xref: /illumos-gate/usr/src/uts/common/fs/sockfs/socktpi.c (revision f012ee0c3db17469b492c2cf757226f3d7b1ebbc)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright (c) 1995, 2010, Oracle and/or its affiliates. All rights reserved.
24  * Copyright 2015, Joyent, Inc.
25  * Copyright 2016 Nexenta Systems, Inc.  All rights reserved.
26  */
27 
28 #include <sys/types.h>
29 #include <sys/t_lock.h>
30 #include <sys/param.h>
31 #include <sys/systm.h>
32 #include <sys/buf.h>
33 #include <sys/conf.h>
34 #include <sys/cred.h>
35 #include <sys/kmem.h>
36 #include <sys/kmem_impl.h>
37 #include <sys/sysmacros.h>
38 #include <sys/vfs.h>
39 #include <sys/vnode.h>
40 #include <sys/debug.h>
41 #include <sys/errno.h>
42 #include <sys/time.h>
43 #include <sys/file.h>
44 #include <sys/open.h>
45 #include <sys/user.h>
46 #include <sys/termios.h>
47 #include <sys/stream.h>
48 #include <sys/strsubr.h>
49 #include <sys/strsun.h>
50 #include <sys/suntpi.h>
51 #include <sys/ddi.h>
52 #include <sys/esunddi.h>
53 #include <sys/flock.h>
54 #include <sys/modctl.h>
55 #include <sys/vtrace.h>
56 #include <sys/cmn_err.h>
57 #include <sys/pathname.h>
58 
59 #include <sys/socket.h>
60 #include <sys/socketvar.h>
61 #include <sys/sockio.h>
62 #include <netinet/in.h>
63 #include <sys/un.h>
64 #include <sys/strsun.h>
65 
66 #include <sys/tiuser.h>
67 #define	_SUN_TPI_VERSION	2
68 #include <sys/tihdr.h>
69 #include <sys/timod.h>		/* TI_GETMYNAME, TI_GETPEERNAME */
70 
71 #include <c2/audit.h>
72 
73 #include <inet/common.h>
74 #include <inet/ip.h>
75 #include <inet/ip6.h>
76 #include <inet/tcp.h>
77 #include <inet/udp_impl.h>
78 
79 #include <sys/zone.h>
80 
81 #include <fs/sockfs/nl7c.h>
82 #include <fs/sockfs/nl7curi.h>
83 
84 #include <fs/sockfs/sockcommon.h>
85 #include <fs/sockfs/socktpi.h>
86 #include <fs/sockfs/socktpi_impl.h>
87 
88 /*
89  * Possible failures when memory can't be allocated. The documented behavior:
90  *
91  * 		5.5:			4.X:		XNET:
92  * accept:	ENOMEM/ENOSR/EINTR	- (EINTR)	ENOMEM/ENOBUFS/ENOSR/
93  *							EINTR
94  *	(4.X does not document EINTR but returns it)
95  * bind:	ENOSR			-		ENOBUFS/ENOSR
96  * connect: 	EINTR			EINTR		ENOBUFS/ENOSR/EINTR
97  * getpeername:	ENOMEM/ENOSR		ENOBUFS (-)	ENOBUFS/ENOSR
98  * getsockname:	ENOMEM/ENOSR		ENOBUFS (-)	ENOBUFS/ENOSR
99  *	(4.X getpeername and getsockname do not fail in practice)
100  * getsockopt:	ENOMEM/ENOSR		-		ENOBUFS/ENOSR
101  * listen:	-			-		ENOBUFS
102  * recv:	ENOMEM/ENOSR/EINTR	EINTR		ENOBUFS/ENOMEM/ENOSR/
103  *							EINTR
104  * send:	ENOMEM/ENOSR/EINTR	ENOBUFS/EINTR	ENOBUFS/ENOMEM/ENOSR/
105  *							EINTR
106  * setsockopt:	ENOMEM/ENOSR		-		ENOBUFS/ENOMEM/ENOSR
107  * shutdown:	ENOMEM/ENOSR		-		ENOBUFS/ENOSR
108  * socket:	ENOMEM/ENOSR		ENOBUFS		ENOBUFS/ENOMEM/ENOSR
109  * socketpair:	ENOMEM/ENOSR		-		ENOBUFS/ENOMEM/ENOSR
110  *
111  * Resolution. When allocation fails:
112  *	recv: return EINTR
113  *	send: return EINTR
114  *	connect, accept: EINTR
115  *	bind, listen, shutdown (unbind, unix_close, disconnect): sleep
116  *	socket, socketpair: ENOBUFS
117  *	getpeername, getsockname: sleep
118  *	getsockopt, setsockopt: sleep
119  */
120 
121 #ifdef SOCK_TEST
122 /*
123  * Variables that make sockfs do something other than the standard TPI
124  * for the AF_INET transports.
125  *
126  * solisten_tpi_tcp:
127  *	TCP can handle a O_T_BIND_REQ with an increased backlog even though
128  *	the transport is already bound. This is needed to avoid loosing the
129  *	port number should listen() do a T_UNBIND_REQ followed by a
130  *	O_T_BIND_REQ.
131  *
132  * soconnect_tpi_udp:
133  *	UDP and ICMP can handle a T_CONN_REQ.
134  *	This is needed to make the sequence of connect(), getsockname()
135  *	return the local IP address used to send packets to the connected to
136  *	destination.
137  *
138  * soconnect_tpi_tcp:
139  *	TCP can handle a T_CONN_REQ without seeing a O_T_BIND_REQ.
140  *	Set this to non-zero to send TPI conformant messages to TCP in this
141  *	respect. This is a performance optimization.
142  *
143  * soaccept_tpi_tcp:
144  *	TCP can handle a T_CONN_REQ without the acceptor being bound.
145  *	This is a performance optimization that has been picked up in XTI.
146  *
147  * soaccept_tpi_multioptions:
148  *	When inheriting SOL_SOCKET options from the listener to the accepting
149  *	socket send them as a single message for AF_INET{,6}.
150  */
151 int solisten_tpi_tcp = 0;
152 int soconnect_tpi_udp = 0;
153 int soconnect_tpi_tcp = 0;
154 int soaccept_tpi_tcp = 0;
155 int soaccept_tpi_multioptions = 1;
156 #else /* SOCK_TEST */
157 #define	soconnect_tpi_tcp	0
158 #define	soconnect_tpi_udp	0
159 #define	solisten_tpi_tcp	0
160 #define	soaccept_tpi_tcp	0
161 #define	soaccept_tpi_multioptions	1
162 #endif /* SOCK_TEST */
163 
164 #ifdef SOCK_TEST
165 extern int do_useracc;
166 extern clock_t sock_test_timelimit;
167 #endif /* SOCK_TEST */
168 
169 extern uint32_t ucredsize;
170 
171 /*
172  * Some X/Open added checks might have to be backed out to keep SunOS 4.X
173  * applications working. Turn on this flag to disable these checks.
174  */
175 int xnet_skip_checks = 0;
176 int xnet_check_print = 0;
177 int xnet_truncate_print = 0;
178 
179 static void sotpi_destroy(struct sonode *);
180 static struct sonode *sotpi_create(struct sockparams *, int, int, int, int,
181     int, int *, cred_t *cr);
182 
183 static boolean_t	sotpi_info_create(struct sonode *, int);
184 static void		sotpi_info_init(struct sonode *);
185 static void 		sotpi_info_fini(struct sonode *);
186 static void 		sotpi_info_destroy(struct sonode *);
187 
188 /*
189  * Do direct function call to the transport layer below; this would
190  * also allow the transport to utilize read-side synchronous stream
191  * interface if necessary.  This is a /etc/system tunable that must
192  * not be modified on a running system.  By default this is enabled
193  * for performance reasons and may be disabled for debugging purposes.
194  */
195 boolean_t socktpi_direct = B_TRUE;
196 
197 static struct kmem_cache *socktpi_cache, *socktpi_unix_cache;
198 
199 extern	void sigintr(k_sigset_t *, int);
200 extern	void sigunintr(k_sigset_t *);
201 
202 static int	sotpi_unbind(struct sonode *, int);
203 
204 /* TPI sockfs sonode operations */
205 int 		sotpi_init(struct sonode *, struct sonode *, struct cred *,
206 		    int);
207 static int	sotpi_accept(struct sonode *, int, struct cred *,
208 		    struct sonode **);
209 static int	sotpi_bind(struct sonode *, struct sockaddr *, socklen_t,
210 		    int, struct cred *);
211 static int	sotpi_listen(struct sonode *, int, struct cred *);
212 static int	sotpi_connect(struct sonode *, struct sockaddr *,
213 		    socklen_t, int, int, struct cred *);
214 extern int	sotpi_recvmsg(struct sonode *, struct nmsghdr *,
215 		    struct uio *, struct cred *);
216 static int	sotpi_sendmsg(struct sonode *, struct nmsghdr *,
217 		    struct uio *, struct cred *);
218 static int	sotpi_sendmblk(struct sonode *, struct nmsghdr *, int,
219 		    struct cred *, mblk_t **);
220 static int	sosend_dgramcmsg(struct sonode *, struct sockaddr *, socklen_t,
221 		    struct uio *, void *, t_uscalar_t, int);
222 static int	sodgram_direct(struct sonode *, struct sockaddr *,
223 		    socklen_t, struct uio *, int);
224 extern int	sotpi_getpeername(struct sonode *, struct sockaddr *,
225 		    socklen_t *, boolean_t, struct cred *);
226 static int	sotpi_getsockname(struct sonode *, struct sockaddr *,
227 		    socklen_t *, struct cred *);
228 static int	sotpi_shutdown(struct sonode *, int, struct cred *);
229 extern int	sotpi_getsockopt(struct sonode *, int, int, void *,
230 		    socklen_t *, int, struct cred *);
231 extern int	sotpi_setsockopt(struct sonode *, int, int, const void *,
232 		    socklen_t, struct cred *);
233 static int 	sotpi_ioctl(struct sonode *, int, intptr_t, int, struct cred *,
234 		    int32_t *);
235 static int 	socktpi_plumbioctl(struct vnode *, int, intptr_t, int,
236 		    struct cred *, int32_t *);
237 static int 	sotpi_poll(struct sonode *, short, int, short *,
238 		    struct pollhead **);
239 static int 	sotpi_close(struct sonode *, int, struct cred *);
240 
241 static int	i_sotpi_info_constructor(sotpi_info_t *);
242 static void 	i_sotpi_info_destructor(sotpi_info_t *);
243 
244 sonodeops_t sotpi_sonodeops = {
245 	sotpi_init,		/* sop_init		*/
246 	sotpi_accept,		/* sop_accept		*/
247 	sotpi_bind,		/* sop_bind		*/
248 	sotpi_listen,		/* sop_listen		*/
249 	sotpi_connect,		/* sop_connect		*/
250 	sotpi_recvmsg,		/* sop_recvmsg		*/
251 	sotpi_sendmsg,		/* sop_sendmsg		*/
252 	sotpi_sendmblk,		/* sop_sendmblk		*/
253 	sotpi_getpeername,	/* sop_getpeername	*/
254 	sotpi_getsockname,	/* sop_getsockname	*/
255 	sotpi_shutdown,		/* sop_shutdown		*/
256 	sotpi_getsockopt,	/* sop_getsockopt	*/
257 	sotpi_setsockopt,	/* sop_setsockopt	*/
258 	sotpi_ioctl,		/* sop_ioctl		*/
259 	sotpi_poll,		/* sop_poll		*/
260 	sotpi_close,		/* sop_close		*/
261 };
262 
263 /*
264  * Return a TPI socket vnode.
265  *
266  * Note that sockets assume that the driver will clone (either itself
267  * or by using the clone driver) i.e. a socket() call will always
268  * result in a new vnode being created.
269  */
270 
271 /*
272  * Common create code for socket and accept. If tso is set the values
273  * from that node is used instead of issuing a T_INFO_REQ.
274  */
275 
276 /* ARGSUSED */
277 static struct sonode *
278 sotpi_create(struct sockparams *sp, int family, int type, int protocol,
279     int version, int sflags, int *errorp, cred_t *cr)
280 {
281 	struct sonode	*so;
282 	kmem_cache_t 	*cp;
283 	int		sfamily = family;
284 
285 	ASSERT(sp->sp_sdev_info.sd_vnode != NULL);
286 
287 	if (family == AF_NCA) {
288 		/*
289 		 * The request is for an NCA socket so for NL7C use the
290 		 * INET domain instead and mark NL7C_AF_NCA below.
291 		 */
292 		family = AF_INET;
293 		/*
294 		 * NL7C is not supported in the non-global zone,
295 		 * we enforce this restriction here.
296 		 */
297 		if (getzoneid() != GLOBAL_ZONEID) {
298 			*errorp = ENOTSUP;
299 			return (NULL);
300 		}
301 	}
302 
303 	/*
304 	 * to be compatible with old tpi socket implementation ignore
305 	 * sleep flag (sflags) passed in
306 	 */
307 	cp = (family == AF_UNIX) ? socktpi_unix_cache : socktpi_cache;
308 	so = kmem_cache_alloc(cp, KM_SLEEP);
309 	if (so == NULL) {
310 		*errorp = ENOMEM;
311 		return (NULL);
312 	}
313 
314 	sonode_init(so, sp, family, type, protocol, &sotpi_sonodeops);
315 	sotpi_info_init(so);
316 
317 	if (sfamily == AF_NCA) {
318 		SOTOTPI(so)->sti_nl7c_flags = NL7C_AF_NCA;
319 	}
320 
321 	if (version == SOV_DEFAULT)
322 		version = so_default_version;
323 
324 	so->so_version = (short)version;
325 	*errorp = 0;
326 
327 	return (so);
328 }
329 
330 static void
331 sotpi_destroy(struct sonode *so)
332 {
333 	kmem_cache_t *cp;
334 	struct sockparams *origsp;
335 
336 	/*
337 	 * If there is a new dealloc function (ie. smod_destroy_func),
338 	 * then it should check the correctness of the ops.
339 	 */
340 
341 	ASSERT(so->so_ops == &sotpi_sonodeops);
342 
343 	origsp = SOTOTPI(so)->sti_orig_sp;
344 
345 	sotpi_info_fini(so);
346 
347 	if (so->so_state & SS_FALLBACK_COMP) {
348 		/*
349 		 * A fallback happend, which means that a sotpi_info_t struct
350 		 * was allocated (as opposed to being allocated from the TPI
351 		 * sonode cache. Therefore we explicitly free the struct
352 		 * here.
353 		 */
354 		sotpi_info_destroy(so);
355 		ASSERT(origsp != NULL);
356 
357 		origsp->sp_smod_info->smod_sock_destroy_func(so);
358 		SOCKPARAMS_DEC_REF(origsp);
359 	} else {
360 		sonode_fini(so);
361 		cp = (so->so_family == AF_UNIX) ? socktpi_unix_cache :
362 		    socktpi_cache;
363 		kmem_cache_free(cp, so);
364 	}
365 }
366 
367 /* ARGSUSED1 */
368 int
369 sotpi_init(struct sonode *so, struct sonode *tso, struct cred *cr, int flags)
370 {
371 	major_t maj;
372 	dev_t newdev;
373 	struct vnode *vp;
374 	int error = 0;
375 	struct stdata *stp;
376 
377 	sotpi_info_t *sti = SOTOTPI(so);
378 
379 	dprint(1, ("sotpi_init()\n"));
380 
381 	/*
382 	 * over write the sleep flag passed in but that is ok
383 	 * as tpi socket does not honor sleep flag.
384 	 */
385 	flags |= FREAD|FWRITE;
386 
387 	/*
388 	 * Record in so_flag that it is a clone.
389 	 */
390 	if (getmajor(sti->sti_dev) == clone_major)
391 		so->so_flag |= SOCLONE;
392 
393 	if ((so->so_type == SOCK_STREAM || so->so_type == SOCK_DGRAM) &&
394 	    (so->so_family == AF_INET || so->so_family == AF_INET6) &&
395 	    (so->so_protocol == IPPROTO_TCP || so->so_protocol == IPPROTO_UDP ||
396 	    so->so_protocol == IPPROTO_IP)) {
397 		/* Tell tcp or udp that it's talking to sockets */
398 		flags |= SO_SOCKSTR;
399 
400 		/*
401 		 * Here we indicate to socktpi_open() our attempt to
402 		 * make direct calls between sockfs and transport.
403 		 * The final decision is left to socktpi_open().
404 		 */
405 		sti->sti_direct = 1;
406 
407 		ASSERT(so->so_type != SOCK_DGRAM || tso == NULL);
408 		if (so->so_type == SOCK_STREAM && tso != NULL) {
409 			if (SOTOTPI(tso)->sti_direct) {
410 				/*
411 				 * Inherit sti_direct from listener and pass
412 				 * SO_ACCEPTOR open flag to tcp, indicating
413 				 * that this is an accept fast-path instance.
414 				 */
415 				flags |= SO_ACCEPTOR;
416 			} else {
417 				/*
418 				 * sti_direct is not set on listener, meaning
419 				 * that the listener has been converted from
420 				 * a socket to a stream.  Ensure that the
421 				 * acceptor inherits these settings.
422 				 */
423 				sti->sti_direct = 0;
424 				flags &= ~SO_SOCKSTR;
425 			}
426 		}
427 	}
428 
429 	/*
430 	 * Tell local transport that it is talking to sockets.
431 	 */
432 	if (so->so_family == AF_UNIX) {
433 		flags |= SO_SOCKSTR;
434 	}
435 
436 	vp = SOTOV(so);
437 	newdev = vp->v_rdev;
438 	maj = getmajor(newdev);
439 	ASSERT(STREAMSTAB(maj));
440 
441 	error = stropen(vp, &newdev, flags, cr);
442 
443 	stp = vp->v_stream;
444 	if (error == 0) {
445 		if (so->so_flag & SOCLONE)
446 			ASSERT(newdev != vp->v_rdev);
447 		mutex_enter(&so->so_lock);
448 		sti->sti_dev = newdev;
449 		vp->v_rdev = newdev;
450 		mutex_exit(&so->so_lock);
451 
452 		if (stp->sd_flag & STRISTTY) {
453 			/*
454 			 * this is a post SVR4 tty driver - a socket can not
455 			 * be a controlling terminal. Fail the open.
456 			 */
457 			(void) sotpi_close(so, flags, cr);
458 			return (ENOTTY);	/* XXX */
459 		}
460 
461 		ASSERT(stp->sd_wrq != NULL);
462 		sti->sti_provinfo = tpi_findprov(stp->sd_wrq);
463 
464 		/*
465 		 * If caller is interested in doing direct function call
466 		 * interface to/from transport module, probe the module
467 		 * directly beneath the streamhead to see if it qualifies.
468 		 *
469 		 * We turn off the direct interface when qualifications fail.
470 		 * In the acceptor case, we simply turn off the sti_direct
471 		 * flag on the socket. We do the fallback after the accept
472 		 * has completed, before the new socket is returned to the
473 		 * application.
474 		 */
475 		if (sti->sti_direct) {
476 			queue_t *tq = stp->sd_wrq->q_next;
477 
478 			/*
479 			 * sti_direct is currently supported and tested
480 			 * only for tcp/udp; this is the main reason to
481 			 * have the following assertions.
482 			 */
483 			ASSERT(so->so_family == AF_INET ||
484 			    so->so_family == AF_INET6);
485 			ASSERT(so->so_protocol == IPPROTO_UDP ||
486 			    so->so_protocol == IPPROTO_TCP ||
487 			    so->so_protocol == IPPROTO_IP);
488 			ASSERT(so->so_type == SOCK_DGRAM ||
489 			    so->so_type == SOCK_STREAM);
490 
491 			/*
492 			 * Abort direct call interface if the module directly
493 			 * underneath the stream head is not defined with the
494 			 * _D_DIRECT flag.  This could happen in the tcp or
495 			 * udp case, when some other module is autopushed
496 			 * above it, or for some reasons the expected module
497 			 * isn't purely D_MP (which is the main requirement).
498 			 */
499 			if (!socktpi_direct || !(tq->q_flag & _QDIRECT) ||
500 			    !(_OTHERQ(tq)->q_flag & _QDIRECT)) {
501 				int rval;
502 
503 				/* Continue on without direct calls */
504 				sti->sti_direct = 0;
505 
506 				/*
507 				 * Cannot issue ioctl on fallback socket since
508 				 * there is no conn associated with the queue.
509 				 * The fallback downcall will notify the proto
510 				 * of the change.
511 				 */
512 				if (!(flags & SO_ACCEPTOR) &&
513 				    !(flags & SO_FALLBACK)) {
514 					if ((error = strioctl(vp,
515 					    _SIOCSOCKFALLBACK, 0, 0, K_TO_K,
516 					    cr, &rval)) != 0) {
517 						(void) sotpi_close(so, flags,
518 						    cr);
519 						return (error);
520 					}
521 				}
522 			}
523 		}
524 
525 		if (flags & SO_FALLBACK) {
526 			/*
527 			 * The stream created does not have a conn.
528 			 * do stream set up after conn has been assigned
529 			 */
530 			return (error);
531 		}
532 		if (error = so_strinit(so, tso)) {
533 			(void) sotpi_close(so, flags, cr);
534 			return (error);
535 		}
536 
537 		/* Enable sendfile() on AF_UNIX streams */
538 		if (so->so_family == AF_UNIX && so->so_type == SOCK_STREAM) {
539 			mutex_enter(&so->so_lock);
540 			so->so_mode |= SM_SENDFILESUPP;
541 			mutex_exit(&so->so_lock);
542 		}
543 
544 		/* Wildcard */
545 		if (so->so_protocol != so->so_sockparams->sp_protocol) {
546 			int protocol = so->so_protocol;
547 			/*
548 			 * Issue SO_PROTOTYPE setsockopt.
549 			 */
550 			error = sotpi_setsockopt(so, SOL_SOCKET, SO_PROTOTYPE,
551 			    &protocol, (t_uscalar_t)sizeof (protocol), cr);
552 			if (error != 0) {
553 				(void) sotpi_close(so, flags, cr);
554 				/*
555 				 * Setsockopt often fails with ENOPROTOOPT but
556 				 * socket() should fail with
557 				 * EPROTONOSUPPORT/EPROTOTYPE.
558 				 */
559 				return (EPROTONOSUPPORT);
560 			}
561 		}
562 
563 	} else {
564 		/*
565 		 * While the same socket can not be reopened (unlike specfs)
566 		 * the stream head sets STREOPENFAIL when the autopush fails.
567 		 */
568 		if ((stp != NULL) &&
569 		    (stp->sd_flag & STREOPENFAIL)) {
570 			/*
571 			 * Open failed part way through.
572 			 */
573 			mutex_enter(&stp->sd_lock);
574 			stp->sd_flag &= ~STREOPENFAIL;
575 			mutex_exit(&stp->sd_lock);
576 			(void) sotpi_close(so, flags, cr);
577 			return (error);
578 			/*NOTREACHED*/
579 		}
580 		ASSERT(stp == NULL);
581 	}
582 	TRACE_4(TR_FAC_SOCKFS, TR_SOCKFS_OPEN,
583 	    "sockfs open:maj %d vp %p so %p error %d",
584 	    maj, vp, so, error);
585 	return (error);
586 }
587 
588 /*
589  * Bind the socket to an unspecified address in sockfs only.
590  * Used for TCP/UDP transports where we know that the O_T_BIND_REQ isn't
591  * required in all cases.
592  */
593 static void
594 so_automatic_bind(struct sonode *so)
595 {
596 	sotpi_info_t *sti = SOTOTPI(so);
597 	ASSERT(so->so_family == AF_INET || so->so_family == AF_INET6);
598 
599 	ASSERT(MUTEX_HELD(&so->so_lock));
600 	ASSERT(!(so->so_state & SS_ISBOUND));
601 	ASSERT(sti->sti_unbind_mp);
602 
603 	ASSERT(sti->sti_laddr_len <= sti->sti_laddr_maxlen);
604 	bzero(sti->sti_laddr_sa, sti->sti_laddr_len);
605 	sti->sti_laddr_sa->sa_family = so->so_family;
606 	so->so_state |= SS_ISBOUND;
607 }
608 
609 
610 /*
611  * bind the socket.
612  *
613  * If the socket is already bound and none of _SOBIND_SOCKBSD or _SOBIND_XPG4_2
614  * are passed in we allow rebinding. Note that for backwards compatibility
615  * even "svr4" sockets pass in _SOBIND_SOCKBSD/SOV_SOCKBSD to sobind/bind.
616  * Thus the rebinding code is currently not executed.
617  *
618  * The constraints for rebinding are:
619  * - it is a SOCK_DGRAM, or
620  * - it is a SOCK_STREAM/SOCK_SEQPACKET that has not been connected
621  *   and no listen() has been done.
622  * This rebinding code was added based on some language in the XNET book
623  * about not returning EINVAL it the protocol allows rebinding. However,
624  * this language is not present in the Posix socket draft. Thus maybe the
625  * rebinding logic should be deleted from the source.
626  *
627  * A null "name" can be used to unbind the socket if:
628  * - it is a SOCK_DGRAM, or
629  * - it is a SOCK_STREAM/SOCK_SEQPACKET that has not been connected
630  *   and no listen() has been done.
631  */
632 /* ARGSUSED */
633 static int
634 sotpi_bindlisten(struct sonode *so, struct sockaddr *name,
635     socklen_t namelen, int backlog, int flags, struct cred *cr)
636 {
637 	struct T_bind_req	bind_req;
638 	struct T_bind_ack	*bind_ack;
639 	int			error = 0;
640 	mblk_t			*mp;
641 	void			*addr;
642 	t_uscalar_t		addrlen;
643 	int			unbind_on_err = 1;
644 	boolean_t		clear_acceptconn_on_err = B_FALSE;
645 	boolean_t		restore_backlog_on_err = B_FALSE;
646 	int			save_so_backlog;
647 	t_scalar_t		PRIM_type = O_T_BIND_REQ;
648 	boolean_t		tcp_udp_xport;
649 	void			*nl7c = NULL;
650 	sotpi_info_t		*sti = SOTOTPI(so);
651 
652 	dprintso(so, 1, ("sotpi_bindlisten(%p, %p, %d, %d, 0x%x) %s\n",
653 	    (void *)so, (void *)name, namelen, backlog, flags,
654 	    pr_state(so->so_state, so->so_mode)));
655 
656 	tcp_udp_xport = so->so_type == SOCK_STREAM || so->so_type == SOCK_DGRAM;
657 
658 	if (!(flags & _SOBIND_LOCK_HELD)) {
659 		mutex_enter(&so->so_lock);
660 		so_lock_single(so);	/* Set SOLOCKED */
661 	} else {
662 		ASSERT(MUTEX_HELD(&so->so_lock));
663 		ASSERT(so->so_flag & SOLOCKED);
664 	}
665 
666 	/*
667 	 * Make sure that there is a preallocated unbind_req message
668 	 * before binding. This message allocated when the socket is
669 	 * created  but it might be have been consumed.
670 	 */
671 	if (sti->sti_unbind_mp == NULL) {
672 		dprintso(so, 1, ("sobind: allocating unbind_req\n"));
673 		/* NOTE: holding so_lock while sleeping */
674 		sti->sti_unbind_mp =
675 		    soallocproto(sizeof (struct T_unbind_req), _ALLOC_SLEEP,
676 		    cr);
677 	}
678 
679 	if (flags & _SOBIND_REBIND) {
680 		/*
681 		 * Called from solisten after doing an sotpi_unbind() or
682 		 * potentially without the unbind (latter for AF_INET{,6}).
683 		 */
684 		ASSERT(name == NULL && namelen == 0);
685 
686 		if (so->so_family == AF_UNIX) {
687 			ASSERT(sti->sti_ux_bound_vp);
688 			addr = &sti->sti_ux_laddr;
689 			addrlen = (t_uscalar_t)sizeof (sti->sti_ux_laddr);
690 			dprintso(so, 1, ("sobind rebind UNIX: addrlen %d, "
691 			    "addr 0x%p, vp %p\n",
692 			    addrlen,
693 			    (void *)((struct so_ux_addr *)addr)->soua_vp,
694 			    (void *)sti->sti_ux_bound_vp));
695 		} else {
696 			addr = sti->sti_laddr_sa;
697 			addrlen = (t_uscalar_t)sti->sti_laddr_len;
698 		}
699 	} else if (flags & _SOBIND_UNSPEC) {
700 		ASSERT(name == NULL && namelen == 0);
701 
702 		/*
703 		 * The caller checked SS_ISBOUND but not necessarily
704 		 * under so_lock
705 		 */
706 		if (so->so_state & SS_ISBOUND) {
707 			/* No error */
708 			goto done;
709 		}
710 
711 		/* Set an initial local address */
712 		switch (so->so_family) {
713 		case AF_UNIX:
714 			/*
715 			 * Use an address with same size as struct sockaddr
716 			 * just like BSD.
717 			 */
718 			sti->sti_laddr_len =
719 			    (socklen_t)sizeof (struct sockaddr);
720 			ASSERT(sti->sti_laddr_len <= sti->sti_laddr_maxlen);
721 			bzero(sti->sti_laddr_sa, sti->sti_laddr_len);
722 			sti->sti_laddr_sa->sa_family = so->so_family;
723 
724 			/*
725 			 * Pass down an address with the implicit bind
726 			 * magic number and the rest all zeros.
727 			 * The transport will return a unique address.
728 			 */
729 			sti->sti_ux_laddr.soua_vp = NULL;
730 			sti->sti_ux_laddr.soua_magic = SOU_MAGIC_IMPLICIT;
731 			addr = &sti->sti_ux_laddr;
732 			addrlen = (t_uscalar_t)sizeof (sti->sti_ux_laddr);
733 			break;
734 
735 		case AF_INET:
736 		case AF_INET6:
737 			/*
738 			 * An unspecified bind in TPI has a NULL address.
739 			 * Set the address in sockfs to have the sa_family.
740 			 */
741 			sti->sti_laddr_len = (so->so_family == AF_INET) ?
742 			    (socklen_t)sizeof (sin_t) :
743 			    (socklen_t)sizeof (sin6_t);
744 			ASSERT(sti->sti_laddr_len <= sti->sti_laddr_maxlen);
745 			bzero(sti->sti_laddr_sa, sti->sti_laddr_len);
746 			sti->sti_laddr_sa->sa_family = so->so_family;
747 			addr = NULL;
748 			addrlen = 0;
749 			break;
750 
751 		default:
752 			/*
753 			 * An unspecified bind in TPI has a NULL address.
754 			 * Set the address in sockfs to be zero length.
755 			 *
756 			 * Can not assume there is a sa_family for all
757 			 * protocol families. For example, AF_X25 does not
758 			 * have a family field.
759 			 */
760 			bzero(sti->sti_laddr_sa, sti->sti_laddr_len);
761 			sti->sti_laddr_len = 0;	/* XXX correct? */
762 			addr = NULL;
763 			addrlen = 0;
764 			break;
765 		}
766 
767 	} else {
768 		if (so->so_state & SS_ISBOUND) {
769 			/*
770 			 * If it is ok to rebind the socket, first unbind
771 			 * with the transport. A rebind to the NULL address
772 			 * is interpreted as an unbind.
773 			 * Note that a bind to NULL in BSD does unbind the
774 			 * socket but it fails with EINVAL.
775 			 * Note that regular sockets set SOV_SOCKBSD i.e.
776 			 * _SOBIND_SOCKBSD gets set here hence no type of
777 			 * socket does currently allow rebinding.
778 			 *
779 			 * If the name is NULL just do an unbind.
780 			 */
781 			if (flags & (_SOBIND_SOCKBSD|_SOBIND_XPG4_2) &&
782 			    name != NULL) {
783 				error = EINVAL;
784 				unbind_on_err = 0;
785 				eprintsoline(so, error);
786 				goto done;
787 			}
788 			if ((so->so_mode & SM_CONNREQUIRED) &&
789 			    (so->so_state & SS_CANTREBIND)) {
790 				error = EINVAL;
791 				unbind_on_err = 0;
792 				eprintsoline(so, error);
793 				goto done;
794 			}
795 			error = sotpi_unbind(so, 0);
796 			if (error) {
797 				eprintsoline(so, error);
798 				goto done;
799 			}
800 			ASSERT(!(so->so_state & SS_ISBOUND));
801 			if (name == NULL) {
802 				so->so_state &=
803 				    ~(SS_ISCONNECTED|SS_ISCONNECTING);
804 				goto done;
805 			}
806 		}
807 
808 		/* X/Open requires this check */
809 		if ((so->so_state & SS_CANTSENDMORE) && !xnet_skip_checks) {
810 			if (xnet_check_print) {
811 				printf("sockfs: X/Open bind state check "
812 				    "caused EINVAL\n");
813 			}
814 			error = EINVAL;
815 			goto done;
816 		}
817 
818 		switch (so->so_family) {
819 		case AF_UNIX:
820 			/*
821 			 * All AF_UNIX addresses are nul terminated
822 			 * when copied (copyin_name) in so the minimum
823 			 * length is 3 bytes.
824 			 */
825 			if (name == NULL ||
826 			    (ssize_t)namelen <= sizeof (short) + 1) {
827 				error = EISDIR;
828 				eprintsoline(so, error);
829 				goto done;
830 			}
831 			/*
832 			 * Verify so_family matches the bound family.
833 			 * BSD does not check this for AF_UNIX resulting
834 			 * in funny mknods.
835 			 */
836 			if (name->sa_family != so->so_family) {
837 				error = EAFNOSUPPORT;
838 				goto done;
839 			}
840 			break;
841 		case AF_INET:
842 			if (name == NULL) {
843 				error = EINVAL;
844 				eprintsoline(so, error);
845 				goto done;
846 			}
847 			if ((size_t)namelen != sizeof (sin_t)) {
848 				error = name->sa_family != so->so_family ?
849 				    EAFNOSUPPORT : EINVAL;
850 				eprintsoline(so, error);
851 				goto done;
852 			}
853 			if ((flags & _SOBIND_XPG4_2) &&
854 			    (name->sa_family != so->so_family)) {
855 				/*
856 				 * This check has to be made for X/Open
857 				 * sockets however application failures have
858 				 * been observed when it is applied to
859 				 * all sockets.
860 				 */
861 				error = EAFNOSUPPORT;
862 				eprintsoline(so, error);
863 				goto done;
864 			}
865 			/*
866 			 * Force a zero sa_family to match so_family.
867 			 *
868 			 * Some programs like inetd(1M) don't set the
869 			 * family field. Other programs leave
870 			 * sin_family set to garbage - SunOS 4.X does
871 			 * not check the family field on a bind.
872 			 * We use the family field that
873 			 * was passed in to the socket() call.
874 			 */
875 			name->sa_family = so->so_family;
876 			break;
877 
878 		case AF_INET6: {
879 #ifdef DEBUG
880 			sin6_t *sin6 = (sin6_t *)name;
881 #endif /* DEBUG */
882 
883 			if (name == NULL) {
884 				error = EINVAL;
885 				eprintsoline(so, error);
886 				goto done;
887 			}
888 			if ((size_t)namelen != sizeof (sin6_t)) {
889 				error = name->sa_family != so->so_family ?
890 				    EAFNOSUPPORT : EINVAL;
891 				eprintsoline(so, error);
892 				goto done;
893 			}
894 			if (name->sa_family != so->so_family) {
895 				/*
896 				 * With IPv6 we require the family to match
897 				 * unlike in IPv4.
898 				 */
899 				error = EAFNOSUPPORT;
900 				eprintsoline(so, error);
901 				goto done;
902 			}
903 #ifdef DEBUG
904 			/*
905 			 * Verify that apps don't forget to clear
906 			 * sin6_scope_id etc
907 			 */
908 			if (sin6->sin6_scope_id != 0 &&
909 			    !IN6_IS_ADDR_LINKSCOPE(&sin6->sin6_addr)) {
910 				zcmn_err(getzoneid(), CE_WARN,
911 				    "bind with uninitialized sin6_scope_id "
912 				    "(%d) on socket. Pid = %d\n",
913 				    (int)sin6->sin6_scope_id,
914 				    (int)curproc->p_pid);
915 			}
916 			if (sin6->__sin6_src_id != 0) {
917 				zcmn_err(getzoneid(), CE_WARN,
918 				    "bind with uninitialized __sin6_src_id "
919 				    "(%d) on socket. Pid = %d\n",
920 				    (int)sin6->__sin6_src_id,
921 				    (int)curproc->p_pid);
922 			}
923 #endif /* DEBUG */
924 			break;
925 		}
926 		default:
927 			/*
928 			 * Don't do any length or sa_family check to allow
929 			 * non-sockaddr style addresses.
930 			 */
931 			if (name == NULL) {
932 				error = EINVAL;
933 				eprintsoline(so, error);
934 				goto done;
935 			}
936 			break;
937 		}
938 
939 		if (namelen > (t_uscalar_t)sti->sti_laddr_maxlen) {
940 			error = ENAMETOOLONG;
941 			eprintsoline(so, error);
942 			goto done;
943 		}
944 		/*
945 		 * Save local address.
946 		 */
947 		sti->sti_laddr_len = (socklen_t)namelen;
948 		ASSERT(sti->sti_laddr_len <= sti->sti_laddr_maxlen);
949 		bcopy(name, sti->sti_laddr_sa, namelen);
950 
951 		addr = sti->sti_laddr_sa;
952 		addrlen = (t_uscalar_t)sti->sti_laddr_len;
953 		switch (so->so_family) {
954 		case AF_INET6:
955 		case AF_INET:
956 			break;
957 		case AF_UNIX: {
958 			struct sockaddr_un *soun =
959 			    (struct sockaddr_un *)sti->sti_laddr_sa;
960 			struct vnode *vp, *rvp;
961 			struct vattr vattr;
962 
963 			ASSERT(sti->sti_ux_bound_vp == NULL);
964 			/*
965 			 * Create vnode for the specified path name.
966 			 * Keep vnode held with a reference in sti_ux_bound_vp.
967 			 * Use the vnode pointer as the address used in the
968 			 * bind with the transport.
969 			 *
970 			 * Use the same mode as in BSD. In particular this does
971 			 * not observe the umask.
972 			 */
973 			/* MAXPATHLEN + soun_family + nul termination */
974 			if (sti->sti_laddr_len >
975 			    (socklen_t)(MAXPATHLEN + sizeof (short) + 1)) {
976 				error = ENAMETOOLONG;
977 				eprintsoline(so, error);
978 				goto done;
979 			}
980 			vattr.va_type = VSOCK;
981 			vattr.va_mode = 0777 & ~PTOU(curproc)->u_cmask;
982 			vattr.va_mask = AT_TYPE|AT_MODE;
983 			/* NOTE: holding so_lock */
984 			error = vn_create(soun->sun_path, UIO_SYSSPACE, &vattr,
985 			    EXCL, 0, &vp, CRMKNOD, 0, 0);
986 			if (error) {
987 				if (error == EEXIST)
988 					error = EADDRINUSE;
989 				eprintsoline(so, error);
990 				goto done;
991 			}
992 			/*
993 			 * Establish pointer from the underlying filesystem
994 			 * vnode to the socket node.
995 			 * sti_ux_bound_vp and v_stream->sd_vnode form the
996 			 * cross-linkage between the underlying filesystem
997 			 * node and the socket node.
998 			 */
999 
1000 			if ((VOP_REALVP(vp, &rvp, NULL) == 0) && (vp != rvp)) {
1001 				VN_HOLD(rvp);
1002 				VN_RELE(vp);
1003 				vp = rvp;
1004 			}
1005 
1006 			ASSERT(SOTOV(so)->v_stream);
1007 			mutex_enter(&vp->v_lock);
1008 			vp->v_stream = SOTOV(so)->v_stream;
1009 			sti->sti_ux_bound_vp = vp;
1010 			mutex_exit(&vp->v_lock);
1011 
1012 			/*
1013 			 * Use the vnode pointer value as a unique address
1014 			 * (together with the magic number to avoid conflicts
1015 			 * with implicit binds) in the transport provider.
1016 			 */
1017 			sti->sti_ux_laddr.soua_vp =
1018 			    (void *)sti->sti_ux_bound_vp;
1019 			sti->sti_ux_laddr.soua_magic = SOU_MAGIC_EXPLICIT;
1020 			addr = &sti->sti_ux_laddr;
1021 			addrlen = (t_uscalar_t)sizeof (sti->sti_ux_laddr);
1022 			dprintso(so, 1, ("sobind UNIX: addrlen %d, addr %p\n",
1023 			    addrlen,
1024 			    (void *)((struct so_ux_addr *)addr)->soua_vp));
1025 			break;
1026 		}
1027 		} /* end switch (so->so_family) */
1028 	}
1029 
1030 	/*
1031 	 * set SS_ACCEPTCONN before sending down O_T_BIND_REQ since
1032 	 * the transport can start passing up T_CONN_IND messages
1033 	 * as soon as it receives the bind req and strsock_proto()
1034 	 * insists that SS_ACCEPTCONN is set when processing T_CONN_INDs.
1035 	 */
1036 	if (flags & _SOBIND_LISTEN) {
1037 		if ((so->so_state & SS_ACCEPTCONN) == 0)
1038 			clear_acceptconn_on_err = B_TRUE;
1039 		save_so_backlog = so->so_backlog;
1040 		restore_backlog_on_err = B_TRUE;
1041 		so->so_state |= SS_ACCEPTCONN;
1042 		so->so_backlog = backlog;
1043 	}
1044 
1045 	/*
1046 	 * If NL7C addr(s) have been configured check for addr/port match,
1047 	 * or if an implicit NL7C socket via AF_NCA mark socket as NL7C.
1048 	 *
1049 	 * NL7C supports the TCP transport only so check AF_INET and AF_INET6
1050 	 * family sockets only. If match mark as such.
1051 	 */
1052 	if (nl7c_enabled && ((addr != NULL &&
1053 	    (so->so_family == AF_INET || so->so_family == AF_INET6) &&
1054 	    (nl7c = nl7c_lookup_addr(addr, addrlen))) ||
1055 	    sti->sti_nl7c_flags == NL7C_AF_NCA)) {
1056 		/*
1057 		 * NL7C is not supported in non-global zones,
1058 		 * we enforce this restriction here.
1059 		 */
1060 		if (so->so_zoneid == GLOBAL_ZONEID) {
1061 			/* An NL7C socket, mark it */
1062 			sti->sti_nl7c_flags |= NL7C_ENABLED;
1063 			if (nl7c == NULL) {
1064 				/*
1065 				 * Was an AF_NCA bind() so add it to the
1066 				 * addr list for reporting purposes.
1067 				 */
1068 				nl7c = nl7c_add_addr(addr, addrlen);
1069 			}
1070 		} else
1071 			nl7c = NULL;
1072 	}
1073 
1074 	/*
1075 	 * We send a T_BIND_REQ for TCP/UDP since we know it supports it,
1076 	 * for other transports we will send in a O_T_BIND_REQ.
1077 	 */
1078 	if (tcp_udp_xport &&
1079 	    (so->so_family == AF_INET || so->so_family == AF_INET6))
1080 		PRIM_type = T_BIND_REQ;
1081 
1082 	bind_req.PRIM_type = PRIM_type;
1083 	bind_req.ADDR_length = addrlen;
1084 	bind_req.ADDR_offset = (t_scalar_t)sizeof (bind_req);
1085 	bind_req.CONIND_number = backlog;
1086 	/* NOTE: holding so_lock while sleeping */
1087 	mp = soallocproto2(&bind_req, sizeof (bind_req),
1088 	    addr, addrlen, 0, _ALLOC_SLEEP, cr);
1089 	sti->sti_laddr_valid = 0;
1090 
1091 	/* Done using sti_laddr_sa - can drop the lock */
1092 	mutex_exit(&so->so_lock);
1093 
1094 	error = kstrputmsg(SOTOV(so), mp, NULL, 0, 0,
1095 	    MSG_BAND|MSG_HOLDSIG|MSG_IGNERROR, 0);
1096 	if (error) {
1097 		eprintsoline(so, error);
1098 		mutex_enter(&so->so_lock);
1099 		goto done;
1100 	}
1101 
1102 	mutex_enter(&so->so_lock);
1103 	error = sowaitprim(so, PRIM_type, T_BIND_ACK,
1104 	    (t_uscalar_t)sizeof (*bind_ack), &mp, 0);
1105 	if (error) {
1106 		eprintsoline(so, error);
1107 		goto done;
1108 	}
1109 	ASSERT(mp);
1110 	/*
1111 	 * Even if some TPI message (e.g. T_DISCON_IND) was received in
1112 	 * strsock_proto while the lock was dropped above, the bind
1113 	 * is allowed to complete.
1114 	 */
1115 
1116 	/* Mark as bound. This will be undone if we detect errors below. */
1117 	if (flags & _SOBIND_NOXLATE) {
1118 		ASSERT(so->so_family == AF_UNIX);
1119 		sti->sti_faddr_noxlate = 1;
1120 	}
1121 	ASSERT(!(so->so_state & SS_ISBOUND) || (flags & _SOBIND_REBIND));
1122 	so->so_state |= SS_ISBOUND;
1123 	ASSERT(sti->sti_unbind_mp);
1124 
1125 	/* note that we've already set SS_ACCEPTCONN above */
1126 
1127 	/*
1128 	 * Recompute addrlen - an unspecied bind sent down an
1129 	 * address of length zero but we expect the appropriate length
1130 	 * in return.
1131 	 */
1132 	addrlen = (t_uscalar_t)(so->so_family == AF_UNIX ?
1133 	    sizeof (sti->sti_ux_laddr) : sti->sti_laddr_len);
1134 
1135 	bind_ack = (struct T_bind_ack *)mp->b_rptr;
1136 	/*
1137 	 * The alignment restriction is really too strict but
1138 	 * we want enough alignment to inspect the fields of
1139 	 * a sockaddr_in.
1140 	 */
1141 	addr = sogetoff(mp, bind_ack->ADDR_offset,
1142 	    bind_ack->ADDR_length,
1143 	    __TPI_ALIGN_SIZE);
1144 	if (addr == NULL) {
1145 		freemsg(mp);
1146 		error = EPROTO;
1147 		eprintsoline(so, error);
1148 		goto done;
1149 	}
1150 	if (!(flags & _SOBIND_UNSPEC)) {
1151 		/*
1152 		 * Verify that the transport didn't return something we
1153 		 * did not want e.g. an address other than what we asked for.
1154 		 *
1155 		 * NOTE: These checks would go away if/when we switch to
1156 		 * using the new TPI (in which the transport would fail
1157 		 * the request instead of assigning a different address).
1158 		 *
1159 		 * NOTE2: For protocols that we don't know (i.e. any
1160 		 * other than AF_INET6, AF_INET and AF_UNIX), we
1161 		 * cannot know if the transport should be expected to
1162 		 * return the same address as that requested.
1163 		 *
1164 		 * NOTE3: For AF_INET and AF_INET6, TCP/UDP, we send
1165 		 * down a T_BIND_REQ. We use O_T_BIND_REQ for others.
1166 		 *
1167 		 * For example, in the case of netatalk it may be
1168 		 * inappropriate for the transport to return the
1169 		 * requested address (as it may have allocated a local
1170 		 * port number in behaviour similar to that of an
1171 		 * AF_INET bind request with a port number of zero).
1172 		 *
1173 		 * Given the definition of O_T_BIND_REQ, where the
1174 		 * transport may bind to an address other than the
1175 		 * requested address, it's not possible to determine
1176 		 * whether a returned address that differs from the
1177 		 * requested address is a reason to fail (because the
1178 		 * requested address was not available) or succeed
1179 		 * (because the transport allocated an appropriate
1180 		 * address and/or port).
1181 		 *
1182 		 * sockfs currently requires that the transport return
1183 		 * the requested address in the T_BIND_ACK, unless
1184 		 * there is code here to allow for any discrepancy.
1185 		 * Such code exists for AF_INET and AF_INET6.
1186 		 *
1187 		 * Netatalk chooses to return the requested address
1188 		 * rather than the (correct) allocated address.  This
1189 		 * means that netatalk violates the TPI specification
1190 		 * (and would not function correctly if used from a
1191 		 * TLI application), but it does mean that it works
1192 		 * with sockfs.
1193 		 *
1194 		 * As noted above, using the newer XTI bind primitive
1195 		 * (T_BIND_REQ) in preference to O_T_BIND_REQ would
1196 		 * allow sockfs to be more sure about whether or not
1197 		 * the bind request had succeeded (as transports are
1198 		 * not permitted to bind to a different address than
1199 		 * that requested - they must return failure).
1200 		 * Unfortunately, support for T_BIND_REQ may not be
1201 		 * present in all transport implementations (netatalk,
1202 		 * for example, doesn't have it), making the
1203 		 * transition difficult.
1204 		 */
1205 		if (bind_ack->ADDR_length != addrlen) {
1206 			/* Assumes that the requested address was in use */
1207 			freemsg(mp);
1208 			error = EADDRINUSE;
1209 			eprintsoline(so, error);
1210 			goto done;
1211 		}
1212 
1213 		switch (so->so_family) {
1214 		case AF_INET6:
1215 		case AF_INET: {
1216 			sin_t *rname, *aname;
1217 
1218 			rname = (sin_t *)addr;
1219 			aname = (sin_t *)sti->sti_laddr_sa;
1220 
1221 			/*
1222 			 * Take advantage of the alignment
1223 			 * of sin_port and sin6_port which fall
1224 			 * in the same place in their data structures.
1225 			 * Just use sin_port for either address family.
1226 			 *
1227 			 * This may become a problem if (heaven forbid)
1228 			 * there's a separate ipv6port_reserved... :-P
1229 			 *
1230 			 * Binding to port 0 has the semantics of letting
1231 			 * the transport bind to any port.
1232 			 *
1233 			 * If the transport is TCP or UDP since we had sent
1234 			 * a T_BIND_REQ we would not get a port other than
1235 			 * what we asked for.
1236 			 */
1237 			if (tcp_udp_xport) {
1238 				/*
1239 				 * Pick up the new port number if we bound to
1240 				 * port 0.
1241 				 */
1242 				if (aname->sin_port == 0)
1243 					aname->sin_port = rname->sin_port;
1244 				sti->sti_laddr_valid = 1;
1245 				break;
1246 			}
1247 			if (aname->sin_port != 0 &&
1248 			    aname->sin_port != rname->sin_port) {
1249 				freemsg(mp);
1250 				error = EADDRINUSE;
1251 				eprintsoline(so, error);
1252 				goto done;
1253 			}
1254 			/*
1255 			 * Pick up the new port number if we bound to port 0.
1256 			 */
1257 			aname->sin_port = rname->sin_port;
1258 
1259 			/*
1260 			 * Unfortunately, addresses aren't _quite_ the same.
1261 			 */
1262 			if (so->so_family == AF_INET) {
1263 				if (aname->sin_addr.s_addr !=
1264 				    rname->sin_addr.s_addr) {
1265 					freemsg(mp);
1266 					error = EADDRNOTAVAIL;
1267 					eprintsoline(so, error);
1268 					goto done;
1269 				}
1270 			} else {
1271 				sin6_t *rname6 = (sin6_t *)rname;
1272 				sin6_t *aname6 = (sin6_t *)aname;
1273 
1274 				if (!IN6_ARE_ADDR_EQUAL(&aname6->sin6_addr,
1275 				    &rname6->sin6_addr)) {
1276 					freemsg(mp);
1277 					error = EADDRNOTAVAIL;
1278 					eprintsoline(so, error);
1279 					goto done;
1280 				}
1281 			}
1282 			break;
1283 		}
1284 		case AF_UNIX:
1285 			if (bcmp(addr, &sti->sti_ux_laddr, addrlen) != 0) {
1286 				freemsg(mp);
1287 				error = EADDRINUSE;
1288 				eprintsoline(so, error);
1289 				eprintso(so,
1290 				    ("addrlen %d, addr 0x%x, vp %p\n",
1291 				    addrlen, *((int *)addr),
1292 				    (void *)sti->sti_ux_bound_vp));
1293 				goto done;
1294 			}
1295 			sti->sti_laddr_valid = 1;
1296 			break;
1297 		default:
1298 			/*
1299 			 * NOTE: This assumes that addresses can be
1300 			 * byte-compared for equivalence.
1301 			 */
1302 			if (bcmp(addr, sti->sti_laddr_sa, addrlen) != 0) {
1303 				freemsg(mp);
1304 				error = EADDRINUSE;
1305 				eprintsoline(so, error);
1306 				goto done;
1307 			}
1308 			/*
1309 			 * Don't mark sti_laddr_valid, as we cannot be
1310 			 * sure that the returned address is the real
1311 			 * bound address when talking to an unknown
1312 			 * transport.
1313 			 */
1314 			break;
1315 		}
1316 	} else {
1317 		/*
1318 		 * Save for returned address for getsockname.
1319 		 * Needed for unspecific bind unless transport supports
1320 		 * the TI_GETMYNAME ioctl.
1321 		 * Do this for AF_INET{,6} even though they do, as
1322 		 * caching info here is much better performance than
1323 		 * a TPI/STREAMS trip to the transport for getsockname.
1324 		 * Any which can't for some reason _must_ _not_ set
1325 		 * sti_laddr_valid here for the caching version of
1326 		 * getsockname to not break;
1327 		 */
1328 		switch (so->so_family) {
1329 		case AF_UNIX:
1330 			/*
1331 			 * Record the address bound with the transport
1332 			 * for use by socketpair.
1333 			 */
1334 			bcopy(addr, &sti->sti_ux_laddr, addrlen);
1335 			sti->sti_laddr_valid = 1;
1336 			break;
1337 		case AF_INET:
1338 		case AF_INET6:
1339 			ASSERT(sti->sti_laddr_len <= sti->sti_laddr_maxlen);
1340 			bcopy(addr, sti->sti_laddr_sa, sti->sti_laddr_len);
1341 			sti->sti_laddr_valid = 1;
1342 			break;
1343 		default:
1344 			/*
1345 			 * Don't mark sti_laddr_valid, as we cannot be
1346 			 * sure that the returned address is the real
1347 			 * bound address when talking to an unknown
1348 			 * transport.
1349 			 */
1350 			break;
1351 		}
1352 	}
1353 
1354 	if (nl7c != NULL) {
1355 		/* Register listen()er sonode pointer with NL7C */
1356 		nl7c_listener_addr(nl7c, so);
1357 	}
1358 
1359 	freemsg(mp);
1360 
1361 done:
1362 	if (error) {
1363 		/* reset state & backlog to values held on entry */
1364 		if (clear_acceptconn_on_err == B_TRUE)
1365 			so->so_state &= ~SS_ACCEPTCONN;
1366 		if (restore_backlog_on_err == B_TRUE)
1367 			so->so_backlog = save_so_backlog;
1368 
1369 		if (unbind_on_err && so->so_state & SS_ISBOUND) {
1370 			int err;
1371 
1372 			err = sotpi_unbind(so, 0);
1373 			/* LINTED - statement has no consequent: if */
1374 			if (err) {
1375 				eprintsoline(so, error);
1376 			} else {
1377 				ASSERT(!(so->so_state & SS_ISBOUND));
1378 			}
1379 		}
1380 	}
1381 	if (!(flags & _SOBIND_LOCK_HELD)) {
1382 		so_unlock_single(so, SOLOCKED);
1383 		mutex_exit(&so->so_lock);
1384 	} else {
1385 		ASSERT(MUTEX_HELD(&so->so_lock));
1386 		ASSERT(so->so_flag & SOLOCKED);
1387 	}
1388 	return (error);
1389 }
1390 
1391 /* bind the socket */
1392 static int
1393 sotpi_bind(struct sonode *so, struct sockaddr *name, socklen_t namelen,
1394     int flags, struct cred *cr)
1395 {
1396 	if ((flags & _SOBIND_SOCKETPAIR) == 0)
1397 		return (sotpi_bindlisten(so, name, namelen, 0, flags, cr));
1398 
1399 	flags &= ~_SOBIND_SOCKETPAIR;
1400 	return (sotpi_bindlisten(so, name, namelen, 1, flags, cr));
1401 }
1402 
1403 /*
1404  * Unbind a socket - used when bind() fails, when bind() specifies a NULL
1405  * address, or when listen needs to unbind and bind.
1406  * If the _SOUNBIND_REBIND flag is specified the addresses are retained
1407  * so that a sobind can pick them up.
1408  */
1409 static int
1410 sotpi_unbind(struct sonode *so, int flags)
1411 {
1412 	struct T_unbind_req	unbind_req;
1413 	int			error = 0;
1414 	mblk_t			*mp;
1415 	sotpi_info_t		*sti = SOTOTPI(so);
1416 
1417 	dprintso(so, 1, ("sotpi_unbind(%p, 0x%x) %s\n",
1418 	    (void *)so, flags, pr_state(so->so_state, so->so_mode)));
1419 
1420 	ASSERT(MUTEX_HELD(&so->so_lock));
1421 	ASSERT(so->so_flag & SOLOCKED);
1422 
1423 	if (!(so->so_state & SS_ISBOUND)) {
1424 		error = EINVAL;
1425 		eprintsoline(so, error);
1426 		goto done;
1427 	}
1428 
1429 	mutex_exit(&so->so_lock);
1430 
1431 	/*
1432 	 * Flush the read and write side (except stream head read queue)
1433 	 * and send down T_UNBIND_REQ.
1434 	 */
1435 	(void) putnextctl1(strvp2wq(SOTOV(so)), M_FLUSH, FLUSHRW);
1436 
1437 	unbind_req.PRIM_type = T_UNBIND_REQ;
1438 	mp = soallocproto1(&unbind_req, sizeof (unbind_req),
1439 	    0, _ALLOC_SLEEP, CRED());
1440 	error = kstrputmsg(SOTOV(so), mp, NULL, 0, 0,
1441 	    MSG_BAND|MSG_HOLDSIG|MSG_IGNERROR, 0);
1442 	mutex_enter(&so->so_lock);
1443 	if (error) {
1444 		eprintsoline(so, error);
1445 		goto done;
1446 	}
1447 
1448 	error = sowaitokack(so, T_UNBIND_REQ);
1449 	if (error) {
1450 		eprintsoline(so, error);
1451 		goto done;
1452 	}
1453 
1454 	/*
1455 	 * Even if some TPI message (e.g. T_DISCON_IND) was received in
1456 	 * strsock_proto while the lock was dropped above, the unbind
1457 	 * is allowed to complete.
1458 	 */
1459 	if (!(flags & _SOUNBIND_REBIND)) {
1460 		/*
1461 		 * Clear out bound address.
1462 		 */
1463 		vnode_t *vp;
1464 
1465 		if ((vp = sti->sti_ux_bound_vp) != NULL) {
1466 			sti->sti_ux_bound_vp = NULL;
1467 			vn_rele_stream(vp);
1468 		}
1469 		/* Clear out address */
1470 		sti->sti_laddr_len = 0;
1471 	}
1472 	so->so_state &= ~(SS_ISBOUND|SS_ACCEPTCONN);
1473 	sti->sti_laddr_valid = 0;
1474 
1475 done:
1476 
1477 	/* If the caller held the lock don't release it here */
1478 	ASSERT(MUTEX_HELD(&so->so_lock));
1479 	ASSERT(so->so_flag & SOLOCKED);
1480 
1481 	return (error);
1482 }
1483 
1484 /*
1485  * listen on the socket.
1486  * For TPI conforming transports this has to first unbind with the transport
1487  * and then bind again using the new backlog.
1488  */
1489 /* ARGSUSED */
1490 int
1491 sotpi_listen(struct sonode *so, int backlog, struct cred *cr)
1492 {
1493 	int		error = 0;
1494 	sotpi_info_t	*sti = SOTOTPI(so);
1495 
1496 	dprintso(so, 1, ("sotpi_listen(%p, %d) %s\n",
1497 	    (void *)so, backlog, pr_state(so->so_state, so->so_mode)));
1498 
1499 	if (sti->sti_serv_type == T_CLTS)
1500 		return (EOPNOTSUPP);
1501 
1502 	/*
1503 	 * If the socket is ready to accept connections already, then
1504 	 * return without doing anything.  This avoids a problem where
1505 	 * a second listen() call fails if a connection is pending and
1506 	 * leaves the socket unbound. Only when we are not unbinding
1507 	 * with the transport can we safely increase the backlog.
1508 	 */
1509 	if (so->so_state & SS_ACCEPTCONN &&
1510 	    !((so->so_family == AF_INET || so->so_family == AF_INET6) &&
1511 	    /*CONSTCOND*/
1512 	    !solisten_tpi_tcp))
1513 		return (0);
1514 
1515 	if (so->so_state & SS_ISCONNECTED)
1516 		return (EINVAL);
1517 
1518 	mutex_enter(&so->so_lock);
1519 	so_lock_single(so);	/* Set SOLOCKED */
1520 
1521 	/*
1522 	 * If the listen doesn't change the backlog we do nothing.
1523 	 * This avoids an EPROTO error from the transport.
1524 	 */
1525 	if ((so->so_state & SS_ACCEPTCONN) &&
1526 	    so->so_backlog == backlog)
1527 		goto done;
1528 
1529 	if (!(so->so_state & SS_ISBOUND)) {
1530 		/*
1531 		 * Must have been explicitly bound in the UNIX domain.
1532 		 */
1533 		if (so->so_family == AF_UNIX) {
1534 			error = EINVAL;
1535 			goto done;
1536 		}
1537 		error = sotpi_bindlisten(so, NULL, 0, backlog,
1538 		    _SOBIND_UNSPEC|_SOBIND_LOCK_HELD|_SOBIND_LISTEN, cr);
1539 	} else if (backlog > 0) {
1540 		/*
1541 		 * AF_INET{,6} hack to avoid losing the port.
1542 		 * Assumes that all AF_INET{,6} transports can handle a
1543 		 * O_T_BIND_REQ with a non-zero CONIND_number when the TPI
1544 		 * has already bound thus it is possible to avoid the unbind.
1545 		 */
1546 		if (!((so->so_family == AF_INET || so->so_family == AF_INET6) &&
1547 		    /*CONSTCOND*/
1548 		    !solisten_tpi_tcp)) {
1549 			error = sotpi_unbind(so, _SOUNBIND_REBIND);
1550 			if (error)
1551 				goto done;
1552 		}
1553 		error = sotpi_bindlisten(so, NULL, 0, backlog,
1554 		    _SOBIND_REBIND|_SOBIND_LOCK_HELD|_SOBIND_LISTEN, cr);
1555 	} else {
1556 		so->so_state |= SS_ACCEPTCONN;
1557 		so->so_backlog = backlog;
1558 	}
1559 	if (error)
1560 		goto done;
1561 	ASSERT(so->so_state & SS_ACCEPTCONN);
1562 done:
1563 	so_unlock_single(so, SOLOCKED);
1564 	mutex_exit(&so->so_lock);
1565 	return (error);
1566 }
1567 
1568 /*
1569  * Disconnect either a specified seqno or all (-1).
1570  * The former is used on listening sockets only.
1571  *
1572  * When seqno == -1 sodisconnect could call sotpi_unbind. However,
1573  * the current use of sodisconnect(seqno == -1) is only for shutdown
1574  * so there is no point (and potentially incorrect) to unbind.
1575  */
1576 static int
1577 sodisconnect(struct sonode *so, t_scalar_t seqno, int flags)
1578 {
1579 	struct T_discon_req	discon_req;
1580 	int			error = 0;
1581 	mblk_t			*mp;
1582 
1583 	dprintso(so, 1, ("sodisconnect(%p, %d, 0x%x) %s\n",
1584 	    (void *)so, seqno, flags, pr_state(so->so_state, so->so_mode)));
1585 
1586 	if (!(flags & _SODISCONNECT_LOCK_HELD)) {
1587 		mutex_enter(&so->so_lock);
1588 		so_lock_single(so);	/* Set SOLOCKED */
1589 	} else {
1590 		ASSERT(MUTEX_HELD(&so->so_lock));
1591 		ASSERT(so->so_flag & SOLOCKED);
1592 	}
1593 
1594 	if (!(so->so_state & (SS_ISCONNECTED|SS_ISCONNECTING|SS_ACCEPTCONN))) {
1595 		error = EINVAL;
1596 		eprintsoline(so, error);
1597 		goto done;
1598 	}
1599 
1600 	mutex_exit(&so->so_lock);
1601 	/*
1602 	 * Flush the write side (unless this is a listener)
1603 	 * and then send down a T_DISCON_REQ.
1604 	 * (Don't flush on listener since it could flush {O_}T_CONN_RES
1605 	 * and other messages.)
1606 	 */
1607 	if (!(so->so_state & SS_ACCEPTCONN))
1608 		(void) putnextctl1(strvp2wq(SOTOV(so)), M_FLUSH, FLUSHW);
1609 
1610 	discon_req.PRIM_type = T_DISCON_REQ;
1611 	discon_req.SEQ_number = seqno;
1612 	mp = soallocproto1(&discon_req, sizeof (discon_req),
1613 	    0, _ALLOC_SLEEP, CRED());
1614 	error = kstrputmsg(SOTOV(so), mp, NULL, 0, 0,
1615 	    MSG_BAND|MSG_HOLDSIG|MSG_IGNERROR, 0);
1616 	mutex_enter(&so->so_lock);
1617 	if (error) {
1618 		eprintsoline(so, error);
1619 		goto done;
1620 	}
1621 
1622 	error = sowaitokack(so, T_DISCON_REQ);
1623 	if (error) {
1624 		eprintsoline(so, error);
1625 		goto done;
1626 	}
1627 	/*
1628 	 * Even if some TPI message (e.g. T_DISCON_IND) was received in
1629 	 * strsock_proto while the lock was dropped above, the disconnect
1630 	 * is allowed to complete. However, it is not possible to
1631 	 * assert that SS_ISCONNECTED|SS_ISCONNECTING are set.
1632 	 */
1633 	so->so_state &= ~(SS_ISCONNECTED|SS_ISCONNECTING);
1634 	SOTOTPI(so)->sti_laddr_valid = 0;
1635 	SOTOTPI(so)->sti_faddr_valid = 0;
1636 done:
1637 	if (!(flags & _SODISCONNECT_LOCK_HELD)) {
1638 		so_unlock_single(so, SOLOCKED);
1639 		mutex_exit(&so->so_lock);
1640 	} else {
1641 		/* If the caller held the lock don't release it here */
1642 		ASSERT(MUTEX_HELD(&so->so_lock));
1643 		ASSERT(so->so_flag & SOLOCKED);
1644 	}
1645 	return (error);
1646 }
1647 
1648 /* ARGSUSED */
1649 int
1650 sotpi_accept(struct sonode *so, int fflag, struct cred *cr,
1651     struct sonode **nsop)
1652 {
1653 	struct T_conn_ind	*conn_ind;
1654 	struct T_conn_res	*conn_res;
1655 	int			error = 0;
1656 	mblk_t			*mp, *ack_mp;
1657 	struct sonode		*nso;
1658 	vnode_t			*nvp;
1659 	void			*src;
1660 	t_uscalar_t		srclen;
1661 	void			*opt;
1662 	t_uscalar_t		optlen;
1663 	t_scalar_t		PRIM_type;
1664 	t_scalar_t		SEQ_number;
1665 	size_t			sinlen;
1666 	sotpi_info_t		*sti = SOTOTPI(so);
1667 	sotpi_info_t		*nsti;
1668 
1669 	dprintso(so, 1, ("sotpi_accept(%p, 0x%x, %p) %s\n",
1670 	    (void *)so, fflag, (void *)nsop,
1671 	    pr_state(so->so_state, so->so_mode)));
1672 
1673 	/*
1674 	 * Defer single-threading the accepting socket until
1675 	 * the T_CONN_IND has been received and parsed and the
1676 	 * new sonode has been opened.
1677 	 */
1678 
1679 	/* Check that we are not already connected */
1680 	if ((so->so_state & SS_ACCEPTCONN) == 0)
1681 		goto conn_bad;
1682 again:
1683 	if ((error = sowaitconnind(so, fflag, &mp)) != 0)
1684 		goto e_bad;
1685 
1686 	ASSERT(mp != NULL);
1687 	conn_ind = (struct T_conn_ind *)mp->b_rptr;
1688 
1689 	/*
1690 	 * Save SEQ_number for error paths.
1691 	 */
1692 	SEQ_number = conn_ind->SEQ_number;
1693 
1694 	srclen = conn_ind->SRC_length;
1695 	src = sogetoff(mp, conn_ind->SRC_offset, srclen, 1);
1696 	if (src == NULL) {
1697 		error = EPROTO;
1698 		freemsg(mp);
1699 		eprintsoline(so, error);
1700 		goto disconnect_unlocked;
1701 	}
1702 	optlen = conn_ind->OPT_length;
1703 	switch (so->so_family) {
1704 	case AF_INET:
1705 	case AF_INET6:
1706 		if ((optlen == sizeof (intptr_t)) && (sti->sti_direct != 0)) {
1707 			bcopy(mp->b_rptr + conn_ind->OPT_offset,
1708 			    &opt, conn_ind->OPT_length);
1709 		} else {
1710 			/*
1711 			 * The transport (in this case TCP) hasn't sent up
1712 			 * a pointer to an instance for the accept fast-path.
1713 			 * Disable fast-path completely because the call to
1714 			 * sotpi_create() below would otherwise create an
1715 			 * incomplete TCP instance, which would lead to
1716 			 * problems when sockfs sends a normal T_CONN_RES
1717 			 * message down the new stream.
1718 			 */
1719 			if (sti->sti_direct) {
1720 				int rval;
1721 				/*
1722 				 * For consistency we inform tcp to disable
1723 				 * direct interface on the listener, though
1724 				 * we can certainly live without doing this
1725 				 * because no data will ever travel upstream
1726 				 * on the listening socket.
1727 				 */
1728 				sti->sti_direct = 0;
1729 				(void) strioctl(SOTOV(so), _SIOCSOCKFALLBACK,
1730 				    0, 0, K_TO_K, cr, &rval);
1731 			}
1732 			opt = NULL;
1733 			optlen = 0;
1734 		}
1735 		break;
1736 	case AF_UNIX:
1737 	default:
1738 		if (optlen != 0) {
1739 			opt = sogetoff(mp, conn_ind->OPT_offset, optlen,
1740 			    __TPI_ALIGN_SIZE);
1741 			if (opt == NULL) {
1742 				error = EPROTO;
1743 				freemsg(mp);
1744 				eprintsoline(so, error);
1745 				goto disconnect_unlocked;
1746 			}
1747 		}
1748 		if (so->so_family == AF_UNIX) {
1749 			if (!sti->sti_faddr_noxlate) {
1750 				src = NULL;
1751 				srclen = 0;
1752 			}
1753 			/* Extract src address from options */
1754 			if (optlen != 0)
1755 				so_getopt_srcaddr(opt, optlen, &src, &srclen);
1756 		}
1757 		break;
1758 	}
1759 
1760 	/*
1761 	 * Create the new socket.
1762 	 */
1763 	nso = socket_newconn(so, NULL, NULL, SOCKET_SLEEP, &error);
1764 	if (nso == NULL) {
1765 		ASSERT(error != 0);
1766 		/*
1767 		 * Accept can not fail with ENOBUFS. sotpi_create
1768 		 * sleeps waiting for memory until a signal is caught
1769 		 * so return EINTR.
1770 		 */
1771 		freemsg(mp);
1772 		if (error == ENOBUFS)
1773 			error = EINTR;
1774 		goto e_disc_unl;
1775 	}
1776 	nvp = SOTOV(nso);
1777 	nsti = SOTOTPI(nso);
1778 
1779 #ifdef DEBUG
1780 	/*
1781 	 * SO_DEBUG is used to trigger the dprint* and eprint* macros thus
1782 	 * it's inherited early to allow debugging of the accept code itself.
1783 	 */
1784 	nso->so_options |= so->so_options & SO_DEBUG;
1785 #endif /* DEBUG */
1786 
1787 	/*
1788 	 * Save the SRC address from the T_CONN_IND
1789 	 * for getpeername to work on AF_UNIX and on transports that do not
1790 	 * support TI_GETPEERNAME.
1791 	 *
1792 	 * NOTE: AF_UNIX NUL termination is ensured by the sender's
1793 	 * copyin_name().
1794 	 */
1795 	if (srclen > (t_uscalar_t)nsti->sti_faddr_maxlen) {
1796 		error = EINVAL;
1797 		freemsg(mp);
1798 		eprintsoline(so, error);
1799 		goto disconnect_vp_unlocked;
1800 	}
1801 	nsti->sti_faddr_len = (socklen_t)srclen;
1802 	ASSERT(sti->sti_faddr_len <= sti->sti_faddr_maxlen);
1803 	bcopy(src, nsti->sti_faddr_sa, srclen);
1804 	nsti->sti_faddr_valid = 1;
1805 
1806 	/*
1807 	 * Record so_peercred and so_cpid from a cred in the T_CONN_IND.
1808 	 */
1809 	if ((DB_REF(mp) > 1) || MBLKSIZE(mp) <
1810 	    (sizeof (struct T_conn_res) + sizeof (intptr_t))) {
1811 		cred_t	*cr;
1812 		pid_t	cpid;
1813 
1814 		cr = msg_getcred(mp, &cpid);
1815 		if (cr != NULL) {
1816 			crhold(cr);
1817 			nso->so_peercred = cr;
1818 			nso->so_cpid = cpid;
1819 		}
1820 		freemsg(mp);
1821 
1822 		mp = soallocproto1(NULL, sizeof (struct T_conn_res) +
1823 		    sizeof (intptr_t), 0, _ALLOC_INTR, cr);
1824 		if (mp == NULL) {
1825 			/*
1826 			 * Accept can not fail with ENOBUFS.
1827 			 * A signal was caught so return EINTR.
1828 			 */
1829 			error = EINTR;
1830 			eprintsoline(so, error);
1831 			goto disconnect_vp_unlocked;
1832 		}
1833 		conn_res = (struct T_conn_res *)mp->b_rptr;
1834 	} else {
1835 		/*
1836 		 * For efficency reasons we use msg_extractcred; no crhold
1837 		 * needed since db_credp is cleared (i.e., we move the cred
1838 		 * from the message to so_peercred.
1839 		 */
1840 		nso->so_peercred = msg_extractcred(mp, &nso->so_cpid);
1841 
1842 		mp->b_rptr = DB_BASE(mp);
1843 		conn_res = (struct T_conn_res *)mp->b_rptr;
1844 		mp->b_wptr = mp->b_rptr + sizeof (struct T_conn_res);
1845 
1846 		mblk_setcred(mp, cr, curproc->p_pid);
1847 	}
1848 
1849 	/*
1850 	 * New socket must be bound at least in sockfs and, except for AF_INET,
1851 	 * (or AF_INET6) it also has to be bound in the transport provider.
1852 	 * We set the local address in the sonode from the T_OK_ACK of the
1853 	 * T_CONN_RES. For this reason the address we bind to here isn't
1854 	 * important.
1855 	 */
1856 	if ((nso->so_family == AF_INET || nso->so_family == AF_INET6) &&
1857 	    /*CONSTCOND*/
1858 	    nso->so_type == SOCK_STREAM && !soaccept_tpi_tcp) {
1859 		/*
1860 		 * Optimization for AF_INET{,6} transports
1861 		 * that can handle a T_CONN_RES without being bound.
1862 		 */
1863 		mutex_enter(&nso->so_lock);
1864 		so_automatic_bind(nso);
1865 		mutex_exit(&nso->so_lock);
1866 	} else {
1867 		/* Perform NULL bind with the transport provider. */
1868 		if ((error = sotpi_bind(nso, NULL, 0, _SOBIND_UNSPEC,
1869 		    cr)) != 0) {
1870 			ASSERT(error != ENOBUFS);
1871 			freemsg(mp);
1872 			eprintsoline(nso, error);
1873 			goto disconnect_vp_unlocked;
1874 		}
1875 	}
1876 
1877 	/*
1878 	 * Inherit SIOCSPGRP, SS_ASYNC before we send the {O_}T_CONN_RES
1879 	 * so that any data arriving on the new socket will cause the
1880 	 * appropriate signals to be delivered for the new socket.
1881 	 *
1882 	 * No other thread (except strsock_proto and strsock_misc)
1883 	 * can access the new socket thus we relax the locking.
1884 	 */
1885 	nso->so_pgrp = so->so_pgrp;
1886 	nso->so_state |= so->so_state & SS_ASYNC;
1887 	nsti->sti_faddr_noxlate = sti->sti_faddr_noxlate;
1888 
1889 	if (nso->so_pgrp != 0) {
1890 		if ((error = so_set_events(nso, nvp, cr)) != 0) {
1891 			eprintsoline(nso, error);
1892 			error = 0;
1893 			nso->so_pgrp = 0;
1894 		}
1895 	}
1896 
1897 	/*
1898 	 * Make note of the socket level options. TCP and IP level options
1899 	 * are already inherited. We could do all this after accept is
1900 	 * successful but doing it here simplifies code and no harm done
1901 	 * for error case.
1902 	 */
1903 	nso->so_options = so->so_options & (SO_DEBUG|SO_REUSEADDR|SO_KEEPALIVE|
1904 	    SO_DONTROUTE|SO_BROADCAST|SO_USELOOPBACK|
1905 	    SO_OOBINLINE|SO_DGRAM_ERRIND|SO_LINGER);
1906 	nso->so_sndbuf = so->so_sndbuf;
1907 	nso->so_rcvbuf = so->so_rcvbuf;
1908 	if (nso->so_options & SO_LINGER)
1909 		nso->so_linger = so->so_linger;
1910 
1911 	/*
1912 	 * Note that the following sti_direct code path should be
1913 	 * removed once we are confident that the direct sockets
1914 	 * do not result in any degradation.
1915 	 */
1916 	if (sti->sti_direct) {
1917 
1918 		ASSERT(opt != NULL);
1919 
1920 		conn_res->OPT_length = optlen;
1921 		conn_res->OPT_offset = MBLKL(mp);
1922 		bcopy(&opt, mp->b_wptr, optlen);
1923 		mp->b_wptr += optlen;
1924 		conn_res->PRIM_type = T_CONN_RES;
1925 		conn_res->ACCEPTOR_id = 0;
1926 		PRIM_type = T_CONN_RES;
1927 
1928 		/* Send down the T_CONN_RES on acceptor STREAM */
1929 		error = kstrputmsg(SOTOV(nso), mp, NULL,
1930 		    0, 0, MSG_BAND|MSG_HOLDSIG|MSG_IGNERROR, 0);
1931 		if (error) {
1932 			mutex_enter(&so->so_lock);
1933 			so_lock_single(so);
1934 			eprintsoline(so, error);
1935 			goto disconnect_vp;
1936 		}
1937 		mutex_enter(&nso->so_lock);
1938 		error = sowaitprim(nso, T_CONN_RES, T_OK_ACK,
1939 		    (t_uscalar_t)sizeof (struct T_ok_ack), &ack_mp, 0);
1940 		if (error) {
1941 			mutex_exit(&nso->so_lock);
1942 			mutex_enter(&so->so_lock);
1943 			so_lock_single(so);
1944 			eprintsoline(so, error);
1945 			goto disconnect_vp;
1946 		}
1947 		if (nso->so_family == AF_INET) {
1948 			sin_t *sin;
1949 
1950 			sin = (sin_t *)(ack_mp->b_rptr +
1951 			    sizeof (struct T_ok_ack));
1952 			bcopy(sin, nsti->sti_laddr_sa, sizeof (sin_t));
1953 			nsti->sti_laddr_len = sizeof (sin_t);
1954 		} else {
1955 			sin6_t *sin6;
1956 
1957 			sin6 = (sin6_t *)(ack_mp->b_rptr +
1958 			    sizeof (struct T_ok_ack));
1959 			bcopy(sin6, nsti->sti_laddr_sa, sizeof (sin6_t));
1960 			nsti->sti_laddr_len = sizeof (sin6_t);
1961 		}
1962 		freemsg(ack_mp);
1963 
1964 		nso->so_state |= SS_ISCONNECTED;
1965 		nso->so_proto_handle = (sock_lower_handle_t)opt;
1966 		nsti->sti_laddr_valid = 1;
1967 
1968 		if (sti->sti_nl7c_flags & NL7C_ENABLED) {
1969 			/*
1970 			 * A NL7C marked listen()er so the new socket
1971 			 * inherits the listen()er's NL7C state, except
1972 			 * for NL7C_POLLIN.
1973 			 *
1974 			 * Only call NL7C to process the new socket if
1975 			 * the listen socket allows blocking i/o.
1976 			 */
1977 			nsti->sti_nl7c_flags =
1978 			    sti->sti_nl7c_flags & (~NL7C_POLLIN);
1979 			if (so->so_state & (SS_NONBLOCK|SS_NDELAY)) {
1980 				/*
1981 				 * Nonblocking accept() just make it
1982 				 * persist to defer processing to the
1983 				 * read-side syscall (e.g. read).
1984 				 */
1985 				nsti->sti_nl7c_flags |= NL7C_SOPERSIST;
1986 			} else if (nl7c_process(nso, B_FALSE)) {
1987 				/*
1988 				 * NL7C has completed processing on the
1989 				 * socket, close the socket and back to
1990 				 * the top to await the next T_CONN_IND.
1991 				 */
1992 				mutex_exit(&nso->so_lock);
1993 				(void) VOP_CLOSE(nvp, 0, 1, (offset_t)0,
1994 				    cr, NULL);
1995 				VN_RELE(nvp);
1996 				goto again;
1997 			}
1998 			/* Pass the new socket out */
1999 		}
2000 
2001 		mutex_exit(&nso->so_lock);
2002 
2003 		/*
2004 		 * It's possible, through the use of autopush for example,
2005 		 * that the acceptor stream may not support sti_direct
2006 		 * semantics. If the new socket does not support sti_direct
2007 		 * we issue a _SIOCSOCKFALLBACK to inform the transport
2008 		 * as we would in the I_PUSH case.
2009 		 */
2010 		if (nsti->sti_direct == 0) {
2011 			int	rval;
2012 
2013 			if ((error = strioctl(SOTOV(nso), _SIOCSOCKFALLBACK,
2014 			    0, 0, K_TO_K, cr, &rval)) != 0) {
2015 				mutex_enter(&so->so_lock);
2016 				so_lock_single(so);
2017 				eprintsoline(so, error);
2018 				goto disconnect_vp;
2019 			}
2020 		}
2021 
2022 		/*
2023 		 * Pass out new socket.
2024 		 */
2025 		if (nsop != NULL)
2026 			*nsop = nso;
2027 
2028 		return (0);
2029 	}
2030 
2031 	/*
2032 	 * This is the non-performance case for sockets (e.g. AF_UNIX sockets)
2033 	 * which don't support the FireEngine accept fast-path. It is also
2034 	 * used when the virtual "sockmod" has been I_POP'd and I_PUSH'd
2035 	 * again. Neither sockfs nor TCP attempt to find out if some other
2036 	 * random module has been inserted in between (in which case we
2037 	 * should follow TLI accept behaviour). We blindly assume the worst
2038 	 * case and revert back to old behaviour i.e. TCP will not send us
2039 	 * any option (eager) and the accept should happen on the listener
2040 	 * queue. Any queued T_conn_ind have already got their options removed
2041 	 * by so_sock2_stream() when "sockmod" was I_POP'd.
2042 	 */
2043 	/*
2044 	 * Fill in the {O_}T_CONN_RES before getting SOLOCKED.
2045 	 */
2046 	if ((nso->so_mode & SM_ACCEPTOR_ID) == 0) {
2047 #ifdef	_ILP32
2048 		queue_t	*q;
2049 
2050 		/*
2051 		 * Find read queue in driver
2052 		 * Can safely do this since we "own" nso/nvp.
2053 		 */
2054 		q = strvp2wq(nvp)->q_next;
2055 		while (SAMESTR(q))
2056 			q = q->q_next;
2057 		q = RD(q);
2058 		conn_res->ACCEPTOR_id = (t_uscalar_t)q;
2059 #else
2060 		conn_res->ACCEPTOR_id = (t_uscalar_t)getminor(nvp->v_rdev);
2061 #endif	/* _ILP32 */
2062 		conn_res->PRIM_type = O_T_CONN_RES;
2063 		PRIM_type = O_T_CONN_RES;
2064 	} else {
2065 		conn_res->ACCEPTOR_id = nsti->sti_acceptor_id;
2066 		conn_res->PRIM_type = T_CONN_RES;
2067 		PRIM_type = T_CONN_RES;
2068 	}
2069 	conn_res->SEQ_number = SEQ_number;
2070 	conn_res->OPT_length = 0;
2071 	conn_res->OPT_offset = 0;
2072 
2073 	mutex_enter(&so->so_lock);
2074 	so_lock_single(so);	/* Set SOLOCKED */
2075 	mutex_exit(&so->so_lock);
2076 
2077 	error = kstrputmsg(SOTOV(so), mp, NULL,
2078 	    0, 0, MSG_BAND|MSG_HOLDSIG|MSG_IGNERROR, 0);
2079 	mutex_enter(&so->so_lock);
2080 	if (error) {
2081 		eprintsoline(so, error);
2082 		goto disconnect_vp;
2083 	}
2084 	error = sowaitprim(so, PRIM_type, T_OK_ACK,
2085 	    (t_uscalar_t)sizeof (struct T_ok_ack), &ack_mp, 0);
2086 	if (error) {
2087 		eprintsoline(so, error);
2088 		goto disconnect_vp;
2089 	}
2090 	mutex_exit(&so->so_lock);
2091 	/*
2092 	 * If there is a sin/sin6 appended onto the T_OK_ACK use
2093 	 * that to set the local address. If this is not present
2094 	 * then we zero out the address and don't set the
2095 	 * sti_laddr_valid bit. For AF_UNIX endpoints we copy over
2096 	 * the pathname from the listening socket.
2097 	 * In the case where this is TCP or an AF_UNIX socket the
2098 	 * client side may have queued data or a T_ORDREL in the
2099 	 * transport. Having now sent the T_CONN_RES we may receive
2100 	 * those queued messages at any time. Hold the acceptor
2101 	 * so_lock until its state and laddr are finalized.
2102 	 */
2103 	mutex_enter(&nso->so_lock);
2104 	sinlen = (nso->so_family == AF_INET) ? sizeof (sin_t) : sizeof (sin6_t);
2105 	if ((nso->so_family == AF_INET) || (nso->so_family == AF_INET6) &&
2106 	    MBLKL(ack_mp) == (sizeof (struct T_ok_ack) + sinlen)) {
2107 		ack_mp->b_rptr += sizeof (struct T_ok_ack);
2108 		bcopy(ack_mp->b_rptr, nsti->sti_laddr_sa, sinlen);
2109 		nsti->sti_laddr_len = sinlen;
2110 		nsti->sti_laddr_valid = 1;
2111 	} else if (nso->so_family == AF_UNIX) {
2112 		ASSERT(so->so_family == AF_UNIX);
2113 		nsti->sti_laddr_len = sti->sti_laddr_len;
2114 		ASSERT(nsti->sti_laddr_len <= nsti->sti_laddr_maxlen);
2115 		bcopy(sti->sti_laddr_sa, nsti->sti_laddr_sa,
2116 		    nsti->sti_laddr_len);
2117 		nsti->sti_laddr_valid = 1;
2118 	} else {
2119 		nsti->sti_laddr_len = sti->sti_laddr_len;
2120 		ASSERT(nsti->sti_laddr_len <= nsti->sti_laddr_maxlen);
2121 		bzero(nsti->sti_laddr_sa, nsti->sti_addr_size);
2122 		nsti->sti_laddr_sa->sa_family = nso->so_family;
2123 	}
2124 	nso->so_state |= SS_ISCONNECTED;
2125 	mutex_exit(&nso->so_lock);
2126 
2127 	freemsg(ack_mp);
2128 
2129 	mutex_enter(&so->so_lock);
2130 	so_unlock_single(so, SOLOCKED);
2131 	mutex_exit(&so->so_lock);
2132 
2133 	/*
2134 	 * Pass out new socket.
2135 	 */
2136 	if (nsop != NULL)
2137 		*nsop = nso;
2138 
2139 	return (0);
2140 
2141 
2142 eproto_disc_unl:
2143 	error = EPROTO;
2144 e_disc_unl:
2145 	eprintsoline(so, error);
2146 	goto disconnect_unlocked;
2147 
2148 pr_disc_vp_unl:
2149 	eprintsoline(so, error);
2150 disconnect_vp_unlocked:
2151 	(void) VOP_CLOSE(nvp, 0, 1, 0, cr, NULL);
2152 	VN_RELE(nvp);
2153 disconnect_unlocked:
2154 	(void) sodisconnect(so, SEQ_number, 0);
2155 	return (error);
2156 
2157 pr_disc_vp:
2158 	eprintsoline(so, error);
2159 disconnect_vp:
2160 	(void) sodisconnect(so, SEQ_number, _SODISCONNECT_LOCK_HELD);
2161 	so_unlock_single(so, SOLOCKED);
2162 	mutex_exit(&so->so_lock);
2163 	(void) VOP_CLOSE(nvp, 0, 1, 0, cr, NULL);
2164 	VN_RELE(nvp);
2165 	return (error);
2166 
2167 conn_bad:	/* Note: SunOS 4/BSD unconditionally returns EINVAL here */
2168 	error = (so->so_type == SOCK_DGRAM || so->so_type == SOCK_RAW)
2169 	    ? EOPNOTSUPP : EINVAL;
2170 e_bad:
2171 	eprintsoline(so, error);
2172 	return (error);
2173 }
2174 
2175 /*
2176  * connect a socket.
2177  *
2178  * Allow SOCK_DGRAM sockets to reconnect (by specifying a new address) and to
2179  * unconnect (by specifying a null address).
2180  */
2181 int
2182 sotpi_connect(struct sonode *so,
2183     struct sockaddr *name,
2184     socklen_t namelen,
2185     int fflag,
2186     int flags,
2187     struct cred *cr)
2188 {
2189 	struct T_conn_req	conn_req;
2190 	int			error = 0;
2191 	mblk_t			*mp;
2192 	void			*src;
2193 	socklen_t		srclen;
2194 	void			*addr;
2195 	socklen_t		addrlen;
2196 	boolean_t		need_unlock;
2197 	sotpi_info_t		*sti = SOTOTPI(so);
2198 
2199 	dprintso(so, 1, ("sotpi_connect(%p, %p, %d, 0x%x, 0x%x) %s\n",
2200 	    (void *)so, (void *)name, namelen, fflag, flags,
2201 	    pr_state(so->so_state, so->so_mode)));
2202 
2203 	/*
2204 	 * Preallocate the T_CONN_REQ mblk before grabbing SOLOCKED to
2205 	 * avoid sleeping for memory with SOLOCKED held.
2206 	 * We know that the T_CONN_REQ can't be larger than 2 * sti_faddr_maxlen
2207 	 * + sizeof (struct T_opthdr).
2208 	 * (the AF_UNIX so_ux_addr_xlate() does not make the address
2209 	 * exceed sti_faddr_maxlen).
2210 	 */
2211 	mp = soallocproto(sizeof (struct T_conn_req) +
2212 	    2 * sti->sti_faddr_maxlen + sizeof (struct T_opthdr), _ALLOC_INTR,
2213 	    cr);
2214 	if (mp == NULL) {
2215 		/*
2216 		 * Connect can not fail with ENOBUFS. A signal was
2217 		 * caught so return EINTR.
2218 		 */
2219 		error = EINTR;
2220 		eprintsoline(so, error);
2221 		return (error);
2222 	}
2223 
2224 	mutex_enter(&so->so_lock);
2225 	/*
2226 	 * Make sure there is a preallocated T_unbind_req message
2227 	 * before any binding. This message is allocated when the
2228 	 * socket is created. Since another thread can consume
2229 	 * so_unbind_mp by the time we return from so_lock_single(),
2230 	 * we should check the availability of so_unbind_mp after
2231 	 * we return from so_lock_single().
2232 	 */
2233 
2234 	so_lock_single(so);	/* Set SOLOCKED */
2235 	need_unlock = B_TRUE;
2236 
2237 	if (sti->sti_unbind_mp == NULL) {
2238 		dprintso(so, 1, ("sotpi_connect: allocating unbind_req\n"));
2239 		/* NOTE: holding so_lock while sleeping */
2240 		sti->sti_unbind_mp =
2241 		    soallocproto(sizeof (struct T_unbind_req), _ALLOC_INTR, cr);
2242 		if (sti->sti_unbind_mp == NULL) {
2243 			error = EINTR;
2244 			goto done;
2245 		}
2246 	}
2247 
2248 	/*
2249 	 * Can't have done a listen before connecting.
2250 	 */
2251 	if (so->so_state & SS_ACCEPTCONN) {
2252 		error = EOPNOTSUPP;
2253 		goto done;
2254 	}
2255 
2256 	/*
2257 	 * Must be bound with the transport
2258 	 */
2259 	if (!(so->so_state & SS_ISBOUND)) {
2260 		if ((so->so_family == AF_INET || so->so_family == AF_INET6) &&
2261 		    /*CONSTCOND*/
2262 		    so->so_type == SOCK_STREAM && !soconnect_tpi_tcp) {
2263 			/*
2264 			 * Optimization for AF_INET{,6} transports
2265 			 * that can handle a T_CONN_REQ without being bound.
2266 			 */
2267 			so_automatic_bind(so);
2268 		} else {
2269 			error = sotpi_bind(so, NULL, 0,
2270 			    _SOBIND_UNSPEC|_SOBIND_LOCK_HELD, cr);
2271 			if (error)
2272 				goto done;
2273 		}
2274 		ASSERT(so->so_state & SS_ISBOUND);
2275 		flags |= _SOCONNECT_DID_BIND;
2276 	}
2277 
2278 	/*
2279 	 * Handle a connect to a name parameter of type AF_UNSPEC like a
2280 	 * connect to a null address. This is the portable method to
2281 	 * unconnect a socket.
2282 	 */
2283 	if ((namelen >= sizeof (sa_family_t)) &&
2284 	    (name->sa_family == AF_UNSPEC)) {
2285 		name = NULL;
2286 		namelen = 0;
2287 	}
2288 
2289 	/*
2290 	 * Check that we are not already connected.
2291 	 * A connection-oriented socket cannot be reconnected.
2292 	 * A connected connection-less socket can be
2293 	 * - connected to a different address by a subsequent connect
2294 	 * - "unconnected" by a connect to the NULL address
2295 	 */
2296 	if (so->so_state & (SS_ISCONNECTED|SS_ISCONNECTING)) {
2297 		ASSERT(!(flags & _SOCONNECT_DID_BIND));
2298 		if (so->so_mode & SM_CONNREQUIRED) {
2299 			/* Connection-oriented socket */
2300 			error = so->so_state & SS_ISCONNECTED ?
2301 			    EISCONN : EALREADY;
2302 			goto done;
2303 		}
2304 		/* Connection-less socket */
2305 		if (name == NULL) {
2306 			/*
2307 			 * Remove the connected state and clear SO_DGRAM_ERRIND
2308 			 * since it was set when the socket was connected.
2309 			 * If this is UDP also send down a T_DISCON_REQ.
2310 			 */
2311 			int val;
2312 
2313 			if ((so->so_family == AF_INET ||
2314 			    so->so_family == AF_INET6) &&
2315 			    (so->so_type == SOCK_DGRAM ||
2316 			    so->so_type == SOCK_RAW) &&
2317 			    /*CONSTCOND*/
2318 			    !soconnect_tpi_udp) {
2319 				/* XXX What about implicitly unbinding here? */
2320 				error = sodisconnect(so, -1,
2321 				    _SODISCONNECT_LOCK_HELD);
2322 			} else {
2323 				so->so_state &=
2324 				    ~(SS_ISCONNECTED | SS_ISCONNECTING);
2325 				sti->sti_faddr_valid = 0;
2326 				sti->sti_faddr_len = 0;
2327 			}
2328 
2329 			/* Remove SOLOCKED since setsockopt will grab it */
2330 			so_unlock_single(so, SOLOCKED);
2331 			mutex_exit(&so->so_lock);
2332 
2333 			val = 0;
2334 			(void) sotpi_setsockopt(so, SOL_SOCKET,
2335 			    SO_DGRAM_ERRIND, &val, (t_uscalar_t)sizeof (val),
2336 			    cr);
2337 
2338 			mutex_enter(&so->so_lock);
2339 			so_lock_single(so);	/* Set SOLOCKED */
2340 			goto done;
2341 		}
2342 	}
2343 	ASSERT(so->so_state & SS_ISBOUND);
2344 
2345 	if (name == NULL || namelen == 0) {
2346 		error = EINVAL;
2347 		goto done;
2348 	}
2349 	/*
2350 	 * Mark the socket if sti_faddr_sa represents the transport level
2351 	 * address.
2352 	 */
2353 	if (flags & _SOCONNECT_NOXLATE) {
2354 		struct sockaddr_ux	*soaddr_ux;
2355 
2356 		ASSERT(so->so_family == AF_UNIX);
2357 		if (namelen != sizeof (struct sockaddr_ux)) {
2358 			error = EINVAL;
2359 			goto done;
2360 		}
2361 		soaddr_ux = (struct sockaddr_ux *)name;
2362 		name = (struct sockaddr *)&soaddr_ux->sou_addr;
2363 		namelen = sizeof (soaddr_ux->sou_addr);
2364 		sti->sti_faddr_noxlate = 1;
2365 	}
2366 
2367 	/*
2368 	 * Length and family checks.
2369 	 */
2370 	error = so_addr_verify(so, name, namelen);
2371 	if (error)
2372 		goto bad;
2373 
2374 	/*
2375 	 * Save foreign address. Needed for AF_UNIX as well as
2376 	 * transport providers that do not support TI_GETPEERNAME.
2377 	 * Also used for cached foreign address for TCP and UDP.
2378 	 */
2379 	if (namelen > (t_uscalar_t)sti->sti_faddr_maxlen) {
2380 		error = EINVAL;
2381 		goto done;
2382 	}
2383 	sti->sti_faddr_len = (socklen_t)namelen;
2384 	ASSERT(sti->sti_faddr_len <= sti->sti_faddr_maxlen);
2385 	bcopy(name, sti->sti_faddr_sa, namelen);
2386 	sti->sti_faddr_valid = 1;
2387 
2388 	if (so->so_family == AF_UNIX) {
2389 		if (sti->sti_faddr_noxlate) {
2390 			/*
2391 			 * Already have a transport internal address. Do not
2392 			 * pass any (transport internal) source address.
2393 			 */
2394 			addr = sti->sti_faddr_sa;
2395 			addrlen = (t_uscalar_t)sti->sti_faddr_len;
2396 			src = NULL;
2397 			srclen = 0;
2398 		} else {
2399 			/*
2400 			 * Pass the sockaddr_un source address as an option
2401 			 * and translate the remote address.
2402 			 * Holding so_lock thus sti_laddr_sa can not change.
2403 			 */
2404 			src = sti->sti_laddr_sa;
2405 			srclen = (t_uscalar_t)sti->sti_laddr_len;
2406 			dprintso(so, 1,
2407 			    ("sotpi_connect UNIX: srclen %d, src %p\n",
2408 			    srclen, src));
2409 			/*
2410 			 * Translate the destination address into our
2411 			 * internal form, and save it in sti_ux_faddr.
2412 			 * After this call, addr==&sti->sti_ux_taddr,
2413 			 * and we copy that to sti->sti_ux_faddr so
2414 			 * we save the connected peer address.
2415 			 */
2416 			error = so_ux_addr_xlate(so,
2417 			    sti->sti_faddr_sa, (socklen_t)sti->sti_faddr_len,
2418 			    (flags & _SOCONNECT_XPG4_2),
2419 			    &addr, &addrlen);
2420 			if (error)
2421 				goto bad;
2422 			bcopy(&sti->sti_ux_taddr, &sti->sti_ux_faddr,
2423 			    sizeof (sti->sti_ux_faddr));
2424 		}
2425 	} else {
2426 		addr = sti->sti_faddr_sa;
2427 		addrlen = (t_uscalar_t)sti->sti_faddr_len;
2428 		src = NULL;
2429 		srclen = 0;
2430 	}
2431 	/*
2432 	 * When connecting a datagram socket we issue the SO_DGRAM_ERRIND
2433 	 * option which asks the transport provider to send T_UDERR_IND
2434 	 * messages. These T_UDERR_IND messages are used to return connected
2435 	 * style errors (e.g. ECONNRESET) for connected datagram sockets.
2436 	 *
2437 	 * In addition, for UDP (and SOCK_RAW AF_INET{,6} sockets)
2438 	 * we send down a T_CONN_REQ. This is needed to let the
2439 	 * transport assign a local address that is consistent with
2440 	 * the remote address. Applications depend on a getsockname()
2441 	 * after a connect() to retrieve the "source" IP address for
2442 	 * the connected socket.  Invalidate the cached local address
2443 	 * to force getsockname() to enquire of the transport.
2444 	 */
2445 	if (!(so->so_mode & SM_CONNREQUIRED)) {
2446 		/*
2447 		 * Datagram socket.
2448 		 */
2449 		int32_t val;
2450 
2451 		so_unlock_single(so, SOLOCKED);
2452 		mutex_exit(&so->so_lock);
2453 
2454 		val = 1;
2455 		(void) sotpi_setsockopt(so, SOL_SOCKET, SO_DGRAM_ERRIND,
2456 		    &val, (t_uscalar_t)sizeof (val), cr);
2457 
2458 		mutex_enter(&so->so_lock);
2459 		so_lock_single(so);	/* Set SOLOCKED */
2460 		if ((so->so_family != AF_INET && so->so_family != AF_INET6) ||
2461 		    (so->so_type != SOCK_DGRAM && so->so_type != SOCK_RAW) ||
2462 		    soconnect_tpi_udp) {
2463 			soisconnected(so);
2464 			goto done;
2465 		}
2466 		/*
2467 		 * Send down T_CONN_REQ etc.
2468 		 * Clear fflag to avoid returning EWOULDBLOCK.
2469 		 */
2470 		fflag = 0;
2471 		ASSERT(so->so_family != AF_UNIX);
2472 		sti->sti_laddr_valid = 0;
2473 	} else if (sti->sti_laddr_len != 0) {
2474 		/*
2475 		 * If the local address or port was "any" then it may be
2476 		 * changed by the transport as a result of the
2477 		 * connect.  Invalidate the cached version if we have one.
2478 		 */
2479 		switch (so->so_family) {
2480 		case AF_INET:
2481 			ASSERT(sti->sti_laddr_len == (socklen_t)sizeof (sin_t));
2482 			if (((sin_t *)sti->sti_laddr_sa)->sin_addr.s_addr ==
2483 			    INADDR_ANY ||
2484 			    ((sin_t *)sti->sti_laddr_sa)->sin_port == 0)
2485 				sti->sti_laddr_valid = 0;
2486 			break;
2487 
2488 		case AF_INET6:
2489 			ASSERT(sti->sti_laddr_len ==
2490 			    (socklen_t)sizeof (sin6_t));
2491 			if (IN6_IS_ADDR_UNSPECIFIED(
2492 			    &((sin6_t *)sti->sti_laddr_sa) ->sin6_addr) ||
2493 			    IN6_IS_ADDR_V4MAPPED_ANY(
2494 			    &((sin6_t *)sti->sti_laddr_sa)->sin6_addr) ||
2495 			    ((sin6_t *)sti->sti_laddr_sa)->sin6_port == 0)
2496 				sti->sti_laddr_valid = 0;
2497 			break;
2498 
2499 		default:
2500 			break;
2501 		}
2502 	}
2503 
2504 	/*
2505 	 * Check for failure of an earlier call
2506 	 */
2507 	if (so->so_error != 0)
2508 		goto so_bad;
2509 
2510 	/*
2511 	 * Send down T_CONN_REQ. Message was allocated above.
2512 	 */
2513 	conn_req.PRIM_type = T_CONN_REQ;
2514 	conn_req.DEST_length = addrlen;
2515 	conn_req.DEST_offset = (t_scalar_t)sizeof (conn_req);
2516 	if (srclen == 0) {
2517 		conn_req.OPT_length = 0;
2518 		conn_req.OPT_offset = 0;
2519 		soappendmsg(mp, &conn_req, sizeof (conn_req));
2520 		soappendmsg(mp, addr, addrlen);
2521 	} else {
2522 		/*
2523 		 * There is a AF_UNIX sockaddr_un to include as a source
2524 		 * address option.
2525 		 */
2526 		struct T_opthdr toh;
2527 
2528 		toh.level = SOL_SOCKET;
2529 		toh.name = SO_SRCADDR;
2530 		toh.len = (t_uscalar_t)(srclen + sizeof (struct T_opthdr));
2531 		toh.status = 0;
2532 		conn_req.OPT_length =
2533 		    (t_scalar_t)(sizeof (toh) + _TPI_ALIGN_TOPT(srclen));
2534 		conn_req.OPT_offset = (t_scalar_t)(sizeof (conn_req) +
2535 		    _TPI_ALIGN_TOPT(addrlen));
2536 
2537 		soappendmsg(mp, &conn_req, sizeof (conn_req));
2538 		soappendmsg(mp, addr, addrlen);
2539 		mp->b_wptr += _TPI_ALIGN_TOPT(addrlen) - addrlen;
2540 		soappendmsg(mp, &toh, sizeof (toh));
2541 		soappendmsg(mp, src, srclen);
2542 		mp->b_wptr += _TPI_ALIGN_TOPT(srclen) - srclen;
2543 		ASSERT(mp->b_wptr <= mp->b_datap->db_lim);
2544 	}
2545 	/*
2546 	 * Set SS_ISCONNECTING before sending down the T_CONN_REQ
2547 	 * in order to have the right state when the T_CONN_CON shows up.
2548 	 */
2549 	soisconnecting(so);
2550 	mutex_exit(&so->so_lock);
2551 
2552 	if (AU_AUDITING())
2553 		audit_sock(T_CONN_REQ, strvp2wq(SOTOV(so)), mp, 0);
2554 
2555 	error = kstrputmsg(SOTOV(so), mp, NULL, 0, 0,
2556 	    MSG_BAND|MSG_HOLDSIG|MSG_IGNERROR, 0);
2557 	mp = NULL;
2558 	mutex_enter(&so->so_lock);
2559 	if (error != 0)
2560 		goto bad;
2561 
2562 	if ((error = sowaitokack(so, T_CONN_REQ)) != 0)
2563 		goto bad;
2564 
2565 	/* Allow other threads to access the socket */
2566 	so_unlock_single(so, SOLOCKED);
2567 	need_unlock = B_FALSE;
2568 
2569 	/*
2570 	 * Wait until we get a T_CONN_CON or an error
2571 	 */
2572 	if ((error = sowaitconnected(so, fflag, 0)) != 0) {
2573 		so_lock_single(so);	/* Set SOLOCKED */
2574 		need_unlock = B_TRUE;
2575 	}
2576 
2577 done:
2578 	freemsg(mp);
2579 	switch (error) {
2580 	case EINPROGRESS:
2581 	case EALREADY:
2582 	case EISCONN:
2583 	case EINTR:
2584 		/* Non-fatal errors */
2585 		sti->sti_laddr_valid = 0;
2586 		/* FALLTHRU */
2587 	case 0:
2588 		break;
2589 	default:
2590 		ASSERT(need_unlock);
2591 		/*
2592 		 * Fatal errors: clear SS_ISCONNECTING in case it was set,
2593 		 * and invalidate local-address cache
2594 		 */
2595 		so->so_state &= ~SS_ISCONNECTING;
2596 		sti->sti_laddr_valid = 0;
2597 		/* A discon_ind might have already unbound us */
2598 		if ((flags & _SOCONNECT_DID_BIND) &&
2599 		    (so->so_state & SS_ISBOUND)) {
2600 			int err;
2601 
2602 			err = sotpi_unbind(so, 0);
2603 			/* LINTED - statement has no conseq */
2604 			if (err) {
2605 				eprintsoline(so, err);
2606 			}
2607 		}
2608 		break;
2609 	}
2610 	if (need_unlock)
2611 		so_unlock_single(so, SOLOCKED);
2612 	mutex_exit(&so->so_lock);
2613 	return (error);
2614 
2615 so_bad:	error = sogeterr(so, B_TRUE);
2616 bad:	eprintsoline(so, error);
2617 	goto done;
2618 }
2619 
2620 /* ARGSUSED */
2621 int
2622 sotpi_shutdown(struct sonode *so, int how, struct cred *cr)
2623 {
2624 	struct T_ordrel_req	ordrel_req;
2625 	mblk_t			*mp;
2626 	uint_t			old_state, state_change;
2627 	int			error = 0;
2628 	sotpi_info_t		*sti = SOTOTPI(so);
2629 
2630 	dprintso(so, 1, ("sotpi_shutdown(%p, %d) %s\n",
2631 	    (void *)so, how, pr_state(so->so_state, so->so_mode)));
2632 
2633 	mutex_enter(&so->so_lock);
2634 	so_lock_single(so);	/* Set SOLOCKED */
2635 
2636 	/*
2637 	 * SunOS 4.X has no check for datagram sockets.
2638 	 * 5.X checks that it is connected (ENOTCONN)
2639 	 * X/Open requires that we check the connected state.
2640 	 */
2641 	if (!(so->so_state & SS_ISCONNECTED)) {
2642 		if (!xnet_skip_checks) {
2643 			error = ENOTCONN;
2644 			if (xnet_check_print) {
2645 				printf("sockfs: X/Open shutdown check "
2646 				    "caused ENOTCONN\n");
2647 			}
2648 		}
2649 		goto done;
2650 	}
2651 	/*
2652 	 * Record the current state and then perform any state changes.
2653 	 * Then use the difference between the old and new states to
2654 	 * determine which messages need to be sent.
2655 	 * This prevents e.g. duplicate T_ORDREL_REQ when there are
2656 	 * duplicate calls to shutdown().
2657 	 */
2658 	old_state = so->so_state;
2659 
2660 	switch (how) {
2661 	case 0:
2662 		socantrcvmore(so);
2663 		break;
2664 	case 1:
2665 		socantsendmore(so);
2666 		break;
2667 	case 2:
2668 		socantsendmore(so);
2669 		socantrcvmore(so);
2670 		break;
2671 	default:
2672 		error = EINVAL;
2673 		goto done;
2674 	}
2675 
2676 	/*
2677 	 * Assumes that the SS_CANT* flags are never cleared in the above code.
2678 	 */
2679 	state_change = (so->so_state & (SS_CANTRCVMORE|SS_CANTSENDMORE)) -
2680 	    (old_state & (SS_CANTRCVMORE|SS_CANTSENDMORE));
2681 	ASSERT((state_change & ~(SS_CANTRCVMORE|SS_CANTSENDMORE)) == 0);
2682 
2683 	switch (state_change) {
2684 	case 0:
2685 		dprintso(so, 1,
2686 		    ("sotpi_shutdown: nothing to send in state 0x%x\n",
2687 		    so->so_state));
2688 		goto done;
2689 
2690 	case SS_CANTRCVMORE:
2691 		mutex_exit(&so->so_lock);
2692 		strseteof(SOTOV(so), 1);
2693 		/*
2694 		 * strseteof takes care of read side wakeups,
2695 		 * pollwakeups, and signals.
2696 		 */
2697 		/*
2698 		 * Get the read lock before flushing data to avoid problems
2699 		 * with the T_EXDATA_IND MSG_PEEK code in sotpi_recvmsg.
2700 		 */
2701 		mutex_enter(&so->so_lock);
2702 		(void) so_lock_read(so, 0);	/* Set SOREADLOCKED */
2703 		mutex_exit(&so->so_lock);
2704 
2705 		/* Flush read side queue */
2706 		strflushrq(SOTOV(so), FLUSHALL);
2707 
2708 		mutex_enter(&so->so_lock);
2709 		so_unlock_read(so);		/* Clear SOREADLOCKED */
2710 		break;
2711 
2712 	case SS_CANTSENDMORE:
2713 		mutex_exit(&so->so_lock);
2714 		strsetwerror(SOTOV(so), 0, 0, sogetwrerr);
2715 		mutex_enter(&so->so_lock);
2716 		break;
2717 
2718 	case SS_CANTSENDMORE|SS_CANTRCVMORE:
2719 		mutex_exit(&so->so_lock);
2720 		strsetwerror(SOTOV(so), 0, 0, sogetwrerr);
2721 		strseteof(SOTOV(so), 1);
2722 		/*
2723 		 * strseteof takes care of read side wakeups,
2724 		 * pollwakeups, and signals.
2725 		 */
2726 		/*
2727 		 * Get the read lock before flushing data to avoid problems
2728 		 * with the T_EXDATA_IND MSG_PEEK code in sotpi_recvmsg.
2729 		 */
2730 		mutex_enter(&so->so_lock);
2731 		(void) so_lock_read(so, 0);	/* Set SOREADLOCKED */
2732 		mutex_exit(&so->so_lock);
2733 
2734 		/* Flush read side queue */
2735 		strflushrq(SOTOV(so), FLUSHALL);
2736 
2737 		mutex_enter(&so->so_lock);
2738 		so_unlock_read(so);		/* Clear SOREADLOCKED */
2739 		break;
2740 	}
2741 
2742 	ASSERT(MUTEX_HELD(&so->so_lock));
2743 
2744 	/*
2745 	 * If either SS_CANTSENDMORE or SS_CANTRCVMORE or both of them
2746 	 * was set due to this call and the new state has both of them set:
2747 	 *	Send the AF_UNIX close indication
2748 	 *	For T_COTS send a discon_ind
2749 	 *
2750 	 * If cantsend was set due to this call:
2751 	 *	For T_COTSORD send an ordrel_ind
2752 	 *
2753 	 * Note that for T_CLTS there is no message sent here.
2754 	 */
2755 	if ((so->so_state & (SS_CANTRCVMORE|SS_CANTSENDMORE)) ==
2756 	    (SS_CANTRCVMORE|SS_CANTSENDMORE)) {
2757 		/*
2758 		 * For SunOS 4.X compatibility we tell the other end
2759 		 * that we are unable to receive at this point.
2760 		 */
2761 		if (so->so_family == AF_UNIX && sti->sti_serv_type != T_CLTS)
2762 			so_unix_close(so);
2763 
2764 		if (sti->sti_serv_type == T_COTS)
2765 			error = sodisconnect(so, -1, _SODISCONNECT_LOCK_HELD);
2766 	}
2767 	if ((state_change & SS_CANTSENDMORE) &&
2768 	    (sti->sti_serv_type == T_COTS_ORD)) {
2769 		/* Send an orderly release */
2770 		ordrel_req.PRIM_type = T_ORDREL_REQ;
2771 
2772 		mutex_exit(&so->so_lock);
2773 		mp = soallocproto1(&ordrel_req, sizeof (ordrel_req),
2774 		    0, _ALLOC_SLEEP, cr);
2775 		/*
2776 		 * Send down the T_ORDREL_REQ even if there is flow control.
2777 		 * This prevents shutdown from blocking.
2778 		 * Note that there is no T_OK_ACK for ordrel_req.
2779 		 */
2780 		error = kstrputmsg(SOTOV(so), mp, NULL, 0, 0,
2781 		    MSG_BAND|MSG_HOLDSIG|MSG_IGNERROR|MSG_IGNFLOW, 0);
2782 		mutex_enter(&so->so_lock);
2783 		if (error) {
2784 			eprintsoline(so, error);
2785 			goto done;
2786 		}
2787 	}
2788 
2789 done:
2790 	so_unlock_single(so, SOLOCKED);
2791 	mutex_exit(&so->so_lock);
2792 	return (error);
2793 }
2794 
2795 /*
2796  * For any connected SOCK_STREAM/SOCK_SEQPACKET AF_UNIX socket we send
2797  * a zero-length T_OPTDATA_REQ with the SO_UNIX_CLOSE option to inform the peer
2798  * that we have closed.
2799  * Also, for connected AF_UNIX SOCK_DGRAM sockets we send a zero-length
2800  * T_UNITDATA_REQ containing the same option.
2801  *
2802  * For SOCK_DGRAM half-connections (somebody connected to this end
2803  * but this end is not connect) we don't know where to send any
2804  * SO_UNIX_CLOSE.
2805  *
2806  * We have to ignore stream head errors just in case there has been
2807  * a shutdown(output).
2808  * Ignore any flow control to try to get the message more quickly to the peer.
2809  * While locally ignoring flow control solves the problem when there
2810  * is only the loopback transport on the stream it would not provide
2811  * the correct AF_UNIX socket semantics when one or more modules have
2812  * been pushed.
2813  */
2814 void
2815 so_unix_close(struct sonode *so)
2816 {
2817 	struct T_opthdr	toh;
2818 	mblk_t		*mp;
2819 	sotpi_info_t	*sti = SOTOTPI(so);
2820 
2821 	ASSERT(MUTEX_HELD(&so->so_lock));
2822 
2823 	ASSERT(so->so_family == AF_UNIX);
2824 
2825 	if ((so->so_state & (SS_ISCONNECTED|SS_ISBOUND)) !=
2826 	    (SS_ISCONNECTED|SS_ISBOUND))
2827 		return;
2828 
2829 	dprintso(so, 1, ("so_unix_close(%p) %s\n",
2830 	    (void *)so, pr_state(so->so_state, so->so_mode)));
2831 
2832 	toh.level = SOL_SOCKET;
2833 	toh.name = SO_UNIX_CLOSE;
2834 
2835 	/* zero length + header */
2836 	toh.len = (t_uscalar_t)sizeof (struct T_opthdr);
2837 	toh.status = 0;
2838 
2839 	if (so->so_type == SOCK_STREAM || so->so_type == SOCK_SEQPACKET) {
2840 		struct T_optdata_req tdr;
2841 
2842 		tdr.PRIM_type = T_OPTDATA_REQ;
2843 		tdr.DATA_flag = 0;
2844 
2845 		tdr.OPT_length = (t_scalar_t)sizeof (toh);
2846 		tdr.OPT_offset = (t_scalar_t)sizeof (tdr);
2847 
2848 		/* NOTE: holding so_lock while sleeping */
2849 		mp = soallocproto2(&tdr, sizeof (tdr),
2850 		    &toh, sizeof (toh), 0, _ALLOC_SLEEP, CRED());
2851 	} else {
2852 		struct T_unitdata_req	tudr;
2853 		void			*addr;
2854 		socklen_t		addrlen;
2855 		void			*src;
2856 		socklen_t		srclen;
2857 		struct T_opthdr		toh2;
2858 		t_scalar_t		size;
2859 
2860 		/*
2861 		 * We know this is an AF_UNIX connected DGRAM socket.
2862 		 * We therefore already have the destination address
2863 		 * in the internal form needed for this send.  This is
2864 		 * similar to the sosend_dgram call later in this file
2865 		 * when there's no user-specified destination address.
2866 		 */
2867 		if (sti->sti_faddr_noxlate) {
2868 			/*
2869 			 * Already have a transport internal address. Do not
2870 			 * pass any (transport internal) source address.
2871 			 */
2872 			addr = sti->sti_faddr_sa;
2873 			addrlen = (t_uscalar_t)sti->sti_faddr_len;
2874 			src = NULL;
2875 			srclen = 0;
2876 		} else {
2877 			/*
2878 			 * Pass the sockaddr_un source address as an option
2879 			 * and translate the remote address.
2880 			 * Holding so_lock thus sti_laddr_sa can not change.
2881 			 */
2882 			src = sti->sti_laddr_sa;
2883 			srclen = (socklen_t)sti->sti_laddr_len;
2884 			dprintso(so, 1,
2885 			    ("so_ux_close: srclen %d, src %p\n",
2886 			    srclen, src));
2887 			/*
2888 			 * Use the destination address saved in connect.
2889 			 */
2890 			addr = &sti->sti_ux_faddr;
2891 			addrlen = sizeof (sti->sti_ux_faddr);
2892 		}
2893 		tudr.PRIM_type = T_UNITDATA_REQ;
2894 		tudr.DEST_length = addrlen;
2895 		tudr.DEST_offset = (t_scalar_t)sizeof (tudr);
2896 		if (srclen == 0) {
2897 			tudr.OPT_length = (t_scalar_t)sizeof (toh);
2898 			tudr.OPT_offset = (t_scalar_t)(sizeof (tudr) +
2899 			    _TPI_ALIGN_TOPT(addrlen));
2900 
2901 			size = tudr.OPT_offset + tudr.OPT_length;
2902 			/* NOTE: holding so_lock while sleeping */
2903 			mp = soallocproto2(&tudr, sizeof (tudr),
2904 			    addr, addrlen, size, _ALLOC_SLEEP, CRED());
2905 			mp->b_wptr += (_TPI_ALIGN_TOPT(addrlen) - addrlen);
2906 			soappendmsg(mp, &toh, sizeof (toh));
2907 		} else {
2908 			/*
2909 			 * There is a AF_UNIX sockaddr_un to include as a
2910 			 * source address option.
2911 			 */
2912 			tudr.OPT_length = (t_scalar_t)(2 * sizeof (toh) +
2913 			    _TPI_ALIGN_TOPT(srclen));
2914 			tudr.OPT_offset = (t_scalar_t)(sizeof (tudr) +
2915 			    _TPI_ALIGN_TOPT(addrlen));
2916 
2917 			toh2.level = SOL_SOCKET;
2918 			toh2.name = SO_SRCADDR;
2919 			toh2.len = (t_uscalar_t)(srclen +
2920 			    sizeof (struct T_opthdr));
2921 			toh2.status = 0;
2922 
2923 			size = tudr.OPT_offset + tudr.OPT_length;
2924 
2925 			/* NOTE: holding so_lock while sleeping */
2926 			mp = soallocproto2(&tudr, sizeof (tudr),
2927 			    addr, addrlen, size, _ALLOC_SLEEP, CRED());
2928 			mp->b_wptr += _TPI_ALIGN_TOPT(addrlen) - addrlen;
2929 			soappendmsg(mp, &toh, sizeof (toh));
2930 			soappendmsg(mp, &toh2, sizeof (toh2));
2931 			soappendmsg(mp, src, srclen);
2932 			mp->b_wptr += _TPI_ALIGN_TOPT(srclen) - srclen;
2933 		}
2934 		ASSERT(mp->b_wptr <= mp->b_datap->db_lim);
2935 	}
2936 	mutex_exit(&so->so_lock);
2937 	(void) kstrputmsg(SOTOV(so), mp, NULL, 0, 0,
2938 	    MSG_BAND|MSG_HOLDSIG|MSG_IGNERROR|MSG_IGNFLOW, 0);
2939 	mutex_enter(&so->so_lock);
2940 }
2941 
2942 /*
2943  * Called by sotpi_recvmsg when reading a non-zero amount of data.
2944  * In addition, the caller typically verifies that there is some
2945  * potential state to clear by checking
2946  *	if (so->so_state & (SS_OOBPEND|SS_HAVEOOBDATA|SS_RCVATMARK))
2947  * before calling this routine.
2948  * Note that such a check can be made without holding so_lock since
2949  * sotpi_recvmsg is single-threaded (using SOREADLOCKED) and only sotpi_recvmsg
2950  * decrements sti_oobsigcnt.
2951  *
2952  * When data is read *after* the point that all pending
2953  * oob data has been consumed the oob indication is cleared.
2954  *
2955  * This logic keeps select/poll returning POLLRDBAND and
2956  * SIOCATMARK returning true until we have read past
2957  * the mark.
2958  */
2959 static void
2960 sorecv_update_oobstate(struct sonode *so)
2961 {
2962 	sotpi_info_t *sti = SOTOTPI(so);
2963 
2964 	mutex_enter(&so->so_lock);
2965 	ASSERT(so_verify_oobstate(so));
2966 	dprintso(so, 1,
2967 	    ("sorecv_update_oobstate: counts %d/%d state %s\n",
2968 	    sti->sti_oobsigcnt,
2969 	    sti->sti_oobcnt, pr_state(so->so_state, so->so_mode)));
2970 	if (sti->sti_oobsigcnt == 0) {
2971 		/* No more pending oob indications */
2972 		so->so_state &= ~(SS_OOBPEND|SS_HAVEOOBDATA|SS_RCVATMARK);
2973 		freemsg(so->so_oobmsg);
2974 		so->so_oobmsg = NULL;
2975 	}
2976 	ASSERT(so_verify_oobstate(so));
2977 	mutex_exit(&so->so_lock);
2978 }
2979 
2980 /*
2981  * Handle recv* calls for an so which has NL7C saved recv mblk_t(s).
2982  */
2983 static int
2984 nl7c_sorecv(struct sonode *so, mblk_t **rmp, uio_t *uiop, rval_t *rp)
2985 {
2986 	sotpi_info_t *sti = SOTOTPI(so);
2987 	int	error = 0;
2988 	mblk_t *tmp = NULL;
2989 	mblk_t *pmp = NULL;
2990 	mblk_t *nmp = sti->sti_nl7c_rcv_mp;
2991 
2992 	ASSERT(nmp != NULL);
2993 
2994 	while (nmp != NULL && uiop->uio_resid > 0) {
2995 		ssize_t n;
2996 
2997 		if (DB_TYPE(nmp) == M_DATA) {
2998 			/*
2999 			 * We have some data, uiomove up to resid bytes.
3000 			 */
3001 			n = MIN(MBLKL(nmp), uiop->uio_resid);
3002 			if (n > 0)
3003 				error = uiomove(nmp->b_rptr, n, UIO_READ, uiop);
3004 			nmp->b_rptr += n;
3005 			if (nmp->b_rptr == nmp->b_wptr) {
3006 				pmp = nmp;
3007 				nmp = nmp->b_cont;
3008 			}
3009 			if (error)
3010 				break;
3011 		} else {
3012 			/*
3013 			 * We only handle data, save for caller to handle.
3014 			 */
3015 			if (pmp != NULL) {
3016 				pmp->b_cont = nmp->b_cont;
3017 			}
3018 			nmp->b_cont = NULL;
3019 			if (*rmp == NULL) {
3020 				*rmp = nmp;
3021 			} else {
3022 				tmp->b_cont = nmp;
3023 			}
3024 			nmp = nmp->b_cont;
3025 			tmp = nmp;
3026 		}
3027 	}
3028 	if (pmp != NULL) {
3029 		/* Free any mblk_t(s) which we have consumed */
3030 		pmp->b_cont = NULL;
3031 		freemsg(sti->sti_nl7c_rcv_mp);
3032 	}
3033 	if ((sti->sti_nl7c_rcv_mp = nmp) == NULL) {
3034 		/* Last mblk_t so return the saved kstrgetmsg() rval/error */
3035 		if (error == 0) {
3036 			rval_t	*p = (rval_t *)&sti->sti_nl7c_rcv_rval;
3037 
3038 			error = p->r_v.r_v2;
3039 			p->r_v.r_v2 = 0;
3040 		}
3041 		rp->r_vals = sti->sti_nl7c_rcv_rval;
3042 		sti->sti_nl7c_rcv_rval = 0;
3043 	} else {
3044 		/* More mblk_t(s) to process so no rval to return */
3045 		rp->r_vals = 0;
3046 	}
3047 	return (error);
3048 }
3049 /*
3050  * Receive the next message on the queue.
3051  * If msg_controllen is non-zero when called the caller is interested in
3052  * any received control info (options).
3053  * If msg_namelen is non-zero when called the caller is interested in
3054  * any received source address.
3055  * The routine returns with msg_control and msg_name pointing to
3056  * kmem_alloc'ed memory which the caller has to free.
3057  */
3058 /* ARGSUSED */
3059 int
3060 sotpi_recvmsg(struct sonode *so, struct nmsghdr *msg, struct uio *uiop,
3061     struct cred *cr)
3062 {
3063 	union T_primitives	*tpr;
3064 	mblk_t			*mp;
3065 	uchar_t			pri;
3066 	int			pflag, opflag;
3067 	void			*control;
3068 	t_uscalar_t		controllen;
3069 	t_uscalar_t		namelen;
3070 	int			so_state = so->so_state; /* Snapshot */
3071 	ssize_t			saved_resid;
3072 	rval_t			rval;
3073 	int			flags;
3074 	clock_t			timout;
3075 	int			error = 0;
3076 	sotpi_info_t		*sti = SOTOTPI(so);
3077 
3078 	flags = msg->msg_flags;
3079 	msg->msg_flags = 0;
3080 
3081 	dprintso(so, 1, ("sotpi_recvmsg(%p, %p, 0x%x) state %s err %d\n",
3082 	    (void *)so, (void *)msg, flags,
3083 	    pr_state(so->so_state, so->so_mode), so->so_error));
3084 
3085 	if (so->so_version == SOV_STREAM) {
3086 		so_update_attrs(so, SOACC);
3087 		/* The imaginary "sockmod" has been popped - act as a stream */
3088 		return (strread(SOTOV(so), uiop, cr));
3089 	}
3090 
3091 	/*
3092 	 * If we are not connected because we have never been connected
3093 	 * we return ENOTCONN. If we have been connected (but are no longer
3094 	 * connected) then SS_CANTRCVMORE is set and we let kstrgetmsg return
3095 	 * the EOF.
3096 	 *
3097 	 * An alternative would be to post an ENOTCONN error in stream head
3098 	 * (read+write) and clear it when we're connected. However, that error
3099 	 * would cause incorrect poll/select behavior!
3100 	 */
3101 	if ((so_state & (SS_ISCONNECTED|SS_CANTRCVMORE)) == 0 &&
3102 	    (so->so_mode & SM_CONNREQUIRED)) {
3103 		return (ENOTCONN);
3104 	}
3105 
3106 	/*
3107 	 * Note: SunOS 4.X checks uio_resid == 0 before going to sleep (but
3108 	 * after checking that the read queue is empty) and returns zero.
3109 	 * This implementation will sleep (in kstrgetmsg) even if uio_resid
3110 	 * is zero.
3111 	 */
3112 
3113 	if (flags & MSG_OOB) {
3114 		/* Check that the transport supports OOB */
3115 		if (!(so->so_mode & SM_EXDATA))
3116 			return (EOPNOTSUPP);
3117 		so_update_attrs(so, SOACC);
3118 		return (sorecvoob(so, msg, uiop, flags,
3119 		    (so->so_options & SO_OOBINLINE)));
3120 	}
3121 
3122 	so_update_attrs(so, SOACC);
3123 
3124 	/*
3125 	 * Set msg_controllen and msg_namelen to zero here to make it
3126 	 * simpler in the cases that no control or name is returned.
3127 	 */
3128 	controllen = msg->msg_controllen;
3129 	namelen = msg->msg_namelen;
3130 	msg->msg_controllen = 0;
3131 	msg->msg_namelen = 0;
3132 
3133 	dprintso(so, 1, ("sotpi_recvmsg: namelen %d controllen %d\n",
3134 	    namelen, controllen));
3135 
3136 	mutex_enter(&so->so_lock);
3137 	/*
3138 	 * If an NL7C enabled socket and not waiting for write data.
3139 	 */
3140 	if ((sti->sti_nl7c_flags & (NL7C_ENABLED | NL7C_WAITWRITE)) ==
3141 	    NL7C_ENABLED) {
3142 		if (sti->sti_nl7c_uri) {
3143 			/* Close uri processing for a previous request */
3144 			nl7c_close(so);
3145 		}
3146 		if ((so_state & SS_CANTRCVMORE) &&
3147 		    sti->sti_nl7c_rcv_mp == NULL) {
3148 			/* Nothing to process, EOF */
3149 			mutex_exit(&so->so_lock);
3150 			return (0);
3151 		} else if (sti->sti_nl7c_flags & NL7C_SOPERSIST) {
3152 			/* Persistent NL7C socket, try to process request */
3153 			boolean_t ret;
3154 
3155 			ret = nl7c_process(so,
3156 			    (so->so_state & (SS_NONBLOCK|SS_NDELAY)));
3157 			rval.r_vals = sti->sti_nl7c_rcv_rval;
3158 			error = rval.r_v.r_v2;
3159 			if (error) {
3160 				/* Error of some sort, return it */
3161 				mutex_exit(&so->so_lock);
3162 				return (error);
3163 			}
3164 			if (sti->sti_nl7c_flags &&
3165 			    ! (sti->sti_nl7c_flags & NL7C_WAITWRITE)) {
3166 				/*
3167 				 * Still an NL7C socket and no data
3168 				 * to pass up to the caller.
3169 				 */
3170 				mutex_exit(&so->so_lock);
3171 				if (ret) {
3172 					/* EOF */
3173 					return (0);
3174 				} else {
3175 					/* Need more data */
3176 					return (EAGAIN);
3177 				}
3178 			}
3179 		} else {
3180 			/*
3181 			 * Not persistent so no further NL7C processing.
3182 			 */
3183 			sti->sti_nl7c_flags = 0;
3184 		}
3185 	}
3186 	/*
3187 	 * Only one reader is allowed at any given time. This is needed
3188 	 * for T_EXDATA handling and, in the future, MSG_WAITALL.
3189 	 *
3190 	 * This is slightly different that BSD behavior in that it fails with
3191 	 * EWOULDBLOCK when using nonblocking io. In BSD the read queue access
3192 	 * is single-threaded using sblock(), which is dropped while waiting
3193 	 * for data to appear. The difference shows up e.g. if one
3194 	 * file descriptor does not have O_NONBLOCK but a dup'ed file descriptor
3195 	 * does use nonblocking io and different threads are reading each
3196 	 * file descriptor. In BSD there would never be an EWOULDBLOCK error
3197 	 * in this case as long as the read queue doesn't get empty.
3198 	 * In this implementation the thread using nonblocking io can
3199 	 * get an EWOULDBLOCK error due to the blocking thread executing
3200 	 * e.g. in the uiomove in kstrgetmsg.
3201 	 * This difference is not believed to be significant.
3202 	 */
3203 	/* Set SOREADLOCKED */
3204 	error = so_lock_read_intr(so,
3205 	    uiop->uio_fmode | ((flags & MSG_DONTWAIT) ? FNONBLOCK : 0));
3206 	mutex_exit(&so->so_lock);
3207 	if (error)
3208 		return (error);
3209 
3210 	/*
3211 	 * Tell kstrgetmsg to not inspect the stream head errors until all
3212 	 * queued data has been consumed.
3213 	 * Use a timeout=-1 to wait forever unless MSG_DONTWAIT is set.
3214 	 * Also, If uio_fmode indicates nonblocking kstrgetmsg will not block.
3215 	 *
3216 	 * MSG_WAITALL only applies to M_DATA and T_DATA_IND messages and
3217 	 * to T_OPTDATA_IND that do not contain any user-visible control msg.
3218 	 * Note that MSG_WAITALL set with MSG_PEEK is a noop.
3219 	 */
3220 	pflag = MSG_ANY | MSG_DELAYERROR;
3221 	if (flags & MSG_PEEK) {
3222 		pflag |= MSG_IPEEK;
3223 		flags &= ~MSG_WAITALL;
3224 	}
3225 	if (so->so_mode & SM_ATOMIC)
3226 		pflag |= MSG_DISCARDTAIL;
3227 
3228 	if (flags & MSG_DONTWAIT)
3229 		timout = 0;
3230 	else if (so->so_rcvtimeo != 0)
3231 		timout = TICK_TO_MSEC(so->so_rcvtimeo);
3232 	else
3233 		timout = -1;
3234 	opflag = pflag;
3235 retry:
3236 	saved_resid = uiop->uio_resid;
3237 	pri = 0;
3238 	mp = NULL;
3239 	if (sti->sti_nl7c_rcv_mp != NULL) {
3240 		/* Already kstrgetmsg()ed saved mblk(s) from NL7C */
3241 		error = nl7c_sorecv(so, &mp, uiop, &rval);
3242 	} else {
3243 		error = kstrgetmsg(SOTOV(so), &mp, uiop, &pri, &pflag,
3244 		    timout, &rval);
3245 	}
3246 	if (error != 0) {
3247 		/* kstrgetmsg returns ETIME when timeout expires */
3248 		if (error == ETIME)
3249 			error = EWOULDBLOCK;
3250 		goto out;
3251 	}
3252 	/*
3253 	 * For datagrams the MOREDATA flag is used to set MSG_TRUNC.
3254 	 * For non-datagrams MOREDATA is used to set MSG_EOR.
3255 	 */
3256 	ASSERT(!(rval.r_val1 & MORECTL));
3257 	if ((rval.r_val1 & MOREDATA) && (so->so_mode & SM_ATOMIC))
3258 		msg->msg_flags |= MSG_TRUNC;
3259 
3260 	if (mp == NULL) {
3261 		dprintso(so, 1, ("sotpi_recvmsg: got M_DATA\n"));
3262 		/*
3263 		 * 4.3BSD and 4.4BSD clears the mark when peeking across it.
3264 		 * The draft Posix socket spec states that the mark should
3265 		 * not be cleared when peeking. We follow the latter.
3266 		 */
3267 		if ((so->so_state &
3268 		    (SS_OOBPEND|SS_HAVEOOBDATA|SS_RCVATMARK)) &&
3269 		    (uiop->uio_resid != saved_resid) &&
3270 		    !(flags & MSG_PEEK)) {
3271 			sorecv_update_oobstate(so);
3272 		}
3273 
3274 		mutex_enter(&so->so_lock);
3275 		/* Set MSG_EOR based on MOREDATA */
3276 		if (!(rval.r_val1 & MOREDATA)) {
3277 			if (so->so_state & SS_SAVEDEOR) {
3278 				msg->msg_flags |= MSG_EOR;
3279 				so->so_state &= ~SS_SAVEDEOR;
3280 			}
3281 		}
3282 		/*
3283 		 * If some data was received (i.e. not EOF) and the
3284 		 * read/recv* has not been satisfied wait for some more.
3285 		 */
3286 		if ((flags & MSG_WAITALL) && !(msg->msg_flags & MSG_EOR) &&
3287 		    uiop->uio_resid != saved_resid && uiop->uio_resid > 0) {
3288 			mutex_exit(&so->so_lock);
3289 			pflag = opflag | MSG_NOMARK;
3290 			goto retry;
3291 		}
3292 		goto out_locked;
3293 	}
3294 
3295 	/* strsock_proto has already verified length and alignment */
3296 	tpr = (union T_primitives *)mp->b_rptr;
3297 	dprintso(so, 1, ("sotpi_recvmsg: type %d\n", tpr->type));
3298 
3299 	switch (tpr->type) {
3300 	case T_DATA_IND: {
3301 		if ((so->so_state &
3302 		    (SS_OOBPEND|SS_HAVEOOBDATA|SS_RCVATMARK)) &&
3303 		    (uiop->uio_resid != saved_resid) &&
3304 		    !(flags & MSG_PEEK)) {
3305 			sorecv_update_oobstate(so);
3306 		}
3307 
3308 		/*
3309 		 * Set msg_flags to MSG_EOR based on
3310 		 * MORE_flag and MOREDATA.
3311 		 */
3312 		mutex_enter(&so->so_lock);
3313 		so->so_state &= ~SS_SAVEDEOR;
3314 		if (!(tpr->data_ind.MORE_flag & 1)) {
3315 			if (!(rval.r_val1 & MOREDATA))
3316 				msg->msg_flags |= MSG_EOR;
3317 			else
3318 				so->so_state |= SS_SAVEDEOR;
3319 		}
3320 		freemsg(mp);
3321 		/*
3322 		 * If some data was received (i.e. not EOF) and the
3323 		 * read/recv* has not been satisfied wait for some more.
3324 		 */
3325 		if ((flags & MSG_WAITALL) && !(msg->msg_flags & MSG_EOR) &&
3326 		    uiop->uio_resid != saved_resid && uiop->uio_resid > 0) {
3327 			mutex_exit(&so->so_lock);
3328 			pflag = opflag | MSG_NOMARK;
3329 			goto retry;
3330 		}
3331 		goto out_locked;
3332 	}
3333 	case T_UNITDATA_IND: {
3334 		void *addr;
3335 		t_uscalar_t addrlen;
3336 		void *abuf;
3337 		t_uscalar_t optlen;
3338 		void *opt;
3339 
3340 		if ((so->so_state &
3341 		    (SS_OOBPEND|SS_HAVEOOBDATA|SS_RCVATMARK)) &&
3342 		    (uiop->uio_resid != saved_resid) &&
3343 		    !(flags & MSG_PEEK)) {
3344 			sorecv_update_oobstate(so);
3345 		}
3346 
3347 		if (namelen != 0) {
3348 			/* Caller wants source address */
3349 			addrlen = tpr->unitdata_ind.SRC_length;
3350 			addr = sogetoff(mp,
3351 			    tpr->unitdata_ind.SRC_offset,
3352 			    addrlen, 1);
3353 			if (addr == NULL) {
3354 				freemsg(mp);
3355 				error = EPROTO;
3356 				eprintsoline(so, error);
3357 				goto out;
3358 			}
3359 			if (so->so_family == AF_UNIX) {
3360 				/*
3361 				 * Can not use the transport level address.
3362 				 * If there is a SO_SRCADDR option carrying
3363 				 * the socket level address it will be
3364 				 * extracted below.
3365 				 */
3366 				addr = NULL;
3367 				addrlen = 0;
3368 			}
3369 		}
3370 		optlen = tpr->unitdata_ind.OPT_length;
3371 		if (optlen != 0) {
3372 			t_uscalar_t ncontrollen;
3373 
3374 			/*
3375 			 * Extract any source address option.
3376 			 * Determine how large cmsg buffer is needed.
3377 			 */
3378 			opt = sogetoff(mp,
3379 			    tpr->unitdata_ind.OPT_offset,
3380 			    optlen, __TPI_ALIGN_SIZE);
3381 
3382 			if (opt == NULL) {
3383 				freemsg(mp);
3384 				error = EPROTO;
3385 				eprintsoline(so, error);
3386 				goto out;
3387 			}
3388 			if (so->so_family == AF_UNIX)
3389 				so_getopt_srcaddr(opt, optlen, &addr, &addrlen);
3390 			ncontrollen = so_cmsglen(mp, opt, optlen,
3391 			    !(flags & MSG_XPG4_2));
3392 			if (controllen != 0)
3393 				controllen = ncontrollen;
3394 			else if (ncontrollen != 0)
3395 				msg->msg_flags |= MSG_CTRUNC;
3396 		} else {
3397 			controllen = 0;
3398 		}
3399 
3400 		if (namelen != 0) {
3401 			/*
3402 			 * Return address to caller.
3403 			 * Caller handles truncation if length
3404 			 * exceeds msg_namelen.
3405 			 * NOTE: AF_UNIX NUL termination is ensured by
3406 			 * the sender's copyin_name().
3407 			 */
3408 			abuf = kmem_alloc(addrlen, KM_SLEEP);
3409 
3410 			bcopy(addr, abuf, addrlen);
3411 			msg->msg_name = abuf;
3412 			msg->msg_namelen = addrlen;
3413 		}
3414 
3415 		if (controllen != 0) {
3416 			/*
3417 			 * Return control msg to caller.
3418 			 * Caller handles truncation if length
3419 			 * exceeds msg_controllen.
3420 			 */
3421 			control = kmem_zalloc(controllen, KM_SLEEP);
3422 
3423 			error = so_opt2cmsg(mp, opt, optlen,
3424 			    !(flags & MSG_XPG4_2),
3425 			    control, controllen);
3426 			if (error) {
3427 				freemsg(mp);
3428 				if (msg->msg_namelen != 0)
3429 					kmem_free(msg->msg_name,
3430 					    msg->msg_namelen);
3431 				kmem_free(control, controllen);
3432 				eprintsoline(so, error);
3433 				goto out;
3434 			}
3435 			msg->msg_control = control;
3436 			msg->msg_controllen = controllen;
3437 		}
3438 
3439 		freemsg(mp);
3440 		goto out;
3441 	}
3442 	case T_OPTDATA_IND: {
3443 		struct T_optdata_req *tdr;
3444 		void *opt;
3445 		t_uscalar_t optlen;
3446 
3447 		if ((so->so_state &
3448 		    (SS_OOBPEND|SS_HAVEOOBDATA|SS_RCVATMARK)) &&
3449 		    (uiop->uio_resid != saved_resid) &&
3450 		    !(flags & MSG_PEEK)) {
3451 			sorecv_update_oobstate(so);
3452 		}
3453 
3454 		tdr = (struct T_optdata_req *)mp->b_rptr;
3455 		optlen = tdr->OPT_length;
3456 		if (optlen != 0) {
3457 			t_uscalar_t ncontrollen;
3458 			/*
3459 			 * Determine how large cmsg buffer is needed.
3460 			 */
3461 			opt = sogetoff(mp,
3462 			    tpr->optdata_ind.OPT_offset,
3463 			    optlen, __TPI_ALIGN_SIZE);
3464 
3465 			if (opt == NULL) {
3466 				freemsg(mp);
3467 				error = EPROTO;
3468 				eprintsoline(so, error);
3469 				goto out;
3470 			}
3471 
3472 			ncontrollen = so_cmsglen(mp, opt, optlen,
3473 			    !(flags & MSG_XPG4_2));
3474 			if (controllen != 0)
3475 				controllen = ncontrollen;
3476 			else if (ncontrollen != 0)
3477 				msg->msg_flags |= MSG_CTRUNC;
3478 		} else {
3479 			controllen = 0;
3480 		}
3481 
3482 		if (controllen != 0) {
3483 			/*
3484 			 * Return control msg to caller.
3485 			 * Caller handles truncation if length
3486 			 * exceeds msg_controllen.
3487 			 */
3488 			control = kmem_zalloc(controllen, KM_SLEEP);
3489 
3490 			error = so_opt2cmsg(mp, opt, optlen,
3491 			    !(flags & MSG_XPG4_2),
3492 			    control, controllen);
3493 			if (error) {
3494 				freemsg(mp);
3495 				kmem_free(control, controllen);
3496 				eprintsoline(so, error);
3497 				goto out;
3498 			}
3499 			msg->msg_control = control;
3500 			msg->msg_controllen = controllen;
3501 		}
3502 
3503 		/*
3504 		 * Set msg_flags to MSG_EOR based on
3505 		 * DATA_flag and MOREDATA.
3506 		 */
3507 		mutex_enter(&so->so_lock);
3508 		so->so_state &= ~SS_SAVEDEOR;
3509 		if (!(tpr->data_ind.MORE_flag & 1)) {
3510 			if (!(rval.r_val1 & MOREDATA))
3511 				msg->msg_flags |= MSG_EOR;
3512 			else
3513 				so->so_state |= SS_SAVEDEOR;
3514 		}
3515 		freemsg(mp);
3516 		/*
3517 		 * If some data was received (i.e. not EOF) and the
3518 		 * read/recv* has not been satisfied wait for some more.
3519 		 * Not possible to wait if control info was received.
3520 		 */
3521 		if ((flags & MSG_WAITALL) && !(msg->msg_flags & MSG_EOR) &&
3522 		    controllen == 0 &&
3523 		    uiop->uio_resid != saved_resid && uiop->uio_resid > 0) {
3524 			mutex_exit(&so->so_lock);
3525 			pflag = opflag | MSG_NOMARK;
3526 			goto retry;
3527 		}
3528 		goto out_locked;
3529 	}
3530 	case T_EXDATA_IND: {
3531 		dprintso(so, 1,
3532 		    ("sotpi_recvmsg: EXDATA_IND counts %d/%d consumed %ld "
3533 		    "state %s\n",
3534 		    sti->sti_oobsigcnt, sti->sti_oobcnt,
3535 		    saved_resid - uiop->uio_resid,
3536 		    pr_state(so->so_state, so->so_mode)));
3537 		/*
3538 		 * kstrgetmsg handles MSGMARK so there is nothing to
3539 		 * inspect in the T_EXDATA_IND.
3540 		 * strsock_proto makes the stream head queue the T_EXDATA_IND
3541 		 * as a separate message with no M_DATA component. Furthermore,
3542 		 * the stream head does not consolidate M_DATA messages onto
3543 		 * an MSGMARK'ed message ensuring that the T_EXDATA_IND
3544 		 * remains a message by itself. This is needed since MSGMARK
3545 		 * marks both the whole message as well as the last byte
3546 		 * of the message.
3547 		 */
3548 		freemsg(mp);
3549 		ASSERT(uiop->uio_resid == saved_resid);	/* No data */
3550 		if (flags & MSG_PEEK) {
3551 			/*
3552 			 * Even though we are peeking we consume the
3553 			 * T_EXDATA_IND thereby moving the mark information
3554 			 * to SS_RCVATMARK. Then the oob code below will
3555 			 * retry the peeking kstrgetmsg.
3556 			 * Note that the stream head read queue is
3557 			 * never flushed without holding SOREADLOCKED
3558 			 * thus the T_EXDATA_IND can not disappear
3559 			 * underneath us.
3560 			 */
3561 			dprintso(so, 1,
3562 			    ("sotpi_recvmsg: consume EXDATA_IND "
3563 			    "counts %d/%d state %s\n",
3564 			    sti->sti_oobsigcnt,
3565 			    sti->sti_oobcnt,
3566 			    pr_state(so->so_state, so->so_mode)));
3567 
3568 			pflag = MSG_ANY | MSG_DELAYERROR;
3569 			if (so->so_mode & SM_ATOMIC)
3570 				pflag |= MSG_DISCARDTAIL;
3571 
3572 			pri = 0;
3573 			mp = NULL;
3574 
3575 			error = kstrgetmsg(SOTOV(so), &mp, uiop,
3576 			    &pri, &pflag, (clock_t)-1, &rval);
3577 			ASSERT(uiop->uio_resid == saved_resid);
3578 
3579 			if (error) {
3580 #ifdef SOCK_DEBUG
3581 				if (error != EWOULDBLOCK && error != EINTR) {
3582 					eprintsoline(so, error);
3583 				}
3584 #endif /* SOCK_DEBUG */
3585 				goto out;
3586 			}
3587 			ASSERT(mp);
3588 			tpr = (union T_primitives *)mp->b_rptr;
3589 			ASSERT(tpr->type == T_EXDATA_IND);
3590 			freemsg(mp);
3591 		} /* end "if (flags & MSG_PEEK)" */
3592 
3593 		/*
3594 		 * Decrement the number of queued and pending oob.
3595 		 *
3596 		 * SS_RCVATMARK is cleared when we read past a mark.
3597 		 * SS_HAVEOOBDATA is cleared when we've read past the
3598 		 * last mark.
3599 		 * SS_OOBPEND is cleared if we've read past the last
3600 		 * mark and no (new) SIGURG has been posted.
3601 		 */
3602 		mutex_enter(&so->so_lock);
3603 		ASSERT(so_verify_oobstate(so));
3604 		ASSERT(sti->sti_oobsigcnt >= sti->sti_oobcnt);
3605 		ASSERT(sti->sti_oobsigcnt > 0);
3606 		sti->sti_oobsigcnt--;
3607 		ASSERT(sti->sti_oobcnt > 0);
3608 		sti->sti_oobcnt--;
3609 		/*
3610 		 * Since the T_EXDATA_IND has been removed from the stream
3611 		 * head, but we have not read data past the mark,
3612 		 * sockfs needs to track that the socket is still at the mark.
3613 		 *
3614 		 * Since no data was received call kstrgetmsg again to wait
3615 		 * for data.
3616 		 */
3617 		so->so_state |= SS_RCVATMARK;
3618 		mutex_exit(&so->so_lock);
3619 		dprintso(so, 1,
3620 		    ("sotpi_recvmsg: retry EXDATA_IND counts %d/%d state %s\n",
3621 		    sti->sti_oobsigcnt, sti->sti_oobcnt,
3622 		    pr_state(so->so_state, so->so_mode)));
3623 		pflag = opflag;
3624 		goto retry;
3625 	}
3626 	default:
3627 		cmn_err(CE_CONT, "sotpi_recvmsg: so %p prim %d mp %p\n",
3628 		    (void *)so, tpr->type, (void *)mp);
3629 		ASSERT(0);
3630 		freemsg(mp);
3631 		error = EPROTO;
3632 		eprintsoline(so, error);
3633 		goto out;
3634 	}
3635 	/* NOTREACHED */
3636 out:
3637 	mutex_enter(&so->so_lock);
3638 out_locked:
3639 	so_unlock_read(so);	/* Clear SOREADLOCKED */
3640 	mutex_exit(&so->so_lock);
3641 	return (error);
3642 }
3643 
3644 /*
3645  * Sending data with options on a datagram socket.
3646  * Assumes caller has verified that SS_ISBOUND etc. are set.
3647  *
3648  * For AF_UNIX the destination address may be already in
3649  * internal form, as indicated by sti->sti_faddr_noxlate
3650  * or the MSG_SENDTO_NOXLATE flag.  Otherwise we need to
3651  * translate the destination address to internal form.
3652  *
3653  * The source address is passed as an option.  If passing
3654  * file descriptors, those are passed as file pointers in
3655  * another option.
3656  */
3657 static int
3658 sosend_dgramcmsg(struct sonode *so, struct sockaddr *name, socklen_t namelen,
3659     struct uio *uiop, void *control, t_uscalar_t controllen, int flags)
3660 {
3661 	struct T_unitdata_req	tudr;
3662 	mblk_t			*mp;
3663 	int			error;
3664 	void			*addr;
3665 	socklen_t		addrlen;
3666 	void			*src;
3667 	socklen_t		srclen;
3668 	ssize_t			len;
3669 	int			size;
3670 	struct T_opthdr		toh;
3671 	struct fdbuf		*fdbuf;
3672 	t_uscalar_t		optlen;
3673 	void			*fds;
3674 	int			fdlen;
3675 	sotpi_info_t		*sti = SOTOTPI(so);
3676 
3677 	ASSERT(name && namelen);
3678 	ASSERT(control && controllen);
3679 
3680 	len = uiop->uio_resid;
3681 	if (len > (ssize_t)sti->sti_tidu_size) {
3682 		return (EMSGSIZE);
3683 	}
3684 
3685 	if (sti->sti_faddr_noxlate == 0 &&
3686 	    (flags & MSG_SENDTO_NOXLATE) == 0) {
3687 		/*
3688 		 * Length and family checks.
3689 		 * Don't verify internal form.
3690 		 */
3691 		error = so_addr_verify(so, name, namelen);
3692 		if (error) {
3693 			eprintsoline(so, error);
3694 			return (error);
3695 		}
3696 	}
3697 
3698 	if (so->so_family == AF_UNIX) {
3699 		if (sti->sti_faddr_noxlate) {
3700 			/*
3701 			 * Already have a transport internal address. Do not
3702 			 * pass any (transport internal) source address.
3703 			 */
3704 			addr = name;
3705 			addrlen = namelen;
3706 			src = NULL;
3707 			srclen = 0;
3708 		} else if (flags & MSG_SENDTO_NOXLATE) {
3709 			/*
3710 			 * Have an internal form dest. address.
3711 			 * Pass the source address as usual.
3712 			 */
3713 			addr = name;
3714 			addrlen = namelen;
3715 			src = sti->sti_laddr_sa;
3716 			srclen = (socklen_t)sti->sti_laddr_len;
3717 		} else {
3718 			/*
3719 			 * Pass the sockaddr_un source address as an option
3720 			 * and translate the remote address.
3721 			 *
3722 			 * Note that this code does not prevent sti_laddr_sa
3723 			 * from changing while it is being used. Thus
3724 			 * if an unbind+bind occurs concurrently with this
3725 			 * send the peer might see a partially new and a
3726 			 * partially old "from" address.
3727 			 */
3728 			src = sti->sti_laddr_sa;
3729 			srclen = (socklen_t)sti->sti_laddr_len;
3730 			dprintso(so, 1,
3731 			    ("sosend_dgramcmsg UNIX: srclen %d, src %p\n",
3732 			    srclen, src));
3733 			/*
3734 			 * The sendmsg caller specified a destination
3735 			 * address, which we must translate into our
3736 			 * internal form.  addr = &sti->sti_ux_taddr
3737 			 */
3738 			error = so_ux_addr_xlate(so, name, namelen,
3739 			    (flags & MSG_XPG4_2),
3740 			    &addr, &addrlen);
3741 			if (error) {
3742 				eprintsoline(so, error);
3743 				return (error);
3744 			}
3745 		}
3746 	} else {
3747 		addr = name;
3748 		addrlen = namelen;
3749 		src = NULL;
3750 		srclen = 0;
3751 	}
3752 	optlen = so_optlen(control, controllen,
3753 	    !(flags & MSG_XPG4_2));
3754 	tudr.PRIM_type = T_UNITDATA_REQ;
3755 	tudr.DEST_length = addrlen;
3756 	tudr.DEST_offset = (t_scalar_t)sizeof (tudr);
3757 	if (srclen != 0)
3758 		tudr.OPT_length = (t_scalar_t)(optlen + sizeof (toh) +
3759 		    _TPI_ALIGN_TOPT(srclen));
3760 	else
3761 		tudr.OPT_length = optlen;
3762 	tudr.OPT_offset = (t_scalar_t)(sizeof (tudr) +
3763 	    _TPI_ALIGN_TOPT(addrlen));
3764 
3765 	size = tudr.OPT_offset + tudr.OPT_length;
3766 
3767 	/*
3768 	 * File descriptors only when SM_FDPASSING set.
3769 	 */
3770 	error = so_getfdopt(control, controllen,
3771 	    !(flags & MSG_XPG4_2), &fds, &fdlen);
3772 	if (error)
3773 		return (error);
3774 	if (fdlen != -1) {
3775 		if (!(so->so_mode & SM_FDPASSING))
3776 			return (EOPNOTSUPP);
3777 
3778 		error = fdbuf_create(fds, fdlen, &fdbuf);
3779 		if (error)
3780 			return (error);
3781 
3782 		/*
3783 		 * Pre-allocate enough additional space for lower level modules
3784 		 * to append an option (e.g. see tl_unitdata). The following
3785 		 * is enough extra space for the largest option we might append.
3786 		 */
3787 		size += sizeof (struct T_opthdr) + ucredsize;
3788 		mp = fdbuf_allocmsg(size, fdbuf);
3789 	} else {
3790 		mp = soallocproto(size, _ALLOC_INTR, CRED());
3791 		if (mp == NULL) {
3792 			/*
3793 			 * Caught a signal waiting for memory.
3794 			 * Let send* return EINTR.
3795 			 */
3796 			return (EINTR);
3797 		}
3798 	}
3799 	soappendmsg(mp, &tudr, sizeof (tudr));
3800 	soappendmsg(mp, addr, addrlen);
3801 	mp->b_wptr += _TPI_ALIGN_TOPT(addrlen) - addrlen;
3802 
3803 	if (fdlen != -1) {
3804 		ASSERT(fdbuf != NULL);
3805 		toh.level = SOL_SOCKET;
3806 		toh.name = SO_FILEP;
3807 		toh.len = fdbuf->fd_size +
3808 		    (t_uscalar_t)sizeof (struct T_opthdr);
3809 		toh.status = 0;
3810 		soappendmsg(mp, &toh, sizeof (toh));
3811 		soappendmsg(mp, fdbuf, fdbuf->fd_size);
3812 		ASSERT(__TPI_TOPT_ISALIGNED(mp->b_wptr));
3813 	}
3814 	if (srclen != 0) {
3815 		/*
3816 		 * There is a AF_UNIX sockaddr_un to include as a source
3817 		 * address option.
3818 		 */
3819 		toh.level = SOL_SOCKET;
3820 		toh.name = SO_SRCADDR;
3821 		toh.len = (t_uscalar_t)(srclen + sizeof (struct T_opthdr));
3822 		toh.status = 0;
3823 		soappendmsg(mp, &toh, sizeof (toh));
3824 		soappendmsg(mp, src, srclen);
3825 		mp->b_wptr += _TPI_ALIGN_TOPT(srclen) - srclen;
3826 		ASSERT(__TPI_TOPT_ISALIGNED(mp->b_wptr));
3827 	}
3828 	ASSERT(mp->b_wptr <= mp->b_datap->db_lim);
3829 	so_cmsg2opt(control, controllen, !(flags & MSG_XPG4_2), mp);
3830 	/*
3831 	 * Normally at most 3 bytes left in the message, but we might have
3832 	 * allowed for extra space if we're passing fd's through.
3833 	 */
3834 	ASSERT(MBLKL(mp) <= (ssize_t)size);
3835 
3836 	ASSERT(mp->b_wptr <= mp->b_datap->db_lim);
3837 	if (AU_AUDITING())
3838 		audit_sock(T_UNITDATA_REQ, strvp2wq(SOTOV(so)), mp, 0);
3839 
3840 	error = kstrputmsg(SOTOV(so), mp, uiop, len, 0, MSG_BAND, 0);
3841 #ifdef SOCK_DEBUG
3842 	if (error) {
3843 		eprintsoline(so, error);
3844 	}
3845 #endif /* SOCK_DEBUG */
3846 	return (error);
3847 }
3848 
3849 /*
3850  * Sending data with options on a connected stream socket.
3851  * Assumes caller has verified that SS_ISCONNECTED is set.
3852  */
3853 static int
3854 sosend_svccmsg(struct sonode *so, struct uio *uiop, int more, void *control,
3855     t_uscalar_t controllen, int flags)
3856 {
3857 	struct T_optdata_req	tdr;
3858 	mblk_t			*mp;
3859 	int			error;
3860 	ssize_t			iosize;
3861 	int			size;
3862 	struct fdbuf		*fdbuf;
3863 	t_uscalar_t		optlen;
3864 	void			*fds;
3865 	int			fdlen;
3866 	struct T_opthdr		toh;
3867 	sotpi_info_t		*sti = SOTOTPI(so);
3868 
3869 	dprintso(so, 1,
3870 	    ("sosend_svccmsg: resid %ld bytes\n", uiop->uio_resid));
3871 
3872 	/*
3873 	 * Has to be bound and connected. However, since no locks are
3874 	 * held the state could have changed after sotpi_sendmsg checked it
3875 	 * thus it is not possible to ASSERT on the state.
3876 	 */
3877 
3878 	/* Options on connection-oriented only when SM_OPTDATA set. */
3879 	if (!(so->so_mode & SM_OPTDATA))
3880 		return (EOPNOTSUPP);
3881 
3882 	do {
3883 		/*
3884 		 * Set the MORE flag if uio_resid does not fit in this
3885 		 * message or if the caller passed in "more".
3886 		 * Error for transports with zero tidu_size.
3887 		 */
3888 		tdr.PRIM_type = T_OPTDATA_REQ;
3889 		iosize = sti->sti_tidu_size;
3890 		if (iosize <= 0)
3891 			return (EMSGSIZE);
3892 		if (uiop->uio_resid > iosize) {
3893 			tdr.DATA_flag = 1;
3894 		} else {
3895 			if (more)
3896 				tdr.DATA_flag = 1;
3897 			else
3898 				tdr.DATA_flag = 0;
3899 			iosize = uiop->uio_resid;
3900 		}
3901 		dprintso(so, 1, ("sosend_svccmsg: sending %d, %ld bytes\n",
3902 		    tdr.DATA_flag, iosize));
3903 
3904 		optlen = so_optlen(control, controllen, !(flags & MSG_XPG4_2));
3905 		tdr.OPT_length = optlen;
3906 		tdr.OPT_offset = (t_scalar_t)sizeof (tdr);
3907 
3908 		size = (int)sizeof (tdr) + optlen;
3909 		/*
3910 		 * File descriptors only when SM_FDPASSING set.
3911 		 */
3912 		error = so_getfdopt(control, controllen,
3913 		    !(flags & MSG_XPG4_2), &fds, &fdlen);
3914 		if (error)
3915 			return (error);
3916 		if (fdlen != -1) {
3917 			if (!(so->so_mode & SM_FDPASSING))
3918 				return (EOPNOTSUPP);
3919 
3920 			error = fdbuf_create(fds, fdlen, &fdbuf);
3921 			if (error)
3922 				return (error);
3923 
3924 			/*
3925 			 * Pre-allocate enough additional space for lower level
3926 			 * modules to append an option (e.g. see tl_unitdata).
3927 			 * The following is enough extra space for the largest
3928 			 * option we might append.
3929 			 */
3930 			size += sizeof (struct T_opthdr) + ucredsize;
3931 			mp = fdbuf_allocmsg(size, fdbuf);
3932 		} else {
3933 			mp = soallocproto(size, _ALLOC_INTR, CRED());
3934 			if (mp == NULL) {
3935 				/*
3936 				 * Caught a signal waiting for memory.
3937 				 * Let send* return EINTR.
3938 				 */
3939 				return (EINTR);
3940 			}
3941 		}
3942 		soappendmsg(mp, &tdr, sizeof (tdr));
3943 
3944 		if (fdlen != -1) {
3945 			ASSERT(fdbuf != NULL);
3946 			toh.level = SOL_SOCKET;
3947 			toh.name = SO_FILEP;
3948 			toh.len = fdbuf->fd_size +
3949 			    (t_uscalar_t)sizeof (struct T_opthdr);
3950 			toh.status = 0;
3951 			soappendmsg(mp, &toh, sizeof (toh));
3952 			soappendmsg(mp, fdbuf, fdbuf->fd_size);
3953 			ASSERT(__TPI_TOPT_ISALIGNED(mp->b_wptr));
3954 		}
3955 		so_cmsg2opt(control, controllen, !(flags & MSG_XPG4_2), mp);
3956 		/*
3957 		 * Normally at most 3 bytes left in the message, but we might
3958 		 * have allowed for extra space if we're passing fd's through.
3959 		 */
3960 		ASSERT(MBLKL(mp) <= (ssize_t)size);
3961 
3962 		ASSERT(mp->b_wptr <= mp->b_datap->db_lim);
3963 
3964 		error = kstrputmsg(SOTOV(so), mp, uiop, iosize,
3965 		    0, MSG_BAND, 0);
3966 		if (error) {
3967 			eprintsoline(so, error);
3968 			return (error);
3969 		}
3970 		control = NULL;
3971 		if (uiop->uio_resid > 0) {
3972 			/*
3973 			 * Recheck for fatal errors. Fail write even though
3974 			 * some data have been written. This is consistent
3975 			 * with strwrite semantics and BSD sockets semantics.
3976 			 */
3977 			if (so->so_state & SS_CANTSENDMORE) {
3978 				eprintsoline(so, error);
3979 				return (EPIPE);
3980 			}
3981 			if (so->so_error != 0) {
3982 				mutex_enter(&so->so_lock);
3983 				error = sogeterr(so, B_TRUE);
3984 				mutex_exit(&so->so_lock);
3985 				if (error != 0) {
3986 					eprintsoline(so, error);
3987 					return (error);
3988 				}
3989 			}
3990 		}
3991 	} while (uiop->uio_resid > 0);
3992 	return (0);
3993 }
3994 
3995 /*
3996  * Sending data on a datagram socket.
3997  * Assumes caller has verified that SS_ISBOUND etc. are set.
3998  *
3999  * For AF_UNIX the destination address may be already in
4000  * internal form, as indicated by sti->sti_faddr_noxlate
4001  * or the MSG_SENDTO_NOXLATE flag.  Otherwise we need to
4002  * translate the destination address to internal form.
4003  *
4004  * The source address is passed as an option.
4005  */
4006 int
4007 sosend_dgram(struct sonode *so, struct sockaddr	*name, socklen_t namelen,
4008     struct uio *uiop, int flags)
4009 {
4010 	struct T_unitdata_req	tudr;
4011 	mblk_t			*mp;
4012 	int			error;
4013 	void			*addr;
4014 	socklen_t		addrlen;
4015 	void			*src;
4016 	socklen_t		srclen;
4017 	ssize_t			len;
4018 	sotpi_info_t		*sti = SOTOTPI(so);
4019 
4020 	ASSERT(name != NULL && namelen != 0);
4021 
4022 	len = uiop->uio_resid;
4023 	if (len > sti->sti_tidu_size) {
4024 		error = EMSGSIZE;
4025 		goto done;
4026 	}
4027 
4028 	if (sti->sti_faddr_noxlate == 0 &&
4029 	    (flags & MSG_SENDTO_NOXLATE) == 0) {
4030 		/*
4031 		 * Length and family checks.
4032 		 * Don't verify internal form.
4033 		 */
4034 		error = so_addr_verify(so, name, namelen);
4035 		if (error != 0)
4036 			goto done;
4037 	}
4038 
4039 	if (sti->sti_direct)	/* Never on AF_UNIX */
4040 		return (sodgram_direct(so, name, namelen, uiop, flags));
4041 
4042 	if (so->so_family == AF_UNIX) {
4043 		if (sti->sti_faddr_noxlate) {
4044 			/*
4045 			 * Already have a transport internal address. Do not
4046 			 * pass any (transport internal) source address.
4047 			 */
4048 			addr = name;
4049 			addrlen = namelen;
4050 			src = NULL;
4051 			srclen = 0;
4052 		} else if (flags & MSG_SENDTO_NOXLATE) {
4053 			/*
4054 			 * Have an internal form dest. address.
4055 			 * Pass the source address as usual.
4056 			 */
4057 			addr = name;
4058 			addrlen = namelen;
4059 			src = sti->sti_laddr_sa;
4060 			srclen = (socklen_t)sti->sti_laddr_len;
4061 		} else {
4062 			/*
4063 			 * Pass the sockaddr_un source address as an option
4064 			 * and translate the remote address.
4065 			 *
4066 			 * Note that this code does not prevent sti_laddr_sa
4067 			 * from changing while it is being used. Thus
4068 			 * if an unbind+bind occurs concurrently with this
4069 			 * send the peer might see a partially new and a
4070 			 * partially old "from" address.
4071 			 */
4072 			src = sti->sti_laddr_sa;
4073 			srclen = (socklen_t)sti->sti_laddr_len;
4074 			dprintso(so, 1,
4075 			    ("sosend_dgram UNIX: srclen %d, src %p\n",
4076 			    srclen, src));
4077 			/*
4078 			 * The sendmsg caller specified a destination
4079 			 * address, which we must translate into our
4080 			 * internal form.  addr = &sti->sti_ux_taddr
4081 			 */
4082 			error = so_ux_addr_xlate(so, name, namelen,
4083 			    (flags & MSG_XPG4_2),
4084 			    &addr, &addrlen);
4085 			if (error) {
4086 				eprintsoline(so, error);
4087 				goto done;
4088 			}
4089 		}
4090 	} else {
4091 		addr = name;
4092 		addrlen = namelen;
4093 		src = NULL;
4094 		srclen = 0;
4095 	}
4096 	tudr.PRIM_type = T_UNITDATA_REQ;
4097 	tudr.DEST_length = addrlen;
4098 	tudr.DEST_offset = (t_scalar_t)sizeof (tudr);
4099 	if (srclen == 0) {
4100 		tudr.OPT_length = 0;
4101 		tudr.OPT_offset = 0;
4102 
4103 		mp = soallocproto2(&tudr, sizeof (tudr),
4104 		    addr, addrlen, 0, _ALLOC_INTR, CRED());
4105 		if (mp == NULL) {
4106 			/*
4107 			 * Caught a signal waiting for memory.
4108 			 * Let send* return EINTR.
4109 			 */
4110 			error = EINTR;
4111 			goto done;
4112 		}
4113 	} else {
4114 		/*
4115 		 * There is a AF_UNIX sockaddr_un to include as a source
4116 		 * address option.
4117 		 */
4118 		struct T_opthdr toh;
4119 		ssize_t size;
4120 
4121 		tudr.OPT_length = (t_scalar_t)(sizeof (toh) +
4122 		    _TPI_ALIGN_TOPT(srclen));
4123 		tudr.OPT_offset = (t_scalar_t)(sizeof (tudr) +
4124 		    _TPI_ALIGN_TOPT(addrlen));
4125 
4126 		toh.level = SOL_SOCKET;
4127 		toh.name = SO_SRCADDR;
4128 		toh.len = (t_uscalar_t)(srclen + sizeof (struct T_opthdr));
4129 		toh.status = 0;
4130 
4131 		size = tudr.OPT_offset + tudr.OPT_length;
4132 		mp = soallocproto2(&tudr, sizeof (tudr),
4133 		    addr, addrlen, size, _ALLOC_INTR, CRED());
4134 		if (mp == NULL) {
4135 			/*
4136 			 * Caught a signal waiting for memory.
4137 			 * Let send* return EINTR.
4138 			 */
4139 			error = EINTR;
4140 			goto done;
4141 		}
4142 		mp->b_wptr += _TPI_ALIGN_TOPT(addrlen) - addrlen;
4143 		soappendmsg(mp, &toh, sizeof (toh));
4144 		soappendmsg(mp, src, srclen);
4145 		mp->b_wptr += _TPI_ALIGN_TOPT(srclen) - srclen;
4146 		ASSERT(mp->b_wptr <= mp->b_datap->db_lim);
4147 	}
4148 
4149 	if (AU_AUDITING())
4150 		audit_sock(T_UNITDATA_REQ, strvp2wq(SOTOV(so)), mp, 0);
4151 
4152 	error = kstrputmsg(SOTOV(so), mp, uiop, len, 0, MSG_BAND, 0);
4153 done:
4154 #ifdef SOCK_DEBUG
4155 	if (error) {
4156 		eprintsoline(so, error);
4157 	}
4158 #endif /* SOCK_DEBUG */
4159 	return (error);
4160 }
4161 
4162 /*
4163  * Sending data on a connected stream socket.
4164  * Assumes caller has verified that SS_ISCONNECTED is set.
4165  */
4166 int
4167 sosend_svc(struct sonode *so, struct uio *uiop, t_scalar_t prim, int more,
4168     int sflag)
4169 {
4170 	struct T_data_req	tdr;
4171 	mblk_t			*mp;
4172 	int			error;
4173 	ssize_t			iosize;
4174 	sotpi_info_t		*sti = SOTOTPI(so);
4175 
4176 	dprintso(so, 1,
4177 	    ("sosend_svc: %p, resid %ld bytes, prim %d, sflag 0x%x\n",
4178 	    (void *)so, uiop->uio_resid, prim, sflag));
4179 
4180 	/*
4181 	 * Has to be bound and connected. However, since no locks are
4182 	 * held the state could have changed after sotpi_sendmsg checked it
4183 	 * thus it is not possible to ASSERT on the state.
4184 	 */
4185 
4186 	do {
4187 		/*
4188 		 * Set the MORE flag if uio_resid does not fit in this
4189 		 * message or if the caller passed in "more".
4190 		 * Error for transports with zero tidu_size.
4191 		 */
4192 		tdr.PRIM_type = prim;
4193 		iosize = sti->sti_tidu_size;
4194 		if (iosize <= 0)
4195 			return (EMSGSIZE);
4196 		if (uiop->uio_resid > iosize) {
4197 			tdr.MORE_flag = 1;
4198 		} else {
4199 			if (more)
4200 				tdr.MORE_flag = 1;
4201 			else
4202 				tdr.MORE_flag = 0;
4203 			iosize = uiop->uio_resid;
4204 		}
4205 		dprintso(so, 1, ("sosend_svc: sending 0x%x %d, %ld bytes\n",
4206 		    prim, tdr.MORE_flag, iosize));
4207 		mp = soallocproto1(&tdr, sizeof (tdr), 0, _ALLOC_INTR, CRED());
4208 		if (mp == NULL) {
4209 			/*
4210 			 * Caught a signal waiting for memory.
4211 			 * Let send* return EINTR.
4212 			 */
4213 			return (EINTR);
4214 		}
4215 
4216 		error = kstrputmsg(SOTOV(so), mp, uiop, iosize,
4217 		    0, sflag | MSG_BAND, 0);
4218 		if (error) {
4219 			eprintsoline(so, error);
4220 			return (error);
4221 		}
4222 		if (uiop->uio_resid > 0) {
4223 			/*
4224 			 * Recheck for fatal errors. Fail write even though
4225 			 * some data have been written. This is consistent
4226 			 * with strwrite semantics and BSD sockets semantics.
4227 			 */
4228 			if (so->so_state & SS_CANTSENDMORE) {
4229 				eprintsoline(so, error);
4230 				return (EPIPE);
4231 			}
4232 			if (so->so_error != 0) {
4233 				mutex_enter(&so->so_lock);
4234 				error = sogeterr(so, B_TRUE);
4235 				mutex_exit(&so->so_lock);
4236 				if (error != 0) {
4237 					eprintsoline(so, error);
4238 					return (error);
4239 				}
4240 			}
4241 		}
4242 	} while (uiop->uio_resid > 0);
4243 	return (0);
4244 }
4245 
4246 /*
4247  * Check the state for errors and call the appropriate send function.
4248  *
4249  * If MSG_DONTROUTE is set (and SO_DONTROUTE isn't already set)
4250  * this function issues a setsockopt to toggle SO_DONTROUTE before and
4251  * after sending the message.
4252  *
4253  * The caller may optionally specify a destination address, for either
4254  * stream or datagram sockets.  This table summarizes the cases:
4255  *
4256  *    Socket type    Dest. given    Connected    Result
4257  *    -----------    -----------    ---------    --------------
4258  *    Stream         *              Yes	         send to conn. addr.
4259  *    Stream         *              No           error ENOTCONN
4260  *    Dgram          yes            *            send to given addr.
4261  *    Dgram          no             yes          send to conn. addr.
4262  *    Dgram          no             no	         error EDESTADDRREQ
4263  *
4264  * There are subtleties around the destination address when using
4265  * AF_UNIX datagram sockets.  When the sendmsg call specifies the
4266  * destination address, it's in (struct sockaddr_un) form and we
4267  * need to translate it to our internal form (struct so_ux_addr).
4268  *
4269  * When the sendmsg call does not specify a destination address
4270  * we're using the peer address saved during sotpi_connect, and
4271  * that address is already in internal form.  In this case, the
4272  * (internal only) flag MSG_SENDTO_NOXLATE is set in the flags
4273  * passed to sosend_dgram or sosend_dgramcmsg to indicate that
4274  * those functions should skip translation to internal form.
4275  * Avoiding that translation is not only more efficient, but it's
4276  * also necessary when a process does a connect on an AF_UNIX
4277  * datagram socket and then drops privileges.  After the process
4278  * has dropped privileges, it may no longer be able to lookup the
4279  * the external name in the filesystem, but it should still be
4280  * able to send messages on the connected socket by leaving the
4281  * destination name unspecified.
4282  *
4283  * Yet more subtleties arise with sockets connected by socketpair(),
4284  * which puts internal form addresses in the fields where normally
4285  * the external form is found, and sets sti_faddr_noxlate=1, which
4286  * (like flag MSG_SENDTO_NOXLATE) causes the sosend_dgram functions
4287  * to skip translation of destination addresses to internal form.
4288  * However, beware that the flag sti_faddr_noxlate=1 also triggers
4289  * different behaviour almost everywhere AF_UNIX addresses appear.
4290  */
4291 static int
4292 sotpi_sendmsg(struct sonode *so, struct nmsghdr *msg, struct uio *uiop,
4293     struct cred *cr)
4294 {
4295 	int		so_state;
4296 	int		so_mode;
4297 	int		error;
4298 	struct sockaddr *name;
4299 	t_uscalar_t	namelen;
4300 	int		dontroute;
4301 	int		flags;
4302 	sotpi_info_t	*sti = SOTOTPI(so);
4303 
4304 	dprintso(so, 1, ("sotpi_sendmsg(%p, %p, 0x%x) state %s, error %d\n",
4305 	    (void *)so, (void *)msg, msg->msg_flags,
4306 	    pr_state(so->so_state, so->so_mode), so->so_error));
4307 
4308 	if (so->so_version == SOV_STREAM) {
4309 		/* The imaginary "sockmod" has been popped - act as a stream */
4310 		so_update_attrs(so, SOMOD);
4311 		return (strwrite(SOTOV(so), uiop, cr));
4312 	}
4313 
4314 	mutex_enter(&so->so_lock);
4315 	so_state = so->so_state;
4316 
4317 	if (so_state & SS_CANTSENDMORE) {
4318 		mutex_exit(&so->so_lock);
4319 		return (EPIPE);
4320 	}
4321 
4322 	if (so->so_error != 0) {
4323 		error = sogeterr(so, B_TRUE);
4324 		if (error != 0) {
4325 			mutex_exit(&so->so_lock);
4326 			return (error);
4327 		}
4328 	}
4329 
4330 	name = (struct sockaddr *)msg->msg_name;
4331 	namelen = msg->msg_namelen;
4332 	flags = msg->msg_flags;
4333 
4334 	/*
4335 	 * Historically, this function does not validate the flags
4336 	 * passed in, and any errant bits are ignored.  However,
4337 	 * we would not want any such errant flag bits accidently
4338 	 * being treated as one of the internal-only flags, so
4339 	 * clear the internal-only flag bits.
4340 	 */
4341 	flags &= ~MSG_SENDTO_NOXLATE;
4342 
4343 	so_mode = so->so_mode;
4344 
4345 	if (name == NULL) {
4346 		if (!(so_state & SS_ISCONNECTED)) {
4347 			mutex_exit(&so->so_lock);
4348 			if (so_mode & SM_CONNREQUIRED)
4349 				return (ENOTCONN);
4350 			else
4351 				return (EDESTADDRREQ);
4352 		}
4353 		/*
4354 		 * This is a connected socket.
4355 		 */
4356 		if (so_mode & SM_CONNREQUIRED) {
4357 			/*
4358 			 * This is a connected STREAM socket,
4359 			 * destination not specified.
4360 			 */
4361 			name = NULL;
4362 			namelen = 0;
4363 		} else {
4364 			/*
4365 			 * Datagram send on connected socket with
4366 			 * the destination name not specified.
4367 			 * Use the peer address from connect.
4368 			 */
4369 			if (so->so_family == AF_UNIX) {
4370 				/*
4371 				 * Use the (internal form) address saved
4372 				 * in sotpi_connect.  See above.
4373 				 */
4374 				name = (void *)&sti->sti_ux_faddr;
4375 				namelen = sizeof (sti->sti_ux_faddr);
4376 				flags |= MSG_SENDTO_NOXLATE;
4377 			} else {
4378 				ASSERT(sti->sti_faddr_sa);
4379 				name = sti->sti_faddr_sa;
4380 				namelen = (t_uscalar_t)sti->sti_faddr_len;
4381 			}
4382 		}
4383 	} else {
4384 		/*
4385 		 * Sendmsg specifies a destination name
4386 		 */
4387 		if (!(so_state & SS_ISCONNECTED) &&
4388 		    (so_mode & SM_CONNREQUIRED)) {
4389 			/* i.e. TCP not connected */
4390 			mutex_exit(&so->so_lock);
4391 			return (ENOTCONN);
4392 		}
4393 		/*
4394 		 * Ignore the address on connection-oriented sockets.
4395 		 * Just like BSD this code does not generate an error for
4396 		 * TCP (a CONNREQUIRED socket) when sending to an address
4397 		 * passed in with sendto/sendmsg. Instead the data is
4398 		 * delivered on the connection as if no address had been
4399 		 * supplied.
4400 		 */
4401 		if ((so_state & SS_ISCONNECTED) &&
4402 		    !(so_mode & SM_CONNREQUIRED)) {
4403 			mutex_exit(&so->so_lock);
4404 			return (EISCONN);
4405 		}
4406 		if (!(so_state & SS_ISBOUND)) {
4407 			so_lock_single(so);	/* Set SOLOCKED */
4408 			error = sotpi_bind(so, NULL, 0,
4409 			    _SOBIND_UNSPEC|_SOBIND_LOCK_HELD, cr);
4410 			so_unlock_single(so, SOLOCKED);
4411 			if (error) {
4412 				mutex_exit(&so->so_lock);
4413 				eprintsoline(so, error);
4414 				return (error);
4415 			}
4416 		}
4417 		/*
4418 		 * Handle delayed datagram errors. These are only queued
4419 		 * when the application sets SO_DGRAM_ERRIND.
4420 		 * Return the error if we are sending to the address
4421 		 * that was returned in the last T_UDERROR_IND.
4422 		 * If sending to some other address discard the delayed
4423 		 * error indication.
4424 		 */
4425 		if (sti->sti_delayed_error) {
4426 			struct T_uderror_ind	*tudi;
4427 			void			*addr;
4428 			t_uscalar_t		addrlen;
4429 			boolean_t		match = B_FALSE;
4430 
4431 			ASSERT(sti->sti_eaddr_mp);
4432 			error = sti->sti_delayed_error;
4433 			sti->sti_delayed_error = 0;
4434 			tudi =
4435 			    (struct T_uderror_ind *)sti->sti_eaddr_mp->b_rptr;
4436 			addrlen = tudi->DEST_length;
4437 			addr = sogetoff(sti->sti_eaddr_mp,
4438 			    tudi->DEST_offset, addrlen, 1);
4439 			ASSERT(addr);	/* Checked by strsock_proto */
4440 			switch (so->so_family) {
4441 			case AF_INET: {
4442 				/* Compare just IP address and port */
4443 				sin_t *sin1 = (sin_t *)name;
4444 				sin_t *sin2 = (sin_t *)addr;
4445 
4446 				if (addrlen == sizeof (sin_t) &&
4447 				    namelen == addrlen &&
4448 				    sin1->sin_port == sin2->sin_port &&
4449 				    sin1->sin_addr.s_addr ==
4450 				    sin2->sin_addr.s_addr)
4451 					match = B_TRUE;
4452 				break;
4453 			}
4454 			case AF_INET6: {
4455 				/* Compare just IP address and port. Not flow */
4456 				sin6_t *sin1 = (sin6_t *)name;
4457 				sin6_t *sin2 = (sin6_t *)addr;
4458 
4459 				if (addrlen == sizeof (sin6_t) &&
4460 				    namelen == addrlen &&
4461 				    sin1->sin6_port == sin2->sin6_port &&
4462 				    IN6_ARE_ADDR_EQUAL(&sin1->sin6_addr,
4463 				    &sin2->sin6_addr))
4464 					match = B_TRUE;
4465 				break;
4466 			}
4467 			case AF_UNIX:
4468 			default:
4469 				if (namelen == addrlen &&
4470 				    bcmp(name, addr, namelen) == 0)
4471 					match = B_TRUE;
4472 			}
4473 			if (match) {
4474 				freemsg(sti->sti_eaddr_mp);
4475 				sti->sti_eaddr_mp = NULL;
4476 				mutex_exit(&so->so_lock);
4477 #ifdef DEBUG
4478 				dprintso(so, 0,
4479 				    ("sockfs delayed error %d for %s\n",
4480 				    error,
4481 				    pr_addr(so->so_family, name, namelen)));
4482 #endif /* DEBUG */
4483 				return (error);
4484 			}
4485 			freemsg(sti->sti_eaddr_mp);
4486 			sti->sti_eaddr_mp = NULL;
4487 		}
4488 	}
4489 	mutex_exit(&so->so_lock);
4490 
4491 	dontroute = 0;
4492 	if ((flags & MSG_DONTROUTE) && !(so->so_options & SO_DONTROUTE)) {
4493 		uint32_t	val;
4494 
4495 		val = 1;
4496 		error = sotpi_setsockopt(so, SOL_SOCKET, SO_DONTROUTE,
4497 		    &val, (t_uscalar_t)sizeof (val), cr);
4498 		if (error)
4499 			return (error);
4500 		dontroute = 1;
4501 	}
4502 
4503 	if ((flags & MSG_OOB) && !(so_mode & SM_EXDATA)) {
4504 		error = EOPNOTSUPP;
4505 		goto done;
4506 	}
4507 	if (msg->msg_controllen != 0) {
4508 		if (!(so_mode & SM_CONNREQUIRED)) {
4509 			so_update_attrs(so, SOMOD);
4510 			error = sosend_dgramcmsg(so, name, namelen, uiop,
4511 			    msg->msg_control, msg->msg_controllen, flags);
4512 		} else {
4513 			if (flags & MSG_OOB) {
4514 				/* Can't generate T_EXDATA_REQ with options */
4515 				error = EOPNOTSUPP;
4516 				goto done;
4517 			}
4518 			so_update_attrs(so, SOMOD);
4519 			error = sosend_svccmsg(so, uiop,
4520 			    !(flags & MSG_EOR),
4521 			    msg->msg_control, msg->msg_controllen,
4522 			    flags);
4523 		}
4524 		goto done;
4525 	}
4526 
4527 	so_update_attrs(so, SOMOD);
4528 	if (!(so_mode & SM_CONNREQUIRED)) {
4529 		/*
4530 		 * If there is no SO_DONTROUTE to turn off return immediately
4531 		 * from send_dgram. This can allow tail-call optimizations.
4532 		 */
4533 		if (!dontroute) {
4534 			return (sosend_dgram(so, name, namelen, uiop, flags));
4535 		}
4536 		error = sosend_dgram(so, name, namelen, uiop, flags);
4537 	} else {
4538 		t_scalar_t prim;
4539 		int sflag;
4540 
4541 		/* Ignore msg_name in the connected state */
4542 		if (flags & MSG_OOB) {
4543 			prim = T_EXDATA_REQ;
4544 			/*
4545 			 * Send down T_EXDATA_REQ even if there is flow
4546 			 * control for data.
4547 			 */
4548 			sflag = MSG_IGNFLOW;
4549 		} else {
4550 			if (so_mode & SM_BYTESTREAM) {
4551 				/* Byte stream transport - use write */
4552 				dprintso(so, 1, ("sotpi_sendmsg: write\n"));
4553 
4554 				/* Send M_DATA messages */
4555 				if ((sti->sti_nl7c_flags & NL7C_ENABLED) &&
4556 				    (error = nl7c_data(so, uiop)) >= 0) {
4557 					/* NL7C consumed the data */
4558 					return (error);
4559 				}
4560 				/*
4561 				 * If there is no SO_DONTROUTE to turn off,
4562 				 * sti_direct is on, and there is no flow
4563 				 * control, we can take the fast path.
4564 				 */
4565 				if (!dontroute && sti->sti_direct != 0 &&
4566 				    canputnext(SOTOV(so)->v_stream->sd_wrq)) {
4567 					return (sostream_direct(so, uiop,
4568 					    NULL, cr));
4569 				}
4570 				error = strwrite(SOTOV(so), uiop, cr);
4571 				goto done;
4572 			}
4573 			prim = T_DATA_REQ;
4574 			sflag = 0;
4575 		}
4576 		/*
4577 		 * If there is no SO_DONTROUTE to turn off return immediately
4578 		 * from sosend_svc. This can allow tail-call optimizations.
4579 		 */
4580 		if (!dontroute)
4581 			return (sosend_svc(so, uiop, prim,
4582 			    !(flags & MSG_EOR), sflag));
4583 		error = sosend_svc(so, uiop, prim,
4584 		    !(flags & MSG_EOR), sflag);
4585 	}
4586 	ASSERT(dontroute);
4587 done:
4588 	if (dontroute) {
4589 		uint32_t	val;
4590 
4591 		val = 0;
4592 		(void) sotpi_setsockopt(so, SOL_SOCKET, SO_DONTROUTE,
4593 		    &val, (t_uscalar_t)sizeof (val), cr);
4594 	}
4595 	return (error);
4596 }
4597 
4598 /*
4599  * kstrwritemp() has very similar semantics as that of strwrite().
4600  * The main difference is it obtains mblks from the caller and also
4601  * does not do any copy as done in strwrite() from user buffers to
4602  * kernel buffers.
4603  *
4604  * Currently, this routine is used by sendfile to send data allocated
4605  * within the kernel without any copying. This interface does not use the
4606  * synchronous stream interface as synch. stream interface implies
4607  * copying.
4608  */
4609 int
4610 kstrwritemp(struct vnode *vp, mblk_t *mp, ushort_t fmode)
4611 {
4612 	struct stdata *stp;
4613 	struct queue *wqp;
4614 	mblk_t *newmp;
4615 	char waitflag;
4616 	int tempmode;
4617 	int error = 0;
4618 	int done = 0;
4619 	struct sonode *so;
4620 	boolean_t direct;
4621 
4622 	ASSERT(vp->v_stream);
4623 	stp = vp->v_stream;
4624 
4625 	so = VTOSO(vp);
4626 	direct = _SOTOTPI(so)->sti_direct;
4627 
4628 	/*
4629 	 * This is the sockfs direct fast path. canputnext() need
4630 	 * not be accurate so we don't grab the sd_lock here. If
4631 	 * we get flow-controlled, we grab sd_lock just before the
4632 	 * do..while loop below to emulate what strwrite() does.
4633 	 */
4634 	wqp = stp->sd_wrq;
4635 	if (canputnext(wqp) && direct &&
4636 	    !(stp->sd_flag & (STWRERR|STRHUP|STPLEX))) {
4637 		return (sostream_direct(so, NULL, mp, CRED()));
4638 	} else if (stp->sd_flag & (STWRERR|STRHUP|STPLEX)) {
4639 		/* Fast check of flags before acquiring the lock */
4640 		mutex_enter(&stp->sd_lock);
4641 		error = strgeterr(stp, STWRERR|STRHUP|STPLEX, 0);
4642 		mutex_exit(&stp->sd_lock);
4643 		if (error != 0) {
4644 			if (!(stp->sd_flag & STPLEX) &&
4645 			    (stp->sd_wput_opt & SW_SIGPIPE)) {
4646 				error = EPIPE;
4647 			}
4648 			return (error);
4649 		}
4650 	}
4651 
4652 	waitflag = WRITEWAIT;
4653 	if (stp->sd_flag & OLDNDELAY)
4654 		tempmode = fmode & ~FNDELAY;
4655 	else
4656 		tempmode = fmode;
4657 
4658 	mutex_enter(&stp->sd_lock);
4659 	do {
4660 		if (canputnext(wqp)) {
4661 			mutex_exit(&stp->sd_lock);
4662 			if (stp->sd_wputdatafunc != NULL) {
4663 				newmp = (stp->sd_wputdatafunc)(vp, mp, NULL,
4664 				    NULL, NULL, NULL);
4665 				if (newmp == NULL) {
4666 					/* The caller will free mp */
4667 					return (ECOMM);
4668 				}
4669 				mp = newmp;
4670 			}
4671 			putnext(wqp, mp);
4672 			return (0);
4673 		}
4674 		error = strwaitq(stp, waitflag, (ssize_t)0, tempmode, -1,
4675 		    &done);
4676 	} while (error == 0 && !done);
4677 
4678 	mutex_exit(&stp->sd_lock);
4679 	/*
4680 	 * EAGAIN tells the application to try again. ENOMEM
4681 	 * is returned only if the memory allocation size
4682 	 * exceeds the physical limits of the system. ENOMEM
4683 	 * can't be true here.
4684 	 */
4685 	if (error == ENOMEM)
4686 		error = EAGAIN;
4687 	return (error);
4688 }
4689 
4690 /* ARGSUSED */
4691 static int
4692 sotpi_sendmblk(struct sonode *so, struct nmsghdr *msg, int fflag,
4693     struct cred *cr, mblk_t **mpp)
4694 {
4695 	int error;
4696 
4697 	switch (so->so_family) {
4698 	case AF_INET:
4699 	case AF_INET6:
4700 	case AF_UNIX:
4701 		break;
4702 	default:
4703 		return (EAFNOSUPPORT);
4704 
4705 	}
4706 
4707 	if (so->so_state & SS_CANTSENDMORE)
4708 		return (EPIPE);
4709 
4710 	if (so->so_type != SOCK_STREAM)
4711 		return (EOPNOTSUPP);
4712 
4713 	if ((so->so_state & SS_ISCONNECTED) == 0)
4714 		return (ENOTCONN);
4715 
4716 	error = kstrwritemp(so->so_vnode, *mpp, fflag);
4717 	if (error == 0)
4718 		*mpp = NULL;
4719 	return (error);
4720 }
4721 
4722 /*
4723  * Sending data on a datagram socket.
4724  * Assumes caller has verified that SS_ISBOUND etc. are set.
4725  */
4726 /* ARGSUSED */
4727 static int
4728 sodgram_direct(struct sonode *so, struct sockaddr *name,
4729     socklen_t namelen, struct uio *uiop, int flags)
4730 {
4731 	struct T_unitdata_req	tudr;
4732 	mblk_t			*mp = NULL;
4733 	int			error = 0;
4734 	void			*addr;
4735 	socklen_t		addrlen;
4736 	ssize_t			len;
4737 	struct stdata		*stp = SOTOV(so)->v_stream;
4738 	int			so_state;
4739 	queue_t			*udp_wq;
4740 	boolean_t		connected;
4741 	mblk_t			*mpdata = NULL;
4742 	sotpi_info_t		*sti = SOTOTPI(so);
4743 	uint32_t		auditing = AU_AUDITING();
4744 
4745 	ASSERT(name != NULL && namelen != 0);
4746 	ASSERT(!(so->so_mode & SM_CONNREQUIRED));
4747 	ASSERT(!(so->so_mode & SM_EXDATA));
4748 	ASSERT(so->so_family == AF_INET || so->so_family == AF_INET6);
4749 	ASSERT(SOTOV(so)->v_type == VSOCK);
4750 
4751 	/* Caller checked for proper length */
4752 	len = uiop->uio_resid;
4753 	ASSERT(len <= sti->sti_tidu_size);
4754 
4755 	/* Length and family checks have been done by caller */
4756 	ASSERT(name->sa_family == so->so_family);
4757 	ASSERT(so->so_family == AF_INET ||
4758 	    (namelen == (socklen_t)sizeof (struct sockaddr_in6)));
4759 	ASSERT(so->so_family == AF_INET6 ||
4760 	    (namelen == (socklen_t)sizeof (struct sockaddr_in)));
4761 
4762 	addr = name;
4763 	addrlen = namelen;
4764 
4765 	if (stp->sd_sidp != NULL &&
4766 	    (error = straccess(stp, JCWRITE)) != 0)
4767 		goto done;
4768 
4769 	so_state = so->so_state;
4770 
4771 	connected = so_state & SS_ISCONNECTED;
4772 	if (!connected) {
4773 		tudr.PRIM_type = T_UNITDATA_REQ;
4774 		tudr.DEST_length = addrlen;
4775 		tudr.DEST_offset = (t_scalar_t)sizeof (tudr);
4776 		tudr.OPT_length = 0;
4777 		tudr.OPT_offset = 0;
4778 
4779 		mp = soallocproto2(&tudr, sizeof (tudr), addr, addrlen, 0,
4780 		    _ALLOC_INTR, CRED());
4781 		if (mp == NULL) {
4782 			/*
4783 			 * Caught a signal waiting for memory.
4784 			 * Let send* return EINTR.
4785 			 */
4786 			error = EINTR;
4787 			goto done;
4788 		}
4789 	}
4790 
4791 	/*
4792 	 * For UDP we don't break up the copyin into smaller pieces
4793 	 * as in the TCP case.  That means if ENOMEM is returned by
4794 	 * mcopyinuio() then the uio vector has not been modified at
4795 	 * all and we fallback to either strwrite() or kstrputmsg()
4796 	 * below.  Note also that we never generate priority messages
4797 	 * from here.
4798 	 */
4799 	udp_wq = stp->sd_wrq->q_next;
4800 	if (canput(udp_wq) &&
4801 	    (mpdata = mcopyinuio(stp, uiop, -1, -1, &error)) != NULL) {
4802 		ASSERT(DB_TYPE(mpdata) == M_DATA);
4803 		ASSERT(uiop->uio_resid == 0);
4804 		if (!connected)
4805 			linkb(mp, mpdata);
4806 		else
4807 			mp = mpdata;
4808 		if (auditing)
4809 			audit_sock(T_UNITDATA_REQ, strvp2wq(SOTOV(so)), mp, 0);
4810 
4811 		udp_wput(udp_wq, mp);
4812 		return (0);
4813 	}
4814 
4815 	ASSERT(mpdata == NULL);
4816 	if (error != 0 && error != ENOMEM) {
4817 		freemsg(mp);
4818 		return (error);
4819 	}
4820 
4821 	/*
4822 	 * For connected, let strwrite() handle the blocking case.
4823 	 * Otherwise we fall thru and use kstrputmsg().
4824 	 */
4825 	if (connected)
4826 		return (strwrite(SOTOV(so), uiop, CRED()));
4827 
4828 	if (auditing)
4829 		audit_sock(T_UNITDATA_REQ, strvp2wq(SOTOV(so)), mp, 0);
4830 
4831 	error = kstrputmsg(SOTOV(so), mp, uiop, len, 0, MSG_BAND, 0);
4832 done:
4833 #ifdef SOCK_DEBUG
4834 	if (error != 0) {
4835 		eprintsoline(so, error);
4836 	}
4837 #endif /* SOCK_DEBUG */
4838 	return (error);
4839 }
4840 
4841 int
4842 sostream_direct(struct sonode *so, struct uio *uiop, mblk_t *mp, cred_t *cr)
4843 {
4844 	struct stdata *stp = SOTOV(so)->v_stream;
4845 	ssize_t iosize, rmax, maxblk;
4846 	queue_t *tcp_wq = stp->sd_wrq->q_next;
4847 	mblk_t *newmp;
4848 	int error = 0, wflag = 0;
4849 
4850 	ASSERT(so->so_mode & SM_BYTESTREAM);
4851 	ASSERT(SOTOV(so)->v_type == VSOCK);
4852 
4853 	if (stp->sd_sidp != NULL &&
4854 	    (error = straccess(stp, JCWRITE)) != 0)
4855 		return (error);
4856 
4857 	if (uiop == NULL) {
4858 		/*
4859 		 * kstrwritemp() should have checked sd_flag and
4860 		 * flow-control before coming here.  If we end up
4861 		 * here it means that we can simply pass down the
4862 		 * data to tcp.
4863 		 */
4864 		ASSERT(mp != NULL);
4865 		if (stp->sd_wputdatafunc != NULL) {
4866 			newmp = (stp->sd_wputdatafunc)(SOTOV(so), mp, NULL,
4867 			    NULL, NULL, NULL);
4868 			if (newmp == NULL) {
4869 				/* The caller will free mp */
4870 				return (ECOMM);
4871 			}
4872 			mp = newmp;
4873 		}
4874 		tcp_wput(tcp_wq, mp);
4875 		return (0);
4876 	}
4877 
4878 	/* Fallback to strwrite() to do proper error handling */
4879 	if (stp->sd_flag & (STWRERR|STRHUP|STPLEX|STRDELIM|OLDNDELAY))
4880 		return (strwrite(SOTOV(so), uiop, cr));
4881 
4882 	rmax = stp->sd_qn_maxpsz;
4883 	ASSERT(rmax >= 0 || rmax == INFPSZ);
4884 	if (rmax == 0 || uiop->uio_resid <= 0)
4885 		return (0);
4886 
4887 	if (rmax == INFPSZ)
4888 		rmax = uiop->uio_resid;
4889 
4890 	maxblk = stp->sd_maxblk;
4891 
4892 	for (;;) {
4893 		iosize = MIN(uiop->uio_resid, rmax);
4894 
4895 		mp = mcopyinuio(stp, uiop, iosize, maxblk, &error);
4896 		if (mp == NULL) {
4897 			/*
4898 			 * Fallback to strwrite() for ENOMEM; if this
4899 			 * is our first time in this routine and the uio
4900 			 * vector has not been modified, we will end up
4901 			 * calling strwrite() without any flag set.
4902 			 */
4903 			if (error == ENOMEM)
4904 				goto slow_send;
4905 			else
4906 				return (error);
4907 		}
4908 		ASSERT(uiop->uio_resid >= 0);
4909 		/*
4910 		 * If mp is non-NULL and ENOMEM is set, it means that
4911 		 * mcopyinuio() was able to break down some of the user
4912 		 * data into one or more mblks.  Send the partial data
4913 		 * to tcp and let the rest be handled in strwrite().
4914 		 */
4915 		ASSERT(error == 0 || error == ENOMEM);
4916 		if (stp->sd_wputdatafunc != NULL) {
4917 			newmp = (stp->sd_wputdatafunc)(SOTOV(so), mp, NULL,
4918 			    NULL, NULL, NULL);
4919 			if (newmp == NULL) {
4920 				/* The caller will free mp */
4921 				return (ECOMM);
4922 			}
4923 			mp = newmp;
4924 		}
4925 		tcp_wput(tcp_wq, mp);
4926 
4927 		wflag |= NOINTR;
4928 
4929 		if (uiop->uio_resid == 0) {	/* No more data; we're done */
4930 			ASSERT(error == 0);
4931 			break;
4932 		} else if (error == ENOMEM || !canput(tcp_wq) || (stp->sd_flag &
4933 		    (STWRERR|STRHUP|STPLEX|STRDELIM|OLDNDELAY))) {
4934 slow_send:
4935 			/*
4936 			 * We were able to send down partial data using
4937 			 * the direct call interface, but are now relying
4938 			 * on strwrite() to handle the non-fastpath cases.
4939 			 * If the socket is blocking we will sleep in
4940 			 * strwaitq() until write is permitted, otherwise,
4941 			 * we will need to return the amount of bytes
4942 			 * written so far back to the app.  This is the
4943 			 * reason why we pass NOINTR flag to strwrite()
4944 			 * for non-blocking socket, because we don't want
4945 			 * to return EAGAIN when portion of the user data
4946 			 * has actually been sent down.
4947 			 */
4948 			return (strwrite_common(SOTOV(so), uiop, cr, wflag));
4949 		}
4950 	}
4951 	return (0);
4952 }
4953 
4954 /*
4955  * Update sti_faddr by asking the transport (unless AF_UNIX).
4956  */
4957 /* ARGSUSED */
4958 int
4959 sotpi_getpeername(struct sonode *so, struct sockaddr *name, socklen_t *namelen,
4960     boolean_t accept, struct cred *cr)
4961 {
4962 	struct strbuf	strbuf;
4963 	int		error = 0, res;
4964 	void		*addr;
4965 	t_uscalar_t	addrlen;
4966 	k_sigset_t	smask;
4967 	sotpi_info_t	*sti = SOTOTPI(so);
4968 
4969 	dprintso(so, 1, ("sotpi_getpeername(%p) %s\n",
4970 	    (void *)so, pr_state(so->so_state, so->so_mode)));
4971 
4972 	ASSERT(*namelen > 0);
4973 	mutex_enter(&so->so_lock);
4974 	so_lock_single(so);	/* Set SOLOCKED */
4975 
4976 	if (accept) {
4977 		bcopy(sti->sti_faddr_sa, name,
4978 		    MIN(*namelen, sti->sti_faddr_len));
4979 		*namelen = sti->sti_faddr_noxlate ? 0: sti->sti_faddr_len;
4980 		goto done;
4981 	}
4982 
4983 	if (!(so->so_state & SS_ISCONNECTED)) {
4984 		error = ENOTCONN;
4985 		goto done;
4986 	}
4987 	/* Added this check for X/Open */
4988 	if ((so->so_state & SS_CANTSENDMORE) && !xnet_skip_checks) {
4989 		error = EINVAL;
4990 		if (xnet_check_print) {
4991 			printf("sockfs: X/Open getpeername check => EINVAL\n");
4992 		}
4993 		goto done;
4994 	}
4995 
4996 	if (sti->sti_faddr_valid) {
4997 		bcopy(sti->sti_faddr_sa, name,
4998 		    MIN(*namelen, sti->sti_faddr_len));
4999 		*namelen = sti->sti_faddr_noxlate ? 0: sti->sti_faddr_len;
5000 		goto done;
5001 	}
5002 
5003 #ifdef DEBUG
5004 	dprintso(so, 1, ("sotpi_getpeername (local): %s\n",
5005 	    pr_addr(so->so_family, sti->sti_faddr_sa,
5006 	    (t_uscalar_t)sti->sti_faddr_len)));
5007 #endif /* DEBUG */
5008 
5009 	if (so->so_family == AF_UNIX) {
5010 		/* Transport has different name space - return local info */
5011 		if (sti->sti_faddr_noxlate)
5012 			*namelen = 0;
5013 		error = 0;
5014 		goto done;
5015 	}
5016 
5017 	ASSERT(so->so_family != AF_UNIX && sti->sti_faddr_noxlate == 0);
5018 
5019 	ASSERT(sti->sti_faddr_sa);
5020 	/* Allocate local buffer to use with ioctl */
5021 	addrlen = (t_uscalar_t)sti->sti_faddr_maxlen;
5022 	mutex_exit(&so->so_lock);
5023 	addr = kmem_alloc(addrlen, KM_SLEEP);
5024 
5025 	/*
5026 	 * Issue TI_GETPEERNAME with signals masked.
5027 	 * Put the result in sti_faddr_sa so that getpeername works after
5028 	 * a shutdown(output).
5029 	 * If the ioctl fails (e.g. due to a ECONNRESET) the error is reposted
5030 	 * back to the socket.
5031 	 */
5032 	strbuf.buf = addr;
5033 	strbuf.maxlen = addrlen;
5034 	strbuf.len = 0;
5035 
5036 	sigintr(&smask, 0);
5037 	res = 0;
5038 	ASSERT(cr);
5039 	error = strioctl(SOTOV(so), TI_GETPEERNAME, (intptr_t)&strbuf,
5040 	    0, K_TO_K, cr, &res);
5041 	sigunintr(&smask);
5042 
5043 	mutex_enter(&so->so_lock);
5044 	/*
5045 	 * If there is an error record the error in so_error put don't fail
5046 	 * the getpeername. Instead fallback on the recorded
5047 	 * sti->sti_faddr_sa.
5048 	 */
5049 	if (error) {
5050 		/*
5051 		 * Various stream head errors can be returned to the ioctl.
5052 		 * However, it is impossible to determine which ones of
5053 		 * these are really socket level errors that were incorrectly
5054 		 * consumed by the ioctl. Thus this code silently ignores the
5055 		 * error - to code explicitly does not reinstate the error
5056 		 * using soseterror().
5057 		 * Experiments have shows that at least this set of
5058 		 * errors are reported and should not be reinstated on the
5059 		 * socket:
5060 		 *	EINVAL	E.g. if an I_LINK was in effect when
5061 		 *		getpeername was called.
5062 		 *	EPIPE	The ioctl error semantics prefer the write
5063 		 *		side error over the read side error.
5064 		 *	ENOTCONN The transport just got disconnected but
5065 		 *		sockfs had not yet seen the T_DISCON_IND
5066 		 *		when issuing the ioctl.
5067 		 */
5068 		error = 0;
5069 	} else if (res == 0 && strbuf.len > 0 &&
5070 	    (so->so_state & SS_ISCONNECTED)) {
5071 		ASSERT(strbuf.len <= (int)sti->sti_faddr_maxlen);
5072 		sti->sti_faddr_len = (socklen_t)strbuf.len;
5073 		bcopy(addr, sti->sti_faddr_sa, sti->sti_faddr_len);
5074 		sti->sti_faddr_valid = 1;
5075 
5076 		bcopy(addr, name, MIN(*namelen, sti->sti_faddr_len));
5077 		*namelen = sti->sti_faddr_len;
5078 	}
5079 	kmem_free(addr, addrlen);
5080 #ifdef DEBUG
5081 	dprintso(so, 1, ("sotpi_getpeername (tp): %s\n",
5082 	    pr_addr(so->so_family, sti->sti_faddr_sa,
5083 	    (t_uscalar_t)sti->sti_faddr_len)));
5084 #endif /* DEBUG */
5085 done:
5086 	so_unlock_single(so, SOLOCKED);
5087 	mutex_exit(&so->so_lock);
5088 	return (error);
5089 }
5090 
5091 /*
5092  * Update sti_laddr by asking the transport (unless AF_UNIX).
5093  */
5094 int
5095 sotpi_getsockname(struct sonode *so, struct sockaddr *name, socklen_t *namelen,
5096     struct cred *cr)
5097 {
5098 	struct strbuf	strbuf;
5099 	int		error = 0, res;
5100 	void		*addr;
5101 	t_uscalar_t	addrlen;
5102 	k_sigset_t	smask;
5103 	sotpi_info_t	*sti = SOTOTPI(so);
5104 
5105 	dprintso(so, 1, ("sotpi_getsockname(%p) %s\n",
5106 	    (void *)so, pr_state(so->so_state, so->so_mode)));
5107 
5108 	ASSERT(*namelen > 0);
5109 	mutex_enter(&so->so_lock);
5110 	so_lock_single(so);	/* Set SOLOCKED */
5111 
5112 #ifdef DEBUG
5113 
5114 	dprintso(so, 1, ("sotpi_getsockname (local): %s\n",
5115 	    pr_addr(so->so_family, sti->sti_laddr_sa,
5116 	    (t_uscalar_t)sti->sti_laddr_len)));
5117 #endif /* DEBUG */
5118 	if (sti->sti_laddr_valid) {
5119 		bcopy(sti->sti_laddr_sa, name,
5120 		    MIN(*namelen, sti->sti_laddr_len));
5121 		*namelen = sti->sti_laddr_len;
5122 		goto done;
5123 	}
5124 
5125 	if (so->so_family == AF_UNIX) {
5126 		/*
5127 		 * Transport has different name space - return local info. If we
5128 		 * have enough space, let consumers know the family.
5129 		 */
5130 		if (*namelen >= sizeof (sa_family_t)) {
5131 			name->sa_family = AF_UNIX;
5132 			*namelen = sizeof (sa_family_t);
5133 		} else {
5134 			*namelen = 0;
5135 		}
5136 		error = 0;
5137 		goto done;
5138 	}
5139 	if (!(so->so_state & SS_ISBOUND)) {
5140 		/* If not bound, then nothing to return. */
5141 		error = 0;
5142 		goto done;
5143 	}
5144 
5145 	/* Allocate local buffer to use with ioctl */
5146 	addrlen = (t_uscalar_t)sti->sti_laddr_maxlen;
5147 	mutex_exit(&so->so_lock);
5148 	addr = kmem_alloc(addrlen, KM_SLEEP);
5149 
5150 	/*
5151 	 * Issue TI_GETMYNAME with signals masked.
5152 	 * Put the result in sti_laddr_sa so that getsockname works after
5153 	 * a shutdown(output).
5154 	 * If the ioctl fails (e.g. due to a ECONNRESET) the error is reposted
5155 	 * back to the socket.
5156 	 */
5157 	strbuf.buf = addr;
5158 	strbuf.maxlen = addrlen;
5159 	strbuf.len = 0;
5160 
5161 	sigintr(&smask, 0);
5162 	res = 0;
5163 	ASSERT(cr);
5164 	error = strioctl(SOTOV(so), TI_GETMYNAME, (intptr_t)&strbuf,
5165 	    0, K_TO_K, cr, &res);
5166 	sigunintr(&smask);
5167 
5168 	mutex_enter(&so->so_lock);
5169 	/*
5170 	 * If there is an error record the error in so_error put don't fail
5171 	 * the getsockname. Instead fallback on the recorded
5172 	 * sti->sti_laddr_sa.
5173 	 */
5174 	if (error) {
5175 		/*
5176 		 * Various stream head errors can be returned to the ioctl.
5177 		 * However, it is impossible to determine which ones of
5178 		 * these are really socket level errors that were incorrectly
5179 		 * consumed by the ioctl. Thus this code silently ignores the
5180 		 * error - to code explicitly does not reinstate the error
5181 		 * using soseterror().
5182 		 * Experiments have shows that at least this set of
5183 		 * errors are reported and should not be reinstated on the
5184 		 * socket:
5185 		 *	EINVAL	E.g. if an I_LINK was in effect when
5186 		 *		getsockname was called.
5187 		 *	EPIPE	The ioctl error semantics prefer the write
5188 		 *		side error over the read side error.
5189 		 */
5190 		error = 0;
5191 	} else if (res == 0 && strbuf.len > 0 &&
5192 	    (so->so_state & SS_ISBOUND)) {
5193 		ASSERT(strbuf.len <= (int)sti->sti_laddr_maxlen);
5194 		sti->sti_laddr_len = (socklen_t)strbuf.len;
5195 		bcopy(addr, sti->sti_laddr_sa, sti->sti_laddr_len);
5196 		sti->sti_laddr_valid = 1;
5197 
5198 		bcopy(addr, name, MIN(sti->sti_laddr_len, *namelen));
5199 		*namelen = sti->sti_laddr_len;
5200 	}
5201 	kmem_free(addr, addrlen);
5202 #ifdef DEBUG
5203 	dprintso(so, 1, ("sotpi_getsockname (tp): %s\n",
5204 	    pr_addr(so->so_family, sti->sti_laddr_sa,
5205 	    (t_uscalar_t)sti->sti_laddr_len)));
5206 #endif /* DEBUG */
5207 done:
5208 	so_unlock_single(so, SOLOCKED);
5209 	mutex_exit(&so->so_lock);
5210 	return (error);
5211 }
5212 
5213 /*
5214  * Get socket options. For SOL_SOCKET options some options are handled
5215  * by the sockfs while others use the value recorded in the sonode as a
5216  * fallback should the T_SVR4_OPTMGMT_REQ fail.
5217  *
5218  * On the return most *optlenp bytes are copied to optval.
5219  */
5220 /* ARGSUSED */
5221 int
5222 sotpi_getsockopt(struct sonode *so, int level, int option_name,
5223     void *optval, socklen_t *optlenp, int flags, struct cred *cr)
5224 {
5225 	struct T_optmgmt_req	optmgmt_req;
5226 	struct T_optmgmt_ack	*optmgmt_ack;
5227 	struct opthdr		oh;
5228 	struct opthdr		*opt_res;
5229 	mblk_t			*mp = NULL;
5230 	int			error = 0;
5231 	void			*option = NULL;	/* Set if fallback value */
5232 	t_uscalar_t		maxlen = *optlenp;
5233 	t_uscalar_t		len;
5234 	uint32_t		value;
5235 	struct timeval		tmo_val; /* used for SO_RCVTIMEO, SO_SNDTIMEO */
5236 	struct timeval32	tmo_val32;
5237 	struct so_snd_bufinfo	snd_bufinfo;	/* used for zero copy */
5238 
5239 	dprintso(so, 1, ("sotpi_getsockopt(%p, 0x%x, 0x%x, %p, %p) %s\n",
5240 	    (void *)so, level, option_name, optval, (void *)optlenp,
5241 	    pr_state(so->so_state, so->so_mode)));
5242 
5243 	mutex_enter(&so->so_lock);
5244 	so_lock_single(so);	/* Set SOLOCKED */
5245 
5246 	/*
5247 	 * Check for SOL_SOCKET options.
5248 	 * Certain SOL_SOCKET options are returned directly whereas
5249 	 * others only provide a default (fallback) value should
5250 	 * the T_SVR4_OPTMGMT_REQ fail.
5251 	 */
5252 	if (level == SOL_SOCKET) {
5253 		/* Check parameters */
5254 		switch (option_name) {
5255 		case SO_TYPE:
5256 		case SO_ERROR:
5257 		case SO_DEBUG:
5258 		case SO_ACCEPTCONN:
5259 		case SO_REUSEADDR:
5260 		case SO_KEEPALIVE:
5261 		case SO_DONTROUTE:
5262 		case SO_BROADCAST:
5263 		case SO_USELOOPBACK:
5264 		case SO_OOBINLINE:
5265 		case SO_SNDBUF:
5266 		case SO_RCVBUF:
5267 #ifdef notyet
5268 		case SO_SNDLOWAT:
5269 		case SO_RCVLOWAT:
5270 #endif /* notyet */
5271 		case SO_DOMAIN:
5272 		case SO_DGRAM_ERRIND:
5273 			if (maxlen < (t_uscalar_t)sizeof (int32_t)) {
5274 				error = EINVAL;
5275 				eprintsoline(so, error);
5276 				goto done2;
5277 			}
5278 			break;
5279 		case SO_RCVTIMEO:
5280 		case SO_SNDTIMEO:
5281 			if (get_udatamodel() == DATAMODEL_NONE ||
5282 			    get_udatamodel() == DATAMODEL_NATIVE) {
5283 				if (maxlen < sizeof (struct timeval)) {
5284 					error = EINVAL;
5285 					eprintsoline(so, error);
5286 					goto done2;
5287 				}
5288 			} else {
5289 				if (maxlen < sizeof (struct timeval32)) {
5290 					error = EINVAL;
5291 					eprintsoline(so, error);
5292 					goto done2;
5293 				}
5294 
5295 			}
5296 			break;
5297 		case SO_LINGER:
5298 			if (maxlen < (t_uscalar_t)sizeof (struct linger)) {
5299 				error = EINVAL;
5300 				eprintsoline(so, error);
5301 				goto done2;
5302 			}
5303 			break;
5304 		case SO_SND_BUFINFO:
5305 			if (maxlen < (t_uscalar_t)
5306 			    sizeof (struct so_snd_bufinfo)) {
5307 				error = EINVAL;
5308 				eprintsoline(so, error);
5309 				goto done2;
5310 			}
5311 			break;
5312 		}
5313 
5314 		len = (t_uscalar_t)sizeof (uint32_t);	/* Default */
5315 
5316 		switch (option_name) {
5317 		case SO_TYPE:
5318 			value = so->so_type;
5319 			option = &value;
5320 			goto copyout; /* No need to issue T_SVR4_OPTMGMT_REQ */
5321 
5322 		case SO_ERROR:
5323 			value = sogeterr(so, B_TRUE);
5324 			option = &value;
5325 			goto copyout; /* No need to issue T_SVR4_OPTMGMT_REQ */
5326 
5327 		case SO_ACCEPTCONN:
5328 			if (so->so_state & SS_ACCEPTCONN)
5329 				value = SO_ACCEPTCONN;
5330 			else
5331 				value = 0;
5332 #ifdef DEBUG
5333 			if (value) {
5334 				dprintso(so, 1,
5335 				    ("sotpi_getsockopt: 0x%x is set\n",
5336 				    option_name));
5337 			} else {
5338 				dprintso(so, 1,
5339 				    ("sotpi_getsockopt: 0x%x not set\n",
5340 				    option_name));
5341 			}
5342 #endif /* DEBUG */
5343 			option = &value;
5344 			goto copyout; /* No need to issue T_SVR4_OPTMGMT_REQ */
5345 
5346 		case SO_DEBUG:
5347 		case SO_REUSEADDR:
5348 		case SO_KEEPALIVE:
5349 		case SO_DONTROUTE:
5350 		case SO_BROADCAST:
5351 		case SO_USELOOPBACK:
5352 		case SO_OOBINLINE:
5353 		case SO_DGRAM_ERRIND:
5354 			value = (so->so_options & option_name);
5355 #ifdef DEBUG
5356 			if (value) {
5357 				dprintso(so, 1,
5358 				    ("sotpi_getsockopt: 0x%x is set\n",
5359 				    option_name));
5360 			} else {
5361 				dprintso(so, 1,
5362 				    ("sotpi_getsockopt: 0x%x not set\n",
5363 				    option_name));
5364 			}
5365 #endif /* DEBUG */
5366 			option = &value;
5367 			goto copyout; /* No need to issue T_SVR4_OPTMGMT_REQ */
5368 
5369 		/*
5370 		 * The following options are only returned by sockfs when the
5371 		 * T_SVR4_OPTMGMT_REQ fails.
5372 		 */
5373 		case SO_LINGER:
5374 			option = &so->so_linger;
5375 			len = (t_uscalar_t)sizeof (struct linger);
5376 			break;
5377 		case SO_SNDBUF: {
5378 			ssize_t lvalue;
5379 
5380 			/*
5381 			 * If the option has not been set then get a default
5382 			 * value from the read queue. This value is
5383 			 * returned if the transport fails
5384 			 * the T_SVR4_OPTMGMT_REQ.
5385 			 */
5386 			lvalue = so->so_sndbuf;
5387 			if (lvalue == 0) {
5388 				mutex_exit(&so->so_lock);
5389 				(void) strqget(strvp2wq(SOTOV(so))->q_next,
5390 				    QHIWAT, 0, &lvalue);
5391 				mutex_enter(&so->so_lock);
5392 				dprintso(so, 1,
5393 				    ("got SO_SNDBUF %ld from q\n", lvalue));
5394 			}
5395 			value = (int)lvalue;
5396 			option = &value;
5397 			len = (t_uscalar_t)sizeof (so->so_sndbuf);
5398 			break;
5399 		}
5400 		case SO_RCVBUF: {
5401 			ssize_t lvalue;
5402 
5403 			/*
5404 			 * If the option has not been set then get a default
5405 			 * value from the read queue. This value is
5406 			 * returned if the transport fails
5407 			 * the T_SVR4_OPTMGMT_REQ.
5408 			 *
5409 			 * XXX If SO_RCVBUF has been set and this is an
5410 			 * XPG 4.2 application then do not ask the transport
5411 			 * since the transport might adjust the value and not
5412 			 * return exactly what was set by the application.
5413 			 * For non-XPG 4.2 application we return the value
5414 			 * that the transport is actually using.
5415 			 */
5416 			lvalue = so->so_rcvbuf;
5417 			if (lvalue == 0) {
5418 				mutex_exit(&so->so_lock);
5419 				(void) strqget(RD(strvp2wq(SOTOV(so))),
5420 				    QHIWAT, 0, &lvalue);
5421 				mutex_enter(&so->so_lock);
5422 				dprintso(so, 1,
5423 				    ("got SO_RCVBUF %ld from q\n", lvalue));
5424 			} else if (flags & _SOGETSOCKOPT_XPG4_2) {
5425 				value = (int)lvalue;
5426 				option = &value;
5427 				goto copyout;	/* skip asking transport */
5428 			}
5429 			value = (int)lvalue;
5430 			option = &value;
5431 			len = (t_uscalar_t)sizeof (so->so_rcvbuf);
5432 			break;
5433 		}
5434 		case SO_DOMAIN:
5435 			value = so->so_family;
5436 			option = &value;
5437 			goto copyout; /* No need to issue T_SVR4_OPTMGMT_REQ */
5438 
5439 #ifdef notyet
5440 		/*
5441 		 * We do not implement the semantics of these options
5442 		 * thus we shouldn't implement the options either.
5443 		 */
5444 		case SO_SNDLOWAT:
5445 			value = so->so_sndlowat;
5446 			option = &value;
5447 			break;
5448 		case SO_RCVLOWAT:
5449 			value = so->so_rcvlowat;
5450 			option = &value;
5451 			break;
5452 #endif /* notyet */
5453 		case SO_SNDTIMEO:
5454 		case SO_RCVTIMEO: {
5455 			clock_t val;
5456 
5457 			if (option_name == SO_RCVTIMEO)
5458 				val = drv_hztousec(so->so_rcvtimeo);
5459 			else
5460 				val = drv_hztousec(so->so_sndtimeo);
5461 			tmo_val.tv_sec = val / (1000 * 1000);
5462 			tmo_val.tv_usec = val % (1000 * 1000);
5463 			if (get_udatamodel() == DATAMODEL_NONE ||
5464 			    get_udatamodel() == DATAMODEL_NATIVE) {
5465 				option = &tmo_val;
5466 				len = sizeof (struct timeval);
5467 			} else {
5468 				TIMEVAL_TO_TIMEVAL32(&tmo_val32, &tmo_val);
5469 				option = &tmo_val32;
5470 				len = sizeof (struct timeval32);
5471 			}
5472 			break;
5473 		}
5474 		case SO_SND_BUFINFO: {
5475 			snd_bufinfo.sbi_wroff =
5476 			    (so->so_proto_props).sopp_wroff;
5477 			snd_bufinfo.sbi_maxblk =
5478 			    (so->so_proto_props).sopp_maxblk;
5479 			snd_bufinfo.sbi_maxpsz =
5480 			    (so->so_proto_props).sopp_maxpsz;
5481 			snd_bufinfo.sbi_tail =
5482 			    (so->so_proto_props).sopp_tail;
5483 			option = &snd_bufinfo;
5484 			len = (t_uscalar_t)sizeof (struct so_snd_bufinfo);
5485 			break;
5486 		}
5487 		}
5488 	}
5489 
5490 	mutex_exit(&so->so_lock);
5491 
5492 	/* Send request */
5493 	optmgmt_req.PRIM_type = T_SVR4_OPTMGMT_REQ;
5494 	optmgmt_req.MGMT_flags = T_CHECK;
5495 	optmgmt_req.OPT_length = (t_scalar_t)(sizeof (oh) + maxlen);
5496 	optmgmt_req.OPT_offset = (t_scalar_t)sizeof (optmgmt_req);
5497 
5498 	oh.level = level;
5499 	oh.name = option_name;
5500 	oh.len = maxlen;
5501 
5502 	mp = soallocproto3(&optmgmt_req, sizeof (optmgmt_req),
5503 	    &oh, sizeof (oh), NULL, maxlen, 0, _ALLOC_SLEEP, cr);
5504 	/* Let option management work in the presence of data flow control */
5505 	error = kstrputmsg(SOTOV(so), mp, NULL, 0, 0,
5506 	    MSG_BAND|MSG_HOLDSIG|MSG_IGNERROR|MSG_IGNFLOW, 0);
5507 	mp = NULL;
5508 	mutex_enter(&so->so_lock);
5509 	if (error) {
5510 		eprintsoline(so, error);
5511 		goto done2;
5512 	}
5513 	error = sowaitprim(so, T_SVR4_OPTMGMT_REQ, T_OPTMGMT_ACK,
5514 	    (t_uscalar_t)(sizeof (*optmgmt_ack) + sizeof (*opt_res)), &mp, 0);
5515 	if (error) {
5516 		if (option != NULL) {
5517 			/* We have a fallback value */
5518 			error = 0;
5519 			goto copyout;
5520 		}
5521 		eprintsoline(so, error);
5522 		goto done2;
5523 	}
5524 	ASSERT(mp);
5525 	optmgmt_ack = (struct T_optmgmt_ack *)mp->b_rptr;
5526 	opt_res = (struct opthdr *)sogetoff(mp, optmgmt_ack->OPT_offset,
5527 	    optmgmt_ack->OPT_length, __TPI_ALIGN_SIZE);
5528 	if (opt_res == NULL) {
5529 		if (option != NULL) {
5530 			/* We have a fallback value */
5531 			error = 0;
5532 			goto copyout;
5533 		}
5534 		error = EPROTO;
5535 		eprintsoline(so, error);
5536 		goto done;
5537 	}
5538 	option = &opt_res[1];
5539 
5540 	/* check to ensure that the option is within bounds */
5541 	if (((uintptr_t)option + opt_res->len < (uintptr_t)option) ||
5542 	    (uintptr_t)option + opt_res->len > (uintptr_t)mp->b_wptr) {
5543 		if (option != NULL) {
5544 			/* We have a fallback value */
5545 			error = 0;
5546 			goto copyout;
5547 		}
5548 		error = EPROTO;
5549 		eprintsoline(so, error);
5550 		goto done;
5551 	}
5552 
5553 	len = opt_res->len;
5554 
5555 copyout: {
5556 		t_uscalar_t size = MIN(len, maxlen);
5557 		bcopy(option, optval, size);
5558 		bcopy(&size, optlenp, sizeof (size));
5559 	}
5560 done:
5561 	freemsg(mp);
5562 done2:
5563 	so_unlock_single(so, SOLOCKED);
5564 	mutex_exit(&so->so_lock);
5565 
5566 	return (error);
5567 }
5568 
5569 /*
5570  * Set socket options. All options are passed down in a T_SVR4_OPTMGMT_REQ.
5571  * SOL_SOCKET options are also recorded in the sonode. A setsockopt for
5572  * SOL_SOCKET options will not fail just because the T_SVR4_OPTMGMT_REQ fails -
5573  * setsockopt has to work even if the transport does not support the option.
5574  */
5575 /* ARGSUSED */
5576 int
5577 sotpi_setsockopt(struct sonode *so, int level, int option_name,
5578     const void *optval, t_uscalar_t optlen, struct cred *cr)
5579 {
5580 	struct T_optmgmt_req	optmgmt_req;
5581 	struct opthdr		oh;
5582 	mblk_t			*mp;
5583 	int			error = 0;
5584 	boolean_t		handled = B_FALSE;
5585 
5586 	dprintso(so, 1, ("sotpi_setsockopt(%p, 0x%x, 0x%x, %p, %d) %s\n",
5587 	    (void *)so, level, option_name, optval, optlen,
5588 	    pr_state(so->so_state, so->so_mode)));
5589 
5590 	/* X/Open requires this check */
5591 	if ((so->so_state & SS_CANTSENDMORE) && !xnet_skip_checks) {
5592 		if (xnet_check_print)
5593 			printf("sockfs: X/Open setsockopt check => EINVAL\n");
5594 		return (EINVAL);
5595 	}
5596 
5597 	mutex_enter(&so->so_lock);
5598 	so_lock_single(so);	/* Set SOLOCKED */
5599 	mutex_exit(&so->so_lock);
5600 
5601 	optmgmt_req.PRIM_type = T_SVR4_OPTMGMT_REQ;
5602 	optmgmt_req.MGMT_flags = T_NEGOTIATE;
5603 	optmgmt_req.OPT_length = (t_scalar_t)sizeof (oh) + optlen;
5604 	optmgmt_req.OPT_offset = (t_scalar_t)sizeof (optmgmt_req);
5605 
5606 	oh.level = level;
5607 	oh.name = option_name;
5608 	oh.len = optlen;
5609 
5610 	mp = soallocproto3(&optmgmt_req, sizeof (optmgmt_req),
5611 	    &oh, sizeof (oh), optval, optlen, 0, _ALLOC_SLEEP, cr);
5612 	/* Let option management work in the presence of data flow control */
5613 	error = kstrputmsg(SOTOV(so), mp, NULL, 0, 0,
5614 	    MSG_BAND|MSG_HOLDSIG|MSG_IGNERROR|MSG_IGNFLOW, 0);
5615 	mp = NULL;
5616 	mutex_enter(&so->so_lock);
5617 	if (error) {
5618 		eprintsoline(so, error);
5619 		goto done2;
5620 	}
5621 	error = sowaitprim(so, T_SVR4_OPTMGMT_REQ, T_OPTMGMT_ACK,
5622 	    (t_uscalar_t)sizeof (struct T_optmgmt_ack), &mp, 0);
5623 	if (error) {
5624 		eprintsoline(so, error);
5625 		goto done;
5626 	}
5627 	ASSERT(mp);
5628 	/* No need to verify T_optmgmt_ack */
5629 	freemsg(mp);
5630 done:
5631 	/*
5632 	 * Check for SOL_SOCKET options and record their values.
5633 	 * If we know about a SOL_SOCKET parameter and the transport
5634 	 * failed it with TBADOPT or TOUTSTATE (i.e. ENOPROTOOPT or
5635 	 * EPROTO) we let the setsockopt succeed.
5636 	 */
5637 	if (level == SOL_SOCKET) {
5638 		/* Check parameters */
5639 		switch (option_name) {
5640 		case SO_DEBUG:
5641 		case SO_REUSEADDR:
5642 		case SO_KEEPALIVE:
5643 		case SO_DONTROUTE:
5644 		case SO_BROADCAST:
5645 		case SO_USELOOPBACK:
5646 		case SO_OOBINLINE:
5647 		case SO_SNDBUF:
5648 		case SO_RCVBUF:
5649 #ifdef notyet
5650 		case SO_SNDLOWAT:
5651 		case SO_RCVLOWAT:
5652 #endif /* notyet */
5653 		case SO_DGRAM_ERRIND:
5654 			if (optlen != (t_uscalar_t)sizeof (int32_t)) {
5655 				error = EINVAL;
5656 				eprintsoline(so, error);
5657 				goto done2;
5658 			}
5659 			ASSERT(optval);
5660 			handled = B_TRUE;
5661 			break;
5662 		case SO_SNDTIMEO:
5663 		case SO_RCVTIMEO:
5664 			if (get_udatamodel() == DATAMODEL_NONE ||
5665 			    get_udatamodel() == DATAMODEL_NATIVE) {
5666 				if (optlen != sizeof (struct timeval)) {
5667 					error = EINVAL;
5668 					eprintsoline(so, error);
5669 					goto done2;
5670 				}
5671 			} else {
5672 				if (optlen != sizeof (struct timeval32)) {
5673 					error = EINVAL;
5674 					eprintsoline(so, error);
5675 					goto done2;
5676 				}
5677 			}
5678 			ASSERT(optval);
5679 			handled = B_TRUE;
5680 			break;
5681 		case SO_LINGER:
5682 			if (optlen != (t_uscalar_t)sizeof (struct linger)) {
5683 				error = EINVAL;
5684 				eprintsoline(so, error);
5685 				goto done2;
5686 			}
5687 			ASSERT(optval);
5688 			handled = B_TRUE;
5689 			break;
5690 		}
5691 
5692 #define	intvalue	(*(int32_t *)optval)
5693 
5694 		switch (option_name) {
5695 		case SO_TYPE:
5696 		case SO_ERROR:
5697 		case SO_ACCEPTCONN:
5698 			/* Can't be set */
5699 			error = ENOPROTOOPT;
5700 			goto done2;
5701 		case SO_LINGER: {
5702 			struct linger *l = (struct linger *)optval;
5703 
5704 			so->so_linger.l_linger = l->l_linger;
5705 			if (l->l_onoff) {
5706 				so->so_linger.l_onoff = SO_LINGER;
5707 				so->so_options |= SO_LINGER;
5708 			} else {
5709 				so->so_linger.l_onoff = 0;
5710 				so->so_options &= ~SO_LINGER;
5711 			}
5712 			break;
5713 		}
5714 
5715 		case SO_DEBUG:
5716 #ifdef SOCK_TEST
5717 			if (intvalue & 2)
5718 				sock_test_timelimit = 10 * hz;
5719 			else
5720 				sock_test_timelimit = 0;
5721 
5722 			if (intvalue & 4)
5723 				do_useracc = 0;
5724 			else
5725 				do_useracc = 1;
5726 #endif /* SOCK_TEST */
5727 			/* FALLTHRU */
5728 		case SO_REUSEADDR:
5729 		case SO_KEEPALIVE:
5730 		case SO_DONTROUTE:
5731 		case SO_BROADCAST:
5732 		case SO_USELOOPBACK:
5733 		case SO_OOBINLINE:
5734 		case SO_DGRAM_ERRIND:
5735 			if (intvalue != 0) {
5736 				dprintso(so, 1,
5737 				    ("socket_setsockopt: setting 0x%x\n",
5738 				    option_name));
5739 				so->so_options |= option_name;
5740 			} else {
5741 				dprintso(so, 1,
5742 				    ("socket_setsockopt: clearing 0x%x\n",
5743 				    option_name));
5744 				so->so_options &= ~option_name;
5745 			}
5746 			break;
5747 		/*
5748 		 * The following options are only returned by us when the
5749 		 * transport layer fails.
5750 		 * XXX XPG 4.2 applications retrieve SO_RCVBUF from sockfs
5751 		 * since the transport might adjust the value and not
5752 		 * return exactly what was set by the application.
5753 		 */
5754 		case SO_SNDBUF:
5755 			so->so_sndbuf = intvalue;
5756 			break;
5757 		case SO_RCVBUF:
5758 			so->so_rcvbuf = intvalue;
5759 			break;
5760 		case SO_RCVPSH:
5761 			so->so_rcv_timer_interval = intvalue;
5762 			break;
5763 #ifdef notyet
5764 		/*
5765 		 * We do not implement the semantics of these options
5766 		 * thus we shouldn't implement the options either.
5767 		 */
5768 		case SO_SNDLOWAT:
5769 			so->so_sndlowat = intvalue;
5770 			break;
5771 		case SO_RCVLOWAT:
5772 			so->so_rcvlowat = intvalue;
5773 			break;
5774 #endif /* notyet */
5775 		case SO_SNDTIMEO:
5776 		case SO_RCVTIMEO: {
5777 			struct timeval tl;
5778 			clock_t val;
5779 
5780 			if (get_udatamodel() == DATAMODEL_NONE ||
5781 			    get_udatamodel() == DATAMODEL_NATIVE)
5782 				bcopy(&tl, (struct timeval *)optval,
5783 				    sizeof (struct timeval));
5784 			else
5785 				TIMEVAL32_TO_TIMEVAL(&tl,
5786 				    (struct timeval32 *)optval);
5787 			val = tl.tv_sec * 1000 * 1000 + tl.tv_usec;
5788 			if (option_name == SO_RCVTIMEO)
5789 				so->so_rcvtimeo = drv_usectohz(val);
5790 			else
5791 				so->so_sndtimeo = drv_usectohz(val);
5792 			break;
5793 		}
5794 		}
5795 #undef	intvalue
5796 
5797 		if (error) {
5798 			if ((error == ENOPROTOOPT || error == EPROTO ||
5799 			    error == EINVAL) && handled) {
5800 				dprintso(so, 1,
5801 				    ("setsockopt: ignoring error %d for 0x%x\n",
5802 				    error, option_name));
5803 				error = 0;
5804 			}
5805 		}
5806 	}
5807 done2:
5808 	so_unlock_single(so, SOLOCKED);
5809 	mutex_exit(&so->so_lock);
5810 	return (error);
5811 }
5812 
5813 /*
5814  * sotpi_close() is called when the last open reference goes away.
5815  */
5816 /* ARGSUSED */
5817 int
5818 sotpi_close(struct sonode *so, int flag, struct cred *cr)
5819 {
5820 	struct vnode *vp = SOTOV(so);
5821 	dev_t dev;
5822 	int error = 0;
5823 	sotpi_info_t *sti = SOTOTPI(so);
5824 
5825 	dprintso(so, 1, ("sotpi_close(%p, %x) %s\n",
5826 	    (void *)vp, flag, pr_state(so->so_state, so->so_mode)));
5827 
5828 	dev = sti->sti_dev;
5829 
5830 	ASSERT(STREAMSTAB(getmajor(dev)));
5831 
5832 	mutex_enter(&so->so_lock);
5833 	so_lock_single(so);	/* Set SOLOCKED */
5834 
5835 	ASSERT(so_verify_oobstate(so));
5836 
5837 	if (sti->sti_nl7c_flags & NL7C_ENABLED) {
5838 		sti->sti_nl7c_flags = 0;
5839 		nl7c_close(so);
5840 	}
5841 
5842 	if (vp->v_stream != NULL) {
5843 		vnode_t *ux_vp;
5844 
5845 		if (so->so_family == AF_UNIX) {
5846 			/* Could avoid this when CANTSENDMORE for !dgram */
5847 			so_unix_close(so);
5848 		}
5849 
5850 		mutex_exit(&so->so_lock);
5851 		/*
5852 		 * Disassemble the linkage from the AF_UNIX underlying file
5853 		 * system vnode to this socket (by atomically clearing
5854 		 * v_stream in vn_rele_stream) before strclose clears sd_vnode
5855 		 * and frees the stream head.
5856 		 */
5857 		if ((ux_vp = sti->sti_ux_bound_vp) != NULL) {
5858 			ASSERT(ux_vp->v_stream);
5859 			sti->sti_ux_bound_vp = NULL;
5860 			vn_rele_stream(ux_vp);
5861 		}
5862 		error = strclose(vp, flag, cr);
5863 		vp->v_stream = NULL;
5864 		mutex_enter(&so->so_lock);
5865 	}
5866 
5867 	/*
5868 	 * Flush the T_DISCON_IND on sti_discon_ind_mp.
5869 	 */
5870 	so_flush_discon_ind(so);
5871 
5872 	so_unlock_single(so, SOLOCKED);
5873 	mutex_exit(&so->so_lock);
5874 
5875 	/*
5876 	 * Needed for STREAMs.
5877 	 * Decrement the device driver's reference count for streams
5878 	 * opened via the clone dip. The driver was held in clone_open().
5879 	 * The absence of clone_close() forces this asymmetry.
5880 	 */
5881 	if (so->so_flag & SOCLONE)
5882 		ddi_rele_driver(getmajor(dev));
5883 
5884 	return (error);
5885 }
5886 
5887 static int
5888 sotpi_ioctl(struct sonode *so, int cmd, intptr_t arg, int mode,
5889     struct cred *cr, int32_t *rvalp)
5890 {
5891 	struct vnode *vp = SOTOV(so);
5892 	sotpi_info_t *sti = SOTOTPI(so);
5893 	int error = 0;
5894 
5895 	dprintso(so, 0, ("sotpi_ioctl: cmd 0x%x, arg 0x%lx, state %s\n",
5896 	    cmd, arg, pr_state(so->so_state, so->so_mode)));
5897 
5898 	switch (cmd) {
5899 	case SIOCSQPTR:
5900 		/*
5901 		 * SIOCSQPTR is valid only when helper stream is created
5902 		 * by the protocol.
5903 		 */
5904 	case _I_INSERT:
5905 	case _I_REMOVE:
5906 		/*
5907 		 * Since there's no compelling reason to support these ioctls
5908 		 * on sockets, and doing so would increase the complexity
5909 		 * markedly, prevent it.
5910 		 */
5911 		return (EOPNOTSUPP);
5912 
5913 	case I_FIND:
5914 	case I_LIST:
5915 	case I_LOOK:
5916 	case I_POP:
5917 	case I_PUSH:
5918 		/*
5919 		 * To prevent races and inconsistencies between the actual
5920 		 * state of the stream and the state according to the sonode,
5921 		 * we serialize all operations which modify or operate on the
5922 		 * list of modules on the socket's stream.
5923 		 */
5924 		mutex_enter(&sti->sti_plumb_lock);
5925 		error = socktpi_plumbioctl(vp, cmd, arg, mode, cr, rvalp);
5926 		mutex_exit(&sti->sti_plumb_lock);
5927 		return (error);
5928 
5929 	default:
5930 		if (so->so_version != SOV_STREAM)
5931 			break;
5932 
5933 		/*
5934 		 * The imaginary "sockmod" has been popped; act as a stream.
5935 		 */
5936 		return (strioctl(vp, cmd, arg, mode, U_TO_K, cr, rvalp));
5937 	}
5938 
5939 	ASSERT(so->so_version != SOV_STREAM);
5940 
5941 	/*
5942 	 * Process socket-specific ioctls.
5943 	 */
5944 	switch (cmd) {
5945 	case FIONBIO: {
5946 		int32_t value;
5947 
5948 		if (so_copyin((void *)arg, &value, sizeof (int32_t),
5949 		    (mode & (int)FKIOCTL)))
5950 			return (EFAULT);
5951 
5952 		mutex_enter(&so->so_lock);
5953 		if (value) {
5954 			so->so_state |= SS_NDELAY;
5955 		} else {
5956 			so->so_state &= ~SS_NDELAY;
5957 		}
5958 		mutex_exit(&so->so_lock);
5959 		return (0);
5960 	}
5961 
5962 	case FIOASYNC: {
5963 		int32_t value;
5964 
5965 		if (so_copyin((void *)arg, &value, sizeof (int32_t),
5966 		    (mode & (int)FKIOCTL)))
5967 			return (EFAULT);
5968 
5969 		mutex_enter(&so->so_lock);
5970 		/*
5971 		 * SS_ASYNC flag not already set correctly?
5972 		 * (!value != !(so->so_state & SS_ASYNC))
5973 		 * but some engineers find that too hard to read.
5974 		 */
5975 		if (value == 0 && (so->so_state & SS_ASYNC) != 0 ||
5976 		    value != 0 && (so->so_state & SS_ASYNC) == 0)
5977 			error = so_flip_async(so, vp, mode, cr);
5978 		mutex_exit(&so->so_lock);
5979 		return (error);
5980 	}
5981 
5982 	case SIOCSPGRP:
5983 	case FIOSETOWN: {
5984 		pid_t pgrp;
5985 
5986 		if (so_copyin((void *)arg, &pgrp, sizeof (pid_t),
5987 		    (mode & (int)FKIOCTL)))
5988 			return (EFAULT);
5989 
5990 		mutex_enter(&so->so_lock);
5991 		dprintso(so, 1, ("setown: new %d old %d\n", pgrp, so->so_pgrp));
5992 		/* Any change? */
5993 		if (pgrp != so->so_pgrp)
5994 			error = so_set_siggrp(so, vp, pgrp, mode, cr);
5995 		mutex_exit(&so->so_lock);
5996 		return (error);
5997 	}
5998 	case SIOCGPGRP:
5999 	case FIOGETOWN:
6000 		if (so_copyout(&so->so_pgrp, (void *)arg,
6001 		    sizeof (pid_t), (mode & (int)FKIOCTL)))
6002 			return (EFAULT);
6003 		return (0);
6004 
6005 	case SIOCATMARK: {
6006 		int retval;
6007 		uint_t so_state;
6008 
6009 		/*
6010 		 * strwaitmark has a finite timeout after which it
6011 		 * returns -1 if the mark state is undetermined.
6012 		 * In order to avoid any race between the mark state
6013 		 * in sockfs and the mark state in the stream head this
6014 		 * routine loops until the mark state can be determined
6015 		 * (or the urgent data indication has been removed by some
6016 		 * other thread).
6017 		 */
6018 		do {
6019 			mutex_enter(&so->so_lock);
6020 			so_state = so->so_state;
6021 			mutex_exit(&so->so_lock);
6022 			if (so_state & SS_RCVATMARK) {
6023 				retval = 1;
6024 			} else if (!(so_state & SS_OOBPEND)) {
6025 				/*
6026 				 * No SIGURG has been generated -- there is no
6027 				 * pending or present urgent data. Thus can't
6028 				 * possibly be at the mark.
6029 				 */
6030 				retval = 0;
6031 			} else {
6032 				/*
6033 				 * Have the stream head wait until there is
6034 				 * either some messages on the read queue, or
6035 				 * STRATMARK or STRNOTATMARK gets set. The
6036 				 * STRNOTATMARK flag is used so that the
6037 				 * transport can send up a MSGNOTMARKNEXT
6038 				 * M_DATA to indicate that it is not
6039 				 * at the mark and additional data is not about
6040 				 * to be send upstream.
6041 				 *
6042 				 * If the mark state is undetermined this will
6043 				 * return -1 and we will loop rechecking the
6044 				 * socket state.
6045 				 */
6046 				retval = strwaitmark(vp);
6047 			}
6048 		} while (retval == -1);
6049 
6050 		if (so_copyout(&retval, (void *)arg, sizeof (int),
6051 		    (mode & (int)FKIOCTL)))
6052 			return (EFAULT);
6053 		return (0);
6054 	}
6055 
6056 	case I_FDINSERT:
6057 	case I_SENDFD:
6058 	case I_RECVFD:
6059 	case I_ATMARK:
6060 	case _SIOCSOCKFALLBACK:
6061 		/*
6062 		 * These ioctls do not apply to sockets. I_FDINSERT can be
6063 		 * used to send M_PROTO messages without modifying the socket
6064 		 * state. I_SENDFD/RECVFD should not be used for socket file
6065 		 * descriptor passing since they assume a twisted stream.
6066 		 * SIOCATMARK must be used instead of I_ATMARK.
6067 		 *
6068 		 * _SIOCSOCKFALLBACK from an application should never be
6069 		 * processed.  It is only generated by socktpi_open() or
6070 		 * in response to I_POP or I_PUSH.
6071 		 */
6072 #ifdef DEBUG
6073 		zcmn_err(getzoneid(), CE_WARN,
6074 		    "Unsupported STREAMS ioctl 0x%x on socket. "
6075 		    "Pid = %d\n", cmd, curproc->p_pid);
6076 #endif /* DEBUG */
6077 		return (EOPNOTSUPP);
6078 
6079 	case _I_GETPEERCRED:
6080 		if ((mode & FKIOCTL) == 0)
6081 			return (EINVAL);
6082 
6083 		mutex_enter(&so->so_lock);
6084 		if ((so->so_mode & SM_CONNREQUIRED) == 0) {
6085 			error = ENOTSUP;
6086 		} else if ((so->so_state & SS_ISCONNECTED) == 0) {
6087 			error = ENOTCONN;
6088 		} else if (so->so_peercred != NULL) {
6089 			k_peercred_t *kp = (k_peercred_t *)arg;
6090 			kp->pc_cr = so->so_peercred;
6091 			kp->pc_cpid = so->so_cpid;
6092 			crhold(so->so_peercred);
6093 		} else {
6094 			error = EINVAL;
6095 		}
6096 		mutex_exit(&so->so_lock);
6097 		return (error);
6098 
6099 	default:
6100 		/*
6101 		 * Do the higher-order bits of the ioctl cmd indicate
6102 		 * that it is an I_* streams ioctl?
6103 		 */
6104 		if ((cmd & 0xffffff00U) == STR &&
6105 		    so->so_version == SOV_SOCKBSD) {
6106 #ifdef DEBUG
6107 			zcmn_err(getzoneid(), CE_WARN,
6108 			    "Unsupported STREAMS ioctl 0x%x on socket. "
6109 			    "Pid = %d\n", cmd, 	curproc->p_pid);
6110 #endif /* DEBUG */
6111 			return (EOPNOTSUPP);
6112 		}
6113 		return (strioctl(vp, cmd, arg, mode, U_TO_K, cr, rvalp));
6114 	}
6115 }
6116 
6117 /*
6118  * Handle plumbing-related ioctls.
6119  */
6120 static int
6121 socktpi_plumbioctl(struct vnode *vp, int cmd, intptr_t arg, int mode,
6122     struct cred *cr, int32_t *rvalp)
6123 {
6124 	static const char sockmod_name[] = "sockmod";
6125 	struct sonode	*so = VTOSO(vp);
6126 	char		mname[FMNAMESZ + 1];
6127 	int		error;
6128 	sotpi_info_t	*sti = SOTOTPI(so);
6129 
6130 	ASSERT(MUTEX_HELD(&sti->sti_plumb_lock));
6131 
6132 	if (so->so_version == SOV_SOCKBSD)
6133 		return (EOPNOTSUPP);
6134 
6135 	if (so->so_version == SOV_STREAM) {
6136 		/*
6137 		 * The imaginary "sockmod" has been popped - act as a stream.
6138 		 * If this is a push of sockmod then change back to a socket.
6139 		 */
6140 		if (cmd == I_PUSH) {
6141 			error = ((mode & FKIOCTL) ? copystr : copyinstr)(
6142 			    (void *)arg, mname, sizeof (mname), NULL);
6143 
6144 			if (error == 0 && strcmp(mname, sockmod_name) == 0) {
6145 				dprintso(so, 0, ("socktpi_ioctl: going to "
6146 				    "socket version\n"));
6147 				so_stream2sock(so);
6148 				return (0);
6149 			}
6150 		}
6151 		return (strioctl(vp, cmd, arg, mode, U_TO_K, cr, rvalp));
6152 	}
6153 
6154 	switch (cmd) {
6155 	case I_PUSH:
6156 		if (sti->sti_direct) {
6157 			mutex_enter(&so->so_lock);
6158 			so_lock_single(so);
6159 			mutex_exit(&so->so_lock);
6160 
6161 			error = strioctl(vp, _SIOCSOCKFALLBACK, 0, 0, K_TO_K,
6162 			    cr, rvalp);
6163 
6164 			mutex_enter(&so->so_lock);
6165 			if (error == 0)
6166 				sti->sti_direct = 0;
6167 			so_unlock_single(so, SOLOCKED);
6168 			mutex_exit(&so->so_lock);
6169 
6170 			if (error != 0)
6171 				return (error);
6172 		}
6173 
6174 		error = strioctl(vp, cmd, arg, mode, U_TO_K, cr, rvalp);
6175 		if (error == 0)
6176 			sti->sti_pushcnt++;
6177 		return (error);
6178 
6179 	case I_POP:
6180 		if (sti->sti_pushcnt == 0) {
6181 			/* Emulate sockmod being popped */
6182 			dprintso(so, 0,
6183 			    ("socktpi_ioctl: going to STREAMS version\n"));
6184 			return (so_sock2stream(so));
6185 		}
6186 
6187 		error = strioctl(vp, cmd, arg, mode, U_TO_K, cr, rvalp);
6188 		if (error == 0)
6189 			sti->sti_pushcnt--;
6190 		return (error);
6191 
6192 	case I_LIST: {
6193 		struct str_mlist *kmlistp, *umlistp;
6194 		struct str_list	kstrlist;
6195 		ssize_t		kstrlistsize;
6196 		int		i, nmods;
6197 
6198 		STRUCT_DECL(str_list, ustrlist);
6199 		STRUCT_INIT(ustrlist, mode);
6200 
6201 		if (arg == NULL) {
6202 			error = strioctl(vp, cmd, arg, mode, U_TO_K, cr, rvalp);
6203 			if (error == 0)
6204 				(*rvalp)++;	/* Add one for sockmod */
6205 			return (error);
6206 		}
6207 
6208 		error = so_copyin((void *)arg, STRUCT_BUF(ustrlist),
6209 		    STRUCT_SIZE(ustrlist), mode & FKIOCTL);
6210 		if (error != 0)
6211 			return (error);
6212 
6213 		nmods = STRUCT_FGET(ustrlist, sl_nmods);
6214 		if (nmods <= 0)
6215 			return (EINVAL);
6216 		/*
6217 		 * Ceiling nmods at nstrpush to prevent someone from
6218 		 * maliciously consuming lots of kernel memory.
6219 		 */
6220 		nmods = MIN(nmods, nstrpush);
6221 
6222 		kstrlistsize = (nmods + 1) * sizeof (struct str_mlist);
6223 		kstrlist.sl_nmods = nmods;
6224 		kstrlist.sl_modlist = kmem_zalloc(kstrlistsize, KM_SLEEP);
6225 
6226 		error = strioctl(vp, cmd, (intptr_t)&kstrlist, mode, K_TO_K,
6227 		    cr, rvalp);
6228 		if (error != 0)
6229 			goto done;
6230 
6231 		/*
6232 		 * Considering the module list as a 0-based array of sl_nmods
6233 		 * modules, sockmod should conceptually exist at slot
6234 		 * sti_pushcnt.  Insert sockmod at this location by sliding all
6235 		 * of the module names after so_pushcnt over by one.  We know
6236 		 * that there will be room to do this since we allocated
6237 		 * sl_modlist with an additional slot.
6238 		 */
6239 		for (i = kstrlist.sl_nmods; i > sti->sti_pushcnt; i--)
6240 			kstrlist.sl_modlist[i] = kstrlist.sl_modlist[i - 1];
6241 
6242 		(void) strcpy(kstrlist.sl_modlist[i].l_name, sockmod_name);
6243 		kstrlist.sl_nmods++;
6244 
6245 		/*
6246 		 * Copy all of the entries out to ustrlist.
6247 		 */
6248 		kmlistp = kstrlist.sl_modlist;
6249 		umlistp = STRUCT_FGETP(ustrlist, sl_modlist);
6250 		for (i = 0; i < nmods && i < kstrlist.sl_nmods; i++) {
6251 			error = so_copyout(kmlistp++, umlistp++,
6252 			    sizeof (struct str_mlist), mode & FKIOCTL);
6253 			if (error != 0)
6254 				goto done;
6255 		}
6256 
6257 		error = so_copyout(&i, (void *)arg, sizeof (int32_t),
6258 		    mode & FKIOCTL);
6259 		if (error == 0)
6260 			*rvalp = 0;
6261 	done:
6262 		kmem_free(kstrlist.sl_modlist, kstrlistsize);
6263 		return (error);
6264 	}
6265 	case I_LOOK:
6266 		if (sti->sti_pushcnt == 0) {
6267 			return (so_copyout(sockmod_name, (void *)arg,
6268 			    sizeof (sockmod_name), mode & FKIOCTL));
6269 		}
6270 		return (strioctl(vp, cmd, arg, mode, U_TO_K, cr, rvalp));
6271 
6272 	case I_FIND:
6273 		error = strioctl(vp, cmd, arg, mode, U_TO_K, cr, rvalp);
6274 		if (error && error != EINVAL)
6275 			return (error);
6276 
6277 		/* if not found and string was sockmod return 1 */
6278 		if (*rvalp == 0 || error == EINVAL) {
6279 			error = ((mode & FKIOCTL) ? copystr : copyinstr)(
6280 			    (void *)arg, mname, sizeof (mname), NULL);
6281 			if (error == ENAMETOOLONG)
6282 				error = EINVAL;
6283 
6284 			if (error == 0 && strcmp(mname, sockmod_name) == 0)
6285 				*rvalp = 1;
6286 		}
6287 		return (error);
6288 
6289 	default:
6290 		panic("socktpi_plumbioctl: unknown ioctl %d", cmd);
6291 		break;
6292 	}
6293 
6294 	return (0);
6295 }
6296 
6297 /*
6298  * Wrapper around the streams poll routine that implements socket poll
6299  * semantics.
6300  * The sockfs never calls pollwakeup itself - the stream head take care
6301  * of all pollwakeups. Since sockfs never holds so_lock when calling the
6302  * stream head there can never be a deadlock due to holding so_lock across
6303  * pollwakeup and acquiring so_lock in this routine.
6304  *
6305  * However, since the performance of VOP_POLL is critical we avoid
6306  * acquiring so_lock here. This is based on two assumptions:
6307  *  - The poll implementation holds locks to serialize the VOP_POLL call
6308  *    and a pollwakeup for the same pollhead. This ensures that should
6309  *    e.g. so_state change during a socktpi_poll call the pollwakeup
6310  *    (which strsock_* and strrput conspire to issue) is issued after
6311  *    the state change. Thus the pollwakeup will block until VOP_POLL has
6312  *    returned and then wake up poll and have it call VOP_POLL again.
6313  *  - The reading of so_state without holding so_lock does not result in
6314  *    stale data that is older than the latest state change that has dropped
6315  *    so_lock. This is ensured by the mutex_exit issuing the appropriate
6316  *    memory barrier to force the data into the coherency domain.
6317  */
6318 static int
6319 sotpi_poll(
6320 	struct sonode	*so,
6321 	short		events,
6322 	int		anyyet,
6323 	short		*reventsp,
6324 	struct pollhead **phpp)
6325 {
6326 	short origevents = events;
6327 	struct vnode *vp = SOTOV(so);
6328 	int error;
6329 	int so_state = so->so_state;	/* snapshot */
6330 	sotpi_info_t *sti = SOTOTPI(so);
6331 
6332 	dprintso(so, 0, ("socktpi_poll(%p): state %s err %d\n",
6333 	    (void *)vp, pr_state(so_state, so->so_mode), so->so_error));
6334 
6335 	ASSERT(vp->v_type == VSOCK);
6336 	ASSERT(vp->v_stream != NULL);
6337 
6338 	if (so->so_version == SOV_STREAM) {
6339 		/* The imaginary "sockmod" has been popped - act as a stream */
6340 		return (strpoll(vp->v_stream, events, anyyet,
6341 		    reventsp, phpp));
6342 	}
6343 
6344 	if (!(so_state & SS_ISCONNECTED) &&
6345 	    (so->so_mode & SM_CONNREQUIRED)) {
6346 		/* Not connected yet - turn off write side events */
6347 		events &= ~(POLLOUT|POLLWRBAND);
6348 	}
6349 	/*
6350 	 * Check for errors without calling strpoll if the caller wants them.
6351 	 * In sockets the errors are represented as input/output events
6352 	 * and there is no need to ask the stream head for this information.
6353 	 */
6354 	if (so->so_error != 0 &&
6355 	    ((POLLIN|POLLRDNORM|POLLOUT) & origevents)  != 0) {
6356 		*reventsp = (POLLIN|POLLRDNORM|POLLOUT) & origevents;
6357 		return (0);
6358 	}
6359 	/*
6360 	 * Ignore M_PROTO only messages such as the T_EXDATA_IND messages.
6361 	 * These message with only an M_PROTO/M_PCPROTO part and no M_DATA
6362 	 * will not trigger a POLLIN event with POLLRDDATA set.
6363 	 * The handling of urgent data (causing POLLRDBAND) is done by
6364 	 * inspecting SS_OOBPEND below.
6365 	 */
6366 	events |= POLLRDDATA;
6367 
6368 	/*
6369 	 * After shutdown(output) a stream head write error is set.
6370 	 * However, we should not return output events.
6371 	 */
6372 	events |= POLLNOERR;
6373 	error = strpoll(vp->v_stream, events, anyyet,
6374 	    reventsp, phpp);
6375 	if (error)
6376 		return (error);
6377 
6378 	ASSERT(!(*reventsp & POLLERR));
6379 
6380 	/*
6381 	 * Notes on T_CONN_IND handling for sockets.
6382 	 *
6383 	 * If strpoll() returned without events, SR_POLLIN is guaranteed
6384 	 * to be set, ensuring any subsequent strrput() runs pollwakeup().
6385 	 *
6386 	 * Since the so_lock is not held, soqueueconnind() may have run
6387 	 * and a T_CONN_IND may be waiting. We now check for any queued
6388 	 * T_CONN_IND msgs on sti_conn_ind_head and set appropriate events
6389 	 * to ensure poll returns.
6390 	 *
6391 	 * However:
6392 	 * If the T_CONN_IND hasn't arrived by the time strpoll() returns,
6393 	 * when strrput() does run for an arriving M_PROTO with T_CONN_IND
6394 	 * the following actions will occur; taken together they ensure the
6395 	 * syscall will return.
6396 	 *
6397 	 * 1. If a socket, soqueueconnind() will queue the T_CONN_IND but if
6398 	 *    the accept() was run on a non-blocking socket sowaitconnind()
6399 	 *    may have already returned EWOULDBLOCK, so not be waiting to
6400 	 *    process the message. Additionally socktpi_poll() has probably
6401 	 *    proceeded past the sti_conn_ind_head check below.
6402 	 * 2. strrput() runs pollwakeup()->pollnotify()->cv_signal() to wake
6403 	 *    this thread,  however that could occur before poll_common()
6404 	 *    has entered cv_wait.
6405 	 * 3. pollnotify() sets T_POLLWAKE, while holding the pc_lock.
6406 	 *
6407 	 * Before proceeding to cv_wait() in poll_common() for an event,
6408 	 * poll_common() atomically checks for T_POLLWAKE under the pc_lock,
6409 	 * and if set, re-calls strpoll() to ensure the late arriving
6410 	 * T_CONN_IND is recognized, and pollsys() returns.
6411 	 */
6412 
6413 	if (sti->sti_conn_ind_head != NULL)
6414 		*reventsp |= (POLLIN|POLLRDNORM) & events;
6415 
6416 	if (so->so_state & SS_CANTRCVMORE) {
6417 		*reventsp |= POLLRDHUP & events;
6418 
6419 		if (so->so_state & SS_CANTSENDMORE)
6420 			*reventsp |= POLLHUP;
6421 	}
6422 
6423 	if (so->so_state & SS_OOBPEND)
6424 		*reventsp |= POLLRDBAND & events;
6425 
6426 	if (sti->sti_nl7c_rcv_mp != NULL) {
6427 		*reventsp |= (POLLIN|POLLRDNORM) & events;
6428 	}
6429 	if ((sti->sti_nl7c_flags & NL7C_ENABLED) &&
6430 	    ((POLLIN|POLLRDNORM) & *reventsp)) {
6431 		sti->sti_nl7c_flags |= NL7C_POLLIN;
6432 	}
6433 
6434 	return (0);
6435 }
6436 
6437 /*ARGSUSED*/
6438 static int
6439 socktpi_constructor(void *buf, void *cdrarg, int kmflags)
6440 {
6441 	sotpi_sonode_t *st = (sotpi_sonode_t *)buf;
6442 	int error = 0;
6443 
6444 	error = sonode_constructor(buf, cdrarg, kmflags);
6445 	if (error != 0)
6446 		return (error);
6447 
6448 	error = i_sotpi_info_constructor(&st->st_info);
6449 	if (error != 0)
6450 		sonode_destructor(buf, cdrarg);
6451 
6452 	st->st_sonode.so_priv = &st->st_info;
6453 
6454 	return (error);
6455 }
6456 
6457 /*ARGSUSED1*/
6458 static void
6459 socktpi_destructor(void *buf, void *cdrarg)
6460 {
6461 	sotpi_sonode_t *st = (sotpi_sonode_t *)buf;
6462 
6463 	ASSERT(st->st_sonode.so_priv == &st->st_info);
6464 	st->st_sonode.so_priv = NULL;
6465 
6466 	i_sotpi_info_destructor(&st->st_info);
6467 	sonode_destructor(buf, cdrarg);
6468 }
6469 
6470 static int
6471 socktpi_unix_constructor(void *buf, void *cdrarg, int kmflags)
6472 {
6473 	int retval;
6474 
6475 	if ((retval = socktpi_constructor(buf, cdrarg, kmflags)) == 0) {
6476 		struct sonode *so = (struct sonode *)buf;
6477 		sotpi_info_t *sti = SOTOTPI(so);
6478 
6479 		mutex_enter(&socklist.sl_lock);
6480 
6481 		sti->sti_next_so = socklist.sl_list;
6482 		sti->sti_prev_so = NULL;
6483 		if (sti->sti_next_so != NULL)
6484 			SOTOTPI(sti->sti_next_so)->sti_prev_so = so;
6485 		socklist.sl_list = so;
6486 
6487 		mutex_exit(&socklist.sl_lock);
6488 
6489 	}
6490 	return (retval);
6491 }
6492 
6493 static void
6494 socktpi_unix_destructor(void *buf, void *cdrarg)
6495 {
6496 	struct sonode	*so = (struct sonode *)buf;
6497 	sotpi_info_t	*sti = SOTOTPI(so);
6498 
6499 	mutex_enter(&socklist.sl_lock);
6500 
6501 	if (sti->sti_next_so != NULL)
6502 		SOTOTPI(sti->sti_next_so)->sti_prev_so = sti->sti_prev_so;
6503 	if (sti->sti_prev_so != NULL)
6504 		SOTOTPI(sti->sti_prev_so)->sti_next_so = sti->sti_next_so;
6505 	else
6506 		socklist.sl_list = sti->sti_next_so;
6507 
6508 	mutex_exit(&socklist.sl_lock);
6509 
6510 	socktpi_destructor(buf, cdrarg);
6511 }
6512 
6513 int
6514 socktpi_init(void)
6515 {
6516 	/*
6517 	 * Create sonode caches.  We create a special one for AF_UNIX so
6518 	 * that we can track them for netstat(1m).
6519 	 */
6520 	socktpi_cache = kmem_cache_create("socktpi_cache",
6521 	    sizeof (struct sotpi_sonode), 0, socktpi_constructor,
6522 	    socktpi_destructor, NULL, NULL, NULL, 0);
6523 
6524 	socktpi_unix_cache = kmem_cache_create("socktpi_unix_cache",
6525 	    sizeof (struct sotpi_sonode), 0, socktpi_unix_constructor,
6526 	    socktpi_unix_destructor, NULL, NULL, NULL, 0);
6527 
6528 	return (0);
6529 }
6530 
6531 /*
6532  * Given a non-TPI sonode, allocate and prep it to be ready for TPI.
6533  *
6534  * Caller must still update state and mode using sotpi_update_state().
6535  */
6536 int
6537 sotpi_convert_sonode(struct sonode *so, struct sockparams *newsp,
6538     boolean_t *direct, queue_t **qp, struct cred *cr)
6539 {
6540 	sotpi_info_t *sti;
6541 	struct sockparams *origsp = so->so_sockparams;
6542 	sock_lower_handle_t handle = so->so_proto_handle;
6543 	struct stdata *stp;
6544 	struct vnode *vp;
6545 	queue_t *q;
6546 	int error = 0;
6547 
6548 	ASSERT((so->so_state & (SS_FALLBACK_PENDING|SS_FALLBACK_COMP)) ==
6549 	    SS_FALLBACK_PENDING);
6550 	ASSERT(SOCK_IS_NONSTR(so));
6551 
6552 	*qp = NULL;
6553 	*direct = B_FALSE;
6554 	so->so_sockparams = newsp;
6555 	/*
6556 	 * Allocate and initalize fields required by TPI.
6557 	 */
6558 	(void) sotpi_info_create(so, KM_SLEEP);
6559 	sotpi_info_init(so);
6560 
6561 	if ((error = sotpi_init(so, NULL, cr, SO_FALLBACK)) != 0) {
6562 		sotpi_info_fini(so);
6563 		sotpi_info_destroy(so);
6564 		return (error);
6565 	}
6566 	ASSERT(handle == so->so_proto_handle);
6567 	sti = SOTOTPI(so);
6568 	if (sti->sti_direct != 0)
6569 		*direct = B_TRUE;
6570 
6571 	/*
6572 	 * Keep the original sp around so we can properly dispose of the
6573 	 * sonode when the socket is being closed.
6574 	 */
6575 	sti->sti_orig_sp = origsp;
6576 
6577 	so_basic_strinit(so);	/* skips the T_CAPABILITY_REQ */
6578 	so_alloc_addr(so, so->so_max_addr_len);
6579 
6580 	/*
6581 	 * If the application has done a SIOCSPGRP, make sure the
6582 	 * STREAM head is aware. This needs to take place before
6583 	 * the protocol start sending up messages. Otherwise we
6584 	 * might miss to generate SIGPOLL.
6585 	 *
6586 	 * It is possible that the application will receive duplicate
6587 	 * signals if some were already generated for either data or
6588 	 * connection indications.
6589 	 */
6590 	if (so->so_pgrp != 0) {
6591 		if (so_set_events(so, so->so_vnode, cr) != 0)
6592 			so->so_pgrp = 0;
6593 	}
6594 
6595 	/*
6596 	 * Determine which queue to use.
6597 	 */
6598 	vp = SOTOV(so);
6599 	stp = vp->v_stream;
6600 	ASSERT(stp != NULL);
6601 	q = stp->sd_wrq->q_next;
6602 
6603 	/*
6604 	 * Skip any modules that may have been auto pushed when the device
6605 	 * was opened
6606 	 */
6607 	while (q->q_next != NULL)
6608 		q = q->q_next;
6609 	*qp = _RD(q);
6610 
6611 	/* This is now a STREAMS sockets */
6612 	so->so_not_str = B_FALSE;
6613 
6614 	return (error);
6615 }
6616 
6617 /*
6618  * Revert a TPI sonode. It is only allowed to revert the sonode during
6619  * the fallback process.
6620  */
6621 void
6622 sotpi_revert_sonode(struct sonode *so, struct cred *cr)
6623 {
6624 	vnode_t *vp = SOTOV(so);
6625 
6626 	ASSERT((so->so_state & (SS_FALLBACK_PENDING|SS_FALLBACK_COMP)) ==
6627 	    SS_FALLBACK_PENDING);
6628 	ASSERT(!SOCK_IS_NONSTR(so));
6629 	ASSERT(vp->v_stream != NULL);
6630 
6631 	strclean(vp);
6632 	(void) strclose(vp, FREAD|FWRITE|SO_FALLBACK, cr);
6633 
6634 	/*
6635 	 * Restore the original sockparams. The caller is responsible for
6636 	 * dropping the ref to the new sp.
6637 	 */
6638 	so->so_sockparams = SOTOTPI(so)->sti_orig_sp;
6639 
6640 	sotpi_info_fini(so);
6641 	sotpi_info_destroy(so);
6642 
6643 	/* This is no longer a STREAMS sockets */
6644 	so->so_not_str = B_TRUE;
6645 }
6646 
6647 void
6648 sotpi_update_state(struct sonode *so, struct T_capability_ack *tcap,
6649     struct sockaddr *laddr, socklen_t laddrlen, struct sockaddr *faddr,
6650     socklen_t faddrlen, short opts)
6651 {
6652 	sotpi_info_t *sti = SOTOTPI(so);
6653 
6654 	so_proc_tcapability_ack(so, tcap);
6655 
6656 	so->so_options |= opts;
6657 
6658 	/*
6659 	 * Determine whether the foreign and local address are valid
6660 	 */
6661 	if (laddrlen != 0) {
6662 		ASSERT(laddrlen <= sti->sti_laddr_maxlen);
6663 		sti->sti_laddr_len = laddrlen;
6664 		bcopy(laddr, sti->sti_laddr_sa, laddrlen);
6665 		sti->sti_laddr_valid = (so->so_state & SS_ISBOUND);
6666 	}
6667 
6668 	if (faddrlen != 0) {
6669 		ASSERT(faddrlen <= sti->sti_faddr_maxlen);
6670 		sti->sti_faddr_len = faddrlen;
6671 		bcopy(faddr, sti->sti_faddr_sa, faddrlen);
6672 		sti->sti_faddr_valid = (so->so_state & SS_ISCONNECTED);
6673 	}
6674 
6675 }
6676 
6677 /*
6678  * Allocate enough space to cache the local and foreign addresses.
6679  */
6680 void
6681 so_alloc_addr(struct sonode *so, t_uscalar_t maxlen)
6682 {
6683 	sotpi_info_t *sti = SOTOTPI(so);
6684 
6685 	ASSERT(sti->sti_laddr_sa == NULL && sti->sti_faddr_sa == NULL);
6686 	ASSERT(sti->sti_laddr_len == 0 && sti->sti_faddr_len == 0);
6687 	sti->sti_laddr_maxlen = sti->sti_faddr_maxlen =
6688 	    P2ROUNDUP(maxlen, KMEM_ALIGN);
6689 	so->so_max_addr_len = sti->sti_laddr_maxlen;
6690 	sti->sti_laddr_sa = kmem_alloc(sti->sti_laddr_maxlen * 2, KM_SLEEP);
6691 	sti->sti_faddr_sa = (struct sockaddr *)((caddr_t)sti->sti_laddr_sa
6692 	    + sti->sti_laddr_maxlen);
6693 
6694 	if (so->so_family == AF_UNIX) {
6695 		/*
6696 		 * Initialize AF_UNIX related fields.
6697 		 */
6698 		bzero(&sti->sti_ux_laddr, sizeof (sti->sti_ux_laddr));
6699 		bzero(&sti->sti_ux_faddr, sizeof (sti->sti_ux_faddr));
6700 	}
6701 }
6702 
6703 
6704 sotpi_info_t *
6705 sotpi_sototpi(struct sonode *so)
6706 {
6707 	sotpi_info_t *sti;
6708 
6709 	ASSERT(so != NULL);
6710 
6711 	sti = (sotpi_info_t *)so->so_priv;
6712 
6713 	ASSERT(sti != NULL);
6714 	ASSERT(sti->sti_magic == SOTPI_INFO_MAGIC);
6715 
6716 	return (sti);
6717 }
6718 
6719 static int
6720 i_sotpi_info_constructor(sotpi_info_t *sti)
6721 {
6722 	sti->sti_magic		= SOTPI_INFO_MAGIC;
6723 	sti->sti_ack_mp		= NULL;
6724 	sti->sti_discon_ind_mp	= NULL;
6725 	sti->sti_ux_bound_vp	= NULL;
6726 	sti->sti_unbind_mp	= NULL;
6727 
6728 	sti->sti_conn_ind_head	= NULL;
6729 	sti->sti_conn_ind_tail	= NULL;
6730 
6731 	sti->sti_laddr_sa	= NULL;
6732 	sti->sti_faddr_sa	= NULL;
6733 
6734 	sti->sti_nl7c_flags	= 0;
6735 	sti->sti_nl7c_uri	= NULL;
6736 	sti->sti_nl7c_rcv_mp	= NULL;
6737 
6738 	mutex_init(&sti->sti_plumb_lock, NULL, MUTEX_DEFAULT, NULL);
6739 	cv_init(&sti->sti_ack_cv, NULL, CV_DEFAULT, NULL);
6740 
6741 	return (0);
6742 }
6743 
6744 static void
6745 i_sotpi_info_destructor(sotpi_info_t *sti)
6746 {
6747 	ASSERT(sti->sti_magic == SOTPI_INFO_MAGIC);
6748 	ASSERT(sti->sti_ack_mp == NULL);
6749 	ASSERT(sti->sti_discon_ind_mp == NULL);
6750 	ASSERT(sti->sti_ux_bound_vp == NULL);
6751 	ASSERT(sti->sti_unbind_mp == NULL);
6752 
6753 	ASSERT(sti->sti_conn_ind_head == NULL);
6754 	ASSERT(sti->sti_conn_ind_tail == NULL);
6755 
6756 	ASSERT(sti->sti_laddr_sa == NULL);
6757 	ASSERT(sti->sti_faddr_sa == NULL);
6758 
6759 	ASSERT(sti->sti_nl7c_flags == 0);
6760 	ASSERT(sti->sti_nl7c_uri == NULL);
6761 	ASSERT(sti->sti_nl7c_rcv_mp == NULL);
6762 
6763 	mutex_destroy(&sti->sti_plumb_lock);
6764 	cv_destroy(&sti->sti_ack_cv);
6765 }
6766 
6767 /*
6768  * Creates and attaches TPI information to the given sonode
6769  */
6770 static boolean_t
6771 sotpi_info_create(struct sonode *so, int kmflags)
6772 {
6773 	sotpi_info_t *sti;
6774 
6775 	ASSERT(so->so_priv == NULL);
6776 
6777 	if ((sti = kmem_zalloc(sizeof (*sti), kmflags)) == NULL)
6778 		return (B_FALSE);
6779 
6780 	if (i_sotpi_info_constructor(sti) != 0) {
6781 		kmem_free(sti, sizeof (*sti));
6782 		return (B_FALSE);
6783 	}
6784 
6785 	so->so_priv = (void *)sti;
6786 	return (B_TRUE);
6787 }
6788 
6789 /*
6790  * Initializes the TPI information.
6791  */
6792 static void
6793 sotpi_info_init(struct sonode *so)
6794 {
6795 	struct vnode *vp = SOTOV(so);
6796 	sotpi_info_t *sti = SOTOTPI(so);
6797 	time_t now;
6798 
6799 	sti->sti_dev 	= so->so_sockparams->sp_sdev_info.sd_vnode->v_rdev;
6800 	vp->v_rdev	= sti->sti_dev;
6801 
6802 	sti->sti_orig_sp = NULL;
6803 
6804 	sti->sti_pushcnt = 0;
6805 
6806 	now = gethrestime_sec();
6807 	sti->sti_atime	= now;
6808 	sti->sti_mtime	= now;
6809 	sti->sti_ctime	= now;
6810 
6811 	sti->sti_eaddr_mp = NULL;
6812 	sti->sti_delayed_error = 0;
6813 
6814 	sti->sti_provinfo = NULL;
6815 
6816 	sti->sti_oobcnt = 0;
6817 	sti->sti_oobsigcnt = 0;
6818 
6819 	ASSERT(sti->sti_laddr_sa == NULL && sti->sti_faddr_sa == NULL);
6820 
6821 	sti->sti_laddr_sa	= 0;
6822 	sti->sti_faddr_sa	= 0;
6823 	sti->sti_laddr_maxlen = sti->sti_faddr_maxlen = 0;
6824 	sti->sti_laddr_len = sti->sti_faddr_len = 0;
6825 
6826 	sti->sti_laddr_valid = 0;
6827 	sti->sti_faddr_valid = 0;
6828 	sti->sti_faddr_noxlate = 0;
6829 
6830 	sti->sti_direct = 0;
6831 
6832 	ASSERT(sti->sti_ack_mp == NULL);
6833 	ASSERT(sti->sti_ux_bound_vp == NULL);
6834 	ASSERT(sti->sti_unbind_mp == NULL);
6835 
6836 	ASSERT(sti->sti_conn_ind_head == NULL);
6837 	ASSERT(sti->sti_conn_ind_tail == NULL);
6838 }
6839 
6840 /*
6841  * Given a sonode, grab the TPI info and free any data.
6842  */
6843 static void
6844 sotpi_info_fini(struct sonode *so)
6845 {
6846 	sotpi_info_t *sti = SOTOTPI(so);
6847 	mblk_t *mp;
6848 
6849 	ASSERT(sti->sti_discon_ind_mp == NULL);
6850 
6851 	if ((mp = sti->sti_conn_ind_head) != NULL) {
6852 		mblk_t *mp1;
6853 
6854 		while (mp) {
6855 			mp1 = mp->b_next;
6856 			mp->b_next = NULL;
6857 			freemsg(mp);
6858 			mp = mp1;
6859 		}
6860 		sti->sti_conn_ind_head = sti->sti_conn_ind_tail = NULL;
6861 	}
6862 
6863 	/*
6864 	 * Protect so->so_[lf]addr_sa so that sockfs_snapshot() can safely
6865 	 * indirect them.  It also uses so_count as a validity test.
6866 	 */
6867 	mutex_enter(&so->so_lock);
6868 
6869 	if (sti->sti_laddr_sa) {
6870 		ASSERT((caddr_t)sti->sti_faddr_sa ==
6871 		    (caddr_t)sti->sti_laddr_sa + sti->sti_laddr_maxlen);
6872 		ASSERT(sti->sti_faddr_maxlen == sti->sti_laddr_maxlen);
6873 		sti->sti_laddr_valid = 0;
6874 		sti->sti_faddr_valid = 0;
6875 		kmem_free(sti->sti_laddr_sa, sti->sti_laddr_maxlen * 2);
6876 		sti->sti_laddr_sa = NULL;
6877 		sti->sti_laddr_len = sti->sti_laddr_maxlen = 0;
6878 		sti->sti_faddr_sa = NULL;
6879 		sti->sti_faddr_len = sti->sti_faddr_maxlen = 0;
6880 	}
6881 
6882 	mutex_exit(&so->so_lock);
6883 
6884 	if ((mp = sti->sti_eaddr_mp) != NULL) {
6885 		freemsg(mp);
6886 		sti->sti_eaddr_mp = NULL;
6887 		sti->sti_delayed_error = 0;
6888 	}
6889 
6890 	if ((mp = sti->sti_ack_mp) != NULL) {
6891 		freemsg(mp);
6892 		sti->sti_ack_mp = NULL;
6893 	}
6894 
6895 	if ((mp = sti->sti_nl7c_rcv_mp) != NULL) {
6896 		sti->sti_nl7c_rcv_mp = NULL;
6897 		freemsg(mp);
6898 	}
6899 	sti->sti_nl7c_rcv_rval = 0;
6900 	if (sti->sti_nl7c_uri != NULL) {
6901 		nl7c_urifree(so);
6902 		/* urifree() cleared nl7c_uri */
6903 	}
6904 	if (sti->sti_nl7c_flags) {
6905 		sti->sti_nl7c_flags = 0;
6906 	}
6907 
6908 	ASSERT(sti->sti_ux_bound_vp == NULL);
6909 	if ((mp = sti->sti_unbind_mp) != NULL) {
6910 		freemsg(mp);
6911 		sti->sti_unbind_mp = NULL;
6912 	}
6913 }
6914 
6915 /*
6916  * Destroys the TPI information attached to a sonode.
6917  */
6918 static void
6919 sotpi_info_destroy(struct sonode *so)
6920 {
6921 	sotpi_info_t *sti = SOTOTPI(so);
6922 
6923 	i_sotpi_info_destructor(sti);
6924 	kmem_free(sti, sizeof (*sti));
6925 
6926 	so->so_priv = NULL;
6927 }
6928 
6929 /*
6930  * Create the global sotpi socket module entry. It will never be freed.
6931  */
6932 smod_info_t *
6933 sotpi_smod_create(void)
6934 {
6935 	smod_info_t *smodp;
6936 
6937 	smodp = kmem_zalloc(sizeof (*smodp), KM_SLEEP);
6938 	smodp->smod_name = kmem_alloc(sizeof (SOTPI_SMOD_NAME), KM_SLEEP);
6939 	(void) strcpy(smodp->smod_name, SOTPI_SMOD_NAME);
6940 	/*
6941 	 * Initialize the smod_refcnt to 1 so it will never be freed.
6942 	 */
6943 	smodp->smod_refcnt = 1;
6944 	smodp->smod_uc_version = SOCK_UC_VERSION;
6945 	smodp->smod_dc_version = SOCK_DC_VERSION;
6946 	smodp->smod_sock_create_func = &sotpi_create;
6947 	smodp->smod_sock_destroy_func = &sotpi_destroy;
6948 	return (smodp);
6949 }
6950