1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21 /* Copyright (c) 1984, 1986, 1987, 1988, 1989 AT&T */
22 /* All Rights Reserved */
23
24
25 /*
26 * Copyright (c) 1988, 2010, Oracle and/or its affiliates. All rights reserved.
27 * Copyright (c) 2014, Joyent, Inc. All rights reserved.
28 */
29
30 #include <sys/types.h>
31 #include <sys/sysmacros.h>
32 #include <sys/param.h>
33 #include <sys/errno.h>
34 #include <sys/signal.h>
35 #include <sys/stat.h>
36 #include <sys/proc.h>
37 #include <sys/cred.h>
38 #include <sys/user.h>
39 #include <sys/vnode.h>
40 #include <sys/file.h>
41 #include <sys/stream.h>
42 #include <sys/strsubr.h>
43 #include <sys/stropts.h>
44 #include <sys/tihdr.h>
45 #include <sys/var.h>
46 #include <sys/poll.h>
47 #include <sys/termio.h>
48 #include <sys/ttold.h>
49 #include <sys/systm.h>
50 #include <sys/uio.h>
51 #include <sys/cmn_err.h>
52 #include <sys/sad.h>
53 #include <sys/netstack.h>
54 #include <sys/priocntl.h>
55 #include <sys/jioctl.h>
56 #include <sys/procset.h>
57 #include <sys/session.h>
58 #include <sys/kmem.h>
59 #include <sys/filio.h>
60 #include <sys/vtrace.h>
61 #include <sys/debug.h>
62 #include <sys/strredir.h>
63 #include <sys/fs/fifonode.h>
64 #include <sys/fs/snode.h>
65 #include <sys/strlog.h>
66 #include <sys/strsun.h>
67 #include <sys/project.h>
68 #include <sys/kbio.h>
69 #include <sys/msio.h>
70 #include <sys/tty.h>
71 #include <sys/ptyvar.h>
72 #include <sys/vuid_event.h>
73 #include <sys/modctl.h>
74 #include <sys/sunddi.h>
75 #include <sys/sunldi_impl.h>
76 #include <sys/autoconf.h>
77 #include <sys/policy.h>
78 #include <sys/dld.h>
79 #include <sys/zone.h>
80 #include <c2/audit.h>
81
82 /*
83 * This define helps improve the readability of streams code while
84 * still maintaining a very old streams performance enhancement. The
85 * performance enhancement basically involved having all callers
86 * of straccess() perform the first check that straccess() will do
87 * locally before actually calling straccess(). (There by reducing
88 * the number of unnecessary calls to straccess().)
89 */
90 #define i_straccess(x, y) ((stp->sd_sidp == NULL) ? 0 : \
91 (stp->sd_vnode->v_type == VFIFO) ? 0 : \
92 straccess((x), (y)))
93
94 /*
95 * what is mblk_pull_len?
96 *
97 * If a streams message consists of many short messages,
98 * a performance degradation occurs from copyout overhead.
99 * To decrease the per mblk overhead, messages that are
100 * likely to consist of many small mblks are pulled up into
101 * one continuous chunk of memory.
102 *
103 * To avoid the processing overhead of examining every
104 * mblk, a quick heuristic is used. If the first mblk in
105 * the message is shorter than mblk_pull_len, it is likely
106 * that the rest of the mblk will be short.
107 *
108 * This heuristic was decided upon after performance tests
109 * indicated that anything more complex slowed down the main
110 * code path.
111 */
112 #define MBLK_PULL_LEN 64
113 uint32_t mblk_pull_len = MBLK_PULL_LEN;
114
115 /*
116 * The sgttyb_handling flag controls the handling of the old BSD
117 * TIOCGETP, TIOCSETP, and TIOCSETN ioctls as follows:
118 *
119 * 0 - Emit no warnings at all and retain old, broken behavior.
120 * 1 - Emit no warnings and silently handle new semantics.
121 * 2 - Send cmn_err(CE_NOTE) when either TIOCSETP or TIOCSETN is used
122 * (once per system invocation). Handle with new semantics.
123 * 3 - Send SIGSYS when any TIOCGETP, TIOCSETP, or TIOCSETN call is
124 * made (so that offenders drop core and are easy to debug).
125 *
126 * The "new semantics" are that TIOCGETP returns B38400 for
127 * sg_[io]speed if the corresponding value is over B38400, and that
128 * TIOCSET[PN] accept B38400 in these cases to mean "retain current
129 * bit rate."
130 */
131 int sgttyb_handling = 1;
132 static boolean_t sgttyb_complaint;
133
134 /* don't push drcompat module by default on Style-2 streams */
135 static int push_drcompat = 0;
136
137 /*
138 * id value used to distinguish between different ioctl messages
139 */
140 static uint32_t ioc_id;
141
142 static void putback(struct stdata *, queue_t *, mblk_t *, int);
143 static void strcleanall(struct vnode *);
144 static int strwsrv(queue_t *);
145 static int strdocmd(struct stdata *, struct strcmd *, cred_t *);
146
147 /*
148 * qinit and module_info structures for stream head read and write queues
149 */
150 struct module_info strm_info = { 0, "strrhead", 0, INFPSZ, STRHIGH, STRLOW };
151 struct module_info stwm_info = { 0, "strwhead", 0, 0, 0, 0 };
152 struct qinit strdata = { strrput, NULL, NULL, NULL, NULL, &strm_info };
153 struct qinit stwdata = { NULL, strwsrv, NULL, NULL, NULL, &stwm_info };
154 struct module_info fiform_info = { 0, "fifostrrhead", 0, PIPE_BUF, FIFOHIWAT,
155 FIFOLOWAT };
156 struct module_info fifowm_info = { 0, "fifostrwhead", 0, 0, 0, 0 };
157 struct qinit fifo_strdata = { strrput, NULL, NULL, NULL, NULL, &fiform_info };
158 struct qinit fifo_stwdata = { NULL, strwsrv, NULL, NULL, NULL, &fifowm_info };
159
160 extern kmutex_t strresources; /* protects global resources */
161 extern kmutex_t muxifier; /* single-threads multiplexor creation */
162
163 static boolean_t msghasdata(mblk_t *bp);
164 #define msgnodata(bp) (!msghasdata(bp))
165
166 /*
167 * Stream head locking notes:
168 * There are four monitors associated with the stream head:
169 * 1. v_stream monitor: in stropen() and strclose() v_lock
170 * is held while the association of vnode and stream
171 * head is established or tested for.
172 * 2. open/close/push/pop monitor: sd_lock is held while each
173 * thread bids for exclusive access to this monitor
174 * for opening or closing a stream. In addition, this
175 * monitor is entered during pushes and pops. This
176 * guarantees that during plumbing operations there
177 * is only one thread trying to change the plumbing.
178 * Any other threads present in the stream are only
179 * using the plumbing.
180 * 3. read/write monitor: in the case of read, a thread holds
181 * sd_lock while trying to get data from the stream
182 * head queue. if there is none to fulfill a read
183 * request, it sets RSLEEP and calls cv_wait_sig() down
184 * in strwaitq() to await the arrival of new data.
185 * when new data arrives in strrput(), sd_lock is acquired
186 * before testing for RSLEEP and calling cv_broadcast().
187 * the behavior of strwrite(), strwsrv(), and WSLEEP
188 * mirror this.
189 * 4. ioctl monitor: sd_lock is gotten to ensure that only one
190 * thread is doing an ioctl at a time.
191 */
192
193 static int
194 push_mod(queue_t *qp, dev_t *devp, struct stdata *stp, const char *name,
195 int anchor, cred_t *crp, uint_t anchor_zoneid)
196 {
197 int error;
198 fmodsw_impl_t *fp;
199
200 if (stp->sd_flag & (STRHUP|STRDERR|STWRERR)) {
201 error = (stp->sd_flag & STRHUP) ? ENXIO : EIO;
202 return (error);
203 }
204 if (stp->sd_pushcnt >= nstrpush) {
205 return (EINVAL);
206 }
207
208 if ((fp = fmodsw_find(name, FMODSW_HOLD | FMODSW_LOAD)) == NULL) {
209 stp->sd_flag |= STREOPENFAIL;
210 return (EINVAL);
211 }
212
213 /*
214 * push new module and call its open routine via qattach
215 */
216 if ((error = qattach(qp, devp, 0, crp, fp, B_FALSE)) != 0)
217 return (error);
218
219 /*
220 * Check to see if caller wants a STREAMS anchor
221 * put at this place in the stream, and add if so.
222 */
223 mutex_enter(&stp->sd_lock);
224 if (anchor == stp->sd_pushcnt) {
225 stp->sd_anchor = stp->sd_pushcnt;
226 stp->sd_anchorzone = anchor_zoneid;
227 }
228 mutex_exit(&stp->sd_lock);
229
230 return (0);
231 }
232
233 /*
234 * Open a stream device.
235 */
236 int
237 stropen(vnode_t *vp, dev_t *devp, int flag, cred_t *crp)
238 {
239 struct stdata *stp;
240 queue_t *qp;
241 int s;
242 dev_t dummydev, savedev;
243 struct autopush *ap;
244 struct dlautopush dlap;
245 int error = 0;
246 ssize_t rmin, rmax;
247 int cloneopen;
248 queue_t *brq;
249 major_t major;
250 str_stack_t *ss;
251 zoneid_t zoneid;
252 uint_t anchor;
253
254 /*
255 * If the stream already exists, wait for any open in progress
256 * to complete, then call the open function of each module and
257 * driver in the stream. Otherwise create the stream.
258 */
259 TRACE_1(TR_FAC_STREAMS_FR, TR_STROPEN, "stropen:%p", vp);
260 retry:
261 mutex_enter(&vp->v_lock);
262 if ((stp = vp->v_stream) != NULL) {
263
264 /*
265 * Waiting for stream to be created to device
266 * due to another open.
267 */
268 mutex_exit(&vp->v_lock);
269
270 if (STRMATED(stp)) {
271 struct stdata *strmatep = stp->sd_mate;
272
273 STRLOCKMATES(stp);
274 if (strmatep->sd_flag & (STWOPEN|STRCLOSE|STRPLUMB)) {
275 if (flag & (FNDELAY|FNONBLOCK)) {
276 error = EAGAIN;
277 mutex_exit(&strmatep->sd_lock);
278 goto ckreturn;
279 }
280 mutex_exit(&stp->sd_lock);
281 if (!cv_wait_sig(&strmatep->sd_monitor,
282 &strmatep->sd_lock)) {
283 error = EINTR;
284 mutex_exit(&strmatep->sd_lock);
285 mutex_enter(&stp->sd_lock);
286 goto ckreturn;
287 }
288 mutex_exit(&strmatep->sd_lock);
289 goto retry;
290 }
291 if (stp->sd_flag & (STWOPEN|STRCLOSE|STRPLUMB)) {
292 if (flag & (FNDELAY|FNONBLOCK)) {
293 error = EAGAIN;
294 mutex_exit(&strmatep->sd_lock);
295 goto ckreturn;
296 }
297 mutex_exit(&strmatep->sd_lock);
298 if (!cv_wait_sig(&stp->sd_monitor,
299 &stp->sd_lock)) {
300 error = EINTR;
301 goto ckreturn;
302 }
303 mutex_exit(&stp->sd_lock);
304 goto retry;
305 }
306
307 if (stp->sd_flag & (STRDERR|STWRERR)) {
308 error = EIO;
309 mutex_exit(&strmatep->sd_lock);
310 goto ckreturn;
311 }
312
313 stp->sd_flag |= STWOPEN;
314 STRUNLOCKMATES(stp);
315 } else {
316 mutex_enter(&stp->sd_lock);
317 if (stp->sd_flag & (STWOPEN|STRCLOSE|STRPLUMB)) {
318 if (flag & (FNDELAY|FNONBLOCK)) {
319 error = EAGAIN;
320 goto ckreturn;
321 }
322 if (!cv_wait_sig(&stp->sd_monitor,
323 &stp->sd_lock)) {
324 error = EINTR;
325 goto ckreturn;
326 }
327 mutex_exit(&stp->sd_lock);
328 goto retry; /* could be clone! */
329 }
330
331 if (stp->sd_flag & (STRDERR|STWRERR)) {
332 error = EIO;
333 goto ckreturn;
334 }
335
336 stp->sd_flag |= STWOPEN;
337 mutex_exit(&stp->sd_lock);
338 }
339
340 /*
341 * Open all modules and devices down stream to notify
342 * that another user is streaming. For modules, set the
343 * last argument to MODOPEN and do not pass any open flags.
344 * Ignore dummydev since this is not the first open.
345 */
346 claimstr(stp->sd_wrq);
347 qp = stp->sd_wrq;
348 while (_SAMESTR(qp)) {
349 qp = qp->q_next;
350 if ((error = qreopen(_RD(qp), devp, flag, crp)) != 0)
351 break;
352 }
353 releasestr(stp->sd_wrq);
354 mutex_enter(&stp->sd_lock);
355 stp->sd_flag &= ~(STRHUP|STWOPEN|STRDERR|STWRERR);
356 stp->sd_rerror = 0;
357 stp->sd_werror = 0;
358 ckreturn:
359 cv_broadcast(&stp->sd_monitor);
360 mutex_exit(&stp->sd_lock);
361 return (error);
362 }
363
364 /*
365 * This vnode isn't streaming. SPECFS already
366 * checked for multiple vnodes pointing to the
367 * same stream, so create a stream to the driver.
368 */
369 qp = allocq();
370 stp = shalloc(qp);
371
372 /*
373 * Initialize stream head. shalloc() has given us
374 * exclusive access, and we have the vnode locked;
375 * we can do whatever we want with stp.
376 */
377 stp->sd_flag = STWOPEN;
378 stp->sd_siglist = NULL;
379 stp->sd_pollist.ph_list = NULL;
380 stp->sd_sigflags = 0;
381 stp->sd_mark = NULL;
382 stp->sd_closetime = STRTIMOUT;
383 stp->sd_sidp = NULL;
384 stp->sd_pgidp = NULL;
385 stp->sd_vnode = vp;
386 stp->sd_rerror = 0;
387 stp->sd_werror = 0;
388 stp->sd_wroff = 0;
389 stp->sd_tail = 0;
390 stp->sd_iocblk = NULL;
391 stp->sd_cmdblk = NULL;
392 stp->sd_pushcnt = 0;
393 stp->sd_qn_minpsz = 0;
394 stp->sd_qn_maxpsz = INFPSZ - 1; /* used to check for initialization */
395 stp->sd_maxblk = INFPSZ;
396 qp->q_ptr = _WR(qp)->q_ptr = stp;
397 STREAM(qp) = STREAM(_WR(qp)) = stp;
398 vp->v_stream = stp;
399 mutex_exit(&vp->v_lock);
400 if (vp->v_type == VFIFO) {
401 stp->sd_flag |= OLDNDELAY;
402 /*
403 * This means, both for pipes and fifos
404 * strwrite will send SIGPIPE if the other
405 * end is closed. For putmsg it depends
406 * on whether it is a XPG4_2 application
407 * or not
408 */
409 stp->sd_wput_opt = SW_SIGPIPE;
410
411 /* setq might sleep in kmem_alloc - avoid holding locks. */
412 setq(qp, &fifo_strdata, &fifo_stwdata, NULL, QMTSAFE,
413 SQ_CI|SQ_CO, B_FALSE);
414
415 set_qend(qp);
416 stp->sd_strtab = fifo_getinfo();
417 _WR(qp)->q_nfsrv = _WR(qp);
418 qp->q_nfsrv = qp;
419 /*
420 * Wake up others that are waiting for stream to be created.
421 */
422 mutex_enter(&stp->sd_lock);
423 /*
424 * nothing is be pushed on stream yet, so
425 * optimized stream head packetsizes are just that
426 * of the read queue
427 */
428 stp->sd_qn_minpsz = qp->q_minpsz;
429 stp->sd_qn_maxpsz = qp->q_maxpsz;
430 stp->sd_flag &= ~STWOPEN;
431 goto fifo_opendone;
432 }
433 /* setq might sleep in kmem_alloc - avoid holding locks. */
434 setq(qp, &strdata, &stwdata, NULL, QMTSAFE, SQ_CI|SQ_CO, B_FALSE);
435
436 set_qend(qp);
437
438 /*
439 * Open driver and create stream to it (via qattach).
440 */
441 savedev = *devp;
442 cloneopen = (getmajor(*devp) == clone_major);
443 if ((error = qattach(qp, devp, flag, crp, NULL, B_FALSE)) != 0) {
444 mutex_enter(&vp->v_lock);
445 vp->v_stream = NULL;
446 mutex_exit(&vp->v_lock);
447 mutex_enter(&stp->sd_lock);
448 cv_broadcast(&stp->sd_monitor);
449 mutex_exit(&stp->sd_lock);
450 freeq(_RD(qp));
451 shfree(stp);
452 return (error);
453 }
454 /*
455 * Set sd_strtab after open in order to handle clonable drivers
456 */
457 stp->sd_strtab = STREAMSTAB(getmajor(*devp));
458
459 /*
460 * Historical note: dummydev used to be be prior to the initial
461 * open (via qattach above), which made the value seen
462 * inconsistent between an I_PUSH and an autopush of a module.
463 */
464 dummydev = *devp;
465
466 /*
467 * For clone open of old style (Q not associated) network driver,
468 * push DRMODNAME module to handle DL_ATTACH/DL_DETACH
469 */
470 brq = _RD(_WR(qp)->q_next);
471 major = getmajor(*devp);
472 if (push_drcompat && cloneopen && NETWORK_DRV(major) &&
473 ((brq->q_flag & _QASSOCIATED) == 0)) {
474 if (push_mod(qp, &dummydev, stp, DRMODNAME, 0, crp, 0) != 0)
475 cmn_err(CE_WARN, "cannot push " DRMODNAME
476 " streams module");
477 }
478
479 if (!NETWORK_DRV(major)) {
480 savedev = *devp;
481 } else {
482 /*
483 * For network devices, process differently based on the
484 * return value from dld_autopush():
485 *
486 * 0: the passed-in device points to a GLDv3 datalink with
487 * per-link autopush configuration; use that configuration
488 * and ignore any per-driver autopush configuration.
489 *
490 * 1: the passed-in device points to a physical GLDv3
491 * datalink without per-link autopush configuration. The
492 * passed in device was changed to refer to the actual
493 * physical device (if it's not already); we use that new
494 * device to look up any per-driver autopush configuration.
495 *
496 * -1: neither of the above cases applied; use the initial
497 * device to look up any per-driver autopush configuration.
498 */
499 switch (dld_autopush(&savedev, &dlap)) {
500 case 0:
501 zoneid = crgetzoneid(crp);
502 for (s = 0; s < dlap.dap_npush; s++) {
503 error = push_mod(qp, &dummydev, stp,
504 dlap.dap_aplist[s], dlap.dap_anchor, crp,
505 zoneid);
506 if (error != 0)
507 break;
508 }
509 goto opendone;
510 case 1:
511 break;
512 case -1:
513 savedev = *devp;
514 break;
515 }
516 }
517 /*
518 * Find the autopush configuration based on "savedev". Start with the
519 * global zone. If not found check in the local zone.
520 */
521 zoneid = GLOBAL_ZONEID;
522 retryap:
523 ss = netstack_find_by_stackid(zoneid_to_netstackid(zoneid))->
524 netstack_str;
525 if ((ap = sad_ap_find_by_dev(savedev, ss)) == NULL) {
526 netstack_rele(ss->ss_netstack);
527 if (zoneid == GLOBAL_ZONEID) {
528 /*
529 * None found. Also look in the zone's autopush table.
530 */
531 zoneid = crgetzoneid(crp);
532 if (zoneid != GLOBAL_ZONEID)
533 goto retryap;
534 }
535 goto opendone;
536 }
537 anchor = ap->ap_anchor;
538 zoneid = crgetzoneid(crp);
539 for (s = 0; s < ap->ap_npush; s++) {
540 error = push_mod(qp, &dummydev, stp, ap->ap_list[s],
541 anchor, crp, zoneid);
542 if (error != 0)
543 break;
544 }
545 sad_ap_rele(ap, ss);
546 netstack_rele(ss->ss_netstack);
547
548 opendone:
549
550 /*
551 * let specfs know that open failed part way through
552 */
553 if (error) {
554 mutex_enter(&stp->sd_lock);
555 stp->sd_flag |= STREOPENFAIL;
556 mutex_exit(&stp->sd_lock);
557 }
558
559 /*
560 * Wake up others that are waiting for stream to be created.
561 */
562 mutex_enter(&stp->sd_lock);
563 stp->sd_flag &= ~STWOPEN;
564
565 /*
566 * As a performance concern we are caching the values of
567 * q_minpsz and q_maxpsz of the module below the stream
568 * head in the stream head.
569 */
570 mutex_enter(QLOCK(stp->sd_wrq->q_next));
571 rmin = stp->sd_wrq->q_next->q_minpsz;
572 rmax = stp->sd_wrq->q_next->q_maxpsz;
573 mutex_exit(QLOCK(stp->sd_wrq->q_next));
574
575 /* do this processing here as a performance concern */
576 if (strmsgsz != 0) {
577 if (rmax == INFPSZ)
578 rmax = strmsgsz;
579 else
580 rmax = MIN(strmsgsz, rmax);
581 }
582
583 mutex_enter(QLOCK(stp->sd_wrq));
584 stp->sd_qn_minpsz = rmin;
585 stp->sd_qn_maxpsz = rmax;
586 mutex_exit(QLOCK(stp->sd_wrq));
587
588 fifo_opendone:
589 cv_broadcast(&stp->sd_monitor);
590 mutex_exit(&stp->sd_lock);
591 return (error);
592 }
593
594 static int strsink(queue_t *, mblk_t *);
595 static struct qinit deadrend = {
596 strsink, NULL, NULL, NULL, NULL, &strm_info, NULL
597 };
598 static struct qinit deadwend = {
599 NULL, NULL, NULL, NULL, NULL, &stwm_info, NULL
600 };
601
602 /*
603 * Close a stream.
604 * This is called from closef() on the last close of an open stream.
605 * Strclean() will already have removed the siglist and pollist
606 * information, so all that remains is to remove all multiplexor links
607 * for the stream, pop all the modules (and the driver), and free the
608 * stream structure.
609 */
610
611 int
612 strclose(struct vnode *vp, int flag, cred_t *crp)
613 {
614 struct stdata *stp;
615 queue_t *qp;
616 int rval;
617 int freestp = 1;
618 queue_t *rmq;
619
620 TRACE_1(TR_FAC_STREAMS_FR,
621 TR_STRCLOSE, "strclose:%p", vp);
622 ASSERT(vp->v_stream);
623
624 stp = vp->v_stream;
625 ASSERT(!(stp->sd_flag & STPLEX));
626 qp = stp->sd_wrq;
627
628 /*
629 * Needed so that strpoll will return non-zero for this fd.
630 * Note that with POLLNOERR STRHUP does still cause POLLHUP.
631 */
632 mutex_enter(&stp->sd_lock);
633 stp->sd_flag |= STRHUP;
634 mutex_exit(&stp->sd_lock);
635
636 /*
637 * If the registered process or process group did not have an
638 * open instance of this stream then strclean would not be
639 * called. Thus at the time of closing all remaining siglist entries
640 * are removed.
641 */
642 if (stp->sd_siglist != NULL)
643 strcleanall(vp);
644
645 ASSERT(stp->sd_siglist == NULL);
646 ASSERT(stp->sd_sigflags == 0);
647
648 if (STRMATED(stp)) {
649 struct stdata *strmatep = stp->sd_mate;
650 int waited = 1;
651
652 STRLOCKMATES(stp);
653 while (waited) {
654 waited = 0;
655 while (stp->sd_flag & (STWOPEN|STRCLOSE|STRPLUMB)) {
656 mutex_exit(&strmatep->sd_lock);
657 cv_wait(&stp->sd_monitor, &stp->sd_lock);
658 mutex_exit(&stp->sd_lock);
659 STRLOCKMATES(stp);
660 waited = 1;
661 }
662 while (strmatep->sd_flag &
663 (STWOPEN|STRCLOSE|STRPLUMB)) {
664 mutex_exit(&stp->sd_lock);
665 cv_wait(&strmatep->sd_monitor,
666 &strmatep->sd_lock);
667 mutex_exit(&strmatep->sd_lock);
668 STRLOCKMATES(stp);
669 waited = 1;
670 }
671 }
672 stp->sd_flag |= STRCLOSE;
673 STRUNLOCKMATES(stp);
674 } else {
675 mutex_enter(&stp->sd_lock);
676 stp->sd_flag |= STRCLOSE;
677 mutex_exit(&stp->sd_lock);
678 }
679
680 ASSERT(qp->q_first == NULL); /* No more delayed write */
681
682 /* Check if an I_LINK was ever done on this stream */
683 if (stp->sd_flag & STRHASLINKS) {
684 netstack_t *ns;
685 str_stack_t *ss;
686
687 ns = netstack_find_by_cred(crp);
688 ASSERT(ns != NULL);
689 ss = ns->netstack_str;
690 ASSERT(ss != NULL);
691
692 (void) munlinkall(stp, LINKCLOSE|LINKNORMAL, crp, &rval, ss);
693 netstack_rele(ss->ss_netstack);
694 }
695
696 while (_SAMESTR(qp)) {
697 /*
698 * Holding sd_lock prevents q_next from changing in
699 * this stream.
700 */
701 mutex_enter(&stp->sd_lock);
702 if (!(flag & (FNDELAY|FNONBLOCK)) && (stp->sd_closetime > 0)) {
703
704 /*
705 * sleep until awakened by strwsrv() or timeout
706 */
707 for (;;) {
708 mutex_enter(QLOCK(qp->q_next));
709 if (!(qp->q_next->q_mblkcnt)) {
710 mutex_exit(QLOCK(qp->q_next));
711 break;
712 }
713 stp->sd_flag |= WSLEEP;
714
715 /* ensure strwsrv gets enabled */
716 qp->q_next->q_flag |= QWANTW;
717 mutex_exit(QLOCK(qp->q_next));
718 /* get out if we timed out or recv'd a signal */
719 if (str_cv_wait(&qp->q_wait, &stp->sd_lock,
720 stp->sd_closetime, 0) <= 0) {
721 break;
722 }
723 }
724 stp->sd_flag &= ~WSLEEP;
725 }
726 mutex_exit(&stp->sd_lock);
727
728 rmq = qp->q_next;
729 if (rmq->q_flag & QISDRV) {
730 ASSERT(!_SAMESTR(rmq));
731 wait_sq_svc(_RD(qp)->q_syncq);
732 }
733
734 qdetach(_RD(rmq), 1, flag, crp, B_FALSE);
735 }
736
737 /*
738 * Since we call pollwakeup in close() now, the poll list should
739 * be empty in most cases. The only exception is the layered devices
740 * (e.g. the console drivers with redirection modules pushed on top
741 * of it). We have to do this after calling qdetach() because
742 * the redirection module won't have torn down the console
743 * redirection until after qdetach() has been invoked.
744 */
745 if (stp->sd_pollist.ph_list != NULL) {
746 pollwakeup(&stp->sd_pollist, POLLERR);
747 pollhead_clean(&stp->sd_pollist);
748 }
749 ASSERT(stp->sd_pollist.ph_list == NULL);
750 ASSERT(stp->sd_sidp == NULL);
751 ASSERT(stp->sd_pgidp == NULL);
752
753 /* Prevent qenable from re-enabling the stream head queue */
754 disable_svc(_RD(qp));
755
756 /*
757 * Wait until service procedure of each queue is
758 * run, if QINSERVICE is set.
759 */
760 wait_svc(_RD(qp));
761
762 /*
763 * Now, flush both queues.
764 */
765 flushq(_RD(qp), FLUSHALL);
766 flushq(qp, FLUSHALL);
767
768 /*
769 * If the write queue of the stream head is pointing to a
770 * read queue, we have a twisted stream. If the read queue
771 * is alive, convert the stream head queues into a dead end.
772 * If the read queue is dead, free the dead pair.
773 */
774 if (qp->q_next && !_SAMESTR(qp)) {
775 if (qp->q_next->q_qinfo == &deadrend) { /* half-closed pipe */
776 flushq(qp->q_next, FLUSHALL); /* ensure no message */
777 shfree(qp->q_next->q_stream);
778 freeq(qp->q_next);
779 freeq(_RD(qp));
780 } else if (qp->q_next == _RD(qp)) { /* fifo */
781 freeq(_RD(qp));
782 } else { /* pipe */
783 freestp = 0;
784 /*
785 * The q_info pointers are never accessed when
786 * SQLOCK is held.
787 */
788 ASSERT(qp->q_syncq == _RD(qp)->q_syncq);
789 mutex_enter(SQLOCK(qp->q_syncq));
790 qp->q_qinfo = &deadwend;
791 _RD(qp)->q_qinfo = &deadrend;
792 mutex_exit(SQLOCK(qp->q_syncq));
793 }
794 } else {
795 freeq(_RD(qp)); /* free stream head queue pair */
796 }
797
798 mutex_enter(&vp->v_lock);
799 if (stp->sd_iocblk) {
800 if (stp->sd_iocblk != (mblk_t *)-1) {
801 freemsg(stp->sd_iocblk);
802 }
803 stp->sd_iocblk = NULL;
804 }
805 stp->sd_vnode = NULL;
806 vp->v_stream = NULL;
807 mutex_exit(&vp->v_lock);
808 mutex_enter(&stp->sd_lock);
809 freemsg(stp->sd_cmdblk);
810 stp->sd_cmdblk = NULL;
811 stp->sd_flag &= ~STRCLOSE;
812 cv_broadcast(&stp->sd_monitor);
813 mutex_exit(&stp->sd_lock);
814
815 if (freestp)
816 shfree(stp);
817 return (0);
818 }
819
820 static int
821 strsink(queue_t *q, mblk_t *bp)
822 {
823 struct copyresp *resp;
824
825 switch (bp->b_datap->db_type) {
826 case M_FLUSH:
827 if ((*bp->b_rptr & FLUSHW) && !(bp->b_flag & MSGNOLOOP)) {
828 *bp->b_rptr &= ~FLUSHR;
829 bp->b_flag |= MSGNOLOOP;
830 /*
831 * Protect against the driver passing up
832 * messages after it has done a qprocsoff.
833 */
834 if (_OTHERQ(q)->q_next == NULL)
835 freemsg(bp);
836 else
837 qreply(q, bp);
838 } else {
839 freemsg(bp);
840 }
841 break;
842
843 case M_COPYIN:
844 case M_COPYOUT:
845 if (bp->b_cont) {
846 freemsg(bp->b_cont);
847 bp->b_cont = NULL;
848 }
849 bp->b_datap->db_type = M_IOCDATA;
850 bp->b_wptr = bp->b_rptr + sizeof (struct copyresp);
851 resp = (struct copyresp *)bp->b_rptr;
852 resp->cp_rval = (caddr_t)1; /* failure */
853 /*
854 * Protect against the driver passing up
855 * messages after it has done a qprocsoff.
856 */
857 if (_OTHERQ(q)->q_next == NULL)
858 freemsg(bp);
859 else
860 qreply(q, bp);
861 break;
862
863 case M_IOCTL:
864 if (bp->b_cont) {
865 freemsg(bp->b_cont);
866 bp->b_cont = NULL;
867 }
868 bp->b_datap->db_type = M_IOCNAK;
869 /*
870 * Protect against the driver passing up
871 * messages after it has done a qprocsoff.
872 */
873 if (_OTHERQ(q)->q_next == NULL)
874 freemsg(bp);
875 else
876 qreply(q, bp);
877 break;
878
879 default:
880 freemsg(bp);
881 break;
882 }
883
884 return (0);
885 }
886
887 /*
888 * Clean up after a process when it closes a stream. This is called
889 * from closef for all closes, whereas strclose is called only for the
890 * last close on a stream. The siglist is scanned for entries for the
891 * current process, and these are removed.
892 */
893 void
894 strclean(struct vnode *vp)
895 {
896 strsig_t *ssp, *pssp, *tssp;
897 stdata_t *stp;
898 int update = 0;
899
900 TRACE_1(TR_FAC_STREAMS_FR,
901 TR_STRCLEAN, "strclean:%p", vp);
902 stp = vp->v_stream;
903 pssp = NULL;
904 mutex_enter(&stp->sd_lock);
905 ssp = stp->sd_siglist;
906 while (ssp) {
907 if (ssp->ss_pidp == curproc->p_pidp) {
908 tssp = ssp->ss_next;
909 if (pssp)
910 pssp->ss_next = tssp;
911 else
912 stp->sd_siglist = tssp;
913 mutex_enter(&pidlock);
914 PID_RELE(ssp->ss_pidp);
915 mutex_exit(&pidlock);
916 kmem_free(ssp, sizeof (strsig_t));
917 update = 1;
918 ssp = tssp;
919 } else {
920 pssp = ssp;
921 ssp = ssp->ss_next;
922 }
923 }
924 if (update) {
925 stp->sd_sigflags = 0;
926 for (ssp = stp->sd_siglist; ssp; ssp = ssp->ss_next)
927 stp->sd_sigflags |= ssp->ss_events;
928 }
929 mutex_exit(&stp->sd_lock);
930 }
931
932 /*
933 * Used on the last close to remove any remaining items on the siglist.
934 * These could be present on the siglist due to I_ESETSIG calls that
935 * use process groups or processed that do not have an open file descriptor
936 * for this stream (Such entries would not be removed by strclean).
937 */
938 static void
939 strcleanall(struct vnode *vp)
940 {
941 strsig_t *ssp, *nssp;
942 stdata_t *stp;
943
944 stp = vp->v_stream;
945 mutex_enter(&stp->sd_lock);
946 ssp = stp->sd_siglist;
947 stp->sd_siglist = NULL;
948 while (ssp) {
949 nssp = ssp->ss_next;
950 mutex_enter(&pidlock);
951 PID_RELE(ssp->ss_pidp);
952 mutex_exit(&pidlock);
953 kmem_free(ssp, sizeof (strsig_t));
954 ssp = nssp;
955 }
956 stp->sd_sigflags = 0;
957 mutex_exit(&stp->sd_lock);
958 }
959
960 /*
961 * Retrieve the next message from the logical stream head read queue
962 * using either rwnext (if sync stream) or getq_noenab.
963 * It is the callers responsibility to call qbackenable after
964 * it is finished with the message. The caller should not call
965 * qbackenable until after any putback calls to avoid spurious backenabling.
966 */
967 mblk_t *
968 strget(struct stdata *stp, queue_t *q, struct uio *uiop, int first,
969 int *errorp)
970 {
971 mblk_t *bp;
972 int error;
973 ssize_t rbytes = 0;
974
975 /* Holding sd_lock prevents the read queue from changing */
976 ASSERT(MUTEX_HELD(&stp->sd_lock));
977
978 if (uiop != NULL && stp->sd_struiordq != NULL &&
979 q->q_first == NULL &&
980 (!first || (stp->sd_wakeq & RSLEEP))) {
981 /*
982 * Stream supports rwnext() for the read side.
983 * If this is the first time we're called by e.g. strread
984 * only do the downcall if there is a deferred wakeup
985 * (registered in sd_wakeq).
986 */
987 struiod_t uiod;
988
989 if (first)
990 stp->sd_wakeq &= ~RSLEEP;
991
992 (void) uiodup(uiop, &uiod.d_uio, uiod.d_iov,
993 sizeof (uiod.d_iov) / sizeof (*uiod.d_iov));
994 uiod.d_mp = 0;
995 /*
996 * Mark that a thread is in rwnext on the read side
997 * to prevent strrput from nacking ioctls immediately.
998 * When the last concurrent rwnext returns
999 * the ioctls are nack'ed.
1000 */
1001 ASSERT(MUTEX_HELD(&stp->sd_lock));
1002 stp->sd_struiodnak++;
1003 /*
1004 * Note: rwnext will drop sd_lock.
1005 */
1006 error = rwnext(q, &uiod);
1007 ASSERT(MUTEX_NOT_HELD(&stp->sd_lock));
1008 mutex_enter(&stp->sd_lock);
1009 stp->sd_struiodnak--;
1010 while (stp->sd_struiodnak == 0 &&
1011 ((bp = stp->sd_struionak) != NULL)) {
1012 stp->sd_struionak = bp->b_next;
1013 bp->b_next = NULL;
1014 bp->b_datap->db_type = M_IOCNAK;
1015 /*
1016 * Protect against the driver passing up
1017 * messages after it has done a qprocsoff.
1018 */
1019 if (_OTHERQ(q)->q_next == NULL)
1020 freemsg(bp);
1021 else {
1022 mutex_exit(&stp->sd_lock);
1023 qreply(q, bp);
1024 mutex_enter(&stp->sd_lock);
1025 }
1026 }
1027 ASSERT(MUTEX_HELD(&stp->sd_lock));
1028 if (error == 0 || error == EWOULDBLOCK) {
1029 if ((bp = uiod.d_mp) != NULL) {
1030 *errorp = 0;
1031 ASSERT(MUTEX_HELD(&stp->sd_lock));
1032 return (bp);
1033 }
1034 error = 0;
1035 } else if (error == EINVAL) {
1036 /*
1037 * The stream plumbing must have
1038 * changed while we were away, so
1039 * just turn off rwnext()s.
1040 */
1041 error = 0;
1042 } else if (error == EBUSY) {
1043 /*
1044 * The module might have data in transit using putnext
1045 * Fall back on waiting + getq.
1046 */
1047 error = 0;
1048 } else {
1049 *errorp = error;
1050 ASSERT(MUTEX_HELD(&stp->sd_lock));
1051 return (NULL);
1052 }
1053 /*
1054 * Try a getq in case a rwnext() generated mblk
1055 * has bubbled up via strrput().
1056 */
1057 }
1058 *errorp = 0;
1059 ASSERT(MUTEX_HELD(&stp->sd_lock));
1060
1061 /*
1062 * If we have a valid uio, try and use this as a guide for how
1063 * many bytes to retrieve from the queue via getq_noenab().
1064 * Doing this can avoid unneccesary counting of overlong
1065 * messages in putback(). We currently only do this for sockets
1066 * and only if there is no sd_rputdatafunc hook.
1067 *
1068 * The sd_rputdatafunc hook transforms the entire message
1069 * before any bytes in it can be given to a client. So, rbytes
1070 * must be 0 if there is a hook.
1071 */
1072 if ((uiop != NULL) && (stp->sd_vnode->v_type == VSOCK) &&
1073 (stp->sd_rputdatafunc == NULL))
1074 rbytes = uiop->uio_resid;
1075
1076 return (getq_noenab(q, rbytes));
1077 }
1078
1079 /*
1080 * Copy out the message pointed to by `bp' into the uio pointed to by `uiop'.
1081 * If the message does not fit in the uio the remainder of it is returned;
1082 * otherwise NULL is returned. Any embedded zero-length mblk_t's are
1083 * consumed, even if uio_resid reaches zero. On error, `*errorp' is set to
1084 * the error code, the message is consumed, and NULL is returned.
1085 */
1086 static mblk_t *
1087 struiocopyout(mblk_t *bp, struct uio *uiop, int *errorp)
1088 {
1089 int error;
1090 ptrdiff_t n;
1091 mblk_t *nbp;
1092
1093 ASSERT(bp->b_wptr >= bp->b_rptr);
1094
1095 do {
1096 if ((n = MIN(uiop->uio_resid, MBLKL(bp))) != 0) {
1097 ASSERT(n > 0);
1098
1099 error = uiomove(bp->b_rptr, n, UIO_READ, uiop);
1100 if (error != 0) {
1101 freemsg(bp);
1102 *errorp = error;
1103 return (NULL);
1104 }
1105 }
1106
1107 bp->b_rptr += n;
1108 while (bp != NULL && (bp->b_rptr >= bp->b_wptr)) {
1109 nbp = bp;
1110 bp = bp->b_cont;
1111 freeb(nbp);
1112 }
1113 } while (bp != NULL && uiop->uio_resid > 0);
1114
1115 *errorp = 0;
1116 return (bp);
1117 }
1118
1119 /*
1120 * Read a stream according to the mode flags in sd_flag:
1121 *
1122 * (default mode) - Byte stream, msg boundaries are ignored
1123 * RD_MSGDIS (msg discard) - Read on msg boundaries and throw away
1124 * any data remaining in msg
1125 * RD_MSGNODIS (msg non-discard) - Read on msg boundaries and put back
1126 * any remaining data on head of read queue
1127 *
1128 * Consume readable messages on the front of the queue until
1129 * ttolwp(curthread)->lwp_count
1130 * is satisfied, the readable messages are exhausted, or a message
1131 * boundary is reached in a message mode. If no data was read and
1132 * the stream was not opened with the NDELAY flag, block until data arrives.
1133 * Otherwise return the data read and update the count.
1134 *
1135 * In default mode a 0 length message signifies end-of-file and terminates
1136 * a read in progress. The 0 length message is removed from the queue
1137 * only if it is the only message read (no data is read).
1138 *
1139 * An attempt to read an M_PROTO or M_PCPROTO message results in an
1140 * EBADMSG error return, unless either RD_PROTDAT or RD_PROTDIS are set.
1141 * If RD_PROTDAT is set, M_PROTO and M_PCPROTO messages are read as data.
1142 * If RD_PROTDIS is set, the M_PROTO and M_PCPROTO parts of the message
1143 * are unlinked from and M_DATA blocks in the message, the protos are
1144 * thrown away, and the data is read.
1145 */
1146 /* ARGSUSED */
1147 int
1148 strread(struct vnode *vp, struct uio *uiop, cred_t *crp)
1149 {
1150 struct stdata *stp;
1151 mblk_t *bp, *nbp;
1152 queue_t *q;
1153 int error = 0;
1154 uint_t old_sd_flag;
1155 int first;
1156 char rflg;
1157 uint_t mark; /* Contains MSG*MARK and _LASTMARK */
1158 #define _LASTMARK 0x8000 /* Distinct from MSG*MARK */
1159 short delim;
1160 unsigned char pri = 0;
1161 char waitflag;
1162 unsigned char type;
1163
1164 TRACE_1(TR_FAC_STREAMS_FR,
1165 TR_STRREAD_ENTER, "strread:%p", vp);
1166 ASSERT(vp->v_stream);
1167 stp = vp->v_stream;
1168
1169 mutex_enter(&stp->sd_lock);
1170
1171 if ((error = i_straccess(stp, JCREAD)) != 0) {
1172 mutex_exit(&stp->sd_lock);
1173 return (error);
1174 }
1175
1176 if (stp->sd_flag & (STRDERR|STPLEX)) {
1177 error = strgeterr(stp, STRDERR|STPLEX, 0);
1178 if (error != 0) {
1179 mutex_exit(&stp->sd_lock);
1180 return (error);
1181 }
1182 }
1183
1184 /*
1185 * Loop terminates when uiop->uio_resid == 0.
1186 */
1187 rflg = 0;
1188 waitflag = READWAIT;
1189 q = _RD(stp->sd_wrq);
1190 for (;;) {
1191 ASSERT(MUTEX_HELD(&stp->sd_lock));
1192 old_sd_flag = stp->sd_flag;
1193 mark = 0;
1194 delim = 0;
1195 first = 1;
1196 while ((bp = strget(stp, q, uiop, first, &error)) == NULL) {
1197 int done = 0;
1198
1199 ASSERT(MUTEX_HELD(&stp->sd_lock));
1200
1201 if (error != 0)
1202 goto oops;
1203
1204 if (stp->sd_flag & (STRHUP|STREOF)) {
1205 goto oops;
1206 }
1207 if (rflg && !(stp->sd_flag & STRDELIM)) {
1208 goto oops;
1209 }
1210 /*
1211 * If a read(fd,buf,0) has been done, there is no
1212 * need to sleep. We always have zero bytes to
1213 * return.
1214 */
1215 if (uiop->uio_resid == 0) {
1216 goto oops;
1217 }
1218
1219 qbackenable(q, 0);
1220
1221 TRACE_3(TR_FAC_STREAMS_FR, TR_STRREAD_WAIT,
1222 "strread calls strwaitq:%p, %p, %p",
1223 vp, uiop, crp);
1224 if ((error = strwaitq(stp, waitflag, uiop->uio_resid,
1225 uiop->uio_fmode, -1, &done)) != 0 || done) {
1226 TRACE_3(TR_FAC_STREAMS_FR, TR_STRREAD_DONE,
1227 "strread error or done:%p, %p, %p",
1228 vp, uiop, crp);
1229 if ((uiop->uio_fmode & FNDELAY) &&
1230 (stp->sd_flag & OLDNDELAY) &&
1231 (error == EAGAIN))
1232 error = 0;
1233 goto oops;
1234 }
1235 TRACE_3(TR_FAC_STREAMS_FR, TR_STRREAD_AWAKE,
1236 "strread awakes:%p, %p, %p", vp, uiop, crp);
1237 if ((error = i_straccess(stp, JCREAD)) != 0) {
1238 goto oops;
1239 }
1240 first = 0;
1241 }
1242
1243 ASSERT(MUTEX_HELD(&stp->sd_lock));
1244 ASSERT(bp);
1245 pri = bp->b_band;
1246 /*
1247 * Extract any mark information. If the message is not
1248 * completely consumed this information will be put in the mblk
1249 * that is putback.
1250 * If MSGMARKNEXT is set and the message is completely consumed
1251 * the STRATMARK flag will be set below. Likewise, if
1252 * MSGNOTMARKNEXT is set and the message is
1253 * completely consumed STRNOTATMARK will be set.
1254 *
1255 * For some unknown reason strread only breaks the read at the
1256 * last mark.
1257 */
1258 mark = bp->b_flag & (MSGMARK | MSGMARKNEXT | MSGNOTMARKNEXT);
1259 ASSERT((mark & (MSGMARKNEXT|MSGNOTMARKNEXT)) !=
1260 (MSGMARKNEXT|MSGNOTMARKNEXT));
1261 if (mark != 0 && bp == stp->sd_mark) {
1262 if (rflg) {
1263 putback(stp, q, bp, pri);
1264 goto oops;
1265 }
1266 mark |= _LASTMARK;
1267 stp->sd_mark = NULL;
1268 }
1269 if ((stp->sd_flag & STRDELIM) && (bp->b_flag & MSGDELIM))
1270 delim = 1;
1271 mutex_exit(&stp->sd_lock);
1272
1273 if (STREAM_NEEDSERVICE(stp))
1274 stream_runservice(stp);
1275
1276 type = bp->b_datap->db_type;
1277
1278 switch (type) {
1279
1280 case M_DATA:
1281 ismdata:
1282 if (msgnodata(bp)) {
1283 if (mark || delim) {
1284 freemsg(bp);
1285 } else if (rflg) {
1286
1287 /*
1288 * If already read data put zero
1289 * length message back on queue else
1290 * free msg and return 0.
1291 */
1292 bp->b_band = pri;
1293 mutex_enter(&stp->sd_lock);
1294 putback(stp, q, bp, pri);
1295 mutex_exit(&stp->sd_lock);
1296 } else {
1297 freemsg(bp);
1298 }
1299 error = 0;
1300 goto oops1;
1301 }
1302
1303 rflg = 1;
1304 waitflag |= NOINTR;
1305 bp = struiocopyout(bp, uiop, &error);
1306 if (error != 0)
1307 goto oops1;
1308
1309 mutex_enter(&stp->sd_lock);
1310 if (bp) {
1311 /*
1312 * Have remaining data in message.
1313 * Free msg if in discard mode.
1314 */
1315 if (stp->sd_read_opt & RD_MSGDIS) {
1316 freemsg(bp);
1317 } else {
1318 bp->b_band = pri;
1319 if ((mark & _LASTMARK) &&
1320 (stp->sd_mark == NULL))
1321 stp->sd_mark = bp;
1322 bp->b_flag |= mark & ~_LASTMARK;
1323 if (delim)
1324 bp->b_flag |= MSGDELIM;
1325 if (msgnodata(bp))
1326 freemsg(bp);
1327 else
1328 putback(stp, q, bp, pri);
1329 }
1330 } else {
1331 /*
1332 * Consumed the complete message.
1333 * Move the MSG*MARKNEXT information
1334 * to the stream head just in case
1335 * the read queue becomes empty.
1336 *
1337 * If the stream head was at the mark
1338 * (STRATMARK) before we dropped sd_lock above
1339 * and some data was consumed then we have
1340 * moved past the mark thus STRATMARK is
1341 * cleared. However, if a message arrived in
1342 * strrput during the copyout above causing
1343 * STRATMARK to be set we can not clear that
1344 * flag.
1345 */
1346 if (mark &
1347 (MSGMARKNEXT|MSGNOTMARKNEXT|MSGMARK)) {
1348 if (mark & MSGMARKNEXT) {
1349 stp->sd_flag &= ~STRNOTATMARK;
1350 stp->sd_flag |= STRATMARK;
1351 } else if (mark & MSGNOTMARKNEXT) {
1352 stp->sd_flag &= ~STRATMARK;
1353 stp->sd_flag |= STRNOTATMARK;
1354 } else {
1355 stp->sd_flag &=
1356 ~(STRATMARK|STRNOTATMARK);
1357 }
1358 } else if (rflg && (old_sd_flag & STRATMARK)) {
1359 stp->sd_flag &= ~STRATMARK;
1360 }
1361 }
1362
1363 /*
1364 * Check for signal messages at the front of the read
1365 * queue and generate the signal(s) if appropriate.
1366 * The only signal that can be on queue is M_SIG at
1367 * this point.
1368 */
1369 while ((((bp = q->q_first)) != NULL) &&
1370 (bp->b_datap->db_type == M_SIG)) {
1371 bp = getq_noenab(q, 0);
1372 /*
1373 * sd_lock is held so the content of the
1374 * read queue can not change.
1375 */
1376 ASSERT(bp != NULL && DB_TYPE(bp) == M_SIG);
1377 strsignal_nolock(stp, *bp->b_rptr, bp->b_band);
1378 mutex_exit(&stp->sd_lock);
1379 freemsg(bp);
1380 if (STREAM_NEEDSERVICE(stp))
1381 stream_runservice(stp);
1382 mutex_enter(&stp->sd_lock);
1383 }
1384
1385 if ((uiop->uio_resid == 0) || (mark & _LASTMARK) ||
1386 delim ||
1387 (stp->sd_read_opt & (RD_MSGDIS|RD_MSGNODIS))) {
1388 goto oops;
1389 }
1390 continue;
1391
1392 case M_SIG:
1393 strsignal(stp, *bp->b_rptr, (int32_t)bp->b_band);
1394 freemsg(bp);
1395 mutex_enter(&stp->sd_lock);
1396 continue;
1397
1398 case M_PROTO:
1399 case M_PCPROTO:
1400 /*
1401 * Only data messages are readable.
1402 * Any others generate an error, unless
1403 * RD_PROTDIS or RD_PROTDAT is set.
1404 */
1405 if (stp->sd_read_opt & RD_PROTDAT) {
1406 for (nbp = bp; nbp; nbp = nbp->b_next) {
1407 if ((nbp->b_datap->db_type ==
1408 M_PROTO) ||
1409 (nbp->b_datap->db_type ==
1410 M_PCPROTO)) {
1411 nbp->b_datap->db_type = M_DATA;
1412 } else {
1413 break;
1414 }
1415 }
1416 /*
1417 * clear stream head hi pri flag based on
1418 * first message
1419 */
1420 if (type == M_PCPROTO) {
1421 mutex_enter(&stp->sd_lock);
1422 stp->sd_flag &= ~STRPRI;
1423 mutex_exit(&stp->sd_lock);
1424 }
1425 goto ismdata;
1426 } else if (stp->sd_read_opt & RD_PROTDIS) {
1427 /*
1428 * discard non-data messages
1429 */
1430 while (bp &&
1431 ((bp->b_datap->db_type == M_PROTO) ||
1432 (bp->b_datap->db_type == M_PCPROTO))) {
1433 nbp = unlinkb(bp);
1434 freeb(bp);
1435 bp = nbp;
1436 }
1437 /*
1438 * clear stream head hi pri flag based on
1439 * first message
1440 */
1441 if (type == M_PCPROTO) {
1442 mutex_enter(&stp->sd_lock);
1443 stp->sd_flag &= ~STRPRI;
1444 mutex_exit(&stp->sd_lock);
1445 }
1446 if (bp) {
1447 bp->b_band = pri;
1448 goto ismdata;
1449 } else {
1450 break;
1451 }
1452 }
1453 /* FALLTHRU */
1454 case M_PASSFP:
1455 if ((bp->b_datap->db_type == M_PASSFP) &&
1456 (stp->sd_read_opt & RD_PROTDIS)) {
1457 freemsg(bp);
1458 break;
1459 }
1460 mutex_enter(&stp->sd_lock);
1461 putback(stp, q, bp, pri);
1462 mutex_exit(&stp->sd_lock);
1463 if (rflg == 0)
1464 error = EBADMSG;
1465 goto oops1;
1466
1467 default:
1468 /*
1469 * Garbage on stream head read queue.
1470 */
1471 cmn_err(CE_WARN, "bad %x found at stream head\n",
1472 bp->b_datap->db_type);
1473 freemsg(bp);
1474 goto oops1;
1475 }
1476 mutex_enter(&stp->sd_lock);
1477 }
1478 oops:
1479 mutex_exit(&stp->sd_lock);
1480 oops1:
1481 qbackenable(q, pri);
1482 return (error);
1483 #undef _LASTMARK
1484 }
1485
1486 /*
1487 * Default processing of M_PROTO/M_PCPROTO messages.
1488 * Determine which wakeups and signals are needed.
1489 * This can be replaced by a user-specified procedure for kernel users
1490 * of STREAMS.
1491 */
1492 /* ARGSUSED */
1493 mblk_t *
1494 strrput_proto(vnode_t *vp, mblk_t *mp,
1495 strwakeup_t *wakeups, strsigset_t *firstmsgsigs,
1496 strsigset_t *allmsgsigs, strpollset_t *pollwakeups)
1497 {
1498 *wakeups = RSLEEP;
1499 *allmsgsigs = 0;
1500
1501 switch (mp->b_datap->db_type) {
1502 case M_PROTO:
1503 if (mp->b_band == 0) {
1504 *firstmsgsigs = S_INPUT | S_RDNORM;
1505 *pollwakeups = POLLIN | POLLRDNORM;
1506 } else {
1507 *firstmsgsigs = S_INPUT | S_RDBAND;
1508 *pollwakeups = POLLIN | POLLRDBAND;
1509 }
1510 break;
1511 case M_PCPROTO:
1512 *firstmsgsigs = S_HIPRI;
1513 *pollwakeups = POLLPRI;
1514 break;
1515 }
1516 return (mp);
1517 }
1518
1519 /*
1520 * Default processing of everything but M_DATA, M_PROTO, M_PCPROTO and
1521 * M_PASSFP messages.
1522 * Determine which wakeups and signals are needed.
1523 * This can be replaced by a user-specified procedure for kernel users
1524 * of STREAMS.
1525 */
1526 /* ARGSUSED */
1527 mblk_t *
1528 strrput_misc(vnode_t *vp, mblk_t *mp,
1529 strwakeup_t *wakeups, strsigset_t *firstmsgsigs,
1530 strsigset_t *allmsgsigs, strpollset_t *pollwakeups)
1531 {
1532 *wakeups = 0;
1533 *firstmsgsigs = 0;
1534 *allmsgsigs = 0;
1535 *pollwakeups = 0;
1536 return (mp);
1537 }
1538
1539 /*
1540 * Stream read put procedure. Called from downstream driver/module
1541 * with messages for the stream head. Data, protocol, and in-stream
1542 * signal messages are placed on the queue, others are handled directly.
1543 */
1544 int
1545 strrput(queue_t *q, mblk_t *bp)
1546 {
1547 struct stdata *stp;
1548 ulong_t rput_opt;
1549 strwakeup_t wakeups;
1550 strsigset_t firstmsgsigs; /* Signals if first message on queue */
1551 strsigset_t allmsgsigs; /* Signals for all messages */
1552 strsigset_t signals; /* Signals events to generate */
1553 strpollset_t pollwakeups;
1554 mblk_t *nextbp;
1555 uchar_t band = 0;
1556 int hipri_sig;
1557
1558 stp = (struct stdata *)q->q_ptr;
1559 /*
1560 * Use rput_opt for optimized access to the SR_ flags except
1561 * SR_POLLIN. That flag has to be checked under sd_lock since it
1562 * is modified by strpoll().
1563 */
1564 rput_opt = stp->sd_rput_opt;
1565
1566 ASSERT(qclaimed(q));
1567 TRACE_2(TR_FAC_STREAMS_FR, TR_STRRPUT_ENTER,
1568 "strrput called with message type:q %p bp %p", q, bp);
1569
1570 /*
1571 * Perform initial processing and pass to the parameterized functions.
1572 */
1573 ASSERT(bp->b_next == NULL);
1574
1575 switch (bp->b_datap->db_type) {
1576 case M_DATA:
1577 /*
1578 * sockfs is the only consumer of STREOF and when it is set,
1579 * it implies that the receiver is not interested in receiving
1580 * any more data, hence the mblk is freed to prevent unnecessary
1581 * message queueing at the stream head.
1582 */
1583 if (stp->sd_flag == STREOF) {
1584 freemsg(bp);
1585 return (0);
1586 }
1587 if ((rput_opt & SR_IGN_ZEROLEN) &&
1588 bp->b_rptr == bp->b_wptr && msgnodata(bp)) {
1589 /*
1590 * Ignore zero-length M_DATA messages. These might be
1591 * generated by some transports.
1592 * The zero-length M_DATA messages, even if they
1593 * are ignored, should effect the atmark tracking and
1594 * should wake up a thread sleeping in strwaitmark.
1595 */
1596 mutex_enter(&stp->sd_lock);
1597 if (bp->b_flag & MSGMARKNEXT) {
1598 /*
1599 * Record the position of the mark either
1600 * in q_last or in STRATMARK.
1601 */
1602 if (q->q_last != NULL) {
1603 q->q_last->b_flag &= ~MSGNOTMARKNEXT;
1604 q->q_last->b_flag |= MSGMARKNEXT;
1605 } else {
1606 stp->sd_flag &= ~STRNOTATMARK;
1607 stp->sd_flag |= STRATMARK;
1608 }
1609 } else if (bp->b_flag & MSGNOTMARKNEXT) {
1610 /*
1611 * Record that this is not the position of
1612 * the mark either in q_last or in
1613 * STRNOTATMARK.
1614 */
1615 if (q->q_last != NULL) {
1616 q->q_last->b_flag &= ~MSGMARKNEXT;
1617 q->q_last->b_flag |= MSGNOTMARKNEXT;
1618 } else {
1619 stp->sd_flag &= ~STRATMARK;
1620 stp->sd_flag |= STRNOTATMARK;
1621 }
1622 }
1623 if (stp->sd_flag & RSLEEP) {
1624 stp->sd_flag &= ~RSLEEP;
1625 cv_broadcast(&q->q_wait);
1626 }
1627 mutex_exit(&stp->sd_lock);
1628 freemsg(bp);
1629 return (0);
1630 }
1631 wakeups = RSLEEP;
1632 if (bp->b_band == 0) {
1633 firstmsgsigs = S_INPUT | S_RDNORM;
1634 pollwakeups = POLLIN | POLLRDNORM;
1635 } else {
1636 firstmsgsigs = S_INPUT | S_RDBAND;
1637 pollwakeups = POLLIN | POLLRDBAND;
1638 }
1639 if (rput_opt & SR_SIGALLDATA)
1640 allmsgsigs = firstmsgsigs;
1641 else
1642 allmsgsigs = 0;
1643
1644 mutex_enter(&stp->sd_lock);
1645 if ((rput_opt & SR_CONSOL_DATA) &&
1646 (q->q_last != NULL) &&
1647 (bp->b_flag & (MSGMARK|MSGDELIM)) == 0) {
1648 /*
1649 * Consolidate an M_DATA message onto an M_DATA,
1650 * M_PROTO, or M_PCPROTO by merging it with q_last.
1651 * The consolidation does not take place if
1652 * the old message is marked with either of the
1653 * marks or the delim flag or if the new
1654 * message is marked with MSGMARK. The MSGMARK
1655 * check is needed to handle the odd semantics of
1656 * MSGMARK where essentially the whole message
1657 * is to be treated as marked.
1658 * Carry any MSGMARKNEXT and MSGNOTMARKNEXT from the
1659 * new message to the front of the b_cont chain.
1660 */
1661 mblk_t *lbp = q->q_last;
1662 unsigned char db_type = lbp->b_datap->db_type;
1663
1664 if ((db_type == M_DATA || db_type == M_PROTO ||
1665 db_type == M_PCPROTO) &&
1666 !(lbp->b_flag & (MSGDELIM|MSGMARK|MSGMARKNEXT))) {
1667 rmvq_noenab(q, lbp);
1668 /*
1669 * The first message in the b_cont list
1670 * tracks MSGMARKNEXT and MSGNOTMARKNEXT.
1671 * We need to handle the case where we
1672 * are appending:
1673 *
1674 * 1) a MSGMARKNEXT to a MSGNOTMARKNEXT.
1675 * 2) a MSGMARKNEXT to a plain message.
1676 * 3) a MSGNOTMARKNEXT to a plain message
1677 * 4) a MSGNOTMARKNEXT to a MSGNOTMARKNEXT
1678 * message.
1679 *
1680 * Thus we never append a MSGMARKNEXT or
1681 * MSGNOTMARKNEXT to a MSGMARKNEXT message.
1682 */
1683 if (bp->b_flag & MSGMARKNEXT) {
1684 lbp->b_flag |= MSGMARKNEXT;
1685 lbp->b_flag &= ~MSGNOTMARKNEXT;
1686 bp->b_flag &= ~MSGMARKNEXT;
1687 } else if (bp->b_flag & MSGNOTMARKNEXT) {
1688 lbp->b_flag |= MSGNOTMARKNEXT;
1689 bp->b_flag &= ~MSGNOTMARKNEXT;
1690 }
1691
1692 linkb(lbp, bp);
1693 bp = lbp;
1694 /*
1695 * The new message logically isn't the first
1696 * even though the q_first check below thinks
1697 * it is. Clear the firstmsgsigs to make it
1698 * not appear to be first.
1699 */
1700 firstmsgsigs = 0;
1701 }
1702 }
1703 break;
1704
1705 case M_PASSFP:
1706 wakeups = RSLEEP;
1707 allmsgsigs = 0;
1708 if (bp->b_band == 0) {
1709 firstmsgsigs = S_INPUT | S_RDNORM;
1710 pollwakeups = POLLIN | POLLRDNORM;
1711 } else {
1712 firstmsgsigs = S_INPUT | S_RDBAND;
1713 pollwakeups = POLLIN | POLLRDBAND;
1714 }
1715 mutex_enter(&stp->sd_lock);
1716 break;
1717
1718 case M_PROTO:
1719 case M_PCPROTO:
1720 ASSERT(stp->sd_rprotofunc != NULL);
1721 bp = (stp->sd_rprotofunc)(stp->sd_vnode, bp,
1722 &wakeups, &firstmsgsigs, &allmsgsigs, &pollwakeups);
1723 #define ALLSIG (S_INPUT|S_HIPRI|S_OUTPUT|S_MSG|S_ERROR|S_HANGUP|S_RDNORM|\
1724 S_WRNORM|S_RDBAND|S_WRBAND|S_BANDURG)
1725 #define ALLPOLL (POLLIN|POLLPRI|POLLOUT|POLLRDNORM|POLLWRNORM|POLLRDBAND|\
1726 POLLWRBAND)
1727
1728 ASSERT((wakeups & ~(RSLEEP|WSLEEP)) == 0);
1729 ASSERT((firstmsgsigs & ~ALLSIG) == 0);
1730 ASSERT((allmsgsigs & ~ALLSIG) == 0);
1731 ASSERT((pollwakeups & ~ALLPOLL) == 0);
1732
1733 mutex_enter(&stp->sd_lock);
1734 break;
1735
1736 default:
1737 ASSERT(stp->sd_rmiscfunc != NULL);
1738 bp = (stp->sd_rmiscfunc)(stp->sd_vnode, bp,
1739 &wakeups, &firstmsgsigs, &allmsgsigs, &pollwakeups);
1740 ASSERT((wakeups & ~(RSLEEP|WSLEEP)) == 0);
1741 ASSERT((firstmsgsigs & ~ALLSIG) == 0);
1742 ASSERT((allmsgsigs & ~ALLSIG) == 0);
1743 ASSERT((pollwakeups & ~ALLPOLL) == 0);
1744 #undef ALLSIG
1745 #undef ALLPOLL
1746 mutex_enter(&stp->sd_lock);
1747 break;
1748 }
1749 ASSERT(MUTEX_HELD(&stp->sd_lock));
1750
1751 /* By default generate superset of signals */
1752 signals = (firstmsgsigs | allmsgsigs);
1753
1754 /*
1755 * The proto and misc functions can return multiple messages
1756 * as a b_next chain. Such messages are processed separately.
1757 */
1758 one_more:
1759 hipri_sig = 0;
1760 if (bp == NULL) {
1761 nextbp = NULL;
1762 } else {
1763 nextbp = bp->b_next;
1764 bp->b_next = NULL;
1765
1766 switch (bp->b_datap->db_type) {
1767 case M_PCPROTO:
1768 /*
1769 * Only one priority protocol message is allowed at the
1770 * stream head at a time.
1771 */
1772 if (stp->sd_flag & STRPRI) {
1773 TRACE_0(TR_FAC_STREAMS_FR, TR_STRRPUT_PROTERR,
1774 "M_PCPROTO already at head");
1775 freemsg(bp);
1776 mutex_exit(&stp->sd_lock);
1777 goto done;
1778 }
1779 stp->sd_flag |= STRPRI;
1780 hipri_sig = 1;
1781 /* FALLTHRU */
1782 case M_DATA:
1783 case M_PROTO:
1784 case M_PASSFP:
1785 band = bp->b_band;
1786 /*
1787 * Marking doesn't work well when messages
1788 * are marked in more than one band. We only
1789 * remember the last message received, even if
1790 * it is placed on the queue ahead of other
1791 * marked messages.
1792 */
1793 if (bp->b_flag & MSGMARK)
1794 stp->sd_mark = bp;
1795 (void) putq(q, bp);
1796
1797 /*
1798 * If message is a PCPROTO message, always use
1799 * firstmsgsigs to determine if a signal should be
1800 * sent as strrput is the only place to send
1801 * signals for PCPROTO. Other messages are based on
1802 * the STRGETINPROG flag. The flag determines if
1803 * strrput or (k)strgetmsg will be responsible for
1804 * sending the signals, in the firstmsgsigs case.
1805 */
1806 if ((hipri_sig == 1) ||
1807 (((stp->sd_flag & STRGETINPROG) == 0) &&
1808 (q->q_first == bp)))
1809 signals = (firstmsgsigs | allmsgsigs);
1810 else
1811 signals = allmsgsigs;
1812 break;
1813
1814 default:
1815 mutex_exit(&stp->sd_lock);
1816 (void) strrput_nondata(q, bp);
1817 mutex_enter(&stp->sd_lock);
1818 break;
1819 }
1820 }
1821 ASSERT(MUTEX_HELD(&stp->sd_lock));
1822 /*
1823 * Wake sleeping read/getmsg and cancel deferred wakeup
1824 */
1825 if (wakeups & RSLEEP)
1826 stp->sd_wakeq &= ~RSLEEP;
1827
1828 wakeups &= stp->sd_flag;
1829 if (wakeups & RSLEEP) {
1830 stp->sd_flag &= ~RSLEEP;
1831 cv_broadcast(&q->q_wait);
1832 }
1833 if (wakeups & WSLEEP) {
1834 stp->sd_flag &= ~WSLEEP;
1835 cv_broadcast(&_WR(q)->q_wait);
1836 }
1837
1838 if (pollwakeups != 0) {
1839 if (pollwakeups == (POLLIN | POLLRDNORM)) {
1840 /*
1841 * Can't use rput_opt since it was not
1842 * read when sd_lock was held and SR_POLLIN is changed
1843 * by strpoll() under sd_lock.
1844 */
1845 if (!(stp->sd_rput_opt & SR_POLLIN))
1846 goto no_pollwake;
1847 stp->sd_rput_opt &= ~SR_POLLIN;
1848 }
1849 mutex_exit(&stp->sd_lock);
1850 pollwakeup(&stp->sd_pollist, pollwakeups);
1851 mutex_enter(&stp->sd_lock);
1852 }
1853 no_pollwake:
1854
1855 /*
1856 * strsendsig can handle multiple signals with a
1857 * single call.
1858 */
1859 if (stp->sd_sigflags & signals)
1860 strsendsig(stp->sd_siglist, signals, band, 0);
1861 mutex_exit(&stp->sd_lock);
1862
1863
1864 done:
1865 if (nextbp == NULL)
1866 return (0);
1867
1868 /*
1869 * Any signals were handled the first time.
1870 * Wakeups and pollwakeups are redone to avoid any race
1871 * conditions - all the messages are not queued until the
1872 * last message has been processed by strrput.
1873 */
1874 bp = nextbp;
1875 signals = firstmsgsigs = allmsgsigs = 0;
1876 mutex_enter(&stp->sd_lock);
1877 goto one_more;
1878 }
1879
1880 static void
1881 log_dupioc(queue_t *rq, mblk_t *bp)
1882 {
1883 queue_t *wq, *qp;
1884 char *modnames, *mnp, *dname;
1885 size_t maxmodstr;
1886 boolean_t islast;
1887
1888 /*
1889 * Allocate a buffer large enough to hold the names of nstrpush modules
1890 * and one driver, with spaces between and NUL terminator. If we can't
1891 * get memory, then we'll just log the driver name.
1892 */
1893 maxmodstr = nstrpush * (FMNAMESZ + 1);
1894 mnp = modnames = kmem_alloc(maxmodstr, KM_NOSLEEP);
1895
1896 /* march down write side to print log message down to the driver */
1897 wq = WR(rq);
1898
1899 /* make sure q_next doesn't shift around while we're grabbing data */
1900 claimstr(wq);
1901 qp = wq->q_next;
1902 do {
1903 dname = Q2NAME(qp);
1904 islast = !SAMESTR(qp) || qp->q_next == NULL;
1905 if (modnames == NULL) {
1906 /*
1907 * If we don't have memory, then get the driver name in
1908 * the log where we can see it. Note that memory
1909 * pressure is a possible cause of these sorts of bugs.
1910 */
1911 if (islast) {
1912 modnames = dname;
1913 maxmodstr = 0;
1914 }
1915 } else {
1916 mnp += snprintf(mnp, FMNAMESZ + 1, "%s", dname);
1917 if (!islast)
1918 *mnp++ = ' ';
1919 }
1920 qp = qp->q_next;
1921 } while (!islast);
1922 releasestr(wq);
1923 /* Cannot happen unless stream head is corrupt. */
1924 ASSERT(modnames != NULL);
1925 (void) strlog(rq->q_qinfo->qi_minfo->mi_idnum, 0, 1,
1926 SL_CONSOLE|SL_TRACE|SL_ERROR,
1927 "Warning: stream %p received duplicate %X M_IOC%s; module list: %s",
1928 rq->q_ptr, ((struct iocblk *)bp->b_rptr)->ioc_cmd,
1929 (DB_TYPE(bp) == M_IOCACK ? "ACK" : "NAK"), modnames);
1930 if (maxmodstr != 0)
1931 kmem_free(modnames, maxmodstr);
1932 }
1933
1934 int
1935 strrput_nondata(queue_t *q, mblk_t *bp)
1936 {
1937 struct stdata *stp;
1938 struct iocblk *iocbp;
1939 struct stroptions *sop;
1940 struct copyreq *reqp;
1941 struct copyresp *resp;
1942 unsigned char bpri;
1943 unsigned char flushed_already = 0;
1944
1945 stp = (struct stdata *)q->q_ptr;
1946
1947 ASSERT(!(stp->sd_flag & STPLEX));
1948 ASSERT(qclaimed(q));
1949
1950 switch (bp->b_datap->db_type) {
1951 case M_ERROR:
1952 /*
1953 * An error has occurred downstream, the errno is in the first
1954 * bytes of the message.
1955 */
1956 if ((bp->b_wptr - bp->b_rptr) == 2) { /* New flavor */
1957 unsigned char rw = 0;
1958
1959 mutex_enter(&stp->sd_lock);
1960 if (*bp->b_rptr != NOERROR) { /* read error */
1961 if (*bp->b_rptr != 0) {
1962 if (stp->sd_flag & STRDERR)
1963 flushed_already |= FLUSHR;
1964 stp->sd_flag |= STRDERR;
1965 rw |= FLUSHR;
1966 } else {
1967 stp->sd_flag &= ~STRDERR;
1968 }
1969 stp->sd_rerror = *bp->b_rptr;
1970 }
1971 bp->b_rptr++;
1972 if (*bp->b_rptr != NOERROR) { /* write error */
1973 if (*bp->b_rptr != 0) {
1974 if (stp->sd_flag & STWRERR)
1975 flushed_already |= FLUSHW;
1976 stp->sd_flag |= STWRERR;
1977 rw |= FLUSHW;
1978 } else {
1979 stp->sd_flag &= ~STWRERR;
1980 }
1981 stp->sd_werror = *bp->b_rptr;
1982 }
1983 if (rw) {
1984 TRACE_2(TR_FAC_STREAMS_FR, TR_STRRPUT_WAKE,
1985 "strrput cv_broadcast:q %p, bp %p",
1986 q, bp);
1987 cv_broadcast(&q->q_wait); /* readers */
1988 cv_broadcast(&_WR(q)->q_wait); /* writers */
1989 cv_broadcast(&stp->sd_monitor); /* ioctllers */
1990
1991 mutex_exit(&stp->sd_lock);
1992 pollwakeup(&stp->sd_pollist, POLLERR);
1993 mutex_enter(&stp->sd_lock);
1994
1995 if (stp->sd_sigflags & S_ERROR)
1996 strsendsig(stp->sd_siglist, S_ERROR, 0,
1997 ((rw & FLUSHR) ? stp->sd_rerror :
1998 stp->sd_werror));
1999 mutex_exit(&stp->sd_lock);
2000 /*
2001 * Send the M_FLUSH only
2002 * for the first M_ERROR
2003 * message on the stream
2004 */
2005 if (flushed_already == rw) {
2006 freemsg(bp);
2007 return (0);
2008 }
2009
2010 bp->b_datap->db_type = M_FLUSH;
2011 *bp->b_rptr = rw;
2012 bp->b_wptr = bp->b_rptr + 1;
2013 /*
2014 * Protect against the driver
2015 * passing up messages after
2016 * it has done a qprocsoff
2017 */
2018 if (_OTHERQ(q)->q_next == NULL)
2019 freemsg(bp);
2020 else
2021 qreply(q, bp);
2022 return (0);
2023 } else
2024 mutex_exit(&stp->sd_lock);
2025 } else if (*bp->b_rptr != 0) { /* Old flavor */
2026 if (stp->sd_flag & (STRDERR|STWRERR))
2027 flushed_already = FLUSHRW;
2028 mutex_enter(&stp->sd_lock);
2029 stp->sd_flag |= (STRDERR|STWRERR);
2030 stp->sd_rerror = *bp->b_rptr;
2031 stp->sd_werror = *bp->b_rptr;
2032 TRACE_2(TR_FAC_STREAMS_FR,
2033 TR_STRRPUT_WAKE2,
2034 "strrput wakeup #2:q %p, bp %p", q, bp);
2035 cv_broadcast(&q->q_wait); /* the readers */
2036 cv_broadcast(&_WR(q)->q_wait); /* the writers */
2037 cv_broadcast(&stp->sd_monitor); /* ioctllers */
2038
2039 mutex_exit(&stp->sd_lock);
2040 pollwakeup(&stp->sd_pollist, POLLERR);
2041 mutex_enter(&stp->sd_lock);
2042
2043 if (stp->sd_sigflags & S_ERROR)
2044 strsendsig(stp->sd_siglist, S_ERROR, 0,
2045 (stp->sd_werror ? stp->sd_werror :
2046 stp->sd_rerror));
2047 mutex_exit(&stp->sd_lock);
2048
2049 /*
2050 * Send the M_FLUSH only
2051 * for the first M_ERROR
2052 * message on the stream
2053 */
2054 if (flushed_already != FLUSHRW) {
2055 bp->b_datap->db_type = M_FLUSH;
2056 *bp->b_rptr = FLUSHRW;
2057 /*
2058 * Protect against the driver passing up
2059 * messages after it has done a
2060 * qprocsoff.
2061 */
2062 if (_OTHERQ(q)->q_next == NULL)
2063 freemsg(bp);
2064 else
2065 qreply(q, bp);
2066 return (0);
2067 }
2068 }
2069 freemsg(bp);
2070 return (0);
2071
2072 case M_HANGUP:
2073
2074 freemsg(bp);
2075 mutex_enter(&stp->sd_lock);
2076 stp->sd_werror = ENXIO;
2077 stp->sd_flag |= STRHUP;
2078 stp->sd_flag &= ~(WSLEEP|RSLEEP);
2079
2080 /*
2081 * send signal if controlling tty
2082 */
2083
2084 if (stp->sd_sidp) {
2085 prsignal(stp->sd_sidp, SIGHUP);
2086 if (stp->sd_sidp != stp->sd_pgidp)
2087 pgsignal(stp->sd_pgidp, SIGTSTP);
2088 }
2089
2090 /*
2091 * wake up read, write, and exception pollers and
2092 * reset wakeup mechanism.
2093 */
2094 cv_broadcast(&q->q_wait); /* the readers */
2095 cv_broadcast(&_WR(q)->q_wait); /* the writers */
2096 cv_broadcast(&stp->sd_monitor); /* the ioctllers */
2097 strhup(stp);
2098 mutex_exit(&stp->sd_lock);
2099 return (0);
2100
2101 case M_UNHANGUP:
2102 freemsg(bp);
2103 mutex_enter(&stp->sd_lock);
2104 stp->sd_werror = 0;
2105 stp->sd_flag &= ~STRHUP;
2106 mutex_exit(&stp->sd_lock);
2107 return (0);
2108
2109 case M_SIG:
2110 /*
2111 * Someone downstream wants to post a signal. The
2112 * signal to post is contained in the first byte of the
2113 * message. If the message would go on the front of
2114 * the queue, send a signal to the process group
2115 * (if not SIGPOLL) or to the siglist processes
2116 * (SIGPOLL). If something is already on the queue,
2117 * OR if we are delivering a delayed suspend (*sigh*
2118 * another "tty" hack) and there's no one sleeping already,
2119 * just enqueue the message.
2120 */
2121 mutex_enter(&stp->sd_lock);
2122 if (q->q_first || (*bp->b_rptr == SIGTSTP &&
2123 !(stp->sd_flag & RSLEEP))) {
2124 (void) putq(q, bp);
2125 mutex_exit(&stp->sd_lock);
2126 return (0);
2127 }
2128 mutex_exit(&stp->sd_lock);
2129 /* FALLTHRU */
2130
2131 case M_PCSIG:
2132 /*
2133 * Don't enqueue, just post the signal.
2134 */
2135 strsignal(stp, *bp->b_rptr, 0L);
2136 freemsg(bp);
2137 return (0);
2138
2139 case M_CMD:
2140 if (MBLKL(bp) != sizeof (cmdblk_t)) {
2141 freemsg(bp);
2142 return (0);
2143 }
2144
2145 mutex_enter(&stp->sd_lock);
2146 if (stp->sd_flag & STRCMDWAIT) {
2147 ASSERT(stp->sd_cmdblk == NULL);
2148 stp->sd_cmdblk = bp;
2149 cv_broadcast(&stp->sd_monitor);
2150 mutex_exit(&stp->sd_lock);
2151 } else {
2152 mutex_exit(&stp->sd_lock);
2153 freemsg(bp);
2154 }
2155 return (0);
2156
2157 case M_FLUSH:
2158 /*
2159 * Flush queues. The indication of which queues to flush
2160 * is in the first byte of the message. If the read queue
2161 * is specified, then flush it. If FLUSHBAND is set, just
2162 * flush the band specified by the second byte of the message.
2163 *
2164 * If a module has issued a M_SETOPT to not flush hi
2165 * priority messages off of the stream head, then pass this
2166 * flag into the flushq code to preserve such messages.
2167 */
2168
2169 if (*bp->b_rptr & FLUSHR) {
2170 mutex_enter(&stp->sd_lock);
2171 if (*bp->b_rptr & FLUSHBAND) {
2172 ASSERT((bp->b_wptr - bp->b_rptr) >= 2);
2173 flushband(q, *(bp->b_rptr + 1), FLUSHALL);
2174 } else
2175 flushq_common(q, FLUSHALL,
2176 stp->sd_read_opt & RFLUSHPCPROT);
2177 if ((q->q_first == NULL) ||
2178 (q->q_first->b_datap->db_type < QPCTL))
2179 stp->sd_flag &= ~STRPRI;
2180 else {
2181 ASSERT(stp->sd_flag & STRPRI);
2182 }
2183 mutex_exit(&stp->sd_lock);
2184 }
2185 if ((*bp->b_rptr & FLUSHW) && !(bp->b_flag & MSGNOLOOP)) {
2186 *bp->b_rptr &= ~FLUSHR;
2187 bp->b_flag |= MSGNOLOOP;
2188 /*
2189 * Protect against the driver passing up
2190 * messages after it has done a qprocsoff.
2191 */
2192 if (_OTHERQ(q)->q_next == NULL)
2193 freemsg(bp);
2194 else
2195 qreply(q, bp);
2196 return (0);
2197 }
2198 freemsg(bp);
2199 return (0);
2200
2201 case M_IOCACK:
2202 case M_IOCNAK:
2203 iocbp = (struct iocblk *)bp->b_rptr;
2204 /*
2205 * If not waiting for ACK or NAK then just free msg.
2206 * If incorrect id sequence number then just free msg.
2207 * If already have ACK or NAK for user then this is a
2208 * duplicate, display a warning and free the msg.
2209 */
2210 mutex_enter(&stp->sd_lock);
2211 if ((stp->sd_flag & IOCWAIT) == 0 || stp->sd_iocblk ||
2212 (stp->sd_iocid != iocbp->ioc_id)) {
2213 /*
2214 * If the ACK/NAK is a dup, display a message
2215 * Dup is when sd_iocid == ioc_id, and
2216 * sd_iocblk == <valid ptr> or -1 (the former
2217 * is when an ioctl has been put on the stream
2218 * head, but has not yet been consumed, the
2219 * later is when it has been consumed).
2220 */
2221 if ((stp->sd_iocid == iocbp->ioc_id) &&
2222 (stp->sd_iocblk != NULL)) {
2223 log_dupioc(q, bp);
2224 }
2225 freemsg(bp);
2226 mutex_exit(&stp->sd_lock);
2227 return (0);
2228 }
2229
2230 /*
2231 * Assign ACK or NAK to user and wake up.
2232 */
2233 stp->sd_iocblk = bp;
2234 cv_broadcast(&stp->sd_monitor);
2235 mutex_exit(&stp->sd_lock);
2236 return (0);
2237
2238 case M_COPYIN:
2239 case M_COPYOUT:
2240 reqp = (struct copyreq *)bp->b_rptr;
2241
2242 /*
2243 * If not waiting for ACK or NAK then just fail request.
2244 * If already have ACK, NAK, or copy request, then just
2245 * fail request.
2246 * If incorrect id sequence number then just fail request.
2247 */
2248 mutex_enter(&stp->sd_lock);
2249 if ((stp->sd_flag & IOCWAIT) == 0 || stp->sd_iocblk ||
2250 (stp->sd_iocid != reqp->cq_id)) {
2251 if (bp->b_cont) {
2252 freemsg(bp->b_cont);
2253 bp->b_cont = NULL;
2254 }
2255 bp->b_datap->db_type = M_IOCDATA;
2256 bp->b_wptr = bp->b_rptr + sizeof (struct copyresp);
2257 resp = (struct copyresp *)bp->b_rptr;
2258 resp->cp_rval = (caddr_t)1; /* failure */
2259 mutex_exit(&stp->sd_lock);
2260 putnext(stp->sd_wrq, bp);
2261 return (0);
2262 }
2263
2264 /*
2265 * Assign copy request to user and wake up.
2266 */
2267 stp->sd_iocblk = bp;
2268 cv_broadcast(&stp->sd_monitor);
2269 mutex_exit(&stp->sd_lock);
2270 return (0);
2271
2272 case M_SETOPTS:
2273 /*
2274 * Set stream head options (read option, write offset,
2275 * min/max packet size, and/or high/low water marks for
2276 * the read side only).
2277 */
2278
2279 bpri = 0;
2280 sop = (struct stroptions *)bp->b_rptr;
2281 mutex_enter(&stp->sd_lock);
2282 if (sop->so_flags & SO_READOPT) {
2283 switch (sop->so_readopt & RMODEMASK) {
2284 case RNORM:
2285 stp->sd_read_opt &= ~(RD_MSGDIS | RD_MSGNODIS);
2286 break;
2287
2288 case RMSGD:
2289 stp->sd_read_opt =
2290 ((stp->sd_read_opt & ~RD_MSGNODIS) |
2291 RD_MSGDIS);
2292 break;
2293
2294 case RMSGN:
2295 stp->sd_read_opt =
2296 ((stp->sd_read_opt & ~RD_MSGDIS) |
2297 RD_MSGNODIS);
2298 break;
2299 }
2300 switch (sop->so_readopt & RPROTMASK) {
2301 case RPROTNORM:
2302 stp->sd_read_opt &= ~(RD_PROTDAT | RD_PROTDIS);
2303 break;
2304
2305 case RPROTDAT:
2306 stp->sd_read_opt =
2307 ((stp->sd_read_opt & ~RD_PROTDIS) |
2308 RD_PROTDAT);
2309 break;
2310
2311 case RPROTDIS:
2312 stp->sd_read_opt =
2313 ((stp->sd_read_opt & ~RD_PROTDAT) |
2314 RD_PROTDIS);
2315 break;
2316 }
2317 switch (sop->so_readopt & RFLUSHMASK) {
2318 case RFLUSHPCPROT:
2319 /*
2320 * This sets the stream head to NOT flush
2321 * M_PCPROTO messages.
2322 */
2323 stp->sd_read_opt |= RFLUSHPCPROT;
2324 break;
2325 }
2326 }
2327 if (sop->so_flags & SO_ERROPT) {
2328 switch (sop->so_erropt & RERRMASK) {
2329 case RERRNORM:
2330 stp->sd_flag &= ~STRDERRNONPERSIST;
2331 break;
2332 case RERRNONPERSIST:
2333 stp->sd_flag |= STRDERRNONPERSIST;
2334 break;
2335 }
2336 switch (sop->so_erropt & WERRMASK) {
2337 case WERRNORM:
2338 stp->sd_flag &= ~STWRERRNONPERSIST;
2339 break;
2340 case WERRNONPERSIST:
2341 stp->sd_flag |= STWRERRNONPERSIST;
2342 break;
2343 }
2344 }
2345 if (sop->so_flags & SO_COPYOPT) {
2346 if (sop->so_copyopt & ZCVMSAFE) {
2347 stp->sd_copyflag |= STZCVMSAFE;
2348 stp->sd_copyflag &= ~STZCVMUNSAFE;
2349 } else if (sop->so_copyopt & ZCVMUNSAFE) {
2350 stp->sd_copyflag |= STZCVMUNSAFE;
2351 stp->sd_copyflag &= ~STZCVMSAFE;
2352 }
2353
2354 if (sop->so_copyopt & COPYCACHED) {
2355 stp->sd_copyflag |= STRCOPYCACHED;
2356 }
2357 }
2358 if (sop->so_flags & SO_WROFF)
2359 stp->sd_wroff = sop->so_wroff;
2360 if (sop->so_flags & SO_TAIL)
2361 stp->sd_tail = sop->so_tail;
2362 if (sop->so_flags & SO_MINPSZ)
2363 q->q_minpsz = sop->so_minpsz;
2364 if (sop->so_flags & SO_MAXPSZ)
2365 q->q_maxpsz = sop->so_maxpsz;
2366 if (sop->so_flags & SO_MAXBLK)
2367 stp->sd_maxblk = sop->so_maxblk;
2368 if (sop->so_flags & SO_HIWAT) {
2369 if (sop->so_flags & SO_BAND) {
2370 if (strqset(q, QHIWAT,
2371 sop->so_band, sop->so_hiwat)) {
2372 cmn_err(CE_WARN, "strrput: could not "
2373 "allocate qband\n");
2374 } else {
2375 bpri = sop->so_band;
2376 }
2377 } else {
2378 q->q_hiwat = sop->so_hiwat;
2379 }
2380 }
2381 if (sop->so_flags & SO_LOWAT) {
2382 if (sop->so_flags & SO_BAND) {
2383 if (strqset(q, QLOWAT,
2384 sop->so_band, sop->so_lowat)) {
2385 cmn_err(CE_WARN, "strrput: could not "
2386 "allocate qband\n");
2387 } else {
2388 bpri = sop->so_band;
2389 }
2390 } else {
2391 q->q_lowat = sop->so_lowat;
2392 }
2393 }
2394 if (sop->so_flags & SO_MREADON)
2395 stp->sd_flag |= SNDMREAD;
2396 if (sop->so_flags & SO_MREADOFF)
2397 stp->sd_flag &= ~SNDMREAD;
2398 if (sop->so_flags & SO_NDELON)
2399 stp->sd_flag |= OLDNDELAY;
2400 if (sop->so_flags & SO_NDELOFF)
2401 stp->sd_flag &= ~OLDNDELAY;
2402 if (sop->so_flags & SO_ISTTY)
2403 stp->sd_flag |= STRISTTY;
2404 if (sop->so_flags & SO_ISNTTY)
2405 stp->sd_flag &= ~STRISTTY;
2406 if (sop->so_flags & SO_TOSTOP)
2407 stp->sd_flag |= STRTOSTOP;
2408 if (sop->so_flags & SO_TONSTOP)
2409 stp->sd_flag &= ~STRTOSTOP;
2410 if (sop->so_flags & SO_DELIM)
2411 stp->sd_flag |= STRDELIM;
2412 if (sop->so_flags & SO_NODELIM)
2413 stp->sd_flag &= ~STRDELIM;
2414
2415 mutex_exit(&stp->sd_lock);
2416 freemsg(bp);
2417
2418 /* Check backenable in case the water marks changed */
2419 qbackenable(q, bpri);
2420 return (0);
2421
2422 /*
2423 * The following set of cases deal with situations where two stream
2424 * heads are connected to each other (twisted streams). These messages
2425 * have no meaning at the stream head.
2426 */
2427 case M_BREAK:
2428 case M_CTL:
2429 case M_DELAY:
2430 case M_START:
2431 case M_STOP:
2432 case M_IOCDATA:
2433 case M_STARTI:
2434 case M_STOPI:
2435 freemsg(bp);
2436 return (0);
2437
2438 case M_IOCTL:
2439 /*
2440 * Always NAK this condition
2441 * (makes no sense)
2442 * If there is one or more threads in the read side
2443 * rwnext we have to defer the nacking until that thread
2444 * returns (in strget).
2445 */
2446 mutex_enter(&stp->sd_lock);
2447 if (stp->sd_struiodnak != 0) {
2448 /*
2449 * Defer NAK to the streamhead. Queue at the end
2450 * the list.
2451 */
2452 mblk_t *mp = stp->sd_struionak;
2453
2454 while (mp && mp->b_next)
2455 mp = mp->b_next;
2456 if (mp)
2457 mp->b_next = bp;
2458 else
2459 stp->sd_struionak = bp;
2460 bp->b_next = NULL;
2461 mutex_exit(&stp->sd_lock);
2462 return (0);
2463 }
2464 mutex_exit(&stp->sd_lock);
2465
2466 bp->b_datap->db_type = M_IOCNAK;
2467 /*
2468 * Protect against the driver passing up
2469 * messages after it has done a qprocsoff.
2470 */
2471 if (_OTHERQ(q)->q_next == NULL)
2472 freemsg(bp);
2473 else
2474 qreply(q, bp);
2475 return (0);
2476
2477 default:
2478 #ifdef DEBUG
2479 cmn_err(CE_WARN,
2480 "bad message type %x received at stream head\n",
2481 bp->b_datap->db_type);
2482 #endif
2483 freemsg(bp);
2484 return (0);
2485 }
2486
2487 /* NOTREACHED */
2488 }
2489
2490 /*
2491 * Check if the stream pointed to by `stp' can be written to, and return an
2492 * error code if not. If `eiohup' is set, then return EIO if STRHUP is set.
2493 * If `sigpipeok' is set and the SW_SIGPIPE option is enabled on the stream,
2494 * then always return EPIPE and send a SIGPIPE to the invoking thread.
2495 */
2496 static int
2497 strwriteable(struct stdata *stp, boolean_t eiohup, boolean_t sigpipeok)
2498 {
2499 int error;
2500
2501 ASSERT(MUTEX_HELD(&stp->sd_lock));
2502
2503 /*
2504 * For modem support, POSIX states that on writes, EIO should
2505 * be returned if the stream has been hung up.
2506 */
2507 if (eiohup && (stp->sd_flag & (STPLEX|STRHUP)) == STRHUP)
2508 error = EIO;
2509 else
2510 error = strgeterr(stp, STRHUP|STPLEX|STWRERR, 0);
2511
2512 if (error != 0) {
2513 if (!(stp->sd_flag & STPLEX) &&
2514 (stp->sd_wput_opt & SW_SIGPIPE) && sigpipeok) {
2515 tsignal(curthread, SIGPIPE);
2516 error = EPIPE;
2517 }
2518 }
2519
2520 return (error);
2521 }
2522
2523 /*
2524 * Copyin and send data down a stream.
2525 * The caller will allocate and copyin any control part that precedes the
2526 * message and pass that in as mctl.
2527 *
2528 * Caller should *not* hold sd_lock.
2529 * When EWOULDBLOCK is returned the caller has to redo the canputnext
2530 * under sd_lock in order to avoid missing a backenabling wakeup.
2531 *
2532 * Use iosize = -1 to not send any M_DATA. iosize = 0 sends zero-length M_DATA.
2533 *
2534 * Set MSG_IGNFLOW in flags to ignore flow control for hipri messages.
2535 * For sync streams we can only ignore flow control by reverting to using
2536 * putnext.
2537 *
2538 * If sd_maxblk is less than *iosize this routine might return without
2539 * transferring all of *iosize. In all cases, on return *iosize will contain
2540 * the amount of data that was transferred.
2541 */
2542 static int
2543 strput(struct stdata *stp, mblk_t *mctl, struct uio *uiop, ssize_t *iosize,
2544 int b_flag, int pri, int flags)
2545 {
2546 struiod_t uiod;
2547 mblk_t *mp;
2548 queue_t *wqp = stp->sd_wrq;
2549 int error = 0;
2550 ssize_t count = *iosize;
2551
2552 ASSERT(MUTEX_NOT_HELD(&stp->sd_lock));
2553
2554 if (uiop != NULL && count >= 0)
2555 flags |= stp->sd_struiowrq ? STRUIO_POSTPONE : 0;
2556
2557 if (!(flags & STRUIO_POSTPONE)) {
2558 /*
2559 * Use regular canputnext, strmakedata, putnext sequence.
2560 */
2561 if (pri == 0) {
2562 if (!canputnext(wqp) && !(flags & MSG_IGNFLOW)) {
2563 freemsg(mctl);
2564 return (EWOULDBLOCK);
2565 }
2566 } else {
2567 if (!(flags & MSG_IGNFLOW) && !bcanputnext(wqp, pri)) {
2568 freemsg(mctl);
2569 return (EWOULDBLOCK);
2570 }
2571 }
2572
2573 if ((error = strmakedata(iosize, uiop, stp, flags,
2574 &mp)) != 0) {
2575 freemsg(mctl);
2576 /*
2577 * need to change return code to ENOMEM
2578 * so that this is not confused with
2579 * flow control, EAGAIN.
2580 */
2581
2582 if (error == EAGAIN)
2583 return (ENOMEM);
2584 else
2585 return (error);
2586 }
2587 if (mctl != NULL) {
2588 if (mctl->b_cont == NULL)
2589 mctl->b_cont = mp;
2590 else if (mp != NULL)
2591 linkb(mctl, mp);
2592 mp = mctl;
2593 } else if (mp == NULL)
2594 return (0);
2595
2596 mp->b_flag |= b_flag;
2597 mp->b_band = (uchar_t)pri;
2598
2599 if (flags & MSG_IGNFLOW) {
2600 /*
2601 * XXX Hack: Don't get stuck running service
2602 * procedures. This is needed for sockfs when
2603 * sending the unbind message out of the rput
2604 * procedure - we don't want a put procedure
2605 * to run service procedures.
2606 */
2607 putnext(wqp, mp);
2608 } else {
2609 stream_willservice(stp);
2610 putnext(wqp, mp);
2611 stream_runservice(stp);
2612 }
2613 return (0);
2614 }
2615 /*
2616 * Stream supports rwnext() for the write side.
2617 */
2618 if ((error = strmakedata(iosize, uiop, stp, flags, &mp)) != 0) {
2619 freemsg(mctl);
2620 /*
2621 * map EAGAIN to ENOMEM since EAGAIN means "flow controlled".
2622 */
2623 return (error == EAGAIN ? ENOMEM : error);
2624 }
2625 if (mctl != NULL) {
2626 if (mctl->b_cont == NULL)
2627 mctl->b_cont = mp;
2628 else if (mp != NULL)
2629 linkb(mctl, mp);
2630 mp = mctl;
2631 } else if (mp == NULL) {
2632 return (0);
2633 }
2634
2635 mp->b_flag |= b_flag;
2636 mp->b_band = (uchar_t)pri;
2637
2638 (void) uiodup(uiop, &uiod.d_uio, uiod.d_iov,
2639 sizeof (uiod.d_iov) / sizeof (*uiod.d_iov));
2640 uiod.d_uio.uio_offset = 0;
2641 uiod.d_mp = mp;
2642 error = rwnext(wqp, &uiod);
2643 if (! uiod.d_mp) {
2644 uioskip(uiop, *iosize);
2645 return (error);
2646 }
2647 ASSERT(mp == uiod.d_mp);
2648 if (error == EINVAL) {
2649 /*
2650 * The stream plumbing must have changed while
2651 * we were away, so just turn off rwnext()s.
2652 */
2653 error = 0;
2654 } else if (error == EBUSY || error == EWOULDBLOCK) {
2655 /*
2656 * Couldn't enter a perimeter or took a page fault,
2657 * so fall-back to putnext().
2658 */
2659 error = 0;
2660 } else {
2661 freemsg(mp);
2662 return (error);
2663 }
2664 /* Have to check canput before consuming data from the uio */
2665 if (pri == 0) {
2666 if (!canputnext(wqp) && !(flags & MSG_IGNFLOW)) {
2667 freemsg(mp);
2668 return (EWOULDBLOCK);
2669 }
2670 } else {
2671 if (!bcanputnext(wqp, pri) && !(flags & MSG_IGNFLOW)) {
2672 freemsg(mp);
2673 return (EWOULDBLOCK);
2674 }
2675 }
2676 ASSERT(mp == uiod.d_mp);
2677 /* Copyin data from the uio */
2678 if ((error = struioget(wqp, mp, &uiod, 0)) != 0) {
2679 freemsg(mp);
2680 return (error);
2681 }
2682 uioskip(uiop, *iosize);
2683 if (flags & MSG_IGNFLOW) {
2684 /*
2685 * XXX Hack: Don't get stuck running service procedures.
2686 * This is needed for sockfs when sending the unbind message
2687 * out of the rput procedure - we don't want a put procedure
2688 * to run service procedures.
2689 */
2690 putnext(wqp, mp);
2691 } else {
2692 stream_willservice(stp);
2693 putnext(wqp, mp);
2694 stream_runservice(stp);
2695 }
2696 return (0);
2697 }
2698
2699 /*
2700 * Write attempts to break the write request into messages conforming
2701 * with the minimum and maximum packet sizes set downstream.
2702 *
2703 * Write will not block if downstream queue is full and
2704 * O_NDELAY is set, otherwise it will block waiting for the queue to get room.
2705 *
2706 * A write of zero bytes gets packaged into a zero length message and sent
2707 * downstream like any other message.
2708 *
2709 * If buffers of the requested sizes are not available, the write will
2710 * sleep until the buffers become available.
2711 *
2712 * Write (if specified) will supply a write offset in a message if it
2713 * makes sense. This can be specified by downstream modules as part of
2714 * a M_SETOPTS message. Write will not supply the write offset if it
2715 * cannot supply any data in a buffer. In other words, write will never
2716 * send down an empty packet due to a write offset.
2717 */
2718 /* ARGSUSED2 */
2719 int
2720 strwrite(struct vnode *vp, struct uio *uiop, cred_t *crp)
2721 {
2722 return (strwrite_common(vp, uiop, crp, 0));
2723 }
2724
2725 /* ARGSUSED2 */
2726 int
2727 strwrite_common(struct vnode *vp, struct uio *uiop, cred_t *crp, int wflag)
2728 {
2729 struct stdata *stp;
2730 struct queue *wqp;
2731 ssize_t rmin, rmax;
2732 ssize_t iosize;
2733 int waitflag;
2734 int tempmode;
2735 int error = 0;
2736 int b_flag;
2737
2738 ASSERT(vp->v_stream);
2739 stp = vp->v_stream;
2740
2741 mutex_enter(&stp->sd_lock);
2742
2743 if ((error = i_straccess(stp, JCWRITE)) != 0) {
2744 mutex_exit(&stp->sd_lock);
2745 return (error);
2746 }
2747
2748 if (stp->sd_flag & (STWRERR|STRHUP|STPLEX)) {
2749 error = strwriteable(stp, B_TRUE, B_TRUE);
2750 if (error != 0) {
2751 mutex_exit(&stp->sd_lock);
2752 return (error);
2753 }
2754 }
2755
2756 mutex_exit(&stp->sd_lock);
2757
2758 wqp = stp->sd_wrq;
2759
2760 /* get these values from them cached in the stream head */
2761 rmin = stp->sd_qn_minpsz;
2762 rmax = stp->sd_qn_maxpsz;
2763
2764 /*
2765 * Check the min/max packet size constraints. If min packet size
2766 * is non-zero, the write cannot be split into multiple messages
2767 * and still guarantee the size constraints.
2768 */
2769 TRACE_1(TR_FAC_STREAMS_FR, TR_STRWRITE_IN, "strwrite in:q %p", wqp);
2770
2771 ASSERT((rmax >= 0) || (rmax == INFPSZ));
2772 if (rmax == 0) {
2773 return (0);
2774 }
2775 if (rmin > 0) {
2776 if (uiop->uio_resid < rmin) {
2777 TRACE_3(TR_FAC_STREAMS_FR, TR_STRWRITE_OUT,
2778 "strwrite out:q %p out %d error %d",
2779 wqp, 0, ERANGE);
2780 return (ERANGE);
2781 }
2782 if ((rmax != INFPSZ) && (uiop->uio_resid > rmax)) {
2783 TRACE_3(TR_FAC_STREAMS_FR, TR_STRWRITE_OUT,
2784 "strwrite out:q %p out %d error %d",
2785 wqp, 1, ERANGE);
2786 return (ERANGE);
2787 }
2788 }
2789
2790 /*
2791 * Do until count satisfied or error.
2792 */
2793 waitflag = WRITEWAIT | wflag;
2794 if (stp->sd_flag & OLDNDELAY)
2795 tempmode = uiop->uio_fmode & ~FNDELAY;
2796 else
2797 tempmode = uiop->uio_fmode;
2798
2799 if (rmax == INFPSZ)
2800 rmax = uiop->uio_resid;
2801
2802 /*
2803 * Note that tempmode does not get used in strput/strmakedata
2804 * but only in strwaitq. The other routines use uio_fmode
2805 * unmodified.
2806 */
2807
2808 /* LINTED: constant in conditional context */
2809 while (1) { /* breaks when uio_resid reaches zero */
2810 /*
2811 * Determine the size of the next message to be
2812 * packaged. May have to break write into several
2813 * messages based on max packet size.
2814 */
2815 iosize = MIN(uiop->uio_resid, rmax);
2816
2817 /*
2818 * Put block downstream when flow control allows it.
2819 */
2820 if ((stp->sd_flag & STRDELIM) && (uiop->uio_resid == iosize))
2821 b_flag = MSGDELIM;
2822 else
2823 b_flag = 0;
2824
2825 for (;;) {
2826 int done = 0;
2827
2828 error = strput(stp, NULL, uiop, &iosize, b_flag, 0, 0);
2829 if (error == 0)
2830 break;
2831 if (error != EWOULDBLOCK)
2832 goto out;
2833
2834 mutex_enter(&stp->sd_lock);
2835 /*
2836 * Check for a missed wakeup.
2837 * Needed since strput did not hold sd_lock across
2838 * the canputnext.
2839 */
2840 if (canputnext(wqp)) {
2841 /* Try again */
2842 mutex_exit(&stp->sd_lock);
2843 continue;
2844 }
2845 TRACE_1(TR_FAC_STREAMS_FR, TR_STRWRITE_WAIT,
2846 "strwrite wait:q %p wait", wqp);
2847 if ((error = strwaitq(stp, waitflag, (ssize_t)0,
2848 tempmode, -1, &done)) != 0 || done) {
2849 mutex_exit(&stp->sd_lock);
2850 if ((vp->v_type == VFIFO) &&
2851 (uiop->uio_fmode & FNDELAY) &&
2852 (error == EAGAIN))
2853 error = 0;
2854 goto out;
2855 }
2856 TRACE_1(TR_FAC_STREAMS_FR, TR_STRWRITE_WAKE,
2857 "strwrite wake:q %p awakes", wqp);
2858 if ((error = i_straccess(stp, JCWRITE)) != 0) {
2859 mutex_exit(&stp->sd_lock);
2860 goto out;
2861 }
2862 mutex_exit(&stp->sd_lock);
2863 }
2864 waitflag |= NOINTR;
2865 TRACE_2(TR_FAC_STREAMS_FR, TR_STRWRITE_RESID,
2866 "strwrite resid:q %p uiop %p", wqp, uiop);
2867 if (uiop->uio_resid) {
2868 /* Recheck for errors - needed for sockets */
2869 if ((stp->sd_wput_opt & SW_RECHECK_ERR) &&
2870 (stp->sd_flag & (STWRERR|STRHUP|STPLEX))) {
2871 mutex_enter(&stp->sd_lock);
2872 error = strwriteable(stp, B_FALSE, B_TRUE);
2873 mutex_exit(&stp->sd_lock);
2874 if (error != 0)
2875 return (error);
2876 }
2877 continue;
2878 }
2879 break;
2880 }
2881 out:
2882 /*
2883 * For historical reasons, applications expect EAGAIN when a data
2884 * mblk_t cannot be allocated, so change ENOMEM back to EAGAIN.
2885 */
2886 if (error == ENOMEM)
2887 error = EAGAIN;
2888 TRACE_3(TR_FAC_STREAMS_FR, TR_STRWRITE_OUT,
2889 "strwrite out:q %p out %d error %d", wqp, 2, error);
2890 return (error);
2891 }
2892
2893 /*
2894 * Stream head write service routine.
2895 * Its job is to wake up any sleeping writers when a queue
2896 * downstream needs data (part of the flow control in putq and getq).
2897 * It also must wake anyone sleeping on a poll().
2898 * For stream head right below mux module, it must also invoke put procedure
2899 * of next downstream module.
2900 */
2901 int
2902 strwsrv(queue_t *q)
2903 {
2904 struct stdata *stp;
2905 queue_t *tq;
2906 qband_t *qbp;
2907 int i;
2908 qband_t *myqbp;
2909 int isevent;
2910 unsigned char qbf[NBAND]; /* band flushing backenable flags */
2911
2912 TRACE_1(TR_FAC_STREAMS_FR,
2913 TR_STRWSRV, "strwsrv:q %p", q);
2914 stp = (struct stdata *)q->q_ptr;
2915 ASSERT(qclaimed(q));
2916 mutex_enter(&stp->sd_lock);
2917 ASSERT(!(stp->sd_flag & STPLEX));
2918
2919 if (stp->sd_flag & WSLEEP) {
2920 stp->sd_flag &= ~WSLEEP;
2921 cv_broadcast(&q->q_wait);
2922 }
2923 mutex_exit(&stp->sd_lock);
2924
2925 /* The other end of a stream pipe went away. */
2926 if ((tq = q->q_next) == NULL) {
2927 return (0);
2928 }
2929
2930 /* Find the next module forward that has a service procedure */
2931 claimstr(q);
2932 tq = q->q_nfsrv;
2933 ASSERT(tq != NULL);
2934
2935 if ((q->q_flag & QBACK)) {
2936 if ((tq->q_flag & QFULL)) {
2937 mutex_enter(QLOCK(tq));
2938 if (!(tq->q_flag & QFULL)) {
2939 mutex_exit(QLOCK(tq));
2940 goto wakeup;
2941 }
2942 /*
2943 * The queue must have become full again. Set QWANTW
2944 * again so strwsrv will be back enabled when
2945 * the queue becomes non-full next time.
2946 */
2947 tq->q_flag |= QWANTW;
2948 mutex_exit(QLOCK(tq));
2949 } else {
2950 wakeup:
2951 pollwakeup(&stp->sd_pollist, POLLWRNORM);
2952 mutex_enter(&stp->sd_lock);
2953 if (stp->sd_sigflags & S_WRNORM)
2954 strsendsig(stp->sd_siglist, S_WRNORM, 0, 0);
2955 mutex_exit(&stp->sd_lock);
2956 }
2957 }
2958
2959 isevent = 0;
2960 i = 1;
2961 bzero((caddr_t)qbf, NBAND);
2962 mutex_enter(QLOCK(tq));
2963 if ((myqbp = q->q_bandp) != NULL)
2964 for (qbp = tq->q_bandp; qbp && myqbp; qbp = qbp->qb_next) {
2965 ASSERT(myqbp);
2966 if ((myqbp->qb_flag & QB_BACK)) {
2967 if (qbp->qb_flag & QB_FULL) {
2968 /*
2969 * The band must have become full again.
2970 * Set QB_WANTW again so strwsrv will
2971 * be back enabled when the band becomes
2972 * non-full next time.
2973 */
2974 qbp->qb_flag |= QB_WANTW;
2975 } else {
2976 isevent = 1;
2977 qbf[i] = 1;
2978 }
2979 }
2980 myqbp = myqbp->qb_next;
2981 i++;
2982 }
2983 mutex_exit(QLOCK(tq));
2984
2985 if (isevent) {
2986 for (i = tq->q_nband; i; i--) {
2987 if (qbf[i]) {
2988 pollwakeup(&stp->sd_pollist, POLLWRBAND);
2989 mutex_enter(&stp->sd_lock);
2990 if (stp->sd_sigflags & S_WRBAND)
2991 strsendsig(stp->sd_siglist, S_WRBAND,
2992 (uchar_t)i, 0);
2993 mutex_exit(&stp->sd_lock);
2994 }
2995 }
2996 }
2997
2998 releasestr(q);
2999 return (0);
3000 }
3001
3002 /*
3003 * Special case of strcopyin/strcopyout for copying
3004 * struct strioctl that can deal with both data
3005 * models.
3006 */
3007
3008 #ifdef _LP64
3009
3010 static int
3011 strcopyin_strioctl(void *from, void *to, int flag, int copyflag)
3012 {
3013 struct strioctl32 strioc32;
3014 struct strioctl *striocp;
3015
3016 if (copyflag & U_TO_K) {
3017 ASSERT((copyflag & K_TO_K) == 0);
3018
3019 if ((flag & FMODELS) == DATAMODEL_ILP32) {
3020 if (copyin(from, &strioc32, sizeof (strioc32)))
3021 return (EFAULT);
3022
3023 striocp = (struct strioctl *)to;
3024 striocp->ic_cmd = strioc32.ic_cmd;
3025 striocp->ic_timout = strioc32.ic_timout;
3026 striocp->ic_len = strioc32.ic_len;
3027 striocp->ic_dp = (char *)(uintptr_t)strioc32.ic_dp;
3028
3029 } else { /* NATIVE data model */
3030 if (copyin(from, to, sizeof (struct strioctl))) {
3031 return (EFAULT);
3032 } else {
3033 return (0);
3034 }
3035 }
3036 } else {
3037 ASSERT(copyflag & K_TO_K);
3038 bcopy(from, to, sizeof (struct strioctl));
3039 }
3040 return (0);
3041 }
3042
3043 static int
3044 strcopyout_strioctl(void *from, void *to, int flag, int copyflag)
3045 {
3046 struct strioctl32 strioc32;
3047 struct strioctl *striocp;
3048
3049 if (copyflag & U_TO_K) {
3050 ASSERT((copyflag & K_TO_K) == 0);
3051
3052 if ((flag & FMODELS) == DATAMODEL_ILP32) {
3053 striocp = (struct strioctl *)from;
3054 strioc32.ic_cmd = striocp->ic_cmd;
3055 strioc32.ic_timout = striocp->ic_timout;
3056 strioc32.ic_len = striocp->ic_len;
3057 strioc32.ic_dp = (caddr32_t)(uintptr_t)striocp->ic_dp;
3058 ASSERT((char *)(uintptr_t)strioc32.ic_dp ==
3059 striocp->ic_dp);
3060
3061 if (copyout(&strioc32, to, sizeof (strioc32)))
3062 return (EFAULT);
3063
3064 } else { /* NATIVE data model */
3065 if (copyout(from, to, sizeof (struct strioctl))) {
3066 return (EFAULT);
3067 } else {
3068 return (0);
3069 }
3070 }
3071 } else {
3072 ASSERT(copyflag & K_TO_K);
3073 bcopy(from, to, sizeof (struct strioctl));
3074 }
3075 return (0);
3076 }
3077
3078 #else /* ! _LP64 */
3079
3080 /* ARGSUSED2 */
3081 static int
3082 strcopyin_strioctl(void *from, void *to, int flag, int copyflag)
3083 {
3084 return (strcopyin(from, to, sizeof (struct strioctl), copyflag));
3085 }
3086
3087 /* ARGSUSED2 */
3088 static int
3089 strcopyout_strioctl(void *from, void *to, int flag, int copyflag)
3090 {
3091 return (strcopyout(from, to, sizeof (struct strioctl), copyflag));
3092 }
3093
3094 #endif /* _LP64 */
3095
3096 /*
3097 * Determine type of job control semantics expected by user. The
3098 * possibilities are:
3099 * JCREAD - Behaves like read() on fd; send SIGTTIN
3100 * JCWRITE - Behaves like write() on fd; send SIGTTOU if TOSTOP set
3101 * JCSETP - Sets a value in the stream; send SIGTTOU, ignore TOSTOP
3102 * JCGETP - Gets a value in the stream; no signals.
3103 * See straccess in strsubr.c for usage of these values.
3104 *
3105 * This routine also returns -1 for I_STR as a special case; the
3106 * caller must call again with the real ioctl number for
3107 * classification.
3108 */
3109 static int
3110 job_control_type(int cmd)
3111 {
3112 switch (cmd) {
3113 case I_STR:
3114 return (-1);
3115
3116 case I_RECVFD:
3117 case I_E_RECVFD:
3118 return (JCREAD);
3119
3120 case I_FDINSERT:
3121 case I_SENDFD:
3122 return (JCWRITE);
3123
3124 case TCSETA:
3125 case TCSETAW:
3126 case TCSETAF:
3127 case TCSBRK:
3128 case TCXONC:
3129 case TCFLSH:
3130 case TCDSET: /* Obsolete */
3131 case TIOCSWINSZ:
3132 case TCSETS:
3133 case TCSETSW:
3134 case TCSETSF:
3135 case TIOCSETD:
3136 case TIOCHPCL:
3137 case TIOCSETP:
3138 case TIOCSETN:
3139 case TIOCEXCL:
3140 case TIOCNXCL:
3141 case TIOCFLUSH:
3142 case TIOCSETC:
3143 case TIOCLBIS:
3144 case TIOCLBIC:
3145 case TIOCLSET:
3146 case TIOCSBRK:
3147 case TIOCCBRK:
3148 case TIOCSDTR:
3149 case TIOCCDTR:
3150 case TIOCSLTC:
3151 case TIOCSTOP:
3152 case TIOCSTART:
3153 case TIOCSTI:
3154 case TIOCSPGRP:
3155 case TIOCMSET:
3156 case TIOCMBIS:
3157 case TIOCMBIC:
3158 case TIOCREMOTE:
3159 case TIOCSIGNAL:
3160 case LDSETT:
3161 case LDSMAP: /* Obsolete */
3162 case DIOCSETP:
3163 case I_FLUSH:
3164 case I_SRDOPT:
3165 case I_SETSIG:
3166 case I_SWROPT:
3167 case I_FLUSHBAND:
3168 case I_SETCLTIME:
3169 case I_SERROPT:
3170 case I_ESETSIG:
3171 case FIONBIO:
3172 case FIOASYNC:
3173 case FIOSETOWN:
3174 case JBOOT: /* Obsolete */
3175 case JTERM: /* Obsolete */
3176 case JTIMOM: /* Obsolete */
3177 case JZOMBOOT: /* Obsolete */
3178 case JAGENT: /* Obsolete */
3179 case JTRUN: /* Obsolete */
3180 case JXTPROTO: /* Obsolete */
3181 return (JCSETP);
3182 }
3183
3184 return (JCGETP);
3185 }
3186
3187 /*
3188 * ioctl for streams
3189 */
3190 int
3191 strioctl(struct vnode *vp, int cmd, intptr_t arg, int flag, int copyflag,
3192 cred_t *crp, int *rvalp)
3193 {
3194 struct stdata *stp;
3195 struct strcmd *scp;
3196 struct strioctl strioc;
3197 struct uio uio;
3198 struct iovec iov;
3199 int access;
3200 mblk_t *mp;
3201 int error = 0;
3202 int done = 0;
3203 ssize_t rmin, rmax;
3204 queue_t *wrq;
3205 queue_t *rdq;
3206 boolean_t kioctl = B_FALSE;
3207 uint32_t auditing = AU_AUDITING();
3208
3209 if (flag & FKIOCTL) {
3210 copyflag = K_TO_K;
3211 kioctl = B_TRUE;
3212 }
3213 ASSERT(vp->v_stream);
3214 ASSERT(copyflag == U_TO_K || copyflag == K_TO_K);
3215 stp = vp->v_stream;
3216
3217 TRACE_3(TR_FAC_STREAMS_FR, TR_IOCTL_ENTER,
3218 "strioctl:stp %p cmd %X arg %lX", stp, cmd, arg);
3219
3220 /*
3221 * If the copy is kernel to kernel, make sure that the FNATIVE
3222 * flag is set. After this it would be a serious error to have
3223 * no model flag.
3224 */
3225 if (copyflag == K_TO_K)
3226 flag = (flag & ~FMODELS) | FNATIVE;
3227
3228 ASSERT((flag & FMODELS) != 0);
3229
3230 wrq = stp->sd_wrq;
3231 rdq = _RD(wrq);
3232
3233 access = job_control_type(cmd);
3234
3235 /* We should never see these here, should be handled by iwscn */
3236 if (cmd == SRIOCSREDIR || cmd == SRIOCISREDIR)
3237 return (EINVAL);
3238
3239 mutex_enter(&stp->sd_lock);
3240 if ((access != -1) && ((error = i_straccess(stp, access)) != 0)) {
3241 mutex_exit(&stp->sd_lock);
3242 return (error);
3243 }
3244 mutex_exit(&stp->sd_lock);
3245
3246 /*
3247 * Check for sgttyb-related ioctls first, and complain as
3248 * necessary.
3249 */
3250 switch (cmd) {
3251 case TIOCGETP:
3252 case TIOCSETP:
3253 case TIOCSETN:
3254 if (sgttyb_handling >= 2 && !sgttyb_complaint) {
3255 sgttyb_complaint = B_TRUE;
3256 cmn_err(CE_NOTE,
3257 "application used obsolete TIOC[GS]ET");
3258 }
3259 if (sgttyb_handling >= 3) {
3260 tsignal(curthread, SIGSYS);
3261 return (EIO);
3262 }
3263 break;
3264 }
3265
3266 mutex_enter(&stp->sd_lock);
3267
3268 switch (cmd) {
3269 case I_RECVFD:
3270 case I_E_RECVFD:
3271 case I_PEEK:
3272 case I_NREAD:
3273 case FIONREAD:
3274 case FIORDCHK:
3275 case I_ATMARK:
3276 case FIONBIO:
3277 case FIOASYNC:
3278 if (stp->sd_flag & (STRDERR|STPLEX)) {
3279 error = strgeterr(stp, STRDERR|STPLEX, 0);
3280 if (error != 0) {
3281 mutex_exit(&stp->sd_lock);
3282 return (error);
3283 }
3284 }
3285 break;
3286
3287 default:
3288 if (stp->sd_flag & (STRDERR|STWRERR|STPLEX)) {
3289 error = strgeterr(stp, STRDERR|STWRERR|STPLEX, 0);
3290 if (error != 0) {
3291 mutex_exit(&stp->sd_lock);
3292 return (error);
3293 }
3294 }
3295 }
3296
3297 mutex_exit(&stp->sd_lock);
3298
3299 switch (cmd) {
3300 default:
3301 /*
3302 * The stream head has hardcoded knowledge of a
3303 * miscellaneous collection of terminal-, keyboard- and
3304 * mouse-related ioctls, enumerated below. This hardcoded
3305 * knowledge allows the stream head to automatically
3306 * convert transparent ioctl requests made by userland
3307 * programs into I_STR ioctls which many old STREAMS
3308 * modules and drivers require.
3309 *
3310 * No new ioctls should ever be added to this list.
3311 * Instead, the STREAMS module or driver should be written
3312 * to either handle transparent ioctls or require any
3313 * userland programs to use I_STR ioctls (by returning
3314 * EINVAL to any transparent ioctl requests).
3315 *
3316 * More importantly, removing ioctls from this list should
3317 * be done with the utmost care, since our STREAMS modules
3318 * and drivers *count* on the stream head performing this
3319 * conversion, and thus may panic while processing
3320 * transparent ioctl request for one of these ioctls (keep
3321 * in mind that third party modules and drivers may have
3322 * similar problems).
3323 */
3324 if (((cmd & IOCTYPE) == LDIOC) ||
3325 ((cmd & IOCTYPE) == tIOC) ||
3326 ((cmd & IOCTYPE) == TIOC) ||
3327 ((cmd & IOCTYPE) == KIOC) ||
3328 ((cmd & IOCTYPE) == MSIOC) ||
3329 ((cmd & IOCTYPE) == VUIOC)) {
3330 /*
3331 * The ioctl is a tty ioctl - set up strioc buffer
3332 * and call strdoioctl() to do the work.
3333 */
3334 if (stp->sd_flag & STRHUP)
3335 return (ENXIO);
3336 strioc.ic_cmd = cmd;
3337 strioc.ic_timout = INFTIM;
3338
3339 switch (cmd) {
3340
3341 case TCXONC:
3342 case TCSBRK:
3343 case TCFLSH:
3344 case TCDSET:
3345 {
3346 int native_arg = (int)arg;
3347 strioc.ic_len = sizeof (int);
3348 strioc.ic_dp = (char *)&native_arg;
3349 return (strdoioctl(stp, &strioc, flag,
3350 K_TO_K, crp, rvalp));
3351 }
3352
3353 case TCSETA:
3354 case TCSETAW:
3355 case TCSETAF:
3356 strioc.ic_len = sizeof (struct termio);
3357 strioc.ic_dp = (char *)arg;
3358 return (strdoioctl(stp, &strioc, flag,
3359 copyflag, crp, rvalp));
3360
3361 case TCSETS:
3362 case TCSETSW:
3363 case TCSETSF:
3364 strioc.ic_len = sizeof (struct termios);
3365 strioc.ic_dp = (char *)arg;
3366 return (strdoioctl(stp, &strioc, flag,
3367 copyflag, crp, rvalp));
3368
3369 case LDSETT:
3370 strioc.ic_len = sizeof (struct termcb);
3371 strioc.ic_dp = (char *)arg;
3372 return (strdoioctl(stp, &strioc, flag,
3373 copyflag, crp, rvalp));
3374
3375 case TIOCSETP:
3376 strioc.ic_len = sizeof (struct sgttyb);
3377 strioc.ic_dp = (char *)arg;
3378 return (strdoioctl(stp, &strioc, flag,
3379 copyflag, crp, rvalp));
3380
3381 case TIOCSTI:
3382 if ((flag & FREAD) == 0 &&
3383 secpolicy_sti(crp) != 0) {
3384 return (EPERM);
3385 }
3386 mutex_enter(&stp->sd_lock);
3387 mutex_enter(&curproc->p_splock);
3388 if (stp->sd_sidp != curproc->p_sessp->s_sidp &&
3389 secpolicy_sti(crp) != 0) {
3390 mutex_exit(&curproc->p_splock);
3391 mutex_exit(&stp->sd_lock);
3392 return (EACCES);
3393 }
3394 mutex_exit(&curproc->p_splock);
3395 mutex_exit(&stp->sd_lock);
3396
3397 strioc.ic_len = sizeof (char);
3398 strioc.ic_dp = (char *)arg;
3399 return (strdoioctl(stp, &strioc, flag,
3400 copyflag, crp, rvalp));
3401
3402 case TIOCSWINSZ:
3403 strioc.ic_len = sizeof (struct winsize);
3404 strioc.ic_dp = (char *)arg;
3405 return (strdoioctl(stp, &strioc, flag,
3406 copyflag, crp, rvalp));
3407
3408 case TIOCSSIZE:
3409 strioc.ic_len = sizeof (struct ttysize);
3410 strioc.ic_dp = (char *)arg;
3411 return (strdoioctl(stp, &strioc, flag,
3412 copyflag, crp, rvalp));
3413
3414 case TIOCSSOFTCAR:
3415 case KIOCTRANS:
3416 case KIOCTRANSABLE:
3417 case KIOCCMD:
3418 case KIOCSDIRECT:
3419 case KIOCSCOMPAT:
3420 case KIOCSKABORTEN:
3421 case KIOCSRPTDELAY:
3422 case KIOCSRPTRATE:
3423 case VUIDSFORMAT:
3424 case TIOCSPPS:
3425 strioc.ic_len = sizeof (int);
3426 strioc.ic_dp = (char *)arg;
3427 return (strdoioctl(stp, &strioc, flag,
3428 copyflag, crp, rvalp));
3429
3430 case KIOCSETKEY:
3431 case KIOCGETKEY:
3432 strioc.ic_len = sizeof (struct kiockey);
3433 strioc.ic_dp = (char *)arg;
3434 return (strdoioctl(stp, &strioc, flag,
3435 copyflag, crp, rvalp));
3436
3437 case KIOCSKEY:
3438 case KIOCGKEY:
3439 strioc.ic_len = sizeof (struct kiockeymap);
3440 strioc.ic_dp = (char *)arg;
3441 return (strdoioctl(stp, &strioc, flag,
3442 copyflag, crp, rvalp));
3443
3444 case KIOCSLED:
3445 /* arg is a pointer to char */
3446 strioc.ic_len = sizeof (char);
3447 strioc.ic_dp = (char *)arg;
3448 return (strdoioctl(stp, &strioc, flag,
3449 copyflag, crp, rvalp));
3450
3451 case MSIOSETPARMS:
3452 strioc.ic_len = sizeof (Ms_parms);
3453 strioc.ic_dp = (char *)arg;
3454 return (strdoioctl(stp, &strioc, flag,
3455 copyflag, crp, rvalp));
3456
3457 case VUIDSADDR:
3458 case VUIDGADDR:
3459 strioc.ic_len = sizeof (struct vuid_addr_probe);
3460 strioc.ic_dp = (char *)arg;
3461 return (strdoioctl(stp, &strioc, flag,
3462 copyflag, crp, rvalp));
3463
3464 /*
3465 * These M_IOCTL's don't require any data to be sent
3466 * downstream, and the driver will allocate and link
3467 * on its own mblk_t upon M_IOCACK -- thus we set
3468 * ic_len to zero and set ic_dp to arg so we know
3469 * where to copyout to later.
3470 */
3471 case TIOCGSOFTCAR:
3472 case TIOCGWINSZ:
3473 case TIOCGSIZE:
3474 case KIOCGTRANS:
3475 case KIOCGTRANSABLE:
3476 case KIOCTYPE:
3477 case KIOCGDIRECT:
3478 case KIOCGCOMPAT:
3479 case KIOCLAYOUT:
3480 case KIOCGLED:
3481 case MSIOGETPARMS:
3482 case MSIOBUTTONS:
3483 case VUIDGFORMAT:
3484 case TIOCGPPS:
3485 case TIOCGPPSEV:
3486 case TCGETA:
3487 case TCGETS:
3488 case LDGETT:
3489 case TIOCGETP:
3490 case KIOCGRPTDELAY:
3491 case KIOCGRPTRATE:
3492 strioc.ic_len = 0;
3493 strioc.ic_dp = (char *)arg;
3494 return (strdoioctl(stp, &strioc, flag,
3495 copyflag, crp, rvalp));
3496 }
3497 }
3498
3499 /*
3500 * Unknown cmd - send it down as a transparent ioctl.
3501 */
3502 strioc.ic_cmd = cmd;
3503 strioc.ic_timout = INFTIM;
3504 strioc.ic_len = TRANSPARENT;
3505 strioc.ic_dp = (char *)&arg;
3506
3507 return (strdoioctl(stp, &strioc, flag, copyflag, crp, rvalp));
3508
3509 case I_STR:
3510 /*
3511 * Stream ioctl. Read in an strioctl buffer from the user
3512 * along with any data specified and send it downstream.
3513 * Strdoioctl will wait allow only one ioctl message at
3514 * a time, and waits for the acknowledgement.
3515 */
3516
3517 if (stp->sd_flag & STRHUP)
3518 return (ENXIO);
3519
3520 error = strcopyin_strioctl((void *)arg, &strioc, flag,
3521 copyflag);
3522 if (error != 0)
3523 return (error);
3524
3525 if ((strioc.ic_len < 0) || (strioc.ic_timout < -1))
3526 return (EINVAL);
3527
3528 access = job_control_type(strioc.ic_cmd);
3529 mutex_enter(&stp->sd_lock);
3530 if ((access != -1) &&
3531 ((error = i_straccess(stp, access)) != 0)) {
3532 mutex_exit(&stp->sd_lock);
3533 return (error);
3534 }
3535 mutex_exit(&stp->sd_lock);
3536
3537 /*
3538 * The I_STR facility provides a trap door for malicious
3539 * code to send down bogus streamio(7I) ioctl commands to
3540 * unsuspecting STREAMS modules and drivers which expect to
3541 * only get these messages from the stream head.
3542 * Explicitly prohibit any streamio ioctls which can be
3543 * passed downstream by the stream head. Note that we do
3544 * not block all streamio ioctls because the ioctl
3545 * numberspace is not well managed and thus it's possible
3546 * that a module or driver's ioctl numbers may accidentally
3547 * collide with them.
3548 */
3549 switch (strioc.ic_cmd) {
3550 case I_LINK:
3551 case I_PLINK:
3552 case I_UNLINK:
3553 case I_PUNLINK:
3554 case _I_GETPEERCRED:
3555 case _I_PLINK_LH:
3556 return (EINVAL);
3557 }
3558
3559 error = strdoioctl(stp, &strioc, flag, copyflag, crp, rvalp);
3560 if (error == 0) {
3561 error = strcopyout_strioctl(&strioc, (void *)arg,
3562 flag, copyflag);
3563 }
3564 return (error);
3565
3566 case _I_CMD:
3567 /*
3568 * Like I_STR, but without using M_IOC* messages and without
3569 * copyins/copyouts beyond the passed-in argument.
3570 */
3571 if (stp->sd_flag & STRHUP)
3572 return (ENXIO);
3573
3574 if ((scp = kmem_alloc(sizeof (strcmd_t), KM_NOSLEEP)) == NULL)
3575 return (ENOMEM);
3576
3577 if (copyin((void *)arg, scp, sizeof (strcmd_t))) {
3578 kmem_free(scp, sizeof (strcmd_t));
3579 return (EFAULT);
3580 }
3581
3582 access = job_control_type(scp->sc_cmd);
3583 mutex_enter(&stp->sd_lock);
3584 if (access != -1 && (error = i_straccess(stp, access)) != 0) {
3585 mutex_exit(&stp->sd_lock);
3586 kmem_free(scp, sizeof (strcmd_t));
3587 return (error);
3588 }
3589 mutex_exit(&stp->sd_lock);
3590
3591 *rvalp = 0;
3592 if ((error = strdocmd(stp, scp, crp)) == 0) {
3593 if (copyout(scp, (void *)arg, sizeof (strcmd_t)))
3594 error = EFAULT;
3595 }
3596 kmem_free(scp, sizeof (strcmd_t));
3597 return (error);
3598
3599 case I_NREAD:
3600 /*
3601 * Return number of bytes of data in first message
3602 * in queue in "arg" and return the number of messages
3603 * in queue in return value.
3604 */
3605 {
3606 size_t size;
3607 int retval;
3608 int count = 0;
3609
3610 mutex_enter(QLOCK(rdq));
3611
3612 size = msgdsize(rdq->q_first);
3613 for (mp = rdq->q_first; mp != NULL; mp = mp->b_next)
3614 count++;
3615
3616 mutex_exit(QLOCK(rdq));
3617 if (stp->sd_struiordq) {
3618 infod_t infod;
3619
3620 infod.d_cmd = INFOD_COUNT;
3621 infod.d_count = 0;
3622 if (count == 0) {
3623 infod.d_cmd |= INFOD_FIRSTBYTES;
3624 infod.d_bytes = 0;
3625 }
3626 infod.d_res = 0;
3627 (void) infonext(rdq, &infod);
3628 count += infod.d_count;
3629 if (infod.d_res & INFOD_FIRSTBYTES)
3630 size = infod.d_bytes;
3631 }
3632
3633 /*
3634 * Drop down from size_t to the "int" required by the
3635 * interface. Cap at INT_MAX.
3636 */
3637 retval = MIN(size, INT_MAX);
3638 error = strcopyout(&retval, (void *)arg, sizeof (retval),
3639 copyflag);
3640 if (!error)
3641 *rvalp = count;
3642 return (error);
3643 }
3644
3645 case FIONREAD:
3646 /*
3647 * Return number of bytes of data in all data messages
3648 * in queue in "arg".
3649 */
3650 {
3651 size_t size = 0;
3652 int retval;
3653
3654 mutex_enter(QLOCK(rdq));
3655 for (mp = rdq->q_first; mp != NULL; mp = mp->b_next)
3656 size += msgdsize(mp);
3657 mutex_exit(QLOCK(rdq));
3658
3659 if (stp->sd_struiordq) {
3660 infod_t infod;
3661
3662 infod.d_cmd = INFOD_BYTES;
3663 infod.d_res = 0;
3664 infod.d_bytes = 0;
3665 (void) infonext(rdq, &infod);
3666 size += infod.d_bytes;
3667 }
3668
3669 /*
3670 * Drop down from size_t to the "int" required by the
3671 * interface. Cap at INT_MAX.
3672 */
3673 retval = MIN(size, INT_MAX);
3674 error = strcopyout(&retval, (void *)arg, sizeof (retval),
3675 copyflag);
3676
3677 *rvalp = 0;
3678 return (error);
3679 }
3680 case FIORDCHK:
3681 /*
3682 * FIORDCHK does not use arg value (like FIONREAD),
3683 * instead a count is returned. I_NREAD value may
3684 * not be accurate but safe. The real thing to do is
3685 * to add the msgdsizes of all data messages until
3686 * a non-data message.
3687 */
3688 {
3689 size_t size = 0;
3690
3691 mutex_enter(QLOCK(rdq));
3692 for (mp = rdq->q_first; mp != NULL; mp = mp->b_next)
3693 size += msgdsize(mp);
3694 mutex_exit(QLOCK(rdq));
3695
3696 if (stp->sd_struiordq) {
3697 infod_t infod;
3698
3699 infod.d_cmd = INFOD_BYTES;
3700 infod.d_res = 0;
3701 infod.d_bytes = 0;
3702 (void) infonext(rdq, &infod);
3703 size += infod.d_bytes;
3704 }
3705
3706 /*
3707 * Since ioctl returns an int, and memory sizes under
3708 * LP64 may not fit, we return INT_MAX if the count was
3709 * actually greater.
3710 */
3711 *rvalp = MIN(size, INT_MAX);
3712 return (0);
3713 }
3714
3715 case I_FIND:
3716 /*
3717 * Get module name.
3718 */
3719 {
3720 char mname[FMNAMESZ + 1];
3721 queue_t *q;
3722
3723 error = (copyflag & U_TO_K ? copyinstr : copystr)((void *)arg,
3724 mname, FMNAMESZ + 1, NULL);
3725 if (error)
3726 return ((error == ENAMETOOLONG) ? EINVAL : EFAULT);
3727
3728 /*
3729 * Return EINVAL if we're handed a bogus module name.
3730 */
3731 if (fmodsw_find(mname, FMODSW_LOAD) == NULL) {
3732 TRACE_0(TR_FAC_STREAMS_FR,
3733 TR_I_CANT_FIND, "couldn't I_FIND");
3734 return (EINVAL);
3735 }
3736
3737 *rvalp = 0;
3738
3739 /* Look downstream to see if module is there. */
3740 claimstr(stp->sd_wrq);
3741 for (q = stp->sd_wrq->q_next; q; q = q->q_next) {
3742 if (q->q_flag & QREADR) {
3743 q = NULL;
3744 break;
3745 }
3746 if (strcmp(mname, Q2NAME(q)) == 0)
3747 break;
3748 }
3749 releasestr(stp->sd_wrq);
3750
3751 *rvalp = (q ? 1 : 0);
3752 return (error);
3753 }
3754
3755 case I_PUSH:
3756 case __I_PUSH_NOCTTY:
3757 /*
3758 * Push a module.
3759 * For the case __I_PUSH_NOCTTY push a module but
3760 * do not allocate controlling tty. See bugid 4025044
3761 */
3762
3763 {
3764 char mname[FMNAMESZ + 1];
3765 fmodsw_impl_t *fp;
3766 dev_t dummydev;
3767
3768 if (stp->sd_flag & STRHUP)
3769 return (ENXIO);
3770
3771 /*
3772 * Get module name and look up in fmodsw.
3773 */
3774 error = (copyflag & U_TO_K ? copyinstr : copystr)((void *)arg,
3775 mname, FMNAMESZ + 1, NULL);
3776 if (error)
3777 return ((error == ENAMETOOLONG) ? EINVAL : EFAULT);
3778
3779 if ((fp = fmodsw_find(mname, FMODSW_HOLD | FMODSW_LOAD)) ==
3780 NULL)
3781 return (EINVAL);
3782
3783 TRACE_2(TR_FAC_STREAMS_FR, TR_I_PUSH,
3784 "I_PUSH:fp %p stp %p", fp, stp);
3785
3786 if (error = strstartplumb(stp, flag, cmd)) {
3787 fmodsw_rele(fp);
3788 return (error);
3789 }
3790
3791 /*
3792 * See if any more modules can be pushed on this stream.
3793 * Note that this check must be done after strstartplumb()
3794 * since otherwise multiple threads issuing I_PUSHes on
3795 * the same stream will be able to exceed nstrpush.
3796 */
3797 mutex_enter(&stp->sd_lock);
3798 if (stp->sd_pushcnt >= nstrpush) {
3799 fmodsw_rele(fp);
3800 strendplumb(stp);
3801 mutex_exit(&stp->sd_lock);
3802 return (EINVAL);
3803 }
3804 mutex_exit(&stp->sd_lock);
3805
3806 /*
3807 * Push new module and call its open routine
3808 * via qattach(). Modules don't change device
3809 * numbers, so just ignore dummydev here.
3810 */
3811 dummydev = vp->v_rdev;
3812 if ((error = qattach(rdq, &dummydev, 0, crp, fp,
3813 B_FALSE)) == 0) {
3814 if (vp->v_type == VCHR && /* sorry, no pipes allowed */
3815 (cmd == I_PUSH) && (stp->sd_flag & STRISTTY)) {
3816 /*
3817 * try to allocate it as a controlling terminal
3818 */
3819 (void) strctty(stp);
3820 }
3821 }
3822
3823 mutex_enter(&stp->sd_lock);
3824
3825 /*
3826 * As a performance concern we are caching the values of
3827 * q_minpsz and q_maxpsz of the module below the stream
3828 * head in the stream head.
3829 */
3830 mutex_enter(QLOCK(stp->sd_wrq->q_next));
3831 rmin = stp->sd_wrq->q_next->q_minpsz;
3832 rmax = stp->sd_wrq->q_next->q_maxpsz;
3833 mutex_exit(QLOCK(stp->sd_wrq->q_next));
3834
3835 /* Do this processing here as a performance concern */
3836 if (strmsgsz != 0) {
3837 if (rmax == INFPSZ)
3838 rmax = strmsgsz;
3839 else {
3840 if (vp->v_type == VFIFO)
3841 rmax = MIN(PIPE_BUF, rmax);
3842 else rmax = MIN(strmsgsz, rmax);
3843 }
3844 }
3845
3846 mutex_enter(QLOCK(wrq));
3847 stp->sd_qn_minpsz = rmin;
3848 stp->sd_qn_maxpsz = rmax;
3849 mutex_exit(QLOCK(wrq));
3850
3851 strendplumb(stp);
3852 mutex_exit(&stp->sd_lock);
3853 return (error);
3854 }
3855
3856 case I_POP:
3857 {
3858 queue_t *q;
3859
3860 if (stp->sd_flag & STRHUP)
3861 return (ENXIO);
3862 if (!wrq->q_next) /* for broken pipes */
3863 return (EINVAL);
3864
3865 if (error = strstartplumb(stp, flag, cmd))
3866 return (error);
3867
3868 /*
3869 * If there is an anchor on this stream and popping
3870 * the current module would attempt to pop through the
3871 * anchor, then disallow the pop unless we have sufficient
3872 * privileges; take the cheapest (non-locking) check
3873 * first.
3874 */
3875 if (secpolicy_ip_config(crp, B_TRUE) != 0 ||
3876 (stp->sd_anchorzone != crgetzoneid(crp))) {
3877 mutex_enter(&stp->sd_lock);
3878 /*
3879 * Anchors only apply if there's at least one
3880 * module on the stream (sd_pushcnt > 0).
3881 */
3882 if (stp->sd_pushcnt > 0 &&
3883 stp->sd_pushcnt == stp->sd_anchor &&
3884 stp->sd_vnode->v_type != VFIFO) {
3885 strendplumb(stp);
3886 mutex_exit(&stp->sd_lock);
3887 if (stp->sd_anchorzone != crgetzoneid(crp))
3888 return (EINVAL);
3889 /* Audit and report error */
3890 return (secpolicy_ip_config(crp, B_FALSE));
3891 }
3892 mutex_exit(&stp->sd_lock);
3893 }
3894
3895 q = wrq->q_next;
3896 TRACE_2(TR_FAC_STREAMS_FR, TR_I_POP,
3897 "I_POP:%p from %p", q, stp);
3898 if (q->q_next == NULL || (q->q_flag & (QREADR|QISDRV))) {
3899 error = EINVAL;
3900 } else {
3901 qdetach(_RD(q), 1, flag, crp, B_FALSE);
3902 error = 0;
3903 }
3904 mutex_enter(&stp->sd_lock);
3905
3906 /*
3907 * As a performance concern we are caching the values of
3908 * q_minpsz and q_maxpsz of the module below the stream
3909 * head in the stream head.
3910 */
3911 mutex_enter(QLOCK(wrq->q_next));
3912 rmin = wrq->q_next->q_minpsz;
3913 rmax = wrq->q_next->q_maxpsz;
3914 mutex_exit(QLOCK(wrq->q_next));
3915
3916 /* Do this processing here as a performance concern */
3917 if (strmsgsz != 0) {
3918 if (rmax == INFPSZ)
3919 rmax = strmsgsz;
3920 else {
3921 if (vp->v_type == VFIFO)
3922 rmax = MIN(PIPE_BUF, rmax);
3923 else rmax = MIN(strmsgsz, rmax);
3924 }
3925 }
3926
3927 mutex_enter(QLOCK(wrq));
3928 stp->sd_qn_minpsz = rmin;
3929 stp->sd_qn_maxpsz = rmax;
3930 mutex_exit(QLOCK(wrq));
3931
3932 /* If we popped through the anchor, then reset the anchor. */
3933 if (stp->sd_pushcnt < stp->sd_anchor) {
3934 stp->sd_anchor = 0;
3935 stp->sd_anchorzone = 0;
3936 }
3937 strendplumb(stp);
3938 mutex_exit(&stp->sd_lock);
3939 return (error);
3940 }
3941
3942 case _I_MUXID2FD:
3943 {
3944 /*
3945 * Create a fd for a I_PLINK'ed lower stream with a given
3946 * muxid. With the fd, application can send down ioctls,
3947 * like I_LIST, to the previously I_PLINK'ed stream. Note
3948 * that after getting the fd, the application has to do an
3949 * I_PUNLINK on the muxid before it can do any operation
3950 * on the lower stream. This is required by spec1170.
3951 *
3952 * The fd used to do this ioctl should point to the same
3953 * controlling device used to do the I_PLINK. If it uses
3954 * a different stream or an invalid muxid, I_MUXID2FD will
3955 * fail. The error code is set to EINVAL.
3956 *
3957 * The intended use of this interface is the following.
3958 * An application I_PLINK'ed a stream and exits. The fd
3959 * to the lower stream is gone. Another application
3960 * wants to get a fd to the lower stream, it uses I_MUXID2FD.
3961 */
3962 int muxid = (int)arg;
3963 int fd;
3964 linkinfo_t *linkp;
3965 struct file *fp;
3966 netstack_t *ns;
3967 str_stack_t *ss;
3968
3969 /*
3970 * Do not allow the wildcard muxid. This ioctl is not
3971 * intended to find arbitrary link.
3972 */
3973 if (muxid == 0) {
3974 return (EINVAL);
3975 }
3976
3977 ns = netstack_find_by_cred(crp);
3978 ASSERT(ns != NULL);
3979 ss = ns->netstack_str;
3980 ASSERT(ss != NULL);
3981
3982 mutex_enter(&muxifier);
3983 linkp = findlinks(vp->v_stream, muxid, LINKPERSIST, ss);
3984 if (linkp == NULL) {
3985 mutex_exit(&muxifier);
3986 netstack_rele(ss->ss_netstack);
3987 return (EINVAL);
3988 }
3989
3990 if ((fd = ufalloc(0)) == -1) {
3991 mutex_exit(&muxifier);
3992 netstack_rele(ss->ss_netstack);
3993 return (EMFILE);
3994 }
3995 fp = linkp->li_fpdown;
3996 mutex_enter(&fp->f_tlock);
3997 fp->f_count++;
3998 mutex_exit(&fp->f_tlock);
3999 mutex_exit(&muxifier);
4000 setf(fd, fp);
4001 *rvalp = fd;
4002 netstack_rele(ss->ss_netstack);
4003 return (0);
4004 }
4005
4006 case _I_INSERT:
4007 {
4008 /*
4009 * To insert a module to a given position in a stream.
4010 * In the first release, only allow privileged user
4011 * to use this ioctl. Furthermore, the insert is only allowed
4012 * below an anchor if the zoneid is the same as the zoneid
4013 * which created the anchor.
4014 *
4015 * Note that we do not plan to support this ioctl
4016 * on pipes in the first release. We want to learn more
4017 * about the implications of these ioctls before extending
4018 * their support. And we do not think these features are
4019 * valuable for pipes.
4020 */
4021 STRUCT_DECL(strmodconf, strmodinsert);
4022 char mod_name[FMNAMESZ + 1];
4023 fmodsw_impl_t *fp;
4024 dev_t dummydev;
4025 queue_t *tmp_wrq;
4026 int pos;
4027 boolean_t is_insert;
4028
4029 STRUCT_INIT(strmodinsert, flag);
4030 if (stp->sd_flag & STRHUP)
4031 return (ENXIO);
4032 if (STRMATED(stp))
4033 return (EINVAL);
4034 if ((error = secpolicy_net_config(crp, B_FALSE)) != 0)
4035 return (error);
4036 if (stp->sd_anchor != 0 &&
4037 stp->sd_anchorzone != crgetzoneid(crp))
4038 return (EINVAL);
4039
4040 error = strcopyin((void *)arg, STRUCT_BUF(strmodinsert),
4041 STRUCT_SIZE(strmodinsert), copyflag);
4042 if (error)
4043 return (error);
4044
4045 /*
4046 * Get module name and look up in fmodsw.
4047 */
4048 error = (copyflag & U_TO_K ? copyinstr :
4049 copystr)(STRUCT_FGETP(strmodinsert, mod_name),
4050 mod_name, FMNAMESZ + 1, NULL);
4051 if (error)
4052 return ((error == ENAMETOOLONG) ? EINVAL : EFAULT);
4053
4054 if ((fp = fmodsw_find(mod_name, FMODSW_HOLD | FMODSW_LOAD)) ==
4055 NULL)
4056 return (EINVAL);
4057
4058 if (error = strstartplumb(stp, flag, cmd)) {
4059 fmodsw_rele(fp);
4060 return (error);
4061 }
4062
4063 /*
4064 * Is this _I_INSERT just like an I_PUSH? We need to know
4065 * this because we do some optimizations if this is a
4066 * module being pushed.
4067 */
4068 pos = STRUCT_FGET(strmodinsert, pos);
4069 is_insert = (pos != 0);
4070
4071 /*
4072 * Make sure pos is valid. Even though it is not an I_PUSH,
4073 * we impose the same limit on the number of modules in a
4074 * stream.
4075 */
4076 mutex_enter(&stp->sd_lock);
4077 if (stp->sd_pushcnt >= nstrpush || pos < 0 ||
4078 pos > stp->sd_pushcnt) {
4079 fmodsw_rele(fp);
4080 strendplumb(stp);
4081 mutex_exit(&stp->sd_lock);
4082 return (EINVAL);
4083 }
4084 if (stp->sd_anchor != 0) {
4085 /*
4086 * Is this insert below the anchor?
4087 * Pushcnt hasn't been increased yet hence
4088 * we test for greater than here, and greater or
4089 * equal after qattach.
4090 */
4091 if (pos > (stp->sd_pushcnt - stp->sd_anchor) &&
4092 stp->sd_anchorzone != crgetzoneid(crp)) {
4093 fmodsw_rele(fp);
4094 strendplumb(stp);
4095 mutex_exit(&stp->sd_lock);
4096 return (EPERM);
4097 }
4098 }
4099
4100 mutex_exit(&stp->sd_lock);
4101
4102 /*
4103 * First find the correct position this module to
4104 * be inserted. We don't need to call claimstr()
4105 * as the stream should not be changing at this point.
4106 *
4107 * Insert new module and call its open routine
4108 * via qattach(). Modules don't change device
4109 * numbers, so just ignore dummydev here.
4110 */
4111 for (tmp_wrq = stp->sd_wrq; pos > 0;
4112 tmp_wrq = tmp_wrq->q_next, pos--) {
4113 ASSERT(SAMESTR(tmp_wrq));
4114 }
4115 dummydev = vp->v_rdev;
4116 if ((error = qattach(_RD(tmp_wrq), &dummydev, 0, crp,
4117 fp, is_insert)) != 0) {
4118 mutex_enter(&stp->sd_lock);
4119 strendplumb(stp);
4120 mutex_exit(&stp->sd_lock);
4121 return (error);
4122 }
4123
4124 mutex_enter(&stp->sd_lock);
4125
4126 /*
4127 * As a performance concern we are caching the values of
4128 * q_minpsz and q_maxpsz of the module below the stream
4129 * head in the stream head.
4130 */
4131 if (!is_insert) {
4132 mutex_enter(QLOCK(stp->sd_wrq->q_next));
4133 rmin = stp->sd_wrq->q_next->q_minpsz;
4134 rmax = stp->sd_wrq->q_next->q_maxpsz;
4135 mutex_exit(QLOCK(stp->sd_wrq->q_next));
4136
4137 /* Do this processing here as a performance concern */
4138 if (strmsgsz != 0) {
4139 if (rmax == INFPSZ) {
4140 rmax = strmsgsz;
4141 } else {
4142 rmax = MIN(strmsgsz, rmax);
4143 }
4144 }
4145
4146 mutex_enter(QLOCK(wrq));
4147 stp->sd_qn_minpsz = rmin;
4148 stp->sd_qn_maxpsz = rmax;
4149 mutex_exit(QLOCK(wrq));
4150 }
4151
4152 /*
4153 * Need to update the anchor value if this module is
4154 * inserted below the anchor point.
4155 */
4156 if (stp->sd_anchor != 0) {
4157 pos = STRUCT_FGET(strmodinsert, pos);
4158 if (pos >= (stp->sd_pushcnt - stp->sd_anchor))
4159 stp->sd_anchor++;
4160 }
4161
4162 strendplumb(stp);
4163 mutex_exit(&stp->sd_lock);
4164 return (0);
4165 }
4166
4167 case _I_REMOVE:
4168 {
4169 /*
4170 * To remove a module with a given name in a stream. The
4171 * caller of this ioctl needs to provide both the name and
4172 * the position of the module to be removed. This eliminates
4173 * the ambiguity of removal if a module is inserted/pushed
4174 * multiple times in a stream. In the first release, only
4175 * allow privileged user to use this ioctl.
4176 * Furthermore, the remove is only allowed
4177 * below an anchor if the zoneid is the same as the zoneid
4178 * which created the anchor.
4179 *
4180 * Note that we do not plan to support this ioctl
4181 * on pipes in the first release. We want to learn more
4182 * about the implications of these ioctls before extending
4183 * their support. And we do not think these features are
4184 * valuable for pipes.
4185 *
4186 * Also note that _I_REMOVE cannot be used to remove a
4187 * driver or the stream head.
4188 */
4189 STRUCT_DECL(strmodconf, strmodremove);
4190 queue_t *q;
4191 int pos;
4192 char mod_name[FMNAMESZ + 1];
4193 boolean_t is_remove;
4194
4195 STRUCT_INIT(strmodremove, flag);
4196 if (stp->sd_flag & STRHUP)
4197 return (ENXIO);
4198 if (STRMATED(stp))
4199 return (EINVAL);
4200 if ((error = secpolicy_net_config(crp, B_FALSE)) != 0)
4201 return (error);
4202 if (stp->sd_anchor != 0 &&
4203 stp->sd_anchorzone != crgetzoneid(crp))
4204 return (EINVAL);
4205
4206 error = strcopyin((void *)arg, STRUCT_BUF(strmodremove),
4207 STRUCT_SIZE(strmodremove), copyflag);
4208 if (error)
4209 return (error);
4210
4211 error = (copyflag & U_TO_K ? copyinstr :
4212 copystr)(STRUCT_FGETP(strmodremove, mod_name),
4213 mod_name, FMNAMESZ + 1, NULL);
4214 if (error)
4215 return ((error == ENAMETOOLONG) ? EINVAL : EFAULT);
4216
4217 if ((error = strstartplumb(stp, flag, cmd)) != 0)
4218 return (error);
4219
4220 /*
4221 * Match the name of given module to the name of module at
4222 * the given position.
4223 */
4224 pos = STRUCT_FGET(strmodremove, pos);
4225
4226 is_remove = (pos != 0);
4227 for (q = stp->sd_wrq->q_next; SAMESTR(q) && pos > 0;
4228 q = q->q_next, pos--)
4229 ;
4230 if (pos > 0 || !SAMESTR(q) ||
4231 strcmp(Q2NAME(q), mod_name) != 0) {
4232 mutex_enter(&stp->sd_lock);
4233 strendplumb(stp);
4234 mutex_exit(&stp->sd_lock);
4235 return (EINVAL);
4236 }
4237
4238 /*
4239 * If the position is at or below an anchor, then the zoneid
4240 * must match the zoneid that created the anchor.
4241 */
4242 if (stp->sd_anchor != 0) {
4243 pos = STRUCT_FGET(strmodremove, pos);
4244 if (pos >= (stp->sd_pushcnt - stp->sd_anchor) &&
4245 stp->sd_anchorzone != crgetzoneid(crp)) {
4246 mutex_enter(&stp->sd_lock);
4247 strendplumb(stp);
4248 mutex_exit(&stp->sd_lock);
4249 return (EPERM);
4250 }
4251 }
4252
4253
4254 ASSERT(!(q->q_flag & QREADR));
4255 qdetach(_RD(q), 1, flag, crp, is_remove);
4256
4257 mutex_enter(&stp->sd_lock);
4258
4259 /*
4260 * As a performance concern we are caching the values of
4261 * q_minpsz and q_maxpsz of the module below the stream
4262 * head in the stream head.
4263 */
4264 if (!is_remove) {
4265 mutex_enter(QLOCK(wrq->q_next));
4266 rmin = wrq->q_next->q_minpsz;
4267 rmax = wrq->q_next->q_maxpsz;
4268 mutex_exit(QLOCK(wrq->q_next));
4269
4270 /* Do this processing here as a performance concern */
4271 if (strmsgsz != 0) {
4272 if (rmax == INFPSZ)
4273 rmax = strmsgsz;
4274 else {
4275 if (vp->v_type == VFIFO)
4276 rmax = MIN(PIPE_BUF, rmax);
4277 else rmax = MIN(strmsgsz, rmax);
4278 }
4279 }
4280
4281 mutex_enter(QLOCK(wrq));
4282 stp->sd_qn_minpsz = rmin;
4283 stp->sd_qn_maxpsz = rmax;
4284 mutex_exit(QLOCK(wrq));
4285 }
4286
4287 /*
4288 * Need to update the anchor value if this module is removed
4289 * at or below the anchor point. If the removed module is at
4290 * the anchor point, remove the anchor for this stream if
4291 * there is no module above the anchor point. Otherwise, if
4292 * the removed module is below the anchor point, decrement the
4293 * anchor point by 1.
4294 */
4295 if (stp->sd_anchor != 0) {
4296 pos = STRUCT_FGET(strmodremove, pos);
4297 if (pos == stp->sd_pushcnt - stp->sd_anchor + 1)
4298 stp->sd_anchor = 0;
4299 else if (pos > (stp->sd_pushcnt - stp->sd_anchor + 1))
4300 stp->sd_anchor--;
4301 }
4302
4303 strendplumb(stp);
4304 mutex_exit(&stp->sd_lock);
4305 return (0);
4306 }
4307
4308 case I_ANCHOR:
4309 /*
4310 * Set the anchor position on the stream to reside at
4311 * the top module (in other words, the top module
4312 * cannot be popped). Anchors with a FIFO make no
4313 * obvious sense, so they're not allowed.
4314 */
4315 mutex_enter(&stp->sd_lock);
4316
4317 if (stp->sd_vnode->v_type == VFIFO) {
4318 mutex_exit(&stp->sd_lock);
4319 return (EINVAL);
4320 }
4321 /* Only allow the same zoneid to update the anchor */
4322 if (stp->sd_anchor != 0 &&
4323 stp->sd_anchorzone != crgetzoneid(crp)) {
4324 mutex_exit(&stp->sd_lock);
4325 return (EINVAL);
4326 }
4327 stp->sd_anchor = stp->sd_pushcnt;
4328 stp->sd_anchorzone = crgetzoneid(crp);
4329 mutex_exit(&stp->sd_lock);
4330 return (0);
4331
4332 case I_LOOK:
4333 /*
4334 * Get name of first module downstream.
4335 * If no module, return an error.
4336 */
4337 claimstr(wrq);
4338 if (_SAMESTR(wrq) && wrq->q_next->q_next != NULL) {
4339 char *name = Q2NAME(wrq->q_next);
4340
4341 error = strcopyout(name, (void *)arg, strlen(name) + 1,
4342 copyflag);
4343 releasestr(wrq);
4344 return (error);
4345 }
4346 releasestr(wrq);
4347 return (EINVAL);
4348
4349 case I_LINK:
4350 case I_PLINK:
4351 /*
4352 * Link a multiplexor.
4353 */
4354 return (mlink(vp, cmd, (int)arg, crp, rvalp, 0));
4355
4356 case _I_PLINK_LH:
4357 /*
4358 * Link a multiplexor: Call must originate from kernel.
4359 */
4360 if (kioctl)
4361 return (ldi_mlink_lh(vp, cmd, arg, crp, rvalp));
4362
4363 return (EINVAL);
4364 case I_UNLINK:
4365 case I_PUNLINK:
4366 /*
4367 * Unlink a multiplexor.
4368 * If arg is -1, unlink all links for which this is the
4369 * controlling stream. Otherwise, arg is an index number
4370 * for a link to be removed.
4371 */
4372 {
4373 struct linkinfo *linkp;
4374 int native_arg = (int)arg;
4375 int type;
4376 netstack_t *ns;
4377 str_stack_t *ss;
4378
4379 TRACE_1(TR_FAC_STREAMS_FR,
4380 TR_I_UNLINK, "I_UNLINK/I_PUNLINK:%p", stp);
4381 if (vp->v_type == VFIFO) {
4382 return (EINVAL);
4383 }
4384 if (cmd == I_UNLINK)
4385 type = LINKNORMAL;
4386 else /* I_PUNLINK */
4387 type = LINKPERSIST;
4388 if (native_arg == 0) {
4389 return (EINVAL);
4390 }
4391 ns = netstack_find_by_cred(crp);
4392 ASSERT(ns != NULL);
4393 ss = ns->netstack_str;
4394 ASSERT(ss != NULL);
4395
4396 if (native_arg == MUXID_ALL)
4397 error = munlinkall(stp, type, crp, rvalp, ss);
4398 else {
4399 mutex_enter(&muxifier);
4400 if (!(linkp = findlinks(stp, (int)arg, type, ss))) {
4401 /* invalid user supplied index number */
4402 mutex_exit(&muxifier);
4403 netstack_rele(ss->ss_netstack);
4404 return (EINVAL);
4405 }
4406 /* munlink drops the muxifier lock */
4407 error = munlink(stp, linkp, type, crp, rvalp, ss);
4408 }
4409 netstack_rele(ss->ss_netstack);
4410 return (error);
4411 }
4412
4413 case I_FLUSH:
4414 /*
4415 * send a flush message downstream
4416 * flush message can indicate
4417 * FLUSHR - flush read queue
4418 * FLUSHW - flush write queue
4419 * FLUSHRW - flush read/write queue
4420 */
4421 if (stp->sd_flag & STRHUP)
4422 return (ENXIO);
4423 if (arg & ~FLUSHRW)
4424 return (EINVAL);
4425
4426 for (;;) {
4427 if (putnextctl1(stp->sd_wrq, M_FLUSH, (int)arg)) {
4428 break;
4429 }
4430 if (error = strwaitbuf(1, BPRI_HI)) {
4431 return (error);
4432 }
4433 }
4434
4435 /*
4436 * Send down an unsupported ioctl and wait for the nack
4437 * in order to allow the M_FLUSH to propagate back
4438 * up to the stream head.
4439 * Replaces if (qready()) runqueues();
4440 */
4441 strioc.ic_cmd = -1; /* The unsupported ioctl */
4442 strioc.ic_timout = 0;
4443 strioc.ic_len = 0;
4444 strioc.ic_dp = NULL;
4445 (void) strdoioctl(stp, &strioc, flag, K_TO_K, crp, rvalp);
4446 *rvalp = 0;
4447 return (0);
4448
4449 case I_FLUSHBAND:
4450 {
4451 struct bandinfo binfo;
4452
4453 error = strcopyin((void *)arg, &binfo, sizeof (binfo),
4454 copyflag);
4455 if (error)
4456 return (error);
4457 if (stp->sd_flag & STRHUP)
4458 return (ENXIO);
4459 if (binfo.bi_flag & ~FLUSHRW)
4460 return (EINVAL);
4461 while (!(mp = allocb(2, BPRI_HI))) {
4462 if (error = strwaitbuf(2, BPRI_HI))
4463 return (error);
4464 }
4465 mp->b_datap->db_type = M_FLUSH;
4466 *mp->b_wptr++ = binfo.bi_flag | FLUSHBAND;
4467 *mp->b_wptr++ = binfo.bi_pri;
4468 putnext(stp->sd_wrq, mp);
4469 /*
4470 * Send down an unsupported ioctl and wait for the nack
4471 * in order to allow the M_FLUSH to propagate back
4472 * up to the stream head.
4473 * Replaces if (qready()) runqueues();
4474 */
4475 strioc.ic_cmd = -1; /* The unsupported ioctl */
4476 strioc.ic_timout = 0;
4477 strioc.ic_len = 0;
4478 strioc.ic_dp = NULL;
4479 (void) strdoioctl(stp, &strioc, flag, K_TO_K, crp, rvalp);
4480 *rvalp = 0;
4481 return (0);
4482 }
4483
4484 case I_SRDOPT:
4485 /*
4486 * Set read options
4487 *
4488 * RNORM - default stream mode
4489 * RMSGN - message no discard
4490 * RMSGD - message discard
4491 * RPROTNORM - fail read with EBADMSG for M_[PC]PROTOs
4492 * RPROTDAT - convert M_[PC]PROTOs to M_DATAs
4493 * RPROTDIS - discard M_[PC]PROTOs and retain M_DATAs
4494 */
4495 if (arg & ~(RMODEMASK | RPROTMASK))
4496 return (EINVAL);
4497
4498 if ((arg & (RMSGD|RMSGN)) == (RMSGD|RMSGN))
4499 return (EINVAL);
4500
4501 mutex_enter(&stp->sd_lock);
4502 switch (arg & RMODEMASK) {
4503 case RNORM:
4504 stp->sd_read_opt &= ~(RD_MSGDIS | RD_MSGNODIS);
4505 break;
4506 case RMSGD:
4507 stp->sd_read_opt = (stp->sd_read_opt & ~RD_MSGNODIS) |
4508 RD_MSGDIS;
4509 break;
4510 case RMSGN:
4511 stp->sd_read_opt = (stp->sd_read_opt & ~RD_MSGDIS) |
4512 RD_MSGNODIS;
4513 break;
4514 }
4515
4516 switch (arg & RPROTMASK) {
4517 case RPROTNORM:
4518 stp->sd_read_opt &= ~(RD_PROTDAT | RD_PROTDIS);
4519 break;
4520
4521 case RPROTDAT:
4522 stp->sd_read_opt = ((stp->sd_read_opt & ~RD_PROTDIS) |
4523 RD_PROTDAT);
4524 break;
4525
4526 case RPROTDIS:
4527 stp->sd_read_opt = ((stp->sd_read_opt & ~RD_PROTDAT) |
4528 RD_PROTDIS);
4529 break;
4530 }
4531 mutex_exit(&stp->sd_lock);
4532 return (0);
4533
4534 case I_GRDOPT:
4535 /*
4536 * Get read option and return the value
4537 * to spot pointed to by arg
4538 */
4539 {
4540 int rdopt;
4541
4542 rdopt = ((stp->sd_read_opt & RD_MSGDIS) ? RMSGD :
4543 ((stp->sd_read_opt & RD_MSGNODIS) ? RMSGN : RNORM));
4544 rdopt |= ((stp->sd_read_opt & RD_PROTDAT) ? RPROTDAT :
4545 ((stp->sd_read_opt & RD_PROTDIS) ? RPROTDIS : RPROTNORM));
4546
4547 return (strcopyout(&rdopt, (void *)arg, sizeof (int),
4548 copyflag));
4549 }
4550
4551 case I_SERROPT:
4552 /*
4553 * Set error options
4554 *
4555 * RERRNORM - persistent read errors
4556 * RERRNONPERSIST - non-persistent read errors
4557 * WERRNORM - persistent write errors
4558 * WERRNONPERSIST - non-persistent write errors
4559 */
4560 if (arg & ~(RERRMASK | WERRMASK))
4561 return (EINVAL);
4562
4563 mutex_enter(&stp->sd_lock);
4564 switch (arg & RERRMASK) {
4565 case RERRNORM:
4566 stp->sd_flag &= ~STRDERRNONPERSIST;
4567 break;
4568 case RERRNONPERSIST:
4569 stp->sd_flag |= STRDERRNONPERSIST;
4570 break;
4571 }
4572 switch (arg & WERRMASK) {
4573 case WERRNORM:
4574 stp->sd_flag &= ~STWRERRNONPERSIST;
4575 break;
4576 case WERRNONPERSIST:
4577 stp->sd_flag |= STWRERRNONPERSIST;
4578 break;
4579 }
4580 mutex_exit(&stp->sd_lock);
4581 return (0);
4582
4583 case I_GERROPT:
4584 /*
4585 * Get error option and return the value
4586 * to spot pointed to by arg
4587 */
4588 {
4589 int erropt = 0;
4590
4591 erropt |= (stp->sd_flag & STRDERRNONPERSIST) ? RERRNONPERSIST :
4592 RERRNORM;
4593 erropt |= (stp->sd_flag & STWRERRNONPERSIST) ? WERRNONPERSIST :
4594 WERRNORM;
4595 return (strcopyout(&erropt, (void *)arg, sizeof (int),
4596 copyflag));
4597 }
4598
4599 case I_SETSIG:
4600 /*
4601 * Register the calling proc to receive the SIGPOLL
4602 * signal based on the events given in arg. If
4603 * arg is zero, remove the proc from register list.
4604 */
4605 {
4606 strsig_t *ssp, *pssp;
4607 struct pid *pidp;
4608
4609 pssp = NULL;
4610 pidp = curproc->p_pidp;
4611 /*
4612 * Hold sd_lock to prevent traversal of sd_siglist while
4613 * it is modified.
4614 */
4615 mutex_enter(&stp->sd_lock);
4616 for (ssp = stp->sd_siglist; ssp && (ssp->ss_pidp != pidp);
4617 pssp = ssp, ssp = ssp->ss_next)
4618 ;
4619
4620 if (arg) {
4621 if (arg & ~(S_INPUT|S_HIPRI|S_MSG|S_HANGUP|S_ERROR|
4622 S_RDNORM|S_WRNORM|S_RDBAND|S_WRBAND|S_BANDURG)) {
4623 mutex_exit(&stp->sd_lock);
4624 return (EINVAL);
4625 }
4626 if ((arg & S_BANDURG) && !(arg & S_RDBAND)) {
4627 mutex_exit(&stp->sd_lock);
4628 return (EINVAL);
4629 }
4630
4631 /*
4632 * If proc not already registered, add it
4633 * to list.
4634 */
4635 if (!ssp) {
4636 ssp = kmem_alloc(sizeof (strsig_t), KM_SLEEP);
4637 ssp->ss_pidp = pidp;
4638 ssp->ss_pid = pidp->pid_id;
4639 ssp->ss_next = NULL;
4640 if (pssp)
4641 pssp->ss_next = ssp;
4642 else
4643 stp->sd_siglist = ssp;
4644 mutex_enter(&pidlock);
4645 PID_HOLD(pidp);
4646 mutex_exit(&pidlock);
4647 }
4648
4649 /*
4650 * Set events.
4651 */
4652 ssp->ss_events = (int)arg;
4653 } else {
4654 /*
4655 * Remove proc from register list.
4656 */
4657 if (ssp) {
4658 mutex_enter(&pidlock);
4659 PID_RELE(pidp);
4660 mutex_exit(&pidlock);
4661 if (pssp)
4662 pssp->ss_next = ssp->ss_next;
4663 else
4664 stp->sd_siglist = ssp->ss_next;
4665 kmem_free(ssp, sizeof (strsig_t));
4666 } else {
4667 mutex_exit(&stp->sd_lock);
4668 return (EINVAL);
4669 }
4670 }
4671
4672 /*
4673 * Recalculate OR of sig events.
4674 */
4675 stp->sd_sigflags = 0;
4676 for (ssp = stp->sd_siglist; ssp; ssp = ssp->ss_next)
4677 stp->sd_sigflags |= ssp->ss_events;
4678 mutex_exit(&stp->sd_lock);
4679 return (0);
4680 }
4681
4682 case I_GETSIG:
4683 /*
4684 * Return (in arg) the current registration of events
4685 * for which the calling proc is to be signaled.
4686 */
4687 {
4688 struct strsig *ssp;
4689 struct pid *pidp;
4690
4691 pidp = curproc->p_pidp;
4692 mutex_enter(&stp->sd_lock);
4693 for (ssp = stp->sd_siglist; ssp; ssp = ssp->ss_next)
4694 if (ssp->ss_pidp == pidp) {
4695 error = strcopyout(&ssp->ss_events, (void *)arg,
4696 sizeof (int), copyflag);
4697 mutex_exit(&stp->sd_lock);
4698 return (error);
4699 }
4700 mutex_exit(&stp->sd_lock);
4701 return (EINVAL);
4702 }
4703
4704 case I_ESETSIG:
4705 /*
4706 * Register the ss_pid to receive the SIGPOLL
4707 * signal based on the events is ss_events arg. If
4708 * ss_events is zero, remove the proc from register list.
4709 */
4710 {
4711 struct strsig *ssp, *pssp;
4712 struct proc *proc;
4713 struct pid *pidp;
4714 pid_t pid;
4715 struct strsigset ss;
4716
4717 error = strcopyin((void *)arg, &ss, sizeof (ss), copyflag);
4718 if (error)
4719 return (error);
4720
4721 pid = ss.ss_pid;
4722
4723 if (ss.ss_events != 0) {
4724 /*
4725 * Permissions check by sending signal 0.
4726 * Note that when kill fails it does a set_errno
4727 * causing the system call to fail.
4728 */
4729 error = kill(pid, 0);
4730 if (error) {
4731 return (error);
4732 }
4733 }
4734 mutex_enter(&pidlock);
4735 if (pid == 0)
4736 proc = curproc;
4737 else if (pid < 0)
4738 proc = pgfind(-pid);
4739 else
4740 proc = prfind(pid);
4741 if (proc == NULL) {
4742 mutex_exit(&pidlock);
4743 return (ESRCH);
4744 }
4745 if (pid < 0)
4746 pidp = proc->p_pgidp;
4747 else
4748 pidp = proc->p_pidp;
4749 ASSERT(pidp);
4750 /*
4751 * Get a hold on the pid structure while referencing it.
4752 * There is a separate PID_HOLD should it be inserted
4753 * in the list below.
4754 */
4755 PID_HOLD(pidp);
4756 mutex_exit(&pidlock);
4757
4758 pssp = NULL;
4759 /*
4760 * Hold sd_lock to prevent traversal of sd_siglist while
4761 * it is modified.
4762 */
4763 mutex_enter(&stp->sd_lock);
4764 for (ssp = stp->sd_siglist; ssp && (ssp->ss_pid != pid);
4765 pssp = ssp, ssp = ssp->ss_next)
4766 ;
4767
4768 if (ss.ss_events) {
4769 if (ss.ss_events &
4770 ~(S_INPUT|S_HIPRI|S_MSG|S_HANGUP|S_ERROR|
4771 S_RDNORM|S_WRNORM|S_RDBAND|S_WRBAND|S_BANDURG)) {
4772 mutex_exit(&stp->sd_lock);
4773 mutex_enter(&pidlock);
4774 PID_RELE(pidp);
4775 mutex_exit(&pidlock);
4776 return (EINVAL);
4777 }
4778 if ((ss.ss_events & S_BANDURG) &&
4779 !(ss.ss_events & S_RDBAND)) {
4780 mutex_exit(&stp->sd_lock);
4781 mutex_enter(&pidlock);
4782 PID_RELE(pidp);
4783 mutex_exit(&pidlock);
4784 return (EINVAL);
4785 }
4786
4787 /*
4788 * If proc not already registered, add it
4789 * to list.
4790 */
4791 if (!ssp) {
4792 ssp = kmem_alloc(sizeof (strsig_t), KM_SLEEP);
4793 ssp->ss_pidp = pidp;
4794 ssp->ss_pid = pid;
4795 ssp->ss_next = NULL;
4796 if (pssp)
4797 pssp->ss_next = ssp;
4798 else
4799 stp->sd_siglist = ssp;
4800 mutex_enter(&pidlock);
4801 PID_HOLD(pidp);
4802 mutex_exit(&pidlock);
4803 }
4804
4805 /*
4806 * Set events.
4807 */
4808 ssp->ss_events = ss.ss_events;
4809 } else {
4810 /*
4811 * Remove proc from register list.
4812 */
4813 if (ssp) {
4814 mutex_enter(&pidlock);
4815 PID_RELE(pidp);
4816 mutex_exit(&pidlock);
4817 if (pssp)
4818 pssp->ss_next = ssp->ss_next;
4819 else
4820 stp->sd_siglist = ssp->ss_next;
4821 kmem_free(ssp, sizeof (strsig_t));
4822 } else {
4823 mutex_exit(&stp->sd_lock);
4824 mutex_enter(&pidlock);
4825 PID_RELE(pidp);
4826 mutex_exit(&pidlock);
4827 return (EINVAL);
4828 }
4829 }
4830
4831 /*
4832 * Recalculate OR of sig events.
4833 */
4834 stp->sd_sigflags = 0;
4835 for (ssp = stp->sd_siglist; ssp; ssp = ssp->ss_next)
4836 stp->sd_sigflags |= ssp->ss_events;
4837 mutex_exit(&stp->sd_lock);
4838 mutex_enter(&pidlock);
4839 PID_RELE(pidp);
4840 mutex_exit(&pidlock);
4841 return (0);
4842 }
4843
4844 case I_EGETSIG:
4845 /*
4846 * Return (in arg) the current registration of events
4847 * for which the calling proc is to be signaled.
4848 */
4849 {
4850 struct strsig *ssp;
4851 struct proc *proc;
4852 pid_t pid;
4853 struct pid *pidp;
4854 struct strsigset ss;
4855
4856 error = strcopyin((void *)arg, &ss, sizeof (ss), copyflag);
4857 if (error)
4858 return (error);
4859
4860 pid = ss.ss_pid;
4861 mutex_enter(&pidlock);
4862 if (pid == 0)
4863 proc = curproc;
4864 else if (pid < 0)
4865 proc = pgfind(-pid);
4866 else
4867 proc = prfind(pid);
4868 if (proc == NULL) {
4869 mutex_exit(&pidlock);
4870 return (ESRCH);
4871 }
4872 if (pid < 0)
4873 pidp = proc->p_pgidp;
4874 else
4875 pidp = proc->p_pidp;
4876
4877 /* Prevent the pidp from being reassigned */
4878 PID_HOLD(pidp);
4879 mutex_exit(&pidlock);
4880
4881 mutex_enter(&stp->sd_lock);
4882 for (ssp = stp->sd_siglist; ssp; ssp = ssp->ss_next)
4883 if (ssp->ss_pid == pid) {
4884 ss.ss_pid = ssp->ss_pid;
4885 ss.ss_events = ssp->ss_events;
4886 error = strcopyout(&ss, (void *)arg,
4887 sizeof (struct strsigset), copyflag);
4888 mutex_exit(&stp->sd_lock);
4889 mutex_enter(&pidlock);
4890 PID_RELE(pidp);
4891 mutex_exit(&pidlock);
4892 return (error);
4893 }
4894 mutex_exit(&stp->sd_lock);
4895 mutex_enter(&pidlock);
4896 PID_RELE(pidp);
4897 mutex_exit(&pidlock);
4898 return (EINVAL);
4899 }
4900
4901 case I_PEEK:
4902 {
4903 STRUCT_DECL(strpeek, strpeek);
4904 size_t n;
4905 mblk_t *fmp, *tmp_mp = NULL;
4906
4907 STRUCT_INIT(strpeek, flag);
4908
4909 error = strcopyin((void *)arg, STRUCT_BUF(strpeek),
4910 STRUCT_SIZE(strpeek), copyflag);
4911 if (error)
4912 return (error);
4913
4914 mutex_enter(QLOCK(rdq));
4915 /*
4916 * Skip the invalid messages
4917 */
4918 for (mp = rdq->q_first; mp != NULL; mp = mp->b_next)
4919 if (mp->b_datap->db_type != M_SIG)
4920 break;
4921
4922 /*
4923 * If user has requested to peek at a high priority message
4924 * and first message is not, return 0
4925 */
4926 if (mp != NULL) {
4927 if ((STRUCT_FGET(strpeek, flags) & RS_HIPRI) &&
4928 queclass(mp) == QNORM) {
4929 *rvalp = 0;
4930 mutex_exit(QLOCK(rdq));
4931 return (0);
4932 }
4933 } else if (stp->sd_struiordq == NULL ||
4934 (STRUCT_FGET(strpeek, flags) & RS_HIPRI)) {
4935 /*
4936 * No mblks to look at at the streamhead and
4937 * 1). This isn't a synch stream or
4938 * 2). This is a synch stream but caller wants high
4939 * priority messages which is not supported by
4940 * the synch stream. (it only supports QNORM)
4941 */
4942 *rvalp = 0;
4943 mutex_exit(QLOCK(rdq));
4944 return (0);
4945 }
4946
4947 fmp = mp;
4948
4949 if (mp && mp->b_datap->db_type == M_PASSFP) {
4950 mutex_exit(QLOCK(rdq));
4951 return (EBADMSG);
4952 }
4953
4954 ASSERT(mp == NULL || mp->b_datap->db_type == M_PCPROTO ||
4955 mp->b_datap->db_type == M_PROTO ||
4956 mp->b_datap->db_type == M_DATA);
4957
4958 if (mp && mp->b_datap->db_type == M_PCPROTO) {
4959 STRUCT_FSET(strpeek, flags, RS_HIPRI);
4960 } else {
4961 STRUCT_FSET(strpeek, flags, 0);
4962 }
4963
4964
4965 if (mp && ((tmp_mp = dupmsg(mp)) == NULL)) {
4966 mutex_exit(QLOCK(rdq));
4967 return (ENOSR);
4968 }
4969 mutex_exit(QLOCK(rdq));
4970
4971 /*
4972 * set mp = tmp_mp, so that I_PEEK processing can continue.
4973 * tmp_mp is used to free the dup'd message.
4974 */
4975 mp = tmp_mp;
4976
4977 uio.uio_fmode = 0;
4978 uio.uio_extflg = UIO_COPY_CACHED;
4979 uio.uio_segflg = (copyflag == U_TO_K) ? UIO_USERSPACE :
4980 UIO_SYSSPACE;
4981 uio.uio_limit = 0;
4982 /*
4983 * First process PROTO blocks, if any.
4984 * If user doesn't want to get ctl info by setting maxlen <= 0,
4985 * then set len to -1/0 and skip control blocks part.
4986 */
4987 if (STRUCT_FGET(strpeek, ctlbuf.maxlen) < 0)
4988 STRUCT_FSET(strpeek, ctlbuf.len, -1);
4989 else if (STRUCT_FGET(strpeek, ctlbuf.maxlen) == 0)
4990 STRUCT_FSET(strpeek, ctlbuf.len, 0);
4991 else {
4992 int ctl_part = 0;
4993
4994 iov.iov_base = STRUCT_FGETP(strpeek, ctlbuf.buf);
4995 iov.iov_len = STRUCT_FGET(strpeek, ctlbuf.maxlen);
4996 uio.uio_iov = &iov;
4997 uio.uio_resid = iov.iov_len;
4998 uio.uio_loffset = 0;
4999 uio.uio_iovcnt = 1;
5000 while (mp && mp->b_datap->db_type != M_DATA &&
5001 uio.uio_resid >= 0) {
5002 ASSERT(STRUCT_FGET(strpeek, flags) == 0 ?
5003 mp->b_datap->db_type == M_PROTO :
5004 mp->b_datap->db_type == M_PCPROTO);
5005
5006 if ((n = MIN(uio.uio_resid,
5007 mp->b_wptr - mp->b_rptr)) != 0 &&
5008 (error = uiomove((char *)mp->b_rptr, n,
5009 UIO_READ, &uio)) != 0) {
5010 freemsg(tmp_mp);
5011 return (error);
5012 }
5013 ctl_part = 1;
5014 mp = mp->b_cont;
5015 }
5016 /* No ctl message */
5017 if (ctl_part == 0)
5018 STRUCT_FSET(strpeek, ctlbuf.len, -1);
5019 else
5020 STRUCT_FSET(strpeek, ctlbuf.len,
5021 STRUCT_FGET(strpeek, ctlbuf.maxlen) -
5022 uio.uio_resid);
5023 }
5024
5025 /*
5026 * Now process DATA blocks, if any.
5027 * If user doesn't want to get data info by setting maxlen <= 0,
5028 * then set len to -1/0 and skip data blocks part.
5029 */
5030 if (STRUCT_FGET(strpeek, databuf.maxlen) < 0)
5031 STRUCT_FSET(strpeek, databuf.len, -1);
5032 else if (STRUCT_FGET(strpeek, databuf.maxlen) == 0)
5033 STRUCT_FSET(strpeek, databuf.len, 0);
5034 else {
5035 int data_part = 0;
5036
5037 iov.iov_base = STRUCT_FGETP(strpeek, databuf.buf);
5038 iov.iov_len = STRUCT_FGET(strpeek, databuf.maxlen);
5039 uio.uio_iov = &iov;
5040 uio.uio_resid = iov.iov_len;
5041 uio.uio_loffset = 0;
5042 uio.uio_iovcnt = 1;
5043 while (mp && uio.uio_resid) {
5044 if (mp->b_datap->db_type == M_DATA) {
5045 if ((n = MIN(uio.uio_resid,
5046 mp->b_wptr - mp->b_rptr)) != 0 &&
5047 (error = uiomove((char *)mp->b_rptr,
5048 n, UIO_READ, &uio)) != 0) {
5049 freemsg(tmp_mp);
5050 return (error);
5051 }
5052 data_part = 1;
5053 }
5054 ASSERT(data_part == 0 ||
5055 mp->b_datap->db_type == M_DATA);
5056 mp = mp->b_cont;
5057 }
5058 /* No data message */
5059 if (data_part == 0)
5060 STRUCT_FSET(strpeek, databuf.len, -1);
5061 else
5062 STRUCT_FSET(strpeek, databuf.len,
5063 STRUCT_FGET(strpeek, databuf.maxlen) -
5064 uio.uio_resid);
5065 }
5066 freemsg(tmp_mp);
5067
5068 /*
5069 * It is a synch stream and user wants to get
5070 * data (maxlen > 0).
5071 * uio setup is done by the codes that process DATA
5072 * blocks above.
5073 */
5074 if ((fmp == NULL) && STRUCT_FGET(strpeek, databuf.maxlen) > 0) {
5075 infod_t infod;
5076
5077 infod.d_cmd = INFOD_COPYOUT;
5078 infod.d_res = 0;
5079 infod.d_uiop = &uio;
5080 error = infonext(rdq, &infod);
5081 if (error == EINVAL || error == EBUSY)
5082 error = 0;
5083 if (error)
5084 return (error);
5085 STRUCT_FSET(strpeek, databuf.len, STRUCT_FGET(strpeek,
5086 databuf.maxlen) - uio.uio_resid);
5087 if (STRUCT_FGET(strpeek, databuf.len) == 0) {
5088 /*
5089 * No data found by the infonext().
5090 */
5091 STRUCT_FSET(strpeek, databuf.len, -1);
5092 }
5093 }
5094 error = strcopyout(STRUCT_BUF(strpeek), (void *)arg,
5095 STRUCT_SIZE(strpeek), copyflag);
5096 if (error) {
5097 return (error);
5098 }
5099 /*
5100 * If there is no message retrieved, set return code to 0
5101 * otherwise, set it to 1.
5102 */
5103 if (STRUCT_FGET(strpeek, ctlbuf.len) == -1 &&
5104 STRUCT_FGET(strpeek, databuf.len) == -1)
5105 *rvalp = 0;
5106 else
5107 *rvalp = 1;
5108 return (0);
5109 }
5110
5111 case I_FDINSERT:
5112 {
5113 STRUCT_DECL(strfdinsert, strfdinsert);
5114 struct file *resftp;
5115 struct stdata *resstp;
5116 t_uscalar_t ival;
5117 ssize_t msgsize;
5118 struct strbuf mctl;
5119
5120 STRUCT_INIT(strfdinsert, flag);
5121 if (stp->sd_flag & STRHUP)
5122 return (ENXIO);
5123 /*
5124 * STRDERR, STWRERR and STPLEX tested above.
5125 */
5126 error = strcopyin((void *)arg, STRUCT_BUF(strfdinsert),
5127 STRUCT_SIZE(strfdinsert), copyflag);
5128 if (error)
5129 return (error);
5130
5131 if (STRUCT_FGET(strfdinsert, offset) < 0 ||
5132 (STRUCT_FGET(strfdinsert, offset) %
5133 sizeof (t_uscalar_t)) != 0)
5134 return (EINVAL);
5135 if ((resftp = getf(STRUCT_FGET(strfdinsert, fildes))) != NULL) {
5136 if ((resstp = resftp->f_vnode->v_stream) == NULL) {
5137 releasef(STRUCT_FGET(strfdinsert, fildes));
5138 return (EINVAL);
5139 }
5140 } else
5141 return (EINVAL);
5142
5143 mutex_enter(&resstp->sd_lock);
5144 if (resstp->sd_flag & (STRDERR|STWRERR|STRHUP|STPLEX)) {
5145 error = strgeterr(resstp,
5146 STRDERR|STWRERR|STRHUP|STPLEX, 0);
5147 if (error != 0) {
5148 mutex_exit(&resstp->sd_lock);
5149 releasef(STRUCT_FGET(strfdinsert, fildes));
5150 return (error);
5151 }
5152 }
5153 mutex_exit(&resstp->sd_lock);
5154
5155 #ifdef _ILP32
5156 {
5157 queue_t *q;
5158 queue_t *mate = NULL;
5159
5160 /* get read queue of stream terminus */
5161 claimstr(resstp->sd_wrq);
5162 for (q = resstp->sd_wrq->q_next; q->q_next != NULL;
5163 q = q->q_next)
5164 if (!STRMATED(resstp) && STREAM(q) != resstp &&
5165 mate == NULL) {
5166 ASSERT(q->q_qinfo->qi_srvp);
5167 ASSERT(_OTHERQ(q)->q_qinfo->qi_srvp);
5168 claimstr(q);
5169 mate = q;
5170 }
5171 q = _RD(q);
5172 if (mate)
5173 releasestr(mate);
5174 releasestr(resstp->sd_wrq);
5175 ival = (t_uscalar_t)q;
5176 }
5177 #else
5178 ival = (t_uscalar_t)getminor(resftp->f_vnode->v_rdev);
5179 #endif /* _ILP32 */
5180
5181 if (STRUCT_FGET(strfdinsert, ctlbuf.len) <
5182 STRUCT_FGET(strfdinsert, offset) + sizeof (t_uscalar_t)) {
5183 releasef(STRUCT_FGET(strfdinsert, fildes));
5184 return (EINVAL);
5185 }
5186
5187 /*
5188 * Check for legal flag value.
5189 */
5190 if (STRUCT_FGET(strfdinsert, flags) & ~RS_HIPRI) {
5191 releasef(STRUCT_FGET(strfdinsert, fildes));
5192 return (EINVAL);
5193 }
5194
5195 /* get these values from those cached in the stream head */
5196 mutex_enter(QLOCK(stp->sd_wrq));
5197 rmin = stp->sd_qn_minpsz;
5198 rmax = stp->sd_qn_maxpsz;
5199 mutex_exit(QLOCK(stp->sd_wrq));
5200
5201 /*
5202 * Make sure ctl and data sizes together fall within
5203 * the limits of the max and min receive packet sizes
5204 * and do not exceed system limit. A negative data
5205 * length means that no data part is to be sent.
5206 */
5207 ASSERT((rmax >= 0) || (rmax == INFPSZ));
5208 if (rmax == 0) {
5209 releasef(STRUCT_FGET(strfdinsert, fildes));
5210 return (ERANGE);
5211 }
5212 if ((msgsize = STRUCT_FGET(strfdinsert, databuf.len)) < 0)
5213 msgsize = 0;
5214 if ((msgsize < rmin) ||
5215 ((msgsize > rmax) && (rmax != INFPSZ)) ||
5216 (STRUCT_FGET(strfdinsert, ctlbuf.len) > strctlsz)) {
5217 releasef(STRUCT_FGET(strfdinsert, fildes));
5218 return (ERANGE);
5219 }
5220
5221 mutex_enter(&stp->sd_lock);
5222 while (!(STRUCT_FGET(strfdinsert, flags) & RS_HIPRI) &&
5223 !canputnext(stp->sd_wrq)) {
5224 if ((error = strwaitq(stp, WRITEWAIT, (ssize_t)0,
5225 flag, -1, &done)) != 0 || done) {
5226 mutex_exit(&stp->sd_lock);
5227 releasef(STRUCT_FGET(strfdinsert, fildes));
5228 return (error);
5229 }
5230 if ((error = i_straccess(stp, access)) != 0) {
5231 mutex_exit(&stp->sd_lock);
5232 releasef(
5233 STRUCT_FGET(strfdinsert, fildes));
5234 return (error);
5235 }
5236 }
5237 mutex_exit(&stp->sd_lock);
5238
5239 /*
5240 * Copy strfdinsert.ctlbuf into native form of
5241 * ctlbuf to pass down into strmakemsg().
5242 */
5243 mctl.maxlen = STRUCT_FGET(strfdinsert, ctlbuf.maxlen);
5244 mctl.len = STRUCT_FGET(strfdinsert, ctlbuf.len);
5245 mctl.buf = STRUCT_FGETP(strfdinsert, ctlbuf.buf);
5246
5247 iov.iov_base = STRUCT_FGETP(strfdinsert, databuf.buf);
5248 iov.iov_len = STRUCT_FGET(strfdinsert, databuf.len);
5249 uio.uio_iov = &iov;
5250 uio.uio_iovcnt = 1;
5251 uio.uio_loffset = 0;
5252 uio.uio_segflg = (copyflag == U_TO_K) ? UIO_USERSPACE :
5253 UIO_SYSSPACE;
5254 uio.uio_fmode = 0;
5255 uio.uio_extflg = UIO_COPY_CACHED;
5256 uio.uio_resid = iov.iov_len;
5257 if ((error = strmakemsg(&mctl,
5258 &msgsize, &uio, stp,
5259 STRUCT_FGET(strfdinsert, flags), &mp)) != 0 || !mp) {
5260 STRUCT_FSET(strfdinsert, databuf.len, msgsize);
5261 releasef(STRUCT_FGET(strfdinsert, fildes));
5262 return (error);
5263 }
5264
5265 STRUCT_FSET(strfdinsert, databuf.len, msgsize);
5266
5267 /*
5268 * Place the possibly reencoded queue pointer 'offset' bytes
5269 * from the start of the control portion of the message.
5270 */
5271 *((t_uscalar_t *)(mp->b_rptr +
5272 STRUCT_FGET(strfdinsert, offset))) = ival;
5273
5274 /*
5275 * Put message downstream.
5276 */
5277 stream_willservice(stp);
5278 putnext(stp->sd_wrq, mp);
5279 stream_runservice(stp);
5280 releasef(STRUCT_FGET(strfdinsert, fildes));
5281 return (error);
5282 }
5283
5284 case I_SENDFD:
5285 {
5286 struct file *fp;
5287
5288 if ((fp = getf((int)arg)) == NULL)
5289 return (EBADF);
5290 error = do_sendfp(stp, fp, crp);
5291 if (auditing) {
5292 audit_fdsend((int)arg, fp, error);
5293 }
5294 releasef((int)arg);
5295 return (error);
5296 }
5297
5298 case I_RECVFD:
5299 case I_E_RECVFD:
5300 {
5301 struct k_strrecvfd *srf;
5302 int i, fd;
5303
5304 mutex_enter(&stp->sd_lock);
5305 while (!(mp = getq(rdq))) {
5306 if (stp->sd_flag & (STRHUP|STREOF)) {
5307 mutex_exit(&stp->sd_lock);
5308 return (ENXIO);
5309 }
5310 if ((error = strwaitq(stp, GETWAIT, (ssize_t)0,
5311 flag, -1, &done)) != 0 || done) {
5312 mutex_exit(&stp->sd_lock);
5313 return (error);
5314 }
5315 if ((error = i_straccess(stp, access)) != 0) {
5316 mutex_exit(&stp->sd_lock);
5317 return (error);
5318 }
5319 }
5320 if (mp->b_datap->db_type != M_PASSFP) {
5321 putback(stp, rdq, mp, mp->b_band);
5322 mutex_exit(&stp->sd_lock);
5323 return (EBADMSG);
5324 }
5325 mutex_exit(&stp->sd_lock);
5326
5327 srf = (struct k_strrecvfd *)mp->b_rptr;
5328 if ((fd = ufalloc(0)) == -1) {
5329 mutex_enter(&stp->sd_lock);
5330 putback(stp, rdq, mp, mp->b_band);
5331 mutex_exit(&stp->sd_lock);
5332 return (EMFILE);
5333 }
5334 if (cmd == I_RECVFD) {
5335 struct o_strrecvfd ostrfd;
5336
5337 /* check to see if uid/gid values are too large. */
5338
5339 if (srf->uid > (o_uid_t)USHRT_MAX ||
5340 srf->gid > (o_gid_t)USHRT_MAX) {
5341 mutex_enter(&stp->sd_lock);
5342 putback(stp, rdq, mp, mp->b_band);
5343 mutex_exit(&stp->sd_lock);
5344 setf(fd, NULL); /* release fd entry */
5345 return (EOVERFLOW);
5346 }
5347
5348 ostrfd.fd = fd;
5349 ostrfd.uid = (o_uid_t)srf->uid;
5350 ostrfd.gid = (o_gid_t)srf->gid;
5351
5352 /* Null the filler bits */
5353 for (i = 0; i < 8; i++)
5354 ostrfd.fill[i] = 0;
5355
5356 error = strcopyout(&ostrfd, (void *)arg,
5357 sizeof (struct o_strrecvfd), copyflag);
5358 } else { /* I_E_RECVFD */
5359 struct strrecvfd strfd;
5360
5361 strfd.fd = fd;
5362 strfd.uid = srf->uid;
5363 strfd.gid = srf->gid;
5364
5365 /* null the filler bits */
5366 for (i = 0; i < 8; i++)
5367 strfd.fill[i] = 0;
5368
5369 error = strcopyout(&strfd, (void *)arg,
5370 sizeof (struct strrecvfd), copyflag);
5371 }
5372
5373 if (error) {
5374 setf(fd, NULL); /* release fd entry */
5375 mutex_enter(&stp->sd_lock);
5376 putback(stp, rdq, mp, mp->b_band);
5377 mutex_exit(&stp->sd_lock);
5378 return (error);
5379 }
5380 if (auditing) {
5381 audit_fdrecv(fd, srf->fp);
5382 }
5383
5384 /*
5385 * Always increment f_count since the freemsg() below will
5386 * always call free_passfp() which performs a closef().
5387 */
5388 mutex_enter(&srf->fp->f_tlock);
5389 srf->fp->f_count++;
5390 mutex_exit(&srf->fp->f_tlock);
5391 setf(fd, srf->fp);
5392 freemsg(mp);
5393 return (0);
5394 }
5395
5396 case I_SWROPT:
5397 /*
5398 * Set/clear the write options. arg is a bit
5399 * mask with any of the following bits set...
5400 * SNDZERO - send zero length message
5401 * SNDPIPE - send sigpipe to process if
5402 * sd_werror is set and process is
5403 * doing a write or putmsg.
5404 * The new stream head write options should reflect
5405 * what is in arg.
5406 */
5407 if (arg & ~(SNDZERO|SNDPIPE))
5408 return (EINVAL);
5409
5410 mutex_enter(&stp->sd_lock);
5411 stp->sd_wput_opt &= ~(SW_SIGPIPE|SW_SNDZERO);
5412 if (arg & SNDZERO)
5413 stp->sd_wput_opt |= SW_SNDZERO;
5414 if (arg & SNDPIPE)
5415 stp->sd_wput_opt |= SW_SIGPIPE;
5416 mutex_exit(&stp->sd_lock);
5417 return (0);
5418
5419 case I_GWROPT:
5420 {
5421 int wropt = 0;
5422
5423 if (stp->sd_wput_opt & SW_SNDZERO)
5424 wropt |= SNDZERO;
5425 if (stp->sd_wput_opt & SW_SIGPIPE)
5426 wropt |= SNDPIPE;
5427 return (strcopyout(&wropt, (void *)arg, sizeof (wropt),
5428 copyflag));
5429 }
5430
5431 case I_LIST:
5432 /*
5433 * Returns all the modules found on this stream,
5434 * upto the driver. If argument is NULL, return the
5435 * number of modules (including driver). If argument
5436 * is not NULL, copy the names into the structure
5437 * provided.
5438 */
5439
5440 {
5441 queue_t *q;
5442 char *qname;
5443 int i, nmods;
5444 struct str_mlist *mlist;
5445 STRUCT_DECL(str_list, strlist);
5446
5447 if (arg == NULL) { /* Return number of modules plus driver */
5448 if (stp->sd_vnode->v_type == VFIFO)
5449 *rvalp = stp->sd_pushcnt;
5450 else
5451 *rvalp = stp->sd_pushcnt + 1;
5452 return (0);
5453 }
5454
5455 STRUCT_INIT(strlist, flag);
5456
5457 error = strcopyin((void *)arg, STRUCT_BUF(strlist),
5458 STRUCT_SIZE(strlist), copyflag);
5459 if (error != 0)
5460 return (error);
5461
5462 mlist = STRUCT_FGETP(strlist, sl_modlist);
5463 nmods = STRUCT_FGET(strlist, sl_nmods);
5464 if (nmods <= 0)
5465 return (EINVAL);
5466
5467 claimstr(stp->sd_wrq);
5468 q = stp->sd_wrq;
5469 for (i = 0; i < nmods && _SAMESTR(q); i++, q = q->q_next) {
5470 qname = Q2NAME(q->q_next);
5471 error = strcopyout(qname, &mlist[i], strlen(qname) + 1,
5472 copyflag);
5473 if (error != 0) {
5474 releasestr(stp->sd_wrq);
5475 return (error);
5476 }
5477 }
5478 releasestr(stp->sd_wrq);
5479 return (strcopyout(&i, (void *)arg, sizeof (int), copyflag));
5480 }
5481
5482 case I_CKBAND:
5483 {
5484 queue_t *q;
5485 qband_t *qbp;
5486
5487 if ((arg < 0) || (arg >= NBAND))
5488 return (EINVAL);
5489 q = _RD(stp->sd_wrq);
5490 mutex_enter(QLOCK(q));
5491 if (arg > (int)q->q_nband) {
5492 *rvalp = 0;
5493 } else {
5494 if (arg == 0) {
5495 if (q->q_first)
5496 *rvalp = 1;
5497 else
5498 *rvalp = 0;
5499 } else {
5500 qbp = q->q_bandp;
5501 while (--arg > 0)
5502 qbp = qbp->qb_next;
5503 if (qbp->qb_first)
5504 *rvalp = 1;
5505 else
5506 *rvalp = 0;
5507 }
5508 }
5509 mutex_exit(QLOCK(q));
5510 return (0);
5511 }
5512
5513 case I_GETBAND:
5514 {
5515 int intpri;
5516 queue_t *q;
5517
5518 q = _RD(stp->sd_wrq);
5519 mutex_enter(QLOCK(q));
5520 mp = q->q_first;
5521 if (!mp) {
5522 mutex_exit(QLOCK(q));
5523 return (ENODATA);
5524 }
5525 intpri = (int)mp->b_band;
5526 error = strcopyout(&intpri, (void *)arg, sizeof (int),
5527 copyflag);
5528 mutex_exit(QLOCK(q));
5529 return (error);
5530 }
5531
5532 case I_ATMARK:
5533 {
5534 queue_t *q;
5535
5536 if (arg & ~(ANYMARK|LASTMARK))
5537 return (EINVAL);
5538 q = _RD(stp->sd_wrq);
5539 mutex_enter(&stp->sd_lock);
5540 if ((stp->sd_flag & STRATMARK) && (arg == ANYMARK)) {
5541 *rvalp = 1;
5542 } else {
5543 mutex_enter(QLOCK(q));
5544 mp = q->q_first;
5545
5546 if (mp == NULL)
5547 *rvalp = 0;
5548 else if ((arg == ANYMARK) && (mp->b_flag & MSGMARK))
5549 *rvalp = 1;
5550 else if ((arg == LASTMARK) && (mp == stp->sd_mark))
5551 *rvalp = 1;
5552 else
5553 *rvalp = 0;
5554 mutex_exit(QLOCK(q));
5555 }
5556 mutex_exit(&stp->sd_lock);
5557 return (0);
5558 }
5559
5560 case I_CANPUT:
5561 {
5562 char band;
5563
5564 if ((arg < 0) || (arg >= NBAND))
5565 return (EINVAL);
5566 band = (char)arg;
5567 *rvalp = bcanputnext(stp->sd_wrq, band);
5568 return (0);
5569 }
5570
5571 case I_SETCLTIME:
5572 {
5573 int closetime;
5574
5575 error = strcopyin((void *)arg, &closetime, sizeof (int),
5576 copyflag);
5577 if (error)
5578 return (error);
5579 if (closetime < 0)
5580 return (EINVAL);
5581
5582 stp->sd_closetime = closetime;
5583 return (0);
5584 }
5585
5586 case I_GETCLTIME:
5587 {
5588 int closetime;
5589
5590 closetime = stp->sd_closetime;
5591 return (strcopyout(&closetime, (void *)arg, sizeof (int),
5592 copyflag));
5593 }
5594
5595 case TIOCGSID:
5596 {
5597 pid_t sid;
5598
5599 mutex_enter(&stp->sd_lock);
5600 if (stp->sd_sidp == NULL) {
5601 mutex_exit(&stp->sd_lock);
5602 return (ENOTTY);
5603 }
5604 sid = stp->sd_sidp->pid_id;
5605 mutex_exit(&stp->sd_lock);
5606 return (strcopyout(&sid, (void *)arg, sizeof (pid_t),
5607 copyflag));
5608 }
5609
5610 case TIOCSPGRP:
5611 {
5612 pid_t pgrp;
5613 proc_t *q;
5614 pid_t sid, fg_pgid, bg_pgid;
5615
5616 if (error = strcopyin((void *)arg, &pgrp, sizeof (pid_t),
5617 copyflag))
5618 return (error);
5619 mutex_enter(&stp->sd_lock);
5620 mutex_enter(&pidlock);
5621 if (stp->sd_sidp != ttoproc(curthread)->p_sessp->s_sidp) {
5622 mutex_exit(&pidlock);
5623 mutex_exit(&stp->sd_lock);
5624 return (ENOTTY);
5625 }
5626 if (pgrp == stp->sd_pgidp->pid_id) {
5627 mutex_exit(&pidlock);
5628 mutex_exit(&stp->sd_lock);
5629 return (0);
5630 }
5631 if (pgrp <= 0 || pgrp >= maxpid) {
5632 mutex_exit(&pidlock);
5633 mutex_exit(&stp->sd_lock);
5634 return (EINVAL);
5635 }
5636 if ((q = pgfind(pgrp)) == NULL ||
5637 q->p_sessp != ttoproc(curthread)->p_sessp) {
5638 mutex_exit(&pidlock);
5639 mutex_exit(&stp->sd_lock);
5640 return (EPERM);
5641 }
5642 sid = stp->sd_sidp->pid_id;
5643 fg_pgid = q->p_pgrp;
5644 bg_pgid = stp->sd_pgidp->pid_id;
5645 CL_SET_PROCESS_GROUP(curthread, sid, bg_pgid, fg_pgid);
5646 PID_RELE(stp->sd_pgidp);
5647 ctty_clear_sighuped();
5648 stp->sd_pgidp = q->p_pgidp;
5649 PID_HOLD(stp->sd_pgidp);
5650 mutex_exit(&pidlock);
5651 mutex_exit(&stp->sd_lock);
5652 return (0);
5653 }
5654
5655 case TIOCGPGRP:
5656 {
5657 pid_t pgrp;
5658
5659 mutex_enter(&stp->sd_lock);
5660 if (stp->sd_sidp == NULL) {
5661 mutex_exit(&stp->sd_lock);
5662 return (ENOTTY);
5663 }
5664 pgrp = stp->sd_pgidp->pid_id;
5665 mutex_exit(&stp->sd_lock);
5666 return (strcopyout(&pgrp, (void *)arg, sizeof (pid_t),
5667 copyflag));
5668 }
5669
5670 case TIOCSCTTY:
5671 {
5672 return (strctty(stp));
5673 }
5674
5675 case TIOCNOTTY:
5676 {
5677 /* freectty() always assumes curproc. */
5678 if (freectty(B_FALSE) != 0)
5679 return (0);
5680 return (ENOTTY);
5681 }
5682
5683 case FIONBIO:
5684 case FIOASYNC:
5685 return (0); /* handled by the upper layer */
5686 }
5687 }
5688
5689 /*
5690 * Custom free routine used for M_PASSFP messages.
5691 */
5692 static void
5693 free_passfp(struct k_strrecvfd *srf)
5694 {
5695 (void) closef(srf->fp);
5696 kmem_free(srf, sizeof (struct k_strrecvfd) + sizeof (frtn_t));
5697 }
5698
5699 /* ARGSUSED */
5700 int
5701 do_sendfp(struct stdata *stp, struct file *fp, struct cred *cr)
5702 {
5703 queue_t *qp, *nextqp;
5704 struct k_strrecvfd *srf;
5705 mblk_t *mp;
5706 frtn_t *frtnp;
5707 size_t bufsize;
5708 queue_t *mate = NULL;
5709 syncq_t *sq = NULL;
5710 int retval = 0;
5711
5712 if (stp->sd_flag & STRHUP)
5713 return (ENXIO);
5714
5715 claimstr(stp->sd_wrq);
5716
5717 /* Fastpath, we have a pipe, and we are already mated, use it. */
5718 if (STRMATED(stp)) {
5719 qp = _RD(stp->sd_mate->sd_wrq);
5720 claimstr(qp);
5721 mate = qp;
5722 } else { /* Not already mated. */
5723
5724 /*
5725 * Walk the stream to the end of this one.
5726 * assumes that the claimstr() will prevent
5727 * plumbing between the stream head and the
5728 * driver from changing
5729 */
5730 qp = stp->sd_wrq;
5731
5732 /*
5733 * Loop until we reach the end of this stream.
5734 * On completion, qp points to the write queue
5735 * at the end of the stream, or the read queue
5736 * at the stream head if this is a fifo.
5737 */
5738 while (((qp = qp->q_next) != NULL) && _SAMESTR(qp))
5739 ;
5740
5741 /*
5742 * Just in case we get a q_next which is NULL, but
5743 * not at the end of the stream. This is actually
5744 * broken, so we set an assert to catch it in
5745 * debug, and set an error and return if not debug.
5746 */
5747 ASSERT(qp);
5748 if (qp == NULL) {
5749 releasestr(stp->sd_wrq);
5750 return (EINVAL);
5751 }
5752
5753 /*
5754 * Enter the syncq for the driver, so (hopefully)
5755 * the queue values will not change on us.
5756 * XXXX - This will only prevent the race IFF only
5757 * the write side modifies the q_next member, and
5758 * the put procedure is protected by at least
5759 * MT_PERQ.
5760 */
5761 if ((sq = qp->q_syncq) != NULL)
5762 entersq(sq, SQ_PUT);
5763
5764 /* Now get the q_next value from this qp. */
5765 nextqp = qp->q_next;
5766
5767 /*
5768 * If nextqp exists and the other stream is different
5769 * from this one claim the stream, set the mate, and
5770 * get the read queue at the stream head of the other
5771 * stream. Assumes that nextqp was at least valid when
5772 * we got it. Hopefully the entersq of the driver
5773 * will prevent it from changing on us.
5774 */
5775 if ((nextqp != NULL) && (STREAM(nextqp) != stp)) {
5776 ASSERT(qp->q_qinfo->qi_srvp);
5777 ASSERT(_OTHERQ(qp)->q_qinfo->qi_srvp);
5778 ASSERT(_OTHERQ(qp->q_next)->q_qinfo->qi_srvp);
5779 claimstr(nextqp);
5780
5781 /* Make sure we still have a q_next */
5782 if (nextqp != qp->q_next) {
5783 releasestr(stp->sd_wrq);
5784 releasestr(nextqp);
5785 return (EINVAL);
5786 }
5787
5788 qp = _RD(STREAM(nextqp)->sd_wrq);
5789 mate = qp;
5790 }
5791 /* If we entered the synq above, leave it. */
5792 if (sq != NULL)
5793 leavesq(sq, SQ_PUT);
5794 } /* STRMATED(STP) */
5795
5796 /* XXX prevents substitution of the ops vector */
5797 if (qp->q_qinfo != &strdata && qp->q_qinfo != &fifo_strdata) {
5798 retval = EINVAL;
5799 goto out;
5800 }
5801
5802 if (qp->q_flag & QFULL) {
5803 retval = EAGAIN;
5804 goto out;
5805 }
5806
5807 /*
5808 * Since M_PASSFP messages include a file descriptor, we use
5809 * esballoc() and specify a custom free routine (free_passfp()) that
5810 * will close the descriptor as part of freeing the message. For
5811 * convenience, we stash the frtn_t right after the data block.
5812 */
5813 bufsize = sizeof (struct k_strrecvfd) + sizeof (frtn_t);
5814 srf = kmem_alloc(bufsize, KM_NOSLEEP);
5815 if (srf == NULL) {
5816 retval = EAGAIN;
5817 goto out;
5818 }
5819
5820 frtnp = (frtn_t *)(srf + 1);
5821 frtnp->free_arg = (caddr_t)srf;
5822 frtnp->free_func = free_passfp;
5823
5824 mp = esballoc((uchar_t *)srf, bufsize, BPRI_MED, frtnp);
5825 if (mp == NULL) {
5826 kmem_free(srf, bufsize);
5827 retval = EAGAIN;
5828 goto out;
5829 }
5830 mp->b_wptr += sizeof (struct k_strrecvfd);
5831 mp->b_datap->db_type = M_PASSFP;
5832
5833 srf->fp = fp;
5834 srf->uid = crgetuid(curthread->t_cred);
5835 srf->gid = crgetgid(curthread->t_cred);
5836 mutex_enter(&fp->f_tlock);
5837 fp->f_count++;
5838 mutex_exit(&fp->f_tlock);
5839
5840 put(qp, mp);
5841 out:
5842 releasestr(stp->sd_wrq);
5843 if (mate)
5844 releasestr(mate);
5845 return (retval);
5846 }
5847
5848 /*
5849 * Send an ioctl message downstream and wait for acknowledgement.
5850 * flags may be set to either U_TO_K or K_TO_K and a combination
5851 * of STR_NOERROR or STR_NOSIG
5852 * STR_NOSIG: Signals are essentially ignored or held and have
5853 * no effect for the duration of the call.
5854 * STR_NOERROR: Ignores stream head read, write and hup errors.
5855 * Additionally, if an existing ioctl times out, it is assumed
5856 * lost and and this ioctl will continue as if the previous ioctl had
5857 * finished. ETIME may be returned if this ioctl times out (i.e.
5858 * ic_timout is not INFTIM). Non-stream head errors may be returned if
5859 * the ioc_error indicates that the driver/module had problems,
5860 * an EFAULT was found when accessing user data, a lack of
5861 * resources, etc.
5862 */
5863 int
5864 strdoioctl(
5865 struct stdata *stp,
5866 struct strioctl *strioc,
5867 int fflags, /* file flags with model info */
5868 int flag,
5869 cred_t *crp,
5870 int *rvalp)
5871 {
5872 mblk_t *bp;
5873 struct iocblk *iocbp;
5874 struct copyreq *reqp;
5875 struct copyresp *resp;
5876 int id;
5877 int transparent = 0;
5878 int error = 0;
5879 int len = 0;
5880 caddr_t taddr;
5881 int copyflag = (flag & (U_TO_K | K_TO_K));
5882 int sigflag = (flag & STR_NOSIG);
5883 int errs;
5884 uint_t waitflags;
5885 boolean_t set_iocwaitne = B_FALSE;
5886
5887 ASSERT(copyflag == U_TO_K || copyflag == K_TO_K);
5888 ASSERT((fflags & FMODELS) != 0);
5889
5890 TRACE_2(TR_FAC_STREAMS_FR,
5891 TR_STRDOIOCTL,
5892 "strdoioctl:stp %p strioc %p", stp, strioc);
5893 if (strioc->ic_len == TRANSPARENT) { /* send arg in M_DATA block */
5894 transparent = 1;
5895 strioc->ic_len = sizeof (intptr_t);
5896 }
5897
5898 if (strioc->ic_len < 0 || (strmsgsz > 0 && strioc->ic_len > strmsgsz))
5899 return (EINVAL);
5900
5901 if ((bp = allocb_cred_wait(sizeof (union ioctypes), sigflag, &error,
5902 crp, curproc->p_pid)) == NULL)
5903 return (error);
5904
5905 bzero(bp->b_wptr, sizeof (union ioctypes));
5906
5907 iocbp = (struct iocblk *)bp->b_wptr;
5908 iocbp->ioc_count = strioc->ic_len;
5909 iocbp->ioc_cmd = strioc->ic_cmd;
5910 iocbp->ioc_flag = (fflags & FMODELS);
5911
5912 crhold(crp);
5913 iocbp->ioc_cr = crp;
5914 DB_TYPE(bp) = M_IOCTL;
5915 bp->b_wptr += sizeof (struct iocblk);
5916
5917 if (flag & STR_NOERROR)
5918 errs = STPLEX;
5919 else
5920 errs = STRHUP|STRDERR|STWRERR|STPLEX;
5921
5922 /*
5923 * If there is data to copy into ioctl block, do so.
5924 */
5925 if (iocbp->ioc_count > 0) {
5926 if (transparent)
5927 /*
5928 * Note: STR_NOERROR does not have an effect
5929 * in putiocd()
5930 */
5931 id = K_TO_K | sigflag;
5932 else
5933 id = flag;
5934 if ((error = putiocd(bp, strioc->ic_dp, id, crp)) != 0) {
5935 freemsg(bp);
5936 crfree(crp);
5937 return (error);
5938 }
5939
5940 /*
5941 * We could have slept copying in user pages.
5942 * Recheck the stream head state (the other end
5943 * of a pipe could have gone away).
5944 */
5945 if (stp->sd_flag & errs) {
5946 mutex_enter(&stp->sd_lock);
5947 error = strgeterr(stp, errs, 0);
5948 mutex_exit(&stp->sd_lock);
5949 if (error != 0) {
5950 freemsg(bp);
5951 crfree(crp);
5952 return (error);
5953 }
5954 }
5955 }
5956 if (transparent)
5957 iocbp->ioc_count = TRANSPARENT;
5958
5959 /*
5960 * Block for up to STRTIMOUT milliseconds if there is an outstanding
5961 * ioctl for this stream already running. All processes
5962 * sleeping here will be awakened as a result of an ACK
5963 * or NAK being received for the outstanding ioctl, or
5964 * as a result of the timer expiring on the outstanding
5965 * ioctl (a failure), or as a result of any waiting
5966 * process's timer expiring (also a failure).
5967 */
5968
5969 error = 0;
5970 mutex_enter(&stp->sd_lock);
5971 while ((stp->sd_flag & IOCWAIT) ||
5972 (!set_iocwaitne && (stp->sd_flag & IOCWAITNE))) {
5973 clock_t cv_rval;
5974
5975 TRACE_0(TR_FAC_STREAMS_FR,
5976 TR_STRDOIOCTL_WAIT,
5977 "strdoioctl sleeps - IOCWAIT");
5978 cv_rval = str_cv_wait(&stp->sd_iocmonitor, &stp->sd_lock,
5979 STRTIMOUT, sigflag);
5980 if (cv_rval <= 0) {
5981 if (cv_rval == 0) {
5982 error = EINTR;
5983 } else {
5984 if (flag & STR_NOERROR) {
5985 /*
5986 * Terminating current ioctl in
5987 * progress -- assume it got lost and
5988 * wake up the other thread so that the
5989 * operation completes.
5990 */
5991 if (!(stp->sd_flag & IOCWAITNE)) {
5992 set_iocwaitne = B_TRUE;
5993 stp->sd_flag |= IOCWAITNE;
5994 cv_broadcast(&stp->sd_monitor);
5995 }
5996 /*
5997 * Otherwise, there's a running
5998 * STR_NOERROR -- we have no choice
5999 * here but to wait forever (or until
6000 * interrupted).
6001 */
6002 } else {
6003 /*
6004 * pending ioctl has caused
6005 * us to time out
6006 */
6007 error = ETIME;
6008 }
6009 }
6010 } else if ((stp->sd_flag & errs)) {
6011 error = strgeterr(stp, errs, 0);
6012 }
6013 if (error) {
6014 mutex_exit(&stp->sd_lock);
6015 freemsg(bp);
6016 crfree(crp);
6017 return (error);
6018 }
6019 }
6020
6021 /*
6022 * Have control of ioctl mechanism.
6023 * Send down ioctl packet and wait for response.
6024 */
6025 if (stp->sd_iocblk != (mblk_t *)-1) {
6026 freemsg(stp->sd_iocblk);
6027 }
6028 stp->sd_iocblk = NULL;
6029
6030 /*
6031 * If this is marked with 'noerror' (internal; mostly
6032 * I_{P,}{UN,}LINK), then make sure nobody else is able to get
6033 * in here by setting IOCWAITNE.
6034 */
6035 waitflags = IOCWAIT;
6036 if (flag & STR_NOERROR)
6037 waitflags |= IOCWAITNE;
6038
6039 stp->sd_flag |= waitflags;
6040
6041 /*
6042 * Assign sequence number.
6043 */
6044 iocbp->ioc_id = stp->sd_iocid = getiocseqno();
6045
6046 mutex_exit(&stp->sd_lock);
6047
6048 TRACE_1(TR_FAC_STREAMS_FR,
6049 TR_STRDOIOCTL_PUT, "strdoioctl put: stp %p", stp);
6050 stream_willservice(stp);
6051 putnext(stp->sd_wrq, bp);
6052 stream_runservice(stp);
6053
6054 /*
6055 * Timed wait for acknowledgment. The wait time is limited by the
6056 * timeout value, which must be a positive integer (number of
6057 * milliseconds) to wait, or 0 (use default value of STRTIMOUT
6058 * milliseconds), or -1 (wait forever). This will be awakened
6059 * either by an ACK/NAK message arriving, the timer expiring, or
6060 * the timer expiring on another ioctl waiting for control of the
6061 * mechanism.
6062 */
6063 waitioc:
6064 mutex_enter(&stp->sd_lock);
6065
6066
6067 /*
6068 * If the reply has already arrived, don't sleep. If awakened from
6069 * the sleep, fail only if the reply has not arrived by then.
6070 * Otherwise, process the reply.
6071 */
6072 while (!stp->sd_iocblk) {
6073 clock_t cv_rval;
6074
6075 if (stp->sd_flag & errs) {
6076 error = strgeterr(stp, errs, 0);
6077 if (error != 0) {
6078 stp->sd_flag &= ~waitflags;
6079 cv_broadcast(&stp->sd_iocmonitor);
6080 mutex_exit(&stp->sd_lock);
6081 crfree(crp);
6082 return (error);
6083 }
6084 }
6085
6086 TRACE_0(TR_FAC_STREAMS_FR,
6087 TR_STRDOIOCTL_WAIT2,
6088 "strdoioctl sleeps awaiting reply");
6089 ASSERT(error == 0);
6090
6091 cv_rval = str_cv_wait(&stp->sd_monitor, &stp->sd_lock,
6092 (strioc->ic_timout ?
6093 strioc->ic_timout * 1000 : STRTIMOUT), sigflag);
6094
6095 /*
6096 * There are four possible cases here: interrupt, timeout,
6097 * wakeup by IOCWAITNE (above), or wakeup by strrput_nondata (a
6098 * valid M_IOCTL reply).
6099 *
6100 * If we've been awakened by a STR_NOERROR ioctl on some other
6101 * thread, then sd_iocblk will still be NULL, and IOCWAITNE
6102 * will be set. Pretend as if we just timed out. Note that
6103 * this other thread waited at least STRTIMOUT before trying to
6104 * awaken our thread, so this is indistinguishable (even for
6105 * INFTIM) from the case where we failed with ETIME waiting on
6106 * IOCWAIT in the prior loop.
6107 */
6108 if (cv_rval > 0 && !(flag & STR_NOERROR) &&
6109 stp->sd_iocblk == NULL && (stp->sd_flag & IOCWAITNE)) {
6110 cv_rval = -1;
6111 }
6112
6113 /*
6114 * note: STR_NOERROR does not protect
6115 * us here.. use ic_timout < 0
6116 */
6117 if (cv_rval <= 0) {
6118 if (cv_rval == 0) {
6119 error = EINTR;
6120 } else {
6121 error = ETIME;
6122 }
6123 /*
6124 * A message could have come in after we were scheduled
6125 * but before we were actually run.
6126 */
6127 bp = stp->sd_iocblk;
6128 stp->sd_iocblk = NULL;
6129 if (bp != NULL) {
6130 if ((bp->b_datap->db_type == M_COPYIN) ||
6131 (bp->b_datap->db_type == M_COPYOUT)) {
6132 mutex_exit(&stp->sd_lock);
6133 if (bp->b_cont) {
6134 freemsg(bp->b_cont);
6135 bp->b_cont = NULL;
6136 }
6137 bp->b_datap->db_type = M_IOCDATA;
6138 bp->b_wptr = bp->b_rptr +
6139 sizeof (struct copyresp);
6140 resp = (struct copyresp *)bp->b_rptr;
6141 resp->cp_rval =
6142 (caddr_t)1; /* failure */
6143 stream_willservice(stp);
6144 putnext(stp->sd_wrq, bp);
6145 stream_runservice(stp);
6146 mutex_enter(&stp->sd_lock);
6147 } else {
6148 freemsg(bp);
6149 }
6150 }
6151 stp->sd_flag &= ~waitflags;
6152 cv_broadcast(&stp->sd_iocmonitor);
6153 mutex_exit(&stp->sd_lock);
6154 crfree(crp);
6155 return (error);
6156 }
6157 }
6158 bp = stp->sd_iocblk;
6159 /*
6160 * Note: it is strictly impossible to get here with sd_iocblk set to
6161 * -1. This is because the initial loop above doesn't allow any new
6162 * ioctls into the fray until all others have passed this point.
6163 */
6164 ASSERT(bp != NULL && bp != (mblk_t *)-1);
6165 TRACE_1(TR_FAC_STREAMS_FR,
6166 TR_STRDOIOCTL_ACK, "strdoioctl got reply: bp %p", bp);
6167 if ((bp->b_datap->db_type == M_IOCACK) ||
6168 (bp->b_datap->db_type == M_IOCNAK)) {
6169 /* for detection of duplicate ioctl replies */
6170 stp->sd_iocblk = (mblk_t *)-1;
6171 stp->sd_flag &= ~waitflags;
6172 cv_broadcast(&stp->sd_iocmonitor);
6173 mutex_exit(&stp->sd_lock);
6174 } else {
6175 /*
6176 * flags not cleared here because we're still doing
6177 * copy in/out for ioctl.
6178 */
6179 stp->sd_iocblk = NULL;
6180 mutex_exit(&stp->sd_lock);
6181 }
6182
6183
6184 /*
6185 * Have received acknowledgment.
6186 */
6187
6188 switch (bp->b_datap->db_type) {
6189 case M_IOCACK:
6190 /*
6191 * Positive ack.
6192 */
6193 iocbp = (struct iocblk *)bp->b_rptr;
6194
6195 /*
6196 * Set error if indicated.
6197 */
6198 if (iocbp->ioc_error) {
6199 error = iocbp->ioc_error;
6200 break;
6201 }
6202
6203 /*
6204 * Set return value.
6205 */
6206 *rvalp = iocbp->ioc_rval;
6207
6208 /*
6209 * Data may have been returned in ACK message (ioc_count > 0).
6210 * If so, copy it out to the user's buffer.
6211 */
6212 if (iocbp->ioc_count && !transparent) {
6213 if (error = getiocd(bp, strioc->ic_dp, copyflag))
6214 break;
6215 }
6216 if (!transparent) {
6217 if (len) /* an M_COPYOUT was used with I_STR */
6218 strioc->ic_len = len;
6219 else
6220 strioc->ic_len = (int)iocbp->ioc_count;
6221 }
6222 break;
6223
6224 case M_IOCNAK:
6225 /*
6226 * Negative ack.
6227 *
6228 * The only thing to do is set error as specified
6229 * in neg ack packet.
6230 */
6231 iocbp = (struct iocblk *)bp->b_rptr;
6232
6233 error = (iocbp->ioc_error ? iocbp->ioc_error : EINVAL);
6234 break;
6235
6236 case M_COPYIN:
6237 /*
6238 * Driver or module has requested user ioctl data.
6239 */
6240 reqp = (struct copyreq *)bp->b_rptr;
6241
6242 /*
6243 * M_COPYIN should *never* have a message attached, though
6244 * it's harmless if it does -- thus, panic on a DEBUG
6245 * kernel and just free it on a non-DEBUG build.
6246 */
6247 ASSERT(bp->b_cont == NULL);
6248 if (bp->b_cont != NULL) {
6249 freemsg(bp->b_cont);
6250 bp->b_cont = NULL;
6251 }
6252
6253 error = putiocd(bp, reqp->cq_addr, flag, crp);
6254 if (error && bp->b_cont) {
6255 freemsg(bp->b_cont);
6256 bp->b_cont = NULL;
6257 }
6258
6259 bp->b_wptr = bp->b_rptr + sizeof (struct copyresp);
6260 bp->b_datap->db_type = M_IOCDATA;
6261
6262 mblk_setcred(bp, crp, curproc->p_pid);
6263 resp = (struct copyresp *)bp->b_rptr;
6264 resp->cp_rval = (caddr_t)(uintptr_t)error;
6265 resp->cp_flag = (fflags & FMODELS);
6266
6267 stream_willservice(stp);
6268 putnext(stp->sd_wrq, bp);
6269 stream_runservice(stp);
6270
6271 if (error) {
6272 mutex_enter(&stp->sd_lock);
6273 stp->sd_flag &= ~waitflags;
6274 cv_broadcast(&stp->sd_iocmonitor);
6275 mutex_exit(&stp->sd_lock);
6276 crfree(crp);
6277 return (error);
6278 }
6279
6280 goto waitioc;
6281
6282 case M_COPYOUT:
6283 /*
6284 * Driver or module has ioctl data for a user.
6285 */
6286 reqp = (struct copyreq *)bp->b_rptr;
6287 ASSERT(bp->b_cont != NULL);
6288
6289 /*
6290 * Always (transparent or non-transparent )
6291 * use the address specified in the request
6292 */
6293 taddr = reqp->cq_addr;
6294 if (!transparent)
6295 len = (int)reqp->cq_size;
6296
6297 /* copyout data to the provided address */
6298 error = getiocd(bp, taddr, copyflag);
6299
6300 freemsg(bp->b_cont);
6301 bp->b_cont = NULL;
6302
6303 bp->b_wptr = bp->b_rptr + sizeof (struct copyresp);
6304 bp->b_datap->db_type = M_IOCDATA;
6305
6306 mblk_setcred(bp, crp, curproc->p_pid);
6307 resp = (struct copyresp *)bp->b_rptr;
6308 resp->cp_rval = (caddr_t)(uintptr_t)error;
6309 resp->cp_flag = (fflags & FMODELS);
6310
6311 stream_willservice(stp);
6312 putnext(stp->sd_wrq, bp);
6313 stream_runservice(stp);
6314
6315 if (error) {
6316 mutex_enter(&stp->sd_lock);
6317 stp->sd_flag &= ~waitflags;
6318 cv_broadcast(&stp->sd_iocmonitor);
6319 mutex_exit(&stp->sd_lock);
6320 crfree(crp);
6321 return (error);
6322 }
6323 goto waitioc;
6324
6325 default:
6326 ASSERT(0);
6327 mutex_enter(&stp->sd_lock);
6328 stp->sd_flag &= ~waitflags;
6329 cv_broadcast(&stp->sd_iocmonitor);
6330 mutex_exit(&stp->sd_lock);
6331 break;
6332 }
6333
6334 freemsg(bp);
6335 crfree(crp);
6336 return (error);
6337 }
6338
6339 /*
6340 * Send an M_CMD message downstream and wait for a reply. This is a ptools
6341 * special used to retrieve information from modules/drivers a stream without
6342 * being subjected to flow control or interfering with pending messages on the
6343 * stream (e.g. an ioctl in flight).
6344 */
6345 int
6346 strdocmd(struct stdata *stp, struct strcmd *scp, cred_t *crp)
6347 {
6348 mblk_t *mp;
6349 struct cmdblk *cmdp;
6350 int error = 0;
6351 int errs = STRHUP|STRDERR|STWRERR|STPLEX;
6352 clock_t rval, timeout = STRTIMOUT;
6353
6354 if (scp->sc_len < 0 || scp->sc_len > sizeof (scp->sc_buf) ||
6355 scp->sc_timeout < -1)
6356 return (EINVAL);
6357
6358 if (scp->sc_timeout > 0)
6359 timeout = scp->sc_timeout * MILLISEC;
6360
6361 if ((mp = allocb_cred(sizeof (struct cmdblk), crp,
6362 curproc->p_pid)) == NULL)
6363 return (ENOMEM);
6364
6365 crhold(crp);
6366
6367 cmdp = (struct cmdblk *)mp->b_wptr;
6368 cmdp->cb_cr = crp;
6369 cmdp->cb_cmd = scp->sc_cmd;
6370 cmdp->cb_len = scp->sc_len;
6371 cmdp->cb_error = 0;
6372 mp->b_wptr += sizeof (struct cmdblk);
6373
6374 DB_TYPE(mp) = M_CMD;
6375 DB_CPID(mp) = curproc->p_pid;
6376
6377 /*
6378 * Copy in the payload.
6379 */
6380 if (cmdp->cb_len > 0) {
6381 mp->b_cont = allocb_cred(sizeof (scp->sc_buf), crp,
6382 curproc->p_pid);
6383 if (mp->b_cont == NULL) {
6384 error = ENOMEM;
6385 goto out;
6386 }
6387
6388 /* cb_len comes from sc_len, which has already been checked */
6389 ASSERT(cmdp->cb_len <= sizeof (scp->sc_buf));
6390 (void) bcopy(scp->sc_buf, mp->b_cont->b_wptr, cmdp->cb_len);
6391 mp->b_cont->b_wptr += cmdp->cb_len;
6392 DB_CPID(mp->b_cont) = curproc->p_pid;
6393 }
6394
6395 /*
6396 * Since this mechanism is strictly for ptools, and since only one
6397 * process can be grabbed at a time, we simply fail if there's
6398 * currently an operation pending.
6399 */
6400 mutex_enter(&stp->sd_lock);
6401 if (stp->sd_flag & STRCMDWAIT) {
6402 mutex_exit(&stp->sd_lock);
6403 error = EBUSY;
6404 goto out;
6405 }
6406 stp->sd_flag |= STRCMDWAIT;
6407 ASSERT(stp->sd_cmdblk == NULL);
6408 mutex_exit(&stp->sd_lock);
6409
6410 putnext(stp->sd_wrq, mp);
6411 mp = NULL;
6412
6413 /*
6414 * Timed wait for acknowledgment. If the reply has already arrived,
6415 * don't sleep. If awakened from the sleep, fail only if the reply
6416 * has not arrived by then. Otherwise, process the reply.
6417 */
6418 mutex_enter(&stp->sd_lock);
6419 while (stp->sd_cmdblk == NULL) {
6420 if (stp->sd_flag & errs) {
6421 if ((error = strgeterr(stp, errs, 0)) != 0)
6422 goto waitout;
6423 }
6424
6425 rval = str_cv_wait(&stp->sd_monitor, &stp->sd_lock, timeout, 0);
6426 if (stp->sd_cmdblk != NULL)
6427 break;
6428
6429 if (rval <= 0) {
6430 error = (rval == 0) ? EINTR : ETIME;
6431 goto waitout;
6432 }
6433 }
6434
6435 /*
6436 * We received a reply.
6437 */
6438 mp = stp->sd_cmdblk;
6439 stp->sd_cmdblk = NULL;
6440 ASSERT(mp != NULL && DB_TYPE(mp) == M_CMD);
6441 ASSERT(stp->sd_flag & STRCMDWAIT);
6442 stp->sd_flag &= ~STRCMDWAIT;
6443 mutex_exit(&stp->sd_lock);
6444
6445 cmdp = (struct cmdblk *)mp->b_rptr;
6446 if ((error = cmdp->cb_error) != 0)
6447 goto out;
6448
6449 /*
6450 * Data may have been returned in the reply (cb_len > 0).
6451 * If so, copy it out to the user's buffer.
6452 */
6453 if (cmdp->cb_len > 0) {
6454 if (mp->b_cont == NULL || MBLKL(mp->b_cont) < cmdp->cb_len) {
6455 error = EPROTO;
6456 goto out;
6457 }
6458
6459 cmdp->cb_len = MIN(cmdp->cb_len, sizeof (scp->sc_buf));
6460 (void) bcopy(mp->b_cont->b_rptr, scp->sc_buf, cmdp->cb_len);
6461 }
6462 scp->sc_len = cmdp->cb_len;
6463 out:
6464 freemsg(mp);
6465 crfree(crp);
6466 return (error);
6467 waitout:
6468 ASSERT(stp->sd_cmdblk == NULL);
6469 stp->sd_flag &= ~STRCMDWAIT;
6470 mutex_exit(&stp->sd_lock);
6471 crfree(crp);
6472 return (error);
6473 }
6474
6475 /*
6476 * For the SunOS keyboard driver.
6477 * Return the next available "ioctl" sequence number.
6478 * Exported, so that streams modules can send "ioctl" messages
6479 * downstream from their open routine.
6480 */
6481 int
6482 getiocseqno(void)
6483 {
6484 int i;
6485
6486 mutex_enter(&strresources);
6487 i = ++ioc_id;
6488 mutex_exit(&strresources);
6489 return (i);
6490 }
6491
6492 /*
6493 * Get the next message from the read queue. If the message is
6494 * priority, STRPRI will have been set by strrput(). This flag
6495 * should be reset only when the entire message at the front of the
6496 * queue as been consumed.
6497 *
6498 * NOTE: strgetmsg and kstrgetmsg have much of the logic in common.
6499 */
6500 int
6501 strgetmsg(
6502 struct vnode *vp,
6503 struct strbuf *mctl,
6504 struct strbuf *mdata,
6505 unsigned char *prip,
6506 int *flagsp,
6507 int fmode,
6508 rval_t *rvp)
6509 {
6510 struct stdata *stp;
6511 mblk_t *bp, *nbp;
6512 mblk_t *savemp = NULL;
6513 mblk_t *savemptail = NULL;
6514 uint_t old_sd_flag;
6515 int flg;
6516 int more = 0;
6517 int error = 0;
6518 char first = 1;
6519 uint_t mark; /* Contains MSG*MARK and _LASTMARK */
6520 #define _LASTMARK 0x8000 /* Distinct from MSG*MARK */
6521 unsigned char pri = 0;
6522 queue_t *q;
6523 int pr = 0; /* Partial read successful */
6524 struct uio uios;
6525 struct uio *uiop = &uios;
6526 struct iovec iovs;
6527 unsigned char type;
6528
6529 TRACE_1(TR_FAC_STREAMS_FR, TR_STRGETMSG_ENTER,
6530 "strgetmsg:%p", vp);
6531
6532 ASSERT(vp->v_stream);
6533 stp = vp->v_stream;
6534 rvp->r_val1 = 0;
6535
6536 mutex_enter(&stp->sd_lock);
6537
6538 if ((error = i_straccess(stp, JCREAD)) != 0) {
6539 mutex_exit(&stp->sd_lock);
6540 return (error);
6541 }
6542
6543 if (stp->sd_flag & (STRDERR|STPLEX)) {
6544 error = strgeterr(stp, STRDERR|STPLEX, 0);
6545 if (error != 0) {
6546 mutex_exit(&stp->sd_lock);
6547 return (error);
6548 }
6549 }
6550 mutex_exit(&stp->sd_lock);
6551
6552 switch (*flagsp) {
6553 case MSG_HIPRI:
6554 if (*prip != 0)
6555 return (EINVAL);
6556 break;
6557
6558 case MSG_ANY:
6559 case MSG_BAND:
6560 break;
6561
6562 default:
6563 return (EINVAL);
6564 }
6565 /*
6566 * Setup uio and iov for data part
6567 */
6568 iovs.iov_base = mdata->buf;
6569 iovs.iov_len = mdata->maxlen;
6570 uios.uio_iov = &iovs;
6571 uios.uio_iovcnt = 1;
6572 uios.uio_loffset = 0;
6573 uios.uio_segflg = UIO_USERSPACE;
6574 uios.uio_fmode = 0;
6575 uios.uio_extflg = UIO_COPY_CACHED;
6576 uios.uio_resid = mdata->maxlen;
6577 uios.uio_offset = 0;
6578
6579 q = _RD(stp->sd_wrq);
6580 mutex_enter(&stp->sd_lock);
6581 old_sd_flag = stp->sd_flag;
6582 mark = 0;
6583 for (;;) {
6584 int done = 0;
6585 mblk_t *q_first = q->q_first;
6586
6587 /*
6588 * Get the next message of appropriate priority
6589 * from the stream head. If the caller is interested
6590 * in band or hipri messages, then they should already
6591 * be enqueued at the stream head. On the other hand
6592 * if the caller wants normal (band 0) messages, they
6593 * might be deferred in a synchronous stream and they
6594 * will need to be pulled up.
6595 *
6596 * After we have dequeued a message, we might find that
6597 * it was a deferred M_SIG that was enqueued at the
6598 * stream head. It must now be posted as part of the
6599 * read by calling strsignal_nolock().
6600 *
6601 * Also note that strrput does not enqueue an M_PCSIG,
6602 * and there cannot be more than one hipri message,
6603 * so there was no need to have the M_PCSIG case.
6604 *
6605 * At some time it might be nice to try and wrap the
6606 * functionality of kstrgetmsg() and strgetmsg() into
6607 * a common routine so to reduce the amount of replicated
6608 * code (since they are extremely similar).
6609 */
6610 if (!(*flagsp & (MSG_HIPRI|MSG_BAND))) {
6611 /* Asking for normal, band0 data */
6612 bp = strget(stp, q, uiop, first, &error);
6613 ASSERT(MUTEX_HELD(&stp->sd_lock));
6614 if (bp != NULL) {
6615 if (DB_TYPE(bp) == M_SIG) {
6616 strsignal_nolock(stp, *bp->b_rptr,
6617 bp->b_band);
6618 freemsg(bp);
6619 continue;
6620 } else {
6621 break;
6622 }
6623 }
6624 if (error != 0)
6625 goto getmout;
6626
6627 /*
6628 * We can't depend on the value of STRPRI here because
6629 * the stream head may be in transit. Therefore, we
6630 * must look at the type of the first message to
6631 * determine if a high priority messages is waiting
6632 */
6633 } else if ((*flagsp & MSG_HIPRI) && q_first != NULL &&
6634 DB_TYPE(q_first) >= QPCTL &&
6635 (bp = getq_noenab(q, 0)) != NULL) {
6636 /* Asked for HIPRI and got one */
6637 ASSERT(DB_TYPE(bp) >= QPCTL);
6638 break;
6639 } else if ((*flagsp & MSG_BAND) && q_first != NULL &&
6640 ((q_first->b_band >= *prip) || DB_TYPE(q_first) >= QPCTL) &&
6641 (bp = getq_noenab(q, 0)) != NULL) {
6642 /*
6643 * Asked for at least band "prip" and got either at
6644 * least that band or a hipri message.
6645 */
6646 ASSERT(bp->b_band >= *prip || DB_TYPE(bp) >= QPCTL);
6647 if (DB_TYPE(bp) == M_SIG) {
6648 strsignal_nolock(stp, *bp->b_rptr, bp->b_band);
6649 freemsg(bp);
6650 continue;
6651 } else {
6652 break;
6653 }
6654 }
6655
6656 /* No data. Time to sleep? */
6657 qbackenable(q, 0);
6658
6659 /*
6660 * If STRHUP or STREOF, return 0 length control and data.
6661 * If resid is 0, then a read(fd,buf,0) was done. Do not
6662 * sleep to satisfy this request because by default we have
6663 * zero bytes to return.
6664 */
6665 if ((stp->sd_flag & (STRHUP|STREOF)) || (mctl->maxlen == 0 &&
6666 mdata->maxlen == 0)) {
6667 mctl->len = mdata->len = 0;
6668 *flagsp = 0;
6669 mutex_exit(&stp->sd_lock);
6670 return (0);
6671 }
6672 TRACE_2(TR_FAC_STREAMS_FR, TR_STRGETMSG_WAIT,
6673 "strgetmsg calls strwaitq:%p, %p",
6674 vp, uiop);
6675 if (((error = strwaitq(stp, GETWAIT, (ssize_t)0, fmode, -1,
6676 &done)) != 0) || done) {
6677 TRACE_2(TR_FAC_STREAMS_FR, TR_STRGETMSG_DONE,
6678 "strgetmsg error or done:%p, %p",
6679 vp, uiop);
6680 mutex_exit(&stp->sd_lock);
6681 return (error);
6682 }
6683 TRACE_2(TR_FAC_STREAMS_FR, TR_STRGETMSG_AWAKE,
6684 "strgetmsg awakes:%p, %p", vp, uiop);
6685 if ((error = i_straccess(stp, JCREAD)) != 0) {
6686 mutex_exit(&stp->sd_lock);
6687 return (error);
6688 }
6689 first = 0;
6690 }
6691 ASSERT(bp != NULL);
6692 /*
6693 * Extract any mark information. If the message is not completely
6694 * consumed this information will be put in the mblk
6695 * that is putback.
6696 * If MSGMARKNEXT is set and the message is completely consumed
6697 * the STRATMARK flag will be set below. Likewise, if
6698 * MSGNOTMARKNEXT is set and the message is
6699 * completely consumed STRNOTATMARK will be set.
6700 */
6701 mark = bp->b_flag & (MSGMARK | MSGMARKNEXT | MSGNOTMARKNEXT);
6702 ASSERT((mark & (MSGMARKNEXT|MSGNOTMARKNEXT)) !=
6703 (MSGMARKNEXT|MSGNOTMARKNEXT));
6704 if (mark != 0 && bp == stp->sd_mark) {
6705 mark |= _LASTMARK;
6706 stp->sd_mark = NULL;
6707 }
6708 /*
6709 * keep track of the original message type and priority
6710 */
6711 pri = bp->b_band;
6712 type = bp->b_datap->db_type;
6713 if (type == M_PASSFP) {
6714 if ((mark & _LASTMARK) && (stp->sd_mark == NULL))
6715 stp->sd_mark = bp;
6716 bp->b_flag |= mark & ~_LASTMARK;
6717 putback(stp, q, bp, pri);
6718 qbackenable(q, pri);
6719 mutex_exit(&stp->sd_lock);
6720 return (EBADMSG);
6721 }
6722 ASSERT(type != M_SIG);
6723
6724 /*
6725 * Set this flag so strrput will not generate signals. Need to
6726 * make sure this flag is cleared before leaving this routine
6727 * else signals will stop being sent.
6728 */
6729 stp->sd_flag |= STRGETINPROG;
6730 mutex_exit(&stp->sd_lock);
6731
6732 if (STREAM_NEEDSERVICE(stp))
6733 stream_runservice(stp);
6734
6735 /*
6736 * Set HIPRI flag if message is priority.
6737 */
6738 if (type >= QPCTL)
6739 flg = MSG_HIPRI;
6740 else
6741 flg = MSG_BAND;
6742
6743 /*
6744 * First process PROTO or PCPROTO blocks, if any.
6745 */
6746 if (mctl->maxlen >= 0 && type != M_DATA) {
6747 size_t n, bcnt;
6748 char *ubuf;
6749
6750 bcnt = mctl->maxlen;
6751 ubuf = mctl->buf;
6752 while (bp != NULL && bp->b_datap->db_type != M_DATA) {
6753 if ((n = MIN(bcnt, bp->b_wptr - bp->b_rptr)) != 0 &&
6754 copyout(bp->b_rptr, ubuf, n)) {
6755 error = EFAULT;
6756 mutex_enter(&stp->sd_lock);
6757 /*
6758 * clear stream head pri flag based on
6759 * first message type
6760 */
6761 if (type >= QPCTL) {
6762 ASSERT(type == M_PCPROTO);
6763 stp->sd_flag &= ~STRPRI;
6764 }
6765 more = 0;
6766 freemsg(bp);
6767 goto getmout;
6768 }
6769 ubuf += n;
6770 bp->b_rptr += n;
6771 if (bp->b_rptr >= bp->b_wptr) {
6772 nbp = bp;
6773 bp = bp->b_cont;
6774 freeb(nbp);
6775 }
6776 ASSERT(n <= bcnt);
6777 bcnt -= n;
6778 if (bcnt == 0)
6779 break;
6780 }
6781 mctl->len = mctl->maxlen - bcnt;
6782 } else
6783 mctl->len = -1;
6784
6785 if (bp && bp->b_datap->db_type != M_DATA) {
6786 /*
6787 * More PROTO blocks in msg.
6788 */
6789 more |= MORECTL;
6790 savemp = bp;
6791 while (bp && bp->b_datap->db_type != M_DATA) {
6792 savemptail = bp;
6793 bp = bp->b_cont;
6794 }
6795 savemptail->b_cont = NULL;
6796 }
6797
6798 /*
6799 * Now process DATA blocks, if any.
6800 */
6801 if (mdata->maxlen >= 0 && bp) {
6802 /*
6803 * struiocopyout will consume a potential zero-length
6804 * M_DATA even if uio_resid is zero.
6805 */
6806 size_t oldresid = uiop->uio_resid;
6807
6808 bp = struiocopyout(bp, uiop, &error);
6809 if (error != 0) {
6810 mutex_enter(&stp->sd_lock);
6811 /*
6812 * clear stream head hi pri flag based on
6813 * first message
6814 */
6815 if (type >= QPCTL) {
6816 ASSERT(type == M_PCPROTO);
6817 stp->sd_flag &= ~STRPRI;
6818 }
6819 more = 0;
6820 freemsg(savemp);
6821 goto getmout;
6822 }
6823 /*
6824 * (pr == 1) indicates a partial read.
6825 */
6826 if (oldresid > uiop->uio_resid)
6827 pr = 1;
6828 mdata->len = mdata->maxlen - uiop->uio_resid;
6829 } else
6830 mdata->len = -1;
6831
6832 if (bp) { /* more data blocks in msg */
6833 more |= MOREDATA;
6834 if (savemp)
6835 savemptail->b_cont = bp;
6836 else
6837 savemp = bp;
6838 }
6839
6840 mutex_enter(&stp->sd_lock);
6841 if (savemp) {
6842 if (pr && (savemp->b_datap->db_type == M_DATA) &&
6843 msgnodata(savemp)) {
6844 /*
6845 * Avoid queuing a zero-length tail part of
6846 * a message. pr=1 indicates that we read some of
6847 * the message.
6848 */
6849 freemsg(savemp);
6850 more &= ~MOREDATA;
6851 /*
6852 * clear stream head hi pri flag based on
6853 * first message
6854 */
6855 if (type >= QPCTL) {
6856 ASSERT(type == M_PCPROTO);
6857 stp->sd_flag &= ~STRPRI;
6858 }
6859 } else {
6860 savemp->b_band = pri;
6861 /*
6862 * If the first message was HIPRI and the one we're
6863 * putting back isn't, then clear STRPRI, otherwise
6864 * set STRPRI again. Note that we must set STRPRI
6865 * again since the flush logic in strrput_nondata()
6866 * may have cleared it while we had sd_lock dropped.
6867 */
6868 if (type >= QPCTL) {
6869 ASSERT(type == M_PCPROTO);
6870 if (queclass(savemp) < QPCTL)
6871 stp->sd_flag &= ~STRPRI;
6872 else
6873 stp->sd_flag |= STRPRI;
6874 } else if (queclass(savemp) >= QPCTL) {
6875 /*
6876 * The first message was not a HIPRI message,
6877 * but the one we are about to putback is.
6878 * For simplicitly, we do not allow for HIPRI
6879 * messages to be embedded in the message
6880 * body, so just force it to same type as
6881 * first message.
6882 */
6883 ASSERT(type == M_DATA || type == M_PROTO);
6884 ASSERT(savemp->b_datap->db_type == M_PCPROTO);
6885 savemp->b_datap->db_type = type;
6886 }
6887 if (mark != 0) {
6888 savemp->b_flag |= mark & ~_LASTMARK;
6889 if ((mark & _LASTMARK) &&
6890 (stp->sd_mark == NULL)) {
6891 /*
6892 * If another marked message arrived
6893 * while sd_lock was not held sd_mark
6894 * would be non-NULL.
6895 */
6896 stp->sd_mark = savemp;
6897 }
6898 }
6899 putback(stp, q, savemp, pri);
6900 }
6901 } else {
6902 /*
6903 * The complete message was consumed.
6904 *
6905 * If another M_PCPROTO arrived while sd_lock was not held
6906 * it would have been discarded since STRPRI was still set.
6907 *
6908 * Move the MSG*MARKNEXT information
6909 * to the stream head just in case
6910 * the read queue becomes empty.
6911 * clear stream head hi pri flag based on
6912 * first message
6913 *
6914 * If the stream head was at the mark
6915 * (STRATMARK) before we dropped sd_lock above
6916 * and some data was consumed then we have
6917 * moved past the mark thus STRATMARK is
6918 * cleared. However, if a message arrived in
6919 * strrput during the copyout above causing
6920 * STRATMARK to be set we can not clear that
6921 * flag.
6922 */
6923 if (type >= QPCTL) {
6924 ASSERT(type == M_PCPROTO);
6925 stp->sd_flag &= ~STRPRI;
6926 }
6927 if (mark & (MSGMARKNEXT|MSGNOTMARKNEXT|MSGMARK)) {
6928 if (mark & MSGMARKNEXT) {
6929 stp->sd_flag &= ~STRNOTATMARK;
6930 stp->sd_flag |= STRATMARK;
6931 } else if (mark & MSGNOTMARKNEXT) {
6932 stp->sd_flag &= ~STRATMARK;
6933 stp->sd_flag |= STRNOTATMARK;
6934 } else {
6935 stp->sd_flag &= ~(STRATMARK|STRNOTATMARK);
6936 }
6937 } else if (pr && (old_sd_flag & STRATMARK)) {
6938 stp->sd_flag &= ~STRATMARK;
6939 }
6940 }
6941
6942 *flagsp = flg;
6943 *prip = pri;
6944
6945 /*
6946 * Getmsg cleanup processing - if the state of the queue has changed
6947 * some signals may need to be sent and/or poll awakened.
6948 */
6949 getmout:
6950 qbackenable(q, pri);
6951
6952 /*
6953 * We dropped the stream head lock above. Send all M_SIG messages
6954 * before processing stream head for SIGPOLL messages.
6955 */
6956 ASSERT(MUTEX_HELD(&stp->sd_lock));
6957 while ((bp = q->q_first) != NULL &&
6958 (bp->b_datap->db_type == M_SIG)) {
6959 /*
6960 * sd_lock is held so the content of the read queue can not
6961 * change.
6962 */
6963 bp = getq(q);
6964 ASSERT(bp != NULL && bp->b_datap->db_type == M_SIG);
6965
6966 strsignal_nolock(stp, *bp->b_rptr, bp->b_band);
6967 mutex_exit(&stp->sd_lock);
6968 freemsg(bp);
6969 if (STREAM_NEEDSERVICE(stp))
6970 stream_runservice(stp);
6971 mutex_enter(&stp->sd_lock);
6972 }
6973
6974 /*
6975 * stream head cannot change while we make the determination
6976 * whether or not to send a signal. Drop the flag to allow strrput
6977 * to send firstmsgsigs again.
6978 */
6979 stp->sd_flag &= ~STRGETINPROG;
6980
6981 /*
6982 * If the type of message at the front of the queue changed
6983 * due to the receive the appropriate signals and pollwakeup events
6984 * are generated. The type of changes are:
6985 * Processed a hipri message, q_first is not hipri.
6986 * Processed a band X message, and q_first is band Y.
6987 * The generated signals and pollwakeups are identical to what
6988 * strrput() generates should the message that is now on q_first
6989 * arrive to an empty read queue.
6990 *
6991 * Note: only strrput will send a signal for a hipri message.
6992 */
6993 if ((bp = q->q_first) != NULL && !(stp->sd_flag & STRPRI)) {
6994 strsigset_t signals = 0;
6995 strpollset_t pollwakeups = 0;
6996
6997 if (flg & MSG_HIPRI) {
6998 /*
6999 * Removed a hipri message. Regular data at
7000 * the front of the queue.
7001 */
7002 if (bp->b_band == 0) {
7003 signals = S_INPUT | S_RDNORM;
7004 pollwakeups = POLLIN | POLLRDNORM;
7005 } else {
7006 signals = S_INPUT | S_RDBAND;
7007 pollwakeups = POLLIN | POLLRDBAND;
7008 }
7009 } else if (pri != bp->b_band) {
7010 /*
7011 * The band is different for the new q_first.
7012 */
7013 if (bp->b_band == 0) {
7014 signals = S_RDNORM;
7015 pollwakeups = POLLIN | POLLRDNORM;
7016 } else {
7017 signals = S_RDBAND;
7018 pollwakeups = POLLIN | POLLRDBAND;
7019 }
7020 }
7021
7022 if (pollwakeups != 0) {
7023 if (pollwakeups == (POLLIN | POLLRDNORM)) {
7024 if (!(stp->sd_rput_opt & SR_POLLIN))
7025 goto no_pollwake;
7026 stp->sd_rput_opt &= ~SR_POLLIN;
7027 }
7028 mutex_exit(&stp->sd_lock);
7029 pollwakeup(&stp->sd_pollist, pollwakeups);
7030 mutex_enter(&stp->sd_lock);
7031 }
7032 no_pollwake:
7033
7034 if (stp->sd_sigflags & signals)
7035 strsendsig(stp->sd_siglist, signals, bp->b_band, 0);
7036 }
7037 mutex_exit(&stp->sd_lock);
7038
7039 rvp->r_val1 = more;
7040 return (error);
7041 #undef _LASTMARK
7042 }
7043
7044 /*
7045 * Get the next message from the read queue. If the message is
7046 * priority, STRPRI will have been set by strrput(). This flag
7047 * should be reset only when the entire message at the front of the
7048 * queue as been consumed.
7049 *
7050 * If uiop is NULL all data is returned in mctlp.
7051 * Note that a NULL uiop implies that FNDELAY and FNONBLOCK are assumed
7052 * not enabled.
7053 * The timeout parameter is in milliseconds; -1 for infinity.
7054 * This routine handles the consolidation private flags:
7055 * MSG_IGNERROR Ignore any stream head error except STPLEX.
7056 * MSG_DELAYERROR Defer the error check until the queue is empty.
7057 * MSG_HOLDSIG Hold signals while waiting for data.
7058 * MSG_IPEEK Only peek at messages.
7059 * MSG_DISCARDTAIL Discard the tail M_DATA part of the message
7060 * that doesn't fit.
7061 * MSG_NOMARK If the message is marked leave it on the queue.
7062 *
7063 * NOTE: strgetmsg and kstrgetmsg have much of the logic in common.
7064 */
7065 int
7066 kstrgetmsg(
7067 struct vnode *vp,
7068 mblk_t **mctlp,
7069 struct uio *uiop,
7070 unsigned char *prip,
7071 int *flagsp,
7072 clock_t timout,
7073 rval_t *rvp)
7074 {
7075 struct stdata *stp;
7076 mblk_t *bp, *nbp;
7077 mblk_t *savemp = NULL;
7078 mblk_t *savemptail = NULL;
7079 int flags;
7080 uint_t old_sd_flag;
7081 int flg;
7082 int more = 0;
7083 int error = 0;
7084 char first = 1;
7085 uint_t mark; /* Contains MSG*MARK and _LASTMARK */
7086 #define _LASTMARK 0x8000 /* Distinct from MSG*MARK */
7087 unsigned char pri = 0;
7088 queue_t *q;
7089 int pr = 0; /* Partial read successful */
7090 unsigned char type;
7091
7092 TRACE_1(TR_FAC_STREAMS_FR, TR_KSTRGETMSG_ENTER,
7093 "kstrgetmsg:%p", vp);
7094
7095 ASSERT(vp->v_stream);
7096 stp = vp->v_stream;
7097 rvp->r_val1 = 0;
7098
7099 mutex_enter(&stp->sd_lock);
7100
7101 if ((error = i_straccess(stp, JCREAD)) != 0) {
7102 mutex_exit(&stp->sd_lock);
7103 return (error);
7104 }
7105
7106 flags = *flagsp;
7107 if (stp->sd_flag & (STRDERR|STPLEX)) {
7108 if ((stp->sd_flag & STPLEX) ||
7109 (flags & (MSG_IGNERROR|MSG_DELAYERROR)) == 0) {
7110 error = strgeterr(stp, STRDERR|STPLEX,
7111 (flags & MSG_IPEEK));
7112 if (error != 0) {
7113 mutex_exit(&stp->sd_lock);
7114 return (error);
7115 }
7116 }
7117 }
7118 mutex_exit(&stp->sd_lock);
7119
7120 switch (flags & (MSG_HIPRI|MSG_ANY|MSG_BAND)) {
7121 case MSG_HIPRI:
7122 if (*prip != 0)
7123 return (EINVAL);
7124 break;
7125
7126 case MSG_ANY:
7127 case MSG_BAND:
7128 break;
7129
7130 default:
7131 return (EINVAL);
7132 }
7133
7134 retry:
7135 q = _RD(stp->sd_wrq);
7136 mutex_enter(&stp->sd_lock);
7137 old_sd_flag = stp->sd_flag;
7138 mark = 0;
7139 for (;;) {
7140 int done = 0;
7141 int waitflag;
7142 int fmode;
7143 mblk_t *q_first = q->q_first;
7144
7145 /*
7146 * This section of the code operates just like the code
7147 * in strgetmsg(). There is a comment there about what
7148 * is going on here.
7149 */
7150 if (!(flags & (MSG_HIPRI|MSG_BAND))) {
7151 /* Asking for normal, band0 data */
7152 bp = strget(stp, q, uiop, first, &error);
7153 ASSERT(MUTEX_HELD(&stp->sd_lock));
7154 if (bp != NULL) {
7155 if (DB_TYPE(bp) == M_SIG) {
7156 strsignal_nolock(stp, *bp->b_rptr,
7157 bp->b_band);
7158 freemsg(bp);
7159 continue;
7160 } else {
7161 break;
7162 }
7163 }
7164 if (error != 0) {
7165 goto getmout;
7166 }
7167 /*
7168 * We can't depend on the value of STRPRI here because
7169 * the stream head may be in transit. Therefore, we
7170 * must look at the type of the first message to
7171 * determine if a high priority messages is waiting
7172 */
7173 } else if ((flags & MSG_HIPRI) && q_first != NULL &&
7174 DB_TYPE(q_first) >= QPCTL &&
7175 (bp = getq_noenab(q, 0)) != NULL) {
7176 ASSERT(DB_TYPE(bp) >= QPCTL);
7177 break;
7178 } else if ((flags & MSG_BAND) && q_first != NULL &&
7179 ((q_first->b_band >= *prip) || DB_TYPE(q_first) >= QPCTL) &&
7180 (bp = getq_noenab(q, 0)) != NULL) {
7181 /*
7182 * Asked for at least band "prip" and got either at
7183 * least that band or a hipri message.
7184 */
7185 ASSERT(bp->b_band >= *prip || DB_TYPE(bp) >= QPCTL);
7186 if (DB_TYPE(bp) == M_SIG) {
7187 strsignal_nolock(stp, *bp->b_rptr, bp->b_band);
7188 freemsg(bp);
7189 continue;
7190 } else {
7191 break;
7192 }
7193 }
7194
7195 /* No data. Time to sleep? */
7196 qbackenable(q, 0);
7197
7198 /*
7199 * Delayed error notification?
7200 */
7201 if ((stp->sd_flag & (STRDERR|STPLEX)) &&
7202 (flags & (MSG_IGNERROR|MSG_DELAYERROR)) == MSG_DELAYERROR) {
7203 error = strgeterr(stp, STRDERR|STPLEX,
7204 (flags & MSG_IPEEK));
7205 if (error != 0) {
7206 mutex_exit(&stp->sd_lock);
7207 return (error);
7208 }
7209 }
7210
7211 /*
7212 * If STRHUP or STREOF, return 0 length control and data.
7213 * If a read(fd,buf,0) has been done, do not sleep, just
7214 * return.
7215 *
7216 * If mctlp == NULL and uiop == NULL, then the code will
7217 * do the strwaitq. This is an understood way of saying
7218 * sleep "polling" until a message is received.
7219 */
7220 if ((stp->sd_flag & (STRHUP|STREOF)) ||
7221 (uiop != NULL && uiop->uio_resid == 0)) {
7222 if (mctlp != NULL)
7223 *mctlp = NULL;
7224 *flagsp = 0;
7225 mutex_exit(&stp->sd_lock);
7226 return (0);
7227 }
7228
7229 waitflag = GETWAIT;
7230 if (flags &
7231 (MSG_HOLDSIG|MSG_IGNERROR|MSG_IPEEK|MSG_DELAYERROR)) {
7232 if (flags & MSG_HOLDSIG)
7233 waitflag |= STR_NOSIG;
7234 if (flags & MSG_IGNERROR)
7235 waitflag |= STR_NOERROR;
7236 if (flags & MSG_IPEEK)
7237 waitflag |= STR_PEEK;
7238 if (flags & MSG_DELAYERROR)
7239 waitflag |= STR_DELAYERR;
7240 }
7241 if (uiop != NULL)
7242 fmode = uiop->uio_fmode;
7243 else
7244 fmode = 0;
7245
7246 TRACE_2(TR_FAC_STREAMS_FR, TR_KSTRGETMSG_WAIT,
7247 "kstrgetmsg calls strwaitq:%p, %p",
7248 vp, uiop);
7249 if (((error = strwaitq(stp, waitflag, (ssize_t)0,
7250 fmode, timout, &done))) != 0 || done) {
7251 TRACE_2(TR_FAC_STREAMS_FR, TR_KSTRGETMSG_DONE,
7252 "kstrgetmsg error or done:%p, %p",
7253 vp, uiop);
7254 mutex_exit(&stp->sd_lock);
7255 return (error);
7256 }
7257 TRACE_2(TR_FAC_STREAMS_FR, TR_KSTRGETMSG_AWAKE,
7258 "kstrgetmsg awakes:%p, %p", vp, uiop);
7259 if ((error = i_straccess(stp, JCREAD)) != 0) {
7260 mutex_exit(&stp->sd_lock);
7261 return (error);
7262 }
7263 first = 0;
7264 }
7265 ASSERT(bp != NULL);
7266 /*
7267 * Extract any mark information. If the message is not completely
7268 * consumed this information will be put in the mblk
7269 * that is putback.
7270 * If MSGMARKNEXT is set and the message is completely consumed
7271 * the STRATMARK flag will be set below. Likewise, if
7272 * MSGNOTMARKNEXT is set and the message is
7273 * completely consumed STRNOTATMARK will be set.
7274 */
7275 mark = bp->b_flag & (MSGMARK | MSGMARKNEXT | MSGNOTMARKNEXT);
7276 ASSERT((mark & (MSGMARKNEXT|MSGNOTMARKNEXT)) !=
7277 (MSGMARKNEXT|MSGNOTMARKNEXT));
7278 pri = bp->b_band;
7279 if (mark != 0) {
7280 /*
7281 * If the caller doesn't want the mark return.
7282 * Used to implement MSG_WAITALL in sockets.
7283 */
7284 if (flags & MSG_NOMARK) {
7285 putback(stp, q, bp, pri);
7286 qbackenable(q, pri);
7287 mutex_exit(&stp->sd_lock);
7288 return (EWOULDBLOCK);
7289 }
7290 if (bp == stp->sd_mark) {
7291 mark |= _LASTMARK;
7292 stp->sd_mark = NULL;
7293 }
7294 }
7295
7296 /*
7297 * keep track of the first message type
7298 */
7299 type = bp->b_datap->db_type;
7300
7301 if (bp->b_datap->db_type == M_PASSFP) {
7302 if ((mark & _LASTMARK) && (stp->sd_mark == NULL))
7303 stp->sd_mark = bp;
7304 bp->b_flag |= mark & ~_LASTMARK;
7305 putback(stp, q, bp, pri);
7306 qbackenable(q, pri);
7307 mutex_exit(&stp->sd_lock);
7308 return (EBADMSG);
7309 }
7310 ASSERT(type != M_SIG);
7311
7312 if (flags & MSG_IPEEK) {
7313 /*
7314 * Clear any struioflag - we do the uiomove over again
7315 * when peeking since it simplifies the code.
7316 *
7317 * Dup the message and put the original back on the queue.
7318 * If dupmsg() fails, try again with copymsg() to see if
7319 * there is indeed a shortage of memory. dupmsg() may fail
7320 * if db_ref in any of the messages reaches its limit.
7321 */
7322
7323 if ((nbp = dupmsg(bp)) == NULL && (nbp = copymsg(bp)) == NULL) {
7324 /*
7325 * Restore the state of the stream head since we
7326 * need to drop sd_lock (strwaitbuf is sleeping).
7327 */
7328 size_t size = msgdsize(bp);
7329
7330 if ((mark & _LASTMARK) && (stp->sd_mark == NULL))
7331 stp->sd_mark = bp;
7332 bp->b_flag |= mark & ~_LASTMARK;
7333 putback(stp, q, bp, pri);
7334 mutex_exit(&stp->sd_lock);
7335 error = strwaitbuf(size, BPRI_HI);
7336 if (error) {
7337 /*
7338 * There is no net change to the queue thus
7339 * no need to qbackenable.
7340 */
7341 return (error);
7342 }
7343 goto retry;
7344 }
7345
7346 if ((mark & _LASTMARK) && (stp->sd_mark == NULL))
7347 stp->sd_mark = bp;
7348 bp->b_flag |= mark & ~_LASTMARK;
7349 putback(stp, q, bp, pri);
7350 bp = nbp;
7351 }
7352
7353 /*
7354 * Set this flag so strrput will not generate signals. Need to
7355 * make sure this flag is cleared before leaving this routine
7356 * else signals will stop being sent.
7357 */
7358 stp->sd_flag |= STRGETINPROG;
7359 mutex_exit(&stp->sd_lock);
7360
7361 if ((stp->sd_rputdatafunc != NULL) && (DB_TYPE(bp) == M_DATA)) {
7362 mblk_t *tmp, *prevmp;
7363
7364 /*
7365 * Put first non-data mblk back to stream head and
7366 * cut the mblk chain so sd_rputdatafunc only sees
7367 * M_DATA mblks. We can skip the first mblk since it
7368 * is M_DATA according to the condition above.
7369 */
7370 for (prevmp = bp, tmp = bp->b_cont; tmp != NULL;
7371 prevmp = tmp, tmp = tmp->b_cont) {
7372 if (DB_TYPE(tmp) != M_DATA) {
7373 prevmp->b_cont = NULL;
7374 mutex_enter(&stp->sd_lock);
7375 putback(stp, q, tmp, tmp->b_band);
7376 mutex_exit(&stp->sd_lock);
7377 break;
7378 }
7379 }
7380
7381 bp = (stp->sd_rputdatafunc)(stp->sd_vnode, bp,
7382 NULL, NULL, NULL, NULL);
7383
7384 if (bp == NULL)
7385 goto retry;
7386 }
7387
7388 if (STREAM_NEEDSERVICE(stp))
7389 stream_runservice(stp);
7390
7391 /*
7392 * Set HIPRI flag if message is priority.
7393 */
7394 if (type >= QPCTL)
7395 flg = MSG_HIPRI;
7396 else
7397 flg = MSG_BAND;
7398
7399 /*
7400 * First process PROTO or PCPROTO blocks, if any.
7401 */
7402 if (mctlp != NULL && type != M_DATA) {
7403 mblk_t *nbp;
7404
7405 *mctlp = bp;
7406 while (bp->b_cont && bp->b_cont->b_datap->db_type != M_DATA)
7407 bp = bp->b_cont;
7408 nbp = bp->b_cont;
7409 bp->b_cont = NULL;
7410 bp = nbp;
7411 }
7412
7413 if (bp && bp->b_datap->db_type != M_DATA) {
7414 /*
7415 * More PROTO blocks in msg. Will only happen if mctlp is NULL.
7416 */
7417 more |= MORECTL;
7418 savemp = bp;
7419 while (bp && bp->b_datap->db_type != M_DATA) {
7420 savemptail = bp;
7421 bp = bp->b_cont;
7422 }
7423 savemptail->b_cont = NULL;
7424 }
7425
7426 /*
7427 * Now process DATA blocks, if any.
7428 */
7429 if (uiop == NULL) {
7430 /* Append data to tail of mctlp */
7431
7432 if (mctlp != NULL) {
7433 mblk_t **mpp = mctlp;
7434
7435 while (*mpp != NULL)
7436 mpp = &((*mpp)->b_cont);
7437 *mpp = bp;
7438 bp = NULL;
7439 }
7440 } else if (uiop->uio_resid >= 0 && bp) {
7441 size_t oldresid = uiop->uio_resid;
7442
7443 /*
7444 * If a streams message is likely to consist
7445 * of many small mblks, it is pulled up into
7446 * one continuous chunk of memory.
7447 * The size of the first mblk may be bogus because
7448 * successive read() calls on the socket reduce
7449 * the size of this mblk until it is exhausted
7450 * and then the code walks on to the next. Thus
7451 * the size of the mblk may not be the original size
7452 * that was passed up, it's simply a remainder
7453 * and hence can be very small without any
7454 * implication that the packet is badly fragmented.
7455 * So the size of the possible second mblk is
7456 * used to spot a badly fragmented packet.
7457 * see longer comment at top of page
7458 * by mblk_pull_len declaration.
7459 */
7460
7461 if (bp->b_cont != NULL && MBLKL(bp->b_cont) < mblk_pull_len) {
7462 (void) pullupmsg(bp, -1);
7463 }
7464
7465 bp = struiocopyout(bp, uiop, &error);
7466 if (error != 0) {
7467 if (mctlp != NULL) {
7468 freemsg(*mctlp);
7469 *mctlp = NULL;
7470 } else
7471 freemsg(savemp);
7472 mutex_enter(&stp->sd_lock);
7473 /*
7474 * clear stream head hi pri flag based on
7475 * first message
7476 */
7477 if (!(flags & MSG_IPEEK) && (type >= QPCTL)) {
7478 ASSERT(type == M_PCPROTO);
7479 stp->sd_flag &= ~STRPRI;
7480 }
7481 more = 0;
7482 goto getmout;
7483 }
7484 /*
7485 * (pr == 1) indicates a partial read.
7486 */
7487 if (oldresid > uiop->uio_resid)
7488 pr = 1;
7489 }
7490
7491 if (bp) { /* more data blocks in msg */
7492 more |= MOREDATA;
7493 if (savemp)
7494 savemptail->b_cont = bp;
7495 else
7496 savemp = bp;
7497 }
7498
7499 mutex_enter(&stp->sd_lock);
7500 if (savemp) {
7501 if (flags & (MSG_IPEEK|MSG_DISCARDTAIL)) {
7502 /*
7503 * When MSG_DISCARDTAIL is set or
7504 * when peeking discard any tail. When peeking this
7505 * is the tail of the dup that was copied out - the
7506 * message has already been putback on the queue.
7507 * Return MOREDATA to the caller even though the data
7508 * is discarded. This is used by sockets (to
7509 * set MSG_TRUNC).
7510 */
7511 freemsg(savemp);
7512 if (!(flags & MSG_IPEEK) && (type >= QPCTL)) {
7513 ASSERT(type == M_PCPROTO);
7514 stp->sd_flag &= ~STRPRI;
7515 }
7516 } else if (pr && (savemp->b_datap->db_type == M_DATA) &&
7517 msgnodata(savemp)) {
7518 /*
7519 * Avoid queuing a zero-length tail part of
7520 * a message. pr=1 indicates that we read some of
7521 * the message.
7522 */
7523 freemsg(savemp);
7524 more &= ~MOREDATA;
7525 if (type >= QPCTL) {
7526 ASSERT(type == M_PCPROTO);
7527 stp->sd_flag &= ~STRPRI;
7528 }
7529 } else {
7530 savemp->b_band = pri;
7531 /*
7532 * If the first message was HIPRI and the one we're
7533 * putting back isn't, then clear STRPRI, otherwise
7534 * set STRPRI again. Note that we must set STRPRI
7535 * again since the flush logic in strrput_nondata()
7536 * may have cleared it while we had sd_lock dropped.
7537 */
7538
7539 if (type >= QPCTL) {
7540 ASSERT(type == M_PCPROTO);
7541 if (queclass(savemp) < QPCTL)
7542 stp->sd_flag &= ~STRPRI;
7543 else
7544 stp->sd_flag |= STRPRI;
7545 } else if (queclass(savemp) >= QPCTL) {
7546 /*
7547 * The first message was not a HIPRI message,
7548 * but the one we are about to putback is.
7549 * For simplicitly, we do not allow for HIPRI
7550 * messages to be embedded in the message
7551 * body, so just force it to same type as
7552 * first message.
7553 */
7554 ASSERT(type == M_DATA || type == M_PROTO);
7555 ASSERT(savemp->b_datap->db_type == M_PCPROTO);
7556 savemp->b_datap->db_type = type;
7557 }
7558 if (mark != 0) {
7559 if ((mark & _LASTMARK) &&
7560 (stp->sd_mark == NULL)) {
7561 /*
7562 * If another marked message arrived
7563 * while sd_lock was not held sd_mark
7564 * would be non-NULL.
7565 */
7566 stp->sd_mark = savemp;
7567 }
7568 savemp->b_flag |= mark & ~_LASTMARK;
7569 }
7570 putback(stp, q, savemp, pri);
7571 }
7572 } else if (!(flags & MSG_IPEEK)) {
7573 /*
7574 * The complete message was consumed.
7575 *
7576 * If another M_PCPROTO arrived while sd_lock was not held
7577 * it would have been discarded since STRPRI was still set.
7578 *
7579 * Move the MSG*MARKNEXT information
7580 * to the stream head just in case
7581 * the read queue becomes empty.
7582 * clear stream head hi pri flag based on
7583 * first message
7584 *
7585 * If the stream head was at the mark
7586 * (STRATMARK) before we dropped sd_lock above
7587 * and some data was consumed then we have
7588 * moved past the mark thus STRATMARK is
7589 * cleared. However, if a message arrived in
7590 * strrput during the copyout above causing
7591 * STRATMARK to be set we can not clear that
7592 * flag.
7593 * XXX A "perimeter" would help by single-threading strrput,
7594 * strread, strgetmsg and kstrgetmsg.
7595 */
7596 if (type >= QPCTL) {
7597 ASSERT(type == M_PCPROTO);
7598 stp->sd_flag &= ~STRPRI;
7599 }
7600 if (mark & (MSGMARKNEXT|MSGNOTMARKNEXT|MSGMARK)) {
7601 if (mark & MSGMARKNEXT) {
7602 stp->sd_flag &= ~STRNOTATMARK;
7603 stp->sd_flag |= STRATMARK;
7604 } else if (mark & MSGNOTMARKNEXT) {
7605 stp->sd_flag &= ~STRATMARK;
7606 stp->sd_flag |= STRNOTATMARK;
7607 } else {
7608 stp->sd_flag &= ~(STRATMARK|STRNOTATMARK);
7609 }
7610 } else if (pr && (old_sd_flag & STRATMARK)) {
7611 stp->sd_flag &= ~STRATMARK;
7612 }
7613 }
7614
7615 *flagsp = flg;
7616 *prip = pri;
7617
7618 /*
7619 * Getmsg cleanup processing - if the state of the queue has changed
7620 * some signals may need to be sent and/or poll awakened.
7621 */
7622 getmout:
7623 qbackenable(q, pri);
7624
7625 /*
7626 * We dropped the stream head lock above. Send all M_SIG messages
7627 * before processing stream head for SIGPOLL messages.
7628 */
7629 ASSERT(MUTEX_HELD(&stp->sd_lock));
7630 while ((bp = q->q_first) != NULL &&
7631 (bp->b_datap->db_type == M_SIG)) {
7632 /*
7633 * sd_lock is held so the content of the read queue can not
7634 * change.
7635 */
7636 bp = getq(q);
7637 ASSERT(bp != NULL && bp->b_datap->db_type == M_SIG);
7638
7639 strsignal_nolock(stp, *bp->b_rptr, bp->b_band);
7640 mutex_exit(&stp->sd_lock);
7641 freemsg(bp);
7642 if (STREAM_NEEDSERVICE(stp))
7643 stream_runservice(stp);
7644 mutex_enter(&stp->sd_lock);
7645 }
7646
7647 /*
7648 * stream head cannot change while we make the determination
7649 * whether or not to send a signal. Drop the flag to allow strrput
7650 * to send firstmsgsigs again.
7651 */
7652 stp->sd_flag &= ~STRGETINPROG;
7653
7654 /*
7655 * If the type of message at the front of the queue changed
7656 * due to the receive the appropriate signals and pollwakeup events
7657 * are generated. The type of changes are:
7658 * Processed a hipri message, q_first is not hipri.
7659 * Processed a band X message, and q_first is band Y.
7660 * The generated signals and pollwakeups are identical to what
7661 * strrput() generates should the message that is now on q_first
7662 * arrive to an empty read queue.
7663 *
7664 * Note: only strrput will send a signal for a hipri message.
7665 */
7666 if ((bp = q->q_first) != NULL && !(stp->sd_flag & STRPRI)) {
7667 strsigset_t signals = 0;
7668 strpollset_t pollwakeups = 0;
7669
7670 if (flg & MSG_HIPRI) {
7671 /*
7672 * Removed a hipri message. Regular data at
7673 * the front of the queue.
7674 */
7675 if (bp->b_band == 0) {
7676 signals = S_INPUT | S_RDNORM;
7677 pollwakeups = POLLIN | POLLRDNORM;
7678 } else {
7679 signals = S_INPUT | S_RDBAND;
7680 pollwakeups = POLLIN | POLLRDBAND;
7681 }
7682 } else if (pri != bp->b_band) {
7683 /*
7684 * The band is different for the new q_first.
7685 */
7686 if (bp->b_band == 0) {
7687 signals = S_RDNORM;
7688 pollwakeups = POLLIN | POLLRDNORM;
7689 } else {
7690 signals = S_RDBAND;
7691 pollwakeups = POLLIN | POLLRDBAND;
7692 }
7693 }
7694
7695 if (pollwakeups != 0) {
7696 if (pollwakeups == (POLLIN | POLLRDNORM)) {
7697 if (!(stp->sd_rput_opt & SR_POLLIN))
7698 goto no_pollwake;
7699 stp->sd_rput_opt &= ~SR_POLLIN;
7700 }
7701 mutex_exit(&stp->sd_lock);
7702 pollwakeup(&stp->sd_pollist, pollwakeups);
7703 mutex_enter(&stp->sd_lock);
7704 }
7705 no_pollwake:
7706
7707 if (stp->sd_sigflags & signals)
7708 strsendsig(stp->sd_siglist, signals, bp->b_band, 0);
7709 }
7710 mutex_exit(&stp->sd_lock);
7711
7712 rvp->r_val1 = more;
7713 return (error);
7714 #undef _LASTMARK
7715 }
7716
7717 /*
7718 * Put a message downstream.
7719 *
7720 * NOTE: strputmsg and kstrputmsg have much of the logic in common.
7721 */
7722 int
7723 strputmsg(
7724 struct vnode *vp,
7725 struct strbuf *mctl,
7726 struct strbuf *mdata,
7727 unsigned char pri,
7728 int flag,
7729 int fmode)
7730 {
7731 struct stdata *stp;
7732 queue_t *wqp;
7733 mblk_t *mp;
7734 ssize_t msgsize;
7735 ssize_t rmin, rmax;
7736 int error;
7737 struct uio uios;
7738 struct uio *uiop = &uios;
7739 struct iovec iovs;
7740 int xpg4 = 0;
7741
7742 ASSERT(vp->v_stream);
7743 stp = vp->v_stream;
7744 wqp = stp->sd_wrq;
7745
7746 /*
7747 * If it is an XPG4 application, we need to send
7748 * SIGPIPE below
7749 */
7750
7751 xpg4 = (flag & MSG_XPG4) ? 1 : 0;
7752 flag &= ~MSG_XPG4;
7753
7754 if (AU_AUDITING())
7755 audit_strputmsg(vp, mctl, mdata, pri, flag, fmode);
7756
7757 mutex_enter(&stp->sd_lock);
7758
7759 if ((error = i_straccess(stp, JCWRITE)) != 0) {
7760 mutex_exit(&stp->sd_lock);
7761 return (error);
7762 }
7763
7764 if (stp->sd_flag & (STWRERR|STRHUP|STPLEX)) {
7765 error = strwriteable(stp, B_FALSE, xpg4);
7766 if (error != 0) {
7767 mutex_exit(&stp->sd_lock);
7768 return (error);
7769 }
7770 }
7771
7772 mutex_exit(&stp->sd_lock);
7773
7774 /*
7775 * Check for legal flag value.
7776 */
7777 switch (flag) {
7778 case MSG_HIPRI:
7779 if ((mctl->len < 0) || (pri != 0))
7780 return (EINVAL);
7781 break;
7782 case MSG_BAND:
7783 break;
7784
7785 default:
7786 return (EINVAL);
7787 }
7788
7789 TRACE_1(TR_FAC_STREAMS_FR, TR_STRPUTMSG_IN,
7790 "strputmsg in:stp %p", stp);
7791
7792 /* get these values from those cached in the stream head */
7793 rmin = stp->sd_qn_minpsz;
7794 rmax = stp->sd_qn_maxpsz;
7795
7796 /*
7797 * Make sure ctl and data sizes together fall within the
7798 * limits of the max and min receive packet sizes and do
7799 * not exceed system limit.
7800 */
7801 ASSERT((rmax >= 0) || (rmax == INFPSZ));
7802 if (rmax == 0) {
7803 return (ERANGE);
7804 }
7805 /*
7806 * Use the MAXIMUM of sd_maxblk and q_maxpsz.
7807 * Needed to prevent partial failures in the strmakedata loop.
7808 */
7809 if (stp->sd_maxblk != INFPSZ && rmax != INFPSZ && rmax < stp->sd_maxblk)
7810 rmax = stp->sd_maxblk;
7811
7812 if ((msgsize = mdata->len) < 0) {
7813 msgsize = 0;
7814 rmin = 0; /* no range check for NULL data part */
7815 }
7816 if ((msgsize < rmin) ||
7817 ((msgsize > rmax) && (rmax != INFPSZ)) ||
7818 (mctl->len > strctlsz)) {
7819 return (ERANGE);
7820 }
7821
7822 /*
7823 * Setup uio and iov for data part
7824 */
7825 iovs.iov_base = mdata->buf;
7826 iovs.iov_len = msgsize;
7827 uios.uio_iov = &iovs;
7828 uios.uio_iovcnt = 1;
7829 uios.uio_loffset = 0;
7830 uios.uio_segflg = UIO_USERSPACE;
7831 uios.uio_fmode = fmode;
7832 uios.uio_extflg = UIO_COPY_DEFAULT;
7833 uios.uio_resid = msgsize;
7834 uios.uio_offset = 0;
7835
7836 /* Ignore flow control in strput for HIPRI */
7837 if (flag & MSG_HIPRI)
7838 flag |= MSG_IGNFLOW;
7839
7840 for (;;) {
7841 int done = 0;
7842
7843 /*
7844 * strput will always free the ctl mblk - even when strput
7845 * fails.
7846 */
7847 if ((error = strmakectl(mctl, flag, fmode, &mp)) != 0) {
7848 TRACE_3(TR_FAC_STREAMS_FR, TR_STRPUTMSG_OUT,
7849 "strputmsg out:stp %p out %d error %d",
7850 stp, 1, error);
7851 return (error);
7852 }
7853 /*
7854 * Verify that the whole message can be transferred by
7855 * strput.
7856 */
7857 ASSERT(stp->sd_maxblk == INFPSZ ||
7858 stp->sd_maxblk >= mdata->len);
7859
7860 msgsize = mdata->len;
7861 error = strput(stp, mp, uiop, &msgsize, 0, pri, flag);
7862 mdata->len = msgsize;
7863
7864 if (error == 0)
7865 break;
7866
7867 if (error != EWOULDBLOCK)
7868 goto out;
7869
7870 mutex_enter(&stp->sd_lock);
7871 /*
7872 * Check for a missed wakeup.
7873 * Needed since strput did not hold sd_lock across
7874 * the canputnext.
7875 */
7876 if (bcanputnext(wqp, pri)) {
7877 /* Try again */
7878 mutex_exit(&stp->sd_lock);
7879 continue;
7880 }
7881 TRACE_2(TR_FAC_STREAMS_FR, TR_STRPUTMSG_WAIT,
7882 "strputmsg wait:stp %p waits pri %d", stp, pri);
7883 if (((error = strwaitq(stp, WRITEWAIT, (ssize_t)0, fmode, -1,
7884 &done)) != 0) || done) {
7885 mutex_exit(&stp->sd_lock);
7886 TRACE_3(TR_FAC_STREAMS_FR, TR_STRPUTMSG_OUT,
7887 "strputmsg out:q %p out %d error %d",
7888 stp, 0, error);
7889 return (error);
7890 }
7891 TRACE_1(TR_FAC_STREAMS_FR, TR_STRPUTMSG_WAKE,
7892 "strputmsg wake:stp %p wakes", stp);
7893 if ((error = i_straccess(stp, JCWRITE)) != 0) {
7894 mutex_exit(&stp->sd_lock);
7895 return (error);
7896 }
7897 mutex_exit(&stp->sd_lock);
7898 }
7899 out:
7900 /*
7901 * For historic reasons, applications expect EAGAIN
7902 * when data mblk could not be allocated. so change
7903 * ENOMEM back to EAGAIN
7904 */
7905 if (error == ENOMEM)
7906 error = EAGAIN;
7907 TRACE_3(TR_FAC_STREAMS_FR, TR_STRPUTMSG_OUT,
7908 "strputmsg out:stp %p out %d error %d", stp, 2, error);
7909 return (error);
7910 }
7911
7912 /*
7913 * Put a message downstream.
7914 * Can send only an M_PROTO/M_PCPROTO by passing in a NULL uiop.
7915 * The fmode flag (NDELAY, NONBLOCK) is the or of the flags in the uio
7916 * and the fmode parameter.
7917 *
7918 * This routine handles the consolidation private flags:
7919 * MSG_IGNERROR Ignore any stream head error except STPLEX.
7920 * MSG_HOLDSIG Hold signals while waiting for data.
7921 * MSG_IGNFLOW Don't check streams flow control.
7922 *
7923 * NOTE: strputmsg and kstrputmsg have much of the logic in common.
7924 */
7925 int
7926 kstrputmsg(
7927 struct vnode *vp,
7928 mblk_t *mctl,
7929 struct uio *uiop,
7930 ssize_t msgsize,
7931 unsigned char pri,
7932 int flag,
7933 int fmode)
7934 {
7935 struct stdata *stp;
7936 queue_t *wqp;
7937 ssize_t rmin, rmax;
7938 int error;
7939
7940 ASSERT(vp->v_stream);
7941 stp = vp->v_stream;
7942 wqp = stp->sd_wrq;
7943 if (AU_AUDITING())
7944 audit_strputmsg(vp, NULL, NULL, pri, flag, fmode);
7945 if (mctl == NULL)
7946 return (EINVAL);
7947
7948 mutex_enter(&stp->sd_lock);
7949
7950 if ((error = i_straccess(stp, JCWRITE)) != 0) {
7951 mutex_exit(&stp->sd_lock);
7952 freemsg(mctl);
7953 return (error);
7954 }
7955
7956 if ((stp->sd_flag & STPLEX) || !(flag & MSG_IGNERROR)) {
7957 if (stp->sd_flag & (STWRERR|STRHUP|STPLEX)) {
7958 error = strwriteable(stp, B_FALSE, B_TRUE);
7959 if (error != 0) {
7960 mutex_exit(&stp->sd_lock);
7961 freemsg(mctl);
7962 return (error);
7963 }
7964 }
7965 }
7966
7967 mutex_exit(&stp->sd_lock);
7968
7969 /*
7970 * Check for legal flag value.
7971 */
7972 switch (flag & (MSG_HIPRI|MSG_BAND|MSG_ANY)) {
7973 case MSG_HIPRI:
7974 if (pri != 0) {
7975 freemsg(mctl);
7976 return (EINVAL);
7977 }
7978 break;
7979 case MSG_BAND:
7980 break;
7981 default:
7982 freemsg(mctl);
7983 return (EINVAL);
7984 }
7985
7986 TRACE_1(TR_FAC_STREAMS_FR, TR_KSTRPUTMSG_IN,
7987 "kstrputmsg in:stp %p", stp);
7988
7989 /* get these values from those cached in the stream head */
7990 rmin = stp->sd_qn_minpsz;
7991 rmax = stp->sd_qn_maxpsz;
7992
7993 /*
7994 * Make sure ctl and data sizes together fall within the
7995 * limits of the max and min receive packet sizes and do
7996 * not exceed system limit.
7997 */
7998 ASSERT((rmax >= 0) || (rmax == INFPSZ));
7999 if (rmax == 0) {
8000 freemsg(mctl);
8001 return (ERANGE);
8002 }
8003 /*
8004 * Use the MAXIMUM of sd_maxblk and q_maxpsz.
8005 * Needed to prevent partial failures in the strmakedata loop.
8006 */
8007 if (stp->sd_maxblk != INFPSZ && rmax != INFPSZ && rmax < stp->sd_maxblk)
8008 rmax = stp->sd_maxblk;
8009
8010 if (uiop == NULL) {
8011 msgsize = -1;
8012 rmin = -1; /* no range check for NULL data part */
8013 } else {
8014 /* Use uio flags as well as the fmode parameter flags */
8015 fmode |= uiop->uio_fmode;
8016
8017 if ((msgsize < rmin) ||
8018 ((msgsize > rmax) && (rmax != INFPSZ))) {
8019 freemsg(mctl);
8020 return (ERANGE);
8021 }
8022 }
8023
8024 /* Ignore flow control in strput for HIPRI */
8025 if (flag & MSG_HIPRI)
8026 flag |= MSG_IGNFLOW;
8027
8028 for (;;) {
8029 int done = 0;
8030 int waitflag;
8031 mblk_t *mp;
8032
8033 /*
8034 * strput will always free the ctl mblk - even when strput
8035 * fails. If MSG_IGNFLOW is set then any error returned
8036 * will cause us to break the loop, so we don't need a copy
8037 * of the message. If MSG_IGNFLOW is not set, then we can
8038 * get hit by flow control and be forced to try again. In
8039 * this case we need to have a copy of the message. We
8040 * do this using copymsg since the message may get modified
8041 * by something below us.
8042 *
8043 * We've observed that many TPI providers do not check db_ref
8044 * on the control messages but blindly reuse them for the
8045 * T_OK_ACK/T_ERROR_ACK. Thus using copymsg is more
8046 * friendly to such providers than using dupmsg. Also, note
8047 * that sockfs uses MSG_IGNFLOW for all TPI control messages.
8048 * Only data messages are subject to flow control, hence
8049 * subject to this copymsg.
8050 */
8051 if (flag & MSG_IGNFLOW) {
8052 mp = mctl;
8053 mctl = NULL;
8054 } else {
8055 do {
8056 /*
8057 * If a message has a free pointer, the message
8058 * must be dupmsg to maintain this pointer.
8059 * Code using this facility must be sure
8060 * that modules below will not change the
8061 * contents of the dblk without checking db_ref
8062 * first. If db_ref is > 1, then the module
8063 * needs to do a copymsg first. Otherwise,
8064 * the contents of the dblk may become
8065 * inconsistent because the freesmg/freeb below
8066 * may end up calling atomic_add_32_nv.
8067 * The atomic_add_32_nv in freeb (accessing
8068 * all of db_ref, db_type, db_flags, and
8069 * db_struioflag) does not prevent other threads
8070 * from concurrently trying to modify e.g.
8071 * db_type.
8072 */
8073 if (mctl->b_datap->db_frtnp != NULL)
8074 mp = dupmsg(mctl);
8075 else
8076 mp = copymsg(mctl);
8077
8078 if (mp != NULL)
8079 break;
8080
8081 error = strwaitbuf(msgdsize(mctl), BPRI_MED);
8082 if (error) {
8083 freemsg(mctl);
8084 return (error);
8085 }
8086 } while (mp == NULL);
8087 }
8088 /*
8089 * Verify that all of msgsize can be transferred by
8090 * strput.
8091 */
8092 ASSERT(stp->sd_maxblk == INFPSZ || stp->sd_maxblk >= msgsize);
8093 error = strput(stp, mp, uiop, &msgsize, 0, pri, flag);
8094 if (error == 0)
8095 break;
8096
8097 if (error != EWOULDBLOCK)
8098 goto out;
8099
8100 /*
8101 * IF MSG_IGNFLOW is set we should have broken out of loop
8102 * above.
8103 */
8104 ASSERT(!(flag & MSG_IGNFLOW));
8105 mutex_enter(&stp->sd_lock);
8106 /*
8107 * Check for a missed wakeup.
8108 * Needed since strput did not hold sd_lock across
8109 * the canputnext.
8110 */
8111 if (bcanputnext(wqp, pri)) {
8112 /* Try again */
8113 mutex_exit(&stp->sd_lock);
8114 continue;
8115 }
8116 TRACE_2(TR_FAC_STREAMS_FR, TR_KSTRPUTMSG_WAIT,
8117 "kstrputmsg wait:stp %p waits pri %d", stp, pri);
8118
8119 waitflag = WRITEWAIT;
8120 if (flag & (MSG_HOLDSIG|MSG_IGNERROR)) {
8121 if (flag & MSG_HOLDSIG)
8122 waitflag |= STR_NOSIG;
8123 if (flag & MSG_IGNERROR)
8124 waitflag |= STR_NOERROR;
8125 }
8126 if (((error = strwaitq(stp, waitflag,
8127 (ssize_t)0, fmode, -1, &done)) != 0) || done) {
8128 mutex_exit(&stp->sd_lock);
8129 TRACE_3(TR_FAC_STREAMS_FR, TR_KSTRPUTMSG_OUT,
8130 "kstrputmsg out:stp %p out %d error %d",
8131 stp, 0, error);
8132 freemsg(mctl);
8133 return (error);
8134 }
8135 TRACE_1(TR_FAC_STREAMS_FR, TR_KSTRPUTMSG_WAKE,
8136 "kstrputmsg wake:stp %p wakes", stp);
8137 if ((error = i_straccess(stp, JCWRITE)) != 0) {
8138 mutex_exit(&stp->sd_lock);
8139 freemsg(mctl);
8140 return (error);
8141 }
8142 mutex_exit(&stp->sd_lock);
8143 }
8144 out:
8145 freemsg(mctl);
8146 /*
8147 * For historic reasons, applications expect EAGAIN
8148 * when data mblk could not be allocated. so change
8149 * ENOMEM back to EAGAIN
8150 */
8151 if (error == ENOMEM)
8152 error = EAGAIN;
8153 TRACE_3(TR_FAC_STREAMS_FR, TR_KSTRPUTMSG_OUT,
8154 "kstrputmsg out:stp %p out %d error %d", stp, 2, error);
8155 return (error);
8156 }
8157
8158 /*
8159 * Determines whether the necessary conditions are set on a stream
8160 * for it to be readable, writeable, or have exceptions.
8161 *
8162 * strpoll handles the consolidation private events:
8163 * POLLNOERR Do not return POLLERR even if there are stream
8164 * head errors.
8165 * Used by sockfs.
8166 * POLLRDDATA Do not return POLLIN unless at least one message on
8167 * the queue contains one or more M_DATA mblks. Thus
8168 * when this flag is set a queue with only
8169 * M_PROTO/M_PCPROTO mblks does not return POLLIN.
8170 * Used by sockfs to ignore T_EXDATA_IND messages.
8171 *
8172 * Note: POLLRDDATA assumes that synch streams only return messages with
8173 * an M_DATA attached (i.e. not messages consisting of only
8174 * an M_PROTO/M_PCPROTO part).
8175 */
8176 int
8177 strpoll(
8178 struct stdata *stp,
8179 short events_arg,
8180 int anyyet,
8181 short *reventsp,
8182 struct pollhead **phpp)
8183 {
8184 int events = (ushort_t)events_arg;
8185 int retevents = 0;
8186 mblk_t *mp;
8187 qband_t *qbp;
8188 long sd_flags = stp->sd_flag;
8189 int headlocked = 0;
8190
8191 /*
8192 * For performance, a single 'if' tests for most possible edge
8193 * conditions in one shot
8194 */
8195 if (sd_flags & (STPLEX | STRDERR | STWRERR)) {
8196 if (sd_flags & STPLEX) {
8197 *reventsp = POLLNVAL;
8198 return (EINVAL);
8199 }
8200 if (((events & (POLLIN | POLLRDNORM | POLLRDBAND | POLLPRI)) &&
8201 (sd_flags & STRDERR)) ||
8202 ((events & (POLLOUT | POLLWRNORM | POLLWRBAND)) &&
8203 (sd_flags & STWRERR))) {
8204 if (!(events & POLLNOERR)) {
8205 *reventsp = POLLERR;
8206 return (0);
8207 }
8208 }
8209 }
8210 if (sd_flags & STRHUP) {
8211 retevents |= POLLHUP;
8212 } else if (events & (POLLWRNORM | POLLWRBAND)) {
8213 queue_t *tq;
8214 queue_t *qp = stp->sd_wrq;
8215
8216 claimstr(qp);
8217 /* Find next module forward that has a service procedure */
8218 tq = qp->q_next->q_nfsrv;
8219 ASSERT(tq != NULL);
8220
8221 if (polllock(&stp->sd_pollist, QLOCK(tq)) != 0) {
8222 releasestr(qp);
8223 *reventsp = POLLNVAL;
8224 return (0);
8225 }
8226 if (events & POLLWRNORM) {
8227 queue_t *sqp;
8228
8229 if (tq->q_flag & QFULL)
8230 /* ensure backq svc procedure runs */
8231 tq->q_flag |= QWANTW;
8232 else if ((sqp = stp->sd_struiowrq) != NULL) {
8233 /* Check sync stream barrier write q */
8234 mutex_exit(QLOCK(tq));
8235 if (polllock(&stp->sd_pollist,
8236 QLOCK(sqp)) != 0) {
8237 releasestr(qp);
8238 *reventsp = POLLNVAL;
8239 return (0);
8240 }
8241 if (sqp->q_flag & QFULL)
8242 /* ensure pollwakeup() is done */
8243 sqp->q_flag |= QWANTWSYNC;
8244 else
8245 retevents |= POLLOUT;
8246 /* More write events to process ??? */
8247 if (! (events & POLLWRBAND)) {
8248 mutex_exit(QLOCK(sqp));
8249 releasestr(qp);
8250 goto chkrd;
8251 }
8252 mutex_exit(QLOCK(sqp));
8253 if (polllock(&stp->sd_pollist,
8254 QLOCK(tq)) != 0) {
8255 releasestr(qp);
8256 *reventsp = POLLNVAL;
8257 return (0);
8258 }
8259 } else
8260 retevents |= POLLOUT;
8261 }
8262 if (events & POLLWRBAND) {
8263 qbp = tq->q_bandp;
8264 if (qbp) {
8265 while (qbp) {
8266 if (qbp->qb_flag & QB_FULL)
8267 qbp->qb_flag |= QB_WANTW;
8268 else
8269 retevents |= POLLWRBAND;
8270 qbp = qbp->qb_next;
8271 }
8272 } else {
8273 retevents |= POLLWRBAND;
8274 }
8275 }
8276 mutex_exit(QLOCK(tq));
8277 releasestr(qp);
8278 }
8279 chkrd:
8280 if (sd_flags & STRPRI) {
8281 retevents |= (events & POLLPRI);
8282 } else if (events & (POLLRDNORM | POLLRDBAND | POLLIN)) {
8283 queue_t *qp = _RD(stp->sd_wrq);
8284 int normevents = (events & (POLLIN | POLLRDNORM));
8285
8286 /*
8287 * Note: Need to do polllock() here since ps_lock may be
8288 * held. See bug 4191544.
8289 */
8290 if (polllock(&stp->sd_pollist, &stp->sd_lock) != 0) {
8291 *reventsp = POLLNVAL;
8292 return (0);
8293 }
8294 headlocked = 1;
8295 mp = qp->q_first;
8296 while (mp) {
8297 /*
8298 * For POLLRDDATA we scan b_cont and b_next until we
8299 * find an M_DATA.
8300 */
8301 if ((events & POLLRDDATA) &&
8302 mp->b_datap->db_type != M_DATA) {
8303 mblk_t *nmp = mp->b_cont;
8304
8305 while (nmp != NULL &&
8306 nmp->b_datap->db_type != M_DATA)
8307 nmp = nmp->b_cont;
8308 if (nmp == NULL) {
8309 mp = mp->b_next;
8310 continue;
8311 }
8312 }
8313 if (mp->b_band == 0)
8314 retevents |= normevents;
8315 else
8316 retevents |= (events & (POLLIN | POLLRDBAND));
8317 break;
8318 }
8319 if (! (retevents & normevents) &&
8320 (stp->sd_wakeq & RSLEEP)) {
8321 /*
8322 * Sync stream barrier read queue has data.
8323 */
8324 retevents |= normevents;
8325 }
8326 /* Treat eof as normal data */
8327 if (sd_flags & STREOF)
8328 retevents |= normevents;
8329 }
8330
8331 *reventsp = (short)retevents;
8332 if (retevents && !(events & POLLET)) {
8333 if (headlocked)
8334 mutex_exit(&stp->sd_lock);
8335 return (0);
8336 }
8337
8338 /*
8339 * If poll() has not found any events yet, set up event cell
8340 * to wake up the poll if a requested event occurs on this
8341 * stream. Check for collisions with outstanding poll requests.
8342 */
8343 if (!anyyet) {
8344 *phpp = &stp->sd_pollist;
8345 if (headlocked == 0) {
8346 if (polllock(&stp->sd_pollist, &stp->sd_lock) != 0) {
8347 *reventsp = POLLNVAL;
8348 return (0);
8349 }
8350 headlocked = 1;
8351 }
8352 stp->sd_rput_opt |= SR_POLLIN;
8353 }
8354 if (headlocked)
8355 mutex_exit(&stp->sd_lock);
8356 return (0);
8357 }
8358
8359 /*
8360 * The purpose of putback() is to assure sleeping polls/reads
8361 * are awakened when there are no new messages arriving at the,
8362 * stream head, and a message is placed back on the read queue.
8363 *
8364 * sd_lock must be held when messages are placed back on stream
8365 * head. (getq() holds sd_lock when it removes messages from
8366 * the queue)
8367 */
8368
8369 static void
8370 putback(struct stdata *stp, queue_t *q, mblk_t *bp, int band)
8371 {
8372 mblk_t *qfirst;
8373 ASSERT(MUTEX_HELD(&stp->sd_lock));
8374
8375 /*
8376 * As a result of lock-step ordering around q_lock and sd_lock,
8377 * it's possible for function calls like putnext() and
8378 * canputnext() to get an inaccurate picture of how much
8379 * data is really being processed at the stream head.
8380 * We only consolidate with existing messages on the queue
8381 * if the length of the message we want to put back is smaller
8382 * than the queue hiwater mark.
8383 */
8384 if ((stp->sd_rput_opt & SR_CONSOL_DATA) &&
8385 (DB_TYPE(bp) == M_DATA) && ((qfirst = q->q_first) != NULL) &&
8386 (DB_TYPE(qfirst) == M_DATA) &&
8387 ((qfirst->b_flag & (MSGMARK|MSGDELIM)) == 0) &&
8388 ((bp->b_flag & (MSGMARK|MSGDELIM|MSGMARKNEXT)) == 0) &&
8389 (mp_cont_len(bp, NULL) < q->q_hiwat)) {
8390 /*
8391 * We use the same logic as defined in strrput()
8392 * but in reverse as we are putting back onto the
8393 * queue and want to retain byte ordering.
8394 * Consolidate M_DATA messages with M_DATA ONLY.
8395 * strrput() allows the consolidation of M_DATA onto
8396 * M_PROTO | M_PCPROTO but not the other way round.
8397 *
8398 * The consolidation does not take place if the message
8399 * we are returning to the queue is marked with either
8400 * of the marks or the delim flag or if q_first
8401 * is marked with MSGMARK. The MSGMARK check is needed to
8402 * handle the odd semantics of MSGMARK where essentially
8403 * the whole message is to be treated as marked.
8404 * Carry any MSGMARKNEXT and MSGNOTMARKNEXT from q_first
8405 * to the front of the b_cont chain.
8406 */
8407 rmvq_noenab(q, qfirst);
8408
8409 /*
8410 * The first message in the b_cont list
8411 * tracks MSGMARKNEXT and MSGNOTMARKNEXT.
8412 * We need to handle the case where we
8413 * are appending:
8414 *
8415 * 1) a MSGMARKNEXT to a MSGNOTMARKNEXT.
8416 * 2) a MSGMARKNEXT to a plain message.
8417 * 3) a MSGNOTMARKNEXT to a plain message
8418 * 4) a MSGNOTMARKNEXT to a MSGNOTMARKNEXT
8419 * message.
8420 *
8421 * Thus we never append a MSGMARKNEXT or
8422 * MSGNOTMARKNEXT to a MSGMARKNEXT message.
8423 */
8424 if (qfirst->b_flag & MSGMARKNEXT) {
8425 bp->b_flag |= MSGMARKNEXT;
8426 bp->b_flag &= ~MSGNOTMARKNEXT;
8427 qfirst->b_flag &= ~MSGMARKNEXT;
8428 } else if (qfirst->b_flag & MSGNOTMARKNEXT) {
8429 bp->b_flag |= MSGNOTMARKNEXT;
8430 qfirst->b_flag &= ~MSGNOTMARKNEXT;
8431 }
8432
8433 linkb(bp, qfirst);
8434 }
8435 (void) putbq(q, bp);
8436
8437 /*
8438 * A message may have come in when the sd_lock was dropped in the
8439 * calling routine. If this is the case and STR*ATMARK info was
8440 * received, need to move that from the stream head to the q_last
8441 * so that SIOCATMARK can return the proper value.
8442 */
8443 if (stp->sd_flag & (STRATMARK | STRNOTATMARK)) {
8444 unsigned short *flagp = &q->q_last->b_flag;
8445 uint_t b_flag = (uint_t)*flagp;
8446
8447 if (stp->sd_flag & STRATMARK) {
8448 b_flag &= ~MSGNOTMARKNEXT;
8449 b_flag |= MSGMARKNEXT;
8450 stp->sd_flag &= ~STRATMARK;
8451 } else {
8452 b_flag &= ~MSGMARKNEXT;
8453 b_flag |= MSGNOTMARKNEXT;
8454 stp->sd_flag &= ~STRNOTATMARK;
8455 }
8456 *flagp = (unsigned short) b_flag;
8457 }
8458
8459 #ifdef DEBUG
8460 /*
8461 * Make sure that the flags are not messed up.
8462 */
8463 {
8464 mblk_t *mp;
8465 mp = q->q_last;
8466 while (mp != NULL) {
8467 ASSERT((mp->b_flag & (MSGMARKNEXT|MSGNOTMARKNEXT)) !=
8468 (MSGMARKNEXT|MSGNOTMARKNEXT));
8469 mp = mp->b_cont;
8470 }
8471 }
8472 #endif
8473 if (q->q_first == bp) {
8474 short pollevents;
8475
8476 if (stp->sd_flag & RSLEEP) {
8477 stp->sd_flag &= ~RSLEEP;
8478 cv_broadcast(&q->q_wait);
8479 }
8480 if (stp->sd_flag & STRPRI) {
8481 pollevents = POLLPRI;
8482 } else {
8483 if (band == 0) {
8484 if (!(stp->sd_rput_opt & SR_POLLIN))
8485 return;
8486 stp->sd_rput_opt &= ~SR_POLLIN;
8487 pollevents = POLLIN | POLLRDNORM;
8488 } else {
8489 pollevents = POLLIN | POLLRDBAND;
8490 }
8491 }
8492 mutex_exit(&stp->sd_lock);
8493 pollwakeup(&stp->sd_pollist, pollevents);
8494 mutex_enter(&stp->sd_lock);
8495 }
8496 }
8497
8498 /*
8499 * Return the held vnode attached to the stream head of a
8500 * given queue
8501 * It is the responsibility of the calling routine to ensure
8502 * that the queue does not go away (e.g. pop).
8503 */
8504 vnode_t *
8505 strq2vp(queue_t *qp)
8506 {
8507 vnode_t *vp;
8508 vp = STREAM(qp)->sd_vnode;
8509 ASSERT(vp != NULL);
8510 VN_HOLD(vp);
8511 return (vp);
8512 }
8513
8514 /*
8515 * return the stream head write queue for the given vp
8516 * It is the responsibility of the calling routine to ensure
8517 * that the stream or vnode do not close.
8518 */
8519 queue_t *
8520 strvp2wq(vnode_t *vp)
8521 {
8522 ASSERT(vp->v_stream != NULL);
8523 return (vp->v_stream->sd_wrq);
8524 }
8525
8526 /*
8527 * pollwakeup stream head
8528 * It is the responsibility of the calling routine to ensure
8529 * that the stream or vnode do not close.
8530 */
8531 void
8532 strpollwakeup(vnode_t *vp, short event)
8533 {
8534 ASSERT(vp->v_stream);
8535 pollwakeup(&vp->v_stream->sd_pollist, event);
8536 }
8537
8538 /*
8539 * Mate the stream heads of two vnodes together. If the two vnodes are the
8540 * same, we just make the write-side point at the read-side -- otherwise,
8541 * we do a full mate. Only works on vnodes associated with streams that are
8542 * still being built and thus have only a stream head.
8543 */
8544 void
8545 strmate(vnode_t *vp1, vnode_t *vp2)
8546 {
8547 queue_t *wrq1 = strvp2wq(vp1);
8548 queue_t *wrq2 = strvp2wq(vp2);
8549
8550 /*
8551 * Verify that there are no modules on the stream yet. We also
8552 * rely on the stream head always having a service procedure to
8553 * avoid tweaking q_nfsrv.
8554 */
8555 ASSERT(wrq1->q_next == NULL && wrq2->q_next == NULL);
8556 ASSERT(wrq1->q_qinfo->qi_srvp != NULL);
8557 ASSERT(wrq2->q_qinfo->qi_srvp != NULL);
8558
8559 /*
8560 * If the queues are the same, just twist; otherwise do a full mate.
8561 */
8562 if (wrq1 == wrq2) {
8563 wrq1->q_next = _RD(wrq1);
8564 } else {
8565 wrq1->q_next = _RD(wrq2);
8566 wrq2->q_next = _RD(wrq1);
8567 STREAM(wrq1)->sd_mate = STREAM(wrq2);
8568 STREAM(wrq1)->sd_flag |= STRMATE;
8569 STREAM(wrq2)->sd_mate = STREAM(wrq1);
8570 STREAM(wrq2)->sd_flag |= STRMATE;
8571 }
8572 }
8573
8574 /*
8575 * XXX will go away when console is correctly fixed.
8576 * Clean up the console PIDS, from previous I_SETSIG,
8577 * called only for cnopen which never calls strclean().
8578 */
8579 void
8580 str_cn_clean(struct vnode *vp)
8581 {
8582 strsig_t *ssp, *pssp, *tssp;
8583 struct stdata *stp;
8584 struct pid *pidp;
8585 int update = 0;
8586
8587 ASSERT(vp->v_stream);
8588 stp = vp->v_stream;
8589 pssp = NULL;
8590 mutex_enter(&stp->sd_lock);
8591 ssp = stp->sd_siglist;
8592 while (ssp) {
8593 mutex_enter(&pidlock);
8594 pidp = ssp->ss_pidp;
8595 /*
8596 * Get rid of PID if the proc is gone.
8597 */
8598 if (pidp->pid_prinactive) {
8599 tssp = ssp->ss_next;
8600 if (pssp)
8601 pssp->ss_next = tssp;
8602 else
8603 stp->sd_siglist = tssp;
8604 ASSERT(pidp->pid_ref <= 1);
8605 PID_RELE(ssp->ss_pidp);
8606 mutex_exit(&pidlock);
8607 kmem_free(ssp, sizeof (strsig_t));
8608 update = 1;
8609 ssp = tssp;
8610 continue;
8611 } else
8612 mutex_exit(&pidlock);
8613 pssp = ssp;
8614 ssp = ssp->ss_next;
8615 }
8616 if (update) {
8617 stp->sd_sigflags = 0;
8618 for (ssp = stp->sd_siglist; ssp; ssp = ssp->ss_next)
8619 stp->sd_sigflags |= ssp->ss_events;
8620 }
8621 mutex_exit(&stp->sd_lock);
8622 }
8623
8624 /*
8625 * Return B_TRUE if there is data in the message, B_FALSE otherwise.
8626 */
8627 static boolean_t
8628 msghasdata(mblk_t *bp)
8629 {
8630 for (; bp; bp = bp->b_cont)
8631 if (bp->b_datap->db_type == M_DATA) {
8632 ASSERT(bp->b_wptr >= bp->b_rptr);
8633 if (bp->b_wptr > bp->b_rptr)
8634 return (B_TRUE);
8635 }
8636 return (B_FALSE);
8637 }