smb_llist_enter(sess_list, RW_READER);
2334 
2335 		sess = user->u_session;
2336 		smb_user_release(user);
2337 
2338 		smb_llist_flush(&sess->s_tree_list);
2339 		smb_llist_flush(&sess->s_user_list);
2340 
2341 		smb_llist_exit(sess_list);
2342 	}
2343 }
2344 
2345 /* See also: libsmb smb_kmod_setcfg */
2346 static void
2347 smb_server_store_cfg(smb_server_t *sv, smb_ioc_cfg_t *ioc)
2348 {
2349 	if (ioc->maxconnections == 0)
2350 		ioc->maxconnections = 0xFFFFFFFF;
2351 
2352 	if (ioc->encrypt == SMB_CONFIG_REQUIRED &&
2353 	    ioc->max_protocol < SMB_VERS_3_0) {
2354 		cmn_err(CE_WARN, "Server set to require encryption; "
2355 		    "forcing max_protocol to 3.0");
2356 		ioc->max_protocol = SMB_VERS_3_0;
2357 	}
2358 	sv->sv_cfg.skc_maxworkers = ioc->maxworkers;
2359 	sv->sv_cfg.skc_maxconnections = ioc->maxconnections;
2360 	sv->sv_cfg.skc_keepalive = ioc->keepalive;
2361 	sv->sv_cfg.skc_restrict_anon = ioc->restrict_anon;
2362 	sv->sv_cfg.skc_signing_enable = ioc->signing_enable;
2363 	sv->sv_cfg.skc_signing_required = ioc->signing_required;
2364 	sv->sv_cfg.skc_oplock_enable = ioc->oplock_enable;
2365 	sv->sv_cfg.skc_sync_enable = ioc->sync_enable;
2366 	sv->sv_cfg.skc_secmode = ioc->secmode;
2367 	sv->sv_cfg.skc_netbios_enable = ioc->netbios_enable;
2368 	sv->sv_cfg.skc_ipv6_enable = ioc->ipv6_enable;
2369 	sv->sv_cfg.skc_print_enable = ioc->print_enable;
2370 	sv->sv_cfg.skc_traverse_mounts = ioc->traverse_mounts;
2371 	sv->sv_cfg.skc_short_names = ioc->short_names;
2372 	sv->sv_cfg.skc_max_protocol = ioc->max_protocol;
2373 	sv->sv_cfg.skc_min_protocol = ioc->min_protocol;
2374 	sv->sv_cfg.skc_encrypt = ioc->encrypt;
2375 	sv->sv_cfg.skc_encrypt_ciphers = ioc->encrypt_ciphers;
2376 	sv->sv_cfg.skc_execflags = ioc->exec_flags;
2377 	sv->sv_cfg.skc_negtok_len = ioc->negtok_len;
2378 	sv->sv_cfg.skc_max_opens = ioc->max_opens;
2379 	sv->sv_cfg.skc_version = ioc->version;
2380 	sv->sv_cfg.skc_initial_credits = ioc->initial_credits;
2381 	sv->sv_cfg.skc_maximum_credits = ioc->maximum_credits;
2382 
2383 	(void) memcpy(sv->sv_cfg.skc_machine_uuid, ioc->machine_uuid,
2384 	    sizeof (uuid_t));
2385 	(void) memcpy(sv->sv_cfg.skc_negtok, ioc->negtok,
2386 	    sizeof (sv->sv_cfg.skc_negtok));
2387 	(void) memcpy(sv->sv_cfg.skc_native_os, ioc->native_os,
2388 	    sizeof (sv->sv_cfg.skc_native_os));
2389 	(void) memcpy(sv->sv_cfg.skc_native_lm, ioc->native_lm,
2390 	    sizeof (sv->sv_cfg.skc_native_lm));
2391 
2392 	(void) strlcpy(sv->sv_cfg.skc_nbdomain, ioc->nbdomain,
2393 	    sizeof (sv->sv_cfg.skc_nbdomain));
2394 	(void) strlcpy(sv->sv_cfg.skc_fqdn, ioc->fqdn,
2395 	    sizeof (sv->sv_cfg.skc_fqdn));
2396 	(void) strlcpy(sv->sv_cfg.skc_hostname, ioc->hostname,
2397 	    sizeof (sv->sv_cfg.skc_hostname));
2398 	(void) strlcpy(sv->sv_cfg.skc_system_comment, ioc->system_comment,
2399 	    sizeof (sv->sv_cfg.skc_system_comment));
2400 }
2401 
2402 static int
2403 smb_server_fsop_start(smb_server_t *sv)
2404 {
2405 	int	error;
2406 
2407 	error = smb_node_root_init(sv, &sv->si_root_smb_node);
2408 	if (error != 0)
2409 		sv->si_root_smb_node = NULL;
2410 
2411 	return (error);
2412 }
2413 
2414 static void
2415 smb_server_fsop_stop(smb_server_t *sv)
2416 {
2417 	if (sv->si_root_smb_node != NULL) {
2418 		smb_node_release(sv->si_root_smb_node);
2419 		sv->si_root_smb_node = NULL;
2420 	}
2421 }
2422 
2423 smb_event_t *
2424 smb_event_create(smb_server_t *sv, int timeout)
2425 {
2426 	smb_event_t	*event;
2427 
2428 	if (smb_server_is_stopping(sv))
2429 		return (NULL);
2430 
2431 	event = kmem_cache_alloc(smb_cache_event, KM_SLEEP);
2432 
2433 	bzero(event, sizeof (smb_event_t));
2434 	mutex_init(&event->se_mutex, NULL, MUTEX_DEFAULT, NULL);
2435 	cv_init(&event->se_cv, NULL, CV_DEFAULT, NULL);
2436 	event->se_magic = SMB_EVENT_MAGIC;
2437 	event->se_txid = smb_event_alloc_txid();
2438 	event->se_server = sv;
2439 	event->se_timeout = timeout;
2440 
2441 	smb_llist_enter(&sv->sv_event_list, RW_WRITER);
2442 	smb_llist_insert_tail(&sv->sv_event_list, event);
2443 	smb_llist_exit(&sv->sv_event_list);
2444 
2445 	return (event);
2446 }
2447 
2448 void
2449 smb_event_destroy(smb_event_t *event)
2450 {
2451 	smb_server_t	*sv;
2452 
2453 	if (event == NULL)
2454 		return;
2455 
2456 	SMB_EVENT_VALID(event);
2457 	ASSERT(event->se_waittime == 0);
2458 	sv = event->se_server;
2459 	SMB_SERVER_VALID(sv);
2460 
2461 	smb_llist_enter(&sv->sv_event_list, RW_WRITER);
2462 	smb_llist_remove(&sv->sv_event_list, event);
2463 	smb_llist_exit(&sv->sv_event_list);
2464 
2465 	event->se_magic = (uint32_t)~SMB_EVENT_MAGIC;
2466 	cv_destroy(&event->se_cv);
2467 	mutex_destroy(&event->se_mutex);
2468 
2469 	kmem_cache_free(smb_cache_event, event);
2470 }
2471 
2472 /*
2473  * Get the txid for the specified event.
2474  */
2475 uint32_t
2476 smb_event_txid(smb_event_t *event)
2477 {
2478 	if (event != NULL) {
2479 		SMB_EVENT_VALID(event);
2480 		return (event->se_txid);
2481 	}
2482 
2483 	cmn_err(CE_NOTE, "smb_event_txid failed");
2484 	return ((uint32_t)-1);
2485 }
2486 
2487 /*
2488  * Wait for event notification.
2489  */
2490 int
2491 smb_event_wait(smb_event_t *event)
2492 {
2493 	int	seconds = 1;
2494 	int	ticks;
2495 	int	err;
2496 
2497 	if (event == NULL)
2498 		return (EINVAL);
2499 
2500 	SMB_EVENT_VALID(event);
2501 
2502 	mutex_enter(&event->se_mutex);
2503 	event->se_waittime = 1;
2504 	event->se_errno = 0;
2505 
2506 	while (!(event->se_notified)) {
2507 		if (smb_event_debug && ((event->se_waittime % 30) == 0))
2508 			cmn_err(CE_NOTE, "smb_event_wait[%d] (%d sec)",
2509 			    event->se_txid, event->se_waittime);
2510 
2511 		if (event->se_errno != 0)
2512 			break;
2513 
2514 		if (event->se_waittime > event->se_timeout) {
2515 			event->se_errno = ETIME;
2516 			break;
2517 		}
2518 
2519 		ticks = SEC_TO_TICK(seconds);
2520 		(void) cv_reltimedwait(&event->se_cv,
2521 		    &event->se_mutex, (clock_t)ticks, TR_CLOCK_TICK);
2522 		++event->se_waittime;
2523 	}
2524 
2525 	err = event->se_errno;
2526 	event->se_waittime = 0;
2527 	event->se_notified = B_FALSE;
2528 	cv_signal(&event->se_cv);
2529 	mutex_exit(&event->se_mutex);
2530 	return (err);
2531 }
2532 
2533 /*
2534  * If txid is non-zero, cancel the specified event.
2535  * Otherwise, cancel all events.
2536  */
2537 static void
2538 smb_event_cancel(smb_server_t *sv, uint32_t txid)
2539 {
2540 	smb_event_t	*event;
2541 	smb_llist_t	*event_list;
2542 
2543 	SMB_SERVER_VALID(sv);
2544 
2545 	event_list = &sv->sv_event_list;
2546 	smb_llist_enter(event_list, RW_WRITER);
2547 
2548 	event = smb_llist_head(event_list);
2549 	while (event) {
2550 		SMB_EVENT_VALID(event);
2551 
2552 		if (txid == 0 || event->se_txid == txid) {
2553 			mutex_enter(&event->se_mutex);
2554 			event->se_errno = ECANCELED;
2555 			event->se_notified = B_TRUE;
2556 			cv_signal(&event->se_cv);
2557 			mutex_exit(&event->se_mutex);
2558 
2559 			if (txid != 0)
2560 				break;
2561 		}
2562 
2563 		event = smb_llist_next(event_list, event);
2564 	}
2565 
2566 	smb_llist_exit(event_list);
2567 }
2568 
2569 /*
2570  * If txid is non-zero, notify the specified event.
2571  * Otherwise, notify all events.
2572  */
2573 void
2574 smb_event_notify(smb_server_t *sv, uint32_t txid)
2575 {
2576 	smb_event_t	*event;
2577 	smb_llist_t	*event_list;
2578 
2579 	SMB_SERVER_VALID(sv);
2580 
2581 	event_list = &sv->sv_event_list;
2582 	smb_llist_enter(event_list, RW_READER);
2583 
2584 	event = smb_llist_head(event_list);
2585 	while (event) {
2586 		SMB_EVENT_VALID(event);
2587 
2588 		if (txid == 0 || event->se_txid == txid) {
2589 			mutex_enter(&event->se_mutex);
2590 			event->se_notified = B_TRUE;
2591 			cv_signal(&event->se_cv);
2592 			mutex_exit(&event->se_mutex);
2593 
2594 			if (txid != 0)
2595 				break;
2596 		}
2597 
2598 		event = smb_llist_next(event_list, event);
2599 	}
2600 
2601 	smb_llist_exit(event_list);
2602 }
2603 
2604 /*
2605  * Allocate a new transaction id (txid).
2606  *
2607  * 0 or -1 are not assigned because they are used to detect invalid
2608  * conditions or to indicate all open id's.
2609  */
2610 static uint32_t
2611 smb_event_alloc_txid(void)
2612 {
2613 	static kmutex_t	txmutex;
2614 	static uint32_t	txid;
2615 	uint32_t	txid_ret;
2616 
2617 	mutex_enter(&txmutex);
2618 
2619 	if (txid == 0)
2620 		txid = ddi_get_lbolt() << 11;
2621 
2622 	do {
2623 		++txid;
2624 	} while (txid == 0 || txid == (uint32_t)-1);
2625 
2626 	txid_ret = txid;
2627 	mutex_exit(&txmutex);
2628 
2629 	return (txid_ret);
2630 }
2631 
2632 /*
2633  * Called by the ioctl to find the corresponding
2634  * spooldoc node.  removes node on success
2635  *
2636  * Return values
2637  * rc
2638  * B_FALSE - not found
2639  * B_TRUE  - found
2640  *
2641  */
2642 
2643 static boolean_t
2644 smb_spool_lookup_doc_byfid(smb_server_t *sv, uint16_t fid,
2645     smb_kspooldoc_t *spdoc)
2646 {
2647 	smb_kspooldoc_t *sp;
2648 	smb_llist_t	*splist;
2649 
2650 	splist = &sv->sp_info.sp_list;
2651 	smb_llist_enter(splist, RW_WRITER);
2652 	sp = smb_llist_head(splist);
2653 	while (sp != NULL) {
2654 		/*
2655 		 * check for a matching fid
2656 		 */
2657 		if (sp->sd_fid == fid) {
2658 			*spdoc = *sp;
2659 			smb_llist_remove(splist, sp);
2660 			smb_llist_exit(splist);
2661 			kmem_free(sp, sizeof (smb_kspooldoc_t));
2662 			return (B_TRUE);
2663 		}
2664 		sp = smb_llist_next(splist, sp);
2665 	}
2666 	cmn_err(CE_WARN, "smb_spool_lookup_user_byfid: no fid:%d", fid);
2667 	smb_llist_exit(splist);
2668 	return (B_FALSE);
2669 }
2670 
2671 /*
2672  * Adds the spool fid to a linked list to be used
2673  * as a search key in the spooldoc queue
2674  *
2675  * Return values
2676  *      rc non-zero error
2677  *	rc zero success
2678  *
2679  */
2680 
2681 void
2682 smb_spool_add_fid(smb_server_t *sv, uint16_t fid)
2683 {
2684 	smb_llist_t	*fidlist;
2685 	smb_spoolfid_t  *sf;
2686 
2687 	if (sv->sv_cfg.skc_print_enable == 0)
2688 		return;
2689 
2690 	sf = kmem_zalloc(sizeof (smb_spoolfid_t), KM_SLEEP);
2691 	fidlist = &sv->sp_info.sp_fidlist;
2692 	smb_llist_enter(fidlist, RW_WRITER);
2693 	sf->sf_fid = fid;
2694 	smb_llist_insert_tail(fidlist, sf);
2695 	smb_llist_exit(fidlist);
2696 	cv_broadcast(&sv->sp_info.sp_cv);
2697 }
2698 
2699 /*
2700  * Called by the ioctl to get and remove the head of the fid list
2701  *
2702  * Return values
2703  * int fd
2704  * greater than 0 success
2705  * 0 - error
2706  *
2707  */
2708 
2709 static uint16_t
2710 smb_spool_get_fid(smb_server_t *sv)
2711 {
2712 	smb_spoolfid_t	*spfid;
2713 	smb_llist_t	*splist;
2714 	uint16_t	fid;
2715 
2716 	splist = &sv->sp_info.sp_fidlist;
2717 	smb_llist_enter(splist, RW_WRITER);
2718 	spfid = smb_llist_head(splist);
2719 	if (spfid != NULL) {
2720 		fid = spfid->sf_fid;
2721 		smb_llist_remove(&sv->sp_info.sp_fidlist, spfid);
2722 		kmem_free(spfid, sizeof (smb_spoolfid_t));
2723 	} else {
2724 		fid = 0;
2725 	}
2726 	smb_llist_exit(splist);
2727 	return (fid);
2728 }
2729 
2730 /*
2731  * Adds the spooldoc to the tail of the spooldoc list
2732  *
2733  * Return values
2734  *      rc non-zero error
2735  *	rc zero success
2736  */
2737 int
2738 smb_spool_add_doc(smb_tree_t *tree, smb_kspooldoc_t *sp)
2739 {
2740 	smb_llist_t	*splist;
2741 	smb_server_t	*sv = tree->t_server;
2742 	int rc = 0;
2743 
2744 	splist = &sv->sp_info.sp_list;
2745 	smb_llist_enter(splist, RW_WRITER);
2746 	sp->sd_spool_num = atomic_inc_32_nv(&sv->sp_info.sp_cnt);
2747 	smb_llist_insert_tail(splist, sp);
2748 	smb_llist_exit(splist);
2749 
2750 	return (rc);
2751 }
2752 
2753 /*
2754  * smb_server_create_session
2755  */
2756 static void
2757 smb_server_create_session(smb_listener_daemon_t *ld, ksocket_t s_so)
2758 {
2759 	smb_server_t		*sv = ld->ld_sv;
2760 	smb_session_t		*session;
2761 	smb_llist_t		*sl;
2762 	taskqid_t		tqid;
2763 	clock_t			now;
2764 
2765 	session = smb_session_create(s_so, ld->ld_port, sv,
2766 	    ld->ld_family);
2767 
2768 	if (session == NULL) {
2769 		/* This should be rare (create sleeps) */
2770 		smb_soshutdown(s_so);
2771 		smb_sodestroy(s_so);
2772 		cmn_err(CE_WARN, "SMB Session: alloc failed");
2773 		return;
2774 	}
2775 
2776 	sl = &sv->sv_session_list;
2777 	smb_llist_enter(sl, RW_WRITER);
2778 	if (smb_llist_get_count(sl) >= sv->sv_cfg.skc_maxconnections) {
2779 		/*
2780 		 * New session not in sv_session_list, so we can just
2781 		 * delete it directly.
2782 		 */
2783 		smb_llist_exit(sl);
2784 		DTRACE_PROBE1(maxconn, smb_session_t *, session);
2785 		smb_soshutdown(session->sock);
2786 		smb_session_delete(session);
2787 		goto logmaxconn;
2788 	}
2789 	smb_llist_insert_tail(sl, session);
2790 	smb_llist_exit(sl);
2791 
2792 	/*
2793 	 * These taskq entries must run independently of one another,
2794 	 * so TQ_NOQUEUE.  TQ_SLEEP (==0) just for clarity.
2795 	 */
2796 	tqid = taskq_dispatch(sv->sv_receiver_pool,
2797 	    smb_server_receiver, session, TQ_NOQUEUE | TQ_SLEEP);
2798 	if (tqid != TASKQID_INVALID) {
2799 		/* Success */
2800 		return;
2801 	}
2802 
2803 	/*
2804 	 * Have: tqid == TASKQID_INVALID
2805 	 * We never entered smb_server_receiver()
2806 	 * so need to do its return cleanup
2807 	 */
2808 	DTRACE_PROBE1(maxconn, smb_session_t *, session);
2809 	smb_session_disconnect(session);
2810 	smb_session_logoff(session);
2811 	smb_server_destroy_session(session);
2812 
2813 logmaxconn:
2814 	/*
2815 	 * If we hit max_connections, log something so an admin
2816 	 * can find out why new connections are failing, but
2817 	 * log this no more than once a minute.
2818 	 */
2819 	now = ddi_get_lbolt();
2820 	if (now > ld->ld_quiet) {
2821 		ld->ld_quiet = now + SEC_TO_TICK(60);
2822 		cmn_err(CE_WARN, "SMB can't create session: "
2823 		    "Would exceed max_connections.");
2824 	}
2825 }
2826 
2827 static void
2828 smb_server_destroy_session(smb_session_t *session)
2829 {
2830 	smb_server_t *sv;
2831 	smb_llist_t *ll;
2832 	uint32_t count;
2833 
2834 	ASSERT(session->s_server != NULL);
2835 	sv = session->s_server;
2836 	ll = &sv->sv_session_list;
2837 
2838 	smb_llist_flush(&session->s_tree_list);
2839 	smb_llist_flush(&session->s_user_list);
2840 
2841 	smb_llist_enter(ll, RW_WRITER);
2842 	smb_llist_remove(ll, session);
2843 	count = ll->ll_count;
2844 	smb_llist_exit(ll);
2845 
2846 	/*
2847 	 * Normally, the session should have state SHUTDOWN here.
2848 	 * If the session has any ofiles remaining, eg. due to
2849 	 * forgotten ofile references or something, the state
2850 	 * will be _DISCONNECTED or _TERMINATED.  Keep such
2851 	 * sessions in the list of zombies (for debugging).
2852 	 */
2853 	if (session->s_state == SMB_SESSION_STATE_SHUTDOWN) {
2854 		smb_session_delete(session);
2855 	} else {
2856 		cmn_err(CE_NOTE, "!Leaked session: 0x%p", (void *)session);
2857 		DTRACE_PROBE1(new__zombie, smb_session_t *, session);
2858 		smb_llist_enter(&smb_server_session_zombies, RW_WRITER);
2859 		smb_llist_insert_head(&smb_server_session_zombies, session);
2860 		smb_llist_exit(&smb_server_session_zombies);
2861 	}
2862 
2863 	if (count == 0) {
2864 		/* See smb_server_shutdown */
2865 		cv_signal(&sv->sv_cv);
2866 	}
2867 }
2868