1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
24  * Use is subject to license terms.
25  */
26 
27 #include <sys/types.h>
28 #include <sys/param.h>
29 #include <sys/signal.h>
30 #include <sys/cmn_err.h>
31 
32 #include <sys/stropts.h>
33 #include <sys/socket.h>
34 #include <sys/socketvar.h>
35 #include <sys/sockio.h>
36 #include <sys/strsubr.h>
37 #include <sys/strsun.h>
38 #include <sys/atomic.h>
39 #include <sys/tihdr.h>
40 
41 #include <fs/sockfs/sockcommon.h>
42 #include <fs/sockfs/socktpi.h>
43 #include <fs/sockfs/sodirect.h>
44 #include <sys/ddi.h>
45 #include <inet/ip.h>
46 #include <sys/time.h>
47 #include <sys/cmn_err.h>
48 
49 #ifdef SOCK_TEST
50 extern int do_useracc;
51 extern clock_t sock_test_timelimit;
52 #endif /* SOCK_TEST */
53 
54 #define	MBLK_PULL_LEN 64
55 uint32_t so_mblk_pull_len = MBLK_PULL_LEN;
56 
57 #ifdef DEBUG
58 boolean_t so_debug_length = B_FALSE;
59 static boolean_t so_check_length(sonode_t *so);
60 #endif
61 
62 int
63 so_acceptq_enqueue_locked(struct sonode *so, struct sonode *nso)
64 {
65 	ASSERT(MUTEX_HELD(&so->so_acceptq_lock));
66 	ASSERT(nso->so_acceptq_next == NULL);
67 
68 	*so->so_acceptq_tail = nso;
69 	so->so_acceptq_tail = &nso->so_acceptq_next;
70 	so->so_acceptq_len++;
71 
72 	/* Wakeup a single consumer */
73 	cv_signal(&so->so_acceptq_cv);
74 
75 	return (so->so_acceptq_len);
76 }
77 
78 /*
79  * int so_acceptq_enqueue(struct sonode *so, struct sonode *nso)
80  *
81  * Enqueue an incoming connection on a listening socket.
82  *
83  * Arguments:
84  *   so	  - listening socket
85  *   nso  - new connection
86  *
87  * Returns:
88  *   Number of queued connections, including the new connection
89  */
90 int
91 so_acceptq_enqueue(struct sonode *so, struct sonode *nso)
92 {
93 	int conns;
94 
95 	mutex_enter(&so->so_acceptq_lock);
96 	conns = so_acceptq_enqueue_locked(so, nso);
97 	mutex_exit(&so->so_acceptq_lock);
98 
99 	return (conns);
100 }
101 
102 static int
103 so_acceptq_dequeue_locked(struct sonode *so, boolean_t dontblock,
104     struct sonode **nsop)
105 {
106 	struct sonode *nso = NULL;
107 
108 	*nsop = NULL;
109 	ASSERT(MUTEX_HELD(&so->so_acceptq_lock));
110 	while ((nso = so->so_acceptq_head) == NULL) {
111 		/*
112 		 * No need to check so_error here, because it is not
113 		 * possible for a listening socket to be reset or otherwise
114 		 * disconnected.
115 		 *
116 		 * So now we just need check if it's ok to wait.
117 		 */
118 		if (dontblock)
119 			return (EWOULDBLOCK);
120 		if (so->so_state & (SS_CLOSING | SS_FALLBACK_PENDING))
121 			return (EINTR);
122 
123 		if (cv_wait_sig_swap(&so->so_acceptq_cv,
124 		    &so->so_acceptq_lock) == 0)
125 			return (EINTR);
126 	}
127 
128 	ASSERT(nso != NULL);
129 	so->so_acceptq_head = nso->so_acceptq_next;
130 	nso->so_acceptq_next = NULL;
131 
132 	if (so->so_acceptq_head == NULL) {
133 		ASSERT(so->so_acceptq_tail == &nso->so_acceptq_next);
134 		so->so_acceptq_tail = &so->so_acceptq_head;
135 	}
136 	ASSERT(so->so_acceptq_len > 0);
137 	--so->so_acceptq_len;
138 
139 	*nsop = nso;
140 
141 	return (0);
142 }
143 
144 /*
145  * int so_acceptq_dequeue(struct sonode *, boolean_t, struct sonode **)
146  *
147  * Pulls a connection off of the accept queue.
148  *
149  * Arguments:
150  *   so	       - listening socket
151  *   dontblock - indicate whether it's ok to sleep if there are no
152  *		 connections on the queue
153  *   nsop      - Value-return argument
154  *
155  * Return values:
156  *   0 when a connection is successfully dequeued, in which case nsop
157  *   is set to point to the new connection. Upon failure a non-zero
158  *   value is returned, and the value of nsop is set to NULL.
159  *
160  * Note:
161  *   so_acceptq_dequeue() may return prematurly if the socket is falling
162  *   back to TPI.
163  */
164 int
165 so_acceptq_dequeue(struct sonode *so, boolean_t dontblock,
166     struct sonode **nsop)
167 {
168 	int error;
169 
170 	mutex_enter(&so->so_acceptq_lock);
171 	error = so_acceptq_dequeue_locked(so, dontblock, nsop);
172 	mutex_exit(&so->so_acceptq_lock);
173 
174 	return (error);
175 }
176 
177 /*
178  * void so_acceptq_flush(struct sonode *so)
179  *
180  * Removes all pending connections from a listening socket, and
181  * frees the associated resources.
182  *
183  * Arguments
184  *   so	    - listening socket
185  *
186  * Return values:
187  *   None.
188  *
189  * Note:
190  *   The caller has to ensure that no calls to so_acceptq_enqueue() or
191  *   so_acceptq_dequeue() occur while the accept queue is being flushed.
192  *   So either the socket needs to be in a state where no operations
193  *   would come in, or so_lock needs to be obtained.
194  */
195 void
196 so_acceptq_flush(struct sonode *so)
197 {
198 	struct sonode *nso;
199 
200 	nso = so->so_acceptq_head;
201 
202 	while (nso != NULL) {
203 		struct sonode *nnso = NULL;
204 
205 		nnso = nso->so_acceptq_next;
206 		nso->so_acceptq_next = NULL;
207 		/*
208 		 * Since the socket is on the accept queue, there can
209 		 * only be one reference. We drop the reference and
210 		 * just blow off the socket.
211 		 */
212 		ASSERT(nso->so_count == 1);
213 		nso->so_count--;
214 		socket_destroy(nso);
215 		nso = nnso;
216 	}
217 
218 	so->so_acceptq_head = NULL;
219 	so->so_acceptq_tail = &so->so_acceptq_head;
220 	so->so_acceptq_len = 0;
221 }
222 
223 int
224 so_wait_connected_locked(struct sonode *so, boolean_t nonblock,
225     sock_connid_t id)
226 {
227 	ASSERT(MUTEX_HELD(&so->so_lock));
228 
229 	/*
230 	 * The protocol has notified us that a connection attempt is being
231 	 * made, so before we wait for a notification to arrive we must
232 	 * clear out any errors associated with earlier connection attempts.
233 	 */
234 	if (so->so_error != 0 && SOCK_CONNID_LT(so->so_proto_connid, id))
235 		so->so_error = 0;
236 
237 	while (SOCK_CONNID_LT(so->so_proto_connid, id)) {
238 		if (nonblock)
239 			return (EINPROGRESS);
240 
241 		if (so->so_state & (SS_CLOSING | SS_FALLBACK_PENDING))
242 			return (EINTR);
243 
244 		if (cv_wait_sig_swap(&so->so_state_cv, &so->so_lock) == 0)
245 			return (EINTR);
246 	}
247 
248 	if (so->so_error != 0)
249 		return (sogeterr(so, B_TRUE));
250 	/*
251 	 * Under normal circumstances, so_error should contain an error
252 	 * in case the connect failed. However, it is possible for another
253 	 * thread to come in a consume the error, so generate a sensible
254 	 * error in that case.
255 	 */
256 	if ((so->so_state & SS_ISCONNECTED) == 0)
257 		return (ECONNREFUSED);
258 
259 	return (0);
260 }
261 
262 /*
263  * int so_wait_connected(struct sonode *so, boolean_t nonblock,
264  *    sock_connid_t id)
265  *
266  * Wait until the socket is connected or an error has occured.
267  *
268  * Arguments:
269  *   so	      - socket
270  *   nonblock - indicate whether it's ok to sleep if the connection has
271  *		not yet been established
272  *   gen      - generation number that was returned by the protocol
273  *		when the operation was started
274  *
275  * Returns:
276  *   0 if the connection attempt was successful, or an error indicating why
277  *   the connection attempt failed.
278  */
279 int
280 so_wait_connected(struct sonode *so, boolean_t nonblock, sock_connid_t id)
281 {
282 	int error;
283 
284 	mutex_enter(&so->so_lock);
285 	error = so_wait_connected_locked(so, nonblock, id);
286 	mutex_exit(&so->so_lock);
287 
288 	return (error);
289 }
290 
291 int
292 so_snd_wait_qnotfull_locked(struct sonode *so, boolean_t dontblock)
293 {
294 	int error;
295 
296 	ASSERT(MUTEX_HELD(&so->so_lock));
297 	while (so->so_snd_qfull) {
298 		if (so->so_state & SS_CANTSENDMORE)
299 			return (EPIPE);
300 		if (dontblock)
301 			return (EWOULDBLOCK);
302 
303 		if (so->so_state & (SS_CLOSING | SS_FALLBACK_PENDING))
304 			return (EINTR);
305 
306 		if (so->so_sndtimeo == 0) {
307 			/*
308 			 * Zero means disable timeout.
309 			 */
310 			error = cv_wait_sig(&so->so_snd_cv, &so->so_lock);
311 		} else {
312 			clock_t now;
313 
314 			time_to_wait(&now, so->so_sndtimeo);
315 			error = cv_timedwait_sig(&so->so_snd_cv, &so->so_lock,
316 			    now);
317 		}
318 		if (error == 0)
319 			return (EINTR);
320 		else if (error == -1)
321 			return (EAGAIN);
322 	}
323 	return (0);
324 }
325 
326 /*
327  * int so_wait_sendbuf(struct sonode *so, boolean_t dontblock)
328  *
329  * Wait for the transport to notify us about send buffers becoming
330  * available.
331  */
332 int
333 so_snd_wait_qnotfull(struct sonode *so, boolean_t dontblock)
334 {
335 	int error = 0;
336 
337 	mutex_enter(&so->so_lock);
338 	if (so->so_snd_qfull) {
339 		so->so_snd_wakeup = B_TRUE;
340 		error = so_snd_wait_qnotfull_locked(so, dontblock);
341 		so->so_snd_wakeup = B_FALSE;
342 	}
343 	mutex_exit(&so->so_lock);
344 
345 	return (error);
346 }
347 
348 void
349 so_snd_qfull(struct sonode *so)
350 {
351 	mutex_enter(&so->so_lock);
352 	so->so_snd_qfull = B_TRUE;
353 	mutex_exit(&so->so_lock);
354 }
355 
356 void
357 so_snd_qnotfull(struct sonode *so)
358 {
359 	mutex_enter(&so->so_lock);
360 	so->so_snd_qfull = B_FALSE;
361 	/* wake up everyone waiting for buffers */
362 	cv_broadcast(&so->so_snd_cv);
363 	mutex_exit(&so->so_lock);
364 }
365 
366 /*
367  * Change the process/process group to which SIGIO is sent.
368  */
369 int
370 socket_chgpgrp(struct sonode *so, pid_t pid)
371 {
372 	int error;
373 
374 	ASSERT(MUTEX_HELD(&so->so_lock));
375 	if (pid != 0) {
376 		/*
377 		 * Permissions check by sending signal 0.
378 		 * Note that when kill fails it does a
379 		 * set_errno causing the system call to fail.
380 		 */
381 		error = kill(pid, 0);
382 		if (error != 0) {
383 			return (error);
384 		}
385 	}
386 	so->so_pgrp = pid;
387 	return (0);
388 }
389 
390 
391 /*
392  * Generate a SIGIO, for 'writable' events include siginfo structure,
393  * for read events just send the signal.
394  */
395 /*ARGSUSED*/
396 static void
397 socket_sigproc(proc_t *proc, int event)
398 {
399 	k_siginfo_t info;
400 
401 	ASSERT(event & (SOCKETSIG_WRITE | SOCKETSIG_READ | SOCKETSIG_URG));
402 
403 	if (event & SOCKETSIG_WRITE) {
404 		info.si_signo = SIGPOLL;
405 		info.si_code = POLL_OUT;
406 		info.si_errno = 0;
407 		info.si_fd = 0;
408 		info.si_band = 0;
409 		sigaddq(proc, NULL, &info, KM_NOSLEEP);
410 	}
411 	if (event & SOCKETSIG_READ) {
412 		sigtoproc(proc, NULL, SIGPOLL);
413 	}
414 	if (event & SOCKETSIG_URG) {
415 		sigtoproc(proc, NULL, SIGURG);
416 	}
417 }
418 
419 void
420 socket_sendsig(struct sonode *so, int event)
421 {
422 	proc_t *proc;
423 
424 	ASSERT(MUTEX_HELD(&so->so_lock));
425 
426 	if (so->so_pgrp == 0 || (!(so->so_state & SS_ASYNC) &&
427 	    event != SOCKETSIG_URG)) {
428 		return;
429 	}
430 
431 	dprint(3, ("sending sig %d to %d\n", event, so->so_pgrp));
432 
433 	if (so->so_pgrp > 0) {
434 		/*
435 		 * XXX This unfortunately still generates
436 		 * a signal when a fd is closed but
437 		 * the proc is active.
438 		 */
439 		mutex_enter(&pidlock);
440 		proc = prfind(so->so_pgrp);
441 		if (proc == NULL) {
442 			mutex_exit(&pidlock);
443 			return;
444 		}
445 		mutex_enter(&proc->p_lock);
446 		mutex_exit(&pidlock);
447 		socket_sigproc(proc, event);
448 		mutex_exit(&proc->p_lock);
449 	} else {
450 		/*
451 		 * Send to process group. Hold pidlock across
452 		 * calls to socket_sigproc().
453 		 */
454 		pid_t pgrp = -so->so_pgrp;
455 
456 		mutex_enter(&pidlock);
457 		proc = pgfind(pgrp);
458 		while (proc != NULL) {
459 			mutex_enter(&proc->p_lock);
460 			socket_sigproc(proc, event);
461 			mutex_exit(&proc->p_lock);
462 			proc = proc->p_pglink;
463 		}
464 		mutex_exit(&pidlock);
465 	}
466 }
467 
468 #define	MIN(a, b) ((a) < (b) ? (a) : (b))
469 /* Copy userdata into a new mblk_t */
470 mblk_t *
471 socopyinuio(uio_t *uiop, ssize_t iosize, size_t wroff, ssize_t maxblk,
472     size_t tail_len, int *errorp, cred_t *cr)
473 {
474 	mblk_t	*head = NULL, **tail = &head;
475 
476 	ASSERT(iosize == INFPSZ || iosize > 0);
477 
478 	if (iosize == INFPSZ || iosize > uiop->uio_resid)
479 		iosize = uiop->uio_resid;
480 
481 	if (maxblk == INFPSZ)
482 		maxblk = iosize;
483 
484 	/* Nothing to do in these cases, so we're done */
485 	if (iosize < 0 || maxblk < 0 || (maxblk == 0 && iosize > 0))
486 		goto done;
487 
488 	/*
489 	 * We will enter the loop below if iosize is 0; it will allocate an
490 	 * empty message block and call uiomove(9F) which will just return.
491 	 * We could avoid that with an extra check but would only slow
492 	 * down the much more likely case where iosize is larger than 0.
493 	 */
494 	do {
495 		ssize_t blocksize;
496 		mblk_t	*mp;
497 
498 		blocksize = MIN(iosize, maxblk);
499 		ASSERT(blocksize >= 0);
500 		if (is_system_labeled())
501 			mp = allocb_cred(wroff + blocksize + tail_len,
502 			    cr, curproc->p_pid);
503 		else
504 			mp = allocb(wroff + blocksize + tail_len, BPRI_MED);
505 		if (mp == NULL) {
506 			*errorp = ENOMEM;
507 			return (head);
508 		}
509 		mp->b_rptr += wroff;
510 		mp->b_wptr = mp->b_rptr + blocksize;
511 
512 		*tail = mp;
513 		tail = &mp->b_cont;
514 
515 		/* uiomove(9F) either returns 0 or EFAULT */
516 		if ((*errorp = uiomove(mp->b_rptr, (size_t)blocksize,
517 		    UIO_WRITE, uiop)) != 0) {
518 			ASSERT(*errorp != ENOMEM);
519 			freemsg(head);
520 			return (NULL);
521 		}
522 
523 		iosize -= blocksize;
524 	} while (iosize > 0);
525 
526 done:
527 	*errorp = 0;
528 	return (head);
529 }
530 
531 mblk_t *
532 socopyoutuio(mblk_t *mp, struct uio *uiop, ssize_t max_read, int *errorp)
533 {
534 	int error;
535 	ptrdiff_t n;
536 	mblk_t *nmp;
537 
538 	ASSERT(mp->b_wptr >= mp->b_rptr);
539 
540 	/*
541 	 * max_read is the offset of the oobmark and read can not go pass
542 	 * the oobmark.
543 	 */
544 	if (max_read == INFPSZ || max_read > uiop->uio_resid)
545 		max_read = uiop->uio_resid;
546 
547 	do {
548 		if ((n = MIN(max_read, MBLKL(mp))) != 0) {
549 			ASSERT(n > 0);
550 
551 			error = uiomove(mp->b_rptr, n, UIO_READ, uiop);
552 			if (error != 0) {
553 				freemsg(mp);
554 				*errorp = error;
555 				return (NULL);
556 			}
557 		}
558 
559 		mp->b_rptr += n;
560 		max_read -= n;
561 		while (mp != NULL && (mp->b_rptr >= mp->b_wptr)) {
562 			/*
563 			 * get rid of zero length mblks
564 			 */
565 			nmp = mp;
566 			mp = mp->b_cont;
567 			freeb(nmp);
568 		}
569 	} while (mp != NULL && max_read > 0);
570 
571 	*errorp = 0;
572 	return (mp);
573 }
574 
575 static void
576 so_prepend_msg(struct sonode *so, mblk_t *mp, mblk_t *last_tail)
577 {
578 	ASSERT(last_tail != NULL);
579 	mp->b_next = so->so_rcv_q_head;
580 	mp->b_prev = last_tail;
581 	ASSERT(!(DB_FLAGS(mp) & DBLK_UIOA));
582 
583 	if (so->so_rcv_q_head == NULL) {
584 		ASSERT(so->so_rcv_q_last_head == NULL);
585 		so->so_rcv_q_last_head = mp;
586 #ifdef DEBUG
587 	} else {
588 		ASSERT(!(DB_FLAGS(so->so_rcv_q_head) & DBLK_UIOA));
589 #endif
590 	}
591 	so->so_rcv_q_head = mp;
592 
593 #ifdef DEBUG
594 	if (so_debug_length) {
595 		mutex_enter(&so->so_lock);
596 		ASSERT(so_check_length(so));
597 		mutex_exit(&so->so_lock);
598 	}
599 #endif
600 }
601 
602 /*
603  * Move a mblk chain (mp_head, mp_last_head) to the sonode's rcv queue so it
604  * can be processed by so_dequeue_msg().
605  */
606 void
607 so_process_new_message(struct sonode *so, mblk_t *mp_head, mblk_t *mp_last_head)
608 {
609 	ASSERT(mp_head->b_prev != NULL);
610 	if (so->so_rcv_q_head  == NULL) {
611 		so->so_rcv_q_head = mp_head;
612 		so->so_rcv_q_last_head = mp_last_head;
613 		ASSERT(so->so_rcv_q_last_head->b_prev != NULL);
614 	} else {
615 		boolean_t flag_equal = ((DB_FLAGS(mp_head) & DBLK_UIOA) ==
616 		    (DB_FLAGS(so->so_rcv_q_last_head) & DBLK_UIOA));
617 
618 		if (mp_head->b_next == NULL &&
619 		    DB_TYPE(mp_head) == M_DATA &&
620 		    DB_TYPE(so->so_rcv_q_last_head) == M_DATA && flag_equal) {
621 			so->so_rcv_q_last_head->b_prev->b_cont = mp_head;
622 			so->so_rcv_q_last_head->b_prev = mp_head->b_prev;
623 			mp_head->b_prev = NULL;
624 		} else if (flag_equal && (DB_FLAGS(mp_head) & DBLK_UIOA)) {
625 			/*
626 			 * Append to last_head if more than one mblks, and both
627 			 * mp_head and last_head are I/OAT mblks.
628 			 */
629 			ASSERT(mp_head->b_next != NULL);
630 			so->so_rcv_q_last_head->b_prev->b_cont = mp_head;
631 			so->so_rcv_q_last_head->b_prev = mp_head->b_prev;
632 			mp_head->b_prev = NULL;
633 
634 			so->so_rcv_q_last_head->b_next = mp_head->b_next;
635 			mp_head->b_next = NULL;
636 			so->so_rcv_q_last_head = mp_last_head;
637 		} else {
638 #ifdef DEBUG
639 			{
640 				mblk_t *tmp_mblk;
641 				tmp_mblk = mp_head;
642 				while (tmp_mblk != NULL) {
643 					ASSERT(tmp_mblk->b_prev != NULL);
644 					tmp_mblk = tmp_mblk->b_next;
645 				}
646 			}
647 #endif
648 			so->so_rcv_q_last_head->b_next = mp_head;
649 			so->so_rcv_q_last_head = mp_last_head;
650 		}
651 	}
652 }
653 
654 int
655 so_dequeue_msg(struct sonode *so, mblk_t **mctlp, struct uio *uiop,
656     rval_t *rvalp, int flags)
657 {
658 	mblk_t	*mp, *nmp;
659 	mblk_t	*savemp, *savemptail;
660 	mblk_t	*new_msg_head;
661 	mblk_t	*new_msg_last_head;
662 	mblk_t	*last_tail;
663 	boolean_t partial_read;
664 	boolean_t reset_atmark = B_FALSE;
665 	int more = 0;
666 	int error;
667 	ssize_t oobmark;
668 	sodirect_t *sodp = so->so_direct;
669 
670 	partial_read = B_FALSE;
671 	*mctlp = NULL;
672 again:
673 	mutex_enter(&so->so_lock);
674 again1:
675 #ifdef DEBUG
676 	if (so_debug_length) {
677 		ASSERT(so_check_length(so));
678 	}
679 #endif
680 	if (so->so_state & SS_RCVATMARK) {
681 		/* Check whether the caller is OK to read past the mark */
682 		if (flags & MSG_NOMARK) {
683 			mutex_exit(&so->so_lock);
684 			return (EWOULDBLOCK);
685 		}
686 		reset_atmark = B_TRUE;
687 	}
688 	/*
689 	 * First move messages from the dump area to processing area
690 	 */
691 	if (sodp != NULL) {
692 		if (sodp->sod_enabled) {
693 			if (sodp->sod_uioa.uioa_state & UIOA_ALLOC) {
694 				/* nothing to uioamove */
695 				sodp = NULL;
696 			} else if (sodp->sod_uioa.uioa_state & UIOA_INIT) {
697 				sodp->sod_uioa.uioa_state &= UIOA_CLR;
698 				sodp->sod_uioa.uioa_state |= UIOA_ENABLED;
699 				/*
700 				 * try to uioamove() the data that
701 				 * has already queued.
702 				 */
703 				sod_uioa_so_init(so, sodp, uiop);
704 			}
705 		} else {
706 			sodp = NULL;
707 		}
708 	}
709 	new_msg_head = so->so_rcv_head;
710 	new_msg_last_head = so->so_rcv_last_head;
711 	so->so_rcv_head = NULL;
712 	so->so_rcv_last_head = NULL;
713 	oobmark = so->so_oobmark;
714 	/*
715 	 * We can release the lock as there can only be one reader
716 	 */
717 	mutex_exit(&so->so_lock);
718 
719 	if (new_msg_head != NULL) {
720 		so_process_new_message(so, new_msg_head, new_msg_last_head);
721 	}
722 	savemp = savemptail = NULL;
723 	rvalp->r_val1 = 0;
724 	error = 0;
725 	mp = so->so_rcv_q_head;
726 
727 	if (mp != NULL &&
728 	    (so->so_rcv_timer_tid == 0 ||
729 	    so->so_rcv_queued >= so->so_rcv_thresh)) {
730 		partial_read = B_FALSE;
731 
732 		if (flags & MSG_PEEK) {
733 			if ((nmp = dupmsg(mp)) == NULL &&
734 			    (nmp = copymsg(mp)) == NULL) {
735 				size_t size = msgsize(mp);
736 
737 				error = strwaitbuf(size, BPRI_HI);
738 				if (error) {
739 					return (error);
740 				}
741 				goto again;
742 			}
743 			mp = nmp;
744 		} else {
745 			ASSERT(mp->b_prev != NULL);
746 			last_tail = mp->b_prev;
747 			mp->b_prev = NULL;
748 			so->so_rcv_q_head = mp->b_next;
749 			if (so->so_rcv_q_head == NULL) {
750 				so->so_rcv_q_last_head = NULL;
751 			}
752 			mp->b_next = NULL;
753 		}
754 
755 		ASSERT(mctlp != NULL);
756 		/*
757 		 * First process PROTO or PCPROTO blocks, if any.
758 		 */
759 		if (DB_TYPE(mp) != M_DATA) {
760 			*mctlp = mp;
761 			savemp = mp;
762 			savemptail = mp;
763 			ASSERT(DB_TYPE(mp) == M_PROTO ||
764 			    DB_TYPE(mp) == M_PCPROTO);
765 			while (mp->b_cont != NULL &&
766 			    DB_TYPE(mp->b_cont) != M_DATA) {
767 				ASSERT(DB_TYPE(mp->b_cont) == M_PROTO ||
768 				    DB_TYPE(mp->b_cont) == M_PCPROTO);
769 				mp = mp->b_cont;
770 				savemptail = mp;
771 			}
772 			mp = savemptail->b_cont;
773 			savemptail->b_cont = NULL;
774 		}
775 
776 		ASSERT(DB_TYPE(mp) == M_DATA);
777 		/*
778 		 * Now process DATA blocks, if any. Note that for sodirect
779 		 * enabled socket, uio_resid can be 0.
780 		 */
781 		if (uiop->uio_resid >= 0) {
782 			ssize_t copied = 0;
783 
784 			if (sodp != NULL && (DB_FLAGS(mp) & DBLK_UIOA)) {
785 				mutex_enter(&so->so_lock);
786 				ASSERT(uiop == (uio_t *)&sodp->sod_uioa);
787 				copied = sod_uioa_mblk(so, mp);
788 				if (copied > 0)
789 					partial_read = B_TRUE;
790 				mutex_exit(&so->so_lock);
791 				/* mark this mblk as processed */
792 				mp = NULL;
793 			} else {
794 				ssize_t oldresid = uiop->uio_resid;
795 
796 				if (MBLKL(mp) < so_mblk_pull_len) {
797 					if (pullupmsg(mp, -1) == 1) {
798 						last_tail = mp;
799 					}
800 				}
801 				/*
802 				 * Can not read beyond the oobmark
803 				 */
804 				mp = socopyoutuio(mp, uiop,
805 				    oobmark == 0 ? INFPSZ : oobmark, &error);
806 				if (error != 0) {
807 					freemsg(*mctlp);
808 					*mctlp = NULL;
809 					more = 0;
810 					goto done;
811 				}
812 				ASSERT(oldresid >= uiop->uio_resid);
813 				copied = oldresid - uiop->uio_resid;
814 				if (oldresid > uiop->uio_resid)
815 					partial_read = B_TRUE;
816 			}
817 			ASSERT(copied >= 0);
818 			if (copied > 0 && !(flags & MSG_PEEK)) {
819 				mutex_enter(&so->so_lock);
820 				so->so_rcv_queued -= copied;
821 				ASSERT(so->so_oobmark >= 0);
822 				if (so->so_oobmark > 0) {
823 					so->so_oobmark -= copied;
824 					ASSERT(so->so_oobmark >= 0);
825 					if (so->so_oobmark == 0) {
826 						ASSERT(so->so_state &
827 						    SS_OOBPEND);
828 						so->so_oobmark = 0;
829 						so->so_state |= SS_RCVATMARK;
830 					}
831 				}
832 				if (so->so_flowctrld && so->so_rcv_queued <
833 				    so->so_rcvlowat) {
834 					so->so_flowctrld = B_FALSE;
835 					mutex_exit(&so->so_lock);
836 					/*
837 					 * Open up flow control. SCTP does
838 					 * not have any downcalls, and it will
839 					 * clr flow ctrl in sosctp_recvmsg().
840 					 */
841 					if (so->so_downcalls != NULL &&
842 					    so->so_downcalls->sd_clr_flowctrl !=
843 					    NULL) {
844 						(*so->so_downcalls->
845 						    sd_clr_flowctrl)
846 						    (so->so_proto_handle);
847 					}
848 				} else {
849 					mutex_exit(&so->so_lock);
850 				}
851 			}
852 		}
853 		if (mp != NULL) { /* more data blocks in msg */
854 			more |= MOREDATA;
855 			if ((flags & (MSG_PEEK|MSG_TRUNC))) {
856 				if (flags & MSG_TRUNC &&
857 				    ((flags & MSG_PEEK) == 0)) {
858 					mutex_enter(&so->so_lock);
859 					so->so_rcv_queued -= msgdsize(mp);
860 					mutex_exit(&so->so_lock);
861 				}
862 				freemsg(mp);
863 			} else if (partial_read && !somsghasdata(mp)) {
864 				/*
865 				 * Avoid queuing a zero-length tail part of
866 				 * a message. partial_read == 1 indicates that
867 				 * we read some of the message.
868 				 */
869 				freemsg(mp);
870 				more &= ~MOREDATA;
871 			} else {
872 				if (savemp != NULL &&
873 				    (flags & MSG_DUPCTRL)) {
874 					mblk_t *nmp;
875 					/*
876 					 * There should only be non data mblks
877 					 */
878 					ASSERT(DB_TYPE(savemp) != M_DATA &&
879 					    DB_TYPE(savemptail) != M_DATA);
880 try_again:
881 					if ((nmp = dupmsg(savemp)) == NULL &&
882 					    (nmp = copymsg(savemp)) == NULL) {
883 
884 						size_t size = msgsize(savemp);
885 
886 						error = strwaitbuf(size,
887 						    BPRI_HI);
888 						if (error != 0) {
889 							/*
890 							 * In case we
891 							 * cannot copy
892 							 * control data
893 							 * free the remaining
894 							 * data.
895 							 */
896 							freemsg(mp);
897 							goto done;
898 						}
899 						goto try_again;
900 					}
901 
902 					ASSERT(nmp != NULL);
903 					ASSERT(DB_TYPE(nmp) != M_DATA);
904 					savemptail->b_cont = mp;
905 					*mctlp = nmp;
906 					mp = savemp;
907 				}
908 				/*
909 				 * putback mp
910 				 */
911 				so_prepend_msg(so, mp, last_tail);
912 			}
913 		}
914 
915 		/* fast check so_rcv_head if there is more data */
916 		if (partial_read && !(so->so_state & SS_RCVATMARK) &&
917 		    *mctlp == NULL && uiop->uio_resid > 0 &&
918 		    !(flags & MSG_PEEK) && so->so_rcv_head != NULL) {
919 			goto again;
920 		}
921 	} else if (!partial_read) {
922 		mutex_enter(&so->so_lock);
923 		if (so->so_error != 0) {
924 			error = sogeterr(so, !(flags & MSG_PEEK));
925 			mutex_exit(&so->so_lock);
926 			return (error);
927 		}
928 		/*
929 		 * No pending data. Return right away for nonblocking
930 		 * socket, otherwise sleep waiting for data.
931 		 */
932 		if (!(so->so_state & SS_CANTRCVMORE) && uiop->uio_resid > 0) {
933 			if ((uiop->uio_fmode & (FNDELAY|FNONBLOCK)) ||
934 			    (flags & MSG_DONTWAIT)) {
935 				error = EWOULDBLOCK;
936 			} else {
937 				if (so->so_state & (SS_CLOSING |
938 				    SS_FALLBACK_PENDING)) {
939 					mutex_exit(&so->so_lock);
940 					error = EINTR;
941 					goto done;
942 				}
943 
944 				if (so->so_rcv_head != NULL) {
945 					goto again1;
946 				}
947 				so->so_rcv_wakeup = B_TRUE;
948 				so->so_rcv_wanted = uiop->uio_resid;
949 				if (so->so_rcvtimeo == 0) {
950 					/*
951 					 * Zero means disable timeout.
952 					 */
953 					error = cv_wait_sig(&so->so_rcv_cv,
954 					    &so->so_lock);
955 				} else {
956 					clock_t now;
957 					time_to_wait(&now, so->so_rcvtimeo);
958 					error = cv_timedwait_sig(&so->so_rcv_cv,
959 					    &so->so_lock, now);
960 				}
961 				so->so_rcv_wakeup = B_FALSE;
962 				so->so_rcv_wanted = 0;
963 
964 				if (error == 0) {
965 					error = EINTR;
966 				} else if (error == -1) {
967 					error = EAGAIN;
968 				} else {
969 					goto again1;
970 				}
971 			}
972 		}
973 		mutex_exit(&so->so_lock);
974 	}
975 	if (reset_atmark && partial_read && !(flags & MSG_PEEK)) {
976 		/*
977 		 * We are passed the mark, update state
978 		 * 4.3BSD and 4.4BSD clears the mark when peeking across it.
979 		 * The draft Posix socket spec states that the mark should
980 		 * not be cleared when peeking. We follow the latter.
981 		 */
982 		mutex_enter(&so->so_lock);
983 		ASSERT(so_verify_oobstate(so));
984 		so->so_state &= ~(SS_OOBPEND|SS_HAVEOOBDATA|SS_RCVATMARK);
985 		freemsg(so->so_oobmsg);
986 		so->so_oobmsg = NULL;
987 		ASSERT(so_verify_oobstate(so));
988 		mutex_exit(&so->so_lock);
989 	}
990 	ASSERT(so->so_rcv_wakeup == B_FALSE);
991 done:
992 	if (sodp != NULL) {
993 		mutex_enter(&so->so_lock);
994 		if (sodp->sod_enabled &&
995 		    (sodp->sod_uioa.uioa_state & UIOA_ENABLED)) {
996 			SOD_UIOAFINI(sodp);
997 			if (sodp->sod_uioa.uioa_mbytes > 0) {
998 				ASSERT(so->so_rcv_q_head != NULL ||
999 				    so->so_rcv_head != NULL);
1000 				so->so_rcv_queued -= sod_uioa_mblk(so, NULL);
1001 				if (error == EWOULDBLOCK)
1002 					error = 0;
1003 			}
1004 		}
1005 		mutex_exit(&so->so_lock);
1006 	}
1007 #ifdef DEBUG
1008 	if (so_debug_length) {
1009 		mutex_enter(&so->so_lock);
1010 		ASSERT(so_check_length(so));
1011 		mutex_exit(&so->so_lock);
1012 	}
1013 #endif
1014 	rvalp->r_val1 = more;
1015 	return (error);
1016 }
1017 
1018 /*
1019  * Enqueue data from the protocol on the socket's rcv queue.
1020  *
1021  * We try to hook new M_DATA mblks onto an existing chain, however,
1022  * that cannot be done if the existing chain has already been
1023  * processed by I/OAT. Non-M_DATA mblks are just linked together via
1024  * b_next. In all cases the b_prev of the enqueued mblk is set to
1025  * point to the last mblk in its b_cont chain.
1026  */
1027 void
1028 so_enqueue_msg(struct sonode *so, mblk_t *mp, size_t msg_size)
1029 {
1030 	ASSERT(MUTEX_HELD(&so->so_lock));
1031 
1032 #ifdef DEBUG
1033 	if (so_debug_length) {
1034 		ASSERT(so_check_length(so));
1035 	}
1036 #endif
1037 	so->so_rcv_queued += msg_size;
1038 
1039 	if (so->so_rcv_head == NULL) {
1040 		ASSERT(so->so_rcv_last_head == NULL);
1041 		so->so_rcv_head = mp;
1042 		so->so_rcv_last_head = mp;
1043 	} else if ((DB_TYPE(mp) == M_DATA &&
1044 	    DB_TYPE(so->so_rcv_last_head) == M_DATA) &&
1045 	    ((DB_FLAGS(mp) & DBLK_UIOA) ==
1046 	    (DB_FLAGS(so->so_rcv_last_head) & DBLK_UIOA))) {
1047 		/* Added to the end */
1048 		ASSERT(so->so_rcv_last_head != NULL);
1049 		ASSERT(so->so_rcv_last_head->b_prev != NULL);
1050 		so->so_rcv_last_head->b_prev->b_cont = mp;
1051 	} else {
1052 		/* Start a new end */
1053 		so->so_rcv_last_head->b_next = mp;
1054 		so->so_rcv_last_head = mp;
1055 	}
1056 	while (mp->b_cont != NULL)
1057 		mp = mp->b_cont;
1058 
1059 	so->so_rcv_last_head->b_prev = mp;
1060 #ifdef DEBUG
1061 	if (so_debug_length) {
1062 		ASSERT(so_check_length(so));
1063 	}
1064 #endif
1065 }
1066 
1067 /*
1068  * Return B_TRUE if there is data in the message, B_FALSE otherwise.
1069  */
1070 boolean_t
1071 somsghasdata(mblk_t *mp)
1072 {
1073 	for (; mp; mp = mp->b_cont)
1074 		if (mp->b_datap->db_type == M_DATA) {
1075 			ASSERT(mp->b_wptr >= mp->b_rptr);
1076 			if (mp->b_wptr > mp->b_rptr)
1077 				return (B_TRUE);
1078 		}
1079 	return (B_FALSE);
1080 }
1081 
1082 /*
1083  * Flush the read side of sockfs.
1084  *
1085  * The caller must be sure that a reader is not already active when the
1086  * buffer is being flushed.
1087  */
1088 void
1089 so_rcv_flush(struct sonode *so)
1090 {
1091 	mblk_t  *mp;
1092 
1093 	ASSERT(MUTEX_HELD(&so->so_lock));
1094 
1095 	if (so->so_oobmsg != NULL) {
1096 		freemsg(so->so_oobmsg);
1097 		so->so_oobmsg = NULL;
1098 		so->so_oobmark = 0;
1099 		so->so_state &=
1100 		    ~(SS_OOBPEND|SS_HAVEOOBDATA|SS_HADOOBDATA|SS_RCVATMARK);
1101 	}
1102 
1103 	/*
1104 	 * Free messages sitting in the send and recv queue
1105 	 */
1106 	while (so->so_rcv_q_head != NULL) {
1107 		mp = so->so_rcv_q_head;
1108 		so->so_rcv_q_head = mp->b_next;
1109 		mp->b_next = mp->b_prev = NULL;
1110 		freemsg(mp);
1111 	}
1112 	while (so->so_rcv_head != NULL) {
1113 		mp = so->so_rcv_head;
1114 		so->so_rcv_head = mp->b_next;
1115 		mp->b_next = mp->b_prev = NULL;
1116 		freemsg(mp);
1117 	}
1118 	so->so_rcv_queued = 0;
1119 	so->so_rcv_q_head = NULL;
1120 	so->so_rcv_q_last_head = NULL;
1121 	so->so_rcv_head = NULL;
1122 	so->so_rcv_last_head = NULL;
1123 }
1124 
1125 /*
1126  * Handle recv* calls that set MSG_OOB or MSG_OOB together with MSG_PEEK.
1127  */
1128 int
1129 sorecvoob(struct sonode *so, struct nmsghdr *msg, struct uio *uiop, int flags,
1130     boolean_t oob_inline)
1131 {
1132 	mblk_t		*mp, *nmp;
1133 	int		error;
1134 
1135 	dprintso(so, 1, ("sorecvoob(%p, %p, 0x%x)\n", (void *)so, (void *)msg,
1136 	    flags));
1137 
1138 	if (msg != NULL) {
1139 		/*
1140 		 * There is never any oob data with addresses or control since
1141 		 * the T_EXDATA_IND does not carry any options.
1142 		 */
1143 		msg->msg_controllen = 0;
1144 		msg->msg_namelen = 0;
1145 		msg->msg_flags = 0;
1146 	}
1147 
1148 	mutex_enter(&so->so_lock);
1149 	ASSERT(so_verify_oobstate(so));
1150 	if (oob_inline ||
1151 	    (so->so_state & (SS_OOBPEND|SS_HADOOBDATA)) != SS_OOBPEND) {
1152 		dprintso(so, 1, ("sorecvoob: inline or data consumed\n"));
1153 		mutex_exit(&so->so_lock);
1154 		return (EINVAL);
1155 	}
1156 	if (!(so->so_state & SS_HAVEOOBDATA)) {
1157 		dprintso(so, 1, ("sorecvoob: no data yet\n"));
1158 		mutex_exit(&so->so_lock);
1159 		return (EWOULDBLOCK);
1160 	}
1161 	ASSERT(so->so_oobmsg != NULL);
1162 	mp = so->so_oobmsg;
1163 	if (flags & MSG_PEEK) {
1164 		/*
1165 		 * Since recv* can not return ENOBUFS we can not use dupmsg.
1166 		 * Instead we revert to the consolidation private
1167 		 * allocb_wait plus bcopy.
1168 		 */
1169 		mblk_t *mp1;
1170 
1171 		mp1 = allocb_wait(msgdsize(mp), BPRI_MED, STR_NOSIG, NULL);
1172 		ASSERT(mp1);
1173 
1174 		while (mp != NULL) {
1175 			ssize_t size;
1176 
1177 			size = MBLKL(mp);
1178 			bcopy(mp->b_rptr, mp1->b_wptr, size);
1179 			mp1->b_wptr += size;
1180 			ASSERT(mp1->b_wptr <= mp1->b_datap->db_lim);
1181 			mp = mp->b_cont;
1182 		}
1183 		mp = mp1;
1184 	} else {
1185 		/*
1186 		 * Update the state indicating that the data has been consumed.
1187 		 * Keep SS_OOBPEND set until data is consumed past the mark.
1188 		 */
1189 		so->so_oobmsg = NULL;
1190 		so->so_state ^= SS_HAVEOOBDATA|SS_HADOOBDATA;
1191 	}
1192 	ASSERT(so_verify_oobstate(so));
1193 	mutex_exit(&so->so_lock);
1194 
1195 	error = 0;
1196 	nmp = mp;
1197 	while (nmp != NULL && uiop->uio_resid > 0) {
1198 		ssize_t n = MBLKL(nmp);
1199 
1200 		n = MIN(n, uiop->uio_resid);
1201 		if (n > 0)
1202 			error = uiomove(nmp->b_rptr, n,
1203 			    UIO_READ, uiop);
1204 		if (error)
1205 			break;
1206 		nmp = nmp->b_cont;
1207 	}
1208 	ASSERT(mp->b_next == NULL && mp->b_prev == NULL);
1209 	freemsg(mp);
1210 	return (error);
1211 }
1212 
1213 /*
1214  * Allocate and initializ sonode
1215  */
1216 /* ARGSUSED */
1217 struct sonode *
1218 socket_sonode_create(struct sockparams *sp, int family, int type,
1219     int protocol, int version, int sflags, int *errorp, struct cred *cr)
1220 {
1221 	sonode_t *so;
1222 	int	kmflags;
1223 
1224 	/*
1225 	 * Choose the right set of sonodeops based on the upcall and
1226 	 * down call version that the protocol has provided
1227 	 */
1228 	if (SOCK_UC_VERSION != sp->sp_smod_info->smod_uc_version ||
1229 	    SOCK_DC_VERSION != sp->sp_smod_info->smod_dc_version) {
1230 		/*
1231 		 * mismatch
1232 		 */
1233 #ifdef DEBUG
1234 		cmn_err(CE_CONT, "protocol and socket module version mismatch");
1235 #endif
1236 		*errorp = EINVAL;
1237 		return (NULL);
1238 	}
1239 
1240 	kmflags = (sflags & SOCKET_NOSLEEP) ? KM_NOSLEEP : KM_SLEEP;
1241 
1242 	so = kmem_cache_alloc(socket_cache, kmflags);
1243 	if (so == NULL) {
1244 		*errorp = ENOMEM;
1245 		return (NULL);
1246 	}
1247 
1248 	sonode_init(so, sp, family, type, protocol, &so_sonodeops);
1249 
1250 	if (version == SOV_DEFAULT)
1251 		version = so_default_version;
1252 
1253 	so->so_version = (short)version;
1254 
1255 	/*
1256 	 * set the default values to be INFPSZ
1257 	 * if a protocol desires it can change the value later
1258 	 */
1259 	so->so_proto_props.sopp_rxhiwat = SOCKET_RECVHIWATER;
1260 	so->so_proto_props.sopp_rxlowat = SOCKET_RECVLOWATER;
1261 	so->so_proto_props.sopp_maxpsz = INFPSZ;
1262 	so->so_proto_props.sopp_maxblk = INFPSZ;
1263 
1264 	return (so);
1265 }
1266 
1267 int
1268 socket_init_common(struct sonode *so, struct sonode *pso, int flags, cred_t *cr)
1269 {
1270 	int error = 0;
1271 
1272 	if (pso != NULL) {
1273 		/*
1274 		 * We have a passive open, so inherit basic state from
1275 		 * the parent (listener).
1276 		 *
1277 		 * No need to grab the new sonode's lock, since there is no
1278 		 * one that can have a reference to it.
1279 		 */
1280 		mutex_enter(&pso->so_lock);
1281 
1282 		so->so_state |= SS_ISCONNECTED | (pso->so_state & SS_ASYNC);
1283 		so->so_pgrp = pso->so_pgrp;
1284 		so->so_rcvtimeo = pso->so_rcvtimeo;
1285 		so->so_sndtimeo = pso->so_sndtimeo;
1286 		so->so_xpg_rcvbuf = pso->so_xpg_rcvbuf;
1287 		/*
1288 		 * Make note of the socket level options. TCP and IP level
1289 		 * options are already inherited. We could do all this after
1290 		 * accept is successful but doing it here simplifies code and
1291 		 * no harm done for error case.
1292 		 */
1293 		so->so_options = pso->so_options & (SO_DEBUG|SO_REUSEADDR|
1294 		    SO_KEEPALIVE|SO_DONTROUTE|SO_BROADCAST|SO_USELOOPBACK|
1295 		    SO_OOBINLINE|SO_DGRAM_ERRIND|SO_LINGER);
1296 		so->so_proto_props = pso->so_proto_props;
1297 		so->so_mode = pso->so_mode;
1298 		so->so_pollev = pso->so_pollev & SO_POLLEV_ALWAYS;
1299 
1300 		mutex_exit(&pso->so_lock);
1301 	} else {
1302 		struct sockparams *sp = so->so_sockparams;
1303 		sock_upcalls_t *upcalls_to_use;
1304 
1305 		/*
1306 		 * Based on the version number select the right upcalls to
1307 		 * pass down. Currently we only have one version so choose
1308 		 * default
1309 		 */
1310 		upcalls_to_use = &so_upcalls;
1311 
1312 		/* active open, so create a lower handle */
1313 		so->so_proto_handle =
1314 		    sp->sp_smod_info->smod_proto_create_func(so->so_family,
1315 		    so->so_type, so->so_protocol, &so->so_downcalls,
1316 		    &so->so_mode, &error, flags, cr);
1317 
1318 		if (so->so_proto_handle == NULL) {
1319 			ASSERT(error != 0);
1320 			/*
1321 			 * To be safe; if a lower handle cannot be created, and
1322 			 * the proto does not give a reason why, assume there
1323 			 * was a lack of memory.
1324 			 */
1325 			return ((error == 0) ? ENOMEM : error);
1326 		}
1327 		ASSERT(so->so_downcalls != NULL);
1328 		ASSERT(so->so_downcalls->sd_send != NULL ||
1329 		    so->so_downcalls->sd_send_uio != NULL);
1330 		if (so->so_downcalls->sd_recv_uio != NULL) {
1331 			ASSERT(so->so_downcalls->sd_poll != NULL);
1332 			so->so_pollev |= SO_POLLEV_ALWAYS;
1333 		}
1334 
1335 		(*so->so_downcalls->sd_activate)(so->so_proto_handle,
1336 		    (sock_upper_handle_t)so, upcalls_to_use, 0, cr);
1337 
1338 		/* Wildcard */
1339 
1340 		/*
1341 		 * FIXME No need for this, the protocol can deal with it in
1342 		 * sd_create(). Should update ICMP.
1343 		 */
1344 		if (so->so_protocol != so->so_sockparams->sp_protocol) {
1345 			int protocol = so->so_protocol;
1346 			int error;
1347 			/*
1348 			 * Issue SO_PROTOTYPE setsockopt.
1349 			 */
1350 			error = socket_setsockopt(so, SOL_SOCKET, SO_PROTOTYPE,
1351 			    &protocol, (t_uscalar_t)sizeof (protocol), cr);
1352 			if (error) {
1353 				(void) (*so->so_downcalls->sd_close)
1354 				    (so->so_proto_handle, 0, cr);
1355 
1356 				mutex_enter(&so->so_lock);
1357 				so_rcv_flush(so);
1358 				mutex_exit(&so->so_lock);
1359 				/*
1360 				 * Setsockopt often fails with ENOPROTOOPT but
1361 				 * socket() should fail with
1362 				 * EPROTONOSUPPORT/EPROTOTYPE.
1363 				 */
1364 				return (EPROTONOSUPPORT);
1365 			}
1366 		}
1367 	}
1368 
1369 	if (uioasync.enabled)
1370 		sod_sock_init(so);
1371 
1372 	return (0);
1373 }
1374 
1375 /*
1376  * int socket_ioctl_common(struct sonode *so, int cmd, intptr_t arg, int mode,
1377  *         struct cred *cr, int32_t *rvalp)
1378  *
1379  * Handle ioctls that manipulate basic socket state; non-blocking,
1380  * async, etc.
1381  *
1382  * Returns:
1383  *   < 0  - ioctl was not handle
1384  *  >= 0  - ioctl was handled, if > 0, then it is an errno
1385  *
1386  * Notes:
1387  *   Assumes the standard receive buffer is used to obtain info for
1388  *   NREAD.
1389  */
1390 /* ARGSUSED */
1391 int
1392 socket_ioctl_common(struct sonode *so, int cmd, intptr_t arg, int mode,
1393     struct cred *cr, int32_t *rvalp)
1394 {
1395 	switch (cmd) {
1396 	case SIOCSQPTR:
1397 		/*
1398 		 * SIOCSQPTR is valid only when helper stream is created
1399 		 * by the protocol.
1400 		 */
1401 
1402 		return (EOPNOTSUPP);
1403 	case FIONBIO: {
1404 		int32_t value;
1405 
1406 		if (so_copyin((void *)arg, &value, sizeof (int32_t),
1407 		    (mode & (int)FKIOCTL)))
1408 			return (EFAULT);
1409 
1410 		mutex_enter(&so->so_lock);
1411 		if (value) {
1412 			so->so_state |= SS_NDELAY;
1413 		} else {
1414 			so->so_state &= ~SS_NDELAY;
1415 		}
1416 		mutex_exit(&so->so_lock);
1417 		return (0);
1418 	}
1419 	case FIOASYNC: {
1420 		int32_t value;
1421 
1422 		if (so_copyin((void *)arg, &value, sizeof (int32_t),
1423 		    (mode & (int)FKIOCTL)))
1424 			return (EFAULT);
1425 
1426 		mutex_enter(&so->so_lock);
1427 
1428 		if (value) {
1429 			/* Turn on SIGIO */
1430 			so->so_state |= SS_ASYNC;
1431 		} else {
1432 			/* Turn off SIGIO */
1433 			so->so_state &= ~SS_ASYNC;
1434 		}
1435 		mutex_exit(&so->so_lock);
1436 
1437 		return (0);
1438 	}
1439 
1440 	case SIOCSPGRP:
1441 	case FIOSETOWN: {
1442 		int error;
1443 		pid_t pid;
1444 
1445 		if (so_copyin((void *)arg, &pid, sizeof (pid_t),
1446 		    (mode & (int)FKIOCTL)))
1447 			return (EFAULT);
1448 
1449 		mutex_enter(&so->so_lock);
1450 		error = (pid != so->so_pgrp) ? socket_chgpgrp(so, pid) : 0;
1451 		mutex_exit(&so->so_lock);
1452 		return (error);
1453 	}
1454 	case SIOCGPGRP:
1455 	case FIOGETOWN:
1456 		if (so_copyout(&so->so_pgrp, (void *)arg,
1457 		    sizeof (pid_t), (mode & (int)FKIOCTL)))
1458 			return (EFAULT);
1459 
1460 		return (0);
1461 	case SIOCATMARK: {
1462 		int retval;
1463 
1464 		/*
1465 		 * Only protocols that support urgent data can handle ATMARK.
1466 		 */
1467 		if ((so->so_mode & SM_EXDATA) == 0)
1468 			return (EINVAL);
1469 
1470 		/*
1471 		 * If the protocol is maintaining its own buffer, then the
1472 		 * request must be passed down.
1473 		 */
1474 		if (so->so_downcalls->sd_recv_uio != NULL)
1475 			return (-1);
1476 
1477 		retval = (so->so_state & SS_RCVATMARK) != 0;
1478 
1479 		if (so_copyout(&retval, (void *)arg, sizeof (int),
1480 		    (mode & (int)FKIOCTL))) {
1481 			return (EFAULT);
1482 		}
1483 		return (0);
1484 	}
1485 
1486 	case FIONREAD: {
1487 		int retval;
1488 
1489 		/*
1490 		 * If the protocol is maintaining its own buffer, then the
1491 		 * request must be passed down.
1492 		 */
1493 		if (so->so_downcalls->sd_recv_uio != NULL)
1494 			return (-1);
1495 
1496 		retval = MIN(so->so_rcv_queued, INT_MAX);
1497 
1498 		if (so_copyout(&retval, (void *)arg,
1499 		    sizeof (retval), (mode & (int)FKIOCTL))) {
1500 			return (EFAULT);
1501 		}
1502 		return (0);
1503 	}
1504 
1505 	case _I_GETPEERCRED: {
1506 		int error = 0;
1507 
1508 		if ((mode & FKIOCTL) == 0)
1509 			return (EINVAL);
1510 
1511 		mutex_enter(&so->so_lock);
1512 		if ((so->so_mode & SM_CONNREQUIRED) == 0) {
1513 			error = ENOTSUP;
1514 		} else if ((so->so_state & SS_ISCONNECTED) == 0) {
1515 			error = ENOTCONN;
1516 		} else if (so->so_peercred != NULL) {
1517 			k_peercred_t *kp = (k_peercred_t *)arg;
1518 			kp->pc_cr = so->so_peercred;
1519 			kp->pc_cpid = so->so_cpid;
1520 			crhold(so->so_peercred);
1521 		} else {
1522 			error = EINVAL;
1523 		}
1524 		mutex_exit(&so->so_lock);
1525 		return (error);
1526 	}
1527 	default:
1528 		return (-1);
1529 	}
1530 }
1531 
1532 /*
1533  * Handle the I_NREAD STREAM ioctl.
1534  */
1535 static int
1536 so_strioc_nread(struct sonode *so, intptr_t arg, int mode, int32_t *rvalp)
1537 {
1538 	size_t size = 0;
1539 	int retval;
1540 	int count = 0;
1541 	mblk_t *mp;
1542 
1543 	if (so->so_downcalls == NULL ||
1544 	    so->so_downcalls->sd_recv_uio != NULL)
1545 		return (EINVAL);
1546 
1547 	mutex_enter(&so->so_lock);
1548 	/* Wait for reader to get out of the way. */
1549 	while (so->so_flag & SOREADLOCKED) {
1550 		/*
1551 		 * If reader is waiting for data, then there should be nothing
1552 		 * on the rcv queue.
1553 		 */
1554 		if (so->so_rcv_wakeup)
1555 			goto out;
1556 
1557 		so->so_flag |= SOWANT;
1558 		/* Do a timed sleep, in case the reader goes to sleep. */
1559 		(void) cv_timedwait(&so->so_state_cv, &so->so_lock,
1560 		    lbolt + drv_usectohz(10));
1561 	}
1562 
1563 	/*
1564 	 * Since we are holding so_lock no new reader will come in, and the
1565 	 * protocol will not be able to enqueue data. So it's safe to walk
1566 	 * both rcv queues.
1567 	 */
1568 	mp = so->so_rcv_q_head;
1569 	if (mp != NULL) {
1570 		size = msgdsize(so->so_rcv_q_head);
1571 		for (; mp != NULL; mp = mp->b_next)
1572 			count++;
1573 	} else {
1574 		/*
1575 		 * In case the processing list was empty, get the size of the
1576 		 * next msg in line.
1577 		 */
1578 		size = msgdsize(so->so_rcv_head);
1579 	}
1580 
1581 	for (mp = so->so_rcv_head; mp != NULL; mp = mp->b_next)
1582 		count++;
1583 out:
1584 	mutex_exit(&so->so_lock);
1585 
1586 	/*
1587 	 * Drop down from size_t to the "int" required by the
1588 	 * interface.  Cap at INT_MAX.
1589 	 */
1590 	retval = MIN(size, INT_MAX);
1591 	if (so_copyout(&retval, (void *)arg, sizeof (retval),
1592 	    (mode & (int)FKIOCTL))) {
1593 		return (EFAULT);
1594 	} else {
1595 		*rvalp = count;
1596 		return (0);
1597 	}
1598 }
1599 
1600 /*
1601  * Process STREAM ioctls.
1602  *
1603  * Returns:
1604  *   < 0  - ioctl was not handle
1605  *  >= 0  - ioctl was handled, if > 0, then it is an errno
1606  */
1607 int
1608 socket_strioc_common(struct sonode *so, int cmd, intptr_t arg, int mode,
1609     struct cred *cr, int32_t *rvalp)
1610 {
1611 	int retval;
1612 
1613 	/* Only STREAM iotcls are handled here */
1614 	if ((cmd & 0xffffff00U) != STR)
1615 		return (-1);
1616 
1617 	switch (cmd) {
1618 	case I_CANPUT:
1619 		/*
1620 		 * We return an error for I_CANPUT so that isastream(3C) will
1621 		 * not report the socket as being a STREAM.
1622 		 */
1623 		return (EOPNOTSUPP);
1624 	case I_NREAD:
1625 		/* Avoid doing a fallback for I_NREAD. */
1626 		return (so_strioc_nread(so, arg, mode, rvalp));
1627 	case I_LOOK:
1628 		/* Avoid doing a fallback for I_LOOK. */
1629 		if (so_copyout("sockmod", (void *)arg, strlen("sockmod") + 1,
1630 		    (mode & (int)FKIOCTL))) {
1631 			return (EFAULT);
1632 		}
1633 		return (0);
1634 	default:
1635 		break;
1636 	}
1637 
1638 	/*
1639 	 * Try to fall back to TPI, and if successful, reissue the ioctl.
1640 	 */
1641 	if ((retval = so_tpi_fallback(so, cr)) == 0) {
1642 		/* Reissue the ioctl */
1643 		ASSERT(so->so_rcv_q_head == NULL);
1644 		return (SOP_IOCTL(so, cmd, arg, mode, cr, rvalp));
1645 	} else {
1646 		return (retval);
1647 	}
1648 }
1649 
1650 int
1651 socket_getopt_common(struct sonode *so, int level, int option_name,
1652     void *optval, socklen_t *optlenp, int flags)
1653 {
1654 	if (level != SOL_SOCKET)
1655 		return (-1);
1656 
1657 	switch (option_name) {
1658 	case SO_ERROR:
1659 	case SO_DOMAIN:
1660 	case SO_TYPE:
1661 	case SO_ACCEPTCONN: {
1662 		int32_t value;
1663 		socklen_t optlen = *optlenp;
1664 
1665 		if (optlen < (t_uscalar_t)sizeof (int32_t)) {
1666 			return (EINVAL);
1667 		}
1668 
1669 		switch (option_name) {
1670 		case SO_ERROR:
1671 			mutex_enter(&so->so_lock);
1672 			value = sogeterr(so, B_TRUE);
1673 			mutex_exit(&so->so_lock);
1674 			break;
1675 		case SO_DOMAIN:
1676 			value = so->so_family;
1677 			break;
1678 		case SO_TYPE:
1679 			value = so->so_type;
1680 			break;
1681 		case SO_ACCEPTCONN:
1682 			if (so->so_state & SS_ACCEPTCONN)
1683 				value = SO_ACCEPTCONN;
1684 			else
1685 				value = 0;
1686 			break;
1687 		}
1688 
1689 		bcopy(&value, optval, sizeof (value));
1690 		*optlenp = sizeof (value);
1691 
1692 		return (0);
1693 	}
1694 	case SO_SNDTIMEO:
1695 	case SO_RCVTIMEO: {
1696 		clock_t value;
1697 		socklen_t optlen = *optlenp;
1698 
1699 		if (get_udatamodel() == DATAMODEL_NONE ||
1700 		    get_udatamodel() == DATAMODEL_NATIVE) {
1701 			if (optlen < sizeof (struct timeval))
1702 				return (EINVAL);
1703 		} else {
1704 			if (optlen < sizeof (struct timeval32))
1705 				return (EINVAL);
1706 		}
1707 		if (option_name == SO_RCVTIMEO)
1708 			value = drv_hztousec(so->so_rcvtimeo);
1709 		else
1710 			value = drv_hztousec(so->so_sndtimeo);
1711 
1712 		if (get_udatamodel() == DATAMODEL_NONE ||
1713 		    get_udatamodel() == DATAMODEL_NATIVE) {
1714 			((struct timeval *)(optval))->tv_sec =
1715 			    value / (1000 * 1000);
1716 			((struct timeval *)(optval))->tv_usec =
1717 			    value % (1000 * 1000);
1718 			*optlenp = sizeof (struct timeval);
1719 		} else {
1720 			((struct timeval32 *)(optval))->tv_sec =
1721 			    value / (1000 * 1000);
1722 			((struct timeval32 *)(optval))->tv_usec =
1723 			    value % (1000 * 1000);
1724 			*optlenp = sizeof (struct timeval32);
1725 		}
1726 		return (0);
1727 	}
1728 	case SO_DEBUG:
1729 	case SO_REUSEADDR:
1730 	case SO_KEEPALIVE:
1731 	case SO_DONTROUTE:
1732 	case SO_BROADCAST:
1733 	case SO_USELOOPBACK:
1734 	case SO_OOBINLINE:
1735 	case SO_SNDBUF:
1736 #ifdef notyet
1737 	case SO_SNDLOWAT:
1738 	case SO_RCVLOWAT:
1739 #endif /* notyet */
1740 	case SO_DGRAM_ERRIND: {
1741 		socklen_t optlen = *optlenp;
1742 
1743 		if (optlen < (t_uscalar_t)sizeof (int32_t))
1744 			return (EINVAL);
1745 		break;
1746 	}
1747 	case SO_RCVBUF: {
1748 		socklen_t optlen = *optlenp;
1749 
1750 		if (optlen < (t_uscalar_t)sizeof (int32_t))
1751 			return (EINVAL);
1752 
1753 		if ((flags & _SOGETSOCKOPT_XPG4_2) && so->so_xpg_rcvbuf != 0) {
1754 			/*
1755 			 * XXX If SO_RCVBUF has been set and this is an
1756 			 * XPG 4.2 application then do not ask the transport
1757 			 * since the transport might adjust the value and not
1758 			 * return exactly what was set by the application.
1759 			 * For non-XPG 4.2 application we return the value
1760 			 * that the transport is actually using.
1761 			 */
1762 			*(int32_t *)optval = so->so_xpg_rcvbuf;
1763 			*optlenp = sizeof (so->so_xpg_rcvbuf);
1764 			return (0);
1765 		}
1766 		/*
1767 		 * If the option has not been set then get a default
1768 		 * value from the transport.
1769 		 */
1770 		break;
1771 	}
1772 	case SO_LINGER: {
1773 		socklen_t optlen = *optlenp;
1774 
1775 		if (optlen < (t_uscalar_t)sizeof (struct linger))
1776 			return (EINVAL);
1777 		break;
1778 	}
1779 	case SO_SND_BUFINFO: {
1780 		socklen_t optlen = *optlenp;
1781 
1782 		if (optlen < (t_uscalar_t)sizeof (struct so_snd_bufinfo))
1783 			return (EINVAL);
1784 		((struct so_snd_bufinfo *)(optval))->sbi_wroff =
1785 		    (so->so_proto_props).sopp_wroff;
1786 		((struct so_snd_bufinfo *)(optval))->sbi_maxblk =
1787 		    (so->so_proto_props).sopp_maxblk;
1788 		((struct so_snd_bufinfo *)(optval))->sbi_maxpsz =
1789 		    (so->so_proto_props).sopp_maxpsz;
1790 		((struct so_snd_bufinfo *)(optval))->sbi_tail =
1791 		    (so->so_proto_props).sopp_tail;
1792 		*optlenp = sizeof (struct so_snd_bufinfo);
1793 		return (0);
1794 	}
1795 	default:
1796 		break;
1797 	}
1798 
1799 	/* Unknown Option */
1800 	return (-1);
1801 }
1802 
1803 void
1804 socket_sonode_destroy(struct sonode *so)
1805 {
1806 	sonode_fini(so);
1807 	kmem_cache_free(socket_cache, so);
1808 }
1809 
1810 int
1811 so_zcopy_wait(struct sonode *so)
1812 {
1813 	int error = 0;
1814 
1815 	mutex_enter(&so->so_lock);
1816 	while (!(so->so_copyflag & STZCNOTIFY)) {
1817 		if (so->so_state & SS_CLOSING) {
1818 			mutex_exit(&so->so_lock);
1819 			return (EINTR);
1820 		}
1821 		if (cv_wait_sig(&so->so_copy_cv, &so->so_lock) == 0) {
1822 			error = EINTR;
1823 			break;
1824 		}
1825 	}
1826 	so->so_copyflag &= ~STZCNOTIFY;
1827 	mutex_exit(&so->so_lock);
1828 	return (error);
1829 }
1830 
1831 void
1832 so_timer_callback(void *arg)
1833 {
1834 	struct sonode *so = (struct sonode *)arg;
1835 
1836 	mutex_enter(&so->so_lock);
1837 
1838 	so->so_rcv_timer_tid = 0;
1839 	if (so->so_rcv_queued > 0) {
1840 		so_notify_data(so, so->so_rcv_queued);
1841 	} else {
1842 		mutex_exit(&so->so_lock);
1843 	}
1844 }
1845 
1846 #ifdef DEBUG
1847 /*
1848  * Verify that the length stored in so_rcv_queued and the length of data blocks
1849  * queued is same.
1850  */
1851 static boolean_t
1852 so_check_length(sonode_t *so)
1853 {
1854 	mblk_t *mp = so->so_rcv_q_head;
1855 	int len = 0;
1856 
1857 	ASSERT(MUTEX_HELD(&so->so_lock));
1858 
1859 	if (mp != NULL) {
1860 		len = msgdsize(mp);
1861 		while ((mp = mp->b_next) != NULL)
1862 			len += msgdsize(mp);
1863 	}
1864 	mp = so->so_rcv_head;
1865 	if (mp != NULL) {
1866 		len += msgdsize(mp);
1867 		while ((mp = mp->b_next) != NULL)
1868 			len += msgdsize(mp);
1869 	}
1870 	return ((len == so->so_rcv_queued) ? B_TRUE : B_FALSE);
1871 }
1872 #endif
1873 
1874 int
1875 so_get_mod_version(struct sockparams *sp)
1876 {
1877 	ASSERT(sp != NULL && sp->sp_smod_info != NULL);
1878 	return (sp->sp_smod_info->smod_version);
1879 }
1880 
1881 /*
1882  * so_start_fallback()
1883  *
1884  * Block new socket operations from coming in, and wait for active operations
1885  * to complete. Threads that are sleeping will be woken up so they can get
1886  * out of the way.
1887  *
1888  * The caller must be a reader on so_fallback_rwlock.
1889  */
1890 static boolean_t
1891 so_start_fallback(struct sonode *so)
1892 {
1893 	ASSERT(RW_READ_HELD(&so->so_fallback_rwlock));
1894 
1895 	mutex_enter(&so->so_lock);
1896 	if (so->so_state & SS_FALLBACK_PENDING) {
1897 		mutex_exit(&so->so_lock);
1898 		return (B_FALSE);
1899 	}
1900 	so->so_state |= SS_FALLBACK_PENDING;
1901 	/*
1902 	 * Poke all threads that might be sleeping. Any operation that comes
1903 	 * in after the cv_broadcast will observe the fallback pending flag
1904 	 * which cause the call to return where it would normally sleep.
1905 	 */
1906 	cv_broadcast(&so->so_state_cv);		/* threads in connect() */
1907 	cv_broadcast(&so->so_rcv_cv);		/* threads in recvmsg() */
1908 	cv_broadcast(&so->so_snd_cv);		/* threads in sendmsg() */
1909 	mutex_enter(&so->so_acceptq_lock);
1910 	cv_broadcast(&so->so_acceptq_cv);	/* threads in accept() */
1911 	mutex_exit(&so->so_acceptq_lock);
1912 	mutex_exit(&so->so_lock);
1913 
1914 	/*
1915 	 * The main reason for the rw_tryupgrade call is to provide
1916 	 * observability during the fallback process. We want to
1917 	 * be able to see if there are pending operations.
1918 	 */
1919 	if (rw_tryupgrade(&so->so_fallback_rwlock) == 0) {
1920 		/*
1921 		 * It is safe to drop and reaquire the fallback lock, because
1922 		 * we are guaranteed that another fallback cannot take place.
1923 		 */
1924 		rw_exit(&so->so_fallback_rwlock);
1925 		DTRACE_PROBE1(pending__ops__wait, (struct sonode *), so);
1926 		rw_enter(&so->so_fallback_rwlock, RW_WRITER);
1927 		DTRACE_PROBE1(pending__ops__complete, (struct sonode *), so);
1928 	}
1929 
1930 	return (B_TRUE);
1931 }
1932 
1933 /*
1934  * so_end_fallback()
1935  *
1936  * Allow socket opertions back in.
1937  *
1938  * The caller must be a writer on so_fallback_rwlock.
1939  */
1940 static void
1941 so_end_fallback(struct sonode *so)
1942 {
1943 	ASSERT(RW_ISWRITER(&so->so_fallback_rwlock));
1944 
1945 	mutex_enter(&so->so_lock);
1946 	so->so_state &= ~(SS_FALLBACK_PENDING|SS_FALLBACK_DRAIN);
1947 	mutex_exit(&so->so_lock);
1948 
1949 	rw_downgrade(&so->so_fallback_rwlock);
1950 }
1951 
1952 /*
1953  * so_quiesced_cb()
1954  *
1955  * Callback passed to the protocol during fallback. It is called once
1956  * the endpoint is quiescent.
1957  *
1958  * No requests from the user, no notifications from the protocol, so it
1959  * is safe to synchronize the state. Data can also be moved without
1960  * risk for reordering.
1961  *
1962  * We do not need to hold so_lock, since there can be only one thread
1963  * operating on the sonode.
1964  */
1965 static void
1966 so_quiesced_cb(sock_upper_handle_t sock_handle, queue_t *q,
1967     struct T_capability_ack *tcap, struct sockaddr *laddr, socklen_t laddrlen,
1968     struct sockaddr *faddr, socklen_t faddrlen, short opts)
1969 {
1970 	struct sonode *so = (struct sonode *)sock_handle;
1971 	boolean_t atmark;
1972 
1973 	sotpi_update_state(so, tcap, laddr, laddrlen, faddr, faddrlen, opts);
1974 
1975 	/*
1976 	 * Some protocols do not quiece the data path during fallback. Once
1977 	 * we set the SS_FALLBACK_DRAIN flag any attempt to queue data will
1978 	 * fail and the protocol is responsible for saving the data for later
1979 	 * delivery (i.e., once the fallback has completed).
1980 	 */
1981 	mutex_enter(&so->so_lock);
1982 	so->so_state |= SS_FALLBACK_DRAIN;
1983 	SOCKET_TIMER_CANCEL(so);
1984 	mutex_exit(&so->so_lock);
1985 
1986 	if (so->so_rcv_head != NULL) {
1987 		if (so->so_rcv_q_last_head == NULL)
1988 			so->so_rcv_q_head = so->so_rcv_head;
1989 		else
1990 			so->so_rcv_q_last_head->b_next = so->so_rcv_head;
1991 		so->so_rcv_q_last_head = so->so_rcv_last_head;
1992 	}
1993 
1994 	atmark = (so->so_state & SS_RCVATMARK) != 0;
1995 	/*
1996 	 * Clear any OOB state having to do with pending data. The TPI
1997 	 * code path will set the appropriate oob state when we move the
1998 	 * oob data to the STREAM head. We leave SS_HADOOBDATA since the oob
1999 	 * data has already been consumed.
2000 	 */
2001 	so->so_state &= ~(SS_RCVATMARK|SS_OOBPEND|SS_HAVEOOBDATA);
2002 
2003 	ASSERT(so->so_oobmsg != NULL || so->so_oobmark <= so->so_rcv_queued);
2004 
2005 	/*
2006 	 * Move data to the STREAM head.
2007 	 */
2008 	while (so->so_rcv_q_head != NULL) {
2009 		mblk_t *mp = so->so_rcv_q_head;
2010 		size_t mlen = msgdsize(mp);
2011 
2012 		so->so_rcv_q_head = mp->b_next;
2013 		mp->b_next = NULL;
2014 		mp->b_prev = NULL;
2015 
2016 		/*
2017 		 * Send T_EXDATA_IND if we are at the oob mark.
2018 		 */
2019 		if (atmark) {
2020 			struct T_exdata_ind *tei;
2021 			mblk_t *mp1 = SOTOTPI(so)->sti_exdata_mp;
2022 
2023 			SOTOTPI(so)->sti_exdata_mp = NULL;
2024 			ASSERT(mp1 != NULL);
2025 			mp1->b_datap->db_type = M_PROTO;
2026 			tei = (struct T_exdata_ind *)mp1->b_rptr;
2027 			tei->PRIM_type = T_EXDATA_IND;
2028 			tei->MORE_flag = 0;
2029 			mp1->b_wptr = (uchar_t *)&tei[1];
2030 
2031 			if (IS_SO_OOB_INLINE(so)) {
2032 				mp1->b_cont = mp;
2033 			} else {
2034 				ASSERT(so->so_oobmsg != NULL);
2035 				mp1->b_cont = so->so_oobmsg;
2036 				so->so_oobmsg = NULL;
2037 
2038 				/* process current mp next time around */
2039 				mp->b_next = so->so_rcv_q_head;
2040 				so->so_rcv_q_head = mp;
2041 				mlen = 0;
2042 			}
2043 			mp = mp1;
2044 
2045 			/* we have consumed the oob mark */
2046 			atmark = B_FALSE;
2047 		} else if (so->so_oobmark > 0) {
2048 			/*
2049 			 * Check if the OOB mark is within the current
2050 			 * mblk chain. In that case we have to split it up.
2051 			 */
2052 			if (so->so_oobmark < mlen) {
2053 				mblk_t *urg_mp = mp;
2054 
2055 				atmark = B_TRUE;
2056 				mp = NULL;
2057 				mlen = so->so_oobmark;
2058 
2059 				/*
2060 				 * It is assumed that the OOB mark does
2061 				 * not land within a mblk.
2062 				 */
2063 				do {
2064 					so->so_oobmark -= MBLKL(urg_mp);
2065 					mp = urg_mp;
2066 					urg_mp = urg_mp->b_cont;
2067 				} while (so->so_oobmark > 0);
2068 				mp->b_cont = NULL;
2069 				if (urg_mp != NULL) {
2070 					urg_mp->b_next = so->so_rcv_q_head;
2071 					so->so_rcv_q_head = urg_mp;
2072 				}
2073 			} else {
2074 				so->so_oobmark -= mlen;
2075 				if (so->so_oobmark == 0)
2076 					atmark = B_TRUE;
2077 			}
2078 		}
2079 
2080 		/*
2081 		 * Queue data on the STREAM head.
2082 		 */
2083 		so->so_rcv_queued -= mlen;
2084 		putnext(q, mp);
2085 	}
2086 	so->so_rcv_head = NULL;
2087 	so->so_rcv_last_head = NULL;
2088 	so->so_rcv_q_head = NULL;
2089 	so->so_rcv_q_last_head = NULL;
2090 
2091 	/*
2092 	 * Check if the oob byte is at the end of the data stream, or if the
2093 	 * oob byte has not yet arrived. In the latter case we have to send a
2094 	 * SIGURG and a mark indicator to the STREAM head. The mark indicator
2095 	 * is needed to guarantee correct behavior for SIOCATMARK. See block
2096 	 * comment in socktpi.h for more details.
2097 	 */
2098 	if (atmark || so->so_oobmark > 0) {
2099 		mblk_t *mp;
2100 
2101 		if (atmark && so->so_oobmsg != NULL) {
2102 			struct T_exdata_ind *tei;
2103 
2104 			mp = SOTOTPI(so)->sti_exdata_mp;
2105 			SOTOTPI(so)->sti_exdata_mp = NULL;
2106 			ASSERT(mp != NULL);
2107 			mp->b_datap->db_type = M_PROTO;
2108 			tei = (struct T_exdata_ind *)mp->b_rptr;
2109 			tei->PRIM_type = T_EXDATA_IND;
2110 			tei->MORE_flag = 0;
2111 			mp->b_wptr = (uchar_t *)&tei[1];
2112 
2113 			mp->b_cont = so->so_oobmsg;
2114 			so->so_oobmsg = NULL;
2115 
2116 			putnext(q, mp);
2117 		} else {
2118 			/* Send up the signal */
2119 			mp = SOTOTPI(so)->sti_exdata_mp;
2120 			SOTOTPI(so)->sti_exdata_mp = NULL;
2121 			ASSERT(mp != NULL);
2122 			DB_TYPE(mp) = M_PCSIG;
2123 			*mp->b_wptr++ = (uchar_t)SIGURG;
2124 			putnext(q, mp);
2125 
2126 			/* Send up the mark indicator */
2127 			mp = SOTOTPI(so)->sti_urgmark_mp;
2128 			SOTOTPI(so)->sti_urgmark_mp = NULL;
2129 			mp->b_flag = atmark ? MSGMARKNEXT : MSGNOTMARKNEXT;
2130 			putnext(q, mp);
2131 
2132 			so->so_oobmark = 0;
2133 		}
2134 	}
2135 
2136 	if (SOTOTPI(so)->sti_exdata_mp != NULL) {
2137 		freeb(SOTOTPI(so)->sti_exdata_mp);
2138 		SOTOTPI(so)->sti_exdata_mp = NULL;
2139 	}
2140 
2141 	if (SOTOTPI(so)->sti_urgmark_mp != NULL) {
2142 		freeb(SOTOTPI(so)->sti_urgmark_mp);
2143 		SOTOTPI(so)->sti_urgmark_mp = NULL;
2144 	}
2145 
2146 	ASSERT(so->so_oobmark == 0);
2147 	ASSERT(so->so_rcv_queued == 0);
2148 }
2149 
2150 #ifdef DEBUG
2151 /*
2152  * Do an integrity check of the sonode. This should be done if a
2153  * fallback fails after sonode has initially been converted to use
2154  * TPI and subsequently have to be reverted.
2155  *
2156  * Failure to pass the integrity check will panic the system.
2157  */
2158 void
2159 so_integrity_check(struct sonode *cur, struct sonode *orig)
2160 {
2161 	VERIFY(cur->so_vnode == orig->so_vnode);
2162 	VERIFY(cur->so_ops == orig->so_ops);
2163 	/*
2164 	 * For so_state we can only VERIFY the state flags in CHECK_STATE.
2165 	 * The other state flags might be affected by a notification from the
2166 	 * protocol.
2167 	 */
2168 #define	CHECK_STATE	(SS_CANTRCVMORE|SS_CANTSENDMORE|SS_NDELAY|SS_NONBLOCK| \
2169 	SS_ASYNC|SS_ACCEPTCONN|SS_SAVEDEOR|SS_RCVATMARK|SS_OOBPEND| \
2170 	SS_HAVEOOBDATA|SS_HADOOBDATA|SS_SENTLASTREADSIG|SS_SENTLASTWRITESIG)
2171 	VERIFY((cur->so_state & (orig->so_state & CHECK_STATE)) ==
2172 	    (orig->so_state & CHECK_STATE));
2173 	VERIFY(cur->so_mode == orig->so_mode);
2174 	VERIFY(cur->so_flag == orig->so_flag);
2175 	VERIFY(cur->so_count == orig->so_count);
2176 	/* Cannot VERIFY so_proto_connid; proto can update it */
2177 	VERIFY(cur->so_sockparams == orig->so_sockparams);
2178 	/* an error might have been recorded, but it can not be lost */
2179 	VERIFY(cur->so_error != 0 || orig->so_error == 0);
2180 	VERIFY(cur->so_family == orig->so_family);
2181 	VERIFY(cur->so_type == orig->so_type);
2182 	VERIFY(cur->so_protocol == orig->so_protocol);
2183 	VERIFY(cur->so_version == orig->so_version);
2184 	/* New conns might have arrived, but none should have been lost */
2185 	VERIFY(cur->so_acceptq_len >= orig->so_acceptq_len);
2186 	VERIFY(cur->so_acceptq_head == orig->so_acceptq_head);
2187 	VERIFY(cur->so_backlog == orig->so_backlog);
2188 	/* New OOB migth have arrived, but mark should not have been lost */
2189 	VERIFY(cur->so_oobmark >= orig->so_oobmark);
2190 	/* Cannot VERIFY so_oobmsg; the proto might have sent up a new one */
2191 	VERIFY(cur->so_pgrp == orig->so_pgrp);
2192 	VERIFY(cur->so_peercred == orig->so_peercred);
2193 	VERIFY(cur->so_cpid == orig->so_cpid);
2194 	VERIFY(cur->so_zoneid == orig->so_zoneid);
2195 	/* New data migth have arrived, but none should have been lost */
2196 	VERIFY(cur->so_rcv_queued >= orig->so_rcv_queued);
2197 	VERIFY(cur->so_rcv_q_head == orig->so_rcv_q_head);
2198 	VERIFY(cur->so_rcv_head == orig->so_rcv_head);
2199 	VERIFY(cur->so_proto_handle == orig->so_proto_handle);
2200 	VERIFY(cur->so_downcalls == orig->so_downcalls);
2201 	/* Cannot VERIFY so_proto_props; they can be updated by proto */
2202 }
2203 #endif
2204 
2205 /*
2206  * so_tpi_fallback()
2207  *
2208  * This is the fallback initation routine; things start here.
2209  *
2210  * Basic strategy:
2211  *   o Block new socket operations from coming in
2212  *   o Allocate/initate info needed by TPI
2213  *   o Quiesce the connection, at which point we sync
2214  *     state and move data
2215  *   o Change operations (sonodeops) associated with the socket
2216  *   o Unblock threads waiting for the fallback to finish
2217  */
2218 int
2219 so_tpi_fallback(struct sonode *so, struct cred *cr)
2220 {
2221 	int error;
2222 	queue_t *q;
2223 	struct sockparams *sp;
2224 	struct sockparams *newsp = NULL;
2225 	so_proto_fallback_func_t fbfunc;
2226 	boolean_t direct;
2227 	struct sonode *nso;
2228 #ifdef DEBUG
2229 	struct sonode origso;
2230 #endif
2231 	error = 0;
2232 	sp = so->so_sockparams;
2233 	fbfunc = sp->sp_smod_info->smod_proto_fallback_func;
2234 
2235 	/*
2236 	 * Fallback can only happen if there is a device associated
2237 	 * with the sonode, and the socket module has a fallback function.
2238 	 */
2239 	if (!SOCKPARAMS_HAS_DEVICE(sp) || fbfunc == NULL)
2240 		return (EINVAL);
2241 
2242 	/*
2243 	 * Initiate fallback; upon success we know that no new requests
2244 	 * will come in from the user.
2245 	 */
2246 	if (!so_start_fallback(so))
2247 		return (EAGAIN);
2248 #ifdef DEBUG
2249 	/*
2250 	 * Make a copy of the sonode in case we need to make an integrity
2251 	 * check later on.
2252 	 */
2253 	bcopy(so, &origso, sizeof (*so));
2254 #endif
2255 
2256 	sp->sp_stats.sps_nfallback.value.ui64++;
2257 
2258 	newsp = sockparams_hold_ephemeral_bydev(so->so_family, so->so_type,
2259 	    so->so_protocol, so->so_sockparams->sp_sdev_info.sd_devpath,
2260 	    KM_SLEEP, &error);
2261 	if (error != 0)
2262 		goto out;
2263 
2264 	if (so->so_direct != NULL) {
2265 		sodirect_t *sodp = so->so_direct;
2266 		mutex_enter(&so->so_lock);
2267 
2268 		so->so_direct->sod_enabled = B_FALSE;
2269 		so->so_state &= ~SS_SODIRECT;
2270 		ASSERT(sodp->sod_uioafh == NULL);
2271 		mutex_exit(&so->so_lock);
2272 	}
2273 
2274 	/* Turn sonode into a TPI socket */
2275 	error = sotpi_convert_sonode(so, newsp, &direct, &q, cr);
2276 	if (error != 0)
2277 		goto out;
2278 
2279 
2280 	/*
2281 	 * Now tell the protocol to start using TPI. so_quiesced_cb be
2282 	 * called once it's safe to synchronize state.
2283 	 */
2284 	DTRACE_PROBE1(proto__fallback__begin, struct sonode *, so);
2285 	error = (*fbfunc)(so->so_proto_handle, q, direct, so_quiesced_cb);
2286 	DTRACE_PROBE1(proto__fallback__end, struct sonode *, so);
2287 
2288 	if (error != 0) {
2289 		/* protocol was unable to do a fallback, revert the sonode */
2290 		sotpi_revert_sonode(so, cr);
2291 		goto out;
2292 	}
2293 
2294 	/*
2295 	 * Walk the accept queue and notify the proto that they should
2296 	 * fall back to TPI. The protocol will send up the T_CONN_IND.
2297 	 */
2298 	nso = so->so_acceptq_head;
2299 	while (nso != NULL) {
2300 		int rval;
2301 
2302 		DTRACE_PROBE1(proto__fallback__begin, struct sonode *, nso);
2303 		rval = (*fbfunc)(nso->so_proto_handle, NULL, direct, NULL);
2304 		DTRACE_PROBE1(proto__fallback__end, struct sonode *, nso);
2305 		if (rval != 0) {
2306 			zcmn_err(getzoneid(), CE_WARN,
2307 			    "Failed to convert socket in accept queue to TPI. "
2308 			    "Pid = %d\n", curproc->p_pid);
2309 		}
2310 		nso = nso->so_acceptq_next;
2311 	}
2312 
2313 	/*
2314 	 * Now flush the acceptq, this will destroy all sockets. They will
2315 	 * be recreated in sotpi_accept().
2316 	 */
2317 	so_acceptq_flush(so);
2318 
2319 	mutex_enter(&so->so_lock);
2320 	so->so_state |= SS_FALLBACK_COMP;
2321 	mutex_exit(&so->so_lock);
2322 
2323 	/*
2324 	 * Swap the sonode ops. Socket opertations that come in once this
2325 	 * is done will proceed without blocking.
2326 	 */
2327 	so->so_ops = &sotpi_sonodeops;
2328 
2329 	/*
2330 	 * Wake up any threads stuck in poll. This is needed since the poll
2331 	 * head changes when the fallback happens (moves from the sonode to
2332 	 * the STREAMS head).
2333 	 */
2334 	pollwakeup(&so->so_poll_list, POLLERR);
2335 out:
2336 	so_end_fallback(so);
2337 
2338 	if (error != 0) {
2339 #ifdef DEBUG
2340 		so_integrity_check(so, &origso);
2341 #endif
2342 		zcmn_err(getzoneid(), CE_WARN,
2343 		    "Failed to convert socket to TPI (err=%d). Pid = %d\n",
2344 		    error, curproc->p_pid);
2345 		if (newsp != NULL)
2346 			SOCKPARAMS_DEC_REF(newsp);
2347 	}
2348 
2349 	return (error);
2350 }
2351