xref: /freebsd/sys/kern/uipc_usrreq.c (revision 60a5ef26a143350cb106f6a2bb01ac7eb933b91f)
19454b2d8SWarner Losh /*-
2df8bae1dSRodney W. Grimes  * Copyright (c) 1982, 1986, 1989, 1991, 1993
3e1ac28e2SRobert Watson  *	The Regents of the University of California.
460a5ef26SRobert Watson  * Copyright (c) 2004-2008 Robert N. M. Watson
5e1ac28e2SRobert Watson  * All rights reserved.
6df8bae1dSRodney W. Grimes  *
7df8bae1dSRodney W. Grimes  * Redistribution and use in source and binary forms, with or without
8df8bae1dSRodney W. Grimes  * modification, are permitted provided that the following conditions
9df8bae1dSRodney W. Grimes  * are met:
10df8bae1dSRodney W. Grimes  * 1. Redistributions of source code must retain the above copyright
11df8bae1dSRodney W. Grimes  *    notice, this list of conditions and the following disclaimer.
12df8bae1dSRodney W. Grimes  * 2. Redistributions in binary form must reproduce the above copyright
13df8bae1dSRodney W. Grimes  *    notice, this list of conditions and the following disclaimer in the
14df8bae1dSRodney W. Grimes  *    documentation and/or other materials provided with the distribution.
15df8bae1dSRodney W. Grimes  * 4. Neither the name of the University nor the names of its contributors
16df8bae1dSRodney W. Grimes  *    may be used to endorse or promote products derived from this software
17df8bae1dSRodney W. Grimes  *    without specific prior written permission.
18df8bae1dSRodney W. Grimes  *
19df8bae1dSRodney W. Grimes  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
20df8bae1dSRodney W. Grimes  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21df8bae1dSRodney W. Grimes  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22df8bae1dSRodney W. Grimes  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
23df8bae1dSRodney W. Grimes  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24df8bae1dSRodney W. Grimes  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25df8bae1dSRodney W. Grimes  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26df8bae1dSRodney W. Grimes  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27df8bae1dSRodney W. Grimes  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28df8bae1dSRodney W. Grimes  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29df8bae1dSRodney W. Grimes  * SUCH DAMAGE.
30df8bae1dSRodney W. Grimes  *
31748e0b0aSGarrett Wollman  *	From: @(#)uipc_usrreq.c	8.3 (Berkeley) 1/4/94
32df8bae1dSRodney W. Grimes  */
33df8bae1dSRodney W. Grimes 
34f23929fbSRobert Watson /*
35f23929fbSRobert Watson  * UNIX Domain (Local) Sockets
36f23929fbSRobert Watson  *
37f23929fbSRobert Watson  * This is an implementation of UNIX (local) domain sockets.  Each socket has
38f23929fbSRobert Watson  * an associated struct unpcb (UNIX protocol control block).  Stream sockets
39f23929fbSRobert Watson  * may be connected to 0 or 1 other socket.  Datagram sockets may be
40f23929fbSRobert Watson  * connected to 0, 1, or many other sockets.  Sockets may be created and
41f23929fbSRobert Watson  * connected in pairs (socketpair(2)), or bound/connected to using the file
42f23929fbSRobert Watson  * system name space.  For most purposes, only the receive socket buffer is
43f23929fbSRobert Watson  * used, as sending on one socket delivers directly to the receive socket
445b950deaSRobert Watson  * buffer of a second socket.
455b950deaSRobert Watson  *
465b950deaSRobert Watson  * The implementation is substantially complicated by the fact that
475b950deaSRobert Watson  * "ancillary data", such as file descriptors or credentials, may be passed
485b950deaSRobert Watson  * across UNIX domain sockets.  The potential for passing UNIX domain sockets
495b950deaSRobert Watson  * over other UNIX domain sockets requires the implementation of a simple
505b950deaSRobert Watson  * garbage collector to find and tear down cycles of disconnected sockets.
51aea52f1bSRobert Watson  *
52aea52f1bSRobert Watson  * TODO:
53aea52f1bSRobert Watson  *	SEQPACKET, RDM
54aea52f1bSRobert Watson  *	rethink name space problems
55aea52f1bSRobert Watson  *	need a proper out-of-band
56f23929fbSRobert Watson  */
57f23929fbSRobert Watson 
58677b542eSDavid E. O'Brien #include <sys/cdefs.h>
59677b542eSDavid E. O'Brien __FBSDID("$FreeBSD$");
60677b542eSDavid E. O'Brien 
6103c96c31SRobert Watson #include "opt_ddb.h"
62335654d7SRobert Watson #include "opt_mac.h"
63335654d7SRobert Watson 
64df8bae1dSRodney W. Grimes #include <sys/param.h>
65fb919e4dSMark Murray #include <sys/domain.h>
66960ed29cSSeigo Tanimura #include <sys/fcntl.h>
67d826c479SBruce Evans #include <sys/malloc.h>		/* XXX must be before <sys/file.h> */
684f590175SPaul Saab #include <sys/eventhandler.h>
69639acc13SGarrett Wollman #include <sys/file.h>
70960ed29cSSeigo Tanimura #include <sys/filedesc.h>
71960ed29cSSeigo Tanimura #include <sys/jail.h>
72960ed29cSSeigo Tanimura #include <sys/kernel.h>
73960ed29cSSeigo Tanimura #include <sys/lock.h>
74639acc13SGarrett Wollman #include <sys/mbuf.h>
75033eb86eSJeff Roberson #include <sys/mount.h>
76960ed29cSSeigo Tanimura #include <sys/mutex.h>
77639acc13SGarrett Wollman #include <sys/namei.h>
78639acc13SGarrett Wollman #include <sys/proc.h>
79df8bae1dSRodney W. Grimes #include <sys/protosw.h>
80960ed29cSSeigo Tanimura #include <sys/resourcevar.h>
81e7c33e29SRobert Watson #include <sys/rwlock.h>
82df8bae1dSRodney W. Grimes #include <sys/socket.h>
83df8bae1dSRodney W. Grimes #include <sys/socketvar.h>
84960ed29cSSeigo Tanimura #include <sys/signalvar.h>
85df8bae1dSRodney W. Grimes #include <sys/stat.h>
86960ed29cSSeigo Tanimura #include <sys/sx.h>
87639acc13SGarrett Wollman #include <sys/sysctl.h>
88960ed29cSSeigo Tanimura #include <sys/systm.h>
89a0ec558aSRobert Watson #include <sys/taskqueue.h>
90639acc13SGarrett Wollman #include <sys/un.h>
9198271db4SGarrett Wollman #include <sys/unpcb.h>
92639acc13SGarrett Wollman #include <sys/vnode.h>
93df8bae1dSRodney W. Grimes 
9403c96c31SRobert Watson #ifdef DDB
9503c96c31SRobert Watson #include <ddb/ddb.h>
9603c96c31SRobert Watson #endif
9703c96c31SRobert Watson 
98aed55708SRobert Watson #include <security/mac/mac_framework.h>
99aed55708SRobert Watson 
1009e9d298aSJeff Roberson #include <vm/uma.h>
10198271db4SGarrett Wollman 
1029e9d298aSJeff Roberson static uma_zone_t	unp_zone;
10398271db4SGarrett Wollman static unp_gen_t	unp_gencnt;
104aea52f1bSRobert Watson static u_int		unp_count;	/* Count of local sockets. */
105aea52f1bSRobert Watson static ino_t		unp_ino;	/* Prototype for fake inode numbers. */
106aea52f1bSRobert Watson static int		unp_rights;	/* File descriptors in flight. */
107aea52f1bSRobert Watson static struct unp_head	unp_shead;	/* List of local stream sockets. */
108aea52f1bSRobert Watson static struct unp_head	unp_dhead;	/* List of local datagram sockets. */
10998271db4SGarrett Wollman 
110aea52f1bSRobert Watson static const struct sockaddr	sun_noname = { sizeof(sun_noname), AF_LOCAL };
11198271db4SGarrett Wollman 
112df8bae1dSRodney W. Grimes /*
113aea52f1bSRobert Watson  * Garbage collection of cyclic file descriptor/socket references occurs
114aea52f1bSRobert Watson  * asynchronously in a taskqueue context in order to avoid recursion and
115aea52f1bSRobert Watson  * reentrance in the UNIX domain socket, file descriptor, and socket layer
116aea52f1bSRobert Watson  * code.  See unp_gc() for a full description.
117df8bae1dSRodney W. Grimes  */
118aea52f1bSRobert Watson static struct task	unp_gc_task;
119f708ef1bSPoul-Henning Kamp 
120ce5f32deSRobert Watson /*
1217e711c3aSRobert Watson  * Both send and receive buffers are allocated PIPSIZ bytes of buffering for
1227e711c3aSRobert Watson  * stream sockets, although the total for sender and receiver is actually
1237e711c3aSRobert Watson  * only PIPSIZ.
1247e711c3aSRobert Watson  *
1257e711c3aSRobert Watson  * Datagram sockets really use the sendspace as the maximum datagram size,
1267e711c3aSRobert Watson  * and don't really want to reserve the sendspace.  Their recvspace should be
1277e711c3aSRobert Watson  * large enough for at least one max-size datagram plus address.
1287e711c3aSRobert Watson  */
1297e711c3aSRobert Watson #ifndef PIPSIZ
1307e711c3aSRobert Watson #define	PIPSIZ	8192
1317e711c3aSRobert Watson #endif
1327e711c3aSRobert Watson static u_long	unpst_sendspace = PIPSIZ;
1337e711c3aSRobert Watson static u_long	unpst_recvspace = PIPSIZ;
1347e711c3aSRobert Watson static u_long	unpdg_sendspace = 2*1024;	/* really max datagram size */
1357e711c3aSRobert Watson static u_long	unpdg_recvspace = 4*1024;
1367e711c3aSRobert Watson 
137e4445a03SRobert Watson SYSCTL_NODE(_net, PF_LOCAL, local, CTLFLAG_RW, 0, "Local domain");
138e4445a03SRobert Watson SYSCTL_NODE(_net_local, SOCK_STREAM, stream, CTLFLAG_RW, 0, "SOCK_STREAM");
139e4445a03SRobert Watson SYSCTL_NODE(_net_local, SOCK_DGRAM, dgram, CTLFLAG_RW, 0, "SOCK_DGRAM");
140e4445a03SRobert Watson 
1417e711c3aSRobert Watson SYSCTL_ULONG(_net_local_stream, OID_AUTO, sendspace, CTLFLAG_RW,
142be6b1304STom Rhodes 	   &unpst_sendspace, 0, "Default stream send space.");
1437e711c3aSRobert Watson SYSCTL_ULONG(_net_local_stream, OID_AUTO, recvspace, CTLFLAG_RW,
144be6b1304STom Rhodes 	   &unpst_recvspace, 0, "Default stream receive space.");
1457e711c3aSRobert Watson SYSCTL_ULONG(_net_local_dgram, OID_AUTO, maxdgram, CTLFLAG_RW,
146be6b1304STom Rhodes 	   &unpdg_sendspace, 0, "Default datagram send space.");
1477e711c3aSRobert Watson SYSCTL_ULONG(_net_local_dgram, OID_AUTO, recvspace, CTLFLAG_RW,
148be6b1304STom Rhodes 	   &unpdg_recvspace, 0, "Default datagram receive space.");
149be6b1304STom Rhodes SYSCTL_INT(_net_local, OID_AUTO, inflight, CTLFLAG_RD, &unp_rights, 0,
150be6b1304STom Rhodes     "File descriptors in flight.");
1517e711c3aSRobert Watson 
152e7c33e29SRobert Watson /*-
153e7c33e29SRobert Watson  * Locking and synchronization:
154ce5f32deSRobert Watson  *
155e7c33e29SRobert Watson  * The global UNIX domain socket rwlock (unp_global_rwlock) protects all
156e7c33e29SRobert Watson  * global variables, including the linked lists tracking the set of allocated
157e7c33e29SRobert Watson  * UNIX domain sockets.  The global rwlock also serves to prevent deadlock
158e7c33e29SRobert Watson  * when more than one PCB lock is acquired at a time (i.e., during
159e7c33e29SRobert Watson  * connect()).  Finally, the global rwlock protects uncounted references from
160e7c33e29SRobert Watson  * vnodes to sockets bound to those vnodes: to safely dereference the
161e7c33e29SRobert Watson  * v_socket pointer, the global rwlock must be held while a full reference is
162e7c33e29SRobert Watson  * acquired.
163ce5f32deSRobert Watson  *
164e7c33e29SRobert Watson  * UNIX domain sockets each have an unpcb hung off of their so_pcb pointer,
165e7c33e29SRobert Watson  * allocated in pru_attach() and freed in pru_detach().  The validity of that
166e7c33e29SRobert Watson  * pointer is an invariant, so no lock is required to dereference the so_pcb
167e7c33e29SRobert Watson  * pointer if a valid socket reference is held by the caller.  In practice,
168e7c33e29SRobert Watson  * this is always true during operations performed on a socket.  Each unpcb
169e7c33e29SRobert Watson  * has a back-pointer to its socket, unp_socket, which will be stable under
170e7c33e29SRobert Watson  * the same circumstances.
171e7c33e29SRobert Watson  *
172e7c33e29SRobert Watson  * This pointer may only be safely dereferenced as long as a valid reference
173e7c33e29SRobert Watson  * to the unpcb is held.  Typically, this reference will be from the socket,
174e7c33e29SRobert Watson  * or from another unpcb when the referring unpcb's lock is held (in order
175e7c33e29SRobert Watson  * that the reference not be invalidated during use).  For example, to follow
176e7c33e29SRobert Watson  * unp->unp_conn->unp_socket, you need unlock the lock on unp, not unp_conn,
177e7c33e29SRobert Watson  * as unp_socket remains valid as long as the reference to unp_conn is valid.
178e7c33e29SRobert Watson  *
179e7c33e29SRobert Watson  * Fields of unpcbss are locked using a per-unpcb lock, unp_mtx.  Individual
180e7c33e29SRobert Watson  * atomic reads without the lock may be performed "lockless", but more
181e7c33e29SRobert Watson  * complex reads and read-modify-writes require the mutex to be held.  No
182e7c33e29SRobert Watson  * lock order is defined between unpcb locks -- multiple unpcb locks may be
183e7c33e29SRobert Watson  * acquired at the same time only when holding the global UNIX domain socket
184e7c33e29SRobert Watson  * rwlock exclusively, which prevents deadlocks.
185e7c33e29SRobert Watson  *
186e7c33e29SRobert Watson  * Blocking with UNIX domain sockets is a tricky issue: unlike most network
187e7c33e29SRobert Watson  * protocols, bind() is a non-atomic operation, and connect() requires
188e7c33e29SRobert Watson  * potential sleeping in the protocol, due to potentially waiting on local or
189e7c33e29SRobert Watson  * distributed file systems.  We try to separate "lookup" operations, which
190e7c33e29SRobert Watson  * may sleep, and the IPC operations themselves, which typically can occur
191e7c33e29SRobert Watson  * with relative atomicity as locks can be held over the entire operation.
192e7c33e29SRobert Watson  *
193e7c33e29SRobert Watson  * Another tricky issue is simultaneous multi-threaded or multi-process
194e7c33e29SRobert Watson  * access to a single UNIX domain socket.  These are handled by the flags
195e7c33e29SRobert Watson  * UNP_CONNECTING and UNP_BINDING, which prevent concurrent connecting or
196e7c33e29SRobert Watson  * binding, both of which involve dropping UNIX domain socket locks in order
197e7c33e29SRobert Watson  * to perform namei() and other file system operations.
198ce5f32deSRobert Watson  */
199e7c33e29SRobert Watson static struct rwlock	unp_global_rwlock;
200e7c33e29SRobert Watson 
201e7c33e29SRobert Watson #define	UNP_GLOBAL_LOCK_INIT()		rw_init(&unp_global_rwlock,	\
202e7c33e29SRobert Watson 					    "unp_global_rwlock")
203e7c33e29SRobert Watson 
204e7c33e29SRobert Watson #define	UNP_GLOBAL_LOCK_ASSERT()	rw_assert(&unp_global_rwlock,	\
205e7c33e29SRobert Watson 					    RA_LOCKED)
206e7c33e29SRobert Watson #define	UNP_GLOBAL_UNLOCK_ASSERT()	rw_assert(&unp_global_rwlock,	\
207e7c33e29SRobert Watson 					    RA_UNLOCKED)
208e7c33e29SRobert Watson 
209e7c33e29SRobert Watson #define	UNP_GLOBAL_WLOCK()		rw_wlock(&unp_global_rwlock)
210e7c33e29SRobert Watson #define	UNP_GLOBAL_WUNLOCK()		rw_wunlock(&unp_global_rwlock)
211e7c33e29SRobert Watson #define	UNP_GLOBAL_WLOCK_ASSERT()	rw_assert(&unp_global_rwlock,	\
212e7c33e29SRobert Watson 					    RA_WLOCKED)
213e7c33e29SRobert Watson #define	UNP_GLOBAL_WOWNED()		rw_wowned(&unp_global_rwlock)
214e7c33e29SRobert Watson 
215e7c33e29SRobert Watson #define	UNP_GLOBAL_RLOCK()		rw_rlock(&unp_global_rwlock)
216e7c33e29SRobert Watson #define	UNP_GLOBAL_RUNLOCK()		rw_runlock(&unp_global_rwlock)
217e7c33e29SRobert Watson #define	UNP_GLOBAL_RLOCK_ASSERT()	rw_assert(&unp_global_rwlock,	\
218e7c33e29SRobert Watson 					    RA_RLOCKED)
219e7c33e29SRobert Watson 
220e7c33e29SRobert Watson #define UNP_PCB_LOCK_INIT(unp)		mtx_init(&(unp)->unp_mtx,	\
221e7c33e29SRobert Watson 					    "unp_mtx", "unp_mtx",	\
222e7c33e29SRobert Watson 					    MTX_DUPOK|MTX_DEF|MTX_RECURSE)
223e7c33e29SRobert Watson #define	UNP_PCB_LOCK_DESTROY(unp)	mtx_destroy(&(unp)->unp_mtx)
224e7c33e29SRobert Watson #define	UNP_PCB_LOCK(unp)		mtx_lock(&(unp)->unp_mtx)
225e7c33e29SRobert Watson #define	UNP_PCB_UNLOCK(unp)		mtx_unlock(&(unp)->unp_mtx)
226e7c33e29SRobert Watson #define	UNP_PCB_LOCK_ASSERT(unp)	mtx_assert(&(unp)->unp_mtx, MA_OWNED)
2270d9ce3a1SRobert Watson 
228aea52f1bSRobert Watson static int	unp_connect(struct socket *, struct sockaddr *,
229aea52f1bSRobert Watson 		    struct thread *);
2306a2989fdSMatthew N. Dodd static int	unp_connect2(struct socket *so, struct socket *so2, int);
231e7c33e29SRobert Watson static void	unp_disconnect(struct unpcb *unp, struct unpcb *unp2);
2324d77a549SAlfred Perlstein static void	unp_shutdown(struct unpcb *);
2334d77a549SAlfred Perlstein static void	unp_drop(struct unpcb *, int);
234a0ec558aSRobert Watson static void	unp_gc(__unused void *, int);
2354d77a549SAlfred Perlstein static void	unp_scan(struct mbuf *, void (*)(struct file *));
2364d77a549SAlfred Perlstein static void	unp_discard(struct file *);
2374d77a549SAlfred Perlstein static void	unp_freerights(struct file **, int);
2384d77a549SAlfred Perlstein static int	unp_internalize(struct mbuf **, struct thread *);
239397c19d1SJeff Roberson static void	unp_internalize_fp(struct file *);
240397c19d1SJeff Roberson static void	unp_externalize_fp(struct file *);
2415b950deaSRobert Watson static struct mbuf	*unp_addsockcred(struct thread *, struct mbuf *);
242f708ef1bSPoul-Henning Kamp 
243e4445a03SRobert Watson /*
244e4445a03SRobert Watson  * Definitions of protocols supported in the LOCAL domain.
245e4445a03SRobert Watson  */
246e4445a03SRobert Watson static struct domain localdomain;
247e4445a03SRobert Watson static struct protosw localsw[] = {
248e4445a03SRobert Watson {
249e4445a03SRobert Watson 	.pr_type =		SOCK_STREAM,
250e4445a03SRobert Watson 	.pr_domain =		&localdomain,
251e4445a03SRobert Watson 	.pr_flags =		PR_CONNREQUIRED|PR_WANTRCVD|PR_RIGHTS,
252e4445a03SRobert Watson 	.pr_ctloutput =		&uipc_ctloutput,
253e4445a03SRobert Watson 	.pr_usrreqs =		&uipc_usrreqs
254e4445a03SRobert Watson },
255e4445a03SRobert Watson {
256e4445a03SRobert Watson 	.pr_type =		SOCK_DGRAM,
257e4445a03SRobert Watson 	.pr_domain =		&localdomain,
258e4445a03SRobert Watson 	.pr_flags =		PR_ATOMIC|PR_ADDR|PR_RIGHTS,
259e4445a03SRobert Watson 	.pr_usrreqs =		&uipc_usrreqs
260e4445a03SRobert Watson },
261e4445a03SRobert Watson };
262e4445a03SRobert Watson 
263e4445a03SRobert Watson static struct domain localdomain = {
264e4445a03SRobert Watson 	.dom_family =		AF_LOCAL,
265e4445a03SRobert Watson 	.dom_name =		"local",
266e4445a03SRobert Watson 	.dom_init =		unp_init,
267e4445a03SRobert Watson 	.dom_externalize =	unp_externalize,
268e4445a03SRobert Watson 	.dom_dispose =		unp_dispose,
269e4445a03SRobert Watson 	.dom_protosw =		localsw,
270e4445a03SRobert Watson 	.dom_protoswNPROTOSW =	&localsw[sizeof(localsw)/sizeof(localsw[0])]
271e4445a03SRobert Watson };
272e4445a03SRobert Watson DOMAIN_SET(local);
273e4445a03SRobert Watson 
274ac45e92fSRobert Watson static void
275a29f300eSGarrett Wollman uipc_abort(struct socket *so)
276df8bae1dSRodney W. Grimes {
277e7c33e29SRobert Watson 	struct unpcb *unp, *unp2;
278df8bae1dSRodney W. Grimes 
27940f2ac28SRobert Watson 	unp = sotounpcb(so);
2804d4b555eSRobert Watson 	KASSERT(unp != NULL, ("uipc_abort: unp == NULL"));
281e7c33e29SRobert Watson 
282e7c33e29SRobert Watson 	UNP_GLOBAL_WLOCK();
283e7c33e29SRobert Watson 	UNP_PCB_LOCK(unp);
284e7c33e29SRobert Watson 	unp2 = unp->unp_conn;
285e7c33e29SRobert Watson 	if (unp2 != NULL) {
286e7c33e29SRobert Watson 		UNP_PCB_LOCK(unp2);
287e7c33e29SRobert Watson 		unp_drop(unp2, ECONNABORTED);
288e7c33e29SRobert Watson 		UNP_PCB_UNLOCK(unp2);
289e7c33e29SRobert Watson 	}
290e7c33e29SRobert Watson 	UNP_PCB_UNLOCK(unp);
291e7c33e29SRobert Watson 	UNP_GLOBAL_WUNLOCK();
292df8bae1dSRodney W. Grimes }
293df8bae1dSRodney W. Grimes 
294a29f300eSGarrett Wollman static int
29557bf258eSGarrett Wollman uipc_accept(struct socket *so, struct sockaddr **nam)
296a29f300eSGarrett Wollman {
297e7c33e29SRobert Watson 	struct unpcb *unp, *unp2;
2980d9ce3a1SRobert Watson 	const struct sockaddr *sa;
299df8bae1dSRodney W. Grimes 
300df8bae1dSRodney W. Grimes 	/*
3011c381b19SRobert Watson 	 * Pass back name of connected socket, if it was bound and we are
3021c381b19SRobert Watson 	 * still connected (our peer may have closed already!).
303df8bae1dSRodney W. Grimes 	 */
3044d4b555eSRobert Watson 	unp = sotounpcb(so);
3054d4b555eSRobert Watson 	KASSERT(unp != NULL, ("uipc_accept: unp == NULL"));
306e7c33e29SRobert Watson 
3070d9ce3a1SRobert Watson 	*nam = malloc(sizeof(struct sockaddr_un), M_SONAME, M_WAITOK);
308e7c33e29SRobert Watson 	UNP_GLOBAL_RLOCK();
309e7c33e29SRobert Watson 	unp2 = unp->unp_conn;
310e7c33e29SRobert Watson 	if (unp2 != NULL && unp2->unp_addr != NULL) {
311e7c33e29SRobert Watson 		UNP_PCB_LOCK(unp2);
312e7c33e29SRobert Watson 		sa = (struct sockaddr *) unp2->unp_addr;
313e7c33e29SRobert Watson 		bcopy(sa, *nam, sa->sa_len);
314e7c33e29SRobert Watson 		UNP_PCB_UNLOCK(unp2);
315e7c33e29SRobert Watson 	} else {
3160d9ce3a1SRobert Watson 		sa = &sun_noname;
3170d9ce3a1SRobert Watson 		bcopy(sa, *nam, sa->sa_len);
318e7c33e29SRobert Watson 	}
319e7c33e29SRobert Watson 	UNP_GLOBAL_RUNLOCK();
320e5aeaa0cSDag-Erling Smørgrav 	return (0);
321a29f300eSGarrett Wollman }
322df8bae1dSRodney W. Grimes 
323a29f300eSGarrett Wollman static int
324b40ce416SJulian Elischer uipc_attach(struct socket *so, int proto, struct thread *td)
325a29f300eSGarrett Wollman {
326e7c33e29SRobert Watson 	u_long sendspace, recvspace;
3276d32873cSRobert Watson 	struct unpcb *unp;
328e7c33e29SRobert Watson 	int error, locked;
329df8bae1dSRodney W. Grimes 
3306d32873cSRobert Watson 	KASSERT(so->so_pcb == NULL, ("uipc_attach: so_pcb != NULL"));
3316d32873cSRobert Watson 	if (so->so_snd.sb_hiwat == 0 || so->so_rcv.sb_hiwat == 0) {
3326d32873cSRobert Watson 		switch (so->so_type) {
3336d32873cSRobert Watson 		case SOCK_STREAM:
334e7c33e29SRobert Watson 			sendspace = unpst_sendspace;
335e7c33e29SRobert Watson 			recvspace = unpst_recvspace;
3366d32873cSRobert Watson 			break;
3376d32873cSRobert Watson 
3386d32873cSRobert Watson 		case SOCK_DGRAM:
339e7c33e29SRobert Watson 			sendspace = unpdg_sendspace;
340e7c33e29SRobert Watson 			recvspace = unpdg_recvspace;
3416d32873cSRobert Watson 			break;
3426d32873cSRobert Watson 
3436d32873cSRobert Watson 		default:
344e7c33e29SRobert Watson 			panic("uipc_attach");
3456d32873cSRobert Watson 		}
346e7c33e29SRobert Watson 		error = soreserve(so, sendspace, recvspace);
3476d32873cSRobert Watson 		if (error)
3486d32873cSRobert Watson 			return (error);
3496d32873cSRobert Watson 	}
35046a1d9bfSRobert Watson 	unp = uma_zalloc(unp_zone, M_NOWAIT | M_ZERO);
3516d32873cSRobert Watson 	if (unp == NULL)
3526d32873cSRobert Watson 		return (ENOBUFS);
3536d32873cSRobert Watson 	LIST_INIT(&unp->unp_refs);
354e7c33e29SRobert Watson 	UNP_PCB_LOCK_INIT(unp);
3556d32873cSRobert Watson 	unp->unp_socket = so;
3566d32873cSRobert Watson 	so->so_pcb = unp;
3579ae328fcSJohn Baldwin 	unp->unp_refcount = 1;
358e7c33e29SRobert Watson 
359e7c33e29SRobert Watson 	/*
360e7c33e29SRobert Watson 	 * uipc_attach() may be called indirectly from within the UNIX domain
361e7c33e29SRobert Watson 	 * socket code via sonewconn() in unp_connect().  Since rwlocks can
362e7c33e29SRobert Watson 	 * not be recursed, we do the closest thing.
363e7c33e29SRobert Watson 	 */
364d7924b70SRobert Watson 	locked = 0;
365e7c33e29SRobert Watson 	if (!UNP_GLOBAL_WOWNED()) {
366e7c33e29SRobert Watson 		UNP_GLOBAL_WLOCK();
367e7c33e29SRobert Watson 		locked = 1;
368e7c33e29SRobert Watson 	}
3696d32873cSRobert Watson 	unp->unp_gencnt = ++unp_gencnt;
3706d32873cSRobert Watson 	unp_count++;
371b7e2f3ecSRobert Watson 	LIST_INSERT_HEAD(so->so_type == SOCK_DGRAM ? &unp_dhead : &unp_shead,
372b7e2f3ecSRobert Watson 	    unp, unp_link);
373e7c33e29SRobert Watson 	if (locked)
374e7c33e29SRobert Watson 		UNP_GLOBAL_WUNLOCK();
3756d32873cSRobert Watson 
3766d32873cSRobert Watson 	return (0);
377a29f300eSGarrett Wollman }
378a29f300eSGarrett Wollman 
379a29f300eSGarrett Wollman static int
380b40ce416SJulian Elischer uipc_bind(struct socket *so, struct sockaddr *nam, struct thread *td)
381a29f300eSGarrett Wollman {
382dd47f5caSRobert Watson 	struct sockaddr_un *soun = (struct sockaddr_un *)nam;
383dd47f5caSRobert Watson 	struct vattr vattr;
3849e289446SWojciech A. Koszek 	int error, namelen, vfslocked;
385dd47f5caSRobert Watson 	struct nameidata nd;
38640f2ac28SRobert Watson 	struct unpcb *unp;
387dd47f5caSRobert Watson 	struct vnode *vp;
388dd47f5caSRobert Watson 	struct mount *mp;
389dd47f5caSRobert Watson 	char *buf;
390a29f300eSGarrett Wollman 
39140f2ac28SRobert Watson 	unp = sotounpcb(so);
3924d4b555eSRobert Watson 	KASSERT(unp != NULL, ("uipc_bind: unp == NULL"));
3934f1f0ef5SRobert Watson 
3944f1f0ef5SRobert Watson 	namelen = soun->sun_len - offsetof(struct sockaddr_un, sun_path);
3954f1f0ef5SRobert Watson 	if (namelen <= 0)
3964f1f0ef5SRobert Watson 		return (EINVAL);
397dd47f5caSRobert Watson 
398dd47f5caSRobert Watson 	/*
3994f1f0ef5SRobert Watson 	 * We don't allow simultaneous bind() calls on a single UNIX domain
4004f1f0ef5SRobert Watson 	 * socket, so flag in-progress operations, and return an error if an
4014f1f0ef5SRobert Watson 	 * operation is already in progress.
4024f1f0ef5SRobert Watson 	 *
4034f1f0ef5SRobert Watson 	 * Historically, we have not allowed a socket to be rebound, so this
404d7924b70SRobert Watson 	 * also returns an error.  Not allowing re-binding simplifies the
405d7924b70SRobert Watson 	 * implementation and avoids a great many possible failure modes.
406dd47f5caSRobert Watson 	 */
407e7c33e29SRobert Watson 	UNP_PCB_LOCK(unp);
408dd47f5caSRobert Watson 	if (unp->unp_vnode != NULL) {
409e7c33e29SRobert Watson 		UNP_PCB_UNLOCK(unp);
410dd47f5caSRobert Watson 		return (EINVAL);
411dd47f5caSRobert Watson 	}
4124f1f0ef5SRobert Watson 	if (unp->unp_flags & UNP_BINDING) {
413e7c33e29SRobert Watson 		UNP_PCB_UNLOCK(unp);
4144f1f0ef5SRobert Watson 		return (EALREADY);
415dd47f5caSRobert Watson 	}
4164f1f0ef5SRobert Watson 	unp->unp_flags |= UNP_BINDING;
417e7c33e29SRobert Watson 	UNP_PCB_UNLOCK(unp);
418dd47f5caSRobert Watson 
419dd47f5caSRobert Watson 	buf = malloc(namelen + 1, M_TEMP, M_WAITOK);
4207928893dSEd Maste 	bcopy(soun->sun_path, buf, namelen);
4217928893dSEd Maste 	buf[namelen] = 0;
422dd47f5caSRobert Watson 
423dd47f5caSRobert Watson restart:
4249e289446SWojciech A. Koszek 	vfslocked = 0;
4259e289446SWojciech A. Koszek 	NDINIT(&nd, CREATE, MPSAFE | NOFOLLOW | LOCKPARENT | SAVENAME,
4269e289446SWojciech A. Koszek 	    UIO_SYSSPACE, buf, td);
427dd47f5caSRobert Watson /* SHOULD BE ABLE TO ADOPT EXISTING AND wakeup() ALA FIFO's */
428dd47f5caSRobert Watson 	error = namei(&nd);
429dd47f5caSRobert Watson 	if (error)
4304f1f0ef5SRobert Watson 		goto error;
431dd47f5caSRobert Watson 	vp = nd.ni_vp;
4329e289446SWojciech A. Koszek 	vfslocked = NDHASGIANT(&nd);
433dd47f5caSRobert Watson 	if (vp != NULL || vn_start_write(nd.ni_dvp, &mp, V_NOWAIT) != 0) {
434dd47f5caSRobert Watson 		NDFREE(&nd, NDF_ONLY_PNBUF);
435dd47f5caSRobert Watson 		if (nd.ni_dvp == vp)
436dd47f5caSRobert Watson 			vrele(nd.ni_dvp);
437dd47f5caSRobert Watson 		else
438dd47f5caSRobert Watson 			vput(nd.ni_dvp);
439dd47f5caSRobert Watson 		if (vp != NULL) {
440dd47f5caSRobert Watson 			vrele(vp);
441dd47f5caSRobert Watson 			error = EADDRINUSE;
4424f1f0ef5SRobert Watson 			goto error;
443dd47f5caSRobert Watson 		}
444dd47f5caSRobert Watson 		error = vn_start_write(NULL, &mp, V_XSLEEP | PCATCH);
445dd47f5caSRobert Watson 		if (error)
4464f1f0ef5SRobert Watson 			goto error;
4479e289446SWojciech A. Koszek 		VFS_UNLOCK_GIANT(vfslocked);
448dd47f5caSRobert Watson 		goto restart;
449dd47f5caSRobert Watson 	}
450dd47f5caSRobert Watson 	VATTR_NULL(&vattr);
451dd47f5caSRobert Watson 	vattr.va_type = VSOCK;
452dd47f5caSRobert Watson 	vattr.va_mode = (ACCESSPERMS & ~td->td_proc->p_fd->fd_cmask);
453dd47f5caSRobert Watson #ifdef MAC
45430d239bcSRobert Watson 	error = mac_vnode_check_create(td->td_ucred, nd.ni_dvp, &nd.ni_cnd,
455dd47f5caSRobert Watson 	    &vattr);
456dd47f5caSRobert Watson #endif
457dd47f5caSRobert Watson 	if (error == 0) {
458dd47f5caSRobert Watson 		VOP_LEASE(nd.ni_dvp, td, td->td_ucred, LEASE_WRITE);
459dd47f5caSRobert Watson 		error = VOP_CREATE(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd, &vattr);
460dd47f5caSRobert Watson 	}
461dd47f5caSRobert Watson 	NDFREE(&nd, NDF_ONLY_PNBUF);
462dd47f5caSRobert Watson 	vput(nd.ni_dvp);
463dd47f5caSRobert Watson 	if (error) {
464dd47f5caSRobert Watson 		vn_finished_write(mp);
4654f1f0ef5SRobert Watson 		goto error;
466dd47f5caSRobert Watson 	}
467dd47f5caSRobert Watson 	vp = nd.ni_vp;
46857fd3d55SPawel Jakub Dawidek 	ASSERT_VOP_ELOCKED(vp, "uipc_bind");
469dd47f5caSRobert Watson 	soun = (struct sockaddr_un *)sodupsockaddr(nam, M_WAITOK);
470e7c33e29SRobert Watson 
471e7c33e29SRobert Watson 	UNP_GLOBAL_WLOCK();
472e7c33e29SRobert Watson 	UNP_PCB_LOCK(unp);
473dd47f5caSRobert Watson 	vp->v_socket = unp->unp_socket;
474dd47f5caSRobert Watson 	unp->unp_vnode = vp;
475dd47f5caSRobert Watson 	unp->unp_addr = soun;
4764f1f0ef5SRobert Watson 	unp->unp_flags &= ~UNP_BINDING;
477e7c33e29SRobert Watson 	UNP_PCB_UNLOCK(unp);
478e7c33e29SRobert Watson 	UNP_GLOBAL_WUNLOCK();
47922db15c0SAttilio Rao 	VOP_UNLOCK(vp, 0);
480dd47f5caSRobert Watson 	vn_finished_write(mp);
4819e289446SWojciech A. Koszek 	VFS_UNLOCK_GIANT(vfslocked);
4824f1f0ef5SRobert Watson 	free(buf, M_TEMP);
4834f1f0ef5SRobert Watson 	return (0);
484e7c33e29SRobert Watson 
4854f1f0ef5SRobert Watson error:
4869e289446SWojciech A. Koszek 	VFS_UNLOCK_GIANT(vfslocked);
487e7c33e29SRobert Watson 	UNP_PCB_LOCK(unp);
4884f1f0ef5SRobert Watson 	unp->unp_flags &= ~UNP_BINDING;
489e7c33e29SRobert Watson 	UNP_PCB_UNLOCK(unp);
490dd47f5caSRobert Watson 	free(buf, M_TEMP);
49140f2ac28SRobert Watson 	return (error);
492a29f300eSGarrett Wollman }
493a29f300eSGarrett Wollman 
494a29f300eSGarrett Wollman static int
495b40ce416SJulian Elischer uipc_connect(struct socket *so, struct sockaddr *nam, struct thread *td)
496a29f300eSGarrett Wollman {
4970d9ce3a1SRobert Watson 	int error;
498a29f300eSGarrett Wollman 
499fd179ee9SRobert Watson 	KASSERT(td == curthread, ("uipc_connect: td != curthread"));
500e7c33e29SRobert Watson 	UNP_GLOBAL_WLOCK();
501fd179ee9SRobert Watson 	error = unp_connect(so, nam, td);
502e7c33e29SRobert Watson 	UNP_GLOBAL_WUNLOCK();
5030d9ce3a1SRobert Watson 	return (error);
504a29f300eSGarrett Wollman }
505a29f300eSGarrett Wollman 
506a152f8a3SRobert Watson static void
507a152f8a3SRobert Watson uipc_close(struct socket *so)
508a152f8a3SRobert Watson {
509e7c33e29SRobert Watson 	struct unpcb *unp, *unp2;
510a152f8a3SRobert Watson 
511a152f8a3SRobert Watson 	unp = sotounpcb(so);
512a152f8a3SRobert Watson 	KASSERT(unp != NULL, ("uipc_close: unp == NULL"));
513e7c33e29SRobert Watson 
514e7c33e29SRobert Watson 	UNP_GLOBAL_WLOCK();
515e7c33e29SRobert Watson 	UNP_PCB_LOCK(unp);
516e7c33e29SRobert Watson 	unp2 = unp->unp_conn;
517e7c33e29SRobert Watson 	if (unp2 != NULL) {
518e7c33e29SRobert Watson 		UNP_PCB_LOCK(unp2);
519e7c33e29SRobert Watson 		unp_disconnect(unp, unp2);
520e7c33e29SRobert Watson 		UNP_PCB_UNLOCK(unp2);
521e7c33e29SRobert Watson 	}
522e7c33e29SRobert Watson 	UNP_PCB_UNLOCK(unp);
523e7c33e29SRobert Watson 	UNP_GLOBAL_WUNLOCK();
524a152f8a3SRobert Watson }
525a152f8a3SRobert Watson 
526db48c0d2SRobert Watson int
527a29f300eSGarrett Wollman uipc_connect2(struct socket *so1, struct socket *so2)
528a29f300eSGarrett Wollman {
529e7c33e29SRobert Watson 	struct unpcb *unp, *unp2;
5300d9ce3a1SRobert Watson 	int error;
531a29f300eSGarrett Wollman 
532e7c33e29SRobert Watson 	UNP_GLOBAL_WLOCK();
533e7c33e29SRobert Watson 	unp = so1->so_pcb;
5344d4b555eSRobert Watson 	KASSERT(unp != NULL, ("uipc_connect2: unp == NULL"));
535e7c33e29SRobert Watson 	UNP_PCB_LOCK(unp);
536e7c33e29SRobert Watson 	unp2 = so2->so_pcb;
537e7c33e29SRobert Watson 	KASSERT(unp2 != NULL, ("uipc_connect2: unp2 == NULL"));
538e7c33e29SRobert Watson 	UNP_PCB_LOCK(unp2);
5396a2989fdSMatthew N. Dodd 	error = unp_connect2(so1, so2, PRU_CONNECT2);
540e7c33e29SRobert Watson 	UNP_PCB_UNLOCK(unp2);
541e7c33e29SRobert Watson 	UNP_PCB_UNLOCK(unp);
542e7c33e29SRobert Watson 	UNP_GLOBAL_WUNLOCK();
5430d9ce3a1SRobert Watson 	return (error);
544a29f300eSGarrett Wollman }
545a29f300eSGarrett Wollman 
546a29f300eSGarrett Wollman /* control is EOPNOTSUPP */
547a29f300eSGarrett Wollman 
548bc725eafSRobert Watson static void
549a29f300eSGarrett Wollman uipc_detach(struct socket *so)
550a29f300eSGarrett Wollman {
551e7c33e29SRobert Watson 	struct unpcb *unp, *unp2;
5529ae328fcSJohn Baldwin 	struct sockaddr_un *saved_unp_addr;
5536d32873cSRobert Watson 	struct vnode *vp;
5549ae328fcSJohn Baldwin 	int freeunp, local_unp_rights;
555a29f300eSGarrett Wollman 
55640f2ac28SRobert Watson 	unp = sotounpcb(so);
5574d4b555eSRobert Watson 	KASSERT(unp != NULL, ("uipc_detach: unp == NULL"));
558e7c33e29SRobert Watson 
559e7c33e29SRobert Watson 	UNP_GLOBAL_WLOCK();
560e7c33e29SRobert Watson 	UNP_PCB_LOCK(unp);
561e7c33e29SRobert Watson 
5626d32873cSRobert Watson 	LIST_REMOVE(unp, unp_link);
5636d32873cSRobert Watson 	unp->unp_gencnt = ++unp_gencnt;
5646d32873cSRobert Watson 	--unp_count;
565e7c33e29SRobert Watson 
566e7c33e29SRobert Watson 	/*
567e7c33e29SRobert Watson 	 * XXXRW: Should assert vp->v_socket == so.
568e7c33e29SRobert Watson 	 */
5696d32873cSRobert Watson 	if ((vp = unp->unp_vnode) != NULL) {
5706d32873cSRobert Watson 		unp->unp_vnode->v_socket = NULL;
5716d32873cSRobert Watson 		unp->unp_vnode = NULL;
5726d32873cSRobert Watson 	}
573e7c33e29SRobert Watson 	unp2 = unp->unp_conn;
574e7c33e29SRobert Watson 	if (unp2 != NULL) {
575e7c33e29SRobert Watson 		UNP_PCB_LOCK(unp2);
576e7c33e29SRobert Watson 		unp_disconnect(unp, unp2);
577e7c33e29SRobert Watson 		UNP_PCB_UNLOCK(unp2);
578e7c33e29SRobert Watson 	}
579e7c33e29SRobert Watson 
580e7c33e29SRobert Watson 	/*
58160a5ef26SRobert Watson 	 * We hold the global lock exclusively, so it's OK to acquire
58260a5ef26SRobert Watson 	 * multiple pcb locks at a time.
583e7c33e29SRobert Watson 	 */
5846d32873cSRobert Watson 	while (!LIST_EMPTY(&unp->unp_refs)) {
5856d32873cSRobert Watson 		struct unpcb *ref = LIST_FIRST(&unp->unp_refs);
586e7c33e29SRobert Watson 
587e7c33e29SRobert Watson 		UNP_PCB_LOCK(ref);
5886d32873cSRobert Watson 		unp_drop(ref, ECONNRESET);
589e7c33e29SRobert Watson 		UNP_PCB_UNLOCK(ref);
5906d32873cSRobert Watson 	}
591397c19d1SJeff Roberson 	local_unp_rights = unp_rights;
592e7c33e29SRobert Watson 	UNP_GLOBAL_WUNLOCK();
5936d32873cSRobert Watson 	unp->unp_socket->so_pcb = NULL;
5949ae328fcSJohn Baldwin 	saved_unp_addr = unp->unp_addr;
5959ae328fcSJohn Baldwin 	unp->unp_addr = NULL;
5969ae328fcSJohn Baldwin 	unp->unp_refcount--;
5979ae328fcSJohn Baldwin 	freeunp = (unp->unp_refcount == 0);
5989ae328fcSJohn Baldwin 	if (saved_unp_addr != NULL)
5999ae328fcSJohn Baldwin 		FREE(saved_unp_addr, M_SONAME);
600e7c33e29SRobert Watson 	if (freeunp) {
601e7c33e29SRobert Watson 		UNP_PCB_LOCK_DESTROY(unp);
6026d32873cSRobert Watson 		uma_zfree(unp_zone, unp);
6036e2faa24SRobert Watson 	} else
6046e2faa24SRobert Watson 		UNP_PCB_UNLOCK(unp);
6056d32873cSRobert Watson 	if (vp) {
6066d32873cSRobert Watson 		int vfslocked;
6076d32873cSRobert Watson 
6086d32873cSRobert Watson 		vfslocked = VFS_LOCK_GIANT(vp->v_mount);
6096d32873cSRobert Watson 		vrele(vp);
6106d32873cSRobert Watson 		VFS_UNLOCK_GIANT(vfslocked);
6116d32873cSRobert Watson 	}
6126d32873cSRobert Watson 	if (local_unp_rights)
6136d32873cSRobert Watson 		taskqueue_enqueue(taskqueue_thread, &unp_gc_task);
614a29f300eSGarrett Wollman }
615a29f300eSGarrett Wollman 
616a29f300eSGarrett Wollman static int
617a29f300eSGarrett Wollman uipc_disconnect(struct socket *so)
618a29f300eSGarrett Wollman {
619e7c33e29SRobert Watson 	struct unpcb *unp, *unp2;
620a29f300eSGarrett Wollman 
62140f2ac28SRobert Watson 	unp = sotounpcb(so);
6224d4b555eSRobert Watson 	KASSERT(unp != NULL, ("uipc_disconnect: unp == NULL"));
623e7c33e29SRobert Watson 
624e7c33e29SRobert Watson 	UNP_GLOBAL_WLOCK();
625e7c33e29SRobert Watson 	UNP_PCB_LOCK(unp);
626e7c33e29SRobert Watson 	unp2 = unp->unp_conn;
627e7c33e29SRobert Watson 	if (unp2 != NULL) {
628e7c33e29SRobert Watson 		UNP_PCB_LOCK(unp2);
629e7c33e29SRobert Watson 		unp_disconnect(unp, unp2);
630e7c33e29SRobert Watson 		UNP_PCB_UNLOCK(unp2);
631e7c33e29SRobert Watson 	}
632e7c33e29SRobert Watson 	UNP_PCB_UNLOCK(unp);
633e7c33e29SRobert Watson 	UNP_GLOBAL_WUNLOCK();
634e5aeaa0cSDag-Erling Smørgrav 	return (0);
635a29f300eSGarrett Wollman }
636a29f300eSGarrett Wollman 
637a29f300eSGarrett Wollman static int
638d374e81eSRobert Watson uipc_listen(struct socket *so, int backlog, struct thread *td)
639a29f300eSGarrett Wollman {
64040f2ac28SRobert Watson 	struct unpcb *unp;
6410d9ce3a1SRobert Watson 	int error;
642a29f300eSGarrett Wollman 
64340f2ac28SRobert Watson 	unp = sotounpcb(so);
6444d4b555eSRobert Watson 	KASSERT(unp != NULL, ("uipc_listen: unp == NULL"));
645e7c33e29SRobert Watson 
646e7c33e29SRobert Watson 	UNP_PCB_LOCK(unp);
6474d4b555eSRobert Watson 	if (unp->unp_vnode == NULL) {
648e7c33e29SRobert Watson 		UNP_PCB_UNLOCK(unp);
64940f2ac28SRobert Watson 		return (EINVAL);
65040f2ac28SRobert Watson 	}
651e7c33e29SRobert Watson 
652e7c33e29SRobert Watson 	SOCK_LOCK(so);
653e7c33e29SRobert Watson 	error = solisten_proto_check(so);
654e7c33e29SRobert Watson 	if (error == 0) {
655e7c33e29SRobert Watson 		cru2x(td->td_ucred, &unp->unp_peercred);
656e7c33e29SRobert Watson 		unp->unp_flags |= UNP_HAVEPCCACHED;
657e7c33e29SRobert Watson 		solisten_proto(so, backlog);
658e7c33e29SRobert Watson 	}
659e7c33e29SRobert Watson 	SOCK_UNLOCK(so);
660e7c33e29SRobert Watson 	UNP_PCB_UNLOCK(unp);
6610d9ce3a1SRobert Watson 	return (error);
662a29f300eSGarrett Wollman }
663a29f300eSGarrett Wollman 
664a29f300eSGarrett Wollman static int
66557bf258eSGarrett Wollman uipc_peeraddr(struct socket *so, struct sockaddr **nam)
666a29f300eSGarrett Wollman {
667e7c33e29SRobert Watson 	struct unpcb *unp, *unp2;
6680d9ce3a1SRobert Watson 	const struct sockaddr *sa;
669a29f300eSGarrett Wollman 
6704d4b555eSRobert Watson 	unp = sotounpcb(so);
6714d4b555eSRobert Watson 	KASSERT(unp != NULL, ("uipc_peeraddr: unp == NULL"));
672e7c33e29SRobert Watson 
6730d9ce3a1SRobert Watson 	*nam = malloc(sizeof(struct sockaddr_un), M_SONAME, M_WAITOK);
674e7c33e29SRobert Watson 	UNP_PCB_LOCK(unp);
675bdc5f6a3SHajimu UMEMOTO 	/*
676e7c33e29SRobert Watson 	 * XXX: It seems that this test always fails even when connection is
677e7c33e29SRobert Watson 	 * established.  So, this else clause is added as workaround to
678e7c33e29SRobert Watson 	 * return PF_LOCAL sockaddr.
679bdc5f6a3SHajimu UMEMOTO 	 */
680e7c33e29SRobert Watson 	unp2 = unp->unp_conn;
681e7c33e29SRobert Watson 	if (unp2 != NULL) {
682e7c33e29SRobert Watson 		UNP_PCB_LOCK(unp2);
683e7c33e29SRobert Watson 		if (unp2->unp_addr != NULL)
684e7c33e29SRobert Watson 			sa = (struct sockaddr *) unp->unp_conn->unp_addr;
685e7c33e29SRobert Watson 		else
6860d9ce3a1SRobert Watson 			sa = &sun_noname;
6870d9ce3a1SRobert Watson 		bcopy(sa, *nam, sa->sa_len);
688e7c33e29SRobert Watson 		UNP_PCB_UNLOCK(unp2);
689e7c33e29SRobert Watson 	} else {
690e7c33e29SRobert Watson 		sa = &sun_noname;
691e7c33e29SRobert Watson 		bcopy(sa, *nam, sa->sa_len);
692e7c33e29SRobert Watson 	}
693e7c33e29SRobert Watson 	UNP_PCB_UNLOCK(unp);
694e5aeaa0cSDag-Erling Smørgrav 	return (0);
695a29f300eSGarrett Wollman }
696a29f300eSGarrett Wollman 
697a29f300eSGarrett Wollman static int
698a29f300eSGarrett Wollman uipc_rcvd(struct socket *so, int flags)
699a29f300eSGarrett Wollman {
700e7c33e29SRobert Watson 	struct unpcb *unp, *unp2;
701a29f300eSGarrett Wollman 	struct socket *so2;
702337cc6b6SRobert Watson 	u_int mbcnt, sbcc;
7036aef685fSBrian Feldman 	u_long newhiwat;
704a29f300eSGarrett Wollman 
70540f2ac28SRobert Watson 	unp = sotounpcb(so);
7064d4b555eSRobert Watson 	KASSERT(unp != NULL, ("uipc_rcvd: unp == NULL"));
707df8bae1dSRodney W. Grimes 
708e7c33e29SRobert Watson 	if (so->so_type == SOCK_DGRAM)
709e7c33e29SRobert Watson 		panic("uipc_rcvd DGRAM?");
710e7c33e29SRobert Watson 
711e7c33e29SRobert Watson 	if (so->so_type != SOCK_STREAM)
712e7c33e29SRobert Watson 		panic("uipc_rcvd unknown socktype");
713e7c33e29SRobert Watson 
714df8bae1dSRodney W. Grimes 	/*
715e7c33e29SRobert Watson 	 * Adjust backpressure on sender and wakeup any waiting to write.
716e7c33e29SRobert Watson 	 *
717d7924b70SRobert Watson 	 * The unp lock is acquired to maintain the validity of the unp_conn
718d7924b70SRobert Watson 	 * pointer; no lock on unp2 is required as unp2->unp_socket will be
719d7924b70SRobert Watson 	 * static as long as we don't permit unp2 to disconnect from unp,
720d7924b70SRobert Watson 	 * which is prevented by the lock on unp.  We cache values from
721d7924b70SRobert Watson 	 * so_rcv to avoid holding the so_rcv lock over the entire
722d7924b70SRobert Watson 	 * transaction on the remote so_snd.
723df8bae1dSRodney W. Grimes 	 */
724337cc6b6SRobert Watson 	SOCKBUF_LOCK(&so->so_rcv);
725337cc6b6SRobert Watson 	mbcnt = so->so_rcv.sb_mbcnt;
726337cc6b6SRobert Watson 	sbcc = so->so_rcv.sb_cc;
727337cc6b6SRobert Watson 	SOCKBUF_UNLOCK(&so->so_rcv);
728e7c33e29SRobert Watson 	UNP_PCB_LOCK(unp);
729e7c33e29SRobert Watson 	unp2 = unp->unp_conn;
730e7c33e29SRobert Watson 	if (unp2 == NULL) {
731e7c33e29SRobert Watson 		UNP_PCB_UNLOCK(unp);
732e7c33e29SRobert Watson 		return (0);
733337cc6b6SRobert Watson 	}
734e7c33e29SRobert Watson 	so2 = unp2->unp_socket;
735337cc6b6SRobert Watson 	SOCKBUF_LOCK(&so2->so_snd);
736337cc6b6SRobert Watson 	so2->so_snd.sb_mbmax += unp->unp_mbcnt - mbcnt;
737337cc6b6SRobert Watson 	newhiwat = so2->so_snd.sb_hiwat + unp->unp_cc - sbcc;
738f535380cSDon Lewis 	(void)chgsbsize(so2->so_cred->cr_uidinfo, &so2->so_snd.sb_hiwat,
7396aef685fSBrian Feldman 	    newhiwat, RLIM_INFINITY);
7401e4d7da7SRobert Watson 	sowwakeup_locked(so2);
741337cc6b6SRobert Watson 	unp->unp_mbcnt = mbcnt;
742337cc6b6SRobert Watson 	unp->unp_cc = sbcc;
743e7c33e29SRobert Watson 	UNP_PCB_UNLOCK(unp);
744e5aeaa0cSDag-Erling Smørgrav 	return (0);
745a29f300eSGarrett Wollman }
746df8bae1dSRodney W. Grimes 
747a29f300eSGarrett Wollman static int
74857bf258eSGarrett Wollman uipc_send(struct socket *so, int flags, struct mbuf *m, struct sockaddr *nam,
749b40ce416SJulian Elischer     struct mbuf *control, struct thread *td)
750a29f300eSGarrett Wollman {
751f3f49bbbSRobert Watson 	struct unpcb *unp, *unp2;
752a29f300eSGarrett Wollman 	struct socket *so2;
753337cc6b6SRobert Watson 	u_int mbcnt, sbcc;
7546aef685fSBrian Feldman 	u_long newhiwat;
755f3f49bbbSRobert Watson 	int error = 0;
756a29f300eSGarrett Wollman 
75740f2ac28SRobert Watson 	unp = sotounpcb(so);
7584d4b555eSRobert Watson 	KASSERT(unp != NULL, ("uipc_send: unp == NULL"));
759e7c33e29SRobert Watson 
760a29f300eSGarrett Wollman 	if (flags & PRUS_OOB) {
761a29f300eSGarrett Wollman 		error = EOPNOTSUPP;
762a29f300eSGarrett Wollman 		goto release;
763a29f300eSGarrett Wollman 	}
764fc3fcacfSRobert Watson 	if (control != NULL && (error = unp_internalize(&control, td)))
765a29f300eSGarrett Wollman 		goto release;
766e7c33e29SRobert Watson 	if ((nam != NULL) || (flags & PRUS_EOF))
767e7c33e29SRobert Watson 		UNP_GLOBAL_WLOCK();
768e7c33e29SRobert Watson 	else
769e7c33e29SRobert Watson 		UNP_GLOBAL_RLOCK();
770a29f300eSGarrett Wollman 	switch (so->so_type) {
771a29f300eSGarrett Wollman 	case SOCK_DGRAM:
772a29f300eSGarrett Wollman 	{
773e7dd9a10SRobert Watson 		const struct sockaddr *from;
774df8bae1dSRodney W. Grimes 
775e7c33e29SRobert Watson 		unp2 = unp->unp_conn;
776fc3fcacfSRobert Watson 		if (nam != NULL) {
777ede6e136SRobert Watson 			UNP_GLOBAL_WLOCK_ASSERT();
778e7c33e29SRobert Watson 			if (unp2 != NULL) {
779df8bae1dSRodney W. Grimes 				error = EISCONN;
780df8bae1dSRodney W. Grimes 				break;
781df8bae1dSRodney W. Grimes 			}
782b40ce416SJulian Elischer 			error = unp_connect(so, nam, td);
783df8bae1dSRodney W. Grimes 			if (error)
784df8bae1dSRodney W. Grimes 				break;
785e7c33e29SRobert Watson 			unp2 = unp->unp_conn;
786df8bae1dSRodney W. Grimes 		}
78760a5ef26SRobert Watson 
788b5ff0914SRobert Watson 		/*
789b5ff0914SRobert Watson 		 * Because connect() and send() are non-atomic in a sendto()
790b5ff0914SRobert Watson 		 * with a target address, it's possible that the socket will
791b5ff0914SRobert Watson 		 * have disconnected before the send() can run.  In that case
792b5ff0914SRobert Watson 		 * return the slightly counter-intuitive but otherwise
793b5ff0914SRobert Watson 		 * correct error that the socket is not connected.
794b5ff0914SRobert Watson 		 */
795b5ff0914SRobert Watson 		if (unp2 == NULL) {
796b5ff0914SRobert Watson 			error = ENOTCONN;
797b5ff0914SRobert Watson 			break;
798b5ff0914SRobert Watson 		}
799ede6e136SRobert Watson 		/* Lockless read. */
800ede6e136SRobert Watson 		if (unp2->unp_flags & UNP_WANTCRED)
801ede6e136SRobert Watson 			control = unp_addsockcred(td, control);
802ede6e136SRobert Watson 		UNP_PCB_LOCK(unp);
803fc3fcacfSRobert Watson 		if (unp->unp_addr != NULL)
80457bf258eSGarrett Wollman 			from = (struct sockaddr *)unp->unp_addr;
805df8bae1dSRodney W. Grimes 		else
806df8bae1dSRodney W. Grimes 			from = &sun_noname;
807ede6e136SRobert Watson 		so2 = unp2->unp_socket;
808a34b7046SRobert Watson 		SOCKBUF_LOCK(&so2->so_rcv);
809a34b7046SRobert Watson 		if (sbappendaddr_locked(&so2->so_rcv, from, m, control)) {
8101e4d7da7SRobert Watson 			sorwakeup_locked(so2);
811fc3fcacfSRobert Watson 			m = NULL;
812fc3fcacfSRobert Watson 			control = NULL;
813e5aeaa0cSDag-Erling Smørgrav 		} else {
814a34b7046SRobert Watson 			SOCKBUF_UNLOCK(&so2->so_rcv);
815df8bae1dSRodney W. Grimes 			error = ENOBUFS;
816e5aeaa0cSDag-Erling Smørgrav 		}
817ede6e136SRobert Watson 		if (nam != NULL) {
818ede6e136SRobert Watson 			UNP_GLOBAL_WLOCK_ASSERT();
819ede6e136SRobert Watson 			UNP_PCB_LOCK(unp2);
820e7c33e29SRobert Watson 			unp_disconnect(unp, unp2);
821e7c33e29SRobert Watson 			UNP_PCB_UNLOCK(unp2);
822ede6e136SRobert Watson 		}
823ede6e136SRobert Watson 		UNP_PCB_UNLOCK(unp);
824df8bae1dSRodney W. Grimes 		break;
825df8bae1dSRodney W. Grimes 	}
826df8bae1dSRodney W. Grimes 
827df8bae1dSRodney W. Grimes 	case SOCK_STREAM:
828402cc72dSDavid Greenman 		if ((so->so_state & SS_ISCONNECTED) == 0) {
829fc3fcacfSRobert Watson 			if (nam != NULL) {
830ede6e136SRobert Watson 				UNP_GLOBAL_WLOCK_ASSERT();
831b40ce416SJulian Elischer 				error = unp_connect(so, nam, td);
832402cc72dSDavid Greenman 				if (error)
8336b8fda4dSGarrett Wollman 					break;	/* XXX */
834402cc72dSDavid Greenman 			} else {
835402cc72dSDavid Greenman 				error = ENOTCONN;
836402cc72dSDavid Greenman 				break;
837402cc72dSDavid Greenman 			}
838ede6e136SRobert Watson 		}
839402cc72dSDavid Greenman 
840337cc6b6SRobert Watson 		/* Lockless read. */
841c0b99ffaSRobert Watson 		if (so->so_snd.sb_state & SBS_CANTSENDMORE) {
842df8bae1dSRodney W. Grimes 			error = EPIPE;
843df8bae1dSRodney W. Grimes 			break;
844df8bae1dSRodney W. Grimes 		}
84560a5ef26SRobert Watson 
846b5ff0914SRobert Watson 		/*
847b5ff0914SRobert Watson 		 * Because connect() and send() are non-atomic in a sendto()
848b5ff0914SRobert Watson 		 * with a target address, it's possible that the socket will
849b5ff0914SRobert Watson 		 * have disconnected before the send() can run.  In that case
850b5ff0914SRobert Watson 		 * return the slightly counter-intuitive but otherwise
851b5ff0914SRobert Watson 		 * correct error that the socket is not connected.
852e7c33e29SRobert Watson 		 *
853d7924b70SRobert Watson 		 * Locking here must be done carefully: the global lock
854d7924b70SRobert Watson 		 * prevents interconnections between unpcbs from changing, so
855d7924b70SRobert Watson 		 * we can traverse from unp to unp2 without acquiring unp's
856d7924b70SRobert Watson 		 * lock.  Socket buffer locks follow unpcb locks, so we can
857d7924b70SRobert Watson 		 * acquire both remote and lock socket buffer locks.
858b5ff0914SRobert Watson 		 */
859f3f49bbbSRobert Watson 		unp2 = unp->unp_conn;
860b5ff0914SRobert Watson 		if (unp2 == NULL) {
861b5ff0914SRobert Watson 			error = ENOTCONN;
862b5ff0914SRobert Watson 			break;
863b5ff0914SRobert Watson 		}
864f3f49bbbSRobert Watson 		so2 = unp2->unp_socket;
865ede6e136SRobert Watson 		UNP_PCB_LOCK(unp2);
866a34b7046SRobert Watson 		SOCKBUF_LOCK(&so2->so_rcv);
867f3f49bbbSRobert Watson 		if (unp2->unp_flags & UNP_WANTCRED) {
8686a2989fdSMatthew N. Dodd 			/*
869ede6e136SRobert Watson 			 * Credentials are passed only once on SOCK_STREAM.
8706a2989fdSMatthew N. Dodd 			 */
871f3f49bbbSRobert Watson 			unp2->unp_flags &= ~UNP_WANTCRED;
8726a2989fdSMatthew N. Dodd 			control = unp_addsockcred(td, control);
8736a2989fdSMatthew N. Dodd 		}
874df8bae1dSRodney W. Grimes 		/*
8751c381b19SRobert Watson 		 * Send to paired receive port, and then reduce send buffer
8761c381b19SRobert Watson 		 * hiwater marks to maintain backpressure.  Wake up readers.
877df8bae1dSRodney W. Grimes 		 */
878fc3fcacfSRobert Watson 		if (control != NULL) {
879a34b7046SRobert Watson 			if (sbappendcontrol_locked(&so2->so_rcv, m, control))
880fc3fcacfSRobert Watson 				control = NULL;
881e7c33e29SRobert Watson 		} else
882a34b7046SRobert Watson 			sbappend_locked(&so2->so_rcv, m);
883f3f49bbbSRobert Watson 		mbcnt = so2->so_rcv.sb_mbcnt - unp2->unp_mbcnt;
884f3f49bbbSRobert Watson 		unp2->unp_mbcnt = so2->so_rcv.sb_mbcnt;
885337cc6b6SRobert Watson 		sbcc = so2->so_rcv.sb_cc;
886337cc6b6SRobert Watson 		sorwakeup_locked(so2);
887337cc6b6SRobert Watson 
888337cc6b6SRobert Watson 		SOCKBUF_LOCK(&so->so_snd);
889f3f49bbbSRobert Watson 		newhiwat = so->so_snd.sb_hiwat - (sbcc - unp2->unp_cc);
890f535380cSDon Lewis 		(void)chgsbsize(so->so_cred->cr_uidinfo, &so->so_snd.sb_hiwat,
8916aef685fSBrian Feldman 		    newhiwat, RLIM_INFINITY);
892337cc6b6SRobert Watson 		so->so_snd.sb_mbmax -= mbcnt;
8937abe2ac2SAlan Cox 		SOCKBUF_UNLOCK(&so->so_snd);
894f3f49bbbSRobert Watson 		unp2->unp_cc = sbcc;
895e7c33e29SRobert Watson 		UNP_PCB_UNLOCK(unp2);
896fc3fcacfSRobert Watson 		m = NULL;
897df8bae1dSRodney W. Grimes 		break;
898df8bae1dSRodney W. Grimes 
899df8bae1dSRodney W. Grimes 	default:
900a29f300eSGarrett Wollman 		panic("uipc_send unknown socktype");
901df8bae1dSRodney W. Grimes 	}
902a29f300eSGarrett Wollman 
9036b8fda4dSGarrett Wollman 	/*
90460a5ef26SRobert Watson 	 * PRUS_EOF is equivalent to pru_send followed by pru_shutdown.
9056b8fda4dSGarrett Wollman 	 */
906a29f300eSGarrett Wollman 	if (flags & PRUS_EOF) {
907ede6e136SRobert Watson 		UNP_PCB_LOCK(unp);
9086b8fda4dSGarrett Wollman 		socantsendmore(so);
9096b8fda4dSGarrett Wollman 		unp_shutdown(unp);
910e7c33e29SRobert Watson 		UNP_PCB_UNLOCK(unp);
911ede6e136SRobert Watson 	}
912e7c33e29SRobert Watson 
913e7c33e29SRobert Watson 	if ((nam != NULL) || (flags & PRUS_EOF))
914e7c33e29SRobert Watson 		UNP_GLOBAL_WUNLOCK();
915e7c33e29SRobert Watson 	else
916e7c33e29SRobert Watson 		UNP_GLOBAL_RUNLOCK();
917df8bae1dSRodney W. Grimes 
918fc3fcacfSRobert Watson 	if (control != NULL && error != 0)
919bd508d39SDon Lewis 		unp_dispose(control);
920bd508d39SDon Lewis 
921a29f300eSGarrett Wollman release:
922fc3fcacfSRobert Watson 	if (control != NULL)
923a29f300eSGarrett Wollman 		m_freem(control);
924fc3fcacfSRobert Watson 	if (m != NULL)
925a29f300eSGarrett Wollman 		m_freem(m);
926e5aeaa0cSDag-Erling Smørgrav 	return (error);
927a29f300eSGarrett Wollman }
928df8bae1dSRodney W. Grimes 
929a29f300eSGarrett Wollman static int
930a29f300eSGarrett Wollman uipc_sense(struct socket *so, struct stat *sb)
931a29f300eSGarrett Wollman {
932e7c33e29SRobert Watson 	struct unpcb *unp, *unp2;
933a29f300eSGarrett Wollman 	struct socket *so2;
934a29f300eSGarrett Wollman 
93540f2ac28SRobert Watson 	unp = sotounpcb(so);
9364d4b555eSRobert Watson 	KASSERT(unp != NULL, ("uipc_sense: unp == NULL"));
937e7c33e29SRobert Watson 
938a29f300eSGarrett Wollman 	sb->st_blksize = so->so_snd.sb_hiwat;
939e7c33e29SRobert Watson 	UNP_GLOBAL_RLOCK();
940e7c33e29SRobert Watson 	UNP_PCB_LOCK(unp);
941e7c33e29SRobert Watson 	unp2 = unp->unp_conn;
942e7c33e29SRobert Watson 	if (so->so_type == SOCK_STREAM && unp2 != NULL) {
943e7c33e29SRobert Watson 		so2 = unp2->unp_socket;
944a29f300eSGarrett Wollman 		sb->st_blksize += so2->so_rcv.sb_cc;
945df8bae1dSRodney W. Grimes 	}
946f3732fd1SPoul-Henning Kamp 	sb->st_dev = NODEV;
947df8bae1dSRodney W. Grimes 	if (unp->unp_ino == 0)
9486f782c46SJeffrey Hsu 		unp->unp_ino = (++unp_ino == 0) ? ++unp_ino : unp_ino;
949a29f300eSGarrett Wollman 	sb->st_ino = unp->unp_ino;
950e7c33e29SRobert Watson 	UNP_PCB_UNLOCK(unp);
951e7c33e29SRobert Watson 	UNP_GLOBAL_RUNLOCK();
952df8bae1dSRodney W. Grimes 	return (0);
953a29f300eSGarrett Wollman }
954df8bae1dSRodney W. Grimes 
955a29f300eSGarrett Wollman static int
956a29f300eSGarrett Wollman uipc_shutdown(struct socket *so)
957a29f300eSGarrett Wollman {
95840f2ac28SRobert Watson 	struct unpcb *unp;
959df8bae1dSRodney W. Grimes 
96040f2ac28SRobert Watson 	unp = sotounpcb(so);
9614d4b555eSRobert Watson 	KASSERT(unp != NULL, ("uipc_shutdown: unp == NULL"));
962e7c33e29SRobert Watson 
963e7c33e29SRobert Watson 	UNP_GLOBAL_WLOCK();
964e7c33e29SRobert Watson 	UNP_PCB_LOCK(unp);
965a29f300eSGarrett Wollman 	socantsendmore(so);
966a29f300eSGarrett Wollman 	unp_shutdown(unp);
967e7c33e29SRobert Watson 	UNP_PCB_UNLOCK(unp);
968e7c33e29SRobert Watson 	UNP_GLOBAL_WUNLOCK();
969e5aeaa0cSDag-Erling Smørgrav 	return (0);
970a29f300eSGarrett Wollman }
971df8bae1dSRodney W. Grimes 
972a29f300eSGarrett Wollman static int
97357bf258eSGarrett Wollman uipc_sockaddr(struct socket *so, struct sockaddr **nam)
974a29f300eSGarrett Wollman {
97540f2ac28SRobert Watson 	struct unpcb *unp;
9760d9ce3a1SRobert Watson 	const struct sockaddr *sa;
977a29f300eSGarrett Wollman 
9784d4b555eSRobert Watson 	unp = sotounpcb(so);
9794d4b555eSRobert Watson 	KASSERT(unp != NULL, ("uipc_sockaddr: unp == NULL"));
980e7c33e29SRobert Watson 
9810d9ce3a1SRobert Watson 	*nam = malloc(sizeof(struct sockaddr_un), M_SONAME, M_WAITOK);
982e7c33e29SRobert Watson 	UNP_PCB_LOCK(unp);
983fc3fcacfSRobert Watson 	if (unp->unp_addr != NULL)
9840d9ce3a1SRobert Watson 		sa = (struct sockaddr *) unp->unp_addr;
98583f3198bSThomas Moestl 	else
9860d9ce3a1SRobert Watson 		sa = &sun_noname;
9870d9ce3a1SRobert Watson 	bcopy(sa, *nam, sa->sa_len);
988e7c33e29SRobert Watson 	UNP_PCB_UNLOCK(unp);
989e5aeaa0cSDag-Erling Smørgrav 	return (0);
990df8bae1dSRodney W. Grimes }
991a29f300eSGarrett Wollman 
992a29f300eSGarrett Wollman struct pr_usrreqs uipc_usrreqs = {
993756d52a1SPoul-Henning Kamp 	.pru_abort = 		uipc_abort,
994756d52a1SPoul-Henning Kamp 	.pru_accept =		uipc_accept,
995756d52a1SPoul-Henning Kamp 	.pru_attach =		uipc_attach,
996756d52a1SPoul-Henning Kamp 	.pru_bind =		uipc_bind,
997756d52a1SPoul-Henning Kamp 	.pru_connect =		uipc_connect,
998756d52a1SPoul-Henning Kamp 	.pru_connect2 =		uipc_connect2,
999756d52a1SPoul-Henning Kamp 	.pru_detach =		uipc_detach,
1000756d52a1SPoul-Henning Kamp 	.pru_disconnect =	uipc_disconnect,
1001756d52a1SPoul-Henning Kamp 	.pru_listen =		uipc_listen,
1002756d52a1SPoul-Henning Kamp 	.pru_peeraddr =		uipc_peeraddr,
1003756d52a1SPoul-Henning Kamp 	.pru_rcvd =		uipc_rcvd,
1004756d52a1SPoul-Henning Kamp 	.pru_send =		uipc_send,
1005756d52a1SPoul-Henning Kamp 	.pru_sense =		uipc_sense,
1006756d52a1SPoul-Henning Kamp 	.pru_shutdown =		uipc_shutdown,
1007756d52a1SPoul-Henning Kamp 	.pru_sockaddr =		uipc_sockaddr,
1008a152f8a3SRobert Watson 	.pru_close =		uipc_close,
1009a29f300eSGarrett Wollman };
1010df8bae1dSRodney W. Grimes 
10110c1bb4fbSDima Dorfman int
1012892af6b9SRobert Watson uipc_ctloutput(struct socket *so, struct sockopt *sopt)
10130c1bb4fbSDima Dorfman {
101440f2ac28SRobert Watson 	struct unpcb *unp;
10150d9ce3a1SRobert Watson 	struct xucred xu;
10166a2989fdSMatthew N. Dodd 	int error, optval;
10176a2989fdSMatthew N. Dodd 
101896a041b5SMatthew N. Dodd 	if (sopt->sopt_level != 0)
101996a041b5SMatthew N. Dodd 		return (EINVAL);
102096a041b5SMatthew N. Dodd 
10216a2989fdSMatthew N. Dodd 	unp = sotounpcb(so);
10224d4b555eSRobert Watson 	KASSERT(unp != NULL, ("uipc_ctloutput: unp == NULL"));
10236a2989fdSMatthew N. Dodd 	error = 0;
10240c1bb4fbSDima Dorfman 	switch (sopt->sopt_dir) {
10250c1bb4fbSDima Dorfman 	case SOPT_GET:
10260c1bb4fbSDima Dorfman 		switch (sopt->sopt_name) {
10270c1bb4fbSDima Dorfman 		case LOCAL_PEERCRED:
1028e7c33e29SRobert Watson 			UNP_PCB_LOCK(unp);
10290c1bb4fbSDima Dorfman 			if (unp->unp_flags & UNP_HAVEPC)
10300d9ce3a1SRobert Watson 				xu = unp->unp_peercred;
10310c1bb4fbSDima Dorfman 			else {
10320c1bb4fbSDima Dorfman 				if (so->so_type == SOCK_STREAM)
10330c1bb4fbSDima Dorfman 					error = ENOTCONN;
10340c1bb4fbSDima Dorfman 				else
10350c1bb4fbSDima Dorfman 					error = EINVAL;
10360c1bb4fbSDima Dorfman 			}
1037e7c33e29SRobert Watson 			UNP_PCB_UNLOCK(unp);
10380d9ce3a1SRobert Watson 			if (error == 0)
10390d9ce3a1SRobert Watson 				error = sooptcopyout(sopt, &xu, sizeof(xu));
10400c1bb4fbSDima Dorfman 			break;
1041e7c33e29SRobert Watson 
10426a2989fdSMatthew N. Dodd 		case LOCAL_CREDS:
1043a6357845SRobert Watson 			/* Unlocked read. */
10446a2989fdSMatthew N. Dodd 			optval = unp->unp_flags & UNP_WANTCRED ? 1 : 0;
10456a2989fdSMatthew N. Dodd 			error = sooptcopyout(sopt, &optval, sizeof(optval));
10466a2989fdSMatthew N. Dodd 			break;
1047e7c33e29SRobert Watson 
10486a2989fdSMatthew N. Dodd 		case LOCAL_CONNWAIT:
1049a6357845SRobert Watson 			/* Unlocked read. */
10506a2989fdSMatthew N. Dodd 			optval = unp->unp_flags & UNP_CONNWAIT ? 1 : 0;
10516a2989fdSMatthew N. Dodd 			error = sooptcopyout(sopt, &optval, sizeof(optval));
10526a2989fdSMatthew N. Dodd 			break;
1053e7c33e29SRobert Watson 
10540c1bb4fbSDima Dorfman 		default:
10550c1bb4fbSDima Dorfman 			error = EOPNOTSUPP;
10560c1bb4fbSDima Dorfman 			break;
10570c1bb4fbSDima Dorfman 		}
10580c1bb4fbSDima Dorfman 		break;
1059e7c33e29SRobert Watson 
10600c1bb4fbSDima Dorfman 	case SOPT_SET:
10616a2989fdSMatthew N. Dodd 		switch (sopt->sopt_name) {
10626a2989fdSMatthew N. Dodd 		case LOCAL_CREDS:
10636a2989fdSMatthew N. Dodd 		case LOCAL_CONNWAIT:
10646a2989fdSMatthew N. Dodd 			error = sooptcopyin(sopt, &optval, sizeof(optval),
10656a2989fdSMatthew N. Dodd 					    sizeof(optval));
10666a2989fdSMatthew N. Dodd 			if (error)
10676a2989fdSMatthew N. Dodd 				break;
10686a2989fdSMatthew N. Dodd 
1069e7c33e29SRobert Watson #define	OPTSET(bit) do {						\
1070e7c33e29SRobert Watson 	UNP_PCB_LOCK(unp);						\
10716a2989fdSMatthew N. Dodd 	if (optval)							\
10726a2989fdSMatthew N. Dodd 		unp->unp_flags |= bit;					\
10736a2989fdSMatthew N. Dodd 	else								\
1074e7c33e29SRobert Watson 		unp->unp_flags &= ~bit;					\
1075e7c33e29SRobert Watson 	UNP_PCB_UNLOCK(unp);						\
1076e7c33e29SRobert Watson } while (0)
10776a2989fdSMatthew N. Dodd 
10786a2989fdSMatthew N. Dodd 			switch (sopt->sopt_name) {
10796a2989fdSMatthew N. Dodd 			case LOCAL_CREDS:
10806a2989fdSMatthew N. Dodd 				OPTSET(UNP_WANTCRED);
10816a2989fdSMatthew N. Dodd 				break;
1082e7c33e29SRobert Watson 
10836a2989fdSMatthew N. Dodd 			case LOCAL_CONNWAIT:
10846a2989fdSMatthew N. Dodd 				OPTSET(UNP_CONNWAIT);
10856a2989fdSMatthew N. Dodd 				break;
1086e7c33e29SRobert Watson 
10876a2989fdSMatthew N. Dodd 			default:
10886a2989fdSMatthew N. Dodd 				break;
10896a2989fdSMatthew N. Dodd 			}
10906a2989fdSMatthew N. Dodd 			break;
10916a2989fdSMatthew N. Dodd #undef	OPTSET
10926a2989fdSMatthew N. Dodd 		default:
10936a2989fdSMatthew N. Dodd 			error = ENOPROTOOPT;
10946a2989fdSMatthew N. Dodd 			break;
10956a2989fdSMatthew N. Dodd 		}
1096abb886faSMatthew N. Dodd 		break;
1097e7c33e29SRobert Watson 
10980c1bb4fbSDima Dorfman 	default:
10990c1bb4fbSDima Dorfman 		error = EOPNOTSUPP;
11000c1bb4fbSDima Dorfman 		break;
11010c1bb4fbSDima Dorfman 	}
11020c1bb4fbSDima Dorfman 	return (error);
11030c1bb4fbSDima Dorfman }
11040c1bb4fbSDima Dorfman 
1105f708ef1bSPoul-Henning Kamp static int
1106892af6b9SRobert Watson unp_connect(struct socket *so, struct sockaddr *nam, struct thread *td)
1107df8bae1dSRodney W. Grimes {
1108892af6b9SRobert Watson 	struct sockaddr_un *soun = (struct sockaddr_un *)nam;
1109892af6b9SRobert Watson 	struct vnode *vp;
1110892af6b9SRobert Watson 	struct socket *so2, *so3;
1111b295bdcdSRobert Watson 	struct unpcb *unp, *unp2, *unp3;
11129e289446SWojciech A. Koszek 	int error, len, vfslocked;
1113df8bae1dSRodney W. Grimes 	struct nameidata nd;
111457bf258eSGarrett Wollman 	char buf[SOCK_MAXADDRLEN];
11150d9ce3a1SRobert Watson 	struct sockaddr *sa;
11160d9ce3a1SRobert Watson 
1117e7c33e29SRobert Watson 	UNP_GLOBAL_WLOCK_ASSERT();
1118df8bae1dSRodney W. Grimes 
11194d4b555eSRobert Watson 	unp = sotounpcb(so);
11204d4b555eSRobert Watson 	KASSERT(unp != NULL, ("unp_connect: unp == NULL"));
1121e7c33e29SRobert Watson 
112257bf258eSGarrett Wollman 	len = nam->sa_len - offsetof(struct sockaddr_un, sun_path);
112357bf258eSGarrett Wollman 	if (len <= 0)
1124e5aeaa0cSDag-Erling Smørgrav 		return (EINVAL);
11257928893dSEd Maste 	bcopy(soun->sun_path, buf, len);
11267928893dSEd Maste 	buf[len] = 0;
1127e7c33e29SRobert Watson 
1128e7c33e29SRobert Watson 	UNP_PCB_LOCK(unp);
11294f1f0ef5SRobert Watson 	if (unp->unp_flags & UNP_CONNECTING) {
1130e7c33e29SRobert Watson 		UNP_PCB_UNLOCK(unp);
11314f1f0ef5SRobert Watson 		return (EALREADY);
11324f1f0ef5SRobert Watson 	}
11338c96f9c1SRobert Watson 	UNP_GLOBAL_WUNLOCK();
113405102f04SRobert Watson 	unp->unp_flags |= UNP_CONNECTING;
1135e7c33e29SRobert Watson 	UNP_PCB_UNLOCK(unp);
1136e7c33e29SRobert Watson 
11370d9ce3a1SRobert Watson 	sa = malloc(sizeof(struct sockaddr_un), M_SONAME, M_WAITOK);
11389e289446SWojciech A. Koszek 	NDINIT(&nd, LOOKUP, MPSAFE | FOLLOW | LOCKLEAF, UIO_SYSSPACE, buf,
11399e289446SWojciech A. Koszek 	    td);
1140797f2d22SPoul-Henning Kamp 	error = namei(&nd);
1141797f2d22SPoul-Henning Kamp 	if (error)
11420d9ce3a1SRobert Watson 		vp = NULL;
11430d9ce3a1SRobert Watson 	else
1144df8bae1dSRodney W. Grimes 		vp = nd.ni_vp;
11450d9ce3a1SRobert Watson 	ASSERT_VOP_LOCKED(vp, "unp_connect");
11469e289446SWojciech A. Koszek 	vfslocked = NDHASGIANT(&nd);
1147762e6b85SEivind Eklund 	NDFREE(&nd, NDF_ONLY_PNBUF);
11480d9ce3a1SRobert Watson 	if (error)
11490d9ce3a1SRobert Watson 		goto bad;
11500d9ce3a1SRobert Watson 
1151df8bae1dSRodney W. Grimes 	if (vp->v_type != VSOCK) {
1152df8bae1dSRodney W. Grimes 		error = ENOTSOCK;
1153df8bae1dSRodney W. Grimes 		goto bad;
1154df8bae1dSRodney W. Grimes 	}
11556fac927cSRobert Watson #ifdef MAC
115630d239bcSRobert Watson 	error = mac_vnode_check_open(td->td_ucred, vp, VWRITE | VREAD);
11576fac927cSRobert Watson 	if (error)
11586fac927cSRobert Watson 		goto bad;
11596fac927cSRobert Watson #endif
1160a854ed98SJohn Baldwin 	error = VOP_ACCESS(vp, VWRITE, td->td_ucred, td);
1161797f2d22SPoul-Henning Kamp 	if (error)
1162df8bae1dSRodney W. Grimes 		goto bad;
11639e289446SWojciech A. Koszek 	VFS_UNLOCK_GIANT(vfslocked);
1164e7c33e29SRobert Watson 
1165b295bdcdSRobert Watson 	unp = sotounpcb(so);
11664d4b555eSRobert Watson 	KASSERT(unp != NULL, ("unp_connect: unp == NULL"));
1167e7c33e29SRobert Watson 
1168e7c33e29SRobert Watson 	/*
1169e7c33e29SRobert Watson 	 * Lock global lock for two reasons: make sure v_socket is stable,
1170e7c33e29SRobert Watson 	 * and to protect simultaneous locking of multiple pcbs.
1171e7c33e29SRobert Watson 	 */
1172e7c33e29SRobert Watson 	UNP_GLOBAL_WLOCK();
1173df8bae1dSRodney W. Grimes 	so2 = vp->v_socket;
1174fc3fcacfSRobert Watson 	if (so2 == NULL) {
1175df8bae1dSRodney W. Grimes 		error = ECONNREFUSED;
11762260c03dSRobert Watson 		goto bad2;
1177df8bae1dSRodney W. Grimes 	}
1178df8bae1dSRodney W. Grimes 	if (so->so_type != so2->so_type) {
1179df8bae1dSRodney W. Grimes 		error = EPROTOTYPE;
11802260c03dSRobert Watson 		goto bad2;
1181df8bae1dSRodney W. Grimes 	}
1182df8bae1dSRodney W. Grimes 	if (so->so_proto->pr_flags & PR_CONNREQUIRED) {
1183e7c33e29SRobert Watson 		if (so2->so_options & SO_ACCEPTCONN) {
1184e7c33e29SRobert Watson 			/*
1185e7c33e29SRobert Watson 			 * We can't drop the global lock here or 'so2' may
1186d7924b70SRobert Watson 			 * become invalid.  As a result, we need to handle
1187d7924b70SRobert Watson 			 * possibly lock recursion in uipc_attach.
1188e7c33e29SRobert Watson 			 */
11890d9ce3a1SRobert Watson 			so3 = sonewconn(so2, 0);
1190e7c33e29SRobert Watson 		} else
11910d9ce3a1SRobert Watson 			so3 = NULL;
11920d9ce3a1SRobert Watson 		if (so3 == NULL) {
1193df8bae1dSRodney W. Grimes 			error = ECONNREFUSED;
11940d9ce3a1SRobert Watson 			goto bad2;
1195df8bae1dSRodney W. Grimes 		}
11960c1bb4fbSDima Dorfman 		unp = sotounpcb(so);
1197df8bae1dSRodney W. Grimes 		unp2 = sotounpcb(so2);
1198df8bae1dSRodney W. Grimes 		unp3 = sotounpcb(so3);
1199e7c33e29SRobert Watson 		UNP_PCB_LOCK(unp);
1200e7c33e29SRobert Watson 		UNP_PCB_LOCK(unp2);
1201e7c33e29SRobert Watson 		UNP_PCB_LOCK(unp3);
12020d9ce3a1SRobert Watson 		if (unp2->unp_addr != NULL) {
12030d9ce3a1SRobert Watson 			bcopy(unp2->unp_addr, sa, unp2->unp_addr->sun_len);
12040d9ce3a1SRobert Watson 			unp3->unp_addr = (struct sockaddr_un *) sa;
12050d9ce3a1SRobert Watson 			sa = NULL;
12060d9ce3a1SRobert Watson 		}
12070c1bb4fbSDima Dorfman 		/*
12080c1bb4fbSDima Dorfman 		 * unp_peercred management:
12090c1bb4fbSDima Dorfman 		 *
12101c381b19SRobert Watson 		 * The connecter's (client's) credentials are copied from its
12111c381b19SRobert Watson 		 * process structure at the time of connect() (which is now).
12120c1bb4fbSDima Dorfman 		 */
1213a854ed98SJohn Baldwin 		cru2x(td->td_ucred, &unp3->unp_peercred);
12140c1bb4fbSDima Dorfman 		unp3->unp_flags |= UNP_HAVEPC;
12150c1bb4fbSDima Dorfman 		/*
12161c381b19SRobert Watson 		 * The receiver's (server's) credentials are copied from the
12171c381b19SRobert Watson 		 * unp_peercred member of socket on which the former called
1218e7c33e29SRobert Watson 		 * listen(); uipc_listen() cached that process's credentials
12191c381b19SRobert Watson 		 * at that time so we can use them now.
12200c1bb4fbSDima Dorfman 		 */
12210c1bb4fbSDima Dorfman 		KASSERT(unp2->unp_flags & UNP_HAVEPCCACHED,
12220c1bb4fbSDima Dorfman 		    ("unp_connect: listener without cached peercred"));
12230c1bb4fbSDima Dorfman 		memcpy(&unp->unp_peercred, &unp2->unp_peercred,
12240c1bb4fbSDima Dorfman 		    sizeof(unp->unp_peercred));
12250c1bb4fbSDima Dorfman 		unp->unp_flags |= UNP_HAVEPC;
1226481f8fe8SMaxim Konovalov 		if (unp2->unp_flags & UNP_WANTCRED)
1227481f8fe8SMaxim Konovalov 			unp3->unp_flags |= UNP_WANTCRED;
1228e7c33e29SRobert Watson 		UNP_PCB_UNLOCK(unp3);
1229e7c33e29SRobert Watson 		UNP_PCB_UNLOCK(unp2);
1230e7c33e29SRobert Watson 		UNP_PCB_UNLOCK(unp);
1231335654d7SRobert Watson #ifdef MAC
1232310e7cebSRobert Watson 		SOCK_LOCK(so);
123330d239bcSRobert Watson 		mac_socketpeer_set_from_socket(so, so3);
123430d239bcSRobert Watson 		mac_socketpeer_set_from_socket(so3, so);
1235310e7cebSRobert Watson 		SOCK_UNLOCK(so);
1236335654d7SRobert Watson #endif
12370c1bb4fbSDima Dorfman 
1238df8bae1dSRodney W. Grimes 		so2 = so3;
1239df8bae1dSRodney W. Grimes 	}
1240e7c33e29SRobert Watson 	unp = sotounpcb(so);
1241e7c33e29SRobert Watson 	KASSERT(unp != NULL, ("unp_connect: unp == NULL"));
1242e7c33e29SRobert Watson 	unp2 = sotounpcb(so2);
1243e7c33e29SRobert Watson 	KASSERT(unp2 != NULL, ("unp_connect: unp2 == NULL"));
1244e7c33e29SRobert Watson 	UNP_PCB_LOCK(unp);
1245e7c33e29SRobert Watson 	UNP_PCB_LOCK(unp2);
12466a2989fdSMatthew N. Dodd 	error = unp_connect2(so, so2, PRU_CONNECT);
1247e7c33e29SRobert Watson 	UNP_PCB_UNLOCK(unp2);
1248e7c33e29SRobert Watson 	UNP_PCB_UNLOCK(unp);
12490d9ce3a1SRobert Watson bad2:
1250e7c33e29SRobert Watson 	UNP_GLOBAL_WUNLOCK();
12519e289446SWojciech A. Koszek 	if (vfslocked)
12529e289446SWojciech A. Koszek 		/*
12539e289446SWojciech A. Koszek 		 * Giant has been previously acquired. This means filesystem
12549e289446SWojciech A. Koszek 		 * isn't MPSAFE.  Do it once again.
12559e289446SWojciech A. Koszek 		 */
12560d9ce3a1SRobert Watson 		mtx_lock(&Giant);
1257df8bae1dSRodney W. Grimes bad:
12580d9ce3a1SRobert Watson 	if (vp != NULL)
1259df8bae1dSRodney W. Grimes 		vput(vp);
12609e289446SWojciech A. Koszek 	VFS_UNLOCK_GIANT(vfslocked);
12610d9ce3a1SRobert Watson 	free(sa, M_SONAME);
1262e7c33e29SRobert Watson 	UNP_GLOBAL_WLOCK();
1263e7c33e29SRobert Watson 	UNP_PCB_LOCK(unp);
12644f1f0ef5SRobert Watson 	unp->unp_flags &= ~UNP_CONNECTING;
1265e7c33e29SRobert Watson 	UNP_PCB_UNLOCK(unp);
1266df8bae1dSRodney W. Grimes 	return (error);
1267df8bae1dSRodney W. Grimes }
1268df8bae1dSRodney W. Grimes 
1269db48c0d2SRobert Watson static int
12706a2989fdSMatthew N. Dodd unp_connect2(struct socket *so, struct socket *so2, int req)
1271df8bae1dSRodney W. Grimes {
1272e7c33e29SRobert Watson 	struct unpcb *unp;
1273892af6b9SRobert Watson 	struct unpcb *unp2;
1274df8bae1dSRodney W. Grimes 
1275e7c33e29SRobert Watson 	unp = sotounpcb(so);
1276e7c33e29SRobert Watson 	KASSERT(unp != NULL, ("unp_connect2: unp == NULL"));
1277e7c33e29SRobert Watson 	unp2 = sotounpcb(so2);
1278e7c33e29SRobert Watson 	KASSERT(unp2 != NULL, ("unp_connect2: unp2 == NULL"));
1279e7c33e29SRobert Watson 
1280e7c33e29SRobert Watson 	UNP_GLOBAL_WLOCK_ASSERT();
1281e7c33e29SRobert Watson 	UNP_PCB_LOCK_ASSERT(unp);
1282e7c33e29SRobert Watson 	UNP_PCB_LOCK_ASSERT(unp2);
12830d9ce3a1SRobert Watson 
1284df8bae1dSRodney W. Grimes 	if (so2->so_type != so->so_type)
1285df8bae1dSRodney W. Grimes 		return (EPROTOTYPE);
1286df8bae1dSRodney W. Grimes 	unp->unp_conn = unp2;
1287e7c33e29SRobert Watson 
1288df8bae1dSRodney W. Grimes 	switch (so->so_type) {
1289df8bae1dSRodney W. Grimes 	case SOCK_DGRAM:
129098271db4SGarrett Wollman 		LIST_INSERT_HEAD(&unp2->unp_refs, unp, unp_reflink);
1291df8bae1dSRodney W. Grimes 		soisconnected(so);
1292df8bae1dSRodney W. Grimes 		break;
1293df8bae1dSRodney W. Grimes 
1294df8bae1dSRodney W. Grimes 	case SOCK_STREAM:
1295df8bae1dSRodney W. Grimes 		unp2->unp_conn = unp;
12966a2989fdSMatthew N. Dodd 		if (req == PRU_CONNECT &&
12976a2989fdSMatthew N. Dodd 		    ((unp->unp_flags | unp2->unp_flags) & UNP_CONNWAIT))
12986a2989fdSMatthew N. Dodd 			soisconnecting(so);
12996a2989fdSMatthew N. Dodd 		else
1300df8bae1dSRodney W. Grimes 			soisconnected(so);
1301df8bae1dSRodney W. Grimes 		soisconnected(so2);
1302df8bae1dSRodney W. Grimes 		break;
1303df8bae1dSRodney W. Grimes 
1304df8bae1dSRodney W. Grimes 	default:
1305df8bae1dSRodney W. Grimes 		panic("unp_connect2");
1306df8bae1dSRodney W. Grimes 	}
1307df8bae1dSRodney W. Grimes 	return (0);
1308df8bae1dSRodney W. Grimes }
1309df8bae1dSRodney W. Grimes 
1310f708ef1bSPoul-Henning Kamp static void
1311e7c33e29SRobert Watson unp_disconnect(struct unpcb *unp, struct unpcb *unp2)
1312df8bae1dSRodney W. Grimes {
13131b2e3b4bSRobert Watson 	struct socket *so;
1314df8bae1dSRodney W. Grimes 
1315e7c33e29SRobert Watson 	KASSERT(unp2 != NULL, ("unp_disconnect: unp2 == NULL"));
13160d9ce3a1SRobert Watson 
1317e7c33e29SRobert Watson 	UNP_GLOBAL_WLOCK_ASSERT();
1318e7c33e29SRobert Watson 	UNP_PCB_LOCK_ASSERT(unp);
1319e7c33e29SRobert Watson 	UNP_PCB_LOCK_ASSERT(unp2);
1320e7c33e29SRobert Watson 
1321fc3fcacfSRobert Watson 	unp->unp_conn = NULL;
1322df8bae1dSRodney W. Grimes 	switch (unp->unp_socket->so_type) {
1323df8bae1dSRodney W. Grimes 	case SOCK_DGRAM:
132498271db4SGarrett Wollman 		LIST_REMOVE(unp, unp_reflink);
13251b2e3b4bSRobert Watson 		so = unp->unp_socket;
13261b2e3b4bSRobert Watson 		SOCK_LOCK(so);
13271b2e3b4bSRobert Watson 		so->so_state &= ~SS_ISCONNECTED;
13281b2e3b4bSRobert Watson 		SOCK_UNLOCK(so);
1329df8bae1dSRodney W. Grimes 		break;
1330df8bae1dSRodney W. Grimes 
1331df8bae1dSRodney W. Grimes 	case SOCK_STREAM:
1332df8bae1dSRodney W. Grimes 		soisdisconnected(unp->unp_socket);
1333fc3fcacfSRobert Watson 		unp2->unp_conn = NULL;
1334df8bae1dSRodney W. Grimes 		soisdisconnected(unp2->unp_socket);
1335df8bae1dSRodney W. Grimes 		break;
1336df8bae1dSRodney W. Grimes 	}
1337df8bae1dSRodney W. Grimes }
1338df8bae1dSRodney W. Grimes 
13390d9ce3a1SRobert Watson /*
1340d7924b70SRobert Watson  * unp_pcblist() walks the global list of struct unpcb's to generate a
1341d7924b70SRobert Watson  * pointer list, bumping the refcount on each unpcb.  It then copies them out
1342d7924b70SRobert Watson  * sequentially, validating the generation number on each to see if it has
1343d7924b70SRobert Watson  * been detached.  All of this is necessary because copyout() may sleep on
1344d7924b70SRobert Watson  * disk I/O.
13450d9ce3a1SRobert Watson  */
134698271db4SGarrett Wollman static int
134782d9ae4eSPoul-Henning Kamp unp_pcblist(SYSCTL_HANDLER_ARGS)
134898271db4SGarrett Wollman {
1349f5ef029eSPoul-Henning Kamp 	int error, i, n;
13509ae328fcSJohn Baldwin 	int freeunp;
135198271db4SGarrett Wollman 	struct unpcb *unp, **unp_list;
135298271db4SGarrett Wollman 	unp_gen_t gencnt;
13538f364875SJulian Elischer 	struct xunpgen *xug;
135498271db4SGarrett Wollman 	struct unp_head *head;
13558f364875SJulian Elischer 	struct xunpcb *xu;
135698271db4SGarrett Wollman 
1357a23d65bfSBruce Evans 	head = ((intptr_t)arg1 == SOCK_DGRAM ? &unp_dhead : &unp_shead);
135898271db4SGarrett Wollman 
135998271db4SGarrett Wollman 	/*
136098271db4SGarrett Wollman 	 * The process of preparing the PCB list is too time-consuming and
136198271db4SGarrett Wollman 	 * resource-intensive to repeat twice on every request.
136298271db4SGarrett Wollman 	 */
1363fc3fcacfSRobert Watson 	if (req->oldptr == NULL) {
136498271db4SGarrett Wollman 		n = unp_count;
13658f364875SJulian Elischer 		req->oldidx = 2 * (sizeof *xug)
136698271db4SGarrett Wollman 			+ (n + n/8) * sizeof(struct xunpcb);
1367e5aeaa0cSDag-Erling Smørgrav 		return (0);
136898271db4SGarrett Wollman 	}
136998271db4SGarrett Wollman 
1370fc3fcacfSRobert Watson 	if (req->newptr != NULL)
1371e5aeaa0cSDag-Erling Smørgrav 		return (EPERM);
137298271db4SGarrett Wollman 
137398271db4SGarrett Wollman 	/*
137498271db4SGarrett Wollman 	 * OK, now we're committed to doing something.
137598271db4SGarrett Wollman 	 */
1376a163d034SWarner Losh 	xug = malloc(sizeof(*xug), M_TEMP, M_WAITOK);
1377e7c33e29SRobert Watson 	UNP_GLOBAL_RLOCK();
137898271db4SGarrett Wollman 	gencnt = unp_gencnt;
137998271db4SGarrett Wollman 	n = unp_count;
1380e7c33e29SRobert Watson 	UNP_GLOBAL_RUNLOCK();
138198271db4SGarrett Wollman 
13828f364875SJulian Elischer 	xug->xug_len = sizeof *xug;
13838f364875SJulian Elischer 	xug->xug_count = n;
13848f364875SJulian Elischer 	xug->xug_gen = gencnt;
13858f364875SJulian Elischer 	xug->xug_sogen = so_gencnt;
13868f364875SJulian Elischer 	error = SYSCTL_OUT(req, xug, sizeof *xug);
13878f364875SJulian Elischer 	if (error) {
13888f364875SJulian Elischer 		free(xug, M_TEMP);
1389e5aeaa0cSDag-Erling Smørgrav 		return (error);
13908f364875SJulian Elischer 	}
139198271db4SGarrett Wollman 
1392a163d034SWarner Losh 	unp_list = malloc(n * sizeof *unp_list, M_TEMP, M_WAITOK);
139398271db4SGarrett Wollman 
1394e7c33e29SRobert Watson 	UNP_GLOBAL_RLOCK();
13952e3c8fcbSPoul-Henning Kamp 	for (unp = LIST_FIRST(head), i = 0; unp && i < n;
13962e3c8fcbSPoul-Henning Kamp 	     unp = LIST_NEXT(unp, unp_link)) {
1397e7c33e29SRobert Watson 		UNP_PCB_LOCK(unp);
13988a7d8cc6SRobert Watson 		if (unp->unp_gencnt <= gencnt) {
1399a854ed98SJohn Baldwin 			if (cr_cansee(req->td->td_ucred,
1400e7c33e29SRobert Watson 			    unp->unp_socket->so_cred)) {
1401e7c33e29SRobert Watson 				UNP_PCB_UNLOCK(unp);
14024787fd37SPaul Saab 				continue;
1403e7c33e29SRobert Watson 			}
140498271db4SGarrett Wollman 			unp_list[i++] = unp;
14059ae328fcSJohn Baldwin 			unp->unp_refcount++;
140698271db4SGarrett Wollman 		}
1407e7c33e29SRobert Watson 		UNP_PCB_UNLOCK(unp);
14084787fd37SPaul Saab 	}
1409e7c33e29SRobert Watson 	UNP_GLOBAL_RUNLOCK();
14101c381b19SRobert Watson 	n = i;			/* In case we lost some during malloc. */
141198271db4SGarrett Wollman 
141298271db4SGarrett Wollman 	error = 0;
1413fe2eee82SColin Percival 	xu = malloc(sizeof(*xu), M_TEMP, M_WAITOK | M_ZERO);
141498271db4SGarrett Wollman 	for (i = 0; i < n; i++) {
141598271db4SGarrett Wollman 		unp = unp_list[i];
1416e7c33e29SRobert Watson 		UNP_PCB_LOCK(unp);
14179ae328fcSJohn Baldwin 		unp->unp_refcount--;
14189ae328fcSJohn Baldwin 	        if (unp->unp_refcount != 0 && unp->unp_gencnt <= gencnt) {
14198f364875SJulian Elischer 			xu->xu_len = sizeof *xu;
14208f364875SJulian Elischer 			xu->xu_unpp = unp;
142198271db4SGarrett Wollman 			/*
142298271db4SGarrett Wollman 			 * XXX - need more locking here to protect against
142398271db4SGarrett Wollman 			 * connect/disconnect races for SMP.
142498271db4SGarrett Wollman 			 */
1425fc3fcacfSRobert Watson 			if (unp->unp_addr != NULL)
14268f364875SJulian Elischer 				bcopy(unp->unp_addr, &xu->xu_addr,
142798271db4SGarrett Wollman 				      unp->unp_addr->sun_len);
1428fc3fcacfSRobert Watson 			if (unp->unp_conn != NULL &&
1429fc3fcacfSRobert Watson 			    unp->unp_conn->unp_addr != NULL)
143098271db4SGarrett Wollman 				bcopy(unp->unp_conn->unp_addr,
14318f364875SJulian Elischer 				      &xu->xu_caddr,
143298271db4SGarrett Wollman 				      unp->unp_conn->unp_addr->sun_len);
14338f364875SJulian Elischer 			bcopy(unp, &xu->xu_unp, sizeof *unp);
14348f364875SJulian Elischer 			sotoxsocket(unp->unp_socket, &xu->xu_socket);
1435e7c33e29SRobert Watson 			UNP_PCB_UNLOCK(unp);
14368f364875SJulian Elischer 			error = SYSCTL_OUT(req, xu, sizeof *xu);
14379ae328fcSJohn Baldwin 		} else {
14389ae328fcSJohn Baldwin 			freeunp = (unp->unp_refcount == 0);
1439e7c33e29SRobert Watson 			UNP_PCB_UNLOCK(unp);
1440e7c33e29SRobert Watson 			if (freeunp) {
1441e7c33e29SRobert Watson 				UNP_PCB_LOCK_DESTROY(unp);
14429ae328fcSJohn Baldwin 				uma_zfree(unp_zone, unp);
144398271db4SGarrett Wollman 			}
144498271db4SGarrett Wollman 		}
1445e7c33e29SRobert Watson 	}
14468f364875SJulian Elischer 	free(xu, M_TEMP);
144798271db4SGarrett Wollman 	if (!error) {
144898271db4SGarrett Wollman 		/*
14491c381b19SRobert Watson 		 * Give the user an updated idea of our state.  If the
14501c381b19SRobert Watson 		 * generation differs from what we told her before, she knows
14511c381b19SRobert Watson 		 * that something happened while we were processing this
14521c381b19SRobert Watson 		 * request, and it might be necessary to retry.
145398271db4SGarrett Wollman 		 */
14548f364875SJulian Elischer 		xug->xug_gen = unp_gencnt;
14558f364875SJulian Elischer 		xug->xug_sogen = so_gencnt;
14568f364875SJulian Elischer 		xug->xug_count = unp_count;
14578f364875SJulian Elischer 		error = SYSCTL_OUT(req, xug, sizeof *xug);
145898271db4SGarrett Wollman 	}
145998271db4SGarrett Wollman 	free(unp_list, M_TEMP);
14608f364875SJulian Elischer 	free(xug, M_TEMP);
1461e5aeaa0cSDag-Erling Smørgrav 	return (error);
146298271db4SGarrett Wollman }
146398271db4SGarrett Wollman 
146498271db4SGarrett Wollman SYSCTL_PROC(_net_local_dgram, OID_AUTO, pcblist, CTLFLAG_RD,
146598271db4SGarrett Wollman 	    (caddr_t)(long)SOCK_DGRAM, 0, unp_pcblist, "S,xunpcb",
146698271db4SGarrett Wollman 	    "List of active local datagram sockets");
146798271db4SGarrett Wollman SYSCTL_PROC(_net_local_stream, OID_AUTO, pcblist, CTLFLAG_RD,
146898271db4SGarrett Wollman 	    (caddr_t)(long)SOCK_STREAM, 0, unp_pcblist, "S,xunpcb",
146998271db4SGarrett Wollman 	    "List of active local stream sockets");
147098271db4SGarrett Wollman 
1471f708ef1bSPoul-Henning Kamp static void
1472892af6b9SRobert Watson unp_shutdown(struct unpcb *unp)
1473df8bae1dSRodney W. Grimes {
1474e7c33e29SRobert Watson 	struct unpcb *unp2;
1475df8bae1dSRodney W. Grimes 	struct socket *so;
1476df8bae1dSRodney W. Grimes 
1477e7c33e29SRobert Watson 	UNP_GLOBAL_WLOCK_ASSERT();
1478e7c33e29SRobert Watson 	UNP_PCB_LOCK_ASSERT(unp);
14790d9ce3a1SRobert Watson 
1480e7c33e29SRobert Watson 	unp2 = unp->unp_conn;
1481e7c33e29SRobert Watson 	if (unp->unp_socket->so_type == SOCK_STREAM && unp2 != NULL) {
1482e7c33e29SRobert Watson 		so = unp2->unp_socket;
1483e7c33e29SRobert Watson 		if (so != NULL)
1484df8bae1dSRodney W. Grimes 			socantrcvmore(so);
1485df8bae1dSRodney W. Grimes 	}
1486e7c33e29SRobert Watson }
1487df8bae1dSRodney W. Grimes 
1488f708ef1bSPoul-Henning Kamp static void
1489892af6b9SRobert Watson unp_drop(struct unpcb *unp, int errno)
1490df8bae1dSRodney W. Grimes {
1491df8bae1dSRodney W. Grimes 	struct socket *so = unp->unp_socket;
1492e7c33e29SRobert Watson 	struct unpcb *unp2;
1493df8bae1dSRodney W. Grimes 
1494e7c33e29SRobert Watson 	UNP_GLOBAL_WLOCK_ASSERT();
1495e7c33e29SRobert Watson 	UNP_PCB_LOCK_ASSERT(unp);
14960d9ce3a1SRobert Watson 
1497df8bae1dSRodney W. Grimes 	so->so_error = errno;
1498e7c33e29SRobert Watson 	unp2 = unp->unp_conn;
1499e7c33e29SRobert Watson 	if (unp2 == NULL)
1500e7c33e29SRobert Watson 		return;
1501e7c33e29SRobert Watson 
1502e7c33e29SRobert Watson 	UNP_PCB_LOCK(unp2);
1503e7c33e29SRobert Watson 	unp_disconnect(unp, unp2);
1504e7c33e29SRobert Watson 	UNP_PCB_UNLOCK(unp2);
1505df8bae1dSRodney W. Grimes }
1506df8bae1dSRodney W. Grimes 
15072bc21ed9SDavid Malone static void
1508892af6b9SRobert Watson unp_freerights(struct file **rp, int fdcount)
1509df8bae1dSRodney W. Grimes {
15102bc21ed9SDavid Malone 	int i;
15112bc21ed9SDavid Malone 	struct file *fp;
1512df8bae1dSRodney W. Grimes 
15132bc21ed9SDavid Malone 	for (i = 0; i < fdcount; i++) {
15148692c025SYoshinobu Inoue 		/*
15151c381b19SRobert Watson 		 * Zero the pointer before calling unp_discard since it may
15161c381b19SRobert Watson 		 * end up in unp_gc()..
1517d7dca903SRobert Watson 		 *
1518d7dca903SRobert Watson 		 * XXXRW: This is less true than it used to be.
15198692c025SYoshinobu Inoue 		 */
1520e7c33e29SRobert Watson 		fp = *rp;
1521e7c33e29SRobert Watson 		*rp++ = NULL;
15228692c025SYoshinobu Inoue 		unp_discard(fp);
1523df8bae1dSRodney W. Grimes 	}
15242bc21ed9SDavid Malone }
15252bc21ed9SDavid Malone 
15262bc21ed9SDavid Malone int
1527892af6b9SRobert Watson unp_externalize(struct mbuf *control, struct mbuf **controlp)
15282bc21ed9SDavid Malone {
15292bc21ed9SDavid Malone 	struct thread *td = curthread;		/* XXX */
15302bc21ed9SDavid Malone 	struct cmsghdr *cm = mtod(control, struct cmsghdr *);
15312bc21ed9SDavid Malone 	int i;
15322bc21ed9SDavid Malone 	int *fdp;
15332bc21ed9SDavid Malone 	struct file **rp;
15342bc21ed9SDavid Malone 	struct file *fp;
15352bc21ed9SDavid Malone 	void *data;
15362bc21ed9SDavid Malone 	socklen_t clen = control->m_len, datalen;
15372bc21ed9SDavid Malone 	int error, newfds;
15382bc21ed9SDavid Malone 	int f;
15392bc21ed9SDavid Malone 	u_int newlen;
15402bc21ed9SDavid Malone 
1541e7c33e29SRobert Watson 	UNP_GLOBAL_UNLOCK_ASSERT();
15424c5bc1caSRobert Watson 
15432bc21ed9SDavid Malone 	error = 0;
15442bc21ed9SDavid Malone 	if (controlp != NULL) /* controlp == NULL => free control messages */
15452bc21ed9SDavid Malone 		*controlp = NULL;
15462bc21ed9SDavid Malone 
15472bc21ed9SDavid Malone 	while (cm != NULL) {
15482bc21ed9SDavid Malone 		if (sizeof(*cm) > clen || cm->cmsg_len > clen) {
15492bc21ed9SDavid Malone 			error = EINVAL;
15502bc21ed9SDavid Malone 			break;
15512bc21ed9SDavid Malone 		}
15522bc21ed9SDavid Malone 
15532bc21ed9SDavid Malone 		data = CMSG_DATA(cm);
15542bc21ed9SDavid Malone 		datalen = (caddr_t)cm + cm->cmsg_len - (caddr_t)data;
15552bc21ed9SDavid Malone 
15562bc21ed9SDavid Malone 		if (cm->cmsg_level == SOL_SOCKET
15572bc21ed9SDavid Malone 		    && cm->cmsg_type == SCM_RIGHTS) {
15582bc21ed9SDavid Malone 			newfds = datalen / sizeof(struct file *);
15592bc21ed9SDavid Malone 			rp = data;
15602bc21ed9SDavid Malone 
1561e2f9a08bSOlivier Houchard 			/* If we're not outputting the descriptors free them. */
15622bc21ed9SDavid Malone 			if (error || controlp == NULL) {
15632bc21ed9SDavid Malone 				unp_freerights(rp, newfds);
15642bc21ed9SDavid Malone 				goto next;
15652bc21ed9SDavid Malone 			}
15665e3f7694SRobert Watson 			FILEDESC_XLOCK(td->td_proc->p_fd);
15672bc21ed9SDavid Malone 			/* if the new FD's will not fit free them.  */
15682bc21ed9SDavid Malone 			if (!fdavail(td, newfds)) {
15695e3f7694SRobert Watson 				FILEDESC_XUNLOCK(td->td_proc->p_fd);
15702bc21ed9SDavid Malone 				error = EMSGSIZE;
15712bc21ed9SDavid Malone 				unp_freerights(rp, newfds);
15722bc21ed9SDavid Malone 				goto next;
1573df8bae1dSRodney W. Grimes 			}
157460a5ef26SRobert Watson 
1575ed5b7817SJulian Elischer 			/*
15761c381b19SRobert Watson 			 * Now change each pointer to an fd in the global
15771c381b19SRobert Watson 			 * table to an integer that is the index to the local
15781c381b19SRobert Watson 			 * fd table entry that we set up to point to the
15791c381b19SRobert Watson 			 * global one we are transferring.
1580ed5b7817SJulian Elischer 			 */
15812bc21ed9SDavid Malone 			newlen = newfds * sizeof(int);
15822bc21ed9SDavid Malone 			*controlp = sbcreatecontrol(NULL, newlen,
15832bc21ed9SDavid Malone 			    SCM_RIGHTS, SOL_SOCKET);
15842bc21ed9SDavid Malone 			if (*controlp == NULL) {
15855e3f7694SRobert Watson 				FILEDESC_XUNLOCK(td->td_proc->p_fd);
15862bc21ed9SDavid Malone 				error = E2BIG;
15872bc21ed9SDavid Malone 				unp_freerights(rp, newfds);
15882bc21ed9SDavid Malone 				goto next;
15892bc21ed9SDavid Malone 			}
15902bc21ed9SDavid Malone 
15912bc21ed9SDavid Malone 			fdp = (int *)
15922bc21ed9SDavid Malone 			    CMSG_DATA(mtod(*controlp, struct cmsghdr *));
1593df8bae1dSRodney W. Grimes 			for (i = 0; i < newfds; i++) {
1594a6d4491cSDag-Erling Smørgrav 				if (fdalloc(td, 0, &f))
15952bc21ed9SDavid Malone 					panic("unp_externalize fdalloc failed");
15968692c025SYoshinobu Inoue 				fp = *rp++;
1597b40ce416SJulian Elischer 				td->td_proc->p_fd->fd_ofiles[f] = fp;
1598397c19d1SJeff Roberson 				unp_externalize_fp(fp);
15998692c025SYoshinobu Inoue 				*fdp++ = f;
1600df8bae1dSRodney W. Grimes 			}
16015e3f7694SRobert Watson 			FILEDESC_XUNLOCK(td->td_proc->p_fd);
16021c381b19SRobert Watson 		} else {
16031c381b19SRobert Watson 			/* We can just copy anything else across. */
16042bc21ed9SDavid Malone 			if (error || controlp == NULL)
16052bc21ed9SDavid Malone 				goto next;
16062bc21ed9SDavid Malone 			*controlp = sbcreatecontrol(NULL, datalen,
16072bc21ed9SDavid Malone 			    cm->cmsg_type, cm->cmsg_level);
16082bc21ed9SDavid Malone 			if (*controlp == NULL) {
16092bc21ed9SDavid Malone 				error = ENOBUFS;
16102bc21ed9SDavid Malone 				goto next;
16112bc21ed9SDavid Malone 			}
16122bc21ed9SDavid Malone 			bcopy(data,
16132bc21ed9SDavid Malone 			    CMSG_DATA(mtod(*controlp, struct cmsghdr *)),
16142bc21ed9SDavid Malone 			    datalen);
16152bc21ed9SDavid Malone 		}
16162bc21ed9SDavid Malone 
16172bc21ed9SDavid Malone 		controlp = &(*controlp)->m_next;
16182bc21ed9SDavid Malone 
16192bc21ed9SDavid Malone next:
16202bc21ed9SDavid Malone 		if (CMSG_SPACE(datalen) < clen) {
16212bc21ed9SDavid Malone 			clen -= CMSG_SPACE(datalen);
16222bc21ed9SDavid Malone 			cm = (struct cmsghdr *)
16232bc21ed9SDavid Malone 			    ((caddr_t)cm + CMSG_SPACE(datalen));
16248692c025SYoshinobu Inoue 		} else {
16252bc21ed9SDavid Malone 			clen = 0;
16262bc21ed9SDavid Malone 			cm = NULL;
16278692c025SYoshinobu Inoue 		}
16288692c025SYoshinobu Inoue 	}
16298692c025SYoshinobu Inoue 
16302bc21ed9SDavid Malone 	m_freem(control);
16312bc21ed9SDavid Malone 
16322bc21ed9SDavid Malone 	return (error);
1633df8bae1dSRodney W. Grimes }
1634df8bae1dSRodney W. Grimes 
16354f590175SPaul Saab static void
16364f590175SPaul Saab unp_zone_change(void *tag)
16374f590175SPaul Saab {
16384f590175SPaul Saab 
16394f590175SPaul Saab 	uma_zone_set_max(unp_zone, maxsockets);
16404f590175SPaul Saab }
16414f590175SPaul Saab 
164298271db4SGarrett Wollman void
164398271db4SGarrett Wollman unp_init(void)
164498271db4SGarrett Wollman {
16451c381b19SRobert Watson 
16469e9d298aSJeff Roberson 	unp_zone = uma_zcreate("unpcb", sizeof(struct unpcb), NULL, NULL,
16479ae328fcSJohn Baldwin 	    NULL, NULL, UMA_ALIGN_PTR, 0);
1648fc3fcacfSRobert Watson 	if (unp_zone == NULL)
164998271db4SGarrett Wollman 		panic("unp_init");
16504f590175SPaul Saab 	uma_zone_set_max(unp_zone, maxsockets);
16514f590175SPaul Saab 	EVENTHANDLER_REGISTER(maxsockets_change, unp_zone_change,
16524f590175SPaul Saab 	    NULL, EVENTHANDLER_PRI_ANY);
165398271db4SGarrett Wollman 	LIST_INIT(&unp_dhead);
165498271db4SGarrett Wollman 	LIST_INIT(&unp_shead);
1655a0ec558aSRobert Watson 	TASK_INIT(&unp_gc_task, 0, unp_gc, NULL);
1656e7c33e29SRobert Watson 	UNP_GLOBAL_LOCK_INIT();
165798271db4SGarrett Wollman }
165898271db4SGarrett Wollman 
1659f708ef1bSPoul-Henning Kamp static int
1660892af6b9SRobert Watson unp_internalize(struct mbuf **controlp, struct thread *td)
1661df8bae1dSRodney W. Grimes {
16622bc21ed9SDavid Malone 	struct mbuf *control = *controlp;
1663b40ce416SJulian Elischer 	struct proc *p = td->td_proc;
16648692c025SYoshinobu Inoue 	struct filedesc *fdescp = p->p_fd;
16652bc21ed9SDavid Malone 	struct cmsghdr *cm = mtod(control, struct cmsghdr *);
16662bc21ed9SDavid Malone 	struct cmsgcred *cmcred;
16672bc21ed9SDavid Malone 	struct file **rp;
16682bc21ed9SDavid Malone 	struct file *fp;
16692bc21ed9SDavid Malone 	struct timeval *tv;
16702bc21ed9SDavid Malone 	int i, fd, *fdp;
16712bc21ed9SDavid Malone 	void *data;
16722bc21ed9SDavid Malone 	socklen_t clen = control->m_len, datalen;
16732bc21ed9SDavid Malone 	int error, oldfds;
16748692c025SYoshinobu Inoue 	u_int newlen;
1675df8bae1dSRodney W. Grimes 
1676e7c33e29SRobert Watson 	UNP_GLOBAL_UNLOCK_ASSERT();
16774c5bc1caSRobert Watson 
16782bc21ed9SDavid Malone 	error = 0;
16792bc21ed9SDavid Malone 	*controlp = NULL;
16800b788fa1SBill Paul 
16812bc21ed9SDavid Malone 	while (cm != NULL) {
16822bc21ed9SDavid Malone 		if (sizeof(*cm) > clen || cm->cmsg_level != SOL_SOCKET
16832bc21ed9SDavid Malone 		    || cm->cmsg_len > clen) {
16842bc21ed9SDavid Malone 			error = EINVAL;
16852bc21ed9SDavid Malone 			goto out;
16862bc21ed9SDavid Malone 		}
16872bc21ed9SDavid Malone 
16882bc21ed9SDavid Malone 		data = CMSG_DATA(cm);
16892bc21ed9SDavid Malone 		datalen = (caddr_t)cm + cm->cmsg_len - (caddr_t)data;
16902bc21ed9SDavid Malone 
16912bc21ed9SDavid Malone 		switch (cm->cmsg_type) {
16920b788fa1SBill Paul 		/*
16930b788fa1SBill Paul 		 * Fill in credential information.
16940b788fa1SBill Paul 		 */
16952bc21ed9SDavid Malone 		case SCM_CREDS:
16962bc21ed9SDavid Malone 			*controlp = sbcreatecontrol(NULL, sizeof(*cmcred),
16972bc21ed9SDavid Malone 			    SCM_CREDS, SOL_SOCKET);
16982bc21ed9SDavid Malone 			if (*controlp == NULL) {
16992bc21ed9SDavid Malone 				error = ENOBUFS;
17002bc21ed9SDavid Malone 				goto out;
17012bc21ed9SDavid Malone 			}
17022bc21ed9SDavid Malone 
17032bc21ed9SDavid Malone 			cmcred = (struct cmsgcred *)
17042bc21ed9SDavid Malone 			    CMSG_DATA(mtod(*controlp, struct cmsghdr *));
17050b788fa1SBill Paul 			cmcred->cmcred_pid = p->p_pid;
1706a854ed98SJohn Baldwin 			cmcred->cmcred_uid = td->td_ucred->cr_ruid;
1707a854ed98SJohn Baldwin 			cmcred->cmcred_gid = td->td_ucred->cr_rgid;
1708a854ed98SJohn Baldwin 			cmcred->cmcred_euid = td->td_ucred->cr_uid;
1709a854ed98SJohn Baldwin 			cmcred->cmcred_ngroups = MIN(td->td_ucred->cr_ngroups,
17100b788fa1SBill Paul 							CMGROUP_MAX);
17110b788fa1SBill Paul 			for (i = 0; i < cmcred->cmcred_ngroups; i++)
17122bc21ed9SDavid Malone 				cmcred->cmcred_groups[i] =
1713a854ed98SJohn Baldwin 				    td->td_ucred->cr_groups[i];
17142bc21ed9SDavid Malone 			break;
17150b788fa1SBill Paul 
17162bc21ed9SDavid Malone 		case SCM_RIGHTS:
17172bc21ed9SDavid Malone 			oldfds = datalen / sizeof (int);
1718ed5b7817SJulian Elischer 			/*
17191c381b19SRobert Watson 			 * Check that all the FDs passed in refer to legal
17201c381b19SRobert Watson 			 * files.  If not, reject the entire operation.
1721ed5b7817SJulian Elischer 			 */
17222bc21ed9SDavid Malone 			fdp = data;
17235e3f7694SRobert Watson 			FILEDESC_SLOCK(fdescp);
1724df8bae1dSRodney W. Grimes 			for (i = 0; i < oldfds; i++) {
17258692c025SYoshinobu Inoue 				fd = *fdp++;
17268692c025SYoshinobu Inoue 				if ((unsigned)fd >= fdescp->fd_nfiles ||
17272bc21ed9SDavid Malone 				    fdescp->fd_ofiles[fd] == NULL) {
17285e3f7694SRobert Watson 					FILEDESC_SUNLOCK(fdescp);
17292bc21ed9SDavid Malone 					error = EBADF;
17302bc21ed9SDavid Malone 					goto out;
17312bc21ed9SDavid Malone 				}
1732e7d6662fSAlfred Perlstein 				fp = fdescp->fd_ofiles[fd];
1733e7d6662fSAlfred Perlstein 				if (!(fp->f_ops->fo_flags & DFLAG_PASSABLE)) {
17345e3f7694SRobert Watson 					FILEDESC_SUNLOCK(fdescp);
1735e7d6662fSAlfred Perlstein 					error = EOPNOTSUPP;
1736e7d6662fSAlfred Perlstein 					goto out;
1737e7d6662fSAlfred Perlstein 				}
1738e7d6662fSAlfred Perlstein 
1739df8bae1dSRodney W. Grimes 			}
17405e3f7694SRobert Watson 
1741ed5b7817SJulian Elischer 			/*
1742e7c33e29SRobert Watson 			 * Now replace the integer FDs with pointers to
1743e7c33e29SRobert Watson 			 * the associated global file table entry..
1744ed5b7817SJulian Elischer 			 */
17452bc21ed9SDavid Malone 			newlen = oldfds * sizeof(struct file *);
17462bc21ed9SDavid Malone 			*controlp = sbcreatecontrol(NULL, newlen,
17472bc21ed9SDavid Malone 			    SCM_RIGHTS, SOL_SOCKET);
17482bc21ed9SDavid Malone 			if (*controlp == NULL) {
17495e3f7694SRobert Watson 				FILEDESC_SUNLOCK(fdescp);
17502bc21ed9SDavid Malone 				error = E2BIG;
17512bc21ed9SDavid Malone 				goto out;
17528692c025SYoshinobu Inoue 			}
17538692c025SYoshinobu Inoue 
17542bc21ed9SDavid Malone 			fdp = data;
17552bc21ed9SDavid Malone 			rp = (struct file **)
17562bc21ed9SDavid Malone 			    CMSG_DATA(mtod(*controlp, struct cmsghdr *));
17578692c025SYoshinobu Inoue 			for (i = 0; i < oldfds; i++) {
17588692c025SYoshinobu Inoue 				fp = fdescp->fd_ofiles[*fdp++];
1759df8bae1dSRodney W. Grimes 				*rp++ = fp;
1760397c19d1SJeff Roberson 				unp_internalize_fp(fp);
1761df8bae1dSRodney W. Grimes 			}
17625e3f7694SRobert Watson 			FILEDESC_SUNLOCK(fdescp);
17632bc21ed9SDavid Malone 			break;
17642bc21ed9SDavid Malone 
17652bc21ed9SDavid Malone 		case SCM_TIMESTAMP:
17662bc21ed9SDavid Malone 			*controlp = sbcreatecontrol(NULL, sizeof(*tv),
17672bc21ed9SDavid Malone 			    SCM_TIMESTAMP, SOL_SOCKET);
17682bc21ed9SDavid Malone 			if (*controlp == NULL) {
17692bc21ed9SDavid Malone 				error = ENOBUFS;
17702bc21ed9SDavid Malone 				goto out;
17718692c025SYoshinobu Inoue 			}
17722bc21ed9SDavid Malone 			tv = (struct timeval *)
17732bc21ed9SDavid Malone 			    CMSG_DATA(mtod(*controlp, struct cmsghdr *));
17742bc21ed9SDavid Malone 			microtime(tv);
17752bc21ed9SDavid Malone 			break;
17762bc21ed9SDavid Malone 
17772bc21ed9SDavid Malone 		default:
17782bc21ed9SDavid Malone 			error = EINVAL;
17792bc21ed9SDavid Malone 			goto out;
17802bc21ed9SDavid Malone 		}
17812bc21ed9SDavid Malone 
17822bc21ed9SDavid Malone 		controlp = &(*controlp)->m_next;
17832bc21ed9SDavid Malone 
17842bc21ed9SDavid Malone 		if (CMSG_SPACE(datalen) < clen) {
17852bc21ed9SDavid Malone 			clen -= CMSG_SPACE(datalen);
17862bc21ed9SDavid Malone 			cm = (struct cmsghdr *)
17872bc21ed9SDavid Malone 			    ((caddr_t)cm + CMSG_SPACE(datalen));
17882bc21ed9SDavid Malone 		} else {
17892bc21ed9SDavid Malone 			clen = 0;
17902bc21ed9SDavid Malone 			cm = NULL;
17912bc21ed9SDavid Malone 		}
17922bc21ed9SDavid Malone 	}
17932bc21ed9SDavid Malone 
17942bc21ed9SDavid Malone out:
17952bc21ed9SDavid Malone 	m_freem(control);
17962bc21ed9SDavid Malone 
17972bc21ed9SDavid Malone 	return (error);
1798df8bae1dSRodney W. Grimes }
1799df8bae1dSRodney W. Grimes 
18005b950deaSRobert Watson static struct mbuf *
18016a2989fdSMatthew N. Dodd unp_addsockcred(struct thread *td, struct mbuf *control)
18026a2989fdSMatthew N. Dodd {
180370df31f4SMaxim Konovalov 	struct mbuf *m, *n, *n_prev;
18046a2989fdSMatthew N. Dodd 	struct sockcred *sc;
180570df31f4SMaxim Konovalov 	const struct cmsghdr *cm;
18066a2989fdSMatthew N. Dodd 	int ngroups;
18076a2989fdSMatthew N. Dodd 	int i;
18086a2989fdSMatthew N. Dodd 
18096a2989fdSMatthew N. Dodd 	ngroups = MIN(td->td_ucred->cr_ngroups, CMGROUP_MAX);
18106a2989fdSMatthew N. Dodd 
18116a2989fdSMatthew N. Dodd 	m = sbcreatecontrol(NULL, SOCKCREDSIZE(ngroups), SCM_CREDS, SOL_SOCKET);
18126a2989fdSMatthew N. Dodd 	if (m == NULL)
18136a2989fdSMatthew N. Dodd 		return (control);
18146a2989fdSMatthew N. Dodd 
18156a2989fdSMatthew N. Dodd 	sc = (struct sockcred *) CMSG_DATA(mtod(m, struct cmsghdr *));
18166a2989fdSMatthew N. Dodd 	sc->sc_uid = td->td_ucred->cr_ruid;
18176a2989fdSMatthew N. Dodd 	sc->sc_euid = td->td_ucred->cr_uid;
18186a2989fdSMatthew N. Dodd 	sc->sc_gid = td->td_ucred->cr_rgid;
18196a2989fdSMatthew N. Dodd 	sc->sc_egid = td->td_ucred->cr_gid;
18206a2989fdSMatthew N. Dodd 	sc->sc_ngroups = ngroups;
18216a2989fdSMatthew N. Dodd 	for (i = 0; i < sc->sc_ngroups; i++)
18226a2989fdSMatthew N. Dodd 		sc->sc_groups[i] = td->td_ucred->cr_groups[i];
18236a2989fdSMatthew N. Dodd 
18246a2989fdSMatthew N. Dodd 	/*
18251c381b19SRobert Watson 	 * Unlink SCM_CREDS control messages (struct cmsgcred), since just
18261c381b19SRobert Watson 	 * created SCM_CREDS control message (struct sockcred) has another
18271c381b19SRobert Watson 	 * format.
18286a2989fdSMatthew N. Dodd 	 */
182970df31f4SMaxim Konovalov 	if (control != NULL)
183070df31f4SMaxim Konovalov 		for (n = control, n_prev = NULL; n != NULL;) {
183170df31f4SMaxim Konovalov 			cm = mtod(n, struct cmsghdr *);
183270df31f4SMaxim Konovalov     			if (cm->cmsg_level == SOL_SOCKET &&
183370df31f4SMaxim Konovalov 			    cm->cmsg_type == SCM_CREDS) {
183470df31f4SMaxim Konovalov     				if (n_prev == NULL)
183570df31f4SMaxim Konovalov 					control = n->m_next;
183670df31f4SMaxim Konovalov 				else
183770df31f4SMaxim Konovalov 					n_prev->m_next = n->m_next;
183870df31f4SMaxim Konovalov 				n = m_free(n);
183970df31f4SMaxim Konovalov 			} else {
184070df31f4SMaxim Konovalov 				n_prev = n;
184170df31f4SMaxim Konovalov 				n = n->m_next;
184270df31f4SMaxim Konovalov 			}
184370df31f4SMaxim Konovalov 		}
18446a2989fdSMatthew N. Dodd 
184570df31f4SMaxim Konovalov 	/* Prepend it to the head. */
184670df31f4SMaxim Konovalov 	m->m_next = control;
184770df31f4SMaxim Konovalov 
184870df31f4SMaxim Konovalov 	return (m);
18496a2989fdSMatthew N. Dodd }
18506a2989fdSMatthew N. Dodd 
1851397c19d1SJeff Roberson static struct unpcb *
1852397c19d1SJeff Roberson fptounp(struct file *fp)
1853397c19d1SJeff Roberson {
1854397c19d1SJeff Roberson 	struct socket *so;
1855397c19d1SJeff Roberson 
1856397c19d1SJeff Roberson 	if (fp->f_type != DTYPE_SOCKET)
1857397c19d1SJeff Roberson 		return (NULL);
1858397c19d1SJeff Roberson 	if ((so = fp->f_data) == NULL)
1859397c19d1SJeff Roberson 		return (NULL);
1860397c19d1SJeff Roberson 	if (so->so_proto->pr_domain != &localdomain)
1861397c19d1SJeff Roberson 		return (NULL);
1862397c19d1SJeff Roberson 	return sotounpcb(so);
1863397c19d1SJeff Roberson }
1864397c19d1SJeff Roberson 
1865397c19d1SJeff Roberson static void
1866397c19d1SJeff Roberson unp_discard(struct file *fp)
1867397c19d1SJeff Roberson {
1868397c19d1SJeff Roberson 
1869397c19d1SJeff Roberson 	unp_externalize_fp(fp);
1870397c19d1SJeff Roberson 	(void) closef(fp, (struct thread *)NULL);
1871397c19d1SJeff Roberson }
1872397c19d1SJeff Roberson 
1873397c19d1SJeff Roberson static void
1874397c19d1SJeff Roberson unp_internalize_fp(struct file *fp)
1875397c19d1SJeff Roberson {
1876397c19d1SJeff Roberson 	struct unpcb *unp;
1877397c19d1SJeff Roberson 
1878397c19d1SJeff Roberson 	UNP_GLOBAL_WLOCK();
1879397c19d1SJeff Roberson 	if ((unp = fptounp(fp)) != NULL) {
1880397c19d1SJeff Roberson 		unp->unp_file = fp;
1881397c19d1SJeff Roberson 		unp->unp_msgcount++;
1882397c19d1SJeff Roberson 	}
188341e0f66dSJeff Roberson 	fhold(fp);
1884397c19d1SJeff Roberson 	unp_rights++;
1885397c19d1SJeff Roberson 	UNP_GLOBAL_WUNLOCK();
1886397c19d1SJeff Roberson }
1887397c19d1SJeff Roberson 
1888397c19d1SJeff Roberson static void
1889397c19d1SJeff Roberson unp_externalize_fp(struct file *fp)
1890397c19d1SJeff Roberson {
1891397c19d1SJeff Roberson 	struct unpcb *unp;
1892397c19d1SJeff Roberson 
1893397c19d1SJeff Roberson 	UNP_GLOBAL_WLOCK();
1894397c19d1SJeff Roberson 	if ((unp = fptounp(fp)) != NULL)
1895397c19d1SJeff Roberson 		unp->unp_msgcount--;
1896397c19d1SJeff Roberson 	unp_rights--;
1897397c19d1SJeff Roberson 	UNP_GLOBAL_WUNLOCK();
1898397c19d1SJeff Roberson }
1899397c19d1SJeff Roberson 
1900161a0c7cSRobert Watson /*
1901a0ec558aSRobert Watson  * unp_defer indicates whether additional work has been defered for a future
1902a0ec558aSRobert Watson  * pass through unp_gc().  It is thread local and does not require explicit
1903a0ec558aSRobert Watson  * synchronization.
1904161a0c7cSRobert Watson  */
1905397c19d1SJeff Roberson static int	unp_marked;
1906397c19d1SJeff Roberson static int	unp_unreachable;
1907a0ec558aSRobert Watson 
1908397c19d1SJeff Roberson static void
1909397c19d1SJeff Roberson unp_accessable(struct file *fp)
1910397c19d1SJeff Roberson {
1911397c19d1SJeff Roberson 	struct unpcb *unp;
1912397c19d1SJeff Roberson 
19136f552cb0SJeff Roberson 	if ((unp = fptounp(fp)) == NULL)
1914397c19d1SJeff Roberson 		return;
1915397c19d1SJeff Roberson 	if (unp->unp_gcflag & UNPGC_REF)
1916397c19d1SJeff Roberson 		return;
1917397c19d1SJeff Roberson 	unp->unp_gcflag &= ~UNPGC_DEAD;
1918397c19d1SJeff Roberson 	unp->unp_gcflag |= UNPGC_REF;
1919397c19d1SJeff Roberson 	unp_marked++;
1920397c19d1SJeff Roberson }
1921397c19d1SJeff Roberson 
1922397c19d1SJeff Roberson static void
1923397c19d1SJeff Roberson unp_gc_process(struct unpcb *unp)
1924397c19d1SJeff Roberson {
1925397c19d1SJeff Roberson 	struct socket *soa;
1926397c19d1SJeff Roberson 	struct socket *so;
1927397c19d1SJeff Roberson 	struct file *fp;
1928397c19d1SJeff Roberson 
1929397c19d1SJeff Roberson 	/* Already processed. */
1930397c19d1SJeff Roberson 	if (unp->unp_gcflag & UNPGC_SCANNED)
1931397c19d1SJeff Roberson 		return;
1932397c19d1SJeff Roberson 	fp = unp->unp_file;
193360a5ef26SRobert Watson 
1934397c19d1SJeff Roberson 	/*
1935397c19d1SJeff Roberson 	 * Check for a socket potentially in a cycle.  It must be in a
1936397c19d1SJeff Roberson 	 * queue as indicated by msgcount, and this must equal the file
1937397c19d1SJeff Roberson 	 * reference count.  Note that when msgcount is 0 the file is NULL.
1938397c19d1SJeff Roberson 	 */
193941e0f66dSJeff Roberson 	if ((unp->unp_gcflag & UNPGC_REF) == 0 && fp &&
194041e0f66dSJeff Roberson 	    unp->unp_msgcount != 0 && fp->f_count == unp->unp_msgcount) {
1941397c19d1SJeff Roberson 		unp->unp_gcflag |= UNPGC_DEAD;
1942397c19d1SJeff Roberson 		unp_unreachable++;
1943397c19d1SJeff Roberson 		return;
1944397c19d1SJeff Roberson 	}
194560a5ef26SRobert Watson 
1946397c19d1SJeff Roberson 	/*
1947397c19d1SJeff Roberson 	 * Mark all sockets we reference with RIGHTS.
1948397c19d1SJeff Roberson 	 */
1949397c19d1SJeff Roberson 	so = unp->unp_socket;
1950397c19d1SJeff Roberson 	SOCKBUF_LOCK(&so->so_rcv);
1951397c19d1SJeff Roberson 	unp_scan(so->so_rcv.sb_mb, unp_accessable);
1952397c19d1SJeff Roberson 	SOCKBUF_UNLOCK(&so->so_rcv);
195360a5ef26SRobert Watson 
1954397c19d1SJeff Roberson 	/*
1955397c19d1SJeff Roberson 	 * Mark all sockets in our accept queue.
1956397c19d1SJeff Roberson 	 */
1957397c19d1SJeff Roberson 	ACCEPT_LOCK();
1958397c19d1SJeff Roberson 	TAILQ_FOREACH(soa, &so->so_comp, so_list) {
1959397c19d1SJeff Roberson 		SOCKBUF_LOCK(&soa->so_rcv);
1960397c19d1SJeff Roberson 		unp_scan(soa->so_rcv.sb_mb, unp_accessable);
1961397c19d1SJeff Roberson 		SOCKBUF_UNLOCK(&soa->so_rcv);
1962397c19d1SJeff Roberson 	}
1963397c19d1SJeff Roberson 	ACCEPT_UNLOCK();
1964397c19d1SJeff Roberson 	unp->unp_gcflag |= UNPGC_SCANNED;
1965397c19d1SJeff Roberson }
1966a0ec558aSRobert Watson 
1967a0ec558aSRobert Watson static int unp_recycled;
1968be6b1304STom Rhodes SYSCTL_INT(_net_local, OID_AUTO, recycled, CTLFLAG_RD, &unp_recycled, 0,
1969be6b1304STom Rhodes     "Number of unreachable sockets claimed by the garbage collector.");
1970df8bae1dSRodney W. Grimes 
1971397c19d1SJeff Roberson static int unp_taskcount;
1972be6b1304STom Rhodes SYSCTL_INT(_net_local, OID_AUTO, taskcount, CTLFLAG_RD, &unp_taskcount, 0,
1973be6b1304STom Rhodes     "Number of times the garbage collector has run.");
1974397c19d1SJeff Roberson 
1975f708ef1bSPoul-Henning Kamp static void
1976a0ec558aSRobert Watson unp_gc(__unused void *arg, int pending)
1977df8bae1dSRodney W. Grimes {
1978397c19d1SJeff Roberson 	struct unp_head *heads[] = { &unp_dhead, &unp_shead, NULL };
1979397c19d1SJeff Roberson 	struct unp_head **head;
1980397c19d1SJeff Roberson 	struct file **unref;
1981397c19d1SJeff Roberson 	struct unpcb *unp;
1982397c19d1SJeff Roberson 	int i;
1983df8bae1dSRodney W. Grimes 
1984a0ec558aSRobert Watson 	unp_taskcount++;
1985397c19d1SJeff Roberson 	UNP_GLOBAL_RLOCK();
1986ed5b7817SJulian Elischer 	/*
1987397c19d1SJeff Roberson 	 * First clear all gc flags from previous runs.
1988ed5b7817SJulian Elischer 	 */
1989397c19d1SJeff Roberson 	for (head = heads; *head != NULL; head++)
1990397c19d1SJeff Roberson 		LIST_FOREACH(unp, *head, unp_link)
199141e0f66dSJeff Roberson 			unp->unp_gcflag = 0;
199260a5ef26SRobert Watson 
1993397c19d1SJeff Roberson 	/*
1994397c19d1SJeff Roberson 	 * Scan marking all reachable sockets with UNPGC_REF.  Once a socket
1995397c19d1SJeff Roberson 	 * is reachable all of the sockets it references are reachable.
1996397c19d1SJeff Roberson 	 * Stop the scan once we do a complete loop without discovering
1997397c19d1SJeff Roberson 	 * a new reachable socket.
1998397c19d1SJeff Roberson 	 */
1999df8bae1dSRodney W. Grimes 	do {
2000397c19d1SJeff Roberson 		unp_unreachable = 0;
2001397c19d1SJeff Roberson 		unp_marked = 0;
2002397c19d1SJeff Roberson 		for (head = heads; *head != NULL; head++)
2003397c19d1SJeff Roberson 			LIST_FOREACH(unp, *head, unp_link)
2004397c19d1SJeff Roberson 				unp_gc_process(unp);
2005397c19d1SJeff Roberson 	} while (unp_marked);
2006397c19d1SJeff Roberson 	UNP_GLOBAL_RUNLOCK();
2007397c19d1SJeff Roberson 	if (unp_unreachable == 0)
2008397c19d1SJeff Roberson 		return;
200960a5ef26SRobert Watson 
2010ed5b7817SJulian Elischer 	/*
2011397c19d1SJeff Roberson 	 * Allocate space for a local list of dead unpcbs.
2012ed5b7817SJulian Elischer 	 */
2013397c19d1SJeff Roberson 	unref = malloc(unp_unreachable * sizeof(struct file *),
2014397c19d1SJeff Roberson 	    M_TEMP, M_WAITOK);
201560a5ef26SRobert Watson 
2016ed5b7817SJulian Elischer 	/*
2017397c19d1SJeff Roberson 	 * Iterate looking for sockets which have been specifically marked
2018397c19d1SJeff Roberson 	 * as as unreachable and store them locally.
2019ed5b7817SJulian Elischer 	 */
2020397c19d1SJeff Roberson 	UNP_GLOBAL_RLOCK();
2021397c19d1SJeff Roberson 	for (i = 0, head = heads; *head != NULL; head++)
2022397c19d1SJeff Roberson 		LIST_FOREACH(unp, *head, unp_link)
2023397c19d1SJeff Roberson 			if (unp->unp_gcflag & UNPGC_DEAD) {
2024397c19d1SJeff Roberson 				unref[i++] = unp->unp_file;
202541e0f66dSJeff Roberson 				fhold(unp->unp_file);
2026397c19d1SJeff Roberson 				KASSERT(unp->unp_file != NULL,
2027397c19d1SJeff Roberson 				    ("unp_gc: Invalid unpcb."));
2028397c19d1SJeff Roberson 				KASSERT(i <= unp_unreachable,
2029397c19d1SJeff Roberson 				    ("unp_gc: incorrect unreachable count."));
2030397c19d1SJeff Roberson 			}
2031397c19d1SJeff Roberson 	UNP_GLOBAL_RUNLOCK();
203260a5ef26SRobert Watson 
2033ed5b7817SJulian Elischer 	/*
2034397c19d1SJeff Roberson 	 * Now flush all sockets, free'ing rights.  This will free the
2035397c19d1SJeff Roberson 	 * struct files associated with these sockets but leave each socket
2036397c19d1SJeff Roberson 	 * with one remaining ref.
2037ed5b7817SJulian Elischer 	 */
2038397c19d1SJeff Roberson 	for (i = 0; i < unp_unreachable; i++)
2039397c19d1SJeff Roberson 		sorflush(unref[i]->f_data);
204060a5ef26SRobert Watson 
2041ed5b7817SJulian Elischer 	/*
2042397c19d1SJeff Roberson 	 * And finally release the sockets so they can be reclaimed.
2043ed5b7817SJulian Elischer 	 */
2044397c19d1SJeff Roberson 	for (i = 0; i < unp_unreachable; i++)
2045397c19d1SJeff Roberson 		fdrop(unref[i], NULL);
2046397c19d1SJeff Roberson 	unp_recycled += unp_unreachable;
2047397c19d1SJeff Roberson 	free(unref, M_TEMP);
2048df8bae1dSRodney W. Grimes }
2049df8bae1dSRodney W. Grimes 
205026f9a767SRodney W. Grimes void
2051892af6b9SRobert Watson unp_dispose(struct mbuf *m)
2052df8bae1dSRodney W. Grimes {
2053996c772fSJohn Dyson 
2054df8bae1dSRodney W. Grimes 	if (m)
2055df8bae1dSRodney W. Grimes 		unp_scan(m, unp_discard);
2056df8bae1dSRodney W. Grimes }
2057df8bae1dSRodney W. Grimes 
2058f708ef1bSPoul-Henning Kamp static void
2059892af6b9SRobert Watson unp_scan(struct mbuf *m0, void (*op)(struct file *))
2060df8bae1dSRodney W. Grimes {
20612bc21ed9SDavid Malone 	struct mbuf *m;
20622bc21ed9SDavid Malone 	struct file **rp;
20632bc21ed9SDavid Malone 	struct cmsghdr *cm;
20642bc21ed9SDavid Malone 	void *data;
20652bc21ed9SDavid Malone 	int i;
20662bc21ed9SDavid Malone 	socklen_t clen, datalen;
2067df8bae1dSRodney W. Grimes 	int qfds;
2068df8bae1dSRodney W. Grimes 
2069fc3fcacfSRobert Watson 	while (m0 != NULL) {
20702bc21ed9SDavid Malone 		for (m = m0; m; m = m->m_next) {
207112396bdcSDavid Malone 			if (m->m_type != MT_CONTROL)
2072df8bae1dSRodney W. Grimes 				continue;
20732bc21ed9SDavid Malone 
20742bc21ed9SDavid Malone 			cm = mtod(m, struct cmsghdr *);
20752bc21ed9SDavid Malone 			clen = m->m_len;
20762bc21ed9SDavid Malone 
20772bc21ed9SDavid Malone 			while (cm != NULL) {
20782bc21ed9SDavid Malone 				if (sizeof(*cm) > clen || cm->cmsg_len > clen)
20792bc21ed9SDavid Malone 					break;
20802bc21ed9SDavid Malone 
20812bc21ed9SDavid Malone 				data = CMSG_DATA(cm);
20822bc21ed9SDavid Malone 				datalen = (caddr_t)cm + cm->cmsg_len
20832bc21ed9SDavid Malone 				    - (caddr_t)data;
20842bc21ed9SDavid Malone 
20852bc21ed9SDavid Malone 				if (cm->cmsg_level == SOL_SOCKET &&
20862bc21ed9SDavid Malone 				    cm->cmsg_type == SCM_RIGHTS) {
20872bc21ed9SDavid Malone 					qfds = datalen / sizeof (struct file *);
20882bc21ed9SDavid Malone 					rp = data;
2089df8bae1dSRodney W. Grimes 					for (i = 0; i < qfds; i++)
2090df8bae1dSRodney W. Grimes 						(*op)(*rp++);
20912bc21ed9SDavid Malone 				}
20922bc21ed9SDavid Malone 
20932bc21ed9SDavid Malone 				if (CMSG_SPACE(datalen) < clen) {
20942bc21ed9SDavid Malone 					clen -= CMSG_SPACE(datalen);
20952bc21ed9SDavid Malone 					cm = (struct cmsghdr *)
20962bc21ed9SDavid Malone 					    ((caddr_t)cm + CMSG_SPACE(datalen));
20972bc21ed9SDavid Malone 				} else {
20982bc21ed9SDavid Malone 					clen = 0;
20992bc21ed9SDavid Malone 					cm = NULL;
21002bc21ed9SDavid Malone 				}
21012bc21ed9SDavid Malone 			}
2102df8bae1dSRodney W. Grimes 		}
2103df8bae1dSRodney W. Grimes 		m0 = m0->m_act;
2104df8bae1dSRodney W. Grimes 	}
2105df8bae1dSRodney W. Grimes }
2106df8bae1dSRodney W. Grimes 
210703c96c31SRobert Watson #ifdef DDB
210803c96c31SRobert Watson static void
210903c96c31SRobert Watson db_print_indent(int indent)
211003c96c31SRobert Watson {
211103c96c31SRobert Watson 	int i;
211203c96c31SRobert Watson 
211303c96c31SRobert Watson 	for (i = 0; i < indent; i++)
211403c96c31SRobert Watson 		db_printf(" ");
211503c96c31SRobert Watson }
211603c96c31SRobert Watson 
211703c96c31SRobert Watson static void
211803c96c31SRobert Watson db_print_unpflags(int unp_flags)
211903c96c31SRobert Watson {
212003c96c31SRobert Watson 	int comma;
212103c96c31SRobert Watson 
212203c96c31SRobert Watson 	comma = 0;
212303c96c31SRobert Watson 	if (unp_flags & UNP_HAVEPC) {
212403c96c31SRobert Watson 		db_printf("%sUNP_HAVEPC", comma ? ", " : "");
212503c96c31SRobert Watson 		comma = 1;
212603c96c31SRobert Watson 	}
212703c96c31SRobert Watson 	if (unp_flags & UNP_HAVEPCCACHED) {
212803c96c31SRobert Watson 		db_printf("%sUNP_HAVEPCCACHED", comma ? ", " : "");
212903c96c31SRobert Watson 		comma = 1;
213003c96c31SRobert Watson 	}
213103c96c31SRobert Watson 	if (unp_flags & UNP_WANTCRED) {
213203c96c31SRobert Watson 		db_printf("%sUNP_WANTCRED", comma ? ", " : "");
213303c96c31SRobert Watson 		comma = 1;
213403c96c31SRobert Watson 	}
213503c96c31SRobert Watson 	if (unp_flags & UNP_CONNWAIT) {
213603c96c31SRobert Watson 		db_printf("%sUNP_CONNWAIT", comma ? ", " : "");
213703c96c31SRobert Watson 		comma = 1;
213803c96c31SRobert Watson 	}
213903c96c31SRobert Watson 	if (unp_flags & UNP_CONNECTING) {
214003c96c31SRobert Watson 		db_printf("%sUNP_CONNECTING", comma ? ", " : "");
214103c96c31SRobert Watson 		comma = 1;
214203c96c31SRobert Watson 	}
214303c96c31SRobert Watson 	if (unp_flags & UNP_BINDING) {
214403c96c31SRobert Watson 		db_printf("%sUNP_BINDING", comma ? ", " : "");
214503c96c31SRobert Watson 		comma = 1;
214603c96c31SRobert Watson 	}
214703c96c31SRobert Watson }
214803c96c31SRobert Watson 
214903c96c31SRobert Watson static void
215003c96c31SRobert Watson db_print_xucred(int indent, struct xucred *xu)
215103c96c31SRobert Watson {
215203c96c31SRobert Watson 	int comma, i;
215303c96c31SRobert Watson 
215403c96c31SRobert Watson 	db_print_indent(indent);
215503c96c31SRobert Watson 	db_printf("cr_version: %u   cr_uid: %u   cr_ngroups: %d\n",
215603c96c31SRobert Watson 	    xu->cr_version, xu->cr_uid, xu->cr_ngroups);
215703c96c31SRobert Watson 	db_print_indent(indent);
215803c96c31SRobert Watson 	db_printf("cr_groups: ");
215903c96c31SRobert Watson 	comma = 0;
216003c96c31SRobert Watson 	for (i = 0; i < xu->cr_ngroups; i++) {
216103c96c31SRobert Watson 		db_printf("%s%u", comma ? ", " : "", xu->cr_groups[i]);
216203c96c31SRobert Watson 		comma = 1;
216303c96c31SRobert Watson 	}
216403c96c31SRobert Watson 	db_printf("\n");
216503c96c31SRobert Watson }
216603c96c31SRobert Watson 
216703c96c31SRobert Watson static void
216803c96c31SRobert Watson db_print_unprefs(int indent, struct unp_head *uh)
216903c96c31SRobert Watson {
217003c96c31SRobert Watson 	struct unpcb *unp;
217103c96c31SRobert Watson 	int counter;
217203c96c31SRobert Watson 
217303c96c31SRobert Watson 	counter = 0;
217403c96c31SRobert Watson 	LIST_FOREACH(unp, uh, unp_reflink) {
217503c96c31SRobert Watson 		if (counter % 4 == 0)
217603c96c31SRobert Watson 			db_print_indent(indent);
217703c96c31SRobert Watson 		db_printf("%p  ", unp);
217803c96c31SRobert Watson 		if (counter % 4 == 3)
217903c96c31SRobert Watson 			db_printf("\n");
218003c96c31SRobert Watson 		counter++;
218103c96c31SRobert Watson 	}
218203c96c31SRobert Watson 	if (counter != 0 && counter % 4 != 0)
218303c96c31SRobert Watson 		db_printf("\n");
218403c96c31SRobert Watson }
218503c96c31SRobert Watson 
218603c96c31SRobert Watson DB_SHOW_COMMAND(unpcb, db_show_unpcb)
218703c96c31SRobert Watson {
218803c96c31SRobert Watson 	struct unpcb *unp;
218903c96c31SRobert Watson 
219003c96c31SRobert Watson         if (!have_addr) {
219103c96c31SRobert Watson                 db_printf("usage: show unpcb <addr>\n");
219203c96c31SRobert Watson                 return;
219303c96c31SRobert Watson         }
219403c96c31SRobert Watson         unp = (struct unpcb *)addr;
219503c96c31SRobert Watson 
219603c96c31SRobert Watson 	db_printf("unp_socket: %p   unp_vnode: %p\n", unp->unp_socket,
219703c96c31SRobert Watson 	    unp->unp_vnode);
219803c96c31SRobert Watson 
219903c96c31SRobert Watson 	db_printf("unp_ino: %d   unp_conn: %p\n", unp->unp_ino,
220003c96c31SRobert Watson 	    unp->unp_conn);
220103c96c31SRobert Watson 
220203c96c31SRobert Watson 	db_printf("unp_refs:\n");
220303c96c31SRobert Watson 	db_print_unprefs(2, &unp->unp_refs);
220403c96c31SRobert Watson 
220503c96c31SRobert Watson 	/* XXXRW: Would be nice to print the full address, if any. */
220603c96c31SRobert Watson 	db_printf("unp_addr: %p\n", unp->unp_addr);
220703c96c31SRobert Watson 
220803c96c31SRobert Watson 	db_printf("unp_cc: %d   unp_mbcnt: %d   unp_gencnt: %llu\n",
220903c96c31SRobert Watson 	    unp->unp_cc, unp->unp_mbcnt,
221003c96c31SRobert Watson 	    (unsigned long long)unp->unp_gencnt);
221103c96c31SRobert Watson 
221203c96c31SRobert Watson 	db_printf("unp_flags: %x (", unp->unp_flags);
221303c96c31SRobert Watson 	db_print_unpflags(unp->unp_flags);
221403c96c31SRobert Watson 	db_printf(")\n");
221503c96c31SRobert Watson 
221603c96c31SRobert Watson 	db_printf("unp_peercred:\n");
221703c96c31SRobert Watson 	db_print_xucred(2, &unp->unp_peercred);
221803c96c31SRobert Watson 
221903c96c31SRobert Watson 	db_printf("unp_refcount: %u\n", unp->unp_refcount);
222003c96c31SRobert Watson }
222103c96c31SRobert Watson #endif
2222