xref: /titanic_41/usr/src/uts/common/os/streamio.c (revision 4a0fa5460e94a33980ceffce0ba3db8802570449)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*	Copyright (c) 1984, 1986, 1987, 1988, 1989 AT&T	*/
22 /*	  All Rights Reserved  	*/
23 
24 
25 /*
26  * Copyright (c) 1988, 2010, Oracle and/or its affiliates. All rights reserved.
27  */
28 
29 #include <sys/types.h>
30 #include <sys/sysmacros.h>
31 #include <sys/param.h>
32 #include <sys/errno.h>
33 #include <sys/signal.h>
34 #include <sys/stat.h>
35 #include <sys/proc.h>
36 #include <sys/cred.h>
37 #include <sys/user.h>
38 #include <sys/vnode.h>
39 #include <sys/file.h>
40 #include <sys/stream.h>
41 #include <sys/strsubr.h>
42 #include <sys/stropts.h>
43 #include <sys/tihdr.h>
44 #include <sys/var.h>
45 #include <sys/poll.h>
46 #include <sys/termio.h>
47 #include <sys/ttold.h>
48 #include <sys/systm.h>
49 #include <sys/uio.h>
50 #include <sys/cmn_err.h>
51 #include <sys/sad.h>
52 #include <sys/netstack.h>
53 #include <sys/priocntl.h>
54 #include <sys/jioctl.h>
55 #include <sys/procset.h>
56 #include <sys/session.h>
57 #include <sys/kmem.h>
58 #include <sys/filio.h>
59 #include <sys/vtrace.h>
60 #include <sys/debug.h>
61 #include <sys/strredir.h>
62 #include <sys/fs/fifonode.h>
63 #include <sys/fs/snode.h>
64 #include <sys/strlog.h>
65 #include <sys/strsun.h>
66 #include <sys/project.h>
67 #include <sys/kbio.h>
68 #include <sys/msio.h>
69 #include <sys/tty.h>
70 #include <sys/ptyvar.h>
71 #include <sys/vuid_event.h>
72 #include <sys/modctl.h>
73 #include <sys/sunddi.h>
74 #include <sys/sunldi_impl.h>
75 #include <sys/autoconf.h>
76 #include <sys/policy.h>
77 #include <sys/dld.h>
78 #include <sys/zone.h>
79 #include <c2/audit.h>
80 
81 /*
82  * This define helps improve the readability of streams code while
83  * still maintaining a very old streams performance enhancement.  The
84  * performance enhancement basically involved having all callers
85  * of straccess() perform the first check that straccess() will do
86  * locally before actually calling straccess().  (There by reducing
87  * the number of unnecessary calls to straccess().)
88  */
89 #define	i_straccess(x, y)	((stp->sd_sidp == NULL) ? 0 : \
90 				    (stp->sd_vnode->v_type == VFIFO) ? 0 : \
91 				    straccess((x), (y)))
92 
93 /*
94  * what is mblk_pull_len?
95  *
96  * If a streams message consists of many short messages,
97  * a performance degradation occurs from copyout overhead.
98  * To decrease the per mblk overhead, messages that are
99  * likely to consist of many small mblks are pulled up into
100  * one continuous chunk of memory.
101  *
102  * To avoid the processing overhead of examining every
103  * mblk, a quick heuristic is used. If the first mblk in
104  * the message is shorter than mblk_pull_len, it is likely
105  * that the rest of the mblk will be short.
106  *
107  * This heuristic was decided upon after performance tests
108  * indicated that anything more complex slowed down the main
109  * code path.
110  */
111 #define	MBLK_PULL_LEN 64
112 uint32_t mblk_pull_len = MBLK_PULL_LEN;
113 
114 /*
115  * The sgttyb_handling flag controls the handling of the old BSD
116  * TIOCGETP, TIOCSETP, and TIOCSETN ioctls as follows:
117  *
118  * 0 - Emit no warnings at all and retain old, broken behavior.
119  * 1 - Emit no warnings and silently handle new semantics.
120  * 2 - Send cmn_err(CE_NOTE) when either TIOCSETP or TIOCSETN is used
121  *     (once per system invocation).  Handle with new semantics.
122  * 3 - Send SIGSYS when any TIOCGETP, TIOCSETP, or TIOCSETN call is
123  *     made (so that offenders drop core and are easy to debug).
124  *
125  * The "new semantics" are that TIOCGETP returns B38400 for
126  * sg_[io]speed if the corresponding value is over B38400, and that
127  * TIOCSET[PN] accept B38400 in these cases to mean "retain current
128  * bit rate."
129  */
130 int sgttyb_handling = 1;
131 static boolean_t sgttyb_complaint;
132 
133 /* don't push drcompat module by default on Style-2 streams */
134 static int push_drcompat = 0;
135 
136 /*
137  * id value used to distinguish between different ioctl messages
138  */
139 static uint32_t ioc_id;
140 
141 static void putback(struct stdata *, queue_t *, mblk_t *, int);
142 static void strcleanall(struct vnode *);
143 static int strwsrv(queue_t *);
144 static int strdocmd(struct stdata *, struct strcmd *, cred_t *);
145 
146 /*
147  * qinit and module_info structures for stream head read and write queues
148  */
149 struct module_info strm_info = { 0, "strrhead", 0, INFPSZ, STRHIGH, STRLOW };
150 struct module_info stwm_info = { 0, "strwhead", 0, 0, 0, 0 };
151 struct qinit strdata = { strrput, NULL, NULL, NULL, NULL, &strm_info };
152 struct qinit stwdata = { NULL, strwsrv, NULL, NULL, NULL, &stwm_info };
153 struct module_info fiform_info = { 0, "fifostrrhead", 0, PIPE_BUF, FIFOHIWAT,
154     FIFOLOWAT };
155 struct module_info fifowm_info = { 0, "fifostrwhead", 0, 0, 0, 0 };
156 struct qinit fifo_strdata = { strrput, NULL, NULL, NULL, NULL, &fiform_info };
157 struct qinit fifo_stwdata = { NULL, strwsrv, NULL, NULL, NULL, &fifowm_info };
158 
159 extern kmutex_t	strresources;	/* protects global resources */
160 extern kmutex_t muxifier;	/* single-threads multiplexor creation */
161 
162 static boolean_t msghasdata(mblk_t *bp);
163 #define	msgnodata(bp) (!msghasdata(bp))
164 
165 /*
166  * Stream head locking notes:
167  *	There are four monitors associated with the stream head:
168  *	1. v_stream monitor: in stropen() and strclose() v_lock
169  *		is held while the association of vnode and stream
170  *		head is established or tested for.
171  *	2. open/close/push/pop monitor: sd_lock is held while each
172  *		thread bids for exclusive access to this monitor
173  *		for opening or closing a stream.  In addition, this
174  *		monitor is entered during pushes and pops.  This
175  *		guarantees that during plumbing operations there
176  *		is only one thread trying to change the plumbing.
177  *		Any other threads present in the stream are only
178  *		using the plumbing.
179  *	3. read/write monitor: in the case of read, a thread holds
180  *		sd_lock while trying to get data from the stream
181  *		head queue.  if there is none to fulfill a read
182  *		request, it sets RSLEEP and calls cv_wait_sig() down
183  *		in strwaitq() to await the arrival of new data.
184  *		when new data arrives in strrput(), sd_lock is acquired
185  *		before testing for RSLEEP and calling cv_broadcast().
186  *		the behavior of strwrite(), strwsrv(), and WSLEEP
187  *		mirror this.
188  *	4. ioctl monitor: sd_lock is gotten to ensure that only one
189  *		thread is doing an ioctl at a time.
190  */
191 
192 static int
push_mod(queue_t * qp,dev_t * devp,struct stdata * stp,const char * name,int anchor,cred_t * crp,uint_t anchor_zoneid)193 push_mod(queue_t *qp, dev_t *devp, struct stdata *stp, const char *name,
194     int anchor, cred_t *crp, uint_t anchor_zoneid)
195 {
196 	int error;
197 	fmodsw_impl_t *fp;
198 
199 	if (stp->sd_flag & (STRHUP|STRDERR|STWRERR)) {
200 		error = (stp->sd_flag & STRHUP) ? ENXIO : EIO;
201 		return (error);
202 	}
203 	if (stp->sd_pushcnt >= nstrpush) {
204 		return (EINVAL);
205 	}
206 
207 	if ((fp = fmodsw_find(name, FMODSW_HOLD | FMODSW_LOAD)) == NULL) {
208 		stp->sd_flag |= STREOPENFAIL;
209 		return (EINVAL);
210 	}
211 
212 	/*
213 	 * push new module and call its open routine via qattach
214 	 */
215 	if ((error = qattach(qp, devp, 0, crp, fp, B_FALSE)) != 0)
216 		return (error);
217 
218 	/*
219 	 * Check to see if caller wants a STREAMS anchor
220 	 * put at this place in the stream, and add if so.
221 	 */
222 	mutex_enter(&stp->sd_lock);
223 	if (anchor == stp->sd_pushcnt) {
224 		stp->sd_anchor = stp->sd_pushcnt;
225 		stp->sd_anchorzone = anchor_zoneid;
226 	}
227 	mutex_exit(&stp->sd_lock);
228 
229 	return (0);
230 }
231 
232 /*
233  * Open a stream device.
234  */
235 int
stropen(vnode_t * vp,dev_t * devp,int flag,cred_t * crp)236 stropen(vnode_t *vp, dev_t *devp, int flag, cred_t *crp)
237 {
238 	struct stdata *stp;
239 	queue_t *qp;
240 	int s;
241 	dev_t dummydev, savedev;
242 	struct autopush *ap;
243 	struct dlautopush dlap;
244 	int error = 0;
245 	ssize_t	rmin, rmax;
246 	int cloneopen;
247 	queue_t *brq;
248 	major_t major;
249 	str_stack_t *ss;
250 	zoneid_t zoneid;
251 	uint_t anchor;
252 
253 	/*
254 	 * If the stream already exists, wait for any open in progress
255 	 * to complete, then call the open function of each module and
256 	 * driver in the stream.  Otherwise create the stream.
257 	 */
258 	TRACE_1(TR_FAC_STREAMS_FR, TR_STROPEN, "stropen:%p", vp);
259 retry:
260 	mutex_enter(&vp->v_lock);
261 	if ((stp = vp->v_stream) != NULL) {
262 
263 		/*
264 		 * Waiting for stream to be created to device
265 		 * due to another open.
266 		 */
267 		mutex_exit(&vp->v_lock);
268 
269 		if (STRMATED(stp)) {
270 			struct stdata *strmatep = stp->sd_mate;
271 
272 			STRLOCKMATES(stp);
273 			if (strmatep->sd_flag & (STWOPEN|STRCLOSE|STRPLUMB)) {
274 				if (flag & (FNDELAY|FNONBLOCK)) {
275 					error = EAGAIN;
276 					mutex_exit(&strmatep->sd_lock);
277 					goto ckreturn;
278 				}
279 				mutex_exit(&stp->sd_lock);
280 				if (!cv_wait_sig(&strmatep->sd_monitor,
281 				    &strmatep->sd_lock)) {
282 					error = EINTR;
283 					mutex_exit(&strmatep->sd_lock);
284 					mutex_enter(&stp->sd_lock);
285 					goto ckreturn;
286 				}
287 				mutex_exit(&strmatep->sd_lock);
288 				goto retry;
289 			}
290 			if (stp->sd_flag & (STWOPEN|STRCLOSE|STRPLUMB)) {
291 				if (flag & (FNDELAY|FNONBLOCK)) {
292 					error = EAGAIN;
293 					mutex_exit(&strmatep->sd_lock);
294 					goto ckreturn;
295 				}
296 				mutex_exit(&strmatep->sd_lock);
297 				if (!cv_wait_sig(&stp->sd_monitor,
298 				    &stp->sd_lock)) {
299 					error = EINTR;
300 					goto ckreturn;
301 				}
302 				mutex_exit(&stp->sd_lock);
303 				goto retry;
304 			}
305 
306 			if (stp->sd_flag & (STRDERR|STWRERR)) {
307 				error = EIO;
308 				mutex_exit(&strmatep->sd_lock);
309 				goto ckreturn;
310 			}
311 
312 			stp->sd_flag |= STWOPEN;
313 			STRUNLOCKMATES(stp);
314 		} else {
315 			mutex_enter(&stp->sd_lock);
316 			if (stp->sd_flag & (STWOPEN|STRCLOSE|STRPLUMB)) {
317 				if (flag & (FNDELAY|FNONBLOCK)) {
318 					error = EAGAIN;
319 					goto ckreturn;
320 				}
321 				if (!cv_wait_sig(&stp->sd_monitor,
322 				    &stp->sd_lock)) {
323 					error = EINTR;
324 					goto ckreturn;
325 				}
326 				mutex_exit(&stp->sd_lock);
327 				goto retry;  /* could be clone! */
328 			}
329 
330 			if (stp->sd_flag & (STRDERR|STWRERR)) {
331 				error = EIO;
332 				goto ckreturn;
333 			}
334 
335 			stp->sd_flag |= STWOPEN;
336 			mutex_exit(&stp->sd_lock);
337 		}
338 
339 		/*
340 		 * Open all modules and devices down stream to notify
341 		 * that another user is streaming.  For modules, set the
342 		 * last argument to MODOPEN and do not pass any open flags.
343 		 * Ignore dummydev since this is not the first open.
344 		 */
345 		claimstr(stp->sd_wrq);
346 		qp = stp->sd_wrq;
347 		while (_SAMESTR(qp)) {
348 			qp = qp->q_next;
349 			if ((error = qreopen(_RD(qp), devp, flag, crp)) != 0)
350 				break;
351 		}
352 		releasestr(stp->sd_wrq);
353 		mutex_enter(&stp->sd_lock);
354 		stp->sd_flag &= ~(STRHUP|STWOPEN|STRDERR|STWRERR);
355 		stp->sd_rerror = 0;
356 		stp->sd_werror = 0;
357 ckreturn:
358 		cv_broadcast(&stp->sd_monitor);
359 		mutex_exit(&stp->sd_lock);
360 		return (error);
361 	}
362 
363 	/*
364 	 * This vnode isn't streaming.  SPECFS already
365 	 * checked for multiple vnodes pointing to the
366 	 * same stream, so create a stream to the driver.
367 	 */
368 	qp = allocq();
369 	stp = shalloc(qp);
370 
371 	/*
372 	 * Initialize stream head.  shalloc() has given us
373 	 * exclusive access, and we have the vnode locked;
374 	 * we can do whatever we want with stp.
375 	 */
376 	stp->sd_flag = STWOPEN;
377 	stp->sd_siglist = NULL;
378 	stp->sd_pollist.ph_list = NULL;
379 	stp->sd_sigflags = 0;
380 	stp->sd_mark = NULL;
381 	stp->sd_closetime = STRTIMOUT;
382 	stp->sd_sidp = NULL;
383 	stp->sd_pgidp = NULL;
384 	stp->sd_vnode = vp;
385 	stp->sd_rerror = 0;
386 	stp->sd_werror = 0;
387 	stp->sd_wroff = 0;
388 	stp->sd_tail = 0;
389 	stp->sd_iocblk = NULL;
390 	stp->sd_cmdblk = NULL;
391 	stp->sd_pushcnt = 0;
392 	stp->sd_qn_minpsz = 0;
393 	stp->sd_qn_maxpsz = INFPSZ - 1;	/* used to check for initialization */
394 	stp->sd_maxblk = INFPSZ;
395 	qp->q_ptr = _WR(qp)->q_ptr = stp;
396 	STREAM(qp) = STREAM(_WR(qp)) = stp;
397 	vp->v_stream = stp;
398 	mutex_exit(&vp->v_lock);
399 	if (vp->v_type == VFIFO) {
400 		stp->sd_flag |= OLDNDELAY;
401 		/*
402 		 * This means, both for pipes and fifos
403 		 * strwrite will send SIGPIPE if the other
404 		 * end is closed. For putmsg it depends
405 		 * on whether it is a XPG4_2 application
406 		 * or not
407 		 */
408 		stp->sd_wput_opt = SW_SIGPIPE;
409 
410 		/* setq might sleep in kmem_alloc - avoid holding locks. */
411 		setq(qp, &fifo_strdata, &fifo_stwdata, NULL, QMTSAFE,
412 		    SQ_CI|SQ_CO, B_FALSE);
413 
414 		set_qend(qp);
415 		stp->sd_strtab = fifo_getinfo();
416 		_WR(qp)->q_nfsrv = _WR(qp);
417 		qp->q_nfsrv = qp;
418 		/*
419 		 * Wake up others that are waiting for stream to be created.
420 		 */
421 		mutex_enter(&stp->sd_lock);
422 		/*
423 		 * nothing is be pushed on stream yet, so
424 		 * optimized stream head packetsizes are just that
425 		 * of the read queue
426 		 */
427 		stp->sd_qn_minpsz = qp->q_minpsz;
428 		stp->sd_qn_maxpsz = qp->q_maxpsz;
429 		stp->sd_flag &= ~STWOPEN;
430 		goto fifo_opendone;
431 	}
432 	/* setq might sleep in kmem_alloc - avoid holding locks. */
433 	setq(qp, &strdata, &stwdata, NULL, QMTSAFE, SQ_CI|SQ_CO, B_FALSE);
434 
435 	set_qend(qp);
436 
437 	/*
438 	 * Open driver and create stream to it (via qattach).
439 	 */
440 	savedev = *devp;
441 	cloneopen = (getmajor(*devp) == clone_major);
442 	if ((error = qattach(qp, devp, flag, crp, NULL, B_FALSE)) != 0) {
443 		mutex_enter(&vp->v_lock);
444 		vp->v_stream = NULL;
445 		mutex_exit(&vp->v_lock);
446 		mutex_enter(&stp->sd_lock);
447 		cv_broadcast(&stp->sd_monitor);
448 		mutex_exit(&stp->sd_lock);
449 		freeq(_RD(qp));
450 		shfree(stp);
451 		return (error);
452 	}
453 	/*
454 	 * Set sd_strtab after open in order to handle clonable drivers
455 	 */
456 	stp->sd_strtab = STREAMSTAB(getmajor(*devp));
457 
458 	/*
459 	 * Historical note: dummydev used to be be prior to the initial
460 	 * open (via qattach above), which made the value seen
461 	 * inconsistent between an I_PUSH and an autopush of a module.
462 	 */
463 	dummydev = *devp;
464 
465 	/*
466 	 * For clone open of old style (Q not associated) network driver,
467 	 * push DRMODNAME module to handle DL_ATTACH/DL_DETACH
468 	 */
469 	brq = _RD(_WR(qp)->q_next);
470 	major = getmajor(*devp);
471 	if (push_drcompat && cloneopen && NETWORK_DRV(major) &&
472 	    ((brq->q_flag & _QASSOCIATED) == 0)) {
473 		if (push_mod(qp, &dummydev, stp, DRMODNAME, 0, crp, 0) != 0)
474 			cmn_err(CE_WARN, "cannot push " DRMODNAME
475 			    " streams module");
476 	}
477 
478 	if (!NETWORK_DRV(major)) {
479 		savedev = *devp;
480 	} else {
481 		/*
482 		 * For network devices, process differently based on the
483 		 * return value from dld_autopush():
484 		 *
485 		 *   0: the passed-in device points to a GLDv3 datalink with
486 		 *   per-link autopush configuration; use that configuration
487 		 *   and ignore any per-driver autopush configuration.
488 		 *
489 		 *   1: the passed-in device points to a physical GLDv3
490 		 *   datalink without per-link autopush configuration.  The
491 		 *   passed in device was changed to refer to the actual
492 		 *   physical device (if it's not already); we use that new
493 		 *   device to look up any per-driver autopush configuration.
494 		 *
495 		 *   -1: neither of the above cases applied; use the initial
496 		 *   device to look up any per-driver autopush configuration.
497 		 */
498 		switch (dld_autopush(&savedev, &dlap)) {
499 		case 0:
500 			zoneid = crgetzoneid(crp);
501 			for (s = 0; s < dlap.dap_npush; s++) {
502 				error = push_mod(qp, &dummydev, stp,
503 				    dlap.dap_aplist[s], dlap.dap_anchor, crp,
504 				    zoneid);
505 				if (error != 0)
506 					break;
507 			}
508 			goto opendone;
509 		case 1:
510 			break;
511 		case -1:
512 			savedev = *devp;
513 			break;
514 		}
515 	}
516 	/*
517 	 * Find the autopush configuration based on "savedev". Start with the
518 	 * global zone. If not found check in the local zone.
519 	 */
520 	zoneid = GLOBAL_ZONEID;
521 retryap:
522 	ss = netstack_find_by_stackid(zoneid_to_netstackid(zoneid))->
523 	    netstack_str;
524 	if ((ap = sad_ap_find_by_dev(savedev, ss)) == NULL) {
525 		netstack_rele(ss->ss_netstack);
526 		if (zoneid == GLOBAL_ZONEID) {
527 			/*
528 			 * None found. Also look in the zone's autopush table.
529 			 */
530 			zoneid = crgetzoneid(crp);
531 			if (zoneid != GLOBAL_ZONEID)
532 				goto retryap;
533 		}
534 		goto opendone;
535 	}
536 	anchor = ap->ap_anchor;
537 	zoneid = crgetzoneid(crp);
538 	for (s = 0; s < ap->ap_npush; s++) {
539 		error = push_mod(qp, &dummydev, stp, ap->ap_list[s],
540 		    anchor, crp, zoneid);
541 		if (error != 0)
542 			break;
543 	}
544 	sad_ap_rele(ap, ss);
545 	netstack_rele(ss->ss_netstack);
546 
547 opendone:
548 
549 	/*
550 	 * let specfs know that open failed part way through
551 	 */
552 	if (error) {
553 		mutex_enter(&stp->sd_lock);
554 		stp->sd_flag |= STREOPENFAIL;
555 		mutex_exit(&stp->sd_lock);
556 	}
557 
558 	/*
559 	 * Wake up others that are waiting for stream to be created.
560 	 */
561 	mutex_enter(&stp->sd_lock);
562 	stp->sd_flag &= ~STWOPEN;
563 
564 	/*
565 	 * As a performance concern we are caching the values of
566 	 * q_minpsz and q_maxpsz of the module below the stream
567 	 * head in the stream head.
568 	 */
569 	mutex_enter(QLOCK(stp->sd_wrq->q_next));
570 	rmin = stp->sd_wrq->q_next->q_minpsz;
571 	rmax = stp->sd_wrq->q_next->q_maxpsz;
572 	mutex_exit(QLOCK(stp->sd_wrq->q_next));
573 
574 	/* do this processing here as a performance concern */
575 	if (strmsgsz != 0) {
576 		if (rmax == INFPSZ)
577 			rmax = strmsgsz;
578 		else
579 			rmax = MIN(strmsgsz, rmax);
580 	}
581 
582 	mutex_enter(QLOCK(stp->sd_wrq));
583 	stp->sd_qn_minpsz = rmin;
584 	stp->sd_qn_maxpsz = rmax;
585 	mutex_exit(QLOCK(stp->sd_wrq));
586 
587 fifo_opendone:
588 	cv_broadcast(&stp->sd_monitor);
589 	mutex_exit(&stp->sd_lock);
590 	return (error);
591 }
592 
593 static int strsink(queue_t *, mblk_t *);
594 static struct qinit deadrend = {
595 	strsink, NULL, NULL, NULL, NULL, &strm_info, NULL
596 };
597 static struct qinit deadwend = {
598 	NULL, NULL, NULL, NULL, NULL, &stwm_info, NULL
599 };
600 
601 /*
602  * Close a stream.
603  * This is called from closef() on the last close of an open stream.
604  * Strclean() will already have removed the siglist and pollist
605  * information, so all that remains is to remove all multiplexor links
606  * for the stream, pop all the modules (and the driver), and free the
607  * stream structure.
608  */
609 
610 int
strclose(struct vnode * vp,int flag,cred_t * crp)611 strclose(struct vnode *vp, int flag, cred_t *crp)
612 {
613 	struct stdata *stp;
614 	queue_t *qp;
615 	int rval;
616 	int freestp = 1;
617 	queue_t *rmq;
618 
619 	TRACE_1(TR_FAC_STREAMS_FR,
620 	    TR_STRCLOSE, "strclose:%p", vp);
621 	ASSERT(vp->v_stream);
622 
623 	stp = vp->v_stream;
624 	ASSERT(!(stp->sd_flag & STPLEX));
625 	qp = stp->sd_wrq;
626 
627 	/*
628 	 * Needed so that strpoll will return non-zero for this fd.
629 	 * Note that with POLLNOERR STRHUP does still cause POLLHUP.
630 	 */
631 	mutex_enter(&stp->sd_lock);
632 	stp->sd_flag |= STRHUP;
633 	mutex_exit(&stp->sd_lock);
634 
635 	/*
636 	 * If the registered process or process group did not have an
637 	 * open instance of this stream then strclean would not be
638 	 * called. Thus at the time of closing all remaining siglist entries
639 	 * are removed.
640 	 */
641 	if (stp->sd_siglist != NULL)
642 		strcleanall(vp);
643 
644 	ASSERT(stp->sd_siglist == NULL);
645 	ASSERT(stp->sd_sigflags == 0);
646 
647 	if (STRMATED(stp)) {
648 		struct stdata *strmatep = stp->sd_mate;
649 		int waited = 1;
650 
651 		STRLOCKMATES(stp);
652 		while (waited) {
653 			waited = 0;
654 			while (stp->sd_flag & (STWOPEN|STRCLOSE|STRPLUMB)) {
655 				mutex_exit(&strmatep->sd_lock);
656 				cv_wait(&stp->sd_monitor, &stp->sd_lock);
657 				mutex_exit(&stp->sd_lock);
658 				STRLOCKMATES(stp);
659 				waited = 1;
660 			}
661 			while (strmatep->sd_flag &
662 			    (STWOPEN|STRCLOSE|STRPLUMB)) {
663 				mutex_exit(&stp->sd_lock);
664 				cv_wait(&strmatep->sd_monitor,
665 				    &strmatep->sd_lock);
666 				mutex_exit(&strmatep->sd_lock);
667 				STRLOCKMATES(stp);
668 				waited = 1;
669 			}
670 		}
671 		stp->sd_flag |= STRCLOSE;
672 		STRUNLOCKMATES(stp);
673 	} else {
674 		mutex_enter(&stp->sd_lock);
675 		stp->sd_flag |= STRCLOSE;
676 		mutex_exit(&stp->sd_lock);
677 	}
678 
679 	ASSERT(qp->q_first == NULL);	/* No more delayed write */
680 
681 	/* Check if an I_LINK was ever done on this stream */
682 	if (stp->sd_flag & STRHASLINKS) {
683 		netstack_t *ns;
684 		str_stack_t *ss;
685 
686 		ns = netstack_find_by_cred(crp);
687 		ASSERT(ns != NULL);
688 		ss = ns->netstack_str;
689 		ASSERT(ss != NULL);
690 
691 		(void) munlinkall(stp, LINKCLOSE|LINKNORMAL, crp, &rval, ss);
692 		netstack_rele(ss->ss_netstack);
693 	}
694 
695 	while (_SAMESTR(qp)) {
696 		/*
697 		 * Holding sd_lock prevents q_next from changing in
698 		 * this stream.
699 		 */
700 		mutex_enter(&stp->sd_lock);
701 		if (!(flag & (FNDELAY|FNONBLOCK)) && (stp->sd_closetime > 0)) {
702 
703 			/*
704 			 * sleep until awakened by strwsrv() or timeout
705 			 */
706 			for (;;) {
707 				mutex_enter(QLOCK(qp->q_next));
708 				if (!(qp->q_next->q_mblkcnt)) {
709 					mutex_exit(QLOCK(qp->q_next));
710 					break;
711 				}
712 				stp->sd_flag |= WSLEEP;
713 
714 				/* ensure strwsrv gets enabled */
715 				qp->q_next->q_flag |= QWANTW;
716 				mutex_exit(QLOCK(qp->q_next));
717 				/* get out if we timed out or recv'd a signal */
718 				if (str_cv_wait(&qp->q_wait, &stp->sd_lock,
719 				    stp->sd_closetime, 0) <= 0) {
720 					break;
721 				}
722 			}
723 			stp->sd_flag &= ~WSLEEP;
724 		}
725 		mutex_exit(&stp->sd_lock);
726 
727 		rmq = qp->q_next;
728 		if (rmq->q_flag & QISDRV) {
729 			ASSERT(!_SAMESTR(rmq));
730 			wait_sq_svc(_RD(qp)->q_syncq);
731 		}
732 
733 		qdetach(_RD(rmq), 1, flag, crp, B_FALSE);
734 	}
735 
736 	/*
737 	 * Since we call pollwakeup in close() now, the poll list should
738 	 * be empty in most cases. The only exception is the layered devices
739 	 * (e.g. the console drivers with redirection modules pushed on top
740 	 * of it).  We have to do this after calling qdetach() because
741 	 * the redirection module won't have torn down the console
742 	 * redirection until after qdetach() has been invoked.
743 	 */
744 	if (stp->sd_pollist.ph_list != NULL) {
745 		pollwakeup(&stp->sd_pollist, POLLERR);
746 		pollhead_clean(&stp->sd_pollist);
747 	}
748 	ASSERT(stp->sd_pollist.ph_list == NULL);
749 	ASSERT(stp->sd_sidp == NULL);
750 	ASSERT(stp->sd_pgidp == NULL);
751 
752 	/* Prevent qenable from re-enabling the stream head queue */
753 	disable_svc(_RD(qp));
754 
755 	/*
756 	 * Wait until service procedure of each queue is
757 	 * run, if QINSERVICE is set.
758 	 */
759 	wait_svc(_RD(qp));
760 
761 	/*
762 	 * Now, flush both queues.
763 	 */
764 	flushq(_RD(qp), FLUSHALL);
765 	flushq(qp, FLUSHALL);
766 
767 	/*
768 	 * If the write queue of the stream head is pointing to a
769 	 * read queue, we have a twisted stream.  If the read queue
770 	 * is alive, convert the stream head queues into a dead end.
771 	 * If the read queue is dead, free the dead pair.
772 	 */
773 	if (qp->q_next && !_SAMESTR(qp)) {
774 		if (qp->q_next->q_qinfo == &deadrend) {	/* half-closed pipe */
775 			flushq(qp->q_next, FLUSHALL); /* ensure no message */
776 			shfree(qp->q_next->q_stream);
777 			freeq(qp->q_next);
778 			freeq(_RD(qp));
779 		} else if (qp->q_next == _RD(qp)) {	/* fifo */
780 			freeq(_RD(qp));
781 		} else {				/* pipe */
782 			freestp = 0;
783 			/*
784 			 * The q_info pointers are never accessed when
785 			 * SQLOCK is held.
786 			 */
787 			ASSERT(qp->q_syncq == _RD(qp)->q_syncq);
788 			mutex_enter(SQLOCK(qp->q_syncq));
789 			qp->q_qinfo = &deadwend;
790 			_RD(qp)->q_qinfo = &deadrend;
791 			mutex_exit(SQLOCK(qp->q_syncq));
792 		}
793 	} else {
794 		freeq(_RD(qp)); /* free stream head queue pair */
795 	}
796 
797 	mutex_enter(&vp->v_lock);
798 	if (stp->sd_iocblk) {
799 		if (stp->sd_iocblk != (mblk_t *)-1) {
800 			freemsg(stp->sd_iocblk);
801 		}
802 		stp->sd_iocblk = NULL;
803 	}
804 	stp->sd_vnode = NULL;
805 	vp->v_stream = NULL;
806 	mutex_exit(&vp->v_lock);
807 	mutex_enter(&stp->sd_lock);
808 	freemsg(stp->sd_cmdblk);
809 	stp->sd_cmdblk = NULL;
810 	stp->sd_flag &= ~STRCLOSE;
811 	cv_broadcast(&stp->sd_monitor);
812 	mutex_exit(&stp->sd_lock);
813 
814 	if (freestp)
815 		shfree(stp);
816 	return (0);
817 }
818 
819 static int
strsink(queue_t * q,mblk_t * bp)820 strsink(queue_t *q, mblk_t *bp)
821 {
822 	struct copyresp *resp;
823 
824 	switch (bp->b_datap->db_type) {
825 	case M_FLUSH:
826 		if ((*bp->b_rptr & FLUSHW) && !(bp->b_flag & MSGNOLOOP)) {
827 			*bp->b_rptr &= ~FLUSHR;
828 			bp->b_flag |= MSGNOLOOP;
829 			/*
830 			 * Protect against the driver passing up
831 			 * messages after it has done a qprocsoff.
832 			 */
833 			if (_OTHERQ(q)->q_next == NULL)
834 				freemsg(bp);
835 			else
836 				qreply(q, bp);
837 		} else {
838 			freemsg(bp);
839 		}
840 		break;
841 
842 	case M_COPYIN:
843 	case M_COPYOUT:
844 		if (bp->b_cont) {
845 			freemsg(bp->b_cont);
846 			bp->b_cont = NULL;
847 		}
848 		bp->b_datap->db_type = M_IOCDATA;
849 		bp->b_wptr = bp->b_rptr + sizeof (struct copyresp);
850 		resp = (struct copyresp *)bp->b_rptr;
851 		resp->cp_rval = (caddr_t)1;	/* failure */
852 		/*
853 		 * Protect against the driver passing up
854 		 * messages after it has done a qprocsoff.
855 		 */
856 		if (_OTHERQ(q)->q_next == NULL)
857 			freemsg(bp);
858 		else
859 			qreply(q, bp);
860 		break;
861 
862 	case M_IOCTL:
863 		if (bp->b_cont) {
864 			freemsg(bp->b_cont);
865 			bp->b_cont = NULL;
866 		}
867 		bp->b_datap->db_type = M_IOCNAK;
868 		/*
869 		 * Protect against the driver passing up
870 		 * messages after it has done a qprocsoff.
871 		 */
872 		if (_OTHERQ(q)->q_next == NULL)
873 			freemsg(bp);
874 		else
875 			qreply(q, bp);
876 		break;
877 
878 	default:
879 		freemsg(bp);
880 		break;
881 	}
882 
883 	return (0);
884 }
885 
886 /*
887  * Clean up after a process when it closes a stream.  This is called
888  * from closef for all closes, whereas strclose is called only for the
889  * last close on a stream.  The siglist is scanned for entries for the
890  * current process, and these are removed.
891  */
892 void
strclean(struct vnode * vp)893 strclean(struct vnode *vp)
894 {
895 	strsig_t *ssp, *pssp, *tssp;
896 	stdata_t *stp;
897 	int update = 0;
898 
899 	TRACE_1(TR_FAC_STREAMS_FR,
900 	    TR_STRCLEAN, "strclean:%p", vp);
901 	stp = vp->v_stream;
902 	pssp = NULL;
903 	mutex_enter(&stp->sd_lock);
904 	ssp = stp->sd_siglist;
905 	while (ssp) {
906 		if (ssp->ss_pidp == curproc->p_pidp) {
907 			tssp = ssp->ss_next;
908 			if (pssp)
909 				pssp->ss_next = tssp;
910 			else
911 				stp->sd_siglist = tssp;
912 			mutex_enter(&pidlock);
913 			PID_RELE(ssp->ss_pidp);
914 			mutex_exit(&pidlock);
915 			kmem_free(ssp, sizeof (strsig_t));
916 			update = 1;
917 			ssp = tssp;
918 		} else {
919 			pssp = ssp;
920 			ssp = ssp->ss_next;
921 		}
922 	}
923 	if (update) {
924 		stp->sd_sigflags = 0;
925 		for (ssp = stp->sd_siglist; ssp; ssp = ssp->ss_next)
926 			stp->sd_sigflags |= ssp->ss_events;
927 	}
928 	mutex_exit(&stp->sd_lock);
929 }
930 
931 /*
932  * Used on the last close to remove any remaining items on the siglist.
933  * These could be present on the siglist due to I_ESETSIG calls that
934  * use process groups or processed that do not have an open file descriptor
935  * for this stream (Such entries would not be removed by strclean).
936  */
937 static void
strcleanall(struct vnode * vp)938 strcleanall(struct vnode *vp)
939 {
940 	strsig_t *ssp, *nssp;
941 	stdata_t *stp;
942 
943 	stp = vp->v_stream;
944 	mutex_enter(&stp->sd_lock);
945 	ssp = stp->sd_siglist;
946 	stp->sd_siglist = NULL;
947 	while (ssp) {
948 		nssp = ssp->ss_next;
949 		mutex_enter(&pidlock);
950 		PID_RELE(ssp->ss_pidp);
951 		mutex_exit(&pidlock);
952 		kmem_free(ssp, sizeof (strsig_t));
953 		ssp = nssp;
954 	}
955 	stp->sd_sigflags = 0;
956 	mutex_exit(&stp->sd_lock);
957 }
958 
959 /*
960  * Retrieve the next message from the logical stream head read queue
961  * using either rwnext (if sync stream) or getq_noenab.
962  * It is the callers responsibility to call qbackenable after
963  * it is finished with the message. The caller should not call
964  * qbackenable until after any putback calls to avoid spurious backenabling.
965  */
966 mblk_t *
strget(struct stdata * stp,queue_t * q,struct uio * uiop,int first,int * errorp)967 strget(struct stdata *stp, queue_t *q, struct uio *uiop, int first,
968     int *errorp)
969 {
970 	mblk_t *bp;
971 	int error;
972 	ssize_t rbytes = 0;
973 
974 	/* Holding sd_lock prevents the read queue from changing  */
975 	ASSERT(MUTEX_HELD(&stp->sd_lock));
976 
977 	if (uiop != NULL && stp->sd_struiordq != NULL &&
978 	    q->q_first == NULL &&
979 	    (!first || (stp->sd_wakeq & RSLEEP))) {
980 		/*
981 		 * Stream supports rwnext() for the read side.
982 		 * If this is the first time we're called by e.g. strread
983 		 * only do the downcall if there is a deferred wakeup
984 		 * (registered in sd_wakeq).
985 		 */
986 		struiod_t uiod;
987 
988 		if (first)
989 			stp->sd_wakeq &= ~RSLEEP;
990 
991 		(void) uiodup(uiop, &uiod.d_uio, uiod.d_iov,
992 		    sizeof (uiod.d_iov) / sizeof (*uiod.d_iov));
993 		uiod.d_mp = 0;
994 		/*
995 		 * Mark that a thread is in rwnext on the read side
996 		 * to prevent strrput from nacking ioctls immediately.
997 		 * When the last concurrent rwnext returns
998 		 * the ioctls are nack'ed.
999 		 */
1000 		ASSERT(MUTEX_HELD(&stp->sd_lock));
1001 		stp->sd_struiodnak++;
1002 		/*
1003 		 * Note: rwnext will drop sd_lock.
1004 		 */
1005 		error = rwnext(q, &uiod);
1006 		ASSERT(MUTEX_NOT_HELD(&stp->sd_lock));
1007 		mutex_enter(&stp->sd_lock);
1008 		stp->sd_struiodnak--;
1009 		while (stp->sd_struiodnak == 0 &&
1010 		    ((bp = stp->sd_struionak) != NULL)) {
1011 			stp->sd_struionak = bp->b_next;
1012 			bp->b_next = NULL;
1013 			bp->b_datap->db_type = M_IOCNAK;
1014 			/*
1015 			 * Protect against the driver passing up
1016 			 * messages after it has done a qprocsoff.
1017 			 */
1018 			if (_OTHERQ(q)->q_next == NULL)
1019 				freemsg(bp);
1020 			else {
1021 				mutex_exit(&stp->sd_lock);
1022 				qreply(q, bp);
1023 				mutex_enter(&stp->sd_lock);
1024 			}
1025 		}
1026 		ASSERT(MUTEX_HELD(&stp->sd_lock));
1027 		if (error == 0 || error == EWOULDBLOCK) {
1028 			if ((bp = uiod.d_mp) != NULL) {
1029 				*errorp = 0;
1030 				ASSERT(MUTEX_HELD(&stp->sd_lock));
1031 				return (bp);
1032 			}
1033 			error = 0;
1034 		} else if (error == EINVAL) {
1035 			/*
1036 			 * The stream plumbing must have
1037 			 * changed while we were away, so
1038 			 * just turn off rwnext()s.
1039 			 */
1040 			error = 0;
1041 		} else if (error == EBUSY) {
1042 			/*
1043 			 * The module might have data in transit using putnext
1044 			 * Fall back on waiting + getq.
1045 			 */
1046 			error = 0;
1047 		} else {
1048 			*errorp = error;
1049 			ASSERT(MUTEX_HELD(&stp->sd_lock));
1050 			return (NULL);
1051 		}
1052 		/*
1053 		 * Try a getq in case a rwnext() generated mblk
1054 		 * has bubbled up via strrput().
1055 		 */
1056 	}
1057 	*errorp = 0;
1058 	ASSERT(MUTEX_HELD(&stp->sd_lock));
1059 
1060 	/*
1061 	 * If we have a valid uio, try and use this as a guide for how
1062 	 * many bytes to retrieve from the queue via getq_noenab().
1063 	 * Doing this can avoid unneccesary counting of overlong
1064 	 * messages in putback(). We currently only do this for sockets
1065 	 * and only if there is no sd_rputdatafunc hook.
1066 	 *
1067 	 * The sd_rputdatafunc hook transforms the entire message
1068 	 * before any bytes in it can be given to a client. So, rbytes
1069 	 * must be 0 if there is a hook.
1070 	 */
1071 	if ((uiop != NULL) && (stp->sd_vnode->v_type == VSOCK) &&
1072 	    (stp->sd_rputdatafunc == NULL))
1073 		rbytes = uiop->uio_resid;
1074 
1075 	return (getq_noenab(q, rbytes));
1076 }
1077 
1078 /*
1079  * Copy out the message pointed to by `bp' into the uio pointed to by `uiop'.
1080  * If the message does not fit in the uio the remainder of it is returned;
1081  * otherwise NULL is returned.  Any embedded zero-length mblk_t's are
1082  * consumed, even if uio_resid reaches zero.  On error, `*errorp' is set to
1083  * the error code, the message is consumed, and NULL is returned.
1084  */
1085 static mblk_t *
struiocopyout(mblk_t * bp,struct uio * uiop,int * errorp)1086 struiocopyout(mblk_t *bp, struct uio *uiop, int *errorp)
1087 {
1088 	int error;
1089 	ptrdiff_t n;
1090 	mblk_t *nbp;
1091 
1092 	ASSERT(bp->b_wptr >= bp->b_rptr);
1093 
1094 	do {
1095 		if ((n = MIN(uiop->uio_resid, MBLKL(bp))) != 0) {
1096 			ASSERT(n > 0);
1097 
1098 			error = uiomove(bp->b_rptr, n, UIO_READ, uiop);
1099 			if (error != 0) {
1100 				freemsg(bp);
1101 				*errorp = error;
1102 				return (NULL);
1103 			}
1104 		}
1105 
1106 		bp->b_rptr += n;
1107 		while (bp != NULL && (bp->b_rptr >= bp->b_wptr)) {
1108 			nbp = bp;
1109 			bp = bp->b_cont;
1110 			freeb(nbp);
1111 		}
1112 	} while (bp != NULL && uiop->uio_resid > 0);
1113 
1114 	*errorp = 0;
1115 	return (bp);
1116 }
1117 
1118 /*
1119  * Read a stream according to the mode flags in sd_flag:
1120  *
1121  * (default mode)		- Byte stream, msg boundaries are ignored
1122  * RD_MSGDIS (msg discard)	- Read on msg boundaries and throw away
1123  *				any data remaining in msg
1124  * RD_MSGNODIS (msg non-discard) - Read on msg boundaries and put back
1125  *				any remaining data on head of read queue
1126  *
1127  * Consume readable messages on the front of the queue until
1128  * ttolwp(curthread)->lwp_count
1129  * is satisfied, the readable messages are exhausted, or a message
1130  * boundary is reached in a message mode.  If no data was read and
1131  * the stream was not opened with the NDELAY flag, block until data arrives.
1132  * Otherwise return the data read and update the count.
1133  *
1134  * In default mode a 0 length message signifies end-of-file and terminates
1135  * a read in progress.  The 0 length message is removed from the queue
1136  * only if it is the only message read (no data is read).
1137  *
1138  * An attempt to read an M_PROTO or M_PCPROTO message results in an
1139  * EBADMSG error return, unless either RD_PROTDAT or RD_PROTDIS are set.
1140  * If RD_PROTDAT is set, M_PROTO and M_PCPROTO messages are read as data.
1141  * If RD_PROTDIS is set, the M_PROTO and M_PCPROTO parts of the message
1142  * are unlinked from and M_DATA blocks in the message, the protos are
1143  * thrown away, and the data is read.
1144  */
1145 /* ARGSUSED */
1146 int
strread(struct vnode * vp,struct uio * uiop,cred_t * crp)1147 strread(struct vnode *vp, struct uio *uiop, cred_t *crp)
1148 {
1149 	struct stdata *stp;
1150 	mblk_t *bp, *nbp;
1151 	queue_t *q;
1152 	int error = 0;
1153 	uint_t old_sd_flag;
1154 	int first;
1155 	char rflg;
1156 	uint_t mark;		/* Contains MSG*MARK and _LASTMARK */
1157 #define	_LASTMARK	0x8000	/* Distinct from MSG*MARK */
1158 	short delim;
1159 	unsigned char pri = 0;
1160 	char waitflag;
1161 	unsigned char type;
1162 
1163 	TRACE_1(TR_FAC_STREAMS_FR,
1164 	    TR_STRREAD_ENTER, "strread:%p", vp);
1165 	ASSERT(vp->v_stream);
1166 	stp = vp->v_stream;
1167 
1168 	mutex_enter(&stp->sd_lock);
1169 
1170 	if ((error = i_straccess(stp, JCREAD)) != 0) {
1171 		mutex_exit(&stp->sd_lock);
1172 		return (error);
1173 	}
1174 
1175 	if (stp->sd_flag & (STRDERR|STPLEX)) {
1176 		error = strgeterr(stp, STRDERR|STPLEX, 0);
1177 		if (error != 0) {
1178 			mutex_exit(&stp->sd_lock);
1179 			return (error);
1180 		}
1181 	}
1182 
1183 	/*
1184 	 * Loop terminates when uiop->uio_resid == 0.
1185 	 */
1186 	rflg = 0;
1187 	waitflag = READWAIT;
1188 	q = _RD(stp->sd_wrq);
1189 	for (;;) {
1190 		ASSERT(MUTEX_HELD(&stp->sd_lock));
1191 		old_sd_flag = stp->sd_flag;
1192 		mark = 0;
1193 		delim = 0;
1194 		first = 1;
1195 		while ((bp = strget(stp, q, uiop, first, &error)) == NULL) {
1196 			int done = 0;
1197 
1198 			ASSERT(MUTEX_HELD(&stp->sd_lock));
1199 
1200 			if (error != 0)
1201 				goto oops;
1202 
1203 			if (stp->sd_flag & (STRHUP|STREOF)) {
1204 				goto oops;
1205 			}
1206 			if (rflg && !(stp->sd_flag & STRDELIM)) {
1207 				goto oops;
1208 			}
1209 			/*
1210 			 * If a read(fd,buf,0) has been done, there is no
1211 			 * need to sleep. We always have zero bytes to
1212 			 * return.
1213 			 */
1214 			if (uiop->uio_resid == 0) {
1215 				goto oops;
1216 			}
1217 
1218 			qbackenable(q, 0);
1219 
1220 			TRACE_3(TR_FAC_STREAMS_FR, TR_STRREAD_WAIT,
1221 			    "strread calls strwaitq:%p, %p, %p",
1222 			    vp, uiop, crp);
1223 			if ((error = strwaitq(stp, waitflag, uiop->uio_resid,
1224 			    uiop->uio_fmode, -1, &done)) != 0 || done) {
1225 				TRACE_3(TR_FAC_STREAMS_FR, TR_STRREAD_DONE,
1226 				    "strread error or done:%p, %p, %p",
1227 				    vp, uiop, crp);
1228 				if ((uiop->uio_fmode & FNDELAY) &&
1229 				    (stp->sd_flag & OLDNDELAY) &&
1230 				    (error == EAGAIN))
1231 					error = 0;
1232 				goto oops;
1233 			}
1234 			TRACE_3(TR_FAC_STREAMS_FR, TR_STRREAD_AWAKE,
1235 			    "strread awakes:%p, %p, %p", vp, uiop, crp);
1236 			if ((error = i_straccess(stp, JCREAD)) != 0) {
1237 				goto oops;
1238 			}
1239 			first = 0;
1240 		}
1241 
1242 		ASSERT(MUTEX_HELD(&stp->sd_lock));
1243 		ASSERT(bp);
1244 		pri = bp->b_band;
1245 		/*
1246 		 * Extract any mark information. If the message is not
1247 		 * completely consumed this information will be put in the mblk
1248 		 * that is putback.
1249 		 * If MSGMARKNEXT is set and the message is completely consumed
1250 		 * the STRATMARK flag will be set below. Likewise, if
1251 		 * MSGNOTMARKNEXT is set and the message is
1252 		 * completely consumed STRNOTATMARK will be set.
1253 		 *
1254 		 * For some unknown reason strread only breaks the read at the
1255 		 * last mark.
1256 		 */
1257 		mark = bp->b_flag & (MSGMARK | MSGMARKNEXT | MSGNOTMARKNEXT);
1258 		ASSERT((mark & (MSGMARKNEXT|MSGNOTMARKNEXT)) !=
1259 		    (MSGMARKNEXT|MSGNOTMARKNEXT));
1260 		if (mark != 0 && bp == stp->sd_mark) {
1261 			if (rflg) {
1262 				putback(stp, q, bp, pri);
1263 				goto oops;
1264 			}
1265 			mark |= _LASTMARK;
1266 			stp->sd_mark = NULL;
1267 		}
1268 		if ((stp->sd_flag & STRDELIM) && (bp->b_flag & MSGDELIM))
1269 			delim = 1;
1270 		mutex_exit(&stp->sd_lock);
1271 
1272 		if (STREAM_NEEDSERVICE(stp))
1273 			stream_runservice(stp);
1274 
1275 		type = bp->b_datap->db_type;
1276 
1277 		switch (type) {
1278 
1279 		case M_DATA:
1280 ismdata:
1281 			if (msgnodata(bp)) {
1282 				if (mark || delim) {
1283 					freemsg(bp);
1284 				} else if (rflg) {
1285 
1286 					/*
1287 					 * If already read data put zero
1288 					 * length message back on queue else
1289 					 * free msg and return 0.
1290 					 */
1291 					bp->b_band = pri;
1292 					mutex_enter(&stp->sd_lock);
1293 					putback(stp, q, bp, pri);
1294 					mutex_exit(&stp->sd_lock);
1295 				} else {
1296 					freemsg(bp);
1297 				}
1298 				error =  0;
1299 				goto oops1;
1300 			}
1301 
1302 			rflg = 1;
1303 			waitflag |= NOINTR;
1304 			bp = struiocopyout(bp, uiop, &error);
1305 			if (error != 0)
1306 				goto oops1;
1307 
1308 			mutex_enter(&stp->sd_lock);
1309 			if (bp) {
1310 				/*
1311 				 * Have remaining data in message.
1312 				 * Free msg if in discard mode.
1313 				 */
1314 				if (stp->sd_read_opt & RD_MSGDIS) {
1315 					freemsg(bp);
1316 				} else {
1317 					bp->b_band = pri;
1318 					if ((mark & _LASTMARK) &&
1319 					    (stp->sd_mark == NULL))
1320 						stp->sd_mark = bp;
1321 					bp->b_flag |= mark & ~_LASTMARK;
1322 					if (delim)
1323 						bp->b_flag |= MSGDELIM;
1324 					if (msgnodata(bp))
1325 						freemsg(bp);
1326 					else
1327 						putback(stp, q, bp, pri);
1328 				}
1329 			} else {
1330 				/*
1331 				 * Consumed the complete message.
1332 				 * Move the MSG*MARKNEXT information
1333 				 * to the stream head just in case
1334 				 * the read queue becomes empty.
1335 				 *
1336 				 * If the stream head was at the mark
1337 				 * (STRATMARK) before we dropped sd_lock above
1338 				 * and some data was consumed then we have
1339 				 * moved past the mark thus STRATMARK is
1340 				 * cleared. However, if a message arrived in
1341 				 * strrput during the copyout above causing
1342 				 * STRATMARK to be set we can not clear that
1343 				 * flag.
1344 				 */
1345 				if (mark &
1346 				    (MSGMARKNEXT|MSGNOTMARKNEXT|MSGMARK)) {
1347 					if (mark & MSGMARKNEXT) {
1348 						stp->sd_flag &= ~STRNOTATMARK;
1349 						stp->sd_flag |= STRATMARK;
1350 					} else if (mark & MSGNOTMARKNEXT) {
1351 						stp->sd_flag &= ~STRATMARK;
1352 						stp->sd_flag |= STRNOTATMARK;
1353 					} else {
1354 						stp->sd_flag &=
1355 						    ~(STRATMARK|STRNOTATMARK);
1356 					}
1357 				} else if (rflg && (old_sd_flag & STRATMARK)) {
1358 					stp->sd_flag &= ~STRATMARK;
1359 				}
1360 			}
1361 
1362 			/*
1363 			 * Check for signal messages at the front of the read
1364 			 * queue and generate the signal(s) if appropriate.
1365 			 * The only signal that can be on queue is M_SIG at
1366 			 * this point.
1367 			 */
1368 			while ((((bp = q->q_first)) != NULL) &&
1369 			    (bp->b_datap->db_type == M_SIG)) {
1370 				bp = getq_noenab(q, 0);
1371 				/*
1372 				 * sd_lock is held so the content of the
1373 				 * read queue can not change.
1374 				 */
1375 				ASSERT(bp != NULL && DB_TYPE(bp) == M_SIG);
1376 				strsignal_nolock(stp, *bp->b_rptr, bp->b_band);
1377 				mutex_exit(&stp->sd_lock);
1378 				freemsg(bp);
1379 				if (STREAM_NEEDSERVICE(stp))
1380 					stream_runservice(stp);
1381 				mutex_enter(&stp->sd_lock);
1382 			}
1383 
1384 			if ((uiop->uio_resid == 0) || (mark & _LASTMARK) ||
1385 			    delim ||
1386 			    (stp->sd_read_opt & (RD_MSGDIS|RD_MSGNODIS))) {
1387 				goto oops;
1388 			}
1389 			continue;
1390 
1391 		case M_SIG:
1392 			strsignal(stp, *bp->b_rptr, (int32_t)bp->b_band);
1393 			freemsg(bp);
1394 			mutex_enter(&stp->sd_lock);
1395 			continue;
1396 
1397 		case M_PROTO:
1398 		case M_PCPROTO:
1399 			/*
1400 			 * Only data messages are readable.
1401 			 * Any others generate an error, unless
1402 			 * RD_PROTDIS or RD_PROTDAT is set.
1403 			 */
1404 			if (stp->sd_read_opt & RD_PROTDAT) {
1405 				for (nbp = bp; nbp; nbp = nbp->b_next) {
1406 					if ((nbp->b_datap->db_type ==
1407 					    M_PROTO) ||
1408 					    (nbp->b_datap->db_type ==
1409 					    M_PCPROTO)) {
1410 						nbp->b_datap->db_type = M_DATA;
1411 					} else {
1412 						break;
1413 					}
1414 				}
1415 				/*
1416 				 * clear stream head hi pri flag based on
1417 				 * first message
1418 				 */
1419 				if (type == M_PCPROTO) {
1420 					mutex_enter(&stp->sd_lock);
1421 					stp->sd_flag &= ~STRPRI;
1422 					mutex_exit(&stp->sd_lock);
1423 				}
1424 				goto ismdata;
1425 			} else if (stp->sd_read_opt & RD_PROTDIS) {
1426 				/*
1427 				 * discard non-data messages
1428 				 */
1429 				while (bp &&
1430 				    ((bp->b_datap->db_type == M_PROTO) ||
1431 				    (bp->b_datap->db_type == M_PCPROTO))) {
1432 					nbp = unlinkb(bp);
1433 					freeb(bp);
1434 					bp = nbp;
1435 				}
1436 				/*
1437 				 * clear stream head hi pri flag based on
1438 				 * first message
1439 				 */
1440 				if (type == M_PCPROTO) {
1441 					mutex_enter(&stp->sd_lock);
1442 					stp->sd_flag &= ~STRPRI;
1443 					mutex_exit(&stp->sd_lock);
1444 				}
1445 				if (bp) {
1446 					bp->b_band = pri;
1447 					goto ismdata;
1448 				} else {
1449 					break;
1450 				}
1451 			}
1452 			/* FALLTHRU */
1453 		case M_PASSFP:
1454 			if ((bp->b_datap->db_type == M_PASSFP) &&
1455 			    (stp->sd_read_opt & RD_PROTDIS)) {
1456 				freemsg(bp);
1457 				break;
1458 			}
1459 			mutex_enter(&stp->sd_lock);
1460 			putback(stp, q, bp, pri);
1461 			mutex_exit(&stp->sd_lock);
1462 			if (rflg == 0)
1463 				error = EBADMSG;
1464 			goto oops1;
1465 
1466 		default:
1467 			/*
1468 			 * Garbage on stream head read queue.
1469 			 */
1470 			cmn_err(CE_WARN, "bad %x found at stream head\n",
1471 			    bp->b_datap->db_type);
1472 			freemsg(bp);
1473 			goto oops1;
1474 		}
1475 		mutex_enter(&stp->sd_lock);
1476 	}
1477 oops:
1478 	mutex_exit(&stp->sd_lock);
1479 oops1:
1480 	qbackenable(q, pri);
1481 	return (error);
1482 #undef	_LASTMARK
1483 }
1484 
1485 /*
1486  * Default processing of M_PROTO/M_PCPROTO messages.
1487  * Determine which wakeups and signals are needed.
1488  * This can be replaced by a user-specified procedure for kernel users
1489  * of STREAMS.
1490  */
1491 /* ARGSUSED */
1492 mblk_t *
strrput_proto(vnode_t * vp,mblk_t * mp,strwakeup_t * wakeups,strsigset_t * firstmsgsigs,strsigset_t * allmsgsigs,strpollset_t * pollwakeups)1493 strrput_proto(vnode_t *vp, mblk_t *mp,
1494     strwakeup_t *wakeups, strsigset_t *firstmsgsigs,
1495     strsigset_t *allmsgsigs, strpollset_t *pollwakeups)
1496 {
1497 	*wakeups = RSLEEP;
1498 	*allmsgsigs = 0;
1499 
1500 	switch (mp->b_datap->db_type) {
1501 	case M_PROTO:
1502 		if (mp->b_band == 0) {
1503 			*firstmsgsigs = S_INPUT | S_RDNORM;
1504 			*pollwakeups = POLLIN | POLLRDNORM;
1505 		} else {
1506 			*firstmsgsigs = S_INPUT | S_RDBAND;
1507 			*pollwakeups = POLLIN | POLLRDBAND;
1508 		}
1509 		break;
1510 	case M_PCPROTO:
1511 		*firstmsgsigs = S_HIPRI;
1512 		*pollwakeups = POLLPRI;
1513 		break;
1514 	}
1515 	return (mp);
1516 }
1517 
1518 /*
1519  * Default processing of everything but M_DATA, M_PROTO, M_PCPROTO and
1520  * M_PASSFP messages.
1521  * Determine which wakeups and signals are needed.
1522  * This can be replaced by a user-specified procedure for kernel users
1523  * of STREAMS.
1524  */
1525 /* ARGSUSED */
1526 mblk_t *
strrput_misc(vnode_t * vp,mblk_t * mp,strwakeup_t * wakeups,strsigset_t * firstmsgsigs,strsigset_t * allmsgsigs,strpollset_t * pollwakeups)1527 strrput_misc(vnode_t *vp, mblk_t *mp,
1528     strwakeup_t *wakeups, strsigset_t *firstmsgsigs,
1529     strsigset_t *allmsgsigs, strpollset_t *pollwakeups)
1530 {
1531 	*wakeups = 0;
1532 	*firstmsgsigs = 0;
1533 	*allmsgsigs = 0;
1534 	*pollwakeups = 0;
1535 	return (mp);
1536 }
1537 
1538 /*
1539  * Stream read put procedure.  Called from downstream driver/module
1540  * with messages for the stream head.  Data, protocol, and in-stream
1541  * signal messages are placed on the queue, others are handled directly.
1542  */
1543 int
strrput(queue_t * q,mblk_t * bp)1544 strrput(queue_t *q, mblk_t *bp)
1545 {
1546 	struct stdata	*stp;
1547 	ulong_t		rput_opt;
1548 	strwakeup_t	wakeups;
1549 	strsigset_t	firstmsgsigs;	/* Signals if first message on queue */
1550 	strsigset_t	allmsgsigs;	/* Signals for all messages */
1551 	strsigset_t	signals;	/* Signals events to generate */
1552 	strpollset_t	pollwakeups;
1553 	mblk_t		*nextbp;
1554 	uchar_t		band = 0;
1555 	int		hipri_sig;
1556 
1557 	stp = (struct stdata *)q->q_ptr;
1558 	/*
1559 	 * Use rput_opt for optimized access to the SR_ flags except
1560 	 * SR_POLLIN. That flag has to be checked under sd_lock since it
1561 	 * is modified by strpoll().
1562 	 */
1563 	rput_opt = stp->sd_rput_opt;
1564 
1565 	ASSERT(qclaimed(q));
1566 	TRACE_2(TR_FAC_STREAMS_FR, TR_STRRPUT_ENTER,
1567 	    "strrput called with message type:q %p bp %p", q, bp);
1568 
1569 	/*
1570 	 * Perform initial processing and pass to the parameterized functions.
1571 	 */
1572 	ASSERT(bp->b_next == NULL);
1573 
1574 	switch (bp->b_datap->db_type) {
1575 	case M_DATA:
1576 		/*
1577 		 * sockfs is the only consumer of STREOF and when it is set,
1578 		 * it implies that the receiver is not interested in receiving
1579 		 * any more data, hence the mblk is freed to prevent unnecessary
1580 		 * message queueing at the stream head.
1581 		 */
1582 		if (stp->sd_flag == STREOF) {
1583 			freemsg(bp);
1584 			return (0);
1585 		}
1586 		if ((rput_opt & SR_IGN_ZEROLEN) &&
1587 		    bp->b_rptr == bp->b_wptr && msgnodata(bp)) {
1588 			/*
1589 			 * Ignore zero-length M_DATA messages. These might be
1590 			 * generated by some transports.
1591 			 * The zero-length M_DATA messages, even if they
1592 			 * are ignored, should effect the atmark tracking and
1593 			 * should wake up a thread sleeping in strwaitmark.
1594 			 */
1595 			mutex_enter(&stp->sd_lock);
1596 			if (bp->b_flag & MSGMARKNEXT) {
1597 				/*
1598 				 * Record the position of the mark either
1599 				 * in q_last or in STRATMARK.
1600 				 */
1601 				if (q->q_last != NULL) {
1602 					q->q_last->b_flag &= ~MSGNOTMARKNEXT;
1603 					q->q_last->b_flag |= MSGMARKNEXT;
1604 				} else {
1605 					stp->sd_flag &= ~STRNOTATMARK;
1606 					stp->sd_flag |= STRATMARK;
1607 				}
1608 			} else if (bp->b_flag & MSGNOTMARKNEXT) {
1609 				/*
1610 				 * Record that this is not the position of
1611 				 * the mark either in q_last or in
1612 				 * STRNOTATMARK.
1613 				 */
1614 				if (q->q_last != NULL) {
1615 					q->q_last->b_flag &= ~MSGMARKNEXT;
1616 					q->q_last->b_flag |= MSGNOTMARKNEXT;
1617 				} else {
1618 					stp->sd_flag &= ~STRATMARK;
1619 					stp->sd_flag |= STRNOTATMARK;
1620 				}
1621 			}
1622 			if (stp->sd_flag & RSLEEP) {
1623 				stp->sd_flag &= ~RSLEEP;
1624 				cv_broadcast(&q->q_wait);
1625 			}
1626 			mutex_exit(&stp->sd_lock);
1627 			freemsg(bp);
1628 			return (0);
1629 		}
1630 		wakeups = RSLEEP;
1631 		if (bp->b_band == 0) {
1632 			firstmsgsigs = S_INPUT | S_RDNORM;
1633 			pollwakeups = POLLIN | POLLRDNORM;
1634 		} else {
1635 			firstmsgsigs = S_INPUT | S_RDBAND;
1636 			pollwakeups = POLLIN | POLLRDBAND;
1637 		}
1638 		if (rput_opt & SR_SIGALLDATA)
1639 			allmsgsigs = firstmsgsigs;
1640 		else
1641 			allmsgsigs = 0;
1642 
1643 		mutex_enter(&stp->sd_lock);
1644 		if ((rput_opt & SR_CONSOL_DATA) &&
1645 		    (q->q_last != NULL) &&
1646 		    (bp->b_flag & (MSGMARK|MSGDELIM)) == 0) {
1647 			/*
1648 			 * Consolidate an M_DATA message onto an M_DATA,
1649 			 * M_PROTO, or M_PCPROTO by merging it with q_last.
1650 			 * The consolidation does not take place if
1651 			 * the old message is marked with either of the
1652 			 * marks or the delim flag or if the new
1653 			 * message is marked with MSGMARK. The MSGMARK
1654 			 * check is needed to handle the odd semantics of
1655 			 * MSGMARK where essentially the whole message
1656 			 * is to be treated as marked.
1657 			 * Carry any MSGMARKNEXT  and MSGNOTMARKNEXT from the
1658 			 * new message to the front of the b_cont chain.
1659 			 */
1660 			mblk_t *lbp = q->q_last;
1661 			unsigned char db_type = lbp->b_datap->db_type;
1662 
1663 			if ((db_type == M_DATA || db_type == M_PROTO ||
1664 			    db_type == M_PCPROTO) &&
1665 			    !(lbp->b_flag & (MSGDELIM|MSGMARK|MSGMARKNEXT))) {
1666 				rmvq_noenab(q, lbp);
1667 				/*
1668 				 * The first message in the b_cont list
1669 				 * tracks MSGMARKNEXT and MSGNOTMARKNEXT.
1670 				 * We need to handle the case where we
1671 				 * are appending:
1672 				 *
1673 				 * 1) a MSGMARKNEXT to a MSGNOTMARKNEXT.
1674 				 * 2) a MSGMARKNEXT to a plain message.
1675 				 * 3) a MSGNOTMARKNEXT to a plain message
1676 				 * 4) a MSGNOTMARKNEXT to a MSGNOTMARKNEXT
1677 				 *    message.
1678 				 *
1679 				 * Thus we never append a MSGMARKNEXT or
1680 				 * MSGNOTMARKNEXT to a MSGMARKNEXT message.
1681 				 */
1682 				if (bp->b_flag & MSGMARKNEXT) {
1683 					lbp->b_flag |= MSGMARKNEXT;
1684 					lbp->b_flag &= ~MSGNOTMARKNEXT;
1685 					bp->b_flag &= ~MSGMARKNEXT;
1686 				} else if (bp->b_flag & MSGNOTMARKNEXT) {
1687 					lbp->b_flag |= MSGNOTMARKNEXT;
1688 					bp->b_flag &= ~MSGNOTMARKNEXT;
1689 				}
1690 
1691 				linkb(lbp, bp);
1692 				bp = lbp;
1693 				/*
1694 				 * The new message logically isn't the first
1695 				 * even though the q_first check below thinks
1696 				 * it is. Clear the firstmsgsigs to make it
1697 				 * not appear to be first.
1698 				 */
1699 				firstmsgsigs = 0;
1700 			}
1701 		}
1702 		break;
1703 
1704 	case M_PASSFP:
1705 		wakeups = RSLEEP;
1706 		allmsgsigs = 0;
1707 		if (bp->b_band == 0) {
1708 			firstmsgsigs = S_INPUT | S_RDNORM;
1709 			pollwakeups = POLLIN | POLLRDNORM;
1710 		} else {
1711 			firstmsgsigs = S_INPUT | S_RDBAND;
1712 			pollwakeups = POLLIN | POLLRDBAND;
1713 		}
1714 		mutex_enter(&stp->sd_lock);
1715 		break;
1716 
1717 	case M_PROTO:
1718 	case M_PCPROTO:
1719 		ASSERT(stp->sd_rprotofunc != NULL);
1720 		bp = (stp->sd_rprotofunc)(stp->sd_vnode, bp,
1721 		    &wakeups, &firstmsgsigs, &allmsgsigs, &pollwakeups);
1722 #define	ALLSIG	(S_INPUT|S_HIPRI|S_OUTPUT|S_MSG|S_ERROR|S_HANGUP|S_RDNORM|\
1723 		S_WRNORM|S_RDBAND|S_WRBAND|S_BANDURG)
1724 #define	ALLPOLL	(POLLIN|POLLPRI|POLLOUT|POLLRDNORM|POLLWRNORM|POLLRDBAND|\
1725 		POLLWRBAND)
1726 
1727 		ASSERT((wakeups & ~(RSLEEP|WSLEEP)) == 0);
1728 		ASSERT((firstmsgsigs & ~ALLSIG) == 0);
1729 		ASSERT((allmsgsigs & ~ALLSIG) == 0);
1730 		ASSERT((pollwakeups & ~ALLPOLL) == 0);
1731 
1732 		mutex_enter(&stp->sd_lock);
1733 		break;
1734 
1735 	default:
1736 		ASSERT(stp->sd_rmiscfunc != NULL);
1737 		bp = (stp->sd_rmiscfunc)(stp->sd_vnode, bp,
1738 		    &wakeups, &firstmsgsigs, &allmsgsigs, &pollwakeups);
1739 		ASSERT((wakeups & ~(RSLEEP|WSLEEP)) == 0);
1740 		ASSERT((firstmsgsigs & ~ALLSIG) == 0);
1741 		ASSERT((allmsgsigs & ~ALLSIG) == 0);
1742 		ASSERT((pollwakeups & ~ALLPOLL) == 0);
1743 #undef	ALLSIG
1744 #undef	ALLPOLL
1745 		mutex_enter(&stp->sd_lock);
1746 		break;
1747 	}
1748 	ASSERT(MUTEX_HELD(&stp->sd_lock));
1749 
1750 	/* By default generate superset of signals */
1751 	signals = (firstmsgsigs | allmsgsigs);
1752 
1753 	/*
1754 	 * The  proto and misc functions can return multiple messages
1755 	 * as a b_next chain. Such messages are processed separately.
1756 	 */
1757 one_more:
1758 	hipri_sig = 0;
1759 	if (bp == NULL) {
1760 		nextbp = NULL;
1761 	} else {
1762 		nextbp = bp->b_next;
1763 		bp->b_next = NULL;
1764 
1765 		switch (bp->b_datap->db_type) {
1766 		case M_PCPROTO:
1767 			/*
1768 			 * Only one priority protocol message is allowed at the
1769 			 * stream head at a time.
1770 			 */
1771 			if (stp->sd_flag & STRPRI) {
1772 				TRACE_0(TR_FAC_STREAMS_FR, TR_STRRPUT_PROTERR,
1773 				    "M_PCPROTO already at head");
1774 				freemsg(bp);
1775 				mutex_exit(&stp->sd_lock);
1776 				goto done;
1777 			}
1778 			stp->sd_flag |= STRPRI;
1779 			hipri_sig = 1;
1780 			/* FALLTHRU */
1781 		case M_DATA:
1782 		case M_PROTO:
1783 		case M_PASSFP:
1784 			band = bp->b_band;
1785 			/*
1786 			 * Marking doesn't work well when messages
1787 			 * are marked in more than one band.  We only
1788 			 * remember the last message received, even if
1789 			 * it is placed on the queue ahead of other
1790 			 * marked messages.
1791 			 */
1792 			if (bp->b_flag & MSGMARK)
1793 				stp->sd_mark = bp;
1794 			(void) putq(q, bp);
1795 
1796 			/*
1797 			 * If message is a PCPROTO message, always use
1798 			 * firstmsgsigs to determine if a signal should be
1799 			 * sent as strrput is the only place to send
1800 			 * signals for PCPROTO. Other messages are based on
1801 			 * the STRGETINPROG flag. The flag determines if
1802 			 * strrput or (k)strgetmsg will be responsible for
1803 			 * sending the signals, in the firstmsgsigs case.
1804 			 */
1805 			if ((hipri_sig == 1) ||
1806 			    (((stp->sd_flag & STRGETINPROG) == 0) &&
1807 			    (q->q_first == bp)))
1808 				signals = (firstmsgsigs | allmsgsigs);
1809 			else
1810 				signals = allmsgsigs;
1811 			break;
1812 
1813 		default:
1814 			mutex_exit(&stp->sd_lock);
1815 			(void) strrput_nondata(q, bp);
1816 			mutex_enter(&stp->sd_lock);
1817 			break;
1818 		}
1819 	}
1820 	ASSERT(MUTEX_HELD(&stp->sd_lock));
1821 	/*
1822 	 * Wake sleeping read/getmsg and cancel deferred wakeup
1823 	 */
1824 	if (wakeups & RSLEEP)
1825 		stp->sd_wakeq &= ~RSLEEP;
1826 
1827 	wakeups &= stp->sd_flag;
1828 	if (wakeups & RSLEEP) {
1829 		stp->sd_flag &= ~RSLEEP;
1830 		cv_broadcast(&q->q_wait);
1831 	}
1832 	if (wakeups & WSLEEP) {
1833 		stp->sd_flag &= ~WSLEEP;
1834 		cv_broadcast(&_WR(q)->q_wait);
1835 	}
1836 
1837 	if (pollwakeups != 0) {
1838 		if (pollwakeups == (POLLIN | POLLRDNORM)) {
1839 			/*
1840 			 * Can't use rput_opt since it was not
1841 			 * read when sd_lock was held and SR_POLLIN is changed
1842 			 * by strpoll() under sd_lock.
1843 			 */
1844 			if (!(stp->sd_rput_opt & SR_POLLIN))
1845 				goto no_pollwake;
1846 			stp->sd_rput_opt &= ~SR_POLLIN;
1847 		}
1848 		mutex_exit(&stp->sd_lock);
1849 		pollwakeup(&stp->sd_pollist, pollwakeups);
1850 		mutex_enter(&stp->sd_lock);
1851 	}
1852 no_pollwake:
1853 
1854 	/*
1855 	 * strsendsig can handle multiple signals with a
1856 	 * single call.
1857 	 */
1858 	if (stp->sd_sigflags & signals)
1859 		strsendsig(stp->sd_siglist, signals, band, 0);
1860 	mutex_exit(&stp->sd_lock);
1861 
1862 
1863 done:
1864 	if (nextbp == NULL)
1865 		return (0);
1866 
1867 	/*
1868 	 * Any signals were handled the first time.
1869 	 * Wakeups and pollwakeups are redone to avoid any race
1870 	 * conditions - all the messages are not queued until the
1871 	 * last message has been processed by strrput.
1872 	 */
1873 	bp = nextbp;
1874 	signals = firstmsgsigs = allmsgsigs = 0;
1875 	mutex_enter(&stp->sd_lock);
1876 	goto one_more;
1877 }
1878 
1879 static void
log_dupioc(queue_t * rq,mblk_t * bp)1880 log_dupioc(queue_t *rq, mblk_t *bp)
1881 {
1882 	queue_t *wq, *qp;
1883 	char *modnames, *mnp, *dname;
1884 	size_t maxmodstr;
1885 	boolean_t islast;
1886 
1887 	/*
1888 	 * Allocate a buffer large enough to hold the names of nstrpush modules
1889 	 * and one driver, with spaces between and NUL terminator.  If we can't
1890 	 * get memory, then we'll just log the driver name.
1891 	 */
1892 	maxmodstr = nstrpush * (FMNAMESZ + 1);
1893 	mnp = modnames = kmem_alloc(maxmodstr, KM_NOSLEEP);
1894 
1895 	/* march down write side to print log message down to the driver */
1896 	wq = WR(rq);
1897 
1898 	/* make sure q_next doesn't shift around while we're grabbing data */
1899 	claimstr(wq);
1900 	qp = wq->q_next;
1901 	do {
1902 		dname = Q2NAME(qp);
1903 		islast = !SAMESTR(qp) || qp->q_next == NULL;
1904 		if (modnames == NULL) {
1905 			/*
1906 			 * If we don't have memory, then get the driver name in
1907 			 * the log where we can see it.  Note that memory
1908 			 * pressure is a possible cause of these sorts of bugs.
1909 			 */
1910 			if (islast) {
1911 				modnames = dname;
1912 				maxmodstr = 0;
1913 			}
1914 		} else {
1915 			mnp += snprintf(mnp, FMNAMESZ + 1, "%s", dname);
1916 			if (!islast)
1917 				*mnp++ = ' ';
1918 		}
1919 		qp = qp->q_next;
1920 	} while (!islast);
1921 	releasestr(wq);
1922 	/* Cannot happen unless stream head is corrupt. */
1923 	ASSERT(modnames != NULL);
1924 	(void) strlog(rq->q_qinfo->qi_minfo->mi_idnum, 0, 1,
1925 	    SL_CONSOLE|SL_TRACE|SL_ERROR,
1926 	    "Warning: stream %p received duplicate %X M_IOC%s; module list: %s",
1927 	    rq->q_ptr, ((struct iocblk *)bp->b_rptr)->ioc_cmd,
1928 	    (DB_TYPE(bp) == M_IOCACK ? "ACK" : "NAK"), modnames);
1929 	if (maxmodstr != 0)
1930 		kmem_free(modnames, maxmodstr);
1931 }
1932 
1933 int
strrput_nondata(queue_t * q,mblk_t * bp)1934 strrput_nondata(queue_t *q, mblk_t *bp)
1935 {
1936 	struct stdata *stp;
1937 	struct iocblk *iocbp;
1938 	struct stroptions *sop;
1939 	struct copyreq *reqp;
1940 	struct copyresp *resp;
1941 	unsigned char bpri;
1942 	unsigned char  flushed_already = 0;
1943 
1944 	stp = (struct stdata *)q->q_ptr;
1945 
1946 	ASSERT(!(stp->sd_flag & STPLEX));
1947 	ASSERT(qclaimed(q));
1948 
1949 	switch (bp->b_datap->db_type) {
1950 	case M_ERROR:
1951 		/*
1952 		 * An error has occurred downstream, the errno is in the first
1953 		 * bytes of the message.
1954 		 */
1955 		if ((bp->b_wptr - bp->b_rptr) == 2) {	/* New flavor */
1956 			unsigned char rw = 0;
1957 
1958 			mutex_enter(&stp->sd_lock);
1959 			if (*bp->b_rptr != NOERROR) {	/* read error */
1960 				if (*bp->b_rptr != 0) {
1961 					if (stp->sd_flag & STRDERR)
1962 						flushed_already |= FLUSHR;
1963 					stp->sd_flag |= STRDERR;
1964 					rw |= FLUSHR;
1965 				} else {
1966 					stp->sd_flag &= ~STRDERR;
1967 				}
1968 				stp->sd_rerror = *bp->b_rptr;
1969 			}
1970 			bp->b_rptr++;
1971 			if (*bp->b_rptr != NOERROR) {	/* write error */
1972 				if (*bp->b_rptr != 0) {
1973 					if (stp->sd_flag & STWRERR)
1974 						flushed_already |= FLUSHW;
1975 					stp->sd_flag |= STWRERR;
1976 					rw |= FLUSHW;
1977 				} else {
1978 					stp->sd_flag &= ~STWRERR;
1979 				}
1980 				stp->sd_werror = *bp->b_rptr;
1981 			}
1982 			if (rw) {
1983 				TRACE_2(TR_FAC_STREAMS_FR, TR_STRRPUT_WAKE,
1984 				    "strrput cv_broadcast:q %p, bp %p",
1985 				    q, bp);
1986 				cv_broadcast(&q->q_wait); /* readers */
1987 				cv_broadcast(&_WR(q)->q_wait); /* writers */
1988 				cv_broadcast(&stp->sd_monitor); /* ioctllers */
1989 
1990 				mutex_exit(&stp->sd_lock);
1991 				pollwakeup(&stp->sd_pollist, POLLERR);
1992 				mutex_enter(&stp->sd_lock);
1993 
1994 				if (stp->sd_sigflags & S_ERROR)
1995 					strsendsig(stp->sd_siglist, S_ERROR, 0,
1996 					    ((rw & FLUSHR) ? stp->sd_rerror :
1997 					    stp->sd_werror));
1998 				mutex_exit(&stp->sd_lock);
1999 				/*
2000 				 * Send the M_FLUSH only
2001 				 * for the first M_ERROR
2002 				 * message on the stream
2003 				 */
2004 				if (flushed_already == rw) {
2005 					freemsg(bp);
2006 					return (0);
2007 				}
2008 
2009 				bp->b_datap->db_type = M_FLUSH;
2010 				*bp->b_rptr = rw;
2011 				bp->b_wptr = bp->b_rptr + 1;
2012 				/*
2013 				 * Protect against the driver
2014 				 * passing up messages after
2015 				 * it has done a qprocsoff
2016 				 */
2017 				if (_OTHERQ(q)->q_next == NULL)
2018 					freemsg(bp);
2019 				else
2020 					qreply(q, bp);
2021 				return (0);
2022 			} else
2023 				mutex_exit(&stp->sd_lock);
2024 		} else if (*bp->b_rptr != 0) {		/* Old flavor */
2025 				if (stp->sd_flag & (STRDERR|STWRERR))
2026 					flushed_already = FLUSHRW;
2027 				mutex_enter(&stp->sd_lock);
2028 				stp->sd_flag |= (STRDERR|STWRERR);
2029 				stp->sd_rerror = *bp->b_rptr;
2030 				stp->sd_werror = *bp->b_rptr;
2031 				TRACE_2(TR_FAC_STREAMS_FR,
2032 				    TR_STRRPUT_WAKE2,
2033 				    "strrput wakeup #2:q %p, bp %p", q, bp);
2034 				cv_broadcast(&q->q_wait); /* the readers */
2035 				cv_broadcast(&_WR(q)->q_wait); /* the writers */
2036 				cv_broadcast(&stp->sd_monitor); /* ioctllers */
2037 
2038 				mutex_exit(&stp->sd_lock);
2039 				pollwakeup(&stp->sd_pollist, POLLERR);
2040 				mutex_enter(&stp->sd_lock);
2041 
2042 				if (stp->sd_sigflags & S_ERROR)
2043 					strsendsig(stp->sd_siglist, S_ERROR, 0,
2044 					    (stp->sd_werror ? stp->sd_werror :
2045 					    stp->sd_rerror));
2046 				mutex_exit(&stp->sd_lock);
2047 
2048 				/*
2049 				 * Send the M_FLUSH only
2050 				 * for the first M_ERROR
2051 				 * message on the stream
2052 				 */
2053 				if (flushed_already != FLUSHRW) {
2054 					bp->b_datap->db_type = M_FLUSH;
2055 					*bp->b_rptr = FLUSHRW;
2056 					/*
2057 					 * Protect against the driver passing up
2058 					 * messages after it has done a
2059 					 * qprocsoff.
2060 					 */
2061 				if (_OTHERQ(q)->q_next == NULL)
2062 					freemsg(bp);
2063 				else
2064 					qreply(q, bp);
2065 				return (0);
2066 				}
2067 		}
2068 		freemsg(bp);
2069 		return (0);
2070 
2071 	case M_HANGUP:
2072 
2073 		freemsg(bp);
2074 		mutex_enter(&stp->sd_lock);
2075 		stp->sd_werror = ENXIO;
2076 		stp->sd_flag |= STRHUP;
2077 		stp->sd_flag &= ~(WSLEEP|RSLEEP);
2078 
2079 		/*
2080 		 * send signal if controlling tty
2081 		 */
2082 
2083 		if (stp->sd_sidp) {
2084 			prsignal(stp->sd_sidp, SIGHUP);
2085 			if (stp->sd_sidp != stp->sd_pgidp)
2086 				pgsignal(stp->sd_pgidp, SIGTSTP);
2087 		}
2088 
2089 		/*
2090 		 * wake up read, write, and exception pollers and
2091 		 * reset wakeup mechanism.
2092 		 */
2093 		cv_broadcast(&q->q_wait);	/* the readers */
2094 		cv_broadcast(&_WR(q)->q_wait);	/* the writers */
2095 		cv_broadcast(&stp->sd_monitor);	/* the ioctllers */
2096 		strhup(stp);
2097 		mutex_exit(&stp->sd_lock);
2098 		return (0);
2099 
2100 	case M_UNHANGUP:
2101 		freemsg(bp);
2102 		mutex_enter(&stp->sd_lock);
2103 		stp->sd_werror = 0;
2104 		stp->sd_flag &= ~STRHUP;
2105 		mutex_exit(&stp->sd_lock);
2106 		return (0);
2107 
2108 	case M_SIG:
2109 		/*
2110 		 * Someone downstream wants to post a signal.  The
2111 		 * signal to post is contained in the first byte of the
2112 		 * message.  If the message would go on the front of
2113 		 * the queue, send a signal to the process group
2114 		 * (if not SIGPOLL) or to the siglist processes
2115 		 * (SIGPOLL).  If something is already on the queue,
2116 		 * OR if we are delivering a delayed suspend (*sigh*
2117 		 * another "tty" hack) and there's no one sleeping already,
2118 		 * just enqueue the message.
2119 		 */
2120 		mutex_enter(&stp->sd_lock);
2121 		if (q->q_first || (*bp->b_rptr == SIGTSTP &&
2122 		    !(stp->sd_flag & RSLEEP))) {
2123 			(void) putq(q, bp);
2124 			mutex_exit(&stp->sd_lock);
2125 			return (0);
2126 		}
2127 		mutex_exit(&stp->sd_lock);
2128 		/* FALLTHRU */
2129 
2130 	case M_PCSIG:
2131 		/*
2132 		 * Don't enqueue, just post the signal.
2133 		 */
2134 		strsignal(stp, *bp->b_rptr, 0L);
2135 		freemsg(bp);
2136 		return (0);
2137 
2138 	case M_CMD:
2139 		if (MBLKL(bp) != sizeof (cmdblk_t)) {
2140 			freemsg(bp);
2141 			return (0);
2142 		}
2143 
2144 		mutex_enter(&stp->sd_lock);
2145 		if (stp->sd_flag & STRCMDWAIT) {
2146 			ASSERT(stp->sd_cmdblk == NULL);
2147 			stp->sd_cmdblk = bp;
2148 			cv_broadcast(&stp->sd_monitor);
2149 			mutex_exit(&stp->sd_lock);
2150 		} else {
2151 			mutex_exit(&stp->sd_lock);
2152 			freemsg(bp);
2153 		}
2154 		return (0);
2155 
2156 	case M_FLUSH:
2157 		/*
2158 		 * Flush queues.  The indication of which queues to flush
2159 		 * is in the first byte of the message.  If the read queue
2160 		 * is specified, then flush it.  If FLUSHBAND is set, just
2161 		 * flush the band specified by the second byte of the message.
2162 		 *
2163 		 * If a module has issued a M_SETOPT to not flush hi
2164 		 * priority messages off of the stream head, then pass this
2165 		 * flag into the flushq code to preserve such messages.
2166 		 */
2167 
2168 		if (*bp->b_rptr & FLUSHR) {
2169 			mutex_enter(&stp->sd_lock);
2170 			if (*bp->b_rptr & FLUSHBAND) {
2171 				ASSERT((bp->b_wptr - bp->b_rptr) >= 2);
2172 				flushband(q, *(bp->b_rptr + 1), FLUSHALL);
2173 			} else
2174 				flushq_common(q, FLUSHALL,
2175 				    stp->sd_read_opt & RFLUSHPCPROT);
2176 			if ((q->q_first == NULL) ||
2177 			    (q->q_first->b_datap->db_type < QPCTL))
2178 				stp->sd_flag &= ~STRPRI;
2179 			else {
2180 				ASSERT(stp->sd_flag & STRPRI);
2181 			}
2182 			mutex_exit(&stp->sd_lock);
2183 		}
2184 		if ((*bp->b_rptr & FLUSHW) && !(bp->b_flag & MSGNOLOOP)) {
2185 			*bp->b_rptr &= ~FLUSHR;
2186 			bp->b_flag |= MSGNOLOOP;
2187 			/*
2188 			 * Protect against the driver passing up
2189 			 * messages after it has done a qprocsoff.
2190 			 */
2191 			if (_OTHERQ(q)->q_next == NULL)
2192 				freemsg(bp);
2193 			else
2194 				qreply(q, bp);
2195 			return (0);
2196 		}
2197 		freemsg(bp);
2198 		return (0);
2199 
2200 	case M_IOCACK:
2201 	case M_IOCNAK:
2202 		iocbp = (struct iocblk *)bp->b_rptr;
2203 		/*
2204 		 * If not waiting for ACK or NAK then just free msg.
2205 		 * If incorrect id sequence number then just free msg.
2206 		 * If already have ACK or NAK for user then this is a
2207 		 *    duplicate, display a warning and free the msg.
2208 		 */
2209 		mutex_enter(&stp->sd_lock);
2210 		if ((stp->sd_flag & IOCWAIT) == 0 || stp->sd_iocblk ||
2211 		    (stp->sd_iocid != iocbp->ioc_id)) {
2212 			/*
2213 			 * If the ACK/NAK is a dup, display a message
2214 			 * Dup is when sd_iocid == ioc_id, and
2215 			 * sd_iocblk == <valid ptr> or -1 (the former
2216 			 * is when an ioctl has been put on the stream
2217 			 * head, but has not yet been consumed, the
2218 			 * later is when it has been consumed).
2219 			 */
2220 			if ((stp->sd_iocid == iocbp->ioc_id) &&
2221 			    (stp->sd_iocblk != NULL)) {
2222 				log_dupioc(q, bp);
2223 			}
2224 			freemsg(bp);
2225 			mutex_exit(&stp->sd_lock);
2226 			return (0);
2227 		}
2228 
2229 		/*
2230 		 * Assign ACK or NAK to user and wake up.
2231 		 */
2232 		stp->sd_iocblk = bp;
2233 		cv_broadcast(&stp->sd_monitor);
2234 		mutex_exit(&stp->sd_lock);
2235 		return (0);
2236 
2237 	case M_COPYIN:
2238 	case M_COPYOUT:
2239 		reqp = (struct copyreq *)bp->b_rptr;
2240 
2241 		/*
2242 		 * If not waiting for ACK or NAK then just fail request.
2243 		 * If already have ACK, NAK, or copy request, then just
2244 		 * fail request.
2245 		 * If incorrect id sequence number then just fail request.
2246 		 */
2247 		mutex_enter(&stp->sd_lock);
2248 		if ((stp->sd_flag & IOCWAIT) == 0 || stp->sd_iocblk ||
2249 		    (stp->sd_iocid != reqp->cq_id)) {
2250 			if (bp->b_cont) {
2251 				freemsg(bp->b_cont);
2252 				bp->b_cont = NULL;
2253 			}
2254 			bp->b_datap->db_type = M_IOCDATA;
2255 			bp->b_wptr = bp->b_rptr + sizeof (struct copyresp);
2256 			resp = (struct copyresp *)bp->b_rptr;
2257 			resp->cp_rval = (caddr_t)1;	/* failure */
2258 			mutex_exit(&stp->sd_lock);
2259 			putnext(stp->sd_wrq, bp);
2260 			return (0);
2261 		}
2262 
2263 		/*
2264 		 * Assign copy request to user and wake up.
2265 		 */
2266 		stp->sd_iocblk = bp;
2267 		cv_broadcast(&stp->sd_monitor);
2268 		mutex_exit(&stp->sd_lock);
2269 		return (0);
2270 
2271 	case M_SETOPTS:
2272 		/*
2273 		 * Set stream head options (read option, write offset,
2274 		 * min/max packet size, and/or high/low water marks for
2275 		 * the read side only).
2276 		 */
2277 
2278 		bpri = 0;
2279 		sop = (struct stroptions *)bp->b_rptr;
2280 		mutex_enter(&stp->sd_lock);
2281 		if (sop->so_flags & SO_READOPT) {
2282 			switch (sop->so_readopt & RMODEMASK) {
2283 			case RNORM:
2284 				stp->sd_read_opt &= ~(RD_MSGDIS | RD_MSGNODIS);
2285 				break;
2286 
2287 			case RMSGD:
2288 				stp->sd_read_opt =
2289 				    ((stp->sd_read_opt & ~RD_MSGNODIS) |
2290 				    RD_MSGDIS);
2291 				break;
2292 
2293 			case RMSGN:
2294 				stp->sd_read_opt =
2295 				    ((stp->sd_read_opt & ~RD_MSGDIS) |
2296 				    RD_MSGNODIS);
2297 				break;
2298 			}
2299 			switch (sop->so_readopt & RPROTMASK) {
2300 			case RPROTNORM:
2301 				stp->sd_read_opt &= ~(RD_PROTDAT | RD_PROTDIS);
2302 				break;
2303 
2304 			case RPROTDAT:
2305 				stp->sd_read_opt =
2306 				    ((stp->sd_read_opt & ~RD_PROTDIS) |
2307 				    RD_PROTDAT);
2308 				break;
2309 
2310 			case RPROTDIS:
2311 				stp->sd_read_opt =
2312 				    ((stp->sd_read_opt & ~RD_PROTDAT) |
2313 				    RD_PROTDIS);
2314 				break;
2315 			}
2316 			switch (sop->so_readopt & RFLUSHMASK) {
2317 			case RFLUSHPCPROT:
2318 				/*
2319 				 * This sets the stream head to NOT flush
2320 				 * M_PCPROTO messages.
2321 				 */
2322 				stp->sd_read_opt |= RFLUSHPCPROT;
2323 				break;
2324 			}
2325 		}
2326 		if (sop->so_flags & SO_ERROPT) {
2327 			switch (sop->so_erropt & RERRMASK) {
2328 			case RERRNORM:
2329 				stp->sd_flag &= ~STRDERRNONPERSIST;
2330 				break;
2331 			case RERRNONPERSIST:
2332 				stp->sd_flag |= STRDERRNONPERSIST;
2333 				break;
2334 			}
2335 			switch (sop->so_erropt & WERRMASK) {
2336 			case WERRNORM:
2337 				stp->sd_flag &= ~STWRERRNONPERSIST;
2338 				break;
2339 			case WERRNONPERSIST:
2340 				stp->sd_flag |= STWRERRNONPERSIST;
2341 				break;
2342 			}
2343 		}
2344 		if (sop->so_flags & SO_COPYOPT) {
2345 			if (sop->so_copyopt & ZCVMSAFE) {
2346 				stp->sd_copyflag |= STZCVMSAFE;
2347 				stp->sd_copyflag &= ~STZCVMUNSAFE;
2348 			} else if (sop->so_copyopt & ZCVMUNSAFE) {
2349 				stp->sd_copyflag |= STZCVMUNSAFE;
2350 				stp->sd_copyflag &= ~STZCVMSAFE;
2351 			}
2352 
2353 			if (sop->so_copyopt & COPYCACHED) {
2354 				stp->sd_copyflag |= STRCOPYCACHED;
2355 			}
2356 		}
2357 		if (sop->so_flags & SO_WROFF)
2358 			stp->sd_wroff = sop->so_wroff;
2359 		if (sop->so_flags & SO_TAIL)
2360 			stp->sd_tail = sop->so_tail;
2361 		if (sop->so_flags & SO_MINPSZ)
2362 			q->q_minpsz = sop->so_minpsz;
2363 		if (sop->so_flags & SO_MAXPSZ)
2364 			q->q_maxpsz = sop->so_maxpsz;
2365 		if (sop->so_flags & SO_MAXBLK)
2366 			stp->sd_maxblk = sop->so_maxblk;
2367 		if (sop->so_flags & SO_HIWAT) {
2368 			if (sop->so_flags & SO_BAND) {
2369 				if (strqset(q, QHIWAT,
2370 				    sop->so_band, sop->so_hiwat)) {
2371 					cmn_err(CE_WARN, "strrput: could not "
2372 					    "allocate qband\n");
2373 				} else {
2374 					bpri = sop->so_band;
2375 				}
2376 			} else {
2377 				q->q_hiwat = sop->so_hiwat;
2378 			}
2379 		}
2380 		if (sop->so_flags & SO_LOWAT) {
2381 			if (sop->so_flags & SO_BAND) {
2382 				if (strqset(q, QLOWAT,
2383 				    sop->so_band, sop->so_lowat)) {
2384 					cmn_err(CE_WARN, "strrput: could not "
2385 					    "allocate qband\n");
2386 				} else {
2387 					bpri = sop->so_band;
2388 				}
2389 			} else {
2390 				q->q_lowat = sop->so_lowat;
2391 			}
2392 		}
2393 		if (sop->so_flags & SO_MREADON)
2394 			stp->sd_flag |= SNDMREAD;
2395 		if (sop->so_flags & SO_MREADOFF)
2396 			stp->sd_flag &= ~SNDMREAD;
2397 		if (sop->so_flags & SO_NDELON)
2398 			stp->sd_flag |= OLDNDELAY;
2399 		if (sop->so_flags & SO_NDELOFF)
2400 			stp->sd_flag &= ~OLDNDELAY;
2401 		if (sop->so_flags & SO_ISTTY)
2402 			stp->sd_flag |= STRISTTY;
2403 		if (sop->so_flags & SO_ISNTTY)
2404 			stp->sd_flag &= ~STRISTTY;
2405 		if (sop->so_flags & SO_TOSTOP)
2406 			stp->sd_flag |= STRTOSTOP;
2407 		if (sop->so_flags & SO_TONSTOP)
2408 			stp->sd_flag &= ~STRTOSTOP;
2409 		if (sop->so_flags & SO_DELIM)
2410 			stp->sd_flag |= STRDELIM;
2411 		if (sop->so_flags & SO_NODELIM)
2412 			stp->sd_flag &= ~STRDELIM;
2413 
2414 		mutex_exit(&stp->sd_lock);
2415 		freemsg(bp);
2416 
2417 		/* Check backenable in case the water marks changed */
2418 		qbackenable(q, bpri);
2419 		return (0);
2420 
2421 	/*
2422 	 * The following set of cases deal with situations where two stream
2423 	 * heads are connected to each other (twisted streams).  These messages
2424 	 * have no meaning at the stream head.
2425 	 */
2426 	case M_BREAK:
2427 	case M_CTL:
2428 	case M_DELAY:
2429 	case M_START:
2430 	case M_STOP:
2431 	case M_IOCDATA:
2432 	case M_STARTI:
2433 	case M_STOPI:
2434 		freemsg(bp);
2435 		return (0);
2436 
2437 	case M_IOCTL:
2438 		/*
2439 		 * Always NAK this condition
2440 		 * (makes no sense)
2441 		 * If there is one or more threads in the read side
2442 		 * rwnext we have to defer the nacking until that thread
2443 		 * returns (in strget).
2444 		 */
2445 		mutex_enter(&stp->sd_lock);
2446 		if (stp->sd_struiodnak != 0) {
2447 			/*
2448 			 * Defer NAK to the streamhead. Queue at the end
2449 			 * the list.
2450 			 */
2451 			mblk_t *mp = stp->sd_struionak;
2452 
2453 			while (mp && mp->b_next)
2454 				mp = mp->b_next;
2455 			if (mp)
2456 				mp->b_next = bp;
2457 			else
2458 				stp->sd_struionak = bp;
2459 			bp->b_next = NULL;
2460 			mutex_exit(&stp->sd_lock);
2461 			return (0);
2462 		}
2463 		mutex_exit(&stp->sd_lock);
2464 
2465 		bp->b_datap->db_type = M_IOCNAK;
2466 		/*
2467 		 * Protect against the driver passing up
2468 		 * messages after it has done a qprocsoff.
2469 		 */
2470 		if (_OTHERQ(q)->q_next == NULL)
2471 			freemsg(bp);
2472 		else
2473 			qreply(q, bp);
2474 		return (0);
2475 
2476 	default:
2477 #ifdef DEBUG
2478 		cmn_err(CE_WARN,
2479 		    "bad message type %x received at stream head\n",
2480 		    bp->b_datap->db_type);
2481 #endif
2482 		freemsg(bp);
2483 		return (0);
2484 	}
2485 
2486 	/* NOTREACHED */
2487 }
2488 
2489 /*
2490  * Check if the stream pointed to by `stp' can be written to, and return an
2491  * error code if not.  If `eiohup' is set, then return EIO if STRHUP is set.
2492  * If `sigpipeok' is set and the SW_SIGPIPE option is enabled on the stream,
2493  * then always return EPIPE and send a SIGPIPE to the invoking thread.
2494  */
2495 static int
strwriteable(struct stdata * stp,boolean_t eiohup,boolean_t sigpipeok)2496 strwriteable(struct stdata *stp, boolean_t eiohup, boolean_t sigpipeok)
2497 {
2498 	int error;
2499 
2500 	ASSERT(MUTEX_HELD(&stp->sd_lock));
2501 
2502 	/*
2503 	 * For modem support, POSIX states that on writes, EIO should
2504 	 * be returned if the stream has been hung up.
2505 	 */
2506 	if (eiohup && (stp->sd_flag & (STPLEX|STRHUP)) == STRHUP)
2507 		error = EIO;
2508 	else
2509 		error = strgeterr(stp, STRHUP|STPLEX|STWRERR, 0);
2510 
2511 	if (error != 0) {
2512 		if (!(stp->sd_flag & STPLEX) &&
2513 		    (stp->sd_wput_opt & SW_SIGPIPE) && sigpipeok) {
2514 			tsignal(curthread, SIGPIPE);
2515 			error = EPIPE;
2516 		}
2517 	}
2518 
2519 	return (error);
2520 }
2521 
2522 /*
2523  * Copyin and send data down a stream.
2524  * The caller will allocate and copyin any control part that precedes the
2525  * message and pass that in as mctl.
2526  *
2527  * Caller should *not* hold sd_lock.
2528  * When EWOULDBLOCK is returned the caller has to redo the canputnext
2529  * under sd_lock in order to avoid missing a backenabling wakeup.
2530  *
2531  * Use iosize = -1 to not send any M_DATA. iosize = 0 sends zero-length M_DATA.
2532  *
2533  * Set MSG_IGNFLOW in flags to ignore flow control for hipri messages.
2534  * For sync streams we can only ignore flow control by reverting to using
2535  * putnext.
2536  *
2537  * If sd_maxblk is less than *iosize this routine might return without
2538  * transferring all of *iosize. In all cases, on return *iosize will contain
2539  * the amount of data that was transferred.
2540  */
2541 static int
strput(struct stdata * stp,mblk_t * mctl,struct uio * uiop,ssize_t * iosize,int b_flag,int pri,int flags)2542 strput(struct stdata *stp, mblk_t *mctl, struct uio *uiop, ssize_t *iosize,
2543     int b_flag, int pri, int flags)
2544 {
2545 	struiod_t uiod;
2546 	mblk_t *mp;
2547 	queue_t *wqp = stp->sd_wrq;
2548 	int error = 0;
2549 	ssize_t count = *iosize;
2550 
2551 	ASSERT(MUTEX_NOT_HELD(&stp->sd_lock));
2552 
2553 	if (uiop != NULL && count >= 0)
2554 		flags |= stp->sd_struiowrq ? STRUIO_POSTPONE : 0;
2555 
2556 	if (!(flags & STRUIO_POSTPONE)) {
2557 		/*
2558 		 * Use regular canputnext, strmakedata, putnext sequence.
2559 		 */
2560 		if (pri == 0) {
2561 			if (!canputnext(wqp) && !(flags & MSG_IGNFLOW)) {
2562 				freemsg(mctl);
2563 				return (EWOULDBLOCK);
2564 			}
2565 		} else {
2566 			if (!(flags & MSG_IGNFLOW) && !bcanputnext(wqp, pri)) {
2567 				freemsg(mctl);
2568 				return (EWOULDBLOCK);
2569 			}
2570 		}
2571 
2572 		if ((error = strmakedata(iosize, uiop, stp, flags,
2573 		    &mp)) != 0) {
2574 			freemsg(mctl);
2575 			/*
2576 			 * need to change return code to ENOMEM
2577 			 * so that this is not confused with
2578 			 * flow control, EAGAIN.
2579 			 */
2580 
2581 			if (error == EAGAIN)
2582 				return (ENOMEM);
2583 			else
2584 				return (error);
2585 		}
2586 		if (mctl != NULL) {
2587 			if (mctl->b_cont == NULL)
2588 				mctl->b_cont = mp;
2589 			else if (mp != NULL)
2590 				linkb(mctl, mp);
2591 			mp = mctl;
2592 		} else if (mp == NULL)
2593 			return (0);
2594 
2595 		mp->b_flag |= b_flag;
2596 		mp->b_band = (uchar_t)pri;
2597 
2598 		if (flags & MSG_IGNFLOW) {
2599 			/*
2600 			 * XXX Hack: Don't get stuck running service
2601 			 * procedures. This is needed for sockfs when
2602 			 * sending the unbind message out of the rput
2603 			 * procedure - we don't want a put procedure
2604 			 * to run service procedures.
2605 			 */
2606 			putnext(wqp, mp);
2607 		} else {
2608 			stream_willservice(stp);
2609 			putnext(wqp, mp);
2610 			stream_runservice(stp);
2611 		}
2612 		return (0);
2613 	}
2614 	/*
2615 	 * Stream supports rwnext() for the write side.
2616 	 */
2617 	if ((error = strmakedata(iosize, uiop, stp, flags, &mp)) != 0) {
2618 		freemsg(mctl);
2619 		/*
2620 		 * map EAGAIN to ENOMEM since EAGAIN means "flow controlled".
2621 		 */
2622 		return (error == EAGAIN ? ENOMEM : error);
2623 	}
2624 	if (mctl != NULL) {
2625 		if (mctl->b_cont == NULL)
2626 			mctl->b_cont = mp;
2627 		else if (mp != NULL)
2628 			linkb(mctl, mp);
2629 		mp = mctl;
2630 	} else if (mp == NULL) {
2631 		return (0);
2632 	}
2633 
2634 	mp->b_flag |= b_flag;
2635 	mp->b_band = (uchar_t)pri;
2636 
2637 	(void) uiodup(uiop, &uiod.d_uio, uiod.d_iov,
2638 	    sizeof (uiod.d_iov) / sizeof (*uiod.d_iov));
2639 	uiod.d_uio.uio_offset = 0;
2640 	uiod.d_mp = mp;
2641 	error = rwnext(wqp, &uiod);
2642 	if (! uiod.d_mp) {
2643 		uioskip(uiop, *iosize);
2644 		return (error);
2645 	}
2646 	ASSERT(mp == uiod.d_mp);
2647 	if (error == EINVAL) {
2648 		/*
2649 		 * The stream plumbing must have changed while
2650 		 * we were away, so just turn off rwnext()s.
2651 		 */
2652 		error = 0;
2653 	} else if (error == EBUSY || error == EWOULDBLOCK) {
2654 		/*
2655 		 * Couldn't enter a perimeter or took a page fault,
2656 		 * so fall-back to putnext().
2657 		 */
2658 		error = 0;
2659 	} else {
2660 		freemsg(mp);
2661 		return (error);
2662 	}
2663 	/* Have to check canput before consuming data from the uio */
2664 	if (pri == 0) {
2665 		if (!canputnext(wqp) && !(flags & MSG_IGNFLOW)) {
2666 			freemsg(mp);
2667 			return (EWOULDBLOCK);
2668 		}
2669 	} else {
2670 		if (!bcanputnext(wqp, pri) && !(flags & MSG_IGNFLOW)) {
2671 			freemsg(mp);
2672 			return (EWOULDBLOCK);
2673 		}
2674 	}
2675 	ASSERT(mp == uiod.d_mp);
2676 	/* Copyin data from the uio */
2677 	if ((error = struioget(wqp, mp, &uiod, 0)) != 0) {
2678 		freemsg(mp);
2679 		return (error);
2680 	}
2681 	uioskip(uiop, *iosize);
2682 	if (flags & MSG_IGNFLOW) {
2683 		/*
2684 		 * XXX Hack: Don't get stuck running service procedures.
2685 		 * This is needed for sockfs when sending the unbind message
2686 		 * out of the rput procedure - we don't want a put procedure
2687 		 * to run service procedures.
2688 		 */
2689 		putnext(wqp, mp);
2690 	} else {
2691 		stream_willservice(stp);
2692 		putnext(wqp, mp);
2693 		stream_runservice(stp);
2694 	}
2695 	return (0);
2696 }
2697 
2698 /*
2699  * Write attempts to break the write request into messages conforming
2700  * with the minimum and maximum packet sizes set downstream.
2701  *
2702  * Write will not block if downstream queue is full and
2703  * O_NDELAY is set, otherwise it will block waiting for the queue to get room.
2704  *
2705  * A write of zero bytes gets packaged into a zero length message and sent
2706  * downstream like any other message.
2707  *
2708  * If buffers of the requested sizes are not available, the write will
2709  * sleep until the buffers become available.
2710  *
2711  * Write (if specified) will supply a write offset in a message if it
2712  * makes sense. This can be specified by downstream modules as part of
2713  * a M_SETOPTS message.  Write will not supply the write offset if it
2714  * cannot supply any data in a buffer.  In other words, write will never
2715  * send down an empty packet due to a write offset.
2716  */
2717 /* ARGSUSED2 */
2718 int
strwrite(struct vnode * vp,struct uio * uiop,cred_t * crp)2719 strwrite(struct vnode *vp, struct uio *uiop, cred_t *crp)
2720 {
2721 	return (strwrite_common(vp, uiop, crp, 0));
2722 }
2723 
2724 /* ARGSUSED2 */
2725 int
strwrite_common(struct vnode * vp,struct uio * uiop,cred_t * crp,int wflag)2726 strwrite_common(struct vnode *vp, struct uio *uiop, cred_t *crp, int wflag)
2727 {
2728 	struct stdata *stp;
2729 	struct queue *wqp;
2730 	ssize_t rmin, rmax;
2731 	ssize_t iosize;
2732 	int waitflag;
2733 	int tempmode;
2734 	int error = 0;
2735 	int b_flag;
2736 
2737 	ASSERT(vp->v_stream);
2738 	stp = vp->v_stream;
2739 
2740 	mutex_enter(&stp->sd_lock);
2741 
2742 	if ((error = i_straccess(stp, JCWRITE)) != 0) {
2743 		mutex_exit(&stp->sd_lock);
2744 		return (error);
2745 	}
2746 
2747 	if (stp->sd_flag & (STWRERR|STRHUP|STPLEX)) {
2748 		error = strwriteable(stp, B_TRUE, B_TRUE);
2749 		if (error != 0) {
2750 			mutex_exit(&stp->sd_lock);
2751 			return (error);
2752 		}
2753 	}
2754 
2755 	mutex_exit(&stp->sd_lock);
2756 
2757 	wqp = stp->sd_wrq;
2758 
2759 	/* get these values from them cached in the stream head */
2760 	rmin = stp->sd_qn_minpsz;
2761 	rmax = stp->sd_qn_maxpsz;
2762 
2763 	/*
2764 	 * Check the min/max packet size constraints.  If min packet size
2765 	 * is non-zero, the write cannot be split into multiple messages
2766 	 * and still guarantee the size constraints.
2767 	 */
2768 	TRACE_1(TR_FAC_STREAMS_FR, TR_STRWRITE_IN, "strwrite in:q %p", wqp);
2769 
2770 	ASSERT((rmax >= 0) || (rmax == INFPSZ));
2771 	if (rmax == 0) {
2772 		return (0);
2773 	}
2774 	if (rmin > 0) {
2775 		if (uiop->uio_resid < rmin) {
2776 			TRACE_3(TR_FAC_STREAMS_FR, TR_STRWRITE_OUT,
2777 			    "strwrite out:q %p out %d error %d",
2778 			    wqp, 0, ERANGE);
2779 			return (ERANGE);
2780 		}
2781 		if ((rmax != INFPSZ) && (uiop->uio_resid > rmax)) {
2782 			TRACE_3(TR_FAC_STREAMS_FR, TR_STRWRITE_OUT,
2783 			    "strwrite out:q %p out %d error %d",
2784 			    wqp, 1, ERANGE);
2785 			return (ERANGE);
2786 		}
2787 	}
2788 
2789 	/*
2790 	 * Do until count satisfied or error.
2791 	 */
2792 	waitflag = WRITEWAIT | wflag;
2793 	if (stp->sd_flag & OLDNDELAY)
2794 		tempmode = uiop->uio_fmode & ~FNDELAY;
2795 	else
2796 		tempmode = uiop->uio_fmode;
2797 
2798 	if (rmax == INFPSZ)
2799 		rmax = uiop->uio_resid;
2800 
2801 	/*
2802 	 * Note that tempmode does not get used in strput/strmakedata
2803 	 * but only in strwaitq. The other routines use uio_fmode
2804 	 * unmodified.
2805 	 */
2806 
2807 	/* LINTED: constant in conditional context */
2808 	while (1) {	/* breaks when uio_resid reaches zero */
2809 		/*
2810 		 * Determine the size of the next message to be
2811 		 * packaged.  May have to break write into several
2812 		 * messages based on max packet size.
2813 		 */
2814 		iosize = MIN(uiop->uio_resid, rmax);
2815 
2816 		/*
2817 		 * Put block downstream when flow control allows it.
2818 		 */
2819 		if ((stp->sd_flag & STRDELIM) && (uiop->uio_resid == iosize))
2820 			b_flag = MSGDELIM;
2821 		else
2822 			b_flag = 0;
2823 
2824 		for (;;) {
2825 			int done = 0;
2826 
2827 			error = strput(stp, NULL, uiop, &iosize, b_flag, 0, 0);
2828 			if (error == 0)
2829 				break;
2830 			if (error != EWOULDBLOCK)
2831 				goto out;
2832 
2833 			mutex_enter(&stp->sd_lock);
2834 			/*
2835 			 * Check for a missed wakeup.
2836 			 * Needed since strput did not hold sd_lock across
2837 			 * the canputnext.
2838 			 */
2839 			if (canputnext(wqp)) {
2840 				/* Try again */
2841 				mutex_exit(&stp->sd_lock);
2842 				continue;
2843 			}
2844 			TRACE_1(TR_FAC_STREAMS_FR, TR_STRWRITE_WAIT,
2845 			    "strwrite wait:q %p wait", wqp);
2846 			if ((error = strwaitq(stp, waitflag, (ssize_t)0,
2847 			    tempmode, -1, &done)) != 0 || done) {
2848 				mutex_exit(&stp->sd_lock);
2849 				if ((vp->v_type == VFIFO) &&
2850 				    (uiop->uio_fmode & FNDELAY) &&
2851 				    (error == EAGAIN))
2852 					error = 0;
2853 				goto out;
2854 			}
2855 			TRACE_1(TR_FAC_STREAMS_FR, TR_STRWRITE_WAKE,
2856 			    "strwrite wake:q %p awakes", wqp);
2857 			if ((error = i_straccess(stp, JCWRITE)) != 0) {
2858 				mutex_exit(&stp->sd_lock);
2859 				goto out;
2860 			}
2861 			mutex_exit(&stp->sd_lock);
2862 		}
2863 		waitflag |= NOINTR;
2864 		TRACE_2(TR_FAC_STREAMS_FR, TR_STRWRITE_RESID,
2865 		    "strwrite resid:q %p uiop %p", wqp, uiop);
2866 		if (uiop->uio_resid) {
2867 			/* Recheck for errors - needed for sockets */
2868 			if ((stp->sd_wput_opt & SW_RECHECK_ERR) &&
2869 			    (stp->sd_flag & (STWRERR|STRHUP|STPLEX))) {
2870 				mutex_enter(&stp->sd_lock);
2871 				error = strwriteable(stp, B_FALSE, B_TRUE);
2872 				mutex_exit(&stp->sd_lock);
2873 				if (error != 0)
2874 					return (error);
2875 			}
2876 			continue;
2877 		}
2878 		break;
2879 	}
2880 out:
2881 	/*
2882 	 * For historical reasons, applications expect EAGAIN when a data
2883 	 * mblk_t cannot be allocated, so change ENOMEM back to EAGAIN.
2884 	 */
2885 	if (error == ENOMEM)
2886 		error = EAGAIN;
2887 	TRACE_3(TR_FAC_STREAMS_FR, TR_STRWRITE_OUT,
2888 	    "strwrite out:q %p out %d error %d", wqp, 2, error);
2889 	return (error);
2890 }
2891 
2892 /*
2893  * Stream head write service routine.
2894  * Its job is to wake up any sleeping writers when a queue
2895  * downstream needs data (part of the flow control in putq and getq).
2896  * It also must wake anyone sleeping on a poll().
2897  * For stream head right below mux module, it must also invoke put procedure
2898  * of next downstream module.
2899  */
2900 int
strwsrv(queue_t * q)2901 strwsrv(queue_t *q)
2902 {
2903 	struct stdata *stp;
2904 	queue_t *tq;
2905 	qband_t *qbp;
2906 	int i;
2907 	qband_t *myqbp;
2908 	int isevent;
2909 	unsigned char	qbf[NBAND];	/* band flushing backenable flags */
2910 
2911 	TRACE_1(TR_FAC_STREAMS_FR,
2912 	    TR_STRWSRV, "strwsrv:q %p", q);
2913 	stp = (struct stdata *)q->q_ptr;
2914 	ASSERT(qclaimed(q));
2915 	mutex_enter(&stp->sd_lock);
2916 	ASSERT(!(stp->sd_flag & STPLEX));
2917 
2918 	if (stp->sd_flag & WSLEEP) {
2919 		stp->sd_flag &= ~WSLEEP;
2920 		cv_broadcast(&q->q_wait);
2921 	}
2922 	mutex_exit(&stp->sd_lock);
2923 
2924 	/* The other end of a stream pipe went away. */
2925 	if ((tq = q->q_next) == NULL) {
2926 		return (0);
2927 	}
2928 
2929 	/* Find the next module forward that has a service procedure */
2930 	claimstr(q);
2931 	tq = q->q_nfsrv;
2932 	ASSERT(tq != NULL);
2933 
2934 	if ((q->q_flag & QBACK)) {
2935 		if ((tq->q_flag & QFULL)) {
2936 			mutex_enter(QLOCK(tq));
2937 			if (!(tq->q_flag & QFULL)) {
2938 				mutex_exit(QLOCK(tq));
2939 				goto wakeup;
2940 			}
2941 			/*
2942 			 * The queue must have become full again. Set QWANTW
2943 			 * again so strwsrv will be back enabled when
2944 			 * the queue becomes non-full next time.
2945 			 */
2946 			tq->q_flag |= QWANTW;
2947 			mutex_exit(QLOCK(tq));
2948 		} else {
2949 		wakeup:
2950 			pollwakeup(&stp->sd_pollist, POLLWRNORM);
2951 			mutex_enter(&stp->sd_lock);
2952 			if (stp->sd_sigflags & S_WRNORM)
2953 				strsendsig(stp->sd_siglist, S_WRNORM, 0, 0);
2954 			mutex_exit(&stp->sd_lock);
2955 		}
2956 	}
2957 
2958 	isevent = 0;
2959 	i = 1;
2960 	bzero((caddr_t)qbf, NBAND);
2961 	mutex_enter(QLOCK(tq));
2962 	if ((myqbp = q->q_bandp) != NULL)
2963 		for (qbp = tq->q_bandp; qbp && myqbp; qbp = qbp->qb_next) {
2964 			ASSERT(myqbp);
2965 			if ((myqbp->qb_flag & QB_BACK)) {
2966 				if (qbp->qb_flag & QB_FULL) {
2967 					/*
2968 					 * The band must have become full again.
2969 					 * Set QB_WANTW again so strwsrv will
2970 					 * be back enabled when the band becomes
2971 					 * non-full next time.
2972 					 */
2973 					qbp->qb_flag |= QB_WANTW;
2974 				} else {
2975 					isevent = 1;
2976 					qbf[i] = 1;
2977 				}
2978 			}
2979 			myqbp = myqbp->qb_next;
2980 			i++;
2981 		}
2982 	mutex_exit(QLOCK(tq));
2983 
2984 	if (isevent) {
2985 		for (i = tq->q_nband; i; i--) {
2986 			if (qbf[i]) {
2987 				pollwakeup(&stp->sd_pollist, POLLWRBAND);
2988 				mutex_enter(&stp->sd_lock);
2989 				if (stp->sd_sigflags & S_WRBAND)
2990 					strsendsig(stp->sd_siglist, S_WRBAND,
2991 					    (uchar_t)i, 0);
2992 				mutex_exit(&stp->sd_lock);
2993 			}
2994 		}
2995 	}
2996 
2997 	releasestr(q);
2998 	return (0);
2999 }
3000 
3001 /*
3002  * Special case of strcopyin/strcopyout for copying
3003  * struct strioctl that can deal with both data
3004  * models.
3005  */
3006 
3007 #ifdef	_LP64
3008 
3009 static int
strcopyin_strioctl(void * from,void * to,int flag,int copyflag)3010 strcopyin_strioctl(void *from, void *to, int flag, int copyflag)
3011 {
3012 	struct	strioctl32 strioc32;
3013 	struct	strioctl *striocp;
3014 
3015 	if (copyflag & U_TO_K) {
3016 		ASSERT((copyflag & K_TO_K) == 0);
3017 
3018 		if ((flag & FMODELS) == DATAMODEL_ILP32) {
3019 			if (copyin(from, &strioc32, sizeof (strioc32)))
3020 				return (EFAULT);
3021 
3022 			striocp = (struct strioctl *)to;
3023 			striocp->ic_cmd	= strioc32.ic_cmd;
3024 			striocp->ic_timout = strioc32.ic_timout;
3025 			striocp->ic_len	= strioc32.ic_len;
3026 			striocp->ic_dp	= (char *)(uintptr_t)strioc32.ic_dp;
3027 
3028 		} else { /* NATIVE data model */
3029 			if (copyin(from, to, sizeof (struct strioctl))) {
3030 				return (EFAULT);
3031 			} else {
3032 				return (0);
3033 			}
3034 		}
3035 	} else {
3036 		ASSERT(copyflag & K_TO_K);
3037 		bcopy(from, to, sizeof (struct strioctl));
3038 	}
3039 	return (0);
3040 }
3041 
3042 static int
strcopyout_strioctl(void * from,void * to,int flag,int copyflag)3043 strcopyout_strioctl(void *from, void *to, int flag, int copyflag)
3044 {
3045 	struct	strioctl32 strioc32;
3046 	struct	strioctl *striocp;
3047 
3048 	if (copyflag & U_TO_K) {
3049 		ASSERT((copyflag & K_TO_K) == 0);
3050 
3051 		if ((flag & FMODELS) == DATAMODEL_ILP32) {
3052 			striocp = (struct strioctl *)from;
3053 			strioc32.ic_cmd	= striocp->ic_cmd;
3054 			strioc32.ic_timout = striocp->ic_timout;
3055 			strioc32.ic_len	= striocp->ic_len;
3056 			strioc32.ic_dp	= (caddr32_t)(uintptr_t)striocp->ic_dp;
3057 			ASSERT((char *)(uintptr_t)strioc32.ic_dp ==
3058 			    striocp->ic_dp);
3059 
3060 			if (copyout(&strioc32, to, sizeof (strioc32)))
3061 				return (EFAULT);
3062 
3063 		} else { /* NATIVE data model */
3064 			if (copyout(from, to, sizeof (struct strioctl))) {
3065 				return (EFAULT);
3066 			} else {
3067 				return (0);
3068 			}
3069 		}
3070 	} else {
3071 		ASSERT(copyflag & K_TO_K);
3072 		bcopy(from, to, sizeof (struct strioctl));
3073 	}
3074 	return (0);
3075 }
3076 
3077 #else	/* ! _LP64 */
3078 
3079 /* ARGSUSED2 */
3080 static int
strcopyin_strioctl(void * from,void * to,int flag,int copyflag)3081 strcopyin_strioctl(void *from, void *to, int flag, int copyflag)
3082 {
3083 	return (strcopyin(from, to, sizeof (struct strioctl), copyflag));
3084 }
3085 
3086 /* ARGSUSED2 */
3087 static int
strcopyout_strioctl(void * from,void * to,int flag,int copyflag)3088 strcopyout_strioctl(void *from, void *to, int flag, int copyflag)
3089 {
3090 	return (strcopyout(from, to, sizeof (struct strioctl), copyflag));
3091 }
3092 
3093 #endif	/* _LP64 */
3094 
3095 /*
3096  * Determine type of job control semantics expected by user.  The
3097  * possibilities are:
3098  *	JCREAD	- Behaves like read() on fd; send SIGTTIN
3099  *	JCWRITE	- Behaves like write() on fd; send SIGTTOU if TOSTOP set
3100  *	JCSETP	- Sets a value in the stream; send SIGTTOU, ignore TOSTOP
3101  *	JCGETP	- Gets a value in the stream; no signals.
3102  * See straccess in strsubr.c for usage of these values.
3103  *
3104  * This routine also returns -1 for I_STR as a special case; the
3105  * caller must call again with the real ioctl number for
3106  * classification.
3107  */
3108 static int
job_control_type(int cmd)3109 job_control_type(int cmd)
3110 {
3111 	switch (cmd) {
3112 	case I_STR:
3113 		return (-1);
3114 
3115 	case I_RECVFD:
3116 	case I_E_RECVFD:
3117 		return (JCREAD);
3118 
3119 	case I_FDINSERT:
3120 	case I_SENDFD:
3121 		return (JCWRITE);
3122 
3123 	case TCSETA:
3124 	case TCSETAW:
3125 	case TCSETAF:
3126 	case TCSBRK:
3127 	case TCXONC:
3128 	case TCFLSH:
3129 	case TCDSET:	/* Obsolete */
3130 	case TIOCSWINSZ:
3131 	case TCSETS:
3132 	case TCSETSW:
3133 	case TCSETSF:
3134 	case TIOCSETD:
3135 	case TIOCHPCL:
3136 	case TIOCSETP:
3137 	case TIOCSETN:
3138 	case TIOCEXCL:
3139 	case TIOCNXCL:
3140 	case TIOCFLUSH:
3141 	case TIOCSETC:
3142 	case TIOCLBIS:
3143 	case TIOCLBIC:
3144 	case TIOCLSET:
3145 	case TIOCSBRK:
3146 	case TIOCCBRK:
3147 	case TIOCSDTR:
3148 	case TIOCCDTR:
3149 	case TIOCSLTC:
3150 	case TIOCSTOP:
3151 	case TIOCSTART:
3152 	case TIOCSTI:
3153 	case TIOCSPGRP:
3154 	case TIOCMSET:
3155 	case TIOCMBIS:
3156 	case TIOCMBIC:
3157 	case TIOCREMOTE:
3158 	case TIOCSIGNAL:
3159 	case LDSETT:
3160 	case LDSMAP:	/* Obsolete */
3161 	case DIOCSETP:
3162 	case I_FLUSH:
3163 	case I_SRDOPT:
3164 	case I_SETSIG:
3165 	case I_SWROPT:
3166 	case I_FLUSHBAND:
3167 	case I_SETCLTIME:
3168 	case I_SERROPT:
3169 	case I_ESETSIG:
3170 	case FIONBIO:
3171 	case FIOASYNC:
3172 	case FIOSETOWN:
3173 	case JBOOT:	/* Obsolete */
3174 	case JTERM:	/* Obsolete */
3175 	case JTIMOM:	/* Obsolete */
3176 	case JZOMBOOT:	/* Obsolete */
3177 	case JAGENT:	/* Obsolete */
3178 	case JTRUN:	/* Obsolete */
3179 	case JXTPROTO:	/* Obsolete */
3180 		return (JCSETP);
3181 	}
3182 
3183 	return (JCGETP);
3184 }
3185 
3186 /*
3187  * ioctl for streams
3188  */
3189 int
strioctl(struct vnode * vp,int cmd,intptr_t arg,int flag,int copyflag,cred_t * crp,int * rvalp)3190 strioctl(struct vnode *vp, int cmd, intptr_t arg, int flag, int copyflag,
3191     cred_t *crp, int *rvalp)
3192 {
3193 	struct stdata *stp;
3194 	struct strcmd *scp;
3195 	struct strioctl strioc;
3196 	struct uio uio;
3197 	struct iovec iov;
3198 	int access;
3199 	mblk_t *mp;
3200 	int error = 0;
3201 	int done = 0;
3202 	ssize_t	rmin, rmax;
3203 	queue_t *wrq;
3204 	queue_t *rdq;
3205 	boolean_t kioctl = B_FALSE;
3206 	uint32_t auditing = AU_AUDITING();
3207 
3208 	if (flag & FKIOCTL) {
3209 		copyflag = K_TO_K;
3210 		kioctl = B_TRUE;
3211 	}
3212 	ASSERT(vp->v_stream);
3213 	ASSERT(copyflag == U_TO_K || copyflag == K_TO_K);
3214 	stp = vp->v_stream;
3215 
3216 	TRACE_3(TR_FAC_STREAMS_FR, TR_IOCTL_ENTER,
3217 	    "strioctl:stp %p cmd %X arg %lX", stp, cmd, arg);
3218 
3219 	/*
3220 	 * If the copy is kernel to kernel, make sure that the FNATIVE
3221 	 * flag is set.  After this it would be a serious error to have
3222 	 * no model flag.
3223 	 */
3224 	if (copyflag == K_TO_K)
3225 		flag = (flag & ~FMODELS) | FNATIVE;
3226 
3227 	ASSERT((flag & FMODELS) != 0);
3228 
3229 	wrq = stp->sd_wrq;
3230 	rdq = _RD(wrq);
3231 
3232 	access = job_control_type(cmd);
3233 
3234 	/* We should never see these here, should be handled by iwscn */
3235 	if (cmd == SRIOCSREDIR || cmd == SRIOCISREDIR)
3236 		return (EINVAL);
3237 
3238 	mutex_enter(&stp->sd_lock);
3239 	if ((access != -1) && ((error = i_straccess(stp, access)) != 0)) {
3240 		mutex_exit(&stp->sd_lock);
3241 		return (error);
3242 	}
3243 	mutex_exit(&stp->sd_lock);
3244 
3245 	/*
3246 	 * Check for sgttyb-related ioctls first, and complain as
3247 	 * necessary.
3248 	 */
3249 	switch (cmd) {
3250 	case TIOCGETP:
3251 	case TIOCSETP:
3252 	case TIOCSETN:
3253 		if (sgttyb_handling >= 2 && !sgttyb_complaint) {
3254 			sgttyb_complaint = B_TRUE;
3255 			cmn_err(CE_NOTE,
3256 			    "application used obsolete TIOC[GS]ET");
3257 		}
3258 		if (sgttyb_handling >= 3) {
3259 			tsignal(curthread, SIGSYS);
3260 			return (EIO);
3261 		}
3262 		break;
3263 	}
3264 
3265 	mutex_enter(&stp->sd_lock);
3266 
3267 	switch (cmd) {
3268 	case I_RECVFD:
3269 	case I_E_RECVFD:
3270 	case I_PEEK:
3271 	case I_NREAD:
3272 	case FIONREAD:
3273 	case FIORDCHK:
3274 	case I_ATMARK:
3275 	case FIONBIO:
3276 	case FIOASYNC:
3277 		if (stp->sd_flag & (STRDERR|STPLEX)) {
3278 			error = strgeterr(stp, STRDERR|STPLEX, 0);
3279 			if (error != 0) {
3280 				mutex_exit(&stp->sd_lock);
3281 				return (error);
3282 			}
3283 		}
3284 		break;
3285 
3286 	default:
3287 		if (stp->sd_flag & (STRDERR|STWRERR|STPLEX)) {
3288 			error = strgeterr(stp, STRDERR|STWRERR|STPLEX, 0);
3289 			if (error != 0) {
3290 				mutex_exit(&stp->sd_lock);
3291 				return (error);
3292 			}
3293 		}
3294 	}
3295 
3296 	mutex_exit(&stp->sd_lock);
3297 
3298 	switch (cmd) {
3299 	default:
3300 		/*
3301 		 * The stream head has hardcoded knowledge of a
3302 		 * miscellaneous collection of terminal-, keyboard- and
3303 		 * mouse-related ioctls, enumerated below.  This hardcoded
3304 		 * knowledge allows the stream head to automatically
3305 		 * convert transparent ioctl requests made by userland
3306 		 * programs into I_STR ioctls which many old STREAMS
3307 		 * modules and drivers require.
3308 		 *
3309 		 * No new ioctls should ever be added to this list.
3310 		 * Instead, the STREAMS module or driver should be written
3311 		 * to either handle transparent ioctls or require any
3312 		 * userland programs to use I_STR ioctls (by returning
3313 		 * EINVAL to any transparent ioctl requests).
3314 		 *
3315 		 * More importantly, removing ioctls from this list should
3316 		 * be done with the utmost care, since our STREAMS modules
3317 		 * and drivers *count* on the stream head performing this
3318 		 * conversion, and thus may panic while processing
3319 		 * transparent ioctl request for one of these ioctls (keep
3320 		 * in mind that third party modules and drivers may have
3321 		 * similar problems).
3322 		 */
3323 		if (((cmd & IOCTYPE) == LDIOC) ||
3324 		    ((cmd & IOCTYPE) == tIOC) ||
3325 		    ((cmd & IOCTYPE) == TIOC) ||
3326 		    ((cmd & IOCTYPE) == KIOC) ||
3327 		    ((cmd & IOCTYPE) == MSIOC) ||
3328 		    ((cmd & IOCTYPE) == VUIOC)) {
3329 			/*
3330 			 * The ioctl is a tty ioctl - set up strioc buffer
3331 			 * and call strdoioctl() to do the work.
3332 			 */
3333 			if (stp->sd_flag & STRHUP)
3334 				return (ENXIO);
3335 			strioc.ic_cmd = cmd;
3336 			strioc.ic_timout = INFTIM;
3337 
3338 			switch (cmd) {
3339 
3340 			case TCXONC:
3341 			case TCSBRK:
3342 			case TCFLSH:
3343 			case TCDSET:
3344 				{
3345 				int native_arg = (int)arg;
3346 				strioc.ic_len = sizeof (int);
3347 				strioc.ic_dp = (char *)&native_arg;
3348 				return (strdoioctl(stp, &strioc, flag,
3349 				    K_TO_K, crp, rvalp));
3350 				}
3351 
3352 			case TCSETA:
3353 			case TCSETAW:
3354 			case TCSETAF:
3355 				strioc.ic_len = sizeof (struct termio);
3356 				strioc.ic_dp = (char *)arg;
3357 				return (strdoioctl(stp, &strioc, flag,
3358 				    copyflag, crp, rvalp));
3359 
3360 			case TCSETS:
3361 			case TCSETSW:
3362 			case TCSETSF:
3363 				strioc.ic_len = sizeof (struct termios);
3364 				strioc.ic_dp = (char *)arg;
3365 				return (strdoioctl(stp, &strioc, flag,
3366 				    copyflag, crp, rvalp));
3367 
3368 			case LDSETT:
3369 				strioc.ic_len = sizeof (struct termcb);
3370 				strioc.ic_dp = (char *)arg;
3371 				return (strdoioctl(stp, &strioc, flag,
3372 				    copyflag, crp, rvalp));
3373 
3374 			case TIOCSETP:
3375 				strioc.ic_len = sizeof (struct sgttyb);
3376 				strioc.ic_dp = (char *)arg;
3377 				return (strdoioctl(stp, &strioc, flag,
3378 				    copyflag, crp, rvalp));
3379 
3380 			case TIOCSTI:
3381 				if ((flag & FREAD) == 0 &&
3382 				    secpolicy_sti(crp) != 0) {
3383 					return (EPERM);
3384 				}
3385 				mutex_enter(&stp->sd_lock);
3386 				mutex_enter(&curproc->p_splock);
3387 				if (stp->sd_sidp != curproc->p_sessp->s_sidp &&
3388 				    secpolicy_sti(crp) != 0) {
3389 					mutex_exit(&curproc->p_splock);
3390 					mutex_exit(&stp->sd_lock);
3391 					return (EACCES);
3392 				}
3393 				mutex_exit(&curproc->p_splock);
3394 				mutex_exit(&stp->sd_lock);
3395 
3396 				strioc.ic_len = sizeof (char);
3397 				strioc.ic_dp = (char *)arg;
3398 				return (strdoioctl(stp, &strioc, flag,
3399 				    copyflag, crp, rvalp));
3400 
3401 			case TIOCSWINSZ:
3402 				strioc.ic_len = sizeof (struct winsize);
3403 				strioc.ic_dp = (char *)arg;
3404 				return (strdoioctl(stp, &strioc, flag,
3405 				    copyflag, crp, rvalp));
3406 
3407 			case TIOCSSIZE:
3408 				strioc.ic_len = sizeof (struct ttysize);
3409 				strioc.ic_dp = (char *)arg;
3410 				return (strdoioctl(stp, &strioc, flag,
3411 				    copyflag, crp, rvalp));
3412 
3413 			case TIOCSSOFTCAR:
3414 			case KIOCTRANS:
3415 			case KIOCTRANSABLE:
3416 			case KIOCCMD:
3417 			case KIOCSDIRECT:
3418 			case KIOCSCOMPAT:
3419 			case KIOCSKABORTEN:
3420 			case KIOCSRPTDELAY:
3421 			case KIOCSRPTRATE:
3422 			case VUIDSFORMAT:
3423 			case TIOCSPPS:
3424 				strioc.ic_len = sizeof (int);
3425 				strioc.ic_dp = (char *)arg;
3426 				return (strdoioctl(stp, &strioc, flag,
3427 				    copyflag, crp, rvalp));
3428 
3429 			case KIOCSETKEY:
3430 			case KIOCGETKEY:
3431 				strioc.ic_len = sizeof (struct kiockey);
3432 				strioc.ic_dp = (char *)arg;
3433 				return (strdoioctl(stp, &strioc, flag,
3434 				    copyflag, crp, rvalp));
3435 
3436 			case KIOCSKEY:
3437 			case KIOCGKEY:
3438 				strioc.ic_len = sizeof (struct kiockeymap);
3439 				strioc.ic_dp = (char *)arg;
3440 				return (strdoioctl(stp, &strioc, flag,
3441 				    copyflag, crp, rvalp));
3442 
3443 			case KIOCSLED:
3444 				/* arg is a pointer to char */
3445 				strioc.ic_len = sizeof (char);
3446 				strioc.ic_dp = (char *)arg;
3447 				return (strdoioctl(stp, &strioc, flag,
3448 				    copyflag, crp, rvalp));
3449 
3450 			case MSIOSETPARMS:
3451 				strioc.ic_len = sizeof (Ms_parms);
3452 				strioc.ic_dp = (char *)arg;
3453 				return (strdoioctl(stp, &strioc, flag,
3454 				    copyflag, crp, rvalp));
3455 
3456 			case VUIDSADDR:
3457 			case VUIDGADDR:
3458 				strioc.ic_len = sizeof (struct vuid_addr_probe);
3459 				strioc.ic_dp = (char *)arg;
3460 				return (strdoioctl(stp, &strioc, flag,
3461 				    copyflag, crp, rvalp));
3462 
3463 			/*
3464 			 * These M_IOCTL's don't require any data to be sent
3465 			 * downstream, and the driver will allocate and link
3466 			 * on its own mblk_t upon M_IOCACK -- thus we set
3467 			 * ic_len to zero and set ic_dp to arg so we know
3468 			 * where to copyout to later.
3469 			 */
3470 			case TIOCGSOFTCAR:
3471 			case TIOCGWINSZ:
3472 			case TIOCGSIZE:
3473 			case KIOCGTRANS:
3474 			case KIOCGTRANSABLE:
3475 			case KIOCTYPE:
3476 			case KIOCGDIRECT:
3477 			case KIOCGCOMPAT:
3478 			case KIOCLAYOUT:
3479 			case KIOCGLED:
3480 			case MSIOGETPARMS:
3481 			case MSIOBUTTONS:
3482 			case VUIDGFORMAT:
3483 			case TIOCGPPS:
3484 			case TIOCGPPSEV:
3485 			case TCGETA:
3486 			case TCGETS:
3487 			case LDGETT:
3488 			case TIOCGETP:
3489 			case KIOCGRPTDELAY:
3490 			case KIOCGRPTRATE:
3491 				strioc.ic_len = 0;
3492 				strioc.ic_dp = (char *)arg;
3493 				return (strdoioctl(stp, &strioc, flag,
3494 				    copyflag, crp, rvalp));
3495 			}
3496 		}
3497 
3498 		/*
3499 		 * Unknown cmd - send it down as a transparent ioctl.
3500 		 */
3501 		strioc.ic_cmd = cmd;
3502 		strioc.ic_timout = INFTIM;
3503 		strioc.ic_len = TRANSPARENT;
3504 		strioc.ic_dp = (char *)&arg;
3505 
3506 		return (strdoioctl(stp, &strioc, flag, copyflag, crp, rvalp));
3507 
3508 	case I_STR:
3509 		/*
3510 		 * Stream ioctl.  Read in an strioctl buffer from the user
3511 		 * along with any data specified and send it downstream.
3512 		 * Strdoioctl will wait allow only one ioctl message at
3513 		 * a time, and waits for the acknowledgement.
3514 		 */
3515 
3516 		if (stp->sd_flag & STRHUP)
3517 			return (ENXIO);
3518 
3519 		error = strcopyin_strioctl((void *)arg, &strioc, flag,
3520 		    copyflag);
3521 		if (error != 0)
3522 			return (error);
3523 
3524 		if ((strioc.ic_len < 0) || (strioc.ic_timout < -1))
3525 			return (EINVAL);
3526 
3527 		access = job_control_type(strioc.ic_cmd);
3528 		mutex_enter(&stp->sd_lock);
3529 		if ((access != -1) &&
3530 		    ((error = i_straccess(stp, access)) != 0)) {
3531 			mutex_exit(&stp->sd_lock);
3532 			return (error);
3533 		}
3534 		mutex_exit(&stp->sd_lock);
3535 
3536 		/*
3537 		 * The I_STR facility provides a trap door for malicious
3538 		 * code to send down bogus streamio(7I) ioctl commands to
3539 		 * unsuspecting STREAMS modules and drivers which expect to
3540 		 * only get these messages from the stream head.
3541 		 * Explicitly prohibit any streamio ioctls which can be
3542 		 * passed downstream by the stream head.  Note that we do
3543 		 * not block all streamio ioctls because the ioctl
3544 		 * numberspace is not well managed and thus it's possible
3545 		 * that a module or driver's ioctl numbers may accidentally
3546 		 * collide with them.
3547 		 */
3548 		switch (strioc.ic_cmd) {
3549 		case I_LINK:
3550 		case I_PLINK:
3551 		case I_UNLINK:
3552 		case I_PUNLINK:
3553 		case _I_GETPEERCRED:
3554 		case _I_PLINK_LH:
3555 			return (EINVAL);
3556 		}
3557 
3558 		error = strdoioctl(stp, &strioc, flag, copyflag, crp, rvalp);
3559 		if (error == 0) {
3560 			error = strcopyout_strioctl(&strioc, (void *)arg,
3561 			    flag, copyflag);
3562 		}
3563 		return (error);
3564 
3565 	case _I_CMD:
3566 		/*
3567 		 * Like I_STR, but without using M_IOC* messages and without
3568 		 * copyins/copyouts beyond the passed-in argument.
3569 		 */
3570 		if (stp->sd_flag & STRHUP)
3571 			return (ENXIO);
3572 
3573 		if ((scp = kmem_alloc(sizeof (strcmd_t), KM_NOSLEEP)) == NULL)
3574 			return (ENOMEM);
3575 
3576 		if (copyin((void *)arg, scp, sizeof (strcmd_t))) {
3577 			kmem_free(scp, sizeof (strcmd_t));
3578 			return (EFAULT);
3579 		}
3580 
3581 		access = job_control_type(scp->sc_cmd);
3582 		mutex_enter(&stp->sd_lock);
3583 		if (access != -1 && (error = i_straccess(stp, access)) != 0) {
3584 			mutex_exit(&stp->sd_lock);
3585 			kmem_free(scp, sizeof (strcmd_t));
3586 			return (error);
3587 		}
3588 		mutex_exit(&stp->sd_lock);
3589 
3590 		*rvalp = 0;
3591 		if ((error = strdocmd(stp, scp, crp)) == 0) {
3592 			if (copyout(scp, (void *)arg, sizeof (strcmd_t)))
3593 				error = EFAULT;
3594 		}
3595 		kmem_free(scp, sizeof (strcmd_t));
3596 		return (error);
3597 
3598 	case I_NREAD:
3599 		/*
3600 		 * Return number of bytes of data in first message
3601 		 * in queue in "arg" and return the number of messages
3602 		 * in queue in return value.
3603 		 */
3604 	{
3605 		size_t	size;
3606 		int	retval;
3607 		int	count = 0;
3608 
3609 		mutex_enter(QLOCK(rdq));
3610 
3611 		size = msgdsize(rdq->q_first);
3612 		for (mp = rdq->q_first; mp != NULL; mp = mp->b_next)
3613 			count++;
3614 
3615 		mutex_exit(QLOCK(rdq));
3616 		if (stp->sd_struiordq) {
3617 			infod_t infod;
3618 
3619 			infod.d_cmd = INFOD_COUNT;
3620 			infod.d_count = 0;
3621 			if (count == 0) {
3622 				infod.d_cmd |= INFOD_FIRSTBYTES;
3623 				infod.d_bytes = 0;
3624 			}
3625 			infod.d_res = 0;
3626 			(void) infonext(rdq, &infod);
3627 			count += infod.d_count;
3628 			if (infod.d_res & INFOD_FIRSTBYTES)
3629 				size = infod.d_bytes;
3630 		}
3631 
3632 		/*
3633 		 * Drop down from size_t to the "int" required by the
3634 		 * interface.  Cap at INT_MAX.
3635 		 */
3636 		retval = MIN(size, INT_MAX);
3637 		error = strcopyout(&retval, (void *)arg, sizeof (retval),
3638 		    copyflag);
3639 		if (!error)
3640 			*rvalp = count;
3641 		return (error);
3642 	}
3643 
3644 	case FIONREAD:
3645 		/*
3646 		 * Return number of bytes of data in all data messages
3647 		 * in queue in "arg".
3648 		 */
3649 	{
3650 		size_t	size = 0;
3651 		int	retval;
3652 
3653 		mutex_enter(QLOCK(rdq));
3654 		for (mp = rdq->q_first; mp != NULL; mp = mp->b_next)
3655 			size += msgdsize(mp);
3656 		mutex_exit(QLOCK(rdq));
3657 
3658 		if (stp->sd_struiordq) {
3659 			infod_t infod;
3660 
3661 			infod.d_cmd = INFOD_BYTES;
3662 			infod.d_res = 0;
3663 			infod.d_bytes = 0;
3664 			(void) infonext(rdq, &infod);
3665 			size += infod.d_bytes;
3666 		}
3667 
3668 		/*
3669 		 * Drop down from size_t to the "int" required by the
3670 		 * interface.  Cap at INT_MAX.
3671 		 */
3672 		retval = MIN(size, INT_MAX);
3673 		error = strcopyout(&retval, (void *)arg, sizeof (retval),
3674 		    copyflag);
3675 
3676 		*rvalp = 0;
3677 		return (error);
3678 	}
3679 	case FIORDCHK:
3680 		/*
3681 		 * FIORDCHK does not use arg value (like FIONREAD),
3682 		 * instead a count is returned. I_NREAD value may
3683 		 * not be accurate but safe. The real thing to do is
3684 		 * to add the msgdsizes of all data  messages until
3685 		 * a non-data message.
3686 		 */
3687 	{
3688 		size_t size = 0;
3689 
3690 		mutex_enter(QLOCK(rdq));
3691 		for (mp = rdq->q_first; mp != NULL; mp = mp->b_next)
3692 			size += msgdsize(mp);
3693 		mutex_exit(QLOCK(rdq));
3694 
3695 		if (stp->sd_struiordq) {
3696 			infod_t infod;
3697 
3698 			infod.d_cmd = INFOD_BYTES;
3699 			infod.d_res = 0;
3700 			infod.d_bytes = 0;
3701 			(void) infonext(rdq, &infod);
3702 			size += infod.d_bytes;
3703 		}
3704 
3705 		/*
3706 		 * Since ioctl returns an int, and memory sizes under
3707 		 * LP64 may not fit, we return INT_MAX if the count was
3708 		 * actually greater.
3709 		 */
3710 		*rvalp = MIN(size, INT_MAX);
3711 		return (0);
3712 	}
3713 
3714 	case I_FIND:
3715 		/*
3716 		 * Get module name.
3717 		 */
3718 	{
3719 		char mname[FMNAMESZ + 1];
3720 		queue_t *q;
3721 
3722 		error = (copyflag & U_TO_K ? copyinstr : copystr)((void *)arg,
3723 		    mname, FMNAMESZ + 1, NULL);
3724 		if (error)
3725 			return ((error == ENAMETOOLONG) ? EINVAL : EFAULT);
3726 
3727 		/*
3728 		 * Return EINVAL if we're handed a bogus module name.
3729 		 */
3730 		if (fmodsw_find(mname, FMODSW_LOAD) == NULL) {
3731 			TRACE_0(TR_FAC_STREAMS_FR,
3732 			    TR_I_CANT_FIND, "couldn't I_FIND");
3733 			return (EINVAL);
3734 		}
3735 
3736 		*rvalp = 0;
3737 
3738 		/* Look downstream to see if module is there. */
3739 		claimstr(stp->sd_wrq);
3740 		for (q = stp->sd_wrq->q_next; q; q = q->q_next) {
3741 			if (q->q_flag & QREADR) {
3742 				q = NULL;
3743 				break;
3744 			}
3745 			if (strcmp(mname, Q2NAME(q)) == 0)
3746 				break;
3747 		}
3748 		releasestr(stp->sd_wrq);
3749 
3750 		*rvalp = (q ? 1 : 0);
3751 		return (error);
3752 	}
3753 
3754 	case I_PUSH:
3755 	case __I_PUSH_NOCTTY:
3756 		/*
3757 		 * Push a module.
3758 		 * For the case __I_PUSH_NOCTTY push a module but
3759 		 * do not allocate controlling tty. See bugid 4025044
3760 		 */
3761 
3762 	{
3763 		char mname[FMNAMESZ + 1];
3764 		fmodsw_impl_t *fp;
3765 		dev_t dummydev;
3766 
3767 		if (stp->sd_flag & STRHUP)
3768 			return (ENXIO);
3769 
3770 		/*
3771 		 * Get module name and look up in fmodsw.
3772 		 */
3773 		error = (copyflag & U_TO_K ? copyinstr : copystr)((void *)arg,
3774 		    mname, FMNAMESZ + 1, NULL);
3775 		if (error)
3776 			return ((error == ENAMETOOLONG) ? EINVAL : EFAULT);
3777 
3778 		if ((fp = fmodsw_find(mname, FMODSW_HOLD | FMODSW_LOAD)) ==
3779 		    NULL)
3780 			return (EINVAL);
3781 
3782 		TRACE_2(TR_FAC_STREAMS_FR, TR_I_PUSH,
3783 		    "I_PUSH:fp %p stp %p", fp, stp);
3784 
3785 		if (error = strstartplumb(stp, flag, cmd)) {
3786 			fmodsw_rele(fp);
3787 			return (error);
3788 		}
3789 
3790 		/*
3791 		 * See if any more modules can be pushed on this stream.
3792 		 * Note that this check must be done after strstartplumb()
3793 		 * since otherwise multiple threads issuing I_PUSHes on
3794 		 * the same stream will be able to exceed nstrpush.
3795 		 */
3796 		mutex_enter(&stp->sd_lock);
3797 		if (stp->sd_pushcnt >= nstrpush) {
3798 			fmodsw_rele(fp);
3799 			strendplumb(stp);
3800 			mutex_exit(&stp->sd_lock);
3801 			return (EINVAL);
3802 		}
3803 		mutex_exit(&stp->sd_lock);
3804 
3805 		/*
3806 		 * Push new module and call its open routine
3807 		 * via qattach().  Modules don't change device
3808 		 * numbers, so just ignore dummydev here.
3809 		 */
3810 		dummydev = vp->v_rdev;
3811 		if ((error = qattach(rdq, &dummydev, 0, crp, fp,
3812 		    B_FALSE)) == 0) {
3813 			if (vp->v_type == VCHR && /* sorry, no pipes allowed */
3814 			    (cmd == I_PUSH) && (stp->sd_flag & STRISTTY)) {
3815 				/*
3816 				 * try to allocate it as a controlling terminal
3817 				 */
3818 				(void) strctty(stp);
3819 			}
3820 		}
3821 
3822 		mutex_enter(&stp->sd_lock);
3823 
3824 		/*
3825 		 * As a performance concern we are caching the values of
3826 		 * q_minpsz and q_maxpsz of the module below the stream
3827 		 * head in the stream head.
3828 		 */
3829 		mutex_enter(QLOCK(stp->sd_wrq->q_next));
3830 		rmin = stp->sd_wrq->q_next->q_minpsz;
3831 		rmax = stp->sd_wrq->q_next->q_maxpsz;
3832 		mutex_exit(QLOCK(stp->sd_wrq->q_next));
3833 
3834 		/* Do this processing here as a performance concern */
3835 		if (strmsgsz != 0) {
3836 			if (rmax == INFPSZ)
3837 				rmax = strmsgsz;
3838 			else  {
3839 				if (vp->v_type == VFIFO)
3840 					rmax = MIN(PIPE_BUF, rmax);
3841 				else	rmax = MIN(strmsgsz, rmax);
3842 			}
3843 		}
3844 
3845 		mutex_enter(QLOCK(wrq));
3846 		stp->sd_qn_minpsz = rmin;
3847 		stp->sd_qn_maxpsz = rmax;
3848 		mutex_exit(QLOCK(wrq));
3849 
3850 		strendplumb(stp);
3851 		mutex_exit(&stp->sd_lock);
3852 		return (error);
3853 	}
3854 
3855 	case I_POP:
3856 	{
3857 		queue_t	*q;
3858 
3859 		if (stp->sd_flag & STRHUP)
3860 			return (ENXIO);
3861 		if (!wrq->q_next)	/* for broken pipes */
3862 			return (EINVAL);
3863 
3864 		if (error = strstartplumb(stp, flag, cmd))
3865 			return (error);
3866 
3867 		/*
3868 		 * If there is an anchor on this stream and popping
3869 		 * the current module would attempt to pop through the
3870 		 * anchor, then disallow the pop unless we have sufficient
3871 		 * privileges; take the cheapest (non-locking) check
3872 		 * first.
3873 		 */
3874 		if (secpolicy_ip_config(crp, B_TRUE) != 0 ||
3875 		    (stp->sd_anchorzone != crgetzoneid(crp))) {
3876 			mutex_enter(&stp->sd_lock);
3877 			/*
3878 			 * Anchors only apply if there's at least one
3879 			 * module on the stream (sd_pushcnt > 0).
3880 			 */
3881 			if (stp->sd_pushcnt > 0 &&
3882 			    stp->sd_pushcnt == stp->sd_anchor &&
3883 			    stp->sd_vnode->v_type != VFIFO) {
3884 				strendplumb(stp);
3885 				mutex_exit(&stp->sd_lock);
3886 				if (stp->sd_anchorzone != crgetzoneid(crp))
3887 					return (EINVAL);
3888 				/* Audit and report error */
3889 				return (secpolicy_ip_config(crp, B_FALSE));
3890 			}
3891 			mutex_exit(&stp->sd_lock);
3892 		}
3893 
3894 		q = wrq->q_next;
3895 		TRACE_2(TR_FAC_STREAMS_FR, TR_I_POP,
3896 		    "I_POP:%p from %p", q, stp);
3897 		if (q->q_next == NULL || (q->q_flag & (QREADR|QISDRV))) {
3898 			error = EINVAL;
3899 		} else {
3900 			qdetach(_RD(q), 1, flag, crp, B_FALSE);
3901 			error = 0;
3902 		}
3903 		mutex_enter(&stp->sd_lock);
3904 
3905 		/*
3906 		 * As a performance concern we are caching the values of
3907 		 * q_minpsz and q_maxpsz of the module below the stream
3908 		 * head in the stream head.
3909 		 */
3910 		mutex_enter(QLOCK(wrq->q_next));
3911 		rmin = wrq->q_next->q_minpsz;
3912 		rmax = wrq->q_next->q_maxpsz;
3913 		mutex_exit(QLOCK(wrq->q_next));
3914 
3915 		/* Do this processing here as a performance concern */
3916 		if (strmsgsz != 0) {
3917 			if (rmax == INFPSZ)
3918 				rmax = strmsgsz;
3919 			else  {
3920 				if (vp->v_type == VFIFO)
3921 					rmax = MIN(PIPE_BUF, rmax);
3922 				else	rmax = MIN(strmsgsz, rmax);
3923 			}
3924 		}
3925 
3926 		mutex_enter(QLOCK(wrq));
3927 		stp->sd_qn_minpsz = rmin;
3928 		stp->sd_qn_maxpsz = rmax;
3929 		mutex_exit(QLOCK(wrq));
3930 
3931 		/* If we popped through the anchor, then reset the anchor. */
3932 		if (stp->sd_pushcnt < stp->sd_anchor) {
3933 			stp->sd_anchor = 0;
3934 			stp->sd_anchorzone = 0;
3935 		}
3936 		strendplumb(stp);
3937 		mutex_exit(&stp->sd_lock);
3938 		return (error);
3939 	}
3940 
3941 	case _I_MUXID2FD:
3942 	{
3943 		/*
3944 		 * Create a fd for a I_PLINK'ed lower stream with a given
3945 		 * muxid.  With the fd, application can send down ioctls,
3946 		 * like I_LIST, to the previously I_PLINK'ed stream.  Note
3947 		 * that after getting the fd, the application has to do an
3948 		 * I_PUNLINK on the muxid before it can do any operation
3949 		 * on the lower stream.  This is required by spec1170.
3950 		 *
3951 		 * The fd used to do this ioctl should point to the same
3952 		 * controlling device used to do the I_PLINK.  If it uses
3953 		 * a different stream or an invalid muxid, I_MUXID2FD will
3954 		 * fail.  The error code is set to EINVAL.
3955 		 *
3956 		 * The intended use of this interface is the following.
3957 		 * An application I_PLINK'ed a stream and exits.  The fd
3958 		 * to the lower stream is gone.  Another application
3959 		 * wants to get a fd to the lower stream, it uses I_MUXID2FD.
3960 		 */
3961 		int muxid = (int)arg;
3962 		int fd;
3963 		linkinfo_t *linkp;
3964 		struct file *fp;
3965 		netstack_t *ns;
3966 		str_stack_t *ss;
3967 
3968 		/*
3969 		 * Do not allow the wildcard muxid.  This ioctl is not
3970 		 * intended to find arbitrary link.
3971 		 */
3972 		if (muxid == 0) {
3973 			return (EINVAL);
3974 		}
3975 
3976 		ns = netstack_find_by_cred(crp);
3977 		ASSERT(ns != NULL);
3978 		ss = ns->netstack_str;
3979 		ASSERT(ss != NULL);
3980 
3981 		mutex_enter(&muxifier);
3982 		linkp = findlinks(vp->v_stream, muxid, LINKPERSIST, ss);
3983 		if (linkp == NULL) {
3984 			mutex_exit(&muxifier);
3985 			netstack_rele(ss->ss_netstack);
3986 			return (EINVAL);
3987 		}
3988 
3989 		if ((fd = ufalloc(0)) == -1) {
3990 			mutex_exit(&muxifier);
3991 			netstack_rele(ss->ss_netstack);
3992 			return (EMFILE);
3993 		}
3994 		fp = linkp->li_fpdown;
3995 		mutex_enter(&fp->f_tlock);
3996 		fp->f_count++;
3997 		mutex_exit(&fp->f_tlock);
3998 		mutex_exit(&muxifier);
3999 		setf(fd, fp);
4000 		*rvalp = fd;
4001 		netstack_rele(ss->ss_netstack);
4002 		return (0);
4003 	}
4004 
4005 	case _I_INSERT:
4006 	{
4007 		/*
4008 		 * To insert a module to a given position in a stream.
4009 		 * In the first release, only allow privileged user
4010 		 * to use this ioctl. Furthermore, the insert is only allowed
4011 		 * below an anchor if the zoneid is the same as the zoneid
4012 		 * which created the anchor.
4013 		 *
4014 		 * Note that we do not plan to support this ioctl
4015 		 * on pipes in the first release.  We want to learn more
4016 		 * about the implications of these ioctls before extending
4017 		 * their support.  And we do not think these features are
4018 		 * valuable for pipes.
4019 		 */
4020 		STRUCT_DECL(strmodconf, strmodinsert);
4021 		char mod_name[FMNAMESZ + 1];
4022 		fmodsw_impl_t *fp;
4023 		dev_t dummydev;
4024 		queue_t *tmp_wrq;
4025 		int pos;
4026 		boolean_t is_insert;
4027 
4028 		STRUCT_INIT(strmodinsert, flag);
4029 		if (stp->sd_flag & STRHUP)
4030 			return (ENXIO);
4031 		if (STRMATED(stp))
4032 			return (EINVAL);
4033 		if ((error = secpolicy_net_config(crp, B_FALSE)) != 0)
4034 			return (error);
4035 		if (stp->sd_anchor != 0 &&
4036 		    stp->sd_anchorzone != crgetzoneid(crp))
4037 			return (EINVAL);
4038 
4039 		error = strcopyin((void *)arg, STRUCT_BUF(strmodinsert),
4040 		    STRUCT_SIZE(strmodinsert), copyflag);
4041 		if (error)
4042 			return (error);
4043 
4044 		/*
4045 		 * Get module name and look up in fmodsw.
4046 		 */
4047 		error = (copyflag & U_TO_K ? copyinstr :
4048 		    copystr)(STRUCT_FGETP(strmodinsert, mod_name),
4049 		    mod_name, FMNAMESZ + 1, NULL);
4050 		if (error)
4051 			return ((error == ENAMETOOLONG) ? EINVAL : EFAULT);
4052 
4053 		if ((fp = fmodsw_find(mod_name, FMODSW_HOLD | FMODSW_LOAD)) ==
4054 		    NULL)
4055 			return (EINVAL);
4056 
4057 		if (error = strstartplumb(stp, flag, cmd)) {
4058 			fmodsw_rele(fp);
4059 			return (error);
4060 		}
4061 
4062 		/*
4063 		 * Is this _I_INSERT just like an I_PUSH?  We need to know
4064 		 * this because we do some optimizations if this is a
4065 		 * module being pushed.
4066 		 */
4067 		pos = STRUCT_FGET(strmodinsert, pos);
4068 		is_insert = (pos != 0);
4069 
4070 		/*
4071 		 * Make sure pos is valid.  Even though it is not an I_PUSH,
4072 		 * we impose the same limit on the number of modules in a
4073 		 * stream.
4074 		 */
4075 		mutex_enter(&stp->sd_lock);
4076 		if (stp->sd_pushcnt >= nstrpush || pos < 0 ||
4077 		    pos > stp->sd_pushcnt) {
4078 			fmodsw_rele(fp);
4079 			strendplumb(stp);
4080 			mutex_exit(&stp->sd_lock);
4081 			return (EINVAL);
4082 		}
4083 		if (stp->sd_anchor != 0) {
4084 			/*
4085 			 * Is this insert below the anchor?
4086 			 * Pushcnt hasn't been increased yet hence
4087 			 * we test for greater than here, and greater or
4088 			 * equal after qattach.
4089 			 */
4090 			if (pos > (stp->sd_pushcnt - stp->sd_anchor) &&
4091 			    stp->sd_anchorzone != crgetzoneid(crp)) {
4092 				fmodsw_rele(fp);
4093 				strendplumb(stp);
4094 				mutex_exit(&stp->sd_lock);
4095 				return (EPERM);
4096 			}
4097 		}
4098 
4099 		mutex_exit(&stp->sd_lock);
4100 
4101 		/*
4102 		 * First find the correct position this module to
4103 		 * be inserted.  We don't need to call claimstr()
4104 		 * as the stream should not be changing at this point.
4105 		 *
4106 		 * Insert new module and call its open routine
4107 		 * via qattach().  Modules don't change device
4108 		 * numbers, so just ignore dummydev here.
4109 		 */
4110 		for (tmp_wrq = stp->sd_wrq; pos > 0;
4111 		    tmp_wrq = tmp_wrq->q_next, pos--) {
4112 			ASSERT(SAMESTR(tmp_wrq));
4113 		}
4114 		dummydev = vp->v_rdev;
4115 		if ((error = qattach(_RD(tmp_wrq), &dummydev, 0, crp,
4116 		    fp, is_insert)) != 0) {
4117 			mutex_enter(&stp->sd_lock);
4118 			strendplumb(stp);
4119 			mutex_exit(&stp->sd_lock);
4120 			return (error);
4121 		}
4122 
4123 		mutex_enter(&stp->sd_lock);
4124 
4125 		/*
4126 		 * As a performance concern we are caching the values of
4127 		 * q_minpsz and q_maxpsz of the module below the stream
4128 		 * head in the stream head.
4129 		 */
4130 		if (!is_insert) {
4131 			mutex_enter(QLOCK(stp->sd_wrq->q_next));
4132 			rmin = stp->sd_wrq->q_next->q_minpsz;
4133 			rmax = stp->sd_wrq->q_next->q_maxpsz;
4134 			mutex_exit(QLOCK(stp->sd_wrq->q_next));
4135 
4136 			/* Do this processing here as a performance concern */
4137 			if (strmsgsz != 0) {
4138 				if (rmax == INFPSZ) {
4139 					rmax = strmsgsz;
4140 				} else  {
4141 					rmax = MIN(strmsgsz, rmax);
4142 				}
4143 			}
4144 
4145 			mutex_enter(QLOCK(wrq));
4146 			stp->sd_qn_minpsz = rmin;
4147 			stp->sd_qn_maxpsz = rmax;
4148 			mutex_exit(QLOCK(wrq));
4149 		}
4150 
4151 		/*
4152 		 * Need to update the anchor value if this module is
4153 		 * inserted below the anchor point.
4154 		 */
4155 		if (stp->sd_anchor != 0) {
4156 			pos = STRUCT_FGET(strmodinsert, pos);
4157 			if (pos >= (stp->sd_pushcnt - stp->sd_anchor))
4158 				stp->sd_anchor++;
4159 		}
4160 
4161 		strendplumb(stp);
4162 		mutex_exit(&stp->sd_lock);
4163 		return (0);
4164 	}
4165 
4166 	case _I_REMOVE:
4167 	{
4168 		/*
4169 		 * To remove a module with a given name in a stream.  The
4170 		 * caller of this ioctl needs to provide both the name and
4171 		 * the position of the module to be removed.  This eliminates
4172 		 * the ambiguity of removal if a module is inserted/pushed
4173 		 * multiple times in a stream.  In the first release, only
4174 		 * allow privileged user to use this ioctl.
4175 		 * Furthermore, the remove is only allowed
4176 		 * below an anchor if the zoneid is the same as the zoneid
4177 		 * which created the anchor.
4178 		 *
4179 		 * Note that we do not plan to support this ioctl
4180 		 * on pipes in the first release.  We want to learn more
4181 		 * about the implications of these ioctls before extending
4182 		 * their support.  And we do not think these features are
4183 		 * valuable for pipes.
4184 		 *
4185 		 * Also note that _I_REMOVE cannot be used to remove a
4186 		 * driver or the stream head.
4187 		 */
4188 		STRUCT_DECL(strmodconf, strmodremove);
4189 		queue_t	*q;
4190 		int pos;
4191 		char mod_name[FMNAMESZ + 1];
4192 		boolean_t is_remove;
4193 
4194 		STRUCT_INIT(strmodremove, flag);
4195 		if (stp->sd_flag & STRHUP)
4196 			return (ENXIO);
4197 		if (STRMATED(stp))
4198 			return (EINVAL);
4199 		if ((error = secpolicy_net_config(crp, B_FALSE)) != 0)
4200 			return (error);
4201 		if (stp->sd_anchor != 0 &&
4202 		    stp->sd_anchorzone != crgetzoneid(crp))
4203 			return (EINVAL);
4204 
4205 		error = strcopyin((void *)arg, STRUCT_BUF(strmodremove),
4206 		    STRUCT_SIZE(strmodremove), copyflag);
4207 		if (error)
4208 			return (error);
4209 
4210 		error = (copyflag & U_TO_K ? copyinstr :
4211 		    copystr)(STRUCT_FGETP(strmodremove, mod_name),
4212 		    mod_name, FMNAMESZ + 1, NULL);
4213 		if (error)
4214 			return ((error == ENAMETOOLONG) ? EINVAL : EFAULT);
4215 
4216 		if ((error = strstartplumb(stp, flag, cmd)) != 0)
4217 			return (error);
4218 
4219 		/*
4220 		 * Match the name of given module to the name of module at
4221 		 * the given position.
4222 		 */
4223 		pos = STRUCT_FGET(strmodremove, pos);
4224 
4225 		is_remove = (pos != 0);
4226 		for (q = stp->sd_wrq->q_next; SAMESTR(q) && pos > 0;
4227 		    q = q->q_next, pos--)
4228 			;
4229 		if (pos > 0 || !SAMESTR(q) ||
4230 		    strcmp(Q2NAME(q), mod_name) != 0) {
4231 			mutex_enter(&stp->sd_lock);
4232 			strendplumb(stp);
4233 			mutex_exit(&stp->sd_lock);
4234 			return (EINVAL);
4235 		}
4236 
4237 		/*
4238 		 * If the position is at or below an anchor, then the zoneid
4239 		 * must match the zoneid that created the anchor.
4240 		 */
4241 		if (stp->sd_anchor != 0) {
4242 			pos = STRUCT_FGET(strmodremove, pos);
4243 			if (pos >= (stp->sd_pushcnt - stp->sd_anchor) &&
4244 			    stp->sd_anchorzone != crgetzoneid(crp)) {
4245 				mutex_enter(&stp->sd_lock);
4246 				strendplumb(stp);
4247 				mutex_exit(&stp->sd_lock);
4248 				return (EPERM);
4249 			}
4250 		}
4251 
4252 
4253 		ASSERT(!(q->q_flag & QREADR));
4254 		qdetach(_RD(q), 1, flag, crp, is_remove);
4255 
4256 		mutex_enter(&stp->sd_lock);
4257 
4258 		/*
4259 		 * As a performance concern we are caching the values of
4260 		 * q_minpsz and q_maxpsz of the module below the stream
4261 		 * head in the stream head.
4262 		 */
4263 		if (!is_remove) {
4264 			mutex_enter(QLOCK(wrq->q_next));
4265 			rmin = wrq->q_next->q_minpsz;
4266 			rmax = wrq->q_next->q_maxpsz;
4267 			mutex_exit(QLOCK(wrq->q_next));
4268 
4269 			/* Do this processing here as a performance concern */
4270 			if (strmsgsz != 0) {
4271 				if (rmax == INFPSZ)
4272 					rmax = strmsgsz;
4273 				else  {
4274 					if (vp->v_type == VFIFO)
4275 						rmax = MIN(PIPE_BUF, rmax);
4276 					else	rmax = MIN(strmsgsz, rmax);
4277 				}
4278 			}
4279 
4280 			mutex_enter(QLOCK(wrq));
4281 			stp->sd_qn_minpsz = rmin;
4282 			stp->sd_qn_maxpsz = rmax;
4283 			mutex_exit(QLOCK(wrq));
4284 		}
4285 
4286 		/*
4287 		 * Need to update the anchor value if this module is removed
4288 		 * at or below the anchor point.  If the removed module is at
4289 		 * the anchor point, remove the anchor for this stream if
4290 		 * there is no module above the anchor point.  Otherwise, if
4291 		 * the removed module is below the anchor point, decrement the
4292 		 * anchor point by 1.
4293 		 */
4294 		if (stp->sd_anchor != 0) {
4295 			pos = STRUCT_FGET(strmodremove, pos);
4296 			if (pos == stp->sd_pushcnt - stp->sd_anchor + 1)
4297 				stp->sd_anchor = 0;
4298 			else if (pos > (stp->sd_pushcnt - stp->sd_anchor + 1))
4299 				stp->sd_anchor--;
4300 		}
4301 
4302 		strendplumb(stp);
4303 		mutex_exit(&stp->sd_lock);
4304 		return (0);
4305 	}
4306 
4307 	case I_ANCHOR:
4308 		/*
4309 		 * Set the anchor position on the stream to reside at
4310 		 * the top module (in other words, the top module
4311 		 * cannot be popped).  Anchors with a FIFO make no
4312 		 * obvious sense, so they're not allowed.
4313 		 */
4314 		mutex_enter(&stp->sd_lock);
4315 
4316 		if (stp->sd_vnode->v_type == VFIFO) {
4317 			mutex_exit(&stp->sd_lock);
4318 			return (EINVAL);
4319 		}
4320 		/* Only allow the same zoneid to update the anchor */
4321 		if (stp->sd_anchor != 0 &&
4322 		    stp->sd_anchorzone != crgetzoneid(crp)) {
4323 			mutex_exit(&stp->sd_lock);
4324 			return (EINVAL);
4325 		}
4326 		stp->sd_anchor = stp->sd_pushcnt;
4327 		stp->sd_anchorzone = crgetzoneid(crp);
4328 		mutex_exit(&stp->sd_lock);
4329 		return (0);
4330 
4331 	case I_LOOK:
4332 		/*
4333 		 * Get name of first module downstream.
4334 		 * If no module, return an error.
4335 		 */
4336 		claimstr(wrq);
4337 		if (_SAMESTR(wrq) && wrq->q_next->q_next != NULL) {
4338 			char *name = Q2NAME(wrq->q_next);
4339 
4340 			error = strcopyout(name, (void *)arg, strlen(name) + 1,
4341 			    copyflag);
4342 			releasestr(wrq);
4343 			return (error);
4344 		}
4345 		releasestr(wrq);
4346 		return (EINVAL);
4347 
4348 	case I_LINK:
4349 	case I_PLINK:
4350 		/*
4351 		 * Link a multiplexor.
4352 		 */
4353 		return (mlink(vp, cmd, (int)arg, crp, rvalp, 0));
4354 
4355 	case _I_PLINK_LH:
4356 		/*
4357 		 * Link a multiplexor: Call must originate from kernel.
4358 		 */
4359 		if (kioctl)
4360 			return (ldi_mlink_lh(vp, cmd, arg, crp, rvalp));
4361 
4362 		return (EINVAL);
4363 	case I_UNLINK:
4364 	case I_PUNLINK:
4365 		/*
4366 		 * Unlink a multiplexor.
4367 		 * If arg is -1, unlink all links for which this is the
4368 		 * controlling stream.  Otherwise, arg is an index number
4369 		 * for a link to be removed.
4370 		 */
4371 	{
4372 		struct linkinfo *linkp;
4373 		int native_arg = (int)arg;
4374 		int type;
4375 		netstack_t *ns;
4376 		str_stack_t *ss;
4377 
4378 		TRACE_1(TR_FAC_STREAMS_FR,
4379 		    TR_I_UNLINK, "I_UNLINK/I_PUNLINK:%p", stp);
4380 		if (vp->v_type == VFIFO) {
4381 			return (EINVAL);
4382 		}
4383 		if (cmd == I_UNLINK)
4384 			type = LINKNORMAL;
4385 		else	/* I_PUNLINK */
4386 			type = LINKPERSIST;
4387 		if (native_arg == 0) {
4388 			return (EINVAL);
4389 		}
4390 		ns = netstack_find_by_cred(crp);
4391 		ASSERT(ns != NULL);
4392 		ss = ns->netstack_str;
4393 		ASSERT(ss != NULL);
4394 
4395 		if (native_arg == MUXID_ALL)
4396 			error = munlinkall(stp, type, crp, rvalp, ss);
4397 		else {
4398 			mutex_enter(&muxifier);
4399 			if (!(linkp = findlinks(stp, (int)arg, type, ss))) {
4400 				/* invalid user supplied index number */
4401 				mutex_exit(&muxifier);
4402 				netstack_rele(ss->ss_netstack);
4403 				return (EINVAL);
4404 			}
4405 			/* munlink drops the muxifier lock */
4406 			error = munlink(stp, linkp, type, crp, rvalp, ss);
4407 		}
4408 		netstack_rele(ss->ss_netstack);
4409 		return (error);
4410 	}
4411 
4412 	case I_FLUSH:
4413 		/*
4414 		 * send a flush message downstream
4415 		 * flush message can indicate
4416 		 * FLUSHR - flush read queue
4417 		 * FLUSHW - flush write queue
4418 		 * FLUSHRW - flush read/write queue
4419 		 */
4420 		if (stp->sd_flag & STRHUP)
4421 			return (ENXIO);
4422 		if (arg & ~FLUSHRW)
4423 			return (EINVAL);
4424 
4425 		for (;;) {
4426 			if (putnextctl1(stp->sd_wrq, M_FLUSH, (int)arg)) {
4427 				break;
4428 			}
4429 			if (error = strwaitbuf(1, BPRI_HI)) {
4430 				return (error);
4431 			}
4432 		}
4433 
4434 		/*
4435 		 * Send down an unsupported ioctl and wait for the nack
4436 		 * in order to allow the M_FLUSH to propagate back
4437 		 * up to the stream head.
4438 		 * Replaces if (qready()) runqueues();
4439 		 */
4440 		strioc.ic_cmd = -1;	/* The unsupported ioctl */
4441 		strioc.ic_timout = 0;
4442 		strioc.ic_len = 0;
4443 		strioc.ic_dp = NULL;
4444 		(void) strdoioctl(stp, &strioc, flag, K_TO_K, crp, rvalp);
4445 		*rvalp = 0;
4446 		return (0);
4447 
4448 	case I_FLUSHBAND:
4449 	{
4450 		struct bandinfo binfo;
4451 
4452 		error = strcopyin((void *)arg, &binfo, sizeof (binfo),
4453 		    copyflag);
4454 		if (error)
4455 			return (error);
4456 		if (stp->sd_flag & STRHUP)
4457 			return (ENXIO);
4458 		if (binfo.bi_flag & ~FLUSHRW)
4459 			return (EINVAL);
4460 		while (!(mp = allocb(2, BPRI_HI))) {
4461 			if (error = strwaitbuf(2, BPRI_HI))
4462 				return (error);
4463 		}
4464 		mp->b_datap->db_type = M_FLUSH;
4465 		*mp->b_wptr++ = binfo.bi_flag | FLUSHBAND;
4466 		*mp->b_wptr++ = binfo.bi_pri;
4467 		putnext(stp->sd_wrq, mp);
4468 		/*
4469 		 * Send down an unsupported ioctl and wait for the nack
4470 		 * in order to allow the M_FLUSH to propagate back
4471 		 * up to the stream head.
4472 		 * Replaces if (qready()) runqueues();
4473 		 */
4474 		strioc.ic_cmd = -1;	/* The unsupported ioctl */
4475 		strioc.ic_timout = 0;
4476 		strioc.ic_len = 0;
4477 		strioc.ic_dp = NULL;
4478 		(void) strdoioctl(stp, &strioc, flag, K_TO_K, crp, rvalp);
4479 		*rvalp = 0;
4480 		return (0);
4481 	}
4482 
4483 	case I_SRDOPT:
4484 		/*
4485 		 * Set read options
4486 		 *
4487 		 * RNORM - default stream mode
4488 		 * RMSGN - message no discard
4489 		 * RMSGD - message discard
4490 		 * RPROTNORM - fail read with EBADMSG for M_[PC]PROTOs
4491 		 * RPROTDAT - convert M_[PC]PROTOs to M_DATAs
4492 		 * RPROTDIS - discard M_[PC]PROTOs and retain M_DATAs
4493 		 */
4494 		if (arg & ~(RMODEMASK | RPROTMASK))
4495 			return (EINVAL);
4496 
4497 		if ((arg & (RMSGD|RMSGN)) == (RMSGD|RMSGN))
4498 			return (EINVAL);
4499 
4500 		mutex_enter(&stp->sd_lock);
4501 		switch (arg & RMODEMASK) {
4502 		case RNORM:
4503 			stp->sd_read_opt &= ~(RD_MSGDIS | RD_MSGNODIS);
4504 			break;
4505 		case RMSGD:
4506 			stp->sd_read_opt = (stp->sd_read_opt & ~RD_MSGNODIS) |
4507 			    RD_MSGDIS;
4508 			break;
4509 		case RMSGN:
4510 			stp->sd_read_opt = (stp->sd_read_opt & ~RD_MSGDIS) |
4511 			    RD_MSGNODIS;
4512 			break;
4513 		}
4514 
4515 		switch (arg & RPROTMASK) {
4516 		case RPROTNORM:
4517 			stp->sd_read_opt &= ~(RD_PROTDAT | RD_PROTDIS);
4518 			break;
4519 
4520 		case RPROTDAT:
4521 			stp->sd_read_opt = ((stp->sd_read_opt & ~RD_PROTDIS) |
4522 			    RD_PROTDAT);
4523 			break;
4524 
4525 		case RPROTDIS:
4526 			stp->sd_read_opt = ((stp->sd_read_opt & ~RD_PROTDAT) |
4527 			    RD_PROTDIS);
4528 			break;
4529 		}
4530 		mutex_exit(&stp->sd_lock);
4531 		return (0);
4532 
4533 	case I_GRDOPT:
4534 		/*
4535 		 * Get read option and return the value
4536 		 * to spot pointed to by arg
4537 		 */
4538 	{
4539 		int rdopt;
4540 
4541 		rdopt = ((stp->sd_read_opt & RD_MSGDIS) ? RMSGD :
4542 		    ((stp->sd_read_opt & RD_MSGNODIS) ? RMSGN : RNORM));
4543 		rdopt |= ((stp->sd_read_opt & RD_PROTDAT) ? RPROTDAT :
4544 		    ((stp->sd_read_opt & RD_PROTDIS) ? RPROTDIS : RPROTNORM));
4545 
4546 		return (strcopyout(&rdopt, (void *)arg, sizeof (int),
4547 		    copyflag));
4548 	}
4549 
4550 	case I_SERROPT:
4551 		/*
4552 		 * Set error options
4553 		 *
4554 		 * RERRNORM - persistent read errors
4555 		 * RERRNONPERSIST - non-persistent read errors
4556 		 * WERRNORM - persistent write errors
4557 		 * WERRNONPERSIST - non-persistent write errors
4558 		 */
4559 		if (arg & ~(RERRMASK | WERRMASK))
4560 			return (EINVAL);
4561 
4562 		mutex_enter(&stp->sd_lock);
4563 		switch (arg & RERRMASK) {
4564 		case RERRNORM:
4565 			stp->sd_flag &= ~STRDERRNONPERSIST;
4566 			break;
4567 		case RERRNONPERSIST:
4568 			stp->sd_flag |= STRDERRNONPERSIST;
4569 			break;
4570 		}
4571 		switch (arg & WERRMASK) {
4572 		case WERRNORM:
4573 			stp->sd_flag &= ~STWRERRNONPERSIST;
4574 			break;
4575 		case WERRNONPERSIST:
4576 			stp->sd_flag |= STWRERRNONPERSIST;
4577 			break;
4578 		}
4579 		mutex_exit(&stp->sd_lock);
4580 		return (0);
4581 
4582 	case I_GERROPT:
4583 		/*
4584 		 * Get error option and return the value
4585 		 * to spot pointed to by arg
4586 		 */
4587 	{
4588 		int erropt = 0;
4589 
4590 		erropt |= (stp->sd_flag & STRDERRNONPERSIST) ? RERRNONPERSIST :
4591 		    RERRNORM;
4592 		erropt |= (stp->sd_flag & STWRERRNONPERSIST) ? WERRNONPERSIST :
4593 		    WERRNORM;
4594 		return (strcopyout(&erropt, (void *)arg, sizeof (int),
4595 		    copyflag));
4596 	}
4597 
4598 	case I_SETSIG:
4599 		/*
4600 		 * Register the calling proc to receive the SIGPOLL
4601 		 * signal based on the events given in arg.  If
4602 		 * arg is zero, remove the proc from register list.
4603 		 */
4604 	{
4605 		strsig_t *ssp, *pssp;
4606 		struct pid *pidp;
4607 
4608 		pssp = NULL;
4609 		pidp = curproc->p_pidp;
4610 		/*
4611 		 * Hold sd_lock to prevent traversal of sd_siglist while
4612 		 * it is modified.
4613 		 */
4614 		mutex_enter(&stp->sd_lock);
4615 		for (ssp = stp->sd_siglist; ssp && (ssp->ss_pidp != pidp);
4616 		    pssp = ssp, ssp = ssp->ss_next)
4617 			;
4618 
4619 		if (arg) {
4620 			if (arg & ~(S_INPUT|S_HIPRI|S_MSG|S_HANGUP|S_ERROR|
4621 			    S_RDNORM|S_WRNORM|S_RDBAND|S_WRBAND|S_BANDURG)) {
4622 				mutex_exit(&stp->sd_lock);
4623 				return (EINVAL);
4624 			}
4625 			if ((arg & S_BANDURG) && !(arg & S_RDBAND)) {
4626 				mutex_exit(&stp->sd_lock);
4627 				return (EINVAL);
4628 			}
4629 
4630 			/*
4631 			 * If proc not already registered, add it
4632 			 * to list.
4633 			 */
4634 			if (!ssp) {
4635 				ssp = kmem_alloc(sizeof (strsig_t), KM_SLEEP);
4636 				ssp->ss_pidp = pidp;
4637 				ssp->ss_pid = pidp->pid_id;
4638 				ssp->ss_next = NULL;
4639 				if (pssp)
4640 					pssp->ss_next = ssp;
4641 				else
4642 					stp->sd_siglist = ssp;
4643 				mutex_enter(&pidlock);
4644 				PID_HOLD(pidp);
4645 				mutex_exit(&pidlock);
4646 			}
4647 
4648 			/*
4649 			 * Set events.
4650 			 */
4651 			ssp->ss_events = (int)arg;
4652 		} else {
4653 			/*
4654 			 * Remove proc from register list.
4655 			 */
4656 			if (ssp) {
4657 				mutex_enter(&pidlock);
4658 				PID_RELE(pidp);
4659 				mutex_exit(&pidlock);
4660 				if (pssp)
4661 					pssp->ss_next = ssp->ss_next;
4662 				else
4663 					stp->sd_siglist = ssp->ss_next;
4664 				kmem_free(ssp, sizeof (strsig_t));
4665 			} else {
4666 				mutex_exit(&stp->sd_lock);
4667 				return (EINVAL);
4668 			}
4669 		}
4670 
4671 		/*
4672 		 * Recalculate OR of sig events.
4673 		 */
4674 		stp->sd_sigflags = 0;
4675 		for (ssp = stp->sd_siglist; ssp; ssp = ssp->ss_next)
4676 			stp->sd_sigflags |= ssp->ss_events;
4677 		mutex_exit(&stp->sd_lock);
4678 		return (0);
4679 	}
4680 
4681 	case I_GETSIG:
4682 		/*
4683 		 * Return (in arg) the current registration of events
4684 		 * for which the calling proc is to be signaled.
4685 		 */
4686 	{
4687 		struct strsig *ssp;
4688 		struct pid  *pidp;
4689 
4690 		pidp = curproc->p_pidp;
4691 		mutex_enter(&stp->sd_lock);
4692 		for (ssp = stp->sd_siglist; ssp; ssp = ssp->ss_next)
4693 			if (ssp->ss_pidp == pidp) {
4694 				error = strcopyout(&ssp->ss_events, (void *)arg,
4695 				    sizeof (int), copyflag);
4696 				mutex_exit(&stp->sd_lock);
4697 				return (error);
4698 			}
4699 		mutex_exit(&stp->sd_lock);
4700 		return (EINVAL);
4701 	}
4702 
4703 	case I_ESETSIG:
4704 		/*
4705 		 * Register the ss_pid to receive the SIGPOLL
4706 		 * signal based on the events is ss_events arg.  If
4707 		 * ss_events is zero, remove the proc from register list.
4708 		 */
4709 	{
4710 		struct strsig *ssp, *pssp;
4711 		struct proc *proc;
4712 		struct pid  *pidp;
4713 		pid_t pid;
4714 		struct strsigset ss;
4715 
4716 		error = strcopyin((void *)arg, &ss, sizeof (ss), copyflag);
4717 		if (error)
4718 			return (error);
4719 
4720 		pid = ss.ss_pid;
4721 
4722 		if (ss.ss_events != 0) {
4723 			/*
4724 			 * Permissions check by sending signal 0.
4725 			 * Note that when kill fails it does a set_errno
4726 			 * causing the system call to fail.
4727 			 */
4728 			error = kill(pid, 0);
4729 			if (error) {
4730 				return (error);
4731 			}
4732 		}
4733 		mutex_enter(&pidlock);
4734 		if (pid == 0)
4735 			proc = curproc;
4736 		else if (pid < 0)
4737 			proc = pgfind(-pid);
4738 		else
4739 			proc = prfind(pid);
4740 		if (proc == NULL) {
4741 			mutex_exit(&pidlock);
4742 			return (ESRCH);
4743 		}
4744 		if (pid < 0)
4745 			pidp = proc->p_pgidp;
4746 		else
4747 			pidp = proc->p_pidp;
4748 		ASSERT(pidp);
4749 		/*
4750 		 * Get a hold on the pid structure while referencing it.
4751 		 * There is a separate PID_HOLD should it be inserted
4752 		 * in the list below.
4753 		 */
4754 		PID_HOLD(pidp);
4755 		mutex_exit(&pidlock);
4756 
4757 		pssp = NULL;
4758 		/*
4759 		 * Hold sd_lock to prevent traversal of sd_siglist while
4760 		 * it is modified.
4761 		 */
4762 		mutex_enter(&stp->sd_lock);
4763 		for (ssp = stp->sd_siglist; ssp && (ssp->ss_pid != pid);
4764 		    pssp = ssp, ssp = ssp->ss_next)
4765 			;
4766 
4767 		if (ss.ss_events) {
4768 			if (ss.ss_events &
4769 			    ~(S_INPUT|S_HIPRI|S_MSG|S_HANGUP|S_ERROR|
4770 			    S_RDNORM|S_WRNORM|S_RDBAND|S_WRBAND|S_BANDURG)) {
4771 				mutex_exit(&stp->sd_lock);
4772 				mutex_enter(&pidlock);
4773 				PID_RELE(pidp);
4774 				mutex_exit(&pidlock);
4775 				return (EINVAL);
4776 			}
4777 			if ((ss.ss_events & S_BANDURG) &&
4778 			    !(ss.ss_events & S_RDBAND)) {
4779 				mutex_exit(&stp->sd_lock);
4780 				mutex_enter(&pidlock);
4781 				PID_RELE(pidp);
4782 				mutex_exit(&pidlock);
4783 				return (EINVAL);
4784 			}
4785 
4786 			/*
4787 			 * If proc not already registered, add it
4788 			 * to list.
4789 			 */
4790 			if (!ssp) {
4791 				ssp = kmem_alloc(sizeof (strsig_t), KM_SLEEP);
4792 				ssp->ss_pidp = pidp;
4793 				ssp->ss_pid = pid;
4794 				ssp->ss_next = NULL;
4795 				if (pssp)
4796 					pssp->ss_next = ssp;
4797 				else
4798 					stp->sd_siglist = ssp;
4799 				mutex_enter(&pidlock);
4800 				PID_HOLD(pidp);
4801 				mutex_exit(&pidlock);
4802 			}
4803 
4804 			/*
4805 			 * Set events.
4806 			 */
4807 			ssp->ss_events = ss.ss_events;
4808 		} else {
4809 			/*
4810 			 * Remove proc from register list.
4811 			 */
4812 			if (ssp) {
4813 				mutex_enter(&pidlock);
4814 				PID_RELE(pidp);
4815 				mutex_exit(&pidlock);
4816 				if (pssp)
4817 					pssp->ss_next = ssp->ss_next;
4818 				else
4819 					stp->sd_siglist = ssp->ss_next;
4820 				kmem_free(ssp, sizeof (strsig_t));
4821 			} else {
4822 				mutex_exit(&stp->sd_lock);
4823 				mutex_enter(&pidlock);
4824 				PID_RELE(pidp);
4825 				mutex_exit(&pidlock);
4826 				return (EINVAL);
4827 			}
4828 		}
4829 
4830 		/*
4831 		 * Recalculate OR of sig events.
4832 		 */
4833 		stp->sd_sigflags = 0;
4834 		for (ssp = stp->sd_siglist; ssp; ssp = ssp->ss_next)
4835 			stp->sd_sigflags |= ssp->ss_events;
4836 		mutex_exit(&stp->sd_lock);
4837 		mutex_enter(&pidlock);
4838 		PID_RELE(pidp);
4839 		mutex_exit(&pidlock);
4840 		return (0);
4841 	}
4842 
4843 	case I_EGETSIG:
4844 		/*
4845 		 * Return (in arg) the current registration of events
4846 		 * for which the calling proc is to be signaled.
4847 		 */
4848 	{
4849 		struct strsig *ssp;
4850 		struct proc *proc;
4851 		pid_t pid;
4852 		struct pid  *pidp;
4853 		struct strsigset ss;
4854 
4855 		error = strcopyin((void *)arg, &ss, sizeof (ss), copyflag);
4856 		if (error)
4857 			return (error);
4858 
4859 		pid = ss.ss_pid;
4860 		mutex_enter(&pidlock);
4861 		if (pid == 0)
4862 			proc = curproc;
4863 		else if (pid < 0)
4864 			proc = pgfind(-pid);
4865 		else
4866 			proc = prfind(pid);
4867 		if (proc == NULL) {
4868 			mutex_exit(&pidlock);
4869 			return (ESRCH);
4870 		}
4871 		if (pid < 0)
4872 			pidp = proc->p_pgidp;
4873 		else
4874 			pidp = proc->p_pidp;
4875 
4876 		/* Prevent the pidp from being reassigned */
4877 		PID_HOLD(pidp);
4878 		mutex_exit(&pidlock);
4879 
4880 		mutex_enter(&stp->sd_lock);
4881 		for (ssp = stp->sd_siglist; ssp; ssp = ssp->ss_next)
4882 			if (ssp->ss_pid == pid) {
4883 				ss.ss_pid = ssp->ss_pid;
4884 				ss.ss_events = ssp->ss_events;
4885 				error = strcopyout(&ss, (void *)arg,
4886 				    sizeof (struct strsigset), copyflag);
4887 				mutex_exit(&stp->sd_lock);
4888 				mutex_enter(&pidlock);
4889 				PID_RELE(pidp);
4890 				mutex_exit(&pidlock);
4891 				return (error);
4892 			}
4893 		mutex_exit(&stp->sd_lock);
4894 		mutex_enter(&pidlock);
4895 		PID_RELE(pidp);
4896 		mutex_exit(&pidlock);
4897 		return (EINVAL);
4898 	}
4899 
4900 	case I_PEEK:
4901 	{
4902 		STRUCT_DECL(strpeek, strpeek);
4903 		size_t n;
4904 		mblk_t *fmp, *tmp_mp = NULL;
4905 
4906 		STRUCT_INIT(strpeek, flag);
4907 
4908 		error = strcopyin((void *)arg, STRUCT_BUF(strpeek),
4909 		    STRUCT_SIZE(strpeek), copyflag);
4910 		if (error)
4911 			return (error);
4912 
4913 		mutex_enter(QLOCK(rdq));
4914 		/*
4915 		 * Skip the invalid messages
4916 		 */
4917 		for (mp = rdq->q_first; mp != NULL; mp = mp->b_next)
4918 			if (mp->b_datap->db_type != M_SIG)
4919 				break;
4920 
4921 		/*
4922 		 * If user has requested to peek at a high priority message
4923 		 * and first message is not, return 0
4924 		 */
4925 		if (mp != NULL) {
4926 			if ((STRUCT_FGET(strpeek, flags) & RS_HIPRI) &&
4927 			    queclass(mp) == QNORM) {
4928 				*rvalp = 0;
4929 				mutex_exit(QLOCK(rdq));
4930 				return (0);
4931 			}
4932 		} else if (stp->sd_struiordq == NULL ||
4933 		    (STRUCT_FGET(strpeek, flags) & RS_HIPRI)) {
4934 			/*
4935 			 * No mblks to look at at the streamhead and
4936 			 * 1). This isn't a synch stream or
4937 			 * 2). This is a synch stream but caller wants high
4938 			 *	priority messages which is not supported by
4939 			 *	the synch stream. (it only supports QNORM)
4940 			 */
4941 			*rvalp = 0;
4942 			mutex_exit(QLOCK(rdq));
4943 			return (0);
4944 		}
4945 
4946 		fmp = mp;
4947 
4948 		if (mp && mp->b_datap->db_type == M_PASSFP) {
4949 			mutex_exit(QLOCK(rdq));
4950 			return (EBADMSG);
4951 		}
4952 
4953 		ASSERT(mp == NULL || mp->b_datap->db_type == M_PCPROTO ||
4954 		    mp->b_datap->db_type == M_PROTO ||
4955 		    mp->b_datap->db_type == M_DATA);
4956 
4957 		if (mp && mp->b_datap->db_type == M_PCPROTO) {
4958 			STRUCT_FSET(strpeek, flags, RS_HIPRI);
4959 		} else {
4960 			STRUCT_FSET(strpeek, flags, 0);
4961 		}
4962 
4963 
4964 		if (mp && ((tmp_mp = dupmsg(mp)) == NULL)) {
4965 			mutex_exit(QLOCK(rdq));
4966 			return (ENOSR);
4967 		}
4968 		mutex_exit(QLOCK(rdq));
4969 
4970 		/*
4971 		 * set mp = tmp_mp, so that I_PEEK processing can continue.
4972 		 * tmp_mp is used to free the dup'd message.
4973 		 */
4974 		mp = tmp_mp;
4975 
4976 		uio.uio_fmode = 0;
4977 		uio.uio_extflg = UIO_COPY_CACHED;
4978 		uio.uio_segflg = (copyflag == U_TO_K) ? UIO_USERSPACE :
4979 		    UIO_SYSSPACE;
4980 		uio.uio_limit = 0;
4981 		/*
4982 		 * First process PROTO blocks, if any.
4983 		 * If user doesn't want to get ctl info by setting maxlen <= 0,
4984 		 * then set len to -1/0 and skip control blocks part.
4985 		 */
4986 		if (STRUCT_FGET(strpeek, ctlbuf.maxlen) < 0)
4987 			STRUCT_FSET(strpeek, ctlbuf.len, -1);
4988 		else if (STRUCT_FGET(strpeek, ctlbuf.maxlen) == 0)
4989 			STRUCT_FSET(strpeek, ctlbuf.len, 0);
4990 		else {
4991 			int	ctl_part = 0;
4992 
4993 			iov.iov_base = STRUCT_FGETP(strpeek, ctlbuf.buf);
4994 			iov.iov_len = STRUCT_FGET(strpeek, ctlbuf.maxlen);
4995 			uio.uio_iov = &iov;
4996 			uio.uio_resid = iov.iov_len;
4997 			uio.uio_loffset = 0;
4998 			uio.uio_iovcnt = 1;
4999 			while (mp && mp->b_datap->db_type != M_DATA &&
5000 			    uio.uio_resid >= 0) {
5001 				ASSERT(STRUCT_FGET(strpeek, flags) == 0 ?
5002 				    mp->b_datap->db_type == M_PROTO :
5003 				    mp->b_datap->db_type == M_PCPROTO);
5004 
5005 				if ((n = MIN(uio.uio_resid,
5006 				    mp->b_wptr - mp->b_rptr)) != 0 &&
5007 				    (error = uiomove((char *)mp->b_rptr, n,
5008 				    UIO_READ, &uio)) != 0) {
5009 					freemsg(tmp_mp);
5010 					return (error);
5011 				}
5012 				ctl_part = 1;
5013 				mp = mp->b_cont;
5014 			}
5015 			/* No ctl message */
5016 			if (ctl_part == 0)
5017 				STRUCT_FSET(strpeek, ctlbuf.len, -1);
5018 			else
5019 				STRUCT_FSET(strpeek, ctlbuf.len,
5020 				    STRUCT_FGET(strpeek, ctlbuf.maxlen) -
5021 				    uio.uio_resid);
5022 		}
5023 
5024 		/*
5025 		 * Now process DATA blocks, if any.
5026 		 * If user doesn't want to get data info by setting maxlen <= 0,
5027 		 * then set len to -1/0 and skip data blocks part.
5028 		 */
5029 		if (STRUCT_FGET(strpeek, databuf.maxlen) < 0)
5030 			STRUCT_FSET(strpeek, databuf.len, -1);
5031 		else if (STRUCT_FGET(strpeek, databuf.maxlen) == 0)
5032 			STRUCT_FSET(strpeek, databuf.len, 0);
5033 		else {
5034 			int	data_part = 0;
5035 
5036 			iov.iov_base = STRUCT_FGETP(strpeek, databuf.buf);
5037 			iov.iov_len = STRUCT_FGET(strpeek, databuf.maxlen);
5038 			uio.uio_iov = &iov;
5039 			uio.uio_resid = iov.iov_len;
5040 			uio.uio_loffset = 0;
5041 			uio.uio_iovcnt = 1;
5042 			while (mp && uio.uio_resid) {
5043 				if (mp->b_datap->db_type == M_DATA) {
5044 					if ((n = MIN(uio.uio_resid,
5045 					    mp->b_wptr - mp->b_rptr)) != 0 &&
5046 					    (error = uiomove((char *)mp->b_rptr,
5047 					    n, UIO_READ, &uio)) != 0) {
5048 						freemsg(tmp_mp);
5049 						return (error);
5050 					}
5051 					data_part = 1;
5052 				}
5053 				ASSERT(data_part == 0 ||
5054 				    mp->b_datap->db_type == M_DATA);
5055 				mp = mp->b_cont;
5056 			}
5057 			/* No data message */
5058 			if (data_part == 0)
5059 				STRUCT_FSET(strpeek, databuf.len, -1);
5060 			else
5061 				STRUCT_FSET(strpeek, databuf.len,
5062 				    STRUCT_FGET(strpeek, databuf.maxlen) -
5063 				    uio.uio_resid);
5064 		}
5065 		freemsg(tmp_mp);
5066 
5067 		/*
5068 		 * It is a synch stream and user wants to get
5069 		 * data (maxlen > 0).
5070 		 * uio setup is done by the codes that process DATA
5071 		 * blocks above.
5072 		 */
5073 		if ((fmp == NULL) && STRUCT_FGET(strpeek, databuf.maxlen) > 0) {
5074 			infod_t infod;
5075 
5076 			infod.d_cmd = INFOD_COPYOUT;
5077 			infod.d_res = 0;
5078 			infod.d_uiop = &uio;
5079 			error = infonext(rdq, &infod);
5080 			if (error == EINVAL || error == EBUSY)
5081 				error = 0;
5082 			if (error)
5083 				return (error);
5084 			STRUCT_FSET(strpeek, databuf.len, STRUCT_FGET(strpeek,
5085 			    databuf.maxlen) - uio.uio_resid);
5086 			if (STRUCT_FGET(strpeek, databuf.len) == 0) {
5087 				/*
5088 				 * No data found by the infonext().
5089 				 */
5090 				STRUCT_FSET(strpeek, databuf.len, -1);
5091 			}
5092 		}
5093 		error = strcopyout(STRUCT_BUF(strpeek), (void *)arg,
5094 		    STRUCT_SIZE(strpeek), copyflag);
5095 		if (error) {
5096 			return (error);
5097 		}
5098 		/*
5099 		 * If there is no message retrieved, set return code to 0
5100 		 * otherwise, set it to 1.
5101 		 */
5102 		if (STRUCT_FGET(strpeek, ctlbuf.len) == -1 &&
5103 		    STRUCT_FGET(strpeek, databuf.len) == -1)
5104 			*rvalp = 0;
5105 		else
5106 			*rvalp = 1;
5107 		return (0);
5108 	}
5109 
5110 	case I_FDINSERT:
5111 	{
5112 		STRUCT_DECL(strfdinsert, strfdinsert);
5113 		struct file *resftp;
5114 		struct stdata *resstp;
5115 		t_uscalar_t	ival;
5116 		ssize_t msgsize;
5117 		struct strbuf mctl;
5118 
5119 		STRUCT_INIT(strfdinsert, flag);
5120 		if (stp->sd_flag & STRHUP)
5121 			return (ENXIO);
5122 		/*
5123 		 * STRDERR, STWRERR and STPLEX tested above.
5124 		 */
5125 		error = strcopyin((void *)arg, STRUCT_BUF(strfdinsert),
5126 		    STRUCT_SIZE(strfdinsert), copyflag);
5127 		if (error)
5128 			return (error);
5129 
5130 		if (STRUCT_FGET(strfdinsert, offset) < 0 ||
5131 		    (STRUCT_FGET(strfdinsert, offset) %
5132 		    sizeof (t_uscalar_t)) != 0)
5133 			return (EINVAL);
5134 		if ((resftp = getf(STRUCT_FGET(strfdinsert, fildes))) != NULL) {
5135 			if ((resstp = resftp->f_vnode->v_stream) == NULL) {
5136 				releasef(STRUCT_FGET(strfdinsert, fildes));
5137 				return (EINVAL);
5138 			}
5139 		} else
5140 			return (EINVAL);
5141 
5142 		mutex_enter(&resstp->sd_lock);
5143 		if (resstp->sd_flag & (STRDERR|STWRERR|STRHUP|STPLEX)) {
5144 			error = strgeterr(resstp,
5145 			    STRDERR|STWRERR|STRHUP|STPLEX, 0);
5146 			if (error != 0) {
5147 				mutex_exit(&resstp->sd_lock);
5148 				releasef(STRUCT_FGET(strfdinsert, fildes));
5149 				return (error);
5150 			}
5151 		}
5152 		mutex_exit(&resstp->sd_lock);
5153 
5154 #ifdef	_ILP32
5155 		{
5156 			queue_t	*q;
5157 			queue_t	*mate = NULL;
5158 
5159 			/* get read queue of stream terminus */
5160 			claimstr(resstp->sd_wrq);
5161 			for (q = resstp->sd_wrq->q_next; q->q_next != NULL;
5162 			    q = q->q_next)
5163 				if (!STRMATED(resstp) && STREAM(q) != resstp &&
5164 				    mate == NULL) {
5165 					ASSERT(q->q_qinfo->qi_srvp);
5166 					ASSERT(_OTHERQ(q)->q_qinfo->qi_srvp);
5167 					claimstr(q);
5168 					mate = q;
5169 				}
5170 			q = _RD(q);
5171 			if (mate)
5172 				releasestr(mate);
5173 			releasestr(resstp->sd_wrq);
5174 			ival = (t_uscalar_t)q;
5175 		}
5176 #else
5177 		ival = (t_uscalar_t)getminor(resftp->f_vnode->v_rdev);
5178 #endif	/* _ILP32 */
5179 
5180 		if (STRUCT_FGET(strfdinsert, ctlbuf.len) <
5181 		    STRUCT_FGET(strfdinsert, offset) + sizeof (t_uscalar_t)) {
5182 			releasef(STRUCT_FGET(strfdinsert, fildes));
5183 			return (EINVAL);
5184 		}
5185 
5186 		/*
5187 		 * Check for legal flag value.
5188 		 */
5189 		if (STRUCT_FGET(strfdinsert, flags) & ~RS_HIPRI) {
5190 			releasef(STRUCT_FGET(strfdinsert, fildes));
5191 			return (EINVAL);
5192 		}
5193 
5194 		/* get these values from those cached in the stream head */
5195 		mutex_enter(QLOCK(stp->sd_wrq));
5196 		rmin = stp->sd_qn_minpsz;
5197 		rmax = stp->sd_qn_maxpsz;
5198 		mutex_exit(QLOCK(stp->sd_wrq));
5199 
5200 		/*
5201 		 * Make sure ctl and data sizes together fall within
5202 		 * the limits of the max and min receive packet sizes
5203 		 * and do not exceed system limit.  A negative data
5204 		 * length means that no data part is to be sent.
5205 		 */
5206 		ASSERT((rmax >= 0) || (rmax == INFPSZ));
5207 		if (rmax == 0) {
5208 			releasef(STRUCT_FGET(strfdinsert, fildes));
5209 			return (ERANGE);
5210 		}
5211 		if ((msgsize = STRUCT_FGET(strfdinsert, databuf.len)) < 0)
5212 			msgsize = 0;
5213 		if ((msgsize < rmin) ||
5214 		    ((msgsize > rmax) && (rmax != INFPSZ)) ||
5215 		    (STRUCT_FGET(strfdinsert, ctlbuf.len) > strctlsz)) {
5216 			releasef(STRUCT_FGET(strfdinsert, fildes));
5217 			return (ERANGE);
5218 		}
5219 
5220 		mutex_enter(&stp->sd_lock);
5221 		while (!(STRUCT_FGET(strfdinsert, flags) & RS_HIPRI) &&
5222 		    !canputnext(stp->sd_wrq)) {
5223 			if ((error = strwaitq(stp, WRITEWAIT, (ssize_t)0,
5224 			    flag, -1, &done)) != 0 || done) {
5225 				mutex_exit(&stp->sd_lock);
5226 				releasef(STRUCT_FGET(strfdinsert, fildes));
5227 				return (error);
5228 			}
5229 			if ((error = i_straccess(stp, access)) != 0) {
5230 				mutex_exit(&stp->sd_lock);
5231 				releasef(
5232 				    STRUCT_FGET(strfdinsert, fildes));
5233 				return (error);
5234 			}
5235 		}
5236 		mutex_exit(&stp->sd_lock);
5237 
5238 		/*
5239 		 * Copy strfdinsert.ctlbuf into native form of
5240 		 * ctlbuf to pass down into strmakemsg().
5241 		 */
5242 		mctl.maxlen = STRUCT_FGET(strfdinsert, ctlbuf.maxlen);
5243 		mctl.len = STRUCT_FGET(strfdinsert, ctlbuf.len);
5244 		mctl.buf = STRUCT_FGETP(strfdinsert, ctlbuf.buf);
5245 
5246 		iov.iov_base = STRUCT_FGETP(strfdinsert, databuf.buf);
5247 		iov.iov_len = STRUCT_FGET(strfdinsert, databuf.len);
5248 		uio.uio_iov = &iov;
5249 		uio.uio_iovcnt = 1;
5250 		uio.uio_loffset = 0;
5251 		uio.uio_segflg = (copyflag == U_TO_K) ? UIO_USERSPACE :
5252 		    UIO_SYSSPACE;
5253 		uio.uio_fmode = 0;
5254 		uio.uio_extflg = UIO_COPY_CACHED;
5255 		uio.uio_resid = iov.iov_len;
5256 		if ((error = strmakemsg(&mctl,
5257 		    &msgsize, &uio, stp,
5258 		    STRUCT_FGET(strfdinsert, flags), &mp)) != 0 || !mp) {
5259 			STRUCT_FSET(strfdinsert, databuf.len, msgsize);
5260 			releasef(STRUCT_FGET(strfdinsert, fildes));
5261 			return (error);
5262 		}
5263 
5264 		STRUCT_FSET(strfdinsert, databuf.len, msgsize);
5265 
5266 		/*
5267 		 * Place the possibly reencoded queue pointer 'offset' bytes
5268 		 * from the start of the control portion of the message.
5269 		 */
5270 		*((t_uscalar_t *)(mp->b_rptr +
5271 		    STRUCT_FGET(strfdinsert, offset))) = ival;
5272 
5273 		/*
5274 		 * Put message downstream.
5275 		 */
5276 		stream_willservice(stp);
5277 		putnext(stp->sd_wrq, mp);
5278 		stream_runservice(stp);
5279 		releasef(STRUCT_FGET(strfdinsert, fildes));
5280 		return (error);
5281 	}
5282 
5283 	case I_SENDFD:
5284 	{
5285 		struct file *fp;
5286 
5287 		if ((fp = getf((int)arg)) == NULL)
5288 			return (EBADF);
5289 		error = do_sendfp(stp, fp, crp);
5290 		if (auditing) {
5291 			audit_fdsend((int)arg, fp, error);
5292 		}
5293 		releasef((int)arg);
5294 		return (error);
5295 	}
5296 
5297 	case I_RECVFD:
5298 	case I_E_RECVFD:
5299 	{
5300 		struct k_strrecvfd *srf;
5301 		int i, fd;
5302 
5303 		mutex_enter(&stp->sd_lock);
5304 		while (!(mp = getq(rdq))) {
5305 			if (stp->sd_flag & (STRHUP|STREOF)) {
5306 				mutex_exit(&stp->sd_lock);
5307 				return (ENXIO);
5308 			}
5309 			if ((error = strwaitq(stp, GETWAIT, (ssize_t)0,
5310 			    flag, -1, &done)) != 0 || done) {
5311 				mutex_exit(&stp->sd_lock);
5312 				return (error);
5313 			}
5314 			if ((error = i_straccess(stp, access)) != 0) {
5315 				mutex_exit(&stp->sd_lock);
5316 				return (error);
5317 			}
5318 		}
5319 		if (mp->b_datap->db_type != M_PASSFP) {
5320 			putback(stp, rdq, mp, mp->b_band);
5321 			mutex_exit(&stp->sd_lock);
5322 			return (EBADMSG);
5323 		}
5324 		mutex_exit(&stp->sd_lock);
5325 
5326 		srf = (struct k_strrecvfd *)mp->b_rptr;
5327 		if ((fd = ufalloc(0)) == -1) {
5328 			mutex_enter(&stp->sd_lock);
5329 			putback(stp, rdq, mp, mp->b_band);
5330 			mutex_exit(&stp->sd_lock);
5331 			return (EMFILE);
5332 		}
5333 		if (cmd == I_RECVFD) {
5334 			struct o_strrecvfd	ostrfd;
5335 
5336 			/* check to see if uid/gid values are too large. */
5337 
5338 			if (srf->uid > (o_uid_t)USHRT_MAX ||
5339 			    srf->gid > (o_gid_t)USHRT_MAX) {
5340 				mutex_enter(&stp->sd_lock);
5341 				putback(stp, rdq, mp, mp->b_band);
5342 				mutex_exit(&stp->sd_lock);
5343 				setf(fd, NULL);	/* release fd entry */
5344 				return (EOVERFLOW);
5345 			}
5346 
5347 			ostrfd.fd = fd;
5348 			ostrfd.uid = (o_uid_t)srf->uid;
5349 			ostrfd.gid = (o_gid_t)srf->gid;
5350 
5351 			/* Null the filler bits */
5352 			for (i = 0; i < 8; i++)
5353 				ostrfd.fill[i] = 0;
5354 
5355 			error = strcopyout(&ostrfd, (void *)arg,
5356 			    sizeof (struct o_strrecvfd), copyflag);
5357 		} else {		/* I_E_RECVFD */
5358 			struct strrecvfd	strfd;
5359 
5360 			strfd.fd = fd;
5361 			strfd.uid = srf->uid;
5362 			strfd.gid = srf->gid;
5363 
5364 			/* null the filler bits */
5365 			for (i = 0; i < 8; i++)
5366 				strfd.fill[i] = 0;
5367 
5368 			error = strcopyout(&strfd, (void *)arg,
5369 			    sizeof (struct strrecvfd), copyflag);
5370 		}
5371 
5372 		if (error) {
5373 			setf(fd, NULL);	/* release fd entry */
5374 			mutex_enter(&stp->sd_lock);
5375 			putback(stp, rdq, mp, mp->b_band);
5376 			mutex_exit(&stp->sd_lock);
5377 			return (error);
5378 		}
5379 		if (auditing) {
5380 			audit_fdrecv(fd, srf->fp);
5381 		}
5382 
5383 		/*
5384 		 * Always increment f_count since the freemsg() below will
5385 		 * always call free_passfp() which performs a closef().
5386 		 */
5387 		mutex_enter(&srf->fp->f_tlock);
5388 		srf->fp->f_count++;
5389 		mutex_exit(&srf->fp->f_tlock);
5390 		setf(fd, srf->fp);
5391 		freemsg(mp);
5392 		return (0);
5393 	}
5394 
5395 	case I_SWROPT:
5396 		/*
5397 		 * Set/clear the write options. arg is a bit
5398 		 * mask with any of the following bits set...
5399 		 * 	SNDZERO - send zero length message
5400 		 *	SNDPIPE - send sigpipe to process if
5401 		 *		sd_werror is set and process is
5402 		 *		doing a write or putmsg.
5403 		 * The new stream head write options should reflect
5404 		 * what is in arg.
5405 		 */
5406 		if (arg & ~(SNDZERO|SNDPIPE))
5407 			return (EINVAL);
5408 
5409 		mutex_enter(&stp->sd_lock);
5410 		stp->sd_wput_opt &= ~(SW_SIGPIPE|SW_SNDZERO);
5411 		if (arg & SNDZERO)
5412 			stp->sd_wput_opt |= SW_SNDZERO;
5413 		if (arg & SNDPIPE)
5414 			stp->sd_wput_opt |= SW_SIGPIPE;
5415 		mutex_exit(&stp->sd_lock);
5416 		return (0);
5417 
5418 	case I_GWROPT:
5419 	{
5420 		int wropt = 0;
5421 
5422 		if (stp->sd_wput_opt & SW_SNDZERO)
5423 			wropt |= SNDZERO;
5424 		if (stp->sd_wput_opt & SW_SIGPIPE)
5425 			wropt |= SNDPIPE;
5426 		return (strcopyout(&wropt, (void *)arg, sizeof (wropt),
5427 		    copyflag));
5428 	}
5429 
5430 	case I_LIST:
5431 		/*
5432 		 * Returns all the modules found on this stream,
5433 		 * upto the driver. If argument is NULL, return the
5434 		 * number of modules (including driver). If argument
5435 		 * is not NULL, copy the names into the structure
5436 		 * provided.
5437 		 */
5438 
5439 	{
5440 		queue_t *q;
5441 		char *qname;
5442 		int i, nmods;
5443 		struct str_mlist *mlist;
5444 		STRUCT_DECL(str_list, strlist);
5445 
5446 		if (arg == NULL) { /* Return number of modules plus driver */
5447 			if (stp->sd_vnode->v_type == VFIFO)
5448 				*rvalp = stp->sd_pushcnt;
5449 			else
5450 				*rvalp = stp->sd_pushcnt + 1;
5451 			return (0);
5452 		}
5453 
5454 		STRUCT_INIT(strlist, flag);
5455 
5456 		error = strcopyin((void *)arg, STRUCT_BUF(strlist),
5457 		    STRUCT_SIZE(strlist), copyflag);
5458 		if (error != 0)
5459 			return (error);
5460 
5461 		mlist = STRUCT_FGETP(strlist, sl_modlist);
5462 		nmods = STRUCT_FGET(strlist, sl_nmods);
5463 		if (nmods <= 0)
5464 			return (EINVAL);
5465 
5466 		claimstr(stp->sd_wrq);
5467 		q = stp->sd_wrq;
5468 		for (i = 0; i < nmods && _SAMESTR(q); i++, q = q->q_next) {
5469 			qname = Q2NAME(q->q_next);
5470 			error = strcopyout(qname, &mlist[i], strlen(qname) + 1,
5471 			    copyflag);
5472 			if (error != 0) {
5473 				releasestr(stp->sd_wrq);
5474 				return (error);
5475 			}
5476 		}
5477 		releasestr(stp->sd_wrq);
5478 		return (strcopyout(&i, (void *)arg, sizeof (int), copyflag));
5479 	}
5480 
5481 	case I_CKBAND:
5482 	{
5483 		queue_t *q;
5484 		qband_t *qbp;
5485 
5486 		if ((arg < 0) || (arg >= NBAND))
5487 			return (EINVAL);
5488 		q = _RD(stp->sd_wrq);
5489 		mutex_enter(QLOCK(q));
5490 		if (arg > (int)q->q_nband) {
5491 			*rvalp = 0;
5492 		} else {
5493 			if (arg == 0) {
5494 				if (q->q_first)
5495 					*rvalp = 1;
5496 				else
5497 					*rvalp = 0;
5498 			} else {
5499 				qbp = q->q_bandp;
5500 				while (--arg > 0)
5501 					qbp = qbp->qb_next;
5502 				if (qbp->qb_first)
5503 					*rvalp = 1;
5504 				else
5505 					*rvalp = 0;
5506 			}
5507 		}
5508 		mutex_exit(QLOCK(q));
5509 		return (0);
5510 	}
5511 
5512 	case I_GETBAND:
5513 	{
5514 		int intpri;
5515 		queue_t *q;
5516 
5517 		q = _RD(stp->sd_wrq);
5518 		mutex_enter(QLOCK(q));
5519 		mp = q->q_first;
5520 		if (!mp) {
5521 			mutex_exit(QLOCK(q));
5522 			return (ENODATA);
5523 		}
5524 		intpri = (int)mp->b_band;
5525 		error = strcopyout(&intpri, (void *)arg, sizeof (int),
5526 		    copyflag);
5527 		mutex_exit(QLOCK(q));
5528 		return (error);
5529 	}
5530 
5531 	case I_ATMARK:
5532 	{
5533 		queue_t *q;
5534 
5535 		if (arg & ~(ANYMARK|LASTMARK))
5536 			return (EINVAL);
5537 		q = _RD(stp->sd_wrq);
5538 		mutex_enter(&stp->sd_lock);
5539 		if ((stp->sd_flag & STRATMARK) && (arg == ANYMARK)) {
5540 			*rvalp = 1;
5541 		} else {
5542 			mutex_enter(QLOCK(q));
5543 			mp = q->q_first;
5544 
5545 			if (mp == NULL)
5546 				*rvalp = 0;
5547 			else if ((arg == ANYMARK) && (mp->b_flag & MSGMARK))
5548 				*rvalp = 1;
5549 			else if ((arg == LASTMARK) && (mp == stp->sd_mark))
5550 				*rvalp = 1;
5551 			else
5552 				*rvalp = 0;
5553 			mutex_exit(QLOCK(q));
5554 		}
5555 		mutex_exit(&stp->sd_lock);
5556 		return (0);
5557 	}
5558 
5559 	case I_CANPUT:
5560 	{
5561 		char band;
5562 
5563 		if ((arg < 0) || (arg >= NBAND))
5564 			return (EINVAL);
5565 		band = (char)arg;
5566 		*rvalp = bcanputnext(stp->sd_wrq, band);
5567 		return (0);
5568 	}
5569 
5570 	case I_SETCLTIME:
5571 	{
5572 		int closetime;
5573 
5574 		error = strcopyin((void *)arg, &closetime, sizeof (int),
5575 		    copyflag);
5576 		if (error)
5577 			return (error);
5578 		if (closetime < 0)
5579 			return (EINVAL);
5580 
5581 		stp->sd_closetime = closetime;
5582 		return (0);
5583 	}
5584 
5585 	case I_GETCLTIME:
5586 	{
5587 		int closetime;
5588 
5589 		closetime = stp->sd_closetime;
5590 		return (strcopyout(&closetime, (void *)arg, sizeof (int),
5591 		    copyflag));
5592 	}
5593 
5594 	case TIOCGSID:
5595 	{
5596 		pid_t sid;
5597 
5598 		mutex_enter(&stp->sd_lock);
5599 		if (stp->sd_sidp == NULL) {
5600 			mutex_exit(&stp->sd_lock);
5601 			return (ENOTTY);
5602 		}
5603 		sid = stp->sd_sidp->pid_id;
5604 		mutex_exit(&stp->sd_lock);
5605 		return (strcopyout(&sid, (void *)arg, sizeof (pid_t),
5606 		    copyflag));
5607 	}
5608 
5609 	case TIOCSPGRP:
5610 	{
5611 		pid_t pgrp;
5612 		proc_t *q;
5613 		pid_t	sid, fg_pgid, bg_pgid;
5614 
5615 		if (error = strcopyin((void *)arg, &pgrp, sizeof (pid_t),
5616 		    copyflag))
5617 			return (error);
5618 		mutex_enter(&stp->sd_lock);
5619 		mutex_enter(&pidlock);
5620 		if (stp->sd_sidp != ttoproc(curthread)->p_sessp->s_sidp) {
5621 			mutex_exit(&pidlock);
5622 			mutex_exit(&stp->sd_lock);
5623 			return (ENOTTY);
5624 		}
5625 		if (pgrp == stp->sd_pgidp->pid_id) {
5626 			mutex_exit(&pidlock);
5627 			mutex_exit(&stp->sd_lock);
5628 			return (0);
5629 		}
5630 		if (pgrp <= 0 || pgrp >= maxpid) {
5631 			mutex_exit(&pidlock);
5632 			mutex_exit(&stp->sd_lock);
5633 			return (EINVAL);
5634 		}
5635 		if ((q = pgfind(pgrp)) == NULL ||
5636 		    q->p_sessp != ttoproc(curthread)->p_sessp) {
5637 			mutex_exit(&pidlock);
5638 			mutex_exit(&stp->sd_lock);
5639 			return (EPERM);
5640 		}
5641 		sid = stp->sd_sidp->pid_id;
5642 		fg_pgid = q->p_pgrp;
5643 		bg_pgid = stp->sd_pgidp->pid_id;
5644 		CL_SET_PROCESS_GROUP(curthread, sid, bg_pgid, fg_pgid);
5645 		PID_RELE(stp->sd_pgidp);
5646 		ctty_clear_sighuped();
5647 		stp->sd_pgidp = q->p_pgidp;
5648 		PID_HOLD(stp->sd_pgidp);
5649 		mutex_exit(&pidlock);
5650 		mutex_exit(&stp->sd_lock);
5651 		return (0);
5652 	}
5653 
5654 	case TIOCGPGRP:
5655 	{
5656 		pid_t pgrp;
5657 
5658 		mutex_enter(&stp->sd_lock);
5659 		if (stp->sd_sidp == NULL) {
5660 			mutex_exit(&stp->sd_lock);
5661 			return (ENOTTY);
5662 		}
5663 		pgrp = stp->sd_pgidp->pid_id;
5664 		mutex_exit(&stp->sd_lock);
5665 		return (strcopyout(&pgrp, (void *)arg, sizeof (pid_t),
5666 		    copyflag));
5667 	}
5668 
5669 	case TIOCSCTTY:
5670 	{
5671 		return (strctty(stp));
5672 	}
5673 
5674 	case TIOCNOTTY:
5675 	{
5676 		/* freectty() always assumes curproc. */
5677 		if (freectty(B_FALSE) != 0)
5678 			return (0);
5679 		return (ENOTTY);
5680 	}
5681 
5682 	case FIONBIO:
5683 	case FIOASYNC:
5684 		return (0);	/* handled by the upper layer */
5685 	}
5686 }
5687 
5688 /*
5689  * Custom free routine used for M_PASSFP messages.
5690  */
5691 static void
free_passfp(struct k_strrecvfd * srf)5692 free_passfp(struct k_strrecvfd *srf)
5693 {
5694 	(void) closef(srf->fp);
5695 	kmem_free(srf, sizeof (struct k_strrecvfd) + sizeof (frtn_t));
5696 }
5697 
5698 /* ARGSUSED */
5699 int
do_sendfp(struct stdata * stp,struct file * fp,struct cred * cr)5700 do_sendfp(struct stdata *stp, struct file *fp, struct cred *cr)
5701 {
5702 	queue_t *qp, *nextqp;
5703 	struct k_strrecvfd *srf;
5704 	mblk_t *mp;
5705 	frtn_t *frtnp;
5706 	size_t bufsize;
5707 	queue_t	*mate = NULL;
5708 	syncq_t	*sq = NULL;
5709 	int retval = 0;
5710 
5711 	if (stp->sd_flag & STRHUP)
5712 		return (ENXIO);
5713 
5714 	claimstr(stp->sd_wrq);
5715 
5716 	/* Fastpath, we have a pipe, and we are already mated, use it. */
5717 	if (STRMATED(stp)) {
5718 		qp = _RD(stp->sd_mate->sd_wrq);
5719 		claimstr(qp);
5720 		mate = qp;
5721 	} else { /* Not already mated. */
5722 
5723 		/*
5724 		 * Walk the stream to the end of this one.
5725 		 * assumes that the claimstr() will prevent
5726 		 * plumbing between the stream head and the
5727 		 * driver from changing
5728 		 */
5729 		qp = stp->sd_wrq;
5730 
5731 		/*
5732 		 * Loop until we reach the end of this stream.
5733 		 * On completion, qp points to the write queue
5734 		 * at the end of the stream, or the read queue
5735 		 * at the stream head if this is a fifo.
5736 		 */
5737 		while (((qp = qp->q_next) != NULL) && _SAMESTR(qp))
5738 			;
5739 
5740 		/*
5741 		 * Just in case we get a q_next which is NULL, but
5742 		 * not at the end of the stream.  This is actually
5743 		 * broken, so we set an assert to catch it in
5744 		 * debug, and set an error and return if not debug.
5745 		 */
5746 		ASSERT(qp);
5747 		if (qp == NULL) {
5748 			releasestr(stp->sd_wrq);
5749 			return (EINVAL);
5750 		}
5751 
5752 		/*
5753 		 * Enter the syncq for the driver, so (hopefully)
5754 		 * the queue values will not change on us.
5755 		 * XXXX - This will only prevent the race IFF only
5756 		 *   the write side modifies the q_next member, and
5757 		 *   the put procedure is protected by at least
5758 		 *   MT_PERQ.
5759 		 */
5760 		if ((sq = qp->q_syncq) != NULL)
5761 			entersq(sq, SQ_PUT);
5762 
5763 		/* Now get the q_next value from this qp. */
5764 		nextqp = qp->q_next;
5765 
5766 		/*
5767 		 * If nextqp exists and the other stream is different
5768 		 * from this one claim the stream, set the mate, and
5769 		 * get the read queue at the stream head of the other
5770 		 * stream.  Assumes that nextqp was at least valid when
5771 		 * we got it.  Hopefully the entersq of the driver
5772 		 * will prevent it from changing on us.
5773 		 */
5774 		if ((nextqp != NULL) && (STREAM(nextqp) != stp)) {
5775 			ASSERT(qp->q_qinfo->qi_srvp);
5776 			ASSERT(_OTHERQ(qp)->q_qinfo->qi_srvp);
5777 			ASSERT(_OTHERQ(qp->q_next)->q_qinfo->qi_srvp);
5778 			claimstr(nextqp);
5779 
5780 			/* Make sure we still have a q_next */
5781 			if (nextqp != qp->q_next) {
5782 				releasestr(stp->sd_wrq);
5783 				releasestr(nextqp);
5784 				return (EINVAL);
5785 			}
5786 
5787 			qp = _RD(STREAM(nextqp)->sd_wrq);
5788 			mate = qp;
5789 		}
5790 		/* If we entered the synq above, leave it. */
5791 		if (sq != NULL)
5792 			leavesq(sq, SQ_PUT);
5793 	} /*  STRMATED(STP)  */
5794 
5795 	/* XXX prevents substitution of the ops vector */
5796 	if (qp->q_qinfo != &strdata && qp->q_qinfo != &fifo_strdata) {
5797 		retval = EINVAL;
5798 		goto out;
5799 	}
5800 
5801 	if (qp->q_flag & QFULL) {
5802 		retval = EAGAIN;
5803 		goto out;
5804 	}
5805 
5806 	/*
5807 	 * Since M_PASSFP messages include a file descriptor, we use
5808 	 * esballoc() and specify a custom free routine (free_passfp()) that
5809 	 * will close the descriptor as part of freeing the message.  For
5810 	 * convenience, we stash the frtn_t right after the data block.
5811 	 */
5812 	bufsize = sizeof (struct k_strrecvfd) + sizeof (frtn_t);
5813 	srf = kmem_alloc(bufsize, KM_NOSLEEP);
5814 	if (srf == NULL) {
5815 		retval = EAGAIN;
5816 		goto out;
5817 	}
5818 
5819 	frtnp = (frtn_t *)(srf + 1);
5820 	frtnp->free_arg = (caddr_t)srf;
5821 	frtnp->free_func = free_passfp;
5822 
5823 	mp = esballoc((uchar_t *)srf, bufsize, BPRI_MED, frtnp);
5824 	if (mp == NULL) {
5825 		kmem_free(srf, bufsize);
5826 		retval = EAGAIN;
5827 		goto out;
5828 	}
5829 	mp->b_wptr += sizeof (struct k_strrecvfd);
5830 	mp->b_datap->db_type = M_PASSFP;
5831 
5832 	srf->fp = fp;
5833 	srf->uid = crgetuid(curthread->t_cred);
5834 	srf->gid = crgetgid(curthread->t_cred);
5835 	mutex_enter(&fp->f_tlock);
5836 	fp->f_count++;
5837 	mutex_exit(&fp->f_tlock);
5838 
5839 	put(qp, mp);
5840 out:
5841 	releasestr(stp->sd_wrq);
5842 	if (mate)
5843 		releasestr(mate);
5844 	return (retval);
5845 }
5846 
5847 /*
5848  * Send an ioctl message downstream and wait for acknowledgement.
5849  * flags may be set to either U_TO_K or K_TO_K and a combination
5850  * of STR_NOERROR or STR_NOSIG
5851  * STR_NOSIG: Signals are essentially ignored or held and have
5852  *	no effect for the duration of the call.
5853  * STR_NOERROR: Ignores stream head read, write and hup errors.
5854  *	Additionally, if an existing ioctl times out, it is assumed
5855  *	lost and and this ioctl will continue as if the previous ioctl had
5856  *	finished.  ETIME may be returned if this ioctl times out (i.e.
5857  *	ic_timout is not INFTIM).  Non-stream head errors may be returned if
5858  *	the ioc_error indicates that the driver/module had problems,
5859  *	an EFAULT was found when accessing user data, a lack of
5860  * 	resources, etc.
5861  */
5862 int
strdoioctl(struct stdata * stp,struct strioctl * strioc,int fflags,int flag,cred_t * crp,int * rvalp)5863 strdoioctl(
5864 	struct stdata *stp,
5865 	struct strioctl *strioc,
5866 	int fflags,		/* file flags with model info */
5867 	int flag,
5868 	cred_t *crp,
5869 	int *rvalp)
5870 {
5871 	mblk_t *bp;
5872 	struct iocblk *iocbp;
5873 	struct copyreq *reqp;
5874 	struct copyresp *resp;
5875 	int id;
5876 	int transparent = 0;
5877 	int error = 0;
5878 	int len = 0;
5879 	caddr_t taddr;
5880 	int copyflag = (flag & (U_TO_K | K_TO_K));
5881 	int sigflag = (flag & STR_NOSIG);
5882 	int errs;
5883 	uint_t waitflags;
5884 	boolean_t set_iocwaitne = B_FALSE;
5885 
5886 	ASSERT(copyflag == U_TO_K || copyflag == K_TO_K);
5887 	ASSERT((fflags & FMODELS) != 0);
5888 
5889 	TRACE_2(TR_FAC_STREAMS_FR,
5890 	    TR_STRDOIOCTL,
5891 	    "strdoioctl:stp %p strioc %p", stp, strioc);
5892 	if (strioc->ic_len == TRANSPARENT) {	/* send arg in M_DATA block */
5893 		transparent = 1;
5894 		strioc->ic_len = sizeof (intptr_t);
5895 	}
5896 
5897 	if (strioc->ic_len < 0 || (strmsgsz > 0 && strioc->ic_len > strmsgsz))
5898 		return (EINVAL);
5899 
5900 	if ((bp = allocb_cred_wait(sizeof (union ioctypes), sigflag, &error,
5901 	    crp, curproc->p_pid)) == NULL)
5902 			return (error);
5903 
5904 	bzero(bp->b_wptr, sizeof (union ioctypes));
5905 
5906 	iocbp = (struct iocblk *)bp->b_wptr;
5907 	iocbp->ioc_count = strioc->ic_len;
5908 	iocbp->ioc_cmd = strioc->ic_cmd;
5909 	iocbp->ioc_flag = (fflags & FMODELS);
5910 
5911 	crhold(crp);
5912 	iocbp->ioc_cr = crp;
5913 	DB_TYPE(bp) = M_IOCTL;
5914 	bp->b_wptr += sizeof (struct iocblk);
5915 
5916 	if (flag & STR_NOERROR)
5917 		errs = STPLEX;
5918 	else
5919 		errs = STRHUP|STRDERR|STWRERR|STPLEX;
5920 
5921 	/*
5922 	 * If there is data to copy into ioctl block, do so.
5923 	 */
5924 	if (iocbp->ioc_count > 0) {
5925 		if (transparent)
5926 			/*
5927 			 * Note: STR_NOERROR does not have an effect
5928 			 * in putiocd()
5929 			 */
5930 			id = K_TO_K | sigflag;
5931 		else
5932 			id = flag;
5933 		if ((error = putiocd(bp, strioc->ic_dp, id, crp)) != 0) {
5934 			freemsg(bp);
5935 			crfree(crp);
5936 			return (error);
5937 		}
5938 
5939 		/*
5940 		 * We could have slept copying in user pages.
5941 		 * Recheck the stream head state (the other end
5942 		 * of a pipe could have gone away).
5943 		 */
5944 		if (stp->sd_flag & errs) {
5945 			mutex_enter(&stp->sd_lock);
5946 			error = strgeterr(stp, errs, 0);
5947 			mutex_exit(&stp->sd_lock);
5948 			if (error != 0) {
5949 				freemsg(bp);
5950 				crfree(crp);
5951 				return (error);
5952 			}
5953 		}
5954 	}
5955 	if (transparent)
5956 		iocbp->ioc_count = TRANSPARENT;
5957 
5958 	/*
5959 	 * Block for up to STRTIMOUT milliseconds if there is an outstanding
5960 	 * ioctl for this stream already running.  All processes
5961 	 * sleeping here will be awakened as a result of an ACK
5962 	 * or NAK being received for the outstanding ioctl, or
5963 	 * as a result of the timer expiring on the outstanding
5964 	 * ioctl (a failure), or as a result of any waiting
5965 	 * process's timer expiring (also a failure).
5966 	 */
5967 
5968 	error = 0;
5969 	mutex_enter(&stp->sd_lock);
5970 	while ((stp->sd_flag & IOCWAIT) ||
5971 	    (!set_iocwaitne && (stp->sd_flag & IOCWAITNE))) {
5972 		clock_t cv_rval;
5973 
5974 		TRACE_0(TR_FAC_STREAMS_FR,
5975 		    TR_STRDOIOCTL_WAIT,
5976 		    "strdoioctl sleeps - IOCWAIT");
5977 		cv_rval = str_cv_wait(&stp->sd_iocmonitor, &stp->sd_lock,
5978 		    STRTIMOUT, sigflag);
5979 		if (cv_rval <= 0) {
5980 			if (cv_rval == 0) {
5981 				error = EINTR;
5982 			} else {
5983 				if (flag & STR_NOERROR) {
5984 					/*
5985 					 * Terminating current ioctl in
5986 					 * progress -- assume it got lost and
5987 					 * wake up the other thread so that the
5988 					 * operation completes.
5989 					 */
5990 					if (!(stp->sd_flag & IOCWAITNE)) {
5991 						set_iocwaitne = B_TRUE;
5992 						stp->sd_flag |= IOCWAITNE;
5993 						cv_broadcast(&stp->sd_monitor);
5994 					}
5995 					/*
5996 					 * Otherwise, there's a running
5997 					 * STR_NOERROR -- we have no choice
5998 					 * here but to wait forever (or until
5999 					 * interrupted).
6000 					 */
6001 				} else {
6002 					/*
6003 					 * pending ioctl has caused
6004 					 * us to time out
6005 					 */
6006 					error = ETIME;
6007 				}
6008 			}
6009 		} else if ((stp->sd_flag & errs)) {
6010 			error = strgeterr(stp, errs, 0);
6011 		}
6012 		if (error) {
6013 			mutex_exit(&stp->sd_lock);
6014 			freemsg(bp);
6015 			crfree(crp);
6016 			return (error);
6017 		}
6018 	}
6019 
6020 	/*
6021 	 * Have control of ioctl mechanism.
6022 	 * Send down ioctl packet and wait for response.
6023 	 */
6024 	if (stp->sd_iocblk != (mblk_t *)-1) {
6025 		freemsg(stp->sd_iocblk);
6026 	}
6027 	stp->sd_iocblk = NULL;
6028 
6029 	/*
6030 	 * If this is marked with 'noerror' (internal; mostly
6031 	 * I_{P,}{UN,}LINK), then make sure nobody else is able to get
6032 	 * in here by setting IOCWAITNE.
6033 	 */
6034 	waitflags = IOCWAIT;
6035 	if (flag & STR_NOERROR)
6036 		waitflags |= IOCWAITNE;
6037 
6038 	stp->sd_flag |= waitflags;
6039 
6040 	/*
6041 	 * Assign sequence number.
6042 	 */
6043 	iocbp->ioc_id = stp->sd_iocid = getiocseqno();
6044 
6045 	mutex_exit(&stp->sd_lock);
6046 
6047 	TRACE_1(TR_FAC_STREAMS_FR,
6048 	    TR_STRDOIOCTL_PUT, "strdoioctl put: stp %p", stp);
6049 	stream_willservice(stp);
6050 	putnext(stp->sd_wrq, bp);
6051 	stream_runservice(stp);
6052 
6053 	/*
6054 	 * Timed wait for acknowledgment.  The wait time is limited by the
6055 	 * timeout value, which must be a positive integer (number of
6056 	 * milliseconds) to wait, or 0 (use default value of STRTIMOUT
6057 	 * milliseconds), or -1 (wait forever).  This will be awakened
6058 	 * either by an ACK/NAK message arriving, the timer expiring, or
6059 	 * the timer expiring on another ioctl waiting for control of the
6060 	 * mechanism.
6061 	 */
6062 waitioc:
6063 	mutex_enter(&stp->sd_lock);
6064 
6065 
6066 	/*
6067 	 * If the reply has already arrived, don't sleep.  If awakened from
6068 	 * the sleep, fail only if the reply has not arrived by then.
6069 	 * Otherwise, process the reply.
6070 	 */
6071 	while (!stp->sd_iocblk) {
6072 		clock_t cv_rval;
6073 
6074 		if (stp->sd_flag & errs) {
6075 			error = strgeterr(stp, errs, 0);
6076 			if (error != 0) {
6077 				stp->sd_flag &= ~waitflags;
6078 				cv_broadcast(&stp->sd_iocmonitor);
6079 				mutex_exit(&stp->sd_lock);
6080 				crfree(crp);
6081 				return (error);
6082 			}
6083 		}
6084 
6085 		TRACE_0(TR_FAC_STREAMS_FR,
6086 		    TR_STRDOIOCTL_WAIT2,
6087 		    "strdoioctl sleeps awaiting reply");
6088 		ASSERT(error == 0);
6089 
6090 		cv_rval = str_cv_wait(&stp->sd_monitor, &stp->sd_lock,
6091 		    (strioc->ic_timout ?
6092 		    strioc->ic_timout * 1000 : STRTIMOUT), sigflag);
6093 
6094 		/*
6095 		 * There are four possible cases here: interrupt, timeout,
6096 		 * wakeup by IOCWAITNE (above), or wakeup by strrput_nondata (a
6097 		 * valid M_IOCTL reply).
6098 		 *
6099 		 * If we've been awakened by a STR_NOERROR ioctl on some other
6100 		 * thread, then sd_iocblk will still be NULL, and IOCWAITNE
6101 		 * will be set.  Pretend as if we just timed out.  Note that
6102 		 * this other thread waited at least STRTIMOUT before trying to
6103 		 * awaken our thread, so this is indistinguishable (even for
6104 		 * INFTIM) from the case where we failed with ETIME waiting on
6105 		 * IOCWAIT in the prior loop.
6106 		 */
6107 		if (cv_rval > 0 && !(flag & STR_NOERROR) &&
6108 		    stp->sd_iocblk == NULL && (stp->sd_flag & IOCWAITNE)) {
6109 			cv_rval = -1;
6110 		}
6111 
6112 		/*
6113 		 * note: STR_NOERROR does not protect
6114 		 * us here.. use ic_timout < 0
6115 		 */
6116 		if (cv_rval <= 0) {
6117 			if (cv_rval == 0) {
6118 				error = EINTR;
6119 			} else {
6120 				error =  ETIME;
6121 			}
6122 			/*
6123 			 * A message could have come in after we were scheduled
6124 			 * but before we were actually run.
6125 			 */
6126 			bp = stp->sd_iocblk;
6127 			stp->sd_iocblk = NULL;
6128 			if (bp != NULL) {
6129 				if ((bp->b_datap->db_type == M_COPYIN) ||
6130 				    (bp->b_datap->db_type == M_COPYOUT)) {
6131 					mutex_exit(&stp->sd_lock);
6132 					if (bp->b_cont) {
6133 						freemsg(bp->b_cont);
6134 						bp->b_cont = NULL;
6135 					}
6136 					bp->b_datap->db_type = M_IOCDATA;
6137 					bp->b_wptr = bp->b_rptr +
6138 					    sizeof (struct copyresp);
6139 					resp = (struct copyresp *)bp->b_rptr;
6140 					resp->cp_rval =
6141 					    (caddr_t)1; /* failure */
6142 					stream_willservice(stp);
6143 					putnext(stp->sd_wrq, bp);
6144 					stream_runservice(stp);
6145 					mutex_enter(&stp->sd_lock);
6146 				} else {
6147 					freemsg(bp);
6148 				}
6149 			}
6150 			stp->sd_flag &= ~waitflags;
6151 			cv_broadcast(&stp->sd_iocmonitor);
6152 			mutex_exit(&stp->sd_lock);
6153 			crfree(crp);
6154 			return (error);
6155 		}
6156 	}
6157 	bp = stp->sd_iocblk;
6158 	/*
6159 	 * Note: it is strictly impossible to get here with sd_iocblk set to
6160 	 * -1.  This is because the initial loop above doesn't allow any new
6161 	 * ioctls into the fray until all others have passed this point.
6162 	 */
6163 	ASSERT(bp != NULL && bp != (mblk_t *)-1);
6164 	TRACE_1(TR_FAC_STREAMS_FR,
6165 	    TR_STRDOIOCTL_ACK, "strdoioctl got reply: bp %p", bp);
6166 	if ((bp->b_datap->db_type == M_IOCACK) ||
6167 	    (bp->b_datap->db_type == M_IOCNAK)) {
6168 		/* for detection of duplicate ioctl replies */
6169 		stp->sd_iocblk = (mblk_t *)-1;
6170 		stp->sd_flag &= ~waitflags;
6171 		cv_broadcast(&stp->sd_iocmonitor);
6172 		mutex_exit(&stp->sd_lock);
6173 	} else {
6174 		/*
6175 		 * flags not cleared here because we're still doing
6176 		 * copy in/out for ioctl.
6177 		 */
6178 		stp->sd_iocblk = NULL;
6179 		mutex_exit(&stp->sd_lock);
6180 	}
6181 
6182 
6183 	/*
6184 	 * Have received acknowledgment.
6185 	 */
6186 
6187 	switch (bp->b_datap->db_type) {
6188 	case M_IOCACK:
6189 		/*
6190 		 * Positive ack.
6191 		 */
6192 		iocbp = (struct iocblk *)bp->b_rptr;
6193 
6194 		/*
6195 		 * Set error if indicated.
6196 		 */
6197 		if (iocbp->ioc_error) {
6198 			error = iocbp->ioc_error;
6199 			break;
6200 		}
6201 
6202 		/*
6203 		 * Set return value.
6204 		 */
6205 		*rvalp = iocbp->ioc_rval;
6206 
6207 		/*
6208 		 * Data may have been returned in ACK message (ioc_count > 0).
6209 		 * If so, copy it out to the user's buffer.
6210 		 */
6211 		if (iocbp->ioc_count && !transparent) {
6212 			if (error = getiocd(bp, strioc->ic_dp, copyflag))
6213 				break;
6214 		}
6215 		if (!transparent) {
6216 			if (len)	/* an M_COPYOUT was used with I_STR */
6217 				strioc->ic_len = len;
6218 			else
6219 				strioc->ic_len = (int)iocbp->ioc_count;
6220 		}
6221 		break;
6222 
6223 	case M_IOCNAK:
6224 		/*
6225 		 * Negative ack.
6226 		 *
6227 		 * The only thing to do is set error as specified
6228 		 * in neg ack packet.
6229 		 */
6230 		iocbp = (struct iocblk *)bp->b_rptr;
6231 
6232 		error = (iocbp->ioc_error ? iocbp->ioc_error : EINVAL);
6233 		break;
6234 
6235 	case M_COPYIN:
6236 		/*
6237 		 * Driver or module has requested user ioctl data.
6238 		 */
6239 		reqp = (struct copyreq *)bp->b_rptr;
6240 
6241 		/*
6242 		 * M_COPYIN should *never* have a message attached, though
6243 		 * it's harmless if it does -- thus, panic on a DEBUG
6244 		 * kernel and just free it on a non-DEBUG build.
6245 		 */
6246 		ASSERT(bp->b_cont == NULL);
6247 		if (bp->b_cont != NULL) {
6248 			freemsg(bp->b_cont);
6249 			bp->b_cont = NULL;
6250 		}
6251 
6252 		error = putiocd(bp, reqp->cq_addr, flag, crp);
6253 		if (error && bp->b_cont) {
6254 			freemsg(bp->b_cont);
6255 			bp->b_cont = NULL;
6256 		}
6257 
6258 		bp->b_wptr = bp->b_rptr + sizeof (struct copyresp);
6259 		bp->b_datap->db_type = M_IOCDATA;
6260 
6261 		mblk_setcred(bp, crp, curproc->p_pid);
6262 		resp = (struct copyresp *)bp->b_rptr;
6263 		resp->cp_rval = (caddr_t)(uintptr_t)error;
6264 		resp->cp_flag = (fflags & FMODELS);
6265 
6266 		stream_willservice(stp);
6267 		putnext(stp->sd_wrq, bp);
6268 		stream_runservice(stp);
6269 
6270 		if (error) {
6271 			mutex_enter(&stp->sd_lock);
6272 			stp->sd_flag &= ~waitflags;
6273 			cv_broadcast(&stp->sd_iocmonitor);
6274 			mutex_exit(&stp->sd_lock);
6275 			crfree(crp);
6276 			return (error);
6277 		}
6278 
6279 		goto waitioc;
6280 
6281 	case M_COPYOUT:
6282 		/*
6283 		 * Driver or module has ioctl data for a user.
6284 		 */
6285 		reqp = (struct copyreq *)bp->b_rptr;
6286 		ASSERT(bp->b_cont != NULL);
6287 
6288 		/*
6289 		 * Always (transparent or non-transparent )
6290 		 * use the address specified in the request
6291 		 */
6292 		taddr = reqp->cq_addr;
6293 		if (!transparent)
6294 			len = (int)reqp->cq_size;
6295 
6296 		/* copyout data to the provided address */
6297 		error = getiocd(bp, taddr, copyflag);
6298 
6299 		freemsg(bp->b_cont);
6300 		bp->b_cont = NULL;
6301 
6302 		bp->b_wptr = bp->b_rptr + sizeof (struct copyresp);
6303 		bp->b_datap->db_type = M_IOCDATA;
6304 
6305 		mblk_setcred(bp, crp, curproc->p_pid);
6306 		resp = (struct copyresp *)bp->b_rptr;
6307 		resp->cp_rval = (caddr_t)(uintptr_t)error;
6308 		resp->cp_flag = (fflags & FMODELS);
6309 
6310 		stream_willservice(stp);
6311 		putnext(stp->sd_wrq, bp);
6312 		stream_runservice(stp);
6313 
6314 		if (error) {
6315 			mutex_enter(&stp->sd_lock);
6316 			stp->sd_flag &= ~waitflags;
6317 			cv_broadcast(&stp->sd_iocmonitor);
6318 			mutex_exit(&stp->sd_lock);
6319 			crfree(crp);
6320 			return (error);
6321 		}
6322 		goto waitioc;
6323 
6324 	default:
6325 		ASSERT(0);
6326 		mutex_enter(&stp->sd_lock);
6327 		stp->sd_flag &= ~waitflags;
6328 		cv_broadcast(&stp->sd_iocmonitor);
6329 		mutex_exit(&stp->sd_lock);
6330 		break;
6331 	}
6332 
6333 	freemsg(bp);
6334 	crfree(crp);
6335 	return (error);
6336 }
6337 
6338 /*
6339  * Send an M_CMD message downstream and wait for a reply.  This is a ptools
6340  * special used to retrieve information from modules/drivers a stream without
6341  * being subjected to flow control or interfering with pending messages on the
6342  * stream (e.g. an ioctl in flight).
6343  */
6344 int
strdocmd(struct stdata * stp,struct strcmd * scp,cred_t * crp)6345 strdocmd(struct stdata *stp, struct strcmd *scp, cred_t *crp)
6346 {
6347 	mblk_t *mp;
6348 	struct cmdblk *cmdp;
6349 	int error = 0;
6350 	int errs = STRHUP|STRDERR|STWRERR|STPLEX;
6351 	clock_t rval, timeout = STRTIMOUT;
6352 
6353 	if (scp->sc_len < 0 || scp->sc_len > sizeof (scp->sc_buf) ||
6354 	    scp->sc_timeout < -1)
6355 		return (EINVAL);
6356 
6357 	if (scp->sc_timeout > 0)
6358 		timeout = scp->sc_timeout * MILLISEC;
6359 
6360 	if ((mp = allocb_cred(sizeof (struct cmdblk), crp,
6361 	    curproc->p_pid)) == NULL)
6362 		return (ENOMEM);
6363 
6364 	crhold(crp);
6365 
6366 	cmdp = (struct cmdblk *)mp->b_wptr;
6367 	cmdp->cb_cr = crp;
6368 	cmdp->cb_cmd = scp->sc_cmd;
6369 	cmdp->cb_len = scp->sc_len;
6370 	cmdp->cb_error = 0;
6371 	mp->b_wptr += sizeof (struct cmdblk);
6372 
6373 	DB_TYPE(mp) = M_CMD;
6374 	DB_CPID(mp) = curproc->p_pid;
6375 
6376 	/*
6377 	 * Copy in the payload.
6378 	 */
6379 	if (cmdp->cb_len > 0) {
6380 		mp->b_cont = allocb_cred(sizeof (scp->sc_buf), crp,
6381 		    curproc->p_pid);
6382 		if (mp->b_cont == NULL) {
6383 			error = ENOMEM;
6384 			goto out;
6385 		}
6386 
6387 		/* cb_len comes from sc_len, which has already been checked */
6388 		ASSERT(cmdp->cb_len <= sizeof (scp->sc_buf));
6389 		(void) bcopy(scp->sc_buf, mp->b_cont->b_wptr, cmdp->cb_len);
6390 		mp->b_cont->b_wptr += cmdp->cb_len;
6391 		DB_CPID(mp->b_cont) = curproc->p_pid;
6392 	}
6393 
6394 	/*
6395 	 * Since this mechanism is strictly for ptools, and since only one
6396 	 * process can be grabbed at a time, we simply fail if there's
6397 	 * currently an operation pending.
6398 	 */
6399 	mutex_enter(&stp->sd_lock);
6400 	if (stp->sd_flag & STRCMDWAIT) {
6401 		mutex_exit(&stp->sd_lock);
6402 		error = EBUSY;
6403 		goto out;
6404 	}
6405 	stp->sd_flag |= STRCMDWAIT;
6406 	ASSERT(stp->sd_cmdblk == NULL);
6407 	mutex_exit(&stp->sd_lock);
6408 
6409 	putnext(stp->sd_wrq, mp);
6410 	mp = NULL;
6411 
6412 	/*
6413 	 * Timed wait for acknowledgment.  If the reply has already arrived,
6414 	 * don't sleep.  If awakened from the sleep, fail only if the reply
6415 	 * has not arrived by then.  Otherwise, process the reply.
6416 	 */
6417 	mutex_enter(&stp->sd_lock);
6418 	while (stp->sd_cmdblk == NULL) {
6419 		if (stp->sd_flag & errs) {
6420 			if ((error = strgeterr(stp, errs, 0)) != 0)
6421 				goto waitout;
6422 		}
6423 
6424 		rval = str_cv_wait(&stp->sd_monitor, &stp->sd_lock, timeout, 0);
6425 		if (stp->sd_cmdblk != NULL)
6426 			break;
6427 
6428 		if (rval <= 0) {
6429 			error = (rval == 0) ? EINTR : ETIME;
6430 			goto waitout;
6431 		}
6432 	}
6433 
6434 	/*
6435 	 * We received a reply.
6436 	 */
6437 	mp = stp->sd_cmdblk;
6438 	stp->sd_cmdblk = NULL;
6439 	ASSERT(mp != NULL && DB_TYPE(mp) == M_CMD);
6440 	ASSERT(stp->sd_flag & STRCMDWAIT);
6441 	stp->sd_flag &= ~STRCMDWAIT;
6442 	mutex_exit(&stp->sd_lock);
6443 
6444 	cmdp = (struct cmdblk *)mp->b_rptr;
6445 	if ((error = cmdp->cb_error) != 0)
6446 		goto out;
6447 
6448 	/*
6449 	 * Data may have been returned in the reply (cb_len > 0).
6450 	 * If so, copy it out to the user's buffer.
6451 	 */
6452 	if (cmdp->cb_len > 0) {
6453 		if (mp->b_cont == NULL || MBLKL(mp->b_cont) < cmdp->cb_len) {
6454 			error = EPROTO;
6455 			goto out;
6456 		}
6457 
6458 		cmdp->cb_len = MIN(cmdp->cb_len, sizeof (scp->sc_buf));
6459 		(void) bcopy(mp->b_cont->b_rptr, scp->sc_buf, cmdp->cb_len);
6460 	}
6461 	scp->sc_len = cmdp->cb_len;
6462 out:
6463 	freemsg(mp);
6464 	crfree(crp);
6465 	return (error);
6466 waitout:
6467 	ASSERT(stp->sd_cmdblk == NULL);
6468 	stp->sd_flag &= ~STRCMDWAIT;
6469 	mutex_exit(&stp->sd_lock);
6470 	crfree(crp);
6471 	return (error);
6472 }
6473 
6474 /*
6475  * For the SunOS keyboard driver.
6476  * Return the next available "ioctl" sequence number.
6477  * Exported, so that streams modules can send "ioctl" messages
6478  * downstream from their open routine.
6479  */
6480 int
getiocseqno(void)6481 getiocseqno(void)
6482 {
6483 	int	i;
6484 
6485 	mutex_enter(&strresources);
6486 	i = ++ioc_id;
6487 	mutex_exit(&strresources);
6488 	return (i);
6489 }
6490 
6491 /*
6492  * Get the next message from the read queue.  If the message is
6493  * priority, STRPRI will have been set by strrput().  This flag
6494  * should be reset only when the entire message at the front of the
6495  * queue as been consumed.
6496  *
6497  * NOTE: strgetmsg and kstrgetmsg have much of the logic in common.
6498  */
6499 int
strgetmsg(struct vnode * vp,struct strbuf * mctl,struct strbuf * mdata,unsigned char * prip,int * flagsp,int fmode,rval_t * rvp)6500 strgetmsg(
6501 	struct vnode *vp,
6502 	struct strbuf *mctl,
6503 	struct strbuf *mdata,
6504 	unsigned char *prip,
6505 	int *flagsp,
6506 	int fmode,
6507 	rval_t *rvp)
6508 {
6509 	struct stdata *stp;
6510 	mblk_t *bp, *nbp;
6511 	mblk_t *savemp = NULL;
6512 	mblk_t *savemptail = NULL;
6513 	uint_t old_sd_flag;
6514 	int flg;
6515 	int more = 0;
6516 	int error = 0;
6517 	char first = 1;
6518 	uint_t mark;		/* Contains MSG*MARK and _LASTMARK */
6519 #define	_LASTMARK	0x8000	/* Distinct from MSG*MARK */
6520 	unsigned char pri = 0;
6521 	queue_t *q;
6522 	int	pr = 0;			/* Partial read successful */
6523 	struct uio uios;
6524 	struct uio *uiop = &uios;
6525 	struct iovec iovs;
6526 	unsigned char type;
6527 
6528 	TRACE_1(TR_FAC_STREAMS_FR, TR_STRGETMSG_ENTER,
6529 	    "strgetmsg:%p", vp);
6530 
6531 	ASSERT(vp->v_stream);
6532 	stp = vp->v_stream;
6533 	rvp->r_val1 = 0;
6534 
6535 	mutex_enter(&stp->sd_lock);
6536 
6537 	if ((error = i_straccess(stp, JCREAD)) != 0) {
6538 		mutex_exit(&stp->sd_lock);
6539 		return (error);
6540 	}
6541 
6542 	if (stp->sd_flag & (STRDERR|STPLEX)) {
6543 		error = strgeterr(stp, STRDERR|STPLEX, 0);
6544 		if (error != 0) {
6545 			mutex_exit(&stp->sd_lock);
6546 			return (error);
6547 		}
6548 	}
6549 	mutex_exit(&stp->sd_lock);
6550 
6551 	switch (*flagsp) {
6552 	case MSG_HIPRI:
6553 		if (*prip != 0)
6554 			return (EINVAL);
6555 		break;
6556 
6557 	case MSG_ANY:
6558 	case MSG_BAND:
6559 		break;
6560 
6561 	default:
6562 		return (EINVAL);
6563 	}
6564 	/*
6565 	 * Setup uio and iov for data part
6566 	 */
6567 	iovs.iov_base = mdata->buf;
6568 	iovs.iov_len = mdata->maxlen;
6569 	uios.uio_iov = &iovs;
6570 	uios.uio_iovcnt = 1;
6571 	uios.uio_loffset = 0;
6572 	uios.uio_segflg = UIO_USERSPACE;
6573 	uios.uio_fmode = 0;
6574 	uios.uio_extflg = UIO_COPY_CACHED;
6575 	uios.uio_resid = mdata->maxlen;
6576 	uios.uio_offset = 0;
6577 
6578 	q = _RD(stp->sd_wrq);
6579 	mutex_enter(&stp->sd_lock);
6580 	old_sd_flag = stp->sd_flag;
6581 	mark = 0;
6582 	for (;;) {
6583 		int done = 0;
6584 		mblk_t *q_first = q->q_first;
6585 
6586 		/*
6587 		 * Get the next message of appropriate priority
6588 		 * from the stream head.  If the caller is interested
6589 		 * in band or hipri messages, then they should already
6590 		 * be enqueued at the stream head.  On the other hand
6591 		 * if the caller wants normal (band 0) messages, they
6592 		 * might be deferred in a synchronous stream and they
6593 		 * will need to be pulled up.
6594 		 *
6595 		 * After we have dequeued a message, we might find that
6596 		 * it was a deferred M_SIG that was enqueued at the
6597 		 * stream head.  It must now be posted as part of the
6598 		 * read by calling strsignal_nolock().
6599 		 *
6600 		 * Also note that strrput does not enqueue an M_PCSIG,
6601 		 * and there cannot be more than one hipri message,
6602 		 * so there was no need to have the M_PCSIG case.
6603 		 *
6604 		 * At some time it might be nice to try and wrap the
6605 		 * functionality of kstrgetmsg() and strgetmsg() into
6606 		 * a common routine so to reduce the amount of replicated
6607 		 * code (since they are extremely similar).
6608 		 */
6609 		if (!(*flagsp & (MSG_HIPRI|MSG_BAND))) {
6610 			/* Asking for normal, band0 data */
6611 			bp = strget(stp, q, uiop, first, &error);
6612 			ASSERT(MUTEX_HELD(&stp->sd_lock));
6613 			if (bp != NULL) {
6614 				if (DB_TYPE(bp) == M_SIG) {
6615 					strsignal_nolock(stp, *bp->b_rptr,
6616 					    bp->b_band);
6617 					freemsg(bp);
6618 					continue;
6619 				} else {
6620 					break;
6621 				}
6622 			}
6623 			if (error != 0)
6624 				goto getmout;
6625 
6626 		/*
6627 		 * We can't depend on the value of STRPRI here because
6628 		 * the stream head may be in transit. Therefore, we
6629 		 * must look at the type of the first message to
6630 		 * determine if a high priority messages is waiting
6631 		 */
6632 		} else if ((*flagsp & MSG_HIPRI) && q_first != NULL &&
6633 		    DB_TYPE(q_first) >= QPCTL &&
6634 		    (bp = getq_noenab(q, 0)) != NULL) {
6635 			/* Asked for HIPRI and got one */
6636 			ASSERT(DB_TYPE(bp) >= QPCTL);
6637 			break;
6638 		} else if ((*flagsp & MSG_BAND) && q_first != NULL &&
6639 		    ((q_first->b_band >= *prip) || DB_TYPE(q_first) >= QPCTL) &&
6640 		    (bp = getq_noenab(q, 0)) != NULL) {
6641 			/*
6642 			 * Asked for at least band "prip" and got either at
6643 			 * least that band or a hipri message.
6644 			 */
6645 			ASSERT(bp->b_band >= *prip || DB_TYPE(bp) >= QPCTL);
6646 			if (DB_TYPE(bp) == M_SIG) {
6647 				strsignal_nolock(stp, *bp->b_rptr, bp->b_band);
6648 				freemsg(bp);
6649 				continue;
6650 			} else {
6651 				break;
6652 			}
6653 		}
6654 
6655 		/* No data. Time to sleep? */
6656 		qbackenable(q, 0);
6657 
6658 		/*
6659 		 * If STRHUP or STREOF, return 0 length control and data.
6660 		 * If resid is 0, then a read(fd,buf,0) was done. Do not
6661 		 * sleep to satisfy this request because by default we have
6662 		 * zero bytes to return.
6663 		 */
6664 		if ((stp->sd_flag & (STRHUP|STREOF)) || (mctl->maxlen == 0 &&
6665 		    mdata->maxlen == 0)) {
6666 			mctl->len = mdata->len = 0;
6667 			*flagsp = 0;
6668 			mutex_exit(&stp->sd_lock);
6669 			return (0);
6670 		}
6671 		TRACE_2(TR_FAC_STREAMS_FR, TR_STRGETMSG_WAIT,
6672 		    "strgetmsg calls strwaitq:%p, %p",
6673 		    vp, uiop);
6674 		if (((error = strwaitq(stp, GETWAIT, (ssize_t)0, fmode, -1,
6675 		    &done)) != 0) || done) {
6676 			TRACE_2(TR_FAC_STREAMS_FR, TR_STRGETMSG_DONE,
6677 			    "strgetmsg error or done:%p, %p",
6678 			    vp, uiop);
6679 			mutex_exit(&stp->sd_lock);
6680 			return (error);
6681 		}
6682 		TRACE_2(TR_FAC_STREAMS_FR, TR_STRGETMSG_AWAKE,
6683 		    "strgetmsg awakes:%p, %p", vp, uiop);
6684 		if ((error = i_straccess(stp, JCREAD)) != 0) {
6685 			mutex_exit(&stp->sd_lock);
6686 			return (error);
6687 		}
6688 		first = 0;
6689 	}
6690 	ASSERT(bp != NULL);
6691 	/*
6692 	 * Extract any mark information. If the message is not completely
6693 	 * consumed this information will be put in the mblk
6694 	 * that is putback.
6695 	 * If MSGMARKNEXT is set and the message is completely consumed
6696 	 * the STRATMARK flag will be set below. Likewise, if
6697 	 * MSGNOTMARKNEXT is set and the message is
6698 	 * completely consumed STRNOTATMARK will be set.
6699 	 */
6700 	mark = bp->b_flag & (MSGMARK | MSGMARKNEXT | MSGNOTMARKNEXT);
6701 	ASSERT((mark & (MSGMARKNEXT|MSGNOTMARKNEXT)) !=
6702 	    (MSGMARKNEXT|MSGNOTMARKNEXT));
6703 	if (mark != 0 && bp == stp->sd_mark) {
6704 		mark |= _LASTMARK;
6705 		stp->sd_mark = NULL;
6706 	}
6707 	/*
6708 	 * keep track of the original message type and priority
6709 	 */
6710 	pri = bp->b_band;
6711 	type = bp->b_datap->db_type;
6712 	if (type == M_PASSFP) {
6713 		if ((mark & _LASTMARK) && (stp->sd_mark == NULL))
6714 			stp->sd_mark = bp;
6715 		bp->b_flag |= mark & ~_LASTMARK;
6716 		putback(stp, q, bp, pri);
6717 		qbackenable(q, pri);
6718 		mutex_exit(&stp->sd_lock);
6719 		return (EBADMSG);
6720 	}
6721 	ASSERT(type != M_SIG);
6722 
6723 	/*
6724 	 * Set this flag so strrput will not generate signals. Need to
6725 	 * make sure this flag is cleared before leaving this routine
6726 	 * else signals will stop being sent.
6727 	 */
6728 	stp->sd_flag |= STRGETINPROG;
6729 	mutex_exit(&stp->sd_lock);
6730 
6731 	if (STREAM_NEEDSERVICE(stp))
6732 		stream_runservice(stp);
6733 
6734 	/*
6735 	 * Set HIPRI flag if message is priority.
6736 	 */
6737 	if (type >= QPCTL)
6738 		flg = MSG_HIPRI;
6739 	else
6740 		flg = MSG_BAND;
6741 
6742 	/*
6743 	 * First process PROTO or PCPROTO blocks, if any.
6744 	 */
6745 	if (mctl->maxlen >= 0 && type != M_DATA) {
6746 		size_t	n, bcnt;
6747 		char	*ubuf;
6748 
6749 		bcnt = mctl->maxlen;
6750 		ubuf = mctl->buf;
6751 		while (bp != NULL && bp->b_datap->db_type != M_DATA) {
6752 			if ((n = MIN(bcnt, bp->b_wptr - bp->b_rptr)) != 0 &&
6753 			    copyout(bp->b_rptr, ubuf, n)) {
6754 				error = EFAULT;
6755 				mutex_enter(&stp->sd_lock);
6756 				/*
6757 				 * clear stream head pri flag based on
6758 				 * first message type
6759 				 */
6760 				if (type >= QPCTL) {
6761 					ASSERT(type == M_PCPROTO);
6762 					stp->sd_flag &= ~STRPRI;
6763 				}
6764 				more = 0;
6765 				freemsg(bp);
6766 				goto getmout;
6767 			}
6768 			ubuf += n;
6769 			bp->b_rptr += n;
6770 			if (bp->b_rptr >= bp->b_wptr) {
6771 				nbp = bp;
6772 				bp = bp->b_cont;
6773 				freeb(nbp);
6774 			}
6775 			ASSERT(n <= bcnt);
6776 			bcnt -= n;
6777 			if (bcnt == 0)
6778 				break;
6779 		}
6780 		mctl->len = mctl->maxlen - bcnt;
6781 	} else
6782 		mctl->len = -1;
6783 
6784 	if (bp && bp->b_datap->db_type != M_DATA) {
6785 		/*
6786 		 * More PROTO blocks in msg.
6787 		 */
6788 		more |= MORECTL;
6789 		savemp = bp;
6790 		while (bp && bp->b_datap->db_type != M_DATA) {
6791 			savemptail = bp;
6792 			bp = bp->b_cont;
6793 		}
6794 		savemptail->b_cont = NULL;
6795 	}
6796 
6797 	/*
6798 	 * Now process DATA blocks, if any.
6799 	 */
6800 	if (mdata->maxlen >= 0 && bp) {
6801 		/*
6802 		 * struiocopyout will consume a potential zero-length
6803 		 * M_DATA even if uio_resid is zero.
6804 		 */
6805 		size_t oldresid = uiop->uio_resid;
6806 
6807 		bp = struiocopyout(bp, uiop, &error);
6808 		if (error != 0) {
6809 			mutex_enter(&stp->sd_lock);
6810 			/*
6811 			 * clear stream head hi pri flag based on
6812 			 * first message
6813 			 */
6814 			if (type >= QPCTL) {
6815 				ASSERT(type == M_PCPROTO);
6816 				stp->sd_flag &= ~STRPRI;
6817 			}
6818 			more = 0;
6819 			freemsg(savemp);
6820 			goto getmout;
6821 		}
6822 		/*
6823 		 * (pr == 1) indicates a partial read.
6824 		 */
6825 		if (oldresid > uiop->uio_resid)
6826 			pr = 1;
6827 		mdata->len = mdata->maxlen - uiop->uio_resid;
6828 	} else
6829 		mdata->len = -1;
6830 
6831 	if (bp) {			/* more data blocks in msg */
6832 		more |= MOREDATA;
6833 		if (savemp)
6834 			savemptail->b_cont = bp;
6835 		else
6836 			savemp = bp;
6837 	}
6838 
6839 	mutex_enter(&stp->sd_lock);
6840 	if (savemp) {
6841 		if (pr && (savemp->b_datap->db_type == M_DATA) &&
6842 		    msgnodata(savemp)) {
6843 			/*
6844 			 * Avoid queuing a zero-length tail part of
6845 			 * a message. pr=1 indicates that we read some of
6846 			 * the message.
6847 			 */
6848 			freemsg(savemp);
6849 			more &= ~MOREDATA;
6850 			/*
6851 			 * clear stream head hi pri flag based on
6852 			 * first message
6853 			 */
6854 			if (type >= QPCTL) {
6855 				ASSERT(type == M_PCPROTO);
6856 				stp->sd_flag &= ~STRPRI;
6857 			}
6858 		} else {
6859 			savemp->b_band = pri;
6860 			/*
6861 			 * If the first message was HIPRI and the one we're
6862 			 * putting back isn't, then clear STRPRI, otherwise
6863 			 * set STRPRI again.  Note that we must set STRPRI
6864 			 * again since the flush logic in strrput_nondata()
6865 			 * may have cleared it while we had sd_lock dropped.
6866 			 */
6867 			if (type >= QPCTL) {
6868 				ASSERT(type == M_PCPROTO);
6869 				if (queclass(savemp) < QPCTL)
6870 					stp->sd_flag &= ~STRPRI;
6871 				else
6872 					stp->sd_flag |= STRPRI;
6873 			} else if (queclass(savemp) >= QPCTL) {
6874 				/*
6875 				 * The first message was not a HIPRI message,
6876 				 * but the one we are about to putback is.
6877 				 * For simplicitly, we do not allow for HIPRI
6878 				 * messages to be embedded in the message
6879 				 * body, so just force it to same type as
6880 				 * first message.
6881 				 */
6882 				ASSERT(type == M_DATA || type == M_PROTO);
6883 				ASSERT(savemp->b_datap->db_type == M_PCPROTO);
6884 				savemp->b_datap->db_type = type;
6885 			}
6886 			if (mark != 0) {
6887 				savemp->b_flag |= mark & ~_LASTMARK;
6888 				if ((mark & _LASTMARK) &&
6889 				    (stp->sd_mark == NULL)) {
6890 					/*
6891 					 * If another marked message arrived
6892 					 * while sd_lock was not held sd_mark
6893 					 * would be non-NULL.
6894 					 */
6895 					stp->sd_mark = savemp;
6896 				}
6897 			}
6898 			putback(stp, q, savemp, pri);
6899 		}
6900 	} else {
6901 		/*
6902 		 * The complete message was consumed.
6903 		 *
6904 		 * If another M_PCPROTO arrived while sd_lock was not held
6905 		 * it would have been discarded since STRPRI was still set.
6906 		 *
6907 		 * Move the MSG*MARKNEXT information
6908 		 * to the stream head just in case
6909 		 * the read queue becomes empty.
6910 		 * clear stream head hi pri flag based on
6911 		 * first message
6912 		 *
6913 		 * If the stream head was at the mark
6914 		 * (STRATMARK) before we dropped sd_lock above
6915 		 * and some data was consumed then we have
6916 		 * moved past the mark thus STRATMARK is
6917 		 * cleared. However, if a message arrived in
6918 		 * strrput during the copyout above causing
6919 		 * STRATMARK to be set we can not clear that
6920 		 * flag.
6921 		 */
6922 		if (type >= QPCTL) {
6923 			ASSERT(type == M_PCPROTO);
6924 			stp->sd_flag &= ~STRPRI;
6925 		}
6926 		if (mark & (MSGMARKNEXT|MSGNOTMARKNEXT|MSGMARK)) {
6927 			if (mark & MSGMARKNEXT) {
6928 				stp->sd_flag &= ~STRNOTATMARK;
6929 				stp->sd_flag |= STRATMARK;
6930 			} else if (mark & MSGNOTMARKNEXT) {
6931 				stp->sd_flag &= ~STRATMARK;
6932 				stp->sd_flag |= STRNOTATMARK;
6933 			} else {
6934 				stp->sd_flag &= ~(STRATMARK|STRNOTATMARK);
6935 			}
6936 		} else if (pr && (old_sd_flag & STRATMARK)) {
6937 			stp->sd_flag &= ~STRATMARK;
6938 		}
6939 	}
6940 
6941 	*flagsp = flg;
6942 	*prip = pri;
6943 
6944 	/*
6945 	 * Getmsg cleanup processing - if the state of the queue has changed
6946 	 * some signals may need to be sent and/or poll awakened.
6947 	 */
6948 getmout:
6949 	qbackenable(q, pri);
6950 
6951 	/*
6952 	 * We dropped the stream head lock above. Send all M_SIG messages
6953 	 * before processing stream head for SIGPOLL messages.
6954 	 */
6955 	ASSERT(MUTEX_HELD(&stp->sd_lock));
6956 	while ((bp = q->q_first) != NULL &&
6957 	    (bp->b_datap->db_type == M_SIG)) {
6958 		/*
6959 		 * sd_lock is held so the content of the read queue can not
6960 		 * change.
6961 		 */
6962 		bp = getq(q);
6963 		ASSERT(bp != NULL && bp->b_datap->db_type == M_SIG);
6964 
6965 		strsignal_nolock(stp, *bp->b_rptr, bp->b_band);
6966 		mutex_exit(&stp->sd_lock);
6967 		freemsg(bp);
6968 		if (STREAM_NEEDSERVICE(stp))
6969 			stream_runservice(stp);
6970 		mutex_enter(&stp->sd_lock);
6971 	}
6972 
6973 	/*
6974 	 * stream head cannot change while we make the determination
6975 	 * whether or not to send a signal. Drop the flag to allow strrput
6976 	 * to send firstmsgsigs again.
6977 	 */
6978 	stp->sd_flag &= ~STRGETINPROG;
6979 
6980 	/*
6981 	 * If the type of message at the front of the queue changed
6982 	 * due to the receive the appropriate signals and pollwakeup events
6983 	 * are generated. The type of changes are:
6984 	 *	Processed a hipri message, q_first is not hipri.
6985 	 *	Processed a band X message, and q_first is band Y.
6986 	 * The generated signals and pollwakeups are identical to what
6987 	 * strrput() generates should the message that is now on q_first
6988 	 * arrive to an empty read queue.
6989 	 *
6990 	 * Note: only strrput will send a signal for a hipri message.
6991 	 */
6992 	if ((bp = q->q_first) != NULL && !(stp->sd_flag & STRPRI)) {
6993 		strsigset_t signals = 0;
6994 		strpollset_t pollwakeups = 0;
6995 
6996 		if (flg & MSG_HIPRI) {
6997 			/*
6998 			 * Removed a hipri message. Regular data at
6999 			 * the front of  the queue.
7000 			 */
7001 			if (bp->b_band == 0) {
7002 				signals = S_INPUT | S_RDNORM;
7003 				pollwakeups = POLLIN | POLLRDNORM;
7004 			} else {
7005 				signals = S_INPUT | S_RDBAND;
7006 				pollwakeups = POLLIN | POLLRDBAND;
7007 			}
7008 		} else if (pri != bp->b_band) {
7009 			/*
7010 			 * The band is different for the new q_first.
7011 			 */
7012 			if (bp->b_band == 0) {
7013 				signals = S_RDNORM;
7014 				pollwakeups = POLLIN | POLLRDNORM;
7015 			} else {
7016 				signals = S_RDBAND;
7017 				pollwakeups = POLLIN | POLLRDBAND;
7018 			}
7019 		}
7020 
7021 		if (pollwakeups != 0) {
7022 			if (pollwakeups == (POLLIN | POLLRDNORM)) {
7023 				if (!(stp->sd_rput_opt & SR_POLLIN))
7024 					goto no_pollwake;
7025 				stp->sd_rput_opt &= ~SR_POLLIN;
7026 			}
7027 			mutex_exit(&stp->sd_lock);
7028 			pollwakeup(&stp->sd_pollist, pollwakeups);
7029 			mutex_enter(&stp->sd_lock);
7030 		}
7031 no_pollwake:
7032 
7033 		if (stp->sd_sigflags & signals)
7034 			strsendsig(stp->sd_siglist, signals, bp->b_band, 0);
7035 	}
7036 	mutex_exit(&stp->sd_lock);
7037 
7038 	rvp->r_val1 = more;
7039 	return (error);
7040 #undef	_LASTMARK
7041 }
7042 
7043 /*
7044  * Get the next message from the read queue.  If the message is
7045  * priority, STRPRI will have been set by strrput().  This flag
7046  * should be reset only when the entire message at the front of the
7047  * queue as been consumed.
7048  *
7049  * If uiop is NULL all data is returned in mctlp.
7050  * Note that a NULL uiop implies that FNDELAY and FNONBLOCK are assumed
7051  * not enabled.
7052  * The timeout parameter is in milliseconds; -1 for infinity.
7053  * This routine handles the consolidation private flags:
7054  *	MSG_IGNERROR	Ignore any stream head error except STPLEX.
7055  *	MSG_DELAYERROR	Defer the error check until the queue is empty.
7056  *	MSG_HOLDSIG	Hold signals while waiting for data.
7057  *	MSG_IPEEK	Only peek at messages.
7058  *	MSG_DISCARDTAIL	Discard the tail M_DATA part of the message
7059  *			that doesn't fit.
7060  *	MSG_NOMARK	If the message is marked leave it on the queue.
7061  *
7062  * NOTE: strgetmsg and kstrgetmsg have much of the logic in common.
7063  */
7064 int
kstrgetmsg(struct vnode * vp,mblk_t ** mctlp,struct uio * uiop,unsigned char * prip,int * flagsp,clock_t timout,rval_t * rvp)7065 kstrgetmsg(
7066 	struct vnode *vp,
7067 	mblk_t **mctlp,
7068 	struct uio *uiop,
7069 	unsigned char *prip,
7070 	int *flagsp,
7071 	clock_t timout,
7072 	rval_t *rvp)
7073 {
7074 	struct stdata *stp;
7075 	mblk_t *bp, *nbp;
7076 	mblk_t *savemp = NULL;
7077 	mblk_t *savemptail = NULL;
7078 	int flags;
7079 	uint_t old_sd_flag;
7080 	int flg;
7081 	int more = 0;
7082 	int error = 0;
7083 	char first = 1;
7084 	uint_t mark;		/* Contains MSG*MARK and _LASTMARK */
7085 #define	_LASTMARK	0x8000	/* Distinct from MSG*MARK */
7086 	unsigned char pri = 0;
7087 	queue_t *q;
7088 	int	pr = 0;			/* Partial read successful */
7089 	unsigned char type;
7090 
7091 	TRACE_1(TR_FAC_STREAMS_FR, TR_KSTRGETMSG_ENTER,
7092 	    "kstrgetmsg:%p", vp);
7093 
7094 	ASSERT(vp->v_stream);
7095 	stp = vp->v_stream;
7096 	rvp->r_val1 = 0;
7097 
7098 	mutex_enter(&stp->sd_lock);
7099 
7100 	if ((error = i_straccess(stp, JCREAD)) != 0) {
7101 		mutex_exit(&stp->sd_lock);
7102 		return (error);
7103 	}
7104 
7105 	flags = *flagsp;
7106 	if (stp->sd_flag & (STRDERR|STPLEX)) {
7107 		if ((stp->sd_flag & STPLEX) ||
7108 		    (flags & (MSG_IGNERROR|MSG_DELAYERROR)) == 0) {
7109 			error = strgeterr(stp, STRDERR|STPLEX,
7110 			    (flags & MSG_IPEEK));
7111 			if (error != 0) {
7112 				mutex_exit(&stp->sd_lock);
7113 				return (error);
7114 			}
7115 		}
7116 	}
7117 	mutex_exit(&stp->sd_lock);
7118 
7119 	switch (flags & (MSG_HIPRI|MSG_ANY|MSG_BAND)) {
7120 	case MSG_HIPRI:
7121 		if (*prip != 0)
7122 			return (EINVAL);
7123 		break;
7124 
7125 	case MSG_ANY:
7126 	case MSG_BAND:
7127 		break;
7128 
7129 	default:
7130 		return (EINVAL);
7131 	}
7132 
7133 retry:
7134 	q = _RD(stp->sd_wrq);
7135 	mutex_enter(&stp->sd_lock);
7136 	old_sd_flag = stp->sd_flag;
7137 	mark = 0;
7138 	for (;;) {
7139 		int done = 0;
7140 		int waitflag;
7141 		int fmode;
7142 		mblk_t *q_first = q->q_first;
7143 
7144 		/*
7145 		 * This section of the code operates just like the code
7146 		 * in strgetmsg().  There is a comment there about what
7147 		 * is going on here.
7148 		 */
7149 		if (!(flags & (MSG_HIPRI|MSG_BAND))) {
7150 			/* Asking for normal, band0 data */
7151 			bp = strget(stp, q, uiop, first, &error);
7152 			ASSERT(MUTEX_HELD(&stp->sd_lock));
7153 			if (bp != NULL) {
7154 				if (DB_TYPE(bp) == M_SIG) {
7155 					strsignal_nolock(stp, *bp->b_rptr,
7156 					    bp->b_band);
7157 					freemsg(bp);
7158 					continue;
7159 				} else {
7160 					break;
7161 				}
7162 			}
7163 			if (error != 0) {
7164 				goto getmout;
7165 			}
7166 		/*
7167 		 * We can't depend on the value of STRPRI here because
7168 		 * the stream head may be in transit. Therefore, we
7169 		 * must look at the type of the first message to
7170 		 * determine if a high priority messages is waiting
7171 		 */
7172 		} else if ((flags & MSG_HIPRI) && q_first != NULL &&
7173 		    DB_TYPE(q_first) >= QPCTL &&
7174 		    (bp = getq_noenab(q, 0)) != NULL) {
7175 			ASSERT(DB_TYPE(bp) >= QPCTL);
7176 			break;
7177 		} else if ((flags & MSG_BAND) && q_first != NULL &&
7178 		    ((q_first->b_band >= *prip) || DB_TYPE(q_first) >= QPCTL) &&
7179 		    (bp = getq_noenab(q, 0)) != NULL) {
7180 			/*
7181 			 * Asked for at least band "prip" and got either at
7182 			 * least that band or a hipri message.
7183 			 */
7184 			ASSERT(bp->b_band >= *prip || DB_TYPE(bp) >= QPCTL);
7185 			if (DB_TYPE(bp) == M_SIG) {
7186 				strsignal_nolock(stp, *bp->b_rptr, bp->b_band);
7187 				freemsg(bp);
7188 				continue;
7189 			} else {
7190 				break;
7191 			}
7192 		}
7193 
7194 		/* No data. Time to sleep? */
7195 		qbackenable(q, 0);
7196 
7197 		/*
7198 		 * Delayed error notification?
7199 		 */
7200 		if ((stp->sd_flag & (STRDERR|STPLEX)) &&
7201 		    (flags & (MSG_IGNERROR|MSG_DELAYERROR)) == MSG_DELAYERROR) {
7202 			error = strgeterr(stp, STRDERR|STPLEX,
7203 			    (flags & MSG_IPEEK));
7204 			if (error != 0) {
7205 				mutex_exit(&stp->sd_lock);
7206 				return (error);
7207 			}
7208 		}
7209 
7210 		/*
7211 		 * If STRHUP or STREOF, return 0 length control and data.
7212 		 * If a read(fd,buf,0) has been done, do not sleep, just
7213 		 * return.
7214 		 *
7215 		 * If mctlp == NULL and uiop == NULL, then the code will
7216 		 * do the strwaitq. This is an understood way of saying
7217 		 * sleep "polling" until a message is received.
7218 		 */
7219 		if ((stp->sd_flag & (STRHUP|STREOF)) ||
7220 		    (uiop != NULL && uiop->uio_resid == 0)) {
7221 			if (mctlp != NULL)
7222 				*mctlp = NULL;
7223 			*flagsp = 0;
7224 			mutex_exit(&stp->sd_lock);
7225 			return (0);
7226 		}
7227 
7228 		waitflag = GETWAIT;
7229 		if (flags &
7230 		    (MSG_HOLDSIG|MSG_IGNERROR|MSG_IPEEK|MSG_DELAYERROR)) {
7231 			if (flags & MSG_HOLDSIG)
7232 				waitflag |= STR_NOSIG;
7233 			if (flags & MSG_IGNERROR)
7234 				waitflag |= STR_NOERROR;
7235 			if (flags & MSG_IPEEK)
7236 				waitflag |= STR_PEEK;
7237 			if (flags & MSG_DELAYERROR)
7238 				waitflag |= STR_DELAYERR;
7239 		}
7240 		if (uiop != NULL)
7241 			fmode = uiop->uio_fmode;
7242 		else
7243 			fmode = 0;
7244 
7245 		TRACE_2(TR_FAC_STREAMS_FR, TR_KSTRGETMSG_WAIT,
7246 		    "kstrgetmsg calls strwaitq:%p, %p",
7247 		    vp, uiop);
7248 		if (((error = strwaitq(stp, waitflag, (ssize_t)0,
7249 		    fmode, timout, &done))) != 0 || done) {
7250 			TRACE_2(TR_FAC_STREAMS_FR, TR_KSTRGETMSG_DONE,
7251 			    "kstrgetmsg error or done:%p, %p",
7252 			    vp, uiop);
7253 			mutex_exit(&stp->sd_lock);
7254 			return (error);
7255 		}
7256 		TRACE_2(TR_FAC_STREAMS_FR, TR_KSTRGETMSG_AWAKE,
7257 		    "kstrgetmsg awakes:%p, %p", vp, uiop);
7258 		if ((error = i_straccess(stp, JCREAD)) != 0) {
7259 			mutex_exit(&stp->sd_lock);
7260 			return (error);
7261 		}
7262 		first = 0;
7263 	}
7264 	ASSERT(bp != NULL);
7265 	/*
7266 	 * Extract any mark information. If the message is not completely
7267 	 * consumed this information will be put in the mblk
7268 	 * that is putback.
7269 	 * If MSGMARKNEXT is set and the message is completely consumed
7270 	 * the STRATMARK flag will be set below. Likewise, if
7271 	 * MSGNOTMARKNEXT is set and the message is
7272 	 * completely consumed STRNOTATMARK will be set.
7273 	 */
7274 	mark = bp->b_flag & (MSGMARK | MSGMARKNEXT | MSGNOTMARKNEXT);
7275 	ASSERT((mark & (MSGMARKNEXT|MSGNOTMARKNEXT)) !=
7276 	    (MSGMARKNEXT|MSGNOTMARKNEXT));
7277 	pri = bp->b_band;
7278 	if (mark != 0) {
7279 		/*
7280 		 * If the caller doesn't want the mark return.
7281 		 * Used to implement MSG_WAITALL in sockets.
7282 		 */
7283 		if (flags & MSG_NOMARK) {
7284 			putback(stp, q, bp, pri);
7285 			qbackenable(q, pri);
7286 			mutex_exit(&stp->sd_lock);
7287 			return (EWOULDBLOCK);
7288 		}
7289 		if (bp == stp->sd_mark) {
7290 			mark |= _LASTMARK;
7291 			stp->sd_mark = NULL;
7292 		}
7293 	}
7294 
7295 	/*
7296 	 * keep track of the first message type
7297 	 */
7298 	type = bp->b_datap->db_type;
7299 
7300 	if (bp->b_datap->db_type == M_PASSFP) {
7301 		if ((mark & _LASTMARK) && (stp->sd_mark == NULL))
7302 			stp->sd_mark = bp;
7303 		bp->b_flag |= mark & ~_LASTMARK;
7304 		putback(stp, q, bp, pri);
7305 		qbackenable(q, pri);
7306 		mutex_exit(&stp->sd_lock);
7307 		return (EBADMSG);
7308 	}
7309 	ASSERT(type != M_SIG);
7310 
7311 	if (flags & MSG_IPEEK) {
7312 		/*
7313 		 * Clear any struioflag - we do the uiomove over again
7314 		 * when peeking since it simplifies the code.
7315 		 *
7316 		 * Dup the message and put the original back on the queue.
7317 		 * If dupmsg() fails, try again with copymsg() to see if
7318 		 * there is indeed a shortage of memory.  dupmsg() may fail
7319 		 * if db_ref in any of the messages reaches its limit.
7320 		 */
7321 
7322 		if ((nbp = dupmsg(bp)) == NULL && (nbp = copymsg(bp)) == NULL) {
7323 			/*
7324 			 * Restore the state of the stream head since we
7325 			 * need to drop sd_lock (strwaitbuf is sleeping).
7326 			 */
7327 			size_t size = msgdsize(bp);
7328 
7329 			if ((mark & _LASTMARK) && (stp->sd_mark == NULL))
7330 				stp->sd_mark = bp;
7331 			bp->b_flag |= mark & ~_LASTMARK;
7332 			putback(stp, q, bp, pri);
7333 			mutex_exit(&stp->sd_lock);
7334 			error = strwaitbuf(size, BPRI_HI);
7335 			if (error) {
7336 				/*
7337 				 * There is no net change to the queue thus
7338 				 * no need to qbackenable.
7339 				 */
7340 				return (error);
7341 			}
7342 			goto retry;
7343 		}
7344 
7345 		if ((mark & _LASTMARK) && (stp->sd_mark == NULL))
7346 			stp->sd_mark = bp;
7347 		bp->b_flag |= mark & ~_LASTMARK;
7348 		putback(stp, q, bp, pri);
7349 		bp = nbp;
7350 	}
7351 
7352 	/*
7353 	 * Set this flag so strrput will not generate signals. Need to
7354 	 * make sure this flag is cleared before leaving this routine
7355 	 * else signals will stop being sent.
7356 	 */
7357 	stp->sd_flag |= STRGETINPROG;
7358 	mutex_exit(&stp->sd_lock);
7359 
7360 	if ((stp->sd_rputdatafunc != NULL) && (DB_TYPE(bp) == M_DATA)) {
7361 		mblk_t *tmp, *prevmp;
7362 
7363 		/*
7364 		 * Put first non-data mblk back to stream head and
7365 		 * cut the mblk chain so sd_rputdatafunc only sees
7366 		 * M_DATA mblks. We can skip the first mblk since it
7367 		 * is M_DATA according to the condition above.
7368 		 */
7369 		for (prevmp = bp, tmp = bp->b_cont; tmp != NULL;
7370 		    prevmp = tmp, tmp = tmp->b_cont) {
7371 			if (DB_TYPE(tmp) != M_DATA) {
7372 				prevmp->b_cont = NULL;
7373 				mutex_enter(&stp->sd_lock);
7374 				putback(stp, q, tmp, tmp->b_band);
7375 				mutex_exit(&stp->sd_lock);
7376 				break;
7377 			}
7378 		}
7379 
7380 		bp = (stp->sd_rputdatafunc)(stp->sd_vnode, bp,
7381 		    NULL, NULL, NULL, NULL);
7382 
7383 		if (bp == NULL)
7384 			goto retry;
7385 	}
7386 
7387 	if (STREAM_NEEDSERVICE(stp))
7388 		stream_runservice(stp);
7389 
7390 	/*
7391 	 * Set HIPRI flag if message is priority.
7392 	 */
7393 	if (type >= QPCTL)
7394 		flg = MSG_HIPRI;
7395 	else
7396 		flg = MSG_BAND;
7397 
7398 	/*
7399 	 * First process PROTO or PCPROTO blocks, if any.
7400 	 */
7401 	if (mctlp != NULL && type != M_DATA) {
7402 		mblk_t *nbp;
7403 
7404 		*mctlp = bp;
7405 		while (bp->b_cont && bp->b_cont->b_datap->db_type != M_DATA)
7406 			bp = bp->b_cont;
7407 		nbp = bp->b_cont;
7408 		bp->b_cont = NULL;
7409 		bp = nbp;
7410 	}
7411 
7412 	if (bp && bp->b_datap->db_type != M_DATA) {
7413 		/*
7414 		 * More PROTO blocks in msg. Will only happen if mctlp is NULL.
7415 		 */
7416 		more |= MORECTL;
7417 		savemp = bp;
7418 		while (bp && bp->b_datap->db_type != M_DATA) {
7419 			savemptail = bp;
7420 			bp = bp->b_cont;
7421 		}
7422 		savemptail->b_cont = NULL;
7423 	}
7424 
7425 	/*
7426 	 * Now process DATA blocks, if any.
7427 	 */
7428 	if (uiop == NULL) {
7429 		/* Append data to tail of mctlp */
7430 
7431 		if (mctlp != NULL) {
7432 			mblk_t **mpp = mctlp;
7433 
7434 			while (*mpp != NULL)
7435 				mpp = &((*mpp)->b_cont);
7436 			*mpp = bp;
7437 			bp = NULL;
7438 		}
7439 	} else if (uiop->uio_resid >= 0 && bp) {
7440 		size_t oldresid = uiop->uio_resid;
7441 
7442 		/*
7443 		 * If a streams message is likely to consist
7444 		 * of many small mblks, it is pulled up into
7445 		 * one continuous chunk of memory.
7446 		 * The size of the first mblk may be bogus because
7447 		 * successive read() calls on the socket reduce
7448 		 * the size of this mblk until it is exhausted
7449 		 * and then the code walks on to the next. Thus
7450 		 * the size of the mblk may not be the original size
7451 		 * that was passed up, it's simply a remainder
7452 		 * and hence can be very small without any
7453 		 * implication that the packet is badly fragmented.
7454 		 * So the size of the possible second mblk is
7455 		 * used to spot a badly fragmented packet.
7456 		 * see longer comment at top of page
7457 		 * by mblk_pull_len declaration.
7458 		 */
7459 
7460 		if (bp->b_cont != NULL && MBLKL(bp->b_cont) < mblk_pull_len) {
7461 			(void) pullupmsg(bp, -1);
7462 		}
7463 
7464 		bp = struiocopyout(bp, uiop, &error);
7465 		if (error != 0) {
7466 			if (mctlp != NULL) {
7467 				freemsg(*mctlp);
7468 				*mctlp = NULL;
7469 			} else
7470 				freemsg(savemp);
7471 			mutex_enter(&stp->sd_lock);
7472 			/*
7473 			 * clear stream head hi pri flag based on
7474 			 * first message
7475 			 */
7476 			if (!(flags & MSG_IPEEK) && (type >= QPCTL)) {
7477 				ASSERT(type == M_PCPROTO);
7478 				stp->sd_flag &= ~STRPRI;
7479 			}
7480 			more = 0;
7481 			goto getmout;
7482 		}
7483 		/*
7484 		 * (pr == 1) indicates a partial read.
7485 		 */
7486 		if (oldresid > uiop->uio_resid)
7487 			pr = 1;
7488 	}
7489 
7490 	if (bp) {			/* more data blocks in msg */
7491 		more |= MOREDATA;
7492 		if (savemp)
7493 			savemptail->b_cont = bp;
7494 		else
7495 			savemp = bp;
7496 	}
7497 
7498 	mutex_enter(&stp->sd_lock);
7499 	if (savemp) {
7500 		if (flags & (MSG_IPEEK|MSG_DISCARDTAIL)) {
7501 			/*
7502 			 * When MSG_DISCARDTAIL is set or
7503 			 * when peeking discard any tail. When peeking this
7504 			 * is the tail of the dup that was copied out - the
7505 			 * message has already been putback on the queue.
7506 			 * Return MOREDATA to the caller even though the data
7507 			 * is discarded. This is used by sockets (to
7508 			 * set MSG_TRUNC).
7509 			 */
7510 			freemsg(savemp);
7511 			if (!(flags & MSG_IPEEK) && (type >= QPCTL)) {
7512 				ASSERT(type == M_PCPROTO);
7513 				stp->sd_flag &= ~STRPRI;
7514 			}
7515 		} else if (pr && (savemp->b_datap->db_type == M_DATA) &&
7516 		    msgnodata(savemp)) {
7517 			/*
7518 			 * Avoid queuing a zero-length tail part of
7519 			 * a message. pr=1 indicates that we read some of
7520 			 * the message.
7521 			 */
7522 			freemsg(savemp);
7523 			more &= ~MOREDATA;
7524 			if (type >= QPCTL) {
7525 				ASSERT(type == M_PCPROTO);
7526 				stp->sd_flag &= ~STRPRI;
7527 			}
7528 		} else {
7529 			savemp->b_band = pri;
7530 			/*
7531 			 * If the first message was HIPRI and the one we're
7532 			 * putting back isn't, then clear STRPRI, otherwise
7533 			 * set STRPRI again.  Note that we must set STRPRI
7534 			 * again since the flush logic in strrput_nondata()
7535 			 * may have cleared it while we had sd_lock dropped.
7536 			 */
7537 
7538 			if (type >= QPCTL) {
7539 				ASSERT(type == M_PCPROTO);
7540 				if (queclass(savemp) < QPCTL)
7541 					stp->sd_flag &= ~STRPRI;
7542 				else
7543 					stp->sd_flag |= STRPRI;
7544 			} else if (queclass(savemp) >= QPCTL) {
7545 				/*
7546 				 * The first message was not a HIPRI message,
7547 				 * but the one we are about to putback is.
7548 				 * For simplicitly, we do not allow for HIPRI
7549 				 * messages to be embedded in the message
7550 				 * body, so just force it to same type as
7551 				 * first message.
7552 				 */
7553 				ASSERT(type == M_DATA || type == M_PROTO);
7554 				ASSERT(savemp->b_datap->db_type == M_PCPROTO);
7555 				savemp->b_datap->db_type = type;
7556 			}
7557 			if (mark != 0) {
7558 				if ((mark & _LASTMARK) &&
7559 				    (stp->sd_mark == NULL)) {
7560 					/*
7561 					 * If another marked message arrived
7562 					 * while sd_lock was not held sd_mark
7563 					 * would be non-NULL.
7564 					 */
7565 					stp->sd_mark = savemp;
7566 				}
7567 				savemp->b_flag |= mark & ~_LASTMARK;
7568 			}
7569 			putback(stp, q, savemp, pri);
7570 		}
7571 	} else if (!(flags & MSG_IPEEK)) {
7572 		/*
7573 		 * The complete message was consumed.
7574 		 *
7575 		 * If another M_PCPROTO arrived while sd_lock was not held
7576 		 * it would have been discarded since STRPRI was still set.
7577 		 *
7578 		 * Move the MSG*MARKNEXT information
7579 		 * to the stream head just in case
7580 		 * the read queue becomes empty.
7581 		 * clear stream head hi pri flag based on
7582 		 * first message
7583 		 *
7584 		 * If the stream head was at the mark
7585 		 * (STRATMARK) before we dropped sd_lock above
7586 		 * and some data was consumed then we have
7587 		 * moved past the mark thus STRATMARK is
7588 		 * cleared. However, if a message arrived in
7589 		 * strrput during the copyout above causing
7590 		 * STRATMARK to be set we can not clear that
7591 		 * flag.
7592 		 * XXX A "perimeter" would help by single-threading strrput,
7593 		 * strread, strgetmsg and kstrgetmsg.
7594 		 */
7595 		if (type >= QPCTL) {
7596 			ASSERT(type == M_PCPROTO);
7597 			stp->sd_flag &= ~STRPRI;
7598 		}
7599 		if (mark & (MSGMARKNEXT|MSGNOTMARKNEXT|MSGMARK)) {
7600 			if (mark & MSGMARKNEXT) {
7601 				stp->sd_flag &= ~STRNOTATMARK;
7602 				stp->sd_flag |= STRATMARK;
7603 			} else if (mark & MSGNOTMARKNEXT) {
7604 				stp->sd_flag &= ~STRATMARK;
7605 				stp->sd_flag |= STRNOTATMARK;
7606 			} else {
7607 				stp->sd_flag &= ~(STRATMARK|STRNOTATMARK);
7608 			}
7609 		} else if (pr && (old_sd_flag & STRATMARK)) {
7610 			stp->sd_flag &= ~STRATMARK;
7611 		}
7612 	}
7613 
7614 	*flagsp = flg;
7615 	*prip = pri;
7616 
7617 	/*
7618 	 * Getmsg cleanup processing - if the state of the queue has changed
7619 	 * some signals may need to be sent and/or poll awakened.
7620 	 */
7621 getmout:
7622 	qbackenable(q, pri);
7623 
7624 	/*
7625 	 * We dropped the stream head lock above. Send all M_SIG messages
7626 	 * before processing stream head for SIGPOLL messages.
7627 	 */
7628 	ASSERT(MUTEX_HELD(&stp->sd_lock));
7629 	while ((bp = q->q_first) != NULL &&
7630 	    (bp->b_datap->db_type == M_SIG)) {
7631 		/*
7632 		 * sd_lock is held so the content of the read queue can not
7633 		 * change.
7634 		 */
7635 		bp = getq(q);
7636 		ASSERT(bp != NULL && bp->b_datap->db_type == M_SIG);
7637 
7638 		strsignal_nolock(stp, *bp->b_rptr, bp->b_band);
7639 		mutex_exit(&stp->sd_lock);
7640 		freemsg(bp);
7641 		if (STREAM_NEEDSERVICE(stp))
7642 			stream_runservice(stp);
7643 		mutex_enter(&stp->sd_lock);
7644 	}
7645 
7646 	/*
7647 	 * stream head cannot change while we make the determination
7648 	 * whether or not to send a signal. Drop the flag to allow strrput
7649 	 * to send firstmsgsigs again.
7650 	 */
7651 	stp->sd_flag &= ~STRGETINPROG;
7652 
7653 	/*
7654 	 * If the type of message at the front of the queue changed
7655 	 * due to the receive the appropriate signals and pollwakeup events
7656 	 * are generated. The type of changes are:
7657 	 *	Processed a hipri message, q_first is not hipri.
7658 	 *	Processed a band X message, and q_first is band Y.
7659 	 * The generated signals and pollwakeups are identical to what
7660 	 * strrput() generates should the message that is now on q_first
7661 	 * arrive to an empty read queue.
7662 	 *
7663 	 * Note: only strrput will send a signal for a hipri message.
7664 	 */
7665 	if ((bp = q->q_first) != NULL && !(stp->sd_flag & STRPRI)) {
7666 		strsigset_t signals = 0;
7667 		strpollset_t pollwakeups = 0;
7668 
7669 		if (flg & MSG_HIPRI) {
7670 			/*
7671 			 * Removed a hipri message. Regular data at
7672 			 * the front of  the queue.
7673 			 */
7674 			if (bp->b_band == 0) {
7675 				signals = S_INPUT | S_RDNORM;
7676 				pollwakeups = POLLIN | POLLRDNORM;
7677 			} else {
7678 				signals = S_INPUT | S_RDBAND;
7679 				pollwakeups = POLLIN | POLLRDBAND;
7680 			}
7681 		} else if (pri != bp->b_band) {
7682 			/*
7683 			 * The band is different for the new q_first.
7684 			 */
7685 			if (bp->b_band == 0) {
7686 				signals = S_RDNORM;
7687 				pollwakeups = POLLIN | POLLRDNORM;
7688 			} else {
7689 				signals = S_RDBAND;
7690 				pollwakeups = POLLIN | POLLRDBAND;
7691 			}
7692 		}
7693 
7694 		if (pollwakeups != 0) {
7695 			if (pollwakeups == (POLLIN | POLLRDNORM)) {
7696 				if (!(stp->sd_rput_opt & SR_POLLIN))
7697 					goto no_pollwake;
7698 				stp->sd_rput_opt &= ~SR_POLLIN;
7699 			}
7700 			mutex_exit(&stp->sd_lock);
7701 			pollwakeup(&stp->sd_pollist, pollwakeups);
7702 			mutex_enter(&stp->sd_lock);
7703 		}
7704 no_pollwake:
7705 
7706 		if (stp->sd_sigflags & signals)
7707 			strsendsig(stp->sd_siglist, signals, bp->b_band, 0);
7708 	}
7709 	mutex_exit(&stp->sd_lock);
7710 
7711 	rvp->r_val1 = more;
7712 	return (error);
7713 #undef	_LASTMARK
7714 }
7715 
7716 /*
7717  * Put a message downstream.
7718  *
7719  * NOTE: strputmsg and kstrputmsg have much of the logic in common.
7720  */
7721 int
strputmsg(struct vnode * vp,struct strbuf * mctl,struct strbuf * mdata,unsigned char pri,int flag,int fmode)7722 strputmsg(
7723 	struct vnode *vp,
7724 	struct strbuf *mctl,
7725 	struct strbuf *mdata,
7726 	unsigned char pri,
7727 	int flag,
7728 	int fmode)
7729 {
7730 	struct stdata *stp;
7731 	queue_t *wqp;
7732 	mblk_t *mp;
7733 	ssize_t msgsize;
7734 	ssize_t rmin, rmax;
7735 	int error;
7736 	struct uio uios;
7737 	struct uio *uiop = &uios;
7738 	struct iovec iovs;
7739 	int xpg4 = 0;
7740 
7741 	ASSERT(vp->v_stream);
7742 	stp = vp->v_stream;
7743 	wqp = stp->sd_wrq;
7744 
7745 	/*
7746 	 * If it is an XPG4 application, we need to send
7747 	 * SIGPIPE below
7748 	 */
7749 
7750 	xpg4 = (flag & MSG_XPG4) ? 1 : 0;
7751 	flag &= ~MSG_XPG4;
7752 
7753 	if (AU_AUDITING())
7754 		audit_strputmsg(vp, mctl, mdata, pri, flag, fmode);
7755 
7756 	mutex_enter(&stp->sd_lock);
7757 
7758 	if ((error = i_straccess(stp, JCWRITE)) != 0) {
7759 		mutex_exit(&stp->sd_lock);
7760 		return (error);
7761 	}
7762 
7763 	if (stp->sd_flag & (STWRERR|STRHUP|STPLEX)) {
7764 		error = strwriteable(stp, B_FALSE, xpg4);
7765 		if (error != 0) {
7766 			mutex_exit(&stp->sd_lock);
7767 			return (error);
7768 		}
7769 	}
7770 
7771 	mutex_exit(&stp->sd_lock);
7772 
7773 	/*
7774 	 * Check for legal flag value.
7775 	 */
7776 	switch (flag) {
7777 	case MSG_HIPRI:
7778 		if ((mctl->len < 0) || (pri != 0))
7779 			return (EINVAL);
7780 		break;
7781 	case MSG_BAND:
7782 		break;
7783 
7784 	default:
7785 		return (EINVAL);
7786 	}
7787 
7788 	TRACE_1(TR_FAC_STREAMS_FR, TR_STRPUTMSG_IN,
7789 	    "strputmsg in:stp %p", stp);
7790 
7791 	/* get these values from those cached in the stream head */
7792 	rmin = stp->sd_qn_minpsz;
7793 	rmax = stp->sd_qn_maxpsz;
7794 
7795 	/*
7796 	 * Make sure ctl and data sizes together fall within the
7797 	 * limits of the max and min receive packet sizes and do
7798 	 * not exceed system limit.
7799 	 */
7800 	ASSERT((rmax >= 0) || (rmax == INFPSZ));
7801 	if (rmax == 0) {
7802 		return (ERANGE);
7803 	}
7804 	/*
7805 	 * Use the MAXIMUM of sd_maxblk and q_maxpsz.
7806 	 * Needed to prevent partial failures in the strmakedata loop.
7807 	 */
7808 	if (stp->sd_maxblk != INFPSZ && rmax != INFPSZ && rmax < stp->sd_maxblk)
7809 		rmax = stp->sd_maxblk;
7810 
7811 	if ((msgsize = mdata->len) < 0) {
7812 		msgsize = 0;
7813 		rmin = 0;	/* no range check for NULL data part */
7814 	}
7815 	if ((msgsize < rmin) ||
7816 	    ((msgsize > rmax) && (rmax != INFPSZ)) ||
7817 	    (mctl->len > strctlsz)) {
7818 		return (ERANGE);
7819 	}
7820 
7821 	/*
7822 	 * Setup uio and iov for data part
7823 	 */
7824 	iovs.iov_base = mdata->buf;
7825 	iovs.iov_len = msgsize;
7826 	uios.uio_iov = &iovs;
7827 	uios.uio_iovcnt = 1;
7828 	uios.uio_loffset = 0;
7829 	uios.uio_segflg = UIO_USERSPACE;
7830 	uios.uio_fmode = fmode;
7831 	uios.uio_extflg = UIO_COPY_DEFAULT;
7832 	uios.uio_resid = msgsize;
7833 	uios.uio_offset = 0;
7834 
7835 	/* Ignore flow control in strput for HIPRI */
7836 	if (flag & MSG_HIPRI)
7837 		flag |= MSG_IGNFLOW;
7838 
7839 	for (;;) {
7840 		int done = 0;
7841 
7842 		/*
7843 		 * strput will always free the ctl mblk - even when strput
7844 		 * fails.
7845 		 */
7846 		if ((error = strmakectl(mctl, flag, fmode, &mp)) != 0) {
7847 			TRACE_3(TR_FAC_STREAMS_FR, TR_STRPUTMSG_OUT,
7848 			    "strputmsg out:stp %p out %d error %d",
7849 			    stp, 1, error);
7850 			return (error);
7851 		}
7852 		/*
7853 		 * Verify that the whole message can be transferred by
7854 		 * strput.
7855 		 */
7856 		ASSERT(stp->sd_maxblk == INFPSZ ||
7857 		    stp->sd_maxblk >= mdata->len);
7858 
7859 		msgsize = mdata->len;
7860 		error = strput(stp, mp, uiop, &msgsize, 0, pri, flag);
7861 		mdata->len = msgsize;
7862 
7863 		if (error == 0)
7864 			break;
7865 
7866 		if (error != EWOULDBLOCK)
7867 			goto out;
7868 
7869 		mutex_enter(&stp->sd_lock);
7870 		/*
7871 		 * Check for a missed wakeup.
7872 		 * Needed since strput did not hold sd_lock across
7873 		 * the canputnext.
7874 		 */
7875 		if (bcanputnext(wqp, pri)) {
7876 			/* Try again */
7877 			mutex_exit(&stp->sd_lock);
7878 			continue;
7879 		}
7880 		TRACE_2(TR_FAC_STREAMS_FR, TR_STRPUTMSG_WAIT,
7881 		    "strputmsg wait:stp %p waits pri %d", stp, pri);
7882 		if (((error = strwaitq(stp, WRITEWAIT, (ssize_t)0, fmode, -1,
7883 		    &done)) != 0) || done) {
7884 			mutex_exit(&stp->sd_lock);
7885 			TRACE_3(TR_FAC_STREAMS_FR, TR_STRPUTMSG_OUT,
7886 			    "strputmsg out:q %p out %d error %d",
7887 			    stp, 0, error);
7888 			return (error);
7889 		}
7890 		TRACE_1(TR_FAC_STREAMS_FR, TR_STRPUTMSG_WAKE,
7891 		    "strputmsg wake:stp %p wakes", stp);
7892 		if ((error = i_straccess(stp, JCWRITE)) != 0) {
7893 			mutex_exit(&stp->sd_lock);
7894 			return (error);
7895 		}
7896 		mutex_exit(&stp->sd_lock);
7897 	}
7898 out:
7899 	/*
7900 	 * For historic reasons, applications expect EAGAIN
7901 	 * when data mblk could not be allocated. so change
7902 	 * ENOMEM back to EAGAIN
7903 	 */
7904 	if (error == ENOMEM)
7905 		error = EAGAIN;
7906 	TRACE_3(TR_FAC_STREAMS_FR, TR_STRPUTMSG_OUT,
7907 	    "strputmsg out:stp %p out %d error %d", stp, 2, error);
7908 	return (error);
7909 }
7910 
7911 /*
7912  * Put a message downstream.
7913  * Can send only an M_PROTO/M_PCPROTO by passing in a NULL uiop.
7914  * The fmode flag (NDELAY, NONBLOCK) is the or of the flags in the uio
7915  * and the fmode parameter.
7916  *
7917  * This routine handles the consolidation private flags:
7918  *	MSG_IGNERROR	Ignore any stream head error except STPLEX.
7919  *	MSG_HOLDSIG	Hold signals while waiting for data.
7920  *	MSG_IGNFLOW	Don't check streams flow control.
7921  *
7922  * NOTE: strputmsg and kstrputmsg have much of the logic in common.
7923  */
7924 int
kstrputmsg(struct vnode * vp,mblk_t * mctl,struct uio * uiop,ssize_t msgsize,unsigned char pri,int flag,int fmode)7925 kstrputmsg(
7926 	struct vnode *vp,
7927 	mblk_t *mctl,
7928 	struct uio *uiop,
7929 	ssize_t msgsize,
7930 	unsigned char pri,
7931 	int flag,
7932 	int fmode)
7933 {
7934 	struct stdata *stp;
7935 	queue_t *wqp;
7936 	ssize_t rmin, rmax;
7937 	int error;
7938 
7939 	ASSERT(vp->v_stream);
7940 	stp = vp->v_stream;
7941 	wqp = stp->sd_wrq;
7942 	if (AU_AUDITING())
7943 		audit_strputmsg(vp, NULL, NULL, pri, flag, fmode);
7944 	if (mctl == NULL)
7945 		return (EINVAL);
7946 
7947 	mutex_enter(&stp->sd_lock);
7948 
7949 	if ((error = i_straccess(stp, JCWRITE)) != 0) {
7950 		mutex_exit(&stp->sd_lock);
7951 		freemsg(mctl);
7952 		return (error);
7953 	}
7954 
7955 	if ((stp->sd_flag & STPLEX) || !(flag & MSG_IGNERROR)) {
7956 		if (stp->sd_flag & (STWRERR|STRHUP|STPLEX)) {
7957 			error = strwriteable(stp, B_FALSE, B_TRUE);
7958 			if (error != 0) {
7959 				mutex_exit(&stp->sd_lock);
7960 				freemsg(mctl);
7961 				return (error);
7962 			}
7963 		}
7964 	}
7965 
7966 	mutex_exit(&stp->sd_lock);
7967 
7968 	/*
7969 	 * Check for legal flag value.
7970 	 */
7971 	switch (flag & (MSG_HIPRI|MSG_BAND|MSG_ANY)) {
7972 	case MSG_HIPRI:
7973 		if (pri != 0) {
7974 			freemsg(mctl);
7975 			return (EINVAL);
7976 		}
7977 		break;
7978 	case MSG_BAND:
7979 		break;
7980 	default:
7981 		freemsg(mctl);
7982 		return (EINVAL);
7983 	}
7984 
7985 	TRACE_1(TR_FAC_STREAMS_FR, TR_KSTRPUTMSG_IN,
7986 	    "kstrputmsg in:stp %p", stp);
7987 
7988 	/* get these values from those cached in the stream head */
7989 	rmin = stp->sd_qn_minpsz;
7990 	rmax = stp->sd_qn_maxpsz;
7991 
7992 	/*
7993 	 * Make sure ctl and data sizes together fall within the
7994 	 * limits of the max and min receive packet sizes and do
7995 	 * not exceed system limit.
7996 	 */
7997 	ASSERT((rmax >= 0) || (rmax == INFPSZ));
7998 	if (rmax == 0) {
7999 		freemsg(mctl);
8000 		return (ERANGE);
8001 	}
8002 	/*
8003 	 * Use the MAXIMUM of sd_maxblk and q_maxpsz.
8004 	 * Needed to prevent partial failures in the strmakedata loop.
8005 	 */
8006 	if (stp->sd_maxblk != INFPSZ && rmax != INFPSZ && rmax < stp->sd_maxblk)
8007 		rmax = stp->sd_maxblk;
8008 
8009 	if (uiop == NULL) {
8010 		msgsize = -1;
8011 		rmin = -1;	/* no range check for NULL data part */
8012 	} else {
8013 		/* Use uio flags as well as the fmode parameter flags */
8014 		fmode |= uiop->uio_fmode;
8015 
8016 		if ((msgsize < rmin) ||
8017 		    ((msgsize > rmax) && (rmax != INFPSZ))) {
8018 			freemsg(mctl);
8019 			return (ERANGE);
8020 		}
8021 	}
8022 
8023 	/* Ignore flow control in strput for HIPRI */
8024 	if (flag & MSG_HIPRI)
8025 		flag |= MSG_IGNFLOW;
8026 
8027 	for (;;) {
8028 		int done = 0;
8029 		int waitflag;
8030 		mblk_t *mp;
8031 
8032 		/*
8033 		 * strput will always free the ctl mblk - even when strput
8034 		 * fails. If MSG_IGNFLOW is set then any error returned
8035 		 * will cause us to break the loop, so we don't need a copy
8036 		 * of the message. If MSG_IGNFLOW is not set, then we can
8037 		 * get hit by flow control and be forced to try again. In
8038 		 * this case we need to have a copy of the message. We
8039 		 * do this using copymsg since the message may get modified
8040 		 * by something below us.
8041 		 *
8042 		 * We've observed that many TPI providers do not check db_ref
8043 		 * on the control messages but blindly reuse them for the
8044 		 * T_OK_ACK/T_ERROR_ACK. Thus using copymsg is more
8045 		 * friendly to such providers than using dupmsg. Also, note
8046 		 * that sockfs uses MSG_IGNFLOW for all TPI control messages.
8047 		 * Only data messages are subject to flow control, hence
8048 		 * subject to this copymsg.
8049 		 */
8050 		if (flag & MSG_IGNFLOW) {
8051 			mp = mctl;
8052 			mctl = NULL;
8053 		} else {
8054 			do {
8055 				/*
8056 				 * If a message has a free pointer, the message
8057 				 * must be dupmsg to maintain this pointer.
8058 				 * Code using this facility must be sure
8059 				 * that modules below will not change the
8060 				 * contents of the dblk without checking db_ref
8061 				 * first. If db_ref is > 1, then the module
8062 				 * needs to do a copymsg first. Otherwise,
8063 				 * the contents of the dblk may become
8064 				 * inconsistent because the freesmg/freeb below
8065 				 * may end up calling atomic_add_32_nv.
8066 				 * The atomic_add_32_nv in freeb (accessing
8067 				 * all of db_ref, db_type, db_flags, and
8068 				 * db_struioflag) does not prevent other threads
8069 				 * from concurrently trying to modify e.g.
8070 				 * db_type.
8071 				 */
8072 				if (mctl->b_datap->db_frtnp != NULL)
8073 					mp = dupmsg(mctl);
8074 				else
8075 					mp = copymsg(mctl);
8076 
8077 				if (mp != NULL)
8078 					break;
8079 
8080 				error = strwaitbuf(msgdsize(mctl), BPRI_MED);
8081 				if (error) {
8082 					freemsg(mctl);
8083 					return (error);
8084 				}
8085 			} while (mp == NULL);
8086 		}
8087 		/*
8088 		 * Verify that all of msgsize can be transferred by
8089 		 * strput.
8090 		 */
8091 		ASSERT(stp->sd_maxblk == INFPSZ || stp->sd_maxblk >= msgsize);
8092 		error = strput(stp, mp, uiop, &msgsize, 0, pri, flag);
8093 		if (error == 0)
8094 			break;
8095 
8096 		if (error != EWOULDBLOCK)
8097 			goto out;
8098 
8099 		/*
8100 		 * IF MSG_IGNFLOW is set we should have broken out of loop
8101 		 * above.
8102 		 */
8103 		ASSERT(!(flag & MSG_IGNFLOW));
8104 		mutex_enter(&stp->sd_lock);
8105 		/*
8106 		 * Check for a missed wakeup.
8107 		 * Needed since strput did not hold sd_lock across
8108 		 * the canputnext.
8109 		 */
8110 		if (bcanputnext(wqp, pri)) {
8111 			/* Try again */
8112 			mutex_exit(&stp->sd_lock);
8113 			continue;
8114 		}
8115 		TRACE_2(TR_FAC_STREAMS_FR, TR_KSTRPUTMSG_WAIT,
8116 		    "kstrputmsg wait:stp %p waits pri %d", stp, pri);
8117 
8118 		waitflag = WRITEWAIT;
8119 		if (flag & (MSG_HOLDSIG|MSG_IGNERROR)) {
8120 			if (flag & MSG_HOLDSIG)
8121 				waitflag |= STR_NOSIG;
8122 			if (flag & MSG_IGNERROR)
8123 				waitflag |= STR_NOERROR;
8124 		}
8125 		if (((error = strwaitq(stp, waitflag,
8126 		    (ssize_t)0, fmode, -1, &done)) != 0) || done) {
8127 			mutex_exit(&stp->sd_lock);
8128 			TRACE_3(TR_FAC_STREAMS_FR, TR_KSTRPUTMSG_OUT,
8129 			    "kstrputmsg out:stp %p out %d error %d",
8130 			    stp, 0, error);
8131 			freemsg(mctl);
8132 			return (error);
8133 		}
8134 		TRACE_1(TR_FAC_STREAMS_FR, TR_KSTRPUTMSG_WAKE,
8135 		    "kstrputmsg wake:stp %p wakes", stp);
8136 		if ((error = i_straccess(stp, JCWRITE)) != 0) {
8137 			mutex_exit(&stp->sd_lock);
8138 			freemsg(mctl);
8139 			return (error);
8140 		}
8141 		mutex_exit(&stp->sd_lock);
8142 	}
8143 out:
8144 	freemsg(mctl);
8145 	/*
8146 	 * For historic reasons, applications expect EAGAIN
8147 	 * when data mblk could not be allocated. so change
8148 	 * ENOMEM back to EAGAIN
8149 	 */
8150 	if (error == ENOMEM)
8151 		error = EAGAIN;
8152 	TRACE_3(TR_FAC_STREAMS_FR, TR_KSTRPUTMSG_OUT,
8153 	    "kstrputmsg out:stp %p out %d error %d", stp, 2, error);
8154 	return (error);
8155 }
8156 
8157 /*
8158  * Determines whether the necessary conditions are set on a stream
8159  * for it to be readable, writeable, or have exceptions.
8160  *
8161  * strpoll handles the consolidation private events:
8162  *	POLLNOERR	Do not return POLLERR even if there are stream
8163  *			head errors.
8164  *			Used by sockfs.
8165  *	POLLRDDATA	Do not return POLLIN unless at least one message on
8166  *			the queue contains one or more M_DATA mblks. Thus
8167  *			when this flag is set a queue with only
8168  *			M_PROTO/M_PCPROTO mblks does not return POLLIN.
8169  *			Used by sockfs to ignore T_EXDATA_IND messages.
8170  *
8171  * Note: POLLRDDATA assumes that synch streams only return messages with
8172  * an M_DATA attached (i.e. not messages consisting of only
8173  * an M_PROTO/M_PCPROTO part).
8174  */
8175 int
strpoll(struct stdata * stp,short events_arg,int anyyet,short * reventsp,struct pollhead ** phpp)8176 strpoll(
8177 	struct stdata *stp,
8178 	short events_arg,
8179 	int anyyet,
8180 	short *reventsp,
8181 	struct pollhead **phpp)
8182 {
8183 	int events = (ushort_t)events_arg;
8184 	int retevents = 0;
8185 	mblk_t *mp;
8186 	qband_t *qbp;
8187 	long sd_flags = stp->sd_flag;
8188 	int headlocked = 0;
8189 
8190 	/*
8191 	 * For performance, a single 'if' tests for most possible edge
8192 	 * conditions in one shot
8193 	 */
8194 	if (sd_flags & (STPLEX | STRDERR | STWRERR)) {
8195 		if (sd_flags & STPLEX) {
8196 			*reventsp = POLLNVAL;
8197 			return (EINVAL);
8198 		}
8199 		if (((events & (POLLIN | POLLRDNORM | POLLRDBAND | POLLPRI)) &&
8200 		    (sd_flags & STRDERR)) ||
8201 		    ((events & (POLLOUT | POLLWRNORM | POLLWRBAND)) &&
8202 		    (sd_flags & STWRERR))) {
8203 			if (!(events & POLLNOERR)) {
8204 				*reventsp = POLLERR;
8205 				return (0);
8206 			}
8207 		}
8208 	}
8209 	if (sd_flags & STRHUP) {
8210 		retevents |= POLLHUP;
8211 	} else if (events & (POLLWRNORM | POLLWRBAND)) {
8212 		queue_t *tq;
8213 		queue_t	*qp = stp->sd_wrq;
8214 
8215 		claimstr(qp);
8216 		/* Find next module forward that has a service procedure */
8217 		tq = qp->q_next->q_nfsrv;
8218 		ASSERT(tq != NULL);
8219 
8220 		polllock(&stp->sd_pollist, QLOCK(tq));
8221 		if (events & POLLWRNORM) {
8222 			queue_t *sqp;
8223 
8224 			if (tq->q_flag & QFULL)
8225 				/* ensure backq svc procedure runs */
8226 				tq->q_flag |= QWANTW;
8227 			else if ((sqp = stp->sd_struiowrq) != NULL) {
8228 				/* Check sync stream barrier write q */
8229 				mutex_exit(QLOCK(tq));
8230 				polllock(&stp->sd_pollist, QLOCK(sqp));
8231 				if (sqp->q_flag & QFULL)
8232 					/* ensure pollwakeup() is done */
8233 					sqp->q_flag |= QWANTWSYNC;
8234 				else
8235 					retevents |= POLLOUT;
8236 				/* More write events to process ??? */
8237 				if (! (events & POLLWRBAND)) {
8238 					mutex_exit(QLOCK(sqp));
8239 					releasestr(qp);
8240 					goto chkrd;
8241 				}
8242 				mutex_exit(QLOCK(sqp));
8243 				polllock(&stp->sd_pollist, QLOCK(tq));
8244 			} else
8245 				retevents |= POLLOUT;
8246 		}
8247 		if (events & POLLWRBAND) {
8248 			qbp = tq->q_bandp;
8249 			if (qbp) {
8250 				while (qbp) {
8251 					if (qbp->qb_flag & QB_FULL)
8252 						qbp->qb_flag |= QB_WANTW;
8253 					else
8254 						retevents |= POLLWRBAND;
8255 					qbp = qbp->qb_next;
8256 				}
8257 			} else {
8258 				retevents |= POLLWRBAND;
8259 			}
8260 		}
8261 		mutex_exit(QLOCK(tq));
8262 		releasestr(qp);
8263 	}
8264 chkrd:
8265 	if (sd_flags & STRPRI) {
8266 		retevents |= (events & POLLPRI);
8267 	} else if (events & (POLLRDNORM | POLLRDBAND | POLLIN)) {
8268 		queue_t	*qp = _RD(stp->sd_wrq);
8269 		int normevents = (events & (POLLIN | POLLRDNORM));
8270 
8271 		/*
8272 		 * Note: Need to do polllock() here since ps_lock may be
8273 		 * held. See bug 4191544.
8274 		 */
8275 		polllock(&stp->sd_pollist, &stp->sd_lock);
8276 		headlocked = 1;
8277 		mp = qp->q_first;
8278 		while (mp) {
8279 			/*
8280 			 * For POLLRDDATA we scan b_cont and b_next until we
8281 			 * find an M_DATA.
8282 			 */
8283 			if ((events & POLLRDDATA) &&
8284 			    mp->b_datap->db_type != M_DATA) {
8285 				mblk_t *nmp = mp->b_cont;
8286 
8287 				while (nmp != NULL &&
8288 				    nmp->b_datap->db_type != M_DATA)
8289 					nmp = nmp->b_cont;
8290 				if (nmp == NULL) {
8291 					mp = mp->b_next;
8292 					continue;
8293 				}
8294 			}
8295 			if (mp->b_band == 0)
8296 				retevents |= normevents;
8297 			else
8298 				retevents |= (events & (POLLIN | POLLRDBAND));
8299 			break;
8300 		}
8301 		if (! (retevents & normevents) &&
8302 		    (stp->sd_wakeq & RSLEEP)) {
8303 			/*
8304 			 * Sync stream barrier read queue has data.
8305 			 */
8306 			retevents |= normevents;
8307 		}
8308 		/* Treat eof as normal data */
8309 		if (sd_flags & STREOF)
8310 			retevents |= normevents;
8311 	}
8312 
8313 	*reventsp = (short)retevents;
8314 	if (retevents) {
8315 		if (headlocked)
8316 			mutex_exit(&stp->sd_lock);
8317 		return (0);
8318 	}
8319 
8320 	/*
8321 	 * If poll() has not found any events yet, set up event cell
8322 	 * to wake up the poll if a requested event occurs on this
8323 	 * stream.  Check for collisions with outstanding poll requests.
8324 	 */
8325 	if (!anyyet) {
8326 		*phpp = &stp->sd_pollist;
8327 		if (headlocked == 0) {
8328 			polllock(&stp->sd_pollist, &stp->sd_lock);
8329 			headlocked = 1;
8330 		}
8331 		stp->sd_rput_opt |= SR_POLLIN;
8332 	}
8333 	if (headlocked)
8334 		mutex_exit(&stp->sd_lock);
8335 	return (0);
8336 }
8337 
8338 /*
8339  * The purpose of putback() is to assure sleeping polls/reads
8340  * are awakened when there are no new messages arriving at the,
8341  * stream head, and a message is placed back on the read queue.
8342  *
8343  * sd_lock must be held when messages are placed back on stream
8344  * head.  (getq() holds sd_lock when it removes messages from
8345  * the queue)
8346  */
8347 
8348 static void
putback(struct stdata * stp,queue_t * q,mblk_t * bp,int band)8349 putback(struct stdata *stp, queue_t *q, mblk_t *bp, int band)
8350 {
8351 	mblk_t	*qfirst;
8352 	ASSERT(MUTEX_HELD(&stp->sd_lock));
8353 
8354 	/*
8355 	 * As a result of lock-step ordering around q_lock and sd_lock,
8356 	 * it's possible for function calls like putnext() and
8357 	 * canputnext() to get an inaccurate picture of how much
8358 	 * data is really being processed at the stream head.
8359 	 * We only consolidate with existing messages on the queue
8360 	 * if the length of the message we want to put back is smaller
8361 	 * than the queue hiwater mark.
8362 	 */
8363 	if ((stp->sd_rput_opt & SR_CONSOL_DATA) &&
8364 	    (DB_TYPE(bp) == M_DATA) && ((qfirst = q->q_first) != NULL) &&
8365 	    (DB_TYPE(qfirst) == M_DATA) &&
8366 	    ((qfirst->b_flag & (MSGMARK|MSGDELIM)) == 0) &&
8367 	    ((bp->b_flag & (MSGMARK|MSGDELIM|MSGMARKNEXT)) == 0) &&
8368 	    (mp_cont_len(bp, NULL) < q->q_hiwat)) {
8369 		/*
8370 		 * We use the same logic as defined in strrput()
8371 		 * but in reverse as we are putting back onto the
8372 		 * queue and want to retain byte ordering.
8373 		 * Consolidate M_DATA messages with M_DATA ONLY.
8374 		 * strrput() allows the consolidation of M_DATA onto
8375 		 * M_PROTO | M_PCPROTO but not the other way round.
8376 		 *
8377 		 * The consolidation does not take place if the message
8378 		 * we are returning to the queue is marked with either
8379 		 * of the marks or the delim flag or if q_first
8380 		 * is marked with MSGMARK. The MSGMARK check is needed to
8381 		 * handle the odd semantics of MSGMARK where essentially
8382 		 * the whole message is to be treated as marked.
8383 		 * Carry any MSGMARKNEXT and MSGNOTMARKNEXT from q_first
8384 		 * to the front of the b_cont chain.
8385 		 */
8386 		rmvq_noenab(q, qfirst);
8387 
8388 		/*
8389 		 * The first message in the b_cont list
8390 		 * tracks MSGMARKNEXT and MSGNOTMARKNEXT.
8391 		 * We need to handle the case where we
8392 		 * are appending:
8393 		 *
8394 		 * 1) a MSGMARKNEXT to a MSGNOTMARKNEXT.
8395 		 * 2) a MSGMARKNEXT to a plain message.
8396 		 * 3) a MSGNOTMARKNEXT to a plain message
8397 		 * 4) a MSGNOTMARKNEXT to a MSGNOTMARKNEXT
8398 		 *    message.
8399 		 *
8400 		 * Thus we never append a MSGMARKNEXT or
8401 		 * MSGNOTMARKNEXT to a MSGMARKNEXT message.
8402 		 */
8403 		if (qfirst->b_flag & MSGMARKNEXT) {
8404 			bp->b_flag |= MSGMARKNEXT;
8405 			bp->b_flag &= ~MSGNOTMARKNEXT;
8406 			qfirst->b_flag &= ~MSGMARKNEXT;
8407 		} else if (qfirst->b_flag & MSGNOTMARKNEXT) {
8408 			bp->b_flag |= MSGNOTMARKNEXT;
8409 			qfirst->b_flag &= ~MSGNOTMARKNEXT;
8410 		}
8411 
8412 		linkb(bp, qfirst);
8413 	}
8414 	(void) putbq(q, bp);
8415 
8416 	/*
8417 	 * A message may have come in when the sd_lock was dropped in the
8418 	 * calling routine. If this is the case and STR*ATMARK info was
8419 	 * received, need to move that from the stream head to the q_last
8420 	 * so that SIOCATMARK can return the proper value.
8421 	 */
8422 	if (stp->sd_flag & (STRATMARK | STRNOTATMARK)) {
8423 		unsigned short *flagp = &q->q_last->b_flag;
8424 		uint_t b_flag = (uint_t)*flagp;
8425 
8426 		if (stp->sd_flag & STRATMARK) {
8427 			b_flag &= ~MSGNOTMARKNEXT;
8428 			b_flag |= MSGMARKNEXT;
8429 			stp->sd_flag &= ~STRATMARK;
8430 		} else {
8431 			b_flag &= ~MSGMARKNEXT;
8432 			b_flag |= MSGNOTMARKNEXT;
8433 			stp->sd_flag &= ~STRNOTATMARK;
8434 		}
8435 		*flagp = (unsigned short) b_flag;
8436 	}
8437 
8438 #ifdef	DEBUG
8439 	/*
8440 	 * Make sure that the flags are not messed up.
8441 	 */
8442 	{
8443 		mblk_t *mp;
8444 		mp = q->q_last;
8445 		while (mp != NULL) {
8446 			ASSERT((mp->b_flag & (MSGMARKNEXT|MSGNOTMARKNEXT)) !=
8447 			    (MSGMARKNEXT|MSGNOTMARKNEXT));
8448 			mp = mp->b_cont;
8449 		}
8450 	}
8451 #endif
8452 	if (q->q_first == bp) {
8453 		short pollevents;
8454 
8455 		if (stp->sd_flag & RSLEEP) {
8456 			stp->sd_flag &= ~RSLEEP;
8457 			cv_broadcast(&q->q_wait);
8458 		}
8459 		if (stp->sd_flag & STRPRI) {
8460 			pollevents = POLLPRI;
8461 		} else {
8462 			if (band == 0) {
8463 				if (!(stp->sd_rput_opt & SR_POLLIN))
8464 					return;
8465 				stp->sd_rput_opt &= ~SR_POLLIN;
8466 				pollevents = POLLIN | POLLRDNORM;
8467 			} else {
8468 				pollevents = POLLIN | POLLRDBAND;
8469 			}
8470 		}
8471 		mutex_exit(&stp->sd_lock);
8472 		pollwakeup(&stp->sd_pollist, pollevents);
8473 		mutex_enter(&stp->sd_lock);
8474 	}
8475 }
8476 
8477 /*
8478  * Return the held vnode attached to the stream head of a
8479  * given queue
8480  * It is the responsibility of the calling routine to ensure
8481  * that the queue does not go away (e.g. pop).
8482  */
8483 vnode_t *
strq2vp(queue_t * qp)8484 strq2vp(queue_t *qp)
8485 {
8486 	vnode_t *vp;
8487 	vp = STREAM(qp)->sd_vnode;
8488 	ASSERT(vp != NULL);
8489 	VN_HOLD(vp);
8490 	return (vp);
8491 }
8492 
8493 /*
8494  * return the stream head write queue for the given vp
8495  * It is the responsibility of the calling routine to ensure
8496  * that the stream or vnode do not close.
8497  */
8498 queue_t *
strvp2wq(vnode_t * vp)8499 strvp2wq(vnode_t *vp)
8500 {
8501 	ASSERT(vp->v_stream != NULL);
8502 	return (vp->v_stream->sd_wrq);
8503 }
8504 
8505 /*
8506  * pollwakeup stream head
8507  * It is the responsibility of the calling routine to ensure
8508  * that the stream or vnode do not close.
8509  */
8510 void
strpollwakeup(vnode_t * vp,short event)8511 strpollwakeup(vnode_t *vp, short event)
8512 {
8513 	ASSERT(vp->v_stream);
8514 	pollwakeup(&vp->v_stream->sd_pollist, event);
8515 }
8516 
8517 /*
8518  * Mate the stream heads of two vnodes together. If the two vnodes are the
8519  * same, we just make the write-side point at the read-side -- otherwise,
8520  * we do a full mate.  Only works on vnodes associated with streams that are
8521  * still being built and thus have only a stream head.
8522  */
8523 void
strmate(vnode_t * vp1,vnode_t * vp2)8524 strmate(vnode_t *vp1, vnode_t *vp2)
8525 {
8526 	queue_t *wrq1 = strvp2wq(vp1);
8527 	queue_t *wrq2 = strvp2wq(vp2);
8528 
8529 	/*
8530 	 * Verify that there are no modules on the stream yet.  We also
8531 	 * rely on the stream head always having a service procedure to
8532 	 * avoid tweaking q_nfsrv.
8533 	 */
8534 	ASSERT(wrq1->q_next == NULL && wrq2->q_next == NULL);
8535 	ASSERT(wrq1->q_qinfo->qi_srvp != NULL);
8536 	ASSERT(wrq2->q_qinfo->qi_srvp != NULL);
8537 
8538 	/*
8539 	 * If the queues are the same, just twist; otherwise do a full mate.
8540 	 */
8541 	if (wrq1 == wrq2) {
8542 		wrq1->q_next = _RD(wrq1);
8543 	} else {
8544 		wrq1->q_next = _RD(wrq2);
8545 		wrq2->q_next = _RD(wrq1);
8546 		STREAM(wrq1)->sd_mate = STREAM(wrq2);
8547 		STREAM(wrq1)->sd_flag |= STRMATE;
8548 		STREAM(wrq2)->sd_mate = STREAM(wrq1);
8549 		STREAM(wrq2)->sd_flag |= STRMATE;
8550 	}
8551 }
8552 
8553 /*
8554  * XXX will go away when console is correctly fixed.
8555  * Clean up the console PIDS, from previous I_SETSIG,
8556  * called only for cnopen which never calls strclean().
8557  */
8558 void
str_cn_clean(struct vnode * vp)8559 str_cn_clean(struct vnode *vp)
8560 {
8561 	strsig_t *ssp, *pssp, *tssp;
8562 	struct stdata *stp;
8563 	struct pid  *pidp;
8564 	int update = 0;
8565 
8566 	ASSERT(vp->v_stream);
8567 	stp = vp->v_stream;
8568 	pssp = NULL;
8569 	mutex_enter(&stp->sd_lock);
8570 	ssp = stp->sd_siglist;
8571 	while (ssp) {
8572 		mutex_enter(&pidlock);
8573 		pidp = ssp->ss_pidp;
8574 		/*
8575 		 * Get rid of PID if the proc is gone.
8576 		 */
8577 		if (pidp->pid_prinactive) {
8578 			tssp = ssp->ss_next;
8579 			if (pssp)
8580 				pssp->ss_next = tssp;
8581 			else
8582 				stp->sd_siglist = tssp;
8583 			ASSERT(pidp->pid_ref <= 1);
8584 			PID_RELE(ssp->ss_pidp);
8585 			mutex_exit(&pidlock);
8586 			kmem_free(ssp, sizeof (strsig_t));
8587 			update = 1;
8588 			ssp = tssp;
8589 			continue;
8590 		} else
8591 			mutex_exit(&pidlock);
8592 		pssp = ssp;
8593 		ssp = ssp->ss_next;
8594 	}
8595 	if (update) {
8596 		stp->sd_sigflags = 0;
8597 		for (ssp = stp->sd_siglist; ssp; ssp = ssp->ss_next)
8598 			stp->sd_sigflags |= ssp->ss_events;
8599 	}
8600 	mutex_exit(&stp->sd_lock);
8601 }
8602 
8603 /*
8604  * Return B_TRUE if there is data in the message, B_FALSE otherwise.
8605  */
8606 static boolean_t
msghasdata(mblk_t * bp)8607 msghasdata(mblk_t *bp)
8608 {
8609 	for (; bp; bp = bp->b_cont)
8610 		if (bp->b_datap->db_type == M_DATA) {
8611 			ASSERT(bp->b_wptr >= bp->b_rptr);
8612 			if (bp->b_wptr > bp->b_rptr)
8613 				return (B_TRUE);
8614 		}
8615 	return (B_FALSE);
8616 }
8617