1 /*
   2  * CDDL HEADER START
   3  *
   4  * The contents of this file are subject to the terms of the
   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21 /*      Copyright (c) 1984, 1986, 1987, 1988, 1989 AT&T     */
  22 /*        All Rights Reserved   */
  23 
  24 
  25 /*
  26  * Copyright (c) 1988, 2010, Oracle and/or its affiliates. All rights reserved.
  27  */
  28 
  29 #include <sys/types.h>
  30 #include <sys/sysmacros.h>
  31 #include <sys/param.h>
  32 #include <sys/errno.h>
  33 #include <sys/signal.h>
  34 #include <sys/stat.h>
  35 #include <sys/proc.h>
  36 #include <sys/cred.h>
  37 #include <sys/user.h>
  38 #include <sys/vnode.h>
  39 #include <sys/file.h>
  40 #include <sys/stream.h>
  41 #include <sys/strsubr.h>
  42 #include <sys/stropts.h>
  43 #include <sys/tihdr.h>
  44 #include <sys/var.h>
  45 #include <sys/poll.h>
  46 #include <sys/termio.h>
  47 #include <sys/ttold.h>
  48 #include <sys/systm.h>
  49 #include <sys/uio.h>
  50 #include <sys/cmn_err.h>
  51 #include <sys/sad.h>
  52 #include <sys/netstack.h>
  53 #include <sys/priocntl.h>
  54 #include <sys/jioctl.h>
  55 #include <sys/procset.h>
  56 #include <sys/session.h>
  57 #include <sys/kmem.h>
  58 #include <sys/filio.h>
  59 #include <sys/vtrace.h>
  60 #include <sys/debug.h>
  61 #include <sys/strredir.h>
  62 #include <sys/fs/fifonode.h>
  63 #include <sys/fs/snode.h>
  64 #include <sys/strlog.h>
  65 #include <sys/strsun.h>
  66 #include <sys/project.h>
  67 #include <sys/kbio.h>
  68 #include <sys/msio.h>
  69 #include <sys/tty.h>
  70 #include <sys/ptyvar.h>
  71 #include <sys/vuid_event.h>
  72 #include <sys/modctl.h>
  73 #include <sys/sunddi.h>
  74 #include <sys/sunldi_impl.h>
  75 #include <sys/autoconf.h>
  76 #include <sys/policy.h>
  77 #include <sys/dld.h>
  78 #include <sys/zone.h>
  79 #include <c2/audit.h>
  80 
  81 /*
  82  * This define helps improve the readability of streams code while
  83  * still maintaining a very old streams performance enhancement.  The
  84  * performance enhancement basically involved having all callers
  85  * of straccess() perform the first check that straccess() will do
  86  * locally before actually calling straccess().  (There by reducing
  87  * the number of unnecessary calls to straccess().)
  88  */
  89 #define i_straccess(x, y)       ((stp->sd_sidp == NULL) ? 0 : \
  90                                     (stp->sd_vnode->v_type == VFIFO) ? 0 : \
  91                                     straccess((x), (y)))
  92 
  93 /*
  94  * what is mblk_pull_len?
  95  *
  96  * If a streams message consists of many short messages,
  97  * a performance degradation occurs from copyout overhead.
  98  * To decrease the per mblk overhead, messages that are
  99  * likely to consist of many small mblks are pulled up into
 100  * one continuous chunk of memory.
 101  *
 102  * To avoid the processing overhead of examining every
 103  * mblk, a quick heuristic is used. If the first mblk in
 104  * the message is shorter than mblk_pull_len, it is likely
 105  * that the rest of the mblk will be short.
 106  *
 107  * This heuristic was decided upon after performance tests
 108  * indicated that anything more complex slowed down the main
 109  * code path.
 110  */
 111 #define MBLK_PULL_LEN 64
 112 uint32_t mblk_pull_len = MBLK_PULL_LEN;
 113 
 114 /*
 115  * The sgttyb_handling flag controls the handling of the old BSD
 116  * TIOCGETP, TIOCSETP, and TIOCSETN ioctls as follows:
 117  *
 118  * 0 - Emit no warnings at all and retain old, broken behavior.
 119  * 1 - Emit no warnings and silently handle new semantics.
 120  * 2 - Send cmn_err(CE_NOTE) when either TIOCSETP or TIOCSETN is used
 121  *     (once per system invocation).  Handle with new semantics.
 122  * 3 - Send SIGSYS when any TIOCGETP, TIOCSETP, or TIOCSETN call is
 123  *     made (so that offenders drop core and are easy to debug).
 124  *
 125  * The "new semantics" are that TIOCGETP returns B38400 for
 126  * sg_[io]speed if the corresponding value is over B38400, and that
 127  * TIOCSET[PN] accept B38400 in these cases to mean "retain current
 128  * bit rate."
 129  */
 130 int sgttyb_handling = 1;
 131 static boolean_t sgttyb_complaint;
 132 
 133 /* don't push drcompat module by default on Style-2 streams */
 134 static int push_drcompat = 0;
 135 
 136 /*
 137  * id value used to distinguish between different ioctl messages
 138  */
 139 static uint32_t ioc_id;
 140 
 141 static void putback(struct stdata *, queue_t *, mblk_t *, int);
 142 static void strcleanall(struct vnode *);
 143 static int strwsrv(queue_t *);
 144 static int strdocmd(struct stdata *, struct strcmd *, cred_t *);
 145 
 146 /*
 147  * qinit and module_info structures for stream head read and write queues
 148  */
 149 struct module_info strm_info = { 0, "strrhead", 0, INFPSZ, STRHIGH, STRLOW };
 150 struct module_info stwm_info = { 0, "strwhead", 0, 0, 0, 0 };
 151 struct qinit strdata = { strrput, NULL, NULL, NULL, NULL, &strm_info };
 152 struct qinit stwdata = { NULL, strwsrv, NULL, NULL, NULL, &stwm_info };
 153 struct module_info fiform_info = { 0, "fifostrrhead", 0, PIPE_BUF, FIFOHIWAT,
 154     FIFOLOWAT };
 155 struct module_info fifowm_info = { 0, "fifostrwhead", 0, 0, 0, 0 };
 156 struct qinit fifo_strdata = { strrput, NULL, NULL, NULL, NULL, &fiform_info };
 157 struct qinit fifo_stwdata = { NULL, strwsrv, NULL, NULL, NULL, &fifowm_info };
 158 
 159 extern kmutex_t strresources;   /* protects global resources */
 160 extern kmutex_t muxifier;       /* single-threads multiplexor creation */
 161 
 162 static boolean_t msghasdata(mblk_t *bp);
 163 #define msgnodata(bp) (!msghasdata(bp))
 164 
 165 /*
 166  * Stream head locking notes:
 167  *      There are four monitors associated with the stream head:
 168  *      1. v_stream monitor: in stropen() and strclose() v_lock
 169  *              is held while the association of vnode and stream
 170  *              head is established or tested for.
 171  *      2. open/close/push/pop monitor: sd_lock is held while each
 172  *              thread bids for exclusive access to this monitor
 173  *              for opening or closing a stream.  In addition, this
 174  *              monitor is entered during pushes and pops.  This
 175  *              guarantees that during plumbing operations there
 176  *              is only one thread trying to change the plumbing.
 177  *              Any other threads present in the stream are only
 178  *              using the plumbing.
 179  *      3. read/write monitor: in the case of read, a thread holds
 180  *              sd_lock while trying to get data from the stream
 181  *              head queue.  if there is none to fulfill a read
 182  *              request, it sets RSLEEP and calls cv_wait_sig() down
 183  *              in strwaitq() to await the arrival of new data.
 184  *              when new data arrives in strrput(), sd_lock is acquired
 185  *              before testing for RSLEEP and calling cv_broadcast().
 186  *              the behavior of strwrite(), strwsrv(), and WSLEEP
 187  *              mirror this.
 188  *      4. ioctl monitor: sd_lock is gotten to ensure that only one
 189  *              thread is doing an ioctl at a time.
 190  */
 191 
 192 static int
 193 push_mod(queue_t *qp, dev_t *devp, struct stdata *stp, const char *name,
 194     int anchor, cred_t *crp, uint_t anchor_zoneid)
 195 {
 196         int error;
 197         fmodsw_impl_t *fp;
 198 
 199         if (stp->sd_flag & (STRHUP|STRDERR|STWRERR)) {
 200                 error = (stp->sd_flag & STRHUP) ? ENXIO : EIO;
 201                 return (error);
 202         }
 203         if (stp->sd_pushcnt >= nstrpush) {
 204                 return (EINVAL);
 205         }
 206 
 207         if ((fp = fmodsw_find(name, FMODSW_HOLD | FMODSW_LOAD)) == NULL) {
 208                 stp->sd_flag |= STREOPENFAIL;
 209                 return (EINVAL);
 210         }
 211 
 212         /*
 213          * push new module and call its open routine via qattach
 214          */
 215         if ((error = qattach(qp, devp, 0, crp, fp, B_FALSE)) != 0)
 216                 return (error);
 217 
 218         /*
 219          * Check to see if caller wants a STREAMS anchor
 220          * put at this place in the stream, and add if so.
 221          */
 222         mutex_enter(&stp->sd_lock);
 223         if (anchor == stp->sd_pushcnt) {
 224                 stp->sd_anchor = stp->sd_pushcnt;
 225                 stp->sd_anchorzone = anchor_zoneid;
 226         }
 227         mutex_exit(&stp->sd_lock);
 228 
 229         return (0);
 230 }
 231 
 232 /*
 233  * Open a stream device.
 234  */
 235 int
 236 stropen(vnode_t *vp, dev_t *devp, int flag, cred_t *crp)
 237 {
 238         struct stdata *stp;
 239         queue_t *qp;
 240         int s;
 241         dev_t dummydev, savedev;
 242         struct autopush *ap;
 243         struct dlautopush dlap;
 244         int error = 0;
 245         ssize_t rmin, rmax;
 246         int cloneopen;
 247         queue_t *brq;
 248         major_t major;
 249         str_stack_t *ss;
 250         zoneid_t zoneid;
 251         uint_t anchor;
 252 
 253         /*
 254          * If the stream already exists, wait for any open in progress
 255          * to complete, then call the open function of each module and
 256          * driver in the stream.  Otherwise create the stream.
 257          */
 258         TRACE_1(TR_FAC_STREAMS_FR, TR_STROPEN, "stropen:%p", vp);
 259 retry:
 260         mutex_enter(&vp->v_lock);
 261         if ((stp = vp->v_stream) != NULL) {
 262 
 263                 /*
 264                  * Waiting for stream to be created to device
 265                  * due to another open.
 266                  */
 267                 mutex_exit(&vp->v_lock);
 268 
 269                 if (STRMATED(stp)) {
 270                         struct stdata *strmatep = stp->sd_mate;
 271 
 272                         STRLOCKMATES(stp);
 273                         if (strmatep->sd_flag & (STWOPEN|STRCLOSE|STRPLUMB)) {
 274                                 if (flag & (FNDELAY|FNONBLOCK)) {
 275                                         error = EAGAIN;
 276                                         mutex_exit(&strmatep->sd_lock);
 277                                         goto ckreturn;
 278                                 }
 279                                 mutex_exit(&stp->sd_lock);
 280                                 if (!cv_wait_sig(&strmatep->sd_monitor,
 281                                     &strmatep->sd_lock)) {
 282                                         error = EINTR;
 283                                         mutex_exit(&strmatep->sd_lock);
 284                                         mutex_enter(&stp->sd_lock);
 285                                         goto ckreturn;
 286                                 }
 287                                 mutex_exit(&strmatep->sd_lock);
 288                                 goto retry;
 289                         }
 290                         if (stp->sd_flag & (STWOPEN|STRCLOSE|STRPLUMB)) {
 291                                 if (flag & (FNDELAY|FNONBLOCK)) {
 292                                         error = EAGAIN;
 293                                         mutex_exit(&strmatep->sd_lock);
 294                                         goto ckreturn;
 295                                 }
 296                                 mutex_exit(&strmatep->sd_lock);
 297                                 if (!cv_wait_sig(&stp->sd_monitor,
 298                                     &stp->sd_lock)) {
 299                                         error = EINTR;
 300                                         goto ckreturn;
 301                                 }
 302                                 mutex_exit(&stp->sd_lock);
 303                                 goto retry;
 304                         }
 305 
 306                         if (stp->sd_flag & (STRDERR|STWRERR)) {
 307                                 error = EIO;
 308                                 mutex_exit(&strmatep->sd_lock);
 309                                 goto ckreturn;
 310                         }
 311 
 312                         stp->sd_flag |= STWOPEN;
 313                         STRUNLOCKMATES(stp);
 314                 } else {
 315                         mutex_enter(&stp->sd_lock);
 316                         if (stp->sd_flag & (STWOPEN|STRCLOSE|STRPLUMB)) {
 317                                 if (flag & (FNDELAY|FNONBLOCK)) {
 318                                         error = EAGAIN;
 319                                         goto ckreturn;
 320                                 }
 321                                 if (!cv_wait_sig(&stp->sd_monitor,
 322                                     &stp->sd_lock)) {
 323                                         error = EINTR;
 324                                         goto ckreturn;
 325                                 }
 326                                 mutex_exit(&stp->sd_lock);
 327                                 goto retry;  /* could be clone! */
 328                         }
 329 
 330                         if (stp->sd_flag & (STRDERR|STWRERR)) {
 331                                 error = EIO;
 332                                 goto ckreturn;
 333                         }
 334 
 335                         stp->sd_flag |= STWOPEN;
 336                         mutex_exit(&stp->sd_lock);
 337                 }
 338 
 339                 /*
 340                  * Open all modules and devices down stream to notify
 341                  * that another user is streaming.  For modules, set the
 342                  * last argument to MODOPEN and do not pass any open flags.
 343                  * Ignore dummydev since this is not the first open.
 344                  */
 345                 claimstr(stp->sd_wrq);
 346                 qp = stp->sd_wrq;
 347                 while (_SAMESTR(qp)) {
 348                         qp = qp->q_next;
 349                         if ((error = qreopen(_RD(qp), devp, flag, crp)) != 0)
 350                                 break;
 351                 }
 352                 releasestr(stp->sd_wrq);
 353                 mutex_enter(&stp->sd_lock);
 354                 stp->sd_flag &= ~(STRHUP|STWOPEN|STRDERR|STWRERR);
 355                 stp->sd_rerror = 0;
 356                 stp->sd_werror = 0;
 357 ckreturn:
 358                 cv_broadcast(&stp->sd_monitor);
 359                 mutex_exit(&stp->sd_lock);
 360                 return (error);
 361         }
 362 
 363         /*
 364          * This vnode isn't streaming.  SPECFS already
 365          * checked for multiple vnodes pointing to the
 366          * same stream, so create a stream to the driver.
 367          */
 368         qp = allocq();
 369         stp = shalloc(qp);
 370 
 371         /*
 372          * Initialize stream head.  shalloc() has given us
 373          * exclusive access, and we have the vnode locked;
 374          * we can do whatever we want with stp.
 375          */
 376         stp->sd_flag = STWOPEN;
 377         stp->sd_siglist = NULL;
 378         stp->sd_pollist.ph_list = NULL;
 379         stp->sd_sigflags = 0;
 380         stp->sd_mark = NULL;
 381         stp->sd_closetime = STRTIMOUT;
 382         stp->sd_sidp = NULL;
 383         stp->sd_pgidp = NULL;
 384         stp->sd_vnode = vp;
 385         stp->sd_rerror = 0;
 386         stp->sd_werror = 0;
 387         stp->sd_wroff = 0;
 388         stp->sd_tail = 0;
 389         stp->sd_iocblk = NULL;
 390         stp->sd_cmdblk = NULL;
 391         stp->sd_pushcnt = 0;
 392         stp->sd_qn_minpsz = 0;
 393         stp->sd_qn_maxpsz = INFPSZ - 1;      /* used to check for initialization */
 394         stp->sd_maxblk = INFPSZ;
 395         qp->q_ptr = _WR(qp)->q_ptr = stp;
 396         STREAM(qp) = STREAM(_WR(qp)) = stp;
 397         vp->v_stream = stp;
 398         mutex_exit(&vp->v_lock);
 399         if (vp->v_type == VFIFO) {
 400                 stp->sd_flag |= OLDNDELAY;
 401                 /*
 402                  * This means, both for pipes and fifos
 403                  * strwrite will send SIGPIPE if the other
 404                  * end is closed. For putmsg it depends
 405                  * on whether it is a XPG4_2 application
 406                  * or not
 407                  */
 408                 stp->sd_wput_opt = SW_SIGPIPE;
 409 
 410                 /* setq might sleep in kmem_alloc - avoid holding locks. */
 411                 setq(qp, &fifo_strdata, &fifo_stwdata, NULL, QMTSAFE,
 412                     SQ_CI|SQ_CO, B_FALSE);
 413 
 414                 set_qend(qp);
 415                 stp->sd_strtab = fifo_getinfo();
 416                 _WR(qp)->q_nfsrv = _WR(qp);
 417                 qp->q_nfsrv = qp;
 418                 /*
 419                  * Wake up others that are waiting for stream to be created.
 420                  */
 421                 mutex_enter(&stp->sd_lock);
 422                 /*
 423                  * nothing is be pushed on stream yet, so
 424                  * optimized stream head packetsizes are just that
 425                  * of the read queue
 426                  */
 427                 stp->sd_qn_minpsz = qp->q_minpsz;
 428                 stp->sd_qn_maxpsz = qp->q_maxpsz;
 429                 stp->sd_flag &= ~STWOPEN;
 430                 goto fifo_opendone;
 431         }
 432         /* setq might sleep in kmem_alloc - avoid holding locks. */
 433         setq(qp, &strdata, &stwdata, NULL, QMTSAFE, SQ_CI|SQ_CO, B_FALSE);
 434 
 435         set_qend(qp);
 436 
 437         /*
 438          * Open driver and create stream to it (via qattach).
 439          */
 440         savedev = *devp;
 441         cloneopen = (getmajor(*devp) == clone_major);
 442         if ((error = qattach(qp, devp, flag, crp, NULL, B_FALSE)) != 0) {
 443                 mutex_enter(&vp->v_lock);
 444                 vp->v_stream = NULL;
 445                 mutex_exit(&vp->v_lock);
 446                 mutex_enter(&stp->sd_lock);
 447                 cv_broadcast(&stp->sd_monitor);
 448                 mutex_exit(&stp->sd_lock);
 449                 freeq(_RD(qp));
 450                 shfree(stp);
 451                 return (error);
 452         }
 453         /*
 454          * Set sd_strtab after open in order to handle clonable drivers
 455          */
 456         stp->sd_strtab = STREAMSTAB(getmajor(*devp));
 457 
 458         /*
 459          * Historical note: dummydev used to be be prior to the initial
 460          * open (via qattach above), which made the value seen
 461          * inconsistent between an I_PUSH and an autopush of a module.
 462          */
 463         dummydev = *devp;
 464 
 465         /*
 466          * For clone open of old style (Q not associated) network driver,
 467          * push DRMODNAME module to handle DL_ATTACH/DL_DETACH
 468          */
 469         brq = _RD(_WR(qp)->q_next);
 470         major = getmajor(*devp);
 471         if (push_drcompat && cloneopen && NETWORK_DRV(major) &&
 472             ((brq->q_flag & _QASSOCIATED) == 0)) {
 473                 if (push_mod(qp, &dummydev, stp, DRMODNAME, 0, crp, 0) != 0)
 474                         cmn_err(CE_WARN, "cannot push " DRMODNAME
 475                             " streams module");
 476         }
 477 
 478         if (!NETWORK_DRV(major)) {
 479                 savedev = *devp;
 480         } else {
 481                 /*
 482                  * For network devices, process differently based on the
 483                  * return value from dld_autopush():
 484                  *
 485                  *   0: the passed-in device points to a GLDv3 datalink with
 486                  *   per-link autopush configuration; use that configuration
 487                  *   and ignore any per-driver autopush configuration.
 488                  *
 489                  *   1: the passed-in device points to a physical GLDv3
 490                  *   datalink without per-link autopush configuration.  The
 491                  *   passed in device was changed to refer to the actual
 492                  *   physical device (if it's not already); we use that new
 493                  *   device to look up any per-driver autopush configuration.
 494                  *
 495                  *   -1: neither of the above cases applied; use the initial
 496                  *   device to look up any per-driver autopush configuration.
 497                  */
 498                 switch (dld_autopush(&savedev, &dlap)) {
 499                 case 0:
 500                         zoneid = crgetzoneid(crp);
 501                         for (s = 0; s < dlap.dap_npush; s++) {
 502                                 error = push_mod(qp, &dummydev, stp,
 503                                     dlap.dap_aplist[s], dlap.dap_anchor, crp,
 504                                     zoneid);
 505                                 if (error != 0)
 506                                         break;
 507                         }
 508                         goto opendone;
 509                 case 1:
 510                         break;
 511                 case -1:
 512                         savedev = *devp;
 513                         break;
 514                 }
 515         }
 516         /*
 517          * Find the autopush configuration based on "savedev". Start with the
 518          * global zone. If not found check in the local zone.
 519          */
 520         zoneid = GLOBAL_ZONEID;
 521 retryap:
 522         ss = netstack_find_by_stackid(zoneid_to_netstackid(zoneid))->
 523             netstack_str;
 524         if ((ap = sad_ap_find_by_dev(savedev, ss)) == NULL) {
 525                 netstack_rele(ss->ss_netstack);
 526                 if (zoneid == GLOBAL_ZONEID) {
 527                         /*
 528                          * None found. Also look in the zone's autopush table.
 529                          */
 530                         zoneid = crgetzoneid(crp);
 531                         if (zoneid != GLOBAL_ZONEID)
 532                                 goto retryap;
 533                 }
 534                 goto opendone;
 535         }
 536         anchor = ap->ap_anchor;
 537         zoneid = crgetzoneid(crp);
 538         for (s = 0; s < ap->ap_npush; s++) {
 539                 error = push_mod(qp, &dummydev, stp, ap->ap_list[s],
 540                     anchor, crp, zoneid);
 541                 if (error != 0)
 542                         break;
 543         }
 544         sad_ap_rele(ap, ss);
 545         netstack_rele(ss->ss_netstack);
 546 
 547 opendone:
 548 
 549         /*
 550          * let specfs know that open failed part way through
 551          */
 552         if (error) {
 553                 mutex_enter(&stp->sd_lock);
 554                 stp->sd_flag |= STREOPENFAIL;
 555                 mutex_exit(&stp->sd_lock);
 556         }
 557 
 558         /*
 559          * Wake up others that are waiting for stream to be created.
 560          */
 561         mutex_enter(&stp->sd_lock);
 562         stp->sd_flag &= ~STWOPEN;
 563 
 564         /*
 565          * As a performance concern we are caching the values of
 566          * q_minpsz and q_maxpsz of the module below the stream
 567          * head in the stream head.
 568          */
 569         mutex_enter(QLOCK(stp->sd_wrq->q_next));
 570         rmin = stp->sd_wrq->q_next->q_minpsz;
 571         rmax = stp->sd_wrq->q_next->q_maxpsz;
 572         mutex_exit(QLOCK(stp->sd_wrq->q_next));
 573 
 574         /* do this processing here as a performance concern */
 575         if (strmsgsz != 0) {
 576                 if (rmax == INFPSZ)
 577                         rmax = strmsgsz;
 578                 else
 579                         rmax = MIN(strmsgsz, rmax);
 580         }
 581 
 582         mutex_enter(QLOCK(stp->sd_wrq));
 583         stp->sd_qn_minpsz = rmin;
 584         stp->sd_qn_maxpsz = rmax;
 585         mutex_exit(QLOCK(stp->sd_wrq));
 586 
 587 fifo_opendone:
 588         cv_broadcast(&stp->sd_monitor);
 589         mutex_exit(&stp->sd_lock);
 590         return (error);
 591 }
 592 
 593 static int strsink(queue_t *, mblk_t *);
 594 static struct qinit deadrend = {
 595         strsink, NULL, NULL, NULL, NULL, &strm_info, NULL
 596 };
 597 static struct qinit deadwend = {
 598         NULL, NULL, NULL, NULL, NULL, &stwm_info, NULL
 599 };
 600 
 601 /*
 602  * Close a stream.
 603  * This is called from closef() on the last close of an open stream.
 604  * Strclean() will already have removed the siglist and pollist
 605  * information, so all that remains is to remove all multiplexor links
 606  * for the stream, pop all the modules (and the driver), and free the
 607  * stream structure.
 608  */
 609 
 610 int
 611 strclose(struct vnode *vp, int flag, cred_t *crp)
 612 {
 613         struct stdata *stp;
 614         queue_t *qp;
 615         int rval;
 616         int freestp = 1;
 617         queue_t *rmq;
 618 
 619         TRACE_1(TR_FAC_STREAMS_FR,
 620             TR_STRCLOSE, "strclose:%p", vp);
 621         ASSERT(vp->v_stream);
 622 
 623         stp = vp->v_stream;
 624         ASSERT(!(stp->sd_flag & STPLEX));
 625         qp = stp->sd_wrq;
 626 
 627         /*
 628          * Needed so that strpoll will return non-zero for this fd.
 629          * Note that with POLLNOERR STRHUP does still cause POLLHUP.
 630          */
 631         mutex_enter(&stp->sd_lock);
 632         stp->sd_flag |= STRHUP;
 633         mutex_exit(&stp->sd_lock);
 634 
 635         /*
 636          * If the registered process or process group did not have an
 637          * open instance of this stream then strclean would not be
 638          * called. Thus at the time of closing all remaining siglist entries
 639          * are removed.
 640          */
 641         if (stp->sd_siglist != NULL)
 642                 strcleanall(vp);
 643 
 644         ASSERT(stp->sd_siglist == NULL);
 645         ASSERT(stp->sd_sigflags == 0);
 646 
 647         if (STRMATED(stp)) {
 648                 struct stdata *strmatep = stp->sd_mate;
 649                 int waited = 1;
 650 
 651                 STRLOCKMATES(stp);
 652                 while (waited) {
 653                         waited = 0;
 654                         while (stp->sd_flag & (STWOPEN|STRCLOSE|STRPLUMB)) {
 655                                 mutex_exit(&strmatep->sd_lock);
 656                                 cv_wait(&stp->sd_monitor, &stp->sd_lock);
 657                                 mutex_exit(&stp->sd_lock);
 658                                 STRLOCKMATES(stp);
 659                                 waited = 1;
 660                         }
 661                         while (strmatep->sd_flag &
 662                             (STWOPEN|STRCLOSE|STRPLUMB)) {
 663                                 mutex_exit(&stp->sd_lock);
 664                                 cv_wait(&strmatep->sd_monitor,
 665                                     &strmatep->sd_lock);
 666                                 mutex_exit(&strmatep->sd_lock);
 667                                 STRLOCKMATES(stp);
 668                                 waited = 1;
 669                         }
 670                 }
 671                 stp->sd_flag |= STRCLOSE;
 672                 STRUNLOCKMATES(stp);
 673         } else {
 674                 mutex_enter(&stp->sd_lock);
 675                 stp->sd_flag |= STRCLOSE;
 676                 mutex_exit(&stp->sd_lock);
 677         }
 678 
 679         ASSERT(qp->q_first == NULL); /* No more delayed write */
 680 
 681         /* Check if an I_LINK was ever done on this stream */
 682         if (stp->sd_flag & STRHASLINKS) {
 683                 netstack_t *ns;
 684                 str_stack_t *ss;
 685 
 686                 ns = netstack_find_by_cred(crp);
 687                 ASSERT(ns != NULL);
 688                 ss = ns->netstack_str;
 689                 ASSERT(ss != NULL);
 690 
 691                 (void) munlinkall(stp, LINKCLOSE|LINKNORMAL, crp, &rval, ss);
 692                 netstack_rele(ss->ss_netstack);
 693         }
 694 
 695         while (_SAMESTR(qp)) {
 696                 /*
 697                  * Holding sd_lock prevents q_next from changing in
 698                  * this stream.
 699                  */
 700                 mutex_enter(&stp->sd_lock);
 701                 if (!(flag & (FNDELAY|FNONBLOCK)) && (stp->sd_closetime > 0)) {
 702 
 703                         /*
 704                          * sleep until awakened by strwsrv() or timeout
 705                          */
 706                         for (;;) {
 707                                 mutex_enter(QLOCK(qp->q_next));
 708                                 if (!(qp->q_next->q_mblkcnt)) {
 709                                         mutex_exit(QLOCK(qp->q_next));
 710                                         break;
 711                                 }
 712                                 stp->sd_flag |= WSLEEP;
 713 
 714                                 /* ensure strwsrv gets enabled */
 715                                 qp->q_next->q_flag |= QWANTW;
 716                                 mutex_exit(QLOCK(qp->q_next));
 717                                 /* get out if we timed out or recv'd a signal */
 718                                 if (str_cv_wait(&qp->q_wait, &stp->sd_lock,
 719                                     stp->sd_closetime, 0) <= 0) {
 720                                         break;
 721                                 }
 722                         }
 723                         stp->sd_flag &= ~WSLEEP;
 724                 }
 725                 mutex_exit(&stp->sd_lock);
 726 
 727                 rmq = qp->q_next;
 728                 if (rmq->q_flag & QISDRV) {
 729                         ASSERT(!_SAMESTR(rmq));
 730                         wait_sq_svc(_RD(qp)->q_syncq);
 731                 }
 732 
 733                 qdetach(_RD(rmq), 1, flag, crp, B_FALSE);
 734         }
 735 
 736         /*
 737          * Since we call pollwakeup in close() now, the poll list should
 738          * be empty in most cases. The only exception is the layered devices
 739          * (e.g. the console drivers with redirection modules pushed on top
 740          * of it).  We have to do this after calling qdetach() because
 741          * the redirection module won't have torn down the console
 742          * redirection until after qdetach() has been invoked.
 743          */
 744         if (stp->sd_pollist.ph_list != NULL) {
 745                 pollwakeup(&stp->sd_pollist, POLLERR);
 746                 pollhead_clean(&stp->sd_pollist);
 747         }
 748         ASSERT(stp->sd_pollist.ph_list == NULL);
 749         ASSERT(stp->sd_sidp == NULL);
 750         ASSERT(stp->sd_pgidp == NULL);
 751 
 752         /* Prevent qenable from re-enabling the stream head queue */
 753         disable_svc(_RD(qp));
 754 
 755         /*
 756          * Wait until service procedure of each queue is
 757          * run, if QINSERVICE is set.
 758          */
 759         wait_svc(_RD(qp));
 760 
 761         /*
 762          * Now, flush both queues.
 763          */
 764         flushq(_RD(qp), FLUSHALL);
 765         flushq(qp, FLUSHALL);
 766 
 767         /*
 768          * If the write queue of the stream head is pointing to a
 769          * read queue, we have a twisted stream.  If the read queue
 770          * is alive, convert the stream head queues into a dead end.
 771          * If the read queue is dead, free the dead pair.
 772          */
 773         if (qp->q_next && !_SAMESTR(qp)) {
 774                 if (qp->q_next->q_qinfo == &deadrend) {       /* half-closed pipe */
 775                         flushq(qp->q_next, FLUSHALL); /* ensure no message */
 776                         shfree(qp->q_next->q_stream);
 777                         freeq(qp->q_next);
 778                         freeq(_RD(qp));
 779                 } else if (qp->q_next == _RD(qp)) {  /* fifo */
 780                         freeq(_RD(qp));
 781                 } else {                                /* pipe */
 782                         freestp = 0;
 783                         /*
 784                          * The q_info pointers are never accessed when
 785                          * SQLOCK is held.
 786                          */
 787                         ASSERT(qp->q_syncq == _RD(qp)->q_syncq);
 788                         mutex_enter(SQLOCK(qp->q_syncq));
 789                         qp->q_qinfo = &deadwend;
 790                         _RD(qp)->q_qinfo = &deadrend;
 791                         mutex_exit(SQLOCK(qp->q_syncq));
 792                 }
 793         } else {
 794                 freeq(_RD(qp)); /* free stream head queue pair */
 795         }
 796 
 797         mutex_enter(&vp->v_lock);
 798         if (stp->sd_iocblk) {
 799                 if (stp->sd_iocblk != (mblk_t *)-1) {
 800                         freemsg(stp->sd_iocblk);
 801                 }
 802                 stp->sd_iocblk = NULL;
 803         }
 804         stp->sd_vnode = NULL;
 805         vp->v_stream = NULL;
 806         mutex_exit(&vp->v_lock);
 807         mutex_enter(&stp->sd_lock);
 808         freemsg(stp->sd_cmdblk);
 809         stp->sd_cmdblk = NULL;
 810         stp->sd_flag &= ~STRCLOSE;
 811         cv_broadcast(&stp->sd_monitor);
 812         mutex_exit(&stp->sd_lock);
 813 
 814         if (freestp)
 815                 shfree(stp);
 816         return (0);
 817 }
 818 
 819 static int
 820 strsink(queue_t *q, mblk_t *bp)
 821 {
 822         struct copyresp *resp;
 823 
 824         switch (bp->b_datap->db_type) {
 825         case M_FLUSH:
 826                 if ((*bp->b_rptr & FLUSHW) && !(bp->b_flag & MSGNOLOOP)) {
 827                         *bp->b_rptr &= ~FLUSHR;
 828                         bp->b_flag |= MSGNOLOOP;
 829                         /*
 830                          * Protect against the driver passing up
 831                          * messages after it has done a qprocsoff.
 832                          */
 833                         if (_OTHERQ(q)->q_next == NULL)
 834                                 freemsg(bp);
 835                         else
 836                                 qreply(q, bp);
 837                 } else {
 838                         freemsg(bp);
 839                 }
 840                 break;
 841 
 842         case M_COPYIN:
 843         case M_COPYOUT:
 844                 if (bp->b_cont) {
 845                         freemsg(bp->b_cont);
 846                         bp->b_cont = NULL;
 847                 }
 848                 bp->b_datap->db_type = M_IOCDATA;
 849                 bp->b_wptr = bp->b_rptr + sizeof (struct copyresp);
 850                 resp = (struct copyresp *)bp->b_rptr;
 851                 resp->cp_rval = (caddr_t)1;  /* failure */
 852                 /*
 853                  * Protect against the driver passing up
 854                  * messages after it has done a qprocsoff.
 855                  */
 856                 if (_OTHERQ(q)->q_next == NULL)
 857                         freemsg(bp);
 858                 else
 859                         qreply(q, bp);
 860                 break;
 861 
 862         case M_IOCTL:
 863                 if (bp->b_cont) {
 864                         freemsg(bp->b_cont);
 865                         bp->b_cont = NULL;
 866                 }
 867                 bp->b_datap->db_type = M_IOCNAK;
 868                 /*
 869                  * Protect against the driver passing up
 870                  * messages after it has done a qprocsoff.
 871                  */
 872                 if (_OTHERQ(q)->q_next == NULL)
 873                         freemsg(bp);
 874                 else
 875                         qreply(q, bp);
 876                 break;
 877 
 878         default:
 879                 freemsg(bp);
 880                 break;
 881         }
 882 
 883         return (0);
 884 }
 885 
 886 /*
 887  * Clean up after a process when it closes a stream.  This is called
 888  * from closef for all closes, whereas strclose is called only for the
 889  * last close on a stream.  The siglist is scanned for entries for the
 890  * current process, and these are removed.
 891  */
 892 void
 893 strclean(struct vnode *vp)
 894 {
 895         strsig_t *ssp, *pssp, *tssp;
 896         stdata_t *stp;
 897         int update = 0;
 898 
 899         TRACE_1(TR_FAC_STREAMS_FR,
 900             TR_STRCLEAN, "strclean:%p", vp);
 901         stp = vp->v_stream;
 902         pssp = NULL;
 903         mutex_enter(&stp->sd_lock);
 904         ssp = stp->sd_siglist;
 905         while (ssp) {
 906                 if (ssp->ss_pidp == curproc->p_pidp) {
 907                         tssp = ssp->ss_next;
 908                         if (pssp)
 909                                 pssp->ss_next = tssp;
 910                         else
 911                                 stp->sd_siglist = tssp;
 912                         mutex_enter(&pidlock);
 913                         PID_RELE(ssp->ss_pidp);
 914                         mutex_exit(&pidlock);
 915                         kmem_free(ssp, sizeof (strsig_t));
 916                         update = 1;
 917                         ssp = tssp;
 918                 } else {
 919                         pssp = ssp;
 920                         ssp = ssp->ss_next;
 921                 }
 922         }
 923         if (update) {
 924                 stp->sd_sigflags = 0;
 925                 for (ssp = stp->sd_siglist; ssp; ssp = ssp->ss_next)
 926                         stp->sd_sigflags |= ssp->ss_events;
 927         }
 928         mutex_exit(&stp->sd_lock);
 929 }
 930 
 931 /*
 932  * Used on the last close to remove any remaining items on the siglist.
 933  * These could be present on the siglist due to I_ESETSIG calls that
 934  * use process groups or processed that do not have an open file descriptor
 935  * for this stream (Such entries would not be removed by strclean).
 936  */
 937 static void
 938 strcleanall(struct vnode *vp)
 939 {
 940         strsig_t *ssp, *nssp;
 941         stdata_t *stp;
 942 
 943         stp = vp->v_stream;
 944         mutex_enter(&stp->sd_lock);
 945         ssp = stp->sd_siglist;
 946         stp->sd_siglist = NULL;
 947         while (ssp) {
 948                 nssp = ssp->ss_next;
 949                 mutex_enter(&pidlock);
 950                 PID_RELE(ssp->ss_pidp);
 951                 mutex_exit(&pidlock);
 952                 kmem_free(ssp, sizeof (strsig_t));
 953                 ssp = nssp;
 954         }
 955         stp->sd_sigflags = 0;
 956         mutex_exit(&stp->sd_lock);
 957 }
 958 
 959 /*
 960  * Retrieve the next message from the logical stream head read queue
 961  * using either rwnext (if sync stream) or getq_noenab.
 962  * It is the callers responsibility to call qbackenable after
 963  * it is finished with the message. The caller should not call
 964  * qbackenable until after any putback calls to avoid spurious backenabling.
 965  */
 966 mblk_t *
 967 strget(struct stdata *stp, queue_t *q, struct uio *uiop, int first,
 968     int *errorp)
 969 {
 970         mblk_t *bp;
 971         int error;
 972         ssize_t rbytes = 0;
 973 
 974         /* Holding sd_lock prevents the read queue from changing  */
 975         ASSERT(MUTEX_HELD(&stp->sd_lock));
 976 
 977         if (uiop != NULL && stp->sd_struiordq != NULL &&
 978             q->q_first == NULL &&
 979             (!first || (stp->sd_wakeq & RSLEEP))) {
 980                 /*
 981                  * Stream supports rwnext() for the read side.
 982                  * If this is the first time we're called by e.g. strread
 983                  * only do the downcall if there is a deferred wakeup
 984                  * (registered in sd_wakeq).
 985                  */
 986                 struiod_t uiod;
 987 
 988                 if (first)
 989                         stp->sd_wakeq &= ~RSLEEP;
 990 
 991                 (void) uiodup(uiop, &uiod.d_uio, uiod.d_iov,
 992                     sizeof (uiod.d_iov) / sizeof (*uiod.d_iov));
 993                 uiod.d_mp = 0;
 994                 /*
 995                  * Mark that a thread is in rwnext on the read side
 996                  * to prevent strrput from nacking ioctls immediately.
 997                  * When the last concurrent rwnext returns
 998                  * the ioctls are nack'ed.
 999                  */
1000                 ASSERT(MUTEX_HELD(&stp->sd_lock));
1001                 stp->sd_struiodnak++;
1002                 /*
1003                  * Note: rwnext will drop sd_lock.
1004                  */
1005                 error = rwnext(q, &uiod);
1006                 ASSERT(MUTEX_NOT_HELD(&stp->sd_lock));
1007                 mutex_enter(&stp->sd_lock);
1008                 stp->sd_struiodnak--;
1009                 while (stp->sd_struiodnak == 0 &&
1010                     ((bp = stp->sd_struionak) != NULL)) {
1011                         stp->sd_struionak = bp->b_next;
1012                         bp->b_next = NULL;
1013                         bp->b_datap->db_type = M_IOCNAK;
1014                         /*
1015                          * Protect against the driver passing up
1016                          * messages after it has done a qprocsoff.
1017                          */
1018                         if (_OTHERQ(q)->q_next == NULL)
1019                                 freemsg(bp);
1020                         else {
1021                                 mutex_exit(&stp->sd_lock);
1022                                 qreply(q, bp);
1023                                 mutex_enter(&stp->sd_lock);
1024                         }
1025                 }
1026                 ASSERT(MUTEX_HELD(&stp->sd_lock));
1027                 if (error == 0 || error == EWOULDBLOCK) {
1028                         if ((bp = uiod.d_mp) != NULL) {
1029                                 *errorp = 0;
1030                                 ASSERT(MUTEX_HELD(&stp->sd_lock));
1031                                 return (bp);
1032                         }
1033                         error = 0;
1034                 } else if (error == EINVAL) {
1035                         /*
1036                          * The stream plumbing must have
1037                          * changed while we were away, so
1038                          * just turn off rwnext()s.
1039                          */
1040                         error = 0;
1041                 } else if (error == EBUSY) {
1042                         /*
1043                          * The module might have data in transit using putnext
1044                          * Fall back on waiting + getq.
1045                          */
1046                         error = 0;
1047                 } else {
1048                         *errorp = error;
1049                         ASSERT(MUTEX_HELD(&stp->sd_lock));
1050                         return (NULL);
1051                 }
1052                 /*
1053                  * Try a getq in case a rwnext() generated mblk
1054                  * has bubbled up via strrput().
1055                  */
1056         }
1057         *errorp = 0;
1058         ASSERT(MUTEX_HELD(&stp->sd_lock));
1059 
1060         /*
1061          * If we have a valid uio, try and use this as a guide for how
1062          * many bytes to retrieve from the queue via getq_noenab().
1063          * Doing this can avoid unneccesary counting of overlong
1064          * messages in putback(). We currently only do this for sockets
1065          * and only if there is no sd_rputdatafunc hook.
1066          *
1067          * The sd_rputdatafunc hook transforms the entire message
1068          * before any bytes in it can be given to a client. So, rbytes
1069          * must be 0 if there is a hook.
1070          */
1071         if ((uiop != NULL) && (stp->sd_vnode->v_type == VSOCK) &&
1072             (stp->sd_rputdatafunc == NULL))
1073                 rbytes = uiop->uio_resid;
1074 
1075         return (getq_noenab(q, rbytes));
1076 }
1077 
1078 /*
1079  * Copy out the message pointed to by `bp' into the uio pointed to by `uiop'.
1080  * If the message does not fit in the uio the remainder of it is returned;
1081  * otherwise NULL is returned.  Any embedded zero-length mblk_t's are
1082  * consumed, even if uio_resid reaches zero.  On error, `*errorp' is set to
1083  * the error code, the message is consumed, and NULL is returned.
1084  */
1085 static mblk_t *
1086 struiocopyout(mblk_t *bp, struct uio *uiop, int *errorp)
1087 {
1088         int error;
1089         ptrdiff_t n;
1090         mblk_t *nbp;
1091 
1092         ASSERT(bp->b_wptr >= bp->b_rptr);
1093 
1094         do {
1095                 if ((n = MIN(uiop->uio_resid, MBLKL(bp))) != 0) {
1096                         ASSERT(n > 0);
1097 
1098                         error = uiomove(bp->b_rptr, n, UIO_READ, uiop);
1099                         if (error != 0) {
1100                                 freemsg(bp);
1101                                 *errorp = error;
1102                                 return (NULL);
1103                         }
1104                 }
1105 
1106                 bp->b_rptr += n;
1107                 while (bp != NULL && (bp->b_rptr >= bp->b_wptr)) {
1108                         nbp = bp;
1109                         bp = bp->b_cont;
1110                         freeb(nbp);
1111                 }
1112         } while (bp != NULL && uiop->uio_resid > 0);
1113 
1114         *errorp = 0;
1115         return (bp);
1116 }
1117 
1118 /*
1119  * Read a stream according to the mode flags in sd_flag:
1120  *
1121  * (default mode)               - Byte stream, msg boundaries are ignored
1122  * RD_MSGDIS (msg discard)      - Read on msg boundaries and throw away
1123  *                              any data remaining in msg
1124  * RD_MSGNODIS (msg non-discard) - Read on msg boundaries and put back
1125  *                              any remaining data on head of read queue
1126  *
1127  * Consume readable messages on the front of the queue until
1128  * ttolwp(curthread)->lwp_count
1129  * is satisfied, the readable messages are exhausted, or a message
1130  * boundary is reached in a message mode.  If no data was read and
1131  * the stream was not opened with the NDELAY flag, block until data arrives.
1132  * Otherwise return the data read and update the count.
1133  *
1134  * In default mode a 0 length message signifies end-of-file and terminates
1135  * a read in progress.  The 0 length message is removed from the queue
1136  * only if it is the only message read (no data is read).
1137  *
1138  * An attempt to read an M_PROTO or M_PCPROTO message results in an
1139  * EBADMSG error return, unless either RD_PROTDAT or RD_PROTDIS are set.
1140  * If RD_PROTDAT is set, M_PROTO and M_PCPROTO messages are read as data.
1141  * If RD_PROTDIS is set, the M_PROTO and M_PCPROTO parts of the message
1142  * are unlinked from and M_DATA blocks in the message, the protos are
1143  * thrown away, and the data is read.
1144  */
1145 /* ARGSUSED */
1146 int
1147 strread(struct vnode *vp, struct uio *uiop, cred_t *crp)
1148 {
1149         struct stdata *stp;
1150         mblk_t *bp, *nbp;
1151         queue_t *q;
1152         int error = 0;
1153         uint_t old_sd_flag;
1154         int first;
1155         char rflg;
1156         uint_t mark;            /* Contains MSG*MARK and _LASTMARK */
1157 #define _LASTMARK       0x8000  /* Distinct from MSG*MARK */
1158         short delim;
1159         unsigned char pri = 0;
1160         char waitflag;
1161         unsigned char type;
1162 
1163         TRACE_1(TR_FAC_STREAMS_FR,
1164             TR_STRREAD_ENTER, "strread:%p", vp);
1165         ASSERT(vp->v_stream);
1166         stp = vp->v_stream;
1167 
1168         mutex_enter(&stp->sd_lock);
1169 
1170         if ((error = i_straccess(stp, JCREAD)) != 0) {
1171                 mutex_exit(&stp->sd_lock);
1172                 return (error);
1173         }
1174 
1175         if (stp->sd_flag & (STRDERR|STPLEX)) {
1176                 error = strgeterr(stp, STRDERR|STPLEX, 0);
1177                 if (error != 0) {
1178                         mutex_exit(&stp->sd_lock);
1179                         return (error);
1180                 }
1181         }
1182 
1183         /*
1184          * Loop terminates when uiop->uio_resid == 0.
1185          */
1186         rflg = 0;
1187         waitflag = READWAIT;
1188         q = _RD(stp->sd_wrq);
1189         for (;;) {
1190                 ASSERT(MUTEX_HELD(&stp->sd_lock));
1191                 old_sd_flag = stp->sd_flag;
1192                 mark = 0;
1193                 delim = 0;
1194                 first = 1;
1195                 while ((bp = strget(stp, q, uiop, first, &error)) == NULL) {
1196                         int done = 0;
1197 
1198                         ASSERT(MUTEX_HELD(&stp->sd_lock));
1199 
1200                         if (error != 0)
1201                                 goto oops;
1202 
1203                         if (stp->sd_flag & (STRHUP|STREOF)) {
1204                                 goto oops;
1205                         }
1206                         if (rflg && !(stp->sd_flag & STRDELIM)) {
1207                                 goto oops;
1208                         }
1209                         /*
1210                          * If a read(fd,buf,0) has been done, there is no
1211                          * need to sleep. We always have zero bytes to
1212                          * return.
1213                          */
1214                         if (uiop->uio_resid == 0) {
1215                                 goto oops;
1216                         }
1217 
1218                         qbackenable(q, 0);
1219 
1220                         TRACE_3(TR_FAC_STREAMS_FR, TR_STRREAD_WAIT,
1221                             "strread calls strwaitq:%p, %p, %p",
1222                             vp, uiop, crp);
1223                         if ((error = strwaitq(stp, waitflag, uiop->uio_resid,
1224                             uiop->uio_fmode, -1, &done)) != 0 || done) {
1225                                 TRACE_3(TR_FAC_STREAMS_FR, TR_STRREAD_DONE,
1226                                     "strread error or done:%p, %p, %p",
1227                                     vp, uiop, crp);
1228                                 if ((uiop->uio_fmode & FNDELAY) &&
1229                                     (stp->sd_flag & OLDNDELAY) &&
1230                                     (error == EAGAIN))
1231                                         error = 0;
1232                                 goto oops;
1233                         }
1234                         TRACE_3(TR_FAC_STREAMS_FR, TR_STRREAD_AWAKE,
1235                             "strread awakes:%p, %p, %p", vp, uiop, crp);
1236                         if ((error = i_straccess(stp, JCREAD)) != 0) {
1237                                 goto oops;
1238                         }
1239                         first = 0;
1240                 }
1241 
1242                 ASSERT(MUTEX_HELD(&stp->sd_lock));
1243                 ASSERT(bp);
1244                 pri = bp->b_band;
1245                 /*
1246                  * Extract any mark information. If the message is not
1247                  * completely consumed this information will be put in the mblk
1248                  * that is putback.
1249                  * If MSGMARKNEXT is set and the message is completely consumed
1250                  * the STRATMARK flag will be set below. Likewise, if
1251                  * MSGNOTMARKNEXT is set and the message is
1252                  * completely consumed STRNOTATMARK will be set.
1253                  *
1254                  * For some unknown reason strread only breaks the read at the
1255                  * last mark.
1256                  */
1257                 mark = bp->b_flag & (MSGMARK | MSGMARKNEXT | MSGNOTMARKNEXT);
1258                 ASSERT((mark & (MSGMARKNEXT|MSGNOTMARKNEXT)) !=
1259                     (MSGMARKNEXT|MSGNOTMARKNEXT));
1260                 if (mark != 0 && bp == stp->sd_mark) {
1261                         if (rflg) {
1262                                 putback(stp, q, bp, pri);
1263                                 goto oops;
1264                         }
1265                         mark |= _LASTMARK;
1266                         stp->sd_mark = NULL;
1267                 }
1268                 if ((stp->sd_flag & STRDELIM) && (bp->b_flag & MSGDELIM))
1269                         delim = 1;
1270                 mutex_exit(&stp->sd_lock);
1271 
1272                 if (STREAM_NEEDSERVICE(stp))
1273                         stream_runservice(stp);
1274 
1275                 type = bp->b_datap->db_type;
1276 
1277                 switch (type) {
1278 
1279                 case M_DATA:
1280 ismdata:
1281                         if (msgnodata(bp)) {
1282                                 if (mark || delim) {
1283                                         freemsg(bp);
1284                                 } else if (rflg) {
1285 
1286                                         /*
1287                                          * If already read data put zero
1288                                          * length message back on queue else
1289                                          * free msg and return 0.
1290                                          */
1291                                         bp->b_band = pri;
1292                                         mutex_enter(&stp->sd_lock);
1293                                         putback(stp, q, bp, pri);
1294                                         mutex_exit(&stp->sd_lock);
1295                                 } else {
1296                                         freemsg(bp);
1297                                 }
1298                                 error =  0;
1299                                 goto oops1;
1300                         }
1301 
1302                         rflg = 1;
1303                         waitflag |= NOINTR;
1304                         bp = struiocopyout(bp, uiop, &error);
1305                         if (error != 0)
1306                                 goto oops1;
1307 
1308                         mutex_enter(&stp->sd_lock);
1309                         if (bp) {
1310                                 /*
1311                                  * Have remaining data in message.
1312                                  * Free msg if in discard mode.
1313                                  */
1314                                 if (stp->sd_read_opt & RD_MSGDIS) {
1315                                         freemsg(bp);
1316                                 } else {
1317                                         bp->b_band = pri;
1318                                         if ((mark & _LASTMARK) &&
1319                                             (stp->sd_mark == NULL))
1320                                                 stp->sd_mark = bp;
1321                                         bp->b_flag |= mark & ~_LASTMARK;
1322                                         if (delim)
1323                                                 bp->b_flag |= MSGDELIM;
1324                                         if (msgnodata(bp))
1325                                                 freemsg(bp);
1326                                         else
1327                                                 putback(stp, q, bp, pri);
1328                                 }
1329                         } else {
1330                                 /*
1331                                  * Consumed the complete message.
1332                                  * Move the MSG*MARKNEXT information
1333                                  * to the stream head just in case
1334                                  * the read queue becomes empty.
1335                                  *
1336                                  * If the stream head was at the mark
1337                                  * (STRATMARK) before we dropped sd_lock above
1338                                  * and some data was consumed then we have
1339                                  * moved past the mark thus STRATMARK is
1340                                  * cleared. However, if a message arrived in
1341                                  * strrput during the copyout above causing
1342                                  * STRATMARK to be set we can not clear that
1343                                  * flag.
1344                                  */
1345                                 if (mark &
1346                                     (MSGMARKNEXT|MSGNOTMARKNEXT|MSGMARK)) {
1347                                         if (mark & MSGMARKNEXT) {
1348                                                 stp->sd_flag &= ~STRNOTATMARK;
1349                                                 stp->sd_flag |= STRATMARK;
1350                                         } else if (mark & MSGNOTMARKNEXT) {
1351                                                 stp->sd_flag &= ~STRATMARK;
1352                                                 stp->sd_flag |= STRNOTATMARK;
1353                                         } else {
1354                                                 stp->sd_flag &=
1355                                                     ~(STRATMARK|STRNOTATMARK);
1356                                         }
1357                                 } else if (rflg && (old_sd_flag & STRATMARK)) {
1358                                         stp->sd_flag &= ~STRATMARK;
1359                                 }
1360                         }
1361 
1362                         /*
1363                          * Check for signal messages at the front of the read
1364                          * queue and generate the signal(s) if appropriate.
1365                          * The only signal that can be on queue is M_SIG at
1366                          * this point.
1367                          */
1368                         while ((((bp = q->q_first)) != NULL) &&
1369                             (bp->b_datap->db_type == M_SIG)) {
1370                                 bp = getq_noenab(q, 0);
1371                                 /*
1372                                  * sd_lock is held so the content of the
1373                                  * read queue can not change.
1374                                  */
1375                                 ASSERT(bp != NULL && DB_TYPE(bp) == M_SIG);
1376                                 strsignal_nolock(stp, *bp->b_rptr, bp->b_band);
1377                                 mutex_exit(&stp->sd_lock);
1378                                 freemsg(bp);
1379                                 if (STREAM_NEEDSERVICE(stp))
1380                                         stream_runservice(stp);
1381                                 mutex_enter(&stp->sd_lock);
1382                         }
1383 
1384                         if ((uiop->uio_resid == 0) || (mark & _LASTMARK) ||
1385                             delim ||
1386                             (stp->sd_read_opt & (RD_MSGDIS|RD_MSGNODIS))) {
1387                                 goto oops;
1388                         }
1389                         continue;
1390 
1391                 case M_SIG:
1392                         strsignal(stp, *bp->b_rptr, (int32_t)bp->b_band);
1393                         freemsg(bp);
1394                         mutex_enter(&stp->sd_lock);
1395                         continue;
1396 
1397                 case M_PROTO:
1398                 case M_PCPROTO:
1399                         /*
1400                          * Only data messages are readable.
1401                          * Any others generate an error, unless
1402                          * RD_PROTDIS or RD_PROTDAT is set.
1403                          */
1404                         if (stp->sd_read_opt & RD_PROTDAT) {
1405                                 for (nbp = bp; nbp; nbp = nbp->b_next) {
1406                                         if ((nbp->b_datap->db_type ==
1407                                             M_PROTO) ||
1408                                             (nbp->b_datap->db_type ==
1409                                             M_PCPROTO)) {
1410                                                 nbp->b_datap->db_type = M_DATA;
1411                                         } else {
1412                                                 break;
1413                                         }
1414                                 }
1415                                 /*
1416                                  * clear stream head hi pri flag based on
1417                                  * first message
1418                                  */
1419                                 if (type == M_PCPROTO) {
1420                                         mutex_enter(&stp->sd_lock);
1421                                         stp->sd_flag &= ~STRPRI;
1422                                         mutex_exit(&stp->sd_lock);
1423                                 }
1424                                 goto ismdata;
1425                         } else if (stp->sd_read_opt & RD_PROTDIS) {
1426                                 /*
1427                                  * discard non-data messages
1428                                  */
1429                                 while (bp &&
1430                                     ((bp->b_datap->db_type == M_PROTO) ||
1431                                     (bp->b_datap->db_type == M_PCPROTO))) {
1432                                         nbp = unlinkb(bp);
1433                                         freeb(bp);
1434                                         bp = nbp;
1435                                 }
1436                                 /*
1437                                  * clear stream head hi pri flag based on
1438                                  * first message
1439                                  */
1440                                 if (type == M_PCPROTO) {
1441                                         mutex_enter(&stp->sd_lock);
1442                                         stp->sd_flag &= ~STRPRI;
1443                                         mutex_exit(&stp->sd_lock);
1444                                 }
1445                                 if (bp) {
1446                                         bp->b_band = pri;
1447                                         goto ismdata;
1448                                 } else {
1449                                         break;
1450                                 }
1451                         }
1452                         /* FALLTHRU */
1453                 case M_PASSFP:
1454                         if ((bp->b_datap->db_type == M_PASSFP) &&
1455                             (stp->sd_read_opt & RD_PROTDIS)) {
1456                                 freemsg(bp);
1457                                 break;
1458                         }
1459                         mutex_enter(&stp->sd_lock);
1460                         putback(stp, q, bp, pri);
1461                         mutex_exit(&stp->sd_lock);
1462                         if (rflg == 0)
1463                                 error = EBADMSG;
1464                         goto oops1;
1465 
1466                 default:
1467                         /*
1468                          * Garbage on stream head read queue.
1469                          */
1470                         cmn_err(CE_WARN, "bad %x found at stream head\n",
1471                             bp->b_datap->db_type);
1472                         freemsg(bp);
1473                         goto oops1;
1474                 }
1475                 mutex_enter(&stp->sd_lock);
1476         }
1477 oops:
1478         mutex_exit(&stp->sd_lock);
1479 oops1:
1480         qbackenable(q, pri);
1481         return (error);
1482 #undef  _LASTMARK
1483 }
1484 
1485 /*
1486  * Default processing of M_PROTO/M_PCPROTO messages.
1487  * Determine which wakeups and signals are needed.
1488  * This can be replaced by a user-specified procedure for kernel users
1489  * of STREAMS.
1490  */
1491 /* ARGSUSED */
1492 mblk_t *
1493 strrput_proto(vnode_t *vp, mblk_t *mp,
1494     strwakeup_t *wakeups, strsigset_t *firstmsgsigs,
1495     strsigset_t *allmsgsigs, strpollset_t *pollwakeups)
1496 {
1497         *wakeups = RSLEEP;
1498         *allmsgsigs = 0;
1499 
1500         switch (mp->b_datap->db_type) {
1501         case M_PROTO:
1502                 if (mp->b_band == 0) {
1503                         *firstmsgsigs = S_INPUT | S_RDNORM;
1504                         *pollwakeups = POLLIN | POLLRDNORM;
1505                 } else {
1506                         *firstmsgsigs = S_INPUT | S_RDBAND;
1507                         *pollwakeups = POLLIN | POLLRDBAND;
1508                 }
1509                 break;
1510         case M_PCPROTO:
1511                 *firstmsgsigs = S_HIPRI;
1512                 *pollwakeups = POLLPRI;
1513                 break;
1514         }
1515         return (mp);
1516 }
1517 
1518 /*
1519  * Default processing of everything but M_DATA, M_PROTO, M_PCPROTO and
1520  * M_PASSFP messages.
1521  * Determine which wakeups and signals are needed.
1522  * This can be replaced by a user-specified procedure for kernel users
1523  * of STREAMS.
1524  */
1525 /* ARGSUSED */
1526 mblk_t *
1527 strrput_misc(vnode_t *vp, mblk_t *mp,
1528     strwakeup_t *wakeups, strsigset_t *firstmsgsigs,
1529     strsigset_t *allmsgsigs, strpollset_t *pollwakeups)
1530 {
1531         *wakeups = 0;
1532         *firstmsgsigs = 0;
1533         *allmsgsigs = 0;
1534         *pollwakeups = 0;
1535         return (mp);
1536 }
1537 
1538 /*
1539  * Stream read put procedure.  Called from downstream driver/module
1540  * with messages for the stream head.  Data, protocol, and in-stream
1541  * signal messages are placed on the queue, others are handled directly.
1542  */
1543 int
1544 strrput(queue_t *q, mblk_t *bp)
1545 {
1546         struct stdata   *stp;
1547         ulong_t         rput_opt;
1548         strwakeup_t     wakeups;
1549         strsigset_t     firstmsgsigs;   /* Signals if first message on queue */
1550         strsigset_t     allmsgsigs;     /* Signals for all messages */
1551         strsigset_t     signals;        /* Signals events to generate */
1552         strpollset_t    pollwakeups;
1553         mblk_t          *nextbp;
1554         uchar_t         band = 0;
1555         int             hipri_sig;
1556 
1557         stp = (struct stdata *)q->q_ptr;
1558         /*
1559          * Use rput_opt for optimized access to the SR_ flags except
1560          * SR_POLLIN. That flag has to be checked under sd_lock since it
1561          * is modified by strpoll().
1562          */
1563         rput_opt = stp->sd_rput_opt;
1564 
1565         ASSERT(qclaimed(q));
1566         TRACE_2(TR_FAC_STREAMS_FR, TR_STRRPUT_ENTER,
1567             "strrput called with message type:q %p bp %p", q, bp);
1568 
1569         /*
1570          * Perform initial processing and pass to the parameterized functions.
1571          */
1572         ASSERT(bp->b_next == NULL);
1573 
1574         switch (bp->b_datap->db_type) {
1575         case M_DATA:
1576                 /*
1577                  * sockfs is the only consumer of STREOF and when it is set,
1578                  * it implies that the receiver is not interested in receiving
1579                  * any more data, hence the mblk is freed to prevent unnecessary
1580                  * message queueing at the stream head.
1581                  */
1582                 if (stp->sd_flag == STREOF) {
1583                         freemsg(bp);
1584                         return (0);
1585                 }
1586                 if ((rput_opt & SR_IGN_ZEROLEN) &&
1587                     bp->b_rptr == bp->b_wptr && msgnodata(bp)) {
1588                         /*
1589                          * Ignore zero-length M_DATA messages. These might be
1590                          * generated by some transports.
1591                          * The zero-length M_DATA messages, even if they
1592                          * are ignored, should effect the atmark tracking and
1593                          * should wake up a thread sleeping in strwaitmark.
1594                          */
1595                         mutex_enter(&stp->sd_lock);
1596                         if (bp->b_flag & MSGMARKNEXT) {
1597                                 /*
1598                                  * Record the position of the mark either
1599                                  * in q_last or in STRATMARK.
1600                                  */
1601                                 if (q->q_last != NULL) {
1602                                         q->q_last->b_flag &= ~MSGNOTMARKNEXT;
1603                                         q->q_last->b_flag |= MSGMARKNEXT;
1604                                 } else {
1605                                         stp->sd_flag &= ~STRNOTATMARK;
1606                                         stp->sd_flag |= STRATMARK;
1607                                 }
1608                         } else if (bp->b_flag & MSGNOTMARKNEXT) {
1609                                 /*
1610                                  * Record that this is not the position of
1611                                  * the mark either in q_last or in
1612                                  * STRNOTATMARK.
1613                                  */
1614                                 if (q->q_last != NULL) {
1615                                         q->q_last->b_flag &= ~MSGMARKNEXT;
1616                                         q->q_last->b_flag |= MSGNOTMARKNEXT;
1617                                 } else {
1618                                         stp->sd_flag &= ~STRATMARK;
1619                                         stp->sd_flag |= STRNOTATMARK;
1620                                 }
1621                         }
1622                         if (stp->sd_flag & RSLEEP) {
1623                                 stp->sd_flag &= ~RSLEEP;
1624                                 cv_broadcast(&q->q_wait);
1625                         }
1626                         mutex_exit(&stp->sd_lock);
1627                         freemsg(bp);
1628                         return (0);
1629                 }
1630                 wakeups = RSLEEP;
1631                 if (bp->b_band == 0) {
1632                         firstmsgsigs = S_INPUT | S_RDNORM;
1633                         pollwakeups = POLLIN | POLLRDNORM;
1634                 } else {
1635                         firstmsgsigs = S_INPUT | S_RDBAND;
1636                         pollwakeups = POLLIN | POLLRDBAND;
1637                 }
1638                 if (rput_opt & SR_SIGALLDATA)
1639                         allmsgsigs = firstmsgsigs;
1640                 else
1641                         allmsgsigs = 0;
1642 
1643                 mutex_enter(&stp->sd_lock);
1644                 if ((rput_opt & SR_CONSOL_DATA) &&
1645                     (q->q_last != NULL) &&
1646                     (bp->b_flag & (MSGMARK|MSGDELIM)) == 0) {
1647                         /*
1648                          * Consolidate an M_DATA message onto an M_DATA,
1649                          * M_PROTO, or M_PCPROTO by merging it with q_last.
1650                          * The consolidation does not take place if
1651                          * the old message is marked with either of the
1652                          * marks or the delim flag or if the new
1653                          * message is marked with MSGMARK. The MSGMARK
1654                          * check is needed to handle the odd semantics of
1655                          * MSGMARK where essentially the whole message
1656                          * is to be treated as marked.
1657                          * Carry any MSGMARKNEXT  and MSGNOTMARKNEXT from the
1658                          * new message to the front of the b_cont chain.
1659                          */
1660                         mblk_t *lbp = q->q_last;
1661                         unsigned char db_type = lbp->b_datap->db_type;
1662 
1663                         if ((db_type == M_DATA || db_type == M_PROTO ||
1664                             db_type == M_PCPROTO) &&
1665                             !(lbp->b_flag & (MSGDELIM|MSGMARK|MSGMARKNEXT))) {
1666                                 rmvq_noenab(q, lbp);
1667                                 /*
1668                                  * The first message in the b_cont list
1669                                  * tracks MSGMARKNEXT and MSGNOTMARKNEXT.
1670                                  * We need to handle the case where we
1671                                  * are appending:
1672                                  *
1673                                  * 1) a MSGMARKNEXT to a MSGNOTMARKNEXT.
1674                                  * 2) a MSGMARKNEXT to a plain message.
1675                                  * 3) a MSGNOTMARKNEXT to a plain message
1676                                  * 4) a MSGNOTMARKNEXT to a MSGNOTMARKNEXT
1677                                  *    message.
1678                                  *
1679                                  * Thus we never append a MSGMARKNEXT or
1680                                  * MSGNOTMARKNEXT to a MSGMARKNEXT message.
1681                                  */
1682                                 if (bp->b_flag & MSGMARKNEXT) {
1683                                         lbp->b_flag |= MSGMARKNEXT;
1684                                         lbp->b_flag &= ~MSGNOTMARKNEXT;
1685                                         bp->b_flag &= ~MSGMARKNEXT;
1686                                 } else if (bp->b_flag & MSGNOTMARKNEXT) {
1687                                         lbp->b_flag |= MSGNOTMARKNEXT;
1688                                         bp->b_flag &= ~MSGNOTMARKNEXT;
1689                                 }
1690 
1691                                 linkb(lbp, bp);
1692                                 bp = lbp;
1693                                 /*
1694                                  * The new message logically isn't the first
1695                                  * even though the q_first check below thinks
1696                                  * it is. Clear the firstmsgsigs to make it
1697                                  * not appear to be first.
1698                                  */
1699                                 firstmsgsigs = 0;
1700                         }
1701                 }
1702                 break;
1703 
1704         case M_PASSFP:
1705                 wakeups = RSLEEP;
1706                 allmsgsigs = 0;
1707                 if (bp->b_band == 0) {
1708                         firstmsgsigs = S_INPUT | S_RDNORM;
1709                         pollwakeups = POLLIN | POLLRDNORM;
1710                 } else {
1711                         firstmsgsigs = S_INPUT | S_RDBAND;
1712                         pollwakeups = POLLIN | POLLRDBAND;
1713                 }
1714                 mutex_enter(&stp->sd_lock);
1715                 break;
1716 
1717         case M_PROTO:
1718         case M_PCPROTO:
1719                 ASSERT(stp->sd_rprotofunc != NULL);
1720                 bp = (stp->sd_rprotofunc)(stp->sd_vnode, bp,
1721                     &wakeups, &firstmsgsigs, &allmsgsigs, &pollwakeups);
1722 #define ALLSIG  (S_INPUT|S_HIPRI|S_OUTPUT|S_MSG|S_ERROR|S_HANGUP|S_RDNORM|\
1723                 S_WRNORM|S_RDBAND|S_WRBAND|S_BANDURG)
1724 #define ALLPOLL (POLLIN|POLLPRI|POLLOUT|POLLRDNORM|POLLWRNORM|POLLRDBAND|\
1725                 POLLWRBAND)
1726 
1727                 ASSERT((wakeups & ~(RSLEEP|WSLEEP)) == 0);
1728                 ASSERT((firstmsgsigs & ~ALLSIG) == 0);
1729                 ASSERT((allmsgsigs & ~ALLSIG) == 0);
1730                 ASSERT((pollwakeups & ~ALLPOLL) == 0);
1731 
1732                 mutex_enter(&stp->sd_lock);
1733                 break;
1734 
1735         default:
1736                 ASSERT(stp->sd_rmiscfunc != NULL);
1737                 bp = (stp->sd_rmiscfunc)(stp->sd_vnode, bp,
1738                     &wakeups, &firstmsgsigs, &allmsgsigs, &pollwakeups);
1739                 ASSERT((wakeups & ~(RSLEEP|WSLEEP)) == 0);
1740                 ASSERT((firstmsgsigs & ~ALLSIG) == 0);
1741                 ASSERT((allmsgsigs & ~ALLSIG) == 0);
1742                 ASSERT((pollwakeups & ~ALLPOLL) == 0);
1743 #undef  ALLSIG
1744 #undef  ALLPOLL
1745                 mutex_enter(&stp->sd_lock);
1746                 break;
1747         }
1748         ASSERT(MUTEX_HELD(&stp->sd_lock));
1749 
1750         /* By default generate superset of signals */
1751         signals = (firstmsgsigs | allmsgsigs);
1752 
1753         /*
1754          * The  proto and misc functions can return multiple messages
1755          * as a b_next chain. Such messages are processed separately.
1756          */
1757 one_more:
1758         hipri_sig = 0;
1759         if (bp == NULL) {
1760                 nextbp = NULL;
1761         } else {
1762                 nextbp = bp->b_next;
1763                 bp->b_next = NULL;
1764 
1765                 switch (bp->b_datap->db_type) {
1766                 case M_PCPROTO:
1767                         /*
1768                          * Only one priority protocol message is allowed at the
1769                          * stream head at a time.
1770                          */
1771                         if (stp->sd_flag & STRPRI) {
1772                                 TRACE_0(TR_FAC_STREAMS_FR, TR_STRRPUT_PROTERR,
1773                                     "M_PCPROTO already at head");
1774                                 freemsg(bp);
1775                                 mutex_exit(&stp->sd_lock);
1776                                 goto done;
1777                         }
1778                         stp->sd_flag |= STRPRI;
1779                         hipri_sig = 1;
1780                         /* FALLTHRU */
1781                 case M_DATA:
1782                 case M_PROTO:
1783                 case M_PASSFP:
1784                         band = bp->b_band;
1785                         /*
1786                          * Marking doesn't work well when messages
1787                          * are marked in more than one band.  We only
1788                          * remember the last message received, even if
1789                          * it is placed on the queue ahead of other
1790                          * marked messages.
1791                          */
1792                         if (bp->b_flag & MSGMARK)
1793                                 stp->sd_mark = bp;
1794                         (void) putq(q, bp);
1795 
1796                         /*
1797                          * If message is a PCPROTO message, always use
1798                          * firstmsgsigs to determine if a signal should be
1799                          * sent as strrput is the only place to send
1800                          * signals for PCPROTO. Other messages are based on
1801                          * the STRGETINPROG flag. The flag determines if
1802                          * strrput or (k)strgetmsg will be responsible for
1803                          * sending the signals, in the firstmsgsigs case.
1804                          */
1805                         if ((hipri_sig == 1) ||
1806                             (((stp->sd_flag & STRGETINPROG) == 0) &&
1807                             (q->q_first == bp)))
1808                                 signals = (firstmsgsigs | allmsgsigs);
1809                         else
1810                                 signals = allmsgsigs;
1811                         break;
1812 
1813                 default:
1814                         mutex_exit(&stp->sd_lock);
1815                         (void) strrput_nondata(q, bp);
1816                         mutex_enter(&stp->sd_lock);
1817                         break;
1818                 }
1819         }
1820         ASSERT(MUTEX_HELD(&stp->sd_lock));
1821         /*
1822          * Wake sleeping read/getmsg and cancel deferred wakeup
1823          */
1824         if (wakeups & RSLEEP)
1825                 stp->sd_wakeq &= ~RSLEEP;
1826 
1827         wakeups &= stp->sd_flag;
1828         if (wakeups & RSLEEP) {
1829                 stp->sd_flag &= ~RSLEEP;
1830                 cv_broadcast(&q->q_wait);
1831         }
1832         if (wakeups & WSLEEP) {
1833                 stp->sd_flag &= ~WSLEEP;
1834                 cv_broadcast(&_WR(q)->q_wait);
1835         }
1836 
1837         if (pollwakeups != 0) {
1838                 if (pollwakeups == (POLLIN | POLLRDNORM)) {
1839                         /*
1840                          * Can't use rput_opt since it was not
1841                          * read when sd_lock was held and SR_POLLIN is changed
1842                          * by strpoll() under sd_lock.
1843                          */
1844                         if (!(stp->sd_rput_opt & SR_POLLIN))
1845                                 goto no_pollwake;
1846                         stp->sd_rput_opt &= ~SR_POLLIN;
1847                 }
1848                 mutex_exit(&stp->sd_lock);
1849                 pollwakeup(&stp->sd_pollist, pollwakeups);
1850                 mutex_enter(&stp->sd_lock);
1851         }
1852 no_pollwake:
1853 
1854         /*
1855          * strsendsig can handle multiple signals with a
1856          * single call.
1857          */
1858         if (stp->sd_sigflags & signals)
1859                 strsendsig(stp->sd_siglist, signals, band, 0);
1860         mutex_exit(&stp->sd_lock);
1861 
1862 
1863 done:
1864         if (nextbp == NULL)
1865                 return (0);
1866 
1867         /*
1868          * Any signals were handled the first time.
1869          * Wakeups and pollwakeups are redone to avoid any race
1870          * conditions - all the messages are not queued until the
1871          * last message has been processed by strrput.
1872          */
1873         bp = nextbp;
1874         signals = firstmsgsigs = allmsgsigs = 0;
1875         mutex_enter(&stp->sd_lock);
1876         goto one_more;
1877 }
1878 
1879 static void
1880 log_dupioc(queue_t *rq, mblk_t *bp)
1881 {
1882         queue_t *wq, *qp;
1883         char *modnames, *mnp, *dname;
1884         size_t maxmodstr;
1885         boolean_t islast;
1886 
1887         /*
1888          * Allocate a buffer large enough to hold the names of nstrpush modules
1889          * and one driver, with spaces between and NUL terminator.  If we can't
1890          * get memory, then we'll just log the driver name.
1891          */
1892         maxmodstr = nstrpush * (FMNAMESZ + 1);
1893         mnp = modnames = kmem_alloc(maxmodstr, KM_NOSLEEP);
1894 
1895         /* march down write side to print log message down to the driver */
1896         wq = WR(rq);
1897 
1898         /* make sure q_next doesn't shift around while we're grabbing data */
1899         claimstr(wq);
1900         qp = wq->q_next;
1901         do {
1902                 dname = Q2NAME(qp);
1903                 islast = !SAMESTR(qp) || qp->q_next == NULL;
1904                 if (modnames == NULL) {
1905                         /*
1906                          * If we don't have memory, then get the driver name in
1907                          * the log where we can see it.  Note that memory
1908                          * pressure is a possible cause of these sorts of bugs.
1909                          */
1910                         if (islast) {
1911                                 modnames = dname;
1912                                 maxmodstr = 0;
1913                         }
1914                 } else {
1915                         mnp += snprintf(mnp, FMNAMESZ + 1, "%s", dname);
1916                         if (!islast)
1917                                 *mnp++ = ' ';
1918                 }
1919                 qp = qp->q_next;
1920         } while (!islast);
1921         releasestr(wq);
1922         /* Cannot happen unless stream head is corrupt. */
1923         ASSERT(modnames != NULL);
1924         (void) strlog(rq->q_qinfo->qi_minfo->mi_idnum, 0, 1,
1925             SL_CONSOLE|SL_TRACE|SL_ERROR,
1926             "Warning: stream %p received duplicate %X M_IOC%s; module list: %s",
1927             rq->q_ptr, ((struct iocblk *)bp->b_rptr)->ioc_cmd,
1928             (DB_TYPE(bp) == M_IOCACK ? "ACK" : "NAK"), modnames);
1929         if (maxmodstr != 0)
1930                 kmem_free(modnames, maxmodstr);
1931 }
1932 
1933 int
1934 strrput_nondata(queue_t *q, mblk_t *bp)
1935 {
1936         struct stdata *stp;
1937         struct iocblk *iocbp;
1938         struct stroptions *sop;
1939         struct copyreq *reqp;
1940         struct copyresp *resp;
1941         unsigned char bpri;
1942         unsigned char  flushed_already = 0;
1943 
1944         stp = (struct stdata *)q->q_ptr;
1945 
1946         ASSERT(!(stp->sd_flag & STPLEX));
1947         ASSERT(qclaimed(q));
1948 
1949         switch (bp->b_datap->db_type) {
1950         case M_ERROR:
1951                 /*
1952                  * An error has occurred downstream, the errno is in the first
1953                  * bytes of the message.
1954                  */
1955                 if ((bp->b_wptr - bp->b_rptr) == 2) {     /* New flavor */
1956                         unsigned char rw = 0;
1957 
1958                         mutex_enter(&stp->sd_lock);
1959                         if (*bp->b_rptr != NOERROR) {        /* read error */
1960                                 if (*bp->b_rptr != 0) {
1961                                         if (stp->sd_flag & STRDERR)
1962                                                 flushed_already |= FLUSHR;
1963                                         stp->sd_flag |= STRDERR;
1964                                         rw |= FLUSHR;
1965                                 } else {
1966                                         stp->sd_flag &= ~STRDERR;
1967                                 }
1968                                 stp->sd_rerror = *bp->b_rptr;
1969                         }
1970                         bp->b_rptr++;
1971                         if (*bp->b_rptr != NOERROR) {        /* write error */
1972                                 if (*bp->b_rptr != 0) {
1973                                         if (stp->sd_flag & STWRERR)
1974                                                 flushed_already |= FLUSHW;
1975                                         stp->sd_flag |= STWRERR;
1976                                         rw |= FLUSHW;
1977                                 } else {
1978                                         stp->sd_flag &= ~STWRERR;
1979                                 }
1980                                 stp->sd_werror = *bp->b_rptr;
1981                         }
1982                         if (rw) {
1983                                 TRACE_2(TR_FAC_STREAMS_FR, TR_STRRPUT_WAKE,
1984                                     "strrput cv_broadcast:q %p, bp %p",
1985                                     q, bp);
1986                                 cv_broadcast(&q->q_wait); /* readers */
1987                                 cv_broadcast(&_WR(q)->q_wait); /* writers */
1988                                 cv_broadcast(&stp->sd_monitor); /* ioctllers */
1989 
1990                                 mutex_exit(&stp->sd_lock);
1991                                 pollwakeup(&stp->sd_pollist, POLLERR);
1992                                 mutex_enter(&stp->sd_lock);
1993 
1994                                 if (stp->sd_sigflags & S_ERROR)
1995                                         strsendsig(stp->sd_siglist, S_ERROR, 0,
1996                                             ((rw & FLUSHR) ? stp->sd_rerror :
1997                                             stp->sd_werror));
1998                                 mutex_exit(&stp->sd_lock);
1999                                 /*
2000                                  * Send the M_FLUSH only
2001                                  * for the first M_ERROR
2002                                  * message on the stream
2003                                  */
2004                                 if (flushed_already == rw) {
2005                                         freemsg(bp);
2006                                         return (0);
2007                                 }
2008 
2009                                 bp->b_datap->db_type = M_FLUSH;
2010                                 *bp->b_rptr = rw;
2011                                 bp->b_wptr = bp->b_rptr + 1;
2012                                 /*
2013                                  * Protect against the driver
2014                                  * passing up messages after
2015                                  * it has done a qprocsoff
2016                                  */
2017                                 if (_OTHERQ(q)->q_next == NULL)
2018                                         freemsg(bp);
2019                                 else
2020                                         qreply(q, bp);
2021                                 return (0);
2022                         } else
2023                                 mutex_exit(&stp->sd_lock);
2024                 } else if (*bp->b_rptr != 0) {               /* Old flavor */
2025                                 if (stp->sd_flag & (STRDERR|STWRERR))
2026                                         flushed_already = FLUSHRW;
2027                                 mutex_enter(&stp->sd_lock);
2028                                 stp->sd_flag |= (STRDERR|STWRERR);
2029                                 stp->sd_rerror = *bp->b_rptr;
2030                                 stp->sd_werror = *bp->b_rptr;
2031                                 TRACE_2(TR_FAC_STREAMS_FR,
2032                                     TR_STRRPUT_WAKE2,
2033                                     "strrput wakeup #2:q %p, bp %p", q, bp);
2034                                 cv_broadcast(&q->q_wait); /* the readers */
2035                                 cv_broadcast(&_WR(q)->q_wait); /* the writers */
2036                                 cv_broadcast(&stp->sd_monitor); /* ioctllers */
2037 
2038                                 mutex_exit(&stp->sd_lock);
2039                                 pollwakeup(&stp->sd_pollist, POLLERR);
2040                                 mutex_enter(&stp->sd_lock);
2041 
2042                                 if (stp->sd_sigflags & S_ERROR)
2043                                         strsendsig(stp->sd_siglist, S_ERROR, 0,
2044                                             (stp->sd_werror ? stp->sd_werror :
2045                                             stp->sd_rerror));
2046                                 mutex_exit(&stp->sd_lock);
2047 
2048                                 /*
2049                                  * Send the M_FLUSH only
2050                                  * for the first M_ERROR
2051                                  * message on the stream
2052                                  */
2053                                 if (flushed_already != FLUSHRW) {
2054                                         bp->b_datap->db_type = M_FLUSH;
2055                                         *bp->b_rptr = FLUSHRW;
2056                                         /*
2057                                          * Protect against the driver passing up
2058                                          * messages after it has done a
2059                                          * qprocsoff.
2060                                          */
2061                                 if (_OTHERQ(q)->q_next == NULL)
2062                                         freemsg(bp);
2063                                 else
2064                                         qreply(q, bp);
2065                                 return (0);
2066                                 }
2067                 }
2068                 freemsg(bp);
2069                 return (0);
2070 
2071         case M_HANGUP:
2072 
2073                 freemsg(bp);
2074                 mutex_enter(&stp->sd_lock);
2075                 stp->sd_werror = ENXIO;
2076                 stp->sd_flag |= STRHUP;
2077                 stp->sd_flag &= ~(WSLEEP|RSLEEP);
2078 
2079                 /*
2080                  * send signal if controlling tty
2081                  */
2082 
2083                 if (stp->sd_sidp) {
2084                         prsignal(stp->sd_sidp, SIGHUP);
2085                         if (stp->sd_sidp != stp->sd_pgidp)
2086                                 pgsignal(stp->sd_pgidp, SIGTSTP);
2087                 }
2088 
2089                 /*
2090                  * wake up read, write, and exception pollers and
2091                  * reset wakeup mechanism.
2092                  */
2093                 cv_broadcast(&q->q_wait);        /* the readers */
2094                 cv_broadcast(&_WR(q)->q_wait);   /* the writers */
2095                 cv_broadcast(&stp->sd_monitor);  /* the ioctllers */
2096                 strhup(stp);
2097                 mutex_exit(&stp->sd_lock);
2098                 return (0);
2099 
2100         case M_UNHANGUP:
2101                 freemsg(bp);
2102                 mutex_enter(&stp->sd_lock);
2103                 stp->sd_werror = 0;
2104                 stp->sd_flag &= ~STRHUP;
2105                 mutex_exit(&stp->sd_lock);
2106                 return (0);
2107 
2108         case M_SIG:
2109                 /*
2110                  * Someone downstream wants to post a signal.  The
2111                  * signal to post is contained in the first byte of the
2112                  * message.  If the message would go on the front of
2113                  * the queue, send a signal to the process group
2114                  * (if not SIGPOLL) or to the siglist processes
2115                  * (SIGPOLL).  If something is already on the queue,
2116                  * OR if we are delivering a delayed suspend (*sigh*
2117                  * another "tty" hack) and there's no one sleeping already,
2118                  * just enqueue the message.
2119                  */
2120                 mutex_enter(&stp->sd_lock);
2121                 if (q->q_first || (*bp->b_rptr == SIGTSTP &&
2122                     !(stp->sd_flag & RSLEEP))) {
2123                         (void) putq(q, bp);
2124                         mutex_exit(&stp->sd_lock);
2125                         return (0);
2126                 }
2127                 mutex_exit(&stp->sd_lock);
2128                 /* FALLTHRU */
2129 
2130         case M_PCSIG:
2131                 /*
2132                  * Don't enqueue, just post the signal.
2133                  */
2134                 strsignal(stp, *bp->b_rptr, 0L);
2135                 freemsg(bp);
2136                 return (0);
2137 
2138         case M_CMD:
2139                 if (MBLKL(bp) != sizeof (cmdblk_t)) {
2140                         freemsg(bp);
2141                         return (0);
2142                 }
2143 
2144                 mutex_enter(&stp->sd_lock);
2145                 if (stp->sd_flag & STRCMDWAIT) {
2146                         ASSERT(stp->sd_cmdblk == NULL);
2147                         stp->sd_cmdblk = bp;
2148                         cv_broadcast(&stp->sd_monitor);
2149                         mutex_exit(&stp->sd_lock);
2150                 } else {
2151                         mutex_exit(&stp->sd_lock);
2152                         freemsg(bp);
2153                 }
2154                 return (0);
2155 
2156         case M_FLUSH:
2157                 /*
2158                  * Flush queues.  The indication of which queues to flush
2159                  * is in the first byte of the message.  If the read queue
2160                  * is specified, then flush it.  If FLUSHBAND is set, just
2161                  * flush the band specified by the second byte of the message.
2162                  *
2163                  * If a module has issued a M_SETOPT to not flush hi
2164                  * priority messages off of the stream head, then pass this
2165                  * flag into the flushq code to preserve such messages.
2166                  */
2167 
2168                 if (*bp->b_rptr & FLUSHR) {
2169                         mutex_enter(&stp->sd_lock);
2170                         if (*bp->b_rptr & FLUSHBAND) {
2171                                 ASSERT((bp->b_wptr - bp->b_rptr) >= 2);
2172                                 flushband(q, *(bp->b_rptr + 1), FLUSHALL);
2173                         } else
2174                                 flushq_common(q, FLUSHALL,
2175                                     stp->sd_read_opt & RFLUSHPCPROT);
2176                         if ((q->q_first == NULL) ||
2177                             (q->q_first->b_datap->db_type < QPCTL))
2178                                 stp->sd_flag &= ~STRPRI;
2179                         else {
2180                                 ASSERT(stp->sd_flag & STRPRI);
2181                         }
2182                         mutex_exit(&stp->sd_lock);
2183                 }
2184                 if ((*bp->b_rptr & FLUSHW) && !(bp->b_flag & MSGNOLOOP)) {
2185                         *bp->b_rptr &= ~FLUSHR;
2186                         bp->b_flag |= MSGNOLOOP;
2187                         /*
2188                          * Protect against the driver passing up
2189                          * messages after it has done a qprocsoff.
2190                          */
2191                         if (_OTHERQ(q)->q_next == NULL)
2192                                 freemsg(bp);
2193                         else
2194                                 qreply(q, bp);
2195                         return (0);
2196                 }
2197                 freemsg(bp);
2198                 return (0);
2199 
2200         case M_IOCACK:
2201         case M_IOCNAK:
2202                 iocbp = (struct iocblk *)bp->b_rptr;
2203                 /*
2204                  * If not waiting for ACK or NAK then just free msg.
2205                  * If incorrect id sequence number then just free msg.
2206                  * If already have ACK or NAK for user then this is a
2207                  *    duplicate, display a warning and free the msg.
2208                  */
2209                 mutex_enter(&stp->sd_lock);
2210                 if ((stp->sd_flag & IOCWAIT) == 0 || stp->sd_iocblk ||
2211                     (stp->sd_iocid != iocbp->ioc_id)) {
2212                         /*
2213                          * If the ACK/NAK is a dup, display a message
2214                          * Dup is when sd_iocid == ioc_id, and
2215                          * sd_iocblk == <valid ptr> or -1 (the former
2216                          * is when an ioctl has been put on the stream
2217                          * head, but has not yet been consumed, the
2218                          * later is when it has been consumed).
2219                          */
2220                         if ((stp->sd_iocid == iocbp->ioc_id) &&
2221                             (stp->sd_iocblk != NULL)) {
2222                                 log_dupioc(q, bp);
2223                         }
2224                         freemsg(bp);
2225                         mutex_exit(&stp->sd_lock);
2226                         return (0);
2227                 }
2228 
2229                 /*
2230                  * Assign ACK or NAK to user and wake up.
2231                  */
2232                 stp->sd_iocblk = bp;
2233                 cv_broadcast(&stp->sd_monitor);
2234                 mutex_exit(&stp->sd_lock);
2235                 return (0);
2236 
2237         case M_COPYIN:
2238         case M_COPYOUT:
2239                 reqp = (struct copyreq *)bp->b_rptr;
2240 
2241                 /*
2242                  * If not waiting for ACK or NAK then just fail request.
2243                  * If already have ACK, NAK, or copy request, then just
2244                  * fail request.
2245                  * If incorrect id sequence number then just fail request.
2246                  */
2247                 mutex_enter(&stp->sd_lock);
2248                 if ((stp->sd_flag & IOCWAIT) == 0 || stp->sd_iocblk ||
2249                     (stp->sd_iocid != reqp->cq_id)) {
2250                         if (bp->b_cont) {
2251                                 freemsg(bp->b_cont);
2252                                 bp->b_cont = NULL;
2253                         }
2254                         bp->b_datap->db_type = M_IOCDATA;
2255                         bp->b_wptr = bp->b_rptr + sizeof (struct copyresp);
2256                         resp = (struct copyresp *)bp->b_rptr;
2257                         resp->cp_rval = (caddr_t)1;  /* failure */
2258                         mutex_exit(&stp->sd_lock);
2259                         putnext(stp->sd_wrq, bp);
2260                         return (0);
2261                 }
2262 
2263                 /*
2264                  * Assign copy request to user and wake up.
2265                  */
2266                 stp->sd_iocblk = bp;
2267                 cv_broadcast(&stp->sd_monitor);
2268                 mutex_exit(&stp->sd_lock);
2269                 return (0);
2270 
2271         case M_SETOPTS:
2272                 /*
2273                  * Set stream head options (read option, write offset,
2274                  * min/max packet size, and/or high/low water marks for
2275                  * the read side only).
2276                  */
2277 
2278                 bpri = 0;
2279                 sop = (struct stroptions *)bp->b_rptr;
2280                 mutex_enter(&stp->sd_lock);
2281                 if (sop->so_flags & SO_READOPT) {
2282                         switch (sop->so_readopt & RMODEMASK) {
2283                         case RNORM:
2284                                 stp->sd_read_opt &= ~(RD_MSGDIS | RD_MSGNODIS);
2285                                 break;
2286 
2287                         case RMSGD:
2288                                 stp->sd_read_opt =
2289                                     ((stp->sd_read_opt & ~RD_MSGNODIS) |
2290                                     RD_MSGDIS);
2291                                 break;
2292 
2293                         case RMSGN:
2294                                 stp->sd_read_opt =
2295                                     ((stp->sd_read_opt & ~RD_MSGDIS) |
2296                                     RD_MSGNODIS);
2297                                 break;
2298                         }
2299                         switch (sop->so_readopt & RPROTMASK) {
2300                         case RPROTNORM:
2301                                 stp->sd_read_opt &= ~(RD_PROTDAT | RD_PROTDIS);
2302                                 break;
2303 
2304                         case RPROTDAT:
2305                                 stp->sd_read_opt =
2306                                     ((stp->sd_read_opt & ~RD_PROTDIS) |
2307                                     RD_PROTDAT);
2308                                 break;
2309 
2310                         case RPROTDIS:
2311                                 stp->sd_read_opt =
2312                                     ((stp->sd_read_opt & ~RD_PROTDAT) |
2313                                     RD_PROTDIS);
2314                                 break;
2315                         }
2316                         switch (sop->so_readopt & RFLUSHMASK) {
2317                         case RFLUSHPCPROT:
2318                                 /*
2319                                  * This sets the stream head to NOT flush
2320                                  * M_PCPROTO messages.
2321                                  */
2322                                 stp->sd_read_opt |= RFLUSHPCPROT;
2323                                 break;
2324                         }
2325                 }
2326                 if (sop->so_flags & SO_ERROPT) {
2327                         switch (sop->so_erropt & RERRMASK) {
2328                         case RERRNORM:
2329                                 stp->sd_flag &= ~STRDERRNONPERSIST;
2330                                 break;
2331                         case RERRNONPERSIST:
2332                                 stp->sd_flag |= STRDERRNONPERSIST;
2333                                 break;
2334                         }
2335                         switch (sop->so_erropt & WERRMASK) {
2336                         case WERRNORM:
2337                                 stp->sd_flag &= ~STWRERRNONPERSIST;
2338                                 break;
2339                         case WERRNONPERSIST:
2340                                 stp->sd_flag |= STWRERRNONPERSIST;
2341                                 break;
2342                         }
2343                 }
2344                 if (sop->so_flags & SO_COPYOPT) {
2345                         if (sop->so_copyopt & ZCVMSAFE) {
2346                                 stp->sd_copyflag |= STZCVMSAFE;
2347                                 stp->sd_copyflag &= ~STZCVMUNSAFE;
2348                         } else if (sop->so_copyopt & ZCVMUNSAFE) {
2349                                 stp->sd_copyflag |= STZCVMUNSAFE;
2350                                 stp->sd_copyflag &= ~STZCVMSAFE;
2351                         }
2352 
2353                         if (sop->so_copyopt & COPYCACHED) {
2354                                 stp->sd_copyflag |= STRCOPYCACHED;
2355                         }
2356                 }
2357                 if (sop->so_flags & SO_WROFF)
2358                         stp->sd_wroff = sop->so_wroff;
2359                 if (sop->so_flags & SO_TAIL)
2360                         stp->sd_tail = sop->so_tail;
2361                 if (sop->so_flags & SO_MINPSZ)
2362                         q->q_minpsz = sop->so_minpsz;
2363                 if (sop->so_flags & SO_MAXPSZ)
2364                         q->q_maxpsz = sop->so_maxpsz;
2365                 if (sop->so_flags & SO_MAXBLK)
2366                         stp->sd_maxblk = sop->so_maxblk;
2367                 if (sop->so_flags & SO_HIWAT) {
2368                         if (sop->so_flags & SO_BAND) {
2369                                 if (strqset(q, QHIWAT,
2370                                     sop->so_band, sop->so_hiwat)) {
2371                                         cmn_err(CE_WARN, "strrput: could not "
2372                                             "allocate qband\n");
2373                                 } else {
2374                                         bpri = sop->so_band;
2375                                 }
2376                         } else {
2377                                 q->q_hiwat = sop->so_hiwat;
2378                         }
2379                 }
2380                 if (sop->so_flags & SO_LOWAT) {
2381                         if (sop->so_flags & SO_BAND) {
2382                                 if (strqset(q, QLOWAT,
2383                                     sop->so_band, sop->so_lowat)) {
2384                                         cmn_err(CE_WARN, "strrput: could not "
2385                                             "allocate qband\n");
2386                                 } else {
2387                                         bpri = sop->so_band;
2388                                 }
2389                         } else {
2390                                 q->q_lowat = sop->so_lowat;
2391                         }
2392                 }
2393                 if (sop->so_flags & SO_MREADON)
2394                         stp->sd_flag |= SNDMREAD;
2395                 if (sop->so_flags & SO_MREADOFF)
2396                         stp->sd_flag &= ~SNDMREAD;
2397                 if (sop->so_flags & SO_NDELON)
2398                         stp->sd_flag |= OLDNDELAY;
2399                 if (sop->so_flags & SO_NDELOFF)
2400                         stp->sd_flag &= ~OLDNDELAY;
2401                 if (sop->so_flags & SO_ISTTY)
2402                         stp->sd_flag |= STRISTTY;
2403                 if (sop->so_flags & SO_ISNTTY)
2404                         stp->sd_flag &= ~STRISTTY;
2405                 if (sop->so_flags & SO_TOSTOP)
2406                         stp->sd_flag |= STRTOSTOP;
2407                 if (sop->so_flags & SO_TONSTOP)
2408                         stp->sd_flag &= ~STRTOSTOP;
2409                 if (sop->so_flags & SO_DELIM)
2410                         stp->sd_flag |= STRDELIM;
2411                 if (sop->so_flags & SO_NODELIM)
2412                         stp->sd_flag &= ~STRDELIM;
2413 
2414                 mutex_exit(&stp->sd_lock);
2415                 freemsg(bp);
2416 
2417                 /* Check backenable in case the water marks changed */
2418                 qbackenable(q, bpri);
2419                 return (0);
2420 
2421         /*
2422          * The following set of cases deal with situations where two stream
2423          * heads are connected to each other (twisted streams).  These messages
2424          * have no meaning at the stream head.
2425          */
2426         case M_BREAK:
2427         case M_CTL:
2428         case M_DELAY:
2429         case M_START:
2430         case M_STOP:
2431         case M_IOCDATA:
2432         case M_STARTI:
2433         case M_STOPI:
2434                 freemsg(bp);
2435                 return (0);
2436 
2437         case M_IOCTL:
2438                 /*
2439                  * Always NAK this condition
2440                  * (makes no sense)
2441                  * If there is one or more threads in the read side
2442                  * rwnext we have to defer the nacking until that thread
2443                  * returns (in strget).
2444                  */
2445                 mutex_enter(&stp->sd_lock);
2446                 if (stp->sd_struiodnak != 0) {
2447                         /*
2448                          * Defer NAK to the streamhead. Queue at the end
2449                          * the list.
2450                          */
2451                         mblk_t *mp = stp->sd_struionak;
2452 
2453                         while (mp && mp->b_next)
2454                                 mp = mp->b_next;
2455                         if (mp)
2456                                 mp->b_next = bp;
2457                         else
2458                                 stp->sd_struionak = bp;
2459                         bp->b_next = NULL;
2460                         mutex_exit(&stp->sd_lock);
2461                         return (0);
2462                 }
2463                 mutex_exit(&stp->sd_lock);
2464 
2465                 bp->b_datap->db_type = M_IOCNAK;
2466                 /*
2467                  * Protect against the driver passing up
2468                  * messages after it has done a qprocsoff.
2469                  */
2470                 if (_OTHERQ(q)->q_next == NULL)
2471                         freemsg(bp);
2472                 else
2473                         qreply(q, bp);
2474                 return (0);
2475 
2476         default:
2477 #ifdef DEBUG
2478                 cmn_err(CE_WARN,
2479                     "bad message type %x received at stream head\n",
2480                     bp->b_datap->db_type);
2481 #endif
2482                 freemsg(bp);
2483                 return (0);
2484         }
2485 
2486         /* NOTREACHED */
2487 }
2488 
2489 /*
2490  * Check if the stream pointed to by `stp' can be written to, and return an
2491  * error code if not.  If `eiohup' is set, then return EIO if STRHUP is set.
2492  * If `sigpipeok' is set and the SW_SIGPIPE option is enabled on the stream,
2493  * then always return EPIPE and send a SIGPIPE to the invoking thread.
2494  */
2495 static int
2496 strwriteable(struct stdata *stp, boolean_t eiohup, boolean_t sigpipeok)
2497 {
2498         int error;
2499 
2500         ASSERT(MUTEX_HELD(&stp->sd_lock));
2501 
2502         /*
2503          * For modem support, POSIX states that on writes, EIO should
2504          * be returned if the stream has been hung up.
2505          */
2506         if (eiohup && (stp->sd_flag & (STPLEX|STRHUP)) == STRHUP)
2507                 error = EIO;
2508         else
2509                 error = strgeterr(stp, STRHUP|STPLEX|STWRERR, 0);
2510 
2511         if (error != 0) {
2512                 if (!(stp->sd_flag & STPLEX) &&
2513                     (stp->sd_wput_opt & SW_SIGPIPE) && sigpipeok) {
2514                         tsignal(curthread, SIGPIPE);
2515                         error = EPIPE;
2516                 }
2517         }
2518 
2519         return (error);
2520 }
2521 
2522 /*
2523  * Copyin and send data down a stream.
2524  * The caller will allocate and copyin any control part that precedes the
2525  * message and pass that in as mctl.
2526  *
2527  * Caller should *not* hold sd_lock.
2528  * When EWOULDBLOCK is returned the caller has to redo the canputnext
2529  * under sd_lock in order to avoid missing a backenabling wakeup.
2530  *
2531  * Use iosize = -1 to not send any M_DATA. iosize = 0 sends zero-length M_DATA.
2532  *
2533  * Set MSG_IGNFLOW in flags to ignore flow control for hipri messages.
2534  * For sync streams we can only ignore flow control by reverting to using
2535  * putnext.
2536  *
2537  * If sd_maxblk is less than *iosize this routine might return without
2538  * transferring all of *iosize. In all cases, on return *iosize will contain
2539  * the amount of data that was transferred.
2540  */
2541 static int
2542 strput(struct stdata *stp, mblk_t *mctl, struct uio *uiop, ssize_t *iosize,
2543     int b_flag, int pri, int flags)
2544 {
2545         struiod_t uiod;
2546         mblk_t *mp;
2547         queue_t *wqp = stp->sd_wrq;
2548         int error = 0;
2549         ssize_t count = *iosize;
2550 
2551         ASSERT(MUTEX_NOT_HELD(&stp->sd_lock));
2552 
2553         if (uiop != NULL && count >= 0)
2554                 flags |= stp->sd_struiowrq ? STRUIO_POSTPONE : 0;
2555 
2556         if (!(flags & STRUIO_POSTPONE)) {
2557                 /*
2558                  * Use regular canputnext, strmakedata, putnext sequence.
2559                  */
2560                 if (pri == 0) {
2561                         if (!canputnext(wqp) && !(flags & MSG_IGNFLOW)) {
2562                                 freemsg(mctl);
2563                                 return (EWOULDBLOCK);
2564                         }
2565                 } else {
2566                         if (!(flags & MSG_IGNFLOW) && !bcanputnext(wqp, pri)) {
2567                                 freemsg(mctl);
2568                                 return (EWOULDBLOCK);
2569                         }
2570                 }
2571 
2572                 if ((error = strmakedata(iosize, uiop, stp, flags,
2573                     &mp)) != 0) {
2574                         freemsg(mctl);
2575                         /*
2576                          * need to change return code to ENOMEM
2577                          * so that this is not confused with
2578                          * flow control, EAGAIN.
2579                          */
2580 
2581                         if (error == EAGAIN)
2582                                 return (ENOMEM);
2583                         else
2584                                 return (error);
2585                 }
2586                 if (mctl != NULL) {
2587                         if (mctl->b_cont == NULL)
2588                                 mctl->b_cont = mp;
2589                         else if (mp != NULL)
2590                                 linkb(mctl, mp);
2591                         mp = mctl;
2592                 } else if (mp == NULL)
2593                         return (0);
2594 
2595                 mp->b_flag |= b_flag;
2596                 mp->b_band = (uchar_t)pri;
2597 
2598                 if (flags & MSG_IGNFLOW) {
2599                         /*
2600                          * XXX Hack: Don't get stuck running service
2601                          * procedures. This is needed for sockfs when
2602                          * sending the unbind message out of the rput
2603                          * procedure - we don't want a put procedure
2604                          * to run service procedures.
2605                          */
2606                         putnext(wqp, mp);
2607                 } else {
2608                         stream_willservice(stp);
2609                         putnext(wqp, mp);
2610                         stream_runservice(stp);
2611                 }
2612                 return (0);
2613         }
2614         /*
2615          * Stream supports rwnext() for the write side.
2616          */
2617         if ((error = strmakedata(iosize, uiop, stp, flags, &mp)) != 0) {
2618                 freemsg(mctl);
2619                 /*
2620                  * map EAGAIN to ENOMEM since EAGAIN means "flow controlled".
2621                  */
2622                 return (error == EAGAIN ? ENOMEM : error);
2623         }
2624         if (mctl != NULL) {
2625                 if (mctl->b_cont == NULL)
2626                         mctl->b_cont = mp;
2627                 else if (mp != NULL)
2628                         linkb(mctl, mp);
2629                 mp = mctl;
2630         } else if (mp == NULL) {
2631                 return (0);
2632         }
2633 
2634         mp->b_flag |= b_flag;
2635         mp->b_band = (uchar_t)pri;
2636 
2637         (void) uiodup(uiop, &uiod.d_uio, uiod.d_iov,
2638             sizeof (uiod.d_iov) / sizeof (*uiod.d_iov));
2639         uiod.d_uio.uio_offset = 0;
2640         uiod.d_mp = mp;
2641         error = rwnext(wqp, &uiod);
2642         if (! uiod.d_mp) {
2643                 uioskip(uiop, *iosize);
2644                 return (error);
2645         }
2646         ASSERT(mp == uiod.d_mp);
2647         if (error == EINVAL) {
2648                 /*
2649                  * The stream plumbing must have changed while
2650                  * we were away, so just turn off rwnext()s.
2651                  */
2652                 error = 0;
2653         } else if (error == EBUSY || error == EWOULDBLOCK) {
2654                 /*
2655                  * Couldn't enter a perimeter or took a page fault,
2656                  * so fall-back to putnext().
2657                  */
2658                 error = 0;
2659         } else {
2660                 freemsg(mp);
2661                 return (error);
2662         }
2663         /* Have to check canput before consuming data from the uio */
2664         if (pri == 0) {
2665                 if (!canputnext(wqp) && !(flags & MSG_IGNFLOW)) {
2666                         freemsg(mp);
2667                         return (EWOULDBLOCK);
2668                 }
2669         } else {
2670                 if (!bcanputnext(wqp, pri) && !(flags & MSG_IGNFLOW)) {
2671                         freemsg(mp);
2672                         return (EWOULDBLOCK);
2673                 }
2674         }
2675         ASSERT(mp == uiod.d_mp);
2676         /* Copyin data from the uio */
2677         if ((error = struioget(wqp, mp, &uiod, 0)) != 0) {
2678                 freemsg(mp);
2679                 return (error);
2680         }
2681         uioskip(uiop, *iosize);
2682         if (flags & MSG_IGNFLOW) {
2683                 /*
2684                  * XXX Hack: Don't get stuck running service procedures.
2685                  * This is needed for sockfs when sending the unbind message
2686                  * out of the rput procedure - we don't want a put procedure
2687                  * to run service procedures.
2688                  */
2689                 putnext(wqp, mp);
2690         } else {
2691                 stream_willservice(stp);
2692                 putnext(wqp, mp);
2693                 stream_runservice(stp);
2694         }
2695         return (0);
2696 }
2697 
2698 /*
2699  * Write attempts to break the write request into messages conforming
2700  * with the minimum and maximum packet sizes set downstream.
2701  *
2702  * Write will not block if downstream queue is full and
2703  * O_NDELAY is set, otherwise it will block waiting for the queue to get room.
2704  *
2705  * A write of zero bytes gets packaged into a zero length message and sent
2706  * downstream like any other message.
2707  *
2708  * If buffers of the requested sizes are not available, the write will
2709  * sleep until the buffers become available.
2710  *
2711  * Write (if specified) will supply a write offset in a message if it
2712  * makes sense. This can be specified by downstream modules as part of
2713  * a M_SETOPTS message.  Write will not supply the write offset if it
2714  * cannot supply any data in a buffer.  In other words, write will never
2715  * send down an empty packet due to a write offset.
2716  */
2717 /* ARGSUSED2 */
2718 int
2719 strwrite(struct vnode *vp, struct uio *uiop, cred_t *crp)
2720 {
2721         return (strwrite_common(vp, uiop, crp, 0));
2722 }
2723 
2724 /* ARGSUSED2 */
2725 int
2726 strwrite_common(struct vnode *vp, struct uio *uiop, cred_t *crp, int wflag)
2727 {
2728         struct stdata *stp;
2729         struct queue *wqp;
2730         ssize_t rmin, rmax;
2731         ssize_t iosize;
2732         int waitflag;
2733         int tempmode;
2734         int error = 0;
2735         int b_flag;
2736 
2737         ASSERT(vp->v_stream);
2738         stp = vp->v_stream;
2739 
2740         mutex_enter(&stp->sd_lock);
2741 
2742         if ((error = i_straccess(stp, JCWRITE)) != 0) {
2743                 mutex_exit(&stp->sd_lock);
2744                 return (error);
2745         }
2746 
2747         if (stp->sd_flag & (STWRERR|STRHUP|STPLEX)) {
2748                 error = strwriteable(stp, B_TRUE, B_TRUE);
2749                 if (error != 0) {
2750                         mutex_exit(&stp->sd_lock);
2751                         return (error);
2752                 }
2753         }
2754 
2755         mutex_exit(&stp->sd_lock);
2756 
2757         wqp = stp->sd_wrq;
2758 
2759         /* get these values from them cached in the stream head */
2760         rmin = stp->sd_qn_minpsz;
2761         rmax = stp->sd_qn_maxpsz;
2762 
2763         /*
2764          * Check the min/max packet size constraints.  If min packet size
2765          * is non-zero, the write cannot be split into multiple messages
2766          * and still guarantee the size constraints.
2767          */
2768         TRACE_1(TR_FAC_STREAMS_FR, TR_STRWRITE_IN, "strwrite in:q %p", wqp);
2769 
2770         ASSERT((rmax >= 0) || (rmax == INFPSZ));
2771         if (rmax == 0) {
2772                 return (0);
2773         }
2774         if (rmin > 0) {
2775                 if (uiop->uio_resid < rmin) {
2776                         TRACE_3(TR_FAC_STREAMS_FR, TR_STRWRITE_OUT,
2777                             "strwrite out:q %p out %d error %d",
2778                             wqp, 0, ERANGE);
2779                         return (ERANGE);
2780                 }
2781                 if ((rmax != INFPSZ) && (uiop->uio_resid > rmax)) {
2782                         TRACE_3(TR_FAC_STREAMS_FR, TR_STRWRITE_OUT,
2783                             "strwrite out:q %p out %d error %d",
2784                             wqp, 1, ERANGE);
2785                         return (ERANGE);
2786                 }
2787         }
2788 
2789         /*
2790          * Do until count satisfied or error.
2791          */
2792         waitflag = WRITEWAIT | wflag;
2793         if (stp->sd_flag & OLDNDELAY)
2794                 tempmode = uiop->uio_fmode & ~FNDELAY;
2795         else
2796                 tempmode = uiop->uio_fmode;
2797 
2798         if (rmax == INFPSZ)
2799                 rmax = uiop->uio_resid;
2800 
2801         /*
2802          * Note that tempmode does not get used in strput/strmakedata
2803          * but only in strwaitq. The other routines use uio_fmode
2804          * unmodified.
2805          */
2806 
2807         /* LINTED: constant in conditional context */
2808         while (1) {     /* breaks when uio_resid reaches zero */
2809                 /*
2810                  * Determine the size of the next message to be
2811                  * packaged.  May have to break write into several
2812                  * messages based on max packet size.
2813                  */
2814                 iosize = MIN(uiop->uio_resid, rmax);
2815 
2816                 /*
2817                  * Put block downstream when flow control allows it.
2818                  */
2819                 if ((stp->sd_flag & STRDELIM) && (uiop->uio_resid == iosize))
2820                         b_flag = MSGDELIM;
2821                 else
2822                         b_flag = 0;
2823 
2824                 for (;;) {
2825                         int done = 0;
2826 
2827                         error = strput(stp, NULL, uiop, &iosize, b_flag, 0, 0);
2828                         if (error == 0)
2829                                 break;
2830                         if (error != EWOULDBLOCK)
2831                                 goto out;
2832 
2833                         mutex_enter(&stp->sd_lock);
2834                         /*
2835                          * Check for a missed wakeup.
2836                          * Needed since strput did not hold sd_lock across
2837                          * the canputnext.
2838                          */
2839                         if (canputnext(wqp)) {
2840                                 /* Try again */
2841                                 mutex_exit(&stp->sd_lock);
2842                                 continue;
2843                         }
2844                         TRACE_1(TR_FAC_STREAMS_FR, TR_STRWRITE_WAIT,
2845                             "strwrite wait:q %p wait", wqp);
2846                         if ((error = strwaitq(stp, waitflag, (ssize_t)0,
2847                             tempmode, -1, &done)) != 0 || done) {
2848                                 mutex_exit(&stp->sd_lock);
2849                                 if ((vp->v_type == VFIFO) &&
2850                                     (uiop->uio_fmode & FNDELAY) &&
2851                                     (error == EAGAIN))
2852                                         error = 0;
2853                                 goto out;
2854                         }
2855                         TRACE_1(TR_FAC_STREAMS_FR, TR_STRWRITE_WAKE,
2856                             "strwrite wake:q %p awakes", wqp);
2857                         if ((error = i_straccess(stp, JCWRITE)) != 0) {
2858                                 mutex_exit(&stp->sd_lock);
2859                                 goto out;
2860                         }
2861                         mutex_exit(&stp->sd_lock);
2862                 }
2863                 waitflag |= NOINTR;
2864                 TRACE_2(TR_FAC_STREAMS_FR, TR_STRWRITE_RESID,
2865                     "strwrite resid:q %p uiop %p", wqp, uiop);
2866                 if (uiop->uio_resid) {
2867                         /* Recheck for errors - needed for sockets */
2868                         if ((stp->sd_wput_opt & SW_RECHECK_ERR) &&
2869                             (stp->sd_flag & (STWRERR|STRHUP|STPLEX))) {
2870                                 mutex_enter(&stp->sd_lock);
2871                                 error = strwriteable(stp, B_FALSE, B_TRUE);
2872                                 mutex_exit(&stp->sd_lock);
2873                                 if (error != 0)
2874                                         return (error);
2875                         }
2876                         continue;
2877                 }
2878                 break;
2879         }
2880 out:
2881         /*
2882          * For historical reasons, applications expect EAGAIN when a data
2883          * mblk_t cannot be allocated, so change ENOMEM back to EAGAIN.
2884          */
2885         if (error == ENOMEM)
2886                 error = EAGAIN;
2887         TRACE_3(TR_FAC_STREAMS_FR, TR_STRWRITE_OUT,
2888             "strwrite out:q %p out %d error %d", wqp, 2, error);
2889         return (error);
2890 }
2891 
2892 /*
2893  * Stream head write service routine.
2894  * Its job is to wake up any sleeping writers when a queue
2895  * downstream needs data (part of the flow control in putq and getq).
2896  * It also must wake anyone sleeping on a poll().
2897  * For stream head right below mux module, it must also invoke put procedure
2898  * of next downstream module.
2899  */
2900 int
2901 strwsrv(queue_t *q)
2902 {
2903         struct stdata *stp;
2904         queue_t *tq;
2905         qband_t *qbp;
2906         int i;
2907         qband_t *myqbp;
2908         int isevent;
2909         unsigned char   qbf[NBAND];     /* band flushing backenable flags */
2910 
2911         TRACE_1(TR_FAC_STREAMS_FR,
2912             TR_STRWSRV, "strwsrv:q %p", q);
2913         stp = (struct stdata *)q->q_ptr;
2914         ASSERT(qclaimed(q));
2915         mutex_enter(&stp->sd_lock);
2916         ASSERT(!(stp->sd_flag & STPLEX));
2917 
2918         if (stp->sd_flag & WSLEEP) {
2919                 stp->sd_flag &= ~WSLEEP;
2920                 cv_broadcast(&q->q_wait);
2921         }
2922         mutex_exit(&stp->sd_lock);
2923 
2924         /* The other end of a stream pipe went away. */
2925         if ((tq = q->q_next) == NULL) {
2926                 return (0);
2927         }
2928 
2929         /* Find the next module forward that has a service procedure */
2930         claimstr(q);
2931         tq = q->q_nfsrv;
2932         ASSERT(tq != NULL);
2933 
2934         if ((q->q_flag & QBACK)) {
2935                 if ((tq->q_flag & QFULL)) {
2936                         mutex_enter(QLOCK(tq));
2937                         if (!(tq->q_flag & QFULL)) {
2938                                 mutex_exit(QLOCK(tq));
2939                                 goto wakeup;
2940                         }
2941                         /*
2942                          * The queue must have become full again. Set QWANTW
2943                          * again so strwsrv will be back enabled when
2944                          * the queue becomes non-full next time.
2945                          */
2946                         tq->q_flag |= QWANTW;
2947                         mutex_exit(QLOCK(tq));
2948                 } else {
2949                 wakeup:
2950                         pollwakeup(&stp->sd_pollist, POLLWRNORM);
2951                         mutex_enter(&stp->sd_lock);
2952                         if (stp->sd_sigflags & S_WRNORM)
2953                                 strsendsig(stp->sd_siglist, S_WRNORM, 0, 0);
2954                         mutex_exit(&stp->sd_lock);
2955                 }
2956         }
2957 
2958         isevent = 0;
2959         i = 1;
2960         bzero((caddr_t)qbf, NBAND);
2961         mutex_enter(QLOCK(tq));
2962         if ((myqbp = q->q_bandp) != NULL)
2963                 for (qbp = tq->q_bandp; qbp && myqbp; qbp = qbp->qb_next) {
2964                         ASSERT(myqbp);
2965                         if ((myqbp->qb_flag & QB_BACK)) {
2966                                 if (qbp->qb_flag & QB_FULL) {
2967                                         /*
2968                                          * The band must have become full again.
2969                                          * Set QB_WANTW again so strwsrv will
2970                                          * be back enabled when the band becomes
2971                                          * non-full next time.
2972                                          */
2973                                         qbp->qb_flag |= QB_WANTW;
2974                                 } else {
2975                                         isevent = 1;
2976                                         qbf[i] = 1;
2977                                 }
2978                         }
2979                         myqbp = myqbp->qb_next;
2980                         i++;
2981                 }
2982         mutex_exit(QLOCK(tq));
2983 
2984         if (isevent) {
2985                 for (i = tq->q_nband; i; i--) {
2986                         if (qbf[i]) {
2987                                 pollwakeup(&stp->sd_pollist, POLLWRBAND);
2988                                 mutex_enter(&stp->sd_lock);
2989                                 if (stp->sd_sigflags & S_WRBAND)
2990                                         strsendsig(stp->sd_siglist, S_WRBAND,
2991                                             (uchar_t)i, 0);
2992                                 mutex_exit(&stp->sd_lock);
2993                         }
2994                 }
2995         }
2996 
2997         releasestr(q);
2998         return (0);
2999 }
3000 
3001 /*
3002  * Special case of strcopyin/strcopyout for copying
3003  * struct strioctl that can deal with both data
3004  * models.
3005  */
3006 
3007 #ifdef  _LP64
3008 
3009 static int
3010 strcopyin_strioctl(void *from, void *to, int flag, int copyflag)
3011 {
3012         struct  strioctl32 strioc32;
3013         struct  strioctl *striocp;
3014 
3015         if (copyflag & U_TO_K) {
3016                 ASSERT((copyflag & K_TO_K) == 0);
3017 
3018                 if ((flag & FMODELS) == DATAMODEL_ILP32) {
3019                         if (copyin(from, &strioc32, sizeof (strioc32)))
3020                                 return (EFAULT);
3021 
3022                         striocp = (struct strioctl *)to;
3023                         striocp->ic_cmd      = strioc32.ic_cmd;
3024                         striocp->ic_timout = strioc32.ic_timout;
3025                         striocp->ic_len      = strioc32.ic_len;
3026                         striocp->ic_dp       = (char *)(uintptr_t)strioc32.ic_dp;
3027 
3028                 } else { /* NATIVE data model */
3029                         if (copyin(from, to, sizeof (struct strioctl))) {
3030                                 return (EFAULT);
3031                         } else {
3032                                 return (0);
3033                         }
3034                 }
3035         } else {
3036                 ASSERT(copyflag & K_TO_K);
3037                 bcopy(from, to, sizeof (struct strioctl));
3038         }
3039         return (0);
3040 }
3041 
3042 static int
3043 strcopyout_strioctl(void *from, void *to, int flag, int copyflag)
3044 {
3045         struct  strioctl32 strioc32;
3046         struct  strioctl *striocp;
3047 
3048         if (copyflag & U_TO_K) {
3049                 ASSERT((copyflag & K_TO_K) == 0);
3050 
3051                 if ((flag & FMODELS) == DATAMODEL_ILP32) {
3052                         striocp = (struct strioctl *)from;
3053                         strioc32.ic_cmd = striocp->ic_cmd;
3054                         strioc32.ic_timout = striocp->ic_timout;
3055                         strioc32.ic_len = striocp->ic_len;
3056                         strioc32.ic_dp  = (caddr32_t)(uintptr_t)striocp->ic_dp;
3057                         ASSERT((char *)(uintptr_t)strioc32.ic_dp ==
3058                             striocp->ic_dp);
3059 
3060                         if (copyout(&strioc32, to, sizeof (strioc32)))
3061                                 return (EFAULT);
3062 
3063                 } else { /* NATIVE data model */
3064                         if (copyout(from, to, sizeof (struct strioctl))) {
3065                                 return (EFAULT);
3066                         } else {
3067                                 return (0);
3068                         }
3069                 }
3070         } else {
3071                 ASSERT(copyflag & K_TO_K);
3072                 bcopy(from, to, sizeof (struct strioctl));
3073         }
3074         return (0);
3075 }
3076 
3077 #else   /* ! _LP64 */
3078 
3079 /* ARGSUSED2 */
3080 static int
3081 strcopyin_strioctl(void *from, void *to, int flag, int copyflag)
3082 {
3083         return (strcopyin(from, to, sizeof (struct strioctl), copyflag));
3084 }
3085 
3086 /* ARGSUSED2 */
3087 static int
3088 strcopyout_strioctl(void *from, void *to, int flag, int copyflag)
3089 {
3090         return (strcopyout(from, to, sizeof (struct strioctl), copyflag));
3091 }
3092 
3093 #endif  /* _LP64 */
3094 
3095 /*
3096  * Determine type of job control semantics expected by user.  The
3097  * possibilities are:
3098  *      JCREAD  - Behaves like read() on fd; send SIGTTIN
3099  *      JCWRITE - Behaves like write() on fd; send SIGTTOU if TOSTOP set
3100  *      JCSETP  - Sets a value in the stream; send SIGTTOU, ignore TOSTOP
3101  *      JCGETP  - Gets a value in the stream; no signals.
3102  * See straccess in strsubr.c for usage of these values.
3103  *
3104  * This routine also returns -1 for I_STR as a special case; the
3105  * caller must call again with the real ioctl number for
3106  * classification.
3107  */
3108 static int
3109 job_control_type(int cmd)
3110 {
3111         switch (cmd) {
3112         case I_STR:
3113                 return (-1);
3114 
3115         case I_RECVFD:
3116         case I_E_RECVFD:
3117                 return (JCREAD);
3118 
3119         case I_FDINSERT:
3120         case I_SENDFD:
3121                 return (JCWRITE);
3122 
3123         case TCSETA:
3124         case TCSETAW:
3125         case TCSETAF:
3126         case TCSBRK:
3127         case TCXONC:
3128         case TCFLSH:
3129         case TCDSET:    /* Obsolete */
3130         case TIOCSWINSZ:
3131         case TCSETS:
3132         case TCSETSW:
3133         case TCSETSF:
3134         case TIOCSETD:
3135         case TIOCHPCL:
3136         case TIOCSETP:
3137         case TIOCSETN:
3138         case TIOCEXCL:
3139         case TIOCNXCL:
3140         case TIOCFLUSH:
3141         case TIOCSETC:
3142         case TIOCLBIS:
3143         case TIOCLBIC:
3144         case TIOCLSET:
3145         case TIOCSBRK:
3146         case TIOCCBRK:
3147         case TIOCSDTR:
3148         case TIOCCDTR:
3149         case TIOCSLTC:
3150         case TIOCSTOP:
3151         case TIOCSTART:
3152         case TIOCSTI:
3153         case TIOCSPGRP:
3154         case TIOCMSET:
3155         case TIOCMBIS:
3156         case TIOCMBIC:
3157         case TIOCREMOTE:
3158         case TIOCSIGNAL:
3159         case LDSETT:
3160         case LDSMAP:    /* Obsolete */
3161         case DIOCSETP:
3162         case I_FLUSH:
3163         case I_SRDOPT:
3164         case I_SETSIG:
3165         case I_SWROPT:
3166         case I_FLUSHBAND:
3167         case I_SETCLTIME:
3168         case I_SERROPT:
3169         case I_ESETSIG:
3170         case FIONBIO:
3171         case FIOASYNC:
3172         case FIOSETOWN:
3173         case JBOOT:     /* Obsolete */
3174         case JTERM:     /* Obsolete */
3175         case JTIMOM:    /* Obsolete */
3176         case JZOMBOOT:  /* Obsolete */
3177         case JAGENT:    /* Obsolete */
3178         case JTRUN:     /* Obsolete */
3179         case JXTPROTO:  /* Obsolete */
3180         case TIOCSETLD:
3181                 return (JCSETP);
3182         }
3183 
3184         return (JCGETP);
3185 }
3186 
3187 /*
3188  * ioctl for streams
3189  */
3190 int
3191 strioctl(struct vnode *vp, int cmd, intptr_t arg, int flag, int copyflag,
3192     cred_t *crp, int *rvalp)
3193 {
3194         struct stdata *stp;
3195         struct strcmd *scp;
3196         struct strioctl strioc;
3197         struct uio uio;
3198         struct iovec iov;
3199         int access;
3200         mblk_t *mp;
3201         int error = 0;
3202         int done = 0;
3203         ssize_t rmin, rmax;
3204         queue_t *wrq;
3205         queue_t *rdq;
3206         boolean_t kioctl = B_FALSE;
3207         uint32_t auditing = AU_AUDITING();
3208 
3209         if (flag & FKIOCTL) {
3210                 copyflag = K_TO_K;
3211                 kioctl = B_TRUE;
3212         }
3213         ASSERT(vp->v_stream);
3214         ASSERT(copyflag == U_TO_K || copyflag == K_TO_K);
3215         stp = vp->v_stream;
3216 
3217         TRACE_3(TR_FAC_STREAMS_FR, TR_IOCTL_ENTER,
3218             "strioctl:stp %p cmd %X arg %lX", stp, cmd, arg);
3219 
3220         /*
3221          * If the copy is kernel to kernel, make sure that the FNATIVE
3222          * flag is set.  After this it would be a serious error to have
3223          * no model flag.
3224          */
3225         if (copyflag == K_TO_K)
3226                 flag = (flag & ~FMODELS) | FNATIVE;
3227 
3228         ASSERT((flag & FMODELS) != 0);
3229 
3230         wrq = stp->sd_wrq;
3231         rdq = _RD(wrq);
3232 
3233         access = job_control_type(cmd);
3234 
3235         /* We should never see these here, should be handled by iwscn */
3236         if (cmd == SRIOCSREDIR || cmd == SRIOCISREDIR)
3237                 return (EINVAL);
3238 
3239         mutex_enter(&stp->sd_lock);
3240         if ((access != -1) && ((error = i_straccess(stp, access)) != 0)) {
3241                 mutex_exit(&stp->sd_lock);
3242                 return (error);
3243         }
3244         mutex_exit(&stp->sd_lock);
3245 
3246         /*
3247          * Check for sgttyb-related ioctls first, and complain as
3248          * necessary.
3249          */
3250         switch (cmd) {
3251         case TIOCGETP:
3252         case TIOCSETP:
3253         case TIOCSETN:
3254                 if (sgttyb_handling >= 2 && !sgttyb_complaint) {
3255                         sgttyb_complaint = B_TRUE;
3256                         cmn_err(CE_NOTE,
3257                             "application used obsolete TIOC[GS]ET");
3258                 }
3259                 if (sgttyb_handling >= 3) {
3260                         tsignal(curthread, SIGSYS);
3261                         return (EIO);
3262                 }
3263                 break;
3264         }
3265 
3266         mutex_enter(&stp->sd_lock);
3267 
3268         switch (cmd) {
3269         case I_RECVFD:
3270         case I_E_RECVFD:
3271         case I_PEEK:
3272         case I_NREAD:
3273         case FIONREAD:
3274         case FIORDCHK:
3275         case I_ATMARK:
3276         case FIONBIO:
3277         case FIOASYNC:
3278                 if (stp->sd_flag & (STRDERR|STPLEX)) {
3279                         error = strgeterr(stp, STRDERR|STPLEX, 0);
3280                         if (error != 0) {
3281                                 mutex_exit(&stp->sd_lock);
3282                                 return (error);
3283                         }
3284                 }
3285                 break;
3286 
3287         default:
3288                 if (stp->sd_flag & (STRDERR|STWRERR|STPLEX)) {
3289                         error = strgeterr(stp, STRDERR|STWRERR|STPLEX, 0);
3290                         if (error != 0) {
3291                                 mutex_exit(&stp->sd_lock);
3292                                 return (error);
3293                         }
3294                 }
3295         }
3296 
3297         mutex_exit(&stp->sd_lock);
3298 
3299         switch (cmd) {
3300         default:
3301                 /*
3302                  * The stream head has hardcoded knowledge of a
3303                  * miscellaneous collection of terminal-, keyboard- and
3304                  * mouse-related ioctls, enumerated below.  This hardcoded
3305                  * knowledge allows the stream head to automatically
3306                  * convert transparent ioctl requests made by userland
3307                  * programs into I_STR ioctls which many old STREAMS
3308                  * modules and drivers require.
3309                  *
3310                  * No new ioctls should ever be added to this list.
3311                  * Instead, the STREAMS module or driver should be written
3312                  * to either handle transparent ioctls or require any
3313                  * userland programs to use I_STR ioctls (by returning
3314                  * EINVAL to any transparent ioctl requests).
3315                  *
3316                  * More importantly, removing ioctls from this list should
3317                  * be done with the utmost care, since our STREAMS modules
3318                  * and drivers *count* on the stream head performing this
3319                  * conversion, and thus may panic while processing
3320                  * transparent ioctl request for one of these ioctls (keep
3321                  * in mind that third party modules and drivers may have
3322                  * similar problems).
3323                  */
3324                 if (((cmd & IOCTYPE) == LDIOC) ||
3325                     ((cmd & IOCTYPE) == tIOC) ||
3326                     ((cmd & IOCTYPE) == TIOC) ||
3327                     ((cmd & IOCTYPE) == KIOC) ||
3328                     ((cmd & IOCTYPE) == MSIOC) ||
3329                     ((cmd & IOCTYPE) == VUIOC)) {
3330                         /*
3331                          * The ioctl is a tty ioctl - set up strioc buffer
3332                          * and call strdoioctl() to do the work.
3333                          */
3334                         if (stp->sd_flag & STRHUP)
3335                                 return (ENXIO);
3336                         strioc.ic_cmd = cmd;
3337                         strioc.ic_timout = INFTIM;
3338 
3339                         switch (cmd) {
3340 
3341                         case TCXONC:
3342                         case TCSBRK:
3343                         case TCFLSH:
3344                         case TCDSET:
3345                                 {
3346                                 int native_arg = (int)arg;
3347                                 strioc.ic_len = sizeof (int);
3348                                 strioc.ic_dp = (char *)&native_arg;
3349                                 return (strdoioctl(stp, &strioc, flag,
3350                                     K_TO_K, crp, rvalp));
3351                                 }
3352 
3353                         case TCSETA:
3354                         case TCSETAW:
3355                         case TCSETAF:
3356                                 strioc.ic_len = sizeof (struct termio);
3357                                 strioc.ic_dp = (char *)arg;
3358                                 return (strdoioctl(stp, &strioc, flag,
3359                                     copyflag, crp, rvalp));
3360 
3361                         case TCSETS:
3362                         case TCSETSW:
3363                         case TCSETSF:
3364                                 strioc.ic_len = sizeof (struct termios);
3365                                 strioc.ic_dp = (char *)arg;
3366                                 return (strdoioctl(stp, &strioc, flag,
3367                                     copyflag, crp, rvalp));
3368 
3369                         case LDSETT:
3370                                 strioc.ic_len = sizeof (struct termcb);
3371                                 strioc.ic_dp = (char *)arg;
3372                                 return (strdoioctl(stp, &strioc, flag,
3373                                     copyflag, crp, rvalp));
3374 
3375                         case TIOCSETP:
3376                                 strioc.ic_len = sizeof (struct sgttyb);
3377                                 strioc.ic_dp = (char *)arg;
3378                                 return (strdoioctl(stp, &strioc, flag,
3379                                     copyflag, crp, rvalp));
3380 
3381                         case TIOCSTI:
3382                                 if ((flag & FREAD) == 0 &&
3383                                     secpolicy_sti(crp) != 0) {
3384                                         return (EPERM);
3385                                 }
3386                                 mutex_enter(&stp->sd_lock);
3387                                 mutex_enter(&curproc->p_splock);
3388                                 if (stp->sd_sidp != curproc->p_sessp->s_sidp &&
3389                                     secpolicy_sti(crp) != 0) {
3390                                         mutex_exit(&curproc->p_splock);
3391                                         mutex_exit(&stp->sd_lock);
3392                                         return (EACCES);
3393                                 }
3394                                 mutex_exit(&curproc->p_splock);
3395                                 mutex_exit(&stp->sd_lock);
3396 
3397                                 strioc.ic_len = sizeof (char);
3398                                 strioc.ic_dp = (char *)arg;
3399                                 return (strdoioctl(stp, &strioc, flag,
3400                                     copyflag, crp, rvalp));
3401 
3402                         case TIOCSWINSZ:
3403                                 strioc.ic_len = sizeof (struct winsize);
3404                                 strioc.ic_dp = (char *)arg;
3405                                 return (strdoioctl(stp, &strioc, flag,
3406                                     copyflag, crp, rvalp));
3407 
3408                         case TIOCSSIZE:
3409                                 strioc.ic_len = sizeof (struct ttysize);
3410                                 strioc.ic_dp = (char *)arg;
3411                                 return (strdoioctl(stp, &strioc, flag,
3412                                     copyflag, crp, rvalp));
3413 
3414                         case TIOCSSOFTCAR:
3415                         case KIOCTRANS:
3416                         case KIOCTRANSABLE:
3417                         case KIOCCMD:
3418                         case KIOCSDIRECT:
3419                         case KIOCSCOMPAT:
3420                         case KIOCSKABORTEN:
3421                         case KIOCSRPTDELAY:
3422                         case KIOCSRPTRATE:
3423                         case VUIDSFORMAT:
3424                         case TIOCSPPS:
3425                                 strioc.ic_len = sizeof (int);
3426                                 strioc.ic_dp = (char *)arg;
3427                                 return (strdoioctl(stp, &strioc, flag,
3428                                     copyflag, crp, rvalp));
3429 
3430                         case KIOCSETKEY:
3431                         case KIOCGETKEY:
3432                                 strioc.ic_len = sizeof (struct kiockey);
3433                                 strioc.ic_dp = (char *)arg;
3434                                 return (strdoioctl(stp, &strioc, flag,
3435                                     copyflag, crp, rvalp));
3436 
3437                         case KIOCSKEY:
3438                         case KIOCGKEY:
3439                                 strioc.ic_len = sizeof (struct kiockeymap);
3440                                 strioc.ic_dp = (char *)arg;
3441                                 return (strdoioctl(stp, &strioc, flag,
3442                                     copyflag, crp, rvalp));
3443 
3444                         case KIOCSLED:
3445                                 /* arg is a pointer to char */
3446                                 strioc.ic_len = sizeof (char);
3447                                 strioc.ic_dp = (char *)arg;
3448                                 return (strdoioctl(stp, &strioc, flag,
3449                                     copyflag, crp, rvalp));
3450 
3451                         case MSIOSETPARMS:
3452                                 strioc.ic_len = sizeof (Ms_parms);
3453                                 strioc.ic_dp = (char *)arg;
3454                                 return (strdoioctl(stp, &strioc, flag,
3455                                     copyflag, crp, rvalp));
3456 
3457                         case VUIDSADDR:
3458                         case VUIDGADDR:
3459                                 strioc.ic_len = sizeof (struct vuid_addr_probe);
3460                                 strioc.ic_dp = (char *)arg;
3461                                 return (strdoioctl(stp, &strioc, flag,
3462                                     copyflag, crp, rvalp));
3463 
3464                         /*
3465                          * These M_IOCTL's don't require any data to be sent
3466                          * downstream, and the driver will allocate and link
3467                          * on its own mblk_t upon M_IOCACK -- thus we set
3468                          * ic_len to zero and set ic_dp to arg so we know
3469                          * where to copyout to later.
3470                          */
3471                         case TIOCGSOFTCAR:
3472                         case TIOCGWINSZ:
3473                         case TIOCGSIZE:
3474                         case KIOCGTRANS:
3475                         case KIOCGTRANSABLE:
3476                         case KIOCTYPE:
3477                         case KIOCGDIRECT:
3478                         case KIOCGCOMPAT:
3479                         case KIOCLAYOUT:
3480                         case KIOCGLED:
3481                         case MSIOGETPARMS:
3482                         case MSIOBUTTONS:
3483                         case VUIDGFORMAT:
3484                         case TIOCGPPS:
3485                         case TIOCGPPSEV:
3486                         case TCGETA:
3487                         case TCGETS:
3488                         case LDGETT:
3489                         case TIOCGETP:
3490                         case KIOCGRPTDELAY:
3491                         case KIOCGRPTRATE:
3492                                 strioc.ic_len = 0;
3493                                 strioc.ic_dp = (char *)arg;
3494                                 return (strdoioctl(stp, &strioc, flag,
3495                                     copyflag, crp, rvalp));
3496                         }
3497                 }
3498 
3499                 /*
3500                  * Unknown cmd - send it down as a transparent ioctl.
3501                  */
3502                 strioc.ic_cmd = cmd;
3503                 strioc.ic_timout = INFTIM;
3504                 strioc.ic_len = TRANSPARENT;
3505                 strioc.ic_dp = (char *)&arg;
3506 
3507                 return (strdoioctl(stp, &strioc, flag, copyflag, crp, rvalp));
3508 
3509         case I_STR:
3510                 /*
3511                  * Stream ioctl.  Read in an strioctl buffer from the user
3512                  * along with any data specified and send it downstream.
3513                  * Strdoioctl will wait allow only one ioctl message at
3514                  * a time, and waits for the acknowledgement.
3515                  */
3516 
3517                 if (stp->sd_flag & STRHUP)
3518                         return (ENXIO);
3519 
3520                 error = strcopyin_strioctl((void *)arg, &strioc, flag,
3521                     copyflag);
3522                 if (error != 0)
3523                         return (error);
3524 
3525                 if ((strioc.ic_len < 0) || (strioc.ic_timout < -1))
3526                         return (EINVAL);
3527 
3528                 access = job_control_type(strioc.ic_cmd);
3529                 mutex_enter(&stp->sd_lock);
3530                 if ((access != -1) &&
3531                     ((error = i_straccess(stp, access)) != 0)) {
3532                         mutex_exit(&stp->sd_lock);
3533                         return (error);
3534                 }
3535                 mutex_exit(&stp->sd_lock);
3536 
3537                 /*
3538                  * The I_STR facility provides a trap door for malicious
3539                  * code to send down bogus streamio(7I) ioctl commands to
3540                  * unsuspecting STREAMS modules and drivers which expect to
3541                  * only get these messages from the stream head.
3542                  * Explicitly prohibit any streamio ioctls which can be
3543                  * passed downstream by the stream head.  Note that we do
3544                  * not block all streamio ioctls because the ioctl
3545                  * numberspace is not well managed and thus it's possible
3546                  * that a module or driver's ioctl numbers may accidentally
3547                  * collide with them.
3548                  */
3549                 switch (strioc.ic_cmd) {
3550                 case I_LINK:
3551                 case I_PLINK:
3552                 case I_UNLINK:
3553                 case I_PUNLINK:
3554                 case _I_GETPEERCRED:
3555                 case _I_PLINK_LH:
3556                         return (EINVAL);
3557                 }
3558 
3559                 error = strdoioctl(stp, &strioc, flag, copyflag, crp, rvalp);
3560                 if (error == 0) {
3561                         error = strcopyout_strioctl(&strioc, (void *)arg,
3562                             flag, copyflag);
3563                 }
3564                 return (error);
3565 
3566         case _I_CMD:
3567                 /*
3568                  * Like I_STR, but without using M_IOC* messages and without
3569                  * copyins/copyouts beyond the passed-in argument.
3570                  */
3571                 if (stp->sd_flag & STRHUP)
3572                         return (ENXIO);
3573 
3574                 if ((scp = kmem_alloc(sizeof (strcmd_t), KM_NOSLEEP)) == NULL)
3575                         return (ENOMEM);
3576 
3577                 if (copyin((void *)arg, scp, sizeof (strcmd_t))) {
3578                         kmem_free(scp, sizeof (strcmd_t));
3579                         return (EFAULT);
3580                 }
3581 
3582                 access = job_control_type(scp->sc_cmd);
3583                 mutex_enter(&stp->sd_lock);
3584                 if (access != -1 && (error = i_straccess(stp, access)) != 0) {
3585                         mutex_exit(&stp->sd_lock);
3586                         kmem_free(scp, sizeof (strcmd_t));
3587                         return (error);
3588                 }
3589                 mutex_exit(&stp->sd_lock);
3590 
3591                 *rvalp = 0;
3592                 if ((error = strdocmd(stp, scp, crp)) == 0) {
3593                         if (copyout(scp, (void *)arg, sizeof (strcmd_t)))
3594                                 error = EFAULT;
3595                 }
3596                 kmem_free(scp, sizeof (strcmd_t));
3597                 return (error);
3598 
3599         case I_NREAD:
3600                 /*
3601                  * Return number of bytes of data in first message
3602                  * in queue in "arg" and return the number of messages
3603                  * in queue in return value.
3604                  */
3605         {
3606                 size_t  size;
3607                 int     retval;
3608                 int     count = 0;
3609 
3610                 mutex_enter(QLOCK(rdq));
3611 
3612                 size = msgdsize(rdq->q_first);
3613                 for (mp = rdq->q_first; mp != NULL; mp = mp->b_next)
3614                         count++;
3615 
3616                 mutex_exit(QLOCK(rdq));
3617                 if (stp->sd_struiordq) {
3618                         infod_t infod;
3619 
3620                         infod.d_cmd = INFOD_COUNT;
3621                         infod.d_count = 0;
3622                         if (count == 0) {
3623                                 infod.d_cmd |= INFOD_FIRSTBYTES;
3624                                 infod.d_bytes = 0;
3625                         }
3626                         infod.d_res = 0;
3627                         (void) infonext(rdq, &infod);
3628                         count += infod.d_count;
3629                         if (infod.d_res & INFOD_FIRSTBYTES)
3630                                 size = infod.d_bytes;
3631                 }
3632 
3633                 /*
3634                  * Drop down from size_t to the "int" required by the
3635                  * interface.  Cap at INT_MAX.
3636                  */
3637                 retval = MIN(size, INT_MAX);
3638                 error = strcopyout(&retval, (void *)arg, sizeof (retval),
3639                     copyflag);
3640                 if (!error)
3641                         *rvalp = count;
3642                 return (error);
3643         }
3644 
3645         case FIONREAD:
3646                 /*
3647                  * Return number of bytes of data in all data messages
3648                  * in queue in "arg".
3649                  */
3650         {
3651                 size_t  size = 0;
3652                 int     retval;
3653 
3654                 mutex_enter(QLOCK(rdq));
3655                 for (mp = rdq->q_first; mp != NULL; mp = mp->b_next)
3656                         size += msgdsize(mp);
3657                 mutex_exit(QLOCK(rdq));
3658 
3659                 if (stp->sd_struiordq) {
3660                         infod_t infod;
3661 
3662                         infod.d_cmd = INFOD_BYTES;
3663                         infod.d_res = 0;
3664                         infod.d_bytes = 0;
3665                         (void) infonext(rdq, &infod);
3666                         size += infod.d_bytes;
3667                 }
3668 
3669                 /*
3670                  * Drop down from size_t to the "int" required by the
3671                  * interface.  Cap at INT_MAX.
3672                  */
3673                 retval = MIN(size, INT_MAX);
3674                 error = strcopyout(&retval, (void *)arg, sizeof (retval),
3675                     copyflag);
3676 
3677                 *rvalp = 0;
3678                 return (error);
3679         }
3680         case FIORDCHK:
3681                 /*
3682                  * FIORDCHK does not use arg value (like FIONREAD),
3683                  * instead a count is returned. I_NREAD value may
3684                  * not be accurate but safe. The real thing to do is
3685                  * to add the msgdsizes of all data  messages until
3686                  * a non-data message.
3687                  */
3688         {
3689                 size_t size = 0;
3690 
3691                 mutex_enter(QLOCK(rdq));
3692                 for (mp = rdq->q_first; mp != NULL; mp = mp->b_next)
3693                         size += msgdsize(mp);
3694                 mutex_exit(QLOCK(rdq));
3695 
3696                 if (stp->sd_struiordq) {
3697                         infod_t infod;
3698 
3699                         infod.d_cmd = INFOD_BYTES;
3700                         infod.d_res = 0;
3701                         infod.d_bytes = 0;
3702                         (void) infonext(rdq, &infod);
3703                         size += infod.d_bytes;
3704                 }
3705 
3706                 /*
3707                  * Since ioctl returns an int, and memory sizes under
3708                  * LP64 may not fit, we return INT_MAX if the count was
3709                  * actually greater.
3710                  */
3711                 *rvalp = MIN(size, INT_MAX);
3712                 return (0);
3713         }
3714 
3715         case I_FIND:
3716                 /*
3717                  * Get module name.
3718                  */
3719         {
3720                 char mname[FMNAMESZ + 1];
3721                 queue_t *q;
3722 
3723                 error = (copyflag & U_TO_K ? copyinstr : copystr)((void *)arg,
3724                     mname, FMNAMESZ + 1, NULL);
3725                 if (error)
3726                         return ((error == ENAMETOOLONG) ? EINVAL : EFAULT);
3727 
3728                 /*
3729                  * Return EINVAL if we're handed a bogus module name.
3730                  */
3731                 if (fmodsw_find(mname, FMODSW_LOAD) == NULL) {
3732                         TRACE_0(TR_FAC_STREAMS_FR,
3733                             TR_I_CANT_FIND, "couldn't I_FIND");
3734                         return (EINVAL);
3735                 }
3736 
3737                 *rvalp = 0;
3738 
3739                 /* Look downstream to see if module is there. */
3740                 claimstr(stp->sd_wrq);
3741                 for (q = stp->sd_wrq->q_next; q; q = q->q_next) {
3742                         if (q->q_flag & QREADR) {
3743                                 q = NULL;
3744                                 break;
3745                         }
3746                         if (strcmp(mname, Q2NAME(q)) == 0)
3747                                 break;
3748                 }
3749                 releasestr(stp->sd_wrq);
3750 
3751                 *rvalp = (q ? 1 : 0);
3752                 return (error);
3753         }
3754 
3755         case I_PUSH:
3756         case __I_PUSH_NOCTTY:
3757                 /*
3758                  * Push a module.
3759                  * For the case __I_PUSH_NOCTTY push a module but
3760                  * do not allocate controlling tty. See bugid 4025044
3761                  */
3762 
3763         {
3764                 char mname[FMNAMESZ + 1];
3765                 fmodsw_impl_t *fp;
3766                 dev_t dummydev;
3767 
3768                 if (stp->sd_flag & STRHUP)
3769                         return (ENXIO);
3770 
3771                 /*
3772                  * Get module name and look up in fmodsw.
3773                  */
3774                 error = (copyflag & U_TO_K ? copyinstr : copystr)((void *)arg,
3775                     mname, FMNAMESZ + 1, NULL);
3776                 if (error)
3777                         return ((error == ENAMETOOLONG) ? EINVAL : EFAULT);
3778 
3779                 if ((fp = fmodsw_find(mname, FMODSW_HOLD | FMODSW_LOAD)) ==
3780                     NULL)
3781                         return (EINVAL);
3782 
3783                 TRACE_2(TR_FAC_STREAMS_FR, TR_I_PUSH,
3784                     "I_PUSH:fp %p stp %p", fp, stp);
3785 
3786                 if (error = strstartplumb(stp, flag, cmd)) {
3787                         fmodsw_rele(fp);
3788                         return (error);
3789                 }
3790 
3791                 /*
3792                  * See if any more modules can be pushed on this stream.
3793                  * Note that this check must be done after strstartplumb()
3794                  * since otherwise multiple threads issuing I_PUSHes on
3795                  * the same stream will be able to exceed nstrpush.
3796                  */
3797                 mutex_enter(&stp->sd_lock);
3798                 if (stp->sd_pushcnt >= nstrpush) {
3799                         fmodsw_rele(fp);
3800                         strendplumb(stp);
3801                         mutex_exit(&stp->sd_lock);
3802                         return (EINVAL);
3803                 }
3804                 mutex_exit(&stp->sd_lock);
3805 
3806                 /*
3807                  * Push new module and call its open routine
3808                  * via qattach().  Modules don't change device
3809                  * numbers, so just ignore dummydev here.
3810                  */
3811                 dummydev = vp->v_rdev;
3812                 if ((error = qattach(rdq, &dummydev, 0, crp, fp,
3813                     B_FALSE)) == 0) {
3814                         if (vp->v_type == VCHR && /* sorry, no pipes allowed */
3815                             (cmd == I_PUSH) && (stp->sd_flag & STRISTTY)) {
3816                                 /*
3817                                  * try to allocate it as a controlling terminal
3818                                  */
3819                                 (void) strctty(stp);
3820                         }
3821                 }
3822 
3823                 mutex_enter(&stp->sd_lock);
3824 
3825                 /*
3826                  * As a performance concern we are caching the values of
3827                  * q_minpsz and q_maxpsz of the module below the stream
3828                  * head in the stream head.
3829                  */
3830                 mutex_enter(QLOCK(stp->sd_wrq->q_next));
3831                 rmin = stp->sd_wrq->q_next->q_minpsz;
3832                 rmax = stp->sd_wrq->q_next->q_maxpsz;
3833                 mutex_exit(QLOCK(stp->sd_wrq->q_next));
3834 
3835                 /* Do this processing here as a performance concern */
3836                 if (strmsgsz != 0) {
3837                         if (rmax == INFPSZ)
3838                                 rmax = strmsgsz;
3839                         else  {
3840                                 if (vp->v_type == VFIFO)
3841                                         rmax = MIN(PIPE_BUF, rmax);
3842                                 else    rmax = MIN(strmsgsz, rmax);
3843                         }
3844                 }
3845 
3846                 mutex_enter(QLOCK(wrq));
3847                 stp->sd_qn_minpsz = rmin;
3848                 stp->sd_qn_maxpsz = rmax;
3849                 mutex_exit(QLOCK(wrq));
3850 
3851                 strendplumb(stp);
3852                 mutex_exit(&stp->sd_lock);
3853                 return (error);
3854         }
3855 
3856         case I_POP:
3857         {
3858                 queue_t *q;
3859 
3860                 if (stp->sd_flag & STRHUP)
3861                         return (ENXIO);
3862                 if (!wrq->q_next)    /* for broken pipes */
3863                         return (EINVAL);
3864 
3865                 if (error = strstartplumb(stp, flag, cmd))
3866                         return (error);
3867 
3868                 /*
3869                  * If there is an anchor on this stream and popping
3870                  * the current module would attempt to pop through the
3871                  * anchor, then disallow the pop unless we have sufficient
3872                  * privileges; take the cheapest (non-locking) check
3873                  * first.
3874                  */
3875                 if (secpolicy_ip_config(crp, B_TRUE) != 0 ||
3876                     (stp->sd_anchorzone != crgetzoneid(crp))) {
3877                         mutex_enter(&stp->sd_lock);
3878                         /*
3879                          * Anchors only apply if there's at least one
3880                          * module on the stream (sd_pushcnt > 0).
3881                          */
3882                         if (stp->sd_pushcnt > 0 &&
3883                             stp->sd_pushcnt == stp->sd_anchor &&
3884                             stp->sd_vnode->v_type != VFIFO) {
3885                                 strendplumb(stp);
3886                                 mutex_exit(&stp->sd_lock);
3887                                 if (stp->sd_anchorzone != crgetzoneid(crp))
3888                                         return (EINVAL);
3889                                 /* Audit and report error */
3890                                 return (secpolicy_ip_config(crp, B_FALSE));
3891                         }
3892                         mutex_exit(&stp->sd_lock);
3893                 }
3894 
3895                 q = wrq->q_next;
3896                 TRACE_2(TR_FAC_STREAMS_FR, TR_I_POP,
3897                     "I_POP:%p from %p", q, stp);
3898                 if (q->q_next == NULL || (q->q_flag & (QREADR|QISDRV))) {
3899                         error = EINVAL;
3900                 } else {
3901                         qdetach(_RD(q), 1, flag, crp, B_FALSE);
3902                         error = 0;
3903                 }
3904                 mutex_enter(&stp->sd_lock);
3905 
3906                 /*
3907                  * As a performance concern we are caching the values of
3908                  * q_minpsz and q_maxpsz of the module below the stream
3909                  * head in the stream head.
3910                  */
3911                 mutex_enter(QLOCK(wrq->q_next));
3912                 rmin = wrq->q_next->q_minpsz;
3913                 rmax = wrq->q_next->q_maxpsz;
3914                 mutex_exit(QLOCK(wrq->q_next));
3915 
3916                 /* Do this processing here as a performance concern */
3917                 if (strmsgsz != 0) {
3918                         if (rmax == INFPSZ)
3919                                 rmax = strmsgsz;
3920                         else  {
3921                                 if (vp->v_type == VFIFO)
3922                                         rmax = MIN(PIPE_BUF, rmax);
3923                                 else    rmax = MIN(strmsgsz, rmax);
3924                         }
3925                 }
3926 
3927                 mutex_enter(QLOCK(wrq));
3928                 stp->sd_qn_minpsz = rmin;
3929                 stp->sd_qn_maxpsz = rmax;
3930                 mutex_exit(QLOCK(wrq));
3931 
3932                 /* If we popped through the anchor, then reset the anchor. */
3933                 if (stp->sd_pushcnt < stp->sd_anchor) {
3934                         stp->sd_anchor = 0;
3935                         stp->sd_anchorzone = 0;
3936                 }
3937                 strendplumb(stp);
3938                 mutex_exit(&stp->sd_lock);
3939                 return (error);
3940         }
3941 
3942         case _I_MUXID2FD:
3943         {
3944                 /*
3945                  * Create a fd for a I_PLINK'ed lower stream with a given
3946                  * muxid.  With the fd, application can send down ioctls,
3947                  * like I_LIST, to the previously I_PLINK'ed stream.  Note
3948                  * that after getting the fd, the application has to do an
3949                  * I_PUNLINK on the muxid before it can do any operation
3950                  * on the lower stream.  This is required by spec1170.
3951                  *
3952                  * The fd used to do this ioctl should point to the same
3953                  * controlling device used to do the I_PLINK.  If it uses
3954                  * a different stream or an invalid muxid, I_MUXID2FD will
3955                  * fail.  The error code is set to EINVAL.
3956                  *
3957                  * The intended use of this interface is the following.
3958                  * An application I_PLINK'ed a stream and exits.  The fd
3959                  * to the lower stream is gone.  Another application
3960                  * wants to get a fd to the lower stream, it uses I_MUXID2FD.
3961                  */
3962                 int muxid = (int)arg;
3963                 int fd;
3964                 linkinfo_t *linkp;
3965                 struct file *fp;
3966                 netstack_t *ns;
3967                 str_stack_t *ss;
3968 
3969                 /*
3970                  * Do not allow the wildcard muxid.  This ioctl is not
3971                  * intended to find arbitrary link.
3972                  */
3973                 if (muxid == 0) {
3974                         return (EINVAL);
3975                 }
3976 
3977                 ns = netstack_find_by_cred(crp);
3978                 ASSERT(ns != NULL);
3979                 ss = ns->netstack_str;
3980                 ASSERT(ss != NULL);
3981 
3982                 mutex_enter(&muxifier);
3983                 linkp = findlinks(vp->v_stream, muxid, LINKPERSIST, ss);
3984                 if (linkp == NULL) {
3985                         mutex_exit(&muxifier);
3986                         netstack_rele(ss->ss_netstack);
3987                         return (EINVAL);
3988                 }
3989 
3990                 if ((fd = ufalloc(0)) == -1) {
3991                         mutex_exit(&muxifier);
3992                         netstack_rele(ss->ss_netstack);
3993                         return (EMFILE);
3994                 }
3995                 fp = linkp->li_fpdown;
3996                 mutex_enter(&fp->f_tlock);
3997                 fp->f_count++;
3998                 mutex_exit(&fp->f_tlock);
3999                 mutex_exit(&muxifier);
4000                 setf(fd, fp);
4001                 *rvalp = fd;
4002                 netstack_rele(ss->ss_netstack);
4003                 return (0);
4004         }
4005 
4006         case _I_INSERT:
4007         {
4008                 /*
4009                  * To insert a module to a given position in a stream.
4010                  * In the first release, only allow privileged user
4011                  * to use this ioctl. Furthermore, the insert is only allowed
4012                  * below an anchor if the zoneid is the same as the zoneid
4013                  * which created the anchor.
4014                  *
4015                  * Note that we do not plan to support this ioctl
4016                  * on pipes in the first release.  We want to learn more
4017                  * about the implications of these ioctls before extending
4018                  * their support.  And we do not think these features are
4019                  * valuable for pipes.
4020                  */
4021                 STRUCT_DECL(strmodconf, strmodinsert);
4022                 char mod_name[FMNAMESZ + 1];
4023                 fmodsw_impl_t *fp;
4024                 dev_t dummydev;
4025                 queue_t *tmp_wrq;
4026                 int pos;
4027                 boolean_t is_insert;
4028 
4029                 STRUCT_INIT(strmodinsert, flag);
4030                 if (stp->sd_flag & STRHUP)
4031                         return (ENXIO);
4032                 if (STRMATED(stp))
4033                         return (EINVAL);
4034                 if ((error = secpolicy_net_config(crp, B_FALSE)) != 0)
4035                         return (error);
4036                 if (stp->sd_anchor != 0 &&
4037                     stp->sd_anchorzone != crgetzoneid(crp))
4038                         return (EINVAL);
4039 
4040                 error = strcopyin((void *)arg, STRUCT_BUF(strmodinsert),
4041                     STRUCT_SIZE(strmodinsert), copyflag);
4042                 if (error)
4043                         return (error);
4044 
4045                 /*
4046                  * Get module name and look up in fmodsw.
4047                  */
4048                 error = (copyflag & U_TO_K ? copyinstr :
4049                     copystr)(STRUCT_FGETP(strmodinsert, mod_name),
4050                     mod_name, FMNAMESZ + 1, NULL);
4051                 if (error)
4052                         return ((error == ENAMETOOLONG) ? EINVAL : EFAULT);
4053 
4054                 if ((fp = fmodsw_find(mod_name, FMODSW_HOLD | FMODSW_LOAD)) ==
4055                     NULL)
4056                         return (EINVAL);
4057 
4058                 if (error = strstartplumb(stp, flag, cmd)) {
4059                         fmodsw_rele(fp);
4060                         return (error);
4061                 }
4062 
4063                 /*
4064                  * Is this _I_INSERT just like an I_PUSH?  We need to know
4065                  * this because we do some optimizations if this is a
4066                  * module being pushed.
4067                  */
4068                 pos = STRUCT_FGET(strmodinsert, pos);
4069                 is_insert = (pos != 0);
4070 
4071                 /*
4072                  * Make sure pos is valid.  Even though it is not an I_PUSH,
4073                  * we impose the same limit on the number of modules in a
4074                  * stream.
4075                  */
4076                 mutex_enter(&stp->sd_lock);
4077                 if (stp->sd_pushcnt >= nstrpush || pos < 0 ||
4078                     pos > stp->sd_pushcnt) {
4079                         fmodsw_rele(fp);
4080                         strendplumb(stp);
4081                         mutex_exit(&stp->sd_lock);
4082                         return (EINVAL);
4083                 }
4084                 if (stp->sd_anchor != 0) {
4085                         /*
4086                          * Is this insert below the anchor?
4087                          * Pushcnt hasn't been increased yet hence
4088                          * we test for greater than here, and greater or
4089                          * equal after qattach.
4090                          */
4091                         if (pos > (stp->sd_pushcnt - stp->sd_anchor) &&
4092                             stp->sd_anchorzone != crgetzoneid(crp)) {
4093                                 fmodsw_rele(fp);
4094                                 strendplumb(stp);
4095                                 mutex_exit(&stp->sd_lock);
4096                                 return (EPERM);
4097                         }
4098                 }
4099 
4100                 mutex_exit(&stp->sd_lock);
4101 
4102                 /*
4103                  * First find the correct position this module to
4104                  * be inserted.  We don't need to call claimstr()
4105                  * as the stream should not be changing at this point.
4106                  *
4107                  * Insert new module and call its open routine
4108                  * via qattach().  Modules don't change device
4109                  * numbers, so just ignore dummydev here.
4110                  */
4111                 for (tmp_wrq = stp->sd_wrq; pos > 0;
4112                     tmp_wrq = tmp_wrq->q_next, pos--) {
4113                         ASSERT(SAMESTR(tmp_wrq));
4114                 }
4115                 dummydev = vp->v_rdev;
4116                 if ((error = qattach(_RD(tmp_wrq), &dummydev, 0, crp,
4117                     fp, is_insert)) != 0) {
4118                         mutex_enter(&stp->sd_lock);
4119                         strendplumb(stp);
4120                         mutex_exit(&stp->sd_lock);
4121                         return (error);
4122                 }
4123 
4124                 mutex_enter(&stp->sd_lock);
4125 
4126                 /*
4127                  * As a performance concern we are caching the values of
4128                  * q_minpsz and q_maxpsz of the module below the stream
4129                  * head in the stream head.
4130                  */
4131                 if (!is_insert) {
4132                         mutex_enter(QLOCK(stp->sd_wrq->q_next));
4133                         rmin = stp->sd_wrq->q_next->q_minpsz;
4134                         rmax = stp->sd_wrq->q_next->q_maxpsz;
4135                         mutex_exit(QLOCK(stp->sd_wrq->q_next));
4136 
4137                         /* Do this processing here as a performance concern */
4138                         if (strmsgsz != 0) {
4139                                 if (rmax == INFPSZ) {
4140                                         rmax = strmsgsz;
4141                                 } else  {
4142                                         rmax = MIN(strmsgsz, rmax);
4143                                 }
4144                         }
4145 
4146                         mutex_enter(QLOCK(wrq));
4147                         stp->sd_qn_minpsz = rmin;
4148                         stp->sd_qn_maxpsz = rmax;
4149                         mutex_exit(QLOCK(wrq));
4150                 }
4151 
4152                 /*
4153                  * Need to update the anchor value if this module is
4154                  * inserted below the anchor point.
4155                  */
4156                 if (stp->sd_anchor != 0) {
4157                         pos = STRUCT_FGET(strmodinsert, pos);
4158                         if (pos >= (stp->sd_pushcnt - stp->sd_anchor))
4159                                 stp->sd_anchor++;
4160                 }
4161 
4162                 strendplumb(stp);
4163                 mutex_exit(&stp->sd_lock);
4164                 return (0);
4165         }
4166 
4167         case _I_REMOVE:
4168         {
4169                 /*
4170                  * To remove a module with a given name in a stream.  The
4171                  * caller of this ioctl needs to provide both the name and
4172                  * the position of the module to be removed.  This eliminates
4173                  * the ambiguity of removal if a module is inserted/pushed
4174                  * multiple times in a stream.  In the first release, only
4175                  * allow privileged user to use this ioctl.
4176                  * Furthermore, the remove is only allowed
4177                  * below an anchor if the zoneid is the same as the zoneid
4178                  * which created the anchor.
4179                  *
4180                  * Note that we do not plan to support this ioctl
4181                  * on pipes in the first release.  We want to learn more
4182                  * about the implications of these ioctls before extending
4183                  * their support.  And we do not think these features are
4184                  * valuable for pipes.
4185                  *
4186                  * Also note that _I_REMOVE cannot be used to remove a
4187                  * driver or the stream head.
4188                  */
4189                 STRUCT_DECL(strmodconf, strmodremove);
4190                 queue_t *q;
4191                 int pos;
4192                 char mod_name[FMNAMESZ + 1];
4193                 boolean_t is_remove;
4194 
4195                 STRUCT_INIT(strmodremove, flag);
4196                 if (stp->sd_flag & STRHUP)
4197                         return (ENXIO);
4198                 if (STRMATED(stp))
4199                         return (EINVAL);
4200                 if ((error = secpolicy_net_config(crp, B_FALSE)) != 0)
4201                         return (error);
4202                 if (stp->sd_anchor != 0 &&
4203                     stp->sd_anchorzone != crgetzoneid(crp))
4204                         return (EINVAL);
4205 
4206                 error = strcopyin((void *)arg, STRUCT_BUF(strmodremove),
4207                     STRUCT_SIZE(strmodremove), copyflag);
4208                 if (error)
4209                         return (error);
4210 
4211                 error = (copyflag & U_TO_K ? copyinstr :
4212                     copystr)(STRUCT_FGETP(strmodremove, mod_name),
4213                     mod_name, FMNAMESZ + 1, NULL);
4214                 if (error)
4215                         return ((error == ENAMETOOLONG) ? EINVAL : EFAULT);
4216 
4217                 if ((error = strstartplumb(stp, flag, cmd)) != 0)
4218                         return (error);
4219 
4220                 /*
4221                  * Match the name of given module to the name of module at
4222                  * the given position.
4223                  */
4224                 pos = STRUCT_FGET(strmodremove, pos);
4225 
4226                 is_remove = (pos != 0);
4227                 for (q = stp->sd_wrq->q_next; SAMESTR(q) && pos > 0;
4228                     q = q->q_next, pos--)
4229                         ;
4230                 if (pos > 0 || !SAMESTR(q) ||
4231                     strcmp(Q2NAME(q), mod_name) != 0) {
4232                         mutex_enter(&stp->sd_lock);
4233                         strendplumb(stp);
4234                         mutex_exit(&stp->sd_lock);
4235                         return (EINVAL);
4236                 }
4237 
4238                 /*
4239                  * If the position is at or below an anchor, then the zoneid
4240                  * must match the zoneid that created the anchor.
4241                  */
4242                 if (stp->sd_anchor != 0) {
4243                         pos = STRUCT_FGET(strmodremove, pos);
4244                         if (pos >= (stp->sd_pushcnt - stp->sd_anchor) &&
4245                             stp->sd_anchorzone != crgetzoneid(crp)) {
4246                                 mutex_enter(&stp->sd_lock);
4247                                 strendplumb(stp);
4248                                 mutex_exit(&stp->sd_lock);
4249                                 return (EPERM);
4250                         }
4251                 }
4252 
4253 
4254                 ASSERT(!(q->q_flag & QREADR));
4255                 qdetach(_RD(q), 1, flag, crp, is_remove);
4256 
4257                 mutex_enter(&stp->sd_lock);
4258 
4259                 /*
4260                  * As a performance concern we are caching the values of
4261                  * q_minpsz and q_maxpsz of the module below the stream
4262                  * head in the stream head.
4263                  */
4264                 if (!is_remove) {
4265                         mutex_enter(QLOCK(wrq->q_next));
4266                         rmin = wrq->q_next->q_minpsz;
4267                         rmax = wrq->q_next->q_maxpsz;
4268                         mutex_exit(QLOCK(wrq->q_next));
4269 
4270                         /* Do this processing here as a performance concern */
4271                         if (strmsgsz != 0) {
4272                                 if (rmax == INFPSZ)
4273                                         rmax = strmsgsz;
4274                                 else  {
4275                                         if (vp->v_type == VFIFO)
4276                                                 rmax = MIN(PIPE_BUF, rmax);
4277                                         else    rmax = MIN(strmsgsz, rmax);
4278                                 }
4279                         }
4280 
4281                         mutex_enter(QLOCK(wrq));
4282                         stp->sd_qn_minpsz = rmin;
4283                         stp->sd_qn_maxpsz = rmax;
4284                         mutex_exit(QLOCK(wrq));
4285                 }
4286 
4287                 /*
4288                  * Need to update the anchor value if this module is removed
4289                  * at or below the anchor point.  If the removed module is at
4290                  * the anchor point, remove the anchor for this stream if
4291                  * there is no module above the anchor point.  Otherwise, if
4292                  * the removed module is below the anchor point, decrement the
4293                  * anchor point by 1.
4294                  */
4295                 if (stp->sd_anchor != 0) {
4296                         pos = STRUCT_FGET(strmodremove, pos);
4297                         if (pos == stp->sd_pushcnt - stp->sd_anchor + 1)
4298                                 stp->sd_anchor = 0;
4299                         else if (pos > (stp->sd_pushcnt - stp->sd_anchor + 1))
4300                                 stp->sd_anchor--;
4301                 }
4302 
4303                 strendplumb(stp);
4304                 mutex_exit(&stp->sd_lock);
4305                 return (0);
4306         }
4307 
4308         case I_ANCHOR:
4309                 /*
4310                  * Set the anchor position on the stream to reside at
4311                  * the top module (in other words, the top module
4312                  * cannot be popped).  Anchors with a FIFO make no
4313                  * obvious sense, so they're not allowed.
4314                  */
4315                 mutex_enter(&stp->sd_lock);
4316 
4317                 if (stp->sd_vnode->v_type == VFIFO) {
4318                         mutex_exit(&stp->sd_lock);
4319                         return (EINVAL);
4320                 }
4321                 /* Only allow the same zoneid to update the anchor */
4322                 if (stp->sd_anchor != 0 &&
4323                     stp->sd_anchorzone != crgetzoneid(crp)) {
4324                         mutex_exit(&stp->sd_lock);
4325                         return (EINVAL);
4326                 }
4327                 stp->sd_anchor = stp->sd_pushcnt;
4328                 stp->sd_anchorzone = crgetzoneid(crp);
4329                 mutex_exit(&stp->sd_lock);
4330                 return (0);
4331 
4332         case I_LOOK:
4333                 /*
4334                  * Get name of first module downstream.
4335                  * If no module, return an error.
4336                  */
4337                 claimstr(wrq);
4338                 if (_SAMESTR(wrq) && wrq->q_next->q_next != NULL) {
4339                         char *name = Q2NAME(wrq->q_next);
4340 
4341                         error = strcopyout(name, (void *)arg, strlen(name) + 1,
4342                             copyflag);
4343                         releasestr(wrq);
4344                         return (error);
4345                 }
4346                 releasestr(wrq);
4347                 return (EINVAL);
4348 
4349         case I_LINK:
4350         case I_PLINK:
4351                 /*
4352                  * Link a multiplexor.
4353                  */
4354                 return (mlink(vp, cmd, (int)arg, crp, rvalp, 0));
4355 
4356         case _I_PLINK_LH:
4357                 /*
4358                  * Link a multiplexor: Call must originate from kernel.
4359                  */
4360                 if (kioctl)
4361                         return (ldi_mlink_lh(vp, cmd, arg, crp, rvalp));
4362 
4363                 return (EINVAL);
4364         case I_UNLINK:
4365         case I_PUNLINK:
4366                 /*
4367                  * Unlink a multiplexor.
4368                  * If arg is -1, unlink all links for which this is the
4369                  * controlling stream.  Otherwise, arg is an index number
4370                  * for a link to be removed.
4371                  */
4372         {
4373                 struct linkinfo *linkp;
4374                 int native_arg = (int)arg;
4375                 int type;
4376                 netstack_t *ns;
4377                 str_stack_t *ss;
4378 
4379                 TRACE_1(TR_FAC_STREAMS_FR,
4380                     TR_I_UNLINK, "I_UNLINK/I_PUNLINK:%p", stp);
4381                 if (vp->v_type == VFIFO) {
4382                         return (EINVAL);
4383                 }
4384                 if (cmd == I_UNLINK)
4385                         type = LINKNORMAL;
4386                 else    /* I_PUNLINK */
4387                         type = LINKPERSIST;
4388                 if (native_arg == 0) {
4389                         return (EINVAL);
4390                 }
4391                 ns = netstack_find_by_cred(crp);
4392                 ASSERT(ns != NULL);
4393                 ss = ns->netstack_str;
4394                 ASSERT(ss != NULL);
4395 
4396                 if (native_arg == MUXID_ALL)
4397                         error = munlinkall(stp, type, crp, rvalp, ss);
4398                 else {
4399                         mutex_enter(&muxifier);
4400                         if (!(linkp = findlinks(stp, (int)arg, type, ss))) {
4401                                 /* invalid user supplied index number */
4402                                 mutex_exit(&muxifier);
4403                                 netstack_rele(ss->ss_netstack);
4404                                 return (EINVAL);
4405                         }
4406                         /* munlink drops the muxifier lock */
4407                         error = munlink(stp, linkp, type, crp, rvalp, ss);
4408                 }
4409                 netstack_rele(ss->ss_netstack);
4410                 return (error);
4411         }
4412 
4413         case I_FLUSH:
4414                 /*
4415                  * send a flush message downstream
4416                  * flush message can indicate
4417                  * FLUSHR - flush read queue
4418                  * FLUSHW - flush write queue
4419                  * FLUSHRW - flush read/write queue
4420                  */
4421                 if (stp->sd_flag & STRHUP)
4422                         return (ENXIO);
4423                 if (arg & ~FLUSHRW)
4424                         return (EINVAL);
4425 
4426                 for (;;) {
4427                         if (putnextctl1(stp->sd_wrq, M_FLUSH, (int)arg)) {
4428                                 break;
4429                         }
4430                         if (error = strwaitbuf(1, BPRI_HI)) {
4431                                 return (error);
4432                         }
4433                 }
4434 
4435                 /*
4436                  * Send down an unsupported ioctl and wait for the nack
4437                  * in order to allow the M_FLUSH to propagate back
4438                  * up to the stream head.
4439                  * Replaces if (qready()) runqueues();
4440                  */
4441                 strioc.ic_cmd = -1;     /* The unsupported ioctl */
4442                 strioc.ic_timout = 0;
4443                 strioc.ic_len = 0;
4444                 strioc.ic_dp = NULL;
4445                 (void) strdoioctl(stp, &strioc, flag, K_TO_K, crp, rvalp);
4446                 *rvalp = 0;
4447                 return (0);
4448 
4449         case I_FLUSHBAND:
4450         {
4451                 struct bandinfo binfo;
4452 
4453                 error = strcopyin((void *)arg, &binfo, sizeof (binfo),
4454                     copyflag);
4455                 if (error)
4456                         return (error);
4457                 if (stp->sd_flag & STRHUP)
4458                         return (ENXIO);
4459                 if (binfo.bi_flag & ~FLUSHRW)
4460                         return (EINVAL);
4461                 while (!(mp = allocb(2, BPRI_HI))) {
4462                         if (error = strwaitbuf(2, BPRI_HI))
4463                                 return (error);
4464                 }
4465                 mp->b_datap->db_type = M_FLUSH;
4466                 *mp->b_wptr++ = binfo.bi_flag | FLUSHBAND;
4467                 *mp->b_wptr++ = binfo.bi_pri;
4468                 putnext(stp->sd_wrq, mp);
4469                 /*
4470                  * Send down an unsupported ioctl and wait for the nack
4471                  * in order to allow the M_FLUSH to propagate back
4472                  * up to the stream head.
4473                  * Replaces if (qready()) runqueues();
4474                  */
4475                 strioc.ic_cmd = -1;     /* The unsupported ioctl */
4476                 strioc.ic_timout = 0;
4477                 strioc.ic_len = 0;
4478                 strioc.ic_dp = NULL;
4479                 (void) strdoioctl(stp, &strioc, flag, K_TO_K, crp, rvalp);
4480                 *rvalp = 0;
4481                 return (0);
4482         }
4483 
4484         case I_SRDOPT:
4485                 /*
4486                  * Set read options
4487                  *
4488                  * RNORM - default stream mode
4489                  * RMSGN - message no discard
4490                  * RMSGD - message discard
4491                  * RPROTNORM - fail read with EBADMSG for M_[PC]PROTOs
4492                  * RPROTDAT - convert M_[PC]PROTOs to M_DATAs
4493                  * RPROTDIS - discard M_[PC]PROTOs and retain M_DATAs
4494                  */
4495                 if (arg & ~(RMODEMASK | RPROTMASK))
4496                         return (EINVAL);
4497 
4498                 if ((arg & (RMSGD|RMSGN)) == (RMSGD|RMSGN))
4499                         return (EINVAL);
4500 
4501                 mutex_enter(&stp->sd_lock);
4502                 switch (arg & RMODEMASK) {
4503                 case RNORM:
4504                         stp->sd_read_opt &= ~(RD_MSGDIS | RD_MSGNODIS);
4505                         break;
4506                 case RMSGD:
4507                         stp->sd_read_opt = (stp->sd_read_opt & ~RD_MSGNODIS) |
4508                             RD_MSGDIS;
4509                         break;
4510                 case RMSGN:
4511                         stp->sd_read_opt = (stp->sd_read_opt & ~RD_MSGDIS) |
4512                             RD_MSGNODIS;
4513                         break;
4514                 }
4515 
4516                 switch (arg & RPROTMASK) {
4517                 case RPROTNORM:
4518                         stp->sd_read_opt &= ~(RD_PROTDAT | RD_PROTDIS);
4519                         break;
4520 
4521                 case RPROTDAT:
4522                         stp->sd_read_opt = ((stp->sd_read_opt & ~RD_PROTDIS) |
4523                             RD_PROTDAT);
4524                         break;
4525 
4526                 case RPROTDIS:
4527                         stp->sd_read_opt = ((stp->sd_read_opt & ~RD_PROTDAT) |
4528                             RD_PROTDIS);
4529                         break;
4530                 }
4531                 mutex_exit(&stp->sd_lock);
4532                 return (0);
4533 
4534         case I_GRDOPT:
4535                 /*
4536                  * Get read option and return the value
4537                  * to spot pointed to by arg
4538                  */
4539         {
4540                 int rdopt;
4541 
4542                 rdopt = ((stp->sd_read_opt & RD_MSGDIS) ? RMSGD :
4543                     ((stp->sd_read_opt & RD_MSGNODIS) ? RMSGN : RNORM));
4544                 rdopt |= ((stp->sd_read_opt & RD_PROTDAT) ? RPROTDAT :
4545                     ((stp->sd_read_opt & RD_PROTDIS) ? RPROTDIS : RPROTNORM));
4546 
4547                 return (strcopyout(&rdopt, (void *)arg, sizeof (int),
4548                     copyflag));
4549         }
4550 
4551         case I_SERROPT:
4552                 /*
4553                  * Set error options
4554                  *
4555                  * RERRNORM - persistent read errors
4556                  * RERRNONPERSIST - non-persistent read errors
4557                  * WERRNORM - persistent write errors
4558                  * WERRNONPERSIST - non-persistent write errors
4559                  */
4560                 if (arg & ~(RERRMASK | WERRMASK))
4561                         return (EINVAL);
4562 
4563                 mutex_enter(&stp->sd_lock);
4564                 switch (arg & RERRMASK) {
4565                 case RERRNORM:
4566                         stp->sd_flag &= ~STRDERRNONPERSIST;
4567                         break;
4568                 case RERRNONPERSIST:
4569                         stp->sd_flag |= STRDERRNONPERSIST;
4570                         break;
4571                 }
4572                 switch (arg & WERRMASK) {
4573                 case WERRNORM:
4574                         stp->sd_flag &= ~STWRERRNONPERSIST;
4575                         break;
4576                 case WERRNONPERSIST:
4577                         stp->sd_flag |= STWRERRNONPERSIST;
4578                         break;
4579                 }
4580                 mutex_exit(&stp->sd_lock);
4581                 return (0);
4582 
4583         case I_GERROPT:
4584                 /*
4585                  * Get error option and return the value
4586                  * to spot pointed to by arg
4587                  */
4588         {
4589                 int erropt = 0;
4590 
4591                 erropt |= (stp->sd_flag & STRDERRNONPERSIST) ? RERRNONPERSIST :
4592                     RERRNORM;
4593                 erropt |= (stp->sd_flag & STWRERRNONPERSIST) ? WERRNONPERSIST :
4594                     WERRNORM;
4595                 return (strcopyout(&erropt, (void *)arg, sizeof (int),
4596                     copyflag));
4597         }
4598 
4599         case I_SETSIG:
4600                 /*
4601                  * Register the calling proc to receive the SIGPOLL
4602                  * signal based on the events given in arg.  If
4603                  * arg is zero, remove the proc from register list.
4604                  */
4605         {
4606                 strsig_t *ssp, *pssp;
4607                 struct pid *pidp;
4608 
4609                 pssp = NULL;
4610                 pidp = curproc->p_pidp;
4611                 /*
4612                  * Hold sd_lock to prevent traversal of sd_siglist while
4613                  * it is modified.
4614                  */
4615                 mutex_enter(&stp->sd_lock);
4616                 for (ssp = stp->sd_siglist; ssp && (ssp->ss_pidp != pidp);
4617                     pssp = ssp, ssp = ssp->ss_next)
4618                         ;
4619 
4620                 if (arg) {
4621                         if (arg & ~(S_INPUT|S_HIPRI|S_MSG|S_HANGUP|S_ERROR|
4622                             S_RDNORM|S_WRNORM|S_RDBAND|S_WRBAND|S_BANDURG)) {
4623                                 mutex_exit(&stp->sd_lock);
4624                                 return (EINVAL);
4625                         }
4626                         if ((arg & S_BANDURG) && !(arg & S_RDBAND)) {
4627                                 mutex_exit(&stp->sd_lock);
4628                                 return (EINVAL);
4629                         }
4630 
4631                         /*
4632                          * If proc not already registered, add it
4633                          * to list.
4634                          */
4635                         if (!ssp) {
4636                                 ssp = kmem_alloc(sizeof (strsig_t), KM_SLEEP);
4637                                 ssp->ss_pidp = pidp;
4638                                 ssp->ss_pid = pidp->pid_id;
4639                                 ssp->ss_next = NULL;
4640                                 if (pssp)
4641                                         pssp->ss_next = ssp;
4642                                 else
4643                                         stp->sd_siglist = ssp;
4644                                 mutex_enter(&pidlock);
4645                                 PID_HOLD(pidp);
4646                                 mutex_exit(&pidlock);
4647                         }
4648 
4649                         /*
4650                          * Set events.
4651                          */
4652                         ssp->ss_events = (int)arg;
4653                 } else {
4654                         /*
4655                          * Remove proc from register list.
4656                          */
4657                         if (ssp) {
4658                                 mutex_enter(&pidlock);
4659                                 PID_RELE(pidp);
4660                                 mutex_exit(&pidlock);
4661                                 if (pssp)
4662                                         pssp->ss_next = ssp->ss_next;
4663                                 else
4664                                         stp->sd_siglist = ssp->ss_next;
4665                                 kmem_free(ssp, sizeof (strsig_t));
4666                         } else {
4667                                 mutex_exit(&stp->sd_lock);
4668                                 return (EINVAL);
4669                         }
4670                 }
4671 
4672                 /*
4673                  * Recalculate OR of sig events.
4674                  */
4675                 stp->sd_sigflags = 0;
4676                 for (ssp = stp->sd_siglist; ssp; ssp = ssp->ss_next)
4677                         stp->sd_sigflags |= ssp->ss_events;
4678                 mutex_exit(&stp->sd_lock);
4679                 return (0);
4680         }
4681 
4682         case I_GETSIG:
4683                 /*
4684                  * Return (in arg) the current registration of events
4685                  * for which the calling proc is to be signaled.
4686                  */
4687         {
4688                 struct strsig *ssp;
4689                 struct pid  *pidp;
4690 
4691                 pidp = curproc->p_pidp;
4692                 mutex_enter(&stp->sd_lock);
4693                 for (ssp = stp->sd_siglist; ssp; ssp = ssp->ss_next)
4694                         if (ssp->ss_pidp == pidp) {
4695                                 error = strcopyout(&ssp->ss_events, (void *)arg,
4696                                     sizeof (int), copyflag);
4697                                 mutex_exit(&stp->sd_lock);
4698                                 return (error);
4699                         }
4700                 mutex_exit(&stp->sd_lock);
4701                 return (EINVAL);
4702         }
4703 
4704         case I_ESETSIG:
4705                 /*
4706                  * Register the ss_pid to receive the SIGPOLL
4707                  * signal based on the events is ss_events arg.  If
4708                  * ss_events is zero, remove the proc from register list.
4709                  */
4710         {
4711                 struct strsig *ssp, *pssp;
4712                 struct proc *proc;
4713                 struct pid  *pidp;
4714                 pid_t pid;
4715                 struct strsigset ss;
4716 
4717                 error = strcopyin((void *)arg, &ss, sizeof (ss), copyflag);
4718                 if (error)
4719                         return (error);
4720 
4721                 pid = ss.ss_pid;
4722 
4723                 if (ss.ss_events != 0) {
4724                         /*
4725                          * Permissions check by sending signal 0.
4726                          * Note that when kill fails it does a set_errno
4727                          * causing the system call to fail.
4728                          */
4729                         error = kill(pid, 0);
4730                         if (error) {
4731                                 return (error);
4732                         }
4733                 }
4734                 mutex_enter(&pidlock);
4735                 if (pid == 0)
4736                         proc = curproc;
4737                 else if (pid < 0)
4738                         proc = pgfind(-pid);
4739                 else
4740                         proc = prfind(pid);
4741                 if (proc == NULL) {
4742                         mutex_exit(&pidlock);
4743                         return (ESRCH);
4744                 }
4745                 if (pid < 0)
4746                         pidp = proc->p_pgidp;
4747                 else
4748                         pidp = proc->p_pidp;
4749                 ASSERT(pidp);
4750                 /*
4751                  * Get a hold on the pid structure while referencing it.
4752                  * There is a separate PID_HOLD should it be inserted
4753                  * in the list below.
4754                  */
4755                 PID_HOLD(pidp);
4756                 mutex_exit(&pidlock);
4757 
4758                 pssp = NULL;
4759                 /*
4760                  * Hold sd_lock to prevent traversal of sd_siglist while
4761                  * it is modified.
4762                  */
4763                 mutex_enter(&stp->sd_lock);
4764                 for (ssp = stp->sd_siglist; ssp && (ssp->ss_pid != pid);
4765                     pssp = ssp, ssp = ssp->ss_next)
4766                         ;
4767 
4768                 if (ss.ss_events) {
4769                         if (ss.ss_events &
4770                             ~(S_INPUT|S_HIPRI|S_MSG|S_HANGUP|S_ERROR|
4771                             S_RDNORM|S_WRNORM|S_RDBAND|S_WRBAND|S_BANDURG)) {
4772                                 mutex_exit(&stp->sd_lock);
4773                                 mutex_enter(&pidlock);
4774                                 PID_RELE(pidp);
4775                                 mutex_exit(&pidlock);
4776                                 return (EINVAL);
4777                         }
4778                         if ((ss.ss_events & S_BANDURG) &&
4779                             !(ss.ss_events & S_RDBAND)) {
4780                                 mutex_exit(&stp->sd_lock);
4781                                 mutex_enter(&pidlock);
4782                                 PID_RELE(pidp);
4783                                 mutex_exit(&pidlock);
4784                                 return (EINVAL);
4785                         }
4786 
4787                         /*
4788                          * If proc not already registered, add it
4789                          * to list.
4790                          */
4791                         if (!ssp) {
4792                                 ssp = kmem_alloc(sizeof (strsig_t), KM_SLEEP);
4793                                 ssp->ss_pidp = pidp;
4794                                 ssp->ss_pid = pid;
4795                                 ssp->ss_next = NULL;
4796                                 if (pssp)
4797                                         pssp->ss_next = ssp;
4798                                 else
4799                                         stp->sd_siglist = ssp;
4800                                 mutex_enter(&pidlock);
4801                                 PID_HOLD(pidp);
4802                                 mutex_exit(&pidlock);
4803                         }
4804 
4805                         /*
4806                          * Set events.
4807                          */
4808                         ssp->ss_events = ss.ss_events;
4809                 } else {
4810                         /*
4811                          * Remove proc from register list.
4812                          */
4813                         if (ssp) {
4814                                 mutex_enter(&pidlock);
4815                                 PID_RELE(pidp);
4816                                 mutex_exit(&pidlock);
4817                                 if (pssp)
4818                                         pssp->ss_next = ssp->ss_next;
4819                                 else
4820                                         stp->sd_siglist = ssp->ss_next;
4821                                 kmem_free(ssp, sizeof (strsig_t));
4822                         } else {
4823                                 mutex_exit(&stp->sd_lock);
4824                                 mutex_enter(&pidlock);
4825                                 PID_RELE(pidp);
4826                                 mutex_exit(&pidlock);
4827                                 return (EINVAL);
4828                         }
4829                 }
4830 
4831                 /*
4832                  * Recalculate OR of sig events.
4833                  */
4834                 stp->sd_sigflags = 0;
4835                 for (ssp = stp->sd_siglist; ssp; ssp = ssp->ss_next)
4836                         stp->sd_sigflags |= ssp->ss_events;
4837                 mutex_exit(&stp->sd_lock);
4838                 mutex_enter(&pidlock);
4839                 PID_RELE(pidp);
4840                 mutex_exit(&pidlock);
4841                 return (0);
4842         }
4843 
4844         case I_EGETSIG:
4845                 /*
4846                  * Return (in arg) the current registration of events
4847                  * for which the calling proc is to be signaled.
4848                  */
4849         {
4850                 struct strsig *ssp;
4851                 struct proc *proc;
4852                 pid_t pid;
4853                 struct pid  *pidp;
4854                 struct strsigset ss;
4855 
4856                 error = strcopyin((void *)arg, &ss, sizeof (ss), copyflag);
4857                 if (error)
4858                         return (error);
4859 
4860                 pid = ss.ss_pid;
4861                 mutex_enter(&pidlock);
4862                 if (pid == 0)
4863                         proc = curproc;
4864                 else if (pid < 0)
4865                         proc = pgfind(-pid);
4866                 else
4867                         proc = prfind(pid);
4868                 if (proc == NULL) {
4869                         mutex_exit(&pidlock);
4870                         return (ESRCH);
4871                 }
4872                 if (pid < 0)
4873                         pidp = proc->p_pgidp;
4874                 else
4875                         pidp = proc->p_pidp;
4876 
4877                 /* Prevent the pidp from being reassigned */
4878                 PID_HOLD(pidp);
4879                 mutex_exit(&pidlock);
4880 
4881                 mutex_enter(&stp->sd_lock);
4882                 for (ssp = stp->sd_siglist; ssp; ssp = ssp->ss_next)
4883                         if (ssp->ss_pid == pid) {
4884                                 ss.ss_pid = ssp->ss_pid;
4885                                 ss.ss_events = ssp->ss_events;
4886                                 error = strcopyout(&ss, (void *)arg,
4887                                     sizeof (struct strsigset), copyflag);
4888                                 mutex_exit(&stp->sd_lock);
4889                                 mutex_enter(&pidlock);
4890                                 PID_RELE(pidp);
4891                                 mutex_exit(&pidlock);
4892                                 return (error);
4893                         }
4894                 mutex_exit(&stp->sd_lock);
4895                 mutex_enter(&pidlock);
4896                 PID_RELE(pidp);
4897                 mutex_exit(&pidlock);
4898                 return (EINVAL);
4899         }
4900 
4901         case I_PEEK:
4902         {
4903                 STRUCT_DECL(strpeek, strpeek);
4904                 size_t n;
4905                 mblk_t *fmp, *tmp_mp = NULL;
4906 
4907                 STRUCT_INIT(strpeek, flag);
4908 
4909                 error = strcopyin((void *)arg, STRUCT_BUF(strpeek),
4910                     STRUCT_SIZE(strpeek), copyflag);
4911                 if (error)
4912                         return (error);
4913 
4914                 mutex_enter(QLOCK(rdq));
4915                 /*
4916                  * Skip the invalid messages
4917                  */
4918                 for (mp = rdq->q_first; mp != NULL; mp = mp->b_next)
4919                         if (mp->b_datap->db_type != M_SIG)
4920                                 break;
4921 
4922                 /*
4923                  * If user has requested to peek at a high priority message
4924                  * and first message is not, return 0
4925                  */
4926                 if (mp != NULL) {
4927                         if ((STRUCT_FGET(strpeek, flags) & RS_HIPRI) &&
4928                             queclass(mp) == QNORM) {
4929                                 *rvalp = 0;
4930                                 mutex_exit(QLOCK(rdq));
4931                                 return (0);
4932                         }
4933                 } else if (stp->sd_struiordq == NULL ||
4934                     (STRUCT_FGET(strpeek, flags) & RS_HIPRI)) {
4935                         /*
4936                          * No mblks to look at at the streamhead and
4937                          * 1). This isn't a synch stream or
4938                          * 2). This is a synch stream but caller wants high
4939                          *      priority messages which is not supported by
4940                          *      the synch stream. (it only supports QNORM)
4941                          */
4942                         *rvalp = 0;
4943                         mutex_exit(QLOCK(rdq));
4944                         return (0);
4945                 }
4946 
4947                 fmp = mp;
4948 
4949                 if (mp && mp->b_datap->db_type == M_PASSFP) {
4950                         mutex_exit(QLOCK(rdq));
4951                         return (EBADMSG);
4952                 }
4953 
4954                 ASSERT(mp == NULL || mp->b_datap->db_type == M_PCPROTO ||
4955                     mp->b_datap->db_type == M_PROTO ||
4956                     mp->b_datap->db_type == M_DATA);
4957 
4958                 if (mp && mp->b_datap->db_type == M_PCPROTO) {
4959                         STRUCT_FSET(strpeek, flags, RS_HIPRI);
4960                 } else {
4961                         STRUCT_FSET(strpeek, flags, 0);
4962                 }
4963 
4964 
4965                 if (mp && ((tmp_mp = dupmsg(mp)) == NULL)) {
4966                         mutex_exit(QLOCK(rdq));
4967                         return (ENOSR);
4968                 }
4969                 mutex_exit(QLOCK(rdq));
4970 
4971                 /*
4972                  * set mp = tmp_mp, so that I_PEEK processing can continue.
4973                  * tmp_mp is used to free the dup'd message.
4974                  */
4975                 mp = tmp_mp;
4976 
4977                 uio.uio_fmode = 0;
4978                 uio.uio_extflg = UIO_COPY_CACHED;
4979                 uio.uio_segflg = (copyflag == U_TO_K) ? UIO_USERSPACE :
4980                     UIO_SYSSPACE;
4981                 uio.uio_limit = 0;
4982                 /*
4983                  * First process PROTO blocks, if any.
4984                  * If user doesn't want to get ctl info by setting maxlen <= 0,
4985                  * then set len to -1/0 and skip control blocks part.
4986                  */
4987                 if (STRUCT_FGET(strpeek, ctlbuf.maxlen) < 0)
4988                         STRUCT_FSET(strpeek, ctlbuf.len, -1);
4989                 else if (STRUCT_FGET(strpeek, ctlbuf.maxlen) == 0)
4990                         STRUCT_FSET(strpeek, ctlbuf.len, 0);
4991                 else {
4992                         int     ctl_part = 0;
4993 
4994                         iov.iov_base = STRUCT_FGETP(strpeek, ctlbuf.buf);
4995                         iov.iov_len = STRUCT_FGET(strpeek, ctlbuf.maxlen);
4996                         uio.uio_iov = &iov;
4997                         uio.uio_resid = iov.iov_len;
4998                         uio.uio_loffset = 0;
4999                         uio.uio_iovcnt = 1;
5000                         while (mp && mp->b_datap->db_type != M_DATA &&
5001                             uio.uio_resid >= 0) {
5002                                 ASSERT(STRUCT_FGET(strpeek, flags) == 0 ?
5003                                     mp->b_datap->db_type == M_PROTO :
5004                                     mp->b_datap->db_type == M_PCPROTO);
5005 
5006                                 if ((n = MIN(uio.uio_resid,
5007                                     mp->b_wptr - mp->b_rptr)) != 0 &&
5008                                     (error = uiomove((char *)mp->b_rptr, n,
5009                                     UIO_READ, &uio)) != 0) {
5010                                         freemsg(tmp_mp);
5011                                         return (error);
5012                                 }
5013                                 ctl_part = 1;
5014                                 mp = mp->b_cont;
5015                         }
5016                         /* No ctl message */
5017                         if (ctl_part == 0)
5018                                 STRUCT_FSET(strpeek, ctlbuf.len, -1);
5019                         else
5020                                 STRUCT_FSET(strpeek, ctlbuf.len,
5021                                     STRUCT_FGET(strpeek, ctlbuf.maxlen) -
5022                                     uio.uio_resid);
5023                 }
5024 
5025                 /*
5026                  * Now process DATA blocks, if any.
5027                  * If user doesn't want to get data info by setting maxlen <= 0,
5028                  * then set len to -1/0 and skip data blocks part.
5029                  */
5030                 if (STRUCT_FGET(strpeek, databuf.maxlen) < 0)
5031                         STRUCT_FSET(strpeek, databuf.len, -1);
5032                 else if (STRUCT_FGET(strpeek, databuf.maxlen) == 0)
5033                         STRUCT_FSET(strpeek, databuf.len, 0);
5034                 else {
5035                         int     data_part = 0;
5036 
5037                         iov.iov_base = STRUCT_FGETP(strpeek, databuf.buf);
5038                         iov.iov_len = STRUCT_FGET(strpeek, databuf.maxlen);
5039                         uio.uio_iov = &iov;
5040                         uio.uio_resid = iov.iov_len;
5041                         uio.uio_loffset = 0;
5042                         uio.uio_iovcnt = 1;
5043                         while (mp && uio.uio_resid) {
5044                                 if (mp->b_datap->db_type == M_DATA) {
5045                                         if ((n = MIN(uio.uio_resid,
5046                                             mp->b_wptr - mp->b_rptr)) != 0 &&
5047                                             (error = uiomove((char *)mp->b_rptr,
5048                                             n, UIO_READ, &uio)) != 0) {
5049                                                 freemsg(tmp_mp);
5050                                                 return (error);
5051                                         }
5052                                         data_part = 1;
5053                                 }
5054                                 ASSERT(data_part == 0 ||
5055                                     mp->b_datap->db_type == M_DATA);
5056                                 mp = mp->b_cont;
5057                         }
5058                         /* No data message */
5059                         if (data_part == 0)
5060                                 STRUCT_FSET(strpeek, databuf.len, -1);
5061                         else
5062                                 STRUCT_FSET(strpeek, databuf.len,
5063                                     STRUCT_FGET(strpeek, databuf.maxlen) -
5064                                     uio.uio_resid);
5065                 }
5066                 freemsg(tmp_mp);
5067 
5068                 /*
5069                  * It is a synch stream and user wants to get
5070                  * data (maxlen > 0).
5071                  * uio setup is done by the codes that process DATA
5072                  * blocks above.
5073                  */
5074                 if ((fmp == NULL) && STRUCT_FGET(strpeek, databuf.maxlen) > 0) {
5075                         infod_t infod;
5076 
5077                         infod.d_cmd = INFOD_COPYOUT;
5078                         infod.d_res = 0;
5079                         infod.d_uiop = &uio;
5080                         error = infonext(rdq, &infod);
5081                         if (error == EINVAL || error == EBUSY)
5082                                 error = 0;
5083                         if (error)
5084                                 return (error);
5085                         STRUCT_FSET(strpeek, databuf.len, STRUCT_FGET(strpeek,
5086                             databuf.maxlen) - uio.uio_resid);
5087                         if (STRUCT_FGET(strpeek, databuf.len) == 0) {
5088                                 /*
5089                                  * No data found by the infonext().
5090                                  */
5091                                 STRUCT_FSET(strpeek, databuf.len, -1);
5092                         }
5093                 }
5094                 error = strcopyout(STRUCT_BUF(strpeek), (void *)arg,
5095                     STRUCT_SIZE(strpeek), copyflag);
5096                 if (error) {
5097                         return (error);
5098                 }
5099                 /*
5100                  * If there is no message retrieved, set return code to 0
5101                  * otherwise, set it to 1.
5102                  */
5103                 if (STRUCT_FGET(strpeek, ctlbuf.len) == -1 &&
5104                     STRUCT_FGET(strpeek, databuf.len) == -1)
5105                         *rvalp = 0;
5106                 else
5107                         *rvalp = 1;
5108                 return (0);
5109         }
5110 
5111         case I_FDINSERT:
5112         {
5113                 STRUCT_DECL(strfdinsert, strfdinsert);
5114                 struct file *resftp;
5115                 struct stdata *resstp;
5116                 t_uscalar_t     ival;
5117                 ssize_t msgsize;
5118                 struct strbuf mctl;
5119 
5120                 STRUCT_INIT(strfdinsert, flag);
5121                 if (stp->sd_flag & STRHUP)
5122                         return (ENXIO);
5123                 /*
5124                  * STRDERR, STWRERR and STPLEX tested above.
5125                  */
5126                 error = strcopyin((void *)arg, STRUCT_BUF(strfdinsert),
5127                     STRUCT_SIZE(strfdinsert), copyflag);
5128                 if (error)
5129                         return (error);
5130 
5131                 if (STRUCT_FGET(strfdinsert, offset) < 0 ||
5132                     (STRUCT_FGET(strfdinsert, offset) %
5133                     sizeof (t_uscalar_t)) != 0)
5134                         return (EINVAL);
5135                 if ((resftp = getf(STRUCT_FGET(strfdinsert, fildes))) != NULL) {
5136                         if ((resstp = resftp->f_vnode->v_stream) == NULL) {
5137                                 releasef(STRUCT_FGET(strfdinsert, fildes));
5138                                 return (EINVAL);
5139                         }
5140                 } else
5141                         return (EINVAL);
5142 
5143                 mutex_enter(&resstp->sd_lock);
5144                 if (resstp->sd_flag & (STRDERR|STWRERR|STRHUP|STPLEX)) {
5145                         error = strgeterr(resstp,
5146                             STRDERR|STWRERR|STRHUP|STPLEX, 0);
5147                         if (error != 0) {
5148                                 mutex_exit(&resstp->sd_lock);
5149                                 releasef(STRUCT_FGET(strfdinsert, fildes));
5150                                 return (error);
5151                         }
5152                 }
5153                 mutex_exit(&resstp->sd_lock);
5154 
5155 #ifdef  _ILP32
5156                 {
5157                         queue_t *q;
5158                         queue_t *mate = NULL;
5159 
5160                         /* get read queue of stream terminus */
5161                         claimstr(resstp->sd_wrq);
5162                         for (q = resstp->sd_wrq->q_next; q->q_next != NULL;
5163                             q = q->q_next)
5164                                 if (!STRMATED(resstp) && STREAM(q) != resstp &&
5165                                     mate == NULL) {
5166                                         ASSERT(q->q_qinfo->qi_srvp);
5167                                         ASSERT(_OTHERQ(q)->q_qinfo->qi_srvp);
5168                                         claimstr(q);
5169                                         mate = q;
5170                                 }
5171                         q = _RD(q);
5172                         if (mate)
5173                                 releasestr(mate);
5174                         releasestr(resstp->sd_wrq);
5175                         ival = (t_uscalar_t)q;
5176                 }
5177 #else
5178                 ival = (t_uscalar_t)getminor(resftp->f_vnode->v_rdev);
5179 #endif  /* _ILP32 */
5180 
5181                 if (STRUCT_FGET(strfdinsert, ctlbuf.len) <
5182                     STRUCT_FGET(strfdinsert, offset) + sizeof (t_uscalar_t)) {
5183                         releasef(STRUCT_FGET(strfdinsert, fildes));
5184                         return (EINVAL);
5185                 }
5186 
5187                 /*
5188                  * Check for legal flag value.
5189                  */
5190                 if (STRUCT_FGET(strfdinsert, flags) & ~RS_HIPRI) {
5191                         releasef(STRUCT_FGET(strfdinsert, fildes));
5192                         return (EINVAL);
5193                 }
5194 
5195                 /* get these values from those cached in the stream head */
5196                 mutex_enter(QLOCK(stp->sd_wrq));
5197                 rmin = stp->sd_qn_minpsz;
5198                 rmax = stp->sd_qn_maxpsz;
5199                 mutex_exit(QLOCK(stp->sd_wrq));
5200 
5201                 /*
5202                  * Make sure ctl and data sizes together fall within
5203                  * the limits of the max and min receive packet sizes
5204                  * and do not exceed system limit.  A negative data
5205                  * length means that no data part is to be sent.
5206                  */
5207                 ASSERT((rmax >= 0) || (rmax == INFPSZ));
5208                 if (rmax == 0) {
5209                         releasef(STRUCT_FGET(strfdinsert, fildes));
5210                         return (ERANGE);
5211                 }
5212                 if ((msgsize = STRUCT_FGET(strfdinsert, databuf.len)) < 0)
5213                         msgsize = 0;
5214                 if ((msgsize < rmin) ||
5215                     ((msgsize > rmax) && (rmax != INFPSZ)) ||
5216                     (STRUCT_FGET(strfdinsert, ctlbuf.len) > strctlsz)) {
5217                         releasef(STRUCT_FGET(strfdinsert, fildes));
5218                         return (ERANGE);
5219                 }
5220 
5221                 mutex_enter(&stp->sd_lock);
5222                 while (!(STRUCT_FGET(strfdinsert, flags) & RS_HIPRI) &&
5223                     !canputnext(stp->sd_wrq)) {
5224                         if ((error = strwaitq(stp, WRITEWAIT, (ssize_t)0,
5225                             flag, -1, &done)) != 0 || done) {
5226                                 mutex_exit(&stp->sd_lock);
5227                                 releasef(STRUCT_FGET(strfdinsert, fildes));
5228                                 return (error);
5229                         }
5230                         if ((error = i_straccess(stp, access)) != 0) {
5231                                 mutex_exit(&stp->sd_lock);
5232                                 releasef(
5233                                     STRUCT_FGET(strfdinsert, fildes));
5234                                 return (error);
5235                         }
5236                 }
5237                 mutex_exit(&stp->sd_lock);
5238 
5239                 /*
5240                  * Copy strfdinsert.ctlbuf into native form of
5241                  * ctlbuf to pass down into strmakemsg().
5242                  */
5243                 mctl.maxlen = STRUCT_FGET(strfdinsert, ctlbuf.maxlen);
5244                 mctl.len = STRUCT_FGET(strfdinsert, ctlbuf.len);
5245                 mctl.buf = STRUCT_FGETP(strfdinsert, ctlbuf.buf);
5246 
5247                 iov.iov_base = STRUCT_FGETP(strfdinsert, databuf.buf);
5248                 iov.iov_len = STRUCT_FGET(strfdinsert, databuf.len);
5249                 uio.uio_iov = &iov;
5250                 uio.uio_iovcnt = 1;
5251                 uio.uio_loffset = 0;
5252                 uio.uio_segflg = (copyflag == U_TO_K) ? UIO_USERSPACE :
5253                     UIO_SYSSPACE;
5254                 uio.uio_fmode = 0;
5255                 uio.uio_extflg = UIO_COPY_CACHED;
5256                 uio.uio_resid = iov.iov_len;
5257                 if ((error = strmakemsg(&mctl,
5258                     &msgsize, &uio, stp,
5259                     STRUCT_FGET(strfdinsert, flags), &mp)) != 0 || !mp) {
5260                         STRUCT_FSET(strfdinsert, databuf.len, msgsize);
5261                         releasef(STRUCT_FGET(strfdinsert, fildes));
5262                         return (error);
5263                 }
5264 
5265                 STRUCT_FSET(strfdinsert, databuf.len, msgsize);
5266 
5267                 /*
5268                  * Place the possibly reencoded queue pointer 'offset' bytes
5269                  * from the start of the control portion of the message.
5270                  */
5271                 *((t_uscalar_t *)(mp->b_rptr +
5272                     STRUCT_FGET(strfdinsert, offset))) = ival;
5273 
5274                 /*
5275                  * Put message downstream.
5276                  */
5277                 stream_willservice(stp);
5278                 putnext(stp->sd_wrq, mp);
5279                 stream_runservice(stp);
5280                 releasef(STRUCT_FGET(strfdinsert, fildes));
5281                 return (error);
5282         }
5283 
5284         case I_SENDFD:
5285         {
5286                 struct file *fp;
5287 
5288                 if ((fp = getf((int)arg)) == NULL)
5289                         return (EBADF);
5290                 error = do_sendfp(stp, fp, crp);
5291                 if (auditing) {
5292                         audit_fdsend((int)arg, fp, error);
5293                 }
5294                 releasef((int)arg);
5295                 return (error);
5296         }
5297 
5298         case I_RECVFD:
5299         case I_E_RECVFD:
5300         {
5301                 struct k_strrecvfd *srf;
5302                 int i, fd;
5303 
5304                 mutex_enter(&stp->sd_lock);
5305                 while (!(mp = getq(rdq))) {
5306                         if (stp->sd_flag & (STRHUP|STREOF)) {
5307                                 mutex_exit(&stp->sd_lock);
5308                                 return (ENXIO);
5309                         }
5310                         if ((error = strwaitq(stp, GETWAIT, (ssize_t)0,
5311                             flag, -1, &done)) != 0 || done) {
5312                                 mutex_exit(&stp->sd_lock);
5313                                 return (error);
5314                         }
5315                         if ((error = i_straccess(stp, access)) != 0) {
5316                                 mutex_exit(&stp->sd_lock);
5317                                 return (error);
5318                         }
5319                 }
5320                 if (mp->b_datap->db_type != M_PASSFP) {
5321                         putback(stp, rdq, mp, mp->b_band);
5322                         mutex_exit(&stp->sd_lock);
5323                         return (EBADMSG);
5324                 }
5325                 mutex_exit(&stp->sd_lock);
5326 
5327                 srf = (struct k_strrecvfd *)mp->b_rptr;
5328                 if ((fd = ufalloc(0)) == -1) {
5329                         mutex_enter(&stp->sd_lock);
5330                         putback(stp, rdq, mp, mp->b_band);
5331                         mutex_exit(&stp->sd_lock);
5332                         return (EMFILE);
5333                 }
5334                 if (cmd == I_RECVFD) {
5335                         struct o_strrecvfd      ostrfd;
5336 
5337                         /* check to see if uid/gid values are too large. */
5338 
5339                         if (srf->uid > (o_uid_t)USHRT_MAX ||
5340                             srf->gid > (o_gid_t)USHRT_MAX) {
5341                                 mutex_enter(&stp->sd_lock);
5342                                 putback(stp, rdq, mp, mp->b_band);
5343                                 mutex_exit(&stp->sd_lock);
5344                                 setf(fd, NULL); /* release fd entry */
5345                                 return (EOVERFLOW);
5346                         }
5347 
5348                         ostrfd.fd = fd;
5349                         ostrfd.uid = (o_uid_t)srf->uid;
5350                         ostrfd.gid = (o_gid_t)srf->gid;
5351 
5352                         /* Null the filler bits */
5353                         for (i = 0; i < 8; i++)
5354                                 ostrfd.fill[i] = 0;
5355 
5356                         error = strcopyout(&ostrfd, (void *)arg,
5357                             sizeof (struct o_strrecvfd), copyflag);
5358                 } else {                /* I_E_RECVFD */
5359                         struct strrecvfd        strfd;
5360 
5361                         strfd.fd = fd;
5362                         strfd.uid = srf->uid;
5363                         strfd.gid = srf->gid;
5364 
5365                         /* null the filler bits */
5366                         for (i = 0; i < 8; i++)
5367                                 strfd.fill[i] = 0;
5368 
5369                         error = strcopyout(&strfd, (void *)arg,
5370                             sizeof (struct strrecvfd), copyflag);
5371                 }
5372 
5373                 if (error) {
5374                         setf(fd, NULL); /* release fd entry */
5375                         mutex_enter(&stp->sd_lock);
5376                         putback(stp, rdq, mp, mp->b_band);
5377                         mutex_exit(&stp->sd_lock);
5378                         return (error);
5379                 }
5380                 if (auditing) {
5381                         audit_fdrecv(fd, srf->fp);
5382                 }
5383 
5384                 /*
5385                  * Always increment f_count since the freemsg() below will
5386                  * always call free_passfp() which performs a closef().
5387                  */
5388                 mutex_enter(&srf->fp->f_tlock);
5389                 srf->fp->f_count++;
5390                 mutex_exit(&srf->fp->f_tlock);
5391                 setf(fd, srf->fp);
5392                 freemsg(mp);
5393                 return (0);
5394         }
5395 
5396         case I_SWROPT:
5397                 /*
5398                  * Set/clear the write options. arg is a bit
5399                  * mask with any of the following bits set...
5400                  *      SNDZERO - send zero length message
5401                  *      SNDPIPE - send sigpipe to process if
5402                  *              sd_werror is set and process is
5403                  *              doing a write or putmsg.
5404                  * The new stream head write options should reflect
5405                  * what is in arg.
5406                  */
5407                 if (arg & ~(SNDZERO|SNDPIPE))
5408                         return (EINVAL);
5409 
5410                 mutex_enter(&stp->sd_lock);
5411                 stp->sd_wput_opt &= ~(SW_SIGPIPE|SW_SNDZERO);
5412                 if (arg & SNDZERO)
5413                         stp->sd_wput_opt |= SW_SNDZERO;
5414                 if (arg & SNDPIPE)
5415                         stp->sd_wput_opt |= SW_SIGPIPE;
5416                 mutex_exit(&stp->sd_lock);
5417                 return (0);
5418 
5419         case I_GWROPT:
5420         {
5421                 int wropt = 0;
5422 
5423                 if (stp->sd_wput_opt & SW_SNDZERO)
5424                         wropt |= SNDZERO;
5425                 if (stp->sd_wput_opt & SW_SIGPIPE)
5426                         wropt |= SNDPIPE;
5427                 return (strcopyout(&wropt, (void *)arg, sizeof (wropt),
5428                     copyflag));
5429         }
5430 
5431         case I_LIST:
5432                 /*
5433                  * Returns all the modules found on this stream,
5434                  * upto the driver. If argument is NULL, return the
5435                  * number of modules (including driver). If argument
5436                  * is not NULL, copy the names into the structure
5437                  * provided.
5438                  */
5439 
5440         {
5441                 queue_t *q;
5442                 char *qname;
5443                 int i, nmods;
5444                 struct str_mlist *mlist;
5445                 STRUCT_DECL(str_list, strlist);
5446 
5447                 if (arg == NULL) { /* Return number of modules plus driver */
5448                         if (stp->sd_vnode->v_type == VFIFO)
5449                                 *rvalp = stp->sd_pushcnt;
5450                         else
5451                                 *rvalp = stp->sd_pushcnt + 1;
5452                         return (0);
5453                 }
5454 
5455                 STRUCT_INIT(strlist, flag);
5456 
5457                 error = strcopyin((void *)arg, STRUCT_BUF(strlist),
5458                     STRUCT_SIZE(strlist), copyflag);
5459                 if (error != 0)
5460                         return (error);
5461 
5462                 mlist = STRUCT_FGETP(strlist, sl_modlist);
5463                 nmods = STRUCT_FGET(strlist, sl_nmods);
5464                 if (nmods <= 0)
5465                         return (EINVAL);
5466 
5467                 claimstr(stp->sd_wrq);
5468                 q = stp->sd_wrq;
5469                 for (i = 0; i < nmods && _SAMESTR(q); i++, q = q->q_next) {
5470                         qname = Q2NAME(q->q_next);
5471                         error = strcopyout(qname, &mlist[i], strlen(qname) + 1,
5472                             copyflag);
5473                         if (error != 0) {
5474                                 releasestr(stp->sd_wrq);
5475                                 return (error);
5476                         }
5477                 }
5478                 releasestr(stp->sd_wrq);
5479                 return (strcopyout(&i, (void *)arg, sizeof (int), copyflag));
5480         }
5481 
5482         case I_CKBAND:
5483         {
5484                 queue_t *q;
5485                 qband_t *qbp;
5486 
5487                 if ((arg < 0) || (arg >= NBAND))
5488                         return (EINVAL);
5489                 q = _RD(stp->sd_wrq);
5490                 mutex_enter(QLOCK(q));
5491                 if (arg > (int)q->q_nband) {
5492                         *rvalp = 0;
5493                 } else {
5494                         if (arg == 0) {
5495                                 if (q->q_first)
5496                                         *rvalp = 1;
5497                                 else
5498                                         *rvalp = 0;
5499                         } else {
5500                                 qbp = q->q_bandp;
5501                                 while (--arg > 0)
5502                                         qbp = qbp->qb_next;
5503                                 if (qbp->qb_first)
5504                                         *rvalp = 1;
5505                                 else
5506                                         *rvalp = 0;
5507                         }
5508                 }
5509                 mutex_exit(QLOCK(q));
5510                 return (0);
5511         }
5512 
5513         case I_GETBAND:
5514         {
5515                 int intpri;
5516                 queue_t *q;
5517 
5518                 q = _RD(stp->sd_wrq);
5519                 mutex_enter(QLOCK(q));
5520                 mp = q->q_first;
5521                 if (!mp) {
5522                         mutex_exit(QLOCK(q));
5523                         return (ENODATA);
5524                 }
5525                 intpri = (int)mp->b_band;
5526                 error = strcopyout(&intpri, (void *)arg, sizeof (int),
5527                     copyflag);
5528                 mutex_exit(QLOCK(q));
5529                 return (error);
5530         }
5531 
5532         case I_ATMARK:
5533         {
5534                 queue_t *q;
5535 
5536                 if (arg & ~(ANYMARK|LASTMARK))
5537                         return (EINVAL);
5538                 q = _RD(stp->sd_wrq);
5539                 mutex_enter(&stp->sd_lock);
5540                 if ((stp->sd_flag & STRATMARK) && (arg == ANYMARK)) {
5541                         *rvalp = 1;
5542                 } else {
5543                         mutex_enter(QLOCK(q));
5544                         mp = q->q_first;
5545 
5546                         if (mp == NULL)
5547                                 *rvalp = 0;
5548                         else if ((arg == ANYMARK) && (mp->b_flag & MSGMARK))
5549                                 *rvalp = 1;
5550                         else if ((arg == LASTMARK) && (mp == stp->sd_mark))
5551                                 *rvalp = 1;
5552                         else
5553                                 *rvalp = 0;
5554                         mutex_exit(QLOCK(q));
5555                 }
5556                 mutex_exit(&stp->sd_lock);
5557                 return (0);
5558         }
5559 
5560         case I_CANPUT:
5561         {
5562                 char band;
5563 
5564                 if ((arg < 0) || (arg >= NBAND))
5565                         return (EINVAL);
5566                 band = (char)arg;
5567                 *rvalp = bcanputnext(stp->sd_wrq, band);
5568                 return (0);
5569         }
5570 
5571         case I_SETCLTIME:
5572         {
5573                 int closetime;
5574 
5575                 error = strcopyin((void *)arg, &closetime, sizeof (int),
5576                     copyflag);
5577                 if (error)
5578                         return (error);
5579                 if (closetime < 0)
5580                         return (EINVAL);
5581 
5582                 stp->sd_closetime = closetime;
5583                 return (0);
5584         }
5585 
5586         case I_GETCLTIME:
5587         {
5588                 int closetime;
5589 
5590                 closetime = stp->sd_closetime;
5591                 return (strcopyout(&closetime, (void *)arg, sizeof (int),
5592                     copyflag));
5593         }
5594 
5595         case TIOCGSID:
5596         {
5597                 pid_t sid;
5598 
5599                 mutex_enter(&stp->sd_lock);
5600                 if (stp->sd_sidp == NULL) {
5601                         mutex_exit(&stp->sd_lock);
5602                         return (ENOTTY);
5603                 }
5604                 sid = stp->sd_sidp->pid_id;
5605                 mutex_exit(&stp->sd_lock);
5606                 return (strcopyout(&sid, (void *)arg, sizeof (pid_t),
5607                     copyflag));
5608         }
5609 
5610         case TIOCSPGRP:
5611         {
5612                 pid_t pgrp;
5613                 proc_t *q;
5614                 pid_t   sid, fg_pgid, bg_pgid;
5615 
5616                 if (error = strcopyin((void *)arg, &pgrp, sizeof (pid_t),
5617                     copyflag))
5618                         return (error);
5619                 mutex_enter(&stp->sd_lock);
5620                 mutex_enter(&pidlock);
5621                 if (stp->sd_sidp != ttoproc(curthread)->p_sessp->s_sidp) {
5622                         mutex_exit(&pidlock);
5623                         mutex_exit(&stp->sd_lock);
5624                         return (ENOTTY);
5625                 }
5626                 if (pgrp == stp->sd_pgidp->pid_id) {
5627                         mutex_exit(&pidlock);
5628                         mutex_exit(&stp->sd_lock);
5629                         return (0);
5630                 }
5631                 if (pgrp <= 0 || pgrp >= maxpid) {
5632                         mutex_exit(&pidlock);
5633                         mutex_exit(&stp->sd_lock);
5634                         return (EINVAL);
5635                 }
5636                 if ((q = pgfind(pgrp)) == NULL ||
5637                     q->p_sessp != ttoproc(curthread)->p_sessp) {
5638                         mutex_exit(&pidlock);
5639                         mutex_exit(&stp->sd_lock);
5640                         return (EPERM);
5641                 }
5642                 sid = stp->sd_sidp->pid_id;
5643                 fg_pgid = q->p_pgrp;
5644                 bg_pgid = stp->sd_pgidp->pid_id;
5645                 CL_SET_PROCESS_GROUP(curthread, sid, bg_pgid, fg_pgid);
5646                 PID_RELE(stp->sd_pgidp);
5647                 ctty_clear_sighuped();
5648                 stp->sd_pgidp = q->p_pgidp;
5649                 PID_HOLD(stp->sd_pgidp);
5650                 mutex_exit(&pidlock);
5651                 mutex_exit(&stp->sd_lock);
5652                 return (0);
5653         }
5654 
5655         case TIOCGPGRP:
5656         {
5657                 pid_t pgrp;
5658 
5659                 mutex_enter(&stp->sd_lock);
5660                 if (stp->sd_sidp == NULL) {
5661                         mutex_exit(&stp->sd_lock);
5662                         return (ENOTTY);
5663                 }
5664                 pgrp = stp->sd_pgidp->pid_id;
5665                 mutex_exit(&stp->sd_lock);
5666                 return (strcopyout(&pgrp, (void *)arg, sizeof (pid_t),
5667                     copyflag));
5668         }
5669 
5670         case TIOCSCTTY:
5671         {
5672                 return (strctty(stp));
5673         }
5674 
5675         case TIOCNOTTY:
5676         {
5677                 /* freectty() always assumes curproc. */
5678                 if (freectty(B_FALSE) != 0)
5679                         return (0);
5680                 return (ENOTTY);
5681         }
5682 
5683         case FIONBIO:
5684         case FIOASYNC:
5685                 return (0);     /* handled by the upper layer */
5686         }
5687 }
5688 
5689 /*
5690  * Custom free routine used for M_PASSFP messages.
5691  */
5692 static void
5693 free_passfp(struct k_strrecvfd *srf)
5694 {
5695         (void) closef(srf->fp);
5696         kmem_free(srf, sizeof (struct k_strrecvfd) + sizeof (frtn_t));
5697 }
5698 
5699 /* ARGSUSED */
5700 int
5701 do_sendfp(struct stdata *stp, struct file *fp, struct cred *cr)
5702 {
5703         queue_t *qp, *nextqp;
5704         struct k_strrecvfd *srf;
5705         mblk_t *mp;
5706         frtn_t *frtnp;
5707         size_t bufsize;
5708         queue_t *mate = NULL;
5709         syncq_t *sq = NULL;
5710         int retval = 0;
5711 
5712         if (stp->sd_flag & STRHUP)
5713                 return (ENXIO);
5714 
5715         claimstr(stp->sd_wrq);
5716 
5717         /* Fastpath, we have a pipe, and we are already mated, use it. */
5718         if (STRMATED(stp)) {
5719                 qp = _RD(stp->sd_mate->sd_wrq);
5720                 claimstr(qp);
5721                 mate = qp;
5722         } else { /* Not already mated. */
5723 
5724                 /*
5725                  * Walk the stream to the end of this one.
5726                  * assumes that the claimstr() will prevent
5727                  * plumbing between the stream head and the
5728                  * driver from changing
5729                  */
5730                 qp = stp->sd_wrq;
5731 
5732                 /*
5733                  * Loop until we reach the end of this stream.
5734                  * On completion, qp points to the write queue
5735                  * at the end of the stream, or the read queue
5736                  * at the stream head if this is a fifo.
5737                  */
5738                 while (((qp = qp->q_next) != NULL) && _SAMESTR(qp))
5739                         ;
5740 
5741                 /*
5742                  * Just in case we get a q_next which is NULL, but
5743                  * not at the end of the stream.  This is actually
5744                  * broken, so we set an assert to catch it in
5745                  * debug, and set an error and return if not debug.
5746                  */
5747                 ASSERT(qp);
5748                 if (qp == NULL) {
5749                         releasestr(stp->sd_wrq);
5750                         return (EINVAL);
5751                 }
5752 
5753                 /*
5754                  * Enter the syncq for the driver, so (hopefully)
5755                  * the queue values will not change on us.
5756                  * XXXX - This will only prevent the race IFF only
5757                  *   the write side modifies the q_next member, and
5758                  *   the put procedure is protected by at least
5759                  *   MT_PERQ.
5760                  */
5761                 if ((sq = qp->q_syncq) != NULL)
5762                         entersq(sq, SQ_PUT);
5763 
5764                 /* Now get the q_next value from this qp. */
5765                 nextqp = qp->q_next;
5766 
5767                 /*
5768                  * If nextqp exists and the other stream is different
5769                  * from this one claim the stream, set the mate, and
5770                  * get the read queue at the stream head of the other
5771                  * stream.  Assumes that nextqp was at least valid when
5772                  * we got it.  Hopefully the entersq of the driver
5773                  * will prevent it from changing on us.
5774                  */
5775                 if ((nextqp != NULL) && (STREAM(nextqp) != stp)) {
5776                         ASSERT(qp->q_qinfo->qi_srvp);
5777                         ASSERT(_OTHERQ(qp)->q_qinfo->qi_srvp);
5778                         ASSERT(_OTHERQ(qp->q_next)->q_qinfo->qi_srvp);
5779                         claimstr(nextqp);
5780 
5781                         /* Make sure we still have a q_next */
5782                         if (nextqp != qp->q_next) {
5783                                 releasestr(stp->sd_wrq);
5784                                 releasestr(nextqp);
5785                                 return (EINVAL);
5786                         }
5787 
5788                         qp = _RD(STREAM(nextqp)->sd_wrq);
5789                         mate = qp;
5790                 }
5791                 /* If we entered the synq above, leave it. */
5792                 if (sq != NULL)
5793                         leavesq(sq, SQ_PUT);
5794         } /*  STRMATED(STP)  */
5795 
5796         /* XXX prevents substitution of the ops vector */
5797         if (qp->q_qinfo != &strdata && qp->q_qinfo != &fifo_strdata) {
5798                 retval = EINVAL;
5799                 goto out;
5800         }
5801 
5802         if (qp->q_flag & QFULL) {
5803                 retval = EAGAIN;
5804                 goto out;
5805         }
5806 
5807         /*
5808          * Since M_PASSFP messages include a file descriptor, we use
5809          * esballoc() and specify a custom free routine (free_passfp()) that
5810          * will close the descriptor as part of freeing the message.  For
5811          * convenience, we stash the frtn_t right after the data block.
5812          */
5813         bufsize = sizeof (struct k_strrecvfd) + sizeof (frtn_t);
5814         srf = kmem_alloc(bufsize, KM_NOSLEEP);
5815         if (srf == NULL) {
5816                 retval = EAGAIN;
5817                 goto out;
5818         }
5819 
5820         frtnp = (frtn_t *)(srf + 1);
5821         frtnp->free_arg = (caddr_t)srf;
5822         frtnp->free_func = free_passfp;
5823 
5824         mp = esballoc((uchar_t *)srf, bufsize, BPRI_MED, frtnp);
5825         if (mp == NULL) {
5826                 kmem_free(srf, bufsize);
5827                 retval = EAGAIN;
5828                 goto out;
5829         }
5830         mp->b_wptr += sizeof (struct k_strrecvfd);
5831         mp->b_datap->db_type = M_PASSFP;
5832 
5833         srf->fp = fp;
5834         srf->uid = crgetuid(curthread->t_cred);
5835         srf->gid = crgetgid(curthread->t_cred);
5836         mutex_enter(&fp->f_tlock);
5837         fp->f_count++;
5838         mutex_exit(&fp->f_tlock);
5839 
5840         put(qp, mp);
5841 out:
5842         releasestr(stp->sd_wrq);
5843         if (mate)
5844                 releasestr(mate);
5845         return (retval);
5846 }
5847 
5848 /*
5849  * Send an ioctl message downstream and wait for acknowledgement.
5850  * flags may be set to either U_TO_K or K_TO_K and a combination
5851  * of STR_NOERROR or STR_NOSIG
5852  * STR_NOSIG: Signals are essentially ignored or held and have
5853  *      no effect for the duration of the call.
5854  * STR_NOERROR: Ignores stream head read, write and hup errors.
5855  *      Additionally, if an existing ioctl times out, it is assumed
5856  *      lost and and this ioctl will continue as if the previous ioctl had
5857  *      finished.  ETIME may be returned if this ioctl times out (i.e.
5858  *      ic_timout is not INFTIM).  Non-stream head errors may be returned if
5859  *      the ioc_error indicates that the driver/module had problems,
5860  *      an EFAULT was found when accessing user data, a lack of
5861  *      resources, etc.
5862  */
5863 int
5864 strdoioctl(
5865         struct stdata *stp,
5866         struct strioctl *strioc,
5867         int fflags,             /* file flags with model info */
5868         int flag,
5869         cred_t *crp,
5870         int *rvalp)
5871 {
5872         mblk_t *bp;
5873         struct iocblk *iocbp;
5874         struct copyreq *reqp;
5875         struct copyresp *resp;
5876         int id;
5877         int transparent = 0;
5878         int error = 0;
5879         int len = 0;
5880         caddr_t taddr;
5881         int copyflag = (flag & (U_TO_K | K_TO_K));
5882         int sigflag = (flag & STR_NOSIG);
5883         int errs;
5884         uint_t waitflags;
5885         boolean_t set_iocwaitne = B_FALSE;
5886 
5887         ASSERT(copyflag == U_TO_K || copyflag == K_TO_K);
5888         ASSERT((fflags & FMODELS) != 0);
5889 
5890         TRACE_2(TR_FAC_STREAMS_FR,
5891             TR_STRDOIOCTL,
5892             "strdoioctl:stp %p strioc %p", stp, strioc);
5893         if (strioc->ic_len == TRANSPARENT) { /* send arg in M_DATA block */
5894                 transparent = 1;
5895                 strioc->ic_len = sizeof (intptr_t);
5896         }
5897 
5898         if (strioc->ic_len < 0 || (strmsgsz > 0 && strioc->ic_len > strmsgsz))
5899                 return (EINVAL);
5900 
5901         if ((bp = allocb_cred_wait(sizeof (union ioctypes), sigflag, &error,
5902             crp, curproc->p_pid)) == NULL)
5903                         return (error);
5904 
5905         bzero(bp->b_wptr, sizeof (union ioctypes));
5906 
5907         iocbp = (struct iocblk *)bp->b_wptr;
5908         iocbp->ioc_count = strioc->ic_len;
5909         iocbp->ioc_cmd = strioc->ic_cmd;
5910         iocbp->ioc_flag = (fflags & FMODELS);
5911 
5912         crhold(crp);
5913         iocbp->ioc_cr = crp;
5914         DB_TYPE(bp) = M_IOCTL;
5915         bp->b_wptr += sizeof (struct iocblk);
5916 
5917         if (flag & STR_NOERROR)
5918                 errs = STPLEX;
5919         else
5920                 errs = STRHUP|STRDERR|STWRERR|STPLEX;
5921 
5922         /*
5923          * If there is data to copy into ioctl block, do so.
5924          */
5925         if (iocbp->ioc_count > 0) {
5926                 if (transparent)
5927                         /*
5928                          * Note: STR_NOERROR does not have an effect
5929                          * in putiocd()
5930                          */
5931                         id = K_TO_K | sigflag;
5932                 else
5933                         id = flag;
5934                 if ((error = putiocd(bp, strioc->ic_dp, id, crp)) != 0) {
5935                         freemsg(bp);
5936                         crfree(crp);
5937                         return (error);
5938                 }
5939 
5940                 /*
5941                  * We could have slept copying in user pages.
5942                  * Recheck the stream head state (the other end
5943                  * of a pipe could have gone away).
5944                  */
5945                 if (stp->sd_flag & errs) {
5946                         mutex_enter(&stp->sd_lock);
5947                         error = strgeterr(stp, errs, 0);
5948                         mutex_exit(&stp->sd_lock);
5949                         if (error != 0) {
5950                                 freemsg(bp);
5951                                 crfree(crp);
5952                                 return (error);
5953                         }
5954                 }
5955         }
5956         if (transparent)
5957                 iocbp->ioc_count = TRANSPARENT;
5958 
5959         /*
5960          * Block for up to STRTIMOUT milliseconds if there is an outstanding
5961          * ioctl for this stream already running.  All processes
5962          * sleeping here will be awakened as a result of an ACK
5963          * or NAK being received for the outstanding ioctl, or
5964          * as a result of the timer expiring on the outstanding
5965          * ioctl (a failure), or as a result of any waiting
5966          * process's timer expiring (also a failure).
5967          */
5968 
5969         error = 0;
5970         mutex_enter(&stp->sd_lock);
5971         while ((stp->sd_flag & IOCWAIT) ||
5972             (!set_iocwaitne && (stp->sd_flag & IOCWAITNE))) {
5973                 clock_t cv_rval;
5974 
5975                 TRACE_0(TR_FAC_STREAMS_FR,
5976                     TR_STRDOIOCTL_WAIT,
5977                     "strdoioctl sleeps - IOCWAIT");
5978                 cv_rval = str_cv_wait(&stp->sd_iocmonitor, &stp->sd_lock,
5979                     STRTIMOUT, sigflag);
5980                 if (cv_rval <= 0) {
5981                         if (cv_rval == 0) {
5982                                 error = EINTR;
5983                         } else {
5984                                 if (flag & STR_NOERROR) {
5985                                         /*
5986                                          * Terminating current ioctl in
5987                                          * progress -- assume it got lost and
5988                                          * wake up the other thread so that the
5989                                          * operation completes.
5990                                          */
5991                                         if (!(stp->sd_flag & IOCWAITNE)) {
5992                                                 set_iocwaitne = B_TRUE;
5993                                                 stp->sd_flag |= IOCWAITNE;
5994                                                 cv_broadcast(&stp->sd_monitor);
5995                                         }
5996                                         /*
5997                                          * Otherwise, there's a running
5998                                          * STR_NOERROR -- we have no choice
5999                                          * here but to wait forever (or until
6000                                          * interrupted).
6001                                          */
6002                                 } else {
6003                                         /*
6004                                          * pending ioctl has caused
6005                                          * us to time out
6006                                          */
6007                                         error = ETIME;
6008                                 }
6009                         }
6010                 } else if ((stp->sd_flag & errs)) {
6011                         error = strgeterr(stp, errs, 0);
6012                 }
6013                 if (error) {
6014                         mutex_exit(&stp->sd_lock);
6015                         freemsg(bp);
6016                         crfree(crp);
6017                         return (error);
6018                 }
6019         }
6020 
6021         /*
6022          * Have control of ioctl mechanism.
6023          * Send down ioctl packet and wait for response.
6024          */
6025         if (stp->sd_iocblk != (mblk_t *)-1) {
6026                 freemsg(stp->sd_iocblk);
6027         }
6028         stp->sd_iocblk = NULL;
6029 
6030         /*
6031          * If this is marked with 'noerror' (internal; mostly
6032          * I_{P,}{UN,}LINK), then make sure nobody else is able to get
6033          * in here by setting IOCWAITNE.
6034          */
6035         waitflags = IOCWAIT;
6036         if (flag & STR_NOERROR)
6037                 waitflags |= IOCWAITNE;
6038 
6039         stp->sd_flag |= waitflags;
6040 
6041         /*
6042          * Assign sequence number.
6043          */
6044         iocbp->ioc_id = stp->sd_iocid = getiocseqno();
6045 
6046         mutex_exit(&stp->sd_lock);
6047 
6048         TRACE_1(TR_FAC_STREAMS_FR,
6049             TR_STRDOIOCTL_PUT, "strdoioctl put: stp %p", stp);
6050         stream_willservice(stp);
6051         putnext(stp->sd_wrq, bp);
6052         stream_runservice(stp);
6053 
6054         /*
6055          * Timed wait for acknowledgment.  The wait time is limited by the
6056          * timeout value, which must be a positive integer (number of
6057          * milliseconds) to wait, or 0 (use default value of STRTIMOUT
6058          * milliseconds), or -1 (wait forever).  This will be awakened
6059          * either by an ACK/NAK message arriving, the timer expiring, or
6060          * the timer expiring on another ioctl waiting for control of the
6061          * mechanism.
6062          */
6063 waitioc:
6064         mutex_enter(&stp->sd_lock);
6065 
6066 
6067         /*
6068          * If the reply has already arrived, don't sleep.  If awakened from
6069          * the sleep, fail only if the reply has not arrived by then.
6070          * Otherwise, process the reply.
6071          */
6072         while (!stp->sd_iocblk) {
6073                 clock_t cv_rval;
6074 
6075                 if (stp->sd_flag & errs) {
6076                         error = strgeterr(stp, errs, 0);
6077                         if (error != 0) {
6078                                 stp->sd_flag &= ~waitflags;
6079                                 cv_broadcast(&stp->sd_iocmonitor);
6080                                 mutex_exit(&stp->sd_lock);
6081                                 crfree(crp);
6082                                 return (error);
6083                         }
6084                 }
6085 
6086                 TRACE_0(TR_FAC_STREAMS_FR,
6087                     TR_STRDOIOCTL_WAIT2,
6088                     "strdoioctl sleeps awaiting reply");
6089                 ASSERT(error == 0);
6090 
6091                 cv_rval = str_cv_wait(&stp->sd_monitor, &stp->sd_lock,
6092                     (strioc->ic_timout ?
6093                     strioc->ic_timout * 1000 : STRTIMOUT), sigflag);
6094 
6095                 /*
6096                  * There are four possible cases here: interrupt, timeout,
6097                  * wakeup by IOCWAITNE (above), or wakeup by strrput_nondata (a
6098                  * valid M_IOCTL reply).
6099                  *
6100                  * If we've been awakened by a STR_NOERROR ioctl on some other
6101                  * thread, then sd_iocblk will still be NULL, and IOCWAITNE
6102                  * will be set.  Pretend as if we just timed out.  Note that
6103                  * this other thread waited at least STRTIMOUT before trying to
6104                  * awaken our thread, so this is indistinguishable (even for
6105                  * INFTIM) from the case where we failed with ETIME waiting on
6106                  * IOCWAIT in the prior loop.
6107                  */
6108                 if (cv_rval > 0 && !(flag & STR_NOERROR) &&
6109                     stp->sd_iocblk == NULL && (stp->sd_flag & IOCWAITNE)) {
6110                         cv_rval = -1;
6111                 }
6112 
6113                 /*
6114                  * note: STR_NOERROR does not protect
6115                  * us here.. use ic_timout < 0
6116                  */
6117                 if (cv_rval <= 0) {
6118                         if (cv_rval == 0) {
6119                                 error = EINTR;
6120                         } else {
6121                                 error =  ETIME;
6122                         }
6123                         /*
6124                          * A message could have come in after we were scheduled
6125                          * but before we were actually run.
6126                          */
6127                         bp = stp->sd_iocblk;
6128                         stp->sd_iocblk = NULL;
6129                         if (bp != NULL) {
6130                                 if ((bp->b_datap->db_type == M_COPYIN) ||
6131                                     (bp->b_datap->db_type == M_COPYOUT)) {
6132                                         mutex_exit(&stp->sd_lock);
6133                                         if (bp->b_cont) {
6134                                                 freemsg(bp->b_cont);
6135                                                 bp->b_cont = NULL;
6136                                         }
6137                                         bp->b_datap->db_type = M_IOCDATA;
6138                                         bp->b_wptr = bp->b_rptr +
6139                                             sizeof (struct copyresp);
6140                                         resp = (struct copyresp *)bp->b_rptr;
6141                                         resp->cp_rval =
6142                                             (caddr_t)1; /* failure */
6143                                         stream_willservice(stp);
6144                                         putnext(stp->sd_wrq, bp);
6145                                         stream_runservice(stp);
6146                                         mutex_enter(&stp->sd_lock);
6147                                 } else {
6148                                         freemsg(bp);
6149                                 }
6150                         }
6151                         stp->sd_flag &= ~waitflags;
6152                         cv_broadcast(&stp->sd_iocmonitor);
6153                         mutex_exit(&stp->sd_lock);
6154                         crfree(crp);
6155                         return (error);
6156                 }
6157         }
6158         bp = stp->sd_iocblk;
6159         /*
6160          * Note: it is strictly impossible to get here with sd_iocblk set to
6161          * -1.  This is because the initial loop above doesn't allow any new
6162          * ioctls into the fray until all others have passed this point.
6163          */
6164         ASSERT(bp != NULL && bp != (mblk_t *)-1);
6165         TRACE_1(TR_FAC_STREAMS_FR,
6166             TR_STRDOIOCTL_ACK, "strdoioctl got reply: bp %p", bp);
6167         if ((bp->b_datap->db_type == M_IOCACK) ||
6168             (bp->b_datap->db_type == M_IOCNAK)) {
6169                 /* for detection of duplicate ioctl replies */
6170                 stp->sd_iocblk = (mblk_t *)-1;
6171                 stp->sd_flag &= ~waitflags;
6172                 cv_broadcast(&stp->sd_iocmonitor);
6173                 mutex_exit(&stp->sd_lock);
6174         } else {
6175                 /*
6176                  * flags not cleared here because we're still doing
6177                  * copy in/out for ioctl.
6178                  */
6179                 stp->sd_iocblk = NULL;
6180                 mutex_exit(&stp->sd_lock);
6181         }
6182 
6183 
6184         /*
6185          * Have received acknowledgment.
6186          */
6187 
6188         switch (bp->b_datap->db_type) {
6189         case M_IOCACK:
6190                 /*
6191                  * Positive ack.
6192                  */
6193                 iocbp = (struct iocblk *)bp->b_rptr;
6194 
6195                 /*
6196                  * Set error if indicated.
6197                  */
6198                 if (iocbp->ioc_error) {
6199                         error = iocbp->ioc_error;
6200                         break;
6201                 }
6202 
6203                 /*
6204                  * Set return value.
6205                  */
6206                 *rvalp = iocbp->ioc_rval;
6207 
6208                 /*
6209                  * Data may have been returned in ACK message (ioc_count > 0).
6210                  * If so, copy it out to the user's buffer.
6211                  */
6212                 if (iocbp->ioc_count && !transparent) {
6213                         if (error = getiocd(bp, strioc->ic_dp, copyflag))
6214                                 break;
6215                 }
6216                 if (!transparent) {
6217                         if (len)        /* an M_COPYOUT was used with I_STR */
6218                                 strioc->ic_len = len;
6219                         else
6220                                 strioc->ic_len = (int)iocbp->ioc_count;
6221                 }
6222                 break;
6223 
6224         case M_IOCNAK:
6225                 /*
6226                  * Negative ack.
6227                  *
6228                  * The only thing to do is set error as specified
6229                  * in neg ack packet.
6230                  */
6231                 iocbp = (struct iocblk *)bp->b_rptr;
6232 
6233                 error = (iocbp->ioc_error ? iocbp->ioc_error : EINVAL);
6234                 break;
6235 
6236         case M_COPYIN:
6237                 /*
6238                  * Driver or module has requested user ioctl data.
6239                  */
6240                 reqp = (struct copyreq *)bp->b_rptr;
6241 
6242                 /*
6243                  * M_COPYIN should *never* have a message attached, though
6244                  * it's harmless if it does -- thus, panic on a DEBUG
6245                  * kernel and just free it on a non-DEBUG build.
6246                  */
6247                 ASSERT(bp->b_cont == NULL);
6248                 if (bp->b_cont != NULL) {
6249                         freemsg(bp->b_cont);
6250                         bp->b_cont = NULL;
6251                 }
6252 
6253                 error = putiocd(bp, reqp->cq_addr, flag, crp);
6254                 if (error && bp->b_cont) {
6255                         freemsg(bp->b_cont);
6256                         bp->b_cont = NULL;
6257                 }
6258 
6259                 bp->b_wptr = bp->b_rptr + sizeof (struct copyresp);
6260                 bp->b_datap->db_type = M_IOCDATA;
6261 
6262                 mblk_setcred(bp, crp, curproc->p_pid);
6263                 resp = (struct copyresp *)bp->b_rptr;
6264                 resp->cp_rval = (caddr_t)(uintptr_t)error;
6265                 resp->cp_flag = (fflags & FMODELS);
6266 
6267                 stream_willservice(stp);
6268                 putnext(stp->sd_wrq, bp);
6269                 stream_runservice(stp);
6270 
6271                 if (error) {
6272                         mutex_enter(&stp->sd_lock);
6273                         stp->sd_flag &= ~waitflags;
6274                         cv_broadcast(&stp->sd_iocmonitor);
6275                         mutex_exit(&stp->sd_lock);
6276                         crfree(crp);
6277                         return (error);
6278                 }
6279 
6280                 goto waitioc;
6281 
6282         case M_COPYOUT:
6283                 /*
6284                  * Driver or module has ioctl data for a user.
6285                  */
6286                 reqp = (struct copyreq *)bp->b_rptr;
6287                 ASSERT(bp->b_cont != NULL);
6288 
6289                 /*
6290                  * Always (transparent or non-transparent )
6291                  * use the address specified in the request
6292                  */
6293                 taddr = reqp->cq_addr;
6294                 if (!transparent)
6295                         len = (int)reqp->cq_size;
6296 
6297                 /* copyout data to the provided address */
6298                 error = getiocd(bp, taddr, copyflag);
6299 
6300                 freemsg(bp->b_cont);
6301                 bp->b_cont = NULL;
6302 
6303                 bp->b_wptr = bp->b_rptr + sizeof (struct copyresp);
6304                 bp->b_datap->db_type = M_IOCDATA;
6305 
6306                 mblk_setcred(bp, crp, curproc->p_pid);
6307                 resp = (struct copyresp *)bp->b_rptr;
6308                 resp->cp_rval = (caddr_t)(uintptr_t)error;
6309                 resp->cp_flag = (fflags & FMODELS);
6310 
6311                 stream_willservice(stp);
6312                 putnext(stp->sd_wrq, bp);
6313                 stream_runservice(stp);
6314 
6315                 if (error) {
6316                         mutex_enter(&stp->sd_lock);
6317                         stp->sd_flag &= ~waitflags;
6318                         cv_broadcast(&stp->sd_iocmonitor);
6319                         mutex_exit(&stp->sd_lock);
6320                         crfree(crp);
6321                         return (error);
6322                 }
6323                 goto waitioc;
6324 
6325         default:
6326                 ASSERT(0);
6327                 mutex_enter(&stp->sd_lock);
6328                 stp->sd_flag &= ~waitflags;
6329                 cv_broadcast(&stp->sd_iocmonitor);
6330                 mutex_exit(&stp->sd_lock);
6331                 break;
6332         }
6333 
6334         freemsg(bp);
6335         crfree(crp);
6336         return (error);
6337 }
6338 
6339 /*
6340  * Send an M_CMD message downstream and wait for a reply.  This is a ptools
6341  * special used to retrieve information from modules/drivers a stream without
6342  * being subjected to flow control or interfering with pending messages on the
6343  * stream (e.g. an ioctl in flight).
6344  */
6345 int
6346 strdocmd(struct stdata *stp, struct strcmd *scp, cred_t *crp)
6347 {
6348         mblk_t *mp;
6349         struct cmdblk *cmdp;
6350         int error = 0;
6351         int errs = STRHUP|STRDERR|STWRERR|STPLEX;
6352         clock_t rval, timeout = STRTIMOUT;
6353 
6354         if (scp->sc_len < 0 || scp->sc_len > sizeof (scp->sc_buf) ||
6355             scp->sc_timeout < -1)
6356                 return (EINVAL);
6357 
6358         if (scp->sc_timeout > 0)
6359                 timeout = scp->sc_timeout * MILLISEC;
6360 
6361         if ((mp = allocb_cred(sizeof (struct cmdblk), crp,
6362             curproc->p_pid)) == NULL)
6363                 return (ENOMEM);
6364 
6365         crhold(crp);
6366 
6367         cmdp = (struct cmdblk *)mp->b_wptr;
6368         cmdp->cb_cr = crp;
6369         cmdp->cb_cmd = scp->sc_cmd;
6370         cmdp->cb_len = scp->sc_len;
6371         cmdp->cb_error = 0;
6372         mp->b_wptr += sizeof (struct cmdblk);
6373 
6374         DB_TYPE(mp) = M_CMD;
6375         DB_CPID(mp) = curproc->p_pid;
6376 
6377         /*
6378          * Copy in the payload.
6379          */
6380         if (cmdp->cb_len > 0) {
6381                 mp->b_cont = allocb_cred(sizeof (scp->sc_buf), crp,
6382                     curproc->p_pid);
6383                 if (mp->b_cont == NULL) {
6384                         error = ENOMEM;
6385                         goto out;
6386                 }
6387 
6388                 /* cb_len comes from sc_len, which has already been checked */
6389                 ASSERT(cmdp->cb_len <= sizeof (scp->sc_buf));
6390                 (void) bcopy(scp->sc_buf, mp->b_cont->b_wptr, cmdp->cb_len);
6391                 mp->b_cont->b_wptr += cmdp->cb_len;
6392                 DB_CPID(mp->b_cont) = curproc->p_pid;
6393         }
6394 
6395         /*
6396          * Since this mechanism is strictly for ptools, and since only one
6397          * process can be grabbed at a time, we simply fail if there's
6398          * currently an operation pending.
6399          */
6400         mutex_enter(&stp->sd_lock);
6401         if (stp->sd_flag & STRCMDWAIT) {
6402                 mutex_exit(&stp->sd_lock);
6403                 error = EBUSY;
6404                 goto out;
6405         }
6406         stp->sd_flag |= STRCMDWAIT;
6407         ASSERT(stp->sd_cmdblk == NULL);
6408         mutex_exit(&stp->sd_lock);
6409 
6410         putnext(stp->sd_wrq, mp);
6411         mp = NULL;
6412 
6413         /*
6414          * Timed wait for acknowledgment.  If the reply has already arrived,
6415          * don't sleep.  If awakened from the sleep, fail only if the reply
6416          * has not arrived by then.  Otherwise, process the reply.
6417          */
6418         mutex_enter(&stp->sd_lock);
6419         while (stp->sd_cmdblk == NULL) {
6420                 if (stp->sd_flag & errs) {
6421                         if ((error = strgeterr(stp, errs, 0)) != 0)
6422                                 goto waitout;
6423                 }
6424 
6425                 rval = str_cv_wait(&stp->sd_monitor, &stp->sd_lock, timeout, 0);
6426                 if (stp->sd_cmdblk != NULL)
6427                         break;
6428 
6429                 if (rval <= 0) {
6430                         error = (rval == 0) ? EINTR : ETIME;
6431                         goto waitout;
6432                 }
6433         }
6434 
6435         /*
6436          * We received a reply.
6437          */
6438         mp = stp->sd_cmdblk;
6439         stp->sd_cmdblk = NULL;
6440         ASSERT(mp != NULL && DB_TYPE(mp) == M_CMD);
6441         ASSERT(stp->sd_flag & STRCMDWAIT);
6442         stp->sd_flag &= ~STRCMDWAIT;
6443         mutex_exit(&stp->sd_lock);
6444 
6445         cmdp = (struct cmdblk *)mp->b_rptr;
6446         if ((error = cmdp->cb_error) != 0)
6447                 goto out;
6448 
6449         /*
6450          * Data may have been returned in the reply (cb_len > 0).
6451          * If so, copy it out to the user's buffer.
6452          */
6453         if (cmdp->cb_len > 0) {
6454                 if (mp->b_cont == NULL || MBLKL(mp->b_cont) < cmdp->cb_len) {
6455                         error = EPROTO;
6456                         goto out;
6457                 }
6458 
6459                 cmdp->cb_len = MIN(cmdp->cb_len, sizeof (scp->sc_buf));
6460                 (void) bcopy(mp->b_cont->b_rptr, scp->sc_buf, cmdp->cb_len);
6461         }
6462         scp->sc_len = cmdp->cb_len;
6463 out:
6464         freemsg(mp);
6465         crfree(crp);
6466         return (error);
6467 waitout:
6468         ASSERT(stp->sd_cmdblk == NULL);
6469         stp->sd_flag &= ~STRCMDWAIT;
6470         mutex_exit(&stp->sd_lock);
6471         crfree(crp);
6472         return (error);
6473 }
6474 
6475 /*
6476  * For the SunOS keyboard driver.
6477  * Return the next available "ioctl" sequence number.
6478  * Exported, so that streams modules can send "ioctl" messages
6479  * downstream from their open routine.
6480  */
6481 int
6482 getiocseqno(void)
6483 {
6484         int     i;
6485 
6486         mutex_enter(&strresources);
6487         i = ++ioc_id;
6488         mutex_exit(&strresources);
6489         return (i);
6490 }
6491 
6492 /*
6493  * Get the next message from the read queue.  If the message is
6494  * priority, STRPRI will have been set by strrput().  This flag
6495  * should be reset only when the entire message at the front of the
6496  * queue as been consumed.
6497  *
6498  * NOTE: strgetmsg and kstrgetmsg have much of the logic in common.
6499  */
6500 int
6501 strgetmsg(
6502         struct vnode *vp,
6503         struct strbuf *mctl,
6504         struct strbuf *mdata,
6505         unsigned char *prip,
6506         int *flagsp,
6507         int fmode,
6508         rval_t *rvp)
6509 {
6510         struct stdata *stp;
6511         mblk_t *bp, *nbp;
6512         mblk_t *savemp = NULL;
6513         mblk_t *savemptail = NULL;
6514         uint_t old_sd_flag;
6515         int flg;
6516         int more = 0;
6517         int error = 0;
6518         char first = 1;
6519         uint_t mark;            /* Contains MSG*MARK and _LASTMARK */
6520 #define _LASTMARK       0x8000  /* Distinct from MSG*MARK */
6521         unsigned char pri = 0;
6522         queue_t *q;
6523         int     pr = 0;                 /* Partial read successful */
6524         struct uio uios;
6525         struct uio *uiop = &uios;
6526         struct iovec iovs;
6527         unsigned char type;
6528 
6529         TRACE_1(TR_FAC_STREAMS_FR, TR_STRGETMSG_ENTER,
6530             "strgetmsg:%p", vp);
6531 
6532         ASSERT(vp->v_stream);
6533         stp = vp->v_stream;
6534         rvp->r_val1 = 0;
6535 
6536         mutex_enter(&stp->sd_lock);
6537 
6538         if ((error = i_straccess(stp, JCREAD)) != 0) {
6539                 mutex_exit(&stp->sd_lock);
6540                 return (error);
6541         }
6542 
6543         if (stp->sd_flag & (STRDERR|STPLEX)) {
6544                 error = strgeterr(stp, STRDERR|STPLEX, 0);
6545                 if (error != 0) {
6546                         mutex_exit(&stp->sd_lock);
6547                         return (error);
6548                 }
6549         }
6550         mutex_exit(&stp->sd_lock);
6551 
6552         switch (*flagsp) {
6553         case MSG_HIPRI:
6554                 if (*prip != 0)
6555                         return (EINVAL);
6556                 break;
6557 
6558         case MSG_ANY:
6559         case MSG_BAND:
6560                 break;
6561 
6562         default:
6563                 return (EINVAL);
6564         }
6565         /*
6566          * Setup uio and iov for data part
6567          */
6568         iovs.iov_base = mdata->buf;
6569         iovs.iov_len = mdata->maxlen;
6570         uios.uio_iov = &iovs;
6571         uios.uio_iovcnt = 1;
6572         uios.uio_loffset = 0;
6573         uios.uio_segflg = UIO_USERSPACE;
6574         uios.uio_fmode = 0;
6575         uios.uio_extflg = UIO_COPY_CACHED;
6576         uios.uio_resid = mdata->maxlen;
6577         uios.uio_offset = 0;
6578 
6579         q = _RD(stp->sd_wrq);
6580         mutex_enter(&stp->sd_lock);
6581         old_sd_flag = stp->sd_flag;
6582         mark = 0;
6583         for (;;) {
6584                 int done = 0;
6585                 mblk_t *q_first = q->q_first;
6586 
6587                 /*
6588                  * Get the next message of appropriate priority
6589                  * from the stream head.  If the caller is interested
6590                  * in band or hipri messages, then they should already
6591                  * be enqueued at the stream head.  On the other hand
6592                  * if the caller wants normal (band 0) messages, they
6593                  * might be deferred in a synchronous stream and they
6594                  * will need to be pulled up.
6595                  *
6596                  * After we have dequeued a message, we might find that
6597                  * it was a deferred M_SIG that was enqueued at the
6598                  * stream head.  It must now be posted as part of the
6599                  * read by calling strsignal_nolock().
6600                  *
6601                  * Also note that strrput does not enqueue an M_PCSIG,
6602                  * and there cannot be more than one hipri message,
6603                  * so there was no need to have the M_PCSIG case.
6604                  *
6605                  * At some time it might be nice to try and wrap the
6606                  * functionality of kstrgetmsg() and strgetmsg() into
6607                  * a common routine so to reduce the amount of replicated
6608                  * code (since they are extremely similar).
6609                  */
6610                 if (!(*flagsp & (MSG_HIPRI|MSG_BAND))) {
6611                         /* Asking for normal, band0 data */
6612                         bp = strget(stp, q, uiop, first, &error);
6613                         ASSERT(MUTEX_HELD(&stp->sd_lock));
6614                         if (bp != NULL) {
6615                                 if (DB_TYPE(bp) == M_SIG) {
6616                                         strsignal_nolock(stp, *bp->b_rptr,
6617                                             bp->b_band);
6618                                         freemsg(bp);
6619                                         continue;
6620                                 } else {
6621                                         break;
6622                                 }
6623                         }
6624                         if (error != 0)
6625                                 goto getmout;
6626 
6627                 /*
6628                  * We can't depend on the value of STRPRI here because
6629                  * the stream head may be in transit. Therefore, we
6630                  * must look at the type of the first message to
6631                  * determine if a high priority messages is waiting
6632                  */
6633                 } else if ((*flagsp & MSG_HIPRI) && q_first != NULL &&
6634                     DB_TYPE(q_first) >= QPCTL &&
6635                     (bp = getq_noenab(q, 0)) != NULL) {
6636                         /* Asked for HIPRI and got one */
6637                         ASSERT(DB_TYPE(bp) >= QPCTL);
6638                         break;
6639                 } else if ((*flagsp & MSG_BAND) && q_first != NULL &&
6640                     ((q_first->b_band >= *prip) || DB_TYPE(q_first) >= QPCTL) &&
6641                     (bp = getq_noenab(q, 0)) != NULL) {
6642                         /*
6643                          * Asked for at least band "prip" and got either at
6644                          * least that band or a hipri message.
6645                          */
6646                         ASSERT(bp->b_band >= *prip || DB_TYPE(bp) >= QPCTL);
6647                         if (DB_TYPE(bp) == M_SIG) {
6648                                 strsignal_nolock(stp, *bp->b_rptr, bp->b_band);
6649                                 freemsg(bp);
6650                                 continue;
6651                         } else {
6652                                 break;
6653                         }
6654                 }
6655 
6656                 /* No data. Time to sleep? */
6657                 qbackenable(q, 0);
6658 
6659                 /*
6660                  * If STRHUP or STREOF, return 0 length control and data.
6661                  * If resid is 0, then a read(fd,buf,0) was done. Do not
6662                  * sleep to satisfy this request because by default we have
6663                  * zero bytes to return.
6664                  */
6665                 if ((stp->sd_flag & (STRHUP|STREOF)) || (mctl->maxlen == 0 &&
6666                     mdata->maxlen == 0)) {
6667                         mctl->len = mdata->len = 0;
6668                         *flagsp = 0;
6669                         mutex_exit(&stp->sd_lock);
6670                         return (0);
6671                 }
6672                 TRACE_2(TR_FAC_STREAMS_FR, TR_STRGETMSG_WAIT,
6673                     "strgetmsg calls strwaitq:%p, %p",
6674                     vp, uiop);
6675                 if (((error = strwaitq(stp, GETWAIT, (ssize_t)0, fmode, -1,
6676                     &done)) != 0) || done) {
6677                         TRACE_2(TR_FAC_STREAMS_FR, TR_STRGETMSG_DONE,
6678                             "strgetmsg error or done:%p, %p",
6679                             vp, uiop);
6680                         mutex_exit(&stp->sd_lock);
6681                         return (error);
6682                 }
6683                 TRACE_2(TR_FAC_STREAMS_FR, TR_STRGETMSG_AWAKE,
6684                     "strgetmsg awakes:%p, %p", vp, uiop);
6685                 if ((error = i_straccess(stp, JCREAD)) != 0) {
6686                         mutex_exit(&stp->sd_lock);
6687                         return (error);
6688                 }
6689                 first = 0;
6690         }
6691         ASSERT(bp != NULL);
6692         /*
6693          * Extract any mark information. If the message is not completely
6694          * consumed this information will be put in the mblk
6695          * that is putback.
6696          * If MSGMARKNEXT is set and the message is completely consumed
6697          * the STRATMARK flag will be set below. Likewise, if
6698          * MSGNOTMARKNEXT is set and the message is
6699          * completely consumed STRNOTATMARK will be set.
6700          */
6701         mark = bp->b_flag & (MSGMARK | MSGMARKNEXT | MSGNOTMARKNEXT);
6702         ASSERT((mark & (MSGMARKNEXT|MSGNOTMARKNEXT)) !=
6703             (MSGMARKNEXT|MSGNOTMARKNEXT));
6704         if (mark != 0 && bp == stp->sd_mark) {
6705                 mark |= _LASTMARK;
6706                 stp->sd_mark = NULL;
6707         }
6708         /*
6709          * keep track of the original message type and priority
6710          */
6711         pri = bp->b_band;
6712         type = bp->b_datap->db_type;
6713         if (type == M_PASSFP) {
6714                 if ((mark & _LASTMARK) && (stp->sd_mark == NULL))
6715                         stp->sd_mark = bp;
6716                 bp->b_flag |= mark & ~_LASTMARK;
6717                 putback(stp, q, bp, pri);
6718                 qbackenable(q, pri);
6719                 mutex_exit(&stp->sd_lock);
6720                 return (EBADMSG);
6721         }
6722         ASSERT(type != M_SIG);
6723 
6724         /*
6725          * Set this flag so strrput will not generate signals. Need to
6726          * make sure this flag is cleared before leaving this routine
6727          * else signals will stop being sent.
6728          */
6729         stp->sd_flag |= STRGETINPROG;
6730         mutex_exit(&stp->sd_lock);
6731 
6732         if (STREAM_NEEDSERVICE(stp))
6733                 stream_runservice(stp);
6734 
6735         /*
6736          * Set HIPRI flag if message is priority.
6737          */
6738         if (type >= QPCTL)
6739                 flg = MSG_HIPRI;
6740         else
6741                 flg = MSG_BAND;
6742 
6743         /*
6744          * First process PROTO or PCPROTO blocks, if any.
6745          */
6746         if (mctl->maxlen >= 0 && type != M_DATA) {
6747                 size_t  n, bcnt;
6748                 char    *ubuf;
6749 
6750                 bcnt = mctl->maxlen;
6751                 ubuf = mctl->buf;
6752                 while (bp != NULL && bp->b_datap->db_type != M_DATA) {
6753                         if ((n = MIN(bcnt, bp->b_wptr - bp->b_rptr)) != 0 &&
6754                             copyout(bp->b_rptr, ubuf, n)) {
6755                                 error = EFAULT;
6756                                 mutex_enter(&stp->sd_lock);
6757                                 /*
6758                                  * clear stream head pri flag based on
6759                                  * first message type
6760                                  */
6761                                 if (type >= QPCTL) {
6762                                         ASSERT(type == M_PCPROTO);
6763                                         stp->sd_flag &= ~STRPRI;
6764                                 }
6765                                 more = 0;
6766                                 freemsg(bp);
6767                                 goto getmout;
6768                         }
6769                         ubuf += n;
6770                         bp->b_rptr += n;
6771                         if (bp->b_rptr >= bp->b_wptr) {
6772                                 nbp = bp;
6773                                 bp = bp->b_cont;
6774                                 freeb(nbp);
6775                         }
6776                         ASSERT(n <= bcnt);
6777                         bcnt -= n;
6778                         if (bcnt == 0)
6779                                 break;
6780                 }
6781                 mctl->len = mctl->maxlen - bcnt;
6782         } else
6783                 mctl->len = -1;
6784 
6785         if (bp && bp->b_datap->db_type != M_DATA) {
6786                 /*
6787                  * More PROTO blocks in msg.
6788                  */
6789                 more |= MORECTL;
6790                 savemp = bp;
6791                 while (bp && bp->b_datap->db_type != M_DATA) {
6792                         savemptail = bp;
6793                         bp = bp->b_cont;
6794                 }
6795                 savemptail->b_cont = NULL;
6796         }
6797 
6798         /*
6799          * Now process DATA blocks, if any.
6800          */
6801         if (mdata->maxlen >= 0 && bp) {
6802                 /*
6803                  * struiocopyout will consume a potential zero-length
6804                  * M_DATA even if uio_resid is zero.
6805                  */
6806                 size_t oldresid = uiop->uio_resid;
6807 
6808                 bp = struiocopyout(bp, uiop, &error);
6809                 if (error != 0) {
6810                         mutex_enter(&stp->sd_lock);
6811                         /*
6812                          * clear stream head hi pri flag based on
6813                          * first message
6814                          */
6815                         if (type >= QPCTL) {
6816                                 ASSERT(type == M_PCPROTO);
6817                                 stp->sd_flag &= ~STRPRI;
6818                         }
6819                         more = 0;
6820                         freemsg(savemp);
6821                         goto getmout;
6822                 }
6823                 /*
6824                  * (pr == 1) indicates a partial read.
6825                  */
6826                 if (oldresid > uiop->uio_resid)
6827                         pr = 1;
6828                 mdata->len = mdata->maxlen - uiop->uio_resid;
6829         } else
6830                 mdata->len = -1;
6831 
6832         if (bp) {                       /* more data blocks in msg */
6833                 more |= MOREDATA;
6834                 if (savemp)
6835                         savemptail->b_cont = bp;
6836                 else
6837                         savemp = bp;
6838         }
6839 
6840         mutex_enter(&stp->sd_lock);
6841         if (savemp) {
6842                 if (pr && (savemp->b_datap->db_type == M_DATA) &&
6843                     msgnodata(savemp)) {
6844                         /*
6845                          * Avoid queuing a zero-length tail part of
6846                          * a message. pr=1 indicates that we read some of
6847                          * the message.
6848                          */
6849                         freemsg(savemp);
6850                         more &= ~MOREDATA;
6851                         /*
6852                          * clear stream head hi pri flag based on
6853                          * first message
6854                          */
6855                         if (type >= QPCTL) {
6856                                 ASSERT(type == M_PCPROTO);
6857                                 stp->sd_flag &= ~STRPRI;
6858                         }
6859                 } else {
6860                         savemp->b_band = pri;
6861                         /*
6862                          * If the first message was HIPRI and the one we're
6863                          * putting back isn't, then clear STRPRI, otherwise
6864                          * set STRPRI again.  Note that we must set STRPRI
6865                          * again since the flush logic in strrput_nondata()
6866                          * may have cleared it while we had sd_lock dropped.
6867                          */
6868                         if (type >= QPCTL) {
6869                                 ASSERT(type == M_PCPROTO);
6870                                 if (queclass(savemp) < QPCTL)
6871                                         stp->sd_flag &= ~STRPRI;
6872                                 else
6873                                         stp->sd_flag |= STRPRI;
6874                         } else if (queclass(savemp) >= QPCTL) {
6875                                 /*
6876                                  * The first message was not a HIPRI message,
6877                                  * but the one we are about to putback is.
6878                                  * For simplicitly, we do not allow for HIPRI
6879                                  * messages to be embedded in the message
6880                                  * body, so just force it to same type as
6881                                  * first message.
6882                                  */
6883                                 ASSERT(type == M_DATA || type == M_PROTO);
6884                                 ASSERT(savemp->b_datap->db_type == M_PCPROTO);
6885                                 savemp->b_datap->db_type = type;
6886                         }
6887                         if (mark != 0) {
6888                                 savemp->b_flag |= mark & ~_LASTMARK;
6889                                 if ((mark & _LASTMARK) &&
6890                                     (stp->sd_mark == NULL)) {
6891                                         /*
6892                                          * If another marked message arrived
6893                                          * while sd_lock was not held sd_mark
6894                                          * would be non-NULL.
6895                                          */
6896                                         stp->sd_mark = savemp;
6897                                 }
6898                         }
6899                         putback(stp, q, savemp, pri);
6900                 }
6901         } else {
6902                 /*
6903                  * The complete message was consumed.
6904                  *
6905                  * If another M_PCPROTO arrived while sd_lock was not held
6906                  * it would have been discarded since STRPRI was still set.
6907                  *
6908                  * Move the MSG*MARKNEXT information
6909                  * to the stream head just in case
6910                  * the read queue becomes empty.
6911                  * clear stream head hi pri flag based on
6912                  * first message
6913                  *
6914                  * If the stream head was at the mark
6915                  * (STRATMARK) before we dropped sd_lock above
6916                  * and some data was consumed then we have
6917                  * moved past the mark thus STRATMARK is
6918                  * cleared. However, if a message arrived in
6919                  * strrput during the copyout above causing
6920                  * STRATMARK to be set we can not clear that
6921                  * flag.
6922                  */
6923                 if (type >= QPCTL) {
6924                         ASSERT(type == M_PCPROTO);
6925                         stp->sd_flag &= ~STRPRI;
6926                 }
6927                 if (mark & (MSGMARKNEXT|MSGNOTMARKNEXT|MSGMARK)) {
6928                         if (mark & MSGMARKNEXT) {
6929                                 stp->sd_flag &= ~STRNOTATMARK;
6930                                 stp->sd_flag |= STRATMARK;
6931                         } else if (mark & MSGNOTMARKNEXT) {
6932                                 stp->sd_flag &= ~STRATMARK;
6933                                 stp->sd_flag |= STRNOTATMARK;
6934                         } else {
6935                                 stp->sd_flag &= ~(STRATMARK|STRNOTATMARK);
6936                         }
6937                 } else if (pr && (old_sd_flag & STRATMARK)) {
6938                         stp->sd_flag &= ~STRATMARK;
6939                 }
6940         }
6941 
6942         *flagsp = flg;
6943         *prip = pri;
6944 
6945         /*
6946          * Getmsg cleanup processing - if the state of the queue has changed
6947          * some signals may need to be sent and/or poll awakened.
6948          */
6949 getmout:
6950         qbackenable(q, pri);
6951 
6952         /*
6953          * We dropped the stream head lock above. Send all M_SIG messages
6954          * before processing stream head for SIGPOLL messages.
6955          */
6956         ASSERT(MUTEX_HELD(&stp->sd_lock));
6957         while ((bp = q->q_first) != NULL &&
6958             (bp->b_datap->db_type == M_SIG)) {
6959                 /*
6960                  * sd_lock is held so the content of the read queue can not
6961                  * change.
6962                  */
6963                 bp = getq(q);
6964                 ASSERT(bp != NULL && bp->b_datap->db_type == M_SIG);
6965 
6966                 strsignal_nolock(stp, *bp->b_rptr, bp->b_band);
6967                 mutex_exit(&stp->sd_lock);
6968                 freemsg(bp);
6969                 if (STREAM_NEEDSERVICE(stp))
6970                         stream_runservice(stp);
6971                 mutex_enter(&stp->sd_lock);
6972         }
6973 
6974         /*
6975          * stream head cannot change while we make the determination
6976          * whether or not to send a signal. Drop the flag to allow strrput
6977          * to send firstmsgsigs again.
6978          */
6979         stp->sd_flag &= ~STRGETINPROG;
6980 
6981         /*
6982          * If the type of message at the front of the queue changed
6983          * due to the receive the appropriate signals and pollwakeup events
6984          * are generated. The type of changes are:
6985          *      Processed a hipri message, q_first is not hipri.
6986          *      Processed a band X message, and q_first is band Y.
6987          * The generated signals and pollwakeups are identical to what
6988          * strrput() generates should the message that is now on q_first
6989          * arrive to an empty read queue.
6990          *
6991          * Note: only strrput will send a signal for a hipri message.
6992          */
6993         if ((bp = q->q_first) != NULL && !(stp->sd_flag & STRPRI)) {
6994                 strsigset_t signals = 0;
6995                 strpollset_t pollwakeups = 0;
6996 
6997                 if (flg & MSG_HIPRI) {
6998                         /*
6999                          * Removed a hipri message. Regular data at
7000                          * the front of  the queue.
7001                          */
7002                         if (bp->b_band == 0) {
7003                                 signals = S_INPUT | S_RDNORM;
7004                                 pollwakeups = POLLIN | POLLRDNORM;
7005                         } else {
7006                                 signals = S_INPUT | S_RDBAND;
7007                                 pollwakeups = POLLIN | POLLRDBAND;
7008                         }
7009                 } else if (pri != bp->b_band) {
7010                         /*
7011                          * The band is different for the new q_first.
7012                          */
7013                         if (bp->b_band == 0) {
7014                                 signals = S_RDNORM;
7015                                 pollwakeups = POLLIN | POLLRDNORM;
7016                         } else {
7017                                 signals = S_RDBAND;
7018                                 pollwakeups = POLLIN | POLLRDBAND;
7019                         }
7020                 }
7021 
7022                 if (pollwakeups != 0) {
7023                         if (pollwakeups == (POLLIN | POLLRDNORM)) {
7024                                 if (!(stp->sd_rput_opt & SR_POLLIN))
7025                                         goto no_pollwake;
7026                                 stp->sd_rput_opt &= ~SR_POLLIN;
7027                         }
7028                         mutex_exit(&stp->sd_lock);
7029                         pollwakeup(&stp->sd_pollist, pollwakeups);
7030                         mutex_enter(&stp->sd_lock);
7031                 }
7032 no_pollwake:
7033 
7034                 if (stp->sd_sigflags & signals)
7035                         strsendsig(stp->sd_siglist, signals, bp->b_band, 0);
7036         }
7037         mutex_exit(&stp->sd_lock);
7038 
7039         rvp->r_val1 = more;
7040         return (error);
7041 #undef  _LASTMARK
7042 }
7043 
7044 /*
7045  * Get the next message from the read queue.  If the message is
7046  * priority, STRPRI will have been set by strrput().  This flag
7047  * should be reset only when the entire message at the front of the
7048  * queue as been consumed.
7049  *
7050  * If uiop is NULL all data is returned in mctlp.
7051  * Note that a NULL uiop implies that FNDELAY and FNONBLOCK are assumed
7052  * not enabled.
7053  * The timeout parameter is in milliseconds; -1 for infinity.
7054  * This routine handles the consolidation private flags:
7055  *      MSG_IGNERROR    Ignore any stream head error except STPLEX.
7056  *      MSG_DELAYERROR  Defer the error check until the queue is empty.
7057  *      MSG_HOLDSIG     Hold signals while waiting for data.
7058  *      MSG_IPEEK       Only peek at messages.
7059  *      MSG_DISCARDTAIL Discard the tail M_DATA part of the message
7060  *                      that doesn't fit.
7061  *      MSG_NOMARK      If the message is marked leave it on the queue.
7062  *
7063  * NOTE: strgetmsg and kstrgetmsg have much of the logic in common.
7064  */
7065 int
7066 kstrgetmsg(
7067         struct vnode *vp,
7068         mblk_t **mctlp,
7069         struct uio *uiop,
7070         unsigned char *prip,
7071         int *flagsp,
7072         clock_t timout,
7073         rval_t *rvp)
7074 {
7075         struct stdata *stp;
7076         mblk_t *bp, *nbp;
7077         mblk_t *savemp = NULL;
7078         mblk_t *savemptail = NULL;
7079         int flags;
7080         uint_t old_sd_flag;
7081         int flg;
7082         int more = 0;
7083         int error = 0;
7084         char first = 1;
7085         uint_t mark;            /* Contains MSG*MARK and _LASTMARK */
7086 #define _LASTMARK       0x8000  /* Distinct from MSG*MARK */
7087         unsigned char pri = 0;
7088         queue_t *q;
7089         int     pr = 0;                 /* Partial read successful */
7090         unsigned char type;
7091 
7092         TRACE_1(TR_FAC_STREAMS_FR, TR_KSTRGETMSG_ENTER,
7093             "kstrgetmsg:%p", vp);
7094 
7095         ASSERT(vp->v_stream);
7096         stp = vp->v_stream;
7097         rvp->r_val1 = 0;
7098 
7099         mutex_enter(&stp->sd_lock);
7100 
7101         if ((error = i_straccess(stp, JCREAD)) != 0) {
7102                 mutex_exit(&stp->sd_lock);
7103                 return (error);
7104         }
7105 
7106         flags = *flagsp;
7107         if (stp->sd_flag & (STRDERR|STPLEX)) {
7108                 if ((stp->sd_flag & STPLEX) ||
7109                     (flags & (MSG_IGNERROR|MSG_DELAYERROR)) == 0) {
7110                         error = strgeterr(stp, STRDERR|STPLEX,
7111                             (flags & MSG_IPEEK));
7112                         if (error != 0) {
7113                                 mutex_exit(&stp->sd_lock);
7114                                 return (error);
7115                         }
7116                 }
7117         }
7118         mutex_exit(&stp->sd_lock);
7119 
7120         switch (flags & (MSG_HIPRI|MSG_ANY|MSG_BAND)) {
7121         case MSG_HIPRI:
7122                 if (*prip != 0)
7123                         return (EINVAL);
7124                 break;
7125 
7126         case MSG_ANY:
7127         case MSG_BAND:
7128                 break;
7129 
7130         default:
7131                 return (EINVAL);
7132         }
7133 
7134 retry:
7135         q = _RD(stp->sd_wrq);
7136         mutex_enter(&stp->sd_lock);
7137         old_sd_flag = stp->sd_flag;
7138         mark = 0;
7139         for (;;) {
7140                 int done = 0;
7141                 int waitflag;
7142                 int fmode;
7143                 mblk_t *q_first = q->q_first;
7144 
7145                 /*
7146                  * This section of the code operates just like the code
7147                  * in strgetmsg().  There is a comment there about what
7148                  * is going on here.
7149                  */
7150                 if (!(flags & (MSG_HIPRI|MSG_BAND))) {
7151                         /* Asking for normal, band0 data */
7152                         bp = strget(stp, q, uiop, first, &error);
7153                         ASSERT(MUTEX_HELD(&stp->sd_lock));
7154                         if (bp != NULL) {
7155                                 if (DB_TYPE(bp) == M_SIG) {
7156                                         strsignal_nolock(stp, *bp->b_rptr,
7157                                             bp->b_band);
7158                                         freemsg(bp);
7159                                         continue;
7160                                 } else {
7161                                         break;
7162                                 }
7163                         }
7164                         if (error != 0) {
7165                                 goto getmout;
7166                         }
7167                 /*
7168                  * We can't depend on the value of STRPRI here because
7169                  * the stream head may be in transit. Therefore, we
7170                  * must look at the type of the first message to
7171                  * determine if a high priority messages is waiting
7172                  */
7173                 } else if ((flags & MSG_HIPRI) && q_first != NULL &&
7174                     DB_TYPE(q_first) >= QPCTL &&
7175                     (bp = getq_noenab(q, 0)) != NULL) {
7176                         ASSERT(DB_TYPE(bp) >= QPCTL);
7177                         break;
7178                 } else if ((flags & MSG_BAND) && q_first != NULL &&
7179                     ((q_first->b_band >= *prip) || DB_TYPE(q_first) >= QPCTL) &&
7180                     (bp = getq_noenab(q, 0)) != NULL) {
7181                         /*
7182                          * Asked for at least band "prip" and got either at
7183                          * least that band or a hipri message.
7184                          */
7185                         ASSERT(bp->b_band >= *prip || DB_TYPE(bp) >= QPCTL);
7186                         if (DB_TYPE(bp) == M_SIG) {
7187                                 strsignal_nolock(stp, *bp->b_rptr, bp->b_band);
7188                                 freemsg(bp);
7189                                 continue;
7190                         } else {
7191                                 break;
7192                         }
7193                 }
7194 
7195                 /* No data. Time to sleep? */
7196                 qbackenable(q, 0);
7197 
7198                 /*
7199                  * Delayed error notification?
7200                  */
7201                 if ((stp->sd_flag & (STRDERR|STPLEX)) &&
7202                     (flags & (MSG_IGNERROR|MSG_DELAYERROR)) == MSG_DELAYERROR) {
7203                         error = strgeterr(stp, STRDERR|STPLEX,
7204                             (flags & MSG_IPEEK));
7205                         if (error != 0) {
7206                                 mutex_exit(&stp->sd_lock);
7207                                 return (error);
7208                         }
7209                 }
7210 
7211                 /*
7212                  * If STRHUP or STREOF, return 0 length control and data.
7213                  * If a read(fd,buf,0) has been done, do not sleep, just
7214                  * return.
7215                  *
7216                  * If mctlp == NULL and uiop == NULL, then the code will
7217                  * do the strwaitq. This is an understood way of saying
7218                  * sleep "polling" until a message is received.
7219                  */
7220                 if ((stp->sd_flag & (STRHUP|STREOF)) ||
7221                     (uiop != NULL && uiop->uio_resid == 0)) {
7222                         if (mctlp != NULL)
7223                                 *mctlp = NULL;
7224                         *flagsp = 0;
7225                         mutex_exit(&stp->sd_lock);
7226                         return (0);
7227                 }
7228 
7229                 waitflag = GETWAIT;
7230                 if (flags &
7231                     (MSG_HOLDSIG|MSG_IGNERROR|MSG_IPEEK|MSG_DELAYERROR)) {
7232                         if (flags & MSG_HOLDSIG)
7233                                 waitflag |= STR_NOSIG;
7234                         if (flags & MSG_IGNERROR)
7235                                 waitflag |= STR_NOERROR;
7236                         if (flags & MSG_IPEEK)
7237                                 waitflag |= STR_PEEK;
7238                         if (flags & MSG_DELAYERROR)
7239                                 waitflag |= STR_DELAYERR;
7240                 }
7241                 if (uiop != NULL)
7242                         fmode = uiop->uio_fmode;
7243                 else
7244                         fmode = 0;
7245 
7246                 TRACE_2(TR_FAC_STREAMS_FR, TR_KSTRGETMSG_WAIT,
7247                     "kstrgetmsg calls strwaitq:%p, %p",
7248                     vp, uiop);
7249                 if (((error = strwaitq(stp, waitflag, (ssize_t)0,
7250                     fmode, timout, &done))) != 0 || done) {
7251                         TRACE_2(TR_FAC_STREAMS_FR, TR_KSTRGETMSG_DONE,
7252                             "kstrgetmsg error or done:%p, %p",
7253                             vp, uiop);
7254                         mutex_exit(&stp->sd_lock);
7255                         return (error);
7256                 }
7257                 TRACE_2(TR_FAC_STREAMS_FR, TR_KSTRGETMSG_AWAKE,
7258                     "kstrgetmsg awakes:%p, %p", vp, uiop);
7259                 if ((error = i_straccess(stp, JCREAD)) != 0) {
7260                         mutex_exit(&stp->sd_lock);
7261                         return (error);
7262                 }
7263                 first = 0;
7264         }
7265         ASSERT(bp != NULL);
7266         /*
7267          * Extract any mark information. If the message is not completely
7268          * consumed this information will be put in the mblk
7269          * that is putback.
7270          * If MSGMARKNEXT is set and the message is completely consumed
7271          * the STRATMARK flag will be set below. Likewise, if
7272          * MSGNOTMARKNEXT is set and the message is
7273          * completely consumed STRNOTATMARK will be set.
7274          */
7275         mark = bp->b_flag & (MSGMARK | MSGMARKNEXT | MSGNOTMARKNEXT);
7276         ASSERT((mark & (MSGMARKNEXT|MSGNOTMARKNEXT)) !=
7277             (MSGMARKNEXT|MSGNOTMARKNEXT));
7278         pri = bp->b_band;
7279         if (mark != 0) {
7280                 /*
7281                  * If the caller doesn't want the mark return.
7282                  * Used to implement MSG_WAITALL in sockets.
7283                  */
7284                 if (flags & MSG_NOMARK) {
7285                         putback(stp, q, bp, pri);
7286                         qbackenable(q, pri);
7287                         mutex_exit(&stp->sd_lock);
7288                         return (EWOULDBLOCK);
7289                 }
7290                 if (bp == stp->sd_mark) {
7291                         mark |= _LASTMARK;
7292                         stp->sd_mark = NULL;
7293                 }
7294         }
7295 
7296         /*
7297          * keep track of the first message type
7298          */
7299         type = bp->b_datap->db_type;
7300 
7301         if (bp->b_datap->db_type == M_PASSFP) {
7302                 if ((mark & _LASTMARK) && (stp->sd_mark == NULL))
7303                         stp->sd_mark = bp;
7304                 bp->b_flag |= mark & ~_LASTMARK;
7305                 putback(stp, q, bp, pri);
7306                 qbackenable(q, pri);
7307                 mutex_exit(&stp->sd_lock);
7308                 return (EBADMSG);
7309         }
7310         ASSERT(type != M_SIG);
7311 
7312         if (flags & MSG_IPEEK) {
7313                 /*
7314                  * Clear any struioflag - we do the uiomove over again
7315                  * when peeking since it simplifies the code.
7316                  *
7317                  * Dup the message and put the original back on the queue.
7318                  * If dupmsg() fails, try again with copymsg() to see if
7319                  * there is indeed a shortage of memory.  dupmsg() may fail
7320                  * if db_ref in any of the messages reaches its limit.
7321                  */
7322 
7323                 if ((nbp = dupmsg(bp)) == NULL && (nbp = copymsg(bp)) == NULL) {
7324                         /*
7325                          * Restore the state of the stream head since we
7326                          * need to drop sd_lock (strwaitbuf is sleeping).
7327                          */
7328                         size_t size = msgdsize(bp);
7329 
7330                         if ((mark & _LASTMARK) && (stp->sd_mark == NULL))
7331                                 stp->sd_mark = bp;
7332                         bp->b_flag |= mark & ~_LASTMARK;
7333                         putback(stp, q, bp, pri);
7334                         mutex_exit(&stp->sd_lock);
7335                         error = strwaitbuf(size, BPRI_HI);
7336                         if (error) {
7337                                 /*
7338                                  * There is no net change to the queue thus
7339                                  * no need to qbackenable.
7340                                  */
7341                                 return (error);
7342                         }
7343                         goto retry;
7344                 }
7345 
7346                 if ((mark & _LASTMARK) && (stp->sd_mark == NULL))
7347                         stp->sd_mark = bp;
7348                 bp->b_flag |= mark & ~_LASTMARK;
7349                 putback(stp, q, bp, pri);
7350                 bp = nbp;
7351         }
7352 
7353         /*
7354          * Set this flag so strrput will not generate signals. Need to
7355          * make sure this flag is cleared before leaving this routine
7356          * else signals will stop being sent.
7357          */
7358         stp->sd_flag |= STRGETINPROG;
7359         mutex_exit(&stp->sd_lock);
7360 
7361         if ((stp->sd_rputdatafunc != NULL) && (DB_TYPE(bp) == M_DATA)) {
7362                 mblk_t *tmp, *prevmp;
7363 
7364                 /*
7365                  * Put first non-data mblk back to stream head and
7366                  * cut the mblk chain so sd_rputdatafunc only sees
7367                  * M_DATA mblks. We can skip the first mblk since it
7368                  * is M_DATA according to the condition above.
7369                  */
7370                 for (prevmp = bp, tmp = bp->b_cont; tmp != NULL;
7371                     prevmp = tmp, tmp = tmp->b_cont) {
7372                         if (DB_TYPE(tmp) != M_DATA) {
7373                                 prevmp->b_cont = NULL;
7374                                 mutex_enter(&stp->sd_lock);
7375                                 putback(stp, q, tmp, tmp->b_band);
7376                                 mutex_exit(&stp->sd_lock);
7377                                 break;
7378                         }
7379                 }
7380 
7381                 bp = (stp->sd_rputdatafunc)(stp->sd_vnode, bp,
7382                     NULL, NULL, NULL, NULL);
7383 
7384                 if (bp == NULL)
7385                         goto retry;
7386         }
7387 
7388         if (STREAM_NEEDSERVICE(stp))
7389                 stream_runservice(stp);
7390 
7391         /*
7392          * Set HIPRI flag if message is priority.
7393          */
7394         if (type >= QPCTL)
7395                 flg = MSG_HIPRI;
7396         else
7397                 flg = MSG_BAND;
7398 
7399         /*
7400          * First process PROTO or PCPROTO blocks, if any.
7401          */
7402         if (mctlp != NULL && type != M_DATA) {
7403                 mblk_t *nbp;
7404 
7405                 *mctlp = bp;
7406                 while (bp->b_cont && bp->b_cont->b_datap->db_type != M_DATA)
7407                         bp = bp->b_cont;
7408                 nbp = bp->b_cont;
7409                 bp->b_cont = NULL;
7410                 bp = nbp;
7411         }
7412 
7413         if (bp && bp->b_datap->db_type != M_DATA) {
7414                 /*
7415                  * More PROTO blocks in msg. Will only happen if mctlp is NULL.
7416                  */
7417                 more |= MORECTL;
7418                 savemp = bp;
7419                 while (bp && bp->b_datap->db_type != M_DATA) {
7420                         savemptail = bp;
7421                         bp = bp->b_cont;
7422                 }
7423                 savemptail->b_cont = NULL;
7424         }
7425 
7426         /*
7427          * Now process DATA blocks, if any.
7428          */
7429         if (uiop == NULL) {
7430                 /* Append data to tail of mctlp */
7431 
7432                 if (mctlp != NULL) {
7433                         mblk_t **mpp = mctlp;
7434 
7435                         while (*mpp != NULL)
7436                                 mpp = &((*mpp)->b_cont);
7437                         *mpp = bp;
7438                         bp = NULL;
7439                 }
7440         } else if (uiop->uio_resid >= 0 && bp) {
7441                 size_t oldresid = uiop->uio_resid;
7442 
7443                 /*
7444                  * If a streams message is likely to consist
7445                  * of many small mblks, it is pulled up into
7446                  * one continuous chunk of memory.
7447                  * The size of the first mblk may be bogus because
7448                  * successive read() calls on the socket reduce
7449                  * the size of this mblk until it is exhausted
7450                  * and then the code walks on to the next. Thus
7451                  * the size of the mblk may not be the original size
7452                  * that was passed up, it's simply a remainder
7453                  * and hence can be very small without any
7454                  * implication that the packet is badly fragmented.
7455                  * So the size of the possible second mblk is
7456                  * used to spot a badly fragmented packet.
7457                  * see longer comment at top of page
7458                  * by mblk_pull_len declaration.
7459                  */
7460 
7461                 if (bp->b_cont != NULL && MBLKL(bp->b_cont) < mblk_pull_len) {
7462                         (void) pullupmsg(bp, -1);
7463                 }
7464 
7465                 bp = struiocopyout(bp, uiop, &error);
7466                 if (error != 0) {
7467                         if (mctlp != NULL) {
7468                                 freemsg(*mctlp);
7469                                 *mctlp = NULL;
7470                         } else
7471                                 freemsg(savemp);
7472                         mutex_enter(&stp->sd_lock);
7473                         /*
7474                          * clear stream head hi pri flag based on
7475                          * first message
7476                          */
7477                         if (!(flags & MSG_IPEEK) && (type >= QPCTL)) {
7478                                 ASSERT(type == M_PCPROTO);
7479                                 stp->sd_flag &= ~STRPRI;
7480                         }
7481                         more = 0;
7482                         goto getmout;
7483                 }
7484                 /*
7485                  * (pr == 1) indicates a partial read.
7486                  */
7487                 if (oldresid > uiop->uio_resid)
7488                         pr = 1;
7489         }
7490 
7491         if (bp) {                       /* more data blocks in msg */
7492                 more |= MOREDATA;
7493                 if (savemp)
7494                         savemptail->b_cont = bp;
7495                 else
7496                         savemp = bp;
7497         }
7498 
7499         mutex_enter(&stp->sd_lock);
7500         if (savemp) {
7501                 if (flags & (MSG_IPEEK|MSG_DISCARDTAIL)) {
7502                         /*
7503                          * When MSG_DISCARDTAIL is set or
7504                          * when peeking discard any tail. When peeking this
7505                          * is the tail of the dup that was copied out - the
7506                          * message has already been putback on the queue.
7507                          * Return MOREDATA to the caller even though the data
7508                          * is discarded. This is used by sockets (to
7509                          * set MSG_TRUNC).
7510                          */
7511                         freemsg(savemp);
7512                         if (!(flags & MSG_IPEEK) && (type >= QPCTL)) {
7513                                 ASSERT(type == M_PCPROTO);
7514                                 stp->sd_flag &= ~STRPRI;
7515                         }
7516                 } else if (pr && (savemp->b_datap->db_type == M_DATA) &&
7517                     msgnodata(savemp)) {
7518                         /*
7519                          * Avoid queuing a zero-length tail part of
7520                          * a message. pr=1 indicates that we read some of
7521                          * the message.
7522                          */
7523                         freemsg(savemp);
7524                         more &= ~MOREDATA;
7525                         if (type >= QPCTL) {
7526                                 ASSERT(type == M_PCPROTO);
7527                                 stp->sd_flag &= ~STRPRI;
7528                         }
7529                 } else {
7530                         savemp->b_band = pri;
7531                         /*
7532                          * If the first message was HIPRI and the one we're
7533                          * putting back isn't, then clear STRPRI, otherwise
7534                          * set STRPRI again.  Note that we must set STRPRI
7535                          * again since the flush logic in strrput_nondata()
7536                          * may have cleared it while we had sd_lock dropped.
7537                          */
7538 
7539                         if (type >= QPCTL) {
7540                                 ASSERT(type == M_PCPROTO);
7541                                 if (queclass(savemp) < QPCTL)
7542                                         stp->sd_flag &= ~STRPRI;
7543                                 else
7544                                         stp->sd_flag |= STRPRI;
7545                         } else if (queclass(savemp) >= QPCTL) {
7546                                 /*
7547                                  * The first message was not a HIPRI message,
7548                                  * but the one we are about to putback is.
7549                                  * For simplicitly, we do not allow for HIPRI
7550                                  * messages to be embedded in the message
7551                                  * body, so just force it to same type as
7552                                  * first message.
7553                                  */
7554                                 ASSERT(type == M_DATA || type == M_PROTO);
7555                                 ASSERT(savemp->b_datap->db_type == M_PCPROTO);
7556                                 savemp->b_datap->db_type = type;
7557                         }
7558                         if (mark != 0) {
7559                                 if ((mark & _LASTMARK) &&
7560                                     (stp->sd_mark == NULL)) {
7561                                         /*
7562                                          * If another marked message arrived
7563                                          * while sd_lock was not held sd_mark
7564                                          * would be non-NULL.
7565                                          */
7566                                         stp->sd_mark = savemp;
7567                                 }
7568                                 savemp->b_flag |= mark & ~_LASTMARK;
7569                         }
7570                         putback(stp, q, savemp, pri);
7571                 }
7572         } else if (!(flags & MSG_IPEEK)) {
7573                 /*
7574                  * The complete message was consumed.
7575                  *
7576                  * If another M_PCPROTO arrived while sd_lock was not held
7577                  * it would have been discarded since STRPRI was still set.
7578                  *
7579                  * Move the MSG*MARKNEXT information
7580                  * to the stream head just in case
7581                  * the read queue becomes empty.
7582                  * clear stream head hi pri flag based on
7583                  * first message
7584                  *
7585                  * If the stream head was at the mark
7586                  * (STRATMARK) before we dropped sd_lock above
7587                  * and some data was consumed then we have
7588                  * moved past the mark thus STRATMARK is
7589                  * cleared. However, if a message arrived in
7590                  * strrput during the copyout above causing
7591                  * STRATMARK to be set we can not clear that
7592                  * flag.
7593                  * XXX A "perimeter" would help by single-threading strrput,
7594                  * strread, strgetmsg and kstrgetmsg.
7595                  */
7596                 if (type >= QPCTL) {
7597                         ASSERT(type == M_PCPROTO);
7598                         stp->sd_flag &= ~STRPRI;
7599                 }
7600                 if (mark & (MSGMARKNEXT|MSGNOTMARKNEXT|MSGMARK)) {
7601                         if (mark & MSGMARKNEXT) {
7602                                 stp->sd_flag &= ~STRNOTATMARK;
7603                                 stp->sd_flag |= STRATMARK;
7604                         } else if (mark & MSGNOTMARKNEXT) {
7605                                 stp->sd_flag &= ~STRATMARK;
7606                                 stp->sd_flag |= STRNOTATMARK;
7607                         } else {
7608                                 stp->sd_flag &= ~(STRATMARK|STRNOTATMARK);
7609                         }
7610                 } else if (pr && (old_sd_flag & STRATMARK)) {
7611                         stp->sd_flag &= ~STRATMARK;
7612                 }
7613         }
7614 
7615         *flagsp = flg;
7616         *prip = pri;
7617 
7618         /*
7619          * Getmsg cleanup processing - if the state of the queue has changed
7620          * some signals may need to be sent and/or poll awakened.
7621          */
7622 getmout:
7623         qbackenable(q, pri);
7624 
7625         /*
7626          * We dropped the stream head lock above. Send all M_SIG messages
7627          * before processing stream head for SIGPOLL messages.
7628          */
7629         ASSERT(MUTEX_HELD(&stp->sd_lock));
7630         while ((bp = q->q_first) != NULL &&
7631             (bp->b_datap->db_type == M_SIG)) {
7632                 /*
7633                  * sd_lock is held so the content of the read queue can not
7634                  * change.
7635                  */
7636                 bp = getq(q);
7637                 ASSERT(bp != NULL && bp->b_datap->db_type == M_SIG);
7638 
7639                 strsignal_nolock(stp, *bp->b_rptr, bp->b_band);
7640                 mutex_exit(&stp->sd_lock);
7641                 freemsg(bp);
7642                 if (STREAM_NEEDSERVICE(stp))
7643                         stream_runservice(stp);
7644                 mutex_enter(&stp->sd_lock);
7645         }
7646 
7647         /*
7648          * stream head cannot change while we make the determination
7649          * whether or not to send a signal. Drop the flag to allow strrput
7650          * to send firstmsgsigs again.
7651          */
7652         stp->sd_flag &= ~STRGETINPROG;
7653 
7654         /*
7655          * If the type of message at the front of the queue changed
7656          * due to the receive the appropriate signals and pollwakeup events
7657          * are generated. The type of changes are:
7658          *      Processed a hipri message, q_first is not hipri.
7659          *      Processed a band X message, and q_first is band Y.
7660          * The generated signals and pollwakeups are identical to what
7661          * strrput() generates should the message that is now on q_first
7662          * arrive to an empty read queue.
7663          *
7664          * Note: only strrput will send a signal for a hipri message.
7665          */
7666         if ((bp = q->q_first) != NULL && !(stp->sd_flag & STRPRI)) {
7667                 strsigset_t signals = 0;
7668                 strpollset_t pollwakeups = 0;
7669 
7670                 if (flg & MSG_HIPRI) {
7671                         /*
7672                          * Removed a hipri message. Regular data at
7673                          * the front of  the queue.
7674                          */
7675                         if (bp->b_band == 0) {
7676                                 signals = S_INPUT | S_RDNORM;
7677                                 pollwakeups = POLLIN | POLLRDNORM;
7678                         } else {
7679                                 signals = S_INPUT | S_RDBAND;
7680                                 pollwakeups = POLLIN | POLLRDBAND;
7681                         }
7682                 } else if (pri != bp->b_band) {
7683                         /*
7684                          * The band is different for the new q_first.
7685                          */
7686                         if (bp->b_band == 0) {
7687                                 signals = S_RDNORM;
7688                                 pollwakeups = POLLIN | POLLRDNORM;
7689                         } else {
7690                                 signals = S_RDBAND;
7691                                 pollwakeups = POLLIN | POLLRDBAND;
7692                         }
7693                 }
7694 
7695                 if (pollwakeups != 0) {
7696                         if (pollwakeups == (POLLIN | POLLRDNORM)) {
7697                                 if (!(stp->sd_rput_opt & SR_POLLIN))
7698                                         goto no_pollwake;
7699                                 stp->sd_rput_opt &= ~SR_POLLIN;
7700                         }
7701                         mutex_exit(&stp->sd_lock);
7702                         pollwakeup(&stp->sd_pollist, pollwakeups);
7703                         mutex_enter(&stp->sd_lock);
7704                 }
7705 no_pollwake:
7706 
7707                 if (stp->sd_sigflags & signals)
7708                         strsendsig(stp->sd_siglist, signals, bp->b_band, 0);
7709         }
7710         mutex_exit(&stp->sd_lock);
7711 
7712         rvp->r_val1 = more;
7713         return (error);
7714 #undef  _LASTMARK
7715 }
7716 
7717 /*
7718  * Put a message downstream.
7719  *
7720  * NOTE: strputmsg and kstrputmsg have much of the logic in common.
7721  */
7722 int
7723 strputmsg(
7724         struct vnode *vp,
7725         struct strbuf *mctl,
7726         struct strbuf *mdata,
7727         unsigned char pri,
7728         int flag,
7729         int fmode)
7730 {
7731         struct stdata *stp;
7732         queue_t *wqp;
7733         mblk_t *mp;
7734         ssize_t msgsize;
7735         ssize_t rmin, rmax;
7736         int error;
7737         struct uio uios;
7738         struct uio *uiop = &uios;
7739         struct iovec iovs;
7740         int xpg4 = 0;
7741 
7742         ASSERT(vp->v_stream);
7743         stp = vp->v_stream;
7744         wqp = stp->sd_wrq;
7745 
7746         /*
7747          * If it is an XPG4 application, we need to send
7748          * SIGPIPE below
7749          */
7750 
7751         xpg4 = (flag & MSG_XPG4) ? 1 : 0;
7752         flag &= ~MSG_XPG4;
7753 
7754         if (AU_AUDITING())
7755                 audit_strputmsg(vp, mctl, mdata, pri, flag, fmode);
7756 
7757         mutex_enter(&stp->sd_lock);
7758 
7759         if ((error = i_straccess(stp, JCWRITE)) != 0) {
7760                 mutex_exit(&stp->sd_lock);
7761                 return (error);
7762         }
7763 
7764         if (stp->sd_flag & (STWRERR|STRHUP|STPLEX)) {
7765                 error = strwriteable(stp, B_FALSE, xpg4);
7766                 if (error != 0) {
7767                         mutex_exit(&stp->sd_lock);
7768                         return (error);
7769                 }
7770         }
7771 
7772         mutex_exit(&stp->sd_lock);
7773 
7774         /*
7775          * Check for legal flag value.
7776          */
7777         switch (flag) {
7778         case MSG_HIPRI:
7779                 if ((mctl->len < 0) || (pri != 0))
7780                         return (EINVAL);
7781                 break;
7782         case MSG_BAND:
7783                 break;
7784 
7785         default:
7786                 return (EINVAL);
7787         }
7788 
7789         TRACE_1(TR_FAC_STREAMS_FR, TR_STRPUTMSG_IN,
7790             "strputmsg in:stp %p", stp);
7791 
7792         /* get these values from those cached in the stream head */
7793         rmin = stp->sd_qn_minpsz;
7794         rmax = stp->sd_qn_maxpsz;
7795 
7796         /*
7797          * Make sure ctl and data sizes together fall within the
7798          * limits of the max and min receive packet sizes and do
7799          * not exceed system limit.
7800          */
7801         ASSERT((rmax >= 0) || (rmax == INFPSZ));
7802         if (rmax == 0) {
7803                 return (ERANGE);
7804         }
7805         /*
7806          * Use the MAXIMUM of sd_maxblk and q_maxpsz.
7807          * Needed to prevent partial failures in the strmakedata loop.
7808          */
7809         if (stp->sd_maxblk != INFPSZ && rmax != INFPSZ && rmax < stp->sd_maxblk)
7810                 rmax = stp->sd_maxblk;
7811 
7812         if ((msgsize = mdata->len) < 0) {
7813                 msgsize = 0;
7814                 rmin = 0;       /* no range check for NULL data part */
7815         }
7816         if ((msgsize < rmin) ||
7817             ((msgsize > rmax) && (rmax != INFPSZ)) ||
7818             (mctl->len > strctlsz)) {
7819                 return (ERANGE);
7820         }
7821 
7822         /*
7823          * Setup uio and iov for data part
7824          */
7825         iovs.iov_base = mdata->buf;
7826         iovs.iov_len = msgsize;
7827         uios.uio_iov = &iovs;
7828         uios.uio_iovcnt = 1;
7829         uios.uio_loffset = 0;
7830         uios.uio_segflg = UIO_USERSPACE;
7831         uios.uio_fmode = fmode;
7832         uios.uio_extflg = UIO_COPY_DEFAULT;
7833         uios.uio_resid = msgsize;
7834         uios.uio_offset = 0;
7835 
7836         /* Ignore flow control in strput for HIPRI */
7837         if (flag & MSG_HIPRI)
7838                 flag |= MSG_IGNFLOW;
7839 
7840         for (;;) {
7841                 int done = 0;
7842 
7843                 /*
7844                  * strput will always free the ctl mblk - even when strput
7845                  * fails.
7846                  */
7847                 if ((error = strmakectl(mctl, flag, fmode, &mp)) != 0) {
7848                         TRACE_3(TR_FAC_STREAMS_FR, TR_STRPUTMSG_OUT,
7849                             "strputmsg out:stp %p out %d error %d",
7850                             stp, 1, error);
7851                         return (error);
7852                 }
7853                 /*
7854                  * Verify that the whole message can be transferred by
7855                  * strput.
7856                  */
7857                 ASSERT(stp->sd_maxblk == INFPSZ ||
7858                     stp->sd_maxblk >= mdata->len);
7859 
7860                 msgsize = mdata->len;
7861                 error = strput(stp, mp, uiop, &msgsize, 0, pri, flag);
7862                 mdata->len = msgsize;
7863 
7864                 if (error == 0)
7865                         break;
7866 
7867                 if (error != EWOULDBLOCK)
7868                         goto out;
7869 
7870                 mutex_enter(&stp->sd_lock);
7871                 /*
7872                  * Check for a missed wakeup.
7873                  * Needed since strput did not hold sd_lock across
7874                  * the canputnext.
7875                  */
7876                 if (bcanputnext(wqp, pri)) {
7877                         /* Try again */
7878                         mutex_exit(&stp->sd_lock);
7879                         continue;
7880                 }
7881                 TRACE_2(TR_FAC_STREAMS_FR, TR_STRPUTMSG_WAIT,
7882                     "strputmsg wait:stp %p waits pri %d", stp, pri);
7883                 if (((error = strwaitq(stp, WRITEWAIT, (ssize_t)0, fmode, -1,
7884                     &done)) != 0) || done) {
7885                         mutex_exit(&stp->sd_lock);
7886                         TRACE_3(TR_FAC_STREAMS_FR, TR_STRPUTMSG_OUT,
7887                             "strputmsg out:q %p out %d error %d",
7888                             stp, 0, error);
7889                         return (error);
7890                 }
7891                 TRACE_1(TR_FAC_STREAMS_FR, TR_STRPUTMSG_WAKE,
7892                     "strputmsg wake:stp %p wakes", stp);
7893                 if ((error = i_straccess(stp, JCWRITE)) != 0) {
7894                         mutex_exit(&stp->sd_lock);
7895                         return (error);
7896                 }
7897                 mutex_exit(&stp->sd_lock);
7898         }
7899 out:
7900         /*
7901          * For historic reasons, applications expect EAGAIN
7902          * when data mblk could not be allocated. so change
7903          * ENOMEM back to EAGAIN
7904          */
7905         if (error == ENOMEM)
7906                 error = EAGAIN;
7907         TRACE_3(TR_FAC_STREAMS_FR, TR_STRPUTMSG_OUT,
7908             "strputmsg out:stp %p out %d error %d", stp, 2, error);
7909         return (error);
7910 }
7911 
7912 /*
7913  * Put a message downstream.
7914  * Can send only an M_PROTO/M_PCPROTO by passing in a NULL uiop.
7915  * The fmode flag (NDELAY, NONBLOCK) is the or of the flags in the uio
7916  * and the fmode parameter.
7917  *
7918  * This routine handles the consolidation private flags:
7919  *      MSG_IGNERROR    Ignore any stream head error except STPLEX.
7920  *      MSG_HOLDSIG     Hold signals while waiting for data.
7921  *      MSG_IGNFLOW     Don't check streams flow control.
7922  *
7923  * NOTE: strputmsg and kstrputmsg have much of the logic in common.
7924  */
7925 int
7926 kstrputmsg(
7927         struct vnode *vp,
7928         mblk_t *mctl,
7929         struct uio *uiop,
7930         ssize_t msgsize,
7931         unsigned char pri,
7932         int flag,
7933         int fmode)
7934 {
7935         struct stdata *stp;
7936         queue_t *wqp;
7937         ssize_t rmin, rmax;
7938         int error;
7939 
7940         ASSERT(vp->v_stream);
7941         stp = vp->v_stream;
7942         wqp = stp->sd_wrq;
7943         if (AU_AUDITING())
7944                 audit_strputmsg(vp, NULL, NULL, pri, flag, fmode);
7945         if (mctl == NULL)
7946                 return (EINVAL);
7947 
7948         mutex_enter(&stp->sd_lock);
7949 
7950         if ((error = i_straccess(stp, JCWRITE)) != 0) {
7951                 mutex_exit(&stp->sd_lock);
7952                 freemsg(mctl);
7953                 return (error);
7954         }
7955 
7956         if ((stp->sd_flag & STPLEX) || !(flag & MSG_IGNERROR)) {
7957                 if (stp->sd_flag & (STWRERR|STRHUP|STPLEX)) {
7958                         error = strwriteable(stp, B_FALSE, B_TRUE);
7959                         if (error != 0) {
7960                                 mutex_exit(&stp->sd_lock);
7961                                 freemsg(mctl);
7962                                 return (error);
7963                         }
7964                 }
7965         }
7966 
7967         mutex_exit(&stp->sd_lock);
7968 
7969         /*
7970          * Check for legal flag value.
7971          */
7972         switch (flag & (MSG_HIPRI|MSG_BAND|MSG_ANY)) {
7973         case MSG_HIPRI:
7974                 if (pri != 0) {
7975                         freemsg(mctl);
7976                         return (EINVAL);
7977                 }
7978                 break;
7979         case MSG_BAND:
7980                 break;
7981         default:
7982                 freemsg(mctl);
7983                 return (EINVAL);
7984         }
7985 
7986         TRACE_1(TR_FAC_STREAMS_FR, TR_KSTRPUTMSG_IN,
7987             "kstrputmsg in:stp %p", stp);
7988 
7989         /* get these values from those cached in the stream head */
7990         rmin = stp->sd_qn_minpsz;
7991         rmax = stp->sd_qn_maxpsz;
7992 
7993         /*
7994          * Make sure ctl and data sizes together fall within the
7995          * limits of the max and min receive packet sizes and do
7996          * not exceed system limit.
7997          */
7998         ASSERT((rmax >= 0) || (rmax == INFPSZ));
7999         if (rmax == 0) {
8000                 freemsg(mctl);
8001                 return (ERANGE);
8002         }
8003         /*
8004          * Use the MAXIMUM of sd_maxblk and q_maxpsz.
8005          * Needed to prevent partial failures in the strmakedata loop.
8006          */
8007         if (stp->sd_maxblk != INFPSZ && rmax != INFPSZ && rmax < stp->sd_maxblk)
8008                 rmax = stp->sd_maxblk;
8009 
8010         if (uiop == NULL) {
8011                 msgsize = -1;
8012                 rmin = -1;      /* no range check for NULL data part */
8013         } else {
8014                 /* Use uio flags as well as the fmode parameter flags */
8015                 fmode |= uiop->uio_fmode;
8016 
8017                 if ((msgsize < rmin) ||
8018                     ((msgsize > rmax) && (rmax != INFPSZ))) {
8019                         freemsg(mctl);
8020                         return (ERANGE);
8021                 }
8022         }
8023 
8024         /* Ignore flow control in strput for HIPRI */
8025         if (flag & MSG_HIPRI)
8026                 flag |= MSG_IGNFLOW;
8027 
8028         for (;;) {
8029                 int done = 0;
8030                 int waitflag;
8031                 mblk_t *mp;
8032 
8033                 /*
8034                  * strput will always free the ctl mblk - even when strput
8035                  * fails. If MSG_IGNFLOW is set then any error returned
8036                  * will cause us to break the loop, so we don't need a copy
8037                  * of the message. If MSG_IGNFLOW is not set, then we can
8038                  * get hit by flow control and be forced to try again. In
8039                  * this case we need to have a copy of the message. We
8040                  * do this using copymsg since the message may get modified
8041                  * by something below us.
8042                  *
8043                  * We've observed that many TPI providers do not check db_ref
8044                  * on the control messages but blindly reuse them for the
8045                  * T_OK_ACK/T_ERROR_ACK. Thus using copymsg is more
8046                  * friendly to such providers than using dupmsg. Also, note
8047                  * that sockfs uses MSG_IGNFLOW for all TPI control messages.
8048                  * Only data messages are subject to flow control, hence
8049                  * subject to this copymsg.
8050                  */
8051                 if (flag & MSG_IGNFLOW) {
8052                         mp = mctl;
8053                         mctl = NULL;
8054                 } else {
8055                         do {
8056                                 /*
8057                                  * If a message has a free pointer, the message
8058                                  * must be dupmsg to maintain this pointer.
8059                                  * Code using this facility must be sure
8060                                  * that modules below will not change the
8061                                  * contents of the dblk without checking db_ref
8062                                  * first. If db_ref is > 1, then the module
8063                                  * needs to do a copymsg first. Otherwise,
8064                                  * the contents of the dblk may become
8065                                  * inconsistent because the freesmg/freeb below
8066                                  * may end up calling atomic_add_32_nv.
8067                                  * The atomic_add_32_nv in freeb (accessing
8068                                  * all of db_ref, db_type, db_flags, and
8069                                  * db_struioflag) does not prevent other threads
8070                                  * from concurrently trying to modify e.g.
8071                                  * db_type.
8072                                  */
8073                                 if (mctl->b_datap->db_frtnp != NULL)
8074                                         mp = dupmsg(mctl);
8075                                 else
8076                                         mp = copymsg(mctl);
8077 
8078                                 if (mp != NULL)
8079                                         break;
8080 
8081                                 error = strwaitbuf(msgdsize(mctl), BPRI_MED);
8082                                 if (error) {
8083                                         freemsg(mctl);
8084                                         return (error);
8085                                 }
8086                         } while (mp == NULL);
8087                 }
8088                 /*
8089                  * Verify that all of msgsize can be transferred by
8090                  * strput.
8091                  */
8092                 ASSERT(stp->sd_maxblk == INFPSZ || stp->sd_maxblk >= msgsize);
8093                 error = strput(stp, mp, uiop, &msgsize, 0, pri, flag);
8094                 if (error == 0)
8095                         break;
8096 
8097                 if (error != EWOULDBLOCK)
8098                         goto out;
8099 
8100                 /*
8101                  * IF MSG_IGNFLOW is set we should have broken out of loop
8102                  * above.
8103                  */
8104                 ASSERT(!(flag & MSG_IGNFLOW));
8105                 mutex_enter(&stp->sd_lock);
8106                 /*
8107                  * Check for a missed wakeup.
8108                  * Needed since strput did not hold sd_lock across
8109                  * the canputnext.
8110                  */
8111                 if (bcanputnext(wqp, pri)) {
8112                         /* Try again */
8113                         mutex_exit(&stp->sd_lock);
8114                         continue;
8115                 }
8116                 TRACE_2(TR_FAC_STREAMS_FR, TR_KSTRPUTMSG_WAIT,
8117                     "kstrputmsg wait:stp %p waits pri %d", stp, pri);
8118 
8119                 waitflag = WRITEWAIT;
8120                 if (flag & (MSG_HOLDSIG|MSG_IGNERROR)) {
8121                         if (flag & MSG_HOLDSIG)
8122                                 waitflag |= STR_NOSIG;
8123                         if (flag & MSG_IGNERROR)
8124                                 waitflag |= STR_NOERROR;
8125                 }
8126                 if (((error = strwaitq(stp, waitflag,
8127                     (ssize_t)0, fmode, -1, &done)) != 0) || done) {
8128                         mutex_exit(&stp->sd_lock);
8129                         TRACE_3(TR_FAC_STREAMS_FR, TR_KSTRPUTMSG_OUT,
8130                             "kstrputmsg out:stp %p out %d error %d",
8131                             stp, 0, error);
8132                         freemsg(mctl);
8133                         return (error);
8134                 }
8135                 TRACE_1(TR_FAC_STREAMS_FR, TR_KSTRPUTMSG_WAKE,
8136                     "kstrputmsg wake:stp %p wakes", stp);
8137                 if ((error = i_straccess(stp, JCWRITE)) != 0) {
8138                         mutex_exit(&stp->sd_lock);
8139                         freemsg(mctl);
8140                         return (error);
8141                 }
8142                 mutex_exit(&stp->sd_lock);
8143         }
8144 out:
8145         freemsg(mctl);
8146         /*
8147          * For historic reasons, applications expect EAGAIN
8148          * when data mblk could not be allocated. so change
8149          * ENOMEM back to EAGAIN
8150          */
8151         if (error == ENOMEM)
8152                 error = EAGAIN;
8153         TRACE_3(TR_FAC_STREAMS_FR, TR_KSTRPUTMSG_OUT,
8154             "kstrputmsg out:stp %p out %d error %d", stp, 2, error);
8155         return (error);
8156 }
8157 
8158 /*
8159  * Determines whether the necessary conditions are set on a stream
8160  * for it to be readable, writeable, or have exceptions.
8161  *
8162  * strpoll handles the consolidation private events:
8163  *      POLLNOERR       Do not return POLLERR even if there are stream
8164  *                      head errors.
8165  *                      Used by sockfs.
8166  *      POLLRDDATA      Do not return POLLIN unless at least one message on
8167  *                      the queue contains one or more M_DATA mblks. Thus
8168  *                      when this flag is set a queue with only
8169  *                      M_PROTO/M_PCPROTO mblks does not return POLLIN.
8170  *                      Used by sockfs to ignore T_EXDATA_IND messages.
8171  *
8172  * Note: POLLRDDATA assumes that synch streams only return messages with
8173  * an M_DATA attached (i.e. not messages consisting of only
8174  * an M_PROTO/M_PCPROTO part).
8175  */
8176 int
8177 strpoll(
8178         struct stdata *stp,
8179         short events_arg,
8180         int anyyet,
8181         short *reventsp,
8182         struct pollhead **phpp)
8183 {
8184         int events = (ushort_t)events_arg;
8185         int retevents = 0;
8186         mblk_t *mp;
8187         qband_t *qbp;
8188         long sd_flags = stp->sd_flag;
8189         int headlocked = 0;
8190 
8191         /*
8192          * For performance, a single 'if' tests for most possible edge
8193          * conditions in one shot
8194          */
8195         if (sd_flags & (STPLEX | STRDERR | STWRERR)) {
8196                 if (sd_flags & STPLEX) {
8197                         *reventsp = POLLNVAL;
8198                         return (EINVAL);
8199                 }
8200                 if (((events & (POLLIN | POLLRDNORM | POLLRDBAND | POLLPRI)) &&
8201                     (sd_flags & STRDERR)) ||
8202                     ((events & (POLLOUT | POLLWRNORM | POLLWRBAND)) &&
8203                     (sd_flags & STWRERR))) {
8204                         if (!(events & POLLNOERR)) {
8205                                 *reventsp = POLLERR;
8206                                 return (0);
8207                         }
8208                 }
8209         }
8210         if (sd_flags & STRHUP) {
8211                 retevents |= POLLHUP;
8212         } else if (events & (POLLWRNORM | POLLWRBAND)) {
8213                 queue_t *tq;
8214                 queue_t *qp = stp->sd_wrq;
8215 
8216                 claimstr(qp);
8217                 /* Find next module forward that has a service procedure */
8218                 tq = qp->q_next->q_nfsrv;
8219                 ASSERT(tq != NULL);
8220 
8221                 polllock(&stp->sd_pollist, QLOCK(tq));
8222                 if (events & POLLWRNORM) {
8223                         queue_t *sqp;
8224 
8225                         if (tq->q_flag & QFULL)
8226                                 /* ensure backq svc procedure runs */
8227                                 tq->q_flag |= QWANTW;
8228                         else if ((sqp = stp->sd_struiowrq) != NULL) {
8229                                 /* Check sync stream barrier write q */
8230                                 mutex_exit(QLOCK(tq));
8231                                 polllock(&stp->sd_pollist, QLOCK(sqp));
8232                                 if (sqp->q_flag & QFULL)
8233                                         /* ensure pollwakeup() is done */
8234                                         sqp->q_flag |= QWANTWSYNC;
8235                                 else
8236                                         retevents |= POLLOUT;
8237                                 /* More write events to process ??? */
8238                                 if (! (events & POLLWRBAND)) {
8239                                         mutex_exit(QLOCK(sqp));
8240                                         releasestr(qp);
8241                                         goto chkrd;
8242                                 }
8243                                 mutex_exit(QLOCK(sqp));
8244                                 polllock(&stp->sd_pollist, QLOCK(tq));
8245                         } else
8246                                 retevents |= POLLOUT;
8247                 }
8248                 if (events & POLLWRBAND) {
8249                         qbp = tq->q_bandp;
8250                         if (qbp) {
8251                                 while (qbp) {
8252                                         if (qbp->qb_flag & QB_FULL)
8253                                                 qbp->qb_flag |= QB_WANTW;
8254                                         else
8255                                                 retevents |= POLLWRBAND;
8256                                         qbp = qbp->qb_next;
8257                                 }
8258                         } else {
8259                                 retevents |= POLLWRBAND;
8260                         }
8261                 }
8262                 mutex_exit(QLOCK(tq));
8263                 releasestr(qp);
8264         }
8265 chkrd:
8266         if (sd_flags & STRPRI) {
8267                 retevents |= (events & POLLPRI);
8268         } else if (events & (POLLRDNORM | POLLRDBAND | POLLIN)) {
8269                 queue_t *qp = _RD(stp->sd_wrq);
8270                 int normevents = (events & (POLLIN | POLLRDNORM));
8271 
8272                 /*
8273                  * Note: Need to do polllock() here since ps_lock may be
8274                  * held. See bug 4191544.
8275                  */
8276                 polllock(&stp->sd_pollist, &stp->sd_lock);
8277                 headlocked = 1;
8278                 mp = qp->q_first;
8279                 while (mp) {
8280                         /*
8281                          * For POLLRDDATA we scan b_cont and b_next until we
8282                          * find an M_DATA.
8283                          */
8284                         if ((events & POLLRDDATA) &&
8285                             mp->b_datap->db_type != M_DATA) {
8286                                 mblk_t *nmp = mp->b_cont;
8287 
8288                                 while (nmp != NULL &&
8289                                     nmp->b_datap->db_type != M_DATA)
8290                                         nmp = nmp->b_cont;
8291                                 if (nmp == NULL) {
8292                                         mp = mp->b_next;
8293                                         continue;
8294                                 }
8295                         }
8296                         if (mp->b_band == 0)
8297                                 retevents |= normevents;
8298                         else
8299                                 retevents |= (events & (POLLIN | POLLRDBAND));
8300                         break;
8301                 }
8302                 if (! (retevents & normevents) &&
8303                     (stp->sd_wakeq & RSLEEP)) {
8304                         /*
8305                          * Sync stream barrier read queue has data.
8306                          */
8307                         retevents |= normevents;
8308                 }
8309                 /* Treat eof as normal data */
8310                 if (sd_flags & STREOF)
8311                         retevents |= normevents;
8312         }
8313 
8314         *reventsp = (short)retevents;
8315         if (retevents) {
8316                 if (headlocked)
8317                         mutex_exit(&stp->sd_lock);
8318                 return (0);
8319         }
8320 
8321         /*
8322          * If poll() has not found any events yet, set up event cell
8323          * to wake up the poll if a requested event occurs on this
8324          * stream.  Check for collisions with outstanding poll requests.
8325          */
8326         if (!anyyet) {
8327                 *phpp = &stp->sd_pollist;
8328                 if (headlocked == 0) {
8329                         polllock(&stp->sd_pollist, &stp->sd_lock);
8330                         headlocked = 1;
8331                 }
8332                 stp->sd_rput_opt |= SR_POLLIN;
8333         }
8334         if (headlocked)
8335                 mutex_exit(&stp->sd_lock);
8336         return (0);
8337 }
8338 
8339 /*
8340  * The purpose of putback() is to assure sleeping polls/reads
8341  * are awakened when there are no new messages arriving at the,
8342  * stream head, and a message is placed back on the read queue.
8343  *
8344  * sd_lock must be held when messages are placed back on stream
8345  * head.  (getq() holds sd_lock when it removes messages from
8346  * the queue)
8347  */
8348 
8349 static void
8350 putback(struct stdata *stp, queue_t *q, mblk_t *bp, int band)
8351 {
8352         mblk_t  *qfirst;
8353         ASSERT(MUTEX_HELD(&stp->sd_lock));
8354 
8355         /*
8356          * As a result of lock-step ordering around q_lock and sd_lock,
8357          * it's possible for function calls like putnext() and
8358          * canputnext() to get an inaccurate picture of how much
8359          * data is really being processed at the stream head.
8360          * We only consolidate with existing messages on the queue
8361          * if the length of the message we want to put back is smaller
8362          * than the queue hiwater mark.
8363          */
8364         if ((stp->sd_rput_opt & SR_CONSOL_DATA) &&
8365             (DB_TYPE(bp) == M_DATA) && ((qfirst = q->q_first) != NULL) &&
8366             (DB_TYPE(qfirst) == M_DATA) &&
8367             ((qfirst->b_flag & (MSGMARK|MSGDELIM)) == 0) &&
8368             ((bp->b_flag & (MSGMARK|MSGDELIM|MSGMARKNEXT)) == 0) &&
8369             (mp_cont_len(bp, NULL) < q->q_hiwat)) {
8370                 /*
8371                  * We use the same logic as defined in strrput()
8372                  * but in reverse as we are putting back onto the
8373                  * queue and want to retain byte ordering.
8374                  * Consolidate M_DATA messages with M_DATA ONLY.
8375                  * strrput() allows the consolidation of M_DATA onto
8376                  * M_PROTO | M_PCPROTO but not the other way round.
8377                  *
8378                  * The consolidation does not take place if the message
8379                  * we are returning to the queue is marked with either
8380                  * of the marks or the delim flag or if q_first
8381                  * is marked with MSGMARK. The MSGMARK check is needed to
8382                  * handle the odd semantics of MSGMARK where essentially
8383                  * the whole message is to be treated as marked.
8384                  * Carry any MSGMARKNEXT and MSGNOTMARKNEXT from q_first
8385                  * to the front of the b_cont chain.
8386                  */
8387                 rmvq_noenab(q, qfirst);
8388 
8389                 /*
8390                  * The first message in the b_cont list
8391                  * tracks MSGMARKNEXT and MSGNOTMARKNEXT.
8392                  * We need to handle the case where we
8393                  * are appending:
8394                  *
8395                  * 1) a MSGMARKNEXT to a MSGNOTMARKNEXT.
8396                  * 2) a MSGMARKNEXT to a plain message.
8397                  * 3) a MSGNOTMARKNEXT to a plain message
8398                  * 4) a MSGNOTMARKNEXT to a MSGNOTMARKNEXT
8399                  *    message.
8400                  *
8401                  * Thus we never append a MSGMARKNEXT or
8402                  * MSGNOTMARKNEXT to a MSGMARKNEXT message.
8403                  */
8404                 if (qfirst->b_flag & MSGMARKNEXT) {
8405                         bp->b_flag |= MSGMARKNEXT;
8406                         bp->b_flag &= ~MSGNOTMARKNEXT;
8407                         qfirst->b_flag &= ~MSGMARKNEXT;
8408                 } else if (qfirst->b_flag & MSGNOTMARKNEXT) {
8409                         bp->b_flag |= MSGNOTMARKNEXT;
8410                         qfirst->b_flag &= ~MSGNOTMARKNEXT;
8411                 }
8412 
8413                 linkb(bp, qfirst);
8414         }
8415         (void) putbq(q, bp);
8416 
8417         /*
8418          * A message may have come in when the sd_lock was dropped in the
8419          * calling routine. If this is the case and STR*ATMARK info was
8420          * received, need to move that from the stream head to the q_last
8421          * so that SIOCATMARK can return the proper value.
8422          */
8423         if (stp->sd_flag & (STRATMARK | STRNOTATMARK)) {
8424                 unsigned short *flagp = &q->q_last->b_flag;
8425                 uint_t b_flag = (uint_t)*flagp;
8426 
8427                 if (stp->sd_flag & STRATMARK) {
8428                         b_flag &= ~MSGNOTMARKNEXT;
8429                         b_flag |= MSGMARKNEXT;
8430                         stp->sd_flag &= ~STRATMARK;
8431                 } else {
8432                         b_flag &= ~MSGMARKNEXT;
8433                         b_flag |= MSGNOTMARKNEXT;
8434                         stp->sd_flag &= ~STRNOTATMARK;
8435                 }
8436                 *flagp = (unsigned short) b_flag;
8437         }
8438 
8439 #ifdef  DEBUG
8440         /*
8441          * Make sure that the flags are not messed up.
8442          */
8443         {
8444                 mblk_t *mp;
8445                 mp = q->q_last;
8446                 while (mp != NULL) {
8447                         ASSERT((mp->b_flag & (MSGMARKNEXT|MSGNOTMARKNEXT)) !=
8448                             (MSGMARKNEXT|MSGNOTMARKNEXT));
8449                         mp = mp->b_cont;
8450                 }
8451         }
8452 #endif
8453         if (q->q_first == bp) {
8454                 short pollevents;
8455 
8456                 if (stp->sd_flag & RSLEEP) {
8457                         stp->sd_flag &= ~RSLEEP;
8458                         cv_broadcast(&q->q_wait);
8459                 }
8460                 if (stp->sd_flag & STRPRI) {
8461                         pollevents = POLLPRI;
8462                 } else {
8463                         if (band == 0) {
8464                                 if (!(stp->sd_rput_opt & SR_POLLIN))
8465                                         return;
8466                                 stp->sd_rput_opt &= ~SR_POLLIN;
8467                                 pollevents = POLLIN | POLLRDNORM;
8468                         } else {
8469                                 pollevents = POLLIN | POLLRDBAND;
8470                         }
8471                 }
8472                 mutex_exit(&stp->sd_lock);
8473                 pollwakeup(&stp->sd_pollist, pollevents);
8474                 mutex_enter(&stp->sd_lock);
8475         }
8476 }
8477 
8478 /*
8479  * Return the held vnode attached to the stream head of a
8480  * given queue
8481  * It is the responsibility of the calling routine to ensure
8482  * that the queue does not go away (e.g. pop).
8483  */
8484 vnode_t *
8485 strq2vp(queue_t *qp)
8486 {
8487         vnode_t *vp;
8488         vp = STREAM(qp)->sd_vnode;
8489         ASSERT(vp != NULL);
8490         VN_HOLD(vp);
8491         return (vp);
8492 }
8493 
8494 /*
8495  * return the stream head write queue for the given vp
8496  * It is the responsibility of the calling routine to ensure
8497  * that the stream or vnode do not close.
8498  */
8499 queue_t *
8500 strvp2wq(vnode_t *vp)
8501 {
8502         ASSERT(vp->v_stream != NULL);
8503         return (vp->v_stream->sd_wrq);
8504 }
8505 
8506 /*
8507  * pollwakeup stream head
8508  * It is the responsibility of the calling routine to ensure
8509  * that the stream or vnode do not close.
8510  */
8511 void
8512 strpollwakeup(vnode_t *vp, short event)
8513 {
8514         ASSERT(vp->v_stream);
8515         pollwakeup(&vp->v_stream->sd_pollist, event);
8516 }
8517 
8518 /*
8519  * Mate the stream heads of two vnodes together. If the two vnodes are the
8520  * same, we just make the write-side point at the read-side -- otherwise,
8521  * we do a full mate.  Only works on vnodes associated with streams that are
8522  * still being built and thus have only a stream head.
8523  */
8524 void
8525 strmate(vnode_t *vp1, vnode_t *vp2)
8526 {
8527         queue_t *wrq1 = strvp2wq(vp1);
8528         queue_t *wrq2 = strvp2wq(vp2);
8529 
8530         /*
8531          * Verify that there are no modules on the stream yet.  We also
8532          * rely on the stream head always having a service procedure to
8533          * avoid tweaking q_nfsrv.
8534          */
8535         ASSERT(wrq1->q_next == NULL && wrq2->q_next == NULL);
8536         ASSERT(wrq1->q_qinfo->qi_srvp != NULL);
8537         ASSERT(wrq2->q_qinfo->qi_srvp != NULL);
8538 
8539         /*
8540          * If the queues are the same, just twist; otherwise do a full mate.
8541          */
8542         if (wrq1 == wrq2) {
8543                 wrq1->q_next = _RD(wrq1);
8544         } else {
8545                 wrq1->q_next = _RD(wrq2);
8546                 wrq2->q_next = _RD(wrq1);
8547                 STREAM(wrq1)->sd_mate = STREAM(wrq2);
8548                 STREAM(wrq1)->sd_flag |= STRMATE;
8549                 STREAM(wrq2)->sd_mate = STREAM(wrq1);
8550                 STREAM(wrq2)->sd_flag |= STRMATE;
8551         }
8552 }
8553 
8554 /*
8555  * XXX will go away when console is correctly fixed.
8556  * Clean up the console PIDS, from previous I_SETSIG,
8557  * called only for cnopen which never calls strclean().
8558  */
8559 void
8560 str_cn_clean(struct vnode *vp)
8561 {
8562         strsig_t *ssp, *pssp, *tssp;
8563         struct stdata *stp;
8564         struct pid  *pidp;
8565         int update = 0;
8566 
8567         ASSERT(vp->v_stream);
8568         stp = vp->v_stream;
8569         pssp = NULL;
8570         mutex_enter(&stp->sd_lock);
8571         ssp = stp->sd_siglist;
8572         while (ssp) {
8573                 mutex_enter(&pidlock);
8574                 pidp = ssp->ss_pidp;
8575                 /*
8576                  * Get rid of PID if the proc is gone.
8577                  */
8578                 if (pidp->pid_prinactive) {
8579                         tssp = ssp->ss_next;
8580                         if (pssp)
8581                                 pssp->ss_next = tssp;
8582                         else
8583                                 stp->sd_siglist = tssp;
8584                         ASSERT(pidp->pid_ref <= 1);
8585                         PID_RELE(ssp->ss_pidp);
8586                         mutex_exit(&pidlock);
8587                         kmem_free(ssp, sizeof (strsig_t));
8588                         update = 1;
8589                         ssp = tssp;
8590                         continue;
8591                 } else
8592                         mutex_exit(&pidlock);
8593                 pssp = ssp;
8594                 ssp = ssp->ss_next;
8595         }
8596         if (update) {
8597                 stp->sd_sigflags = 0;
8598                 for (ssp = stp->sd_siglist; ssp; ssp = ssp->ss_next)
8599                         stp->sd_sigflags |= ssp->ss_events;
8600         }
8601         mutex_exit(&stp->sd_lock);
8602 }
8603 
8604 /*
8605  * Return B_TRUE if there is data in the message, B_FALSE otherwise.
8606  */
8607 static boolean_t
8608 msghasdata(mblk_t *bp)
8609 {
8610         for (; bp; bp = bp->b_cont)
8611                 if (bp->b_datap->db_type == M_DATA) {
8612                         ASSERT(bp->b_wptr >= bp->b_rptr);
8613                         if (bp->b_wptr > bp->b_rptr)
8614                                 return (B_TRUE);
8615                 }
8616         return (B_FALSE);
8617 }