1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21 /* Copyright (c) 1984, 1986, 1987, 1988, 1989 AT&T */
22 /* All Rights Reserved */
23
24
25 /*
26 * Copyright (c) 1988, 2010, Oracle and/or its affiliates. All rights reserved.
27 */
28
29 #include <sys/types.h>
30 #include <sys/sysmacros.h>
31 #include <sys/param.h>
32 #include <sys/errno.h>
33 #include <sys/signal.h>
34 #include <sys/stat.h>
35 #include <sys/proc.h>
36 #include <sys/cred.h>
37 #include <sys/user.h>
38 #include <sys/vnode.h>
39 #include <sys/file.h>
40 #include <sys/stream.h>
41 #include <sys/strsubr.h>
42 #include <sys/stropts.h>
43 #include <sys/tihdr.h>
44 #include <sys/var.h>
45 #include <sys/poll.h>
46 #include <sys/termio.h>
47 #include <sys/ttold.h>
48 #include <sys/systm.h>
49 #include <sys/uio.h>
50 #include <sys/cmn_err.h>
51 #include <sys/sad.h>
52 #include <sys/netstack.h>
53 #include <sys/priocntl.h>
54 #include <sys/jioctl.h>
55 #include <sys/procset.h>
56 #include <sys/session.h>
57 #include <sys/kmem.h>
58 #include <sys/filio.h>
59 #include <sys/vtrace.h>
60 #include <sys/debug.h>
61 #include <sys/strredir.h>
62 #include <sys/fs/fifonode.h>
63 #include <sys/fs/snode.h>
64 #include <sys/strlog.h>
65 #include <sys/strsun.h>
66 #include <sys/project.h>
67 #include <sys/kbio.h>
68 #include <sys/msio.h>
69 #include <sys/tty.h>
70 #include <sys/ptyvar.h>
71 #include <sys/vuid_event.h>
72 #include <sys/modctl.h>
73 #include <sys/sunddi.h>
74 #include <sys/sunldi_impl.h>
75 #include <sys/autoconf.h>
76 #include <sys/policy.h>
77 #include <sys/dld.h>
78 #include <sys/zone.h>
79 #include <c2/audit.h>
80 #include <sys/fcntl.h>
81
82 /*
83 * This define helps improve the readability of streams code while
84 * still maintaining a very old streams performance enhancement. The
85 * performance enhancement basically involved having all callers
86 * of straccess() perform the first check that straccess() will do
87 * locally before actually calling straccess(). (There by reducing
88 * the number of unnecessary calls to straccess().)
89 */
90 #define i_straccess(x, y) ((stp->sd_sidp == NULL) ? 0 : \
91 (stp->sd_vnode->v_type == VFIFO) ? 0 : \
92 straccess((x), (y)))
93
94 /*
95 * what is mblk_pull_len?
96 *
97 * If a streams message consists of many short messages,
98 * a performance degradation occurs from copyout overhead.
99 * To decrease the per mblk overhead, messages that are
100 * likely to consist of many small mblks are pulled up into
101 * one continuous chunk of memory.
102 *
103 * To avoid the processing overhead of examining every
104 * mblk, a quick heuristic is used. If the first mblk in
105 * the message is shorter than mblk_pull_len, it is likely
106 * that the rest of the mblk will be short.
107 *
108 * This heuristic was decided upon after performance tests
109 * indicated that anything more complex slowed down the main
110 * code path.
111 */
112 #define MBLK_PULL_LEN 64
113 uint32_t mblk_pull_len = MBLK_PULL_LEN;
114
115 /*
116 * The sgttyb_handling flag controls the handling of the old BSD
117 * TIOCGETP, TIOCSETP, and TIOCSETN ioctls as follows:
118 *
119 * 0 - Emit no warnings at all and retain old, broken behavior.
120 * 1 - Emit no warnings and silently handle new semantics.
121 * 2 - Send cmn_err(CE_NOTE) when either TIOCSETP or TIOCSETN is used
122 * (once per system invocation). Handle with new semantics.
123 * 3 - Send SIGSYS when any TIOCGETP, TIOCSETP, or TIOCSETN call is
124 * made (so that offenders drop core and are easy to debug).
125 *
126 * The "new semantics" are that TIOCGETP returns B38400 for
127 * sg_[io]speed if the corresponding value is over B38400, and that
128 * TIOCSET[PN] accept B38400 in these cases to mean "retain current
129 * bit rate."
130 */
131 int sgttyb_handling = 1;
132 static boolean_t sgttyb_complaint;
133
134 /* don't push drcompat module by default on Style-2 streams */
135 static int push_drcompat = 0;
136
137 /*
138 * id value used to distinguish between different ioctl messages
139 */
140 static uint32_t ioc_id;
141
142 static void putback(struct stdata *, queue_t *, mblk_t *, int);
143 static void strcleanall(struct vnode *);
144 static int strwsrv(queue_t *);
145 static int strdocmd(struct stdata *, struct strcmd *, cred_t *);
146 static boolean_t is_xti_str(const struct stdata *);
147
148 /*
149 * qinit and module_info structures for stream head read and write queues
150 */
151 struct module_info strm_info = { 0, "strrhead", 0, INFPSZ, STRHIGH, STRLOW };
152 struct module_info stwm_info = { 0, "strwhead", 0, 0, 0, 0 };
153 struct qinit strdata = { strrput, NULL, NULL, NULL, NULL, &strm_info };
154 struct qinit stwdata = { NULL, strwsrv, NULL, NULL, NULL, &stwm_info };
155 struct module_info fiform_info = { 0, "fifostrrhead", 0, PIPE_BUF, FIFOHIWAT,
156 FIFOLOWAT };
157 struct module_info fifowm_info = { 0, "fifostrwhead", 0, 0, 0, 0 };
158 struct qinit fifo_strdata = { strrput, NULL, NULL, NULL, NULL, &fiform_info };
159 struct qinit fifo_stwdata = { NULL, strwsrv, NULL, NULL, NULL, &fifowm_info };
160
161 extern kmutex_t strresources; /* protects global resources */
162 extern kmutex_t muxifier; /* single-threads multiplexor creation */
163
164 static boolean_t msghasdata(mblk_t *bp);
165 #define msgnodata(bp) (!msghasdata(bp))
166
167 /*
168 * Stream head locking notes:
169 * There are four monitors associated with the stream head:
170 * 1. v_stream monitor: in stropen() and strclose() v_lock
171 * is held while the association of vnode and stream
172 * head is established or tested for.
173 * 2. open/close/push/pop monitor: sd_lock is held while each
174 * thread bids for exclusive access to this monitor
175 * for opening or closing a stream. In addition, this
176 * monitor is entered during pushes and pops. This
177 * guarantees that during plumbing operations there
178 * is only one thread trying to change the plumbing.
179 * Any other threads present in the stream are only
180 * using the plumbing.
181 * 3. read/write monitor: in the case of read, a thread holds
182 * sd_lock while trying to get data from the stream
183 * head queue. if there is none to fulfill a read
184 * request, it sets RSLEEP and calls cv_wait_sig() down
185 * in strwaitq() to await the arrival of new data.
186 * when new data arrives in strrput(), sd_lock is acquired
187 * before testing for RSLEEP and calling cv_broadcast().
188 * the behavior of strwrite(), strwsrv(), and WSLEEP
189 * mirror this.
190 * 4. ioctl monitor: sd_lock is gotten to ensure that only one
191 * thread is doing an ioctl at a time.
192 */
193
194 static int
195 push_mod(queue_t *qp, dev_t *devp, struct stdata *stp, const char *name,
196 int anchor, cred_t *crp, uint_t anchor_zoneid)
197 {
198 int error;
199 fmodsw_impl_t *fp;
200
201 if (stp->sd_flag & (STRHUP|STRDERR|STWRERR)) {
202 error = (stp->sd_flag & STRHUP) ? ENXIO : EIO;
203 return (error);
204 }
205 if (stp->sd_pushcnt >= nstrpush) {
206 return (EINVAL);
207 }
208
209 if ((fp = fmodsw_find(name, FMODSW_HOLD | FMODSW_LOAD)) == NULL) {
210 stp->sd_flag |= STREOPENFAIL;
211 return (EINVAL);
212 }
213
214 /*
215 * push new module and call its open routine via qattach
216 */
217 if ((error = qattach(qp, devp, 0, crp, fp, B_FALSE)) != 0)
218 return (error);
219
220 /*
221 * Check to see if caller wants a STREAMS anchor
222 * put at this place in the stream, and add if so.
223 */
224 mutex_enter(&stp->sd_lock);
225 if (anchor == stp->sd_pushcnt) {
226 stp->sd_anchor = stp->sd_pushcnt;
227 stp->sd_anchorzone = anchor_zoneid;
228 }
229 mutex_exit(&stp->sd_lock);
230
231 return (0);
232 }
233
234 /*
235 * Open a stream device.
236 */
237 int
238 stropen(vnode_t *vp, dev_t *devp, int flag, cred_t *crp)
239 {
240 struct stdata *stp;
241 queue_t *qp;
242 int s;
243 dev_t dummydev, savedev;
244 struct autopush *ap;
245 struct dlautopush dlap;
246 int error = 0;
247 ssize_t rmin, rmax;
248 int cloneopen;
249 queue_t *brq;
250 major_t major;
251 str_stack_t *ss;
252 zoneid_t zoneid;
253 uint_t anchor;
254
255 /*
256 * If the stream already exists, wait for any open in progress
257 * to complete, then call the open function of each module and
258 * driver in the stream. Otherwise create the stream.
259 */
260 TRACE_1(TR_FAC_STREAMS_FR, TR_STROPEN, "stropen:%p", vp);
261 retry:
262 mutex_enter(&vp->v_lock);
263 if ((stp = vp->v_stream) != NULL) {
264
265 /*
266 * Waiting for stream to be created to device
267 * due to another open.
268 */
269 mutex_exit(&vp->v_lock);
270
271 if (STRMATED(stp)) {
272 struct stdata *strmatep = stp->sd_mate;
273
274 STRLOCKMATES(stp);
275 if (strmatep->sd_flag & (STWOPEN|STRCLOSE|STRPLUMB)) {
276 if (flag & (FNDELAY|FNONBLOCK)) {
277 error = EAGAIN;
278 mutex_exit(&strmatep->sd_lock);
279 goto ckreturn;
280 }
281 mutex_exit(&stp->sd_lock);
282 if (!cv_wait_sig(&strmatep->sd_monitor,
283 &strmatep->sd_lock)) {
284 error = EINTR;
285 mutex_exit(&strmatep->sd_lock);
286 mutex_enter(&stp->sd_lock);
287 goto ckreturn;
288 }
289 mutex_exit(&strmatep->sd_lock);
290 goto retry;
291 }
292 if (stp->sd_flag & (STWOPEN|STRCLOSE|STRPLUMB)) {
293 if (flag & (FNDELAY|FNONBLOCK)) {
294 error = EAGAIN;
295 mutex_exit(&strmatep->sd_lock);
296 goto ckreturn;
297 }
298 mutex_exit(&strmatep->sd_lock);
299 if (!cv_wait_sig(&stp->sd_monitor,
300 &stp->sd_lock)) {
301 error = EINTR;
302 goto ckreturn;
303 }
304 mutex_exit(&stp->sd_lock);
305 goto retry;
306 }
307
308 if (stp->sd_flag & (STRDERR|STWRERR)) {
309 error = EIO;
310 mutex_exit(&strmatep->sd_lock);
311 goto ckreturn;
312 }
313
314 stp->sd_flag |= STWOPEN;
315 STRUNLOCKMATES(stp);
316 } else {
317 mutex_enter(&stp->sd_lock);
318 if (stp->sd_flag & (STWOPEN|STRCLOSE|STRPLUMB)) {
319 if (flag & (FNDELAY|FNONBLOCK)) {
320 error = EAGAIN;
321 goto ckreturn;
322 }
323 if (!cv_wait_sig(&stp->sd_monitor,
324 &stp->sd_lock)) {
325 error = EINTR;
326 goto ckreturn;
327 }
328 mutex_exit(&stp->sd_lock);
329 goto retry; /* could be clone! */
330 }
331
332 if (stp->sd_flag & (STRDERR|STWRERR)) {
333 error = EIO;
334 goto ckreturn;
335 }
336
337 stp->sd_flag |= STWOPEN;
338 mutex_exit(&stp->sd_lock);
339 }
340
341 /*
342 * Open all modules and devices down stream to notify
343 * that another user is streaming. For modules, set the
344 * last argument to MODOPEN and do not pass any open flags.
345 * Ignore dummydev since this is not the first open.
346 */
347 claimstr(stp->sd_wrq);
348 qp = stp->sd_wrq;
349 while (_SAMESTR(qp)) {
350 qp = qp->q_next;
351 if ((error = qreopen(_RD(qp), devp, flag, crp)) != 0)
352 break;
353 }
354 releasestr(stp->sd_wrq);
355 mutex_enter(&stp->sd_lock);
356 stp->sd_flag &= ~(STRHUP|STWOPEN|STRDERR|STWRERR);
357 stp->sd_rerror = 0;
358 stp->sd_werror = 0;
359 ckreturn:
360 cv_broadcast(&stp->sd_monitor);
361 mutex_exit(&stp->sd_lock);
362 return (error);
363 }
364
365 /*
366 * This vnode isn't streaming. SPECFS already
367 * checked for multiple vnodes pointing to the
368 * same stream, so create a stream to the driver.
369 */
370 qp = allocq();
371 stp = shalloc(qp);
372
373 /*
374 * Initialize stream head. shalloc() has given us
375 * exclusive access, and we have the vnode locked;
376 * we can do whatever we want with stp.
377 */
378 stp->sd_flag = STWOPEN;
379 stp->sd_siglist = NULL;
380 stp->sd_pollist.ph_list = NULL;
381 stp->sd_sigflags = 0;
382 stp->sd_mark = NULL;
383 stp->sd_closetime = STRTIMOUT;
384 stp->sd_sidp = NULL;
385 stp->sd_pgidp = NULL;
386 stp->sd_vnode = vp;
387 stp->sd_rerror = 0;
388 stp->sd_werror = 0;
389 stp->sd_wroff = 0;
390 stp->sd_tail = 0;
391 stp->sd_iocblk = NULL;
392 stp->sd_cmdblk = NULL;
393 stp->sd_pushcnt = 0;
394 stp->sd_qn_minpsz = 0;
395 stp->sd_qn_maxpsz = INFPSZ - 1; /* used to check for initialization */
396 stp->sd_maxblk = INFPSZ;
397 qp->q_ptr = _WR(qp)->q_ptr = stp;
398 STREAM(qp) = STREAM(_WR(qp)) = stp;
399 vp->v_stream = stp;
400 mutex_exit(&vp->v_lock);
401
402 /*
403 * If this is not a system process, then add it to
404 * the list associated with the stream head.
405 */
406 if (!(curproc->p_flag & SSYS) && is_xti_str(stp))
407 sh_insert_pid(stp, curproc->p_pidp->pid_id);
408
409 if (vp->v_type == VFIFO) {
410 stp->sd_flag |= OLDNDELAY;
411 /*
412 * This means, both for pipes and fifos
413 * strwrite will send SIGPIPE if the other
414 * end is closed. For putmsg it depends
415 * on whether it is a XPG4_2 application
416 * or not
417 */
418 stp->sd_wput_opt = SW_SIGPIPE;
419
420 /* setq might sleep in kmem_alloc - avoid holding locks. */
421 setq(qp, &fifo_strdata, &fifo_stwdata, NULL, QMTSAFE,
422 SQ_CI|SQ_CO, B_FALSE);
423
424 set_qend(qp);
425 stp->sd_strtab = fifo_getinfo();
426 _WR(qp)->q_nfsrv = _WR(qp);
427 qp->q_nfsrv = qp;
428 /*
429 * Wake up others that are waiting for stream to be created.
430 */
431 mutex_enter(&stp->sd_lock);
432 /*
433 * nothing is be pushed on stream yet, so
434 * optimized stream head packetsizes are just that
435 * of the read queue
436 */
437 stp->sd_qn_minpsz = qp->q_minpsz;
438 stp->sd_qn_maxpsz = qp->q_maxpsz;
439 stp->sd_flag &= ~STWOPEN;
440 goto fifo_opendone;
441 }
442 /* setq might sleep in kmem_alloc - avoid holding locks. */
443 setq(qp, &strdata, &stwdata, NULL, QMTSAFE, SQ_CI|SQ_CO, B_FALSE);
444
445 set_qend(qp);
446
447 /*
448 * Open driver and create stream to it (via qattach).
449 */
450 savedev = *devp;
451 cloneopen = (getmajor(*devp) == clone_major);
452 if ((error = qattach(qp, devp, flag, crp, NULL, B_FALSE)) != 0) {
453 mutex_enter(&vp->v_lock);
454 vp->v_stream = NULL;
455 mutex_exit(&vp->v_lock);
456 mutex_enter(&stp->sd_lock);
457 cv_broadcast(&stp->sd_monitor);
458 mutex_exit(&stp->sd_lock);
459 freeq(_RD(qp));
460 shfree(stp);
461 return (error);
462 }
463 /*
464 * Set sd_strtab after open in order to handle clonable drivers
465 */
466 stp->sd_strtab = STREAMSTAB(getmajor(*devp));
467
468 /*
469 * Historical note: dummydev used to be be prior to the initial
470 * open (via qattach above), which made the value seen
471 * inconsistent between an I_PUSH and an autopush of a module.
472 */
473 dummydev = *devp;
474
475 /*
476 * For clone open of old style (Q not associated) network driver,
477 * push DRMODNAME module to handle DL_ATTACH/DL_DETACH
478 */
479 brq = _RD(_WR(qp)->q_next);
480 major = getmajor(*devp);
481 if (push_drcompat && cloneopen && NETWORK_DRV(major) &&
482 ((brq->q_flag & _QASSOCIATED) == 0)) {
483 if (push_mod(qp, &dummydev, stp, DRMODNAME, 0, crp, 0) != 0)
484 cmn_err(CE_WARN, "cannot push " DRMODNAME
485 " streams module");
486 }
487
488 if (!NETWORK_DRV(major)) {
489 savedev = *devp;
490 } else {
491 /*
492 * For network devices, process differently based on the
493 * return value from dld_autopush():
494 *
495 * 0: the passed-in device points to a GLDv3 datalink with
496 * per-link autopush configuration; use that configuration
497 * and ignore any per-driver autopush configuration.
498 *
499 * 1: the passed-in device points to a physical GLDv3
500 * datalink without per-link autopush configuration. The
501 * passed in device was changed to refer to the actual
502 * physical device (if it's not already); we use that new
503 * device to look up any per-driver autopush configuration.
504 *
505 * -1: neither of the above cases applied; use the initial
506 * device to look up any per-driver autopush configuration.
507 */
508 switch (dld_autopush(&savedev, &dlap)) {
509 case 0:
510 zoneid = crgetzoneid(crp);
511 for (s = 0; s < dlap.dap_npush; s++) {
512 error = push_mod(qp, &dummydev, stp,
513 dlap.dap_aplist[s], dlap.dap_anchor, crp,
514 zoneid);
515 if (error != 0)
516 break;
517 }
518 goto opendone;
519 case 1:
520 break;
521 case -1:
522 savedev = *devp;
523 break;
524 }
525 }
526 /*
527 * Find the autopush configuration based on "savedev". Start with the
528 * global zone. If not found check in the local zone.
529 */
530 zoneid = GLOBAL_ZONEID;
531 retryap:
532 ss = netstack_find_by_stackid(zoneid_to_netstackid(zoneid))->
533 netstack_str;
534 if ((ap = sad_ap_find_by_dev(savedev, ss)) == NULL) {
535 netstack_rele(ss->ss_netstack);
536 if (zoneid == GLOBAL_ZONEID) {
537 /*
538 * None found. Also look in the zone's autopush table.
539 */
540 zoneid = crgetzoneid(crp);
541 if (zoneid != GLOBAL_ZONEID)
542 goto retryap;
543 }
544 goto opendone;
545 }
546 anchor = ap->ap_anchor;
547 zoneid = crgetzoneid(crp);
548 for (s = 0; s < ap->ap_npush; s++) {
549 error = push_mod(qp, &dummydev, stp, ap->ap_list[s],
550 anchor, crp, zoneid);
551 if (error != 0)
552 break;
553 }
554 sad_ap_rele(ap, ss);
555 netstack_rele(ss->ss_netstack);
556
557 opendone:
558
559 /*
560 * let specfs know that open failed part way through
561 */
562 if (error) {
563 mutex_enter(&stp->sd_lock);
564 stp->sd_flag |= STREOPENFAIL;
565 mutex_exit(&stp->sd_lock);
566 }
567
568 /*
569 * Wake up others that are waiting for stream to be created.
570 */
571 mutex_enter(&stp->sd_lock);
572 stp->sd_flag &= ~STWOPEN;
573
574 /*
575 * As a performance concern we are caching the values of
576 * q_minpsz and q_maxpsz of the module below the stream
577 * head in the stream head.
578 */
579 mutex_enter(QLOCK(stp->sd_wrq->q_next));
580 rmin = stp->sd_wrq->q_next->q_minpsz;
581 rmax = stp->sd_wrq->q_next->q_maxpsz;
582 mutex_exit(QLOCK(stp->sd_wrq->q_next));
583
584 /* do this processing here as a performance concern */
585 if (strmsgsz != 0) {
586 if (rmax == INFPSZ)
587 rmax = strmsgsz;
588 else
589 rmax = MIN(strmsgsz, rmax);
590 }
591
592 mutex_enter(QLOCK(stp->sd_wrq));
593 stp->sd_qn_minpsz = rmin;
594 stp->sd_qn_maxpsz = rmax;
595 mutex_exit(QLOCK(stp->sd_wrq));
596
597 fifo_opendone:
598 cv_broadcast(&stp->sd_monitor);
599 mutex_exit(&stp->sd_lock);
600 return (error);
601 }
602
603 static int strsink(queue_t *, mblk_t *);
604 static struct qinit deadrend = {
605 strsink, NULL, NULL, NULL, NULL, &strm_info, NULL
606 };
607 static struct qinit deadwend = {
608 NULL, NULL, NULL, NULL, NULL, &stwm_info, NULL
609 };
610
611 /*
612 * Close a stream.
613 * This is called from closef() on the last close of an open stream.
614 * Strclean() will already have removed the siglist and pollist
615 * information, so all that remains is to remove all multiplexor links
616 * for the stream, pop all the modules (and the driver), and free the
617 * stream structure.
618 */
619
620 int
621 strclose(struct vnode *vp, int flag, cred_t *crp)
622 {
623 struct stdata *stp;
624 queue_t *qp;
625 int rval;
626 int freestp = 1;
627 queue_t *rmq;
628
629 TRACE_1(TR_FAC_STREAMS_FR,
630 TR_STRCLOSE, "strclose:%p", vp);
631 ASSERT(vp->v_stream);
632
633 stp = vp->v_stream;
634 ASSERT(!(stp->sd_flag & STPLEX));
635 qp = stp->sd_wrq;
636
637 /*
638 * Needed so that strpoll will return non-zero for this fd.
639 * Note that with POLLNOERR STRHUP does still cause POLLHUP.
640 */
641 mutex_enter(&stp->sd_lock);
642 stp->sd_flag |= STRHUP;
643 mutex_exit(&stp->sd_lock);
644
645 /*
646 * If the registered process or process group did not have an
647 * open instance of this stream then strclean would not be
648 * called. Thus at the time of closing all remaining siglist entries
649 * are removed.
650 */
651 if (stp->sd_siglist != NULL)
652 strcleanall(vp);
653
654 ASSERT(stp->sd_siglist == NULL);
655 ASSERT(stp->sd_sigflags == 0);
656
657 if (STRMATED(stp)) {
658 struct stdata *strmatep = stp->sd_mate;
659 int waited = 1;
660
661 STRLOCKMATES(stp);
662 while (waited) {
663 waited = 0;
664 while (stp->sd_flag & (STWOPEN|STRCLOSE|STRPLUMB)) {
665 mutex_exit(&strmatep->sd_lock);
666 cv_wait(&stp->sd_monitor, &stp->sd_lock);
667 mutex_exit(&stp->sd_lock);
668 STRLOCKMATES(stp);
669 waited = 1;
670 }
671 while (strmatep->sd_flag &
672 (STWOPEN|STRCLOSE|STRPLUMB)) {
673 mutex_exit(&stp->sd_lock);
674 cv_wait(&strmatep->sd_monitor,
675 &strmatep->sd_lock);
676 mutex_exit(&strmatep->sd_lock);
677 STRLOCKMATES(stp);
678 waited = 1;
679 }
680 }
681 stp->sd_flag |= STRCLOSE;
682 STRUNLOCKMATES(stp);
683 } else {
684 mutex_enter(&stp->sd_lock);
685 stp->sd_flag |= STRCLOSE;
686 mutex_exit(&stp->sd_lock);
687 }
688
689 ASSERT(qp->q_first == NULL); /* No more delayed write */
690
691 /* Check if an I_LINK was ever done on this stream */
692 if (stp->sd_flag & STRHASLINKS) {
693 netstack_t *ns;
694 str_stack_t *ss;
695
696 ns = netstack_find_by_cred(crp);
697 ASSERT(ns != NULL);
698 ss = ns->netstack_str;
699 ASSERT(ss != NULL);
700
701 (void) munlinkall(stp, LINKCLOSE|LINKNORMAL, crp, &rval, ss);
702 netstack_rele(ss->ss_netstack);
703 }
704
705 while (_SAMESTR(qp)) {
706 /*
707 * Holding sd_lock prevents q_next from changing in
708 * this stream.
709 */
710 mutex_enter(&stp->sd_lock);
711 if (!(flag & (FNDELAY|FNONBLOCK)) && (stp->sd_closetime > 0)) {
712
713 /*
714 * sleep until awakened by strwsrv() or timeout
715 */
716 for (;;) {
717 mutex_enter(QLOCK(qp->q_next));
718 if (!(qp->q_next->q_mblkcnt)) {
719 mutex_exit(QLOCK(qp->q_next));
720 break;
721 }
722 stp->sd_flag |= WSLEEP;
723
724 /* ensure strwsrv gets enabled */
725 qp->q_next->q_flag |= QWANTW;
726 mutex_exit(QLOCK(qp->q_next));
727 /* get out if we timed out or recv'd a signal */
728 if (str_cv_wait(&qp->q_wait, &stp->sd_lock,
729 stp->sd_closetime, 0) <= 0) {
730 break;
731 }
732 }
733 stp->sd_flag &= ~WSLEEP;
734 }
735 mutex_exit(&stp->sd_lock);
736
737 rmq = qp->q_next;
738 if (rmq->q_flag & QISDRV) {
739 ASSERT(!_SAMESTR(rmq));
740 wait_sq_svc(_RD(qp)->q_syncq);
741 }
742
743 qdetach(_RD(rmq), 1, flag, crp, B_FALSE);
744 }
745
746 /*
747 * Since we call pollwakeup in close() now, the poll list should
748 * be empty in most cases. The only exception is the layered devices
749 * (e.g. the console drivers with redirection modules pushed on top
750 * of it). We have to do this after calling qdetach() because
751 * the redirection module won't have torn down the console
752 * redirection until after qdetach() has been invoked.
753 */
754 if (stp->sd_pollist.ph_list != NULL) {
755 pollwakeup(&stp->sd_pollist, POLLERR);
756 pollhead_clean(&stp->sd_pollist);
757 }
758 ASSERT(stp->sd_pollist.ph_list == NULL);
759 ASSERT(stp->sd_sidp == NULL);
760 ASSERT(stp->sd_pgidp == NULL);
761
762 /* Prevent qenable from re-enabling the stream head queue */
763 disable_svc(_RD(qp));
764
765 /*
766 * Wait until service procedure of each queue is
767 * run, if QINSERVICE is set.
768 */
769 wait_svc(_RD(qp));
770
771 /*
772 * Now, flush both queues.
773 */
774 flushq(_RD(qp), FLUSHALL);
775 flushq(qp, FLUSHALL);
776
777 /*
778 * If the write queue of the stream head is pointing to a
779 * read queue, we have a twisted stream. If the read queue
780 * is alive, convert the stream head queues into a dead end.
781 * If the read queue is dead, free the dead pair.
782 */
783 if (qp->q_next && !_SAMESTR(qp)) {
784 if (qp->q_next->q_qinfo == &deadrend) { /* half-closed pipe */
785 flushq(qp->q_next, FLUSHALL); /* ensure no message */
786 shfree(qp->q_next->q_stream);
787 freeq(qp->q_next);
788 freeq(_RD(qp));
789 } else if (qp->q_next == _RD(qp)) { /* fifo */
790 freeq(_RD(qp));
791 } else { /* pipe */
792 freestp = 0;
793 /*
794 * The q_info pointers are never accessed when
795 * SQLOCK is held.
796 */
797 ASSERT(qp->q_syncq == _RD(qp)->q_syncq);
798 mutex_enter(SQLOCK(qp->q_syncq));
799 qp->q_qinfo = &deadwend;
800 _RD(qp)->q_qinfo = &deadrend;
801 mutex_exit(SQLOCK(qp->q_syncq));
802 }
803 } else {
804 freeq(_RD(qp)); /* free stream head queue pair */
805 }
806
807 mutex_enter(&vp->v_lock);
808 if (stp->sd_iocblk) {
809 if (stp->sd_iocblk != (mblk_t *)-1) {
810 freemsg(stp->sd_iocblk);
811 }
812 stp->sd_iocblk = NULL;
813 }
814 stp->sd_vnode = NULL;
815 vp->v_stream = NULL;
816 mutex_exit(&vp->v_lock);
817 mutex_enter(&stp->sd_lock);
818 freemsg(stp->sd_cmdblk);
819 stp->sd_cmdblk = NULL;
820 stp->sd_flag &= ~STRCLOSE;
821 cv_broadcast(&stp->sd_monitor);
822 mutex_exit(&stp->sd_lock);
823
824 if (freestp)
825 shfree(stp);
826 return (0);
827 }
828
829 static int
830 strsink(queue_t *q, mblk_t *bp)
831 {
832 struct copyresp *resp;
833
834 switch (bp->b_datap->db_type) {
835 case M_FLUSH:
836 if ((*bp->b_rptr & FLUSHW) && !(bp->b_flag & MSGNOLOOP)) {
837 *bp->b_rptr &= ~FLUSHR;
838 bp->b_flag |= MSGNOLOOP;
839 /*
840 * Protect against the driver passing up
841 * messages after it has done a qprocsoff.
842 */
843 if (_OTHERQ(q)->q_next == NULL)
844 freemsg(bp);
845 else
846 qreply(q, bp);
847 } else {
848 freemsg(bp);
849 }
850 break;
851
852 case M_COPYIN:
853 case M_COPYOUT:
854 if (bp->b_cont) {
855 freemsg(bp->b_cont);
856 bp->b_cont = NULL;
857 }
858 bp->b_datap->db_type = M_IOCDATA;
859 bp->b_wptr = bp->b_rptr + sizeof (struct copyresp);
860 resp = (struct copyresp *)bp->b_rptr;
861 resp->cp_rval = (caddr_t)1; /* failure */
862 /*
863 * Protect against the driver passing up
864 * messages after it has done a qprocsoff.
865 */
866 if (_OTHERQ(q)->q_next == NULL)
867 freemsg(bp);
868 else
869 qreply(q, bp);
870 break;
871
872 case M_IOCTL:
873 if (bp->b_cont) {
874 freemsg(bp->b_cont);
875 bp->b_cont = NULL;
876 }
877 bp->b_datap->db_type = M_IOCNAK;
878 /*
879 * Protect against the driver passing up
880 * messages after it has done a qprocsoff.
881 */
882 if (_OTHERQ(q)->q_next == NULL)
883 freemsg(bp);
884 else
885 qreply(q, bp);
886 break;
887
888 default:
889 freemsg(bp);
890 break;
891 }
892
893 return (0);
894 }
895
896 /*
897 * Clean up after a process when it closes a stream. This is called
898 * from closef for all closes, whereas strclose is called only for the
899 * last close on a stream. The siglist is scanned for entries for the
900 * current process, and these are removed.
901 */
902 void
903 strclean(struct vnode *vp)
904 {
905 strsig_t *ssp, *pssp, *tssp;
906 stdata_t *stp;
907 int update = 0;
908
909 TRACE_1(TR_FAC_STREAMS_FR,
910 TR_STRCLEAN, "strclean:%p", vp);
911 stp = vp->v_stream;
912 pssp = NULL;
913 mutex_enter(&stp->sd_lock);
914 ssp = stp->sd_siglist;
915 while (ssp) {
916 if (ssp->ss_pidp == curproc->p_pidp) {
917 tssp = ssp->ss_next;
918 if (pssp)
919 pssp->ss_next = tssp;
920 else
921 stp->sd_siglist = tssp;
922 mutex_enter(&pidlock);
923 PID_RELE(ssp->ss_pidp);
924 mutex_exit(&pidlock);
925 kmem_free(ssp, sizeof (strsig_t));
926 update = 1;
927 ssp = tssp;
928 } else {
929 pssp = ssp;
930 ssp = ssp->ss_next;
931 }
932 }
933 if (update) {
934 stp->sd_sigflags = 0;
935 for (ssp = stp->sd_siglist; ssp; ssp = ssp->ss_next)
936 stp->sd_sigflags |= ssp->ss_events;
937 }
938 mutex_exit(&stp->sd_lock);
939 }
940
941 /*
942 * Used on the last close to remove any remaining items on the siglist.
943 * These could be present on the siglist due to I_ESETSIG calls that
944 * use process groups or processed that do not have an open file descriptor
945 * for this stream (Such entries would not be removed by strclean).
946 */
947 static void
948 strcleanall(struct vnode *vp)
949 {
950 strsig_t *ssp, *nssp;
951 stdata_t *stp;
952
953 stp = vp->v_stream;
954 mutex_enter(&stp->sd_lock);
955 ssp = stp->sd_siglist;
956 stp->sd_siglist = NULL;
957 while (ssp) {
958 nssp = ssp->ss_next;
959 mutex_enter(&pidlock);
960 PID_RELE(ssp->ss_pidp);
961 mutex_exit(&pidlock);
962 kmem_free(ssp, sizeof (strsig_t));
963 ssp = nssp;
964 }
965 stp->sd_sigflags = 0;
966 mutex_exit(&stp->sd_lock);
967 }
968
969 /*
970 * Retrieve the next message from the logical stream head read queue
971 * using either rwnext (if sync stream) or getq_noenab.
972 * It is the callers responsibility to call qbackenable after
973 * it is finished with the message. The caller should not call
974 * qbackenable until after any putback calls to avoid spurious backenabling.
975 */
976 mblk_t *
977 strget(struct stdata *stp, queue_t *q, struct uio *uiop, int first,
978 int *errorp)
979 {
980 mblk_t *bp;
981 int error;
982 ssize_t rbytes = 0;
983
984 /* Holding sd_lock prevents the read queue from changing */
985 ASSERT(MUTEX_HELD(&stp->sd_lock));
986
987 if (uiop != NULL && stp->sd_struiordq != NULL &&
988 q->q_first == NULL &&
989 (!first || (stp->sd_wakeq & RSLEEP))) {
990 /*
991 * Stream supports rwnext() for the read side.
992 * If this is the first time we're called by e.g. strread
993 * only do the downcall if there is a deferred wakeup
994 * (registered in sd_wakeq).
995 */
996 struiod_t uiod;
997
998 if (first)
999 stp->sd_wakeq &= ~RSLEEP;
1000
1001 (void) uiodup(uiop, &uiod.d_uio, uiod.d_iov,
1002 sizeof (uiod.d_iov) / sizeof (*uiod.d_iov));
1003 uiod.d_mp = 0;
1004 /*
1005 * Mark that a thread is in rwnext on the read side
1006 * to prevent strrput from nacking ioctls immediately.
1007 * When the last concurrent rwnext returns
1008 * the ioctls are nack'ed.
1009 */
1010 ASSERT(MUTEX_HELD(&stp->sd_lock));
1011 stp->sd_struiodnak++;
1012 /*
1013 * Note: rwnext will drop sd_lock.
1014 */
1015 error = rwnext(q, &uiod);
1016 ASSERT(MUTEX_NOT_HELD(&stp->sd_lock));
1017 mutex_enter(&stp->sd_lock);
1018 stp->sd_struiodnak--;
1019 while (stp->sd_struiodnak == 0 &&
1020 ((bp = stp->sd_struionak) != NULL)) {
1021 stp->sd_struionak = bp->b_next;
1022 bp->b_next = NULL;
1023 bp->b_datap->db_type = M_IOCNAK;
1024 /*
1025 * Protect against the driver passing up
1026 * messages after it has done a qprocsoff.
1027 */
1028 if (_OTHERQ(q)->q_next == NULL)
1029 freemsg(bp);
1030 else {
1031 mutex_exit(&stp->sd_lock);
1032 qreply(q, bp);
1033 mutex_enter(&stp->sd_lock);
1034 }
1035 }
1036 ASSERT(MUTEX_HELD(&stp->sd_lock));
1037 if (error == 0 || error == EWOULDBLOCK) {
1038 if ((bp = uiod.d_mp) != NULL) {
1039 *errorp = 0;
1040 ASSERT(MUTEX_HELD(&stp->sd_lock));
1041 return (bp);
1042 }
1043 error = 0;
1044 } else if (error == EINVAL) {
1045 /*
1046 * The stream plumbing must have
1047 * changed while we were away, so
1048 * just turn off rwnext()s.
1049 */
1050 error = 0;
1051 } else if (error == EBUSY) {
1052 /*
1053 * The module might have data in transit using putnext
1054 * Fall back on waiting + getq.
1055 */
1056 error = 0;
1057 } else {
1058 *errorp = error;
1059 ASSERT(MUTEX_HELD(&stp->sd_lock));
1060 return (NULL);
1061 }
1062 /*
1063 * Try a getq in case a rwnext() generated mblk
1064 * has bubbled up via strrput().
1065 */
1066 }
1067 *errorp = 0;
1068 ASSERT(MUTEX_HELD(&stp->sd_lock));
1069
1070 /*
1071 * If we have a valid uio, try and use this as a guide for how
1072 * many bytes to retrieve from the queue via getq_noenab().
1073 * Doing this can avoid unneccesary counting of overlong
1074 * messages in putback(). We currently only do this for sockets
1075 * and only if there is no sd_rputdatafunc hook.
1076 *
1077 * The sd_rputdatafunc hook transforms the entire message
1078 * before any bytes in it can be given to a client. So, rbytes
1079 * must be 0 if there is a hook.
1080 */
1081 if ((uiop != NULL) && (stp->sd_vnode->v_type == VSOCK) &&
1082 (stp->sd_rputdatafunc == NULL))
1083 rbytes = uiop->uio_resid;
1084
1085 return (getq_noenab(q, rbytes));
1086 }
1087
1088 /*
1089 * Copy out the message pointed to by `bp' into the uio pointed to by `uiop'.
1090 * If the message does not fit in the uio the remainder of it is returned;
1091 * otherwise NULL is returned. Any embedded zero-length mblk_t's are
1092 * consumed, even if uio_resid reaches zero. On error, `*errorp' is set to
1093 * the error code, the message is consumed, and NULL is returned.
1094 */
1095 static mblk_t *
1096 struiocopyout(mblk_t *bp, struct uio *uiop, int *errorp)
1097 {
1098 int error;
1099 ptrdiff_t n;
1100 mblk_t *nbp;
1101
1102 ASSERT(bp->b_wptr >= bp->b_rptr);
1103
1104 do {
1105 if ((n = MIN(uiop->uio_resid, MBLKL(bp))) != 0) {
1106 ASSERT(n > 0);
1107
1108 error = uiomove(bp->b_rptr, n, UIO_READ, uiop);
1109 if (error != 0) {
1110 freemsg(bp);
1111 *errorp = error;
1112 return (NULL);
1113 }
1114 }
1115
1116 bp->b_rptr += n;
1117 while (bp != NULL && (bp->b_rptr >= bp->b_wptr)) {
1118 nbp = bp;
1119 bp = bp->b_cont;
1120 freeb(nbp);
1121 }
1122 } while (bp != NULL && uiop->uio_resid > 0);
1123
1124 *errorp = 0;
1125 return (bp);
1126 }
1127
1128 /*
1129 * Read a stream according to the mode flags in sd_flag:
1130 *
1131 * (default mode) - Byte stream, msg boundaries are ignored
1132 * RD_MSGDIS (msg discard) - Read on msg boundaries and throw away
1133 * any data remaining in msg
1134 * RD_MSGNODIS (msg non-discard) - Read on msg boundaries and put back
1135 * any remaining data on head of read queue
1136 *
1137 * Consume readable messages on the front of the queue until
1138 * ttolwp(curthread)->lwp_count
1139 * is satisfied, the readable messages are exhausted, or a message
1140 * boundary is reached in a message mode. If no data was read and
1141 * the stream was not opened with the NDELAY flag, block until data arrives.
1142 * Otherwise return the data read and update the count.
1143 *
1144 * In default mode a 0 length message signifies end-of-file and terminates
1145 * a read in progress. The 0 length message is removed from the queue
1146 * only if it is the only message read (no data is read).
1147 *
1148 * An attempt to read an M_PROTO or M_PCPROTO message results in an
1149 * EBADMSG error return, unless either RD_PROTDAT or RD_PROTDIS are set.
1150 * If RD_PROTDAT is set, M_PROTO and M_PCPROTO messages are read as data.
1151 * If RD_PROTDIS is set, the M_PROTO and M_PCPROTO parts of the message
1152 * are unlinked from and M_DATA blocks in the message, the protos are
1153 * thrown away, and the data is read.
1154 */
1155 /* ARGSUSED */
1156 int
1157 strread(struct vnode *vp, struct uio *uiop, cred_t *crp)
1158 {
1159 struct stdata *stp;
1160 mblk_t *bp, *nbp;
1161 queue_t *q;
1162 int error = 0;
1163 uint_t old_sd_flag;
1164 int first;
1165 char rflg;
1166 uint_t mark; /* Contains MSG*MARK and _LASTMARK */
1167 #define _LASTMARK 0x8000 /* Distinct from MSG*MARK */
1168 short delim;
1169 unsigned char pri = 0;
1170 char waitflag;
1171 unsigned char type;
1172
1173 TRACE_1(TR_FAC_STREAMS_FR,
1174 TR_STRREAD_ENTER, "strread:%p", vp);
1175 ASSERT(vp->v_stream);
1176 stp = vp->v_stream;
1177
1178 mutex_enter(&stp->sd_lock);
1179
1180 if ((error = i_straccess(stp, JCREAD)) != 0) {
1181 mutex_exit(&stp->sd_lock);
1182 return (error);
1183 }
1184
1185 if (stp->sd_flag & (STRDERR|STPLEX)) {
1186 error = strgeterr(stp, STRDERR|STPLEX, 0);
1187 if (error != 0) {
1188 mutex_exit(&stp->sd_lock);
1189 return (error);
1190 }
1191 }
1192
1193 /*
1194 * Loop terminates when uiop->uio_resid == 0.
1195 */
1196 rflg = 0;
1197 waitflag = READWAIT;
1198 q = _RD(stp->sd_wrq);
1199 for (;;) {
1200 ASSERT(MUTEX_HELD(&stp->sd_lock));
1201 old_sd_flag = stp->sd_flag;
1202 mark = 0;
1203 delim = 0;
1204 first = 1;
1205 while ((bp = strget(stp, q, uiop, first, &error)) == NULL) {
1206 int done = 0;
1207
1208 ASSERT(MUTEX_HELD(&stp->sd_lock));
1209
1210 if (error != 0)
1211 goto oops;
1212
1213 if (stp->sd_flag & (STRHUP|STREOF)) {
1214 goto oops;
1215 }
1216 if (rflg && !(stp->sd_flag & STRDELIM)) {
1217 goto oops;
1218 }
1219 /*
1220 * If a read(fd,buf,0) has been done, there is no
1221 * need to sleep. We always have zero bytes to
1222 * return.
1223 */
1224 if (uiop->uio_resid == 0) {
1225 goto oops;
1226 }
1227
1228 qbackenable(q, 0);
1229
1230 TRACE_3(TR_FAC_STREAMS_FR, TR_STRREAD_WAIT,
1231 "strread calls strwaitq:%p, %p, %p",
1232 vp, uiop, crp);
1233 if ((error = strwaitq(stp, waitflag, uiop->uio_resid,
1234 uiop->uio_fmode, -1, &done)) != 0 || done) {
1235 TRACE_3(TR_FAC_STREAMS_FR, TR_STRREAD_DONE,
1236 "strread error or done:%p, %p, %p",
1237 vp, uiop, crp);
1238 if ((uiop->uio_fmode & FNDELAY) &&
1239 (stp->sd_flag & OLDNDELAY) &&
1240 (error == EAGAIN))
1241 error = 0;
1242 goto oops;
1243 }
1244 TRACE_3(TR_FAC_STREAMS_FR, TR_STRREAD_AWAKE,
1245 "strread awakes:%p, %p, %p", vp, uiop, crp);
1246 if ((error = i_straccess(stp, JCREAD)) != 0) {
1247 goto oops;
1248 }
1249 first = 0;
1250 }
1251
1252 ASSERT(MUTEX_HELD(&stp->sd_lock));
1253 ASSERT(bp);
1254 pri = bp->b_band;
1255 /*
1256 * Extract any mark information. If the message is not
1257 * completely consumed this information will be put in the mblk
1258 * that is putback.
1259 * If MSGMARKNEXT is set and the message is completely consumed
1260 * the STRATMARK flag will be set below. Likewise, if
1261 * MSGNOTMARKNEXT is set and the message is
1262 * completely consumed STRNOTATMARK will be set.
1263 *
1264 * For some unknown reason strread only breaks the read at the
1265 * last mark.
1266 */
1267 mark = bp->b_flag & (MSGMARK | MSGMARKNEXT | MSGNOTMARKNEXT);
1268 ASSERT((mark & (MSGMARKNEXT|MSGNOTMARKNEXT)) !=
1269 (MSGMARKNEXT|MSGNOTMARKNEXT));
1270 if (mark != 0 && bp == stp->sd_mark) {
1271 if (rflg) {
1272 putback(stp, q, bp, pri);
1273 goto oops;
1274 }
1275 mark |= _LASTMARK;
1276 stp->sd_mark = NULL;
1277 }
1278 if ((stp->sd_flag & STRDELIM) && (bp->b_flag & MSGDELIM))
1279 delim = 1;
1280 mutex_exit(&stp->sd_lock);
1281
1282 if (STREAM_NEEDSERVICE(stp))
1283 stream_runservice(stp);
1284
1285 type = bp->b_datap->db_type;
1286
1287 switch (type) {
1288
1289 case M_DATA:
1290 ismdata:
1291 if (msgnodata(bp)) {
1292 if (mark || delim) {
1293 freemsg(bp);
1294 } else if (rflg) {
1295
1296 /*
1297 * If already read data put zero
1298 * length message back on queue else
1299 * free msg and return 0.
1300 */
1301 bp->b_band = pri;
1302 mutex_enter(&stp->sd_lock);
1303 putback(stp, q, bp, pri);
1304 mutex_exit(&stp->sd_lock);
1305 } else {
1306 freemsg(bp);
1307 }
1308 error = 0;
1309 goto oops1;
1310 }
1311
1312 rflg = 1;
1313 waitflag |= NOINTR;
1314 bp = struiocopyout(bp, uiop, &error);
1315 if (error != 0)
1316 goto oops1;
1317
1318 mutex_enter(&stp->sd_lock);
1319 if (bp) {
1320 /*
1321 * Have remaining data in message.
1322 * Free msg if in discard mode.
1323 */
1324 if (stp->sd_read_opt & RD_MSGDIS) {
1325 freemsg(bp);
1326 } else {
1327 bp->b_band = pri;
1328 if ((mark & _LASTMARK) &&
1329 (stp->sd_mark == NULL))
1330 stp->sd_mark = bp;
1331 bp->b_flag |= mark & ~_LASTMARK;
1332 if (delim)
1333 bp->b_flag |= MSGDELIM;
1334 if (msgnodata(bp))
1335 freemsg(bp);
1336 else
1337 putback(stp, q, bp, pri);
1338 }
1339 } else {
1340 /*
1341 * Consumed the complete message.
1342 * Move the MSG*MARKNEXT information
1343 * to the stream head just in case
1344 * the read queue becomes empty.
1345 *
1346 * If the stream head was at the mark
1347 * (STRATMARK) before we dropped sd_lock above
1348 * and some data was consumed then we have
1349 * moved past the mark thus STRATMARK is
1350 * cleared. However, if a message arrived in
1351 * strrput during the copyout above causing
1352 * STRATMARK to be set we can not clear that
1353 * flag.
1354 */
1355 if (mark &
1356 (MSGMARKNEXT|MSGNOTMARKNEXT|MSGMARK)) {
1357 if (mark & MSGMARKNEXT) {
1358 stp->sd_flag &= ~STRNOTATMARK;
1359 stp->sd_flag |= STRATMARK;
1360 } else if (mark & MSGNOTMARKNEXT) {
1361 stp->sd_flag &= ~STRATMARK;
1362 stp->sd_flag |= STRNOTATMARK;
1363 } else {
1364 stp->sd_flag &=
1365 ~(STRATMARK|STRNOTATMARK);
1366 }
1367 } else if (rflg && (old_sd_flag & STRATMARK)) {
1368 stp->sd_flag &= ~STRATMARK;
1369 }
1370 }
1371
1372 /*
1373 * Check for signal messages at the front of the read
1374 * queue and generate the signal(s) if appropriate.
1375 * The only signal that can be on queue is M_SIG at
1376 * this point.
1377 */
1378 while ((((bp = q->q_first)) != NULL) &&
1379 (bp->b_datap->db_type == M_SIG)) {
1380 bp = getq_noenab(q, 0);
1381 /*
1382 * sd_lock is held so the content of the
1383 * read queue can not change.
1384 */
1385 ASSERT(bp != NULL && DB_TYPE(bp) == M_SIG);
1386 strsignal_nolock(stp, *bp->b_rptr, bp->b_band);
1387 mutex_exit(&stp->sd_lock);
1388 freemsg(bp);
1389 if (STREAM_NEEDSERVICE(stp))
1390 stream_runservice(stp);
1391 mutex_enter(&stp->sd_lock);
1392 }
1393
1394 if ((uiop->uio_resid == 0) || (mark & _LASTMARK) ||
1395 delim ||
1396 (stp->sd_read_opt & (RD_MSGDIS|RD_MSGNODIS))) {
1397 goto oops;
1398 }
1399 continue;
1400
1401 case M_SIG:
1402 strsignal(stp, *bp->b_rptr, (int32_t)bp->b_band);
1403 freemsg(bp);
1404 mutex_enter(&stp->sd_lock);
1405 continue;
1406
1407 case M_PROTO:
1408 case M_PCPROTO:
1409 /*
1410 * Only data messages are readable.
1411 * Any others generate an error, unless
1412 * RD_PROTDIS or RD_PROTDAT is set.
1413 */
1414 if (stp->sd_read_opt & RD_PROTDAT) {
1415 for (nbp = bp; nbp; nbp = nbp->b_next) {
1416 if ((nbp->b_datap->db_type ==
1417 M_PROTO) ||
1418 (nbp->b_datap->db_type ==
1419 M_PCPROTO)) {
1420 nbp->b_datap->db_type = M_DATA;
1421 } else {
1422 break;
1423 }
1424 }
1425 /*
1426 * clear stream head hi pri flag based on
1427 * first message
1428 */
1429 if (type == M_PCPROTO) {
1430 mutex_enter(&stp->sd_lock);
1431 stp->sd_flag &= ~STRPRI;
1432 mutex_exit(&stp->sd_lock);
1433 }
1434 goto ismdata;
1435 } else if (stp->sd_read_opt & RD_PROTDIS) {
1436 /*
1437 * discard non-data messages
1438 */
1439 while (bp &&
1440 ((bp->b_datap->db_type == M_PROTO) ||
1441 (bp->b_datap->db_type == M_PCPROTO))) {
1442 nbp = unlinkb(bp);
1443 freeb(bp);
1444 bp = nbp;
1445 }
1446 /*
1447 * clear stream head hi pri flag based on
1448 * first message
1449 */
1450 if (type == M_PCPROTO) {
1451 mutex_enter(&stp->sd_lock);
1452 stp->sd_flag &= ~STRPRI;
1453 mutex_exit(&stp->sd_lock);
1454 }
1455 if (bp) {
1456 bp->b_band = pri;
1457 goto ismdata;
1458 } else {
1459 break;
1460 }
1461 }
1462 /* FALLTHRU */
1463 case M_PASSFP:
1464 if ((bp->b_datap->db_type == M_PASSFP) &&
1465 (stp->sd_read_opt & RD_PROTDIS)) {
1466 freemsg(bp);
1467 break;
1468 }
1469 mutex_enter(&stp->sd_lock);
1470 putback(stp, q, bp, pri);
1471 mutex_exit(&stp->sd_lock);
1472 if (rflg == 0)
1473 error = EBADMSG;
1474 goto oops1;
1475
1476 default:
1477 /*
1478 * Garbage on stream head read queue.
1479 */
1480 cmn_err(CE_WARN, "bad %x found at stream head\n",
1481 bp->b_datap->db_type);
1482 freemsg(bp);
1483 goto oops1;
1484 }
1485 mutex_enter(&stp->sd_lock);
1486 }
1487 oops:
1488 mutex_exit(&stp->sd_lock);
1489 oops1:
1490 qbackenable(q, pri);
1491 return (error);
1492 #undef _LASTMARK
1493 }
1494
1495 /*
1496 * Default processing of M_PROTO/M_PCPROTO messages.
1497 * Determine which wakeups and signals are needed.
1498 * This can be replaced by a user-specified procedure for kernel users
1499 * of STREAMS.
1500 */
1501 /* ARGSUSED */
1502 mblk_t *
1503 strrput_proto(vnode_t *vp, mblk_t *mp,
1504 strwakeup_t *wakeups, strsigset_t *firstmsgsigs,
1505 strsigset_t *allmsgsigs, strpollset_t *pollwakeups)
1506 {
1507 *wakeups = RSLEEP;
1508 *allmsgsigs = 0;
1509
1510 switch (mp->b_datap->db_type) {
1511 case M_PROTO:
1512 if (mp->b_band == 0) {
1513 *firstmsgsigs = S_INPUT | S_RDNORM;
1514 *pollwakeups = POLLIN | POLLRDNORM;
1515 } else {
1516 *firstmsgsigs = S_INPUT | S_RDBAND;
1517 *pollwakeups = POLLIN | POLLRDBAND;
1518 }
1519 break;
1520 case M_PCPROTO:
1521 *firstmsgsigs = S_HIPRI;
1522 *pollwakeups = POLLPRI;
1523 break;
1524 }
1525 return (mp);
1526 }
1527
1528 /*
1529 * Default processing of everything but M_DATA, M_PROTO, M_PCPROTO and
1530 * M_PASSFP messages.
1531 * Determine which wakeups and signals are needed.
1532 * This can be replaced by a user-specified procedure for kernel users
1533 * of STREAMS.
1534 */
1535 /* ARGSUSED */
1536 mblk_t *
1537 strrput_misc(vnode_t *vp, mblk_t *mp,
1538 strwakeup_t *wakeups, strsigset_t *firstmsgsigs,
1539 strsigset_t *allmsgsigs, strpollset_t *pollwakeups)
1540 {
1541 *wakeups = 0;
1542 *firstmsgsigs = 0;
1543 *allmsgsigs = 0;
1544 *pollwakeups = 0;
1545 return (mp);
1546 }
1547
1548 /*
1549 * Stream read put procedure. Called from downstream driver/module
1550 * with messages for the stream head. Data, protocol, and in-stream
1551 * signal messages are placed on the queue, others are handled directly.
1552 */
1553 int
1554 strrput(queue_t *q, mblk_t *bp)
1555 {
1556 struct stdata *stp;
1557 ulong_t rput_opt;
1558 strwakeup_t wakeups;
1559 strsigset_t firstmsgsigs; /* Signals if first message on queue */
1560 strsigset_t allmsgsigs; /* Signals for all messages */
1561 strsigset_t signals; /* Signals events to generate */
1562 strpollset_t pollwakeups;
1563 mblk_t *nextbp;
1564 uchar_t band = 0;
1565 int hipri_sig;
1566
1567 stp = (struct stdata *)q->q_ptr;
1568 /*
1569 * Use rput_opt for optimized access to the SR_ flags except
1570 * SR_POLLIN. That flag has to be checked under sd_lock since it
1571 * is modified by strpoll().
1572 */
1573 rput_opt = stp->sd_rput_opt;
1574
1575 ASSERT(qclaimed(q));
1576 TRACE_2(TR_FAC_STREAMS_FR, TR_STRRPUT_ENTER,
1577 "strrput called with message type:q %p bp %p", q, bp);
1578
1579 /*
1580 * Perform initial processing and pass to the parameterized functions.
1581 */
1582 ASSERT(bp->b_next == NULL);
1583
1584 switch (bp->b_datap->db_type) {
1585 case M_DATA:
1586 /*
1587 * sockfs is the only consumer of STREOF and when it is set,
1588 * it implies that the receiver is not interested in receiving
1589 * any more data, hence the mblk is freed to prevent unnecessary
1590 * message queueing at the stream head.
1591 */
1592 if (stp->sd_flag == STREOF) {
1593 freemsg(bp);
1594 return (0);
1595 }
1596 if ((rput_opt & SR_IGN_ZEROLEN) &&
1597 bp->b_rptr == bp->b_wptr && msgnodata(bp)) {
1598 /*
1599 * Ignore zero-length M_DATA messages. These might be
1600 * generated by some transports.
1601 * The zero-length M_DATA messages, even if they
1602 * are ignored, should effect the atmark tracking and
1603 * should wake up a thread sleeping in strwaitmark.
1604 */
1605 mutex_enter(&stp->sd_lock);
1606 if (bp->b_flag & MSGMARKNEXT) {
1607 /*
1608 * Record the position of the mark either
1609 * in q_last or in STRATMARK.
1610 */
1611 if (q->q_last != NULL) {
1612 q->q_last->b_flag &= ~MSGNOTMARKNEXT;
1613 q->q_last->b_flag |= MSGMARKNEXT;
1614 } else {
1615 stp->sd_flag &= ~STRNOTATMARK;
1616 stp->sd_flag |= STRATMARK;
1617 }
1618 } else if (bp->b_flag & MSGNOTMARKNEXT) {
1619 /*
1620 * Record that this is not the position of
1621 * the mark either in q_last or in
1622 * STRNOTATMARK.
1623 */
1624 if (q->q_last != NULL) {
1625 q->q_last->b_flag &= ~MSGMARKNEXT;
1626 q->q_last->b_flag |= MSGNOTMARKNEXT;
1627 } else {
1628 stp->sd_flag &= ~STRATMARK;
1629 stp->sd_flag |= STRNOTATMARK;
1630 }
1631 }
1632 if (stp->sd_flag & RSLEEP) {
1633 stp->sd_flag &= ~RSLEEP;
1634 cv_broadcast(&q->q_wait);
1635 }
1636 mutex_exit(&stp->sd_lock);
1637 freemsg(bp);
1638 return (0);
1639 }
1640 wakeups = RSLEEP;
1641 if (bp->b_band == 0) {
1642 firstmsgsigs = S_INPUT | S_RDNORM;
1643 pollwakeups = POLLIN | POLLRDNORM;
1644 } else {
1645 firstmsgsigs = S_INPUT | S_RDBAND;
1646 pollwakeups = POLLIN | POLLRDBAND;
1647 }
1648 if (rput_opt & SR_SIGALLDATA)
1649 allmsgsigs = firstmsgsigs;
1650 else
1651 allmsgsigs = 0;
1652
1653 mutex_enter(&stp->sd_lock);
1654 if ((rput_opt & SR_CONSOL_DATA) &&
1655 (q->q_last != NULL) &&
1656 (bp->b_flag & (MSGMARK|MSGDELIM)) == 0) {
1657 /*
1658 * Consolidate an M_DATA message onto an M_DATA,
1659 * M_PROTO, or M_PCPROTO by merging it with q_last.
1660 * The consolidation does not take place if
1661 * the old message is marked with either of the
1662 * marks or the delim flag or if the new
1663 * message is marked with MSGMARK. The MSGMARK
1664 * check is needed to handle the odd semantics of
1665 * MSGMARK where essentially the whole message
1666 * is to be treated as marked.
1667 * Carry any MSGMARKNEXT and MSGNOTMARKNEXT from the
1668 * new message to the front of the b_cont chain.
1669 */
1670 mblk_t *lbp = q->q_last;
1671 unsigned char db_type = lbp->b_datap->db_type;
1672
1673 if ((db_type == M_DATA || db_type == M_PROTO ||
1674 db_type == M_PCPROTO) &&
1675 !(lbp->b_flag & (MSGDELIM|MSGMARK|MSGMARKNEXT))) {
1676 rmvq_noenab(q, lbp);
1677 /*
1678 * The first message in the b_cont list
1679 * tracks MSGMARKNEXT and MSGNOTMARKNEXT.
1680 * We need to handle the case where we
1681 * are appending:
1682 *
1683 * 1) a MSGMARKNEXT to a MSGNOTMARKNEXT.
1684 * 2) a MSGMARKNEXT to a plain message.
1685 * 3) a MSGNOTMARKNEXT to a plain message
1686 * 4) a MSGNOTMARKNEXT to a MSGNOTMARKNEXT
1687 * message.
1688 *
1689 * Thus we never append a MSGMARKNEXT or
1690 * MSGNOTMARKNEXT to a MSGMARKNEXT message.
1691 */
1692 if (bp->b_flag & MSGMARKNEXT) {
1693 lbp->b_flag |= MSGMARKNEXT;
1694 lbp->b_flag &= ~MSGNOTMARKNEXT;
1695 bp->b_flag &= ~MSGMARKNEXT;
1696 } else if (bp->b_flag & MSGNOTMARKNEXT) {
1697 lbp->b_flag |= MSGNOTMARKNEXT;
1698 bp->b_flag &= ~MSGNOTMARKNEXT;
1699 }
1700
1701 linkb(lbp, bp);
1702 bp = lbp;
1703 /*
1704 * The new message logically isn't the first
1705 * even though the q_first check below thinks
1706 * it is. Clear the firstmsgsigs to make it
1707 * not appear to be first.
1708 */
1709 firstmsgsigs = 0;
1710 }
1711 }
1712 break;
1713
1714 case M_PASSFP:
1715 wakeups = RSLEEP;
1716 allmsgsigs = 0;
1717 if (bp->b_band == 0) {
1718 firstmsgsigs = S_INPUT | S_RDNORM;
1719 pollwakeups = POLLIN | POLLRDNORM;
1720 } else {
1721 firstmsgsigs = S_INPUT | S_RDBAND;
1722 pollwakeups = POLLIN | POLLRDBAND;
1723 }
1724 mutex_enter(&stp->sd_lock);
1725 break;
1726
1727 case M_PROTO:
1728 case M_PCPROTO:
1729 ASSERT(stp->sd_rprotofunc != NULL);
1730 bp = (stp->sd_rprotofunc)(stp->sd_vnode, bp,
1731 &wakeups, &firstmsgsigs, &allmsgsigs, &pollwakeups);
1732 #define ALLSIG (S_INPUT|S_HIPRI|S_OUTPUT|S_MSG|S_ERROR|S_HANGUP|S_RDNORM|\
1733 S_WRNORM|S_RDBAND|S_WRBAND|S_BANDURG)
1734 #define ALLPOLL (POLLIN|POLLPRI|POLLOUT|POLLRDNORM|POLLWRNORM|POLLRDBAND|\
1735 POLLWRBAND)
1736
1737 ASSERT((wakeups & ~(RSLEEP|WSLEEP)) == 0);
1738 ASSERT((firstmsgsigs & ~ALLSIG) == 0);
1739 ASSERT((allmsgsigs & ~ALLSIG) == 0);
1740 ASSERT((pollwakeups & ~ALLPOLL) == 0);
1741
1742 mutex_enter(&stp->sd_lock);
1743 break;
1744
1745 default:
1746 ASSERT(stp->sd_rmiscfunc != NULL);
1747 bp = (stp->sd_rmiscfunc)(stp->sd_vnode, bp,
1748 &wakeups, &firstmsgsigs, &allmsgsigs, &pollwakeups);
1749 ASSERT((wakeups & ~(RSLEEP|WSLEEP)) == 0);
1750 ASSERT((firstmsgsigs & ~ALLSIG) == 0);
1751 ASSERT((allmsgsigs & ~ALLSIG) == 0);
1752 ASSERT((pollwakeups & ~ALLPOLL) == 0);
1753 #undef ALLSIG
1754 #undef ALLPOLL
1755 mutex_enter(&stp->sd_lock);
1756 break;
1757 }
1758 ASSERT(MUTEX_HELD(&stp->sd_lock));
1759
1760 /* By default generate superset of signals */
1761 signals = (firstmsgsigs | allmsgsigs);
1762
1763 /*
1764 * The proto and misc functions can return multiple messages
1765 * as a b_next chain. Such messages are processed separately.
1766 */
1767 one_more:
1768 hipri_sig = 0;
1769 if (bp == NULL) {
1770 nextbp = NULL;
1771 } else {
1772 nextbp = bp->b_next;
1773 bp->b_next = NULL;
1774
1775 switch (bp->b_datap->db_type) {
1776 case M_PCPROTO:
1777 /*
1778 * Only one priority protocol message is allowed at the
1779 * stream head at a time.
1780 */
1781 if (stp->sd_flag & STRPRI) {
1782 TRACE_0(TR_FAC_STREAMS_FR, TR_STRRPUT_PROTERR,
1783 "M_PCPROTO already at head");
1784 freemsg(bp);
1785 mutex_exit(&stp->sd_lock);
1786 goto done;
1787 }
1788 stp->sd_flag |= STRPRI;
1789 hipri_sig = 1;
1790 /* FALLTHRU */
1791 case M_DATA:
1792 case M_PROTO:
1793 case M_PASSFP:
1794 band = bp->b_band;
1795 /*
1796 * Marking doesn't work well when messages
1797 * are marked in more than one band. We only
1798 * remember the last message received, even if
1799 * it is placed on the queue ahead of other
1800 * marked messages.
1801 */
1802 if (bp->b_flag & MSGMARK)
1803 stp->sd_mark = bp;
1804 (void) putq(q, bp);
1805
1806 /*
1807 * If message is a PCPROTO message, always use
1808 * firstmsgsigs to determine if a signal should be
1809 * sent as strrput is the only place to send
1810 * signals for PCPROTO. Other messages are based on
1811 * the STRGETINPROG flag. The flag determines if
1812 * strrput or (k)strgetmsg will be responsible for
1813 * sending the signals, in the firstmsgsigs case.
1814 */
1815 if ((hipri_sig == 1) ||
1816 (((stp->sd_flag & STRGETINPROG) == 0) &&
1817 (q->q_first == bp)))
1818 signals = (firstmsgsigs | allmsgsigs);
1819 else
1820 signals = allmsgsigs;
1821 break;
1822
1823 default:
1824 mutex_exit(&stp->sd_lock);
1825 (void) strrput_nondata(q, bp);
1826 mutex_enter(&stp->sd_lock);
1827 break;
1828 }
1829 }
1830 ASSERT(MUTEX_HELD(&stp->sd_lock));
1831 /*
1832 * Wake sleeping read/getmsg and cancel deferred wakeup
1833 */
1834 if (wakeups & RSLEEP)
1835 stp->sd_wakeq &= ~RSLEEP;
1836
1837 wakeups &= stp->sd_flag;
1838 if (wakeups & RSLEEP) {
1839 stp->sd_flag &= ~RSLEEP;
1840 cv_broadcast(&q->q_wait);
1841 }
1842 if (wakeups & WSLEEP) {
1843 stp->sd_flag &= ~WSLEEP;
1844 cv_broadcast(&_WR(q)->q_wait);
1845 }
1846
1847 if (pollwakeups != 0) {
1848 if (pollwakeups == (POLLIN | POLLRDNORM)) {
1849 /*
1850 * Can't use rput_opt since it was not
1851 * read when sd_lock was held and SR_POLLIN is changed
1852 * by strpoll() under sd_lock.
1853 */
1854 if (!(stp->sd_rput_opt & SR_POLLIN))
1855 goto no_pollwake;
1856 stp->sd_rput_opt &= ~SR_POLLIN;
1857 }
1858 mutex_exit(&stp->sd_lock);
1859 pollwakeup(&stp->sd_pollist, pollwakeups);
1860 mutex_enter(&stp->sd_lock);
1861 }
1862 no_pollwake:
1863
1864 /*
1865 * strsendsig can handle multiple signals with a
1866 * single call.
1867 */
1868 if (stp->sd_sigflags & signals)
1869 strsendsig(stp->sd_siglist, signals, band, 0);
1870 mutex_exit(&stp->sd_lock);
1871
1872
1873 done:
1874 if (nextbp == NULL)
1875 return (0);
1876
1877 /*
1878 * Any signals were handled the first time.
1879 * Wakeups and pollwakeups are redone to avoid any race
1880 * conditions - all the messages are not queued until the
1881 * last message has been processed by strrput.
1882 */
1883 bp = nextbp;
1884 signals = firstmsgsigs = allmsgsigs = 0;
1885 mutex_enter(&stp->sd_lock);
1886 goto one_more;
1887 }
1888
1889 static void
1890 log_dupioc(queue_t *rq, mblk_t *bp)
1891 {
1892 queue_t *wq, *qp;
1893 char *modnames, *mnp, *dname;
1894 size_t maxmodstr;
1895 boolean_t islast;
1896
1897 /*
1898 * Allocate a buffer large enough to hold the names of nstrpush modules
1899 * and one driver, with spaces between and NUL terminator. If we can't
1900 * get memory, then we'll just log the driver name.
1901 */
1902 maxmodstr = nstrpush * (FMNAMESZ + 1);
1903 mnp = modnames = kmem_alloc(maxmodstr, KM_NOSLEEP);
1904
1905 /* march down write side to print log message down to the driver */
1906 wq = WR(rq);
1907
1908 /* make sure q_next doesn't shift around while we're grabbing data */
1909 claimstr(wq);
1910 qp = wq->q_next;
1911 do {
1912 dname = Q2NAME(qp);
1913 islast = !SAMESTR(qp) || qp->q_next == NULL;
1914 if (modnames == NULL) {
1915 /*
1916 * If we don't have memory, then get the driver name in
1917 * the log where we can see it. Note that memory
1918 * pressure is a possible cause of these sorts of bugs.
1919 */
1920 if (islast) {
1921 modnames = dname;
1922 maxmodstr = 0;
1923 }
1924 } else {
1925 mnp += snprintf(mnp, FMNAMESZ + 1, "%s", dname);
1926 if (!islast)
1927 *mnp++ = ' ';
1928 }
1929 qp = qp->q_next;
1930 } while (!islast);
1931 releasestr(wq);
1932 /* Cannot happen unless stream head is corrupt. */
1933 ASSERT(modnames != NULL);
1934 (void) strlog(rq->q_qinfo->qi_minfo->mi_idnum, 0, 1,
1935 SL_CONSOLE|SL_TRACE|SL_ERROR,
1936 "Warning: stream %p received duplicate %X M_IOC%s; module list: %s",
1937 rq->q_ptr, ((struct iocblk *)bp->b_rptr)->ioc_cmd,
1938 (DB_TYPE(bp) == M_IOCACK ? "ACK" : "NAK"), modnames);
1939 if (maxmodstr != 0)
1940 kmem_free(modnames, maxmodstr);
1941 }
1942
1943 int
1944 strrput_nondata(queue_t *q, mblk_t *bp)
1945 {
1946 struct stdata *stp;
1947 struct iocblk *iocbp;
1948 struct stroptions *sop;
1949 struct copyreq *reqp;
1950 struct copyresp *resp;
1951 unsigned char bpri;
1952 unsigned char flushed_already = 0;
1953
1954 stp = (struct stdata *)q->q_ptr;
1955
1956 ASSERT(!(stp->sd_flag & STPLEX));
1957 ASSERT(qclaimed(q));
1958
1959 switch (bp->b_datap->db_type) {
1960 case M_ERROR:
1961 /*
1962 * An error has occurred downstream, the errno is in the first
1963 * bytes of the message.
1964 */
1965 if ((bp->b_wptr - bp->b_rptr) == 2) { /* New flavor */
1966 unsigned char rw = 0;
1967
1968 mutex_enter(&stp->sd_lock);
1969 if (*bp->b_rptr != NOERROR) { /* read error */
1970 if (*bp->b_rptr != 0) {
1971 if (stp->sd_flag & STRDERR)
1972 flushed_already |= FLUSHR;
1973 stp->sd_flag |= STRDERR;
1974 rw |= FLUSHR;
1975 } else {
1976 stp->sd_flag &= ~STRDERR;
1977 }
1978 stp->sd_rerror = *bp->b_rptr;
1979 }
1980 bp->b_rptr++;
1981 if (*bp->b_rptr != NOERROR) { /* write error */
1982 if (*bp->b_rptr != 0) {
1983 if (stp->sd_flag & STWRERR)
1984 flushed_already |= FLUSHW;
1985 stp->sd_flag |= STWRERR;
1986 rw |= FLUSHW;
1987 } else {
1988 stp->sd_flag &= ~STWRERR;
1989 }
1990 stp->sd_werror = *bp->b_rptr;
1991 }
1992 if (rw) {
1993 TRACE_2(TR_FAC_STREAMS_FR, TR_STRRPUT_WAKE,
1994 "strrput cv_broadcast:q %p, bp %p",
1995 q, bp);
1996 cv_broadcast(&q->q_wait); /* readers */
1997 cv_broadcast(&_WR(q)->q_wait); /* writers */
1998 cv_broadcast(&stp->sd_monitor); /* ioctllers */
1999
2000 mutex_exit(&stp->sd_lock);
2001 pollwakeup(&stp->sd_pollist, POLLERR);
2002 mutex_enter(&stp->sd_lock);
2003
2004 if (stp->sd_sigflags & S_ERROR)
2005 strsendsig(stp->sd_siglist, S_ERROR, 0,
2006 ((rw & FLUSHR) ? stp->sd_rerror :
2007 stp->sd_werror));
2008 mutex_exit(&stp->sd_lock);
2009 /*
2010 * Send the M_FLUSH only
2011 * for the first M_ERROR
2012 * message on the stream
2013 */
2014 if (flushed_already == rw) {
2015 freemsg(bp);
2016 return (0);
2017 }
2018
2019 bp->b_datap->db_type = M_FLUSH;
2020 *bp->b_rptr = rw;
2021 bp->b_wptr = bp->b_rptr + 1;
2022 /*
2023 * Protect against the driver
2024 * passing up messages after
2025 * it has done a qprocsoff
2026 */
2027 if (_OTHERQ(q)->q_next == NULL)
2028 freemsg(bp);
2029 else
2030 qreply(q, bp);
2031 return (0);
2032 } else
2033 mutex_exit(&stp->sd_lock);
2034 } else if (*bp->b_rptr != 0) { /* Old flavor */
2035 if (stp->sd_flag & (STRDERR|STWRERR))
2036 flushed_already = FLUSHRW;
2037 mutex_enter(&stp->sd_lock);
2038 stp->sd_flag |= (STRDERR|STWRERR);
2039 stp->sd_rerror = *bp->b_rptr;
2040 stp->sd_werror = *bp->b_rptr;
2041 TRACE_2(TR_FAC_STREAMS_FR,
2042 TR_STRRPUT_WAKE2,
2043 "strrput wakeup #2:q %p, bp %p", q, bp);
2044 cv_broadcast(&q->q_wait); /* the readers */
2045 cv_broadcast(&_WR(q)->q_wait); /* the writers */
2046 cv_broadcast(&stp->sd_monitor); /* ioctllers */
2047
2048 mutex_exit(&stp->sd_lock);
2049 pollwakeup(&stp->sd_pollist, POLLERR);
2050 mutex_enter(&stp->sd_lock);
2051
2052 if (stp->sd_sigflags & S_ERROR)
2053 strsendsig(stp->sd_siglist, S_ERROR, 0,
2054 (stp->sd_werror ? stp->sd_werror :
2055 stp->sd_rerror));
2056 mutex_exit(&stp->sd_lock);
2057
2058 /*
2059 * Send the M_FLUSH only
2060 * for the first M_ERROR
2061 * message on the stream
2062 */
2063 if (flushed_already != FLUSHRW) {
2064 bp->b_datap->db_type = M_FLUSH;
2065 *bp->b_rptr = FLUSHRW;
2066 /*
2067 * Protect against the driver passing up
2068 * messages after it has done a
2069 * qprocsoff.
2070 */
2071 if (_OTHERQ(q)->q_next == NULL)
2072 freemsg(bp);
2073 else
2074 qreply(q, bp);
2075 return (0);
2076 }
2077 }
2078 freemsg(bp);
2079 return (0);
2080
2081 case M_HANGUP:
2082
2083 freemsg(bp);
2084 mutex_enter(&stp->sd_lock);
2085 stp->sd_werror = ENXIO;
2086 stp->sd_flag |= STRHUP;
2087 stp->sd_flag &= ~(WSLEEP|RSLEEP);
2088
2089 /*
2090 * send signal if controlling tty
2091 */
2092
2093 if (stp->sd_sidp) {
2094 prsignal(stp->sd_sidp, SIGHUP);
2095 if (stp->sd_sidp != stp->sd_pgidp)
2096 pgsignal(stp->sd_pgidp, SIGTSTP);
2097 }
2098
2099 /*
2100 * wake up read, write, and exception pollers and
2101 * reset wakeup mechanism.
2102 */
2103 cv_broadcast(&q->q_wait); /* the readers */
2104 cv_broadcast(&_WR(q)->q_wait); /* the writers */
2105 cv_broadcast(&stp->sd_monitor); /* the ioctllers */
2106 strhup(stp);
2107 mutex_exit(&stp->sd_lock);
2108 return (0);
2109
2110 case M_UNHANGUP:
2111 freemsg(bp);
2112 mutex_enter(&stp->sd_lock);
2113 stp->sd_werror = 0;
2114 stp->sd_flag &= ~STRHUP;
2115 mutex_exit(&stp->sd_lock);
2116 return (0);
2117
2118 case M_SIG:
2119 /*
2120 * Someone downstream wants to post a signal. The
2121 * signal to post is contained in the first byte of the
2122 * message. If the message would go on the front of
2123 * the queue, send a signal to the process group
2124 * (if not SIGPOLL) or to the siglist processes
2125 * (SIGPOLL). If something is already on the queue,
2126 * OR if we are delivering a delayed suspend (*sigh*
2127 * another "tty" hack) and there's no one sleeping already,
2128 * just enqueue the message.
2129 */
2130 mutex_enter(&stp->sd_lock);
2131 if (q->q_first || (*bp->b_rptr == SIGTSTP &&
2132 !(stp->sd_flag & RSLEEP))) {
2133 (void) putq(q, bp);
2134 mutex_exit(&stp->sd_lock);
2135 return (0);
2136 }
2137 mutex_exit(&stp->sd_lock);
2138 /* FALLTHRU */
2139
2140 case M_PCSIG:
2141 /*
2142 * Don't enqueue, just post the signal.
2143 */
2144 strsignal(stp, *bp->b_rptr, 0L);
2145 freemsg(bp);
2146 return (0);
2147
2148 case M_CMD:
2149 if (MBLKL(bp) != sizeof (cmdblk_t)) {
2150 freemsg(bp);
2151 return (0);
2152 }
2153
2154 mutex_enter(&stp->sd_lock);
2155 if (stp->sd_flag & STRCMDWAIT) {
2156 ASSERT(stp->sd_cmdblk == NULL);
2157 stp->sd_cmdblk = bp;
2158 cv_broadcast(&stp->sd_monitor);
2159 mutex_exit(&stp->sd_lock);
2160 } else {
2161 mutex_exit(&stp->sd_lock);
2162 freemsg(bp);
2163 }
2164 return (0);
2165
2166 case M_FLUSH:
2167 /*
2168 * Flush queues. The indication of which queues to flush
2169 * is in the first byte of the message. If the read queue
2170 * is specified, then flush it. If FLUSHBAND is set, just
2171 * flush the band specified by the second byte of the message.
2172 *
2173 * If a module has issued a M_SETOPT to not flush hi
2174 * priority messages off of the stream head, then pass this
2175 * flag into the flushq code to preserve such messages.
2176 */
2177
2178 if (*bp->b_rptr & FLUSHR) {
2179 mutex_enter(&stp->sd_lock);
2180 if (*bp->b_rptr & FLUSHBAND) {
2181 ASSERT((bp->b_wptr - bp->b_rptr) >= 2);
2182 flushband(q, *(bp->b_rptr + 1), FLUSHALL);
2183 } else
2184 flushq_common(q, FLUSHALL,
2185 stp->sd_read_opt & RFLUSHPCPROT);
2186 if ((q->q_first == NULL) ||
2187 (q->q_first->b_datap->db_type < QPCTL))
2188 stp->sd_flag &= ~STRPRI;
2189 else {
2190 ASSERT(stp->sd_flag & STRPRI);
2191 }
2192 mutex_exit(&stp->sd_lock);
2193 }
2194 if ((*bp->b_rptr & FLUSHW) && !(bp->b_flag & MSGNOLOOP)) {
2195 *bp->b_rptr &= ~FLUSHR;
2196 bp->b_flag |= MSGNOLOOP;
2197 /*
2198 * Protect against the driver passing up
2199 * messages after it has done a qprocsoff.
2200 */
2201 if (_OTHERQ(q)->q_next == NULL)
2202 freemsg(bp);
2203 else
2204 qreply(q, bp);
2205 return (0);
2206 }
2207 freemsg(bp);
2208 return (0);
2209
2210 case M_IOCACK:
2211 case M_IOCNAK:
2212 iocbp = (struct iocblk *)bp->b_rptr;
2213 /*
2214 * If not waiting for ACK or NAK then just free msg.
2215 * If incorrect id sequence number then just free msg.
2216 * If already have ACK or NAK for user then this is a
2217 * duplicate, display a warning and free the msg.
2218 */
2219 mutex_enter(&stp->sd_lock);
2220 if ((stp->sd_flag & IOCWAIT) == 0 || stp->sd_iocblk ||
2221 (stp->sd_iocid != iocbp->ioc_id)) {
2222 /*
2223 * If the ACK/NAK is a dup, display a message
2224 * Dup is when sd_iocid == ioc_id, and
2225 * sd_iocblk == <valid ptr> or -1 (the former
2226 * is when an ioctl has been put on the stream
2227 * head, but has not yet been consumed, the
2228 * later is when it has been consumed).
2229 */
2230 if ((stp->sd_iocid == iocbp->ioc_id) &&
2231 (stp->sd_iocblk != NULL)) {
2232 log_dupioc(q, bp);
2233 }
2234 freemsg(bp);
2235 mutex_exit(&stp->sd_lock);
2236 return (0);
2237 }
2238
2239 /*
2240 * Assign ACK or NAK to user and wake up.
2241 */
2242 stp->sd_iocblk = bp;
2243 cv_broadcast(&stp->sd_monitor);
2244 mutex_exit(&stp->sd_lock);
2245 return (0);
2246
2247 case M_COPYIN:
2248 case M_COPYOUT:
2249 reqp = (struct copyreq *)bp->b_rptr;
2250
2251 /*
2252 * If not waiting for ACK or NAK then just fail request.
2253 * If already have ACK, NAK, or copy request, then just
2254 * fail request.
2255 * If incorrect id sequence number then just fail request.
2256 */
2257 mutex_enter(&stp->sd_lock);
2258 if ((stp->sd_flag & IOCWAIT) == 0 || stp->sd_iocblk ||
2259 (stp->sd_iocid != reqp->cq_id)) {
2260 if (bp->b_cont) {
2261 freemsg(bp->b_cont);
2262 bp->b_cont = NULL;
2263 }
2264 bp->b_datap->db_type = M_IOCDATA;
2265 bp->b_wptr = bp->b_rptr + sizeof (struct copyresp);
2266 resp = (struct copyresp *)bp->b_rptr;
2267 resp->cp_rval = (caddr_t)1; /* failure */
2268 mutex_exit(&stp->sd_lock);
2269 putnext(stp->sd_wrq, bp);
2270 return (0);
2271 }
2272
2273 /*
2274 * Assign copy request to user and wake up.
2275 */
2276 stp->sd_iocblk = bp;
2277 cv_broadcast(&stp->sd_monitor);
2278 mutex_exit(&stp->sd_lock);
2279 return (0);
2280
2281 case M_SETOPTS:
2282 /*
2283 * Set stream head options (read option, write offset,
2284 * min/max packet size, and/or high/low water marks for
2285 * the read side only).
2286 */
2287
2288 bpri = 0;
2289 sop = (struct stroptions *)bp->b_rptr;
2290 mutex_enter(&stp->sd_lock);
2291 if (sop->so_flags & SO_READOPT) {
2292 switch (sop->so_readopt & RMODEMASK) {
2293 case RNORM:
2294 stp->sd_read_opt &= ~(RD_MSGDIS | RD_MSGNODIS);
2295 break;
2296
2297 case RMSGD:
2298 stp->sd_read_opt =
2299 ((stp->sd_read_opt & ~RD_MSGNODIS) |
2300 RD_MSGDIS);
2301 break;
2302
2303 case RMSGN:
2304 stp->sd_read_opt =
2305 ((stp->sd_read_opt & ~RD_MSGDIS) |
2306 RD_MSGNODIS);
2307 break;
2308 }
2309 switch (sop->so_readopt & RPROTMASK) {
2310 case RPROTNORM:
2311 stp->sd_read_opt &= ~(RD_PROTDAT | RD_PROTDIS);
2312 break;
2313
2314 case RPROTDAT:
2315 stp->sd_read_opt =
2316 ((stp->sd_read_opt & ~RD_PROTDIS) |
2317 RD_PROTDAT);
2318 break;
2319
2320 case RPROTDIS:
2321 stp->sd_read_opt =
2322 ((stp->sd_read_opt & ~RD_PROTDAT) |
2323 RD_PROTDIS);
2324 break;
2325 }
2326 switch (sop->so_readopt & RFLUSHMASK) {
2327 case RFLUSHPCPROT:
2328 /*
2329 * This sets the stream head to NOT flush
2330 * M_PCPROTO messages.
2331 */
2332 stp->sd_read_opt |= RFLUSHPCPROT;
2333 break;
2334 }
2335 }
2336 if (sop->so_flags & SO_ERROPT) {
2337 switch (sop->so_erropt & RERRMASK) {
2338 case RERRNORM:
2339 stp->sd_flag &= ~STRDERRNONPERSIST;
2340 break;
2341 case RERRNONPERSIST:
2342 stp->sd_flag |= STRDERRNONPERSIST;
2343 break;
2344 }
2345 switch (sop->so_erropt & WERRMASK) {
2346 case WERRNORM:
2347 stp->sd_flag &= ~STWRERRNONPERSIST;
2348 break;
2349 case WERRNONPERSIST:
2350 stp->sd_flag |= STWRERRNONPERSIST;
2351 break;
2352 }
2353 }
2354 if (sop->so_flags & SO_COPYOPT) {
2355 if (sop->so_copyopt & ZCVMSAFE) {
2356 stp->sd_copyflag |= STZCVMSAFE;
2357 stp->sd_copyflag &= ~STZCVMUNSAFE;
2358 } else if (sop->so_copyopt & ZCVMUNSAFE) {
2359 stp->sd_copyflag |= STZCVMUNSAFE;
2360 stp->sd_copyflag &= ~STZCVMSAFE;
2361 }
2362
2363 if (sop->so_copyopt & COPYCACHED) {
2364 stp->sd_copyflag |= STRCOPYCACHED;
2365 }
2366 }
2367 if (sop->so_flags & SO_WROFF)
2368 stp->sd_wroff = sop->so_wroff;
2369 if (sop->so_flags & SO_TAIL)
2370 stp->sd_tail = sop->so_tail;
2371 if (sop->so_flags & SO_MINPSZ)
2372 q->q_minpsz = sop->so_minpsz;
2373 if (sop->so_flags & SO_MAXPSZ)
2374 q->q_maxpsz = sop->so_maxpsz;
2375 if (sop->so_flags & SO_MAXBLK)
2376 stp->sd_maxblk = sop->so_maxblk;
2377 if (sop->so_flags & SO_HIWAT) {
2378 if (sop->so_flags & SO_BAND) {
2379 if (strqset(q, QHIWAT,
2380 sop->so_band, sop->so_hiwat)) {
2381 cmn_err(CE_WARN, "strrput: could not "
2382 "allocate qband\n");
2383 } else {
2384 bpri = sop->so_band;
2385 }
2386 } else {
2387 q->q_hiwat = sop->so_hiwat;
2388 }
2389 }
2390 if (sop->so_flags & SO_LOWAT) {
2391 if (sop->so_flags & SO_BAND) {
2392 if (strqset(q, QLOWAT,
2393 sop->so_band, sop->so_lowat)) {
2394 cmn_err(CE_WARN, "strrput: could not "
2395 "allocate qband\n");
2396 } else {
2397 bpri = sop->so_band;
2398 }
2399 } else {
2400 q->q_lowat = sop->so_lowat;
2401 }
2402 }
2403 if (sop->so_flags & SO_MREADON)
2404 stp->sd_flag |= SNDMREAD;
2405 if (sop->so_flags & SO_MREADOFF)
2406 stp->sd_flag &= ~SNDMREAD;
2407 if (sop->so_flags & SO_NDELON)
2408 stp->sd_flag |= OLDNDELAY;
2409 if (sop->so_flags & SO_NDELOFF)
2410 stp->sd_flag &= ~OLDNDELAY;
2411 if (sop->so_flags & SO_ISTTY)
2412 stp->sd_flag |= STRISTTY;
2413 if (sop->so_flags & SO_ISNTTY)
2414 stp->sd_flag &= ~STRISTTY;
2415 if (sop->so_flags & SO_TOSTOP)
2416 stp->sd_flag |= STRTOSTOP;
2417 if (sop->so_flags & SO_TONSTOP)
2418 stp->sd_flag &= ~STRTOSTOP;
2419 if (sop->so_flags & SO_DELIM)
2420 stp->sd_flag |= STRDELIM;
2421 if (sop->so_flags & SO_NODELIM)
2422 stp->sd_flag &= ~STRDELIM;
2423
2424 mutex_exit(&stp->sd_lock);
2425 freemsg(bp);
2426
2427 /* Check backenable in case the water marks changed */
2428 qbackenable(q, bpri);
2429 return (0);
2430
2431 /*
2432 * The following set of cases deal with situations where two stream
2433 * heads are connected to each other (twisted streams). These messages
2434 * have no meaning at the stream head.
2435 */
2436 case M_BREAK:
2437 case M_CTL:
2438 case M_DELAY:
2439 case M_START:
2440 case M_STOP:
2441 case M_IOCDATA:
2442 case M_STARTI:
2443 case M_STOPI:
2444 freemsg(bp);
2445 return (0);
2446
2447 case M_IOCTL:
2448 /*
2449 * Always NAK this condition
2450 * (makes no sense)
2451 * If there is one or more threads in the read side
2452 * rwnext we have to defer the nacking until that thread
2453 * returns (in strget).
2454 */
2455 mutex_enter(&stp->sd_lock);
2456 if (stp->sd_struiodnak != 0) {
2457 /*
2458 * Defer NAK to the streamhead. Queue at the end
2459 * the list.
2460 */
2461 mblk_t *mp = stp->sd_struionak;
2462
2463 while (mp && mp->b_next)
2464 mp = mp->b_next;
2465 if (mp)
2466 mp->b_next = bp;
2467 else
2468 stp->sd_struionak = bp;
2469 bp->b_next = NULL;
2470 mutex_exit(&stp->sd_lock);
2471 return (0);
2472 }
2473 mutex_exit(&stp->sd_lock);
2474
2475 bp->b_datap->db_type = M_IOCNAK;
2476 /*
2477 * Protect against the driver passing up
2478 * messages after it has done a qprocsoff.
2479 */
2480 if (_OTHERQ(q)->q_next == NULL)
2481 freemsg(bp);
2482 else
2483 qreply(q, bp);
2484 return (0);
2485
2486 default:
2487 #ifdef DEBUG
2488 cmn_err(CE_WARN,
2489 "bad message type %x received at stream head\n",
2490 bp->b_datap->db_type);
2491 #endif
2492 freemsg(bp);
2493 return (0);
2494 }
2495
2496 /* NOTREACHED */
2497 }
2498
2499 /*
2500 * Check if the stream pointed to by `stp' can be written to, and return an
2501 * error code if not. If `eiohup' is set, then return EIO if STRHUP is set.
2502 * If `sigpipeok' is set and the SW_SIGPIPE option is enabled on the stream,
2503 * then always return EPIPE and send a SIGPIPE to the invoking thread.
2504 */
2505 static int
2506 strwriteable(struct stdata *stp, boolean_t eiohup, boolean_t sigpipeok)
2507 {
2508 int error;
2509
2510 ASSERT(MUTEX_HELD(&stp->sd_lock));
2511
2512 /*
2513 * For modem support, POSIX states that on writes, EIO should
2514 * be returned if the stream has been hung up.
2515 */
2516 if (eiohup && (stp->sd_flag & (STPLEX|STRHUP)) == STRHUP)
2517 error = EIO;
2518 else
2519 error = strgeterr(stp, STRHUP|STPLEX|STWRERR, 0);
2520
2521 if (error != 0) {
2522 if (!(stp->sd_flag & STPLEX) &&
2523 (stp->sd_wput_opt & SW_SIGPIPE) && sigpipeok) {
2524 tsignal(curthread, SIGPIPE);
2525 error = EPIPE;
2526 }
2527 }
2528
2529 return (error);
2530 }
2531
2532 /*
2533 * Copyin and send data down a stream.
2534 * The caller will allocate and copyin any control part that precedes the
2535 * message and pass that in as mctl.
2536 *
2537 * Caller should *not* hold sd_lock.
2538 * When EWOULDBLOCK is returned the caller has to redo the canputnext
2539 * under sd_lock in order to avoid missing a backenabling wakeup.
2540 *
2541 * Use iosize = -1 to not send any M_DATA. iosize = 0 sends zero-length M_DATA.
2542 *
2543 * Set MSG_IGNFLOW in flags to ignore flow control for hipri messages.
2544 * For sync streams we can only ignore flow control by reverting to using
2545 * putnext.
2546 *
2547 * If sd_maxblk is less than *iosize this routine might return without
2548 * transferring all of *iosize. In all cases, on return *iosize will contain
2549 * the amount of data that was transferred.
2550 */
2551 static int
2552 strput(struct stdata *stp, mblk_t *mctl, struct uio *uiop, ssize_t *iosize,
2553 int b_flag, int pri, int flags)
2554 {
2555 struiod_t uiod;
2556 mblk_t *mp;
2557 queue_t *wqp = stp->sd_wrq;
2558 int error = 0;
2559 ssize_t count = *iosize;
2560
2561 ASSERT(MUTEX_NOT_HELD(&stp->sd_lock));
2562
2563 if (uiop != NULL && count >= 0)
2564 flags |= stp->sd_struiowrq ? STRUIO_POSTPONE : 0;
2565
2566 if (!(flags & STRUIO_POSTPONE)) {
2567 /*
2568 * Use regular canputnext, strmakedata, putnext sequence.
2569 */
2570 if (pri == 0) {
2571 if (!canputnext(wqp) && !(flags & MSG_IGNFLOW)) {
2572 freemsg(mctl);
2573 return (EWOULDBLOCK);
2574 }
2575 } else {
2576 if (!(flags & MSG_IGNFLOW) && !bcanputnext(wqp, pri)) {
2577 freemsg(mctl);
2578 return (EWOULDBLOCK);
2579 }
2580 }
2581
2582 if ((error = strmakedata(iosize, uiop, stp, flags,
2583 &mp)) != 0) {
2584 freemsg(mctl);
2585 /*
2586 * need to change return code to ENOMEM
2587 * so that this is not confused with
2588 * flow control, EAGAIN.
2589 */
2590
2591 if (error == EAGAIN)
2592 return (ENOMEM);
2593 else
2594 return (error);
2595 }
2596 if (mctl != NULL) {
2597 if (mctl->b_cont == NULL)
2598 mctl->b_cont = mp;
2599 else if (mp != NULL)
2600 linkb(mctl, mp);
2601 mp = mctl;
2602 } else if (mp == NULL)
2603 return (0);
2604
2605 mp->b_flag |= b_flag;
2606 mp->b_band = (uchar_t)pri;
2607
2608 if (flags & MSG_IGNFLOW) {
2609 /*
2610 * XXX Hack: Don't get stuck running service
2611 * procedures. This is needed for sockfs when
2612 * sending the unbind message out of the rput
2613 * procedure - we don't want a put procedure
2614 * to run service procedures.
2615 */
2616 putnext(wqp, mp);
2617 } else {
2618 stream_willservice(stp);
2619 putnext(wqp, mp);
2620 stream_runservice(stp);
2621 }
2622 return (0);
2623 }
2624 /*
2625 * Stream supports rwnext() for the write side.
2626 */
2627 if ((error = strmakedata(iosize, uiop, stp, flags, &mp)) != 0) {
2628 freemsg(mctl);
2629 /*
2630 * map EAGAIN to ENOMEM since EAGAIN means "flow controlled".
2631 */
2632 return (error == EAGAIN ? ENOMEM : error);
2633 }
2634 if (mctl != NULL) {
2635 if (mctl->b_cont == NULL)
2636 mctl->b_cont = mp;
2637 else if (mp != NULL)
2638 linkb(mctl, mp);
2639 mp = mctl;
2640 } else if (mp == NULL) {
2641 return (0);
2642 }
2643
2644 mp->b_flag |= b_flag;
2645 mp->b_band = (uchar_t)pri;
2646
2647 (void) uiodup(uiop, &uiod.d_uio, uiod.d_iov,
2648 sizeof (uiod.d_iov) / sizeof (*uiod.d_iov));
2649 uiod.d_uio.uio_offset = 0;
2650 uiod.d_mp = mp;
2651 error = rwnext(wqp, &uiod);
2652 if (! uiod.d_mp) {
2653 uioskip(uiop, *iosize);
2654 return (error);
2655 }
2656 ASSERT(mp == uiod.d_mp);
2657 if (error == EINVAL) {
2658 /*
2659 * The stream plumbing must have changed while
2660 * we were away, so just turn off rwnext()s.
2661 */
2662 error = 0;
2663 } else if (error == EBUSY || error == EWOULDBLOCK) {
2664 /*
2665 * Couldn't enter a perimeter or took a page fault,
2666 * so fall-back to putnext().
2667 */
2668 error = 0;
2669 } else {
2670 freemsg(mp);
2671 return (error);
2672 }
2673 /* Have to check canput before consuming data from the uio */
2674 if (pri == 0) {
2675 if (!canputnext(wqp) && !(flags & MSG_IGNFLOW)) {
2676 freemsg(mp);
2677 return (EWOULDBLOCK);
2678 }
2679 } else {
2680 if (!bcanputnext(wqp, pri) && !(flags & MSG_IGNFLOW)) {
2681 freemsg(mp);
2682 return (EWOULDBLOCK);
2683 }
2684 }
2685 ASSERT(mp == uiod.d_mp);
2686 /* Copyin data from the uio */
2687 if ((error = struioget(wqp, mp, &uiod, 0)) != 0) {
2688 freemsg(mp);
2689 return (error);
2690 }
2691 uioskip(uiop, *iosize);
2692 if (flags & MSG_IGNFLOW) {
2693 /*
2694 * XXX Hack: Don't get stuck running service procedures.
2695 * This is needed for sockfs when sending the unbind message
2696 * out of the rput procedure - we don't want a put procedure
2697 * to run service procedures.
2698 */
2699 putnext(wqp, mp);
2700 } else {
2701 stream_willservice(stp);
2702 putnext(wqp, mp);
2703 stream_runservice(stp);
2704 }
2705 return (0);
2706 }
2707
2708 /*
2709 * Write attempts to break the write request into messages conforming
2710 * with the minimum and maximum packet sizes set downstream.
2711 *
2712 * Write will not block if downstream queue is full and
2713 * O_NDELAY is set, otherwise it will block waiting for the queue to get room.
2714 *
2715 * A write of zero bytes gets packaged into a zero length message and sent
2716 * downstream like any other message.
2717 *
2718 * If buffers of the requested sizes are not available, the write will
2719 * sleep until the buffers become available.
2720 *
2721 * Write (if specified) will supply a write offset in a message if it
2722 * makes sense. This can be specified by downstream modules as part of
2723 * a M_SETOPTS message. Write will not supply the write offset if it
2724 * cannot supply any data in a buffer. In other words, write will never
2725 * send down an empty packet due to a write offset.
2726 */
2727 /* ARGSUSED2 */
2728 int
2729 strwrite(struct vnode *vp, struct uio *uiop, cred_t *crp)
2730 {
2731 return (strwrite_common(vp, uiop, crp, 0));
2732 }
2733
2734 /* ARGSUSED2 */
2735 int
2736 strwrite_common(struct vnode *vp, struct uio *uiop, cred_t *crp, int wflag)
2737 {
2738 struct stdata *stp;
2739 struct queue *wqp;
2740 ssize_t rmin, rmax;
2741 ssize_t iosize;
2742 int waitflag;
2743 int tempmode;
2744 int error = 0;
2745 int b_flag;
2746
2747 ASSERT(vp->v_stream);
2748 stp = vp->v_stream;
2749
2750 mutex_enter(&stp->sd_lock);
2751
2752 if ((error = i_straccess(stp, JCWRITE)) != 0) {
2753 mutex_exit(&stp->sd_lock);
2754 return (error);
2755 }
2756
2757 if (stp->sd_flag & (STWRERR|STRHUP|STPLEX)) {
2758 error = strwriteable(stp, B_TRUE, B_TRUE);
2759 if (error != 0) {
2760 mutex_exit(&stp->sd_lock);
2761 return (error);
2762 }
2763 }
2764
2765 mutex_exit(&stp->sd_lock);
2766
2767 wqp = stp->sd_wrq;
2768
2769 /* get these values from them cached in the stream head */
2770 rmin = stp->sd_qn_minpsz;
2771 rmax = stp->sd_qn_maxpsz;
2772
2773 /*
2774 * Check the min/max packet size constraints. If min packet size
2775 * is non-zero, the write cannot be split into multiple messages
2776 * and still guarantee the size constraints.
2777 */
2778 TRACE_1(TR_FAC_STREAMS_FR, TR_STRWRITE_IN, "strwrite in:q %p", wqp);
2779
2780 ASSERT((rmax >= 0) || (rmax == INFPSZ));
2781 if (rmax == 0) {
2782 return (0);
2783 }
2784 if (rmin > 0) {
2785 if (uiop->uio_resid < rmin) {
2786 TRACE_3(TR_FAC_STREAMS_FR, TR_STRWRITE_OUT,
2787 "strwrite out:q %p out %d error %d",
2788 wqp, 0, ERANGE);
2789 return (ERANGE);
2790 }
2791 if ((rmax != INFPSZ) && (uiop->uio_resid > rmax)) {
2792 TRACE_3(TR_FAC_STREAMS_FR, TR_STRWRITE_OUT,
2793 "strwrite out:q %p out %d error %d",
2794 wqp, 1, ERANGE);
2795 return (ERANGE);
2796 }
2797 }
2798
2799 /*
2800 * Do until count satisfied or error.
2801 */
2802 waitflag = WRITEWAIT | wflag;
2803 if (stp->sd_flag & OLDNDELAY)
2804 tempmode = uiop->uio_fmode & ~FNDELAY;
2805 else
2806 tempmode = uiop->uio_fmode;
2807
2808 if (rmax == INFPSZ)
2809 rmax = uiop->uio_resid;
2810
2811 /*
2812 * Note that tempmode does not get used in strput/strmakedata
2813 * but only in strwaitq. The other routines use uio_fmode
2814 * unmodified.
2815 */
2816
2817 /* LINTED: constant in conditional context */
2818 while (1) { /* breaks when uio_resid reaches zero */
2819 /*
2820 * Determine the size of the next message to be
2821 * packaged. May have to break write into several
2822 * messages based on max packet size.
2823 */
2824 iosize = MIN(uiop->uio_resid, rmax);
2825
2826 /*
2827 * Put block downstream when flow control allows it.
2828 */
2829 if ((stp->sd_flag & STRDELIM) && (uiop->uio_resid == iosize))
2830 b_flag = MSGDELIM;
2831 else
2832 b_flag = 0;
2833
2834 for (;;) {
2835 int done = 0;
2836
2837 error = strput(stp, NULL, uiop, &iosize, b_flag, 0, 0);
2838 if (error == 0)
2839 break;
2840 if (error != EWOULDBLOCK)
2841 goto out;
2842
2843 mutex_enter(&stp->sd_lock);
2844 /*
2845 * Check for a missed wakeup.
2846 * Needed since strput did not hold sd_lock across
2847 * the canputnext.
2848 */
2849 if (canputnext(wqp)) {
2850 /* Try again */
2851 mutex_exit(&stp->sd_lock);
2852 continue;
2853 }
2854 TRACE_1(TR_FAC_STREAMS_FR, TR_STRWRITE_WAIT,
2855 "strwrite wait:q %p wait", wqp);
2856 if ((error = strwaitq(stp, waitflag, (ssize_t)0,
2857 tempmode, -1, &done)) != 0 || done) {
2858 mutex_exit(&stp->sd_lock);
2859 if ((vp->v_type == VFIFO) &&
2860 (uiop->uio_fmode & FNDELAY) &&
2861 (error == EAGAIN))
2862 error = 0;
2863 goto out;
2864 }
2865 TRACE_1(TR_FAC_STREAMS_FR, TR_STRWRITE_WAKE,
2866 "strwrite wake:q %p awakes", wqp);
2867 if ((error = i_straccess(stp, JCWRITE)) != 0) {
2868 mutex_exit(&stp->sd_lock);
2869 goto out;
2870 }
2871 mutex_exit(&stp->sd_lock);
2872 }
2873 waitflag |= NOINTR;
2874 TRACE_2(TR_FAC_STREAMS_FR, TR_STRWRITE_RESID,
2875 "strwrite resid:q %p uiop %p", wqp, uiop);
2876 if (uiop->uio_resid) {
2877 /* Recheck for errors - needed for sockets */
2878 if ((stp->sd_wput_opt & SW_RECHECK_ERR) &&
2879 (stp->sd_flag & (STWRERR|STRHUP|STPLEX))) {
2880 mutex_enter(&stp->sd_lock);
2881 error = strwriteable(stp, B_FALSE, B_TRUE);
2882 mutex_exit(&stp->sd_lock);
2883 if (error != 0)
2884 return (error);
2885 }
2886 continue;
2887 }
2888 break;
2889 }
2890 out:
2891 /*
2892 * For historical reasons, applications expect EAGAIN when a data
2893 * mblk_t cannot be allocated, so change ENOMEM back to EAGAIN.
2894 */
2895 if (error == ENOMEM)
2896 error = EAGAIN;
2897 TRACE_3(TR_FAC_STREAMS_FR, TR_STRWRITE_OUT,
2898 "strwrite out:q %p out %d error %d", wqp, 2, error);
2899 return (error);
2900 }
2901
2902 /*
2903 * Stream head write service routine.
2904 * Its job is to wake up any sleeping writers when a queue
2905 * downstream needs data (part of the flow control in putq and getq).
2906 * It also must wake anyone sleeping on a poll().
2907 * For stream head right below mux module, it must also invoke put procedure
2908 * of next downstream module.
2909 */
2910 int
2911 strwsrv(queue_t *q)
2912 {
2913 struct stdata *stp;
2914 queue_t *tq;
2915 qband_t *qbp;
2916 int i;
2917 qband_t *myqbp;
2918 int isevent;
2919 unsigned char qbf[NBAND]; /* band flushing backenable flags */
2920
2921 TRACE_1(TR_FAC_STREAMS_FR,
2922 TR_STRWSRV, "strwsrv:q %p", q);
2923 stp = (struct stdata *)q->q_ptr;
2924 ASSERT(qclaimed(q));
2925 mutex_enter(&stp->sd_lock);
2926 ASSERT(!(stp->sd_flag & STPLEX));
2927
2928 if (stp->sd_flag & WSLEEP) {
2929 stp->sd_flag &= ~WSLEEP;
2930 cv_broadcast(&q->q_wait);
2931 }
2932 mutex_exit(&stp->sd_lock);
2933
2934 /* The other end of a stream pipe went away. */
2935 if ((tq = q->q_next) == NULL) {
2936 return (0);
2937 }
2938
2939 /* Find the next module forward that has a service procedure */
2940 claimstr(q);
2941 tq = q->q_nfsrv;
2942 ASSERT(tq != NULL);
2943
2944 if ((q->q_flag & QBACK)) {
2945 if ((tq->q_flag & QFULL)) {
2946 mutex_enter(QLOCK(tq));
2947 if (!(tq->q_flag & QFULL)) {
2948 mutex_exit(QLOCK(tq));
2949 goto wakeup;
2950 }
2951 /*
2952 * The queue must have become full again. Set QWANTW
2953 * again so strwsrv will be back enabled when
2954 * the queue becomes non-full next time.
2955 */
2956 tq->q_flag |= QWANTW;
2957 mutex_exit(QLOCK(tq));
2958 } else {
2959 wakeup:
2960 pollwakeup(&stp->sd_pollist, POLLWRNORM);
2961 mutex_enter(&stp->sd_lock);
2962 if (stp->sd_sigflags & S_WRNORM)
2963 strsendsig(stp->sd_siglist, S_WRNORM, 0, 0);
2964 mutex_exit(&stp->sd_lock);
2965 }
2966 }
2967
2968 isevent = 0;
2969 i = 1;
2970 bzero((caddr_t)qbf, NBAND);
2971 mutex_enter(QLOCK(tq));
2972 if ((myqbp = q->q_bandp) != NULL)
2973 for (qbp = tq->q_bandp; qbp && myqbp; qbp = qbp->qb_next) {
2974 ASSERT(myqbp);
2975 if ((myqbp->qb_flag & QB_BACK)) {
2976 if (qbp->qb_flag & QB_FULL) {
2977 /*
2978 * The band must have become full again.
2979 * Set QB_WANTW again so strwsrv will
2980 * be back enabled when the band becomes
2981 * non-full next time.
2982 */
2983 qbp->qb_flag |= QB_WANTW;
2984 } else {
2985 isevent = 1;
2986 qbf[i] = 1;
2987 }
2988 }
2989 myqbp = myqbp->qb_next;
2990 i++;
2991 }
2992 mutex_exit(QLOCK(tq));
2993
2994 if (isevent) {
2995 for (i = tq->q_nband; i; i--) {
2996 if (qbf[i]) {
2997 pollwakeup(&stp->sd_pollist, POLLWRBAND);
2998 mutex_enter(&stp->sd_lock);
2999 if (stp->sd_sigflags & S_WRBAND)
3000 strsendsig(stp->sd_siglist, S_WRBAND,
3001 (uchar_t)i, 0);
3002 mutex_exit(&stp->sd_lock);
3003 }
3004 }
3005 }
3006
3007 releasestr(q);
3008 return (0);
3009 }
3010
3011 /*
3012 * Special case of strcopyin/strcopyout for copying
3013 * struct strioctl that can deal with both data
3014 * models.
3015 */
3016
3017 #ifdef _LP64
3018
3019 static int
3020 strcopyin_strioctl(void *from, void *to, int flag, int copyflag)
3021 {
3022 struct strioctl32 strioc32;
3023 struct strioctl *striocp;
3024
3025 if (copyflag & U_TO_K) {
3026 ASSERT((copyflag & K_TO_K) == 0);
3027
3028 if ((flag & FMODELS) == DATAMODEL_ILP32) {
3029 if (copyin(from, &strioc32, sizeof (strioc32)))
3030 return (EFAULT);
3031
3032 striocp = (struct strioctl *)to;
3033 striocp->ic_cmd = strioc32.ic_cmd;
3034 striocp->ic_timout = strioc32.ic_timout;
3035 striocp->ic_len = strioc32.ic_len;
3036 striocp->ic_dp = (char *)(uintptr_t)strioc32.ic_dp;
3037
3038 } else { /* NATIVE data model */
3039 if (copyin(from, to, sizeof (struct strioctl))) {
3040 return (EFAULT);
3041 } else {
3042 return (0);
3043 }
3044 }
3045 } else {
3046 ASSERT(copyflag & K_TO_K);
3047 bcopy(from, to, sizeof (struct strioctl));
3048 }
3049 return (0);
3050 }
3051
3052 static int
3053 strcopyout_strioctl(void *from, void *to, int flag, int copyflag)
3054 {
3055 struct strioctl32 strioc32;
3056 struct strioctl *striocp;
3057
3058 if (copyflag & U_TO_K) {
3059 ASSERT((copyflag & K_TO_K) == 0);
3060
3061 if ((flag & FMODELS) == DATAMODEL_ILP32) {
3062 striocp = (struct strioctl *)from;
3063 strioc32.ic_cmd = striocp->ic_cmd;
3064 strioc32.ic_timout = striocp->ic_timout;
3065 strioc32.ic_len = striocp->ic_len;
3066 strioc32.ic_dp = (caddr32_t)(uintptr_t)striocp->ic_dp;
3067 ASSERT((char *)(uintptr_t)strioc32.ic_dp ==
3068 striocp->ic_dp);
3069
3070 if (copyout(&strioc32, to, sizeof (strioc32)))
3071 return (EFAULT);
3072
3073 } else { /* NATIVE data model */
3074 if (copyout(from, to, sizeof (struct strioctl))) {
3075 return (EFAULT);
3076 } else {
3077 return (0);
3078 }
3079 }
3080 } else {
3081 ASSERT(copyflag & K_TO_K);
3082 bcopy(from, to, sizeof (struct strioctl));
3083 }
3084 return (0);
3085 }
3086
3087 #else /* ! _LP64 */
3088
3089 /* ARGSUSED2 */
3090 static int
3091 strcopyin_strioctl(void *from, void *to, int flag, int copyflag)
3092 {
3093 return (strcopyin(from, to, sizeof (struct strioctl), copyflag));
3094 }
3095
3096 /* ARGSUSED2 */
3097 static int
3098 strcopyout_strioctl(void *from, void *to, int flag, int copyflag)
3099 {
3100 return (strcopyout(from, to, sizeof (struct strioctl), copyflag));
3101 }
3102
3103 #endif /* _LP64 */
3104
3105 /*
3106 * Determine type of job control semantics expected by user. The
3107 * possibilities are:
3108 * JCREAD - Behaves like read() on fd; send SIGTTIN
3109 * JCWRITE - Behaves like write() on fd; send SIGTTOU if TOSTOP set
3110 * JCSETP - Sets a value in the stream; send SIGTTOU, ignore TOSTOP
3111 * JCGETP - Gets a value in the stream; no signals.
3112 * See straccess in strsubr.c for usage of these values.
3113 *
3114 * This routine also returns -1 for I_STR as a special case; the
3115 * caller must call again with the real ioctl number for
3116 * classification.
3117 */
3118 static int
3119 job_control_type(int cmd)
3120 {
3121 switch (cmd) {
3122 case I_STR:
3123 return (-1);
3124
3125 case I_RECVFD:
3126 case I_E_RECVFD:
3127 return (JCREAD);
3128
3129 case I_FDINSERT:
3130 case I_SENDFD:
3131 return (JCWRITE);
3132
3133 case TCSETA:
3134 case TCSETAW:
3135 case TCSETAF:
3136 case TCSBRK:
3137 case TCXONC:
3138 case TCFLSH:
3139 case TCDSET: /* Obsolete */
3140 case TIOCSWINSZ:
3141 case TCSETS:
3142 case TCSETSW:
3143 case TCSETSF:
3144 case TIOCSETD:
3145 case TIOCHPCL:
3146 case TIOCSETP:
3147 case TIOCSETN:
3148 case TIOCEXCL:
3149 case TIOCNXCL:
3150 case TIOCFLUSH:
3151 case TIOCSETC:
3152 case TIOCLBIS:
3153 case TIOCLBIC:
3154 case TIOCLSET:
3155 case TIOCSBRK:
3156 case TIOCCBRK:
3157 case TIOCSDTR:
3158 case TIOCCDTR:
3159 case TIOCSLTC:
3160 case TIOCSTOP:
3161 case TIOCSTART:
3162 case TIOCSTI:
3163 case TIOCSPGRP:
3164 case TIOCMSET:
3165 case TIOCMBIS:
3166 case TIOCMBIC:
3167 case TIOCREMOTE:
3168 case TIOCSIGNAL:
3169 case LDSETT:
3170 case LDSMAP: /* Obsolete */
3171 case DIOCSETP:
3172 case I_FLUSH:
3173 case I_SRDOPT:
3174 case I_SETSIG:
3175 case I_SWROPT:
3176 case I_FLUSHBAND:
3177 case I_SETCLTIME:
3178 case I_SERROPT:
3179 case I_ESETSIG:
3180 case FIONBIO:
3181 case FIOASYNC:
3182 case FIOSETOWN:
3183 case JBOOT: /* Obsolete */
3184 case JTERM: /* Obsolete */
3185 case JTIMOM: /* Obsolete */
3186 case JZOMBOOT: /* Obsolete */
3187 case JAGENT: /* Obsolete */
3188 case JTRUN: /* Obsolete */
3189 case JXTPROTO: /* Obsolete */
3190 return (JCSETP);
3191 }
3192
3193 return (JCGETP);
3194 }
3195
3196 /*
3197 * ioctl for streams
3198 */
3199 int
3200 strioctl(struct vnode *vp, int cmd, intptr_t arg, int flag, int copyflag,
3201 cred_t *crp, int *rvalp)
3202 {
3203 struct stdata *stp;
3204 struct strcmd *scp;
3205 struct strioctl strioc;
3206 struct uio uio;
3207 struct iovec iov;
3208 int access;
3209 mblk_t *mp;
3210 int error = 0;
3211 int done = 0;
3212 ssize_t rmin, rmax;
3213 queue_t *wrq;
3214 queue_t *rdq;
3215 boolean_t kioctl = B_FALSE;
3216 uint32_t auditing = AU_AUDITING();
3217
3218 if (flag & FKIOCTL) {
3219 copyflag = K_TO_K;
3220 kioctl = B_TRUE;
3221 }
3222 ASSERT(vp->v_stream);
3223 ASSERT(copyflag == U_TO_K || copyflag == K_TO_K);
3224 stp = vp->v_stream;
3225
3226 TRACE_3(TR_FAC_STREAMS_FR, TR_IOCTL_ENTER,
3227 "strioctl:stp %p cmd %X arg %lX", stp, cmd, arg);
3228
3229 /*
3230 * If the copy is kernel to kernel, make sure that the FNATIVE
3231 * flag is set. After this it would be a serious error to have
3232 * no model flag.
3233 */
3234 if (copyflag == K_TO_K)
3235 flag = (flag & ~FMODELS) | FNATIVE;
3236
3237 ASSERT((flag & FMODELS) != 0);
3238
3239 wrq = stp->sd_wrq;
3240 rdq = _RD(wrq);
3241
3242 access = job_control_type(cmd);
3243
3244 /* We should never see these here, should be handled by iwscn */
3245 if (cmd == SRIOCSREDIR || cmd == SRIOCISREDIR)
3246 return (EINVAL);
3247
3248 mutex_enter(&stp->sd_lock);
3249 if ((access != -1) && ((error = i_straccess(stp, access)) != 0)) {
3250 mutex_exit(&stp->sd_lock);
3251 return (error);
3252 }
3253 mutex_exit(&stp->sd_lock);
3254
3255 /*
3256 * Check for sgttyb-related ioctls first, and complain as
3257 * necessary.
3258 */
3259 switch (cmd) {
3260 case TIOCGETP:
3261 case TIOCSETP:
3262 case TIOCSETN:
3263 if (sgttyb_handling >= 2 && !sgttyb_complaint) {
3264 sgttyb_complaint = B_TRUE;
3265 cmn_err(CE_NOTE,
3266 "application used obsolete TIOC[GS]ET");
3267 }
3268 if (sgttyb_handling >= 3) {
3269 tsignal(curthread, SIGSYS);
3270 return (EIO);
3271 }
3272 break;
3273 }
3274
3275 mutex_enter(&stp->sd_lock);
3276
3277 switch (cmd) {
3278 case I_RECVFD:
3279 case I_E_RECVFD:
3280 case I_PEEK:
3281 case I_NREAD:
3282 case FIONREAD:
3283 case FIORDCHK:
3284 case I_ATMARK:
3285 case FIONBIO:
3286 case FIOASYNC:
3287 if (stp->sd_flag & (STRDERR|STPLEX)) {
3288 error = strgeterr(stp, STRDERR|STPLEX, 0);
3289 if (error != 0) {
3290 mutex_exit(&stp->sd_lock);
3291 return (error);
3292 }
3293 }
3294 break;
3295
3296 default:
3297 if (stp->sd_flag & (STRDERR|STWRERR|STPLEX)) {
3298 error = strgeterr(stp, STRDERR|STWRERR|STPLEX, 0);
3299 if (error != 0) {
3300 mutex_exit(&stp->sd_lock);
3301 return (error);
3302 }
3303 }
3304 }
3305
3306 mutex_exit(&stp->sd_lock);
3307
3308 switch (cmd) {
3309 default:
3310 /*
3311 * The stream head has hardcoded knowledge of a
3312 * miscellaneous collection of terminal-, keyboard- and
3313 * mouse-related ioctls, enumerated below. This hardcoded
3314 * knowledge allows the stream head to automatically
3315 * convert transparent ioctl requests made by userland
3316 * programs into I_STR ioctls which many old STREAMS
3317 * modules and drivers require.
3318 *
3319 * No new ioctls should ever be added to this list.
3320 * Instead, the STREAMS module or driver should be written
3321 * to either handle transparent ioctls or require any
3322 * userland programs to use I_STR ioctls (by returning
3323 * EINVAL to any transparent ioctl requests).
3324 *
3325 * More importantly, removing ioctls from this list should
3326 * be done with the utmost care, since our STREAMS modules
3327 * and drivers *count* on the stream head performing this
3328 * conversion, and thus may panic while processing
3329 * transparent ioctl request for one of these ioctls (keep
3330 * in mind that third party modules and drivers may have
3331 * similar problems).
3332 */
3333 if (((cmd & IOCTYPE) == LDIOC) ||
3334 ((cmd & IOCTYPE) == tIOC) ||
3335 ((cmd & IOCTYPE) == TIOC) ||
3336 ((cmd & IOCTYPE) == KIOC) ||
3337 ((cmd & IOCTYPE) == MSIOC) ||
3338 ((cmd & IOCTYPE) == VUIOC)) {
3339 /*
3340 * The ioctl is a tty ioctl - set up strioc buffer
3341 * and call strdoioctl() to do the work.
3342 */
3343 if (stp->sd_flag & STRHUP)
3344 return (ENXIO);
3345 strioc.ic_cmd = cmd;
3346 strioc.ic_timout = INFTIM;
3347
3348 switch (cmd) {
3349
3350 case TCXONC:
3351 case TCSBRK:
3352 case TCFLSH:
3353 case TCDSET:
3354 {
3355 int native_arg = (int)arg;
3356 strioc.ic_len = sizeof (int);
3357 strioc.ic_dp = (char *)&native_arg;
3358 return (strdoioctl(stp, &strioc, flag,
3359 K_TO_K, crp, rvalp));
3360 }
3361
3362 case TCSETA:
3363 case TCSETAW:
3364 case TCSETAF:
3365 strioc.ic_len = sizeof (struct termio);
3366 strioc.ic_dp = (char *)arg;
3367 return (strdoioctl(stp, &strioc, flag,
3368 copyflag, crp, rvalp));
3369
3370 case TCSETS:
3371 case TCSETSW:
3372 case TCSETSF:
3373 strioc.ic_len = sizeof (struct termios);
3374 strioc.ic_dp = (char *)arg;
3375 return (strdoioctl(stp, &strioc, flag,
3376 copyflag, crp, rvalp));
3377
3378 case LDSETT:
3379 strioc.ic_len = sizeof (struct termcb);
3380 strioc.ic_dp = (char *)arg;
3381 return (strdoioctl(stp, &strioc, flag,
3382 copyflag, crp, rvalp));
3383
3384 case TIOCSETP:
3385 strioc.ic_len = sizeof (struct sgttyb);
3386 strioc.ic_dp = (char *)arg;
3387 return (strdoioctl(stp, &strioc, flag,
3388 copyflag, crp, rvalp));
3389
3390 case TIOCSTI:
3391 if ((flag & FREAD) == 0 &&
3392 secpolicy_sti(crp) != 0) {
3393 return (EPERM);
3394 }
3395 mutex_enter(&stp->sd_lock);
3396 mutex_enter(&curproc->p_splock);
3397 if (stp->sd_sidp != curproc->p_sessp->s_sidp &&
3398 secpolicy_sti(crp) != 0) {
3399 mutex_exit(&curproc->p_splock);
3400 mutex_exit(&stp->sd_lock);
3401 return (EACCES);
3402 }
3403 mutex_exit(&curproc->p_splock);
3404 mutex_exit(&stp->sd_lock);
3405
3406 strioc.ic_len = sizeof (char);
3407 strioc.ic_dp = (char *)arg;
3408 return (strdoioctl(stp, &strioc, flag,
3409 copyflag, crp, rvalp));
3410
3411 case TIOCSWINSZ:
3412 strioc.ic_len = sizeof (struct winsize);
3413 strioc.ic_dp = (char *)arg;
3414 return (strdoioctl(stp, &strioc, flag,
3415 copyflag, crp, rvalp));
3416
3417 case TIOCSSIZE:
3418 strioc.ic_len = sizeof (struct ttysize);
3419 strioc.ic_dp = (char *)arg;
3420 return (strdoioctl(stp, &strioc, flag,
3421 copyflag, crp, rvalp));
3422
3423 case TIOCSSOFTCAR:
3424 case KIOCTRANS:
3425 case KIOCTRANSABLE:
3426 case KIOCCMD:
3427 case KIOCSDIRECT:
3428 case KIOCSCOMPAT:
3429 case KIOCSKABORTEN:
3430 case KIOCSRPTDELAY:
3431 case KIOCSRPTRATE:
3432 case VUIDSFORMAT:
3433 case TIOCSPPS:
3434 strioc.ic_len = sizeof (int);
3435 strioc.ic_dp = (char *)arg;
3436 return (strdoioctl(stp, &strioc, flag,
3437 copyflag, crp, rvalp));
3438
3439 case KIOCSETKEY:
3440 case KIOCGETKEY:
3441 strioc.ic_len = sizeof (struct kiockey);
3442 strioc.ic_dp = (char *)arg;
3443 return (strdoioctl(stp, &strioc, flag,
3444 copyflag, crp, rvalp));
3445
3446 case KIOCSKEY:
3447 case KIOCGKEY:
3448 strioc.ic_len = sizeof (struct kiockeymap);
3449 strioc.ic_dp = (char *)arg;
3450 return (strdoioctl(stp, &strioc, flag,
3451 copyflag, crp, rvalp));
3452
3453 case KIOCSLED:
3454 /* arg is a pointer to char */
3455 strioc.ic_len = sizeof (char);
3456 strioc.ic_dp = (char *)arg;
3457 return (strdoioctl(stp, &strioc, flag,
3458 copyflag, crp, rvalp));
3459
3460 case MSIOSETPARMS:
3461 strioc.ic_len = sizeof (Ms_parms);
3462 strioc.ic_dp = (char *)arg;
3463 return (strdoioctl(stp, &strioc, flag,
3464 copyflag, crp, rvalp));
3465
3466 case VUIDSADDR:
3467 case VUIDGADDR:
3468 strioc.ic_len = sizeof (struct vuid_addr_probe);
3469 strioc.ic_dp = (char *)arg;
3470 return (strdoioctl(stp, &strioc, flag,
3471 copyflag, crp, rvalp));
3472
3473 /*
3474 * These M_IOCTL's don't require any data to be sent
3475 * downstream, and the driver will allocate and link
3476 * on its own mblk_t upon M_IOCACK -- thus we set
3477 * ic_len to zero and set ic_dp to arg so we know
3478 * where to copyout to later.
3479 */
3480 case TIOCGSOFTCAR:
3481 case TIOCGWINSZ:
3482 case TIOCGSIZE:
3483 case KIOCGTRANS:
3484 case KIOCGTRANSABLE:
3485 case KIOCTYPE:
3486 case KIOCGDIRECT:
3487 case KIOCGCOMPAT:
3488 case KIOCLAYOUT:
3489 case KIOCGLED:
3490 case MSIOGETPARMS:
3491 case MSIOBUTTONS:
3492 case VUIDGFORMAT:
3493 case TIOCGPPS:
3494 case TIOCGPPSEV:
3495 case TCGETA:
3496 case TCGETS:
3497 case LDGETT:
3498 case TIOCGETP:
3499 case KIOCGRPTDELAY:
3500 case KIOCGRPTRATE:
3501 strioc.ic_len = 0;
3502 strioc.ic_dp = (char *)arg;
3503 return (strdoioctl(stp, &strioc, flag,
3504 copyflag, crp, rvalp));
3505 }
3506 }
3507
3508 /*
3509 * Unknown cmd - send it down as a transparent ioctl.
3510 */
3511 strioc.ic_cmd = cmd;
3512 strioc.ic_timout = INFTIM;
3513 strioc.ic_len = TRANSPARENT;
3514 strioc.ic_dp = (char *)&arg;
3515
3516 return (strdoioctl(stp, &strioc, flag, copyflag, crp, rvalp));
3517
3518 case I_STR:
3519 /*
3520 * Stream ioctl. Read in an strioctl buffer from the user
3521 * along with any data specified and send it downstream.
3522 * Strdoioctl will wait allow only one ioctl message at
3523 * a time, and waits for the acknowledgement.
3524 */
3525
3526 if (stp->sd_flag & STRHUP)
3527 return (ENXIO);
3528
3529 error = strcopyin_strioctl((void *)arg, &strioc, flag,
3530 copyflag);
3531 if (error != 0)
3532 return (error);
3533
3534 if ((strioc.ic_len < 0) || (strioc.ic_timout < -1))
3535 return (EINVAL);
3536
3537 access = job_control_type(strioc.ic_cmd);
3538 mutex_enter(&stp->sd_lock);
3539 if ((access != -1) &&
3540 ((error = i_straccess(stp, access)) != 0)) {
3541 mutex_exit(&stp->sd_lock);
3542 return (error);
3543 }
3544 mutex_exit(&stp->sd_lock);
3545
3546 /*
3547 * The I_STR facility provides a trap door for malicious
3548 * code to send down bogus streamio(7I) ioctl commands to
3549 * unsuspecting STREAMS modules and drivers which expect to
3550 * only get these messages from the stream head.
3551 * Explicitly prohibit any streamio ioctls which can be
3552 * passed downstream by the stream head. Note that we do
3553 * not block all streamio ioctls because the ioctl
3554 * numberspace is not well managed and thus it's possible
3555 * that a module or driver's ioctl numbers may accidentally
3556 * collide with them.
3557 */
3558 switch (strioc.ic_cmd) {
3559 case I_LINK:
3560 case I_PLINK:
3561 case I_UNLINK:
3562 case I_PUNLINK:
3563 case _I_GETPEERCRED:
3564 case _I_PLINK_LH:
3565 return (EINVAL);
3566 }
3567
3568 error = strdoioctl(stp, &strioc, flag, copyflag, crp, rvalp);
3569 if (error == 0) {
3570 error = strcopyout_strioctl(&strioc, (void *)arg,
3571 flag, copyflag);
3572 }
3573 return (error);
3574
3575 case _I_CMD:
3576 /*
3577 * Like I_STR, but without using M_IOC* messages and without
3578 * copyins/copyouts beyond the passed-in argument.
3579 */
3580 if (stp->sd_flag & STRHUP)
3581 return (ENXIO);
3582
3583 if ((scp = kmem_alloc(sizeof (strcmd_t), KM_NOSLEEP)) == NULL)
3584 return (ENOMEM);
3585
3586 if (copyin((void *)arg, scp, sizeof (strcmd_t))) {
3587 kmem_free(scp, sizeof (strcmd_t));
3588 return (EFAULT);
3589 }
3590
3591 access = job_control_type(scp->sc_cmd);
3592 mutex_enter(&stp->sd_lock);
3593 if (access != -1 && (error = i_straccess(stp, access)) != 0) {
3594 mutex_exit(&stp->sd_lock);
3595 kmem_free(scp, sizeof (strcmd_t));
3596 return (error);
3597 }
3598 mutex_exit(&stp->sd_lock);
3599
3600 *rvalp = 0;
3601 if ((error = strdocmd(stp, scp, crp)) == 0) {
3602 if (copyout(scp, (void *)arg, sizeof (strcmd_t)))
3603 error = EFAULT;
3604 }
3605 kmem_free(scp, sizeof (strcmd_t));
3606 return (error);
3607
3608 case I_NREAD:
3609 /*
3610 * Return number of bytes of data in first message
3611 * in queue in "arg" and return the number of messages
3612 * in queue in return value.
3613 */
3614 {
3615 size_t size;
3616 int retval;
3617 int count = 0;
3618
3619 mutex_enter(QLOCK(rdq));
3620
3621 size = msgdsize(rdq->q_first);
3622 for (mp = rdq->q_first; mp != NULL; mp = mp->b_next)
3623 count++;
3624
3625 mutex_exit(QLOCK(rdq));
3626 if (stp->sd_struiordq) {
3627 infod_t infod;
3628
3629 infod.d_cmd = INFOD_COUNT;
3630 infod.d_count = 0;
3631 if (count == 0) {
3632 infod.d_cmd |= INFOD_FIRSTBYTES;
3633 infod.d_bytes = 0;
3634 }
3635 infod.d_res = 0;
3636 (void) infonext(rdq, &infod);
3637 count += infod.d_count;
3638 if (infod.d_res & INFOD_FIRSTBYTES)
3639 size = infod.d_bytes;
3640 }
3641
3642 /*
3643 * Drop down from size_t to the "int" required by the
3644 * interface. Cap at INT_MAX.
3645 */
3646 retval = MIN(size, INT_MAX);
3647 error = strcopyout(&retval, (void *)arg, sizeof (retval),
3648 copyflag);
3649 if (!error)
3650 *rvalp = count;
3651 return (error);
3652 }
3653
3654 case FIONREAD:
3655 /*
3656 * Return number of bytes of data in all data messages
3657 * in queue in "arg".
3658 */
3659 {
3660 size_t size = 0;
3661 int retval;
3662
3663 mutex_enter(QLOCK(rdq));
3664 for (mp = rdq->q_first; mp != NULL; mp = mp->b_next)
3665 size += msgdsize(mp);
3666 mutex_exit(QLOCK(rdq));
3667
3668 if (stp->sd_struiordq) {
3669 infod_t infod;
3670
3671 infod.d_cmd = INFOD_BYTES;
3672 infod.d_res = 0;
3673 infod.d_bytes = 0;
3674 (void) infonext(rdq, &infod);
3675 size += infod.d_bytes;
3676 }
3677
3678 /*
3679 * Drop down from size_t to the "int" required by the
3680 * interface. Cap at INT_MAX.
3681 */
3682 retval = MIN(size, INT_MAX);
3683 error = strcopyout(&retval, (void *)arg, sizeof (retval),
3684 copyflag);
3685
3686 *rvalp = 0;
3687 return (error);
3688 }
3689 case FIORDCHK:
3690 /*
3691 * FIORDCHK does not use arg value (like FIONREAD),
3692 * instead a count is returned. I_NREAD value may
3693 * not be accurate but safe. The real thing to do is
3694 * to add the msgdsizes of all data messages until
3695 * a non-data message.
3696 */
3697 {
3698 size_t size = 0;
3699
3700 mutex_enter(QLOCK(rdq));
3701 for (mp = rdq->q_first; mp != NULL; mp = mp->b_next)
3702 size += msgdsize(mp);
3703 mutex_exit(QLOCK(rdq));
3704
3705 if (stp->sd_struiordq) {
3706 infod_t infod;
3707
3708 infod.d_cmd = INFOD_BYTES;
3709 infod.d_res = 0;
3710 infod.d_bytes = 0;
3711 (void) infonext(rdq, &infod);
3712 size += infod.d_bytes;
3713 }
3714
3715 /*
3716 * Since ioctl returns an int, and memory sizes under
3717 * LP64 may not fit, we return INT_MAX if the count was
3718 * actually greater.
3719 */
3720 *rvalp = MIN(size, INT_MAX);
3721 return (0);
3722 }
3723
3724 case I_FIND:
3725 /*
3726 * Get module name.
3727 */
3728 {
3729 char mname[FMNAMESZ + 1];
3730 queue_t *q;
3731
3732 error = (copyflag & U_TO_K ? copyinstr : copystr)((void *)arg,
3733 mname, FMNAMESZ + 1, NULL);
3734 if (error)
3735 return ((error == ENAMETOOLONG) ? EINVAL : EFAULT);
3736
3737 /*
3738 * Return EINVAL if we're handed a bogus module name.
3739 */
3740 if (fmodsw_find(mname, FMODSW_LOAD) == NULL) {
3741 TRACE_0(TR_FAC_STREAMS_FR,
3742 TR_I_CANT_FIND, "couldn't I_FIND");
3743 return (EINVAL);
3744 }
3745
3746 *rvalp = 0;
3747
3748 /* Look downstream to see if module is there. */
3749 claimstr(stp->sd_wrq);
3750 for (q = stp->sd_wrq->q_next; q; q = q->q_next) {
3751 if (q->q_flag & QREADR) {
3752 q = NULL;
3753 break;
3754 }
3755 if (strcmp(mname, Q2NAME(q)) == 0)
3756 break;
3757 }
3758 releasestr(stp->sd_wrq);
3759
3760 *rvalp = (q ? 1 : 0);
3761 return (error);
3762 }
3763
3764 case I_PUSH:
3765 case __I_PUSH_NOCTTY:
3766 /*
3767 * Push a module.
3768 * For the case __I_PUSH_NOCTTY push a module but
3769 * do not allocate controlling tty. See bugid 4025044
3770 */
3771
3772 {
3773 char mname[FMNAMESZ + 1];
3774 fmodsw_impl_t *fp;
3775 dev_t dummydev;
3776
3777 if (stp->sd_flag & STRHUP)
3778 return (ENXIO);
3779
3780 /*
3781 * Get module name and look up in fmodsw.
3782 */
3783 error = (copyflag & U_TO_K ? copyinstr : copystr)((void *)arg,
3784 mname, FMNAMESZ + 1, NULL);
3785 if (error)
3786 return ((error == ENAMETOOLONG) ? EINVAL : EFAULT);
3787
3788 if ((fp = fmodsw_find(mname, FMODSW_HOLD | FMODSW_LOAD)) ==
3789 NULL)
3790 return (EINVAL);
3791
3792 TRACE_2(TR_FAC_STREAMS_FR, TR_I_PUSH,
3793 "I_PUSH:fp %p stp %p", fp, stp);
3794
3795 if (error = strstartplumb(stp, flag, cmd)) {
3796 fmodsw_rele(fp);
3797 return (error);
3798 }
3799
3800 /*
3801 * See if any more modules can be pushed on this stream.
3802 * Note that this check must be done after strstartplumb()
3803 * since otherwise multiple threads issuing I_PUSHes on
3804 * the same stream will be able to exceed nstrpush.
3805 */
3806 mutex_enter(&stp->sd_lock);
3807 if (stp->sd_pushcnt >= nstrpush) {
3808 fmodsw_rele(fp);
3809 strendplumb(stp);
3810 mutex_exit(&stp->sd_lock);
3811 return (EINVAL);
3812 }
3813 mutex_exit(&stp->sd_lock);
3814
3815 /*
3816 * Push new module and call its open routine
3817 * via qattach(). Modules don't change device
3818 * numbers, so just ignore dummydev here.
3819 */
3820 dummydev = vp->v_rdev;
3821 if ((error = qattach(rdq, &dummydev, 0, crp, fp,
3822 B_FALSE)) == 0) {
3823 if (vp->v_type == VCHR && /* sorry, no pipes allowed */
3824 (cmd == I_PUSH) && (stp->sd_flag & STRISTTY)) {
3825 /*
3826 * try to allocate it as a controlling terminal
3827 */
3828 (void) strctty(stp);
3829 }
3830 }
3831
3832 mutex_enter(&stp->sd_lock);
3833
3834 /*
3835 * As a performance concern we are caching the values of
3836 * q_minpsz and q_maxpsz of the module below the stream
3837 * head in the stream head.
3838 */
3839 mutex_enter(QLOCK(stp->sd_wrq->q_next));
3840 rmin = stp->sd_wrq->q_next->q_minpsz;
3841 rmax = stp->sd_wrq->q_next->q_maxpsz;
3842 mutex_exit(QLOCK(stp->sd_wrq->q_next));
3843
3844 /* Do this processing here as a performance concern */
3845 if (strmsgsz != 0) {
3846 if (rmax == INFPSZ)
3847 rmax = strmsgsz;
3848 else {
3849 if (vp->v_type == VFIFO)
3850 rmax = MIN(PIPE_BUF, rmax);
3851 else rmax = MIN(strmsgsz, rmax);
3852 }
3853 }
3854
3855 mutex_enter(QLOCK(wrq));
3856 stp->sd_qn_minpsz = rmin;
3857 stp->sd_qn_maxpsz = rmax;
3858 mutex_exit(QLOCK(wrq));
3859
3860 strendplumb(stp);
3861 mutex_exit(&stp->sd_lock);
3862 return (error);
3863 }
3864
3865 case I_POP:
3866 {
3867 queue_t *q;
3868
3869 if (stp->sd_flag & STRHUP)
3870 return (ENXIO);
3871 if (!wrq->q_next) /* for broken pipes */
3872 return (EINVAL);
3873
3874 if (error = strstartplumb(stp, flag, cmd))
3875 return (error);
3876
3877 /*
3878 * If there is an anchor on this stream and popping
3879 * the current module would attempt to pop through the
3880 * anchor, then disallow the pop unless we have sufficient
3881 * privileges; take the cheapest (non-locking) check
3882 * first.
3883 */
3884 if (secpolicy_ip_config(crp, B_TRUE) != 0 ||
3885 (stp->sd_anchorzone != crgetzoneid(crp))) {
3886 mutex_enter(&stp->sd_lock);
3887 /*
3888 * Anchors only apply if there's at least one
3889 * module on the stream (sd_pushcnt > 0).
3890 */
3891 if (stp->sd_pushcnt > 0 &&
3892 stp->sd_pushcnt == stp->sd_anchor &&
3893 stp->sd_vnode->v_type != VFIFO) {
3894 strendplumb(stp);
3895 mutex_exit(&stp->sd_lock);
3896 if (stp->sd_anchorzone != crgetzoneid(crp))
3897 return (EINVAL);
3898 /* Audit and report error */
3899 return (secpolicy_ip_config(crp, B_FALSE));
3900 }
3901 mutex_exit(&stp->sd_lock);
3902 }
3903
3904 q = wrq->q_next;
3905 TRACE_2(TR_FAC_STREAMS_FR, TR_I_POP,
3906 "I_POP:%p from %p", q, stp);
3907 if (q->q_next == NULL || (q->q_flag & (QREADR|QISDRV))) {
3908 error = EINVAL;
3909 } else {
3910 qdetach(_RD(q), 1, flag, crp, B_FALSE);
3911 error = 0;
3912 }
3913 mutex_enter(&stp->sd_lock);
3914
3915 /*
3916 * As a performance concern we are caching the values of
3917 * q_minpsz and q_maxpsz of the module below the stream
3918 * head in the stream head.
3919 */
3920 mutex_enter(QLOCK(wrq->q_next));
3921 rmin = wrq->q_next->q_minpsz;
3922 rmax = wrq->q_next->q_maxpsz;
3923 mutex_exit(QLOCK(wrq->q_next));
3924
3925 /* Do this processing here as a performance concern */
3926 if (strmsgsz != 0) {
3927 if (rmax == INFPSZ)
3928 rmax = strmsgsz;
3929 else {
3930 if (vp->v_type == VFIFO)
3931 rmax = MIN(PIPE_BUF, rmax);
3932 else rmax = MIN(strmsgsz, rmax);
3933 }
3934 }
3935
3936 mutex_enter(QLOCK(wrq));
3937 stp->sd_qn_minpsz = rmin;
3938 stp->sd_qn_maxpsz = rmax;
3939 mutex_exit(QLOCK(wrq));
3940
3941 /* If we popped through the anchor, then reset the anchor. */
3942 if (stp->sd_pushcnt < stp->sd_anchor) {
3943 stp->sd_anchor = 0;
3944 stp->sd_anchorzone = 0;
3945 }
3946 strendplumb(stp);
3947 mutex_exit(&stp->sd_lock);
3948 return (error);
3949 }
3950
3951 case _I_MUXID2FD:
3952 {
3953 /*
3954 * Create a fd for a I_PLINK'ed lower stream with a given
3955 * muxid. With the fd, application can send down ioctls,
3956 * like I_LIST, to the previously I_PLINK'ed stream. Note
3957 * that after getting the fd, the application has to do an
3958 * I_PUNLINK on the muxid before it can do any operation
3959 * on the lower stream. This is required by spec1170.
3960 *
3961 * The fd used to do this ioctl should point to the same
3962 * controlling device used to do the I_PLINK. If it uses
3963 * a different stream or an invalid muxid, I_MUXID2FD will
3964 * fail. The error code is set to EINVAL.
3965 *
3966 * The intended use of this interface is the following.
3967 * An application I_PLINK'ed a stream and exits. The fd
3968 * to the lower stream is gone. Another application
3969 * wants to get a fd to the lower stream, it uses I_MUXID2FD.
3970 */
3971 int muxid = (int)arg;
3972 int fd;
3973 linkinfo_t *linkp;
3974 struct file *fp;
3975 netstack_t *ns;
3976 str_stack_t *ss;
3977
3978 /*
3979 * Do not allow the wildcard muxid. This ioctl is not
3980 * intended to find arbitrary link.
3981 */
3982 if (muxid == 0) {
3983 return (EINVAL);
3984 }
3985
3986 ns = netstack_find_by_cred(crp);
3987 ASSERT(ns != NULL);
3988 ss = ns->netstack_str;
3989 ASSERT(ss != NULL);
3990
3991 mutex_enter(&muxifier);
3992 linkp = findlinks(vp->v_stream, muxid, LINKPERSIST, ss);
3993 if (linkp == NULL) {
3994 mutex_exit(&muxifier);
3995 netstack_rele(ss->ss_netstack);
3996 return (EINVAL);
3997 }
3998
3999 if ((fd = ufalloc(0)) == -1) {
4000 mutex_exit(&muxifier);
4001 netstack_rele(ss->ss_netstack);
4002 return (EMFILE);
4003 }
4004 fp = linkp->li_fpdown;
4005 mutex_enter(&fp->f_tlock);
4006 fp->f_count++;
4007 mutex_exit(&fp->f_tlock);
4008 mutex_exit(&muxifier);
4009 setf(fd, fp);
4010 *rvalp = fd;
4011 netstack_rele(ss->ss_netstack);
4012 return (0);
4013 }
4014
4015 case _I_INSERT:
4016 {
4017 /*
4018 * To insert a module to a given position in a stream.
4019 * In the first release, only allow privileged user
4020 * to use this ioctl. Furthermore, the insert is only allowed
4021 * below an anchor if the zoneid is the same as the zoneid
4022 * which created the anchor.
4023 *
4024 * Note that we do not plan to support this ioctl
4025 * on pipes in the first release. We want to learn more
4026 * about the implications of these ioctls before extending
4027 * their support. And we do not think these features are
4028 * valuable for pipes.
4029 */
4030 STRUCT_DECL(strmodconf, strmodinsert);
4031 char mod_name[FMNAMESZ + 1];
4032 fmodsw_impl_t *fp;
4033 dev_t dummydev;
4034 queue_t *tmp_wrq;
4035 int pos;
4036 boolean_t is_insert;
4037
4038 STRUCT_INIT(strmodinsert, flag);
4039 if (stp->sd_flag & STRHUP)
4040 return (ENXIO);
4041 if (STRMATED(stp))
4042 return (EINVAL);
4043 if ((error = secpolicy_net_config(crp, B_FALSE)) != 0)
4044 return (error);
4045 if (stp->sd_anchor != 0 &&
4046 stp->sd_anchorzone != crgetzoneid(crp))
4047 return (EINVAL);
4048
4049 error = strcopyin((void *)arg, STRUCT_BUF(strmodinsert),
4050 STRUCT_SIZE(strmodinsert), copyflag);
4051 if (error)
4052 return (error);
4053
4054 /*
4055 * Get module name and look up in fmodsw.
4056 */
4057 error = (copyflag & U_TO_K ? copyinstr :
4058 copystr)(STRUCT_FGETP(strmodinsert, mod_name),
4059 mod_name, FMNAMESZ + 1, NULL);
4060 if (error)
4061 return ((error == ENAMETOOLONG) ? EINVAL : EFAULT);
4062
4063 if ((fp = fmodsw_find(mod_name, FMODSW_HOLD | FMODSW_LOAD)) ==
4064 NULL)
4065 return (EINVAL);
4066
4067 if (error = strstartplumb(stp, flag, cmd)) {
4068 fmodsw_rele(fp);
4069 return (error);
4070 }
4071
4072 /*
4073 * Is this _I_INSERT just like an I_PUSH? We need to know
4074 * this because we do some optimizations if this is a
4075 * module being pushed.
4076 */
4077 pos = STRUCT_FGET(strmodinsert, pos);
4078 is_insert = (pos != 0);
4079
4080 /*
4081 * Make sure pos is valid. Even though it is not an I_PUSH,
4082 * we impose the same limit on the number of modules in a
4083 * stream.
4084 */
4085 mutex_enter(&stp->sd_lock);
4086 if (stp->sd_pushcnt >= nstrpush || pos < 0 ||
4087 pos > stp->sd_pushcnt) {
4088 fmodsw_rele(fp);
4089 strendplumb(stp);
4090 mutex_exit(&stp->sd_lock);
4091 return (EINVAL);
4092 }
4093 if (stp->sd_anchor != 0) {
4094 /*
4095 * Is this insert below the anchor?
4096 * Pushcnt hasn't been increased yet hence
4097 * we test for greater than here, and greater or
4098 * equal after qattach.
4099 */
4100 if (pos > (stp->sd_pushcnt - stp->sd_anchor) &&
4101 stp->sd_anchorzone != crgetzoneid(crp)) {
4102 fmodsw_rele(fp);
4103 strendplumb(stp);
4104 mutex_exit(&stp->sd_lock);
4105 return (EPERM);
4106 }
4107 }
4108
4109 mutex_exit(&stp->sd_lock);
4110
4111 /*
4112 * First find the correct position this module to
4113 * be inserted. We don't need to call claimstr()
4114 * as the stream should not be changing at this point.
4115 *
4116 * Insert new module and call its open routine
4117 * via qattach(). Modules don't change device
4118 * numbers, so just ignore dummydev here.
4119 */
4120 for (tmp_wrq = stp->sd_wrq; pos > 0;
4121 tmp_wrq = tmp_wrq->q_next, pos--) {
4122 ASSERT(SAMESTR(tmp_wrq));
4123 }
4124 dummydev = vp->v_rdev;
4125 if ((error = qattach(_RD(tmp_wrq), &dummydev, 0, crp,
4126 fp, is_insert)) != 0) {
4127 mutex_enter(&stp->sd_lock);
4128 strendplumb(stp);
4129 mutex_exit(&stp->sd_lock);
4130 return (error);
4131 }
4132
4133 mutex_enter(&stp->sd_lock);
4134
4135 /*
4136 * As a performance concern we are caching the values of
4137 * q_minpsz and q_maxpsz of the module below the stream
4138 * head in the stream head.
4139 */
4140 if (!is_insert) {
4141 mutex_enter(QLOCK(stp->sd_wrq->q_next));
4142 rmin = stp->sd_wrq->q_next->q_minpsz;
4143 rmax = stp->sd_wrq->q_next->q_maxpsz;
4144 mutex_exit(QLOCK(stp->sd_wrq->q_next));
4145
4146 /* Do this processing here as a performance concern */
4147 if (strmsgsz != 0) {
4148 if (rmax == INFPSZ) {
4149 rmax = strmsgsz;
4150 } else {
4151 rmax = MIN(strmsgsz, rmax);
4152 }
4153 }
4154
4155 mutex_enter(QLOCK(wrq));
4156 stp->sd_qn_minpsz = rmin;
4157 stp->sd_qn_maxpsz = rmax;
4158 mutex_exit(QLOCK(wrq));
4159 }
4160
4161 /*
4162 * Need to update the anchor value if this module is
4163 * inserted below the anchor point.
4164 */
4165 if (stp->sd_anchor != 0) {
4166 pos = STRUCT_FGET(strmodinsert, pos);
4167 if (pos >= (stp->sd_pushcnt - stp->sd_anchor))
4168 stp->sd_anchor++;
4169 }
4170
4171 strendplumb(stp);
4172 mutex_exit(&stp->sd_lock);
4173 return (0);
4174 }
4175
4176 case _I_REMOVE:
4177 {
4178 /*
4179 * To remove a module with a given name in a stream. The
4180 * caller of this ioctl needs to provide both the name and
4181 * the position of the module to be removed. This eliminates
4182 * the ambiguity of removal if a module is inserted/pushed
4183 * multiple times in a stream. In the first release, only
4184 * allow privileged user to use this ioctl.
4185 * Furthermore, the remove is only allowed
4186 * below an anchor if the zoneid is the same as the zoneid
4187 * which created the anchor.
4188 *
4189 * Note that we do not plan to support this ioctl
4190 * on pipes in the first release. We want to learn more
4191 * about the implications of these ioctls before extending
4192 * their support. And we do not think these features are
4193 * valuable for pipes.
4194 *
4195 * Also note that _I_REMOVE cannot be used to remove a
4196 * driver or the stream head.
4197 */
4198 STRUCT_DECL(strmodconf, strmodremove);
4199 queue_t *q;
4200 int pos;
4201 char mod_name[FMNAMESZ + 1];
4202 boolean_t is_remove;
4203
4204 STRUCT_INIT(strmodremove, flag);
4205 if (stp->sd_flag & STRHUP)
4206 return (ENXIO);
4207 if (STRMATED(stp))
4208 return (EINVAL);
4209 if ((error = secpolicy_net_config(crp, B_FALSE)) != 0)
4210 return (error);
4211 if (stp->sd_anchor != 0 &&
4212 stp->sd_anchorzone != crgetzoneid(crp))
4213 return (EINVAL);
4214
4215 error = strcopyin((void *)arg, STRUCT_BUF(strmodremove),
4216 STRUCT_SIZE(strmodremove), copyflag);
4217 if (error)
4218 return (error);
4219
4220 error = (copyflag & U_TO_K ? copyinstr :
4221 copystr)(STRUCT_FGETP(strmodremove, mod_name),
4222 mod_name, FMNAMESZ + 1, NULL);
4223 if (error)
4224 return ((error == ENAMETOOLONG) ? EINVAL : EFAULT);
4225
4226 if ((error = strstartplumb(stp, flag, cmd)) != 0)
4227 return (error);
4228
4229 /*
4230 * Match the name of given module to the name of module at
4231 * the given position.
4232 */
4233 pos = STRUCT_FGET(strmodremove, pos);
4234
4235 is_remove = (pos != 0);
4236 for (q = stp->sd_wrq->q_next; SAMESTR(q) && pos > 0;
4237 q = q->q_next, pos--)
4238 ;
4239 if (pos > 0 || !SAMESTR(q) ||
4240 strcmp(Q2NAME(q), mod_name) != 0) {
4241 mutex_enter(&stp->sd_lock);
4242 strendplumb(stp);
4243 mutex_exit(&stp->sd_lock);
4244 return (EINVAL);
4245 }
4246
4247 /*
4248 * If the position is at or below an anchor, then the zoneid
4249 * must match the zoneid that created the anchor.
4250 */
4251 if (stp->sd_anchor != 0) {
4252 pos = STRUCT_FGET(strmodremove, pos);
4253 if (pos >= (stp->sd_pushcnt - stp->sd_anchor) &&
4254 stp->sd_anchorzone != crgetzoneid(crp)) {
4255 mutex_enter(&stp->sd_lock);
4256 strendplumb(stp);
4257 mutex_exit(&stp->sd_lock);
4258 return (EPERM);
4259 }
4260 }
4261
4262
4263 ASSERT(!(q->q_flag & QREADR));
4264 qdetach(_RD(q), 1, flag, crp, is_remove);
4265
4266 mutex_enter(&stp->sd_lock);
4267
4268 /*
4269 * As a performance concern we are caching the values of
4270 * q_minpsz and q_maxpsz of the module below the stream
4271 * head in the stream head.
4272 */
4273 if (!is_remove) {
4274 mutex_enter(QLOCK(wrq->q_next));
4275 rmin = wrq->q_next->q_minpsz;
4276 rmax = wrq->q_next->q_maxpsz;
4277 mutex_exit(QLOCK(wrq->q_next));
4278
4279 /* Do this processing here as a performance concern */
4280 if (strmsgsz != 0) {
4281 if (rmax == INFPSZ)
4282 rmax = strmsgsz;
4283 else {
4284 if (vp->v_type == VFIFO)
4285 rmax = MIN(PIPE_BUF, rmax);
4286 else rmax = MIN(strmsgsz, rmax);
4287 }
4288 }
4289
4290 mutex_enter(QLOCK(wrq));
4291 stp->sd_qn_minpsz = rmin;
4292 stp->sd_qn_maxpsz = rmax;
4293 mutex_exit(QLOCK(wrq));
4294 }
4295
4296 /*
4297 * Need to update the anchor value if this module is removed
4298 * at or below the anchor point. If the removed module is at
4299 * the anchor point, remove the anchor for this stream if
4300 * there is no module above the anchor point. Otherwise, if
4301 * the removed module is below the anchor point, decrement the
4302 * anchor point by 1.
4303 */
4304 if (stp->sd_anchor != 0) {
4305 pos = STRUCT_FGET(strmodremove, pos);
4306 if (pos == stp->sd_pushcnt - stp->sd_anchor + 1)
4307 stp->sd_anchor = 0;
4308 else if (pos > (stp->sd_pushcnt - stp->sd_anchor + 1))
4309 stp->sd_anchor--;
4310 }
4311
4312 strendplumb(stp);
4313 mutex_exit(&stp->sd_lock);
4314 return (0);
4315 }
4316
4317 case I_ANCHOR:
4318 /*
4319 * Set the anchor position on the stream to reside at
4320 * the top module (in other words, the top module
4321 * cannot be popped). Anchors with a FIFO make no
4322 * obvious sense, so they're not allowed.
4323 */
4324 mutex_enter(&stp->sd_lock);
4325
4326 if (stp->sd_vnode->v_type == VFIFO) {
4327 mutex_exit(&stp->sd_lock);
4328 return (EINVAL);
4329 }
4330 /* Only allow the same zoneid to update the anchor */
4331 if (stp->sd_anchor != 0 &&
4332 stp->sd_anchorzone != crgetzoneid(crp)) {
4333 mutex_exit(&stp->sd_lock);
4334 return (EINVAL);
4335 }
4336 stp->sd_anchor = stp->sd_pushcnt;
4337 stp->sd_anchorzone = crgetzoneid(crp);
4338 mutex_exit(&stp->sd_lock);
4339 return (0);
4340
4341 case I_LOOK:
4342 /*
4343 * Get name of first module downstream.
4344 * If no module, return an error.
4345 */
4346 claimstr(wrq);
4347 if (_SAMESTR(wrq) && wrq->q_next->q_next != NULL) {
4348 char *name = Q2NAME(wrq->q_next);
4349
4350 error = strcopyout(name, (void *)arg, strlen(name) + 1,
4351 copyflag);
4352 releasestr(wrq);
4353 return (error);
4354 }
4355 releasestr(wrq);
4356 return (EINVAL);
4357
4358 case I_LINK:
4359 case I_PLINK:
4360 /*
4361 * Link a multiplexor.
4362 */
4363 return (mlink(vp, cmd, (int)arg, crp, rvalp, 0));
4364
4365 case _I_PLINK_LH:
4366 /*
4367 * Link a multiplexor: Call must originate from kernel.
4368 */
4369 if (kioctl)
4370 return (ldi_mlink_lh(vp, cmd, arg, crp, rvalp));
4371
4372 return (EINVAL);
4373 case I_UNLINK:
4374 case I_PUNLINK:
4375 /*
4376 * Unlink a multiplexor.
4377 * If arg is -1, unlink all links for which this is the
4378 * controlling stream. Otherwise, arg is an index number
4379 * for a link to be removed.
4380 */
4381 {
4382 struct linkinfo *linkp;
4383 int native_arg = (int)arg;
4384 int type;
4385 netstack_t *ns;
4386 str_stack_t *ss;
4387
4388 TRACE_1(TR_FAC_STREAMS_FR,
4389 TR_I_UNLINK, "I_UNLINK/I_PUNLINK:%p", stp);
4390 if (vp->v_type == VFIFO) {
4391 return (EINVAL);
4392 }
4393 if (cmd == I_UNLINK)
4394 type = LINKNORMAL;
4395 else /* I_PUNLINK */
4396 type = LINKPERSIST;
4397 if (native_arg == 0) {
4398 return (EINVAL);
4399 }
4400 ns = netstack_find_by_cred(crp);
4401 ASSERT(ns != NULL);
4402 ss = ns->netstack_str;
4403 ASSERT(ss != NULL);
4404
4405 if (native_arg == MUXID_ALL)
4406 error = munlinkall(stp, type, crp, rvalp, ss);
4407 else {
4408 mutex_enter(&muxifier);
4409 if (!(linkp = findlinks(stp, (int)arg, type, ss))) {
4410 /* invalid user supplied index number */
4411 mutex_exit(&muxifier);
4412 netstack_rele(ss->ss_netstack);
4413 return (EINVAL);
4414 }
4415 /* munlink drops the muxifier lock */
4416 error = munlink(stp, linkp, type, crp, rvalp, ss);
4417 }
4418 netstack_rele(ss->ss_netstack);
4419 return (error);
4420 }
4421
4422 case I_FLUSH:
4423 /*
4424 * send a flush message downstream
4425 * flush message can indicate
4426 * FLUSHR - flush read queue
4427 * FLUSHW - flush write queue
4428 * FLUSHRW - flush read/write queue
4429 */
4430 if (stp->sd_flag & STRHUP)
4431 return (ENXIO);
4432 if (arg & ~FLUSHRW)
4433 return (EINVAL);
4434
4435 for (;;) {
4436 if (putnextctl1(stp->sd_wrq, M_FLUSH, (int)arg)) {
4437 break;
4438 }
4439 if (error = strwaitbuf(1, BPRI_HI)) {
4440 return (error);
4441 }
4442 }
4443
4444 /*
4445 * Send down an unsupported ioctl and wait for the nack
4446 * in order to allow the M_FLUSH to propagate back
4447 * up to the stream head.
4448 * Replaces if (qready()) runqueues();
4449 */
4450 strioc.ic_cmd = -1; /* The unsupported ioctl */
4451 strioc.ic_timout = 0;
4452 strioc.ic_len = 0;
4453 strioc.ic_dp = NULL;
4454 (void) strdoioctl(stp, &strioc, flag, K_TO_K, crp, rvalp);
4455 *rvalp = 0;
4456 return (0);
4457
4458 case I_FLUSHBAND:
4459 {
4460 struct bandinfo binfo;
4461
4462 error = strcopyin((void *)arg, &binfo, sizeof (binfo),
4463 copyflag);
4464 if (error)
4465 return (error);
4466 if (stp->sd_flag & STRHUP)
4467 return (ENXIO);
4468 if (binfo.bi_flag & ~FLUSHRW)
4469 return (EINVAL);
4470 while (!(mp = allocb(2, BPRI_HI))) {
4471 if (error = strwaitbuf(2, BPRI_HI))
4472 return (error);
4473 }
4474 mp->b_datap->db_type = M_FLUSH;
4475 *mp->b_wptr++ = binfo.bi_flag | FLUSHBAND;
4476 *mp->b_wptr++ = binfo.bi_pri;
4477 putnext(stp->sd_wrq, mp);
4478 /*
4479 * Send down an unsupported ioctl and wait for the nack
4480 * in order to allow the M_FLUSH to propagate back
4481 * up to the stream head.
4482 * Replaces if (qready()) runqueues();
4483 */
4484 strioc.ic_cmd = -1; /* The unsupported ioctl */
4485 strioc.ic_timout = 0;
4486 strioc.ic_len = 0;
4487 strioc.ic_dp = NULL;
4488 (void) strdoioctl(stp, &strioc, flag, K_TO_K, crp, rvalp);
4489 *rvalp = 0;
4490 return (0);
4491 }
4492
4493 case I_SRDOPT:
4494 /*
4495 * Set read options
4496 *
4497 * RNORM - default stream mode
4498 * RMSGN - message no discard
4499 * RMSGD - message discard
4500 * RPROTNORM - fail read with EBADMSG for M_[PC]PROTOs
4501 * RPROTDAT - convert M_[PC]PROTOs to M_DATAs
4502 * RPROTDIS - discard M_[PC]PROTOs and retain M_DATAs
4503 */
4504 if (arg & ~(RMODEMASK | RPROTMASK))
4505 return (EINVAL);
4506
4507 if ((arg & (RMSGD|RMSGN)) == (RMSGD|RMSGN))
4508 return (EINVAL);
4509
4510 mutex_enter(&stp->sd_lock);
4511 switch (arg & RMODEMASK) {
4512 case RNORM:
4513 stp->sd_read_opt &= ~(RD_MSGDIS | RD_MSGNODIS);
4514 break;
4515 case RMSGD:
4516 stp->sd_read_opt = (stp->sd_read_opt & ~RD_MSGNODIS) |
4517 RD_MSGDIS;
4518 break;
4519 case RMSGN:
4520 stp->sd_read_opt = (stp->sd_read_opt & ~RD_MSGDIS) |
4521 RD_MSGNODIS;
4522 break;
4523 }
4524
4525 switch (arg & RPROTMASK) {
4526 case RPROTNORM:
4527 stp->sd_read_opt &= ~(RD_PROTDAT | RD_PROTDIS);
4528 break;
4529
4530 case RPROTDAT:
4531 stp->sd_read_opt = ((stp->sd_read_opt & ~RD_PROTDIS) |
4532 RD_PROTDAT);
4533 break;
4534
4535 case RPROTDIS:
4536 stp->sd_read_opt = ((stp->sd_read_opt & ~RD_PROTDAT) |
4537 RD_PROTDIS);
4538 break;
4539 }
4540 mutex_exit(&stp->sd_lock);
4541 return (0);
4542
4543 case I_GRDOPT:
4544 /*
4545 * Get read option and return the value
4546 * to spot pointed to by arg
4547 */
4548 {
4549 int rdopt;
4550
4551 rdopt = ((stp->sd_read_opt & RD_MSGDIS) ? RMSGD :
4552 ((stp->sd_read_opt & RD_MSGNODIS) ? RMSGN : RNORM));
4553 rdopt |= ((stp->sd_read_opt & RD_PROTDAT) ? RPROTDAT :
4554 ((stp->sd_read_opt & RD_PROTDIS) ? RPROTDIS : RPROTNORM));
4555
4556 return (strcopyout(&rdopt, (void *)arg, sizeof (int),
4557 copyflag));
4558 }
4559
4560 case I_SERROPT:
4561 /*
4562 * Set error options
4563 *
4564 * RERRNORM - persistent read errors
4565 * RERRNONPERSIST - non-persistent read errors
4566 * WERRNORM - persistent write errors
4567 * WERRNONPERSIST - non-persistent write errors
4568 */
4569 if (arg & ~(RERRMASK | WERRMASK))
4570 return (EINVAL);
4571
4572 mutex_enter(&stp->sd_lock);
4573 switch (arg & RERRMASK) {
4574 case RERRNORM:
4575 stp->sd_flag &= ~STRDERRNONPERSIST;
4576 break;
4577 case RERRNONPERSIST:
4578 stp->sd_flag |= STRDERRNONPERSIST;
4579 break;
4580 }
4581 switch (arg & WERRMASK) {
4582 case WERRNORM:
4583 stp->sd_flag &= ~STWRERRNONPERSIST;
4584 break;
4585 case WERRNONPERSIST:
4586 stp->sd_flag |= STWRERRNONPERSIST;
4587 break;
4588 }
4589 mutex_exit(&stp->sd_lock);
4590 return (0);
4591
4592 case I_GERROPT:
4593 /*
4594 * Get error option and return the value
4595 * to spot pointed to by arg
4596 */
4597 {
4598 int erropt = 0;
4599
4600 erropt |= (stp->sd_flag & STRDERRNONPERSIST) ? RERRNONPERSIST :
4601 RERRNORM;
4602 erropt |= (stp->sd_flag & STWRERRNONPERSIST) ? WERRNONPERSIST :
4603 WERRNORM;
4604 return (strcopyout(&erropt, (void *)arg, sizeof (int),
4605 copyflag));
4606 }
4607
4608 case I_SETSIG:
4609 /*
4610 * Register the calling proc to receive the SIGPOLL
4611 * signal based on the events given in arg. If
4612 * arg is zero, remove the proc from register list.
4613 */
4614 {
4615 strsig_t *ssp, *pssp;
4616 struct pid *pidp;
4617
4618 pssp = NULL;
4619 pidp = curproc->p_pidp;
4620 /*
4621 * Hold sd_lock to prevent traversal of sd_siglist while
4622 * it is modified.
4623 */
4624 mutex_enter(&stp->sd_lock);
4625 for (ssp = stp->sd_siglist; ssp && (ssp->ss_pidp != pidp);
4626 pssp = ssp, ssp = ssp->ss_next)
4627 ;
4628
4629 if (arg) {
4630 if (arg & ~(S_INPUT|S_HIPRI|S_MSG|S_HANGUP|S_ERROR|
4631 S_RDNORM|S_WRNORM|S_RDBAND|S_WRBAND|S_BANDURG)) {
4632 mutex_exit(&stp->sd_lock);
4633 return (EINVAL);
4634 }
4635 if ((arg & S_BANDURG) && !(arg & S_RDBAND)) {
4636 mutex_exit(&stp->sd_lock);
4637 return (EINVAL);
4638 }
4639
4640 /*
4641 * If proc not already registered, add it
4642 * to list.
4643 */
4644 if (!ssp) {
4645 ssp = kmem_alloc(sizeof (strsig_t), KM_SLEEP);
4646 ssp->ss_pidp = pidp;
4647 ssp->ss_pid = pidp->pid_id;
4648 ssp->ss_next = NULL;
4649 if (pssp)
4650 pssp->ss_next = ssp;
4651 else
4652 stp->sd_siglist = ssp;
4653 mutex_enter(&pidlock);
4654 PID_HOLD(pidp);
4655 mutex_exit(&pidlock);
4656 }
4657
4658 /*
4659 * Set events.
4660 */
4661 ssp->ss_events = (int)arg;
4662 } else {
4663 /*
4664 * Remove proc from register list.
4665 */
4666 if (ssp) {
4667 mutex_enter(&pidlock);
4668 PID_RELE(pidp);
4669 mutex_exit(&pidlock);
4670 if (pssp)
4671 pssp->ss_next = ssp->ss_next;
4672 else
4673 stp->sd_siglist = ssp->ss_next;
4674 kmem_free(ssp, sizeof (strsig_t));
4675 } else {
4676 mutex_exit(&stp->sd_lock);
4677 return (EINVAL);
4678 }
4679 }
4680
4681 /*
4682 * Recalculate OR of sig events.
4683 */
4684 stp->sd_sigflags = 0;
4685 for (ssp = stp->sd_siglist; ssp; ssp = ssp->ss_next)
4686 stp->sd_sigflags |= ssp->ss_events;
4687 mutex_exit(&stp->sd_lock);
4688 return (0);
4689 }
4690
4691 case I_GETSIG:
4692 /*
4693 * Return (in arg) the current registration of events
4694 * for which the calling proc is to be signaled.
4695 */
4696 {
4697 struct strsig *ssp;
4698 struct pid *pidp;
4699
4700 pidp = curproc->p_pidp;
4701 mutex_enter(&stp->sd_lock);
4702 for (ssp = stp->sd_siglist; ssp; ssp = ssp->ss_next)
4703 if (ssp->ss_pidp == pidp) {
4704 error = strcopyout(&ssp->ss_events, (void *)arg,
4705 sizeof (int), copyflag);
4706 mutex_exit(&stp->sd_lock);
4707 return (error);
4708 }
4709 mutex_exit(&stp->sd_lock);
4710 return (EINVAL);
4711 }
4712
4713 case I_ESETSIG:
4714 /*
4715 * Register the ss_pid to receive the SIGPOLL
4716 * signal based on the events is ss_events arg. If
4717 * ss_events is zero, remove the proc from register list.
4718 */
4719 {
4720 struct strsig *ssp, *pssp;
4721 struct proc *proc;
4722 struct pid *pidp;
4723 pid_t pid;
4724 struct strsigset ss;
4725
4726 error = strcopyin((void *)arg, &ss, sizeof (ss), copyflag);
4727 if (error)
4728 return (error);
4729
4730 pid = ss.ss_pid;
4731
4732 if (ss.ss_events != 0) {
4733 /*
4734 * Permissions check by sending signal 0.
4735 * Note that when kill fails it does a set_errno
4736 * causing the system call to fail.
4737 */
4738 error = kill(pid, 0);
4739 if (error) {
4740 return (error);
4741 }
4742 }
4743 mutex_enter(&pidlock);
4744 if (pid == 0)
4745 proc = curproc;
4746 else if (pid < 0)
4747 proc = pgfind(-pid);
4748 else
4749 proc = prfind(pid);
4750 if (proc == NULL) {
4751 mutex_exit(&pidlock);
4752 return (ESRCH);
4753 }
4754 if (pid < 0)
4755 pidp = proc->p_pgidp;
4756 else
4757 pidp = proc->p_pidp;
4758 ASSERT(pidp);
4759 /*
4760 * Get a hold on the pid structure while referencing it.
4761 * There is a separate PID_HOLD should it be inserted
4762 * in the list below.
4763 */
4764 PID_HOLD(pidp);
4765 mutex_exit(&pidlock);
4766
4767 pssp = NULL;
4768 /*
4769 * Hold sd_lock to prevent traversal of sd_siglist while
4770 * it is modified.
4771 */
4772 mutex_enter(&stp->sd_lock);
4773 for (ssp = stp->sd_siglist; ssp && (ssp->ss_pid != pid);
4774 pssp = ssp, ssp = ssp->ss_next)
4775 ;
4776
4777 if (ss.ss_events) {
4778 if (ss.ss_events &
4779 ~(S_INPUT|S_HIPRI|S_MSG|S_HANGUP|S_ERROR|
4780 S_RDNORM|S_WRNORM|S_RDBAND|S_WRBAND|S_BANDURG)) {
4781 mutex_exit(&stp->sd_lock);
4782 mutex_enter(&pidlock);
4783 PID_RELE(pidp);
4784 mutex_exit(&pidlock);
4785 return (EINVAL);
4786 }
4787 if ((ss.ss_events & S_BANDURG) &&
4788 !(ss.ss_events & S_RDBAND)) {
4789 mutex_exit(&stp->sd_lock);
4790 mutex_enter(&pidlock);
4791 PID_RELE(pidp);
4792 mutex_exit(&pidlock);
4793 return (EINVAL);
4794 }
4795
4796 /*
4797 * If proc not already registered, add it
4798 * to list.
4799 */
4800 if (!ssp) {
4801 ssp = kmem_alloc(sizeof (strsig_t), KM_SLEEP);
4802 ssp->ss_pidp = pidp;
4803 ssp->ss_pid = pid;
4804 ssp->ss_next = NULL;
4805 if (pssp)
4806 pssp->ss_next = ssp;
4807 else
4808 stp->sd_siglist = ssp;
4809 mutex_enter(&pidlock);
4810 PID_HOLD(pidp);
4811 mutex_exit(&pidlock);
4812 }
4813
4814 /*
4815 * Set events.
4816 */
4817 ssp->ss_events = ss.ss_events;
4818 } else {
4819 /*
4820 * Remove proc from register list.
4821 */
4822 if (ssp) {
4823 mutex_enter(&pidlock);
4824 PID_RELE(pidp);
4825 mutex_exit(&pidlock);
4826 if (pssp)
4827 pssp->ss_next = ssp->ss_next;
4828 else
4829 stp->sd_siglist = ssp->ss_next;
4830 kmem_free(ssp, sizeof (strsig_t));
4831 } else {
4832 mutex_exit(&stp->sd_lock);
4833 mutex_enter(&pidlock);
4834 PID_RELE(pidp);
4835 mutex_exit(&pidlock);
4836 return (EINVAL);
4837 }
4838 }
4839
4840 /*
4841 * Recalculate OR of sig events.
4842 */
4843 stp->sd_sigflags = 0;
4844 for (ssp = stp->sd_siglist; ssp; ssp = ssp->ss_next)
4845 stp->sd_sigflags |= ssp->ss_events;
4846 mutex_exit(&stp->sd_lock);
4847 mutex_enter(&pidlock);
4848 PID_RELE(pidp);
4849 mutex_exit(&pidlock);
4850 return (0);
4851 }
4852
4853 case I_EGETSIG:
4854 /*
4855 * Return (in arg) the current registration of events
4856 * for which the calling proc is to be signaled.
4857 */
4858 {
4859 struct strsig *ssp;
4860 struct proc *proc;
4861 pid_t pid;
4862 struct pid *pidp;
4863 struct strsigset ss;
4864
4865 error = strcopyin((void *)arg, &ss, sizeof (ss), copyflag);
4866 if (error)
4867 return (error);
4868
4869 pid = ss.ss_pid;
4870 mutex_enter(&pidlock);
4871 if (pid == 0)
4872 proc = curproc;
4873 else if (pid < 0)
4874 proc = pgfind(-pid);
4875 else
4876 proc = prfind(pid);
4877 if (proc == NULL) {
4878 mutex_exit(&pidlock);
4879 return (ESRCH);
4880 }
4881 if (pid < 0)
4882 pidp = proc->p_pgidp;
4883 else
4884 pidp = proc->p_pidp;
4885
4886 /* Prevent the pidp from being reassigned */
4887 PID_HOLD(pidp);
4888 mutex_exit(&pidlock);
4889
4890 mutex_enter(&stp->sd_lock);
4891 for (ssp = stp->sd_siglist; ssp; ssp = ssp->ss_next)
4892 if (ssp->ss_pid == pid) {
4893 ss.ss_pid = ssp->ss_pid;
4894 ss.ss_events = ssp->ss_events;
4895 error = strcopyout(&ss, (void *)arg,
4896 sizeof (struct strsigset), copyflag);
4897 mutex_exit(&stp->sd_lock);
4898 mutex_enter(&pidlock);
4899 PID_RELE(pidp);
4900 mutex_exit(&pidlock);
4901 return (error);
4902 }
4903 mutex_exit(&stp->sd_lock);
4904 mutex_enter(&pidlock);
4905 PID_RELE(pidp);
4906 mutex_exit(&pidlock);
4907 return (EINVAL);
4908 }
4909
4910 case I_PEEK:
4911 {
4912 STRUCT_DECL(strpeek, strpeek);
4913 size_t n;
4914 mblk_t *fmp, *tmp_mp = NULL;
4915
4916 STRUCT_INIT(strpeek, flag);
4917
4918 error = strcopyin((void *)arg, STRUCT_BUF(strpeek),
4919 STRUCT_SIZE(strpeek), copyflag);
4920 if (error)
4921 return (error);
4922
4923 mutex_enter(QLOCK(rdq));
4924 /*
4925 * Skip the invalid messages
4926 */
4927 for (mp = rdq->q_first; mp != NULL; mp = mp->b_next)
4928 if (mp->b_datap->db_type != M_SIG)
4929 break;
4930
4931 /*
4932 * If user has requested to peek at a high priority message
4933 * and first message is not, return 0
4934 */
4935 if (mp != NULL) {
4936 if ((STRUCT_FGET(strpeek, flags) & RS_HIPRI) &&
4937 queclass(mp) == QNORM) {
4938 *rvalp = 0;
4939 mutex_exit(QLOCK(rdq));
4940 return (0);
4941 }
4942 } else if (stp->sd_struiordq == NULL ||
4943 (STRUCT_FGET(strpeek, flags) & RS_HIPRI)) {
4944 /*
4945 * No mblks to look at at the streamhead and
4946 * 1). This isn't a synch stream or
4947 * 2). This is a synch stream but caller wants high
4948 * priority messages which is not supported by
4949 * the synch stream. (it only supports QNORM)
4950 */
4951 *rvalp = 0;
4952 mutex_exit(QLOCK(rdq));
4953 return (0);
4954 }
4955
4956 fmp = mp;
4957
4958 if (mp && mp->b_datap->db_type == M_PASSFP) {
4959 mutex_exit(QLOCK(rdq));
4960 return (EBADMSG);
4961 }
4962
4963 ASSERT(mp == NULL || mp->b_datap->db_type == M_PCPROTO ||
4964 mp->b_datap->db_type == M_PROTO ||
4965 mp->b_datap->db_type == M_DATA);
4966
4967 if (mp && mp->b_datap->db_type == M_PCPROTO) {
4968 STRUCT_FSET(strpeek, flags, RS_HIPRI);
4969 } else {
4970 STRUCT_FSET(strpeek, flags, 0);
4971 }
4972
4973
4974 if (mp && ((tmp_mp = dupmsg(mp)) == NULL)) {
4975 mutex_exit(QLOCK(rdq));
4976 return (ENOSR);
4977 }
4978 mutex_exit(QLOCK(rdq));
4979
4980 /*
4981 * set mp = tmp_mp, so that I_PEEK processing can continue.
4982 * tmp_mp is used to free the dup'd message.
4983 */
4984 mp = tmp_mp;
4985
4986 uio.uio_fmode = 0;
4987 uio.uio_extflg = UIO_COPY_CACHED;
4988 uio.uio_segflg = (copyflag == U_TO_K) ? UIO_USERSPACE :
4989 UIO_SYSSPACE;
4990 uio.uio_limit = 0;
4991 /*
4992 * First process PROTO blocks, if any.
4993 * If user doesn't want to get ctl info by setting maxlen <= 0,
4994 * then set len to -1/0 and skip control blocks part.
4995 */
4996 if (STRUCT_FGET(strpeek, ctlbuf.maxlen) < 0)
4997 STRUCT_FSET(strpeek, ctlbuf.len, -1);
4998 else if (STRUCT_FGET(strpeek, ctlbuf.maxlen) == 0)
4999 STRUCT_FSET(strpeek, ctlbuf.len, 0);
5000 else {
5001 int ctl_part = 0;
5002
5003 iov.iov_base = STRUCT_FGETP(strpeek, ctlbuf.buf);
5004 iov.iov_len = STRUCT_FGET(strpeek, ctlbuf.maxlen);
5005 uio.uio_iov = &iov;
5006 uio.uio_resid = iov.iov_len;
5007 uio.uio_loffset = 0;
5008 uio.uio_iovcnt = 1;
5009 while (mp && mp->b_datap->db_type != M_DATA &&
5010 uio.uio_resid >= 0) {
5011 ASSERT(STRUCT_FGET(strpeek, flags) == 0 ?
5012 mp->b_datap->db_type == M_PROTO :
5013 mp->b_datap->db_type == M_PCPROTO);
5014
5015 if ((n = MIN(uio.uio_resid,
5016 mp->b_wptr - mp->b_rptr)) != 0 &&
5017 (error = uiomove((char *)mp->b_rptr, n,
5018 UIO_READ, &uio)) != 0) {
5019 freemsg(tmp_mp);
5020 return (error);
5021 }
5022 ctl_part = 1;
5023 mp = mp->b_cont;
5024 }
5025 /* No ctl message */
5026 if (ctl_part == 0)
5027 STRUCT_FSET(strpeek, ctlbuf.len, -1);
5028 else
5029 STRUCT_FSET(strpeek, ctlbuf.len,
5030 STRUCT_FGET(strpeek, ctlbuf.maxlen) -
5031 uio.uio_resid);
5032 }
5033
5034 /*
5035 * Now process DATA blocks, if any.
5036 * If user doesn't want to get data info by setting maxlen <= 0,
5037 * then set len to -1/0 and skip data blocks part.
5038 */
5039 if (STRUCT_FGET(strpeek, databuf.maxlen) < 0)
5040 STRUCT_FSET(strpeek, databuf.len, -1);
5041 else if (STRUCT_FGET(strpeek, databuf.maxlen) == 0)
5042 STRUCT_FSET(strpeek, databuf.len, 0);
5043 else {
5044 int data_part = 0;
5045
5046 iov.iov_base = STRUCT_FGETP(strpeek, databuf.buf);
5047 iov.iov_len = STRUCT_FGET(strpeek, databuf.maxlen);
5048 uio.uio_iov = &iov;
5049 uio.uio_resid = iov.iov_len;
5050 uio.uio_loffset = 0;
5051 uio.uio_iovcnt = 1;
5052 while (mp && uio.uio_resid) {
5053 if (mp->b_datap->db_type == M_DATA) {
5054 if ((n = MIN(uio.uio_resid,
5055 mp->b_wptr - mp->b_rptr)) != 0 &&
5056 (error = uiomove((char *)mp->b_rptr,
5057 n, UIO_READ, &uio)) != 0) {
5058 freemsg(tmp_mp);
5059 return (error);
5060 }
5061 data_part = 1;
5062 }
5063 ASSERT(data_part == 0 ||
5064 mp->b_datap->db_type == M_DATA);
5065 mp = mp->b_cont;
5066 }
5067 /* No data message */
5068 if (data_part == 0)
5069 STRUCT_FSET(strpeek, databuf.len, -1);
5070 else
5071 STRUCT_FSET(strpeek, databuf.len,
5072 STRUCT_FGET(strpeek, databuf.maxlen) -
5073 uio.uio_resid);
5074 }
5075 freemsg(tmp_mp);
5076
5077 /*
5078 * It is a synch stream and user wants to get
5079 * data (maxlen > 0).
5080 * uio setup is done by the codes that process DATA
5081 * blocks above.
5082 */
5083 if ((fmp == NULL) && STRUCT_FGET(strpeek, databuf.maxlen) > 0) {
5084 infod_t infod;
5085
5086 infod.d_cmd = INFOD_COPYOUT;
5087 infod.d_res = 0;
5088 infod.d_uiop = &uio;
5089 error = infonext(rdq, &infod);
5090 if (error == EINVAL || error == EBUSY)
5091 error = 0;
5092 if (error)
5093 return (error);
5094 STRUCT_FSET(strpeek, databuf.len, STRUCT_FGET(strpeek,
5095 databuf.maxlen) - uio.uio_resid);
5096 if (STRUCT_FGET(strpeek, databuf.len) == 0) {
5097 /*
5098 * No data found by the infonext().
5099 */
5100 STRUCT_FSET(strpeek, databuf.len, -1);
5101 }
5102 }
5103 error = strcopyout(STRUCT_BUF(strpeek), (void *)arg,
5104 STRUCT_SIZE(strpeek), copyflag);
5105 if (error) {
5106 return (error);
5107 }
5108 /*
5109 * If there is no message retrieved, set return code to 0
5110 * otherwise, set it to 1.
5111 */
5112 if (STRUCT_FGET(strpeek, ctlbuf.len) == -1 &&
5113 STRUCT_FGET(strpeek, databuf.len) == -1)
5114 *rvalp = 0;
5115 else
5116 *rvalp = 1;
5117 return (0);
5118 }
5119
5120 case I_FDINSERT:
5121 {
5122 STRUCT_DECL(strfdinsert, strfdinsert);
5123 struct file *resftp;
5124 struct stdata *resstp;
5125 t_uscalar_t ival;
5126 ssize_t msgsize;
5127 struct strbuf mctl;
5128
5129 STRUCT_INIT(strfdinsert, flag);
5130 if (stp->sd_flag & STRHUP)
5131 return (ENXIO);
5132 /*
5133 * STRDERR, STWRERR and STPLEX tested above.
5134 */
5135 error = strcopyin((void *)arg, STRUCT_BUF(strfdinsert),
5136 STRUCT_SIZE(strfdinsert), copyflag);
5137 if (error)
5138 return (error);
5139
5140 if (STRUCT_FGET(strfdinsert, offset) < 0 ||
5141 (STRUCT_FGET(strfdinsert, offset) %
5142 sizeof (t_uscalar_t)) != 0)
5143 return (EINVAL);
5144 if ((resftp = getf(STRUCT_FGET(strfdinsert, fildes))) != NULL) {
5145 if ((resstp = resftp->f_vnode->v_stream) == NULL) {
5146 releasef(STRUCT_FGET(strfdinsert, fildes));
5147 return (EINVAL);
5148 }
5149 } else
5150 return (EINVAL);
5151
5152 mutex_enter(&resstp->sd_lock);
5153 if (resstp->sd_flag & (STRDERR|STWRERR|STRHUP|STPLEX)) {
5154 error = strgeterr(resstp,
5155 STRDERR|STWRERR|STRHUP|STPLEX, 0);
5156 if (error != 0) {
5157 mutex_exit(&resstp->sd_lock);
5158 releasef(STRUCT_FGET(strfdinsert, fildes));
5159 return (error);
5160 }
5161 }
5162 mutex_exit(&resstp->sd_lock);
5163
5164 #ifdef _ILP32
5165 {
5166 queue_t *q;
5167 queue_t *mate = NULL;
5168
5169 /* get read queue of stream terminus */
5170 claimstr(resstp->sd_wrq);
5171 for (q = resstp->sd_wrq->q_next; q->q_next != NULL;
5172 q = q->q_next)
5173 if (!STRMATED(resstp) && STREAM(q) != resstp &&
5174 mate == NULL) {
5175 ASSERT(q->q_qinfo->qi_srvp);
5176 ASSERT(_OTHERQ(q)->q_qinfo->qi_srvp);
5177 claimstr(q);
5178 mate = q;
5179 }
5180 q = _RD(q);
5181 if (mate)
5182 releasestr(mate);
5183 releasestr(resstp->sd_wrq);
5184 ival = (t_uscalar_t)q;
5185 }
5186 #else
5187 ival = (t_uscalar_t)getminor(resftp->f_vnode->v_rdev);
5188 #endif /* _ILP32 */
5189
5190 if (STRUCT_FGET(strfdinsert, ctlbuf.len) <
5191 STRUCT_FGET(strfdinsert, offset) + sizeof (t_uscalar_t)) {
5192 releasef(STRUCT_FGET(strfdinsert, fildes));
5193 return (EINVAL);
5194 }
5195
5196 /*
5197 * Check for legal flag value.
5198 */
5199 if (STRUCT_FGET(strfdinsert, flags) & ~RS_HIPRI) {
5200 releasef(STRUCT_FGET(strfdinsert, fildes));
5201 return (EINVAL);
5202 }
5203
5204 /* get these values from those cached in the stream head */
5205 mutex_enter(QLOCK(stp->sd_wrq));
5206 rmin = stp->sd_qn_minpsz;
5207 rmax = stp->sd_qn_maxpsz;
5208 mutex_exit(QLOCK(stp->sd_wrq));
5209
5210 /*
5211 * Make sure ctl and data sizes together fall within
5212 * the limits of the max and min receive packet sizes
5213 * and do not exceed system limit. A negative data
5214 * length means that no data part is to be sent.
5215 */
5216 ASSERT((rmax >= 0) || (rmax == INFPSZ));
5217 if (rmax == 0) {
5218 releasef(STRUCT_FGET(strfdinsert, fildes));
5219 return (ERANGE);
5220 }
5221 if ((msgsize = STRUCT_FGET(strfdinsert, databuf.len)) < 0)
5222 msgsize = 0;
5223 if ((msgsize < rmin) ||
5224 ((msgsize > rmax) && (rmax != INFPSZ)) ||
5225 (STRUCT_FGET(strfdinsert, ctlbuf.len) > strctlsz)) {
5226 releasef(STRUCT_FGET(strfdinsert, fildes));
5227 return (ERANGE);
5228 }
5229
5230 mutex_enter(&stp->sd_lock);
5231 while (!(STRUCT_FGET(strfdinsert, flags) & RS_HIPRI) &&
5232 !canputnext(stp->sd_wrq)) {
5233 if ((error = strwaitq(stp, WRITEWAIT, (ssize_t)0,
5234 flag, -1, &done)) != 0 || done) {
5235 mutex_exit(&stp->sd_lock);
5236 releasef(STRUCT_FGET(strfdinsert, fildes));
5237 return (error);
5238 }
5239 if ((error = i_straccess(stp, access)) != 0) {
5240 mutex_exit(&stp->sd_lock);
5241 releasef(
5242 STRUCT_FGET(strfdinsert, fildes));
5243 return (error);
5244 }
5245 }
5246 mutex_exit(&stp->sd_lock);
5247
5248 /*
5249 * Copy strfdinsert.ctlbuf into native form of
5250 * ctlbuf to pass down into strmakemsg().
5251 */
5252 mctl.maxlen = STRUCT_FGET(strfdinsert, ctlbuf.maxlen);
5253 mctl.len = STRUCT_FGET(strfdinsert, ctlbuf.len);
5254 mctl.buf = STRUCT_FGETP(strfdinsert, ctlbuf.buf);
5255
5256 iov.iov_base = STRUCT_FGETP(strfdinsert, databuf.buf);
5257 iov.iov_len = STRUCT_FGET(strfdinsert, databuf.len);
5258 uio.uio_iov = &iov;
5259 uio.uio_iovcnt = 1;
5260 uio.uio_loffset = 0;
5261 uio.uio_segflg = (copyflag == U_TO_K) ? UIO_USERSPACE :
5262 UIO_SYSSPACE;
5263 uio.uio_fmode = 0;
5264 uio.uio_extflg = UIO_COPY_CACHED;
5265 uio.uio_resid = iov.iov_len;
5266 if ((error = strmakemsg(&mctl,
5267 &msgsize, &uio, stp,
5268 STRUCT_FGET(strfdinsert, flags), &mp)) != 0 || !mp) {
5269 STRUCT_FSET(strfdinsert, databuf.len, msgsize);
5270 releasef(STRUCT_FGET(strfdinsert, fildes));
5271 return (error);
5272 }
5273
5274 STRUCT_FSET(strfdinsert, databuf.len, msgsize);
5275
5276 /*
5277 * Place the possibly reencoded queue pointer 'offset' bytes
5278 * from the start of the control portion of the message.
5279 */
5280 *((t_uscalar_t *)(mp->b_rptr +
5281 STRUCT_FGET(strfdinsert, offset))) = ival;
5282
5283 /*
5284 * Put message downstream.
5285 */
5286 stream_willservice(stp);
5287 putnext(stp->sd_wrq, mp);
5288 stream_runservice(stp);
5289 releasef(STRUCT_FGET(strfdinsert, fildes));
5290 return (error);
5291 }
5292
5293 case I_SENDFD:
5294 {
5295 struct file *fp;
5296
5297 if ((fp = getf((int)arg)) == NULL)
5298 return (EBADF);
5299 error = do_sendfp(stp, fp, crp);
5300 if (auditing) {
5301 audit_fdsend((int)arg, fp, error);
5302 }
5303 releasef((int)arg);
5304 return (error);
5305 }
5306
5307 case I_RECVFD:
5308 case I_E_RECVFD:
5309 {
5310 struct k_strrecvfd *srf;
5311 int i, fd;
5312
5313 mutex_enter(&stp->sd_lock);
5314 while (!(mp = getq(rdq))) {
5315 if (stp->sd_flag & (STRHUP|STREOF)) {
5316 mutex_exit(&stp->sd_lock);
5317 return (ENXIO);
5318 }
5319 if ((error = strwaitq(stp, GETWAIT, (ssize_t)0,
5320 flag, -1, &done)) != 0 || done) {
5321 mutex_exit(&stp->sd_lock);
5322 return (error);
5323 }
5324 if ((error = i_straccess(stp, access)) != 0) {
5325 mutex_exit(&stp->sd_lock);
5326 return (error);
5327 }
5328 }
5329 if (mp->b_datap->db_type != M_PASSFP) {
5330 putback(stp, rdq, mp, mp->b_band);
5331 mutex_exit(&stp->sd_lock);
5332 return (EBADMSG);
5333 }
5334 mutex_exit(&stp->sd_lock);
5335
5336 srf = (struct k_strrecvfd *)mp->b_rptr;
5337 if ((fd = ufalloc(0)) == -1) {
5338 mutex_enter(&stp->sd_lock);
5339 putback(stp, rdq, mp, mp->b_band);
5340 mutex_exit(&stp->sd_lock);
5341 return (EMFILE);
5342 }
5343 if (cmd == I_RECVFD) {
5344 struct o_strrecvfd ostrfd;
5345
5346 /* check to see if uid/gid values are too large. */
5347
5348 if (srf->uid > (o_uid_t)USHRT_MAX ||
5349 srf->gid > (o_gid_t)USHRT_MAX) {
5350 mutex_enter(&stp->sd_lock);
5351 putback(stp, rdq, mp, mp->b_band);
5352 mutex_exit(&stp->sd_lock);
5353 setf(fd, NULL); /* release fd entry */
5354 return (EOVERFLOW);
5355 }
5356
5357 ostrfd.fd = fd;
5358 ostrfd.uid = (o_uid_t)srf->uid;
5359 ostrfd.gid = (o_gid_t)srf->gid;
5360
5361 /* Null the filler bits */
5362 for (i = 0; i < 8; i++)
5363 ostrfd.fill[i] = 0;
5364
5365 error = strcopyout(&ostrfd, (void *)arg,
5366 sizeof (struct o_strrecvfd), copyflag);
5367 } else { /* I_E_RECVFD */
5368 struct strrecvfd strfd;
5369
5370 strfd.fd = fd;
5371 strfd.uid = srf->uid;
5372 strfd.gid = srf->gid;
5373
5374 /* null the filler bits */
5375 for (i = 0; i < 8; i++)
5376 strfd.fill[i] = 0;
5377
5378 error = strcopyout(&strfd, (void *)arg,
5379 sizeof (struct strrecvfd), copyflag);
5380 }
5381
5382 if (error) {
5383 setf(fd, NULL); /* release fd entry */
5384 mutex_enter(&stp->sd_lock);
5385 putback(stp, rdq, mp, mp->b_band);
5386 mutex_exit(&stp->sd_lock);
5387 return (error);
5388 }
5389 if (auditing) {
5390 audit_fdrecv(fd, srf->fp);
5391 }
5392
5393 /*
5394 * Always increment f_count since the freemsg() below will
5395 * always call free_passfp() which performs a closef().
5396 */
5397 mutex_enter(&srf->fp->f_tlock);
5398 srf->fp->f_count++;
5399 mutex_exit(&srf->fp->f_tlock);
5400 setf(fd, srf->fp);
5401 freemsg(mp);
5402 return (0);
5403 }
5404
5405 case I_SWROPT:
5406 /*
5407 * Set/clear the write options. arg is a bit
5408 * mask with any of the following bits set...
5409 * SNDZERO - send zero length message
5410 * SNDPIPE - send sigpipe to process if
5411 * sd_werror is set and process is
5412 * doing a write or putmsg.
5413 * The new stream head write options should reflect
5414 * what is in arg.
5415 */
5416 if (arg & ~(SNDZERO|SNDPIPE))
5417 return (EINVAL);
5418
5419 mutex_enter(&stp->sd_lock);
5420 stp->sd_wput_opt &= ~(SW_SIGPIPE|SW_SNDZERO);
5421 if (arg & SNDZERO)
5422 stp->sd_wput_opt |= SW_SNDZERO;
5423 if (arg & SNDPIPE)
5424 stp->sd_wput_opt |= SW_SIGPIPE;
5425 mutex_exit(&stp->sd_lock);
5426 return (0);
5427
5428 case I_GWROPT:
5429 {
5430 int wropt = 0;
5431
5432 if (stp->sd_wput_opt & SW_SNDZERO)
5433 wropt |= SNDZERO;
5434 if (stp->sd_wput_opt & SW_SIGPIPE)
5435 wropt |= SNDPIPE;
5436 return (strcopyout(&wropt, (void *)arg, sizeof (wropt),
5437 copyflag));
5438 }
5439
5440 case I_LIST:
5441 /*
5442 * Returns all the modules found on this stream,
5443 * upto the driver. If argument is NULL, return the
5444 * number of modules (including driver). If argument
5445 * is not NULL, copy the names into the structure
5446 * provided.
5447 */
5448
5449 {
5450 queue_t *q;
5451 char *qname;
5452 int i, nmods;
5453 struct str_mlist *mlist;
5454 STRUCT_DECL(str_list, strlist);
5455
5456 if (arg == NULL) { /* Return number of modules plus driver */
5457 if (stp->sd_vnode->v_type == VFIFO)
5458 *rvalp = stp->sd_pushcnt;
5459 else
5460 *rvalp = stp->sd_pushcnt + 1;
5461 return (0);
5462 }
5463
5464 STRUCT_INIT(strlist, flag);
5465
5466 error = strcopyin((void *)arg, STRUCT_BUF(strlist),
5467 STRUCT_SIZE(strlist), copyflag);
5468 if (error != 0)
5469 return (error);
5470
5471 mlist = STRUCT_FGETP(strlist, sl_modlist);
5472 nmods = STRUCT_FGET(strlist, sl_nmods);
5473 if (nmods <= 0)
5474 return (EINVAL);
5475
5476 claimstr(stp->sd_wrq);
5477 q = stp->sd_wrq;
5478 for (i = 0; i < nmods && _SAMESTR(q); i++, q = q->q_next) {
5479 qname = Q2NAME(q->q_next);
5480 error = strcopyout(qname, &mlist[i], strlen(qname) + 1,
5481 copyflag);
5482 if (error != 0) {
5483 releasestr(stp->sd_wrq);
5484 return (error);
5485 }
5486 }
5487 releasestr(stp->sd_wrq);
5488 return (strcopyout(&i, (void *)arg, sizeof (int), copyflag));
5489 }
5490
5491 case I_CKBAND:
5492 {
5493 queue_t *q;
5494 qband_t *qbp;
5495
5496 if ((arg < 0) || (arg >= NBAND))
5497 return (EINVAL);
5498 q = _RD(stp->sd_wrq);
5499 mutex_enter(QLOCK(q));
5500 if (arg > (int)q->q_nband) {
5501 *rvalp = 0;
5502 } else {
5503 if (arg == 0) {
5504 if (q->q_first)
5505 *rvalp = 1;
5506 else
5507 *rvalp = 0;
5508 } else {
5509 qbp = q->q_bandp;
5510 while (--arg > 0)
5511 qbp = qbp->qb_next;
5512 if (qbp->qb_first)
5513 *rvalp = 1;
5514 else
5515 *rvalp = 0;
5516 }
5517 }
5518 mutex_exit(QLOCK(q));
5519 return (0);
5520 }
5521
5522 case I_GETBAND:
5523 {
5524 int intpri;
5525 queue_t *q;
5526
5527 q = _RD(stp->sd_wrq);
5528 mutex_enter(QLOCK(q));
5529 mp = q->q_first;
5530 if (!mp) {
5531 mutex_exit(QLOCK(q));
5532 return (ENODATA);
5533 }
5534 intpri = (int)mp->b_band;
5535 error = strcopyout(&intpri, (void *)arg, sizeof (int),
5536 copyflag);
5537 mutex_exit(QLOCK(q));
5538 return (error);
5539 }
5540
5541 case I_ATMARK:
5542 {
5543 queue_t *q;
5544
5545 if (arg & ~(ANYMARK|LASTMARK))
5546 return (EINVAL);
5547 q = _RD(stp->sd_wrq);
5548 mutex_enter(&stp->sd_lock);
5549 if ((stp->sd_flag & STRATMARK) && (arg == ANYMARK)) {
5550 *rvalp = 1;
5551 } else {
5552 mutex_enter(QLOCK(q));
5553 mp = q->q_first;
5554
5555 if (mp == NULL)
5556 *rvalp = 0;
5557 else if ((arg == ANYMARK) && (mp->b_flag & MSGMARK))
5558 *rvalp = 1;
5559 else if ((arg == LASTMARK) && (mp == stp->sd_mark))
5560 *rvalp = 1;
5561 else
5562 *rvalp = 0;
5563 mutex_exit(QLOCK(q));
5564 }
5565 mutex_exit(&stp->sd_lock);
5566 return (0);
5567 }
5568
5569 case I_CANPUT:
5570 {
5571 char band;
5572
5573 if ((arg < 0) || (arg >= NBAND))
5574 return (EINVAL);
5575 band = (char)arg;
5576 *rvalp = bcanputnext(stp->sd_wrq, band);
5577 return (0);
5578 }
5579
5580 case I_SETCLTIME:
5581 {
5582 int closetime;
5583
5584 error = strcopyin((void *)arg, &closetime, sizeof (int),
5585 copyflag);
5586 if (error)
5587 return (error);
5588 if (closetime < 0)
5589 return (EINVAL);
5590
5591 stp->sd_closetime = closetime;
5592 return (0);
5593 }
5594
5595 case I_GETCLTIME:
5596 {
5597 int closetime;
5598
5599 closetime = stp->sd_closetime;
5600 return (strcopyout(&closetime, (void *)arg, sizeof (int),
5601 copyflag));
5602 }
5603
5604 case TIOCGSID:
5605 {
5606 pid_t sid;
5607
5608 mutex_enter(&stp->sd_lock);
5609 if (stp->sd_sidp == NULL) {
5610 mutex_exit(&stp->sd_lock);
5611 return (ENOTTY);
5612 }
5613 sid = stp->sd_sidp->pid_id;
5614 mutex_exit(&stp->sd_lock);
5615 return (strcopyout(&sid, (void *)arg, sizeof (pid_t),
5616 copyflag));
5617 }
5618
5619 case TIOCSPGRP:
5620 {
5621 pid_t pgrp;
5622 proc_t *q;
5623 pid_t sid, fg_pgid, bg_pgid;
5624
5625 if (error = strcopyin((void *)arg, &pgrp, sizeof (pid_t),
5626 copyflag))
5627 return (error);
5628 mutex_enter(&stp->sd_lock);
5629 mutex_enter(&pidlock);
5630 if (stp->sd_sidp != ttoproc(curthread)->p_sessp->s_sidp) {
5631 mutex_exit(&pidlock);
5632 mutex_exit(&stp->sd_lock);
5633 return (ENOTTY);
5634 }
5635 if (pgrp == stp->sd_pgidp->pid_id) {
5636 mutex_exit(&pidlock);
5637 mutex_exit(&stp->sd_lock);
5638 return (0);
5639 }
5640 if (pgrp <= 0 || pgrp >= maxpid) {
5641 mutex_exit(&pidlock);
5642 mutex_exit(&stp->sd_lock);
5643 return (EINVAL);
5644 }
5645 if ((q = pgfind(pgrp)) == NULL ||
5646 q->p_sessp != ttoproc(curthread)->p_sessp) {
5647 mutex_exit(&pidlock);
5648 mutex_exit(&stp->sd_lock);
5649 return (EPERM);
5650 }
5651 sid = stp->sd_sidp->pid_id;
5652 fg_pgid = q->p_pgrp;
5653 bg_pgid = stp->sd_pgidp->pid_id;
5654 CL_SET_PROCESS_GROUP(curthread, sid, bg_pgid, fg_pgid);
5655 PID_RELE(stp->sd_pgidp);
5656 ctty_clear_sighuped();
5657 stp->sd_pgidp = q->p_pgidp;
5658 PID_HOLD(stp->sd_pgidp);
5659 mutex_exit(&pidlock);
5660 mutex_exit(&stp->sd_lock);
5661 return (0);
5662 }
5663
5664 case TIOCGPGRP:
5665 {
5666 pid_t pgrp;
5667
5668 mutex_enter(&stp->sd_lock);
5669 if (stp->sd_sidp == NULL) {
5670 mutex_exit(&stp->sd_lock);
5671 return (ENOTTY);
5672 }
5673 pgrp = stp->sd_pgidp->pid_id;
5674 mutex_exit(&stp->sd_lock);
5675 return (strcopyout(&pgrp, (void *)arg, sizeof (pid_t),
5676 copyflag));
5677 }
5678
5679 case TIOCSCTTY:
5680 {
5681 return (strctty(stp));
5682 }
5683
5684 case TIOCNOTTY:
5685 {
5686 /* freectty() always assumes curproc. */
5687 if (freectty(B_FALSE) != 0)
5688 return (0);
5689 return (ENOTTY);
5690 }
5691
5692 case FIONBIO:
5693 case FIOASYNC:
5694 return (0); /* handled by the upper layer */
5695 case F_ASSOCI_PID:
5696 {
5697 if (crp != kcred)
5698 return (EPERM);
5699 if (is_xti_str(stp))
5700 sh_insert_pid(stp, (pid_t)arg);
5701 return (0);
5702 }
5703 case F_DASSOC_PID:
5704 {
5705 if (crp != kcred)
5706 return (EPERM);
5707 if (is_xti_str(stp))
5708 sh_remove_pid(stp, (pid_t)arg);
5709 return (0);
5710 }
5711 }
5712 }
5713
5714 /*
5715 * Custom free routine used for M_PASSFP messages.
5716 */
5717 static void
5718 free_passfp(struct k_strrecvfd *srf)
5719 {
5720 (void) closef(srf->fp);
5721 kmem_free(srf, sizeof (struct k_strrecvfd) + sizeof (frtn_t));
5722 }
5723
5724 /* ARGSUSED */
5725 int
5726 do_sendfp(struct stdata *stp, struct file *fp, struct cred *cr)
5727 {
5728 queue_t *qp, *nextqp;
5729 struct k_strrecvfd *srf;
5730 mblk_t *mp;
5731 frtn_t *frtnp;
5732 size_t bufsize;
5733 queue_t *mate = NULL;
5734 syncq_t *sq = NULL;
5735 int retval = 0;
5736
5737 if (stp->sd_flag & STRHUP)
5738 return (ENXIO);
5739
5740 claimstr(stp->sd_wrq);
5741
5742 /* Fastpath, we have a pipe, and we are already mated, use it. */
5743 if (STRMATED(stp)) {
5744 qp = _RD(stp->sd_mate->sd_wrq);
5745 claimstr(qp);
5746 mate = qp;
5747 } else { /* Not already mated. */
5748
5749 /*
5750 * Walk the stream to the end of this one.
5751 * assumes that the claimstr() will prevent
5752 * plumbing between the stream head and the
5753 * driver from changing
5754 */
5755 qp = stp->sd_wrq;
5756
5757 /*
5758 * Loop until we reach the end of this stream.
5759 * On completion, qp points to the write queue
5760 * at the end of the stream, or the read queue
5761 * at the stream head if this is a fifo.
5762 */
5763 while (((qp = qp->q_next) != NULL) && _SAMESTR(qp))
5764 ;
5765
5766 /*
5767 * Just in case we get a q_next which is NULL, but
5768 * not at the end of the stream. This is actually
5769 * broken, so we set an assert to catch it in
5770 * debug, and set an error and return if not debug.
5771 */
5772 ASSERT(qp);
5773 if (qp == NULL) {
5774 releasestr(stp->sd_wrq);
5775 return (EINVAL);
5776 }
5777
5778 /*
5779 * Enter the syncq for the driver, so (hopefully)
5780 * the queue values will not change on us.
5781 * XXXX - This will only prevent the race IFF only
5782 * the write side modifies the q_next member, and
5783 * the put procedure is protected by at least
5784 * MT_PERQ.
5785 */
5786 if ((sq = qp->q_syncq) != NULL)
5787 entersq(sq, SQ_PUT);
5788
5789 /* Now get the q_next value from this qp. */
5790 nextqp = qp->q_next;
5791
5792 /*
5793 * If nextqp exists and the other stream is different
5794 * from this one claim the stream, set the mate, and
5795 * get the read queue at the stream head of the other
5796 * stream. Assumes that nextqp was at least valid when
5797 * we got it. Hopefully the entersq of the driver
5798 * will prevent it from changing on us.
5799 */
5800 if ((nextqp != NULL) && (STREAM(nextqp) != stp)) {
5801 ASSERT(qp->q_qinfo->qi_srvp);
5802 ASSERT(_OTHERQ(qp)->q_qinfo->qi_srvp);
5803 ASSERT(_OTHERQ(qp->q_next)->q_qinfo->qi_srvp);
5804 claimstr(nextqp);
5805
5806 /* Make sure we still have a q_next */
5807 if (nextqp != qp->q_next) {
5808 releasestr(stp->sd_wrq);
5809 releasestr(nextqp);
5810 return (EINVAL);
5811 }
5812
5813 qp = _RD(STREAM(nextqp)->sd_wrq);
5814 mate = qp;
5815 }
5816 /* If we entered the synq above, leave it. */
5817 if (sq != NULL)
5818 leavesq(sq, SQ_PUT);
5819 } /* STRMATED(STP) */
5820
5821 /* XXX prevents substitution of the ops vector */
5822 if (qp->q_qinfo != &strdata && qp->q_qinfo != &fifo_strdata) {
5823 retval = EINVAL;
5824 goto out;
5825 }
5826
5827 if (qp->q_flag & QFULL) {
5828 retval = EAGAIN;
5829 goto out;
5830 }
5831
5832 /*
5833 * Since M_PASSFP messages include a file descriptor, we use
5834 * esballoc() and specify a custom free routine (free_passfp()) that
5835 * will close the descriptor as part of freeing the message. For
5836 * convenience, we stash the frtn_t right after the data block.
5837 */
5838 bufsize = sizeof (struct k_strrecvfd) + sizeof (frtn_t);
5839 srf = kmem_alloc(bufsize, KM_NOSLEEP);
5840 if (srf == NULL) {
5841 retval = EAGAIN;
5842 goto out;
5843 }
5844
5845 frtnp = (frtn_t *)(srf + 1);
5846 frtnp->free_arg = (caddr_t)srf;
5847 frtnp->free_func = free_passfp;
5848
5849 mp = esballoc((uchar_t *)srf, bufsize, BPRI_MED, frtnp);
5850 if (mp == NULL) {
5851 kmem_free(srf, bufsize);
5852 retval = EAGAIN;
5853 goto out;
5854 }
5855 mp->b_wptr += sizeof (struct k_strrecvfd);
5856 mp->b_datap->db_type = M_PASSFP;
5857
5858 srf->fp = fp;
5859 srf->uid = crgetuid(curthread->t_cred);
5860 srf->gid = crgetgid(curthread->t_cred);
5861 mutex_enter(&fp->f_tlock);
5862 fp->f_count++;
5863 mutex_exit(&fp->f_tlock);
5864
5865 put(qp, mp);
5866 out:
5867 releasestr(stp->sd_wrq);
5868 if (mate)
5869 releasestr(mate);
5870 return (retval);
5871 }
5872
5873 /*
5874 * Send an ioctl message downstream and wait for acknowledgement.
5875 * flags may be set to either U_TO_K or K_TO_K and a combination
5876 * of STR_NOERROR or STR_NOSIG
5877 * STR_NOSIG: Signals are essentially ignored or held and have
5878 * no effect for the duration of the call.
5879 * STR_NOERROR: Ignores stream head read, write and hup errors.
5880 * Additionally, if an existing ioctl times out, it is assumed
5881 * lost and and this ioctl will continue as if the previous ioctl had
5882 * finished. ETIME may be returned if this ioctl times out (i.e.
5883 * ic_timout is not INFTIM). Non-stream head errors may be returned if
5884 * the ioc_error indicates that the driver/module had problems,
5885 * an EFAULT was found when accessing user data, a lack of
5886 * resources, etc.
5887 */
5888 int
5889 strdoioctl(
5890 struct stdata *stp,
5891 struct strioctl *strioc,
5892 int fflags, /* file flags with model info */
5893 int flag,
5894 cred_t *crp,
5895 int *rvalp)
5896 {
5897 mblk_t *bp;
5898 struct iocblk *iocbp;
5899 struct copyreq *reqp;
5900 struct copyresp *resp;
5901 int id;
5902 int transparent = 0;
5903 int error = 0;
5904 int len = 0;
5905 caddr_t taddr;
5906 int copyflag = (flag & (U_TO_K | K_TO_K));
5907 int sigflag = (flag & STR_NOSIG);
5908 int errs;
5909 uint_t waitflags;
5910 boolean_t set_iocwaitne = B_FALSE;
5911
5912 ASSERT(copyflag == U_TO_K || copyflag == K_TO_K);
5913 ASSERT((fflags & FMODELS) != 0);
5914
5915 TRACE_2(TR_FAC_STREAMS_FR,
5916 TR_STRDOIOCTL,
5917 "strdoioctl:stp %p strioc %p", stp, strioc);
5918 if (strioc->ic_len == TRANSPARENT) { /* send arg in M_DATA block */
5919 transparent = 1;
5920 strioc->ic_len = sizeof (intptr_t);
5921 }
5922
5923 if (strioc->ic_len < 0 || (strmsgsz > 0 && strioc->ic_len > strmsgsz))
5924 return (EINVAL);
5925
5926 if ((bp = allocb_cred_wait(sizeof (union ioctypes), sigflag, &error,
5927 crp, curproc->p_pid)) == NULL)
5928 return (error);
5929
5930 bzero(bp->b_wptr, sizeof (union ioctypes));
5931
5932 iocbp = (struct iocblk *)bp->b_wptr;
5933 iocbp->ioc_count = strioc->ic_len;
5934 iocbp->ioc_cmd = strioc->ic_cmd;
5935 iocbp->ioc_flag = (fflags & FMODELS);
5936
5937 crhold(crp);
5938 iocbp->ioc_cr = crp;
5939 DB_TYPE(bp) = M_IOCTL;
5940 bp->b_wptr += sizeof (struct iocblk);
5941
5942 if (flag & STR_NOERROR)
5943 errs = STPLEX;
5944 else
5945 errs = STRHUP|STRDERR|STWRERR|STPLEX;
5946
5947 /*
5948 * If there is data to copy into ioctl block, do so.
5949 */
5950 if (iocbp->ioc_count > 0) {
5951 if (transparent)
5952 /*
5953 * Note: STR_NOERROR does not have an effect
5954 * in putiocd()
5955 */
5956 id = K_TO_K | sigflag;
5957 else
5958 id = flag;
5959 if ((error = putiocd(bp, strioc->ic_dp, id, crp)) != 0) {
5960 freemsg(bp);
5961 crfree(crp);
5962 return (error);
5963 }
5964
5965 /*
5966 * We could have slept copying in user pages.
5967 * Recheck the stream head state (the other end
5968 * of a pipe could have gone away).
5969 */
5970 if (stp->sd_flag & errs) {
5971 mutex_enter(&stp->sd_lock);
5972 error = strgeterr(stp, errs, 0);
5973 mutex_exit(&stp->sd_lock);
5974 if (error != 0) {
5975 freemsg(bp);
5976 crfree(crp);
5977 return (error);
5978 }
5979 }
5980 }
5981 if (transparent)
5982 iocbp->ioc_count = TRANSPARENT;
5983
5984 /*
5985 * Block for up to STRTIMOUT milliseconds if there is an outstanding
5986 * ioctl for this stream already running. All processes
5987 * sleeping here will be awakened as a result of an ACK
5988 * or NAK being received for the outstanding ioctl, or
5989 * as a result of the timer expiring on the outstanding
5990 * ioctl (a failure), or as a result of any waiting
5991 * process's timer expiring (also a failure).
5992 */
5993
5994 error = 0;
5995 mutex_enter(&stp->sd_lock);
5996 while ((stp->sd_flag & IOCWAIT) ||
5997 (!set_iocwaitne && (stp->sd_flag & IOCWAITNE))) {
5998 clock_t cv_rval;
5999
6000 TRACE_0(TR_FAC_STREAMS_FR,
6001 TR_STRDOIOCTL_WAIT,
6002 "strdoioctl sleeps - IOCWAIT");
6003 cv_rval = str_cv_wait(&stp->sd_iocmonitor, &stp->sd_lock,
6004 STRTIMOUT, sigflag);
6005 if (cv_rval <= 0) {
6006 if (cv_rval == 0) {
6007 error = EINTR;
6008 } else {
6009 if (flag & STR_NOERROR) {
6010 /*
6011 * Terminating current ioctl in
6012 * progress -- assume it got lost and
6013 * wake up the other thread so that the
6014 * operation completes.
6015 */
6016 if (!(stp->sd_flag & IOCWAITNE)) {
6017 set_iocwaitne = B_TRUE;
6018 stp->sd_flag |= IOCWAITNE;
6019 cv_broadcast(&stp->sd_monitor);
6020 }
6021 /*
6022 * Otherwise, there's a running
6023 * STR_NOERROR -- we have no choice
6024 * here but to wait forever (or until
6025 * interrupted).
6026 */
6027 } else {
6028 /*
6029 * pending ioctl has caused
6030 * us to time out
6031 */
6032 error = ETIME;
6033 }
6034 }
6035 } else if ((stp->sd_flag & errs)) {
6036 error = strgeterr(stp, errs, 0);
6037 }
6038 if (error) {
6039 mutex_exit(&stp->sd_lock);
6040 freemsg(bp);
6041 crfree(crp);
6042 return (error);
6043 }
6044 }
6045
6046 /*
6047 * Have control of ioctl mechanism.
6048 * Send down ioctl packet and wait for response.
6049 */
6050 if (stp->sd_iocblk != (mblk_t *)-1) {
6051 freemsg(stp->sd_iocblk);
6052 }
6053 stp->sd_iocblk = NULL;
6054
6055 /*
6056 * If this is marked with 'noerror' (internal; mostly
6057 * I_{P,}{UN,}LINK), then make sure nobody else is able to get
6058 * in here by setting IOCWAITNE.
6059 */
6060 waitflags = IOCWAIT;
6061 if (flag & STR_NOERROR)
6062 waitflags |= IOCWAITNE;
6063
6064 stp->sd_flag |= waitflags;
6065
6066 /*
6067 * Assign sequence number.
6068 */
6069 iocbp->ioc_id = stp->sd_iocid = getiocseqno();
6070
6071 mutex_exit(&stp->sd_lock);
6072
6073 TRACE_1(TR_FAC_STREAMS_FR,
6074 TR_STRDOIOCTL_PUT, "strdoioctl put: stp %p", stp);
6075 stream_willservice(stp);
6076 putnext(stp->sd_wrq, bp);
6077 stream_runservice(stp);
6078
6079 /*
6080 * Timed wait for acknowledgment. The wait time is limited by the
6081 * timeout value, which must be a positive integer (number of
6082 * milliseconds) to wait, or 0 (use default value of STRTIMOUT
6083 * milliseconds), or -1 (wait forever). This will be awakened
6084 * either by an ACK/NAK message arriving, the timer expiring, or
6085 * the timer expiring on another ioctl waiting for control of the
6086 * mechanism.
6087 */
6088 waitioc:
6089 mutex_enter(&stp->sd_lock);
6090
6091
6092 /*
6093 * If the reply has already arrived, don't sleep. If awakened from
6094 * the sleep, fail only if the reply has not arrived by then.
6095 * Otherwise, process the reply.
6096 */
6097 while (!stp->sd_iocblk) {
6098 clock_t cv_rval;
6099
6100 if (stp->sd_flag & errs) {
6101 error = strgeterr(stp, errs, 0);
6102 if (error != 0) {
6103 stp->sd_flag &= ~waitflags;
6104 cv_broadcast(&stp->sd_iocmonitor);
6105 mutex_exit(&stp->sd_lock);
6106 crfree(crp);
6107 return (error);
6108 }
6109 }
6110
6111 TRACE_0(TR_FAC_STREAMS_FR,
6112 TR_STRDOIOCTL_WAIT2,
6113 "strdoioctl sleeps awaiting reply");
6114 ASSERT(error == 0);
6115
6116 cv_rval = str_cv_wait(&stp->sd_monitor, &stp->sd_lock,
6117 (strioc->ic_timout ?
6118 strioc->ic_timout * 1000 : STRTIMOUT), sigflag);
6119
6120 /*
6121 * There are four possible cases here: interrupt, timeout,
6122 * wakeup by IOCWAITNE (above), or wakeup by strrput_nondata (a
6123 * valid M_IOCTL reply).
6124 *
6125 * If we've been awakened by a STR_NOERROR ioctl on some other
6126 * thread, then sd_iocblk will still be NULL, and IOCWAITNE
6127 * will be set. Pretend as if we just timed out. Note that
6128 * this other thread waited at least STRTIMOUT before trying to
6129 * awaken our thread, so this is indistinguishable (even for
6130 * INFTIM) from the case where we failed with ETIME waiting on
6131 * IOCWAIT in the prior loop.
6132 */
6133 if (cv_rval > 0 && !(flag & STR_NOERROR) &&
6134 stp->sd_iocblk == NULL && (stp->sd_flag & IOCWAITNE)) {
6135 cv_rval = -1;
6136 }
6137
6138 /*
6139 * note: STR_NOERROR does not protect
6140 * us here.. use ic_timout < 0
6141 */
6142 if (cv_rval <= 0) {
6143 if (cv_rval == 0) {
6144 error = EINTR;
6145 } else {
6146 error = ETIME;
6147 }
6148 /*
6149 * A message could have come in after we were scheduled
6150 * but before we were actually run.
6151 */
6152 bp = stp->sd_iocblk;
6153 stp->sd_iocblk = NULL;
6154 if (bp != NULL) {
6155 if ((bp->b_datap->db_type == M_COPYIN) ||
6156 (bp->b_datap->db_type == M_COPYOUT)) {
6157 mutex_exit(&stp->sd_lock);
6158 if (bp->b_cont) {
6159 freemsg(bp->b_cont);
6160 bp->b_cont = NULL;
6161 }
6162 bp->b_datap->db_type = M_IOCDATA;
6163 bp->b_wptr = bp->b_rptr +
6164 sizeof (struct copyresp);
6165 resp = (struct copyresp *)bp->b_rptr;
6166 resp->cp_rval =
6167 (caddr_t)1; /* failure */
6168 stream_willservice(stp);
6169 putnext(stp->sd_wrq, bp);
6170 stream_runservice(stp);
6171 mutex_enter(&stp->sd_lock);
6172 } else {
6173 freemsg(bp);
6174 }
6175 }
6176 stp->sd_flag &= ~waitflags;
6177 cv_broadcast(&stp->sd_iocmonitor);
6178 mutex_exit(&stp->sd_lock);
6179 crfree(crp);
6180 return (error);
6181 }
6182 }
6183 bp = stp->sd_iocblk;
6184 /*
6185 * Note: it is strictly impossible to get here with sd_iocblk set to
6186 * -1. This is because the initial loop above doesn't allow any new
6187 * ioctls into the fray until all others have passed this point.
6188 */
6189 ASSERT(bp != NULL && bp != (mblk_t *)-1);
6190 TRACE_1(TR_FAC_STREAMS_FR,
6191 TR_STRDOIOCTL_ACK, "strdoioctl got reply: bp %p", bp);
6192 if ((bp->b_datap->db_type == M_IOCACK) ||
6193 (bp->b_datap->db_type == M_IOCNAK)) {
6194 /* for detection of duplicate ioctl replies */
6195 stp->sd_iocblk = (mblk_t *)-1;
6196 stp->sd_flag &= ~waitflags;
6197 cv_broadcast(&stp->sd_iocmonitor);
6198 mutex_exit(&stp->sd_lock);
6199 } else {
6200 /*
6201 * flags not cleared here because we're still doing
6202 * copy in/out for ioctl.
6203 */
6204 stp->sd_iocblk = NULL;
6205 mutex_exit(&stp->sd_lock);
6206 }
6207
6208
6209 /*
6210 * Have received acknowledgment.
6211 */
6212
6213 switch (bp->b_datap->db_type) {
6214 case M_IOCACK:
6215 /*
6216 * Positive ack.
6217 */
6218 iocbp = (struct iocblk *)bp->b_rptr;
6219
6220 /*
6221 * Set error if indicated.
6222 */
6223 if (iocbp->ioc_error) {
6224 error = iocbp->ioc_error;
6225 break;
6226 }
6227
6228 /*
6229 * Set return value.
6230 */
6231 *rvalp = iocbp->ioc_rval;
6232
6233 /*
6234 * Data may have been returned in ACK message (ioc_count > 0).
6235 * If so, copy it out to the user's buffer.
6236 */
6237 if (iocbp->ioc_count && !transparent) {
6238 if (error = getiocd(bp, strioc->ic_dp, copyflag))
6239 break;
6240 }
6241 if (!transparent) {
6242 if (len) /* an M_COPYOUT was used with I_STR */
6243 strioc->ic_len = len;
6244 else
6245 strioc->ic_len = (int)iocbp->ioc_count;
6246 }
6247 break;
6248
6249 case M_IOCNAK:
6250 /*
6251 * Negative ack.
6252 *
6253 * The only thing to do is set error as specified
6254 * in neg ack packet.
6255 */
6256 iocbp = (struct iocblk *)bp->b_rptr;
6257
6258 error = (iocbp->ioc_error ? iocbp->ioc_error : EINVAL);
6259 break;
6260
6261 case M_COPYIN:
6262 /*
6263 * Driver or module has requested user ioctl data.
6264 */
6265 reqp = (struct copyreq *)bp->b_rptr;
6266
6267 /*
6268 * M_COPYIN should *never* have a message attached, though
6269 * it's harmless if it does -- thus, panic on a DEBUG
6270 * kernel and just free it on a non-DEBUG build.
6271 */
6272 ASSERT(bp->b_cont == NULL);
6273 if (bp->b_cont != NULL) {
6274 freemsg(bp->b_cont);
6275 bp->b_cont = NULL;
6276 }
6277
6278 error = putiocd(bp, reqp->cq_addr, flag, crp);
6279 if (error && bp->b_cont) {
6280 freemsg(bp->b_cont);
6281 bp->b_cont = NULL;
6282 }
6283
6284 bp->b_wptr = bp->b_rptr + sizeof (struct copyresp);
6285 bp->b_datap->db_type = M_IOCDATA;
6286
6287 mblk_setcred(bp, crp, curproc->p_pid);
6288 resp = (struct copyresp *)bp->b_rptr;
6289 resp->cp_rval = (caddr_t)(uintptr_t)error;
6290 resp->cp_flag = (fflags & FMODELS);
6291
6292 stream_willservice(stp);
6293 putnext(stp->sd_wrq, bp);
6294 stream_runservice(stp);
6295
6296 if (error) {
6297 mutex_enter(&stp->sd_lock);
6298 stp->sd_flag &= ~waitflags;
6299 cv_broadcast(&stp->sd_iocmonitor);
6300 mutex_exit(&stp->sd_lock);
6301 crfree(crp);
6302 return (error);
6303 }
6304
6305 goto waitioc;
6306
6307 case M_COPYOUT:
6308 /*
6309 * Driver or module has ioctl data for a user.
6310 */
6311 reqp = (struct copyreq *)bp->b_rptr;
6312 ASSERT(bp->b_cont != NULL);
6313
6314 /*
6315 * Always (transparent or non-transparent )
6316 * use the address specified in the request
6317 */
6318 taddr = reqp->cq_addr;
6319 if (!transparent)
6320 len = (int)reqp->cq_size;
6321
6322 /* copyout data to the provided address */
6323 error = getiocd(bp, taddr, copyflag);
6324
6325 freemsg(bp->b_cont);
6326 bp->b_cont = NULL;
6327
6328 bp->b_wptr = bp->b_rptr + sizeof (struct copyresp);
6329 bp->b_datap->db_type = M_IOCDATA;
6330
6331 mblk_setcred(bp, crp, curproc->p_pid);
6332 resp = (struct copyresp *)bp->b_rptr;
6333 resp->cp_rval = (caddr_t)(uintptr_t)error;
6334 resp->cp_flag = (fflags & FMODELS);
6335
6336 stream_willservice(stp);
6337 putnext(stp->sd_wrq, bp);
6338 stream_runservice(stp);
6339
6340 if (error) {
6341 mutex_enter(&stp->sd_lock);
6342 stp->sd_flag &= ~waitflags;
6343 cv_broadcast(&stp->sd_iocmonitor);
6344 mutex_exit(&stp->sd_lock);
6345 crfree(crp);
6346 return (error);
6347 }
6348 goto waitioc;
6349
6350 default:
6351 ASSERT(0);
6352 mutex_enter(&stp->sd_lock);
6353 stp->sd_flag &= ~waitflags;
6354 cv_broadcast(&stp->sd_iocmonitor);
6355 mutex_exit(&stp->sd_lock);
6356 break;
6357 }
6358
6359 freemsg(bp);
6360 crfree(crp);
6361 return (error);
6362 }
6363
6364 /*
6365 * Send an M_CMD message downstream and wait for a reply. This is a ptools
6366 * special used to retrieve information from modules/drivers a stream without
6367 * being subjected to flow control or interfering with pending messages on the
6368 * stream (e.g. an ioctl in flight).
6369 */
6370 int
6371 strdocmd(struct stdata *stp, struct strcmd *scp, cred_t *crp)
6372 {
6373 mblk_t *mp;
6374 struct cmdblk *cmdp;
6375 int error = 0;
6376 int errs = STRHUP|STRDERR|STWRERR|STPLEX;
6377 clock_t rval, timeout = STRTIMOUT;
6378
6379 if (scp->sc_len < 0 || scp->sc_len > sizeof (scp->sc_buf) ||
6380 scp->sc_timeout < -1)
6381 return (EINVAL);
6382
6383 if (scp->sc_timeout > 0)
6384 timeout = scp->sc_timeout * MILLISEC;
6385
6386 if ((mp = allocb_cred(sizeof (struct cmdblk), crp,
6387 curproc->p_pid)) == NULL)
6388 return (ENOMEM);
6389
6390 crhold(crp);
6391
6392 cmdp = (struct cmdblk *)mp->b_wptr;
6393 cmdp->cb_cr = crp;
6394 cmdp->cb_cmd = scp->sc_cmd;
6395 cmdp->cb_len = scp->sc_len;
6396 cmdp->cb_error = 0;
6397 mp->b_wptr += sizeof (struct cmdblk);
6398
6399 DB_TYPE(mp) = M_CMD;
6400 DB_CPID(mp) = curproc->p_pid;
6401
6402 /*
6403 * Copy in the payload.
6404 */
6405 if (cmdp->cb_len > 0) {
6406 mp->b_cont = allocb_cred(sizeof (scp->sc_buf), crp,
6407 curproc->p_pid);
6408 if (mp->b_cont == NULL) {
6409 error = ENOMEM;
6410 goto out;
6411 }
6412
6413 /* cb_len comes from sc_len, which has already been checked */
6414 ASSERT(cmdp->cb_len <= sizeof (scp->sc_buf));
6415 (void) bcopy(scp->sc_buf, mp->b_cont->b_wptr, cmdp->cb_len);
6416 mp->b_cont->b_wptr += cmdp->cb_len;
6417 DB_CPID(mp->b_cont) = curproc->p_pid;
6418 }
6419
6420 /*
6421 * Since this mechanism is strictly for ptools, and since only one
6422 * process can be grabbed at a time, we simply fail if there's
6423 * currently an operation pending.
6424 */
6425 mutex_enter(&stp->sd_lock);
6426 if (stp->sd_flag & STRCMDWAIT) {
6427 mutex_exit(&stp->sd_lock);
6428 error = EBUSY;
6429 goto out;
6430 }
6431 stp->sd_flag |= STRCMDWAIT;
6432 ASSERT(stp->sd_cmdblk == NULL);
6433 mutex_exit(&stp->sd_lock);
6434
6435 putnext(stp->sd_wrq, mp);
6436 mp = NULL;
6437
6438 /*
6439 * Timed wait for acknowledgment. If the reply has already arrived,
6440 * don't sleep. If awakened from the sleep, fail only if the reply
6441 * has not arrived by then. Otherwise, process the reply.
6442 */
6443 mutex_enter(&stp->sd_lock);
6444 while (stp->sd_cmdblk == NULL) {
6445 if (stp->sd_flag & errs) {
6446 if ((error = strgeterr(stp, errs, 0)) != 0)
6447 goto waitout;
6448 }
6449
6450 rval = str_cv_wait(&stp->sd_monitor, &stp->sd_lock, timeout, 0);
6451 if (stp->sd_cmdblk != NULL)
6452 break;
6453
6454 if (rval <= 0) {
6455 error = (rval == 0) ? EINTR : ETIME;
6456 goto waitout;
6457 }
6458 }
6459
6460 /*
6461 * We received a reply.
6462 */
6463 mp = stp->sd_cmdblk;
6464 stp->sd_cmdblk = NULL;
6465 ASSERT(mp != NULL && DB_TYPE(mp) == M_CMD);
6466 ASSERT(stp->sd_flag & STRCMDWAIT);
6467 stp->sd_flag &= ~STRCMDWAIT;
6468 mutex_exit(&stp->sd_lock);
6469
6470 cmdp = (struct cmdblk *)mp->b_rptr;
6471 if ((error = cmdp->cb_error) != 0)
6472 goto out;
6473
6474 /*
6475 * Data may have been returned in the reply (cb_len > 0).
6476 * If so, copy it out to the user's buffer.
6477 */
6478 if (cmdp->cb_len > 0) {
6479 if (mp->b_cont == NULL || MBLKL(mp->b_cont) < cmdp->cb_len) {
6480 error = EPROTO;
6481 goto out;
6482 }
6483
6484 cmdp->cb_len = MIN(cmdp->cb_len, sizeof (scp->sc_buf));
6485 (void) bcopy(mp->b_cont->b_rptr, scp->sc_buf, cmdp->cb_len);
6486 }
6487 scp->sc_len = cmdp->cb_len;
6488 out:
6489 freemsg(mp);
6490 crfree(crp);
6491 return (error);
6492 waitout:
6493 ASSERT(stp->sd_cmdblk == NULL);
6494 stp->sd_flag &= ~STRCMDWAIT;
6495 mutex_exit(&stp->sd_lock);
6496 crfree(crp);
6497 return (error);
6498 }
6499
6500 /*
6501 * For the SunOS keyboard driver.
6502 * Return the next available "ioctl" sequence number.
6503 * Exported, so that streams modules can send "ioctl" messages
6504 * downstream from their open routine.
6505 */
6506 int
6507 getiocseqno(void)
6508 {
6509 int i;
6510
6511 mutex_enter(&strresources);
6512 i = ++ioc_id;
6513 mutex_exit(&strresources);
6514 return (i);
6515 }
6516
6517 /*
6518 * Get the next message from the read queue. If the message is
6519 * priority, STRPRI will have been set by strrput(). This flag
6520 * should be reset only when the entire message at the front of the
6521 * queue as been consumed.
6522 *
6523 * NOTE: strgetmsg and kstrgetmsg have much of the logic in common.
6524 */
6525 int
6526 strgetmsg(
6527 struct vnode *vp,
6528 struct strbuf *mctl,
6529 struct strbuf *mdata,
6530 unsigned char *prip,
6531 int *flagsp,
6532 int fmode,
6533 rval_t *rvp)
6534 {
6535 struct stdata *stp;
6536 mblk_t *bp, *nbp;
6537 mblk_t *savemp = NULL;
6538 mblk_t *savemptail = NULL;
6539 uint_t old_sd_flag;
6540 int flg;
6541 int more = 0;
6542 int error = 0;
6543 char first = 1;
6544 uint_t mark; /* Contains MSG*MARK and _LASTMARK */
6545 #define _LASTMARK 0x8000 /* Distinct from MSG*MARK */
6546 unsigned char pri = 0;
6547 queue_t *q;
6548 int pr = 0; /* Partial read successful */
6549 struct uio uios;
6550 struct uio *uiop = &uios;
6551 struct iovec iovs;
6552 unsigned char type;
6553
6554 TRACE_1(TR_FAC_STREAMS_FR, TR_STRGETMSG_ENTER,
6555 "strgetmsg:%p", vp);
6556
6557 ASSERT(vp->v_stream);
6558 stp = vp->v_stream;
6559 rvp->r_val1 = 0;
6560
6561 mutex_enter(&stp->sd_lock);
6562
6563 if ((error = i_straccess(stp, JCREAD)) != 0) {
6564 mutex_exit(&stp->sd_lock);
6565 return (error);
6566 }
6567
6568 if (stp->sd_flag & (STRDERR|STPLEX)) {
6569 error = strgeterr(stp, STRDERR|STPLEX, 0);
6570 if (error != 0) {
6571 mutex_exit(&stp->sd_lock);
6572 return (error);
6573 }
6574 }
6575 mutex_exit(&stp->sd_lock);
6576
6577 switch (*flagsp) {
6578 case MSG_HIPRI:
6579 if (*prip != 0)
6580 return (EINVAL);
6581 break;
6582
6583 case MSG_ANY:
6584 case MSG_BAND:
6585 break;
6586
6587 default:
6588 return (EINVAL);
6589 }
6590 /*
6591 * Setup uio and iov for data part
6592 */
6593 iovs.iov_base = mdata->buf;
6594 iovs.iov_len = mdata->maxlen;
6595 uios.uio_iov = &iovs;
6596 uios.uio_iovcnt = 1;
6597 uios.uio_loffset = 0;
6598 uios.uio_segflg = UIO_USERSPACE;
6599 uios.uio_fmode = 0;
6600 uios.uio_extflg = UIO_COPY_CACHED;
6601 uios.uio_resid = mdata->maxlen;
6602 uios.uio_offset = 0;
6603
6604 q = _RD(stp->sd_wrq);
6605 mutex_enter(&stp->sd_lock);
6606 old_sd_flag = stp->sd_flag;
6607 mark = 0;
6608 for (;;) {
6609 int done = 0;
6610 mblk_t *q_first = q->q_first;
6611
6612 /*
6613 * Get the next message of appropriate priority
6614 * from the stream head. If the caller is interested
6615 * in band or hipri messages, then they should already
6616 * be enqueued at the stream head. On the other hand
6617 * if the caller wants normal (band 0) messages, they
6618 * might be deferred in a synchronous stream and they
6619 * will need to be pulled up.
6620 *
6621 * After we have dequeued a message, we might find that
6622 * it was a deferred M_SIG that was enqueued at the
6623 * stream head. It must now be posted as part of the
6624 * read by calling strsignal_nolock().
6625 *
6626 * Also note that strrput does not enqueue an M_PCSIG,
6627 * and there cannot be more than one hipri message,
6628 * so there was no need to have the M_PCSIG case.
6629 *
6630 * At some time it might be nice to try and wrap the
6631 * functionality of kstrgetmsg() and strgetmsg() into
6632 * a common routine so to reduce the amount of replicated
6633 * code (since they are extremely similar).
6634 */
6635 if (!(*flagsp & (MSG_HIPRI|MSG_BAND))) {
6636 /* Asking for normal, band0 data */
6637 bp = strget(stp, q, uiop, first, &error);
6638 ASSERT(MUTEX_HELD(&stp->sd_lock));
6639 if (bp != NULL) {
6640 if (DB_TYPE(bp) == M_SIG) {
6641 strsignal_nolock(stp, *bp->b_rptr,
6642 bp->b_band);
6643 freemsg(bp);
6644 continue;
6645 } else {
6646 break;
6647 }
6648 }
6649 if (error != 0)
6650 goto getmout;
6651
6652 /*
6653 * We can't depend on the value of STRPRI here because
6654 * the stream head may be in transit. Therefore, we
6655 * must look at the type of the first message to
6656 * determine if a high priority messages is waiting
6657 */
6658 } else if ((*flagsp & MSG_HIPRI) && q_first != NULL &&
6659 DB_TYPE(q_first) >= QPCTL &&
6660 (bp = getq_noenab(q, 0)) != NULL) {
6661 /* Asked for HIPRI and got one */
6662 ASSERT(DB_TYPE(bp) >= QPCTL);
6663 break;
6664 } else if ((*flagsp & MSG_BAND) && q_first != NULL &&
6665 ((q_first->b_band >= *prip) || DB_TYPE(q_first) >= QPCTL) &&
6666 (bp = getq_noenab(q, 0)) != NULL) {
6667 /*
6668 * Asked for at least band "prip" and got either at
6669 * least that band or a hipri message.
6670 */
6671 ASSERT(bp->b_band >= *prip || DB_TYPE(bp) >= QPCTL);
6672 if (DB_TYPE(bp) == M_SIG) {
6673 strsignal_nolock(stp, *bp->b_rptr, bp->b_band);
6674 freemsg(bp);
6675 continue;
6676 } else {
6677 break;
6678 }
6679 }
6680
6681 /* No data. Time to sleep? */
6682 qbackenable(q, 0);
6683
6684 /*
6685 * If STRHUP or STREOF, return 0 length control and data.
6686 * If resid is 0, then a read(fd,buf,0) was done. Do not
6687 * sleep to satisfy this request because by default we have
6688 * zero bytes to return.
6689 */
6690 if ((stp->sd_flag & (STRHUP|STREOF)) || (mctl->maxlen == 0 &&
6691 mdata->maxlen == 0)) {
6692 mctl->len = mdata->len = 0;
6693 *flagsp = 0;
6694 mutex_exit(&stp->sd_lock);
6695 return (0);
6696 }
6697 TRACE_2(TR_FAC_STREAMS_FR, TR_STRGETMSG_WAIT,
6698 "strgetmsg calls strwaitq:%p, %p",
6699 vp, uiop);
6700 if (((error = strwaitq(stp, GETWAIT, (ssize_t)0, fmode, -1,
6701 &done)) != 0) || done) {
6702 TRACE_2(TR_FAC_STREAMS_FR, TR_STRGETMSG_DONE,
6703 "strgetmsg error or done:%p, %p",
6704 vp, uiop);
6705 mutex_exit(&stp->sd_lock);
6706 return (error);
6707 }
6708 TRACE_2(TR_FAC_STREAMS_FR, TR_STRGETMSG_AWAKE,
6709 "strgetmsg awakes:%p, %p", vp, uiop);
6710 if ((error = i_straccess(stp, JCREAD)) != 0) {
6711 mutex_exit(&stp->sd_lock);
6712 return (error);
6713 }
6714 first = 0;
6715 }
6716 ASSERT(bp != NULL);
6717 /*
6718 * Extract any mark information. If the message is not completely
6719 * consumed this information will be put in the mblk
6720 * that is putback.
6721 * If MSGMARKNEXT is set and the message is completely consumed
6722 * the STRATMARK flag will be set below. Likewise, if
6723 * MSGNOTMARKNEXT is set and the message is
6724 * completely consumed STRNOTATMARK will be set.
6725 */
6726 mark = bp->b_flag & (MSGMARK | MSGMARKNEXT | MSGNOTMARKNEXT);
6727 ASSERT((mark & (MSGMARKNEXT|MSGNOTMARKNEXT)) !=
6728 (MSGMARKNEXT|MSGNOTMARKNEXT));
6729 if (mark != 0 && bp == stp->sd_mark) {
6730 mark |= _LASTMARK;
6731 stp->sd_mark = NULL;
6732 }
6733 /*
6734 * keep track of the original message type and priority
6735 */
6736 pri = bp->b_band;
6737 type = bp->b_datap->db_type;
6738 if (type == M_PASSFP) {
6739 if ((mark & _LASTMARK) && (stp->sd_mark == NULL))
6740 stp->sd_mark = bp;
6741 bp->b_flag |= mark & ~_LASTMARK;
6742 putback(stp, q, bp, pri);
6743 qbackenable(q, pri);
6744 mutex_exit(&stp->sd_lock);
6745 return (EBADMSG);
6746 }
6747 ASSERT(type != M_SIG);
6748
6749 /*
6750 * Set this flag so strrput will not generate signals. Need to
6751 * make sure this flag is cleared before leaving this routine
6752 * else signals will stop being sent.
6753 */
6754 stp->sd_flag |= STRGETINPROG;
6755 mutex_exit(&stp->sd_lock);
6756
6757 if (STREAM_NEEDSERVICE(stp))
6758 stream_runservice(stp);
6759
6760 /*
6761 * Set HIPRI flag if message is priority.
6762 */
6763 if (type >= QPCTL)
6764 flg = MSG_HIPRI;
6765 else
6766 flg = MSG_BAND;
6767
6768 /*
6769 * First process PROTO or PCPROTO blocks, if any.
6770 */
6771 if (mctl->maxlen >= 0 && type != M_DATA) {
6772 size_t n, bcnt;
6773 char *ubuf;
6774
6775 bcnt = mctl->maxlen;
6776 ubuf = mctl->buf;
6777 while (bp != NULL && bp->b_datap->db_type != M_DATA) {
6778 if ((n = MIN(bcnt, bp->b_wptr - bp->b_rptr)) != 0 &&
6779 copyout(bp->b_rptr, ubuf, n)) {
6780 error = EFAULT;
6781 mutex_enter(&stp->sd_lock);
6782 /*
6783 * clear stream head pri flag based on
6784 * first message type
6785 */
6786 if (type >= QPCTL) {
6787 ASSERT(type == M_PCPROTO);
6788 stp->sd_flag &= ~STRPRI;
6789 }
6790 more = 0;
6791 freemsg(bp);
6792 goto getmout;
6793 }
6794 ubuf += n;
6795 bp->b_rptr += n;
6796 if (bp->b_rptr >= bp->b_wptr) {
6797 nbp = bp;
6798 bp = bp->b_cont;
6799 freeb(nbp);
6800 }
6801 ASSERT(n <= bcnt);
6802 bcnt -= n;
6803 if (bcnt == 0)
6804 break;
6805 }
6806 mctl->len = mctl->maxlen - bcnt;
6807 } else
6808 mctl->len = -1;
6809
6810 if (bp && bp->b_datap->db_type != M_DATA) {
6811 /*
6812 * More PROTO blocks in msg.
6813 */
6814 more |= MORECTL;
6815 savemp = bp;
6816 while (bp && bp->b_datap->db_type != M_DATA) {
6817 savemptail = bp;
6818 bp = bp->b_cont;
6819 }
6820 savemptail->b_cont = NULL;
6821 }
6822
6823 /*
6824 * Now process DATA blocks, if any.
6825 */
6826 if (mdata->maxlen >= 0 && bp) {
6827 /*
6828 * struiocopyout will consume a potential zero-length
6829 * M_DATA even if uio_resid is zero.
6830 */
6831 size_t oldresid = uiop->uio_resid;
6832
6833 bp = struiocopyout(bp, uiop, &error);
6834 if (error != 0) {
6835 mutex_enter(&stp->sd_lock);
6836 /*
6837 * clear stream head hi pri flag based on
6838 * first message
6839 */
6840 if (type >= QPCTL) {
6841 ASSERT(type == M_PCPROTO);
6842 stp->sd_flag &= ~STRPRI;
6843 }
6844 more = 0;
6845 freemsg(savemp);
6846 goto getmout;
6847 }
6848 /*
6849 * (pr == 1) indicates a partial read.
6850 */
6851 if (oldresid > uiop->uio_resid)
6852 pr = 1;
6853 mdata->len = mdata->maxlen - uiop->uio_resid;
6854 } else
6855 mdata->len = -1;
6856
6857 if (bp) { /* more data blocks in msg */
6858 more |= MOREDATA;
6859 if (savemp)
6860 savemptail->b_cont = bp;
6861 else
6862 savemp = bp;
6863 }
6864
6865 mutex_enter(&stp->sd_lock);
6866 if (savemp) {
6867 if (pr && (savemp->b_datap->db_type == M_DATA) &&
6868 msgnodata(savemp)) {
6869 /*
6870 * Avoid queuing a zero-length tail part of
6871 * a message. pr=1 indicates that we read some of
6872 * the message.
6873 */
6874 freemsg(savemp);
6875 more &= ~MOREDATA;
6876 /*
6877 * clear stream head hi pri flag based on
6878 * first message
6879 */
6880 if (type >= QPCTL) {
6881 ASSERT(type == M_PCPROTO);
6882 stp->sd_flag &= ~STRPRI;
6883 }
6884 } else {
6885 savemp->b_band = pri;
6886 /*
6887 * If the first message was HIPRI and the one we're
6888 * putting back isn't, then clear STRPRI, otherwise
6889 * set STRPRI again. Note that we must set STRPRI
6890 * again since the flush logic in strrput_nondata()
6891 * may have cleared it while we had sd_lock dropped.
6892 */
6893 if (type >= QPCTL) {
6894 ASSERT(type == M_PCPROTO);
6895 if (queclass(savemp) < QPCTL)
6896 stp->sd_flag &= ~STRPRI;
6897 else
6898 stp->sd_flag |= STRPRI;
6899 } else if (queclass(savemp) >= QPCTL) {
6900 /*
6901 * The first message was not a HIPRI message,
6902 * but the one we are about to putback is.
6903 * For simplicitly, we do not allow for HIPRI
6904 * messages to be embedded in the message
6905 * body, so just force it to same type as
6906 * first message.
6907 */
6908 ASSERT(type == M_DATA || type == M_PROTO);
6909 ASSERT(savemp->b_datap->db_type == M_PCPROTO);
6910 savemp->b_datap->db_type = type;
6911 }
6912 if (mark != 0) {
6913 savemp->b_flag |= mark & ~_LASTMARK;
6914 if ((mark & _LASTMARK) &&
6915 (stp->sd_mark == NULL)) {
6916 /*
6917 * If another marked message arrived
6918 * while sd_lock was not held sd_mark
6919 * would be non-NULL.
6920 */
6921 stp->sd_mark = savemp;
6922 }
6923 }
6924 putback(stp, q, savemp, pri);
6925 }
6926 } else {
6927 /*
6928 * The complete message was consumed.
6929 *
6930 * If another M_PCPROTO arrived while sd_lock was not held
6931 * it would have been discarded since STRPRI was still set.
6932 *
6933 * Move the MSG*MARKNEXT information
6934 * to the stream head just in case
6935 * the read queue becomes empty.
6936 * clear stream head hi pri flag based on
6937 * first message
6938 *
6939 * If the stream head was at the mark
6940 * (STRATMARK) before we dropped sd_lock above
6941 * and some data was consumed then we have
6942 * moved past the mark thus STRATMARK is
6943 * cleared. However, if a message arrived in
6944 * strrput during the copyout above causing
6945 * STRATMARK to be set we can not clear that
6946 * flag.
6947 */
6948 if (type >= QPCTL) {
6949 ASSERT(type == M_PCPROTO);
6950 stp->sd_flag &= ~STRPRI;
6951 }
6952 if (mark & (MSGMARKNEXT|MSGNOTMARKNEXT|MSGMARK)) {
6953 if (mark & MSGMARKNEXT) {
6954 stp->sd_flag &= ~STRNOTATMARK;
6955 stp->sd_flag |= STRATMARK;
6956 } else if (mark & MSGNOTMARKNEXT) {
6957 stp->sd_flag &= ~STRATMARK;
6958 stp->sd_flag |= STRNOTATMARK;
6959 } else {
6960 stp->sd_flag &= ~(STRATMARK|STRNOTATMARK);
6961 }
6962 } else if (pr && (old_sd_flag & STRATMARK)) {
6963 stp->sd_flag &= ~STRATMARK;
6964 }
6965 }
6966
6967 *flagsp = flg;
6968 *prip = pri;
6969
6970 /*
6971 * Getmsg cleanup processing - if the state of the queue has changed
6972 * some signals may need to be sent and/or poll awakened.
6973 */
6974 getmout:
6975 qbackenable(q, pri);
6976
6977 /*
6978 * We dropped the stream head lock above. Send all M_SIG messages
6979 * before processing stream head for SIGPOLL messages.
6980 */
6981 ASSERT(MUTEX_HELD(&stp->sd_lock));
6982 while ((bp = q->q_first) != NULL &&
6983 (bp->b_datap->db_type == M_SIG)) {
6984 /*
6985 * sd_lock is held so the content of the read queue can not
6986 * change.
6987 */
6988 bp = getq(q);
6989 ASSERT(bp != NULL && bp->b_datap->db_type == M_SIG);
6990
6991 strsignal_nolock(stp, *bp->b_rptr, bp->b_band);
6992 mutex_exit(&stp->sd_lock);
6993 freemsg(bp);
6994 if (STREAM_NEEDSERVICE(stp))
6995 stream_runservice(stp);
6996 mutex_enter(&stp->sd_lock);
6997 }
6998
6999 /*
7000 * stream head cannot change while we make the determination
7001 * whether or not to send a signal. Drop the flag to allow strrput
7002 * to send firstmsgsigs again.
7003 */
7004 stp->sd_flag &= ~STRGETINPROG;
7005
7006 /*
7007 * If the type of message at the front of the queue changed
7008 * due to the receive the appropriate signals and pollwakeup events
7009 * are generated. The type of changes are:
7010 * Processed a hipri message, q_first is not hipri.
7011 * Processed a band X message, and q_first is band Y.
7012 * The generated signals and pollwakeups are identical to what
7013 * strrput() generates should the message that is now on q_first
7014 * arrive to an empty read queue.
7015 *
7016 * Note: only strrput will send a signal for a hipri message.
7017 */
7018 if ((bp = q->q_first) != NULL && !(stp->sd_flag & STRPRI)) {
7019 strsigset_t signals = 0;
7020 strpollset_t pollwakeups = 0;
7021
7022 if (flg & MSG_HIPRI) {
7023 /*
7024 * Removed a hipri message. Regular data at
7025 * the front of the queue.
7026 */
7027 if (bp->b_band == 0) {
7028 signals = S_INPUT | S_RDNORM;
7029 pollwakeups = POLLIN | POLLRDNORM;
7030 } else {
7031 signals = S_INPUT | S_RDBAND;
7032 pollwakeups = POLLIN | POLLRDBAND;
7033 }
7034 } else if (pri != bp->b_band) {
7035 /*
7036 * The band is different for the new q_first.
7037 */
7038 if (bp->b_band == 0) {
7039 signals = S_RDNORM;
7040 pollwakeups = POLLIN | POLLRDNORM;
7041 } else {
7042 signals = S_RDBAND;
7043 pollwakeups = POLLIN | POLLRDBAND;
7044 }
7045 }
7046
7047 if (pollwakeups != 0) {
7048 if (pollwakeups == (POLLIN | POLLRDNORM)) {
7049 if (!(stp->sd_rput_opt & SR_POLLIN))
7050 goto no_pollwake;
7051 stp->sd_rput_opt &= ~SR_POLLIN;
7052 }
7053 mutex_exit(&stp->sd_lock);
7054 pollwakeup(&stp->sd_pollist, pollwakeups);
7055 mutex_enter(&stp->sd_lock);
7056 }
7057 no_pollwake:
7058
7059 if (stp->sd_sigflags & signals)
7060 strsendsig(stp->sd_siglist, signals, bp->b_band, 0);
7061 }
7062 mutex_exit(&stp->sd_lock);
7063
7064 rvp->r_val1 = more;
7065 return (error);
7066 #undef _LASTMARK
7067 }
7068
7069 /*
7070 * Get the next message from the read queue. If the message is
7071 * priority, STRPRI will have been set by strrput(). This flag
7072 * should be reset only when the entire message at the front of the
7073 * queue as been consumed.
7074 *
7075 * If uiop is NULL all data is returned in mctlp.
7076 * Note that a NULL uiop implies that FNDELAY and FNONBLOCK are assumed
7077 * not enabled.
7078 * The timeout parameter is in milliseconds; -1 for infinity.
7079 * This routine handles the consolidation private flags:
7080 * MSG_IGNERROR Ignore any stream head error except STPLEX.
7081 * MSG_DELAYERROR Defer the error check until the queue is empty.
7082 * MSG_HOLDSIG Hold signals while waiting for data.
7083 * MSG_IPEEK Only peek at messages.
7084 * MSG_DISCARDTAIL Discard the tail M_DATA part of the message
7085 * that doesn't fit.
7086 * MSG_NOMARK If the message is marked leave it on the queue.
7087 *
7088 * NOTE: strgetmsg and kstrgetmsg have much of the logic in common.
7089 */
7090 int
7091 kstrgetmsg(
7092 struct vnode *vp,
7093 mblk_t **mctlp,
7094 struct uio *uiop,
7095 unsigned char *prip,
7096 int *flagsp,
7097 clock_t timout,
7098 rval_t *rvp)
7099 {
7100 struct stdata *stp;
7101 mblk_t *bp, *nbp;
7102 mblk_t *savemp = NULL;
7103 mblk_t *savemptail = NULL;
7104 int flags;
7105 uint_t old_sd_flag;
7106 int flg;
7107 int more = 0;
7108 int error = 0;
7109 char first = 1;
7110 uint_t mark; /* Contains MSG*MARK and _LASTMARK */
7111 #define _LASTMARK 0x8000 /* Distinct from MSG*MARK */
7112 unsigned char pri = 0;
7113 queue_t *q;
7114 int pr = 0; /* Partial read successful */
7115 unsigned char type;
7116
7117 TRACE_1(TR_FAC_STREAMS_FR, TR_KSTRGETMSG_ENTER,
7118 "kstrgetmsg:%p", vp);
7119
7120 ASSERT(vp->v_stream);
7121 stp = vp->v_stream;
7122 rvp->r_val1 = 0;
7123
7124 mutex_enter(&stp->sd_lock);
7125
7126 if ((error = i_straccess(stp, JCREAD)) != 0) {
7127 mutex_exit(&stp->sd_lock);
7128 return (error);
7129 }
7130
7131 flags = *flagsp;
7132 if (stp->sd_flag & (STRDERR|STPLEX)) {
7133 if ((stp->sd_flag & STPLEX) ||
7134 (flags & (MSG_IGNERROR|MSG_DELAYERROR)) == 0) {
7135 error = strgeterr(stp, STRDERR|STPLEX,
7136 (flags & MSG_IPEEK));
7137 if (error != 0) {
7138 mutex_exit(&stp->sd_lock);
7139 return (error);
7140 }
7141 }
7142 }
7143 mutex_exit(&stp->sd_lock);
7144
7145 switch (flags & (MSG_HIPRI|MSG_ANY|MSG_BAND)) {
7146 case MSG_HIPRI:
7147 if (*prip != 0)
7148 return (EINVAL);
7149 break;
7150
7151 case MSG_ANY:
7152 case MSG_BAND:
7153 break;
7154
7155 default:
7156 return (EINVAL);
7157 }
7158
7159 retry:
7160 q = _RD(stp->sd_wrq);
7161 mutex_enter(&stp->sd_lock);
7162 old_sd_flag = stp->sd_flag;
7163 mark = 0;
7164 for (;;) {
7165 int done = 0;
7166 int waitflag;
7167 int fmode;
7168 mblk_t *q_first = q->q_first;
7169
7170 /*
7171 * This section of the code operates just like the code
7172 * in strgetmsg(). There is a comment there about what
7173 * is going on here.
7174 */
7175 if (!(flags & (MSG_HIPRI|MSG_BAND))) {
7176 /* Asking for normal, band0 data */
7177 bp = strget(stp, q, uiop, first, &error);
7178 ASSERT(MUTEX_HELD(&stp->sd_lock));
7179 if (bp != NULL) {
7180 if (DB_TYPE(bp) == M_SIG) {
7181 strsignal_nolock(stp, *bp->b_rptr,
7182 bp->b_band);
7183 freemsg(bp);
7184 continue;
7185 } else {
7186 break;
7187 }
7188 }
7189 if (error != 0) {
7190 goto getmout;
7191 }
7192 /*
7193 * We can't depend on the value of STRPRI here because
7194 * the stream head may be in transit. Therefore, we
7195 * must look at the type of the first message to
7196 * determine if a high priority messages is waiting
7197 */
7198 } else if ((flags & MSG_HIPRI) && q_first != NULL &&
7199 DB_TYPE(q_first) >= QPCTL &&
7200 (bp = getq_noenab(q, 0)) != NULL) {
7201 ASSERT(DB_TYPE(bp) >= QPCTL);
7202 break;
7203 } else if ((flags & MSG_BAND) && q_first != NULL &&
7204 ((q_first->b_band >= *prip) || DB_TYPE(q_first) >= QPCTL) &&
7205 (bp = getq_noenab(q, 0)) != NULL) {
7206 /*
7207 * Asked for at least band "prip" and got either at
7208 * least that band or a hipri message.
7209 */
7210 ASSERT(bp->b_band >= *prip || DB_TYPE(bp) >= QPCTL);
7211 if (DB_TYPE(bp) == M_SIG) {
7212 strsignal_nolock(stp, *bp->b_rptr, bp->b_band);
7213 freemsg(bp);
7214 continue;
7215 } else {
7216 break;
7217 }
7218 }
7219
7220 /* No data. Time to sleep? */
7221 qbackenable(q, 0);
7222
7223 /*
7224 * Delayed error notification?
7225 */
7226 if ((stp->sd_flag & (STRDERR|STPLEX)) &&
7227 (flags & (MSG_IGNERROR|MSG_DELAYERROR)) == MSG_DELAYERROR) {
7228 error = strgeterr(stp, STRDERR|STPLEX,
7229 (flags & MSG_IPEEK));
7230 if (error != 0) {
7231 mutex_exit(&stp->sd_lock);
7232 return (error);
7233 }
7234 }
7235
7236 /*
7237 * If STRHUP or STREOF, return 0 length control and data.
7238 * If a read(fd,buf,0) has been done, do not sleep, just
7239 * return.
7240 *
7241 * If mctlp == NULL and uiop == NULL, then the code will
7242 * do the strwaitq. This is an understood way of saying
7243 * sleep "polling" until a message is received.
7244 */
7245 if ((stp->sd_flag & (STRHUP|STREOF)) ||
7246 (uiop != NULL && uiop->uio_resid == 0)) {
7247 if (mctlp != NULL)
7248 *mctlp = NULL;
7249 *flagsp = 0;
7250 mutex_exit(&stp->sd_lock);
7251 return (0);
7252 }
7253
7254 waitflag = GETWAIT;
7255 if (flags &
7256 (MSG_HOLDSIG|MSG_IGNERROR|MSG_IPEEK|MSG_DELAYERROR)) {
7257 if (flags & MSG_HOLDSIG)
7258 waitflag |= STR_NOSIG;
7259 if (flags & MSG_IGNERROR)
7260 waitflag |= STR_NOERROR;
7261 if (flags & MSG_IPEEK)
7262 waitflag |= STR_PEEK;
7263 if (flags & MSG_DELAYERROR)
7264 waitflag |= STR_DELAYERR;
7265 }
7266 if (uiop != NULL)
7267 fmode = uiop->uio_fmode;
7268 else
7269 fmode = 0;
7270
7271 TRACE_2(TR_FAC_STREAMS_FR, TR_KSTRGETMSG_WAIT,
7272 "kstrgetmsg calls strwaitq:%p, %p",
7273 vp, uiop);
7274 if (((error = strwaitq(stp, waitflag, (ssize_t)0,
7275 fmode, timout, &done))) != 0 || done) {
7276 TRACE_2(TR_FAC_STREAMS_FR, TR_KSTRGETMSG_DONE,
7277 "kstrgetmsg error or done:%p, %p",
7278 vp, uiop);
7279 mutex_exit(&stp->sd_lock);
7280 return (error);
7281 }
7282 TRACE_2(TR_FAC_STREAMS_FR, TR_KSTRGETMSG_AWAKE,
7283 "kstrgetmsg awakes:%p, %p", vp, uiop);
7284 if ((error = i_straccess(stp, JCREAD)) != 0) {
7285 mutex_exit(&stp->sd_lock);
7286 return (error);
7287 }
7288 first = 0;
7289 }
7290 ASSERT(bp != NULL);
7291 /*
7292 * Extract any mark information. If the message is not completely
7293 * consumed this information will be put in the mblk
7294 * that is putback.
7295 * If MSGMARKNEXT is set and the message is completely consumed
7296 * the STRATMARK flag will be set below. Likewise, if
7297 * MSGNOTMARKNEXT is set and the message is
7298 * completely consumed STRNOTATMARK will be set.
7299 */
7300 mark = bp->b_flag & (MSGMARK | MSGMARKNEXT | MSGNOTMARKNEXT);
7301 ASSERT((mark & (MSGMARKNEXT|MSGNOTMARKNEXT)) !=
7302 (MSGMARKNEXT|MSGNOTMARKNEXT));
7303 pri = bp->b_band;
7304 if (mark != 0) {
7305 /*
7306 * If the caller doesn't want the mark return.
7307 * Used to implement MSG_WAITALL in sockets.
7308 */
7309 if (flags & MSG_NOMARK) {
7310 putback(stp, q, bp, pri);
7311 qbackenable(q, pri);
7312 mutex_exit(&stp->sd_lock);
7313 return (EWOULDBLOCK);
7314 }
7315 if (bp == stp->sd_mark) {
7316 mark |= _LASTMARK;
7317 stp->sd_mark = NULL;
7318 }
7319 }
7320
7321 /*
7322 * keep track of the first message type
7323 */
7324 type = bp->b_datap->db_type;
7325
7326 if (bp->b_datap->db_type == M_PASSFP) {
7327 if ((mark & _LASTMARK) && (stp->sd_mark == NULL))
7328 stp->sd_mark = bp;
7329 bp->b_flag |= mark & ~_LASTMARK;
7330 putback(stp, q, bp, pri);
7331 qbackenable(q, pri);
7332 mutex_exit(&stp->sd_lock);
7333 return (EBADMSG);
7334 }
7335 ASSERT(type != M_SIG);
7336
7337 if (flags & MSG_IPEEK) {
7338 /*
7339 * Clear any struioflag - we do the uiomove over again
7340 * when peeking since it simplifies the code.
7341 *
7342 * Dup the message and put the original back on the queue.
7343 * If dupmsg() fails, try again with copymsg() to see if
7344 * there is indeed a shortage of memory. dupmsg() may fail
7345 * if db_ref in any of the messages reaches its limit.
7346 */
7347
7348 if ((nbp = dupmsg(bp)) == NULL && (nbp = copymsg(bp)) == NULL) {
7349 /*
7350 * Restore the state of the stream head since we
7351 * need to drop sd_lock (strwaitbuf is sleeping).
7352 */
7353 size_t size = msgdsize(bp);
7354
7355 if ((mark & _LASTMARK) && (stp->sd_mark == NULL))
7356 stp->sd_mark = bp;
7357 bp->b_flag |= mark & ~_LASTMARK;
7358 putback(stp, q, bp, pri);
7359 mutex_exit(&stp->sd_lock);
7360 error = strwaitbuf(size, BPRI_HI);
7361 if (error) {
7362 /*
7363 * There is no net change to the queue thus
7364 * no need to qbackenable.
7365 */
7366 return (error);
7367 }
7368 goto retry;
7369 }
7370
7371 if ((mark & _LASTMARK) && (stp->sd_mark == NULL))
7372 stp->sd_mark = bp;
7373 bp->b_flag |= mark & ~_LASTMARK;
7374 putback(stp, q, bp, pri);
7375 bp = nbp;
7376 }
7377
7378 /*
7379 * Set this flag so strrput will not generate signals. Need to
7380 * make sure this flag is cleared before leaving this routine
7381 * else signals will stop being sent.
7382 */
7383 stp->sd_flag |= STRGETINPROG;
7384 mutex_exit(&stp->sd_lock);
7385
7386 if ((stp->sd_rputdatafunc != NULL) && (DB_TYPE(bp) == M_DATA)) {
7387 mblk_t *tmp, *prevmp;
7388
7389 /*
7390 * Put first non-data mblk back to stream head and
7391 * cut the mblk chain so sd_rputdatafunc only sees
7392 * M_DATA mblks. We can skip the first mblk since it
7393 * is M_DATA according to the condition above.
7394 */
7395 for (prevmp = bp, tmp = bp->b_cont; tmp != NULL;
7396 prevmp = tmp, tmp = tmp->b_cont) {
7397 if (DB_TYPE(tmp) != M_DATA) {
7398 prevmp->b_cont = NULL;
7399 mutex_enter(&stp->sd_lock);
7400 putback(stp, q, tmp, tmp->b_band);
7401 mutex_exit(&stp->sd_lock);
7402 break;
7403 }
7404 }
7405
7406 bp = (stp->sd_rputdatafunc)(stp->sd_vnode, bp,
7407 NULL, NULL, NULL, NULL);
7408
7409 if (bp == NULL)
7410 goto retry;
7411 }
7412
7413 if (STREAM_NEEDSERVICE(stp))
7414 stream_runservice(stp);
7415
7416 /*
7417 * Set HIPRI flag if message is priority.
7418 */
7419 if (type >= QPCTL)
7420 flg = MSG_HIPRI;
7421 else
7422 flg = MSG_BAND;
7423
7424 /*
7425 * First process PROTO or PCPROTO blocks, if any.
7426 */
7427 if (mctlp != NULL && type != M_DATA) {
7428 mblk_t *nbp;
7429
7430 *mctlp = bp;
7431 while (bp->b_cont && bp->b_cont->b_datap->db_type != M_DATA)
7432 bp = bp->b_cont;
7433 nbp = bp->b_cont;
7434 bp->b_cont = NULL;
7435 bp = nbp;
7436 }
7437
7438 if (bp && bp->b_datap->db_type != M_DATA) {
7439 /*
7440 * More PROTO blocks in msg. Will only happen if mctlp is NULL.
7441 */
7442 more |= MORECTL;
7443 savemp = bp;
7444 while (bp && bp->b_datap->db_type != M_DATA) {
7445 savemptail = bp;
7446 bp = bp->b_cont;
7447 }
7448 savemptail->b_cont = NULL;
7449 }
7450
7451 /*
7452 * Now process DATA blocks, if any.
7453 */
7454 if (uiop == NULL) {
7455 /* Append data to tail of mctlp */
7456
7457 if (mctlp != NULL) {
7458 mblk_t **mpp = mctlp;
7459
7460 while (*mpp != NULL)
7461 mpp = &((*mpp)->b_cont);
7462 *mpp = bp;
7463 bp = NULL;
7464 }
7465 } else if (uiop->uio_resid >= 0 && bp) {
7466 size_t oldresid = uiop->uio_resid;
7467
7468 /*
7469 * If a streams message is likely to consist
7470 * of many small mblks, it is pulled up into
7471 * one continuous chunk of memory.
7472 * The size of the first mblk may be bogus because
7473 * successive read() calls on the socket reduce
7474 * the size of this mblk until it is exhausted
7475 * and then the code walks on to the next. Thus
7476 * the size of the mblk may not be the original size
7477 * that was passed up, it's simply a remainder
7478 * and hence can be very small without any
7479 * implication that the packet is badly fragmented.
7480 * So the size of the possible second mblk is
7481 * used to spot a badly fragmented packet.
7482 * see longer comment at top of page
7483 * by mblk_pull_len declaration.
7484 */
7485
7486 if (bp->b_cont != NULL && MBLKL(bp->b_cont) < mblk_pull_len) {
7487 (void) pullupmsg(bp, -1);
7488 }
7489
7490 bp = struiocopyout(bp, uiop, &error);
7491 if (error != 0) {
7492 if (mctlp != NULL) {
7493 freemsg(*mctlp);
7494 *mctlp = NULL;
7495 } else
7496 freemsg(savemp);
7497 mutex_enter(&stp->sd_lock);
7498 /*
7499 * clear stream head hi pri flag based on
7500 * first message
7501 */
7502 if (!(flags & MSG_IPEEK) && (type >= QPCTL)) {
7503 ASSERT(type == M_PCPROTO);
7504 stp->sd_flag &= ~STRPRI;
7505 }
7506 more = 0;
7507 goto getmout;
7508 }
7509 /*
7510 * (pr == 1) indicates a partial read.
7511 */
7512 if (oldresid > uiop->uio_resid)
7513 pr = 1;
7514 }
7515
7516 if (bp) { /* more data blocks in msg */
7517 more |= MOREDATA;
7518 if (savemp)
7519 savemptail->b_cont = bp;
7520 else
7521 savemp = bp;
7522 }
7523
7524 mutex_enter(&stp->sd_lock);
7525 if (savemp) {
7526 if (flags & (MSG_IPEEK|MSG_DISCARDTAIL)) {
7527 /*
7528 * When MSG_DISCARDTAIL is set or
7529 * when peeking discard any tail. When peeking this
7530 * is the tail of the dup that was copied out - the
7531 * message has already been putback on the queue.
7532 * Return MOREDATA to the caller even though the data
7533 * is discarded. This is used by sockets (to
7534 * set MSG_TRUNC).
7535 */
7536 freemsg(savemp);
7537 if (!(flags & MSG_IPEEK) && (type >= QPCTL)) {
7538 ASSERT(type == M_PCPROTO);
7539 stp->sd_flag &= ~STRPRI;
7540 }
7541 } else if (pr && (savemp->b_datap->db_type == M_DATA) &&
7542 msgnodata(savemp)) {
7543 /*
7544 * Avoid queuing a zero-length tail part of
7545 * a message. pr=1 indicates that we read some of
7546 * the message.
7547 */
7548 freemsg(savemp);
7549 more &= ~MOREDATA;
7550 if (type >= QPCTL) {
7551 ASSERT(type == M_PCPROTO);
7552 stp->sd_flag &= ~STRPRI;
7553 }
7554 } else {
7555 savemp->b_band = pri;
7556 /*
7557 * If the first message was HIPRI and the one we're
7558 * putting back isn't, then clear STRPRI, otherwise
7559 * set STRPRI again. Note that we must set STRPRI
7560 * again since the flush logic in strrput_nondata()
7561 * may have cleared it while we had sd_lock dropped.
7562 */
7563
7564 if (type >= QPCTL) {
7565 ASSERT(type == M_PCPROTO);
7566 if (queclass(savemp) < QPCTL)
7567 stp->sd_flag &= ~STRPRI;
7568 else
7569 stp->sd_flag |= STRPRI;
7570 } else if (queclass(savemp) >= QPCTL) {
7571 /*
7572 * The first message was not a HIPRI message,
7573 * but the one we are about to putback is.
7574 * For simplicitly, we do not allow for HIPRI
7575 * messages to be embedded in the message
7576 * body, so just force it to same type as
7577 * first message.
7578 */
7579 ASSERT(type == M_DATA || type == M_PROTO);
7580 ASSERT(savemp->b_datap->db_type == M_PCPROTO);
7581 savemp->b_datap->db_type = type;
7582 }
7583 if (mark != 0) {
7584 if ((mark & _LASTMARK) &&
7585 (stp->sd_mark == NULL)) {
7586 /*
7587 * If another marked message arrived
7588 * while sd_lock was not held sd_mark
7589 * would be non-NULL.
7590 */
7591 stp->sd_mark = savemp;
7592 }
7593 savemp->b_flag |= mark & ~_LASTMARK;
7594 }
7595 putback(stp, q, savemp, pri);
7596 }
7597 } else if (!(flags & MSG_IPEEK)) {
7598 /*
7599 * The complete message was consumed.
7600 *
7601 * If another M_PCPROTO arrived while sd_lock was not held
7602 * it would have been discarded since STRPRI was still set.
7603 *
7604 * Move the MSG*MARKNEXT information
7605 * to the stream head just in case
7606 * the read queue becomes empty.
7607 * clear stream head hi pri flag based on
7608 * first message
7609 *
7610 * If the stream head was at the mark
7611 * (STRATMARK) before we dropped sd_lock above
7612 * and some data was consumed then we have
7613 * moved past the mark thus STRATMARK is
7614 * cleared. However, if a message arrived in
7615 * strrput during the copyout above causing
7616 * STRATMARK to be set we can not clear that
7617 * flag.
7618 * XXX A "perimeter" would help by single-threading strrput,
7619 * strread, strgetmsg and kstrgetmsg.
7620 */
7621 if (type >= QPCTL) {
7622 ASSERT(type == M_PCPROTO);
7623 stp->sd_flag &= ~STRPRI;
7624 }
7625 if (mark & (MSGMARKNEXT|MSGNOTMARKNEXT|MSGMARK)) {
7626 if (mark & MSGMARKNEXT) {
7627 stp->sd_flag &= ~STRNOTATMARK;
7628 stp->sd_flag |= STRATMARK;
7629 } else if (mark & MSGNOTMARKNEXT) {
7630 stp->sd_flag &= ~STRATMARK;
7631 stp->sd_flag |= STRNOTATMARK;
7632 } else {
7633 stp->sd_flag &= ~(STRATMARK|STRNOTATMARK);
7634 }
7635 } else if (pr && (old_sd_flag & STRATMARK)) {
7636 stp->sd_flag &= ~STRATMARK;
7637 }
7638 }
7639
7640 *flagsp = flg;
7641 *prip = pri;
7642
7643 /*
7644 * Getmsg cleanup processing - if the state of the queue has changed
7645 * some signals may need to be sent and/or poll awakened.
7646 */
7647 getmout:
7648 qbackenable(q, pri);
7649
7650 /*
7651 * We dropped the stream head lock above. Send all M_SIG messages
7652 * before processing stream head for SIGPOLL messages.
7653 */
7654 ASSERT(MUTEX_HELD(&stp->sd_lock));
7655 while ((bp = q->q_first) != NULL &&
7656 (bp->b_datap->db_type == M_SIG)) {
7657 /*
7658 * sd_lock is held so the content of the read queue can not
7659 * change.
7660 */
7661 bp = getq(q);
7662 ASSERT(bp != NULL && bp->b_datap->db_type == M_SIG);
7663
7664 strsignal_nolock(stp, *bp->b_rptr, bp->b_band);
7665 mutex_exit(&stp->sd_lock);
7666 freemsg(bp);
7667 if (STREAM_NEEDSERVICE(stp))
7668 stream_runservice(stp);
7669 mutex_enter(&stp->sd_lock);
7670 }
7671
7672 /*
7673 * stream head cannot change while we make the determination
7674 * whether or not to send a signal. Drop the flag to allow strrput
7675 * to send firstmsgsigs again.
7676 */
7677 stp->sd_flag &= ~STRGETINPROG;
7678
7679 /*
7680 * If the type of message at the front of the queue changed
7681 * due to the receive the appropriate signals and pollwakeup events
7682 * are generated. The type of changes are:
7683 * Processed a hipri message, q_first is not hipri.
7684 * Processed a band X message, and q_first is band Y.
7685 * The generated signals and pollwakeups are identical to what
7686 * strrput() generates should the message that is now on q_first
7687 * arrive to an empty read queue.
7688 *
7689 * Note: only strrput will send a signal for a hipri message.
7690 */
7691 if ((bp = q->q_first) != NULL && !(stp->sd_flag & STRPRI)) {
7692 strsigset_t signals = 0;
7693 strpollset_t pollwakeups = 0;
7694
7695 if (flg & MSG_HIPRI) {
7696 /*
7697 * Removed a hipri message. Regular data at
7698 * the front of the queue.
7699 */
7700 if (bp->b_band == 0) {
7701 signals = S_INPUT | S_RDNORM;
7702 pollwakeups = POLLIN | POLLRDNORM;
7703 } else {
7704 signals = S_INPUT | S_RDBAND;
7705 pollwakeups = POLLIN | POLLRDBAND;
7706 }
7707 } else if (pri != bp->b_band) {
7708 /*
7709 * The band is different for the new q_first.
7710 */
7711 if (bp->b_band == 0) {
7712 signals = S_RDNORM;
7713 pollwakeups = POLLIN | POLLRDNORM;
7714 } else {
7715 signals = S_RDBAND;
7716 pollwakeups = POLLIN | POLLRDBAND;
7717 }
7718 }
7719
7720 if (pollwakeups != 0) {
7721 if (pollwakeups == (POLLIN | POLLRDNORM)) {
7722 if (!(stp->sd_rput_opt & SR_POLLIN))
7723 goto no_pollwake;
7724 stp->sd_rput_opt &= ~SR_POLLIN;
7725 }
7726 mutex_exit(&stp->sd_lock);
7727 pollwakeup(&stp->sd_pollist, pollwakeups);
7728 mutex_enter(&stp->sd_lock);
7729 }
7730 no_pollwake:
7731
7732 if (stp->sd_sigflags & signals)
7733 strsendsig(stp->sd_siglist, signals, bp->b_band, 0);
7734 }
7735 mutex_exit(&stp->sd_lock);
7736
7737 rvp->r_val1 = more;
7738 return (error);
7739 #undef _LASTMARK
7740 }
7741
7742 /*
7743 * Put a message downstream.
7744 *
7745 * NOTE: strputmsg and kstrputmsg have much of the logic in common.
7746 */
7747 int
7748 strputmsg(
7749 struct vnode *vp,
7750 struct strbuf *mctl,
7751 struct strbuf *mdata,
7752 unsigned char pri,
7753 int flag,
7754 int fmode)
7755 {
7756 struct stdata *stp;
7757 queue_t *wqp;
7758 mblk_t *mp;
7759 ssize_t msgsize;
7760 ssize_t rmin, rmax;
7761 int error;
7762 struct uio uios;
7763 struct uio *uiop = &uios;
7764 struct iovec iovs;
7765 int xpg4 = 0;
7766
7767 ASSERT(vp->v_stream);
7768 stp = vp->v_stream;
7769 wqp = stp->sd_wrq;
7770
7771 /*
7772 * If it is an XPG4 application, we need to send
7773 * SIGPIPE below
7774 */
7775
7776 xpg4 = (flag & MSG_XPG4) ? 1 : 0;
7777 flag &= ~MSG_XPG4;
7778
7779 if (AU_AUDITING())
7780 audit_strputmsg(vp, mctl, mdata, pri, flag, fmode);
7781
7782 mutex_enter(&stp->sd_lock);
7783
7784 if ((error = i_straccess(stp, JCWRITE)) != 0) {
7785 mutex_exit(&stp->sd_lock);
7786 return (error);
7787 }
7788
7789 if (stp->sd_flag & (STWRERR|STRHUP|STPLEX)) {
7790 error = strwriteable(stp, B_FALSE, xpg4);
7791 if (error != 0) {
7792 mutex_exit(&stp->sd_lock);
7793 return (error);
7794 }
7795 }
7796
7797 mutex_exit(&stp->sd_lock);
7798
7799 /*
7800 * Check for legal flag value.
7801 */
7802 switch (flag) {
7803 case MSG_HIPRI:
7804 if ((mctl->len < 0) || (pri != 0))
7805 return (EINVAL);
7806 break;
7807 case MSG_BAND:
7808 break;
7809
7810 default:
7811 return (EINVAL);
7812 }
7813
7814 TRACE_1(TR_FAC_STREAMS_FR, TR_STRPUTMSG_IN,
7815 "strputmsg in:stp %p", stp);
7816
7817 /* get these values from those cached in the stream head */
7818 rmin = stp->sd_qn_minpsz;
7819 rmax = stp->sd_qn_maxpsz;
7820
7821 /*
7822 * Make sure ctl and data sizes together fall within the
7823 * limits of the max and min receive packet sizes and do
7824 * not exceed system limit.
7825 */
7826 ASSERT((rmax >= 0) || (rmax == INFPSZ));
7827 if (rmax == 0) {
7828 return (ERANGE);
7829 }
7830 /*
7831 * Use the MAXIMUM of sd_maxblk and q_maxpsz.
7832 * Needed to prevent partial failures in the strmakedata loop.
7833 */
7834 if (stp->sd_maxblk != INFPSZ && rmax != INFPSZ && rmax < stp->sd_maxblk)
7835 rmax = stp->sd_maxblk;
7836
7837 if ((msgsize = mdata->len) < 0) {
7838 msgsize = 0;
7839 rmin = 0; /* no range check for NULL data part */
7840 }
7841 if ((msgsize < rmin) ||
7842 ((msgsize > rmax) && (rmax != INFPSZ)) ||
7843 (mctl->len > strctlsz)) {
7844 return (ERANGE);
7845 }
7846
7847 /*
7848 * Setup uio and iov for data part
7849 */
7850 iovs.iov_base = mdata->buf;
7851 iovs.iov_len = msgsize;
7852 uios.uio_iov = &iovs;
7853 uios.uio_iovcnt = 1;
7854 uios.uio_loffset = 0;
7855 uios.uio_segflg = UIO_USERSPACE;
7856 uios.uio_fmode = fmode;
7857 uios.uio_extflg = UIO_COPY_DEFAULT;
7858 uios.uio_resid = msgsize;
7859 uios.uio_offset = 0;
7860
7861 /* Ignore flow control in strput for HIPRI */
7862 if (flag & MSG_HIPRI)
7863 flag |= MSG_IGNFLOW;
7864
7865 for (;;) {
7866 int done = 0;
7867
7868 /*
7869 * strput will always free the ctl mblk - even when strput
7870 * fails.
7871 */
7872 if ((error = strmakectl(mctl, flag, fmode, &mp)) != 0) {
7873 TRACE_3(TR_FAC_STREAMS_FR, TR_STRPUTMSG_OUT,
7874 "strputmsg out:stp %p out %d error %d",
7875 stp, 1, error);
7876 return (error);
7877 }
7878 /*
7879 * Verify that the whole message can be transferred by
7880 * strput.
7881 */
7882 ASSERT(stp->sd_maxblk == INFPSZ ||
7883 stp->sd_maxblk >= mdata->len);
7884
7885 msgsize = mdata->len;
7886 error = strput(stp, mp, uiop, &msgsize, 0, pri, flag);
7887 mdata->len = msgsize;
7888
7889 if (error == 0)
7890 break;
7891
7892 if (error != EWOULDBLOCK)
7893 goto out;
7894
7895 mutex_enter(&stp->sd_lock);
7896 /*
7897 * Check for a missed wakeup.
7898 * Needed since strput did not hold sd_lock across
7899 * the canputnext.
7900 */
7901 if (bcanputnext(wqp, pri)) {
7902 /* Try again */
7903 mutex_exit(&stp->sd_lock);
7904 continue;
7905 }
7906 TRACE_2(TR_FAC_STREAMS_FR, TR_STRPUTMSG_WAIT,
7907 "strputmsg wait:stp %p waits pri %d", stp, pri);
7908 if (((error = strwaitq(stp, WRITEWAIT, (ssize_t)0, fmode, -1,
7909 &done)) != 0) || done) {
7910 mutex_exit(&stp->sd_lock);
7911 TRACE_3(TR_FAC_STREAMS_FR, TR_STRPUTMSG_OUT,
7912 "strputmsg out:q %p out %d error %d",
7913 stp, 0, error);
7914 return (error);
7915 }
7916 TRACE_1(TR_FAC_STREAMS_FR, TR_STRPUTMSG_WAKE,
7917 "strputmsg wake:stp %p wakes", stp);
7918 if ((error = i_straccess(stp, JCWRITE)) != 0) {
7919 mutex_exit(&stp->sd_lock);
7920 return (error);
7921 }
7922 mutex_exit(&stp->sd_lock);
7923 }
7924 out:
7925 /*
7926 * For historic reasons, applications expect EAGAIN
7927 * when data mblk could not be allocated. so change
7928 * ENOMEM back to EAGAIN
7929 */
7930 if (error == ENOMEM)
7931 error = EAGAIN;
7932 TRACE_3(TR_FAC_STREAMS_FR, TR_STRPUTMSG_OUT,
7933 "strputmsg out:stp %p out %d error %d", stp, 2, error);
7934 return (error);
7935 }
7936
7937 /*
7938 * Put a message downstream.
7939 * Can send only an M_PROTO/M_PCPROTO by passing in a NULL uiop.
7940 * The fmode flag (NDELAY, NONBLOCK) is the or of the flags in the uio
7941 * and the fmode parameter.
7942 *
7943 * This routine handles the consolidation private flags:
7944 * MSG_IGNERROR Ignore any stream head error except STPLEX.
7945 * MSG_HOLDSIG Hold signals while waiting for data.
7946 * MSG_IGNFLOW Don't check streams flow control.
7947 *
7948 * NOTE: strputmsg and kstrputmsg have much of the logic in common.
7949 */
7950 int
7951 kstrputmsg(
7952 struct vnode *vp,
7953 mblk_t *mctl,
7954 struct uio *uiop,
7955 ssize_t msgsize,
7956 unsigned char pri,
7957 int flag,
7958 int fmode)
7959 {
7960 struct stdata *stp;
7961 queue_t *wqp;
7962 ssize_t rmin, rmax;
7963 int error;
7964
7965 ASSERT(vp->v_stream);
7966 stp = vp->v_stream;
7967 wqp = stp->sd_wrq;
7968 if (AU_AUDITING())
7969 audit_strputmsg(vp, NULL, NULL, pri, flag, fmode);
7970 if (mctl == NULL)
7971 return (EINVAL);
7972
7973 mutex_enter(&stp->sd_lock);
7974
7975 if ((error = i_straccess(stp, JCWRITE)) != 0) {
7976 mutex_exit(&stp->sd_lock);
7977 freemsg(mctl);
7978 return (error);
7979 }
7980
7981 if ((stp->sd_flag & STPLEX) || !(flag & MSG_IGNERROR)) {
7982 if (stp->sd_flag & (STWRERR|STRHUP|STPLEX)) {
7983 error = strwriteable(stp, B_FALSE, B_TRUE);
7984 if (error != 0) {
7985 mutex_exit(&stp->sd_lock);
7986 freemsg(mctl);
7987 return (error);
7988 }
7989 }
7990 }
7991
7992 mutex_exit(&stp->sd_lock);
7993
7994 /*
7995 * Check for legal flag value.
7996 */
7997 switch (flag & (MSG_HIPRI|MSG_BAND|MSG_ANY)) {
7998 case MSG_HIPRI:
7999 if (pri != 0) {
8000 freemsg(mctl);
8001 return (EINVAL);
8002 }
8003 break;
8004 case MSG_BAND:
8005 break;
8006 default:
8007 freemsg(mctl);
8008 return (EINVAL);
8009 }
8010
8011 TRACE_1(TR_FAC_STREAMS_FR, TR_KSTRPUTMSG_IN,
8012 "kstrputmsg in:stp %p", stp);
8013
8014 /* get these values from those cached in the stream head */
8015 rmin = stp->sd_qn_minpsz;
8016 rmax = stp->sd_qn_maxpsz;
8017
8018 /*
8019 * Make sure ctl and data sizes together fall within the
8020 * limits of the max and min receive packet sizes and do
8021 * not exceed system limit.
8022 */
8023 ASSERT((rmax >= 0) || (rmax == INFPSZ));
8024 if (rmax == 0) {
8025 freemsg(mctl);
8026 return (ERANGE);
8027 }
8028 /*
8029 * Use the MAXIMUM of sd_maxblk and q_maxpsz.
8030 * Needed to prevent partial failures in the strmakedata loop.
8031 */
8032 if (stp->sd_maxblk != INFPSZ && rmax != INFPSZ && rmax < stp->sd_maxblk)
8033 rmax = stp->sd_maxblk;
8034
8035 if (uiop == NULL) {
8036 msgsize = -1;
8037 rmin = -1; /* no range check for NULL data part */
8038 } else {
8039 /* Use uio flags as well as the fmode parameter flags */
8040 fmode |= uiop->uio_fmode;
8041
8042 if ((msgsize < rmin) ||
8043 ((msgsize > rmax) && (rmax != INFPSZ))) {
8044 freemsg(mctl);
8045 return (ERANGE);
8046 }
8047 }
8048
8049 /* Ignore flow control in strput for HIPRI */
8050 if (flag & MSG_HIPRI)
8051 flag |= MSG_IGNFLOW;
8052
8053 for (;;) {
8054 int done = 0;
8055 int waitflag;
8056 mblk_t *mp;
8057
8058 /*
8059 * strput will always free the ctl mblk - even when strput
8060 * fails. If MSG_IGNFLOW is set then any error returned
8061 * will cause us to break the loop, so we don't need a copy
8062 * of the message. If MSG_IGNFLOW is not set, then we can
8063 * get hit by flow control and be forced to try again. In
8064 * this case we need to have a copy of the message. We
8065 * do this using copymsg since the message may get modified
8066 * by something below us.
8067 *
8068 * We've observed that many TPI providers do not check db_ref
8069 * on the control messages but blindly reuse them for the
8070 * T_OK_ACK/T_ERROR_ACK. Thus using copymsg is more
8071 * friendly to such providers than using dupmsg. Also, note
8072 * that sockfs uses MSG_IGNFLOW for all TPI control messages.
8073 * Only data messages are subject to flow control, hence
8074 * subject to this copymsg.
8075 */
8076 if (flag & MSG_IGNFLOW) {
8077 mp = mctl;
8078 mctl = NULL;
8079 } else {
8080 do {
8081 /*
8082 * If a message has a free pointer, the message
8083 * must be dupmsg to maintain this pointer.
8084 * Code using this facility must be sure
8085 * that modules below will not change the
8086 * contents of the dblk without checking db_ref
8087 * first. If db_ref is > 1, then the module
8088 * needs to do a copymsg first. Otherwise,
8089 * the contents of the dblk may become
8090 * inconsistent because the freesmg/freeb below
8091 * may end up calling atomic_add_32_nv.
8092 * The atomic_add_32_nv in freeb (accessing
8093 * all of db_ref, db_type, db_flags, and
8094 * db_struioflag) does not prevent other threads
8095 * from concurrently trying to modify e.g.
8096 * db_type.
8097 */
8098 if (mctl->b_datap->db_frtnp != NULL)
8099 mp = dupmsg(mctl);
8100 else
8101 mp = copymsg(mctl);
8102
8103 if (mp != NULL)
8104 break;
8105
8106 error = strwaitbuf(msgdsize(mctl), BPRI_MED);
8107 if (error) {
8108 freemsg(mctl);
8109 return (error);
8110 }
8111 } while (mp == NULL);
8112 }
8113 /*
8114 * Verify that all of msgsize can be transferred by
8115 * strput.
8116 */
8117 ASSERT(stp->sd_maxblk == INFPSZ || stp->sd_maxblk >= msgsize);
8118 error = strput(stp, mp, uiop, &msgsize, 0, pri, flag);
8119 if (error == 0)
8120 break;
8121
8122 if (error != EWOULDBLOCK)
8123 goto out;
8124
8125 /*
8126 * IF MSG_IGNFLOW is set we should have broken out of loop
8127 * above.
8128 */
8129 ASSERT(!(flag & MSG_IGNFLOW));
8130 mutex_enter(&stp->sd_lock);
8131 /*
8132 * Check for a missed wakeup.
8133 * Needed since strput did not hold sd_lock across
8134 * the canputnext.
8135 */
8136 if (bcanputnext(wqp, pri)) {
8137 /* Try again */
8138 mutex_exit(&stp->sd_lock);
8139 continue;
8140 }
8141 TRACE_2(TR_FAC_STREAMS_FR, TR_KSTRPUTMSG_WAIT,
8142 "kstrputmsg wait:stp %p waits pri %d", stp, pri);
8143
8144 waitflag = WRITEWAIT;
8145 if (flag & (MSG_HOLDSIG|MSG_IGNERROR)) {
8146 if (flag & MSG_HOLDSIG)
8147 waitflag |= STR_NOSIG;
8148 if (flag & MSG_IGNERROR)
8149 waitflag |= STR_NOERROR;
8150 }
8151 if (((error = strwaitq(stp, waitflag,
8152 (ssize_t)0, fmode, -1, &done)) != 0) || done) {
8153 mutex_exit(&stp->sd_lock);
8154 TRACE_3(TR_FAC_STREAMS_FR, TR_KSTRPUTMSG_OUT,
8155 "kstrputmsg out:stp %p out %d error %d",
8156 stp, 0, error);
8157 freemsg(mctl);
8158 return (error);
8159 }
8160 TRACE_1(TR_FAC_STREAMS_FR, TR_KSTRPUTMSG_WAKE,
8161 "kstrputmsg wake:stp %p wakes", stp);
8162 if ((error = i_straccess(stp, JCWRITE)) != 0) {
8163 mutex_exit(&stp->sd_lock);
8164 freemsg(mctl);
8165 return (error);
8166 }
8167 mutex_exit(&stp->sd_lock);
8168 }
8169 out:
8170 freemsg(mctl);
8171 /*
8172 * For historic reasons, applications expect EAGAIN
8173 * when data mblk could not be allocated. so change
8174 * ENOMEM back to EAGAIN
8175 */
8176 if (error == ENOMEM)
8177 error = EAGAIN;
8178 TRACE_3(TR_FAC_STREAMS_FR, TR_KSTRPUTMSG_OUT,
8179 "kstrputmsg out:stp %p out %d error %d", stp, 2, error);
8180 return (error);
8181 }
8182
8183 /*
8184 * Determines whether the necessary conditions are set on a stream
8185 * for it to be readable, writeable, or have exceptions.
8186 *
8187 * strpoll handles the consolidation private events:
8188 * POLLNOERR Do not return POLLERR even if there are stream
8189 * head errors.
8190 * Used by sockfs.
8191 * POLLRDDATA Do not return POLLIN unless at least one message on
8192 * the queue contains one or more M_DATA mblks. Thus
8193 * when this flag is set a queue with only
8194 * M_PROTO/M_PCPROTO mblks does not return POLLIN.
8195 * Used by sockfs to ignore T_EXDATA_IND messages.
8196 *
8197 * Note: POLLRDDATA assumes that synch streams only return messages with
8198 * an M_DATA attached (i.e. not messages consisting of only
8199 * an M_PROTO/M_PCPROTO part).
8200 */
8201 int
8202 strpoll(
8203 struct stdata *stp,
8204 short events_arg,
8205 int anyyet,
8206 short *reventsp,
8207 struct pollhead **phpp)
8208 {
8209 int events = (ushort_t)events_arg;
8210 int retevents = 0;
8211 mblk_t *mp;
8212 qband_t *qbp;
8213 long sd_flags = stp->sd_flag;
8214 int headlocked = 0;
8215
8216 /*
8217 * For performance, a single 'if' tests for most possible edge
8218 * conditions in one shot
8219 */
8220 if (sd_flags & (STPLEX | STRDERR | STWRERR)) {
8221 if (sd_flags & STPLEX) {
8222 *reventsp = POLLNVAL;
8223 return (EINVAL);
8224 }
8225 if (((events & (POLLIN | POLLRDNORM | POLLRDBAND | POLLPRI)) &&
8226 (sd_flags & STRDERR)) ||
8227 ((events & (POLLOUT | POLLWRNORM | POLLWRBAND)) &&
8228 (sd_flags & STWRERR))) {
8229 if (!(events & POLLNOERR)) {
8230 *reventsp = POLLERR;
8231 return (0);
8232 }
8233 }
8234 }
8235 if (sd_flags & STRHUP) {
8236 retevents |= POLLHUP;
8237 } else if (events & (POLLWRNORM | POLLWRBAND)) {
8238 queue_t *tq;
8239 queue_t *qp = stp->sd_wrq;
8240
8241 claimstr(qp);
8242 /* Find next module forward that has a service procedure */
8243 tq = qp->q_next->q_nfsrv;
8244 ASSERT(tq != NULL);
8245
8246 polllock(&stp->sd_pollist, QLOCK(tq));
8247 if (events & POLLWRNORM) {
8248 queue_t *sqp;
8249
8250 if (tq->q_flag & QFULL)
8251 /* ensure backq svc procedure runs */
8252 tq->q_flag |= QWANTW;
8253 else if ((sqp = stp->sd_struiowrq) != NULL) {
8254 /* Check sync stream barrier write q */
8255 mutex_exit(QLOCK(tq));
8256 polllock(&stp->sd_pollist, QLOCK(sqp));
8257 if (sqp->q_flag & QFULL)
8258 /* ensure pollwakeup() is done */
8259 sqp->q_flag |= QWANTWSYNC;
8260 else
8261 retevents |= POLLOUT;
8262 /* More write events to process ??? */
8263 if (! (events & POLLWRBAND)) {
8264 mutex_exit(QLOCK(sqp));
8265 releasestr(qp);
8266 goto chkrd;
8267 }
8268 mutex_exit(QLOCK(sqp));
8269 polllock(&stp->sd_pollist, QLOCK(tq));
8270 } else
8271 retevents |= POLLOUT;
8272 }
8273 if (events & POLLWRBAND) {
8274 qbp = tq->q_bandp;
8275 if (qbp) {
8276 while (qbp) {
8277 if (qbp->qb_flag & QB_FULL)
8278 qbp->qb_flag |= QB_WANTW;
8279 else
8280 retevents |= POLLWRBAND;
8281 qbp = qbp->qb_next;
8282 }
8283 } else {
8284 retevents |= POLLWRBAND;
8285 }
8286 }
8287 mutex_exit(QLOCK(tq));
8288 releasestr(qp);
8289 }
8290 chkrd:
8291 if (sd_flags & STRPRI) {
8292 retevents |= (events & POLLPRI);
8293 } else if (events & (POLLRDNORM | POLLRDBAND | POLLIN)) {
8294 queue_t *qp = _RD(stp->sd_wrq);
8295 int normevents = (events & (POLLIN | POLLRDNORM));
8296
8297 /*
8298 * Note: Need to do polllock() here since ps_lock may be
8299 * held. See bug 4191544.
8300 */
8301 polllock(&stp->sd_pollist, &stp->sd_lock);
8302 headlocked = 1;
8303 mp = qp->q_first;
8304 while (mp) {
8305 /*
8306 * For POLLRDDATA we scan b_cont and b_next until we
8307 * find an M_DATA.
8308 */
8309 if ((events & POLLRDDATA) &&
8310 mp->b_datap->db_type != M_DATA) {
8311 mblk_t *nmp = mp->b_cont;
8312
8313 while (nmp != NULL &&
8314 nmp->b_datap->db_type != M_DATA)
8315 nmp = nmp->b_cont;
8316 if (nmp == NULL) {
8317 mp = mp->b_next;
8318 continue;
8319 }
8320 }
8321 if (mp->b_band == 0)
8322 retevents |= normevents;
8323 else
8324 retevents |= (events & (POLLIN | POLLRDBAND));
8325 break;
8326 }
8327 if (! (retevents & normevents) &&
8328 (stp->sd_wakeq & RSLEEP)) {
8329 /*
8330 * Sync stream barrier read queue has data.
8331 */
8332 retevents |= normevents;
8333 }
8334 /* Treat eof as normal data */
8335 if (sd_flags & STREOF)
8336 retevents |= normevents;
8337 }
8338
8339 *reventsp = (short)retevents;
8340 if (retevents) {
8341 if (headlocked)
8342 mutex_exit(&stp->sd_lock);
8343 return (0);
8344 }
8345
8346 /*
8347 * If poll() has not found any events yet, set up event cell
8348 * to wake up the poll if a requested event occurs on this
8349 * stream. Check for collisions with outstanding poll requests.
8350 */
8351 if (!anyyet) {
8352 *phpp = &stp->sd_pollist;
8353 if (headlocked == 0) {
8354 polllock(&stp->sd_pollist, &stp->sd_lock);
8355 headlocked = 1;
8356 }
8357 stp->sd_rput_opt |= SR_POLLIN;
8358 }
8359 if (headlocked)
8360 mutex_exit(&stp->sd_lock);
8361 return (0);
8362 }
8363
8364 /*
8365 * The purpose of putback() is to assure sleeping polls/reads
8366 * are awakened when there are no new messages arriving at the,
8367 * stream head, and a message is placed back on the read queue.
8368 *
8369 * sd_lock must be held when messages are placed back on stream
8370 * head. (getq() holds sd_lock when it removes messages from
8371 * the queue)
8372 */
8373
8374 static void
8375 putback(struct stdata *stp, queue_t *q, mblk_t *bp, int band)
8376 {
8377 mblk_t *qfirst;
8378 ASSERT(MUTEX_HELD(&stp->sd_lock));
8379
8380 /*
8381 * As a result of lock-step ordering around q_lock and sd_lock,
8382 * it's possible for function calls like putnext() and
8383 * canputnext() to get an inaccurate picture of how much
8384 * data is really being processed at the stream head.
8385 * We only consolidate with existing messages on the queue
8386 * if the length of the message we want to put back is smaller
8387 * than the queue hiwater mark.
8388 */
8389 if ((stp->sd_rput_opt & SR_CONSOL_DATA) &&
8390 (DB_TYPE(bp) == M_DATA) && ((qfirst = q->q_first) != NULL) &&
8391 (DB_TYPE(qfirst) == M_DATA) &&
8392 ((qfirst->b_flag & (MSGMARK|MSGDELIM)) == 0) &&
8393 ((bp->b_flag & (MSGMARK|MSGDELIM|MSGMARKNEXT)) == 0) &&
8394 (mp_cont_len(bp, NULL) < q->q_hiwat)) {
8395 /*
8396 * We use the same logic as defined in strrput()
8397 * but in reverse as we are putting back onto the
8398 * queue and want to retain byte ordering.
8399 * Consolidate M_DATA messages with M_DATA ONLY.
8400 * strrput() allows the consolidation of M_DATA onto
8401 * M_PROTO | M_PCPROTO but not the other way round.
8402 *
8403 * The consolidation does not take place if the message
8404 * we are returning to the queue is marked with either
8405 * of the marks or the delim flag or if q_first
8406 * is marked with MSGMARK. The MSGMARK check is needed to
8407 * handle the odd semantics of MSGMARK where essentially
8408 * the whole message is to be treated as marked.
8409 * Carry any MSGMARKNEXT and MSGNOTMARKNEXT from q_first
8410 * to the front of the b_cont chain.
8411 */
8412 rmvq_noenab(q, qfirst);
8413
8414 /*
8415 * The first message in the b_cont list
8416 * tracks MSGMARKNEXT and MSGNOTMARKNEXT.
8417 * We need to handle the case where we
8418 * are appending:
8419 *
8420 * 1) a MSGMARKNEXT to a MSGNOTMARKNEXT.
8421 * 2) a MSGMARKNEXT to a plain message.
8422 * 3) a MSGNOTMARKNEXT to a plain message
8423 * 4) a MSGNOTMARKNEXT to a MSGNOTMARKNEXT
8424 * message.
8425 *
8426 * Thus we never append a MSGMARKNEXT or
8427 * MSGNOTMARKNEXT to a MSGMARKNEXT message.
8428 */
8429 if (qfirst->b_flag & MSGMARKNEXT) {
8430 bp->b_flag |= MSGMARKNEXT;
8431 bp->b_flag &= ~MSGNOTMARKNEXT;
8432 qfirst->b_flag &= ~MSGMARKNEXT;
8433 } else if (qfirst->b_flag & MSGNOTMARKNEXT) {
8434 bp->b_flag |= MSGNOTMARKNEXT;
8435 qfirst->b_flag &= ~MSGNOTMARKNEXT;
8436 }
8437
8438 linkb(bp, qfirst);
8439 }
8440 (void) putbq(q, bp);
8441
8442 /*
8443 * A message may have come in when the sd_lock was dropped in the
8444 * calling routine. If this is the case and STR*ATMARK info was
8445 * received, need to move that from the stream head to the q_last
8446 * so that SIOCATMARK can return the proper value.
8447 */
8448 if (stp->sd_flag & (STRATMARK | STRNOTATMARK)) {
8449 unsigned short *flagp = &q->q_last->b_flag;
8450 uint_t b_flag = (uint_t)*flagp;
8451
8452 if (stp->sd_flag & STRATMARK) {
8453 b_flag &= ~MSGNOTMARKNEXT;
8454 b_flag |= MSGMARKNEXT;
8455 stp->sd_flag &= ~STRATMARK;
8456 } else {
8457 b_flag &= ~MSGMARKNEXT;
8458 b_flag |= MSGNOTMARKNEXT;
8459 stp->sd_flag &= ~STRNOTATMARK;
8460 }
8461 *flagp = (unsigned short) b_flag;
8462 }
8463
8464 #ifdef DEBUG
8465 /*
8466 * Make sure that the flags are not messed up.
8467 */
8468 {
8469 mblk_t *mp;
8470 mp = q->q_last;
8471 while (mp != NULL) {
8472 ASSERT((mp->b_flag & (MSGMARKNEXT|MSGNOTMARKNEXT)) !=
8473 (MSGMARKNEXT|MSGNOTMARKNEXT));
8474 mp = mp->b_cont;
8475 }
8476 }
8477 #endif
8478 if (q->q_first == bp) {
8479 short pollevents;
8480
8481 if (stp->sd_flag & RSLEEP) {
8482 stp->sd_flag &= ~RSLEEP;
8483 cv_broadcast(&q->q_wait);
8484 }
8485 if (stp->sd_flag & STRPRI) {
8486 pollevents = POLLPRI;
8487 } else {
8488 if (band == 0) {
8489 if (!(stp->sd_rput_opt & SR_POLLIN))
8490 return;
8491 stp->sd_rput_opt &= ~SR_POLLIN;
8492 pollevents = POLLIN | POLLRDNORM;
8493 } else {
8494 pollevents = POLLIN | POLLRDBAND;
8495 }
8496 }
8497 mutex_exit(&stp->sd_lock);
8498 pollwakeup(&stp->sd_pollist, pollevents);
8499 mutex_enter(&stp->sd_lock);
8500 }
8501 }
8502
8503 /*
8504 * Return the held vnode attached to the stream head of a
8505 * given queue
8506 * It is the responsibility of the calling routine to ensure
8507 * that the queue does not go away (e.g. pop).
8508 */
8509 vnode_t *
8510 strq2vp(queue_t *qp)
8511 {
8512 vnode_t *vp;
8513 vp = STREAM(qp)->sd_vnode;
8514 ASSERT(vp != NULL);
8515 VN_HOLD(vp);
8516 return (vp);
8517 }
8518
8519 /*
8520 * return the stream head write queue for the given vp
8521 * It is the responsibility of the calling routine to ensure
8522 * that the stream or vnode do not close.
8523 */
8524 queue_t *
8525 strvp2wq(vnode_t *vp)
8526 {
8527 ASSERT(vp->v_stream != NULL);
8528 return (vp->v_stream->sd_wrq);
8529 }
8530
8531 /*
8532 * pollwakeup stream head
8533 * It is the responsibility of the calling routine to ensure
8534 * that the stream or vnode do not close.
8535 */
8536 void
8537 strpollwakeup(vnode_t *vp, short event)
8538 {
8539 ASSERT(vp->v_stream);
8540 pollwakeup(&vp->v_stream->sd_pollist, event);
8541 }
8542
8543 /*
8544 * Mate the stream heads of two vnodes together. If the two vnodes are the
8545 * same, we just make the write-side point at the read-side -- otherwise,
8546 * we do a full mate. Only works on vnodes associated with streams that are
8547 * still being built and thus have only a stream head.
8548 */
8549 void
8550 strmate(vnode_t *vp1, vnode_t *vp2)
8551 {
8552 queue_t *wrq1 = strvp2wq(vp1);
8553 queue_t *wrq2 = strvp2wq(vp2);
8554
8555 /*
8556 * Verify that there are no modules on the stream yet. We also
8557 * rely on the stream head always having a service procedure to
8558 * avoid tweaking q_nfsrv.
8559 */
8560 ASSERT(wrq1->q_next == NULL && wrq2->q_next == NULL);
8561 ASSERT(wrq1->q_qinfo->qi_srvp != NULL);
8562 ASSERT(wrq2->q_qinfo->qi_srvp != NULL);
8563
8564 /*
8565 * If the queues are the same, just twist; otherwise do a full mate.
8566 */
8567 if (wrq1 == wrq2) {
8568 wrq1->q_next = _RD(wrq1);
8569 } else {
8570 wrq1->q_next = _RD(wrq2);
8571 wrq2->q_next = _RD(wrq1);
8572 STREAM(wrq1)->sd_mate = STREAM(wrq2);
8573 STREAM(wrq1)->sd_flag |= STRMATE;
8574 STREAM(wrq2)->sd_mate = STREAM(wrq1);
8575 STREAM(wrq2)->sd_flag |= STRMATE;
8576 }
8577 }
8578
8579 /*
8580 * XXX will go away when console is correctly fixed.
8581 * Clean up the console PIDS, from previous I_SETSIG,
8582 * called only for cnopen which never calls strclean().
8583 */
8584 void
8585 str_cn_clean(struct vnode *vp)
8586 {
8587 strsig_t *ssp, *pssp, *tssp;
8588 struct stdata *stp;
8589 struct pid *pidp;
8590 int update = 0;
8591
8592 ASSERT(vp->v_stream);
8593 stp = vp->v_stream;
8594 pssp = NULL;
8595 mutex_enter(&stp->sd_lock);
8596 ssp = stp->sd_siglist;
8597 while (ssp) {
8598 mutex_enter(&pidlock);
8599 pidp = ssp->ss_pidp;
8600 /*
8601 * Get rid of PID if the proc is gone.
8602 */
8603 if (pidp->pid_prinactive) {
8604 tssp = ssp->ss_next;
8605 if (pssp)
8606 pssp->ss_next = tssp;
8607 else
8608 stp->sd_siglist = tssp;
8609 ASSERT(pidp->pid_ref <= 1);
8610 PID_RELE(ssp->ss_pidp);
8611 mutex_exit(&pidlock);
8612 kmem_free(ssp, sizeof (strsig_t));
8613 update = 1;
8614 ssp = tssp;
8615 continue;
8616 } else
8617 mutex_exit(&pidlock);
8618 pssp = ssp;
8619 ssp = ssp->ss_next;
8620 }
8621 if (update) {
8622 stp->sd_sigflags = 0;
8623 for (ssp = stp->sd_siglist; ssp; ssp = ssp->ss_next)
8624 stp->sd_sigflags |= ssp->ss_events;
8625 }
8626 mutex_exit(&stp->sd_lock);
8627 }
8628
8629 /*
8630 * Return B_TRUE if there is data in the message, B_FALSE otherwise.
8631 */
8632 static boolean_t
8633 msghasdata(mblk_t *bp)
8634 {
8635 for (; bp; bp = bp->b_cont)
8636 if (bp->b_datap->db_type == M_DATA) {
8637 ASSERT(bp->b_wptr >= bp->b_rptr);
8638 if (bp->b_wptr > bp->b_rptr)
8639 return (B_TRUE);
8640 }
8641 return (B_FALSE);
8642 }
8643
8644 /*
8645 * Check whether a stream is an XTI stream or not.
8646 */
8647 static boolean_t
8648 is_xti_str(const struct stdata *stp)
8649 {
8650 struct devnames *dnp;
8651 vnode_t *vn;
8652 major_t major;
8653 if ((vn = stp->sd_vnode) != NULL && vn->v_type == VCHR &&
8654 vn->v_rdev != 0) {
8655 major = getmajor(vn->v_rdev);
8656 dnp = (major != DDI_MAJOR_T_NONE && major >= 0 &&
8657 major < devcnt) ? &devnamesp[major] : NULL;
8658 if (dnp != NULL && dnp->dn_name != NULL &&
8659 (strcmp(dnp->dn_name, "ip") == 0 ||
8660 strcmp(dnp->dn_name, "tcp") == 0 ||
8661 strcmp(dnp->dn_name, "udp") == 0 ||
8662 strcmp(dnp->dn_name, "icmp") == 0 ||
8663 strcmp(dnp->dn_name, "tl") == 0 ||
8664 strcmp(dnp->dn_name, "ip6") == 0 ||
8665 strcmp(dnp->dn_name, "tcp6") == 0 ||
8666 strcmp(dnp->dn_name, "udp6") == 0 ||
8667 strcmp(dnp->dn_name, "icmp6") == 0)) {
8668 return (B_TRUE);
8669 }
8670 }
8671 return (B_FALSE);
8672 }