xref: /titanic_41/usr/src/uts/common/fs/sockfs/socksubr.c (revision 7b209c2cc5ea45251aba06dcc6181d3f23da807a)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
24  * Use is subject to license terms.
25  */
26 
27 #pragma ident	"%Z%%M%	%I%	%E% SMI"
28 
29 #include <sys/types.h>
30 #include <sys/t_lock.h>
31 #include <sys/param.h>
32 #include <sys/systm.h>
33 #include <sys/buf.h>
34 #include <sys/conf.h>
35 #include <sys/cred.h>
36 #include <sys/kmem.h>
37 #include <sys/sysmacros.h>
38 #include <sys/vfs.h>
39 #include <sys/vfs_opreg.h>
40 #include <sys/vnode.h>
41 #include <sys/debug.h>
42 #include <sys/errno.h>
43 #include <sys/time.h>
44 #include <sys/file.h>
45 #include <sys/open.h>
46 #include <sys/user.h>
47 #include <sys/termios.h>
48 #include <sys/stream.h>
49 #include <sys/strsubr.h>
50 #include <sys/strsun.h>
51 #include <sys/esunddi.h>
52 #include <sys/flock.h>
53 #include <sys/modctl.h>
54 #include <sys/cmn_err.h>
55 #include <sys/mkdev.h>
56 #include <sys/pathname.h>
57 #include <sys/ddi.h>
58 #include <sys/stat.h>
59 #include <sys/fs/snode.h>
60 #include <sys/fs/dv_node.h>
61 #include <sys/zone.h>
62 
63 #include <sys/socket.h>
64 #include <sys/socketvar.h>
65 #include <netinet/in.h>
66 #include <sys/un.h>
67 
68 #include <sys/ucred.h>
69 
70 #include <sys/tiuser.h>
71 #define	_SUN_TPI_VERSION	2
72 #include <sys/tihdr.h>
73 
74 #include <c2/audit.h>
75 
76 #include <fs/sockfs/nl7c.h>
77 
78 /*
79  * Macros that operate on struct cmsghdr.
80  * The CMSG_VALID macro does not assume that the last option buffer is padded.
81  */
82 #define	CMSG_CONTENT(cmsg)	(&((cmsg)[1]))
83 #define	CMSG_CONTENTLEN(cmsg)	((cmsg)->cmsg_len - sizeof (struct cmsghdr))
84 #define	CMSG_VALID(cmsg, start, end)					\
85 	(ISALIGNED_cmsghdr(cmsg) &&					\
86 	((uintptr_t)(cmsg) >= (uintptr_t)(start)) &&			\
87 	((uintptr_t)(cmsg) < (uintptr_t)(end)) &&			\
88 	((ssize_t)(cmsg)->cmsg_len >= sizeof (struct cmsghdr)) &&	\
89 	((uintptr_t)(cmsg) + (cmsg)->cmsg_len <= (uintptr_t)(end)))
90 #define	SO_LOCK_WAKEUP_TIME	3000	/* Wakeup time in milliseconds */
91 
92 static struct kmem_cache *socktpi_cache, *socktpi_unix_cache;
93 
94 dev_t sockdev;	/* For fsid in getattr */
95 
96 struct sockparams *sphead;
97 krwlock_t splist_lock;
98 
99 struct socklist socklist;
100 
101 static int sockfs_update(kstat_t *, int);
102 static int sockfs_snapshot(kstat_t *, void *, int);
103 
104 extern void sendfile_init();
105 
106 extern void nl7c_init(void);
107 
108 #define	ADRSTRLEN (2 * sizeof (void *) + 1)
109 /*
110  * kernel structure for passing the sockinfo data back up to the user.
111  * the strings array allows us to convert AF_UNIX addresses into strings
112  * with a common method regardless of which n-bit kernel we're running.
113  */
114 struct k_sockinfo {
115 	struct sockinfo	ks_si;
116 	char		ks_straddr[3][ADRSTRLEN];
117 };
118 
119 /*
120  * Translate from a device pathname (e.g. "/dev/tcp") to a vnode.
121  * Returns with the vnode held.
122  */
123 static int
124 sogetvp(char *devpath, vnode_t **vpp, int uioflag)
125 {
126 	struct snode *csp;
127 	vnode_t *vp, *dvp;
128 	major_t maj;
129 	int error;
130 
131 	ASSERT(uioflag == UIO_SYSSPACE || uioflag == UIO_USERSPACE);
132 	/*
133 	 * Lookup the underlying filesystem vnode.
134 	 */
135 	error = lookupname(devpath, uioflag, FOLLOW, NULLVPP, &vp);
136 	if (error)
137 		return (error);
138 
139 	/* Check that it is the correct vnode */
140 	if (vp->v_type != VCHR) {
141 		VN_RELE(vp);
142 		return (ENOTSOCK);
143 	}
144 
145 	/*
146 	 * If devpath went through devfs, the device should already
147 	 * be configured. If devpath is a mknod file, however, we
148 	 * need to make sure the device is properly configured.
149 	 * To do this, we do something similar to spec_open()
150 	 * except that we resolve to the minor/leaf level since
151 	 * we need to return a vnode.
152 	 */
153 	csp = VTOS(VTOS(vp)->s_commonvp);
154 	if (!(csp->s_flag & SDIPSET)) {
155 		char *pathname = kmem_alloc(MAXPATHLEN, KM_SLEEP);
156 		error = ddi_dev_pathname(vp->v_rdev, S_IFCHR, pathname);
157 		if (error == 0)
158 			error = devfs_lookupname(pathname, NULLVPP, &dvp);
159 		VN_RELE(vp);
160 		kmem_free(pathname, MAXPATHLEN);
161 		if (error != 0)
162 			return (ENXIO);
163 		vp = dvp;	/* use the devfs vp */
164 	}
165 
166 	/* device is configured at this point */
167 	maj = getmajor(vp->v_rdev);
168 	if (!STREAMSTAB(maj)) {
169 		VN_RELE(vp);
170 		return (ENOSTR);
171 	}
172 
173 	*vpp = vp;
174 	return (0);
175 }
176 
177 /*
178  * Add or delete (latter if devpath is NULL) an enter to the sockparams
179  * table. If devpathlen is zero the devpath with not be kmem_freed. Otherwise
180  * this routine assumes that the caller has kmem_alloced devpath/devpathlen
181  * for this routine to consume.
182  * The zero devpathlen could be used if the kernel wants to create entries
183  * itself by calling sockconfig(1,2,3, "/dev/tcp", 0);
184  */
185 int
186 soconfig(int domain, int type, int protocol,
187     char *devpath, int devpathlen)
188 {
189 	struct sockparams **spp;
190 	struct sockparams *sp;
191 	int error = 0;
192 
193 	dprint(0, ("soconfig(%d,%d,%d,%s,%d)\n",
194 	    domain, type, protocol, devpath, devpathlen));
195 
196 	/*
197 	 * Look for an existing match.
198 	 */
199 	rw_enter(&splist_lock, RW_WRITER);
200 	for (spp = &sphead; (sp = *spp) != NULL; spp = &sp->sp_next) {
201 		if (sp->sp_domain == domain &&
202 		    sp->sp_type == type &&
203 		    sp->sp_protocol == protocol) {
204 			break;
205 		}
206 	}
207 	if (devpath == NULL) {
208 		ASSERT(devpathlen == 0);
209 
210 		/* Delete existing entry */
211 		if (sp == NULL) {
212 			error = ENXIO;
213 			goto done;
214 		}
215 		/* Unlink and free existing entry */
216 		*spp = sp->sp_next;
217 		ASSERT(sp->sp_vnode);
218 		VN_RELE(sp->sp_vnode);
219 		if (sp->sp_devpathlen != 0)
220 			kmem_free(sp->sp_devpath, sp->sp_devpathlen);
221 		kmem_free(sp, sizeof (*sp));
222 	} else {
223 		vnode_t *vp;
224 
225 		/* Add new entry */
226 		if (sp != NULL) {
227 			error = EEXIST;
228 			goto done;
229 		}
230 
231 		error = sogetvp(devpath, &vp, UIO_SYSSPACE);
232 		if (error) {
233 			dprint(0, ("soconfig: vp %s failed with %d\n",
234 			    devpath, error));
235 			goto done;
236 		}
237 
238 		dprint(0, ("soconfig: %s => vp %p, dev 0x%lx\n",
239 		    devpath, vp, vp->v_rdev));
240 
241 		sp = kmem_alloc(sizeof (*sp), KM_SLEEP);
242 		sp->sp_domain = domain;
243 		sp->sp_type = type;
244 		sp->sp_protocol = protocol;
245 		sp->sp_devpath = devpath;
246 		sp->sp_devpathlen = devpathlen;
247 		sp->sp_vnode = vp;
248 		sp->sp_next = NULL;
249 		*spp = sp;
250 	}
251 done:
252 	rw_exit(&splist_lock);
253 	if (error) {
254 		if (devpath != NULL)
255 			kmem_free(devpath, devpathlen);
256 #ifdef SOCK_DEBUG
257 		eprintline(error);
258 #endif /* SOCK_DEBUG */
259 	}
260 	return (error);
261 }
262 
263 /*
264  * Lookup an entry in the sockparams list based on the triple.
265  * If no entry is found and devpath is not NULL translate devpath to a
266  * vnode. Note that devpath is a pointer to a user address!
267  * Returns with the vnode held.
268  *
269  * When this routine uses devpath it does not create an entry in the sockparams
270  * list since this routine can run on behalf of any user and one user
271  * should not be able to effect the transport used by another user.
272  *
273  * In order to return the correct error this routine has to do wildcard scans
274  * of the list. The errors are (in decreasing precedence):
275  *	EAFNOSUPPORT - address family not in list
276  *	EPROTONOSUPPORT - address family supported but not protocol.
277  *	EPROTOTYPE - address family and protocol supported but not socket type.
278  */
279 vnode_t *
280 solookup(int domain, int type, int protocol, char *devpath, int *errorp)
281 {
282 	struct sockparams *sp;
283 	int error;
284 	vnode_t *vp;
285 
286 	rw_enter(&splist_lock, RW_READER);
287 	for (sp = sphead; sp != NULL; sp = sp->sp_next) {
288 		if (sp->sp_domain == domain &&
289 		    sp->sp_type == type &&
290 		    sp->sp_protocol == protocol) {
291 			break;
292 		}
293 	}
294 	if (sp == NULL) {
295 		dprint(0, ("solookup(%d,%d,%d) not found\n",
296 		    domain, type, protocol));
297 		if (devpath == NULL) {
298 			/* Determine correct error code */
299 			int found = 0;
300 
301 			for (sp = sphead; sp != NULL; sp = sp->sp_next) {
302 				if (sp->sp_domain == domain && found < 1)
303 					found = 1;
304 				if (sp->sp_domain == domain &&
305 				    sp->sp_protocol == protocol && found < 2)
306 					found = 2;
307 			}
308 			rw_exit(&splist_lock);
309 			switch (found) {
310 			case 0:
311 				*errorp = EAFNOSUPPORT;
312 				break;
313 			case 1:
314 				*errorp = EPROTONOSUPPORT;
315 				break;
316 			case 2:
317 				*errorp = EPROTOTYPE;
318 				break;
319 			}
320 			return (NULL);
321 		}
322 		rw_exit(&splist_lock);
323 
324 		/*
325 		 * Return vp based on devpath.
326 		 * Do not enter into table to avoid random users
327 		 * modifying the sockparams list.
328 		 */
329 		error = sogetvp(devpath, &vp, UIO_USERSPACE);
330 		if (error) {
331 			dprint(0, ("solookup: vp %p failed with %d\n",
332 			    devpath, error));
333 			*errorp = EPROTONOSUPPORT;
334 			return (NULL);
335 		}
336 		dprint(0, ("solookup: %p => vp %p, dev 0x%lx\n",
337 		    devpath, vp, vp->v_rdev));
338 
339 		return (vp);
340 	}
341 	dprint(0, ("solookup(%d,%d,%d) vp %p devpath %s\n",
342 	    domain, type, protocol, sp->sp_vnode, sp->sp_devpath));
343 
344 	vp = sp->sp_vnode;
345 	VN_HOLD(vp);
346 	rw_exit(&splist_lock);
347 	return (vp);
348 }
349 
350 /*
351  * Return a socket vnode.
352  *
353  * Assumes that the caller is "passing" an VN_HOLD for accessvp i.e.
354  * when the socket is freed a VN_RELE will take place.
355  *
356  * Note that sockets assume that the driver will clone (either itself
357  * or by using the clone driver) i.e. a socket() call will always
358  * result in a new vnode being created.
359  */
360 struct vnode *
361 makesockvp(struct vnode *accessvp, int domain, int type, int protocol)
362 {
363 	kmem_cache_t *cp;
364 	struct sonode *so;
365 	struct vnode *vp;
366 	time_t now;
367 	dev_t dev;
368 
369 	cp = (domain == AF_UNIX) ? socktpi_unix_cache : socktpi_cache;
370 	so = kmem_cache_alloc(cp, KM_SLEEP);
371 	so->so_cache = cp;
372 	so->so_obj = so;
373 	vp = SOTOV(so);
374 	now = gethrestime_sec();
375 
376 	so->so_flag	= 0;
377 	ASSERT(so->so_accessvp == NULL);
378 	so->so_accessvp	= accessvp;
379 	dev = accessvp->v_rdev;
380 
381 	/*
382 	 * Record in so_flag that it is a clone.
383 	 */
384 	if (getmajor(dev) == clone_major) {
385 		so->so_flag |= SOCLONE;
386 	}
387 	so->so_dev = dev;
388 
389 	so->so_state	= 0;
390 	so->so_mode	= 0;
391 
392 	so->so_fsid	= sockdev;
393 	so->so_atime	= now;
394 	so->so_mtime	= now;
395 	so->so_ctime	= now;		/* Never modified */
396 	so->so_count	= 0;
397 
398 	so->so_family	= (short)domain;
399 	so->so_type	= (short)type;
400 	so->so_protocol	= (short)protocol;
401 	so->so_pushcnt	= 0;
402 
403 	so->so_options	= 0;
404 	so->so_linger.l_onoff	= 0;
405 	so->so_linger.l_linger = 0;
406 	so->so_sndbuf	= 0;
407 	so->so_rcvbuf	= 0;
408 	so->so_sndlowat	= 0;
409 	so->so_rcvlowat	= 0;
410 #ifdef notyet
411 	so->so_sndtimeo	= 0;
412 	so->so_rcvtimeo	= 0;
413 #endif /* notyet */
414 	so->so_error	= 0;
415 	so->so_delayed_error = 0;
416 
417 	ASSERT(so->so_oobmsg == NULL);
418 	so->so_oobcnt	= 0;
419 	so->so_oobsigcnt = 0;
420 	so->so_pgrp	= 0;
421 	so->so_provinfo = NULL;
422 
423 	ASSERT(so->so_laddr_sa == NULL && so->so_faddr_sa == NULL);
424 	so->so_laddr_len = so->so_faddr_len = 0;
425 	so->so_laddr_maxlen = so->so_faddr_maxlen = 0;
426 	so->so_eaddr_mp = NULL;
427 	so->so_priv = NULL;
428 
429 	so->so_peercred = NULL;
430 
431 	ASSERT(so->so_ack_mp == NULL);
432 	ASSERT(so->so_conn_ind_head == NULL);
433 	ASSERT(so->so_conn_ind_tail == NULL);
434 	ASSERT(so->so_ux_bound_vp == NULL);
435 	ASSERT(so->so_unbind_mp == NULL);
436 
437 	vn_reinit(vp);
438 	vp->v_vfsp	= rootvfs;
439 	vp->v_type	= VSOCK;
440 	vp->v_rdev	= so->so_dev;
441 	vn_exists(vp);
442 
443 	return (vp);
444 }
445 
446 void
447 sockfree(struct sonode *so)
448 {
449 	mblk_t *mp;
450 	vnode_t *vp;
451 
452 	ASSERT(so->so_count == 0);
453 	ASSERT(so->so_accessvp);
454 	ASSERT(so->so_discon_ind_mp == NULL);
455 
456 	vp = so->so_accessvp;
457 	VN_RELE(vp);
458 
459 	/*
460 	 * Protect so->so_[lf]addr_sa so that sockfs_snapshot() can safely
461 	 * indirect them.  It also uses so_accessvp as a validity test.
462 	 */
463 	mutex_enter(&so->so_lock);
464 
465 	so->so_accessvp = NULL;
466 
467 	if (so->so_laddr_sa) {
468 		ASSERT((caddr_t)so->so_faddr_sa ==
469 		    (caddr_t)so->so_laddr_sa + so->so_laddr_maxlen);
470 		ASSERT(so->so_faddr_maxlen == so->so_laddr_maxlen);
471 		so->so_state &= ~(SS_LADDR_VALID | SS_FADDR_VALID);
472 		kmem_free(so->so_laddr_sa, so->so_laddr_maxlen * 2);
473 		so->so_laddr_sa = NULL;
474 		so->so_laddr_len = so->so_laddr_maxlen = 0;
475 		so->so_faddr_sa = NULL;
476 		so->so_faddr_len = so->so_faddr_maxlen = 0;
477 	}
478 
479 	mutex_exit(&so->so_lock);
480 
481 	if ((mp = so->so_eaddr_mp) != NULL) {
482 		freemsg(mp);
483 		so->so_eaddr_mp = NULL;
484 		so->so_delayed_error = 0;
485 	}
486 	if ((mp = so->so_ack_mp) != NULL) {
487 		freemsg(mp);
488 		so->so_ack_mp = NULL;
489 	}
490 	if ((mp = so->so_conn_ind_head) != NULL) {
491 		mblk_t *mp1;
492 
493 		while (mp) {
494 			mp1 = mp->b_next;
495 			mp->b_next = NULL;
496 			freemsg(mp);
497 			mp = mp1;
498 		}
499 		so->so_conn_ind_head = so->so_conn_ind_tail = NULL;
500 		so->so_state &= ~SS_HASCONNIND;
501 	}
502 #ifdef DEBUG
503 	mutex_enter(&so->so_lock);
504 	ASSERT(so_verify_oobstate(so));
505 	mutex_exit(&so->so_lock);
506 #endif /* DEBUG */
507 	if ((mp = so->so_oobmsg) != NULL) {
508 		freemsg(mp);
509 		so->so_oobmsg = NULL;
510 		so->so_state &= ~(SS_OOBPEND|SS_HAVEOOBDATA|SS_HADOOBDATA);
511 	}
512 
513 	if ((mp = so->so_nl7c_rcv_mp) != NULL) {
514 		so->so_nl7c_rcv_mp = NULL;
515 		freemsg(mp);
516 	}
517 	so->so_nl7c_rcv_rval = 0;
518 	if (so->so_nl7c_uri != NULL) {
519 		nl7c_urifree(so);
520 		/* urifree() cleared nl7c_uri */
521 	}
522 	if (so->so_nl7c_flags) {
523 		so->so_nl7c_flags = 0;
524 	}
525 
526 	ASSERT(so->so_ux_bound_vp == NULL);
527 	if ((mp = so->so_unbind_mp) != NULL) {
528 		freemsg(mp);
529 		so->so_unbind_mp = NULL;
530 	}
531 	vn_invalid(SOTOV(so));
532 
533 	if (so->so_peercred != NULL)
534 		crfree(so->so_peercred);
535 
536 	kmem_cache_free(so->so_cache, so->so_obj);
537 }
538 
539 /*
540  * Update the accessed, updated, or changed times in an sonode
541  * with the current time.
542  *
543  * Note that both SunOS 4.X and 4.4BSD sockets do not present reasonable
544  * attributes in a fstat call. (They return the current time and 0 for
545  * all timestamps, respectively.) We maintain the current timestamps
546  * here primarily so that should sockmod be popped the resulting
547  * file descriptor will behave like a stream w.r.t. the timestamps.
548  */
549 void
550 so_update_attrs(struct sonode *so, int flag)
551 {
552 	time_t now = gethrestime_sec();
553 
554 	mutex_enter(&so->so_lock);
555 	so->so_flag |= flag;
556 	if (flag & SOACC)
557 		so->so_atime = now;
558 	if (flag & SOMOD)
559 		so->so_mtime = now;
560 	mutex_exit(&so->so_lock);
561 }
562 
563 /*ARGSUSED*/
564 static int
565 socktpi_constructor(void *buf, void *cdrarg, int kmflags)
566 {
567 	struct sonode *so = buf;
568 	struct vnode *vp;
569 
570 	so->so_nl7c_flags	= 0;
571 	so->so_nl7c_uri		= NULL;
572 	so->so_nl7c_rcv_mp	= NULL;
573 
574 	so->so_oobmsg		= NULL;
575 	so->so_ack_mp		= NULL;
576 	so->so_conn_ind_head	= NULL;
577 	so->so_conn_ind_tail	= NULL;
578 	so->so_discon_ind_mp	= NULL;
579 	so->so_ux_bound_vp	= NULL;
580 	so->so_unbind_mp	= NULL;
581 	so->so_accessvp		= NULL;
582 	so->so_laddr_sa		= NULL;
583 	so->so_faddr_sa		= NULL;
584 	so->so_ops		= &sotpi_sonodeops;
585 
586 	vp = vn_alloc(KM_SLEEP);
587 	so->so_vnode = vp;
588 
589 	vn_setops(vp, socktpi_vnodeops);
590 	vp->v_data = (caddr_t)so;
591 
592 	mutex_init(&so->so_lock, NULL, MUTEX_DEFAULT, NULL);
593 	mutex_init(&so->so_plumb_lock, NULL, MUTEX_DEFAULT, NULL);
594 	cv_init(&so->so_state_cv, NULL, CV_DEFAULT, NULL);
595 	cv_init(&so->so_ack_cv, NULL, CV_DEFAULT, NULL);
596 	cv_init(&so->so_connind_cv, NULL, CV_DEFAULT, NULL);
597 	cv_init(&so->so_want_cv, NULL, CV_DEFAULT, NULL);
598 
599 	return (0);
600 }
601 
602 /*ARGSUSED1*/
603 static void
604 socktpi_destructor(void *buf, void *cdrarg)
605 {
606 	struct sonode *so = buf;
607 	struct vnode *vp = SOTOV(so);
608 
609 	ASSERT(so->so_nl7c_flags == 0);
610 	ASSERT(so->so_nl7c_uri == NULL);
611 	ASSERT(so->so_nl7c_rcv_mp == NULL);
612 
613 	ASSERT(so->so_oobmsg == NULL);
614 	ASSERT(so->so_ack_mp == NULL);
615 	ASSERT(so->so_conn_ind_head == NULL);
616 	ASSERT(so->so_conn_ind_tail == NULL);
617 	ASSERT(so->so_discon_ind_mp == NULL);
618 	ASSERT(so->so_ux_bound_vp == NULL);
619 	ASSERT(so->so_unbind_mp == NULL);
620 	ASSERT(so->so_ops == &sotpi_sonodeops);
621 
622 	ASSERT(vn_matchops(vp, socktpi_vnodeops));
623 	ASSERT(vp->v_data == (caddr_t)so);
624 
625 	vn_free(vp);
626 
627 	mutex_destroy(&so->so_lock);
628 	mutex_destroy(&so->so_plumb_lock);
629 	cv_destroy(&so->so_state_cv);
630 	cv_destroy(&so->so_ack_cv);
631 	cv_destroy(&so->so_connind_cv);
632 	cv_destroy(&so->so_want_cv);
633 }
634 
635 static int
636 socktpi_unix_constructor(void *buf, void *cdrarg, int kmflags)
637 {
638 	int retval;
639 
640 	if ((retval = socktpi_constructor(buf, cdrarg, kmflags)) == 0) {
641 		struct sonode *so = (struct sonode *)buf;
642 
643 		mutex_enter(&socklist.sl_lock);
644 
645 		so->so_next = socklist.sl_list;
646 		so->so_prev = NULL;
647 		if (so->so_next != NULL)
648 			so->so_next->so_prev = so;
649 		socklist.sl_list = so;
650 
651 		mutex_exit(&socklist.sl_lock);
652 
653 	}
654 	return (retval);
655 }
656 
657 static void
658 socktpi_unix_destructor(void *buf, void *cdrarg)
659 {
660 	struct sonode	*so	= (struct sonode *)buf;
661 
662 	mutex_enter(&socklist.sl_lock);
663 
664 	if (so->so_next != NULL)
665 		so->so_next->so_prev = so->so_prev;
666 	if (so->so_prev != NULL)
667 		so->so_prev->so_next = so->so_next;
668 	else
669 		socklist.sl_list = so->so_next;
670 
671 	mutex_exit(&socklist.sl_lock);
672 
673 	socktpi_destructor(buf, cdrarg);
674 }
675 
676 /*
677  * Init function called when sockfs is loaded.
678  */
679 int
680 sockinit(int fstype, char *name)
681 {
682 	static const fs_operation_def_t sock_vfsops_template[] = {
683 		NULL, NULL
684 	};
685 	int error;
686 	major_t dev;
687 	char *err_str;
688 
689 	error = vfs_setfsops(fstype, sock_vfsops_template, NULL);
690 	if (error != 0) {
691 		zcmn_err(GLOBAL_ZONEID, CE_WARN,
692 		    "sockinit: bad vfs ops template");
693 		return (error);
694 	}
695 
696 	error = vn_make_ops(name, socktpi_vnodeops_template, &socktpi_vnodeops);
697 	if (error != 0) {
698 		err_str = "sockinit: bad sock vnode ops template";
699 		/* vn_make_ops() does not reset socktpi_vnodeops on failure. */
700 		socktpi_vnodeops = NULL;
701 		goto failure;
702 	}
703 
704 	error = sosctp_init();
705 	if (error != 0) {
706 		err_str = NULL;
707 		goto failure;
708 	}
709 
710 	error = sosdp_init();
711 	if (error != 0) {
712 		err_str = NULL;
713 		goto failure;
714 	}
715 
716 	/*
717 	 * Create sonode caches.  We create a special one for AF_UNIX so
718 	 * that we can track them for netstat(1m).
719 	 */
720 	socktpi_cache = kmem_cache_create("socktpi_cache",
721 	    sizeof (struct sonode), 0, socktpi_constructor,
722 	    socktpi_destructor, NULL, NULL, NULL, 0);
723 
724 	socktpi_unix_cache = kmem_cache_create("socktpi_unix_cache",
725 	    sizeof (struct sonode), 0, socktpi_unix_constructor,
726 	    socktpi_unix_destructor, NULL, NULL, NULL, 0);
727 
728 	/*
729 	 * Build initial list mapping socket parameters to vnode.
730 	 */
731 	rw_init(&splist_lock, NULL, RW_DEFAULT, NULL);
732 
733 	/*
734 	 * If sockets are needed before init runs /sbin/soconfig
735 	 * it is possible to preload the sockparams list here using
736 	 * calls like:
737 	 *	sockconfig(1,2,3, "/dev/tcp", 0);
738 	 */
739 
740 	/*
741 	 * Create a unique dev_t for use in so_fsid.
742 	 */
743 
744 	if ((dev = getudev()) == (major_t)-1)
745 		dev = 0;
746 	sockdev = makedevice(dev, 0);
747 
748 	mutex_init(&socklist.sl_lock, NULL, MUTEX_DEFAULT, NULL);
749 	sendfile_init();
750 	nl7c_init();
751 
752 	return (0);
753 
754 failure:
755 	(void) vfs_freevfsops_by_type(fstype);
756 	if (socktpi_vnodeops != NULL)
757 		vn_freevnodeops(socktpi_vnodeops);
758 	if (err_str != NULL)
759 		zcmn_err(GLOBAL_ZONEID, CE_WARN, err_str);
760 	return (error);
761 }
762 
763 /*
764  * Caller must hold the mutex. Used to set SOLOCKED.
765  */
766 void
767 so_lock_single(struct sonode *so)
768 {
769 	ASSERT(MUTEX_HELD(&so->so_lock));
770 
771 	while (so->so_flag & (SOLOCKED | SOASYNC_UNBIND)) {
772 		so->so_flag |= SOWANT;
773 		cv_wait_stop(&so->so_want_cv, &so->so_lock,
774 		    SO_LOCK_WAKEUP_TIME);
775 	}
776 	so->so_flag |= SOLOCKED;
777 }
778 
779 /*
780  * Caller must hold the mutex and pass in SOLOCKED or SOASYNC_UNBIND.
781  * Used to clear SOLOCKED or SOASYNC_UNBIND.
782  */
783 void
784 so_unlock_single(struct sonode *so, int flag)
785 {
786 	ASSERT(MUTEX_HELD(&so->so_lock));
787 	ASSERT(flag & (SOLOCKED|SOASYNC_UNBIND));
788 	ASSERT((flag & ~(SOLOCKED|SOASYNC_UNBIND)) == 0);
789 	ASSERT(so->so_flag & flag);
790 
791 	/*
792 	 * Process the T_DISCON_IND on so_discon_ind_mp.
793 	 *
794 	 * Call to so_drain_discon_ind will result in so_lock
795 	 * being dropped and re-acquired later.
796 	 */
797 	if (so->so_discon_ind_mp != NULL)
798 		so_drain_discon_ind(so);
799 
800 	if (so->so_flag & SOWANT)
801 		cv_broadcast(&so->so_want_cv);
802 	so->so_flag &= ~(SOWANT|flag);
803 }
804 
805 /*
806  * Caller must hold the mutex. Used to set SOREADLOCKED.
807  * If the caller wants nonblocking behavior it should set fmode.
808  */
809 int
810 so_lock_read(struct sonode *so, int fmode)
811 {
812 	ASSERT(MUTEX_HELD(&so->so_lock));
813 
814 	while (so->so_flag & SOREADLOCKED) {
815 		if (fmode & (FNDELAY|FNONBLOCK))
816 			return (EWOULDBLOCK);
817 		so->so_flag |= SOWANT;
818 		cv_wait_stop(&so->so_want_cv, &so->so_lock,
819 		    SO_LOCK_WAKEUP_TIME);
820 	}
821 	so->so_flag |= SOREADLOCKED;
822 	return (0);
823 }
824 
825 /*
826  * Like so_lock_read above but allows signals.
827  */
828 int
829 so_lock_read_intr(struct sonode *so, int fmode)
830 {
831 	ASSERT(MUTEX_HELD(&so->so_lock));
832 
833 	while (so->so_flag & SOREADLOCKED) {
834 		if (fmode & (FNDELAY|FNONBLOCK))
835 			return (EWOULDBLOCK);
836 		so->so_flag |= SOWANT;
837 		if (!cv_wait_sig(&so->so_want_cv, &so->so_lock))
838 			return (EINTR);
839 	}
840 	so->so_flag |= SOREADLOCKED;
841 	return (0);
842 }
843 
844 /*
845  * Caller must hold the mutex. Used to clear SOREADLOCKED,
846  * set in so_lock_read() or so_lock_read_intr().
847  */
848 void
849 so_unlock_read(struct sonode *so)
850 {
851 	ASSERT(MUTEX_HELD(&so->so_lock));
852 	ASSERT(so->so_flag & SOREADLOCKED);
853 
854 	if (so->so_flag & SOWANT)
855 		cv_broadcast(&so->so_want_cv);
856 	so->so_flag &= ~(SOWANT|SOREADLOCKED);
857 }
858 
859 /*
860  * Verify that the specified offset falls within the mblk and
861  * that the resulting pointer is aligned.
862  * Returns NULL if not.
863  */
864 void *
865 sogetoff(mblk_t *mp, t_uscalar_t offset,
866     t_uscalar_t length, uint_t align_size)
867 {
868 	uintptr_t ptr1, ptr2;
869 
870 	ASSERT(mp && mp->b_wptr >= mp->b_rptr);
871 	ptr1 = (uintptr_t)mp->b_rptr + offset;
872 	ptr2 = (uintptr_t)ptr1 + length;
873 	if (ptr1 < (uintptr_t)mp->b_rptr || ptr2 > (uintptr_t)mp->b_wptr) {
874 		eprintline(0);
875 		return (NULL);
876 	}
877 	if ((ptr1 & (align_size - 1)) != 0) {
878 		eprintline(0);
879 		return (NULL);
880 	}
881 	return ((void *)ptr1);
882 }
883 
884 /*
885  * Return the AF_UNIX underlying filesystem vnode matching a given name.
886  * Makes sure the sending and the destination sonodes are compatible.
887  * The vnode is returned held.
888  *
889  * The underlying filesystem VSOCK vnode has a v_stream pointer that
890  * references the actual stream head (hence indirectly the actual sonode).
891  */
892 static int
893 so_ux_lookup(struct sonode *so, struct sockaddr_un *soun, int checkaccess,
894 		vnode_t **vpp)
895 {
896 	vnode_t		*vp;	/* Underlying filesystem vnode */
897 	vnode_t		*svp;	/* sockfs vnode */
898 	struct sonode	*so2;
899 	int		error;
900 
901 	dprintso(so, 1, ("so_ux_lookup(%p) name <%s>\n",
902 	    so, soun->sun_path));
903 
904 	error = lookupname(soun->sun_path, UIO_SYSSPACE, FOLLOW, NULLVPP, &vp);
905 	if (error) {
906 		eprintsoline(so, error);
907 		return (error);
908 	}
909 	if (vp->v_type != VSOCK) {
910 		error = ENOTSOCK;
911 		eprintsoline(so, error);
912 		goto done2;
913 	}
914 
915 	if (checkaccess) {
916 		/*
917 		 * Check that we have permissions to access the destination
918 		 * vnode. This check is not done in BSD but it is required
919 		 * by X/Open.
920 		 */
921 		if (error = VOP_ACCESS(vp, VREAD|VWRITE, 0, CRED(), NULL)) {
922 			eprintsoline(so, error);
923 			goto done2;
924 		}
925 	}
926 
927 	/*
928 	 * Check if the remote socket has been closed.
929 	 *
930 	 * Synchronize with vn_rele_stream by holding v_lock while traversing
931 	 * v_stream->sd_vnode.
932 	 */
933 	mutex_enter(&vp->v_lock);
934 	if (vp->v_stream == NULL) {
935 		mutex_exit(&vp->v_lock);
936 		if (so->so_type == SOCK_DGRAM)
937 			error = EDESTADDRREQ;
938 		else
939 			error = ECONNREFUSED;
940 
941 		eprintsoline(so, error);
942 		goto done2;
943 	}
944 	ASSERT(vp->v_stream->sd_vnode);
945 	svp = vp->v_stream->sd_vnode;
946 	/*
947 	 * holding v_lock on underlying filesystem vnode and acquiring
948 	 * it on sockfs vnode. Assumes that no code ever attempts to
949 	 * acquire these locks in the reverse order.
950 	 */
951 	VN_HOLD(svp);
952 	mutex_exit(&vp->v_lock);
953 
954 	if (svp->v_type != VSOCK) {
955 		error = ENOTSOCK;
956 		eprintsoline(so, error);
957 		goto done;
958 	}
959 
960 	so2 = VTOSO(svp);
961 
962 	if (so->so_type != so2->so_type) {
963 		error = EPROTOTYPE;
964 		eprintsoline(so, error);
965 		goto done;
966 	}
967 
968 	VN_RELE(svp);
969 	*vpp = vp;
970 	return (0);
971 
972 done:
973 	VN_RELE(svp);
974 done2:
975 	VN_RELE(vp);
976 	return (error);
977 }
978 
979 /*
980  * Verify peer address for connect and sendto/sendmsg.
981  * Since sendto/sendmsg would not get synchronous errors from the transport
982  * provider we have to do these ugly checks in the socket layer to
983  * preserve compatibility with SunOS 4.X.
984  */
985 int
986 so_addr_verify(struct sonode *so, const struct sockaddr *name,
987     socklen_t namelen)
988 {
989 	int		family;
990 
991 	dprintso(so, 1, ("so_addr_verify(%p, %p, %d)\n", so, name, namelen));
992 
993 	ASSERT(name != NULL);
994 
995 	family = so->so_family;
996 	switch (family) {
997 	case AF_INET:
998 		if (name->sa_family != family) {
999 			eprintsoline(so, EAFNOSUPPORT);
1000 			return (EAFNOSUPPORT);
1001 		}
1002 		if (namelen != (socklen_t)sizeof (struct sockaddr_in)) {
1003 			eprintsoline(so, EINVAL);
1004 			return (EINVAL);
1005 		}
1006 		break;
1007 	case AF_INET6: {
1008 #ifdef DEBUG
1009 		struct sockaddr_in6 *sin6;
1010 #endif /* DEBUG */
1011 
1012 		if (name->sa_family != family) {
1013 			eprintsoline(so, EAFNOSUPPORT);
1014 			return (EAFNOSUPPORT);
1015 		}
1016 		if (namelen != (socklen_t)sizeof (struct sockaddr_in6)) {
1017 			eprintsoline(so, EINVAL);
1018 			return (EINVAL);
1019 		}
1020 #ifdef DEBUG
1021 		/* Verify that apps don't forget to clear sin6_scope_id etc */
1022 		sin6 = (struct sockaddr_in6 *)name;
1023 		if (sin6->sin6_scope_id != 0 &&
1024 		    !IN6_IS_ADDR_LINKSCOPE(&sin6->sin6_addr)) {
1025 			zcmn_err(getzoneid(), CE_WARN,
1026 			    "connect/send* with uninitialized sin6_scope_id "
1027 			    "(%d) on socket. Pid = %d\n",
1028 			    (int)sin6->sin6_scope_id, (int)curproc->p_pid);
1029 		}
1030 #endif /* DEBUG */
1031 		break;
1032 	}
1033 	case AF_UNIX:
1034 		if (so->so_state & SS_FADDR_NOXLATE) {
1035 			return (0);
1036 		}
1037 		if (namelen < (socklen_t)sizeof (short)) {
1038 			eprintsoline(so, ENOENT);
1039 			return (ENOENT);
1040 		}
1041 		if (name->sa_family != family) {
1042 			eprintsoline(so, EAFNOSUPPORT);
1043 			return (EAFNOSUPPORT);
1044 		}
1045 		/* MAXPATHLEN + soun_family + nul termination */
1046 		if (namelen > (socklen_t)(MAXPATHLEN + sizeof (short) + 1)) {
1047 			eprintsoline(so, ENAMETOOLONG);
1048 			return (ENAMETOOLONG);
1049 		}
1050 
1051 		break;
1052 
1053 	default:
1054 		/*
1055 		 * Default is don't do any length or sa_family check
1056 		 * to allow non-sockaddr style addresses.
1057 		 */
1058 		break;
1059 	}
1060 
1061 	return (0);
1062 }
1063 
1064 
1065 /*
1066  * Translate an AF_UNIX sockaddr_un to the transport internal name.
1067  * Assumes caller has called so_addr_verify first.
1068  */
1069 /*ARGSUSED*/
1070 int
1071 so_ux_addr_xlate(struct sonode *so, struct sockaddr *name,
1072     socklen_t namelen, int checkaccess,
1073     void **addrp, socklen_t *addrlenp)
1074 {
1075 	int			error;
1076 	struct sockaddr_un	*soun;
1077 	vnode_t			*vp;
1078 	void			*addr;
1079 	socklen_t		addrlen;
1080 
1081 	dprintso(so, 1, ("so_ux_addr_xlate(%p, %p, %d, %d)\n",
1082 	    so, name, namelen, checkaccess));
1083 
1084 	ASSERT(name != NULL);
1085 	ASSERT(so->so_family == AF_UNIX);
1086 	ASSERT(!(so->so_state & SS_FADDR_NOXLATE));
1087 	ASSERT(namelen >= (socklen_t)sizeof (short));
1088 	ASSERT(name->sa_family == AF_UNIX);
1089 	soun = (struct sockaddr_un *)name;
1090 	/*
1091 	 * Lookup vnode for the specified path name and verify that
1092 	 * it is a socket.
1093 	 */
1094 	error = so_ux_lookup(so, soun, checkaccess, &vp);
1095 	if (error) {
1096 		eprintsoline(so, error);
1097 		return (error);
1098 	}
1099 	/*
1100 	 * Use the address of the peer vnode as the address to send
1101 	 * to. We release the peer vnode here. In case it has been
1102 	 * closed by the time the T_CONN_REQ or T_UNIDATA_REQ reaches the
1103 	 * transport the message will get an error or be dropped.
1104 	 */
1105 	so->so_ux_faddr.soua_vp = vp;
1106 	so->so_ux_faddr.soua_magic = SOU_MAGIC_EXPLICIT;
1107 	addr = &so->so_ux_faddr;
1108 	addrlen = (socklen_t)sizeof (so->so_ux_faddr);
1109 	dprintso(so, 1, ("ux_xlate UNIX: addrlen %d, vp %p\n",
1110 	    addrlen, vp));
1111 	VN_RELE(vp);
1112 	*addrp = addr;
1113 	*addrlenp = (socklen_t)addrlen;
1114 	return (0);
1115 }
1116 
1117 /*
1118  * Esballoc free function for messages that contain SO_FILEP option.
1119  * Decrement the reference count on the file pointers using closef.
1120  */
1121 void
1122 fdbuf_free(struct fdbuf *fdbuf)
1123 {
1124 	int	i;
1125 	struct file *fp;
1126 
1127 	dprint(1, ("fdbuf_free: %d fds\n", fdbuf->fd_numfd));
1128 	for (i = 0; i < fdbuf->fd_numfd; i++) {
1129 		/*
1130 		 * We need pointer size alignment for fd_fds. On a LP64
1131 		 * kernel, the required alignment is 8 bytes while
1132 		 * the option headers and values are only 4 bytes
1133 		 * aligned. So its safer to do a bcopy compared to
1134 		 * assigning fdbuf->fd_fds[i] to fp.
1135 		 */
1136 		bcopy((char *)&fdbuf->fd_fds[i], (char *)&fp, sizeof (fp));
1137 		dprint(1, ("fdbuf_free: [%d] = %p\n", i, fp));
1138 		(void) closef(fp);
1139 	}
1140 	if (fdbuf->fd_ebuf != NULL)
1141 		kmem_free(fdbuf->fd_ebuf, fdbuf->fd_ebuflen);
1142 	kmem_free(fdbuf, fdbuf->fd_size);
1143 }
1144 
1145 /*
1146  * Allocate an esballoc'ed message for AF_UNIX file descriptor passing.
1147  * Waits if memory is not available.
1148  */
1149 mblk_t *
1150 fdbuf_allocmsg(int size, struct fdbuf *fdbuf)
1151 {
1152 	uchar_t	*buf;
1153 	mblk_t	*mp;
1154 
1155 	dprint(1, ("fdbuf_allocmsg: size %d, %d fds\n", size, fdbuf->fd_numfd));
1156 	buf = kmem_alloc(size, KM_SLEEP);
1157 	fdbuf->fd_ebuf = (caddr_t)buf;
1158 	fdbuf->fd_ebuflen = size;
1159 	fdbuf->fd_frtn.free_func = fdbuf_free;
1160 	fdbuf->fd_frtn.free_arg = (caddr_t)fdbuf;
1161 
1162 	mp = esballoc_wait(buf, size, BPRI_MED, &fdbuf->fd_frtn);
1163 	mp->b_datap->db_type = M_PROTO;
1164 	return (mp);
1165 }
1166 
1167 /*
1168  * Extract file descriptors from a fdbuf.
1169  * Return list in rights/rightslen.
1170  */
1171 /*ARGSUSED*/
1172 static int
1173 fdbuf_extract(struct fdbuf *fdbuf, void *rights, int rightslen)
1174 {
1175 	int	i, fd;
1176 	int	*rp;
1177 	struct file *fp;
1178 	int	numfd;
1179 
1180 	dprint(1, ("fdbuf_extract: %d fds, len %d\n",
1181 	    fdbuf->fd_numfd, rightslen));
1182 
1183 	numfd = fdbuf->fd_numfd;
1184 	ASSERT(rightslen == numfd * (int)sizeof (int));
1185 
1186 	/*
1187 	 * Allocate a file descriptor and increment the f_count.
1188 	 * The latter is needed since we always call fdbuf_free
1189 	 * which performs a closef.
1190 	 */
1191 	rp = (int *)rights;
1192 	for (i = 0; i < numfd; i++) {
1193 		if ((fd = ufalloc(0)) == -1)
1194 			goto cleanup;
1195 		/*
1196 		 * We need pointer size alignment for fd_fds. On a LP64
1197 		 * kernel, the required alignment is 8 bytes while
1198 		 * the option headers and values are only 4 bytes
1199 		 * aligned. So its safer to do a bcopy compared to
1200 		 * assigning fdbuf->fd_fds[i] to fp.
1201 		 */
1202 		bcopy((char *)&fdbuf->fd_fds[i], (char *)&fp, sizeof (fp));
1203 		mutex_enter(&fp->f_tlock);
1204 		fp->f_count++;
1205 		mutex_exit(&fp->f_tlock);
1206 		setf(fd, fp);
1207 		*rp++ = fd;
1208 		if (audit_active)
1209 			audit_fdrecv(fd, fp);
1210 		dprint(1, ("fdbuf_extract: [%d] = %d, %p refcnt %d\n",
1211 		    i, fd, fp, fp->f_count));
1212 	}
1213 	return (0);
1214 
1215 cleanup:
1216 	/*
1217 	 * Undo whatever partial work the loop above has done.
1218 	 */
1219 	{
1220 		int j;
1221 
1222 		rp = (int *)rights;
1223 		for (j = 0; j < i; j++) {
1224 			dprint(0,
1225 			    ("fdbuf_extract: cleanup[%d] = %d\n", j, *rp));
1226 			(void) closeandsetf(*rp++, NULL);
1227 		}
1228 	}
1229 
1230 	return (EMFILE);
1231 }
1232 
1233 /*
1234  * Insert file descriptors into an fdbuf.
1235  * Returns a kmem_alloc'ed fdbuf. The fdbuf should be freed
1236  * by calling fdbuf_free().
1237  */
1238 int
1239 fdbuf_create(void *rights, int rightslen, struct fdbuf **fdbufp)
1240 {
1241 	int		numfd, i;
1242 	int		*fds;
1243 	struct file	*fp;
1244 	struct fdbuf	*fdbuf;
1245 	int		fdbufsize;
1246 
1247 	dprint(1, ("fdbuf_create: len %d\n", rightslen));
1248 
1249 	numfd = rightslen / (int)sizeof (int);
1250 
1251 	fdbufsize = (int)FDBUF_HDRSIZE + (numfd * (int)sizeof (struct file *));
1252 	fdbuf = kmem_alloc(fdbufsize, KM_SLEEP);
1253 	fdbuf->fd_size = fdbufsize;
1254 	fdbuf->fd_numfd = 0;
1255 	fdbuf->fd_ebuf = NULL;
1256 	fdbuf->fd_ebuflen = 0;
1257 	fds = (int *)rights;
1258 	for (i = 0; i < numfd; i++) {
1259 		if ((fp = getf(fds[i])) == NULL) {
1260 			fdbuf_free(fdbuf);
1261 			return (EBADF);
1262 		}
1263 		dprint(1, ("fdbuf_create: [%d] = %d, %p refcnt %d\n",
1264 		    i, fds[i], fp, fp->f_count));
1265 		mutex_enter(&fp->f_tlock);
1266 		fp->f_count++;
1267 		mutex_exit(&fp->f_tlock);
1268 		/*
1269 		 * The maximum alignment for fdbuf (or any option header
1270 		 * and its value) it 4 bytes. On a LP64 kernel, the alignment
1271 		 * is not sufficient for pointers (fd_fds in this case). Since
1272 		 * we just did a kmem_alloc (we get a double word alignment),
1273 		 * we don't need to do anything on the send side (we loose
1274 		 * the double word alignment because fdbuf goes after an
1275 		 * option header (eg T_unitdata_req) which is only 4 byte
1276 		 * aligned). We take care of this when we extract the file
1277 		 * descriptor in fdbuf_extract or fdbuf_free.
1278 		 */
1279 		fdbuf->fd_fds[i] = fp;
1280 		fdbuf->fd_numfd++;
1281 		releasef(fds[i]);
1282 		if (audit_active)
1283 			audit_fdsend(fds[i], fp, 0);
1284 	}
1285 	*fdbufp = fdbuf;
1286 	return (0);
1287 }
1288 
1289 static int
1290 fdbuf_optlen(int rightslen)
1291 {
1292 	int numfd;
1293 
1294 	numfd = rightslen / (int)sizeof (int);
1295 
1296 	return ((int)FDBUF_HDRSIZE + (numfd * (int)sizeof (struct file *)));
1297 }
1298 
1299 static t_uscalar_t
1300 fdbuf_cmsglen(int fdbuflen)
1301 {
1302 	return (t_uscalar_t)((fdbuflen - FDBUF_HDRSIZE) /
1303 	    (int)sizeof (struct file *) * (int)sizeof (int));
1304 }
1305 
1306 
1307 /*
1308  * Return non-zero if the mblk and fdbuf are consistent.
1309  */
1310 static int
1311 fdbuf_verify(mblk_t *mp, struct fdbuf *fdbuf, int fdbuflen)
1312 {
1313 	if (fdbuflen >= FDBUF_HDRSIZE &&
1314 	    fdbuflen == fdbuf->fd_size) {
1315 		frtn_t *frp = mp->b_datap->db_frtnp;
1316 		/*
1317 		 * Check that the SO_FILEP portion of the
1318 		 * message has not been modified by
1319 		 * the loopback transport. The sending sockfs generates
1320 		 * a message that is esballoc'ed with the free function
1321 		 * being fdbuf_free() and where free_arg contains the
1322 		 * identical information as the SO_FILEP content.
1323 		 *
1324 		 * If any of these constraints are not satisfied we
1325 		 * silently ignore the option.
1326 		 */
1327 		ASSERT(mp);
1328 		if (frp != NULL &&
1329 		    frp->free_func == fdbuf_free &&
1330 		    frp->free_arg != NULL &&
1331 		    bcmp(frp->free_arg, fdbuf, fdbuflen) == 0) {
1332 			dprint(1, ("fdbuf_verify: fdbuf %p len %d\n",
1333 			    fdbuf, fdbuflen));
1334 			return (1);
1335 		} else {
1336 			zcmn_err(getzoneid(), CE_WARN,
1337 			    "sockfs: mismatched fdbuf content (%p)",
1338 			    (void *)mp);
1339 			return (0);
1340 		}
1341 	} else {
1342 		zcmn_err(getzoneid(), CE_WARN,
1343 		    "sockfs: mismatched fdbuf len %d, %d\n",
1344 		    fdbuflen, fdbuf->fd_size);
1345 		return (0);
1346 	}
1347 }
1348 
1349 /*
1350  * When the file descriptors returned by sorecvmsg can not be passed
1351  * to the application this routine will cleanup the references on
1352  * the files. Start at startoff bytes into the buffer.
1353  */
1354 static void
1355 close_fds(void *fdbuf, int fdbuflen, int startoff)
1356 {
1357 	int *fds = (int *)fdbuf;
1358 	int numfd = fdbuflen / (int)sizeof (int);
1359 	int i;
1360 
1361 	dprint(1, ("close_fds(%p, %d, %d)\n", fdbuf, fdbuflen, startoff));
1362 
1363 	for (i = 0; i < numfd; i++) {
1364 		if (startoff < 0)
1365 			startoff = 0;
1366 		if (startoff < (int)sizeof (int)) {
1367 			/*
1368 			 * This file descriptor is partially or fully after
1369 			 * the offset
1370 			 */
1371 			dprint(0,
1372 			    ("close_fds: cleanup[%d] = %d\n", i, fds[i]));
1373 			(void) closeandsetf(fds[i], NULL);
1374 		}
1375 		startoff -= (int)sizeof (int);
1376 	}
1377 }
1378 
1379 /*
1380  * Close all file descriptors contained in the control part starting at
1381  * the startoffset.
1382  */
1383 void
1384 so_closefds(void *control, t_uscalar_t controllen, int oldflg,
1385     int startoff)
1386 {
1387 	struct cmsghdr *cmsg;
1388 
1389 	if (control == NULL)
1390 		return;
1391 
1392 	if (oldflg) {
1393 		close_fds(control, controllen, startoff);
1394 		return;
1395 	}
1396 	/* Scan control part for file descriptors. */
1397 	for (cmsg = (struct cmsghdr *)control;
1398 	    CMSG_VALID(cmsg, control, (uintptr_t)control + controllen);
1399 	    cmsg = CMSG_NEXT(cmsg)) {
1400 		if (cmsg->cmsg_level == SOL_SOCKET &&
1401 		    cmsg->cmsg_type == SCM_RIGHTS) {
1402 			close_fds(CMSG_CONTENT(cmsg),
1403 			    (int)CMSG_CONTENTLEN(cmsg),
1404 			    startoff - (int)sizeof (struct cmsghdr));
1405 		}
1406 		startoff -= cmsg->cmsg_len;
1407 	}
1408 }
1409 
1410 /*
1411  * Returns a pointer/length for the file descriptors contained
1412  * in the control buffer. Returns with *fdlenp == -1 if there are no
1413  * file descriptor options present. This is different than there being
1414  * a zero-length file descriptor option.
1415  * Fail if there are multiple SCM_RIGHT cmsgs.
1416  */
1417 int
1418 so_getfdopt(void *control, t_uscalar_t controllen, int oldflg,
1419     void **fdsp, int *fdlenp)
1420 {
1421 	struct cmsghdr *cmsg;
1422 	void *fds;
1423 	int fdlen;
1424 
1425 	if (control == NULL) {
1426 		*fdsp = NULL;
1427 		*fdlenp = -1;
1428 		return (0);
1429 	}
1430 
1431 	if (oldflg) {
1432 		*fdsp = control;
1433 		if (controllen == 0)
1434 			*fdlenp = -1;
1435 		else
1436 			*fdlenp = controllen;
1437 		dprint(1, ("so_getfdopt: old %d\n", *fdlenp));
1438 		return (0);
1439 	}
1440 
1441 	fds = NULL;
1442 	fdlen = 0;
1443 
1444 	for (cmsg = (struct cmsghdr *)control;
1445 	    CMSG_VALID(cmsg, control, (uintptr_t)control + controllen);
1446 	    cmsg = CMSG_NEXT(cmsg)) {
1447 		if (cmsg->cmsg_level == SOL_SOCKET &&
1448 		    cmsg->cmsg_type == SCM_RIGHTS) {
1449 			if (fds != NULL)
1450 				return (EINVAL);
1451 			fds = CMSG_CONTENT(cmsg);
1452 			fdlen = (int)CMSG_CONTENTLEN(cmsg);
1453 			dprint(1, ("so_getfdopt: new %lu\n",
1454 			    (size_t)CMSG_CONTENTLEN(cmsg)));
1455 		}
1456 	}
1457 	if (fds == NULL) {
1458 		dprint(1, ("so_getfdopt: NONE\n"));
1459 		*fdlenp = -1;
1460 	} else
1461 		*fdlenp = fdlen;
1462 	*fdsp = fds;
1463 	return (0);
1464 }
1465 
1466 /*
1467  * Return the length of the options including any file descriptor options.
1468  */
1469 t_uscalar_t
1470 so_optlen(void *control, t_uscalar_t controllen, int oldflg)
1471 {
1472 	struct cmsghdr *cmsg;
1473 	t_uscalar_t optlen = 0;
1474 	t_uscalar_t len;
1475 
1476 	if (control == NULL)
1477 		return (0);
1478 
1479 	if (oldflg)
1480 		return ((t_uscalar_t)(sizeof (struct T_opthdr) +
1481 		    fdbuf_optlen(controllen)));
1482 
1483 	for (cmsg = (struct cmsghdr *)control;
1484 	    CMSG_VALID(cmsg, control, (uintptr_t)control + controllen);
1485 	    cmsg = CMSG_NEXT(cmsg)) {
1486 		if (cmsg->cmsg_level == SOL_SOCKET &&
1487 		    cmsg->cmsg_type == SCM_RIGHTS) {
1488 			len = fdbuf_optlen((int)CMSG_CONTENTLEN(cmsg));
1489 		} else {
1490 			len = (t_uscalar_t)CMSG_CONTENTLEN(cmsg);
1491 		}
1492 		optlen += (t_uscalar_t)(_TPI_ALIGN_TOPT(len) +
1493 		    sizeof (struct T_opthdr));
1494 	}
1495 	dprint(1, ("so_optlen: controllen %d, flg %d -> optlen %d\n",
1496 	    controllen, oldflg, optlen));
1497 	return (optlen);
1498 }
1499 
1500 /*
1501  * Copy options from control to the mblk. Skip any file descriptor options.
1502  */
1503 void
1504 so_cmsg2opt(void *control, t_uscalar_t controllen, int oldflg, mblk_t *mp)
1505 {
1506 	struct T_opthdr toh;
1507 	struct cmsghdr *cmsg;
1508 
1509 	if (control == NULL)
1510 		return;
1511 
1512 	if (oldflg) {
1513 		/* No real options - caller has handled file descriptors */
1514 		return;
1515 	}
1516 	for (cmsg = (struct cmsghdr *)control;
1517 	    CMSG_VALID(cmsg, control, (uintptr_t)control + controllen);
1518 	    cmsg = CMSG_NEXT(cmsg)) {
1519 		/*
1520 		 * Note: The caller handles file descriptors prior
1521 		 * to calling this function.
1522 		 */
1523 		t_uscalar_t len;
1524 
1525 		if (cmsg->cmsg_level == SOL_SOCKET &&
1526 		    cmsg->cmsg_type == SCM_RIGHTS)
1527 			continue;
1528 
1529 		len = (t_uscalar_t)CMSG_CONTENTLEN(cmsg);
1530 		toh.level = cmsg->cmsg_level;
1531 		toh.name = cmsg->cmsg_type;
1532 		toh.len = len + (t_uscalar_t)sizeof (struct T_opthdr);
1533 		toh.status = 0;
1534 
1535 		soappendmsg(mp, &toh, sizeof (toh));
1536 		soappendmsg(mp, CMSG_CONTENT(cmsg), len);
1537 		mp->b_wptr += _TPI_ALIGN_TOPT(len) - len;
1538 		ASSERT(mp->b_wptr <= mp->b_datap->db_lim);
1539 	}
1540 }
1541 
1542 /*
1543  * Return the length of the control message derived from the options.
1544  * Exclude SO_SRCADDR and SO_UNIX_CLOSE options. Include SO_FILEP.
1545  * When oldflg is set only include SO_FILEP.
1546  * so_opt2cmsg and so_cmsglen are inter-related since so_cmsglen
1547  * allocates the space that so_opt2cmsg fills. If one changes, the other should
1548  * also be checked for any possible impacts.
1549  */
1550 t_uscalar_t
1551 so_cmsglen(mblk_t *mp, void *opt, t_uscalar_t optlen, int oldflg)
1552 {
1553 	t_uscalar_t cmsglen = 0;
1554 	struct T_opthdr *tohp;
1555 	t_uscalar_t len;
1556 	t_uscalar_t last_roundup = 0;
1557 
1558 	ASSERT(__TPI_TOPT_ISALIGNED(opt));
1559 
1560 	for (tohp = (struct T_opthdr *)opt;
1561 	    tohp && _TPI_TOPT_VALID(tohp, opt, (uintptr_t)opt + optlen);
1562 	    tohp = _TPI_TOPT_NEXTHDR(opt, optlen, tohp)) {
1563 		dprint(1, ("so_cmsglen: level 0x%x, name %d, len %d\n",
1564 		    tohp->level, tohp->name, tohp->len));
1565 		if (tohp->level == SOL_SOCKET &&
1566 		    (tohp->name == SO_SRCADDR ||
1567 		    tohp->name == SO_UNIX_CLOSE)) {
1568 			continue;
1569 		}
1570 		if (tohp->level == SOL_SOCKET && tohp->name == SO_FILEP) {
1571 			struct fdbuf *fdbuf;
1572 			int fdbuflen;
1573 
1574 			fdbuf = (struct fdbuf *)_TPI_TOPT_DATA(tohp);
1575 			fdbuflen = (int)_TPI_TOPT_DATALEN(tohp);
1576 
1577 			if (!fdbuf_verify(mp, fdbuf, fdbuflen))
1578 				continue;
1579 			if (oldflg) {
1580 				cmsglen += fdbuf_cmsglen(fdbuflen);
1581 				continue;
1582 			}
1583 			len = fdbuf_cmsglen(fdbuflen);
1584 		} else if (tohp->level == SOL_SOCKET &&
1585 		    tohp->name == SCM_TIMESTAMP) {
1586 			if (oldflg)
1587 				continue;
1588 
1589 			if (get_udatamodel() == DATAMODEL_NATIVE) {
1590 				len = sizeof (struct timeval);
1591 			} else {
1592 				len = sizeof (struct timeval32);
1593 			}
1594 		} else {
1595 			if (oldflg)
1596 				continue;
1597 			len = (t_uscalar_t)_TPI_TOPT_DATALEN(tohp);
1598 		}
1599 		/*
1600 		 * Exclude roundup for last option to not set
1601 		 * MSG_CTRUNC when the cmsg fits but the padding doesn't fit.
1602 		 */
1603 		last_roundup = (t_uscalar_t)
1604 		    (ROUNDUP_cmsglen(len + (int)sizeof (struct cmsghdr)) -
1605 		    (len + (int)sizeof (struct cmsghdr)));
1606 		cmsglen += (t_uscalar_t)(len + (int)sizeof (struct cmsghdr)) +
1607 		    last_roundup;
1608 	}
1609 	cmsglen -= last_roundup;
1610 	dprint(1, ("so_cmsglen: optlen %d, flg %d -> cmsglen %d\n",
1611 	    optlen, oldflg, cmsglen));
1612 	return (cmsglen);
1613 }
1614 
1615 /*
1616  * Copy options from options to the control. Convert SO_FILEP to
1617  * file descriptors.
1618  * Returns errno or zero.
1619  * so_opt2cmsg and so_cmsglen are inter-related since so_cmsglen
1620  * allocates the space that so_opt2cmsg fills. If one changes, the other should
1621  * also be checked for any possible impacts.
1622  */
1623 int
1624 so_opt2cmsg(mblk_t *mp, void *opt, t_uscalar_t optlen, int oldflg,
1625     void *control, t_uscalar_t controllen)
1626 {
1627 	struct T_opthdr *tohp;
1628 	struct cmsghdr *cmsg;
1629 	struct fdbuf *fdbuf;
1630 	int fdbuflen;
1631 	int error;
1632 #if defined(DEBUG) || defined(__lint)
1633 	struct cmsghdr *cend = (struct cmsghdr *)
1634 	    (((uint8_t *)control) + ROUNDUP_cmsglen(controllen));
1635 #endif
1636 	cmsg = (struct cmsghdr *)control;
1637 
1638 	ASSERT(__TPI_TOPT_ISALIGNED(opt));
1639 
1640 	for (tohp = (struct T_opthdr *)opt;
1641 	    tohp && _TPI_TOPT_VALID(tohp, opt, (uintptr_t)opt + optlen);
1642 	    tohp = _TPI_TOPT_NEXTHDR(opt, optlen, tohp)) {
1643 		dprint(1, ("so_opt2cmsg: level 0x%x, name %d, len %d\n",
1644 		    tohp->level, tohp->name, tohp->len));
1645 
1646 		if (tohp->level == SOL_SOCKET &&
1647 		    (tohp->name == SO_SRCADDR ||
1648 		    tohp->name == SO_UNIX_CLOSE)) {
1649 			continue;
1650 		}
1651 		ASSERT((uintptr_t)cmsg <= (uintptr_t)control + controllen);
1652 		if (tohp->level == SOL_SOCKET && tohp->name == SO_FILEP) {
1653 			fdbuf = (struct fdbuf *)_TPI_TOPT_DATA(tohp);
1654 			fdbuflen = (int)_TPI_TOPT_DATALEN(tohp);
1655 
1656 			if (!fdbuf_verify(mp, fdbuf, fdbuflen))
1657 				return (EPROTO);
1658 			if (oldflg) {
1659 				error = fdbuf_extract(fdbuf, control,
1660 				    (int)controllen);
1661 				if (error != 0)
1662 					return (error);
1663 				continue;
1664 			} else {
1665 				int fdlen;
1666 
1667 				fdlen = (int)fdbuf_cmsglen(
1668 				    (int)_TPI_TOPT_DATALEN(tohp));
1669 
1670 				cmsg->cmsg_level = tohp->level;
1671 				cmsg->cmsg_type = SCM_RIGHTS;
1672 				cmsg->cmsg_len = (socklen_t)(fdlen +
1673 				    sizeof (struct cmsghdr));
1674 
1675 				error = fdbuf_extract(fdbuf,
1676 				    CMSG_CONTENT(cmsg), fdlen);
1677 				if (error != 0)
1678 					return (error);
1679 			}
1680 		} else if (tohp->level == SOL_SOCKET &&
1681 		    tohp->name == SCM_TIMESTAMP) {
1682 			timestruc_t *timestamp;
1683 
1684 			if (oldflg)
1685 				continue;
1686 
1687 			cmsg->cmsg_level = tohp->level;
1688 			cmsg->cmsg_type = tohp->name;
1689 
1690 			timestamp =
1691 			    (timestruc_t *)P2ROUNDUP((intptr_t)&tohp[1],
1692 			    sizeof (intptr_t));
1693 
1694 			if (get_udatamodel() == DATAMODEL_NATIVE) {
1695 				struct timeval tv;
1696 
1697 				cmsg->cmsg_len = sizeof (struct timeval) +
1698 				    sizeof (struct cmsghdr);
1699 				tv.tv_sec = timestamp->tv_sec;
1700 				tv.tv_usec = timestamp->tv_nsec /
1701 				    (NANOSEC / MICROSEC);
1702 				/*
1703 				 * on LP64 systems, the struct timeval in
1704 				 * the destination will not be 8-byte aligned,
1705 				 * so use bcopy to avoid alignment trouble
1706 				 */
1707 				bcopy(&tv, CMSG_CONTENT(cmsg), sizeof (tv));
1708 			} else {
1709 				struct timeval32 *time32;
1710 
1711 				cmsg->cmsg_len = sizeof (struct timeval32) +
1712 				    sizeof (struct cmsghdr);
1713 				time32 = (struct timeval32 *)CMSG_CONTENT(cmsg);
1714 				time32->tv_sec = (time32_t)timestamp->tv_sec;
1715 				time32->tv_usec =
1716 				    (int32_t)(timestamp->tv_nsec /
1717 				    (NANOSEC / MICROSEC));
1718 			}
1719 
1720 		} else {
1721 			if (oldflg)
1722 				continue;
1723 
1724 			cmsg->cmsg_level = tohp->level;
1725 			cmsg->cmsg_type = tohp->name;
1726 			cmsg->cmsg_len = (socklen_t)(_TPI_TOPT_DATALEN(tohp) +
1727 			    sizeof (struct cmsghdr));
1728 
1729 			/* copy content to control data part */
1730 			bcopy(&tohp[1], CMSG_CONTENT(cmsg),
1731 			    CMSG_CONTENTLEN(cmsg));
1732 		}
1733 		/* move to next CMSG structure! */
1734 		cmsg = CMSG_NEXT(cmsg);
1735 	}
1736 	dprint(1, ("so_opt2cmsg: buf %p len %d; cend %p; final cmsg %p\n",
1737 	    control, controllen, cend, cmsg));
1738 	ASSERT(cmsg <= cend);
1739 	return (0);
1740 }
1741 
1742 /*
1743  * Extract the SO_SRCADDR option value if present.
1744  */
1745 void
1746 so_getopt_srcaddr(void *opt, t_uscalar_t optlen, void **srcp,
1747     t_uscalar_t *srclenp)
1748 {
1749 	struct T_opthdr		*tohp;
1750 
1751 	ASSERT(__TPI_TOPT_ISALIGNED(opt));
1752 
1753 	ASSERT(srcp != NULL && srclenp != NULL);
1754 	*srcp = NULL;
1755 	*srclenp = 0;
1756 
1757 	for (tohp = (struct T_opthdr *)opt;
1758 	    tohp && _TPI_TOPT_VALID(tohp, opt, (uintptr_t)opt + optlen);
1759 	    tohp = _TPI_TOPT_NEXTHDR(opt, optlen, tohp)) {
1760 		dprint(1, ("so_getopt_srcaddr: level 0x%x, name %d, len %d\n",
1761 		    tohp->level, tohp->name, tohp->len));
1762 		if (tohp->level == SOL_SOCKET &&
1763 		    tohp->name == SO_SRCADDR) {
1764 			*srcp = _TPI_TOPT_DATA(tohp);
1765 			*srclenp = (t_uscalar_t)_TPI_TOPT_DATALEN(tohp);
1766 		}
1767 	}
1768 }
1769 
1770 /*
1771  * Verify if the SO_UNIX_CLOSE option is present.
1772  */
1773 int
1774 so_getopt_unix_close(void *opt, t_uscalar_t optlen)
1775 {
1776 	struct T_opthdr		*tohp;
1777 
1778 	ASSERT(__TPI_TOPT_ISALIGNED(opt));
1779 
1780 	for (tohp = (struct T_opthdr *)opt;
1781 	    tohp && _TPI_TOPT_VALID(tohp, opt, (uintptr_t)opt + optlen);
1782 	    tohp = _TPI_TOPT_NEXTHDR(opt, optlen, tohp)) {
1783 		dprint(1,
1784 		    ("so_getopt_unix_close: level 0x%x, name %d, len %d\n",
1785 		    tohp->level, tohp->name, tohp->len));
1786 		if (tohp->level == SOL_SOCKET &&
1787 		    tohp->name == SO_UNIX_CLOSE)
1788 			return (1);
1789 	}
1790 	return (0);
1791 }
1792 
1793 /*
1794  * Allocate an M_PROTO message.
1795  *
1796  * If allocation fails the behavior depends on sleepflg:
1797  *	_ALLOC_NOSLEEP	fail immediately
1798  *	_ALLOC_INTR	sleep for memory until a signal is caught
1799  *	_ALLOC_SLEEP	sleep forever. Don't return NULL.
1800  */
1801 mblk_t *
1802 soallocproto(size_t size, int sleepflg)
1803 {
1804 	mblk_t	*mp;
1805 
1806 	/* Round up size for reuse */
1807 	size = MAX(size, 64);
1808 	mp = allocb(size, BPRI_MED);
1809 	if (mp == NULL) {
1810 		int error;	/* Dummy - error not returned to caller */
1811 
1812 		switch (sleepflg) {
1813 		case _ALLOC_SLEEP:
1814 			mp = allocb_wait(size, BPRI_MED, STR_NOSIG, &error);
1815 			ASSERT(mp);
1816 			break;
1817 		case _ALLOC_INTR:
1818 			mp = allocb_wait(size, BPRI_MED, 0, &error);
1819 			if (mp == NULL) {
1820 				/* Caught signal while sleeping for memory */
1821 				eprintline(ENOBUFS);
1822 				return (NULL);
1823 			}
1824 			break;
1825 		case _ALLOC_NOSLEEP:
1826 		default:
1827 			eprintline(ENOBUFS);
1828 			return (NULL);
1829 		}
1830 	}
1831 	DB_TYPE(mp) = M_PROTO;
1832 	return (mp);
1833 }
1834 
1835 /*
1836  * Allocate an M_PROTO message with a single component.
1837  * len is the length of buf. size is the amount to allocate.
1838  *
1839  * buf can be NULL with a non-zero len.
1840  * This results in a bzero'ed chunk being placed the message.
1841  */
1842 mblk_t *
1843 soallocproto1(const void *buf, ssize_t len, ssize_t size, int sleepflg)
1844 {
1845 	mblk_t	*mp;
1846 
1847 	if (size == 0)
1848 		size = len;
1849 
1850 	ASSERT(size >= len);
1851 	/* Round up size for reuse */
1852 	size = MAX(size, 64);
1853 	mp = soallocproto(size, sleepflg);
1854 	if (mp == NULL)
1855 		return (NULL);
1856 	mp->b_datap->db_type = M_PROTO;
1857 	if (len != 0) {
1858 		if (buf != NULL)
1859 			bcopy(buf, mp->b_wptr, len);
1860 		else
1861 			bzero(mp->b_wptr, len);
1862 		mp->b_wptr += len;
1863 	}
1864 	return (mp);
1865 }
1866 
1867 /*
1868  * Append buf/len to mp.
1869  * The caller has to ensure that there is enough room in the mblk.
1870  *
1871  * buf can be NULL with a non-zero len.
1872  * This results in a bzero'ed chunk being placed the message.
1873  */
1874 void
1875 soappendmsg(mblk_t *mp, const void *buf, ssize_t len)
1876 {
1877 	ASSERT(mp);
1878 
1879 	if (len != 0) {
1880 		/* Assert for room left */
1881 		ASSERT(mp->b_datap->db_lim - mp->b_wptr >= len);
1882 		if (buf != NULL)
1883 			bcopy(buf, mp->b_wptr, len);
1884 		else
1885 			bzero(mp->b_wptr, len);
1886 	}
1887 	mp->b_wptr += len;
1888 }
1889 
1890 /*
1891  * Create a message using two kernel buffers.
1892  * If size is set that will determine the allocation size (e.g. for future
1893  * soappendmsg calls). If size is zero it is derived from the buffer
1894  * lengths.
1895  */
1896 mblk_t *
1897 soallocproto2(const void *buf1, ssize_t len1, const void *buf2, ssize_t len2,
1898     ssize_t size, int sleepflg)
1899 {
1900 	mblk_t *mp;
1901 
1902 	if (size == 0)
1903 		size = len1 + len2;
1904 	ASSERT(size >= len1 + len2);
1905 
1906 	mp = soallocproto1(buf1, len1, size, sleepflg);
1907 	if (mp)
1908 		soappendmsg(mp, buf2, len2);
1909 	return (mp);
1910 }
1911 
1912 /*
1913  * Create a message using three kernel buffers.
1914  * If size is set that will determine the allocation size (for future
1915  * soappendmsg calls). If size is zero it is derived from the buffer
1916  * lengths.
1917  */
1918 mblk_t *
1919 soallocproto3(const void *buf1, ssize_t len1, const void *buf2, ssize_t len2,
1920     const void *buf3, ssize_t len3, ssize_t size, int sleepflg)
1921 {
1922 	mblk_t *mp;
1923 
1924 	if (size == 0)
1925 		size = len1 + len2 +len3;
1926 	ASSERT(size >= len1 + len2 + len3);
1927 
1928 	mp = soallocproto1(buf1, len1, size, sleepflg);
1929 	if (mp != NULL) {
1930 		soappendmsg(mp, buf2, len2);
1931 		soappendmsg(mp, buf3, len3);
1932 	}
1933 	return (mp);
1934 }
1935 
1936 #ifdef DEBUG
1937 char *
1938 pr_state(uint_t state, uint_t mode)
1939 {
1940 	static char buf[1024];
1941 
1942 	buf[0] = 0;
1943 	if (state & SS_ISCONNECTED)
1944 		strcat(buf, "ISCONNECTED ");
1945 	if (state & SS_ISCONNECTING)
1946 		strcat(buf, "ISCONNECTING ");
1947 	if (state & SS_ISDISCONNECTING)
1948 		strcat(buf, "ISDISCONNECTING ");
1949 	if (state & SS_CANTSENDMORE)
1950 		strcat(buf, "CANTSENDMORE ");
1951 
1952 	if (state & SS_CANTRCVMORE)
1953 		strcat(buf, "CANTRCVMORE ");
1954 	if (state & SS_ISBOUND)
1955 		strcat(buf, "ISBOUND ");
1956 	if (state & SS_NDELAY)
1957 		strcat(buf, "NDELAY ");
1958 	if (state & SS_NONBLOCK)
1959 		strcat(buf, "NONBLOCK ");
1960 
1961 	if (state & SS_ASYNC)
1962 		strcat(buf, "ASYNC ");
1963 	if (state & SS_ACCEPTCONN)
1964 		strcat(buf, "ACCEPTCONN ");
1965 	if (state & SS_HASCONNIND)
1966 		strcat(buf, "HASCONNIND ");
1967 	if (state & SS_SAVEDEOR)
1968 		strcat(buf, "SAVEDEOR ");
1969 
1970 	if (state & SS_RCVATMARK)
1971 		strcat(buf, "RCVATMARK ");
1972 	if (state & SS_OOBPEND)
1973 		strcat(buf, "OOBPEND ");
1974 	if (state & SS_HAVEOOBDATA)
1975 		strcat(buf, "HAVEOOBDATA ");
1976 	if (state & SS_HADOOBDATA)
1977 		strcat(buf, "HADOOBDATA ");
1978 
1979 	if (state & SS_FADDR_NOXLATE)
1980 		strcat(buf, "FADDR_NOXLATE ");
1981 
1982 	if (mode & SM_PRIV)
1983 		strcat(buf, "PRIV ");
1984 	if (mode & SM_ATOMIC)
1985 		strcat(buf, "ATOMIC ");
1986 	if (mode & SM_ADDR)
1987 		strcat(buf, "ADDR ");
1988 	if (mode & SM_CONNREQUIRED)
1989 		strcat(buf, "CONNREQUIRED ");
1990 
1991 	if (mode & SM_FDPASSING)
1992 		strcat(buf, "FDPASSING ");
1993 	if (mode & SM_EXDATA)
1994 		strcat(buf, "EXDATA ");
1995 	if (mode & SM_OPTDATA)
1996 		strcat(buf, "OPTDATA ");
1997 	if (mode & SM_BYTESTREAM)
1998 		strcat(buf, "BYTESTREAM ");
1999 	return (buf);
2000 }
2001 
2002 char *
2003 pr_addr(int family, struct sockaddr *addr, t_uscalar_t addrlen)
2004 {
2005 	static char buf[1024];
2006 
2007 	if (addr == NULL || addrlen == 0) {
2008 		sprintf(buf, "(len %d) %p", addrlen, addr);
2009 		return (buf);
2010 	}
2011 	switch (family) {
2012 	case AF_INET: {
2013 		struct sockaddr_in sin;
2014 
2015 		bcopy(addr, &sin, sizeof (sin));
2016 
2017 		(void) sprintf(buf, "(len %d) %x/%d",
2018 		    addrlen, ntohl(sin.sin_addr.s_addr),
2019 		    ntohs(sin.sin_port));
2020 		break;
2021 	}
2022 	case AF_INET6: {
2023 		struct sockaddr_in6 sin6;
2024 		uint16_t *piece = (uint16_t *)&sin6.sin6_addr;
2025 
2026 		bcopy((char *)addr, (char *)&sin6, sizeof (sin6));
2027 		sprintf(buf, "(len %d) %x:%x:%x:%x:%x:%x:%x:%x/%d",
2028 		    addrlen,
2029 		    ntohs(piece[0]), ntohs(piece[1]),
2030 		    ntohs(piece[2]), ntohs(piece[3]),
2031 		    ntohs(piece[4]), ntohs(piece[5]),
2032 		    ntohs(piece[6]), ntohs(piece[7]),
2033 		    ntohs(sin6.sin6_port));
2034 		break;
2035 	}
2036 	case AF_UNIX: {
2037 		struct sockaddr_un *soun = (struct sockaddr_un *)addr;
2038 
2039 		(void) sprintf(buf, "(len %d) %s",
2040 		    addrlen,
2041 		    (soun == NULL) ? "(none)" : soun->sun_path);
2042 		break;
2043 	}
2044 	default:
2045 		(void) sprintf(buf, "(unknown af %d)", family);
2046 		break;
2047 	}
2048 	return (buf);
2049 }
2050 
2051 /* The logical equivalence operator (a if-and-only-if b) */
2052 #define	EQUIV(a, b)	(((a) && (b)) || (!(a) && (!(b))))
2053 
2054 /*
2055  * Verify limitations and invariants on oob state.
2056  * Return 1 if OK, otherwise 0 so that it can be used as
2057  *	ASSERT(verify_oobstate(so));
2058  */
2059 int
2060 so_verify_oobstate(struct sonode *so)
2061 {
2062 	ASSERT(MUTEX_HELD(&so->so_lock));
2063 
2064 	/*
2065 	 * The possible state combinations are:
2066 	 *	0
2067 	 *	SS_OOBPEND
2068 	 *	SS_OOBPEND|SS_HAVEOOBDATA
2069 	 *	SS_OOBPEND|SS_HADOOBDATA
2070 	 *	SS_HADOOBDATA
2071 	 */
2072 	switch (so->so_state & (SS_OOBPEND|SS_HAVEOOBDATA|SS_HADOOBDATA)) {
2073 	case 0:
2074 	case SS_OOBPEND:
2075 	case SS_OOBPEND|SS_HAVEOOBDATA:
2076 	case SS_OOBPEND|SS_HADOOBDATA:
2077 	case SS_HADOOBDATA:
2078 		break;
2079 	default:
2080 		printf("Bad oob state 1 (%p): counts %d/%d state %s\n",
2081 		    so, so->so_oobsigcnt,
2082 		    so->so_oobcnt, pr_state(so->so_state, so->so_mode));
2083 		return (0);
2084 	}
2085 
2086 	/* SS_RCVATMARK should only be set when SS_OOBPEND is set */
2087 	if ((so->so_state & (SS_RCVATMARK|SS_OOBPEND)) == SS_RCVATMARK) {
2088 		printf("Bad oob state 2 (%p): counts %d/%d state %s\n",
2089 		    so, so->so_oobsigcnt,
2090 		    so->so_oobcnt, pr_state(so->so_state, so->so_mode));
2091 		return (0);
2092 	}
2093 
2094 	/*
2095 	 * (so_oobsigcnt != 0 or SS_RCVATMARK) iff SS_OOBPEND
2096 	 */
2097 	if (!EQUIV((so->so_oobsigcnt != 0) || (so->so_state & SS_RCVATMARK),
2098 	    so->so_state & SS_OOBPEND)) {
2099 		printf("Bad oob state 3 (%p): counts %d/%d state %s\n",
2100 		    so, so->so_oobsigcnt,
2101 		    so->so_oobcnt, pr_state(so->so_state, so->so_mode));
2102 		return (0);
2103 	}
2104 
2105 	/*
2106 	 * Unless SO_OOBINLINE we have so_oobmsg != NULL iff SS_HAVEOOBDATA
2107 	 */
2108 	if (!(so->so_options & SO_OOBINLINE) &&
2109 	    !EQUIV(so->so_oobmsg != NULL, so->so_state & SS_HAVEOOBDATA)) {
2110 		printf("Bad oob state 4 (%p): counts %d/%d state %s\n",
2111 		    so, so->so_oobsigcnt,
2112 		    so->so_oobcnt, pr_state(so->so_state, so->so_mode));
2113 		return (0);
2114 	}
2115 	if (so->so_oobsigcnt < so->so_oobcnt) {
2116 		printf("Bad oob state 5 (%p): counts %d/%d state %s\n",
2117 		    so, so->so_oobsigcnt,
2118 		    so->so_oobcnt, pr_state(so->so_state, so->so_mode));
2119 		return (0);
2120 	}
2121 	return (1);
2122 }
2123 #undef	EQUIV
2124 
2125 #endif /* DEBUG */
2126 
2127 /* initialize sockfs zone specific kstat related items			*/
2128 void *
2129 sock_kstat_init(zoneid_t zoneid)
2130 {
2131 	kstat_t	*ksp;
2132 
2133 	ksp = kstat_create_zone("sockfs", 0, "sock_unix_list", "misc",
2134 	    KSTAT_TYPE_RAW, 0, KSTAT_FLAG_VAR_SIZE|KSTAT_FLAG_VIRTUAL, zoneid);
2135 
2136 	if (ksp != NULL) {
2137 		ksp->ks_update = sockfs_update;
2138 		ksp->ks_snapshot = sockfs_snapshot;
2139 		ksp->ks_lock = &socklist.sl_lock;
2140 		ksp->ks_private = (void *)(uintptr_t)zoneid;
2141 		kstat_install(ksp);
2142 	}
2143 
2144 	return (ksp);
2145 }
2146 
2147 /* tear down sockfs zone specific kstat related items			*/
2148 /*ARGSUSED*/
2149 void
2150 sock_kstat_fini(zoneid_t zoneid, void *arg)
2151 {
2152 	kstat_t *ksp = (kstat_t *)arg;
2153 
2154 	if (ksp != NULL) {
2155 		ASSERT(zoneid == (zoneid_t)(uintptr_t)ksp->ks_private);
2156 		kstat_delete(ksp);
2157 	}
2158 }
2159 
2160 /*
2161  * Zones:
2162  * Note that nactive is going to be different for each zone.
2163  * This means we require kstat to call sockfs_update and then sockfs_snapshot
2164  * for the same zone, or sockfs_snapshot will be taken into the wrong size
2165  * buffer. This is safe, but if the buffer is too small, user will not be
2166  * given details of all sockets. However, as this kstat has a ks_lock, kstat
2167  * driver will keep it locked between the update and the snapshot, so no
2168  * other process (zone) can currently get inbetween resulting in a wrong size
2169  * buffer allocation.
2170  */
2171 static int
2172 sockfs_update(kstat_t *ksp, int rw)
2173 {
2174 	uint_t	nactive = 0;		/* # of active AF_UNIX sockets	*/
2175 	struct sonode	*so;		/* current sonode on socklist	*/
2176 	zoneid_t	myzoneid = (zoneid_t)(uintptr_t)ksp->ks_private;
2177 
2178 	ASSERT((zoneid_t)(uintptr_t)ksp->ks_private == getzoneid());
2179 
2180 	if (rw == KSTAT_WRITE) {	/* bounce all writes		*/
2181 		return (EACCES);
2182 	}
2183 
2184 	for (so = socklist.sl_list; so != NULL; so = so->so_next) {
2185 		if (so->so_accessvp != NULL && so->so_zoneid == myzoneid) {
2186 			nactive++;
2187 		}
2188 	}
2189 	ksp->ks_ndata = nactive;
2190 	ksp->ks_data_size = nactive * sizeof (struct k_sockinfo);
2191 
2192 	return (0);
2193 }
2194 
2195 static int
2196 sockfs_snapshot(kstat_t *ksp, void *buf, int rw)
2197 {
2198 	int			ns;	/* # of sonodes we've copied	*/
2199 	struct sonode		*so;	/* current sonode on socklist	*/
2200 	struct k_sockinfo	*pksi;	/* where we put sockinfo data	*/
2201 	t_uscalar_t		sn_len;	/* soa_len			*/
2202 	zoneid_t		myzoneid = (zoneid_t)(uintptr_t)ksp->ks_private;
2203 
2204 	ASSERT((zoneid_t)(uintptr_t)ksp->ks_private == getzoneid());
2205 
2206 	ksp->ks_snaptime = gethrtime();
2207 
2208 	if (rw == KSTAT_WRITE) {	/* bounce all writes		*/
2209 		return (EACCES);
2210 	}
2211 
2212 	/*
2213 	 * for each sonode on the socklist, we massage the important
2214 	 * info into buf, in k_sockinfo format.
2215 	 */
2216 	pksi = (struct k_sockinfo *)buf;
2217 	for (ns = 0, so = socklist.sl_list; so != NULL; so = so->so_next) {
2218 		/* only stuff active sonodes and the same zone:		*/
2219 		if (so->so_accessvp == NULL || so->so_zoneid != myzoneid) {
2220 			continue;
2221 		}
2222 
2223 		/*
2224 		 * If the sonode was activated between the update and the
2225 		 * snapshot, we're done - as this is only a snapshot.
2226 		 */
2227 		if ((caddr_t)(pksi) >= (caddr_t)buf + ksp->ks_data_size) {
2228 			break;
2229 		}
2230 
2231 		/* copy important info into buf:			*/
2232 		pksi->ks_si.si_size = sizeof (struct k_sockinfo);
2233 		pksi->ks_si.si_family = so->so_family;
2234 		pksi->ks_si.si_type = so->so_type;
2235 		pksi->ks_si.si_flag = so->so_flag;
2236 		pksi->ks_si.si_state = so->so_state;
2237 		pksi->ks_si.si_serv_type = so->so_serv_type;
2238 		pksi->ks_si.si_ux_laddr_sou_magic = so->so_ux_laddr.soua_magic;
2239 		pksi->ks_si.si_ux_faddr_sou_magic = so->so_ux_faddr.soua_magic;
2240 		pksi->ks_si.si_laddr_soa_len = so->so_laddr.soa_len;
2241 		pksi->ks_si.si_faddr_soa_len = so->so_faddr.soa_len;
2242 		pksi->ks_si.si_szoneid = so->so_zoneid;
2243 
2244 		mutex_enter(&so->so_lock);
2245 
2246 		if (so->so_laddr_sa != NULL) {
2247 			ASSERT(so->so_laddr_sa->sa_data != NULL);
2248 			sn_len = so->so_laddr_len;
2249 			ASSERT(sn_len <= sizeof (short) +
2250 			    sizeof (pksi->ks_si.si_laddr_sun_path));
2251 
2252 			pksi->ks_si.si_laddr_family =
2253 			    so->so_laddr_sa->sa_family;
2254 			if (sn_len != 0) {
2255 				/* AF_UNIX socket names are NULL terminated */
2256 				(void) strncpy(pksi->ks_si.si_laddr_sun_path,
2257 				    so->so_laddr_sa->sa_data,
2258 				    sizeof (pksi->ks_si.si_laddr_sun_path));
2259 				sn_len = strlen(pksi->ks_si.si_laddr_sun_path);
2260 			}
2261 			pksi->ks_si.si_laddr_sun_path[sn_len] = 0;
2262 		}
2263 
2264 		if (so->so_faddr_sa != NULL) {
2265 			ASSERT(so->so_faddr_sa->sa_data != NULL);
2266 			sn_len = so->so_faddr_len;
2267 			ASSERT(sn_len <= sizeof (short) +
2268 			    sizeof (pksi->ks_si.si_faddr_sun_path));
2269 
2270 			pksi->ks_si.si_faddr_family =
2271 			    so->so_faddr_sa->sa_family;
2272 			if (sn_len != 0) {
2273 				(void) strncpy(pksi->ks_si.si_faddr_sun_path,
2274 				    so->so_faddr_sa->sa_data,
2275 				    sizeof (pksi->ks_si.si_faddr_sun_path));
2276 				sn_len = strlen(pksi->ks_si.si_faddr_sun_path);
2277 			}
2278 			pksi->ks_si.si_faddr_sun_path[sn_len] = 0;
2279 		}
2280 
2281 		mutex_exit(&so->so_lock);
2282 
2283 		(void) sprintf(pksi->ks_straddr[0], "%p", (void *)so);
2284 		(void) sprintf(pksi->ks_straddr[1], "%p",
2285 		    (void *)so->so_ux_laddr.soua_vp);
2286 		(void) sprintf(pksi->ks_straddr[2], "%p",
2287 		    (void *)so->so_ux_faddr.soua_vp);
2288 
2289 		ns++;
2290 		pksi++;
2291 	}
2292 
2293 	ksp->ks_ndata = ns;
2294 	return (0);
2295 }
2296 
2297 ssize_t
2298 soreadfile(file_t *fp, uchar_t *buf, u_offset_t fileoff, int *err, size_t size)
2299 {
2300 	struct uio auio;
2301 	struct iovec aiov[MSG_MAXIOVLEN];
2302 	register vnode_t *vp;
2303 	int ioflag, rwflag;
2304 	ssize_t cnt;
2305 	int error = 0;
2306 	int iovcnt = 0;
2307 	short fflag;
2308 
2309 	vp = fp->f_vnode;
2310 	fflag = fp->f_flag;
2311 
2312 	rwflag = 0;
2313 	aiov[0].iov_base = (caddr_t)buf;
2314 	aiov[0].iov_len = size;
2315 	iovcnt = 1;
2316 	cnt = (ssize_t)size;
2317 	(void) VOP_RWLOCK(vp, rwflag, NULL);
2318 
2319 	auio.uio_loffset = fileoff;
2320 	auio.uio_iov = aiov;
2321 	auio.uio_iovcnt = iovcnt;
2322 	auio.uio_resid = cnt;
2323 	auio.uio_segflg = UIO_SYSSPACE;
2324 	auio.uio_llimit = MAXOFFSET_T;
2325 	auio.uio_fmode = fflag;
2326 	auio.uio_extflg = UIO_COPY_CACHED;
2327 
2328 	ioflag = auio.uio_fmode & (FAPPEND|FSYNC|FDSYNC|FRSYNC);
2329 
2330 	/* If read sync is not asked for, filter sync flags */
2331 	if ((ioflag & FRSYNC) == 0)
2332 		ioflag &= ~(FSYNC|FDSYNC);
2333 	error = VOP_READ(vp, &auio, ioflag, fp->f_cred, NULL);
2334 	cnt -= auio.uio_resid;
2335 
2336 	VOP_RWUNLOCK(vp, rwflag, NULL);
2337 
2338 	if (error == EINTR && cnt != 0)
2339 		error = 0;
2340 out:
2341 	if (error != 0) {
2342 		*err = error;
2343 		return (0);
2344 	} else {
2345 		*err = 0;
2346 		return (cnt);
2347 	}
2348 }
2349