1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21 /*
22 * Copyright 2010 Sun Microsystems, Inc. All rights reserved.
23 * Use is subject to license terms.
24 */
25 /*
26 * Copyright 2011 Nexenta Systems, Inc. All rights reserved.
27 * Copyright (c) 2012 by Delphix. All rights reserved.
28 * Copyright 2015 Joyent, Inc.
29 */
30
31 /*
32 * Multithreaded STREAMS Local Transport Provider.
33 *
34 * OVERVIEW
35 * ========
36 *
37 * This driver provides TLI as well as socket semantics. It provides
38 * connectionless, connection oriented, and connection oriented with orderly
39 * release transports for TLI and sockets. Each transport type has separate name
40 * spaces (i.e. it is not possible to connect from a socket to a TLI endpoint) -
41 * this removes any name space conflicts when binding to socket style transport
42 * addresses.
43 *
44 * NOTE: There is one exception: Socket ticots and ticotsord transports share
45 * the same namespace. In fact, sockets always use ticotsord type transport.
46 *
47 * The driver mode is specified during open() by the minor number used for
48 * open.
49 *
50 * The sockets in addition have the following semantic differences:
51 * No support for passing up credentials (TL_SET[U]CRED).
52 *
53 * Options are passed through transparently on T_CONN_REQ to T_CONN_IND,
54 * from T_UNITDATA_REQ to T_UNIDATA_IND, and from T_OPTDATA_REQ to
55 * T_OPTDATA_IND.
56 *
57 * The T_CONN_CON is generated when processing the T_CONN_REQ i.e. before
58 * a T_CONN_RES is received from the acceptor. This means that a socket
59 * connect will complete before the peer has called accept.
60 *
61 *
62 * MULTITHREADING
63 * ==============
64 *
65 * The driver does not use STREAMS protection mechanisms. Instead it uses a
66 * generic "serializer" abstraction. Most of the operations are executed behind
67 * the serializer and are, essentially single-threaded. All functions executed
68 * behind the same serializer are strictly serialized. So if one thread calls
69 * serializer_enter(serializer, foo, mp1, arg1); and another thread calls
70 * serializer_enter(serializer, bar, mp2, arg1); then (depending on which one
71 * was called) the actual sequence will be foo(mp1, arg1); bar(mp1, arg2) or
72 * bar(mp1, arg2); foo(mp1, arg1); But foo() and bar() will never run at the
73 * same time.
74 *
75 * Connectionless transport use a single serializer per transport type (one for
76 * TLI and one for sockets. Connection-oriented transports use finer-grained
77 * serializers.
78 *
79 * All COTS-type endpoints start their life with private serializers. During
80 * connection request processing the endpoint serializer is switched to the
81 * listener's serializer and the rest of T_CONN_REQ processing is done on the
82 * listener serializer. During T_CONN_RES processing the eager serializer is
83 * switched from listener to acceptor serializer and after that point all
84 * processing for eager and acceptor happens on this serializer. To avoid races
85 * with endpoint closes while its serializer may be changing closes are blocked
86 * while serializers are manipulated.
87 *
88 * References accounting
89 * ---------------------
90 *
91 * Endpoints are reference counted and freed when the last reference is
92 * dropped. Functions within the serializer may access an endpoint state even
93 * after an endpoint closed. The te_closing being set on the endpoint indicates
94 * that the endpoint entered its close routine.
95 *
96 * One reference is held for each opened endpoint instance. The reference
97 * counter is incremented when the endpoint is linked to another endpoint and
98 * decremented when the link disappears. It is also incremented when the
99 * endpoint is found by the hash table lookup. This increment is atomic with the
100 * lookup itself and happens while the hash table read lock is held.
101 *
102 * Close synchronization
103 * ---------------------
104 *
105 * During close the endpoint as marked as closing using te_closing flag. It is
106 * usually enough to check for te_closing flag since all other state changes
107 * happen after this flag is set and the close entered serializer. Immediately
108 * after setting te_closing flag tl_close() enters serializer and waits until
109 * the callback finishes. This allows all functions called within serializer to
110 * simply check te_closing without any locks.
111 *
112 * Serializer management.
113 * ---------------------
114 *
115 * For COTS transports serializers are created when the endpoint is constructed
116 * and destroyed when the endpoint is destructed. CLTS transports use global
117 * serializers - one for sockets and one for TLI.
118 *
119 * COTS serializers have separate reference counts to deal with several
120 * endpoints sharing the same serializer. There is a subtle problem related to
121 * the serializer destruction. The serializer should never be destroyed by any
122 * function executed inside serializer. This means that close has to wait till
123 * all serializer activity for this endpoint is finished before it can drop the
124 * last reference on the endpoint (which may as well free the serializer). This
125 * is only relevant for COTS transports which manage serializers
126 * dynamically. For CLTS transports close may complete without waiting for all
127 * serializer activity to finish since serializer is only destroyed at driver
128 * detach time.
129 *
130 * COTS endpoints keep track of the number of outstanding requests on the
131 * serializer for the endpoint. The code handling accept() avoids changing
132 * client serializer if it has any pending messages on the serializer and
133 * instead moves acceptor to listener's serializer.
134 *
135 *
136 * Use of hash tables
137 * ------------------
138 *
139 * The driver uses modhash hash table implementation. Each transport uses two
140 * hash tables - one for finding endpoints by acceptor ID and another one for
141 * finding endpoints by address. For sockets TICOTS and TICOTSORD share the same
142 * pair of hash tables since sockets only use TICOTSORD.
143 *
144 * All hash tables lookups increment a reference count for returned endpoints,
145 * so we may safely check the endpoint state even when the endpoint is removed
146 * from the hash by another thread immediately after it is found.
147 *
148 *
149 * CLOSE processing
150 * ================
151 *
152 * The driver enters serializer twice on close(). The close sequence is the
153 * following:
154 *
155 * 1) Wait until closing is safe (te_closewait becomes zero)
156 * This step is needed to prevent close during serializer switches. In most
157 * cases (close happening after connection establishment) te_closewait is
158 * zero.
159 * 1) Set te_closing.
160 * 2) Call tl_close_ser() within serializer and wait for it to complete.
161 *
162 * te_close_ser simply marks endpoint and wakes up waiting tl_close().
163 * It also needs to clear write-side q_next pointers - this should be done
164 * before qprocsoff().
165 *
166 * This synchronous serializer entry during close is needed to ensure that
167 * the queue is valid everywhere inside the serializer.
168 *
169 * Note that in many cases close will execute tl_close_ser() synchronously,
170 * so it will not wait at all.
171 *
172 * 3) Calls qprocsoff().
173 * 4) Calls tl_close_finish_ser() within the serializer and waits for it to
174 * complete (for COTS transports). For CLTS transport there is no wait.
175 *
176 * tl_close_finish_ser() Finishes the close process and wakes up waiting
177 * close if there is any.
178 *
179 * Note that in most cases close will enter te_close_ser_finish()
180 * synchronously and will not wait at all.
181 *
182 *
183 * Flow Control
184 * ============
185 *
186 * The driver implements both read and write side service routines. No one calls
187 * putq() on the read queue. The read side service routine tl_rsrv() is called
188 * when the read side stream is back-enabled. It enters serializer synchronously
189 * (waits till serializer processing is complete). Within serializer it
190 * back-enables all endpoints blocked by the queue for connection-less
191 * transports and enables write side service processing for the peer for
192 * connection-oriented transports.
193 *
194 * Read and write side service routines use special mblk_sized space in the
195 * endpoint structure to enter perimeter.
196 *
197 * Write-side flow control
198 * -----------------------
199 *
200 * Write side flow control is a bit tricky. The driver needs to deal with two
201 * message queues - the explicit STREAMS message queue maintained by
202 * putq()/getq()/putbq() and the implicit queue within the serializer. These two
203 * queues should be synchronized to preserve message ordering and should
204 * maintain a single order determined by the order in which messages enter
205 * tl_wput(). In order to maintain the ordering between these two queues the
206 * STREAMS queue is only manipulated within the serializer, so the ordering is
207 * provided by the serializer.
208 *
209 * Functions called from the tl_wsrv() sometimes may call putbq(). To
210 * immediately stop any further processing of the STREAMS message queues the
211 * code calling putbq() also sets the te_nowsrv flag in the endpoint. The write
212 * side service processing stops when the flag is set.
213 *
214 * The tl_wsrv() function enters serializer synchronously and waits for it to
215 * complete. The serializer call-back tl_wsrv_ser() either drains all messages
216 * on the STREAMS queue or terminates when it notices the te_nowsrv flag
217 * set. Note that the maximum amount of messages processed by tl_wput_ser() is
218 * always bounded by the amount of messages on the STREAMS queue at the time
219 * tl_wsrv_ser() is entered. Any new messages may only appear on the STREAMS
220 * queue from another serialized entry which can't happen in parallel. This
221 * guarantees that tl_wput_ser() is complete in bounded time (there is no risk
222 * of it draining forever while writer places new messages on the STREAMS
223 * queue).
224 *
225 * Note that a closing endpoint never sets te_nowsrv and never calls putbq().
226 *
227 *
228 * Unix Domain Sockets
229 * ===================
230 *
231 * The driver knows the structure of Unix Domain sockets addresses and treats
232 * them differently from generic TLI addresses. For sockets implicit binds are
233 * requested by setting SOU_MAGIC_IMPLICIT in the soua_magic part of the address
234 * instead of using address length of zero. Explicit binds specify
235 * SOU_MAGIC_EXPLICIT as magic.
236 *
237 * For implicit binds we always use minor number as soua_vp part of the address
238 * and avoid any hash table lookups. This saves two hash tables lookups per
239 * anonymous bind.
240 *
241 * For explicit address we hash the vnode pointer instead of hashing the
242 * full-scale address+zone+length. Hashing by pointer is more efficient then
243 * hashing by the full address.
244 *
245 * For unix domain sockets the te_ap is always pointing to te_uxaddr part of the
246 * tep structure, so it should be never freed.
247 *
248 * Also for sockets the driver always uses minor number as acceptor id.
249 *
250 * TPI VIOLATIONS
251 * --------------
252 *
253 * This driver violates TPI in several respects for Unix Domain Sockets:
254 *
255 * 1) It treats O_T_BIND_REQ as T_BIND_REQ and refuses bind if an explicit bind
256 * is requested and the endpoint is already in use. There is no point in
257 * generating an unused address since this address will be rejected by
258 * sockfs anyway. For implicit binds it always generates a new address
259 * (sets soua_vp to its minor number).
260 *
261 * 2) It always uses minor number as acceptor ID and never uses queue
262 * pointer. It is ok since sockets get acceptor ID from T_CAPABILITY_REQ
263 * message and they do not use the queue pointer.
264 *
265 * 3) For Listener sockets the usual sequence is to issue bind() zero backlog
266 * followed by listen(). The listen() should be issued with non-zero
267 * backlog, so sotpi_listen() issues unbind request followed by bind
268 * request to the same address but with a non-zero qlen value. Both
269 * tl_bind() and tl_unbind() require write lock on the hash table to
270 * insert/remove the address. The driver does not remove the address from
271 * the hash for endpoints that are bound to the explicit address and have
272 * backlog of zero. During T_BIND_REQ processing if the address requested
273 * is equal to the address the endpoint already has it updates the backlog
274 * without reinserting the address in the hash table. This optimization
275 * avoids two hash table updates for each listener created. It always
276 * avoids the problem of a "stolen" address when another listener may use
277 * the same address between the unbind and bind and suddenly listen() fails
278 * because address is in use even though the bind() succeeded.
279 *
280 *
281 * CONNECTIONLESS TRANSPORTS
282 * =========================
283 *
284 * Connectionless transports all share the same serializer (one for TLI and one
285 * for Sockets). Functions executing behind serializer can check or modify state
286 * of any endpoint.
287 *
288 * When endpoint X talks to another endpoint Y it caches the pointer to Y in the
289 * te_lastep field. The next time X talks to some address A it checks whether A
290 * is the same as Y's address and if it is there is no need to lookup Y. If the
291 * address is different or the state of Y is not appropriate (e.g. closed or not
292 * idle) X does a lookup using tl_find_peer() and caches the new address.
293 * NOTE: tl_find_peer() never returns closing endpoint and it places a refhold
294 * on the endpoint found.
295 *
296 * During close of endpoint Y it doesn't try to remove itself from other
297 * endpoints caches. They will detect that Y is gone and will search the peer
298 * endpoint again.
299 *
300 * Flow Control Handling.
301 * ----------------------
302 *
303 * Each connectionless endpoint keeps a list of endpoints which are
304 * flow-controlled by its queue. It also keeps a pointer to the queue which
305 * flow-controls itself. Whenever flow control releases for endpoint X it
306 * enables all queues from the list. During close it also back-enables everyone
307 * in the list. If X is flow-controlled when it is closing it removes it from
308 * the peers list.
309 *
310 * DATA STRUCTURES
311 * ===============
312 *
313 * Each endpoint is represented by the tl_endpt_t structure which keeps all the
314 * endpoint state. For connection-oriented transports it has a keeps a list
315 * of pending connections (tl_icon_t). For connectionless transports it keeps a
316 * list of endpoints flow controlled by this one.
317 *
318 * Each transport type is represented by a per-transport data structure
319 * tl_transport_state_t. It contains a pointer to an acceptor ID hash and the
320 * endpoint address hash tables for each transport. It also contains pointer to
321 * transport serializer for connectionless transports.
322 *
323 * Each endpoint keeps a link to its transport structure, so the code can find
324 * all per-transport information quickly.
325 */
326
327 #include <sys/types.h>
328 #include <sys/inttypes.h>
329 #include <sys/stream.h>
330 #include <sys/stropts.h>
331 #define _SUN_TPI_VERSION 2
332 #include <sys/tihdr.h>
333 #include <sys/strlog.h>
334 #include <sys/debug.h>
335 #include <sys/cred.h>
336 #include <sys/errno.h>
337 #include <sys/kmem.h>
338 #include <sys/id_space.h>
339 #include <sys/modhash.h>
340 #include <sys/mkdev.h>
341 #include <sys/tl.h>
342 #include <sys/stat.h>
343 #include <sys/conf.h>
344 #include <sys/modctl.h>
345 #include <sys/strsun.h>
346 #include <sys/socket.h>
347 #include <sys/socketvar.h>
348 #include <sys/sysmacros.h>
349 #include <sys/xti_xtiopt.h>
350 #include <sys/ddi.h>
351 #include <sys/sunddi.h>
352 #include <sys/zone.h>
353 #include <inet/common.h> /* typedef int (*pfi_t)() for inet/optcom.h */
354 #include <inet/optcom.h>
355 #include <sys/strsubr.h>
356 #include <sys/ucred.h>
357 #include <sys/suntpi.h>
358 #include <sys/list.h>
359 #include <sys/serializer.h>
360
361 /*
362 * TBD List
363 * 14 Eliminate state changes through table
364 * 16. AF_UNIX socket options
365 * 17. connect() for ticlts
366 * 18. support for "netstat" to show AF_UNIX plus TLI local
367 * transport connections
368 * 21. sanity check to flushing on sending M_ERROR
369 */
370
371 /*
372 * CONSTANT DECLARATIONS
373 * --------------------
374 */
375
376 /*
377 * Local declarations
378 */
379 #define NEXTSTATE(EV, ST) ti_statetbl[EV][ST]
380
381 #define BADSEQNUM (-1) /* initial seq number used by T_DISCON_IND */
382 #define TL_BUFWAIT (10000) /* usecs to wait for allocb buffer timeout */
383 #define TL_TIDUSZ (64*1024) /* tidu size when "strmsgz" is unlimited (0) */
384 /*
385 * Hash tables size.
386 */
387 #define TL_HASH_SIZE 311
388
389 /*
390 * Definitions for module_info
391 */
392 #define TL_ID (104) /* module ID number */
393 #define TL_NAME "tl" /* module name */
394 #define TL_MINPSZ (0) /* min packet size */
395 #define TL_MAXPSZ INFPSZ /* max packet size ZZZ */
396 #define TL_HIWAT (16*1024) /* hi water mark */
397 #define TL_LOWAT (256) /* lo water mark */
398 /*
399 * Definition of minor numbers/modes for new transport provider modes.
400 * We view the socket use as a separate mode to get a separate name space.
401 */
402 #define TL_TICOTS 0 /* connection oriented transport */
403 #define TL_TICOTSORD 1 /* COTS w/ orderly release */
404 #define TL_TICLTS 2 /* connectionless transport */
405 #define TL_UNUSED 3
406 #define TL_SOCKET 4 /* Socket */
407 #define TL_SOCK_COTS (TL_SOCKET|TL_TICOTS)
408 #define TL_SOCK_COTSORD (TL_SOCKET|TL_TICOTSORD)
409 #define TL_SOCK_CLTS (TL_SOCKET|TL_TICLTS)
410
411 #define TL_MINOR_MASK 0x7
412 #define TL_MINOR_START (TL_TICLTS + 1)
413
414 /*
415 * LOCAL MACROS
416 */
417 #define T_ALIGN(p) P2ROUNDUP((p), sizeof (t_scalar_t))
418
419 /*
420 * EXTERNAL VARIABLE DECLARATIONS
421 * -----------------------------
422 */
423 /*
424 * state table defined in the OS space.c
425 */
426 extern char ti_statetbl[TE_NOEVENTS][TS_NOSTATES];
427
428 /*
429 * STREAMS DRIVER ENTRY POINTS PROTOTYPES
430 */
431 static int tl_open(queue_t *, dev_t *, int, int, cred_t *);
432 static int tl_close(queue_t *, int, cred_t *);
433 static void tl_wput(queue_t *, mblk_t *);
434 static void tl_wsrv(queue_t *);
435 static void tl_rsrv(queue_t *);
436
437 static int tl_attach(dev_info_t *, ddi_attach_cmd_t);
438 static int tl_detach(dev_info_t *, ddi_detach_cmd_t);
439 static int tl_info(dev_info_t *, ddi_info_cmd_t, void *, void **);
440
441
442 /*
443 * GLOBAL DATA STRUCTURES AND VARIABLES
444 * -----------------------------------
445 */
446
447 /*
448 * Table representing database of all options managed by T_SVR4_OPTMGMT_REQ
449 * For now, we only manage the SO_RECVUCRED option but we also have
450 * harmless dummy options to make things work with some common code we access.
451 */
452 opdes_t tl_opt_arr[] = {
453 /* The SO_TYPE is needed for the hack below */
454 {
455 SO_TYPE,
456 SOL_SOCKET,
457 OA_R,
458 OA_R,
459 OP_NP,
460 0,
461 sizeof (t_scalar_t),
462 0
463 },
464 {
465 SO_RECVUCRED,
466 SOL_SOCKET,
467 OA_RW,
468 OA_RW,
469 OP_NP,
470 0,
471 sizeof (int),
472 0
473 }
474 };
475
476 /*
477 * Table of all supported levels
478 * Note: Some levels (e.g. XTI_GENERIC) may be valid but may not have
479 * any supported options so we need this info separately.
480 *
481 * This is needed only for topmost tpi providers.
482 */
483 optlevel_t tl_valid_levels_arr[] = {
484 XTI_GENERIC,
485 SOL_SOCKET,
486 TL_PROT_LEVEL
487 };
488
489 #define TL_VALID_LEVELS_CNT A_CNT(tl_valid_levels_arr)
490 /*
491 * Current upper bound on the amount of space needed to return all options.
492 * Additional options with data size of sizeof(long) are handled automatically.
493 * Others need hand job.
494 */
495 #define TL_MAX_OPT_BUF_LEN \
496 ((A_CNT(tl_opt_arr) << 2) + \
497 (A_CNT(tl_opt_arr) * sizeof (struct opthdr)) + \
498 + 64 + sizeof (struct T_optmgmt_ack))
499
500 #define TL_OPT_ARR_CNT A_CNT(tl_opt_arr)
501
502 /*
503 * transport addr structure
504 */
505 typedef struct tl_addr {
506 zoneid_t ta_zoneid; /* Zone scope of address */
507 t_scalar_t ta_alen; /* length of abuf */
508 void *ta_abuf; /* the addr itself */
509 } tl_addr_t;
510
511 /*
512 * Refcounted version of serializer.
513 */
514 typedef struct tl_serializer {
515 uint_t ts_refcnt;
516 serializer_t *ts_serializer;
517 } tl_serializer_t;
518
519 /*
520 * Each transport type has a separate state.
521 * Per-transport state.
522 */
523 typedef struct tl_transport_state {
524 char *tr_name;
525 minor_t tr_minor;
526 uint32_t tr_defaddr;
527 mod_hash_t *tr_ai_hash;
528 mod_hash_t *tr_addr_hash;
529 tl_serializer_t *tr_serializer;
530 } tl_transport_state_t;
531
532 #define TL_DFADDR 0x1000
533
534 static tl_transport_state_t tl_transports[] = {
535 { "ticots", TL_TICOTS, TL_DFADDR, NULL, NULL, NULL },
536 { "ticotsord", TL_TICOTSORD, TL_DFADDR, NULL, NULL, NULL },
537 { "ticlts", TL_TICLTS, TL_DFADDR, NULL, NULL, NULL },
538 { "undefined", TL_UNUSED, TL_DFADDR, NULL, NULL, NULL },
539 { "sticots", TL_SOCK_COTS, TL_DFADDR, NULL, NULL, NULL },
540 { "sticotsord", TL_SOCK_COTSORD, TL_DFADDR, NULL, NULL },
541 { "sticlts", TL_SOCK_CLTS, TL_DFADDR, NULL, NULL, NULL }
542 };
543
544 #define TL_MAXTRANSPORT A_CNT(tl_transports)
545
546 struct tl_endpt;
547 typedef struct tl_endpt tl_endpt_t;
548
549 typedef void (tlproc_t)(mblk_t *, tl_endpt_t *);
550
551 /*
552 * Data structure used to represent pending connects.
553 * Records enough information so that the connecting peer can close
554 * before the connection gets accepted.
555 */
556 typedef struct tl_icon {
557 list_node_t ti_node;
558 struct tl_endpt *ti_tep; /* NULL if peer has already closed */
559 mblk_t *ti_mp; /* b_next list of data + ordrel_ind */
560 t_scalar_t ti_seqno; /* Sequence number */
561 } tl_icon_t;
562
563 typedef struct so_ux_addr soux_addr_t;
564 #define TL_SOUX_ADDRLEN sizeof (soux_addr_t)
565
566 /*
567 * Maximum number of unaccepted connection indications allowed per listener.
568 */
569 #define TL_MAXQLEN 4096
570 int tl_maxqlen = TL_MAXQLEN;
571
572 /*
573 * transport endpoint structure
574 */
575 struct tl_endpt {
576 queue_t *te_rq; /* stream read queue */
577 queue_t *te_wq; /* stream write queue */
578 uint32_t te_refcnt;
579 int32_t te_state; /* TPI state of endpoint */
580 minor_t te_minor; /* minor number */
581 #define te_seqno te_minor
582 uint_t te_flag; /* flag field */
583 boolean_t te_nowsrv;
584 tl_serializer_t *te_ser; /* Serializer to use */
585 #define te_serializer te_ser->ts_serializer
586
587 soux_addr_t te_uxaddr; /* Socket address */
588 #define te_magic te_uxaddr.soua_magic
589 #define te_vp te_uxaddr.soua_vp
590 tl_addr_t te_ap; /* addr bound to this endpt */
591 #define te_zoneid te_ap.ta_zoneid
592 #define te_alen te_ap.ta_alen
593 #define te_abuf te_ap.ta_abuf
594
595 tl_transport_state_t *te_transport;
596 #define te_addrhash te_transport->tr_addr_hash
597 #define te_aihash te_transport->tr_ai_hash
598 #define te_defaddr te_transport->tr_defaddr
599 cred_t *te_credp; /* endpoint user credentials */
600 mod_hash_hndl_t te_hash_hndl; /* Handle for address hash */
601
602 /*
603 * State specific for connection-oriented and connectionless transports.
604 */
605 union {
606 /* Connection-oriented state. */
607 struct {
608 t_uscalar_t _te_nicon; /* count of conn requests */
609 t_uscalar_t _te_qlen; /* max conn requests */
610 tl_endpt_t *_te_oconp; /* conn request pending */
611 tl_endpt_t *_te_conp; /* connected endpt */
612 #ifndef _ILP32
613 void *_te_pad;
614 #endif
615 list_t _te_iconp; /* list of conn ind. pending */
616 } _te_cots_state;
617 /* Connection-less state. */
618 struct {
619 tl_endpt_t *_te_lastep; /* last dest. endpoint */
620 tl_endpt_t *_te_flowq; /* flow controlled on whom */
621 list_node_t _te_flows; /* lists of connections */
622 list_t _te_flowlist; /* Who flowcontrols on me */
623 } _te_clts_state;
624 } _te_transport_state;
625 #define te_nicon _te_transport_state._te_cots_state._te_nicon
626 #define te_qlen _te_transport_state._te_cots_state._te_qlen
627 #define te_oconp _te_transport_state._te_cots_state._te_oconp
628 #define te_conp _te_transport_state._te_cots_state._te_conp
629 #define te_iconp _te_transport_state._te_cots_state._te_iconp
630 #define te_lastep _te_transport_state._te_clts_state._te_lastep
631 #define te_flowq _te_transport_state._te_clts_state._te_flowq
632 #define te_flowlist _te_transport_state._te_clts_state._te_flowlist
633 #define te_flows _te_transport_state._te_clts_state._te_flows
634
635 bufcall_id_t te_bufcid; /* outstanding bufcall id */
636 timeout_id_t te_timoutid; /* outstanding timeout id */
637 pid_t te_cpid; /* cached pid of endpoint */
638 t_uscalar_t te_acceptor_id; /* acceptor id for T_CONN_RES */
639 /*
640 * Pieces of the endpoint state needed for closing.
641 */
642 kmutex_t te_closelock;
643 kcondvar_t te_closecv;
644 uint8_t te_closing; /* The endpoint started closing */
645 uint8_t te_closewait; /* Wait in close until zero */
646 mblk_t te_closemp; /* for entering serializer on close */
647 mblk_t te_rsrvmp; /* for entering serializer on rsrv */
648 mblk_t te_wsrvmp; /* for entering serializer on wsrv */
649 kmutex_t te_srv_lock;
650 kcondvar_t te_srv_cv;
651 uint8_t te_rsrv_active; /* Running in tl_rsrv() */
652 uint8_t te_wsrv_active; /* Running in tl_wsrv() */
653 /*
654 * Pieces of the endpoint state needed for serializer transitions.
655 */
656 kmutex_t te_ser_lock; /* Protects the count below */
657 uint_t te_ser_count; /* Number of messages on serializer */
658 };
659
660 /*
661 * Flag values. Lower 4 bits specify that transport used.
662 * TL_LISTENER, TL_ACCEPTOR, TL_ACCEPTED and TL_EAGER are for debugging only,
663 * they allow to identify the endpoint more easily.
664 */
665 #define TL_LISTENER 0x00010 /* the listener endpoint */
666 #define TL_ACCEPTOR 0x00020 /* the accepting endpoint */
667 #define TL_EAGER 0x00040 /* connecting endpoint */
668 #define TL_ACCEPTED 0x00080 /* accepted connection */
669 #define TL_SETCRED 0x00100 /* flag to indicate sending of credentials */
670 #define TL_SETUCRED 0x00200 /* flag to indicate sending of ucred */
671 #define TL_SOCKUCRED 0x00400 /* flag to indicate sending of SCM_UCRED */
672 #define TL_ADDRHASHED 0x01000 /* Endpoint address is stored in te_addrhash */
673 #define TL_CLOSE_SER 0x10000 /* Endpoint close has entered the serializer */
674 /*
675 * Boolean checks for the endpoint type.
676 */
677 #define IS_CLTS(x) (((x)->te_flag & TL_TICLTS) != 0)
678 #define IS_COTS(x) (((x)->te_flag & TL_TICLTS) == 0)
679 #define IS_COTSORD(x) (((x)->te_flag & TL_TICOTSORD) != 0)
680 #define IS_SOCKET(x) (((x)->te_flag & TL_SOCKET) != 0)
681
682 /*
683 * Certain operations are always used together. These macros reduce the chance
684 * of missing a part of a combination.
685 */
686 #define TL_UNCONNECT(x) { tl_refrele(x); x = NULL; }
687 #define TL_REMOVE_PEER(x) { if ((x) != NULL) TL_UNCONNECT(x) }
688
689 #define TL_PUTBQ(x, mp) { \
690 ASSERT(!((x)->te_flag & TL_CLOSE_SER)); \
691 (x)->te_nowsrv = B_TRUE; \
692 (void) putbq((x)->te_wq, mp); \
693 }
694
695 #define TL_QENABLE(x) { (x)->te_nowsrv = B_FALSE; qenable((x)->te_wq); }
696 #define TL_PUTQ(x, mp) { (x)->te_nowsrv = B_FALSE; (void)putq((x)->te_wq, mp); }
697
698 /*
699 * STREAMS driver glue data structures.
700 */
701 static struct module_info tl_minfo = {
702 TL_ID, /* mi_idnum */
703 TL_NAME, /* mi_idname */
704 TL_MINPSZ, /* mi_minpsz */
705 TL_MAXPSZ, /* mi_maxpsz */
706 TL_HIWAT, /* mi_hiwat */
707 TL_LOWAT /* mi_lowat */
708 };
709
710 static struct qinit tl_rinit = {
711 NULL, /* qi_putp */
712 (int (*)())tl_rsrv, /* qi_srvp */
713 tl_open, /* qi_qopen */
714 tl_close, /* qi_qclose */
715 NULL, /* qi_qadmin */
716 &tl_minfo, /* qi_minfo */
717 NULL /* qi_mstat */
718 };
719
720 static struct qinit tl_winit = {
721 (int (*)())tl_wput, /* qi_putp */
722 (int (*)())tl_wsrv, /* qi_srvp */
723 NULL, /* qi_qopen */
724 NULL, /* qi_qclose */
725 NULL, /* qi_qadmin */
726 &tl_minfo, /* qi_minfo */
727 NULL /* qi_mstat */
728 };
729
730 static struct streamtab tlinfo = {
731 &tl_rinit, /* st_rdinit */
732 &tl_winit, /* st_wrinit */
733 NULL, /* st_muxrinit */
734 NULL /* st_muxwrinit */
735 };
736
737 DDI_DEFINE_STREAM_OPS(tl_devops, nulldev, nulldev, tl_attach, tl_detach,
738 nulldev, tl_info, D_MP, &tlinfo, ddi_quiesce_not_supported);
739
740 static struct modldrv modldrv = {
741 &mod_driverops, /* Type of module -- pseudo driver here */
742 "TPI Local Transport (tl)",
743 &tl_devops, /* driver ops */
744 };
745
746 /*
747 * Module linkage information for the kernel.
748 */
749 static struct modlinkage modlinkage = {
750 MODREV_1,
751 &modldrv,
752 NULL
753 };
754
755 /*
756 * Templates for response to info request
757 * Check sanity of unlimited connect data etc.
758 */
759
760 #define TL_CLTS_PROVIDER_FLAG (XPG4_1|SENDZERO)
761 #define TL_COTS_PROVIDER_FLAG (XPG4_1|SENDZERO)
762
763 static struct T_info_ack tl_cots_info_ack =
764 {
765 T_INFO_ACK, /* PRIM_type -always T_INFO_ACK */
766 T_INFINITE, /* TSDU size */
767 T_INFINITE, /* ETSDU size */
768 T_INFINITE, /* CDATA_size */
769 T_INFINITE, /* DDATA_size */
770 T_INFINITE, /* ADDR_size */
771 T_INFINITE, /* OPT_size */
772 0, /* TIDU_size - fill at run time */
773 T_COTS, /* SERV_type */
774 -1, /* CURRENT_state */
775 TL_COTS_PROVIDER_FLAG /* PROVIDER_flag */
776 };
777
778 static struct T_info_ack tl_clts_info_ack =
779 {
780 T_INFO_ACK, /* PRIM_type - always T_INFO_ACK */
781 0, /* TSDU_size - fill at run time */
782 -2, /* ETSDU_size -2 => not supported */
783 -2, /* CDATA_size -2 => not supported */
784 -2, /* DDATA_size -2 => not supported */
785 -1, /* ADDR_size -1 => infinite */
786 -1, /* OPT_size */
787 0, /* TIDU_size - fill at run time */
788 T_CLTS, /* SERV_type */
789 -1, /* CURRENT_state */
790 TL_CLTS_PROVIDER_FLAG /* PROVIDER_flag */
791 };
792
793 /*
794 * private copy of devinfo pointer used in tl_info
795 */
796 static dev_info_t *tl_dip;
797
798 /*
799 * Endpoints cache.
800 */
801 static kmem_cache_t *tl_cache;
802 /*
803 * Minor number space.
804 */
805 static id_space_t *tl_minors;
806
807 /*
808 * Default Data Unit size.
809 */
810 static t_scalar_t tl_tidusz;
811
812 /*
813 * Size of hash tables.
814 */
815 static size_t tl_hash_size = TL_HASH_SIZE;
816
817 /*
818 * Debug and test variable ONLY. Turn off T_CONN_IND queueing
819 * for sockets.
820 */
821 static int tl_disable_early_connect = 0;
822 static int tl_client_closing_when_accepting;
823
824 static int tl_serializer_noswitch;
825
826 /*
827 * LOCAL FUNCTION PROTOTYPES
828 * -------------------------
829 */
830 static boolean_t tl_eqaddr(tl_addr_t *, tl_addr_t *);
831 static void tl_do_proto(mblk_t *, tl_endpt_t *);
832 static void tl_do_ioctl(mblk_t *, tl_endpt_t *);
833 static void tl_do_ioctl_ser(mblk_t *, tl_endpt_t *);
834 static void tl_error_ack(queue_t *, mblk_t *, t_scalar_t, t_scalar_t,
835 t_scalar_t);
836 static void tl_bind(mblk_t *, tl_endpt_t *);
837 static void tl_bind_ser(mblk_t *, tl_endpt_t *);
838 static void tl_ok_ack(queue_t *, mblk_t *mp, t_scalar_t);
839 static void tl_unbind(mblk_t *, tl_endpt_t *);
840 static void tl_optmgmt(queue_t *, mblk_t *);
841 static void tl_conn_req(queue_t *, mblk_t *);
842 static void tl_conn_req_ser(mblk_t *, tl_endpt_t *);
843 static void tl_conn_res(mblk_t *, tl_endpt_t *);
844 static void tl_discon_req(mblk_t *, tl_endpt_t *);
845 static void tl_capability_req(mblk_t *, tl_endpt_t *);
846 static void tl_info_req_ser(mblk_t *, tl_endpt_t *);
847 static void tl_addr_req_ser(mblk_t *, tl_endpt_t *);
848 static void tl_info_req(mblk_t *, tl_endpt_t *);
849 static void tl_addr_req(mblk_t *, tl_endpt_t *);
850 static void tl_connected_cots_addr_req(mblk_t *, tl_endpt_t *);
851 static void tl_data(mblk_t *, tl_endpt_t *);
852 static void tl_exdata(mblk_t *, tl_endpt_t *);
853 static void tl_ordrel(mblk_t *, tl_endpt_t *);
854 static void tl_unitdata(mblk_t *, tl_endpt_t *);
855 static void tl_unitdata_ser(mblk_t *, tl_endpt_t *);
856 static void tl_uderr(queue_t *, mblk_t *, t_scalar_t);
857 static tl_endpt_t *tl_find_peer(tl_endpt_t *, tl_addr_t *);
858 static tl_endpt_t *tl_sock_find_peer(tl_endpt_t *, struct so_ux_addr *);
859 static boolean_t tl_get_any_addr(tl_endpt_t *, tl_addr_t *);
860 static void tl_cl_backenable(tl_endpt_t *);
861 static void tl_co_unconnect(tl_endpt_t *);
862 static mblk_t *tl_resizemp(mblk_t *, ssize_t);
863 static void tl_discon_ind(tl_endpt_t *, uint32_t);
864 static mblk_t *tl_discon_ind_alloc(uint32_t, t_scalar_t);
865 static mblk_t *tl_ordrel_ind_alloc(void);
866 static tl_icon_t *tl_icon_find(tl_endpt_t *, t_scalar_t);
867 static void tl_icon_queuemsg(tl_endpt_t *, t_scalar_t, mblk_t *);
868 static boolean_t tl_icon_hasprim(tl_endpt_t *, t_scalar_t, t_scalar_t);
869 static void tl_icon_sendmsgs(tl_endpt_t *, mblk_t **);
870 static void tl_icon_freemsgs(mblk_t **);
871 static void tl_merror(queue_t *, mblk_t *, int);
872 static void tl_fill_option(uchar_t *, cred_t *, pid_t, int, cred_t *);
873 static int tl_default_opt(queue_t *, int, int, uchar_t *);
874 static int tl_get_opt(queue_t *, int, int, uchar_t *);
875 static int tl_set_opt(queue_t *, uint_t, int, int, uint_t, uchar_t *, uint_t *,
876 uchar_t *, void *, cred_t *);
877 static void tl_memrecover(queue_t *, mblk_t *, size_t);
878 static void tl_freetip(tl_endpt_t *, tl_icon_t *);
879 static void tl_free(tl_endpt_t *);
880 static int tl_constructor(void *, void *, int);
881 static void tl_destructor(void *, void *);
882 static void tl_find_callback(mod_hash_key_t, mod_hash_val_t);
883 static tl_serializer_t *tl_serializer_alloc(int);
884 static void tl_serializer_refhold(tl_serializer_t *);
885 static void tl_serializer_refrele(tl_serializer_t *);
886 static void tl_serializer_enter(tl_endpt_t *, tlproc_t, mblk_t *);
887 static void tl_serializer_exit(tl_endpt_t *);
888 static boolean_t tl_noclose(tl_endpt_t *);
889 static void tl_closeok(tl_endpt_t *);
890 static void tl_refhold(tl_endpt_t *);
891 static void tl_refrele(tl_endpt_t *);
892 static int tl_hash_cmp_addr(mod_hash_key_t, mod_hash_key_t);
893 static uint_t tl_hash_by_addr(void *, mod_hash_key_t);
894 static void tl_close_ser(mblk_t *, tl_endpt_t *);
895 static void tl_close_finish_ser(mblk_t *, tl_endpt_t *);
896 static void tl_wput_data_ser(mblk_t *, tl_endpt_t *);
897 static void tl_proto_ser(mblk_t *, tl_endpt_t *);
898 static void tl_putq_ser(mblk_t *, tl_endpt_t *);
899 static void tl_wput_common_ser(mblk_t *, tl_endpt_t *);
900 static void tl_wput_ser(mblk_t *, tl_endpt_t *);
901 static void tl_wsrv_ser(mblk_t *, tl_endpt_t *);
902 static void tl_rsrv_ser(mblk_t *, tl_endpt_t *);
903 static void tl_addr_unbind(tl_endpt_t *);
904
905 /*
906 * Intialize option database object for TL
907 */
908
909 optdb_obj_t tl_opt_obj = {
910 tl_default_opt, /* TL default value function pointer */
911 tl_get_opt, /* TL get function pointer */
912 tl_set_opt, /* TL set function pointer */
913 TL_OPT_ARR_CNT, /* TL option database count of entries */
914 tl_opt_arr, /* TL option database */
915 TL_VALID_LEVELS_CNT, /* TL valid level count of entries */
916 tl_valid_levels_arr /* TL valid level array */
917 };
918
919 /*
920 * LOCAL FUNCTIONS AND DRIVER ENTRY POINTS
921 * ---------------------------------------
922 */
923
924 /*
925 * Loadable module routines
926 */
927 int
928 _init(void)
929 {
930 return (mod_install(&modlinkage));
931 }
932
933 int
934 _fini(void)
935 {
936 return (mod_remove(&modlinkage));
937 }
938
939 int
940 _info(struct modinfo *modinfop)
941 {
942 return (mod_info(&modlinkage, modinfop));
943 }
944
945 /*
946 * Driver Entry Points and Other routines
947 */
948 static int
949 tl_attach(dev_info_t *devi, ddi_attach_cmd_t cmd)
950 {
951 int i;
952 char name[32];
953
954 /*
955 * Resume from a checkpoint state.
956 */
957 if (cmd == DDI_RESUME)
958 return (DDI_SUCCESS);
959
960 if (cmd != DDI_ATTACH)
961 return (DDI_FAILURE);
962
963 /*
964 * Deduce TIDU size to use. Note: "strmsgsz" being 0 has semantics that
965 * streams message sizes can be unlimited. We use a defined constant
966 * instead.
967 */
968 tl_tidusz = strmsgsz != 0 ? (t_scalar_t)strmsgsz : TL_TIDUSZ;
969
970 /*
971 * Create subdevices for each transport.
972 */
973 for (i = 0; i < TL_UNUSED; i++) {
974 if (ddi_create_minor_node(devi,
975 tl_transports[i].tr_name,
976 S_IFCHR, tl_transports[i].tr_minor,
977 DDI_PSEUDO, NULL) == DDI_FAILURE) {
978 ddi_remove_minor_node(devi, NULL);
979 return (DDI_FAILURE);
980 }
981 }
982
983 tl_cache = kmem_cache_create("tl_cache", sizeof (tl_endpt_t),
984 0, tl_constructor, tl_destructor, NULL, NULL, NULL, 0);
985
986 if (tl_cache == NULL) {
987 ddi_remove_minor_node(devi, NULL);
988 return (DDI_FAILURE);
989 }
990
991 tl_minors = id_space_create("tl_minor_space",
992 TL_MINOR_START, MAXMIN32 - TL_MINOR_START + 1);
993
994 /*
995 * Create ID space for minor numbers
996 */
997 for (i = 0; i < TL_MAXTRANSPORT; i++) {
998 tl_transport_state_t *t = &tl_transports[i];
999
1000 if (i == TL_UNUSED)
1001 continue;
1002
1003 /* Socket COTSORD shares namespace with COTS */
1004 if (i == TL_SOCK_COTSORD) {
1005 t->tr_ai_hash =
1006 tl_transports[TL_SOCK_COTS].tr_ai_hash;
1007 ASSERT(t->tr_ai_hash != NULL);
1008 t->tr_addr_hash =
1009 tl_transports[TL_SOCK_COTS].tr_addr_hash;
1010 ASSERT(t->tr_addr_hash != NULL);
1011 continue;
1012 }
1013
1014 /*
1015 * Create hash tables.
1016 */
1017 (void) snprintf(name, sizeof (name), "%s_ai_hash",
1018 t->tr_name);
1019 #ifdef _ILP32
1020 if (i & TL_SOCKET)
1021 t->tr_ai_hash =
1022 mod_hash_create_idhash(name, tl_hash_size - 1,
1023 mod_hash_null_valdtor);
1024 else
1025 t->tr_ai_hash =
1026 mod_hash_create_ptrhash(name, tl_hash_size,
1027 mod_hash_null_valdtor, sizeof (queue_t));
1028 #else
1029 t->tr_ai_hash =
1030 mod_hash_create_idhash(name, tl_hash_size - 1,
1031 mod_hash_null_valdtor);
1032 #endif /* _ILP32 */
1033
1034 if (i & TL_SOCKET) {
1035 (void) snprintf(name, sizeof (name), "%s_sockaddr_hash",
1036 t->tr_name);
1037 t->tr_addr_hash = mod_hash_create_ptrhash(name,
1038 tl_hash_size, mod_hash_null_valdtor,
1039 sizeof (uintptr_t));
1040 } else {
1041 (void) snprintf(name, sizeof (name), "%s_addr_hash",
1042 t->tr_name);
1043 t->tr_addr_hash = mod_hash_create_extended(name,
1044 tl_hash_size, mod_hash_null_keydtor,
1045 mod_hash_null_valdtor,
1046 tl_hash_by_addr, NULL, tl_hash_cmp_addr, KM_SLEEP);
1047 }
1048
1049 /* Create serializer for connectionless transports. */
1050 if (i & TL_TICLTS)
1051 t->tr_serializer = tl_serializer_alloc(KM_SLEEP);
1052 }
1053
1054 tl_dip = devi;
1055
1056 return (DDI_SUCCESS);
1057 }
1058
1059 static int
1060 tl_detach(dev_info_t *devi, ddi_detach_cmd_t cmd)
1061 {
1062 int i;
1063
1064 if (cmd == DDI_SUSPEND)
1065 return (DDI_SUCCESS);
1066
1067 if (cmd != DDI_DETACH)
1068 return (DDI_FAILURE);
1069
1070 /*
1071 * Destroy arenas and hash tables.
1072 */
1073 for (i = 0; i < TL_MAXTRANSPORT; i++) {
1074 tl_transport_state_t *t = &tl_transports[i];
1075
1076 if ((i == TL_UNUSED) || (i == TL_SOCK_COTSORD))
1077 continue;
1078
1079 EQUIV(i & TL_TICLTS, t->tr_serializer != NULL);
1080 if (t->tr_serializer != NULL) {
1081 tl_serializer_refrele(t->tr_serializer);
1082 t->tr_serializer = NULL;
1083 }
1084
1085 #ifdef _ILP32
1086 if (i & TL_SOCKET)
1087 mod_hash_destroy_idhash(t->tr_ai_hash);
1088 else
1089 mod_hash_destroy_ptrhash(t->tr_ai_hash);
1090 #else
1091 mod_hash_destroy_idhash(t->tr_ai_hash);
1092 #endif /* _ILP32 */
1093 t->tr_ai_hash = NULL;
1094 if (i & TL_SOCKET)
1095 mod_hash_destroy_ptrhash(t->tr_addr_hash);
1096 else
1097 mod_hash_destroy_hash(t->tr_addr_hash);
1098 t->tr_addr_hash = NULL;
1099 }
1100
1101 kmem_cache_destroy(tl_cache);
1102 tl_cache = NULL;
1103 id_space_destroy(tl_minors);
1104 tl_minors = NULL;
1105 ddi_remove_minor_node(devi, NULL);
1106 return (DDI_SUCCESS);
1107 }
1108
1109 /* ARGSUSED */
1110 static int
1111 tl_info(dev_info_t *dip, ddi_info_cmd_t infocmd, void *arg, void **result)
1112 {
1113
1114 int retcode = DDI_FAILURE;
1115
1116 switch (infocmd) {
1117
1118 case DDI_INFO_DEVT2DEVINFO:
1119 if (tl_dip != NULL) {
1120 *result = (void *)tl_dip;
1121 retcode = DDI_SUCCESS;
1122 }
1123 break;
1124
1125 case DDI_INFO_DEVT2INSTANCE:
1126 *result = (void *)0;
1127 retcode = DDI_SUCCESS;
1128 break;
1129
1130 default:
1131 break;
1132 }
1133 return (retcode);
1134 }
1135
1136 /*
1137 * Endpoint reference management.
1138 */
1139 static void
1140 tl_refhold(tl_endpt_t *tep)
1141 {
1142 atomic_inc_32(&tep->te_refcnt);
1143 }
1144
1145 static void
1146 tl_refrele(tl_endpt_t *tep)
1147 {
1148 ASSERT(tep->te_refcnt != 0);
1149
1150 if (atomic_dec_32_nv(&tep->te_refcnt) == 0)
1151 tl_free(tep);
1152 }
1153
1154 /*ARGSUSED*/
1155 static int
1156 tl_constructor(void *buf, void *cdrarg, int kmflags)
1157 {
1158 tl_endpt_t *tep = buf;
1159
1160 bzero(tep, sizeof (tl_endpt_t));
1161 mutex_init(&tep->te_closelock, NULL, MUTEX_DEFAULT, NULL);
1162 cv_init(&tep->te_closecv, NULL, CV_DEFAULT, NULL);
1163 mutex_init(&tep->te_srv_lock, NULL, MUTEX_DEFAULT, NULL);
1164 cv_init(&tep->te_srv_cv, NULL, CV_DEFAULT, NULL);
1165 mutex_init(&tep->te_ser_lock, NULL, MUTEX_DEFAULT, NULL);
1166
1167 return (0);
1168 }
1169
1170 /*ARGSUSED*/
1171 static void
1172 tl_destructor(void *buf, void *cdrarg)
1173 {
1174 tl_endpt_t *tep = buf;
1175
1176 mutex_destroy(&tep->te_closelock);
1177 cv_destroy(&tep->te_closecv);
1178 mutex_destroy(&tep->te_srv_lock);
1179 cv_destroy(&tep->te_srv_cv);
1180 mutex_destroy(&tep->te_ser_lock);
1181 }
1182
1183 static void
1184 tl_free(tl_endpt_t *tep)
1185 {
1186 ASSERT(tep->te_refcnt == 0);
1187 ASSERT(tep->te_transport != NULL);
1188 ASSERT(tep->te_rq == NULL);
1189 ASSERT(tep->te_wq == NULL);
1190 ASSERT(tep->te_ser != NULL);
1191 ASSERT(tep->te_ser_count == 0);
1192 ASSERT(! (tep->te_flag & TL_ADDRHASHED));
1193
1194 if (IS_SOCKET(tep)) {
1195 ASSERT(tep->te_alen == TL_SOUX_ADDRLEN);
1196 ASSERT(tep->te_abuf == &tep->te_uxaddr);
1197 ASSERT(tep->te_vp == (void *)(uintptr_t)tep->te_minor);
1198 ASSERT(tep->te_magic == SOU_MAGIC_IMPLICIT);
1199 } else if (tep->te_abuf != NULL) {
1200 kmem_free(tep->te_abuf, tep->te_alen);
1201 tep->te_alen = -1; /* uninitialized */
1202 tep->te_abuf = NULL;
1203 } else {
1204 ASSERT(tep->te_alen == -1);
1205 }
1206
1207 id_free(tl_minors, tep->te_minor);
1208 ASSERT(tep->te_credp == NULL);
1209
1210 if (tep->te_hash_hndl != NULL)
1211 mod_hash_cancel(tep->te_addrhash, &tep->te_hash_hndl);
1212
1213 if (IS_COTS(tep)) {
1214 TL_REMOVE_PEER(tep->te_conp);
1215 TL_REMOVE_PEER(tep->te_oconp);
1216 tl_serializer_refrele(tep->te_ser);
1217 tep->te_ser = NULL;
1218 ASSERT(tep->te_nicon == 0);
1219 ASSERT(list_head(&tep->te_iconp) == NULL);
1220 } else {
1221 ASSERT(tep->te_lastep == NULL);
1222 ASSERT(list_head(&tep->te_flowlist) == NULL);
1223 ASSERT(tep->te_flowq == NULL);
1224 }
1225
1226 ASSERT(tep->te_bufcid == 0);
1227 ASSERT(tep->te_timoutid == 0);
1228 bzero(&tep->te_ap, sizeof (tep->te_ap));
1229 tep->te_acceptor_id = 0;
1230
1231 ASSERT(tep->te_closewait == 0);
1232 ASSERT(!tep->te_rsrv_active);
1233 ASSERT(!tep->te_wsrv_active);
1234 tep->te_closing = 0;
1235 tep->te_nowsrv = B_FALSE;
1236 tep->te_flag = 0;
1237
1238 kmem_cache_free(tl_cache, tep);
1239 }
1240
1241 /*
1242 * Allocate/free reference-counted wrappers for serializers.
1243 */
1244 static tl_serializer_t *
1245 tl_serializer_alloc(int flags)
1246 {
1247 tl_serializer_t *s = kmem_alloc(sizeof (tl_serializer_t), flags);
1248 serializer_t *ser;
1249
1250 if (s == NULL)
1251 return (NULL);
1252
1253 ser = serializer_create(flags);
1254
1255 if (ser == NULL) {
1256 kmem_free(s, sizeof (tl_serializer_t));
1257 return (NULL);
1258 }
1259
1260 s->ts_refcnt = 1;
1261 s->ts_serializer = ser;
1262 return (s);
1263 }
1264
1265 static void
1266 tl_serializer_refhold(tl_serializer_t *s)
1267 {
1268 atomic_inc_32(&s->ts_refcnt);
1269 }
1270
1271 static void
1272 tl_serializer_refrele(tl_serializer_t *s)
1273 {
1274 if (atomic_dec_32_nv(&s->ts_refcnt) == 0) {
1275 serializer_destroy(s->ts_serializer);
1276 kmem_free(s, sizeof (tl_serializer_t));
1277 }
1278 }
1279
1280 /*
1281 * Post a request on the endpoint serializer. For COTS transports keep track of
1282 * the number of pending requests.
1283 */
1284 static void
1285 tl_serializer_enter(tl_endpt_t *tep, tlproc_t tlproc, mblk_t *mp)
1286 {
1287 if (IS_COTS(tep)) {
1288 mutex_enter(&tep->te_ser_lock);
1289 tep->te_ser_count++;
1290 mutex_exit(&tep->te_ser_lock);
1291 }
1292 serializer_enter(tep->te_serializer, (srproc_t *)tlproc, mp, tep);
1293 }
1294
1295 /*
1296 * Complete processing the request on the serializer. Decrement the counter for
1297 * pending requests for COTS transports.
1298 */
1299 static void
1300 tl_serializer_exit(tl_endpt_t *tep)
1301 {
1302 if (IS_COTS(tep)) {
1303 mutex_enter(&tep->te_ser_lock);
1304 ASSERT(tep->te_ser_count != 0);
1305 tep->te_ser_count--;
1306 mutex_exit(&tep->te_ser_lock);
1307 }
1308 }
1309
1310 /*
1311 * Hash management functions.
1312 */
1313
1314 /*
1315 * Return TRUE if two addresses are equal, false otherwise.
1316 */
1317 static boolean_t
1318 tl_eqaddr(tl_addr_t *ap1, tl_addr_t *ap2)
1319 {
1320 return ((ap1->ta_alen > 0) &&
1321 (ap1->ta_alen == ap2->ta_alen) &&
1322 (ap1->ta_zoneid == ap2->ta_zoneid) &&
1323 (bcmp(ap1->ta_abuf, ap2->ta_abuf, ap1->ta_alen) == 0));
1324 }
1325
1326 /*
1327 * This function is called whenever an endpoint is found in the hash table.
1328 */
1329 /* ARGSUSED0 */
1330 static void
1331 tl_find_callback(mod_hash_key_t key, mod_hash_val_t val)
1332 {
1333 tl_refhold((tl_endpt_t *)val);
1334 }
1335
1336 /*
1337 * Address hash function.
1338 */
1339 /* ARGSUSED */
1340 static uint_t
1341 tl_hash_by_addr(void *hash_data, mod_hash_key_t key)
1342 {
1343 tl_addr_t *ap = (tl_addr_t *)key;
1344 size_t len = ap->ta_alen;
1345 uchar_t *p = ap->ta_abuf;
1346 uint_t i, g;
1347
1348 ASSERT((len > 0) && (p != NULL));
1349
1350 for (i = ap->ta_zoneid; len -- != 0; p++) {
1351 i = (i << 4) + (*p);
1352 if ((g = (i & 0xf0000000U)) != 0) {
1353 i ^= (g >> 24);
1354 i ^= g;
1355 }
1356 }
1357 return (i);
1358 }
1359
1360 /*
1361 * This function is used by hash lookups. It compares two generic addresses.
1362 */
1363 static int
1364 tl_hash_cmp_addr(mod_hash_key_t key1, mod_hash_key_t key2)
1365 {
1366 #ifdef DEBUG
1367 tl_addr_t *ap1 = (tl_addr_t *)key1;
1368 tl_addr_t *ap2 = (tl_addr_t *)key2;
1369
1370 ASSERT(key1 != NULL);
1371 ASSERT(key2 != NULL);
1372
1373 ASSERT(ap1->ta_abuf != NULL);
1374 ASSERT(ap2->ta_abuf != NULL);
1375 ASSERT(ap1->ta_alen > 0);
1376 ASSERT(ap2->ta_alen > 0);
1377 #endif
1378
1379 return (! tl_eqaddr((tl_addr_t *)key1, (tl_addr_t *)key2));
1380 }
1381
1382 /*
1383 * Prevent endpoint from closing if possible.
1384 * Return B_TRUE on success, B_FALSE on failure.
1385 */
1386 static boolean_t
1387 tl_noclose(tl_endpt_t *tep)
1388 {
1389 boolean_t rc = B_FALSE;
1390
1391 mutex_enter(&tep->te_closelock);
1392 if (! tep->te_closing) {
1393 ASSERT(tep->te_closewait == 0);
1394 tep->te_closewait++;
1395 rc = B_TRUE;
1396 }
1397 mutex_exit(&tep->te_closelock);
1398 return (rc);
1399 }
1400
1401 /*
1402 * Allow endpoint to close if needed.
1403 */
1404 static void
1405 tl_closeok(tl_endpt_t *tep)
1406 {
1407 ASSERT(tep->te_closewait > 0);
1408 mutex_enter(&tep->te_closelock);
1409 ASSERT(tep->te_closewait == 1);
1410 tep->te_closewait--;
1411 cv_signal(&tep->te_closecv);
1412 mutex_exit(&tep->te_closelock);
1413 }
1414
1415 /*
1416 * STREAMS open entry point.
1417 */
1418 /* ARGSUSED */
1419 static int
1420 tl_open(queue_t *rq, dev_t *devp, int oflag, int sflag, cred_t *credp)
1421 {
1422 tl_endpt_t *tep;
1423 minor_t minor = getminor(*devp);
1424
1425 /*
1426 * Driver is called directly. Both CLONEOPEN and MODOPEN
1427 * are illegal
1428 */
1429 if ((sflag == CLONEOPEN) || (sflag == MODOPEN))
1430 return (ENXIO);
1431
1432 if (rq->q_ptr != NULL)
1433 return (0);
1434
1435 /* Minor number should specify the mode used for the driver. */
1436 if ((minor >= TL_UNUSED))
1437 return (ENXIO);
1438
1439 if (oflag & SO_SOCKSTR) {
1440 minor |= TL_SOCKET;
1441 }
1442
1443 tep = kmem_cache_alloc(tl_cache, KM_SLEEP);
1444 tep->te_refcnt = 1;
1445 tep->te_cpid = curproc->p_pid;
1446 rq->q_ptr = WR(rq)->q_ptr = tep;
1447 tep->te_state = TS_UNBND;
1448 tep->te_credp = credp;
1449 crhold(credp);
1450 tep->te_zoneid = getzoneid();
1451
1452 tep->te_flag = minor & TL_MINOR_MASK;
1453 tep->te_transport = &tl_transports[minor];
1454
1455 /* Allocate a unique minor number for this instance. */
1456 tep->te_minor = (minor_t)id_alloc(tl_minors);
1457
1458 /* Reserve hash handle for bind(). */
1459 (void) mod_hash_reserve(tep->te_addrhash, &tep->te_hash_hndl);
1460
1461 /* Transport-specific initialization */
1462 if (IS_COTS(tep)) {
1463 /* Use private serializer */
1464 tep->te_ser = tl_serializer_alloc(KM_SLEEP);
1465
1466 /* Create list for pending connections */
1467 list_create(&tep->te_iconp, sizeof (tl_icon_t),
1468 offsetof(tl_icon_t, ti_node));
1469 tep->te_qlen = 0;
1470 tep->te_nicon = 0;
1471 tep->te_oconp = NULL;
1472 tep->te_conp = NULL;
1473 } else {
1474 /* Use shared serializer */
1475 tep->te_ser = tep->te_transport->tr_serializer;
1476 bzero(&tep->te_flows, sizeof (list_node_t));
1477 /* Create list for flow control */
1478 list_create(&tep->te_flowlist, sizeof (tl_endpt_t),
1479 offsetof(tl_endpt_t, te_flows));
1480 tep->te_flowq = NULL;
1481 tep->te_lastep = NULL;
1482
1483 }
1484
1485 /* Initialize endpoint address */
1486 if (IS_SOCKET(tep)) {
1487 /* Socket-specific address handling. */
1488 tep->te_alen = TL_SOUX_ADDRLEN;
1489 tep->te_abuf = &tep->te_uxaddr;
1490 tep->te_vp = (void *)(uintptr_t)tep->te_minor;
1491 tep->te_magic = SOU_MAGIC_IMPLICIT;
1492 } else {
1493 tep->te_alen = -1;
1494 tep->te_abuf = NULL;
1495 }
1496
1497 /* clone the driver */
1498 *devp = makedevice(getmajor(*devp), tep->te_minor);
1499
1500 tep->te_rq = rq;
1501 tep->te_wq = WR(rq);
1502
1503 #ifdef _ILP32
1504 if (IS_SOCKET(tep))
1505 tep->te_acceptor_id = tep->te_minor;
1506 else
1507 tep->te_acceptor_id = (t_uscalar_t)rq;
1508 #else
1509 tep->te_acceptor_id = tep->te_minor;
1510 #endif /* _ILP32 */
1511
1512
1513 qprocson(rq);
1514
1515 /*
1516 * Insert acceptor ID in the hash. The AI hash always sleeps on
1517 * insertion so insertion can't fail.
1518 */
1519 (void) mod_hash_insert(tep->te_transport->tr_ai_hash,
1520 (mod_hash_key_t)(uintptr_t)tep->te_acceptor_id,
1521 (mod_hash_val_t)tep);
1522
1523 return (0);
1524 }
1525
1526 /* ARGSUSED1 */
1527 static int
1528 tl_close(queue_t *rq, int flag, cred_t *credp)
1529 {
1530 tl_endpt_t *tep = (tl_endpt_t *)rq->q_ptr;
1531 tl_endpt_t *elp = NULL;
1532 queue_t *wq = tep->te_wq;
1533 int rc;
1534
1535 ASSERT(wq == WR(rq));
1536
1537 /*
1538 * Remove the endpoint from acceptor hash.
1539 */
1540 rc = mod_hash_remove(tep->te_transport->tr_ai_hash,
1541 (mod_hash_key_t)(uintptr_t)tep->te_acceptor_id,
1542 (mod_hash_val_t *)&elp);
1543 ASSERT(rc == 0 && tep == elp);
1544 if ((rc != 0) || (tep != elp)) {
1545 (void) (STRLOG(TL_ID, tep->te_minor, 1,
1546 SL_TRACE|SL_ERROR,
1547 "tl_close:inconsistency in AI hash"));
1548 }
1549
1550 /*
1551 * Wait till close is safe, then mark endpoint as closing.
1552 */
1553 mutex_enter(&tep->te_closelock);
1554 while (tep->te_closewait)
1555 cv_wait(&tep->te_closecv, &tep->te_closelock);
1556 tep->te_closing = B_TRUE;
1557 /*
1558 * Will wait for the serializer part of the close to finish, so set
1559 * te_closewait now.
1560 */
1561 tep->te_closewait = 1;
1562 tep->te_nowsrv = B_FALSE;
1563 mutex_exit(&tep->te_closelock);
1564
1565 /*
1566 * tl_close_ser doesn't drop reference, so no need to tl_refhold.
1567 * It is safe because close will wait for tl_close_ser to finish.
1568 */
1569 tl_serializer_enter(tep, tl_close_ser, &tep->te_closemp);
1570
1571 /*
1572 * Wait for the first phase of close to complete before qprocsoff().
1573 */
1574 mutex_enter(&tep->te_closelock);
1575 while (tep->te_closewait)
1576 cv_wait(&tep->te_closecv, &tep->te_closelock);
1577 mutex_exit(&tep->te_closelock);
1578
1579 qprocsoff(rq);
1580
1581 if (tep->te_bufcid) {
1582 qunbufcall(rq, tep->te_bufcid);
1583 tep->te_bufcid = 0;
1584 }
1585 if (tep->te_timoutid) {
1586 (void) quntimeout(rq, tep->te_timoutid);
1587 tep->te_timoutid = 0;
1588 }
1589
1590 /*
1591 * Finish close behind serializer.
1592 *
1593 * For a CLTS endpoint increase a refcount and continue close processing
1594 * with serializer protection. This processing may happen asynchronously
1595 * with the completion of tl_close().
1596 *
1597 * Fot a COTS endpoint wait before destroying tep since the serializer
1598 * may go away together with tep and we need to destroy serializer
1599 * outside of serializer context.
1600 */
1601 ASSERT(tep->te_closewait == 0);
1602 if (IS_COTS(tep))
1603 tep->te_closewait = 1;
1604 else
1605 tl_refhold(tep);
1606
1607 tl_serializer_enter(tep, tl_close_finish_ser, &tep->te_closemp);
1608
1609 /*
1610 * For connection-oriented transports wait for all serializer activity
1611 * to settle down.
1612 */
1613 if (IS_COTS(tep)) {
1614 mutex_enter(&tep->te_closelock);
1615 while (tep->te_closewait)
1616 cv_wait(&tep->te_closecv, &tep->te_closelock);
1617 mutex_exit(&tep->te_closelock);
1618 }
1619
1620 crfree(tep->te_credp);
1621 tep->te_credp = NULL;
1622 tep->te_wq = NULL;
1623 tl_refrele(tep);
1624 /*
1625 * tep is likely to be destroyed now, so can't reference it any more.
1626 */
1627
1628 rq->q_ptr = wq->q_ptr = NULL;
1629 return (0);
1630 }
1631
1632 /*
1633 * First phase of close processing done behind the serializer.
1634 *
1635 * Do not drop the reference in the end - tl_close() wants this reference to
1636 * stay.
1637 */
1638 /* ARGSUSED0 */
1639 static void
1640 tl_close_ser(mblk_t *mp, tl_endpt_t *tep)
1641 {
1642 ASSERT(tep->te_closing);
1643 ASSERT(tep->te_closewait == 1);
1644 ASSERT(!(tep->te_flag & TL_CLOSE_SER));
1645
1646 tep->te_flag |= TL_CLOSE_SER;
1647
1648 /*
1649 * Drain out all messages on queue except for TL_TICOTS where the
1650 * abortive release semantics permit discarding of data on close
1651 */
1652 if (tep->te_wq->q_first && (IS_CLTS(tep) || IS_COTSORD(tep))) {
1653 tl_wsrv_ser(NULL, tep);
1654 }
1655
1656 /* Remove address from hash table. */
1657 tl_addr_unbind(tep);
1658 /*
1659 * qprocsoff() gets confused when q->q_next is not NULL on the write
1660 * queue of the driver, so clear these before qprocsoff() is called.
1661 * Also clear q_next for the peer since this queue is going away.
1662 */
1663 if (IS_COTS(tep) && !IS_SOCKET(tep)) {
1664 tl_endpt_t *peer_tep = tep->te_conp;
1665
1666 tep->te_wq->q_next = NULL;
1667 if ((peer_tep != NULL) && !peer_tep->te_closing)
1668 peer_tep->te_wq->q_next = NULL;
1669 }
1670
1671 tep->te_rq = NULL;
1672
1673 /* wake up tl_close() */
1674 tl_closeok(tep);
1675 tl_serializer_exit(tep);
1676 }
1677
1678 /*
1679 * Second phase of tl_close(). Should wakeup tl_close() for COTS mode and drop
1680 * the reference for CLTS.
1681 *
1682 * Called from serializer. Should drop reference count for CLTS only.
1683 */
1684 /* ARGSUSED0 */
1685 static void
1686 tl_close_finish_ser(mblk_t *mp, tl_endpt_t *tep)
1687 {
1688 ASSERT(tep->te_closing);
1689 IMPLY(IS_CLTS(tep), tep->te_closewait == 0);
1690 IMPLY(IS_COTS(tep), tep->te_closewait == 1);
1691
1692 tep->te_state = -1; /* Uninitialized */
1693 if (IS_COTS(tep)) {
1694 tl_co_unconnect(tep);
1695 } else {
1696 /* Connectionless specific cleanup */
1697 TL_REMOVE_PEER(tep->te_lastep);
1698 /*
1699 * Backenable anybody that is flow controlled waiting for
1700 * this endpoint.
1701 */
1702 tl_cl_backenable(tep);
1703 if (tep->te_flowq != NULL) {
1704 list_remove(&(tep->te_flowq->te_flowlist), tep);
1705 tep->te_flowq = NULL;
1706 }
1707 }
1708
1709 tl_serializer_exit(tep);
1710 if (IS_COTS(tep))
1711 tl_closeok(tep);
1712 else
1713 tl_refrele(tep);
1714 }
1715
1716 /*
1717 * STREAMS write-side put procedure.
1718 * Enter serializer for most of the processing.
1719 *
1720 * The T_CONN_REQ is processed outside of serializer.
1721 */
1722 static void
1723 tl_wput(queue_t *wq, mblk_t *mp)
1724 {
1725 tl_endpt_t *tep = (tl_endpt_t *)wq->q_ptr;
1726 ssize_t msz = MBLKL(mp);
1727 union T_primitives *prim = (union T_primitives *)mp->b_rptr;
1728 tlproc_t *tl_proc = NULL;
1729
1730 switch (DB_TYPE(mp)) {
1731 case M_DATA:
1732 /* Only valid for connection-oriented transports */
1733 if (IS_CLTS(tep)) {
1734 (void) (STRLOG(TL_ID, tep->te_minor, 1,
1735 SL_TRACE|SL_ERROR,
1736 "tl_wput:M_DATA invalid for ticlts driver"));
1737 tl_merror(wq, mp, EPROTO);
1738 return;
1739 }
1740 tl_proc = tl_wput_data_ser;
1741 break;
1742
1743 case M_IOCTL:
1744 switch (((struct iocblk *)mp->b_rptr)->ioc_cmd) {
1745 case TL_IOC_CREDOPT:
1746 /* FALLTHROUGH */
1747 case TL_IOC_UCREDOPT:
1748 /*
1749 * Serialize endpoint state change.
1750 */
1751 tl_proc = tl_do_ioctl_ser;
1752 break;
1753
1754 default:
1755 miocnak(wq, mp, 0, EINVAL);
1756 return;
1757 }
1758 break;
1759
1760 case M_FLUSH:
1761 /*
1762 * do canonical M_FLUSH processing
1763 */
1764 if (*mp->b_rptr & FLUSHW) {
1765 flushq(wq, FLUSHALL);
1766 *mp->b_rptr &= ~FLUSHW;
1767 }
1768 if (*mp->b_rptr & FLUSHR) {
1769 flushq(RD(wq), FLUSHALL);
1770 qreply(wq, mp);
1771 } else {
1772 freemsg(mp);
1773 }
1774 return;
1775
1776 case M_PROTO:
1777 if (msz < sizeof (prim->type)) {
1778 (void) (STRLOG(TL_ID, tep->te_minor, 1,
1779 SL_TRACE|SL_ERROR,
1780 "tl_wput:M_PROTO data too short"));
1781 tl_merror(wq, mp, EPROTO);
1782 return;
1783 }
1784 switch (prim->type) {
1785 case T_OPTMGMT_REQ:
1786 case T_SVR4_OPTMGMT_REQ:
1787 /*
1788 * Process TPI option management requests immediately
1789 * in put procedure regardless of in-order processing
1790 * of already queued messages.
1791 * (Note: This driver supports AF_UNIX socket
1792 * implementation. Unless we implement this processing,
1793 * setsockopt() on socket endpoint will block on flow
1794 * controlled endpoints which it should not. That is
1795 * required for successful execution of VSU socket tests
1796 * and is consistent with BSD socket behavior).
1797 */
1798 tl_optmgmt(wq, mp);
1799 return;
1800 case O_T_BIND_REQ:
1801 case T_BIND_REQ:
1802 tl_proc = tl_bind_ser;
1803 break;
1804 case T_CONN_REQ:
1805 if (IS_CLTS(tep)) {
1806 tl_merror(wq, mp, EPROTO);
1807 return;
1808 }
1809 tl_conn_req(wq, mp);
1810 return;
1811 case T_DATA_REQ:
1812 case T_OPTDATA_REQ:
1813 case T_EXDATA_REQ:
1814 case T_ORDREL_REQ:
1815 tl_proc = tl_putq_ser;
1816 break;
1817 case T_UNITDATA_REQ:
1818 if (IS_COTS(tep) ||
1819 (msz < sizeof (struct T_unitdata_req))) {
1820 tl_merror(wq, mp, EPROTO);
1821 return;
1822 }
1823 if ((tep->te_state == TS_IDLE) && !wq->q_first) {
1824 tl_proc = tl_unitdata_ser;
1825 } else {
1826 tl_proc = tl_putq_ser;
1827 }
1828 break;
1829 default:
1830 /*
1831 * process in service procedure if message already
1832 * queued (maintain in-order processing)
1833 */
1834 if (wq->q_first != NULL) {
1835 tl_proc = tl_putq_ser;
1836 } else {
1837 tl_proc = tl_wput_ser;
1838 }
1839 break;
1840 }
1841 break;
1842
1843 case M_PCPROTO:
1844 /*
1845 * Check that the message has enough data to figure out TPI
1846 * primitive.
1847 */
1848 if (msz < sizeof (prim->type)) {
1849 (void) (STRLOG(TL_ID, tep->te_minor, 1,
1850 SL_TRACE|SL_ERROR,
1851 "tl_wput:M_PCROTO data too short"));
1852 tl_merror(wq, mp, EPROTO);
1853 return;
1854 }
1855 switch (prim->type) {
1856 case T_CAPABILITY_REQ:
1857 tl_capability_req(mp, tep);
1858 return;
1859 case T_INFO_REQ:
1860 tl_proc = tl_info_req_ser;
1861 break;
1862 case T_ADDR_REQ:
1863 tl_proc = tl_addr_req_ser;
1864 break;
1865
1866 default:
1867 (void) (STRLOG(TL_ID, tep->te_minor, 1,
1868 SL_TRACE|SL_ERROR,
1869 "tl_wput:unknown TPI msg primitive"));
1870 tl_merror(wq, mp, EPROTO);
1871 return;
1872 }
1873 break;
1874 default:
1875 (void) (STRLOG(TL_ID, tep->te_minor, 1, SL_TRACE|SL_ERROR,
1876 "tl_wput:default:unexpected Streams message"));
1877 freemsg(mp);
1878 return;
1879 }
1880
1881 /*
1882 * Continue processing via serializer.
1883 */
1884 ASSERT(tl_proc != NULL);
1885 tl_refhold(tep);
1886 tl_serializer_enter(tep, tl_proc, mp);
1887 }
1888
1889 /*
1890 * Place message on the queue while preserving order.
1891 */
1892 static void
1893 tl_putq_ser(mblk_t *mp, tl_endpt_t *tep)
1894 {
1895 if (tep->te_closing) {
1896 tl_wput_ser(mp, tep);
1897 } else {
1898 TL_PUTQ(tep, mp);
1899 tl_serializer_exit(tep);
1900 tl_refrele(tep);
1901 }
1902
1903 }
1904
1905 static void
1906 tl_wput_common_ser(mblk_t *mp, tl_endpt_t *tep)
1907 {
1908 ASSERT((DB_TYPE(mp) == M_DATA) || (DB_TYPE(mp) == M_PROTO));
1909
1910 switch (DB_TYPE(mp)) {
1911 case M_DATA:
1912 tl_data(mp, tep);
1913 break;
1914 case M_PROTO:
1915 tl_do_proto(mp, tep);
1916 break;
1917 default:
1918 freemsg(mp);
1919 break;
1920 }
1921 }
1922
1923 /*
1924 * Write side put procedure called from serializer.
1925 */
1926 static void
1927 tl_wput_ser(mblk_t *mp, tl_endpt_t *tep)
1928 {
1929 tl_wput_common_ser(mp, tep);
1930 tl_serializer_exit(tep);
1931 tl_refrele(tep);
1932 }
1933
1934 /*
1935 * M_DATA processing. Called from serializer.
1936 */
1937 static void
1938 tl_wput_data_ser(mblk_t *mp, tl_endpt_t *tep)
1939 {
1940 tl_endpt_t *peer_tep = tep->te_conp;
1941 queue_t *peer_rq;
1942
1943 ASSERT(DB_TYPE(mp) == M_DATA);
1944 ASSERT(IS_COTS(tep));
1945
1946 IMPLY(peer_tep, tep->te_serializer == peer_tep->te_serializer);
1947
1948 /*
1949 * fastpath for data. Ignore flow control if tep is closing.
1950 */
1951 if ((peer_tep != NULL) &&
1952 !peer_tep->te_closing &&
1953 ((tep->te_state == TS_DATA_XFER) ||
1954 (tep->te_state == TS_WREQ_ORDREL)) &&
1955 (tep->te_wq != NULL) &&
1956 (tep->te_wq->q_first == NULL) &&
1957 ((peer_tep->te_state == TS_DATA_XFER) ||
1958 (peer_tep->te_state == TS_WREQ_ORDREL)) &&
1959 ((peer_rq = peer_tep->te_rq) != NULL) &&
1960 (canputnext(peer_rq) || tep->te_closing)) {
1961 putnext(peer_rq, mp);
1962 } else if (tep->te_closing) {
1963 /*
1964 * It is possible that by the time we got here tep started to
1965 * close. If the write queue is not empty, and the state is
1966 * TS_DATA_XFER the data should be delivered in order, so we
1967 * call putq() instead of freeing the data.
1968 */
1969 if ((tep->te_wq != NULL) &&
1970 ((tep->te_state == TS_DATA_XFER) ||
1971 (tep->te_state == TS_WREQ_ORDREL))) {
1972 TL_PUTQ(tep, mp);
1973 } else {
1974 freemsg(mp);
1975 }
1976 } else {
1977 TL_PUTQ(tep, mp);
1978 }
1979
1980 tl_serializer_exit(tep);
1981 tl_refrele(tep);
1982 }
1983
1984 /*
1985 * Write side service routine.
1986 *
1987 * All actual processing happens within serializer which is entered
1988 * synchronously. It is possible that by the time tl_wsrv() wakes up, some new
1989 * messages that need processing may have arrived, so tl_wsrv repeats until
1990 * queue is empty or te_nowsrv is set.
1991 */
1992 static void
1993 tl_wsrv(queue_t *wq)
1994 {
1995 tl_endpt_t *tep = (tl_endpt_t *)wq->q_ptr;
1996
1997 while ((wq->q_first != NULL) && !tep->te_nowsrv) {
1998 mutex_enter(&tep->te_srv_lock);
1999 ASSERT(tep->te_wsrv_active == B_FALSE);
2000 tep->te_wsrv_active = B_TRUE;
2001 mutex_exit(&tep->te_srv_lock);
2002
2003 tl_serializer_enter(tep, tl_wsrv_ser, &tep->te_wsrvmp);
2004
2005 /*
2006 * Wait for serializer job to complete.
2007 */
2008 mutex_enter(&tep->te_srv_lock);
2009 while (tep->te_wsrv_active) {
2010 cv_wait(&tep->te_srv_cv, &tep->te_srv_lock);
2011 }
2012 cv_signal(&tep->te_srv_cv);
2013 mutex_exit(&tep->te_srv_lock);
2014 }
2015 }
2016
2017 /*
2018 * Serialized write side processing of the STREAMS queue.
2019 * May be called either from tl_wsrv() or from tl_close() in which case ser_mp
2020 * is NULL.
2021 */
2022 static void
2023 tl_wsrv_ser(mblk_t *ser_mp, tl_endpt_t *tep)
2024 {
2025 mblk_t *mp;
2026 queue_t *wq = tep->te_wq;
2027
2028 ASSERT(wq != NULL);
2029 while (!tep->te_nowsrv && (mp = getq(wq)) != NULL) {
2030 tl_wput_common_ser(mp, tep);
2031 }
2032
2033 /*
2034 * Wakeup service routine unless called from close.
2035 * If ser_mp is specified, the caller is tl_wsrv().
2036 * Otherwise, the caller is tl_close_ser(). Since tl_close_ser() doesn't
2037 * call tl_serializer_enter() before calling tl_wsrv_ser(), there should
2038 * be no matching tl_serializer_exit() in this case.
2039 * Also, there is no need to wakeup anyone since tl_close_ser() is not
2040 * waiting on te_srv_cv.
2041 */
2042 if (ser_mp != NULL) {
2043 /*
2044 * We are called from tl_wsrv.
2045 */
2046 mutex_enter(&tep->te_srv_lock);
2047 ASSERT(tep->te_wsrv_active);
2048 tep->te_wsrv_active = B_FALSE;
2049 cv_signal(&tep->te_srv_cv);
2050 mutex_exit(&tep->te_srv_lock);
2051 tl_serializer_exit(tep);
2052 }
2053 }
2054
2055 /*
2056 * Called when the stream is backenabled. Enter serializer and qenable everyone
2057 * flow controlled by tep.
2058 *
2059 * NOTE: The service routine should enter serializer synchronously. Otherwise it
2060 * is possible that two instances of tl_rsrv will be running reusing the same
2061 * rsrv mblk.
2062 */
2063 static void
2064 tl_rsrv(queue_t *rq)
2065 {
2066 tl_endpt_t *tep = (tl_endpt_t *)rq->q_ptr;
2067
2068 ASSERT(rq->q_first == NULL);
2069 ASSERT(tep->te_rsrv_active == 0);
2070
2071 tep->te_rsrv_active = B_TRUE;
2072 tl_serializer_enter(tep, tl_rsrv_ser, &tep->te_rsrvmp);
2073 /*
2074 * Wait for serializer job to complete.
2075 */
2076 mutex_enter(&tep->te_srv_lock);
2077 while (tep->te_rsrv_active) {
2078 cv_wait(&tep->te_srv_cv, &tep->te_srv_lock);
2079 }
2080 cv_signal(&tep->te_srv_cv);
2081 mutex_exit(&tep->te_srv_lock);
2082 }
2083
2084 /* ARGSUSED */
2085 static void
2086 tl_rsrv_ser(mblk_t *mp, tl_endpt_t *tep)
2087 {
2088 tl_endpt_t *peer_tep;
2089
2090 if (IS_CLTS(tep) && tep->te_state == TS_IDLE) {
2091 tl_cl_backenable(tep);
2092 } else if (
2093 IS_COTS(tep) &&
2094 ((peer_tep = tep->te_conp) != NULL) &&
2095 !peer_tep->te_closing &&
2096 ((tep->te_state == TS_DATA_XFER) ||
2097 (tep->te_state == TS_WIND_ORDREL)||
2098 (tep->te_state == TS_WREQ_ORDREL))) {
2099 TL_QENABLE(peer_tep);
2100 }
2101
2102 /*
2103 * Wakeup read side service routine.
2104 */
2105 mutex_enter(&tep->te_srv_lock);
2106 ASSERT(tep->te_rsrv_active);
2107 tep->te_rsrv_active = B_FALSE;
2108 cv_signal(&tep->te_srv_cv);
2109 mutex_exit(&tep->te_srv_lock);
2110 tl_serializer_exit(tep);
2111 }
2112
2113 /*
2114 * process M_PROTO messages. Always called from serializer.
2115 */
2116 static void
2117 tl_do_proto(mblk_t *mp, tl_endpt_t *tep)
2118 {
2119 ssize_t msz = MBLKL(mp);
2120 union T_primitives *prim = (union T_primitives *)mp->b_rptr;
2121
2122 /* Message size was validated by tl_wput(). */
2123 ASSERT(msz >= sizeof (prim->type));
2124
2125 switch (prim->type) {
2126 case T_UNBIND_REQ:
2127 tl_unbind(mp, tep);
2128 break;
2129
2130 case T_ADDR_REQ:
2131 tl_addr_req(mp, tep);
2132 break;
2133
2134 case O_T_CONN_RES:
2135 case T_CONN_RES:
2136 if (IS_CLTS(tep)) {
2137 tl_merror(tep->te_wq, mp, EPROTO);
2138 break;
2139 }
2140 tl_conn_res(mp, tep);
2141 break;
2142
2143 case T_DISCON_REQ:
2144 if (IS_CLTS(tep)) {
2145 tl_merror(tep->te_wq, mp, EPROTO);
2146 break;
2147 }
2148 tl_discon_req(mp, tep);
2149 break;
2150
2151 case T_DATA_REQ:
2152 if (IS_CLTS(tep)) {
2153 tl_merror(tep->te_wq, mp, EPROTO);
2154 break;
2155 }
2156 tl_data(mp, tep);
2157 break;
2158
2159 case T_OPTDATA_REQ:
2160 if (IS_CLTS(tep)) {
2161 tl_merror(tep->te_wq, mp, EPROTO);
2162 break;
2163 }
2164 tl_data(mp, tep);
2165 break;
2166
2167 case T_EXDATA_REQ:
2168 if (IS_CLTS(tep)) {
2169 tl_merror(tep->te_wq, mp, EPROTO);
2170 break;
2171 }
2172 tl_exdata(mp, tep);
2173 break;
2174
2175 case T_ORDREL_REQ:
2176 if (! IS_COTSORD(tep)) {
2177 tl_merror(tep->te_wq, mp, EPROTO);
2178 break;
2179 }
2180 tl_ordrel(mp, tep);
2181 break;
2182
2183 case T_UNITDATA_REQ:
2184 if (IS_COTS(tep)) {
2185 tl_merror(tep->te_wq, mp, EPROTO);
2186 break;
2187 }
2188 tl_unitdata(mp, tep);
2189 break;
2190
2191 default:
2192 tl_merror(tep->te_wq, mp, EPROTO);
2193 break;
2194 }
2195 }
2196
2197 /*
2198 * Process ioctl from serializer.
2199 * This is a wrapper around tl_do_ioctl().
2200 */
2201 static void
2202 tl_do_ioctl_ser(mblk_t *mp, tl_endpt_t *tep)
2203 {
2204 if (! tep->te_closing)
2205 tl_do_ioctl(mp, tep);
2206 else
2207 freemsg(mp);
2208
2209 tl_serializer_exit(tep);
2210 tl_refrele(tep);
2211 }
2212
2213 static void
2214 tl_do_ioctl(mblk_t *mp, tl_endpt_t *tep)
2215 {
2216 struct iocblk *iocbp = (struct iocblk *)mp->b_rptr;
2217 int cmd = iocbp->ioc_cmd;
2218 queue_t *wq = tep->te_wq;
2219 int error;
2220 int thisopt, otheropt;
2221
2222 ASSERT((cmd == TL_IOC_CREDOPT) || (cmd == TL_IOC_UCREDOPT));
2223
2224 switch (cmd) {
2225 case TL_IOC_CREDOPT:
2226 if (cmd == TL_IOC_CREDOPT) {
2227 thisopt = TL_SETCRED;
2228 otheropt = TL_SETUCRED;
2229 } else {
2230 /* FALLTHROUGH */
2231 case TL_IOC_UCREDOPT:
2232 thisopt = TL_SETUCRED;
2233 otheropt = TL_SETCRED;
2234 }
2235 /*
2236 * The credentials passing does not apply to sockets.
2237 * Only one of the cred options can be set at a given time.
2238 */
2239 if (IS_SOCKET(tep) || (tep->te_flag & otheropt)) {
2240 miocnak(wq, mp, 0, EINVAL);
2241 return;
2242 }
2243
2244 /*
2245 * Turn on generation of credential options for
2246 * T_conn_req, T_conn_con, T_unidata_ind.
2247 */
2248 error = miocpullup(mp, sizeof (uint32_t));
2249 if (error != 0) {
2250 miocnak(wq, mp, 0, error);
2251 return;
2252 }
2253 if (!IS_P2ALIGNED(mp->b_cont->b_rptr, sizeof (uint32_t))) {
2254 miocnak(wq, mp, 0, EINVAL);
2255 return;
2256 }
2257
2258 if (*(uint32_t *)mp->b_cont->b_rptr)
2259 tep->te_flag |= thisopt;
2260 else
2261 tep->te_flag &= ~thisopt;
2262
2263 miocack(wq, mp, 0, 0);
2264 break;
2265
2266 default:
2267 /* Should not be here */
2268 miocnak(wq, mp, 0, EINVAL);
2269 break;
2270 }
2271 }
2272
2273
2274 /*
2275 * send T_ERROR_ACK
2276 * Note: assumes enough memory or caller passed big enough mp
2277 * - no recovery from allocb failures
2278 */
2279
2280 static void
2281 tl_error_ack(queue_t *wq, mblk_t *mp, t_scalar_t tli_err,
2282 t_scalar_t unix_err, t_scalar_t type)
2283 {
2284 struct T_error_ack *err_ack;
2285 mblk_t *ackmp = tpi_ack_alloc(mp, sizeof (struct T_error_ack),
2286 M_PCPROTO, T_ERROR_ACK);
2287
2288 if (ackmp == NULL) {
2289 (void) (STRLOG(TL_ID, 0, 1, SL_TRACE|SL_ERROR,
2290 "tl_error_ack:out of mblk memory"));
2291 tl_merror(wq, NULL, ENOSR);
2292 return;
2293 }
2294 err_ack = (struct T_error_ack *)ackmp->b_rptr;
2295 err_ack->ERROR_prim = type;
2296 err_ack->TLI_error = tli_err;
2297 err_ack->UNIX_error = unix_err;
2298
2299 /*
2300 * send error ack message
2301 */
2302 qreply(wq, ackmp);
2303 }
2304
2305
2306
2307 /*
2308 * send T_OK_ACK
2309 * Note: assumes enough memory or caller passed big enough mp
2310 * - no recovery from allocb failures
2311 */
2312 static void
2313 tl_ok_ack(queue_t *wq, mblk_t *mp, t_scalar_t type)
2314 {
2315 struct T_ok_ack *ok_ack;
2316 mblk_t *ackmp = tpi_ack_alloc(mp, sizeof (struct T_ok_ack),
2317 M_PCPROTO, T_OK_ACK);
2318
2319 if (ackmp == NULL) {
2320 tl_merror(wq, NULL, ENOMEM);
2321 return;
2322 }
2323
2324 ok_ack = (struct T_ok_ack *)ackmp->b_rptr;
2325 ok_ack->CORRECT_prim = type;
2326
2327 (void) qreply(wq, ackmp);
2328 }
2329
2330 /*
2331 * Process T_BIND_REQ and O_T_BIND_REQ from serializer.
2332 * This is a wrapper around tl_bind().
2333 */
2334 static void
2335 tl_bind_ser(mblk_t *mp, tl_endpt_t *tep)
2336 {
2337 if (! tep->te_closing)
2338 tl_bind(mp, tep);
2339 else
2340 freemsg(mp);
2341
2342 tl_serializer_exit(tep);
2343 tl_refrele(tep);
2344 }
2345
2346 /*
2347 * Process T_BIND_REQ and O_T_BIND_REQ TPI requests.
2348 * Assumes that the endpoint is in the unbound.
2349 */
2350 static void
2351 tl_bind(mblk_t *mp, tl_endpt_t *tep)
2352 {
2353 queue_t *wq = tep->te_wq;
2354 struct T_bind_ack *b_ack;
2355 struct T_bind_req *bind = (struct T_bind_req *)mp->b_rptr;
2356 mblk_t *ackmp, *bamp;
2357 soux_addr_t ux_addr;
2358 t_uscalar_t qlen = 0;
2359 t_scalar_t alen, aoff;
2360 tl_addr_t addr_req;
2361 void *addr_startp;
2362 ssize_t msz = MBLKL(mp), basize;
2363 t_scalar_t tli_err = 0, unix_err = 0;
2364 t_scalar_t save_prim_type = bind->PRIM_type;
2365 t_scalar_t save_state = tep->te_state;
2366
2367 if (tep->te_state != TS_UNBND) {
2368 (void) (STRLOG(TL_ID, tep->te_minor, 1,
2369 SL_TRACE|SL_ERROR,
2370 "tl_wput:bind_request:out of state, state=%d",
2371 tep->te_state));
2372 tli_err = TOUTSTATE;
2373 goto error;
2374 }
2375
2376 if (msz < sizeof (struct T_bind_req)) {
2377 tli_err = TSYSERR; unix_err = EINVAL;
2378 goto error;
2379 }
2380
2381 tep->te_state = NEXTSTATE(TE_BIND_REQ, tep->te_state);
2382
2383 ASSERT((bind->PRIM_type == O_T_BIND_REQ) ||
2384 (bind->PRIM_type == T_BIND_REQ));
2385
2386 alen = bind->ADDR_length;
2387 aoff = bind->ADDR_offset;
2388
2389 /* negotiate max conn req pending */
2390 if (IS_COTS(tep)) {
2391 qlen = bind->CONIND_number;
2392 if (qlen > tl_maxqlen)
2393 qlen = tl_maxqlen;
2394 }
2395
2396 /*
2397 * Reserve hash handle. It can only be NULL if the endpoint is unbound
2398 * and bound again.
2399 */
2400 if ((tep->te_hash_hndl == NULL) &&
2401 ((tep->te_flag & TL_ADDRHASHED) == 0) &&
2402 mod_hash_reserve_nosleep(tep->te_addrhash,
2403 &tep->te_hash_hndl) != 0) {
2404 tli_err = TSYSERR; unix_err = ENOSR;
2405 goto error;
2406 }
2407
2408 /*
2409 * Verify address correctness.
2410 */
2411 if (IS_SOCKET(tep)) {
2412 ASSERT(bind->PRIM_type == O_T_BIND_REQ);
2413
2414 if ((alen != TL_SOUX_ADDRLEN) ||
2415 (aoff < 0) ||
2416 (aoff + alen > msz)) {
2417 (void) (STRLOG(TL_ID, tep->te_minor,
2418 1, SL_TRACE|SL_ERROR,
2419 "tl_bind: invalid socket addr"));
2420 tep->te_state = NEXTSTATE(TE_ERROR_ACK, tep->te_state);
2421 tli_err = TSYSERR; unix_err = EINVAL;
2422 goto error;
2423 }
2424 /* Copy address from message to local buffer. */
2425 bcopy(mp->b_rptr + aoff, &ux_addr, sizeof (ux_addr));
2426 /*
2427 * Check that we got correct address from sockets
2428 */
2429 if ((ux_addr.soua_magic != SOU_MAGIC_EXPLICIT) &&
2430 (ux_addr.soua_magic != SOU_MAGIC_IMPLICIT)) {
2431 (void) (STRLOG(TL_ID, tep->te_minor,
2432 1, SL_TRACE|SL_ERROR,
2433 "tl_bind: invalid socket magic"));
2434 tep->te_state = NEXTSTATE(TE_ERROR_ACK, tep->te_state);
2435 tli_err = TSYSERR; unix_err = EINVAL;
2436 goto error;
2437 }
2438 if ((ux_addr.soua_magic == SOU_MAGIC_IMPLICIT) &&
2439 (ux_addr.soua_vp != NULL)) {
2440 (void) (STRLOG(TL_ID, tep->te_minor,
2441 1, SL_TRACE|SL_ERROR,
2442 "tl_bind: implicit addr non-empty"));
2443 tep->te_state = NEXTSTATE(TE_ERROR_ACK, tep->te_state);
2444 tli_err = TSYSERR; unix_err = EINVAL;
2445 goto error;
2446 }
2447 if ((ux_addr.soua_magic == SOU_MAGIC_EXPLICIT) &&
2448 (ux_addr.soua_vp == NULL)) {
2449 (void) (STRLOG(TL_ID, tep->te_minor,
2450 1, SL_TRACE|SL_ERROR,
2451 "tl_bind: explicit addr empty"));
2452 tep->te_state = NEXTSTATE(TE_ERROR_ACK, tep->te_state);
2453 tli_err = TSYSERR; unix_err = EINVAL;
2454 goto error;
2455 }
2456 } else {
2457 if ((alen > 0) && ((aoff < 0) ||
2458 ((ssize_t)(aoff + alen) > msz) ||
2459 ((aoff + alen) < 0))) {
2460 (void) (STRLOG(TL_ID, tep->te_minor,
2461 1, SL_TRACE|SL_ERROR,
2462 "tl_bind: invalid message"));
2463 tep->te_state = NEXTSTATE(TE_ERROR_ACK, tep->te_state);
2464 tli_err = TSYSERR; unix_err = EINVAL;
2465 goto error;
2466 }
2467 if ((alen < 0) || (alen > (msz - sizeof (struct T_bind_req)))) {
2468 (void) (STRLOG(TL_ID, tep->te_minor,
2469 1, SL_TRACE|SL_ERROR,
2470 "tl_bind: bad addr in message"));
2471 tep->te_state = NEXTSTATE(TE_ERROR_ACK, tep->te_state);
2472 tli_err = TBADADDR;
2473 goto error;
2474 }
2475 #ifdef DEBUG
2476 /*
2477 * Mild form of ASSERT()ion to detect broken TPI apps.
2478 * if (! assertion)
2479 * log warning;
2480 */
2481 if (! ((alen == 0 && aoff == 0) ||
2482 (aoff >= (t_scalar_t)(sizeof (struct T_bind_req))))) {
2483 (void) (STRLOG(TL_ID, tep->te_minor,
2484 3, SL_TRACE|SL_ERROR,
2485 "tl_bind: addr overlaps TPI message"));
2486 }
2487 #endif
2488 }
2489
2490 /*
2491 * Bind the address provided or allocate one if requested.
2492 * Allow rebinds with a new qlen value.
2493 */
2494 if (IS_SOCKET(tep)) {
2495 /*
2496 * For anonymous requests the te_ap is already set up properly
2497 * so use minor number as an address.
2498 * For explicit requests need to check whether the address is
2499 * already in use.
2500 */
2501 if (ux_addr.soua_magic == SOU_MAGIC_EXPLICIT) {
2502 int rc;
2503
2504 if (tep->te_flag & TL_ADDRHASHED) {
2505 ASSERT(IS_COTS(tep) && tep->te_qlen == 0);
2506 if (tep->te_vp == ux_addr.soua_vp)
2507 goto skip_addr_bind;
2508 else /* Rebind to a new address. */
2509 tl_addr_unbind(tep);
2510 }
2511 /*
2512 * Insert address in the hash if it is not already
2513 * there. Since we use preallocated handle, the insert
2514 * can fail only if the key is already present.
2515 */
2516 rc = mod_hash_insert_reserve(tep->te_addrhash,
2517 (mod_hash_key_t)ux_addr.soua_vp,
2518 (mod_hash_val_t)tep, tep->te_hash_hndl);
2519
2520 if (rc != 0) {
2521 ASSERT(rc == MH_ERR_DUPLICATE);
2522 /*
2523 * Violate O_T_BIND_REQ semantics and fail with
2524 * TADDRBUSY - sockets will not use any address
2525 * other than supplied one for explicit binds.
2526 */
2527 (void) (STRLOG(TL_ID, tep->te_minor, 1,
2528 SL_TRACE|SL_ERROR,
2529 "tl_bind:requested addr %p is busy",
2530 ux_addr.soua_vp));
2531 tli_err = TADDRBUSY; unix_err = 0;
2532 goto error;
2533 }
2534 tep->te_uxaddr = ux_addr;
2535 tep->te_flag |= TL_ADDRHASHED;
2536 tep->te_hash_hndl = NULL;
2537 }
2538 } else if (alen == 0) {
2539 /*
2540 * assign any free address
2541 */
2542 if (! tl_get_any_addr(tep, NULL)) {
2543 (void) (STRLOG(TL_ID, tep->te_minor,
2544 1, SL_TRACE|SL_ERROR,
2545 "tl_bind:failed to get buffer for any "
2546 "address"));
2547 tli_err = TSYSERR; unix_err = ENOSR;
2548 goto error;
2549 }
2550 } else {
2551 addr_req.ta_alen = alen;
2552 addr_req.ta_abuf = (mp->b_rptr + aoff);
2553 addr_req.ta_zoneid = tep->te_zoneid;
2554
2555 tep->te_abuf = kmem_zalloc((size_t)alen, KM_NOSLEEP);
2556 if (tep->te_abuf == NULL) {
2557 tli_err = TSYSERR; unix_err = ENOSR;
2558 goto error;
2559 }
2560 bcopy(addr_req.ta_abuf, tep->te_abuf, addr_req.ta_alen);
2561 tep->te_alen = alen;
2562
2563 if (mod_hash_insert_reserve(tep->te_addrhash,
2564 (mod_hash_key_t)&tep->te_ap, (mod_hash_val_t)tep,
2565 tep->te_hash_hndl) != 0) {
2566 if (save_prim_type == T_BIND_REQ) {
2567 /*
2568 * The bind semantics for this primitive
2569 * require a failure if the exact address
2570 * requested is busy
2571 */
2572 (void) (STRLOG(TL_ID, tep->te_minor, 1,
2573 SL_TRACE|SL_ERROR,
2574 "tl_bind:requested addr is busy"));
2575 tli_err = TADDRBUSY; unix_err = 0;
2576 goto error;
2577 }
2578
2579 /*
2580 * O_T_BIND_REQ semantics say if address if requested
2581 * address is busy, bind to any available free address
2582 */
2583 if (! tl_get_any_addr(tep, &addr_req)) {
2584 (void) (STRLOG(TL_ID, tep->te_minor, 1,
2585 SL_TRACE|SL_ERROR,
2586 "tl_bind:unable to get any addr buf"));
2587 tli_err = TSYSERR; unix_err = ENOMEM;
2588 goto error;
2589 }
2590 } else {
2591 tep->te_flag |= TL_ADDRHASHED;
2592 tep->te_hash_hndl = NULL;
2593 }
2594 }
2595
2596 ASSERT(tep->te_alen >= 0);
2597
2598 skip_addr_bind:
2599 /*
2600 * prepare T_BIND_ACK TPI message
2601 */
2602 basize = sizeof (struct T_bind_ack) + tep->te_alen;
2603 bamp = reallocb(mp, basize, 0);
2604 if (bamp == NULL) {
2605 (void) (STRLOG(TL_ID, tep->te_minor, 1, SL_TRACE|SL_ERROR,
2606 "tl_wput:tl_bind: allocb failed"));
2607 /*
2608 * roll back state changes
2609 */
2610 tl_addr_unbind(tep);
2611 tep->te_state = TS_UNBND;
2612 tl_memrecover(wq, mp, basize);
2613 return;
2614 }
2615
2616 DB_TYPE(bamp) = M_PCPROTO;
2617 bamp->b_wptr = bamp->b_rptr + basize;
2618 b_ack = (struct T_bind_ack *)bamp->b_rptr;
2619 b_ack->PRIM_type = T_BIND_ACK;
2620 b_ack->CONIND_number = qlen;
2621 b_ack->ADDR_length = tep->te_alen;
2622 b_ack->ADDR_offset = (t_scalar_t)sizeof (struct T_bind_ack);
2623 addr_startp = bamp->b_rptr + b_ack->ADDR_offset;
2624 bcopy(tep->te_abuf, addr_startp, tep->te_alen);
2625
2626 if (IS_COTS(tep)) {
2627 tep->te_qlen = qlen;
2628 if (qlen > 0)
2629 tep->te_flag |= TL_LISTENER;
2630 }
2631
2632 tep->te_state = NEXTSTATE(TE_BIND_ACK, tep->te_state);
2633 /*
2634 * send T_BIND_ACK message
2635 */
2636 (void) qreply(wq, bamp);
2637 return;
2638
2639 error:
2640 ackmp = reallocb(mp, sizeof (struct T_error_ack), 0);
2641 if (ackmp == NULL) {
2642 /*
2643 * roll back state changes
2644 */
2645 tep->te_state = save_state;
2646 tl_memrecover(wq, mp, sizeof (struct T_error_ack));
2647 return;
2648 }
2649 tep->te_state = NEXTSTATE(TE_ERROR_ACK, tep->te_state);
2650 tl_error_ack(wq, ackmp, tli_err, unix_err, save_prim_type);
2651 }
2652
2653 /*
2654 * Process T_UNBIND_REQ.
2655 * Called from serializer.
2656 */
2657 static void
2658 tl_unbind(mblk_t *mp, tl_endpt_t *tep)
2659 {
2660 queue_t *wq;
2661 mblk_t *ackmp;
2662
2663 if (tep->te_closing) {
2664 freemsg(mp);
2665 return;
2666 }
2667
2668 wq = tep->te_wq;
2669
2670 /*
2671 * preallocate memory for max of T_OK_ACK and T_ERROR_ACK
2672 * ==> allocate for T_ERROR_ACK (known max)
2673 */
2674 if ((ackmp = reallocb(mp, sizeof (struct T_error_ack), 0)) == NULL) {
2675 tl_memrecover(wq, mp, sizeof (struct T_error_ack));
2676 return;
2677 }
2678 /*
2679 * memory resources committed
2680 * Note: no message validation. T_UNBIND_REQ message is
2681 * same size as PRIM_type field so already verified earlier.
2682 */
2683
2684 /*
2685 * validate state
2686 */
2687 if (tep->te_state != TS_IDLE) {
2688 (void) (STRLOG(TL_ID, tep->te_minor, 1,
2689 SL_TRACE|SL_ERROR,
2690 "tl_wput:T_UNBIND_REQ:out of state, state=%d",
2691 tep->te_state));
2692 tl_error_ack(wq, ackmp, TOUTSTATE, 0, T_UNBIND_REQ);
2693 return;
2694 }
2695 tep->te_state = NEXTSTATE(TE_UNBIND_REQ, tep->te_state);
2696
2697 /*
2698 * TPI says on T_UNBIND_REQ:
2699 * send up a M_FLUSH to flush both
2700 * read and write queues
2701 */
2702 (void) putnextctl1(RD(wq), M_FLUSH, FLUSHRW);
2703
2704 if (! IS_SOCKET(tep) || !IS_CLTS(tep) || tep->te_qlen != 0 ||
2705 tep->te_magic != SOU_MAGIC_EXPLICIT) {
2706
2707 /*
2708 * Sockets use bind with qlen==0 followed by bind() to
2709 * the same address with qlen > 0 for listeners.
2710 * We allow rebind with a new qlen value.
2711 */
2712 tl_addr_unbind(tep);
2713 }
2714
2715 tep->te_state = NEXTSTATE(TE_OK_ACK1, tep->te_state);
2716 /*
2717 * send T_OK_ACK
2718 */
2719 tl_ok_ack(wq, ackmp, T_UNBIND_REQ);
2720 }
2721
2722
2723 /*
2724 * Option management code from drv/ip is used here
2725 * Note: TL_PROT_LEVEL/TL_IOC_CREDOPT option is not part of tl_opt_arr
2726 * database of options. So optcom_req() will fail T_SVR4_OPTMGMT_REQ.
2727 * However, that is what we want as that option is 'unorthodox'
2728 * and only valid in T_CONN_IND, T_CONN_CON and T_UNITDATA_IND
2729 * and not in T_SVR4_OPTMGMT_REQ/ACK
2730 * Note2: use of optcom_req means this routine is an exception to
2731 * recovery from allocb() failures.
2732 */
2733
2734 static void
2735 tl_optmgmt(queue_t *wq, mblk_t *mp)
2736 {
2737 tl_endpt_t *tep;
2738 mblk_t *ackmp;
2739 union T_primitives *prim;
2740 cred_t *cr;
2741
2742 tep = (tl_endpt_t *)wq->q_ptr;
2743 prim = (union T_primitives *)mp->b_rptr;
2744
2745 /*
2746 * All Solaris components should pass a db_credp
2747 * for this TPI message, hence we ASSERT.
2748 * But in case there is some other M_PROTO that looks
2749 * like a TPI message sent by some other kernel
2750 * component, we check and return an error.
2751 */
2752 cr = msg_getcred(mp, NULL);
2753 ASSERT(cr != NULL);
2754 if (cr == NULL) {
2755 tl_error_ack(wq, mp, TSYSERR, EINVAL, prim->type);
2756 return;
2757 }
2758
2759 /* all states OK for AF_UNIX options ? */
2760 if (!IS_SOCKET(tep) && tep->te_state != TS_IDLE &&
2761 prim->type == T_SVR4_OPTMGMT_REQ) {
2762 /*
2763 * Broken TLI semantics that options can only be managed
2764 * in TS_IDLE state. Needed for Sparc ABI test suite that
2765 * tests this TLI (mis)feature using this device driver.
2766 */
2767 (void) (STRLOG(TL_ID, tep->te_minor, 1,
2768 SL_TRACE|SL_ERROR,
2769 "tl_wput:T_SVR4_OPTMGMT_REQ:out of state, state=%d",
2770 tep->te_state));
2771 /*
2772 * preallocate memory for T_ERROR_ACK
2773 */
2774 ackmp = allocb(sizeof (struct T_error_ack), BPRI_MED);
2775 if (! ackmp) {
2776 tl_memrecover(wq, mp, sizeof (struct T_error_ack));
2777 return;
2778 }
2779
2780 tl_error_ack(wq, ackmp, TOUTSTATE, 0, T_SVR4_OPTMGMT_REQ);
2781 freemsg(mp);
2782 return;
2783 }
2784
2785 /*
2786 * call common option management routine from drv/ip
2787 */
2788 if (prim->type == T_SVR4_OPTMGMT_REQ) {
2789 svr4_optcom_req(wq, mp, cr, &tl_opt_obj);
2790 } else {
2791 ASSERT(prim->type == T_OPTMGMT_REQ);
2792 tpi_optcom_req(wq, mp, cr, &tl_opt_obj);
2793 }
2794 }
2795
2796 /*
2797 * Handle T_conn_req - the driver part of accept().
2798 * If TL_SET[U]CRED generate the credentials options.
2799 * If this is a socket pass through options unmodified.
2800 * For sockets generate the T_CONN_CON here instead of
2801 * waiting for the T_CONN_RES.
2802 */
2803 static void
2804 tl_conn_req(queue_t *wq, mblk_t *mp)
2805 {
2806 tl_endpt_t *tep = (tl_endpt_t *)wq->q_ptr;
2807 struct T_conn_req *creq = (struct T_conn_req *)mp->b_rptr;
2808 ssize_t msz = MBLKL(mp);
2809 t_scalar_t alen, aoff, olen, ooff, err = 0;
2810 tl_endpt_t *peer_tep = NULL;
2811 mblk_t *ackmp;
2812 mblk_t *dimp;
2813 struct T_discon_ind *di;
2814 soux_addr_t ux_addr;
2815 tl_addr_t dst;
2816
2817 ASSERT(IS_COTS(tep));
2818
2819 if (tep->te_closing) {
2820 freemsg(mp);
2821 return;
2822 }
2823
2824 /*
2825 * preallocate memory for:
2826 * 1. max of T_ERROR_ACK and T_OK_ACK
2827 * ==> known max T_ERROR_ACK
2828 * 2. max of T_DISCON_IND and T_CONN_IND
2829 */
2830 ackmp = allocb(sizeof (struct T_error_ack), BPRI_MED);
2831 if (! ackmp) {
2832 tl_memrecover(wq, mp, sizeof (struct T_error_ack));
2833 return;
2834 }
2835 /*
2836 * memory committed for T_OK_ACK/T_ERROR_ACK now
2837 * will be committed for T_DISCON_IND/T_CONN_IND later
2838 */
2839
2840 if (tep->te_state != TS_IDLE) {
2841 (void) (STRLOG(TL_ID, tep->te_minor, 1,
2842 SL_TRACE|SL_ERROR,
2843 "tl_wput:T_CONN_REQ:out of state, state=%d",
2844 tep->te_state));
2845 tl_error_ack(wq, ackmp, TOUTSTATE, 0, T_CONN_REQ);
2846 freemsg(mp);
2847 return;
2848 }
2849
2850 /*
2851 * validate the message
2852 * Note: dereference fields in struct inside message only
2853 * after validating the message length.
2854 */
2855 if (msz < sizeof (struct T_conn_req)) {
2856 (void) (STRLOG(TL_ID, tep->te_minor, 1, SL_TRACE|SL_ERROR,
2857 "tl_conn_req:invalid message length"));
2858 tl_error_ack(wq, ackmp, TSYSERR, EINVAL, T_CONN_REQ);
2859 freemsg(mp);
2860 return;
2861 }
2862 alen = creq->DEST_length;
2863 aoff = creq->DEST_offset;
2864 olen = creq->OPT_length;
2865 ooff = creq->OPT_offset;
2866 if (olen == 0)
2867 ooff = 0;
2868
2869 if (IS_SOCKET(tep)) {
2870 if ((alen != TL_SOUX_ADDRLEN) ||
2871 (aoff < 0) ||
2872 (aoff + alen > msz) ||
2873 (alen > msz - sizeof (struct T_conn_req))) {
2874 (void) (STRLOG(TL_ID, tep->te_minor,
2875 1, SL_TRACE|SL_ERROR,
2876 "tl_conn_req: invalid socket addr"));
2877 tl_error_ack(wq, ackmp, TSYSERR, EINVAL, T_CONN_REQ);
2878 freemsg(mp);
2879 return;
2880 }
2881 bcopy(mp->b_rptr + aoff, &ux_addr, TL_SOUX_ADDRLEN);
2882 if ((ux_addr.soua_magic != SOU_MAGIC_IMPLICIT) &&
2883 (ux_addr.soua_magic != SOU_MAGIC_EXPLICIT)) {
2884 (void) (STRLOG(TL_ID, tep->te_minor,
2885 1, SL_TRACE|SL_ERROR,
2886 "tl_conn_req: invalid socket magic"));
2887 tl_error_ack(wq, ackmp, TSYSERR, EINVAL, T_CONN_REQ);
2888 freemsg(mp);
2889 return;
2890 }
2891 } else {
2892 if ((alen > 0 && ((aoff + alen) > msz || aoff + alen < 0)) ||
2893 (olen > 0 && ((ssize_t)(ooff + olen) > msz ||
2894 ooff + olen < 0)) ||
2895 olen < 0 || ooff < 0) {
2896 (void) (STRLOG(TL_ID, tep->te_minor, 1,
2897 SL_TRACE|SL_ERROR,
2898 "tl_conn_req:invalid message"));
2899 tl_error_ack(wq, ackmp, TSYSERR, EINVAL, T_CONN_REQ);
2900 freemsg(mp);
2901 return;
2902 }
2903
2904 if (alen <= 0 || aoff < 0 ||
2905 (ssize_t)alen > msz - sizeof (struct T_conn_req)) {
2906 (void) (STRLOG(TL_ID, tep->te_minor, 1,
2907 SL_TRACE|SL_ERROR,
2908 "tl_conn_req:bad addr in message, "
2909 "alen=%d, msz=%ld",
2910 alen, msz));
2911 tl_error_ack(wq, ackmp, TBADADDR, 0, T_CONN_REQ);
2912 freemsg(mp);
2913 return;
2914 }
2915 #ifdef DEBUG
2916 /*
2917 * Mild form of ASSERT()ion to detect broken TPI apps.
2918 * if (! assertion)
2919 * log warning;
2920 */
2921 if (! (aoff >= (t_scalar_t)sizeof (struct T_conn_req))) {
2922 (void) (STRLOG(TL_ID, tep->te_minor, 3,
2923 SL_TRACE|SL_ERROR,
2924 "tl_conn_req: addr overlaps TPI message"));
2925 }
2926 #endif
2927 if (olen) {
2928 /*
2929 * no opts in connect req
2930 * supported in this provider except for sockets.
2931 */
2932 (void) (STRLOG(TL_ID, tep->te_minor, 1,
2933 SL_TRACE|SL_ERROR,
2934 "tl_conn_req:options not supported "
2935 "in message"));
2936 tl_error_ack(wq, ackmp, TBADOPT, 0, T_CONN_REQ);
2937 freemsg(mp);
2938 return;
2939 }
2940 }
2941
2942 /*
2943 * Prevent tep from closing on us.
2944 */
2945 if (! tl_noclose(tep)) {
2946 (void) (STRLOG(TL_ID, tep->te_minor, 1, SL_TRACE|SL_ERROR,
2947 "tl_conn_req:endpoint is closing"));
2948 tl_error_ack(wq, ackmp, TOUTSTATE, 0, T_CONN_REQ);
2949 freemsg(mp);
2950 return;
2951 }
2952
2953 tep->te_state = NEXTSTATE(TE_CONN_REQ, tep->te_state);
2954 /*
2955 * get endpoint to connect to
2956 * check that peer with DEST addr is bound to addr
2957 * and has CONIND_number > 0
2958 */
2959 dst.ta_alen = alen;
2960 dst.ta_abuf = mp->b_rptr + aoff;
2961 dst.ta_zoneid = tep->te_zoneid;
2962
2963 /*
2964 * Verify if remote addr is in use
2965 */
2966 peer_tep = (IS_SOCKET(tep) ?
2967 tl_sock_find_peer(tep, &ux_addr) :
2968 tl_find_peer(tep, &dst));
2969
2970 if (peer_tep == NULL) {
2971 (void) (STRLOG(TL_ID, tep->te_minor, 1, SL_TRACE|SL_ERROR,
2972 "tl_conn_req:no one at connect address"));
2973 err = ECONNREFUSED;
2974 } else if (peer_tep->te_nicon >= peer_tep->te_qlen) {
2975 /*
2976 * validate that number of incoming connection is
2977 * not to capacity on destination endpoint
2978 */
2979 (void) (STRLOG(TL_ID, tep->te_minor, 2, SL_TRACE,
2980 "tl_conn_req: qlen overflow connection refused"));
2981 err = ECONNREFUSED;
2982 }
2983
2984 /*
2985 * Send T_DISCON_IND in case of error
2986 */
2987 if (err != 0) {
2988 if (peer_tep != NULL)
2989 tl_refrele(peer_tep);
2990 /* We are still expected to send T_OK_ACK */
2991 tep->te_state = NEXTSTATE(TE_OK_ACK1, tep->te_state);
2992 tl_ok_ack(tep->te_wq, ackmp, T_CONN_REQ);
2993 tl_closeok(tep);
2994 dimp = tpi_ack_alloc(mp, sizeof (struct T_discon_ind),
2995 M_PROTO, T_DISCON_IND);
2996 if (dimp == NULL) {
2997 tl_merror(wq, NULL, ENOSR);
2998 return;
2999 }
3000 di = (struct T_discon_ind *)dimp->b_rptr;
3001 di->DISCON_reason = err;
3002 di->SEQ_number = BADSEQNUM;
3003
3004 tep->te_state = TS_IDLE;
3005 /*
3006 * send T_DISCON_IND message
3007 */
3008 putnext(tep->te_rq, dimp);
3009 return;
3010 }
3011
3012 ASSERT(IS_COTS(peer_tep));
3013
3014 /*
3015 * Found the listener. At this point processing will continue on
3016 * listener serializer. Close of the endpoint should be blocked while we
3017 * switch serializers.
3018 */
3019 tl_serializer_refhold(peer_tep->te_ser);
3020 tl_serializer_refrele(tep->te_ser);
3021 tep->te_ser = peer_tep->te_ser;
3022 ASSERT(tep->te_oconp == NULL);
3023 tep->te_oconp = peer_tep;
3024
3025 /*
3026 * It is safe to close now. Close may continue on listener serializer.
3027 */
3028 tl_closeok(tep);
3029
3030 /*
3031 * Pass ackmp to tl_conn_req_ser. Note that mp->b_cont may contain user
3032 * data, so we link mp to ackmp.
3033 */
3034 ackmp->b_cont = mp;
3035 mp = ackmp;
3036
3037 tl_refhold(tep);
3038 tl_serializer_enter(tep, tl_conn_req_ser, mp);
3039 }
3040
3041 /*
3042 * Finish T_CONN_REQ processing on listener serializer.
3043 */
3044 static void
3045 tl_conn_req_ser(mblk_t *mp, tl_endpt_t *tep)
3046 {
3047 queue_t *wq;
3048 tl_endpt_t *peer_tep = tep->te_oconp;
3049 mblk_t *confmp, *cimp, *indmp;
3050 void *opts = NULL;
3051 mblk_t *ackmp = mp;
3052 struct T_conn_req *creq = (struct T_conn_req *)mp->b_cont->b_rptr;
3053 struct T_conn_ind *ci;
3054 tl_icon_t *tip;
3055 void *addr_startp;
3056 t_scalar_t olen = creq->OPT_length;
3057 t_scalar_t ooff = creq->OPT_offset;
3058 size_t ci_msz;
3059 size_t size;
3060 cred_t *cr = NULL;
3061 pid_t cpid;
3062
3063 if (tep->te_closing) {
3064 TL_UNCONNECT(tep->te_oconp);
3065 tl_serializer_exit(tep);
3066 tl_refrele(tep);
3067 freemsg(mp);
3068 return;
3069 }
3070
3071 wq = tep->te_wq;
3072 tep->te_flag |= TL_EAGER;
3073
3074 /*
3075 * Extract preallocated ackmp from mp.
3076 */
3077 mp = mp->b_cont;
3078 ackmp->b_cont = NULL;
3079
3080 if (olen == 0)
3081 ooff = 0;
3082
3083 if (peer_tep->te_closing ||
3084 !((peer_tep->te_state == TS_IDLE) ||
3085 (peer_tep->te_state == TS_WRES_CIND))) {
3086 (void) (STRLOG(TL_ID, tep->te_minor, 2, SL_TRACE | SL_ERROR,
3087 "tl_conn_req:peer in bad state (%d)",
3088 peer_tep->te_state));
3089 TL_UNCONNECT(tep->te_oconp);
3090 tl_error_ack(wq, mp, TSYSERR, ECONNREFUSED, T_CONN_REQ);
3091 freemsg(ackmp);
3092 tl_serializer_exit(tep);
3093 tl_refrele(tep);
3094 return;
3095 }
3096
3097 /*
3098 * preallocate now for T_DISCON_IND or T_CONN_IND
3099 */
3100 /*
3101 * calculate length of T_CONN_IND message
3102 */
3103 if (peer_tep->te_flag & (TL_SETCRED|TL_SETUCRED)) {
3104 cr = msg_getcred(mp, &cpid);
3105 ASSERT(cr != NULL);
3106 if (peer_tep->te_flag & TL_SETCRED) {
3107 ooff = 0;
3108 olen = (t_scalar_t) sizeof (struct opthdr) +
3109 OPTLEN(sizeof (tl_credopt_t));
3110 /* 1 option only */
3111 } else {
3112 ooff = 0;
3113 olen = (t_scalar_t)sizeof (struct opthdr) +
3114 OPTLEN(ucredminsize(cr));
3115 /* 1 option only */
3116 }
3117 }
3118 ci_msz = sizeof (struct T_conn_ind) + tep->te_alen;
3119 ci_msz = T_ALIGN(ci_msz) + olen;
3120 size = max(ci_msz, sizeof (struct T_discon_ind));
3121
3122 /*
3123 * Save options from mp - we'll need them for T_CONN_IND.
3124 */
3125 if (ooff != 0) {
3126 opts = kmem_alloc(olen, KM_NOSLEEP);
3127 if (opts == NULL) {
3128 /*
3129 * roll back state changes
3130 */
3131 tep->te_state = TS_IDLE;
3132 tl_memrecover(wq, mp, size);
3133 freemsg(ackmp);
3134 TL_UNCONNECT(tep->te_oconp);
3135 tl_serializer_exit(tep);
3136 tl_refrele(tep);
3137 return;
3138 }
3139 /* Copy options to a temp buffer */
3140 bcopy(mp->b_rptr + ooff, opts, olen);
3141 }
3142
3143 if (IS_SOCKET(tep) && !tl_disable_early_connect) {
3144 /*
3145 * Generate a T_CONN_CON that has the identical address
3146 * (and options) as the T_CONN_REQ.
3147 * NOTE: assumes that the T_conn_req and T_conn_con structures
3148 * are isomorphic.
3149 */
3150 confmp = copyb(mp);
3151 if (! confmp) {
3152 /*
3153 * roll back state changes
3154 */
3155 tep->te_state = TS_IDLE;
3156 tl_memrecover(wq, mp, mp->b_wptr - mp->b_rptr);
3157 freemsg(ackmp);
3158 if (opts != NULL)
3159 kmem_free(opts, olen);
3160 TL_UNCONNECT(tep->te_oconp);
3161 tl_serializer_exit(tep);
3162 tl_refrele(tep);
3163 return;
3164 }
3165 ((struct T_conn_con *)(confmp->b_rptr))->PRIM_type =
3166 T_CONN_CON;
3167 } else {
3168 confmp = NULL;
3169 }
3170 if ((indmp = reallocb(mp, size, 0)) == NULL) {
3171 /*
3172 * roll back state changes
3173 */
3174 tep->te_state = TS_IDLE;
3175 tl_memrecover(wq, mp, size);
3176 freemsg(ackmp);
3177 if (opts != NULL)
3178 kmem_free(opts, olen);
3179 freemsg(confmp);
3180 TL_UNCONNECT(tep->te_oconp);
3181 tl_serializer_exit(tep);
3182 tl_refrele(tep);
3183 return;
3184 }
3185
3186 tip = kmem_zalloc(sizeof (*tip), KM_NOSLEEP);
3187 if (tip == NULL) {
3188 /*
3189 * roll back state changes
3190 */
3191 tep->te_state = TS_IDLE;
3192 tl_memrecover(wq, indmp, sizeof (*tip));
3193 freemsg(ackmp);
3194 if (opts != NULL)
3195 kmem_free(opts, olen);
3196 freemsg(confmp);
3197 TL_UNCONNECT(tep->te_oconp);
3198 tl_serializer_exit(tep);
3199 tl_refrele(tep);
3200 return;
3201 }
3202 tip->ti_mp = NULL;
3203
3204 /*
3205 * memory is now committed for T_DISCON_IND/T_CONN_IND/T_CONN_CON
3206 * and tl_icon_t cell.
3207 */
3208
3209 /*
3210 * ack validity of request and send the peer credential in the ACK.
3211 */
3212 tep->te_state = NEXTSTATE(TE_OK_ACK1, tep->te_state);
3213
3214 if (peer_tep != NULL && peer_tep->te_credp != NULL &&
3215 confmp != NULL) {
3216 mblk_setcred(confmp, peer_tep->te_credp, peer_tep->te_cpid);
3217 }
3218
3219 tl_ok_ack(wq, ackmp, T_CONN_REQ);
3220
3221 /*
3222 * prepare message to send T_CONN_IND
3223 */
3224 /*
3225 * allocate the message - original data blocks retained
3226 * in the returned mblk
3227 */
3228 cimp = tl_resizemp(indmp, size);
3229 if (! cimp) {
3230 (void) (STRLOG(TL_ID, tep->te_minor, 3, SL_TRACE|SL_ERROR,
3231 "tl_conn_req:con_ind:allocb failure"));
3232 tl_merror(wq, indmp, ENOMEM);
3233 TL_UNCONNECT(tep->te_oconp);
3234 tl_serializer_exit(tep);
3235 tl_refrele(tep);
3236 if (opts != NULL)
3237 kmem_free(opts, olen);
3238 freemsg(confmp);
3239 ASSERT(tip->ti_mp == NULL);
3240 kmem_free(tip, sizeof (*tip));
3241 return;
3242 }
3243
3244 DB_TYPE(cimp) = M_PROTO;
3245 ci = (struct T_conn_ind *)cimp->b_rptr;
3246 ci->PRIM_type = T_CONN_IND;
3247 ci->SRC_offset = (t_scalar_t)sizeof (struct T_conn_ind);
3248 ci->SRC_length = tep->te_alen;
3249 ci->SEQ_number = tep->te_seqno;
3250
3251 addr_startp = cimp->b_rptr + ci->SRC_offset;
3252 bcopy(tep->te_abuf, addr_startp, tep->te_alen);
3253 if (peer_tep->te_flag & (TL_SETCRED|TL_SETUCRED)) {
3254
3255 ci->OPT_offset = (t_scalar_t)T_ALIGN(ci->SRC_offset +
3256 ci->SRC_length);
3257 ci->OPT_length = olen; /* because only 1 option */
3258 tl_fill_option(cimp->b_rptr + ci->OPT_offset,
3259 cr, cpid,
3260 peer_tep->te_flag, peer_tep->te_credp);
3261 } else if (ooff != 0) {
3262 /* Copy option from T_CONN_REQ */
3263 ci->OPT_offset = (t_scalar_t)T_ALIGN(ci->SRC_offset +
3264 ci->SRC_length);
3265 ci->OPT_length = olen;
3266 ASSERT(opts != NULL);
3267 bcopy(opts, (void *)((uintptr_t)ci + ci->OPT_offset), olen);
3268 } else {
3269 ci->OPT_offset = 0;
3270 ci->OPT_length = 0;
3271 }
3272 if (opts != NULL)
3273 kmem_free(opts, olen);
3274
3275 /*
3276 * register connection request with server peer
3277 * append to list of incoming connections
3278 * increment references for both peer_tep and tep: peer_tep is placed on
3279 * te_oconp and tep is placed on listeners queue.
3280 */
3281 tip->ti_tep = tep;
3282 tip->ti_seqno = tep->te_seqno;
3283 list_insert_tail(&peer_tep->te_iconp, tip);
3284 peer_tep->te_nicon++;
3285
3286 peer_tep->te_state = NEXTSTATE(TE_CONN_IND, peer_tep->te_state);
3287 /*
3288 * send the T_CONN_IND message
3289 */
3290 putnext(peer_tep->te_rq, cimp);
3291
3292 /*
3293 * Send a T_CONN_CON message for sockets.
3294 * Disable the queues until we have reached the correct state!
3295 */
3296 if (confmp != NULL) {
3297 tep->te_state = NEXTSTATE(TE_CONN_CON, tep->te_state);
3298 noenable(wq);
3299 putnext(tep->te_rq, confmp);
3300 }
3301 /*
3302 * Now we need to increment tep reference because tep is referenced by
3303 * server list of pending connections. We also need to decrement
3304 * reference before exiting serializer. Two operations void each other
3305 * so we don't modify reference at all.
3306 */
3307 ASSERT(tep->te_refcnt >= 2);
3308 ASSERT(peer_tep->te_refcnt >= 2);
3309 tl_serializer_exit(tep);
3310 }
3311
3312
3313
3314 /*
3315 * Handle T_conn_res on listener stream. Called on listener serializer.
3316 * tl_conn_req has already generated the T_CONN_CON.
3317 * tl_conn_res is called on listener serializer.
3318 * No one accesses acceptor at this point, so it is safe to modify acceptor.
3319 * Switch eager serializer to acceptor's.
3320 *
3321 * If TL_SET[U]CRED generate the credentials options.
3322 * For sockets tl_conn_req has already generated the T_CONN_CON.
3323 */
3324 static void
3325 tl_conn_res(mblk_t *mp, tl_endpt_t *tep)
3326 {
3327 queue_t *wq;
3328 struct T_conn_res *cres = (struct T_conn_res *)mp->b_rptr;
3329 ssize_t msz = MBLKL(mp);
3330 t_scalar_t olen, ooff, err = 0;
3331 t_scalar_t prim = cres->PRIM_type;
3332 uchar_t *addr_startp;
3333 tl_endpt_t *acc_ep = NULL, *cl_ep = NULL;
3334 tl_icon_t *tip;
3335 size_t size;
3336 mblk_t *ackmp, *respmp;
3337 mblk_t *dimp, *ccmp = NULL;
3338 struct T_discon_ind *di;
3339 struct T_conn_con *cc;
3340 boolean_t client_noclose_set = B_FALSE;
3341 boolean_t switch_client_serializer = B_TRUE;
3342
3343 ASSERT(IS_COTS(tep));
3344
3345 if (tep->te_closing) {
3346 freemsg(mp);
3347 return;
3348 }
3349
3350 wq = tep->te_wq;
3351
3352 /*
3353 * preallocate memory for:
3354 * 1. max of T_ERROR_ACK and T_OK_ACK
3355 * ==> known max T_ERROR_ACK
3356 * 2. max of T_DISCON_IND and T_CONN_CON
3357 */
3358 ackmp = allocb(sizeof (struct T_error_ack), BPRI_MED);
3359 if (! ackmp) {
3360 tl_memrecover(wq, mp, sizeof (struct T_error_ack));
3361 return;
3362 }
3363 /*
3364 * memory committed for T_OK_ACK/T_ERROR_ACK now
3365 * will be committed for T_DISCON_IND/T_CONN_CON later
3366 */
3367
3368
3369 ASSERT(prim == T_CONN_RES || prim == O_T_CONN_RES);
3370
3371 /*
3372 * validate state
3373 */
3374 if (tep->te_state != TS_WRES_CIND) {
3375 (void) (STRLOG(TL_ID, tep->te_minor, 1,
3376 SL_TRACE|SL_ERROR,
3377 "tl_wput:T_CONN_RES:out of state, state=%d",
3378 tep->te_state));
3379 tl_error_ack(wq, ackmp, TOUTSTATE, 0, prim);
3380 freemsg(mp);
3381 return;
3382 }
3383
3384 /*
3385 * validate the message
3386 * Note: dereference fields in struct inside message only
3387 * after validating the message length.
3388 */
3389 if (msz < sizeof (struct T_conn_res)) {
3390 (void) (STRLOG(TL_ID, tep->te_minor, 1, SL_TRACE|SL_ERROR,
3391 "tl_conn_res:invalid message length"));
3392 tl_error_ack(wq, ackmp, TSYSERR, EINVAL, prim);
3393 freemsg(mp);
3394 return;
3395 }
3396 olen = cres->OPT_length;
3397 ooff = cres->OPT_offset;
3398 if (((olen > 0) && ((ooff + olen) > msz))) {
3399 (void) (STRLOG(TL_ID, tep->te_minor, 1, SL_TRACE|SL_ERROR,
3400 "tl_conn_res:invalid message"));
3401 tl_error_ack(wq, ackmp, TSYSERR, EINVAL, prim);
3402 freemsg(mp);
3403 return;
3404 }
3405 if (olen) {
3406 /*
3407 * no opts in connect res
3408 * supported in this provider
3409 */
3410 (void) (STRLOG(TL_ID, tep->te_minor, 1, SL_TRACE|SL_ERROR,
3411 "tl_conn_res:options not supported in message"));
3412 tl_error_ack(wq, ackmp, TBADOPT, 0, prim);
3413 freemsg(mp);
3414 return;
3415 }
3416
3417 tep->te_state = NEXTSTATE(TE_CONN_RES, tep->te_state);
3418 ASSERT(tep->te_state == TS_WACK_CRES);
3419
3420 if (cres->SEQ_number < TL_MINOR_START &&
3421 cres->SEQ_number >= BADSEQNUM) {
3422 (void) (STRLOG(TL_ID, tep->te_minor, 2, SL_TRACE|SL_ERROR,
3423 "tl_conn_res:remote endpoint sequence number bad"));
3424 tep->te_state = NEXTSTATE(TE_ERROR_ACK, tep->te_state);
3425 tl_error_ack(wq, ackmp, TBADSEQ, 0, prim);
3426 freemsg(mp);
3427 return;
3428 }
3429
3430 /*
3431 * find accepting endpoint. Will have extra reference if found.
3432 */
3433 if (mod_hash_find_cb(tep->te_transport->tr_ai_hash,
3434 (mod_hash_key_t)(uintptr_t)cres->ACCEPTOR_id,
3435 (mod_hash_val_t *)&acc_ep, tl_find_callback) != 0) {
3436 (void) (STRLOG(TL_ID, tep->te_minor, 2, SL_TRACE|SL_ERROR,
3437 "tl_conn_res:bad accepting endpoint"));
3438 tep->te_state = NEXTSTATE(TE_ERROR_ACK, tep->te_state);
3439 tl_error_ack(wq, ackmp, TBADF, 0, prim);
3440 freemsg(mp);
3441 return;
3442 }
3443
3444 /*
3445 * Prevent acceptor from closing.
3446 */
3447 if (! tl_noclose(acc_ep)) {
3448 (void) (STRLOG(TL_ID, tep->te_minor, 2, SL_TRACE|SL_ERROR,
3449 "tl_conn_res:bad accepting endpoint"));
3450 tep->te_state = NEXTSTATE(TE_ERROR_ACK, tep->te_state);
3451 tl_error_ack(wq, ackmp, TBADF, 0, prim);
3452 tl_refrele(acc_ep);
3453 freemsg(mp);
3454 return;
3455 }
3456
3457 acc_ep->te_flag |= TL_ACCEPTOR;
3458
3459 /*
3460 * validate that accepting endpoint, if different from listening
3461 * has address bound => state is TS_IDLE
3462 * TROUBLE in XPG4 !!?
3463 */
3464 if ((tep != acc_ep) && (acc_ep->te_state != TS_IDLE)) {
3465 (void) (STRLOG(TL_ID, tep->te_minor, 2, SL_TRACE|SL_ERROR,
3466 "tl_conn_res:accepting endpoint has no address bound,"
3467 "state=%d", acc_ep->te_state));
3468 tep->te_state = NEXTSTATE(TE_ERROR_ACK, tep->te_state);
3469 tl_error_ack(wq, ackmp, TOUTSTATE, 0, prim);
3470 freemsg(mp);
3471 tl_closeok(acc_ep);
3472 tl_refrele(acc_ep);
3473 return;
3474 }
3475
3476 /*
3477 * validate if accepting endpt same as listening, then
3478 * no other incoming connection should be on the queue
3479 */
3480
3481 if ((tep == acc_ep) && (tep->te_nicon > 1)) {
3482 (void) (STRLOG(TL_ID, tep->te_minor, 3, SL_TRACE|SL_ERROR,
3483 "tl_conn_res: > 1 conn_ind on listener-acceptor"));
3484 tep->te_state = NEXTSTATE(TE_ERROR_ACK, tep->te_state);
3485 tl_error_ack(wq, ackmp, TBADF, 0, prim);
3486 freemsg(mp);
3487 tl_closeok(acc_ep);
3488 tl_refrele(acc_ep);
3489 return;
3490 }
3491
3492 /*
3493 * Mark for deletion, the entry corresponding to client
3494 * on list of pending connections made by the listener
3495 * search list to see if client is one of the
3496 * recorded as a listener.
3497 */
3498 tip = tl_icon_find(tep, cres->SEQ_number);
3499 if (tip == NULL) {
3500 (void) (STRLOG(TL_ID, tep->te_minor, 2, SL_TRACE|SL_ERROR,
3501 "tl_conn_res:no client in listener list"));
3502 tep->te_state = NEXTSTATE(TE_ERROR_ACK, tep->te_state);
3503 tl_error_ack(wq, ackmp, TBADSEQ, 0, prim);
3504 freemsg(mp);
3505 tl_closeok(acc_ep);
3506 tl_refrele(acc_ep);
3507 return;
3508 }
3509
3510 /*
3511 * If ti_tep is NULL the client has already closed. In this case
3512 * the code below will avoid any action on the client side
3513 * but complete the server and acceptor state transitions.
3514 */
3515 ASSERT(tip->ti_tep == NULL ||
3516 tip->ti_tep->te_seqno == cres->SEQ_number);
3517 cl_ep = tip->ti_tep;
3518
3519 /*
3520 * If the client is present it is switched from listener's to acceptor's
3521 * serializer. We should block client closes while serializers are
3522 * being switched.
3523 *
3524 * It is possible that the client is present but is currently being
3525 * closed. There are two possible cases:
3526 *
3527 * 1) The client has already entered tl_close_finish_ser() and sent
3528 * T_ORDREL_IND. In this case we can just ignore the client (but we
3529 * still need to send all messages from tip->ti_mp to the acceptor).
3530 *
3531 * 2) The client started the close but has not entered
3532 * tl_close_finish_ser() yet. In this case, the client is already
3533 * proceeding asynchronously on the listener's serializer, so we're
3534 * forced to change the acceptor to use the listener's serializer to
3535 * ensure that any operations on the acceptor are serialized with
3536 * respect to the close that's in-progress.
3537 */
3538 if (cl_ep != NULL) {
3539 if (tl_noclose(cl_ep)) {
3540 client_noclose_set = B_TRUE;
3541 } else {
3542 /*
3543 * Client is closing. If it it has sent the
3544 * T_ORDREL_IND, we can simply ignore it - otherwise,
3545 * we have to let let the client continue until it is
3546 * sent.
3547 *
3548 * If we do continue using the client, acceptor will
3549 * switch to client's serializer which is used by client
3550 * for its close.
3551 */
3552 tl_client_closing_when_accepting++;
3553 switch_client_serializer = B_FALSE;
3554 if (!IS_SOCKET(cl_ep) || tl_disable_early_connect ||
3555 cl_ep->te_state == -1)
3556 cl_ep = NULL;
3557 }
3558 }
3559
3560 if (cl_ep != NULL) {
3561 /*
3562 * validate client state to be TS_WCON_CREQ or TS_DATA_XFER
3563 * (latter for sockets only)
3564 */
3565 if (cl_ep->te_state != TS_WCON_CREQ &&
3566 (cl_ep->te_state != TS_DATA_XFER &&
3567 IS_SOCKET(cl_ep))) {
3568 err = ECONNREFUSED;
3569 /*
3570 * T_DISCON_IND sent later after committing memory
3571 * and acking validity of request
3572 */
3573 (void) (STRLOG(TL_ID, tep->te_minor, 2, SL_TRACE,
3574 "tl_conn_res:peer in bad state"));
3575 }
3576
3577 /*
3578 * preallocate now for T_DISCON_IND or T_CONN_CONN
3579 * ack validity of request (T_OK_ACK) after memory committed
3580 */
3581
3582 if (err)
3583 size = sizeof (struct T_discon_ind);
3584 else {
3585 /*
3586 * calculate length of T_CONN_CON message
3587 */
3588 olen = 0;
3589 if (cl_ep->te_flag & TL_SETCRED) {
3590 olen = (t_scalar_t)sizeof (struct opthdr) +
3591 OPTLEN(sizeof (tl_credopt_t));
3592 } else if (cl_ep->te_flag & TL_SETUCRED) {
3593 olen = (t_scalar_t)sizeof (struct opthdr) +
3594 OPTLEN(ucredminsize(acc_ep->te_credp));
3595 }
3596 size = T_ALIGN(sizeof (struct T_conn_con) +
3597 acc_ep->te_alen) + olen;
3598 }
3599 if ((respmp = reallocb(mp, size, 0)) == NULL) {
3600 /*
3601 * roll back state changes
3602 */
3603 tep->te_state = TS_WRES_CIND;
3604 tl_memrecover(wq, mp, size);
3605 freemsg(ackmp);
3606 if (client_noclose_set)
3607 tl_closeok(cl_ep);
3608 tl_closeok(acc_ep);
3609 tl_refrele(acc_ep);
3610 return;
3611 }
3612 mp = NULL;
3613 }
3614
3615 /*
3616 * Now ack validity of request
3617 */
3618 if (tep->te_nicon == 1) {
3619 if (tep == acc_ep)
3620 tep->te_state = NEXTSTATE(TE_OK_ACK2, tep->te_state);
3621 else
3622 tep->te_state = NEXTSTATE(TE_OK_ACK3, tep->te_state);
3623 } else
3624 tep->te_state = NEXTSTATE(TE_OK_ACK4, tep->te_state);
3625
3626 /*
3627 * send T_DISCON_IND now if client state validation failed earlier
3628 */
3629 if (err) {
3630 tl_ok_ack(wq, ackmp, prim);
3631 /*
3632 * flush the queues - why always ?
3633 */
3634 (void) putnextctl1(acc_ep->te_rq, M_FLUSH, FLUSHR);
3635
3636 dimp = tl_resizemp(respmp, size);
3637 if (! dimp) {
3638 (void) (STRLOG(TL_ID, tep->te_minor, 3,
3639 SL_TRACE|SL_ERROR,
3640 "tl_conn_res:con_ind:allocb failure"));
3641 tl_merror(wq, respmp, ENOMEM);
3642 tl_closeok(acc_ep);
3643 if (client_noclose_set)
3644 tl_closeok(cl_ep);
3645 tl_refrele(acc_ep);
3646 return;
3647 }
3648 if (dimp->b_cont) {
3649 /* no user data in provider generated discon ind */
3650 freemsg(dimp->b_cont);
3651 dimp->b_cont = NULL;
3652 }
3653
3654 DB_TYPE(dimp) = M_PROTO;
3655 di = (struct T_discon_ind *)dimp->b_rptr;
3656 di->PRIM_type = T_DISCON_IND;
3657 di->DISCON_reason = err;
3658 di->SEQ_number = BADSEQNUM;
3659
3660 tep->te_state = TS_IDLE;
3661 /*
3662 * send T_DISCON_IND message
3663 */
3664 putnext(acc_ep->te_rq, dimp);
3665 if (client_noclose_set)
3666 tl_closeok(cl_ep);
3667 tl_closeok(acc_ep);
3668 tl_refrele(acc_ep);
3669 return;
3670 }
3671
3672 /*
3673 * now start connecting the accepting endpoint
3674 */
3675 if (tep != acc_ep)
3676 acc_ep->te_state = NEXTSTATE(TE_PASS_CONN, acc_ep->te_state);
3677
3678 if (cl_ep == NULL) {
3679 /*
3680 * The client has already closed. Send up any queued messages
3681 * and change the state accordingly.
3682 */
3683 tl_ok_ack(wq, ackmp, prim);
3684 tl_icon_sendmsgs(acc_ep, &tip->ti_mp);
3685
3686 /*
3687 * remove endpoint from incoming connection
3688 * delete client from list of incoming connections
3689 */
3690 tl_freetip(tep, tip);
3691 freemsg(mp);
3692 tl_closeok(acc_ep);
3693 tl_refrele(acc_ep);
3694 return;
3695 } else if (tip->ti_mp != NULL) {
3696 /*
3697 * The client could have queued a T_DISCON_IND which needs
3698 * to be sent up.
3699 * Note that t_discon_req can not operate the same as
3700 * t_data_req since it is not possible for it to putbq
3701 * the message and return -1 due to the use of qwriter.
3702 */
3703 tl_icon_sendmsgs(acc_ep, &tip->ti_mp);
3704 }
3705
3706 /*
3707 * prepare connect confirm T_CONN_CON message
3708 */
3709
3710 /*
3711 * allocate the message - original data blocks
3712 * retained in the returned mblk
3713 */
3714 if (! IS_SOCKET(cl_ep) || tl_disable_early_connect) {
3715 ccmp = tl_resizemp(respmp, size);
3716 if (ccmp == NULL) {
3717 tl_ok_ack(wq, ackmp, prim);
3718 (void) (STRLOG(TL_ID, tep->te_minor, 3,
3719 SL_TRACE|SL_ERROR,
3720 "tl_conn_res:conn_con:allocb failure"));
3721 tl_merror(wq, respmp, ENOMEM);
3722 tl_closeok(acc_ep);
3723 if (client_noclose_set)
3724 tl_closeok(cl_ep);
3725 tl_refrele(acc_ep);
3726 return;
3727 }
3728
3729 DB_TYPE(ccmp) = M_PROTO;
3730 cc = (struct T_conn_con *)ccmp->b_rptr;
3731 cc->PRIM_type = T_CONN_CON;
3732 cc->RES_offset = (t_scalar_t)sizeof (struct T_conn_con);
3733 cc->RES_length = acc_ep->te_alen;
3734 addr_startp = ccmp->b_rptr + cc->RES_offset;
3735 bcopy(acc_ep->te_abuf, addr_startp, acc_ep->te_alen);
3736 if (cl_ep->te_flag & (TL_SETCRED|TL_SETUCRED)) {
3737 cc->OPT_offset = (t_scalar_t)T_ALIGN(cc->RES_offset +
3738 cc->RES_length);
3739 cc->OPT_length = olen;
3740 tl_fill_option(ccmp->b_rptr + cc->OPT_offset,
3741 acc_ep->te_credp, acc_ep->te_cpid, cl_ep->te_flag,
3742 cl_ep->te_credp);
3743 } else {
3744 cc->OPT_offset = 0;
3745 cc->OPT_length = 0;
3746 }
3747 /*
3748 * Forward the credential in the packet so it can be picked up
3749 * at the higher layers for more complete credential processing
3750 */
3751 mblk_setcred(ccmp, acc_ep->te_credp, acc_ep->te_cpid);
3752 } else {
3753 freemsg(respmp);
3754 respmp = NULL;
3755 }
3756
3757 /*
3758 * make connection linking
3759 * accepting and client endpoints
3760 * No need to increment references:
3761 * on client: it should already have one from tip->ti_tep linkage.
3762 * on acceptor is should already have one from the table lookup.
3763 *
3764 * At this point both client and acceptor can't close. Set client
3765 * serializer to acceptor's.
3766 */
3767 ASSERT(cl_ep->te_refcnt >= 2);
3768 ASSERT(acc_ep->te_refcnt >= 2);
3769 ASSERT(cl_ep->te_conp == NULL);
3770 ASSERT(acc_ep->te_conp == NULL);
3771 cl_ep->te_conp = acc_ep;
3772 acc_ep->te_conp = cl_ep;
3773 ASSERT(cl_ep->te_ser == tep->te_ser);
3774 if (switch_client_serializer) {
3775 mutex_enter(&cl_ep->te_ser_lock);
3776 if (cl_ep->te_ser_count > 0) {
3777 switch_client_serializer = B_FALSE;
3778 tl_serializer_noswitch++;
3779 } else {
3780 /*
3781 * Move client to the acceptor's serializer.
3782 */
3783 tl_serializer_refhold(acc_ep->te_ser);
3784 tl_serializer_refrele(cl_ep->te_ser);
3785 cl_ep->te_ser = acc_ep->te_ser;
3786 }
3787 mutex_exit(&cl_ep->te_ser_lock);
3788 }
3789 if (!switch_client_serializer) {
3790 /*
3791 * It is not possible to switch client to use acceptor's.
3792 * Move acceptor to client's serializer (which is the same as
3793 * listener's).
3794 */
3795 tl_serializer_refhold(cl_ep->te_ser);
3796 tl_serializer_refrele(acc_ep->te_ser);
3797 acc_ep->te_ser = cl_ep->te_ser;
3798 }
3799
3800 TL_REMOVE_PEER(cl_ep->te_oconp);
3801 TL_REMOVE_PEER(acc_ep->te_oconp);
3802
3803 /*
3804 * remove endpoint from incoming connection
3805 * delete client from list of incoming connections
3806 */
3807 tip->ti_tep = NULL;
3808 tl_freetip(tep, tip);
3809 tl_ok_ack(wq, ackmp, prim);
3810
3811 /*
3812 * data blocks already linked in reallocb()
3813 */
3814
3815 /*
3816 * link queues so that I_SENDFD will work
3817 */
3818 if (! IS_SOCKET(tep)) {
3819 acc_ep->te_wq->q_next = cl_ep->te_rq;
3820 cl_ep->te_wq->q_next = acc_ep->te_rq;
3821 }
3822
3823 /*
3824 * send T_CONN_CON up on client side unless it was already
3825 * done (for a socket). In cases any data or ordrel req has been
3826 * queued make sure that the service procedure runs.
3827 */
3828 if (IS_SOCKET(cl_ep) && !tl_disable_early_connect) {
3829 enableok(cl_ep->te_wq);
3830 TL_QENABLE(cl_ep);
3831 if (ccmp != NULL)
3832 freemsg(ccmp);
3833 } else {
3834 /*
3835 * change client state on TE_CONN_CON event
3836 */
3837 cl_ep->te_state = NEXTSTATE(TE_CONN_CON, cl_ep->te_state);
3838 putnext(cl_ep->te_rq, ccmp);
3839 }
3840
3841 /* Mark the both endpoints as accepted */
3842 cl_ep->te_flag |= TL_ACCEPTED;
3843 acc_ep->te_flag |= TL_ACCEPTED;
3844
3845 /*
3846 * Allow client and acceptor to close.
3847 */
3848 tl_closeok(acc_ep);
3849 if (client_noclose_set)
3850 tl_closeok(cl_ep);
3851 }
3852
3853
3854
3855
3856 static void
3857 tl_discon_req(mblk_t *mp, tl_endpt_t *tep)
3858 {
3859 queue_t *wq;
3860 struct T_discon_req *dr;
3861 ssize_t msz;
3862 tl_endpt_t *peer_tep = tep->te_conp;
3863 tl_endpt_t *srv_tep = tep->te_oconp;
3864 tl_icon_t *tip;
3865 size_t size;
3866 mblk_t *ackmp, *dimp, *respmp;
3867 struct T_discon_ind *di;
3868 t_scalar_t save_state, new_state;
3869
3870 if (tep->te_closing) {
3871 freemsg(mp);
3872 return;
3873 }
3874
3875 if ((peer_tep != NULL) && peer_tep->te_closing) {
3876 TL_UNCONNECT(tep->te_conp);
3877 peer_tep = NULL;
3878 }
3879 if ((srv_tep != NULL) && srv_tep->te_closing) {
3880 TL_UNCONNECT(tep->te_oconp);
3881 srv_tep = NULL;
3882 }
3883
3884 wq = tep->te_wq;
3885
3886 /*
3887 * preallocate memory for:
3888 * 1. max of T_ERROR_ACK and T_OK_ACK
3889 * ==> known max T_ERROR_ACK
3890 * 2. for T_DISCON_IND
3891 */
3892 ackmp = allocb(sizeof (struct T_error_ack), BPRI_MED);
3893 if (! ackmp) {
3894 tl_memrecover(wq, mp, sizeof (struct T_error_ack));
3895 return;
3896 }
3897 /*
3898 * memory committed for T_OK_ACK/T_ERROR_ACK now
3899 * will be committed for T_DISCON_IND later
3900 */
3901
3902 dr = (struct T_discon_req *)mp->b_rptr;
3903 msz = MBLKL(mp);
3904
3905 /*
3906 * validate the state
3907 */
3908 save_state = new_state = tep->te_state;
3909 if (! (save_state >= TS_WCON_CREQ && save_state <= TS_WRES_CIND) &&
3910 ! (save_state >= TS_DATA_XFER && save_state <= TS_WREQ_ORDREL)) {
3911 (void) (STRLOG(TL_ID, tep->te_minor, 1,
3912 SL_TRACE|SL_ERROR,
3913 "tl_wput:T_DISCON_REQ:out of state, state=%d",
3914 tep->te_state));
3915 tl_error_ack(wq, ackmp, TOUTSTATE, 0, T_DISCON_REQ);
3916 freemsg(mp);
3917 return;
3918 }
3919 /*
3920 * Defer committing the state change until it is determined if
3921 * the message will be queued with the tl_icon or not.
3922 */
3923 new_state = NEXTSTATE(TE_DISCON_REQ, tep->te_state);
3924
3925 /* validate the message */
3926 if (msz < sizeof (struct T_discon_req)) {
3927 (void) (STRLOG(TL_ID, tep->te_minor, 1, SL_TRACE|SL_ERROR,
3928 "tl_discon_req:invalid message"));
3929 tep->te_state = NEXTSTATE(TE_ERROR_ACK, new_state);
3930 tl_error_ack(wq, ackmp, TSYSERR, EINVAL, T_DISCON_REQ);
3931 freemsg(mp);
3932 return;
3933 }
3934
3935 /*
3936 * if server, then validate that client exists
3937 * by connection sequence number etc.
3938 */
3939 if (tep->te_nicon > 0) { /* server */
3940
3941 /*
3942 * search server list for disconnect client
3943 */
3944 tip = tl_icon_find(tep, dr->SEQ_number);
3945 if (tip == NULL) {
3946 (void) (STRLOG(TL_ID, tep->te_minor, 2,
3947 SL_TRACE|SL_ERROR,
3948 "tl_discon_req:no disconnect endpoint"));
3949 tep->te_state = NEXTSTATE(TE_ERROR_ACK, new_state);
3950 tl_error_ack(wq, ackmp, TBADSEQ, 0, T_DISCON_REQ);
3951 freemsg(mp);
3952 return;
3953 }
3954 /*
3955 * If ti_tep is NULL the client has already closed. In this case
3956 * the code below will avoid any action on the client side.
3957 */
3958
3959 IMPLY(tip->ti_tep != NULL,
3960 tip->ti_tep->te_seqno == dr->SEQ_number);
3961 peer_tep = tip->ti_tep;
3962 }
3963
3964 /*
3965 * preallocate now for T_DISCON_IND
3966 * ack validity of request (T_OK_ACK) after memory committed
3967 */
3968 size = sizeof (struct T_discon_ind);
3969 if ((respmp = reallocb(mp, size, 0)) == NULL) {
3970 tl_memrecover(wq, mp, size);
3971 freemsg(ackmp);
3972 return;
3973 }
3974
3975 /*
3976 * prepare message to ack validity of request
3977 */
3978 if (tep->te_nicon == 0)
3979 new_state = NEXTSTATE(TE_OK_ACK1, new_state);
3980 else
3981 if (tep->te_nicon == 1)
3982 new_state = NEXTSTATE(TE_OK_ACK2, new_state);
3983 else
3984 new_state = NEXTSTATE(TE_OK_ACK4, new_state);
3985
3986 /*
3987 * Flushing queues according to TPI. Using the old state.
3988 */
3989 if ((tep->te_nicon <= 1) &&
3990 ((save_state == TS_DATA_XFER) ||
3991 (save_state == TS_WIND_ORDREL) ||
3992 (save_state == TS_WREQ_ORDREL)))
3993 (void) putnextctl1(RD(wq), M_FLUSH, FLUSHRW);
3994
3995 /* send T_OK_ACK up */
3996 tl_ok_ack(wq, ackmp, T_DISCON_REQ);
3997
3998 /*
3999 * now do disconnect business
4000 */
4001 if (tep->te_nicon > 0) { /* listener */
4002 if (peer_tep != NULL && !peer_tep->te_closing) {
4003 /*
4004 * disconnect incoming connect request pending to tep
4005 */
4006 if ((dimp = tl_resizemp(respmp, size)) == NULL) {
4007 (void) (STRLOG(TL_ID, tep->te_minor, 2,
4008 SL_TRACE|SL_ERROR,
4009 "tl_discon_req: reallocb failed"));
4010 tep->te_state = new_state;
4011 tl_merror(wq, respmp, ENOMEM);
4012 return;
4013 }
4014 di = (struct T_discon_ind *)dimp->b_rptr;
4015 di->SEQ_number = BADSEQNUM;
4016 save_state = peer_tep->te_state;
4017 peer_tep->te_state = TS_IDLE;
4018
4019 TL_REMOVE_PEER(peer_tep->te_oconp);
4020 enableok(peer_tep->te_wq);
4021 TL_QENABLE(peer_tep);
4022 } else {
4023 freemsg(respmp);
4024 dimp = NULL;
4025 }
4026
4027 /*
4028 * remove endpoint from incoming connection list
4029 * - remove disconnect client from list on server
4030 */
4031 tl_freetip(tep, tip);
4032 } else if ((peer_tep = tep->te_oconp) != NULL) { /* client */
4033 /*
4034 * disconnect an outgoing request pending from tep
4035 */
4036
4037 if ((dimp = tl_resizemp(respmp, size)) == NULL) {
4038 (void) (STRLOG(TL_ID, tep->te_minor, 2,
4039 SL_TRACE|SL_ERROR,
4040 "tl_discon_req: reallocb failed"));
4041 tep->te_state = new_state;
4042 tl_merror(wq, respmp, ENOMEM);
4043 return;
4044 }
4045 di = (struct T_discon_ind *)dimp->b_rptr;
4046 DB_TYPE(dimp) = M_PROTO;
4047 di->PRIM_type = T_DISCON_IND;
4048 di->DISCON_reason = ECONNRESET;
4049 di->SEQ_number = tep->te_seqno;
4050
4051 /*
4052 * If this is a socket the T_DISCON_IND is queued with
4053 * the T_CONN_IND. Otherwise the T_CONN_IND is removed
4054 * from the list of pending connections.
4055 * Note that when te_oconp is set the peer better have
4056 * a t_connind_t for the client.
4057 */
4058 if (IS_SOCKET(tep) && !tl_disable_early_connect) {
4059 /*
4060 * No need to check that
4061 * ti_tep == NULL since the T_DISCON_IND
4062 * takes precedence over other queued
4063 * messages.
4064 */
4065 tl_icon_queuemsg(peer_tep, tep->te_seqno, dimp);
4066 peer_tep = NULL;
4067 dimp = NULL;
4068 /*
4069 * Can't clear te_oconp since tl_co_unconnect needs
4070 * it as a hint not to free the tep.
4071 * Keep the state unchanged since tl_conn_res inspects
4072 * it.
4073 */
4074 new_state = tep->te_state;
4075 } else {
4076 /* Found - delete it */
4077 tip = tl_icon_find(peer_tep, tep->te_seqno);
4078 if (tip != NULL) {
4079 ASSERT(tep == tip->ti_tep);
4080 save_state = peer_tep->te_state;
4081 if (peer_tep->te_nicon == 1)
4082 peer_tep->te_state =
4083 NEXTSTATE(TE_DISCON_IND2,
4084 peer_tep->te_state);
4085 else
4086 peer_tep->te_state =
4087 NEXTSTATE(TE_DISCON_IND3,
4088 peer_tep->te_state);
4089 tl_freetip(peer_tep, tip);
4090 }
4091 ASSERT(tep->te_oconp != NULL);
4092 TL_UNCONNECT(tep->te_oconp);
4093 }
4094 } else if ((peer_tep = tep->te_conp) != NULL) { /* connected! */
4095 if ((dimp = tl_resizemp(respmp, size)) == NULL) {
4096 (void) (STRLOG(TL_ID, tep->te_minor, 2,
4097 SL_TRACE|SL_ERROR,
4098 "tl_discon_req: reallocb failed"));
4099 tep->te_state = new_state;
4100 tl_merror(wq, respmp, ENOMEM);
4101 return;
4102 }
4103 di = (struct T_discon_ind *)dimp->b_rptr;
4104 di->SEQ_number = BADSEQNUM;
4105
4106 save_state = peer_tep->te_state;
4107 peer_tep->te_state = TS_IDLE;
4108 } else {
4109 /* Not connected */
4110 tep->te_state = new_state;
4111 freemsg(respmp);
4112 return;
4113 }
4114
4115 /* Commit state changes */
4116 tep->te_state = new_state;
4117
4118 if (peer_tep == NULL) {
4119 ASSERT(dimp == NULL);
4120 goto done;
4121 }
4122 /*
4123 * Flush queues on peer before sending up
4124 * T_DISCON_IND according to TPI
4125 */
4126
4127 if ((save_state == TS_DATA_XFER) ||
4128 (save_state == TS_WIND_ORDREL) ||
4129 (save_state == TS_WREQ_ORDREL))
4130 (void) putnextctl1(peer_tep->te_rq, M_FLUSH, FLUSHRW);
4131
4132 DB_TYPE(dimp) = M_PROTO;
4133 di->PRIM_type = T_DISCON_IND;
4134 di->DISCON_reason = ECONNRESET;
4135
4136 /*
4137 * data blocks already linked into dimp by reallocb()
4138 */
4139 /*
4140 * send indication message to peer user module
4141 */
4142 ASSERT(dimp != NULL);
4143 putnext(peer_tep->te_rq, dimp);
4144 done:
4145 if (tep->te_conp) { /* disconnect pointers if connected */
4146 ASSERT(! peer_tep->te_closing);
4147
4148 /*
4149 * Messages may be queued on peer's write queue
4150 * waiting to be processed by its write service
4151 * procedure. Before the pointer to the peer transport
4152 * structure is set to NULL, qenable the peer's write
4153 * queue so that the queued up messages are processed.
4154 */
4155 if ((save_state == TS_DATA_XFER) ||
4156 (save_state == TS_WIND_ORDREL) ||
4157 (save_state == TS_WREQ_ORDREL))
4158 TL_QENABLE(peer_tep);
4159 ASSERT(peer_tep != NULL && peer_tep->te_conp != NULL);
4160 TL_UNCONNECT(peer_tep->te_conp);
4161 if (! IS_SOCKET(tep)) {
4162 /*
4163 * unlink the streams
4164 */
4165 tep->te_wq->q_next = NULL;
4166 peer_tep->te_wq->q_next = NULL;
4167 }
4168 TL_UNCONNECT(tep->te_conp);
4169 }
4170 }
4171
4172 static void
4173 tl_addr_req_ser(mblk_t *mp, tl_endpt_t *tep)
4174 {
4175 if (!tep->te_closing)
4176 tl_addr_req(mp, tep);
4177 else
4178 freemsg(mp);
4179
4180 tl_serializer_exit(tep);
4181 tl_refrele(tep);
4182 }
4183
4184 static void
4185 tl_addr_req(mblk_t *mp, tl_endpt_t *tep)
4186 {
4187 queue_t *wq;
4188 size_t ack_sz;
4189 mblk_t *ackmp;
4190 struct T_addr_ack *taa;
4191
4192 if (tep->te_closing) {
4193 freemsg(mp);
4194 return;
4195 }
4196
4197 wq = tep->te_wq;
4198
4199 /*
4200 * Note: T_ADDR_REQ message has only PRIM_type field
4201 * so it is already validated earlier.
4202 */
4203
4204 if (IS_CLTS(tep) ||
4205 (tep->te_state > TS_WREQ_ORDREL) ||
4206 (tep->te_state < TS_DATA_XFER)) {
4207 /*
4208 * Either connectionless or connection oriented but not
4209 * in connected data transfer state or half-closed states.
4210 */
4211 ack_sz = sizeof (struct T_addr_ack);
4212 if (tep->te_state >= TS_IDLE)
4213 /* is bound */
4214 ack_sz += tep->te_alen;
4215 ackmp = reallocb(mp, ack_sz, 0);
4216 if (ackmp == NULL) {
4217 (void) (STRLOG(TL_ID, tep->te_minor, 1,
4218 SL_TRACE|SL_ERROR,
4219 "tl_addr_req: reallocb failed"));
4220 tl_memrecover(wq, mp, ack_sz);
4221 return;
4222 }
4223
4224 taa = (struct T_addr_ack *)ackmp->b_rptr;
4225
4226 bzero(taa, sizeof (struct T_addr_ack));
4227
4228 taa->PRIM_type = T_ADDR_ACK;
4229 ackmp->b_datap->db_type = M_PCPROTO;
4230 ackmp->b_wptr = (uchar_t *)&taa[1];
4231
4232 if (tep->te_state >= TS_IDLE) {
4233 /* endpoint is bound */
4234 taa->LOCADDR_length = tep->te_alen;
4235 taa->LOCADDR_offset = (t_scalar_t)sizeof (*taa);
4236
4237 bcopy(tep->te_abuf, ackmp->b_wptr,
4238 tep->te_alen);
4239 ackmp->b_wptr += tep->te_alen;
4240 ASSERT(ackmp->b_wptr <= ackmp->b_datap->db_lim);
4241 }
4242
4243 (void) qreply(wq, ackmp);
4244 } else {
4245 ASSERT(tep->te_state == TS_DATA_XFER ||
4246 tep->te_state == TS_WIND_ORDREL ||
4247 tep->te_state == TS_WREQ_ORDREL);
4248 /* connection oriented in data transfer */
4249 tl_connected_cots_addr_req(mp, tep);
4250 }
4251 }
4252
4253
4254 static void
4255 tl_connected_cots_addr_req(mblk_t *mp, tl_endpt_t *tep)
4256 {
4257 tl_endpt_t *peer_tep = tep->te_conp;
4258 size_t ack_sz;
4259 mblk_t *ackmp;
4260 struct T_addr_ack *taa;
4261 uchar_t *addr_startp;
4262
4263 if (tep->te_closing) {
4264 freemsg(mp);
4265 return;
4266 }
4267
4268 if (peer_tep == NULL || peer_tep->te_closing) {
4269 tl_error_ack(tep->te_wq, mp, TSYSERR, ECONNRESET, T_ADDR_REQ);
4270 return;
4271 }
4272
4273 ASSERT(tep->te_state >= TS_IDLE);
4274
4275 ack_sz = sizeof (struct T_addr_ack);
4276 ack_sz += T_ALIGN(tep->te_alen);
4277 ack_sz += peer_tep->te_alen;
4278
4279 ackmp = tpi_ack_alloc(mp, ack_sz, M_PCPROTO, T_ADDR_ACK);
4280 if (ackmp == NULL) {
4281 (void) (STRLOG(TL_ID, tep->te_minor, 1, SL_TRACE|SL_ERROR,
4282 "tl_connected_cots_addr_req: reallocb failed"));
4283 tl_memrecover(tep->te_wq, mp, ack_sz);
4284 return;
4285 }
4286
4287 taa = (struct T_addr_ack *)ackmp->b_rptr;
4288
4289 /* endpoint is bound */
4290 taa->LOCADDR_length = tep->te_alen;
4291 taa->LOCADDR_offset = (t_scalar_t)sizeof (*taa);
4292
4293 addr_startp = (uchar_t *)&taa[1];
4294
4295 bcopy(tep->te_abuf, addr_startp,
4296 tep->te_alen);
4297
4298 taa->REMADDR_length = peer_tep->te_alen;
4299 taa->REMADDR_offset = (t_scalar_t)T_ALIGN(taa->LOCADDR_offset +
4300 taa->LOCADDR_length);
4301 addr_startp = ackmp->b_rptr + taa->REMADDR_offset;
4302 bcopy(peer_tep->te_abuf, addr_startp,
4303 peer_tep->te_alen);
4304 ackmp->b_wptr = (uchar_t *)ackmp->b_rptr +
4305 taa->REMADDR_offset + peer_tep->te_alen;
4306 ASSERT(ackmp->b_wptr <= ackmp->b_datap->db_lim);
4307
4308 putnext(tep->te_rq, ackmp);
4309 }
4310
4311 static void
4312 tl_copy_info(struct T_info_ack *ia, tl_endpt_t *tep)
4313 {
4314 if (IS_CLTS(tep)) {
4315 *ia = tl_clts_info_ack;
4316 ia->TSDU_size = tl_tidusz; /* TSDU and TIDU size are same */
4317 } else {
4318 *ia = tl_cots_info_ack;
4319 if (IS_COTSORD(tep))
4320 ia->SERV_type = T_COTS_ORD;
4321 }
4322 ia->TIDU_size = tl_tidusz;
4323 ia->CURRENT_state = tep->te_state;
4324 }
4325
4326 /*
4327 * This routine responds to T_CAPABILITY_REQ messages. It is called by
4328 * tl_wput.
4329 */
4330 static void
4331 tl_capability_req(mblk_t *mp, tl_endpt_t *tep)
4332 {
4333 mblk_t *ackmp;
4334 t_uscalar_t cap_bits1;
4335 struct T_capability_ack *tcap;
4336
4337 if (tep->te_closing) {
4338 freemsg(mp);
4339 return;
4340 }
4341
4342 cap_bits1 = ((struct T_capability_req *)mp->b_rptr)->CAP_bits1;
4343
4344 ackmp = tpi_ack_alloc(mp, sizeof (struct T_capability_ack),
4345 M_PCPROTO, T_CAPABILITY_ACK);
4346 if (ackmp == NULL) {
4347 (void) (STRLOG(TL_ID, tep->te_minor, 1, SL_TRACE|SL_ERROR,
4348 "tl_capability_req: reallocb failed"));
4349 tl_memrecover(tep->te_wq, mp,
4350 sizeof (struct T_capability_ack));
4351 return;
4352 }
4353
4354 tcap = (struct T_capability_ack *)ackmp->b_rptr;
4355 tcap->CAP_bits1 = 0;
4356
4357 if (cap_bits1 & TC1_INFO) {
4358 tl_copy_info(&tcap->INFO_ack, tep);
4359 tcap->CAP_bits1 |= TC1_INFO;
4360 }
4361
4362 if (cap_bits1 & TC1_ACCEPTOR_ID) {
4363 tcap->ACCEPTOR_id = tep->te_acceptor_id;
4364 tcap->CAP_bits1 |= TC1_ACCEPTOR_ID;
4365 }
4366
4367 putnext(tep->te_rq, ackmp);
4368 }
4369
4370 static void
4371 tl_info_req_ser(mblk_t *mp, tl_endpt_t *tep)
4372 {
4373 if (! tep->te_closing)
4374 tl_info_req(mp, tep);
4375 else
4376 freemsg(mp);
4377
4378 tl_serializer_exit(tep);
4379 tl_refrele(tep);
4380 }
4381
4382 static void
4383 tl_info_req(mblk_t *mp, tl_endpt_t *tep)
4384 {
4385 mblk_t *ackmp;
4386
4387 ackmp = tpi_ack_alloc(mp, sizeof (struct T_info_ack),
4388 M_PCPROTO, T_INFO_ACK);
4389 if (ackmp == NULL) {
4390 (void) (STRLOG(TL_ID, tep->te_minor, 1, SL_TRACE|SL_ERROR,
4391 "tl_info_req: reallocb failed"));
4392 tl_memrecover(tep->te_wq, mp, sizeof (struct T_info_ack));
4393 return;
4394 }
4395
4396 /*
4397 * fill in T_INFO_ACK contents
4398 */
4399 tl_copy_info((struct T_info_ack *)ackmp->b_rptr, tep);
4400
4401 /*
4402 * send ack message
4403 */
4404 putnext(tep->te_rq, ackmp);
4405 }
4406
4407 /*
4408 * Handle M_DATA, T_data_req and T_optdata_req.
4409 * If this is a socket pass through T_optdata_req options unmodified.
4410 */
4411 static void
4412 tl_data(mblk_t *mp, tl_endpt_t *tep)
4413 {
4414 queue_t *wq = tep->te_wq;
4415 union T_primitives *prim = (union T_primitives *)mp->b_rptr;
4416 ssize_t msz = MBLKL(mp);
4417 tl_endpt_t *peer_tep;
4418 queue_t *peer_rq;
4419 boolean_t closing = tep->te_closing;
4420
4421 if (IS_CLTS(tep)) {
4422 (void) (STRLOG(TL_ID, tep->te_minor, 2,
4423 SL_TRACE|SL_ERROR,
4424 "tl_wput:clts:unattached M_DATA"));
4425 if (!closing) {
4426 tl_merror(wq, mp, EPROTO);
4427 } else {
4428 freemsg(mp);
4429 }
4430 return;
4431 }
4432
4433 /*
4434 * If the endpoint is closing it should still forward any data to the
4435 * peer (if it has one). If it is not allowed to forward it can just
4436 * free the message.
4437 */
4438 if (closing &&
4439 (tep->te_state != TS_DATA_XFER) &&
4440 (tep->te_state != TS_WREQ_ORDREL)) {
4441 freemsg(mp);
4442 return;
4443 }
4444
4445 if (DB_TYPE(mp) == M_PROTO) {
4446 if (prim->type == T_DATA_REQ &&
4447 msz < sizeof (struct T_data_req)) {
4448 (void) (STRLOG(TL_ID, tep->te_minor, 1,
4449 SL_TRACE|SL_ERROR,
4450 "tl_data:T_DATA_REQ:invalid message"));
4451 if (!closing) {
4452 tl_merror(wq, mp, EPROTO);
4453 } else {
4454 freemsg(mp);
4455 }
4456 return;
4457 } else if (prim->type == T_OPTDATA_REQ &&
4458 (msz < sizeof (struct T_optdata_req) || !IS_SOCKET(tep))) {
4459 (void) (STRLOG(TL_ID, tep->te_minor, 1,
4460 SL_TRACE|SL_ERROR,
4461 "tl_data:T_OPTDATA_REQ:invalid message"));
4462 if (!closing) {
4463 tl_merror(wq, mp, EPROTO);
4464 } else {
4465 freemsg(mp);
4466 }
4467 return;
4468 }
4469 }
4470
4471 /*
4472 * connection oriented provider
4473 */
4474 switch (tep->te_state) {
4475 case TS_IDLE:
4476 /*
4477 * Other end not here - do nothing.
4478 */
4479 freemsg(mp);
4480 (void) (STRLOG(TL_ID, tep->te_minor, 3, SL_TRACE|SL_ERROR,
4481 "tl_data:cots with endpoint idle"));
4482 return;
4483
4484 case TS_DATA_XFER:
4485 /* valid states */
4486 if (tep->te_conp != NULL)
4487 break;
4488
4489 if (tep->te_oconp == NULL) {
4490 if (!closing) {
4491 tl_merror(wq, mp, EPROTO);
4492 } else {
4493 freemsg(mp);
4494 }
4495 return;
4496 }
4497 /*
4498 * For a socket the T_CONN_CON is sent early thus
4499 * the peer might not yet have accepted the connection.
4500 * If we are closing queue the packet with the T_CONN_IND.
4501 * Otherwise defer processing the packet until the peer
4502 * accepts the connection.
4503 * Note that the queue is noenabled when we go into this
4504 * state.
4505 */
4506 if (!closing) {
4507 (void) (STRLOG(TL_ID, tep->te_minor, 1,
4508 SL_TRACE|SL_ERROR,
4509 "tl_data: ocon"));
4510 TL_PUTBQ(tep, mp);
4511 return;
4512 }
4513 if (DB_TYPE(mp) == M_PROTO) {
4514 if (msz < sizeof (t_scalar_t)) {
4515 freemsg(mp);
4516 return;
4517 }
4518 /* reuse message block - just change REQ to IND */
4519 if (prim->type == T_DATA_REQ)
4520 prim->type = T_DATA_IND;
4521 else
4522 prim->type = T_OPTDATA_IND;
4523 }
4524 tl_icon_queuemsg(tep->te_oconp, tep->te_seqno, mp);
4525 return;
4526
4527 case TS_WREQ_ORDREL:
4528 if (tep->te_conp == NULL) {
4529 /*
4530 * Other end closed - generate discon_ind
4531 * with reason 0 to cause an EPIPE but no
4532 * read side error on AF_UNIX sockets.
4533 */
4534 freemsg(mp);
4535 (void) (STRLOG(TL_ID, tep->te_minor, 3,
4536 SL_TRACE|SL_ERROR,
4537 "tl_data: WREQ_ORDREL and no peer"));
4538 tl_discon_ind(tep, 0);
4539 return;
4540 }
4541 break;
4542
4543 default:
4544 /* invalid state for event TE_DATA_REQ */
4545 (void) (STRLOG(TL_ID, tep->te_minor, 1, SL_TRACE|SL_ERROR,
4546 "tl_data:cots:out of state"));
4547 tl_merror(wq, mp, EPROTO);
4548 return;
4549 }
4550 /*
4551 * tep->te_state = NEXTSTATE(TE_DATA_REQ, tep->te_state);
4552 * (State stays same on this event)
4553 */
4554
4555 /*
4556 * get connected endpoint
4557 */
4558 if (((peer_tep = tep->te_conp) == NULL) || peer_tep->te_closing) {
4559 freemsg(mp);
4560 /* Peer closed */
4561 (void) (STRLOG(TL_ID, tep->te_minor, 3, SL_TRACE,
4562 "tl_data: peer gone"));
4563 return;
4564 }
4565
4566 ASSERT(tep->te_serializer == peer_tep->te_serializer);
4567 peer_rq = peer_tep->te_rq;
4568
4569 /*
4570 * Put it back if flow controlled
4571 * Note: Messages already on queue when we are closing is bounded
4572 * so we can ignore flow control.
4573 */
4574 if (!canputnext(peer_rq) && !closing) {
4575 TL_PUTBQ(tep, mp);
4576 return;
4577 }
4578
4579 /*
4580 * validate peer state
4581 */
4582 switch (peer_tep->te_state) {
4583 case TS_DATA_XFER:
4584 case TS_WIND_ORDREL:
4585 /* valid states */
4586 break;
4587 default:
4588 (void) (STRLOG(TL_ID, tep->te_minor, 1, SL_TRACE|SL_ERROR,
4589 "tl_data:rx side:invalid state"));
4590 tl_merror(peer_tep->te_wq, mp, EPROTO);
4591 return;
4592 }
4593 if (DB_TYPE(mp) == M_PROTO) {
4594 /* reuse message block - just change REQ to IND */
4595 if (prim->type == T_DATA_REQ)
4596 prim->type = T_DATA_IND;
4597 else
4598 prim->type = T_OPTDATA_IND;
4599 }
4600 /*
4601 * peer_tep->te_state = NEXTSTATE(TE_DATA_IND, peer_tep->te_state);
4602 * (peer state stays same on this event)
4603 */
4604 /*
4605 * send data to connected peer
4606 */
4607 putnext(peer_rq, mp);
4608 }
4609
4610
4611
4612 static void
4613 tl_exdata(mblk_t *mp, tl_endpt_t *tep)
4614 {
4615 queue_t *wq = tep->te_wq;
4616 union T_primitives *prim = (union T_primitives *)mp->b_rptr;
4617 ssize_t msz = MBLKL(mp);
4618 tl_endpt_t *peer_tep;
4619 queue_t *peer_rq;
4620 boolean_t closing = tep->te_closing;
4621
4622 if (msz < sizeof (struct T_exdata_req)) {
4623 (void) (STRLOG(TL_ID, tep->te_minor, 1, SL_TRACE|SL_ERROR,
4624 "tl_exdata:invalid message"));
4625 if (!closing) {
4626 tl_merror(wq, mp, EPROTO);
4627 } else {
4628 freemsg(mp);
4629 }
4630 return;
4631 }
4632
4633 /*
4634 * If the endpoint is closing it should still forward any data to the
4635 * peer (if it has one). If it is not allowed to forward it can just
4636 * free the message.
4637 */
4638 if (closing &&
4639 (tep->te_state != TS_DATA_XFER) &&
4640 (tep->te_state != TS_WREQ_ORDREL)) {
4641 freemsg(mp);
4642 return;
4643 }
4644
4645 /*
4646 * validate state
4647 */
4648 switch (tep->te_state) {
4649 case TS_IDLE:
4650 /*
4651 * Other end not here - do nothing.
4652 */
4653 freemsg(mp);
4654 (void) (STRLOG(TL_ID, tep->te_minor, 3, SL_TRACE|SL_ERROR,
4655 "tl_exdata:cots with endpoint idle"));
4656 return;
4657
4658 case TS_DATA_XFER:
4659 /* valid states */
4660 if (tep->te_conp != NULL)
4661 break;
4662
4663 if (tep->te_oconp == NULL) {
4664 if (!closing) {
4665 tl_merror(wq, mp, EPROTO);
4666 } else {
4667 freemsg(mp);
4668 }
4669 return;
4670 }
4671 /*
4672 * For a socket the T_CONN_CON is sent early thus
4673 * the peer might not yet have accepted the connection.
4674 * If we are closing queue the packet with the T_CONN_IND.
4675 * Otherwise defer processing the packet until the peer
4676 * accepts the connection.
4677 * Note that the queue is noenabled when we go into this
4678 * state.
4679 */
4680 if (!closing) {
4681 (void) (STRLOG(TL_ID, tep->te_minor, 1,
4682 SL_TRACE|SL_ERROR,
4683 "tl_exdata: ocon"));
4684 TL_PUTBQ(tep, mp);
4685 return;
4686 }
4687 (void) (STRLOG(TL_ID, tep->te_minor, 1, SL_TRACE|SL_ERROR,
4688 "tl_exdata: closing socket ocon"));
4689 prim->type = T_EXDATA_IND;
4690 tl_icon_queuemsg(tep->te_oconp, tep->te_seqno, mp);
4691 return;
4692
4693 case TS_WREQ_ORDREL:
4694 if (tep->te_conp == NULL) {
4695 /*
4696 * Other end closed - generate discon_ind
4697 * with reason 0 to cause an EPIPE but no
4698 * read side error on AF_UNIX sockets.
4699 */
4700 freemsg(mp);
4701 (void) (STRLOG(TL_ID, tep->te_minor, 3,
4702 SL_TRACE|SL_ERROR,
4703 "tl_exdata: WREQ_ORDREL and no peer"));
4704 tl_discon_ind(tep, 0);
4705 return;
4706 }
4707 break;
4708
4709 default:
4710 (void) (STRLOG(TL_ID, tep->te_minor, 1,
4711 SL_TRACE|SL_ERROR,
4712 "tl_wput:T_EXDATA_REQ:out of state, state=%d",
4713 tep->te_state));
4714 tl_merror(wq, mp, EPROTO);
4715 return;
4716 }
4717 /*
4718 * tep->te_state = NEXTSTATE(TE_EXDATA_REQ, tep->te_state);
4719 * (state stays same on this event)
4720 */
4721
4722 /*
4723 * get connected endpoint
4724 */
4725 if (((peer_tep = tep->te_conp) == NULL) || peer_tep->te_closing) {
4726 freemsg(mp);
4727 /* Peer closed */
4728 (void) (STRLOG(TL_ID, tep->te_minor, 3, SL_TRACE,
4729 "tl_exdata: peer gone"));
4730 return;
4731 }
4732
4733 peer_rq = peer_tep->te_rq;
4734
4735 /*
4736 * Put it back if flow controlled
4737 * Note: Messages already on queue when we are closing is bounded
4738 * so we can ignore flow control.
4739 */
4740 if (!canputnext(peer_rq) && !closing) {
4741 TL_PUTBQ(tep, mp);
4742 return;
4743 }
4744
4745 /*
4746 * validate state on peer
4747 */
4748 switch (peer_tep->te_state) {
4749 case TS_DATA_XFER:
4750 case TS_WIND_ORDREL:
4751 /* valid states */
4752 break;
4753 default:
4754 (void) (STRLOG(TL_ID, tep->te_minor, 1, SL_TRACE|SL_ERROR,
4755 "tl_exdata:rx side:invalid state"));
4756 tl_merror(peer_tep->te_wq, mp, EPROTO);
4757 return;
4758 }
4759 /*
4760 * peer_tep->te_state = NEXTSTATE(TE_DATA_IND, peer_tep->te_state);
4761 * (peer state stays same on this event)
4762 */
4763 /*
4764 * reuse message block
4765 */
4766 prim->type = T_EXDATA_IND;
4767
4768 /*
4769 * send data to connected peer
4770 */
4771 putnext(peer_rq, mp);
4772 }
4773
4774
4775
4776 static void
4777 tl_ordrel(mblk_t *mp, tl_endpt_t *tep)
4778 {
4779 queue_t *wq = tep->te_wq;
4780 union T_primitives *prim = (union T_primitives *)mp->b_rptr;
4781 ssize_t msz = MBLKL(mp);
4782 tl_endpt_t *peer_tep;
4783 queue_t *peer_rq;
4784 boolean_t closing = tep->te_closing;
4785
4786 if (msz < sizeof (struct T_ordrel_req)) {
4787 (void) (STRLOG(TL_ID, tep->te_minor, 1, SL_TRACE|SL_ERROR,
4788 "tl_ordrel:invalid message"));
4789 if (!closing) {
4790 tl_merror(wq, mp, EPROTO);
4791 } else {
4792 freemsg(mp);
4793 }
4794 return;
4795 }
4796
4797 /*
4798 * validate state
4799 */
4800 switch (tep->te_state) {
4801 case TS_DATA_XFER:
4802 case TS_WREQ_ORDREL:
4803 /* valid states */
4804 if (tep->te_conp != NULL)
4805 break;
4806
4807 if (tep->te_oconp == NULL)
4808 break;
4809
4810 /*
4811 * For a socket the T_CONN_CON is sent early thus
4812 * the peer might not yet have accepted the connection.
4813 * If we are closing queue the packet with the T_CONN_IND.
4814 * Otherwise defer processing the packet until the peer
4815 * accepts the connection.
4816 * Note that the queue is noenabled when we go into this
4817 * state.
4818 */
4819 if (!closing) {
4820 (void) (STRLOG(TL_ID, tep->te_minor, 1,
4821 SL_TRACE|SL_ERROR,
4822 "tl_ordlrel: ocon"));
4823 TL_PUTBQ(tep, mp);
4824 return;
4825 }
4826 (void) (STRLOG(TL_ID, tep->te_minor, 1, SL_TRACE|SL_ERROR,
4827 "tl_ordlrel: closing socket ocon"));
4828 prim->type = T_ORDREL_IND;
4829 (void) tl_icon_queuemsg(tep->te_oconp, tep->te_seqno, mp);
4830 return;
4831
4832 default:
4833 (void) (STRLOG(TL_ID, tep->te_minor, 1,
4834 SL_TRACE|SL_ERROR,
4835 "tl_wput:T_ORDREL_REQ:out of state, state=%d",
4836 tep->te_state));
4837 if (!closing) {
4838 tl_merror(wq, mp, EPROTO);
4839 } else {
4840 freemsg(mp);
4841 }
4842 return;
4843 }
4844 tep->te_state = NEXTSTATE(TE_ORDREL_REQ, tep->te_state);
4845
4846 /*
4847 * get connected endpoint
4848 */
4849 if (((peer_tep = tep->te_conp) == NULL) || peer_tep->te_closing) {
4850 /* Peer closed */
4851 (void) (STRLOG(TL_ID, tep->te_minor, 3, SL_TRACE,
4852 "tl_ordrel: peer gone"));
4853 freemsg(mp);
4854 return;
4855 }
4856
4857 peer_rq = peer_tep->te_rq;
4858
4859 /*
4860 * Put it back if flow controlled except when we are closing.
4861 * Note: Messages already on queue when we are closing is bounded
4862 * so we can ignore flow control.
4863 */
4864 if (! canputnext(peer_rq) && !closing) {
4865 TL_PUTBQ(tep, mp);
4866 return;
4867 }
4868
4869 /*
4870 * validate state on peer
4871 */
4872 switch (peer_tep->te_state) {
4873 case TS_DATA_XFER:
4874 case TS_WIND_ORDREL:
4875 /* valid states */
4876 break;
4877 default:
4878 (void) (STRLOG(TL_ID, tep->te_minor, 1, SL_TRACE|SL_ERROR,
4879 "tl_ordrel:rx side:invalid state"));
4880 tl_merror(peer_tep->te_wq, mp, EPROTO);
4881 return;
4882 }
4883 peer_tep->te_state = NEXTSTATE(TE_ORDREL_IND, peer_tep->te_state);
4884
4885 /*
4886 * reuse message block
4887 */
4888 prim->type = T_ORDREL_IND;
4889 (void) (STRLOG(TL_ID, tep->te_minor, 3, SL_TRACE,
4890 "tl_ordrel: send ordrel_ind"));
4891
4892 /*
4893 * send data to connected peer
4894 */
4895 putnext(peer_rq, mp);
4896 }
4897
4898
4899 /*
4900 * Send T_UDERROR_IND. The error should be from the <sys/errno.h> space.
4901 */
4902 static void
4903 tl_uderr(queue_t *wq, mblk_t *mp, t_scalar_t err)
4904 {
4905 size_t err_sz;
4906 tl_endpt_t *tep;
4907 struct T_unitdata_req *udreq;
4908 mblk_t *err_mp;
4909 t_scalar_t alen;
4910 t_scalar_t olen;
4911 struct T_uderror_ind *uderr;
4912 uchar_t *addr_startp;
4913
4914 err_sz = sizeof (struct T_uderror_ind);
4915 tep = (tl_endpt_t *)wq->q_ptr;
4916 udreq = (struct T_unitdata_req *)mp->b_rptr;
4917 alen = udreq->DEST_length;
4918 olen = udreq->OPT_length;
4919
4920 if (alen > 0)
4921 err_sz = T_ALIGN(err_sz + alen);
4922 if (olen > 0)
4923 err_sz += olen;
4924
4925 err_mp = allocb(err_sz, BPRI_MED);
4926 if (! err_mp) {
4927 (void) (STRLOG(TL_ID, tep->te_minor, 3, SL_TRACE|SL_ERROR,
4928 "tl_uderr:allocb failure"));
4929 /*
4930 * Note: no rollback of state needed as it does
4931 * not change in connectionless transport
4932 */
4933 tl_memrecover(wq, mp, err_sz);
4934 return;
4935 }
4936
4937 DB_TYPE(err_mp) = M_PROTO;
4938 err_mp->b_wptr = err_mp->b_rptr + err_sz;
4939 uderr = (struct T_uderror_ind *)err_mp->b_rptr;
4940 uderr->PRIM_type = T_UDERROR_IND;
4941 uderr->ERROR_type = err;
4942 uderr->DEST_length = alen;
4943 uderr->OPT_length = olen;
4944 if (alen <= 0) {
4945 uderr->DEST_offset = 0;
4946 } else {
4947 uderr->DEST_offset =
4948 (t_scalar_t)sizeof (struct T_uderror_ind);
4949 addr_startp = mp->b_rptr + udreq->DEST_offset;
4950 bcopy(addr_startp, err_mp->b_rptr + uderr->DEST_offset,
4951 (size_t)alen);
4952 }
4953 if (olen <= 0) {
4954 uderr->OPT_offset = 0;
4955 } else {
4956 uderr->OPT_offset =
4957 (t_scalar_t)T_ALIGN(sizeof (struct T_uderror_ind) +
4958 uderr->DEST_length);
4959 addr_startp = mp->b_rptr + udreq->OPT_offset;
4960 bcopy(addr_startp, err_mp->b_rptr+uderr->OPT_offset,
4961 (size_t)olen);
4962 }
4963 freemsg(mp);
4964
4965 /*
4966 * send indication message
4967 */
4968 tep->te_state = NEXTSTATE(TE_UDERROR_IND, tep->te_state);
4969
4970 qreply(wq, err_mp);
4971 }
4972
4973 static void
4974 tl_unitdata_ser(mblk_t *mp, tl_endpt_t *tep)
4975 {
4976 queue_t *wq = tep->te_wq;
4977
4978 if (!tep->te_closing && (wq->q_first != NULL)) {
4979 TL_PUTQ(tep, mp);
4980 } else if (tep->te_rq != NULL)
4981 tl_unitdata(mp, tep);
4982 else
4983 freemsg(mp);
4984
4985 tl_serializer_exit(tep);
4986 tl_refrele(tep);
4987 }
4988
4989 /*
4990 * Handle T_unitdata_req.
4991 * If TL_SET[U]CRED or TL_SOCKUCRED generate the credentials options.
4992 * If this is a socket pass through options unmodified.
4993 */
4994 static void
4995 tl_unitdata(mblk_t *mp, tl_endpt_t *tep)
4996 {
4997 queue_t *wq = tep->te_wq;
4998 soux_addr_t ux_addr;
4999 tl_addr_t destaddr;
5000 uchar_t *addr_startp;
5001 tl_endpt_t *peer_tep;
5002 struct T_unitdata_ind *udind;
5003 struct T_unitdata_req *udreq;
5004 ssize_t msz, ui_sz, reuse_mb_sz;
5005 t_scalar_t alen, aoff, olen, ooff;
5006 t_scalar_t oldolen = 0;
5007 cred_t *cr = NULL;
5008 pid_t cpid;
5009
5010 udreq = (struct T_unitdata_req *)mp->b_rptr;
5011 msz = MBLKL(mp);
5012
5013 /*
5014 * validate the state
5015 */
5016 if (tep->te_state != TS_IDLE) {
5017 (void) (STRLOG(TL_ID, tep->te_minor, 1,
5018 SL_TRACE|SL_ERROR,
5019 "tl_wput:T_CONN_REQ:out of state"));
5020 tl_merror(wq, mp, EPROTO);
5021 return;
5022 }
5023 /*
5024 * tep->te_state = NEXTSTATE(TE_UNITDATA_REQ, tep->te_state);
5025 * (state does not change on this event)
5026 */
5027
5028 /*
5029 * validate the message
5030 * Note: dereference fields in struct inside message only
5031 * after validating the message length.
5032 */
5033 if (msz < sizeof (struct T_unitdata_req)) {
5034 (void) (STRLOG(TL_ID, tep->te_minor, 1, SL_TRACE|SL_ERROR,
5035 "tl_unitdata:invalid message length"));
5036 tl_merror(wq, mp, EINVAL);
5037 return;
5038 }
5039 alen = udreq->DEST_length;
5040 aoff = udreq->DEST_offset;
5041 oldolen = olen = udreq->OPT_length;
5042 ooff = udreq->OPT_offset;
5043 if (olen == 0)
5044 ooff = 0;
5045
5046 if (IS_SOCKET(tep)) {
5047 if ((alen != TL_SOUX_ADDRLEN) ||
5048 (aoff < 0) ||
5049 (aoff + alen > msz) ||
5050 (olen < 0) || (ooff < 0) ||
5051 ((olen > 0) && ((ooff + olen) > msz))) {
5052 (void) (STRLOG(TL_ID, tep->te_minor,
5053 1, SL_TRACE|SL_ERROR,
5054 "tl_unitdata_req: invalid socket addr "
5055 "(msz=%d, al=%d, ao=%d, ol=%d, oo = %d)",
5056 (int)msz, alen, aoff, olen, ooff));
5057 tl_error_ack(wq, mp, TSYSERR, EINVAL, T_UNITDATA_REQ);
5058 return;
5059 }
5060 bcopy(mp->b_rptr + aoff, &ux_addr, TL_SOUX_ADDRLEN);
5061
5062 if ((ux_addr.soua_magic != SOU_MAGIC_IMPLICIT) &&
5063 (ux_addr.soua_magic != SOU_MAGIC_EXPLICIT)) {
5064 (void) (STRLOG(TL_ID, tep->te_minor,
5065 1, SL_TRACE|SL_ERROR,
5066 "tl_conn_req: invalid socket magic"));
5067 tl_error_ack(wq, mp, TSYSERR, EINVAL, T_UNITDATA_REQ);
5068 return;
5069 }
5070 } else {
5071 if ((alen < 0) ||
5072 (aoff < 0) ||
5073 ((alen > 0) && ((aoff + alen) > msz)) ||
5074 ((ssize_t)alen > (msz - sizeof (struct T_unitdata_req))) ||
5075 ((aoff + alen) < 0) ||
5076 ((olen > 0) && ((ooff + olen) > msz)) ||
5077 (olen < 0) ||
5078 (ooff < 0) ||
5079 ((ssize_t)olen > (msz - sizeof (struct T_unitdata_req)))) {
5080 (void) (STRLOG(TL_ID, tep->te_minor, 1,
5081 SL_TRACE|SL_ERROR,
5082 "tl_unitdata:invalid unit data message"));
5083 tl_merror(wq, mp, EINVAL);
5084 return;
5085 }
5086 }
5087
5088 /* Options not supported unless it's a socket */
5089 if (alen == 0 || (olen != 0 && !IS_SOCKET(tep))) {
5090 (void) (STRLOG(TL_ID, tep->te_minor, 3, SL_TRACE|SL_ERROR,
5091 "tl_unitdata:option use(unsupported) or zero len addr"));
5092 tl_uderr(wq, mp, EPROTO);
5093 return;
5094 }
5095 #ifdef DEBUG
5096 /*
5097 * Mild form of ASSERT()ion to detect broken TPI apps.
5098 * if (! assertion)
5099 * log warning;
5100 */
5101 if (! (aoff >= (t_scalar_t)sizeof (struct T_unitdata_req))) {
5102 (void) (STRLOG(TL_ID, tep->te_minor, 3, SL_TRACE|SL_ERROR,
5103 "tl_unitdata:addr overlaps TPI message"));
5104 }
5105 #endif
5106 /*
5107 * get destination endpoint
5108 */
5109 destaddr.ta_alen = alen;
5110 destaddr.ta_abuf = mp->b_rptr + aoff;
5111 destaddr.ta_zoneid = tep->te_zoneid;
5112
5113 /*
5114 * Check whether the destination is the same that was used previously
5115 * and the destination endpoint is in the right state. If something is
5116 * wrong, find destination again and cache it.
5117 */
5118 peer_tep = tep->te_lastep;
5119
5120 if ((peer_tep == NULL) || peer_tep->te_closing ||
5121 (peer_tep->te_state != TS_IDLE) ||
5122 !tl_eqaddr(&destaddr, &peer_tep->te_ap)) {
5123 /*
5124 * Not the same as cached destination , need to find the right
5125 * destination.
5126 */
5127 peer_tep = (IS_SOCKET(tep) ?
5128 tl_sock_find_peer(tep, &ux_addr) :
5129 tl_find_peer(tep, &destaddr));
5130
5131 if (peer_tep == NULL) {
5132 (void) (STRLOG(TL_ID, tep->te_minor, 3,
5133 SL_TRACE|SL_ERROR,
5134 "tl_unitdata:no one at destination address"));
5135 tl_uderr(wq, mp, ECONNRESET);
5136 return;
5137 }
5138
5139 /*
5140 * Cache the new peer.
5141 */
5142 if (tep->te_lastep != NULL)
5143 tl_refrele(tep->te_lastep);
5144
5145 tep->te_lastep = peer_tep;
5146 }
5147
5148 if (peer_tep->te_state != TS_IDLE) {
5149 (void) (STRLOG(TL_ID, tep->te_minor, 1, SL_TRACE|SL_ERROR,
5150 "tl_unitdata:provider in invalid state"));
5151 tl_uderr(wq, mp, EPROTO);
5152 return;
5153 }
5154
5155 ASSERT(peer_tep->te_rq != NULL);
5156
5157 /*
5158 * Put it back if flow controlled except when we are closing.
5159 * Note: Messages already on queue when we are closing is bounded
5160 * so we can ignore flow control.
5161 */
5162 if (!canputnext(peer_tep->te_rq) && !(tep->te_closing)) {
5163 /* record what we are flow controlled on */
5164 if (tep->te_flowq != NULL) {
5165 list_remove(&tep->te_flowq->te_flowlist, tep);
5166 }
5167 list_insert_head(&peer_tep->te_flowlist, tep);
5168 tep->te_flowq = peer_tep;
5169 TL_PUTBQ(tep, mp);
5170 return;
5171 }
5172 /*
5173 * prepare indication message
5174 */
5175
5176 /*
5177 * calculate length of message
5178 */
5179 if (peer_tep->te_flag & (TL_SETCRED|TL_SETUCRED|TL_SOCKUCRED)) {
5180 cr = msg_getcred(mp, &cpid);
5181 ASSERT(cr != NULL);
5182
5183 if (peer_tep->te_flag & TL_SETCRED) {
5184 ASSERT(olen == 0);
5185 olen = (t_scalar_t)sizeof (struct opthdr) +
5186 OPTLEN(sizeof (tl_credopt_t));
5187 /* 1 option only */
5188 } else if (peer_tep->te_flag & TL_SETUCRED) {
5189 ASSERT(olen == 0);
5190 olen = (t_scalar_t)sizeof (struct opthdr) +
5191 OPTLEN(ucredminsize(cr));
5192 /* 1 option only */
5193 } else {
5194 /* Possibly more than one option */
5195 olen += (t_scalar_t)sizeof (struct T_opthdr) +
5196 OPTLEN(ucredminsize(cr));
5197 }
5198 }
5199
5200 ui_sz = T_ALIGN(sizeof (struct T_unitdata_ind) + tep->te_alen) + olen;
5201 reuse_mb_sz = T_ALIGN(sizeof (struct T_unitdata_ind) + alen) + olen;
5202
5203 /*
5204 * If the unitdata_ind fits and we are not adding options
5205 * reuse the udreq mblk.
5206 *
5207 * Otherwise, it is possible we need to append an option if one of the
5208 * te_flag bits is set. This requires extra space in the data block for
5209 * the additional option but the traditional technique used below to
5210 * allocate a new block and copy into it will not work when there is a
5211 * message block with a free pointer (since we don't know anything
5212 * about the layout of the data, pointers referencing or within the
5213 * data, etc.). To handle this possibility the upper layers may have
5214 * preallocated some space to use for appending an option. We check the
5215 * overall mblock size against the size we need ('reuse_mb_sz' with the
5216 * original address length [alen] to ensure we won't overrun the
5217 * current mblk data size) to see if there is free space and thus
5218 * avoid allocating a new message block.
5219 */
5220 if (msz >= ui_sz && alen >= tep->te_alen &&
5221 !(peer_tep->te_flag & (TL_SETCRED|TL_SETUCRED|TL_SOCKUCRED))) {
5222 /*
5223 * Reuse the original mblk. Leave options in place.
5224 */
5225 udind = (struct T_unitdata_ind *)mp->b_rptr;
5226 udind->PRIM_type = T_UNITDATA_IND;
5227 udind->SRC_length = tep->te_alen;
5228 addr_startp = mp->b_rptr + udind->SRC_offset;
5229 bcopy(tep->te_abuf, addr_startp, tep->te_alen);
5230
5231 } else if (MBLKSIZE(mp) >= reuse_mb_sz && alen >= tep->te_alen &&
5232 mp->b_datap->db_frtnp != NULL) {
5233 /*
5234 * We have a message block with a free pointer, but extra space
5235 * has been pre-allocated for us in case we need to append an
5236 * option. Reuse the original mblk, leaving existing options in
5237 * place.
5238 */
5239 udind = (struct T_unitdata_ind *)mp->b_rptr;
5240 udind->PRIM_type = T_UNITDATA_IND;
5241 udind->SRC_length = tep->te_alen;
5242 addr_startp = mp->b_rptr + udind->SRC_offset;
5243 bcopy(tep->te_abuf, addr_startp, tep->te_alen);
5244
5245 if (peer_tep->te_flag & (TL_SETCRED|TL_SETUCRED|TL_SOCKUCRED)) {
5246 ASSERT(cr != NULL);
5247 /*
5248 * We're appending one new option here after the
5249 * original ones.
5250 */
5251 tl_fill_option(mp->b_rptr + udind->OPT_offset + oldolen,
5252 cr, cpid, peer_tep->te_flag, peer_tep->te_credp);
5253 }
5254
5255 } else if (mp->b_datap->db_frtnp != NULL) {
5256 /*
5257 * The next block creates a new mp and tries to copy the data
5258 * block into it, but that cannot handle a message with a free
5259 * pointer (for more details see the comment in kstrputmsg()
5260 * where dupmsg() is called). Since we can never properly
5261 * duplicate the mp while also extending the data, just error
5262 * out now.
5263 */
5264 tl_uderr(wq, mp, EPROTO);
5265 return;
5266 } else {
5267 /* Allocate a new T_unitdata_ind message */
5268 mblk_t *ui_mp;
5269
5270 ui_mp = allocb(ui_sz, BPRI_MED);
5271 if (! ui_mp) {
5272 (void) (STRLOG(TL_ID, tep->te_minor, 4, SL_TRACE,
5273 "tl_unitdata:allocb failure:message queued"));
5274 tl_memrecover(wq, mp, ui_sz);
5275 return;
5276 }
5277
5278 /*
5279 * fill in T_UNITDATA_IND contents
5280 */
5281 DB_TYPE(ui_mp) = M_PROTO;
5282 ui_mp->b_wptr = ui_mp->b_rptr + ui_sz;
5283 udind = (struct T_unitdata_ind *)ui_mp->b_rptr;
5284 udind->PRIM_type = T_UNITDATA_IND;
5285 udind->SRC_offset = (t_scalar_t)sizeof (struct T_unitdata_ind);
5286 udind->SRC_length = tep->te_alen;
5287 addr_startp = ui_mp->b_rptr + udind->SRC_offset;
5288 bcopy(tep->te_abuf, addr_startp, tep->te_alen);
5289 udind->OPT_offset =
5290 (t_scalar_t)T_ALIGN(udind->SRC_offset + udind->SRC_length);
5291 udind->OPT_length = olen;
5292 if (peer_tep->te_flag & (TL_SETCRED|TL_SETUCRED|TL_SOCKUCRED)) {
5293
5294 if (oldolen != 0) {
5295 bcopy((void *)((uintptr_t)udreq + ooff),
5296 (void *)((uintptr_t)udind +
5297 udind->OPT_offset),
5298 oldolen);
5299 }
5300 ASSERT(cr != NULL);
5301
5302 tl_fill_option(ui_mp->b_rptr + udind->OPT_offset +
5303 oldolen, cr, cpid,
5304 peer_tep->te_flag, peer_tep->te_credp);
5305 } else {
5306 bcopy((void *)((uintptr_t)udreq + ooff),
5307 (void *)((uintptr_t)udind + udind->OPT_offset),
5308 olen);
5309 }
5310
5311 /*
5312 * relink data blocks from mp to ui_mp
5313 */
5314 ui_mp->b_cont = mp->b_cont;
5315 freeb(mp);
5316 mp = ui_mp;
5317 }
5318 /*
5319 * send indication message
5320 */
5321 peer_tep->te_state = NEXTSTATE(TE_UNITDATA_IND, peer_tep->te_state);
5322 putnext(peer_tep->te_rq, mp);
5323 }
5324
5325
5326
5327 /*
5328 * Check if a given addr is in use.
5329 * Endpoint ptr returned or NULL if not found.
5330 * The name space is separate for each mode. This implies that
5331 * sockets get their own name space.
5332 */
5333 static tl_endpt_t *
5334 tl_find_peer(tl_endpt_t *tep, tl_addr_t *ap)
5335 {
5336 tl_endpt_t *peer_tep = NULL;
5337 int rc = mod_hash_find_cb(tep->te_addrhash, (mod_hash_key_t)ap,
5338 (mod_hash_val_t *)&peer_tep, tl_find_callback);
5339
5340 ASSERT(! IS_SOCKET(tep));
5341
5342 ASSERT(ap != NULL && ap->ta_alen > 0);
5343 ASSERT(ap->ta_zoneid == tep->te_zoneid);
5344 ASSERT(ap->ta_abuf != NULL);
5345 EQUIV(rc == 0, peer_tep != NULL);
5346 IMPLY(rc == 0,
5347 (tep->te_zoneid == peer_tep->te_zoneid) &&
5348 (tep->te_transport == peer_tep->te_transport));
5349
5350 if ((rc == 0) && (peer_tep->te_closing)) {
5351 tl_refrele(peer_tep);
5352 peer_tep = NULL;
5353 }
5354
5355 return (peer_tep);
5356 }
5357
5358 /*
5359 * Find peer for a socket based on unix domain address.
5360 * For implicit addresses our peer can be found by minor number in ai hash. For
5361 * explicit binds we look vnode address at addr_hash.
5362 */
5363 static tl_endpt_t *
5364 tl_sock_find_peer(tl_endpt_t *tep, soux_addr_t *ux_addr)
5365 {
5366 tl_endpt_t *peer_tep = NULL;
5367 mod_hash_t *hash = ux_addr->soua_magic == SOU_MAGIC_IMPLICIT ?
5368 tep->te_aihash : tep->te_addrhash;
5369 int rc = mod_hash_find_cb(hash, (mod_hash_key_t)ux_addr->soua_vp,
5370 (mod_hash_val_t *)&peer_tep, tl_find_callback);
5371
5372 ASSERT(IS_SOCKET(tep));
5373 EQUIV(rc == 0, peer_tep != NULL);
5374 IMPLY(rc == 0, (tep->te_transport == peer_tep->te_transport));
5375
5376 if (peer_tep != NULL) {
5377 /* Don't attempt to use closing peer. */
5378 if (peer_tep->te_closing)
5379 goto errout;
5380
5381 /*
5382 * Cross-zone unix sockets are permitted, but for Trusted
5383 * Extensions only, the "server" for these must be in the
5384 * global zone.
5385 */
5386 if ((peer_tep->te_zoneid != tep->te_zoneid) &&
5387 is_system_labeled() &&
5388 (peer_tep->te_zoneid != GLOBAL_ZONEID))
5389 goto errout;
5390 }
5391
5392 return (peer_tep);
5393
5394 errout:
5395 tl_refrele(peer_tep);
5396 return (NULL);
5397 }
5398
5399 /*
5400 * Generate a free addr and return it in struct pointed by ap
5401 * but allocating space for address buffer.
5402 * The generated address will be at least 4 bytes long and, if req->ta_alen
5403 * exceeds 4 bytes, be req->ta_alen bytes long.
5404 *
5405 * If address is found it will be inserted in the hash.
5406 *
5407 * If req->ta_alen is larger than the default alen (4 bytes) the last
5408 * alen-4 bytes will always be the same as in req.
5409 *
5410 * Return 0 for failure.
5411 * Return non-zero for success.
5412 */
5413 static boolean_t
5414 tl_get_any_addr(tl_endpt_t *tep, tl_addr_t *req)
5415 {
5416 t_scalar_t alen;
5417 uint32_t loopcnt; /* Limit loop to 2^32 */
5418
5419 ASSERT(tep->te_hash_hndl != NULL);
5420 ASSERT(! IS_SOCKET(tep));
5421
5422 if (tep->te_hash_hndl == NULL)
5423 return (B_FALSE);
5424
5425 /*
5426 * check if default addr is in use
5427 * if it is - bump it and try again
5428 */
5429 if (req == NULL) {
5430 alen = sizeof (uint32_t);
5431 } else {
5432 alen = max(req->ta_alen, sizeof (uint32_t));
5433 ASSERT(tep->te_zoneid == req->ta_zoneid);
5434 }
5435
5436 if (tep->te_alen < alen) {
5437 void *abuf = kmem_zalloc((size_t)alen, KM_NOSLEEP);
5438
5439 /*
5440 * Not enough space in tep->ta_ap to hold the address,
5441 * allocate a bigger space.
5442 */
5443 if (abuf == NULL)
5444 return (B_FALSE);
5445
5446 if (tep->te_alen > 0)
5447 kmem_free(tep->te_abuf, tep->te_alen);
5448
5449 tep->te_alen = alen;
5450 tep->te_abuf = abuf;
5451 }
5452
5453 /* Copy in the address in req */
5454 if (req != NULL) {
5455 ASSERT(alen >= req->ta_alen);
5456 bcopy(req->ta_abuf, tep->te_abuf, (size_t)req->ta_alen);
5457 }
5458
5459 /*
5460 * First try minor number then try default addresses.
5461 */
5462 bcopy(&tep->te_minor, tep->te_abuf, sizeof (uint32_t));
5463
5464 for (loopcnt = 0; loopcnt < UINT32_MAX; loopcnt++) {
5465 if (mod_hash_insert_reserve(tep->te_addrhash,
5466 (mod_hash_key_t)&tep->te_ap, (mod_hash_val_t)tep,
5467 tep->te_hash_hndl) == 0) {
5468 /*
5469 * found free address
5470 */
5471 tep->te_flag |= TL_ADDRHASHED;
5472 tep->te_hash_hndl = NULL;
5473
5474 return (B_TRUE); /* successful return */
5475 }
5476 /*
5477 * Use default address.
5478 */
5479 bcopy(&tep->te_defaddr, tep->te_abuf, sizeof (uint32_t));
5480 atomic_inc_32(&tep->te_defaddr);
5481 }
5482
5483 /*
5484 * Failed to find anything.
5485 */
5486 (void) (STRLOG(TL_ID, -1, 1, SL_ERROR,
5487 "tl_get_any_addr:looped 2^32 times"));
5488 return (B_FALSE);
5489 }
5490
5491 /*
5492 * reallocb + set r/w ptrs to reflect size.
5493 */
5494 static mblk_t *
5495 tl_resizemp(mblk_t *mp, ssize_t new_size)
5496 {
5497 if ((mp = reallocb(mp, new_size, 0)) == NULL)
5498 return (NULL);
5499
5500 mp->b_rptr = DB_BASE(mp);
5501 mp->b_wptr = mp->b_rptr + new_size;
5502 return (mp);
5503 }
5504
5505 static void
5506 tl_cl_backenable(tl_endpt_t *tep)
5507 {
5508 list_t *l = &tep->te_flowlist;
5509 tl_endpt_t *elp;
5510
5511 ASSERT(IS_CLTS(tep));
5512
5513 for (elp = list_head(l); elp != NULL; elp = list_head(l)) {
5514 ASSERT(tep->te_ser == elp->te_ser);
5515 ASSERT(elp->te_flowq == tep);
5516 if (! elp->te_closing)
5517 TL_QENABLE(elp);
5518 elp->te_flowq = NULL;
5519 list_remove(l, elp);
5520 }
5521 }
5522
5523 /*
5524 * Unconnect endpoints.
5525 */
5526 static void
5527 tl_co_unconnect(tl_endpt_t *tep)
5528 {
5529 tl_endpt_t *peer_tep = tep->te_conp;
5530 tl_endpt_t *srv_tep = tep->te_oconp;
5531 list_t *l;
5532 tl_icon_t *tip;
5533 tl_endpt_t *cl_tep;
5534 mblk_t *d_mp;
5535
5536 ASSERT(IS_COTS(tep));
5537 /*
5538 * If our peer is closing, don't use it.
5539 */
5540 if ((peer_tep != NULL) && peer_tep->te_closing) {
5541 TL_UNCONNECT(tep->te_conp);
5542 peer_tep = NULL;
5543 }
5544 if ((srv_tep != NULL) && srv_tep->te_closing) {
5545 TL_UNCONNECT(tep->te_oconp);
5546 srv_tep = NULL;
5547 }
5548
5549 if (tep->te_nicon > 0) {
5550 l = &tep->te_iconp;
5551 /*
5552 * If incoming requests pending, change state
5553 * of clients on disconnect ind event and send
5554 * discon_ind pdu to modules above them
5555 * for server: all clients get disconnect
5556 */
5557
5558 while (tep->te_nicon > 0) {
5559 tip = list_head(l);
5560 cl_tep = tip->ti_tep;
5561
5562 if (cl_tep == NULL) {
5563 tl_freetip(tep, tip);
5564 continue;
5565 }
5566
5567 if (cl_tep->te_oconp != NULL) {
5568 ASSERT(cl_tep != cl_tep->te_oconp);
5569 TL_UNCONNECT(cl_tep->te_oconp);
5570 }
5571
5572 if (cl_tep->te_closing) {
5573 tl_freetip(tep, tip);
5574 continue;
5575 }
5576
5577 enableok(cl_tep->te_wq);
5578 TL_QENABLE(cl_tep);
5579 d_mp = tl_discon_ind_alloc(ECONNREFUSED, BADSEQNUM);
5580 if (d_mp != NULL) {
5581 cl_tep->te_state = TS_IDLE;
5582 putnext(cl_tep->te_rq, d_mp);
5583 } else {
5584 (void) (STRLOG(TL_ID, tep->te_minor, 3,
5585 SL_TRACE|SL_ERROR,
5586 "tl_co_unconnect:icmng: "
5587 "allocb failure"));
5588 }
5589 tl_freetip(tep, tip);
5590 }
5591 } else if (srv_tep != NULL) {
5592 /*
5593 * If outgoing request pending, change state
5594 * of server on discon ind event
5595 */
5596
5597 if (IS_SOCKET(tep) && !tl_disable_early_connect &&
5598 IS_COTSORD(srv_tep) &&
5599 !tl_icon_hasprim(srv_tep, tep->te_seqno, T_ORDREL_IND)) {
5600 /*
5601 * Queue ordrel_ind for server to be picked up
5602 * when the connection is accepted.
5603 */
5604 d_mp = tl_ordrel_ind_alloc();
5605 } else {
5606 /*
5607 * send discon_ind to server
5608 */
5609 d_mp = tl_discon_ind_alloc(ECONNRESET, tep->te_seqno);
5610 }
5611 if (d_mp == NULL) {
5612 (void) (STRLOG(TL_ID, tep->te_minor, 3,
5613 SL_TRACE|SL_ERROR,
5614 "tl_co_unconnect:outgoing:allocb failure"));
5615 TL_UNCONNECT(tep->te_oconp);
5616 goto discon_peer;
5617 }
5618
5619 /*
5620 * If this is a socket the T_DISCON_IND is queued with
5621 * the T_CONN_IND. Otherwise the T_CONN_IND is removed
5622 * from the list of pending connections.
5623 * Note that when te_oconp is set the peer better have
5624 * a t_connind_t for the client.
5625 */
5626 if (IS_SOCKET(tep) && !tl_disable_early_connect) {
5627 /*
5628 * Queue the disconnection message.
5629 */
5630 tl_icon_queuemsg(srv_tep, tep->te_seqno, d_mp);
5631 } else {
5632 tip = tl_icon_find(srv_tep, tep->te_seqno);
5633 if (tip == NULL) {
5634 freemsg(d_mp);
5635 } else {
5636 ASSERT(tep == tip->ti_tep);
5637 ASSERT(tep->te_ser == srv_tep->te_ser);
5638 /*
5639 * Delete tip from the server list.
5640 */
5641 if (srv_tep->te_nicon == 1) {
5642 srv_tep->te_state =
5643 NEXTSTATE(TE_DISCON_IND2,
5644 srv_tep->te_state);
5645 } else {
5646 srv_tep->te_state =
5647 NEXTSTATE(TE_DISCON_IND3,
5648 srv_tep->te_state);
5649 }
5650 ASSERT(*(uint32_t *)(d_mp->b_rptr) ==
5651 T_DISCON_IND);
5652 putnext(srv_tep->te_rq, d_mp);
5653 tl_freetip(srv_tep, tip);
5654 }
5655 TL_UNCONNECT(tep->te_oconp);
5656 srv_tep = NULL;
5657 }
5658 } else if (peer_tep != NULL) {
5659 /*
5660 * unconnect existing connection
5661 * If connected, change state of peer on
5662 * discon ind event and send discon ind pdu
5663 * to module above it
5664 */
5665
5666 ASSERT(tep->te_ser == peer_tep->te_ser);
5667 if (IS_COTSORD(peer_tep) &&
5668 (peer_tep->te_state == TS_WIND_ORDREL ||
5669 peer_tep->te_state == TS_DATA_XFER)) {
5670 /*
5671 * send ordrel ind
5672 */
5673 (void) (STRLOG(TL_ID, tep->te_minor, 3, SL_TRACE,
5674 "tl_co_unconnect:connected: ordrel_ind state %d->%d",
5675 peer_tep->te_state,
5676 NEXTSTATE(TE_ORDREL_IND, peer_tep->te_state)));
5677 d_mp = tl_ordrel_ind_alloc();
5678 if (! d_mp) {
5679 (void) (STRLOG(TL_ID, tep->te_minor, 3,
5680 SL_TRACE|SL_ERROR,
5681 "tl_co_unconnect:connected:"
5682 "allocb failure"));
5683 /*
5684 * Continue with cleaning up peer as
5685 * this side may go away with the close
5686 */
5687 TL_QENABLE(peer_tep);
5688 goto discon_peer;
5689 }
5690 peer_tep->te_state =
5691 NEXTSTATE(TE_ORDREL_IND, peer_tep->te_state);
5692
5693 putnext(peer_tep->te_rq, d_mp);
5694 /*
5695 * Handle flow control case. This will generate
5696 * a t_discon_ind message with reason 0 if there
5697 * is data queued on the write side.
5698 */
5699 TL_QENABLE(peer_tep);
5700 } else if (IS_COTSORD(peer_tep) &&
5701 peer_tep->te_state == TS_WREQ_ORDREL) {
5702 /*
5703 * Sent an ordrel_ind. We send a discon with
5704 * with error 0 to inform that the peer is gone.
5705 */
5706 (void) (STRLOG(TL_ID, tep->te_minor, 3,
5707 SL_TRACE|SL_ERROR,
5708 "tl_co_unconnect: discon in state %d",
5709 tep->te_state));
5710 tl_discon_ind(peer_tep, 0);
5711 } else {
5712 (void) (STRLOG(TL_ID, tep->te_minor, 3,
5713 SL_TRACE|SL_ERROR,
5714 "tl_co_unconnect: state %d", tep->te_state));
5715 tl_discon_ind(peer_tep, ECONNRESET);
5716 }
5717
5718 discon_peer:
5719 /*
5720 * Disconnect cross-pointers only for close
5721 */
5722 if (tep->te_closing) {
5723 peer_tep = tep->te_conp;
5724 TL_REMOVE_PEER(peer_tep->te_conp);
5725 TL_REMOVE_PEER(tep->te_conp);
5726 }
5727 }
5728 }
5729
5730 /*
5731 * Note: The following routine does not recover from allocb()
5732 * failures
5733 * The reason should be from the <sys/errno.h> space.
5734 */
5735 static void
5736 tl_discon_ind(tl_endpt_t *tep, uint32_t reason)
5737 {
5738 mblk_t *d_mp;
5739
5740 if (tep->te_closing)
5741 return;
5742
5743 /*
5744 * flush the queues.
5745 */
5746 flushq(tep->te_rq, FLUSHDATA);
5747 (void) putnextctl1(tep->te_rq, M_FLUSH, FLUSHRW);
5748
5749 /*
5750 * send discon ind
5751 */
5752 d_mp = tl_discon_ind_alloc(reason, tep->te_seqno);
5753 if (! d_mp) {
5754 (void) (STRLOG(TL_ID, tep->te_minor, 3, SL_TRACE|SL_ERROR,
5755 "tl_discon_ind:allocb failure"));
5756 return;
5757 }
5758 tep->te_state = TS_IDLE;
5759 putnext(tep->te_rq, d_mp);
5760 }
5761
5762 /*
5763 * Note: The following routine does not recover from allocb()
5764 * failures
5765 * The reason should be from the <sys/errno.h> space.
5766 */
5767 static mblk_t *
5768 tl_discon_ind_alloc(uint32_t reason, t_scalar_t seqnum)
5769 {
5770 mblk_t *mp;
5771 struct T_discon_ind *tdi;
5772
5773 if (mp = allocb(sizeof (struct T_discon_ind), BPRI_MED)) {
5774 DB_TYPE(mp) = M_PROTO;
5775 mp->b_wptr = mp->b_rptr + sizeof (struct T_discon_ind);
5776 tdi = (struct T_discon_ind *)mp->b_rptr;
5777 tdi->PRIM_type = T_DISCON_IND;
5778 tdi->DISCON_reason = reason;
5779 tdi->SEQ_number = seqnum;
5780 }
5781 return (mp);
5782 }
5783
5784
5785 /*
5786 * Note: The following routine does not recover from allocb()
5787 * failures
5788 */
5789 static mblk_t *
5790 tl_ordrel_ind_alloc(void)
5791 {
5792 mblk_t *mp;
5793 struct T_ordrel_ind *toi;
5794
5795 if (mp = allocb(sizeof (struct T_ordrel_ind), BPRI_MED)) {
5796 DB_TYPE(mp) = M_PROTO;
5797 mp->b_wptr = mp->b_rptr + sizeof (struct T_ordrel_ind);
5798 toi = (struct T_ordrel_ind *)mp->b_rptr;
5799 toi->PRIM_type = T_ORDREL_IND;
5800 }
5801 return (mp);
5802 }
5803
5804
5805 /*
5806 * Lookup the seqno in the list of queued connections.
5807 */
5808 static tl_icon_t *
5809 tl_icon_find(tl_endpt_t *tep, t_scalar_t seqno)
5810 {
5811 list_t *l = &tep->te_iconp;
5812 tl_icon_t *tip = list_head(l);
5813
5814 ASSERT(seqno != 0);
5815
5816 for (; tip != NULL && (tip->ti_seqno != seqno); tip = list_next(l, tip))
5817 ;
5818
5819 return (tip);
5820 }
5821
5822 /*
5823 * Queue data for a given T_CONN_IND while verifying that redundant
5824 * messages, such as a T_ORDREL_IND after a T_DISCON_IND, are not queued.
5825 * Used when the originator of the connection closes.
5826 */
5827 static void
5828 tl_icon_queuemsg(tl_endpt_t *tep, t_scalar_t seqno, mblk_t *nmp)
5829 {
5830 tl_icon_t *tip;
5831 mblk_t **mpp, *mp;
5832 int prim, nprim;
5833
5834 if (nmp->b_datap->db_type == M_PROTO)
5835 nprim = ((union T_primitives *)nmp->b_rptr)->type;
5836 else
5837 nprim = -1; /* M_DATA */
5838
5839 tip = tl_icon_find(tep, seqno);
5840 if (tip == NULL) {
5841 freemsg(nmp);
5842 return;
5843 }
5844
5845 ASSERT(tip->ti_seqno != 0);
5846 mpp = &tip->ti_mp;
5847 while (*mpp != NULL) {
5848 mp = *mpp;
5849
5850 if (mp->b_datap->db_type == M_PROTO)
5851 prim = ((union T_primitives *)mp->b_rptr)->type;
5852 else
5853 prim = -1; /* M_DATA */
5854
5855 /*
5856 * Allow nothing after a T_DISCON_IND
5857 */
5858 if (prim == T_DISCON_IND) {
5859 freemsg(nmp);
5860 return;
5861 }
5862 /*
5863 * Only allow a T_DISCON_IND after an T_ORDREL_IND
5864 */
5865 if (prim == T_ORDREL_IND && nprim != T_DISCON_IND) {
5866 freemsg(nmp);
5867 return;
5868 }
5869 mpp = &(mp->b_next);
5870 }
5871 *mpp = nmp;
5872 }
5873
5874 /*
5875 * Verify if a certain TPI primitive exists on the connind queue.
5876 * Use prim -1 for M_DATA.
5877 * Return non-zero if found.
5878 */
5879 static boolean_t
5880 tl_icon_hasprim(tl_endpt_t *tep, t_scalar_t seqno, t_scalar_t prim)
5881 {
5882 tl_icon_t *tip = tl_icon_find(tep, seqno);
5883 boolean_t found = B_FALSE;
5884
5885 if (tip != NULL) {
5886 mblk_t *mp;
5887 for (mp = tip->ti_mp; !found && mp != NULL; mp = mp->b_next) {
5888 found = (DB_TYPE(mp) == M_PROTO &&
5889 ((union T_primitives *)mp->b_rptr)->type == prim);
5890 }
5891 }
5892 return (found);
5893 }
5894
5895 /*
5896 * Send the b_next mblk chain that has accumulated before the connection
5897 * was accepted. Perform the necessary state transitions.
5898 */
5899 static void
5900 tl_icon_sendmsgs(tl_endpt_t *tep, mblk_t **mpp)
5901 {
5902 mblk_t *mp;
5903 union T_primitives *primp;
5904
5905 if (tep->te_closing) {
5906 tl_icon_freemsgs(mpp);
5907 return;
5908 }
5909
5910 ASSERT(tep->te_state == TS_DATA_XFER);
5911 ASSERT(tep->te_rq->q_first == NULL);
5912
5913 while ((mp = *mpp) != NULL) {
5914 *mpp = mp->b_next;
5915 mp->b_next = NULL;
5916
5917 ASSERT((DB_TYPE(mp) == M_DATA) || (DB_TYPE(mp) == M_PROTO));
5918 switch (DB_TYPE(mp)) {
5919 default:
5920 freemsg(mp);
5921 break;
5922 case M_DATA:
5923 putnext(tep->te_rq, mp);
5924 break;
5925 case M_PROTO:
5926 primp = (union T_primitives *)mp->b_rptr;
5927 switch (primp->type) {
5928 case T_UNITDATA_IND:
5929 case T_DATA_IND:
5930 case T_OPTDATA_IND:
5931 case T_EXDATA_IND:
5932 putnext(tep->te_rq, mp);
5933 break;
5934 case T_ORDREL_IND:
5935 tep->te_state = NEXTSTATE(TE_ORDREL_IND,
5936 tep->te_state);
5937 putnext(tep->te_rq, mp);
5938 break;
5939 case T_DISCON_IND:
5940 tep->te_state = TS_IDLE;
5941 putnext(tep->te_rq, mp);
5942 break;
5943 default:
5944 #ifdef DEBUG
5945 cmn_err(CE_PANIC,
5946 "tl_icon_sendmsgs: unknown primitive");
5947 #endif /* DEBUG */
5948 freemsg(mp);
5949 break;
5950 }
5951 break;
5952 }
5953 }
5954 }
5955
5956 /*
5957 * Free the b_next mblk chain that has accumulated before the connection
5958 * was accepted.
5959 */
5960 static void
5961 tl_icon_freemsgs(mblk_t **mpp)
5962 {
5963 mblk_t *mp;
5964
5965 while ((mp = *mpp) != NULL) {
5966 *mpp = mp->b_next;
5967 mp->b_next = NULL;
5968 freemsg(mp);
5969 }
5970 }
5971
5972 /*
5973 * Send M_ERROR
5974 * Note: assumes caller ensured enough space in mp or enough
5975 * memory available. Does not attempt recovery from allocb()
5976 * failures
5977 */
5978
5979 static void
5980 tl_merror(queue_t *wq, mblk_t *mp, int error)
5981 {
5982 tl_endpt_t *tep = (tl_endpt_t *)wq->q_ptr;
5983
5984 if (tep->te_closing) {
5985 freemsg(mp);
5986 return;
5987 }
5988
5989 (void) (STRLOG(TL_ID, tep->te_minor, 1,
5990 SL_TRACE|SL_ERROR,
5991 "tl_merror: tep=%p, err=%d", (void *)tep, error));
5992
5993 /*
5994 * flush all messages on queue. we are shutting
5995 * the stream down on fatal error
5996 */
5997 flushq(wq, FLUSHALL);
5998 if (IS_COTS(tep)) {
5999 /* connection oriented - unconnect endpoints */
6000 tl_co_unconnect(tep);
6001 }
6002 if (mp->b_cont) {
6003 freemsg(mp->b_cont);
6004 mp->b_cont = NULL;
6005 }
6006
6007 if ((MBLKSIZE(mp) < 1) || (DB_REF(mp) > 1)) {
6008 freemsg(mp);
6009 mp = allocb(1, BPRI_HI);
6010 if (!mp) {
6011 (void) (STRLOG(TL_ID, tep->te_minor, 1,
6012 SL_TRACE|SL_ERROR,
6013 "tl_merror:M_PROTO: out of memory"));
6014 return;
6015 }
6016 }
6017 if (mp) {
6018 DB_TYPE(mp) = M_ERROR;
6019 mp->b_rptr = DB_BASE(mp);
6020 *mp->b_rptr = (char)error;
6021 mp->b_wptr = mp->b_rptr + sizeof (char);
6022 qreply(wq, mp);
6023 } else {
6024 (void) putnextctl1(tep->te_rq, M_ERROR, error);
6025 }
6026 }
6027
6028 static void
6029 tl_fill_option(uchar_t *buf, cred_t *cr, pid_t cpid, int flag, cred_t *pcr)
6030 {
6031 ASSERT(cr != NULL);
6032
6033 if (flag & TL_SETCRED) {
6034 struct opthdr *opt = (struct opthdr *)buf;
6035 tl_credopt_t *tlcred;
6036
6037 opt->level = TL_PROT_LEVEL;
6038 opt->name = TL_OPT_PEER_CRED;
6039 opt->len = (t_uscalar_t)OPTLEN(sizeof (tl_credopt_t));
6040
6041 tlcred = (tl_credopt_t *)(opt + 1);
6042 tlcred->tc_uid = crgetuid(cr);
6043 tlcred->tc_gid = crgetgid(cr);
6044 tlcred->tc_ruid = crgetruid(cr);
6045 tlcred->tc_rgid = crgetrgid(cr);
6046 tlcred->tc_suid = crgetsuid(cr);
6047 tlcred->tc_sgid = crgetsgid(cr);
6048 tlcred->tc_ngroups = crgetngroups(cr);
6049 } else if (flag & TL_SETUCRED) {
6050 struct opthdr *opt = (struct opthdr *)buf;
6051
6052 opt->level = TL_PROT_LEVEL;
6053 opt->name = TL_OPT_PEER_UCRED;
6054 opt->len = (t_uscalar_t)OPTLEN(ucredminsize(cr));
6055
6056 (void) cred2ucred(cr, cpid, (void *)(opt + 1), pcr);
6057 } else {
6058 struct T_opthdr *topt = (struct T_opthdr *)buf;
6059 ASSERT(flag & TL_SOCKUCRED);
6060
6061 topt->level = SOL_SOCKET;
6062 topt->name = SCM_UCRED;
6063 topt->len = ucredminsize(cr) + sizeof (*topt);
6064 topt->status = 0;
6065 (void) cred2ucred(cr, cpid, (void *)(topt + 1), pcr);
6066 }
6067 }
6068
6069 /* ARGSUSED */
6070 static int
6071 tl_default_opt(queue_t *wq, int level, int name, uchar_t *ptr)
6072 {
6073 /* no default value processed in protocol specific code currently */
6074 return (-1);
6075 }
6076
6077 /* ARGSUSED */
6078 static int
6079 tl_get_opt(queue_t *wq, int level, int name, uchar_t *ptr)
6080 {
6081 int len;
6082 tl_endpt_t *tep;
6083 int *valp;
6084
6085 tep = (tl_endpt_t *)wq->q_ptr;
6086
6087 len = 0;
6088
6089 /*
6090 * Assumes: option level and name sanity check done elsewhere
6091 */
6092
6093 switch (level) {
6094 case SOL_SOCKET:
6095 if (! IS_SOCKET(tep))
6096 break;
6097 switch (name) {
6098 case SO_RECVUCRED:
6099 len = sizeof (int);
6100 valp = (int *)ptr;
6101 *valp = (tep->te_flag & TL_SOCKUCRED) != 0;
6102 break;
6103 default:
6104 break;
6105 }
6106 break;
6107 case TL_PROT_LEVEL:
6108 switch (name) {
6109 case TL_OPT_PEER_CRED:
6110 case TL_OPT_PEER_UCRED:
6111 /*
6112 * option not supposed to retrieved directly
6113 * Only sent in T_CON_{IND,CON}, T_UNITDATA_IND
6114 * when some internal flags set by other options
6115 * Direct retrieval always designed to fail(ignored)
6116 * for this option.
6117 */
6118 break;
6119 }
6120 }
6121 return (len);
6122 }
6123
6124 /* ARGSUSED */
6125 static int
6126 tl_set_opt(
6127 queue_t *wq,
6128 uint_t mgmt_flags,
6129 int level,
6130 int name,
6131 uint_t inlen,
6132 uchar_t *invalp,
6133 uint_t *outlenp,
6134 uchar_t *outvalp,
6135 void *thisdg_attrs,
6136 cred_t *cr)
6137 {
6138 int error;
6139 tl_endpt_t *tep;
6140
6141 tep = (tl_endpt_t *)wq->q_ptr;
6142
6143 error = 0; /* NOERROR */
6144
6145 /*
6146 * Assumes: option level and name sanity checks done elsewhere
6147 */
6148
6149 switch (level) {
6150 case SOL_SOCKET:
6151 if (! IS_SOCKET(tep)) {
6152 error = EINVAL;
6153 break;
6154 }
6155 /*
6156 * TBD: fill in other AF_UNIX socket options and then stop
6157 * returning error.
6158 */
6159 switch (name) {
6160 case SO_RECVUCRED:
6161 /*
6162 * We only support this for datagram sockets;
6163 * getpeerucred handles the connection oriented
6164 * transports.
6165 */
6166 if (! IS_CLTS(tep)) {
6167 error = EINVAL;
6168 break;
6169 }
6170 if (*(int *)invalp == 0)
6171 tep->te_flag &= ~TL_SOCKUCRED;
6172 else
6173 tep->te_flag |= TL_SOCKUCRED;
6174 break;
6175 default:
6176 error = EINVAL;
6177 break;
6178 }
6179 break;
6180 case TL_PROT_LEVEL:
6181 switch (name) {
6182 case TL_OPT_PEER_CRED:
6183 case TL_OPT_PEER_UCRED:
6184 /*
6185 * option not supposed to be set directly
6186 * Its value in initialized for each endpoint at
6187 * driver open time.
6188 * Direct setting always designed to fail for this
6189 * option.
6190 */
6191 (void) (STRLOG(TL_ID, tep->te_minor, 1,
6192 SL_TRACE|SL_ERROR,
6193 "tl_set_opt: option is not supported"));
6194 error = EPROTO;
6195 break;
6196 }
6197 }
6198 return (error);
6199 }
6200
6201
6202 static void
6203 tl_timer(void *arg)
6204 {
6205 queue_t *wq = arg;
6206 tl_endpt_t *tep = (tl_endpt_t *)wq->q_ptr;
6207
6208 ASSERT(tep);
6209
6210 tep->te_timoutid = 0;
6211
6212 enableok(wq);
6213 /*
6214 * Note: can call wsrv directly here and save context switch
6215 * Consider change when qtimeout (not timeout) is active
6216 */
6217 qenable(wq);
6218 }
6219
6220 static void
6221 tl_buffer(void *arg)
6222 {
6223 queue_t *wq = arg;
6224 tl_endpt_t *tep = (tl_endpt_t *)wq->q_ptr;
6225
6226 ASSERT(tep);
6227
6228 tep->te_bufcid = 0;
6229 tep->te_nowsrv = B_FALSE;
6230
6231 enableok(wq);
6232 /*
6233 * Note: can call wsrv directly here and save context switch
6234 * Consider change when qbufcall (not bufcall) is active
6235 */
6236 qenable(wq);
6237 }
6238
6239 static void
6240 tl_memrecover(queue_t *wq, mblk_t *mp, size_t size)
6241 {
6242 tl_endpt_t *tep;
6243
6244 tep = (tl_endpt_t *)wq->q_ptr;
6245
6246 if (tep->te_closing) {
6247 freemsg(mp);
6248 return;
6249 }
6250 noenable(wq);
6251
6252 (void) insq(wq, wq->q_first, mp);
6253
6254 if (tep->te_bufcid || tep->te_timoutid) {
6255 (void) (STRLOG(TL_ID, tep->te_minor, 1, SL_TRACE|SL_ERROR,
6256 "tl_memrecover:recover %p pending", (void *)wq));
6257 return;
6258 }
6259
6260 if (!(tep->te_bufcid = qbufcall(wq, size, BPRI_MED, tl_buffer, wq))) {
6261 tep->te_timoutid = qtimeout(wq, tl_timer, wq,
6262 drv_usectohz(TL_BUFWAIT));
6263 }
6264 }
6265
6266 static void
6267 tl_freetip(tl_endpt_t *tep, tl_icon_t *tip)
6268 {
6269 ASSERT(tip->ti_seqno != 0);
6270
6271 if (tip->ti_mp != NULL) {
6272 tl_icon_freemsgs(&tip->ti_mp);
6273 tip->ti_mp = NULL;
6274 }
6275 if (tip->ti_tep != NULL) {
6276 tl_refrele(tip->ti_tep);
6277 tip->ti_tep = NULL;
6278 }
6279 list_remove(&tep->te_iconp, tip);
6280 kmem_free(tip, sizeof (tl_icon_t));
6281 tep->te_nicon--;
6282 }
6283
6284 /*
6285 * Remove address from address hash.
6286 */
6287 static void
6288 tl_addr_unbind(tl_endpt_t *tep)
6289 {
6290 tl_endpt_t *elp;
6291
6292 if (tep->te_flag & TL_ADDRHASHED) {
6293 if (IS_SOCKET(tep)) {
6294 (void) mod_hash_remove(tep->te_addrhash,
6295 (mod_hash_key_t)tep->te_vp,
6296 (mod_hash_val_t *)&elp);
6297 tep->te_vp = (void *)(uintptr_t)tep->te_minor;
6298 tep->te_magic = SOU_MAGIC_IMPLICIT;
6299 } else {
6300 (void) mod_hash_remove(tep->te_addrhash,
6301 (mod_hash_key_t)&tep->te_ap,
6302 (mod_hash_val_t *)&elp);
6303 (void) kmem_free(tep->te_abuf, tep->te_alen);
6304 tep->te_alen = -1;
6305 tep->te_abuf = NULL;
6306 }
6307 tep->te_flag &= ~TL_ADDRHASHED;
6308 }
6309 }