xref: /illumos-gate/usr/src/uts/common/fs/doorfs/door_sys.c (revision 915894ef)

/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */

/*
 * Copyright (c) 2006, 2010, Oracle and/or its affiliates. All rights reserved.
 * Copyright (c) 2016 by Delphix. All rights reserved.
 * Copyright 2021 Tintri by DDN, Inc. All rights reserved.
 */

/*
 * System call I/F to doors (outside of vnodes I/F) and misc support
 * routines
 */
#include <sys/types.h>
#include <sys/systm.h>
#include <sys/door.h>
#include <sys/door_data.h>
#include <sys/proc.h>
#include <sys/thread.h>
#include <sys/prsystm.h>
#include <sys/procfs.h>
#include <sys/class.h>
#include <sys/cred.h>
#include <sys/kmem.h>
#include <sys/cmn_err.h>
#include <sys/stack.h>
#include <sys/debug.h>
#include <sys/cpuvar.h>
#include <sys/file.h>
#include <sys/fcntl.h>
#include <sys/vnode.h>
#include <sys/vfs.h>
#include <sys/vfs_opreg.h>
#include <sys/sobject.h>
#include <sys/schedctl.h>
#include <sys/callb.h>
#include <sys/ucred.h>

#include <sys/mman.h>
#include <sys/sysmacros.h>
#include <sys/vmsystm.h>
#include <vm/as.h>
#include <vm/hat.h>
#include <vm/page.h>
#include <vm/seg.h>
#include <vm/seg_vn.h>
#include <vm/seg_vn.h>
#include <vm/seg_kpm.h>

#include <sys/modctl.h>
#include <sys/syscall.h>
#include <sys/pathname.h>
#include <sys/rctl.h>

/*
 * The maximum amount of data (in bytes) that will be transferred using
 * an intermediate kernel buffer.  For sizes greater than this we map
 * in the destination pages and perform a 1-copy transfer.
 */
size_t	door_max_arg = 16 * 1024;

/*
 * Maximum amount of data that will be transferred in a reply to a
 * door_upcall.  Need to guard against a process returning huge amounts
 * of data and getting the kernel stuck in kmem_alloc.
 */
size_t	door_max_upcall_reply = 4 * 1024 * 1024;

/*
 * Maximum number of descriptors allowed to be passed in a single
 * door_call or door_return.  We need to allocate kernel memory
 * for all of them at once, so we can't let it scale without limit.
 */
uint_t door_max_desc = 1024;

/*
 * Definition of a door handle, used by other kernel subsystems when
 * calling door functions.  This is really a file structure but we
 * want to hide that fact.
 */
struct __door_handle {
	file_t dh_file;
};

#define	DHTOF(dh) ((file_t *)(dh))
#define	FTODH(fp) ((door_handle_t)(fp))

static int doorfs(long, long, long, long, long, long);

static struct sysent door_sysent = {
	6,
	SE_ARGC | SE_NOUNLOAD,
	(int (*)())doorfs,
};

static struct modlsys modlsys = {
	&mod_syscallops, "doors", &door_sysent
};

#ifdef _SYSCALL32_IMPL

static int
doorfs32(int32_t arg1, int32_t arg2, int32_t arg3, int32_t arg4,
    int32_t arg5, int32_t subcode);

static struct sysent door_sysent32 = {
	6,
	SE_ARGC | SE_NOUNLOAD,
	(int (*)())doorfs32,
};

static struct modlsys modlsys32 = {
	&mod_syscallops32,
	"32-bit door syscalls",
	&door_sysent32
};
#endif

static struct modlinkage modlinkage = {
	MODREV_1,
	&modlsys,
#ifdef _SYSCALL32_IMPL
	&modlsys32,
#endif
	NULL
};

dev_t	doordev;

extern	struct vfs door_vfs;
extern	struct vnodeops *door_vnodeops;

int
_init(void)
{
	static const fs_operation_def_t door_vfsops_template[] = {
		NULL, NULL
	};
	extern const fs_operation_def_t door_vnodeops_template[];
	vfsops_t *door_vfsops;
	major_t major;
	int error;

	mutex_init(&door_knob, NULL, MUTEX_DEFAULT, NULL);
	if ((major = getudev()) == (major_t)-1)
		return (ENXIO);
	doordev = makedevice(major, 0);

	/* Create a dummy vfs */
	error = vfs_makefsops(door_vfsops_template, &door_vfsops);
	if (error != 0) {
		cmn_err(CE_WARN, "door init: bad vfs ops");
		return (error);
	}
	VFS_INIT(&door_vfs, door_vfsops, NULL);
	door_vfs.vfs_flag = VFS_RDONLY;
	door_vfs.vfs_dev = doordev;
	vfs_make_fsid(&(door_vfs.vfs_fsid), doordev, 0);

	error = vn_make_ops("doorfs", door_vnodeops_template, &door_vnodeops);
	if (error != 0) {
		vfs_freevfsops(door_vfsops);
		cmn_err(CE_WARN, "door init: bad vnode ops");
		return (error);
	}
	return (mod_install(&modlinkage));
}

int
_info(struct modinfo *modinfop)
{
	return (mod_info(&modlinkage, modinfop));
}

/* system call functions */
static int door_call(int, void *);
static int door_return(caddr_t, size_t, door_desc_t *, uint_t, caddr_t, size_t);
static int door_create(void (*pc_cookie)(void *, char *, size_t, door_desc_t *,
    uint_t), void *data_cookie, uint_t);
static int door_revoke(int);
static int door_info(int, struct door_info *);
static int door_ucred(struct ucred_s *);
static int door_bind(int);
static int door_unbind(void);
static int door_unref(void);
static int door_getparam(int, int, size_t *);
static int door_setparam(int, int, size_t);

#define	DOOR_RETURN_OLD	4		/* historic value, for s10 */

/*
 * System call wrapper for all door related system calls
 */
static int
doorfs(long arg1, long arg2, long arg3, long arg4, long arg5, long subcode)
{
	switch (subcode) {
	case DOOR_CALL:
		return (door_call(arg1, (void *)arg2));
	case DOOR_RETURN: {
		door_return_desc_t *drdp = (door_return_desc_t *)arg3;

		if (drdp != NULL) {
			door_return_desc_t drd;
			if (copyin(drdp, &drd, sizeof (drd)))
				return (EFAULT);
			return (door_return((caddr_t)arg1, arg2, drd.desc_ptr,
			    drd.desc_num, (caddr_t)arg4, arg5));
		}
		return (door_return((caddr_t)arg1, arg2, NULL,
		    0, (caddr_t)arg4, arg5));
	}
	case DOOR_RETURN_OLD:
		/*
		 * In order to support the S10 runtime environment, we
		 * still respond to the old syscall subcode for door_return.
		 * We treat it as having no stack limits.  This code should
		 * be removed when such support is no longer needed.
		 */
		return (door_return((caddr_t)arg1, arg2, (door_desc_t *)arg3,
		    arg4, (caddr_t)arg5, 0));
	case DOOR_CREATE:
		return (door_create((void (*)())arg1, (void *)arg2, arg3));
	case DOOR_REVOKE:
		return (door_revoke(arg1));
	case DOOR_INFO:
		return (door_info(arg1, (struct door_info *)arg2));
	case DOOR_BIND:
		return (door_bind(arg1));
	case DOOR_UNBIND:
		return (door_unbind());
	case DOOR_UNREFSYS:
		return (door_unref());
	case DOOR_UCRED:
		return (door_ucred((struct ucred_s *)arg1));
	case DOOR_GETPARAM:
		return (door_getparam(arg1, arg2, (size_t *)arg3));
	case DOOR_SETPARAM:
		return (door_setparam(arg1, arg2, arg3));
	default:
		return (set_errno(EINVAL));
	}
}

#ifdef _SYSCALL32_IMPL
/*
 * System call wrapper for all door related system calls from 32-bit programs.
 * Needed at the moment because of the casts - they undo some damage
 * that truss causes (sign-extending the stack pointer) when truss'ing
 * a 32-bit program using doors.
 */
static int
doorfs32(int32_t arg1, int32_t arg2, int32_t arg3,
    int32_t arg4, int32_t arg5, int32_t subcode)
{
	switch (subcode) {
	case DOOR_CALL:
		return (door_call(arg1, (void *)(uintptr_t)(caddr32_t)arg2));
	case DOOR_RETURN: {
		door_return_desc32_t *drdp =
		    (door_return_desc32_t *)(uintptr_t)(caddr32_t)arg3;
		if (drdp != NULL) {
			door_return_desc32_t drd;
			if (copyin(drdp, &drd, sizeof (drd)))
				return (EFAULT);
			return (door_return(
			    (caddr_t)(uintptr_t)(caddr32_t)arg1, arg2,
			    (door_desc_t *)(uintptr_t)drd.desc_ptr,
			    drd.desc_num, (caddr_t)(uintptr_t)(caddr32_t)arg4,
			    (size_t)(uintptr_t)(size32_t)arg5));
		}
		return (door_return((caddr_t)(uintptr_t)(caddr32_t)arg1,
		    arg2, NULL, 0, (caddr_t)(uintptr_t)(caddr32_t)arg4,
		    (size_t)(uintptr_t)(size32_t)arg5));
	}
	case DOOR_RETURN_OLD:
		/*
		 * In order to support the S10 runtime environment, we
		 * still respond to the old syscall subcode for door_return.
		 * We treat it as having no stack limits.  This code should
		 * be removed when such support is no longer needed.
		 */
		return (door_return((caddr_t)(uintptr_t)(caddr32_t)arg1, arg2,
		    (door_desc_t *)(uintptr_t)(caddr32_t)arg3, arg4,
		    (caddr_t)(uintptr_t)(caddr32_t)arg5, 0));
	case DOOR_CREATE:
		return (door_create((void (*)())(uintptr_t)(caddr32_t)arg1,
		    (void *)(uintptr_t)(caddr32_t)arg2, arg3));
	case DOOR_REVOKE:
		return (door_revoke(arg1));
	case DOOR_INFO:
		return (door_info(arg1,
		    (struct door_info *)(uintptr_t)(caddr32_t)arg2));
	case DOOR_BIND:
		return (door_bind(arg1));
	case DOOR_UNBIND:
		return (door_unbind());
	case DOOR_UNREFSYS:
		return (door_unref());
	case DOOR_UCRED:
		return (door_ucred(
		    (struct ucred_s *)(uintptr_t)(caddr32_t)arg1));
	case DOOR_GETPARAM:
		return (door_getparam(arg1, arg2,
		    (size_t *)(uintptr_t)(caddr32_t)arg3));
	case DOOR_SETPARAM:
		return (door_setparam(arg1, arg2, (size_t)(size32_t)arg3));

	default:
		return (set_errno(EINVAL));
	}
}
#endif

void shuttle_resume(kthread_t *, kmutex_t *);
void shuttle_swtch(kmutex_t *);
void shuttle_sleep(kthread_t *);

/*
 * Support routines
 */
static int door_create_common(void (*)(), void *, uint_t, int, int *,
    file_t **);
static int door_overflow(kthread_t *, caddr_t, size_t, door_desc_t *, uint_t);
static int door_args(kthread_t *, int);
static int door_results(kthread_t *, caddr_t, size_t, door_desc_t *, uint_t);
static int door_copy(struct as *, caddr_t, caddr_t, uint_t);
static void	door_server_exit(proc_t *, kthread_t *);
static void	door_release_server(door_node_t *, kthread_t *);
static kthread_t	*door_get_server(door_node_t *);
static door_node_t	*door_lookup(int, file_t **);
static int	door_translate_in(void);
static int	door_translate_out(void);
static void	door_fd_rele(door_desc_t *, uint_t, int);
static void	door_list_insert(door_node_t *);
static void	door_info_common(door_node_t *, door_info_t *, file_t *);
static int	door_release_fds(door_desc_t *, uint_t);
static void	door_fd_close(door_desc_t *, uint_t);
static void	door_fp_close(struct file **, uint_t);

static door_data_t *
door_my_data(int create_if_missing)
{
	door_data_t *ddp;

	ddp = curthread->t_door;
	if (create_if_missing && ddp == NULL)
		ddp = curthread->t_door = kmem_zalloc(sizeof (*ddp), KM_SLEEP);

	return (ddp);
}

static door_server_t *
door_my_server(int create_if_missing)
{
	door_data_t *ddp = door_my_data(create_if_missing);

	return ((ddp != NULL)? DOOR_SERVER(ddp) : NULL);
}

static door_client_t *
door_my_client(int create_if_missing)
{
	door_data_t *ddp = door_my_data(create_if_missing);

	return ((ddp != NULL)? DOOR_CLIENT(ddp) : NULL);
}

/*
 * System call to create a door
 */
int
door_create(void (*pc_cookie)(), void *data_cookie, uint_t attributes)
{
	int fd;
	int err;

	if ((attributes & ~DOOR_CREATE_MASK) ||
	    ((attributes & (DOOR_UNREF | DOOR_UNREF_MULTI)) ==
	    (DOOR_UNREF | DOOR_UNREF_MULTI)))
		return (set_errno(EINVAL));

	if ((err = door_create_common(pc_cookie, data_cookie, attributes, 0,
	    &fd, NULL)) != 0)
		return (set_errno(err));

	f_setfd(fd, FD_CLOEXEC);
	return (fd);
}

/*
 * Common code for creating user and kernel doors.  If a door was
 * created, stores a file structure pointer in the location pointed
 * to by fpp (if fpp is non-NULL) and returns 0.  Also, if a non-NULL
 * pointer to a file descriptor is passed in as fdp, allocates a file
 * descriptor representing the door.  If a door could not be created,
 * returns an error.
 */
static int
door_create_common(void (*pc_cookie)(), void *data_cookie, uint_t attributes,
    int from_kernel, int *fdp, file_t **fpp)
{
	door_node_t	*dp;
	vnode_t		*vp;
	struct file	*fp;
	static door_id_t index = 0;
	proc_t		*p = (from_kernel)? &p0 : curproc;

	dp = kmem_zalloc(sizeof (door_node_t), KM_SLEEP);

	dp->door_vnode = vn_alloc(KM_SLEEP);
	dp->door_target = p;
	dp->door_data = data_cookie;
	dp->door_pc = pc_cookie;
	dp->door_flags = attributes;
#ifdef _SYSCALL32_IMPL
	if (!from_kernel && get_udatamodel() != DATAMODEL_NATIVE)
		dp->door_data_max = UINT32_MAX;
	else
#endif
		dp->door_data_max = SIZE_MAX;
	dp->door_data_min = 0UL;
	dp->door_desc_max = (attributes & DOOR_REFUSE_DESC)? 0 : INT_MAX;

	vp = DTOV(dp);
	vn_setops(vp, door_vnodeops);
	vp->v_type = VDOOR;
	vp->v_vfsp = &door_vfs;
	vp->v_data = (caddr_t)dp;
	mutex_enter(&door_knob);
	dp->door_index = index++;
	/* add to per-process door list */
	door_list_insert(dp);
	mutex_exit(&door_knob);

	if (falloc(vp, FREAD | FWRITE, &fp, fdp)) {
		/*
		 * If the file table is full, remove the door from the
		 * per-process list, free the door, and return NULL.
		 */
		mutex_enter(&door_knob);
		door_list_delete(dp);
		mutex_exit(&door_knob);
		vn_free(vp);
		kmem_free(dp, sizeof (door_node_t));
		return (EMFILE);
	}
	vn_exists(vp);
	if (fdp != NULL)
		setf(*fdp, fp);
	mutex_exit(&fp->f_tlock);

	if (fpp != NULL)
		*fpp = fp;
	return (0);
}

static int
door_check_limits(door_node_t *dp, door_arg_t *da, int upcall)
{
	ASSERT(MUTEX_HELD(&door_knob));

	/* we allow unref upcalls through, despite any minimum */
	if (da->data_size < dp->door_data_min &&
	    !(upcall && da->data_ptr == DOOR_UNREF_DATA))
		return (ENOBUFS);

	if (da->data_size > dp->door_data_max)
		return (ENOBUFS);

	if (da->desc_num > 0 && (dp->door_flags & DOOR_REFUSE_DESC))
		return (ENOTSUP);

	if (da->desc_num > dp->door_desc_max)
		return (ENFILE);

	return (0);
}

/*
 * Door invocation.
 */
int
door_call(int did, void *args)
{
	/* Locals */
	door_node_t	*dp;
	kthread_t	*server_thread;
	int		error = 0;
	klwp_t		*lwp;
	door_client_t	*ct;		/* curthread door_data */
	door_server_t	*st;		/* server thread door_data */
	door_desc_t	*start = NULL;
	uint_t		ncopied = 0;
	size_t		dsize;
	/* destructor for data returned by a kernel server */
	void		(*destfn)() = NULL;
	void		*destarg;
	model_t		datamodel;
	int		gotresults = 0;
	int		needcleanup = 0;
	int		cancel_pending;

	lwp = ttolwp(curthread);
	datamodel = lwp_getdatamodel(lwp);

	ct = door_my_client(1);

	/*
	 * Get the arguments
	 */
	if (args) {
		if (datamodel == DATAMODEL_NATIVE) {
			if (copyin(args, &ct->d_args, sizeof (door_arg_t)) != 0)
				return (set_errno(EFAULT));
		} else {
			door_arg32_t    da32;

			if (copyin(args, &da32, sizeof (door_arg32_t)) != 0)
				return (set_errno(EFAULT));
			ct->d_args.data_ptr =
			    (char *)(uintptr_t)da32.data_ptr;
			ct->d_args.data_size = da32.data_size;
			ct->d_args.desc_ptr =
			    (door_desc_t *)(uintptr_t)da32.desc_ptr;
			ct->d_args.desc_num = da32.desc_num;
			ct->d_args.rbuf =
			    (char *)(uintptr_t)da32.rbuf;
			ct->d_args.rsize = da32.rsize;
		}
	} else {
		/* No arguments, and no results allowed */
		ct->d_noresults = 1;
		ct->d_args.data_size = 0;
		ct->d_args.desc_num = 0;
		ct->d_args.rsize = 0;
	}

	if ((dp = door_lookup(did, NULL)) == NULL)
		return (set_errno(EBADF));

	/*
	 * We don't want to hold the door FD over the entire operation;
	 * instead, we put a hold on the door vnode and release the FD
	 * immediately
	 */
	VN_HOLD(DTOV(dp));
	releasef(did);

	/*
	 * This should be done in shuttle_resume(), just before going to
	 * sleep, but we want to avoid overhead while holding door_knob.
	 * prstop() is just a no-op if we don't really go to sleep.
	 * We test not-kernel-address-space for the sake of clustering code.
	 */
	if (lwp && lwp->lwp_nostop == 0 && curproc->p_as != &kas)
		prstop(PR_REQUESTED, 0);

	mutex_enter(&door_knob);
	if (DOOR_INVALID(dp)) {
		mutex_exit(&door_knob);
		error = EBADF;
		goto out;
	}

	/*
	 * before we do anything, check that we are not overflowing the
	 * required limits.
	 */
	error = door_check_limits(dp, &ct->d_args, 0);
	if (error != 0) {
		mutex_exit(&door_knob);
		goto out;
	}

	/*
	 * Check for in-kernel door server.
	 */
	if (dp->door_target == &p0) {
		caddr_t rbuf = ct->d_args.rbuf;
		size_t rsize = ct->d_args.rsize;

		dp->door_active++;
		ct->d_kernel = 1;
		ct->d_error = DOOR_WAIT;
		mutex_exit(&door_knob);
		/* translate file descriptors to vnodes */
		if (ct->d_args.desc_num) {
			error = door_translate_in();
			if (error)
				goto out;
		}
		/*
		 * Call kernel door server.  Arguments are passed and
		 * returned as a door_arg pointer.  When called, data_ptr
		 * points to user data and desc_ptr points to a kernel list
		 * of door descriptors that have been converted to file
		 * structure pointers.  It's the server function's
		 * responsibility to copyin the data pointed to by data_ptr
		 * (this avoids extra copying in some cases).  On return,
		 * data_ptr points to a user buffer of data, and desc_ptr
		 * points to a kernel list of door descriptors representing
		 * files.  When a reference is passed to a kernel server,
		 * it is the server's responsibility to release the reference
		 * (by calling closef).  When the server includes a
		 * reference in its reply, it is released as part of the
		 * the call (the server must duplicate the reference if
		 * it wants to retain a copy).  The destfn, if set to
		 * non-NULL, is a destructor to be called when the returned
		 * kernel data (if any) is no longer needed (has all been
		 * translated and copied to user level).
		 */
		(*(dp->door_pc))(dp->door_data, &ct->d_args,
		    &destfn, &destarg, &error);
		mutex_enter(&door_knob);
		/* not implemented yet */
		if (--dp->door_active == 0 && (dp->door_flags & DOOR_DELAY))
			door_deliver_unref(dp);
		mutex_exit(&door_knob);
		if (error)
			goto out;

		/* translate vnodes to files */
		if (ct->d_args.desc_num) {
			error = door_translate_out();
			if (error)
				goto out;
		}
		ct->d_buf = ct->d_args.rbuf;
		ct->d_bufsize = ct->d_args.rsize;
		if (rsize < (ct->d_args.data_size +
		    (ct->d_args.desc_num * sizeof (door_desc_t)))) {
			/* handle overflow */
			error = door_overflow(curthread, ct->d_args.data_ptr,
			    ct->d_args.data_size, ct->d_args.desc_ptr,
			    ct->d_args.desc_num);
			if (error)
				goto out;
			/* door_overflow sets d_args rbuf and rsize */
		} else {
			ct->d_args.rbuf = rbuf;
			ct->d_args.rsize = rsize;
		}
		goto results;
	}

	/*
	 * Get a server thread from the target domain
	 */
	if ((server_thread = door_get_server(dp)) == NULL) {
		if (DOOR_INVALID(dp))
			error = EBADF;
		else
			error = EAGAIN;
		mutex_exit(&door_knob);
		goto out;
	}

	st = DOOR_SERVER(server_thread->t_door);
	if (ct->d_args.desc_num || ct->d_args.data_size) {
		int is_private = (dp->door_flags & DOOR_PRIVATE);
		/*
		 * Move data from client to server
		 */
		DOOR_T_HOLD(st);
		mutex_exit(&door_knob);
		error = door_args(server_thread, is_private);
		mutex_enter(&door_knob);
		DOOR_T_RELEASE(st);
		if (error) {
			/*
			 * We're not going to resume this thread after all
			 */
			door_release_server(dp, server_thread);
			shuttle_sleep(server_thread);
			mutex_exit(&door_knob);
			goto out;
		}
	}

	dp->door_active++;
	ct->d_error = DOOR_WAIT;
	ct->d_args_done = 0;
	st->d_caller = curthread;
	st->d_active = dp;

	shuttle_resume(server_thread, &door_knob);

	mutex_enter(&door_knob);
shuttle_return:
	if ((error = ct->d_error) < 0) {	/* DOOR_WAIT or DOOR_EXIT */
		/*
		 * Premature wakeup. Find out why (stop, forkall, sig, exit ...)
		 */
		mutex_exit(&door_knob);		/* May block in ISSIG */
		cancel_pending = 0;
		if (ISSIG(curthread, FORREAL) || lwp->lwp_sysabort ||
		    MUSTRETURN(curproc, curthread) ||
		    (cancel_pending = schedctl_cancel_pending()) != 0) {
			/* Signal, forkall, ... */
			lwp->lwp_sysabort = 0;
			if (cancel_pending)
				schedctl_cancel_eintr();
			mutex_enter(&door_knob);
			error = EINTR;
			/*
			 * If the server has finished processing our call,
			 * or exited (calling door_slam()), then d_error
			 * will have changed.  If the server hasn't finished
			 * yet, d_error will still be DOOR_WAIT, and we
			 * let it know we are not interested in any
			 * results by sending a SIGCANCEL, unless the door
			 * is marked with DOOR_NO_CANCEL.
			 */
			if (ct->d_error == DOOR_WAIT &&
			    st->d_caller == curthread) {
				proc_t	*p = ttoproc(server_thread);

				st->d_active = NULL;
				st->d_caller = NULL;

				if (!(dp->door_flags & DOOR_NO_CANCEL)) {
					DOOR_T_HOLD(st);
					mutex_exit(&door_knob);

					mutex_enter(&p->p_lock);
					sigtoproc(p, server_thread, SIGCANCEL);
					mutex_exit(&p->p_lock);

					mutex_enter(&door_knob);
					DOOR_T_RELEASE(st);
				}
			}
		} else {
			/*
			 * Return from stop(), server exit...
			 *
			 * Note that the server could have done a
			 * door_return while the client was in stop state
			 * (ISSIG), in which case the error condition
			 * is updated by the server.
			 */
			mutex_enter(&door_knob);
			if (ct->d_error == DOOR_WAIT) {
				/* Still waiting for a reply */
				shuttle_swtch(&door_knob);
				mutex_enter(&door_knob);
				lwp->lwp_asleep = 0;
				goto	shuttle_return;
			} else if (ct->d_error == DOOR_EXIT) {
				/* Server exit */
				error = EINTR;
			} else {
				/* Server did a door_return during ISSIG */
				error = ct->d_error;
			}
		}
		/*
		 * Can't exit if the server is currently copying
		 * results for me.
		 */
		while (DOOR_T_HELD(ct))
			cv_wait(&ct->d_cv, &door_knob);

		/*
		 * If the server has not processed our message, free the
		 * descriptors.
		 */
		if (!ct->d_args_done) {
			needcleanup = 1;
			ct->d_args_done = 1;
		}

		/*
		 * Find out if results were successfully copied.
		 */
		if (ct->d_error == 0)
			gotresults = 1;
	}
	ASSERT(ct->d_args_done);
	lwp->lwp_asleep = 0;		/* /proc */
	lwp->lwp_sysabort = 0;		/* /proc */
	if (--dp->door_active == 0 && (dp->door_flags & DOOR_DELAY))
		door_deliver_unref(dp);
	mutex_exit(&door_knob);

	if (needcleanup)
		door_fp_close(ct->d_fpp, ct->d_args.desc_num);

results:
	/*
	 * Move the results to userland (if any)
	 */

	if (ct->d_noresults)
		goto out;

	if (error) {
		/*
		 * If server returned results successfully, then we've
		 * been interrupted and may need to clean up.
		 */
		if (gotresults) {
			ASSERT(error == EINTR);
			door_fp_close(ct->d_fpp, ct->d_args.desc_num);
		}
		goto out;
	}

	/*
	 * Copy back data if we haven't caused an overflow (already
	 * handled) and we are using a 2 copy transfer, or we are
	 * returning data from a kernel server.
	 */
	if (ct->d_args.data_size) {
		ct->d_args.data_ptr = ct->d_args.rbuf;
		if (ct->d_kernel || (!ct->d_overflow &&
		    ct->d_args.data_size <= door_max_arg)) {
			if (copyout_nowatch(ct->d_buf, ct->d_args.rbuf,
			    ct->d_args.data_size)) {
				door_fp_close(ct->d_fpp, ct->d_args.desc_num);
				error = EFAULT;
				goto out;
			}
		}
	}

	/*
	 * stuff returned doors into our proc, copyout the descriptors
	 */
	if (ct->d_args.desc_num) {
		struct file	**fpp;
		door_desc_t	*didpp;
		uint_t		n = ct->d_args.desc_num;

		dsize = n * sizeof (door_desc_t);
		start = didpp = kmem_alloc(dsize, KM_SLEEP);
		fpp = ct->d_fpp;

		while (n--) {
			if (door_insert(*fpp, didpp) == -1) {
				/* Close remaining files */
				door_fp_close(fpp, n + 1);
				error = EMFILE;
				goto out;
			}
			fpp++; didpp++; ncopied++;
		}

		ct->d_args.desc_ptr = (door_desc_t *)(ct->d_args.rbuf +
		    roundup(ct->d_args.data_size, sizeof (door_desc_t)));

		if (copyout_nowatch(start, ct->d_args.desc_ptr, dsize)) {
			error = EFAULT;
			goto out;
		}
	}

	/*
	 * Return the results
	 */
	if (datamodel == DATAMODEL_NATIVE) {
		if (copyout_nowatch(&ct->d_args, args,
		    sizeof (door_arg_t)) != 0)
			error = EFAULT;
	} else {
		door_arg32_t    da32;

		da32.data_ptr = (caddr32_t)(uintptr_t)ct->d_args.data_ptr;
		da32.data_size = ct->d_args.data_size;
		da32.desc_ptr = (caddr32_t)(uintptr_t)ct->d_args.desc_ptr;
		da32.desc_num = ct->d_args.desc_num;
		da32.rbuf = (caddr32_t)(uintptr_t)ct->d_args.rbuf;
		da32.rsize = ct->d_args.rsize;
		if (copyout_nowatch(&da32, args, sizeof (door_arg32_t)) != 0) {
			error = EFAULT;
		}
	}

out:
	ct->d_noresults = 0;

	/* clean up the overflow buffer if an error occurred */
	if (error != 0 && ct->d_overflow) {
		(void) as_unmap(curproc->p_as, ct->d_args.rbuf,
		    ct->d_args.rsize);
	}
	ct->d_overflow = 0;

	/* call destructor */
	if (destfn) {
		ASSERT(ct->d_kernel);
		(*destfn)(dp->door_data, destarg);
		ct->d_buf = NULL;
		ct->d_bufsize = 0;
	}

	if (dp)
		VN_RELE(DTOV(dp));

	if (ct->d_buf) {
		ASSERT(!ct->d_kernel);
		kmem_free(ct->d_buf, ct->d_bufsize);
		ct->d_buf = NULL;
		ct->d_bufsize = 0;
	}
	ct->d_kernel = 0;

	/* clean up the descriptor copyout buffer */
	if (start != NULL) {
		if (error != 0)
			door_fd_close(start, ncopied);
		kmem_free(start, dsize);
	}

	if (ct->d_fpp) {
		kmem_free(ct->d_fpp, ct->d_fpp_size);
		ct->d_fpp = NULL;
		ct->d_fpp_size = 0;
	}

	if (error)
		return (set_errno(error));

	return (0);
}

static int
door_setparam_common(door_node_t *dp, int from_kernel, int type, size_t val)
{
	int error = 0;

	mutex_enter(&door_knob);

	if (DOOR_INVALID(dp)) {
		mutex_exit(&door_knob);
		return (EBADF);
	}

	/*
	 * door_ki_setparam() can only affect kernel doors.
	 * door_setparam() can only affect doors attached to the current
	 * process.
	 */
	if ((from_kernel && dp->door_target != &p0) ||
	    (!from_kernel && dp->door_target != curproc)) {
		mutex_exit(&door_knob);
		return (EPERM);
	}

	switch (type) {
	case DOOR_PARAM_DESC_MAX:
		if (val > INT_MAX)
			error = ERANGE;
		else if ((dp->door_flags & DOOR_REFUSE_DESC) && val != 0)
			error = ENOTSUP;
		else
			dp->door_desc_max = (uint_t)val;
		break;

	case DOOR_PARAM_DATA_MIN:
		if (val > dp->door_data_max)
			error = EINVAL;
		else
			dp->door_data_min = val;
		break;

	case DOOR_PARAM_DATA_MAX:
		if (val < dp->door_data_min)
			error = EINVAL;
		else
			dp->door_data_max = val;
		break;

	default:
		error = EINVAL;
		break;
	}

	mutex_exit(&door_knob);
	return (error);
}

static int
door_getparam_common(door_node_t *dp, int type, size_t *out)
{
	int error = 0;

	mutex_enter(&door_knob);
	switch (type) {
	case DOOR_PARAM_DESC_MAX:
		*out = (size_t)dp->door_desc_max;
		break;
	case DOOR_PARAM_DATA_MIN:
		*out = dp->door_data_min;
		break;
	case DOOR_PARAM_DATA_MAX:
		*out = dp->door_data_max;
		break;
	default:
		error = EINVAL;
		break;
	}
	mutex_exit(&door_knob);
	return (error);
}

int
door_setparam(int did, int type, size_t val)
{
	door_node_t *dp;
	int error = 0;

	if ((dp = door_lookup(did, NULL)) == NULL)
		return (set_errno(EBADF));

	error = door_setparam_common(dp, 0, type, val);

	releasef(did);

	if (error)
		return (set_errno(error));

	return (0);
}

int
door_getparam(int did, int type, size_t *out)
{
	door_node_t *dp;
	size_t val = 0;
	int error = 0;

	if ((dp = door_lookup(did, NULL)) == NULL)
		return (set_errno(EBADF));

	error = door_getparam_common(dp, type, &val);

	releasef(did);

	if (error)
		return (set_errno(error));

	if (get_udatamodel() == DATAMODEL_NATIVE) {
		if (copyout(&val, out, sizeof (val)))
			return (set_errno(EFAULT));
#ifdef _SYSCALL32_IMPL
	} else {
		size32_t val32 = (size32_t)val;

		if (val != val32)
			return (set_errno(EOVERFLOW));

		if (copyout(&val32, out, sizeof (val32)))
			return (set_errno(EFAULT));
#endif /* _SYSCALL32_IMPL */
	}

	return (0);
}

/*
 * A copyout() which proceeds from high addresses to low addresses.  This way,
 * stack guard pages are effective.
 *
 * Note that we use copyout_nowatch();  this is called while the client is
 * held.
 */
static int
door_stack_copyout(const void *kaddr, void *uaddr, size_t count)
{
	const char *kbase = (const char *)kaddr;
	uintptr_t ubase = (uintptr_t)uaddr;
	size_t pgsize = PAGESIZE;

	if (count <= pgsize)
		return (copyout_nowatch(kaddr, uaddr, count));

	while (count > 0) {
		uintptr_t start, end, offset, amount;

		end = ubase + count;
		start = P2ALIGN(end - 1, pgsize);
		if (P2ALIGN(ubase, pgsize) == start)
			start = ubase;

		offset = start - ubase;
		amount = end - start;

		ASSERT(amount > 0 && amount <= count && amount <= pgsize);