1 /*
   2  * CDDL HEADER START
   3  *
   4  * The contents of this file are subject to the terms of the
   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21 
  22 /*
  23  * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
  24  * Copyright 2016 Nexenta Systems, Inc.  All rights reserved.
  25  */
  26 
  27 /*
  28  * SMB requests.
  29  *
  30  * Request
  31  *   Header
  32  *      Magic           0xFF 'S' 'M' 'B'
  33  *      smb_com         a byte, the "first" command
  34  *      Error           a 4-byte union, ignored in a request
  35  *      smb_flg         a one byte set of eight flags
  36  *      smb_flg2        a two byte set of 16 flags
  37  *      .               twelve reserved bytes, have a role
  38  *                      in connectionless transports (IPX, UDP?)
  39  *      smb_tid         a 16-bit tree ID, a mount point sorta,
  40  *                      0xFFFF is this command does not have
  41  *                      or require a tree context
  42  *      smb_pid         a 16-bit process ID
  43  *      smb_uid         a 16-bit user ID, specific to this "session"
  44  *                      and mapped to a system (bona-fide) UID
  45  *      smb_mid         a 16-bit multiplex ID, used to differentiate
  46  *                      multiple simultaneous requests from the same
  47  *                      process (pid) (ref RPC "xid")
  48  *
  49  *   Chained (AndX) commands (0 or more)
  50  *      smb_wct         a byte, number of 16-bit words containing
  51  *                      command parameters, min 2 for chained command
  52  *      andx_com        a byte, the "next" command, 0xFF for none
  53  *      .               an unused byte
  54  *      andx_off        a 16-bit offset, byte displacement from &Magic
  55  *                      to the smb_wct field of the "next" command,
  56  *                      ignore if andx_com is 0xFF, s/b 0 if no next
  57  *      smb_vwv[]       0 or more 16-bit (sorta) parameters for
  58  *                      "this" command (i.e. smb_com if this is the
  59  *                      first parameters, or the andx_com of the just
  60  *                      previous block.
  61  *      smb_bcc         a 16-bit count of smb_data[] bytes
  62  *      smb_data[]      0 or more bytes, format specific to commands
  63  *      padding[]       Optional padding
  64  *
  65  *   Last command
  66  *      smb_wct         a byte, number of 16-bit words containing
  67  *                      command parameters, min 0 for chained command
  68  *      smb_vwv[]       0 or more 16-bit (sorta) parameters for
  69  *                      "this" command (i.e. smb_com if this is the
  70  *                      first parameters, or the andx_com of the just
  71  *                      previous block.
  72  *      smb_bcc         a 16-bit count of smb_data[] bytes
  73  *      smb_data[]      0 or more bytes, format specific to commands
  74  *
  75  * Reply
  76  *   Header
  77  *      Magic           0xFF 'S' 'M' 'B'
  78  *      smb_com         a byte, the "first" command, corresponds
  79  *                      to request
  80  *      Error           a 4-byte union, coding depends on dialect in use
  81  *                      for "DOS" errors
  82  *                              a byte for error class
  83  *                              an unused byte
  84  *                              a 16-bit word for error code
  85  *                      for "NT" errors
  86  *                              a 32-bit error code which
  87  *                              is a packed class and specifier
  88  *                      for "OS/2" errors
  89  *                              I don't know
  90  *                      The error information is specific to the
  91  *                      last command in the reply chain.
  92  *      smb_flg         a one byte set of eight flags, 0x80 bit set
  93  *                      indicating this message is a reply
  94  *      smb_flg2        a two byte set of 16 flags
  95  *      .               twelve reserved bytes, have a role
  96  *                      in connectionless transports (IPX, UDP?)
  97  *      smb_tid         a 16-bit tree ID, a mount point sorta,
  98  *                      should be the same as the request
  99  *      smb_pid         a 16-bit process ID, MUST BE the same as request
 100  *      smb_uid         a 16-bit user ID, specific to this "session"
 101  *                      and mapped to a system (bona-fide) UID,
 102  *                      should be the same as request
 103  *      smb_mid         a 16-bit multiplex ID, used to differentiate
 104  *                      multiple simultaneous requests from the same
 105  *                      process (pid) (ref RPC "xid"), MUST BE the
 106  *                      same as request
 107  *      padding[]       Optional padding
 108  *
 109  *   Chained (AndX) commands (0 or more)
 110  *      smb_wct         a byte, number of 16-bit words containing
 111  *                      command parameters, min 2 for chained command,
 112  *      andx_com        a byte, the "next" command, 0xFF for none,
 113  *                      corresponds to request, if this is the chained
 114  *                      command that had an error set to 0xFF
 115  *      .               an unused byte
 116  *      andx_off        a 16-bit offset, byte displacement from &Magic
 117  *                      to the smb_wct field of the "next" command,
 118  *                      ignore if andx_com is 0xFF, s/b 0 if no next
 119  *      smb_vwv[]       0 or more 16-bit (sorta) parameters for
 120  *                      "this" command (i.e. smb_com if this is the
 121  *                      first parameters, or the andx_com of the just
 122  *                      previous block. Empty if an error.
 123  *      smb_bcc         a 16-bit count of smb_data[] bytes
 124  *      smb_data[]      0 or more bytes, format specific to commands
 125  *                      empty if an error.
 126  *
 127  *   Last command
 128  *      smb_wct         a byte, number of 16-bit words containing
 129  *                      command parameters, min 0 for chained command
 130  *      smb_vwv[]       0 or more 16-bit (sorta) parameters for
 131  *                      "this" command (i.e. smb_com if this is the
 132  *                      first parameters, or the andx_com of the just
 133  *                      previous block, empty if an error.
 134  *      smb_bcc         a 16-bit count of smb_data[] bytes
 135  *      smb_data[]      0 or more bytes, format specific to commands,
 136  *                      empty if an error.
 137  */
 138 
 139 #include <smbsrv/smb_kproto.h>
 140 #include <smbsrv/smb_kstat.h>
 141 #include <sys/sdt.h>
 142 #include <sys/spl.h>
 143 
 144 static int is_andx_com(unsigned char);
 145 static int smbsr_check_result(struct smb_request *, int, int);
 146 static void smb1_tq_work(void *);
 147 
 148 static const smb_disp_entry_t const
 149 smb_disp_table[SMB_COM_NUM] = {
 150         { "SmbCreateDirectory", SMB_SDT_OPS(create_directory),  /* 0x00 000 */
 151             0x00, PC_NETWORK_PROGRAM_1_0 },
 152         { "SmbDeleteDirectory", SMB_SDT_OPS(delete_directory),  /* 0x01 001 */
 153             0x01, PC_NETWORK_PROGRAM_1_0 },
 154         { "SmbOpen", SMB_SDT_OPS(open),                         /* 0x02 002 */
 155             0x02, PC_NETWORK_PROGRAM_1_0 },
 156         { "SmbCreate", SMB_SDT_OPS(create),                     /* 0x03 003 */
 157             0x03, PC_NETWORK_PROGRAM_1_0 },
 158         { "SmbClose", SMB_SDT_OPS(close),                       /* 0x04 004 */
 159             0x04, PC_NETWORK_PROGRAM_1_0 },
 160         { "SmbFlush", SMB_SDT_OPS(flush),                       /* 0x05 005 */
 161             0x05, PC_NETWORK_PROGRAM_1_0 },
 162         { "SmbDelete", SMB_SDT_OPS(delete),                     /* 0x06 006 */
 163             0x06, PC_NETWORK_PROGRAM_1_0 },
 164         { "SmbRename", SMB_SDT_OPS(rename),                     /* 0x07 007 */
 165             0x07, PC_NETWORK_PROGRAM_1_0 },
 166         { "SmbQueryInformation", SMB_SDT_OPS(query_information), /* 0x08 008 */
 167             0x08, PC_NETWORK_PROGRAM_1_0 },
 168         { "SmbSetInformation", SMB_SDT_OPS(set_information),    /* 0x09 009 */
 169             0x09, PC_NETWORK_PROGRAM_1_0 },
 170         { "SmbRead", SMB_SDT_OPS(read),                         /* 0x0A 010 */
 171             0x0A, PC_NETWORK_PROGRAM_1_0, SDDF_READOP },
 172         { "SmbWrite", SMB_SDT_OPS(write),                       /* 0x0B 011 */
 173             0x0B, PC_NETWORK_PROGRAM_1_0, SDDF_WRITEOP },
 174         { "SmbLockByteRange", SMB_SDT_OPS(lock_byte_range),     /* 0x0C 012 */
 175             0x0C, PC_NETWORK_PROGRAM_1_0 },
 176         { "SmbUnlockByteRange", SMB_SDT_OPS(unlock_byte_range), /* 0x0D 013 */
 177             0x0D, PC_NETWORK_PROGRAM_1_0 },
 178         { "SmbCreateTemporary", SMB_SDT_OPS(create_temporary),  /* 0x0E 014 */
 179             0x0E, PC_NETWORK_PROGRAM_1_0 },
 180         { "SmbCreateNew", SMB_SDT_OPS(create_new),              /* 0x0F 015 */
 181             0x0F, PC_NETWORK_PROGRAM_1_0 },
 182         { "SmbCheckDirectory", SMB_SDT_OPS(check_directory),    /* 0x10 016 */
 183             0x10, PC_NETWORK_PROGRAM_1_0 },
 184         { "SmbProcessExit", SMB_SDT_OPS(process_exit),          /* 0x11 017 */
 185             0x11, PC_NETWORK_PROGRAM_1_0,
 186             SDDF_SUPPRESS_TID | SDDF_SUPPRESS_UID },
 187         { "SmbSeek", SMB_SDT_OPS(seek),                         /* 0x12 018 */
 188             0x12, PC_NETWORK_PROGRAM_1_0 },
 189         { "SmbLockAndRead", SMB_SDT_OPS(lock_and_read),         /* 0x13 019 */
 190             0x13, LANMAN1_0, SDDF_READOP},
 191         { "SmbWriteAndUnlock", SMB_SDT_OPS(write_and_unlock),   /* 0x14 020 */
 192             0x14, LANMAN1_0, SDDF_WRITEOP },
 193         { "Invalid", SMB_SDT_OPS(invalid), 0x15, 0 },           /* 0x15 021 */
 194         { "Invalid", SMB_SDT_OPS(invalid), 0x16, 0 },           /* 0x16 022 */
 195         { "Invalid", SMB_SDT_OPS(invalid), 0x17, 0 },           /* 0x17 023 */
 196         { "Invalid", SMB_SDT_OPS(invalid), 0x18, 0 },           /* 0x18 024 */
 197         { "Invalid", SMB_SDT_OPS(invalid), 0x19, 0 },           /* 0x19 025 */
 198         { "SmbReadRaw", SMB_SDT_OPS(invalid), 0x1A, 0 },        /* 0x1A 026 */
 199         { "Invalid", SMB_SDT_OPS(invalid), 0x1B, 0 },           /* 0x1B 027 */
 200         { "Invalid", SMB_SDT_OPS(invalid), 0x1C, 0 },           /* 0x1C 028 */
 201         { "SmbWriteRaw", SMB_SDT_OPS(invalid), 0x1D, 0 },       /* 0x1D 029 */
 202         { "Invalid", SMB_SDT_OPS(invalid), 0x1E, 0 },           /* 0x1E 030 */
 203         { "Invalid", SMB_SDT_OPS(invalid), 0x1F, 0 },           /* 0x1F 031 */
 204         { "Invalid", SMB_SDT_OPS(invalid), 0x20, 0 },           /* 0x20 032 */
 205         { "Invalid", SMB_SDT_OPS(invalid), 0x21, 0 },           /* 0x21 033 */
 206         { "SmbSetInformation2", SMB_SDT_OPS(set_information2),  /* 0x22 034 */
 207             0x22, LANMAN1_0 },
 208         { "SmbQueryInformation2",
 209             SMB_SDT_OPS(query_information2),                    /* 0x23 035 */
 210             0x23, LANMAN1_0 },
 211         { "SmbLockingX", SMB_SDT_OPS(locking_andx),             /* 0x24 036 */
 212             0x24, LANMAN1_0 },
 213         { "SmbTransaction", SMB_SDT_OPS(transaction),           /* 0x25 037 */
 214             0x25, LANMAN1_0 },
 215         { "SmbTransactionSecondary",
 216             SMB_SDT_OPS(transaction_secondary),                 /* 0x26 038 */
 217             0x26, LANMAN1_0 },
 218         { "SmbIoctl", SMB_SDT_OPS(ioctl),                       /* 0x27 039 */
 219             0x27, LANMAN1_0 },
 220         { "Invalid", SMB_SDT_OPS(invalid), 0x28, 0 },   /* 0x28 040 */
 221         { "Invalid", SMB_SDT_OPS(invalid), 0x29, 0 },   /* 0x29 041 */
 222         { "Invalid", SMB_SDT_OPS(invalid), 0x2A, 0 },   /* 0x2A 042 */
 223         { "SmbEcho", SMB_SDT_OPS(echo),                         /* 0x2B 043 */
 224             0x2B, LANMAN1_0, SDDF_SUPPRESS_TID | SDDF_SUPPRESS_UID },
 225         { "SmbWriteAndClose", SMB_SDT_OPS(write_and_close),     /* 0x2C 044 */
 226             0x2C, LANMAN1_0, SDDF_WRITEOP },
 227         { "SmbOpenX", SMB_SDT_OPS(open_andx),                   /* 0x2D 045 */
 228             0x2D, LANMAN1_0 },
 229         { "SmbReadX", SMB_SDT_OPS(read_andx),                   /* 0x2E 046 */
 230             0x2E, LANMAN1_0, SDDF_READOP },
 231         { "SmbWriteX", SMB_SDT_OPS(write_andx),                 /* 0x2F 047 */
 232             0x2F, LANMAN1_0, SDDF_WRITEOP },
 233         { "Invalid", SMB_SDT_OPS(invalid), 0x30, 0 },   /* 0x30 048 */
 234         { "SmbCloseAndTreeDisconnect",
 235             SMB_SDT_OPS(close_and_tree_disconnect),             /* 0x31 049 */
 236             0x31, LANMAN1_0 },
 237         { "SmbTransaction2", SMB_SDT_OPS(transaction2),         /* 0x32 050 */
 238             0x32, LM1_2X002 },
 239         { "SmbTransaction2Secondary",
 240             SMB_SDT_OPS(transaction2_secondary),                /* 0x33 051 */
 241             0x33, LM1_2X002 },
 242         { "SmbFindClose2", SMB_SDT_OPS(find_close2),            /* 0x34 052 */
 243             0x34, LM1_2X002 },
 244         { "Invalid", SMB_SDT_OPS(invalid), 0x35, 0 },   /* 0x35 053 */
 245         { "Invalid", SMB_SDT_OPS(invalid), 0x36, 0 },   /* 0x36 054 */
 246         { "Invalid", SMB_SDT_OPS(invalid), 0x37, 0 },   /* 0x37 055 */
 247         { "Invalid", SMB_SDT_OPS(invalid), 0x38, 0 },   /* 0x38 056 */
 248         { "Invalid", SMB_SDT_OPS(invalid), 0x39, 0 },   /* 0x39 057 */
 249         { "Invalid", SMB_SDT_OPS(invalid), 0x3A, 0 },   /* 0x3A 058 */
 250         { "Invalid", SMB_SDT_OPS(invalid), 0x3B, 0 },   /* 0x3B 059 */
 251         { "Invalid", SMB_SDT_OPS(invalid), 0x3C, 0 },   /* 0x3C 060 */
 252         { "Invalid", SMB_SDT_OPS(invalid), 0x3D, 0 },   /* 0x3D 061 */
 253         { "Invalid", SMB_SDT_OPS(invalid), 0x3E, 0 },   /* 0x3E 062 */
 254         { "Invalid", SMB_SDT_OPS(invalid), 0x3F, 0 },   /* 0x3F 063 */
 255         { "Invalid", SMB_SDT_OPS(invalid), 0x40, 0 },   /* 0x40 064 */
 256         { "Invalid", SMB_SDT_OPS(invalid), 0x47, 0 },   /* 0x47 065 */
 257         { "Invalid", SMB_SDT_OPS(invalid), 0x48, 0 },   /* 0x48 066 */
 258         { "Invalid", SMB_SDT_OPS(invalid), 0x49, 0 },   /* 0x49 067 */
 259         { "Invalid", SMB_SDT_OPS(invalid), 0x44, 0 },   /* 0x44 068 */
 260         { "Invalid", SMB_SDT_OPS(invalid), 0x45, 0 },   /* 0x45 069 */
 261         { "Invalid", SMB_SDT_OPS(invalid), 0x46, 0 },   /* 0x46 070 */
 262         { "Invalid", SMB_SDT_OPS(invalid), 0x47, 0 },   /* 0x47 071 */
 263         { "Invalid", SMB_SDT_OPS(invalid), 0x48, 0 },   /* 0x48 072 */
 264         { "Invalid", SMB_SDT_OPS(invalid), 0x49, 0 },   /* 0x49 073 */
 265         { "Invalid", SMB_SDT_OPS(invalid), 0x4A, 0 },   /* 0x4A 074 */
 266         { "Invalid", SMB_SDT_OPS(invalid), 0x4B, 0 },   /* 0x4B 075 */
 267         { "Invalid", SMB_SDT_OPS(invalid), 0x4C, 0 },   /* 0x4C 076 */
 268         { "Invalid", SMB_SDT_OPS(invalid), 0x4D, 0 },   /* 0x4D 077 */
 269         { "Invalid", SMB_SDT_OPS(invalid), 0x4E, 0 },   /* 0x4E 078 */
 270         { "Invalid", SMB_SDT_OPS(invalid), 0x4F, 0 },   /* 0x4F 079 */
 271         { "Invalid", SMB_SDT_OPS(invalid), 0x50, 0 },   /* 0x50 080 */
 272         { "Invalid", SMB_SDT_OPS(invalid), 0x51, 0 },   /* 0x51 081 */
 273         { "Invalid", SMB_SDT_OPS(invalid), 0x52, 0 },   /* 0x52 082 */
 274         { "Invalid", SMB_SDT_OPS(invalid), 0x53, 0 },   /* 0x53 083 */
 275         { "Invalid", SMB_SDT_OPS(invalid), 0x54, 0 },   /* 0x54 084 */
 276         { "Invalid", SMB_SDT_OPS(invalid), 0x55, 0 },   /* 0x55 085 */
 277         { "Invalid", SMB_SDT_OPS(invalid), 0x56, 0 },   /* 0x56 086 */
 278         { "Invalid", SMB_SDT_OPS(invalid), 0x57, 0 },   /* 0x57 087 */
 279         { "Invalid", SMB_SDT_OPS(invalid), 0x58, 0 },   /* 0x58 088 */
 280         { "Invalid", SMB_SDT_OPS(invalid), 0x59, 0 },   /* 0x59 089 */
 281         { "Invalid", SMB_SDT_OPS(invalid), 0x5A, 0 },   /* 0x5A 090 */
 282         { "Invalid", SMB_SDT_OPS(invalid), 0x5B, 0 },   /* 0x5B 091 */
 283         { "Invalid", SMB_SDT_OPS(invalid), 0x5C, 0 },   /* 0x5C 092 */
 284         { "Invalid", SMB_SDT_OPS(invalid), 0x5D, 0 },   /* 0x5D 093 */
 285         { "Invalid", SMB_SDT_OPS(invalid), 0x5E, 0 },   /* 0x5E 094 */
 286         { "Invalid", SMB_SDT_OPS(invalid), 0x5F, 0 },   /* 0x5F 095 */
 287         { "Invalid", SMB_SDT_OPS(invalid), 0x60, 0 },   /* 0x60 096 */
 288         { "Invalid", SMB_SDT_OPS(invalid), 0x61, 0 },   /* 0x61 097 */
 289         { "Invalid", SMB_SDT_OPS(invalid), 0x62, 0 },   /* 0x62 098 */
 290         { "Invalid", SMB_SDT_OPS(invalid), 0x63, 0 },   /* 0x63 099 */
 291         { "Invalid", SMB_SDT_OPS(invalid), 0x64, 0 },   /* 0x64 100 */
 292         { "Invalid", SMB_SDT_OPS(invalid), 0x65, 0 },   /* 0x65 101 */
 293         { "Invalid", SMB_SDT_OPS(invalid), 0x66, 0 },   /* 0x66 102 */
 294         { "Invalid", SMB_SDT_OPS(invalid), 0x67, 0 },   /* 0x67 103 */
 295         { "Invalid", SMB_SDT_OPS(invalid), 0x68, 0 },   /* 0x68 104 */
 296         { "Invalid", SMB_SDT_OPS(invalid), 0x69, 0 },   /* 0x69 105 */
 297         { "Invalid", SMB_SDT_OPS(invalid), 0x6A, 0 },   /* 0x6A 106 */
 298         { "Invalid", SMB_SDT_OPS(invalid), 0x6B, 0 },   /* 0x6B 107 */
 299         { "Invalid", SMB_SDT_OPS(invalid), 0x6C, 0 },   /* 0x6C 108 */
 300         { "Invalid", SMB_SDT_OPS(invalid), 0x6D, 0 },   /* 0x6D 109 */
 301         { "Invalid", SMB_SDT_OPS(invalid), 0x6E, 0 },   /* 0x6E 110 */
 302         { "Invalid", SMB_SDT_OPS(invalid), 0x6F, 0 },   /* 0x6F 111 */
 303         { "SmbTreeConnect", SMB_SDT_OPS(tree_connect),          /* 0x70 112 */
 304             0x70, PC_NETWORK_PROGRAM_1_0, SDDF_SUPPRESS_TID },
 305         { "SmbTreeDisconnect", SMB_SDT_OPS(tree_disconnect),    /* 0x71 113 */
 306             0x71, PC_NETWORK_PROGRAM_1_0,
 307             SDDF_SUPPRESS_TID | SDDF_SUPPRESS_UID },
 308         /*
 309          * NB: Negotiate gets special handling via
 310          * smb_initial_request_handler.  After that,
 311          * another Negotiate is an invalid request.
 312          */
 313         { "SmbNegotiate", SMB_SDT_OPS(invalid),                 /* 0x72 114 */
 314             0x72, PC_NETWORK_PROGRAM_1_0,
 315             SDDF_SUPPRESS_TID | SDDF_SUPPRESS_UID },
 316         { "SmbSessionSetupX", SMB_SDT_OPS(session_setup_andx),  /* 0x73 115 */
 317             0x73, LANMAN1_0, SDDF_SUPPRESS_TID | SDDF_SUPPRESS_UID },
 318         { "SmbLogoffX", SMB_SDT_OPS(logoff_andx),               /* 0x74 116 */
 319             0x74, LM1_2X002, SDDF_SUPPRESS_TID },
 320         { "SmbTreeConnectX", SMB_SDT_OPS(tree_connect_andx),    /* 0x75 117 */
 321             0x75, LANMAN1_0, SDDF_SUPPRESS_TID },
 322         { "Invalid", SMB_SDT_OPS(invalid), 0x76, 0, 0 },        /* 0x76 118 */
 323         { "Invalid", SMB_SDT_OPS(invalid), 0x77, 0, 0 },        /* 0x77 119 */
 324         { "Invalid", SMB_SDT_OPS(invalid), 0x78, 0, 0 },        /* 0x78 120 */
 325         { "Invalid", SMB_SDT_OPS(invalid), 0x79, 0, 0 },        /* 0x79 121 */
 326         { "Invalid", SMB_SDT_OPS(invalid), 0x7A, 0, 0 },        /* 0x7A 122 */
 327         { "Invalid", SMB_SDT_OPS(invalid), 0x7B, 0, 0 },        /* 0x7B 123 */
 328         { "Invalid", SMB_SDT_OPS(invalid), 0x7C, 0, 0 },        /* 0x7C 124 */
 329         { "Invalid", SMB_SDT_OPS(invalid), 0x7D, 0, 0 },        /* 0x7D 125 */
 330         { "Invalid", SMB_SDT_OPS(invalid), 0x7E, 0, 0 },        /* 0x7E 126 */
 331         { "Invalid", SMB_SDT_OPS(invalid), 0x7F, 0, 0 },        /* 0x7F 127 */
 332         { "SmbQueryInformationDisk",
 333             SMB_SDT_OPS(query_information_disk),                /* 0x80 128 */
 334             0x80, PC_NETWORK_PROGRAM_1_0, 0 },
 335         { "SmbSearch", SMB_SDT_OPS(search),                     /* 0x81 129 */
 336             0x81, PC_NETWORK_PROGRAM_1_0, 0 },
 337         { "SmbFind", SMB_SDT_OPS(find),                         /* 0x82 130 */
 338             0x82, LANMAN1_0, 0 },
 339         { "SmbFindUnique", SMB_SDT_OPS(find_unique),            /* 0x83 131 */
 340             0x83, LANMAN1_0, 0 },
 341         { "SmbFindClose", SMB_SDT_OPS(find_close),              /* 0x84 132 */
 342             0x84, LANMAN1_0, 0 },
 343         { "Invalid", SMB_SDT_OPS(invalid), 0x85, 0, 0 },        /* 0x85 133 */
 344         { "Invalid", SMB_SDT_OPS(invalid), 0x86, 0, 0 },        /* 0x86 134 */
 345         { "Invalid", SMB_SDT_OPS(invalid), 0x87, 0, 0 },        /* 0x87 135 */
 346         { "Invalid", SMB_SDT_OPS(invalid), 0x88, 0, 0 },        /* 0x88 136 */
 347         { "Invalid", SMB_SDT_OPS(invalid), 0x89, 0, 0 },        /* 0x89 137 */
 348         { "Invalid", SMB_SDT_OPS(invalid), 0x8A, 0, 0 },        /* 0x8A 138 */
 349         { "Invalid", SMB_SDT_OPS(invalid), 0x8B, 0, 0 },        /* 0x8B 139 */
 350         { "Invalid", SMB_SDT_OPS(invalid), 0x8C, 0, 0 },        /* 0x8C 140 */
 351         { "Invalid", SMB_SDT_OPS(invalid), 0x8D, 0, 0 },        /* 0x8D 141 */
 352         { "Invalid", SMB_SDT_OPS(invalid), 0x8E, 0, 0 },        /* 0x8E 142 */
 353         { "Invalid", SMB_SDT_OPS(invalid), 0x8F, 0, 0 },        /* 0x8F 143 */
 354         { "Invalid", SMB_SDT_OPS(invalid), 0x90, 0, 0 },        /* 0x90 144 */
 355         { "Invalid", SMB_SDT_OPS(invalid), 0x91, 0, 0 },        /* 0x91 145 */
 356         { "Invalid", SMB_SDT_OPS(invalid), 0x92, 0, 0 },        /* 0x92 146 */
 357         { "Invalid", SMB_SDT_OPS(invalid), 0x93, 0, 0 },        /* 0x93 147 */
 358         { "Invalid", SMB_SDT_OPS(invalid), 0x94, 0, 0 },        /* 0x94 148 */
 359         { "Invalid", SMB_SDT_OPS(invalid), 0x95, 0, 0 },        /* 0x95 149 */
 360         { "Invalid", SMB_SDT_OPS(invalid), 0x96, 0, 0 },        /* 0x96 150 */
 361         { "Invalid", SMB_SDT_OPS(invalid), 0x97, 0, 0 },        /* 0x97 151 */
 362         { "Invalid", SMB_SDT_OPS(invalid), 0x98, 0, 0 },        /* 0x98 152 */
 363         { "Invalid", SMB_SDT_OPS(invalid), 0x99, 0, 0 },        /* 0x99 153 */
 364         { "Invalid", SMB_SDT_OPS(invalid), 0x9A, 0, 0 },        /* 0x9A 154 */
 365         { "Invalid", SMB_SDT_OPS(invalid), 0x9B, 0, 0 },        /* 0x9B 155 */
 366         { "Invalid", SMB_SDT_OPS(invalid), 0x9C, 0, 0 },        /* 0x9C 156 */
 367         { "Invalid", SMB_SDT_OPS(invalid), 0x9D, 0, 0 },        /* 0x9D 157 */
 368         { "Invalid", SMB_SDT_OPS(invalid), 0x9E, 0, 0 },        /* 0x9E 158 */
 369         { "Invalid", SMB_SDT_OPS(invalid), 0x9F, 0, 0 },        /* 0x9F 159 */
 370         { "SmbNtTransact", SMB_SDT_OPS(nt_transact),    /* 0xA0 160 */
 371             0xA0, NT_LM_0_12, 0 },
 372         { "SmbNtTransactSecondary",
 373             SMB_SDT_OPS(nt_transact_secondary),                 /* 0xA1 161 */
 374             0xA1, NT_LM_0_12, 0 },
 375         { "SmbNtCreateX", SMB_SDT_OPS(nt_create_andx),          /* 0xA2 162 */
 376             0xA2, NT_LM_0_12, 0 },
 377         { "Invalid", SMB_SDT_OPS(invalid), 0xA3, 0, 0 },        /* 0xA3 163 */
 378         { "SmbNtCancel", SMB_SDT_OPS(nt_cancel),                /* 0xA4 164 */
 379             0xA4, NT_LM_0_12, 0 },
 380         { "SmbNtRename", SMB_SDT_OPS(nt_rename),                /* 0xA5 165 */
 381             0xA5, NT_LM_0_12, 0 },
 382         { "Invalid", SMB_SDT_OPS(invalid), 0xA6, 0, 0 },        /* 0xA6 166 */
 383         { "Invalid", SMB_SDT_OPS(invalid), 0xA7, 0, 0 },        /* 0xA7 167 */
 384         { "Invalid", SMB_SDT_OPS(invalid), 0xA8, 0, 0 },        /* 0xA8 168 */
 385         { "Invalid", SMB_SDT_OPS(invalid), 0xA9, 0, 0 },        /* 0xA9 169 */
 386         { "Invalid", SMB_SDT_OPS(invalid), 0xAA, 0, 0 },        /* 0xAA 170 */
 387         { "Invalid", SMB_SDT_OPS(invalid), 0xAB, 0, 0 },        /* 0xAB 171 */
 388         { "Invalid", SMB_SDT_OPS(invalid), 0xAC, 0, 0 },        /* 0xAC 172 */
 389         { "Invalid", SMB_SDT_OPS(invalid), 0xAD, 0, 0 },        /* 0xAD 173 */
 390         { "Invalid", SMB_SDT_OPS(invalid), 0xAE, 0, 0 },        /* 0xAE 174 */
 391         { "Invalid", SMB_SDT_OPS(invalid), 0xAF, 0, 0 },        /* 0xAF 175 */
 392         { "Invalid", SMB_SDT_OPS(invalid), 0xB0, 0, 0 },        /* 0xB0 176 */
 393         { "Invalid", SMB_SDT_OPS(invalid), 0xB1, 0, 0 },        /* 0xB1 177 */
 394         { "Invalid", SMB_SDT_OPS(invalid), 0xB2, 0, 0 },        /* 0xB2 178 */
 395         { "Invalid", SMB_SDT_OPS(invalid), 0xB3, 0, 0 },        /* 0xB3 179 */
 396         { "Invalid", SMB_SDT_OPS(invalid), 0xB4, 0, 0 },        /* 0xB4 180 */
 397         { "Invalid", SMB_SDT_OPS(invalid), 0xB5, 0, 0 },        /* 0xB5 181 */
 398         { "Invalid", SMB_SDT_OPS(invalid), 0xB6, 0, 0 },        /* 0xB6 182 */
 399         { "Invalid", SMB_SDT_OPS(invalid), 0xB7, 0, 0 },        /* 0xB7 183 */
 400         { "Invalid", SMB_SDT_OPS(invalid), 0xB8, 0, 0 },        /* 0xB8 184 */
 401         { "Invalid", SMB_SDT_OPS(invalid), 0xB9, 0, 0 },        /* 0xB9 185 */
 402         { "Invalid", SMB_SDT_OPS(invalid), 0xBA, 0, 0 },        /* 0xBA 186 */
 403         { "Invalid", SMB_SDT_OPS(invalid), 0xBB, 0, 0 },        /* 0xBB 187 */
 404         { "Invalid", SMB_SDT_OPS(invalid), 0xBC, 0, 0 },        /* 0xBC 188 */
 405         { "Invalid", SMB_SDT_OPS(invalid), 0xBD, 0, 0 },        /* 0xBD 189 */
 406         { "Invalid", SMB_SDT_OPS(invalid), 0xBE, 0, 0 },        /* 0xBE 190 */
 407         { "Invalid", SMB_SDT_OPS(invalid), 0xBF, 0, 0 },        /* 0xBF 191 */
 408         { "SmbOpenPrintFile", SMB_SDT_OPS(open_print_file),     /* 0xC0 192 */
 409             0xC0, PC_NETWORK_PROGRAM_1_0, 0 },
 410         { "SmbWritePrintFile", SMB_SDT_OPS(write_print_file),   /* 0xC1 193 */
 411             0xC1, PC_NETWORK_PROGRAM_1_0, SDDF_WRITEOP },
 412         { "SmbClosePrintFile", SMB_SDT_OPS(close_print_file),   /* 0xC2 194 */
 413             0xC2, PC_NETWORK_PROGRAM_1_0, 0 },
 414         { "SmbGetPrintQueue", SMB_SDT_OPS(get_print_queue),     /* 0xC3 195 */
 415             0xC3, PC_NETWORK_PROGRAM_1_0, 0 },
 416         { "Invalid", SMB_SDT_OPS(invalid), 0xC4, 0, 0 },        /* 0xC4 196 */
 417         { "Invalid", SMB_SDT_OPS(invalid), 0xC5, 0, 0 },        /* 0xC5 197 */
 418         { "Invalid", SMB_SDT_OPS(invalid), 0xC6, 0, 0 },        /* 0xC6 198 */
 419         { "Invalid", SMB_SDT_OPS(invalid), 0xC7, 0, 0 },        /* 0xC7 199 */
 420         { "Invalid", SMB_SDT_OPS(invalid), 0xC8, 0, 0 },        /* 0xC8 200 */
 421         { "Invalid", SMB_SDT_OPS(invalid), 0xC9, 0, 0 },        /* 0xC9 201 */
 422         { "Invalid", SMB_SDT_OPS(invalid), 0xCA, 0, 0 },        /* 0xCA 202 */
 423         { "Invalid", SMB_SDT_OPS(invalid), 0xCB, 0, 0 },        /* 0xCB 203 */
 424         { "Invalid", SMB_SDT_OPS(invalid), 0xCC, 0, 0 },        /* 0xCC 204 */
 425         { "Invalid", SMB_SDT_OPS(invalid), 0xCD, 0, 0 },        /* 0xCD 205 */
 426         { "Invalid", SMB_SDT_OPS(invalid), 0xCE, 0, 0 },        /* 0xCE 206 */
 427         { "Invalid", SMB_SDT_OPS(invalid), 0xCF, 0, 0 },        /* 0xCF 207 */
 428         { "Invalid", SMB_SDT_OPS(invalid), 0xD0, 0, 0 },        /* 0xD0 208 */
 429         { "Invalid", SMB_SDT_OPS(invalid), 0xD1, 0, 0 },        /* 0xD1 209 */
 430         { "Invalid", SMB_SDT_OPS(invalid), 0xD2, 0, 0 },        /* 0xD2 210 */
 431         { "Invalid", SMB_SDT_OPS(invalid), 0xD3, 0, 0 },        /* 0xD3 211 */
 432         { "Invalid", SMB_SDT_OPS(invalid), 0xD4, 0, 0 },        /* 0xD4 212 */
 433         { "Invalid", SMB_SDT_OPS(invalid), 0xD5, 0, 0 },        /* 0xD5 213 */
 434         { "Invalid", SMB_SDT_OPS(invalid), 0xD6, 0, 0 },        /* 0xD6 214 */
 435         { "Invalid", SMB_SDT_OPS(invalid), 0xD7, 0, 0 },        /* 0xD7 215 */
 436         { "Invalid", SMB_SDT_OPS(invalid), 0xD8, 0, 0 },        /* 0xD8 216 */
 437         { "Invalid", SMB_SDT_OPS(invalid), 0xD9, 0, 0 },        /* 0xD9 217 */
 438         { "Invalid", SMB_SDT_OPS(invalid), 0xDA, 0, 0 },        /* 0xDA 218 */
 439         { "Invalid", SMB_SDT_OPS(invalid), 0xDB, 0, 0 },        /* 0xDB 219 */
 440         { "Invalid", SMB_SDT_OPS(invalid), 0xDC, 0, 0 },        /* 0xDC 220 */
 441         { "Invalid", SMB_SDT_OPS(invalid), 0xDD, 0, 0 },        /* 0xDD 221 */
 442         { "Invalid", SMB_SDT_OPS(invalid), 0xDE, 0, 0 },        /* 0xDE 222 */
 443         { "Invalid", SMB_SDT_OPS(invalid), 0xDF, 0, 0 },        /* 0xDF 223 */
 444         { "Invalid", SMB_SDT_OPS(invalid), 0xE0, 0, 0 },        /* 0xE0 224 */
 445         { "Invalid", SMB_SDT_OPS(invalid), 0xE1, 0, 0 },        /* 0xE1 225 */
 446         { "Invalid", SMB_SDT_OPS(invalid), 0xE2, 0, 0 },        /* 0xE2 226 */
 447         { "Invalid", SMB_SDT_OPS(invalid), 0xE3, 0, 0 },        /* 0xE3 227 */
 448         { "Invalid", SMB_SDT_OPS(invalid), 0xE4, 0, 0 },        /* 0xE4 228 */
 449         { "Invalid", SMB_SDT_OPS(invalid), 0xE5, 0, 0 },        /* 0xE5 229 */
 450         { "Invalid", SMB_SDT_OPS(invalid), 0xE6, 0, 0 },        /* 0xE6 230 */
 451         { "Invalid", SMB_SDT_OPS(invalid), 0xE7, 0, 0 },        /* 0xE7 231 */
 452         { "Invalid", SMB_SDT_OPS(invalid), 0xE8, 0, 0 },        /* 0xE8 232 */
 453         { "Invalid", SMB_SDT_OPS(invalid), 0xE9, 0, 0 },        /* 0xE9 233 */
 454         { "Invalid", SMB_SDT_OPS(invalid), 0xEA, 0, 0 },        /* 0xEA 234 */
 455         { "Invalid", SMB_SDT_OPS(invalid), 0xEB, 0, 0 },        /* 0xEB 235 */
 456         { "Invalid", SMB_SDT_OPS(invalid), 0xEC, 0, 0 },        /* 0xEC 236 */
 457         { "Invalid", SMB_SDT_OPS(invalid), 0xED, 0, 0 },        /* 0xED 237 */
 458         { "Invalid", SMB_SDT_OPS(invalid), 0xEE, 0, 0 },        /* 0xEE 238 */
 459         { "Invalid", SMB_SDT_OPS(invalid), 0xEF, 0, 0 },        /* 0xEF 239 */
 460         { "Invalid", SMB_SDT_OPS(invalid), 0xF0, 0, 0 },        /* 0xF0 240 */
 461         { "Invalid", SMB_SDT_OPS(invalid), 0xF1, 0, 0 },        /* 0xF1 241 */
 462         { "Invalid", SMB_SDT_OPS(invalid), 0xF2, 0, 0 },        /* 0xF2 242 */
 463         { "Invalid", SMB_SDT_OPS(invalid), 0xF3, 0, 0 },        /* 0xF3 243 */
 464         { "Invalid", SMB_SDT_OPS(invalid), 0xF4, 0, 0 },        /* 0xF4 244 */
 465         { "Invalid", SMB_SDT_OPS(invalid), 0xF5, 0, 0 },        /* 0xF5 245 */
 466         { "Invalid", SMB_SDT_OPS(invalid), 0xF6, 0, 0 },        /* 0xF6 246 */
 467         { "Invalid", SMB_SDT_OPS(invalid), 0xF7, 0, 0 },        /* 0xF7 247 */
 468         { "Invalid", SMB_SDT_OPS(invalid), 0xF8, 0, 0 },        /* 0xF8 248 */
 469         { "Invalid", SMB_SDT_OPS(invalid), 0xF9, 0, 0 },        /* 0xF9 249 */
 470         { "Invalid", SMB_SDT_OPS(invalid), 0xFA, 0, 0 },        /* 0xFA 250 */
 471         { "Invalid", SMB_SDT_OPS(invalid), 0xFB, 0, 0 },        /* 0xFB 251 */
 472         { "Invalid", SMB_SDT_OPS(invalid), 0xFC, 0, 0 },        /* 0xFC 252 */
 473         { "Invalid", SMB_SDT_OPS(invalid), 0xFD, 0, 0 },        /* 0xFD 253 */
 474         { "Invalid", SMB_SDT_OPS(invalid), 0xFE, 0, 0 },        /* 0xFE 254 */
 475         { "Invalid", SMB_SDT_OPS(invalid), 0xFF, 0, 0 } /* 0xFF 255 */
 476 };
 477 
 478 /*
 479  * smbsr_cleanup
 480  *
 481  * If any user/tree/file is used by given request then
 482  * the reference count for that resource has been incremented.
 483  * This function decrements the reference count and close
 484  * the resource if it's needed.
 485  */
 486 
 487 void
 488 smbsr_cleanup(smb_request_t *sr)
 489 {
 490         ASSERT((sr->sr_state != SMB_REQ_STATE_CLEANED_UP) &&
 491             (sr->sr_state != SMB_REQ_STATE_COMPLETED));
 492 
 493         if (sr->r_xa) {
 494                 if (sr->r_xa->xa_flags & SMB_XA_FLAG_COMPLETE)
 495                         smb_xa_close(sr->r_xa);
 496                 smb_xa_rele(sr->session, sr->r_xa);
 497                 sr->r_xa = NULL;
 498         }
 499 
 500         /*
 501          * Mark this request so we know that we've already cleaned it up.
 502          * A request should only get cleaned up once so multiple calls to
 503          * smbsr_cleanup for the same request indicate a bug.
 504          */
 505         mutex_enter(&sr->sr_mutex);
 506         if (sr->sr_state != SMB_REQ_STATE_CANCELLED)
 507                 sr->sr_state = SMB_REQ_STATE_CLEANED_UP;
 508         mutex_exit(&sr->sr_mutex);
 509 }
 510 
 511 int smb_cancel_in_reader = 1;
 512 
 513 /*
 514  * This is the SMB1 handler for new smb requests, called from
 515  * smb_session_reader after SMB negotiate is done.  For most SMB
 516  * requests, we just enqueue them for the smb_session_worker to
 517  * execute via the task queue, so they can block for resources
 518  * without stopping the reader thread.  A few protocol messages
 519  * are special cases and are handled directly here in the reader
 520  * thread so they don't wait for taskq scheduling.  Later, a few
 521  * MORE things could be handled here, such as REPLY messages
 522  * (oplock break reply) and things like "NT_cancel".
 523  *
 524  * This function must either enqueue the new request for
 525  * execution via the task queue, or execute it directly
 526  * and then free it.  If this returns non-zero, the caller
 527  * will drop the session.
 528  */
 529 int
 530 smb1sr_newrq(smb_request_t *sr)
 531 {
 532         uint16_t pid_hi, pid_lo;
 533         int rc, save_offset;
 534 
 535         /*
 536          * Decode the SMB header now (peek) so that
 537          * SMB_COM_NT_CANCEL can find this SR.
 538          */
 539         save_offset = sr->command.chain_offset;
 540         rc = smb_mbc_decodef(&sr->command, SMB_HEADER_ED_FMT,
 541             &sr->smb_com,
 542             &sr->smb_rcls,
 543             &sr->smb_reh,
 544             &sr->smb_err,
 545             &sr->smb_flg,
 546             &sr->smb_flg2,
 547             &pid_hi,
 548             sr->smb_sig,
 549             &sr->smb_tid,
 550             &pid_lo,
 551             &sr->smb_uid,
 552             &sr->smb_mid);
 553         sr->command.chain_offset = save_offset;
 554         if (rc != 0) {
 555                 /* Failed decoding the header. Drop 'em. */
 556                 smb_request_free(sr);
 557                 return (EPROTO);
 558         }
 559         sr->smb_pid = (pid_hi << 16) | pid_lo;
 560 
 561         if (sr->smb_com == SMB_COM_NT_CANCEL) {
 562                 if (sr->session->signing.flags & SMB_SIGNING_ENABLED) {
 563                         sr->session->signing.seqnum++;
 564                         sr->sr_seqnum = sr->session->signing.seqnum + 1;
 565                         sr->reply_seqnum = 0;
 566                 }
 567 
 568                 /*
 569                  * Normally execute cancel requests immediately,
 570                  * (here in the reader thread) so they won't wait
 571                  * for other commands already in the task queue.
 572                  * Disable this via smb_cancel_in_reader=0 for
 573                  * testing or diagnostic efforts, in which case
 574                  * cancel runs via taskq_dispatch.
 575                  */
 576                 if (smb_cancel_in_reader != 0) {
 577                         rc = smb1sr_newrq_cancel(sr);
 578                         smb_request_free(sr);
 579                         return (rc);
 580                 }
 581         } else {
 582                 /* not NT cancel */
 583                 if (sr->session->signing.flags & SMB_SIGNING_ENABLED) {
 584                         sr->session->signing.seqnum += 2;
 585                         sr->sr_seqnum = sr->session->signing.seqnum;
 586                         sr->reply_seqnum = sr->sr_seqnum + 1;
 587                 }
 588         }
 589 
 590         /*
 591          * Submit the request to the task queue, which calls
 592          * smb1_tq_work when the workload permits.
 593          */
 594         sr->sr_time_submitted = gethrtime();
 595         sr->sr_state = SMB_REQ_STATE_SUBMITTED;
 596         smb_srqueue_waitq_enter(sr->session->s_srqueue);
 597         (void) taskq_dispatch(sr->sr_server->sv_worker_pool,
 598             smb1_tq_work, sr, TQ_SLEEP);
 599 
 600         return (0);
 601 }
 602 
 603 static void
 604 smb1_tq_work(void *arg)
 605 {
 606         smb_request_t   *sr;
 607         smb_srqueue_t   *srq;
 608 
 609         sr = (smb_request_t *)arg;
 610         SMB_REQ_VALID(sr);
 611 
 612         srq = sr->session->s_srqueue;
 613         smb_srqueue_waitq_to_runq(srq);
 614         sr->sr_worker = curthread;
 615         sr->sr_time_active = gethrtime();
 616 
 617         /*
 618          * Always dispatch to the work function, because cancelled
 619          * requests need an error reply (NT_STATUS_CANCELLED).
 620          */
 621         mutex_enter(&sr->sr_mutex);
 622         if (sr->sr_state == SMB_REQ_STATE_SUBMITTED)
 623                 sr->sr_state = SMB_REQ_STATE_ACTIVE;
 624         mutex_exit(&sr->sr_mutex);
 625 
 626         smb1sr_work(sr);
 627 
 628         smb_srqueue_runq_exit(srq);
 629 }
 630 
 631 /*
 632  * smb1sr_work
 633  *
 634  * In most cases, this should free the request before return.
 635  * Exceptions are when a dispatch function returns SDRC_SR_KEPT.
 636  */
 637 void
 638 smb1sr_work(struct smb_request *sr)
 639 {
 640         smb_sdrc_t              sdrc;
 641         const smb_disp_entry_t  *sdd;
 642         smb_disp_stats_t        *sds;
 643         boolean_t               disconnect = B_FALSE;
 644         smb_session_t           *session;
 645         smb_server_t            *server;
 646         int32_t                 txbase;
 647         uint32_t                rxbytes;
 648         uint32_t                byte_count;
 649         uint32_t                max_bytes;
 650         uint16_t                pid_hi, pid_lo;
 651 
 652         session = sr->session;
 653         server = session->s_server;
 654 
 655         ASSERT(sr->tid_tree == 0);
 656         ASSERT(sr->uid_user == 0);
 657         ASSERT(sr->fid_ofile == 0);
 658         sr->smb_fid = (uint16_t)-1;
 659 
 660         /* temporary until we identify a user */
 661         sr->user_cr = zone_kcred();
 662         sr->orig_request_hdr = sr->command.chain_offset;
 663 
 664         /*
 665          * Decode the SMB header.
 666          */
 667         if (smb_mbc_decodef(&sr->command, SMB_HEADER_ED_FMT,
 668             &sr->smb_com,
 669             &sr->smb_rcls,
 670             &sr->smb_reh,
 671             &sr->smb_err,
 672             &sr->smb_flg,
 673             &sr->smb_flg2,
 674             &pid_hi,
 675             sr->smb_sig,
 676             &sr->smb_tid,
 677             &pid_lo,
 678             &sr->smb_uid,
 679             &sr->smb_mid) != 0) {
 680                 disconnect = B_TRUE;
 681                 goto drop_connection;
 682         }
 683         sr->smb_pid = (pid_hi << 16) | pid_lo;
 684 
 685         /*
 686          * The reply "header" is filled in now even though it will,
 687          * most likely, be rewritten under reply_ready below.  We
 688          * could reserve the space but this is convenient in case
 689          * the dialect dispatcher has to send a special reply (like
 690          * TRANSACT).
 691          *
 692          * Ensure that the 32-bit error code flag is turned off.
 693          * Clients seem to set it in transact requests and they may
 694          * get confused if we return success or a 16-bit SMB code.
 695          */
 696         sr->smb_rcls = 0;
 697         sr->smb_reh = 0;
 698         sr->smb_err = 0;
 699         sr->smb_flg2 &= ~SMB_FLAGS2_NT_STATUS;
 700 
 701         (void) smb_mbc_encodef(&sr->reply, SMB_HEADER_ED_FMT,
 702             sr->smb_com,
 703             sr->smb_rcls,
 704             sr->smb_reh,
 705             sr->smb_err,
 706             sr->smb_flg,
 707             sr->smb_flg2,
 708             pid_hi,
 709             sr->smb_sig,
 710             sr->smb_tid,
 711             pid_lo,
 712             sr->smb_uid,
 713             sr->smb_mid);
 714         sr->first_smb_com = sr->smb_com;
 715 
 716         if ((session->signing.flags & SMB_SIGNING_CHECK) != 0) {
 717                 if ((sr->smb_flg2 & SMB_FLAGS2_SMB_SECURITY_SIGNATURE) == 0 ||
 718                     smb_sign_check_request(sr) != 0) {
 719                         smbsr_error(sr, NT_STATUS_ACCESS_DENIED,
 720                             ERRDOS, ERROR_ACCESS_DENIED);
 721                         disconnect = B_TRUE;
 722                         goto report_error;
 723                 }
 724         }
 725 
 726 andx_more:
 727         sdd = &smb_disp_table[sr->smb_com];
 728         ASSERT(sdd->sdt_function);
 729         sds = &server->sv_disp_stats1[sr->smb_com];
 730 
 731         if (smb_mbc_decodef(&sr->command, "b", &sr->smb_wct) != 0) {
 732                 disconnect = B_TRUE;
 733                 goto report_error;
 734         }
 735 
 736         (void) MBC_SHADOW_CHAIN(&sr->smb_vwv, &sr->command,
 737             sr->command.chain_offset, sr->smb_wct * 2);
 738 
 739         if (smb_mbc_decodef(&sr->command, "#.w", sr->smb_wct*2, &sr->smb_bcc)) {
 740                 disconnect = B_TRUE;
 741                 goto report_error;
 742         }
 743 
 744         /*
 745          * Ignore smb_bcc if CAP_LARGE_READX/CAP_LARGE_WRITEX
 746          * and this is SmbReadX/SmbWriteX since this enables
 747          * large reads/write and bcc is only 16-bits.
 748          */
 749         max_bytes = sr->command.max_bytes - sr->command.chain_offset;
 750         if (sr->smb_com == SMB_COM_WRITE_ANDX) {
 751                 /* Allow > BCC */
 752                 byte_count = max_bytes;
 753         } else if (max_bytes < (uint32_t)sr->smb_bcc) {
 754                 /* BCC is bogus.  Will fail later. */
 755                 byte_count = max_bytes;
 756         } else {
 757                 /* ordinary case */
 758                 byte_count = (uint32_t)sr->smb_bcc;
 759         }
 760 
 761         /* Save these for kstat updates below. */
 762         rxbytes = byte_count + 1 + 2 * sr->smb_wct;
 763         txbase = sr->reply.chain_offset;
 764 
 765         (void) MBC_SHADOW_CHAIN(&sr->smb_data, &sr->command,
 766             sr->command.chain_offset, byte_count);
 767 
 768         sr->command.chain_offset += byte_count;
 769         if (sr->command.chain_offset > sr->command.max_bytes) {
 770                 disconnect = B_TRUE;
 771                 goto report_error;
 772         }
 773 
 774         /* Store pointers for later */
 775         sr->cur_reply_offset = sr->reply.chain_offset;
 776 
 777         if (is_andx_com(sr->smb_com)) {
 778                 /* Peek ahead and don't disturb vwv */
 779                 if (smb_mbc_peek(&sr->smb_vwv, sr->smb_vwv.chain_offset, "b.w",
 780                     &sr->andx_com, &sr->andx_off) < 0) {
 781                         disconnect = B_TRUE;
 782                         goto report_error;
 783                 }
 784         } else {
 785                 sr->andx_com = (unsigned char)-1;
 786         }
 787 
 788         mutex_enter(&sr->sr_mutex);
 789         switch (sr->sr_state) {
 790         case SMB_REQ_STATE_ACTIVE:
 791                 break;
 792         case SMB_REQ_STATE_CLEANED_UP:
 793                 sr->sr_state = SMB_REQ_STATE_ACTIVE;
 794                 break;
 795         case SMB_REQ_STATE_CANCELLED:
 796                 /*
 797                  * Keep cancelled.  Handlers that might block will
 798                  * check the state and return NT_STATUS_CANCELLED.
 799                  */
 800                 break;
 801         default:
 802                 ASSERT(0);
 803                 break;
 804         }
 805         mutex_exit(&sr->sr_mutex);
 806 
 807         /*
 808          * Setup UID and TID information (if required). Both functions
 809          * will set the sr credentials. In domain mode, the user and
 810          * tree credentials should be the same. In share mode, the
 811          * tree credentials (defined in the share definition) should
 812          * override the user credentials.
 813          */
 814         if (!(sdd->sdt_flags & SDDF_SUPPRESS_UID) && (sr->uid_user == NULL)) {
 815                 sr->uid_user = smb_session_lookup_uid(session, sr->smb_uid);
 816                 if (sr->uid_user == NULL) {
 817                         smbsr_error(sr, 0, ERRSRV, ERRbaduid);
 818                         smbsr_cleanup(sr);
 819                         goto report_error;
 820                 }
 821 
 822                 sr->user_cr = smb_user_getcred(sr->uid_user);
 823         }
 824         if (!(sdd->sdt_flags & SDDF_SUPPRESS_TID) && (sr->tid_tree == NULL)) {
 825                 sr->tid_tree = smb_session_lookup_tree(session, sr->smb_tid);
 826                 if (sr->tid_tree == NULL) {
 827                         smbsr_error(sr, 0, ERRSRV, ERRinvnid);
 828                         smbsr_cleanup(sr);
 829                         goto report_error;
 830                 }
 831         }
 832 
 833         sr->sr_time_start = gethrtime();
 834         if ((sdrc = (*sdd->sdt_pre_op)(sr)) == SDRC_SUCCESS)
 835                 sdrc = (*sdd->sdt_function)(sr);
 836 
 837         if (sdrc != SDRC_SR_KEPT) {
 838                 (*sdd->sdt_post_op)(sr);
 839                 smbsr_cleanup(sr);
 840         }
 841 
 842         /* Record latency and rx/tx bytes per:  server, session, share. */
 843         {
 844                 hrtime_t        dt;
 845                 int64_t         rxb, txb;
 846                 smb_disp_stats_t        *client_sds;    /* session */
 847                 smb_disp_stats_t        *share_sds;  /* kshare */
 848                 int     cmd_type;
 849 
 850                 if (sdd->sdt_flags & SDDF_READOP) {
 851                         cmd_type = SMBSRV_CLSH_READ;
 852                 } else if (sdd->sdt_flags & SDDF_WRITEOP) {
 853                         cmd_type = SMBSRV_CLSH_WRITE;
 854                 } else {
 855                         cmd_type = SMBSRV_CLSH_OTHER;
 856                 }
 857 
 858                 dt = gethrtime() - sr->sr_time_start;
 859                 rxb = (int64_t)rxbytes;
 860                 txb = (int64_t)(sr->reply.chain_offset - txbase);
 861 
 862                 smb_latency_add_sample(&sds->sdt_lat, dt);
 863                 atomic_add_64(&sds->sdt_rxb, rxb);
 864                 atomic_add_64(&sds->sdt_txb, txb);
 865 
 866                 client_sds = &session->s_stats[cmd_type];
 867                 smb_latency_add_sample(&client_sds->sdt_lat, dt);
 868                 atomic_add_64(&client_sds->sdt_rxb, rxb);
 869                 atomic_add_64(&client_sds->sdt_txb, txb);
 870 
 871                 if ((sr->tid_tree != NULL) &&
 872                     (sr->tid_tree->t_kshare != NULL)) {
 873                         share_sds =
 874                             &sr->tid_tree->t_kshare->shr_stats[cmd_type];
 875                         smb_latency_add_sample(&share_sds->sdt_lat, dt);
 876                         atomic_add_64(&share_sds->sdt_rxb, rxb);
 877                         atomic_add_64(&share_sds->sdt_txb, txb);
 878                 }
 879         }
 880 
 881         switch (sdrc) {
 882         case SDRC_SUCCESS:
 883                 break;
 884 
 885         case SDRC_DROP_VC:
 886                 disconnect = B_TRUE;
 887                 goto drop_connection;
 888 
 889         case SDRC_NO_REPLY:
 890                 /* will free sr */
 891                 goto out;
 892 
 893         case SDRC_SR_KEPT:
 894                 /* Do NOT free sr */
 895                 sr = NULL;
 896                 goto out;
 897 
 898         case SDRC_ERROR:
 899                 goto report_error;
 900 
 901         case SDRC_NOT_IMPLEMENTED:
 902         default:
 903                 smbsr_error(sr, 0, ERRDOS, ERRbadfunc);
 904                 goto report_error;
 905         }
 906 
 907         /*
 908          * If there's no AndX command, we're done.
 909          */
 910         if (sr->andx_com == 0xff)
 911                 goto reply_ready;
 912 
 913         /*
 914          * Otherwise, we have to back-patch the AndXCommand and AndXOffset
 915          * and continue processing.
 916          */
 917         sr->andx_prev_wct = sr->cur_reply_offset;
 918         (void) smb_mbc_poke(&sr->reply, sr->andx_prev_wct + 1, "b.w",
 919             sr->andx_com, MBC_LENGTH(&sr->reply));
 920 
 921         sr->command.chain_offset = sr->orig_request_hdr + sr->andx_off;
 922         sr->smb_com = sr->andx_com;
 923         goto andx_more;
 924 
 925 report_error:
 926         sr->reply.chain_offset = sr->cur_reply_offset;
 927         (void) smb_mbc_encodef(&sr->reply, "bw", 0, 0);
 928 
 929         sr->smb_wct = 0;
 930         sr->smb_bcc = 0;
 931 
 932         if (sr->smb_rcls == 0 && sr->smb_reh == 0 && sr->smb_err == 0)
 933                 smbsr_error(sr, 0, ERRSRV, ERRerror);
 934 
 935 reply_ready:
 936         smbsr_send_reply(sr);
 937 
 938 drop_connection:
 939         if (disconnect) {
 940                 smb_rwx_rwenter(&session->s_lock, RW_WRITER);
 941                 switch (session->s_state) {
 942                 case SMB_SESSION_STATE_DISCONNECTED:
 943                 case SMB_SESSION_STATE_TERMINATED:
 944                         break;
 945                 default:
 946                         smb_soshutdown(session->sock);
 947                         session->s_state = SMB_SESSION_STATE_DISCONNECTED;
 948                         break;
 949                 }
 950                 smb_rwx_rwexit(&session->s_lock);
 951         }
 952 
 953 out:
 954         if (sr != NULL) {
 955                 mutex_enter(&sr->sr_mutex);
 956                 sr->sr_state = SMB_REQ_STATE_COMPLETED;
 957                 mutex_exit(&sr->sr_mutex);
 958                 smb_request_free(sr);
 959         }
 960 }
 961 
 962 int
 963 smbsr_encode_empty_result(struct smb_request *sr)
 964 {
 965         return (smbsr_encode_result(sr, 0, 0, "bw", 0, 0));
 966 }
 967 
 968 int
 969 smbsr_encode_result(struct smb_request *sr, int wct, int bcc,
 970     const char *fmt, ...)
 971 {
 972         va_list ap;
 973 
 974         if (MBC_LENGTH(&sr->reply) != sr->cur_reply_offset)
 975                 return (-1);
 976 
 977         va_start(ap, fmt);
 978         (void) smb_mbc_vencodef(&sr->reply, fmt, ap);
 979         va_end(ap);
 980 
 981         sr->smb_wct = (unsigned char)wct;
 982         sr->smb_bcc = (uint16_t)bcc;
 983 
 984         if (smbsr_check_result(sr, wct, bcc) != 0)
 985                 return (-1);
 986 
 987         return (0);
 988 }
 989 
 990 static int
 991 smbsr_check_result(struct smb_request *sr, int wct, int bcc)
 992 {
 993         int             offset = sr->cur_reply_offset;
 994         int             total_bytes;
 995         unsigned char   temp, temp1;
 996         struct mbuf     *m;
 997 
 998         total_bytes = 0;
 999         m = sr->reply.chain;
1000         while (m != 0) {
1001                 total_bytes += m->m_len;
1002                 m = m->m_next;
1003         }
1004 
1005         if ((offset + 3) > total_bytes)
1006                 return (-1);
1007 
1008         (void) smb_mbc_peek(&sr->reply, offset, "b", &temp);
1009         if (temp != wct)
1010                 return (-1);
1011 
1012         if ((offset + (wct * 2 + 1)) > total_bytes)
1013                 return (-1);
1014 
1015         /* reply wct & vwv seem ok, consider data now */
1016         offset += wct * 2 + 1;
1017 
1018         if ((offset + 2) > total_bytes)
1019                 return (-1);
1020 
1021         (void) smb_mbc_peek(&sr->reply, offset, "bb", &temp, &temp1);
1022         if (bcc == VAR_BCC) {
1023                 if ((temp != 0xFF) || (temp1 != 0xFF)) {
1024                         return (-1);
1025                 } else {
1026                         bcc = (total_bytes - offset) - 2;
1027                         (void) smb_mbc_poke(&sr->reply, offset, "bb",
1028                             bcc, bcc >> 8);
1029                 }
1030         } else {
1031                 if ((temp != (bcc&0xFF)) || (temp1 != ((bcc>>8)&0xFF)))
1032                         return (-1);
1033         }
1034 
1035         offset += bcc + 2;
1036 
1037         if (offset != total_bytes)
1038                 return (-1);
1039 
1040         sr->smb_wct = (unsigned char)wct;
1041         sr->smb_bcc = (uint16_t)bcc;
1042         return (0);
1043 }
1044 
1045 int
1046 smbsr_decode_vwv(struct smb_request *sr, const char *fmt, ...)
1047 {
1048         int rc;
1049         va_list ap;
1050 
1051         va_start(ap, fmt);
1052         rc = smb_mbc_vdecodef(&sr->smb_vwv, fmt, ap);
1053         va_end(ap);
1054 
1055         if (rc)
1056                 smbsr_error(sr, 0, ERRSRV, ERRerror);
1057         return (rc);
1058 }
1059 
1060 int
1061 smbsr_decode_data(struct smb_request *sr, const char *fmt, ...)
1062 {
1063         int rc;
1064         va_list ap;
1065 
1066         va_start(ap, fmt);
1067         rc = smb_mbc_vdecodef(&sr->smb_data, fmt, ap);
1068         va_end(ap);
1069 
1070         if (rc)
1071                 smbsr_error(sr, 0, ERRSRV, ERRerror);
1072         return (rc);
1073 }
1074 
1075 boolean_t
1076 smbsr_decode_data_avail(smb_request_t *sr)
1077 {
1078         return (sr->smb_data.chain_offset < sr->smb_data.max_bytes);
1079 }
1080 
1081 void
1082 smbsr_send_reply(smb_request_t *sr)
1083 {
1084         uint16_t        pid_hi, pid_lo;
1085 
1086         if (SMB_TREE_IS_CASEINSENSITIVE(sr))
1087                 sr->smb_flg |= SMB_FLAGS_CASE_INSENSITIVE;
1088         else
1089                 sr->smb_flg &= ~SMB_FLAGS_CASE_INSENSITIVE;
1090         pid_hi = sr->smb_pid >> 16;
1091         pid_lo = (uint16_t)sr->smb_pid;
1092 
1093         (void) smb_mbc_poke(&sr->reply, 0, SMB_HEADER_ED_FMT,
1094             sr->first_smb_com,
1095             sr->smb_rcls,
1096             sr->smb_reh,
1097             sr->smb_err,
1098             sr->smb_flg | SMB_FLAGS_REPLY,
1099             sr->smb_flg2,
1100             pid_hi,
1101             sr->smb_sig,
1102             sr->smb_tid,
1103             pid_lo,
1104             sr->smb_uid,
1105             sr->smb_mid);
1106 
1107         if (sr->session->signing.flags & SMB_SIGNING_ENABLED)
1108                 smb_sign_reply(sr, NULL);
1109 
1110         if (smb_session_send(sr->session, 0, &sr->reply) == 0)
1111                 sr->reply.chain = 0;
1112 }
1113 
1114 void
1115 smbsr_map_errno(int errnum, smb_error_t *err)
1116 {
1117         uint32_t status;
1118         uint16_t doserr;
1119 
1120         status = smb_errno2status(errnum);
1121         doserr = smb_status2doserr(status);
1122 
1123         err->status  = status;
1124         err->errcls  = ERRDOS;
1125         err->errcode = doserr;
1126 }
1127 
1128 void
1129 smbsr_errno(struct smb_request *sr, int errnum)
1130 {
1131         smbsr_map_errno(errnum, &sr->smb_error);
1132         smbsr_set_error(sr, &sr->smb_error);
1133 }
1134 
1135 /*
1136  * Report a request processing status (error or warning).
1137  */
1138 void
1139 smbsr_status(smb_request_t *sr, DWORD status, uint16_t errcls, uint16_t errcode)
1140 {
1141 
1142         sr->smb_error.status   = status;
1143 
1144         /*
1145          * This function is SMB1 specific.  While adding SMB2 support,
1146          * calls to this function have been removed from common code.
1147          * In case we missed any, check for SMB2 callers here, and
1148          * vector into a wrapper function that we can watch for...
1149          * (and track down with dtrace:)
1150          */
1151         if (sr->session->dialect >= SMB_VERS_2_BASE) {
1152                 smbsr_status_smb2(sr, status);
1153                 return;
1154         }
1155 
1156         if (status != 0 && errcls == 0 && errcode == 0) {
1157                 errcls = ERRDOS;
1158                 errcode = smb_status2doserr(status);
1159         }
1160 
1161         sr->smb_error.errcls   = errcls;
1162         sr->smb_error.errcode  = errcode;
1163 
1164         smbsr_set_error(sr, &sr->smb_error);
1165 }
1166 
1167 /*
1168  * Setup a request processing error.  This function can be used to
1169  * report 32-bit status codes or DOS errors.  Set the status code
1170  * to 0 (NT_STATUS_SUCCESS) to explicitly report a DOS error,
1171  * regardless of the client capabilities.
1172  *
1173  * If status is non-zero and the client supports 32-bit status
1174  * codes, report the status.  Otherwise, report the DOS error.
1175  */
1176 void
1177 smbsr_set_error(smb_request_t *sr, smb_error_t *err)
1178 {
1179         uint32_t status;
1180         uint32_t capabilities;
1181 
1182         ASSERT(sr);
1183         ASSERT(err);
1184 
1185         status = err->status;
1186         capabilities = sr->session->capabilities;
1187 
1188         if ((err->errcls == 0) && (err->errcode == 0)) {
1189                 capabilities |= CAP_STATUS32;
1190                 if (status == 0)
1191                         status = NT_STATUS_INTERNAL_ERROR;
1192         }
1193 
1194         if ((capabilities & CAP_STATUS32) && (status != 0)) {
1195                 sr->smb_rcls = status & 0xff;
1196                 sr->smb_reh = (status >> 8) & 0xff;
1197                 sr->smb_err  = status >> 16;
1198                 sr->smb_flg2 |= SMB_FLAGS2_NT_STATUS;
1199         } else {
1200                 if ((err->errcls == 0) || (err->errcode == 0)) {
1201                         sr->smb_rcls = ERRSRV;
1202                         sr->smb_err  = ERRerror;
1203                 } else {
1204                         sr->smb_rcls = (uint8_t)err->errcls;
1205                         sr->smb_err  = (uint16_t)err->errcode;
1206                 }
1207         }
1208 }
1209 
1210 smb_xa_t *
1211 smbsr_lookup_xa(smb_request_t *sr)
1212 {
1213         ASSERT(sr->r_xa == 0);
1214 
1215         sr->r_xa = smb_xa_find(sr->session, sr->smb_pid, sr->smb_mid);
1216         return (sr->r_xa);
1217 }
1218 
1219 void
1220 smbsr_release_file(smb_request_t *sr)
1221 {
1222         smb_ofile_t     *of = sr->fid_ofile;
1223 
1224         sr->fid_ofile = NULL;
1225         (void) smb_ofile_release(of);
1226 }
1227 
1228 void
1229 smbsr_lookup_file(smb_request_t *sr)
1230 {
1231         if (sr->fid_ofile == NULL)
1232                 sr->fid_ofile = smb_ofile_lookup_by_fid(sr, sr->smb_fid);
1233 }
1234 
1235 static int
1236 is_andx_com(unsigned char com)
1237 {
1238         switch (com) {
1239         case SMB_COM_LOCKING_ANDX:
1240         case SMB_COM_OPEN_ANDX:
1241         case SMB_COM_READ_ANDX:
1242         case SMB_COM_WRITE_ANDX:
1243         case SMB_COM_SESSION_SETUP_ANDX:
1244         case SMB_COM_LOGOFF_ANDX:
1245         case SMB_COM_TREE_CONNECT_ANDX:
1246         case SMB_COM_NT_CREATE_ANDX:
1247                 return (1);
1248         }
1249         return (0);
1250 }
1251 
1252 /*
1253  * Invalid command stubs.
1254  *
1255  * The Read/Write Block Multiplexed (mpx) protocol is used to maximize
1256  * performance when reading/writing a large block of data: it can be
1257  * used in parallel with other client/server operations.  The mpx sub-
1258  * protocol is not supported because we support only connection oriented
1259  * transports and NT supports mpx only over connectionless transports.
1260  */
1261 smb_sdrc_t
1262 smb_pre_invalid(smb_request_t *sr)
1263 {
1264         DTRACE_SMB_1(op__Invalid__start, smb_request_t *, sr);
1265         return (SDRC_SUCCESS);
1266 }
1267 
1268 void
1269 smb_post_invalid(smb_request_t *sr)
1270 {
1271         DTRACE_SMB_1(op__Invalid__done, smb_request_t *, sr);
1272 }
1273 
1274 smb_sdrc_t
1275 smb_com_invalid(smb_request_t *sr)
1276 {
1277         smb_sdrc_t sdrc;
1278 
1279         switch (sr->smb_com) {
1280         case SMB_COM_WRITE_COMPLETE:
1281                 smbsr_error(sr, 0, ERRSRV, ERRerror);
1282                 sdrc = SDRC_ERROR;
1283                 break;
1284 
1285         default:
1286                 smbsr_error(sr, NT_STATUS_NOT_IMPLEMENTED,
1287                     ERRDOS, ERROR_INVALID_FUNCTION);
1288                 sdrc = SDRC_NOT_IMPLEMENTED;
1289                 break;
1290         }
1291 
1292         return (sdrc);
1293 }
1294 
1295 /*
1296  * smb_dispatch_stats_init
1297  *
1298  * Initializes dispatch statistics.
1299  */
1300 void
1301 smb_dispatch_stats_init(smb_server_t *sv)
1302 {
1303         smb_disp_stats_t *sds = sv->sv_disp_stats1;
1304         smb_kstat_req_t *ksr;
1305         int             i;
1306 
1307         ksr = ((smbsrv_kstats_t *)sv->sv_ksp->ks_data)->ks_reqs1;
1308 
1309         for (i = 0; i < SMB_COM_NUM; i++, ksr++) {
1310                 smb_latency_init(&sds[i].sdt_lat);
1311                 (void) strlcpy(ksr->kr_name, smb_disp_table[i].sdt_name,
1312                     sizeof (ksr->kr_name));
1313         }
1314 }
1315 
1316 /*
1317  * smb_dispatch_stats_fini
1318  *
1319  * Frees and destroyes the resources used for statistics.
1320  */
1321 void
1322 smb_dispatch_stats_fini(smb_server_t *sv)
1323 {
1324         smb_disp_stats_t *sds = sv->sv_disp_stats1;
1325         int     i;
1326 
1327         for (i = 0; i < SMB_COM_NUM; i++)
1328                 smb_latency_destroy(&sds[i].sdt_lat);
1329 }
1330 
1331 void
1332 smb_dispatch_stats_update(smb_server_t *sv,
1333     smb_kstat_req_t *ksr, int first, int nreq)
1334 {
1335         smb_disp_stats_t *sds = sv->sv_disp_stats1;
1336         int     i;
1337         int     last;
1338 
1339         last = first + nreq - 1;
1340 
1341         if ((first < SMB_COM_NUM) && (last < SMB_COM_NUM))  {
1342                 for (i = first; i <= last; i++, ksr++) {
1343                         ksr->kr_rxb = sds[i].sdt_rxb;
1344                         ksr->kr_txb = sds[i].sdt_txb;
1345                         mutex_enter(&sds[i].sdt_lat.ly_mutex);
1346                         ksr->kr_nreq = sds[i].sdt_lat.ly_a_nreq;
1347                         ksr->kr_sum = sds[i].sdt_lat.ly_a_sum;
1348                         ksr->kr_a_mean = sds[i].sdt_lat.ly_a_mean;
1349                         ksr->kr_a_stddev =
1350                             sds[i].sdt_lat.ly_a_stddev;
1351                         ksr->kr_d_mean = sds[i].sdt_lat.ly_d_mean;
1352                         ksr->kr_d_stddev =
1353                             sds[i].sdt_lat.ly_d_stddev;
1354                         sds[i].sdt_lat.ly_d_mean = 0;
1355                         sds[i].sdt_lat.ly_d_nreq = 0;
1356                         sds[i].sdt_lat.ly_d_stddev = 0;
1357                         sds[i].sdt_lat.ly_d_sum = 0;
1358                         mutex_exit(&sds[i].sdt_lat.ly_mutex);
1359                 }
1360         }
1361 }