xref: /freebsd/sys/kern/uipc_socket.c (revision 87569f75a91f298c52a71823c04d41cf53c88889)
1 /*-
2  * Copyright (c) 1982, 1986, 1988, 1990, 1993
3  *	The Regents of the University of California.  All rights reserved.
4  * Copyright (c) 2004 The FreeBSD Foundation
5  * Copyright (c) 2004-2006 Robert N. M. Watson
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  * 4. Neither the name of the University nor the names of its contributors
16  *    may be used to endorse or promote products derived from this software
17  *    without specific prior written permission.
18  *
19  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
20  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
23  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29  * SUCH DAMAGE.
30  *
31  *	@(#)uipc_socket.c	8.3 (Berkeley) 4/15/94
32  */
33 
34 #include <sys/cdefs.h>
35 __FBSDID("$FreeBSD$");
36 
37 #include "opt_inet.h"
38 #include "opt_mac.h"
39 #include "opt_zero.h"
40 #include "opt_compat.h"
41 
42 #include <sys/param.h>
43 #include <sys/systm.h>
44 #include <sys/fcntl.h>
45 #include <sys/limits.h>
46 #include <sys/lock.h>
47 #include <sys/mac.h>
48 #include <sys/malloc.h>
49 #include <sys/mbuf.h>
50 #include <sys/mutex.h>
51 #include <sys/domain.h>
52 #include <sys/file.h>			/* for struct knote */
53 #include <sys/kernel.h>
54 #include <sys/event.h>
55 #include <sys/poll.h>
56 #include <sys/proc.h>
57 #include <sys/protosw.h>
58 #include <sys/socket.h>
59 #include <sys/socketvar.h>
60 #include <sys/resourcevar.h>
61 #include <sys/signalvar.h>
62 #include <sys/sysctl.h>
63 #include <sys/uio.h>
64 #include <sys/jail.h>
65 
66 #include <vm/uma.h>
67 
68 #ifdef COMPAT_IA32
69 #include <sys/mount.h>
70 #include <compat/freebsd32/freebsd32.h>
71 
72 extern struct sysentvec ia32_freebsd_sysvec;
73 #endif
74 
75 static int	soreceive_rcvoob(struct socket *so, struct uio *uio,
76 		    int flags);
77 
78 static void	filt_sordetach(struct knote *kn);
79 static int	filt_soread(struct knote *kn, long hint);
80 static void	filt_sowdetach(struct knote *kn);
81 static int	filt_sowrite(struct knote *kn, long hint);
82 static int	filt_solisten(struct knote *kn, long hint);
83 
84 static struct filterops solisten_filtops =
85 	{ 1, NULL, filt_sordetach, filt_solisten };
86 static struct filterops soread_filtops =
87 	{ 1, NULL, filt_sordetach, filt_soread };
88 static struct filterops sowrite_filtops =
89 	{ 1, NULL, filt_sowdetach, filt_sowrite };
90 
91 uma_zone_t socket_zone;
92 so_gen_t	so_gencnt;	/* generation count for sockets */
93 
94 MALLOC_DEFINE(M_SONAME, "soname", "socket name");
95 MALLOC_DEFINE(M_PCB, "pcb", "protocol control block");
96 
97 SYSCTL_DECL(_kern_ipc);
98 
99 static int somaxconn = SOMAXCONN;
100 static int somaxconn_sysctl(SYSCTL_HANDLER_ARGS);
101 /* XXX: we dont have SYSCTL_USHORT */
102 SYSCTL_PROC(_kern_ipc, KIPC_SOMAXCONN, somaxconn, CTLTYPE_UINT | CTLFLAG_RW,
103     0, sizeof(int), somaxconn_sysctl, "I", "Maximum pending socket connection "
104     "queue size");
105 static int numopensockets;
106 SYSCTL_INT(_kern_ipc, OID_AUTO, numopensockets, CTLFLAG_RD,
107     &numopensockets, 0, "Number of open sockets");
108 #ifdef ZERO_COPY_SOCKETS
109 /* These aren't static because they're used in other files. */
110 int so_zero_copy_send = 1;
111 int so_zero_copy_receive = 1;
112 SYSCTL_NODE(_kern_ipc, OID_AUTO, zero_copy, CTLFLAG_RD, 0,
113     "Zero copy controls");
114 SYSCTL_INT(_kern_ipc_zero_copy, OID_AUTO, receive, CTLFLAG_RW,
115     &so_zero_copy_receive, 0, "Enable zero copy receive");
116 SYSCTL_INT(_kern_ipc_zero_copy, OID_AUTO, send, CTLFLAG_RW,
117     &so_zero_copy_send, 0, "Enable zero copy send");
118 #endif /* ZERO_COPY_SOCKETS */
119 
120 /*
121  * accept_mtx locks down per-socket fields relating to accept queues.  See
122  * socketvar.h for an annotation of the protected fields of struct socket.
123  */
124 struct mtx accept_mtx;
125 MTX_SYSINIT(accept_mtx, &accept_mtx, "accept", MTX_DEF);
126 
127 /*
128  * so_global_mtx protects so_gencnt, numopensockets, and the per-socket
129  * so_gencnt field.
130  */
131 static struct mtx so_global_mtx;
132 MTX_SYSINIT(so_global_mtx, &so_global_mtx, "so_glabel", MTX_DEF);
133 
134 /*
135  * Socket operation routines.
136  * These routines are called by the routines in
137  * sys_socket.c or from a system process, and
138  * implement the semantics of socket operations by
139  * switching out to the protocol specific routines.
140  */
141 
142 /*
143  * Get a socket structure from our zone, and initialize it.
144  * Note that it would probably be better to allocate socket
145  * and PCB at the same time, but I'm not convinced that all
146  * the protocols can be easily modified to do this.
147  *
148  * soalloc() returns a socket with a ref count of 0.
149  */
150 struct socket *
151 soalloc(int mflags)
152 {
153 	struct socket *so;
154 
155 	so = uma_zalloc(socket_zone, mflags | M_ZERO);
156 	if (so != NULL) {
157 #ifdef MAC
158 		if (mac_init_socket(so, mflags) != 0) {
159 			uma_zfree(socket_zone, so);
160 			return (NULL);
161 		}
162 #endif
163 		SOCKBUF_LOCK_INIT(&so->so_snd, "so_snd");
164 		SOCKBUF_LOCK_INIT(&so->so_rcv, "so_rcv");
165 		TAILQ_INIT(&so->so_aiojobq);
166 		mtx_lock(&so_global_mtx);
167 		so->so_gencnt = ++so_gencnt;
168 		++numopensockets;
169 		mtx_unlock(&so_global_mtx);
170 	}
171 	return (so);
172 }
173 
174 /*
175  * socreate returns a socket with a ref count of 1.  The socket should be
176  * closed with soclose().
177  */
178 int
179 socreate(dom, aso, type, proto, cred, td)
180 	int dom;
181 	struct socket **aso;
182 	int type;
183 	int proto;
184 	struct ucred *cred;
185 	struct thread *td;
186 {
187 	struct protosw *prp;
188 	struct socket *so;
189 	int error;
190 
191 	if (proto)
192 		prp = pffindproto(dom, proto, type);
193 	else
194 		prp = pffindtype(dom, type);
195 
196 	if (prp == NULL || prp->pr_usrreqs->pru_attach == NULL ||
197 	    prp->pr_usrreqs->pru_attach == pru_attach_notsupp)
198 		return (EPROTONOSUPPORT);
199 
200 	if (jailed(cred) && jail_socket_unixiproute_only &&
201 	    prp->pr_domain->dom_family != PF_LOCAL &&
202 	    prp->pr_domain->dom_family != PF_INET &&
203 	    prp->pr_domain->dom_family != PF_ROUTE) {
204 		return (EPROTONOSUPPORT);
205 	}
206 
207 	if (prp->pr_type != type)
208 		return (EPROTOTYPE);
209 	so = soalloc(M_WAITOK);
210 	if (so == NULL)
211 		return (ENOBUFS);
212 
213 	TAILQ_INIT(&so->so_incomp);
214 	TAILQ_INIT(&so->so_comp);
215 	so->so_type = type;
216 	so->so_cred = crhold(cred);
217 	so->so_proto = prp;
218 #ifdef MAC
219 	mac_create_socket(cred, so);
220 #endif
221 	knlist_init(&so->so_rcv.sb_sel.si_note, SOCKBUF_MTX(&so->so_rcv),
222 	    NULL, NULL, NULL);
223 	knlist_init(&so->so_snd.sb_sel.si_note, SOCKBUF_MTX(&so->so_snd),
224 	    NULL, NULL, NULL);
225 	so->so_count = 1;
226 	error = (*prp->pr_usrreqs->pru_attach)(so, proto, td);
227 	if (error) {
228 		ACCEPT_LOCK();
229 		SOCK_LOCK(so);
230 		so->so_state |= SS_NOFDREF;
231 		sorele(so);
232 		return (error);
233 	}
234 	*aso = so;
235 	return (0);
236 }
237 
238 int
239 sobind(so, nam, td)
240 	struct socket *so;
241 	struct sockaddr *nam;
242 	struct thread *td;
243 {
244 
245 	return ((*so->so_proto->pr_usrreqs->pru_bind)(so, nam, td));
246 }
247 
248 void
249 sodealloc(struct socket *so)
250 {
251 
252 	KASSERT(so->so_count == 0, ("sodealloc(): so_count %d", so->so_count));
253 	mtx_lock(&so_global_mtx);
254 	so->so_gencnt = ++so_gencnt;
255 	mtx_unlock(&so_global_mtx);
256 	if (so->so_rcv.sb_hiwat)
257 		(void)chgsbsize(so->so_cred->cr_uidinfo,
258 		    &so->so_rcv.sb_hiwat, 0, RLIM_INFINITY);
259 	if (so->so_snd.sb_hiwat)
260 		(void)chgsbsize(so->so_cred->cr_uidinfo,
261 		    &so->so_snd.sb_hiwat, 0, RLIM_INFINITY);
262 #ifdef INET
263 	/* remove acccept filter if one is present. */
264 	if (so->so_accf != NULL)
265 		do_setopt_accept_filter(so, NULL);
266 #endif
267 #ifdef MAC
268 	mac_destroy_socket(so);
269 #endif
270 	crfree(so->so_cred);
271 	SOCKBUF_LOCK_DESTROY(&so->so_snd);
272 	SOCKBUF_LOCK_DESTROY(&so->so_rcv);
273 	uma_zfree(socket_zone, so);
274 	mtx_lock(&so_global_mtx);
275 	--numopensockets;
276 	mtx_unlock(&so_global_mtx);
277 }
278 
279 /*
280  * solisten() transitions a socket from a non-listening state to a listening
281  * state, but can also be used to update the listen queue depth on an
282  * existing listen socket.  The protocol will call back into the sockets
283  * layer using solisten_proto_check() and solisten_proto() to check and set
284  * socket-layer listen state.  Call backs are used so that the protocol can
285  * acquire both protocol and socket layer locks in whatever order is required
286  * by the protocol.
287  *
288  * Protocol implementors are advised to hold the socket lock across the
289  * socket-layer test and set to avoid races at the socket layer.
290  */
291 int
292 solisten(so, backlog, td)
293 	struct socket *so;
294 	int backlog;
295 	struct thread *td;
296 {
297 
298 	return ((*so->so_proto->pr_usrreqs->pru_listen)(so, backlog, td));
299 }
300 
301 int
302 solisten_proto_check(so)
303 	struct socket *so;
304 {
305 
306 	SOCK_LOCK_ASSERT(so);
307 
308 	if (so->so_state & (SS_ISCONNECTED | SS_ISCONNECTING |
309 	    SS_ISDISCONNECTING))
310 		return (EINVAL);
311 	return (0);
312 }
313 
314 void
315 solisten_proto(so, backlog)
316 	struct socket *so;
317 	int backlog;
318 {
319 
320 	SOCK_LOCK_ASSERT(so);
321 
322 	if (backlog < 0 || backlog > somaxconn)
323 		backlog = somaxconn;
324 	so->so_qlimit = backlog;
325 	so->so_options |= SO_ACCEPTCONN;
326 }
327 
328 /*
329  * Attempt to free a socket.  This should really be sotryfree().
330  *
331  * We free the socket if the protocol is no longer interested in the socket,
332  * there's no file descriptor reference, and the refcount is 0.  While the
333  * calling macro sotryfree() tests the refcount, sofree() has to test it
334  * again as it's possible to race with an accept()ing thread if the socket is
335  * in an listen queue of a listen socket, as being in the listen queue
336  * doesn't elevate the reference count.  sofree() acquires the accept mutex
337  * early for this test in order to avoid that race.
338  */
339 void
340 sofree(so)
341 	struct socket *so;
342 {
343 	struct socket *head;
344 
345 	ACCEPT_LOCK_ASSERT();
346 	SOCK_LOCK_ASSERT(so);
347 
348 	if (so->so_pcb != NULL || (so->so_state & SS_NOFDREF) == 0 ||
349 	    so->so_count != 0 || (so->so_state & SS_PROTOREF)) {
350 		SOCK_UNLOCK(so);
351 		ACCEPT_UNLOCK();
352 		return;
353 	}
354 
355 	head = so->so_head;
356 	if (head != NULL) {
357 		KASSERT((so->so_qstate & SQ_COMP) != 0 ||
358 		    (so->so_qstate & SQ_INCOMP) != 0,
359 		    ("sofree: so_head != NULL, but neither SQ_COMP nor "
360 		    "SQ_INCOMP"));
361 		KASSERT((so->so_qstate & SQ_COMP) == 0 ||
362 		    (so->so_qstate & SQ_INCOMP) == 0,
363 		    ("sofree: so->so_qstate is SQ_COMP and also SQ_INCOMP"));
364 		/*
365 		 * accept(2) is responsible draining the completed
366 		 * connection queue and freeing those sockets, so
367 		 * we just return here if this socket is currently
368 		 * on the completed connection queue.  Otherwise,
369 		 * accept(2) may hang after select(2) has indicating
370 		 * that a listening socket was ready.  If it's an
371 		 * incomplete connection, we remove it from the queue
372 		 * and free it; otherwise, it won't be released until
373 		 * the listening socket is closed.
374 		 */
375 		if ((so->so_qstate & SQ_COMP) != 0) {
376 			SOCK_UNLOCK(so);
377 			ACCEPT_UNLOCK();
378 			return;
379 		}
380 		TAILQ_REMOVE(&head->so_incomp, so, so_list);
381 		head->so_incqlen--;
382 		so->so_qstate &= ~SQ_INCOMP;
383 		so->so_head = NULL;
384 	}
385 	KASSERT((so->so_qstate & SQ_COMP) == 0 &&
386 	    (so->so_qstate & SQ_INCOMP) == 0,
387 	    ("sofree: so_head == NULL, but still SQ_COMP(%d) or SQ_INCOMP(%d)",
388 	    so->so_qstate & SQ_COMP, so->so_qstate & SQ_INCOMP));
389 	SOCK_UNLOCK(so);
390 	ACCEPT_UNLOCK();
391 	SOCKBUF_LOCK(&so->so_snd);
392 	so->so_snd.sb_flags |= SB_NOINTR;
393 	(void)sblock(&so->so_snd, M_WAITOK);
394 	/*
395 	 * socantsendmore_locked() drops the socket buffer mutex so that it
396 	 * can safely perform wakeups.  Re-acquire the mutex before
397 	 * continuing.
398 	 */
399 	socantsendmore_locked(so);
400 	SOCKBUF_LOCK(&so->so_snd);
401 	sbunlock(&so->so_snd);
402 	sbrelease_locked(&so->so_snd, so);
403 	SOCKBUF_UNLOCK(&so->so_snd);
404 	sorflush(so);
405 	knlist_destroy(&so->so_rcv.sb_sel.si_note);
406 	knlist_destroy(&so->so_snd.sb_sel.si_note);
407 	sodealloc(so);
408 }
409 
410 /*
411  * Close a socket on last file table reference removal.
412  * Initiate disconnect if connected.
413  * Free socket when disconnect complete.
414  *
415  * This function will sorele() the socket.  Note that soclose() may be
416  * called prior to the ref count reaching zero.  The actual socket
417  * structure will not be freed until the ref count reaches zero.
418  */
419 int
420 soclose(so)
421 	struct socket *so;
422 {
423 	int error = 0;
424 
425 	KASSERT(!(so->so_state & SS_NOFDREF), ("soclose: SS_NOFDREF on enter"));
426 
427 	funsetown(&so->so_sigio);
428 	if (so->so_options & SO_ACCEPTCONN) {
429 		struct socket *sp;
430 		ACCEPT_LOCK();
431 		while ((sp = TAILQ_FIRST(&so->so_incomp)) != NULL) {
432 			TAILQ_REMOVE(&so->so_incomp, sp, so_list);
433 			so->so_incqlen--;
434 			sp->so_qstate &= ~SQ_INCOMP;
435 			sp->so_head = NULL;
436 			ACCEPT_UNLOCK();
437 			soabort(sp);
438 			ACCEPT_LOCK();
439 		}
440 		while ((sp = TAILQ_FIRST(&so->so_comp)) != NULL) {
441 			TAILQ_REMOVE(&so->so_comp, sp, so_list);
442 			so->so_qlen--;
443 			sp->so_qstate &= ~SQ_COMP;
444 			sp->so_head = NULL;
445 			ACCEPT_UNLOCK();
446 			soabort(sp);
447 			ACCEPT_LOCK();
448 		}
449 		ACCEPT_UNLOCK();
450 	}
451 	if (so->so_pcb == NULL)
452 		goto discard;
453 	if (so->so_state & SS_ISCONNECTED) {
454 		if ((so->so_state & SS_ISDISCONNECTING) == 0) {
455 			error = sodisconnect(so);
456 			if (error)
457 				goto drop;
458 		}
459 		if (so->so_options & SO_LINGER) {
460 			if ((so->so_state & SS_ISDISCONNECTING) &&
461 			    (so->so_state & SS_NBIO))
462 				goto drop;
463 			while (so->so_state & SS_ISCONNECTED) {
464 				error = tsleep(&so->so_timeo,
465 				    PSOCK | PCATCH, "soclos", so->so_linger * hz);
466 				if (error)
467 					break;
468 			}
469 		}
470 	}
471 drop:
472 	if (so->so_pcb != NULL) {
473 		int error2 = (*so->so_proto->pr_usrreqs->pru_detach)(so);
474 		if (error == 0)
475 			error = error2;
476 	}
477 discard:
478 	ACCEPT_LOCK();
479 	SOCK_LOCK(so);
480 	KASSERT((so->so_state & SS_NOFDREF) == 0, ("soclose: NOFDREF"));
481 	so->so_state |= SS_NOFDREF;
482 	sorele(so);
483 	return (error);
484 }
485 
486 /*
487  * soabort() must not be called with any socket locks held, as it calls
488  * into the protocol, which will call back into the socket code causing
489  * it to acquire additional socket locks that may cause recursion or lock
490  * order reversals.
491  */
492 void
493 soabort(so)
494 	struct socket *so;
495 {
496 	int error;
497 
498 	error = (*so->so_proto->pr_usrreqs->pru_abort)(so);
499 	if (error) {
500 		ACCEPT_LOCK();
501 		SOCK_LOCK(so);
502 		sotryfree(so);	/* note: does not decrement the ref count */
503 	}
504 }
505 
506 int
507 soaccept(so, nam)
508 	struct socket *so;
509 	struct sockaddr **nam;
510 {
511 	int error;
512 
513 	SOCK_LOCK(so);
514 	KASSERT((so->so_state & SS_NOFDREF) != 0, ("soaccept: !NOFDREF"));
515 	so->so_state &= ~SS_NOFDREF;
516 	SOCK_UNLOCK(so);
517 	error = (*so->so_proto->pr_usrreqs->pru_accept)(so, nam);
518 	return (error);
519 }
520 
521 int
522 soconnect(so, nam, td)
523 	struct socket *so;
524 	struct sockaddr *nam;
525 	struct thread *td;
526 {
527 	int error;
528 
529 	if (so->so_options & SO_ACCEPTCONN)
530 		return (EOPNOTSUPP);
531 	/*
532 	 * If protocol is connection-based, can only connect once.
533 	 * Otherwise, if connected, try to disconnect first.
534 	 * This allows user to disconnect by connecting to, e.g.,
535 	 * a null address.
536 	 */
537 	if (so->so_state & (SS_ISCONNECTED|SS_ISCONNECTING) &&
538 	    ((so->so_proto->pr_flags & PR_CONNREQUIRED) ||
539 	    (error = sodisconnect(so)))) {
540 		error = EISCONN;
541 	} else {
542 		/*
543 		 * Prevent accumulated error from previous connection
544 		 * from biting us.
545 		 */
546 		so->so_error = 0;
547 		error = (*so->so_proto->pr_usrreqs->pru_connect)(so, nam, td);
548 	}
549 
550 	return (error);
551 }
552 
553 int
554 soconnect2(so1, so2)
555 	struct socket *so1;
556 	struct socket *so2;
557 {
558 
559 	return ((*so1->so_proto->pr_usrreqs->pru_connect2)(so1, so2));
560 }
561 
562 int
563 sodisconnect(so)
564 	struct socket *so;
565 {
566 	int error;
567 
568 	if ((so->so_state & SS_ISCONNECTED) == 0)
569 		return (ENOTCONN);
570 	if (so->so_state & SS_ISDISCONNECTING)
571 		return (EALREADY);
572 	error = (*so->so_proto->pr_usrreqs->pru_disconnect)(so);
573 	return (error);
574 }
575 
576 #ifdef ZERO_COPY_SOCKETS
577 struct so_zerocopy_stats{
578 	int size_ok;
579 	int align_ok;
580 	int found_ifp;
581 };
582 struct so_zerocopy_stats so_zerocp_stats = {0,0,0};
583 #include <netinet/in.h>
584 #include <net/route.h>
585 #include <netinet/in_pcb.h>
586 #include <vm/vm.h>
587 #include <vm/vm_page.h>
588 #include <vm/vm_object.h>
589 #endif /*ZERO_COPY_SOCKETS*/
590 
591 /*
592  * sosend_copyin() accepts a uio and prepares an mbuf chain holding part or
593  * all of the data referenced by the uio.  If desired, it uses zero-copy.
594  * *space will be updated to reflect data copied in.
595  *
596  * NB: If atomic I/O is requested, the caller must already have checked that
597  * space can hold resid bytes.
598  *
599  * NB: In the event of an error, the caller may need to free the partial
600  * chain pointed to by *mpp.  The contents of both *uio and *space may be
601  * modified even in the case of an error.
602  */
603 static int
604 sosend_copyin(struct uio *uio, struct mbuf **retmp, int atomic, long *space,
605     int flags)
606 {
607 	struct mbuf *m, **mp, *top;
608 	long len, resid;
609 	int error;
610 #ifdef ZERO_COPY_SOCKETS
611 	int cow_send;
612 #endif
613 
614 	*retmp = top = NULL;
615 	mp = &top;
616 	len = 0;
617 	resid = uio->uio_resid;
618 	error = 0;
619 	do {
620 #ifdef ZERO_COPY_SOCKETS
621 		cow_send = 0;
622 #endif /* ZERO_COPY_SOCKETS */
623 		if (resid >= MINCLSIZE) {
624 #ifdef ZERO_COPY_SOCKETS
625 			if (top == NULL) {
626 				MGETHDR(m, M_TRYWAIT, MT_DATA);
627 				if (m == NULL) {
628 					error = ENOBUFS;
629 					goto out;
630 				}
631 				m->m_pkthdr.len = 0;
632 				m->m_pkthdr.rcvif = NULL;
633 			} else {
634 				MGET(m, M_TRYWAIT, MT_DATA);
635 				if (m == NULL) {
636 					error = ENOBUFS;
637 					goto out;
638 				}
639 			}
640 			if (so_zero_copy_send &&
641 			    resid>=PAGE_SIZE &&
642 			    *space>=PAGE_SIZE &&
643 			    uio->uio_iov->iov_len>=PAGE_SIZE) {
644 				so_zerocp_stats.size_ok++;
645 				so_zerocp_stats.align_ok++;
646 				cow_send = socow_setup(m, uio);
647 				len = cow_send;
648 			}
649 			if (!cow_send) {
650 				MCLGET(m, M_TRYWAIT);
651 				if ((m->m_flags & M_EXT) == 0) {
652 					m_free(m);
653 					m = NULL;
654 				} else {
655 					len = min(min(MCLBYTES, resid),
656 					    *space);
657 				}
658 			}
659 #else /* ZERO_COPY_SOCKETS */
660 			if (top == NULL) {
661 				m = m_getcl(M_TRYWAIT, MT_DATA, M_PKTHDR);
662 				m->m_pkthdr.len = 0;
663 				m->m_pkthdr.rcvif = NULL;
664 			} else
665 				m = m_getcl(M_TRYWAIT, MT_DATA, 0);
666 			len = min(min(MCLBYTES, resid), *space);
667 #endif /* ZERO_COPY_SOCKETS */
668 		} else {
669 			if (top == NULL) {
670 				m = m_gethdr(M_TRYWAIT, MT_DATA);
671 				m->m_pkthdr.len = 0;
672 				m->m_pkthdr.rcvif = NULL;
673 
674 				len = min(min(MHLEN, resid), *space);
675 				/*
676 				 * For datagram protocols, leave room
677 				 * for protocol headers in first mbuf.
678 				 */
679 				if (atomic && m && len < MHLEN)
680 					MH_ALIGN(m, len);
681 			} else {
682 				m = m_get(M_TRYWAIT, MT_DATA);
683 				len = min(min(MLEN, resid), *space);
684 			}
685 		}
686 		if (m == NULL) {
687 			error = ENOBUFS;
688 			goto out;
689 		}
690 
691 		*space -= len;
692 #ifdef ZERO_COPY_SOCKETS
693 		if (cow_send)
694 			error = 0;
695 		else
696 #endif /* ZERO_COPY_SOCKETS */
697 		error = uiomove(mtod(m, void *), (int)len, uio);
698 		resid = uio->uio_resid;
699 		m->m_len = len;
700 		*mp = m;
701 		top->m_pkthdr.len += len;
702 		if (error)
703 			goto out;
704 		mp = &m->m_next;
705 		if (resid <= 0) {
706 			if (flags & MSG_EOR)
707 				top->m_flags |= M_EOR;
708 			break;
709 		}
710 	} while (*space > 0 && atomic);
711 out:
712 	*retmp = top;
713 	return (error);
714 }
715 
716 #define	SBLOCKWAIT(f)	(((f) & MSG_DONTWAIT) ? M_NOWAIT : M_WAITOK)
717 
718 int
719 sosend_dgram(so, addr, uio, top, control, flags, td)
720 	struct socket *so;
721 	struct sockaddr *addr;
722 	struct uio *uio;
723 	struct mbuf *top;
724 	struct mbuf *control;
725 	int flags;
726 	struct thread *td;
727 {
728 	long space, resid;
729 	int clen = 0, error, dontroute;
730 	int atomic = sosendallatonce(so) || top;
731 
732 	KASSERT(so->so_type == SOCK_DGRAM, ("sodgram_send: !SOCK_DGRAM"));
733 	KASSERT(so->so_proto->pr_flags & PR_ATOMIC,
734 	    ("sodgram_send: !PR_ATOMIC"));
735 
736 	if (uio != NULL)
737 		resid = uio->uio_resid;
738 	else
739 		resid = top->m_pkthdr.len;
740 	/*
741 	 * In theory resid should be unsigned.
742 	 * However, space must be signed, as it might be less than 0
743 	 * if we over-committed, and we must use a signed comparison
744 	 * of space and resid.  On the other hand, a negative resid
745 	 * causes us to loop sending 0-length segments to the protocol.
746 	 *
747 	 * Also check to make sure that MSG_EOR isn't used on SOCK_STREAM
748 	 * type sockets since that's an error.
749 	 */
750 	if (resid < 0) {
751 		error = EINVAL;
752 		goto out;
753 	}
754 
755 	dontroute =
756 	    (flags & MSG_DONTROUTE) && (so->so_options & SO_DONTROUTE) == 0;
757 	if (td != NULL)
758 		td->td_proc->p_stats->p_ru.ru_msgsnd++;
759 	if (control != NULL)
760 		clen = control->m_len;
761 
762 	SOCKBUF_LOCK(&so->so_snd);
763 	if (so->so_snd.sb_state & SBS_CANTSENDMORE) {
764 		SOCKBUF_UNLOCK(&so->so_snd);
765 		error = EPIPE;
766 		goto out;
767 	}
768 	if (so->so_error) {
769 		error = so->so_error;
770 		so->so_error = 0;
771 		SOCKBUF_UNLOCK(&so->so_snd);
772 		goto out;
773 	}
774 	if ((so->so_state & SS_ISCONNECTED) == 0) {
775 		/*
776 		 * `sendto' and `sendmsg' is allowed on a connection-
777 		 * based socket if it supports implied connect.
778 		 * Return ENOTCONN if not connected and no address is
779 		 * supplied.
780 		 */
781 		if ((so->so_proto->pr_flags & PR_CONNREQUIRED) &&
782 		    (so->so_proto->pr_flags & PR_IMPLOPCL) == 0) {
783 			if ((so->so_state & SS_ISCONFIRMING) == 0 &&
784 			    !(resid == 0 && clen != 0)) {
785 				SOCKBUF_UNLOCK(&so->so_snd);
786 				error = ENOTCONN;
787 				goto out;
788 			}
789 		} else if (addr == NULL) {
790 			if (so->so_proto->pr_flags & PR_CONNREQUIRED)
791 				error = ENOTCONN;
792 			else
793 				error = EDESTADDRREQ;
794 			SOCKBUF_UNLOCK(&so->so_snd);
795 			goto out;
796 		}
797 	}
798 
799 	/*
800 	 * Do we need MSG_OOB support in SOCK_DGRAM?  Signs here may be a
801 	 * problem and need fixing.
802 	 */
803 	space = sbspace(&so->so_snd);
804 	if (flags & MSG_OOB)
805 		space += 1024;
806 	space -= clen;
807 	if (resid > space) {
808 		error = EMSGSIZE;
809 		goto out;
810 	}
811 	SOCKBUF_UNLOCK(&so->so_snd);
812 	if (uio == NULL) {
813 		resid = 0;
814 		if (flags & MSG_EOR)
815 			top->m_flags |= M_EOR;
816 	} else {
817 		error = sosend_copyin(uio, &top, atomic, &space, flags);
818 		if (error)
819 			goto out;
820 		resid = uio->uio_resid;
821 	}
822 	KASSERT(resid == 0, ("sosend_dgram: resid != 0"));
823 	/*
824 	 * XXXRW: Frobbing SO_DONTROUTE here is even worse without sblock
825 	 * than with.
826 	 */
827 	if (dontroute) {
828 		SOCK_LOCK(so);
829 		so->so_options |= SO_DONTROUTE;
830 		SOCK_UNLOCK(so);
831 	}
832 	/*
833 	 * XXX all the SBS_CANTSENDMORE checks previously
834 	 * done could be out of date.  We could have recieved
835 	 * a reset packet in an interrupt or maybe we slept
836 	 * while doing page faults in uiomove() etc. We could
837 	 * probably recheck again inside the locking protection
838 	 * here, but there are probably other places that this
839 	 * also happens.  We must rethink this.
840 	 */
841 	error = (*so->so_proto->pr_usrreqs->pru_send)(so,
842 	    (flags & MSG_OOB) ? PRUS_OOB :
843 	/*
844 	 * If the user set MSG_EOF, the protocol
845 	 * understands this flag and nothing left to
846 	 * send then use PRU_SEND_EOF instead of PRU_SEND.
847 	 */
848 	    ((flags & MSG_EOF) &&
849 	     (so->so_proto->pr_flags & PR_IMPLOPCL) &&
850 	     (resid <= 0)) ?
851 		PRUS_EOF :
852 		/* If there is more to send set PRUS_MORETOCOME */
853 		(resid > 0 && space > 0) ? PRUS_MORETOCOME : 0,
854 		top, addr, control, td);
855 	if (dontroute) {
856 		SOCK_LOCK(so);
857 		so->so_options &= ~SO_DONTROUTE;
858 		SOCK_UNLOCK(so);
859 	}
860 	clen = 0;
861 	control = NULL;
862 	top = NULL;
863 out:
864 	if (top != NULL)
865 		m_freem(top);
866 	if (control != NULL)
867 		m_freem(control);
868 	return (error);
869 }
870 
871 /*
872  * Send on a socket.
873  * If send must go all at once and message is larger than
874  * send buffering, then hard error.
875  * Lock against other senders.
876  * If must go all at once and not enough room now, then
877  * inform user that this would block and do nothing.
878  * Otherwise, if nonblocking, send as much as possible.
879  * The data to be sent is described by "uio" if nonzero,
880  * otherwise by the mbuf chain "top" (which must be null
881  * if uio is not).  Data provided in mbuf chain must be small
882  * enough to send all at once.
883  *
884  * Returns nonzero on error, timeout or signal; callers
885  * must check for short counts if EINTR/ERESTART are returned.
886  * Data and control buffers are freed on return.
887  */
888 #define	snderr(errno)	{ error = (errno); goto release; }
889 int
890 sosend(so, addr, uio, top, control, flags, td)
891 	struct socket *so;
892 	struct sockaddr *addr;
893 	struct uio *uio;
894 	struct mbuf *top;
895 	struct mbuf *control;
896 	int flags;
897 	struct thread *td;
898 {
899 	long space, resid;
900 	int clen = 0, error, dontroute;
901 	int atomic = sosendallatonce(so) || top;
902 
903 	if (uio != NULL)
904 		resid = uio->uio_resid;
905 	else
906 		resid = top->m_pkthdr.len;
907 	/*
908 	 * In theory resid should be unsigned.
909 	 * However, space must be signed, as it might be less than 0
910 	 * if we over-committed, and we must use a signed comparison
911 	 * of space and resid.  On the other hand, a negative resid
912 	 * causes us to loop sending 0-length segments to the protocol.
913 	 *
914 	 * Also check to make sure that MSG_EOR isn't used on SOCK_STREAM
915 	 * type sockets since that's an error.
916 	 */
917 	if (resid < 0 || (so->so_type == SOCK_STREAM && (flags & MSG_EOR))) {
918 		error = EINVAL;
919 		goto out;
920 	}
921 
922 	dontroute =
923 	    (flags & MSG_DONTROUTE) && (so->so_options & SO_DONTROUTE) == 0 &&
924 	    (so->so_proto->pr_flags & PR_ATOMIC);
925 	if (td != NULL)
926 		td->td_proc->p_stats->p_ru.ru_msgsnd++;
927 	if (control != NULL)
928 		clen = control->m_len;
929 
930 	SOCKBUF_LOCK(&so->so_snd);
931 restart:
932 	SOCKBUF_LOCK_ASSERT(&so->so_snd);
933 	error = sblock(&so->so_snd, SBLOCKWAIT(flags));
934 	if (error)
935 		goto out_locked;
936 	do {
937 		SOCKBUF_LOCK_ASSERT(&so->so_snd);
938 		if (so->so_snd.sb_state & SBS_CANTSENDMORE)
939 			snderr(EPIPE);
940 		if (so->so_error) {
941 			error = so->so_error;
942 			so->so_error = 0;
943 			goto release;
944 		}
945 		if ((so->so_state & SS_ISCONNECTED) == 0) {
946 			/*
947 			 * `sendto' and `sendmsg' is allowed on a connection-
948 			 * based socket if it supports implied connect.
949 			 * Return ENOTCONN if not connected and no address is
950 			 * supplied.
951 			 */
952 			if ((so->so_proto->pr_flags & PR_CONNREQUIRED) &&
953 			    (so->so_proto->pr_flags & PR_IMPLOPCL) == 0) {
954 				if ((so->so_state & SS_ISCONFIRMING) == 0 &&
955 				    !(resid == 0 && clen != 0))
956 					snderr(ENOTCONN);
957 			} else if (addr == NULL)
958 			    snderr(so->so_proto->pr_flags & PR_CONNREQUIRED ?
959 				   ENOTCONN : EDESTADDRREQ);
960 		}
961 		space = sbspace(&so->so_snd);
962 		if (flags & MSG_OOB)
963 			space += 1024;
964 		if ((atomic && resid > so->so_snd.sb_hiwat) ||
965 		    clen > so->so_snd.sb_hiwat)
966 			snderr(EMSGSIZE);
967 		if (space < resid + clen &&
968 		    (atomic || space < so->so_snd.sb_lowat || space < clen)) {
969 			if ((so->so_state & SS_NBIO) || (flags & MSG_NBIO))
970 				snderr(EWOULDBLOCK);
971 			sbunlock(&so->so_snd);
972 			error = sbwait(&so->so_snd);
973 			if (error)
974 				goto out_locked;
975 			goto restart;
976 		}
977 		SOCKBUF_UNLOCK(&so->so_snd);
978 		space -= clen;
979 		do {
980 			if (uio == NULL) {
981 				resid = 0;
982 				if (flags & MSG_EOR)
983 					top->m_flags |= M_EOR;
984 			} else {
985 				error = sosend_copyin(uio, &top, atomic,
986 				    &space, flags);
987 				if (error != 0) {
988 					SOCKBUF_LOCK(&so->so_snd);
989 					goto release;
990 				}
991 				resid = uio->uio_resid;
992 			}
993 			if (dontroute) {
994 				SOCK_LOCK(so);
995 				so->so_options |= SO_DONTROUTE;
996 				SOCK_UNLOCK(so);
997 			}
998 			/*
999 			 * XXX all the SBS_CANTSENDMORE checks previously
1000 			 * done could be out of date.  We could have recieved
1001 			 * a reset packet in an interrupt or maybe we slept
1002 			 * while doing page faults in uiomove() etc. We could
1003 			 * probably recheck again inside the locking protection
1004 			 * here, but there are probably other places that this
1005 			 * also happens.  We must rethink this.
1006 			 */
1007 			error = (*so->so_proto->pr_usrreqs->pru_send)(so,
1008 			    (flags & MSG_OOB) ? PRUS_OOB :
1009 			/*
1010 			 * If the user set MSG_EOF, the protocol
1011 			 * understands this flag and nothing left to
1012 			 * send then use PRU_SEND_EOF instead of PRU_SEND.
1013 			 */
1014 			    ((flags & MSG_EOF) &&
1015 			     (so->so_proto->pr_flags & PR_IMPLOPCL) &&
1016 			     (resid <= 0)) ?
1017 				PRUS_EOF :
1018 			/* If there is more to send set PRUS_MORETOCOME */
1019 			    (resid > 0 && space > 0) ? PRUS_MORETOCOME : 0,
1020 			    top, addr, control, td);
1021 			if (dontroute) {
1022 				SOCK_LOCK(so);
1023 				so->so_options &= ~SO_DONTROUTE;
1024 				SOCK_UNLOCK(so);
1025 			}
1026 			clen = 0;
1027 			control = NULL;
1028 			top = NULL;
1029 			if (error) {
1030 				SOCKBUF_LOCK(&so->so_snd);
1031 				goto release;
1032 			}
1033 		} while (resid && space > 0);
1034 		SOCKBUF_LOCK(&so->so_snd);
1035 	} while (resid);
1036 
1037 release:
1038 	SOCKBUF_LOCK_ASSERT(&so->so_snd);
1039 	sbunlock(&so->so_snd);
1040 out_locked:
1041 	SOCKBUF_LOCK_ASSERT(&so->so_snd);
1042 	SOCKBUF_UNLOCK(&so->so_snd);
1043 out:
1044 	if (top != NULL)
1045 		m_freem(top);
1046 	if (control != NULL)
1047 		m_freem(control);
1048 	return (error);
1049 }
1050 #undef snderr
1051 
1052 /*
1053  * The part of soreceive() that implements reading non-inline out-of-band
1054  * data from a socket.  For more complete comments, see soreceive(), from
1055  * which this code originated.
1056  *
1057  * Note that soreceive_rcvoob(), unlike the remainder of soreceive(), is
1058  * unable to return an mbuf chain to the caller.
1059  */
1060 static int
1061 soreceive_rcvoob(so, uio, flags)
1062 	struct socket *so;
1063 	struct uio *uio;
1064 	int flags;
1065 {
1066 	struct protosw *pr = so->so_proto;
1067 	struct mbuf *m;
1068 	int error;
1069 
1070 	KASSERT(flags & MSG_OOB, ("soreceive_rcvoob: (flags & MSG_OOB) == 0"));
1071 
1072 	m = m_get(M_TRYWAIT, MT_DATA);
1073 	if (m == NULL)
1074 		return (ENOBUFS);
1075 	error = (*pr->pr_usrreqs->pru_rcvoob)(so, m, flags & MSG_PEEK);
1076 	if (error)
1077 		goto bad;
1078 	do {
1079 #ifdef ZERO_COPY_SOCKETS
1080 		if (so_zero_copy_receive) {
1081 			int disposable;
1082 
1083 			if ((m->m_flags & M_EXT)
1084 			 && (m->m_ext.ext_type == EXT_DISPOSABLE))
1085 				disposable = 1;
1086 			else
1087 				disposable = 0;
1088 
1089 			error = uiomoveco(mtod(m, void *),
1090 					  min(uio->uio_resid, m->m_len),
1091 					  uio, disposable);
1092 		} else
1093 #endif /* ZERO_COPY_SOCKETS */
1094 		error = uiomove(mtod(m, void *),
1095 		    (int) min(uio->uio_resid, m->m_len), uio);
1096 		m = m_free(m);
1097 	} while (uio->uio_resid && error == 0 && m);
1098 bad:
1099 	if (m != NULL)
1100 		m_freem(m);
1101 	return (error);
1102 }
1103 
1104 /*
1105  * Following replacement or removal of the first mbuf on the first mbuf chain
1106  * of a socket buffer, push necessary state changes back into the socket
1107  * buffer so that other consumers see the values consistently.  'nextrecord'
1108  * is the callers locally stored value of the original value of
1109  * sb->sb_mb->m_nextpkt which must be restored when the lead mbuf changes.
1110  * NOTE: 'nextrecord' may be NULL.
1111  */
1112 static __inline void
1113 sockbuf_pushsync(struct sockbuf *sb, struct mbuf *nextrecord)
1114 {
1115 
1116 	SOCKBUF_LOCK_ASSERT(sb);
1117 	/*
1118 	 * First, update for the new value of nextrecord.  If necessary, make
1119 	 * it the first record.
1120 	 */
1121 	if (sb->sb_mb != NULL)
1122 		sb->sb_mb->m_nextpkt = nextrecord;
1123 	else
1124 		sb->sb_mb = nextrecord;
1125 
1126         /*
1127          * Now update any dependent socket buffer fields to reflect the new
1128          * state.  This is an expanded inline of SB_EMPTY_FIXUP(), with the
1129 	 * addition of a second clause that takes care of the case where
1130 	 * sb_mb has been updated, but remains the last record.
1131          */
1132         if (sb->sb_mb == NULL) {
1133                 sb->sb_mbtail = NULL;
1134                 sb->sb_lastrecord = NULL;
1135         } else if (sb->sb_mb->m_nextpkt == NULL)
1136                 sb->sb_lastrecord = sb->sb_mb;
1137 }
1138 
1139 
1140 /*
1141  * Implement receive operations on a socket.
1142  * We depend on the way that records are added to the sockbuf
1143  * by sbappend*.  In particular, each record (mbufs linked through m_next)
1144  * must begin with an address if the protocol so specifies,
1145  * followed by an optional mbuf or mbufs containing ancillary data,
1146  * and then zero or more mbufs of data.
1147  * In order to avoid blocking network interrupts for the entire time here,
1148  * we splx() while doing the actual copy to user space.
1149  * Although the sockbuf is locked, new data may still be appended,
1150  * and thus we must maintain consistency of the sockbuf during that time.
1151  *
1152  * The caller may receive the data as a single mbuf chain by supplying
1153  * an mbuf **mp0 for use in returning the chain.  The uio is then used
1154  * only for the count in uio_resid.
1155  */
1156 int
1157 soreceive(so, psa, uio, mp0, controlp, flagsp)
1158 	struct socket *so;
1159 	struct sockaddr **psa;
1160 	struct uio *uio;
1161 	struct mbuf **mp0;
1162 	struct mbuf **controlp;
1163 	int *flagsp;
1164 {
1165 	struct mbuf *m, **mp;
1166 	int flags, len, error, offset;
1167 	struct protosw *pr = so->so_proto;
1168 	struct mbuf *nextrecord;
1169 	int moff, type = 0;
1170 	int orig_resid = uio->uio_resid;
1171 
1172 	mp = mp0;
1173 	if (psa != NULL)
1174 		*psa = NULL;
1175 	if (controlp != NULL)
1176 		*controlp = NULL;
1177 	if (flagsp != NULL)
1178 		flags = *flagsp &~ MSG_EOR;
1179 	else
1180 		flags = 0;
1181 	if (flags & MSG_OOB)
1182 		return (soreceive_rcvoob(so, uio, flags));
1183 	if (mp != NULL)
1184 		*mp = NULL;
1185 	if ((pr->pr_flags & PR_WANTRCVD) && (so->so_state & SS_ISCONFIRMING)
1186 	    && uio->uio_resid)
1187 		(*pr->pr_usrreqs->pru_rcvd)(so, 0);
1188 
1189 	SOCKBUF_LOCK(&so->so_rcv);
1190 restart:
1191 	SOCKBUF_LOCK_ASSERT(&so->so_rcv);
1192 	error = sblock(&so->so_rcv, SBLOCKWAIT(flags));
1193 	if (error)
1194 		goto out;
1195 
1196 	m = so->so_rcv.sb_mb;
1197 	/*
1198 	 * If we have less data than requested, block awaiting more
1199 	 * (subject to any timeout) if:
1200 	 *   1. the current count is less than the low water mark, or
1201 	 *   2. MSG_WAITALL is set, and it is possible to do the entire
1202 	 *	receive operation at once if we block (resid <= hiwat).
1203 	 *   3. MSG_DONTWAIT is not set
1204 	 * If MSG_WAITALL is set but resid is larger than the receive buffer,
1205 	 * we have to do the receive in sections, and thus risk returning
1206 	 * a short count if a timeout or signal occurs after we start.
1207 	 */
1208 	if (m == NULL || (((flags & MSG_DONTWAIT) == 0 &&
1209 	    so->so_rcv.sb_cc < uio->uio_resid) &&
1210 	    (so->so_rcv.sb_cc < so->so_rcv.sb_lowat ||
1211 	    ((flags & MSG_WAITALL) && uio->uio_resid <= so->so_rcv.sb_hiwat)) &&
1212 	    m->m_nextpkt == NULL && (pr->pr_flags & PR_ATOMIC) == 0)) {
1213 		KASSERT(m != NULL || !so->so_rcv.sb_cc,
1214 		    ("receive: m == %p so->so_rcv.sb_cc == %u",
1215 		    m, so->so_rcv.sb_cc));
1216 		if (so->so_error) {
1217 			if (m != NULL)
1218 				goto dontblock;
1219 			error = so->so_error;
1220 			if ((flags & MSG_PEEK) == 0)
1221 				so->so_error = 0;
1222 			goto release;
1223 		}
1224 		SOCKBUF_LOCK_ASSERT(&so->so_rcv);
1225 		if (so->so_rcv.sb_state & SBS_CANTRCVMORE) {
1226 			if (m)
1227 				goto dontblock;
1228 			else
1229 				goto release;
1230 		}
1231 		for (; m != NULL; m = m->m_next)
1232 			if (m->m_type == MT_OOBDATA  || (m->m_flags & M_EOR)) {
1233 				m = so->so_rcv.sb_mb;
1234 				goto dontblock;
1235 			}
1236 		if ((so->so_state & (SS_ISCONNECTED|SS_ISCONNECTING)) == 0 &&
1237 		    (so->so_proto->pr_flags & PR_CONNREQUIRED)) {
1238 			error = ENOTCONN;
1239 			goto release;
1240 		}
1241 		if (uio->uio_resid == 0)
1242 			goto release;
1243 		if ((so->so_state & SS_NBIO) ||
1244 		    (flags & (MSG_DONTWAIT|MSG_NBIO))) {
1245 			error = EWOULDBLOCK;
1246 			goto release;
1247 		}
1248 		SBLASTRECORDCHK(&so->so_rcv);
1249 		SBLASTMBUFCHK(&so->so_rcv);
1250 		sbunlock(&so->so_rcv);
1251 		error = sbwait(&so->so_rcv);
1252 		if (error)
1253 			goto out;
1254 		goto restart;
1255 	}
1256 dontblock:
1257 	/*
1258 	 * From this point onward, we maintain 'nextrecord' as a cache of the
1259 	 * pointer to the next record in the socket buffer.  We must keep the
1260 	 * various socket buffer pointers and local stack versions of the
1261 	 * pointers in sync, pushing out modifications before dropping the
1262 	 * socket buffer mutex, and re-reading them when picking it up.
1263 	 *
1264 	 * Otherwise, we will race with the network stack appending new data
1265 	 * or records onto the socket buffer by using inconsistent/stale
1266 	 * versions of the field, possibly resulting in socket buffer
1267 	 * corruption.
1268 	 *
1269 	 * By holding the high-level sblock(), we prevent simultaneous
1270 	 * readers from pulling off the front of the socket buffer.
1271 	 */
1272 	SOCKBUF_LOCK_ASSERT(&so->so_rcv);
1273 	if (uio->uio_td)
1274 		uio->uio_td->td_proc->p_stats->p_ru.ru_msgrcv++;
1275 	KASSERT(m == so->so_rcv.sb_mb, ("soreceive: m != so->so_rcv.sb_mb"));
1276 	SBLASTRECORDCHK(&so->so_rcv);
1277 	SBLASTMBUFCHK(&so->so_rcv);
1278 	nextrecord = m->m_nextpkt;
1279 	if (pr->pr_flags & PR_ADDR) {
1280 		KASSERT(m->m_type == MT_SONAME,
1281 		    ("m->m_type == %d", m->m_type));
1282 		orig_resid = 0;
1283 		if (psa != NULL)
1284 			*psa = sodupsockaddr(mtod(m, struct sockaddr *),
1285 			    M_NOWAIT);
1286 		if (flags & MSG_PEEK) {
1287 			m = m->m_next;
1288 		} else {
1289 			sbfree(&so->so_rcv, m);
1290 			so->so_rcv.sb_mb = m_free(m);
1291 			m = so->so_rcv.sb_mb;
1292 			sockbuf_pushsync(&so->so_rcv, nextrecord);
1293 		}
1294 	}
1295 
1296 	/*
1297 	 * Process one or more MT_CONTROL mbufs present before any data mbufs
1298 	 * in the first mbuf chain on the socket buffer.  If MSG_PEEK, we
1299 	 * just copy the data; if !MSG_PEEK, we call into the protocol to
1300 	 * perform externalization (or freeing if controlp == NULL).
1301 	 */
1302 	if (m != NULL && m->m_type == MT_CONTROL) {
1303 		struct mbuf *cm = NULL, *cmn;
1304 		struct mbuf **cme = &cm;
1305 
1306 		do {
1307 			if (flags & MSG_PEEK) {
1308 				if (controlp != NULL) {
1309 					*controlp = m_copy(m, 0, m->m_len);
1310 					controlp = &(*controlp)->m_next;
1311 				}
1312 				m = m->m_next;
1313 			} else {
1314 				sbfree(&so->so_rcv, m);
1315 				so->so_rcv.sb_mb = m->m_next;
1316 				m->m_next = NULL;
1317 				*cme = m;
1318 				cme = &(*cme)->m_next;
1319 				m = so->so_rcv.sb_mb;
1320 			}
1321 		} while (m != NULL && m->m_type == MT_CONTROL);
1322 		if ((flags & MSG_PEEK) == 0)
1323 			sockbuf_pushsync(&so->so_rcv, nextrecord);
1324 		while (cm != NULL) {
1325 			cmn = cm->m_next;
1326 			cm->m_next = NULL;
1327 			if (pr->pr_domain->dom_externalize != NULL) {
1328 				SOCKBUF_UNLOCK(&so->so_rcv);
1329 				error = (*pr->pr_domain->dom_externalize)
1330 				    (cm, controlp);
1331 				SOCKBUF_LOCK(&so->so_rcv);
1332 			} else if (controlp != NULL)
1333 				*controlp = cm;
1334 			else
1335 				m_freem(cm);
1336 			if (controlp != NULL) {
1337 				orig_resid = 0;
1338 				while (*controlp != NULL)
1339 					controlp = &(*controlp)->m_next;
1340 			}
1341 			cm = cmn;
1342 		}
1343 		if (so->so_rcv.sb_mb)
1344 			nextrecord = so->so_rcv.sb_mb->m_nextpkt;
1345 		else
1346 			nextrecord = NULL;
1347 		orig_resid = 0;
1348 	}
1349 	if (m != NULL) {
1350 		if ((flags & MSG_PEEK) == 0) {
1351 			KASSERT(m->m_nextpkt == nextrecord,
1352 			    ("soreceive: post-control, nextrecord !sync"));
1353 			if (nextrecord == NULL) {
1354 				KASSERT(so->so_rcv.sb_mb == m,
1355 				    ("soreceive: post-control, sb_mb!=m"));
1356 				KASSERT(so->so_rcv.sb_lastrecord == m,
1357 				    ("soreceive: post-control, lastrecord!=m"));
1358 			}
1359 		}
1360 		type = m->m_type;
1361 		if (type == MT_OOBDATA)
1362 			flags |= MSG_OOB;
1363 	} else {
1364 		if ((flags & MSG_PEEK) == 0) {
1365 			KASSERT(so->so_rcv.sb_mb == nextrecord,
1366 			    ("soreceive: sb_mb != nextrecord"));
1367 			if (so->so_rcv.sb_mb == NULL) {
1368 				KASSERT(so->so_rcv.sb_lastrecord == NULL,
1369 				    ("soreceive: sb_lastercord != NULL"));
1370 			}
1371 		}
1372 	}
1373 	SOCKBUF_LOCK_ASSERT(&so->so_rcv);
1374 	SBLASTRECORDCHK(&so->so_rcv);
1375 	SBLASTMBUFCHK(&so->so_rcv);
1376 
1377 	/*
1378 	 * Now continue to read any data mbufs off of the head of the socket
1379 	 * buffer until the read request is satisfied.  Note that 'type' is
1380 	 * used to store the type of any mbuf reads that have happened so far
1381 	 * such that soreceive() can stop reading if the type changes, which
1382 	 * causes soreceive() to return only one of regular data and inline
1383 	 * out-of-band data in a single socket receive operation.
1384 	 */
1385 	moff = 0;
1386 	offset = 0;
1387 	while (m != NULL && uio->uio_resid > 0 && error == 0) {
1388 		/*
1389 		 * If the type of mbuf has changed since the last mbuf
1390 		 * examined ('type'), end the receive operation.
1391 	 	 */
1392 		SOCKBUF_LOCK_ASSERT(&so->so_rcv);
1393 		if (m->m_type == MT_OOBDATA) {
1394 			if (type != MT_OOBDATA)
1395 				break;
1396 		} else if (type == MT_OOBDATA)
1397 			break;
1398 		else
1399 		    KASSERT(m->m_type == MT_DATA,
1400 			("m->m_type == %d", m->m_type));
1401 		so->so_rcv.sb_state &= ~SBS_RCVATMARK;
1402 		len = uio->uio_resid;
1403 		if (so->so_oobmark && len > so->so_oobmark - offset)
1404 			len = so->so_oobmark - offset;
1405 		if (len > m->m_len - moff)
1406 			len = m->m_len - moff;
1407 		/*
1408 		 * If mp is set, just pass back the mbufs.
1409 		 * Otherwise copy them out via the uio, then free.
1410 		 * Sockbuf must be consistent here (points to current mbuf,
1411 		 * it points to next record) when we drop priority;
1412 		 * we must note any additions to the sockbuf when we
1413 		 * block interrupts again.
1414 		 */
1415 		if (mp == NULL) {
1416 			SOCKBUF_LOCK_ASSERT(&so->so_rcv);
1417 			SBLASTRECORDCHK(&so->so_rcv);
1418 			SBLASTMBUFCHK(&so->so_rcv);
1419 			SOCKBUF_UNLOCK(&so->so_rcv);
1420 #ifdef ZERO_COPY_SOCKETS
1421 			if (so_zero_copy_receive) {
1422 				int disposable;
1423 
1424 				if ((m->m_flags & M_EXT)
1425 				 && (m->m_ext.ext_type == EXT_DISPOSABLE))
1426 					disposable = 1;
1427 				else
1428 					disposable = 0;
1429 
1430 				error = uiomoveco(mtod(m, char *) + moff,
1431 						  (int)len, uio,
1432 						  disposable);
1433 			} else
1434 #endif /* ZERO_COPY_SOCKETS */
1435 			error = uiomove(mtod(m, char *) + moff, (int)len, uio);
1436 			SOCKBUF_LOCK(&so->so_rcv);
1437 			if (error)
1438 				goto release;
1439 		} else
1440 			uio->uio_resid -= len;
1441 		SOCKBUF_LOCK_ASSERT(&so->so_rcv);
1442 		if (len == m->m_len - moff) {
1443 			if (m->m_flags & M_EOR)
1444 				flags |= MSG_EOR;
1445 			if (flags & MSG_PEEK) {
1446 				m = m->m_next;
1447 				moff = 0;
1448 			} else {
1449 				nextrecord = m->m_nextpkt;
1450 				sbfree(&so->so_rcv, m);
1451 				if (mp != NULL) {
1452 					*mp = m;
1453 					mp = &m->m_next;
1454 					so->so_rcv.sb_mb = m = m->m_next;
1455 					*mp = NULL;
1456 				} else {
1457 					so->so_rcv.sb_mb = m_free(m);
1458 					m = so->so_rcv.sb_mb;
1459 				}
1460 				sockbuf_pushsync(&so->so_rcv, nextrecord);
1461 				SBLASTRECORDCHK(&so->so_rcv);
1462 				SBLASTMBUFCHK(&so->so_rcv);
1463 			}
1464 		} else {
1465 			if (flags & MSG_PEEK)
1466 				moff += len;
1467 			else {
1468 				if (mp != NULL) {
1469 					int copy_flag;
1470 
1471 					if (flags & MSG_DONTWAIT)
1472 						copy_flag = M_DONTWAIT;
1473 					else
1474 						copy_flag = M_TRYWAIT;
1475 					if (copy_flag == M_TRYWAIT)
1476 						SOCKBUF_UNLOCK(&so->so_rcv);
1477 					*mp = m_copym(m, 0, len, copy_flag);
1478 					if (copy_flag == M_TRYWAIT)
1479 						SOCKBUF_LOCK(&so->so_rcv);
1480  					if (*mp == NULL) {
1481  						/*
1482  						 * m_copym() couldn't allocate an mbuf.
1483 						 * Adjust uio_resid back (it was adjusted
1484 						 * down by len bytes, which we didn't end
1485 						 * up "copying" over).
1486  						 */
1487  						uio->uio_resid += len;
1488  						break;
1489  					}
1490 				}
1491 				m->m_data += len;
1492 				m->m_len -= len;
1493 				so->so_rcv.sb_cc -= len;
1494 			}
1495 		}
1496 		SOCKBUF_LOCK_ASSERT(&so->so_rcv);
1497 		if (so->so_oobmark) {
1498 			if ((flags & MSG_PEEK) == 0) {
1499 				so->so_oobmark -= len;
1500 				if (so->so_oobmark == 0) {
1501 					so->so_rcv.sb_state |= SBS_RCVATMARK;
1502 					break;
1503 				}
1504 			} else {
1505 				offset += len;
1506 				if (offset == so->so_oobmark)
1507 					break;
1508 			}
1509 		}
1510 		if (flags & MSG_EOR)
1511 			break;
1512 		/*
1513 		 * If the MSG_WAITALL flag is set (for non-atomic socket),
1514 		 * we must not quit until "uio->uio_resid == 0" or an error
1515 		 * termination.  If a signal/timeout occurs, return
1516 		 * with a short count but without error.
1517 		 * Keep sockbuf locked against other readers.
1518 		 */
1519 		while (flags & MSG_WAITALL && m == NULL && uio->uio_resid > 0 &&
1520 		    !sosendallatonce(so) && nextrecord == NULL) {
1521 			SOCKBUF_LOCK_ASSERT(&so->so_rcv);
1522 			if (so->so_error || so->so_rcv.sb_state & SBS_CANTRCVMORE)
1523 				break;
1524 			/*
1525 			 * Notify the protocol that some data has been
1526 			 * drained before blocking.
1527 			 */
1528 			if (pr->pr_flags & PR_WANTRCVD && so->so_pcb != NULL) {
1529 				SOCKBUF_UNLOCK(&so->so_rcv);
1530 				(*pr->pr_usrreqs->pru_rcvd)(so, flags);
1531 				SOCKBUF_LOCK(&so->so_rcv);
1532 			}
1533 			SBLASTRECORDCHK(&so->so_rcv);
1534 			SBLASTMBUFCHK(&so->so_rcv);
1535 			error = sbwait(&so->so_rcv);
1536 			if (error)
1537 				goto release;
1538 			m = so->so_rcv.sb_mb;
1539 			if (m != NULL)
1540 				nextrecord = m->m_nextpkt;
1541 		}
1542 	}
1543 
1544 	SOCKBUF_LOCK_ASSERT(&so->so_rcv);
1545 	if (m != NULL && pr->pr_flags & PR_ATOMIC) {
1546 		flags |= MSG_TRUNC;
1547 		if ((flags & MSG_PEEK) == 0)
1548 			(void) sbdroprecord_locked(&so->so_rcv);
1549 	}
1550 	if ((flags & MSG_PEEK) == 0) {
1551 		if (m == NULL) {
1552 			/*
1553 			 * First part is an inline SB_EMPTY_FIXUP().  Second
1554 			 * part makes sure sb_lastrecord is up-to-date if
1555 			 * there is still data in the socket buffer.
1556 			 */
1557 			so->so_rcv.sb_mb = nextrecord;
1558 			if (so->so_rcv.sb_mb == NULL) {
1559 				so->so_rcv.sb_mbtail = NULL;
1560 				so->so_rcv.sb_lastrecord = NULL;
1561 			} else if (nextrecord->m_nextpkt == NULL)
1562 				so->so_rcv.sb_lastrecord = nextrecord;
1563 		}
1564 		SBLASTRECORDCHK(&so->so_rcv);
1565 		SBLASTMBUFCHK(&so->so_rcv);
1566 		/*
1567 		 * If soreceive() is being done from the socket callback, then
1568 		 * don't need to generate ACK to peer to update window, since
1569 		 * ACK will be generated on return to TCP.
1570 		 */
1571 		if (!(flags & MSG_SOCALLBCK) &&
1572 		    (pr->pr_flags & PR_WANTRCVD) && so->so_pcb) {
1573 			SOCKBUF_UNLOCK(&so->so_rcv);
1574 			(*pr->pr_usrreqs->pru_rcvd)(so, flags);
1575 			SOCKBUF_LOCK(&so->so_rcv);
1576 		}
1577 	}
1578 	SOCKBUF_LOCK_ASSERT(&so->so_rcv);
1579 	if (orig_resid == uio->uio_resid && orig_resid &&
1580 	    (flags & MSG_EOR) == 0 && (so->so_rcv.sb_state & SBS_CANTRCVMORE) == 0) {
1581 		sbunlock(&so->so_rcv);
1582 		goto restart;
1583 	}
1584 
1585 	if (flagsp != NULL)
1586 		*flagsp |= flags;
1587 release:
1588 	SOCKBUF_LOCK_ASSERT(&so->so_rcv);
1589 	sbunlock(&so->so_rcv);
1590 out:
1591 	SOCKBUF_LOCK_ASSERT(&so->so_rcv);
1592 	SOCKBUF_UNLOCK(&so->so_rcv);
1593 	return (error);
1594 }
1595 
1596 int
1597 soshutdown(so, how)
1598 	struct socket *so;
1599 	int how;
1600 {
1601 	struct protosw *pr = so->so_proto;
1602 
1603 	if (!(how == SHUT_RD || how == SHUT_WR || how == SHUT_RDWR))
1604 		return (EINVAL);
1605 
1606 	if (how != SHUT_WR)
1607 		sorflush(so);
1608 	if (how != SHUT_RD)
1609 		return ((*pr->pr_usrreqs->pru_shutdown)(so));
1610 	return (0);
1611 }
1612 
1613 void
1614 sorflush(so)
1615 	struct socket *so;
1616 {
1617 	struct sockbuf *sb = &so->so_rcv;
1618 	struct protosw *pr = so->so_proto;
1619 	struct sockbuf asb;
1620 
1621 	/*
1622 	 * XXXRW: This is quite ugly.  Previously, this code made a copy of
1623 	 * the socket buffer, then zero'd the original to clear the buffer
1624 	 * fields.  However, with mutexes in the socket buffer, this causes
1625 	 * problems.  We only clear the zeroable bits of the original;
1626 	 * however, we have to initialize and destroy the mutex in the copy
1627 	 * so that dom_dispose() and sbrelease() can lock t as needed.
1628 	 */
1629 	SOCKBUF_LOCK(sb);
1630 	sb->sb_flags |= SB_NOINTR;
1631 	(void) sblock(sb, M_WAITOK);
1632 	/*
1633 	 * socantrcvmore_locked() drops the socket buffer mutex so that it
1634 	 * can safely perform wakeups.  Re-acquire the mutex before
1635 	 * continuing.
1636 	 */
1637 	socantrcvmore_locked(so);
1638 	SOCKBUF_LOCK(sb);
1639 	sbunlock(sb);
1640 	/*
1641 	 * Invalidate/clear most of the sockbuf structure, but leave
1642 	 * selinfo and mutex data unchanged.
1643 	 */
1644 	bzero(&asb, offsetof(struct sockbuf, sb_startzero));
1645 	bcopy(&sb->sb_startzero, &asb.sb_startzero,
1646 	    sizeof(*sb) - offsetof(struct sockbuf, sb_startzero));
1647 	bzero(&sb->sb_startzero,
1648 	    sizeof(*sb) - offsetof(struct sockbuf, sb_startzero));
1649 	SOCKBUF_UNLOCK(sb);
1650 
1651 	SOCKBUF_LOCK_INIT(&asb, "so_rcv");
1652 	if (pr->pr_flags & PR_RIGHTS && pr->pr_domain->dom_dispose != NULL)
1653 		(*pr->pr_domain->dom_dispose)(asb.sb_mb);
1654 	sbrelease(&asb, so);
1655 	SOCKBUF_LOCK_DESTROY(&asb);
1656 }
1657 
1658 /*
1659  * Perhaps this routine, and sooptcopyout(), below, ought to come in
1660  * an additional variant to handle the case where the option value needs
1661  * to be some kind of integer, but not a specific size.
1662  * In addition to their use here, these functions are also called by the
1663  * protocol-level pr_ctloutput() routines.
1664  */
1665 int
1666 sooptcopyin(sopt, buf, len, minlen)
1667 	struct	sockopt *sopt;
1668 	void	*buf;
1669 	size_t	len;
1670 	size_t	minlen;
1671 {
1672 	size_t	valsize;
1673 
1674 	/*
1675 	 * If the user gives us more than we wanted, we ignore it,
1676 	 * but if we don't get the minimum length the caller
1677 	 * wants, we return EINVAL.  On success, sopt->sopt_valsize
1678 	 * is set to however much we actually retrieved.
1679 	 */
1680 	if ((valsize = sopt->sopt_valsize) < minlen)
1681 		return EINVAL;
1682 	if (valsize > len)
1683 		sopt->sopt_valsize = valsize = len;
1684 
1685 	if (sopt->sopt_td != NULL)
1686 		return (copyin(sopt->sopt_val, buf, valsize));
1687 
1688 	bcopy(sopt->sopt_val, buf, valsize);
1689 	return (0);
1690 }
1691 
1692 /*
1693  * Kernel version of setsockopt(2)/
1694  * XXX: optlen is size_t, not socklen_t
1695  */
1696 int
1697 so_setsockopt(struct socket *so, int level, int optname, void *optval,
1698     size_t optlen)
1699 {
1700 	struct sockopt sopt;
1701 
1702 	sopt.sopt_level = level;
1703 	sopt.sopt_name = optname;
1704 	sopt.sopt_dir = SOPT_SET;
1705 	sopt.sopt_val = optval;
1706 	sopt.sopt_valsize = optlen;
1707 	sopt.sopt_td = NULL;
1708 	return (sosetopt(so, &sopt));
1709 }
1710 
1711 int
1712 sosetopt(so, sopt)
1713 	struct socket *so;
1714 	struct sockopt *sopt;
1715 {
1716 	int	error, optval;
1717 	struct	linger l;
1718 	struct	timeval tv;
1719 	u_long  val;
1720 #ifdef MAC
1721 	struct mac extmac;
1722 #endif
1723 
1724 	error = 0;
1725 	if (sopt->sopt_level != SOL_SOCKET) {
1726 		if (so->so_proto && so->so_proto->pr_ctloutput)
1727 			return ((*so->so_proto->pr_ctloutput)
1728 				  (so, sopt));
1729 		error = ENOPROTOOPT;
1730 	} else {
1731 		switch (sopt->sopt_name) {
1732 #ifdef INET
1733 		case SO_ACCEPTFILTER:
1734 			error = do_setopt_accept_filter(so, sopt);
1735 			if (error)
1736 				goto bad;
1737 			break;
1738 #endif
1739 		case SO_LINGER:
1740 			error = sooptcopyin(sopt, &l, sizeof l, sizeof l);
1741 			if (error)
1742 				goto bad;
1743 
1744 			SOCK_LOCK(so);
1745 			so->so_linger = l.l_linger;
1746 			if (l.l_onoff)
1747 				so->so_options |= SO_LINGER;
1748 			else
1749 				so->so_options &= ~SO_LINGER;
1750 			SOCK_UNLOCK(so);
1751 			break;
1752 
1753 		case SO_DEBUG:
1754 		case SO_KEEPALIVE:
1755 		case SO_DONTROUTE:
1756 		case SO_USELOOPBACK:
1757 		case SO_BROADCAST:
1758 		case SO_REUSEADDR:
1759 		case SO_REUSEPORT:
1760 		case SO_OOBINLINE:
1761 		case SO_TIMESTAMP:
1762 		case SO_BINTIME:
1763 		case SO_NOSIGPIPE:
1764 			error = sooptcopyin(sopt, &optval, sizeof optval,
1765 					    sizeof optval);
1766 			if (error)
1767 				goto bad;
1768 			SOCK_LOCK(so);
1769 			if (optval)
1770 				so->so_options |= sopt->sopt_name;
1771 			else
1772 				so->so_options &= ~sopt->sopt_name;
1773 			SOCK_UNLOCK(so);
1774 			break;
1775 
1776 		case SO_SNDBUF:
1777 		case SO_RCVBUF:
1778 		case SO_SNDLOWAT:
1779 		case SO_RCVLOWAT:
1780 			error = sooptcopyin(sopt, &optval, sizeof optval,
1781 					    sizeof optval);
1782 			if (error)
1783 				goto bad;
1784 
1785 			/*
1786 			 * Values < 1 make no sense for any of these
1787 			 * options, so disallow them.
1788 			 */
1789 			if (optval < 1) {
1790 				error = EINVAL;
1791 				goto bad;
1792 			}
1793 
1794 			switch (sopt->sopt_name) {
1795 			case SO_SNDBUF:
1796 			case SO_RCVBUF:
1797 				if (sbreserve(sopt->sopt_name == SO_SNDBUF ?
1798 				    &so->so_snd : &so->so_rcv, (u_long)optval,
1799 				    so, curthread) == 0) {
1800 					error = ENOBUFS;
1801 					goto bad;
1802 				}
1803 				break;
1804 
1805 			/*
1806 			 * Make sure the low-water is never greater than
1807 			 * the high-water.
1808 			 */
1809 			case SO_SNDLOWAT:
1810 				SOCKBUF_LOCK(&so->so_snd);
1811 				so->so_snd.sb_lowat =
1812 				    (optval > so->so_snd.sb_hiwat) ?
1813 				    so->so_snd.sb_hiwat : optval;
1814 				SOCKBUF_UNLOCK(&so->so_snd);
1815 				break;
1816 			case SO_RCVLOWAT:
1817 				SOCKBUF_LOCK(&so->so_rcv);
1818 				so->so_rcv.sb_lowat =
1819 				    (optval > so->so_rcv.sb_hiwat) ?
1820 				    so->so_rcv.sb_hiwat : optval;
1821 				SOCKBUF_UNLOCK(&so->so_rcv);
1822 				break;
1823 			}
1824 			break;
1825 
1826 		case SO_SNDTIMEO:
1827 		case SO_RCVTIMEO:
1828 #ifdef COMPAT_IA32
1829 			if (curthread->td_proc->p_sysent == &ia32_freebsd_sysvec) {
1830 				struct timeval32 tv32;
1831 
1832 				error = sooptcopyin(sopt, &tv32, sizeof tv32,
1833 				    sizeof tv32);
1834 				CP(tv32, tv, tv_sec);
1835 				CP(tv32, tv, tv_usec);
1836 			} else
1837 #endif
1838 				error = sooptcopyin(sopt, &tv, sizeof tv,
1839 				    sizeof tv);
1840 			if (error)
1841 				goto bad;
1842 
1843 			/* assert(hz > 0); */
1844 			if (tv.tv_sec < 0 || tv.tv_sec > INT_MAX / hz ||
1845 			    tv.tv_usec < 0 || tv.tv_usec >= 1000000) {
1846 				error = EDOM;
1847 				goto bad;
1848 			}
1849 			/* assert(tick > 0); */
1850 			/* assert(ULONG_MAX - INT_MAX >= 1000000); */
1851 			val = (u_long)(tv.tv_sec * hz) + tv.tv_usec / tick;
1852 			if (val > INT_MAX) {
1853 				error = EDOM;
1854 				goto bad;
1855 			}
1856 			if (val == 0 && tv.tv_usec != 0)
1857 				val = 1;
1858 
1859 			switch (sopt->sopt_name) {
1860 			case SO_SNDTIMEO:
1861 				so->so_snd.sb_timeo = val;
1862 				break;
1863 			case SO_RCVTIMEO:
1864 				so->so_rcv.sb_timeo = val;
1865 				break;
1866 			}
1867 			break;
1868 
1869 		case SO_LABEL:
1870 #ifdef MAC
1871 			error = sooptcopyin(sopt, &extmac, sizeof extmac,
1872 			    sizeof extmac);
1873 			if (error)
1874 				goto bad;
1875 			error = mac_setsockopt_label(sopt->sopt_td->td_ucred,
1876 			    so, &extmac);
1877 #else
1878 			error = EOPNOTSUPP;
1879 #endif
1880 			break;
1881 
1882 		default:
1883 			error = ENOPROTOOPT;
1884 			break;
1885 		}
1886 		if (error == 0 && so->so_proto != NULL &&
1887 		    so->so_proto->pr_ctloutput != NULL) {
1888 			(void) ((*so->so_proto->pr_ctloutput)
1889 				  (so, sopt));
1890 		}
1891 	}
1892 bad:
1893 	return (error);
1894 }
1895 
1896 /* Helper routine for getsockopt */
1897 int
1898 sooptcopyout(struct sockopt *sopt, const void *buf, size_t len)
1899 {
1900 	int	error;
1901 	size_t	valsize;
1902 
1903 	error = 0;
1904 
1905 	/*
1906 	 * Documented get behavior is that we always return a value,
1907 	 * possibly truncated to fit in the user's buffer.
1908 	 * Traditional behavior is that we always tell the user
1909 	 * precisely how much we copied, rather than something useful
1910 	 * like the total amount we had available for her.
1911 	 * Note that this interface is not idempotent; the entire answer must
1912 	 * generated ahead of time.
1913 	 */
1914 	valsize = min(len, sopt->sopt_valsize);
1915 	sopt->sopt_valsize = valsize;
1916 	if (sopt->sopt_val != NULL) {
1917 		if (sopt->sopt_td != NULL)
1918 			error = copyout(buf, sopt->sopt_val, valsize);
1919 		else
1920 			bcopy(buf, sopt->sopt_val, valsize);
1921 	}
1922 	return (error);
1923 }
1924 
1925 int
1926 sogetopt(so, sopt)
1927 	struct socket *so;
1928 	struct sockopt *sopt;
1929 {
1930 	int	error, optval;
1931 	struct	linger l;
1932 	struct	timeval tv;
1933 #ifdef MAC
1934 	struct mac extmac;
1935 #endif
1936 
1937 	error = 0;
1938 	if (sopt->sopt_level != SOL_SOCKET) {
1939 		if (so->so_proto && so->so_proto->pr_ctloutput) {
1940 			return ((*so->so_proto->pr_ctloutput)
1941 				  (so, sopt));
1942 		} else
1943 			return (ENOPROTOOPT);
1944 	} else {
1945 		switch (sopt->sopt_name) {
1946 #ifdef INET
1947 		case SO_ACCEPTFILTER:
1948 			error = do_getopt_accept_filter(so, sopt);
1949 			break;
1950 #endif
1951 		case SO_LINGER:
1952 			SOCK_LOCK(so);
1953 			l.l_onoff = so->so_options & SO_LINGER;
1954 			l.l_linger = so->so_linger;
1955 			SOCK_UNLOCK(so);
1956 			error = sooptcopyout(sopt, &l, sizeof l);
1957 			break;
1958 
1959 		case SO_USELOOPBACK:
1960 		case SO_DONTROUTE:
1961 		case SO_DEBUG:
1962 		case SO_KEEPALIVE:
1963 		case SO_REUSEADDR:
1964 		case SO_REUSEPORT:
1965 		case SO_BROADCAST:
1966 		case SO_OOBINLINE:
1967 		case SO_ACCEPTCONN:
1968 		case SO_TIMESTAMP:
1969 		case SO_BINTIME:
1970 		case SO_NOSIGPIPE:
1971 			optval = so->so_options & sopt->sopt_name;
1972 integer:
1973 			error = sooptcopyout(sopt, &optval, sizeof optval);
1974 			break;
1975 
1976 		case SO_TYPE:
1977 			optval = so->so_type;
1978 			goto integer;
1979 
1980 		case SO_ERROR:
1981 			optval = so->so_error;
1982 			so->so_error = 0;
1983 			goto integer;
1984 
1985 		case SO_SNDBUF:
1986 			optval = so->so_snd.sb_hiwat;
1987 			goto integer;
1988 
1989 		case SO_RCVBUF:
1990 			optval = so->so_rcv.sb_hiwat;
1991 			goto integer;
1992 
1993 		case SO_SNDLOWAT:
1994 			optval = so->so_snd.sb_lowat;
1995 			goto integer;
1996 
1997 		case SO_RCVLOWAT:
1998 			optval = so->so_rcv.sb_lowat;
1999 			goto integer;
2000 
2001 		case SO_SNDTIMEO:
2002 		case SO_RCVTIMEO:
2003 			optval = (sopt->sopt_name == SO_SNDTIMEO ?
2004 				  so->so_snd.sb_timeo : so->so_rcv.sb_timeo);
2005 
2006 			tv.tv_sec = optval / hz;
2007 			tv.tv_usec = (optval % hz) * tick;
2008 #ifdef COMPAT_IA32
2009 			if (curthread->td_proc->p_sysent == &ia32_freebsd_sysvec) {
2010 				struct timeval32 tv32;
2011 
2012 				CP(tv, tv32, tv_sec);
2013 				CP(tv, tv32, tv_usec);
2014 				error = sooptcopyout(sopt, &tv32, sizeof tv32);
2015 			} else
2016 #endif
2017 				error = sooptcopyout(sopt, &tv, sizeof tv);
2018 			break;
2019 
2020 		case SO_LABEL:
2021 #ifdef MAC
2022 			error = sooptcopyin(sopt, &extmac, sizeof(extmac),
2023 			    sizeof(extmac));
2024 			if (error)
2025 				return (error);
2026 			error = mac_getsockopt_label(sopt->sopt_td->td_ucred,
2027 			    so, &extmac);
2028 			if (error)
2029 				return (error);
2030 			error = sooptcopyout(sopt, &extmac, sizeof extmac);
2031 #else
2032 			error = EOPNOTSUPP;
2033 #endif
2034 			break;
2035 
2036 		case SO_PEERLABEL:
2037 #ifdef MAC
2038 			error = sooptcopyin(sopt, &extmac, sizeof(extmac),
2039 			    sizeof(extmac));
2040 			if (error)
2041 				return (error);
2042 			error = mac_getsockopt_peerlabel(
2043 			    sopt->sopt_td->td_ucred, so, &extmac);
2044 			if (error)
2045 				return (error);
2046 			error = sooptcopyout(sopt, &extmac, sizeof extmac);
2047 #else
2048 			error = EOPNOTSUPP;
2049 #endif
2050 			break;
2051 
2052 		case SO_LISTENQLIMIT:
2053 			optval = so->so_qlimit;
2054 			goto integer;
2055 
2056 		case SO_LISTENQLEN:
2057 			optval = so->so_qlen;
2058 			goto integer;
2059 
2060 		case SO_LISTENINCQLEN:
2061 			optval = so->so_incqlen;
2062 			goto integer;
2063 
2064 		default:
2065 			error = ENOPROTOOPT;
2066 			break;
2067 		}
2068 		return (error);
2069 	}
2070 }
2071 
2072 /* XXX; prepare mbuf for (__FreeBSD__ < 3) routines. */
2073 int
2074 soopt_getm(struct sockopt *sopt, struct mbuf **mp)
2075 {
2076 	struct mbuf *m, *m_prev;
2077 	int sopt_size = sopt->sopt_valsize;
2078 
2079 	MGET(m, sopt->sopt_td ? M_TRYWAIT : M_DONTWAIT, MT_DATA);
2080 	if (m == NULL)
2081 		return ENOBUFS;
2082 	if (sopt_size > MLEN) {
2083 		MCLGET(m, sopt->sopt_td ? M_TRYWAIT : M_DONTWAIT);
2084 		if ((m->m_flags & M_EXT) == 0) {
2085 			m_free(m);
2086 			return ENOBUFS;
2087 		}
2088 		m->m_len = min(MCLBYTES, sopt_size);
2089 	} else {
2090 		m->m_len = min(MLEN, sopt_size);
2091 	}
2092 	sopt_size -= m->m_len;
2093 	*mp = m;
2094 	m_prev = m;
2095 
2096 	while (sopt_size) {
2097 		MGET(m, sopt->sopt_td ? M_TRYWAIT : M_DONTWAIT, MT_DATA);
2098 		if (m == NULL) {
2099 			m_freem(*mp);
2100 			return ENOBUFS;
2101 		}
2102 		if (sopt_size > MLEN) {
2103 			MCLGET(m, sopt->sopt_td != NULL ? M_TRYWAIT :
2104 			    M_DONTWAIT);
2105 			if ((m->m_flags & M_EXT) == 0) {
2106 				m_freem(m);
2107 				m_freem(*mp);
2108 				return ENOBUFS;
2109 			}
2110 			m->m_len = min(MCLBYTES, sopt_size);
2111 		} else {
2112 			m->m_len = min(MLEN, sopt_size);
2113 		}
2114 		sopt_size -= m->m_len;
2115 		m_prev->m_next = m;
2116 		m_prev = m;
2117 	}
2118 	return (0);
2119 }
2120 
2121 /* XXX; copyin sopt data into mbuf chain for (__FreeBSD__ < 3) routines. */
2122 int
2123 soopt_mcopyin(struct sockopt *sopt, struct mbuf *m)
2124 {
2125 	struct mbuf *m0 = m;
2126 
2127 	if (sopt->sopt_val == NULL)
2128 		return (0);
2129 	while (m != NULL && sopt->sopt_valsize >= m->m_len) {
2130 		if (sopt->sopt_td != NULL) {
2131 			int error;
2132 
2133 			error = copyin(sopt->sopt_val, mtod(m, char *),
2134 				       m->m_len);
2135 			if (error != 0) {
2136 				m_freem(m0);
2137 				return(error);
2138 			}
2139 		} else
2140 			bcopy(sopt->sopt_val, mtod(m, char *), m->m_len);
2141 		sopt->sopt_valsize -= m->m_len;
2142 		sopt->sopt_val = (char *)sopt->sopt_val + m->m_len;
2143 		m = m->m_next;
2144 	}
2145 	if (m != NULL) /* should be allocated enoughly at ip6_sooptmcopyin() */
2146 		panic("ip6_sooptmcopyin");
2147 	return (0);
2148 }
2149 
2150 /* XXX; copyout mbuf chain data into soopt for (__FreeBSD__ < 3) routines. */
2151 int
2152 soopt_mcopyout(struct sockopt *sopt, struct mbuf *m)
2153 {
2154 	struct mbuf *m0 = m;
2155 	size_t valsize = 0;
2156 
2157 	if (sopt->sopt_val == NULL)
2158 		return (0);
2159 	while (m != NULL && sopt->sopt_valsize >= m->m_len) {
2160 		if (sopt->sopt_td != NULL) {
2161 			int error;
2162 
2163 			error = copyout(mtod(m, char *), sopt->sopt_val,
2164 				       m->m_len);
2165 			if (error != 0) {
2166 				m_freem(m0);
2167 				return(error);
2168 			}
2169 		} else
2170 			bcopy(mtod(m, char *), sopt->sopt_val, m->m_len);
2171 	       sopt->sopt_valsize -= m->m_len;
2172 	       sopt->sopt_val = (char *)sopt->sopt_val + m->m_len;
2173 	       valsize += m->m_len;
2174 	       m = m->m_next;
2175 	}
2176 	if (m != NULL) {
2177 		/* enough soopt buffer should be given from user-land */
2178 		m_freem(m0);
2179 		return(EINVAL);
2180 	}
2181 	sopt->sopt_valsize = valsize;
2182 	return (0);
2183 }
2184 
2185 void
2186 sohasoutofband(so)
2187 	struct socket *so;
2188 {
2189 	if (so->so_sigio != NULL)
2190 		pgsigio(&so->so_sigio, SIGURG, 0);
2191 	selwakeuppri(&so->so_rcv.sb_sel, PSOCK);
2192 }
2193 
2194 int
2195 sopoll(struct socket *so, int events, struct ucred *active_cred,
2196     struct thread *td)
2197 {
2198 	int revents = 0;
2199 
2200 	SOCKBUF_LOCK(&so->so_snd);
2201 	SOCKBUF_LOCK(&so->so_rcv);
2202 	if (events & (POLLIN | POLLRDNORM))
2203 		if (soreadable(so))
2204 			revents |= events & (POLLIN | POLLRDNORM);
2205 
2206 	if (events & POLLINIGNEOF)
2207 		if (so->so_rcv.sb_cc >= so->so_rcv.sb_lowat ||
2208 		    !TAILQ_EMPTY(&so->so_comp) || so->so_error)
2209 			revents |= POLLINIGNEOF;
2210 
2211 	if (events & (POLLOUT | POLLWRNORM))
2212 		if (sowriteable(so))
2213 			revents |= events & (POLLOUT | POLLWRNORM);
2214 
2215 	if (events & (POLLPRI | POLLRDBAND))
2216 		if (so->so_oobmark || (so->so_rcv.sb_state & SBS_RCVATMARK))
2217 			revents |= events & (POLLPRI | POLLRDBAND);
2218 
2219 	if (revents == 0) {
2220 		if (events &
2221 		    (POLLIN | POLLINIGNEOF | POLLPRI | POLLRDNORM |
2222 		     POLLRDBAND)) {
2223 			selrecord(td, &so->so_rcv.sb_sel);
2224 			so->so_rcv.sb_flags |= SB_SEL;
2225 		}
2226 
2227 		if (events & (POLLOUT | POLLWRNORM)) {
2228 			selrecord(td, &so->so_snd.sb_sel);
2229 			so->so_snd.sb_flags |= SB_SEL;
2230 		}
2231 	}
2232 
2233 	SOCKBUF_UNLOCK(&so->so_rcv);
2234 	SOCKBUF_UNLOCK(&so->so_snd);
2235 	return (revents);
2236 }
2237 
2238 int
2239 soo_kqfilter(struct file *fp, struct knote *kn)
2240 {
2241 	struct socket *so = kn->kn_fp->f_data;
2242 	struct sockbuf *sb;
2243 
2244 	switch (kn->kn_filter) {
2245 	case EVFILT_READ:
2246 		if (so->so_options & SO_ACCEPTCONN)
2247 			kn->kn_fop = &solisten_filtops;
2248 		else
2249 			kn->kn_fop = &soread_filtops;
2250 		sb = &so->so_rcv;
2251 		break;
2252 	case EVFILT_WRITE:
2253 		kn->kn_fop = &sowrite_filtops;
2254 		sb = &so->so_snd;
2255 		break;
2256 	default:
2257 		return (EINVAL);
2258 	}
2259 
2260 	SOCKBUF_LOCK(sb);
2261 	knlist_add(&sb->sb_sel.si_note, kn, 1);
2262 	sb->sb_flags |= SB_KNOTE;
2263 	SOCKBUF_UNLOCK(sb);
2264 	return (0);
2265 }
2266 
2267 static void
2268 filt_sordetach(struct knote *kn)
2269 {
2270 	struct socket *so = kn->kn_fp->f_data;
2271 
2272 	SOCKBUF_LOCK(&so->so_rcv);
2273 	knlist_remove(&so->so_rcv.sb_sel.si_note, kn, 1);
2274 	if (knlist_empty(&so->so_rcv.sb_sel.si_note))
2275 		so->so_rcv.sb_flags &= ~SB_KNOTE;
2276 	SOCKBUF_UNLOCK(&so->so_rcv);
2277 }
2278 
2279 /*ARGSUSED*/
2280 static int
2281 filt_soread(struct knote *kn, long hint)
2282 {
2283 	struct socket *so;
2284 
2285 	so = kn->kn_fp->f_data;
2286 	SOCKBUF_LOCK_ASSERT(&so->so_rcv);
2287 
2288 	kn->kn_data = so->so_rcv.sb_cc - so->so_rcv.sb_ctl;
2289 	if (so->so_rcv.sb_state & SBS_CANTRCVMORE) {
2290 		kn->kn_flags |= EV_EOF;
2291 		kn->kn_fflags = so->so_error;
2292 		return (1);
2293 	} else if (so->so_error)	/* temporary udp error */
2294 		return (1);
2295 	else if (kn->kn_sfflags & NOTE_LOWAT)
2296 		return (kn->kn_data >= kn->kn_sdata);
2297 	else
2298 		return (so->so_rcv.sb_cc >= so->so_rcv.sb_lowat);
2299 }
2300 
2301 static void
2302 filt_sowdetach(struct knote *kn)
2303 {
2304 	struct socket *so = kn->kn_fp->f_data;
2305 
2306 	SOCKBUF_LOCK(&so->so_snd);
2307 	knlist_remove(&so->so_snd.sb_sel.si_note, kn, 1);
2308 	if (knlist_empty(&so->so_snd.sb_sel.si_note))
2309 		so->so_snd.sb_flags &= ~SB_KNOTE;
2310 	SOCKBUF_UNLOCK(&so->so_snd);
2311 }
2312 
2313 /*ARGSUSED*/
2314 static int
2315 filt_sowrite(struct knote *kn, long hint)
2316 {
2317 	struct socket *so;
2318 
2319 	so = kn->kn_fp->f_data;
2320 	SOCKBUF_LOCK_ASSERT(&so->so_snd);
2321 	kn->kn_data = sbspace(&so->so_snd);
2322 	if (so->so_snd.sb_state & SBS_CANTSENDMORE) {
2323 		kn->kn_flags |= EV_EOF;
2324 		kn->kn_fflags = so->so_error;
2325 		return (1);
2326 	} else if (so->so_error)	/* temporary udp error */
2327 		return (1);
2328 	else if (((so->so_state & SS_ISCONNECTED) == 0) &&
2329 	    (so->so_proto->pr_flags & PR_CONNREQUIRED))
2330 		return (0);
2331 	else if (kn->kn_sfflags & NOTE_LOWAT)
2332 		return (kn->kn_data >= kn->kn_sdata);
2333 	else
2334 		return (kn->kn_data >= so->so_snd.sb_lowat);
2335 }
2336 
2337 /*ARGSUSED*/
2338 static int
2339 filt_solisten(struct knote *kn, long hint)
2340 {
2341 	struct socket *so = kn->kn_fp->f_data;
2342 
2343 	kn->kn_data = so->so_qlen;
2344 	return (! TAILQ_EMPTY(&so->so_comp));
2345 }
2346 
2347 int
2348 socheckuid(struct socket *so, uid_t uid)
2349 {
2350 
2351 	if (so == NULL)
2352 		return (EPERM);
2353 	if (so->so_cred->cr_uid != uid)
2354 		return (EPERM);
2355 	return (0);
2356 }
2357 
2358 static int
2359 somaxconn_sysctl(SYSCTL_HANDLER_ARGS)
2360 {
2361 	int error;
2362 	int val;
2363 
2364 	val = somaxconn;
2365 	error = sysctl_handle_int(oidp, &val, sizeof(int), req);
2366 	if (error || !req->newptr )
2367 		return (error);
2368 
2369 	if (val < 1 || val > USHRT_MAX)
2370 		return (EINVAL);
2371 
2372 	somaxconn = val;
2373 	return (0);
2374 }
2375