1 /*
   2  * CDDL HEADER START
   3  *
   4  * The contents of this file are subject to the terms of the
   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21 /*      Copyright (c) 1984, 1986, 1987, 1988, 1989 AT&T     */
  22 /*        All Rights Reserved   */
  23 
  24 
  25 /*
  26  * Copyright (c) 1988, 2010, Oracle and/or its affiliates. All rights reserved.
  27  */
  28 
  29 #include <sys/types.h>
  30 #include <sys/sysmacros.h>
  31 #include <sys/param.h>
  32 #include <sys/errno.h>
  33 #include <sys/signal.h>
  34 #include <sys/stat.h>
  35 #include <sys/proc.h>
  36 #include <sys/cred.h>
  37 #include <sys/user.h>
  38 #include <sys/vnode.h>
  39 #include <sys/file.h>
  40 #include <sys/stream.h>
  41 #include <sys/strsubr.h>
  42 #include <sys/stropts.h>
  43 #include <sys/tihdr.h>
  44 #include <sys/var.h>
  45 #include <sys/poll.h>
  46 #include <sys/termio.h>
  47 #include <sys/ttold.h>
  48 #include <sys/systm.h>
  49 #include <sys/uio.h>
  50 #include <sys/cmn_err.h>
  51 #include <sys/sad.h>
  52 #include <sys/netstack.h>
  53 #include <sys/priocntl.h>
  54 #include <sys/jioctl.h>
  55 #include <sys/procset.h>
  56 #include <sys/session.h>
  57 #include <sys/kmem.h>
  58 #include <sys/filio.h>
  59 #include <sys/vtrace.h>
  60 #include <sys/debug.h>
  61 #include <sys/strredir.h>
  62 #include <sys/fs/fifonode.h>
  63 #include <sys/fs/snode.h>
  64 #include <sys/strlog.h>
  65 #include <sys/strsun.h>
  66 #include <sys/project.h>
  67 #include <sys/kbio.h>
  68 #include <sys/msio.h>
  69 #include <sys/tty.h>
  70 #include <sys/ptyvar.h>
  71 #include <sys/vuid_event.h>
  72 #include <sys/modctl.h>
  73 #include <sys/sunddi.h>
  74 #include <sys/sunldi_impl.h>
  75 #include <sys/autoconf.h>
  76 #include <sys/policy.h>
  77 #include <sys/dld.h>
  78 #include <sys/zone.h>
  79 #include <c2/audit.h>
  80 
  81 /*
  82  * This define helps improve the readability of streams code while
  83  * still maintaining a very old streams performance enhancement.  The
  84  * performance enhancement basically involved having all callers
  85  * of straccess() perform the first check that straccess() will do
  86  * locally before actually calling straccess().  (There by reducing
  87  * the number of unnecessary calls to straccess().)
  88  */
  89 #define i_straccess(x, y)       ((stp->sd_sidp == NULL) ? 0 : \
  90                                     (stp->sd_vnode->v_type == VFIFO) ? 0 : \
  91                                     straccess((x), (y)))
  92 
  93 /*
  94  * what is mblk_pull_len?
  95  *
  96  * If a streams message consists of many short messages,
  97  * a performance degradation occurs from copyout overhead.
  98  * To decrease the per mblk overhead, messages that are
  99  * likely to consist of many small mblks are pulled up into
 100  * one continuous chunk of memory.
 101  *
 102  * To avoid the processing overhead of examining every
 103  * mblk, a quick heuristic is used. If the first mblk in
 104  * the message is shorter than mblk_pull_len, it is likely
 105  * that the rest of the mblk will be short.
 106  *
 107  * This heuristic was decided upon after performance tests
 108  * indicated that anything more complex slowed down the main
 109  * code path.
 110  */
 111 #define MBLK_PULL_LEN 64
 112 uint32_t mblk_pull_len = MBLK_PULL_LEN;
 113 
 114 /*
 115  * The sgttyb_handling flag controls the handling of the old BSD
 116  * TIOCGETP, TIOCSETP, and TIOCSETN ioctls as follows:
 117  *
 118  * 0 - Emit no warnings at all and retain old, broken behavior.
 119  * 1 - Emit no warnings and silently handle new semantics.
 120  * 2 - Send cmn_err(CE_NOTE) when either TIOCSETP or TIOCSETN is used
 121  *     (once per system invocation).  Handle with new semantics.
 122  * 3 - Send SIGSYS when any TIOCGETP, TIOCSETP, or TIOCSETN call is
 123  *     made (so that offenders drop core and are easy to debug).
 124  *
 125  * The "new semantics" are that TIOCGETP returns B38400 for
 126  * sg_[io]speed if the corresponding value is over B38400, and that
 127  * TIOCSET[PN] accept B38400 in these cases to mean "retain current
 128  * bit rate."
 129  */
 130 int sgttyb_handling = 1;
 131 static boolean_t sgttyb_complaint;
 132 
 133 /* don't push drcompat module by default on Style-2 streams */
 134 static int push_drcompat = 0;
 135 
 136 /*
 137  * id value used to distinguish between different ioctl messages
 138  */
 139 static uint32_t ioc_id;
 140 
 141 static void putback(struct stdata *, queue_t *, mblk_t *, int);
 142 static void strcleanall(struct vnode *);
 143 static int strwsrv(queue_t *);
 144 static int strdocmd(struct stdata *, struct strcmd *, cred_t *);
 145 
 146 /*
 147  * qinit and module_info structures for stream head read and write queues
 148  */
 149 struct module_info strm_info = { 0, "strrhead", 0, INFPSZ, STRHIGH, STRLOW };
 150 struct module_info stwm_info = { 0, "strwhead", 0, 0, 0, 0 };
 151 struct qinit strdata = { strrput, NULL, NULL, NULL, NULL, &strm_info };
 152 struct qinit stwdata = { NULL, strwsrv, NULL, NULL, NULL, &stwm_info };
 153 struct module_info fiform_info = { 0, "fifostrrhead", 0, PIPE_BUF, FIFOHIWAT,
 154     FIFOLOWAT };
 155 struct module_info fifowm_info = { 0, "fifostrwhead", 0, 0, 0, 0 };
 156 struct qinit fifo_strdata = { strrput, NULL, NULL, NULL, NULL, &fiform_info };
 157 struct qinit fifo_stwdata = { NULL, strwsrv, NULL, NULL, NULL, &fifowm_info };
 158 
 159 extern kmutex_t strresources;   /* protects global resources */
 160 extern kmutex_t muxifier;       /* single-threads multiplexor creation */
 161 
 162 static boolean_t msghasdata(mblk_t *bp);
 163 #define msgnodata(bp) (!msghasdata(bp))
 164 
 165 /*
 166  * Stream head locking notes:
 167  *      There are four monitors associated with the stream head:
 168  *      1. v_stream monitor: in stropen() and strclose() v_lock
 169  *              is held while the association of vnode and stream
 170  *              head is established or tested for.
 171  *      2. open/close/push/pop monitor: sd_lock is held while each
 172  *              thread bids for exclusive access to this monitor
 173  *              for opening or closing a stream.  In addition, this
 174  *              monitor is entered during pushes and pops.  This
 175  *              guarantees that during plumbing operations there
 176  *              is only one thread trying to change the plumbing.
 177  *              Any other threads present in the stream are only
 178  *              using the plumbing.
 179  *      3. read/write monitor: in the case of read, a thread holds
 180  *              sd_lock while trying to get data from the stream
 181  *              head queue.  if there is none to fulfill a read
 182  *              request, it sets RSLEEP and calls cv_wait_sig() down
 183  *              in strwaitq() to await the arrival of new data.
 184  *              when new data arrives in strrput(), sd_lock is acquired
 185  *              before testing for RSLEEP and calling cv_broadcast().
 186  *              the behavior of strwrite(), strwsrv(), and WSLEEP
 187  *              mirror this.
 188  *      4. ioctl monitor: sd_lock is gotten to ensure that only one
 189  *              thread is doing an ioctl at a time.
 190  */
 191 
 192 static int
 193 push_mod(queue_t *qp, dev_t *devp, struct stdata *stp, const char *name,
 194     int anchor, cred_t *crp, uint_t anchor_zoneid)
 195 {
 196         int error;
 197         fmodsw_impl_t *fp;
 198 
 199         if (stp->sd_flag & (STRHUP|STRDERR|STWRERR)) {
 200                 error = (stp->sd_flag & STRHUP) ? ENXIO : EIO;
 201                 return (error);
 202         }
 203         if (stp->sd_pushcnt >= nstrpush) {
 204                 return (EINVAL);
 205         }
 206 
 207         if ((fp = fmodsw_find(name, FMODSW_HOLD | FMODSW_LOAD)) == NULL) {
 208                 stp->sd_flag |= STREOPENFAIL;
 209                 return (EINVAL);
 210         }
 211 
 212         /*
 213          * push new module and call its open routine via qattach
 214          */
 215         if ((error = qattach(qp, devp, 0, crp, fp, B_FALSE)) != 0)
 216                 return (error);
 217 
 218         /*
 219          * Check to see if caller wants a STREAMS anchor
 220          * put at this place in the stream, and add if so.
 221          */
 222         mutex_enter(&stp->sd_lock);
 223         if (anchor == stp->sd_pushcnt) {
 224                 stp->sd_anchor = stp->sd_pushcnt;
 225                 stp->sd_anchorzone = anchor_zoneid;
 226         }
 227         mutex_exit(&stp->sd_lock);
 228 
 229         return (0);
 230 }
 231 
 232 /*
 233  * Open a stream device.
 234  */
 235 int
 236 stropen(vnode_t *vp, dev_t *devp, int flag, cred_t *crp)
 237 {
 238         struct stdata *stp;
 239         queue_t *qp;
 240         int s;
 241         dev_t dummydev, savedev;
 242         struct autopush *ap;
 243         struct dlautopush dlap;
 244         int error = 0;
 245         ssize_t rmin, rmax;
 246         int cloneopen;
 247         queue_t *brq;
 248         major_t major;
 249         str_stack_t *ss;
 250         zoneid_t zoneid;
 251         uint_t anchor;
 252 
 253         /*
 254          * If the stream already exists, wait for any open in progress
 255          * to complete, then call the open function of each module and
 256          * driver in the stream.  Otherwise create the stream.
 257          */
 258         TRACE_1(TR_FAC_STREAMS_FR, TR_STROPEN, "stropen:%p", vp);
 259 retry:
 260         mutex_enter(&vp->v_lock);
 261         if ((stp = vp->v_stream) != NULL) {
 262 
 263                 /*
 264                  * Waiting for stream to be created to device
 265                  * due to another open.
 266                  */
 267                 mutex_exit(&vp->v_lock);
 268 
 269                 if (STRMATED(stp)) {
 270                         struct stdata *strmatep = stp->sd_mate;
 271 
 272                         STRLOCKMATES(stp);
 273                         if (strmatep->sd_flag & (STWOPEN|STRCLOSE|STRPLUMB)) {
 274                                 if (flag & (FNDELAY|FNONBLOCK)) {
 275                                         error = EAGAIN;
 276                                         mutex_exit(&strmatep->sd_lock);
 277                                         goto ckreturn;
 278                                 }
 279                                 mutex_exit(&stp->sd_lock);
 280                                 if (!cv_wait_sig(&strmatep->sd_monitor,
 281                                     &strmatep->sd_lock)) {
 282                                         error = EINTR;
 283                                         mutex_exit(&strmatep->sd_lock);
 284                                         mutex_enter(&stp->sd_lock);
 285                                         goto ckreturn;
 286                                 }
 287                                 mutex_exit(&strmatep->sd_lock);
 288                                 goto retry;
 289                         }
 290                         if (stp->sd_flag & (STWOPEN|STRCLOSE|STRPLUMB)) {
 291                                 if (flag & (FNDELAY|FNONBLOCK)) {
 292                                         error = EAGAIN;
 293                                         mutex_exit(&strmatep->sd_lock);
 294                                         goto ckreturn;
 295                                 }
 296                                 mutex_exit(&strmatep->sd_lock);
 297                                 if (!cv_wait_sig(&stp->sd_monitor,
 298                                     &stp->sd_lock)) {
 299                                         error = EINTR;
 300                                         goto ckreturn;
 301                                 }
 302                                 mutex_exit(&stp->sd_lock);
 303                                 goto retry;
 304                         }
 305 
 306                         if (stp->sd_flag & (STRDERR|STWRERR)) {
 307                                 error = EIO;
 308                                 mutex_exit(&strmatep->sd_lock);
 309                                 goto ckreturn;
 310                         }
 311 
 312                         stp->sd_flag |= STWOPEN;
 313                         STRUNLOCKMATES(stp);
 314                 } else {
 315                         mutex_enter(&stp->sd_lock);
 316                         if (stp->sd_flag & (STWOPEN|STRCLOSE|STRPLUMB)) {
 317                                 if (flag & (FNDELAY|FNONBLOCK)) {
 318                                         error = EAGAIN;
 319                                         goto ckreturn;
 320                                 }
 321                                 if (!cv_wait_sig(&stp->sd_monitor,
 322                                     &stp->sd_lock)) {
 323                                         error = EINTR;
 324                                         goto ckreturn;
 325                                 }
 326                                 mutex_exit(&stp->sd_lock);
 327                                 goto retry;  /* could be clone! */
 328                         }
 329 
 330                         if (stp->sd_flag & (STRDERR|STWRERR)) {
 331                                 error = EIO;
 332                                 goto ckreturn;
 333                         }
 334 
 335                         stp->sd_flag |= STWOPEN;
 336                         mutex_exit(&stp->sd_lock);
 337                 }
 338 
 339                 /*
 340                  * Open all modules and devices down stream to notify
 341                  * that another user is streaming.  For modules, set the
 342                  * last argument to MODOPEN and do not pass any open flags.
 343                  * Ignore dummydev since this is not the first open.
 344                  */
 345                 claimstr(stp->sd_wrq);
 346                 qp = stp->sd_wrq;
 347                 while (_SAMESTR(qp)) {
 348                         qp = qp->q_next;
 349                         if ((error = qreopen(_RD(qp), devp, flag, crp)) != 0)
 350                                 break;
 351                 }
 352                 releasestr(stp->sd_wrq);
 353                 mutex_enter(&stp->sd_lock);
 354                 stp->sd_flag &= ~(STRHUP|STWOPEN|STRDERR|STWRERR);
 355                 stp->sd_rerror = 0;
 356                 stp->sd_werror = 0;
 357 ckreturn:
 358                 cv_broadcast(&stp->sd_monitor);
 359                 mutex_exit(&stp->sd_lock);
 360                 return (error);
 361         }
 362 
 363         /*
 364          * This vnode isn't streaming.  SPECFS already
 365          * checked for multiple vnodes pointing to the
 366          * same stream, so create a stream to the driver.
 367          */
 368         qp = allocq();
 369         stp = shalloc(qp);
 370 
 371         /*
 372          * Initialize stream head.  shalloc() has given us
 373          * exclusive access, and we have the vnode locked;
 374          * we can do whatever we want with stp.
 375          */
 376         stp->sd_flag = STWOPEN;
 377         stp->sd_siglist = NULL;
 378         stp->sd_pollist.ph_list = NULL;
 379         stp->sd_sigflags = 0;
 380         stp->sd_mark = NULL;
 381         stp->sd_closetime = STRTIMOUT;
 382         stp->sd_sidp = NULL;
 383         stp->sd_pgidp = NULL;
 384         stp->sd_vnode = vp;
 385         stp->sd_rerror = 0;
 386         stp->sd_werror = 0;
 387         stp->sd_wroff = 0;
 388         stp->sd_tail = 0;
 389         stp->sd_iocblk = NULL;
 390         stp->sd_cmdblk = NULL;
 391         stp->sd_pushcnt = 0;
 392         stp->sd_qn_minpsz = 0;
 393         stp->sd_qn_maxpsz = INFPSZ - 1;      /* used to check for initialization */
 394         stp->sd_maxblk = INFPSZ;
 395         qp->q_ptr = _WR(qp)->q_ptr = stp;
 396         STREAM(qp) = STREAM(_WR(qp)) = stp;
 397         vp->v_stream = stp;
 398         mutex_exit(&vp->v_lock);
 399         if (vp->v_type == VFIFO) {
 400                 stp->sd_flag |= OLDNDELAY;
 401                 /*
 402                  * This means, both for pipes and fifos
 403                  * strwrite will send SIGPIPE if the other
 404                  * end is closed. For putmsg it depends
 405                  * on whether it is a XPG4_2 application
 406                  * or not
 407                  */
 408                 stp->sd_wput_opt = SW_SIGPIPE;
 409 
 410                 /* setq might sleep in kmem_alloc - avoid holding locks. */
 411                 setq(qp, &fifo_strdata, &fifo_stwdata, NULL, QMTSAFE,
 412                     SQ_CI|SQ_CO, B_FALSE);
 413 
 414                 set_qend(qp);
 415                 stp->sd_strtab = fifo_getinfo();
 416                 _WR(qp)->q_nfsrv = _WR(qp);
 417                 qp->q_nfsrv = qp;
 418                 /*
 419                  * Wake up others that are waiting for stream to be created.
 420                  */
 421                 mutex_enter(&stp->sd_lock);
 422                 /*
 423                  * nothing is be pushed on stream yet, so
 424                  * optimized stream head packetsizes are just that
 425                  * of the read queue
 426                  */
 427                 stp->sd_qn_minpsz = qp->q_minpsz;
 428                 stp->sd_qn_maxpsz = qp->q_maxpsz;
 429                 stp->sd_flag &= ~STWOPEN;
 430                 goto fifo_opendone;
 431         }
 432         /* setq might sleep in kmem_alloc - avoid holding locks. */
 433         setq(qp, &strdata, &stwdata, NULL, QMTSAFE, SQ_CI|SQ_CO, B_FALSE);
 434 
 435         set_qend(qp);
 436 
 437         /*
 438          * Open driver and create stream to it (via qattach).
 439          */
 440         savedev = *devp;
 441         cloneopen = (getmajor(*devp) == clone_major);
 442         if ((error = qattach(qp, devp, flag, crp, NULL, B_FALSE)) != 0) {
 443                 mutex_enter(&vp->v_lock);
 444                 vp->v_stream = NULL;
 445                 mutex_exit(&vp->v_lock);
 446                 mutex_enter(&stp->sd_lock);
 447                 cv_broadcast(&stp->sd_monitor);
 448                 mutex_exit(&stp->sd_lock);
 449                 freeq(_RD(qp));
 450                 shfree(stp);
 451                 return (error);
 452         }
 453         /*
 454          * Set sd_strtab after open in order to handle clonable drivers
 455          */
 456         stp->sd_strtab = STREAMSTAB(getmajor(*devp));
 457 
 458         /*
 459          * Historical note: dummydev used to be be prior to the initial
 460          * open (via qattach above), which made the value seen
 461          * inconsistent between an I_PUSH and an autopush of a module.
 462          */
 463         dummydev = *devp;
 464 
 465         /*
 466          * For clone open of old style (Q not associated) network driver,
 467          * push DRMODNAME module to handle DL_ATTACH/DL_DETACH
 468          */
 469         brq = _RD(_WR(qp)->q_next);
 470         major = getmajor(*devp);
 471         if (push_drcompat && cloneopen && NETWORK_DRV(major) &&
 472             ((brq->q_flag & _QASSOCIATED) == 0)) {
 473                 if (push_mod(qp, &dummydev, stp, DRMODNAME, 0, crp, 0) != 0)
 474                         cmn_err(CE_WARN, "cannot push " DRMODNAME
 475                             " streams module");
 476         }
 477 
 478         if (!NETWORK_DRV(major)) {
 479                 savedev = *devp;
 480         } else {
 481                 /*
 482                  * For network devices, process differently based on the
 483                  * return value from dld_autopush():
 484                  *
 485                  *   0: the passed-in device points to a GLDv3 datalink with
 486                  *   per-link autopush configuration; use that configuration
 487                  *   and ignore any per-driver autopush configuration.
 488                  *
 489                  *   1: the passed-in device points to a physical GLDv3
 490                  *   datalink without per-link autopush configuration.  The
 491                  *   passed in device was changed to refer to the actual
 492                  *   physical device (if it's not already); we use that new
 493                  *   device to look up any per-driver autopush configuration.
 494                  *
 495                  *   -1: neither of the above cases applied; use the initial
 496                  *   device to look up any per-driver autopush configuration.
 497                  */
 498                 switch (dld_autopush(&savedev, &dlap)) {
 499                 case 0:
 500                         zoneid = crgetzoneid(crp);
 501                         for (s = 0; s < dlap.dap_npush; s++) {
 502                                 error = push_mod(qp, &dummydev, stp,
 503                                     dlap.dap_aplist[s], dlap.dap_anchor, crp,
 504                                     zoneid);
 505                                 if (error != 0)
 506                                         break;
 507                         }
 508                         goto opendone;
 509                 case 1:
 510                         break;
 511                 case -1:
 512                         savedev = *devp;
 513                         break;
 514                 }
 515         }
 516         /*
 517          * Find the autopush configuration based on "savedev". Start with the
 518          * global zone. If not found check in the local zone.
 519          */
 520         zoneid = GLOBAL_ZONEID;
 521 retryap:
 522         ss = netstack_find_by_stackid(zoneid_to_netstackid(zoneid))->
 523             netstack_str;
 524         if ((ap = sad_ap_find_by_dev(savedev, ss)) == NULL) {
 525                 netstack_rele(ss->ss_netstack);
 526                 if (zoneid == GLOBAL_ZONEID) {
 527                         /*
 528                          * None found. Also look in the zone's autopush table.
 529                          */
 530                         zoneid = crgetzoneid(crp);
 531                         if (zoneid != GLOBAL_ZONEID)
 532                                 goto retryap;
 533                 }
 534                 goto opendone;
 535         }
 536         anchor = ap->ap_anchor;
 537         zoneid = crgetzoneid(crp);
 538         for (s = 0; s < ap->ap_npush; s++) {
 539                 error = push_mod(qp, &dummydev, stp, ap->ap_list[s],
 540                     anchor, crp, zoneid);
 541                 if (error != 0)
 542                         break;
 543         }
 544         sad_ap_rele(ap, ss);
 545         netstack_rele(ss->ss_netstack);
 546 
 547 opendone:
 548 
 549         /*
 550          * let specfs know that open failed part way through
 551          */
 552         if (error) {
 553                 mutex_enter(&stp->sd_lock);
 554                 stp->sd_flag |= STREOPENFAIL;
 555                 mutex_exit(&stp->sd_lock);
 556         }
 557 
 558         /*
 559          * Wake up others that are waiting for stream to be created.
 560          */
 561         mutex_enter(&stp->sd_lock);
 562         stp->sd_flag &= ~STWOPEN;
 563 
 564         /*
 565          * As a performance concern we are caching the values of
 566          * q_minpsz and q_maxpsz of the module below the stream
 567          * head in the stream head.
 568          */
 569         mutex_enter(QLOCK(stp->sd_wrq->q_next));
 570         rmin = stp->sd_wrq->q_next->q_minpsz;
 571         rmax = stp->sd_wrq->q_next->q_maxpsz;
 572         mutex_exit(QLOCK(stp->sd_wrq->q_next));
 573 
 574         /* do this processing here as a performance concern */
 575         if (strmsgsz != 0) {
 576                 if (rmax == INFPSZ)
 577                         rmax = strmsgsz;
 578                 else
 579                         rmax = MIN(strmsgsz, rmax);
 580         }
 581 
 582         mutex_enter(QLOCK(stp->sd_wrq));
 583         stp->sd_qn_minpsz = rmin;
 584         stp->sd_qn_maxpsz = rmax;
 585         mutex_exit(QLOCK(stp->sd_wrq));
 586 
 587 fifo_opendone:
 588         cv_broadcast(&stp->sd_monitor);
 589         mutex_exit(&stp->sd_lock);
 590         return (error);
 591 }
 592 
 593 static int strsink(queue_t *, mblk_t *);
 594 static struct qinit deadrend = {
 595         strsink, NULL, NULL, NULL, NULL, &strm_info, NULL
 596 };
 597 static struct qinit deadwend = {
 598         NULL, NULL, NULL, NULL, NULL, &stwm_info, NULL
 599 };
 600 
 601 /*
 602  * Close a stream.
 603  * This is called from closef() on the last close of an open stream.
 604  * Strclean() will already have removed the siglist and pollist
 605  * information, so all that remains is to remove all multiplexor links
 606  * for the stream, pop all the modules (and the driver), and free the
 607  * stream structure.
 608  */
 609 
 610 int
 611 strclose(struct vnode *vp, int flag, cred_t *crp)
 612 {
 613         struct stdata *stp;
 614         queue_t *qp;
 615         int rval;
 616         int freestp = 1;
 617         queue_t *rmq;
 618 
 619         TRACE_1(TR_FAC_STREAMS_FR,
 620             TR_STRCLOSE, "strclose:%p", vp);
 621         ASSERT(vp->v_stream);
 622 
 623         stp = vp->v_stream;
 624         ASSERT(!(stp->sd_flag & STPLEX));
 625         qp = stp->sd_wrq;
 626 
 627         /*
 628          * Needed so that strpoll will return non-zero for this fd.
 629          * Note that with POLLNOERR STRHUP does still cause POLLHUP.
 630          */
 631         mutex_enter(&stp->sd_lock);
 632         stp->sd_flag |= STRHUP;
 633         mutex_exit(&stp->sd_lock);
 634 
 635         /*
 636          * If the registered process or process group did not have an
 637          * open instance of this stream then strclean would not be
 638          * called. Thus at the time of closing all remaining siglist entries
 639          * are removed.
 640          */
 641         if (stp->sd_siglist != NULL)
 642                 strcleanall(vp);
 643 
 644         ASSERT(stp->sd_siglist == NULL);
 645         ASSERT(stp->sd_sigflags == 0);
 646 
 647         if (STRMATED(stp)) {
 648                 struct stdata *strmatep = stp->sd_mate;
 649                 int waited = 1;
 650 
 651                 STRLOCKMATES(stp);
 652                 while (waited) {
 653                         waited = 0;
 654                         while (stp->sd_flag & (STWOPEN|STRCLOSE|STRPLUMB)) {
 655                                 mutex_exit(&strmatep->sd_lock);
 656                                 cv_wait(&stp->sd_monitor, &stp->sd_lock);
 657                                 mutex_exit(&stp->sd_lock);
 658                                 STRLOCKMATES(stp);
 659                                 waited = 1;
 660                         }
 661                         while (strmatep->sd_flag &
 662                             (STWOPEN|STRCLOSE|STRPLUMB)) {
 663                                 mutex_exit(&stp->sd_lock);
 664                                 cv_wait(&strmatep->sd_monitor,
 665                                     &strmatep->sd_lock);
 666                                 mutex_exit(&strmatep->sd_lock);
 667                                 STRLOCKMATES(stp);
 668                                 waited = 1;
 669                         }
 670                 }
 671                 stp->sd_flag |= STRCLOSE;
 672                 STRUNLOCKMATES(stp);
 673         } else {
 674                 mutex_enter(&stp->sd_lock);
 675                 stp->sd_flag |= STRCLOSE;
 676                 mutex_exit(&stp->sd_lock);
 677         }
 678 
 679         ASSERT(qp->q_first == NULL); /* No more delayed write */
 680 
 681         /* Check if an I_LINK was ever done on this stream */
 682         if (stp->sd_flag & STRHASLINKS) {
 683                 netstack_t *ns;
 684                 str_stack_t *ss;
 685 
 686                 ns = netstack_find_by_cred(crp);
 687                 ASSERT(ns != NULL);
 688                 ss = ns->netstack_str;
 689                 ASSERT(ss != NULL);
 690 
 691                 (void) munlinkall(stp, LINKCLOSE|LINKNORMAL, crp, &rval, ss);
 692                 netstack_rele(ss->ss_netstack);
 693         }
 694 
 695         while (_SAMESTR(qp)) {
 696                 /*
 697                  * Holding sd_lock prevents q_next from changing in
 698                  * this stream.
 699                  */
 700                 mutex_enter(&stp->sd_lock);
 701                 if (!(flag & (FNDELAY|FNONBLOCK)) && (stp->sd_closetime > 0)) {
 702 
 703                         /*
 704                          * sleep until awakened by strwsrv() or timeout
 705                          */
 706                         for (;;) {
 707                                 mutex_enter(QLOCK(qp->q_next));
 708                                 if (!(qp->q_next->q_mblkcnt)) {
 709                                         mutex_exit(QLOCK(qp->q_next));
 710                                         break;
 711                                 }
 712                                 stp->sd_flag |= WSLEEP;
 713 
 714                                 /* ensure strwsrv gets enabled */
 715                                 qp->q_next->q_flag |= QWANTW;
 716                                 mutex_exit(QLOCK(qp->q_next));
 717                                 /* get out if we timed out or recv'd a signal */
 718                                 if (str_cv_wait(&qp->q_wait, &stp->sd_lock,
 719                                     stp->sd_closetime, 0) <= 0) {
 720                                         break;
 721                                 }
 722                         }
 723                         stp->sd_flag &= ~WSLEEP;
 724                 }
 725                 mutex_exit(&stp->sd_lock);
 726 
 727                 rmq = qp->q_next;
 728                 if (rmq->q_flag & QISDRV) {
 729                         ASSERT(!_SAMESTR(rmq));
 730                         wait_sq_svc(_RD(qp)->q_syncq);
 731                 }
 732 
 733                 qdetach(_RD(rmq), 1, flag, crp, B_FALSE);
 734         }
 735 
 736         /*
 737          * Since we call pollwakeup in close() now, the poll list should
 738          * be empty in most cases. The only exception is the layered devices
 739          * (e.g. the console drivers with redirection modules pushed on top
 740          * of it).  We have to do this after calling qdetach() because
 741          * the redirection module won't have torn down the console
 742          * redirection until after qdetach() has been invoked.
 743          */
 744         if (stp->sd_pollist.ph_list != NULL) {
 745                 pollwakeup(&stp->sd_pollist, POLLERR);
 746                 pollhead_clean(&stp->sd_pollist);
 747         }
 748         ASSERT(stp->sd_pollist.ph_list == NULL);
 749         ASSERT(stp->sd_sidp == NULL);
 750         ASSERT(stp->sd_pgidp == NULL);
 751 
 752         /* Prevent qenable from re-enabling the stream head queue */
 753         disable_svc(_RD(qp));
 754 
 755         /*
 756          * Wait until service procedure of each queue is
 757          * run, if QINSERVICE is set.
 758          */
 759         wait_svc(_RD(qp));
 760 
 761         /*
 762          * Now, flush both queues.
 763          */
 764         flushq(_RD(qp), FLUSHALL);
 765         flushq(qp, FLUSHALL);
 766 
 767         /*
 768          * If the write queue of the stream head is pointing to a
 769          * read queue, we have a twisted stream.  If the read queue
 770          * is alive, convert the stream head queues into a dead end.
 771          * If the read queue is dead, free the dead pair.
 772          */
 773         if (qp->q_next && !_SAMESTR(qp)) {
 774                 if (qp->q_next->q_qinfo == &deadrend) {       /* half-closed pipe */
 775                         flushq(qp->q_next, FLUSHALL); /* ensure no message */
 776                         shfree(qp->q_next->q_stream);
 777                         freeq(qp->q_next);
 778                         freeq(_RD(qp));
 779                 } else if (qp->q_next == _RD(qp)) {  /* fifo */
 780                         freeq(_RD(qp));
 781                 } else {                                /* pipe */
 782                         freestp = 0;
 783                         /*
 784                          * The q_info pointers are never accessed when
 785                          * SQLOCK is held.
 786                          */
 787                         ASSERT(qp->q_syncq == _RD(qp)->q_syncq);
 788                         mutex_enter(SQLOCK(qp->q_syncq));
 789                         qp->q_qinfo = &deadwend;
 790                         _RD(qp)->q_qinfo = &deadrend;
 791                         mutex_exit(SQLOCK(qp->q_syncq));
 792                 }
 793         } else {
 794                 freeq(_RD(qp)); /* free stream head queue pair */
 795         }
 796 
 797         mutex_enter(&vp->v_lock);
 798         if (stp->sd_iocblk) {
 799                 if (stp->sd_iocblk != (mblk_t *)-1) {
 800                         freemsg(stp->sd_iocblk);
 801                 }
 802                 stp->sd_iocblk = NULL;
 803         }
 804         stp->sd_vnode = NULL;
 805         vp->v_stream = NULL;
 806         mutex_exit(&vp->v_lock);
 807         mutex_enter(&stp->sd_lock);
 808         freemsg(stp->sd_cmdblk);
 809         stp->sd_cmdblk = NULL;
 810         stp->sd_flag &= ~STRCLOSE;
 811         cv_broadcast(&stp->sd_monitor);
 812         mutex_exit(&stp->sd_lock);
 813 
 814         if (freestp)
 815                 shfree(stp);
 816         return (0);
 817 }
 818 
 819 static int
 820 strsink(queue_t *q, mblk_t *bp)
 821 {
 822         struct copyresp *resp;
 823 
 824         switch (bp->b_datap->db_type) {
 825         case M_FLUSH:
 826                 if ((*bp->b_rptr & FLUSHW) && !(bp->b_flag & MSGNOLOOP)) {
 827                         *bp->b_rptr &= ~FLUSHR;
 828                         bp->b_flag |= MSGNOLOOP;
 829                         /*
 830                          * Protect against the driver passing up
 831                          * messages after it has done a qprocsoff.
 832                          */
 833                         if (_OTHERQ(q)->q_next == NULL)
 834                                 freemsg(bp);
 835                         else
 836                                 qreply(q, bp);
 837                 } else {
 838                         freemsg(bp);
 839                 }
 840                 break;
 841 
 842         case M_COPYIN:
 843         case M_COPYOUT:
 844                 if (bp->b_cont) {
 845                         freemsg(bp->b_cont);
 846                         bp->b_cont = NULL;
 847                 }
 848                 bp->b_datap->db_type = M_IOCDATA;
 849                 bp->b_wptr = bp->b_rptr + sizeof (struct copyresp);
 850                 resp = (struct copyresp *)bp->b_rptr;
 851                 resp->cp_rval = (caddr_t)1;  /* failure */
 852                 /*
 853                  * Protect against the driver passing up
 854                  * messages after it has done a qprocsoff.
 855                  */
 856                 if (_OTHERQ(q)->q_next == NULL)
 857                         freemsg(bp);
 858                 else
 859                         qreply(q, bp);
 860                 break;
 861 
 862         case M_IOCTL:
 863                 if (bp->b_cont) {
 864                         freemsg(bp->b_cont);
 865                         bp->b_cont = NULL;
 866                 }
 867                 bp->b_datap->db_type = M_IOCNAK;
 868                 /*
 869                  * Protect against the driver passing up
 870                  * messages after it has done a qprocsoff.
 871                  */
 872                 if (_OTHERQ(q)->q_next == NULL)
 873                         freemsg(bp);
 874                 else
 875                         qreply(q, bp);
 876                 break;
 877 
 878         default:
 879                 freemsg(bp);
 880                 break;
 881         }
 882 
 883         return (0);
 884 }
 885 
 886 /*
 887  * Clean up after a process when it closes a stream.  This is called
 888  * from closef for all closes, whereas strclose is called only for the
 889  * last close on a stream.  The siglist is scanned for entries for the
 890  * current process, and these are removed.
 891  */
 892 void
 893 strclean(struct vnode *vp)
 894 {
 895         strsig_t *ssp, *pssp, *tssp;
 896         stdata_t *stp;
 897         int update = 0;
 898 
 899         TRACE_1(TR_FAC_STREAMS_FR,
 900             TR_STRCLEAN, "strclean:%p", vp);
 901         stp = vp->v_stream;
 902         pssp = NULL;
 903         mutex_enter(&stp->sd_lock);
 904         ssp = stp->sd_siglist;
 905         while (ssp) {
 906                 if (ssp->ss_pidp == curproc->p_pidp) {
 907                         tssp = ssp->ss_next;
 908                         if (pssp)
 909                                 pssp->ss_next = tssp;
 910                         else
 911                                 stp->sd_siglist = tssp;
 912                         mutex_enter(&pidlock);
 913                         PID_RELE(ssp->ss_pidp);
 914                         mutex_exit(&pidlock);
 915                         kmem_free(ssp, sizeof (strsig_t));
 916                         update = 1;
 917                         ssp = tssp;
 918                 } else {
 919                         pssp = ssp;
 920                         ssp = ssp->ss_next;
 921                 }
 922         }
 923         if (update) {
 924                 stp->sd_sigflags = 0;
 925                 for (ssp = stp->sd_siglist; ssp; ssp = ssp->ss_next)
 926                         stp->sd_sigflags |= ssp->ss_events;
 927         }
 928         mutex_exit(&stp->sd_lock);
 929 }
 930 
 931 /*
 932  * Used on the last close to remove any remaining items on the siglist.
 933  * These could be present on the siglist due to I_ESETSIG calls that
 934  * use process groups or processed that do not have an open file descriptor
 935  * for this stream (Such entries would not be removed by strclean).
 936  */
 937 static void
 938 strcleanall(struct vnode *vp)
 939 {
 940         strsig_t *ssp, *nssp;
 941         stdata_t *stp;
 942 
 943         stp = vp->v_stream;
 944         mutex_enter(&stp->sd_lock);
 945         ssp = stp->sd_siglist;
 946         stp->sd_siglist = NULL;
 947         while (ssp) {
 948                 nssp = ssp->ss_next;
 949                 mutex_enter(&pidlock);
 950                 PID_RELE(ssp->ss_pidp);
 951                 mutex_exit(&pidlock);
 952                 kmem_free(ssp, sizeof (strsig_t));
 953                 ssp = nssp;
 954         }
 955         stp->sd_sigflags = 0;
 956         mutex_exit(&stp->sd_lock);
 957 }
 958 
 959 /*
 960  * Retrieve the next message from the logical stream head read queue
 961  * using either rwnext (if sync stream) or getq_noenab.
 962  * It is the callers responsibility to call qbackenable after
 963  * it is finished with the message. The caller should not call
 964  * qbackenable until after any putback calls to avoid spurious backenabling.
 965  */
 966 mblk_t *
 967 strget(struct stdata *stp, queue_t *q, struct uio *uiop, int first,
 968     int *errorp)
 969 {
 970         mblk_t *bp;
 971         int error;
 972         ssize_t rbytes = 0;
 973 
 974         /* Holding sd_lock prevents the read queue from changing  */
 975         ASSERT(MUTEX_HELD(&stp->sd_lock));
 976 
 977         if (uiop != NULL && stp->sd_struiordq != NULL &&
 978             q->q_first == NULL &&
 979             (!first || (stp->sd_wakeq & RSLEEP))) {
 980                 /*
 981                  * Stream supports rwnext() for the read side.
 982                  * If this is the first time we're called by e.g. strread
 983                  * only do the downcall if there is a deferred wakeup
 984                  * (registered in sd_wakeq).
 985                  */
 986                 struiod_t uiod;
 987 
 988                 if (first)
 989                         stp->sd_wakeq &= ~RSLEEP;
 990 
 991                 (void) uiodup(uiop, &uiod.d_uio, uiod.d_iov,
 992                     sizeof (uiod.d_iov) / sizeof (*uiod.d_iov));
 993                 uiod.d_mp = 0;
 994                 /*
 995                  * Mark that a thread is in rwnext on the read side
 996                  * to prevent strrput from nacking ioctls immediately.
 997                  * When the last concurrent rwnext returns
 998                  * the ioctls are nack'ed.
 999                  */
1000                 ASSERT(MUTEX_HELD(&stp->sd_lock));
1001                 stp->sd_struiodnak++;
1002                 /*
1003                  * Note: rwnext will drop sd_lock.
1004                  */
1005                 error = rwnext(q, &uiod);
1006                 ASSERT(MUTEX_NOT_HELD(&stp->sd_lock));
1007                 mutex_enter(&stp->sd_lock);
1008                 stp->sd_struiodnak--;
1009                 while (stp->sd_struiodnak == 0 &&
1010                     ((bp = stp->sd_struionak) != NULL)) {
1011                         stp->sd_struionak = bp->b_next;
1012                         bp->b_next = NULL;
1013                         bp->b_datap->db_type = M_IOCNAK;
1014                         /*
1015                          * Protect against the driver passing up
1016                          * messages after it has done a qprocsoff.
1017                          */
1018                         if (_OTHERQ(q)->q_next == NULL)
1019                                 freemsg(bp);
1020                         else {
1021                                 mutex_exit(&stp->sd_lock);
1022                                 qreply(q, bp);
1023                                 mutex_enter(&stp->sd_lock);
1024                         }
1025                 }
1026                 ASSERT(MUTEX_HELD(&stp->sd_lock));
1027                 if (error == 0 || error == EWOULDBLOCK) {
1028                         if ((bp = uiod.d_mp) != NULL) {
1029                                 *errorp = 0;
1030                                 ASSERT(MUTEX_HELD(&stp->sd_lock));
1031                                 return (bp);
1032                         }
1033                         error = 0;
1034                 } else if (error == EINVAL) {
1035                         /*
1036                          * The stream plumbing must have
1037                          * changed while we were away, so
1038                          * just turn off rwnext()s.
1039                          */
1040                         error = 0;
1041                 } else if (error == EBUSY) {
1042                         /*
1043                          * The module might have data in transit using putnext
1044                          * Fall back on waiting + getq.
1045                          */
1046                         error = 0;
1047                 } else {
1048                         *errorp = error;
1049                         ASSERT(MUTEX_HELD(&stp->sd_lock));
1050                         return (NULL);
1051                 }
1052                 /*
1053                  * Try a getq in case a rwnext() generated mblk
1054                  * has bubbled up via strrput().
1055                  */
1056         }
1057         *errorp = 0;
1058         ASSERT(MUTEX_HELD(&stp->sd_lock));
1059 
1060         /*
1061          * If we have a valid uio, try and use this as a guide for how
1062          * many bytes to retrieve from the queue via getq_noenab().
1063          * Doing this can avoid unneccesary counting of overlong
1064          * messages in putback(). We currently only do this for sockets
1065          * and only if there is no sd_rputdatafunc hook.
1066          *
1067          * The sd_rputdatafunc hook transforms the entire message
1068          * before any bytes in it can be given to a client. So, rbytes
1069          * must be 0 if there is a hook.
1070          */
1071         if ((uiop != NULL) && (stp->sd_vnode->v_type == VSOCK) &&
1072             (stp->sd_rputdatafunc == NULL))
1073                 rbytes = uiop->uio_resid;
1074 
1075         return (getq_noenab(q, rbytes));
1076 }
1077 
1078 /*
1079  * Copy out the message pointed to by `bp' into the uio pointed to by `uiop'.
1080  * If the message does not fit in the uio the remainder of it is returned;
1081  * otherwise NULL is returned.  Any embedded zero-length mblk_t's are
1082  * consumed, even if uio_resid reaches zero.  On error, `*errorp' is set to
1083  * the error code, the message is consumed, and NULL is returned.
1084  */
1085 static mblk_t *
1086 struiocopyout(mblk_t *bp, struct uio *uiop, int *errorp)
1087 {
1088         int error;
1089         ptrdiff_t n;
1090         mblk_t *nbp;
1091 
1092         ASSERT(bp->b_wptr >= bp->b_rptr);
1093 
1094         do {
1095                 if ((n = MIN(uiop->uio_resid, MBLKL(bp))) != 0) {
1096                         ASSERT(n > 0);
1097 
1098                         error = uiomove(bp->b_rptr, n, UIO_READ, uiop);
1099                         if (error != 0) {
1100                                 freemsg(bp);
1101                                 *errorp = error;
1102                                 return (NULL);
1103                         }
1104                 }
1105 
1106                 bp->b_rptr += n;
1107                 while (bp != NULL && (bp->b_rptr >= bp->b_wptr)) {
1108                         nbp = bp;
1109                         bp = bp->b_cont;
1110                         freeb(nbp);
1111                 }
1112         } while (bp != NULL && uiop->uio_resid > 0);
1113 
1114         *errorp = 0;
1115         return (bp);
1116 }
1117 
1118 /*
1119  * Read a stream according to the mode flags in sd_flag:
1120  *
1121  * (default mode)               - Byte stream, msg boundaries are ignored
1122  * RD_MSGDIS (msg discard)      - Read on msg boundaries and throw away
1123  *                              any data remaining in msg
1124  * RD_MSGNODIS (msg non-discard) - Read on msg boundaries and put back
1125  *                              any remaining data on head of read queue
1126  *
1127  * Consume readable messages on the front of the queue until
1128  * ttolwp(curthread)->lwp_count
1129  * is satisfied, the readable messages are exhausted, or a message
1130  * boundary is reached in a message mode.  If no data was read and
1131  * the stream was not opened with the NDELAY flag, block until data arrives.
1132  * Otherwise return the data read and update the count.
1133  *
1134  * In default mode a 0 length message signifies end-of-file and terminates
1135  * a read in progress.  The 0 length message is removed from the queue
1136  * only if it is the only message read (no data is read).
1137  *
1138  * An attempt to read an M_PROTO or M_PCPROTO message results in an
1139  * EBADMSG error return, unless either RD_PROTDAT or RD_PROTDIS are set.
1140  * If RD_PROTDAT is set, M_PROTO and M_PCPROTO messages are read as data.
1141  * If RD_PROTDIS is set, the M_PROTO and M_PCPROTO parts of the message
1142  * are unlinked from and M_DATA blocks in the message, the protos are
1143  * thrown away, and the data is read.
1144  */
1145 /* ARGSUSED */
1146 int
1147 strread(struct vnode *vp, struct uio *uiop, cred_t *crp)
1148 {
1149         struct stdata *stp;
1150         mblk_t *bp, *nbp;
1151         queue_t *q;
1152         int error = 0;
1153         uint_t old_sd_flag;
1154         int first;
1155         char rflg;
1156         uint_t mark;            /* Contains MSG*MARK and _LASTMARK */
1157 #define _LASTMARK       0x8000  /* Distinct from MSG*MARK */
1158         short delim;
1159         unsigned char pri = 0;
1160         char waitflag;
1161         unsigned char type;
1162 
1163         TRACE_1(TR_FAC_STREAMS_FR,
1164             TR_STRREAD_ENTER, "strread:%p", vp);
1165         ASSERT(vp->v_stream);
1166         stp = vp->v_stream;
1167 
1168         mutex_enter(&stp->sd_lock);
1169 
1170         if ((error = i_straccess(stp, JCREAD)) != 0) {
1171                 mutex_exit(&stp->sd_lock);
1172                 return (error);
1173         }
1174 
1175         if (stp->sd_flag & (STRDERR|STPLEX)) {
1176                 error = strgeterr(stp, STRDERR|STPLEX, 0);
1177                 if (error != 0) {
1178                         mutex_exit(&stp->sd_lock);
1179                         return (error);
1180                 }
1181         }
1182 
1183         /*
1184          * Loop terminates when uiop->uio_resid == 0.
1185          */
1186         rflg = 0;
1187         waitflag = READWAIT;
1188         q = _RD(stp->sd_wrq);
1189         for (;;) {
1190                 ASSERT(MUTEX_HELD(&stp->sd_lock));
1191                 old_sd_flag = stp->sd_flag;
1192                 mark = 0;
1193                 delim = 0;
1194                 first = 1;
1195                 while ((bp = strget(stp, q, uiop, first, &error)) == NULL) {
1196                         int done = 0;
1197 
1198                         ASSERT(MUTEX_HELD(&stp->sd_lock));
1199 
1200                         if (error != 0)
1201                                 goto oops;
1202 
1203                         if (stp->sd_flag & (STRHUP|STREOF)) {
1204                                 goto oops;
1205                         }
1206                         if (rflg && !(stp->sd_flag & STRDELIM)) {
1207                                 goto oops;
1208                         }
1209                         /*
1210                          * If a read(fd,buf,0) has been done, there is no
1211                          * need to sleep. We always have zero bytes to
1212                          * return.
1213                          */
1214                         if (uiop->uio_resid == 0) {
1215                                 goto oops;
1216                         }
1217 
1218                         qbackenable(q, 0);
1219 
1220                         TRACE_3(TR_FAC_STREAMS_FR, TR_STRREAD_WAIT,
1221                             "strread calls strwaitq:%p, %p, %p",
1222                             vp, uiop, crp);
1223                         if ((error = strwaitq(stp, waitflag, uiop->uio_resid,
1224                             uiop->uio_fmode, -1, &done)) != 0 || done) {
1225                                 TRACE_3(TR_FAC_STREAMS_FR, TR_STRREAD_DONE,
1226                                     "strread error or done:%p, %p, %p",
1227                                     vp, uiop, crp);
1228                                 if ((uiop->uio_fmode & FNDELAY) &&
1229                                     (stp->sd_flag & OLDNDELAY) &&
1230                                     (error == EAGAIN))
1231                                         error = 0;
1232                                 goto oops;
1233                         }
1234                         TRACE_3(TR_FAC_STREAMS_FR, TR_STRREAD_AWAKE,
1235                             "strread awakes:%p, %p, %p", vp, uiop, crp);
1236                         if ((error = i_straccess(stp, JCREAD)) != 0) {
1237                                 goto oops;
1238                         }
1239                         first = 0;
1240                 }
1241 
1242                 ASSERT(MUTEX_HELD(&stp->sd_lock));
1243                 ASSERT(bp);
1244                 pri = bp->b_band;
1245                 /*
1246                  * Extract any mark information. If the message is not
1247                  * completely consumed this information will be put in the mblk
1248                  * that is putback.
1249                  * If MSGMARKNEXT is set and the message is completely consumed
1250                  * the STRATMARK flag will be set below. Likewise, if
1251                  * MSGNOTMARKNEXT is set and the message is
1252                  * completely consumed STRNOTATMARK will be set.
1253                  *
1254                  * For some unknown reason strread only breaks the read at the
1255                  * last mark.
1256                  */
1257                 mark = bp->b_flag & (MSGMARK | MSGMARKNEXT | MSGNOTMARKNEXT);
1258                 ASSERT((mark & (MSGMARKNEXT|MSGNOTMARKNEXT)) !=
1259                     (MSGMARKNEXT|MSGNOTMARKNEXT));
1260                 if (mark != 0 && bp == stp->sd_mark) {
1261                         if (rflg) {
1262                                 putback(stp, q, bp, pri);
1263                                 goto oops;
1264                         }
1265                         mark |= _LASTMARK;
1266                         stp->sd_mark = NULL;
1267                 }
1268                 if ((stp->sd_flag & STRDELIM) && (bp->b_flag & MSGDELIM))
1269                         delim = 1;
1270                 mutex_exit(&stp->sd_lock);
1271 
1272                 if (STREAM_NEEDSERVICE(stp))
1273                         stream_runservice(stp);
1274 
1275                 type = bp->b_datap->db_type;
1276 
1277                 switch (type) {
1278 
1279                 case M_DATA:
1280 ismdata:
1281                         if (msgnodata(bp)) {
1282                                 if (mark || delim) {
1283                                         freemsg(bp);
1284                                 } else if (rflg) {
1285 
1286                                         /*
1287                                          * If already read data put zero
1288                                          * length message back on queue else
1289                                          * free msg and return 0.
1290                                          */
1291                                         bp->b_band = pri;
1292                                         mutex_enter(&stp->sd_lock);
1293                                         putback(stp, q, bp, pri);
1294                                         mutex_exit(&stp->sd_lock);
1295                                 } else {
1296                                         freemsg(bp);
1297                                 }
1298                                 error =  0;
1299                                 goto oops1;
1300                         }
1301 
1302                         rflg = 1;
1303                         waitflag |= NOINTR;
1304                         bp = struiocopyout(bp, uiop, &error);
1305                         if (error != 0)
1306                                 goto oops1;
1307 
1308                         mutex_enter(&stp->sd_lock);
1309                         if (bp) {
1310                                 /*
1311                                  * Have remaining data in message.
1312                                  * Free msg if in discard mode.
1313                                  */
1314                                 if (stp->sd_read_opt & RD_MSGDIS) {
1315                                         freemsg(bp);
1316                                 } else {
1317                                         bp->b_band = pri;
1318                                         if ((mark & _LASTMARK) &&
1319                                             (stp->sd_mark == NULL))
1320                                                 stp->sd_mark = bp;
1321                                         bp->b_flag |= mark & ~_LASTMARK;
1322                                         if (delim)
1323                                                 bp->b_flag |= MSGDELIM;
1324                                         if (msgnodata(bp))
1325                                                 freemsg(bp);
1326                                         else
1327                                                 putback(stp, q, bp, pri);
1328                                 }
1329                         } else {
1330                                 /*
1331                                  * Consumed the complete message.
1332                                  * Move the MSG*MARKNEXT information
1333                                  * to the stream head just in case
1334                                  * the read queue becomes empty.
1335                                  *
1336                                  * If the stream head was at the mark
1337                                  * (STRATMARK) before we dropped sd_lock above
1338                                  * and some data was consumed then we have
1339                                  * moved past the mark thus STRATMARK is
1340                                  * cleared. However, if a message arrived in
1341                                  * strrput during the copyout above causing
1342                                  * STRATMARK to be set we can not clear that
1343                                  * flag.
1344                                  */
1345                                 if (mark &
1346                                     (MSGMARKNEXT|MSGNOTMARKNEXT|MSGMARK)) {
1347                                         if (mark & MSGMARKNEXT) {
1348                                                 stp->sd_flag &= ~STRNOTATMARK;
1349                                                 stp->sd_flag |= STRATMARK;
1350                                         } else if (mark & MSGNOTMARKNEXT) {
1351                                                 stp->sd_flag &= ~STRATMARK;
1352                                                 stp->sd_flag |= STRNOTATMARK;
1353                                         } else {
1354                                                 stp->sd_flag &=
1355                                                     ~(STRATMARK|STRNOTATMARK);
1356                                         }
1357                                 } else if (rflg && (old_sd_flag & STRATMARK)) {
1358                                         stp->sd_flag &= ~STRATMARK;
1359                                 }
1360                         }
1361 
1362                         /*
1363                          * Check for signal messages at the front of the read
1364                          * queue and generate the signal(s) if appropriate.
1365                          * The only signal that can be on queue is M_SIG at
1366                          * this point.
1367                          */
1368                         while ((((bp = q->q_first)) != NULL) &&
1369                             (bp->b_datap->db_type == M_SIG)) {
1370                                 bp = getq_noenab(q, 0);
1371                                 /*
1372                                  * sd_lock is held so the content of the
1373                                  * read queue can not change.
1374                                  */
1375                                 ASSERT(bp != NULL && DB_TYPE(bp) == M_SIG);
1376                                 strsignal_nolock(stp, *bp->b_rptr, bp->b_band);
1377                                 mutex_exit(&stp->sd_lock);
1378                                 freemsg(bp);
1379                                 if (STREAM_NEEDSERVICE(stp))
1380                                         stream_runservice(stp);
1381                                 mutex_enter(&stp->sd_lock);
1382                         }
1383 
1384                         if ((uiop->uio_resid == 0) || (mark & _LASTMARK) ||
1385                             delim ||
1386                             (stp->sd_read_opt & (RD_MSGDIS|RD_MSGNODIS))) {
1387                                 goto oops;
1388                         }
1389                         continue;
1390 
1391                 case M_SIG:
1392                         strsignal(stp, *bp->b_rptr, (int32_t)bp->b_band);
1393                         freemsg(bp);
1394                         mutex_enter(&stp->sd_lock);
1395                         continue;
1396 
1397                 case M_PROTO:
1398                 case M_PCPROTO:
1399                         /*
1400                          * Only data messages are readable.
1401                          * Any others generate an error, unless
1402                          * RD_PROTDIS or RD_PROTDAT is set.
1403                          */
1404                         if (stp->sd_read_opt & RD_PROTDAT) {
1405                                 for (nbp = bp; nbp; nbp = nbp->b_next) {
1406                                         if ((nbp->b_datap->db_type ==
1407                                             M_PROTO) ||
1408                                             (nbp->b_datap->db_type ==
1409                                             M_PCPROTO)) {
1410                                                 nbp->b_datap->db_type = M_DATA;
1411                                         } else {
1412                                                 break;
1413                                         }
1414                                 }
1415                                 /*
1416                                  * clear stream head hi pri flag based on
1417                                  * first message
1418                                  */
1419                                 if (type == M_PCPROTO) {
1420                                         mutex_enter(&stp->sd_lock);
1421                                         stp->sd_flag &= ~STRPRI;
1422                                         mutex_exit(&stp->sd_lock);
1423                                 }
1424                                 goto ismdata;
1425                         } else if (stp->sd_read_opt & RD_PROTDIS) {
1426                                 /*
1427                                  * discard non-data messages
1428                                  */
1429                                 while (bp &&
1430                                     ((bp->b_datap->db_type == M_PROTO) ||
1431                                     (bp->b_datap->db_type == M_PCPROTO))) {
1432                                         nbp = unlinkb(bp);
1433                                         freeb(bp);
1434                                         bp = nbp;
1435                                 }
1436                                 /*
1437                                  * clear stream head hi pri flag based on
1438                                  * first message
1439                                  */
1440                                 if (type == M_PCPROTO) {
1441                                         mutex_enter(&stp->sd_lock);
1442                                         stp->sd_flag &= ~STRPRI;
1443                                         mutex_exit(&stp->sd_lock);
1444                                 }
1445                                 if (bp) {
1446                                         bp->b_band = pri;
1447                                         goto ismdata;
1448                                 } else {
1449                                         break;
1450                                 }
1451                         }
1452                         /* FALLTHRU */
1453                 case M_PASSFP:
1454                         if ((bp->b_datap->db_type == M_PASSFP) &&
1455                             (stp->sd_read_opt & RD_PROTDIS)) {
1456                                 freemsg(bp);
1457                                 break;
1458                         }
1459                         mutex_enter(&stp->sd_lock);
1460                         putback(stp, q, bp, pri);
1461                         mutex_exit(&stp->sd_lock);
1462                         if (rflg == 0)
1463                                 error = EBADMSG;
1464                         goto oops1;
1465 
1466                 default:
1467                         /*
1468                          * Garbage on stream head read queue.
1469                          */
1470                         cmn_err(CE_WARN, "bad %x found at stream head\n",
1471                             bp->b_datap->db_type);
1472                         freemsg(bp);
1473                         goto oops1;
1474                 }
1475                 mutex_enter(&stp->sd_lock);
1476         }
1477 oops:
1478         mutex_exit(&stp->sd_lock);
1479 oops1:
1480         qbackenable(q, pri);
1481         return (error);
1482 #undef  _LASTMARK
1483 }
1484 
1485 /*
1486  * Default processing of M_PROTO/M_PCPROTO messages.
1487  * Determine which wakeups and signals are needed.
1488  * This can be replaced by a user-specified procedure for kernel users
1489  * of STREAMS.
1490  */
1491 /* ARGSUSED */
1492 mblk_t *
1493 strrput_proto(vnode_t *vp, mblk_t *mp,
1494     strwakeup_t *wakeups, strsigset_t *firstmsgsigs,
1495     strsigset_t *allmsgsigs, strpollset_t *pollwakeups)
1496 {
1497         *wakeups = RSLEEP;
1498         *allmsgsigs = 0;
1499 
1500         switch (mp->b_datap->db_type) {
1501         case M_PROTO:
1502                 if (mp->b_band == 0) {
1503                         *firstmsgsigs = S_INPUT | S_RDNORM;
1504                         *pollwakeups = POLLIN | POLLRDNORM;
1505                 } else {
1506                         *firstmsgsigs = S_INPUT | S_RDBAND;
1507                         *pollwakeups = POLLIN | POLLRDBAND;
1508                 }
1509                 break;
1510         case M_PCPROTO:
1511                 *firstmsgsigs = S_HIPRI;
1512                 *pollwakeups = POLLPRI;
1513                 break;
1514         }
1515         return (mp);
1516 }
1517 
1518 /*
1519  * Default processing of everything but M_DATA, M_PROTO, M_PCPROTO and
1520  * M_PASSFP messages.
1521  * Determine which wakeups and signals are needed.
1522  * This can be replaced by a user-specified procedure for kernel users
1523  * of STREAMS.
1524  */
1525 /* ARGSUSED */
1526 mblk_t *
1527 strrput_misc(vnode_t *vp, mblk_t *mp,
1528     strwakeup_t *wakeups, strsigset_t *firstmsgsigs,
1529     strsigset_t *allmsgsigs, strpollset_t *pollwakeups)
1530 {
1531         *wakeups = 0;
1532         *firstmsgsigs = 0;
1533         *allmsgsigs = 0;
1534         *pollwakeups = 0;
1535         return (mp);
1536 }
1537 
1538 /*
1539  * Stream read put procedure.  Called from downstream driver/module
1540  * with messages for the stream head.  Data, protocol, and in-stream
1541  * signal messages are placed on the queue, others are handled directly.
1542  */
1543 int
1544 strrput(queue_t *q, mblk_t *bp)
1545 {
1546         struct stdata   *stp;
1547         ulong_t         rput_opt;
1548         strwakeup_t     wakeups;
1549         strsigset_t     firstmsgsigs;   /* Signals if first message on queue */
1550         strsigset_t     allmsgsigs;     /* Signals for all messages */
1551         strsigset_t     signals;        /* Signals events to generate */
1552         strpollset_t    pollwakeups;
1553         mblk_t          *nextbp;
1554         uchar_t         band = 0;
1555         int             hipri_sig;
1556 
1557         stp = (struct stdata *)q->q_ptr;
1558         /*
1559          * Use rput_opt for optimized access to the SR_ flags except
1560          * SR_POLLIN. That flag has to be checked under sd_lock since it
1561          * is modified by strpoll().
1562          */
1563         rput_opt = stp->sd_rput_opt;
1564 
1565         ASSERT(qclaimed(q));
1566         TRACE_2(TR_FAC_STREAMS_FR, TR_STRRPUT_ENTER,
1567             "strrput called with message type:q %p bp %p", q, bp);
1568 
1569         /*
1570          * Perform initial processing and pass to the parameterized functions.
1571          */
1572         ASSERT(bp->b_next == NULL);
1573 
1574         switch (bp->b_datap->db_type) {
1575         case M_DATA:
1576                 /*
1577                  * sockfs is the only consumer of STREOF and when it is set,
1578                  * it implies that the receiver is not interested in receiving
1579                  * any more data, hence the mblk is freed to prevent unnecessary
1580                  * message queueing at the stream head.
1581                  */
1582                 if (stp->sd_flag == STREOF) {
1583                         freemsg(bp);
1584                         return (0);
1585                 }
1586                 if ((rput_opt & SR_IGN_ZEROLEN) &&
1587                     bp->b_rptr == bp->b_wptr && msgnodata(bp)) {
1588                         /*
1589                          * Ignore zero-length M_DATA messages. These might be
1590                          * generated by some transports.
1591                          * The zero-length M_DATA messages, even if they
1592                          * are ignored, should effect the atmark tracking and
1593                          * should wake up a thread sleeping in strwaitmark.
1594                          */
1595                         mutex_enter(&stp->sd_lock);
1596                         if (bp->b_flag & MSGMARKNEXT) {
1597                                 /*
1598                                  * Record the position of the mark either
1599                                  * in q_last or in STRATMARK.
1600                                  */
1601                                 if (q->q_last != NULL) {
1602                                         q->q_last->b_flag &= ~MSGNOTMARKNEXT;
1603                                         q->q_last->b_flag |= MSGMARKNEXT;
1604                                 } else {
1605                                         stp->sd_flag &= ~STRNOTATMARK;
1606                                         stp->sd_flag |= STRATMARK;
1607                                 }
1608                         } else if (bp->b_flag & MSGNOTMARKNEXT) {
1609                                 /*
1610                                  * Record that this is not the position of
1611                                  * the mark either in q_last or in
1612                                  * STRNOTATMARK.
1613                                  */
1614                                 if (q->q_last != NULL) {
1615                                         q->q_last->b_flag &= ~MSGMARKNEXT;
1616                                         q->q_last->b_flag |= MSGNOTMARKNEXT;
1617                                 } else {
1618                                         stp->sd_flag &= ~STRATMARK;
1619                                         stp->sd_flag |= STRNOTATMARK;
1620                                 }
1621                         }
1622                         if (stp->sd_flag & RSLEEP) {
1623                                 stp->sd_flag &= ~RSLEEP;
1624                                 cv_broadcast(&q->q_wait);
1625                         }
1626                         mutex_exit(&stp->sd_lock);
1627                         freemsg(bp);
1628                         return (0);
1629                 }
1630                 wakeups = RSLEEP;
1631                 if (bp->b_band == 0) {
1632                         firstmsgsigs = S_INPUT | S_RDNORM;
1633                         pollwakeups = POLLIN | POLLRDNORM;
1634                 } else {
1635                         firstmsgsigs = S_INPUT | S_RDBAND;
1636                         pollwakeups = POLLIN | POLLRDBAND;
1637                 }
1638                 if (rput_opt & SR_SIGALLDATA)
1639                         allmsgsigs = firstmsgsigs;
1640                 else
1641                         allmsgsigs = 0;
1642 
1643                 mutex_enter(&stp->sd_lock);
1644                 if ((rput_opt & SR_CONSOL_DATA) &&
1645                     (q->q_last != NULL) &&
1646                     (bp->b_flag & (MSGMARK|MSGDELIM)) == 0) {
1647                         /*
1648                          * Consolidate an M_DATA message onto an M_DATA,
1649                          * M_PROTO, or M_PCPROTO by merging it with q_last.
1650                          * The consolidation does not take place if
1651                          * the old message is marked with either of the
1652                          * marks or the delim flag or if the new
1653                          * message is marked with MSGMARK. The MSGMARK
1654                          * check is needed to handle the odd semantics of
1655                          * MSGMARK where essentially the whole message
1656                          * is to be treated as marked.
1657                          * Carry any MSGMARKNEXT  and MSGNOTMARKNEXT from the
1658                          * new message to the front of the b_cont chain.
1659                          */
1660                         mblk_t *lbp = q->q_last;
1661                         unsigned char db_type = lbp->b_datap->db_type;
1662 
1663                         if ((db_type == M_DATA || db_type == M_PROTO ||
1664                             db_type == M_PCPROTO) &&
1665                             !(lbp->b_flag & (MSGDELIM|MSGMARK|MSGMARKNEXT))) {
1666                                 rmvq_noenab(q, lbp);
1667                                 /*
1668                                  * The first message in the b_cont list
1669                                  * tracks MSGMARKNEXT and MSGNOTMARKNEXT.
1670                                  * We need to handle the case where we
1671                                  * are appending:
1672                                  *
1673                                  * 1) a MSGMARKNEXT to a MSGNOTMARKNEXT.
1674                                  * 2) a MSGMARKNEXT to a plain message.
1675                                  * 3) a MSGNOTMARKNEXT to a plain message
1676                                  * 4) a MSGNOTMARKNEXT to a MSGNOTMARKNEXT
1677                                  *    message.
1678                                  *
1679                                  * Thus we never append a MSGMARKNEXT or
1680                                  * MSGNOTMARKNEXT to a MSGMARKNEXT message.
1681                                  */
1682                                 if (bp->b_flag & MSGMARKNEXT) {
1683                                         lbp->b_flag |= MSGMARKNEXT;
1684                                         lbp->b_flag &= ~MSGNOTMARKNEXT;
1685                                         bp->b_flag &= ~MSGMARKNEXT;
1686                                 } else if (bp->b_flag & MSGNOTMARKNEXT) {
1687                                         lbp->b_flag |= MSGNOTMARKNEXT;
1688                                         bp->b_flag &= ~MSGNOTMARKNEXT;
1689                                 }
1690 
1691                                 linkb(lbp, bp);
1692                                 bp = lbp;
1693                                 /*
1694                                  * The new message logically isn't the first
1695                                  * even though the q_first check below thinks
1696                                  * it is. Clear the firstmsgsigs to make it
1697                                  * not appear to be first.
1698                                  */
1699                                 firstmsgsigs = 0;
1700                         }
1701                 }
1702                 break;
1703 
1704         case M_PASSFP:
1705                 wakeups = RSLEEP;
1706                 allmsgsigs = 0;
1707                 if (bp->b_band == 0) {
1708                         firstmsgsigs = S_INPUT | S_RDNORM;
1709                         pollwakeups = POLLIN | POLLRDNORM;
1710                 } else {
1711                         firstmsgsigs = S_INPUT | S_RDBAND;
1712                         pollwakeups = POLLIN | POLLRDBAND;
1713                 }
1714                 mutex_enter(&stp->sd_lock);
1715                 break;
1716 
1717         case M_PROTO:
1718         case M_PCPROTO:
1719                 ASSERT(stp->sd_rprotofunc != NULL);
1720                 bp = (stp->sd_rprotofunc)(stp->sd_vnode, bp,
1721                     &wakeups, &firstmsgsigs, &allmsgsigs, &pollwakeups);
1722 #define ALLSIG  (S_INPUT|S_HIPRI|S_OUTPUT|S_MSG|S_ERROR|S_HANGUP|S_RDNORM|\
1723                 S_WRNORM|S_RDBAND|S_WRBAND|S_BANDURG)
1724 #define ALLPOLL (POLLIN|POLLPRI|POLLOUT|POLLRDNORM|POLLWRNORM|POLLRDBAND|\
1725                 POLLWRBAND)
1726 
1727                 ASSERT((wakeups & ~(RSLEEP|WSLEEP)) == 0);
1728                 ASSERT((firstmsgsigs & ~ALLSIG) == 0);
1729                 ASSERT((allmsgsigs & ~ALLSIG) == 0);
1730                 ASSERT((pollwakeups & ~ALLPOLL) == 0);
1731 
1732                 mutex_enter(&stp->sd_lock);
1733                 break;
1734 
1735         default:
1736                 ASSERT(stp->sd_rmiscfunc != NULL);
1737                 bp = (stp->sd_rmiscfunc)(stp->sd_vnode, bp,
1738                     &wakeups, &firstmsgsigs, &allmsgsigs, &pollwakeups);
1739                 ASSERT((wakeups & ~(RSLEEP|WSLEEP)) == 0);
1740                 ASSERT((firstmsgsigs & ~ALLSIG) == 0);
1741                 ASSERT((allmsgsigs & ~ALLSIG) == 0);
1742                 ASSERT((pollwakeups & ~ALLPOLL) == 0);
1743 #undef  ALLSIG
1744 #undef  ALLPOLL
1745                 mutex_enter(&stp->sd_lock);
1746                 break;
1747         }
1748         ASSERT(MUTEX_HELD(&stp->sd_lock));
1749 
1750         /* By default generate superset of signals */
1751         signals = (firstmsgsigs | allmsgsigs);
1752 
1753         /*
1754          * The  proto and misc functions can return multiple messages
1755          * as a b_next chain. Such messages are processed separately.
1756          */
1757 one_more:
1758         hipri_sig = 0;
1759         if (bp == NULL) {
1760                 nextbp = NULL;
1761         } else {
1762                 nextbp = bp->b_next;
1763                 bp->b_next = NULL;
1764 
1765                 switch (bp->b_datap->db_type) {
1766                 case M_PCPROTO:
1767                         /*
1768                          * Only one priority protocol message is allowed at the
1769                          * stream head at a time.
1770                          */
1771                         if (stp->sd_flag & STRPRI) {
1772                                 TRACE_0(TR_FAC_STREAMS_FR, TR_STRRPUT_PROTERR,
1773                                     "M_PCPROTO already at head");
1774                                 freemsg(bp);
1775                                 mutex_exit(&stp->sd_lock);
1776                                 goto done;
1777                         }
1778                         stp->sd_flag |= STRPRI;
1779                         hipri_sig = 1;
1780                         /* FALLTHRU */
1781                 case M_DATA:
1782                 case M_PROTO:
1783                 case M_PASSFP:
1784                         band = bp->b_band;
1785                         /*
1786                          * Marking doesn't work well when messages
1787                          * are marked in more than one band.  We only
1788                          * remember the last message received, even if
1789                          * it is placed on the queue ahead of other
1790                          * marked messages.
1791                          */
1792                         if (bp->b_flag & MSGMARK)
1793                                 stp->sd_mark = bp;
1794                         (void) putq(q, bp);
1795 
1796                         /*
1797                          * If message is a PCPROTO message, always use
1798                          * firstmsgsigs to determine if a signal should be
1799                          * sent as strrput is the only place to send
1800                          * signals for PCPROTO. Other messages are based on
1801                          * the STRGETINPROG flag. The flag determines if
1802                          * strrput or (k)strgetmsg will be responsible for
1803                          * sending the signals, in the firstmsgsigs case.
1804                          */
1805                         if ((hipri_sig == 1) ||
1806                             (((stp->sd_flag & STRGETINPROG) == 0) &&
1807                             (q->q_first == bp)))
1808                                 signals = (firstmsgsigs | allmsgsigs);
1809                         else
1810                                 signals = allmsgsigs;
1811                         break;
1812 
1813                 default:
1814                         mutex_exit(&stp->sd_lock);
1815                         (void) strrput_nondata(q, bp);
1816                         mutex_enter(&stp->sd_lock);
1817                         break;
1818                 }
1819         }
1820         ASSERT(MUTEX_HELD(&stp->sd_lock));
1821         /*
1822          * Wake sleeping read/getmsg and cancel deferred wakeup
1823          */
1824         if (wakeups & RSLEEP)
1825                 stp->sd_wakeq &= ~RSLEEP;
1826 
1827         wakeups &= stp->sd_flag;
1828         if (wakeups & RSLEEP) {
1829                 stp->sd_flag &= ~RSLEEP;
1830                 cv_broadcast(&q->q_wait);
1831         }
1832         if (wakeups & WSLEEP) {
1833                 stp->sd_flag &= ~WSLEEP;
1834                 cv_broadcast(&_WR(q)->q_wait);
1835         }
1836 
1837         if (pollwakeups != 0) {
1838                 if (pollwakeups == (POLLIN | POLLRDNORM)) {
1839                         /*
1840                          * Can't use rput_opt since it was not
1841                          * read when sd_lock was held and SR_POLLIN is changed
1842                          * by strpoll() under sd_lock.
1843                          */
1844                         if (!(stp->sd_rput_opt & SR_POLLIN))
1845                                 goto no_pollwake;
1846                         stp->sd_rput_opt &= ~SR_POLLIN;
1847                 }
1848                 mutex_exit(&stp->sd_lock);
1849                 pollwakeup(&stp->sd_pollist, pollwakeups);
1850                 mutex_enter(&stp->sd_lock);
1851         }
1852 no_pollwake:
1853 
1854         /*
1855          * strsendsig can handle multiple signals with a
1856          * single call.
1857          */
1858         if (stp->sd_sigflags & signals)
1859                 strsendsig(stp->sd_siglist, signals, band, 0);
1860         mutex_exit(&stp->sd_lock);
1861 
1862 
1863 done:
1864         if (nextbp == NULL)
1865                 return (0);
1866 
1867         /*
1868          * Any signals were handled the first time.
1869          * Wakeups and pollwakeups are redone to avoid any race
1870          * conditions - all the messages are not queued until the
1871          * last message has been processed by strrput.
1872          */
1873         bp = nextbp;
1874         signals = firstmsgsigs = allmsgsigs = 0;
1875         mutex_enter(&stp->sd_lock);
1876         goto one_more;
1877 }
1878 
1879 static void
1880 log_dupioc(queue_t *rq, mblk_t *bp)
1881 {
1882         queue_t *wq, *qp;
1883         char *modnames, *mnp, *dname;
1884         size_t maxmodstr;
1885         boolean_t islast;
1886 
1887         /*
1888          * Allocate a buffer large enough to hold the names of nstrpush modules
1889          * and one driver, with spaces between and NUL terminator.  If we can't
1890          * get memory, then we'll just log the driver name.
1891          */
1892         maxmodstr = nstrpush * (FMNAMESZ + 1);
1893         mnp = modnames = kmem_alloc(maxmodstr, KM_NOSLEEP);
1894 
1895         /* march down write side to print log message down to the driver */
1896         wq = WR(rq);
1897 
1898         /* make sure q_next doesn't shift around while we're grabbing data */
1899         claimstr(wq);
1900         qp = wq->q_next;
1901         do {
1902                 dname = Q2NAME(qp);
1903                 islast = !SAMESTR(qp) || qp->q_next == NULL;
1904                 if (modnames == NULL) {
1905                         /*
1906                          * If we don't have memory, then get the driver name in
1907                          * the log where we can see it.  Note that memory
1908                          * pressure is a possible cause of these sorts of bugs.
1909                          */
1910                         if (islast) {
1911                                 modnames = dname;
1912                                 maxmodstr = 0;
1913                         }
1914                 } else {
1915                         mnp += snprintf(mnp, FMNAMESZ + 1, "%s", dname);
1916                         if (!islast)
1917                                 *mnp++ = ' ';
1918                 }
1919                 qp = qp->q_next;
1920         } while (!islast);
1921         releasestr(wq);
1922         /* Cannot happen unless stream head is corrupt. */
1923         ASSERT(modnames != NULL);
1924         (void) strlog(rq->q_qinfo->qi_minfo->mi_idnum, 0, 1,
1925             SL_CONSOLE|SL_TRACE|SL_ERROR,
1926             "Warning: stream %p received duplicate %X M_IOC%s; module list: %s",
1927             rq->q_ptr, ((struct iocblk *)bp->b_rptr)->ioc_cmd,
1928             (DB_TYPE(bp) == M_IOCACK ? "ACK" : "NAK"), modnames);
1929         if (maxmodstr != 0)
1930                 kmem_free(modnames, maxmodstr);
1931 }
1932 
1933 int
1934 strrput_nondata(queue_t *q, mblk_t *bp)
1935 {
1936         struct stdata *stp;
1937         struct iocblk *iocbp;
1938         struct stroptions *sop;
1939         struct copyreq *reqp;
1940         struct copyresp *resp;
1941         unsigned char bpri;
1942         unsigned char  flushed_already = 0;
1943 
1944         stp = (struct stdata *)q->q_ptr;
1945 
1946         ASSERT(!(stp->sd_flag & STPLEX));
1947         ASSERT(qclaimed(q));
1948 
1949         switch (bp->b_datap->db_type) {
1950         case M_ERROR:
1951                 /*
1952                  * An error has occurred downstream, the errno is in the first
1953                  * bytes of the message.
1954                  */
1955                 if ((bp->b_wptr - bp->b_rptr) == 2) {     /* New flavor */
1956                         unsigned char rw = 0;
1957 
1958                         mutex_enter(&stp->sd_lock);
1959                         if (*bp->b_rptr != NOERROR) {        /* read error */
1960                                 if (*bp->b_rptr != 0) {
1961                                         if (stp->sd_flag & STRDERR)
1962                                                 flushed_already |= FLUSHR;
1963                                         stp->sd_flag |= STRDERR;
1964                                         rw |= FLUSHR;
1965                                 } else {
1966                                         stp->sd_flag &= ~STRDERR;
1967                                 }
1968                                 stp->sd_rerror = *bp->b_rptr;
1969                         }
1970                         bp->b_rptr++;
1971                         if (*bp->b_rptr != NOERROR) {        /* write error */
1972                                 if (*bp->b_rptr != 0) {
1973                                         if (stp->sd_flag & STWRERR)
1974                                                 flushed_already |= FLUSHW;
1975                                         stp->sd_flag |= STWRERR;
1976                                         rw |= FLUSHW;
1977                                 } else {
1978                                         stp->sd_flag &= ~STWRERR;
1979                                 }
1980                                 stp->sd_werror = *bp->b_rptr;
1981                         }
1982                         if (rw) {
1983                                 TRACE_2(TR_FAC_STREAMS_FR, TR_STRRPUT_WAKE,
1984                                     "strrput cv_broadcast:q %p, bp %p",
1985                                     q, bp);
1986                                 cv_broadcast(&q->q_wait); /* readers */
1987                                 cv_broadcast(&_WR(q)->q_wait); /* writers */
1988                                 cv_broadcast(&stp->sd_monitor); /* ioctllers */
1989 
1990                                 mutex_exit(&stp->sd_lock);
1991                                 pollwakeup(&stp->sd_pollist, POLLERR);
1992                                 mutex_enter(&stp->sd_lock);
1993 
1994                                 if (stp->sd_sigflags & S_ERROR)
1995                                         strsendsig(stp->sd_siglist, S_ERROR, 0,
1996                                             ((rw & FLUSHR) ? stp->sd_rerror :
1997                                             stp->sd_werror));
1998                                 mutex_exit(&stp->sd_lock);
1999                                 /*
2000                                  * Send the M_FLUSH only
2001                                  * for the first M_ERROR
2002                                  * message on the stream
2003                                  */
2004                                 if (flushed_already == rw) {
2005                                         freemsg(bp);
2006                                         return (0);
2007                                 }
2008 
2009                                 bp->b_datap->db_type = M_FLUSH;
2010                                 *bp->b_rptr = rw;
2011                                 bp->b_wptr = bp->b_rptr + 1;
2012                                 /*
2013                                  * Protect against the driver
2014                                  * passing up messages after
2015                                  * it has done a qprocsoff
2016                                  */
2017                                 if (_OTHERQ(q)->q_next == NULL)
2018                                         freemsg(bp);
2019                                 else
2020                                         qreply(q, bp);
2021                                 return (0);
2022                         } else
2023                                 mutex_exit(&stp->sd_lock);
2024                 } else if (*bp->b_rptr != 0) {               /* Old flavor */
2025                                 if (stp->sd_flag & (STRDERR|STWRERR))
2026                                         flushed_already = FLUSHRW;
2027                                 mutex_enter(&stp->sd_lock);
2028                                 stp->sd_flag |= (STRDERR|STWRERR);
2029                                 stp->sd_rerror = *bp->b_rptr;
2030                                 stp->sd_werror = *bp->b_rptr;
2031                                 TRACE_2(TR_FAC_STREAMS_FR,
2032                                     TR_STRRPUT_WAKE2,
2033                                     "strrput wakeup #2:q %p, bp %p", q, bp);
2034                                 cv_broadcast(&q->q_wait); /* the readers */
2035                                 cv_broadcast(&_WR(q)->q_wait); /* the writers */
2036                                 cv_broadcast(&stp->sd_monitor); /* ioctllers */
2037 
2038                                 mutex_exit(&stp->sd_lock);
2039                                 pollwakeup(&stp->sd_pollist, POLLERR);
2040                                 mutex_enter(&stp->sd_lock);
2041 
2042                                 if (stp->sd_sigflags & S_ERROR)
2043                                         strsendsig(stp->sd_siglist, S_ERROR, 0,
2044                                             (stp->sd_werror ? stp->sd_werror :
2045                                             stp->sd_rerror));
2046                                 mutex_exit(&stp->sd_lock);
2047 
2048                                 /*
2049                                  * Send the M_FLUSH only
2050                                  * for the first M_ERROR
2051                                  * message on the stream
2052                                  */
2053                                 if (flushed_already != FLUSHRW) {
2054                                         bp->b_datap->db_type = M_FLUSH;
2055                                         *bp->b_rptr = FLUSHRW;
2056                                         /*
2057                                          * Protect against the driver passing up
2058                                          * messages after it has done a
2059                                          * qprocsoff.
2060                                          */
2061                                 if (_OTHERQ(q)->q_next == NULL)
2062                                         freemsg(bp);
2063                                 else
2064                                         qreply(q, bp);
2065                                 return (0);
2066                                 }
2067                 }
2068                 freemsg(bp);
2069                 return (0);
2070 
2071         case M_HANGUP:
2072 
2073                 freemsg(bp);
2074                 mutex_enter(&stp->sd_lock);
2075                 stp->sd_werror = ENXIO;
2076                 stp->sd_flag |= STRHUP;
2077                 stp->sd_flag &= ~(WSLEEP|RSLEEP);
2078 
2079                 /*
2080                  * send signal if controlling tty
2081                  */
2082 
2083                 if (stp->sd_sidp) {
2084                         prsignal(stp->sd_sidp, SIGHUP);
2085                         if (stp->sd_sidp != stp->sd_pgidp)
2086                                 pgsignal(stp->sd_pgidp, SIGTSTP);
2087                 }
2088 
2089                 /*
2090                  * wake up read, write, and exception pollers and
2091                  * reset wakeup mechanism.
2092                  */
2093                 cv_broadcast(&q->q_wait);        /* the readers */
2094                 cv_broadcast(&_WR(q)->q_wait);   /* the writers */
2095                 cv_broadcast(&stp->sd_monitor);  /* the ioctllers */
2096                 strhup(stp);
2097                 mutex_exit(&stp->sd_lock);
2098                 return (0);
2099 
2100         case M_UNHANGUP:
2101                 freemsg(bp);
2102                 mutex_enter(&stp->sd_lock);
2103                 stp->sd_werror = 0;
2104                 stp->sd_flag &= ~STRHUP;
2105                 mutex_exit(&stp->sd_lock);
2106                 return (0);
2107 
2108         case M_SIG:
2109                 /*
2110                  * Someone downstream wants to post a signal.  The
2111                  * signal to post is contained in the first byte of the
2112                  * message.  If the message would go on the front of
2113                  * the queue, send a signal to the process group
2114                  * (if not SIGPOLL) or to the siglist processes
2115                  * (SIGPOLL).  If something is already on the queue,
2116                  * OR if we are delivering a delayed suspend (*sigh*
2117                  * another "tty" hack) and there's no one sleeping already,
2118                  * just enqueue the message.
2119                  */
2120                 mutex_enter(&stp->sd_lock);
2121                 if (q->q_first || (*bp->b_rptr == SIGTSTP &&
2122                     !(stp->sd_flag & RSLEEP))) {
2123                         (void) putq(q, bp);
2124                         mutex_exit(&stp->sd_lock);
2125                         return (0);
2126                 }
2127                 mutex_exit(&stp->sd_lock);
2128                 /* FALLTHRU */
2129 
2130         case M_PCSIG:
2131                 /*
2132                  * Don't enqueue, just post the signal.
2133                  */
2134                 strsignal(stp, *bp->b_rptr, 0L);
2135                 freemsg(bp);
2136                 return (0);
2137 
2138         case M_CMD:
2139                 if (MBLKL(bp) != sizeof (cmdblk_t)) {
2140                         freemsg(bp);
2141                         return (0);
2142                 }
2143 
2144                 mutex_enter(&stp->sd_lock);
2145                 if (stp->sd_flag & STRCMDWAIT) {
2146                         ASSERT(stp->sd_cmdblk == NULL);
2147                         stp->sd_cmdblk = bp;
2148                         cv_broadcast(&stp->sd_monitor);
2149                         mutex_exit(&stp->sd_lock);
2150                 } else {
2151                         mutex_exit(&stp->sd_lock);
2152                         freemsg(bp);
2153                 }
2154                 return (0);
2155 
2156         case M_FLUSH:
2157                 /*
2158                  * Flush queues.  The indication of which queues to flush
2159                  * is in the first byte of the message.  If the read queue
2160                  * is specified, then flush it.  If FLUSHBAND is set, just
2161                  * flush the band specified by the second byte of the message.
2162                  *
2163                  * If a module has issued a M_SETOPT to not flush hi
2164                  * priority messages off of the stream head, then pass this
2165                  * flag into the flushq code to preserve such messages.
2166                  */
2167 
2168                 if (*bp->b_rptr & FLUSHR) {
2169                         mutex_enter(&stp->sd_lock);
2170                         if (*bp->b_rptr & FLUSHBAND) {
2171                                 ASSERT((bp->b_wptr - bp->b_rptr) >= 2);
2172                                 flushband(q, *(bp->b_rptr + 1), FLUSHALL);
2173                         } else
2174                                 flushq_common(q, FLUSHALL,
2175                                     stp->sd_read_opt & RFLUSHPCPROT);
2176                         if ((q->q_first == NULL) ||
2177                             (q->q_first->b_datap->db_type < QPCTL))
2178                                 stp->sd_flag &= ~STRPRI;
2179                         else {
2180                                 ASSERT(stp->sd_flag & STRPRI);
2181                         }
2182                         mutex_exit(&stp->sd_lock);
2183                 }
2184                 if ((*bp->b_rptr & FLUSHW) && !(bp->b_flag & MSGNOLOOP)) {
2185                         *bp->b_rptr &= ~FLUSHR;
2186                         bp->b_flag |= MSGNOLOOP;
2187                         /*
2188                          * Protect against the driver passing up
2189                          * messages after it has done a qprocsoff.
2190                          */
2191                         if (_OTHERQ(q)->q_next == NULL)
2192                                 freemsg(bp);
2193                         else
2194                                 qreply(q, bp);
2195                         return (0);
2196                 }
2197                 freemsg(bp);
2198                 return (0);
2199 
2200         case M_IOCACK:
2201         case M_IOCNAK:
2202                 iocbp = (struct iocblk *)bp->b_rptr;
2203                 /*
2204                  * If not waiting for ACK or NAK then just free msg.
2205                  * If incorrect id sequence number then just free msg.
2206                  * If already have ACK or NAK for user then this is a
2207                  *    duplicate, display a warning and free the msg.
2208                  */
2209                 mutex_enter(&stp->sd_lock);
2210                 if ((stp->sd_flag & IOCWAIT) == 0 || stp->sd_iocblk ||
2211                     (stp->sd_iocid != iocbp->ioc_id)) {
2212                         /*
2213                          * If the ACK/NAK is a dup, display a message
2214                          * Dup is when sd_iocid == ioc_id, and
2215                          * sd_iocblk == <valid ptr> or -1 (the former
2216                          * is when an ioctl has been put on the stream
2217                          * head, but has not yet been consumed, the
2218                          * later is when it has been consumed).
2219                          */
2220                         if ((stp->sd_iocid == iocbp->ioc_id) &&
2221                             (stp->sd_iocblk != NULL)) {
2222                                 log_dupioc(q, bp);
2223                         }
2224                         freemsg(bp);
2225                         mutex_exit(&stp->sd_lock);
2226                         return (0);
2227                 }
2228 
2229                 /*
2230                  * Assign ACK or NAK to user and wake up.
2231                  */
2232                 stp->sd_iocblk = bp;
2233                 cv_broadcast(&stp->sd_monitor);
2234                 mutex_exit(&stp->sd_lock);
2235                 return (0);
2236 
2237         case M_COPYIN:
2238         case M_COPYOUT:
2239                 reqp = (struct copyreq *)bp->b_rptr;
2240 
2241                 /*
2242                  * If not waiting for ACK or NAK then just fail request.
2243                  * If already have ACK, NAK, or copy request, then just
2244                  * fail request.
2245                  * If incorrect id sequence number then just fail request.
2246                  */
2247                 mutex_enter(&stp->sd_lock);
2248                 if ((stp->sd_flag & IOCWAIT) == 0 || stp->sd_iocblk ||
2249                     (stp->sd_iocid != reqp->cq_id)) {
2250                         if (bp->b_cont) {
2251                                 freemsg(bp->b_cont);
2252                                 bp->b_cont = NULL;
2253                         }
2254                         bp->b_datap->db_type = M_IOCDATA;
2255                         bp->b_wptr = bp->b_rptr + sizeof (struct copyresp);
2256                         resp = (struct copyresp *)bp->b_rptr;
2257                         resp->cp_rval = (caddr_t)1;  /* failure */
2258                         mutex_exit(&stp->sd_lock);
2259                         putnext(stp->sd_wrq, bp);
2260                         return (0);
2261                 }
2262 
2263                 /*
2264                  * Assign copy request to user and wake up.
2265                  */
2266                 stp->sd_iocblk = bp;
2267                 cv_broadcast(&stp->sd_monitor);
2268                 mutex_exit(&stp->sd_lock);
2269                 return (0);
2270 
2271         case M_SETOPTS:
2272                 /*
2273                  * Set stream head options (read option, write offset,
2274                  * min/max packet size, and/or high/low water marks for
2275                  * the read side only).
2276                  */
2277 
2278                 bpri = 0;
2279                 sop = (struct stroptions *)bp->b_rptr;
2280                 mutex_enter(&stp->sd_lock);
2281                 if (sop->so_flags & SO_READOPT) {
2282                         switch (sop->so_readopt & RMODEMASK) {
2283                         case RNORM:
2284                                 stp->sd_read_opt &= ~(RD_MSGDIS | RD_MSGNODIS);
2285                                 break;
2286 
2287                         case RMSGD:
2288                                 stp->sd_read_opt =
2289                                     ((stp->sd_read_opt & ~RD_MSGNODIS) |
2290                                     RD_MSGDIS);
2291                                 break;
2292 
2293                         case RMSGN:
2294                                 stp->sd_read_opt =
2295                                     ((stp->sd_read_opt & ~RD_MSGDIS) |
2296                                     RD_MSGNODIS);
2297                                 break;
2298                         }
2299                         switch (sop->so_readopt & RPROTMASK) {
2300                         case RPROTNORM:
2301                                 stp->sd_read_opt &= ~(RD_PROTDAT | RD_PROTDIS);
2302                                 break;
2303 
2304                         case RPROTDAT:
2305                                 stp->sd_read_opt =
2306                                     ((stp->sd_read_opt & ~RD_PROTDIS) |
2307                                     RD_PROTDAT);
2308                                 break;
2309 
2310                         case RPROTDIS:
2311                                 stp->sd_read_opt =
2312                                     ((stp->sd_read_opt & ~RD_PROTDAT) |
2313                                     RD_PROTDIS);
2314                                 break;
2315                         }
2316                         switch (sop->so_readopt & RFLUSHMASK) {
2317                         case RFLUSHPCPROT:
2318                                 /*
2319                                  * This sets the stream head to NOT flush
2320                                  * M_PCPROTO messages.
2321                                  */
2322                                 stp->sd_read_opt |= RFLUSHPCPROT;
2323                                 break;
2324                         }
2325                 }
2326                 if (sop->so_flags & SO_ERROPT) {
2327                         switch (sop->so_erropt & RERRMASK) {
2328                         case RERRNORM:
2329                                 stp->sd_flag &= ~STRDERRNONPERSIST;
2330                                 break;
2331                         case RERRNONPERSIST:
2332                                 stp->sd_flag |= STRDERRNONPERSIST;
2333                                 break;
2334                         }
2335                         switch (sop->so_erropt & WERRMASK) {
2336                         case WERRNORM:
2337                                 stp->sd_flag &= ~STWRERRNONPERSIST;
2338                                 break;
2339                         case WERRNONPERSIST:
2340                                 stp->sd_flag |= STWRERRNONPERSIST;
2341                                 break;
2342                         }
2343                 }
2344                 if (sop->so_flags & SO_COPYOPT) {
2345                         if (sop->so_copyopt & ZCVMSAFE) {
2346                                 stp->sd_copyflag |= STZCVMSAFE;
2347                                 stp->sd_copyflag &= ~STZCVMUNSAFE;
2348                         } else if (sop->so_copyopt & ZCVMUNSAFE) {
2349                                 stp->sd_copyflag |= STZCVMUNSAFE;
2350                                 stp->sd_copyflag &= ~STZCVMSAFE;
2351                         }
2352 
2353                         if (sop->so_copyopt & COPYCACHED) {
2354                                 stp->sd_copyflag |= STRCOPYCACHED;
2355                         }
2356                 }
2357                 if (sop->so_flags & SO_WROFF)
2358                         stp->sd_wroff = sop->so_wroff;
2359                 if (sop->so_flags & SO_TAIL)
2360                         stp->sd_tail = sop->so_tail;
2361                 if (sop->so_flags & SO_MINPSZ)
2362                         q->q_minpsz = sop->so_minpsz;
2363                 if (sop->so_flags & SO_MAXPSZ)
2364                         q->q_maxpsz = sop->so_maxpsz;
2365                 if (sop->so_flags & SO_MAXBLK)
2366                         stp->sd_maxblk = sop->so_maxblk;
2367                 if (sop->so_flags & SO_HIWAT) {
2368                         if (sop->so_flags & SO_BAND) {
2369                                 if (strqset(q, QHIWAT,
2370                                     sop->so_band, sop->so_hiwat)) {
2371                                         cmn_err(CE_WARN, "strrput: could not "
2372                                             "allocate qband\n");
2373                                 } else {
2374                                         bpri = sop->so_band;
2375                                 }
2376                         } else {
2377                                 q->q_hiwat = sop->so_hiwat;
2378                         }
2379                 }
2380                 if (sop->so_flags & SO_LOWAT) {
2381                         if (sop->so_flags & SO_BAND) {
2382                                 if (strqset(q, QLOWAT,
2383                                     sop->so_band, sop->so_lowat)) {
2384                                         cmn_err(CE_WARN, "strrput: could not "
2385                                             "allocate qband\n");
2386                                 } else {
2387                                         bpri = sop->so_band;
2388                                 }
2389                         } else {
2390                                 q->q_lowat = sop->so_lowat;
2391                         }
2392                 }
2393                 if (sop->so_flags & SO_MREADON)
2394                         stp->sd_flag |= SNDMREAD;
2395                 if (sop->so_flags & SO_MREADOFF)
2396                         stp->sd_flag &= ~SNDMREAD;
2397                 if (sop->so_flags & SO_NDELON)
2398                         stp->sd_flag |= OLDNDELAY;
2399                 if (sop->so_flags & SO_NDELOFF)
2400                         stp->sd_flag &= ~OLDNDELAY;
2401                 if (sop->so_flags & SO_ISTTY)
2402                         stp->sd_flag |= STRISTTY;
2403                 if (sop->so_flags & SO_ISNTTY)
2404                         stp->sd_flag &= ~STRISTTY;
2405                 if (sop->so_flags & SO_TOSTOP)
2406                         stp->sd_flag |= STRTOSTOP;
2407                 if (sop->so_flags & SO_TONSTOP)
2408                         stp->sd_flag &= ~STRTOSTOP;
2409                 if (sop->so_flags & SO_DELIM)
2410                         stp->sd_flag |= STRDELIM;
2411                 if (sop->so_flags & SO_NODELIM)
2412                         stp->sd_flag &= ~STRDELIM;
2413 
2414                 mutex_exit(&stp->sd_lock);
2415                 freemsg(bp);
2416 
2417                 /* Check backenable in case the water marks changed */
2418                 qbackenable(q, bpri);
2419                 return (0);
2420 
2421         /*
2422          * The following set of cases deal with situations where two stream
2423          * heads are connected to each other (twisted streams).  These messages
2424          * have no meaning at the stream head.
2425          */
2426         case M_BREAK:
2427         case M_CTL:
2428         case M_DELAY:
2429         case M_START:
2430         case M_STOP:
2431         case M_IOCDATA:
2432         case M_STARTI:
2433         case M_STOPI:
2434                 freemsg(bp);
2435                 return (0);
2436 
2437         case M_IOCTL:
2438                 /*
2439                  * Always NAK this condition
2440                  * (makes no sense)
2441                  * If there is one or more threads in the read side
2442                  * rwnext we have to defer the nacking until that thread
2443                  * returns (in strget).
2444                  */
2445                 mutex_enter(&stp->sd_lock);
2446                 if (stp->sd_struiodnak != 0) {
2447                         /*
2448                          * Defer NAK to the streamhead. Queue at the end
2449                          * the list.
2450                          */
2451                         mblk_t *mp = stp->sd_struionak;
2452 
2453                         while (mp && mp->b_next)
2454                                 mp = mp->b_next;
2455                         if (mp)
2456                                 mp->b_next = bp;
2457                         else
2458                                 stp->sd_struionak = bp;
2459                         bp->b_next = NULL;
2460                         mutex_exit(&stp->sd_lock);
2461                         return (0);
2462                 }
2463                 mutex_exit(&stp->sd_lock);
2464 
2465                 bp->b_datap->db_type = M_IOCNAK;
2466                 /*
2467                  * Protect against the driver passing up
2468                  * messages after it has done a qprocsoff.
2469                  */
2470                 if (_OTHERQ(q)->q_next == NULL)
2471                         freemsg(bp);
2472                 else
2473                         qreply(q, bp);
2474                 return (0);
2475 
2476         default:
2477 #ifdef DEBUG
2478                 cmn_err(CE_WARN,
2479                     "bad message type %x received at stream head\n",
2480                     bp->b_datap->db_type);
2481 #endif
2482                 freemsg(bp);
2483                 return (0);
2484         }
2485 
2486         /* NOTREACHED */
2487 }
2488 
2489 /*
2490  * Check if the stream pointed to by `stp' can be written to, and return an
2491  * error code if not.  If `eiohup' is set, then return EIO if STRHUP is set.
2492  * If `sigpipeok' is set and the SW_SIGPIPE option is enabled on the stream,
2493  * then always return EPIPE and send a SIGPIPE to the invoking thread.
2494  */
2495 static int
2496 strwriteable(struct stdata *stp, boolean_t eiohup, boolean_t sigpipeok)
2497 {
2498         int error;
2499 
2500         ASSERT(MUTEX_HELD(&stp->sd_lock));
2501 
2502         /*
2503          * For modem support, POSIX states that on writes, EIO should
2504          * be returned if the stream has been hung up.
2505          */
2506         if (eiohup && (stp->sd_flag & (STPLEX|STRHUP)) == STRHUP)
2507                 error = EIO;
2508         else
2509                 error = strgeterr(stp, STRHUP|STPLEX|STWRERR, 0);
2510 
2511         if (error != 0) {
2512                 if (!(stp->sd_flag & STPLEX) &&
2513                     (stp->sd_wput_opt & SW_SIGPIPE) && sigpipeok) {
2514                         tsignal(curthread, SIGPIPE);
2515                         error = EPIPE;
2516                 }
2517         }
2518 
2519         return (error);
2520 }
2521 
2522 /*
2523  * Copyin and send data down a stream.
2524  * The caller will allocate and copyin any control part that precedes the
2525  * message and pass that in as mctl.
2526  *
2527  * Caller should *not* hold sd_lock.
2528  * When EWOULDBLOCK is returned the caller has to redo the canputnext
2529  * under sd_lock in order to avoid missing a backenabling wakeup.
2530  *
2531  * Use iosize = -1 to not send any M_DATA. iosize = 0 sends zero-length M_DATA.
2532  *
2533  * Set MSG_IGNFLOW in flags to ignore flow control for hipri messages.
2534  * For sync streams we can only ignore flow control by reverting to using
2535  * putnext.
2536  *
2537  * If sd_maxblk is less than *iosize this routine might return without
2538  * transferring all of *iosize. In all cases, on return *iosize will contain
2539  * the amount of data that was transferred.
2540  */
2541 static int
2542 strput(struct stdata *stp, mblk_t *mctl, struct uio *uiop, ssize_t *iosize,
2543     int b_flag, int pri, int flags)
2544 {
2545         struiod_t uiod;
2546         mblk_t *mp;
2547         queue_t *wqp = stp->sd_wrq;
2548         int error = 0;
2549         ssize_t count = *iosize;
2550 
2551         ASSERT(MUTEX_NOT_HELD(&stp->sd_lock));
2552 
2553         if (uiop != NULL && count >= 0)
2554                 flags |= stp->sd_struiowrq ? STRUIO_POSTPONE : 0;
2555 
2556         if (!(flags & STRUIO_POSTPONE)) {
2557                 /*
2558                  * Use regular canputnext, strmakedata, putnext sequence.
2559                  */
2560                 if (pri == 0) {
2561                         if (!canputnext(wqp) && !(flags & MSG_IGNFLOW)) {
2562                                 freemsg(mctl);
2563                                 return (EWOULDBLOCK);
2564                         }
2565                 } else {
2566                         if (!(flags & MSG_IGNFLOW) && !bcanputnext(wqp, pri)) {
2567                                 freemsg(mctl);
2568                                 return (EWOULDBLOCK);
2569                         }
2570                 }
2571 
2572                 if ((error = strmakedata(iosize, uiop, stp, flags,
2573                     &mp)) != 0) {
2574                         freemsg(mctl);
2575                         /*
2576                          * need to change return code to ENOMEM
2577                          * so that this is not confused with
2578                          * flow control, EAGAIN.
2579                          */
2580 
2581                         if (error == EAGAIN)
2582                                 return (ENOMEM);
2583                         else
2584                                 return (error);
2585                 }
2586                 if (mctl != NULL) {
2587                         if (mctl->b_cont == NULL)
2588                                 mctl->b_cont = mp;
2589                         else if (mp != NULL)
2590                                 linkb(mctl, mp);
2591                         mp = mctl;
2592                 } else if (mp == NULL)
2593                         return (0);
2594 
2595                 mp->b_flag |= b_flag;
2596                 mp->b_band = (uchar_t)pri;
2597 
2598                 if (flags & MSG_IGNFLOW) {
2599                         /*
2600                          * XXX Hack: Don't get stuck running service
2601                          * procedures. This is needed for sockfs when
2602                          * sending the unbind message out of the rput
2603                          * procedure - we don't want a put procedure
2604                          * to run service procedures.
2605                          */
2606                         putnext(wqp, mp);
2607                 } else {
2608                         stream_willservice(stp);
2609                         putnext(wqp, mp);
2610                         stream_runservice(stp);
2611                 }
2612                 return (0);
2613         }
2614         /*
2615          * Stream supports rwnext() for the write side.
2616          */
2617         if ((error = strmakedata(iosize, uiop, stp, flags, &mp)) != 0) {
2618                 freemsg(mctl);
2619                 /*
2620                  * map EAGAIN to ENOMEM since EAGAIN means "flow controlled".
2621                  */
2622                 return (error == EAGAIN ? ENOMEM : error);
2623         }
2624         if (mctl != NULL) {
2625                 if (mctl->b_cont == NULL)
2626                         mctl->b_cont = mp;
2627                 else if (mp != NULL)
2628                         linkb(mctl, mp);
2629                 mp = mctl;
2630         } else if (mp == NULL) {
2631                 return (0);
2632         }
2633 
2634         mp->b_flag |= b_flag;
2635         mp->b_band = (uchar_t)pri;
2636 
2637         (void) uiodup(uiop, &uiod.d_uio, uiod.d_iov,
2638             sizeof (uiod.d_iov) / sizeof (*uiod.d_iov));
2639         uiod.d_uio.uio_offset = 0;
2640         uiod.d_mp = mp;
2641         error = rwnext(wqp, &uiod);
2642         if (! uiod.d_mp) {
2643                 uioskip(uiop, *iosize);
2644                 return (error);
2645         }
2646         ASSERT(mp == uiod.d_mp);
2647         if (error == EINVAL) {
2648                 /*
2649                  * The stream plumbing must have changed while
2650                  * we were away, so just turn off rwnext()s.
2651                  */
2652                 error = 0;
2653         } else if (error == EBUSY || error == EWOULDBLOCK) {
2654                 /*
2655                  * Couldn't enter a perimeter or took a page fault,
2656                  * so fall-back to putnext().
2657                  */
2658                 error = 0;
2659         } else {
2660                 freemsg(mp);
2661                 return (error);
2662         }
2663         /* Have to check canput before consuming data from the uio */
2664         if (pri == 0) {
2665                 if (!canputnext(wqp) && !(flags & MSG_IGNFLOW)) {
2666                         freemsg(mp);
2667                         return (EWOULDBLOCK);
2668                 }
2669         } else {
2670                 if (!bcanputnext(wqp, pri) && !(flags & MSG_IGNFLOW)) {
2671                         freemsg(mp);
2672                         return (EWOULDBLOCK);
2673                 }
2674         }
2675         ASSERT(mp == uiod.d_mp);
2676         /* Copyin data from the uio */
2677         if ((error = struioget(wqp, mp, &uiod, 0)) != 0) {
2678                 freemsg(mp);
2679                 return (error);
2680         }
2681         uioskip(uiop, *iosize);
2682         if (flags & MSG_IGNFLOW) {
2683                 /*
2684                  * XXX Hack: Don't get stuck running service procedures.
2685                  * This is needed for sockfs when sending the unbind message
2686                  * out of the rput procedure - we don't want a put procedure
2687                  * to run service procedures.
2688                  */
2689                 putnext(wqp, mp);
2690         } else {
2691                 stream_willservice(stp);
2692                 putnext(wqp, mp);
2693                 stream_runservice(stp);
2694         }
2695         return (0);
2696 }
2697 
2698 /*
2699  * Write attempts to break the write request into messages conforming
2700  * with the minimum and maximum packet sizes set downstream.
2701  *
2702  * Write will not block if downstream queue is full and
2703  * O_NDELAY is set, otherwise it will block waiting for the queue to get room.
2704  *
2705  * A write of zero bytes gets packaged into a zero length message and sent
2706  * downstream like any other message.
2707  *
2708  * If buffers of the requested sizes are not available, the write will
2709  * sleep until the buffers become available.
2710  *
2711  * Write (if specified) will supply a write offset in a message if it
2712  * makes sense. This can be specified by downstream modules as part of
2713  * a M_SETOPTS message.  Write will not supply the write offset if it
2714  * cannot supply any data in a buffer.  In other words, write will never
2715  * send down an empty packet due to a write offset.
2716  */
2717 /* ARGSUSED2 */
2718 int
2719 strwrite(struct vnode *vp, struct uio *uiop, cred_t *crp)
2720 {
2721         return (strwrite_common(vp, uiop, crp, 0));
2722 }
2723 
2724 /* ARGSUSED2 */
2725 int
2726 strwrite_common(struct vnode *vp, struct uio *uiop, cred_t *crp, int wflag)
2727 {
2728         struct stdata *stp;
2729         struct queue *wqp;
2730         ssize_t rmin, rmax;
2731         ssize_t iosize;
2732         int waitflag;
2733         int tempmode;
2734         int error = 0;
2735         int b_flag;
2736 
2737         ASSERT(vp->v_stream);
2738         stp = vp->v_stream;
2739 
2740         mutex_enter(&stp->sd_lock);
2741 
2742         if ((error = i_straccess(stp, JCWRITE)) != 0) {
2743                 mutex_exit(&stp->sd_lock);
2744                 return (error);
2745         }
2746 
2747         if (stp->sd_flag & (STWRERR|STRHUP|STPLEX)) {
2748                 error = strwriteable(stp, B_TRUE, B_TRUE);
2749                 if (error != 0) {
2750                         mutex_exit(&stp->sd_lock);
2751                         return (error);
2752                 }
2753         }
2754 
2755         mutex_exit(&stp->sd_lock);
2756 
2757         wqp = stp->sd_wrq;
2758 
2759         /* get these values from them cached in the stream head */
2760         rmin = stp->sd_qn_minpsz;
2761         rmax = stp->sd_qn_maxpsz;
2762 
2763         /*
2764          * Check the min/max packet size constraints.  If min packet size
2765          * is non-zero, the write cannot be split into multiple messages
2766          * and still guarantee the size constraints.
2767          */
2768         TRACE_1(TR_FAC_STREAMS_FR, TR_STRWRITE_IN, "strwrite in:q %p", wqp);
2769 
2770         ASSERT((rmax >= 0) || (rmax == INFPSZ));
2771         if (rmax == 0) {
2772                 return (0);
2773         }
2774         if (rmin > 0) {
2775                 if (uiop->uio_resid < rmin) {
2776                         TRACE_3(TR_FAC_STREAMS_FR, TR_STRWRITE_OUT,
2777                             "strwrite out:q %p out %d error %d",
2778                             wqp, 0, ERANGE);
2779                         return (ERANGE);
2780                 }
2781                 if ((rmax != INFPSZ) && (uiop->uio_resid > rmax)) {
2782                         TRACE_3(TR_FAC_STREAMS_FR, TR_STRWRITE_OUT,
2783                             "strwrite out:q %p out %d error %d",
2784                             wqp, 1, ERANGE);
2785                         return (ERANGE);
2786                 }
2787         }
2788 
2789         /*
2790          * Do until count satisfied or error.
2791          */
2792         waitflag = WRITEWAIT | wflag;
2793         if (stp->sd_flag & OLDNDELAY)
2794                 tempmode = uiop->uio_fmode & ~FNDELAY;
2795         else
2796                 tempmode = uiop->uio_fmode;
2797 
2798         if (rmax == INFPSZ)
2799                 rmax = uiop->uio_resid;
2800 
2801         /*
2802          * Note that tempmode does not get used in strput/strmakedata
2803          * but only in strwaitq. The other routines use uio_fmode
2804          * unmodified.
2805          */
2806 
2807         /* LINTED: constant in conditional context */
2808         while (1) {     /* breaks when uio_resid reaches zero */
2809                 /*
2810                  * Determine the size of the next message to be
2811                  * packaged.  May have to break write into several
2812                  * messages based on max packet size.
2813                  */
2814                 iosize = MIN(uiop->uio_resid, rmax);
2815 
2816                 /*
2817                  * Put block downstream when flow control allows it.
2818                  */
2819                 if ((stp->sd_flag & STRDELIM) && (uiop->uio_resid == iosize))
2820                         b_flag = MSGDELIM;
2821                 else
2822                         b_flag = 0;
2823 
2824                 for (;;) {
2825                         int done = 0;
2826 
2827                         error = strput(stp, NULL, uiop, &iosize, b_flag, 0, 0);
2828                         if (error == 0)
2829                                 break;
2830                         if (error != EWOULDBLOCK)
2831                                 goto out;
2832 
2833                         mutex_enter(&stp->sd_lock);
2834                         /*
2835                          * Check for a missed wakeup.
2836                          * Needed since strput did not hold sd_lock across
2837                          * the canputnext.
2838                          */
2839                         if (canputnext(wqp)) {
2840                                 /* Try again */
2841                                 mutex_exit(&stp->sd_lock);
2842                                 continue;
2843                         }
2844                         TRACE_1(TR_FAC_STREAMS_FR, TR_STRWRITE_WAIT,
2845                             "strwrite wait:q %p wait", wqp);
2846                         if ((error = strwaitq(stp, waitflag, (ssize_t)0,
2847                             tempmode, -1, &done)) != 0 || done) {
2848                                 mutex_exit(&stp->sd_lock);
2849                                 if ((vp->v_type == VFIFO) &&
2850                                     (uiop->uio_fmode & FNDELAY) &&
2851                                     (error == EAGAIN))
2852                                         error = 0;
2853                                 goto out;
2854                         }
2855                         TRACE_1(TR_FAC_STREAMS_FR, TR_STRWRITE_WAKE,
2856                             "strwrite wake:q %p awakes", wqp);
2857                         if ((error = i_straccess(stp, JCWRITE)) != 0) {
2858                                 mutex_exit(&stp->sd_lock);
2859                                 goto out;
2860                         }
2861                         mutex_exit(&stp->sd_lock);
2862                 }
2863                 waitflag |= NOINTR;
2864                 TRACE_2(TR_FAC_STREAMS_FR, TR_STRWRITE_RESID,
2865                     "strwrite resid:q %p uiop %p", wqp, uiop);
2866                 if (uiop->uio_resid) {
2867                         /* Recheck for errors - needed for sockets */
2868                         if ((stp->sd_wput_opt & SW_RECHECK_ERR) &&
2869                             (stp->sd_flag & (STWRERR|STRHUP|STPLEX))) {
2870                                 mutex_enter(&stp->sd_lock);
2871                                 error = strwriteable(stp, B_FALSE, B_TRUE);
2872                                 mutex_exit(&stp->sd_lock);
2873                                 if (error != 0)
2874                                         return (error);
2875                         }
2876                         continue;
2877                 }
2878                 break;
2879         }
2880 out:
2881         /*
2882          * For historical reasons, applications expect EAGAIN when a data
2883          * mblk_t cannot be allocated, so change ENOMEM back to EAGAIN.
2884          */
2885         if (error == ENOMEM)
2886                 error = EAGAIN;
2887         TRACE_3(TR_FAC_STREAMS_FR, TR_STRWRITE_OUT,
2888             "strwrite out:q %p out %d error %d", wqp, 2, error);
2889         return (error);
2890 }
2891 
2892 /*
2893  * Stream head write service routine.
2894  * Its job is to wake up any sleeping writers when a queue
2895  * downstream needs data (part of the flow control in putq and getq).
2896  * It also must wake anyone sleeping on a poll().
2897  * For stream head right below mux module, it must also invoke put procedure
2898  * of next downstream module.
2899  */
2900 int
2901 strwsrv(queue_t *q)
2902 {
2903         struct stdata *stp;
2904         queue_t *tq;
2905         qband_t *qbp;
2906         int i;
2907         qband_t *myqbp;
2908         int isevent;
2909         unsigned char   qbf[NBAND];     /* band flushing backenable flags */
2910 
2911         TRACE_1(TR_FAC_STREAMS_FR,
2912             TR_STRWSRV, "strwsrv:q %p", q);
2913         stp = (struct stdata *)q->q_ptr;
2914         ASSERT(qclaimed(q));
2915         mutex_enter(&stp->sd_lock);
2916         ASSERT(!(stp->sd_flag & STPLEX));
2917 
2918         if (stp->sd_flag & WSLEEP) {
2919                 stp->sd_flag &= ~WSLEEP;
2920                 cv_broadcast(&q->q_wait);
2921         }
2922         mutex_exit(&stp->sd_lock);
2923 
2924         /* The other end of a stream pipe went away. */
2925         if ((tq = q->q_next) == NULL) {
2926                 return (0);
2927         }
2928 
2929         /* Find the next module forward that has a service procedure */
2930         claimstr(q);
2931         tq = q->q_nfsrv;
2932         ASSERT(tq != NULL);
2933 
2934         if ((q->q_flag & QBACK)) {
2935                 if ((tq->q_flag & QFULL)) {
2936                         mutex_enter(QLOCK(tq));
2937                         if (!(tq->q_flag & QFULL)) {
2938                                 mutex_exit(QLOCK(tq));
2939                                 goto wakeup;
2940                         }
2941                         /*
2942                          * The queue must have become full again. Set QWANTW
2943                          * again so strwsrv will be back enabled when
2944                          * the queue becomes non-full next time.
2945                          */
2946                         tq->q_flag |= QWANTW;
2947                         mutex_exit(QLOCK(tq));
2948                 } else {
2949                 wakeup:
2950                         pollwakeup(&stp->sd_pollist, POLLWRNORM);
2951                         mutex_enter(&stp->sd_lock);
2952                         if (stp->sd_sigflags & S_WRNORM)
2953                                 strsendsig(stp->sd_siglist, S_WRNORM, 0, 0);
2954                         mutex_exit(&stp->sd_lock);
2955                 }
2956         }
2957 
2958         isevent = 0;
2959         i = 1;
2960         bzero((caddr_t)qbf, NBAND);
2961         mutex_enter(QLOCK(tq));
2962         if ((myqbp = q->q_bandp) != NULL)
2963                 for (qbp = tq->q_bandp; qbp && myqbp; qbp = qbp->qb_next) {
2964                         ASSERT(myqbp);
2965                         if ((myqbp->qb_flag & QB_BACK)) {
2966                                 if (qbp->qb_flag & QB_FULL) {
2967                                         /*
2968                                          * The band must have become full again.
2969                                          * Set QB_WANTW again so strwsrv will
2970                                          * be back enabled when the band becomes
2971                                          * non-full next time.
2972                                          */
2973                                         qbp->qb_flag |= QB_WANTW;
2974                                 } else {
2975                                         isevent = 1;
2976                                         qbf[i] = 1;
2977                                 }
2978                         }
2979                         myqbp = myqbp->qb_next;
2980                         i++;
2981                 }
2982         mutex_exit(QLOCK(tq));
2983 
2984         if (isevent) {
2985                 for (i = tq->q_nband; i; i--) {
2986                         if (qbf[i]) {
2987                                 pollwakeup(&stp->sd_pollist, POLLWRBAND);
2988                                 mutex_enter(&stp->sd_lock);
2989                                 if (stp->sd_sigflags & S_WRBAND)
2990                                         strsendsig(stp->sd_siglist, S_WRBAND,
2991                                             (uchar_t)i, 0);
2992                                 mutex_exit(&stp->sd_lock);
2993                         }
2994                 }
2995         }
2996 
2997         releasestr(q);
2998         return (0);
2999 }
3000 
3001 /*
3002  * Special case of strcopyin/strcopyout for copying
3003  * struct strioctl that can deal with both data
3004  * models.
3005  */
3006 
3007 #ifdef  _LP64
3008 
3009 static int
3010 strcopyin_strioctl(void *from, void *to, int flag, int copyflag)
3011 {
3012         struct  strioctl32 strioc32;
3013         struct  strioctl *striocp;
3014 
3015         if (copyflag & U_TO_K) {
3016                 ASSERT((copyflag & K_TO_K) == 0);
3017 
3018                 if ((flag & FMODELS) == DATAMODEL_ILP32) {
3019                         if (copyin(from, &strioc32, sizeof (strioc32)))
3020                                 return (EFAULT);
3021 
3022                         striocp = (struct strioctl *)to;
3023                         striocp->ic_cmd      = strioc32.ic_cmd;
3024                         striocp->ic_timout = strioc32.ic_timout;
3025                         striocp->ic_len      = strioc32.ic_len;
3026                         striocp->ic_dp       = (char *)(uintptr_t)strioc32.ic_dp;
3027 
3028                 } else { /* NATIVE data model */
3029                         if (copyin(from, to, sizeof (struct strioctl))) {
3030                                 return (EFAULT);
3031                         } else {
3032                                 return (0);
3033                         }
3034                 }
3035         } else {
3036                 ASSERT(copyflag & K_TO_K);
3037                 bcopy(from, to, sizeof (struct strioctl));
3038         }
3039         return (0);
3040 }
3041 
3042 static int
3043 strcopyout_strioctl(void *from, void *to, int flag, int copyflag)
3044 {
3045         struct  strioctl32 strioc32;
3046         struct  strioctl *striocp;
3047 
3048         if (copyflag & U_TO_K) {
3049                 ASSERT((copyflag & K_TO_K) == 0);
3050 
3051                 if ((flag & FMODELS) == DATAMODEL_ILP32) {
3052                         striocp = (struct strioctl *)from;
3053                         strioc32.ic_cmd = striocp->ic_cmd;
3054                         strioc32.ic_timout = striocp->ic_timout;
3055                         strioc32.ic_len = striocp->ic_len;
3056                         strioc32.ic_dp  = (caddr32_t)(uintptr_t)striocp->ic_dp;
3057                         ASSERT((char *)(uintptr_t)strioc32.ic_dp ==
3058                             striocp->ic_dp);
3059 
3060                         if (copyout(&strioc32, to, sizeof (strioc32)))
3061                                 return (EFAULT);
3062 
3063                 } else { /* NATIVE data model */
3064                         if (copyout(from, to, sizeof (struct strioctl))) {
3065                                 return (EFAULT);
3066                         } else {
3067                                 return (0);
3068                         }
3069                 }
3070         } else {
3071                 ASSERT(copyflag & K_TO_K);
3072                 bcopy(from, to, sizeof (struct strioctl));
3073         }
3074         return (0);
3075 }
3076 
3077 #else   /* ! _LP64 */
3078 
3079 /* ARGSUSED2 */
3080 static int
3081 strcopyin_strioctl(void *from, void *to, int flag, int copyflag)
3082 {
3083         return (strcopyin(from, to, sizeof (struct strioctl), copyflag));
3084 }
3085 
3086 /* ARGSUSED2 */
3087 static int
3088 strcopyout_strioctl(void *from, void *to, int flag, int copyflag)
3089 {
3090         return (strcopyout(from, to, sizeof (struct strioctl), copyflag));
3091 }
3092 
3093 #endif  /* _LP64 */
3094 
3095 /*
3096  * Determine type of job control semantics expected by user.  The
3097  * possibilities are:
3098  *      JCREAD  - Behaves like read() on fd; send SIGTTIN
3099  *      JCWRITE - Behaves like write() on fd; send SIGTTOU if TOSTOP set
3100  *      JCSETP  - Sets a value in the stream; send SIGTTOU, ignore TOSTOP
3101  *      JCGETP  - Gets a value in the stream; no signals.
3102  * See straccess in strsubr.c for usage of these values.
3103  *
3104  * This routine also returns -1 for I_STR as a special case; the
3105  * caller must call again with the real ioctl number for
3106  * classification.
3107  */
3108 static int
3109 job_control_type(int cmd)
3110 {
3111         switch (cmd) {
3112         case I_STR:
3113                 return (-1);
3114 
3115         case I_RECVFD:
3116         case I_E_RECVFD:
3117                 return (JCREAD);
3118 
3119         case I_FDINSERT:
3120         case I_SENDFD:
3121                 return (JCWRITE);
3122 
3123         case TCSETA:
3124         case TCSETAW:
3125         case TCSETAF:
3126         case TCSBRK:
3127         case TCXONC:
3128         case TCFLSH:
3129         case TCDSET:    /* Obsolete */
3130         case TIOCSWINSZ:
3131         case TCSETS:
3132         case TCSETSW:
3133         case TCSETSF:
3134         case TIOCSETD:
3135         case TIOCHPCL:
3136         case TIOCSETP:
3137         case TIOCSETN:
3138         case TIOCEXCL:
3139         case TIOCNXCL:
3140         case TIOCFLUSH:
3141         case TIOCSETC:
3142         case TIOCLBIS:
3143         case TIOCLBIC:
3144         case TIOCLSET:
3145         case TIOCSBRK:
3146         case TIOCCBRK:
3147         case TIOCSDTR:
3148         case TIOCCDTR:
3149         case TIOCSLTC:
3150         case TIOCSTOP:
3151         case TIOCSTART:
3152         case TIOCSTI:
3153         case TIOCSPGRP:
3154         case TIOCMSET:
3155         case TIOCMBIS:
3156         case TIOCMBIC:
3157         case TIOCREMOTE:
3158         case TIOCSIGNAL:
3159         case LDSETT:
3160         case LDSMAP:    /* Obsolete */
3161         case DIOCSETP:
3162         case I_FLUSH:
3163         case I_SRDOPT:
3164         case I_SETSIG:
3165         case I_SWROPT:
3166         case I_FLUSHBAND:
3167         case I_SETCLTIME:
3168         case I_SERROPT:
3169         case I_ESETSIG:
3170         case FIONBIO:
3171         case FIOASYNC:
3172         case FIOSETOWN:
3173         case JBOOT:     /* Obsolete */
3174         case JTERM:     /* Obsolete */
3175         case JTIMOM:    /* Obsolete */
3176         case JZOMBOOT:  /* Obsolete */
3177         case JAGENT:    /* Obsolete */
3178         case JTRUN:     /* Obsolete */
3179         case JXTPROTO:  /* Obsolete */
3180                 return (JCSETP);
3181         }
3182 
3183         return (JCGETP);
3184 }
3185 
3186 /*
3187  * ioctl for streams
3188  */
3189 int
3190 strioctl(struct vnode *vp, int cmd, intptr_t arg, int flag, int copyflag,
3191     cred_t *crp, int *rvalp)
3192 {
3193         struct stdata *stp;
3194         struct strcmd *scp;
3195         struct strioctl strioc;
3196         struct uio uio;
3197         struct iovec iov;
3198         int access;
3199         mblk_t *mp;
3200         int error = 0;
3201         int done = 0;
3202         ssize_t rmin, rmax;
3203         queue_t *wrq;
3204         queue_t *rdq;
3205         boolean_t kioctl = B_FALSE;
3206         uint32_t auditing = AU_AUDITING();
3207 
3208         if (flag & FKIOCTL) {
3209                 copyflag = K_TO_K;
3210                 kioctl = B_TRUE;
3211         }
3212         ASSERT(vp->v_stream);
3213         ASSERT(copyflag == U_TO_K || copyflag == K_TO_K);
3214         stp = vp->v_stream;
3215 
3216         TRACE_3(TR_FAC_STREAMS_FR, TR_IOCTL_ENTER,
3217             "strioctl:stp %p cmd %X arg %lX", stp, cmd, arg);
3218 
3219         /*
3220          * If the copy is kernel to kernel, make sure that the FNATIVE
3221          * flag is set.  After this it would be a serious error to have
3222          * no model flag.
3223          */
3224         if (copyflag == K_TO_K)
3225                 flag = (flag & ~FMODELS) | FNATIVE;
3226 
3227         ASSERT((flag & FMODELS) != 0);
3228 
3229         wrq = stp->sd_wrq;
3230         rdq = _RD(wrq);
3231 
3232         access = job_control_type(cmd);
3233 
3234         /* We should never see these here, should be handled by iwscn */
3235         if (cmd == SRIOCSREDIR || cmd == SRIOCISREDIR)
3236                 return (EINVAL);
3237 
3238         mutex_enter(&stp->sd_lock);
3239         if ((access != -1) && ((error = i_straccess(stp, access)) != 0)) {
3240                 mutex_exit(&stp->sd_lock);
3241                 return (error);
3242         }
3243         mutex_exit(&stp->sd_lock);
3244 
3245         /*
3246          * Check for sgttyb-related ioctls first, and complain as
3247          * necessary.
3248          */
3249         switch (cmd) {
3250         case TIOCGETP:
3251         case TIOCSETP:
3252         case TIOCSETN:
3253                 if (sgttyb_handling >= 2 && !sgttyb_complaint) {
3254                         sgttyb_complaint = B_TRUE;
3255                         cmn_err(CE_NOTE,
3256                             "application used obsolete TIOC[GS]ET");
3257                 }
3258                 if (sgttyb_handling >= 3) {
3259                         tsignal(curthread, SIGSYS);
3260                         return (EIO);
3261                 }
3262                 break;
3263         }
3264 
3265         mutex_enter(&stp->sd_lock);
3266 
3267         switch (cmd) {
3268         case I_RECVFD:
3269         case I_E_RECVFD:
3270         case I_PEEK:
3271         case I_NREAD:
3272         case FIONREAD:
3273         case FIORDCHK:
3274         case I_ATMARK:
3275         case FIONBIO:
3276         case FIOASYNC:
3277                 if (stp->sd_flag & (STRDERR|STPLEX)) {
3278                         error = strgeterr(stp, STRDERR|STPLEX, 0);
3279                         if (error != 0) {
3280                                 mutex_exit(&stp->sd_lock);
3281                                 return (error);
3282                         }
3283                 }
3284                 break;
3285 
3286         default:
3287                 if (stp->sd_flag & (STRDERR|STWRERR|STPLEX)) {
3288                         error = strgeterr(stp, STRDERR|STWRERR|STPLEX, 0);
3289                         if (error != 0) {
3290                                 mutex_exit(&stp->sd_lock);
3291                                 return (error);
3292                         }
3293                 }
3294         }
3295 
3296         mutex_exit(&stp->sd_lock);
3297 
3298         switch (cmd) {
3299         default:
3300                 /*
3301                  * The stream head has hardcoded knowledge of a
3302                  * miscellaneous collection of terminal-, keyboard- and
3303                  * mouse-related ioctls, enumerated below.  This hardcoded
3304                  * knowledge allows the stream head to automatically
3305                  * convert transparent ioctl requests made by userland
3306                  * programs into I_STR ioctls which many old STREAMS
3307                  * modules and drivers require.
3308                  *
3309                  * No new ioctls should ever be added to this list.
3310                  * Instead, the STREAMS module or driver should be written
3311                  * to either handle transparent ioctls or require any
3312                  * userland programs to use I_STR ioctls (by returning
3313                  * EINVAL to any transparent ioctl requests).
3314                  *
3315                  * More importantly, removing ioctls from this list should
3316                  * be done with the utmost care, since our STREAMS modules
3317                  * and drivers *count* on the stream head performing this
3318                  * conversion, and thus may panic while processing
3319                  * transparent ioctl request for one of these ioctls (keep
3320                  * in mind that third party modules and drivers may have
3321                  * similar problems).
3322                  */
3323                 if (((cmd & IOCTYPE) == LDIOC) ||
3324                     ((cmd & IOCTYPE) == tIOC) ||
3325                     ((cmd & IOCTYPE) == TIOC) ||
3326                     ((cmd & IOCTYPE) == KIOC) ||
3327                     ((cmd & IOCTYPE) == MSIOC) ||
3328                     ((cmd & IOCTYPE) == VUIOC)) {
3329                         /*
3330                          * The ioctl is a tty ioctl - set up strioc buffer
3331                          * and call strdoioctl() to do the work.
3332                          */
3333                         if (stp->sd_flag & STRHUP)
3334                                 return (ENXIO);
3335                         strioc.ic_cmd = cmd;
3336                         strioc.ic_timout = INFTIM;
3337 
3338                         switch (cmd) {
3339 
3340                         case TCXONC:
3341                         case TCSBRK:
3342                         case TCFLSH:
3343                         case TCDSET:
3344                                 {
3345                                 int native_arg = (int)arg;
3346                                 strioc.ic_len = sizeof (int);
3347                                 strioc.ic_dp = (char *)&native_arg;
3348                                 return (strdoioctl(stp, &strioc, flag,
3349                                     K_TO_K, crp, rvalp));
3350                                 }
3351 
3352                         case TCSETA:
3353                         case TCSETAW:
3354                         case TCSETAF:
3355                                 strioc.ic_len = sizeof (struct termio);
3356                                 strioc.ic_dp = (char *)arg;
3357                                 return (strdoioctl(stp, &strioc, flag,
3358                                     copyflag, crp, rvalp));
3359 
3360                         case TCSETS:
3361                         case TCSETSW:
3362                         case TCSETSF:
3363                                 strioc.ic_len = sizeof (struct termios);
3364                                 strioc.ic_dp = (char *)arg;
3365                                 return (strdoioctl(stp, &strioc, flag,
3366                                     copyflag, crp, rvalp));
3367 
3368                         case LDSETT:
3369                                 strioc.ic_len = sizeof (struct termcb);
3370                                 strioc.ic_dp = (char *)arg;
3371                                 return (strdoioctl(stp, &strioc, flag,
3372                                     copyflag, crp, rvalp));
3373 
3374                         case TIOCSETP:
3375                                 strioc.ic_len = sizeof (struct sgttyb);
3376                                 strioc.ic_dp = (char *)arg;
3377                                 return (strdoioctl(stp, &strioc, flag,
3378                                     copyflag, crp, rvalp));
3379 
3380                         case TIOCSTI:
3381                                 if ((flag & FREAD) == 0 &&
3382                                     secpolicy_sti(crp) != 0) {
3383                                         return (EPERM);
3384                                 }
3385                                 mutex_enter(&stp->sd_lock);
3386                                 mutex_enter(&curproc->p_splock);
3387                                 if (stp->sd_sidp != curproc->p_sessp->s_sidp &&
3388                                     secpolicy_sti(crp) != 0) {
3389                                         mutex_exit(&curproc->p_splock);
3390                                         mutex_exit(&stp->sd_lock);
3391                                         return (EACCES);
3392                                 }
3393                                 mutex_exit(&curproc->p_splock);
3394                                 mutex_exit(&stp->sd_lock);
3395 
3396                                 strioc.ic_len = sizeof (char);
3397                                 strioc.ic_dp = (char *)arg;
3398                                 return (strdoioctl(stp, &strioc, flag,
3399                                     copyflag, crp, rvalp));
3400 
3401                         case TIOCSWINSZ:
3402                                 strioc.ic_len = sizeof (struct winsize);
3403                                 strioc.ic_dp = (char *)arg;
3404                                 return (strdoioctl(stp, &strioc, flag,
3405                                     copyflag, crp, rvalp));
3406 
3407                         case TIOCSSIZE:
3408                                 strioc.ic_len = sizeof (struct ttysize);
3409                                 strioc.ic_dp = (char *)arg;
3410                                 return (strdoioctl(stp, &strioc, flag,
3411                                     copyflag, crp, rvalp));
3412 
3413                         case TIOCSSOFTCAR:
3414                         case KIOCTRANS:
3415                         case KIOCTRANSABLE:
3416                         case KIOCCMD:
3417                         case KIOCSDIRECT:
3418                         case KIOCSCOMPAT:
3419                         case KIOCSKABORTEN:
3420                         case KIOCSRPTDELAY:
3421                         case KIOCSRPTRATE:
3422                         case VUIDSFORMAT:
3423                         case TIOCSPPS:
3424                                 strioc.ic_len = sizeof (int);
3425                                 strioc.ic_dp = (char *)arg;
3426                                 return (strdoioctl(stp, &strioc, flag,
3427                                     copyflag, crp, rvalp));
3428 
3429                         case KIOCSETKEY:
3430                         case KIOCGETKEY:
3431                                 strioc.ic_len = sizeof (struct kiockey);
3432                                 strioc.ic_dp = (char *)arg;
3433                                 return (strdoioctl(stp, &strioc, flag,
3434                                     copyflag, crp, rvalp));
3435 
3436                         case KIOCSKEY:
3437                         case KIOCGKEY:
3438                                 strioc.ic_len = sizeof (struct kiockeymap);
3439                                 strioc.ic_dp = (char *)arg;
3440                                 return (strdoioctl(stp, &strioc, flag,
3441                                     copyflag, crp, rvalp));
3442 
3443                         case KIOCSLED:
3444                                 /* arg is a pointer to char */
3445                                 strioc.ic_len = sizeof (char);
3446                                 strioc.ic_dp = (char *)arg;
3447                                 return (strdoioctl(stp, &strioc, flag,
3448                                     copyflag, crp, rvalp));
3449 
3450                         case MSIOSETPARMS:
3451                                 strioc.ic_len = sizeof (Ms_parms);
3452                                 strioc.ic_dp = (char *)arg;
3453                                 return (strdoioctl(stp, &strioc, flag,
3454                                     copyflag, crp, rvalp));
3455 
3456                         case VUIDSADDR:
3457                         case VUIDGADDR:
3458                                 strioc.ic_len = sizeof (struct vuid_addr_probe);
3459                                 strioc.ic_dp = (char *)arg;
3460                                 return (strdoioctl(stp, &strioc, flag,
3461                                     copyflag, crp, rvalp));
3462 
3463                         /*
3464                          * These M_IOCTL's don't require any data to be sent
3465                          * downstream, and the driver will allocate and link
3466                          * on its own mblk_t upon M_IOCACK -- thus we set
3467                          * ic_len to zero and set ic_dp to arg so we know
3468                          * where to copyout to later.
3469                          */
3470                         case TIOCGSOFTCAR:
3471                         case TIOCGWINSZ:
3472                         case TIOCGSIZE:
3473                         case KIOCGTRANS:
3474                         case KIOCGTRANSABLE:
3475                         case KIOCTYPE:
3476                         case KIOCGDIRECT:
3477                         case KIOCGCOMPAT:
3478                         case KIOCLAYOUT:
3479                         case KIOCGLED:
3480                         case MSIOGETPARMS:
3481                         case MSIOBUTTONS:
3482                         case VUIDGFORMAT:
3483                         case TIOCGPPS:
3484                         case TIOCGPPSEV:
3485                         case TCGETA:
3486                         case TCGETS:
3487                         case LDGETT:
3488                         case TIOCGETP:
3489                         case KIOCGRPTDELAY:
3490                         case KIOCGRPTRATE:
3491                                 strioc.ic_len = 0;
3492                                 strioc.ic_dp = (char *)arg;
3493                                 return (strdoioctl(stp, &strioc, flag,
3494                                     copyflag, crp, rvalp));
3495                         }
3496                 }
3497 
3498                 /*
3499                  * Unknown cmd - send it down as a transparent ioctl.
3500                  */
3501                 strioc.ic_cmd = cmd;
3502                 strioc.ic_timout = INFTIM;
3503                 strioc.ic_len = TRANSPARENT;
3504                 strioc.ic_dp = (char *)&arg;
3505 
3506                 return (strdoioctl(stp, &strioc, flag, copyflag, crp, rvalp));
3507 
3508         case I_STR:
3509                 /*
3510                  * Stream ioctl.  Read in an strioctl buffer from the user
3511                  * along with any data specified and send it downstream.
3512                  * Strdoioctl will wait allow only one ioctl message at
3513                  * a time, and waits for the acknowledgement.
3514                  */
3515 
3516                 if (stp->sd_flag & STRHUP)
3517                         return (ENXIO);
3518 
3519                 error = strcopyin_strioctl((void *)arg, &strioc, flag,
3520                     copyflag);
3521                 if (error != 0)
3522                         return (error);
3523 
3524                 if ((strioc.ic_len < 0) || (strioc.ic_timout < -1))
3525                         return (EINVAL);
3526 
3527                 access = job_control_type(strioc.ic_cmd);
3528                 mutex_enter(&stp->sd_lock);
3529                 if ((access != -1) &&
3530                     ((error = i_straccess(stp, access)) != 0)) {
3531                         mutex_exit(&stp->sd_lock);
3532                         return (error);
3533                 }
3534                 mutex_exit(&stp->sd_lock);
3535 
3536                 /*
3537                  * The I_STR facility provides a trap door for malicious
3538                  * code to send down bogus streamio(7I) ioctl commands to
3539                  * unsuspecting STREAMS modules and drivers which expect to
3540                  * only get these messages from the stream head.
3541                  * Explicitly prohibit any streamio ioctls which can be
3542                  * passed downstream by the stream head.  Note that we do
3543                  * not block all streamio ioctls because the ioctl
3544                  * numberspace is not well managed and thus it's possible
3545                  * that a module or driver's ioctl numbers may accidentally
3546                  * collide with them.
3547                  */
3548                 switch (strioc.ic_cmd) {
3549                 case I_LINK:
3550                 case I_PLINK:
3551                 case I_UNLINK:
3552                 case I_PUNLINK:
3553                 case _I_GETPEERCRED:
3554                 case _I_PLINK_LH:
3555                         return (EINVAL);
3556                 }
3557 
3558                 error = strdoioctl(stp, &strioc, flag, copyflag, crp, rvalp);
3559                 if (error == 0) {
3560                         error = strcopyout_strioctl(&strioc, (void *)arg,
3561                             flag, copyflag);
3562                 }
3563                 return (error);
3564 
3565         case _I_CMD:
3566                 /*
3567                  * Like I_STR, but without using M_IOC* messages and without
3568                  * copyins/copyouts beyond the passed-in argument.
3569                  */
3570                 if (stp->sd_flag & STRHUP)
3571                         return (ENXIO);
3572 
3573                 if ((scp = kmem_alloc(sizeof (strcmd_t), KM_NOSLEEP)) == NULL)
3574                         return (ENOMEM);
3575 
3576                 if (copyin((void *)arg, scp, sizeof (strcmd_t))) {
3577                         kmem_free(scp, sizeof (strcmd_t));
3578                         return (EFAULT);
3579                 }
3580 
3581                 access = job_control_type(scp->sc_cmd);
3582                 mutex_enter(&stp->sd_lock);
3583                 if (access != -1 && (error = i_straccess(stp, access)) != 0) {
3584                         mutex_exit(&stp->sd_lock);
3585                         kmem_free(scp, sizeof (strcmd_t));
3586                         return (error);
3587                 }
3588                 mutex_exit(&stp->sd_lock);
3589 
3590                 *rvalp = 0;
3591                 if ((error = strdocmd(stp, scp, crp)) == 0) {
3592                         if (copyout(scp, (void *)arg, sizeof (strcmd_t)))
3593                                 error = EFAULT;
3594                 }
3595                 kmem_free(scp, sizeof (strcmd_t));
3596                 return (error);
3597 
3598         case I_NREAD:
3599                 /*
3600                  * Return number of bytes of data in first message
3601                  * in queue in "arg" and return the number of messages
3602                  * in queue in return value.
3603                  */
3604         {
3605                 size_t  size;
3606                 int     retval;
3607                 int     count = 0;
3608 
3609                 mutex_enter(QLOCK(rdq));
3610 
3611                 size = msgdsize(rdq->q_first);
3612                 for (mp = rdq->q_first; mp != NULL; mp = mp->b_next)
3613                         count++;
3614 
3615                 mutex_exit(QLOCK(rdq));
3616                 if (stp->sd_struiordq) {
3617                         infod_t infod;
3618 
3619                         infod.d_cmd = INFOD_COUNT;
3620                         infod.d_count = 0;
3621                         if (count == 0) {
3622                                 infod.d_cmd |= INFOD_FIRSTBYTES;
3623                                 infod.d_bytes = 0;
3624                         }
3625                         infod.d_res = 0;
3626                         (void) infonext(rdq, &infod);
3627                         count += infod.d_count;
3628                         if (infod.d_res & INFOD_FIRSTBYTES)
3629                                 size = infod.d_bytes;
3630                 }
3631 
3632                 /*
3633                  * Drop down from size_t to the "int" required by the
3634                  * interface.  Cap at INT_MAX.
3635                  */
3636                 retval = MIN(size, INT_MAX);
3637                 error = strcopyout(&retval, (void *)arg, sizeof (retval),
3638                     copyflag);
3639                 if (!error)
3640                         *rvalp = count;
3641                 return (error);
3642         }
3643 
3644         case FIONREAD:
3645                 /*
3646                  * Return number of bytes of data in all data messages
3647                  * in queue in "arg".
3648                  */
3649         {
3650                 size_t  size = 0;
3651                 int     retval;
3652 
3653                 mutex_enter(QLOCK(rdq));
3654                 for (mp = rdq->q_first; mp != NULL; mp = mp->b_next)
3655                         size += msgdsize(mp);
3656                 mutex_exit(QLOCK(rdq));
3657 
3658                 if (stp->sd_struiordq) {
3659                         infod_t infod;
3660 
3661                         infod.d_cmd = INFOD_BYTES;
3662                         infod.d_res = 0;
3663                         infod.d_bytes = 0;
3664                         (void) infonext(rdq, &infod);
3665                         size += infod.d_bytes;
3666                 }
3667 
3668                 /*
3669                  * Drop down from size_t to the "int" required by the
3670                  * interface.  Cap at INT_MAX.
3671                  */
3672                 retval = MIN(size, INT_MAX);
3673                 error = strcopyout(&retval, (void *)arg, sizeof (retval),
3674                     copyflag);
3675 
3676                 *rvalp = 0;
3677                 return (error);
3678         }
3679         case FIORDCHK:
3680                 /*
3681                  * FIORDCHK does not use arg value (like FIONREAD),
3682                  * instead a count is returned. I_NREAD value may
3683                  * not be accurate but safe. The real thing to do is
3684                  * to add the msgdsizes of all data  messages until
3685                  * a non-data message.
3686                  */
3687         {
3688                 size_t size = 0;
3689 
3690                 mutex_enter(QLOCK(rdq));
3691                 for (mp = rdq->q_first; mp != NULL; mp = mp->b_next)
3692                         size += msgdsize(mp);
3693                 mutex_exit(QLOCK(rdq));
3694 
3695                 if (stp->sd_struiordq) {
3696                         infod_t infod;
3697 
3698                         infod.d_cmd = INFOD_BYTES;
3699                         infod.d_res = 0;
3700                         infod.d_bytes = 0;
3701                         (void) infonext(rdq, &infod);
3702                         size += infod.d_bytes;
3703                 }
3704 
3705                 /*
3706                  * Since ioctl returns an int, and memory sizes under
3707                  * LP64 may not fit, we return INT_MAX if the count was
3708                  * actually greater.
3709                  */
3710                 *rvalp = MIN(size, INT_MAX);
3711                 return (0);
3712         }
3713 
3714         case I_FIND:
3715                 /*
3716                  * Get module name.
3717                  */
3718         {
3719                 char mname[FMNAMESZ + 1];
3720                 queue_t *q;
3721 
3722                 error = (copyflag & U_TO_K ? copyinstr : copystr)((void *)arg,
3723                     mname, FMNAMESZ + 1, NULL);
3724                 if (error)
3725                         return ((error == ENAMETOOLONG) ? EINVAL : EFAULT);
3726 
3727                 /*
3728                  * Return EINVAL if we're handed a bogus module name.
3729                  */
3730                 if (fmodsw_find(mname, FMODSW_LOAD) == NULL) {
3731                         TRACE_0(TR_FAC_STREAMS_FR,
3732                             TR_I_CANT_FIND, "couldn't I_FIND");
3733                         return (EINVAL);
3734                 }
3735 
3736                 *rvalp = 0;
3737 
3738                 /* Look downstream to see if module is there. */
3739                 claimstr(stp->sd_wrq);
3740                 for (q = stp->sd_wrq->q_next; q; q = q->q_next) {
3741                         if (q->q_flag & QREADR) {
3742                                 q = NULL;
3743                                 break;
3744                         }
3745                         if (strcmp(mname, Q2NAME(q)) == 0)
3746                                 break;
3747                 }
3748                 releasestr(stp->sd_wrq);
3749 
3750                 *rvalp = (q ? 1 : 0);
3751                 return (error);
3752         }
3753 
3754         case I_PUSH:
3755         case __I_PUSH_NOCTTY:
3756                 /*
3757                  * Push a module.
3758                  * For the case __I_PUSH_NOCTTY push a module but
3759                  * do not allocate controlling tty. See bugid 4025044
3760                  */
3761 
3762         {
3763                 char mname[FMNAMESZ + 1];
3764                 fmodsw_impl_t *fp;
3765                 dev_t dummydev;
3766 
3767                 if (stp->sd_flag & STRHUP)
3768                         return (ENXIO);
3769 
3770                 /*
3771                  * Get module name and look up in fmodsw.
3772                  */
3773                 error = (copyflag & U_TO_K ? copyinstr : copystr)((void *)arg,
3774                     mname, FMNAMESZ + 1, NULL);
3775                 if (error)
3776                         return ((error == ENAMETOOLONG) ? EINVAL : EFAULT);
3777 
3778                 if ((fp = fmodsw_find(mname, FMODSW_HOLD | FMODSW_LOAD)) ==
3779                     NULL)
3780                         return (EINVAL);
3781 
3782                 TRACE_2(TR_FAC_STREAMS_FR, TR_I_PUSH,
3783                     "I_PUSH:fp %p stp %p", fp, stp);
3784 
3785                 if (error = strstartplumb(stp, flag, cmd)) {
3786                         fmodsw_rele(fp);
3787                         return (error);
3788                 }
3789 
3790                 /*
3791                  * See if any more modules can be pushed on this stream.
3792                  * Note that this check must be done after strstartplumb()
3793                  * since otherwise multiple threads issuing I_PUSHes on
3794                  * the same stream will be able to exceed nstrpush.
3795                  */
3796                 mutex_enter(&stp->sd_lock);
3797                 if (stp->sd_pushcnt >= nstrpush) {
3798                         fmodsw_rele(fp);
3799                         strendplumb(stp);
3800                         mutex_exit(&stp->sd_lock);
3801                         return (EINVAL);
3802                 }
3803                 mutex_exit(&stp->sd_lock);
3804 
3805                 /*
3806                  * Push new module and call its open routine
3807                  * via qattach().  Modules don't change device
3808                  * numbers, so just ignore dummydev here.
3809                  */
3810                 dummydev = vp->v_rdev;
3811                 if ((error = qattach(rdq, &dummydev, 0, crp, fp,
3812                     B_FALSE)) == 0) {
3813                         if (vp->v_type == VCHR && /* sorry, no pipes allowed */
3814                             (cmd == I_PUSH) && (stp->sd_flag & STRISTTY)) {
3815                                 /*
3816                                  * try to allocate it as a controlling terminal
3817                                  */
3818                                 (void) strctty(stp);
3819                         }
3820                 }
3821 
3822                 mutex_enter(&stp->sd_lock);
3823 
3824                 /*
3825                  * As a performance concern we are caching the values of
3826                  * q_minpsz and q_maxpsz of the module below the stream
3827                  * head in the stream head.
3828                  */
3829                 mutex_enter(QLOCK(stp->sd_wrq->q_next));
3830                 rmin = stp->sd_wrq->q_next->q_minpsz;
3831                 rmax = stp->sd_wrq->q_next->q_maxpsz;
3832                 mutex_exit(QLOCK(stp->sd_wrq->q_next));
3833 
3834                 /* Do this processing here as a performance concern */
3835                 if (strmsgsz != 0) {
3836                         if (rmax == INFPSZ)
3837                                 rmax = strmsgsz;
3838                         else  {
3839                                 if (vp->v_type == VFIFO)
3840                                         rmax = MIN(PIPE_BUF, rmax);
3841                                 else    rmax = MIN(strmsgsz, rmax);
3842                         }
3843                 }
3844 
3845                 mutex_enter(QLOCK(wrq));
3846                 stp->sd_qn_minpsz = rmin;
3847                 stp->sd_qn_maxpsz = rmax;
3848                 mutex_exit(QLOCK(wrq));
3849 
3850                 strendplumb(stp);
3851                 mutex_exit(&stp->sd_lock);
3852                 return (error);
3853         }
3854 
3855         case I_POP:
3856         {
3857                 queue_t *q;
3858 
3859                 if (stp->sd_flag & STRHUP)
3860                         return (ENXIO);
3861                 if (!wrq->q_next)    /* for broken pipes */
3862                         return (EINVAL);
3863 
3864                 if (error = strstartplumb(stp, flag, cmd))
3865                         return (error);
3866 
3867                 /*
3868                  * If there is an anchor on this stream and popping
3869                  * the current module would attempt to pop through the
3870                  * anchor, then disallow the pop unless we have sufficient
3871                  * privileges; take the cheapest (non-locking) check
3872                  * first.
3873                  */
3874                 if (secpolicy_ip_config(crp, B_TRUE) != 0 ||
3875                     (stp->sd_anchorzone != crgetzoneid(crp))) {
3876                         mutex_enter(&stp->sd_lock);
3877                         /*
3878                          * Anchors only apply if there's at least one
3879                          * module on the stream (sd_pushcnt > 0).
3880                          */
3881                         if (stp->sd_pushcnt > 0 &&
3882                             stp->sd_pushcnt == stp->sd_anchor &&
3883                             stp->sd_vnode->v_type != VFIFO) {
3884                                 strendplumb(stp);
3885                                 mutex_exit(&stp->sd_lock);
3886                                 if (stp->sd_anchorzone != crgetzoneid(crp))
3887                                         return (EINVAL);
3888                                 /* Audit and report error */
3889                                 return (secpolicy_ip_config(crp, B_FALSE));
3890                         }
3891                         mutex_exit(&stp->sd_lock);
3892                 }
3893 
3894                 q = wrq->q_next;
3895                 TRACE_2(TR_FAC_STREAMS_FR, TR_I_POP,
3896                     "I_POP:%p from %p", q, stp);
3897                 if (q->q_next == NULL || (q->q_flag & (QREADR|QISDRV))) {
3898                         error = EINVAL;
3899                 } else {
3900                         qdetach(_RD(q), 1, flag, crp, B_FALSE);
3901                         error = 0;
3902                 }
3903                 mutex_enter(&stp->sd_lock);
3904 
3905                 /*
3906                  * As a performance concern we are caching the values of
3907                  * q_minpsz and q_maxpsz of the module below the stream
3908                  * head in the stream head.
3909                  */
3910                 mutex_enter(QLOCK(wrq->q_next));
3911                 rmin = wrq->q_next->q_minpsz;
3912                 rmax = wrq->q_next->q_maxpsz;
3913                 mutex_exit(QLOCK(wrq->q_next));
3914 
3915                 /* Do this processing here as a performance concern */
3916                 if (strmsgsz != 0) {
3917                         if (rmax == INFPSZ)
3918                                 rmax = strmsgsz;
3919                         else  {
3920                                 if (vp->v_type == VFIFO)
3921                                         rmax = MIN(PIPE_BUF, rmax);
3922                                 else    rmax = MIN(strmsgsz, rmax);
3923                         }
3924                 }
3925 
3926                 mutex_enter(QLOCK(wrq));
3927                 stp->sd_qn_minpsz = rmin;
3928                 stp->sd_qn_maxpsz = rmax;
3929                 mutex_exit(QLOCK(wrq));
3930 
3931                 /* If we popped through the anchor, then reset the anchor. */
3932                 if (stp->sd_pushcnt < stp->sd_anchor) {
3933                         stp->sd_anchor = 0;
3934                         stp->sd_anchorzone = 0;
3935                 }
3936                 strendplumb(stp);
3937                 mutex_exit(&stp->sd_lock);
3938                 return (error);
3939         }
3940 
3941         case _I_MUXID2FD:
3942         {
3943                 /*
3944                  * Create a fd for a I_PLINK'ed lower stream with a given
3945                  * muxid.  With the fd, application can send down ioctls,
3946                  * like I_LIST, to the previously I_PLINK'ed stream.  Note
3947                  * that after getting the fd, the application has to do an
3948                  * I_PUNLINK on the muxid before it can do any operation
3949                  * on the lower stream.  This is required by spec1170.
3950                  *
3951                  * The fd used to do this ioctl should point to the same
3952                  * controlling device used to do the I_PLINK.  If it uses
3953                  * a different stream or an invalid muxid, I_MUXID2FD will
3954                  * fail.  The error code is set to EINVAL.
3955                  *
3956                  * The intended use of this interface is the following.
3957                  * An application I_PLINK'ed a stream and exits.  The fd
3958                  * to the lower stream is gone.  Another application
3959                  * wants to get a fd to the lower stream, it uses I_MUXID2FD.
3960                  */
3961                 int muxid = (int)arg;
3962                 int fd;
3963                 linkinfo_t *linkp;
3964                 struct file *fp;
3965                 netstack_t *ns;
3966                 str_stack_t *ss;
3967 
3968                 /*
3969                  * Do not allow the wildcard muxid.  This ioctl is not
3970                  * intended to find arbitrary link.
3971                  */
3972                 if (muxid == 0) {
3973                         return (EINVAL);
3974                 }
3975 
3976                 ns = netstack_find_by_cred(crp);
3977                 ASSERT(ns != NULL);
3978                 ss = ns->netstack_str;
3979                 ASSERT(ss != NULL);
3980 
3981                 mutex_enter(&muxifier);
3982                 linkp = findlinks(vp->v_stream, muxid, LINKPERSIST, ss);
3983                 if (linkp == NULL) {
3984                         mutex_exit(&muxifier);
3985                         netstack_rele(ss->ss_netstack);
3986                         return (EINVAL);
3987                 }
3988 
3989                 if ((fd = ufalloc(0)) == -1) {
3990                         mutex_exit(&muxifier);
3991                         netstack_rele(ss->ss_netstack);
3992                         return (EMFILE);
3993                 }
3994                 fp = linkp->li_fpdown;
3995                 mutex_enter(&fp->f_tlock);
3996                 fp->f_count++;
3997                 mutex_exit(&fp->f_tlock);
3998                 mutex_exit(&muxifier);
3999                 setf(fd, fp);
4000                 *rvalp = fd;
4001                 netstack_rele(ss->ss_netstack);
4002                 return (0);
4003         }
4004 
4005         case _I_INSERT:
4006         {
4007                 /*
4008                  * To insert a module to a given position in a stream.
4009                  * In the first release, only allow privileged user
4010                  * to use this ioctl. Furthermore, the insert is only allowed
4011                  * below an anchor if the zoneid is the same as the zoneid
4012                  * which created the anchor.
4013                  *
4014                  * Note that we do not plan to support this ioctl
4015                  * on pipes in the first release.  We want to learn more
4016                  * about the implications of these ioctls before extending
4017                  * their support.  And we do not think these features are
4018                  * valuable for pipes.
4019                  */
4020                 STRUCT_DECL(strmodconf, strmodinsert);
4021                 char mod_name[FMNAMESZ + 1];
4022                 fmodsw_impl_t *fp;
4023                 dev_t dummydev;
4024                 queue_t *tmp_wrq;
4025                 int pos;
4026                 boolean_t is_insert;
4027 
4028                 STRUCT_INIT(strmodinsert, flag);
4029                 if (stp->sd_flag & STRHUP)
4030                         return (ENXIO);
4031                 if (STRMATED(stp))
4032                         return (EINVAL);
4033                 if ((error = secpolicy_net_config(crp, B_FALSE)) != 0)
4034                         return (error);
4035                 if (stp->sd_anchor != 0 &&
4036                     stp->sd_anchorzone != crgetzoneid(crp))
4037                         return (EINVAL);
4038 
4039                 error = strcopyin((void *)arg, STRUCT_BUF(strmodinsert),
4040                     STRUCT_SIZE(strmodinsert), copyflag);
4041                 if (error)
4042                         return (error);
4043 
4044                 /*
4045                  * Get module name and look up in fmodsw.
4046                  */
4047                 error = (copyflag & U_TO_K ? copyinstr :
4048                     copystr)(STRUCT_FGETP(strmodinsert, mod_name),
4049                     mod_name, FMNAMESZ + 1, NULL);
4050                 if (error)
4051                         return ((error == ENAMETOOLONG) ? EINVAL : EFAULT);
4052 
4053                 if ((fp = fmodsw_find(mod_name, FMODSW_HOLD | FMODSW_LOAD)) ==
4054                     NULL)
4055                         return (EINVAL);
4056 
4057                 if (error = strstartplumb(stp, flag, cmd)) {
4058                         fmodsw_rele(fp);
4059                         return (error);
4060                 }
4061 
4062                 /*
4063                  * Is this _I_INSERT just like an I_PUSH?  We need to know
4064                  * this because we do some optimizations if this is a
4065                  * module being pushed.
4066                  */
4067                 pos = STRUCT_FGET(strmodinsert, pos);
4068                 is_insert = (pos != 0);
4069 
4070                 /*
4071                  * Make sure pos is valid.  Even though it is not an I_PUSH,
4072                  * we impose the same limit on the number of modules in a
4073                  * stream.
4074                  */
4075                 mutex_enter(&stp->sd_lock);
4076                 if (stp->sd_pushcnt >= nstrpush || pos < 0 ||
4077                     pos > stp->sd_pushcnt) {
4078                         fmodsw_rele(fp);
4079                         strendplumb(stp);
4080                         mutex_exit(&stp->sd_lock);
4081                         return (EINVAL);
4082                 }
4083                 if (stp->sd_anchor != 0) {
4084                         /*
4085                          * Is this insert below the anchor?
4086                          * Pushcnt hasn't been increased yet hence
4087                          * we test for greater than here, and greater or
4088                          * equal after qattach.
4089                          */
4090                         if (pos > (stp->sd_pushcnt - stp->sd_anchor) &&
4091                             stp->sd_anchorzone != crgetzoneid(crp)) {
4092                                 fmodsw_rele(fp);
4093                                 strendplumb(stp);
4094                                 mutex_exit(&stp->sd_lock);
4095                                 return (EPERM);
4096                         }
4097                 }
4098 
4099                 mutex_exit(&stp->sd_lock);
4100 
4101                 /*
4102                  * First find the correct position this module to
4103                  * be inserted.  We don't need to call claimstr()
4104                  * as the stream should not be changing at this point.
4105                  *
4106                  * Insert new module and call its open routine
4107                  * via qattach().  Modules don't change device
4108                  * numbers, so just ignore dummydev here.
4109                  */
4110                 for (tmp_wrq = stp->sd_wrq; pos > 0;
4111                     tmp_wrq = tmp_wrq->q_next, pos--) {
4112                         ASSERT(SAMESTR(tmp_wrq));
4113                 }
4114                 dummydev = vp->v_rdev;
4115                 if ((error = qattach(_RD(tmp_wrq), &dummydev, 0, crp,
4116                     fp, is_insert)) != 0) {
4117                         mutex_enter(&stp->sd_lock);
4118                         strendplumb(stp);
4119                         mutex_exit(&stp->sd_lock);
4120                         return (error);
4121                 }
4122 
4123                 mutex_enter(&stp->sd_lock);
4124 
4125                 /*
4126                  * As a performance concern we are caching the values of
4127                  * q_minpsz and q_maxpsz of the module below the stream
4128                  * head in the stream head.
4129                  */
4130                 if (!is_insert) {
4131                         mutex_enter(QLOCK(stp->sd_wrq->q_next));
4132                         rmin = stp->sd_wrq->q_next->q_minpsz;
4133                         rmax = stp->sd_wrq->q_next->q_maxpsz;
4134                         mutex_exit(QLOCK(stp->sd_wrq->q_next));
4135 
4136                         /* Do this processing here as a performance concern */
4137                         if (strmsgsz != 0) {
4138                                 if (rmax == INFPSZ) {
4139                                         rmax = strmsgsz;
4140                                 } else  {
4141                                         rmax = MIN(strmsgsz, rmax);
4142                                 }
4143                         }
4144 
4145                         mutex_enter(QLOCK(wrq));
4146                         stp->sd_qn_minpsz = rmin;
4147                         stp->sd_qn_maxpsz = rmax;
4148                         mutex_exit(QLOCK(wrq));
4149                 }
4150 
4151                 /*
4152                  * Need to update the anchor value if this module is
4153                  * inserted below the anchor point.
4154                  */
4155                 if (stp->sd_anchor != 0) {
4156                         pos = STRUCT_FGET(strmodinsert, pos);
4157                         if (pos >= (stp->sd_pushcnt - stp->sd_anchor))
4158                                 stp->sd_anchor++;
4159                 }
4160 
4161                 strendplumb(stp);
4162                 mutex_exit(&stp->sd_lock);
4163                 return (0);
4164         }
4165 
4166         case _I_REMOVE:
4167         {
4168                 /*
4169                  * To remove a module with a given name in a stream.  The
4170                  * caller of this ioctl needs to provide both the name and
4171                  * the position of the module to be removed.  This eliminates
4172                  * the ambiguity of removal if a module is inserted/pushed
4173                  * multiple times in a stream.  In the first release, only
4174                  * allow privileged user to use this ioctl.
4175                  * Furthermore, the remove is only allowed
4176                  * below an anchor if the zoneid is the same as the zoneid
4177                  * which created the anchor.
4178                  *
4179                  * Note that we do not plan to support this ioctl
4180                  * on pipes in the first release.  We want to learn more
4181                  * about the implications of these ioctls before extending
4182                  * their support.  And we do not think these features are
4183                  * valuable for pipes.
4184                  *
4185                  * Also note that _I_REMOVE cannot be used to remove a
4186                  * driver or the stream head.
4187                  */
4188                 STRUCT_DECL(strmodconf, strmodremove);
4189                 queue_t *q;
4190                 int pos;
4191                 char mod_name[FMNAMESZ + 1];
4192                 boolean_t is_remove;
4193 
4194                 STRUCT_INIT(strmodremove, flag);
4195                 if (stp->sd_flag & STRHUP)
4196                         return (ENXIO);
4197                 if (STRMATED(stp))
4198                         return (EINVAL);
4199                 if ((error = secpolicy_net_config(crp, B_FALSE)) != 0)
4200                         return (error);
4201                 if (stp->sd_anchor != 0 &&
4202                     stp->sd_anchorzone != crgetzoneid(crp))
4203                         return (EINVAL);
4204 
4205                 error = strcopyin((void *)arg, STRUCT_BUF(strmodremove),
4206                     STRUCT_SIZE(strmodremove), copyflag);
4207                 if (error)
4208                         return (error);
4209 
4210                 error = (copyflag & U_TO_K ? copyinstr :
4211                     copystr)(STRUCT_FGETP(strmodremove, mod_name),
4212                     mod_name, FMNAMESZ + 1, NULL);
4213                 if (error)
4214                         return ((error == ENAMETOOLONG) ? EINVAL : EFAULT);
4215 
4216                 if ((error = strstartplumb(stp, flag, cmd)) != 0)
4217                         return (error);
4218 
4219                 /*
4220                  * Match the name of given module to the name of module at
4221                  * the given position.
4222                  */
4223                 pos = STRUCT_FGET(strmodremove, pos);
4224 
4225                 is_remove = (pos != 0);
4226                 for (q = stp->sd_wrq->q_next; SAMESTR(q) && pos > 0;
4227                     q = q->q_next, pos--)
4228                         ;
4229                 if (pos > 0 || !SAMESTR(q) ||
4230                     strcmp(Q2NAME(q), mod_name) != 0) {
4231                         mutex_enter(&stp->sd_lock);
4232                         strendplumb(stp);
4233                         mutex_exit(&stp->sd_lock);
4234                         return (EINVAL);
4235                 }
4236 
4237                 /*
4238                  * If the position is at or below an anchor, then the zoneid
4239                  * must match the zoneid that created the anchor.
4240                  */
4241                 if (stp->sd_anchor != 0) {
4242                         pos = STRUCT_FGET(strmodremove, pos);
4243                         if (pos >= (stp->sd_pushcnt - stp->sd_anchor) &&
4244                             stp->sd_anchorzone != crgetzoneid(crp)) {
4245                                 mutex_enter(&stp->sd_lock);
4246                                 strendplumb(stp);
4247                                 mutex_exit(&stp->sd_lock);
4248                                 return (EPERM);
4249                         }
4250                 }
4251 
4252 
4253                 ASSERT(!(q->q_flag & QREADR));
4254                 qdetach(_RD(q), 1, flag, crp, is_remove);
4255 
4256                 mutex_enter(&stp->sd_lock);
4257 
4258                 /*
4259                  * As a performance concern we are caching the values of
4260                  * q_minpsz and q_maxpsz of the module below the stream
4261                  * head in the stream head.
4262                  */
4263                 if (!is_remove) {
4264                         mutex_enter(QLOCK(wrq->q_next));
4265                         rmin = wrq->q_next->q_minpsz;
4266                         rmax = wrq->q_next->q_maxpsz;
4267                         mutex_exit(QLOCK(wrq->q_next));
4268 
4269                         /* Do this processing here as a performance concern */
4270                         if (strmsgsz != 0) {
4271                                 if (rmax == INFPSZ)
4272                                         rmax = strmsgsz;
4273                                 else  {
4274                                         if (vp->v_type == VFIFO)
4275                                                 rmax = MIN(PIPE_BUF, rmax);
4276                                         else    rmax = MIN(strmsgsz, rmax);
4277                                 }
4278                         }
4279 
4280                         mutex_enter(QLOCK(wrq));
4281                         stp->sd_qn_minpsz = rmin;
4282                         stp->sd_qn_maxpsz = rmax;
4283                         mutex_exit(QLOCK(wrq));
4284                 }
4285 
4286                 /*
4287                  * Need to update the anchor value if this module is removed
4288                  * at or below the anchor point.  If the removed module is at
4289                  * the anchor point, remove the anchor for this stream if
4290                  * there is no module above the anchor point.  Otherwise, if
4291                  * the removed module is below the anchor point, decrement the
4292                  * anchor point by 1.
4293                  */
4294                 if (stp->sd_anchor != 0) {
4295                         pos = STRUCT_FGET(strmodremove, pos);
4296                         if (pos == stp->sd_pushcnt - stp->sd_anchor + 1)
4297                                 stp->sd_anchor = 0;
4298                         else if (pos > (stp->sd_pushcnt - stp->sd_anchor + 1))
4299                                 stp->sd_anchor--;
4300                 }
4301 
4302                 strendplumb(stp);
4303                 mutex_exit(&stp->sd_lock);
4304                 return (0);
4305         }
4306 
4307         case I_ANCHOR:
4308                 /*
4309                  * Set the anchor position on the stream to reside at
4310                  * the top module (in other words, the top module
4311                  * cannot be popped).  Anchors with a FIFO make no
4312                  * obvious sense, so they're not allowed.
4313                  */
4314                 mutex_enter(&stp->sd_lock);
4315 
4316                 if (stp->sd_vnode->v_type == VFIFO) {
4317                         mutex_exit(&stp->sd_lock);
4318                         return (EINVAL);
4319                 }
4320                 /* Only allow the same zoneid to update the anchor */
4321                 if (stp->sd_anchor != 0 &&
4322                     stp->sd_anchorzone != crgetzoneid(crp)) {
4323                         mutex_exit(&stp->sd_lock);
4324                         return (EINVAL);
4325                 }
4326                 stp->sd_anchor = stp->sd_pushcnt;
4327                 stp->sd_anchorzone = crgetzoneid(crp);
4328                 mutex_exit(&stp->sd_lock);
4329                 return (0);
4330 
4331         case I_LOOK:
4332                 /*
4333                  * Get name of first module downstream.
4334                  * If no module, return an error.
4335                  */
4336                 claimstr(wrq);
4337                 if (_SAMESTR(wrq) && wrq->q_next->q_next != NULL) {
4338                         char *name = Q2NAME(wrq->q_next);
4339 
4340                         error = strcopyout(name, (void *)arg, strlen(name) + 1,
4341                             copyflag);
4342                         releasestr(wrq);
4343                         return (error);
4344                 }
4345                 releasestr(wrq);
4346                 return (EINVAL);
4347 
4348         case I_LINK:
4349         case I_PLINK:
4350                 /*
4351                  * Link a multiplexor.
4352                  */
4353                 return (mlink(vp, cmd, (int)arg, crp, rvalp, 0));
4354 
4355         case _I_PLINK_LH:
4356                 /*
4357                  * Link a multiplexor: Call must originate from kernel.
4358                  */
4359                 if (kioctl)
4360                         return (ldi_mlink_lh(vp, cmd, arg, crp, rvalp));
4361 
4362                 return (EINVAL);
4363         case I_UNLINK:
4364         case I_PUNLINK:
4365                 /*
4366                  * Unlink a multiplexor.
4367                  * If arg is -1, unlink all links for which this is the
4368                  * controlling stream.  Otherwise, arg is an index number
4369                  * for a link to be removed.
4370                  */
4371         {
4372                 struct linkinfo *linkp;
4373                 int native_arg = (int)arg;
4374                 int type;
4375                 netstack_t *ns;
4376                 str_stack_t *ss;
4377 
4378                 TRACE_1(TR_FAC_STREAMS_FR,
4379                     TR_I_UNLINK, "I_UNLINK/I_PUNLINK:%p", stp);
4380                 if (vp->v_type == VFIFO) {
4381                         return (EINVAL);
4382                 }
4383                 if (cmd == I_UNLINK)
4384                         type = LINKNORMAL;
4385                 else    /* I_PUNLINK */
4386                         type = LINKPERSIST;
4387                 if (native_arg == 0) {
4388                         return (EINVAL);
4389                 }
4390                 ns = netstack_find_by_cred(crp);
4391                 ASSERT(ns != NULL);
4392                 ss = ns->netstack_str;
4393                 ASSERT(ss != NULL);
4394 
4395                 if (native_arg == MUXID_ALL)
4396                         error = munlinkall(stp, type, crp, rvalp, ss);
4397                 else {
4398                         mutex_enter(&muxifier);
4399                         if (!(linkp = findlinks(stp, (int)arg, type, ss))) {
4400                                 /* invalid user supplied index number */
4401                                 mutex_exit(&muxifier);
4402                                 netstack_rele(ss->ss_netstack);
4403                                 return (EINVAL);
4404                         }
4405                         /* munlink drops the muxifier lock */
4406                         error = munlink(stp, linkp, type, crp, rvalp, ss);
4407                 }
4408                 netstack_rele(ss->ss_netstack);
4409                 return (error);
4410         }
4411 
4412         case I_FLUSH:
4413                 /*
4414                  * send a flush message downstream
4415                  * flush message can indicate
4416                  * FLUSHR - flush read queue
4417                  * FLUSHW - flush write queue
4418                  * FLUSHRW - flush read/write queue
4419                  */
4420                 if (stp->sd_flag & STRHUP)
4421                         return (ENXIO);
4422                 if (arg & ~FLUSHRW)
4423                         return (EINVAL);
4424 
4425                 for (;;) {
4426                         if (putnextctl1(stp->sd_wrq, M_FLUSH, (int)arg)) {
4427                                 break;
4428                         }
4429                         if (error = strwaitbuf(1, BPRI_HI)) {
4430                                 return (error);
4431                         }
4432                 }
4433 
4434                 /*
4435                  * Send down an unsupported ioctl and wait for the nack
4436                  * in order to allow the M_FLUSH to propagate back
4437                  * up to the stream head.
4438                  * Replaces if (qready()) runqueues();
4439                  */
4440                 strioc.ic_cmd = -1;     /* The unsupported ioctl */
4441                 strioc.ic_timout = 0;
4442                 strioc.ic_len = 0;
4443                 strioc.ic_dp = NULL;
4444                 (void) strdoioctl(stp, &strioc, flag, K_TO_K, crp, rvalp);
4445                 *rvalp = 0;
4446                 return (0);
4447 
4448         case I_FLUSHBAND:
4449         {
4450                 struct bandinfo binfo;
4451 
4452                 error = strcopyin((void *)arg, &binfo, sizeof (binfo),
4453                     copyflag);
4454                 if (error)
4455                         return (error);
4456                 if (stp->sd_flag & STRHUP)
4457                         return (ENXIO);
4458                 if (binfo.bi_flag & ~FLUSHRW)
4459                         return (EINVAL);
4460                 while (!(mp = allocb(2, BPRI_HI))) {
4461                         if (error = strwaitbuf(2, BPRI_HI))
4462                                 return (error);
4463                 }
4464                 mp->b_datap->db_type = M_FLUSH;
4465                 *mp->b_wptr++ = binfo.bi_flag | FLUSHBAND;
4466                 *mp->b_wptr++ = binfo.bi_pri;
4467                 putnext(stp->sd_wrq, mp);
4468                 /*
4469                  * Send down an unsupported ioctl and wait for the nack
4470                  * in order to allow the M_FLUSH to propagate back
4471                  * up to the stream head.
4472                  * Replaces if (qready()) runqueues();
4473                  */
4474                 strioc.ic_cmd = -1;     /* The unsupported ioctl */
4475                 strioc.ic_timout = 0;
4476                 strioc.ic_len = 0;
4477                 strioc.ic_dp = NULL;
4478                 (void) strdoioctl(stp, &strioc, flag, K_TO_K, crp, rvalp);
4479                 *rvalp = 0;
4480                 return (0);
4481         }
4482 
4483         case I_SRDOPT:
4484                 /*
4485                  * Set read options
4486                  *
4487                  * RNORM - default stream mode
4488                  * RMSGN - message no discard
4489                  * RMSGD - message discard
4490                  * RPROTNORM - fail read with EBADMSG for M_[PC]PROTOs
4491                  * RPROTDAT - convert M_[PC]PROTOs to M_DATAs
4492                  * RPROTDIS - discard M_[PC]PROTOs and retain M_DATAs
4493                  */
4494                 if (arg & ~(RMODEMASK | RPROTMASK))
4495                         return (EINVAL);
4496 
4497                 if ((arg & (RMSGD|RMSGN)) == (RMSGD|RMSGN))
4498                         return (EINVAL);
4499 
4500                 mutex_enter(&stp->sd_lock);
4501                 switch (arg & RMODEMASK) {
4502                 case RNORM:
4503                         stp->sd_read_opt &= ~(RD_MSGDIS | RD_MSGNODIS);
4504                         break;
4505                 case RMSGD:
4506                         stp->sd_read_opt = (stp->sd_read_opt & ~RD_MSGNODIS) |
4507                             RD_MSGDIS;
4508                         break;
4509                 case RMSGN:
4510                         stp->sd_read_opt = (stp->sd_read_opt & ~RD_MSGDIS) |
4511                             RD_MSGNODIS;
4512                         break;
4513                 }
4514 
4515                 switch (arg & RPROTMASK) {
4516                 case RPROTNORM:
4517                         stp->sd_read_opt &= ~(RD_PROTDAT | RD_PROTDIS);
4518                         break;
4519 
4520                 case RPROTDAT:
4521                         stp->sd_read_opt = ((stp->sd_read_opt & ~RD_PROTDIS) |
4522                             RD_PROTDAT);
4523                         break;
4524 
4525                 case RPROTDIS:
4526                         stp->sd_read_opt = ((stp->sd_read_opt & ~RD_PROTDAT) |
4527                             RD_PROTDIS);
4528                         break;
4529                 }
4530                 mutex_exit(&stp->sd_lock);
4531                 return (0);
4532 
4533         case I_GRDOPT:
4534                 /*
4535                  * Get read option and return the value
4536                  * to spot pointed to by arg
4537                  */
4538         {
4539                 int rdopt;
4540 
4541                 rdopt = ((stp->sd_read_opt & RD_MSGDIS) ? RMSGD :
4542                     ((stp->sd_read_opt & RD_MSGNODIS) ? RMSGN : RNORM));
4543                 rdopt |= ((stp->sd_read_opt & RD_PROTDAT) ? RPROTDAT :
4544                     ((stp->sd_read_opt & RD_PROTDIS) ? RPROTDIS : RPROTNORM));
4545 
4546                 return (strcopyout(&rdopt, (void *)arg, sizeof (int),
4547                     copyflag));
4548         }
4549 
4550         case I_SERROPT:
4551                 /*
4552                  * Set error options
4553                  *
4554                  * RERRNORM - persistent read errors
4555                  * RERRNONPERSIST - non-persistent read errors
4556                  * WERRNORM - persistent write errors
4557                  * WERRNONPERSIST - non-persistent write errors
4558                  */
4559                 if (arg & ~(RERRMASK | WERRMASK))
4560                         return (EINVAL);
4561 
4562                 mutex_enter(&stp->sd_lock);
4563                 switch (arg & RERRMASK) {
4564                 case RERRNORM:
4565                         stp->sd_flag &= ~STRDERRNONPERSIST;
4566                         break;
4567                 case RERRNONPERSIST:
4568                         stp->sd_flag |= STRDERRNONPERSIST;
4569                         break;
4570                 }
4571                 switch (arg & WERRMASK) {
4572                 case WERRNORM:
4573                         stp->sd_flag &= ~STWRERRNONPERSIST;
4574                         break;
4575                 case WERRNONPERSIST:
4576                         stp->sd_flag |= STWRERRNONPERSIST;
4577                         break;
4578                 }
4579                 mutex_exit(&stp->sd_lock);
4580                 return (0);
4581 
4582         case I_GERROPT:
4583                 /*
4584                  * Get error option and return the value
4585                  * to spot pointed to by arg
4586                  */
4587         {
4588                 int erropt = 0;
4589 
4590                 erropt |= (stp->sd_flag & STRDERRNONPERSIST) ? RERRNONPERSIST :
4591                     RERRNORM;
4592                 erropt |= (stp->sd_flag & STWRERRNONPERSIST) ? WERRNONPERSIST :
4593                     WERRNORM;
4594                 return (strcopyout(&erropt, (void *)arg, sizeof (int),
4595                     copyflag));
4596         }
4597 
4598         case I_SETSIG:
4599                 /*
4600                  * Register the calling proc to receive the SIGPOLL
4601                  * signal based on the events given in arg.  If
4602                  * arg is zero, remove the proc from register list.
4603                  */
4604         {
4605                 strsig_t *ssp, *pssp;
4606                 struct pid *pidp;
4607 
4608                 pssp = NULL;
4609                 pidp = curproc->p_pidp;
4610                 /*
4611                  * Hold sd_lock to prevent traversal of sd_siglist while
4612                  * it is modified.
4613                  */
4614                 mutex_enter(&stp->sd_lock);
4615                 for (ssp = stp->sd_siglist; ssp && (ssp->ss_pidp != pidp);
4616                     pssp = ssp, ssp = ssp->ss_next)
4617                         ;
4618 
4619                 if (arg) {
4620                         if (arg & ~(S_INPUT|S_HIPRI|S_MSG|S_HANGUP|S_ERROR|
4621                             S_RDNORM|S_WRNORM|S_RDBAND|S_WRBAND|S_BANDURG)) {
4622                                 mutex_exit(&stp->sd_lock);
4623                                 return (EINVAL);
4624                         }
4625                         if ((arg & S_BANDURG) && !(arg & S_RDBAND)) {
4626                                 mutex_exit(&stp->sd_lock);
4627                                 return (EINVAL);
4628                         }
4629 
4630                         /*
4631                          * If proc not already registered, add it
4632                          * to list.
4633                          */
4634                         if (!ssp) {
4635                                 ssp = kmem_alloc(sizeof (strsig_t), KM_SLEEP);
4636                                 ssp->ss_pidp = pidp;
4637                                 ssp->ss_pid = pidp->pid_id;
4638                                 ssp->ss_next = NULL;
4639                                 if (pssp)
4640                                         pssp->ss_next = ssp;
4641                                 else
4642                                         stp->sd_siglist = ssp;
4643                                 mutex_enter(&pidlock);
4644                                 PID_HOLD(pidp);
4645                                 mutex_exit(&pidlock);
4646                         }
4647 
4648                         /*
4649                          * Set events.
4650                          */
4651                         ssp->ss_events = (int)arg;
4652                 } else {
4653                         /*
4654                          * Remove proc from register list.
4655                          */
4656                         if (ssp) {
4657                                 mutex_enter(&pidlock);
4658                                 PID_RELE(pidp);
4659                                 mutex_exit(&pidlock);
4660                                 if (pssp)
4661                                         pssp->ss_next = ssp->ss_next;
4662                                 else
4663                                         stp->sd_siglist = ssp->ss_next;
4664                                 kmem_free(ssp, sizeof (strsig_t));
4665                         } else {
4666                                 mutex_exit(&stp->sd_lock);
4667                                 return (EINVAL);
4668                         }
4669                 }
4670 
4671                 /*
4672                  * Recalculate OR of sig events.
4673                  */
4674                 stp->sd_sigflags = 0;
4675                 for (ssp = stp->sd_siglist; ssp; ssp = ssp->ss_next)
4676                         stp->sd_sigflags |= ssp->ss_events;
4677                 mutex_exit(&stp->sd_lock);
4678                 return (0);
4679         }
4680 
4681         case I_GETSIG:
4682                 /*
4683                  * Return (in arg) the current registration of events
4684                  * for which the calling proc is to be signaled.
4685                  */
4686         {
4687                 struct strsig *ssp;
4688                 struct pid  *pidp;
4689 
4690                 pidp = curproc->p_pidp;
4691                 mutex_enter(&stp->sd_lock);
4692                 for (ssp = stp->sd_siglist; ssp; ssp = ssp->ss_next)
4693                         if (ssp->ss_pidp == pidp) {
4694                                 error = strcopyout(&ssp->ss_events, (void *)arg,
4695                                     sizeof (int), copyflag);
4696                                 mutex_exit(&stp->sd_lock);
4697                                 return (error);
4698                         }
4699                 mutex_exit(&stp->sd_lock);
4700                 return (EINVAL);
4701         }
4702 
4703         case I_ESETSIG:
4704                 /*
4705                  * Register the ss_pid to receive the SIGPOLL
4706                  * signal based on the events is ss_events arg.  If
4707                  * ss_events is zero, remove the proc from register list.
4708                  */
4709         {
4710                 struct strsig *ssp, *pssp;
4711                 struct proc *proc;
4712                 struct pid  *pidp;
4713                 pid_t pid;
4714                 struct strsigset ss;
4715 
4716                 error = strcopyin((void *)arg, &ss, sizeof (ss), copyflag);
4717                 if (error)
4718                         return (error);
4719 
4720                 pid = ss.ss_pid;
4721 
4722                 if (ss.ss_events != 0) {
4723                         /*
4724                          * Permissions check by sending signal 0.
4725                          * Note that when kill fails it does a set_errno
4726                          * causing the system call to fail.
4727                          */
4728                         error = kill(pid, 0);
4729                         if (error) {
4730                                 return (error);
4731                         }
4732                 }
4733                 mutex_enter(&pidlock);
4734                 if (pid == 0)
4735                         proc = curproc;
4736                 else if (pid < 0)
4737                         proc = pgfind(-pid);
4738                 else
4739                         proc = prfind(pid);
4740                 if (proc == NULL) {
4741                         mutex_exit(&pidlock);
4742                         return (ESRCH);
4743                 }
4744                 if (pid < 0)
4745                         pidp = proc->p_pgidp;
4746                 else
4747                         pidp = proc->p_pidp;
4748                 ASSERT(pidp);
4749                 /*
4750                  * Get a hold on the pid structure while referencing it.
4751                  * There is a separate PID_HOLD should it be inserted
4752                  * in the list below.
4753                  */
4754                 PID_HOLD(pidp);
4755                 mutex_exit(&pidlock);
4756 
4757                 pssp = NULL;
4758                 /*
4759                  * Hold sd_lock to prevent traversal of sd_siglist while
4760                  * it is modified.
4761                  */
4762                 mutex_enter(&stp->sd_lock);
4763                 for (ssp = stp->sd_siglist; ssp && (ssp->ss_pid != pid);
4764                     pssp = ssp, ssp = ssp->ss_next)
4765                         ;
4766 
4767                 if (ss.ss_events) {
4768                         if (ss.ss_events &
4769                             ~(S_INPUT|S_HIPRI|S_MSG|S_HANGUP|S_ERROR|
4770                             S_RDNORM|S_WRNORM|S_RDBAND|S_WRBAND|S_BANDURG)) {
4771                                 mutex_exit(&stp->sd_lock);
4772                                 mutex_enter(&pidlock);
4773                                 PID_RELE(pidp);
4774                                 mutex_exit(&pidlock);
4775                                 return (EINVAL);
4776                         }
4777                         if ((ss.ss_events & S_BANDURG) &&
4778                             !(ss.ss_events & S_RDBAND)) {
4779                                 mutex_exit(&stp->sd_lock);
4780                                 mutex_enter(&pidlock);
4781                                 PID_RELE(pidp);
4782                                 mutex_exit(&pidlock);
4783                                 return (EINVAL);
4784                         }
4785 
4786                         /*
4787                          * If proc not already registered, add it
4788                          * to list.
4789                          */
4790                         if (!ssp) {
4791                                 ssp = kmem_alloc(sizeof (strsig_t), KM_SLEEP);
4792                                 ssp->ss_pidp = pidp;
4793                                 ssp->ss_pid = pid;
4794                                 ssp->ss_next = NULL;
4795                                 if (pssp)
4796                                         pssp->ss_next = ssp;
4797                                 else
4798                                         stp->sd_siglist = ssp;
4799                                 mutex_enter(&pidlock);
4800                                 PID_HOLD(pidp);
4801                                 mutex_exit(&pidlock);
4802                         }
4803 
4804                         /*
4805                          * Set events.
4806                          */
4807                         ssp->ss_events = ss.ss_events;
4808                 } else {
4809                         /*
4810                          * Remove proc from register list.
4811                          */
4812                         if (ssp) {
4813                                 mutex_enter(&pidlock);
4814                                 PID_RELE(pidp);
4815                                 mutex_exit(&pidlock);
4816                                 if (pssp)
4817                                         pssp->ss_next = ssp->ss_next;
4818                                 else
4819                                         stp->sd_siglist = ssp->ss_next;
4820                                 kmem_free(ssp, sizeof (strsig_t));
4821                         } else {
4822                                 mutex_exit(&stp->sd_lock);
4823                                 mutex_enter(&pidlock);
4824                                 PID_RELE(pidp);
4825                                 mutex_exit(&pidlock);
4826                                 return (EINVAL);
4827                         }
4828                 }
4829 
4830                 /*
4831                  * Recalculate OR of sig events.
4832                  */
4833                 stp->sd_sigflags = 0;
4834                 for (ssp = stp->sd_siglist; ssp; ssp = ssp->ss_next)
4835                         stp->sd_sigflags |= ssp->ss_events;
4836                 mutex_exit(&stp->sd_lock);
4837                 mutex_enter(&pidlock);
4838                 PID_RELE(pidp);
4839                 mutex_exit(&pidlock);
4840                 return (0);
4841         }
4842 
4843         case I_EGETSIG:
4844                 /*
4845                  * Return (in arg) the current registration of events
4846                  * for which the calling proc is to be signaled.
4847                  */
4848         {
4849                 struct strsig *ssp;
4850                 struct proc *proc;
4851                 pid_t pid;
4852                 struct pid  *pidp;
4853                 struct strsigset ss;
4854 
4855                 error = strcopyin((void *)arg, &ss, sizeof (ss), copyflag);
4856                 if (error)
4857                         return (error);
4858 
4859                 pid = ss.ss_pid;
4860                 mutex_enter(&pidlock);
4861                 if (pid == 0)
4862                         proc = curproc;
4863                 else if (pid < 0)
4864                         proc = pgfind(-pid);
4865                 else
4866                         proc = prfind(pid);
4867                 if (proc == NULL) {
4868                         mutex_exit(&pidlock);
4869                         return (ESRCH);
4870                 }
4871                 if (pid < 0)
4872                         pidp = proc->p_pgidp;
4873                 else
4874                         pidp = proc->p_pidp;
4875 
4876                 /* Prevent the pidp from being reassigned */
4877                 PID_HOLD(pidp);
4878                 mutex_exit(&pidlock);
4879 
4880                 mutex_enter(&stp->sd_lock);
4881                 for (ssp = stp->sd_siglist; ssp; ssp = ssp->ss_next)
4882                         if (ssp->ss_pid == pid) {
4883                                 ss.ss_pid = ssp->ss_pid;
4884                                 ss.ss_events = ssp->ss_events;
4885                                 error = strcopyout(&ss, (void *)arg,
4886                                     sizeof (struct strsigset), copyflag);
4887                                 mutex_exit(&stp->sd_lock);
4888                                 mutex_enter(&pidlock);
4889                                 PID_RELE(pidp);
4890                                 mutex_exit(&pidlock);
4891                                 return (error);
4892                         }
4893                 mutex_exit(&stp->sd_lock);
4894                 mutex_enter(&pidlock);
4895                 PID_RELE(pidp);
4896                 mutex_exit(&pidlock);
4897                 return (EINVAL);
4898         }
4899 
4900         case I_PEEK:
4901         {
4902                 STRUCT_DECL(strpeek, strpeek);
4903                 size_t n;
4904                 mblk_t *fmp, *tmp_mp = NULL;
4905 
4906                 STRUCT_INIT(strpeek, flag);
4907 
4908                 error = strcopyin((void *)arg, STRUCT_BUF(strpeek),
4909                     STRUCT_SIZE(strpeek), copyflag);
4910                 if (error)
4911                         return (error);
4912 
4913                 mutex_enter(QLOCK(rdq));
4914                 /*
4915                  * Skip the invalid messages
4916                  */
4917                 for (mp = rdq->q_first; mp != NULL; mp = mp->b_next)
4918                         if (mp->b_datap->db_type != M_SIG)
4919                                 break;
4920 
4921                 /*
4922                  * If user has requested to peek at a high priority message
4923                  * and first message is not, return 0
4924                  */
4925                 if (mp != NULL) {
4926                         if ((STRUCT_FGET(strpeek, flags) & RS_HIPRI) &&
4927                             queclass(mp) == QNORM) {
4928                                 *rvalp = 0;
4929                                 mutex_exit(QLOCK(rdq));
4930                                 return (0);
4931                         }
4932                 } else if (stp->sd_struiordq == NULL ||
4933                     (STRUCT_FGET(strpeek, flags) & RS_HIPRI)) {
4934                         /*
4935                          * No mblks to look at at the streamhead and
4936                          * 1). This isn't a synch stream or
4937                          * 2). This is a synch stream but caller wants high
4938                          *      priority messages which is not supported by
4939                          *      the synch stream. (it only supports QNORM)
4940                          */
4941                         *rvalp = 0;
4942                         mutex_exit(QLOCK(rdq));
4943                         return (0);
4944                 }
4945 
4946                 fmp = mp;
4947 
4948                 if (mp && mp->b_datap->db_type == M_PASSFP) {
4949                         mutex_exit(QLOCK(rdq));
4950                         return (EBADMSG);
4951                 }
4952 
4953                 ASSERT(mp == NULL || mp->b_datap->db_type == M_PCPROTO ||
4954                     mp->b_datap->db_type == M_PROTO ||
4955                     mp->b_datap->db_type == M_DATA);
4956 
4957                 if (mp && mp->b_datap->db_type == M_PCPROTO) {
4958                         STRUCT_FSET(strpeek, flags, RS_HIPRI);
4959                 } else {
4960                         STRUCT_FSET(strpeek, flags, 0);
4961                 }
4962 
4963 
4964                 if (mp && ((tmp_mp = dupmsg(mp)) == NULL)) {
4965                         mutex_exit(QLOCK(rdq));
4966                         return (ENOSR);
4967                 }
4968                 mutex_exit(QLOCK(rdq));
4969 
4970                 /*
4971                  * set mp = tmp_mp, so that I_PEEK processing can continue.
4972                  * tmp_mp is used to free the dup'd message.
4973                  */
4974                 mp = tmp_mp;
4975 
4976                 uio.uio_fmode = 0;
4977                 uio.uio_extflg = UIO_COPY_CACHED;
4978                 uio.uio_segflg = (copyflag == U_TO_K) ? UIO_USERSPACE :
4979                     UIO_SYSSPACE;
4980                 uio.uio_limit = 0;
4981                 /*
4982                  * First process PROTO blocks, if any.
4983                  * If user doesn't want to get ctl info by setting maxlen <= 0,
4984                  * then set len to -1/0 and skip control blocks part.
4985                  */
4986                 if (STRUCT_FGET(strpeek, ctlbuf.maxlen) < 0)
4987                         STRUCT_FSET(strpeek, ctlbuf.len, -1);
4988                 else if (STRUCT_FGET(strpeek, ctlbuf.maxlen) == 0)
4989                         STRUCT_FSET(strpeek, ctlbuf.len, 0);
4990                 else {
4991                         int     ctl_part = 0;
4992 
4993                         iov.iov_base = STRUCT_FGETP(strpeek, ctlbuf.buf);
4994                         iov.iov_len = STRUCT_FGET(strpeek, ctlbuf.maxlen);
4995                         uio.uio_iov = &iov;
4996                         uio.uio_resid = iov.iov_len;
4997                         uio.uio_loffset = 0;
4998                         uio.uio_iovcnt = 1;
4999                         while (mp && mp->b_datap->db_type != M_DATA &&
5000                             uio.uio_resid >= 0) {
5001                                 ASSERT(STRUCT_FGET(strpeek, flags) == 0 ?
5002                                     mp->b_datap->db_type == M_PROTO :
5003                                     mp->b_datap->db_type == M_PCPROTO);
5004 
5005                                 if ((n = MIN(uio.uio_resid,
5006                                     mp->b_wptr - mp->b_rptr)) != 0 &&
5007                                     (error = uiomove((char *)mp->b_rptr, n,
5008                                     UIO_READ, &uio)) != 0) {
5009                                         freemsg(tmp_mp);
5010                                         return (error);
5011                                 }
5012                                 ctl_part = 1;
5013                                 mp = mp->b_cont;
5014                         }
5015                         /* No ctl message */
5016                         if (ctl_part == 0)
5017                                 STRUCT_FSET(strpeek, ctlbuf.len, -1);
5018                         else
5019                                 STRUCT_FSET(strpeek, ctlbuf.len,
5020                                     STRUCT_FGET(strpeek, ctlbuf.maxlen) -
5021                                     uio.uio_resid);
5022                 }
5023 
5024                 /*
5025                  * Now process DATA blocks, if any.
5026                  * If user doesn't want to get data info by setting maxlen <= 0,
5027                  * then set len to -1/0 and skip data blocks part.
5028                  */
5029                 if (STRUCT_FGET(strpeek, databuf.maxlen) < 0)
5030                         STRUCT_FSET(strpeek, databuf.len, -1);
5031                 else if (STRUCT_FGET(strpeek, databuf.maxlen) == 0)
5032                         STRUCT_FSET(strpeek, databuf.len, 0);
5033                 else {
5034                         int     data_part = 0;
5035 
5036                         iov.iov_base = STRUCT_FGETP(strpeek, databuf.buf);
5037                         iov.iov_len = STRUCT_FGET(strpeek, databuf.maxlen);
5038                         uio.uio_iov = &iov;
5039                         uio.uio_resid = iov.iov_len;
5040                         uio.uio_loffset = 0;
5041                         uio.uio_iovcnt = 1;
5042                         while (mp && uio.uio_resid) {
5043                                 if (mp->b_datap->db_type == M_DATA) {
5044                                         if ((n = MIN(uio.uio_resid,
5045                                             mp->b_wptr - mp->b_rptr)) != 0 &&
5046                                             (error = uiomove((char *)mp->b_rptr,
5047                                             n, UIO_READ, &uio)) != 0) {
5048                                                 freemsg(tmp_mp);
5049                                                 return (error);
5050                                         }
5051                                         data_part = 1;
5052                                 }
5053                                 ASSERT(data_part == 0 ||
5054                                     mp->b_datap->db_type == M_DATA);
5055                                 mp = mp->b_cont;
5056                         }
5057                         /* No data message */
5058                         if (data_part == 0)
5059                                 STRUCT_FSET(strpeek, databuf.len, -1);
5060                         else
5061                                 STRUCT_FSET(strpeek, databuf.len,
5062                                     STRUCT_FGET(strpeek, databuf.maxlen) -
5063                                     uio.uio_resid);
5064                 }
5065                 freemsg(tmp_mp);
5066 
5067                 /*
5068                  * It is a synch stream and user wants to get
5069                  * data (maxlen > 0).
5070                  * uio setup is done by the codes that process DATA
5071                  * blocks above.
5072                  */
5073                 if ((fmp == NULL) && STRUCT_FGET(strpeek, databuf.maxlen) > 0) {
5074                         infod_t infod;
5075 
5076                         infod.d_cmd = INFOD_COPYOUT;
5077                         infod.d_res = 0;
5078                         infod.d_uiop = &uio;
5079                         error = infonext(rdq, &infod);
5080                         if (error == EINVAL || error == EBUSY)
5081                                 error = 0;
5082                         if (error)
5083                                 return (error);
5084                         STRUCT_FSET(strpeek, databuf.len, STRUCT_FGET(strpeek,
5085                             databuf.maxlen) - uio.uio_resid);
5086                         if (STRUCT_FGET(strpeek, databuf.len) == 0) {
5087                                 /*
5088                                  * No data found by the infonext().
5089                                  */
5090                                 STRUCT_FSET(strpeek, databuf.len, -1);
5091                         }
5092                 }
5093                 error = strcopyout(STRUCT_BUF(strpeek), (void *)arg,
5094                     STRUCT_SIZE(strpeek), copyflag);
5095                 if (error) {
5096                         return (error);
5097                 }
5098                 /*
5099                  * If there is no message retrieved, set return code to 0
5100                  * otherwise, set it to 1.
5101                  */
5102                 if (STRUCT_FGET(strpeek, ctlbuf.len) == -1 &&
5103                     STRUCT_FGET(strpeek, databuf.len) == -1)
5104                         *rvalp = 0;
5105                 else
5106                         *rvalp = 1;
5107                 return (0);
5108         }
5109 
5110         case I_FDINSERT:
5111         {
5112                 STRUCT_DECL(strfdinsert, strfdinsert);
5113                 struct file *resftp;
5114                 struct stdata *resstp;
5115                 t_uscalar_t     ival;
5116                 ssize_t msgsize;
5117                 struct strbuf mctl;
5118 
5119                 STRUCT_INIT(strfdinsert, flag);
5120                 if (stp->sd_flag & STRHUP)
5121                         return (ENXIO);
5122                 /*
5123                  * STRDERR, STWRERR and STPLEX tested above.
5124                  */
5125                 error = strcopyin((void *)arg, STRUCT_BUF(strfdinsert),
5126                     STRUCT_SIZE(strfdinsert), copyflag);
5127                 if (error)
5128                         return (error);
5129 
5130                 if (STRUCT_FGET(strfdinsert, offset) < 0 ||
5131                     (STRUCT_FGET(strfdinsert, offset) %
5132                     sizeof (t_uscalar_t)) != 0)
5133                         return (EINVAL);
5134                 if ((resftp = getf(STRUCT_FGET(strfdinsert, fildes))) != NULL) {
5135                         if ((resstp = resftp->f_vnode->v_stream) == NULL) {
5136                                 releasef(STRUCT_FGET(strfdinsert, fildes));
5137                                 return (EINVAL);
5138                         }
5139                 } else
5140                         return (EINVAL);
5141 
5142                 mutex_enter(&resstp->sd_lock);
5143                 if (resstp->sd_flag & (STRDERR|STWRERR|STRHUP|STPLEX)) {
5144                         error = strgeterr(resstp,
5145                             STRDERR|STWRERR|STRHUP|STPLEX, 0);
5146                         if (error != 0) {
5147                                 mutex_exit(&resstp->sd_lock);
5148                                 releasef(STRUCT_FGET(strfdinsert, fildes));
5149                                 return (error);
5150                         }
5151                 }
5152                 mutex_exit(&resstp->sd_lock);
5153 
5154 #ifdef  _ILP32
5155                 {
5156                         queue_t *q;
5157                         queue_t *mate = NULL;
5158 
5159                         /* get read queue of stream terminus */
5160                         claimstr(resstp->sd_wrq);
5161                         for (q = resstp->sd_wrq->q_next; q->q_next != NULL;
5162                             q = q->q_next)
5163                                 if (!STRMATED(resstp) && STREAM(q) != resstp &&
5164                                     mate == NULL) {
5165                                         ASSERT(q->q_qinfo->qi_srvp);
5166                                         ASSERT(_OTHERQ(q)->q_qinfo->qi_srvp);
5167                                         claimstr(q);
5168                                         mate = q;
5169                                 }
5170                         q = _RD(q);
5171                         if (mate)
5172                                 releasestr(mate);
5173                         releasestr(resstp->sd_wrq);
5174                         ival = (t_uscalar_t)q;
5175                 }
5176 #else
5177                 ival = (t_uscalar_t)getminor(resftp->f_vnode->v_rdev);
5178 #endif  /* _ILP32 */
5179 
5180                 if (STRUCT_FGET(strfdinsert, ctlbuf.len) <
5181                     STRUCT_FGET(strfdinsert, offset) + sizeof (t_uscalar_t)) {
5182                         releasef(STRUCT_FGET(strfdinsert, fildes));
5183                         return (EINVAL);
5184                 }
5185 
5186                 /*
5187                  * Check for legal flag value.
5188                  */
5189                 if (STRUCT_FGET(strfdinsert, flags) & ~RS_HIPRI) {
5190                         releasef(STRUCT_FGET(strfdinsert, fildes));
5191                         return (EINVAL);
5192                 }
5193 
5194                 /* get these values from those cached in the stream head */
5195                 mutex_enter(QLOCK(stp->sd_wrq));
5196                 rmin = stp->sd_qn_minpsz;
5197                 rmax = stp->sd_qn_maxpsz;
5198                 mutex_exit(QLOCK(stp->sd_wrq));
5199 
5200                 /*
5201                  * Make sure ctl and data sizes together fall within
5202                  * the limits of the max and min receive packet sizes
5203                  * and do not exceed system limit.  A negative data
5204                  * length means that no data part is to be sent.
5205                  */
5206                 ASSERT((rmax >= 0) || (rmax == INFPSZ));
5207                 if (rmax == 0) {
5208                         releasef(STRUCT_FGET(strfdinsert, fildes));
5209                         return (ERANGE);
5210                 }
5211                 if ((msgsize = STRUCT_FGET(strfdinsert, databuf.len)) < 0)
5212                         msgsize = 0;
5213                 if ((msgsize < rmin) ||
5214                     ((msgsize > rmax) && (rmax != INFPSZ)) ||
5215                     (STRUCT_FGET(strfdinsert, ctlbuf.len) > strctlsz)) {
5216                         releasef(STRUCT_FGET(strfdinsert, fildes));
5217                         return (ERANGE);
5218                 }
5219 
5220                 mutex_enter(&stp->sd_lock);
5221                 while (!(STRUCT_FGET(strfdinsert, flags) & RS_HIPRI) &&
5222                     !canputnext(stp->sd_wrq)) {
5223                         if ((error = strwaitq(stp, WRITEWAIT, (ssize_t)0,
5224                             flag, -1, &done)) != 0 || done) {
5225                                 mutex_exit(&stp->sd_lock);
5226                                 releasef(STRUCT_FGET(strfdinsert, fildes));
5227                                 return (error);
5228                         }
5229                         if ((error = i_straccess(stp, access)) != 0) {
5230                                 mutex_exit(&stp->sd_lock);
5231                                 releasef(
5232                                     STRUCT_FGET(strfdinsert, fildes));
5233                                 return (error);
5234                         }
5235                 }
5236                 mutex_exit(&stp->sd_lock);
5237 
5238                 /*
5239                  * Copy strfdinsert.ctlbuf into native form of
5240                  * ctlbuf to pass down into strmakemsg().
5241                  */
5242                 mctl.maxlen = STRUCT_FGET(strfdinsert, ctlbuf.maxlen);
5243                 mctl.len = STRUCT_FGET(strfdinsert, ctlbuf.len);
5244                 mctl.buf = STRUCT_FGETP(strfdinsert, ctlbuf.buf);
5245 
5246                 iov.iov_base = STRUCT_FGETP(strfdinsert, databuf.buf);
5247                 iov.iov_len = STRUCT_FGET(strfdinsert, databuf.len);
5248                 uio.uio_iov = &iov;
5249                 uio.uio_iovcnt = 1;
5250                 uio.uio_loffset = 0;
5251                 uio.uio_segflg = (copyflag == U_TO_K) ? UIO_USERSPACE :
5252                     UIO_SYSSPACE;
5253                 uio.uio_fmode = 0;
5254                 uio.uio_extflg = UIO_COPY_CACHED;
5255                 uio.uio_resid = iov.iov_len;
5256                 if ((error = strmakemsg(&mctl,
5257                     &msgsize, &uio, stp,
5258                     STRUCT_FGET(strfdinsert, flags), &mp)) != 0 || !mp) {
5259                         STRUCT_FSET(strfdinsert, databuf.len, msgsize);
5260                         releasef(STRUCT_FGET(strfdinsert, fildes));
5261                         return (error);
5262                 }
5263 
5264                 STRUCT_FSET(strfdinsert, databuf.len, msgsize);
5265 
5266                 /*
5267                  * Place the possibly reencoded queue pointer 'offset' bytes
5268                  * from the start of the control portion of the message.
5269                  */
5270                 *((t_uscalar_t *)(mp->b_rptr +
5271                     STRUCT_FGET(strfdinsert, offset))) = ival;
5272 
5273                 /*
5274                  * Put message downstream.
5275                  */
5276                 stream_willservice(stp);
5277                 putnext(stp->sd_wrq, mp);
5278                 stream_runservice(stp);
5279                 releasef(STRUCT_FGET(strfdinsert, fildes));
5280                 return (error);
5281         }
5282 
5283         case I_SENDFD:
5284         {
5285                 struct file *fp;
5286 
5287                 if ((fp = getf((int)arg)) == NULL)
5288                         return (EBADF);
5289                 error = do_sendfp(stp, fp, crp);
5290                 if (auditing) {
5291                         audit_fdsend((int)arg, fp, error);
5292                 }
5293                 releasef((int)arg);
5294                 return (error);
5295         }
5296 
5297         case I_RECVFD:
5298         case I_E_RECVFD:
5299         {
5300                 struct k_strrecvfd *srf;
5301                 int i, fd;
5302 
5303                 mutex_enter(&stp->sd_lock);
5304                 while (!(mp = getq(rdq))) {
5305                         if (stp->sd_flag & (STRHUP|STREOF)) {
5306                                 mutex_exit(&stp->sd_lock);
5307                                 return (ENXIO);
5308                         }
5309                         if ((error = strwaitq(stp, GETWAIT, (ssize_t)0,
5310                             flag, -1, &done)) != 0 || done) {
5311                                 mutex_exit(&stp->sd_lock);
5312                                 return (error);
5313                         }
5314                         if ((error = i_straccess(stp, access)) != 0) {
5315                                 mutex_exit(&stp->sd_lock);
5316                                 return (error);
5317                         }
5318                 }
5319                 if (mp->b_datap->db_type != M_PASSFP) {
5320                         putback(stp, rdq, mp, mp->b_band);
5321                         mutex_exit(&stp->sd_lock);
5322                         return (EBADMSG);
5323                 }
5324                 mutex_exit(&stp->sd_lock);
5325 
5326                 srf = (struct k_strrecvfd *)mp->b_rptr;
5327                 if ((fd = ufalloc(0)) == -1) {
5328                         mutex_enter(&stp->sd_lock);
5329                         putback(stp, rdq, mp, mp->b_band);
5330                         mutex_exit(&stp->sd_lock);
5331                         return (EMFILE);
5332                 }
5333                 if (cmd == I_RECVFD) {
5334                         struct o_strrecvfd      ostrfd;
5335 
5336                         /* check to see if uid/gid values are too large. */
5337 
5338                         if (srf->uid > (o_uid_t)USHRT_MAX ||
5339                             srf->gid > (o_gid_t)USHRT_MAX) {
5340                                 mutex_enter(&stp->sd_lock);
5341                                 putback(stp, rdq, mp, mp->b_band);
5342                                 mutex_exit(&stp->sd_lock);
5343                                 setf(fd, NULL); /* release fd entry */
5344                                 return (EOVERFLOW);
5345                         }
5346 
5347                         ostrfd.fd = fd;
5348                         ostrfd.uid = (o_uid_t)srf->uid;
5349                         ostrfd.gid = (o_gid_t)srf->gid;
5350 
5351                         /* Null the filler bits */
5352                         for (i = 0; i < 8; i++)
5353                                 ostrfd.fill[i] = 0;
5354 
5355                         error = strcopyout(&ostrfd, (void *)arg,
5356                             sizeof (struct o_strrecvfd), copyflag);
5357                 } else {                /* I_E_RECVFD */
5358                         struct strrecvfd        strfd;
5359 
5360                         strfd.fd = fd;
5361                         strfd.uid = srf->uid;
5362                         strfd.gid = srf->gid;
5363 
5364                         /* null the filler bits */
5365                         for (i = 0; i < 8; i++)
5366                                 strfd.fill[i] = 0;
5367 
5368                         error = strcopyout(&strfd, (void *)arg,
5369                             sizeof (struct strrecvfd), copyflag);
5370                 }
5371 
5372                 if (error) {
5373                         setf(fd, NULL); /* release fd entry */
5374                         mutex_enter(&stp->sd_lock);
5375                         putback(stp, rdq, mp, mp->b_band);
5376                         mutex_exit(&stp->sd_lock);
5377                         return (error);
5378                 }
5379                 if (auditing) {
5380                         audit_fdrecv(fd, srf->fp);
5381                 }
5382 
5383                 /*
5384                  * Always increment f_count since the freemsg() below will
5385                  * always call free_passfp() which performs a closef().
5386                  */
5387                 mutex_enter(&srf->fp->f_tlock);
5388                 srf->fp->f_count++;
5389                 mutex_exit(&srf->fp->f_tlock);
5390                 setf(fd, srf->fp);
5391                 freemsg(mp);
5392                 return (0);
5393         }
5394 
5395         case I_SWROPT:
5396                 /*
5397                  * Set/clear the write options. arg is a bit
5398                  * mask with any of the following bits set...
5399                  *      SNDZERO - send zero length message
5400                  *      SNDPIPE - send sigpipe to process if
5401                  *              sd_werror is set and process is
5402                  *              doing a write or putmsg.
5403                  * The new stream head write options should reflect
5404                  * what is in arg.
5405                  */
5406                 if (arg & ~(SNDZERO|SNDPIPE))
5407                         return (EINVAL);
5408 
5409                 mutex_enter(&stp->sd_lock);
5410                 stp->sd_wput_opt &= ~(SW_SIGPIPE|SW_SNDZERO);
5411                 if (arg & SNDZERO)
5412                         stp->sd_wput_opt |= SW_SNDZERO;
5413                 if (arg & SNDPIPE)
5414                         stp->sd_wput_opt |= SW_SIGPIPE;
5415                 mutex_exit(&stp->sd_lock);
5416                 return (0);
5417 
5418         case I_GWROPT:
5419         {
5420                 int wropt = 0;
5421 
5422                 if (stp->sd_wput_opt & SW_SNDZERO)
5423                         wropt |= SNDZERO;
5424                 if (stp->sd_wput_opt & SW_SIGPIPE)
5425                         wropt |= SNDPIPE;
5426                 return (strcopyout(&wropt, (void *)arg, sizeof (wropt),
5427                     copyflag));
5428         }
5429 
5430         case I_LIST:
5431                 /*
5432                  * Returns all the modules found on this stream,
5433                  * upto the driver. If argument is NULL, return the
5434                  * number of modules (including driver). If argument
5435                  * is not NULL, copy the names into the structure
5436                  * provided.
5437                  */
5438 
5439         {
5440                 queue_t *q;
5441                 char *qname;
5442                 int i, nmods;
5443                 struct str_mlist *mlist;
5444                 STRUCT_DECL(str_list, strlist);
5445 
5446                 if (arg == NULL) { /* Return number of modules plus driver */
5447                         if (stp->sd_vnode->v_type == VFIFO)
5448                                 *rvalp = stp->sd_pushcnt;
5449                         else
5450                                 *rvalp = stp->sd_pushcnt + 1;
5451                         return (0);
5452                 }
5453 
5454                 STRUCT_INIT(strlist, flag);
5455 
5456                 error = strcopyin((void *)arg, STRUCT_BUF(strlist),
5457                     STRUCT_SIZE(strlist), copyflag);
5458                 if (error != 0)
5459                         return (error);
5460 
5461                 mlist = STRUCT_FGETP(strlist, sl_modlist);
5462                 nmods = STRUCT_FGET(strlist, sl_nmods);
5463                 if (nmods <= 0)
5464                         return (EINVAL);
5465 
5466                 claimstr(stp->sd_wrq);
5467                 q = stp->sd_wrq;
5468                 for (i = 0; i < nmods && _SAMESTR(q); i++, q = q->q_next) {
5469                         qname = Q2NAME(q->q_next);
5470                         error = strcopyout(qname, &mlist[i], strlen(qname) + 1,
5471                             copyflag);
5472                         if (error != 0) {
5473                                 releasestr(stp->sd_wrq);
5474                                 return (error);
5475                         }
5476                 }
5477                 releasestr(stp->sd_wrq);
5478                 return (strcopyout(&i, (void *)arg, sizeof (int), copyflag));
5479         }
5480 
5481         case I_CKBAND:
5482         {
5483                 queue_t *q;
5484                 qband_t *qbp;
5485 
5486                 if ((arg < 0) || (arg >= NBAND))
5487                         return (EINVAL);
5488                 q = _RD(stp->sd_wrq);
5489                 mutex_enter(QLOCK(q));
5490                 if (arg > (int)q->q_nband) {
5491                         *rvalp = 0;
5492                 } else {
5493                         if (arg == 0) {
5494                                 if (q->q_first)
5495                                         *rvalp = 1;
5496                                 else
5497                                         *rvalp = 0;
5498                         } else {
5499                                 qbp = q->q_bandp;
5500                                 while (--arg > 0)
5501                                         qbp = qbp->qb_next;
5502                                 if (qbp->qb_first)
5503                                         *rvalp = 1;
5504                                 else
5505                                         *rvalp = 0;
5506                         }
5507                 }
5508                 mutex_exit(QLOCK(q));
5509                 return (0);
5510         }
5511 
5512         case I_GETBAND:
5513         {
5514                 int intpri;
5515                 queue_t *q;
5516 
5517                 q = _RD(stp->sd_wrq);
5518                 mutex_enter(QLOCK(q));
5519                 mp = q->q_first;
5520                 if (!mp) {
5521                         mutex_exit(QLOCK(q));
5522                         return (ENODATA);
5523                 }
5524                 intpri = (int)mp->b_band;
5525                 error = strcopyout(&intpri, (void *)arg, sizeof (int),
5526                     copyflag);
5527                 mutex_exit(QLOCK(q));
5528                 return (error);
5529         }
5530 
5531         case I_ATMARK:
5532         {
5533                 queue_t *q;
5534 
5535                 if (arg & ~(ANYMARK|LASTMARK))
5536                         return (EINVAL);
5537                 q = _RD(stp->sd_wrq);
5538                 mutex_enter(&stp->sd_lock);
5539                 if ((stp->sd_flag & STRATMARK) && (arg == ANYMARK)) {
5540                         *rvalp = 1;
5541                 } else {
5542                         mutex_enter(QLOCK(q));
5543                         mp = q->q_first;
5544 
5545                         if (mp == NULL)
5546                                 *rvalp = 0;
5547                         else if ((arg == ANYMARK) && (mp->b_flag & MSGMARK))
5548                                 *rvalp = 1;
5549                         else if ((arg == LASTMARK) && (mp == stp->sd_mark))
5550                                 *rvalp = 1;
5551                         else
5552                                 *rvalp = 0;
5553                         mutex_exit(QLOCK(q));
5554                 }
5555                 mutex_exit(&stp->sd_lock);
5556                 return (0);
5557         }
5558 
5559         case I_CANPUT:
5560         {
5561                 char band;
5562 
5563                 if ((arg < 0) || (arg >= NBAND))
5564                         return (EINVAL);
5565                 band = (char)arg;
5566                 *rvalp = bcanputnext(stp->sd_wrq, band);
5567                 return (0);
5568         }
5569 
5570         case I_SETCLTIME:
5571         {
5572                 int closetime;
5573 
5574                 error = strcopyin((void *)arg, &closetime, sizeof (int),
5575                     copyflag);
5576                 if (error)
5577                         return (error);
5578                 if (closetime < 0)
5579                         return (EINVAL);
5580 
5581                 stp->sd_closetime = closetime;
5582                 return (0);
5583         }
5584 
5585         case I_GETCLTIME:
5586         {
5587                 int closetime;
5588 
5589                 closetime = stp->sd_closetime;
5590                 return (strcopyout(&closetime, (void *)arg, sizeof (int),
5591                     copyflag));
5592         }
5593 
5594         case TIOCGSID:
5595         {
5596                 pid_t sid;
5597 
5598                 mutex_enter(&stp->sd_lock);
5599                 if (stp->sd_sidp == NULL) {
5600                         mutex_exit(&stp->sd_lock);
5601                         return (ENOTTY);
5602                 }
5603                 sid = stp->sd_sidp->pid_id;
5604                 mutex_exit(&stp->sd_lock);
5605                 return (strcopyout(&sid, (void *)arg, sizeof (pid_t),
5606                     copyflag));
5607         }
5608 
5609         case TIOCSPGRP:
5610         {
5611                 pid_t pgrp;
5612                 proc_t *q;
5613                 pid_t   sid, fg_pgid, bg_pgid;
5614 
5615                 if (error = strcopyin((void *)arg, &pgrp, sizeof (pid_t),
5616                     copyflag))
5617                         return (error);
5618                 mutex_enter(&stp->sd_lock);
5619                 mutex_enter(&pidlock);
5620                 if (stp->sd_sidp != ttoproc(curthread)->p_sessp->s_sidp) {
5621                         mutex_exit(&pidlock);
5622                         mutex_exit(&stp->sd_lock);
5623                         return (ENOTTY);
5624                 }
5625                 if (pgrp == stp->sd_pgidp->pid_id) {
5626                         mutex_exit(&pidlock);
5627                         mutex_exit(&stp->sd_lock);
5628                         return (0);
5629                 }
5630                 if (pgrp <= 0 || pgrp >= maxpid) {
5631                         mutex_exit(&pidlock);
5632                         mutex_exit(&stp->sd_lock);
5633                         return (EINVAL);
5634                 }
5635                 if ((q = pgfind(pgrp)) == NULL ||
5636                     q->p_sessp != ttoproc(curthread)->p_sessp) {
5637                         mutex_exit(&pidlock);
5638                         mutex_exit(&stp->sd_lock);
5639                         return (EPERM);
5640                 }
5641                 sid = stp->sd_sidp->pid_id;
5642                 fg_pgid = q->p_pgrp;
5643                 bg_pgid = stp->sd_pgidp->pid_id;
5644                 CL_SET_PROCESS_GROUP(curthread, sid, bg_pgid, fg_pgid);
5645                 PID_RELE(stp->sd_pgidp);
5646                 ctty_clear_sighuped();
5647                 stp->sd_pgidp = q->p_pgidp;
5648                 PID_HOLD(stp->sd_pgidp);
5649                 mutex_exit(&pidlock);
5650                 mutex_exit(&stp->sd_lock);
5651                 return (0);
5652         }
5653 
5654         case TIOCGPGRP:
5655         {
5656                 pid_t pgrp;
5657 
5658                 mutex_enter(&stp->sd_lock);
5659                 if (stp->sd_sidp == NULL) {
5660                         mutex_exit(&stp->sd_lock);
5661                         return (ENOTTY);
5662                 }
5663                 pgrp = stp->sd_pgidp->pid_id;
5664                 mutex_exit(&stp->sd_lock);
5665                 return (strcopyout(&pgrp, (void *)arg, sizeof (pid_t),
5666                     copyflag));
5667         }
5668 
5669         case TIOCSCTTY:
5670         {
5671                 return (strctty(stp));
5672         }
5673 
5674         case TIOCNOTTY:
5675         {
5676                 /* freectty() always assumes curproc. */
5677                 if (freectty(B_FALSE) != 0)
5678                         return (0);
5679                 return (ENOTTY);
5680         }
5681 
5682         case FIONBIO:
5683         case FIOASYNC:
5684                 return (0);     /* handled by the upper layer */
5685         }
5686 }
5687 
5688 /*
5689  * Custom free routine used for M_PASSFP messages.
5690  */
5691 static void
5692 free_passfp(struct k_strrecvfd *srf)
5693 {
5694         (void) closef(srf->fp);
5695         kmem_free(srf, sizeof (struct k_strrecvfd) + sizeof (frtn_t));
5696 }
5697 
5698 /* ARGSUSED */
5699 int
5700 do_sendfp(struct stdata *stp, struct file *fp, struct cred *cr)
5701 {
5702         queue_t *qp, *nextqp;
5703         struct k_strrecvfd *srf;
5704         mblk_t *mp;
5705         frtn_t *frtnp;
5706         size_t bufsize;
5707         queue_t *mate = NULL;
5708         syncq_t *sq = NULL;
5709         int retval = 0;
5710 
5711         if (stp->sd_flag & STRHUP)
5712                 return (ENXIO);
5713 
5714         claimstr(stp->sd_wrq);
5715 
5716         /* Fastpath, we have a pipe, and we are already mated, use it. */
5717         if (STRMATED(stp)) {
5718                 qp = _RD(stp->sd_mate->sd_wrq);
5719                 claimstr(qp);
5720                 mate = qp;
5721         } else { /* Not already mated. */
5722 
5723                 /*
5724                  * Walk the stream to the end of this one.
5725                  * assumes that the claimstr() will prevent
5726                  * plumbing between the stream head and the
5727                  * driver from changing
5728                  */
5729                 qp = stp->sd_wrq;
5730 
5731                 /*
5732                  * Loop until we reach the end of this stream.
5733                  * On completion, qp points to the write queue
5734                  * at the end of the stream, or the read queue
5735                  * at the stream head if this is a fifo.
5736                  */
5737                 while (((qp = qp->q_next) != NULL) && _SAMESTR(qp))
5738                         ;
5739 
5740                 /*
5741                  * Just in case we get a q_next which is NULL, but
5742                  * not at the end of the stream.  This is actually
5743                  * broken, so we set an assert to catch it in
5744                  * debug, and set an error and return if not debug.
5745                  */
5746                 ASSERT(qp);
5747                 if (qp == NULL) {
5748                         releasestr(stp->sd_wrq);
5749                         return (EINVAL);
5750                 }
5751 
5752                 /*
5753                  * Enter the syncq for the driver, so (hopefully)
5754                  * the queue values will not change on us.
5755                  * XXXX - This will only prevent the race IFF only
5756                  *   the write side modifies the q_next member, and
5757                  *   the put procedure is protected by at least
5758                  *   MT_PERQ.
5759                  */
5760                 if ((sq = qp->q_syncq) != NULL)
5761                         entersq(sq, SQ_PUT);
5762 
5763                 /* Now get the q_next value from this qp. */
5764                 nextqp = qp->q_next;
5765 
5766                 /*
5767                  * If nextqp exists and the other stream is different
5768                  * from this one claim the stream, set the mate, and
5769                  * get the read queue at the stream head of the other
5770                  * stream.  Assumes that nextqp was at least valid when
5771                  * we got it.  Hopefully the entersq of the driver
5772                  * will prevent it from changing on us.
5773                  */
5774                 if ((nextqp != NULL) && (STREAM(nextqp) != stp)) {
5775                         ASSERT(qp->q_qinfo->qi_srvp);
5776                         ASSERT(_OTHERQ(qp)->q_qinfo->qi_srvp);
5777                         ASSERT(_OTHERQ(qp->q_next)->q_qinfo->qi_srvp);
5778                         claimstr(nextqp);
5779 
5780                         /* Make sure we still have a q_next */
5781                         if (nextqp != qp->q_next) {
5782                                 releasestr(stp->sd_wrq);
5783                                 releasestr(nextqp);
5784                                 return (EINVAL);
5785                         }
5786 
5787                         qp = _RD(STREAM(nextqp)->sd_wrq);
5788                         mate = qp;
5789                 }
5790                 /* If we entered the synq above, leave it. */
5791                 if (sq != NULL)
5792                         leavesq(sq, SQ_PUT);
5793         } /*  STRMATED(STP)  */
5794 
5795         /* XXX prevents substitution of the ops vector */
5796         if (qp->q_qinfo != &strdata && qp->q_qinfo != &fifo_strdata) {
5797                 retval = EINVAL;
5798                 goto out;
5799         }
5800 
5801         if (qp->q_flag & QFULL) {
5802                 retval = EAGAIN;
5803                 goto out;
5804         }
5805 
5806         /*
5807          * Since M_PASSFP messages include a file descriptor, we use
5808          * esballoc() and specify a custom free routine (free_passfp()) that
5809          * will close the descriptor as part of freeing the message.  For
5810          * convenience, we stash the frtn_t right after the data block.
5811          */
5812         bufsize = sizeof (struct k_strrecvfd) + sizeof (frtn_t);
5813         srf = kmem_alloc(bufsize, KM_NOSLEEP);
5814         if (srf == NULL) {
5815                 retval = EAGAIN;
5816                 goto out;
5817         }
5818 
5819         frtnp = (frtn_t *)(srf + 1);
5820         frtnp->free_arg = (caddr_t)srf;
5821         frtnp->free_func = free_passfp;
5822 
5823         mp = esballoc((uchar_t *)srf, bufsize, BPRI_MED, frtnp);
5824         if (mp == NULL) {
5825                 kmem_free(srf, bufsize);
5826                 retval = EAGAIN;
5827                 goto out;
5828         }
5829         mp->b_wptr += sizeof (struct k_strrecvfd);
5830         mp->b_datap->db_type = M_PASSFP;
5831 
5832         srf->fp = fp;
5833         srf->uid = crgetuid(curthread->t_cred);
5834         srf->gid = crgetgid(curthread->t_cred);
5835         mutex_enter(&fp->f_tlock);
5836         fp->f_count++;
5837         mutex_exit(&fp->f_tlock);
5838 
5839         put(qp, mp);
5840 out:
5841         releasestr(stp->sd_wrq);
5842         if (mate)
5843                 releasestr(mate);
5844         return (retval);
5845 }
5846 
5847 /*
5848  * Send an ioctl message downstream and wait for acknowledgement.
5849  * flags may be set to either U_TO_K or K_TO_K and a combination
5850  * of STR_NOERROR or STR_NOSIG
5851  * STR_NOSIG: Signals are essentially ignored or held and have
5852  *      no effect for the duration of the call.
5853  * STR_NOERROR: Ignores stream head read, write and hup errors.
5854  *      Additionally, if an existing ioctl times out, it is assumed
5855  *      lost and and this ioctl will continue as if the previous ioctl had
5856  *      finished.  ETIME may be returned if this ioctl times out (i.e.
5857  *      ic_timout is not INFTIM).  Non-stream head errors may be returned if
5858  *      the ioc_error indicates that the driver/module had problems,
5859  *      an EFAULT was found when accessing user data, a lack of
5860  *      resources, etc.
5861  */
5862 int
5863 strdoioctl(
5864         struct stdata *stp,
5865         struct strioctl *strioc,
5866         int fflags,             /* file flags with model info */
5867         int flag,
5868         cred_t *crp,
5869         int *rvalp)
5870 {
5871         mblk_t *bp;
5872         struct iocblk *iocbp;
5873         struct copyreq *reqp;
5874         struct copyresp *resp;
5875         int id;
5876         int transparent = 0;
5877         int error = 0;
5878         int len = 0;
5879         caddr_t taddr;
5880         int copyflag = (flag & (U_TO_K | K_TO_K));
5881         int sigflag = (flag & STR_NOSIG);
5882         int errs;
5883         uint_t waitflags;
5884         boolean_t set_iocwaitne = B_FALSE;
5885 
5886         ASSERT(copyflag == U_TO_K || copyflag == K_TO_K);
5887         ASSERT((fflags & FMODELS) != 0);
5888 
5889         TRACE_2(TR_FAC_STREAMS_FR,
5890             TR_STRDOIOCTL,
5891             "strdoioctl:stp %p strioc %p", stp, strioc);
5892         if (strioc->ic_len == TRANSPARENT) { /* send arg in M_DATA block */
5893                 transparent = 1;
5894                 strioc->ic_len = sizeof (intptr_t);
5895         }
5896 
5897         if (strioc->ic_len < 0 || (strmsgsz > 0 && strioc->ic_len > strmsgsz))
5898                 return (EINVAL);
5899 
5900         if ((bp = allocb_cred_wait(sizeof (union ioctypes), sigflag, &error,
5901             crp, curproc->p_pid)) == NULL)
5902                         return (error);
5903 
5904         bzero(bp->b_wptr, sizeof (union ioctypes));
5905 
5906         iocbp = (struct iocblk *)bp->b_wptr;
5907         iocbp->ioc_count = strioc->ic_len;
5908         iocbp->ioc_cmd = strioc->ic_cmd;
5909         iocbp->ioc_flag = (fflags & FMODELS);
5910 
5911         crhold(crp);
5912         iocbp->ioc_cr = crp;
5913         DB_TYPE(bp) = M_IOCTL;
5914         bp->b_wptr += sizeof (struct iocblk);
5915 
5916         if (flag & STR_NOERROR)
5917                 errs = STPLEX;
5918         else
5919                 errs = STRHUP|STRDERR|STWRERR|STPLEX;
5920 
5921         /*
5922          * If there is data to copy into ioctl block, do so.
5923          */
5924         if (iocbp->ioc_count > 0) {
5925                 if (transparent)
5926                         /*
5927                          * Note: STR_NOERROR does not have an effect
5928                          * in putiocd()
5929                          */
5930                         id = K_TO_K | sigflag;
5931                 else
5932                         id = flag;
5933                 if ((error = putiocd(bp, strioc->ic_dp, id, crp)) != 0) {
5934                         freemsg(bp);
5935                         crfree(crp);
5936                         return (error);
5937                 }
5938 
5939                 /*
5940                  * We could have slept copying in user pages.
5941                  * Recheck the stream head state (the other end
5942                  * of a pipe could have gone away).
5943                  */
5944                 if (stp->sd_flag & errs) {
5945                         mutex_enter(&stp->sd_lock);
5946                         error = strgeterr(stp, errs, 0);
5947                         mutex_exit(&stp->sd_lock);
5948                         if (error != 0) {
5949                                 freemsg(bp);
5950                                 crfree(crp);
5951                                 return (error);
5952                         }
5953                 }
5954         }
5955         if (transparent)
5956                 iocbp->ioc_count = TRANSPARENT;
5957 
5958         /*
5959          * Block for up to STRTIMOUT milliseconds if there is an outstanding
5960          * ioctl for this stream already running.  All processes
5961          * sleeping here will be awakened as a result of an ACK
5962          * or NAK being received for the outstanding ioctl, or
5963          * as a result of the timer expiring on the outstanding
5964          * ioctl (a failure), or as a result of any waiting
5965          * process's timer expiring (also a failure).
5966          */
5967 
5968         error = 0;
5969         mutex_enter(&stp->sd_lock);
5970         while ((stp->sd_flag & IOCWAIT) ||
5971             (!set_iocwaitne && (stp->sd_flag & IOCWAITNE))) {
5972                 clock_t cv_rval;
5973 
5974                 TRACE_0(TR_FAC_STREAMS_FR,
5975                     TR_STRDOIOCTL_WAIT,
5976                     "strdoioctl sleeps - IOCWAIT");
5977                 cv_rval = str_cv_wait(&stp->sd_iocmonitor, &stp->sd_lock,
5978                     STRTIMOUT, sigflag);
5979                 if (cv_rval <= 0) {
5980                         if (cv_rval == 0) {
5981                                 error = EINTR;
5982                         } else {
5983                                 if (flag & STR_NOERROR) {
5984                                         /*
5985                                          * Terminating current ioctl in
5986                                          * progress -- assume it got lost and
5987                                          * wake up the other thread so that the
5988                                          * operation completes.
5989                                          */
5990                                         if (!(stp->sd_flag & IOCWAITNE)) {
5991                                                 set_iocwaitne = B_TRUE;
5992                                                 stp->sd_flag |= IOCWAITNE;
5993                                                 cv_broadcast(&stp->sd_monitor);
5994                                         }
5995                                         /*
5996                                          * Otherwise, there's a running
5997                                          * STR_NOERROR -- we have no choice
5998                                          * here but to wait forever (or until
5999                                          * interrupted).
6000                                          */
6001                                 } else {
6002                                         /*
6003                                          * pending ioctl has caused
6004                                          * us to time out
6005                                          */
6006                                         error = ETIME;
6007                                 }
6008                         }
6009                 } else if ((stp->sd_flag & errs)) {
6010                         error = strgeterr(stp, errs, 0);
6011                 }
6012                 if (error) {
6013                         mutex_exit(&stp->sd_lock);
6014                         freemsg(bp);
6015                         crfree(crp);
6016                         return (error);
6017                 }
6018         }
6019 
6020         /*
6021          * Have control of ioctl mechanism.
6022          * Send down ioctl packet and wait for response.
6023          */
6024         if (stp->sd_iocblk != (mblk_t *)-1) {
6025                 freemsg(stp->sd_iocblk);
6026         }
6027         stp->sd_iocblk = NULL;
6028 
6029         /*
6030          * If this is marked with 'noerror' (internal; mostly
6031          * I_{P,}{UN,}LINK), then make sure nobody else is able to get
6032          * in here by setting IOCWAITNE.
6033          */
6034         waitflags = IOCWAIT;
6035         if (flag & STR_NOERROR)
6036                 waitflags |= IOCWAITNE;
6037 
6038         stp->sd_flag |= waitflags;
6039 
6040         /*
6041          * Assign sequence number.
6042          */
6043         iocbp->ioc_id = stp->sd_iocid = getiocseqno();
6044 
6045         mutex_exit(&stp->sd_lock);
6046 
6047         TRACE_1(TR_FAC_STREAMS_FR,
6048             TR_STRDOIOCTL_PUT, "strdoioctl put: stp %p", stp);
6049         stream_willservice(stp);
6050         putnext(stp->sd_wrq, bp);
6051         stream_runservice(stp);
6052 
6053         /*
6054          * Timed wait for acknowledgment.  The wait time is limited by the
6055          * timeout value, which must be a positive integer (number of
6056          * milliseconds) to wait, or 0 (use default value of STRTIMOUT
6057          * milliseconds), or -1 (wait forever).  This will be awakened
6058          * either by an ACK/NAK message arriving, the timer expiring, or
6059          * the timer expiring on another ioctl waiting for control of the
6060          * mechanism.
6061          */
6062 waitioc:
6063         mutex_enter(&stp->sd_lock);
6064 
6065 
6066         /*
6067          * If the reply has already arrived, don't sleep.  If awakened from
6068          * the sleep, fail only if the reply has not arrived by then.
6069          * Otherwise, process the reply.
6070          */
6071         while (!stp->sd_iocblk) {
6072                 clock_t cv_rval;
6073 
6074                 if (stp->sd_flag & errs) {
6075                         error = strgeterr(stp, errs, 0);
6076                         if (error != 0) {
6077                                 stp->sd_flag &= ~waitflags;
6078                                 cv_broadcast(&stp->sd_iocmonitor);
6079                                 mutex_exit(&stp->sd_lock);
6080                                 crfree(crp);
6081                                 return (error);
6082                         }
6083                 }
6084 
6085                 TRACE_0(TR_FAC_STREAMS_FR,
6086                     TR_STRDOIOCTL_WAIT2,
6087                     "strdoioctl sleeps awaiting reply");
6088                 ASSERT(error == 0);
6089 
6090                 cv_rval = str_cv_wait(&stp->sd_monitor, &stp->sd_lock,
6091                     (strioc->ic_timout ?
6092                     strioc->ic_timout * 1000 : STRTIMOUT), sigflag);
6093 
6094                 /*
6095                  * There are four possible cases here: interrupt, timeout,
6096                  * wakeup by IOCWAITNE (above), or wakeup by strrput_nondata (a
6097                  * valid M_IOCTL reply).
6098                  *
6099                  * If we've been awakened by a STR_NOERROR ioctl on some other
6100                  * thread, then sd_iocblk will still be NULL, and IOCWAITNE
6101                  * will be set.  Pretend as if we just timed out.  Note that
6102                  * this other thread waited at least STRTIMOUT before trying to
6103                  * awaken our thread, so this is indistinguishable (even for
6104                  * INFTIM) from the case where we failed with ETIME waiting on
6105                  * IOCWAIT in the prior loop.
6106                  */
6107                 if (cv_rval > 0 && !(flag & STR_NOERROR) &&
6108                     stp->sd_iocblk == NULL && (stp->sd_flag & IOCWAITNE)) {
6109                         cv_rval = -1;
6110                 }
6111 
6112                 /*
6113                  * note: STR_NOERROR does not protect
6114                  * us here.. use ic_timout < 0
6115                  */
6116                 if (cv_rval <= 0) {
6117                         if (cv_rval == 0) {
6118                                 error = EINTR;
6119                         } else {
6120                                 error =  ETIME;
6121                         }
6122                         /*
6123                          * A message could have come in after we were scheduled
6124                          * but before we were actually run.
6125                          */
6126                         bp = stp->sd_iocblk;
6127                         stp->sd_iocblk = NULL;
6128                         if (bp != NULL) {
6129                                 if ((bp->b_datap->db_type == M_COPYIN) ||
6130                                     (bp->b_datap->db_type == M_COPYOUT)) {
6131                                         mutex_exit(&stp->sd_lock);
6132                                         if (bp->b_cont) {
6133                                                 freemsg(bp->b_cont);
6134                                                 bp->b_cont = NULL;
6135                                         }
6136                                         bp->b_datap->db_type = M_IOCDATA;
6137                                         bp->b_wptr = bp->b_rptr +
6138                                             sizeof (struct copyresp);
6139                                         resp = (struct copyresp *)bp->b_rptr;
6140                                         resp->cp_rval =
6141                                             (caddr_t)1; /* failure */
6142                                         stream_willservice(stp);
6143                                         putnext(stp->sd_wrq, bp);
6144                                         stream_runservice(stp);
6145                                         mutex_enter(&stp->sd_lock);
6146                                 } else {
6147                                         freemsg(bp);
6148                                 }
6149                         }
6150                         stp->sd_flag &= ~waitflags;
6151                         cv_broadcast(&stp->sd_iocmonitor);
6152                         mutex_exit(&stp->sd_lock);
6153                         crfree(crp);
6154                         return (error);
6155                 }
6156         }
6157         bp = stp->sd_iocblk;
6158         /*
6159          * Note: it is strictly impossible to get here with sd_iocblk set to
6160          * -1.  This is because the initial loop above doesn't allow any new
6161          * ioctls into the fray until all others have passed this point.
6162          */
6163         ASSERT(bp != NULL && bp != (mblk_t *)-1);
6164         TRACE_1(TR_FAC_STREAMS_FR,
6165             TR_STRDOIOCTL_ACK, "strdoioctl got reply: bp %p", bp);
6166         if ((bp->b_datap->db_type == M_IOCACK) ||
6167             (bp->b_datap->db_type == M_IOCNAK)) {
6168                 /* for detection of duplicate ioctl replies */
6169                 stp->sd_iocblk = (mblk_t *)-1;
6170                 stp->sd_flag &= ~waitflags;
6171                 cv_broadcast(&stp->sd_iocmonitor);
6172                 mutex_exit(&stp->sd_lock);
6173         } else {
6174                 /*
6175                  * flags not cleared here because we're still doing
6176                  * copy in/out for ioctl.
6177                  */
6178                 stp->sd_iocblk = NULL;
6179                 mutex_exit(&stp->sd_lock);
6180         }
6181 
6182 
6183         /*
6184          * Have received acknowledgment.
6185          */
6186 
6187         switch (bp->b_datap->db_type) {
6188         case M_IOCACK:
6189                 /*
6190                  * Positive ack.
6191                  */
6192                 iocbp = (struct iocblk *)bp->b_rptr;
6193 
6194                 /*
6195                  * Set error if indicated.
6196                  */
6197                 if (iocbp->ioc_error) {
6198                         error = iocbp->ioc_error;
6199                         break;
6200                 }
6201 
6202                 /*
6203                  * Set return value.
6204                  */
6205                 *rvalp = iocbp->ioc_rval;
6206 
6207                 /*
6208                  * Data may have been returned in ACK message (ioc_count > 0).
6209                  * If so, copy it out to the user's buffer.
6210                  */
6211                 if (iocbp->ioc_count && !transparent) {
6212                         if (error = getiocd(bp, strioc->ic_dp, copyflag))
6213                                 break;
6214                 }
6215                 if (!transparent) {
6216                         if (len)        /* an M_COPYOUT was used with I_STR */
6217                                 strioc->ic_len = len;
6218                         else
6219                                 strioc->ic_len = (int)iocbp->ioc_count;
6220                 }
6221                 break;
6222 
6223         case M_IOCNAK:
6224                 /*
6225                  * Negative ack.
6226                  *
6227                  * The only thing to do is set error as specified
6228                  * in neg ack packet.
6229                  */
6230                 iocbp = (struct iocblk *)bp->b_rptr;
6231 
6232                 error = (iocbp->ioc_error ? iocbp->ioc_error : EINVAL);
6233                 break;
6234 
6235         case M_COPYIN:
6236                 /*
6237                  * Driver or module has requested user ioctl data.
6238                  */
6239                 reqp = (struct copyreq *)bp->b_rptr;
6240 
6241                 /*
6242                  * M_COPYIN should *never* have a message attached, though
6243                  * it's harmless if it does -- thus, panic on a DEBUG
6244                  * kernel and just free it on a non-DEBUG build.
6245                  */
6246                 ASSERT(bp->b_cont == NULL);
6247                 if (bp->b_cont != NULL) {
6248                         freemsg(bp->b_cont);
6249                         bp->b_cont = NULL;
6250                 }
6251 
6252                 error = putiocd(bp, reqp->cq_addr, flag, crp);
6253                 if (error && bp->b_cont) {
6254                         freemsg(bp->b_cont);
6255                         bp->b_cont = NULL;
6256                 }
6257 
6258                 bp->b_wptr = bp->b_rptr + sizeof (struct copyresp);
6259                 bp->b_datap->db_type = M_IOCDATA;
6260 
6261                 mblk_setcred(bp, crp, curproc->p_pid);
6262                 resp = (struct copyresp *)bp->b_rptr;
6263                 resp->cp_rval = (caddr_t)(uintptr_t)error;
6264                 resp->cp_flag = (fflags & FMODELS);
6265 
6266                 stream_willservice(stp);
6267                 putnext(stp->sd_wrq, bp);
6268                 stream_runservice(stp);
6269 
6270                 if (error) {
6271                         mutex_enter(&stp->sd_lock);
6272                         stp->sd_flag &= ~waitflags;
6273                         cv_broadcast(&stp->sd_iocmonitor);
6274                         mutex_exit(&stp->sd_lock);
6275                         crfree(crp);
6276                         return (error);
6277                 }
6278 
6279                 goto waitioc;
6280 
6281         case M_COPYOUT:
6282                 /*
6283                  * Driver or module has ioctl data for a user.
6284                  */
6285                 reqp = (struct copyreq *)bp->b_rptr;
6286                 ASSERT(bp->b_cont != NULL);
6287 
6288                 /*
6289                  * Always (transparent or non-transparent )
6290                  * use the address specified in the request
6291                  */
6292                 taddr = reqp->cq_addr;
6293                 if (!transparent)
6294                         len = (int)reqp->cq_size;
6295 
6296                 /* copyout data to the provided address */
6297                 error = getiocd(bp, taddr, copyflag);
6298 
6299                 freemsg(bp->b_cont);
6300                 bp->b_cont = NULL;
6301 
6302                 bp->b_wptr = bp->b_rptr + sizeof (struct copyresp);
6303                 bp->b_datap->db_type = M_IOCDATA;
6304 
6305                 mblk_setcred(bp, crp, curproc->p_pid);
6306                 resp = (struct copyresp *)bp->b_rptr;
6307                 resp->cp_rval = (caddr_t)(uintptr_t)error;
6308                 resp->cp_flag = (fflags & FMODELS);
6309 
6310                 stream_willservice(stp);
6311                 putnext(stp->sd_wrq, bp);
6312                 stream_runservice(stp);
6313 
6314                 if (error) {
6315                         mutex_enter(&stp->sd_lock);
6316                         stp->sd_flag &= ~waitflags;
6317                         cv_broadcast(&stp->sd_iocmonitor);
6318                         mutex_exit(&stp->sd_lock);
6319                         crfree(crp);
6320                         return (error);
6321                 }
6322                 goto waitioc;
6323 
6324         default:
6325                 ASSERT(0);
6326                 mutex_enter(&stp->sd_lock);
6327                 stp->sd_flag &= ~waitflags;
6328                 cv_broadcast(&stp->sd_iocmonitor);
6329                 mutex_exit(&stp->sd_lock);
6330                 break;
6331         }
6332 
6333         freemsg(bp);
6334         crfree(crp);
6335         return (error);
6336 }
6337 
6338 /*
6339  * Send an M_CMD message downstream and wait for a reply.  This is a ptools
6340  * special used to retrieve information from modules/drivers a stream without
6341  * being subjected to flow control or interfering with pending messages on the
6342  * stream (e.g. an ioctl in flight).
6343  */
6344 int
6345 strdocmd(struct stdata *stp, struct strcmd *scp, cred_t *crp)
6346 {
6347         mblk_t *mp;
6348         struct cmdblk *cmdp;
6349         int error = 0;
6350         int errs = STRHUP|STRDERR|STWRERR|STPLEX;
6351         clock_t rval, timeout = STRTIMOUT;
6352 
6353         if (scp->sc_len < 0 || scp->sc_len > sizeof (scp->sc_buf) ||
6354             scp->sc_timeout < -1)
6355                 return (EINVAL);
6356 
6357         if (scp->sc_timeout > 0)
6358                 timeout = scp->sc_timeout * MILLISEC;
6359 
6360         if ((mp = allocb_cred(sizeof (struct cmdblk), crp,
6361             curproc->p_pid)) == NULL)
6362                 return (ENOMEM);
6363 
6364         crhold(crp);
6365 
6366         cmdp = (struct cmdblk *)mp->b_wptr;
6367         cmdp->cb_cr = crp;
6368         cmdp->cb_cmd = scp->sc_cmd;
6369         cmdp->cb_len = scp->sc_len;
6370         cmdp->cb_error = 0;
6371         mp->b_wptr += sizeof (struct cmdblk);
6372 
6373         DB_TYPE(mp) = M_CMD;
6374         DB_CPID(mp) = curproc->p_pid;
6375 
6376         /*
6377          * Copy in the payload.
6378          */
6379         if (cmdp->cb_len > 0) {
6380                 mp->b_cont = allocb_cred(sizeof (scp->sc_buf), crp,
6381                     curproc->p_pid);
6382                 if (mp->b_cont == NULL) {
6383                         error = ENOMEM;
6384                         goto out;
6385                 }
6386 
6387                 /* cb_len comes from sc_len, which has already been checked */
6388                 ASSERT(cmdp->cb_len <= sizeof (scp->sc_buf));
6389                 (void) bcopy(scp->sc_buf, mp->b_cont->b_wptr, cmdp->cb_len);
6390                 mp->b_cont->b_wptr += cmdp->cb_len;
6391                 DB_CPID(mp->b_cont) = curproc->p_pid;
6392         }
6393 
6394         /*
6395          * Since this mechanism is strictly for ptools, and since only one
6396          * process can be grabbed at a time, we simply fail if there's
6397          * currently an operation pending.
6398          */
6399         mutex_enter(&stp->sd_lock);
6400         if (stp->sd_flag & STRCMDWAIT) {
6401                 mutex_exit(&stp->sd_lock);
6402                 error = EBUSY;
6403                 goto out;
6404         }
6405         stp->sd_flag |= STRCMDWAIT;
6406         ASSERT(stp->sd_cmdblk == NULL);
6407         mutex_exit(&stp->sd_lock);
6408 
6409         putnext(stp->sd_wrq, mp);
6410         mp = NULL;
6411 
6412         /*
6413          * Timed wait for acknowledgment.  If the reply has already arrived,
6414          * don't sleep.  If awakened from the sleep, fail only if the reply
6415          * has not arrived by then.  Otherwise, process the reply.
6416          */
6417         mutex_enter(&stp->sd_lock);
6418         while (stp->sd_cmdblk == NULL) {
6419                 if (stp->sd_flag & errs) {
6420                         if ((error = strgeterr(stp, errs, 0)) != 0)
6421                                 goto waitout;
6422                 }
6423 
6424                 rval = str_cv_wait(&stp->sd_monitor, &stp->sd_lock, timeout, 0);
6425                 if (stp->sd_cmdblk != NULL)
6426                         break;
6427 
6428                 if (rval <= 0) {
6429                         error = (rval == 0) ? EINTR : ETIME;
6430                         goto waitout;
6431                 }
6432         }
6433 
6434         /*
6435          * We received a reply.
6436          */
6437         mp = stp->sd_cmdblk;
6438         stp->sd_cmdblk = NULL;
6439         ASSERT(mp != NULL && DB_TYPE(mp) == M_CMD);
6440         ASSERT(stp->sd_flag & STRCMDWAIT);
6441         stp->sd_flag &= ~STRCMDWAIT;
6442         mutex_exit(&stp->sd_lock);
6443 
6444         cmdp = (struct cmdblk *)mp->b_rptr;
6445         if ((error = cmdp->cb_error) != 0)
6446                 goto out;
6447 
6448         /*
6449          * Data may have been returned in the reply (cb_len > 0).
6450          * If so, copy it out to the user's buffer.
6451          */
6452         if (cmdp->cb_len > 0) {
6453                 if (mp->b_cont == NULL || MBLKL(mp->b_cont) < cmdp->cb_len) {
6454                         error = EPROTO;
6455                         goto out;
6456                 }
6457 
6458                 cmdp->cb_len = MIN(cmdp->cb_len, sizeof (scp->sc_buf));
6459                 (void) bcopy(mp->b_cont->b_rptr, scp->sc_buf, cmdp->cb_len);
6460         }
6461         scp->sc_len = cmdp->cb_len;
6462 out:
6463         freemsg(mp);
6464         crfree(crp);
6465         return (error);
6466 waitout:
6467         ASSERT(stp->sd_cmdblk == NULL);
6468         stp->sd_flag &= ~STRCMDWAIT;
6469         mutex_exit(&stp->sd_lock);
6470         crfree(crp);
6471         return (error);
6472 }
6473 
6474 /*
6475  * For the SunOS keyboard driver.
6476  * Return the next available "ioctl" sequence number.
6477  * Exported, so that streams modules can send "ioctl" messages
6478  * downstream from their open routine.
6479  */
6480 int
6481 getiocseqno(void)
6482 {
6483         int     i;
6484 
6485         mutex_enter(&strresources);
6486         i = ++ioc_id;
6487         mutex_exit(&strresources);
6488         return (i);
6489 }
6490 
6491 /*
6492  * Get the next message from the read queue.  If the message is
6493  * priority, STRPRI will have been set by strrput().  This flag
6494  * should be reset only when the entire message at the front of the
6495  * queue as been consumed.
6496  *
6497  * NOTE: strgetmsg and kstrgetmsg have much of the logic in common.
6498  */
6499 int
6500 strgetmsg(
6501         struct vnode *vp,
6502         struct strbuf *mctl,
6503         struct strbuf *mdata,
6504         unsigned char *prip,
6505         int *flagsp,
6506         int fmode,
6507         rval_t *rvp)
6508 {
6509         struct stdata *stp;
6510         mblk_t *bp, *nbp;
6511         mblk_t *savemp = NULL;
6512         mblk_t *savemptail = NULL;
6513         uint_t old_sd_flag;
6514         int flg;
6515         int more = 0;
6516         int error = 0;
6517         char first = 1;
6518         uint_t mark;            /* Contains MSG*MARK and _LASTMARK */
6519 #define _LASTMARK       0x8000  /* Distinct from MSG*MARK */
6520         unsigned char pri = 0;
6521         queue_t *q;
6522         int     pr = 0;                 /* Partial read successful */
6523         struct uio uios;
6524         struct uio *uiop = &uios;
6525         struct iovec iovs;
6526         unsigned char type;
6527 
6528         TRACE_1(TR_FAC_STREAMS_FR, TR_STRGETMSG_ENTER,
6529             "strgetmsg:%p", vp);
6530 
6531         ASSERT(vp->v_stream);
6532         stp = vp->v_stream;
6533         rvp->r_val1 = 0;
6534 
6535         mutex_enter(&stp->sd_lock);
6536 
6537         if ((error = i_straccess(stp, JCREAD)) != 0) {
6538                 mutex_exit(&stp->sd_lock);
6539                 return (error);
6540         }
6541 
6542         if (stp->sd_flag & (STRDERR|STPLEX)) {
6543                 error = strgeterr(stp, STRDERR|STPLEX, 0);
6544                 if (error != 0) {
6545                         mutex_exit(&stp->sd_lock);
6546                         return (error);
6547                 }
6548         }
6549         mutex_exit(&stp->sd_lock);
6550 
6551         switch (*flagsp) {
6552         case MSG_HIPRI:
6553                 if (*prip != 0)
6554                         return (EINVAL);
6555                 break;
6556 
6557         case MSG_ANY:
6558         case MSG_BAND:
6559                 break;
6560 
6561         default:
6562                 return (EINVAL);
6563         }
6564         /*
6565          * Setup uio and iov for data part
6566          */
6567         iovs.iov_base = mdata->buf;
6568         iovs.iov_len = mdata->maxlen;
6569         uios.uio_iov = &iovs;
6570         uios.uio_iovcnt = 1;
6571         uios.uio_loffset = 0;
6572         uios.uio_segflg = UIO_USERSPACE;
6573         uios.uio_fmode = 0;
6574         uios.uio_extflg = UIO_COPY_CACHED;
6575         uios.uio_resid = mdata->maxlen;
6576         uios.uio_offset = 0;
6577 
6578         q = _RD(stp->sd_wrq);
6579         mutex_enter(&stp->sd_lock);
6580         old_sd_flag = stp->sd_flag;
6581         mark = 0;
6582         for (;;) {
6583                 int done = 0;
6584                 mblk_t *q_first = q->q_first;
6585 
6586                 /*
6587                  * Get the next message of appropriate priority
6588                  * from the stream head.  If the caller is interested
6589                  * in band or hipri messages, then they should already
6590                  * be enqueued at the stream head.  On the other hand
6591                  * if the caller wants normal (band 0) messages, they
6592                  * might be deferred in a synchronous stream and they
6593                  * will need to be pulled up.
6594                  *
6595                  * After we have dequeued a message, we might find that
6596                  * it was a deferred M_SIG that was enqueued at the
6597                  * stream head.  It must now be posted as part of the
6598                  * read by calling strsignal_nolock().
6599                  *
6600                  * Also note that strrput does not enqueue an M_PCSIG,
6601                  * and there cannot be more than one hipri message,
6602                  * so there was no need to have the M_PCSIG case.
6603                  *
6604                  * At some time it might be nice to try and wrap the
6605                  * functionality of kstrgetmsg() and strgetmsg() into
6606                  * a common routine so to reduce the amount of replicated
6607                  * code (since they are extremely similar).
6608                  */
6609                 if (!(*flagsp & (MSG_HIPRI|MSG_BAND))) {
6610                         /* Asking for normal, band0 data */
6611                         bp = strget(stp, q, uiop, first, &error);
6612                         ASSERT(MUTEX_HELD(&stp->sd_lock));
6613                         if (bp != NULL) {
6614                                 if (DB_TYPE(bp) == M_SIG) {
6615                                         strsignal_nolock(stp, *bp->b_rptr,
6616                                             bp->b_band);
6617                                         freemsg(bp);
6618                                         continue;
6619                                 } else {
6620                                         break;
6621                                 }
6622                         }
6623                         if (error != 0)
6624                                 goto getmout;
6625 
6626                 /*
6627                  * We can't depend on the value of STRPRI here because
6628                  * the stream head may be in transit. Therefore, we
6629                  * must look at the type of the first message to
6630                  * determine if a high priority messages is waiting
6631                  */
6632                 } else if ((*flagsp & MSG_HIPRI) && q_first != NULL &&
6633                     DB_TYPE(q_first) >= QPCTL &&
6634                     (bp = getq_noenab(q, 0)) != NULL) {
6635                         /* Asked for HIPRI and got one */
6636                         ASSERT(DB_TYPE(bp) >= QPCTL);
6637                         break;
6638                 } else if ((*flagsp & MSG_BAND) && q_first != NULL &&
6639                     ((q_first->b_band >= *prip) || DB_TYPE(q_first) >= QPCTL) &&
6640                     (bp = getq_noenab(q, 0)) != NULL) {
6641                         /*
6642                          * Asked for at least band "prip" and got either at
6643                          * least that band or a hipri message.
6644                          */
6645                         ASSERT(bp->b_band >= *prip || DB_TYPE(bp) >= QPCTL);
6646                         if (DB_TYPE(bp) == M_SIG) {
6647                                 strsignal_nolock(stp, *bp->b_rptr, bp->b_band);
6648                                 freemsg(bp);
6649                                 continue;
6650                         } else {
6651                                 break;
6652                         }
6653                 }
6654 
6655                 /* No data. Time to sleep? */
6656                 qbackenable(q, 0);
6657 
6658                 /*
6659                  * If STRHUP or STREOF, return 0 length control and data.
6660                  * If resid is 0, then a read(fd,buf,0) was done. Do not
6661                  * sleep to satisfy this request because by default we have
6662                  * zero bytes to return.
6663                  */
6664                 if ((stp->sd_flag & (STRHUP|STREOF)) || (mctl->maxlen == 0 &&
6665                     mdata->maxlen == 0)) {
6666                         mctl->len = mdata->len = 0;
6667                         *flagsp = 0;
6668                         mutex_exit(&stp->sd_lock);
6669                         return (0);
6670                 }
6671                 TRACE_2(TR_FAC_STREAMS_FR, TR_STRGETMSG_WAIT,
6672                     "strgetmsg calls strwaitq:%p, %p",
6673                     vp, uiop);
6674                 if (((error = strwaitq(stp, GETWAIT, (ssize_t)0, fmode, -1,
6675                     &done)) != 0) || done) {
6676                         TRACE_2(TR_FAC_STREAMS_FR, TR_STRGETMSG_DONE,
6677                             "strgetmsg error or done:%p, %p",
6678                             vp, uiop);
6679                         mutex_exit(&stp->sd_lock);
6680                         return (error);
6681                 }
6682                 TRACE_2(TR_FAC_STREAMS_FR, TR_STRGETMSG_AWAKE,
6683                     "strgetmsg awakes:%p, %p", vp, uiop);
6684                 if ((error = i_straccess(stp, JCREAD)) != 0) {
6685                         mutex_exit(&stp->sd_lock);
6686                         return (error);
6687                 }
6688                 first = 0;
6689         }
6690         ASSERT(bp != NULL);
6691         /*
6692          * Extract any mark information. If the message is not completely
6693          * consumed this information will be put in the mblk
6694          * that is putback.
6695          * If MSGMARKNEXT is set and the message is completely consumed
6696          * the STRATMARK flag will be set below. Likewise, if
6697          * MSGNOTMARKNEXT is set and the message is
6698          * completely consumed STRNOTATMARK will be set.
6699          */
6700         mark = bp->b_flag & (MSGMARK | MSGMARKNEXT | MSGNOTMARKNEXT);
6701         ASSERT((mark & (MSGMARKNEXT|MSGNOTMARKNEXT)) !=
6702             (MSGMARKNEXT|MSGNOTMARKNEXT));
6703         if (mark != 0 && bp == stp->sd_mark) {
6704                 mark |= _LASTMARK;
6705                 stp->sd_mark = NULL;
6706         }
6707         /*
6708          * keep track of the original message type and priority
6709          */
6710         pri = bp->b_band;
6711         type = bp->b_datap->db_type;
6712         if (type == M_PASSFP) {
6713                 if ((mark & _LASTMARK) && (stp->sd_mark == NULL))
6714                         stp->sd_mark = bp;
6715                 bp->b_flag |= mark & ~_LASTMARK;
6716                 putback(stp, q, bp, pri);
6717                 qbackenable(q, pri);
6718                 mutex_exit(&stp->sd_lock);
6719                 return (EBADMSG);
6720         }
6721         ASSERT(type != M_SIG);
6722 
6723         /*
6724          * Set this flag so strrput will not generate signals. Need to
6725          * make sure this flag is cleared before leaving this routine
6726          * else signals will stop being sent.
6727          */
6728         stp->sd_flag |= STRGETINPROG;
6729         mutex_exit(&stp->sd_lock);
6730 
6731         if (STREAM_NEEDSERVICE(stp))
6732                 stream_runservice(stp);
6733 
6734         /*
6735          * Set HIPRI flag if message is priority.
6736          */
6737         if (type >= QPCTL)
6738                 flg = MSG_HIPRI;
6739         else
6740                 flg = MSG_BAND;
6741 
6742         /*
6743          * First process PROTO or PCPROTO blocks, if any.
6744          */
6745         if (mctl->maxlen >= 0 && type != M_DATA) {
6746                 size_t  n, bcnt;
6747                 char    *ubuf;
6748 
6749                 bcnt = mctl->maxlen;
6750                 ubuf = mctl->buf;
6751                 while (bp != NULL && bp->b_datap->db_type != M_DATA) {
6752                         if ((n = MIN(bcnt, bp->b_wptr - bp->b_rptr)) != 0 &&
6753                             copyout(bp->b_rptr, ubuf, n)) {
6754                                 error = EFAULT;
6755                                 mutex_enter(&stp->sd_lock);
6756                                 /*
6757                                  * clear stream head pri flag based on
6758                                  * first message type
6759                                  */
6760                                 if (type >= QPCTL) {
6761                                         ASSERT(type == M_PCPROTO);
6762                                         stp->sd_flag &= ~STRPRI;
6763                                 }
6764                                 more = 0;
6765                                 freemsg(bp);
6766                                 goto getmout;
6767                         }
6768                         ubuf += n;
6769                         bp->b_rptr += n;
6770                         if (bp->b_rptr >= bp->b_wptr) {
6771                                 nbp = bp;
6772                                 bp = bp->b_cont;
6773                                 freeb(nbp);
6774                         }
6775                         ASSERT(n <= bcnt);
6776                         bcnt -= n;
6777                         if (bcnt == 0)
6778                                 break;
6779                 }
6780                 mctl->len = mctl->maxlen - bcnt;
6781         } else
6782                 mctl->len = -1;
6783 
6784         if (bp && bp->b_datap->db_type != M_DATA) {
6785                 /*
6786                  * More PROTO blocks in msg.
6787                  */
6788                 more |= MORECTL;
6789                 savemp = bp;
6790                 while (bp && bp->b_datap->db_type != M_DATA) {
6791                         savemptail = bp;
6792                         bp = bp->b_cont;
6793                 }
6794                 savemptail->b_cont = NULL;
6795         }
6796 
6797         /*
6798          * Now process DATA blocks, if any.
6799          */
6800         if (mdata->maxlen >= 0 && bp) {
6801                 /*
6802                  * struiocopyout will consume a potential zero-length
6803                  * M_DATA even if uio_resid is zero.
6804                  */
6805                 size_t oldresid = uiop->uio_resid;
6806 
6807                 bp = struiocopyout(bp, uiop, &error);
6808                 if (error != 0) {
6809                         mutex_enter(&stp->sd_lock);
6810                         /*
6811                          * clear stream head hi pri flag based on
6812                          * first message
6813                          */
6814                         if (type >= QPCTL) {
6815                                 ASSERT(type == M_PCPROTO);
6816                                 stp->sd_flag &= ~STRPRI;
6817                         }
6818                         more = 0;
6819                         freemsg(savemp);
6820                         goto getmout;
6821                 }
6822                 /*
6823                  * (pr == 1) indicates a partial read.
6824                  */
6825                 if (oldresid > uiop->uio_resid)
6826                         pr = 1;
6827                 mdata->len = mdata->maxlen - uiop->uio_resid;
6828         } else
6829                 mdata->len = -1;
6830 
6831         if (bp) {                       /* more data blocks in msg */
6832                 more |= MOREDATA;
6833                 if (savemp)
6834                         savemptail->b_cont = bp;
6835                 else
6836                         savemp = bp;
6837         }
6838 
6839         mutex_enter(&stp->sd_lock);
6840         if (savemp) {
6841                 if (pr && (savemp->b_datap->db_type == M_DATA) &&
6842                     msgnodata(savemp)) {
6843                         /*
6844                          * Avoid queuing a zero-length tail part of
6845                          * a message. pr=1 indicates that we read some of
6846                          * the message.
6847                          */
6848                         freemsg(savemp);
6849                         more &= ~MOREDATA;
6850                         /*
6851                          * clear stream head hi pri flag based on
6852                          * first message
6853                          */
6854                         if (type >= QPCTL) {
6855                                 ASSERT(type == M_PCPROTO);
6856                                 stp->sd_flag &= ~STRPRI;
6857                         }
6858                 } else {
6859                         savemp->b_band = pri;
6860                         /*
6861                          * If the first message was HIPRI and the one we're
6862                          * putting back isn't, then clear STRPRI, otherwise
6863                          * set STRPRI again.  Note that we must set STRPRI
6864                          * again since the flush logic in strrput_nondata()
6865                          * may have cleared it while we had sd_lock dropped.
6866                          */
6867                         if (type >= QPCTL) {
6868                                 ASSERT(type == M_PCPROTO);
6869                                 if (queclass(savemp) < QPCTL)
6870                                         stp->sd_flag &= ~STRPRI;
6871                                 else
6872                                         stp->sd_flag |= STRPRI;
6873                         } else if (queclass(savemp) >= QPCTL) {
6874                                 /*
6875                                  * The first message was not a HIPRI message,
6876                                  * but the one we are about to putback is.
6877                                  * For simplicitly, we do not allow for HIPRI
6878                                  * messages to be embedded in the message
6879                                  * body, so just force it to same type as
6880                                  * first message.
6881                                  */
6882                                 ASSERT(type == M_DATA || type == M_PROTO);
6883                                 ASSERT(savemp->b_datap->db_type == M_PCPROTO);
6884                                 savemp->b_datap->db_type = type;
6885                         }
6886                         if (mark != 0) {
6887                                 savemp->b_flag |= mark & ~_LASTMARK;
6888                                 if ((mark & _LASTMARK) &&
6889                                     (stp->sd_mark == NULL)) {
6890                                         /*
6891                                          * If another marked message arrived
6892                                          * while sd_lock was not held sd_mark
6893                                          * would be non-NULL.
6894                                          */
6895                                         stp->sd_mark = savemp;
6896                                 }
6897                         }
6898                         putback(stp, q, savemp, pri);
6899                 }
6900         } else {
6901                 /*
6902                  * The complete message was consumed.
6903                  *
6904                  * If another M_PCPROTO arrived while sd_lock was not held
6905                  * it would have been discarded since STRPRI was still set.
6906                  *
6907                  * Move the MSG*MARKNEXT information
6908                  * to the stream head just in case
6909                  * the read queue becomes empty.
6910                  * clear stream head hi pri flag based on
6911                  * first message
6912                  *
6913                  * If the stream head was at the mark
6914                  * (STRATMARK) before we dropped sd_lock above
6915                  * and some data was consumed then we have
6916                  * moved past the mark thus STRATMARK is
6917                  * cleared. However, if a message arrived in
6918                  * strrput during the copyout above causing
6919                  * STRATMARK to be set we can not clear that
6920                  * flag.
6921                  */
6922                 if (type >= QPCTL) {
6923                         ASSERT(type == M_PCPROTO);
6924                         stp->sd_flag &= ~STRPRI;
6925                 }
6926                 if (mark & (MSGMARKNEXT|MSGNOTMARKNEXT|MSGMARK)) {
6927                         if (mark & MSGMARKNEXT) {
6928                                 stp->sd_flag &= ~STRNOTATMARK;
6929                                 stp->sd_flag |= STRATMARK;
6930                         } else if (mark & MSGNOTMARKNEXT) {
6931                                 stp->sd_flag &= ~STRATMARK;
6932                                 stp->sd_flag |= STRNOTATMARK;
6933                         } else {
6934                                 stp->sd_flag &= ~(STRATMARK|STRNOTATMARK);
6935                         }
6936                 } else if (pr && (old_sd_flag & STRATMARK)) {
6937                         stp->sd_flag &= ~STRATMARK;
6938                 }
6939         }
6940 
6941         *flagsp = flg;
6942         *prip = pri;
6943 
6944         /*
6945          * Getmsg cleanup processing - if the state of the queue has changed
6946          * some signals may need to be sent and/or poll awakened.
6947          */
6948 getmout:
6949         qbackenable(q, pri);
6950 
6951         /*
6952          * We dropped the stream head lock above. Send all M_SIG messages
6953          * before processing stream head for SIGPOLL messages.
6954          */
6955         ASSERT(MUTEX_HELD(&stp->sd_lock));
6956         while ((bp = q->q_first) != NULL &&
6957             (bp->b_datap->db_type == M_SIG)) {
6958                 /*
6959                  * sd_lock is held so the content of the read queue can not
6960                  * change.
6961                  */
6962                 bp = getq(q);
6963                 ASSERT(bp != NULL && bp->b_datap->db_type == M_SIG);
6964 
6965                 strsignal_nolock(stp, *bp->b_rptr, bp->b_band);
6966                 mutex_exit(&stp->sd_lock);
6967                 freemsg(bp);
6968                 if (STREAM_NEEDSERVICE(stp))
6969                         stream_runservice(stp);
6970                 mutex_enter(&stp->sd_lock);
6971         }
6972 
6973         /*
6974          * stream head cannot change while we make the determination
6975          * whether or not to send a signal. Drop the flag to allow strrput
6976          * to send firstmsgsigs again.
6977          */
6978         stp->sd_flag &= ~STRGETINPROG;
6979 
6980         /*
6981          * If the type of message at the front of the queue changed
6982          * due to the receive the appropriate signals and pollwakeup events
6983          * are generated. The type of changes are:
6984          *      Processed a hipri message, q_first is not hipri.
6985          *      Processed a band X message, and q_first is band Y.
6986          * The generated signals and pollwakeups are identical to what
6987          * strrput() generates should the message that is now on q_first
6988          * arrive to an empty read queue.
6989          *
6990          * Note: only strrput will send a signal for a hipri message.
6991          */
6992         if ((bp = q->q_first) != NULL && !(stp->sd_flag & STRPRI)) {
6993                 strsigset_t signals = 0;
6994                 strpollset_t pollwakeups = 0;
6995 
6996                 if (flg & MSG_HIPRI) {
6997                         /*
6998                          * Removed a hipri message. Regular data at
6999                          * the front of  the queue.
7000                          */
7001                         if (bp->b_band == 0) {
7002                                 signals = S_INPUT | S_RDNORM;
7003                                 pollwakeups = POLLIN | POLLRDNORM;
7004                         } else {
7005                                 signals = S_INPUT | S_RDBAND;
7006                                 pollwakeups = POLLIN | POLLRDBAND;
7007                         }
7008                 } else if (pri != bp->b_band) {
7009                         /*
7010                          * The band is different for the new q_first.
7011                          */
7012                         if (bp->b_band == 0) {
7013                                 signals = S_RDNORM;
7014                                 pollwakeups = POLLIN | POLLRDNORM;
7015                         } else {
7016                                 signals = S_RDBAND;
7017                                 pollwakeups = POLLIN | POLLRDBAND;
7018                         }
7019                 }
7020 
7021                 if (pollwakeups != 0) {
7022                         if (pollwakeups == (POLLIN | POLLRDNORM)) {
7023                                 if (!(stp->sd_rput_opt & SR_POLLIN))
7024                                         goto no_pollwake;
7025                                 stp->sd_rput_opt &= ~SR_POLLIN;
7026                         }
7027                         mutex_exit(&stp->sd_lock);
7028                         pollwakeup(&stp->sd_pollist, pollwakeups);
7029                         mutex_enter(&stp->sd_lock);
7030                 }
7031 no_pollwake:
7032 
7033                 if (stp->sd_sigflags & signals)
7034                         strsendsig(stp->sd_siglist, signals, bp->b_band, 0);
7035         }
7036         mutex_exit(&stp->sd_lock);
7037 
7038         rvp->r_val1 = more;
7039         return (error);
7040 #undef  _LASTMARK
7041 }
7042 
7043 /*
7044  * Get the next message from the read queue.  If the message is
7045  * priority, STRPRI will have been set by strrput().  This flag
7046  * should be reset only when the entire message at the front of the
7047  * queue as been consumed.
7048  *
7049  * If uiop is NULL all data is returned in mctlp.
7050  * Note that a NULL uiop implies that FNDELAY and FNONBLOCK are assumed
7051  * not enabled.
7052  * The timeout parameter is in milliseconds; -1 for infinity.
7053  * This routine handles the consolidation private flags:
7054  *      MSG_IGNERROR    Ignore any stream head error except STPLEX.
7055  *      MSG_DELAYERROR  Defer the error check until the queue is empty.
7056  *      MSG_HOLDSIG     Hold signals while waiting for data.
7057  *      MSG_IPEEK       Only peek at messages.
7058  *      MSG_DISCARDTAIL Discard the tail M_DATA part of the message
7059  *                      that doesn't fit.
7060  *      MSG_NOMARK      If the message is marked leave it on the queue.
7061  *
7062  * NOTE: strgetmsg and kstrgetmsg have much of the logic in common.
7063  */
7064 int
7065 kstrgetmsg(
7066         struct vnode *vp,
7067         mblk_t **mctlp,
7068         struct uio *uiop,
7069         unsigned char *prip,
7070         int *flagsp,
7071         clock_t timout,
7072         rval_t *rvp)
7073 {
7074         struct stdata *stp;
7075         mblk_t *bp, *nbp;
7076         mblk_t *savemp = NULL;
7077         mblk_t *savemptail = NULL;
7078         int flags;
7079         uint_t old_sd_flag;
7080         int flg;
7081         int more = 0;
7082         int error = 0;
7083         char first = 1;
7084         uint_t mark;            /* Contains MSG*MARK and _LASTMARK */
7085 #define _LASTMARK       0x8000  /* Distinct from MSG*MARK */
7086         unsigned char pri = 0;
7087         queue_t *q;
7088         int     pr = 0;                 /* Partial read successful */
7089         unsigned char type;
7090 
7091         TRACE_1(TR_FAC_STREAMS_FR, TR_KSTRGETMSG_ENTER,
7092             "kstrgetmsg:%p", vp);
7093 
7094         ASSERT(vp->v_stream);
7095         stp = vp->v_stream;
7096         rvp->r_val1 = 0;
7097 
7098         mutex_enter(&stp->sd_lock);
7099 
7100         if ((error = i_straccess(stp, JCREAD)) != 0) {
7101                 mutex_exit(&stp->sd_lock);
7102                 return (error);
7103         }
7104 
7105         flags = *flagsp;
7106         if (stp->sd_flag & (STRDERR|STPLEX)) {
7107                 if ((stp->sd_flag & STPLEX) ||
7108                     (flags & (MSG_IGNERROR|MSG_DELAYERROR)) == 0) {
7109                         error = strgeterr(stp, STRDERR|STPLEX,
7110                             (flags & MSG_IPEEK));
7111                         if (error != 0) {
7112                                 mutex_exit(&stp->sd_lock);
7113                                 return (error);
7114                         }
7115                 }
7116         }
7117         mutex_exit(&stp->sd_lock);
7118 
7119         switch (flags & (MSG_HIPRI|MSG_ANY|MSG_BAND)) {
7120         case MSG_HIPRI:
7121                 if (*prip != 0)
7122                         return (EINVAL);
7123                 break;
7124 
7125         case MSG_ANY:
7126         case MSG_BAND:
7127                 break;
7128 
7129         default:
7130                 return (EINVAL);
7131         }
7132 
7133 retry:
7134         q = _RD(stp->sd_wrq);
7135         mutex_enter(&stp->sd_lock);
7136         old_sd_flag = stp->sd_flag;
7137         mark = 0;
7138         for (;;) {
7139                 int done = 0;
7140                 int waitflag;
7141                 int fmode;
7142                 mblk_t *q_first = q->q_first;
7143 
7144                 /*
7145                  * This section of the code operates just like the code
7146                  * in strgetmsg().  There is a comment there about what
7147                  * is going on here.
7148                  */
7149                 if (!(flags & (MSG_HIPRI|MSG_BAND))) {
7150                         /* Asking for normal, band0 data */
7151                         bp = strget(stp, q, uiop, first, &error);
7152                         ASSERT(MUTEX_HELD(&stp->sd_lock));
7153                         if (bp != NULL) {
7154                                 if (DB_TYPE(bp) == M_SIG) {
7155                                         strsignal_nolock(stp, *bp->b_rptr,
7156                                             bp->b_band);
7157                                         freemsg(bp);
7158                                         continue;
7159                                 } else {
7160                                         break;
7161                                 }
7162                         }
7163                         if (error != 0) {
7164                                 goto getmout;
7165                         }
7166                 /*
7167                  * We can't depend on the value of STRPRI here because
7168                  * the stream head may be in transit. Therefore, we
7169                  * must look at the type of the first message to
7170                  * determine if a high priority messages is waiting
7171                  */
7172                 } else if ((flags & MSG_HIPRI) && q_first != NULL &&
7173                     DB_TYPE(q_first) >= QPCTL &&
7174                     (bp = getq_noenab(q, 0)) != NULL) {
7175                         ASSERT(DB_TYPE(bp) >= QPCTL);
7176                         break;
7177                 } else if ((flags & MSG_BAND) && q_first != NULL &&
7178                     ((q_first->b_band >= *prip) || DB_TYPE(q_first) >= QPCTL) &&
7179                     (bp = getq_noenab(q, 0)) != NULL) {
7180                         /*
7181                          * Asked for at least band "prip" and got either at
7182                          * least that band or a hipri message.
7183                          */
7184                         ASSERT(bp->b_band >= *prip || DB_TYPE(bp) >= QPCTL);
7185                         if (DB_TYPE(bp) == M_SIG) {
7186                                 strsignal_nolock(stp, *bp->b_rptr, bp->b_band);
7187                                 freemsg(bp);
7188                                 continue;
7189                         } else {
7190                                 break;
7191                         }
7192                 }
7193 
7194                 /* No data. Time to sleep? */
7195                 qbackenable(q, 0);
7196 
7197                 /*
7198                  * Delayed error notification?
7199                  */
7200                 if ((stp->sd_flag & (STRDERR|STPLEX)) &&
7201                     (flags & (MSG_IGNERROR|MSG_DELAYERROR)) == MSG_DELAYERROR) {
7202                         error = strgeterr(stp, STRDERR|STPLEX,
7203                             (flags & MSG_IPEEK));
7204                         if (error != 0) {
7205                                 mutex_exit(&stp->sd_lock);
7206                                 return (error);
7207                         }
7208                 }
7209 
7210                 /*
7211                  * If STRHUP or STREOF, return 0 length control and data.
7212                  * If a read(fd,buf,0) has been done, do not sleep, just
7213                  * return.
7214                  *
7215                  * If mctlp == NULL and uiop == NULL, then the code will
7216                  * do the strwaitq. This is an understood way of saying
7217                  * sleep "polling" until a message is received.
7218                  */
7219                 if ((stp->sd_flag & (STRHUP|STREOF)) ||
7220                     (uiop != NULL && uiop->uio_resid == 0)) {
7221                         if (mctlp != NULL)
7222                                 *mctlp = NULL;
7223                         *flagsp = 0;
7224                         mutex_exit(&stp->sd_lock);
7225                         return (0);
7226                 }
7227 
7228                 waitflag = GETWAIT;
7229                 if (flags &
7230                     (MSG_HOLDSIG|MSG_IGNERROR|MSG_IPEEK|MSG_DELAYERROR)) {
7231                         if (flags & MSG_HOLDSIG)
7232                                 waitflag |= STR_NOSIG;
7233                         if (flags & MSG_IGNERROR)
7234                                 waitflag |= STR_NOERROR;
7235                         if (flags & MSG_IPEEK)
7236                                 waitflag |= STR_PEEK;
7237                         if (flags & MSG_DELAYERROR)
7238                                 waitflag |= STR_DELAYERR;
7239                 }
7240                 if (uiop != NULL)
7241                         fmode = uiop->uio_fmode;
7242                 else
7243                         fmode = 0;
7244 
7245                 TRACE_2(TR_FAC_STREAMS_FR, TR_KSTRGETMSG_WAIT,
7246                     "kstrgetmsg calls strwaitq:%p, %p",
7247                     vp, uiop);
7248                 if (((error = strwaitq(stp, waitflag, (ssize_t)0,
7249                     fmode, timout, &done))) != 0 || done) {
7250                         TRACE_2(TR_FAC_STREAMS_FR, TR_KSTRGETMSG_DONE,
7251                             "kstrgetmsg error or done:%p, %p",
7252                             vp, uiop);
7253                         mutex_exit(&stp->sd_lock);
7254                         return (error);
7255                 }
7256                 TRACE_2(TR_FAC_STREAMS_FR, TR_KSTRGETMSG_AWAKE,
7257                     "kstrgetmsg awakes:%p, %p", vp, uiop);
7258                 if ((error = i_straccess(stp, JCREAD)) != 0) {
7259                         mutex_exit(&stp->sd_lock);
7260                         return (error);
7261                 }
7262                 first = 0;
7263         }
7264         ASSERT(bp != NULL);
7265         /*
7266          * Extract any mark information. If the message is not completely
7267          * consumed this information will be put in the mblk
7268          * that is putback.
7269          * If MSGMARKNEXT is set and the message is completely consumed
7270          * the STRATMARK flag will be set below. Likewise, if
7271          * MSGNOTMARKNEXT is set and the message is
7272          * completely consumed STRNOTATMARK will be set.
7273          */
7274         mark = bp->b_flag & (MSGMARK | MSGMARKNEXT | MSGNOTMARKNEXT);
7275         ASSERT((mark & (MSGMARKNEXT|MSGNOTMARKNEXT)) !=
7276             (MSGMARKNEXT|MSGNOTMARKNEXT));
7277         pri = bp->b_band;
7278         if (mark != 0) {
7279                 /*
7280                  * If the caller doesn't want the mark return.
7281                  * Used to implement MSG_WAITALL in sockets.
7282                  */
7283                 if (flags & MSG_NOMARK) {
7284                         putback(stp, q, bp, pri);
7285                         qbackenable(q, pri);
7286                         mutex_exit(&stp->sd_lock);
7287                         return (EWOULDBLOCK);
7288                 }
7289                 if (bp == stp->sd_mark) {
7290                         mark |= _LASTMARK;
7291                         stp->sd_mark = NULL;
7292                 }
7293         }
7294 
7295         /*
7296          * keep track of the first message type
7297          */
7298         type = bp->b_datap->db_type;
7299 
7300         if (bp->b_datap->db_type == M_PASSFP) {
7301                 if ((mark & _LASTMARK) && (stp->sd_mark == NULL))
7302                         stp->sd_mark = bp;
7303                 bp->b_flag |= mark & ~_LASTMARK;
7304                 putback(stp, q, bp, pri);
7305                 qbackenable(q, pri);
7306                 mutex_exit(&stp->sd_lock);
7307                 return (EBADMSG);
7308         }
7309         ASSERT(type != M_SIG);
7310 
7311         if (flags & MSG_IPEEK) {
7312                 /*
7313                  * Clear any struioflag - we do the uiomove over again
7314                  * when peeking since it simplifies the code.
7315                  *
7316                  * Dup the message and put the original back on the queue.
7317                  * If dupmsg() fails, try again with copymsg() to see if
7318                  * there is indeed a shortage of memory.  dupmsg() may fail
7319                  * if db_ref in any of the messages reaches its limit.
7320                  */
7321 
7322                 if ((nbp = dupmsg(bp)) == NULL && (nbp = copymsg(bp)) == NULL) {
7323                         /*
7324                          * Restore the state of the stream head since we
7325                          * need to drop sd_lock (strwaitbuf is sleeping).
7326                          */
7327                         size_t size = msgdsize(bp);
7328 
7329                         if ((mark & _LASTMARK) && (stp->sd_mark == NULL))
7330                                 stp->sd_mark = bp;
7331                         bp->b_flag |= mark & ~_LASTMARK;
7332                         putback(stp, q, bp, pri);
7333                         mutex_exit(&stp->sd_lock);
7334                         error = strwaitbuf(size, BPRI_HI);
7335                         if (error) {
7336                                 /*
7337                                  * There is no net change to the queue thus
7338                                  * no need to qbackenable.
7339                                  */
7340                                 return (error);
7341                         }
7342                         goto retry;
7343                 }
7344 
7345                 if ((mark & _LASTMARK) && (stp->sd_mark == NULL))
7346                         stp->sd_mark = bp;
7347                 bp->b_flag |= mark & ~_LASTMARK;
7348                 putback(stp, q, bp, pri);
7349                 bp = nbp;
7350         }
7351 
7352         /*
7353          * Set this flag so strrput will not generate signals. Need to
7354          * make sure this flag is cleared before leaving this routine
7355          * else signals will stop being sent.
7356          */
7357         stp->sd_flag |= STRGETINPROG;
7358         mutex_exit(&stp->sd_lock);
7359 
7360         if ((stp->sd_rputdatafunc != NULL) && (DB_TYPE(bp) == M_DATA)) {
7361                 mblk_t *tmp, *prevmp;
7362 
7363                 /*
7364                  * Put first non-data mblk back to stream head and
7365                  * cut the mblk chain so sd_rputdatafunc only sees
7366                  * M_DATA mblks. We can skip the first mblk since it
7367                  * is M_DATA according to the condition above.
7368                  */
7369                 for (prevmp = bp, tmp = bp->b_cont; tmp != NULL;
7370                     prevmp = tmp, tmp = tmp->b_cont) {
7371                         if (DB_TYPE(tmp) != M_DATA) {
7372                                 prevmp->b_cont = NULL;
7373                                 mutex_enter(&stp->sd_lock);
7374                                 putback(stp, q, tmp, tmp->b_band);
7375                                 mutex_exit(&stp->sd_lock);
7376                                 break;
7377                         }
7378                 }
7379 
7380                 bp = (stp->sd_rputdatafunc)(stp->sd_vnode, bp,
7381                     NULL, NULL, NULL, NULL);
7382 
7383                 if (bp == NULL)
7384                         goto retry;
7385         }
7386 
7387         if (STREAM_NEEDSERVICE(stp))
7388                 stream_runservice(stp);
7389 
7390         /*
7391          * Set HIPRI flag if message is priority.
7392          */
7393         if (type >= QPCTL)
7394                 flg = MSG_HIPRI;
7395         else
7396                 flg = MSG_BAND;
7397 
7398         /*
7399          * First process PROTO or PCPROTO blocks, if any.
7400          */
7401         if (mctlp != NULL && type != M_DATA) {
7402                 mblk_t *nbp;
7403 
7404                 *mctlp = bp;
7405                 while (bp->b_cont && bp->b_cont->b_datap->db_type != M_DATA)
7406                         bp = bp->b_cont;
7407                 nbp = bp->b_cont;
7408                 bp->b_cont = NULL;
7409                 bp = nbp;
7410         }
7411 
7412         if (bp && bp->b_datap->db_type != M_DATA) {
7413                 /*
7414                  * More PROTO blocks in msg. Will only happen if mctlp is NULL.
7415                  */
7416                 more |= MORECTL;
7417                 savemp = bp;
7418                 while (bp && bp->b_datap->db_type != M_DATA) {
7419                         savemptail = bp;
7420                         bp = bp->b_cont;
7421                 }
7422                 savemptail->b_cont = NULL;
7423         }
7424 
7425         /*
7426          * Now process DATA blocks, if any.
7427          */
7428         if (uiop == NULL) {
7429                 /* Append data to tail of mctlp */
7430 
7431                 if (mctlp != NULL) {
7432                         mblk_t **mpp = mctlp;
7433 
7434                         while (*mpp != NULL)
7435                                 mpp = &((*mpp)->b_cont);
7436                         *mpp = bp;
7437                         bp = NULL;
7438                 }
7439         } else if (uiop->uio_resid >= 0 && bp) {
7440                 size_t oldresid = uiop->uio_resid;
7441 
7442                 /*
7443                  * If a streams message is likely to consist
7444                  * of many small mblks, it is pulled up into
7445                  * one continuous chunk of memory.
7446                  * The size of the first mblk may be bogus because
7447                  * successive read() calls on the socket reduce
7448                  * the size of this mblk until it is exhausted
7449                  * and then the code walks on to the next. Thus
7450                  * the size of the mblk may not be the original size
7451                  * that was passed up, it's simply a remainder
7452                  * and hence can be very small without any
7453                  * implication that the packet is badly fragmented.
7454                  * So the size of the possible second mblk is
7455                  * used to spot a badly fragmented packet.
7456                  * see longer comment at top of page
7457                  * by mblk_pull_len declaration.
7458                  */
7459 
7460                 if (bp->b_cont != NULL && MBLKL(bp->b_cont) < mblk_pull_len) {
7461                         (void) pullupmsg(bp, -1);
7462                 }
7463 
7464                 bp = struiocopyout(bp, uiop, &error);
7465                 if (error != 0) {
7466                         if (mctlp != NULL) {
7467                                 freemsg(*mctlp);
7468                                 *mctlp = NULL;
7469                         } else
7470                                 freemsg(savemp);
7471                         mutex_enter(&stp->sd_lock);
7472                         /*
7473                          * clear stream head hi pri flag based on
7474                          * first message
7475                          */
7476                         if (!(flags & MSG_IPEEK) && (type >= QPCTL)) {
7477                                 ASSERT(type == M_PCPROTO);
7478                                 stp->sd_flag &= ~STRPRI;
7479                         }
7480                         more = 0;
7481                         goto getmout;
7482                 }
7483                 /*
7484                  * (pr == 1) indicates a partial read.
7485                  */
7486                 if (oldresid > uiop->uio_resid)
7487                         pr = 1;
7488         }
7489 
7490         if (bp) {                       /* more data blocks in msg */
7491                 more |= MOREDATA;
7492                 if (savemp)
7493                         savemptail->b_cont = bp;
7494                 else
7495                         savemp = bp;
7496         }
7497 
7498         mutex_enter(&stp->sd_lock);
7499         if (savemp) {
7500                 if (flags & (MSG_IPEEK|MSG_DISCARDTAIL)) {
7501                         /*
7502                          * When MSG_DISCARDTAIL is set or
7503                          * when peeking discard any tail. When peeking this
7504                          * is the tail of the dup that was copied out - the
7505                          * message has already been putback on the queue.
7506                          * Return MOREDATA to the caller even though the data
7507                          * is discarded. This is used by sockets (to
7508                          * set MSG_TRUNC).
7509                          */
7510                         freemsg(savemp);
7511                         if (!(flags & MSG_IPEEK) && (type >= QPCTL)) {
7512                                 ASSERT(type == M_PCPROTO);
7513                                 stp->sd_flag &= ~STRPRI;
7514                         }
7515                 } else if (pr && (savemp->b_datap->db_type == M_DATA) &&
7516                     msgnodata(savemp)) {
7517                         /*
7518                          * Avoid queuing a zero-length tail part of
7519                          * a message. pr=1 indicates that we read some of
7520                          * the message.
7521                          */
7522                         freemsg(savemp);
7523                         more &= ~MOREDATA;
7524                         if (type >= QPCTL) {
7525                                 ASSERT(type == M_PCPROTO);
7526                                 stp->sd_flag &= ~STRPRI;
7527                         }
7528                 } else {
7529                         savemp->b_band = pri;
7530                         /*
7531                          * If the first message was HIPRI and the one we're
7532                          * putting back isn't, then clear STRPRI, otherwise
7533                          * set STRPRI again.  Note that we must set STRPRI
7534                          * again since the flush logic in strrput_nondata()
7535                          * may have cleared it while we had sd_lock dropped.
7536                          */
7537 
7538                         if (type >= QPCTL) {
7539                                 ASSERT(type == M_PCPROTO);
7540                                 if (queclass(savemp) < QPCTL)
7541                                         stp->sd_flag &= ~STRPRI;
7542                                 else
7543                                         stp->sd_flag |= STRPRI;
7544                         } else if (queclass(savemp) >= QPCTL) {
7545                                 /*
7546                                  * The first message was not a HIPRI message,
7547                                  * but the one we are about to putback is.
7548                                  * For simplicitly, we do not allow for HIPRI
7549                                  * messages to be embedded in the message
7550                                  * body, so just force it to same type as
7551                                  * first message.
7552                                  */
7553                                 ASSERT(type == M_DATA || type == M_PROTO);
7554                                 ASSERT(savemp->b_datap->db_type == M_PCPROTO);
7555                                 savemp->b_datap->db_type = type;
7556                         }
7557                         if (mark != 0) {
7558                                 if ((mark & _LASTMARK) &&
7559                                     (stp->sd_mark == NULL)) {
7560                                         /*
7561                                          * If another marked message arrived
7562                                          * while sd_lock was not held sd_mark
7563                                          * would be non-NULL.
7564                                          */
7565                                         stp->sd_mark = savemp;
7566                                 }
7567                                 savemp->b_flag |= mark & ~_LASTMARK;
7568                         }
7569                         putback(stp, q, savemp, pri);
7570                 }
7571         } else if (!(flags & MSG_IPEEK)) {
7572                 /*
7573                  * The complete message was consumed.
7574                  *
7575                  * If another M_PCPROTO arrived while sd_lock was not held
7576                  * it would have been discarded since STRPRI was still set.
7577                  *
7578                  * Move the MSG*MARKNEXT information
7579                  * to the stream head just in case
7580                  * the read queue becomes empty.
7581                  * clear stream head hi pri flag based on
7582                  * first message
7583                  *
7584                  * If the stream head was at the mark
7585                  * (STRATMARK) before we dropped sd_lock above
7586                  * and some data was consumed then we have
7587                  * moved past the mark thus STRATMARK is
7588                  * cleared. However, if a message arrived in
7589                  * strrput during the copyout above causing
7590                  * STRATMARK to be set we can not clear that
7591                  * flag.
7592                  * XXX A "perimeter" would help by single-threading strrput,
7593                  * strread, strgetmsg and kstrgetmsg.
7594                  */
7595                 if (type >= QPCTL) {
7596                         ASSERT(type == M_PCPROTO);
7597                         stp->sd_flag &= ~STRPRI;
7598                 }
7599                 if (mark & (MSGMARKNEXT|MSGNOTMARKNEXT|MSGMARK)) {
7600                         if (mark & MSGMARKNEXT) {
7601                                 stp->sd_flag &= ~STRNOTATMARK;
7602                                 stp->sd_flag |= STRATMARK;
7603                         } else if (mark & MSGNOTMARKNEXT) {
7604                                 stp->sd_flag &= ~STRATMARK;
7605                                 stp->sd_flag |= STRNOTATMARK;
7606                         } else {
7607                                 stp->sd_flag &= ~(STRATMARK|STRNOTATMARK);
7608                         }
7609                 } else if (pr && (old_sd_flag & STRATMARK)) {
7610                         stp->sd_flag &= ~STRATMARK;
7611                 }
7612         }
7613 
7614         *flagsp = flg;
7615         *prip = pri;
7616 
7617         /*
7618          * Getmsg cleanup processing - if the state of the queue has changed
7619          * some signals may need to be sent and/or poll awakened.
7620          */
7621 getmout:
7622         qbackenable(q, pri);
7623 
7624         /*
7625          * We dropped the stream head lock above. Send all M_SIG messages
7626          * before processing stream head for SIGPOLL messages.
7627          */
7628         ASSERT(MUTEX_HELD(&stp->sd_lock));
7629         while ((bp = q->q_first) != NULL &&
7630             (bp->b_datap->db_type == M_SIG)) {
7631                 /*
7632                  * sd_lock is held so the content of the read queue can not
7633                  * change.
7634                  */
7635                 bp = getq(q);
7636                 ASSERT(bp != NULL && bp->b_datap->db_type == M_SIG);
7637 
7638                 strsignal_nolock(stp, *bp->b_rptr, bp->b_band);
7639                 mutex_exit(&stp->sd_lock);
7640                 freemsg(bp);
7641                 if (STREAM_NEEDSERVICE(stp))
7642                         stream_runservice(stp);
7643                 mutex_enter(&stp->sd_lock);
7644         }
7645 
7646         /*
7647          * stream head cannot change while we make the determination
7648          * whether or not to send a signal. Drop the flag to allow strrput
7649          * to send firstmsgsigs again.
7650          */
7651         stp->sd_flag &= ~STRGETINPROG;
7652 
7653         /*
7654          * If the type of message at the front of the queue changed
7655          * due to the receive the appropriate signals and pollwakeup events
7656          * are generated. The type of changes are:
7657          *      Processed a hipri message, q_first is not hipri.
7658          *      Processed a band X message, and q_first is band Y.
7659          * The generated signals and pollwakeups are identical to what
7660          * strrput() generates should the message that is now on q_first
7661          * arrive to an empty read queue.
7662          *
7663          * Note: only strrput will send a signal for a hipri message.
7664          */
7665         if ((bp = q->q_first) != NULL && !(stp->sd_flag & STRPRI)) {
7666                 strsigset_t signals = 0;
7667                 strpollset_t pollwakeups = 0;
7668 
7669                 if (flg & MSG_HIPRI) {
7670                         /*
7671                          * Removed a hipri message. Regular data at
7672                          * the front of  the queue.
7673                          */
7674                         if (bp->b_band == 0) {
7675                                 signals = S_INPUT | S_RDNORM;
7676                                 pollwakeups = POLLIN | POLLRDNORM;
7677                         } else {
7678                                 signals = S_INPUT | S_RDBAND;
7679                                 pollwakeups = POLLIN | POLLRDBAND;
7680                         }
7681                 } else if (pri != bp->b_band) {
7682                         /*
7683                          * The band is different for the new q_first.
7684                          */
7685                         if (bp->b_band == 0) {
7686                                 signals = S_RDNORM;
7687                                 pollwakeups = POLLIN | POLLRDNORM;
7688                         } else {
7689                                 signals = S_RDBAND;
7690                                 pollwakeups = POLLIN | POLLRDBAND;
7691                         }
7692                 }
7693 
7694                 if (pollwakeups != 0) {
7695                         if (pollwakeups == (POLLIN | POLLRDNORM)) {
7696                                 if (!(stp->sd_rput_opt & SR_POLLIN))
7697                                         goto no_pollwake;
7698                                 stp->sd_rput_opt &= ~SR_POLLIN;
7699                         }
7700                         mutex_exit(&stp->sd_lock);
7701                         pollwakeup(&stp->sd_pollist, pollwakeups);
7702                         mutex_enter(&stp->sd_lock);
7703                 }
7704 no_pollwake:
7705 
7706                 if (stp->sd_sigflags & signals)
7707                         strsendsig(stp->sd_siglist, signals, bp->b_band, 0);
7708         }
7709         mutex_exit(&stp->sd_lock);
7710 
7711         rvp->r_val1 = more;
7712         return (error);
7713 #undef  _LASTMARK
7714 }
7715 
7716 /*
7717  * Put a message downstream.
7718  *
7719  * NOTE: strputmsg and kstrputmsg have much of the logic in common.
7720  */
7721 int
7722 strputmsg(
7723         struct vnode *vp,
7724         struct strbuf *mctl,
7725         struct strbuf *mdata,
7726         unsigned char pri,
7727         int flag,
7728         int fmode)
7729 {
7730         struct stdata *stp;
7731         queue_t *wqp;
7732         mblk_t *mp;
7733         ssize_t msgsize;
7734         ssize_t rmin, rmax;
7735         int error;
7736         struct uio uios;
7737         struct uio *uiop = &uios;
7738         struct iovec iovs;
7739         int xpg4 = 0;
7740 
7741         ASSERT(vp->v_stream);
7742         stp = vp->v_stream;
7743         wqp = stp->sd_wrq;
7744 
7745         /*
7746          * If it is an XPG4 application, we need to send
7747          * SIGPIPE below
7748          */
7749 
7750         xpg4 = (flag & MSG_XPG4) ? 1 : 0;
7751         flag &= ~MSG_XPG4;
7752 
7753         if (AU_AUDITING())
7754                 audit_strputmsg(vp, mctl, mdata, pri, flag, fmode);
7755 
7756         mutex_enter(&stp->sd_lock);
7757 
7758         if ((error = i_straccess(stp, JCWRITE)) != 0) {
7759                 mutex_exit(&stp->sd_lock);
7760                 return (error);
7761         }
7762 
7763         if (stp->sd_flag & (STWRERR|STRHUP|STPLEX)) {
7764                 error = strwriteable(stp, B_FALSE, xpg4);
7765                 if (error != 0) {
7766                         mutex_exit(&stp->sd_lock);
7767                         return (error);
7768                 }
7769         }
7770 
7771         mutex_exit(&stp->sd_lock);
7772 
7773         /*
7774          * Check for legal flag value.
7775          */
7776         switch (flag) {
7777         case MSG_HIPRI:
7778                 if ((mctl->len < 0) || (pri != 0))
7779                         return (EINVAL);
7780                 break;
7781         case MSG_BAND:
7782                 break;
7783 
7784         default:
7785                 return (EINVAL);
7786         }
7787 
7788         TRACE_1(TR_FAC_STREAMS_FR, TR_STRPUTMSG_IN,
7789             "strputmsg in:stp %p", stp);
7790 
7791         /* get these values from those cached in the stream head */
7792         rmin = stp->sd_qn_minpsz;
7793         rmax = stp->sd_qn_maxpsz;
7794 
7795         /*
7796          * Make sure ctl and data sizes together fall within the
7797          * limits of the max and min receive packet sizes and do
7798          * not exceed system limit.
7799          */
7800         ASSERT((rmax >= 0) || (rmax == INFPSZ));
7801         if (rmax == 0) {
7802                 return (ERANGE);
7803         }
7804         /*
7805          * Use the MAXIMUM of sd_maxblk and q_maxpsz.
7806          * Needed to prevent partial failures in the strmakedata loop.
7807          */
7808         if (stp->sd_maxblk != INFPSZ && rmax != INFPSZ && rmax < stp->sd_maxblk)
7809                 rmax = stp->sd_maxblk;
7810 
7811         if ((msgsize = mdata->len) < 0) {
7812                 msgsize = 0;
7813                 rmin = 0;       /* no range check for NULL data part */
7814         }
7815         if ((msgsize < rmin) ||
7816             ((msgsize > rmax) && (rmax != INFPSZ)) ||
7817             (mctl->len > strctlsz)) {
7818                 return (ERANGE);
7819         }
7820 
7821         /*
7822          * Setup uio and iov for data part
7823          */
7824         iovs.iov_base = mdata->buf;
7825         iovs.iov_len = msgsize;
7826         uios.uio_iov = &iovs;
7827         uios.uio_iovcnt = 1;
7828         uios.uio_loffset = 0;
7829         uios.uio_segflg = UIO_USERSPACE;
7830         uios.uio_fmode = fmode;
7831         uios.uio_extflg = UIO_COPY_DEFAULT;
7832         uios.uio_resid = msgsize;
7833         uios.uio_offset = 0;
7834 
7835         /* Ignore flow control in strput for HIPRI */
7836         if (flag & MSG_HIPRI)
7837                 flag |= MSG_IGNFLOW;
7838 
7839         for (;;) {
7840                 int done = 0;
7841 
7842                 /*
7843                  * strput will always free the ctl mblk - even when strput
7844                  * fails.
7845                  */
7846                 if ((error = strmakectl(mctl, flag, fmode, &mp)) != 0) {
7847                         TRACE_3(TR_FAC_STREAMS_FR, TR_STRPUTMSG_OUT,
7848                             "strputmsg out:stp %p out %d error %d",
7849                             stp, 1, error);
7850                         return (error);
7851                 }
7852                 /*
7853                  * Verify that the whole message can be transferred by
7854                  * strput.
7855                  */
7856                 ASSERT(stp->sd_maxblk == INFPSZ ||
7857                     stp->sd_maxblk >= mdata->len);
7858 
7859                 msgsize = mdata->len;
7860                 error = strput(stp, mp, uiop, &msgsize, 0, pri, flag);
7861                 mdata->len = msgsize;
7862 
7863                 if (error == 0)
7864                         break;
7865 
7866                 if (error != EWOULDBLOCK)
7867                         goto out;
7868 
7869                 mutex_enter(&stp->sd_lock);
7870                 /*
7871                  * Check for a missed wakeup.
7872                  * Needed since strput did not hold sd_lock across
7873                  * the canputnext.
7874                  */
7875                 if (bcanputnext(wqp, pri)) {
7876                         /* Try again */
7877                         mutex_exit(&stp->sd_lock);
7878                         continue;
7879                 }
7880                 TRACE_2(TR_FAC_STREAMS_FR, TR_STRPUTMSG_WAIT,
7881                     "strputmsg wait:stp %p waits pri %d", stp, pri);
7882                 if (((error = strwaitq(stp, WRITEWAIT, (ssize_t)0, fmode, -1,
7883                     &done)) != 0) || done) {
7884                         mutex_exit(&stp->sd_lock);
7885                         TRACE_3(TR_FAC_STREAMS_FR, TR_STRPUTMSG_OUT,
7886                             "strputmsg out:q %p out %d error %d",
7887                             stp, 0, error);
7888                         return (error);
7889                 }
7890                 TRACE_1(TR_FAC_STREAMS_FR, TR_STRPUTMSG_WAKE,
7891                     "strputmsg wake:stp %p wakes", stp);
7892                 if ((error = i_straccess(stp, JCWRITE)) != 0) {
7893                         mutex_exit(&stp->sd_lock);
7894                         return (error);
7895                 }
7896                 mutex_exit(&stp->sd_lock);
7897         }
7898 out:
7899         /*
7900          * For historic reasons, applications expect EAGAIN
7901          * when data mblk could not be allocated. so change
7902          * ENOMEM back to EAGAIN
7903          */
7904         if (error == ENOMEM)
7905                 error = EAGAIN;
7906         TRACE_3(TR_FAC_STREAMS_FR, TR_STRPUTMSG_OUT,
7907             "strputmsg out:stp %p out %d error %d", stp, 2, error);
7908         return (error);
7909 }
7910 
7911 /*
7912  * Put a message downstream.
7913  * Can send only an M_PROTO/M_PCPROTO by passing in a NULL uiop.
7914  * The fmode flag (NDELAY, NONBLOCK) is the or of the flags in the uio
7915  * and the fmode parameter.
7916  *
7917  * This routine handles the consolidation private flags:
7918  *      MSG_IGNERROR    Ignore any stream head error except STPLEX.
7919  *      MSG_HOLDSIG     Hold signals while waiting for data.
7920  *      MSG_IGNFLOW     Don't check streams flow control.
7921  *
7922  * NOTE: strputmsg and kstrputmsg have much of the logic in common.
7923  */
7924 int
7925 kstrputmsg(
7926         struct vnode *vp,
7927         mblk_t *mctl,
7928         struct uio *uiop,
7929         ssize_t msgsize,
7930         unsigned char pri,
7931         int flag,
7932         int fmode)
7933 {
7934         struct stdata *stp;
7935         queue_t *wqp;
7936         ssize_t rmin, rmax;
7937         int error;
7938 
7939         ASSERT(vp->v_stream);
7940         stp = vp->v_stream;
7941         wqp = stp->sd_wrq;
7942         if (AU_AUDITING())
7943                 audit_strputmsg(vp, NULL, NULL, pri, flag, fmode);
7944         if (mctl == NULL)
7945                 return (EINVAL);
7946 
7947         mutex_enter(&stp->sd_lock);
7948 
7949         if ((error = i_straccess(stp, JCWRITE)) != 0) {
7950                 mutex_exit(&stp->sd_lock);
7951                 freemsg(mctl);
7952                 return (error);
7953         }
7954 
7955         if ((stp->sd_flag & STPLEX) || !(flag & MSG_IGNERROR)) {
7956                 if (stp->sd_flag & (STWRERR|STRHUP|STPLEX)) {
7957                         error = strwriteable(stp, B_FALSE, B_TRUE);
7958                         if (error != 0) {
7959                                 mutex_exit(&stp->sd_lock);
7960                                 freemsg(mctl);
7961                                 return (error);
7962                         }
7963                 }
7964         }
7965 
7966         mutex_exit(&stp->sd_lock);
7967 
7968         /*
7969          * Check for legal flag value.
7970          */
7971         switch (flag & (MSG_HIPRI|MSG_BAND|MSG_ANY)) {
7972         case MSG_HIPRI:
7973                 if (pri != 0) {
7974                         freemsg(mctl);
7975                         return (EINVAL);
7976                 }
7977                 break;
7978         case MSG_BAND:
7979                 break;
7980         default:
7981                 freemsg(mctl);
7982                 return (EINVAL);
7983         }
7984 
7985         TRACE_1(TR_FAC_STREAMS_FR, TR_KSTRPUTMSG_IN,
7986             "kstrputmsg in:stp %p", stp);
7987 
7988         /* get these values from those cached in the stream head */
7989         rmin = stp->sd_qn_minpsz;
7990         rmax = stp->sd_qn_maxpsz;
7991 
7992         /*
7993          * Make sure ctl and data sizes together fall within the
7994          * limits of the max and min receive packet sizes and do
7995          * not exceed system limit.
7996          */
7997         ASSERT((rmax >= 0) || (rmax == INFPSZ));
7998         if (rmax == 0) {
7999                 freemsg(mctl);
8000                 return (ERANGE);
8001         }
8002         /*
8003          * Use the MAXIMUM of sd_maxblk and q_maxpsz.
8004          * Needed to prevent partial failures in the strmakedata loop.
8005          */
8006         if (stp->sd_maxblk != INFPSZ && rmax != INFPSZ && rmax < stp->sd_maxblk)
8007                 rmax = stp->sd_maxblk;
8008 
8009         if (uiop == NULL) {
8010                 msgsize = -1;
8011                 rmin = -1;      /* no range check for NULL data part */
8012         } else {
8013                 /* Use uio flags as well as the fmode parameter flags */
8014                 fmode |= uiop->uio_fmode;
8015 
8016                 if ((msgsize < rmin) ||
8017                     ((msgsize > rmax) && (rmax != INFPSZ))) {
8018                         freemsg(mctl);
8019                         return (ERANGE);
8020                 }
8021         }
8022 
8023         /* Ignore flow control in strput for HIPRI */
8024         if (flag & MSG_HIPRI)
8025                 flag |= MSG_IGNFLOW;
8026 
8027         for (;;) {
8028                 int done = 0;
8029                 int waitflag;
8030                 mblk_t *mp;
8031 
8032                 /*
8033                  * strput will always free the ctl mblk - even when strput
8034                  * fails. If MSG_IGNFLOW is set then any error returned
8035                  * will cause us to break the loop, so we don't need a copy
8036                  * of the message. If MSG_IGNFLOW is not set, then we can
8037                  * get hit by flow control and be forced to try again. In
8038                  * this case we need to have a copy of the message. We
8039                  * do this using copymsg since the message may get modified
8040                  * by something below us.
8041                  *
8042                  * We've observed that many TPI providers do not check db_ref
8043                  * on the control messages but blindly reuse them for the
8044                  * T_OK_ACK/T_ERROR_ACK. Thus using copymsg is more
8045                  * friendly to such providers than using dupmsg. Also, note
8046                  * that sockfs uses MSG_IGNFLOW for all TPI control messages.
8047                  * Only data messages are subject to flow control, hence
8048                  * subject to this copymsg.
8049                  */
8050                 if (flag & MSG_IGNFLOW) {
8051                         mp = mctl;
8052                         mctl = NULL;
8053                 } else {
8054                         do {
8055                                 /*
8056                                  * If a message has a free pointer, the message
8057                                  * must be dupmsg to maintain this pointer.
8058                                  * Code using this facility must be sure
8059                                  * that modules below will not change the
8060                                  * contents of the dblk without checking db_ref
8061                                  * first. If db_ref is > 1, then the module
8062                                  * needs to do a copymsg first. Otherwise,
8063                                  * the contents of the dblk may become
8064                                  * inconsistent because the freesmg/freeb below
8065                                  * may end up calling atomic_add_32_nv.
8066                                  * The atomic_add_32_nv in freeb (accessing
8067                                  * all of db_ref, db_type, db_flags, and
8068                                  * db_struioflag) does not prevent other threads
8069                                  * from concurrently trying to modify e.g.
8070                                  * db_type.
8071                                  */
8072                                 if (mctl->b_datap->db_frtnp != NULL)
8073                                         mp = dupmsg(mctl);
8074                                 else
8075                                         mp = copymsg(mctl);
8076 
8077                                 if (mp != NULL)
8078                                         break;
8079 
8080                                 error = strwaitbuf(msgdsize(mctl), BPRI_MED);
8081                                 if (error) {
8082                                         freemsg(mctl);
8083                                         return (error);
8084                                 }
8085                         } while (mp == NULL);
8086                 }
8087                 /*
8088                  * Verify that all of msgsize can be transferred by
8089                  * strput.
8090                  */
8091                 ASSERT(stp->sd_maxblk == INFPSZ || stp->sd_maxblk >= msgsize);
8092                 error = strput(stp, mp, uiop, &msgsize, 0, pri, flag);
8093                 if (error == 0)
8094                         break;
8095 
8096                 if (error != EWOULDBLOCK)
8097                         goto out;
8098 
8099                 /*
8100                  * IF MSG_IGNFLOW is set we should have broken out of loop
8101                  * above.
8102                  */
8103                 ASSERT(!(flag & MSG_IGNFLOW));
8104                 mutex_enter(&stp->sd_lock);
8105                 /*
8106                  * Check for a missed wakeup.
8107                  * Needed since strput did not hold sd_lock across
8108                  * the canputnext.
8109                  */
8110                 if (bcanputnext(wqp, pri)) {
8111                         /* Try again */
8112                         mutex_exit(&stp->sd_lock);
8113                         continue;
8114                 }
8115                 TRACE_2(TR_FAC_STREAMS_FR, TR_KSTRPUTMSG_WAIT,
8116                     "kstrputmsg wait:stp %p waits pri %d", stp, pri);
8117 
8118                 waitflag = WRITEWAIT;
8119                 if (flag & (MSG_HOLDSIG|MSG_IGNERROR)) {
8120                         if (flag & MSG_HOLDSIG)
8121                                 waitflag |= STR_NOSIG;
8122                         if (flag & MSG_IGNERROR)
8123                                 waitflag |= STR_NOERROR;
8124                 }
8125                 if (((error = strwaitq(stp, waitflag,
8126                     (ssize_t)0, fmode, -1, &done)) != 0) || done) {
8127                         mutex_exit(&stp->sd_lock);
8128                         TRACE_3(TR_FAC_STREAMS_FR, TR_KSTRPUTMSG_OUT,
8129                             "kstrputmsg out:stp %p out %d error %d",
8130                             stp, 0, error);
8131                         freemsg(mctl);
8132                         return (error);
8133                 }
8134                 TRACE_1(TR_FAC_STREAMS_FR, TR_KSTRPUTMSG_WAKE,
8135                     "kstrputmsg wake:stp %p wakes", stp);
8136                 if ((error = i_straccess(stp, JCWRITE)) != 0) {
8137                         mutex_exit(&stp->sd_lock);
8138                         freemsg(mctl);
8139                         return (error);
8140                 }
8141                 mutex_exit(&stp->sd_lock);
8142         }
8143 out:
8144         freemsg(mctl);
8145         /*
8146          * For historic reasons, applications expect EAGAIN
8147          * when data mblk could not be allocated. so change
8148          * ENOMEM back to EAGAIN
8149          */
8150         if (error == ENOMEM)
8151                 error = EAGAIN;
8152         TRACE_3(TR_FAC_STREAMS_FR, TR_KSTRPUTMSG_OUT,
8153             "kstrputmsg out:stp %p out %d error %d", stp, 2, error);
8154         return (error);
8155 }
8156 
8157 /*
8158  * Determines whether the necessary conditions are set on a stream
8159  * for it to be readable, writeable, or have exceptions.
8160  *
8161  * strpoll handles the consolidation private events:
8162  *      POLLNOERR       Do not return POLLERR even if there are stream
8163  *                      head errors.
8164  *                      Used by sockfs.
8165  *      POLLRDDATA      Do not return POLLIN unless at least one message on
8166  *                      the queue contains one or more M_DATA mblks. Thus
8167  *                      when this flag is set a queue with only
8168  *                      M_PROTO/M_PCPROTO mblks does not return POLLIN.
8169  *                      Used by sockfs to ignore T_EXDATA_IND messages.
8170  *
8171  * Note: POLLRDDATA assumes that synch streams only return messages with
8172  * an M_DATA attached (i.e. not messages consisting of only
8173  * an M_PROTO/M_PCPROTO part).
8174  */
8175 int
8176 strpoll(
8177         struct stdata *stp,
8178         short events_arg,
8179         int anyyet,
8180         short *reventsp,
8181         struct pollhead **phpp)
8182 {
8183         int events = (ushort_t)events_arg;
8184         int retevents = 0;
8185         mblk_t *mp;
8186         qband_t *qbp;
8187         long sd_flags = stp->sd_flag;
8188         int headlocked = 0;
8189 
8190         /*
8191          * For performance, a single 'if' tests for most possible edge
8192          * conditions in one shot
8193          */
8194         if (sd_flags & (STPLEX | STRDERR | STWRERR)) {
8195                 if (sd_flags & STPLEX) {
8196                         *reventsp = POLLNVAL;
8197                         return (EINVAL);
8198                 }
8199                 if (((events & (POLLIN | POLLRDNORM | POLLRDBAND | POLLPRI)) &&
8200                     (sd_flags & STRDERR)) ||
8201                     ((events & (POLLOUT | POLLWRNORM | POLLWRBAND)) &&
8202                     (sd_flags & STWRERR))) {
8203                         if (!(events & POLLNOERR)) {
8204                                 *reventsp = POLLERR;
8205                                 return (0);
8206                         }
8207                 }
8208         }
8209         if (sd_flags & STRHUP) {
8210                 retevents |= POLLHUP;
8211         } else if (events & (POLLWRNORM | POLLWRBAND)) {
8212                 queue_t *tq;
8213                 queue_t *qp = stp->sd_wrq;
8214 
8215                 claimstr(qp);
8216                 /* Find next module forward that has a service procedure */
8217                 tq = qp->q_next->q_nfsrv;
8218                 ASSERT(tq != NULL);
8219 
8220                 polllock(&stp->sd_pollist, QLOCK(tq));
8221                 if (events & POLLWRNORM) {
8222                         queue_t *sqp;
8223 
8224                         if (tq->q_flag & QFULL)
8225                                 /* ensure backq svc procedure runs */
8226                                 tq->q_flag |= QWANTW;
8227                         else if ((sqp = stp->sd_struiowrq) != NULL) {
8228                                 /* Check sync stream barrier write q */
8229                                 mutex_exit(QLOCK(tq));
8230                                 polllock(&stp->sd_pollist, QLOCK(sqp));
8231                                 if (sqp->q_flag & QFULL)
8232                                         /* ensure pollwakeup() is done */
8233                                         sqp->q_flag |= QWANTWSYNC;
8234                                 else
8235                                         retevents |= POLLOUT;
8236                                 /* More write events to process ??? */
8237                                 if (! (events & POLLWRBAND)) {
8238                                         mutex_exit(QLOCK(sqp));
8239                                         releasestr(qp);
8240                                         goto chkrd;
8241                                 }
8242                                 mutex_exit(QLOCK(sqp));
8243                                 polllock(&stp->sd_pollist, QLOCK(tq));
8244                         } else
8245                                 retevents |= POLLOUT;
8246                 }
8247                 if (events & POLLWRBAND) {
8248                         qbp = tq->q_bandp;
8249                         if (qbp) {
8250                                 while (qbp) {
8251                                         if (qbp->qb_flag & QB_FULL)
8252                                                 qbp->qb_flag |= QB_WANTW;
8253                                         else
8254                                                 retevents |= POLLWRBAND;
8255                                         qbp = qbp->qb_next;
8256                                 }
8257                         } else {
8258                                 retevents |= POLLWRBAND;
8259                         }
8260                 }
8261                 mutex_exit(QLOCK(tq));
8262                 releasestr(qp);
8263         }
8264 chkrd:
8265         if (sd_flags & STRPRI) {
8266                 retevents |= (events & POLLPRI);
8267         } else if (events & (POLLRDNORM | POLLRDBAND | POLLIN)) {
8268                 queue_t *qp = _RD(stp->sd_wrq);
8269                 int normevents = (events & (POLLIN | POLLRDNORM));
8270 
8271                 /*
8272                  * Note: Need to do polllock() here since ps_lock may be
8273                  * held. See bug 4191544.
8274                  */
8275                 polllock(&stp->sd_pollist, &stp->sd_lock);
8276                 headlocked = 1;
8277                 mp = qp->q_first;
8278                 while (mp) {
8279                         /*
8280                          * For POLLRDDATA we scan b_cont and b_next until we
8281                          * find an M_DATA.
8282                          */
8283                         if ((events & POLLRDDATA) &&
8284                             mp->b_datap->db_type != M_DATA) {
8285                                 mblk_t *nmp = mp->b_cont;
8286 
8287                                 while (nmp != NULL &&
8288                                     nmp->b_datap->db_type != M_DATA)
8289                                         nmp = nmp->b_cont;
8290                                 if (nmp == NULL) {
8291                                         mp = mp->b_next;
8292                                         continue;
8293                                 }
8294                         }
8295                         if (mp->b_band == 0)
8296                                 retevents |= normevents;
8297                         else
8298                                 retevents |= (events & (POLLIN | POLLRDBAND));
8299                         break;
8300                 }
8301                 if (! (retevents & normevents) &&
8302                     (stp->sd_wakeq & RSLEEP)) {
8303                         /*
8304                          * Sync stream barrier read queue has data.
8305                          */
8306                         retevents |= normevents;
8307                 }
8308                 /* Treat eof as normal data */
8309                 if (sd_flags & STREOF)
8310                         retevents |= normevents;
8311         }
8312 
8313         *reventsp = (short)retevents;
8314         if (retevents) {
8315                 if (headlocked)
8316                         mutex_exit(&stp->sd_lock);
8317                 return (0);
8318         }
8319 
8320         /*
8321          * If poll() has not found any events yet, set up event cell
8322          * to wake up the poll if a requested event occurs on this
8323          * stream.  Check for collisions with outstanding poll requests.
8324          */
8325         if (!anyyet) {
8326                 *phpp = &stp->sd_pollist;
8327                 if (headlocked == 0) {
8328                         polllock(&stp->sd_pollist, &stp->sd_lock);
8329                         headlocked = 1;
8330                 }
8331                 stp->sd_rput_opt |= SR_POLLIN;
8332         }
8333         if (headlocked)
8334                 mutex_exit(&stp->sd_lock);
8335         return (0);
8336 }
8337 
8338 /*
8339  * The purpose of putback() is to assure sleeping polls/reads
8340  * are awakened when there are no new messages arriving at the,
8341  * stream head, and a message is placed back on the read queue.
8342  *
8343  * sd_lock must be held when messages are placed back on stream
8344  * head.  (getq() holds sd_lock when it removes messages from
8345  * the queue)
8346  */
8347 
8348 static void
8349 putback(struct stdata *stp, queue_t *q, mblk_t *bp, int band)
8350 {
8351         mblk_t  *qfirst;
8352         ASSERT(MUTEX_HELD(&stp->sd_lock));
8353 
8354         /*
8355          * As a result of lock-step ordering around q_lock and sd_lock,
8356          * it's possible for function calls like putnext() and
8357          * canputnext() to get an inaccurate picture of how much
8358          * data is really being processed at the stream head.
8359          * We only consolidate with existing messages on the queue
8360          * if the length of the message we want to put back is smaller
8361          * than the queue hiwater mark.
8362          */
8363         if ((stp->sd_rput_opt & SR_CONSOL_DATA) &&
8364             (DB_TYPE(bp) == M_DATA) && ((qfirst = q->q_first) != NULL) &&
8365             (DB_TYPE(qfirst) == M_DATA) &&
8366             ((qfirst->b_flag & (MSGMARK|MSGDELIM)) == 0) &&
8367             ((bp->b_flag & (MSGMARK|MSGDELIM|MSGMARKNEXT)) == 0) &&
8368             (mp_cont_len(bp, NULL) < q->q_hiwat)) {
8369                 /*
8370                  * We use the same logic as defined in strrput()
8371                  * but in reverse as we are putting back onto the
8372                  * queue and want to retain byte ordering.
8373                  * Consolidate M_DATA messages with M_DATA ONLY.
8374                  * strrput() allows the consolidation of M_DATA onto
8375                  * M_PROTO | M_PCPROTO but not the other way round.
8376                  *
8377                  * The consolidation does not take place if the message
8378                  * we are returning to the queue is marked with either
8379                  * of the marks or the delim flag or if q_first
8380                  * is marked with MSGMARK. The MSGMARK check is needed to
8381                  * handle the odd semantics of MSGMARK where essentially
8382                  * the whole message is to be treated as marked.
8383                  * Carry any MSGMARKNEXT and MSGNOTMARKNEXT from q_first
8384                  * to the front of the b_cont chain.
8385                  */
8386                 rmvq_noenab(q, qfirst);
8387 
8388                 /*
8389                  * The first message in the b_cont list
8390                  * tracks MSGMARKNEXT and MSGNOTMARKNEXT.
8391                  * We need to handle the case where we
8392                  * are appending:
8393                  *
8394                  * 1) a MSGMARKNEXT to a MSGNOTMARKNEXT.
8395                  * 2) a MSGMARKNEXT to a plain message.
8396                  * 3) a MSGNOTMARKNEXT to a plain message
8397                  * 4) a MSGNOTMARKNEXT to a MSGNOTMARKNEXT
8398                  *    message.
8399                  *
8400                  * Thus we never append a MSGMARKNEXT or
8401                  * MSGNOTMARKNEXT to a MSGMARKNEXT message.
8402                  */
8403                 if (qfirst->b_flag & MSGMARKNEXT) {
8404                         bp->b_flag |= MSGMARKNEXT;
8405                         bp->b_flag &= ~MSGNOTMARKNEXT;
8406                         qfirst->b_flag &= ~MSGMARKNEXT;
8407                 } else if (qfirst->b_flag & MSGNOTMARKNEXT) {
8408                         bp->b_flag |= MSGNOTMARKNEXT;
8409                         qfirst->b_flag &= ~MSGNOTMARKNEXT;
8410                 }
8411 
8412                 linkb(bp, qfirst);
8413         }
8414         (void) putbq(q, bp);
8415 
8416         /*
8417          * A message may have come in when the sd_lock was dropped in the
8418          * calling routine. If this is the case and STR*ATMARK info was
8419          * received, need to move that from the stream head to the q_last
8420          * so that SIOCATMARK can return the proper value.
8421          */
8422         if (stp->sd_flag & (STRATMARK | STRNOTATMARK)) {
8423                 unsigned short *flagp = &q->q_last->b_flag;
8424                 uint_t b_flag = (uint_t)*flagp;
8425 
8426                 if (stp->sd_flag & STRATMARK) {
8427                         b_flag &= ~MSGNOTMARKNEXT;
8428                         b_flag |= MSGMARKNEXT;
8429                         stp->sd_flag &= ~STRATMARK;
8430                 } else {
8431                         b_flag &= ~MSGMARKNEXT;
8432                         b_flag |= MSGNOTMARKNEXT;
8433                         stp->sd_flag &= ~STRNOTATMARK;
8434                 }
8435                 *flagp = (unsigned short) b_flag;
8436         }
8437 
8438 #ifdef  DEBUG
8439         /*
8440          * Make sure that the flags are not messed up.
8441          */
8442         {
8443                 mblk_t *mp;
8444                 mp = q->q_last;
8445                 while (mp != NULL) {
8446                         ASSERT((mp->b_flag & (MSGMARKNEXT|MSGNOTMARKNEXT)) !=
8447                             (MSGMARKNEXT|MSGNOTMARKNEXT));
8448                         mp = mp->b_cont;
8449                 }
8450         }
8451 #endif
8452         if (q->q_first == bp) {
8453                 short pollevents;
8454 
8455                 if (stp->sd_flag & RSLEEP) {
8456                         stp->sd_flag &= ~RSLEEP;
8457                         cv_broadcast(&q->q_wait);
8458                 }
8459                 if (stp->sd_flag & STRPRI) {
8460                         pollevents = POLLPRI;
8461                 } else {
8462                         if (band == 0) {
8463                                 if (!(stp->sd_rput_opt & SR_POLLIN))
8464                                         return;
8465                                 stp->sd_rput_opt &= ~SR_POLLIN;
8466                                 pollevents = POLLIN | POLLRDNORM;
8467                         } else {
8468                                 pollevents = POLLIN | POLLRDBAND;
8469                         }
8470                 }
8471                 mutex_exit(&stp->sd_lock);
8472                 pollwakeup(&stp->sd_pollist, pollevents);
8473                 mutex_enter(&stp->sd_lock);
8474         }
8475 }
8476 
8477 /*
8478  * Return the held vnode attached to the stream head of a
8479  * given queue
8480  * It is the responsibility of the calling routine to ensure
8481  * that the queue does not go away (e.g. pop).
8482  */
8483 vnode_t *
8484 strq2vp(queue_t *qp)
8485 {
8486         vnode_t *vp;
8487         vp = STREAM(qp)->sd_vnode;
8488         ASSERT(vp != NULL);
8489         VN_HOLD(vp);
8490         return (vp);
8491 }
8492 
8493 /*
8494  * return the stream head write queue for the given vp
8495  * It is the responsibility of the calling routine to ensure
8496  * that the stream or vnode do not close.
8497  */
8498 queue_t *
8499 strvp2wq(vnode_t *vp)
8500 {
8501         ASSERT(vp->v_stream != NULL);
8502         return (vp->v_stream->sd_wrq);
8503 }
8504 
8505 /*
8506  * pollwakeup stream head
8507  * It is the responsibility of the calling routine to ensure
8508  * that the stream or vnode do not close.
8509  */
8510 void
8511 strpollwakeup(vnode_t *vp, short event)
8512 {
8513         ASSERT(vp->v_stream);
8514         pollwakeup(&vp->v_stream->sd_pollist, event);
8515 }
8516 
8517 /*
8518  * Mate the stream heads of two vnodes together. If the two vnodes are the
8519  * same, we just make the write-side point at the read-side -- otherwise,
8520  * we do a full mate.  Only works on vnodes associated with streams that are
8521  * still being built and thus have only a stream head.
8522  */
8523 void
8524 strmate(vnode_t *vp1, vnode_t *vp2)
8525 {
8526         queue_t *wrq1 = strvp2wq(vp1);
8527         queue_t *wrq2 = strvp2wq(vp2);
8528 
8529         /*
8530          * Verify that there are no modules on the stream yet.  We also
8531          * rely on the stream head always having a service procedure to
8532          * avoid tweaking q_nfsrv.
8533          */
8534         ASSERT(wrq1->q_next == NULL && wrq2->q_next == NULL);
8535         ASSERT(wrq1->q_qinfo->qi_srvp != NULL);
8536         ASSERT(wrq2->q_qinfo->qi_srvp != NULL);
8537 
8538         /*
8539          * If the queues are the same, just twist; otherwise do a full mate.
8540          */
8541         if (wrq1 == wrq2) {
8542                 wrq1->q_next = _RD(wrq1);
8543         } else {
8544                 wrq1->q_next = _RD(wrq2);
8545                 wrq2->q_next = _RD(wrq1);
8546                 STREAM(wrq1)->sd_mate = STREAM(wrq2);
8547                 STREAM(wrq1)->sd_flag |= STRMATE;
8548                 STREAM(wrq2)->sd_mate = STREAM(wrq1);
8549                 STREAM(wrq2)->sd_flag |= STRMATE;
8550         }
8551 }
8552 
8553 /*
8554  * XXX will go away when console is correctly fixed.
8555  * Clean up the console PIDS, from previous I_SETSIG,
8556  * called only for cnopen which never calls strclean().
8557  */
8558 void
8559 str_cn_clean(struct vnode *vp)
8560 {
8561         strsig_t *ssp, *pssp, *tssp;
8562         struct stdata *stp;
8563         struct pid  *pidp;
8564         int update = 0;
8565 
8566         ASSERT(vp->v_stream);
8567         stp = vp->v_stream;
8568         pssp = NULL;
8569         mutex_enter(&stp->sd_lock);
8570         ssp = stp->sd_siglist;
8571         while (ssp) {
8572                 mutex_enter(&pidlock);
8573                 pidp = ssp->ss_pidp;
8574                 /*
8575                  * Get rid of PID if the proc is gone.
8576                  */
8577                 if (pidp->pid_prinactive) {
8578                         tssp = ssp->ss_next;
8579                         if (pssp)
8580                                 pssp->ss_next = tssp;
8581                         else
8582                                 stp->sd_siglist = tssp;
8583                         ASSERT(pidp->pid_ref <= 1);
8584                         PID_RELE(ssp->ss_pidp);
8585                         mutex_exit(&pidlock);
8586                         kmem_free(ssp, sizeof (strsig_t));
8587                         update = 1;
8588                         ssp = tssp;
8589                         continue;
8590                 } else
8591                         mutex_exit(&pidlock);
8592                 pssp = ssp;
8593                 ssp = ssp->ss_next;
8594         }
8595         if (update) {
8596                 stp->sd_sigflags = 0;
8597                 for (ssp = stp->sd_siglist; ssp; ssp = ssp->ss_next)
8598                         stp->sd_sigflags |= ssp->ss_events;
8599         }
8600         mutex_exit(&stp->sd_lock);
8601 }
8602 
8603 /*
8604  * Return B_TRUE if there is data in the message, B_FALSE otherwise.
8605  */
8606 static boolean_t
8607 msghasdata(mblk_t *bp)
8608 {
8609         for (; bp; bp = bp->b_cont)
8610                 if (bp->b_datap->db_type == M_DATA) {
8611                         ASSERT(bp->b_wptr >= bp->b_rptr);
8612                         if (bp->b_wptr > bp->b_rptr)
8613                                 return (B_TRUE);
8614                 }
8615         return (B_FALSE);
8616 }