xref: /freebsd/sys/kern/uipc_socket.c (revision f18976136625a7d016e97bfd9eabddf640b3e06d)
1 /*-
2  * SPDX-License-Identifier: BSD-3-Clause
3  *
4  * Copyright (c) 1982, 1986, 1988, 1990, 1993
5  *	The Regents of the University of California.
6  * Copyright (c) 2004 The FreeBSD Foundation
7  * Copyright (c) 2004-2008 Robert N. M. Watson
8  * All rights reserved.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  * 3. Neither the name of the University nor the names of its contributors
19  *    may be used to endorse or promote products derived from this software
20  *    without specific prior written permission.
21  *
22  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
23  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
26  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32  * SUCH DAMAGE.
33  *
34  *	@(#)uipc_socket.c	8.3 (Berkeley) 4/15/94
35  */
36 
37 /*
38  * Comments on the socket life cycle:
39  *
40  * soalloc() sets of socket layer state for a socket, called only by
41  * socreate() and sonewconn().  Socket layer private.
42  *
43  * sodealloc() tears down socket layer state for a socket, called only by
44  * sofree() and sonewconn().  Socket layer private.
45  *
46  * pru_attach() associates protocol layer state with an allocated socket;
47  * called only once, may fail, aborting socket allocation.  This is called
48  * from socreate() and sonewconn().  Socket layer private.
49  *
50  * pru_detach() disassociates protocol layer state from an attached socket,
51  * and will be called exactly once for sockets in which pru_attach() has
52  * been successfully called.  If pru_attach() returned an error,
53  * pru_detach() will not be called.  Socket layer private.
54  *
55  * pru_abort() and pru_close() notify the protocol layer that the last
56  * consumer of a socket is starting to tear down the socket, and that the
57  * protocol should terminate the connection.  Historically, pru_abort() also
58  * detached protocol state from the socket state, but this is no longer the
59  * case.
60  *
61  * socreate() creates a socket and attaches protocol state.  This is a public
62  * interface that may be used by socket layer consumers to create new
63  * sockets.
64  *
65  * sonewconn() creates a socket and attaches protocol state.  This is a
66  * public interface  that may be used by protocols to create new sockets when
67  * a new connection is received and will be available for accept() on a
68  * listen socket.
69  *
70  * soclose() destroys a socket after possibly waiting for it to disconnect.
71  * This is a public interface that socket consumers should use to close and
72  * release a socket when done with it.
73  *
74  * soabort() destroys a socket without waiting for it to disconnect (used
75  * only for incoming connections that are already partially or fully
76  * connected).  This is used internally by the socket layer when clearing
77  * listen socket queues (due to overflow or close on the listen socket), but
78  * is also a public interface protocols may use to abort connections in
79  * their incomplete listen queues should they no longer be required.  Sockets
80  * placed in completed connection listen queues should not be aborted for
81  * reasons described in the comment above the soclose() implementation.  This
82  * is not a general purpose close routine, and except in the specific
83  * circumstances described here, should not be used.
84  *
85  * sofree() will free a socket and its protocol state if all references on
86  * the socket have been released, and is the public interface to attempt to
87  * free a socket when a reference is removed.  This is a socket layer private
88  * interface.
89  *
90  * NOTE: In addition to socreate() and soclose(), which provide a single
91  * socket reference to the consumer to be managed as required, there are two
92  * calls to explicitly manage socket references, soref(), and sorele().
93  * Currently, these are generally required only when transitioning a socket
94  * from a listen queue to a file descriptor, in order to prevent garbage
95  * collection of the socket at an untimely moment.  For a number of reasons,
96  * these interfaces are not preferred, and should be avoided.
97  *
98  * NOTE: With regard to VNETs the general rule is that callers do not set
99  * curvnet. Exceptions to this rule include soabort(), sodisconnect(),
100  * sofree() (and with that sorele(), sotryfree()), as well as sonewconn()
101  * and sorflush(), which are usually called from a pre-set VNET context.
102  * sopoll() currently does not need a VNET context to be set.
103  */
104 
105 #include <sys/cdefs.h>
106 __FBSDID("$FreeBSD$");
107 
108 #include "opt_inet.h"
109 #include "opt_inet6.h"
110 #include "opt_kern_tls.h"
111 #include "opt_sctp.h"
112 
113 #include <sys/param.h>
114 #include <sys/systm.h>
115 #include <sys/fcntl.h>
116 #include <sys/limits.h>
117 #include <sys/lock.h>
118 #include <sys/mac.h>
119 #include <sys/malloc.h>
120 #include <sys/mbuf.h>
121 #include <sys/mutex.h>
122 #include <sys/domain.h>
123 #include <sys/file.h>			/* for struct knote */
124 #include <sys/hhook.h>
125 #include <sys/kernel.h>
126 #include <sys/khelp.h>
127 #include <sys/ktls.h>
128 #include <sys/event.h>
129 #include <sys/eventhandler.h>
130 #include <sys/poll.h>
131 #include <sys/proc.h>
132 #include <sys/protosw.h>
133 #include <sys/socket.h>
134 #include <sys/socketvar.h>
135 #include <sys/resourcevar.h>
136 #include <net/route.h>
137 #include <sys/signalvar.h>
138 #include <sys/stat.h>
139 #include <sys/sx.h>
140 #include <sys/sysctl.h>
141 #include <sys/taskqueue.h>
142 #include <sys/uio.h>
143 #include <sys/jail.h>
144 #include <sys/syslog.h>
145 #include <netinet/in.h>
146 #include <netinet/tcp.h>
147 
148 #include <net/vnet.h>
149 #include <net/if.h>	/* XXXGL: net_epoch should move out there */
150 #include <net/if_var.h>	/* XXXGL: net_epoch should move out there */
151 
152 #include <security/mac/mac_framework.h>
153 
154 #include <vm/uma.h>
155 
156 #ifdef COMPAT_FREEBSD32
157 #include <sys/mount.h>
158 #include <sys/sysent.h>
159 #include <compat/freebsd32/freebsd32.h>
160 #endif
161 
162 static int	soreceive_rcvoob(struct socket *so, struct uio *uio,
163 		    int flags);
164 static void	so_rdknl_lock(void *);
165 static void	so_rdknl_unlock(void *);
166 static void	so_rdknl_assert_locked(void *);
167 static void	so_rdknl_assert_unlocked(void *);
168 static void	so_wrknl_lock(void *);
169 static void	so_wrknl_unlock(void *);
170 static void	so_wrknl_assert_locked(void *);
171 static void	so_wrknl_assert_unlocked(void *);
172 
173 static void	filt_sordetach(struct knote *kn);
174 static int	filt_soread(struct knote *kn, long hint);
175 static void	filt_sowdetach(struct knote *kn);
176 static int	filt_sowrite(struct knote *kn, long hint);
177 static int	filt_soempty(struct knote *kn, long hint);
178 static int inline hhook_run_socket(struct socket *so, void *hctx, int32_t h_id);
179 fo_kqfilter_t	soo_kqfilter;
180 
181 static struct filterops soread_filtops = {
182 	.f_isfd = 1,
183 	.f_detach = filt_sordetach,
184 	.f_event = filt_soread,
185 };
186 static struct filterops sowrite_filtops = {
187 	.f_isfd = 1,
188 	.f_detach = filt_sowdetach,
189 	.f_event = filt_sowrite,
190 };
191 static struct filterops soempty_filtops = {
192 	.f_isfd = 1,
193 	.f_detach = filt_sowdetach,
194 	.f_event = filt_soempty,
195 };
196 
197 so_gen_t	so_gencnt;	/* generation count for sockets */
198 
199 MALLOC_DEFINE(M_SONAME, "soname", "socket name");
200 MALLOC_DEFINE(M_PCB, "pcb", "protocol control block");
201 
202 #define	VNET_SO_ASSERT(so)						\
203 	VNET_ASSERT(curvnet != NULL,					\
204 	    ("%s:%d curvnet is NULL, so=%p", __func__, __LINE__, (so)));
205 
206 VNET_DEFINE(struct hhook_head *, socket_hhh[HHOOK_SOCKET_LAST + 1]);
207 #define	V_socket_hhh		VNET(socket_hhh)
208 
209 /*
210  * Limit on the number of connections in the listen queue waiting
211  * for accept(2).
212  * NB: The original sysctl somaxconn is still available but hidden
213  * to prevent confusion about the actual purpose of this number.
214  */
215 static u_int somaxconn = SOMAXCONN;
216 
217 static int
218 sysctl_somaxconn(SYSCTL_HANDLER_ARGS)
219 {
220 	int error;
221 	int val;
222 
223 	val = somaxconn;
224 	error = sysctl_handle_int(oidp, &val, 0, req);
225 	if (error || !req->newptr )
226 		return (error);
227 
228 	/*
229 	 * The purpose of the UINT_MAX / 3 limit, is so that the formula
230 	 *   3 * so_qlimit / 2
231 	 * below, will not overflow.
232          */
233 
234 	if (val < 1 || val > UINT_MAX / 3)
235 		return (EINVAL);
236 
237 	somaxconn = val;
238 	return (0);
239 }
240 SYSCTL_PROC(_kern_ipc, OID_AUTO, soacceptqueue, CTLTYPE_UINT | CTLFLAG_RW,
241     0, sizeof(int), sysctl_somaxconn, "I",
242     "Maximum listen socket pending connection accept queue size");
243 SYSCTL_PROC(_kern_ipc, KIPC_SOMAXCONN, somaxconn,
244     CTLTYPE_UINT | CTLFLAG_RW | CTLFLAG_SKIP,
245     0, sizeof(int), sysctl_somaxconn, "I",
246     "Maximum listen socket pending connection accept queue size (compat)");
247 
248 static int numopensockets;
249 SYSCTL_INT(_kern_ipc, OID_AUTO, numopensockets, CTLFLAG_RD,
250     &numopensockets, 0, "Number of open sockets");
251 
252 /*
253  * accept_mtx locks down per-socket fields relating to accept queues.  See
254  * socketvar.h for an annotation of the protected fields of struct socket.
255  */
256 struct mtx accept_mtx;
257 MTX_SYSINIT(accept_mtx, &accept_mtx, "accept", MTX_DEF);
258 
259 /*
260  * so_global_mtx protects so_gencnt, numopensockets, and the per-socket
261  * so_gencnt field.
262  */
263 static struct mtx so_global_mtx;
264 MTX_SYSINIT(so_global_mtx, &so_global_mtx, "so_glabel", MTX_DEF);
265 
266 /*
267  * General IPC sysctl name space, used by sockets and a variety of other IPC
268  * types.
269  */
270 SYSCTL_NODE(_kern, KERN_IPC, ipc, CTLFLAG_RW, 0, "IPC");
271 
272 /*
273  * Initialize the socket subsystem and set up the socket
274  * memory allocator.
275  */
276 static uma_zone_t socket_zone;
277 int	maxsockets;
278 
279 static void
280 socket_zone_change(void *tag)
281 {
282 
283 	maxsockets = uma_zone_set_max(socket_zone, maxsockets);
284 }
285 
286 static void
287 socket_hhook_register(int subtype)
288 {
289 
290 	if (hhook_head_register(HHOOK_TYPE_SOCKET, subtype,
291 	    &V_socket_hhh[subtype],
292 	    HHOOK_NOWAIT|HHOOK_HEADISINVNET) != 0)
293 		printf("%s: WARNING: unable to register hook\n", __func__);
294 }
295 
296 static void
297 socket_hhook_deregister(int subtype)
298 {
299 
300 	if (hhook_head_deregister(V_socket_hhh[subtype]) != 0)
301 		printf("%s: WARNING: unable to deregister hook\n", __func__);
302 }
303 
304 static void
305 socket_init(void *tag)
306 {
307 
308 	socket_zone = uma_zcreate("socket", sizeof(struct socket), NULL, NULL,
309 	    NULL, NULL, UMA_ALIGN_PTR, UMA_ZONE_NOFREE);
310 	maxsockets = uma_zone_set_max(socket_zone, maxsockets);
311 	uma_zone_set_warning(socket_zone, "kern.ipc.maxsockets limit reached");
312 	EVENTHANDLER_REGISTER(maxsockets_change, socket_zone_change, NULL,
313 	    EVENTHANDLER_PRI_FIRST);
314 }
315 SYSINIT(socket, SI_SUB_PROTO_DOMAININIT, SI_ORDER_ANY, socket_init, NULL);
316 
317 static void
318 socket_vnet_init(const void *unused __unused)
319 {
320 	int i;
321 
322 	/* We expect a contiguous range */
323 	for (i = 0; i <= HHOOK_SOCKET_LAST; i++)
324 		socket_hhook_register(i);
325 }
326 VNET_SYSINIT(socket_vnet_init, SI_SUB_PROTO_DOMAININIT, SI_ORDER_ANY,
327     socket_vnet_init, NULL);
328 
329 static void
330 socket_vnet_uninit(const void *unused __unused)
331 {
332 	int i;
333 
334 	for (i = 0; i <= HHOOK_SOCKET_LAST; i++)
335 		socket_hhook_deregister(i);
336 }
337 VNET_SYSUNINIT(socket_vnet_uninit, SI_SUB_PROTO_DOMAININIT, SI_ORDER_ANY,
338     socket_vnet_uninit, NULL);
339 
340 /*
341  * Initialise maxsockets.  This SYSINIT must be run after
342  * tunable_mbinit().
343  */
344 static void
345 init_maxsockets(void *ignored)
346 {
347 
348 	TUNABLE_INT_FETCH("kern.ipc.maxsockets", &maxsockets);
349 	maxsockets = imax(maxsockets, maxfiles);
350 }
351 SYSINIT(param, SI_SUB_TUNABLES, SI_ORDER_ANY, init_maxsockets, NULL);
352 
353 /*
354  * Sysctl to get and set the maximum global sockets limit.  Notify protocols
355  * of the change so that they can update their dependent limits as required.
356  */
357 static int
358 sysctl_maxsockets(SYSCTL_HANDLER_ARGS)
359 {
360 	int error, newmaxsockets;
361 
362 	newmaxsockets = maxsockets;
363 	error = sysctl_handle_int(oidp, &newmaxsockets, 0, req);
364 	if (error == 0 && req->newptr) {
365 		if (newmaxsockets > maxsockets &&
366 		    newmaxsockets <= maxfiles) {
367 			maxsockets = newmaxsockets;
368 			EVENTHANDLER_INVOKE(maxsockets_change);
369 		} else
370 			error = EINVAL;
371 	}
372 	return (error);
373 }
374 SYSCTL_PROC(_kern_ipc, OID_AUTO, maxsockets, CTLTYPE_INT|CTLFLAG_RW,
375     &maxsockets, 0, sysctl_maxsockets, "IU",
376     "Maximum number of sockets available");
377 
378 /*
379  * Socket operation routines.  These routines are called by the routines in
380  * sys_socket.c or from a system process, and implement the semantics of
381  * socket operations by switching out to the protocol specific routines.
382  */
383 
384 /*
385  * Get a socket structure from our zone, and initialize it.  Note that it
386  * would probably be better to allocate socket and PCB at the same time, but
387  * I'm not convinced that all the protocols can be easily modified to do
388  * this.
389  *
390  * soalloc() returns a socket with a ref count of 0.
391  */
392 static struct socket *
393 soalloc(struct vnet *vnet)
394 {
395 	struct socket *so;
396 
397 	so = uma_zalloc(socket_zone, M_NOWAIT | M_ZERO);
398 	if (so == NULL)
399 		return (NULL);
400 #ifdef MAC
401 	if (mac_socket_init(so, M_NOWAIT) != 0) {
402 		uma_zfree(socket_zone, so);
403 		return (NULL);
404 	}
405 #endif
406 	if (khelp_init_osd(HELPER_CLASS_SOCKET, &so->osd)) {
407 		uma_zfree(socket_zone, so);
408 		return (NULL);
409 	}
410 
411 	/*
412 	 * The socket locking protocol allows to lock 2 sockets at a time,
413 	 * however, the first one must be a listening socket.  WITNESS lacks
414 	 * a feature to change class of an existing lock, so we use DUPOK.
415 	 */
416 	mtx_init(&so->so_lock, "socket", NULL, MTX_DEF | MTX_DUPOK);
417 	SOCKBUF_LOCK_INIT(&so->so_snd, "so_snd");
418 	SOCKBUF_LOCK_INIT(&so->so_rcv, "so_rcv");
419 	so->so_rcv.sb_sel = &so->so_rdsel;
420 	so->so_snd.sb_sel = &so->so_wrsel;
421 	sx_init(&so->so_snd.sb_sx, "so_snd_sx");
422 	sx_init(&so->so_rcv.sb_sx, "so_rcv_sx");
423 	TAILQ_INIT(&so->so_snd.sb_aiojobq);
424 	TAILQ_INIT(&so->so_rcv.sb_aiojobq);
425 	TASK_INIT(&so->so_snd.sb_aiotask, 0, soaio_snd, so);
426 	TASK_INIT(&so->so_rcv.sb_aiotask, 0, soaio_rcv, so);
427 #ifdef VIMAGE
428 	VNET_ASSERT(vnet != NULL, ("%s:%d vnet is NULL, so=%p",
429 	    __func__, __LINE__, so));
430 	so->so_vnet = vnet;
431 #endif
432 	/* We shouldn't need the so_global_mtx */
433 	if (hhook_run_socket(so, NULL, HHOOK_SOCKET_CREATE)) {
434 		/* Do we need more comprehensive error returns? */
435 		uma_zfree(socket_zone, so);
436 		return (NULL);
437 	}
438 	mtx_lock(&so_global_mtx);
439 	so->so_gencnt = ++so_gencnt;
440 	++numopensockets;
441 #ifdef VIMAGE
442 	vnet->vnet_sockcnt++;
443 #endif
444 	mtx_unlock(&so_global_mtx);
445 
446 	return (so);
447 }
448 
449 /*
450  * Free the storage associated with a socket at the socket layer, tear down
451  * locks, labels, etc.  All protocol state is assumed already to have been
452  * torn down (and possibly never set up) by the caller.
453  */
454 static void
455 sodealloc(struct socket *so)
456 {
457 
458 	KASSERT(so->so_count == 0, ("sodealloc(): so_count %d", so->so_count));
459 	KASSERT(so->so_pcb == NULL, ("sodealloc(): so_pcb != NULL"));
460 
461 	mtx_lock(&so_global_mtx);
462 	so->so_gencnt = ++so_gencnt;
463 	--numopensockets;	/* Could be below, but faster here. */
464 #ifdef VIMAGE
465 	VNET_ASSERT(so->so_vnet != NULL, ("%s:%d so_vnet is NULL, so=%p",
466 	    __func__, __LINE__, so));
467 	so->so_vnet->vnet_sockcnt--;
468 #endif
469 	mtx_unlock(&so_global_mtx);
470 #ifdef MAC
471 	mac_socket_destroy(so);
472 #endif
473 	hhook_run_socket(so, NULL, HHOOK_SOCKET_CLOSE);
474 
475 	crfree(so->so_cred);
476 	khelp_destroy_osd(&so->osd);
477 	if (SOLISTENING(so)) {
478 		if (so->sol_accept_filter != NULL)
479 			accept_filt_setopt(so, NULL);
480 	} else {
481 		if (so->so_rcv.sb_hiwat)
482 			(void)chgsbsize(so->so_cred->cr_uidinfo,
483 			    &so->so_rcv.sb_hiwat, 0, RLIM_INFINITY);
484 		if (so->so_snd.sb_hiwat)
485 			(void)chgsbsize(so->so_cred->cr_uidinfo,
486 			    &so->so_snd.sb_hiwat, 0, RLIM_INFINITY);
487 		sx_destroy(&so->so_snd.sb_sx);
488 		sx_destroy(&so->so_rcv.sb_sx);
489 		SOCKBUF_LOCK_DESTROY(&so->so_snd);
490 		SOCKBUF_LOCK_DESTROY(&so->so_rcv);
491 	}
492 	mtx_destroy(&so->so_lock);
493 	uma_zfree(socket_zone, so);
494 }
495 
496 /*
497  * socreate returns a socket with a ref count of 1.  The socket should be
498  * closed with soclose().
499  */
500 int
501 socreate(int dom, struct socket **aso, int type, int proto,
502     struct ucred *cred, struct thread *td)
503 {
504 	struct protosw *prp;
505 	struct socket *so;
506 	int error;
507 
508 	if (proto)
509 		prp = pffindproto(dom, proto, type);
510 	else
511 		prp = pffindtype(dom, type);
512 
513 	if (prp == NULL) {
514 		/* No support for domain. */
515 		if (pffinddomain(dom) == NULL)
516 			return (EAFNOSUPPORT);
517 		/* No support for socket type. */
518 		if (proto == 0 && type != 0)
519 			return (EPROTOTYPE);
520 		return (EPROTONOSUPPORT);
521 	}
522 	if (prp->pr_usrreqs->pru_attach == NULL ||
523 	    prp->pr_usrreqs->pru_attach == pru_attach_notsupp)
524 		return (EPROTONOSUPPORT);
525 
526 	if (prison_check_af(cred, prp->pr_domain->dom_family) != 0)
527 		return (EPROTONOSUPPORT);
528 
529 	if (prp->pr_type != type)
530 		return (EPROTOTYPE);
531 	so = soalloc(CRED_TO_VNET(cred));
532 	if (so == NULL)
533 		return (ENOBUFS);
534 
535 	so->so_type = type;
536 	so->so_cred = crhold(cred);
537 	if ((prp->pr_domain->dom_family == PF_INET) ||
538 	    (prp->pr_domain->dom_family == PF_INET6) ||
539 	    (prp->pr_domain->dom_family == PF_ROUTE))
540 		so->so_fibnum = td->td_proc->p_fibnum;
541 	else
542 		so->so_fibnum = 0;
543 	so->so_proto = prp;
544 #ifdef MAC
545 	mac_socket_create(cred, so);
546 #endif
547 	knlist_init(&so->so_rdsel.si_note, so, so_rdknl_lock, so_rdknl_unlock,
548 	    so_rdknl_assert_locked, so_rdknl_assert_unlocked);
549 	knlist_init(&so->so_wrsel.si_note, so, so_wrknl_lock, so_wrknl_unlock,
550 	    so_wrknl_assert_locked, so_wrknl_assert_unlocked);
551 	/*
552 	 * Auto-sizing of socket buffers is managed by the protocols and
553 	 * the appropriate flags must be set in the pru_attach function.
554 	 */
555 	CURVNET_SET(so->so_vnet);
556 	error = (*prp->pr_usrreqs->pru_attach)(so, proto, td);
557 	CURVNET_RESTORE();
558 	if (error) {
559 		sodealloc(so);
560 		return (error);
561 	}
562 	soref(so);
563 	*aso = so;
564 	return (0);
565 }
566 
567 #ifdef REGRESSION
568 static int regression_sonewconn_earlytest = 1;
569 SYSCTL_INT(_regression, OID_AUTO, sonewconn_earlytest, CTLFLAG_RW,
570     &regression_sonewconn_earlytest, 0, "Perform early sonewconn limit test");
571 #endif
572 
573 /*
574  * When an attempt at a new connection is noted on a socket which accepts
575  * connections, sonewconn is called.  If the connection is possible (subject
576  * to space constraints, etc.) then we allocate a new structure, properly
577  * linked into the data structure of the original socket, and return this.
578  * Connstatus may be 0, or SS_ISCONFIRMING, or SS_ISCONNECTED.
579  *
580  * Note: the ref count on the socket is 0 on return.
581  */
582 struct socket *
583 sonewconn(struct socket *head, int connstatus)
584 {
585 	static struct timeval lastover;
586 	static struct timeval overinterval = { 60, 0 };
587 	static int overcount;
588 
589 	struct socket *so;
590 	u_int over;
591 
592 	SOLISTEN_LOCK(head);
593 	over = (head->sol_qlen > 3 * head->sol_qlimit / 2);
594 	SOLISTEN_UNLOCK(head);
595 #ifdef REGRESSION
596 	if (regression_sonewconn_earlytest && over) {
597 #else
598 	if (over) {
599 #endif
600 		overcount++;
601 
602 		if (ratecheck(&lastover, &overinterval)) {
603 			log(LOG_DEBUG, "%s: pcb %p: Listen queue overflow: "
604 			    "%i already in queue awaiting acceptance "
605 			    "(%d occurrences)\n",
606 			    __func__, head->so_pcb, head->sol_qlen, overcount);
607 
608 			overcount = 0;
609 		}
610 
611 		return (NULL);
612 	}
613 	VNET_ASSERT(head->so_vnet != NULL, ("%s: so %p vnet is NULL",
614 	    __func__, head));
615 	so = soalloc(head->so_vnet);
616 	if (so == NULL) {
617 		log(LOG_DEBUG, "%s: pcb %p: New socket allocation failure: "
618 		    "limit reached or out of memory\n",
619 		    __func__, head->so_pcb);
620 		return (NULL);
621 	}
622 	so->so_listen = head;
623 	so->so_type = head->so_type;
624 	so->so_linger = head->so_linger;
625 	so->so_state = head->so_state | SS_NOFDREF;
626 	so->so_fibnum = head->so_fibnum;
627 	so->so_proto = head->so_proto;
628 	so->so_cred = crhold(head->so_cred);
629 #ifdef MAC
630 	mac_socket_newconn(head, so);
631 #endif
632 	knlist_init(&so->so_rdsel.si_note, so, so_rdknl_lock, so_rdknl_unlock,
633 	    so_rdknl_assert_locked, so_rdknl_assert_unlocked);
634 	knlist_init(&so->so_wrsel.si_note, so, so_wrknl_lock, so_wrknl_unlock,
635 	    so_wrknl_assert_locked, so_wrknl_assert_unlocked);
636 	VNET_SO_ASSERT(head);
637 	if (soreserve(so, head->sol_sbsnd_hiwat, head->sol_sbrcv_hiwat)) {
638 		sodealloc(so);
639 		log(LOG_DEBUG, "%s: pcb %p: soreserve() failed\n",
640 		    __func__, head->so_pcb);
641 		return (NULL);
642 	}
643 	if ((*so->so_proto->pr_usrreqs->pru_attach)(so, 0, NULL)) {
644 		sodealloc(so);
645 		log(LOG_DEBUG, "%s: pcb %p: pru_attach() failed\n",
646 		    __func__, head->so_pcb);
647 		return (NULL);
648 	}
649 	so->so_rcv.sb_lowat = head->sol_sbrcv_lowat;
650 	so->so_snd.sb_lowat = head->sol_sbsnd_lowat;
651 	so->so_rcv.sb_timeo = head->sol_sbrcv_timeo;
652 	so->so_snd.sb_timeo = head->sol_sbsnd_timeo;
653 	so->so_rcv.sb_flags |= head->sol_sbrcv_flags & SB_AUTOSIZE;
654 	so->so_snd.sb_flags |= head->sol_sbsnd_flags & SB_AUTOSIZE;
655 
656 	SOLISTEN_LOCK(head);
657 	if (head->sol_accept_filter != NULL)
658 		connstatus = 0;
659 	so->so_state |= connstatus;
660 	so->so_options = head->so_options & ~SO_ACCEPTCONN;
661 	soref(head); /* A socket on (in)complete queue refs head. */
662 	if (connstatus) {
663 		TAILQ_INSERT_TAIL(&head->sol_comp, so, so_list);
664 		so->so_qstate = SQ_COMP;
665 		head->sol_qlen++;
666 		solisten_wakeup(head);	/* unlocks */
667 	} else {
668 		/*
669 		 * Keep removing sockets from the head until there's room for
670 		 * us to insert on the tail.  In pre-locking revisions, this
671 		 * was a simple if(), but as we could be racing with other
672 		 * threads and soabort() requires dropping locks, we must
673 		 * loop waiting for the condition to be true.
674 		 */
675 		while (head->sol_incqlen > head->sol_qlimit) {
676 			struct socket *sp;
677 
678 			sp = TAILQ_FIRST(&head->sol_incomp);
679 			TAILQ_REMOVE(&head->sol_incomp, sp, so_list);
680 			head->sol_incqlen--;
681 			SOCK_LOCK(sp);
682 			sp->so_qstate = SQ_NONE;
683 			sp->so_listen = NULL;
684 			SOCK_UNLOCK(sp);
685 			sorele(head);	/* does SOLISTEN_UNLOCK, head stays */
686 			soabort(sp);
687 			SOLISTEN_LOCK(head);
688 		}
689 		TAILQ_INSERT_TAIL(&head->sol_incomp, so, so_list);
690 		so->so_qstate = SQ_INCOMP;
691 		head->sol_incqlen++;
692 		SOLISTEN_UNLOCK(head);
693 	}
694 	return (so);
695 }
696 
697 #ifdef SCTP
698 /*
699  * Socket part of sctp_peeloff().  Detach a new socket from an
700  * association.  The new socket is returned with a reference.
701  */
702 struct socket *
703 sopeeloff(struct socket *head)
704 {
705 	struct socket *so;
706 
707 	VNET_ASSERT(head->so_vnet != NULL, ("%s:%d so_vnet is NULL, head=%p",
708 	    __func__, __LINE__, head));
709 	so = soalloc(head->so_vnet);
710 	if (so == NULL) {
711 		log(LOG_DEBUG, "%s: pcb %p: New socket allocation failure: "
712 		    "limit reached or out of memory\n",
713 		    __func__, head->so_pcb);
714 		return (NULL);
715 	}
716 	so->so_type = head->so_type;
717 	so->so_options = head->so_options;
718 	so->so_linger = head->so_linger;
719 	so->so_state = (head->so_state & SS_NBIO) | SS_ISCONNECTED;
720 	so->so_fibnum = head->so_fibnum;
721 	so->so_proto = head->so_proto;
722 	so->so_cred = crhold(head->so_cred);
723 #ifdef MAC
724 	mac_socket_newconn(head, so);
725 #endif
726 	knlist_init(&so->so_rdsel.si_note, so, so_rdknl_lock, so_rdknl_unlock,
727 	    so_rdknl_assert_locked, so_rdknl_assert_unlocked);
728 	knlist_init(&so->so_wrsel.si_note, so, so_wrknl_lock, so_wrknl_unlock,
729 	    so_wrknl_assert_locked, so_wrknl_assert_unlocked);
730 	VNET_SO_ASSERT(head);
731 	if (soreserve(so, head->so_snd.sb_hiwat, head->so_rcv.sb_hiwat)) {
732 		sodealloc(so);
733 		log(LOG_DEBUG, "%s: pcb %p: soreserve() failed\n",
734 		    __func__, head->so_pcb);
735 		return (NULL);
736 	}
737 	if ((*so->so_proto->pr_usrreqs->pru_attach)(so, 0, NULL)) {
738 		sodealloc(so);
739 		log(LOG_DEBUG, "%s: pcb %p: pru_attach() failed\n",
740 		    __func__, head->so_pcb);
741 		return (NULL);
742 	}
743 	so->so_rcv.sb_lowat = head->so_rcv.sb_lowat;
744 	so->so_snd.sb_lowat = head->so_snd.sb_lowat;
745 	so->so_rcv.sb_timeo = head->so_rcv.sb_timeo;
746 	so->so_snd.sb_timeo = head->so_snd.sb_timeo;
747 	so->so_rcv.sb_flags |= head->so_rcv.sb_flags & SB_AUTOSIZE;
748 	so->so_snd.sb_flags |= head->so_snd.sb_flags & SB_AUTOSIZE;
749 
750 	soref(so);
751 
752 	return (so);
753 }
754 #endif	/* SCTP */
755 
756 int
757 sobind(struct socket *so, struct sockaddr *nam, struct thread *td)
758 {
759 	int error;
760 
761 	CURVNET_SET(so->so_vnet);
762 	error = (*so->so_proto->pr_usrreqs->pru_bind)(so, nam, td);
763 	CURVNET_RESTORE();
764 	return (error);
765 }
766 
767 int
768 sobindat(int fd, struct socket *so, struct sockaddr *nam, struct thread *td)
769 {
770 	int error;
771 
772 	CURVNET_SET(so->so_vnet);
773 	error = (*so->so_proto->pr_usrreqs->pru_bindat)(fd, so, nam, td);
774 	CURVNET_RESTORE();
775 	return (error);
776 }
777 
778 /*
779  * solisten() transitions a socket from a non-listening state to a listening
780  * state, but can also be used to update the listen queue depth on an
781  * existing listen socket.  The protocol will call back into the sockets
782  * layer using solisten_proto_check() and solisten_proto() to check and set
783  * socket-layer listen state.  Call backs are used so that the protocol can
784  * acquire both protocol and socket layer locks in whatever order is required
785  * by the protocol.
786  *
787  * Protocol implementors are advised to hold the socket lock across the
788  * socket-layer test and set to avoid races at the socket layer.
789  */
790 int
791 solisten(struct socket *so, int backlog, struct thread *td)
792 {
793 	int error;
794 
795 	CURVNET_SET(so->so_vnet);
796 	error = (*so->so_proto->pr_usrreqs->pru_listen)(so, backlog, td);
797 	CURVNET_RESTORE();
798 	return (error);
799 }
800 
801 int
802 solisten_proto_check(struct socket *so)
803 {
804 
805 	SOCK_LOCK_ASSERT(so);
806 
807 	if (so->so_state & (SS_ISCONNECTED | SS_ISCONNECTING |
808 	    SS_ISDISCONNECTING))
809 		return (EINVAL);
810 	return (0);
811 }
812 
813 void
814 solisten_proto(struct socket *so, int backlog)
815 {
816 	int sbrcv_lowat, sbsnd_lowat;
817 	u_int sbrcv_hiwat, sbsnd_hiwat;
818 	short sbrcv_flags, sbsnd_flags;
819 	sbintime_t sbrcv_timeo, sbsnd_timeo;
820 
821 	SOCK_LOCK_ASSERT(so);
822 
823 	if (SOLISTENING(so))
824 		goto listening;
825 
826 	/*
827 	 * Change this socket to listening state.
828 	 */
829 	sbrcv_lowat = so->so_rcv.sb_lowat;
830 	sbsnd_lowat = so->so_snd.sb_lowat;
831 	sbrcv_hiwat = so->so_rcv.sb_hiwat;
832 	sbsnd_hiwat = so->so_snd.sb_hiwat;
833 	sbrcv_flags = so->so_rcv.sb_flags;
834 	sbsnd_flags = so->so_snd.sb_flags;
835 	sbrcv_timeo = so->so_rcv.sb_timeo;
836 	sbsnd_timeo = so->so_snd.sb_timeo;
837 
838 	sbdestroy(&so->so_snd, so);
839 	sbdestroy(&so->so_rcv, so);
840 	sx_destroy(&so->so_snd.sb_sx);
841 	sx_destroy(&so->so_rcv.sb_sx);
842 	SOCKBUF_LOCK_DESTROY(&so->so_snd);
843 	SOCKBUF_LOCK_DESTROY(&so->so_rcv);
844 
845 #ifdef INVARIANTS
846 	bzero(&so->so_rcv,
847 	    sizeof(struct socket) - offsetof(struct socket, so_rcv));
848 #endif
849 
850 	so->sol_sbrcv_lowat = sbrcv_lowat;
851 	so->sol_sbsnd_lowat = sbsnd_lowat;
852 	so->sol_sbrcv_hiwat = sbrcv_hiwat;
853 	so->sol_sbsnd_hiwat = sbsnd_hiwat;
854 	so->sol_sbrcv_flags = sbrcv_flags;
855 	so->sol_sbsnd_flags = sbsnd_flags;
856 	so->sol_sbrcv_timeo = sbrcv_timeo;
857 	so->sol_sbsnd_timeo = sbsnd_timeo;
858 
859 	so->sol_qlen = so->sol_incqlen = 0;
860 	TAILQ_INIT(&so->sol_incomp);
861 	TAILQ_INIT(&so->sol_comp);
862 
863 	so->sol_accept_filter = NULL;
864 	so->sol_accept_filter_arg = NULL;
865 	so->sol_accept_filter_str = NULL;
866 
867 	so->sol_upcall = NULL;
868 	so->sol_upcallarg = NULL;
869 
870 	so->so_options |= SO_ACCEPTCONN;
871 
872 listening:
873 	if (backlog < 0 || backlog > somaxconn)
874 		backlog = somaxconn;
875 	so->sol_qlimit = backlog;
876 }
877 
878 /*
879  * Wakeup listeners/subsystems once we have a complete connection.
880  * Enters with lock, returns unlocked.
881  */
882 void
883 solisten_wakeup(struct socket *sol)
884 {
885 
886 	if (sol->sol_upcall != NULL)
887 		(void )sol->sol_upcall(sol, sol->sol_upcallarg, M_NOWAIT);
888 	else {
889 		selwakeuppri(&sol->so_rdsel, PSOCK);
890 		KNOTE_LOCKED(&sol->so_rdsel.si_note, 0);
891 	}
892 	SOLISTEN_UNLOCK(sol);
893 	wakeup_one(&sol->sol_comp);
894 	if ((sol->so_state & SS_ASYNC) && sol->so_sigio != NULL)
895 		pgsigio(&sol->so_sigio, SIGIO, 0);
896 }
897 
898 /*
899  * Return single connection off a listening socket queue.  Main consumer of
900  * the function is kern_accept4().  Some modules, that do their own accept
901  * management also use the function.
902  *
903  * Listening socket must be locked on entry and is returned unlocked on
904  * return.
905  * The flags argument is set of accept4(2) flags and ACCEPT4_INHERIT.
906  */
907 int
908 solisten_dequeue(struct socket *head, struct socket **ret, int flags)
909 {
910 	struct socket *so;
911 	int error;
912 
913 	SOLISTEN_LOCK_ASSERT(head);
914 
915 	while (!(head->so_state & SS_NBIO) && TAILQ_EMPTY(&head->sol_comp) &&
916 	    head->so_error == 0) {
917 		error = msleep(&head->sol_comp, &head->so_lock, PSOCK | PCATCH,
918 		    "accept", 0);
919 		if (error != 0) {
920 			SOLISTEN_UNLOCK(head);
921 			return (error);
922 		}
923 	}
924 	if (head->so_error) {
925 		error = head->so_error;
926 		head->so_error = 0;
927 	} else if ((head->so_state & SS_NBIO) && TAILQ_EMPTY(&head->sol_comp))
928 		error = EWOULDBLOCK;
929 	else
930 		error = 0;
931 	if (error) {
932 		SOLISTEN_UNLOCK(head);
933 		return (error);
934 	}
935 	so = TAILQ_FIRST(&head->sol_comp);
936 	SOCK_LOCK(so);
937 	KASSERT(so->so_qstate == SQ_COMP,
938 	    ("%s: so %p not SQ_COMP", __func__, so));
939 	soref(so);
940 	head->sol_qlen--;
941 	so->so_qstate = SQ_NONE;
942 	so->so_listen = NULL;
943 	TAILQ_REMOVE(&head->sol_comp, so, so_list);
944 	if (flags & ACCEPT4_INHERIT)
945 		so->so_state |= (head->so_state & SS_NBIO);
946 	else
947 		so->so_state |= (flags & SOCK_NONBLOCK) ? SS_NBIO : 0;
948 	SOCK_UNLOCK(so);
949 	sorele(head);
950 
951 	*ret = so;
952 	return (0);
953 }
954 
955 /*
956  * Evaluate the reference count and named references on a socket; if no
957  * references remain, free it.  This should be called whenever a reference is
958  * released, such as in sorele(), but also when named reference flags are
959  * cleared in socket or protocol code.
960  *
961  * sofree() will free the socket if:
962  *
963  * - There are no outstanding file descriptor references or related consumers
964  *   (so_count == 0).
965  *
966  * - The socket has been closed by user space, if ever open (SS_NOFDREF).
967  *
968  * - The protocol does not have an outstanding strong reference on the socket
969  *   (SS_PROTOREF).
970  *
971  * - The socket is not in a completed connection queue, so a process has been
972  *   notified that it is present.  If it is removed, the user process may
973  *   block in accept() despite select() saying the socket was ready.
974  */
975 void
976 sofree(struct socket *so)
977 {
978 	struct protosw *pr = so->so_proto;
979 
980 	SOCK_LOCK_ASSERT(so);
981 
982 	if ((so->so_state & SS_NOFDREF) == 0 || so->so_count != 0 ||
983 	    (so->so_state & SS_PROTOREF) || (so->so_qstate == SQ_COMP)) {
984 		SOCK_UNLOCK(so);
985 		return;
986 	}
987 
988 	if (!SOLISTENING(so) && so->so_qstate == SQ_INCOMP) {
989 		struct socket *sol;
990 
991 		sol = so->so_listen;
992 		KASSERT(sol, ("%s: so %p on incomp of NULL", __func__, so));
993 
994 		/*
995 		 * To solve race between close of a listening socket and
996 		 * a socket on its incomplete queue, we need to lock both.
997 		 * The order is first listening socket, then regular.
998 		 * Since we don't have SS_NOFDREF neither SS_PROTOREF, this
999 		 * function and the listening socket are the only pointers
1000 		 * to so.  To preserve so and sol, we reference both and then
1001 		 * relock.
1002 		 * After relock the socket may not move to so_comp since it
1003 		 * doesn't have PCB already, but it may be removed from
1004 		 * so_incomp. If that happens, we share responsiblity on
1005 		 * freeing the socket, but soclose() has already removed
1006 		 * it from queue.
1007 		 */
1008 		soref(sol);
1009 		soref(so);
1010 		SOCK_UNLOCK(so);
1011 		SOLISTEN_LOCK(sol);
1012 		SOCK_LOCK(so);
1013 		if (so->so_qstate == SQ_INCOMP) {
1014 			KASSERT(so->so_listen == sol,
1015 			    ("%s: so %p migrated out of sol %p",
1016 			    __func__, so, sol));
1017 			TAILQ_REMOVE(&sol->sol_incomp, so, so_list);
1018 			sol->sol_incqlen--;
1019 			/* This is guarenteed not to be the last. */
1020 			refcount_release(&sol->so_count);
1021 			so->so_qstate = SQ_NONE;
1022 			so->so_listen = NULL;
1023 		} else
1024 			KASSERT(so->so_listen == NULL,
1025 			    ("%s: so %p not on (in)comp with so_listen",
1026 			    __func__, so));
1027 		sorele(sol);
1028 		KASSERT(so->so_count == 1,
1029 		    ("%s: so %p count %u", __func__, so, so->so_count));
1030 		so->so_count = 0;
1031 	}
1032 	if (SOLISTENING(so))
1033 		so->so_error = ECONNABORTED;
1034 	SOCK_UNLOCK(so);
1035 
1036 	if (so->so_dtor != NULL)
1037 		so->so_dtor(so);
1038 
1039 	VNET_SO_ASSERT(so);
1040 	if (pr->pr_flags & PR_RIGHTS && pr->pr_domain->dom_dispose != NULL)
1041 		(*pr->pr_domain->dom_dispose)(so);
1042 	if (pr->pr_usrreqs->pru_detach != NULL)
1043 		(*pr->pr_usrreqs->pru_detach)(so);
1044 
1045 	/*
1046 	 * From this point on, we assume that no other references to this
1047 	 * socket exist anywhere else in the stack.  Therefore, no locks need
1048 	 * to be acquired or held.
1049 	 *
1050 	 * We used to do a lot of socket buffer and socket locking here, as
1051 	 * well as invoke sorflush() and perform wakeups.  The direct call to
1052 	 * dom_dispose() and sbdestroy() are an inlining of what was
1053 	 * necessary from sorflush().
1054 	 *
1055 	 * Notice that the socket buffer and kqueue state are torn down
1056 	 * before calling pru_detach.  This means that protocols shold not
1057 	 * assume they can perform socket wakeups, etc, in their detach code.
1058 	 */
1059 	if (!SOLISTENING(so)) {
1060 		sbdestroy(&so->so_snd, so);
1061 		sbdestroy(&so->so_rcv, so);
1062 	}
1063 	seldrain(&so->so_rdsel);
1064 	seldrain(&so->so_wrsel);
1065 	knlist_destroy(&so->so_rdsel.si_note);
1066 	knlist_destroy(&so->so_wrsel.si_note);
1067 	sodealloc(so);
1068 }
1069 
1070 /*
1071  * Close a socket on last file table reference removal.  Initiate disconnect
1072  * if connected.  Free socket when disconnect complete.
1073  *
1074  * This function will sorele() the socket.  Note that soclose() may be called
1075  * prior to the ref count reaching zero.  The actual socket structure will
1076  * not be freed until the ref count reaches zero.
1077  */
1078 int
1079 soclose(struct socket *so)
1080 {
1081 	struct accept_queue lqueue;
1082 	bool listening;
1083 	int error = 0;
1084 
1085 	KASSERT(!(so->so_state & SS_NOFDREF), ("soclose: SS_NOFDREF on enter"));
1086 
1087 	CURVNET_SET(so->so_vnet);
1088 	funsetown(&so->so_sigio);
1089 	if (so->so_state & SS_ISCONNECTED) {
1090 		if ((so->so_state & SS_ISDISCONNECTING) == 0) {
1091 			error = sodisconnect(so);
1092 			if (error) {
1093 				if (error == ENOTCONN)
1094 					error = 0;
1095 				goto drop;
1096 			}
1097 		}
1098 		if (so->so_options & SO_LINGER) {
1099 			if ((so->so_state & SS_ISDISCONNECTING) &&
1100 			    (so->so_state & SS_NBIO))
1101 				goto drop;
1102 			while (so->so_state & SS_ISCONNECTED) {
1103 				error = tsleep(&so->so_timeo,
1104 				    PSOCK | PCATCH, "soclos",
1105 				    so->so_linger * hz);
1106 				if (error)
1107 					break;
1108 			}
1109 		}
1110 	}
1111 
1112 drop:
1113 	if (so->so_proto->pr_usrreqs->pru_close != NULL)
1114 		(*so->so_proto->pr_usrreqs->pru_close)(so);
1115 
1116 	SOCK_LOCK(so);
1117 	if ((listening = (so->so_options & SO_ACCEPTCONN))) {
1118 		struct socket *sp;
1119 
1120 		TAILQ_INIT(&lqueue);
1121 		TAILQ_SWAP(&lqueue, &so->sol_incomp, socket, so_list);
1122 		TAILQ_CONCAT(&lqueue, &so->sol_comp, so_list);
1123 
1124 		so->sol_qlen = so->sol_incqlen = 0;
1125 
1126 		TAILQ_FOREACH(sp, &lqueue, so_list) {
1127 			SOCK_LOCK(sp);
1128 			sp->so_qstate = SQ_NONE;
1129 			sp->so_listen = NULL;
1130 			SOCK_UNLOCK(sp);
1131 			/* Guaranteed not to be the last. */
1132 			refcount_release(&so->so_count);
1133 		}
1134 	}
1135 	KASSERT((so->so_state & SS_NOFDREF) == 0, ("soclose: NOFDREF"));
1136 	so->so_state |= SS_NOFDREF;
1137 	sorele(so);
1138 	if (listening) {
1139 		struct socket *sp, *tsp;
1140 
1141 		TAILQ_FOREACH_SAFE(sp, &lqueue, so_list, tsp) {
1142 			SOCK_LOCK(sp);
1143 			if (sp->so_count == 0) {
1144 				SOCK_UNLOCK(sp);
1145 				soabort(sp);
1146 			} else
1147 				/* sp is now in sofree() */
1148 				SOCK_UNLOCK(sp);
1149 		}
1150 	}
1151 	CURVNET_RESTORE();
1152 	return (error);
1153 }
1154 
1155 /*
1156  * soabort() is used to abruptly tear down a connection, such as when a
1157  * resource limit is reached (listen queue depth exceeded), or if a listen
1158  * socket is closed while there are sockets waiting to be accepted.
1159  *
1160  * This interface is tricky, because it is called on an unreferenced socket,
1161  * and must be called only by a thread that has actually removed the socket
1162  * from the listen queue it was on, or races with other threads are risked.
1163  *
1164  * This interface will call into the protocol code, so must not be called
1165  * with any socket locks held.  Protocols do call it while holding their own
1166  * recursible protocol mutexes, but this is something that should be subject
1167  * to review in the future.
1168  */
1169 void
1170 soabort(struct socket *so)
1171 {
1172 
1173 	/*
1174 	 * In as much as is possible, assert that no references to this
1175 	 * socket are held.  This is not quite the same as asserting that the
1176 	 * current thread is responsible for arranging for no references, but
1177 	 * is as close as we can get for now.
1178 	 */
1179 	KASSERT(so->so_count == 0, ("soabort: so_count"));
1180 	KASSERT((so->so_state & SS_PROTOREF) == 0, ("soabort: SS_PROTOREF"));
1181 	KASSERT(so->so_state & SS_NOFDREF, ("soabort: !SS_NOFDREF"));
1182 	VNET_SO_ASSERT(so);
1183 
1184 	if (so->so_proto->pr_usrreqs->pru_abort != NULL)
1185 		(*so->so_proto->pr_usrreqs->pru_abort)(so);
1186 	SOCK_LOCK(so);
1187 	sofree(so);
1188 }
1189 
1190 int
1191 soaccept(struct socket *so, struct sockaddr **nam)
1192 {
1193 	int error;
1194 
1195 	SOCK_LOCK(so);
1196 	KASSERT((so->so_state & SS_NOFDREF) != 0, ("soaccept: !NOFDREF"));
1197 	so->so_state &= ~SS_NOFDREF;
1198 	SOCK_UNLOCK(so);
1199 
1200 	CURVNET_SET(so->so_vnet);
1201 	error = (*so->so_proto->pr_usrreqs->pru_accept)(so, nam);
1202 	CURVNET_RESTORE();
1203 	return (error);
1204 }
1205 
1206 int
1207 soconnect(struct socket *so, struct sockaddr *nam, struct thread *td)
1208 {
1209 
1210 	return (soconnectat(AT_FDCWD, so, nam, td));
1211 }
1212 
1213 int
1214 soconnectat(int fd, struct socket *so, struct sockaddr *nam, struct thread *td)
1215 {
1216 	int error;
1217 
1218 	if (so->so_options & SO_ACCEPTCONN)
1219 		return (EOPNOTSUPP);
1220 
1221 	CURVNET_SET(so->so_vnet);
1222 	/*
1223 	 * If protocol is connection-based, can only connect once.
1224 	 * Otherwise, if connected, try to disconnect first.  This allows
1225 	 * user to disconnect by connecting to, e.g., a null address.
1226 	 */
1227 	if (so->so_state & (SS_ISCONNECTED|SS_ISCONNECTING) &&
1228 	    ((so->so_proto->pr_flags & PR_CONNREQUIRED) ||
1229 	    (error = sodisconnect(so)))) {
1230 		error = EISCONN;
1231 	} else {
1232 		/*
1233 		 * Prevent accumulated error from previous connection from
1234 		 * biting us.
1235 		 */
1236 		so->so_error = 0;
1237 		if (fd == AT_FDCWD) {
1238 			error = (*so->so_proto->pr_usrreqs->pru_connect)(so,
1239 			    nam, td);
1240 		} else {
1241 			error = (*so->so_proto->pr_usrreqs->pru_connectat)(fd,
1242 			    so, nam, td);
1243 		}
1244 	}
1245 	CURVNET_RESTORE();
1246 
1247 	return (error);
1248 }
1249 
1250 int
1251 soconnect2(struct socket *so1, struct socket *so2)
1252 {
1253 	int error;
1254 
1255 	CURVNET_SET(so1->so_vnet);
1256 	error = (*so1->so_proto->pr_usrreqs->pru_connect2)(so1, so2);
1257 	CURVNET_RESTORE();
1258 	return (error);
1259 }
1260 
1261 int
1262 sodisconnect(struct socket *so)
1263 {
1264 	int error;
1265 
1266 	if ((so->so_state & SS_ISCONNECTED) == 0)
1267 		return (ENOTCONN);
1268 	if (so->so_state & SS_ISDISCONNECTING)
1269 		return (EALREADY);
1270 	VNET_SO_ASSERT(so);
1271 	error = (*so->so_proto->pr_usrreqs->pru_disconnect)(so);
1272 	return (error);
1273 }
1274 
1275 #define	SBLOCKWAIT(f)	(((f) & MSG_DONTWAIT) ? 0 : SBL_WAIT)
1276 
1277 int
1278 sosend_dgram(struct socket *so, struct sockaddr *addr, struct uio *uio,
1279     struct mbuf *top, struct mbuf *control, int flags, struct thread *td)
1280 {
1281 	long space;
1282 	ssize_t resid;
1283 	int clen = 0, error, dontroute;
1284 
1285 	KASSERT(so->so_type == SOCK_DGRAM, ("sosend_dgram: !SOCK_DGRAM"));
1286 	KASSERT(so->so_proto->pr_flags & PR_ATOMIC,
1287 	    ("sosend_dgram: !PR_ATOMIC"));
1288 
1289 	if (uio != NULL)
1290 		resid = uio->uio_resid;
1291 	else
1292 		resid = top->m_pkthdr.len;
1293 	/*
1294 	 * In theory resid should be unsigned.  However, space must be
1295 	 * signed, as it might be less than 0 if we over-committed, and we
1296 	 * must use a signed comparison of space and resid.  On the other
1297 	 * hand, a negative resid causes us to loop sending 0-length
1298 	 * segments to the protocol.
1299 	 */
1300 	if (resid < 0) {
1301 		error = EINVAL;
1302 		goto out;
1303 	}
1304 
1305 	dontroute =
1306 	    (flags & MSG_DONTROUTE) && (so->so_options & SO_DONTROUTE) == 0;
1307 	if (td != NULL)
1308 		td->td_ru.ru_msgsnd++;
1309 	if (control != NULL)
1310 		clen = control->m_len;
1311 
1312 	SOCKBUF_LOCK(&so->so_snd);
1313 	if (so->so_snd.sb_state & SBS_CANTSENDMORE) {
1314 		SOCKBUF_UNLOCK(&so->so_snd);
1315 		error = EPIPE;
1316 		goto out;
1317 	}
1318 	if (so->so_error) {
1319 		error = so->so_error;
1320 		so->so_error = 0;
1321 		SOCKBUF_UNLOCK(&so->so_snd);
1322 		goto out;
1323 	}
1324 	if ((so->so_state & SS_ISCONNECTED) == 0) {
1325 		/*
1326 		 * `sendto' and `sendmsg' is allowed on a connection-based
1327 		 * socket if it supports implied connect.  Return ENOTCONN if
1328 		 * not connected and no address is supplied.
1329 		 */
1330 		if ((so->so_proto->pr_flags & PR_CONNREQUIRED) &&
1331 		    (so->so_proto->pr_flags & PR_IMPLOPCL) == 0) {
1332 			if ((so->so_state & SS_ISCONFIRMING) == 0 &&
1333 			    !(resid == 0 && clen != 0)) {
1334 				SOCKBUF_UNLOCK(&so->so_snd);
1335 				error = ENOTCONN;
1336 				goto out;
1337 			}
1338 		} else if (addr == NULL) {
1339 			if (so->so_proto->pr_flags & PR_CONNREQUIRED)
1340 				error = ENOTCONN;
1341 			else
1342 				error = EDESTADDRREQ;
1343 			SOCKBUF_UNLOCK(&so->so_snd);
1344 			goto out;
1345 		}
1346 	}
1347 
1348 	/*
1349 	 * Do we need MSG_OOB support in SOCK_DGRAM?  Signs here may be a
1350 	 * problem and need fixing.
1351 	 */
1352 	space = sbspace(&so->so_snd);
1353 	if (flags & MSG_OOB)
1354 		space += 1024;
1355 	space -= clen;
1356 	SOCKBUF_UNLOCK(&so->so_snd);
1357 	if (resid > space) {
1358 		error = EMSGSIZE;
1359 		goto out;
1360 	}
1361 	if (uio == NULL) {
1362 		resid = 0;
1363 		if (flags & MSG_EOR)
1364 			top->m_flags |= M_EOR;
1365 	} else {
1366 		/*
1367 		 * Copy the data from userland into a mbuf chain.
1368 		 * If no data is to be copied in, a single empty mbuf
1369 		 * is returned.
1370 		 */
1371 		top = m_uiotombuf(uio, M_WAITOK, space, max_hdr,
1372 		    (M_PKTHDR | ((flags & MSG_EOR) ? M_EOR : 0)));
1373 		if (top == NULL) {
1374 			error = EFAULT;	/* only possible error */
1375 			goto out;
1376 		}
1377 		space -= resid - uio->uio_resid;
1378 		resid = uio->uio_resid;
1379 	}
1380 	KASSERT(resid == 0, ("sosend_dgram: resid != 0"));
1381 	/*
1382 	 * XXXRW: Frobbing SO_DONTROUTE here is even worse without sblock
1383 	 * than with.
1384 	 */
1385 	if (dontroute) {
1386 		SOCK_LOCK(so);
1387 		so->so_options |= SO_DONTROUTE;
1388 		SOCK_UNLOCK(so);
1389 	}
1390 	/*
1391 	 * XXX all the SBS_CANTSENDMORE checks previously done could be out
1392 	 * of date.  We could have received a reset packet in an interrupt or
1393 	 * maybe we slept while doing page faults in uiomove() etc.  We could
1394 	 * probably recheck again inside the locking protection here, but
1395 	 * there are probably other places that this also happens.  We must
1396 	 * rethink this.
1397 	 */
1398 	VNET_SO_ASSERT(so);
1399 	error = (*so->so_proto->pr_usrreqs->pru_send)(so,
1400 	    (flags & MSG_OOB) ? PRUS_OOB :
1401 	/*
1402 	 * If the user set MSG_EOF, the protocol understands this flag and
1403 	 * nothing left to send then use PRU_SEND_EOF instead of PRU_SEND.
1404 	 */
1405 	    ((flags & MSG_EOF) &&
1406 	     (so->so_proto->pr_flags & PR_IMPLOPCL) &&
1407 	     (resid <= 0)) ?
1408 		PRUS_EOF :
1409 		/* If there is more to send set PRUS_MORETOCOME */
1410 		(flags & MSG_MORETOCOME) ||
1411 		(resid > 0 && space > 0) ? PRUS_MORETOCOME : 0,
1412 		top, addr, control, td);
1413 	if (dontroute) {
1414 		SOCK_LOCK(so);
1415 		so->so_options &= ~SO_DONTROUTE;
1416 		SOCK_UNLOCK(so);
1417 	}
1418 	clen = 0;
1419 	control = NULL;
1420 	top = NULL;
1421 out:
1422 	if (top != NULL)
1423 		m_freem(top);
1424 	if (control != NULL)
1425 		m_freem(control);
1426 	return (error);
1427 }
1428 
1429 /*
1430  * Send on a socket.  If send must go all at once and message is larger than
1431  * send buffering, then hard error.  Lock against other senders.  If must go
1432  * all at once and not enough room now, then inform user that this would
1433  * block and do nothing.  Otherwise, if nonblocking, send as much as
1434  * possible.  The data to be sent is described by "uio" if nonzero, otherwise
1435  * by the mbuf chain "top" (which must be null if uio is not).  Data provided
1436  * in mbuf chain must be small enough to send all at once.
1437  *
1438  * Returns nonzero on error, timeout or signal; callers must check for short
1439  * counts if EINTR/ERESTART are returned.  Data and control buffers are freed
1440  * on return.
1441  */
1442 int
1443 sosend_generic(struct socket *so, struct sockaddr *addr, struct uio *uio,
1444     struct mbuf *top, struct mbuf *control, int flags, struct thread *td)
1445 {
1446 	long space;
1447 	ssize_t resid;
1448 	int clen = 0, error, dontroute;
1449 	int atomic = sosendallatonce(so) || top;
1450 	int pru_flag;
1451 #ifdef KERN_TLS
1452 	struct ktls_session *tls;
1453 	int tls_enq_cnt, tls_pruflag;
1454 	uint8_t tls_rtype;
1455 
1456 	tls = NULL;
1457 	tls_rtype = TLS_RLTYPE_APP;
1458 #endif
1459 	if (uio != NULL)
1460 		resid = uio->uio_resid;
1461 	else
1462 		resid = top->m_pkthdr.len;
1463 	/*
1464 	 * In theory resid should be unsigned.  However, space must be
1465 	 * signed, as it might be less than 0 if we over-committed, and we
1466 	 * must use a signed comparison of space and resid.  On the other
1467 	 * hand, a negative resid causes us to loop sending 0-length
1468 	 * segments to the protocol.
1469 	 *
1470 	 * Also check to make sure that MSG_EOR isn't used on SOCK_STREAM
1471 	 * type sockets since that's an error.
1472 	 */
1473 	if (resid < 0 || (so->so_type == SOCK_STREAM && (flags & MSG_EOR))) {
1474 		error = EINVAL;
1475 		goto out;
1476 	}
1477 
1478 	dontroute =
1479 	    (flags & MSG_DONTROUTE) && (so->so_options & SO_DONTROUTE) == 0 &&
1480 	    (so->so_proto->pr_flags & PR_ATOMIC);
1481 	if (td != NULL)
1482 		td->td_ru.ru_msgsnd++;
1483 	if (control != NULL)
1484 		clen = control->m_len;
1485 
1486 	error = sblock(&so->so_snd, SBLOCKWAIT(flags));
1487 	if (error)
1488 		goto out;
1489 
1490 #ifdef KERN_TLS
1491 	tls_pruflag = 0;
1492 	tls = ktls_hold(so->so_snd.sb_tls_info);
1493 	if (tls != NULL) {
1494 		if (tls->sw_encrypt != NULL)
1495 			tls_pruflag = PRUS_NOTREADY;
1496 
1497 		if (control != NULL) {
1498 			struct cmsghdr *cm = mtod(control, struct cmsghdr *);
1499 
1500 			if (clen >= sizeof(*cm) &&
1501 			    cm->cmsg_type == TLS_SET_RECORD_TYPE) {
1502 				tls_rtype = *((uint8_t *)CMSG_DATA(cm));
1503 				clen = 0;
1504 				m_freem(control);
1505 				control = NULL;
1506 				atomic = 1;
1507 			}
1508 		}
1509 	}
1510 #endif
1511 
1512 restart:
1513 	do {
1514 		SOCKBUF_LOCK(&so->so_snd);
1515 		if (so->so_snd.sb_state & SBS_CANTSENDMORE) {
1516 			SOCKBUF_UNLOCK(&so->so_snd);
1517 			error = EPIPE;
1518 			goto release;
1519 		}
1520 		if (so->so_error) {
1521 			error = so->so_error;
1522 			so->so_error = 0;
1523 			SOCKBUF_UNLOCK(&so->so_snd);
1524 			goto release;
1525 		}
1526 		if ((so->so_state & SS_ISCONNECTED) == 0) {
1527 			/*
1528 			 * `sendto' and `sendmsg' is allowed on a connection-
1529 			 * based socket if it supports implied connect.
1530 			 * Return ENOTCONN if not connected and no address is
1531 			 * supplied.
1532 			 */
1533 			if ((so->so_proto->pr_flags & PR_CONNREQUIRED) &&
1534 			    (so->so_proto->pr_flags & PR_IMPLOPCL) == 0) {
1535 				if ((so->so_state & SS_ISCONFIRMING) == 0 &&
1536 				    !(resid == 0 && clen != 0)) {
1537 					SOCKBUF_UNLOCK(&so->so_snd);
1538 					error = ENOTCONN;
1539 					goto release;
1540 				}
1541 			} else if (addr == NULL) {
1542 				SOCKBUF_UNLOCK(&so->so_snd);
1543 				if (so->so_proto->pr_flags & PR_CONNREQUIRED)
1544 					error = ENOTCONN;
1545 				else
1546 					error = EDESTADDRREQ;
1547 				goto release;
1548 			}
1549 		}
1550 		space = sbspace(&so->so_snd);
1551 		if (flags & MSG_OOB)
1552 			space += 1024;
1553 		if ((atomic && resid > so->so_snd.sb_hiwat) ||
1554 		    clen > so->so_snd.sb_hiwat) {
1555 			SOCKBUF_UNLOCK(&so->so_snd);
1556 			error = EMSGSIZE;
1557 			goto release;
1558 		}
1559 		if (space < resid + clen &&
1560 		    (atomic || space < so->so_snd.sb_lowat || space < clen)) {
1561 			if ((so->so_state & SS_NBIO) ||
1562 			    (flags & (MSG_NBIO | MSG_DONTWAIT)) != 0) {
1563 				SOCKBUF_UNLOCK(&so->so_snd);
1564 				error = EWOULDBLOCK;
1565 				goto release;
1566 			}
1567 			error = sbwait(&so->so_snd);
1568 			SOCKBUF_UNLOCK(&so->so_snd);
1569 			if (error)
1570 				goto release;
1571 			goto restart;
1572 		}
1573 		SOCKBUF_UNLOCK(&so->so_snd);
1574 		space -= clen;
1575 		do {
1576 			if (uio == NULL) {
1577 				resid = 0;
1578 				if (flags & MSG_EOR)
1579 					top->m_flags |= M_EOR;
1580 			} else {
1581 				/*
1582 				 * Copy the data from userland into a mbuf
1583 				 * chain.  If resid is 0, which can happen
1584 				 * only if we have control to send, then
1585 				 * a single empty mbuf is returned.  This
1586 				 * is a workaround to prevent protocol send
1587 				 * methods to panic.
1588 				 */
1589 #ifdef KERN_TLS
1590 				if (tls != NULL) {
1591 					top = m_uiotombuf(uio, M_WAITOK, space,
1592 					    tls->params.max_frame_len,
1593 					    M_NOMAP |
1594 					    ((flags & MSG_EOR) ? M_EOR : 0));
1595 					if (top != NULL) {
1596 						error = ktls_frame(top, tls,
1597 						    &tls_enq_cnt, tls_rtype);
1598 						if (error) {
1599 							m_freem(top);
1600 							goto release;
1601 						}
1602 					}
1603 					tls_rtype = TLS_RLTYPE_APP;
1604 				} else
1605 #endif
1606 					top = m_uiotombuf(uio, M_WAITOK, space,
1607 					    (atomic ? max_hdr : 0),
1608 					    (atomic ? M_PKTHDR : 0) |
1609 					    ((flags & MSG_EOR) ? M_EOR : 0));
1610 				if (top == NULL) {
1611 					error = EFAULT; /* only possible error */
1612 					goto release;
1613 				}
1614 				space -= resid - uio->uio_resid;
1615 				resid = uio->uio_resid;
1616 			}
1617 			if (dontroute) {
1618 				SOCK_LOCK(so);
1619 				so->so_options |= SO_DONTROUTE;
1620 				SOCK_UNLOCK(so);
1621 			}
1622 			/*
1623 			 * XXX all the SBS_CANTSENDMORE checks previously
1624 			 * done could be out of date.  We could have received
1625 			 * a reset packet in an interrupt or maybe we slept
1626 			 * while doing page faults in uiomove() etc.  We
1627 			 * could probably recheck again inside the locking
1628 			 * protection here, but there are probably other
1629 			 * places that this also happens.  We must rethink
1630 			 * this.
1631 			 */
1632 			VNET_SO_ASSERT(so);
1633 
1634 			pru_flag = (flags & MSG_OOB) ? PRUS_OOB :
1635 			/*
1636 			 * If the user set MSG_EOF, the protocol understands
1637 			 * this flag and nothing left to send then use
1638 			 * PRU_SEND_EOF instead of PRU_SEND.
1639 			 */
1640 			    ((flags & MSG_EOF) &&
1641 			     (so->so_proto->pr_flags & PR_IMPLOPCL) &&
1642 			     (resid <= 0)) ?
1643 				PRUS_EOF :
1644 			/* If there is more to send set PRUS_MORETOCOME. */
1645 			    (flags & MSG_MORETOCOME) ||
1646 			    (resid > 0 && space > 0) ? PRUS_MORETOCOME : 0;
1647 
1648 #ifdef KERN_TLS
1649 			pru_flag |= tls_pruflag;
1650 #endif
1651 
1652 			error = (*so->so_proto->pr_usrreqs->pru_send)(so,
1653 			    pru_flag, top, addr, control, td);
1654 
1655 			if (dontroute) {
1656 				SOCK_LOCK(so);
1657 				so->so_options &= ~SO_DONTROUTE;
1658 				SOCK_UNLOCK(so);
1659 			}
1660 
1661 #ifdef KERN_TLS
1662 			if (tls != NULL && tls->sw_encrypt != NULL) {
1663 				/*
1664 				 * Note that error is intentionally
1665 				 * ignored.
1666 				 *
1667 				 * Like sendfile(), we rely on the
1668 				 * completion routine (pru_ready())
1669 				 * to free the mbufs in the event that
1670 				 * pru_send() encountered an error and
1671 				 * did not append them to the sockbuf.
1672 				 */
1673 				soref(so);
1674 				ktls_enqueue(top, so, tls_enq_cnt);
1675 			}
1676 #endif
1677 			clen = 0;
1678 			control = NULL;
1679 			top = NULL;
1680 			if (error)
1681 				goto release;
1682 		} while (resid && space > 0);
1683 	} while (resid);
1684 
1685 release:
1686 	sbunlock(&so->so_snd);
1687 out:
1688 #ifdef KERN_TLS
1689 	if (tls != NULL)
1690 		ktls_free(tls);
1691 #endif
1692 	if (top != NULL)
1693 		m_freem(top);
1694 	if (control != NULL)
1695 		m_freem(control);
1696 	return (error);
1697 }
1698 
1699 int
1700 sosend(struct socket *so, struct sockaddr *addr, struct uio *uio,
1701     struct mbuf *top, struct mbuf *control, int flags, struct thread *td)
1702 {
1703 	int error;
1704 
1705 	CURVNET_SET(so->so_vnet);
1706 	if (!SOLISTENING(so))
1707 		error = so->so_proto->pr_usrreqs->pru_sosend(so, addr, uio,
1708 		    top, control, flags, td);
1709 	else {
1710 		m_freem(top);
1711 		m_freem(control);
1712 		error = ENOTCONN;
1713 	}
1714 	CURVNET_RESTORE();
1715 	return (error);
1716 }
1717 
1718 /*
1719  * The part of soreceive() that implements reading non-inline out-of-band
1720  * data from a socket.  For more complete comments, see soreceive(), from
1721  * which this code originated.
1722  *
1723  * Note that soreceive_rcvoob(), unlike the remainder of soreceive(), is
1724  * unable to return an mbuf chain to the caller.
1725  */
1726 static int
1727 soreceive_rcvoob(struct socket *so, struct uio *uio, int flags)
1728 {
1729 	struct protosw *pr = so->so_proto;
1730 	struct mbuf *m;
1731 	int error;
1732 
1733 	KASSERT(flags & MSG_OOB, ("soreceive_rcvoob: (flags & MSG_OOB) == 0"));
1734 	VNET_SO_ASSERT(so);
1735 
1736 	m = m_get(M_WAITOK, MT_DATA);
1737 	error = (*pr->pr_usrreqs->pru_rcvoob)(so, m, flags & MSG_PEEK);
1738 	if (error)
1739 		goto bad;
1740 	do {
1741 		error = uiomove(mtod(m, void *),
1742 		    (int) min(uio->uio_resid, m->m_len), uio);
1743 		m = m_free(m);
1744 	} while (uio->uio_resid && error == 0 && m);
1745 bad:
1746 	if (m != NULL)
1747 		m_freem(m);
1748 	return (error);
1749 }
1750 
1751 /*
1752  * Following replacement or removal of the first mbuf on the first mbuf chain
1753  * of a socket buffer, push necessary state changes back into the socket
1754  * buffer so that other consumers see the values consistently.  'nextrecord'
1755  * is the callers locally stored value of the original value of
1756  * sb->sb_mb->m_nextpkt which must be restored when the lead mbuf changes.
1757  * NOTE: 'nextrecord' may be NULL.
1758  */
1759 static __inline void
1760 sockbuf_pushsync(struct sockbuf *sb, struct mbuf *nextrecord)
1761 {
1762 
1763 	SOCKBUF_LOCK_ASSERT(sb);
1764 	/*
1765 	 * First, update for the new value of nextrecord.  If necessary, make
1766 	 * it the first record.
1767 	 */
1768 	if (sb->sb_mb != NULL)
1769 		sb->sb_mb->m_nextpkt = nextrecord;
1770 	else
1771 		sb->sb_mb = nextrecord;
1772 
1773 	/*
1774 	 * Now update any dependent socket buffer fields to reflect the new
1775 	 * state.  This is an expanded inline of SB_EMPTY_FIXUP(), with the
1776 	 * addition of a second clause that takes care of the case where
1777 	 * sb_mb has been updated, but remains the last record.
1778 	 */
1779 	if (sb->sb_mb == NULL) {
1780 		sb->sb_mbtail = NULL;
1781 		sb->sb_lastrecord = NULL;
1782 	} else if (sb->sb_mb->m_nextpkt == NULL)
1783 		sb->sb_lastrecord = sb->sb_mb;
1784 }
1785 
1786 /*
1787  * Implement receive operations on a socket.  We depend on the way that
1788  * records are added to the sockbuf by sbappend.  In particular, each record
1789  * (mbufs linked through m_next) must begin with an address if the protocol
1790  * so specifies, followed by an optional mbuf or mbufs containing ancillary
1791  * data, and then zero or more mbufs of data.  In order to allow parallelism
1792  * between network receive and copying to user space, as well as avoid
1793  * sleeping with a mutex held, we release the socket buffer mutex during the
1794  * user space copy.  Although the sockbuf is locked, new data may still be
1795  * appended, and thus we must maintain consistency of the sockbuf during that
1796  * time.
1797  *
1798  * The caller may receive the data as a single mbuf chain by supplying an
1799  * mbuf **mp0 for use in returning the chain.  The uio is then used only for
1800  * the count in uio_resid.
1801  */
1802 int
1803 soreceive_generic(struct socket *so, struct sockaddr **psa, struct uio *uio,
1804     struct mbuf **mp0, struct mbuf **controlp, int *flagsp)
1805 {
1806 	struct mbuf *m, **mp;
1807 	int flags, error, offset;
1808 	ssize_t len;
1809 	struct protosw *pr = so->so_proto;
1810 	struct mbuf *nextrecord;
1811 	int moff, type = 0;
1812 	ssize_t orig_resid = uio->uio_resid;
1813 
1814 	mp = mp0;
1815 	if (psa != NULL)
1816 		*psa = NULL;
1817 	if (controlp != NULL)
1818 		*controlp = NULL;
1819 	if (flagsp != NULL)
1820 		flags = *flagsp &~ MSG_EOR;
1821 	else
1822 		flags = 0;
1823 	if (flags & MSG_OOB)
1824 		return (soreceive_rcvoob(so, uio, flags));
1825 	if (mp != NULL)
1826 		*mp = NULL;
1827 	if ((pr->pr_flags & PR_WANTRCVD) && (so->so_state & SS_ISCONFIRMING)
1828 	    && uio->uio_resid) {
1829 		VNET_SO_ASSERT(so);
1830 		(*pr->pr_usrreqs->pru_rcvd)(so, 0);
1831 	}
1832 
1833 	error = sblock(&so->so_rcv, SBLOCKWAIT(flags));
1834 	if (error)
1835 		return (error);
1836 
1837 restart:
1838 	SOCKBUF_LOCK(&so->so_rcv);
1839 	m = so->so_rcv.sb_mb;
1840 	/*
1841 	 * If we have less data than requested, block awaiting more (subject
1842 	 * to any timeout) if:
1843 	 *   1. the current count is less than the low water mark, or
1844 	 *   2. MSG_DONTWAIT is not set
1845 	 */
1846 	if (m == NULL || (((flags & MSG_DONTWAIT) == 0 &&
1847 	    sbavail(&so->so_rcv) < uio->uio_resid) &&
1848 	    sbavail(&so->so_rcv) < so->so_rcv.sb_lowat &&
1849 	    m->m_nextpkt == NULL && (pr->pr_flags & PR_ATOMIC) == 0)) {
1850 		KASSERT(m != NULL || !sbavail(&so->so_rcv),
1851 		    ("receive: m == %p sbavail == %u",
1852 		    m, sbavail(&so->so_rcv)));
1853 		if (so->so_error) {
1854 			if (m != NULL)
1855 				goto dontblock;
1856 			error = so->so_error;
1857 			if ((flags & MSG_PEEK) == 0)
1858 				so->so_error = 0;
1859 			SOCKBUF_UNLOCK(&so->so_rcv);
1860 			goto release;
1861 		}
1862 		SOCKBUF_LOCK_ASSERT(&so->so_rcv);
1863 		if (so->so_rcv.sb_state & SBS_CANTRCVMORE) {
1864 			if (m == NULL) {
1865 				SOCKBUF_UNLOCK(&so->so_rcv);
1866 				goto release;
1867 			} else
1868 				goto dontblock;
1869 		}
1870 		for (; m != NULL; m = m->m_next)
1871 			if (m->m_type == MT_OOBDATA  || (m->m_flags & M_EOR)) {
1872 				m = so->so_rcv.sb_mb;
1873 				goto dontblock;
1874 			}
1875 		if ((so->so_state & (SS_ISCONNECTED|SS_ISCONNECTING)) == 0 &&
1876 		    (so->so_proto->pr_flags & PR_CONNREQUIRED)) {
1877 			SOCKBUF_UNLOCK(&so->so_rcv);
1878 			error = ENOTCONN;
1879 			goto release;
1880 		}
1881 		if (uio->uio_resid == 0) {
1882 			SOCKBUF_UNLOCK(&so->so_rcv);
1883 			goto release;
1884 		}
1885 		if ((so->so_state & SS_NBIO) ||
1886 		    (flags & (MSG_DONTWAIT|MSG_NBIO))) {
1887 			SOCKBUF_UNLOCK(&so->so_rcv);
1888 			error = EWOULDBLOCK;
1889 			goto release;
1890 		}
1891 		SBLASTRECORDCHK(&so->so_rcv);
1892 		SBLASTMBUFCHK(&so->so_rcv);
1893 		error = sbwait(&so->so_rcv);
1894 		SOCKBUF_UNLOCK(&so->so_rcv);
1895 		if (error)
1896 			goto release;
1897 		goto restart;
1898 	}
1899 dontblock:
1900 	/*
1901 	 * From this point onward, we maintain 'nextrecord' as a cache of the
1902 	 * pointer to the next record in the socket buffer.  We must keep the
1903 	 * various socket buffer pointers and local stack versions of the
1904 	 * pointers in sync, pushing out modifications before dropping the
1905 	 * socket buffer mutex, and re-reading them when picking it up.
1906 	 *
1907 	 * Otherwise, we will race with the network stack appending new data
1908 	 * or records onto the socket buffer by using inconsistent/stale
1909 	 * versions of the field, possibly resulting in socket buffer
1910 	 * corruption.
1911 	 *
1912 	 * By holding the high-level sblock(), we prevent simultaneous
1913 	 * readers from pulling off the front of the socket buffer.
1914 	 */
1915 	SOCKBUF_LOCK_ASSERT(&so->so_rcv);
1916 	if (uio->uio_td)
1917 		uio->uio_td->td_ru.ru_msgrcv++;
1918 	KASSERT(m == so->so_rcv.sb_mb, ("soreceive: m != so->so_rcv.sb_mb"));
1919 	SBLASTRECORDCHK(&so->so_rcv);
1920 	SBLASTMBUFCHK(&so->so_rcv);
1921 	nextrecord = m->m_nextpkt;
1922 	if (pr->pr_flags & PR_ADDR) {
1923 		KASSERT(m->m_type == MT_SONAME,
1924 		    ("m->m_type == %d", m->m_type));
1925 		orig_resid = 0;
1926 		if (psa != NULL)
1927 			*psa = sodupsockaddr(mtod(m, struct sockaddr *),
1928 			    M_NOWAIT);
1929 		if (flags & MSG_PEEK) {
1930 			m = m->m_next;
1931 		} else {
1932 			sbfree(&so->so_rcv, m);
1933 			so->so_rcv.sb_mb = m_free(m);
1934 			m = so->so_rcv.sb_mb;
1935 			sockbuf_pushsync(&so->so_rcv, nextrecord);
1936 		}
1937 	}
1938 
1939 	/*
1940 	 * Process one or more MT_CONTROL mbufs present before any data mbufs
1941 	 * in the first mbuf chain on the socket buffer.  If MSG_PEEK, we
1942 	 * just copy the data; if !MSG_PEEK, we call into the protocol to
1943 	 * perform externalization (or freeing if controlp == NULL).
1944 	 */
1945 	if (m != NULL && m->m_type == MT_CONTROL) {
1946 		struct mbuf *cm = NULL, *cmn;
1947 		struct mbuf **cme = &cm;
1948 
1949 		do {
1950 			if (flags & MSG_PEEK) {
1951 				if (controlp != NULL) {
1952 					*controlp = m_copym(m, 0, m->m_len,
1953 					    M_NOWAIT);
1954 					controlp = &(*controlp)->m_next;
1955 				}
1956 				m = m->m_next;
1957 			} else {
1958 				sbfree(&so->so_rcv, m);
1959 				so->so_rcv.sb_mb = m->m_next;
1960 				m->m_next = NULL;
1961 				*cme = m;
1962 				cme = &(*cme)->m_next;
1963 				m = so->so_rcv.sb_mb;
1964 			}
1965 		} while (m != NULL && m->m_type == MT_CONTROL);
1966 		if ((flags & MSG_PEEK) == 0)
1967 			sockbuf_pushsync(&so->so_rcv, nextrecord);
1968 		while (cm != NULL) {
1969 			cmn = cm->m_next;
1970 			cm->m_next = NULL;
1971 			if (pr->pr_domain->dom_externalize != NULL) {
1972 				SOCKBUF_UNLOCK(&so->so_rcv);
1973 				VNET_SO_ASSERT(so);
1974 				error = (*pr->pr_domain->dom_externalize)
1975 				    (cm, controlp, flags);
1976 				SOCKBUF_LOCK(&so->so_rcv);
1977 			} else if (controlp != NULL)
1978 				*controlp = cm;
1979 			else
1980 				m_freem(cm);
1981 			if (controlp != NULL) {
1982 				orig_resid = 0;
1983 				while (*controlp != NULL)
1984 					controlp = &(*controlp)->m_next;
1985 			}
1986 			cm = cmn;
1987 		}
1988 		if (m != NULL)
1989 			nextrecord = so->so_rcv.sb_mb->m_nextpkt;
1990 		else
1991 			nextrecord = so->so_rcv.sb_mb;
1992 		orig_resid = 0;
1993 	}
1994 	if (m != NULL) {
1995 		if ((flags & MSG_PEEK) == 0) {
1996 			KASSERT(m->m_nextpkt == nextrecord,
1997 			    ("soreceive: post-control, nextrecord !sync"));
1998 			if (nextrecord == NULL) {
1999 				KASSERT(so->so_rcv.sb_mb == m,
2000 				    ("soreceive: post-control, sb_mb!=m"));
2001 				KASSERT(so->so_rcv.sb_lastrecord == m,
2002 				    ("soreceive: post-control, lastrecord!=m"));
2003 			}
2004 		}
2005 		type = m->m_type;
2006 		if (type == MT_OOBDATA)
2007 			flags |= MSG_OOB;
2008 	} else {
2009 		if ((flags & MSG_PEEK) == 0) {
2010 			KASSERT(so->so_rcv.sb_mb == nextrecord,
2011 			    ("soreceive: sb_mb != nextrecord"));
2012 			if (so->so_rcv.sb_mb == NULL) {
2013 				KASSERT(so->so_rcv.sb_lastrecord == NULL,
2014 				    ("soreceive: sb_lastercord != NULL"));
2015 			}
2016 		}
2017 	}
2018 	SOCKBUF_LOCK_ASSERT(&so->so_rcv);
2019 	SBLASTRECORDCHK(&so->so_rcv);
2020 	SBLASTMBUFCHK(&so->so_rcv);
2021 
2022 	/*
2023 	 * Now continue to read any data mbufs off of the head of the socket
2024 	 * buffer until the read request is satisfied.  Note that 'type' is
2025 	 * used to store the type of any mbuf reads that have happened so far
2026 	 * such that soreceive() can stop reading if the type changes, which
2027 	 * causes soreceive() to return only one of regular data and inline
2028 	 * out-of-band data in a single socket receive operation.
2029 	 */
2030 	moff = 0;
2031 	offset = 0;
2032 	while (m != NULL && !(m->m_flags & M_NOTAVAIL) && uio->uio_resid > 0
2033 	    && error == 0) {
2034 		/*
2035 		 * If the type of mbuf has changed since the last mbuf
2036 		 * examined ('type'), end the receive operation.
2037 		 */
2038 		SOCKBUF_LOCK_ASSERT(&so->so_rcv);
2039 		if (m->m_type == MT_OOBDATA || m->m_type == MT_CONTROL) {
2040 			if (type != m->m_type)
2041 				break;
2042 		} else if (type == MT_OOBDATA)
2043 			break;
2044 		else
2045 		    KASSERT(m->m_type == MT_DATA,
2046 			("m->m_type == %d", m->m_type));
2047 		so->so_rcv.sb_state &= ~SBS_RCVATMARK;
2048 		len = uio->uio_resid;
2049 		if (so->so_oobmark && len > so->so_oobmark - offset)
2050 			len = so->so_oobmark - offset;
2051 		if (len > m->m_len - moff)
2052 			len = m->m_len - moff;
2053 		/*
2054 		 * If mp is set, just pass back the mbufs.  Otherwise copy
2055 		 * them out via the uio, then free.  Sockbuf must be
2056 		 * consistent here (points to current mbuf, it points to next
2057 		 * record) when we drop priority; we must note any additions
2058 		 * to the sockbuf when we block interrupts again.
2059 		 */
2060 		if (mp == NULL) {
2061 			SOCKBUF_LOCK_ASSERT(&so->so_rcv);
2062 			SBLASTRECORDCHK(&so->so_rcv);
2063 			SBLASTMBUFCHK(&so->so_rcv);
2064 			SOCKBUF_UNLOCK(&so->so_rcv);
2065 			if ((m->m_flags & M_NOMAP) != 0)
2066 				error = m_unmappedtouio(m, moff, uio, (int)len);
2067 			else
2068 				error = uiomove(mtod(m, char *) + moff,
2069 				    (int)len, uio);
2070 			SOCKBUF_LOCK(&so->so_rcv);
2071 			if (error) {
2072 				/*
2073 				 * The MT_SONAME mbuf has already been removed
2074 				 * from the record, so it is necessary to
2075 				 * remove the data mbufs, if any, to preserve
2076 				 * the invariant in the case of PR_ADDR that
2077 				 * requires MT_SONAME mbufs at the head of
2078 				 * each record.
2079 				 */
2080 				if (pr->pr_flags & PR_ATOMIC &&
2081 				    ((flags & MSG_PEEK) == 0))
2082 					(void)sbdroprecord_locked(&so->so_rcv);
2083 				SOCKBUF_UNLOCK(&so->so_rcv);
2084 				goto release;
2085 			}
2086 		} else
2087 			uio->uio_resid -= len;
2088 		SOCKBUF_LOCK_ASSERT(&so->so_rcv);
2089 		if (len == m->m_len - moff) {
2090 			if (m->m_flags & M_EOR)
2091 				flags |= MSG_EOR;
2092 			if (flags & MSG_PEEK) {
2093 				m = m->m_next;
2094 				moff = 0;
2095 			} else {
2096 				nextrecord = m->m_nextpkt;
2097 				sbfree(&so->so_rcv, m);
2098 				if (mp != NULL) {
2099 					m->m_nextpkt = NULL;
2100 					*mp = m;
2101 					mp = &m->m_next;
2102 					so->so_rcv.sb_mb = m = m->m_next;
2103 					*mp = NULL;
2104 				} else {
2105 					so->so_rcv.sb_mb = m_free(m);
2106 					m = so->so_rcv.sb_mb;
2107 				}
2108 				sockbuf_pushsync(&so->so_rcv, nextrecord);
2109 				SBLASTRECORDCHK(&so->so_rcv);
2110 				SBLASTMBUFCHK(&so->so_rcv);
2111 			}
2112 		} else {
2113 			if (flags & MSG_PEEK)
2114 				moff += len;
2115 			else {
2116 				if (mp != NULL) {
2117 					if (flags & MSG_DONTWAIT) {
2118 						*mp = m_copym(m, 0, len,
2119 						    M_NOWAIT);
2120 						if (*mp == NULL) {
2121 							/*
2122 							 * m_copym() couldn't
2123 							 * allocate an mbuf.
2124 							 * Adjust uio_resid back
2125 							 * (it was adjusted
2126 							 * down by len bytes,
2127 							 * which we didn't end
2128 							 * up "copying" over).
2129 							 */
2130 							uio->uio_resid += len;
2131 							break;
2132 						}
2133 					} else {
2134 						SOCKBUF_UNLOCK(&so->so_rcv);
2135 						*mp = m_copym(m, 0, len,
2136 						    M_WAITOK);
2137 						SOCKBUF_LOCK(&so->so_rcv);
2138 					}
2139 				}
2140 				sbcut_locked(&so->so_rcv, len);
2141 			}
2142 		}
2143 		SOCKBUF_LOCK_ASSERT(&so->so_rcv);
2144 		if (so->so_oobmark) {
2145 			if ((flags & MSG_PEEK) == 0) {
2146 				so->so_oobmark -= len;
2147 				if (so->so_oobmark == 0) {
2148 					so->so_rcv.sb_state |= SBS_RCVATMARK;
2149 					break;
2150 				}
2151 			} else {
2152 				offset += len;
2153 				if (offset == so->so_oobmark)
2154 					break;
2155 			}
2156 		}
2157 		if (flags & MSG_EOR)
2158 			break;
2159 		/*
2160 		 * If the MSG_WAITALL flag is set (for non-atomic socket), we
2161 		 * must not quit until "uio->uio_resid == 0" or an error
2162 		 * termination.  If a signal/timeout occurs, return with a
2163 		 * short count but without error.  Keep sockbuf locked
2164 		 * against other readers.
2165 		 */
2166 		while (flags & MSG_WAITALL && m == NULL && uio->uio_resid > 0 &&
2167 		    !sosendallatonce(so) && nextrecord == NULL) {
2168 			SOCKBUF_LOCK_ASSERT(&so->so_rcv);
2169 			if (so->so_error ||
2170 			    so->so_rcv.sb_state & SBS_CANTRCVMORE)
2171 				break;
2172 			/*
2173 			 * Notify the protocol that some data has been
2174 			 * drained before blocking.
2175 			 */
2176 			if (pr->pr_flags & PR_WANTRCVD) {
2177 				SOCKBUF_UNLOCK(&so->so_rcv);
2178 				VNET_SO_ASSERT(so);
2179 				(*pr->pr_usrreqs->pru_rcvd)(so, flags);
2180 				SOCKBUF_LOCK(&so->so_rcv);
2181 			}
2182 			SBLASTRECORDCHK(&so->so_rcv);
2183 			SBLASTMBUFCHK(&so->so_rcv);
2184 			/*
2185 			 * We could receive some data while was notifying
2186 			 * the protocol. Skip blocking in this case.
2187 			 */
2188 			if (so->so_rcv.sb_mb == NULL) {
2189 				error = sbwait(&so->so_rcv);
2190 				if (error) {
2191 					SOCKBUF_UNLOCK(&so->so_rcv);
2192 					goto release;
2193 				}
2194 			}
2195 			m = so->so_rcv.sb_mb;
2196 			if (m != NULL)
2197 				nextrecord = m->m_nextpkt;
2198 		}
2199 	}
2200 
2201 	SOCKBUF_LOCK_ASSERT(&so->so_rcv);
2202 	if (m != NULL && pr->pr_flags & PR_ATOMIC) {
2203 		flags |= MSG_TRUNC;
2204 		if ((flags & MSG_PEEK) == 0)
2205 			(void) sbdroprecord_locked(&so->so_rcv);
2206 	}
2207 	if ((flags & MSG_PEEK) == 0) {
2208 		if (m == NULL) {
2209 			/*
2210 			 * First part is an inline SB_EMPTY_FIXUP().  Second
2211 			 * part makes sure sb_lastrecord is up-to-date if
2212 			 * there is still data in the socket buffer.
2213 			 */
2214 			so->so_rcv.sb_mb = nextrecord;
2215 			if (so->so_rcv.sb_mb == NULL) {
2216 				so->so_rcv.sb_mbtail = NULL;
2217 				so->so_rcv.sb_lastrecord = NULL;
2218 			} else if (nextrecord->m_nextpkt == NULL)
2219 				so->so_rcv.sb_lastrecord = nextrecord;
2220 		}
2221 		SBLASTRECORDCHK(&so->so_rcv);
2222 		SBLASTMBUFCHK(&so->so_rcv);
2223 		/*
2224 		 * If soreceive() is being done from the socket callback,
2225 		 * then don't need to generate ACK to peer to update window,
2226 		 * since ACK will be generated on return to TCP.
2227 		 */
2228 		if (!(flags & MSG_SOCALLBCK) &&
2229 		    (pr->pr_flags & PR_WANTRCVD)) {
2230 			SOCKBUF_UNLOCK(&so->so_rcv);
2231 			VNET_SO_ASSERT(so);
2232 			(*pr->pr_usrreqs->pru_rcvd)(so, flags);
2233 			SOCKBUF_LOCK(&so->so_rcv);
2234 		}
2235 	}
2236 	SOCKBUF_LOCK_ASSERT(&so->so_rcv);
2237 	if (orig_resid == uio->uio_resid && orig_resid &&
2238 	    (flags & MSG_EOR) == 0 && (so->so_rcv.sb_state & SBS_CANTRCVMORE) == 0) {
2239 		SOCKBUF_UNLOCK(&so->so_rcv);
2240 		goto restart;
2241 	}
2242 	SOCKBUF_UNLOCK(&so->so_rcv);
2243 
2244 	if (flagsp != NULL)
2245 		*flagsp |= flags;
2246 release:
2247 	sbunlock(&so->so_rcv);
2248 	return (error);
2249 }
2250 
2251 /*
2252  * Optimized version of soreceive() for stream (TCP) sockets.
2253  */
2254 int
2255 soreceive_stream(struct socket *so, struct sockaddr **psa, struct uio *uio,
2256     struct mbuf **mp0, struct mbuf **controlp, int *flagsp)
2257 {
2258 	int len = 0, error = 0, flags, oresid;
2259 	struct sockbuf *sb;
2260 	struct mbuf *m, *n = NULL;
2261 
2262 	/* We only do stream sockets. */
2263 	if (so->so_type != SOCK_STREAM)
2264 		return (EINVAL);
2265 	if (psa != NULL)
2266 		*psa = NULL;
2267 	if (flagsp != NULL)
2268 		flags = *flagsp &~ MSG_EOR;
2269 	else
2270 		flags = 0;
2271 	if (controlp != NULL)
2272 		*controlp = NULL;
2273 	if (flags & MSG_OOB)
2274 		return (soreceive_rcvoob(so, uio, flags));
2275 	if (mp0 != NULL)
2276 		*mp0 = NULL;
2277 
2278 	sb = &so->so_rcv;
2279 
2280 	/* Prevent other readers from entering the socket. */
2281 	error = sblock(sb, SBLOCKWAIT(flags));
2282 	if (error)
2283 		return (error);
2284 	SOCKBUF_LOCK(sb);
2285 
2286 	/* Easy one, no space to copyout anything. */
2287 	if (uio->uio_resid == 0) {
2288 		error = EINVAL;
2289 		goto out;
2290 	}
2291 	oresid = uio->uio_resid;
2292 
2293 	/* We will never ever get anything unless we are or were connected. */
2294 	if (!(so->so_state & (SS_ISCONNECTED|SS_ISDISCONNECTED))) {
2295 		error = ENOTCONN;
2296 		goto out;
2297 	}
2298 
2299 restart:
2300 	SOCKBUF_LOCK_ASSERT(&so->so_rcv);
2301 
2302 	/* Abort if socket has reported problems. */
2303 	if (so->so_error) {
2304 		if (sbavail(sb) > 0)
2305 			goto deliver;
2306 		if (oresid > uio->uio_resid)
2307 			goto out;
2308 		error = so->so_error;
2309 		if (!(flags & MSG_PEEK))
2310 			so->so_error = 0;
2311 		goto out;
2312 	}
2313 
2314 	/* Door is closed.  Deliver what is left, if any. */
2315 	if (sb->sb_state & SBS_CANTRCVMORE) {
2316 		if (sbavail(sb) > 0)
2317 			goto deliver;
2318 		else
2319 			goto out;
2320 	}
2321 
2322 	/* Socket buffer is empty and we shall not block. */
2323 	if (sbavail(sb) == 0 &&
2324 	    ((so->so_state & SS_NBIO) || (flags & (MSG_DONTWAIT|MSG_NBIO)))) {
2325 		error = EAGAIN;
2326 		goto out;
2327 	}
2328 
2329 	/* Socket buffer got some data that we shall deliver now. */
2330 	if (sbavail(sb) > 0 && !(flags & MSG_WAITALL) &&
2331 	    ((so->so_state & SS_NBIO) ||
2332 	     (flags & (MSG_DONTWAIT|MSG_NBIO)) ||
2333 	     sbavail(sb) >= sb->sb_lowat ||
2334 	     sbavail(sb) >= uio->uio_resid ||
2335 	     sbavail(sb) >= sb->sb_hiwat) ) {
2336 		goto deliver;
2337 	}
2338 
2339 	/* On MSG_WAITALL we must wait until all data or error arrives. */
2340 	if ((flags & MSG_WAITALL) &&
2341 	    (sbavail(sb) >= uio->uio_resid || sbavail(sb) >= sb->sb_hiwat))
2342 		goto deliver;
2343 
2344 	/*
2345 	 * Wait and block until (more) data comes in.
2346 	 * NB: Drops the sockbuf lock during wait.
2347 	 */
2348 	error = sbwait(sb);
2349 	if (error)
2350 		goto out;
2351 	goto restart;
2352 
2353 deliver:
2354 	SOCKBUF_LOCK_ASSERT(&so->so_rcv);
2355 	KASSERT(sbavail(sb) > 0, ("%s: sockbuf empty", __func__));
2356 	KASSERT(sb->sb_mb != NULL, ("%s: sb_mb == NULL", __func__));
2357 
2358 	/* Statistics. */
2359 	if (uio->uio_td)
2360 		uio->uio_td->td_ru.ru_msgrcv++;
2361 
2362 	/* Fill uio until full or current end of socket buffer is reached. */
2363 	len = min(uio->uio_resid, sbavail(sb));
2364 	if (mp0 != NULL) {
2365 		/* Dequeue as many mbufs as possible. */
2366 		if (!(flags & MSG_PEEK) && len >= sb->sb_mb->m_len) {
2367 			if (*mp0 == NULL)
2368 				*mp0 = sb->sb_mb;
2369 			else
2370 				m_cat(*mp0, sb->sb_mb);
2371 			for (m = sb->sb_mb;
2372 			     m != NULL && m->m_len <= len;
2373 			     m = m->m_next) {
2374 				KASSERT(!(m->m_flags & M_NOTAVAIL),
2375 				    ("%s: m %p not available", __func__, m));
2376 				len -= m->m_len;
2377 				uio->uio_resid -= m->m_len;
2378 				sbfree(sb, m);
2379 				n = m;
2380 			}
2381 			n->m_next = NULL;
2382 			sb->sb_mb = m;
2383 			sb->sb_lastrecord = sb->sb_mb;
2384 			if (sb->sb_mb == NULL)
2385 				SB_EMPTY_FIXUP(sb);
2386 		}
2387 		/* Copy the remainder. */
2388 		if (len > 0) {
2389 			KASSERT(sb->sb_mb != NULL,
2390 			    ("%s: len > 0 && sb->sb_mb empty", __func__));
2391 
2392 			m = m_copym(sb->sb_mb, 0, len, M_NOWAIT);
2393 			if (m == NULL)
2394 				len = 0;	/* Don't flush data from sockbuf. */
2395 			else
2396 				uio->uio_resid -= len;
2397 			if (*mp0 != NULL)
2398 				m_cat(*mp0, m);
2399 			else
2400 				*mp0 = m;
2401 			if (*mp0 == NULL) {
2402 				error = ENOBUFS;
2403 				goto out;
2404 			}
2405 		}
2406 	} else {
2407 		/* NB: Must unlock socket buffer as uiomove may sleep. */
2408 		SOCKBUF_UNLOCK(sb);
2409 		error = m_mbuftouio(uio, sb->sb_mb, len);
2410 		SOCKBUF_LOCK(sb);
2411 		if (error)
2412 			goto out;
2413 	}
2414 	SBLASTRECORDCHK(sb);
2415 	SBLASTMBUFCHK(sb);
2416 
2417 	/*
2418 	 * Remove the delivered data from the socket buffer unless we
2419 	 * were only peeking.
2420 	 */
2421 	if (!(flags & MSG_PEEK)) {
2422 		if (len > 0)
2423 			sbdrop_locked(sb, len);
2424 
2425 		/* Notify protocol that we drained some data. */
2426 		if ((so->so_proto->pr_flags & PR_WANTRCVD) &&
2427 		    (((flags & MSG_WAITALL) && uio->uio_resid > 0) ||
2428 		     !(flags & MSG_SOCALLBCK))) {
2429 			SOCKBUF_UNLOCK(sb);
2430 			VNET_SO_ASSERT(so);
2431 			(*so->so_proto->pr_usrreqs->pru_rcvd)(so, flags);
2432 			SOCKBUF_LOCK(sb);
2433 		}
2434 	}
2435 
2436 	/*
2437 	 * For MSG_WAITALL we may have to loop again and wait for
2438 	 * more data to come in.
2439 	 */
2440 	if ((flags & MSG_WAITALL) && uio->uio_resid > 0)
2441 		goto restart;
2442 out:
2443 	SOCKBUF_LOCK_ASSERT(sb);
2444 	SBLASTRECORDCHK(sb);
2445 	SBLASTMBUFCHK(sb);
2446 	SOCKBUF_UNLOCK(sb);
2447 	sbunlock(sb);
2448 	return (error);
2449 }
2450 
2451 /*
2452  * Optimized version of soreceive() for simple datagram cases from userspace.
2453  * Unlike in the stream case, we're able to drop a datagram if copyout()
2454  * fails, and because we handle datagrams atomically, we don't need to use a
2455  * sleep lock to prevent I/O interlacing.
2456  */
2457 int
2458 soreceive_dgram(struct socket *so, struct sockaddr **psa, struct uio *uio,
2459     struct mbuf **mp0, struct mbuf **controlp, int *flagsp)
2460 {
2461 	struct mbuf *m, *m2;
2462 	int flags, error;
2463 	ssize_t len;
2464 	struct protosw *pr = so->so_proto;
2465 	struct mbuf *nextrecord;
2466 
2467 	if (psa != NULL)
2468 		*psa = NULL;
2469 	if (controlp != NULL)
2470 		*controlp = NULL;
2471 	if (flagsp != NULL)
2472 		flags = *flagsp &~ MSG_EOR;
2473 	else
2474 		flags = 0;
2475 
2476 	/*
2477 	 * For any complicated cases, fall back to the full
2478 	 * soreceive_generic().
2479 	 */
2480 	if (mp0 != NULL || (flags & MSG_PEEK) || (flags & MSG_OOB))
2481 		return (soreceive_generic(so, psa, uio, mp0, controlp,
2482 		    flagsp));
2483 
2484 	/*
2485 	 * Enforce restrictions on use.
2486 	 */
2487 	KASSERT((pr->pr_flags & PR_WANTRCVD) == 0,
2488 	    ("soreceive_dgram: wantrcvd"));
2489 	KASSERT(pr->pr_flags & PR_ATOMIC, ("soreceive_dgram: !atomic"));
2490 	KASSERT((so->so_rcv.sb_state & SBS_RCVATMARK) == 0,
2491 	    ("soreceive_dgram: SBS_RCVATMARK"));
2492 	KASSERT((so->so_proto->pr_flags & PR_CONNREQUIRED) == 0,
2493 	    ("soreceive_dgram: P_CONNREQUIRED"));
2494 
2495 	/*
2496 	 * Loop blocking while waiting for a datagram.
2497 	 */
2498 	SOCKBUF_LOCK(&so->so_rcv);
2499 	while ((m = so->so_rcv.sb_mb) == NULL) {
2500 		KASSERT(sbavail(&so->so_rcv) == 0,
2501 		    ("soreceive_dgram: sb_mb NULL but sbavail %u",
2502 		    sbavail(&so->so_rcv)));
2503 		if (so->so_error) {
2504 			error = so->so_error;
2505 			so->so_error = 0;
2506 			SOCKBUF_UNLOCK(&so->so_rcv);
2507 			return (error);
2508 		}
2509 		if (so->so_rcv.sb_state & SBS_CANTRCVMORE ||
2510 		    uio->uio_resid == 0) {
2511 			SOCKBUF_UNLOCK(&so->so_rcv);
2512 			return (0);
2513 		}
2514 		if ((so->so_state & SS_NBIO) ||
2515 		    (flags & (MSG_DONTWAIT|MSG_NBIO))) {
2516 			SOCKBUF_UNLOCK(&so->so_rcv);
2517 			return (EWOULDBLOCK);
2518 		}
2519 		SBLASTRECORDCHK(&so->so_rcv);
2520 		SBLASTMBUFCHK(&so->so_rcv);
2521 		error = sbwait(&so->so_rcv);
2522 		if (error) {
2523 			SOCKBUF_UNLOCK(&so->so_rcv);
2524 			return (error);
2525 		}
2526 	}
2527 	SOCKBUF_LOCK_ASSERT(&so->so_rcv);
2528 
2529 	if (uio->uio_td)
2530 		uio->uio_td->td_ru.ru_msgrcv++;
2531 	SBLASTRECORDCHK(&so->so_rcv);
2532 	SBLASTMBUFCHK(&so->so_rcv);
2533 	nextrecord = m->m_nextpkt;
2534 	if (nextrecord == NULL) {
2535 		KASSERT(so->so_rcv.sb_lastrecord == m,
2536 		    ("soreceive_dgram: lastrecord != m"));
2537 	}
2538 
2539 	KASSERT(so->so_rcv.sb_mb->m_nextpkt == nextrecord,
2540 	    ("soreceive_dgram: m_nextpkt != nextrecord"));
2541 
2542 	/*
2543 	 * Pull 'm' and its chain off the front of the packet queue.
2544 	 */
2545 	so->so_rcv.sb_mb = NULL;
2546 	sockbuf_pushsync(&so->so_rcv, nextrecord);
2547 
2548 	/*
2549 	 * Walk 'm's chain and free that many bytes from the socket buffer.
2550 	 */
2551 	for (m2 = m; m2 != NULL; m2 = m2->m_next)
2552 		sbfree(&so->so_rcv, m2);
2553 
2554 	/*
2555 	 * Do a few last checks before we let go of the lock.
2556 	 */
2557 	SBLASTRECORDCHK(&so->so_rcv);
2558 	SBLASTMBUFCHK(&so->so_rcv);
2559 	SOCKBUF_UNLOCK(&so->so_rcv);
2560 
2561 	if (pr->pr_flags & PR_ADDR) {
2562 		KASSERT(m->m_type == MT_SONAME,
2563 		    ("m->m_type == %d", m->m_type));
2564 		if (psa != NULL)
2565 			*psa = sodupsockaddr(mtod(m, struct sockaddr *),
2566 			    M_NOWAIT);
2567 		m = m_free(m);
2568 	}
2569 	if (m == NULL) {
2570 		/* XXXRW: Can this happen? */
2571 		return (0);
2572 	}
2573 
2574 	/*
2575 	 * Packet to copyout() is now in 'm' and it is disconnected from the
2576 	 * queue.
2577 	 *
2578 	 * Process one or more MT_CONTROL mbufs present before any data mbufs
2579 	 * in the first mbuf chain on the socket buffer.  We call into the
2580 	 * protocol to perform externalization (or freeing if controlp ==
2581 	 * NULL). In some cases there can be only MT_CONTROL mbufs without
2582 	 * MT_DATA mbufs.
2583 	 */
2584 	if (m->m_type == MT_CONTROL) {
2585 		struct mbuf *cm = NULL, *cmn;
2586 		struct mbuf **cme = &cm;
2587 
2588 		do {
2589 			m2 = m->m_next;
2590 			m->m_next = NULL;
2591 			*cme = m;
2592 			cme = &(*cme)->m_next;
2593 			m = m2;
2594 		} while (m != NULL && m->m_type == MT_CONTROL);
2595 		while (cm != NULL) {
2596 			cmn = cm->m_next;
2597 			cm->m_next = NULL;
2598 			if (pr->pr_domain->dom_externalize != NULL) {
2599 				error = (*pr->pr_domain->dom_externalize)
2600 				    (cm, controlp, flags);
2601 			} else if (controlp != NULL)
2602 				*controlp = cm;
2603 			else
2604 				m_freem(cm);
2605 			if (controlp != NULL) {
2606 				while (*controlp != NULL)
2607 					controlp = &(*controlp)->m_next;
2608 			}
2609 			cm = cmn;
2610 		}
2611 	}
2612 	KASSERT(m == NULL || m->m_type == MT_DATA,
2613 	    ("soreceive_dgram: !data"));
2614 	while (m != NULL && uio->uio_resid > 0) {
2615 		len = uio->uio_resid;
2616 		if (len > m->m_len)
2617 			len = m->m_len;
2618 		error = uiomove(mtod(m, char *), (int)len, uio);
2619 		if (error) {
2620 			m_freem(m);
2621 			return (error);
2622 		}
2623 		if (len == m->m_len)
2624 			m = m_free(m);
2625 		else {
2626 			m->m_data += len;
2627 			m->m_len -= len;
2628 		}
2629 	}
2630 	if (m != NULL) {
2631 		flags |= MSG_TRUNC;
2632 		m_freem(m);
2633 	}
2634 	if (flagsp != NULL)
2635 		*flagsp |= flags;
2636 	return (0);
2637 }
2638 
2639 int
2640 soreceive(struct socket *so, struct sockaddr **psa, struct uio *uio,
2641     struct mbuf **mp0, struct mbuf **controlp, int *flagsp)
2642 {
2643 	int error;
2644 
2645 	CURVNET_SET(so->so_vnet);
2646 	if (!SOLISTENING(so))
2647 		error = (so->so_proto->pr_usrreqs->pru_soreceive(so, psa, uio,
2648 		    mp0, controlp, flagsp));
2649 	else
2650 		error = ENOTCONN;
2651 	CURVNET_RESTORE();
2652 	return (error);
2653 }
2654 
2655 int
2656 soshutdown(struct socket *so, int how)
2657 {
2658 	struct protosw *pr = so->so_proto;
2659 	int error, soerror_enotconn;
2660 
2661 	if (!(how == SHUT_RD || how == SHUT_WR || how == SHUT_RDWR))
2662 		return (EINVAL);
2663 
2664 	soerror_enotconn = 0;
2665 	if ((so->so_state &
2666 	    (SS_ISCONNECTED | SS_ISCONNECTING | SS_ISDISCONNECTING)) == 0) {
2667 		/*
2668 		 * POSIX mandates us to return ENOTCONN when shutdown(2) is
2669 		 * invoked on a datagram sockets, however historically we would
2670 		 * actually tear socket down. This is known to be leveraged by
2671 		 * some applications to unblock process waiting in recvXXX(2)
2672 		 * by other process that it shares that socket with. Try to meet
2673 		 * both backward-compatibility and POSIX requirements by forcing
2674 		 * ENOTCONN but still asking protocol to perform pru_shutdown().
2675 		 */
2676 		if (so->so_type != SOCK_DGRAM && !SOLISTENING(so))
2677 			return (ENOTCONN);
2678 		soerror_enotconn = 1;
2679 	}
2680 
2681 	if (SOLISTENING(so)) {
2682 		if (how != SHUT_WR) {
2683 			SOLISTEN_LOCK(so);
2684 			so->so_error = ECONNABORTED;
2685 			solisten_wakeup(so);	/* unlocks so */
2686 		}
2687 		goto done;
2688 	}
2689 
2690 	CURVNET_SET(so->so_vnet);
2691 	if (pr->pr_usrreqs->pru_flush != NULL)
2692 		(*pr->pr_usrreqs->pru_flush)(so, how);
2693 	if (how != SHUT_WR)
2694 		sorflush(so);
2695 	if (how != SHUT_RD) {
2696 		error = (*pr->pr_usrreqs->pru_shutdown)(so);
2697 		wakeup(&so->so_timeo);
2698 		CURVNET_RESTORE();
2699 		return ((error == 0 && soerror_enotconn) ? ENOTCONN : error);
2700 	}
2701 	wakeup(&so->so_timeo);
2702 	CURVNET_RESTORE();
2703 
2704 done:
2705 	return (soerror_enotconn ? ENOTCONN : 0);
2706 }
2707 
2708 void
2709 sorflush(struct socket *so)
2710 {
2711 	struct sockbuf *sb = &so->so_rcv;
2712 	struct protosw *pr = so->so_proto;
2713 	struct socket aso;
2714 
2715 	VNET_SO_ASSERT(so);
2716 
2717 	/*
2718 	 * In order to avoid calling dom_dispose with the socket buffer mutex
2719 	 * held, and in order to generally avoid holding the lock for a long
2720 	 * time, we make a copy of the socket buffer and clear the original
2721 	 * (except locks, state).  The new socket buffer copy won't have
2722 	 * initialized locks so we can only call routines that won't use or
2723 	 * assert those locks.
2724 	 *
2725 	 * Dislodge threads currently blocked in receive and wait to acquire
2726 	 * a lock against other simultaneous readers before clearing the
2727 	 * socket buffer.  Don't let our acquire be interrupted by a signal
2728 	 * despite any existing socket disposition on interruptable waiting.
2729 	 */
2730 	socantrcvmore(so);
2731 	(void) sblock(sb, SBL_WAIT | SBL_NOINTR);
2732 
2733 	/*
2734 	 * Invalidate/clear most of the sockbuf structure, but leave selinfo
2735 	 * and mutex data unchanged.
2736 	 */
2737 	SOCKBUF_LOCK(sb);
2738 	bzero(&aso, sizeof(aso));
2739 	aso.so_pcb = so->so_pcb;
2740 	bcopy(&sb->sb_startzero, &aso.so_rcv.sb_startzero,
2741 	    sizeof(*sb) - offsetof(struct sockbuf, sb_startzero));
2742 	bzero(&sb->sb_startzero,
2743 	    sizeof(*sb) - offsetof(struct sockbuf, sb_startzero));
2744 	SOCKBUF_UNLOCK(sb);
2745 	sbunlock(sb);
2746 
2747 	/*
2748 	 * Dispose of special rights and flush the copied socket.  Don't call
2749 	 * any unsafe routines (that rely on locks being initialized) on aso.
2750 	 */
2751 	if (pr->pr_flags & PR_RIGHTS && pr->pr_domain->dom_dispose != NULL)
2752 		(*pr->pr_domain->dom_dispose)(&aso);
2753 	sbrelease_internal(&aso.so_rcv, so);
2754 }
2755 
2756 /*
2757  * Wrapper for Socket established helper hook.
2758  * Parameters: socket, context of the hook point, hook id.
2759  */
2760 static int inline
2761 hhook_run_socket(struct socket *so, void *hctx, int32_t h_id)
2762 {
2763 	struct socket_hhook_data hhook_data = {
2764 		.so = so,
2765 		.hctx = hctx,
2766 		.m = NULL,
2767 		.status = 0
2768 	};
2769 
2770 	CURVNET_SET(so->so_vnet);
2771 	HHOOKS_RUN_IF(V_socket_hhh[h_id], &hhook_data, &so->osd);
2772 	CURVNET_RESTORE();
2773 
2774 	/* Ugly but needed, since hhooks return void for now */
2775 	return (hhook_data.status);
2776 }
2777 
2778 /*
2779  * Perhaps this routine, and sooptcopyout(), below, ought to come in an
2780  * additional variant to handle the case where the option value needs to be
2781  * some kind of integer, but not a specific size.  In addition to their use
2782  * here, these functions are also called by the protocol-level pr_ctloutput()
2783  * routines.
2784  */
2785 int
2786 sooptcopyin(struct sockopt *sopt, void *buf, size_t len, size_t minlen)
2787 {
2788 	size_t	valsize;
2789 
2790 	/*
2791 	 * If the user gives us more than we wanted, we ignore it, but if we
2792 	 * don't get the minimum length the caller wants, we return EINVAL.
2793 	 * On success, sopt->sopt_valsize is set to however much we actually
2794 	 * retrieved.
2795 	 */
2796 	if ((valsize = sopt->sopt_valsize) < minlen)
2797 		return EINVAL;
2798 	if (valsize > len)
2799 		sopt->sopt_valsize = valsize = len;
2800 
2801 	if (sopt->sopt_td != NULL)
2802 		return (copyin(sopt->sopt_val, buf, valsize));
2803 
2804 	bcopy(sopt->sopt_val, buf, valsize);
2805 	return (0);
2806 }
2807 
2808 /*
2809  * Kernel version of setsockopt(2).
2810  *
2811  * XXX: optlen is size_t, not socklen_t
2812  */
2813 int
2814 so_setsockopt(struct socket *so, int level, int optname, void *optval,
2815     size_t optlen)
2816 {
2817 	struct sockopt sopt;
2818 
2819 	sopt.sopt_level = level;
2820 	sopt.sopt_name = optname;
2821 	sopt.sopt_dir = SOPT_SET;
2822 	sopt.sopt_val = optval;
2823 	sopt.sopt_valsize = optlen;
2824 	sopt.sopt_td = NULL;
2825 	return (sosetopt(so, &sopt));
2826 }
2827 
2828 int
2829 sosetopt(struct socket *so, struct sockopt *sopt)
2830 {
2831 	int	error, optval;
2832 	struct	linger l;
2833 	struct	timeval tv;
2834 	sbintime_t val;
2835 	uint32_t val32;
2836 #ifdef MAC
2837 	struct mac extmac;
2838 #endif
2839 
2840 	CURVNET_SET(so->so_vnet);
2841 	error = 0;
2842 	if (sopt->sopt_level != SOL_SOCKET) {
2843 		if (so->so_proto->pr_ctloutput != NULL)
2844 			error = (*so->so_proto->pr_ctloutput)(so, sopt);
2845 		else
2846 			error = ENOPROTOOPT;
2847 	} else {
2848 		switch (sopt->sopt_name) {
2849 		case SO_ACCEPTFILTER:
2850 			error = accept_filt_setopt(so, sopt);
2851 			if (error)
2852 				goto bad;
2853 			break;
2854 
2855 		case SO_LINGER:
2856 			error = sooptcopyin(sopt, &l, sizeof l, sizeof l);
2857 			if (error)
2858 				goto bad;
2859 			if (l.l_linger < 0 ||
2860 			    l.l_linger > USHRT_MAX ||
2861 			    l.l_linger > (INT_MAX / hz)) {
2862 				error = EDOM;
2863 				goto bad;
2864 			}
2865 			SOCK_LOCK(so);
2866 			so->so_linger = l.l_linger;
2867 			if (l.l_onoff)
2868 				so->so_options |= SO_LINGER;
2869 			else
2870 				so->so_options &= ~SO_LINGER;
2871 			SOCK_UNLOCK(so);
2872 			break;
2873 
2874 		case SO_DEBUG:
2875 		case SO_KEEPALIVE:
2876 		case SO_DONTROUTE:
2877 		case SO_USELOOPBACK:
2878 		case SO_BROADCAST:
2879 		case SO_REUSEADDR:
2880 		case SO_REUSEPORT:
2881 		case SO_REUSEPORT_LB:
2882 		case SO_OOBINLINE:
2883 		case SO_TIMESTAMP:
2884 		case SO_BINTIME:
2885 		case SO_NOSIGPIPE:
2886 		case SO_NO_DDP:
2887 		case SO_NO_OFFLOAD:
2888 			error = sooptcopyin(sopt, &optval, sizeof optval,
2889 			    sizeof optval);
2890 			if (error)
2891 				goto bad;
2892 			SOCK_LOCK(so);
2893 			if (optval)
2894 				so->so_options |= sopt->sopt_name;
2895 			else
2896 				so->so_options &= ~sopt->sopt_name;
2897 			SOCK_UNLOCK(so);
2898 			break;
2899 
2900 		case SO_SETFIB:
2901 			error = sooptcopyin(sopt, &optval, sizeof optval,
2902 			    sizeof optval);
2903 			if (error)
2904 				goto bad;
2905 
2906 			if (optval < 0 || optval >= rt_numfibs) {
2907 				error = EINVAL;
2908 				goto bad;
2909 			}
2910 			if (((so->so_proto->pr_domain->dom_family == PF_INET) ||
2911 			   (so->so_proto->pr_domain->dom_family == PF_INET6) ||
2912 			   (so->so_proto->pr_domain->dom_family == PF_ROUTE)))
2913 				so->so_fibnum = optval;
2914 			else
2915 				so->so_fibnum = 0;
2916 			break;
2917 
2918 		case SO_USER_COOKIE:
2919 			error = sooptcopyin(sopt, &val32, sizeof val32,
2920 			    sizeof val32);
2921 			if (error)
2922 				goto bad;
2923 			so->so_user_cookie = val32;
2924 			break;
2925 
2926 		case SO_SNDBUF:
2927 		case SO_RCVBUF:
2928 		case SO_SNDLOWAT:
2929 		case SO_RCVLOWAT:
2930 			error = sooptcopyin(sopt, &optval, sizeof optval,
2931 			    sizeof optval);
2932 			if (error)
2933 				goto bad;
2934 
2935 			/*
2936 			 * Values < 1 make no sense for any of these options,
2937 			 * so disallow them.
2938 			 */
2939 			if (optval < 1) {
2940 				error = EINVAL;
2941 				goto bad;
2942 			}
2943 
2944 			error = sbsetopt(so, sopt->sopt_name, optval);
2945 			break;
2946 
2947 		case SO_SNDTIMEO:
2948 		case SO_RCVTIMEO:
2949 #ifdef COMPAT_FREEBSD32
2950 			if (SV_CURPROC_FLAG(SV_ILP32)) {
2951 				struct timeval32 tv32;
2952 
2953 				error = sooptcopyin(sopt, &tv32, sizeof tv32,
2954 				    sizeof tv32);
2955 				CP(tv32, tv, tv_sec);
2956 				CP(tv32, tv, tv_usec);
2957 			} else
2958 #endif
2959 				error = sooptcopyin(sopt, &tv, sizeof tv,
2960 				    sizeof tv);
2961 			if (error)
2962 				goto bad;
2963 			if (tv.tv_sec < 0 || tv.tv_usec < 0 ||
2964 			    tv.tv_usec >= 1000000) {
2965 				error = EDOM;
2966 				goto bad;
2967 			}
2968 			if (tv.tv_sec > INT32_MAX)
2969 				val = SBT_MAX;
2970 			else
2971 				val = tvtosbt(tv);
2972 			switch (sopt->sopt_name) {
2973 			case SO_SNDTIMEO:
2974 				so->so_snd.sb_timeo = val;
2975 				break;
2976 			case SO_RCVTIMEO:
2977 				so->so_rcv.sb_timeo = val;
2978 				break;
2979 			}
2980 			break;
2981 
2982 		case SO_LABEL:
2983 #ifdef MAC
2984 			error = sooptcopyin(sopt, &extmac, sizeof extmac,
2985 			    sizeof extmac);
2986 			if (error)
2987 				goto bad;
2988 			error = mac_setsockopt_label(sopt->sopt_td->td_ucred,
2989 			    so, &extmac);
2990 #else
2991 			error = EOPNOTSUPP;
2992 #endif
2993 			break;
2994 
2995 		case SO_TS_CLOCK:
2996 			error = sooptcopyin(sopt, &optval, sizeof optval,
2997 			    sizeof optval);
2998 			if (error)
2999 				goto bad;
3000 			if (optval < 0 || optval > SO_TS_CLOCK_MAX) {
3001 				error = EINVAL;
3002 				goto bad;
3003 			}
3004 			so->so_ts_clock = optval;
3005 			break;
3006 
3007 		case SO_MAX_PACING_RATE:
3008 			error = sooptcopyin(sopt, &val32, sizeof(val32),
3009 			    sizeof(val32));
3010 			if (error)
3011 				goto bad;
3012 			so->so_max_pacing_rate = val32;
3013 			break;
3014 
3015 		default:
3016 			if (V_socket_hhh[HHOOK_SOCKET_OPT]->hhh_nhooks > 0)
3017 				error = hhook_run_socket(so, sopt,
3018 				    HHOOK_SOCKET_OPT);
3019 			else
3020 				error = ENOPROTOOPT;
3021 			break;
3022 		}
3023 		if (error == 0 && so->so_proto->pr_ctloutput != NULL)
3024 			(void)(*so->so_proto->pr_ctloutput)(so, sopt);
3025 	}
3026 bad:
3027 	CURVNET_RESTORE();
3028 	return (error);
3029 }
3030 
3031 /*
3032  * Helper routine for getsockopt.
3033  */
3034 int
3035 sooptcopyout(struct sockopt *sopt, const void *buf, size_t len)
3036 {
3037 	int	error;
3038 	size_t	valsize;
3039 
3040 	error = 0;
3041 
3042 	/*
3043 	 * Documented get behavior is that we always return a value, possibly
3044 	 * truncated to fit in the user's buffer.  Traditional behavior is
3045 	 * that we always tell the user precisely how much we copied, rather
3046 	 * than something useful like the total amount we had available for
3047 	 * her.  Note that this interface is not idempotent; the entire
3048 	 * answer must be generated ahead of time.
3049 	 */
3050 	valsize = min(len, sopt->sopt_valsize);
3051 	sopt->sopt_valsize = valsize;
3052 	if (sopt->sopt_val != NULL) {
3053 		if (sopt->sopt_td != NULL)
3054 			error = copyout(buf, sopt->sopt_val, valsize);
3055 		else
3056 			bcopy(buf, sopt->sopt_val, valsize);
3057 	}
3058 	return (error);
3059 }
3060 
3061 int
3062 sogetopt(struct socket *so, struct sockopt *sopt)
3063 {
3064 	int	error, optval;
3065 	struct	linger l;
3066 	struct	timeval tv;
3067 #ifdef MAC
3068 	struct mac extmac;
3069 #endif
3070 
3071 	CURVNET_SET(so->so_vnet);
3072 	error = 0;
3073 	if (sopt->sopt_level != SOL_SOCKET) {
3074 		if (so->so_proto->pr_ctloutput != NULL)
3075 			error = (*so->so_proto->pr_ctloutput)(so, sopt);
3076 		else
3077 			error = ENOPROTOOPT;
3078 		CURVNET_RESTORE();
3079 		return (error);
3080 	} else {
3081 		switch (sopt->sopt_name) {
3082 		case SO_ACCEPTFILTER:
3083 			error = accept_filt_getopt(so, sopt);
3084 			break;
3085 
3086 		case SO_LINGER:
3087 			SOCK_LOCK(so);
3088 			l.l_onoff = so->so_options & SO_LINGER;
3089 			l.l_linger = so->so_linger;
3090 			SOCK_UNLOCK(so);
3091 			error = sooptcopyout(sopt, &l, sizeof l);
3092 			break;
3093 
3094 		case SO_USELOOPBACK:
3095 		case SO_DONTROUTE:
3096 		case SO_DEBUG:
3097 		case SO_KEEPALIVE:
3098 		case SO_REUSEADDR:
3099 		case SO_REUSEPORT:
3100 		case SO_REUSEPORT_LB:
3101 		case SO_BROADCAST:
3102 		case SO_OOBINLINE:
3103 		case SO_ACCEPTCONN:
3104 		case SO_TIMESTAMP:
3105 		case SO_BINTIME:
3106 		case SO_NOSIGPIPE:
3107 			optval = so->so_options & sopt->sopt_name;
3108 integer:
3109 			error = sooptcopyout(sopt, &optval, sizeof optval);
3110 			break;
3111 
3112 		case SO_DOMAIN:
3113 			optval = so->so_proto->pr_domain->dom_family;
3114 			goto integer;
3115 
3116 		case SO_TYPE:
3117 			optval = so->so_type;
3118 			goto integer;
3119 
3120 		case SO_PROTOCOL:
3121 			optval = so->so_proto->pr_protocol;
3122 			goto integer;
3123 
3124 		case SO_ERROR:
3125 			SOCK_LOCK(so);
3126 			optval = so->so_error;
3127 			so->so_error = 0;
3128 			SOCK_UNLOCK(so);
3129 			goto integer;
3130 
3131 		case SO_SNDBUF:
3132 			optval = SOLISTENING(so) ? so->sol_sbsnd_hiwat :
3133 			    so->so_snd.sb_hiwat;
3134 			goto integer;
3135 
3136 		case SO_RCVBUF:
3137 			optval = SOLISTENING(so) ? so->sol_sbrcv_hiwat :
3138 			    so->so_rcv.sb_hiwat;
3139 			goto integer;
3140 
3141 		case SO_SNDLOWAT:
3142 			optval = SOLISTENING(so) ? so->sol_sbsnd_lowat :
3143 			    so->so_snd.sb_lowat;
3144 			goto integer;
3145 
3146 		case SO_RCVLOWAT:
3147 			optval = SOLISTENING(so) ? so->sol_sbrcv_lowat :
3148 			    so->so_rcv.sb_lowat;
3149 			goto integer;
3150 
3151 		case SO_SNDTIMEO:
3152 		case SO_RCVTIMEO:
3153 			tv = sbttotv(sopt->sopt_name == SO_SNDTIMEO ?
3154 			    so->so_snd.sb_timeo : so->so_rcv.sb_timeo);
3155 #ifdef COMPAT_FREEBSD32
3156 			if (SV_CURPROC_FLAG(SV_ILP32)) {
3157 				struct timeval32 tv32;
3158 
3159 				CP(tv, tv32, tv_sec);
3160 				CP(tv, tv32, tv_usec);
3161 				error = sooptcopyout(sopt, &tv32, sizeof tv32);
3162 			} else
3163 #endif
3164 				error = sooptcopyout(sopt, &tv, sizeof tv);
3165 			break;
3166 
3167 		case SO_LABEL:
3168 #ifdef MAC
3169 			error = sooptcopyin(sopt, &extmac, sizeof(extmac),
3170 			    sizeof(extmac));
3171 			if (error)
3172 				goto bad;
3173 			error = mac_getsockopt_label(sopt->sopt_td->td_ucred,
3174 			    so, &extmac);
3175 			if (error)
3176 				goto bad;
3177 			error = sooptcopyout(sopt, &extmac, sizeof extmac);
3178 #else
3179 			error = EOPNOTSUPP;
3180 #endif
3181 			break;
3182 
3183 		case SO_PEERLABEL:
3184 #ifdef MAC
3185 			error = sooptcopyin(sopt, &extmac, sizeof(extmac),
3186 			    sizeof(extmac));
3187 			if (error)
3188 				goto bad;
3189 			error = mac_getsockopt_peerlabel(
3190 			    sopt->sopt_td->td_ucred, so, &extmac);
3191 			if (error)
3192 				goto bad;
3193 			error = sooptcopyout(sopt, &extmac, sizeof extmac);
3194 #else
3195 			error = EOPNOTSUPP;
3196 #endif
3197 			break;
3198 
3199 		case SO_LISTENQLIMIT:
3200 			optval = SOLISTENING(so) ? so->sol_qlimit : 0;
3201 			goto integer;
3202 
3203 		case SO_LISTENQLEN:
3204 			optval = SOLISTENING(so) ? so->sol_qlen : 0;
3205 			goto integer;
3206 
3207 		case SO_LISTENINCQLEN:
3208 			optval = SOLISTENING(so) ? so->sol_incqlen : 0;
3209 			goto integer;
3210 
3211 		case SO_TS_CLOCK:
3212 			optval = so->so_ts_clock;
3213 			goto integer;
3214 
3215 		case SO_MAX_PACING_RATE:
3216 			optval = so->so_max_pacing_rate;
3217 			goto integer;
3218 
3219 		default:
3220 			if (V_socket_hhh[HHOOK_SOCKET_OPT]->hhh_nhooks > 0)
3221 				error = hhook_run_socket(so, sopt,
3222 				    HHOOK_SOCKET_OPT);
3223 			else
3224 				error = ENOPROTOOPT;
3225 			break;
3226 		}
3227 	}
3228 #ifdef MAC
3229 bad:
3230 #endif
3231 	CURVNET_RESTORE();
3232 	return (error);
3233 }
3234 
3235 int
3236 soopt_getm(struct sockopt *sopt, struct mbuf **mp)
3237 {
3238 	struct mbuf *m, *m_prev;
3239 	int sopt_size = sopt->sopt_valsize;
3240 
3241 	MGET(m, sopt->sopt_td ? M_WAITOK : M_NOWAIT, MT_DATA);
3242 	if (m == NULL)
3243 		return ENOBUFS;
3244 	if (sopt_size > MLEN) {
3245 		MCLGET(m, sopt->sopt_td ? M_WAITOK : M_NOWAIT);
3246 		if ((m->m_flags & M_EXT) == 0) {
3247 			m_free(m);
3248 			return ENOBUFS;
3249 		}
3250 		m->m_len = min(MCLBYTES, sopt_size);
3251 	} else {
3252 		m->m_len = min(MLEN, sopt_size);
3253 	}
3254 	sopt_size -= m->m_len;
3255 	*mp = m;
3256 	m_prev = m;
3257 
3258 	while (sopt_size) {
3259 		MGET(m, sopt->sopt_td ? M_WAITOK : M_NOWAIT, MT_DATA);
3260 		if (m == NULL) {
3261 			m_freem(*mp);
3262 			return ENOBUFS;
3263 		}
3264 		if (sopt_size > MLEN) {
3265 			MCLGET(m, sopt->sopt_td != NULL ? M_WAITOK :
3266 			    M_NOWAIT);
3267 			if ((m->m_flags & M_EXT) == 0) {
3268 				m_freem(m);
3269 				m_freem(*mp);
3270 				return ENOBUFS;
3271 			}
3272 			m->m_len = min(MCLBYTES, sopt_size);
3273 		} else {
3274 			m->m_len = min(MLEN, sopt_size);
3275 		}
3276 		sopt_size -= m->m_len;
3277 		m_prev->m_next = m;
3278 		m_prev = m;
3279 	}
3280 	return (0);
3281 }
3282 
3283 int
3284 soopt_mcopyin(struct sockopt *sopt, struct mbuf *m)
3285 {
3286 	struct mbuf *m0 = m;
3287 
3288 	if (sopt->sopt_val == NULL)
3289 		return (0);
3290 	while (m != NULL && sopt->sopt_valsize >= m->m_len) {
3291 		if (sopt->sopt_td != NULL) {
3292 			int error;
3293 
3294 			error = copyin(sopt->sopt_val, mtod(m, char *),
3295 			    m->m_len);
3296 			if (error != 0) {
3297 				m_freem(m0);
3298 				return(error);
3299 			}
3300 		} else
3301 			bcopy(sopt->sopt_val, mtod(m, char *), m->m_len);
3302 		sopt->sopt_valsize -= m->m_len;
3303 		sopt->sopt_val = (char *)sopt->sopt_val + m->m_len;
3304 		m = m->m_next;
3305 	}
3306 	if (m != NULL) /* should be allocated enoughly at ip6_sooptmcopyin() */
3307 		panic("ip6_sooptmcopyin");
3308 	return (0);
3309 }
3310 
3311 int
3312 soopt_mcopyout(struct sockopt *sopt, struct mbuf *m)
3313 {
3314 	struct mbuf *m0 = m;
3315 	size_t valsize = 0;
3316 
3317 	if (sopt->sopt_val == NULL)
3318 		return (0);
3319 	while (m != NULL && sopt->sopt_valsize >= m->m_len) {
3320 		if (sopt->sopt_td != NULL) {
3321 			int error;
3322 
3323 			error = copyout(mtod(m, char *), sopt->sopt_val,
3324 			    m->m_len);
3325 			if (error != 0) {
3326 				m_freem(m0);
3327 				return(error);
3328 			}
3329 		} else
3330 			bcopy(mtod(m, char *), sopt->sopt_val, m->m_len);
3331 		sopt->sopt_valsize -= m->m_len;
3332 		sopt->sopt_val = (char *)sopt->sopt_val + m->m_len;
3333 		valsize += m->m_len;
3334 		m = m->m_next;
3335 	}
3336 	if (m != NULL) {
3337 		/* enough soopt buffer should be given from user-land */
3338 		m_freem(m0);
3339 		return(EINVAL);
3340 	}
3341 	sopt->sopt_valsize = valsize;
3342 	return (0);
3343 }
3344 
3345 /*
3346  * sohasoutofband(): protocol notifies socket layer of the arrival of new
3347  * out-of-band data, which will then notify socket consumers.
3348  */
3349 void
3350 sohasoutofband(struct socket *so)
3351 {
3352 
3353 	if (so->so_sigio != NULL)
3354 		pgsigio(&so->so_sigio, SIGURG, 0);
3355 	selwakeuppri(&so->so_rdsel, PSOCK);
3356 }
3357 
3358 int
3359 sopoll(struct socket *so, int events, struct ucred *active_cred,
3360     struct thread *td)
3361 {
3362 
3363 	/*
3364 	 * We do not need to set or assert curvnet as long as everyone uses
3365 	 * sopoll_generic().
3366 	 */
3367 	return (so->so_proto->pr_usrreqs->pru_sopoll(so, events, active_cred,
3368 	    td));
3369 }
3370 
3371 int
3372 sopoll_generic(struct socket *so, int events, struct ucred *active_cred,
3373     struct thread *td)
3374 {
3375 	int revents;
3376 
3377 	SOCK_LOCK(so);
3378 	if (SOLISTENING(so)) {
3379 		if (!(events & (POLLIN | POLLRDNORM)))
3380 			revents = 0;
3381 		else if (!TAILQ_EMPTY(&so->sol_comp))
3382 			revents = events & (POLLIN | POLLRDNORM);
3383 		else if ((events & POLLINIGNEOF) == 0 && so->so_error)
3384 			revents = (events & (POLLIN | POLLRDNORM)) | POLLHUP;
3385 		else {
3386 			selrecord(td, &so->so_rdsel);
3387 			revents = 0;
3388 		}
3389 	} else {
3390 		revents = 0;
3391 		SOCKBUF_LOCK(&so->so_snd);
3392 		SOCKBUF_LOCK(&so->so_rcv);
3393 		if (events & (POLLIN | POLLRDNORM))
3394 			if (soreadabledata(so))
3395 				revents |= events & (POLLIN | POLLRDNORM);
3396 		if (events & (POLLOUT | POLLWRNORM))
3397 			if (sowriteable(so))
3398 				revents |= events & (POLLOUT | POLLWRNORM);
3399 		if (events & (POLLPRI | POLLRDBAND))
3400 			if (so->so_oobmark ||
3401 			    (so->so_rcv.sb_state & SBS_RCVATMARK))
3402 				revents |= events & (POLLPRI | POLLRDBAND);
3403 		if ((events & POLLINIGNEOF) == 0) {
3404 			if (so->so_rcv.sb_state & SBS_CANTRCVMORE) {
3405 				revents |= events & (POLLIN | POLLRDNORM);
3406 				if (so->so_snd.sb_state & SBS_CANTSENDMORE)
3407 					revents |= POLLHUP;
3408 			}
3409 		}
3410 		if (revents == 0) {
3411 			if (events &
3412 			    (POLLIN | POLLPRI | POLLRDNORM | POLLRDBAND)) {
3413 				selrecord(td, &so->so_rdsel);
3414 				so->so_rcv.sb_flags |= SB_SEL;
3415 			}
3416 			if (events & (POLLOUT | POLLWRNORM)) {
3417 				selrecord(td, &so->so_wrsel);
3418 				so->so_snd.sb_flags |= SB_SEL;
3419 			}
3420 		}
3421 		SOCKBUF_UNLOCK(&so->so_rcv);
3422 		SOCKBUF_UNLOCK(&so->so_snd);
3423 	}
3424 	SOCK_UNLOCK(so);
3425 	return (revents);
3426 }
3427 
3428 int
3429 soo_kqfilter(struct file *fp, struct knote *kn)
3430 {
3431 	struct socket *so = kn->kn_fp->f_data;
3432 	struct sockbuf *sb;
3433 	struct knlist *knl;
3434 
3435 	switch (kn->kn_filter) {
3436 	case EVFILT_READ:
3437 		kn->kn_fop = &soread_filtops;
3438 		knl = &so->so_rdsel.si_note;
3439 		sb = &so->so_rcv;
3440 		break;
3441 	case EVFILT_WRITE:
3442 		kn->kn_fop = &sowrite_filtops;
3443 		knl = &so->so_wrsel.si_note;
3444 		sb = &so->so_snd;
3445 		break;
3446 	case EVFILT_EMPTY:
3447 		kn->kn_fop = &soempty_filtops;
3448 		knl = &so->so_wrsel.si_note;
3449 		sb = &so->so_snd;
3450 		break;
3451 	default:
3452 		return (EINVAL);
3453 	}
3454 
3455 	SOCK_LOCK(so);
3456 	if (SOLISTENING(so)) {
3457 		knlist_add(knl, kn, 1);
3458 	} else {
3459 		SOCKBUF_LOCK(sb);
3460 		knlist_add(knl, kn, 1);
3461 		sb->sb_flags |= SB_KNOTE;
3462 		SOCKBUF_UNLOCK(sb);
3463 	}
3464 	SOCK_UNLOCK(so);
3465 	return (0);
3466 }
3467 
3468 /*
3469  * Some routines that return EOPNOTSUPP for entry points that are not
3470  * supported by a protocol.  Fill in as needed.
3471  */
3472 int
3473 pru_accept_notsupp(struct socket *so, struct sockaddr **nam)
3474 {
3475 
3476 	return EOPNOTSUPP;
3477 }
3478 
3479 int
3480 pru_aio_queue_notsupp(struct socket *so, struct kaiocb *job)
3481 {
3482 
3483 	return EOPNOTSUPP;
3484 }
3485 
3486 int
3487 pru_attach_notsupp(struct socket *so, int proto, struct thread *td)
3488 {
3489 
3490 	return EOPNOTSUPP;
3491 }
3492 
3493 int
3494 pru_bind_notsupp(struct socket *so, struct sockaddr *nam, struct thread *td)
3495 {
3496 
3497 	return EOPNOTSUPP;
3498 }
3499 
3500 int
3501 pru_bindat_notsupp(int fd, struct socket *so, struct sockaddr *nam,
3502     struct thread *td)
3503 {
3504 
3505 	return EOPNOTSUPP;
3506 }
3507 
3508 int
3509 pru_connect_notsupp(struct socket *so, struct sockaddr *nam, struct thread *td)
3510 {
3511 
3512 	return EOPNOTSUPP;
3513 }
3514 
3515 int
3516 pru_connectat_notsupp(int fd, struct socket *so, struct sockaddr *nam,
3517     struct thread *td)
3518 {
3519 
3520 	return EOPNOTSUPP;
3521 }
3522 
3523 int
3524 pru_connect2_notsupp(struct socket *so1, struct socket *so2)
3525 {
3526 
3527 	return EOPNOTSUPP;
3528 }
3529 
3530 int
3531 pru_control_notsupp(struct socket *so, u_long cmd, caddr_t data,
3532     struct ifnet *ifp, struct thread *td)
3533 {
3534 
3535 	return EOPNOTSUPP;
3536 }
3537 
3538 int
3539 pru_disconnect_notsupp(struct socket *so)
3540 {
3541 
3542 	return EOPNOTSUPP;
3543 }
3544 
3545 int
3546 pru_listen_notsupp(struct socket *so, int backlog, struct thread *td)
3547 {
3548 
3549 	return EOPNOTSUPP;
3550 }
3551 
3552 int
3553 pru_peeraddr_notsupp(struct socket *so, struct sockaddr **nam)
3554 {
3555 
3556 	return EOPNOTSUPP;
3557 }
3558 
3559 int
3560 pru_rcvd_notsupp(struct socket *so, int flags)
3561 {
3562 
3563 	return EOPNOTSUPP;
3564 }
3565 
3566 int
3567 pru_rcvoob_notsupp(struct socket *so, struct mbuf *m, int flags)
3568 {
3569 
3570 	return EOPNOTSUPP;
3571 }
3572 
3573 int
3574 pru_send_notsupp(struct socket *so, int flags, struct mbuf *m,
3575     struct sockaddr *addr, struct mbuf *control, struct thread *td)
3576 {
3577 
3578 	return EOPNOTSUPP;
3579 }
3580 
3581 int
3582 pru_ready_notsupp(struct socket *so, struct mbuf *m, int count)
3583 {
3584 
3585 	return (EOPNOTSUPP);
3586 }
3587 
3588 /*
3589  * This isn't really a ``null'' operation, but it's the default one and
3590  * doesn't do anything destructive.
3591  */
3592 int
3593 pru_sense_null(struct socket *so, struct stat *sb)
3594 {
3595 
3596 	sb->st_blksize = so->so_snd.sb_hiwat;
3597 	return 0;
3598 }
3599 
3600 int
3601 pru_shutdown_notsupp(struct socket *so)
3602 {
3603 
3604 	return EOPNOTSUPP;
3605 }
3606 
3607 int
3608 pru_sockaddr_notsupp(struct socket *so, struct sockaddr **nam)
3609 {
3610 
3611 	return EOPNOTSUPP;
3612 }
3613 
3614 int
3615 pru_sosend_notsupp(struct socket *so, struct sockaddr *addr, struct uio *uio,
3616     struct mbuf *top, struct mbuf *control, int flags, struct thread *td)
3617 {
3618 
3619 	return EOPNOTSUPP;
3620 }
3621 
3622 int
3623 pru_soreceive_notsupp(struct socket *so, struct sockaddr **paddr,
3624     struct uio *uio, struct mbuf **mp0, struct mbuf **controlp, int *flagsp)
3625 {
3626 
3627 	return EOPNOTSUPP;
3628 }
3629 
3630 int
3631 pru_sopoll_notsupp(struct socket *so, int events, struct ucred *cred,
3632     struct thread *td)
3633 {
3634 
3635 	return EOPNOTSUPP;
3636 }
3637 
3638 static void
3639 filt_sordetach(struct knote *kn)
3640 {
3641 	struct socket *so = kn->kn_fp->f_data;
3642 
3643 	so_rdknl_lock(so);
3644 	knlist_remove(&so->so_rdsel.si_note, kn, 1);
3645 	if (!SOLISTENING(so) && knlist_empty(&so->so_rdsel.si_note))
3646 		so->so_rcv.sb_flags &= ~SB_KNOTE;
3647 	so_rdknl_unlock(so);
3648 }
3649 
3650 /*ARGSUSED*/
3651 static int
3652 filt_soread(struct knote *kn, long hint)
3653 {
3654 	struct socket *so;
3655 
3656 	so = kn->kn_fp->f_data;
3657 
3658 	if (SOLISTENING(so)) {
3659 		SOCK_LOCK_ASSERT(so);
3660 		kn->kn_data = so->sol_qlen;
3661 		if (so->so_error) {
3662 			kn->kn_flags |= EV_EOF;
3663 			kn->kn_fflags = so->so_error;
3664 			return (1);
3665 		}
3666 		return (!TAILQ_EMPTY(&so->sol_comp));
3667 	}
3668 
3669 	SOCKBUF_LOCK_ASSERT(&so->so_rcv);
3670 
3671 	kn->kn_data = sbavail(&so->so_rcv) - so->so_rcv.sb_ctl;
3672 	if (so->so_rcv.sb_state & SBS_CANTRCVMORE) {
3673 		kn->kn_flags |= EV_EOF;
3674 		kn->kn_fflags = so->so_error;
3675 		return (1);
3676 	} else if (so->so_error)	/* temporary udp error */
3677 		return (1);
3678 
3679 	if (kn->kn_sfflags & NOTE_LOWAT) {
3680 		if (kn->kn_data >= kn->kn_sdata)
3681 			return (1);
3682 	} else if (sbavail(&so->so_rcv) >= so->so_rcv.sb_lowat)
3683 		return (1);
3684 
3685 	/* This hook returning non-zero indicates an event, not error */
3686 	return (hhook_run_socket(so, NULL, HHOOK_FILT_SOREAD));
3687 }
3688 
3689 static void
3690 filt_sowdetach(struct knote *kn)
3691 {
3692 	struct socket *so = kn->kn_fp->f_data;
3693 
3694 	so_wrknl_lock(so);
3695 	knlist_remove(&so->so_wrsel.si_note, kn, 1);
3696 	if (!SOLISTENING(so) && knlist_empty(&so->so_wrsel.si_note))
3697 		so->so_snd.sb_flags &= ~SB_KNOTE;
3698 	so_wrknl_unlock(so);
3699 }
3700 
3701 /*ARGSUSED*/
3702 static int
3703 filt_sowrite(struct knote *kn, long hint)
3704 {
3705 	struct socket *so;
3706 
3707 	so = kn->kn_fp->f_data;
3708 
3709 	if (SOLISTENING(so))
3710 		return (0);
3711 
3712 	SOCKBUF_LOCK_ASSERT(&so->so_snd);
3713 	kn->kn_data = sbspace(&so->so_snd);
3714 
3715 	hhook_run_socket(so, kn, HHOOK_FILT_SOWRITE);
3716 
3717 	if (so->so_snd.sb_state & SBS_CANTSENDMORE) {
3718 		kn->kn_flags |= EV_EOF;
3719 		kn->kn_fflags = so->so_error;
3720 		return (1);
3721 	} else if (so->so_error)	/* temporary udp error */
3722 		return (1);
3723 	else if (((so->so_state & SS_ISCONNECTED) == 0) &&
3724 	    (so->so_proto->pr_flags & PR_CONNREQUIRED))
3725 		return (0);
3726 	else if (kn->kn_sfflags & NOTE_LOWAT)
3727 		return (kn->kn_data >= kn->kn_sdata);
3728 	else
3729 		return (kn->kn_data >= so->so_snd.sb_lowat);
3730 }
3731 
3732 static int
3733 filt_soempty(struct knote *kn, long hint)
3734 {
3735 	struct socket *so;
3736 
3737 	so = kn->kn_fp->f_data;
3738 
3739 	if (SOLISTENING(so))
3740 		return (1);
3741 
3742 	SOCKBUF_LOCK_ASSERT(&so->so_snd);
3743 	kn->kn_data = sbused(&so->so_snd);
3744 
3745 	if (kn->kn_data == 0)
3746 		return (1);
3747 	else
3748 		return (0);
3749 }
3750 
3751 int
3752 socheckuid(struct socket *so, uid_t uid)
3753 {
3754 
3755 	if (so == NULL)
3756 		return (EPERM);
3757 	if (so->so_cred->cr_uid != uid)
3758 		return (EPERM);
3759 	return (0);
3760 }
3761 
3762 /*
3763  * These functions are used by protocols to notify the socket layer (and its
3764  * consumers) of state changes in the sockets driven by protocol-side events.
3765  */
3766 
3767 /*
3768  * Procedures to manipulate state flags of socket and do appropriate wakeups.
3769  *
3770  * Normal sequence from the active (originating) side is that
3771  * soisconnecting() is called during processing of connect() call, resulting
3772  * in an eventual call to soisconnected() if/when the connection is
3773  * established.  When the connection is torn down soisdisconnecting() is
3774  * called during processing of disconnect() call, and soisdisconnected() is
3775  * called when the connection to the peer is totally severed.  The semantics
3776  * of these routines are such that connectionless protocols can call
3777  * soisconnected() and soisdisconnected() only, bypassing the in-progress
3778  * calls when setting up a ``connection'' takes no time.
3779  *
3780  * From the passive side, a socket is created with two queues of sockets:
3781  * so_incomp for connections in progress and so_comp for connections already
3782  * made and awaiting user acceptance.  As a protocol is preparing incoming
3783  * connections, it creates a socket structure queued on so_incomp by calling
3784  * sonewconn().  When the connection is established, soisconnected() is
3785  * called, and transfers the socket structure to so_comp, making it available
3786  * to accept().
3787  *
3788  * If a socket is closed with sockets on either so_incomp or so_comp, these
3789  * sockets are dropped.
3790  *
3791  * If higher-level protocols are implemented in the kernel, the wakeups done
3792  * here will sometimes cause software-interrupt process scheduling.
3793  */
3794 void
3795 soisconnecting(struct socket *so)
3796 {
3797 
3798 	SOCK_LOCK(so);
3799 	so->so_state &= ~(SS_ISCONNECTED|SS_ISDISCONNECTING);
3800 	so->so_state |= SS_ISCONNECTING;
3801 	SOCK_UNLOCK(so);
3802 }
3803 
3804 void
3805 soisconnected(struct socket *so)
3806 {
3807 
3808 	SOCK_LOCK(so);
3809 	so->so_state &= ~(SS_ISCONNECTING|SS_ISDISCONNECTING|SS_ISCONFIRMING);
3810 	so->so_state |= SS_ISCONNECTED;
3811 
3812 	if (so->so_qstate == SQ_INCOMP) {
3813 		struct socket *head = so->so_listen;
3814 		int ret;
3815 
3816 		KASSERT(head, ("%s: so %p on incomp of NULL", __func__, so));
3817 		/*
3818 		 * Promoting a socket from incomplete queue to complete, we
3819 		 * need to go through reverse order of locking.  We first do
3820 		 * trylock, and if that doesn't succeed, we go the hard way
3821 		 * leaving a reference and rechecking consistency after proper
3822 		 * locking.
3823 		 */
3824 		if (__predict_false(SOLISTEN_TRYLOCK(head) == 0)) {
3825 			soref(head);
3826 			SOCK_UNLOCK(so);
3827 			SOLISTEN_LOCK(head);
3828 			SOCK_LOCK(so);
3829 			if (__predict_false(head != so->so_listen)) {
3830 				/*
3831 				 * The socket went off the listen queue,
3832 				 * should be lost race to close(2) of sol.
3833 				 * The socket is about to soabort().
3834 				 */
3835 				SOCK_UNLOCK(so);
3836 				sorele(head);
3837 				return;
3838 			}
3839 			/* Not the last one, as so holds a ref. */
3840 			refcount_release(&head->so_count);
3841 		}
3842 again:
3843 		if ((so->so_options & SO_ACCEPTFILTER) == 0) {
3844 			TAILQ_REMOVE(&head->sol_incomp, so, so_list);
3845 			head->sol_incqlen--;
3846 			TAILQ_INSERT_TAIL(&head->sol_comp, so, so_list);
3847 			head->sol_qlen++;
3848 			so->so_qstate = SQ_COMP;
3849 			SOCK_UNLOCK(so);
3850 			solisten_wakeup(head);	/* unlocks */
3851 		} else {
3852 			SOCKBUF_LOCK(&so->so_rcv);
3853 			soupcall_set(so, SO_RCV,
3854 			    head->sol_accept_filter->accf_callback,
3855 			    head->sol_accept_filter_arg);
3856 			so->so_options &= ~SO_ACCEPTFILTER;
3857 			ret = head->sol_accept_filter->accf_callback(so,
3858 			    head->sol_accept_filter_arg, M_NOWAIT);
3859 			if (ret == SU_ISCONNECTED) {
3860 				soupcall_clear(so, SO_RCV);
3861 				SOCKBUF_UNLOCK(&so->so_rcv);
3862 				goto again;
3863 			}
3864 			SOCKBUF_UNLOCK(&so->so_rcv);
3865 			SOCK_UNLOCK(so);
3866 			SOLISTEN_UNLOCK(head);
3867 		}
3868 		return;
3869 	}
3870 	SOCK_UNLOCK(so);
3871 	wakeup(&so->so_timeo);
3872 	sorwakeup(so);
3873 	sowwakeup(so);
3874 }
3875 
3876 void
3877 soisdisconnecting(struct socket *so)
3878 {
3879 
3880 	SOCK_LOCK(so);
3881 	so->so_state &= ~SS_ISCONNECTING;
3882 	so->so_state |= SS_ISDISCONNECTING;
3883 
3884 	if (!SOLISTENING(so)) {
3885 		SOCKBUF_LOCK(&so->so_rcv);
3886 		socantrcvmore_locked(so);
3887 		SOCKBUF_LOCK(&so->so_snd);
3888 		socantsendmore_locked(so);
3889 	}
3890 	SOCK_UNLOCK(so);
3891 	wakeup(&so->so_timeo);
3892 }
3893 
3894 void
3895 soisdisconnected(struct socket *so)
3896 {
3897 
3898 	SOCK_LOCK(so);
3899 	so->so_state &= ~(SS_ISCONNECTING|SS_ISCONNECTED|SS_ISDISCONNECTING);
3900 	so->so_state |= SS_ISDISCONNECTED;
3901 
3902 	if (!SOLISTENING(so)) {
3903 		SOCK_UNLOCK(so);
3904 		SOCKBUF_LOCK(&so->so_rcv);
3905 		socantrcvmore_locked(so);
3906 		SOCKBUF_LOCK(&so->so_snd);
3907 		sbdrop_locked(&so->so_snd, sbused(&so->so_snd));
3908 		socantsendmore_locked(so);
3909 	} else
3910 		SOCK_UNLOCK(so);
3911 	wakeup(&so->so_timeo);
3912 }
3913 
3914 /*
3915  * Make a copy of a sockaddr in a malloced buffer of type M_SONAME.
3916  */
3917 struct sockaddr *
3918 sodupsockaddr(const struct sockaddr *sa, int mflags)
3919 {
3920 	struct sockaddr *sa2;
3921 
3922 	sa2 = malloc(sa->sa_len, M_SONAME, mflags);
3923 	if (sa2)
3924 		bcopy(sa, sa2, sa->sa_len);
3925 	return sa2;
3926 }
3927 
3928 /*
3929  * Register per-socket destructor.
3930  */
3931 void
3932 sodtor_set(struct socket *so, so_dtor_t *func)
3933 {
3934 
3935 	SOCK_LOCK_ASSERT(so);
3936 	so->so_dtor = func;
3937 }
3938 
3939 /*
3940  * Register per-socket buffer upcalls.
3941  */
3942 void
3943 soupcall_set(struct socket *so, int which, so_upcall_t func, void *arg)
3944 {
3945 	struct sockbuf *sb;
3946 
3947 	KASSERT(!SOLISTENING(so), ("%s: so %p listening", __func__, so));
3948 
3949 	switch (which) {
3950 	case SO_RCV:
3951 		sb = &so->so_rcv;
3952 		break;
3953 	case SO_SND:
3954 		sb = &so->so_snd;
3955 		break;
3956 	default:
3957 		panic("soupcall_set: bad which");
3958 	}
3959 	SOCKBUF_LOCK_ASSERT(sb);
3960 	sb->sb_upcall = func;
3961 	sb->sb_upcallarg = arg;
3962 	sb->sb_flags |= SB_UPCALL;
3963 }
3964 
3965 void
3966 soupcall_clear(struct socket *so, int which)
3967 {
3968 	struct sockbuf *sb;
3969 
3970 	KASSERT(!SOLISTENING(so), ("%s: so %p listening", __func__, so));
3971 
3972 	switch (which) {
3973 	case SO_RCV:
3974 		sb = &so->so_rcv;
3975 		break;
3976 	case SO_SND:
3977 		sb = &so->so_snd;
3978 		break;
3979 	default:
3980 		panic("soupcall_clear: bad which");
3981 	}
3982 	SOCKBUF_LOCK_ASSERT(sb);
3983 	KASSERT(sb->sb_upcall != NULL,
3984 	    ("%s: so %p no upcall to clear", __func__, so));
3985 	sb->sb_upcall = NULL;
3986 	sb->sb_upcallarg = NULL;
3987 	sb->sb_flags &= ~SB_UPCALL;
3988 }
3989 
3990 void
3991 solisten_upcall_set(struct socket *so, so_upcall_t func, void *arg)
3992 {
3993 
3994 	SOLISTEN_LOCK_ASSERT(so);
3995 	so->sol_upcall = func;
3996 	so->sol_upcallarg = arg;
3997 }
3998 
3999 static void
4000 so_rdknl_lock(void *arg)
4001 {
4002 	struct socket *so = arg;
4003 
4004 	if (SOLISTENING(so))
4005 		SOCK_LOCK(so);
4006 	else
4007 		SOCKBUF_LOCK(&so->so_rcv);
4008 }
4009 
4010 static void
4011 so_rdknl_unlock(void *arg)
4012 {
4013 	struct socket *so = arg;
4014 
4015 	if (SOLISTENING(so))
4016 		SOCK_UNLOCK(so);
4017 	else
4018 		SOCKBUF_UNLOCK(&so->so_rcv);
4019 }
4020 
4021 static void
4022 so_rdknl_assert_locked(void *arg)
4023 {
4024 	struct socket *so = arg;
4025 
4026 	if (SOLISTENING(so))
4027 		SOCK_LOCK_ASSERT(so);
4028 	else
4029 		SOCKBUF_LOCK_ASSERT(&so->so_rcv);
4030 }
4031 
4032 static void
4033 so_rdknl_assert_unlocked(void *arg)
4034 {
4035 	struct socket *so = arg;
4036 
4037 	if (SOLISTENING(so))
4038 		SOCK_UNLOCK_ASSERT(so);
4039 	else
4040 		SOCKBUF_UNLOCK_ASSERT(&so->so_rcv);
4041 }
4042 
4043 static void
4044 so_wrknl_lock(void *arg)
4045 {
4046 	struct socket *so = arg;
4047 
4048 	if (SOLISTENING(so))
4049 		SOCK_LOCK(so);
4050 	else
4051 		SOCKBUF_LOCK(&so->so_snd);
4052 }
4053 
4054 static void
4055 so_wrknl_unlock(void *arg)
4056 {
4057 	struct socket *so = arg;
4058 
4059 	if (SOLISTENING(so))
4060 		SOCK_UNLOCK(so);
4061 	else
4062 		SOCKBUF_UNLOCK(&so->so_snd);
4063 }
4064 
4065 static void
4066 so_wrknl_assert_locked(void *arg)
4067 {
4068 	struct socket *so = arg;
4069 
4070 	if (SOLISTENING(so))
4071 		SOCK_LOCK_ASSERT(so);
4072 	else
4073 		SOCKBUF_LOCK_ASSERT(&so->so_snd);
4074 }
4075 
4076 static void
4077 so_wrknl_assert_unlocked(void *arg)
4078 {
4079 	struct socket *so = arg;
4080 
4081 	if (SOLISTENING(so))
4082 		SOCK_UNLOCK_ASSERT(so);
4083 	else
4084 		SOCKBUF_UNLOCK_ASSERT(&so->so_snd);
4085 }
4086 
4087 /*
4088  * Create an external-format (``xsocket'') structure using the information in
4089  * the kernel-format socket structure pointed to by so.  This is done to
4090  * reduce the spew of irrelevant information over this interface, to isolate
4091  * user code from changes in the kernel structure, and potentially to provide
4092  * information-hiding if we decide that some of this information should be
4093  * hidden from users.
4094  */
4095 void
4096 sotoxsocket(struct socket *so, struct xsocket *xso)
4097 {
4098 
4099 	bzero(xso, sizeof(*xso));
4100 	xso->xso_len = sizeof *xso;
4101 	xso->xso_so = (uintptr_t)so;
4102 	xso->so_type = so->so_type;
4103 	xso->so_options = so->so_options;
4104 	xso->so_linger = so->so_linger;
4105 	xso->so_state = so->so_state;
4106 	xso->so_pcb = (uintptr_t)so->so_pcb;
4107 	xso->xso_protocol = so->so_proto->pr_protocol;
4108 	xso->xso_family = so->so_proto->pr_domain->dom_family;
4109 	xso->so_timeo = so->so_timeo;
4110 	xso->so_error = so->so_error;
4111 	xso->so_uid = so->so_cred->cr_uid;
4112 	xso->so_pgid = so->so_sigio ? so->so_sigio->sio_pgid : 0;
4113 	if (SOLISTENING(so)) {
4114 		xso->so_qlen = so->sol_qlen;
4115 		xso->so_incqlen = so->sol_incqlen;
4116 		xso->so_qlimit = so->sol_qlimit;
4117 		xso->so_oobmark = 0;
4118 	} else {
4119 		xso->so_state |= so->so_qstate;
4120 		xso->so_qlen = xso->so_incqlen = xso->so_qlimit = 0;
4121 		xso->so_oobmark = so->so_oobmark;
4122 		sbtoxsockbuf(&so->so_snd, &xso->so_snd);
4123 		sbtoxsockbuf(&so->so_rcv, &xso->so_rcv);
4124 	}
4125 }
4126 
4127 struct sockbuf *
4128 so_sockbuf_rcv(struct socket *so)
4129 {
4130 
4131 	return (&so->so_rcv);
4132 }
4133 
4134 struct sockbuf *
4135 so_sockbuf_snd(struct socket *so)
4136 {
4137 
4138 	return (&so->so_snd);
4139 }
4140 
4141 int
4142 so_state_get(const struct socket *so)
4143 {
4144 
4145 	return (so->so_state);
4146 }
4147 
4148 void
4149 so_state_set(struct socket *so, int val)
4150 {
4151 
4152 	so->so_state = val;
4153 }
4154 
4155 int
4156 so_options_get(const struct socket *so)
4157 {
4158 
4159 	return (so->so_options);
4160 }
4161 
4162 void
4163 so_options_set(struct socket *so, int val)
4164 {
4165 
4166 	so->so_options = val;
4167 }
4168 
4169 int
4170 so_error_get(const struct socket *so)
4171 {
4172 
4173 	return (so->so_error);
4174 }
4175 
4176 void
4177 so_error_set(struct socket *so, int val)
4178 {
4179 
4180 	so->so_error = val;
4181 }
4182 
4183 int
4184 so_linger_get(const struct socket *so)
4185 {
4186 
4187 	return (so->so_linger);
4188 }
4189 
4190 void
4191 so_linger_set(struct socket *so, int val)
4192 {
4193 
4194 	KASSERT(val >= 0 && val <= USHRT_MAX && val <= (INT_MAX / hz),
4195 	    ("%s: val %d out of range", __func__, val));
4196 
4197 	so->so_linger = val;
4198 }
4199 
4200 struct protosw *
4201 so_protosw_get(const struct socket *so)
4202 {
4203 
4204 	return (so->so_proto);
4205 }
4206 
4207 void
4208 so_protosw_set(struct socket *so, struct protosw *val)
4209 {
4210 
4211 	so->so_proto = val;
4212 }
4213 
4214 void
4215 so_sorwakeup(struct socket *so)
4216 {
4217 
4218 	sorwakeup(so);
4219 }
4220 
4221 void
4222 so_sowwakeup(struct socket *so)
4223 {
4224 
4225 	sowwakeup(so);
4226 }
4227 
4228 void
4229 so_sorwakeup_locked(struct socket *so)
4230 {
4231 
4232 	sorwakeup_locked(so);
4233 }
4234 
4235 void
4236 so_sowwakeup_locked(struct socket *so)
4237 {
4238 
4239 	sowwakeup_locked(so);
4240 }
4241 
4242 void
4243 so_lock(struct socket *so)
4244 {
4245 
4246 	SOCK_LOCK(so);
4247 }
4248 
4249 void
4250 so_unlock(struct socket *so)
4251 {
4252 
4253 	SOCK_UNLOCK(so);
4254 }
4255