1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21 /*
22 * Copyright 2010 Sun Microsystems, Inc. All rights reserved.
23 * Use is subject to license terms.
24 */
25 /*
26 * Copyright 2011 Nexenta Systems, Inc. All rights reserved.
27 * Copyright (c) 2012 by Delphix. All rights reserved.
28 */
29
30 /*
31 * Multithreaded STREAMS Local Transport Provider.
32 *
33 * OVERVIEW
34 * ========
35 *
36 * This driver provides TLI as well as socket semantics. It provides
37 * connectionless, connection oriented, and connection oriented with orderly
38 * release transports for TLI and sockets. Each transport type has separate name
39 * spaces (i.e. it is not possible to connect from a socket to a TLI endpoint) -
40 * this removes any name space conflicts when binding to socket style transport
41 * addresses.
42 *
43 * NOTE: There is one exception: Socket ticots and ticotsord transports share
44 * the same namespace. In fact, sockets always use ticotsord type transport.
45 *
46 * The driver mode is specified during open() by the minor number used for
47 * open.
48 *
49 * The sockets in addition have the following semantic differences:
50 * No support for passing up credentials (TL_SET[U]CRED).
51 *
52 * Options are passed through transparently on T_CONN_REQ to T_CONN_IND,
53 * from T_UNITDATA_REQ to T_UNIDATA_IND, and from T_OPTDATA_REQ to
54 * T_OPTDATA_IND.
55 *
56 * The T_CONN_CON is generated when processing the T_CONN_REQ i.e. before
57 * a T_CONN_RES is received from the acceptor. This means that a socket
58 * connect will complete before the peer has called accept.
59 *
60 *
61 * MULTITHREADING
62 * ==============
63 *
64 * The driver does not use STREAMS protection mechanisms. Instead it uses a
65 * generic "serializer" abstraction. Most of the operations are executed behind
66 * the serializer and are, essentially single-threaded. All functions executed
67 * behind the same serializer are strictly serialized. So if one thread calls
68 * serializer_enter(serializer, foo, mp1, arg1); and another thread calls
69 * serializer_enter(serializer, bar, mp2, arg1); then (depending on which one
70 * was called) the actual sequence will be foo(mp1, arg1); bar(mp1, arg2) or
71 * bar(mp1, arg2); foo(mp1, arg1); But foo() and bar() will never run at the
72 * same time.
73 *
74 * Connectionless transport use a single serializer per transport type (one for
75 * TLI and one for sockets. Connection-oriented transports use finer-grained
76 * serializers.
77 *
78 * All COTS-type endpoints start their life with private serializers. During
79 * connection request processing the endpoint serializer is switched to the
80 * listener's serializer and the rest of T_CONN_REQ processing is done on the
81 * listener serializer. During T_CONN_RES processing the eager serializer is
82 * switched from listener to acceptor serializer and after that point all
83 * processing for eager and acceptor happens on this serializer. To avoid races
84 * with endpoint closes while its serializer may be changing closes are blocked
85 * while serializers are manipulated.
86 *
87 * References accounting
88 * ---------------------
89 *
90 * Endpoints are reference counted and freed when the last reference is
91 * dropped. Functions within the serializer may access an endpoint state even
92 * after an endpoint closed. The te_closing being set on the endpoint indicates
93 * that the endpoint entered its close routine.
94 *
95 * One reference is held for each opened endpoint instance. The reference
96 * counter is incremented when the endpoint is linked to another endpoint and
97 * decremented when the link disappears. It is also incremented when the
98 * endpoint is found by the hash table lookup. This increment is atomic with the
99 * lookup itself and happens while the hash table read lock is held.
100 *
101 * Close synchronization
102 * ---------------------
103 *
104 * During close the endpoint as marked as closing using te_closing flag. It is
105 * usually enough to check for te_closing flag since all other state changes
106 * happen after this flag is set and the close entered serializer. Immediately
107 * after setting te_closing flag tl_close() enters serializer and waits until
108 * the callback finishes. This allows all functions called within serializer to
109 * simply check te_closing without any locks.
110 *
111 * Serializer management.
112 * ---------------------
113 *
114 * For COTS transports serializers are created when the endpoint is constructed
115 * and destroyed when the endpoint is destructed. CLTS transports use global
116 * serializers - one for sockets and one for TLI.
117 *
118 * COTS serializers have separate reference counts to deal with several
119 * endpoints sharing the same serializer. There is a subtle problem related to
120 * the serializer destruction. The serializer should never be destroyed by any
121 * function executed inside serializer. This means that close has to wait till
122 * all serializer activity for this endpoint is finished before it can drop the
123 * last reference on the endpoint (which may as well free the serializer). This
124 * is only relevant for COTS transports which manage serializers
125 * dynamically. For CLTS transports close may complete without waiting for all
126 * serializer activity to finish since serializer is only destroyed at driver
127 * detach time.
128 *
129 * COTS endpoints keep track of the number of outstanding requests on the
130 * serializer for the endpoint. The code handling accept() avoids changing
131 * client serializer if it has any pending messages on the serializer and
132 * instead moves acceptor to listener's serializer.
133 *
134 *
135 * Use of hash tables
136 * ------------------
137 *
138 * The driver uses modhash hash table implementation. Each transport uses two
139 * hash tables - one for finding endpoints by acceptor ID and another one for
140 * finding endpoints by address. For sockets TICOTS and TICOTSORD share the same
141 * pair of hash tables since sockets only use TICOTSORD.
142 *
143 * All hash tables lookups increment a reference count for returned endpoints,
144 * so we may safely check the endpoint state even when the endpoint is removed
145 * from the hash by another thread immediately after it is found.
146 *
147 *
148 * CLOSE processing
149 * ================
150 *
151 * The driver enters serializer twice on close(). The close sequence is the
152 * following:
153 *
154 * 1) Wait until closing is safe (te_closewait becomes zero)
155 * This step is needed to prevent close during serializer switches. In most
156 * cases (close happening after connection establishment) te_closewait is
157 * zero.
158 * 1) Set te_closing.
159 * 2) Call tl_close_ser() within serializer and wait for it to complete.
160 *
161 * te_close_ser simply marks endpoint and wakes up waiting tl_close().
162 * It also needs to clear write-side q_next pointers - this should be done
163 * before qprocsoff().
164 *
165 * This synchronous serializer entry during close is needed to ensure that
166 * the queue is valid everywhere inside the serializer.
167 *
168 * Note that in many cases close will execute tl_close_ser() synchronously,
169 * so it will not wait at all.
170 *
171 * 3) Calls qprocsoff().
172 * 4) Calls tl_close_finish_ser() within the serializer and waits for it to
173 * complete (for COTS transports). For CLTS transport there is no wait.
174 *
175 * tl_close_finish_ser() Finishes the close process and wakes up waiting
176 * close if there is any.
177 *
178 * Note that in most cases close will enter te_close_ser_finish()
179 * synchronously and will not wait at all.
180 *
181 *
182 * Flow Control
183 * ============
184 *
185 * The driver implements both read and write side service routines. No one calls
186 * putq() on the read queue. The read side service routine tl_rsrv() is called
187 * when the read side stream is back-enabled. It enters serializer synchronously
188 * (waits till serializer processing is complete). Within serializer it
189 * back-enables all endpoints blocked by the queue for connection-less
190 * transports and enables write side service processing for the peer for
191 * connection-oriented transports.
192 *
193 * Read and write side service routines use special mblk_sized space in the
194 * endpoint structure to enter perimeter.
195 *
196 * Write-side flow control
197 * -----------------------
198 *
199 * Write side flow control is a bit tricky. The driver needs to deal with two
200 * message queues - the explicit STREAMS message queue maintained by
201 * putq()/getq()/putbq() and the implicit queue within the serializer. These two
202 * queues should be synchronized to preserve message ordering and should
203 * maintain a single order determined by the order in which messages enter
204 * tl_wput(). In order to maintain the ordering between these two queues the
205 * STREAMS queue is only manipulated within the serializer, so the ordering is
206 * provided by the serializer.
207 *
208 * Functions called from the tl_wsrv() sometimes may call putbq(). To
209 * immediately stop any further processing of the STREAMS message queues the
210 * code calling putbq() also sets the te_nowsrv flag in the endpoint. The write
211 * side service processing stops when the flag is set.
212 *
213 * The tl_wsrv() function enters serializer synchronously and waits for it to
214 * complete. The serializer call-back tl_wsrv_ser() either drains all messages
215 * on the STREAMS queue or terminates when it notices the te_nowsrv flag
216 * set. Note that the maximum amount of messages processed by tl_wput_ser() is
217 * always bounded by the amount of messages on the STREAMS queue at the time
218 * tl_wsrv_ser() is entered. Any new messages may only appear on the STREAMS
219 * queue from another serialized entry which can't happen in parallel. This
220 * guarantees that tl_wput_ser() is complete in bounded time (there is no risk
221 * of it draining forever while writer places new messages on the STREAMS
222 * queue).
223 *
224 * Note that a closing endpoint never sets te_nowsrv and never calls putbq().
225 *
226 *
227 * Unix Domain Sockets
228 * ===================
229 *
230 * The driver knows the structure of Unix Domain sockets addresses and treats
231 * them differently from generic TLI addresses. For sockets implicit binds are
232 * requested by setting SOU_MAGIC_IMPLICIT in the soua_magic part of the address
233 * instead of using address length of zero. Explicit binds specify
234 * SOU_MAGIC_EXPLICIT as magic.
235 *
236 * For implicit binds we always use minor number as soua_vp part of the address
237 * and avoid any hash table lookups. This saves two hash tables lookups per
238 * anonymous bind.
239 *
240 * For explicit address we hash the vnode pointer instead of hashing the
241 * full-scale address+zone+length. Hashing by pointer is more efficient then
242 * hashing by the full address.
243 *
244 * For unix domain sockets the te_ap is always pointing to te_uxaddr part of the
245 * tep structure, so it should be never freed.
246 *
247 * Also for sockets the driver always uses minor number as acceptor id.
248 *
249 * TPI VIOLATIONS
250 * --------------
251 *
252 * This driver violates TPI in several respects for Unix Domain Sockets:
253 *
254 * 1) It treats O_T_BIND_REQ as T_BIND_REQ and refuses bind if an explicit bind
255 * is requested and the endpoint is already in use. There is no point in
256 * generating an unused address since this address will be rejected by
257 * sockfs anyway. For implicit binds it always generates a new address
258 * (sets soua_vp to its minor number).
259 *
260 * 2) It always uses minor number as acceptor ID and never uses queue
261 * pointer. It is ok since sockets get acceptor ID from T_CAPABILITY_REQ
262 * message and they do not use the queue pointer.
263 *
264 * 3) For Listener sockets the usual sequence is to issue bind() zero backlog
265 * followed by listen(). The listen() should be issued with non-zero
266 * backlog, so sotpi_listen() issues unbind request followed by bind
267 * request to the same address but with a non-zero qlen value. Both
268 * tl_bind() and tl_unbind() require write lock on the hash table to
269 * insert/remove the address. The driver does not remove the address from
270 * the hash for endpoints that are bound to the explicit address and have
271 * backlog of zero. During T_BIND_REQ processing if the address requested
272 * is equal to the address the endpoint already has it updates the backlog
273 * without reinserting the address in the hash table. This optimization
274 * avoids two hash table updates for each listener created. It always
275 * avoids the problem of a "stolen" address when another listener may use
276 * the same address between the unbind and bind and suddenly listen() fails
277 * because address is in use even though the bind() succeeded.
278 *
279 *
280 * CONNECTIONLESS TRANSPORTS
281 * =========================
282 *
283 * Connectionless transports all share the same serializer (one for TLI and one
284 * for Sockets). Functions executing behind serializer can check or modify state
285 * of any endpoint.
286 *
287 * When endpoint X talks to another endpoint Y it caches the pointer to Y in the
288 * te_lastep field. The next time X talks to some address A it checks whether A
289 * is the same as Y's address and if it is there is no need to lookup Y. If the
290 * address is different or the state of Y is not appropriate (e.g. closed or not
291 * idle) X does a lookup using tl_find_peer() and caches the new address.
292 * NOTE: tl_find_peer() never returns closing endpoint and it places a refhold
293 * on the endpoint found.
294 *
295 * During close of endpoint Y it doesn't try to remove itself from other
296 * endpoints caches. They will detect that Y is gone and will search the peer
297 * endpoint again.
298 *
299 * Flow Control Handling.
300 * ----------------------
301 *
302 * Each connectionless endpoint keeps a list of endpoints which are
303 * flow-controlled by its queue. It also keeps a pointer to the queue which
304 * flow-controls itself. Whenever flow control releases for endpoint X it
305 * enables all queues from the list. During close it also back-enables everyone
306 * in the list. If X is flow-controlled when it is closing it removes it from
307 * the peers list.
308 *
309 * DATA STRUCTURES
310 * ===============
311 *
312 * Each endpoint is represented by the tl_endpt_t structure which keeps all the
313 * endpoint state. For connection-oriented transports it has a keeps a list
314 * of pending connections (tl_icon_t). For connectionless transports it keeps a
315 * list of endpoints flow controlled by this one.
316 *
317 * Each transport type is represented by a per-transport data structure
318 * tl_transport_state_t. It contains a pointer to an acceptor ID hash and the
319 * endpoint address hash tables for each transport. It also contains pointer to
320 * transport serializer for connectionless transports.
321 *
322 * Each endpoint keeps a link to its transport structure, so the code can find
323 * all per-transport information quickly.
324 */
325
326 #include <sys/types.h>
327 #include <sys/inttypes.h>
328 #include <sys/stream.h>
329 #include <sys/stropts.h>
330 #define _SUN_TPI_VERSION 2
331 #include <sys/tihdr.h>
332 #include <sys/strlog.h>
333 #include <sys/debug.h>
334 #include <sys/cred.h>
335 #include <sys/errno.h>
336 #include <sys/kmem.h>
337 #include <sys/id_space.h>
338 #include <sys/modhash.h>
339 #include <sys/mkdev.h>
340 #include <sys/tl.h>
341 #include <sys/stat.h>
342 #include <sys/conf.h>
343 #include <sys/modctl.h>
344 #include <sys/strsun.h>
345 #include <sys/socket.h>
346 #include <sys/socketvar.h>
347 #include <sys/sysmacros.h>
348 #include <sys/xti_xtiopt.h>
349 #include <sys/ddi.h>
350 #include <sys/sunddi.h>
351 #include <sys/zone.h>
352 #include <inet/common.h> /* typedef int (*pfi_t)() for inet/optcom.h */
353 #include <inet/optcom.h>
354 #include <sys/strsubr.h>
355 #include <sys/ucred.h>
356 #include <sys/suntpi.h>
357 #include <sys/list.h>
358 #include <sys/serializer.h>
359
360 /*
361 * TBD List
362 * 14 Eliminate state changes through table
363 * 16. AF_UNIX socket options
364 * 17. connect() for ticlts
365 * 18. support for "netstat" to show AF_UNIX plus TLI local
366 * transport connections
367 * 21. sanity check to flushing on sending M_ERROR
368 */
369
370 /*
371 * CONSTANT DECLARATIONS
372 * --------------------
373 */
374
375 /*
376 * Local declarations
377 */
378 #define NEXTSTATE(EV, ST) ti_statetbl[EV][ST]
379
380 #define BADSEQNUM (-1) /* initial seq number used by T_DISCON_IND */
381 #define TL_BUFWAIT (10000) /* usecs to wait for allocb buffer timeout */
382 #define TL_TIDUSZ (64*1024) /* tidu size when "strmsgz" is unlimited (0) */
383 /*
384 * Hash tables size.
385 */
386 #define TL_HASH_SIZE 311
387
388 /*
389 * Definitions for module_info
390 */
391 #define TL_ID (104) /* module ID number */
392 #define TL_NAME "tl" /* module name */
393 #define TL_MINPSZ (0) /* min packet size */
394 #define TL_MAXPSZ INFPSZ /* max packet size ZZZ */
395 #define TL_HIWAT (16*1024) /* hi water mark */
396 #define TL_LOWAT (256) /* lo water mark */
397 /*
398 * Definition of minor numbers/modes for new transport provider modes.
399 * We view the socket use as a separate mode to get a separate name space.
400 */
401 #define TL_TICOTS 0 /* connection oriented transport */
402 #define TL_TICOTSORD 1 /* COTS w/ orderly release */
403 #define TL_TICLTS 2 /* connectionless transport */
404 #define TL_UNUSED 3
405 #define TL_SOCKET 4 /* Socket */
406 #define TL_SOCK_COTS (TL_SOCKET|TL_TICOTS)
407 #define TL_SOCK_COTSORD (TL_SOCKET|TL_TICOTSORD)
408 #define TL_SOCK_CLTS (TL_SOCKET|TL_TICLTS)
409
410 #define TL_MINOR_MASK 0x7
411 #define TL_MINOR_START (TL_TICLTS + 1)
412
413 /*
414 * LOCAL MACROS
415 */
416 #define T_ALIGN(p) P2ROUNDUP((p), sizeof (t_scalar_t))
417
418 /*
419 * EXTERNAL VARIABLE DECLARATIONS
420 * -----------------------------
421 */
422 /*
423 * state table defined in the OS space.c
424 */
425 extern char ti_statetbl[TE_NOEVENTS][TS_NOSTATES];
426
427 /*
428 * STREAMS DRIVER ENTRY POINTS PROTOTYPES
429 */
430 static int tl_open(queue_t *, dev_t *, int, int, cred_t *);
431 static int tl_close(queue_t *, int, cred_t *);
432 static void tl_wput(queue_t *, mblk_t *);
433 static void tl_wsrv(queue_t *);
434 static void tl_rsrv(queue_t *);
435
436 static int tl_attach(dev_info_t *, ddi_attach_cmd_t);
437 static int tl_detach(dev_info_t *, ddi_detach_cmd_t);
438 static int tl_info(dev_info_t *, ddi_info_cmd_t, void *, void **);
439
440
441 /*
442 * GLOBAL DATA STRUCTURES AND VARIABLES
443 * -----------------------------------
444 */
445
446 /*
447 * Table representing database of all options managed by T_SVR4_OPTMGMT_REQ
448 * For now, we only manage the SO_RECVUCRED option but we also have
449 * harmless dummy options to make things work with some common code we access.
450 */
451 opdes_t tl_opt_arr[] = {
452 /* The SO_TYPE is needed for the hack below */
453 {
454 SO_TYPE,
455 SOL_SOCKET,
456 OA_R,
457 OA_R,
458 OP_NP,
459 0,
460 sizeof (t_scalar_t),
461 0
462 },
463 {
464 SO_RECVUCRED,
465 SOL_SOCKET,
466 OA_RW,
467 OA_RW,
468 OP_NP,
469 0,
470 sizeof (int),
471 0
472 }
473 };
474
475 /*
476 * Table of all supported levels
477 * Note: Some levels (e.g. XTI_GENERIC) may be valid but may not have
478 * any supported options so we need this info separately.
479 *
480 * This is needed only for topmost tpi providers.
481 */
482 optlevel_t tl_valid_levels_arr[] = {
483 XTI_GENERIC,
484 SOL_SOCKET,
485 TL_PROT_LEVEL
486 };
487
488 #define TL_VALID_LEVELS_CNT A_CNT(tl_valid_levels_arr)
489 /*
490 * Current upper bound on the amount of space needed to return all options.
491 * Additional options with data size of sizeof(long) are handled automatically.
492 * Others need hand job.
493 */
494 #define TL_MAX_OPT_BUF_LEN \
495 ((A_CNT(tl_opt_arr) << 2) + \
496 (A_CNT(tl_opt_arr) * sizeof (struct opthdr)) + \
497 + 64 + sizeof (struct T_optmgmt_ack))
498
499 #define TL_OPT_ARR_CNT A_CNT(tl_opt_arr)
500
501 /*
502 * transport addr structure
503 */
504 typedef struct tl_addr {
505 zoneid_t ta_zoneid; /* Zone scope of address */
506 t_scalar_t ta_alen; /* length of abuf */
507 void *ta_abuf; /* the addr itself */
508 } tl_addr_t;
509
510 /*
511 * Refcounted version of serializer.
512 */
513 typedef struct tl_serializer {
514 uint_t ts_refcnt;
515 serializer_t *ts_serializer;
516 } tl_serializer_t;
517
518 /*
519 * Each transport type has a separate state.
520 * Per-transport state.
521 */
522 typedef struct tl_transport_state {
523 char *tr_name;
524 minor_t tr_minor;
525 uint32_t tr_defaddr;
526 mod_hash_t *tr_ai_hash;
527 mod_hash_t *tr_addr_hash;
528 tl_serializer_t *tr_serializer;
529 } tl_transport_state_t;
530
531 #define TL_DFADDR 0x1000
532
533 static tl_transport_state_t tl_transports[] = {
534 { "ticots", TL_TICOTS, TL_DFADDR, NULL, NULL, NULL },
535 { "ticotsord", TL_TICOTSORD, TL_DFADDR, NULL, NULL, NULL },
536 { "ticlts", TL_TICLTS, TL_DFADDR, NULL, NULL, NULL },
537 { "undefined", TL_UNUSED, TL_DFADDR, NULL, NULL, NULL },
538 { "sticots", TL_SOCK_COTS, TL_DFADDR, NULL, NULL, NULL },
539 { "sticotsord", TL_SOCK_COTSORD, TL_DFADDR, NULL, NULL },
540 { "sticlts", TL_SOCK_CLTS, TL_DFADDR, NULL, NULL, NULL }
541 };
542
543 #define TL_MAXTRANSPORT A_CNT(tl_transports)
544
545 struct tl_endpt;
546 typedef struct tl_endpt tl_endpt_t;
547
548 typedef void (tlproc_t)(mblk_t *, tl_endpt_t *);
549
550 /*
551 * Data structure used to represent pending connects.
552 * Records enough information so that the connecting peer can close
553 * before the connection gets accepted.
554 */
555 typedef struct tl_icon {
556 list_node_t ti_node;
557 struct tl_endpt *ti_tep; /* NULL if peer has already closed */
558 mblk_t *ti_mp; /* b_next list of data + ordrel_ind */
559 t_scalar_t ti_seqno; /* Sequence number */
560 } tl_icon_t;
561
562 typedef struct so_ux_addr soux_addr_t;
563 #define TL_SOUX_ADDRLEN sizeof (soux_addr_t)
564
565 /*
566 * Maximum number of unaccepted connection indications allowed per listener.
567 */
568 #define TL_MAXQLEN 4096
569 int tl_maxqlen = TL_MAXQLEN;
570
571 /*
572 * transport endpoint structure
573 */
574 struct tl_endpt {
575 queue_t *te_rq; /* stream read queue */
576 queue_t *te_wq; /* stream write queue */
577 uint32_t te_refcnt;
578 int32_t te_state; /* TPI state of endpoint */
579 minor_t te_minor; /* minor number */
580 #define te_seqno te_minor
581 uint_t te_flag; /* flag field */
582 boolean_t te_nowsrv;
583 tl_serializer_t *te_ser; /* Serializer to use */
584 #define te_serializer te_ser->ts_serializer
585
586 soux_addr_t te_uxaddr; /* Socket address */
587 #define te_magic te_uxaddr.soua_magic
588 #define te_vp te_uxaddr.soua_vp
589 tl_addr_t te_ap; /* addr bound to this endpt */
590 #define te_zoneid te_ap.ta_zoneid
591 #define te_alen te_ap.ta_alen
592 #define te_abuf te_ap.ta_abuf
593
594 tl_transport_state_t *te_transport;
595 #define te_addrhash te_transport->tr_addr_hash
596 #define te_aihash te_transport->tr_ai_hash
597 #define te_defaddr te_transport->tr_defaddr
598 cred_t *te_credp; /* endpoint user credentials */
599 mod_hash_hndl_t te_hash_hndl; /* Handle for address hash */
600
601 /*
602 * State specific for connection-oriented and connectionless transports.
603 */
604 union {
605 /* Connection-oriented state. */
606 struct {
607 t_uscalar_t _te_nicon; /* count of conn requests */
608 t_uscalar_t _te_qlen; /* max conn requests */
609 tl_endpt_t *_te_oconp; /* conn request pending */
610 tl_endpt_t *_te_conp; /* connected endpt */
611 #ifndef _ILP32
612 void *_te_pad;
613 #endif
614 list_t _te_iconp; /* list of conn ind. pending */
615 } _te_cots_state;
616 /* Connection-less state. */
617 struct {
618 tl_endpt_t *_te_lastep; /* last dest. endpoint */
619 tl_endpt_t *_te_flowq; /* flow controlled on whom */
620 list_node_t _te_flows; /* lists of connections */
621 list_t _te_flowlist; /* Who flowcontrols on me */
622 } _te_clts_state;
623 } _te_transport_state;
624 #define te_nicon _te_transport_state._te_cots_state._te_nicon
625 #define te_qlen _te_transport_state._te_cots_state._te_qlen
626 #define te_oconp _te_transport_state._te_cots_state._te_oconp
627 #define te_conp _te_transport_state._te_cots_state._te_conp
628 #define te_iconp _te_transport_state._te_cots_state._te_iconp
629 #define te_lastep _te_transport_state._te_clts_state._te_lastep
630 #define te_flowq _te_transport_state._te_clts_state._te_flowq
631 #define te_flowlist _te_transport_state._te_clts_state._te_flowlist
632 #define te_flows _te_transport_state._te_clts_state._te_flows
633
634 bufcall_id_t te_bufcid; /* outstanding bufcall id */
635 timeout_id_t te_timoutid; /* outstanding timeout id */
636 pid_t te_cpid; /* cached pid of endpoint */
637 t_uscalar_t te_acceptor_id; /* acceptor id for T_CONN_RES */
638 /*
639 * Pieces of the endpoint state needed for closing.
640 */
641 kmutex_t te_closelock;
642 kcondvar_t te_closecv;
643 uint8_t te_closing; /* The endpoint started closing */
644 uint8_t te_closewait; /* Wait in close until zero */
645 mblk_t te_closemp; /* for entering serializer on close */
646 mblk_t te_rsrvmp; /* for entering serializer on rsrv */
647 mblk_t te_wsrvmp; /* for entering serializer on wsrv */
648 kmutex_t te_srv_lock;
649 kcondvar_t te_srv_cv;
650 uint8_t te_rsrv_active; /* Running in tl_rsrv() */
651 uint8_t te_wsrv_active; /* Running in tl_wsrv() */
652 /*
653 * Pieces of the endpoint state needed for serializer transitions.
654 */
655 kmutex_t te_ser_lock; /* Protects the count below */
656 uint_t te_ser_count; /* Number of messages on serializer */
657 };
658
659 /*
660 * Flag values. Lower 4 bits specify that transport used.
661 * TL_LISTENER, TL_ACCEPTOR, TL_ACCEPTED and TL_EAGER are for debugging only,
662 * they allow to identify the endpoint more easily.
663 */
664 #define TL_LISTENER 0x00010 /* the listener endpoint */
665 #define TL_ACCEPTOR 0x00020 /* the accepting endpoint */
666 #define TL_EAGER 0x00040 /* connecting endpoint */
667 #define TL_ACCEPTED 0x00080 /* accepted connection */
668 #define TL_SETCRED 0x00100 /* flag to indicate sending of credentials */
669 #define TL_SETUCRED 0x00200 /* flag to indicate sending of ucred */
670 #define TL_SOCKUCRED 0x00400 /* flag to indicate sending of SCM_UCRED */
671 #define TL_ADDRHASHED 0x01000 /* Endpoint address is stored in te_addrhash */
672 #define TL_CLOSE_SER 0x10000 /* Endpoint close has entered the serializer */
673 /*
674 * Boolean checks for the endpoint type.
675 */
676 #define IS_CLTS(x) (((x)->te_flag & TL_TICLTS) != 0)
677 #define IS_COTS(x) (((x)->te_flag & TL_TICLTS) == 0)
678 #define IS_COTSORD(x) (((x)->te_flag & TL_TICOTSORD) != 0)
679 #define IS_SOCKET(x) (((x)->te_flag & TL_SOCKET) != 0)
680
681 /*
682 * Certain operations are always used together. These macros reduce the chance
683 * of missing a part of a combination.
684 */
685 #define TL_UNCONNECT(x) { tl_refrele(x); x = NULL; }
686 #define TL_REMOVE_PEER(x) { if ((x) != NULL) TL_UNCONNECT(x) }
687
688 #define TL_PUTBQ(x, mp) { \
689 ASSERT(!((x)->te_flag & TL_CLOSE_SER)); \
690 (x)->te_nowsrv = B_TRUE; \
691 (void) putbq((x)->te_wq, mp); \
692 }
693
694 #define TL_QENABLE(x) { (x)->te_nowsrv = B_FALSE; qenable((x)->te_wq); }
695 #define TL_PUTQ(x, mp) { (x)->te_nowsrv = B_FALSE; (void)putq((x)->te_wq, mp); }
696
697 /*
698 * STREAMS driver glue data structures.
699 */
700 static struct module_info tl_minfo = {
701 TL_ID, /* mi_idnum */
702 TL_NAME, /* mi_idname */
703 TL_MINPSZ, /* mi_minpsz */
704 TL_MAXPSZ, /* mi_maxpsz */
705 TL_HIWAT, /* mi_hiwat */
706 TL_LOWAT /* mi_lowat */
707 };
708
709 static struct qinit tl_rinit = {
710 NULL, /* qi_putp */
711 (int (*)())tl_rsrv, /* qi_srvp */
712 tl_open, /* qi_qopen */
713 tl_close, /* qi_qclose */
714 NULL, /* qi_qadmin */
715 &tl_minfo, /* qi_minfo */
716 NULL /* qi_mstat */
717 };
718
719 static struct qinit tl_winit = {
720 (int (*)())tl_wput, /* qi_putp */
721 (int (*)())tl_wsrv, /* qi_srvp */
722 NULL, /* qi_qopen */
723 NULL, /* qi_qclose */
724 NULL, /* qi_qadmin */
725 &tl_minfo, /* qi_minfo */
726 NULL /* qi_mstat */
727 };
728
729 static struct streamtab tlinfo = {
730 &tl_rinit, /* st_rdinit */
731 &tl_winit, /* st_wrinit */
732 NULL, /* st_muxrinit */
733 NULL /* st_muxwrinit */
734 };
735
736 DDI_DEFINE_STREAM_OPS(tl_devops, nulldev, nulldev, tl_attach, tl_detach,
737 nulldev, tl_info, D_MP, &tlinfo, ddi_quiesce_not_supported);
738
739 static struct modldrv modldrv = {
740 &mod_driverops, /* Type of module -- pseudo driver here */
741 "TPI Local Transport (tl)",
742 &tl_devops, /* driver ops */
743 };
744
745 /*
746 * Module linkage information for the kernel.
747 */
748 static struct modlinkage modlinkage = {
749 MODREV_1,
750 &modldrv,
751 NULL
752 };
753
754 /*
755 * Templates for response to info request
756 * Check sanity of unlimited connect data etc.
757 */
758
759 #define TL_CLTS_PROVIDER_FLAG (XPG4_1|SENDZERO)
760 #define TL_COTS_PROVIDER_FLAG (XPG4_1|SENDZERO)
761
762 static struct T_info_ack tl_cots_info_ack =
763 {
764 T_INFO_ACK, /* PRIM_type -always T_INFO_ACK */
765 T_INFINITE, /* TSDU size */
766 T_INFINITE, /* ETSDU size */
767 T_INFINITE, /* CDATA_size */
768 T_INFINITE, /* DDATA_size */
769 T_INFINITE, /* ADDR_size */
770 T_INFINITE, /* OPT_size */
771 0, /* TIDU_size - fill at run time */
772 T_COTS, /* SERV_type */
773 -1, /* CURRENT_state */
774 TL_COTS_PROVIDER_FLAG /* PROVIDER_flag */
775 };
776
777 static struct T_info_ack tl_clts_info_ack =
778 {
779 T_INFO_ACK, /* PRIM_type - always T_INFO_ACK */
780 0, /* TSDU_size - fill at run time */
781 -2, /* ETSDU_size -2 => not supported */
782 -2, /* CDATA_size -2 => not supported */
783 -2, /* DDATA_size -2 => not supported */
784 -1, /* ADDR_size -1 => infinite */
785 -1, /* OPT_size */
786 0, /* TIDU_size - fill at run time */
787 T_CLTS, /* SERV_type */
788 -1, /* CURRENT_state */
789 TL_CLTS_PROVIDER_FLAG /* PROVIDER_flag */
790 };
791
792 /*
793 * private copy of devinfo pointer used in tl_info
794 */
795 static dev_info_t *tl_dip;
796
797 /*
798 * Endpoints cache.
799 */
800 static kmem_cache_t *tl_cache;
801 /*
802 * Minor number space.
803 */
804 static id_space_t *tl_minors;
805
806 /*
807 * Default Data Unit size.
808 */
809 static t_scalar_t tl_tidusz;
810
811 /*
812 * Size of hash tables.
813 */
814 static size_t tl_hash_size = TL_HASH_SIZE;
815
816 /*
817 * Debug and test variable ONLY. Turn off T_CONN_IND queueing
818 * for sockets.
819 */
820 static int tl_disable_early_connect = 0;
821 static int tl_client_closing_when_accepting;
822
823 static int tl_serializer_noswitch;
824
825 /*
826 * LOCAL FUNCTION PROTOTYPES
827 * -------------------------
828 */
829 static boolean_t tl_eqaddr(tl_addr_t *, tl_addr_t *);
830 static void tl_do_proto(mblk_t *, tl_endpt_t *);
831 static void tl_do_ioctl(mblk_t *, tl_endpt_t *);
832 static void tl_do_ioctl_ser(mblk_t *, tl_endpt_t *);
833 static void tl_error_ack(queue_t *, mblk_t *, t_scalar_t, t_scalar_t,
834 t_scalar_t);
835 static void tl_bind(mblk_t *, tl_endpt_t *);
836 static void tl_bind_ser(mblk_t *, tl_endpt_t *);
837 static void tl_ok_ack(queue_t *, mblk_t *mp, t_scalar_t);
838 static void tl_unbind(mblk_t *, tl_endpt_t *);
839 static void tl_optmgmt(queue_t *, mblk_t *);
840 static void tl_conn_req(queue_t *, mblk_t *);
841 static void tl_conn_req_ser(mblk_t *, tl_endpt_t *);
842 static void tl_conn_res(mblk_t *, tl_endpt_t *);
843 static void tl_discon_req(mblk_t *, tl_endpt_t *);
844 static void tl_capability_req(mblk_t *, tl_endpt_t *);
845 static void tl_info_req_ser(mblk_t *, tl_endpt_t *);
846 static void tl_addr_req_ser(mblk_t *, tl_endpt_t *);
847 static void tl_info_req(mblk_t *, tl_endpt_t *);
848 static void tl_addr_req(mblk_t *, tl_endpt_t *);
849 static void tl_connected_cots_addr_req(mblk_t *, tl_endpt_t *);
850 static void tl_data(mblk_t *, tl_endpt_t *);
851 static void tl_exdata(mblk_t *, tl_endpt_t *);
852 static void tl_ordrel(mblk_t *, tl_endpt_t *);
853 static void tl_unitdata(mblk_t *, tl_endpt_t *);
854 static void tl_unitdata_ser(mblk_t *, tl_endpt_t *);
855 static void tl_uderr(queue_t *, mblk_t *, t_scalar_t);
856 static tl_endpt_t *tl_find_peer(tl_endpt_t *, tl_addr_t *);
857 static tl_endpt_t *tl_sock_find_peer(tl_endpt_t *, struct so_ux_addr *);
858 static boolean_t tl_get_any_addr(tl_endpt_t *, tl_addr_t *);
859 static void tl_cl_backenable(tl_endpt_t *);
860 static void tl_co_unconnect(tl_endpt_t *);
861 static mblk_t *tl_resizemp(mblk_t *, ssize_t);
862 static void tl_discon_ind(tl_endpt_t *, uint32_t);
863 static mblk_t *tl_discon_ind_alloc(uint32_t, t_scalar_t);
864 static mblk_t *tl_ordrel_ind_alloc(void);
865 static tl_icon_t *tl_icon_find(tl_endpt_t *, t_scalar_t);
866 static void tl_icon_queuemsg(tl_endpt_t *, t_scalar_t, mblk_t *);
867 static boolean_t tl_icon_hasprim(tl_endpt_t *, t_scalar_t, t_scalar_t);
868 static void tl_icon_sendmsgs(tl_endpt_t *, mblk_t **);
869 static void tl_icon_freemsgs(mblk_t **);
870 static void tl_merror(queue_t *, mblk_t *, int);
871 static void tl_fill_option(uchar_t *, cred_t *, pid_t, int, cred_t *);
872 static int tl_default_opt(queue_t *, int, int, uchar_t *);
873 static int tl_get_opt(queue_t *, int, int, uchar_t *);
874 static int tl_set_opt(queue_t *, uint_t, int, int, uint_t, uchar_t *, uint_t *,
875 uchar_t *, void *, cred_t *);
876 static void tl_memrecover(queue_t *, mblk_t *, size_t);
877 static void tl_freetip(tl_endpt_t *, tl_icon_t *);
878 static void tl_free(tl_endpt_t *);
879 static int tl_constructor(void *, void *, int);
880 static void tl_destructor(void *, void *);
881 static void tl_find_callback(mod_hash_key_t, mod_hash_val_t);
882 static tl_serializer_t *tl_serializer_alloc(int);
883 static void tl_serializer_refhold(tl_serializer_t *);
884 static void tl_serializer_refrele(tl_serializer_t *);
885 static void tl_serializer_enter(tl_endpt_t *, tlproc_t, mblk_t *);
886 static void tl_serializer_exit(tl_endpt_t *);
887 static boolean_t tl_noclose(tl_endpt_t *);
888 static void tl_closeok(tl_endpt_t *);
889 static void tl_refhold(tl_endpt_t *);
890 static void tl_refrele(tl_endpt_t *);
891 static int tl_hash_cmp_addr(mod_hash_key_t, mod_hash_key_t);
892 static uint_t tl_hash_by_addr(void *, mod_hash_key_t);
893 static void tl_close_ser(mblk_t *, tl_endpt_t *);
894 static void tl_close_finish_ser(mblk_t *, tl_endpt_t *);
895 static void tl_wput_data_ser(mblk_t *, tl_endpt_t *);
896 static void tl_proto_ser(mblk_t *, tl_endpt_t *);
897 static void tl_putq_ser(mblk_t *, tl_endpt_t *);
898 static void tl_wput_common_ser(mblk_t *, tl_endpt_t *);
899 static void tl_wput_ser(mblk_t *, tl_endpt_t *);
900 static void tl_wsrv_ser(mblk_t *, tl_endpt_t *);
901 static void tl_rsrv_ser(mblk_t *, tl_endpt_t *);
902 static void tl_addr_unbind(tl_endpt_t *);
903
904 /*
905 * Intialize option database object for TL
906 */
907
908 optdb_obj_t tl_opt_obj = {
909 tl_default_opt, /* TL default value function pointer */
910 tl_get_opt, /* TL get function pointer */
911 tl_set_opt, /* TL set function pointer */
912 TL_OPT_ARR_CNT, /* TL option database count of entries */
913 tl_opt_arr, /* TL option database */
914 TL_VALID_LEVELS_CNT, /* TL valid level count of entries */
915 tl_valid_levels_arr /* TL valid level array */
916 };
917
918 /*
919 * LOCAL FUNCTIONS AND DRIVER ENTRY POINTS
920 * ---------------------------------------
921 */
922
923 /*
924 * Loadable module routines
925 */
926 int
927 _init(void)
928 {
929 return (mod_install(&modlinkage));
930 }
931
932 int
933 _fini(void)
934 {
935 return (mod_remove(&modlinkage));
936 }
937
938 int
939 _info(struct modinfo *modinfop)
940 {
941 return (mod_info(&modlinkage, modinfop));
942 }
943
944 /*
945 * Driver Entry Points and Other routines
946 */
947 static int
948 tl_attach(dev_info_t *devi, ddi_attach_cmd_t cmd)
949 {
950 int i;
951 char name[32];
952
953 /*
954 * Resume from a checkpoint state.
955 */
956 if (cmd == DDI_RESUME)
957 return (DDI_SUCCESS);
958
959 if (cmd != DDI_ATTACH)
960 return (DDI_FAILURE);
961
962 /*
963 * Deduce TIDU size to use. Note: "strmsgsz" being 0 has semantics that
964 * streams message sizes can be unlimited. We use a defined constant
965 * instead.
966 */
967 tl_tidusz = strmsgsz != 0 ? (t_scalar_t)strmsgsz : TL_TIDUSZ;
968
969 /*
970 * Create subdevices for each transport.
971 */
972 for (i = 0; i < TL_UNUSED; i++) {
973 if (ddi_create_minor_node(devi,
974 tl_transports[i].tr_name,
975 S_IFCHR, tl_transports[i].tr_minor,
976 DDI_PSEUDO, NULL) == DDI_FAILURE) {
977 ddi_remove_minor_node(devi, NULL);
978 return (DDI_FAILURE);
979 }
980 }
981
982 tl_cache = kmem_cache_create("tl_cache", sizeof (tl_endpt_t),
983 0, tl_constructor, tl_destructor, NULL, NULL, NULL, 0);
984
985 if (tl_cache == NULL) {
986 ddi_remove_minor_node(devi, NULL);
987 return (DDI_FAILURE);
988 }
989
990 tl_minors = id_space_create("tl_minor_space",
991 TL_MINOR_START, MAXMIN32 - TL_MINOR_START + 1);
992
993 /*
994 * Create ID space for minor numbers
995 */
996 for (i = 0; i < TL_MAXTRANSPORT; i++) {
997 tl_transport_state_t *t = &tl_transports[i];
998
999 if (i == TL_UNUSED)
1000 continue;
1001
1002 /* Socket COTSORD shares namespace with COTS */
1003 if (i == TL_SOCK_COTSORD) {
1004 t->tr_ai_hash =
1005 tl_transports[TL_SOCK_COTS].tr_ai_hash;
1006 ASSERT(t->tr_ai_hash != NULL);
1007 t->tr_addr_hash =
1008 tl_transports[TL_SOCK_COTS].tr_addr_hash;
1009 ASSERT(t->tr_addr_hash != NULL);
1010 continue;
1011 }
1012
1013 /*
1014 * Create hash tables.
1015 */
1016 (void) snprintf(name, sizeof (name), "%s_ai_hash",
1017 t->tr_name);
1018 #ifdef _ILP32
1019 if (i & TL_SOCKET)
1020 t->tr_ai_hash =
1021 mod_hash_create_idhash(name, tl_hash_size - 1,
1022 mod_hash_null_valdtor);
1023 else
1024 t->tr_ai_hash =
1025 mod_hash_create_ptrhash(name, tl_hash_size,
1026 mod_hash_null_valdtor, sizeof (queue_t));
1027 #else
1028 t->tr_ai_hash =
1029 mod_hash_create_idhash(name, tl_hash_size - 1,
1030 mod_hash_null_valdtor);
1031 #endif /* _ILP32 */
1032
1033 if (i & TL_SOCKET) {
1034 (void) snprintf(name, sizeof (name), "%s_sockaddr_hash",
1035 t->tr_name);
1036 t->tr_addr_hash = mod_hash_create_ptrhash(name,
1037 tl_hash_size, mod_hash_null_valdtor,
1038 sizeof (uintptr_t));
1039 } else {
1040 (void) snprintf(name, sizeof (name), "%s_addr_hash",
1041 t->tr_name);
1042 t->tr_addr_hash = mod_hash_create_extended(name,
1043 tl_hash_size, mod_hash_null_keydtor,
1044 mod_hash_null_valdtor,
1045 tl_hash_by_addr, NULL, tl_hash_cmp_addr, KM_SLEEP);
1046 }
1047
1048 /* Create serializer for connectionless transports. */
1049 if (i & TL_TICLTS)
1050 t->tr_serializer = tl_serializer_alloc(KM_SLEEP);
1051 }
1052
1053 tl_dip = devi;
1054
1055 return (DDI_SUCCESS);
1056 }
1057
1058 static int
1059 tl_detach(dev_info_t *devi, ddi_detach_cmd_t cmd)
1060 {
1061 int i;
1062
1063 if (cmd == DDI_SUSPEND)
1064 return (DDI_SUCCESS);
1065
1066 if (cmd != DDI_DETACH)
1067 return (DDI_FAILURE);
1068
1069 /*
1070 * Destroy arenas and hash tables.
1071 */
1072 for (i = 0; i < TL_MAXTRANSPORT; i++) {
1073 tl_transport_state_t *t = &tl_transports[i];
1074
1075 if ((i == TL_UNUSED) || (i == TL_SOCK_COTSORD))
1076 continue;
1077
1078 EQUIV(i & TL_TICLTS, t->tr_serializer != NULL);
1079 if (t->tr_serializer != NULL) {
1080 tl_serializer_refrele(t->tr_serializer);
1081 t->tr_serializer = NULL;
1082 }
1083
1084 #ifdef _ILP32
1085 if (i & TL_SOCKET)
1086 mod_hash_destroy_idhash(t->tr_ai_hash);
1087 else
1088 mod_hash_destroy_ptrhash(t->tr_ai_hash);
1089 #else
1090 mod_hash_destroy_idhash(t->tr_ai_hash);
1091 #endif /* _ILP32 */
1092 t->tr_ai_hash = NULL;
1093 if (i & TL_SOCKET)
1094 mod_hash_destroy_ptrhash(t->tr_addr_hash);
1095 else
1096 mod_hash_destroy_hash(t->tr_addr_hash);
1097 t->tr_addr_hash = NULL;
1098 }
1099
1100 kmem_cache_destroy(tl_cache);
1101 tl_cache = NULL;
1102 id_space_destroy(tl_minors);
1103 tl_minors = NULL;
1104 ddi_remove_minor_node(devi, NULL);
1105 return (DDI_SUCCESS);
1106 }
1107
1108 /* ARGSUSED */
1109 static int
1110 tl_info(dev_info_t *dip, ddi_info_cmd_t infocmd, void *arg, void **result)
1111 {
1112
1113 int retcode = DDI_FAILURE;
1114
1115 switch (infocmd) {
1116
1117 case DDI_INFO_DEVT2DEVINFO:
1118 if (tl_dip != NULL) {
1119 *result = (void *)tl_dip;
1120 retcode = DDI_SUCCESS;
1121 }
1122 break;
1123
1124 case DDI_INFO_DEVT2INSTANCE:
1125 *result = (void *)0;
1126 retcode = DDI_SUCCESS;
1127 break;
1128
1129 default:
1130 break;
1131 }
1132 return (retcode);
1133 }
1134
1135 /*
1136 * Endpoint reference management.
1137 */
1138 static void
1139 tl_refhold(tl_endpt_t *tep)
1140 {
1141 atomic_add_32(&tep->te_refcnt, 1);
1142 }
1143
1144 static void
1145 tl_refrele(tl_endpt_t *tep)
1146 {
1147 ASSERT(tep->te_refcnt != 0);
1148
1149 if (atomic_add_32_nv(&tep->te_refcnt, -1) == 0)
1150 tl_free(tep);
1151 }
1152
1153 /*ARGSUSED*/
1154 static int
1155 tl_constructor(void *buf, void *cdrarg, int kmflags)
1156 {
1157 tl_endpt_t *tep = buf;
1158
1159 bzero(tep, sizeof (tl_endpt_t));
1160 mutex_init(&tep->te_closelock, NULL, MUTEX_DEFAULT, NULL);
1161 cv_init(&tep->te_closecv, NULL, CV_DEFAULT, NULL);
1162 mutex_init(&tep->te_srv_lock, NULL, MUTEX_DEFAULT, NULL);
1163 cv_init(&tep->te_srv_cv, NULL, CV_DEFAULT, NULL);
1164 mutex_init(&tep->te_ser_lock, NULL, MUTEX_DEFAULT, NULL);
1165
1166 return (0);
1167 }
1168
1169 /*ARGSUSED*/
1170 static void
1171 tl_destructor(void *buf, void *cdrarg)
1172 {
1173 tl_endpt_t *tep = buf;
1174
1175 mutex_destroy(&tep->te_closelock);
1176 cv_destroy(&tep->te_closecv);
1177 mutex_destroy(&tep->te_srv_lock);
1178 cv_destroy(&tep->te_srv_cv);
1179 mutex_destroy(&tep->te_ser_lock);
1180 }
1181
1182 static void
1183 tl_free(tl_endpt_t *tep)
1184 {
1185 ASSERT(tep->te_refcnt == 0);
1186 ASSERT(tep->te_transport != NULL);
1187 ASSERT(tep->te_rq == NULL);
1188 ASSERT(tep->te_wq == NULL);
1189 ASSERT(tep->te_ser != NULL);
1190 ASSERT(tep->te_ser_count == 0);
1191 ASSERT(! (tep->te_flag & TL_ADDRHASHED));
1192
1193 if (IS_SOCKET(tep)) {
1194 ASSERT(tep->te_alen == TL_SOUX_ADDRLEN);
1195 ASSERT(tep->te_abuf == &tep->te_uxaddr);
1196 ASSERT(tep->te_vp == (void *)(uintptr_t)tep->te_minor);
1197 ASSERT(tep->te_magic == SOU_MAGIC_IMPLICIT);
1198 } else if (tep->te_abuf != NULL) {
1199 kmem_free(tep->te_abuf, tep->te_alen);
1200 tep->te_alen = -1; /* uninitialized */
1201 tep->te_abuf = NULL;
1202 } else {
1203 ASSERT(tep->te_alen == -1);
1204 }
1205
1206 id_free(tl_minors, tep->te_minor);
1207 ASSERT(tep->te_credp == NULL);
1208
1209 if (tep->te_hash_hndl != NULL)
1210 mod_hash_cancel(tep->te_addrhash, &tep->te_hash_hndl);
1211
1212 if (IS_COTS(tep)) {
1213 TL_REMOVE_PEER(tep->te_conp);
1214 TL_REMOVE_PEER(tep->te_oconp);
1215 tl_serializer_refrele(tep->te_ser);
1216 tep->te_ser = NULL;
1217 ASSERT(tep->te_nicon == 0);
1218 ASSERT(list_head(&tep->te_iconp) == NULL);
1219 } else {
1220 ASSERT(tep->te_lastep == NULL);
1221 ASSERT(list_head(&tep->te_flowlist) == NULL);
1222 ASSERT(tep->te_flowq == NULL);
1223 }
1224
1225 ASSERT(tep->te_bufcid == 0);
1226 ASSERT(tep->te_timoutid == 0);
1227 bzero(&tep->te_ap, sizeof (tep->te_ap));
1228 tep->te_acceptor_id = 0;
1229
1230 ASSERT(tep->te_closewait == 0);
1231 ASSERT(!tep->te_rsrv_active);
1232 ASSERT(!tep->te_wsrv_active);
1233 tep->te_closing = 0;
1234 tep->te_nowsrv = B_FALSE;
1235 tep->te_flag = 0;
1236
1237 kmem_cache_free(tl_cache, tep);
1238 }
1239
1240 /*
1241 * Allocate/free reference-counted wrappers for serializers.
1242 */
1243 static tl_serializer_t *
1244 tl_serializer_alloc(int flags)
1245 {
1246 tl_serializer_t *s = kmem_alloc(sizeof (tl_serializer_t), flags);
1247 serializer_t *ser;
1248
1249 if (s == NULL)
1250 return (NULL);
1251
1252 ser = serializer_create(flags);
1253
1254 if (ser == NULL) {
1255 kmem_free(s, sizeof (tl_serializer_t));
1256 return (NULL);
1257 }
1258
1259 s->ts_refcnt = 1;
1260 s->ts_serializer = ser;
1261 return (s);
1262 }
1263
1264 static void
1265 tl_serializer_refhold(tl_serializer_t *s)
1266 {
1267 atomic_add_32(&s->ts_refcnt, 1);
1268 }
1269
1270 static void
1271 tl_serializer_refrele(tl_serializer_t *s)
1272 {
1273 if (atomic_add_32_nv(&s->ts_refcnt, -1) == 0) {
1274 serializer_destroy(s->ts_serializer);
1275 kmem_free(s, sizeof (tl_serializer_t));
1276 }
1277 }
1278
1279 /*
1280 * Post a request on the endpoint serializer. For COTS transports keep track of
1281 * the number of pending requests.
1282 */
1283 static void
1284 tl_serializer_enter(tl_endpt_t *tep, tlproc_t tlproc, mblk_t *mp)
1285 {
1286 if (IS_COTS(tep)) {
1287 mutex_enter(&tep->te_ser_lock);
1288 tep->te_ser_count++;
1289 mutex_exit(&tep->te_ser_lock);
1290 }
1291 serializer_enter(tep->te_serializer, (srproc_t *)tlproc, mp, tep);
1292 }
1293
1294 /*
1295 * Complete processing the request on the serializer. Decrement the counter for
1296 * pending requests for COTS transports.
1297 */
1298 static void
1299 tl_serializer_exit(tl_endpt_t *tep)
1300 {
1301 if (IS_COTS(tep)) {
1302 mutex_enter(&tep->te_ser_lock);
1303 ASSERT(tep->te_ser_count != 0);
1304 tep->te_ser_count--;
1305 mutex_exit(&tep->te_ser_lock);
1306 }
1307 }
1308
1309 /*
1310 * Hash management functions.
1311 */
1312
1313 /*
1314 * Return TRUE if two addresses are equal, false otherwise.
1315 */
1316 static boolean_t
1317 tl_eqaddr(tl_addr_t *ap1, tl_addr_t *ap2)
1318 {
1319 return ((ap1->ta_alen > 0) &&
1320 (ap1->ta_alen == ap2->ta_alen) &&
1321 (ap1->ta_zoneid == ap2->ta_zoneid) &&
1322 (bcmp(ap1->ta_abuf, ap2->ta_abuf, ap1->ta_alen) == 0));
1323 }
1324
1325 /*
1326 * This function is called whenever an endpoint is found in the hash table.
1327 */
1328 /* ARGSUSED0 */
1329 static void
1330 tl_find_callback(mod_hash_key_t key, mod_hash_val_t val)
1331 {
1332 tl_refhold((tl_endpt_t *)val);
1333 }
1334
1335 /*
1336 * Address hash function.
1337 */
1338 /* ARGSUSED */
1339 static uint_t
1340 tl_hash_by_addr(void *hash_data, mod_hash_key_t key)
1341 {
1342 tl_addr_t *ap = (tl_addr_t *)key;
1343 size_t len = ap->ta_alen;
1344 uchar_t *p = ap->ta_abuf;
1345 uint_t i, g;
1346
1347 ASSERT((len > 0) && (p != NULL));
1348
1349 for (i = ap->ta_zoneid; len -- != 0; p++) {
1350 i = (i << 4) + (*p);
1351 if ((g = (i & 0xf0000000U)) != 0) {
1352 i ^= (g >> 24);
1353 i ^= g;
1354 }
1355 }
1356 return (i);
1357 }
1358
1359 /*
1360 * This function is used by hash lookups. It compares two generic addresses.
1361 */
1362 static int
1363 tl_hash_cmp_addr(mod_hash_key_t key1, mod_hash_key_t key2)
1364 {
1365 #ifdef DEBUG
1366 tl_addr_t *ap1 = (tl_addr_t *)key1;
1367 tl_addr_t *ap2 = (tl_addr_t *)key2;
1368
1369 ASSERT(key1 != NULL);
1370 ASSERT(key2 != NULL);
1371
1372 ASSERT(ap1->ta_abuf != NULL);
1373 ASSERT(ap2->ta_abuf != NULL);
1374 ASSERT(ap1->ta_alen > 0);
1375 ASSERT(ap2->ta_alen > 0);
1376 #endif
1377
1378 return (! tl_eqaddr((tl_addr_t *)key1, (tl_addr_t *)key2));
1379 }
1380
1381 /*
1382 * Prevent endpoint from closing if possible.
1383 * Return B_TRUE on success, B_FALSE on failure.
1384 */
1385 static boolean_t
1386 tl_noclose(tl_endpt_t *tep)
1387 {
1388 boolean_t rc = B_FALSE;
1389
1390 mutex_enter(&tep->te_closelock);
1391 if (! tep->te_closing) {
1392 ASSERT(tep->te_closewait == 0);
1393 tep->te_closewait++;
1394 rc = B_TRUE;
1395 }
1396 mutex_exit(&tep->te_closelock);
1397 return (rc);
1398 }
1399
1400 /*
1401 * Allow endpoint to close if needed.
1402 */
1403 static void
1404 tl_closeok(tl_endpt_t *tep)
1405 {
1406 ASSERT(tep->te_closewait > 0);
1407 mutex_enter(&tep->te_closelock);
1408 ASSERT(tep->te_closewait == 1);
1409 tep->te_closewait--;
1410 cv_signal(&tep->te_closecv);
1411 mutex_exit(&tep->te_closelock);
1412 }
1413
1414 /*
1415 * STREAMS open entry point.
1416 */
1417 /* ARGSUSED */
1418 static int
1419 tl_open(queue_t *rq, dev_t *devp, int oflag, int sflag, cred_t *credp)
1420 {
1421 tl_endpt_t *tep;
1422 minor_t minor = getminor(*devp);
1423
1424 /*
1425 * Driver is called directly. Both CLONEOPEN and MODOPEN
1426 * are illegal
1427 */
1428 if ((sflag == CLONEOPEN) || (sflag == MODOPEN))
1429 return (ENXIO);
1430
1431 if (rq->q_ptr != NULL)
1432 return (0);
1433
1434 /* Minor number should specify the mode used for the driver. */
1435 if ((minor >= TL_UNUSED))
1436 return (ENXIO);
1437
1438 if (oflag & SO_SOCKSTR) {
1439 minor |= TL_SOCKET;
1440 }
1441
1442 tep = kmem_cache_alloc(tl_cache, KM_SLEEP);
1443 tep->te_refcnt = 1;
1444 tep->te_cpid = curproc->p_pid;
1445 rq->q_ptr = WR(rq)->q_ptr = tep;
1446 tep->te_state = TS_UNBND;
1447 tep->te_credp = credp;
1448 crhold(credp);
1449 tep->te_zoneid = getzoneid();
1450
1451 tep->te_flag = minor & TL_MINOR_MASK;
1452 tep->te_transport = &tl_transports[minor];
1453
1454 /* Allocate a unique minor number for this instance. */
1455 tep->te_minor = (minor_t)id_alloc(tl_minors);
1456
1457 /* Reserve hash handle for bind(). */
1458 (void) mod_hash_reserve(tep->te_addrhash, &tep->te_hash_hndl);
1459
1460 /* Transport-specific initialization */
1461 if (IS_COTS(tep)) {
1462 /* Use private serializer */
1463 tep->te_ser = tl_serializer_alloc(KM_SLEEP);
1464
1465 /* Create list for pending connections */
1466 list_create(&tep->te_iconp, sizeof (tl_icon_t),
1467 offsetof(tl_icon_t, ti_node));
1468 tep->te_qlen = 0;
1469 tep->te_nicon = 0;
1470 tep->te_oconp = NULL;
1471 tep->te_conp = NULL;
1472 } else {
1473 /* Use shared serializer */
1474 tep->te_ser = tep->te_transport->tr_serializer;
1475 bzero(&tep->te_flows, sizeof (list_node_t));
1476 /* Create list for flow control */
1477 list_create(&tep->te_flowlist, sizeof (tl_endpt_t),
1478 offsetof(tl_endpt_t, te_flows));
1479 tep->te_flowq = NULL;
1480 tep->te_lastep = NULL;
1481
1482 }
1483
1484 /* Initialize endpoint address */
1485 if (IS_SOCKET(tep)) {
1486 /* Socket-specific address handling. */
1487 tep->te_alen = TL_SOUX_ADDRLEN;
1488 tep->te_abuf = &tep->te_uxaddr;
1489 tep->te_vp = (void *)(uintptr_t)tep->te_minor;
1490 tep->te_magic = SOU_MAGIC_IMPLICIT;
1491 } else {
1492 tep->te_alen = -1;
1493 tep->te_abuf = NULL;
1494 }
1495
1496 /* clone the driver */
1497 *devp = makedevice(getmajor(*devp), tep->te_minor);
1498
1499 tep->te_rq = rq;
1500 tep->te_wq = WR(rq);
1501
1502 #ifdef _ILP32
1503 if (IS_SOCKET(tep))
1504 tep->te_acceptor_id = tep->te_minor;
1505 else
1506 tep->te_acceptor_id = (t_uscalar_t)rq;
1507 #else
1508 tep->te_acceptor_id = tep->te_minor;
1509 #endif /* _ILP32 */
1510
1511
1512 qprocson(rq);
1513
1514 /*
1515 * Insert acceptor ID in the hash. The AI hash always sleeps on
1516 * insertion so insertion can't fail.
1517 */
1518 (void) mod_hash_insert(tep->te_transport->tr_ai_hash,
1519 (mod_hash_key_t)(uintptr_t)tep->te_acceptor_id,
1520 (mod_hash_val_t)tep);
1521
1522 return (0);
1523 }
1524
1525 /* ARGSUSED1 */
1526 static int
1527 tl_close(queue_t *rq, int flag, cred_t *credp)
1528 {
1529 tl_endpt_t *tep = (tl_endpt_t *)rq->q_ptr;
1530 tl_endpt_t *elp = NULL;
1531 queue_t *wq = tep->te_wq;
1532 int rc;
1533
1534 ASSERT(wq == WR(rq));
1535
1536 /*
1537 * Remove the endpoint from acceptor hash.
1538 */
1539 rc = mod_hash_remove(tep->te_transport->tr_ai_hash,
1540 (mod_hash_key_t)(uintptr_t)tep->te_acceptor_id,
1541 (mod_hash_val_t *)&elp);
1542 ASSERT(rc == 0 && tep == elp);
1543 if ((rc != 0) || (tep != elp)) {
1544 (void) (STRLOG(TL_ID, tep->te_minor, 1,
1545 SL_TRACE|SL_ERROR,
1546 "tl_close:inconsistency in AI hash"));
1547 }
1548
1549 /*
1550 * Wait till close is safe, then mark endpoint as closing.
1551 */
1552 mutex_enter(&tep->te_closelock);
1553 while (tep->te_closewait)
1554 cv_wait(&tep->te_closecv, &tep->te_closelock);
1555 tep->te_closing = B_TRUE;
1556 /*
1557 * Will wait for the serializer part of the close to finish, so set
1558 * te_closewait now.
1559 */
1560 tep->te_closewait = 1;
1561 tep->te_nowsrv = B_FALSE;
1562 mutex_exit(&tep->te_closelock);
1563
1564 /*
1565 * tl_close_ser doesn't drop reference, so no need to tl_refhold.
1566 * It is safe because close will wait for tl_close_ser to finish.
1567 */
1568 tl_serializer_enter(tep, tl_close_ser, &tep->te_closemp);
1569
1570 /*
1571 * Wait for the first phase of close to complete before qprocsoff().
1572 */
1573 mutex_enter(&tep->te_closelock);
1574 while (tep->te_closewait)
1575 cv_wait(&tep->te_closecv, &tep->te_closelock);
1576 mutex_exit(&tep->te_closelock);
1577
1578 qprocsoff(rq);
1579
1580 if (tep->te_bufcid) {
1581 qunbufcall(rq, tep->te_bufcid);
1582 tep->te_bufcid = 0;
1583 }
1584 if (tep->te_timoutid) {
1585 (void) quntimeout(rq, tep->te_timoutid);
1586 tep->te_timoutid = 0;
1587 }
1588
1589 /*
1590 * Finish close behind serializer.
1591 *
1592 * For a CLTS endpoint increase a refcount and continue close processing
1593 * with serializer protection. This processing may happen asynchronously
1594 * with the completion of tl_close().
1595 *
1596 * Fot a COTS endpoint wait before destroying tep since the serializer
1597 * may go away together with tep and we need to destroy serializer
1598 * outside of serializer context.
1599 */
1600 ASSERT(tep->te_closewait == 0);
1601 if (IS_COTS(tep))
1602 tep->te_closewait = 1;
1603 else
1604 tl_refhold(tep);
1605
1606 tl_serializer_enter(tep, tl_close_finish_ser, &tep->te_closemp);
1607
1608 /*
1609 * For connection-oriented transports wait for all serializer activity
1610 * to settle down.
1611 */
1612 if (IS_COTS(tep)) {
1613 mutex_enter(&tep->te_closelock);
1614 while (tep->te_closewait)
1615 cv_wait(&tep->te_closecv, &tep->te_closelock);
1616 mutex_exit(&tep->te_closelock);
1617 }
1618
1619 crfree(tep->te_credp);
1620 tep->te_credp = NULL;
1621 tep->te_wq = NULL;
1622 tl_refrele(tep);
1623 /*
1624 * tep is likely to be destroyed now, so can't reference it any more.
1625 */
1626
1627 rq->q_ptr = wq->q_ptr = NULL;
1628 return (0);
1629 }
1630
1631 /*
1632 * First phase of close processing done behind the serializer.
1633 *
1634 * Do not drop the reference in the end - tl_close() wants this reference to
1635 * stay.
1636 */
1637 /* ARGSUSED0 */
1638 static void
1639 tl_close_ser(mblk_t *mp, tl_endpt_t *tep)
1640 {
1641 ASSERT(tep->te_closing);
1642 ASSERT(tep->te_closewait == 1);
1643 ASSERT(!(tep->te_flag & TL_CLOSE_SER));
1644
1645 tep->te_flag |= TL_CLOSE_SER;
1646
1647 /*
1648 * Drain out all messages on queue except for TL_TICOTS where the
1649 * abortive release semantics permit discarding of data on close
1650 */
1651 if (tep->te_wq->q_first && (IS_CLTS(tep) || IS_COTSORD(tep))) {
1652 tl_wsrv_ser(NULL, tep);
1653 }
1654
1655 /* Remove address from hash table. */
1656 tl_addr_unbind(tep);
1657 /*
1658 * qprocsoff() gets confused when q->q_next is not NULL on the write
1659 * queue of the driver, so clear these before qprocsoff() is called.
1660 * Also clear q_next for the peer since this queue is going away.
1661 */
1662 if (IS_COTS(tep) && !IS_SOCKET(tep)) {
1663 tl_endpt_t *peer_tep = tep->te_conp;
1664
1665 tep->te_wq->q_next = NULL;
1666 if ((peer_tep != NULL) && !peer_tep->te_closing)
1667 peer_tep->te_wq->q_next = NULL;
1668 }
1669
1670 tep->te_rq = NULL;
1671
1672 /* wake up tl_close() */
1673 tl_closeok(tep);
1674 tl_serializer_exit(tep);
1675 }
1676
1677 /*
1678 * Second phase of tl_close(). Should wakeup tl_close() for COTS mode and drop
1679 * the reference for CLTS.
1680 *
1681 * Called from serializer. Should drop reference count for CLTS only.
1682 */
1683 /* ARGSUSED0 */
1684 static void
1685 tl_close_finish_ser(mblk_t *mp, tl_endpt_t *tep)
1686 {
1687 ASSERT(tep->te_closing);
1688 IMPLY(IS_CLTS(tep), tep->te_closewait == 0);
1689 IMPLY(IS_COTS(tep), tep->te_closewait == 1);
1690
1691 tep->te_state = -1; /* Uninitialized */
1692 if (IS_COTS(tep)) {
1693 tl_co_unconnect(tep);
1694 } else {
1695 /* Connectionless specific cleanup */
1696 TL_REMOVE_PEER(tep->te_lastep);
1697 /*
1698 * Backenable anybody that is flow controlled waiting for
1699 * this endpoint.
1700 */
1701 tl_cl_backenable(tep);
1702 if (tep->te_flowq != NULL) {
1703 list_remove(&(tep->te_flowq->te_flowlist), tep);
1704 tep->te_flowq = NULL;
1705 }
1706 }
1707
1708 tl_serializer_exit(tep);
1709 if (IS_COTS(tep))
1710 tl_closeok(tep);
1711 else
1712 tl_refrele(tep);
1713 }
1714
1715 /*
1716 * STREAMS write-side put procedure.
1717 * Enter serializer for most of the processing.
1718 *
1719 * The T_CONN_REQ is processed outside of serializer.
1720 */
1721 static void
1722 tl_wput(queue_t *wq, mblk_t *mp)
1723 {
1724 tl_endpt_t *tep = (tl_endpt_t *)wq->q_ptr;
1725 ssize_t msz = MBLKL(mp);
1726 union T_primitives *prim = (union T_primitives *)mp->b_rptr;
1727 tlproc_t *tl_proc = NULL;
1728
1729 switch (DB_TYPE(mp)) {
1730 case M_DATA:
1731 /* Only valid for connection-oriented transports */
1732 if (IS_CLTS(tep)) {
1733 (void) (STRLOG(TL_ID, tep->te_minor, 1,
1734 SL_TRACE|SL_ERROR,
1735 "tl_wput:M_DATA invalid for ticlts driver"));
1736 tl_merror(wq, mp, EPROTO);
1737 return;
1738 }
1739 tl_proc = tl_wput_data_ser;
1740 break;
1741
1742 case M_IOCTL:
1743 switch (((struct iocblk *)mp->b_rptr)->ioc_cmd) {
1744 case TL_IOC_CREDOPT:
1745 /* FALLTHROUGH */
1746 case TL_IOC_UCREDOPT:
1747 /*
1748 * Serialize endpoint state change.
1749 */
1750 tl_proc = tl_do_ioctl_ser;
1751 break;
1752
1753 default:
1754 miocnak(wq, mp, 0, EINVAL);
1755 return;
1756 }
1757 break;
1758
1759 case M_FLUSH:
1760 /*
1761 * do canonical M_FLUSH processing
1762 */
1763 if (*mp->b_rptr & FLUSHW) {
1764 flushq(wq, FLUSHALL);
1765 *mp->b_rptr &= ~FLUSHW;
1766 }
1767 if (*mp->b_rptr & FLUSHR) {
1768 flushq(RD(wq), FLUSHALL);
1769 qreply(wq, mp);
1770 } else {
1771 freemsg(mp);
1772 }
1773 return;
1774
1775 case M_PROTO:
1776 if (msz < sizeof (prim->type)) {
1777 (void) (STRLOG(TL_ID, tep->te_minor, 1,
1778 SL_TRACE|SL_ERROR,
1779 "tl_wput:M_PROTO data too short"));
1780 tl_merror(wq, mp, EPROTO);
1781 return;
1782 }
1783 switch (prim->type) {
1784 case T_OPTMGMT_REQ:
1785 case T_SVR4_OPTMGMT_REQ:
1786 /*
1787 * Process TPI option management requests immediately
1788 * in put procedure regardless of in-order processing
1789 * of already queued messages.
1790 * (Note: This driver supports AF_UNIX socket
1791 * implementation. Unless we implement this processing,
1792 * setsockopt() on socket endpoint will block on flow
1793 * controlled endpoints which it should not. That is
1794 * required for successful execution of VSU socket tests
1795 * and is consistent with BSD socket behavior).
1796 */
1797 tl_optmgmt(wq, mp);
1798 return;
1799 case O_T_BIND_REQ:
1800 case T_BIND_REQ:
1801 tl_proc = tl_bind_ser;
1802 break;
1803 case T_CONN_REQ:
1804 if (IS_CLTS(tep)) {
1805 tl_merror(wq, mp, EPROTO);
1806 return;
1807 }
1808 tl_conn_req(wq, mp);
1809 return;
1810 case T_DATA_REQ:
1811 case T_OPTDATA_REQ:
1812 case T_EXDATA_REQ:
1813 case T_ORDREL_REQ:
1814 tl_proc = tl_putq_ser;
1815 break;
1816 case T_UNITDATA_REQ:
1817 if (IS_COTS(tep) ||
1818 (msz < sizeof (struct T_unitdata_req))) {
1819 tl_merror(wq, mp, EPROTO);
1820 return;
1821 }
1822 if ((tep->te_state == TS_IDLE) && !wq->q_first) {
1823 tl_proc = tl_unitdata_ser;
1824 } else {
1825 tl_proc = tl_putq_ser;
1826 }
1827 break;
1828 default:
1829 /*
1830 * process in service procedure if message already
1831 * queued (maintain in-order processing)
1832 */
1833 if (wq->q_first != NULL) {
1834 tl_proc = tl_putq_ser;
1835 } else {
1836 tl_proc = tl_wput_ser;
1837 }
1838 break;
1839 }
1840 break;
1841
1842 case M_PCPROTO:
1843 /*
1844 * Check that the message has enough data to figure out TPI
1845 * primitive.
1846 */
1847 if (msz < sizeof (prim->type)) {
1848 (void) (STRLOG(TL_ID, tep->te_minor, 1,
1849 SL_TRACE|SL_ERROR,
1850 "tl_wput:M_PCROTO data too short"));
1851 tl_merror(wq, mp, EPROTO);
1852 return;
1853 }
1854 switch (prim->type) {
1855 case T_CAPABILITY_REQ:
1856 tl_capability_req(mp, tep);
1857 return;
1858 case T_INFO_REQ:
1859 tl_proc = tl_info_req_ser;
1860 break;
1861 case T_ADDR_REQ:
1862 tl_proc = tl_addr_req_ser;
1863 break;
1864
1865 default:
1866 (void) (STRLOG(TL_ID, tep->te_minor, 1,
1867 SL_TRACE|SL_ERROR,
1868 "tl_wput:unknown TPI msg primitive"));
1869 tl_merror(wq, mp, EPROTO);
1870 return;
1871 }
1872 break;
1873 default:
1874 (void) (STRLOG(TL_ID, tep->te_minor, 1, SL_TRACE|SL_ERROR,
1875 "tl_wput:default:unexpected Streams message"));
1876 freemsg(mp);
1877 return;
1878 }
1879
1880 /*
1881 * Continue processing via serializer.
1882 */
1883 ASSERT(tl_proc != NULL);
1884 tl_refhold(tep);
1885 tl_serializer_enter(tep, tl_proc, mp);
1886 }
1887
1888 /*
1889 * Place message on the queue while preserving order.
1890 */
1891 static void
1892 tl_putq_ser(mblk_t *mp, tl_endpt_t *tep)
1893 {
1894 if (tep->te_closing) {
1895 tl_wput_ser(mp, tep);
1896 } else {
1897 TL_PUTQ(tep, mp);
1898 tl_serializer_exit(tep);
1899 tl_refrele(tep);
1900 }
1901
1902 }
1903
1904 static void
1905 tl_wput_common_ser(mblk_t *mp, tl_endpt_t *tep)
1906 {
1907 ASSERT((DB_TYPE(mp) == M_DATA) || (DB_TYPE(mp) == M_PROTO));
1908
1909 switch (DB_TYPE(mp)) {
1910 case M_DATA:
1911 tl_data(mp, tep);
1912 break;
1913 case M_PROTO:
1914 tl_do_proto(mp, tep);
1915 break;
1916 default:
1917 freemsg(mp);
1918 break;
1919 }
1920 }
1921
1922 /*
1923 * Write side put procedure called from serializer.
1924 */
1925 static void
1926 tl_wput_ser(mblk_t *mp, tl_endpt_t *tep)
1927 {
1928 tl_wput_common_ser(mp, tep);
1929 tl_serializer_exit(tep);
1930 tl_refrele(tep);
1931 }
1932
1933 /*
1934 * M_DATA processing. Called from serializer.
1935 */
1936 static void
1937 tl_wput_data_ser(mblk_t *mp, tl_endpt_t *tep)
1938 {
1939 tl_endpt_t *peer_tep = tep->te_conp;
1940 queue_t *peer_rq;
1941
1942 ASSERT(DB_TYPE(mp) == M_DATA);
1943 ASSERT(IS_COTS(tep));
1944
1945 IMPLY(peer_tep, tep->te_serializer == peer_tep->te_serializer);
1946
1947 /*
1948 * fastpath for data. Ignore flow control if tep is closing.
1949 */
1950 if ((peer_tep != NULL) &&
1951 !peer_tep->te_closing &&
1952 ((tep->te_state == TS_DATA_XFER) ||
1953 (tep->te_state == TS_WREQ_ORDREL)) &&
1954 (tep->te_wq != NULL) &&
1955 (tep->te_wq->q_first == NULL) &&
1956 ((peer_tep->te_state == TS_DATA_XFER) ||
1957 (peer_tep->te_state == TS_WREQ_ORDREL)) &&
1958 ((peer_rq = peer_tep->te_rq) != NULL) &&
1959 (canputnext(peer_rq) || tep->te_closing)) {
1960 putnext(peer_rq, mp);
1961 } else if (tep->te_closing) {
1962 /*
1963 * It is possible that by the time we got here tep started to
1964 * close. If the write queue is not empty, and the state is
1965 * TS_DATA_XFER the data should be delivered in order, so we
1966 * call putq() instead of freeing the data.
1967 */
1968 if ((tep->te_wq != NULL) &&
1969 ((tep->te_state == TS_DATA_XFER) ||
1970 (tep->te_state == TS_WREQ_ORDREL))) {
1971 TL_PUTQ(tep, mp);
1972 } else {
1973 freemsg(mp);
1974 }
1975 } else {
1976 TL_PUTQ(tep, mp);
1977 }
1978
1979 tl_serializer_exit(tep);
1980 tl_refrele(tep);
1981 }
1982
1983 /*
1984 * Write side service routine.
1985 *
1986 * All actual processing happens within serializer which is entered
1987 * synchronously. It is possible that by the time tl_wsrv() wakes up, some new
1988 * messages that need processing may have arrived, so tl_wsrv repeats until
1989 * queue is empty or te_nowsrv is set.
1990 */
1991 static void
1992 tl_wsrv(queue_t *wq)
1993 {
1994 tl_endpt_t *tep = (tl_endpt_t *)wq->q_ptr;
1995
1996 while ((wq->q_first != NULL) && !tep->te_nowsrv) {
1997 mutex_enter(&tep->te_srv_lock);
1998 ASSERT(tep->te_wsrv_active == B_FALSE);
1999 tep->te_wsrv_active = B_TRUE;
2000 mutex_exit(&tep->te_srv_lock);
2001
2002 tl_serializer_enter(tep, tl_wsrv_ser, &tep->te_wsrvmp);
2003
2004 /*
2005 * Wait for serializer job to complete.
2006 */
2007 mutex_enter(&tep->te_srv_lock);
2008 while (tep->te_wsrv_active) {
2009 cv_wait(&tep->te_srv_cv, &tep->te_srv_lock);
2010 }
2011 cv_signal(&tep->te_srv_cv);
2012 mutex_exit(&tep->te_srv_lock);
2013 }
2014 }
2015
2016 /*
2017 * Serialized write side processing of the STREAMS queue.
2018 * May be called either from tl_wsrv() or from tl_close() in which case ser_mp
2019 * is NULL.
2020 */
2021 static void
2022 tl_wsrv_ser(mblk_t *ser_mp, tl_endpt_t *tep)
2023 {
2024 mblk_t *mp;
2025 queue_t *wq = tep->te_wq;
2026
2027 ASSERT(wq != NULL);
2028 while (!tep->te_nowsrv && (mp = getq(wq)) != NULL) {
2029 tl_wput_common_ser(mp, tep);
2030 }
2031
2032 /*
2033 * Wakeup service routine unless called from close.
2034 * If ser_mp is specified, the caller is tl_wsrv().
2035 * Otherwise, the caller is tl_close_ser(). Since tl_close_ser() doesn't
2036 * call tl_serializer_enter() before calling tl_wsrv_ser(), there should
2037 * be no matching tl_serializer_exit() in this case.
2038 * Also, there is no need to wakeup anyone since tl_close_ser() is not
2039 * waiting on te_srv_cv.
2040 */
2041 if (ser_mp != NULL) {
2042 /*
2043 * We are called from tl_wsrv.
2044 */
2045 mutex_enter(&tep->te_srv_lock);
2046 ASSERT(tep->te_wsrv_active);
2047 tep->te_wsrv_active = B_FALSE;
2048 cv_signal(&tep->te_srv_cv);
2049 mutex_exit(&tep->te_srv_lock);
2050 tl_serializer_exit(tep);
2051 }
2052 }
2053
2054 /*
2055 * Called when the stream is backenabled. Enter serializer and qenable everyone
2056 * flow controlled by tep.
2057 *
2058 * NOTE: The service routine should enter serializer synchronously. Otherwise it
2059 * is possible that two instances of tl_rsrv will be running reusing the same
2060 * rsrv mblk.
2061 */
2062 static void
2063 tl_rsrv(queue_t *rq)
2064 {
2065 tl_endpt_t *tep = (tl_endpt_t *)rq->q_ptr;
2066
2067 ASSERT(rq->q_first == NULL);
2068 ASSERT(tep->te_rsrv_active == 0);
2069
2070 tep->te_rsrv_active = B_TRUE;
2071 tl_serializer_enter(tep, tl_rsrv_ser, &tep->te_rsrvmp);
2072 /*
2073 * Wait for serializer job to complete.
2074 */
2075 mutex_enter(&tep->te_srv_lock);
2076 while (tep->te_rsrv_active) {
2077 cv_wait(&tep->te_srv_cv, &tep->te_srv_lock);
2078 }
2079 cv_signal(&tep->te_srv_cv);
2080 mutex_exit(&tep->te_srv_lock);
2081 }
2082
2083 /* ARGSUSED */
2084 static void
2085 tl_rsrv_ser(mblk_t *mp, tl_endpt_t *tep)
2086 {
2087 tl_endpt_t *peer_tep;
2088
2089 if (IS_CLTS(tep) && tep->te_state == TS_IDLE) {
2090 tl_cl_backenable(tep);
2091 } else if (
2092 IS_COTS(tep) &&
2093 ((peer_tep = tep->te_conp) != NULL) &&
2094 !peer_tep->te_closing &&
2095 ((tep->te_state == TS_DATA_XFER) ||
2096 (tep->te_state == TS_WIND_ORDREL)||
2097 (tep->te_state == TS_WREQ_ORDREL))) {
2098 TL_QENABLE(peer_tep);
2099 }
2100
2101 /*
2102 * Wakeup read side service routine.
2103 */
2104 mutex_enter(&tep->te_srv_lock);
2105 ASSERT(tep->te_rsrv_active);
2106 tep->te_rsrv_active = B_FALSE;
2107 cv_signal(&tep->te_srv_cv);
2108 mutex_exit(&tep->te_srv_lock);
2109 tl_serializer_exit(tep);
2110 }
2111
2112 /*
2113 * process M_PROTO messages. Always called from serializer.
2114 */
2115 static void
2116 tl_do_proto(mblk_t *mp, tl_endpt_t *tep)
2117 {
2118 ssize_t msz = MBLKL(mp);
2119 union T_primitives *prim = (union T_primitives *)mp->b_rptr;
2120
2121 /* Message size was validated by tl_wput(). */
2122 ASSERT(msz >= sizeof (prim->type));
2123
2124 switch (prim->type) {
2125 case T_UNBIND_REQ:
2126 tl_unbind(mp, tep);
2127 break;
2128
2129 case T_ADDR_REQ:
2130 tl_addr_req(mp, tep);
2131 break;
2132
2133 case O_T_CONN_RES:
2134 case T_CONN_RES:
2135 if (IS_CLTS(tep)) {
2136 tl_merror(tep->te_wq, mp, EPROTO);
2137 break;
2138 }
2139 tl_conn_res(mp, tep);
2140 break;
2141
2142 case T_DISCON_REQ:
2143 if (IS_CLTS(tep)) {
2144 tl_merror(tep->te_wq, mp, EPROTO);
2145 break;
2146 }
2147 tl_discon_req(mp, tep);
2148 break;
2149
2150 case T_DATA_REQ:
2151 if (IS_CLTS(tep)) {
2152 tl_merror(tep->te_wq, mp, EPROTO);
2153 break;
2154 }
2155 tl_data(mp, tep);
2156 break;
2157
2158 case T_OPTDATA_REQ:
2159 if (IS_CLTS(tep)) {
2160 tl_merror(tep->te_wq, mp, EPROTO);
2161 break;
2162 }
2163 tl_data(mp, tep);
2164 break;
2165
2166 case T_EXDATA_REQ:
2167 if (IS_CLTS(tep)) {
2168 tl_merror(tep->te_wq, mp, EPROTO);
2169 break;
2170 }
2171 tl_exdata(mp, tep);
2172 break;
2173
2174 case T_ORDREL_REQ:
2175 if (! IS_COTSORD(tep)) {
2176 tl_merror(tep->te_wq, mp, EPROTO);
2177 break;
2178 }
2179 tl_ordrel(mp, tep);
2180 break;
2181
2182 case T_UNITDATA_REQ:
2183 if (IS_COTS(tep)) {
2184 tl_merror(tep->te_wq, mp, EPROTO);
2185 break;
2186 }
2187 tl_unitdata(mp, tep);
2188 break;
2189
2190 default:
2191 tl_merror(tep->te_wq, mp, EPROTO);
2192 break;
2193 }
2194 }
2195
2196 /*
2197 * Process ioctl from serializer.
2198 * This is a wrapper around tl_do_ioctl().
2199 */
2200 static void
2201 tl_do_ioctl_ser(mblk_t *mp, tl_endpt_t *tep)
2202 {
2203 if (! tep->te_closing)
2204 tl_do_ioctl(mp, tep);
2205 else
2206 freemsg(mp);
2207
2208 tl_serializer_exit(tep);
2209 tl_refrele(tep);
2210 }
2211
2212 static void
2213 tl_do_ioctl(mblk_t *mp, tl_endpt_t *tep)
2214 {
2215 struct iocblk *iocbp = (struct iocblk *)mp->b_rptr;
2216 int cmd = iocbp->ioc_cmd;
2217 queue_t *wq = tep->te_wq;
2218 int error;
2219 int thisopt, otheropt;
2220
2221 ASSERT((cmd == TL_IOC_CREDOPT) || (cmd == TL_IOC_UCREDOPT));
2222
2223 switch (cmd) {
2224 case TL_IOC_CREDOPT:
2225 if (cmd == TL_IOC_CREDOPT) {
2226 thisopt = TL_SETCRED;
2227 otheropt = TL_SETUCRED;
2228 } else {
2229 /* FALLTHROUGH */
2230 case TL_IOC_UCREDOPT:
2231 thisopt = TL_SETUCRED;
2232 otheropt = TL_SETCRED;
2233 }
2234 /*
2235 * The credentials passing does not apply to sockets.
2236 * Only one of the cred options can be set at a given time.
2237 */
2238 if (IS_SOCKET(tep) || (tep->te_flag & otheropt)) {
2239 miocnak(wq, mp, 0, EINVAL);
2240 return;
2241 }
2242
2243 /*
2244 * Turn on generation of credential options for
2245 * T_conn_req, T_conn_con, T_unidata_ind.
2246 */
2247 error = miocpullup(mp, sizeof (uint32_t));
2248 if (error != 0) {
2249 miocnak(wq, mp, 0, error);
2250 return;
2251 }
2252 if (!IS_P2ALIGNED(mp->b_cont->b_rptr, sizeof (uint32_t))) {
2253 miocnak(wq, mp, 0, EINVAL);
2254 return;
2255 }
2256
2257 if (*(uint32_t *)mp->b_cont->b_rptr)
2258 tep->te_flag |= thisopt;
2259 else
2260 tep->te_flag &= ~thisopt;
2261
2262 miocack(wq, mp, 0, 0);
2263 break;
2264
2265 default:
2266 /* Should not be here */
2267 miocnak(wq, mp, 0, EINVAL);
2268 break;
2269 }
2270 }
2271
2272
2273 /*
2274 * send T_ERROR_ACK
2275 * Note: assumes enough memory or caller passed big enough mp
2276 * - no recovery from allocb failures
2277 */
2278
2279 static void
2280 tl_error_ack(queue_t *wq, mblk_t *mp, t_scalar_t tli_err,
2281 t_scalar_t unix_err, t_scalar_t type)
2282 {
2283 struct T_error_ack *err_ack;
2284 mblk_t *ackmp = tpi_ack_alloc(mp, sizeof (struct T_error_ack),
2285 M_PCPROTO, T_ERROR_ACK);
2286
2287 if (ackmp == NULL) {
2288 (void) (STRLOG(TL_ID, 0, 1, SL_TRACE|SL_ERROR,
2289 "tl_error_ack:out of mblk memory"));
2290 tl_merror(wq, NULL, ENOSR);
2291 return;
2292 }
2293 err_ack = (struct T_error_ack *)ackmp->b_rptr;
2294 err_ack->ERROR_prim = type;
2295 err_ack->TLI_error = tli_err;
2296 err_ack->UNIX_error = unix_err;
2297
2298 /*
2299 * send error ack message
2300 */
2301 qreply(wq, ackmp);
2302 }
2303
2304
2305
2306 /*
2307 * send T_OK_ACK
2308 * Note: assumes enough memory or caller passed big enough mp
2309 * - no recovery from allocb failures
2310 */
2311 static void
2312 tl_ok_ack(queue_t *wq, mblk_t *mp, t_scalar_t type)
2313 {
2314 struct T_ok_ack *ok_ack;
2315 mblk_t *ackmp = tpi_ack_alloc(mp, sizeof (struct T_ok_ack),
2316 M_PCPROTO, T_OK_ACK);
2317
2318 if (ackmp == NULL) {
2319 tl_merror(wq, NULL, ENOMEM);
2320 return;
2321 }
2322
2323 ok_ack = (struct T_ok_ack *)ackmp->b_rptr;
2324 ok_ack->CORRECT_prim = type;
2325
2326 (void) qreply(wq, ackmp);
2327 }
2328
2329 /*
2330 * Process T_BIND_REQ and O_T_BIND_REQ from serializer.
2331 * This is a wrapper around tl_bind().
2332 */
2333 static void
2334 tl_bind_ser(mblk_t *mp, tl_endpt_t *tep)
2335 {
2336 if (! tep->te_closing)
2337 tl_bind(mp, tep);
2338 else
2339 freemsg(mp);
2340
2341 tl_serializer_exit(tep);
2342 tl_refrele(tep);
2343 }
2344
2345 /*
2346 * Process T_BIND_REQ and O_T_BIND_REQ TPI requests.
2347 * Assumes that the endpoint is in the unbound.
2348 */
2349 static void
2350 tl_bind(mblk_t *mp, tl_endpt_t *tep)
2351 {
2352 queue_t *wq = tep->te_wq;
2353 struct T_bind_ack *b_ack;
2354 struct T_bind_req *bind = (struct T_bind_req *)mp->b_rptr;
2355 mblk_t *ackmp, *bamp;
2356 soux_addr_t ux_addr;
2357 t_uscalar_t qlen = 0;
2358 t_scalar_t alen, aoff;
2359 tl_addr_t addr_req;
2360 void *addr_startp;
2361 ssize_t msz = MBLKL(mp), basize;
2362 t_scalar_t tli_err = 0, unix_err = 0;
2363 t_scalar_t save_prim_type = bind->PRIM_type;
2364 t_scalar_t save_state = tep->te_state;
2365
2366 if (tep->te_state != TS_UNBND) {
2367 (void) (STRLOG(TL_ID, tep->te_minor, 1,
2368 SL_TRACE|SL_ERROR,
2369 "tl_wput:bind_request:out of state, state=%d",
2370 tep->te_state));
2371 tli_err = TOUTSTATE;
2372 goto error;
2373 }
2374
2375 if (msz < sizeof (struct T_bind_req)) {
2376 tli_err = TSYSERR; unix_err = EINVAL;
2377 goto error;
2378 }
2379
2380 tep->te_state = NEXTSTATE(TE_BIND_REQ, tep->te_state);
2381
2382 ASSERT((bind->PRIM_type == O_T_BIND_REQ) ||
2383 (bind->PRIM_type == T_BIND_REQ));
2384
2385 alen = bind->ADDR_length;
2386 aoff = bind->ADDR_offset;
2387
2388 /* negotiate max conn req pending */
2389 if (IS_COTS(tep)) {
2390 qlen = bind->CONIND_number;
2391 if (qlen > tl_maxqlen)
2392 qlen = tl_maxqlen;
2393 }
2394
2395 /*
2396 * Reserve hash handle. It can only be NULL if the endpoint is unbound
2397 * and bound again.
2398 */
2399 if ((tep->te_hash_hndl == NULL) &&
2400 ((tep->te_flag & TL_ADDRHASHED) == 0) &&
2401 mod_hash_reserve_nosleep(tep->te_addrhash,
2402 &tep->te_hash_hndl) != 0) {
2403 tli_err = TSYSERR; unix_err = ENOSR;
2404 goto error;
2405 }
2406
2407 /*
2408 * Verify address correctness.
2409 */
2410 if (IS_SOCKET(tep)) {
2411 ASSERT(bind->PRIM_type == O_T_BIND_REQ);
2412
2413 if ((alen != TL_SOUX_ADDRLEN) ||
2414 (aoff < 0) ||
2415 (aoff + alen > msz)) {
2416 (void) (STRLOG(TL_ID, tep->te_minor,
2417 1, SL_TRACE|SL_ERROR,
2418 "tl_bind: invalid socket addr"));
2419 tep->te_state = NEXTSTATE(TE_ERROR_ACK, tep->te_state);
2420 tli_err = TSYSERR; unix_err = EINVAL;
2421 goto error;
2422 }
2423 /* Copy address from message to local buffer. */
2424 bcopy(mp->b_rptr + aoff, &ux_addr, sizeof (ux_addr));
2425 /*
2426 * Check that we got correct address from sockets
2427 */
2428 if ((ux_addr.soua_magic != SOU_MAGIC_EXPLICIT) &&
2429 (ux_addr.soua_magic != SOU_MAGIC_IMPLICIT)) {
2430 (void) (STRLOG(TL_ID, tep->te_minor,
2431 1, SL_TRACE|SL_ERROR,
2432 "tl_bind: invalid socket magic"));
2433 tep->te_state = NEXTSTATE(TE_ERROR_ACK, tep->te_state);
2434 tli_err = TSYSERR; unix_err = EINVAL;
2435 goto error;
2436 }
2437 if ((ux_addr.soua_magic == SOU_MAGIC_IMPLICIT) &&
2438 (ux_addr.soua_vp != NULL)) {
2439 (void) (STRLOG(TL_ID, tep->te_minor,
2440 1, SL_TRACE|SL_ERROR,
2441 "tl_bind: implicit addr non-empty"));
2442 tep->te_state = NEXTSTATE(TE_ERROR_ACK, tep->te_state);
2443 tli_err = TSYSERR; unix_err = EINVAL;
2444 goto error;
2445 }
2446 if ((ux_addr.soua_magic == SOU_MAGIC_EXPLICIT) &&
2447 (ux_addr.soua_vp == NULL)) {
2448 (void) (STRLOG(TL_ID, tep->te_minor,
2449 1, SL_TRACE|SL_ERROR,
2450 "tl_bind: explicit addr empty"));
2451 tep->te_state = NEXTSTATE(TE_ERROR_ACK, tep->te_state);
2452 tli_err = TSYSERR; unix_err = EINVAL;
2453 goto error;
2454 }
2455 } else {
2456 if ((alen > 0) && ((aoff < 0) ||
2457 ((ssize_t)(aoff + alen) > msz) ||
2458 ((aoff + alen) < 0))) {
2459 (void) (STRLOG(TL_ID, tep->te_minor,
2460 1, SL_TRACE|SL_ERROR,
2461 "tl_bind: invalid message"));
2462 tep->te_state = NEXTSTATE(TE_ERROR_ACK, tep->te_state);
2463 tli_err = TSYSERR; unix_err = EINVAL;
2464 goto error;
2465 }
2466 if ((alen < 0) || (alen > (msz - sizeof (struct T_bind_req)))) {
2467 (void) (STRLOG(TL_ID, tep->te_minor,
2468 1, SL_TRACE|SL_ERROR,
2469 "tl_bind: bad addr in message"));
2470 tep->te_state = NEXTSTATE(TE_ERROR_ACK, tep->te_state);
2471 tli_err = TBADADDR;
2472 goto error;
2473 }
2474 #ifdef DEBUG
2475 /*
2476 * Mild form of ASSERT()ion to detect broken TPI apps.
2477 * if (! assertion)
2478 * log warning;
2479 */
2480 if (! ((alen == 0 && aoff == 0) ||
2481 (aoff >= (t_scalar_t)(sizeof (struct T_bind_req))))) {
2482 (void) (STRLOG(TL_ID, tep->te_minor,
2483 3, SL_TRACE|SL_ERROR,
2484 "tl_bind: addr overlaps TPI message"));
2485 }
2486 #endif
2487 }
2488
2489 /*
2490 * Bind the address provided or allocate one if requested.
2491 * Allow rebinds with a new qlen value.
2492 */
2493 if (IS_SOCKET(tep)) {
2494 /*
2495 * For anonymous requests the te_ap is already set up properly
2496 * so use minor number as an address.
2497 * For explicit requests need to check whether the address is
2498 * already in use.
2499 */
2500 if (ux_addr.soua_magic == SOU_MAGIC_EXPLICIT) {
2501 int rc;
2502
2503 if (tep->te_flag & TL_ADDRHASHED) {
2504 ASSERT(IS_COTS(tep) && tep->te_qlen == 0);
2505 if (tep->te_vp == ux_addr.soua_vp)
2506 goto skip_addr_bind;
2507 else /* Rebind to a new address. */
2508 tl_addr_unbind(tep);
2509 }
2510 /*
2511 * Insert address in the hash if it is not already
2512 * there. Since we use preallocated handle, the insert
2513 * can fail only if the key is already present.
2514 */
2515 rc = mod_hash_insert_reserve(tep->te_addrhash,
2516 (mod_hash_key_t)ux_addr.soua_vp,
2517 (mod_hash_val_t)tep, tep->te_hash_hndl);
2518
2519 if (rc != 0) {
2520 ASSERT(rc == MH_ERR_DUPLICATE);
2521 /*
2522 * Violate O_T_BIND_REQ semantics and fail with
2523 * TADDRBUSY - sockets will not use any address
2524 * other than supplied one for explicit binds.
2525 */
2526 (void) (STRLOG(TL_ID, tep->te_minor, 1,
2527 SL_TRACE|SL_ERROR,
2528 "tl_bind:requested addr %p is busy",
2529 ux_addr.soua_vp));
2530 tli_err = TADDRBUSY; unix_err = 0;
2531 goto error;
2532 }
2533 tep->te_uxaddr = ux_addr;
2534 tep->te_flag |= TL_ADDRHASHED;
2535 tep->te_hash_hndl = NULL;
2536 }
2537 } else if (alen == 0) {
2538 /*
2539 * assign any free address
2540 */
2541 if (! tl_get_any_addr(tep, NULL)) {
2542 (void) (STRLOG(TL_ID, tep->te_minor,
2543 1, SL_TRACE|SL_ERROR,
2544 "tl_bind:failed to get buffer for any "
2545 "address"));
2546 tli_err = TSYSERR; unix_err = ENOSR;
2547 goto error;
2548 }
2549 } else {
2550 addr_req.ta_alen = alen;
2551 addr_req.ta_abuf = (mp->b_rptr + aoff);
2552 addr_req.ta_zoneid = tep->te_zoneid;
2553
2554 tep->te_abuf = kmem_zalloc((size_t)alen, KM_NOSLEEP);
2555 if (tep->te_abuf == NULL) {
2556 tli_err = TSYSERR; unix_err = ENOSR;
2557 goto error;
2558 }
2559 bcopy(addr_req.ta_abuf, tep->te_abuf, addr_req.ta_alen);
2560 tep->te_alen = alen;
2561
2562 if (mod_hash_insert_reserve(tep->te_addrhash,
2563 (mod_hash_key_t)&tep->te_ap, (mod_hash_val_t)tep,
2564 tep->te_hash_hndl) != 0) {
2565 if (save_prim_type == T_BIND_REQ) {
2566 /*
2567 * The bind semantics for this primitive
2568 * require a failure if the exact address
2569 * requested is busy
2570 */
2571 (void) (STRLOG(TL_ID, tep->te_minor, 1,
2572 SL_TRACE|SL_ERROR,
2573 "tl_bind:requested addr is busy"));
2574 tli_err = TADDRBUSY; unix_err = 0;
2575 goto error;
2576 }
2577
2578 /*
2579 * O_T_BIND_REQ semantics say if address if requested
2580 * address is busy, bind to any available free address
2581 */
2582 if (! tl_get_any_addr(tep, &addr_req)) {
2583 (void) (STRLOG(TL_ID, tep->te_minor, 1,
2584 SL_TRACE|SL_ERROR,
2585 "tl_bind:unable to get any addr buf"));
2586 tli_err = TSYSERR; unix_err = ENOMEM;
2587 goto error;
2588 }
2589 } else {
2590 tep->te_flag |= TL_ADDRHASHED;
2591 tep->te_hash_hndl = NULL;
2592 }
2593 }
2594
2595 ASSERT(tep->te_alen >= 0);
2596
2597 skip_addr_bind:
2598 /*
2599 * prepare T_BIND_ACK TPI message
2600 */
2601 basize = sizeof (struct T_bind_ack) + tep->te_alen;
2602 bamp = reallocb(mp, basize, 0);
2603 if (bamp == NULL) {
2604 (void) (STRLOG(TL_ID, tep->te_minor, 1, SL_TRACE|SL_ERROR,
2605 "tl_wput:tl_bind: allocb failed"));
2606 /*
2607 * roll back state changes
2608 */
2609 tl_addr_unbind(tep);
2610 tep->te_state = TS_UNBND;
2611 tl_memrecover(wq, mp, basize);
2612 return;
2613 }
2614
2615 DB_TYPE(bamp) = M_PCPROTO;
2616 bamp->b_wptr = bamp->b_rptr + basize;
2617 b_ack = (struct T_bind_ack *)bamp->b_rptr;
2618 b_ack->PRIM_type = T_BIND_ACK;
2619 b_ack->CONIND_number = qlen;
2620 b_ack->ADDR_length = tep->te_alen;
2621 b_ack->ADDR_offset = (t_scalar_t)sizeof (struct T_bind_ack);
2622 addr_startp = bamp->b_rptr + b_ack->ADDR_offset;
2623 bcopy(tep->te_abuf, addr_startp, tep->te_alen);
2624
2625 if (IS_COTS(tep)) {
2626 tep->te_qlen = qlen;
2627 if (qlen > 0)
2628 tep->te_flag |= TL_LISTENER;
2629 }
2630
2631 tep->te_state = NEXTSTATE(TE_BIND_ACK, tep->te_state);
2632 /*
2633 * send T_BIND_ACK message
2634 */
2635 (void) qreply(wq, bamp);
2636 return;
2637
2638 error:
2639 ackmp = reallocb(mp, sizeof (struct T_error_ack), 0);
2640 if (ackmp == NULL) {
2641 /*
2642 * roll back state changes
2643 */
2644 tep->te_state = save_state;
2645 tl_memrecover(wq, mp, sizeof (struct T_error_ack));
2646 return;
2647 }
2648 tep->te_state = NEXTSTATE(TE_ERROR_ACK, tep->te_state);
2649 tl_error_ack(wq, ackmp, tli_err, unix_err, save_prim_type);
2650 }
2651
2652 /*
2653 * Process T_UNBIND_REQ.
2654 * Called from serializer.
2655 */
2656 static void
2657 tl_unbind(mblk_t *mp, tl_endpt_t *tep)
2658 {
2659 queue_t *wq;
2660 mblk_t *ackmp;
2661
2662 if (tep->te_closing) {
2663 freemsg(mp);
2664 return;
2665 }
2666
2667 wq = tep->te_wq;
2668
2669 /*
2670 * preallocate memory for max of T_OK_ACK and T_ERROR_ACK
2671 * ==> allocate for T_ERROR_ACK (known max)
2672 */
2673 if ((ackmp = reallocb(mp, sizeof (struct T_error_ack), 0)) == NULL) {
2674 tl_memrecover(wq, mp, sizeof (struct T_error_ack));
2675 return;
2676 }
2677 /*
2678 * memory resources committed
2679 * Note: no message validation. T_UNBIND_REQ message is
2680 * same size as PRIM_type field so already verified earlier.
2681 */
2682
2683 /*
2684 * validate state
2685 */
2686 if (tep->te_state != TS_IDLE) {
2687 (void) (STRLOG(TL_ID, tep->te_minor, 1,
2688 SL_TRACE|SL_ERROR,
2689 "tl_wput:T_UNBIND_REQ:out of state, state=%d",
2690 tep->te_state));
2691 tl_error_ack(wq, ackmp, TOUTSTATE, 0, T_UNBIND_REQ);
2692 return;
2693 }
2694 tep->te_state = NEXTSTATE(TE_UNBIND_REQ, tep->te_state);
2695
2696 /*
2697 * TPI says on T_UNBIND_REQ:
2698 * send up a M_FLUSH to flush both
2699 * read and write queues
2700 */
2701 (void) putnextctl1(RD(wq), M_FLUSH, FLUSHRW);
2702
2703 if (! IS_SOCKET(tep) || !IS_CLTS(tep) || tep->te_qlen != 0 ||
2704 tep->te_magic != SOU_MAGIC_EXPLICIT) {
2705
2706 /*
2707 * Sockets use bind with qlen==0 followed by bind() to
2708 * the same address with qlen > 0 for listeners.
2709 * We allow rebind with a new qlen value.
2710 */
2711 tl_addr_unbind(tep);
2712 }
2713
2714 tep->te_state = NEXTSTATE(TE_OK_ACK1, tep->te_state);
2715 /*
2716 * send T_OK_ACK
2717 */
2718 tl_ok_ack(wq, ackmp, T_UNBIND_REQ);
2719 }
2720
2721
2722 /*
2723 * Option management code from drv/ip is used here
2724 * Note: TL_PROT_LEVEL/TL_IOC_CREDOPT option is not part of tl_opt_arr
2725 * database of options. So optcom_req() will fail T_SVR4_OPTMGMT_REQ.
2726 * However, that is what we want as that option is 'unorthodox'
2727 * and only valid in T_CONN_IND, T_CONN_CON and T_UNITDATA_IND
2728 * and not in T_SVR4_OPTMGMT_REQ/ACK
2729 * Note2: use of optcom_req means this routine is an exception to
2730 * recovery from allocb() failures.
2731 */
2732
2733 static void
2734 tl_optmgmt(queue_t *wq, mblk_t *mp)
2735 {
2736 tl_endpt_t *tep;
2737 mblk_t *ackmp;
2738 union T_primitives *prim;
2739 cred_t *cr;
2740
2741 tep = (tl_endpt_t *)wq->q_ptr;
2742 prim = (union T_primitives *)mp->b_rptr;
2743
2744 /*
2745 * All Solaris components should pass a db_credp
2746 * for this TPI message, hence we ASSERT.
2747 * But in case there is some other M_PROTO that looks
2748 * like a TPI message sent by some other kernel
2749 * component, we check and return an error.
2750 */
2751 cr = msg_getcred(mp, NULL);
2752 ASSERT(cr != NULL);
2753 if (cr == NULL) {
2754 tl_error_ack(wq, mp, TSYSERR, EINVAL, prim->type);
2755 return;
2756 }
2757
2758 /* all states OK for AF_UNIX options ? */
2759 if (!IS_SOCKET(tep) && tep->te_state != TS_IDLE &&
2760 prim->type == T_SVR4_OPTMGMT_REQ) {
2761 /*
2762 * Broken TLI semantics that options can only be managed
2763 * in TS_IDLE state. Needed for Sparc ABI test suite that
2764 * tests this TLI (mis)feature using this device driver.
2765 */
2766 (void) (STRLOG(TL_ID, tep->te_minor, 1,
2767 SL_TRACE|SL_ERROR,
2768 "tl_wput:T_SVR4_OPTMGMT_REQ:out of state, state=%d",
2769 tep->te_state));
2770 /*
2771 * preallocate memory for T_ERROR_ACK
2772 */
2773 ackmp = allocb(sizeof (struct T_error_ack), BPRI_MED);
2774 if (! ackmp) {
2775 tl_memrecover(wq, mp, sizeof (struct T_error_ack));
2776 return;
2777 }
2778
2779 tl_error_ack(wq, ackmp, TOUTSTATE, 0, T_SVR4_OPTMGMT_REQ);
2780 freemsg(mp);
2781 return;
2782 }
2783
2784 /*
2785 * call common option management routine from drv/ip
2786 */
2787 if (prim->type == T_SVR4_OPTMGMT_REQ) {
2788 svr4_optcom_req(wq, mp, cr, &tl_opt_obj);
2789 } else {
2790 ASSERT(prim->type == T_OPTMGMT_REQ);
2791 tpi_optcom_req(wq, mp, cr, &tl_opt_obj);
2792 }
2793 }
2794
2795 /*
2796 * Handle T_conn_req - the driver part of accept().
2797 * If TL_SET[U]CRED generate the credentials options.
2798 * If this is a socket pass through options unmodified.
2799 * For sockets generate the T_CONN_CON here instead of
2800 * waiting for the T_CONN_RES.
2801 */
2802 static void
2803 tl_conn_req(queue_t *wq, mblk_t *mp)
2804 {
2805 tl_endpt_t *tep = (tl_endpt_t *)wq->q_ptr;
2806 struct T_conn_req *creq = (struct T_conn_req *)mp->b_rptr;
2807 ssize_t msz = MBLKL(mp);
2808 t_scalar_t alen, aoff, olen, ooff, err = 0;
2809 tl_endpt_t *peer_tep = NULL;
2810 mblk_t *ackmp;
2811 mblk_t *dimp;
2812 struct T_discon_ind *di;
2813 soux_addr_t ux_addr;
2814 tl_addr_t dst;
2815
2816 ASSERT(IS_COTS(tep));
2817
2818 if (tep->te_closing) {
2819 freemsg(mp);
2820 return;
2821 }
2822
2823 /*
2824 * preallocate memory for:
2825 * 1. max of T_ERROR_ACK and T_OK_ACK
2826 * ==> known max T_ERROR_ACK
2827 * 2. max of T_DISCON_IND and T_CONN_IND
2828 */
2829 ackmp = allocb(sizeof (struct T_error_ack), BPRI_MED);
2830 if (! ackmp) {
2831 tl_memrecover(wq, mp, sizeof (struct T_error_ack));
2832 return;
2833 }
2834 /*
2835 * memory committed for T_OK_ACK/T_ERROR_ACK now
2836 * will be committed for T_DISCON_IND/T_CONN_IND later
2837 */
2838
2839 if (tep->te_state != TS_IDLE) {
2840 (void) (STRLOG(TL_ID, tep->te_minor, 1,
2841 SL_TRACE|SL_ERROR,
2842 "tl_wput:T_CONN_REQ:out of state, state=%d",
2843 tep->te_state));
2844 tl_error_ack(wq, ackmp, TOUTSTATE, 0, T_CONN_REQ);
2845 freemsg(mp);
2846 return;
2847 }
2848
2849 /*
2850 * validate the message
2851 * Note: dereference fields in struct inside message only
2852 * after validating the message length.
2853 */
2854 if (msz < sizeof (struct T_conn_req)) {
2855 (void) (STRLOG(TL_ID, tep->te_minor, 1, SL_TRACE|SL_ERROR,
2856 "tl_conn_req:invalid message length"));
2857 tl_error_ack(wq, ackmp, TSYSERR, EINVAL, T_CONN_REQ);
2858 freemsg(mp);
2859 return;
2860 }
2861 alen = creq->DEST_length;
2862 aoff = creq->DEST_offset;
2863 olen = creq->OPT_length;
2864 ooff = creq->OPT_offset;
2865 if (olen == 0)
2866 ooff = 0;
2867
2868 if (IS_SOCKET(tep)) {
2869 if ((alen != TL_SOUX_ADDRLEN) ||
2870 (aoff < 0) ||
2871 (aoff + alen > msz) ||
2872 (alen > msz - sizeof (struct T_conn_req))) {
2873 (void) (STRLOG(TL_ID, tep->te_minor,
2874 1, SL_TRACE|SL_ERROR,
2875 "tl_conn_req: invalid socket addr"));
2876 tl_error_ack(wq, ackmp, TSYSERR, EINVAL, T_CONN_REQ);
2877 freemsg(mp);
2878 return;
2879 }
2880 bcopy(mp->b_rptr + aoff, &ux_addr, TL_SOUX_ADDRLEN);
2881 if ((ux_addr.soua_magic != SOU_MAGIC_IMPLICIT) &&
2882 (ux_addr.soua_magic != SOU_MAGIC_EXPLICIT)) {
2883 (void) (STRLOG(TL_ID, tep->te_minor,
2884 1, SL_TRACE|SL_ERROR,
2885 "tl_conn_req: invalid socket magic"));
2886 tl_error_ack(wq, ackmp, TSYSERR, EINVAL, T_CONN_REQ);
2887 freemsg(mp);
2888 return;
2889 }
2890 } else {
2891 if ((alen > 0 && ((aoff + alen) > msz || aoff + alen < 0)) ||
2892 (olen > 0 && ((ssize_t)(ooff + olen) > msz ||
2893 ooff + olen < 0)) ||
2894 olen < 0 || ooff < 0) {
2895 (void) (STRLOG(TL_ID, tep->te_minor, 1,
2896 SL_TRACE|SL_ERROR,
2897 "tl_conn_req:invalid message"));
2898 tl_error_ack(wq, ackmp, TSYSERR, EINVAL, T_CONN_REQ);
2899 freemsg(mp);
2900 return;
2901 }
2902
2903 if (alen <= 0 || aoff < 0 ||
2904 (ssize_t)alen > msz - sizeof (struct T_conn_req)) {
2905 (void) (STRLOG(TL_ID, tep->te_minor, 1,
2906 SL_TRACE|SL_ERROR,
2907 "tl_conn_req:bad addr in message, "
2908 "alen=%d, msz=%ld",
2909 alen, msz));
2910 tl_error_ack(wq, ackmp, TBADADDR, 0, T_CONN_REQ);
2911 freemsg(mp);
2912 return;
2913 }
2914 #ifdef DEBUG
2915 /*
2916 * Mild form of ASSERT()ion to detect broken TPI apps.
2917 * if (! assertion)
2918 * log warning;
2919 */
2920 if (! (aoff >= (t_scalar_t)sizeof (struct T_conn_req))) {
2921 (void) (STRLOG(TL_ID, tep->te_minor, 3,
2922 SL_TRACE|SL_ERROR,
2923 "tl_conn_req: addr overlaps TPI message"));
2924 }
2925 #endif
2926 if (olen) {
2927 /*
2928 * no opts in connect req
2929 * supported in this provider except for sockets.
2930 */
2931 (void) (STRLOG(TL_ID, tep->te_minor, 1,
2932 SL_TRACE|SL_ERROR,
2933 "tl_conn_req:options not supported "
2934 "in message"));
2935 tl_error_ack(wq, ackmp, TBADOPT, 0, T_CONN_REQ);
2936 freemsg(mp);
2937 return;
2938 }
2939 }
2940
2941 /*
2942 * Prevent tep from closing on us.
2943 */
2944 if (! tl_noclose(tep)) {
2945 (void) (STRLOG(TL_ID, tep->te_minor, 1, SL_TRACE|SL_ERROR,
2946 "tl_conn_req:endpoint is closing"));
2947 tl_error_ack(wq, ackmp, TOUTSTATE, 0, T_CONN_REQ);
2948 freemsg(mp);
2949 return;
2950 }
2951
2952 tep->te_state = NEXTSTATE(TE_CONN_REQ, tep->te_state);
2953 /*
2954 * get endpoint to connect to
2955 * check that peer with DEST addr is bound to addr
2956 * and has CONIND_number > 0
2957 */
2958 dst.ta_alen = alen;
2959 dst.ta_abuf = mp->b_rptr + aoff;
2960 dst.ta_zoneid = tep->te_zoneid;
2961
2962 /*
2963 * Verify if remote addr is in use
2964 */
2965 peer_tep = (IS_SOCKET(tep) ?
2966 tl_sock_find_peer(tep, &ux_addr) :
2967 tl_find_peer(tep, &dst));
2968
2969 if (peer_tep == NULL) {
2970 (void) (STRLOG(TL_ID, tep->te_minor, 1, SL_TRACE|SL_ERROR,
2971 "tl_conn_req:no one at connect address"));
2972 err = ECONNREFUSED;
2973 } else if (peer_tep->te_nicon >= peer_tep->te_qlen) {
2974 /*
2975 * validate that number of incoming connection is
2976 * not to capacity on destination endpoint
2977 */
2978 (void) (STRLOG(TL_ID, tep->te_minor, 2, SL_TRACE,
2979 "tl_conn_req: qlen overflow connection refused"));
2980 err = ECONNREFUSED;
2981 }
2982
2983 /*
2984 * Send T_DISCON_IND in case of error
2985 */
2986 if (err != 0) {
2987 if (peer_tep != NULL)
2988 tl_refrele(peer_tep);
2989 /* We are still expected to send T_OK_ACK */
2990 tep->te_state = NEXTSTATE(TE_OK_ACK1, tep->te_state);
2991 tl_ok_ack(tep->te_wq, ackmp, T_CONN_REQ);
2992 tl_closeok(tep);
2993 dimp = tpi_ack_alloc(mp, sizeof (struct T_discon_ind),
2994 M_PROTO, T_DISCON_IND);
2995 if (dimp == NULL) {
2996 tl_merror(wq, NULL, ENOSR);
2997 return;
2998 }
2999 di = (struct T_discon_ind *)dimp->b_rptr;
3000 di->DISCON_reason = err;
3001 di->SEQ_number = BADSEQNUM;
3002
3003 tep->te_state = TS_IDLE;
3004 /*
3005 * send T_DISCON_IND message
3006 */
3007 putnext(tep->te_rq, dimp);
3008 return;
3009 }
3010
3011 ASSERT(IS_COTS(peer_tep));
3012
3013 /*
3014 * Found the listener. At this point processing will continue on
3015 * listener serializer. Close of the endpoint should be blocked while we
3016 * switch serializers.
3017 */
3018 tl_serializer_refhold(peer_tep->te_ser);
3019 tl_serializer_refrele(tep->te_ser);
3020 tep->te_ser = peer_tep->te_ser;
3021 ASSERT(tep->te_oconp == NULL);
3022 tep->te_oconp = peer_tep;
3023
3024 /*
3025 * It is safe to close now. Close may continue on listener serializer.
3026 */
3027 tl_closeok(tep);
3028
3029 /*
3030 * Pass ackmp to tl_conn_req_ser. Note that mp->b_cont may contain user
3031 * data, so we link mp to ackmp.
3032 */
3033 ackmp->b_cont = mp;
3034 mp = ackmp;
3035
3036 tl_refhold(tep);
3037 tl_serializer_enter(tep, tl_conn_req_ser, mp);
3038 }
3039
3040 /*
3041 * Finish T_CONN_REQ processing on listener serializer.
3042 */
3043 static void
3044 tl_conn_req_ser(mblk_t *mp, tl_endpt_t *tep)
3045 {
3046 queue_t *wq;
3047 tl_endpt_t *peer_tep = tep->te_oconp;
3048 mblk_t *confmp, *cimp, *indmp;
3049 void *opts = NULL;
3050 mblk_t *ackmp = mp;
3051 struct T_conn_req *creq = (struct T_conn_req *)mp->b_cont->b_rptr;
3052 struct T_conn_ind *ci;
3053 tl_icon_t *tip;
3054 void *addr_startp;
3055 t_scalar_t olen = creq->OPT_length;
3056 t_scalar_t ooff = creq->OPT_offset;
3057 size_t ci_msz;
3058 size_t size;
3059 cred_t *cr = NULL;
3060 pid_t cpid;
3061
3062 if (tep->te_closing) {
3063 TL_UNCONNECT(tep->te_oconp);
3064 tl_serializer_exit(tep);
3065 tl_refrele(tep);
3066 freemsg(mp);
3067 return;
3068 }
3069
3070 wq = tep->te_wq;
3071 tep->te_flag |= TL_EAGER;
3072
3073 /*
3074 * Extract preallocated ackmp from mp.
3075 */
3076 mp = mp->b_cont;
3077 ackmp->b_cont = NULL;
3078
3079 if (olen == 0)
3080 ooff = 0;
3081
3082 if (peer_tep->te_closing ||
3083 !((peer_tep->te_state == TS_IDLE) ||
3084 (peer_tep->te_state == TS_WRES_CIND))) {
3085 (void) (STRLOG(TL_ID, tep->te_minor, 2, SL_TRACE | SL_ERROR,
3086 "tl_conn_req:peer in bad state (%d)",
3087 peer_tep->te_state));
3088 TL_UNCONNECT(tep->te_oconp);
3089 tl_error_ack(wq, mp, TSYSERR, ECONNREFUSED, T_CONN_REQ);
3090 freemsg(ackmp);
3091 tl_serializer_exit(tep);
3092 tl_refrele(tep);
3093 return;
3094 }
3095
3096 /*
3097 * preallocate now for T_DISCON_IND or T_CONN_IND
3098 */
3099 /*
3100 * calculate length of T_CONN_IND message
3101 */
3102 if (peer_tep->te_flag & (TL_SETCRED|TL_SETUCRED)) {
3103 cr = msg_getcred(mp, &cpid);
3104 ASSERT(cr != NULL);
3105 if (peer_tep->te_flag & TL_SETCRED) {
3106 ooff = 0;
3107 olen = (t_scalar_t) sizeof (struct opthdr) +
3108 OPTLEN(sizeof (tl_credopt_t));
3109 /* 1 option only */
3110 } else {
3111 ooff = 0;
3112 olen = (t_scalar_t)sizeof (struct opthdr) +
3113 OPTLEN(ucredminsize(cr));
3114 /* 1 option only */
3115 }
3116 }
3117 ci_msz = sizeof (struct T_conn_ind) + tep->te_alen;
3118 ci_msz = T_ALIGN(ci_msz) + olen;
3119 size = max(ci_msz, sizeof (struct T_discon_ind));
3120
3121 /*
3122 * Save options from mp - we'll need them for T_CONN_IND.
3123 */
3124 if (ooff != 0) {
3125 opts = kmem_alloc(olen, KM_NOSLEEP);
3126 if (opts == NULL) {
3127 /*
3128 * roll back state changes
3129 */
3130 tep->te_state = TS_IDLE;
3131 tl_memrecover(wq, mp, size);
3132 freemsg(ackmp);
3133 TL_UNCONNECT(tep->te_oconp);
3134 tl_serializer_exit(tep);
3135 tl_refrele(tep);
3136 return;
3137 }
3138 /* Copy options to a temp buffer */
3139 bcopy(mp->b_rptr + ooff, opts, olen);
3140 }
3141
3142 if (IS_SOCKET(tep) && !tl_disable_early_connect) {
3143 /*
3144 * Generate a T_CONN_CON that has the identical address
3145 * (and options) as the T_CONN_REQ.
3146 * NOTE: assumes that the T_conn_req and T_conn_con structures
3147 * are isomorphic.
3148 */
3149 confmp = copyb(mp);
3150 if (! confmp) {
3151 /*
3152 * roll back state changes
3153 */
3154 tep->te_state = TS_IDLE;
3155 tl_memrecover(wq, mp, mp->b_wptr - mp->b_rptr);
3156 freemsg(ackmp);
3157 if (opts != NULL)
3158 kmem_free(opts, olen);
3159 TL_UNCONNECT(tep->te_oconp);
3160 tl_serializer_exit(tep);
3161 tl_refrele(tep);
3162 return;
3163 }
3164 ((struct T_conn_con *)(confmp->b_rptr))->PRIM_type =
3165 T_CONN_CON;
3166 } else {
3167 confmp = NULL;
3168 }
3169 if ((indmp = reallocb(mp, size, 0)) == NULL) {
3170 /*
3171 * roll back state changes
3172 */
3173 tep->te_state = TS_IDLE;
3174 tl_memrecover(wq, mp, size);
3175 freemsg(ackmp);
3176 if (opts != NULL)
3177 kmem_free(opts, olen);
3178 freemsg(confmp);
3179 TL_UNCONNECT(tep->te_oconp);
3180 tl_serializer_exit(tep);
3181 tl_refrele(tep);
3182 return;
3183 }
3184
3185 tip = kmem_zalloc(sizeof (*tip), KM_NOSLEEP);
3186 if (tip == NULL) {
3187 /*
3188 * roll back state changes
3189 */
3190 tep->te_state = TS_IDLE;
3191 tl_memrecover(wq, indmp, sizeof (*tip));
3192 freemsg(ackmp);
3193 if (opts != NULL)
3194 kmem_free(opts, olen);
3195 freemsg(confmp);
3196 TL_UNCONNECT(tep->te_oconp);
3197 tl_serializer_exit(tep);
3198 tl_refrele(tep);
3199 return;
3200 }
3201 tip->ti_mp = NULL;
3202
3203 /*
3204 * memory is now committed for T_DISCON_IND/T_CONN_IND/T_CONN_CON
3205 * and tl_icon_t cell.
3206 */
3207
3208 /*
3209 * ack validity of request and send the peer credential in the ACK.
3210 */
3211 tep->te_state = NEXTSTATE(TE_OK_ACK1, tep->te_state);
3212
3213 if (peer_tep != NULL && peer_tep->te_credp != NULL &&
3214 confmp != NULL) {
3215 mblk_setcred(confmp, peer_tep->te_credp, peer_tep->te_cpid);
3216 }
3217
3218 tl_ok_ack(wq, ackmp, T_CONN_REQ);
3219
3220 /*
3221 * prepare message to send T_CONN_IND
3222 */
3223 /*
3224 * allocate the message - original data blocks retained
3225 * in the returned mblk
3226 */
3227 cimp = tl_resizemp(indmp, size);
3228 if (! cimp) {
3229 (void) (STRLOG(TL_ID, tep->te_minor, 3, SL_TRACE|SL_ERROR,
3230 "tl_conn_req:con_ind:allocb failure"));
3231 tl_merror(wq, indmp, ENOMEM);
3232 TL_UNCONNECT(tep->te_oconp);
3233 tl_serializer_exit(tep);
3234 tl_refrele(tep);
3235 if (opts != NULL)
3236 kmem_free(opts, olen);
3237 freemsg(confmp);
3238 ASSERT(tip->ti_mp == NULL);
3239 kmem_free(tip, sizeof (*tip));
3240 return;
3241 }
3242
3243 DB_TYPE(cimp) = M_PROTO;
3244 ci = (struct T_conn_ind *)cimp->b_rptr;
3245 ci->PRIM_type = T_CONN_IND;
3246 ci->SRC_offset = (t_scalar_t)sizeof (struct T_conn_ind);
3247 ci->SRC_length = tep->te_alen;
3248 ci->SEQ_number = tep->te_seqno;
3249
3250 addr_startp = cimp->b_rptr + ci->SRC_offset;
3251 bcopy(tep->te_abuf, addr_startp, tep->te_alen);
3252 if (peer_tep->te_flag & (TL_SETCRED|TL_SETUCRED)) {
3253
3254 ci->OPT_offset = (t_scalar_t)T_ALIGN(ci->SRC_offset +
3255 ci->SRC_length);
3256 ci->OPT_length = olen; /* because only 1 option */
3257 tl_fill_option(cimp->b_rptr + ci->OPT_offset,
3258 cr, cpid,
3259 peer_tep->te_flag, peer_tep->te_credp);
3260 } else if (ooff != 0) {
3261 /* Copy option from T_CONN_REQ */
3262 ci->OPT_offset = (t_scalar_t)T_ALIGN(ci->SRC_offset +
3263 ci->SRC_length);
3264 ci->OPT_length = olen;
3265 ASSERT(opts != NULL);
3266 bcopy(opts, (void *)((uintptr_t)ci + ci->OPT_offset), olen);
3267 } else {
3268 ci->OPT_offset = 0;
3269 ci->OPT_length = 0;
3270 }
3271 if (opts != NULL)
3272 kmem_free(opts, olen);
3273
3274 /*
3275 * register connection request with server peer
3276 * append to list of incoming connections
3277 * increment references for both peer_tep and tep: peer_tep is placed on
3278 * te_oconp and tep is placed on listeners queue.
3279 */
3280 tip->ti_tep = tep;
3281 tip->ti_seqno = tep->te_seqno;
3282 list_insert_tail(&peer_tep->te_iconp, tip);
3283 peer_tep->te_nicon++;
3284
3285 peer_tep->te_state = NEXTSTATE(TE_CONN_IND, peer_tep->te_state);
3286 /*
3287 * send the T_CONN_IND message
3288 */
3289 putnext(peer_tep->te_rq, cimp);
3290
3291 /*
3292 * Send a T_CONN_CON message for sockets.
3293 * Disable the queues until we have reached the correct state!
3294 */
3295 if (confmp != NULL) {
3296 tep->te_state = NEXTSTATE(TE_CONN_CON, tep->te_state);
3297 noenable(wq);
3298 putnext(tep->te_rq, confmp);
3299 }
3300 /*
3301 * Now we need to increment tep reference because tep is referenced by
3302 * server list of pending connections. We also need to decrement
3303 * reference before exiting serializer. Two operations void each other
3304 * so we don't modify reference at all.
3305 */
3306 ASSERT(tep->te_refcnt >= 2);
3307 ASSERT(peer_tep->te_refcnt >= 2);
3308 tl_serializer_exit(tep);
3309 }
3310
3311
3312
3313 /*
3314 * Handle T_conn_res on listener stream. Called on listener serializer.
3315 * tl_conn_req has already generated the T_CONN_CON.
3316 * tl_conn_res is called on listener serializer.
3317 * No one accesses acceptor at this point, so it is safe to modify acceptor.
3318 * Switch eager serializer to acceptor's.
3319 *
3320 * If TL_SET[U]CRED generate the credentials options.
3321 * For sockets tl_conn_req has already generated the T_CONN_CON.
3322 */
3323 static void
3324 tl_conn_res(mblk_t *mp, tl_endpt_t *tep)
3325 {
3326 queue_t *wq;
3327 struct T_conn_res *cres = (struct T_conn_res *)mp->b_rptr;
3328 ssize_t msz = MBLKL(mp);
3329 t_scalar_t olen, ooff, err = 0;
3330 t_scalar_t prim = cres->PRIM_type;
3331 uchar_t *addr_startp;
3332 tl_endpt_t *acc_ep = NULL, *cl_ep = NULL;
3333 tl_icon_t *tip;
3334 size_t size;
3335 mblk_t *ackmp, *respmp;
3336 mblk_t *dimp, *ccmp = NULL;
3337 struct T_discon_ind *di;
3338 struct T_conn_con *cc;
3339 boolean_t client_noclose_set = B_FALSE;
3340 boolean_t switch_client_serializer = B_TRUE;
3341
3342 ASSERT(IS_COTS(tep));
3343
3344 if (tep->te_closing) {
3345 freemsg(mp);
3346 return;
3347 }
3348
3349 wq = tep->te_wq;
3350
3351 /*
3352 * preallocate memory for:
3353 * 1. max of T_ERROR_ACK and T_OK_ACK
3354 * ==> known max T_ERROR_ACK
3355 * 2. max of T_DISCON_IND and T_CONN_CON
3356 */
3357 ackmp = allocb(sizeof (struct T_error_ack), BPRI_MED);
3358 if (! ackmp) {
3359 tl_memrecover(wq, mp, sizeof (struct T_error_ack));
3360 return;
3361 }
3362 /*
3363 * memory committed for T_OK_ACK/T_ERROR_ACK now
3364 * will be committed for T_DISCON_IND/T_CONN_CON later
3365 */
3366
3367
3368 ASSERT(prim == T_CONN_RES || prim == O_T_CONN_RES);
3369
3370 /*
3371 * validate state
3372 */
3373 if (tep->te_state != TS_WRES_CIND) {
3374 (void) (STRLOG(TL_ID, tep->te_minor, 1,
3375 SL_TRACE|SL_ERROR,
3376 "tl_wput:T_CONN_RES:out of state, state=%d",
3377 tep->te_state));
3378 tl_error_ack(wq, ackmp, TOUTSTATE, 0, prim);
3379 freemsg(mp);
3380 return;
3381 }
3382
3383 /*
3384 * validate the message
3385 * Note: dereference fields in struct inside message only
3386 * after validating the message length.
3387 */
3388 if (msz < sizeof (struct T_conn_res)) {
3389 (void) (STRLOG(TL_ID, tep->te_minor, 1, SL_TRACE|SL_ERROR,
3390 "tl_conn_res:invalid message length"));
3391 tl_error_ack(wq, ackmp, TSYSERR, EINVAL, prim);
3392 freemsg(mp);
3393 return;
3394 }
3395 olen = cres->OPT_length;
3396 ooff = cres->OPT_offset;
3397 if (((olen > 0) && ((ooff + olen) > msz))) {
3398 (void) (STRLOG(TL_ID, tep->te_minor, 1, SL_TRACE|SL_ERROR,
3399 "tl_conn_res:invalid message"));
3400 tl_error_ack(wq, ackmp, TSYSERR, EINVAL, prim);
3401 freemsg(mp);
3402 return;
3403 }
3404 if (olen) {
3405 /*
3406 * no opts in connect res
3407 * supported in this provider
3408 */
3409 (void) (STRLOG(TL_ID, tep->te_minor, 1, SL_TRACE|SL_ERROR,
3410 "tl_conn_res:options not supported in message"));
3411 tl_error_ack(wq, ackmp, TBADOPT, 0, prim);
3412 freemsg(mp);
3413 return;
3414 }
3415
3416 tep->te_state = NEXTSTATE(TE_CONN_RES, tep->te_state);
3417 ASSERT(tep->te_state == TS_WACK_CRES);
3418
3419 if (cres->SEQ_number < TL_MINOR_START &&
3420 cres->SEQ_number >= BADSEQNUM) {
3421 (void) (STRLOG(TL_ID, tep->te_minor, 2, SL_TRACE|SL_ERROR,
3422 "tl_conn_res:remote endpoint sequence number bad"));
3423 tep->te_state = NEXTSTATE(TE_ERROR_ACK, tep->te_state);
3424 tl_error_ack(wq, ackmp, TBADSEQ, 0, prim);
3425 freemsg(mp);
3426 return;
3427 }
3428
3429 /*
3430 * find accepting endpoint. Will have extra reference if found.
3431 */
3432 if (mod_hash_find_cb(tep->te_transport->tr_ai_hash,
3433 (mod_hash_key_t)(uintptr_t)cres->ACCEPTOR_id,
3434 (mod_hash_val_t *)&acc_ep, tl_find_callback) != 0) {
3435 (void) (STRLOG(TL_ID, tep->te_minor, 2, SL_TRACE|SL_ERROR,
3436 "tl_conn_res:bad accepting endpoint"));
3437 tep->te_state = NEXTSTATE(TE_ERROR_ACK, tep->te_state);
3438 tl_error_ack(wq, ackmp, TBADF, 0, prim);
3439 freemsg(mp);
3440 return;
3441 }
3442
3443 /*
3444 * Prevent acceptor from closing.
3445 */
3446 if (! tl_noclose(acc_ep)) {
3447 (void) (STRLOG(TL_ID, tep->te_minor, 2, SL_TRACE|SL_ERROR,
3448 "tl_conn_res:bad accepting endpoint"));
3449 tep->te_state = NEXTSTATE(TE_ERROR_ACK, tep->te_state);
3450 tl_error_ack(wq, ackmp, TBADF, 0, prim);
3451 tl_refrele(acc_ep);
3452 freemsg(mp);
3453 return;
3454 }
3455
3456 acc_ep->te_flag |= TL_ACCEPTOR;
3457
3458 /*
3459 * validate that accepting endpoint, if different from listening
3460 * has address bound => state is TS_IDLE
3461 * TROUBLE in XPG4 !!?
3462 */
3463 if ((tep != acc_ep) && (acc_ep->te_state != TS_IDLE)) {
3464 (void) (STRLOG(TL_ID, tep->te_minor, 2, SL_TRACE|SL_ERROR,
3465 "tl_conn_res:accepting endpoint has no address bound,"
3466 "state=%d", acc_ep->te_state));
3467 tep->te_state = NEXTSTATE(TE_ERROR_ACK, tep->te_state);
3468 tl_error_ack(wq, ackmp, TOUTSTATE, 0, prim);
3469 freemsg(mp);
3470 tl_closeok(acc_ep);
3471 tl_refrele(acc_ep);
3472 return;
3473 }
3474
3475 /*
3476 * validate if accepting endpt same as listening, then
3477 * no other incoming connection should be on the queue
3478 */
3479
3480 if ((tep == acc_ep) && (tep->te_nicon > 1)) {
3481 (void) (STRLOG(TL_ID, tep->te_minor, 3, SL_TRACE|SL_ERROR,
3482 "tl_conn_res: > 1 conn_ind on listener-acceptor"));
3483 tep->te_state = NEXTSTATE(TE_ERROR_ACK, tep->te_state);
3484 tl_error_ack(wq, ackmp, TBADF, 0, prim);
3485 freemsg(mp);
3486 tl_closeok(acc_ep);
3487 tl_refrele(acc_ep);
3488 return;
3489 }
3490
3491 /*
3492 * Mark for deletion, the entry corresponding to client
3493 * on list of pending connections made by the listener
3494 * search list to see if client is one of the
3495 * recorded as a listener.
3496 */
3497 tip = tl_icon_find(tep, cres->SEQ_number);
3498 if (tip == NULL) {
3499 (void) (STRLOG(TL_ID, tep->te_minor, 2, SL_TRACE|SL_ERROR,
3500 "tl_conn_res:no client in listener list"));
3501 tep->te_state = NEXTSTATE(TE_ERROR_ACK, tep->te_state);
3502 tl_error_ack(wq, ackmp, TBADSEQ, 0, prim);
3503 freemsg(mp);
3504 tl_closeok(acc_ep);
3505 tl_refrele(acc_ep);
3506 return;
3507 }
3508
3509 /*
3510 * If ti_tep is NULL the client has already closed. In this case
3511 * the code below will avoid any action on the client side
3512 * but complete the server and acceptor state transitions.
3513 */
3514 ASSERT(tip->ti_tep == NULL ||
3515 tip->ti_tep->te_seqno == cres->SEQ_number);
3516 cl_ep = tip->ti_tep;
3517
3518 /*
3519 * If the client is present it is switched from listener's to acceptor's
3520 * serializer. We should block client closes while serializers are
3521 * being switched.
3522 *
3523 * It is possible that the client is present but is currently being
3524 * closed. There are two possible cases:
3525 *
3526 * 1) The client has already entered tl_close_finish_ser() and sent
3527 * T_ORDREL_IND. In this case we can just ignore the client (but we
3528 * still need to send all messages from tip->ti_mp to the acceptor).
3529 *
3530 * 2) The client started the close but has not entered
3531 * tl_close_finish_ser() yet. In this case, the client is already
3532 * proceeding asynchronously on the listener's serializer, so we're
3533 * forced to change the acceptor to use the listener's serializer to
3534 * ensure that any operations on the acceptor are serialized with
3535 * respect to the close that's in-progress.
3536 */
3537 if (cl_ep != NULL) {
3538 if (tl_noclose(cl_ep)) {
3539 client_noclose_set = B_TRUE;
3540 } else {
3541 /*
3542 * Client is closing. If it it has sent the
3543 * T_ORDREL_IND, we can simply ignore it - otherwise,
3544 * we have to let let the client continue until it is
3545 * sent.
3546 *
3547 * If we do continue using the client, acceptor will
3548 * switch to client's serializer which is used by client
3549 * for its close.
3550 */
3551 tl_client_closing_when_accepting++;
3552 switch_client_serializer = B_FALSE;
3553 if (!IS_SOCKET(cl_ep) || tl_disable_early_connect ||
3554 cl_ep->te_state == -1)
3555 cl_ep = NULL;
3556 }
3557 }
3558
3559 if (cl_ep != NULL) {
3560 /*
3561 * validate client state to be TS_WCON_CREQ or TS_DATA_XFER
3562 * (latter for sockets only)
3563 */
3564 if (cl_ep->te_state != TS_WCON_CREQ &&
3565 (cl_ep->te_state != TS_DATA_XFER &&
3566 IS_SOCKET(cl_ep))) {
3567 err = ECONNREFUSED;
3568 /*
3569 * T_DISCON_IND sent later after committing memory
3570 * and acking validity of request
3571 */
3572 (void) (STRLOG(TL_ID, tep->te_minor, 2, SL_TRACE,
3573 "tl_conn_res:peer in bad state"));
3574 }
3575
3576 /*
3577 * preallocate now for T_DISCON_IND or T_CONN_CONN
3578 * ack validity of request (T_OK_ACK) after memory committed
3579 */
3580
3581 if (err)
3582 size = sizeof (struct T_discon_ind);
3583 else {
3584 /*
3585 * calculate length of T_CONN_CON message
3586 */
3587 olen = 0;
3588 if (cl_ep->te_flag & TL_SETCRED) {
3589 olen = (t_scalar_t)sizeof (struct opthdr) +
3590 OPTLEN(sizeof (tl_credopt_t));
3591 } else if (cl_ep->te_flag & TL_SETUCRED) {
3592 olen = (t_scalar_t)sizeof (struct opthdr) +
3593 OPTLEN(ucredminsize(acc_ep->te_credp));
3594 }
3595 size = T_ALIGN(sizeof (struct T_conn_con) +
3596 acc_ep->te_alen) + olen;
3597 }
3598 if ((respmp = reallocb(mp, size, 0)) == NULL) {
3599 /*
3600 * roll back state changes
3601 */
3602 tep->te_state = TS_WRES_CIND;
3603 tl_memrecover(wq, mp, size);
3604 freemsg(ackmp);
3605 if (client_noclose_set)
3606 tl_closeok(cl_ep);
3607 tl_closeok(acc_ep);
3608 tl_refrele(acc_ep);
3609 return;
3610 }
3611 mp = NULL;
3612 }
3613
3614 /*
3615 * Now ack validity of request
3616 */
3617 if (tep->te_nicon == 1) {
3618 if (tep == acc_ep)
3619 tep->te_state = NEXTSTATE(TE_OK_ACK2, tep->te_state);
3620 else
3621 tep->te_state = NEXTSTATE(TE_OK_ACK3, tep->te_state);
3622 } else
3623 tep->te_state = NEXTSTATE(TE_OK_ACK4, tep->te_state);
3624
3625 /*
3626 * send T_DISCON_IND now if client state validation failed earlier
3627 */
3628 if (err) {
3629 tl_ok_ack(wq, ackmp, prim);
3630 /*
3631 * flush the queues - why always ?
3632 */
3633 (void) putnextctl1(acc_ep->te_rq, M_FLUSH, FLUSHR);
3634
3635 dimp = tl_resizemp(respmp, size);
3636 if (! dimp) {
3637 (void) (STRLOG(TL_ID, tep->te_minor, 3,
3638 SL_TRACE|SL_ERROR,
3639 "tl_conn_res:con_ind:allocb failure"));
3640 tl_merror(wq, respmp, ENOMEM);
3641 tl_closeok(acc_ep);
3642 if (client_noclose_set)
3643 tl_closeok(cl_ep);
3644 tl_refrele(acc_ep);
3645 return;
3646 }
3647 if (dimp->b_cont) {
3648 /* no user data in provider generated discon ind */
3649 freemsg(dimp->b_cont);
3650 dimp->b_cont = NULL;
3651 }
3652
3653 DB_TYPE(dimp) = M_PROTO;
3654 di = (struct T_discon_ind *)dimp->b_rptr;
3655 di->PRIM_type = T_DISCON_IND;
3656 di->DISCON_reason = err;
3657 di->SEQ_number = BADSEQNUM;
3658
3659 tep->te_state = TS_IDLE;
3660 /*
3661 * send T_DISCON_IND message
3662 */
3663 putnext(acc_ep->te_rq, dimp);
3664 if (client_noclose_set)
3665 tl_closeok(cl_ep);
3666 tl_closeok(acc_ep);
3667 tl_refrele(acc_ep);
3668 return;
3669 }
3670
3671 /*
3672 * now start connecting the accepting endpoint
3673 */
3674 if (tep != acc_ep)
3675 acc_ep->te_state = NEXTSTATE(TE_PASS_CONN, acc_ep->te_state);
3676
3677 if (cl_ep == NULL) {
3678 /*
3679 * The client has already closed. Send up any queued messages
3680 * and change the state accordingly.
3681 */
3682 tl_ok_ack(wq, ackmp, prim);
3683 tl_icon_sendmsgs(acc_ep, &tip->ti_mp);
3684
3685 /*
3686 * remove endpoint from incoming connection
3687 * delete client from list of incoming connections
3688 */
3689 tl_freetip(tep, tip);
3690 freemsg(mp);
3691 tl_closeok(acc_ep);
3692 tl_refrele(acc_ep);
3693 return;
3694 } else if (tip->ti_mp != NULL) {
3695 /*
3696 * The client could have queued a T_DISCON_IND which needs
3697 * to be sent up.
3698 * Note that t_discon_req can not operate the same as
3699 * t_data_req since it is not possible for it to putbq
3700 * the message and return -1 due to the use of qwriter.
3701 */
3702 tl_icon_sendmsgs(acc_ep, &tip->ti_mp);
3703 }
3704
3705 /*
3706 * prepare connect confirm T_CONN_CON message
3707 */
3708
3709 /*
3710 * allocate the message - original data blocks
3711 * retained in the returned mblk
3712 */
3713 if (! IS_SOCKET(cl_ep) || tl_disable_early_connect) {
3714 ccmp = tl_resizemp(respmp, size);
3715 if (ccmp == NULL) {
3716 tl_ok_ack(wq, ackmp, prim);
3717 (void) (STRLOG(TL_ID, tep->te_minor, 3,
3718 SL_TRACE|SL_ERROR,
3719 "tl_conn_res:conn_con:allocb failure"));
3720 tl_merror(wq, respmp, ENOMEM);
3721 tl_closeok(acc_ep);
3722 if (client_noclose_set)
3723 tl_closeok(cl_ep);
3724 tl_refrele(acc_ep);
3725 return;
3726 }
3727
3728 DB_TYPE(ccmp) = M_PROTO;
3729 cc = (struct T_conn_con *)ccmp->b_rptr;
3730 cc->PRIM_type = T_CONN_CON;
3731 cc->RES_offset = (t_scalar_t)sizeof (struct T_conn_con);
3732 cc->RES_length = acc_ep->te_alen;
3733 addr_startp = ccmp->b_rptr + cc->RES_offset;
3734 bcopy(acc_ep->te_abuf, addr_startp, acc_ep->te_alen);
3735 if (cl_ep->te_flag & (TL_SETCRED|TL_SETUCRED)) {
3736 cc->OPT_offset = (t_scalar_t)T_ALIGN(cc->RES_offset +
3737 cc->RES_length);
3738 cc->OPT_length = olen;
3739 tl_fill_option(ccmp->b_rptr + cc->OPT_offset,
3740 acc_ep->te_credp, acc_ep->te_cpid, cl_ep->te_flag,
3741 cl_ep->te_credp);
3742 } else {
3743 cc->OPT_offset = 0;
3744 cc->OPT_length = 0;
3745 }
3746 /*
3747 * Forward the credential in the packet so it can be picked up
3748 * at the higher layers for more complete credential processing
3749 */
3750 mblk_setcred(ccmp, acc_ep->te_credp, acc_ep->te_cpid);
3751 } else {
3752 freemsg(respmp);
3753 respmp = NULL;
3754 }
3755
3756 /*
3757 * make connection linking
3758 * accepting and client endpoints
3759 * No need to increment references:
3760 * on client: it should already have one from tip->ti_tep linkage.
3761 * on acceptor is should already have one from the table lookup.
3762 *
3763 * At this point both client and acceptor can't close. Set client
3764 * serializer to acceptor's.
3765 */
3766 ASSERT(cl_ep->te_refcnt >= 2);
3767 ASSERT(acc_ep->te_refcnt >= 2);
3768 ASSERT(cl_ep->te_conp == NULL);
3769 ASSERT(acc_ep->te_conp == NULL);
3770 cl_ep->te_conp = acc_ep;
3771 acc_ep->te_conp = cl_ep;
3772 ASSERT(cl_ep->te_ser == tep->te_ser);
3773 if (switch_client_serializer) {
3774 mutex_enter(&cl_ep->te_ser_lock);
3775 if (cl_ep->te_ser_count > 0) {
3776 switch_client_serializer = B_FALSE;
3777 tl_serializer_noswitch++;
3778 } else {
3779 /*
3780 * Move client to the acceptor's serializer.
3781 */
3782 tl_serializer_refhold(acc_ep->te_ser);
3783 tl_serializer_refrele(cl_ep->te_ser);
3784 cl_ep->te_ser = acc_ep->te_ser;
3785 }
3786 mutex_exit(&cl_ep->te_ser_lock);
3787 }
3788 if (!switch_client_serializer) {
3789 /*
3790 * It is not possible to switch client to use acceptor's.
3791 * Move acceptor to client's serializer (which is the same as
3792 * listener's).
3793 */
3794 tl_serializer_refhold(cl_ep->te_ser);
3795 tl_serializer_refrele(acc_ep->te_ser);
3796 acc_ep->te_ser = cl_ep->te_ser;
3797 }
3798
3799 TL_REMOVE_PEER(cl_ep->te_oconp);
3800 TL_REMOVE_PEER(acc_ep->te_oconp);
3801
3802 /*
3803 * remove endpoint from incoming connection
3804 * delete client from list of incoming connections
3805 */
3806 tip->ti_tep = NULL;
3807 tl_freetip(tep, tip);
3808 tl_ok_ack(wq, ackmp, prim);
3809
3810 /*
3811 * data blocks already linked in reallocb()
3812 */
3813
3814 /*
3815 * link queues so that I_SENDFD will work
3816 */
3817 if (! IS_SOCKET(tep)) {
3818 acc_ep->te_wq->q_next = cl_ep->te_rq;
3819 cl_ep->te_wq->q_next = acc_ep->te_rq;
3820 }
3821
3822 /*
3823 * send T_CONN_CON up on client side unless it was already
3824 * done (for a socket). In cases any data or ordrel req has been
3825 * queued make sure that the service procedure runs.
3826 */
3827 if (IS_SOCKET(cl_ep) && !tl_disable_early_connect) {
3828 enableok(cl_ep->te_wq);
3829 TL_QENABLE(cl_ep);
3830 if (ccmp != NULL)
3831 freemsg(ccmp);
3832 } else {
3833 /*
3834 * change client state on TE_CONN_CON event
3835 */
3836 cl_ep->te_state = NEXTSTATE(TE_CONN_CON, cl_ep->te_state);
3837 putnext(cl_ep->te_rq, ccmp);
3838 }
3839
3840 /* Mark the both endpoints as accepted */
3841 cl_ep->te_flag |= TL_ACCEPTED;
3842 acc_ep->te_flag |= TL_ACCEPTED;
3843
3844 /*
3845 * Allow client and acceptor to close.
3846 */
3847 tl_closeok(acc_ep);
3848 if (client_noclose_set)
3849 tl_closeok(cl_ep);
3850 }
3851
3852
3853
3854
3855 static void
3856 tl_discon_req(mblk_t *mp, tl_endpt_t *tep)
3857 {
3858 queue_t *wq;
3859 struct T_discon_req *dr;
3860 ssize_t msz;
3861 tl_endpt_t *peer_tep = tep->te_conp;
3862 tl_endpt_t *srv_tep = tep->te_oconp;
3863 tl_icon_t *tip;
3864 size_t size;
3865 mblk_t *ackmp, *dimp, *respmp;
3866 struct T_discon_ind *di;
3867 t_scalar_t save_state, new_state;
3868
3869 if (tep->te_closing) {
3870 freemsg(mp);
3871 return;
3872 }
3873
3874 if ((peer_tep != NULL) && peer_tep->te_closing) {
3875 TL_UNCONNECT(tep->te_conp);
3876 peer_tep = NULL;
3877 }
3878 if ((srv_tep != NULL) && srv_tep->te_closing) {
3879 TL_UNCONNECT(tep->te_oconp);
3880 srv_tep = NULL;
3881 }
3882
3883 wq = tep->te_wq;
3884
3885 /*
3886 * preallocate memory for:
3887 * 1. max of T_ERROR_ACK and T_OK_ACK
3888 * ==> known max T_ERROR_ACK
3889 * 2. for T_DISCON_IND
3890 */
3891 ackmp = allocb(sizeof (struct T_error_ack), BPRI_MED);
3892 if (! ackmp) {
3893 tl_memrecover(wq, mp, sizeof (struct T_error_ack));
3894 return;
3895 }
3896 /*
3897 * memory committed for T_OK_ACK/T_ERROR_ACK now
3898 * will be committed for T_DISCON_IND later
3899 */
3900
3901 dr = (struct T_discon_req *)mp->b_rptr;
3902 msz = MBLKL(mp);
3903
3904 /*
3905 * validate the state
3906 */
3907 save_state = new_state = tep->te_state;
3908 if (! (save_state >= TS_WCON_CREQ && save_state <= TS_WRES_CIND) &&
3909 ! (save_state >= TS_DATA_XFER && save_state <= TS_WREQ_ORDREL)) {
3910 (void) (STRLOG(TL_ID, tep->te_minor, 1,
3911 SL_TRACE|SL_ERROR,
3912 "tl_wput:T_DISCON_REQ:out of state, state=%d",
3913 tep->te_state));
3914 tl_error_ack(wq, ackmp, TOUTSTATE, 0, T_DISCON_REQ);
3915 freemsg(mp);
3916 return;
3917 }
3918 /*
3919 * Defer committing the state change until it is determined if
3920 * the message will be queued with the tl_icon or not.
3921 */
3922 new_state = NEXTSTATE(TE_DISCON_REQ, tep->te_state);
3923
3924 /* validate the message */
3925 if (msz < sizeof (struct T_discon_req)) {
3926 (void) (STRLOG(TL_ID, tep->te_minor, 1, SL_TRACE|SL_ERROR,
3927 "tl_discon_req:invalid message"));
3928 tep->te_state = NEXTSTATE(TE_ERROR_ACK, new_state);
3929 tl_error_ack(wq, ackmp, TSYSERR, EINVAL, T_DISCON_REQ);
3930 freemsg(mp);
3931 return;
3932 }
3933
3934 /*
3935 * if server, then validate that client exists
3936 * by connection sequence number etc.
3937 */
3938 if (tep->te_nicon > 0) { /* server */
3939
3940 /*
3941 * search server list for disconnect client
3942 */
3943 tip = tl_icon_find(tep, dr->SEQ_number);
3944 if (tip == NULL) {
3945 (void) (STRLOG(TL_ID, tep->te_minor, 2,
3946 SL_TRACE|SL_ERROR,
3947 "tl_discon_req:no disconnect endpoint"));
3948 tep->te_state = NEXTSTATE(TE_ERROR_ACK, new_state);
3949 tl_error_ack(wq, ackmp, TBADSEQ, 0, T_DISCON_REQ);
3950 freemsg(mp);
3951 return;
3952 }
3953 /*
3954 * If ti_tep is NULL the client has already closed. In this case
3955 * the code below will avoid any action on the client side.
3956 */
3957
3958 IMPLY(tip->ti_tep != NULL,
3959 tip->ti_tep->te_seqno == dr->SEQ_number);
3960 peer_tep = tip->ti_tep;
3961 }
3962
3963 /*
3964 * preallocate now for T_DISCON_IND
3965 * ack validity of request (T_OK_ACK) after memory committed
3966 */
3967 size = sizeof (struct T_discon_ind);
3968 if ((respmp = reallocb(mp, size, 0)) == NULL) {
3969 tl_memrecover(wq, mp, size);
3970 freemsg(ackmp);
3971 return;
3972 }
3973
3974 /*
3975 * prepare message to ack validity of request
3976 */
3977 if (tep->te_nicon == 0)
3978 new_state = NEXTSTATE(TE_OK_ACK1, new_state);
3979 else
3980 if (tep->te_nicon == 1)
3981 new_state = NEXTSTATE(TE_OK_ACK2, new_state);
3982 else
3983 new_state = NEXTSTATE(TE_OK_ACK4, new_state);
3984
3985 /*
3986 * Flushing queues according to TPI. Using the old state.
3987 */
3988 if ((tep->te_nicon <= 1) &&
3989 ((save_state == TS_DATA_XFER) ||
3990 (save_state == TS_WIND_ORDREL) ||
3991 (save_state == TS_WREQ_ORDREL)))
3992 (void) putnextctl1(RD(wq), M_FLUSH, FLUSHRW);
3993
3994 /* send T_OK_ACK up */
3995 tl_ok_ack(wq, ackmp, T_DISCON_REQ);
3996
3997 /*
3998 * now do disconnect business
3999 */
4000 if (tep->te_nicon > 0) { /* listener */
4001 if (peer_tep != NULL && !peer_tep->te_closing) {
4002 /*
4003 * disconnect incoming connect request pending to tep
4004 */
4005 if ((dimp = tl_resizemp(respmp, size)) == NULL) {
4006 (void) (STRLOG(TL_ID, tep->te_minor, 2,
4007 SL_TRACE|SL_ERROR,
4008 "tl_discon_req: reallocb failed"));
4009 tep->te_state = new_state;
4010 tl_merror(wq, respmp, ENOMEM);
4011 return;
4012 }
4013 di = (struct T_discon_ind *)dimp->b_rptr;
4014 di->SEQ_number = BADSEQNUM;
4015 save_state = peer_tep->te_state;
4016 peer_tep->te_state = TS_IDLE;
4017
4018 TL_REMOVE_PEER(peer_tep->te_oconp);
4019 enableok(peer_tep->te_wq);
4020 TL_QENABLE(peer_tep);
4021 } else {
4022 freemsg(respmp);
4023 dimp = NULL;
4024 }
4025
4026 /*
4027 * remove endpoint from incoming connection list
4028 * - remove disconnect client from list on server
4029 */
4030 tl_freetip(tep, tip);
4031 } else if ((peer_tep = tep->te_oconp) != NULL) { /* client */
4032 /*
4033 * disconnect an outgoing request pending from tep
4034 */
4035
4036 if ((dimp = tl_resizemp(respmp, size)) == NULL) {
4037 (void) (STRLOG(TL_ID, tep->te_minor, 2,
4038 SL_TRACE|SL_ERROR,
4039 "tl_discon_req: reallocb failed"));
4040 tep->te_state = new_state;
4041 tl_merror(wq, respmp, ENOMEM);
4042 return;
4043 }
4044 di = (struct T_discon_ind *)dimp->b_rptr;
4045 DB_TYPE(dimp) = M_PROTO;
4046 di->PRIM_type = T_DISCON_IND;
4047 di->DISCON_reason = ECONNRESET;
4048 di->SEQ_number = tep->te_seqno;
4049
4050 /*
4051 * If this is a socket the T_DISCON_IND is queued with
4052 * the T_CONN_IND. Otherwise the T_CONN_IND is removed
4053 * from the list of pending connections.
4054 * Note that when te_oconp is set the peer better have
4055 * a t_connind_t for the client.
4056 */
4057 if (IS_SOCKET(tep) && !tl_disable_early_connect) {
4058 /*
4059 * No need to check that
4060 * ti_tep == NULL since the T_DISCON_IND
4061 * takes precedence over other queued
4062 * messages.
4063 */
4064 tl_icon_queuemsg(peer_tep, tep->te_seqno, dimp);
4065 peer_tep = NULL;
4066 dimp = NULL;
4067 /*
4068 * Can't clear te_oconp since tl_co_unconnect needs
4069 * it as a hint not to free the tep.
4070 * Keep the state unchanged since tl_conn_res inspects
4071 * it.
4072 */
4073 new_state = tep->te_state;
4074 } else {
4075 /* Found - delete it */
4076 tip = tl_icon_find(peer_tep, tep->te_seqno);
4077 if (tip != NULL) {
4078 ASSERT(tep == tip->ti_tep);
4079 save_state = peer_tep->te_state;
4080 if (peer_tep->te_nicon == 1)
4081 peer_tep->te_state =
4082 NEXTSTATE(TE_DISCON_IND2,
4083 peer_tep->te_state);
4084 else
4085 peer_tep->te_state =
4086 NEXTSTATE(TE_DISCON_IND3,
4087 peer_tep->te_state);
4088 tl_freetip(peer_tep, tip);
4089 }
4090 ASSERT(tep->te_oconp != NULL);
4091 TL_UNCONNECT(tep->te_oconp);
4092 }
4093 } else if ((peer_tep = tep->te_conp) != NULL) { /* connected! */
4094 if ((dimp = tl_resizemp(respmp, size)) == NULL) {
4095 (void) (STRLOG(TL_ID, tep->te_minor, 2,
4096 SL_TRACE|SL_ERROR,
4097 "tl_discon_req: reallocb failed"));
4098 tep->te_state = new_state;
4099 tl_merror(wq, respmp, ENOMEM);
4100 return;
4101 }
4102 di = (struct T_discon_ind *)dimp->b_rptr;
4103 di->SEQ_number = BADSEQNUM;
4104
4105 save_state = peer_tep->te_state;
4106 peer_tep->te_state = TS_IDLE;
4107 } else {
4108 /* Not connected */
4109 tep->te_state = new_state;
4110 freemsg(respmp);
4111 return;
4112 }
4113
4114 /* Commit state changes */
4115 tep->te_state = new_state;
4116
4117 if (peer_tep == NULL) {
4118 ASSERT(dimp == NULL);
4119 goto done;
4120 }
4121 /*
4122 * Flush queues on peer before sending up
4123 * T_DISCON_IND according to TPI
4124 */
4125
4126 if ((save_state == TS_DATA_XFER) ||
4127 (save_state == TS_WIND_ORDREL) ||
4128 (save_state == TS_WREQ_ORDREL))
4129 (void) putnextctl1(peer_tep->te_rq, M_FLUSH, FLUSHRW);
4130
4131 DB_TYPE(dimp) = M_PROTO;
4132 di->PRIM_type = T_DISCON_IND;
4133 di->DISCON_reason = ECONNRESET;
4134
4135 /*
4136 * data blocks already linked into dimp by reallocb()
4137 */
4138 /*
4139 * send indication message to peer user module
4140 */
4141 ASSERT(dimp != NULL);
4142 putnext(peer_tep->te_rq, dimp);
4143 done:
4144 if (tep->te_conp) { /* disconnect pointers if connected */
4145 ASSERT(! peer_tep->te_closing);
4146
4147 /*
4148 * Messages may be queued on peer's write queue
4149 * waiting to be processed by its write service
4150 * procedure. Before the pointer to the peer transport
4151 * structure is set to NULL, qenable the peer's write
4152 * queue so that the queued up messages are processed.
4153 */
4154 if ((save_state == TS_DATA_XFER) ||
4155 (save_state == TS_WIND_ORDREL) ||
4156 (save_state == TS_WREQ_ORDREL))
4157 TL_QENABLE(peer_tep);
4158 ASSERT(peer_tep != NULL && peer_tep->te_conp != NULL);
4159 TL_UNCONNECT(peer_tep->te_conp);
4160 if (! IS_SOCKET(tep)) {
4161 /*
4162 * unlink the streams
4163 */
4164 tep->te_wq->q_next = NULL;
4165 peer_tep->te_wq->q_next = NULL;
4166 }
4167 TL_UNCONNECT(tep->te_conp);
4168 }
4169 }
4170
4171 static void
4172 tl_addr_req_ser(mblk_t *mp, tl_endpt_t *tep)
4173 {
4174 if (!tep->te_closing)
4175 tl_addr_req(mp, tep);
4176 else
4177 freemsg(mp);
4178
4179 tl_serializer_exit(tep);
4180 tl_refrele(tep);
4181 }
4182
4183 static void
4184 tl_addr_req(mblk_t *mp, tl_endpt_t *tep)
4185 {
4186 queue_t *wq;
4187 size_t ack_sz;
4188 mblk_t *ackmp;
4189 struct T_addr_ack *taa;
4190
4191 if (tep->te_closing) {
4192 freemsg(mp);
4193 return;
4194 }
4195
4196 wq = tep->te_wq;
4197
4198 /*
4199 * Note: T_ADDR_REQ message has only PRIM_type field
4200 * so it is already validated earlier.
4201 */
4202
4203 if (IS_CLTS(tep) ||
4204 (tep->te_state > TS_WREQ_ORDREL) ||
4205 (tep->te_state < TS_DATA_XFER)) {
4206 /*
4207 * Either connectionless or connection oriented but not
4208 * in connected data transfer state or half-closed states.
4209 */
4210 ack_sz = sizeof (struct T_addr_ack);
4211 if (tep->te_state >= TS_IDLE)
4212 /* is bound */
4213 ack_sz += tep->te_alen;
4214 ackmp = reallocb(mp, ack_sz, 0);
4215 if (ackmp == NULL) {
4216 (void) (STRLOG(TL_ID, tep->te_minor, 1,
4217 SL_TRACE|SL_ERROR,
4218 "tl_addr_req: reallocb failed"));
4219 tl_memrecover(wq, mp, ack_sz);
4220 return;
4221 }
4222
4223 taa = (struct T_addr_ack *)ackmp->b_rptr;
4224
4225 bzero(taa, sizeof (struct T_addr_ack));
4226
4227 taa->PRIM_type = T_ADDR_ACK;
4228 ackmp->b_datap->db_type = M_PCPROTO;
4229 ackmp->b_wptr = (uchar_t *)&taa[1];
4230
4231 if (tep->te_state >= TS_IDLE) {
4232 /* endpoint is bound */
4233 taa->LOCADDR_length = tep->te_alen;
4234 taa->LOCADDR_offset = (t_scalar_t)sizeof (*taa);
4235
4236 bcopy(tep->te_abuf, ackmp->b_wptr,
4237 tep->te_alen);
4238 ackmp->b_wptr += tep->te_alen;
4239 ASSERT(ackmp->b_wptr <= ackmp->b_datap->db_lim);
4240 }
4241
4242 (void) qreply(wq, ackmp);
4243 } else {
4244 ASSERT(tep->te_state == TS_DATA_XFER ||
4245 tep->te_state == TS_WIND_ORDREL ||
4246 tep->te_state == TS_WREQ_ORDREL);
4247 /* connection oriented in data transfer */
4248 tl_connected_cots_addr_req(mp, tep);
4249 }
4250 }
4251
4252
4253 static void
4254 tl_connected_cots_addr_req(mblk_t *mp, tl_endpt_t *tep)
4255 {
4256 tl_endpt_t *peer_tep = tep->te_conp;
4257 size_t ack_sz;
4258 mblk_t *ackmp;
4259 struct T_addr_ack *taa;
4260 uchar_t *addr_startp;
4261
4262 if (tep->te_closing) {
4263 freemsg(mp);
4264 return;
4265 }
4266
4267 if (peer_tep == NULL || peer_tep->te_closing) {
4268 tl_error_ack(tep->te_wq, mp, TSYSERR, ECONNRESET, T_ADDR_REQ);
4269 return;
4270 }
4271
4272 ASSERT(tep->te_state >= TS_IDLE);
4273
4274 ack_sz = sizeof (struct T_addr_ack);
4275 ack_sz += T_ALIGN(tep->te_alen);
4276 ack_sz += peer_tep->te_alen;
4277
4278 ackmp = tpi_ack_alloc(mp, ack_sz, M_PCPROTO, T_ADDR_ACK);
4279 if (ackmp == NULL) {
4280 (void) (STRLOG(TL_ID, tep->te_minor, 1, SL_TRACE|SL_ERROR,
4281 "tl_connected_cots_addr_req: reallocb failed"));
4282 tl_memrecover(tep->te_wq, mp, ack_sz);
4283 return;
4284 }
4285
4286 taa = (struct T_addr_ack *)ackmp->b_rptr;
4287
4288 /* endpoint is bound */
4289 taa->LOCADDR_length = tep->te_alen;
4290 taa->LOCADDR_offset = (t_scalar_t)sizeof (*taa);
4291
4292 addr_startp = (uchar_t *)&taa[1];
4293
4294 bcopy(tep->te_abuf, addr_startp,
4295 tep->te_alen);
4296
4297 taa->REMADDR_length = peer_tep->te_alen;
4298 taa->REMADDR_offset = (t_scalar_t)T_ALIGN(taa->LOCADDR_offset +
4299 taa->LOCADDR_length);
4300 addr_startp = ackmp->b_rptr + taa->REMADDR_offset;
4301 bcopy(peer_tep->te_abuf, addr_startp,
4302 peer_tep->te_alen);
4303 ackmp->b_wptr = (uchar_t *)ackmp->b_rptr +
4304 taa->REMADDR_offset + peer_tep->te_alen;
4305 ASSERT(ackmp->b_wptr <= ackmp->b_datap->db_lim);
4306
4307 putnext(tep->te_rq, ackmp);
4308 }
4309
4310 static void
4311 tl_copy_info(struct T_info_ack *ia, tl_endpt_t *tep)
4312 {
4313 if (IS_CLTS(tep)) {
4314 *ia = tl_clts_info_ack;
4315 ia->TSDU_size = tl_tidusz; /* TSDU and TIDU size are same */
4316 } else {
4317 *ia = tl_cots_info_ack;
4318 if (IS_COTSORD(tep))
4319 ia->SERV_type = T_COTS_ORD;
4320 }
4321 ia->TIDU_size = tl_tidusz;
4322 ia->CURRENT_state = tep->te_state;
4323 }
4324
4325 /*
4326 * This routine responds to T_CAPABILITY_REQ messages. It is called by
4327 * tl_wput.
4328 */
4329 static void
4330 tl_capability_req(mblk_t *mp, tl_endpt_t *tep)
4331 {
4332 mblk_t *ackmp;
4333 t_uscalar_t cap_bits1;
4334 struct T_capability_ack *tcap;
4335
4336 if (tep->te_closing) {
4337 freemsg(mp);
4338 return;
4339 }
4340
4341 cap_bits1 = ((struct T_capability_req *)mp->b_rptr)->CAP_bits1;
4342
4343 ackmp = tpi_ack_alloc(mp, sizeof (struct T_capability_ack),
4344 M_PCPROTO, T_CAPABILITY_ACK);
4345 if (ackmp == NULL) {
4346 (void) (STRLOG(TL_ID, tep->te_minor, 1, SL_TRACE|SL_ERROR,
4347 "tl_capability_req: reallocb failed"));
4348 tl_memrecover(tep->te_wq, mp,
4349 sizeof (struct T_capability_ack));
4350 return;
4351 }
4352
4353 tcap = (struct T_capability_ack *)ackmp->b_rptr;
4354 tcap->CAP_bits1 = 0;
4355
4356 if (cap_bits1 & TC1_INFO) {
4357 tl_copy_info(&tcap->INFO_ack, tep);
4358 tcap->CAP_bits1 |= TC1_INFO;
4359 }
4360
4361 if (cap_bits1 & TC1_ACCEPTOR_ID) {
4362 tcap->ACCEPTOR_id = tep->te_acceptor_id;
4363 tcap->CAP_bits1 |= TC1_ACCEPTOR_ID;
4364 }
4365
4366 putnext(tep->te_rq, ackmp);
4367 }
4368
4369 static void
4370 tl_info_req_ser(mblk_t *mp, tl_endpt_t *tep)
4371 {
4372 if (! tep->te_closing)
4373 tl_info_req(mp, tep);
4374 else
4375 freemsg(mp);
4376
4377 tl_serializer_exit(tep);
4378 tl_refrele(tep);
4379 }
4380
4381 static void
4382 tl_info_req(mblk_t *mp, tl_endpt_t *tep)
4383 {
4384 mblk_t *ackmp;
4385
4386 ackmp = tpi_ack_alloc(mp, sizeof (struct T_info_ack),
4387 M_PCPROTO, T_INFO_ACK);
4388 if (ackmp == NULL) {
4389 (void) (STRLOG(TL_ID, tep->te_minor, 1, SL_TRACE|SL_ERROR,
4390 "tl_info_req: reallocb failed"));
4391 tl_memrecover(tep->te_wq, mp, sizeof (struct T_info_ack));
4392 return;
4393 }
4394
4395 /*
4396 * fill in T_INFO_ACK contents
4397 */
4398 tl_copy_info((struct T_info_ack *)ackmp->b_rptr, tep);
4399
4400 /*
4401 * send ack message
4402 */
4403 putnext(tep->te_rq, ackmp);
4404 }
4405
4406 /*
4407 * Handle M_DATA, T_data_req and T_optdata_req.
4408 * If this is a socket pass through T_optdata_req options unmodified.
4409 */
4410 static void
4411 tl_data(mblk_t *mp, tl_endpt_t *tep)
4412 {
4413 queue_t *wq = tep->te_wq;
4414 union T_primitives *prim = (union T_primitives *)mp->b_rptr;
4415 ssize_t msz = MBLKL(mp);
4416 tl_endpt_t *peer_tep;
4417 queue_t *peer_rq;
4418 boolean_t closing = tep->te_closing;
4419
4420 if (IS_CLTS(tep)) {
4421 (void) (STRLOG(TL_ID, tep->te_minor, 2,
4422 SL_TRACE|SL_ERROR,
4423 "tl_wput:clts:unattached M_DATA"));
4424 if (!closing) {
4425 tl_merror(wq, mp, EPROTO);
4426 } else {
4427 freemsg(mp);
4428 }
4429 return;
4430 }
4431
4432 /*
4433 * If the endpoint is closing it should still forward any data to the
4434 * peer (if it has one). If it is not allowed to forward it can just
4435 * free the message.
4436 */
4437 if (closing &&
4438 (tep->te_state != TS_DATA_XFER) &&
4439 (tep->te_state != TS_WREQ_ORDREL)) {
4440 freemsg(mp);
4441 return;
4442 }
4443
4444 if (DB_TYPE(mp) == M_PROTO) {
4445 if (prim->type == T_DATA_REQ &&
4446 msz < sizeof (struct T_data_req)) {
4447 (void) (STRLOG(TL_ID, tep->te_minor, 1,
4448 SL_TRACE|SL_ERROR,
4449 "tl_data:T_DATA_REQ:invalid message"));
4450 if (!closing) {
4451 tl_merror(wq, mp, EPROTO);
4452 } else {
4453 freemsg(mp);
4454 }
4455 return;
4456 } else if (prim->type == T_OPTDATA_REQ &&
4457 (msz < sizeof (struct T_optdata_req) || !IS_SOCKET(tep))) {
4458 (void) (STRLOG(TL_ID, tep->te_minor, 1,
4459 SL_TRACE|SL_ERROR,
4460 "tl_data:T_OPTDATA_REQ:invalid message"));
4461 if (!closing) {
4462 tl_merror(wq, mp, EPROTO);
4463 } else {
4464 freemsg(mp);
4465 }
4466 return;
4467 }
4468 }
4469
4470 /*
4471 * connection oriented provider
4472 */
4473 switch (tep->te_state) {
4474 case TS_IDLE:
4475 /*
4476 * Other end not here - do nothing.
4477 */
4478 freemsg(mp);
4479 (void) (STRLOG(TL_ID, tep->te_minor, 3, SL_TRACE|SL_ERROR,
4480 "tl_data:cots with endpoint idle"));
4481 return;
4482
4483 case TS_DATA_XFER:
4484 /* valid states */
4485 if (tep->te_conp != NULL)
4486 break;
4487
4488 if (tep->te_oconp == NULL) {
4489 if (!closing) {
4490 tl_merror(wq, mp, EPROTO);
4491 } else {
4492 freemsg(mp);
4493 }
4494 return;
4495 }
4496 /*
4497 * For a socket the T_CONN_CON is sent early thus
4498 * the peer might not yet have accepted the connection.
4499 * If we are closing queue the packet with the T_CONN_IND.
4500 * Otherwise defer processing the packet until the peer
4501 * accepts the connection.
4502 * Note that the queue is noenabled when we go into this
4503 * state.
4504 */
4505 if (!closing) {
4506 (void) (STRLOG(TL_ID, tep->te_minor, 1,
4507 SL_TRACE|SL_ERROR,
4508 "tl_data: ocon"));
4509 TL_PUTBQ(tep, mp);
4510 return;
4511 }
4512 if (DB_TYPE(mp) == M_PROTO) {
4513 if (msz < sizeof (t_scalar_t)) {
4514 freemsg(mp);
4515 return;
4516 }
4517 /* reuse message block - just change REQ to IND */
4518 if (prim->type == T_DATA_REQ)
4519 prim->type = T_DATA_IND;
4520 else
4521 prim->type = T_OPTDATA_IND;
4522 }
4523 tl_icon_queuemsg(tep->te_oconp, tep->te_seqno, mp);
4524 return;
4525
4526 case TS_WREQ_ORDREL:
4527 if (tep->te_conp == NULL) {
4528 /*
4529 * Other end closed - generate discon_ind
4530 * with reason 0 to cause an EPIPE but no
4531 * read side error on AF_UNIX sockets.
4532 */
4533 freemsg(mp);
4534 (void) (STRLOG(TL_ID, tep->te_minor, 3,
4535 SL_TRACE|SL_ERROR,
4536 "tl_data: WREQ_ORDREL and no peer"));
4537 tl_discon_ind(tep, 0);
4538 return;
4539 }
4540 break;
4541
4542 default:
4543 /* invalid state for event TE_DATA_REQ */
4544 (void) (STRLOG(TL_ID, tep->te_minor, 1, SL_TRACE|SL_ERROR,
4545 "tl_data:cots:out of state"));
4546 tl_merror(wq, mp, EPROTO);
4547 return;
4548 }
4549 /*
4550 * tep->te_state = NEXTSTATE(TE_DATA_REQ, tep->te_state);
4551 * (State stays same on this event)
4552 */
4553
4554 /*
4555 * get connected endpoint
4556 */
4557 if (((peer_tep = tep->te_conp) == NULL) || peer_tep->te_closing) {
4558 freemsg(mp);
4559 /* Peer closed */
4560 (void) (STRLOG(TL_ID, tep->te_minor, 3, SL_TRACE,
4561 "tl_data: peer gone"));
4562 return;
4563 }
4564
4565 ASSERT(tep->te_serializer == peer_tep->te_serializer);
4566 peer_rq = peer_tep->te_rq;
4567
4568 /*
4569 * Put it back if flow controlled
4570 * Note: Messages already on queue when we are closing is bounded
4571 * so we can ignore flow control.
4572 */
4573 if (!canputnext(peer_rq) && !closing) {
4574 TL_PUTBQ(tep, mp);
4575 return;
4576 }
4577
4578 /*
4579 * validate peer state
4580 */
4581 switch (peer_tep->te_state) {
4582 case TS_DATA_XFER:
4583 case TS_WIND_ORDREL:
4584 /* valid states */
4585 break;
4586 default:
4587 (void) (STRLOG(TL_ID, tep->te_minor, 1, SL_TRACE|SL_ERROR,
4588 "tl_data:rx side:invalid state"));
4589 tl_merror(peer_tep->te_wq, mp, EPROTO);
4590 return;
4591 }
4592 if (DB_TYPE(mp) == M_PROTO) {
4593 /* reuse message block - just change REQ to IND */
4594 if (prim->type == T_DATA_REQ)
4595 prim->type = T_DATA_IND;
4596 else
4597 prim->type = T_OPTDATA_IND;
4598 }
4599 /*
4600 * peer_tep->te_state = NEXTSTATE(TE_DATA_IND, peer_tep->te_state);
4601 * (peer state stays same on this event)
4602 */
4603 /*
4604 * send data to connected peer
4605 */
4606 putnext(peer_rq, mp);
4607 }
4608
4609
4610
4611 static void
4612 tl_exdata(mblk_t *mp, tl_endpt_t *tep)
4613 {
4614 queue_t *wq = tep->te_wq;
4615 union T_primitives *prim = (union T_primitives *)mp->b_rptr;
4616 ssize_t msz = MBLKL(mp);
4617 tl_endpt_t *peer_tep;
4618 queue_t *peer_rq;
4619 boolean_t closing = tep->te_closing;
4620
4621 if (msz < sizeof (struct T_exdata_req)) {
4622 (void) (STRLOG(TL_ID, tep->te_minor, 1, SL_TRACE|SL_ERROR,
4623 "tl_exdata:invalid message"));
4624 if (!closing) {
4625 tl_merror(wq, mp, EPROTO);
4626 } else {
4627 freemsg(mp);
4628 }
4629 return;
4630 }
4631
4632 /*
4633 * If the endpoint is closing it should still forward any data to the
4634 * peer (if it has one). If it is not allowed to forward it can just
4635 * free the message.
4636 */
4637 if (closing &&
4638 (tep->te_state != TS_DATA_XFER) &&
4639 (tep->te_state != TS_WREQ_ORDREL)) {
4640 freemsg(mp);
4641 return;
4642 }
4643
4644 /*
4645 * validate state
4646 */
4647 switch (tep->te_state) {
4648 case TS_IDLE:
4649 /*
4650 * Other end not here - do nothing.
4651 */
4652 freemsg(mp);
4653 (void) (STRLOG(TL_ID, tep->te_minor, 3, SL_TRACE|SL_ERROR,
4654 "tl_exdata:cots with endpoint idle"));
4655 return;
4656
4657 case TS_DATA_XFER:
4658 /* valid states */
4659 if (tep->te_conp != NULL)
4660 break;
4661
4662 if (tep->te_oconp == NULL) {
4663 if (!closing) {
4664 tl_merror(wq, mp, EPROTO);
4665 } else {
4666 freemsg(mp);
4667 }
4668 return;
4669 }
4670 /*
4671 * For a socket the T_CONN_CON is sent early thus
4672 * the peer might not yet have accepted the connection.
4673 * If we are closing queue the packet with the T_CONN_IND.
4674 * Otherwise defer processing the packet until the peer
4675 * accepts the connection.
4676 * Note that the queue is noenabled when we go into this
4677 * state.
4678 */
4679 if (!closing) {
4680 (void) (STRLOG(TL_ID, tep->te_minor, 1,
4681 SL_TRACE|SL_ERROR,
4682 "tl_exdata: ocon"));
4683 TL_PUTBQ(tep, mp);
4684 return;
4685 }
4686 (void) (STRLOG(TL_ID, tep->te_minor, 1, SL_TRACE|SL_ERROR,
4687 "tl_exdata: closing socket ocon"));
4688 prim->type = T_EXDATA_IND;
4689 tl_icon_queuemsg(tep->te_oconp, tep->te_seqno, mp);
4690 return;
4691
4692 case TS_WREQ_ORDREL:
4693 if (tep->te_conp == NULL) {
4694 /*
4695 * Other end closed - generate discon_ind
4696 * with reason 0 to cause an EPIPE but no
4697 * read side error on AF_UNIX sockets.
4698 */
4699 freemsg(mp);
4700 (void) (STRLOG(TL_ID, tep->te_minor, 3,
4701 SL_TRACE|SL_ERROR,
4702 "tl_exdata: WREQ_ORDREL and no peer"));
4703 tl_discon_ind(tep, 0);
4704 return;
4705 }
4706 break;
4707
4708 default:
4709 (void) (STRLOG(TL_ID, tep->te_minor, 1,
4710 SL_TRACE|SL_ERROR,
4711 "tl_wput:T_EXDATA_REQ:out of state, state=%d",
4712 tep->te_state));
4713 tl_merror(wq, mp, EPROTO);
4714 return;
4715 }
4716 /*
4717 * tep->te_state = NEXTSTATE(TE_EXDATA_REQ, tep->te_state);
4718 * (state stays same on this event)
4719 */
4720
4721 /*
4722 * get connected endpoint
4723 */
4724 if (((peer_tep = tep->te_conp) == NULL) || peer_tep->te_closing) {
4725 freemsg(mp);
4726 /* Peer closed */
4727 (void) (STRLOG(TL_ID, tep->te_minor, 3, SL_TRACE,
4728 "tl_exdata: peer gone"));
4729 return;
4730 }
4731
4732 peer_rq = peer_tep->te_rq;
4733
4734 /*
4735 * Put it back if flow controlled
4736 * Note: Messages already on queue when we are closing is bounded
4737 * so we can ignore flow control.
4738 */
4739 if (!canputnext(peer_rq) && !closing) {
4740 TL_PUTBQ(tep, mp);
4741 return;
4742 }
4743
4744 /*
4745 * validate state on peer
4746 */
4747 switch (peer_tep->te_state) {
4748 case TS_DATA_XFER:
4749 case TS_WIND_ORDREL:
4750 /* valid states */
4751 break;
4752 default:
4753 (void) (STRLOG(TL_ID, tep->te_minor, 1, SL_TRACE|SL_ERROR,
4754 "tl_exdata:rx side:invalid state"));
4755 tl_merror(peer_tep->te_wq, mp, EPROTO);
4756 return;
4757 }
4758 /*
4759 * peer_tep->te_state = NEXTSTATE(TE_DATA_IND, peer_tep->te_state);
4760 * (peer state stays same on this event)
4761 */
4762 /*
4763 * reuse message block
4764 */
4765 prim->type = T_EXDATA_IND;
4766
4767 /*
4768 * send data to connected peer
4769 */
4770 putnext(peer_rq, mp);
4771 }
4772
4773
4774
4775 static void
4776 tl_ordrel(mblk_t *mp, tl_endpt_t *tep)
4777 {
4778 queue_t *wq = tep->te_wq;
4779 union T_primitives *prim = (union T_primitives *)mp->b_rptr;
4780 ssize_t msz = MBLKL(mp);
4781 tl_endpt_t *peer_tep;
4782 queue_t *peer_rq;
4783 boolean_t closing = tep->te_closing;
4784
4785 if (msz < sizeof (struct T_ordrel_req)) {
4786 (void) (STRLOG(TL_ID, tep->te_minor, 1, SL_TRACE|SL_ERROR,
4787 "tl_ordrel:invalid message"));
4788 if (!closing) {
4789 tl_merror(wq, mp, EPROTO);
4790 } else {
4791 freemsg(mp);
4792 }
4793 return;
4794 }
4795
4796 /*
4797 * validate state
4798 */
4799 switch (tep->te_state) {
4800 case TS_DATA_XFER:
4801 case TS_WREQ_ORDREL:
4802 /* valid states */
4803 if (tep->te_conp != NULL)
4804 break;
4805
4806 if (tep->te_oconp == NULL)
4807 break;
4808
4809 /*
4810 * For a socket the T_CONN_CON is sent early thus
4811 * the peer might not yet have accepted the connection.
4812 * If we are closing queue the packet with the T_CONN_IND.
4813 * Otherwise defer processing the packet until the peer
4814 * accepts the connection.
4815 * Note that the queue is noenabled when we go into this
4816 * state.
4817 */
4818 if (!closing) {
4819 (void) (STRLOG(TL_ID, tep->te_minor, 1,
4820 SL_TRACE|SL_ERROR,
4821 "tl_ordlrel: ocon"));
4822 TL_PUTBQ(tep, mp);
4823 return;
4824 }
4825 (void) (STRLOG(TL_ID, tep->te_minor, 1, SL_TRACE|SL_ERROR,
4826 "tl_ordlrel: closing socket ocon"));
4827 prim->type = T_ORDREL_IND;
4828 (void) tl_icon_queuemsg(tep->te_oconp, tep->te_seqno, mp);
4829 return;
4830
4831 default:
4832 (void) (STRLOG(TL_ID, tep->te_minor, 1,
4833 SL_TRACE|SL_ERROR,
4834 "tl_wput:T_ORDREL_REQ:out of state, state=%d",
4835 tep->te_state));
4836 if (!closing) {
4837 tl_merror(wq, mp, EPROTO);
4838 } else {
4839 freemsg(mp);
4840 }
4841 return;
4842 }
4843 tep->te_state = NEXTSTATE(TE_ORDREL_REQ, tep->te_state);
4844
4845 /*
4846 * get connected endpoint
4847 */
4848 if (((peer_tep = tep->te_conp) == NULL) || peer_tep->te_closing) {
4849 /* Peer closed */
4850 (void) (STRLOG(TL_ID, tep->te_minor, 3, SL_TRACE,
4851 "tl_ordrel: peer gone"));
4852 freemsg(mp);
4853 return;
4854 }
4855
4856 peer_rq = peer_tep->te_rq;
4857
4858 /*
4859 * Put it back if flow controlled except when we are closing.
4860 * Note: Messages already on queue when we are closing is bounded
4861 * so we can ignore flow control.
4862 */
4863 if (! canputnext(peer_rq) && !closing) {
4864 TL_PUTBQ(tep, mp);
4865 return;
4866 }
4867
4868 /*
4869 * validate state on peer
4870 */
4871 switch (peer_tep->te_state) {
4872 case TS_DATA_XFER:
4873 case TS_WIND_ORDREL:
4874 /* valid states */
4875 break;
4876 default:
4877 (void) (STRLOG(TL_ID, tep->te_minor, 1, SL_TRACE|SL_ERROR,
4878 "tl_ordrel:rx side:invalid state"));
4879 tl_merror(peer_tep->te_wq, mp, EPROTO);
4880 return;
4881 }
4882 peer_tep->te_state = NEXTSTATE(TE_ORDREL_IND, peer_tep->te_state);
4883
4884 /*
4885 * reuse message block
4886 */
4887 prim->type = T_ORDREL_IND;
4888 (void) (STRLOG(TL_ID, tep->te_minor, 3, SL_TRACE,
4889 "tl_ordrel: send ordrel_ind"));
4890
4891 /*
4892 * send data to connected peer
4893 */
4894 putnext(peer_rq, mp);
4895 }
4896
4897
4898 /*
4899 * Send T_UDERROR_IND. The error should be from the <sys/errno.h> space.
4900 */
4901 static void
4902 tl_uderr(queue_t *wq, mblk_t *mp, t_scalar_t err)
4903 {
4904 size_t err_sz;
4905 tl_endpt_t *tep;
4906 struct T_unitdata_req *udreq;
4907 mblk_t *err_mp;
4908 t_scalar_t alen;
4909 t_scalar_t olen;
4910 struct T_uderror_ind *uderr;
4911 uchar_t *addr_startp;
4912
4913 err_sz = sizeof (struct T_uderror_ind);
4914 tep = (tl_endpt_t *)wq->q_ptr;
4915 udreq = (struct T_unitdata_req *)mp->b_rptr;
4916 alen = udreq->DEST_length;
4917 olen = udreq->OPT_length;
4918
4919 if (alen > 0)
4920 err_sz = T_ALIGN(err_sz + alen);
4921 if (olen > 0)
4922 err_sz += olen;
4923
4924 err_mp = allocb(err_sz, BPRI_MED);
4925 if (! err_mp) {
4926 (void) (STRLOG(TL_ID, tep->te_minor, 3, SL_TRACE|SL_ERROR,
4927 "tl_uderr:allocb failure"));
4928 /*
4929 * Note: no rollback of state needed as it does
4930 * not change in connectionless transport
4931 */
4932 tl_memrecover(wq, mp, err_sz);
4933 return;
4934 }
4935
4936 DB_TYPE(err_mp) = M_PROTO;
4937 err_mp->b_wptr = err_mp->b_rptr + err_sz;
4938 uderr = (struct T_uderror_ind *)err_mp->b_rptr;
4939 uderr->PRIM_type = T_UDERROR_IND;
4940 uderr->ERROR_type = err;
4941 uderr->DEST_length = alen;
4942 uderr->OPT_length = olen;
4943 if (alen <= 0) {
4944 uderr->DEST_offset = 0;
4945 } else {
4946 uderr->DEST_offset =
4947 (t_scalar_t)sizeof (struct T_uderror_ind);
4948 addr_startp = mp->b_rptr + udreq->DEST_offset;
4949 bcopy(addr_startp, err_mp->b_rptr + uderr->DEST_offset,
4950 (size_t)alen);
4951 }
4952 if (olen <= 0) {
4953 uderr->OPT_offset = 0;
4954 } else {
4955 uderr->OPT_offset =
4956 (t_scalar_t)T_ALIGN(sizeof (struct T_uderror_ind) +
4957 uderr->DEST_length);
4958 addr_startp = mp->b_rptr + udreq->OPT_offset;
4959 bcopy(addr_startp, err_mp->b_rptr+uderr->OPT_offset,
4960 (size_t)olen);
4961 }
4962 freemsg(mp);
4963
4964 /*
4965 * send indication message
4966 */
4967 tep->te_state = NEXTSTATE(TE_UDERROR_IND, tep->te_state);
4968
4969 qreply(wq, err_mp);
4970 }
4971
4972 static void
4973 tl_unitdata_ser(mblk_t *mp, tl_endpt_t *tep)
4974 {
4975 queue_t *wq = tep->te_wq;
4976
4977 if (!tep->te_closing && (wq->q_first != NULL)) {
4978 TL_PUTQ(tep, mp);
4979 } else if (tep->te_rq != NULL)
4980 tl_unitdata(mp, tep);
4981 else
4982 freemsg(mp);
4983
4984 tl_serializer_exit(tep);
4985 tl_refrele(tep);
4986 }
4987
4988 /*
4989 * Handle T_unitdata_req.
4990 * If TL_SET[U]CRED or TL_SOCKUCRED generate the credentials options.
4991 * If this is a socket pass through options unmodified.
4992 */
4993 static void
4994 tl_unitdata(mblk_t *mp, tl_endpt_t *tep)
4995 {
4996 queue_t *wq = tep->te_wq;
4997 soux_addr_t ux_addr;
4998 tl_addr_t destaddr;
4999 uchar_t *addr_startp;
5000 tl_endpt_t *peer_tep;
5001 struct T_unitdata_ind *udind;
5002 struct T_unitdata_req *udreq;
5003 ssize_t msz, ui_sz;
5004 t_scalar_t alen, aoff, olen, ooff;
5005 t_scalar_t oldolen = 0;
5006 cred_t *cr = NULL;
5007 pid_t cpid;
5008
5009 udreq = (struct T_unitdata_req *)mp->b_rptr;
5010 msz = MBLKL(mp);
5011
5012 /*
5013 * validate the state
5014 */
5015 if (tep->te_state != TS_IDLE) {
5016 (void) (STRLOG(TL_ID, tep->te_minor, 1,
5017 SL_TRACE|SL_ERROR,
5018 "tl_wput:T_CONN_REQ:out of state"));
5019 tl_merror(wq, mp, EPROTO);
5020 return;
5021 }
5022 /*
5023 * tep->te_state = NEXTSTATE(TE_UNITDATA_REQ, tep->te_state);
5024 * (state does not change on this event)
5025 */
5026
5027 /*
5028 * validate the message
5029 * Note: dereference fields in struct inside message only
5030 * after validating the message length.
5031 */
5032 if (msz < sizeof (struct T_unitdata_req)) {
5033 (void) (STRLOG(TL_ID, tep->te_minor, 1, SL_TRACE|SL_ERROR,
5034 "tl_unitdata:invalid message length"));
5035 tl_merror(wq, mp, EINVAL);
5036 return;
5037 }
5038 alen = udreq->DEST_length;
5039 aoff = udreq->DEST_offset;
5040 oldolen = olen = udreq->OPT_length;
5041 ooff = udreq->OPT_offset;
5042 if (olen == 0)
5043 ooff = 0;
5044
5045 if (IS_SOCKET(tep)) {
5046 if ((alen != TL_SOUX_ADDRLEN) ||
5047 (aoff < 0) ||
5048 (aoff + alen > msz) ||
5049 (olen < 0) || (ooff < 0) ||
5050 ((olen > 0) && ((ooff + olen) > msz))) {
5051 (void) (STRLOG(TL_ID, tep->te_minor,
5052 1, SL_TRACE|SL_ERROR,
5053 "tl_unitdata_req: invalid socket addr "
5054 "(msz=%d, al=%d, ao=%d, ol=%d, oo = %d)",
5055 (int)msz, alen, aoff, olen, ooff));
5056 tl_error_ack(wq, mp, TSYSERR, EINVAL, T_UNITDATA_REQ);
5057 return;
5058 }
5059 bcopy(mp->b_rptr + aoff, &ux_addr, TL_SOUX_ADDRLEN);
5060
5061 if ((ux_addr.soua_magic != SOU_MAGIC_IMPLICIT) &&
5062 (ux_addr.soua_magic != SOU_MAGIC_EXPLICIT)) {
5063 (void) (STRLOG(TL_ID, tep->te_minor,
5064 1, SL_TRACE|SL_ERROR,
5065 "tl_conn_req: invalid socket magic"));
5066 tl_error_ack(wq, mp, TSYSERR, EINVAL, T_UNITDATA_REQ);
5067 return;
5068 }
5069 } else {
5070 if ((alen < 0) ||
5071 (aoff < 0) ||
5072 ((alen > 0) && ((aoff + alen) > msz)) ||
5073 ((ssize_t)alen > (msz - sizeof (struct T_unitdata_req))) ||
5074 ((aoff + alen) < 0) ||
5075 ((olen > 0) && ((ooff + olen) > msz)) ||
5076 (olen < 0) ||
5077 (ooff < 0) ||
5078 ((ssize_t)olen > (msz - sizeof (struct T_unitdata_req)))) {
5079 (void) (STRLOG(TL_ID, tep->te_minor, 1,
5080 SL_TRACE|SL_ERROR,
5081 "tl_unitdata:invalid unit data message"));
5082 tl_merror(wq, mp, EINVAL);
5083 return;
5084 }
5085 }
5086
5087 /* Options not supported unless it's a socket */
5088 if (alen == 0 || (olen != 0 && !IS_SOCKET(tep))) {
5089 (void) (STRLOG(TL_ID, tep->te_minor, 3, SL_TRACE|SL_ERROR,
5090 "tl_unitdata:option use(unsupported) or zero len addr"));
5091 tl_uderr(wq, mp, EPROTO);
5092 return;
5093 }
5094 #ifdef DEBUG
5095 /*
5096 * Mild form of ASSERT()ion to detect broken TPI apps.
5097 * if (! assertion)
5098 * log warning;
5099 */
5100 if (! (aoff >= (t_scalar_t)sizeof (struct T_unitdata_req))) {
5101 (void) (STRLOG(TL_ID, tep->te_minor, 3, SL_TRACE|SL_ERROR,
5102 "tl_unitdata:addr overlaps TPI message"));
5103 }
5104 #endif
5105 /*
5106 * get destination endpoint
5107 */
5108 destaddr.ta_alen = alen;
5109 destaddr.ta_abuf = mp->b_rptr + aoff;
5110 destaddr.ta_zoneid = tep->te_zoneid;
5111
5112 /*
5113 * Check whether the destination is the same that was used previously
5114 * and the destination endpoint is in the right state. If something is
5115 * wrong, find destination again and cache it.
5116 */
5117 peer_tep = tep->te_lastep;
5118
5119 if ((peer_tep == NULL) || peer_tep->te_closing ||
5120 (peer_tep->te_state != TS_IDLE) ||
5121 !tl_eqaddr(&destaddr, &peer_tep->te_ap)) {
5122 /*
5123 * Not the same as cached destination , need to find the right
5124 * destination.
5125 */
5126 peer_tep = (IS_SOCKET(tep) ?
5127 tl_sock_find_peer(tep, &ux_addr) :
5128 tl_find_peer(tep, &destaddr));
5129
5130 if (peer_tep == NULL) {
5131 (void) (STRLOG(TL_ID, tep->te_minor, 3,
5132 SL_TRACE|SL_ERROR,
5133 "tl_unitdata:no one at destination address"));
5134 tl_uderr(wq, mp, ECONNRESET);
5135 return;
5136 }
5137
5138 /*
5139 * Cache the new peer.
5140 */
5141 if (tep->te_lastep != NULL)
5142 tl_refrele(tep->te_lastep);
5143
5144 tep->te_lastep = peer_tep;
5145 }
5146
5147 if (peer_tep->te_state != TS_IDLE) {
5148 (void) (STRLOG(TL_ID, tep->te_minor, 1, SL_TRACE|SL_ERROR,
5149 "tl_unitdata:provider in invalid state"));
5150 tl_uderr(wq, mp, EPROTO);
5151 return;
5152 }
5153
5154 ASSERT(peer_tep->te_rq != NULL);
5155
5156 /*
5157 * Put it back if flow controlled except when we are closing.
5158 * Note: Messages already on queue when we are closing is bounded
5159 * so we can ignore flow control.
5160 */
5161 if (!canputnext(peer_tep->te_rq) && !(tep->te_closing)) {
5162 /* record what we are flow controlled on */
5163 if (tep->te_flowq != NULL) {
5164 list_remove(&tep->te_flowq->te_flowlist, tep);
5165 }
5166 list_insert_head(&peer_tep->te_flowlist, tep);
5167 tep->te_flowq = peer_tep;
5168 TL_PUTBQ(tep, mp);
5169 return;
5170 }
5171 /*
5172 * prepare indication message
5173 */
5174
5175 /*
5176 * calculate length of message
5177 */
5178 if (peer_tep->te_flag & (TL_SETCRED|TL_SETUCRED|TL_SOCKUCRED)) {
5179 cr = msg_getcred(mp, &cpid);
5180 ASSERT(cr != NULL);
5181
5182 if (peer_tep->te_flag & TL_SETCRED) {
5183 ASSERT(olen == 0);
5184 olen = (t_scalar_t)sizeof (struct opthdr) +
5185 OPTLEN(sizeof (tl_credopt_t));
5186 /* 1 option only */
5187 } else if (peer_tep->te_flag & TL_SETUCRED) {
5188 ASSERT(olen == 0);
5189 olen = (t_scalar_t)sizeof (struct opthdr) +
5190 OPTLEN(ucredminsize(cr));
5191 /* 1 option only */
5192 } else {
5193 /* Possibly more than one option */
5194 olen += (t_scalar_t)sizeof (struct T_opthdr) +
5195 OPTLEN(ucredminsize(cr));
5196 }
5197 }
5198
5199 ui_sz = T_ALIGN(sizeof (struct T_unitdata_ind) + tep->te_alen) +
5200 olen;
5201 /*
5202 * If the unitdata_ind fits and we are not adding options
5203 * reuse the udreq mblk.
5204 */
5205 if (msz >= ui_sz && alen >= tep->te_alen &&
5206 !(peer_tep->te_flag & (TL_SETCRED|TL_SETUCRED|TL_SOCKUCRED))) {
5207 /*
5208 * Reuse the original mblk. Leave options in place.
5209 */
5210 udind = (struct T_unitdata_ind *)mp->b_rptr;
5211 udind->PRIM_type = T_UNITDATA_IND;
5212 udind->SRC_length = tep->te_alen;
5213 addr_startp = mp->b_rptr + udind->SRC_offset;
5214 bcopy(tep->te_abuf, addr_startp, tep->te_alen);
5215 } else {
5216 /* Allocate a new T_unidata_ind message */
5217 mblk_t *ui_mp;
5218
5219 ui_mp = allocb(ui_sz, BPRI_MED);
5220 if (! ui_mp) {
5221 (void) (STRLOG(TL_ID, tep->te_minor, 4, SL_TRACE,
5222 "tl_unitdata:allocb failure:message queued"));
5223 tl_memrecover(wq, mp, ui_sz);
5224 return;
5225 }
5226
5227 /*
5228 * fill in T_UNITDATA_IND contents
5229 */
5230 DB_TYPE(ui_mp) = M_PROTO;
5231 ui_mp->b_wptr = ui_mp->b_rptr + ui_sz;
5232 udind = (struct T_unitdata_ind *)ui_mp->b_rptr;
5233 udind->PRIM_type = T_UNITDATA_IND;
5234 udind->SRC_offset = (t_scalar_t)sizeof (struct T_unitdata_ind);
5235 udind->SRC_length = tep->te_alen;
5236 addr_startp = ui_mp->b_rptr + udind->SRC_offset;
5237 bcopy(tep->te_abuf, addr_startp, tep->te_alen);
5238 udind->OPT_offset =
5239 (t_scalar_t)T_ALIGN(udind->SRC_offset + udind->SRC_length);
5240 udind->OPT_length = olen;
5241 if (peer_tep->te_flag & (TL_SETCRED|TL_SETUCRED|TL_SOCKUCRED)) {
5242
5243 if (oldolen != 0) {
5244 bcopy((void *)((uintptr_t)udreq + ooff),
5245 (void *)((uintptr_t)udind +
5246 udind->OPT_offset),
5247 oldolen);
5248 }
5249 ASSERT(cr != NULL);
5250
5251 tl_fill_option(ui_mp->b_rptr + udind->OPT_offset +
5252 oldolen, cr, cpid,
5253 peer_tep->te_flag, peer_tep->te_credp);
5254 } else {
5255 bcopy((void *)((uintptr_t)udreq + ooff),
5256 (void *)((uintptr_t)udind + udind->OPT_offset),
5257 olen);
5258 }
5259
5260 /*
5261 * relink data blocks from mp to ui_mp
5262 */
5263 ui_mp->b_cont = mp->b_cont;
5264 freeb(mp);
5265 mp = ui_mp;
5266 }
5267 /*
5268 * send indication message
5269 */
5270 peer_tep->te_state = NEXTSTATE(TE_UNITDATA_IND, peer_tep->te_state);
5271 putnext(peer_tep->te_rq, mp);
5272 }
5273
5274
5275
5276 /*
5277 * Check if a given addr is in use.
5278 * Endpoint ptr returned or NULL if not found.
5279 * The name space is separate for each mode. This implies that
5280 * sockets get their own name space.
5281 */
5282 static tl_endpt_t *
5283 tl_find_peer(tl_endpt_t *tep, tl_addr_t *ap)
5284 {
5285 tl_endpt_t *peer_tep = NULL;
5286 int rc = mod_hash_find_cb(tep->te_addrhash, (mod_hash_key_t)ap,
5287 (mod_hash_val_t *)&peer_tep, tl_find_callback);
5288
5289 ASSERT(! IS_SOCKET(tep));
5290
5291 ASSERT(ap != NULL && ap->ta_alen > 0);
5292 ASSERT(ap->ta_zoneid == tep->te_zoneid);
5293 ASSERT(ap->ta_abuf != NULL);
5294 EQUIV(rc == 0, peer_tep != NULL);
5295 IMPLY(rc == 0,
5296 (tep->te_zoneid == peer_tep->te_zoneid) &&
5297 (tep->te_transport == peer_tep->te_transport));
5298
5299 if ((rc == 0) && (peer_tep->te_closing)) {
5300 tl_refrele(peer_tep);
5301 peer_tep = NULL;
5302 }
5303
5304 return (peer_tep);
5305 }
5306
5307 /*
5308 * Find peer for a socket based on unix domain address.
5309 * For implicit addresses our peer can be found by minor number in ai hash. For
5310 * explicit binds we look vnode address at addr_hash.
5311 */
5312 static tl_endpt_t *
5313 tl_sock_find_peer(tl_endpt_t *tep, soux_addr_t *ux_addr)
5314 {
5315 tl_endpt_t *peer_tep = NULL;
5316 mod_hash_t *hash = ux_addr->soua_magic == SOU_MAGIC_IMPLICIT ?
5317 tep->te_aihash : tep->te_addrhash;
5318 int rc = mod_hash_find_cb(hash, (mod_hash_key_t)ux_addr->soua_vp,
5319 (mod_hash_val_t *)&peer_tep, tl_find_callback);
5320
5321 ASSERT(IS_SOCKET(tep));
5322 EQUIV(rc == 0, peer_tep != NULL);
5323 IMPLY(rc == 0, (tep->te_transport == peer_tep->te_transport));
5324
5325 if (peer_tep != NULL) {
5326 /* Don't attempt to use closing peer. */
5327 if (peer_tep->te_closing)
5328 goto errout;
5329
5330 /*
5331 * Cross-zone unix sockets are permitted, but for Trusted
5332 * Extensions only, the "server" for these must be in the
5333 * global zone.
5334 */
5335 if ((peer_tep->te_zoneid != tep->te_zoneid) &&
5336 is_system_labeled() &&
5337 (peer_tep->te_zoneid != GLOBAL_ZONEID))
5338 goto errout;
5339 }
5340
5341 return (peer_tep);
5342
5343 errout:
5344 tl_refrele(peer_tep);
5345 return (NULL);
5346 }
5347
5348 /*
5349 * Generate a free addr and return it in struct pointed by ap
5350 * but allocating space for address buffer.
5351 * The generated address will be at least 4 bytes long and, if req->ta_alen
5352 * exceeds 4 bytes, be req->ta_alen bytes long.
5353 *
5354 * If address is found it will be inserted in the hash.
5355 *
5356 * If req->ta_alen is larger than the default alen (4 bytes) the last
5357 * alen-4 bytes will always be the same as in req.
5358 *
5359 * Return 0 for failure.
5360 * Return non-zero for success.
5361 */
5362 static boolean_t
5363 tl_get_any_addr(tl_endpt_t *tep, tl_addr_t *req)
5364 {
5365 t_scalar_t alen;
5366 uint32_t loopcnt; /* Limit loop to 2^32 */
5367
5368 ASSERT(tep->te_hash_hndl != NULL);
5369 ASSERT(! IS_SOCKET(tep));
5370
5371 if (tep->te_hash_hndl == NULL)
5372 return (B_FALSE);
5373
5374 /*
5375 * check if default addr is in use
5376 * if it is - bump it and try again
5377 */
5378 if (req == NULL) {
5379 alen = sizeof (uint32_t);
5380 } else {
5381 alen = max(req->ta_alen, sizeof (uint32_t));
5382 ASSERT(tep->te_zoneid == req->ta_zoneid);
5383 }
5384
5385 if (tep->te_alen < alen) {
5386 void *abuf = kmem_zalloc((size_t)alen, KM_NOSLEEP);
5387
5388 /*
5389 * Not enough space in tep->ta_ap to hold the address,
5390 * allocate a bigger space.
5391 */
5392 if (abuf == NULL)
5393 return (B_FALSE);
5394
5395 if (tep->te_alen > 0)
5396 kmem_free(tep->te_abuf, tep->te_alen);
5397
5398 tep->te_alen = alen;
5399 tep->te_abuf = abuf;
5400 }
5401
5402 /* Copy in the address in req */
5403 if (req != NULL) {
5404 ASSERT(alen >= req->ta_alen);
5405 bcopy(req->ta_abuf, tep->te_abuf, (size_t)req->ta_alen);
5406 }
5407
5408 /*
5409 * First try minor number then try default addresses.
5410 */
5411 bcopy(&tep->te_minor, tep->te_abuf, sizeof (uint32_t));
5412
5413 for (loopcnt = 0; loopcnt < UINT32_MAX; loopcnt++) {
5414 if (mod_hash_insert_reserve(tep->te_addrhash,
5415 (mod_hash_key_t)&tep->te_ap, (mod_hash_val_t)tep,
5416 tep->te_hash_hndl) == 0) {
5417 /*
5418 * found free address
5419 */
5420 tep->te_flag |= TL_ADDRHASHED;
5421 tep->te_hash_hndl = NULL;
5422
5423 return (B_TRUE); /* successful return */
5424 }
5425 /*
5426 * Use default address.
5427 */
5428 bcopy(&tep->te_defaddr, tep->te_abuf, sizeof (uint32_t));
5429 atomic_add_32(&tep->te_defaddr, 1);
5430 }
5431
5432 /*
5433 * Failed to find anything.
5434 */
5435 (void) (STRLOG(TL_ID, -1, 1, SL_ERROR,
5436 "tl_get_any_addr:looped 2^32 times"));
5437 return (B_FALSE);
5438 }
5439
5440 /*
5441 * reallocb + set r/w ptrs to reflect size.
5442 */
5443 static mblk_t *
5444 tl_resizemp(mblk_t *mp, ssize_t new_size)
5445 {
5446 if ((mp = reallocb(mp, new_size, 0)) == NULL)
5447 return (NULL);
5448
5449 mp->b_rptr = DB_BASE(mp);
5450 mp->b_wptr = mp->b_rptr + new_size;
5451 return (mp);
5452 }
5453
5454 static void
5455 tl_cl_backenable(tl_endpt_t *tep)
5456 {
5457 list_t *l = &tep->te_flowlist;
5458 tl_endpt_t *elp;
5459
5460 ASSERT(IS_CLTS(tep));
5461
5462 for (elp = list_head(l); elp != NULL; elp = list_head(l)) {
5463 ASSERT(tep->te_ser == elp->te_ser);
5464 ASSERT(elp->te_flowq == tep);
5465 if (! elp->te_closing)
5466 TL_QENABLE(elp);
5467 elp->te_flowq = NULL;
5468 list_remove(l, elp);
5469 }
5470 }
5471
5472 /*
5473 * Unconnect endpoints.
5474 */
5475 static void
5476 tl_co_unconnect(tl_endpt_t *tep)
5477 {
5478 tl_endpt_t *peer_tep = tep->te_conp;
5479 tl_endpt_t *srv_tep = tep->te_oconp;
5480 list_t *l;
5481 tl_icon_t *tip;
5482 tl_endpt_t *cl_tep;
5483 mblk_t *d_mp;
5484
5485 ASSERT(IS_COTS(tep));
5486 /*
5487 * If our peer is closing, don't use it.
5488 */
5489 if ((peer_tep != NULL) && peer_tep->te_closing) {
5490 TL_UNCONNECT(tep->te_conp);
5491 peer_tep = NULL;
5492 }
5493 if ((srv_tep != NULL) && srv_tep->te_closing) {
5494 TL_UNCONNECT(tep->te_oconp);
5495 srv_tep = NULL;
5496 }
5497
5498 if (tep->te_nicon > 0) {
5499 l = &tep->te_iconp;
5500 /*
5501 * If incoming requests pending, change state
5502 * of clients on disconnect ind event and send
5503 * discon_ind pdu to modules above them
5504 * for server: all clients get disconnect
5505 */
5506
5507 while (tep->te_nicon > 0) {
5508 tip = list_head(l);
5509 cl_tep = tip->ti_tep;
5510
5511 if (cl_tep == NULL) {
5512 tl_freetip(tep, tip);
5513 continue;
5514 }
5515
5516 if (cl_tep->te_oconp != NULL) {
5517 ASSERT(cl_tep != cl_tep->te_oconp);
5518 TL_UNCONNECT(cl_tep->te_oconp);
5519 }
5520
5521 if (cl_tep->te_closing) {
5522 tl_freetip(tep, tip);
5523 continue;
5524 }
5525
5526 enableok(cl_tep->te_wq);
5527 TL_QENABLE(cl_tep);
5528 d_mp = tl_discon_ind_alloc(ECONNREFUSED, BADSEQNUM);
5529 if (d_mp != NULL) {
5530 cl_tep->te_state = TS_IDLE;
5531 putnext(cl_tep->te_rq, d_mp);
5532 } else {
5533 (void) (STRLOG(TL_ID, tep->te_minor, 3,
5534 SL_TRACE|SL_ERROR,
5535 "tl_co_unconnect:icmng: "
5536 "allocb failure"));
5537 }
5538 tl_freetip(tep, tip);
5539 }
5540 } else if (srv_tep != NULL) {
5541 /*
5542 * If outgoing request pending, change state
5543 * of server on discon ind event
5544 */
5545
5546 if (IS_SOCKET(tep) && !tl_disable_early_connect &&
5547 IS_COTSORD(srv_tep) &&
5548 !tl_icon_hasprim(srv_tep, tep->te_seqno, T_ORDREL_IND)) {
5549 /*
5550 * Queue ordrel_ind for server to be picked up
5551 * when the connection is accepted.
5552 */
5553 d_mp = tl_ordrel_ind_alloc();
5554 } else {
5555 /*
5556 * send discon_ind to server
5557 */
5558 d_mp = tl_discon_ind_alloc(ECONNRESET, tep->te_seqno);
5559 }
5560 if (d_mp == NULL) {
5561 (void) (STRLOG(TL_ID, tep->te_minor, 3,
5562 SL_TRACE|SL_ERROR,
5563 "tl_co_unconnect:outgoing:allocb failure"));
5564 TL_UNCONNECT(tep->te_oconp);
5565 goto discon_peer;
5566 }
5567
5568 /*
5569 * If this is a socket the T_DISCON_IND is queued with
5570 * the T_CONN_IND. Otherwise the T_CONN_IND is removed
5571 * from the list of pending connections.
5572 * Note that when te_oconp is set the peer better have
5573 * a t_connind_t for the client.
5574 */
5575 if (IS_SOCKET(tep) && !tl_disable_early_connect) {
5576 /*
5577 * Queue the disconnection message.
5578 */
5579 tl_icon_queuemsg(srv_tep, tep->te_seqno, d_mp);
5580 } else {
5581 tip = tl_icon_find(srv_tep, tep->te_seqno);
5582 if (tip == NULL) {
5583 freemsg(d_mp);
5584 } else {
5585 ASSERT(tep == tip->ti_tep);
5586 ASSERT(tep->te_ser == srv_tep->te_ser);
5587 /*
5588 * Delete tip from the server list.
5589 */
5590 if (srv_tep->te_nicon == 1) {
5591 srv_tep->te_state =
5592 NEXTSTATE(TE_DISCON_IND2,
5593 srv_tep->te_state);
5594 } else {
5595 srv_tep->te_state =
5596 NEXTSTATE(TE_DISCON_IND3,
5597 srv_tep->te_state);
5598 }
5599 ASSERT(*(uint32_t *)(d_mp->b_rptr) ==
5600 T_DISCON_IND);
5601 putnext(srv_tep->te_rq, d_mp);
5602 tl_freetip(srv_tep, tip);
5603 }
5604 TL_UNCONNECT(tep->te_oconp);
5605 srv_tep = NULL;
5606 }
5607 } else if (peer_tep != NULL) {
5608 /*
5609 * unconnect existing connection
5610 * If connected, change state of peer on
5611 * discon ind event and send discon ind pdu
5612 * to module above it
5613 */
5614
5615 ASSERT(tep->te_ser == peer_tep->te_ser);
5616 if (IS_COTSORD(peer_tep) &&
5617 (peer_tep->te_state == TS_WIND_ORDREL ||
5618 peer_tep->te_state == TS_DATA_XFER)) {
5619 /*
5620 * send ordrel ind
5621 */
5622 (void) (STRLOG(TL_ID, tep->te_minor, 3, SL_TRACE,
5623 "tl_co_unconnect:connected: ordrel_ind state %d->%d",
5624 peer_tep->te_state,
5625 NEXTSTATE(TE_ORDREL_IND, peer_tep->te_state)));
5626 d_mp = tl_ordrel_ind_alloc();
5627 if (! d_mp) {
5628 (void) (STRLOG(TL_ID, tep->te_minor, 3,
5629 SL_TRACE|SL_ERROR,
5630 "tl_co_unconnect:connected:"
5631 "allocb failure"));
5632 /*
5633 * Continue with cleaning up peer as
5634 * this side may go away with the close
5635 */
5636 TL_QENABLE(peer_tep);
5637 goto discon_peer;
5638 }
5639 peer_tep->te_state =
5640 NEXTSTATE(TE_ORDREL_IND, peer_tep->te_state);
5641
5642 putnext(peer_tep->te_rq, d_mp);
5643 /*
5644 * Handle flow control case. This will generate
5645 * a t_discon_ind message with reason 0 if there
5646 * is data queued on the write side.
5647 */
5648 TL_QENABLE(peer_tep);
5649 } else if (IS_COTSORD(peer_tep) &&
5650 peer_tep->te_state == TS_WREQ_ORDREL) {
5651 /*
5652 * Sent an ordrel_ind. We send a discon with
5653 * with error 0 to inform that the peer is gone.
5654 */
5655 (void) (STRLOG(TL_ID, tep->te_minor, 3,
5656 SL_TRACE|SL_ERROR,
5657 "tl_co_unconnect: discon in state %d",
5658 tep->te_state));
5659 tl_discon_ind(peer_tep, 0);
5660 } else {
5661 (void) (STRLOG(TL_ID, tep->te_minor, 3,
5662 SL_TRACE|SL_ERROR,
5663 "tl_co_unconnect: state %d", tep->te_state));
5664 tl_discon_ind(peer_tep, ECONNRESET);
5665 }
5666
5667 discon_peer:
5668 /*
5669 * Disconnect cross-pointers only for close
5670 */
5671 if (tep->te_closing) {
5672 peer_tep = tep->te_conp;
5673 TL_REMOVE_PEER(peer_tep->te_conp);
5674 TL_REMOVE_PEER(tep->te_conp);
5675 }
5676 }
5677 }
5678
5679 /*
5680 * Note: The following routine does not recover from allocb()
5681 * failures
5682 * The reason should be from the <sys/errno.h> space.
5683 */
5684 static void
5685 tl_discon_ind(tl_endpt_t *tep, uint32_t reason)
5686 {
5687 mblk_t *d_mp;
5688
5689 if (tep->te_closing)
5690 return;
5691
5692 /*
5693 * flush the queues.
5694 */
5695 flushq(tep->te_rq, FLUSHDATA);
5696 (void) putnextctl1(tep->te_rq, M_FLUSH, FLUSHRW);
5697
5698 /*
5699 * send discon ind
5700 */
5701 d_mp = tl_discon_ind_alloc(reason, tep->te_seqno);
5702 if (! d_mp) {
5703 (void) (STRLOG(TL_ID, tep->te_minor, 3, SL_TRACE|SL_ERROR,
5704 "tl_discon_ind:allocb failure"));
5705 return;
5706 }
5707 tep->te_state = TS_IDLE;
5708 putnext(tep->te_rq, d_mp);
5709 }
5710
5711 /*
5712 * Note: The following routine does not recover from allocb()
5713 * failures
5714 * The reason should be from the <sys/errno.h> space.
5715 */
5716 static mblk_t *
5717 tl_discon_ind_alloc(uint32_t reason, t_scalar_t seqnum)
5718 {
5719 mblk_t *mp;
5720 struct T_discon_ind *tdi;
5721
5722 if (mp = allocb(sizeof (struct T_discon_ind), BPRI_MED)) {
5723 DB_TYPE(mp) = M_PROTO;
5724 mp->b_wptr = mp->b_rptr + sizeof (struct T_discon_ind);
5725 tdi = (struct T_discon_ind *)mp->b_rptr;
5726 tdi->PRIM_type = T_DISCON_IND;
5727 tdi->DISCON_reason = reason;
5728 tdi->SEQ_number = seqnum;
5729 }
5730 return (mp);
5731 }
5732
5733
5734 /*
5735 * Note: The following routine does not recover from allocb()
5736 * failures
5737 */
5738 static mblk_t *
5739 tl_ordrel_ind_alloc(void)
5740 {
5741 mblk_t *mp;
5742 struct T_ordrel_ind *toi;
5743
5744 if (mp = allocb(sizeof (struct T_ordrel_ind), BPRI_MED)) {
5745 DB_TYPE(mp) = M_PROTO;
5746 mp->b_wptr = mp->b_rptr + sizeof (struct T_ordrel_ind);
5747 toi = (struct T_ordrel_ind *)mp->b_rptr;
5748 toi->PRIM_type = T_ORDREL_IND;
5749 }
5750 return (mp);
5751 }
5752
5753
5754 /*
5755 * Lookup the seqno in the list of queued connections.
5756 */
5757 static tl_icon_t *
5758 tl_icon_find(tl_endpt_t *tep, t_scalar_t seqno)
5759 {
5760 list_t *l = &tep->te_iconp;
5761 tl_icon_t *tip = list_head(l);
5762
5763 ASSERT(seqno != 0);
5764
5765 for (; tip != NULL && (tip->ti_seqno != seqno); tip = list_next(l, tip))
5766 ;
5767
5768 return (tip);
5769 }
5770
5771 /*
5772 * Queue data for a given T_CONN_IND while verifying that redundant
5773 * messages, such as a T_ORDREL_IND after a T_DISCON_IND, are not queued.
5774 * Used when the originator of the connection closes.
5775 */
5776 static void
5777 tl_icon_queuemsg(tl_endpt_t *tep, t_scalar_t seqno, mblk_t *nmp)
5778 {
5779 tl_icon_t *tip;
5780 mblk_t **mpp, *mp;
5781 int prim, nprim;
5782
5783 if (nmp->b_datap->db_type == M_PROTO)
5784 nprim = ((union T_primitives *)nmp->b_rptr)->type;
5785 else
5786 nprim = -1; /* M_DATA */
5787
5788 tip = tl_icon_find(tep, seqno);
5789 if (tip == NULL) {
5790 freemsg(nmp);
5791 return;
5792 }
5793
5794 ASSERT(tip->ti_seqno != 0);
5795 mpp = &tip->ti_mp;
5796 while (*mpp != NULL) {
5797 mp = *mpp;
5798
5799 if (mp->b_datap->db_type == M_PROTO)
5800 prim = ((union T_primitives *)mp->b_rptr)->type;
5801 else
5802 prim = -1; /* M_DATA */
5803
5804 /*
5805 * Allow nothing after a T_DISCON_IND
5806 */
5807 if (prim == T_DISCON_IND) {
5808 freemsg(nmp);
5809 return;
5810 }
5811 /*
5812 * Only allow a T_DISCON_IND after an T_ORDREL_IND
5813 */
5814 if (prim == T_ORDREL_IND && nprim != T_DISCON_IND) {
5815 freemsg(nmp);
5816 return;
5817 }
5818 mpp = &(mp->b_next);
5819 }
5820 *mpp = nmp;
5821 }
5822
5823 /*
5824 * Verify if a certain TPI primitive exists on the connind queue.
5825 * Use prim -1 for M_DATA.
5826 * Return non-zero if found.
5827 */
5828 static boolean_t
5829 tl_icon_hasprim(tl_endpt_t *tep, t_scalar_t seqno, t_scalar_t prim)
5830 {
5831 tl_icon_t *tip = tl_icon_find(tep, seqno);
5832 boolean_t found = B_FALSE;
5833
5834 if (tip != NULL) {
5835 mblk_t *mp;
5836 for (mp = tip->ti_mp; !found && mp != NULL; mp = mp->b_next) {
5837 found = (DB_TYPE(mp) == M_PROTO &&
5838 ((union T_primitives *)mp->b_rptr)->type == prim);
5839 }
5840 }
5841 return (found);
5842 }
5843
5844 /*
5845 * Send the b_next mblk chain that has accumulated before the connection
5846 * was accepted. Perform the necessary state transitions.
5847 */
5848 static void
5849 tl_icon_sendmsgs(tl_endpt_t *tep, mblk_t **mpp)
5850 {
5851 mblk_t *mp;
5852 union T_primitives *primp;
5853
5854 if (tep->te_closing) {
5855 tl_icon_freemsgs(mpp);
5856 return;
5857 }
5858
5859 ASSERT(tep->te_state == TS_DATA_XFER);
5860 ASSERT(tep->te_rq->q_first == NULL);
5861
5862 while ((mp = *mpp) != NULL) {
5863 *mpp = mp->b_next;
5864 mp->b_next = NULL;
5865
5866 ASSERT((DB_TYPE(mp) == M_DATA) || (DB_TYPE(mp) == M_PROTO));
5867 switch (DB_TYPE(mp)) {
5868 default:
5869 freemsg(mp);
5870 break;
5871 case M_DATA:
5872 putnext(tep->te_rq, mp);
5873 break;
5874 case M_PROTO:
5875 primp = (union T_primitives *)mp->b_rptr;
5876 switch (primp->type) {
5877 case T_UNITDATA_IND:
5878 case T_DATA_IND:
5879 case T_OPTDATA_IND:
5880 case T_EXDATA_IND:
5881 putnext(tep->te_rq, mp);
5882 break;
5883 case T_ORDREL_IND:
5884 tep->te_state = NEXTSTATE(TE_ORDREL_IND,
5885 tep->te_state);
5886 putnext(tep->te_rq, mp);
5887 break;
5888 case T_DISCON_IND:
5889 tep->te_state = TS_IDLE;
5890 putnext(tep->te_rq, mp);
5891 break;
5892 default:
5893 #ifdef DEBUG
5894 cmn_err(CE_PANIC,
5895 "tl_icon_sendmsgs: unknown primitive");
5896 #endif /* DEBUG */
5897 freemsg(mp);
5898 break;
5899 }
5900 break;
5901 }
5902 }
5903 }
5904
5905 /*
5906 * Free the b_next mblk chain that has accumulated before the connection
5907 * was accepted.
5908 */
5909 static void
5910 tl_icon_freemsgs(mblk_t **mpp)
5911 {
5912 mblk_t *mp;
5913
5914 while ((mp = *mpp) != NULL) {
5915 *mpp = mp->b_next;
5916 mp->b_next = NULL;
5917 freemsg(mp);
5918 }
5919 }
5920
5921 /*
5922 * Send M_ERROR
5923 * Note: assumes caller ensured enough space in mp or enough
5924 * memory available. Does not attempt recovery from allocb()
5925 * failures
5926 */
5927
5928 static void
5929 tl_merror(queue_t *wq, mblk_t *mp, int error)
5930 {
5931 tl_endpt_t *tep = (tl_endpt_t *)wq->q_ptr;
5932
5933 if (tep->te_closing) {
5934 freemsg(mp);
5935 return;
5936 }
5937
5938 (void) (STRLOG(TL_ID, tep->te_minor, 1,
5939 SL_TRACE|SL_ERROR,
5940 "tl_merror: tep=%p, err=%d", (void *)tep, error));
5941
5942 /*
5943 * flush all messages on queue. we are shutting
5944 * the stream down on fatal error
5945 */
5946 flushq(wq, FLUSHALL);
5947 if (IS_COTS(tep)) {
5948 /* connection oriented - unconnect endpoints */
5949 tl_co_unconnect(tep);
5950 }
5951 if (mp->b_cont) {
5952 freemsg(mp->b_cont);
5953 mp->b_cont = NULL;
5954 }
5955
5956 if ((MBLKSIZE(mp) < 1) || (DB_REF(mp) > 1)) {
5957 freemsg(mp);
5958 mp = allocb(1, BPRI_HI);
5959 if (!mp) {
5960 (void) (STRLOG(TL_ID, tep->te_minor, 1,
5961 SL_TRACE|SL_ERROR,
5962 "tl_merror:M_PROTO: out of memory"));
5963 return;
5964 }
5965 }
5966 if (mp) {
5967 DB_TYPE(mp) = M_ERROR;
5968 mp->b_rptr = DB_BASE(mp);
5969 *mp->b_rptr = (char)error;
5970 mp->b_wptr = mp->b_rptr + sizeof (char);
5971 qreply(wq, mp);
5972 } else {
5973 (void) putnextctl1(tep->te_rq, M_ERROR, error);
5974 }
5975 }
5976
5977 static void
5978 tl_fill_option(uchar_t *buf, cred_t *cr, pid_t cpid, int flag, cred_t *pcr)
5979 {
5980 ASSERT(cr != NULL);
5981
5982 if (flag & TL_SETCRED) {
5983 struct opthdr *opt = (struct opthdr *)buf;
5984 tl_credopt_t *tlcred;
5985
5986 opt->level = TL_PROT_LEVEL;
5987 opt->name = TL_OPT_PEER_CRED;
5988 opt->len = (t_uscalar_t)OPTLEN(sizeof (tl_credopt_t));
5989
5990 tlcred = (tl_credopt_t *)(opt + 1);
5991 tlcred->tc_uid = crgetuid(cr);
5992 tlcred->tc_gid = crgetgid(cr);
5993 tlcred->tc_ruid = crgetruid(cr);
5994 tlcred->tc_rgid = crgetrgid(cr);
5995 tlcred->tc_suid = crgetsuid(cr);
5996 tlcred->tc_sgid = crgetsgid(cr);
5997 tlcred->tc_ngroups = crgetngroups(cr);
5998 } else if (flag & TL_SETUCRED) {
5999 struct opthdr *opt = (struct opthdr *)buf;
6000
6001 opt->level = TL_PROT_LEVEL;
6002 opt->name = TL_OPT_PEER_UCRED;
6003 opt->len = (t_uscalar_t)OPTLEN(ucredminsize(cr));
6004
6005 (void) cred2ucred(cr, cpid, (void *)(opt + 1), pcr);
6006 } else {
6007 struct T_opthdr *topt = (struct T_opthdr *)buf;
6008 ASSERT(flag & TL_SOCKUCRED);
6009
6010 topt->level = SOL_SOCKET;
6011 topt->name = SCM_UCRED;
6012 topt->len = ucredminsize(cr) + sizeof (*topt);
6013 topt->status = 0;
6014 (void) cred2ucred(cr, cpid, (void *)(topt + 1), pcr);
6015 }
6016 }
6017
6018 /* ARGSUSED */
6019 static int
6020 tl_default_opt(queue_t *wq, int level, int name, uchar_t *ptr)
6021 {
6022 /* no default value processed in protocol specific code currently */
6023 return (-1);
6024 }
6025
6026 /* ARGSUSED */
6027 static int
6028 tl_get_opt(queue_t *wq, int level, int name, uchar_t *ptr)
6029 {
6030 int len;
6031 tl_endpt_t *tep;
6032 int *valp;
6033
6034 tep = (tl_endpt_t *)wq->q_ptr;
6035
6036 len = 0;
6037
6038 /*
6039 * Assumes: option level and name sanity check done elsewhere
6040 */
6041
6042 switch (level) {
6043 case SOL_SOCKET:
6044 if (! IS_SOCKET(tep))
6045 break;
6046 switch (name) {
6047 case SO_RECVUCRED:
6048 len = sizeof (int);
6049 valp = (int *)ptr;
6050 *valp = (tep->te_flag & TL_SOCKUCRED) != 0;
6051 break;
6052 default:
6053 break;
6054 }
6055 break;
6056 case TL_PROT_LEVEL:
6057 switch (name) {
6058 case TL_OPT_PEER_CRED:
6059 case TL_OPT_PEER_UCRED:
6060 /*
6061 * option not supposed to retrieved directly
6062 * Only sent in T_CON_{IND,CON}, T_UNITDATA_IND
6063 * when some internal flags set by other options
6064 * Direct retrieval always designed to fail(ignored)
6065 * for this option.
6066 */
6067 break;
6068 }
6069 }
6070 return (len);
6071 }
6072
6073 /* ARGSUSED */
6074 static int
6075 tl_set_opt(
6076 queue_t *wq,
6077 uint_t mgmt_flags,
6078 int level,
6079 int name,
6080 uint_t inlen,
6081 uchar_t *invalp,
6082 uint_t *outlenp,
6083 uchar_t *outvalp,
6084 void *thisdg_attrs,
6085 cred_t *cr)
6086 {
6087 int error;
6088 tl_endpt_t *tep;
6089
6090 tep = (tl_endpt_t *)wq->q_ptr;
6091
6092 error = 0; /* NOERROR */
6093
6094 /*
6095 * Assumes: option level and name sanity checks done elsewhere
6096 */
6097
6098 switch (level) {
6099 case SOL_SOCKET:
6100 if (! IS_SOCKET(tep)) {
6101 error = EINVAL;
6102 break;
6103 }
6104 /*
6105 * TBD: fill in other AF_UNIX socket options and then stop
6106 * returning error.
6107 */
6108 switch (name) {
6109 case SO_RECVUCRED:
6110 /*
6111 * We only support this for datagram sockets;
6112 * getpeerucred handles the connection oriented
6113 * transports.
6114 */
6115 if (! IS_CLTS(tep)) {
6116 error = EINVAL;
6117 break;
6118 }
6119 if (*(int *)invalp == 0)
6120 tep->te_flag &= ~TL_SOCKUCRED;
6121 else
6122 tep->te_flag |= TL_SOCKUCRED;
6123 break;
6124 default:
6125 error = EINVAL;
6126 break;
6127 }
6128 break;
6129 case TL_PROT_LEVEL:
6130 switch (name) {
6131 case TL_OPT_PEER_CRED:
6132 case TL_OPT_PEER_UCRED:
6133 /*
6134 * option not supposed to be set directly
6135 * Its value in initialized for each endpoint at
6136 * driver open time.
6137 * Direct setting always designed to fail for this
6138 * option.
6139 */
6140 (void) (STRLOG(TL_ID, tep->te_minor, 1,
6141 SL_TRACE|SL_ERROR,
6142 "tl_set_opt: option is not supported"));
6143 error = EPROTO;
6144 break;
6145 }
6146 }
6147 return (error);
6148 }
6149
6150
6151 static void
6152 tl_timer(void *arg)
6153 {
6154 queue_t *wq = arg;
6155 tl_endpt_t *tep = (tl_endpt_t *)wq->q_ptr;
6156
6157 ASSERT(tep);
6158
6159 tep->te_timoutid = 0;
6160
6161 enableok(wq);
6162 /*
6163 * Note: can call wsrv directly here and save context switch
6164 * Consider change when qtimeout (not timeout) is active
6165 */
6166 qenable(wq);
6167 }
6168
6169 static void
6170 tl_buffer(void *arg)
6171 {
6172 queue_t *wq = arg;
6173 tl_endpt_t *tep = (tl_endpt_t *)wq->q_ptr;
6174
6175 ASSERT(tep);
6176
6177 tep->te_bufcid = 0;
6178 tep->te_nowsrv = B_FALSE;
6179
6180 enableok(wq);
6181 /*
6182 * Note: can call wsrv directly here and save context switch
6183 * Consider change when qbufcall (not bufcall) is active
6184 */
6185 qenable(wq);
6186 }
6187
6188 static void
6189 tl_memrecover(queue_t *wq, mblk_t *mp, size_t size)
6190 {
6191 tl_endpt_t *tep;
6192
6193 tep = (tl_endpt_t *)wq->q_ptr;
6194
6195 if (tep->te_closing) {
6196 freemsg(mp);
6197 return;
6198 }
6199 noenable(wq);
6200
6201 (void) insq(wq, wq->q_first, mp);
6202
6203 if (tep->te_bufcid || tep->te_timoutid) {
6204 (void) (STRLOG(TL_ID, tep->te_minor, 1, SL_TRACE|SL_ERROR,
6205 "tl_memrecover:recover %p pending", (void *)wq));
6206 return;
6207 }
6208
6209 if (!(tep->te_bufcid = qbufcall(wq, size, BPRI_MED, tl_buffer, wq))) {
6210 tep->te_timoutid = qtimeout(wq, tl_timer, wq,
6211 drv_usectohz(TL_BUFWAIT));
6212 }
6213 }
6214
6215 static void
6216 tl_freetip(tl_endpt_t *tep, tl_icon_t *tip)
6217 {
6218 ASSERT(tip->ti_seqno != 0);
6219
6220 if (tip->ti_mp != NULL) {
6221 tl_icon_freemsgs(&tip->ti_mp);
6222 tip->ti_mp = NULL;
6223 }
6224 if (tip->ti_tep != NULL) {
6225 tl_refrele(tip->ti_tep);
6226 tip->ti_tep = NULL;
6227 }
6228 list_remove(&tep->te_iconp, tip);
6229 kmem_free(tip, sizeof (tl_icon_t));
6230 tep->te_nicon--;
6231 }
6232
6233 /*
6234 * Remove address from address hash.
6235 */
6236 static void
6237 tl_addr_unbind(tl_endpt_t *tep)
6238 {
6239 tl_endpt_t *elp;
6240
6241 if (tep->te_flag & TL_ADDRHASHED) {
6242 if (IS_SOCKET(tep)) {
6243 (void) mod_hash_remove(tep->te_addrhash,
6244 (mod_hash_key_t)tep->te_vp,
6245 (mod_hash_val_t *)&elp);
6246 tep->te_vp = (void *)(uintptr_t)tep->te_minor;
6247 tep->te_magic = SOU_MAGIC_IMPLICIT;
6248 } else {
6249 (void) mod_hash_remove(tep->te_addrhash,
6250 (mod_hash_key_t)&tep->te_ap,
6251 (mod_hash_val_t *)&elp);
6252 (void) kmem_free(tep->te_abuf, tep->te_alen);
6253 tep->te_alen = -1;
6254 tep->te_abuf = NULL;
6255 }
6256 tep->te_flag &= ~TL_ADDRHASHED;
6257 }
6258 }