[PHP] fix: preserve queued datagrams under receive overflow

crates/kernel/src/wakeup.rs

@@ -1,8 +1,9 @@
 //! Wakeup event buffer for kernel-driven poll/select notification.
 //!
-//! When pipe operations or listener accept queues change readiness state,
-//! events are pushed into a global buffer. The host drains this buffer after
-//! each syscall to wake only the specific waiters that are affected.
+//! When pipe operations, listener accept queues, or AF_UNIX datagram send
+//! state changes readiness, events are pushed into a global buffer. The host
+//! drains this buffer after each syscall and wakes targeted waiters where an
+//! identity is available or performs a bounded broad retry otherwise.
 
 use alloc::vec::Vec;
 use core::cell::UnsafeCell;
@@ -16,6 +17,14 @@ pub const WAKE_WRITABLE: u8 = 2;
 /// Listener accept queue received a pending connection.
 pub const WAKE_ACCEPT: u8 = 4;
 
+/// AF_UNIX datagram send readiness or its immediate result changed.
+///
+/// Datagram writers do not have a pipe index that the host can target. The
+/// host therefore retries untargeted blocked sends and issues a broad
+/// readiness wake for poll/select/epoll operations when capacity,
+/// associations, shutdown, close, or pathname state changes.
+pub const WAKE_DATAGRAM_WRITABLE: u8 = 8;
+
 /// A readiness change event.
 #[derive(Debug, Clone, Copy)]
 pub struct WakeupEvent {
@@ -57,6 +66,12 @@ pub fn push_accept(accept_idx: u32) {
     push(accept_idx, WAKE_ACCEPT);
 }
 
+/// Notify the host that AF_UNIX datagram send readiness or its immediate
+/// outcome may have changed.
+pub fn push_datagram_writable() {
+    push(0, WAKE_DATAGRAM_WRITABLE);
+}
+
 /// Drain all pending wakeup events, writing them to the output buffer.
 /// Returns the number of events written.
 ///
@@ -101,10 +116,11 @@ mod tests {
         push(5, WAKE_READABLE);
         push(10, WAKE_WRITABLE);
         push_accept(12);
+        push_datagram_writable();
 
-        let mut buf = [0u8; 20];
+        let mut buf = [0u8; 25];
         let count = drain(&mut buf, 10);
-        assert_eq!(count, 3);
+        assert_eq!(count, 4);
 
         // Event 0: pipe_idx=5, WAKE_READABLE
         assert_eq!(u32::from_le_bytes([buf[0], buf[1], buf[2], buf[3]]), 5);
@@ -118,6 +134,10 @@ mod tests {
         assert_eq!(u32::from_le_bytes([buf[10], buf[11], buf[12], buf[13]]), 12);
         assert_eq!(buf[14], WAKE_ACCEPT);
 
+        // Event 3: broad datagram-writable readiness change.
+        assert_eq!(u32::from_le_bytes([buf[15], buf[16], buf[17], buf[18]]), 0);
+        assert_eq!(buf[19], WAKE_DATAGRAM_WRITABLE);
+
         // Buffer should be empty now
         let count2 = drain(&mut buf, 10);
         assert_eq!(count2, 0);

docs/architecture.md

@@ -506,6 +506,18 @@ Offset   Size   Field
 
 User-visible networking is POSIX-first. Guest programs call normal AF_UNIX, AF_INET, and partial AF_INET6 socket syscalls (`socket`, `bind`, `connect`, `listen`, `accept`, `send`, `recv`, `sendto`, `recvfrom`, `poll`, and `select`). The Rust kernel owns the socket file descriptors, datagram queues, stream listener state, loopback routing, and errno behavior. Host transports plug in below that layer through `NetworkIO`; they are backends, not the userspace-visible abstraction.
 
+AF_INET and AF_INET6 receive queues are currently bounded at 128 datagrams per
+socket. Once that fixed internal queue is full, a newly arriving UDP datagram
+is dropped and the already-queued datagrams retain their order. `SO_RCVBUF`
+requests are stored but do not size this queue; `getsockopt` continues to report
+the fixed default capacity. AF_UNIX datagrams use the same bounded storage but
+are reliable: a full receive queue makes the send enter the host's blocking
+retry path, or returns `EAGAIN` immediately for an `O_NONBLOCK` or
+`MSG_DONTWAIT` send, without discarding queued messages. Queue-capacity,
+association, shutdown, close, and pathname changes wake blocked writers and
+writable readiness waiters so they can observe either capacity or the new
+immediate error.
+
 Loopback addresses are scoped to one Kandelo machine, but not every socket path is machine-wide yet. IPv4 and IPv6 loopback TCP and AF_UNIX streams have explicit cross-process paths. Current in-kernel IPv4/IPv6 loopback datagrams, AF_UNIX datagrams, and IPv4 multicast delivery are confined to the sending process. Forked sockets retain their kernel-local bind reservations and local lookup targets, but host-backed UDP endpoint registrations are not yet shared or transferred between processes. AF_INET6 represents `sockaddr_in6`, supports `::`/`::1`, and models dual-stack wildcard stream-port reservation, but it has no external or virtual-network IPv6 transport and no IPv6 multicast delivery. AF_INET6 datagrams therefore report `IPV6_V6ONLY=1`; disabling it fails until dual-stack datagram routing exists.
 
 Routed virtual IPv4 addresses are explicit backend addresses. For example, the browser network lab attaches separate machines to addresses such as `10.88.0.2`, `10.88.0.3`, and `10.88.0.4`; traffic to `127.0.0.1` stays inside one machine, while traffic to those virtual addresses can cross machines through the backend.

docs/posix-status.md

@@ -235,9 +235,9 @@ shortcuts.
 | `accept()` / `accept4()` | Partial | AF_INET TCP delegates to the active HostIO networking backend; AF_UNIX and AF_INET6 loopback streams return connected sockets from kernel queues. A dual-stack IPv6 listener reports IPv4 peers as IPv4-mapped `sockaddr_in6`. Linux-style accept does not inherit O_NONBLOCK; accept4 applies SOCK_NONBLOCK and SOCK_CLOEXEC explicitly and rejects other flags before consuming a pending connection. Datagram accept rejects as unsupported. |
 | `connect()` | Partial | AF_UNIX streams support same- and cross-process pathname or abstract-namespace listeners. AF_UNIX datagrams deliver to a registered peer only within the same process; a missing, wrong-type, or cross-process peer returns ECONNREFUSED until machine-wide datagram routing exists. AF_INET TCP is host-backed and works over Node external TCP or the browser local virtual-network backend. AF_INET UDP connect stores the peer, auto-binds an ephemeral local port when needed, filters receives to the connected peer, and supports AF_UNSPEC unconnect. AF_INET6 streams support same- and cross-process `::1`; AF_INET6 datagrams are process-local and report `IPV6_V6ONLY=1` because dual-stack datagram routing is not implemented. Non-loopback IPv6 fails with EADDRNOTAVAIL for streams and ENETUNREACH for datagrams. External raw UDP also returns ENETUNREACH without another HostIO transport. |
 | `send()` / `recv()` | Partial | Unix domain streams and datagrams, AF_INET/AF_INET6 TCP streams, and connected AF_INET/AF_INET6 UDP preserve their socket-family addressing and datagram boundaries. TCP send/recv works over Node external TCP and the local virtual-network backend. Datagram MSG_PEEK and MSG_DONTWAIT are handled through recvfrom. Normal TCP close drains queued bytes before FIN and EOF; no transport invents a fixed post-FIN write count. A send rejected by a closed/reset stream returns EPIPE and raises SIGPIPE, while direct host/virtual handles may preserve ECONNRESET; accepted pipe-bridged resets currently surface as EOF/EPIPE. MSG_NOSIGNAL suppresses SIGPIPE without changing the errno. |
-| `sendto()` / `recvfrom()` | Partial | AF_INET, AF_INET6, and AF_UNIX datagrams support connected and unconnected send, receive queues, and connected-peer filtering. IPv4/IPv6 return sender addresses; AF_UNIX currently returns only the family. In-kernel IPv4/IPv6 loopback, AF_UNIX datagram, and IPv4 multicast delivery currently reaches sockets in the sender's process only; machine-wide cross-process datagram routing remains unimplemented. Fork preserves kernel-local bind reservations and lookup ownership, but it does not yet share or transfer a host-backed UDP registration. The `10.88.*` LocalVirtualNetwork path can route IPv4 datagrams between attached Kandelo machines through HostIO for the process that registered the endpoint. IPv4 multicast supports interface selection, loop suppression, membership, and source filtering only; IPv6 multicast and external raw UDP are not implemented. |
+| `sendto()` / `recvfrom()` | Partial | AF_INET, AF_INET6, and AF_UNIX datagrams support connected and unconnected send, receive queues, and connected-peer filtering. IPv4/IPv6 return sender addresses; AF_UNIX currently returns only the family. IPv4/IPv6 UDP receive queues hold 128 datagrams and drop a new arrival once full, preserving the accepted queue's order; `SO_RCVBUF` requests do not size that fixed queue, and `getsockopt` reports the fixed default capacity. AF_UNIX uses the same bound but preserves reliable delivery: a full queue blocks a blocking send through host retry and returns EAGAIN for `O_NONBLOCK`/`MSG_DONTWAIT`; capacity, association, shutdown, close, and pathname changes wake blocked sends and writable readiness waits to observe capacity or the new immediate error. In-kernel IPv4/IPv6 loopback, AF_UNIX datagram, and IPv4 multicast delivery currently reaches sockets in the sender's process only; machine-wide cross-process datagram routing remains unimplemented. Fork preserves kernel-local bind reservations and lookup ownership, but it does not yet share or transfer a host-backed UDP registration. The `10.88.*` LocalVirtualNetwork path can route IPv4 datagrams between attached Kandelo machines through HostIO for the process that registered the endpoint. IPv4 multicast supports interface selection, loop suppression, membership, and source filtering only; IPv6 multicast and external raw UDP are not implemented. |
 | `setsockopt()` / `getsockopt()` | Partial | SOL_SOCKET exposes SO_TYPE, SO_DOMAIN, SO_ERROR, SO_ACCEPTCONN, SO_RCVBUF, and SO_SNDBUF; SO_REUSEADDR affects UDP bind conflicts. SO_LINGER uses `struct linger`; its disabled form is stored, while enabling timed or reset-style linger returns EOPNOTSUPP until every transport supports the close mode. SO_BINDTODEVICE validates `lo`/`eth0`, supports empty-name unbind, and constrains bind/connect/send routing. TCP_CONGESTION uses a string layout and accepts only the modeled `cubic` policy; selecting unimplemented algorithms fails. IPv4 multicast membership/source-filter options drive process-local loopback delivery. IPV6_V6ONLY controls pre-bind stream dual-stack behavior; AF_INET6 datagrams truthfully remain V6-only. Other accepted IPv6 multicast options are stored but do not provide IPv6 multicast transport. |
-| `shutdown()` | Partial | SHUT_RD, SHUT_WR, and SHUT_RDWR transitions are idempotent within a process and release each owned pipe/host reference once. UDP write shutdown returns EPIPE on datagram send; read shutdown is EOF-like for recv/poll. Fork-inherited sockets still clone shutdown flags per process instead of sharing one socket-wide shutdown state, and the external host ABI has no half-shutdown operation. |
+| `shutdown()` | Partial | SHUT_RD, SHUT_WR, and SHUT_RDWR transitions are idempotent within a process and release each owned pipe/host reference once. UDP write shutdown returns EPIPE on datagram send; read shutdown is EOF-like for recv/poll. Sending to a read-shut AF_UNIX datagram peer returns EPIPE (and SIGPIPE unless MSG_NOSIGNAL is used), and the transition wakes blocked sends/readiness waits. Fork-inherited sockets still clone shutdown flags per process instead of sharing one socket-wide shutdown state, and the external host ABI has no half-shutdown operation. |
 | `select()` | Partial | Wrapper around poll(). Converts fd_set bitmasks to pollfd array. Timeout supported via polling loop. |
 | `poll()` | Partial | Checks readiness for regular files, pipes, and sockets. UDP poll reports queued datagrams, connected-peer filtering, EOF-like read shutdown, write-shutdown hangup, and pending socket errors. Timeout supported via polling loop with 1ms sleep intervals. Returns EINTR on pending signals. |
 | `ppoll()` | Full | Wraps poll() with atomic signal mask swap: save → set → poll → restore. Timespec converted to timeout_ms in glue layer. |