xref: /illumos-gate/usr/src/uts/common/fs/sockfs/sockcommon_subr.c (revision 9b4e3ac25d882519cad3fc11f0c53b07f4e60536)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
24  * Use is subject to license terms.
25  */
26 
27 #include <sys/types.h>
28 #include <sys/param.h>
29 #include <sys/signal.h>
30 #include <sys/cmn_err.h>
31 
32 #include <sys/stropts.h>
33 #include <sys/socket.h>
34 #include <sys/socketvar.h>
35 #include <sys/sockio.h>
36 #include <sys/sodirect.h>
37 #include <sys/strsubr.h>
38 #include <sys/strsun.h>
39 #include <sys/atomic.h>
40 
41 #include <fs/sockfs/sockcommon.h>
42 #include <fs/sockfs/socktpi.h>
43 #include <sys/ddi.h>
44 #include <inet/ip.h>
45 #include <sys/time.h>
46 #include <sys/cmn_err.h>
47 
48 #ifdef SOCK_TEST
49 extern int do_useracc;
50 extern clock_t sock_test_timelimit;
51 #endif /* SOCK_TEST */
52 
53 #define	MBLK_PULL_LEN 64
54 uint32_t so_mblk_pull_len = MBLK_PULL_LEN;
55 
56 #ifdef DEBUG
57 boolean_t so_debug_length = B_FALSE;
58 static boolean_t so_check_length(sonode_t *so);
59 #endif
60 
61 int
62 so_acceptq_enqueue_locked(struct sonode *so, struct sonode *nso)
63 {
64 	ASSERT(MUTEX_HELD(&so->so_acceptq_lock));
65 	ASSERT(nso->so_acceptq_next == NULL);
66 
67 	*so->so_acceptq_tail = nso;
68 	so->so_acceptq_tail = &nso->so_acceptq_next;
69 	so->so_acceptq_len++;
70 
71 	/* Wakeup a single consumer */
72 	cv_signal(&so->so_acceptq_cv);
73 
74 	return (so->so_acceptq_len);
75 }
76 
77 /*
78  * int so_acceptq_enqueue(struct sonode *so, struct sonode *nso)
79  *
80  * Enqueue an incoming connection on a listening socket.
81  *
82  * Arguments:
83  *   so	  - listening socket
84  *   nso  - new connection
85  *
86  * Returns:
87  *   Number of queued connections, including the new connection
88  */
89 int
90 so_acceptq_enqueue(struct sonode *so, struct sonode *nso)
91 {
92 	int conns;
93 
94 	mutex_enter(&so->so_acceptq_lock);
95 	conns = so_acceptq_enqueue_locked(so, nso);
96 	mutex_exit(&so->so_acceptq_lock);
97 
98 	return (conns);
99 }
100 
101 static int
102 so_acceptq_dequeue_locked(struct sonode *so, boolean_t dontblock,
103     struct sonode **nsop)
104 {
105 	struct sonode *nso = NULL;
106 
107 	*nsop = NULL;
108 	ASSERT(MUTEX_HELD(&so->so_acceptq_lock));
109 	while ((nso = so->so_acceptq_head) == NULL) {
110 		/*
111 		 * No need to check so_error here, because it is not
112 		 * possible for a listening socket to be reset or otherwise
113 		 * disconnected.
114 		 *
115 		 * So now we just need check if it's ok to wait.
116 		 */
117 		if (dontblock)
118 			return (EWOULDBLOCK);
119 		if (so->so_state & (SS_CLOSING | SS_FALLBACK_PENDING))
120 			return (EINTR);
121 
122 		if (cv_wait_sig_swap(&so->so_acceptq_cv,
123 		    &so->so_acceptq_lock) == 0)
124 			return (EINTR);
125 	}
126 
127 	ASSERT(nso != NULL);
128 	so->so_acceptq_head = nso->so_acceptq_next;
129 	nso->so_acceptq_next = NULL;
130 
131 	if (so->so_acceptq_head == NULL) {
132 		ASSERT(so->so_acceptq_tail == &nso->so_acceptq_next);
133 		so->so_acceptq_tail = &so->so_acceptq_head;
134 	}
135 	ASSERT(so->so_acceptq_len > 0);
136 	--so->so_acceptq_len;
137 
138 	*nsop = nso;
139 
140 	return (0);
141 }
142 
143 /*
144  * int so_acceptq_dequeue(struct sonode *, boolean_t, struct sonode **)
145  *
146  * Pulls a connection off of the accept queue.
147  *
148  * Arguments:
149  *   so	       - listening socket
150  *   dontblock - indicate whether it's ok to sleep if there are no
151  *		 connections on the queue
152  *   nsop      - Value-return argument
153  *
154  * Return values:
155  *   0 when a connection is successfully dequeued, in which case nsop
156  *   is set to point to the new connection. Upon failure a non-zero
157  *   value is returned, and the value of nsop is set to NULL.
158  *
159  * Note:
160  *   so_acceptq_dequeue() may return prematurly if the socket is falling
161  *   back to TPI.
162  */
163 int
164 so_acceptq_dequeue(struct sonode *so, boolean_t dontblock,
165     struct sonode **nsop)
166 {
167 	int error;
168 
169 	mutex_enter(&so->so_acceptq_lock);
170 	error = so_acceptq_dequeue_locked(so, dontblock, nsop);
171 	mutex_exit(&so->so_acceptq_lock);
172 
173 	return (error);
174 }
175 
176 /*
177  * void so_acceptq_flush(struct sonode *so)
178  *
179  * Removes all pending connections from a listening socket, and
180  * frees the associated resources.
181  *
182  * Arguments
183  *   so	    - listening socket
184  *
185  * Return values:
186  *   None.
187  *
188  * Note:
189  *   The caller has to ensure that no calls to so_acceptq_enqueue() or
190  *   so_acceptq_dequeue() occur while the accept queue is being flushed.
191  *   So either the socket needs to be in a state where no operations
192  *   would come in, or so_lock needs to be obtained.
193  */
194 void
195 so_acceptq_flush(struct sonode *so)
196 {
197 	struct sonode *nso;
198 
199 	nso = so->so_acceptq_head;
200 
201 	while (nso != NULL) {
202 		struct sonode *nnso = NULL;
203 
204 		nnso = nso->so_acceptq_next;
205 		nso->so_acceptq_next = NULL;
206 		/*
207 		 * Since the socket is on the accept queue, there can
208 		 * only be one reference. We drop the reference and
209 		 * just blow off the socket.
210 		 */
211 		ASSERT(nso->so_count == 1);
212 		nso->so_count--;
213 		socket_destroy(nso);
214 		nso = nnso;
215 	}
216 
217 	so->so_acceptq_head = NULL;
218 	so->so_acceptq_tail = &so->so_acceptq_head;
219 	so->so_acceptq_len = 0;
220 }
221 
222 int
223 so_wait_connected_locked(struct sonode *so, boolean_t nonblock,
224     sock_connid_t id)
225 {
226 	ASSERT(MUTEX_HELD(&so->so_lock));
227 
228 	/*
229 	 * The protocol has notified us that a connection attempt is being
230 	 * made, so before we wait for a notification to arrive we must
231 	 * clear out any errors associated with earlier connection attempts.
232 	 */
233 	if (so->so_error != 0 && SOCK_CONNID_LT(so->so_proto_connid, id))
234 		so->so_error = 0;
235 
236 	while (SOCK_CONNID_LT(so->so_proto_connid, id)) {
237 		if (nonblock)
238 			return (EINPROGRESS);
239 
240 		if (so->so_state & (SS_CLOSING | SS_FALLBACK_PENDING))
241 			return (EINTR);
242 
243 		if (cv_wait_sig_swap(&so->so_state_cv, &so->so_lock) == 0)
244 			return (EINTR);
245 	}
246 
247 	if (so->so_error != 0)
248 		return (sogeterr(so, B_TRUE));
249 	/*
250 	 * Under normal circumstances, so_error should contain an error
251 	 * in case the connect failed. However, it is possible for another
252 	 * thread to come in a consume the error, so generate a sensible
253 	 * error in that case.
254 	 */
255 	if ((so->so_state & SS_ISCONNECTED) == 0)
256 		return (ECONNREFUSED);
257 
258 	return (0);
259 }
260 
261 /*
262  * int so_wait_connected(struct sonode *so, boolean_t nonblock,
263  *    sock_connid_t id)
264  *
265  * Wait until the socket is connected or an error has occured.
266  *
267  * Arguments:
268  *   so	      - socket
269  *   nonblock - indicate whether it's ok to sleep if the connection has
270  *		not yet been established
271  *   gen      - generation number that was returned by the protocol
272  *		when the operation was started
273  *
274  * Returns:
275  *   0 if the connection attempt was successful, or an error indicating why
276  *   the connection attempt failed.
277  */
278 int
279 so_wait_connected(struct sonode *so, boolean_t nonblock, sock_connid_t id)
280 {
281 	int error;
282 
283 	mutex_enter(&so->so_lock);
284 	error = so_wait_connected_locked(so, nonblock, id);
285 	mutex_exit(&so->so_lock);
286 
287 	return (error);
288 }
289 
290 int
291 so_snd_wait_qnotfull_locked(struct sonode *so, boolean_t dontblock)
292 {
293 	int error;
294 
295 	ASSERT(MUTEX_HELD(&so->so_lock));
296 	while (so->so_snd_qfull) {
297 		if (so->so_state & SS_CANTSENDMORE)
298 			return (EPIPE);
299 		if (dontblock)
300 			return (EWOULDBLOCK);
301 
302 		if (so->so_state & (SS_CLOSING | SS_FALLBACK_PENDING))
303 			return (EINTR);
304 
305 		if (so->so_sndtimeo == 0) {
306 			/*
307 			 * Zero means disable timeout.
308 			 */
309 			error = cv_wait_sig(&so->so_snd_cv, &so->so_lock);
310 		} else {
311 			clock_t now;
312 
313 			time_to_wait(&now, so->so_sndtimeo);
314 			error = cv_timedwait_sig(&so->so_snd_cv, &so->so_lock,
315 			    now);
316 		}
317 		if (error == 0)
318 			return (EINTR);
319 		else if (error == -1)
320 			return (ETIME);
321 	}
322 	return (0);
323 }
324 
325 /*
326  * int so_wait_sendbuf(struct sonode *so, boolean_t dontblock)
327  *
328  * Wait for the transport to notify us about send buffers becoming
329  * available.
330  */
331 int
332 so_snd_wait_qnotfull(struct sonode *so, boolean_t dontblock)
333 {
334 	int error = 0;
335 
336 	mutex_enter(&so->so_lock);
337 	if (so->so_snd_qfull) {
338 		so->so_snd_wakeup = B_TRUE;
339 		error = so_snd_wait_qnotfull_locked(so, dontblock);
340 		so->so_snd_wakeup = B_FALSE;
341 	}
342 	mutex_exit(&so->so_lock);
343 
344 	return (error);
345 }
346 
347 void
348 so_snd_qfull(struct sonode *so)
349 {
350 	mutex_enter(&so->so_lock);
351 	so->so_snd_qfull = B_TRUE;
352 	mutex_exit(&so->so_lock);
353 }
354 
355 void
356 so_snd_qnotfull(struct sonode *so)
357 {
358 	mutex_enter(&so->so_lock);
359 	so->so_snd_qfull = B_FALSE;
360 	/* wake up everyone waiting for buffers */
361 	cv_broadcast(&so->so_snd_cv);
362 	mutex_exit(&so->so_lock);
363 }
364 
365 /*
366  * Change the process/process group to which SIGIO is sent.
367  */
368 int
369 socket_chgpgrp(struct sonode *so, pid_t pid)
370 {
371 	int error;
372 
373 	ASSERT(MUTEX_HELD(&so->so_lock));
374 	if (pid != 0) {
375 		/*
376 		 * Permissions check by sending signal 0.
377 		 * Note that when kill fails it does a
378 		 * set_errno causing the system call to fail.
379 		 */
380 		error = kill(pid, 0);
381 		if (error != 0) {
382 			return (error);
383 		}
384 	}
385 	so->so_pgrp = pid;
386 	return (0);
387 }
388 
389 
390 /*
391  * Generate a SIGIO, for 'writable' events include siginfo structure,
392  * for read events just send the signal.
393  */
394 /*ARGSUSED*/
395 static void
396 socket_sigproc(proc_t *proc, int event)
397 {
398 	k_siginfo_t info;
399 
400 	ASSERT(event & (SOCKETSIG_WRITE | SOCKETSIG_READ | SOCKETSIG_URG));
401 
402 	if (event & SOCKETSIG_WRITE) {
403 		info.si_signo = SIGPOLL;
404 		info.si_code = POLL_OUT;
405 		info.si_errno = 0;
406 		info.si_fd = 0;
407 		info.si_band = 0;
408 		sigaddq(proc, NULL, &info, KM_NOSLEEP);
409 	}
410 	if (event & SOCKETSIG_READ) {
411 		sigtoproc(proc, NULL, SIGPOLL);
412 	}
413 	if (event & SOCKETSIG_URG) {
414 		sigtoproc(proc, NULL, SIGURG);
415 	}
416 }
417 
418 void
419 socket_sendsig(struct sonode *so, int event)
420 {
421 	proc_t *proc;
422 
423 	ASSERT(MUTEX_HELD(&so->so_lock));
424 
425 	if (so->so_pgrp == 0 || (!(so->so_state & SS_ASYNC) &&
426 	    event != SOCKETSIG_URG)) {
427 		return;
428 	}
429 
430 	dprint(3, ("sending sig %d to %d\n", event, so->so_pgrp));
431 
432 	if (so->so_pgrp > 0) {
433 		/*
434 		 * XXX This unfortunately still generates
435 		 * a signal when a fd is closed but
436 		 * the proc is active.
437 		 */
438 		mutex_enter(&pidlock);
439 		proc = prfind(so->so_pgrp);
440 		if (proc == NULL) {
441 			mutex_exit(&pidlock);
442 			return;
443 		}
444 		mutex_enter(&proc->p_lock);
445 		mutex_exit(&pidlock);
446 		socket_sigproc(proc, event);
447 		mutex_exit(&proc->p_lock);
448 	} else {
449 		/*
450 		 * Send to process group. Hold pidlock across
451 		 * calls to socket_sigproc().
452 		 */
453 		pid_t pgrp = -so->so_pgrp;
454 
455 		mutex_enter(&pidlock);
456 		proc = pgfind(pgrp);
457 		while (proc != NULL) {
458 			mutex_enter(&proc->p_lock);
459 			socket_sigproc(proc, event);
460 			mutex_exit(&proc->p_lock);
461 			proc = proc->p_pglink;
462 		}
463 		mutex_exit(&pidlock);
464 	}
465 }
466 
467 #define	MIN(a, b) ((a) < (b) ? (a) : (b))
468 /* Copy userdata into a new mblk_t */
469 mblk_t *
470 socopyinuio(uio_t *uiop, ssize_t iosize, size_t wroff, ssize_t maxblk,
471     size_t tail_len, int *errorp)
472 {
473 	mblk_t	*head = NULL, **tail = &head;
474 
475 	ASSERT(iosize == INFPSZ || iosize > 0);
476 
477 	if (iosize == INFPSZ || iosize > uiop->uio_resid)
478 		iosize = uiop->uio_resid;
479 
480 	if (maxblk == INFPSZ)
481 		maxblk = iosize;
482 
483 	/* Nothing to do in these cases, so we're done */
484 	if (iosize < 0 || maxblk < 0 || (maxblk == 0 && iosize > 0))
485 		goto done;
486 
487 	/*
488 	 * We will enter the loop below if iosize is 0; it will allocate an
489 	 * empty message block and call uiomove(9F) which will just return.
490 	 * We could avoid that with an extra check but would only slow
491 	 * down the much more likely case where iosize is larger than 0.
492 	 */
493 	do {
494 		ssize_t blocksize;
495 		mblk_t	*mp;
496 
497 		blocksize = MIN(iosize, maxblk);
498 		ASSERT(blocksize >= 0);
499 		if ((mp = allocb(wroff + blocksize + tail_len,
500 		    BPRI_MED)) == NULL) {
501 			*errorp = ENOMEM;
502 			return (head);
503 		}
504 		mp->b_rptr += wroff;
505 		mp->b_wptr = mp->b_rptr + blocksize;
506 
507 		*tail = mp;
508 		tail = &mp->b_cont;
509 
510 		/* uiomove(9F) either returns 0 or EFAULT */
511 		if ((*errorp = uiomove(mp->b_rptr, (size_t)blocksize,
512 		    UIO_WRITE, uiop)) != 0) {
513 			ASSERT(*errorp != ENOMEM);
514 			freemsg(head);
515 			return (NULL);
516 		}
517 
518 		iosize -= blocksize;
519 	} while (iosize > 0);
520 
521 done:
522 	*errorp = 0;
523 	return (head);
524 }
525 
526 mblk_t *
527 socopyoutuio(mblk_t *mp, struct uio *uiop, ssize_t max_read, int *errorp)
528 {
529 	int error;
530 	ptrdiff_t n;
531 	mblk_t *nmp;
532 
533 	ASSERT(mp->b_wptr >= mp->b_rptr);
534 
535 	/*
536 	 * max_read is the offset of the oobmark and read can not go pass
537 	 * the oobmark.
538 	 */
539 	if (max_read == INFPSZ || max_read > uiop->uio_resid)
540 		max_read = uiop->uio_resid;
541 
542 	do {
543 		if ((n = MIN(max_read, MBLKL(mp))) != 0) {
544 			ASSERT(n > 0);
545 
546 			error = uiomove(mp->b_rptr, n, UIO_READ, uiop);
547 			if (error != 0) {
548 				freemsg(mp);
549 				*errorp = error;
550 				return (NULL);
551 			}
552 		}
553 
554 		mp->b_rptr += n;
555 		max_read -= n;
556 		while (mp != NULL && (mp->b_rptr >= mp->b_wptr)) {
557 			/*
558 			 * get rid of zero length mblks
559 			 */
560 			nmp = mp;
561 			mp = mp->b_cont;
562 			freeb(nmp);
563 		}
564 	} while (mp != NULL && max_read > 0);
565 
566 	*errorp = 0;
567 	return (mp);
568 }
569 
570 static void
571 so_prepend_msg(struct sonode *so, mblk_t *mp, mblk_t *last_tail)
572 {
573 	ASSERT(last_tail != NULL);
574 	mp->b_next = so->so_rcv_q_head;
575 	mp->b_prev = last_tail;
576 	ASSERT(!(DB_FLAGS(mp) & DBLK_UIOA));
577 
578 	if (so->so_rcv_q_head == NULL) {
579 		ASSERT(so->so_rcv_q_last_head == NULL);
580 		so->so_rcv_q_last_head = mp;
581 #ifdef DEBUG
582 	} else {
583 		ASSERT(!(DB_FLAGS(so->so_rcv_q_head) & DBLK_UIOA));
584 #endif
585 	}
586 	so->so_rcv_q_head = mp;
587 
588 #ifdef DEBUG
589 	if (so_debug_length) {
590 		mutex_enter(&so->so_lock);
591 		ASSERT(so_check_length(so));
592 		mutex_exit(&so->so_lock);
593 	}
594 #endif
595 }
596 
597 static void
598 process_new_message(struct sonode *so, mblk_t *mp_head, mblk_t *mp_last_head)
599 {
600 	ASSERT(mp_head->b_prev != NULL);
601 	if (so->so_rcv_q_head  == NULL) {
602 		so->so_rcv_q_head = mp_head;
603 		so->so_rcv_q_last_head = mp_last_head;
604 		ASSERT(so->so_rcv_q_last_head->b_prev != NULL);
605 	} else {
606 		boolean_t flag_equal = ((DB_FLAGS(mp_head) & DBLK_UIOA) ==
607 		    (DB_FLAGS(so->so_rcv_q_last_head) & DBLK_UIOA));
608 
609 		if (mp_head->b_next == NULL &&
610 		    DB_TYPE(mp_head) == M_DATA &&
611 		    DB_TYPE(so->so_rcv_q_last_head) == M_DATA && flag_equal) {
612 			so->so_rcv_q_last_head->b_prev->b_cont = mp_head;
613 			so->so_rcv_q_last_head->b_prev = mp_head->b_prev;
614 			mp_head->b_prev = NULL;
615 		} else if (flag_equal && (DB_FLAGS(mp_head) & DBLK_UIOA)) {
616 			/*
617 			 * Append to last_head if more than one mblks, and both
618 			 * mp_head and last_head are I/OAT mblks.
619 			 */
620 			ASSERT(mp_head->b_next != NULL);
621 			so->so_rcv_q_last_head->b_prev->b_cont = mp_head;
622 			so->so_rcv_q_last_head->b_prev = mp_head->b_prev;
623 			mp_head->b_prev = NULL;
624 
625 			so->so_rcv_q_last_head->b_next = mp_head->b_next;
626 			mp_head->b_next = NULL;
627 			so->so_rcv_q_last_head = mp_last_head;
628 		} else {
629 #ifdef DEBUG
630 			{
631 				mblk_t *tmp_mblk;
632 				tmp_mblk = mp_head;
633 				while (tmp_mblk != NULL) {
634 					ASSERT(tmp_mblk->b_prev != NULL);
635 					tmp_mblk = tmp_mblk->b_next;
636 				}
637 			}
638 #endif
639 			so->so_rcv_q_last_head->b_next = mp_head;
640 			so->so_rcv_q_last_head = mp_last_head;
641 		}
642 	}
643 }
644 
645 int
646 so_dequeue_msg(struct sonode *so, mblk_t **mctlp, struct uio *uiop,
647     rval_t *rvalp, int flags)
648 {
649 	mblk_t	*mp, *nmp;
650 	mblk_t	*savemp, *savemptail;
651 	mblk_t	*new_msg_head;
652 	mblk_t	*new_msg_last_head;
653 	mblk_t	*last_tail;
654 	boolean_t partial_read;
655 	boolean_t reset_atmark = B_FALSE;
656 	int more = 0;
657 	int error;
658 	ssize_t oobmark;
659 	sodirect_t *sodp = so->so_direct;
660 
661 	partial_read = B_FALSE;
662 	*mctlp = NULL;
663 again:
664 	mutex_enter(&so->so_lock);
665 again1:
666 #ifdef DEBUG
667 	if (so_debug_length) {
668 		ASSERT(so_check_length(so));
669 	}
670 #endif
671 	/*
672 	 * First move messages from the dump area to processing area
673 	 */
674 	if (sodp != NULL) {
675 		/* No need to grab sod_lockp since it pointers to so_lock */
676 		if (sodp->sod_state & SOD_ENABLED) {
677 			ASSERT(sodp->sod_lockp == &so->so_lock);
678 
679 			if (sodp->sod_uioa.uioa_state & UIOA_ALLOC) {
680 				/* nothing to uioamove */
681 				sodp = NULL;
682 			} else if (sodp->sod_uioa.uioa_state & UIOA_INIT) {
683 				sodp->sod_uioa.uioa_state &= UIOA_CLR;
684 				sodp->sod_uioa.uioa_state |= UIOA_ENABLED;
685 				/*
686 				 * try to uioamove() the data that
687 				 * has already queued.
688 				 */
689 				sod_uioa_so_init(so, sodp, uiop);
690 			}
691 		} else {
692 			sodp = NULL;
693 		}
694 	}
695 	new_msg_head = so->so_rcv_head;
696 	new_msg_last_head = so->so_rcv_last_head;
697 	so->so_rcv_head = NULL;
698 	so->so_rcv_last_head = NULL;
699 	oobmark = so->so_oobmark;
700 	/*
701 	 * We can release the lock as there can only be one reader
702 	 */
703 	mutex_exit(&so->so_lock);
704 
705 	if (so->so_state & SS_RCVATMARK) {
706 		reset_atmark = B_TRUE;
707 	}
708 	if (new_msg_head != NULL) {
709 		process_new_message(so, new_msg_head, new_msg_last_head);
710 	}
711 	savemp = savemptail = NULL;
712 	rvalp->r_val1 = 0;
713 	error = 0;
714 	mp = so->so_rcv_q_head;
715 
716 	if (mp != NULL &&
717 	    (so->so_rcv_timer_tid == 0 ||
718 	    so->so_rcv_queued >= so->so_rcv_thresh)) {
719 		partial_read = B_FALSE;
720 
721 		if (flags & MSG_PEEK) {
722 			if ((nmp = dupmsg(mp)) == NULL &&
723 			    (nmp = copymsg(mp)) == NULL) {
724 				size_t size = msgsize(mp);
725 
726 				error = strwaitbuf(size, BPRI_HI);
727 				if (error) {
728 					return (error);
729 				}
730 				goto again;
731 			}
732 			mp = nmp;
733 		} else {
734 			ASSERT(mp->b_prev != NULL);
735 			last_tail = mp->b_prev;
736 			mp->b_prev = NULL;
737 			so->so_rcv_q_head = mp->b_next;
738 			if (so->so_rcv_q_head == NULL) {
739 				so->so_rcv_q_last_head = NULL;
740 			}
741 			mp->b_next = NULL;
742 		}
743 
744 		ASSERT(mctlp != NULL);
745 		/*
746 		 * First process PROTO or PCPROTO blocks, if any.
747 		 */
748 		if (DB_TYPE(mp) != M_DATA) {
749 			*mctlp = mp;
750 			savemp = mp;
751 			savemptail = mp;
752 			ASSERT(DB_TYPE(mp) == M_PROTO ||
753 			    DB_TYPE(mp) == M_PCPROTO);
754 			while (mp->b_cont != NULL &&
755 			    DB_TYPE(mp->b_cont) != M_DATA) {
756 				ASSERT(DB_TYPE(mp->b_cont) == M_PROTO ||
757 				    DB_TYPE(mp->b_cont) == M_PCPROTO);
758 				mp = mp->b_cont;
759 				savemptail = mp;
760 			}
761 			mp = savemptail->b_cont;
762 			savemptail->b_cont = NULL;
763 		}
764 
765 		ASSERT(DB_TYPE(mp) == M_DATA);
766 		/*
767 		 * Now process DATA blocks, if any. Note that for sodirect
768 		 * enabled socket, uio_resid can be 0.
769 		 */
770 		if (uiop->uio_resid >= 0) {
771 			ssize_t copied = 0;
772 
773 			if (sodp != NULL && (DB_FLAGS(mp) & DBLK_UIOA)) {
774 				mutex_enter(sodp->sod_lockp);
775 				ASSERT(uiop == (uio_t *)&sodp->sod_uioa);
776 				copied = sod_uioa_mblk(so, mp);
777 				if (copied > 0)
778 					partial_read = B_TRUE;
779 				mutex_exit(sodp->sod_lockp);
780 				/* mark this mblk as processed */
781 				mp = NULL;
782 			} else {
783 				ssize_t oldresid = uiop->uio_resid;
784 
785 				if (MBLKL(mp) < so_mblk_pull_len) {
786 					if (pullupmsg(mp, -1) == 1) {
787 						last_tail = mp;
788 					}
789 				}
790 				/*
791 				 * Can not read beyond the oobmark
792 				 */
793 				mp = socopyoutuio(mp, uiop,
794 				    oobmark == 0 ? INFPSZ : oobmark, &error);
795 				if (error != 0) {
796 					freemsg(*mctlp);
797 					*mctlp = NULL;
798 					more = 0;
799 					goto done;
800 				}
801 				ASSERT(oldresid >= uiop->uio_resid);
802 				copied = oldresid - uiop->uio_resid;
803 				if (oldresid > uiop->uio_resid)
804 					partial_read = B_TRUE;
805 			}
806 			ASSERT(copied >= 0);
807 			if (copied > 0 && !(flags & MSG_PEEK)) {
808 				mutex_enter(&so->so_lock);
809 				so->so_rcv_queued -= copied;
810 				ASSERT(so->so_oobmark >= 0);
811 				if (so->so_oobmark > 0) {
812 					so->so_oobmark -= copied;
813 					ASSERT(so->so_oobmark >= 0);
814 					if (so->so_oobmark == 0) {
815 						ASSERT(so->so_state &
816 						    SS_OOBPEND);
817 						so->so_oobmark = 0;
818 						so->so_state |= SS_RCVATMARK;
819 					}
820 				}
821 				if (so->so_flowctrld && so->so_rcv_queued <
822 				    so->so_rcvlowat) {
823 					so->so_flowctrld = B_FALSE;
824 					mutex_exit(&so->so_lock);
825 					/*
826 					 * open up flow control
827 					 */
828 					(*so->so_downcalls->sd_clr_flowctrl)
829 					    (so->so_proto_handle);
830 				} else {
831 					mutex_exit(&so->so_lock);
832 				}
833 			}
834 		}
835 		if (mp != NULL) { /* more data blocks in msg */
836 			more |= MOREDATA;
837 			if ((flags & (MSG_PEEK|MSG_TRUNC))) {
838 				if (flags & MSG_TRUNC) {
839 					mutex_enter(&so->so_lock);
840 					so->so_rcv_queued -= msgdsize(mp);
841 					mutex_exit(&so->so_lock);
842 				}
843 				freemsg(mp);
844 			} else if (partial_read && !somsghasdata(mp)) {
845 				/*
846 				 * Avoid queuing a zero-length tail part of
847 				 * a message. partial_read == 1 indicates that
848 				 * we read some of the message.
849 				 */
850 				freemsg(mp);
851 				more &= ~MOREDATA;
852 			} else {
853 				if (savemp != NULL &&
854 				    (flags & MSG_DUPCTRL)) {
855 					mblk_t *nmp;
856 					/*
857 					 * There should only be non data mblks
858 					 */
859 					ASSERT(DB_TYPE(savemp) != M_DATA &&
860 					    DB_TYPE(savemptail) != M_DATA);
861 try_again:
862 					if ((nmp = dupmsg(savemp)) == NULL &&
863 					    (nmp = copymsg(savemp)) == NULL) {
864 
865 						size_t size = msgsize(savemp);
866 
867 						error = strwaitbuf(size,
868 						    BPRI_HI);
869 						if (error != 0) {
870 							/*
871 							 * In case we
872 							 * cannot copy
873 							 * control data
874 							 * free the remaining
875 							 * data.
876 							 */
877 							freemsg(mp);
878 							goto done;
879 						}
880 						goto try_again;
881 					}
882 
883 					ASSERT(nmp != NULL);
884 					ASSERT(DB_TYPE(nmp) != M_DATA);
885 					savemptail->b_cont = mp;
886 					*mctlp = nmp;
887 					mp = savemp;
888 				}
889 				/*
890 				 * putback mp
891 				 */
892 				so_prepend_msg(so, mp, last_tail);
893 			}
894 		}
895 
896 		/* fast check so_rcv_head if there is more data */
897 		if (partial_read && !(so->so_state & SS_RCVATMARK) &&
898 		    *mctlp == NULL && uiop->uio_resid > 0 &&
899 		    !(flags & MSG_PEEK) && so->so_rcv_head != NULL) {
900 			goto again;
901 		}
902 	} else if (!partial_read) {
903 		mutex_enter(&so->so_lock);
904 		if (so->so_error != 0) {
905 			error = sogeterr(so, !(flags & MSG_PEEK));
906 			mutex_exit(&so->so_lock);
907 			return (error);
908 		}
909 		/*
910 		 * No pending data. Return right away for nonblocking
911 		 * socket, otherwise sleep waiting for data.
912 		 */
913 		if (!(so->so_state & SS_CANTRCVMORE)) {
914 			if ((uiop->uio_fmode & (FNDELAY|FNONBLOCK)) ||
915 			    (flags & MSG_DONTWAIT)) {
916 				error = EWOULDBLOCK;
917 			} else {
918 				if (so->so_state & (SS_CLOSING |
919 				    SS_FALLBACK_PENDING)) {
920 					mutex_exit(&so->so_lock);
921 					error = EINTR;
922 					goto done;
923 				}
924 
925 				if (so->so_rcv_head != NULL) {
926 					goto again1;
927 				}
928 				so->so_rcv_wakeup = B_TRUE;
929 				so->so_rcv_wanted = uiop->uio_resid;
930 				if (so->so_rcvtimeo == 0) {
931 					/*
932 					 * Zero means disable timeout.
933 					 */
934 					error = cv_wait_sig(&so->so_rcv_cv,
935 					    &so->so_lock);
936 				} else {
937 					clock_t now;
938 					time_to_wait(&now, so->so_rcvtimeo);
939 					error = cv_timedwait_sig(&so->so_rcv_cv,
940 					    &so->so_lock, now);
941 				}
942 				so->so_rcv_wakeup = B_FALSE;
943 				so->so_rcv_wanted = 0;
944 
945 				if (error == 0) {
946 					error = EINTR;
947 				} else if (error == -1) {
948 					error = ETIME;
949 				} else {
950 					goto again1;
951 				}
952 			}
953 		}
954 		mutex_exit(&so->so_lock);
955 	}
956 	if (reset_atmark && partial_read && !(flags & MSG_PEEK)) {
957 		/*
958 		 * We are passed the mark, update state
959 		 * 4.3BSD and 4.4BSD clears the mark when peeking across it.
960 		 * The draft Posix socket spec states that the mark should
961 		 * not be cleared when peeking. We follow the latter.
962 		 */
963 		mutex_enter(&so->so_lock);
964 		ASSERT(so_verify_oobstate(so));
965 		so->so_state &= ~(SS_OOBPEND|SS_HAVEOOBDATA|SS_RCVATMARK);
966 		freemsg(so->so_oobmsg);
967 		so->so_oobmsg = NULL;
968 		ASSERT(so_verify_oobstate(so));
969 		mutex_exit(&so->so_lock);
970 	}
971 	ASSERT(so->so_rcv_wakeup == B_FALSE);
972 done:
973 	if (sodp != NULL) {
974 		mutex_enter(sodp->sod_lockp);
975 		if ((sodp->sod_state & SOD_ENABLED) &&
976 		    (sodp->sod_uioa.uioa_state & UIOA_ENABLED)) {
977 			SOD_UIOAFINI(sodp);
978 			if (sodp->sod_uioa.uioa_mbytes > 0) {
979 				ASSERT(so->so_rcv_q_head != NULL ||
980 				    so->so_rcv_head != NULL);
981 				so->so_rcv_queued -= sod_uioa_mblk(so, NULL);
982 				if (error == EWOULDBLOCK)
983 					error = 0;
984 			}
985 		}
986 		mutex_exit(sodp->sod_lockp);
987 	}
988 #ifdef DEBUG
989 	if (so_debug_length) {
990 		mutex_enter(&so->so_lock);
991 		ASSERT(so_check_length(so));
992 		mutex_exit(&so->so_lock);
993 	}
994 #endif
995 	rvalp->r_val1 = more;
996 	return (error);
997 }
998 
999 void
1000 so_enqueue_msg(struct sonode *so, mblk_t *mp, size_t msg_size)
1001 {
1002 	ASSERT(MUTEX_HELD(&so->so_lock));
1003 
1004 #ifdef DEBUG
1005 	if (so_debug_length) {
1006 		ASSERT(so_check_length(so));
1007 	}
1008 #endif
1009 	so->so_rcv_queued += msg_size;
1010 
1011 	if (so->so_rcv_head == NULL) {
1012 		ASSERT(so->so_rcv_last_head == NULL);
1013 		so->so_rcv_head = mp;
1014 		so->so_rcv_last_head = mp;
1015 	} else if ((DB_TYPE(mp) == M_DATA &&
1016 	    DB_TYPE(so->so_rcv_last_head) == M_DATA) &&
1017 	    ((DB_FLAGS(mp) & DBLK_UIOA) ==
1018 	    (DB_FLAGS(so->so_rcv_last_head) & DBLK_UIOA))) {
1019 		/* Added to the end */
1020 		ASSERT(so->so_rcv_last_head != NULL);
1021 		ASSERT(so->so_rcv_last_head->b_prev != NULL);
1022 		so->so_rcv_last_head->b_prev->b_cont = mp;
1023 	} else {
1024 		/* Start a new end */
1025 		so->so_rcv_last_head->b_next = mp;
1026 		so->so_rcv_last_head = mp;
1027 	}
1028 	while (mp->b_cont != NULL)
1029 		mp = mp->b_cont;
1030 
1031 	so->so_rcv_last_head->b_prev = mp;
1032 #ifdef DEBUG
1033 	if (so_debug_length) {
1034 		ASSERT(so_check_length(so));
1035 	}
1036 #endif
1037 }
1038 
1039 /*
1040  * Return B_TRUE if there is data in the message, B_FALSE otherwise.
1041  */
1042 boolean_t
1043 somsghasdata(mblk_t *mp)
1044 {
1045 	for (; mp; mp = mp->b_cont)
1046 		if (mp->b_datap->db_type == M_DATA) {
1047 			ASSERT(mp->b_wptr >= mp->b_rptr);
1048 			if (mp->b_wptr > mp->b_rptr)
1049 				return (B_TRUE);
1050 		}
1051 	return (B_FALSE);
1052 }
1053 
1054 /*
1055  * Flush the read side of sockfs.
1056  *
1057  * The caller must be sure that a reader is not already active when the
1058  * buffer is being flushed.
1059  */
1060 void
1061 so_rcv_flush(struct sonode *so)
1062 {
1063 	mblk_t  *mp;
1064 
1065 	ASSERT(MUTEX_HELD(&so->so_lock));
1066 
1067 	if (so->so_oobmsg != NULL) {
1068 		freemsg(so->so_oobmsg);
1069 		so->so_oobmsg = NULL;
1070 		so->so_oobmark = 0;
1071 		so->so_state &=
1072 		    ~(SS_OOBPEND|SS_HAVEOOBDATA|SS_HADOOBDATA|SS_RCVATMARK);
1073 	}
1074 
1075 	/*
1076 	 * Free messages sitting in the send and recv queue
1077 	 */
1078 	while (so->so_rcv_q_head != NULL) {
1079 		mp = so->so_rcv_q_head;
1080 		so->so_rcv_q_head = mp->b_next;
1081 		mp->b_next = mp->b_prev = NULL;
1082 		freemsg(mp);
1083 	}
1084 	while (so->so_rcv_head != NULL) {
1085 		mp = so->so_rcv_head;
1086 		so->so_rcv_head = mp->b_next;
1087 		mp->b_next = mp->b_prev = NULL;
1088 		freemsg(mp);
1089 	}
1090 	so->so_rcv_queued = 0;
1091 	so->so_rcv_q_head = NULL;
1092 	so->so_rcv_q_last_head = NULL;
1093 	so->so_rcv_head = NULL;
1094 	so->so_rcv_last_head = NULL;
1095 }
1096 
1097 /*
1098  * Handle recv* calls that set MSG_OOB or MSG_OOB together with MSG_PEEK.
1099  */
1100 int
1101 sorecvoob(struct sonode *so, struct nmsghdr *msg, struct uio *uiop, int flags,
1102     boolean_t oob_inline)
1103 {
1104 	mblk_t		*mp, *nmp;
1105 	int		error;
1106 
1107 	dprintso(so, 1, ("sorecvoob(%p, %p, 0x%x)\n", (void *)so, (void *)msg,
1108 	    flags));
1109 
1110 	if (msg != NULL) {
1111 		/*
1112 		 * There is never any oob data with addresses or control since
1113 		 * the T_EXDATA_IND does not carry any options.
1114 		 */
1115 		msg->msg_controllen = 0;
1116 		msg->msg_namelen = 0;
1117 		msg->msg_flags = 0;
1118 	}
1119 
1120 	mutex_enter(&so->so_lock);
1121 	ASSERT(so_verify_oobstate(so));
1122 	if (oob_inline ||
1123 	    (so->so_state & (SS_OOBPEND|SS_HADOOBDATA)) != SS_OOBPEND) {
1124 		dprintso(so, 1, ("sorecvoob: inline or data consumed\n"));
1125 		mutex_exit(&so->so_lock);
1126 		return (EINVAL);
1127 	}
1128 	if (!(so->so_state & SS_HAVEOOBDATA)) {
1129 		dprintso(so, 1, ("sorecvoob: no data yet\n"));
1130 		mutex_exit(&so->so_lock);
1131 		return (EWOULDBLOCK);
1132 	}
1133 	ASSERT(so->so_oobmsg != NULL);
1134 	mp = so->so_oobmsg;
1135 	if (flags & MSG_PEEK) {
1136 		/*
1137 		 * Since recv* can not return ENOBUFS we can not use dupmsg.
1138 		 * Instead we revert to the consolidation private
1139 		 * allocb_wait plus bcopy.
1140 		 */
1141 		mblk_t *mp1;
1142 
1143 		mp1 = allocb_wait(msgdsize(mp), BPRI_MED, STR_NOSIG, NULL);
1144 		ASSERT(mp1);
1145 
1146 		while (mp != NULL) {
1147 			ssize_t size;
1148 
1149 			size = MBLKL(mp);
1150 			bcopy(mp->b_rptr, mp1->b_wptr, size);
1151 			mp1->b_wptr += size;
1152 			ASSERT(mp1->b_wptr <= mp1->b_datap->db_lim);
1153 			mp = mp->b_cont;
1154 		}
1155 		mp = mp1;
1156 	} else {
1157 		/*
1158 		 * Update the state indicating that the data has been consumed.
1159 		 * Keep SS_OOBPEND set until data is consumed past the mark.
1160 		 */
1161 		so->so_oobmsg = NULL;
1162 		so->so_state ^= SS_HAVEOOBDATA|SS_HADOOBDATA;
1163 	}
1164 	ASSERT(so_verify_oobstate(so));
1165 	mutex_exit(&so->so_lock);
1166 
1167 	error = 0;
1168 	nmp = mp;
1169 	while (nmp != NULL && uiop->uio_resid > 0) {
1170 		ssize_t n = MBLKL(nmp);
1171 
1172 		n = MIN(n, uiop->uio_resid);
1173 		if (n > 0)
1174 			error = uiomove(nmp->b_rptr, n,
1175 			    UIO_READ, uiop);
1176 		if (error)
1177 			break;
1178 		nmp = nmp->b_cont;
1179 	}
1180 	ASSERT(mp->b_next == NULL && mp->b_prev == NULL);
1181 	freemsg(mp);
1182 	return (error);
1183 }
1184 
1185 /*
1186  * Allocate and initializ sonode
1187  */
1188 /* ARGSUSED */
1189 struct sonode *
1190 socket_sonode_create(struct sockparams *sp, int family, int type,
1191     int protocol, int version, int sflags, int *errorp, struct cred *cr)
1192 {
1193 	sonode_t *so;
1194 	int	kmflags;
1195 
1196 	/*
1197 	 * Choose the right set of sonodeops based on the upcall and
1198 	 * down call version that the protocol has provided
1199 	 */
1200 	if (SOCK_UC_VERSION != sp->sp_smod_info->smod_uc_version ||
1201 	    SOCK_DC_VERSION != sp->sp_smod_info->smod_dc_version) {
1202 		/*
1203 		 * mismatch
1204 		 */
1205 #ifdef DEBUG
1206 		cmn_err(CE_CONT, "protocol and socket module version mismatch");
1207 #endif
1208 		*errorp = EINVAL;
1209 		return (NULL);
1210 	}
1211 
1212 	kmflags = (sflags & SOCKET_NOSLEEP) ? KM_NOSLEEP : KM_SLEEP;
1213 
1214 	so = kmem_cache_alloc(socket_cache, kmflags);
1215 	if (so == NULL) {
1216 		*errorp = ENOMEM;
1217 		return (NULL);
1218 	}
1219 
1220 	sonode_init(so, sp, family, type, protocol, &so_sonodeops);
1221 
1222 	if (version == SOV_DEFAULT)
1223 		version = so_default_version;
1224 
1225 	so->so_version = (short)version;
1226 
1227 	/*
1228 	 * set the default values to be INFPSZ
1229 	 * if a protocol desires it can change the value later
1230 	 */
1231 	so->so_proto_props.sopp_rxhiwat = SOCKET_RECVHIWATER;
1232 	so->so_proto_props.sopp_rxlowat = SOCKET_RECVLOWATER;
1233 	so->so_proto_props.sopp_maxpsz = INFPSZ;
1234 	so->so_proto_props.sopp_maxblk = INFPSZ;
1235 
1236 	return (so);
1237 }
1238 
1239 int
1240 socket_init_common(struct sonode *so, struct sonode *pso, int flags, cred_t *cr)
1241 {
1242 	int error = 0;
1243 
1244 	if (pso != NULL) {
1245 		/*
1246 		 * We have a passive open, so inherit basic state from
1247 		 * the parent (listener).
1248 		 *
1249 		 * No need to grab the new sonode's lock, since there is no
1250 		 * one that can have a reference to it.
1251 		 */
1252 		mutex_enter(&pso->so_lock);
1253 
1254 		so->so_state |= SS_ISCONNECTED | (pso->so_state & SS_ASYNC);
1255 		so->so_pgrp = pso->so_pgrp;
1256 		so->so_rcvtimeo = pso->so_rcvtimeo;
1257 		so->so_sndtimeo = pso->so_sndtimeo;
1258 		/*
1259 		 * Make note of the socket level options. TCP and IP level
1260 		 * options are already inherited. We could do all this after
1261 		 * accept is successful but doing it here simplifies code and
1262 		 * no harm done for error case.
1263 		 */
1264 		so->so_options = pso->so_options & (SO_DEBUG|SO_REUSEADDR|
1265 		    SO_KEEPALIVE| SO_DONTROUTE|SO_BROADCAST|SO_USELOOPBACK|
1266 		    SO_OOBINLINE|SO_DGRAM_ERRIND|SO_LINGER);
1267 		so->so_proto_props = pso->so_proto_props;
1268 		so->so_mode = pso->so_mode;
1269 
1270 		mutex_exit(&pso->so_lock);
1271 
1272 		if (uioasync.enabled) {
1273 			sod_sock_init(so, NULL, NULL, NULL, &so->so_lock);
1274 		}
1275 		return (0);
1276 	} else {
1277 		struct sockparams *sp = so->so_sockparams;
1278 		sock_upcalls_t *upcalls_to_use;
1279 
1280 		/*
1281 		 * Based on the version number select the right upcalls to
1282 		 * pass down. Currently we only have one version so choose
1283 		 * default
1284 		 */
1285 		upcalls_to_use = &so_upcalls;
1286 
1287 		/* active open, so create a lower handle */
1288 		so->so_proto_handle =
1289 		    sp->sp_smod_info->smod_proto_create_func(so->so_family,
1290 		    so->so_type, so->so_protocol, &so->so_downcalls,
1291 		    &so->so_mode, &error, flags, cr);
1292 
1293 		if (so->so_proto_handle == NULL) {
1294 			ASSERT(error != 0);
1295 			/*
1296 			 * To be safe; if a lower handle cannot be created, and
1297 			 * the proto does not give a reason why, assume there
1298 			 * was a lack of memory.
1299 			 */
1300 			return ((error == 0) ? ENOMEM : error);
1301 		}
1302 		ASSERT(so->so_downcalls != NULL);
1303 		ASSERT(so->so_downcalls->sd_send != NULL ||
1304 		    so->so_downcalls->sd_send_uio != NULL);
1305 		if (so->so_downcalls->sd_recv_uio != NULL) {
1306 			ASSERT(so->so_downcalls->sd_poll != NULL);
1307 			so->so_pollev |= SO_POLLEV_ALWAYS;
1308 		}
1309 
1310 		(*so->so_downcalls->sd_activate)(so->so_proto_handle,
1311 		    (sock_upper_handle_t)so, upcalls_to_use, 0, cr);
1312 
1313 		/* Wildcard */
1314 
1315 		/*
1316 		 * FIXME No need for this, the protocol can deal with it in
1317 		 * sd_create(). Should update ICMP.
1318 		 */
1319 		if (so->so_protocol != so->so_sockparams->sp_protocol) {
1320 			int protocol = so->so_protocol;
1321 			int error;
1322 			/*
1323 			 * Issue SO_PROTOTYPE setsockopt.
1324 			 */
1325 			error = socket_setsockopt(so, SOL_SOCKET, SO_PROTOTYPE,
1326 			    &protocol, (t_uscalar_t)sizeof (protocol), cr);
1327 			if (error) {
1328 				(void) (*so->so_downcalls->sd_close)
1329 				    (so->so_proto_handle, 0, cr);
1330 
1331 				mutex_enter(&so->so_lock);
1332 				so_rcv_flush(so);
1333 				mutex_exit(&so->so_lock);
1334 				/*
1335 				 * Setsockopt often fails with ENOPROTOOPT but
1336 				 * socket() should fail with
1337 				 * EPROTONOSUPPORT/EPROTOTYPE.
1338 				 */
1339 				return (EPROTONOSUPPORT);
1340 			}
1341 		}
1342 		return (0);
1343 	}
1344 }
1345 
1346 /*
1347  * int socket_ioctl_common(struct sonode *so, int cmd, intptr_t arg, int mode,
1348  *         struct cred *cr, int32_t *rvalp)
1349  *
1350  * Handle ioctls that manipulate basic socket state; non-blocking,
1351  * async, etc.
1352  *
1353  * Returns:
1354  *   < 0  - ioctl was not handle
1355  *  >= 0  - ioctl was handled, if > 0, then it is an errno
1356  *
1357  * Notes:
1358  *   Assumes the standard receive buffer is used to obtain info for
1359  *   NREAD.
1360  */
1361 /* ARGSUSED */
1362 int
1363 socket_ioctl_common(struct sonode *so, int cmd, intptr_t arg, int mode,
1364     struct cred *cr, int32_t *rvalp)
1365 {
1366 	switch (cmd) {
1367 	case FIONBIO: {
1368 		int32_t value;
1369 
1370 		if (so_copyin((void *)arg, &value, sizeof (int32_t),
1371 		    (mode & (int)FKIOCTL)))
1372 			return (EFAULT);
1373 
1374 		mutex_enter(&so->so_lock);
1375 		if (value) {
1376 			so->so_state |= SS_NDELAY;
1377 		} else {
1378 			so->so_state &= ~SS_NDELAY;
1379 		}
1380 		mutex_exit(&so->so_lock);
1381 		return (0);
1382 	}
1383 	case FIOASYNC: {
1384 		int32_t value;
1385 
1386 		if (so_copyin((void *)arg, &value, sizeof (int32_t),
1387 		    (mode & (int)FKIOCTL)))
1388 			return (EFAULT);
1389 
1390 		mutex_enter(&so->so_lock);
1391 
1392 		if (value) {
1393 			/* Turn on SIGIO */
1394 			so->so_state |= SS_ASYNC;
1395 		} else {
1396 			/* Turn off SIGIO */
1397 			so->so_state &= ~SS_ASYNC;
1398 		}
1399 		mutex_exit(&so->so_lock);
1400 
1401 		return (0);
1402 	}
1403 
1404 	case SIOCSPGRP:
1405 	case FIOSETOWN: {
1406 		int error;
1407 		pid_t pid;
1408 
1409 		if (so_copyin((void *)arg, &pid, sizeof (pid_t),
1410 		    (mode & (int)FKIOCTL)))
1411 			return (EFAULT);
1412 
1413 		mutex_enter(&so->so_lock);
1414 		error = (pid != so->so_pgrp) ? socket_chgpgrp(so, pid) : 0;
1415 		mutex_exit(&so->so_lock);
1416 		return (error);
1417 	}
1418 	case SIOCGPGRP:
1419 	case FIOGETOWN:
1420 		if (so_copyout(&so->so_pgrp, (void *)arg,
1421 		    sizeof (pid_t), (mode & (int)FKIOCTL)))
1422 			return (EFAULT);
1423 
1424 		return (0);
1425 	case SIOCATMARK: {
1426 		int retval;
1427 
1428 		/*
1429 		 * Only protocols that support urgent data can handle ATMARK.
1430 		 */
1431 		if ((so->so_mode & SM_EXDATA) == 0)
1432 			return (EINVAL);
1433 
1434 		/*
1435 		 * If the protocol is maintaining its own buffer, then the
1436 		 * request must be passed down.
1437 		 */
1438 		if (so->so_downcalls->sd_recv_uio != NULL)
1439 			return (-1);
1440 
1441 		retval = (so->so_state & SS_RCVATMARK) != 0;
1442 
1443 		if (so_copyout(&retval, (void *)arg, sizeof (int),
1444 		    (mode & (int)FKIOCTL))) {
1445 			return (EFAULT);
1446 		}
1447 		return (0);
1448 	}
1449 
1450 	case FIONREAD: {
1451 		int retval;
1452 
1453 		/*
1454 		 * If the protocol is maintaining its own buffer, then the
1455 		 * request must be passed down.
1456 		 */
1457 		if (so->so_downcalls->sd_recv_uio != NULL)
1458 			return (-1);
1459 
1460 		retval = MIN(so->so_rcv_queued, INT_MAX);
1461 
1462 		if (so_copyout(&retval, (void *)arg,
1463 		    sizeof (retval), (mode & (int)FKIOCTL))) {
1464 			return (EFAULT);
1465 		}
1466 		return (0);
1467 	}
1468 
1469 	case _I_GETPEERCRED: {
1470 		int error = 0;
1471 
1472 		if ((mode & FKIOCTL) == 0)
1473 			return (EINVAL);
1474 
1475 		mutex_enter(&so->so_lock);
1476 		if ((so->so_mode & SM_CONNREQUIRED) == 0) {
1477 			error = ENOTSUP;
1478 		} else if ((so->so_state & SS_ISCONNECTED) == 0) {
1479 			error = ENOTCONN;
1480 		} else if (so->so_peercred != NULL) {
1481 			k_peercred_t *kp = (k_peercred_t *)arg;
1482 			kp->pc_cr = so->so_peercred;
1483 			kp->pc_cpid = so->so_cpid;
1484 			crhold(so->so_peercred);
1485 		} else {
1486 			error = EINVAL;
1487 		}
1488 		mutex_exit(&so->so_lock);
1489 		return (error);
1490 	}
1491 	default:
1492 		return (-1);
1493 	}
1494 }
1495 
1496 /*
1497  * Process STREAMS related ioctls. If a I_PUSH/POP operation is specified
1498  * then the socket will fall back to TPI.
1499  *
1500  * Returns:
1501  *   < 0  - ioctl was not handle
1502  *  >= 0  - ioctl was handled, if > 0, then it is an errno
1503  */
1504 int
1505 socket_strioc_common(struct sonode *so, int cmd, intptr_t arg, int mode,
1506     struct cred *cr, int32_t *rvalp)
1507 {
1508 	switch (cmd) {
1509 	case _I_INSERT:
1510 	case _I_REMOVE:
1511 	case I_FIND:
1512 	case I_LIST:
1513 		return (EOPNOTSUPP);
1514 
1515 	case I_PUSH:
1516 	case I_POP: {
1517 		int retval;
1518 
1519 		if ((retval = so_tpi_fallback(so, cr)) == 0) {
1520 			/* Reissue the ioctl */
1521 			ASSERT(so->so_rcv_q_head == NULL);
1522 			return (SOP_IOCTL(so, cmd, arg, mode, cr, rvalp));
1523 		}
1524 		return (retval);
1525 	}
1526 	case I_LOOK:
1527 		if (so_copyout("sockmod", (void *)arg, strlen("sockmod") + 1,
1528 		    (mode & (int)FKIOCTL))) {
1529 			return (EFAULT);
1530 		}
1531 		return (0);
1532 	default:
1533 		return (-1);
1534 	}
1535 }
1536 
1537 int
1538 socket_getopt_common(struct sonode *so, int level, int option_name,
1539     void *optval, socklen_t *optlenp)
1540 {
1541 	if (level != SOL_SOCKET)
1542 		return (-1);
1543 
1544 	switch (option_name) {
1545 	case SO_ERROR:
1546 	case SO_DOMAIN:
1547 	case SO_TYPE:
1548 	case SO_ACCEPTCONN: {
1549 		int32_t value;
1550 		socklen_t optlen = *optlenp;
1551 
1552 		if (optlen < (t_uscalar_t)sizeof (int32_t)) {
1553 			return (EINVAL);
1554 		}
1555 
1556 		switch (option_name) {
1557 		case SO_ERROR:
1558 			mutex_enter(&so->so_lock);
1559 			value = sogeterr(so, B_TRUE);
1560 			mutex_exit(&so->so_lock);
1561 			break;
1562 		case SO_DOMAIN:
1563 			value = so->so_family;
1564 			break;
1565 		case SO_TYPE:
1566 			value = so->so_type;
1567 			break;
1568 		case SO_ACCEPTCONN:
1569 			if (so->so_state & SS_ACCEPTCONN)
1570 				value = SO_ACCEPTCONN;
1571 			else
1572 				value = 0;
1573 			break;
1574 		}
1575 
1576 		bcopy(&value, optval, sizeof (value));
1577 		*optlenp = sizeof (value);
1578 
1579 		return (0);
1580 	}
1581 	case SO_SNDTIMEO:
1582 	case SO_RCVTIMEO: {
1583 		clock_t value;
1584 		socklen_t optlen = *optlenp;
1585 
1586 		if (optlen < (t_uscalar_t)sizeof (struct timeval)) {
1587 			return (EINVAL);
1588 		}
1589 		if (option_name == SO_RCVTIMEO)
1590 			value = drv_hztousec(so->so_rcvtimeo);
1591 		else
1592 			value = drv_hztousec(so->so_sndtimeo);
1593 		((struct timeval *)(optval))->tv_sec = value / (1000 * 1000);
1594 		((struct timeval *)(optval))->tv_usec = value % (1000 * 1000);
1595 		*optlenp = sizeof (struct timeval);
1596 		return (0);
1597 	}
1598 	case SO_DEBUG:
1599 	case SO_REUSEADDR:
1600 	case SO_KEEPALIVE:
1601 	case SO_DONTROUTE:
1602 	case SO_BROADCAST:
1603 	case SO_USELOOPBACK:
1604 	case SO_OOBINLINE:
1605 	case SO_SNDBUF:
1606 	case SO_RCVBUF:
1607 #ifdef notyet
1608 	case SO_SNDLOWAT:
1609 	case SO_RCVLOWAT:
1610 #endif /* notyet */
1611 	case SO_DGRAM_ERRIND: {
1612 		socklen_t optlen = *optlenp;
1613 
1614 		if (optlen < (t_uscalar_t)sizeof (int32_t))
1615 			return (EINVAL);
1616 		break;
1617 	}
1618 	case SO_LINGER: {
1619 		socklen_t optlen = *optlenp;
1620 
1621 		if (optlen < (t_uscalar_t)sizeof (struct linger))
1622 			return (EINVAL);
1623 		break;
1624 	}
1625 	case SO_SND_BUFINFO: {
1626 		socklen_t optlen = *optlenp;
1627 
1628 		if (optlen < (t_uscalar_t)sizeof (struct so_snd_bufinfo))
1629 			return (EINVAL);
1630 		((struct so_snd_bufinfo *)(optval))->sbi_wroff =
1631 		    (so->so_proto_props).sopp_wroff;
1632 		((struct so_snd_bufinfo *)(optval))->sbi_maxblk =
1633 		    (so->so_proto_props).sopp_maxblk;
1634 		((struct so_snd_bufinfo *)(optval))->sbi_maxpsz =
1635 		    (so->so_proto_props).sopp_maxpsz;
1636 		((struct so_snd_bufinfo *)(optval))->sbi_tail =
1637 		    (so->so_proto_props).sopp_tail;
1638 		*optlenp = sizeof (struct so_snd_bufinfo);
1639 		return (0);
1640 	}
1641 	default:
1642 		break;
1643 	}
1644 
1645 	/* Unknown Option */
1646 	return (-1);
1647 }
1648 
1649 void
1650 socket_sonode_destroy(struct sonode *so)
1651 {
1652 	sonode_fini(so);
1653 	kmem_cache_free(socket_cache, so);
1654 }
1655 
1656 int
1657 so_zcopy_wait(struct sonode *so)
1658 {
1659 	int error = 0;
1660 
1661 	mutex_enter(&so->so_lock);
1662 	while (!(so->so_copyflag & STZCNOTIFY)) {
1663 		if (so->so_state & SS_CLOSING) {
1664 			mutex_exit(&so->so_lock);
1665 			return (EINTR);
1666 		}
1667 		if (cv_wait_sig(&so->so_copy_cv, &so->so_lock) == 0) {
1668 			error = EINTR;
1669 			break;
1670 		}
1671 	}
1672 	so->so_copyflag &= ~STZCNOTIFY;
1673 	mutex_exit(&so->so_lock);
1674 	return (error);
1675 }
1676 
1677 void
1678 so_timer_callback(void *arg)
1679 {
1680 	struct sonode *so = (struct sonode *)arg;
1681 
1682 	mutex_enter(&so->so_lock);
1683 
1684 	so->so_rcv_timer_tid = 0;
1685 	if (so->so_rcv_queued > 0) {
1686 		so_notify_data(so, so->so_rcv_queued);
1687 	} else {
1688 		mutex_exit(&so->so_lock);
1689 	}
1690 }
1691 
1692 #ifdef DEBUG
1693 /*
1694  * Verify that the length stored in so_rcv_queued and the length of data blocks
1695  * queued is same.
1696  */
1697 static boolean_t
1698 so_check_length(sonode_t *so)
1699 {
1700 	mblk_t *mp = so->so_rcv_q_head;
1701 	int len = 0;
1702 
1703 	ASSERT(MUTEX_HELD(&so->so_lock));
1704 
1705 	if (mp != NULL) {
1706 		len = msgdsize(mp);
1707 		while ((mp = mp->b_next) != NULL)
1708 			len += msgdsize(mp);
1709 	}
1710 	mp = so->so_rcv_head;
1711 	if (mp != NULL) {
1712 		len += msgdsize(mp);
1713 		while ((mp = mp->b_next) != NULL)
1714 			len += msgdsize(mp);
1715 	}
1716 	return ((len == so->so_rcv_queued) ? B_TRUE : B_FALSE);
1717 }
1718 #endif
1719 
1720 int
1721 so_get_mod_version(struct sockparams *sp)
1722 {
1723 	ASSERT(sp != NULL && sp->sp_smod_info != NULL);
1724 	return (sp->sp_smod_info->smod_version);
1725 }
1726 
1727 /*
1728  * so_start_fallback()
1729  *
1730  * Block new socket operations from coming in, and wait for active operations
1731  * to complete. Threads that are sleeping will be woken up so they can get
1732  * out of the way.
1733  *
1734  * The caller must be a reader on so_fallback_rwlock.
1735  */
1736 static boolean_t
1737 so_start_fallback(struct sonode *so)
1738 {
1739 	ASSERT(RW_READ_HELD(&so->so_fallback_rwlock));
1740 
1741 	mutex_enter(&so->so_lock);
1742 	if (so->so_state & SS_FALLBACK_PENDING) {
1743 		mutex_exit(&so->so_lock);
1744 		return (B_FALSE);
1745 	}
1746 	so->so_state |= SS_FALLBACK_PENDING;
1747 	/*
1748 	 * Poke all threads that might be sleeping. Any operation that comes
1749 	 * in after the cv_broadcast will observe the fallback pending flag
1750 	 * which cause the call to return where it would normally sleep.
1751 	 */
1752 	cv_broadcast(&so->so_state_cv);		/* threads in connect() */
1753 	cv_broadcast(&so->so_rcv_cv);		/* threads in recvmsg() */
1754 	cv_broadcast(&so->so_snd_cv);		/* threads in sendmsg() */
1755 	mutex_enter(&so->so_acceptq_lock);
1756 	cv_broadcast(&so->so_acceptq_cv);	/* threads in accept() */
1757 	mutex_exit(&so->so_acceptq_lock);
1758 	mutex_exit(&so->so_lock);
1759 
1760 	/*
1761 	 * The main reason for the rw_tryupgrade call is to provide
1762 	 * observability during the fallback process. We want to
1763 	 * be able to see if there are pending operations.
1764 	 */
1765 	if (rw_tryupgrade(&so->so_fallback_rwlock) == 0) {
1766 		/*
1767 		 * It is safe to drop and reaquire the fallback lock, because
1768 		 * we are guaranteed that another fallback cannot take place.
1769 		 */
1770 		rw_exit(&so->so_fallback_rwlock);
1771 		DTRACE_PROBE1(pending__ops__wait, (struct sonode *), so);
1772 		rw_enter(&so->so_fallback_rwlock, RW_WRITER);
1773 		DTRACE_PROBE1(pending__ops__complete, (struct sonode *), so);
1774 	}
1775 
1776 	return (B_TRUE);
1777 }
1778 
1779 /*
1780  * so_end_fallback()
1781  *
1782  * Allow socket opertions back in.
1783  *
1784  * The caller must be a writer on so_fallback_rwlock.
1785  */
1786 static void
1787 so_end_fallback(struct sonode *so)
1788 {
1789 	ASSERT(RW_ISWRITER(&so->so_fallback_rwlock));
1790 
1791 	mutex_enter(&so->so_lock);
1792 	so->so_state &= ~SS_FALLBACK_PENDING;
1793 	mutex_exit(&so->so_lock);
1794 
1795 	rw_downgrade(&so->so_fallback_rwlock);
1796 }
1797 
1798 /*
1799  * so_quiesced_cb()
1800  *
1801  * Callback passed to the protocol during fallback. It is called once
1802  * the endpoint is quiescent.
1803  *
1804  * No requests from the user, no notifications from the protocol, so it
1805  * is safe to synchronize the state. Data can also be moved without
1806  * risk for reordering.
1807  *
1808  * NOTE: urgent data is dropped on the floor.
1809  *
1810  * We do not need to hold so_lock, since there can be only one thread
1811  * operating on the sonode.
1812  */
1813 static void
1814 so_quiesced_cb(sock_upper_handle_t sock_handle, queue_t *q,
1815     struct T_capability_ack *tcap, struct sockaddr *laddr, socklen_t laddrlen,
1816     struct sockaddr *faddr, socklen_t faddrlen, short opts)
1817 {
1818 	struct sonode *so = (struct sonode *)sock_handle;
1819 
1820 	sotpi_update_state(so, tcap, laddr, laddrlen, faddr, faddrlen, opts);
1821 
1822 	mutex_enter(&so->so_lock);
1823 	SOCKET_TIMER_CANCEL(so);
1824 	mutex_exit(&so->so_lock);
1825 	/*
1826 	 * Move data to the STREAM head.
1827 	 */
1828 	if (so->so_rcv_head != NULL) {
1829 		if (so->so_rcv_q_last_head == NULL)
1830 			so->so_rcv_q_head = so->so_rcv_head;
1831 		else
1832 			so->so_rcv_q_last_head->b_next = so->so_rcv_head;
1833 		so->so_rcv_q_last_head = so->so_rcv_last_head;
1834 	}
1835 
1836 	while (so->so_rcv_q_head != NULL) {
1837 		mblk_t *mp = so->so_rcv_q_head;
1838 		size_t mlen = msgdsize(mp);
1839 
1840 		so->so_rcv_q_head = mp->b_next;
1841 		mp->b_next = NULL;
1842 		mp->b_prev = NULL;
1843 		so->so_rcv_queued -= mlen;
1844 		putnext(q, mp);
1845 	}
1846 	ASSERT(so->so_rcv_queued == 0);
1847 	so->so_rcv_head = NULL;
1848 	so->so_rcv_last_head = NULL;
1849 	so->so_rcv_q_head = NULL;
1850 	so->so_rcv_q_last_head = NULL;
1851 
1852 #ifdef DEBUG
1853 	if (so->so_oobmsg != NULL || so->so_oobmark > 0) {
1854 		cmn_err(CE_NOTE, "losing oob data due to tpi fallback\n");
1855 	}
1856 #endif
1857 	if (so->so_oobmsg != NULL) {
1858 		freemsg(so->so_oobmsg);
1859 		so->so_oobmsg = NULL;
1860 	}
1861 	so->so_oobmark = 0;
1862 
1863 	ASSERT(so->so_rcv_queued == 0);
1864 }
1865 
1866 /*
1867  * so_tpi_fallback()
1868  *
1869  * This is fallback initation routine; things start here.
1870  *
1871  * Basic strategy:
1872  *   o Block new socket operations from coming in
1873  *   o Allocate/initate info needed by TPI
1874  *   o Quiesce the connection, at which point we sync
1875  *     state and move data
1876  *   o Change operations (sonodeops) associated with the socket
1877  *   o Unblock threads waiting for the fallback to finish
1878  */
1879 int
1880 so_tpi_fallback(struct sonode *so, struct cred *cr)
1881 {
1882 	int error;
1883 	queue_t *q;
1884 	struct sockparams *sp;
1885 	struct sockparams *newsp;
1886 	so_proto_fallback_func_t fbfunc;
1887 	boolean_t direct;
1888 
1889 	error = 0;
1890 	sp = so->so_sockparams;
1891 	fbfunc = sp->sp_smod_info->smod_proto_fallback_func;
1892 
1893 	/*
1894 	 * Fallback can only happen if there is a device associated
1895 	 * with the sonode, and the socket module has a fallback function.
1896 	 */
1897 	if (!SOCKPARAMS_HAS_DEVICE(sp) || fbfunc == NULL)
1898 		return (EINVAL);
1899 
1900 	/*
1901 	 * Initiate fallback; upon success we know that no new requests
1902 	 * will come in from the user.
1903 	 */
1904 	if (!so_start_fallback(so))
1905 		return (EAGAIN);
1906 
1907 	newsp = sockparams_hold_ephemeral_bydev(so->so_family, so->so_type,
1908 	    so->so_protocol, so->so_sockparams->sp_sdev_info.sd_devpath,
1909 	    KM_SLEEP, &error);
1910 	if (error != 0)
1911 		goto out;
1912 
1913 	if (so->so_direct != NULL) {
1914 		sodirect_t *sodp = so->so_direct;
1915 		mutex_enter(sodp->sod_lockp);
1916 
1917 		so->so_direct->sod_state &= ~SOD_ENABLED;
1918 		so->so_state &= ~SS_SODIRECT;
1919 		ASSERT(sodp->sod_uioafh == NULL);
1920 		mutex_exit(sodp->sod_lockp);
1921 	}
1922 
1923 	/* Turn sonode into a TPI socket */
1924 	q = sotpi_convert_sonode(so, newsp, &direct, cr);
1925 	if (q == NULL) {
1926 		zcmn_err(getzoneid(), CE_WARN,
1927 		    "Failed to convert socket to TPI. Pid = %d\n",
1928 		    curproc->p_pid);
1929 		SOCKPARAMS_DEC_REF(newsp);
1930 		error = EINVAL;
1931 		goto out;
1932 	}
1933 
1934 	/*
1935 	 * Now tell the protocol to start using TPI. so_quiesced_cb be
1936 	 * called once it's safe to synchronize state.
1937 	 */
1938 	DTRACE_PROBE1(proto__fallback__begin, struct sonode *, so);
1939 	/* FIXME assumes this cannot fail. TCP can fail to enter squeue */
1940 	(*fbfunc)(so->so_proto_handle, q, direct, so_quiesced_cb);
1941 	DTRACE_PROBE1(proto__fallback__end, struct sonode *, so);
1942 
1943 	/*
1944 	 * Free all pending connection indications, i.e., socket_accept() has
1945 	 * not yet pulled the connection of the queue. The transport sent
1946 	 * a T_CONN_IND message for each pending connection to the STREAM head.
1947 	 */
1948 	so_acceptq_flush(so);
1949 
1950 	mutex_enter(&so->so_lock);
1951 	so->so_state |= SS_FALLBACK_COMP;
1952 	mutex_exit(&so->so_lock);
1953 
1954 	/*
1955 	 * Swap the sonode ops. Socket opertations that come in once this
1956 	 * is done will proceed without blocking.
1957 	 */
1958 	so->so_ops = &sotpi_sonodeops;
1959 
1960 	/*
1961 	 * Wake up any threads stuck in poll. This is needed since the poll
1962 	 * head changes when the fallback happens (moves from the sonode to
1963 	 * the STREAMS head).
1964 	 */
1965 	pollwakeup(&so->so_poll_list, POLLERR);
1966 out:
1967 	so_end_fallback(so);
1968 
1969 	return (error);
1970 }
1971