usr/src/uts/common/fs/smbclnt/netsmb/smb_iod.c

/*
 * Copyright (c) 2000-2001 Boris Popov
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 * 3. All advertising materials mentioning features or use of this software
 *    must display the following acknowledgement:
 *    This product includes software developed by Boris Popov.
 * 4. Neither the name of the author nor the names of any co-contributors
 *    may be used to endorse or promote products derived from this software
 *    without specific prior written permission.
 *
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 *
 * $Id: smb_iod.c,v 1.32 2005/02/12 00:17:09 lindak Exp $
 */

/*
 * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

#ifdef DEBUG
/* See sys/queue.h */
#define	QUEUEDEBUG 1
#endif

#include <sys/param.h>
#include <sys/systm.h>
#include <sys/atomic.h>
#include <sys/proc.h>
#include <sys/thread.h>
#include <sys/file.h>
#include <sys/kmem.h>
#include <sys/unistd.h>
#include <sys/mount.h>
#include <sys/vnode.h>
#include <sys/types.h>
#include <sys/ddi.h>
#include <sys/sunddi.h>
#include <sys/stream.h>
#include <sys/strsun.h>
#include <sys/time.h>
#include <sys/class.h>
#include <sys/disp.h>
#include <sys/cmn_err.h>
#include <sys/zone.h>
#include <sys/sdt.h>

#include <netsmb/smb_osdep.h>

#include <netsmb/smb.h>
#include <netsmb/smb_conn.h>
#include <netsmb/smb_rq.h>
#include <netsmb/smb_subr.h>
#include <netsmb/smb_tran.h>
#include <netsmb/smb_trantcp.h>

int smb_iod_send_echo(smb_vc_t *);

/*
 * This is set/cleared when smbfs loads/unloads
 * No locks should be necessary, because smbfs
 * can't unload until all the mounts are gone.
 */
static smb_fscb_t *fscb;
void
smb_fscb_set(smb_fscb_t *cb)
{
	fscb = cb;
}

static void
smb_iod_share_disconnected(smb_share_t *ssp)
{

	smb_share_invalidate(ssp);

	/* smbfs_dead() */
	if (fscb && fscb->fscb_disconn) {
		fscb->fscb_disconn(ssp);
	}
}

/*
 * State changes are important and infrequent.
 * Make them easily observable via dtrace.
 */
void
smb_iod_newstate(struct smb_vc *vcp, int state)
{
	vcp->vc_state = state;
}

/* Lock Held version of the next function. */
static inline void
smb_iod_rqprocessed_LH(
	struct smb_rq *rqp,
	int error,
	int flags)
{
	rqp->sr_flags |= flags;
	rqp->sr_lerror = error;
	rqp->sr_rpgen++;
	rqp->sr_state = SMBRQ_NOTIFIED;
	cv_broadcast(&rqp->sr_cond);
}

static void
smb_iod_rqprocessed(
	struct smb_rq *rqp,
	int error,
	int flags)
{

	SMBRQ_LOCK(rqp);
	smb_iod_rqprocessed_LH(rqp, error, flags);
	SMBRQ_UNLOCK(rqp);
}

static void
smb_iod_invrq(struct smb_vc *vcp)
{
	struct smb_rq *rqp;

	/*
	 * Invalidate all outstanding requests for this connection
	 */
	rw_enter(&vcp->iod_rqlock, RW_READER);
	TAILQ_FOREACH(rqp, &vcp->iod_rqlist, sr_link) {
		smb_iod_rqprocessed(rqp, ENOTCONN, SMBR_RESTART);
	}
	rw_exit(&vcp->iod_rqlock);
}

/*
 * Called by smb_vc_rele, smb_vc_kill, and by the driver
 * close entry point if the IOD closes its dev handle.
 *
 * Forcibly kill the connection and IOD.
 */
void
smb_iod_disconnect(struct smb_vc *vcp)
{

	/*
	 * Inform everyone of the state change.
	 */
	SMB_VC_LOCK(vcp);
	if (vcp->vc_state != SMBIOD_ST_DEAD) {
		smb_iod_newstate(vcp, SMBIOD_ST_DEAD);
		cv_broadcast(&vcp->vc_statechg);
	}
	SMB_VC_UNLOCK(vcp);

	/*
	 * Let's be safe here and avoid doing any
	 * call across the network while trying to
	 * shut things down.  If we just disconnect,
	 * the server will take care of the logoff.
	 */
	SMB_TRAN_DISCONNECT(vcp);
}

/*
 * Send one request.
 *
 * Called by _addrq (for internal requests)
 * and _sendall (via _addrq, _multirq, _waitrq)
 */
static int
smb_iod_sendrq(struct smb_rq *rqp)
{
	struct smb_vc *vcp = rqp->sr_vc;
	mblk_t *m;
	int error;

	ASSERT(vcp);
	ASSERT(SEMA_HELD(&vcp->vc_sendlock));
	ASSERT(RW_READ_HELD(&vcp->iod_rqlock));

	/*
	 * Note: Anything special for SMBR_INTERNAL here?
	 */
	if (vcp->vc_state != SMBIOD_ST_VCACTIVE) {
		SMBIODEBUG("bad vc_state=%d\n", vcp->vc_state);
		return (ENOTCONN);
	}


	/*
	 * On the first send, set the MID and (maybe)
	 * the signing sequence numbers.  The increments
	 * here are serialized by vc_sendlock
	 */
	if (rqp->sr_sendcnt == 0) {

		rqp->sr_mid = vcp->vc_next_mid++;

		if (rqp->sr_rqflags2 & SMB_FLAGS2_SECURITY_SIGNATURE) {
			/*
			 * We're signing requests and verifying
			 * signatures on responses.  Set the
			 * sequence numbers of the request and
			 * response here, used in smb_rq_verify.
			 */
			rqp->sr_seqno = vcp->vc_next_seq++;
			rqp->sr_rseqno = vcp->vc_next_seq++;
		}

		/* Fill in UID, TID, MID, etc. */
		smb_rq_fillhdr(rqp);

		/*
		 * Sign the message now that we're finally done
		 * filling in the SMB header fields, etc.
		 */
		if (rqp->sr_rqflags2 & SMB_FLAGS2_SECURITY_SIGNATURE) {
			smb_rq_sign(rqp);
		}
	}
	if (rqp->sr_sendcnt++ >= 60/SMBSBTIMO) { /* one minute */
		smb_iod_rqprocessed(rqp, rqp->sr_lerror, SMBR_RESTART);
		/*
		 * If all attempts to send a request failed, then
		 * something is seriously hosed.
		 */
		return (ENOTCONN);
	}

	/*
	 * Replaced m_copym() with Solaris copymsg() which does the same
	 * work when we want to do a M_COPYALL.
	 * m = m_copym(rqp->sr_rq.mb_top, 0, M_COPYALL, 0);
	 */
	m = copymsg(rqp->sr_rq.mb_top);

#ifdef DTRACE_PROBE
	DTRACE_PROBE2(smb_iod_sendrq,
	    (smb_rq_t *), rqp, (mblk_t *), m);
#else
	SMBIODEBUG("M:%04x, P:%04x, U:%04x, T:%04x\n", rqp->sr_mid, 0, 0, 0);
#endif
	m_dumpm(m);

	if (m != NULL) {
		error = SMB_TRAN_SEND(vcp, m);
		m = 0; /* consumed by SEND */
	} else
		error = ENOBUFS;

	rqp->sr_lerror = error;
	if (error == 0) {
		SMBRQ_LOCK(rqp);
		rqp->sr_flags |= SMBR_SENT;
		rqp->sr_state = SMBRQ_SENT;
		if (rqp->sr_flags & SMBR_SENDWAIT)
			cv_broadcast(&rqp->sr_cond);
		SMBRQ_UNLOCK(rqp);
		return (0);
	}
	/*
	 * Check for fatal errors
	 */
	if (SMB_TRAN_FATAL(vcp, error)) {
		/*
		 * No further attempts should be made
		 */
		SMBSDEBUG("TRAN_SEND returned fatal error %d\n", error);
		return (ENOTCONN);
	}
	if (error)
		SMBSDEBUG("TRAN_SEND returned non-fatal error %d\n", error);

#ifdef APPLE
	/* If proc waiting on rqp was signaled... */
	if (smb_rq_intr(rqp))
		smb_iod_rqprocessed(rqp, EINTR, 0);
#endif

	return (0);
}

static int
smb_iod_recv1(struct smb_vc *vcp, mblk_t **mpp)
{
	mblk_t *m;
	uchar_t *hp;
	int error;

top:
	m = NULL;
	error = SMB_TRAN_RECV(vcp, &m);
	if (error == EAGAIN)
		goto top;
	if (error)
		return (error);
	ASSERT(m);

	m = m_pullup(m, SMB_HDRLEN);
	if (m == NULL) {
		return (ENOSR);
	}

	/*
	 * Check the SMB header
	 */
	hp = mtod(m, uchar_t *);
	if (bcmp(hp, SMB_SIGNATURE, SMB_SIGLEN) != 0) {
		m_freem(m);
		return (EPROTO);
	}

	*mpp = m;
	return (0);
}

/*
 * Process incoming packets
 *
 * This is the "reader" loop, run by the IOD thread
 * while in state SMBIOD_ST_VCACTIVE.  The loop now
 * simply blocks in the socket recv until either a
 * message arrives, or a disconnect.
 *
 * Any non-zero error means the IOD should terminate.
 */
int
smb_iod_recvall(struct smb_vc *vcp)
{
	struct smb_rq *rqp;
	mblk_t *m;
	uchar_t *hp;
	ushort_t mid;
	int error = 0;
	int etime_count = 0; /* for "server not responding", etc. */

	for (;;) {
		/*
		 * Check whether someone "killed" this VC,
		 * or is asking the IOD to terminate.
		 */

		if (vcp->vc_state != SMBIOD_ST_VCACTIVE) {
			SMBIODEBUG("bad vc_state=%d\n", vcp->vc_state);
			error = 0;
			break;
		}

		if (vcp->iod_flags & SMBIOD_SHUTDOWN) {
			SMBIODEBUG("SHUTDOWN set\n");
			/* This IOD thread will terminate. */
			SMB_VC_LOCK(vcp);
			smb_iod_newstate(vcp, SMBIOD_ST_DEAD);
			cv_broadcast(&vcp->vc_statechg);
			SMB_VC_UNLOCK(vcp);
			error = EINTR;
			break;
		}

		m = NULL;
		error = smb_iod_recv1(vcp, &m);

		if (error == ETIME &&
		    vcp->iod_rqlist.tqh_first != NULL) {
			/*
			 * Nothing received for 15 seconds and
			 * we have requests in the queue.
			 */
			etime_count++;

			/*
			 * Once, at 15 sec. notify callbacks
			 * and print the warning message.
			 */
			if (etime_count == 1) {
				/* Was: smb_iod_notify_down(vcp); */
				if (fscb && fscb->fscb_down)
					smb_vc_walkshares(vcp,
					    fscb->fscb_down);
				zprintf(vcp->vc_zoneid,
				    "SMB server %s not responding\n",
				    vcp->vc_srvname);
			}

			/*
			 * At 30 sec. try sending an echo, and then
			 * once a minute thereafter.
			 */
			if ((etime_count & 3) == 2) {
				(void) smb_iod_send_echo(vcp);
			}

			continue;
		} /* ETIME && requests in queue */

		if (error == ETIME) {
			/*
			 * If the IOD thread holds the last reference
			 * to this VC, let the IOD thread terminate.
			 */
			if (vcp->vc_co.co_usecount > 1)
				continue;
			SMB_VC_LOCK(vcp);
			if (vcp->vc_co.co_usecount == 1) {
				smb_iod_newstate(vcp, SMBIOD_ST_DEAD);
				SMB_VC_UNLOCK(vcp);
				error = 0;
				break;
			}
			SMB_VC_UNLOCK(vcp);
			continue;
		} /* error == ETIME */

		if (error) {
			/*
			 * The recv. above returned some error
			 * we can't continue from i.e. ENOTCONN.
			 * It's dangerous to continue here.
			 * (possible infinite loop!)
			 *
			 * If we have requests enqueued, next
			 * state is reconnecting, else idle.
			 */
			int state;
			SMB_VC_LOCK(vcp);
			state = (vcp->iod_rqlist.tqh_first != NULL) ?
			    SMBIOD_ST_RECONNECT : SMBIOD_ST_IDLE;
			smb_iod_newstate(vcp, state);
			cv_broadcast(&vcp->vc_statechg);
			SMB_VC_UNLOCK(vcp);
			error = 0;
			break;
		}

		/*
		 * Received something.  Yea!
		 */
		if (etime_count) {
			etime_count = 0;

			zprintf(vcp->vc_zoneid, "SMB server %s OK\n",
			    vcp->vc_srvname);

			/* Was: smb_iod_notify_up(vcp); */
			if (fscb && fscb->fscb_up)
				smb_vc_walkshares(vcp, fscb->fscb_up);
		}

		/*
		 * Have an SMB packet.  The SMB header was
		 * checked in smb_iod_recv1().
		 * Find the request...
		 */
		hp = mtod(m, uchar_t *);
		/*LINTED*/
		mid = letohs(SMB_HDRMID(hp));
		SMBIODEBUG("mid %04x\n", (uint_t)mid);

		rw_enter(&vcp->iod_rqlock, RW_READER);
		TAILQ_FOREACH(rqp, &vcp->iod_rqlist, sr_link) {

			if (rqp->sr_mid != mid)
				continue;

			DTRACE_PROBE2(smb_iod_recvrq,
			    (smb_rq_t *), rqp, (mblk_t *), m);
			m_dumpm(m);

			SMBRQ_LOCK(rqp);
			if (rqp->sr_rp.md_top == NULL) {
				md_initm(&rqp->sr_rp, m);
			} else {
				if (rqp->sr_flags & SMBR_MULTIPACKET) {
					md_append_record(&rqp->sr_rp, m);
				} else {
					SMBRQ_UNLOCK(rqp);
					SMBSDEBUG("duplicate response %d "
					    "(ignored)\n", mid);
					break;
				}
			}
			smb_iod_rqprocessed_LH(rqp, 0, 0);
			SMBRQ_UNLOCK(rqp);
			break;
		}

		if (rqp == NULL) {
			int cmd = SMB_HDRCMD(hp);

			if (cmd != SMB_COM_ECHO)
				SMBSDEBUG("drop resp: mid %d, cmd %d\n",
				    (uint_t)mid, cmd);
/*			smb_printrqlist(vcp); */
			m_freem(m);
		}
		rw_exit(&vcp->iod_rqlock);

	}

	return (error);
}

/*
 * The IOD receiver thread has requests pending and
 * has not received anything in a while.  Try to
 * send an SMB echo request.  It's tricky to do a
 * send from the IOD thread because we can't block.
 *
 * Using tmo=SMBNOREPLYWAIT in the request
 * so smb_rq_reply will skip smb_iod_waitrq.
 * The smb_smb_echo call uses SMBR_INTERNAL
 * to avoid calling smb_iod_sendall().
 */
int
smb_iod_send_echo(smb_vc_t *vcp)
{
	smb_cred_t scred;
	int err;

	smb_credinit(&scred, NULL);
	err = smb_smb_echo(vcp, &scred, SMBNOREPLYWAIT);
	smb_credrele(&scred);
	return (err);
}

/*
 * The IOD thread is now just a "reader",
 * so no more smb_iod_request().  Yea!
 */

/*
 * Place request in the queue, and send it now if possible.
 * Called with no locks held.
 */
int
smb_iod_addrq(struct smb_rq *rqp)
{
	struct smb_vc *vcp = rqp->sr_vc;
	int error, save_newrq;

	ASSERT(rqp->sr_cred);

	/*
	 * State should be correct after the check in
	 * smb_rq_enqueue(), but we dropped locks...
	 */
	if (vcp->vc_state != SMBIOD_ST_VCACTIVE) {
		SMBIODEBUG("bad vc_state=%d\n", vcp->vc_state);
		return (ENOTCONN);
	}

	/*
	 * Requests from the IOD itself are marked _INTERNAL,
	 * and get some special treatment to avoid blocking
	 * the reader thread (so we don't deadlock).
	 * The request is not yet on the queue, so we can
	 * modify it's state here without locks.
	 * Only thing using this now is ECHO.
	 */
	rqp->sr_owner = curthread;
	if (rqp->sr_owner == vcp->iod_thr) {
		rqp->sr_flags |= SMBR_INTERNAL;

		/*
		 * This is a request from the IOD thread.
		 * Always send directly from this thread.
		 * Note lock order: iod_rqlist, vc_sendlock
		 */
		rw_enter(&vcp->iod_rqlock, RW_WRITER);
		TAILQ_INSERT_HEAD(&vcp->iod_rqlist, rqp, sr_link);
		rw_downgrade(&vcp->iod_rqlock);

		/*
		 * Note: iod_sendrq expects vc_sendlock,
		 * so take that here, but carefully:
		 * Never block the IOD thread here.
		 */
		if (sema_tryp(&vcp->vc_sendlock) == 0) {
			SMBIODEBUG("sendlock busy\n");
			error = EAGAIN;
		} else {
			/* Have vc_sendlock */
			error = smb_iod_sendrq(rqp);
			sema_v(&vcp->vc_sendlock);
		}

		rw_exit(&vcp->iod_rqlock);

		/*
		 * In the non-error case, _removerq
		 * is done by either smb_rq_reply
		 * or smb_iod_waitrq.
		 */
		if (error)
			smb_iod_removerq(rqp);

		return (error);
	}

	rw_enter(&vcp->iod_rqlock, RW_WRITER);

	TAILQ_INSERT_TAIL(&vcp->iod_rqlist, rqp, sr_link);
	/* iod_rqlock/WRITER protects iod_newrq */
	save_newrq = vcp->iod_newrq;
	vcp->iod_newrq++;

	rw_exit(&vcp->iod_rqlock);

	/*
	 * Now send any requests that need to be sent,
	 * including the one we just put on the list.
	 * Only the thread that found iod_newrq==0
	 * needs to run the send loop.
	 */
	if (save_newrq == 0)
		smb_iod_sendall(vcp);

	return (0);
}

/*
 * Mark an SMBR_MULTIPACKET request as
 * needing another send.  Similar to the
 * "normal" part of smb_iod_addrq.
 */
int
smb_iod_multirq(struct smb_rq *rqp)
{
	struct smb_vc *vcp = rqp->sr_vc;
	int save_newrq;

	ASSERT(rqp->sr_flags & SMBR_MULTIPACKET);

	if (rqp->sr_flags & SMBR_INTERNAL)
		return (EINVAL);

	if (vcp->vc_state != SMBIOD_ST_VCACTIVE) {
		SMBIODEBUG("bad vc_state=%d\n", vcp->vc_state);
		return (ENOTCONN);
	}

	rw_enter(&vcp->iod_rqlock, RW_WRITER);

	/* Already on iod_rqlist, just reset state. */
	rqp->sr_state = SMBRQ_NOTSENT;

	/* iod_rqlock/WRITER protects iod_newrq */
	save_newrq = vcp->iod_newrq;
	vcp->iod_newrq++;

	rw_exit(&vcp->iod_rqlock);

	/*
	 * Now send any requests that need to be sent,
	 * including the one we just marked NOTSENT.
	 * Only the thread that found iod_newrq==0
	 * needs to run the send loop.
	 */
	if (save_newrq == 0)
		smb_iod_sendall(vcp);

	return (0);
}


void
smb_iod_removerq(struct smb_rq *rqp)
{
	struct smb_vc *vcp = rqp->sr_vc;

	rw_enter(&vcp->iod_rqlock, RW_WRITER);
#ifdef QUEUEDEBUG
	/*
	 * Make sure we have not already removed it.
	 * See sys/queue.h QUEUEDEBUG_TAILQ_POSTREMOVE
	 * XXX: Don't like the constant 1 here...
	 */
	ASSERT(rqp->sr_link.tqe_next != (void *)1L);
#endif
	TAILQ_REMOVE(&vcp->iod_rqlist, rqp, sr_link);
	rw_exit(&vcp->iod_rqlock);
}



/*
 * Wait for a request to complete.
 *
 * For normal requests, we need to deal with
 * ioc_muxcnt dropping below vc_maxmux by
 * making arrangements to send more...
 */
int
smb_iod_waitrq(struct smb_rq *rqp)
{
	struct smb_vc *vcp = rqp->sr_vc;
	clock_t tr, tmo1, tmo2;
	int error, rc;

	if (rqp->sr_flags & SMBR_INTERNAL) {
		ASSERT((rqp->sr_flags & SMBR_MULTIPACKET) == 0);
		smb_iod_removerq(rqp);
		return (EAGAIN);
	}

	/*
	 * Make sure this is NOT the IOD thread,
	 * or the wait below will stop the reader.
	 */
	ASSERT(curthread != vcp->iod_thr);

	SMBRQ_LOCK(rqp);

	/*
	 * First, wait for the request to be sent.  Normally the send
	 * has already happened by the time we get here.  However, if
	 * we have more than maxmux entries in the request list, our
	 * request may not be sent until other requests complete.
	 * The wait in this case is due to local I/O demands, so
	 * we don't want the server response timeout to apply.
	 *
	 * If a request is allowed to interrupt this wait, then the
	 * request is cancelled and never sent OTW.  Some kinds of
	 * requests should never be cancelled (i.e. close) and those
	 * are marked SMBR_NOINTR_SEND so they either go eventually,
	 * or a connection close will terminate them with ENOTCONN.
	 */
	while (rqp->sr_state == SMBRQ_NOTSENT) {
		rqp->sr_flags |= SMBR_SENDWAIT;
		if (rqp->sr_flags & SMBR_NOINTR_SEND) {
			cv_wait(&rqp->sr_cond, &rqp->sr_lock);
			rc = 1;
		} else
			rc = cv_wait_sig(&rqp->sr_cond, &rqp->sr_lock);
		rqp->sr_flags &= ~SMBR_SENDWAIT;
		if (rc == 0) {
			SMBIODEBUG("EINTR in sendwait, rqp=%p\n", rqp);
			error = EINTR;
			goto out;
		}
	}

	/*
	 * The request has been sent.  Now wait for the response,
	 * with the timeout specified for this request.
	 * Compute all the deadlines now, so we effectively
	 * start the timer(s) after the request is sent.
	 */
	if (smb_timo_notice && (smb_timo_notice < rqp->sr_timo))
		tmo1 = SEC_TO_TICK(smb_timo_notice);
	else
		tmo1 = 0;
	tmo2 = ddi_get_lbolt() + SEC_TO_TICK(rqp->sr_timo);

	/*
	 * As above, we don't want to allow interrupt for some
	 * requests like open, because we could miss a succesful
	 * response and therefore "leak" a FID.  Such requests
	 * are marked SMBR_NOINTR_RECV to prevent that.
	 *
	 * If "slow server" warnings are enabled, wait first
	 * for the "notice" timeout, and warn if expired.
	 */
	if (tmo1 && rqp->sr_rpgen == rqp->sr_rplast) {
		if (rqp->sr_flags & SMBR_NOINTR_RECV)
			tr = cv_reltimedwait(&rqp->sr_cond,
			    &rqp->sr_lock, tmo1, TR_CLOCK_TICK);
		else
			tr = cv_reltimedwait_sig(&rqp->sr_cond,
			    &rqp->sr_lock, tmo1, TR_CLOCK_TICK);
		if (tr == 0) {
			error = EINTR;
			goto out;
		}
		if (tr < 0) {
#ifdef DTRACE_PROBE
			DTRACE_PROBE1(smb_iod_waitrq1,
			    (smb_rq_t *), rqp);
#endif
#ifdef NOT_YET
			/* Want this to go ONLY to the user. */
			uprintf("SMB server %s has not responded"
			    " to request %d after %d seconds..."
			    " (still waiting).\n", vcp->vc_srvname,
			    rqp->sr_mid, smb_timo_notice);
#endif
		}
	}

	/*
	 * Keep waiting until tmo2 is expired.
	 */
	while (rqp->sr_rpgen == rqp->sr_rplast) {
		if (rqp->sr_flags & SMBR_NOINTR_RECV)
			tr = cv_timedwait(&rqp->sr_cond,
			    &rqp->sr_lock, tmo2);
		else
			tr = cv_timedwait_sig(&rqp->sr_cond,
			    &rqp->sr_lock, tmo2);
		if (tr == 0) {
			error = EINTR;
			goto out;
		}
		if (tr < 0) {
#ifdef DTRACE_PROBE
			DTRACE_PROBE1(smb_iod_waitrq2,
			    (smb_rq_t *), rqp);
#endif
#ifdef NOT_YET
			/* Want this to go ONLY to the user. */
			uprintf("SMB server %s has not responded"
			    " to request %d after %d seconds..."
			    " (giving up).\n", vcp->vc_srvname,
			    rqp->sr_mid, rqp->sr_timo);
#endif
			error = ETIME;
			goto out;
		}
		/* got wakeup */
	}
	error = rqp->sr_lerror;
	rqp->sr_rplast++;

out:
	SMBRQ_UNLOCK(rqp);

	/*
	 * MULTIPACKET request must stay in the list.
	 * They may need additional responses.
	 */
	if ((rqp->sr_flags & SMBR_MULTIPACKET) == 0)
		smb_iod_removerq(rqp);

	/*
	 * Some request has been completed.
	 * If we reached the mux limit,
	 * re-run the send loop...
	 */
	if (vcp->iod_muxfull)
		smb_iod_sendall(vcp);

	return (error);
}

/*
 * Shutdown all outstanding I/O requests on the specified share with
 * ENXIO; used when unmounting a share.  (There shouldn't be any for a
 * non-forced unmount; if this is a forced unmount, we have to shutdown
 * the requests as part of the unmount process.)
 */
void
smb_iod_shutdown_share(struct smb_share *ssp)
{
	struct smb_vc *vcp = SSTOVC(ssp);
	struct smb_rq *rqp;

	/*
	 * Loop through the list of requests and shutdown the ones
	 * that are for the specified share.
	 */
	rw_enter(&vcp->iod_rqlock, RW_READER);
	TAILQ_FOREACH(rqp, &vcp->iod_rqlist, sr_link) {
		if (rqp->sr_state != SMBRQ_NOTIFIED && rqp->sr_share == ssp)
			smb_iod_rqprocessed(rqp, EIO, 0);
	}
	rw_exit(&vcp->iod_rqlock);
}

/*
 * Send all requests that need sending.
 * Called from _addrq, _multirq, _waitrq
 */
void
smb_iod_sendall(smb_vc_t *vcp)
{
	struct smb_rq *rqp;
	int error, muxcnt;

	/*
	 * Clear "newrq" to make sure threads adding
	 * new requests will run this function again.
	 */
	rw_enter(&vcp->iod_rqlock, RW_WRITER);
	vcp->iod_newrq = 0;

	/*
	 * We only read iod_rqlist, so downgrade rwlock.
	 * This allows the IOD to handle responses while
	 * some requesting thread may be blocked in send.
	 */
	rw_downgrade(&vcp->iod_rqlock);

	/*
	 * Serialize to prevent multiple senders.
	 * Note lock order: iod_rqlock, vc_sendlock
	 */
	sema_p(&vcp->vc_sendlock);

	/*
	 * Walk the list of requests and send when possible.
	 * We avoid having more than vc_maxmux requests
	 * outstanding to the server by traversing only
	 * vc_maxmux entries into this list.  Simple!
	 */
	ASSERT(vcp->vc_maxmux > 0);
	error = muxcnt = 0;
	TAILQ_FOREACH(rqp, &vcp->iod_rqlist, sr_link) {

		if (vcp->vc_state != SMBIOD_ST_VCACTIVE) {
			error = ENOTCONN; /* stop everything! */
			break;
		}

		if (rqp->sr_state == SMBRQ_NOTSENT) {
			error = smb_iod_sendrq(rqp);
			if (error)
				break;
		}

		if (++muxcnt == vcp->vc_maxmux) {
			SMBIODEBUG("muxcnt == vc_maxmux\n");
			break;
		}

	}

	/*
	 * If we have vc_maxmux requests outstanding,
	 * arrange for _waitrq to call _sendall as
	 * requests are completed.
	 */
	vcp->iod_muxfull =
	    (muxcnt < vcp->vc_maxmux) ? 0 : 1;

	sema_v(&vcp->vc_sendlock);
	rw_exit(&vcp->iod_rqlock);
}

int
smb_iod_vc_work(struct smb_vc *vcp, cred_t *cr)
{
	struct file *fp = NULL;
	int err = 0;

	/*
	 * This is called by the one-and-only
	 * IOD thread for this VC.
	 */
	ASSERT(vcp->iod_thr == curthread);

	/*
	 * Get the network transport file pointer,
	 * and "loan" it to our transport module.
	 */
	if ((fp = getf(vcp->vc_tran_fd)) == NULL) {
		err = EBADF;
		goto out;
	}
	if ((err = SMB_TRAN_LOAN_FP(vcp, fp, cr)) != 0)
		goto out;

	/*
	 * In case of reconnect, tell any enqueued requests
	 * then can GO!
	 */
	SMB_VC_LOCK(vcp);
	vcp->vc_genid++;	/* possibly new connection */
	smb_iod_newstate(vcp, SMBIOD_ST_VCACTIVE);
	cv_broadcast(&vcp->vc_statechg);
	SMB_VC_UNLOCK(vcp);

	/*
	 * The above cv_broadcast should be sufficient to
	 * get requests going again.
	 *
	 * If we have a callback function, run it.
	 * Was: smb_iod_notify_connected()
	 */
	if (fscb && fscb->fscb_connect)
		smb_vc_walkshares(vcp, fscb->fscb_connect);

	/*
	 * Run the "reader" loop.
	 */
	err = smb_iod_recvall(vcp);

	/*
	 * The reader loop returned, so we must have a
	 * new state.  (disconnected or reconnecting)
	 *
	 * Notify shares of the disconnect.
	 * Was: smb_iod_notify_disconnect()
	 */
	smb_vc_walkshares(vcp, smb_iod_share_disconnected);

	/*
	 * The reader loop function returns only when
	 * there's been an error on the connection, or
	 * this VC has no more references.  It also
	 * updates the state before it returns.
	 *
	 * Tell any requests to give up or restart.
	 */
	smb_iod_invrq(vcp);

out:
	/* Recall the file descriptor loan. */
	(void) SMB_TRAN_LOAN_FP(vcp, NULL, cr);
	if (fp != NULL) {
		releasef(vcp->vc_tran_fd);
	}

	return (err);
}

/*
 * Wait around for someone to ask to use this VC.
 * If the VC has only the IOD reference, then
 * wait only a minute or so, then drop it.
 */
int
smb_iod_vc_idle(struct smb_vc *vcp)
{
	clock_t tr, delta = SEC_TO_TICK(15);
	int err = 0;

	/*
	 * This is called by the one-and-only
	 * IOD thread for this VC.
	 */
	ASSERT(vcp->iod_thr == curthread);

	SMB_VC_LOCK(vcp);
	while (vcp->vc_state == SMBIOD_ST_IDLE) {
		tr = cv_reltimedwait_sig(&vcp->iod_idle, &vcp->vc_lock,
		    delta, TR_CLOCK_TICK);
		if (tr == 0) {
			err = EINTR;
			break;
		}
		if (tr < 0) {
			/* timeout */
			if (vcp->vc_co.co_usecount == 1) {
				/* Let this IOD terminate. */
				smb_iod_newstate(vcp, SMBIOD_ST_DEAD);
				/* nobody to cv_broadcast */
				break;
			}
		}
	}
	SMB_VC_UNLOCK(vcp);

	return (err);
}

/*
 * After a failed reconnect attempt, smbiod will
 * call this to make current requests error out.
 */
int
smb_iod_vc_rcfail(struct smb_vc *vcp)
{
	clock_t tr;
	int err = 0;

	/*
	 * This is called by the one-and-only
	 * IOD thread for this VC.
	 */
	ASSERT(vcp->iod_thr == curthread);

	if (vcp->vc_state != SMBIOD_ST_RECONNECT)
		return (EINVAL);

	SMB_VC_LOCK(vcp);

	smb_iod_newstate(vcp, SMBIOD_ST_RCFAILED);
	cv_broadcast(&vcp->vc_statechg);

	/*
	 * Short wait here for two reasons:
	 * (1) Give requests a chance to error out.
	 * (2) Prevent immediate retry.
	 */
	tr = cv_reltimedwait_sig(&vcp->iod_idle, &vcp->vc_lock,
	    SEC_TO_TICK(5), TR_CLOCK_TICK);
	if (tr == 0)
		err = EINTR;

	smb_iod_newstate(vcp, SMBIOD_ST_IDLE);
	cv_broadcast(&vcp->vc_statechg);

	SMB_VC_UNLOCK(vcp);

	return (err);
}

/*
 * Ask the IOD to reconnect (if not already underway)
 * then wait for the reconnect to finish.
 */
int
smb_iod_reconnect(struct smb_vc *vcp)
{
	int err = 0, rv;

	SMB_VC_LOCK(vcp);
again:
	switch (vcp->vc_state) {

	case SMBIOD_ST_IDLE:
		smb_iod_newstate(vcp, SMBIOD_ST_RECONNECT);
		cv_signal(&vcp->iod_idle);
		/* FALLTHROUGH */

	case SMBIOD_ST_RECONNECT:
		rv = cv_wait_sig(&vcp->vc_statechg, &vcp->vc_lock);
		if (rv == 0) {
			err = EINTR;
			break;
		}
		goto again;

	case SMBIOD_ST_VCACTIVE:
		err = 0; /* success! */
		break;

	case SMBIOD_ST_RCFAILED:
	case SMBIOD_ST_DEAD:
	default:
		err = ENOTCONN;
		break;
	}

	SMB_VC_UNLOCK(vcp);
	return (err);
}