xref: /titanic_41/usr/src/uts/common/fs/sockfs/socktpi.c (revision efd31e1d839d4665462b5c267a1c654548082663)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright (c) 1995, 2010, Oracle and/or its affiliates. All rights reserved.
24  */
25 
26 #include <sys/types.h>
27 #include <sys/t_lock.h>
28 #include <sys/param.h>
29 #include <sys/systm.h>
30 #include <sys/buf.h>
31 #include <sys/conf.h>
32 #include <sys/cred.h>
33 #include <sys/kmem.h>
34 #include <sys/kmem_impl.h>
35 #include <sys/sysmacros.h>
36 #include <sys/vfs.h>
37 #include <sys/vnode.h>
38 #include <sys/debug.h>
39 #include <sys/errno.h>
40 #include <sys/time.h>
41 #include <sys/file.h>
42 #include <sys/open.h>
43 #include <sys/user.h>
44 #include <sys/termios.h>
45 #include <sys/stream.h>
46 #include <sys/strsubr.h>
47 #include <sys/strsun.h>
48 #include <sys/suntpi.h>
49 #include <sys/ddi.h>
50 #include <sys/esunddi.h>
51 #include <sys/flock.h>
52 #include <sys/modctl.h>
53 #include <sys/vtrace.h>
54 #include <sys/cmn_err.h>
55 #include <sys/pathname.h>
56 
57 #include <sys/socket.h>
58 #include <sys/socketvar.h>
59 #include <sys/sockio.h>
60 #include <netinet/in.h>
61 #include <sys/un.h>
62 #include <sys/strsun.h>
63 
64 #include <sys/tiuser.h>
65 #define	_SUN_TPI_VERSION	2
66 #include <sys/tihdr.h>
67 #include <sys/timod.h>		/* TI_GETMYNAME, TI_GETPEERNAME */
68 
69 #include <c2/audit.h>
70 
71 #include <inet/common.h>
72 #include <inet/ip.h>
73 #include <inet/ip6.h>
74 #include <inet/tcp.h>
75 #include <inet/udp_impl.h>
76 
77 #include <sys/zone.h>
78 
79 #include <fs/sockfs/nl7c.h>
80 #include <fs/sockfs/nl7curi.h>
81 
82 #include <fs/sockfs/sockcommon.h>
83 #include <fs/sockfs/socktpi.h>
84 #include <fs/sockfs/socktpi_impl.h>
85 
86 /*
87  * Possible failures when memory can't be allocated. The documented behavior:
88  *
89  * 		5.5:			4.X:		XNET:
90  * accept:	ENOMEM/ENOSR/EINTR	- (EINTR)	ENOMEM/ENOBUFS/ENOSR/
91  *							EINTR
92  *	(4.X does not document EINTR but returns it)
93  * bind:	ENOSR			-		ENOBUFS/ENOSR
94  * connect: 	EINTR			EINTR		ENOBUFS/ENOSR/EINTR
95  * getpeername:	ENOMEM/ENOSR		ENOBUFS (-)	ENOBUFS/ENOSR
96  * getsockname:	ENOMEM/ENOSR		ENOBUFS (-)	ENOBUFS/ENOSR
97  *	(4.X getpeername and getsockname do not fail in practice)
98  * getsockopt:	ENOMEM/ENOSR		-		ENOBUFS/ENOSR
99  * listen:	-			-		ENOBUFS
100  * recv:	ENOMEM/ENOSR/EINTR	EINTR		ENOBUFS/ENOMEM/ENOSR/
101  *							EINTR
102  * send:	ENOMEM/ENOSR/EINTR	ENOBUFS/EINTR	ENOBUFS/ENOMEM/ENOSR/
103  *							EINTR
104  * setsockopt:	ENOMEM/ENOSR		-		ENOBUFS/ENOMEM/ENOSR
105  * shutdown:	ENOMEM/ENOSR		-		ENOBUFS/ENOSR
106  * socket:	ENOMEM/ENOSR		ENOBUFS		ENOBUFS/ENOMEM/ENOSR
107  * socketpair:	ENOMEM/ENOSR		-		ENOBUFS/ENOMEM/ENOSR
108  *
109  * Resolution. When allocation fails:
110  *	recv: return EINTR
111  *	send: return EINTR
112  *	connect, accept: EINTR
113  *	bind, listen, shutdown (unbind, unix_close, disconnect): sleep
114  *	socket, socketpair: ENOBUFS
115  *	getpeername, getsockname: sleep
116  *	getsockopt, setsockopt: sleep
117  */
118 
119 #ifdef SOCK_TEST
120 /*
121  * Variables that make sockfs do something other than the standard TPI
122  * for the AF_INET transports.
123  *
124  * solisten_tpi_tcp:
125  *	TCP can handle a O_T_BIND_REQ with an increased backlog even though
126  *	the transport is already bound. This is needed to avoid loosing the
127  *	port number should listen() do a T_UNBIND_REQ followed by a
128  *	O_T_BIND_REQ.
129  *
130  * soconnect_tpi_udp:
131  *	UDP and ICMP can handle a T_CONN_REQ.
132  *	This is needed to make the sequence of connect(), getsockname()
133  *	return the local IP address used to send packets to the connected to
134  *	destination.
135  *
136  * soconnect_tpi_tcp:
137  *	TCP can handle a T_CONN_REQ without seeing a O_T_BIND_REQ.
138  *	Set this to non-zero to send TPI conformant messages to TCP in this
139  *	respect. This is a performance optimization.
140  *
141  * soaccept_tpi_tcp:
142  *	TCP can handle a T_CONN_REQ without the acceptor being bound.
143  *	This is a performance optimization that has been picked up in XTI.
144  *
145  * soaccept_tpi_multioptions:
146  *	When inheriting SOL_SOCKET options from the listener to the accepting
147  *	socket send them as a single message for AF_INET{,6}.
148  */
149 int solisten_tpi_tcp = 0;
150 int soconnect_tpi_udp = 0;
151 int soconnect_tpi_tcp = 0;
152 int soaccept_tpi_tcp = 0;
153 int soaccept_tpi_multioptions = 1;
154 #else /* SOCK_TEST */
155 #define	soconnect_tpi_tcp	0
156 #define	soconnect_tpi_udp	0
157 #define	solisten_tpi_tcp	0
158 #define	soaccept_tpi_tcp	0
159 #define	soaccept_tpi_multioptions	1
160 #endif /* SOCK_TEST */
161 
162 #ifdef SOCK_TEST
163 extern int do_useracc;
164 extern clock_t sock_test_timelimit;
165 #endif /* SOCK_TEST */
166 
167 /*
168  * Some X/Open added checks might have to be backed out to keep SunOS 4.X
169  * applications working. Turn on this flag to disable these checks.
170  */
171 int xnet_skip_checks = 0;
172 int xnet_check_print = 0;
173 int xnet_truncate_print = 0;
174 
175 static void sotpi_destroy(struct sonode *);
176 static struct sonode *sotpi_create(struct sockparams *, int, int, int, int,
177     int, int *, cred_t *cr);
178 
179 static boolean_t	sotpi_info_create(struct sonode *, int);
180 static void		sotpi_info_init(struct sonode *);
181 static void 		sotpi_info_fini(struct sonode *);
182 static void 		sotpi_info_destroy(struct sonode *);
183 
184 /*
185  * Do direct function call to the transport layer below; this would
186  * also allow the transport to utilize read-side synchronous stream
187  * interface if necessary.  This is a /etc/system tunable that must
188  * not be modified on a running system.  By default this is enabled
189  * for performance reasons and may be disabled for debugging purposes.
190  */
191 boolean_t socktpi_direct = B_TRUE;
192 
193 static struct kmem_cache *socktpi_cache, *socktpi_unix_cache;
194 
195 extern	void sigintr(k_sigset_t *, int);
196 extern	void sigunintr(k_sigset_t *);
197 
198 static int	sotpi_unbind(struct sonode *, int);
199 
200 /* TPI sockfs sonode operations */
201 int 		sotpi_init(struct sonode *, struct sonode *, struct cred *,
202 		    int);
203 static int	sotpi_accept(struct sonode *, int, struct cred *,
204 		    struct sonode **);
205 static int	sotpi_bind(struct sonode *, struct sockaddr *, socklen_t,
206 		    int, struct cred *);
207 static int	sotpi_listen(struct sonode *, int, struct cred *);
208 static int	sotpi_connect(struct sonode *, struct sockaddr *,
209 		    socklen_t, int, int, struct cred *);
210 extern int	sotpi_recvmsg(struct sonode *, struct nmsghdr *,
211 		    struct uio *, struct cred *);
212 static int	sotpi_sendmsg(struct sonode *, struct nmsghdr *,
213 		    struct uio *, struct cred *);
214 static int	sotpi_sendmblk(struct sonode *, struct nmsghdr *, int,
215 		    struct cred *, mblk_t **);
216 static int	sosend_dgramcmsg(struct sonode *, struct sockaddr *, socklen_t,
217 		    struct uio *, void *, t_uscalar_t, int);
218 static int	sodgram_direct(struct sonode *, struct sockaddr *,
219 		    socklen_t, struct uio *, int);
220 extern int	sotpi_getpeername(struct sonode *, struct sockaddr *,
221 		    socklen_t *, boolean_t, struct cred *);
222 static int	sotpi_getsockname(struct sonode *, struct sockaddr *,
223 		    socklen_t *, struct cred *);
224 static int	sotpi_shutdown(struct sonode *, int, struct cred *);
225 extern int	sotpi_getsockopt(struct sonode *, int, int, void *,
226 		    socklen_t *, int, struct cred *);
227 extern int	sotpi_setsockopt(struct sonode *, int, int, const void *,
228 		    socklen_t, struct cred *);
229 static int 	sotpi_ioctl(struct sonode *, int, intptr_t, int, struct cred *,
230 		    int32_t *);
231 static int 	socktpi_plumbioctl(struct vnode *, int, intptr_t, int,
232 		    struct cred *, int32_t *);
233 static int 	sotpi_poll(struct sonode *, short, int, short *,
234 		    struct pollhead **);
235 static int 	sotpi_close(struct sonode *, int, struct cred *);
236 
237 static int	i_sotpi_info_constructor(sotpi_info_t *);
238 static void 	i_sotpi_info_destructor(sotpi_info_t *);
239 
240 sonodeops_t sotpi_sonodeops = {
241 	sotpi_init,		/* sop_init		*/
242 	sotpi_accept,		/* sop_accept		*/
243 	sotpi_bind,		/* sop_bind		*/
244 	sotpi_listen,		/* sop_listen		*/
245 	sotpi_connect,		/* sop_connect		*/
246 	sotpi_recvmsg,		/* sop_recvmsg		*/
247 	sotpi_sendmsg,		/* sop_sendmsg		*/
248 	sotpi_sendmblk,		/* sop_sendmblk		*/
249 	sotpi_getpeername,	/* sop_getpeername	*/
250 	sotpi_getsockname,	/* sop_getsockname	*/
251 	sotpi_shutdown,		/* sop_shutdown		*/
252 	sotpi_getsockopt,	/* sop_getsockopt	*/
253 	sotpi_setsockopt,	/* sop_setsockopt	*/
254 	sotpi_ioctl,		/* sop_ioctl		*/
255 	sotpi_poll,		/* sop_poll		*/
256 	sotpi_close,		/* sop_close		*/
257 };
258 
259 /*
260  * Return a TPI socket vnode.
261  *
262  * Note that sockets assume that the driver will clone (either itself
263  * or by using the clone driver) i.e. a socket() call will always
264  * result in a new vnode being created.
265  */
266 
267 /*
268  * Common create code for socket and accept. If tso is set the values
269  * from that node is used instead of issuing a T_INFO_REQ.
270  */
271 
272 /* ARGSUSED */
273 static struct sonode *
274 sotpi_create(struct sockparams *sp, int family, int type, int protocol,
275     int version, int sflags, int *errorp, cred_t *cr)
276 {
277 	struct sonode	*so;
278 	kmem_cache_t 	*cp;
279 	int		sfamily = family;
280 
281 	ASSERT(sp->sp_sdev_info.sd_vnode != NULL);
282 
283 	if (family == AF_NCA) {
284 		/*
285 		 * The request is for an NCA socket so for NL7C use the
286 		 * INET domain instead and mark NL7C_AF_NCA below.
287 		 */
288 		family = AF_INET;
289 		/*
290 		 * NL7C is not supported in the non-global zone,
291 		 * we enforce this restriction here.
292 		 */
293 		if (getzoneid() != GLOBAL_ZONEID) {
294 			*errorp = ENOTSUP;
295 			return (NULL);
296 		}
297 	}
298 
299 	/*
300 	 * to be compatible with old tpi socket implementation ignore
301 	 * sleep flag (sflags) passed in
302 	 */
303 	cp = (family == AF_UNIX) ? socktpi_unix_cache : socktpi_cache;
304 	so = kmem_cache_alloc(cp, KM_SLEEP);
305 	if (so == NULL) {
306 		*errorp = ENOMEM;
307 		return (NULL);
308 	}
309 
310 	sonode_init(so, sp, family, type, protocol, &sotpi_sonodeops);
311 	sotpi_info_init(so);
312 
313 	if (sfamily == AF_NCA) {
314 		SOTOTPI(so)->sti_nl7c_flags = NL7C_AF_NCA;
315 	}
316 
317 	if (version == SOV_DEFAULT)
318 		version = so_default_version;
319 
320 	so->so_version = (short)version;
321 	*errorp = 0;
322 
323 	return (so);
324 }
325 
326 static void
327 sotpi_destroy(struct sonode *so)
328 {
329 	kmem_cache_t *cp;
330 	struct sockparams *origsp;
331 
332 	/*
333 	 * If there is a new dealloc function (ie. smod_destroy_func),
334 	 * then it should check the correctness of the ops.
335 	 */
336 
337 	ASSERT(so->so_ops == &sotpi_sonodeops);
338 
339 	origsp = SOTOTPI(so)->sti_orig_sp;
340 
341 	sotpi_info_fini(so);
342 
343 	if (so->so_state & SS_FALLBACK_COMP) {
344 		/*
345 		 * A fallback happend, which means that a sotpi_info_t struct
346 		 * was allocated (as opposed to being allocated from the TPI
347 		 * sonode cache. Therefore we explicitly free the struct
348 		 * here.
349 		 */
350 		sotpi_info_destroy(so);
351 		ASSERT(origsp != NULL);
352 
353 		origsp->sp_smod_info->smod_sock_destroy_func(so);
354 		SOCKPARAMS_DEC_REF(origsp);
355 	} else {
356 		sonode_fini(so);
357 		cp = (so->so_family == AF_UNIX) ? socktpi_unix_cache :
358 		    socktpi_cache;
359 		kmem_cache_free(cp, so);
360 	}
361 }
362 
363 /* ARGSUSED1 */
364 int
365 sotpi_init(struct sonode *so, struct sonode *tso, struct cred *cr, int flags)
366 {
367 	major_t maj;
368 	dev_t newdev;
369 	struct vnode *vp;
370 	int error = 0;
371 	struct stdata *stp;
372 
373 	sotpi_info_t *sti = SOTOTPI(so);
374 
375 	dprint(1, ("sotpi_init()\n"));
376 
377 	/*
378 	 * over write the sleep flag passed in but that is ok
379 	 * as tpi socket does not honor sleep flag.
380 	 */
381 	flags |= FREAD|FWRITE;
382 
383 	/*
384 	 * Record in so_flag that it is a clone.
385 	 */
386 	if (getmajor(sti->sti_dev) == clone_major)
387 		so->so_flag |= SOCLONE;
388 
389 	if ((so->so_type == SOCK_STREAM || so->so_type == SOCK_DGRAM) &&
390 	    (so->so_family == AF_INET || so->so_family == AF_INET6) &&
391 	    (so->so_protocol == IPPROTO_TCP || so->so_protocol == IPPROTO_UDP ||
392 	    so->so_protocol == IPPROTO_IP)) {
393 		/* Tell tcp or udp that it's talking to sockets */
394 		flags |= SO_SOCKSTR;
395 
396 		/*
397 		 * Here we indicate to socktpi_open() our attempt to
398 		 * make direct calls between sockfs and transport.
399 		 * The final decision is left to socktpi_open().
400 		 */
401 		sti->sti_direct = 1;
402 
403 		ASSERT(so->so_type != SOCK_DGRAM || tso == NULL);
404 		if (so->so_type == SOCK_STREAM && tso != NULL) {
405 			if (SOTOTPI(tso)->sti_direct) {
406 				/*
407 				 * Inherit sti_direct from listener and pass
408 				 * SO_ACCEPTOR open flag to tcp, indicating
409 				 * that this is an accept fast-path instance.
410 				 */
411 				flags |= SO_ACCEPTOR;
412 			} else {
413 				/*
414 				 * sti_direct is not set on listener, meaning
415 				 * that the listener has been converted from
416 				 * a socket to a stream.  Ensure that the
417 				 * acceptor inherits these settings.
418 				 */
419 				sti->sti_direct = 0;
420 				flags &= ~SO_SOCKSTR;
421 			}
422 		}
423 	}
424 
425 	/*
426 	 * Tell local transport that it is talking to sockets.
427 	 */
428 	if (so->so_family == AF_UNIX) {
429 		flags |= SO_SOCKSTR;
430 	}
431 
432 	vp = SOTOV(so);
433 	newdev = vp->v_rdev;
434 	maj = getmajor(newdev);
435 	ASSERT(STREAMSTAB(maj));
436 
437 	error = stropen(vp, &newdev, flags, cr);
438 
439 	stp = vp->v_stream;
440 	if (error == 0) {
441 		if (so->so_flag & SOCLONE)
442 			ASSERT(newdev != vp->v_rdev);
443 		mutex_enter(&so->so_lock);
444 		sti->sti_dev = newdev;
445 		vp->v_rdev = newdev;
446 		mutex_exit(&so->so_lock);
447 
448 		if (stp->sd_flag & STRISTTY) {
449 			/*
450 			 * this is a post SVR4 tty driver - a socket can not
451 			 * be a controlling terminal. Fail the open.
452 			 */
453 			(void) sotpi_close(so, flags, cr);
454 			return (ENOTTY);	/* XXX */
455 		}
456 
457 		ASSERT(stp->sd_wrq != NULL);
458 		sti->sti_provinfo = tpi_findprov(stp->sd_wrq);
459 
460 		/*
461 		 * If caller is interested in doing direct function call
462 		 * interface to/from transport module, probe the module
463 		 * directly beneath the streamhead to see if it qualifies.
464 		 *
465 		 * We turn off the direct interface when qualifications fail.
466 		 * In the acceptor case, we simply turn off the sti_direct
467 		 * flag on the socket. We do the fallback after the accept
468 		 * has completed, before the new socket is returned to the
469 		 * application.
470 		 */
471 		if (sti->sti_direct) {
472 			queue_t *tq = stp->sd_wrq->q_next;
473 
474 			/*
475 			 * sti_direct is currently supported and tested
476 			 * only for tcp/udp; this is the main reason to
477 			 * have the following assertions.
478 			 */
479 			ASSERT(so->so_family == AF_INET ||
480 			    so->so_family == AF_INET6);
481 			ASSERT(so->so_protocol == IPPROTO_UDP ||
482 			    so->so_protocol == IPPROTO_TCP ||
483 			    so->so_protocol == IPPROTO_IP);
484 			ASSERT(so->so_type == SOCK_DGRAM ||
485 			    so->so_type == SOCK_STREAM);
486 
487 			/*
488 			 * Abort direct call interface if the module directly
489 			 * underneath the stream head is not defined with the
490 			 * _D_DIRECT flag.  This could happen in the tcp or
491 			 * udp case, when some other module is autopushed
492 			 * above it, or for some reasons the expected module
493 			 * isn't purely D_MP (which is the main requirement).
494 			 */
495 			if (!socktpi_direct || !(tq->q_flag & _QDIRECT) ||
496 			    !(_OTHERQ(tq)->q_flag & _QDIRECT)) {
497 				int rval;
498 
499 				/* Continue on without direct calls */
500 				sti->sti_direct = 0;
501 
502 				/*
503 				 * Cannot issue ioctl on fallback socket since
504 				 * there is no conn associated with the queue.
505 				 * The fallback downcall will notify the proto
506 				 * of the change.
507 				 */
508 				if (!(flags & SO_ACCEPTOR) &&
509 				    !(flags & SO_FALLBACK)) {
510 					if ((error = strioctl(vp,
511 					    _SIOCSOCKFALLBACK, 0, 0, K_TO_K,
512 					    cr, &rval)) != 0) {
513 						(void) sotpi_close(so, flags,
514 						    cr);
515 						return (error);
516 					}
517 				}
518 			}
519 		}
520 
521 		if (flags & SO_FALLBACK) {
522 			/*
523 			 * The stream created does not have a conn.
524 			 * do stream set up after conn has been assigned
525 			 */
526 			return (error);
527 		}
528 		if (error = so_strinit(so, tso)) {
529 			(void) sotpi_close(so, flags, cr);
530 			return (error);
531 		}
532 
533 		/* Wildcard */
534 		if (so->so_protocol != so->so_sockparams->sp_protocol) {
535 			int protocol = so->so_protocol;
536 			/*
537 			 * Issue SO_PROTOTYPE setsockopt.
538 			 */
539 			error = sotpi_setsockopt(so, SOL_SOCKET, SO_PROTOTYPE,
540 			    &protocol, (t_uscalar_t)sizeof (protocol), cr);
541 			if (error != 0) {
542 				(void) sotpi_close(so, flags, cr);
543 				/*
544 				 * Setsockopt often fails with ENOPROTOOPT but
545 				 * socket() should fail with
546 				 * EPROTONOSUPPORT/EPROTOTYPE.
547 				 */
548 				return (EPROTONOSUPPORT);
549 			}
550 		}
551 
552 	} else {
553 		/*
554 		 * While the same socket can not be reopened (unlike specfs)
555 		 * the stream head sets STREOPENFAIL when the autopush fails.
556 		 */
557 		if ((stp != NULL) &&
558 		    (stp->sd_flag & STREOPENFAIL)) {
559 			/*
560 			 * Open failed part way through.
561 			 */
562 			mutex_enter(&stp->sd_lock);
563 			stp->sd_flag &= ~STREOPENFAIL;
564 			mutex_exit(&stp->sd_lock);
565 			(void) sotpi_close(so, flags, cr);
566 			return (error);
567 			/*NOTREACHED*/
568 		}
569 		ASSERT(stp == NULL);
570 	}
571 	TRACE_4(TR_FAC_SOCKFS, TR_SOCKFS_OPEN,
572 	    "sockfs open:maj %d vp %p so %p error %d",
573 	    maj, vp, so, error);
574 	return (error);
575 }
576 
577 /*
578  * Bind the socket to an unspecified address in sockfs only.
579  * Used for TCP/UDP transports where we know that the O_T_BIND_REQ isn't
580  * required in all cases.
581  */
582 static void
583 so_automatic_bind(struct sonode *so)
584 {
585 	sotpi_info_t *sti = SOTOTPI(so);
586 	ASSERT(so->so_family == AF_INET || so->so_family == AF_INET6);
587 
588 	ASSERT(MUTEX_HELD(&so->so_lock));
589 	ASSERT(!(so->so_state & SS_ISBOUND));
590 	ASSERT(sti->sti_unbind_mp);
591 
592 	ASSERT(sti->sti_laddr_len <= sti->sti_laddr_maxlen);
593 	bzero(sti->sti_laddr_sa, sti->sti_laddr_len);
594 	sti->sti_laddr_sa->sa_family = so->so_family;
595 	so->so_state |= SS_ISBOUND;
596 }
597 
598 
599 /*
600  * bind the socket.
601  *
602  * If the socket is already bound and none of _SOBIND_SOCKBSD or _SOBIND_XPG4_2
603  * are passed in we allow rebinding. Note that for backwards compatibility
604  * even "svr4" sockets pass in _SOBIND_SOCKBSD/SOV_SOCKBSD to sobind/bind.
605  * Thus the rebinding code is currently not executed.
606  *
607  * The constraints for rebinding are:
608  * - it is a SOCK_DGRAM, or
609  * - it is a SOCK_STREAM/SOCK_SEQPACKET that has not been connected
610  *   and no listen() has been done.
611  * This rebinding code was added based on some language in the XNET book
612  * about not returning EINVAL it the protocol allows rebinding. However,
613  * this language is not present in the Posix socket draft. Thus maybe the
614  * rebinding logic should be deleted from the source.
615  *
616  * A null "name" can be used to unbind the socket if:
617  * - it is a SOCK_DGRAM, or
618  * - it is a SOCK_STREAM/SOCK_SEQPACKET that has not been connected
619  *   and no listen() has been done.
620  */
621 /* ARGSUSED */
622 static int
623 sotpi_bindlisten(struct sonode *so, struct sockaddr *name,
624     socklen_t namelen, int backlog, int flags, struct cred *cr)
625 {
626 	struct T_bind_req	bind_req;
627 	struct T_bind_ack	*bind_ack;
628 	int			error = 0;
629 	mblk_t			*mp;
630 	void			*addr;
631 	t_uscalar_t		addrlen;
632 	int			unbind_on_err = 1;
633 	boolean_t		clear_acceptconn_on_err = B_FALSE;
634 	boolean_t		restore_backlog_on_err = B_FALSE;
635 	int			save_so_backlog;
636 	t_scalar_t		PRIM_type = O_T_BIND_REQ;
637 	boolean_t		tcp_udp_xport;
638 	void			*nl7c = NULL;
639 	sotpi_info_t		*sti = SOTOTPI(so);
640 
641 	dprintso(so, 1, ("sotpi_bindlisten(%p, %p, %d, %d, 0x%x) %s\n",
642 	    (void *)so, (void *)name, namelen, backlog, flags,
643 	    pr_state(so->so_state, so->so_mode)));
644 
645 	tcp_udp_xport = so->so_type == SOCK_STREAM || so->so_type == SOCK_DGRAM;
646 
647 	if (!(flags & _SOBIND_LOCK_HELD)) {
648 		mutex_enter(&so->so_lock);
649 		so_lock_single(so);	/* Set SOLOCKED */
650 	} else {
651 		ASSERT(MUTEX_HELD(&so->so_lock));
652 		ASSERT(so->so_flag & SOLOCKED);
653 	}
654 
655 	/*
656 	 * Make sure that there is a preallocated unbind_req message
657 	 * before binding. This message allocated when the socket is
658 	 * created  but it might be have been consumed.
659 	 */
660 	if (sti->sti_unbind_mp == NULL) {
661 		dprintso(so, 1, ("sobind: allocating unbind_req\n"));
662 		/* NOTE: holding so_lock while sleeping */
663 		sti->sti_unbind_mp =
664 		    soallocproto(sizeof (struct T_unbind_req), _ALLOC_SLEEP,
665 		    cr);
666 	}
667 
668 	if (flags & _SOBIND_REBIND) {
669 		/*
670 		 * Called from solisten after doing an sotpi_unbind() or
671 		 * potentially without the unbind (latter for AF_INET{,6}).
672 		 */
673 		ASSERT(name == NULL && namelen == 0);
674 
675 		if (so->so_family == AF_UNIX) {
676 			ASSERT(sti->sti_ux_bound_vp);
677 			addr = &sti->sti_ux_laddr;
678 			addrlen = (t_uscalar_t)sizeof (sti->sti_ux_laddr);
679 			dprintso(so, 1, ("sobind rebind UNIX: addrlen %d, "
680 			    "addr 0x%p, vp %p\n",
681 			    addrlen,
682 			    (void *)((struct so_ux_addr *)addr)->soua_vp,
683 			    (void *)sti->sti_ux_bound_vp));
684 		} else {
685 			addr = sti->sti_laddr_sa;
686 			addrlen = (t_uscalar_t)sti->sti_laddr_len;
687 		}
688 	} else if (flags & _SOBIND_UNSPEC) {
689 		ASSERT(name == NULL && namelen == 0);
690 
691 		/*
692 		 * The caller checked SS_ISBOUND but not necessarily
693 		 * under so_lock
694 		 */
695 		if (so->so_state & SS_ISBOUND) {
696 			/* No error */
697 			goto done;
698 		}
699 
700 		/* Set an initial local address */
701 		switch (so->so_family) {
702 		case AF_UNIX:
703 			/*
704 			 * Use an address with same size as struct sockaddr
705 			 * just like BSD.
706 			 */
707 			sti->sti_laddr_len =
708 			    (socklen_t)sizeof (struct sockaddr);
709 			ASSERT(sti->sti_laddr_len <= sti->sti_laddr_maxlen);
710 			bzero(sti->sti_laddr_sa, sti->sti_laddr_len);
711 			sti->sti_laddr_sa->sa_family = so->so_family;
712 
713 			/*
714 			 * Pass down an address with the implicit bind
715 			 * magic number and the rest all zeros.
716 			 * The transport will return a unique address.
717 			 */
718 			sti->sti_ux_laddr.soua_vp = NULL;
719 			sti->sti_ux_laddr.soua_magic = SOU_MAGIC_IMPLICIT;
720 			addr = &sti->sti_ux_laddr;
721 			addrlen = (t_uscalar_t)sizeof (sti->sti_ux_laddr);
722 			break;
723 
724 		case AF_INET:
725 		case AF_INET6:
726 			/*
727 			 * An unspecified bind in TPI has a NULL address.
728 			 * Set the address in sockfs to have the sa_family.
729 			 */
730 			sti->sti_laddr_len = (so->so_family == AF_INET) ?
731 			    (socklen_t)sizeof (sin_t) :
732 			    (socklen_t)sizeof (sin6_t);
733 			ASSERT(sti->sti_laddr_len <= sti->sti_laddr_maxlen);
734 			bzero(sti->sti_laddr_sa, sti->sti_laddr_len);
735 			sti->sti_laddr_sa->sa_family = so->so_family;
736 			addr = NULL;
737 			addrlen = 0;
738 			break;
739 
740 		default:
741 			/*
742 			 * An unspecified bind in TPI has a NULL address.
743 			 * Set the address in sockfs to be zero length.
744 			 *
745 			 * Can not assume there is a sa_family for all
746 			 * protocol families. For example, AF_X25 does not
747 			 * have a family field.
748 			 */
749 			bzero(sti->sti_laddr_sa, sti->sti_laddr_len);
750 			sti->sti_laddr_len = 0;	/* XXX correct? */
751 			addr = NULL;
752 			addrlen = 0;
753 			break;
754 		}
755 
756 	} else {
757 		if (so->so_state & SS_ISBOUND) {
758 			/*
759 			 * If it is ok to rebind the socket, first unbind
760 			 * with the transport. A rebind to the NULL address
761 			 * is interpreted as an unbind.
762 			 * Note that a bind to NULL in BSD does unbind the
763 			 * socket but it fails with EINVAL.
764 			 * Note that regular sockets set SOV_SOCKBSD i.e.
765 			 * _SOBIND_SOCKBSD gets set here hence no type of
766 			 * socket does currently allow rebinding.
767 			 *
768 			 * If the name is NULL just do an unbind.
769 			 */
770 			if (flags & (_SOBIND_SOCKBSD|_SOBIND_XPG4_2) &&
771 			    name != NULL) {
772 				error = EINVAL;
773 				unbind_on_err = 0;
774 				eprintsoline(so, error);
775 				goto done;
776 			}
777 			if ((so->so_mode & SM_CONNREQUIRED) &&
778 			    (so->so_state & SS_CANTREBIND)) {
779 				error = EINVAL;
780 				unbind_on_err = 0;
781 				eprintsoline(so, error);
782 				goto done;
783 			}
784 			error = sotpi_unbind(so, 0);
785 			if (error) {
786 				eprintsoline(so, error);
787 				goto done;
788 			}
789 			ASSERT(!(so->so_state & SS_ISBOUND));
790 			if (name == NULL) {
791 				so->so_state &=
792 				    ~(SS_ISCONNECTED|SS_ISCONNECTING);
793 				goto done;
794 			}
795 		}
796 
797 		/* X/Open requires this check */
798 		if ((so->so_state & SS_CANTSENDMORE) && !xnet_skip_checks) {
799 			if (xnet_check_print) {
800 				printf("sockfs: X/Open bind state check "
801 				    "caused EINVAL\n");
802 			}
803 			error = EINVAL;
804 			goto done;
805 		}
806 
807 		switch (so->so_family) {
808 		case AF_UNIX:
809 			/*
810 			 * All AF_UNIX addresses are nul terminated
811 			 * when copied (copyin_name) in so the minimum
812 			 * length is 3 bytes.
813 			 */
814 			if (name == NULL ||
815 			    (ssize_t)namelen <= sizeof (short) + 1) {
816 				error = EISDIR;
817 				eprintsoline(so, error);
818 				goto done;
819 			}
820 			/*
821 			 * Verify so_family matches the bound family.
822 			 * BSD does not check this for AF_UNIX resulting
823 			 * in funny mknods.
824 			 */
825 			if (name->sa_family != so->so_family) {
826 				error = EAFNOSUPPORT;
827 				goto done;
828 			}
829 			break;
830 		case AF_INET:
831 			if (name == NULL) {
832 				error = EINVAL;
833 				eprintsoline(so, error);
834 				goto done;
835 			}
836 			if ((size_t)namelen != sizeof (sin_t)) {
837 				error = name->sa_family != so->so_family ?
838 				    EAFNOSUPPORT : EINVAL;
839 				eprintsoline(so, error);
840 				goto done;
841 			}
842 			if ((flags & _SOBIND_XPG4_2) &&
843 			    (name->sa_family != so->so_family)) {
844 				/*
845 				 * This check has to be made for X/Open
846 				 * sockets however application failures have
847 				 * been observed when it is applied to
848 				 * all sockets.
849 				 */
850 				error = EAFNOSUPPORT;
851 				eprintsoline(so, error);
852 				goto done;
853 			}
854 			/*
855 			 * Force a zero sa_family to match so_family.
856 			 *
857 			 * Some programs like inetd(1M) don't set the
858 			 * family field. Other programs leave
859 			 * sin_family set to garbage - SunOS 4.X does
860 			 * not check the family field on a bind.
861 			 * We use the family field that
862 			 * was passed in to the socket() call.
863 			 */
864 			name->sa_family = so->so_family;
865 			break;
866 
867 		case AF_INET6: {
868 #ifdef DEBUG
869 			sin6_t *sin6 = (sin6_t *)name;
870 #endif /* DEBUG */
871 
872 			if (name == NULL) {
873 				error = EINVAL;
874 				eprintsoline(so, error);
875 				goto done;
876 			}
877 			if ((size_t)namelen != sizeof (sin6_t)) {
878 				error = name->sa_family != so->so_family ?
879 				    EAFNOSUPPORT : EINVAL;
880 				eprintsoline(so, error);
881 				goto done;
882 			}
883 			if (name->sa_family != so->so_family) {
884 				/*
885 				 * With IPv6 we require the family to match
886 				 * unlike in IPv4.
887 				 */
888 				error = EAFNOSUPPORT;
889 				eprintsoline(so, error);
890 				goto done;
891 			}
892 #ifdef DEBUG
893 			/*
894 			 * Verify that apps don't forget to clear
895 			 * sin6_scope_id etc
896 			 */
897 			if (sin6->sin6_scope_id != 0 &&
898 			    !IN6_IS_ADDR_LINKSCOPE(&sin6->sin6_addr)) {
899 				zcmn_err(getzoneid(), CE_WARN,
900 				    "bind with uninitialized sin6_scope_id "
901 				    "(%d) on socket. Pid = %d\n",
902 				    (int)sin6->sin6_scope_id,
903 				    (int)curproc->p_pid);
904 			}
905 			if (sin6->__sin6_src_id != 0) {
906 				zcmn_err(getzoneid(), CE_WARN,
907 				    "bind with uninitialized __sin6_src_id "
908 				    "(%d) on socket. Pid = %d\n",
909 				    (int)sin6->__sin6_src_id,
910 				    (int)curproc->p_pid);
911 			}
912 #endif /* DEBUG */
913 			break;
914 		}
915 		default:
916 			/*
917 			 * Don't do any length or sa_family check to allow
918 			 * non-sockaddr style addresses.
919 			 */
920 			if (name == NULL) {
921 				error = EINVAL;
922 				eprintsoline(so, error);
923 				goto done;
924 			}
925 			break;
926 		}
927 
928 		if (namelen > (t_uscalar_t)sti->sti_laddr_maxlen) {
929 			error = ENAMETOOLONG;
930 			eprintsoline(so, error);
931 			goto done;
932 		}
933 		/*
934 		 * Save local address.
935 		 */
936 		sti->sti_laddr_len = (socklen_t)namelen;
937 		ASSERT(sti->sti_laddr_len <= sti->sti_laddr_maxlen);
938 		bcopy(name, sti->sti_laddr_sa, namelen);
939 
940 		addr = sti->sti_laddr_sa;
941 		addrlen = (t_uscalar_t)sti->sti_laddr_len;
942 		switch (so->so_family) {
943 		case AF_INET6:
944 		case AF_INET:
945 			break;
946 		case AF_UNIX: {
947 			struct sockaddr_un *soun =
948 			    (struct sockaddr_un *)sti->sti_laddr_sa;
949 			struct vnode *vp, *rvp;
950 			struct vattr vattr;
951 
952 			ASSERT(sti->sti_ux_bound_vp == NULL);
953 			/*
954 			 * Create vnode for the specified path name.
955 			 * Keep vnode held with a reference in sti_ux_bound_vp.
956 			 * Use the vnode pointer as the address used in the
957 			 * bind with the transport.
958 			 *
959 			 * Use the same mode as in BSD. In particular this does
960 			 * not observe the umask.
961 			 */
962 			/* MAXPATHLEN + soun_family + nul termination */
963 			if (sti->sti_laddr_len >
964 			    (socklen_t)(MAXPATHLEN + sizeof (short) + 1)) {
965 				error = ENAMETOOLONG;
966 				eprintsoline(so, error);
967 				goto done;
968 			}
969 			vattr.va_type = VSOCK;
970 			vattr.va_mode = 0777 & ~PTOU(curproc)->u_cmask;
971 			vattr.va_mask = AT_TYPE|AT_MODE;
972 			/* NOTE: holding so_lock */
973 			error = vn_create(soun->sun_path, UIO_SYSSPACE, &vattr,
974 			    EXCL, 0, &vp, CRMKNOD, 0, 0);
975 			if (error) {
976 				if (error == EEXIST)
977 					error = EADDRINUSE;
978 				eprintsoline(so, error);
979 				goto done;
980 			}
981 			/*
982 			 * Establish pointer from the underlying filesystem
983 			 * vnode to the socket node.
984 			 * sti_ux_bound_vp and v_stream->sd_vnode form the
985 			 * cross-linkage between the underlying filesystem
986 			 * node and the socket node.
987 			 */
988 
989 			if ((VOP_REALVP(vp, &rvp, NULL) == 0) && (vp != rvp)) {
990 				VN_HOLD(rvp);
991 				VN_RELE(vp);
992 				vp = rvp;
993 			}
994 
995 			ASSERT(SOTOV(so)->v_stream);
996 			mutex_enter(&vp->v_lock);
997 			vp->v_stream = SOTOV(so)->v_stream;
998 			sti->sti_ux_bound_vp = vp;
999 			mutex_exit(&vp->v_lock);
1000 
1001 			/*
1002 			 * Use the vnode pointer value as a unique address
1003 			 * (together with the magic number to avoid conflicts
1004 			 * with implicit binds) in the transport provider.
1005 			 */
1006 			sti->sti_ux_laddr.soua_vp =
1007 			    (void *)sti->sti_ux_bound_vp;
1008 			sti->sti_ux_laddr.soua_magic = SOU_MAGIC_EXPLICIT;
1009 			addr = &sti->sti_ux_laddr;
1010 			addrlen = (t_uscalar_t)sizeof (sti->sti_ux_laddr);
1011 			dprintso(so, 1, ("sobind UNIX: addrlen %d, addr %p\n",
1012 			    addrlen,
1013 			    (void *)((struct so_ux_addr *)addr)->soua_vp));
1014 			break;
1015 		}
1016 		} /* end switch (so->so_family) */
1017 	}
1018 
1019 	/*
1020 	 * set SS_ACCEPTCONN before sending down O_T_BIND_REQ since
1021 	 * the transport can start passing up T_CONN_IND messages
1022 	 * as soon as it receives the bind req and strsock_proto()
1023 	 * insists that SS_ACCEPTCONN is set when processing T_CONN_INDs.
1024 	 */
1025 	if (flags & _SOBIND_LISTEN) {
1026 		if ((so->so_state & SS_ACCEPTCONN) == 0)
1027 			clear_acceptconn_on_err = B_TRUE;
1028 		save_so_backlog = so->so_backlog;
1029 		restore_backlog_on_err = B_TRUE;
1030 		so->so_state |= SS_ACCEPTCONN;
1031 		so->so_backlog = backlog;
1032 	}
1033 
1034 	/*
1035 	 * If NL7C addr(s) have been configured check for addr/port match,
1036 	 * or if an implicit NL7C socket via AF_NCA mark socket as NL7C.
1037 	 *
1038 	 * NL7C supports the TCP transport only so check AF_INET and AF_INET6
1039 	 * family sockets only. If match mark as such.
1040 	 */
1041 	if (nl7c_enabled && ((addr != NULL &&
1042 	    (so->so_family == AF_INET || so->so_family == AF_INET6) &&
1043 	    (nl7c = nl7c_lookup_addr(addr, addrlen))) ||
1044 	    sti->sti_nl7c_flags == NL7C_AF_NCA)) {
1045 		/*
1046 		 * NL7C is not supported in non-global zones,
1047 		 * we enforce this restriction here.
1048 		 */
1049 		if (so->so_zoneid == GLOBAL_ZONEID) {
1050 			/* An NL7C socket, mark it */
1051 			sti->sti_nl7c_flags |= NL7C_ENABLED;
1052 			if (nl7c == NULL) {
1053 				/*
1054 				 * Was an AF_NCA bind() so add it to the
1055 				 * addr list for reporting purposes.
1056 				 */
1057 				nl7c = nl7c_add_addr(addr, addrlen);
1058 			}
1059 		} else
1060 			nl7c = NULL;
1061 	}
1062 
1063 	/*
1064 	 * We send a T_BIND_REQ for TCP/UDP since we know it supports it,
1065 	 * for other transports we will send in a O_T_BIND_REQ.
1066 	 */
1067 	if (tcp_udp_xport &&
1068 	    (so->so_family == AF_INET || so->so_family == AF_INET6))
1069 		PRIM_type = T_BIND_REQ;
1070 
1071 	bind_req.PRIM_type = PRIM_type;
1072 	bind_req.ADDR_length = addrlen;
1073 	bind_req.ADDR_offset = (t_scalar_t)sizeof (bind_req);
1074 	bind_req.CONIND_number = backlog;
1075 	/* NOTE: holding so_lock while sleeping */
1076 	mp = soallocproto2(&bind_req, sizeof (bind_req),
1077 	    addr, addrlen, 0, _ALLOC_SLEEP, cr);
1078 	sti->sti_laddr_valid = 0;
1079 
1080 	/* Done using sti_laddr_sa - can drop the lock */
1081 	mutex_exit(&so->so_lock);
1082 
1083 	error = kstrputmsg(SOTOV(so), mp, NULL, 0, 0,
1084 	    MSG_BAND|MSG_HOLDSIG|MSG_IGNERROR, 0);
1085 	if (error) {
1086 		eprintsoline(so, error);
1087 		mutex_enter(&so->so_lock);
1088 		goto done;
1089 	}
1090 
1091 	mutex_enter(&so->so_lock);
1092 	error = sowaitprim(so, PRIM_type, T_BIND_ACK,
1093 	    (t_uscalar_t)sizeof (*bind_ack), &mp, 0);
1094 	if (error) {
1095 		eprintsoline(so, error);
1096 		goto done;
1097 	}
1098 	ASSERT(mp);
1099 	/*
1100 	 * Even if some TPI message (e.g. T_DISCON_IND) was received in
1101 	 * strsock_proto while the lock was dropped above, the bind
1102 	 * is allowed to complete.
1103 	 */
1104 
1105 	/* Mark as bound. This will be undone if we detect errors below. */
1106 	if (flags & _SOBIND_NOXLATE) {
1107 		ASSERT(so->so_family == AF_UNIX);
1108 		sti->sti_faddr_noxlate = 1;
1109 	}
1110 	ASSERT(!(so->so_state & SS_ISBOUND) || (flags & _SOBIND_REBIND));
1111 	so->so_state |= SS_ISBOUND;
1112 	ASSERT(sti->sti_unbind_mp);
1113 
1114 	/* note that we've already set SS_ACCEPTCONN above */
1115 
1116 	/*
1117 	 * Recompute addrlen - an unspecied bind sent down an
1118 	 * address of length zero but we expect the appropriate length
1119 	 * in return.
1120 	 */
1121 	addrlen = (t_uscalar_t)(so->so_family == AF_UNIX ?
1122 	    sizeof (sti->sti_ux_laddr) : sti->sti_laddr_len);
1123 
1124 	bind_ack = (struct T_bind_ack *)mp->b_rptr;
1125 	/*
1126 	 * The alignment restriction is really too strict but
1127 	 * we want enough alignment to inspect the fields of
1128 	 * a sockaddr_in.
1129 	 */
1130 	addr = sogetoff(mp, bind_ack->ADDR_offset,
1131 	    bind_ack->ADDR_length,
1132 	    __TPI_ALIGN_SIZE);
1133 	if (addr == NULL) {
1134 		freemsg(mp);
1135 		error = EPROTO;
1136 		eprintsoline(so, error);
1137 		goto done;
1138 	}
1139 	if (!(flags & _SOBIND_UNSPEC)) {
1140 		/*
1141 		 * Verify that the transport didn't return something we
1142 		 * did not want e.g. an address other than what we asked for.
1143 		 *
1144 		 * NOTE: These checks would go away if/when we switch to
1145 		 * using the new TPI (in which the transport would fail
1146 		 * the request instead of assigning a different address).
1147 		 *
1148 		 * NOTE2: For protocols that we don't know (i.e. any
1149 		 * other than AF_INET6, AF_INET and AF_UNIX), we
1150 		 * cannot know if the transport should be expected to
1151 		 * return the same address as that requested.
1152 		 *
1153 		 * NOTE3: For AF_INET and AF_INET6, TCP/UDP, we send
1154 		 * down a T_BIND_REQ. We use O_T_BIND_REQ for others.
1155 		 *
1156 		 * For example, in the case of netatalk it may be
1157 		 * inappropriate for the transport to return the
1158 		 * requested address (as it may have allocated a local
1159 		 * port number in behaviour similar to that of an
1160 		 * AF_INET bind request with a port number of zero).
1161 		 *
1162 		 * Given the definition of O_T_BIND_REQ, where the
1163 		 * transport may bind to an address other than the
1164 		 * requested address, it's not possible to determine
1165 		 * whether a returned address that differs from the
1166 		 * requested address is a reason to fail (because the
1167 		 * requested address was not available) or succeed
1168 		 * (because the transport allocated an appropriate
1169 		 * address and/or port).
1170 		 *
1171 		 * sockfs currently requires that the transport return
1172 		 * the requested address in the T_BIND_ACK, unless
1173 		 * there is code here to allow for any discrepancy.
1174 		 * Such code exists for AF_INET and AF_INET6.
1175 		 *
1176 		 * Netatalk chooses to return the requested address
1177 		 * rather than the (correct) allocated address.  This
1178 		 * means that netatalk violates the TPI specification
1179 		 * (and would not function correctly if used from a
1180 		 * TLI application), but it does mean that it works
1181 		 * with sockfs.
1182 		 *
1183 		 * As noted above, using the newer XTI bind primitive
1184 		 * (T_BIND_REQ) in preference to O_T_BIND_REQ would
1185 		 * allow sockfs to be more sure about whether or not
1186 		 * the bind request had succeeded (as transports are
1187 		 * not permitted to bind to a different address than
1188 		 * that requested - they must return failure).
1189 		 * Unfortunately, support for T_BIND_REQ may not be
1190 		 * present in all transport implementations (netatalk,
1191 		 * for example, doesn't have it), making the
1192 		 * transition difficult.
1193 		 */
1194 		if (bind_ack->ADDR_length != addrlen) {
1195 			/* Assumes that the requested address was in use */
1196 			freemsg(mp);
1197 			error = EADDRINUSE;
1198 			eprintsoline(so, error);
1199 			goto done;
1200 		}
1201 
1202 		switch (so->so_family) {
1203 		case AF_INET6:
1204 		case AF_INET: {
1205 			sin_t *rname, *aname;
1206 
1207 			rname = (sin_t *)addr;
1208 			aname = (sin_t *)sti->sti_laddr_sa;
1209 
1210 			/*
1211 			 * Take advantage of the alignment
1212 			 * of sin_port and sin6_port which fall
1213 			 * in the same place in their data structures.
1214 			 * Just use sin_port for either address family.
1215 			 *
1216 			 * This may become a problem if (heaven forbid)
1217 			 * there's a separate ipv6port_reserved... :-P
1218 			 *
1219 			 * Binding to port 0 has the semantics of letting
1220 			 * the transport bind to any port.
1221 			 *
1222 			 * If the transport is TCP or UDP since we had sent
1223 			 * a T_BIND_REQ we would not get a port other than
1224 			 * what we asked for.
1225 			 */
1226 			if (tcp_udp_xport) {
1227 				/*
1228 				 * Pick up the new port number if we bound to
1229 				 * port 0.
1230 				 */
1231 				if (aname->sin_port == 0)
1232 					aname->sin_port = rname->sin_port;
1233 				sti->sti_laddr_valid = 1;
1234 				break;
1235 			}
1236 			if (aname->sin_port != 0 &&
1237 			    aname->sin_port != rname->sin_port) {
1238 				freemsg(mp);
1239 				error = EADDRINUSE;
1240 				eprintsoline(so, error);
1241 				goto done;
1242 			}
1243 			/*
1244 			 * Pick up the new port number if we bound to port 0.
1245 			 */
1246 			aname->sin_port = rname->sin_port;
1247 
1248 			/*
1249 			 * Unfortunately, addresses aren't _quite_ the same.
1250 			 */
1251 			if (so->so_family == AF_INET) {
1252 				if (aname->sin_addr.s_addr !=
1253 				    rname->sin_addr.s_addr) {
1254 					freemsg(mp);
1255 					error = EADDRNOTAVAIL;
1256 					eprintsoline(so, error);
1257 					goto done;
1258 				}
1259 			} else {
1260 				sin6_t *rname6 = (sin6_t *)rname;
1261 				sin6_t *aname6 = (sin6_t *)aname;
1262 
1263 				if (!IN6_ARE_ADDR_EQUAL(&aname6->sin6_addr,
1264 				    &rname6->sin6_addr)) {
1265 					freemsg(mp);
1266 					error = EADDRNOTAVAIL;
1267 					eprintsoline(so, error);
1268 					goto done;
1269 				}
1270 			}
1271 			break;
1272 		}
1273 		case AF_UNIX:
1274 			if (bcmp(addr, &sti->sti_ux_laddr, addrlen) != 0) {
1275 				freemsg(mp);
1276 				error = EADDRINUSE;
1277 				eprintsoline(so, error);
1278 				eprintso(so,
1279 				    ("addrlen %d, addr 0x%x, vp %p\n",
1280 				    addrlen, *((int *)addr),
1281 				    (void *)sti->sti_ux_bound_vp));
1282 				goto done;
1283 			}
1284 			sti->sti_laddr_valid = 1;
1285 			break;
1286 		default:
1287 			/*
1288 			 * NOTE: This assumes that addresses can be
1289 			 * byte-compared for equivalence.
1290 			 */
1291 			if (bcmp(addr, sti->sti_laddr_sa, addrlen) != 0) {
1292 				freemsg(mp);
1293 				error = EADDRINUSE;
1294 				eprintsoline(so, error);
1295 				goto done;
1296 			}
1297 			/*
1298 			 * Don't mark sti_laddr_valid, as we cannot be
1299 			 * sure that the returned address is the real
1300 			 * bound address when talking to an unknown
1301 			 * transport.
1302 			 */
1303 			break;
1304 		}
1305 	} else {
1306 		/*
1307 		 * Save for returned address for getsockname.
1308 		 * Needed for unspecific bind unless transport supports
1309 		 * the TI_GETMYNAME ioctl.
1310 		 * Do this for AF_INET{,6} even though they do, as
1311 		 * caching info here is much better performance than
1312 		 * a TPI/STREAMS trip to the transport for getsockname.
1313 		 * Any which can't for some reason _must_ _not_ set
1314 		 * sti_laddr_valid here for the caching version of
1315 		 * getsockname to not break;
1316 		 */
1317 		switch (so->so_family) {
1318 		case AF_UNIX:
1319 			/*
1320 			 * Record the address bound with the transport
1321 			 * for use by socketpair.
1322 			 */
1323 			bcopy(addr, &sti->sti_ux_laddr, addrlen);
1324 			sti->sti_laddr_valid = 1;
1325 			break;
1326 		case AF_INET:
1327 		case AF_INET6:
1328 			ASSERT(sti->sti_laddr_len <= sti->sti_laddr_maxlen);
1329 			bcopy(addr, sti->sti_laddr_sa, sti->sti_laddr_len);
1330 			sti->sti_laddr_valid = 1;
1331 			break;
1332 		default:
1333 			/*
1334 			 * Don't mark sti_laddr_valid, as we cannot be
1335 			 * sure that the returned address is the real
1336 			 * bound address when talking to an unknown
1337 			 * transport.
1338 			 */
1339 			break;
1340 		}
1341 	}
1342 
1343 	if (nl7c != NULL) {
1344 		/* Register listen()er sonode pointer with NL7C */
1345 		nl7c_listener_addr(nl7c, so);
1346 	}
1347 
1348 	freemsg(mp);
1349 
1350 done:
1351 	if (error) {
1352 		/* reset state & backlog to values held on entry */
1353 		if (clear_acceptconn_on_err == B_TRUE)
1354 			so->so_state &= ~SS_ACCEPTCONN;
1355 		if (restore_backlog_on_err == B_TRUE)
1356 			so->so_backlog = save_so_backlog;
1357 
1358 		if (unbind_on_err && so->so_state & SS_ISBOUND) {
1359 			int err;
1360 
1361 			err = sotpi_unbind(so, 0);
1362 			/* LINTED - statement has no consequent: if */
1363 			if (err) {
1364 				eprintsoline(so, error);
1365 			} else {
1366 				ASSERT(!(so->so_state & SS_ISBOUND));
1367 			}
1368 		}
1369 	}
1370 	if (!(flags & _SOBIND_LOCK_HELD)) {
1371 		so_unlock_single(so, SOLOCKED);
1372 		mutex_exit(&so->so_lock);
1373 	} else {
1374 		ASSERT(MUTEX_HELD(&so->so_lock));
1375 		ASSERT(so->so_flag & SOLOCKED);
1376 	}
1377 	return (error);
1378 }
1379 
1380 /* bind the socket */
1381 static int
1382 sotpi_bind(struct sonode *so, struct sockaddr *name, socklen_t namelen,
1383     int flags, struct cred *cr)
1384 {
1385 	if ((flags & _SOBIND_SOCKETPAIR) == 0)
1386 		return (sotpi_bindlisten(so, name, namelen, 0, flags, cr));
1387 
1388 	flags &= ~_SOBIND_SOCKETPAIR;
1389 	return (sotpi_bindlisten(so, name, namelen, 1, flags, cr));
1390 }
1391 
1392 /*
1393  * Unbind a socket - used when bind() fails, when bind() specifies a NULL
1394  * address, or when listen needs to unbind and bind.
1395  * If the _SOUNBIND_REBIND flag is specified the addresses are retained
1396  * so that a sobind can pick them up.
1397  */
1398 static int
1399 sotpi_unbind(struct sonode *so, int flags)
1400 {
1401 	struct T_unbind_req	unbind_req;
1402 	int			error = 0;
1403 	mblk_t			*mp;
1404 	sotpi_info_t		*sti = SOTOTPI(so);
1405 
1406 	dprintso(so, 1, ("sotpi_unbind(%p, 0x%x) %s\n",
1407 	    (void *)so, flags, pr_state(so->so_state, so->so_mode)));
1408 
1409 	ASSERT(MUTEX_HELD(&so->so_lock));
1410 	ASSERT(so->so_flag & SOLOCKED);
1411 
1412 	if (!(so->so_state & SS_ISBOUND)) {
1413 		error = EINVAL;
1414 		eprintsoline(so, error);
1415 		goto done;
1416 	}
1417 
1418 	mutex_exit(&so->so_lock);
1419 
1420 	/*
1421 	 * Flush the read and write side (except stream head read queue)
1422 	 * and send down T_UNBIND_REQ.
1423 	 */
1424 	(void) putnextctl1(strvp2wq(SOTOV(so)), M_FLUSH, FLUSHRW);
1425 
1426 	unbind_req.PRIM_type = T_UNBIND_REQ;
1427 	mp = soallocproto1(&unbind_req, sizeof (unbind_req),
1428 	    0, _ALLOC_SLEEP, CRED());
1429 	error = kstrputmsg(SOTOV(so), mp, NULL, 0, 0,
1430 	    MSG_BAND|MSG_HOLDSIG|MSG_IGNERROR, 0);
1431 	mutex_enter(&so->so_lock);
1432 	if (error) {
1433 		eprintsoline(so, error);
1434 		goto done;
1435 	}
1436 
1437 	error = sowaitokack(so, T_UNBIND_REQ);
1438 	if (error) {
1439 		eprintsoline(so, error);
1440 		goto done;
1441 	}
1442 
1443 	/*
1444 	 * Even if some TPI message (e.g. T_DISCON_IND) was received in
1445 	 * strsock_proto while the lock was dropped above, the unbind
1446 	 * is allowed to complete.
1447 	 */
1448 	if (!(flags & _SOUNBIND_REBIND)) {
1449 		/*
1450 		 * Clear out bound address.
1451 		 */
1452 		vnode_t *vp;
1453 
1454 		if ((vp = sti->sti_ux_bound_vp) != NULL) {
1455 			sti->sti_ux_bound_vp = NULL;
1456 			vn_rele_stream(vp);
1457 		}
1458 		/* Clear out address */
1459 		sti->sti_laddr_len = 0;
1460 	}
1461 	so->so_state &= ~(SS_ISBOUND|SS_ACCEPTCONN);
1462 	sti->sti_laddr_valid = 0;
1463 
1464 done:
1465 
1466 	/* If the caller held the lock don't release it here */
1467 	ASSERT(MUTEX_HELD(&so->so_lock));
1468 	ASSERT(so->so_flag & SOLOCKED);
1469 
1470 	return (error);
1471 }
1472 
1473 /*
1474  * listen on the socket.
1475  * For TPI conforming transports this has to first unbind with the transport
1476  * and then bind again using the new backlog.
1477  */
1478 /* ARGSUSED */
1479 int
1480 sotpi_listen(struct sonode *so, int backlog, struct cred *cr)
1481 {
1482 	int		error = 0;
1483 	sotpi_info_t	*sti = SOTOTPI(so);
1484 
1485 	dprintso(so, 1, ("sotpi_listen(%p, %d) %s\n",
1486 	    (void *)so, backlog, pr_state(so->so_state, so->so_mode)));
1487 
1488 	if (sti->sti_serv_type == T_CLTS)
1489 		return (EOPNOTSUPP);
1490 
1491 	/*
1492 	 * If the socket is ready to accept connections already, then
1493 	 * return without doing anything.  This avoids a problem where
1494 	 * a second listen() call fails if a connection is pending and
1495 	 * leaves the socket unbound. Only when we are not unbinding
1496 	 * with the transport can we safely increase the backlog.
1497 	 */
1498 	if (so->so_state & SS_ACCEPTCONN &&
1499 	    !((so->so_family == AF_INET || so->so_family == AF_INET6) &&
1500 	    /*CONSTCOND*/
1501 	    !solisten_tpi_tcp))
1502 		return (0);
1503 
1504 	if (so->so_state & SS_ISCONNECTED)
1505 		return (EINVAL);
1506 
1507 	mutex_enter(&so->so_lock);
1508 	so_lock_single(so);	/* Set SOLOCKED */
1509 
1510 	/*
1511 	 * If the listen doesn't change the backlog we do nothing.
1512 	 * This avoids an EPROTO error from the transport.
1513 	 */
1514 	if ((so->so_state & SS_ACCEPTCONN) &&
1515 	    so->so_backlog == backlog)
1516 		goto done;
1517 
1518 	if (!(so->so_state & SS_ISBOUND)) {
1519 		/*
1520 		 * Must have been explicitly bound in the UNIX domain.
1521 		 */
1522 		if (so->so_family == AF_UNIX) {
1523 			error = EINVAL;
1524 			goto done;
1525 		}
1526 		error = sotpi_bindlisten(so, NULL, 0, backlog,
1527 		    _SOBIND_UNSPEC|_SOBIND_LOCK_HELD|_SOBIND_LISTEN, cr);
1528 	} else if (backlog > 0) {
1529 		/*
1530 		 * AF_INET{,6} hack to avoid losing the port.
1531 		 * Assumes that all AF_INET{,6} transports can handle a
1532 		 * O_T_BIND_REQ with a non-zero CONIND_number when the TPI
1533 		 * has already bound thus it is possible to avoid the unbind.
1534 		 */
1535 		if (!((so->so_family == AF_INET || so->so_family == AF_INET6) &&
1536 		    /*CONSTCOND*/
1537 		    !solisten_tpi_tcp)) {
1538 			error = sotpi_unbind(so, _SOUNBIND_REBIND);
1539 			if (error)
1540 				goto done;
1541 		}
1542 		error = sotpi_bindlisten(so, NULL, 0, backlog,
1543 		    _SOBIND_REBIND|_SOBIND_LOCK_HELD|_SOBIND_LISTEN, cr);
1544 	} else {
1545 		so->so_state |= SS_ACCEPTCONN;
1546 		so->so_backlog = backlog;
1547 	}
1548 	if (error)
1549 		goto done;
1550 	ASSERT(so->so_state & SS_ACCEPTCONN);
1551 done:
1552 	so_unlock_single(so, SOLOCKED);
1553 	mutex_exit(&so->so_lock);
1554 	return (error);
1555 }
1556 
1557 /*
1558  * Disconnect either a specified seqno or all (-1).
1559  * The former is used on listening sockets only.
1560  *
1561  * When seqno == -1 sodisconnect could call sotpi_unbind. However,
1562  * the current use of sodisconnect(seqno == -1) is only for shutdown
1563  * so there is no point (and potentially incorrect) to unbind.
1564  */
1565 static int
1566 sodisconnect(struct sonode *so, t_scalar_t seqno, int flags)
1567 {
1568 	struct T_discon_req	discon_req;
1569 	int			error = 0;
1570 	mblk_t			*mp;
1571 
1572 	dprintso(so, 1, ("sodisconnect(%p, %d, 0x%x) %s\n",
1573 	    (void *)so, seqno, flags, pr_state(so->so_state, so->so_mode)));
1574 
1575 	if (!(flags & _SODISCONNECT_LOCK_HELD)) {
1576 		mutex_enter(&so->so_lock);
1577 		so_lock_single(so);	/* Set SOLOCKED */
1578 	} else {
1579 		ASSERT(MUTEX_HELD(&so->so_lock));
1580 		ASSERT(so->so_flag & SOLOCKED);
1581 	}
1582 
1583 	if (!(so->so_state & (SS_ISCONNECTED|SS_ISCONNECTING|SS_ACCEPTCONN))) {
1584 		error = EINVAL;
1585 		eprintsoline(so, error);
1586 		goto done;
1587 	}
1588 
1589 	mutex_exit(&so->so_lock);
1590 	/*
1591 	 * Flush the write side (unless this is a listener)
1592 	 * and then send down a T_DISCON_REQ.
1593 	 * (Don't flush on listener since it could flush {O_}T_CONN_RES
1594 	 * and other messages.)
1595 	 */
1596 	if (!(so->so_state & SS_ACCEPTCONN))
1597 		(void) putnextctl1(strvp2wq(SOTOV(so)), M_FLUSH, FLUSHW);
1598 
1599 	discon_req.PRIM_type = T_DISCON_REQ;
1600 	discon_req.SEQ_number = seqno;
1601 	mp = soallocproto1(&discon_req, sizeof (discon_req),
1602 	    0, _ALLOC_SLEEP, CRED());
1603 	error = kstrputmsg(SOTOV(so), mp, NULL, 0, 0,
1604 	    MSG_BAND|MSG_HOLDSIG|MSG_IGNERROR, 0);
1605 	mutex_enter(&so->so_lock);
1606 	if (error) {
1607 		eprintsoline(so, error);
1608 		goto done;
1609 	}
1610 
1611 	error = sowaitokack(so, T_DISCON_REQ);
1612 	if (error) {
1613 		eprintsoline(so, error);
1614 		goto done;
1615 	}
1616 	/*
1617 	 * Even if some TPI message (e.g. T_DISCON_IND) was received in
1618 	 * strsock_proto while the lock was dropped above, the disconnect
1619 	 * is allowed to complete. However, it is not possible to
1620 	 * assert that SS_ISCONNECTED|SS_ISCONNECTING are set.
1621 	 */
1622 	so->so_state &= ~(SS_ISCONNECTED|SS_ISCONNECTING);
1623 	SOTOTPI(so)->sti_laddr_valid = 0;
1624 	SOTOTPI(so)->sti_faddr_valid = 0;
1625 done:
1626 	if (!(flags & _SODISCONNECT_LOCK_HELD)) {
1627 		so_unlock_single(so, SOLOCKED);
1628 		mutex_exit(&so->so_lock);
1629 	} else {
1630 		/* If the caller held the lock don't release it here */
1631 		ASSERT(MUTEX_HELD(&so->so_lock));
1632 		ASSERT(so->so_flag & SOLOCKED);
1633 	}
1634 	return (error);
1635 }
1636 
1637 /* ARGSUSED */
1638 int
1639 sotpi_accept(struct sonode *so, int fflag, struct cred *cr,
1640     struct sonode **nsop)
1641 {
1642 	struct T_conn_ind	*conn_ind;
1643 	struct T_conn_res	*conn_res;
1644 	int			error = 0;
1645 	mblk_t			*mp, *ack_mp;
1646 	struct sonode		*nso;
1647 	vnode_t			*nvp;
1648 	void			*src;
1649 	t_uscalar_t		srclen;
1650 	void			*opt;
1651 	t_uscalar_t		optlen;
1652 	t_scalar_t		PRIM_type;
1653 	t_scalar_t		SEQ_number;
1654 	size_t			sinlen;
1655 	sotpi_info_t		*sti = SOTOTPI(so);
1656 	sotpi_info_t		*nsti;
1657 
1658 	dprintso(so, 1, ("sotpi_accept(%p, 0x%x, %p) %s\n",
1659 	    (void *)so, fflag, (void *)nsop,
1660 	    pr_state(so->so_state, so->so_mode)));
1661 
1662 	/*
1663 	 * Defer single-threading the accepting socket until
1664 	 * the T_CONN_IND has been received and parsed and the
1665 	 * new sonode has been opened.
1666 	 */
1667 
1668 	/* Check that we are not already connected */
1669 	if ((so->so_state & SS_ACCEPTCONN) == 0)
1670 		goto conn_bad;
1671 again:
1672 	if ((error = sowaitconnind(so, fflag, &mp)) != 0)
1673 		goto e_bad;
1674 
1675 	ASSERT(mp != NULL);
1676 	conn_ind = (struct T_conn_ind *)mp->b_rptr;
1677 
1678 	/*
1679 	 * Save SEQ_number for error paths.
1680 	 */
1681 	SEQ_number = conn_ind->SEQ_number;
1682 
1683 	srclen = conn_ind->SRC_length;
1684 	src = sogetoff(mp, conn_ind->SRC_offset, srclen, 1);
1685 	if (src == NULL) {
1686 		error = EPROTO;
1687 		freemsg(mp);
1688 		eprintsoline(so, error);
1689 		goto disconnect_unlocked;
1690 	}
1691 	optlen = conn_ind->OPT_length;
1692 	switch (so->so_family) {
1693 	case AF_INET:
1694 	case AF_INET6:
1695 		if ((optlen == sizeof (intptr_t)) && (sti->sti_direct != 0)) {
1696 			bcopy(mp->b_rptr + conn_ind->OPT_offset,
1697 			    &opt, conn_ind->OPT_length);
1698 		} else {
1699 			/*
1700 			 * The transport (in this case TCP) hasn't sent up
1701 			 * a pointer to an instance for the accept fast-path.
1702 			 * Disable fast-path completely because the call to
1703 			 * sotpi_create() below would otherwise create an
1704 			 * incomplete TCP instance, which would lead to
1705 			 * problems when sockfs sends a normal T_CONN_RES
1706 			 * message down the new stream.
1707 			 */
1708 			if (sti->sti_direct) {
1709 				int rval;
1710 				/*
1711 				 * For consistency we inform tcp to disable
1712 				 * direct interface on the listener, though
1713 				 * we can certainly live without doing this
1714 				 * because no data will ever travel upstream
1715 				 * on the listening socket.
1716 				 */
1717 				sti->sti_direct = 0;
1718 				(void) strioctl(SOTOV(so), _SIOCSOCKFALLBACK,
1719 				    0, 0, K_TO_K, cr, &rval);
1720 			}
1721 			opt = NULL;
1722 			optlen = 0;
1723 		}
1724 		break;
1725 	case AF_UNIX:
1726 	default:
1727 		if (optlen != 0) {
1728 			opt = sogetoff(mp, conn_ind->OPT_offset, optlen,
1729 			    __TPI_ALIGN_SIZE);
1730 			if (opt == NULL) {
1731 				error = EPROTO;
1732 				freemsg(mp);
1733 				eprintsoline(so, error);
1734 				goto disconnect_unlocked;
1735 			}
1736 		}
1737 		if (so->so_family == AF_UNIX) {
1738 			if (!sti->sti_faddr_noxlate) {
1739 				src = NULL;
1740 				srclen = 0;
1741 			}
1742 			/* Extract src address from options */
1743 			if (optlen != 0)
1744 				so_getopt_srcaddr(opt, optlen, &src, &srclen);
1745 		}
1746 		break;
1747 	}
1748 
1749 	/*
1750 	 * Create the new socket.
1751 	 */
1752 	nso = socket_newconn(so, NULL, NULL, SOCKET_SLEEP, &error);
1753 	if (nso == NULL) {
1754 		ASSERT(error != 0);
1755 		/*
1756 		 * Accept can not fail with ENOBUFS. sotpi_create
1757 		 * sleeps waiting for memory until a signal is caught
1758 		 * so return EINTR.
1759 		 */
1760 		freemsg(mp);
1761 		if (error == ENOBUFS)
1762 			error = EINTR;
1763 		goto e_disc_unl;
1764 	}
1765 	nvp = SOTOV(nso);
1766 	nsti = SOTOTPI(nso);
1767 
1768 #ifdef DEBUG
1769 	/*
1770 	 * SO_DEBUG is used to trigger the dprint* and eprint* macros thus
1771 	 * it's inherited early to allow debugging of the accept code itself.
1772 	 */
1773 	nso->so_options |= so->so_options & SO_DEBUG;
1774 #endif /* DEBUG */
1775 
1776 	/*
1777 	 * Save the SRC address from the T_CONN_IND
1778 	 * for getpeername to work on AF_UNIX and on transports that do not
1779 	 * support TI_GETPEERNAME.
1780 	 *
1781 	 * NOTE: AF_UNIX NUL termination is ensured by the sender's
1782 	 * copyin_name().
1783 	 */
1784 	if (srclen > (t_uscalar_t)nsti->sti_faddr_maxlen) {
1785 		error = EINVAL;
1786 		freemsg(mp);
1787 		eprintsoline(so, error);
1788 		goto disconnect_vp_unlocked;
1789 	}
1790 	nsti->sti_faddr_len = (socklen_t)srclen;
1791 	ASSERT(sti->sti_faddr_len <= sti->sti_faddr_maxlen);
1792 	bcopy(src, nsti->sti_faddr_sa, srclen);
1793 	nsti->sti_faddr_valid = 1;
1794 
1795 	/*
1796 	 * Record so_peercred and so_cpid from a cred in the T_CONN_IND.
1797 	 */
1798 	if ((DB_REF(mp) > 1) || MBLKSIZE(mp) <
1799 	    (sizeof (struct T_conn_res) + sizeof (intptr_t))) {
1800 		cred_t	*cr;
1801 		pid_t	cpid;
1802 
1803 		cr = msg_getcred(mp, &cpid);
1804 		if (cr != NULL) {
1805 			crhold(cr);
1806 			nso->so_peercred = cr;
1807 			nso->so_cpid = cpid;
1808 		}
1809 		freemsg(mp);
1810 
1811 		mp = soallocproto1(NULL, sizeof (struct T_conn_res) +
1812 		    sizeof (intptr_t), 0, _ALLOC_INTR, cr);
1813 		if (mp == NULL) {
1814 			/*
1815 			 * Accept can not fail with ENOBUFS.
1816 			 * A signal was caught so return EINTR.
1817 			 */
1818 			error = EINTR;
1819 			eprintsoline(so, error);
1820 			goto disconnect_vp_unlocked;
1821 		}
1822 		conn_res = (struct T_conn_res *)mp->b_rptr;
1823 	} else {
1824 		/*
1825 		 * For efficency reasons we use msg_extractcred; no crhold
1826 		 * needed since db_credp is cleared (i.e., we move the cred
1827 		 * from the message to so_peercred.
1828 		 */
1829 		nso->so_peercred = msg_extractcred(mp, &nso->so_cpid);
1830 
1831 		mp->b_rptr = DB_BASE(mp);
1832 		conn_res = (struct T_conn_res *)mp->b_rptr;
1833 		mp->b_wptr = mp->b_rptr + sizeof (struct T_conn_res);
1834 
1835 		mblk_setcred(mp, cr, curproc->p_pid);
1836 	}
1837 
1838 	/*
1839 	 * New socket must be bound at least in sockfs and, except for AF_INET,
1840 	 * (or AF_INET6) it also has to be bound in the transport provider.
1841 	 * We set the local address in the sonode from the T_OK_ACK of the
1842 	 * T_CONN_RES. For this reason the address we bind to here isn't
1843 	 * important.
1844 	 */
1845 	if ((nso->so_family == AF_INET || nso->so_family == AF_INET6) &&
1846 	    /*CONSTCOND*/
1847 	    nso->so_type == SOCK_STREAM && !soaccept_tpi_tcp) {
1848 		/*
1849 		 * Optimization for AF_INET{,6} transports
1850 		 * that can handle a T_CONN_RES without being bound.
1851 		 */
1852 		mutex_enter(&nso->so_lock);
1853 		so_automatic_bind(nso);
1854 		mutex_exit(&nso->so_lock);
1855 	} else {
1856 		/* Perform NULL bind with the transport provider. */
1857 		if ((error = sotpi_bind(nso, NULL, 0, _SOBIND_UNSPEC,
1858 		    cr)) != 0) {
1859 			ASSERT(error != ENOBUFS);
1860 			freemsg(mp);
1861 			eprintsoline(nso, error);
1862 			goto disconnect_vp_unlocked;
1863 		}
1864 	}
1865 
1866 	/*
1867 	 * Inherit SIOCSPGRP, SS_ASYNC before we send the {O_}T_CONN_RES
1868 	 * so that any data arriving on the new socket will cause the
1869 	 * appropriate signals to be delivered for the new socket.
1870 	 *
1871 	 * No other thread (except strsock_proto and strsock_misc)
1872 	 * can access the new socket thus we relax the locking.
1873 	 */
1874 	nso->so_pgrp = so->so_pgrp;
1875 	nso->so_state |= so->so_state & SS_ASYNC;
1876 	nsti->sti_faddr_noxlate = sti->sti_faddr_noxlate;
1877 
1878 	if (nso->so_pgrp != 0) {
1879 		if ((error = so_set_events(nso, nvp, cr)) != 0) {
1880 			eprintsoline(nso, error);
1881 			error = 0;
1882 			nso->so_pgrp = 0;
1883 		}
1884 	}
1885 
1886 	/*
1887 	 * Make note of the socket level options. TCP and IP level options
1888 	 * are already inherited. We could do all this after accept is
1889 	 * successful but doing it here simplifies code and no harm done
1890 	 * for error case.
1891 	 */
1892 	nso->so_options = so->so_options & (SO_DEBUG|SO_REUSEADDR|SO_KEEPALIVE|
1893 	    SO_DONTROUTE|SO_BROADCAST|SO_USELOOPBACK|
1894 	    SO_OOBINLINE|SO_DGRAM_ERRIND|SO_LINGER);
1895 	nso->so_sndbuf = so->so_sndbuf;
1896 	nso->so_rcvbuf = so->so_rcvbuf;
1897 	if (nso->so_options & SO_LINGER)
1898 		nso->so_linger = so->so_linger;
1899 
1900 	/*
1901 	 * Note that the following sti_direct code path should be
1902 	 * removed once we are confident that the direct sockets
1903 	 * do not result in any degradation.
1904 	 */
1905 	if (sti->sti_direct) {
1906 
1907 		ASSERT(opt != NULL);
1908 
1909 		conn_res->OPT_length = optlen;
1910 		conn_res->OPT_offset = MBLKL(mp);
1911 		bcopy(&opt, mp->b_wptr, optlen);
1912 		mp->b_wptr += optlen;
1913 		conn_res->PRIM_type = T_CONN_RES;
1914 		conn_res->ACCEPTOR_id = 0;
1915 		PRIM_type = T_CONN_RES;
1916 
1917 		/* Send down the T_CONN_RES on acceptor STREAM */
1918 		error = kstrputmsg(SOTOV(nso), mp, NULL,
1919 		    0, 0, MSG_BAND|MSG_HOLDSIG|MSG_IGNERROR, 0);
1920 		if (error) {
1921 			mutex_enter(&so->so_lock);
1922 			so_lock_single(so);
1923 			eprintsoline(so, error);
1924 			goto disconnect_vp;
1925 		}
1926 		mutex_enter(&nso->so_lock);
1927 		error = sowaitprim(nso, T_CONN_RES, T_OK_ACK,
1928 		    (t_uscalar_t)sizeof (struct T_ok_ack), &ack_mp, 0);
1929 		if (error) {
1930 			mutex_exit(&nso->so_lock);
1931 			mutex_enter(&so->so_lock);
1932 			so_lock_single(so);
1933 			eprintsoline(so, error);
1934 			goto disconnect_vp;
1935 		}
1936 		if (nso->so_family == AF_INET) {
1937 			sin_t *sin;
1938 
1939 			sin = (sin_t *)(ack_mp->b_rptr +
1940 			    sizeof (struct T_ok_ack));
1941 			bcopy(sin, nsti->sti_laddr_sa, sizeof (sin_t));
1942 			nsti->sti_laddr_len = sizeof (sin_t);
1943 		} else {
1944 			sin6_t *sin6;
1945 
1946 			sin6 = (sin6_t *)(ack_mp->b_rptr +
1947 			    sizeof (struct T_ok_ack));
1948 			bcopy(sin6, nsti->sti_laddr_sa, sizeof (sin6_t));
1949 			nsti->sti_laddr_len = sizeof (sin6_t);
1950 		}
1951 		freemsg(ack_mp);
1952 
1953 		nso->so_state |= SS_ISCONNECTED;
1954 		nso->so_proto_handle = (sock_lower_handle_t)opt;
1955 		nsti->sti_laddr_valid = 1;
1956 
1957 		if (sti->sti_nl7c_flags & NL7C_ENABLED) {
1958 			/*
1959 			 * A NL7C marked listen()er so the new socket
1960 			 * inherits the listen()er's NL7C state, except
1961 			 * for NL7C_POLLIN.
1962 			 *
1963 			 * Only call NL7C to process the new socket if
1964 			 * the listen socket allows blocking i/o.
1965 			 */
1966 			nsti->sti_nl7c_flags =
1967 			    sti->sti_nl7c_flags & (~NL7C_POLLIN);
1968 			if (so->so_state & (SS_NONBLOCK|SS_NDELAY)) {
1969 				/*
1970 				 * Nonblocking accept() just make it
1971 				 * persist to defer processing to the
1972 				 * read-side syscall (e.g. read).
1973 				 */
1974 				nsti->sti_nl7c_flags |= NL7C_SOPERSIST;
1975 			} else if (nl7c_process(nso, B_FALSE)) {
1976 				/*
1977 				 * NL7C has completed processing on the
1978 				 * socket, close the socket and back to
1979 				 * the top to await the next T_CONN_IND.
1980 				 */
1981 				mutex_exit(&nso->so_lock);
1982 				(void) VOP_CLOSE(nvp, 0, 1, (offset_t)0,
1983 				    cr, NULL);
1984 				VN_RELE(nvp);
1985 				goto again;
1986 			}
1987 			/* Pass the new socket out */
1988 		}
1989 
1990 		mutex_exit(&nso->so_lock);
1991 
1992 		/*
1993 		 * It's possible, through the use of autopush for example,
1994 		 * that the acceptor stream may not support sti_direct
1995 		 * semantics. If the new socket does not support sti_direct
1996 		 * we issue a _SIOCSOCKFALLBACK to inform the transport
1997 		 * as we would in the I_PUSH case.
1998 		 */
1999 		if (nsti->sti_direct == 0) {
2000 			int	rval;
2001 
2002 			if ((error = strioctl(SOTOV(nso), _SIOCSOCKFALLBACK,
2003 			    0, 0, K_TO_K, cr, &rval)) != 0) {
2004 				mutex_enter(&so->so_lock);
2005 				so_lock_single(so);
2006 				eprintsoline(so, error);
2007 				goto disconnect_vp;
2008 			}
2009 		}
2010 
2011 		/*
2012 		 * Pass out new socket.
2013 		 */
2014 		if (nsop != NULL)
2015 			*nsop = nso;
2016 
2017 		return (0);
2018 	}
2019 
2020 	/*
2021 	 * This is the non-performance case for sockets (e.g. AF_UNIX sockets)
2022 	 * which don't support the FireEngine accept fast-path. It is also
2023 	 * used when the virtual "sockmod" has been I_POP'd and I_PUSH'd
2024 	 * again. Neither sockfs nor TCP attempt to find out if some other
2025 	 * random module has been inserted in between (in which case we
2026 	 * should follow TLI accept behaviour). We blindly assume the worst
2027 	 * case and revert back to old behaviour i.e. TCP will not send us
2028 	 * any option (eager) and the accept should happen on the listener
2029 	 * queue. Any queued T_conn_ind have already got their options removed
2030 	 * by so_sock2_stream() when "sockmod" was I_POP'd.
2031 	 */
2032 	/*
2033 	 * Fill in the {O_}T_CONN_RES before getting SOLOCKED.
2034 	 */
2035 	if ((nso->so_mode & SM_ACCEPTOR_ID) == 0) {
2036 #ifdef	_ILP32
2037 		queue_t	*q;
2038 
2039 		/*
2040 		 * Find read queue in driver
2041 		 * Can safely do this since we "own" nso/nvp.
2042 		 */
2043 		q = strvp2wq(nvp)->q_next;
2044 		while (SAMESTR(q))
2045 			q = q->q_next;
2046 		q = RD(q);
2047 		conn_res->ACCEPTOR_id = (t_uscalar_t)q;
2048 #else
2049 		conn_res->ACCEPTOR_id = (t_uscalar_t)getminor(nvp->v_rdev);
2050 #endif	/* _ILP32 */
2051 		conn_res->PRIM_type = O_T_CONN_RES;
2052 		PRIM_type = O_T_CONN_RES;
2053 	} else {
2054 		conn_res->ACCEPTOR_id = nsti->sti_acceptor_id;
2055 		conn_res->PRIM_type = T_CONN_RES;
2056 		PRIM_type = T_CONN_RES;
2057 	}
2058 	conn_res->SEQ_number = SEQ_number;
2059 	conn_res->OPT_length = 0;
2060 	conn_res->OPT_offset = 0;
2061 
2062 	mutex_enter(&so->so_lock);
2063 	so_lock_single(so);	/* Set SOLOCKED */
2064 	mutex_exit(&so->so_lock);
2065 
2066 	error = kstrputmsg(SOTOV(so), mp, NULL,
2067 	    0, 0, MSG_BAND|MSG_HOLDSIG|MSG_IGNERROR, 0);
2068 	mutex_enter(&so->so_lock);
2069 	if (error) {
2070 		eprintsoline(so, error);
2071 		goto disconnect_vp;
2072 	}
2073 	error = sowaitprim(so, PRIM_type, T_OK_ACK,
2074 	    (t_uscalar_t)sizeof (struct T_ok_ack), &ack_mp, 0);
2075 	if (error) {
2076 		eprintsoline(so, error);
2077 		goto disconnect_vp;
2078 	}
2079 	/*
2080 	 * If there is a sin/sin6 appended onto the T_OK_ACK use
2081 	 * that to set the local address. If this is not present
2082 	 * then we zero out the address and don't set the
2083 	 * sti_laddr_valid bit. For AF_UNIX endpoints we copy over
2084 	 * the pathname from the listening socket.
2085 	 */
2086 	sinlen = (nso->so_family == AF_INET) ? sizeof (sin_t) : sizeof (sin6_t);
2087 	if ((nso->so_family == AF_INET) || (nso->so_family == AF_INET6) &&
2088 	    MBLKL(ack_mp) == (sizeof (struct T_ok_ack) + sinlen)) {
2089 		ack_mp->b_rptr += sizeof (struct T_ok_ack);
2090 		bcopy(ack_mp->b_rptr, nsti->sti_laddr_sa, sinlen);
2091 		nsti->sti_laddr_len = sinlen;
2092 		nsti->sti_laddr_valid = 1;
2093 	} else if (nso->so_family == AF_UNIX) {
2094 		ASSERT(so->so_family == AF_UNIX);
2095 		nsti->sti_laddr_len = sti->sti_laddr_len;
2096 		ASSERT(nsti->sti_laddr_len <= nsti->sti_laddr_maxlen);
2097 		bcopy(sti->sti_laddr_sa, nsti->sti_laddr_sa,
2098 		    nsti->sti_laddr_len);
2099 		nsti->sti_laddr_valid = 1;
2100 	} else {
2101 		nsti->sti_laddr_len = sti->sti_laddr_len;
2102 		ASSERT(nsti->sti_laddr_len <= nsti->sti_laddr_maxlen);
2103 		bzero(nsti->sti_laddr_sa, nsti->sti_addr_size);
2104 		nsti->sti_laddr_sa->sa_family = nso->so_family;
2105 	}
2106 	freemsg(ack_mp);
2107 
2108 	so_unlock_single(so, SOLOCKED);
2109 	mutex_exit(&so->so_lock);
2110 
2111 	nso->so_state |= SS_ISCONNECTED;
2112 
2113 	/*
2114 	 * Pass out new socket.
2115 	 */
2116 	if (nsop != NULL)
2117 		*nsop = nso;
2118 
2119 	return (0);
2120 
2121 
2122 eproto_disc_unl:
2123 	error = EPROTO;
2124 e_disc_unl:
2125 	eprintsoline(so, error);
2126 	goto disconnect_unlocked;
2127 
2128 pr_disc_vp_unl:
2129 	eprintsoline(so, error);
2130 disconnect_vp_unlocked:
2131 	(void) VOP_CLOSE(nvp, 0, 1, 0, cr, NULL);
2132 	VN_RELE(nvp);
2133 disconnect_unlocked:
2134 	(void) sodisconnect(so, SEQ_number, 0);
2135 	return (error);
2136 
2137 pr_disc_vp:
2138 	eprintsoline(so, error);
2139 disconnect_vp:
2140 	(void) sodisconnect(so, SEQ_number, _SODISCONNECT_LOCK_HELD);
2141 	so_unlock_single(so, SOLOCKED);
2142 	mutex_exit(&so->so_lock);
2143 	(void) VOP_CLOSE(nvp, 0, 1, 0, cr, NULL);
2144 	VN_RELE(nvp);
2145 	return (error);
2146 
2147 conn_bad:	/* Note: SunOS 4/BSD unconditionally returns EINVAL here */
2148 	error = (so->so_type == SOCK_DGRAM || so->so_type == SOCK_RAW)
2149 	    ? EOPNOTSUPP : EINVAL;
2150 e_bad:
2151 	eprintsoline(so, error);
2152 	return (error);
2153 }
2154 
2155 /*
2156  * connect a socket.
2157  *
2158  * Allow SOCK_DGRAM sockets to reconnect (by specifying a new address) and to
2159  * unconnect (by specifying a null address).
2160  */
2161 int
2162 sotpi_connect(struct sonode *so,
2163 	struct sockaddr *name,
2164 	socklen_t namelen,
2165 	int fflag,
2166 	int flags,
2167 	struct cred *cr)
2168 {
2169 	struct T_conn_req	conn_req;
2170 	int			error = 0;
2171 	mblk_t			*mp;
2172 	void			*src;
2173 	socklen_t		srclen;
2174 	void			*addr;
2175 	socklen_t		addrlen;
2176 	boolean_t		need_unlock;
2177 	sotpi_info_t		*sti = SOTOTPI(so);
2178 
2179 	dprintso(so, 1, ("sotpi_connect(%p, %p, %d, 0x%x, 0x%x) %s\n",
2180 	    (void *)so, (void *)name, namelen, fflag, flags,
2181 	    pr_state(so->so_state, so->so_mode)));
2182 
2183 	/*
2184 	 * Preallocate the T_CONN_REQ mblk before grabbing SOLOCKED to
2185 	 * avoid sleeping for memory with SOLOCKED held.
2186 	 * We know that the T_CONN_REQ can't be larger than 2 * sti_faddr_maxlen
2187 	 * + sizeof (struct T_opthdr).
2188 	 * (the AF_UNIX so_ux_addr_xlate() does not make the address
2189 	 * exceed sti_faddr_maxlen).
2190 	 */
2191 	mp = soallocproto(sizeof (struct T_conn_req) +
2192 	    2 * sti->sti_faddr_maxlen + sizeof (struct T_opthdr), _ALLOC_INTR,
2193 	    cr);
2194 	if (mp == NULL) {
2195 		/*
2196 		 * Connect can not fail with ENOBUFS. A signal was
2197 		 * caught so return EINTR.
2198 		 */
2199 		error = EINTR;
2200 		eprintsoline(so, error);
2201 		return (error);
2202 	}
2203 
2204 	mutex_enter(&so->so_lock);
2205 	/*
2206 	 * Make sure there is a preallocated T_unbind_req message
2207 	 * before any binding. This message is allocated when the
2208 	 * socket is created. Since another thread can consume
2209 	 * so_unbind_mp by the time we return from so_lock_single(),
2210 	 * we should check the availability of so_unbind_mp after
2211 	 * we return from so_lock_single().
2212 	 */
2213 
2214 	so_lock_single(so);	/* Set SOLOCKED */
2215 	need_unlock = B_TRUE;
2216 
2217 	if (sti->sti_unbind_mp == NULL) {
2218 		dprintso(so, 1, ("sotpi_connect: allocating unbind_req\n"));
2219 		/* NOTE: holding so_lock while sleeping */
2220 		sti->sti_unbind_mp =
2221 		    soallocproto(sizeof (struct T_unbind_req), _ALLOC_INTR, cr);
2222 		if (sti->sti_unbind_mp == NULL) {
2223 			error = EINTR;
2224 			goto done;
2225 		}
2226 	}
2227 
2228 	/*
2229 	 * Can't have done a listen before connecting.
2230 	 */
2231 	if (so->so_state & SS_ACCEPTCONN) {
2232 		error = EOPNOTSUPP;
2233 		goto done;
2234 	}
2235 
2236 	/*
2237 	 * Must be bound with the transport
2238 	 */
2239 	if (!(so->so_state & SS_ISBOUND)) {
2240 		if ((so->so_family == AF_INET || so->so_family == AF_INET6) &&
2241 		    /*CONSTCOND*/
2242 		    so->so_type == SOCK_STREAM && !soconnect_tpi_tcp) {
2243 			/*
2244 			 * Optimization for AF_INET{,6} transports
2245 			 * that can handle a T_CONN_REQ without being bound.
2246 			 */
2247 			so_automatic_bind(so);
2248 		} else {
2249 			error = sotpi_bind(so, NULL, 0,
2250 			    _SOBIND_UNSPEC|_SOBIND_LOCK_HELD, cr);
2251 			if (error)
2252 				goto done;
2253 		}
2254 		ASSERT(so->so_state & SS_ISBOUND);
2255 		flags |= _SOCONNECT_DID_BIND;
2256 	}
2257 
2258 	/*
2259 	 * Handle a connect to a name parameter of type AF_UNSPEC like a
2260 	 * connect to a null address. This is the portable method to
2261 	 * unconnect a socket.
2262 	 */
2263 	if ((namelen >= sizeof (sa_family_t)) &&
2264 	    (name->sa_family == AF_UNSPEC)) {
2265 		name = NULL;
2266 		namelen = 0;
2267 	}
2268 
2269 	/*
2270 	 * Check that we are not already connected.
2271 	 * A connection-oriented socket cannot be reconnected.
2272 	 * A connected connection-less socket can be
2273 	 * - connected to a different address by a subsequent connect
2274 	 * - "unconnected" by a connect to the NULL address
2275 	 */
2276 	if (so->so_state & (SS_ISCONNECTED|SS_ISCONNECTING)) {
2277 		ASSERT(!(flags & _SOCONNECT_DID_BIND));
2278 		if (so->so_mode & SM_CONNREQUIRED) {
2279 			/* Connection-oriented socket */
2280 			error = so->so_state & SS_ISCONNECTED ?
2281 			    EISCONN : EALREADY;
2282 			goto done;
2283 		}
2284 		/* Connection-less socket */
2285 		if (name == NULL) {
2286 			/*
2287 			 * Remove the connected state and clear SO_DGRAM_ERRIND
2288 			 * since it was set when the socket was connected.
2289 			 * If this is UDP also send down a T_DISCON_REQ.
2290 			 */
2291 			int val;
2292 
2293 			if ((so->so_family == AF_INET ||
2294 			    so->so_family == AF_INET6) &&
2295 			    (so->so_type == SOCK_DGRAM ||
2296 			    so->so_type == SOCK_RAW) &&
2297 			    /*CONSTCOND*/
2298 			    !soconnect_tpi_udp) {
2299 				/* XXX What about implicitly unbinding here? */
2300 				error = sodisconnect(so, -1,
2301 				    _SODISCONNECT_LOCK_HELD);
2302 			} else {
2303 				so->so_state &=
2304 				    ~(SS_ISCONNECTED | SS_ISCONNECTING);
2305 				sti->sti_faddr_valid = 0;
2306 				sti->sti_faddr_len = 0;
2307 			}
2308 
2309 			/* Remove SOLOCKED since setsockopt will grab it */
2310 			so_unlock_single(so, SOLOCKED);
2311 			mutex_exit(&so->so_lock);
2312 
2313 			val = 0;
2314 			(void) sotpi_setsockopt(so, SOL_SOCKET,
2315 			    SO_DGRAM_ERRIND, &val, (t_uscalar_t)sizeof (val),
2316 			    cr);
2317 
2318 			mutex_enter(&so->so_lock);
2319 			so_lock_single(so);	/* Set SOLOCKED */
2320 			goto done;
2321 		}
2322 	}
2323 	ASSERT(so->so_state & SS_ISBOUND);
2324 
2325 	if (name == NULL || namelen == 0) {
2326 		error = EINVAL;
2327 		goto done;
2328 	}
2329 	/*
2330 	 * Mark the socket if sti_faddr_sa represents the transport level
2331 	 * address.
2332 	 */
2333 	if (flags & _SOCONNECT_NOXLATE) {
2334 		struct sockaddr_ux	*soaddr_ux;
2335 
2336 		ASSERT(so->so_family == AF_UNIX);
2337 		if (namelen != sizeof (struct sockaddr_ux)) {
2338 			error = EINVAL;
2339 			goto done;
2340 		}
2341 		soaddr_ux = (struct sockaddr_ux *)name;
2342 		name = (struct sockaddr *)&soaddr_ux->sou_addr;
2343 		namelen = sizeof (soaddr_ux->sou_addr);
2344 		sti->sti_faddr_noxlate = 1;
2345 	}
2346 
2347 	/*
2348 	 * Length and family checks.
2349 	 */
2350 	error = so_addr_verify(so, name, namelen);
2351 	if (error)
2352 		goto bad;
2353 
2354 	/*
2355 	 * Save foreign address. Needed for AF_UNIX as well as
2356 	 * transport providers that do not support TI_GETPEERNAME.
2357 	 * Also used for cached foreign address for TCP and UDP.
2358 	 */
2359 	if (namelen > (t_uscalar_t)sti->sti_faddr_maxlen) {
2360 		error = EINVAL;
2361 		goto done;
2362 	}
2363 	sti->sti_faddr_len = (socklen_t)namelen;
2364 	ASSERT(sti->sti_faddr_len <= sti->sti_faddr_maxlen);
2365 	bcopy(name, sti->sti_faddr_sa, namelen);
2366 	sti->sti_faddr_valid = 1;
2367 
2368 	if (so->so_family == AF_UNIX) {
2369 		if (sti->sti_faddr_noxlate) {
2370 			/*
2371 			 * Already have a transport internal address. Do not
2372 			 * pass any (transport internal) source address.
2373 			 */
2374 			addr = sti->sti_faddr_sa;
2375 			addrlen = (t_uscalar_t)sti->sti_faddr_len;
2376 			src = NULL;
2377 			srclen = 0;
2378 		} else {
2379 			/*
2380 			 * Pass the sockaddr_un source address as an option
2381 			 * and translate the remote address.
2382 			 * Holding so_lock thus sti_laddr_sa can not change.
2383 			 */
2384 			src = sti->sti_laddr_sa;
2385 			srclen = (t_uscalar_t)sti->sti_laddr_len;
2386 			dprintso(so, 1,
2387 			    ("sotpi_connect UNIX: srclen %d, src %p\n",
2388 			    srclen, src));
2389 			error = so_ux_addr_xlate(so,
2390 			    sti->sti_faddr_sa, (socklen_t)sti->sti_faddr_len,
2391 			    (flags & _SOCONNECT_XPG4_2),
2392 			    &addr, &addrlen);
2393 			if (error)
2394 				goto bad;
2395 		}
2396 	} else {
2397 		addr = sti->sti_faddr_sa;
2398 		addrlen = (t_uscalar_t)sti->sti_faddr_len;
2399 		src = NULL;
2400 		srclen = 0;
2401 	}
2402 	/*
2403 	 * When connecting a datagram socket we issue the SO_DGRAM_ERRIND
2404 	 * option which asks the transport provider to send T_UDERR_IND
2405 	 * messages. These T_UDERR_IND messages are used to return connected
2406 	 * style errors (e.g. ECONNRESET) for connected datagram sockets.
2407 	 *
2408 	 * In addition, for UDP (and SOCK_RAW AF_INET{,6} sockets)
2409 	 * we send down a T_CONN_REQ. This is needed to let the
2410 	 * transport assign a local address that is consistent with
2411 	 * the remote address. Applications depend on a getsockname()
2412 	 * after a connect() to retrieve the "source" IP address for
2413 	 * the connected socket.  Invalidate the cached local address
2414 	 * to force getsockname() to enquire of the transport.
2415 	 */
2416 	if (!(so->so_mode & SM_CONNREQUIRED)) {
2417 		/*
2418 		 * Datagram socket.
2419 		 */
2420 		int32_t val;
2421 
2422 		so_unlock_single(so, SOLOCKED);
2423 		mutex_exit(&so->so_lock);
2424 
2425 		val = 1;
2426 		(void) sotpi_setsockopt(so, SOL_SOCKET, SO_DGRAM_ERRIND,
2427 		    &val, (t_uscalar_t)sizeof (val), cr);
2428 
2429 		mutex_enter(&so->so_lock);
2430 		so_lock_single(so);	/* Set SOLOCKED */
2431 		if ((so->so_family != AF_INET && so->so_family != AF_INET6) ||
2432 		    (so->so_type != SOCK_DGRAM && so->so_type != SOCK_RAW) ||
2433 		    soconnect_tpi_udp) {
2434 			soisconnected(so);
2435 			goto done;
2436 		}
2437 		/*
2438 		 * Send down T_CONN_REQ etc.
2439 		 * Clear fflag to avoid returning EWOULDBLOCK.
2440 		 */
2441 		fflag = 0;
2442 		ASSERT(so->so_family != AF_UNIX);
2443 		sti->sti_laddr_valid = 0;
2444 	} else if (sti->sti_laddr_len != 0) {
2445 		/*
2446 		 * If the local address or port was "any" then it may be
2447 		 * changed by the transport as a result of the
2448 		 * connect.  Invalidate the cached version if we have one.
2449 		 */
2450 		switch (so->so_family) {
2451 		case AF_INET:
2452 			ASSERT(sti->sti_laddr_len == (socklen_t)sizeof (sin_t));
2453 			if (((sin_t *)sti->sti_laddr_sa)->sin_addr.s_addr ==
2454 			    INADDR_ANY ||
2455 			    ((sin_t *)sti->sti_laddr_sa)->sin_port == 0)
2456 				sti->sti_laddr_valid = 0;
2457 			break;
2458 
2459 		case AF_INET6:
2460 			ASSERT(sti->sti_laddr_len ==
2461 			    (socklen_t)sizeof (sin6_t));
2462 			if (IN6_IS_ADDR_UNSPECIFIED(
2463 			    &((sin6_t *)sti->sti_laddr_sa) ->sin6_addr) ||
2464 			    IN6_IS_ADDR_V4MAPPED_ANY(
2465 			    &((sin6_t *)sti->sti_laddr_sa)->sin6_addr) ||
2466 			    ((sin6_t *)sti->sti_laddr_sa)->sin6_port == 0)
2467 				sti->sti_laddr_valid = 0;
2468 			break;
2469 
2470 		default:
2471 			break;
2472 		}
2473 	}
2474 
2475 	/*
2476 	 * Check for failure of an earlier call
2477 	 */
2478 	if (so->so_error != 0)
2479 		goto so_bad;
2480 
2481 	/*
2482 	 * Send down T_CONN_REQ. Message was allocated above.
2483 	 */
2484 	conn_req.PRIM_type = T_CONN_REQ;
2485 	conn_req.DEST_length = addrlen;
2486 	conn_req.DEST_offset = (t_scalar_t)sizeof (conn_req);
2487 	if (srclen == 0) {
2488 		conn_req.OPT_length = 0;
2489 		conn_req.OPT_offset = 0;
2490 		soappendmsg(mp, &conn_req, sizeof (conn_req));
2491 		soappendmsg(mp, addr, addrlen);
2492 	} else {
2493 		/*
2494 		 * There is a AF_UNIX sockaddr_un to include as a source
2495 		 * address option.
2496 		 */
2497 		struct T_opthdr toh;
2498 
2499 		toh.level = SOL_SOCKET;
2500 		toh.name = SO_SRCADDR;
2501 		toh.len = (t_uscalar_t)(srclen + sizeof (struct T_opthdr));
2502 		toh.status = 0;
2503 		conn_req.OPT_length =
2504 		    (t_scalar_t)(sizeof (toh) + _TPI_ALIGN_TOPT(srclen));
2505 		conn_req.OPT_offset = (t_scalar_t)(sizeof (conn_req) +
2506 		    _TPI_ALIGN_TOPT(addrlen));
2507 
2508 		soappendmsg(mp, &conn_req, sizeof (conn_req));
2509 		soappendmsg(mp, addr, addrlen);
2510 		mp->b_wptr += _TPI_ALIGN_TOPT(addrlen) - addrlen;
2511 		soappendmsg(mp, &toh, sizeof (toh));
2512 		soappendmsg(mp, src, srclen);
2513 		mp->b_wptr += _TPI_ALIGN_TOPT(srclen) - srclen;
2514 		ASSERT(mp->b_wptr <= mp->b_datap->db_lim);
2515 	}
2516 	/*
2517 	 * Set SS_ISCONNECTING before sending down the T_CONN_REQ
2518 	 * in order to have the right state when the T_CONN_CON shows up.
2519 	 */
2520 	soisconnecting(so);
2521 	mutex_exit(&so->so_lock);
2522 
2523 	if (AU_AUDITING())
2524 		audit_sock(T_CONN_REQ, strvp2wq(SOTOV(so)), mp, 0);
2525 
2526 	error = kstrputmsg(SOTOV(so), mp, NULL, 0, 0,
2527 	    MSG_BAND|MSG_HOLDSIG|MSG_IGNERROR, 0);
2528 	mp = NULL;
2529 	mutex_enter(&so->so_lock);
2530 	if (error != 0)
2531 		goto bad;
2532 
2533 	if ((error = sowaitokack(so, T_CONN_REQ)) != 0)
2534 		goto bad;
2535 
2536 	/* Allow other threads to access the socket */
2537 	so_unlock_single(so, SOLOCKED);
2538 	need_unlock = B_FALSE;
2539 
2540 	/*
2541 	 * Wait until we get a T_CONN_CON or an error
2542 	 */
2543 	if ((error = sowaitconnected(so, fflag, 0)) != 0) {
2544 		so_lock_single(so);	/* Set SOLOCKED */
2545 		need_unlock = B_TRUE;
2546 	}
2547 
2548 done:
2549 	freemsg(mp);
2550 	switch (error) {
2551 	case EINPROGRESS:
2552 	case EALREADY:
2553 	case EISCONN:
2554 	case EINTR:
2555 		/* Non-fatal errors */
2556 		sti->sti_laddr_valid = 0;
2557 		/* FALLTHRU */
2558 	case 0:
2559 		break;
2560 	default:
2561 		ASSERT(need_unlock);
2562 		/*
2563 		 * Fatal errors: clear SS_ISCONNECTING in case it was set,
2564 		 * and invalidate local-address cache
2565 		 */
2566 		so->so_state &= ~SS_ISCONNECTING;
2567 		sti->sti_laddr_valid = 0;
2568 		/* A discon_ind might have already unbound us */
2569 		if ((flags & _SOCONNECT_DID_BIND) &&
2570 		    (so->so_state & SS_ISBOUND)) {
2571 			int err;
2572 
2573 			err = sotpi_unbind(so, 0);
2574 			/* LINTED - statement has no conseq */
2575 			if (err) {
2576 				eprintsoline(so, err);
2577 			}
2578 		}
2579 		break;
2580 	}
2581 	if (need_unlock)
2582 		so_unlock_single(so, SOLOCKED);
2583 	mutex_exit(&so->so_lock);
2584 	return (error);
2585 
2586 so_bad:	error = sogeterr(so, B_TRUE);
2587 bad:	eprintsoline(so, error);
2588 	goto done;
2589 }
2590 
2591 /* ARGSUSED */
2592 int
2593 sotpi_shutdown(struct sonode *so, int how, struct cred *cr)
2594 {
2595 	struct T_ordrel_req	ordrel_req;
2596 	mblk_t			*mp;
2597 	uint_t			old_state, state_change;
2598 	int			error = 0;
2599 	sotpi_info_t		*sti = SOTOTPI(so);
2600 
2601 	dprintso(so, 1, ("sotpi_shutdown(%p, %d) %s\n",
2602 	    (void *)so, how, pr_state(so->so_state, so->so_mode)));
2603 
2604 	mutex_enter(&so->so_lock);
2605 	so_lock_single(so);	/* Set SOLOCKED */
2606 
2607 	/*
2608 	 * SunOS 4.X has no check for datagram sockets.
2609 	 * 5.X checks that it is connected (ENOTCONN)
2610 	 * X/Open requires that we check the connected state.
2611 	 */
2612 	if (!(so->so_state & SS_ISCONNECTED)) {
2613 		if (!xnet_skip_checks) {
2614 			error = ENOTCONN;
2615 			if (xnet_check_print) {
2616 				printf("sockfs: X/Open shutdown check "
2617 				    "caused ENOTCONN\n");
2618 			}
2619 		}
2620 		goto done;
2621 	}
2622 	/*
2623 	 * Record the current state and then perform any state changes.
2624 	 * Then use the difference between the old and new states to
2625 	 * determine which messages need to be sent.
2626 	 * This prevents e.g. duplicate T_ORDREL_REQ when there are
2627 	 * duplicate calls to shutdown().
2628 	 */
2629 	old_state = so->so_state;
2630 
2631 	switch (how) {
2632 	case 0:
2633 		socantrcvmore(so);
2634 		break;
2635 	case 1:
2636 		socantsendmore(so);
2637 		break;
2638 	case 2:
2639 		socantsendmore(so);
2640 		socantrcvmore(so);
2641 		break;
2642 	default:
2643 		error = EINVAL;
2644 		goto done;
2645 	}
2646 
2647 	/*
2648 	 * Assumes that the SS_CANT* flags are never cleared in the above code.
2649 	 */
2650 	state_change = (so->so_state & (SS_CANTRCVMORE|SS_CANTSENDMORE)) -
2651 	    (old_state & (SS_CANTRCVMORE|SS_CANTSENDMORE));
2652 	ASSERT((state_change & ~(SS_CANTRCVMORE|SS_CANTSENDMORE)) == 0);
2653 
2654 	switch (state_change) {
2655 	case 0:
2656 		dprintso(so, 1,
2657 		    ("sotpi_shutdown: nothing to send in state 0x%x\n",
2658 		    so->so_state));
2659 		goto done;
2660 
2661 	case SS_CANTRCVMORE:
2662 		mutex_exit(&so->so_lock);
2663 		strseteof(SOTOV(so), 1);
2664 		/*
2665 		 * strseteof takes care of read side wakeups,
2666 		 * pollwakeups, and signals.
2667 		 */
2668 		/*
2669 		 * Get the read lock before flushing data to avoid problems
2670 		 * with the T_EXDATA_IND MSG_PEEK code in sotpi_recvmsg.
2671 		 */
2672 		mutex_enter(&so->so_lock);
2673 		(void) so_lock_read(so, 0);	/* Set SOREADLOCKED */
2674 		mutex_exit(&so->so_lock);
2675 
2676 		/* Flush read side queue */
2677 		strflushrq(SOTOV(so), FLUSHALL);
2678 
2679 		mutex_enter(&so->so_lock);
2680 		so_unlock_read(so);		/* Clear SOREADLOCKED */
2681 		break;
2682 
2683 	case SS_CANTSENDMORE:
2684 		mutex_exit(&so->so_lock);
2685 		strsetwerror(SOTOV(so), 0, 0, sogetwrerr);
2686 		mutex_enter(&so->so_lock);
2687 		break;
2688 
2689 	case SS_CANTSENDMORE|SS_CANTRCVMORE:
2690 		mutex_exit(&so->so_lock);
2691 		strsetwerror(SOTOV(so), 0, 0, sogetwrerr);
2692 		strseteof(SOTOV(so), 1);
2693 		/*
2694 		 * strseteof takes care of read side wakeups,
2695 		 * pollwakeups, and signals.
2696 		 */
2697 		/*
2698 		 * Get the read lock before flushing data to avoid problems
2699 		 * with the T_EXDATA_IND MSG_PEEK code in sotpi_recvmsg.
2700 		 */
2701 		mutex_enter(&so->so_lock);
2702 		(void) so_lock_read(so, 0);	/* Set SOREADLOCKED */
2703 		mutex_exit(&so->so_lock);
2704 
2705 		/* Flush read side queue */
2706 		strflushrq(SOTOV(so), FLUSHALL);
2707 
2708 		mutex_enter(&so->so_lock);
2709 		so_unlock_read(so);		/* Clear SOREADLOCKED */
2710 		break;
2711 	}
2712 
2713 	ASSERT(MUTEX_HELD(&so->so_lock));
2714 
2715 	/*
2716 	 * If either SS_CANTSENDMORE or SS_CANTRCVMORE or both of them
2717 	 * was set due to this call and the new state has both of them set:
2718 	 *	Send the AF_UNIX close indication
2719 	 *	For T_COTS send a discon_ind
2720 	 *
2721 	 * If cantsend was set due to this call:
2722 	 *	For T_COTSORD send an ordrel_ind
2723 	 *
2724 	 * Note that for T_CLTS there is no message sent here.
2725 	 */
2726 	if ((so->so_state & (SS_CANTRCVMORE|SS_CANTSENDMORE)) ==
2727 	    (SS_CANTRCVMORE|SS_CANTSENDMORE)) {
2728 		/*
2729 		 * For SunOS 4.X compatibility we tell the other end
2730 		 * that we are unable to receive at this point.
2731 		 */
2732 		if (so->so_family == AF_UNIX && sti->sti_serv_type != T_CLTS)
2733 			so_unix_close(so);
2734 
2735 		if (sti->sti_serv_type == T_COTS)
2736 			error = sodisconnect(so, -1, _SODISCONNECT_LOCK_HELD);
2737 	}
2738 	if ((state_change & SS_CANTSENDMORE) &&
2739 	    (sti->sti_serv_type == T_COTS_ORD)) {
2740 		/* Send an orderly release */
2741 		ordrel_req.PRIM_type = T_ORDREL_REQ;
2742 
2743 		mutex_exit(&so->so_lock);
2744 		mp = soallocproto1(&ordrel_req, sizeof (ordrel_req),
2745 		    0, _ALLOC_SLEEP, cr);
2746 		/*
2747 		 * Send down the T_ORDREL_REQ even if there is flow control.
2748 		 * This prevents shutdown from blocking.
2749 		 * Note that there is no T_OK_ACK for ordrel_req.
2750 		 */
2751 		error = kstrputmsg(SOTOV(so), mp, NULL, 0, 0,
2752 		    MSG_BAND|MSG_HOLDSIG|MSG_IGNERROR|MSG_IGNFLOW, 0);
2753 		mutex_enter(&so->so_lock);
2754 		if (error) {
2755 			eprintsoline(so, error);
2756 			goto done;
2757 		}
2758 	}
2759 
2760 done:
2761 	so_unlock_single(so, SOLOCKED);
2762 	mutex_exit(&so->so_lock);
2763 	return (error);
2764 }
2765 
2766 /*
2767  * For any connected SOCK_STREAM/SOCK_SEQPACKET AF_UNIX socket we send
2768  * a zero-length T_OPTDATA_REQ with the SO_UNIX_CLOSE option to inform the peer
2769  * that we have closed.
2770  * Also, for connected AF_UNIX SOCK_DGRAM sockets we send a zero-length
2771  * T_UNITDATA_REQ containing the same option.
2772  *
2773  * For SOCK_DGRAM half-connections (somebody connected to this end
2774  * but this end is not connect) we don't know where to send any
2775  * SO_UNIX_CLOSE.
2776  *
2777  * We have to ignore stream head errors just in case there has been
2778  * a shutdown(output).
2779  * Ignore any flow control to try to get the message more quickly to the peer.
2780  * While locally ignoring flow control solves the problem when there
2781  * is only the loopback transport on the stream it would not provide
2782  * the correct AF_UNIX socket semantics when one or more modules have
2783  * been pushed.
2784  */
2785 void
2786 so_unix_close(struct sonode *so)
2787 {
2788 	int		error;
2789 	struct T_opthdr	toh;
2790 	mblk_t		*mp;
2791 	sotpi_info_t	*sti = SOTOTPI(so);
2792 
2793 	ASSERT(MUTEX_HELD(&so->so_lock));
2794 
2795 	ASSERT(so->so_family == AF_UNIX);
2796 
2797 	if ((so->so_state & (SS_ISCONNECTED|SS_ISBOUND)) !=
2798 	    (SS_ISCONNECTED|SS_ISBOUND))
2799 		return;
2800 
2801 	dprintso(so, 1, ("so_unix_close(%p) %s\n",
2802 	    (void *)so, pr_state(so->so_state, so->so_mode)));
2803 
2804 	toh.level = SOL_SOCKET;
2805 	toh.name = SO_UNIX_CLOSE;
2806 
2807 	/* zero length + header */
2808 	toh.len = (t_uscalar_t)sizeof (struct T_opthdr);
2809 	toh.status = 0;
2810 
2811 	if (so->so_type == SOCK_STREAM || so->so_type == SOCK_SEQPACKET) {
2812 		struct T_optdata_req tdr;
2813 
2814 		tdr.PRIM_type = T_OPTDATA_REQ;
2815 		tdr.DATA_flag = 0;
2816 
2817 		tdr.OPT_length = (t_scalar_t)sizeof (toh);
2818 		tdr.OPT_offset = (t_scalar_t)sizeof (tdr);
2819 
2820 		/* NOTE: holding so_lock while sleeping */
2821 		mp = soallocproto2(&tdr, sizeof (tdr),
2822 		    &toh, sizeof (toh), 0, _ALLOC_SLEEP, CRED());
2823 	} else {
2824 		struct T_unitdata_req	tudr;
2825 		void			*addr;
2826 		socklen_t		addrlen;
2827 		void			*src;
2828 		socklen_t		srclen;
2829 		struct T_opthdr		toh2;
2830 		t_scalar_t		size;
2831 
2832 		/* Connecteded DGRAM socket */
2833 
2834 		/*
2835 		 * For AF_UNIX the destination address is translated to
2836 		 * an internal name and the source address is passed as
2837 		 * an option.
2838 		 */
2839 		/*
2840 		 * Length and family checks.
2841 		 */
2842 		error = so_addr_verify(so, sti->sti_faddr_sa,
2843 		    (t_uscalar_t)sti->sti_faddr_len);
2844 		if (error) {
2845 			eprintsoline(so, error);
2846 			return;
2847 		}
2848 		if (sti->sti_faddr_noxlate) {
2849 			/*
2850 			 * Already have a transport internal address. Do not
2851 			 * pass any (transport internal) source address.
2852 			 */
2853 			addr = sti->sti_faddr_sa;
2854 			addrlen = (t_uscalar_t)sti->sti_faddr_len;
2855 			src = NULL;
2856 			srclen = 0;
2857 		} else {
2858 			/*
2859 			 * Pass the sockaddr_un source address as an option
2860 			 * and translate the remote address.
2861 			 * Holding so_lock thus sti_laddr_sa can not change.
2862 			 */
2863 			src = sti->sti_laddr_sa;
2864 			srclen = (socklen_t)sti->sti_laddr_len;
2865 			dprintso(so, 1,
2866 			    ("so_ux_close: srclen %d, src %p\n",
2867 			    srclen, src));
2868 			error = so_ux_addr_xlate(so,
2869 			    sti->sti_faddr_sa,
2870 			    (socklen_t)sti->sti_faddr_len, 0,
2871 			    &addr, &addrlen);
2872 			if (error) {
2873 				eprintsoline(so, error);
2874 				return;
2875 			}
2876 		}
2877 		tudr.PRIM_type = T_UNITDATA_REQ;
2878 		tudr.DEST_length = addrlen;
2879 		tudr.DEST_offset = (t_scalar_t)sizeof (tudr);
2880 		if (srclen == 0) {
2881 			tudr.OPT_length = (t_scalar_t)sizeof (toh);
2882 			tudr.OPT_offset = (t_scalar_t)(sizeof (tudr) +
2883 			    _TPI_ALIGN_TOPT(addrlen));
2884 
2885 			size = tudr.OPT_offset + tudr.OPT_length;
2886 			/* NOTE: holding so_lock while sleeping */
2887 			mp = soallocproto2(&tudr, sizeof (tudr),
2888 			    addr, addrlen, size, _ALLOC_SLEEP, CRED());
2889 			mp->b_wptr += (_TPI_ALIGN_TOPT(addrlen) - addrlen);
2890 			soappendmsg(mp, &toh, sizeof (toh));
2891 		} else {
2892 			/*
2893 			 * There is a AF_UNIX sockaddr_un to include as a
2894 			 * source address option.
2895 			 */
2896 			tudr.OPT_length = (t_scalar_t)(2 * sizeof (toh) +
2897 			    _TPI_ALIGN_TOPT(srclen));
2898 			tudr.OPT_offset = (t_scalar_t)(sizeof (tudr) +
2899 			    _TPI_ALIGN_TOPT(addrlen));
2900 
2901 			toh2.level = SOL_SOCKET;
2902 			toh2.name = SO_SRCADDR;
2903 			toh2.len = (t_uscalar_t)(srclen +
2904 			    sizeof (struct T_opthdr));
2905 			toh2.status = 0;
2906 
2907 			size = tudr.OPT_offset + tudr.OPT_length;
2908 
2909 			/* NOTE: holding so_lock while sleeping */
2910 			mp = soallocproto2(&tudr, sizeof (tudr),
2911 			    addr, addrlen, size, _ALLOC_SLEEP, CRED());
2912 			mp->b_wptr += _TPI_ALIGN_TOPT(addrlen) - addrlen;
2913 			soappendmsg(mp, &toh, sizeof (toh));
2914 			soappendmsg(mp, &toh2, sizeof (toh2));
2915 			soappendmsg(mp, src, srclen);
2916 			mp->b_wptr += _TPI_ALIGN_TOPT(srclen) - srclen;
2917 		}
2918 		ASSERT(mp->b_wptr <= mp->b_datap->db_lim);
2919 	}
2920 	mutex_exit(&so->so_lock);
2921 	error = kstrputmsg(SOTOV(so), mp, NULL, 0, 0,
2922 	    MSG_BAND|MSG_HOLDSIG|MSG_IGNERROR|MSG_IGNFLOW, 0);
2923 	mutex_enter(&so->so_lock);
2924 }
2925 
2926 /*
2927  * Called by sotpi_recvmsg when reading a non-zero amount of data.
2928  * In addition, the caller typically verifies that there is some
2929  * potential state to clear by checking
2930  *	if (so->so_state & (SS_OOBPEND|SS_HAVEOOBDATA|SS_RCVATMARK))
2931  * before calling this routine.
2932  * Note that such a check can be made without holding so_lock since
2933  * sotpi_recvmsg is single-threaded (using SOREADLOCKED) and only sotpi_recvmsg
2934  * decrements sti_oobsigcnt.
2935  *
2936  * When data is read *after* the point that all pending
2937  * oob data has been consumed the oob indication is cleared.
2938  *
2939  * This logic keeps select/poll returning POLLRDBAND and
2940  * SIOCATMARK returning true until we have read past
2941  * the mark.
2942  */
2943 static void
2944 sorecv_update_oobstate(struct sonode *so)
2945 {
2946 	sotpi_info_t *sti = SOTOTPI(so);
2947 
2948 	mutex_enter(&so->so_lock);
2949 	ASSERT(so_verify_oobstate(so));
2950 	dprintso(so, 1,
2951 	    ("sorecv_update_oobstate: counts %d/%d state %s\n",
2952 	    sti->sti_oobsigcnt,
2953 	    sti->sti_oobcnt, pr_state(so->so_state, so->so_mode)));
2954 	if (sti->sti_oobsigcnt == 0) {
2955 		/* No more pending oob indications */
2956 		so->so_state &= ~(SS_OOBPEND|SS_HAVEOOBDATA|SS_RCVATMARK);
2957 		freemsg(so->so_oobmsg);
2958 		so->so_oobmsg = NULL;
2959 	}
2960 	ASSERT(so_verify_oobstate(so));
2961 	mutex_exit(&so->so_lock);
2962 }
2963 
2964 /*
2965  * Handle recv* calls for an so which has NL7C saved recv mblk_t(s).
2966  */
2967 static int
2968 nl7c_sorecv(struct sonode *so, mblk_t **rmp, uio_t *uiop, rval_t *rp)
2969 {
2970 	sotpi_info_t *sti = SOTOTPI(so);
2971 	int	error = 0;
2972 	mblk_t *tmp = NULL;
2973 	mblk_t *pmp = NULL;
2974 	mblk_t *nmp = sti->sti_nl7c_rcv_mp;
2975 
2976 	ASSERT(nmp != NULL);
2977 
2978 	while (nmp != NULL && uiop->uio_resid > 0) {
2979 		ssize_t n;
2980 
2981 		if (DB_TYPE(nmp) == M_DATA) {
2982 			/*
2983 			 * We have some data, uiomove up to resid bytes.
2984 			 */
2985 			n = MIN(MBLKL(nmp), uiop->uio_resid);
2986 			if (n > 0)
2987 				error = uiomove(nmp->b_rptr, n, UIO_READ, uiop);
2988 			nmp->b_rptr += n;
2989 			if (nmp->b_rptr == nmp->b_wptr) {
2990 				pmp = nmp;
2991 				nmp = nmp->b_cont;
2992 			}
2993 			if (error)
2994 				break;
2995 		} else {
2996 			/*
2997 			 * We only handle data, save for caller to handle.
2998 			 */
2999 			if (pmp != NULL) {
3000 				pmp->b_cont = nmp->b_cont;
3001 			}
3002 			nmp->b_cont = NULL;
3003 			if (*rmp == NULL) {
3004 				*rmp = nmp;
3005 			} else {
3006 				tmp->b_cont = nmp;
3007 			}
3008 			nmp = nmp->b_cont;
3009 			tmp = nmp;
3010 		}
3011 	}
3012 	if (pmp != NULL) {
3013 		/* Free any mblk_t(s) which we have consumed */
3014 		pmp->b_cont = NULL;
3015 		freemsg(sti->sti_nl7c_rcv_mp);
3016 	}
3017 	if ((sti->sti_nl7c_rcv_mp = nmp) == NULL) {
3018 		/* Last mblk_t so return the saved kstrgetmsg() rval/error */
3019 		if (error == 0) {
3020 			rval_t	*p = (rval_t *)&sti->sti_nl7c_rcv_rval;
3021 
3022 			error = p->r_v.r_v2;
3023 			p->r_v.r_v2 = 0;
3024 		}
3025 		rp->r_vals = sti->sti_nl7c_rcv_rval;
3026 		sti->sti_nl7c_rcv_rval = 0;
3027 	} else {
3028 		/* More mblk_t(s) to process so no rval to return */
3029 		rp->r_vals = 0;
3030 	}
3031 	return (error);
3032 }
3033 /*
3034  * Receive the next message on the queue.
3035  * If msg_controllen is non-zero when called the caller is interested in
3036  * any received control info (options).
3037  * If msg_namelen is non-zero when called the caller is interested in
3038  * any received source address.
3039  * The routine returns with msg_control and msg_name pointing to
3040  * kmem_alloc'ed memory which the caller has to free.
3041  */
3042 /* ARGSUSED */
3043 int
3044 sotpi_recvmsg(struct sonode *so, struct nmsghdr *msg, struct uio *uiop,
3045     struct cred *cr)
3046 {
3047 	union T_primitives	*tpr;
3048 	mblk_t			*mp;
3049 	uchar_t			pri;
3050 	int			pflag, opflag;
3051 	void			*control;
3052 	t_uscalar_t		controllen;
3053 	t_uscalar_t		namelen;
3054 	int			so_state = so->so_state; /* Snapshot */
3055 	ssize_t			saved_resid;
3056 	rval_t			rval;
3057 	int			flags;
3058 	clock_t			timout;
3059 	int			error = 0;
3060 	sotpi_info_t		*sti = SOTOTPI(so);
3061 
3062 	flags = msg->msg_flags;
3063 	msg->msg_flags = 0;
3064 
3065 	dprintso(so, 1, ("sotpi_recvmsg(%p, %p, 0x%x) state %s err %d\n",
3066 	    (void *)so, (void *)msg, flags,
3067 	    pr_state(so->so_state, so->so_mode), so->so_error));
3068 
3069 	if (so->so_version == SOV_STREAM) {
3070 		so_update_attrs(so, SOACC);
3071 		/* The imaginary "sockmod" has been popped - act as a stream */
3072 		return (strread(SOTOV(so), uiop, cr));
3073 	}
3074 
3075 	/*
3076 	 * If we are not connected because we have never been connected
3077 	 * we return ENOTCONN. If we have been connected (but are no longer
3078 	 * connected) then SS_CANTRCVMORE is set and we let kstrgetmsg return
3079 	 * the EOF.
3080 	 *
3081 	 * An alternative would be to post an ENOTCONN error in stream head
3082 	 * (read+write) and clear it when we're connected. However, that error
3083 	 * would cause incorrect poll/select behavior!
3084 	 */
3085 	if ((so_state & (SS_ISCONNECTED|SS_CANTRCVMORE)) == 0 &&
3086 	    (so->so_mode & SM_CONNREQUIRED)) {
3087 		return (ENOTCONN);
3088 	}
3089 
3090 	/*
3091 	 * Note: SunOS 4.X checks uio_resid == 0 before going to sleep (but
3092 	 * after checking that the read queue is empty) and returns zero.
3093 	 * This implementation will sleep (in kstrgetmsg) even if uio_resid
3094 	 * is zero.
3095 	 */
3096 
3097 	if (flags & MSG_OOB) {
3098 		/* Check that the transport supports OOB */
3099 		if (!(so->so_mode & SM_EXDATA))
3100 			return (EOPNOTSUPP);
3101 		so_update_attrs(so, SOACC);
3102 		return (sorecvoob(so, msg, uiop, flags,
3103 		    (so->so_options & SO_OOBINLINE)));
3104 	}
3105 
3106 	so_update_attrs(so, SOACC);
3107 
3108 	/*
3109 	 * Set msg_controllen and msg_namelen to zero here to make it
3110 	 * simpler in the cases that no control or name is returned.
3111 	 */
3112 	controllen = msg->msg_controllen;
3113 	namelen = msg->msg_namelen;
3114 	msg->msg_controllen = 0;
3115 	msg->msg_namelen = 0;
3116 
3117 	dprintso(so, 1, ("sotpi_recvmsg: namelen %d controllen %d\n",
3118 	    namelen, controllen));
3119 
3120 	mutex_enter(&so->so_lock);
3121 	/*
3122 	 * If an NL7C enabled socket and not waiting for write data.
3123 	 */
3124 	if ((sti->sti_nl7c_flags & (NL7C_ENABLED | NL7C_WAITWRITE)) ==
3125 	    NL7C_ENABLED) {
3126 		if (sti->sti_nl7c_uri) {
3127 			/* Close uri processing for a previous request */
3128 			nl7c_close(so);
3129 		}
3130 		if ((so_state & SS_CANTRCVMORE) &&
3131 		    sti->sti_nl7c_rcv_mp == NULL) {
3132 			/* Nothing to process, EOF */
3133 			mutex_exit(&so->so_lock);
3134 			return (0);
3135 		} else if (sti->sti_nl7c_flags & NL7C_SOPERSIST) {
3136 			/* Persistent NL7C socket, try to process request */
3137 			boolean_t ret;
3138 
3139 			ret = nl7c_process(so,
3140 			    (so->so_state & (SS_NONBLOCK|SS_NDELAY)));
3141 			rval.r_vals = sti->sti_nl7c_rcv_rval;
3142 			error = rval.r_v.r_v2;
3143 			if (error) {
3144 				/* Error of some sort, return it */
3145 				mutex_exit(&so->so_lock);
3146 				return (error);
3147 			}
3148 			if (sti->sti_nl7c_flags &&
3149 			    ! (sti->sti_nl7c_flags & NL7C_WAITWRITE)) {
3150 				/*
3151 				 * Still an NL7C socket and no data
3152 				 * to pass up to the caller.
3153 				 */
3154 				mutex_exit(&so->so_lock);
3155 				if (ret) {
3156 					/* EOF */
3157 					return (0);
3158 				} else {
3159 					/* Need more data */
3160 					return (EAGAIN);
3161 				}
3162 			}
3163 		} else {
3164 			/*
3165 			 * Not persistent so no further NL7C processing.
3166 			 */
3167 			sti->sti_nl7c_flags = 0;
3168 		}
3169 	}
3170 	/*
3171 	 * Only one reader is allowed at any given time. This is needed
3172 	 * for T_EXDATA handling and, in the future, MSG_WAITALL.
3173 	 *
3174 	 * This is slightly different that BSD behavior in that it fails with
3175 	 * EWOULDBLOCK when using nonblocking io. In BSD the read queue access
3176 	 * is single-threaded using sblock(), which is dropped while waiting
3177 	 * for data to appear. The difference shows up e.g. if one
3178 	 * file descriptor does not have O_NONBLOCK but a dup'ed file descriptor
3179 	 * does use nonblocking io and different threads are reading each
3180 	 * file descriptor. In BSD there would never be an EWOULDBLOCK error
3181 	 * in this case as long as the read queue doesn't get empty.
3182 	 * In this implementation the thread using nonblocking io can
3183 	 * get an EWOULDBLOCK error due to the blocking thread executing
3184 	 * e.g. in the uiomove in kstrgetmsg.
3185 	 * This difference is not believed to be significant.
3186 	 */
3187 	/* Set SOREADLOCKED */
3188 	error = so_lock_read_intr(so,
3189 	    uiop->uio_fmode | ((flags & MSG_DONTWAIT) ? FNONBLOCK : 0));
3190 	mutex_exit(&so->so_lock);
3191 	if (error)
3192 		return (error);
3193 
3194 	/*
3195 	 * Tell kstrgetmsg to not inspect the stream head errors until all
3196 	 * queued data has been consumed.
3197 	 * Use a timeout=-1 to wait forever unless MSG_DONTWAIT is set.
3198 	 * Also, If uio_fmode indicates nonblocking kstrgetmsg will not block.
3199 	 *
3200 	 * MSG_WAITALL only applies to M_DATA and T_DATA_IND messages and
3201 	 * to T_OPTDATA_IND that do not contain any user-visible control msg.
3202 	 * Note that MSG_WAITALL set with MSG_PEEK is a noop.
3203 	 */
3204 	pflag = MSG_ANY | MSG_DELAYERROR;
3205 	if (flags & MSG_PEEK) {
3206 		pflag |= MSG_IPEEK;
3207 		flags &= ~MSG_WAITALL;
3208 	}
3209 	if (so->so_mode & SM_ATOMIC)
3210 		pflag |= MSG_DISCARDTAIL;
3211 
3212 	if (flags & MSG_DONTWAIT)
3213 		timout = 0;
3214 	else
3215 		timout = -1;
3216 	opflag = pflag;
3217 retry:
3218 	saved_resid = uiop->uio_resid;
3219 	pri = 0;
3220 	mp = NULL;
3221 	if (sti->sti_nl7c_rcv_mp != NULL) {
3222 		/* Already kstrgetmsg()ed saved mblk(s) from NL7C */
3223 		error = nl7c_sorecv(so, &mp, uiop, &rval);
3224 	} else {
3225 		error = kstrgetmsg(SOTOV(so), &mp, uiop, &pri, &pflag,
3226 		    timout, &rval);
3227 	}
3228 	if (error != 0) {
3229 		/* kstrgetmsg returns ETIME when timeout expires */
3230 		if (error == ETIME)
3231 			error = EWOULDBLOCK;
3232 		goto out;
3233 	}
3234 	/*
3235 	 * For datagrams the MOREDATA flag is used to set MSG_TRUNC.
3236 	 * For non-datagrams MOREDATA is used to set MSG_EOR.
3237 	 */
3238 	ASSERT(!(rval.r_val1 & MORECTL));
3239 	if ((rval.r_val1 & MOREDATA) && (so->so_mode & SM_ATOMIC))
3240 		msg->msg_flags |= MSG_TRUNC;
3241 
3242 	if (mp == NULL) {
3243 		dprintso(so, 1, ("sotpi_recvmsg: got M_DATA\n"));
3244 		/*
3245 		 * 4.3BSD and 4.4BSD clears the mark when peeking across it.
3246 		 * The draft Posix socket spec states that the mark should
3247 		 * not be cleared when peeking. We follow the latter.
3248 		 */
3249 		if ((so->so_state &
3250 		    (SS_OOBPEND|SS_HAVEOOBDATA|SS_RCVATMARK)) &&
3251 		    (uiop->uio_resid != saved_resid) &&
3252 		    !(flags & MSG_PEEK)) {
3253 			sorecv_update_oobstate(so);
3254 		}
3255 
3256 		mutex_enter(&so->so_lock);
3257 		/* Set MSG_EOR based on MOREDATA */
3258 		if (!(rval.r_val1 & MOREDATA)) {
3259 			if (so->so_state & SS_SAVEDEOR) {
3260 				msg->msg_flags |= MSG_EOR;
3261 				so->so_state &= ~SS_SAVEDEOR;
3262 			}
3263 		}
3264 		/*
3265 		 * If some data was received (i.e. not EOF) and the
3266 		 * read/recv* has not been satisfied wait for some more.
3267 		 */
3268 		if ((flags & MSG_WAITALL) && !(msg->msg_flags & MSG_EOR) &&
3269 		    uiop->uio_resid != saved_resid && uiop->uio_resid > 0) {
3270 			mutex_exit(&so->so_lock);
3271 			pflag = opflag | MSG_NOMARK;
3272 			goto retry;
3273 		}
3274 		goto out_locked;
3275 	}
3276 
3277 	/* strsock_proto has already verified length and alignment */
3278 	tpr = (union T_primitives *)mp->b_rptr;
3279 	dprintso(so, 1, ("sotpi_recvmsg: type %d\n", tpr->type));
3280 
3281 	switch (tpr->type) {
3282 	case T_DATA_IND: {
3283 		if ((so->so_state &
3284 		    (SS_OOBPEND|SS_HAVEOOBDATA|SS_RCVATMARK)) &&
3285 		    (uiop->uio_resid != saved_resid) &&
3286 		    !(flags & MSG_PEEK)) {
3287 			sorecv_update_oobstate(so);
3288 		}
3289 
3290 		/*
3291 		 * Set msg_flags to MSG_EOR based on
3292 		 * MORE_flag and MOREDATA.
3293 		 */
3294 		mutex_enter(&so->so_lock);
3295 		so->so_state &= ~SS_SAVEDEOR;
3296 		if (!(tpr->data_ind.MORE_flag & 1)) {
3297 			if (!(rval.r_val1 & MOREDATA))
3298 				msg->msg_flags |= MSG_EOR;
3299 			else
3300 				so->so_state |= SS_SAVEDEOR;
3301 		}
3302 		freemsg(mp);
3303 		/*
3304 		 * If some data was received (i.e. not EOF) and the
3305 		 * read/recv* has not been satisfied wait for some more.
3306 		 */
3307 		if ((flags & MSG_WAITALL) && !(msg->msg_flags & MSG_EOR) &&
3308 		    uiop->uio_resid != saved_resid && uiop->uio_resid > 0) {
3309 			mutex_exit(&so->so_lock);
3310 			pflag = opflag | MSG_NOMARK;
3311 			goto retry;
3312 		}
3313 		goto out_locked;
3314 	}
3315 	case T_UNITDATA_IND: {
3316 		void *addr;
3317 		t_uscalar_t addrlen;
3318 		void *abuf;
3319 		t_uscalar_t optlen;
3320 		void *opt;
3321 
3322 		if ((so->so_state &
3323 		    (SS_OOBPEND|SS_HAVEOOBDATA|SS_RCVATMARK)) &&
3324 		    (uiop->uio_resid != saved_resid) &&
3325 		    !(flags & MSG_PEEK)) {
3326 			sorecv_update_oobstate(so);
3327 		}
3328 
3329 		if (namelen != 0) {
3330 			/* Caller wants source address */
3331 			addrlen = tpr->unitdata_ind.SRC_length;
3332 			addr = sogetoff(mp,
3333 			    tpr->unitdata_ind.SRC_offset,
3334 			    addrlen, 1);
3335 			if (addr == NULL) {
3336 				freemsg(mp);
3337 				error = EPROTO;
3338 				eprintsoline(so, error);
3339 				goto out;
3340 			}
3341 			if (so->so_family == AF_UNIX) {
3342 				/*
3343 				 * Can not use the transport level address.
3344 				 * If there is a SO_SRCADDR option carrying
3345 				 * the socket level address it will be
3346 				 * extracted below.
3347 				 */
3348 				addr = NULL;
3349 				addrlen = 0;
3350 			}
3351 		}
3352 		optlen = tpr->unitdata_ind.OPT_length;
3353 		if (optlen != 0) {
3354 			t_uscalar_t ncontrollen;
3355 
3356 			/*
3357 			 * Extract any source address option.
3358 			 * Determine how large cmsg buffer is needed.
3359 			 */
3360 			opt = sogetoff(mp,
3361 			    tpr->unitdata_ind.OPT_offset,
3362 			    optlen, __TPI_ALIGN_SIZE);
3363 
3364 			if (opt == NULL) {
3365 				freemsg(mp);
3366 				error = EPROTO;
3367 				eprintsoline(so, error);
3368 				goto out;
3369 			}
3370 			if (so->so_family == AF_UNIX)
3371 				so_getopt_srcaddr(opt, optlen, &addr, &addrlen);
3372 			ncontrollen = so_cmsglen(mp, opt, optlen,
3373 			    !(flags & MSG_XPG4_2));
3374 			if (controllen != 0)
3375 				controllen = ncontrollen;
3376 			else if (ncontrollen != 0)
3377 				msg->msg_flags |= MSG_CTRUNC;
3378 		} else {
3379 			controllen = 0;
3380 		}
3381 
3382 		if (namelen != 0) {
3383 			/*
3384 			 * Return address to caller.
3385 			 * Caller handles truncation if length
3386 			 * exceeds msg_namelen.
3387 			 * NOTE: AF_UNIX NUL termination is ensured by
3388 			 * the sender's copyin_name().
3389 			 */
3390 			abuf = kmem_alloc(addrlen, KM_SLEEP);
3391 
3392 			bcopy(addr, abuf, addrlen);
3393 			msg->msg_name = abuf;
3394 			msg->msg_namelen = addrlen;
3395 		}
3396 
3397 		if (controllen != 0) {
3398 			/*
3399 			 * Return control msg to caller.
3400 			 * Caller handles truncation if length
3401 			 * exceeds msg_controllen.
3402 			 */
3403 			control = kmem_zalloc(controllen, KM_SLEEP);
3404 
3405 			error = so_opt2cmsg(mp, opt, optlen,
3406 			    !(flags & MSG_XPG4_2),
3407 			    control, controllen);
3408 			if (error) {
3409 				freemsg(mp);
3410 				if (msg->msg_namelen != 0)
3411 					kmem_free(msg->msg_name,
3412 					    msg->msg_namelen);
3413 				kmem_free(control, controllen);
3414 				eprintsoline(so, error);
3415 				goto out;
3416 			}
3417 			msg->msg_control = control;
3418 			msg->msg_controllen = controllen;
3419 		}
3420 
3421 		freemsg(mp);
3422 		goto out;
3423 	}
3424 	case T_OPTDATA_IND: {
3425 		struct T_optdata_req *tdr;
3426 		void *opt;
3427 		t_uscalar_t optlen;
3428 
3429 		if ((so->so_state &
3430 		    (SS_OOBPEND|SS_HAVEOOBDATA|SS_RCVATMARK)) &&
3431 		    (uiop->uio_resid != saved_resid) &&
3432 		    !(flags & MSG_PEEK)) {
3433 			sorecv_update_oobstate(so);
3434 		}
3435 
3436 		tdr = (struct T_optdata_req *)mp->b_rptr;
3437 		optlen = tdr->OPT_length;
3438 		if (optlen != 0) {
3439 			t_uscalar_t ncontrollen;
3440 			/*
3441 			 * Determine how large cmsg buffer is needed.
3442 			 */
3443 			opt = sogetoff(mp,
3444 			    tpr->optdata_ind.OPT_offset,
3445 			    optlen, __TPI_ALIGN_SIZE);
3446 
3447 			if (opt == NULL) {
3448 				freemsg(mp);
3449 				error = EPROTO;
3450 				eprintsoline(so, error);
3451 				goto out;
3452 			}
3453 
3454 			ncontrollen = so_cmsglen(mp, opt, optlen,
3455 			    !(flags & MSG_XPG4_2));
3456 			if (controllen != 0)
3457 				controllen = ncontrollen;
3458 			else if (ncontrollen != 0)
3459 				msg->msg_flags |= MSG_CTRUNC;
3460 		} else {
3461 			controllen = 0;
3462 		}
3463 
3464 		if (controllen != 0) {
3465 			/*
3466 			 * Return control msg to caller.
3467 			 * Caller handles truncation if length
3468 			 * exceeds msg_controllen.
3469 			 */
3470 			control = kmem_zalloc(controllen, KM_SLEEP);
3471 
3472 			error = so_opt2cmsg(mp, opt, optlen,
3473 			    !(flags & MSG_XPG4_2),
3474 			    control, controllen);
3475 			if (error) {
3476 				freemsg(mp);
3477 				kmem_free(control, controllen);
3478 				eprintsoline(so, error);
3479 				goto out;
3480 			}
3481 			msg->msg_control = control;
3482 			msg->msg_controllen = controllen;
3483 		}
3484 
3485 		/*
3486 		 * Set msg_flags to MSG_EOR based on
3487 		 * DATA_flag and MOREDATA.
3488 		 */
3489 		mutex_enter(&so->so_lock);
3490 		so->so_state &= ~SS_SAVEDEOR;
3491 		if (!(tpr->data_ind.MORE_flag & 1)) {
3492 			if (!(rval.r_val1 & MOREDATA))
3493 				msg->msg_flags |= MSG_EOR;
3494 			else
3495 				so->so_state |= SS_SAVEDEOR;
3496 		}
3497 		freemsg(mp);
3498 		/*
3499 		 * If some data was received (i.e. not EOF) and the
3500 		 * read/recv* has not been satisfied wait for some more.
3501 		 * Not possible to wait if control info was received.
3502 		 */
3503 		if ((flags & MSG_WAITALL) && !(msg->msg_flags & MSG_EOR) &&
3504 		    controllen == 0 &&
3505 		    uiop->uio_resid != saved_resid && uiop->uio_resid > 0) {
3506 			mutex_exit(&so->so_lock);
3507 			pflag = opflag | MSG_NOMARK;
3508 			goto retry;
3509 		}
3510 		goto out_locked;
3511 	}
3512 	case T_EXDATA_IND: {
3513 		dprintso(so, 1,
3514 		    ("sotpi_recvmsg: EXDATA_IND counts %d/%d consumed %ld "
3515 		    "state %s\n",
3516 		    sti->sti_oobsigcnt, sti->sti_oobcnt,
3517 		    saved_resid - uiop->uio_resid,
3518 		    pr_state(so->so_state, so->so_mode)));
3519 		/*
3520 		 * kstrgetmsg handles MSGMARK so there is nothing to
3521 		 * inspect in the T_EXDATA_IND.
3522 		 * strsock_proto makes the stream head queue the T_EXDATA_IND
3523 		 * as a separate message with no M_DATA component. Furthermore,
3524 		 * the stream head does not consolidate M_DATA messages onto
3525 		 * an MSGMARK'ed message ensuring that the T_EXDATA_IND
3526 		 * remains a message by itself. This is needed since MSGMARK
3527 		 * marks both the whole message as well as the last byte
3528 		 * of the message.
3529 		 */
3530 		freemsg(mp);
3531 		ASSERT(uiop->uio_resid == saved_resid);	/* No data */
3532 		if (flags & MSG_PEEK) {
3533 			/*
3534 			 * Even though we are peeking we consume the
3535 			 * T_EXDATA_IND thereby moving the mark information
3536 			 * to SS_RCVATMARK. Then the oob code below will
3537 			 * retry the peeking kstrgetmsg.
3538 			 * Note that the stream head read queue is
3539 			 * never flushed without holding SOREADLOCKED
3540 			 * thus the T_EXDATA_IND can not disappear
3541 			 * underneath us.
3542 			 */
3543 			dprintso(so, 1,
3544 			    ("sotpi_recvmsg: consume EXDATA_IND "
3545 			    "counts %d/%d state %s\n",
3546 			    sti->sti_oobsigcnt,
3547 			    sti->sti_oobcnt,
3548 			    pr_state(so->so_state, so->so_mode)));
3549 
3550 			pflag = MSG_ANY | MSG_DELAYERROR;
3551 			if (so->so_mode & SM_ATOMIC)
3552 				pflag |= MSG_DISCARDTAIL;
3553 
3554 			pri = 0;
3555 			mp = NULL;
3556 
3557 			error = kstrgetmsg(SOTOV(so), &mp, uiop,
3558 			    &pri, &pflag, (clock_t)-1, &rval);
3559 			ASSERT(uiop->uio_resid == saved_resid);
3560 
3561 			if (error) {
3562 #ifdef SOCK_DEBUG
3563 				if (error != EWOULDBLOCK && error != EINTR) {
3564 					eprintsoline(so, error);
3565 				}
3566 #endif /* SOCK_DEBUG */
3567 				goto out;
3568 			}
3569 			ASSERT(mp);
3570 			tpr = (union T_primitives *)mp->b_rptr;
3571 			ASSERT(tpr->type == T_EXDATA_IND);
3572 			freemsg(mp);
3573 		} /* end "if (flags & MSG_PEEK)" */
3574 
3575 		/*
3576 		 * Decrement the number of queued and pending oob.
3577 		 *
3578 		 * SS_RCVATMARK is cleared when we read past a mark.
3579 		 * SS_HAVEOOBDATA is cleared when we've read past the
3580 		 * last mark.
3581 		 * SS_OOBPEND is cleared if we've read past the last
3582 		 * mark and no (new) SIGURG has been posted.
3583 		 */
3584 		mutex_enter(&so->so_lock);
3585 		ASSERT(so_verify_oobstate(so));
3586 		ASSERT(sti->sti_oobsigcnt >= sti->sti_oobcnt);
3587 		ASSERT(sti->sti_oobsigcnt > 0);
3588 		sti->sti_oobsigcnt--;
3589 		ASSERT(sti->sti_oobcnt > 0);
3590 		sti->sti_oobcnt--;
3591 		/*
3592 		 * Since the T_EXDATA_IND has been removed from the stream
3593 		 * head, but we have not read data past the mark,
3594 		 * sockfs needs to track that the socket is still at the mark.
3595 		 *
3596 		 * Since no data was received call kstrgetmsg again to wait
3597 		 * for data.
3598 		 */
3599 		so->so_state |= SS_RCVATMARK;
3600 		mutex_exit(&so->so_lock);
3601 		dprintso(so, 1,
3602 		    ("sotpi_recvmsg: retry EXDATA_IND counts %d/%d state %s\n",
3603 		    sti->sti_oobsigcnt, sti->sti_oobcnt,
3604 		    pr_state(so->so_state, so->so_mode)));
3605 		pflag = opflag;
3606 		goto retry;
3607 	}
3608 	default:
3609 		cmn_err(CE_CONT, "sotpi_recvmsg: so %p prim %d mp %p\n",
3610 		    (void *)so, tpr->type, (void *)mp);
3611 		ASSERT(0);
3612 		freemsg(mp);
3613 		error = EPROTO;
3614 		eprintsoline(so, error);
3615 		goto out;
3616 	}
3617 	/* NOTREACHED */
3618 out:
3619 	mutex_enter(&so->so_lock);
3620 out_locked:
3621 	so_unlock_read(so);	/* Clear SOREADLOCKED */
3622 	mutex_exit(&so->so_lock);
3623 	return (error);
3624 }
3625 
3626 /*
3627  * Sending data with options on a datagram socket.
3628  * Assumes caller has verified that SS_ISBOUND etc. are set.
3629  */
3630 static int
3631 sosend_dgramcmsg(struct sonode *so, struct sockaddr *name, socklen_t namelen,
3632     struct uio *uiop, void *control, t_uscalar_t controllen, int flags)
3633 {
3634 	struct T_unitdata_req	tudr;
3635 	mblk_t			*mp;
3636 	int			error;
3637 	void			*addr;
3638 	socklen_t		addrlen;
3639 	void			*src;
3640 	socklen_t		srclen;
3641 	ssize_t			len;
3642 	int			size;
3643 	struct T_opthdr		toh;
3644 	struct fdbuf		*fdbuf;
3645 	t_uscalar_t		optlen;
3646 	void			*fds;
3647 	int			fdlen;
3648 	sotpi_info_t		*sti = SOTOTPI(so);
3649 
3650 	ASSERT(name && namelen);
3651 	ASSERT(control && controllen);
3652 
3653 	len = uiop->uio_resid;
3654 	if (len > (ssize_t)sti->sti_tidu_size) {
3655 		return (EMSGSIZE);
3656 	}
3657 
3658 	/*
3659 	 * For AF_UNIX the destination address is translated to an internal
3660 	 * name and the source address is passed as an option.
3661 	 * Also, file descriptors are passed as file pointers in an
3662 	 * option.
3663 	 */
3664 
3665 	/*
3666 	 * Length and family checks.
3667 	 */
3668 	error = so_addr_verify(so, name, namelen);
3669 	if (error) {
3670 		eprintsoline(so, error);
3671 		return (error);
3672 	}
3673 	if (so->so_family == AF_UNIX) {
3674 		if (sti->sti_faddr_noxlate) {
3675 			/*
3676 			 * Already have a transport internal address. Do not
3677 			 * pass any (transport internal) source address.
3678 			 */
3679 			addr = name;
3680 			addrlen = namelen;
3681 			src = NULL;
3682 			srclen = 0;
3683 		} else {
3684 			/*
3685 			 * Pass the sockaddr_un source address as an option
3686 			 * and translate the remote address.
3687 			 *
3688 			 * Note that this code does not prevent sti_laddr_sa
3689 			 * from changing while it is being used. Thus
3690 			 * if an unbind+bind occurs concurrently with this
3691 			 * send the peer might see a partially new and a
3692 			 * partially old "from" address.
3693 			 */
3694 			src = sti->sti_laddr_sa;
3695 			srclen = (t_uscalar_t)sti->sti_laddr_len;
3696 			dprintso(so, 1,
3697 			    ("sosend_dgramcmsg UNIX: srclen %d, src %p\n",
3698 			    srclen, src));
3699 			error = so_ux_addr_xlate(so, name, namelen,
3700 			    (flags & MSG_XPG4_2),
3701 			    &addr, &addrlen);
3702 			if (error) {
3703 				eprintsoline(so, error);
3704 				return (error);
3705 			}
3706 		}
3707 	} else {
3708 		addr = name;
3709 		addrlen = namelen;
3710 		src = NULL;
3711 		srclen = 0;
3712 	}
3713 	optlen = so_optlen(control, controllen,
3714 	    !(flags & MSG_XPG4_2));
3715 	tudr.PRIM_type = T_UNITDATA_REQ;
3716 	tudr.DEST_length = addrlen;
3717 	tudr.DEST_offset = (t_scalar_t)sizeof (tudr);
3718 	if (srclen != 0)
3719 		tudr.OPT_length = (t_scalar_t)(optlen + sizeof (toh) +
3720 		    _TPI_ALIGN_TOPT(srclen));
3721 	else
3722 		tudr.OPT_length = optlen;
3723 	tudr.OPT_offset = (t_scalar_t)(sizeof (tudr) +
3724 	    _TPI_ALIGN_TOPT(addrlen));
3725 
3726 	size = tudr.OPT_offset + tudr.OPT_length;
3727 
3728 	/*
3729 	 * File descriptors only when SM_FDPASSING set.
3730 	 */
3731 	error = so_getfdopt(control, controllen,
3732 	    !(flags & MSG_XPG4_2), &fds, &fdlen);
3733 	if (error)
3734 		return (error);
3735 	if (fdlen != -1) {
3736 		if (!(so->so_mode & SM_FDPASSING))
3737 			return (EOPNOTSUPP);
3738 
3739 		error = fdbuf_create(fds, fdlen, &fdbuf);
3740 		if (error)
3741 			return (error);
3742 		mp = fdbuf_allocmsg(size, fdbuf);
3743 	} else {
3744 		mp = soallocproto(size, _ALLOC_INTR, CRED());
3745 		if (mp == NULL) {
3746 			/*
3747 			 * Caught a signal waiting for memory.
3748 			 * Let send* return EINTR.
3749 			 */
3750 			return (EINTR);
3751 		}
3752 	}
3753 	soappendmsg(mp, &tudr, sizeof (tudr));
3754 	soappendmsg(mp, addr, addrlen);
3755 	mp->b_wptr += _TPI_ALIGN_TOPT(addrlen) - addrlen;
3756 
3757 	if (fdlen != -1) {
3758 		ASSERT(fdbuf != NULL);
3759 		toh.level = SOL_SOCKET;
3760 		toh.name = SO_FILEP;
3761 		toh.len = fdbuf->fd_size +
3762 		    (t_uscalar_t)sizeof (struct T_opthdr);
3763 		toh.status = 0;
3764 		soappendmsg(mp, &toh, sizeof (toh));
3765 		soappendmsg(mp, fdbuf, fdbuf->fd_size);
3766 		ASSERT(__TPI_TOPT_ISALIGNED(mp->b_wptr));
3767 	}
3768 	if (srclen != 0) {
3769 		/*
3770 		 * There is a AF_UNIX sockaddr_un to include as a source
3771 		 * address option.
3772 		 */
3773 		toh.level = SOL_SOCKET;
3774 		toh.name = SO_SRCADDR;
3775 		toh.len = (t_uscalar_t)(srclen + sizeof (struct T_opthdr));
3776 		toh.status = 0;
3777 		soappendmsg(mp, &toh, sizeof (toh));
3778 		soappendmsg(mp, src, srclen);
3779 		mp->b_wptr += _TPI_ALIGN_TOPT(srclen) - srclen;
3780 		ASSERT(__TPI_TOPT_ISALIGNED(mp->b_wptr));
3781 	}
3782 	ASSERT(mp->b_wptr <= mp->b_datap->db_lim);
3783 	so_cmsg2opt(control, controllen, !(flags & MSG_XPG4_2), mp);
3784 	/* At most 3 bytes left in the message */
3785 	ASSERT(MBLKL(mp) > (ssize_t)(size - __TPI_ALIGN_SIZE));
3786 	ASSERT(MBLKL(mp) <= (ssize_t)size);
3787 
3788 	ASSERT(mp->b_wptr <= mp->b_datap->db_lim);
3789 	if (AU_AUDITING())
3790 		audit_sock(T_UNITDATA_REQ, strvp2wq(SOTOV(so)), mp, 0);
3791 
3792 	error = kstrputmsg(SOTOV(so), mp, uiop, len, 0, MSG_BAND, 0);
3793 #ifdef SOCK_DEBUG
3794 	if (error) {
3795 		eprintsoline(so, error);
3796 	}
3797 #endif /* SOCK_DEBUG */
3798 	return (error);
3799 }
3800 
3801 /*
3802  * Sending data with options on a connected stream socket.
3803  * Assumes caller has verified that SS_ISCONNECTED is set.
3804  */
3805 static int
3806 sosend_svccmsg(struct sonode *so, struct uio *uiop, int more, void *control,
3807     t_uscalar_t controllen, int flags)
3808 {
3809 	struct T_optdata_req	tdr;
3810 	mblk_t			*mp;
3811 	int			error;
3812 	ssize_t			iosize;
3813 	int			size;
3814 	struct fdbuf		*fdbuf;
3815 	t_uscalar_t		optlen;
3816 	void			*fds;
3817 	int			fdlen;
3818 	struct T_opthdr		toh;
3819 	sotpi_info_t		*sti = SOTOTPI(so);
3820 
3821 	dprintso(so, 1,
3822 	    ("sosend_svccmsg: resid %ld bytes\n", uiop->uio_resid));
3823 
3824 	/*
3825 	 * Has to be bound and connected. However, since no locks are
3826 	 * held the state could have changed after sotpi_sendmsg checked it
3827 	 * thus it is not possible to ASSERT on the state.
3828 	 */
3829 
3830 	/* Options on connection-oriented only when SM_OPTDATA set. */
3831 	if (!(so->so_mode & SM_OPTDATA))
3832 		return (EOPNOTSUPP);
3833 
3834 	do {
3835 		/*
3836 		 * Set the MORE flag if uio_resid does not fit in this
3837 		 * message or if the caller passed in "more".
3838 		 * Error for transports with zero tidu_size.
3839 		 */
3840 		tdr.PRIM_type = T_OPTDATA_REQ;
3841 		iosize = sti->sti_tidu_size;
3842 		if (iosize <= 0)
3843 			return (EMSGSIZE);
3844 		if (uiop->uio_resid > iosize) {
3845 			tdr.DATA_flag = 1;
3846 		} else {
3847 			if (more)
3848 				tdr.DATA_flag = 1;
3849 			else
3850 				tdr.DATA_flag = 0;
3851 			iosize = uiop->uio_resid;
3852 		}
3853 		dprintso(so, 1, ("sosend_svccmsg: sending %d, %ld bytes\n",
3854 		    tdr.DATA_flag, iosize));
3855 
3856 		optlen = so_optlen(control, controllen, !(flags & MSG_XPG4_2));
3857 		tdr.OPT_length = optlen;
3858 		tdr.OPT_offset = (t_scalar_t)sizeof (tdr);
3859 
3860 		size = (int)sizeof (tdr) + optlen;
3861 		/*
3862 		 * File descriptors only when SM_FDPASSING set.
3863 		 */
3864 		error = so_getfdopt(control, controllen,
3865 		    !(flags & MSG_XPG4_2), &fds, &fdlen);
3866 		if (error)
3867 			return (error);
3868 		if (fdlen != -1) {
3869 			if (!(so->so_mode & SM_FDPASSING))
3870 				return (EOPNOTSUPP);
3871 
3872 			error = fdbuf_create(fds, fdlen, &fdbuf);
3873 			if (error)
3874 				return (error);
3875 			mp = fdbuf_allocmsg(size, fdbuf);
3876 		} else {
3877 			mp = soallocproto(size, _ALLOC_INTR, CRED());
3878 			if (mp == NULL) {
3879 				/*
3880 				 * Caught a signal waiting for memory.
3881 				 * Let send* return EINTR.
3882 				 */
3883 				return (EINTR);
3884 			}
3885 		}
3886 		soappendmsg(mp, &tdr, sizeof (tdr));
3887 
3888 		if (fdlen != -1) {
3889 			ASSERT(fdbuf != NULL);
3890 			toh.level = SOL_SOCKET;
3891 			toh.name = SO_FILEP;
3892 			toh.len = fdbuf->fd_size +
3893 			    (t_uscalar_t)sizeof (struct T_opthdr);
3894 			toh.status = 0;
3895 			soappendmsg(mp, &toh, sizeof (toh));
3896 			soappendmsg(mp, fdbuf, fdbuf->fd_size);
3897 			ASSERT(__TPI_TOPT_ISALIGNED(mp->b_wptr));
3898 		}
3899 		so_cmsg2opt(control, controllen, !(flags & MSG_XPG4_2), mp);
3900 		/* At most 3 bytes left in the message */
3901 		ASSERT(MBLKL(mp) > (ssize_t)(size - __TPI_ALIGN_SIZE));
3902 		ASSERT(MBLKL(mp) <= (ssize_t)size);
3903 
3904 		ASSERT(mp->b_wptr <= mp->b_datap->db_lim);
3905 
3906 		error = kstrputmsg(SOTOV(so), mp, uiop, iosize,
3907 		    0, MSG_BAND, 0);
3908 		if (error) {
3909 			eprintsoline(so, error);
3910 			return (error);
3911 		}
3912 		control = NULL;
3913 		if (uiop->uio_resid > 0) {
3914 			/*
3915 			 * Recheck for fatal errors. Fail write even though
3916 			 * some data have been written. This is consistent
3917 			 * with strwrite semantics and BSD sockets semantics.
3918 			 */
3919 			if (so->so_state & SS_CANTSENDMORE) {
3920 				eprintsoline(so, error);
3921 				return (EPIPE);
3922 			}
3923 			if (so->so_error != 0) {
3924 				mutex_enter(&so->so_lock);
3925 				error = sogeterr(so, B_TRUE);
3926 				mutex_exit(&so->so_lock);
3927 				if (error != 0) {
3928 					eprintsoline(so, error);
3929 					return (error);
3930 				}
3931 			}
3932 		}
3933 	} while (uiop->uio_resid > 0);
3934 	return (0);
3935 }
3936 
3937 /*
3938  * Sending data on a datagram socket.
3939  * Assumes caller has verified that SS_ISBOUND etc. are set.
3940  *
3941  * For AF_UNIX the destination address is translated to an internal
3942  * name and the source address is passed as an option.
3943  */
3944 int
3945 sosend_dgram(struct sonode *so, struct sockaddr	*name, socklen_t namelen,
3946     struct uio *uiop, int flags)
3947 {
3948 	struct T_unitdata_req	tudr;
3949 	mblk_t			*mp;
3950 	int			error;
3951 	void			*addr;
3952 	socklen_t		addrlen;
3953 	void			*src;
3954 	socklen_t		srclen;
3955 	ssize_t			len;
3956 	sotpi_info_t		*sti = SOTOTPI(so);
3957 
3958 	ASSERT(name != NULL && namelen != 0);
3959 
3960 	len = uiop->uio_resid;
3961 	if (len > sti->sti_tidu_size) {
3962 		error = EMSGSIZE;
3963 		goto done;
3964 	}
3965 
3966 	/* Length and family checks */
3967 	error = so_addr_verify(so, name, namelen);
3968 	if (error != 0)
3969 		goto done;
3970 
3971 	if (sti->sti_direct)
3972 		return (sodgram_direct(so, name, namelen, uiop, flags));
3973 
3974 	if (so->so_family == AF_UNIX) {
3975 		if (sti->sti_faddr_noxlate) {
3976 			/*
3977 			 * Already have a transport internal address. Do not
3978 			 * pass any (transport internal) source address.
3979 			 */
3980 			addr = name;
3981 			addrlen = namelen;
3982 			src = NULL;
3983 			srclen = 0;
3984 		} else {
3985 			/*
3986 			 * Pass the sockaddr_un source address as an option
3987 			 * and translate the remote address.
3988 			 *
3989 			 * Note that this code does not prevent sti_laddr_sa
3990 			 * from changing while it is being used. Thus
3991 			 * if an unbind+bind occurs concurrently with this
3992 			 * send the peer might see a partially new and a
3993 			 * partially old "from" address.
3994 			 */
3995 			src = sti->sti_laddr_sa;
3996 			srclen = (socklen_t)sti->sti_laddr_len;
3997 			dprintso(so, 1,
3998 			    ("sosend_dgram UNIX: srclen %d, src %p\n",
3999 			    srclen, src));
4000 			error = so_ux_addr_xlate(so, name, namelen,
4001 			    (flags & MSG_XPG4_2),
4002 			    &addr, &addrlen);
4003 			if (error) {
4004 				eprintsoline(so, error);
4005 				goto done;
4006 			}
4007 		}
4008 	} else {
4009 		addr = name;
4010 		addrlen = namelen;
4011 		src = NULL;
4012 		srclen = 0;
4013 	}
4014 	tudr.PRIM_type = T_UNITDATA_REQ;
4015 	tudr.DEST_length = addrlen;
4016 	tudr.DEST_offset = (t_scalar_t)sizeof (tudr);
4017 	if (srclen == 0) {
4018 		tudr.OPT_length = 0;
4019 		tudr.OPT_offset = 0;
4020 
4021 		mp = soallocproto2(&tudr, sizeof (tudr),
4022 		    addr, addrlen, 0, _ALLOC_INTR, CRED());
4023 		if (mp == NULL) {
4024 			/*
4025 			 * Caught a signal waiting for memory.
4026 			 * Let send* return EINTR.
4027 			 */
4028 			error = EINTR;
4029 			goto done;
4030 		}
4031 	} else {
4032 		/*
4033 		 * There is a AF_UNIX sockaddr_un to include as a source
4034 		 * address option.
4035 		 */
4036 		struct T_opthdr toh;
4037 		ssize_t size;
4038 
4039 		tudr.OPT_length = (t_scalar_t)(sizeof (toh) +
4040 		    _TPI_ALIGN_TOPT(srclen));
4041 		tudr.OPT_offset = (t_scalar_t)(sizeof (tudr) +
4042 		    _TPI_ALIGN_TOPT(addrlen));
4043 
4044 		toh.level = SOL_SOCKET;
4045 		toh.name = SO_SRCADDR;
4046 		toh.len = (t_uscalar_t)(srclen + sizeof (struct T_opthdr));
4047 		toh.status = 0;
4048 
4049 		size = tudr.OPT_offset + tudr.OPT_length;
4050 		mp = soallocproto2(&tudr, sizeof (tudr),
4051 		    addr, addrlen, size, _ALLOC_INTR, CRED());
4052 		if (mp == NULL) {
4053 			/*
4054 			 * Caught a signal waiting for memory.
4055 			 * Let send* return EINTR.
4056 			 */
4057 			error = EINTR;
4058 			goto done;
4059 		}
4060 		mp->b_wptr += _TPI_ALIGN_TOPT(addrlen) - addrlen;
4061 		soappendmsg(mp, &toh, sizeof (toh));
4062 		soappendmsg(mp, src, srclen);
4063 		mp->b_wptr += _TPI_ALIGN_TOPT(srclen) - srclen;
4064 		ASSERT(mp->b_wptr <= mp->b_datap->db_lim);
4065 	}
4066 
4067 	if (AU_AUDITING())
4068 		audit_sock(T_UNITDATA_REQ, strvp2wq(SOTOV(so)), mp, 0);
4069 
4070 	error = kstrputmsg(SOTOV(so), mp, uiop, len, 0, MSG_BAND, 0);
4071 done:
4072 #ifdef SOCK_DEBUG
4073 	if (error) {
4074 		eprintsoline(so, error);
4075 	}
4076 #endif /* SOCK_DEBUG */
4077 	return (error);
4078 }
4079 
4080 /*
4081  * Sending data on a connected stream socket.
4082  * Assumes caller has verified that SS_ISCONNECTED is set.
4083  */
4084 int
4085 sosend_svc(struct sonode *so, struct uio *uiop, t_scalar_t prim, int more,
4086     int sflag)
4087 {
4088 	struct T_data_req	tdr;
4089 	mblk_t			*mp;
4090 	int			error;
4091 	ssize_t			iosize;
4092 	sotpi_info_t		*sti = SOTOTPI(so);
4093 
4094 	dprintso(so, 1,
4095 	    ("sosend_svc: %p, resid %ld bytes, prim %d, sflag 0x%x\n",
4096 	    (void *)so, uiop->uio_resid, prim, sflag));
4097 
4098 	/*
4099 	 * Has to be bound and connected. However, since no locks are
4100 	 * held the state could have changed after sotpi_sendmsg checked it
4101 	 * thus it is not possible to ASSERT on the state.
4102 	 */
4103 
4104 	do {
4105 		/*
4106 		 * Set the MORE flag if uio_resid does not fit in this
4107 		 * message or if the caller passed in "more".
4108 		 * Error for transports with zero tidu_size.
4109 		 */
4110 		tdr.PRIM_type = prim;
4111 		iosize = sti->sti_tidu_size;
4112 		if (iosize <= 0)
4113 			return (EMSGSIZE);
4114 		if (uiop->uio_resid > iosize) {
4115 			tdr.MORE_flag = 1;
4116 		} else {
4117 			if (more)
4118 				tdr.MORE_flag = 1;
4119 			else
4120 				tdr.MORE_flag = 0;
4121 			iosize = uiop->uio_resid;
4122 		}
4123 		dprintso(so, 1, ("sosend_svc: sending 0x%x %d, %ld bytes\n",
4124 		    prim, tdr.MORE_flag, iosize));
4125 		mp = soallocproto1(&tdr, sizeof (tdr), 0, _ALLOC_INTR, CRED());
4126 		if (mp == NULL) {
4127 			/*
4128 			 * Caught a signal waiting for memory.
4129 			 * Let send* return EINTR.
4130 			 */
4131 			return (EINTR);
4132 		}
4133 
4134 		error = kstrputmsg(SOTOV(so), mp, uiop, iosize,
4135 		    0, sflag | MSG_BAND, 0);
4136 		if (error) {
4137 			eprintsoline(so, error);
4138 			return (error);
4139 		}
4140 		if (uiop->uio_resid > 0) {
4141 			/*
4142 			 * Recheck for fatal errors. Fail write even though
4143 			 * some data have been written. This is consistent
4144 			 * with strwrite semantics and BSD sockets semantics.
4145 			 */
4146 			if (so->so_state & SS_CANTSENDMORE) {
4147 				eprintsoline(so, error);
4148 				return (EPIPE);
4149 			}
4150 			if (so->so_error != 0) {
4151 				mutex_enter(&so->so_lock);
4152 				error = sogeterr(so, B_TRUE);
4153 				mutex_exit(&so->so_lock);
4154 				if (error != 0) {
4155 					eprintsoline(so, error);
4156 					return (error);
4157 				}
4158 			}
4159 		}
4160 	} while (uiop->uio_resid > 0);
4161 	return (0);
4162 }
4163 
4164 /*
4165  * Check the state for errors and call the appropriate send function.
4166  *
4167  * If MSG_DONTROUTE is set (and SO_DONTROUTE isn't already set)
4168  * this function issues a setsockopt to toggle SO_DONTROUTE before and
4169  * after sending the message.
4170  */
4171 static int
4172 sotpi_sendmsg(struct sonode *so, struct nmsghdr *msg, struct uio *uiop,
4173     struct cred *cr)
4174 {
4175 	int		so_state;
4176 	int		so_mode;
4177 	int		error;
4178 	struct sockaddr *name;
4179 	t_uscalar_t	namelen;
4180 	int		dontroute;
4181 	int		flags;
4182 	sotpi_info_t	*sti = SOTOTPI(so);
4183 
4184 	dprintso(so, 1, ("sotpi_sendmsg(%p, %p, 0x%x) state %s, error %d\n",
4185 	    (void *)so, (void *)msg, msg->msg_flags,
4186 	    pr_state(so->so_state, so->so_mode), so->so_error));
4187 
4188 	if (so->so_version == SOV_STREAM) {
4189 		/* The imaginary "sockmod" has been popped - act as a stream */
4190 		so_update_attrs(so, SOMOD);
4191 		return (strwrite(SOTOV(so), uiop, cr));
4192 	}
4193 
4194 	mutex_enter(&so->so_lock);
4195 	so_state = so->so_state;
4196 
4197 	if (so_state & SS_CANTSENDMORE) {
4198 		mutex_exit(&so->so_lock);
4199 		return (EPIPE);
4200 	}
4201 
4202 	if (so->so_error != 0) {
4203 		error = sogeterr(so, B_TRUE);
4204 		if (error != 0) {
4205 			mutex_exit(&so->so_lock);
4206 			return (error);
4207 		}
4208 	}
4209 
4210 	name = (struct sockaddr *)msg->msg_name;
4211 	namelen = msg->msg_namelen;
4212 
4213 	so_mode = so->so_mode;
4214 
4215 	if (name == NULL) {
4216 		if (!(so_state & SS_ISCONNECTED)) {
4217 			mutex_exit(&so->so_lock);
4218 			if (so_mode & SM_CONNREQUIRED)
4219 				return (ENOTCONN);
4220 			else
4221 				return (EDESTADDRREQ);
4222 		}
4223 		if (so_mode & SM_CONNREQUIRED) {
4224 			name = NULL;
4225 			namelen = 0;
4226 		} else {
4227 			/*
4228 			 * Note that this code does not prevent sti_faddr_sa
4229 			 * from changing while it is being used. Thus
4230 			 * if an "unconnect"+connect occurs concurrently with
4231 			 * this send the datagram might be delivered to a
4232 			 * garbaled address.
4233 			 */
4234 			ASSERT(sti->sti_faddr_sa);
4235 			name = sti->sti_faddr_sa;
4236 			namelen = (t_uscalar_t)sti->sti_faddr_len;
4237 		}
4238 	} else {
4239 		if (!(so_state & SS_ISCONNECTED) &&
4240 		    (so_mode & SM_CONNREQUIRED)) {
4241 			/* Required but not connected */
4242 			mutex_exit(&so->so_lock);
4243 			return (ENOTCONN);
4244 		}
4245 		/*
4246 		 * Ignore the address on connection-oriented sockets.
4247 		 * Just like BSD this code does not generate an error for
4248 		 * TCP (a CONNREQUIRED socket) when sending to an address
4249 		 * passed in with sendto/sendmsg. Instead the data is
4250 		 * delivered on the connection as if no address had been
4251 		 * supplied.
4252 		 */
4253 		if ((so_state & SS_ISCONNECTED) &&
4254 		    !(so_mode & SM_CONNREQUIRED)) {
4255 			mutex_exit(&so->so_lock);
4256 			return (EISCONN);
4257 		}
4258 		if (!(so_state & SS_ISBOUND)) {
4259 			so_lock_single(so);	/* Set SOLOCKED */
4260 			error = sotpi_bind(so, NULL, 0,
4261 			    _SOBIND_UNSPEC|_SOBIND_LOCK_HELD, cr);
4262 			so_unlock_single(so, SOLOCKED);
4263 			if (error) {
4264 				mutex_exit(&so->so_lock);
4265 				eprintsoline(so, error);
4266 				return (error);
4267 			}
4268 		}
4269 		/*
4270 		 * Handle delayed datagram errors. These are only queued
4271 		 * when the application sets SO_DGRAM_ERRIND.
4272 		 * Return the error if we are sending to the address
4273 		 * that was returned in the last T_UDERROR_IND.
4274 		 * If sending to some other address discard the delayed
4275 		 * error indication.
4276 		 */
4277 		if (sti->sti_delayed_error) {
4278 			struct T_uderror_ind	*tudi;
4279 			void			*addr;
4280 			t_uscalar_t		addrlen;
4281 			boolean_t		match = B_FALSE;
4282 
4283 			ASSERT(sti->sti_eaddr_mp);
4284 			error = sti->sti_delayed_error;
4285 			sti->sti_delayed_error = 0;
4286 			tudi =
4287 			    (struct T_uderror_ind *)sti->sti_eaddr_mp->b_rptr;
4288 			addrlen = tudi->DEST_length;
4289 			addr = sogetoff(sti->sti_eaddr_mp,
4290 			    tudi->DEST_offset, addrlen, 1);
4291 			ASSERT(addr);	/* Checked by strsock_proto */
4292 			switch (so->so_family) {
4293 			case AF_INET: {
4294 				/* Compare just IP address and port */
4295 				sin_t *sin1 = (sin_t *)name;
4296 				sin_t *sin2 = (sin_t *)addr;
4297 
4298 				if (addrlen == sizeof (sin_t) &&
4299 				    namelen == addrlen &&
4300 				    sin1->sin_port == sin2->sin_port &&
4301 				    sin1->sin_addr.s_addr ==
4302 				    sin2->sin_addr.s_addr)
4303 					match = B_TRUE;
4304 				break;
4305 			}
4306 			case AF_INET6: {
4307 				/* Compare just IP address and port. Not flow */
4308 				sin6_t *sin1 = (sin6_t *)name;
4309 				sin6_t *sin2 = (sin6_t *)addr;
4310 
4311 				if (addrlen == sizeof (sin6_t) &&
4312 				    namelen == addrlen &&
4313 				    sin1->sin6_port == sin2->sin6_port &&
4314 				    IN6_ARE_ADDR_EQUAL(&sin1->sin6_addr,
4315 				    &sin2->sin6_addr))
4316 					match = B_TRUE;
4317 				break;
4318 			}
4319 			case AF_UNIX:
4320 			default:
4321 				if (namelen == addrlen &&
4322 				    bcmp(name, addr, namelen) == 0)
4323 					match = B_TRUE;
4324 			}
4325 			if (match) {
4326 				freemsg(sti->sti_eaddr_mp);
4327 				sti->sti_eaddr_mp = NULL;
4328 				mutex_exit(&so->so_lock);
4329 #ifdef DEBUG
4330 				dprintso(so, 0,
4331 				    ("sockfs delayed error %d for %s\n",
4332 				    error,
4333 				    pr_addr(so->so_family, name, namelen)));
4334 #endif /* DEBUG */
4335 				return (error);
4336 			}
4337 			freemsg(sti->sti_eaddr_mp);
4338 			sti->sti_eaddr_mp = NULL;
4339 		}
4340 	}
4341 	mutex_exit(&so->so_lock);
4342 
4343 	flags = msg->msg_flags;
4344 	dontroute = 0;
4345 	if ((flags & MSG_DONTROUTE) && !(so->so_options & SO_DONTROUTE)) {
4346 		uint32_t	val;
4347 
4348 		val = 1;
4349 		error = sotpi_setsockopt(so, SOL_SOCKET, SO_DONTROUTE,
4350 		    &val, (t_uscalar_t)sizeof (val), cr);
4351 		if (error)
4352 			return (error);
4353 		dontroute = 1;
4354 	}
4355 
4356 	if ((flags & MSG_OOB) && !(so_mode & SM_EXDATA)) {
4357 		error = EOPNOTSUPP;
4358 		goto done;
4359 	}
4360 	if (msg->msg_controllen != 0) {
4361 		if (!(so_mode & SM_CONNREQUIRED)) {
4362 			so_update_attrs(so, SOMOD);
4363 			error = sosend_dgramcmsg(so, name, namelen, uiop,
4364 			    msg->msg_control, msg->msg_controllen, flags);
4365 		} else {
4366 			if (flags & MSG_OOB) {
4367 				/* Can't generate T_EXDATA_REQ with options */
4368 				error = EOPNOTSUPP;
4369 				goto done;
4370 			}
4371 			so_update_attrs(so, SOMOD);
4372 			error = sosend_svccmsg(so, uiop,
4373 			    !(flags & MSG_EOR),
4374 			    msg->msg_control, msg->msg_controllen,
4375 			    flags);
4376 		}
4377 		goto done;
4378 	}
4379 
4380 	so_update_attrs(so, SOMOD);
4381 	if (!(so_mode & SM_CONNREQUIRED)) {
4382 		/*
4383 		 * If there is no SO_DONTROUTE to turn off return immediately
4384 		 * from send_dgram. This can allow tail-call optimizations.
4385 		 */
4386 		if (!dontroute) {
4387 			return (sosend_dgram(so, name, namelen, uiop, flags));
4388 		}
4389 		error = sosend_dgram(so, name, namelen, uiop, flags);
4390 	} else {
4391 		t_scalar_t prim;
4392 		int sflag;
4393 
4394 		/* Ignore msg_name in the connected state */
4395 		if (flags & MSG_OOB) {
4396 			prim = T_EXDATA_REQ;
4397 			/*
4398 			 * Send down T_EXDATA_REQ even if there is flow
4399 			 * control for data.
4400 			 */
4401 			sflag = MSG_IGNFLOW;
4402 		} else {
4403 			if (so_mode & SM_BYTESTREAM) {
4404 				/* Byte stream transport - use write */
4405 				dprintso(so, 1, ("sotpi_sendmsg: write\n"));
4406 
4407 				/* Send M_DATA messages */
4408 				if ((sti->sti_nl7c_flags & NL7C_ENABLED) &&
4409 				    (error = nl7c_data(so, uiop)) >= 0) {
4410 					/* NL7C consumed the data */
4411 					return (error);
4412 				}
4413 				/*
4414 				 * If there is no SO_DONTROUTE to turn off,
4415 				 * sti_direct is on, and there is no flow
4416 				 * control, we can take the fast path.
4417 				 */
4418 				if (!dontroute && sti->sti_direct != 0 &&
4419 				    canputnext(SOTOV(so)->v_stream->sd_wrq)) {
4420 					return (sostream_direct(so, uiop,
4421 					    NULL, cr));
4422 				}
4423 				error = strwrite(SOTOV(so), uiop, cr);
4424 				goto done;
4425 			}
4426 			prim = T_DATA_REQ;
4427 			sflag = 0;
4428 		}
4429 		/*
4430 		 * If there is no SO_DONTROUTE to turn off return immediately
4431 		 * from sosend_svc. This can allow tail-call optimizations.
4432 		 */
4433 		if (!dontroute)
4434 			return (sosend_svc(so, uiop, prim,
4435 			    !(flags & MSG_EOR), sflag));
4436 		error = sosend_svc(so, uiop, prim,
4437 		    !(flags & MSG_EOR), sflag);
4438 	}
4439 	ASSERT(dontroute);
4440 done:
4441 	if (dontroute) {
4442 		uint32_t	val;
4443 
4444 		val = 0;
4445 		(void) sotpi_setsockopt(so, SOL_SOCKET, SO_DONTROUTE,
4446 		    &val, (t_uscalar_t)sizeof (val), cr);
4447 	}
4448 	return (error);
4449 }
4450 
4451 /*
4452  * kstrwritemp() has very similar semantics as that of strwrite().
4453  * The main difference is it obtains mblks from the caller and also
4454  * does not do any copy as done in strwrite() from user buffers to
4455  * kernel buffers.
4456  *
4457  * Currently, this routine is used by sendfile to send data allocated
4458  * within the kernel without any copying. This interface does not use the
4459  * synchronous stream interface as synch. stream interface implies
4460  * copying.
4461  */
4462 int
4463 kstrwritemp(struct vnode *vp, mblk_t *mp, ushort_t fmode)
4464 {
4465 	struct stdata *stp;
4466 	struct queue *wqp;
4467 	mblk_t *newmp;
4468 	char waitflag;
4469 	int tempmode;
4470 	int error = 0;
4471 	int done = 0;
4472 	struct sonode *so;
4473 	boolean_t direct;
4474 
4475 	ASSERT(vp->v_stream);
4476 	stp = vp->v_stream;
4477 
4478 	so = VTOSO(vp);
4479 	direct = _SOTOTPI(so)->sti_direct;
4480 
4481 	/*
4482 	 * This is the sockfs direct fast path. canputnext() need
4483 	 * not be accurate so we don't grab the sd_lock here. If
4484 	 * we get flow-controlled, we grab sd_lock just before the
4485 	 * do..while loop below to emulate what strwrite() does.
4486 	 */
4487 	wqp = stp->sd_wrq;
4488 	if (canputnext(wqp) && direct &&
4489 	    !(stp->sd_flag & (STWRERR|STRHUP|STPLEX))) {
4490 		return (sostream_direct(so, NULL, mp, CRED()));
4491 	} else if (stp->sd_flag & (STWRERR|STRHUP|STPLEX)) {
4492 		/* Fast check of flags before acquiring the lock */
4493 		mutex_enter(&stp->sd_lock);
4494 		error = strgeterr(stp, STWRERR|STRHUP|STPLEX, 0);
4495 		mutex_exit(&stp->sd_lock);
4496 		if (error != 0) {
4497 			if (!(stp->sd_flag & STPLEX) &&
4498 			    (stp->sd_wput_opt & SW_SIGPIPE)) {
4499 				error = EPIPE;
4500 			}
4501 			return (error);
4502 		}
4503 	}
4504 
4505 	waitflag = WRITEWAIT;
4506 	if (stp->sd_flag & OLDNDELAY)
4507 		tempmode = fmode & ~FNDELAY;
4508 	else
4509 		tempmode = fmode;
4510 
4511 	mutex_enter(&stp->sd_lock);
4512 	do {
4513 		if (canputnext(wqp)) {
4514 			mutex_exit(&stp->sd_lock);
4515 			if (stp->sd_wputdatafunc != NULL) {
4516 				newmp = (stp->sd_wputdatafunc)(vp, mp, NULL,
4517 				    NULL, NULL, NULL);
4518 				if (newmp == NULL) {
4519 					/* The caller will free mp */
4520 					return (ECOMM);
4521 				}
4522 				mp = newmp;
4523 			}
4524 			putnext(wqp, mp);
4525 			return (0);
4526 		}
4527 		error = strwaitq(stp, waitflag, (ssize_t)0, tempmode, -1,
4528 		    &done);
4529 	} while (error == 0 && !done);
4530 
4531 	mutex_exit(&stp->sd_lock);
4532 	/*
4533 	 * EAGAIN tells the application to try again. ENOMEM
4534 	 * is returned only if the memory allocation size
4535 	 * exceeds the physical limits of the system. ENOMEM
4536 	 * can't be true here.
4537 	 */
4538 	if (error == ENOMEM)
4539 		error = EAGAIN;
4540 	return (error);
4541 }
4542 
4543 /* ARGSUSED */
4544 static int
4545 sotpi_sendmblk(struct sonode *so, struct nmsghdr *msg, int fflag,
4546     struct cred *cr, mblk_t **mpp)
4547 {
4548 	int error;
4549 
4550 	if (so->so_family != AF_INET && so->so_family != AF_INET6)
4551 		return (EAFNOSUPPORT);
4552 
4553 	if (so->so_state & SS_CANTSENDMORE)
4554 		return (EPIPE);
4555 
4556 	if (so->so_type != SOCK_STREAM)
4557 		return (EOPNOTSUPP);
4558 
4559 	if ((so->so_state & SS_ISCONNECTED) == 0)
4560 		return (ENOTCONN);
4561 
4562 	error = kstrwritemp(so->so_vnode, *mpp, fflag);
4563 	if (error == 0)
4564 		*mpp = NULL;
4565 	return (error);
4566 }
4567 
4568 /*
4569  * Sending data on a datagram socket.
4570  * Assumes caller has verified that SS_ISBOUND etc. are set.
4571  */
4572 /* ARGSUSED */
4573 static int
4574 sodgram_direct(struct sonode *so, struct sockaddr *name,
4575     socklen_t namelen, struct uio *uiop, int flags)
4576 {
4577 	struct T_unitdata_req	tudr;
4578 	mblk_t			*mp = NULL;
4579 	int			error = 0;
4580 	void			*addr;
4581 	socklen_t		addrlen;
4582 	ssize_t			len;
4583 	struct stdata		*stp = SOTOV(so)->v_stream;
4584 	int			so_state;
4585 	queue_t			*udp_wq;
4586 	boolean_t		connected;
4587 	mblk_t			*mpdata = NULL;
4588 	sotpi_info_t		*sti = SOTOTPI(so);
4589 	uint32_t		auditing = AU_AUDITING();
4590 
4591 	ASSERT(name != NULL && namelen != 0);
4592 	ASSERT(!(so->so_mode & SM_CONNREQUIRED));
4593 	ASSERT(!(so->so_mode & SM_EXDATA));
4594 	ASSERT(so->so_family == AF_INET || so->so_family == AF_INET6);
4595 	ASSERT(SOTOV(so)->v_type == VSOCK);
4596 
4597 	/* Caller checked for proper length */
4598 	len = uiop->uio_resid;
4599 	ASSERT(len <= sti->sti_tidu_size);
4600 
4601 	/* Length and family checks have been done by caller */
4602 	ASSERT(name->sa_family == so->so_family);
4603 	ASSERT(so->so_family == AF_INET ||
4604 	    (namelen == (socklen_t)sizeof (struct sockaddr_in6)));
4605 	ASSERT(so->so_family == AF_INET6 ||
4606 	    (namelen == (socklen_t)sizeof (struct sockaddr_in)));
4607 
4608 	addr = name;
4609 	addrlen = namelen;
4610 
4611 	if (stp->sd_sidp != NULL &&
4612 	    (error = straccess(stp, JCWRITE)) != 0)
4613 		goto done;
4614 
4615 	so_state = so->so_state;
4616 
4617 	connected = so_state & SS_ISCONNECTED;
4618 	if (!connected) {
4619 		tudr.PRIM_type = T_UNITDATA_REQ;
4620 		tudr.DEST_length = addrlen;
4621 		tudr.DEST_offset = (t_scalar_t)sizeof (tudr);
4622 		tudr.OPT_length = 0;
4623 		tudr.OPT_offset = 0;
4624 
4625 		mp = soallocproto2(&tudr, sizeof (tudr), addr, addrlen, 0,
4626 		    _ALLOC_INTR, CRED());
4627 		if (mp == NULL) {
4628 			/*
4629 			 * Caught a signal waiting for memory.
4630 			 * Let send* return EINTR.
4631 			 */
4632 			error = EINTR;
4633 			goto done;
4634 		}
4635 	}
4636 
4637 	/*
4638 	 * For UDP we don't break up the copyin into smaller pieces
4639 	 * as in the TCP case.  That means if ENOMEM is returned by
4640 	 * mcopyinuio() then the uio vector has not been modified at
4641 	 * all and we fallback to either strwrite() or kstrputmsg()
4642 	 * below.  Note also that we never generate priority messages
4643 	 * from here.
4644 	 */
4645 	udp_wq = stp->sd_wrq->q_next;
4646 	if (canput(udp_wq) &&
4647 	    (mpdata = mcopyinuio(stp, uiop, -1, -1, &error)) != NULL) {
4648 		ASSERT(DB_TYPE(mpdata) == M_DATA);
4649 		ASSERT(uiop->uio_resid == 0);
4650 		if (!connected)
4651 			linkb(mp, mpdata);
4652 		else
4653 			mp = mpdata;
4654 		if (auditing)
4655 			audit_sock(T_UNITDATA_REQ, strvp2wq(SOTOV(so)), mp, 0);
4656 
4657 		udp_wput(udp_wq, mp);
4658 		return (0);
4659 	}
4660 
4661 	ASSERT(mpdata == NULL);
4662 	if (error != 0 && error != ENOMEM) {
4663 		freemsg(mp);
4664 		return (error);
4665 	}
4666 
4667 	/*
4668 	 * For connected, let strwrite() handle the blocking case.
4669 	 * Otherwise we fall thru and use kstrputmsg().
4670 	 */
4671 	if (connected)
4672 		return (strwrite(SOTOV(so), uiop, CRED()));
4673 
4674 	if (auditing)
4675 		audit_sock(T_UNITDATA_REQ, strvp2wq(SOTOV(so)), mp, 0);
4676 
4677 	error = kstrputmsg(SOTOV(so), mp, uiop, len, 0, MSG_BAND, 0);
4678 done:
4679 #ifdef SOCK_DEBUG
4680 	if (error != 0) {
4681 		eprintsoline(so, error);
4682 	}
4683 #endif /* SOCK_DEBUG */
4684 	return (error);
4685 }
4686 
4687 int
4688 sostream_direct(struct sonode *so, struct uio *uiop, mblk_t *mp, cred_t *cr)
4689 {
4690 	struct stdata *stp = SOTOV(so)->v_stream;
4691 	ssize_t iosize, rmax, maxblk;
4692 	queue_t *tcp_wq = stp->sd_wrq->q_next;
4693 	mblk_t *newmp;
4694 	int error = 0, wflag = 0;
4695 
4696 	ASSERT(so->so_mode & SM_BYTESTREAM);
4697 	ASSERT(SOTOV(so)->v_type == VSOCK);
4698 
4699 	if (stp->sd_sidp != NULL &&
4700 	    (error = straccess(stp, JCWRITE)) != 0)
4701 		return (error);
4702 
4703 	if (uiop == NULL) {
4704 		/*
4705 		 * kstrwritemp() should have checked sd_flag and
4706 		 * flow-control before coming here.  If we end up
4707 		 * here it means that we can simply pass down the
4708 		 * data to tcp.
4709 		 */
4710 		ASSERT(mp != NULL);
4711 		if (stp->sd_wputdatafunc != NULL) {
4712 			newmp = (stp->sd_wputdatafunc)(SOTOV(so), mp, NULL,
4713 			    NULL, NULL, NULL);
4714 			if (newmp == NULL) {
4715 				/* The caller will free mp */
4716 				return (ECOMM);
4717 			}
4718 			mp = newmp;
4719 		}
4720 		tcp_wput(tcp_wq, mp);
4721 		return (0);
4722 	}
4723 
4724 	/* Fallback to strwrite() to do proper error handling */
4725 	if (stp->sd_flag & (STWRERR|STRHUP|STPLEX|STRDELIM|OLDNDELAY))
4726 		return (strwrite(SOTOV(so), uiop, cr));
4727 
4728 	rmax = stp->sd_qn_maxpsz;
4729 	ASSERT(rmax >= 0 || rmax == INFPSZ);
4730 	if (rmax == 0 || uiop->uio_resid <= 0)
4731 		return (0);
4732 
4733 	if (rmax == INFPSZ)
4734 		rmax = uiop->uio_resid;
4735 
4736 	maxblk = stp->sd_maxblk;
4737 
4738 	for (;;) {
4739 		iosize = MIN(uiop->uio_resid, rmax);
4740 
4741 		mp = mcopyinuio(stp, uiop, iosize, maxblk, &error);
4742 		if (mp == NULL) {
4743 			/*
4744 			 * Fallback to strwrite() for ENOMEM; if this
4745 			 * is our first time in this routine and the uio
4746 			 * vector has not been modified, we will end up
4747 			 * calling strwrite() without any flag set.
4748 			 */
4749 			if (error == ENOMEM)
4750 				goto slow_send;
4751 			else
4752 				return (error);
4753 		}
4754 		ASSERT(uiop->uio_resid >= 0);
4755 		/*
4756 		 * If mp is non-NULL and ENOMEM is set, it means that
4757 		 * mcopyinuio() was able to break down some of the user
4758 		 * data into one or more mblks.  Send the partial data
4759 		 * to tcp and let the rest be handled in strwrite().
4760 		 */
4761 		ASSERT(error == 0 || error == ENOMEM);
4762 		if (stp->sd_wputdatafunc != NULL) {
4763 			newmp = (stp->sd_wputdatafunc)(SOTOV(so), mp, NULL,
4764 			    NULL, NULL, NULL);
4765 			if (newmp == NULL) {
4766 				/* The caller will free mp */
4767 				return (ECOMM);
4768 			}
4769 			mp = newmp;
4770 		}
4771 		tcp_wput(tcp_wq, mp);
4772 
4773 		wflag |= NOINTR;
4774 
4775 		if (uiop->uio_resid == 0) {	/* No more data; we're done */
4776 			ASSERT(error == 0);
4777 			break;
4778 		} else if (error == ENOMEM || !canput(tcp_wq) || (stp->sd_flag &
4779 		    (STWRERR|STRHUP|STPLEX|STRDELIM|OLDNDELAY))) {
4780 slow_send:
4781 			/*
4782 			 * We were able to send down partial data using
4783 			 * the direct call interface, but are now relying
4784 			 * on strwrite() to handle the non-fastpath cases.
4785 			 * If the socket is blocking we will sleep in
4786 			 * strwaitq() until write is permitted, otherwise,
4787 			 * we will need to return the amount of bytes
4788 			 * written so far back to the app.  This is the
4789 			 * reason why we pass NOINTR flag to strwrite()
4790 			 * for non-blocking socket, because we don't want
4791 			 * to return EAGAIN when portion of the user data
4792 			 * has actually been sent down.
4793 			 */
4794 			return (strwrite_common(SOTOV(so), uiop, cr, wflag));
4795 		}
4796 	}
4797 	return (0);
4798 }
4799 
4800 /*
4801  * Update sti_faddr by asking the transport (unless AF_UNIX).
4802  */
4803 /* ARGSUSED */
4804 int
4805 sotpi_getpeername(struct sonode *so, struct sockaddr *name, socklen_t *namelen,
4806     boolean_t accept, struct cred *cr)
4807 {
4808 	struct strbuf	strbuf;
4809 	int		error = 0, res;
4810 	void		*addr;
4811 	t_uscalar_t	addrlen;
4812 	k_sigset_t	smask;
4813 	sotpi_info_t	*sti = SOTOTPI(so);
4814 
4815 	dprintso(so, 1, ("sotpi_getpeername(%p) %s\n",
4816 	    (void *)so, pr_state(so->so_state, so->so_mode)));
4817 
4818 	ASSERT(*namelen > 0);
4819 	mutex_enter(&so->so_lock);
4820 	so_lock_single(so);	/* Set SOLOCKED */
4821 
4822 	if (accept) {
4823 		bcopy(sti->sti_faddr_sa, name,
4824 		    MIN(*namelen, sti->sti_faddr_len));
4825 		*namelen = sti->sti_faddr_noxlate ? 0: sti->sti_faddr_len;
4826 		goto done;
4827 	}
4828 
4829 	if (!(so->so_state & SS_ISCONNECTED)) {
4830 		error = ENOTCONN;
4831 		goto done;
4832 	}
4833 	/* Added this check for X/Open */
4834 	if ((so->so_state & SS_CANTSENDMORE) && !xnet_skip_checks) {
4835 		error = EINVAL;
4836 		if (xnet_check_print) {
4837 			printf("sockfs: X/Open getpeername check => EINVAL\n");
4838 		}
4839 		goto done;
4840 	}
4841 
4842 	if (sti->sti_faddr_valid) {
4843 		bcopy(sti->sti_faddr_sa, name,
4844 		    MIN(*namelen, sti->sti_faddr_len));
4845 		*namelen = sti->sti_faddr_noxlate ? 0: sti->sti_faddr_len;
4846 		goto done;
4847 	}
4848 
4849 #ifdef DEBUG
4850 	dprintso(so, 1, ("sotpi_getpeername (local): %s\n",
4851 	    pr_addr(so->so_family, sti->sti_faddr_sa,
4852 	    (t_uscalar_t)sti->sti_faddr_len)));
4853 #endif /* DEBUG */
4854 
4855 	if (so->so_family == AF_UNIX) {
4856 		/* Transport has different name space - return local info */
4857 		if (sti->sti_faddr_noxlate)
4858 			*namelen = 0;
4859 		error = 0;
4860 		goto done;
4861 	}
4862 
4863 	ASSERT(so->so_family != AF_UNIX && sti->sti_faddr_noxlate == 0);
4864 
4865 	ASSERT(sti->sti_faddr_sa);
4866 	/* Allocate local buffer to use with ioctl */
4867 	addrlen = (t_uscalar_t)sti->sti_faddr_maxlen;
4868 	mutex_exit(&so->so_lock);
4869 	addr = kmem_alloc(addrlen, KM_SLEEP);
4870 
4871 	/*
4872 	 * Issue TI_GETPEERNAME with signals masked.
4873 	 * Put the result in sti_faddr_sa so that getpeername works after
4874 	 * a shutdown(output).
4875 	 * If the ioctl fails (e.g. due to a ECONNRESET) the error is reposted
4876 	 * back to the socket.
4877 	 */
4878 	strbuf.buf = addr;
4879 	strbuf.maxlen = addrlen;
4880 	strbuf.len = 0;
4881 
4882 	sigintr(&smask, 0);
4883 	res = 0;
4884 	ASSERT(cr);
4885 	error = strioctl(SOTOV(so), TI_GETPEERNAME, (intptr_t)&strbuf,
4886 	    0, K_TO_K, cr, &res);
4887 	sigunintr(&smask);
4888 
4889 	mutex_enter(&so->so_lock);
4890 	/*
4891 	 * If there is an error record the error in so_error put don't fail
4892 	 * the getpeername. Instead fallback on the recorded
4893 	 * sti->sti_faddr_sa.
4894 	 */
4895 	if (error) {
4896 		/*
4897 		 * Various stream head errors can be returned to the ioctl.
4898 		 * However, it is impossible to determine which ones of
4899 		 * these are really socket level errors that were incorrectly
4900 		 * consumed by the ioctl. Thus this code silently ignores the
4901 		 * error - to code explicitly does not reinstate the error
4902 		 * using soseterror().
4903 		 * Experiments have shows that at least this set of
4904 		 * errors are reported and should not be reinstated on the
4905 		 * socket:
4906 		 *	EINVAL	E.g. if an I_LINK was in effect when
4907 		 *		getpeername was called.
4908 		 *	EPIPE	The ioctl error semantics prefer the write
4909 		 *		side error over the read side error.
4910 		 *	ENOTCONN The transport just got disconnected but
4911 		 *		sockfs had not yet seen the T_DISCON_IND
4912 		 *		when issuing the ioctl.
4913 		 */
4914 		error = 0;
4915 	} else if (res == 0 && strbuf.len > 0 &&
4916 	    (so->so_state & SS_ISCONNECTED)) {
4917 		ASSERT(strbuf.len <= (int)sti->sti_faddr_maxlen);
4918 		sti->sti_faddr_len = (socklen_t)strbuf.len;
4919 		bcopy(addr, sti->sti_faddr_sa, sti->sti_faddr_len);
4920 		sti->sti_faddr_valid = 1;
4921 
4922 		bcopy(addr, name, MIN(*namelen, sti->sti_faddr_len));
4923 		*namelen = sti->sti_faddr_len;
4924 	}
4925 	kmem_free(addr, addrlen);
4926 #ifdef DEBUG
4927 	dprintso(so, 1, ("sotpi_getpeername (tp): %s\n",
4928 	    pr_addr(so->so_family, sti->sti_faddr_sa,
4929 	    (t_uscalar_t)sti->sti_faddr_len)));
4930 #endif /* DEBUG */
4931 done:
4932 	so_unlock_single(so, SOLOCKED);
4933 	mutex_exit(&so->so_lock);
4934 	return (error);
4935 }
4936 
4937 /*
4938  * Update sti_laddr by asking the transport (unless AF_UNIX).
4939  */
4940 int
4941 sotpi_getsockname(struct sonode *so, struct sockaddr *name, socklen_t *namelen,
4942     struct cred *cr)
4943 {
4944 	struct strbuf	strbuf;
4945 	int		error = 0, res;
4946 	void		*addr;
4947 	t_uscalar_t	addrlen;
4948 	k_sigset_t	smask;
4949 	sotpi_info_t	*sti = SOTOTPI(so);
4950 
4951 	dprintso(so, 1, ("sotpi_getsockname(%p) %s\n",
4952 	    (void *)so, pr_state(so->so_state, so->so_mode)));
4953 
4954 	ASSERT(*namelen > 0);
4955 	mutex_enter(&so->so_lock);
4956 	so_lock_single(so);	/* Set SOLOCKED */
4957 
4958 #ifdef DEBUG
4959 
4960 	dprintso(so, 1, ("sotpi_getsockname (local): %s\n",
4961 	    pr_addr(so->so_family, sti->sti_laddr_sa,
4962 	    (t_uscalar_t)sti->sti_laddr_len)));
4963 #endif /* DEBUG */
4964 	if (sti->sti_laddr_valid) {
4965 		bcopy(sti->sti_laddr_sa, name,
4966 		    MIN(*namelen, sti->sti_laddr_len));
4967 		*namelen = sti->sti_laddr_len;
4968 		goto done;
4969 	}
4970 
4971 	if (so->so_family == AF_UNIX) {
4972 		/* Transport has different name space - return local info */
4973 		error = 0;
4974 		*namelen = 0;
4975 		goto done;
4976 	}
4977 	if (!(so->so_state & SS_ISBOUND)) {
4978 		/* If not bound, then nothing to return. */
4979 		error = 0;
4980 		goto done;
4981 	}
4982 
4983 	/* Allocate local buffer to use with ioctl */
4984 	addrlen = (t_uscalar_t)sti->sti_laddr_maxlen;
4985 	mutex_exit(&so->so_lock);
4986 	addr = kmem_alloc(addrlen, KM_SLEEP);
4987 
4988 	/*
4989 	 * Issue TI_GETMYNAME with signals masked.
4990 	 * Put the result in sti_laddr_sa so that getsockname works after
4991 	 * a shutdown(output).
4992 	 * If the ioctl fails (e.g. due to a ECONNRESET) the error is reposted
4993 	 * back to the socket.
4994 	 */
4995 	strbuf.buf = addr;
4996 	strbuf.maxlen = addrlen;
4997 	strbuf.len = 0;
4998 
4999 	sigintr(&smask, 0);
5000 	res = 0;
5001 	ASSERT(cr);
5002 	error = strioctl(SOTOV(so), TI_GETMYNAME, (intptr_t)&strbuf,
5003 	    0, K_TO_K, cr, &res);
5004 	sigunintr(&smask);
5005 
5006 	mutex_enter(&so->so_lock);
5007 	/*
5008 	 * If there is an error record the error in so_error put don't fail
5009 	 * the getsockname. Instead fallback on the recorded
5010 	 * sti->sti_laddr_sa.
5011 	 */
5012 	if (error) {
5013 		/*
5014 		 * Various stream head errors can be returned to the ioctl.
5015 		 * However, it is impossible to determine which ones of
5016 		 * these are really socket level errors that were incorrectly
5017 		 * consumed by the ioctl. Thus this code silently ignores the
5018 		 * error - to code explicitly does not reinstate the error
5019 		 * using soseterror().
5020 		 * Experiments have shows that at least this set of
5021 		 * errors are reported and should not be reinstated on the
5022 		 * socket:
5023 		 *	EINVAL	E.g. if an I_LINK was in effect when
5024 		 *		getsockname was called.
5025 		 *	EPIPE	The ioctl error semantics prefer the write
5026 		 *		side error over the read side error.
5027 		 */
5028 		error = 0;
5029 	} else if (res == 0 && strbuf.len > 0 &&
5030 	    (so->so_state & SS_ISBOUND)) {
5031 		ASSERT(strbuf.len <= (int)sti->sti_laddr_maxlen);
5032 		sti->sti_laddr_len = (socklen_t)strbuf.len;
5033 		bcopy(addr, sti->sti_laddr_sa, sti->sti_laddr_len);
5034 		sti->sti_laddr_valid = 1;
5035 
5036 		bcopy(addr, name, MIN(sti->sti_laddr_len, *namelen));
5037 		*namelen = sti->sti_laddr_len;
5038 	}
5039 	kmem_free(addr, addrlen);
5040 #ifdef DEBUG
5041 	dprintso(so, 1, ("sotpi_getsockname (tp): %s\n",
5042 	    pr_addr(so->so_family, sti->sti_laddr_sa,
5043 	    (t_uscalar_t)sti->sti_laddr_len)));
5044 #endif /* DEBUG */
5045 done:
5046 	so_unlock_single(so, SOLOCKED);
5047 	mutex_exit(&so->so_lock);
5048 	return (error);
5049 }
5050 
5051 /*
5052  * Get socket options. For SOL_SOCKET options some options are handled
5053  * by the sockfs while others use the value recorded in the sonode as a
5054  * fallback should the T_SVR4_OPTMGMT_REQ fail.
5055  *
5056  * On the return most *optlenp bytes are copied to optval.
5057  */
5058 /* ARGSUSED */
5059 int
5060 sotpi_getsockopt(struct sonode *so, int level, int option_name,
5061 		void *optval, socklen_t *optlenp, int flags, struct cred *cr)
5062 {
5063 	struct T_optmgmt_req	optmgmt_req;
5064 	struct T_optmgmt_ack	*optmgmt_ack;
5065 	struct opthdr		oh;
5066 	struct opthdr		*opt_res;
5067 	mblk_t			*mp = NULL;
5068 	int			error = 0;
5069 	void			*option = NULL;	/* Set if fallback value */
5070 	t_uscalar_t		maxlen = *optlenp;
5071 	t_uscalar_t		len;
5072 	uint32_t		value;
5073 	struct timeval		tmo_val; /* used for SO_RCVTIMEO, SO_SNDTIMEO */
5074 	struct timeval32	tmo_val32;
5075 	struct so_snd_bufinfo	snd_bufinfo;	/* used for zero copy */
5076 
5077 	dprintso(so, 1, ("sotpi_getsockopt(%p, 0x%x, 0x%x, %p, %p) %s\n",
5078 	    (void *)so, level, option_name, optval, (void *)optlenp,
5079 	    pr_state(so->so_state, so->so_mode)));
5080 
5081 	mutex_enter(&so->so_lock);
5082 	so_lock_single(so);	/* Set SOLOCKED */
5083 
5084 	/*
5085 	 * Check for SOL_SOCKET options.
5086 	 * Certain SOL_SOCKET options are returned directly whereas
5087 	 * others only provide a default (fallback) value should
5088 	 * the T_SVR4_OPTMGMT_REQ fail.
5089 	 */
5090 	if (level == SOL_SOCKET) {
5091 		/* Check parameters */
5092 		switch (option_name) {
5093 		case SO_TYPE:
5094 		case SO_ERROR:
5095 		case SO_DEBUG:
5096 		case SO_ACCEPTCONN:
5097 		case SO_REUSEADDR:
5098 		case SO_KEEPALIVE:
5099 		case SO_DONTROUTE:
5100 		case SO_BROADCAST:
5101 		case SO_USELOOPBACK:
5102 		case SO_OOBINLINE:
5103 		case SO_SNDBUF:
5104 		case SO_RCVBUF:
5105 #ifdef notyet
5106 		case SO_SNDLOWAT:
5107 		case SO_RCVLOWAT:
5108 #endif /* notyet */
5109 		case SO_DOMAIN:
5110 		case SO_DGRAM_ERRIND:
5111 			if (maxlen < (t_uscalar_t)sizeof (int32_t)) {
5112 				error = EINVAL;
5113 				eprintsoline(so, error);
5114 				goto done2;
5115 			}
5116 			break;
5117 		case SO_RCVTIMEO:
5118 		case SO_SNDTIMEO:
5119 			if (get_udatamodel() == DATAMODEL_NONE ||
5120 			    get_udatamodel() == DATAMODEL_NATIVE) {
5121 				if (maxlen < sizeof (struct timeval)) {
5122 					error = EINVAL;
5123 					eprintsoline(so, error);
5124 					goto done2;
5125 				}
5126 			} else {
5127 				if (maxlen < sizeof (struct timeval32)) {
5128 					error = EINVAL;
5129 					eprintsoline(so, error);
5130 					goto done2;
5131 				}
5132 
5133 			}
5134 			break;
5135 		case SO_LINGER:
5136 			if (maxlen < (t_uscalar_t)sizeof (struct linger)) {
5137 				error = EINVAL;
5138 				eprintsoline(so, error);
5139 				goto done2;
5140 			}
5141 			break;
5142 		case SO_SND_BUFINFO:
5143 			if (maxlen < (t_uscalar_t)
5144 			    sizeof (struct so_snd_bufinfo)) {
5145 				error = EINVAL;
5146 				eprintsoline(so, error);
5147 				goto done2;
5148 			}
5149 			break;
5150 		}
5151 
5152 		len = (t_uscalar_t)sizeof (uint32_t);	/* Default */
5153 
5154 		switch (option_name) {
5155 		case SO_TYPE:
5156 			value = so->so_type;
5157 			option = &value;
5158 			goto copyout; /* No need to issue T_SVR4_OPTMGMT_REQ */
5159 
5160 		case SO_ERROR:
5161 			value = sogeterr(so, B_TRUE);
5162 			option = &value;
5163 			goto copyout; /* No need to issue T_SVR4_OPTMGMT_REQ */
5164 
5165 		case SO_ACCEPTCONN:
5166 			if (so->so_state & SS_ACCEPTCONN)
5167 				value = SO_ACCEPTCONN;
5168 			else
5169 				value = 0;
5170 #ifdef DEBUG
5171 			if (value) {
5172 				dprintso(so, 1,
5173 				    ("sotpi_getsockopt: 0x%x is set\n",
5174 				    option_name));
5175 			} else {
5176 				dprintso(so, 1,
5177 				    ("sotpi_getsockopt: 0x%x not set\n",
5178 				    option_name));
5179 			}
5180 #endif /* DEBUG */
5181 			option = &value;
5182 			goto copyout; /* No need to issue T_SVR4_OPTMGMT_REQ */
5183 
5184 		case SO_DEBUG:
5185 		case SO_REUSEADDR:
5186 		case SO_KEEPALIVE:
5187 		case SO_DONTROUTE:
5188 		case SO_BROADCAST:
5189 		case SO_USELOOPBACK:
5190 		case SO_OOBINLINE:
5191 		case SO_DGRAM_ERRIND:
5192 			value = (so->so_options & option_name);
5193 #ifdef DEBUG
5194 			if (value) {
5195 				dprintso(so, 1,
5196 				    ("sotpi_getsockopt: 0x%x is set\n",
5197 				    option_name));
5198 			} else {
5199 				dprintso(so, 1,
5200 				    ("sotpi_getsockopt: 0x%x not set\n",
5201 				    option_name));
5202 			}
5203 #endif /* DEBUG */
5204 			option = &value;
5205 			goto copyout; /* No need to issue T_SVR4_OPTMGMT_REQ */
5206 
5207 		/*
5208 		 * The following options are only returned by sockfs when the
5209 		 * T_SVR4_OPTMGMT_REQ fails.
5210 		 */
5211 		case SO_LINGER:
5212 			option = &so->so_linger;
5213 			len = (t_uscalar_t)sizeof (struct linger);
5214 			break;
5215 		case SO_SNDBUF: {
5216 			ssize_t lvalue;
5217 
5218 			/*
5219 			 * If the option has not been set then get a default
5220 			 * value from the read queue. This value is
5221 			 * returned if the transport fails
5222 			 * the T_SVR4_OPTMGMT_REQ.
5223 			 */
5224 			lvalue = so->so_sndbuf;
5225 			if (lvalue == 0) {
5226 				mutex_exit(&so->so_lock);
5227 				(void) strqget(strvp2wq(SOTOV(so))->q_next,
5228 				    QHIWAT, 0, &lvalue);
5229 				mutex_enter(&so->so_lock);
5230 				dprintso(so, 1,
5231 				    ("got SO_SNDBUF %ld from q\n", lvalue));
5232 			}
5233 			value = (int)lvalue;
5234 			option = &value;
5235 			len = (t_uscalar_t)sizeof (so->so_sndbuf);
5236 			break;
5237 		}
5238 		case SO_RCVBUF: {
5239 			ssize_t lvalue;
5240 
5241 			/*
5242 			 * If the option has not been set then get a default
5243 			 * value from the read queue. This value is
5244 			 * returned if the transport fails
5245 			 * the T_SVR4_OPTMGMT_REQ.
5246 			 *
5247 			 * XXX If SO_RCVBUF has been set and this is an
5248 			 * XPG 4.2 application then do not ask the transport
5249 			 * since the transport might adjust the value and not
5250 			 * return exactly what was set by the application.
5251 			 * For non-XPG 4.2 application we return the value
5252 			 * that the transport is actually using.
5253 			 */
5254 			lvalue = so->so_rcvbuf;
5255 			if (lvalue == 0) {
5256 				mutex_exit(&so->so_lock);
5257 				(void) strqget(RD(strvp2wq(SOTOV(so))),
5258 				    QHIWAT, 0, &lvalue);
5259 				mutex_enter(&so->so_lock);
5260 				dprintso(so, 1,
5261 				    ("got SO_RCVBUF %ld from q\n", lvalue));
5262 			} else if (flags & _SOGETSOCKOPT_XPG4_2) {
5263 				value = (int)lvalue;
5264 				option = &value;
5265 				goto copyout;	/* skip asking transport */
5266 			}
5267 			value = (int)lvalue;
5268 			option = &value;
5269 			len = (t_uscalar_t)sizeof (so->so_rcvbuf);
5270 			break;
5271 		}
5272 		case SO_DOMAIN:
5273 			value = so->so_family;
5274 			option = &value;
5275 			goto copyout; /* No need to issue T_SVR4_OPTMGMT_REQ */
5276 
5277 #ifdef notyet
5278 		/*
5279 		 * We do not implement the semantics of these options
5280 		 * thus we shouldn't implement the options either.
5281 		 */
5282 		case SO_SNDLOWAT:
5283 			value = so->so_sndlowat;
5284 			option = &value;
5285 			break;
5286 		case SO_RCVLOWAT:
5287 			value = so->so_rcvlowat;
5288 			option = &value;
5289 			break;
5290 #endif /* notyet */
5291 		case SO_SNDTIMEO:
5292 		case SO_RCVTIMEO: {
5293 			clock_t val;
5294 
5295 			if (option_name == SO_RCVTIMEO)
5296 				val = drv_hztousec(so->so_rcvtimeo);
5297 			else
5298 				val = drv_hztousec(so->so_sndtimeo);
5299 			tmo_val.tv_sec = val / (1000 * 1000);
5300 			tmo_val.tv_usec = val % (1000 * 1000);
5301 			if (get_udatamodel() == DATAMODEL_NONE ||
5302 			    get_udatamodel() == DATAMODEL_NATIVE) {
5303 				option = &tmo_val;
5304 				len = sizeof (struct timeval);
5305 			} else {
5306 				TIMEVAL_TO_TIMEVAL32(&tmo_val32, &tmo_val);
5307 				option = &tmo_val32;
5308 				len = sizeof (struct timeval32);
5309 			}
5310 			break;
5311 		}
5312 		case SO_SND_BUFINFO: {
5313 			snd_bufinfo.sbi_wroff =
5314 			    (so->so_proto_props).sopp_wroff;
5315 			snd_bufinfo.sbi_maxblk =
5316 			    (so->so_proto_props).sopp_maxblk;
5317 			snd_bufinfo.sbi_maxpsz =
5318 			    (so->so_proto_props).sopp_maxpsz;
5319 			snd_bufinfo.sbi_tail =
5320 			    (so->so_proto_props).sopp_tail;
5321 			option = &snd_bufinfo;
5322 			len = (t_uscalar_t)sizeof (struct so_snd_bufinfo);
5323 			break;
5324 		}
5325 		}
5326 	}
5327 
5328 	mutex_exit(&so->so_lock);
5329 
5330 	/* Send request */
5331 	optmgmt_req.PRIM_type = T_SVR4_OPTMGMT_REQ;
5332 	optmgmt_req.MGMT_flags = T_CHECK;
5333 	optmgmt_req.OPT_length = (t_scalar_t)(sizeof (oh) + maxlen);
5334 	optmgmt_req.OPT_offset = (t_scalar_t)sizeof (optmgmt_req);
5335 
5336 	oh.level = level;
5337 	oh.name = option_name;
5338 	oh.len = maxlen;
5339 
5340 	mp = soallocproto3(&optmgmt_req, sizeof (optmgmt_req),
5341 	    &oh, sizeof (oh), NULL, maxlen, 0, _ALLOC_SLEEP, cr);
5342 	/* Let option management work in the presence of data flow control */
5343 	error = kstrputmsg(SOTOV(so), mp, NULL, 0, 0,
5344 	    MSG_BAND|MSG_HOLDSIG|MSG_IGNERROR|MSG_IGNFLOW, 0);
5345 	mp = NULL;
5346 	mutex_enter(&so->so_lock);
5347 	if (error) {
5348 		eprintsoline(so, error);
5349 		goto done2;
5350 	}
5351 	error = sowaitprim(so, T_SVR4_OPTMGMT_REQ, T_OPTMGMT_ACK,
5352 	    (t_uscalar_t)(sizeof (*optmgmt_ack) + sizeof (*opt_res)), &mp, 0);
5353 	if (error) {
5354 		if (option != NULL) {
5355 			/* We have a fallback value */
5356 			error = 0;
5357 			goto copyout;
5358 		}
5359 		eprintsoline(so, error);
5360 		goto done2;
5361 	}
5362 	ASSERT(mp);
5363 	optmgmt_ack = (struct T_optmgmt_ack *)mp->b_rptr;
5364 	opt_res = (struct opthdr *)sogetoff(mp, optmgmt_ack->OPT_offset,
5365 	    optmgmt_ack->OPT_length, __TPI_ALIGN_SIZE);
5366 	if (opt_res == NULL) {
5367 		if (option != NULL) {
5368 			/* We have a fallback value */
5369 			error = 0;
5370 			goto copyout;
5371 		}
5372 		error = EPROTO;
5373 		eprintsoline(so, error);
5374 		goto done;
5375 	}
5376 	option = &opt_res[1];
5377 
5378 	/* check to ensure that the option is within bounds */
5379 	if (((uintptr_t)option + opt_res->len < (uintptr_t)option) ||
5380 	    (uintptr_t)option + opt_res->len > (uintptr_t)mp->b_wptr) {
5381 		if (option != NULL) {
5382 			/* We have a fallback value */
5383 			error = 0;
5384 			goto copyout;
5385 		}
5386 		error = EPROTO;
5387 		eprintsoline(so, error);
5388 		goto done;
5389 	}
5390 
5391 	len = opt_res->len;
5392 
5393 copyout: {
5394 		t_uscalar_t size = MIN(len, maxlen);
5395 		bcopy(option, optval, size);
5396 		bcopy(&size, optlenp, sizeof (size));
5397 	}
5398 done:
5399 	freemsg(mp);
5400 done2:
5401 	so_unlock_single(so, SOLOCKED);
5402 	mutex_exit(&so->so_lock);
5403 
5404 	return (error);
5405 }
5406 
5407 /*
5408  * Set socket options. All options are passed down in a T_SVR4_OPTMGMT_REQ.
5409  * SOL_SOCKET options are also recorded in the sonode. A setsockopt for
5410  * SOL_SOCKET options will not fail just because the T_SVR4_OPTMGMT_REQ fails -
5411  * setsockopt has to work even if the transport does not support the option.
5412  */
5413 /* ARGSUSED */
5414 int
5415 sotpi_setsockopt(struct sonode *so, int level, int option_name,
5416 	const void *optval, t_uscalar_t optlen, struct cred *cr)
5417 {
5418 	struct T_optmgmt_req	optmgmt_req;
5419 	struct opthdr		oh;
5420 	mblk_t			*mp;
5421 	int			error = 0;
5422 	boolean_t		handled = B_FALSE;
5423 
5424 	dprintso(so, 1, ("sotpi_setsockopt(%p, 0x%x, 0x%x, %p, %d) %s\n",
5425 	    (void *)so, level, option_name, optval, optlen,
5426 	    pr_state(so->so_state, so->so_mode)));
5427 
5428 	/* X/Open requires this check */
5429 	if ((so->so_state & SS_CANTSENDMORE) && !xnet_skip_checks) {
5430 		if (xnet_check_print)
5431 			printf("sockfs: X/Open setsockopt check => EINVAL\n");
5432 		return (EINVAL);
5433 	}
5434 
5435 	mutex_enter(&so->so_lock);
5436 	so_lock_single(so);	/* Set SOLOCKED */
5437 	mutex_exit(&so->so_lock);
5438 
5439 	optmgmt_req.PRIM_type = T_SVR4_OPTMGMT_REQ;
5440 	optmgmt_req.MGMT_flags = T_NEGOTIATE;
5441 	optmgmt_req.OPT_length = (t_scalar_t)sizeof (oh) + optlen;
5442 	optmgmt_req.OPT_offset = (t_scalar_t)sizeof (optmgmt_req);
5443 
5444 	oh.level = level;
5445 	oh.name = option_name;
5446 	oh.len = optlen;
5447 
5448 	mp = soallocproto3(&optmgmt_req, sizeof (optmgmt_req),
5449 	    &oh, sizeof (oh), optval, optlen, 0, _ALLOC_SLEEP, cr);
5450 	/* Let option management work in the presence of data flow control */
5451 	error = kstrputmsg(SOTOV(so), mp, NULL, 0, 0,
5452 	    MSG_BAND|MSG_HOLDSIG|MSG_IGNERROR|MSG_IGNFLOW, 0);
5453 	mp = NULL;
5454 	mutex_enter(&so->so_lock);
5455 	if (error) {
5456 		eprintsoline(so, error);
5457 		goto done2;
5458 	}
5459 	error = sowaitprim(so, T_SVR4_OPTMGMT_REQ, T_OPTMGMT_ACK,
5460 	    (t_uscalar_t)sizeof (struct T_optmgmt_ack), &mp, 0);
5461 	if (error) {
5462 		eprintsoline(so, error);
5463 		goto done;
5464 	}
5465 	ASSERT(mp);
5466 	/* No need to verify T_optmgmt_ack */
5467 	freemsg(mp);
5468 done:
5469 	/*
5470 	 * Check for SOL_SOCKET options and record their values.
5471 	 * If we know about a SOL_SOCKET parameter and the transport
5472 	 * failed it with TBADOPT or TOUTSTATE (i.e. ENOPROTOOPT or
5473 	 * EPROTO) we let the setsockopt succeed.
5474 	 */
5475 	if (level == SOL_SOCKET) {
5476 		/* Check parameters */
5477 		switch (option_name) {
5478 		case SO_DEBUG:
5479 		case SO_REUSEADDR:
5480 		case SO_KEEPALIVE:
5481 		case SO_DONTROUTE:
5482 		case SO_BROADCAST:
5483 		case SO_USELOOPBACK:
5484 		case SO_OOBINLINE:
5485 		case SO_SNDBUF:
5486 		case SO_RCVBUF:
5487 #ifdef notyet
5488 		case SO_SNDLOWAT:
5489 		case SO_RCVLOWAT:
5490 #endif /* notyet */
5491 		case SO_DGRAM_ERRIND:
5492 			if (optlen != (t_uscalar_t)sizeof (int32_t)) {
5493 				error = EINVAL;
5494 				eprintsoline(so, error);
5495 				goto done2;
5496 			}
5497 			ASSERT(optval);
5498 			handled = B_TRUE;
5499 			break;
5500 		case SO_SNDTIMEO:
5501 		case SO_RCVTIMEO:
5502 			if (get_udatamodel() == DATAMODEL_NONE ||
5503 			    get_udatamodel() == DATAMODEL_NATIVE) {
5504 				if (optlen != sizeof (struct timeval)) {
5505 					error = EINVAL;
5506 					eprintsoline(so, error);
5507 					goto done2;
5508 				}
5509 			} else {
5510 				if (optlen != sizeof (struct timeval32)) {
5511 					error = EINVAL;
5512 					eprintsoline(so, error);
5513 					goto done2;
5514 				}
5515 			}
5516 			ASSERT(optval);
5517 			handled = B_TRUE;
5518 			break;
5519 		case SO_LINGER:
5520 			if (optlen != (t_uscalar_t)sizeof (struct linger)) {
5521 				error = EINVAL;
5522 				eprintsoline(so, error);
5523 				goto done2;
5524 			}
5525 			ASSERT(optval);
5526 			handled = B_TRUE;
5527 			break;
5528 		}
5529 
5530 #define	intvalue	(*(int32_t *)optval)
5531 
5532 		switch (option_name) {
5533 		case SO_TYPE:
5534 		case SO_ERROR:
5535 		case SO_ACCEPTCONN:
5536 			/* Can't be set */
5537 			error = ENOPROTOOPT;
5538 			goto done2;
5539 		case SO_LINGER: {
5540 			struct linger *l = (struct linger *)optval;
5541 
5542 			so->so_linger.l_linger = l->l_linger;
5543 			if (l->l_onoff) {
5544 				so->so_linger.l_onoff = SO_LINGER;
5545 				so->so_options |= SO_LINGER;
5546 			} else {
5547 				so->so_linger.l_onoff = 0;
5548 				so->so_options &= ~SO_LINGER;
5549 			}
5550 			break;
5551 		}
5552 
5553 		case SO_DEBUG:
5554 #ifdef SOCK_TEST
5555 			if (intvalue & 2)
5556 				sock_test_timelimit = 10 * hz;
5557 			else
5558 				sock_test_timelimit = 0;
5559 
5560 			if (intvalue & 4)
5561 				do_useracc = 0;
5562 			else
5563 				do_useracc = 1;
5564 #endif /* SOCK_TEST */
5565 			/* FALLTHRU */
5566 		case SO_REUSEADDR:
5567 		case SO_KEEPALIVE:
5568 		case SO_DONTROUTE:
5569 		case SO_BROADCAST:
5570 		case SO_USELOOPBACK:
5571 		case SO_OOBINLINE:
5572 		case SO_DGRAM_ERRIND:
5573 			if (intvalue != 0) {
5574 				dprintso(so, 1,
5575 				    ("socket_setsockopt: setting 0x%x\n",
5576 				    option_name));
5577 				so->so_options |= option_name;
5578 			} else {
5579 				dprintso(so, 1,
5580 				    ("socket_setsockopt: clearing 0x%x\n",
5581 				    option_name));
5582 				so->so_options &= ~option_name;
5583 			}
5584 			break;
5585 		/*
5586 		 * The following options are only returned by us when the
5587 		 * transport layer fails.
5588 		 * XXX XPG 4.2 applications retrieve SO_RCVBUF from sockfs
5589 		 * since the transport might adjust the value and not
5590 		 * return exactly what was set by the application.
5591 		 */
5592 		case SO_SNDBUF:
5593 			so->so_sndbuf = intvalue;
5594 			break;
5595 		case SO_RCVBUF:
5596 			so->so_rcvbuf = intvalue;
5597 			break;
5598 		case SO_RCVPSH:
5599 			so->so_rcv_timer_interval = intvalue;
5600 			break;
5601 #ifdef notyet
5602 		/*
5603 		 * We do not implement the semantics of these options
5604 		 * thus we shouldn't implement the options either.
5605 		 */
5606 		case SO_SNDLOWAT:
5607 			so->so_sndlowat = intvalue;
5608 			break;
5609 		case SO_RCVLOWAT:
5610 			so->so_rcvlowat = intvalue;
5611 			break;
5612 #endif /* notyet */
5613 		case SO_SNDTIMEO:
5614 		case SO_RCVTIMEO: {
5615 			struct timeval tl;
5616 			clock_t val;
5617 
5618 			if (get_udatamodel() == DATAMODEL_NONE ||
5619 			    get_udatamodel() == DATAMODEL_NATIVE)
5620 				bcopy(&tl, (struct timeval *)optval,
5621 				    sizeof (struct timeval));
5622 			else
5623 				TIMEVAL32_TO_TIMEVAL(&tl,
5624 				    (struct timeval32 *)optval);
5625 			val = tl.tv_sec * 1000 * 1000 + tl.tv_usec;
5626 			if (option_name == SO_RCVTIMEO)
5627 				so->so_rcvtimeo = drv_usectohz(val);
5628 			else
5629 				so->so_sndtimeo = drv_usectohz(val);
5630 			break;
5631 		}
5632 		}
5633 #undef	intvalue
5634 
5635 		if (error) {
5636 			if ((error == ENOPROTOOPT || error == EPROTO ||
5637 			    error == EINVAL) && handled) {
5638 				dprintso(so, 1,
5639 				    ("setsockopt: ignoring error %d for 0x%x\n",
5640 				    error, option_name));
5641 				error = 0;
5642 			}
5643 		}
5644 	}
5645 done2:
5646 	so_unlock_single(so, SOLOCKED);
5647 	mutex_exit(&so->so_lock);
5648 	return (error);
5649 }
5650 
5651 /*
5652  * sotpi_close() is called when the last open reference goes away.
5653  */
5654 /* ARGSUSED */
5655 int
5656 sotpi_close(struct sonode *so, int flag, struct cred *cr)
5657 {
5658 	struct vnode *vp = SOTOV(so);
5659 	dev_t dev;
5660 	int error = 0;
5661 	sotpi_info_t *sti = SOTOTPI(so);
5662 
5663 	dprintso(so, 1, ("sotpi_close(%p, %x) %s\n",
5664 	    (void *)vp, flag, pr_state(so->so_state, so->so_mode)));
5665 
5666 	dev = sti->sti_dev;
5667 
5668 	ASSERT(STREAMSTAB(getmajor(dev)));
5669 
5670 	mutex_enter(&so->so_lock);
5671 	so_lock_single(so);	/* Set SOLOCKED */
5672 
5673 	ASSERT(so_verify_oobstate(so));
5674 
5675 	if (sti->sti_nl7c_flags & NL7C_ENABLED) {
5676 		sti->sti_nl7c_flags = 0;
5677 		nl7c_close(so);
5678 	}
5679 
5680 	if (vp->v_stream != NULL) {
5681 		vnode_t *ux_vp;
5682 
5683 		if (so->so_family == AF_UNIX) {
5684 			/* Could avoid this when CANTSENDMORE for !dgram */
5685 			so_unix_close(so);
5686 		}
5687 
5688 		mutex_exit(&so->so_lock);
5689 		/*
5690 		 * Disassemble the linkage from the AF_UNIX underlying file
5691 		 * system vnode to this socket (by atomically clearing
5692 		 * v_stream in vn_rele_stream) before strclose clears sd_vnode
5693 		 * and frees the stream head.
5694 		 */
5695 		if ((ux_vp = sti->sti_ux_bound_vp) != NULL) {
5696 			ASSERT(ux_vp->v_stream);
5697 			sti->sti_ux_bound_vp = NULL;
5698 			vn_rele_stream(ux_vp);
5699 		}
5700 		error = strclose(vp, flag, cr);
5701 		vp->v_stream = NULL;
5702 		mutex_enter(&so->so_lock);
5703 	}
5704 
5705 	/*
5706 	 * Flush the T_DISCON_IND on sti_discon_ind_mp.
5707 	 */
5708 	so_flush_discon_ind(so);
5709 
5710 	so_unlock_single(so, SOLOCKED);
5711 	mutex_exit(&so->so_lock);
5712 
5713 	/*
5714 	 * Needed for STREAMs.
5715 	 * Decrement the device driver's reference count for streams
5716 	 * opened via the clone dip. The driver was held in clone_open().
5717 	 * The absence of clone_close() forces this asymmetry.
5718 	 */
5719 	if (so->so_flag & SOCLONE)
5720 		ddi_rele_driver(getmajor(dev));
5721 
5722 	return (error);
5723 }
5724 
5725 static int
5726 sotpi_ioctl(struct sonode *so, int cmd, intptr_t arg, int mode,
5727     struct cred *cr, int32_t *rvalp)
5728 {
5729 	struct vnode *vp = SOTOV(so);
5730 	sotpi_info_t *sti = SOTOTPI(so);
5731 	int error = 0;
5732 
5733 	dprintso(so, 0, ("sotpi_ioctl: cmd 0x%x, arg 0x%lx, state %s\n",
5734 	    cmd, arg, pr_state(so->so_state, so->so_mode)));
5735 
5736 	switch (cmd) {
5737 	case SIOCSQPTR:
5738 		/*
5739 		 * SIOCSQPTR is valid only when helper stream is created
5740 		 * by the protocol.
5741 		 */
5742 	case _I_INSERT:
5743 	case _I_REMOVE:
5744 		/*
5745 		 * Since there's no compelling reason to support these ioctls
5746 		 * on sockets, and doing so would increase the complexity
5747 		 * markedly, prevent it.
5748 		 */
5749 		return (EOPNOTSUPP);
5750 
5751 	case I_FIND:
5752 	case I_LIST:
5753 	case I_LOOK:
5754 	case I_POP:
5755 	case I_PUSH:
5756 		/*
5757 		 * To prevent races and inconsistencies between the actual
5758 		 * state of the stream and the state according to the sonode,
5759 		 * we serialize all operations which modify or operate on the
5760 		 * list of modules on the socket's stream.
5761 		 */
5762 		mutex_enter(&sti->sti_plumb_lock);
5763 		error = socktpi_plumbioctl(vp, cmd, arg, mode, cr, rvalp);
5764 		mutex_exit(&sti->sti_plumb_lock);
5765 		return (error);
5766 
5767 	default:
5768 		if (so->so_version != SOV_STREAM)
5769 			break;
5770 
5771 		/*
5772 		 * The imaginary "sockmod" has been popped; act as a stream.
5773 		 */
5774 		return (strioctl(vp, cmd, arg, mode, U_TO_K, cr, rvalp));
5775 	}
5776 
5777 	ASSERT(so->so_version != SOV_STREAM);
5778 
5779 	/*
5780 	 * Process socket-specific ioctls.
5781 	 */
5782 	switch (cmd) {
5783 	case FIONBIO: {
5784 		int32_t value;
5785 
5786 		if (so_copyin((void *)arg, &value, sizeof (int32_t),
5787 		    (mode & (int)FKIOCTL)))
5788 			return (EFAULT);
5789 
5790 		mutex_enter(&so->so_lock);
5791 		if (value) {
5792 			so->so_state |= SS_NDELAY;
5793 		} else {
5794 			so->so_state &= ~SS_NDELAY;
5795 		}
5796 		mutex_exit(&so->so_lock);
5797 		return (0);
5798 	}
5799 
5800 	case FIOASYNC: {
5801 		int32_t value;
5802 
5803 		if (so_copyin((void *)arg, &value, sizeof (int32_t),
5804 		    (mode & (int)FKIOCTL)))
5805 			return (EFAULT);
5806 
5807 		mutex_enter(&so->so_lock);
5808 		/*
5809 		 * SS_ASYNC flag not already set correctly?
5810 		 * (!value != !(so->so_state & SS_ASYNC))
5811 		 * but some engineers find that too hard to read.
5812 		 */
5813 		if (value == 0 && (so->so_state & SS_ASYNC) != 0 ||
5814 		    value != 0 && (so->so_state & SS_ASYNC) == 0)
5815 			error = so_flip_async(so, vp, mode, cr);
5816 		mutex_exit(&so->so_lock);
5817 		return (error);
5818 	}
5819 
5820 	case SIOCSPGRP:
5821 	case FIOSETOWN: {
5822 		pid_t pgrp;
5823 
5824 		if (so_copyin((void *)arg, &pgrp, sizeof (pid_t),
5825 		    (mode & (int)FKIOCTL)))
5826 			return (EFAULT);
5827 
5828 		mutex_enter(&so->so_lock);
5829 		dprintso(so, 1, ("setown: new %d old %d\n", pgrp, so->so_pgrp));
5830 		/* Any change? */
5831 		if (pgrp != so->so_pgrp)
5832 			error = so_set_siggrp(so, vp, pgrp, mode, cr);
5833 		mutex_exit(&so->so_lock);
5834 		return (error);
5835 	}
5836 	case SIOCGPGRP:
5837 	case FIOGETOWN:
5838 		if (so_copyout(&so->so_pgrp, (void *)arg,
5839 		    sizeof (pid_t), (mode & (int)FKIOCTL)))
5840 			return (EFAULT);
5841 		return (0);
5842 
5843 	case SIOCATMARK: {
5844 		int retval;
5845 		uint_t so_state;
5846 
5847 		/*
5848 		 * strwaitmark has a finite timeout after which it
5849 		 * returns -1 if the mark state is undetermined.
5850 		 * In order to avoid any race between the mark state
5851 		 * in sockfs and the mark state in the stream head this
5852 		 * routine loops until the mark state can be determined
5853 		 * (or the urgent data indication has been removed by some
5854 		 * other thread).
5855 		 */
5856 		do {
5857 			mutex_enter(&so->so_lock);
5858 			so_state = so->so_state;
5859 			mutex_exit(&so->so_lock);
5860 			if (so_state & SS_RCVATMARK) {
5861 				retval = 1;
5862 			} else if (!(so_state & SS_OOBPEND)) {
5863 				/*
5864 				 * No SIGURG has been generated -- there is no
5865 				 * pending or present urgent data. Thus can't
5866 				 * possibly be at the mark.
5867 				 */
5868 				retval = 0;
5869 			} else {
5870 				/*
5871 				 * Have the stream head wait until there is
5872 				 * either some messages on the read queue, or
5873 				 * STRATMARK or STRNOTATMARK gets set. The
5874 				 * STRNOTATMARK flag is used so that the
5875 				 * transport can send up a MSGNOTMARKNEXT
5876 				 * M_DATA to indicate that it is not
5877 				 * at the mark and additional data is not about
5878 				 * to be send upstream.
5879 				 *
5880 				 * If the mark state is undetermined this will
5881 				 * return -1 and we will loop rechecking the
5882 				 * socket state.
5883 				 */
5884 				retval = strwaitmark(vp);
5885 			}
5886 		} while (retval == -1);
5887 
5888 		if (so_copyout(&retval, (void *)arg, sizeof (int),
5889 		    (mode & (int)FKIOCTL)))
5890 			return (EFAULT);
5891 		return (0);
5892 	}
5893 
5894 	case I_FDINSERT:
5895 	case I_SENDFD:
5896 	case I_RECVFD:
5897 	case I_ATMARK:
5898 	case _SIOCSOCKFALLBACK:
5899 		/*
5900 		 * These ioctls do not apply to sockets. I_FDINSERT can be
5901 		 * used to send M_PROTO messages without modifying the socket
5902 		 * state. I_SENDFD/RECVFD should not be used for socket file
5903 		 * descriptor passing since they assume a twisted stream.
5904 		 * SIOCATMARK must be used instead of I_ATMARK.
5905 		 *
5906 		 * _SIOCSOCKFALLBACK from an application should never be
5907 		 * processed.  It is only generated by socktpi_open() or
5908 		 * in response to I_POP or I_PUSH.
5909 		 */
5910 #ifdef DEBUG
5911 		zcmn_err(getzoneid(), CE_WARN,
5912 		    "Unsupported STREAMS ioctl 0x%x on socket. "
5913 		    "Pid = %d\n", cmd, curproc->p_pid);
5914 #endif /* DEBUG */
5915 		return (EOPNOTSUPP);
5916 
5917 	case _I_GETPEERCRED:
5918 		if ((mode & FKIOCTL) == 0)
5919 			return (EINVAL);
5920 
5921 		mutex_enter(&so->so_lock);
5922 		if ((so->so_mode & SM_CONNREQUIRED) == 0) {
5923 			error = ENOTSUP;
5924 		} else if ((so->so_state & SS_ISCONNECTED) == 0) {
5925 			error = ENOTCONN;
5926 		} else if (so->so_peercred != NULL) {
5927 			k_peercred_t *kp = (k_peercred_t *)arg;
5928 			kp->pc_cr = so->so_peercred;
5929 			kp->pc_cpid = so->so_cpid;
5930 			crhold(so->so_peercred);
5931 		} else {
5932 			error = EINVAL;
5933 		}
5934 		mutex_exit(&so->so_lock);
5935 		return (error);
5936 
5937 	default:
5938 		/*
5939 		 * Do the higher-order bits of the ioctl cmd indicate
5940 		 * that it is an I_* streams ioctl?
5941 		 */
5942 		if ((cmd & 0xffffff00U) == STR &&
5943 		    so->so_version == SOV_SOCKBSD) {
5944 #ifdef DEBUG
5945 			zcmn_err(getzoneid(), CE_WARN,
5946 			    "Unsupported STREAMS ioctl 0x%x on socket. "
5947 			    "Pid = %d\n", cmd, 	curproc->p_pid);
5948 #endif /* DEBUG */
5949 			return (EOPNOTSUPP);
5950 		}
5951 		return (strioctl(vp, cmd, arg, mode, U_TO_K, cr, rvalp));
5952 	}
5953 }
5954 
5955 /*
5956  * Handle plumbing-related ioctls.
5957  */
5958 static int
5959 socktpi_plumbioctl(struct vnode *vp, int cmd, intptr_t arg, int mode,
5960     struct cred *cr, int32_t *rvalp)
5961 {
5962 	static const char sockmod_name[] = "sockmod";
5963 	struct sonode	*so = VTOSO(vp);
5964 	char		mname[FMNAMESZ + 1];
5965 	int		error;
5966 	sotpi_info_t	*sti = SOTOTPI(so);
5967 
5968 	ASSERT(MUTEX_HELD(&sti->sti_plumb_lock));
5969 
5970 	if (so->so_version == SOV_SOCKBSD)
5971 		return (EOPNOTSUPP);
5972 
5973 	if (so->so_version == SOV_STREAM) {
5974 		/*
5975 		 * The imaginary "sockmod" has been popped - act as a stream.
5976 		 * If this is a push of sockmod then change back to a socket.
5977 		 */
5978 		if (cmd == I_PUSH) {
5979 			error = ((mode & FKIOCTL) ? copystr : copyinstr)(
5980 			    (void *)arg, mname, sizeof (mname), NULL);
5981 
5982 			if (error == 0 && strcmp(mname, sockmod_name) == 0) {
5983 				dprintso(so, 0, ("socktpi_ioctl: going to "
5984 				    "socket version\n"));
5985 				so_stream2sock(so);
5986 				return (0);
5987 			}
5988 		}
5989 		return (strioctl(vp, cmd, arg, mode, U_TO_K, cr, rvalp));
5990 	}
5991 
5992 	switch (cmd) {
5993 	case I_PUSH:
5994 		if (sti->sti_direct) {
5995 			mutex_enter(&so->so_lock);
5996 			so_lock_single(so);
5997 			mutex_exit(&so->so_lock);
5998 
5999 			error = strioctl(vp, _SIOCSOCKFALLBACK, 0, 0, K_TO_K,
6000 			    cr, rvalp);
6001 
6002 			mutex_enter(&so->so_lock);
6003 			if (error == 0)
6004 				sti->sti_direct = 0;
6005 			so_unlock_single(so, SOLOCKED);
6006 			mutex_exit(&so->so_lock);
6007 
6008 			if (error != 0)
6009 				return (error);
6010 		}
6011 
6012 		error = strioctl(vp, cmd, arg, mode, U_TO_K, cr, rvalp);
6013 		if (error == 0)
6014 			sti->sti_pushcnt++;
6015 		return (error);
6016 
6017 	case I_POP:
6018 		if (sti->sti_pushcnt == 0) {
6019 			/* Emulate sockmod being popped */
6020 			dprintso(so, 0,
6021 			    ("socktpi_ioctl: going to STREAMS version\n"));
6022 			return (so_sock2stream(so));
6023 		}
6024 
6025 		error = strioctl(vp, cmd, arg, mode, U_TO_K, cr, rvalp);
6026 		if (error == 0)
6027 			sti->sti_pushcnt--;
6028 		return (error);
6029 
6030 	case I_LIST: {
6031 		struct str_mlist *kmlistp, *umlistp;
6032 		struct str_list	kstrlist;
6033 		ssize_t		kstrlistsize;
6034 		int		i, nmods;
6035 
6036 		STRUCT_DECL(str_list, ustrlist);
6037 		STRUCT_INIT(ustrlist, mode);
6038 
6039 		if (arg == NULL) {
6040 			error = strioctl(vp, cmd, arg, mode, U_TO_K, cr, rvalp);
6041 			if (error == 0)
6042 				(*rvalp)++;	/* Add one for sockmod */
6043 			return (error);
6044 		}
6045 
6046 		error = so_copyin((void *)arg, STRUCT_BUF(ustrlist),
6047 		    STRUCT_SIZE(ustrlist), mode & FKIOCTL);
6048 		if (error != 0)
6049 			return (error);
6050 
6051 		nmods = STRUCT_FGET(ustrlist, sl_nmods);
6052 		if (nmods <= 0)
6053 			return (EINVAL);
6054 		/*
6055 		 * Ceiling nmods at nstrpush to prevent someone from
6056 		 * maliciously consuming lots of kernel memory.
6057 		 */
6058 		nmods = MIN(nmods, nstrpush);
6059 
6060 		kstrlistsize = (nmods + 1) * sizeof (struct str_mlist);
6061 		kstrlist.sl_nmods = nmods;
6062 		kstrlist.sl_modlist = kmem_zalloc(kstrlistsize, KM_SLEEP);
6063 
6064 		error = strioctl(vp, cmd, (intptr_t)&kstrlist, mode, K_TO_K,
6065 		    cr, rvalp);
6066 		if (error != 0)
6067 			goto done;
6068 
6069 		/*
6070 		 * Considering the module list as a 0-based array of sl_nmods
6071 		 * modules, sockmod should conceptually exist at slot
6072 		 * sti_pushcnt.  Insert sockmod at this location by sliding all
6073 		 * of the module names after so_pushcnt over by one.  We know
6074 		 * that there will be room to do this since we allocated
6075 		 * sl_modlist with an additional slot.
6076 		 */
6077 		for (i = kstrlist.sl_nmods; i > sti->sti_pushcnt; i--)
6078 			kstrlist.sl_modlist[i] = kstrlist.sl_modlist[i - 1];
6079 
6080 		(void) strcpy(kstrlist.sl_modlist[i].l_name, sockmod_name);
6081 		kstrlist.sl_nmods++;
6082 
6083 		/*
6084 		 * Copy all of the entries out to ustrlist.
6085 		 */
6086 		kmlistp = kstrlist.sl_modlist;
6087 		umlistp = STRUCT_FGETP(ustrlist, sl_modlist);
6088 		for (i = 0; i < nmods && i < kstrlist.sl_nmods; i++) {
6089 			error = so_copyout(kmlistp++, umlistp++,
6090 			    sizeof (struct str_mlist), mode & FKIOCTL);
6091 			if (error != 0)
6092 				goto done;
6093 		}
6094 
6095 		error = so_copyout(&i, (void *)arg, sizeof (int32_t),
6096 		    mode & FKIOCTL);
6097 		if (error == 0)
6098 			*rvalp = 0;
6099 	done:
6100 		kmem_free(kstrlist.sl_modlist, kstrlistsize);
6101 		return (error);
6102 	}
6103 	case I_LOOK:
6104 		if (sti->sti_pushcnt == 0) {
6105 			return (so_copyout(sockmod_name, (void *)arg,
6106 			    sizeof (sockmod_name), mode & FKIOCTL));
6107 		}
6108 		return (strioctl(vp, cmd, arg, mode, U_TO_K, cr, rvalp));
6109 
6110 	case I_FIND:
6111 		error = strioctl(vp, cmd, arg, mode, U_TO_K, cr, rvalp);
6112 		if (error && error != EINVAL)
6113 			return (error);
6114 
6115 		/* if not found and string was sockmod return 1 */
6116 		if (*rvalp == 0 || error == EINVAL) {
6117 			error = ((mode & FKIOCTL) ? copystr : copyinstr)(
6118 			    (void *)arg, mname, sizeof (mname), NULL);
6119 			if (error == ENAMETOOLONG)
6120 				error = EINVAL;
6121 
6122 			if (error == 0 && strcmp(mname, sockmod_name) == 0)
6123 				*rvalp = 1;
6124 		}
6125 		return (error);
6126 
6127 	default:
6128 		panic("socktpi_plumbioctl: unknown ioctl %d", cmd);
6129 		break;
6130 	}
6131 
6132 	return (0);
6133 }
6134 
6135 /*
6136  * Wrapper around the streams poll routine that implements socket poll
6137  * semantics.
6138  * The sockfs never calls pollwakeup itself - the stream head take care
6139  * of all pollwakeups. Since sockfs never holds so_lock when calling the
6140  * stream head there can never be a deadlock due to holding so_lock across
6141  * pollwakeup and acquiring so_lock in this routine.
6142  *
6143  * However, since the performance of VOP_POLL is critical we avoid
6144  * acquiring so_lock here. This is based on two assumptions:
6145  *  - The poll implementation holds locks to serialize the VOP_POLL call
6146  *    and a pollwakeup for the same pollhead. This ensures that should
6147  *    e.g. so_state change during a socktpi_poll call the pollwakeup
6148  *    (which strsock_* and strrput conspire to issue) is issued after
6149  *    the state change. Thus the pollwakeup will block until VOP_POLL has
6150  *    returned and then wake up poll and have it call VOP_POLL again.
6151  *  - The reading of so_state without holding so_lock does not result in
6152  *    stale data that is older than the latest state change that has dropped
6153  *    so_lock. This is ensured by the mutex_exit issuing the appropriate
6154  *    memory barrier to force the data into the coherency domain.
6155  */
6156 static int
6157 sotpi_poll(
6158 	struct sonode	*so,
6159 	short		events,
6160 	int		anyyet,
6161 	short		*reventsp,
6162 	struct pollhead **phpp)
6163 {
6164 	short origevents = events;
6165 	struct vnode *vp = SOTOV(so);
6166 	int error;
6167 	int so_state = so->so_state;	/* snapshot */
6168 	sotpi_info_t *sti = SOTOTPI(so);
6169 
6170 	dprintso(so, 0, ("socktpi_poll(%p): state %s err %d\n",
6171 	    (void *)vp, pr_state(so_state, so->so_mode), so->so_error));
6172 
6173 	ASSERT(vp->v_type == VSOCK);
6174 	ASSERT(vp->v_stream != NULL);
6175 
6176 	if (so->so_version == SOV_STREAM) {
6177 		/* The imaginary "sockmod" has been popped - act as a stream */
6178 		return (strpoll(vp->v_stream, events, anyyet,
6179 		    reventsp, phpp));
6180 	}
6181 
6182 	if (!(so_state & SS_ISCONNECTED) &&
6183 	    (so->so_mode & SM_CONNREQUIRED)) {
6184 		/* Not connected yet - turn off write side events */
6185 		events &= ~(POLLOUT|POLLWRBAND);
6186 	}
6187 	/*
6188 	 * Check for errors without calling strpoll if the caller wants them.
6189 	 * In sockets the errors are represented as input/output events
6190 	 * and there is no need to ask the stream head for this information.
6191 	 */
6192 	if (so->so_error != 0 &&
6193 	    ((POLLIN|POLLRDNORM|POLLOUT) & origevents)  != 0) {
6194 		*reventsp = (POLLIN|POLLRDNORM|POLLOUT) & origevents;
6195 		return (0);
6196 	}
6197 	/*
6198 	 * Ignore M_PROTO only messages such as the T_EXDATA_IND messages.
6199 	 * These message with only an M_PROTO/M_PCPROTO part and no M_DATA
6200 	 * will not trigger a POLLIN event with POLLRDDATA set.
6201 	 * The handling of urgent data (causing POLLRDBAND) is done by
6202 	 * inspecting SS_OOBPEND below.
6203 	 */
6204 	events |= POLLRDDATA;
6205 
6206 	/*
6207 	 * After shutdown(output) a stream head write error is set.
6208 	 * However, we should not return output events.
6209 	 */
6210 	events |= POLLNOERR;
6211 	error = strpoll(vp->v_stream, events, anyyet,
6212 	    reventsp, phpp);
6213 	if (error)
6214 		return (error);
6215 
6216 	ASSERT(!(*reventsp & POLLERR));
6217 
6218 	/*
6219 	 * Notes on T_CONN_IND handling for sockets.
6220 	 *
6221 	 * If strpoll() returned without events, SR_POLLIN is guaranteed
6222 	 * to be set, ensuring any subsequent strrput() runs pollwakeup().
6223 	 *
6224 	 * Since the so_lock is not held, soqueueconnind() may have run
6225 	 * and a T_CONN_IND may be waiting. We now check for any queued
6226 	 * T_CONN_IND msgs on sti_conn_ind_head and set appropriate events
6227 	 * to ensure poll returns.
6228 	 *
6229 	 * However:
6230 	 * If the T_CONN_IND hasn't arrived by the time strpoll() returns,
6231 	 * when strrput() does run for an arriving M_PROTO with T_CONN_IND
6232 	 * the following actions will occur; taken together they ensure the
6233 	 * syscall will return.
6234 	 *
6235 	 * 1. If a socket, soqueueconnind() will queue the T_CONN_IND but if
6236 	 *    the accept() was run on a non-blocking socket sowaitconnind()
6237 	 *    may have already returned EWOULDBLOCK, so not be waiting to
6238 	 *    process the message. Additionally socktpi_poll() has probably
6239 	 *    proceeded past the sti_conn_ind_head check below.
6240 	 * 2. strrput() runs pollwakeup()->pollnotify()->cv_signal() to wake
6241 	 *    this thread,  however that could occur before poll_common()
6242 	 *    has entered cv_wait.
6243 	 * 3. pollnotify() sets T_POLLWAKE, while holding the pc_lock.
6244 	 *
6245 	 * Before proceeding to cv_wait() in poll_common() for an event,
6246 	 * poll_common() atomically checks for T_POLLWAKE under the pc_lock,
6247 	 * and if set, re-calls strpoll() to ensure the late arriving
6248 	 * T_CONN_IND is recognized, and pollsys() returns.
6249 	 */
6250 
6251 	if (sti->sti_conn_ind_head != NULL)
6252 		*reventsp |= (POLLIN|POLLRDNORM) & events;
6253 
6254 	if (so->so_state & SS_OOBPEND)
6255 		*reventsp |= POLLRDBAND & events;
6256 
6257 	if (sti->sti_nl7c_rcv_mp != NULL) {
6258 		*reventsp |= (POLLIN|POLLRDNORM) & events;
6259 	}
6260 	if ((sti->sti_nl7c_flags & NL7C_ENABLED) &&
6261 	    ((POLLIN|POLLRDNORM) & *reventsp)) {
6262 		sti->sti_nl7c_flags |= NL7C_POLLIN;
6263 	}
6264 
6265 	return (0);
6266 }
6267 
6268 /*ARGSUSED*/
6269 static int
6270 socktpi_constructor(void *buf, void *cdrarg, int kmflags)
6271 {
6272 	sotpi_sonode_t *st = (sotpi_sonode_t *)buf;
6273 	int error = 0;
6274 
6275 	error = sonode_constructor(buf, cdrarg, kmflags);
6276 	if (error != 0)
6277 		return (error);
6278 
6279 	error = i_sotpi_info_constructor(&st->st_info);
6280 	if (error != 0)
6281 		sonode_destructor(buf, cdrarg);
6282 
6283 	st->st_sonode.so_priv = &st->st_info;
6284 
6285 	return (error);
6286 }
6287 
6288 /*ARGSUSED1*/
6289 static void
6290 socktpi_destructor(void *buf, void *cdrarg)
6291 {
6292 	sotpi_sonode_t *st = (sotpi_sonode_t *)buf;
6293 
6294 	ASSERT(st->st_sonode.so_priv == &st->st_info);
6295 	st->st_sonode.so_priv = NULL;
6296 
6297 	i_sotpi_info_destructor(&st->st_info);
6298 	sonode_destructor(buf, cdrarg);
6299 }
6300 
6301 static int
6302 socktpi_unix_constructor(void *buf, void *cdrarg, int kmflags)
6303 {
6304 	int retval;
6305 
6306 	if ((retval = socktpi_constructor(buf, cdrarg, kmflags)) == 0) {
6307 		struct sonode *so = (struct sonode *)buf;
6308 		sotpi_info_t *sti = SOTOTPI(so);
6309 
6310 		mutex_enter(&socklist.sl_lock);
6311 
6312 		sti->sti_next_so = socklist.sl_list;
6313 		sti->sti_prev_so = NULL;
6314 		if (sti->sti_next_so != NULL)
6315 			SOTOTPI(sti->sti_next_so)->sti_prev_so = so;
6316 		socklist.sl_list = so;
6317 
6318 		mutex_exit(&socklist.sl_lock);
6319 
6320 	}
6321 	return (retval);
6322 }
6323 
6324 static void
6325 socktpi_unix_destructor(void *buf, void *cdrarg)
6326 {
6327 	struct sonode	*so = (struct sonode *)buf;
6328 	sotpi_info_t	*sti = SOTOTPI(so);
6329 
6330 	mutex_enter(&socklist.sl_lock);
6331 
6332 	if (sti->sti_next_so != NULL)
6333 		SOTOTPI(sti->sti_next_so)->sti_prev_so = sti->sti_prev_so;
6334 	if (sti->sti_prev_so != NULL)
6335 		SOTOTPI(sti->sti_prev_so)->sti_next_so = sti->sti_next_so;
6336 	else
6337 		socklist.sl_list = sti->sti_next_so;
6338 
6339 	mutex_exit(&socklist.sl_lock);
6340 
6341 	socktpi_destructor(buf, cdrarg);
6342 }
6343 
6344 int
6345 socktpi_init(void)
6346 {
6347 	/*
6348 	 * Create sonode caches.  We create a special one for AF_UNIX so
6349 	 * that we can track them for netstat(1m).
6350 	 */
6351 	socktpi_cache = kmem_cache_create("socktpi_cache",
6352 	    sizeof (struct sotpi_sonode), 0, socktpi_constructor,
6353 	    socktpi_destructor, NULL, NULL, NULL, 0);
6354 
6355 	socktpi_unix_cache = kmem_cache_create("socktpi_unix_cache",
6356 	    sizeof (struct sotpi_sonode), 0, socktpi_unix_constructor,
6357 	    socktpi_unix_destructor, NULL, NULL, NULL, 0);
6358 
6359 	return (0);
6360 }
6361 
6362 /*
6363  * Given a non-TPI sonode, allocate and prep it to be ready for TPI.
6364  *
6365  * Caller must still update state and mode using sotpi_update_state().
6366  */
6367 int
6368 sotpi_convert_sonode(struct sonode *so, struct sockparams *newsp,
6369     boolean_t *direct, queue_t **qp, struct cred *cr)
6370 {
6371 	sotpi_info_t *sti;
6372 	struct sockparams *origsp = so->so_sockparams;
6373 	sock_lower_handle_t handle = so->so_proto_handle;
6374 	struct stdata *stp;
6375 	struct vnode *vp;
6376 	queue_t *q;
6377 	int error = 0;
6378 
6379 	ASSERT((so->so_state & (SS_FALLBACK_PENDING|SS_FALLBACK_COMP)) ==
6380 	    SS_FALLBACK_PENDING);
6381 	ASSERT(SOCK_IS_NONSTR(so));
6382 
6383 	*qp = NULL;
6384 	*direct = B_FALSE;
6385 	so->so_sockparams = newsp;
6386 	/*
6387 	 * Allocate and initalize fields required by TPI.
6388 	 */
6389 	(void) sotpi_info_create(so, KM_SLEEP);
6390 	sotpi_info_init(so);
6391 
6392 	if ((error = sotpi_init(so, NULL, cr, SO_FALLBACK)) != 0) {
6393 		sotpi_info_fini(so);
6394 		sotpi_info_destroy(so);
6395 		return (error);
6396 	}
6397 	ASSERT(handle == so->so_proto_handle);
6398 	sti = SOTOTPI(so);
6399 	if (sti->sti_direct != 0)
6400 		*direct = B_TRUE;
6401 
6402 	/*
6403 	 * Keep the original sp around so we can properly dispose of the
6404 	 * sonode when the socket is being closed.
6405 	 */
6406 	sti->sti_orig_sp = origsp;
6407 
6408 	so_basic_strinit(so);	/* skips the T_CAPABILITY_REQ */
6409 	so_alloc_addr(so, so->so_max_addr_len);
6410 
6411 	/*
6412 	 * If the application has done a SIOCSPGRP, make sure the
6413 	 * STREAM head is aware. This needs to take place before
6414 	 * the protocol start sending up messages. Otherwise we
6415 	 * might miss to generate SIGPOLL.
6416 	 *
6417 	 * It is possible that the application will receive duplicate
6418 	 * signals if some were already generated for either data or
6419 	 * connection indications.
6420 	 */
6421 	if (so->so_pgrp != 0) {
6422 		if (so_set_events(so, so->so_vnode, cr) != 0)
6423 			so->so_pgrp = 0;
6424 	}
6425 
6426 	/*
6427 	 * Determine which queue to use.
6428 	 */
6429 	vp = SOTOV(so);
6430 	stp = vp->v_stream;
6431 	ASSERT(stp != NULL);
6432 	q = stp->sd_wrq->q_next;
6433 
6434 	/*
6435 	 * Skip any modules that may have been auto pushed when the device
6436 	 * was opened
6437 	 */
6438 	while (q->q_next != NULL)
6439 		q = q->q_next;
6440 	*qp = _RD(q);
6441 
6442 	/* This is now a STREAMS sockets */
6443 	so->so_not_str = B_FALSE;
6444 
6445 	return (error);
6446 }
6447 
6448 /*
6449  * Revert a TPI sonode. It is only allowed to revert the sonode during
6450  * the fallback process.
6451  */
6452 void
6453 sotpi_revert_sonode(struct sonode *so, struct cred *cr)
6454 {
6455 	vnode_t *vp = SOTOV(so);
6456 
6457 	ASSERT((so->so_state & (SS_FALLBACK_PENDING|SS_FALLBACK_COMP)) ==
6458 	    SS_FALLBACK_PENDING);
6459 	ASSERT(!SOCK_IS_NONSTR(so));
6460 	ASSERT(vp->v_stream != NULL);
6461 
6462 	strclean(vp);
6463 	(void) strclose(vp, FREAD|FWRITE|SO_FALLBACK, cr);
6464 
6465 	/*
6466 	 * Restore the original sockparams. The caller is responsible for
6467 	 * dropping the ref to the new sp.
6468 	 */
6469 	so->so_sockparams = SOTOTPI(so)->sti_orig_sp;
6470 
6471 	sotpi_info_fini(so);
6472 	sotpi_info_destroy(so);
6473 
6474 	/* This is no longer a STREAMS sockets */
6475 	so->so_not_str = B_TRUE;
6476 }
6477 
6478 void
6479 sotpi_update_state(struct sonode *so, struct T_capability_ack *tcap,
6480     struct sockaddr *laddr, socklen_t laddrlen, struct sockaddr *faddr,
6481     socklen_t faddrlen, short opts)
6482 {
6483 	sotpi_info_t *sti = SOTOTPI(so);
6484 
6485 	so_proc_tcapability_ack(so, tcap);
6486 
6487 	so->so_options |= opts;
6488 
6489 	/*
6490 	 * Determine whether the foreign and local address are valid
6491 	 */
6492 	if (laddrlen != 0) {
6493 		ASSERT(laddrlen <= sti->sti_laddr_maxlen);
6494 		sti->sti_laddr_len = laddrlen;
6495 		bcopy(laddr, sti->sti_laddr_sa, laddrlen);
6496 		sti->sti_laddr_valid = (so->so_state & SS_ISBOUND);
6497 	}
6498 
6499 	if (faddrlen != 0) {
6500 		ASSERT(faddrlen <= sti->sti_faddr_maxlen);
6501 		sti->sti_faddr_len = faddrlen;
6502 		bcopy(faddr, sti->sti_faddr_sa, faddrlen);
6503 		sti->sti_faddr_valid = (so->so_state & SS_ISCONNECTED);
6504 	}
6505 
6506 }
6507 
6508 /*
6509  * Allocate enough space to cache the local and foreign addresses.
6510  */
6511 void
6512 so_alloc_addr(struct sonode *so, t_uscalar_t maxlen)
6513 {
6514 	sotpi_info_t *sti = SOTOTPI(so);
6515 
6516 	ASSERT(sti->sti_laddr_sa == NULL && sti->sti_faddr_sa == NULL);
6517 	ASSERT(sti->sti_laddr_len == 0 && sti->sti_faddr_len == 0);
6518 	sti->sti_laddr_maxlen = sti->sti_faddr_maxlen =
6519 	    P2ROUNDUP(maxlen, KMEM_ALIGN);
6520 	so->so_max_addr_len = sti->sti_laddr_maxlen;
6521 	sti->sti_laddr_sa = kmem_alloc(sti->sti_laddr_maxlen * 2, KM_SLEEP);
6522 	sti->sti_faddr_sa = (struct sockaddr *)((caddr_t)sti->sti_laddr_sa
6523 	    + sti->sti_laddr_maxlen);
6524 
6525 	if (so->so_family == AF_UNIX) {
6526 		/*
6527 		 * Initialize AF_UNIX related fields.
6528 		 */
6529 		bzero(&sti->sti_ux_laddr, sizeof (sti->sti_ux_laddr));
6530 		bzero(&sti->sti_ux_faddr, sizeof (sti->sti_ux_faddr));
6531 	}
6532 }
6533 
6534 
6535 sotpi_info_t *
6536 sotpi_sototpi(struct sonode *so)
6537 {
6538 	sotpi_info_t *sti;
6539 
6540 	ASSERT(so != NULL);
6541 
6542 	sti = (sotpi_info_t *)so->so_priv;
6543 
6544 	ASSERT(sti != NULL);
6545 	ASSERT(sti->sti_magic == SOTPI_INFO_MAGIC);
6546 
6547 	return (sti);
6548 }
6549 
6550 static int
6551 i_sotpi_info_constructor(sotpi_info_t *sti)
6552 {
6553 	sti->sti_magic		= SOTPI_INFO_MAGIC;
6554 	sti->sti_ack_mp		= NULL;
6555 	sti->sti_discon_ind_mp	= NULL;
6556 	sti->sti_ux_bound_vp	= NULL;
6557 	sti->sti_unbind_mp	= NULL;
6558 
6559 	sti->sti_conn_ind_head	= NULL;
6560 	sti->sti_conn_ind_tail	= NULL;
6561 
6562 	sti->sti_laddr_sa	= NULL;
6563 	sti->sti_faddr_sa	= NULL;
6564 
6565 	sti->sti_nl7c_flags	= 0;
6566 	sti->sti_nl7c_uri	= NULL;
6567 	sti->sti_nl7c_rcv_mp	= NULL;
6568 
6569 	mutex_init(&sti->sti_plumb_lock, NULL, MUTEX_DEFAULT, NULL);
6570 	cv_init(&sti->sti_ack_cv, NULL, CV_DEFAULT, NULL);
6571 
6572 	return (0);
6573 }
6574 
6575 static void
6576 i_sotpi_info_destructor(sotpi_info_t *sti)
6577 {
6578 	ASSERT(sti->sti_magic == SOTPI_INFO_MAGIC);
6579 	ASSERT(sti->sti_ack_mp == NULL);
6580 	ASSERT(sti->sti_discon_ind_mp == NULL);
6581 	ASSERT(sti->sti_ux_bound_vp == NULL);
6582 	ASSERT(sti->sti_unbind_mp == NULL);
6583 
6584 	ASSERT(sti->sti_conn_ind_head == NULL);
6585 	ASSERT(sti->sti_conn_ind_tail == NULL);
6586 
6587 	ASSERT(sti->sti_laddr_sa == NULL);
6588 	ASSERT(sti->sti_faddr_sa == NULL);
6589 
6590 	ASSERT(sti->sti_nl7c_flags == 0);
6591 	ASSERT(sti->sti_nl7c_uri == NULL);
6592 	ASSERT(sti->sti_nl7c_rcv_mp == NULL);
6593 
6594 	mutex_destroy(&sti->sti_plumb_lock);
6595 	cv_destroy(&sti->sti_ack_cv);
6596 }
6597 
6598 /*
6599  * Creates and attaches TPI information to the given sonode
6600  */
6601 static boolean_t
6602 sotpi_info_create(struct sonode *so, int kmflags)
6603 {
6604 	sotpi_info_t *sti;
6605 
6606 	ASSERT(so->so_priv == NULL);
6607 
6608 	if ((sti = kmem_zalloc(sizeof (*sti), kmflags)) == NULL)
6609 		return (B_FALSE);
6610 
6611 	if (i_sotpi_info_constructor(sti) != 0) {
6612 		kmem_free(sti, sizeof (*sti));
6613 		return (B_FALSE);
6614 	}
6615 
6616 	so->so_priv = (void *)sti;
6617 	return (B_TRUE);
6618 }
6619 
6620 /*
6621  * Initializes the TPI information.
6622  */
6623 static void
6624 sotpi_info_init(struct sonode *so)
6625 {
6626 	struct vnode *vp = SOTOV(so);
6627 	sotpi_info_t *sti = SOTOTPI(so);
6628 	time_t now;
6629 
6630 	sti->sti_dev 	= so->so_sockparams->sp_sdev_info.sd_vnode->v_rdev;
6631 	vp->v_rdev	= sti->sti_dev;
6632 
6633 	sti->sti_orig_sp = NULL;
6634 
6635 	sti->sti_pushcnt = 0;
6636 
6637 	now = gethrestime_sec();
6638 	sti->sti_atime	= now;
6639 	sti->sti_mtime	= now;
6640 	sti->sti_ctime	= now;
6641 
6642 	sti->sti_eaddr_mp = NULL;
6643 	sti->sti_delayed_error = 0;
6644 
6645 	sti->sti_provinfo = NULL;
6646 
6647 	sti->sti_oobcnt = 0;
6648 	sti->sti_oobsigcnt = 0;
6649 
6650 	ASSERT(sti->sti_laddr_sa == NULL && sti->sti_faddr_sa == NULL);
6651 
6652 	sti->sti_laddr_sa	= 0;
6653 	sti->sti_faddr_sa	= 0;
6654 	sti->sti_laddr_maxlen = sti->sti_faddr_maxlen = 0;
6655 	sti->sti_laddr_len = sti->sti_faddr_len = 0;
6656 
6657 	sti->sti_laddr_valid = 0;
6658 	sti->sti_faddr_valid = 0;
6659 	sti->sti_faddr_noxlate = 0;
6660 
6661 	sti->sti_direct = 0;
6662 
6663 	ASSERT(sti->sti_ack_mp == NULL);
6664 	ASSERT(sti->sti_ux_bound_vp == NULL);
6665 	ASSERT(sti->sti_unbind_mp == NULL);
6666 
6667 	ASSERT(sti->sti_conn_ind_head == NULL);
6668 	ASSERT(sti->sti_conn_ind_tail == NULL);
6669 }
6670 
6671 /*
6672  * Given a sonode, grab the TPI info and free any data.
6673  */
6674 static void
6675 sotpi_info_fini(struct sonode *so)
6676 {
6677 	sotpi_info_t *sti = SOTOTPI(so);
6678 	mblk_t *mp;
6679 
6680 	ASSERT(sti->sti_discon_ind_mp == NULL);
6681 
6682 	if ((mp = sti->sti_conn_ind_head) != NULL) {
6683 		mblk_t *mp1;
6684 
6685 		while (mp) {
6686 			mp1 = mp->b_next;
6687 			mp->b_next = NULL;
6688 			freemsg(mp);
6689 			mp = mp1;
6690 		}
6691 		sti->sti_conn_ind_head = sti->sti_conn_ind_tail = NULL;
6692 	}
6693 
6694 	/*
6695 	 * Protect so->so_[lf]addr_sa so that sockfs_snapshot() can safely
6696 	 * indirect them.  It also uses so_count as a validity test.
6697 	 */
6698 	mutex_enter(&so->so_lock);
6699 
6700 	if (sti->sti_laddr_sa) {
6701 		ASSERT((caddr_t)sti->sti_faddr_sa ==
6702 		    (caddr_t)sti->sti_laddr_sa + sti->sti_laddr_maxlen);
6703 		ASSERT(sti->sti_faddr_maxlen == sti->sti_laddr_maxlen);
6704 		sti->sti_laddr_valid = 0;
6705 		sti->sti_faddr_valid = 0;
6706 		kmem_free(sti->sti_laddr_sa, sti->sti_laddr_maxlen * 2);
6707 		sti->sti_laddr_sa = NULL;
6708 		sti->sti_laddr_len = sti->sti_laddr_maxlen = 0;
6709 		sti->sti_faddr_sa = NULL;
6710 		sti->sti_faddr_len = sti->sti_faddr_maxlen = 0;
6711 	}
6712 
6713 	mutex_exit(&so->so_lock);
6714 
6715 	if ((mp = sti->sti_eaddr_mp) != NULL) {
6716 		freemsg(mp);
6717 		sti->sti_eaddr_mp = NULL;
6718 		sti->sti_delayed_error = 0;
6719 	}
6720 
6721 	if ((mp = sti->sti_ack_mp) != NULL) {
6722 		freemsg(mp);
6723 		sti->sti_ack_mp = NULL;
6724 	}
6725 
6726 	if ((mp = sti->sti_nl7c_rcv_mp) != NULL) {
6727 		sti->sti_nl7c_rcv_mp = NULL;
6728 		freemsg(mp);
6729 	}
6730 	sti->sti_nl7c_rcv_rval = 0;
6731 	if (sti->sti_nl7c_uri != NULL) {
6732 		nl7c_urifree(so);
6733 		/* urifree() cleared nl7c_uri */
6734 	}
6735 	if (sti->sti_nl7c_flags) {
6736 		sti->sti_nl7c_flags = 0;
6737 	}
6738 
6739 	ASSERT(sti->sti_ux_bound_vp == NULL);
6740 	if ((mp = sti->sti_unbind_mp) != NULL) {
6741 		freemsg(mp);
6742 		sti->sti_unbind_mp = NULL;
6743 	}
6744 }
6745 
6746 /*
6747  * Destroys the TPI information attached to a sonode.
6748  */
6749 static void
6750 sotpi_info_destroy(struct sonode *so)
6751 {
6752 	sotpi_info_t *sti = SOTOTPI(so);
6753 
6754 	i_sotpi_info_destructor(sti);
6755 	kmem_free(sti, sizeof (*sti));
6756 
6757 	so->so_priv = NULL;
6758 }
6759 
6760 /*
6761  * Create the global sotpi socket module entry. It will never be freed.
6762  */
6763 smod_info_t *
6764 sotpi_smod_create(void)
6765 {
6766 	smod_info_t *smodp;
6767 
6768 	smodp = kmem_zalloc(sizeof (*smodp), KM_SLEEP);
6769 	smodp->smod_name = kmem_alloc(sizeof (SOTPI_SMOD_NAME), KM_SLEEP);
6770 	(void) strcpy(smodp->smod_name, SOTPI_SMOD_NAME);
6771 	/*
6772 	 * Initialize the smod_refcnt to 1 so it will never be freed.
6773 	 */
6774 	smodp->smod_refcnt = 1;
6775 	smodp->smod_uc_version = SOCK_UC_VERSION;
6776 	smodp->smod_dc_version = SOCK_DC_VERSION;
6777 	smodp->smod_sock_create_func = &sotpi_create;
6778 	smodp->smod_sock_destroy_func = &sotpi_destroy;
6779 	return (smodp);
6780 }
6781