350         pppt_iocdata_t                  iocd;
 351         door_handle_t                   new_handle;
 352 
 353         if (drv_priv(cred) != 0) {
 354                 return (EPERM);
 355         }
 356 
 357         rc = ddi_copyin((void *)argp, &iocd, sizeof (iocd), flag);
 358         if (rc)
 359                 return (EFAULT);
 360 
 361         if (iocd.pppt_version != PPPT_VERSION_1)
 362                 return (EINVAL);
 363 
 364         switch (cmd) {
 365         case PPPT_MESSAGE:
 366 
 367                 /* XXX limit buf_size ? */
 368                 buf_size = (size_t)iocd.pppt_buf_size;
 369                 buf = kmem_alloc(buf_size, KM_SLEEP);
 370                 if (buf == NULL)
 371                         return (ENOMEM);
 372 
 373                 rc = ddi_copyin((void *)(unsigned long)iocd.pppt_buf,
 374                     buf, buf_size, flag);
 375                 if (rc) {
 376                         kmem_free(buf, buf_size);
 377                         return (EFAULT);
 378                 }
 379 
 380                 stmf_ic_rx_msg(buf, buf_size);
 381 
 382                 kmem_free(buf, buf_size);
 383                 break;
 384         case PPPT_INSTALL_DOOR:
 385 
 386                 new_handle = door_ki_lookup((int)iocd.pppt_door_fd);
 387                 if (new_handle == NULL)
 388                         return (EINVAL);
 389 
 390                 mutex_enter(&pppt_global.global_door_lock);
 391                 ASSERT(pppt_global.global_svc_state == PSS_ENABLED);

 350         pppt_iocdata_t                  iocd;
 351         door_handle_t                   new_handle;
 352 
 353         if (drv_priv(cred) != 0) {
 354                 return (EPERM);
 355         }
 356 
 357         rc = ddi_copyin((void *)argp, &iocd, sizeof (iocd), flag);
 358         if (rc)
 359                 return (EFAULT);
 360 
 361         if (iocd.pppt_version != PPPT_VERSION_1)
 362                 return (EINVAL);
 363 
 364         switch (cmd) {
 365         case PPPT_MESSAGE:
 366 
 367                 /* XXX limit buf_size ? */
 368                 buf_size = (size_t)iocd.pppt_buf_size;
 369                 buf = kmem_alloc(buf_size, KM_SLEEP);


 370 
 371                 rc = ddi_copyin((void *)(unsigned long)iocd.pppt_buf,
 372                     buf, buf_size, flag);
 373                 if (rc) {
 374                         kmem_free(buf, buf_size);
 375                         return (EFAULT);
 376                 }
 377 
 378                 stmf_ic_rx_msg(buf, buf_size);
 379 
 380                 kmem_free(buf, buf_size);
 381                 break;
 382         case PPPT_INSTALL_DOOR:
 383 
 384                 new_handle = door_ki_lookup((int)iocd.pppt_door_fd);
 385                 if (new_handle == NULL)
 386                         return (EINVAL);
 387 
 388                 mutex_enter(&pppt_global.global_door_lock);
 389                 ASSERT(pppt_global.global_svc_state == PSS_ENABLED);