xref: /freebsd/sys/kern/uipc_usrreq.c (revision 6ceacebdf5221133943ab3b6b56751c8b51c3e2b)
19454b2d8SWarner Losh /*-
251369649SPedro F. Giffuni  * SPDX-License-Identifier: BSD-3-Clause
351369649SPedro F. Giffuni  *
4df8bae1dSRodney W. Grimes  * Copyright (c) 1982, 1986, 1989, 1991, 1993
5f344fb0bSWarner Losh  *	The Regents of the University of California. All Rights Reserved.
6f344fb0bSWarner Losh  * Copyright (c) 2004-2009 Robert N. M. Watson All Rights Reserved.
7c0874c34SMatt Macy  * Copyright (c) 2018 Matthew Macy
8df8bae1dSRodney W. Grimes  *
9df8bae1dSRodney W. Grimes  * Redistribution and use in source and binary forms, with or without
10df8bae1dSRodney W. Grimes  * modification, are permitted provided that the following conditions
11df8bae1dSRodney W. Grimes  * are met:
12df8bae1dSRodney W. Grimes  * 1. Redistributions of source code must retain the above copyright
13df8bae1dSRodney W. Grimes  *    notice, this list of conditions and the following disclaimer.
14df8bae1dSRodney W. Grimes  * 2. Redistributions in binary form must reproduce the above copyright
15df8bae1dSRodney W. Grimes  *    notice, this list of conditions and the following disclaimer in the
16df8bae1dSRodney W. Grimes  *    documentation and/or other materials provided with the distribution.
1769a28758SEd Maste  * 3. Neither the name of the University nor the names of its contributors
18df8bae1dSRodney W. Grimes  *    may be used to endorse or promote products derived from this software
19df8bae1dSRodney W. Grimes  *    without specific prior written permission.
20df8bae1dSRodney W. Grimes  *
21df8bae1dSRodney W. Grimes  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
22df8bae1dSRodney W. Grimes  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23df8bae1dSRodney W. Grimes  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24df8bae1dSRodney W. Grimes  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
25df8bae1dSRodney W. Grimes  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26df8bae1dSRodney W. Grimes  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27df8bae1dSRodney W. Grimes  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28df8bae1dSRodney W. Grimes  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29df8bae1dSRodney W. Grimes  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30df8bae1dSRodney W. Grimes  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31df8bae1dSRodney W. Grimes  * SUCH DAMAGE.
32df8bae1dSRodney W. Grimes  *
33748e0b0aSGarrett Wollman  *	From: @(#)uipc_usrreq.c	8.3 (Berkeley) 1/4/94
34df8bae1dSRodney W. Grimes  */
35df8bae1dSRodney W. Grimes 
36f23929fbSRobert Watson /*
37f23929fbSRobert Watson  * UNIX Domain (Local) Sockets
38f23929fbSRobert Watson  *
39f23929fbSRobert Watson  * This is an implementation of UNIX (local) domain sockets.  Each socket has
40f23929fbSRobert Watson  * an associated struct unpcb (UNIX protocol control block).  Stream sockets
41f23929fbSRobert Watson  * may be connected to 0 or 1 other socket.  Datagram sockets may be
42f23929fbSRobert Watson  * connected to 0, 1, or many other sockets.  Sockets may be created and
43f23929fbSRobert Watson  * connected in pairs (socketpair(2)), or bound/connected to using the file
44f23929fbSRobert Watson  * system name space.  For most purposes, only the receive socket buffer is
45f23929fbSRobert Watson  * used, as sending on one socket delivers directly to the receive socket
465b950deaSRobert Watson  * buffer of a second socket.
475b950deaSRobert Watson  *
485b950deaSRobert Watson  * The implementation is substantially complicated by the fact that
495b950deaSRobert Watson  * "ancillary data", such as file descriptors or credentials, may be passed
505b950deaSRobert Watson  * across UNIX domain sockets.  The potential for passing UNIX domain sockets
515b950deaSRobert Watson  * over other UNIX domain sockets requires the implementation of a simple
525b950deaSRobert Watson  * garbage collector to find and tear down cycles of disconnected sockets.
53aea52f1bSRobert Watson  *
54aea52f1bSRobert Watson  * TODO:
5584d61770SRobert Watson  *	RDM
56aea52f1bSRobert Watson  *	rethink name space problems
57aea52f1bSRobert Watson  *	need a proper out-of-band
58f23929fbSRobert Watson  */
59f23929fbSRobert Watson 
60677b542eSDavid E. O'Brien #include <sys/cdefs.h>
61677b542eSDavid E. O'Brien __FBSDID("$FreeBSD$");
62677b542eSDavid E. O'Brien 
6303c96c31SRobert Watson #include "opt_ddb.h"
64335654d7SRobert Watson 
65df8bae1dSRodney W. Grimes #include <sys/param.h>
664a144410SRobert Watson #include <sys/capsicum.h>
67fb919e4dSMark Murray #include <sys/domain.h>
684f590175SPaul Saab #include <sys/eventhandler.h>
69d5cbccecSMark Johnston #include <sys/fcntl.h>
70639acc13SGarrett Wollman #include <sys/file.h>
71960ed29cSSeigo Tanimura #include <sys/filedesc.h>
72960ed29cSSeigo Tanimura #include <sys/kernel.h>
73960ed29cSSeigo Tanimura #include <sys/lock.h>
74d5cbccecSMark Johnston #include <sys/malloc.h>
75639acc13SGarrett Wollman #include <sys/mbuf.h>
76033eb86eSJeff Roberson #include <sys/mount.h>
77960ed29cSSeigo Tanimura #include <sys/mutex.h>
78639acc13SGarrett Wollman #include <sys/namei.h>
79639acc13SGarrett Wollman #include <sys/proc.h>
80df8bae1dSRodney W. Grimes #include <sys/protosw.h>
810cb64678SKonstantin Belousov #include <sys/queue.h>
82960ed29cSSeigo Tanimura #include <sys/resourcevar.h>
83e7c33e29SRobert Watson #include <sys/rwlock.h>
84df8bae1dSRodney W. Grimes #include <sys/socket.h>
85df8bae1dSRodney W. Grimes #include <sys/socketvar.h>
86960ed29cSSeigo Tanimura #include <sys/signalvar.h>
87df8bae1dSRodney W. Grimes #include <sys/stat.h>
88960ed29cSSeigo Tanimura #include <sys/sx.h>
89639acc13SGarrett Wollman #include <sys/sysctl.h>
90960ed29cSSeigo Tanimura #include <sys/systm.h>
91a0ec558aSRobert Watson #include <sys/taskqueue.h>
92639acc13SGarrett Wollman #include <sys/un.h>
9398271db4SGarrett Wollman #include <sys/unpcb.h>
94639acc13SGarrett Wollman #include <sys/vnode.h>
95530c0060SRobert Watson 
96530c0060SRobert Watson #include <net/vnet.h>
97df8bae1dSRodney W. Grimes 
9803c96c31SRobert Watson #ifdef DDB
9903c96c31SRobert Watson #include <ddb/ddb.h>
10003c96c31SRobert Watson #endif
10103c96c31SRobert Watson 
102aed55708SRobert Watson #include <security/mac/mac_framework.h>
103aed55708SRobert Watson 
1049e9d298aSJeff Roberson #include <vm/uma.h>
10598271db4SGarrett Wollman 
1068cb539f1SPawel Jakub Dawidek MALLOC_DECLARE(M_FILECAPS);
1078cb539f1SPawel Jakub Dawidek 
1083dab55bcSRobert Watson /*
109d5cbccecSMark Johnston  * See unpcb.h for the locking key.
1103dab55bcSRobert Watson  */
1113dab55bcSRobert Watson 
1129e9d298aSJeff Roberson static uma_zone_t	unp_zone;
1133dab55bcSRobert Watson static unp_gen_t	unp_gencnt;	/* (l) */
1143dab55bcSRobert Watson static u_int		unp_count;	/* (l) Count of local sockets. */
115aea52f1bSRobert Watson static ino_t		unp_ino;	/* Prototype for fake inode numbers. */
1163dab55bcSRobert Watson static int		unp_rights;	/* (g) File descriptors in flight. */
1173dab55bcSRobert Watson static struct unp_head	unp_shead;	/* (l) List of stream sockets. */
1183dab55bcSRobert Watson static struct unp_head	unp_dhead;	/* (l) List of datagram sockets. */
11984d61770SRobert Watson static struct unp_head	unp_sphead;	/* (l) List of seqpacket sockets. */
12098271db4SGarrett Wollman 
1210cb64678SKonstantin Belousov struct unp_defer {
1220cb64678SKonstantin Belousov 	SLIST_ENTRY(unp_defer) ud_link;
1230cb64678SKonstantin Belousov 	struct file *ud_fp;
1240cb64678SKonstantin Belousov };
1250cb64678SKonstantin Belousov static SLIST_HEAD(, unp_defer) unp_defers;
1260cb64678SKonstantin Belousov static int unp_defers_count;
1270cb64678SKonstantin Belousov 
128aea52f1bSRobert Watson static const struct sockaddr	sun_noname = { sizeof(sun_noname), AF_LOCAL };
12998271db4SGarrett Wollman 
130df8bae1dSRodney W. Grimes /*
131aea52f1bSRobert Watson  * Garbage collection of cyclic file descriptor/socket references occurs
132aea52f1bSRobert Watson  * asynchronously in a taskqueue context in order to avoid recursion and
133aea52f1bSRobert Watson  * reentrance in the UNIX domain socket, file descriptor, and socket layer
134aea52f1bSRobert Watson  * code.  See unp_gc() for a full description.
135df8bae1dSRodney W. Grimes  */
136daee0f0bSKonstantin Belousov static struct timeout_task unp_gc_task;
137f708ef1bSPoul-Henning Kamp 
138ce5f32deSRobert Watson /*
1390cb64678SKonstantin Belousov  * The close of unix domain sockets attached as SCM_RIGHTS is
1400cb64678SKonstantin Belousov  * postponed to the taskqueue, to avoid arbitrary recursion depth.
1410cb64678SKonstantin Belousov  * The attached sockets might have another sockets attached.
1420cb64678SKonstantin Belousov  */
1430cb64678SKonstantin Belousov static struct task	unp_defer_task;
1440cb64678SKonstantin Belousov 
1450cb64678SKonstantin Belousov /*
1467e711c3aSRobert Watson  * Both send and receive buffers are allocated PIPSIZ bytes of buffering for
1477e711c3aSRobert Watson  * stream sockets, although the total for sender and receiver is actually
1487e711c3aSRobert Watson  * only PIPSIZ.
1497e711c3aSRobert Watson  *
1507e711c3aSRobert Watson  * Datagram sockets really use the sendspace as the maximum datagram size,
1517e711c3aSRobert Watson  * and don't really want to reserve the sendspace.  Their recvspace should be
1527e711c3aSRobert Watson  * large enough for at least one max-size datagram plus address.
1537e711c3aSRobert Watson  */
1547e711c3aSRobert Watson #ifndef PIPSIZ
1557e711c3aSRobert Watson #define	PIPSIZ	8192
1567e711c3aSRobert Watson #endif
1577e711c3aSRobert Watson static u_long	unpst_sendspace = PIPSIZ;
1587e711c3aSRobert Watson static u_long	unpst_recvspace = PIPSIZ;
1597e711c3aSRobert Watson static u_long	unpdg_sendspace = 2*1024;	/* really max datagram size */
1607e711c3aSRobert Watson static u_long	unpdg_recvspace = 4*1024;
16184d61770SRobert Watson static u_long	unpsp_sendspace = PIPSIZ;	/* really max datagram size */
16284d61770SRobert Watson static u_long	unpsp_recvspace = PIPSIZ;
1637e711c3aSRobert Watson 
1647029da5cSPawel Biernacki static SYSCTL_NODE(_net, PF_LOCAL, local, CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
1657029da5cSPawel Biernacki     "Local domain");
1667029da5cSPawel Biernacki static SYSCTL_NODE(_net_local, SOCK_STREAM, stream,
1677029da5cSPawel Biernacki     CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
1686472ac3dSEd Schouten     "SOCK_STREAM");
1697029da5cSPawel Biernacki static SYSCTL_NODE(_net_local, SOCK_DGRAM, dgram,
1707029da5cSPawel Biernacki     CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
1717029da5cSPawel Biernacki     "SOCK_DGRAM");
1727029da5cSPawel Biernacki static SYSCTL_NODE(_net_local, SOCK_SEQPACKET, seqpacket,
1737029da5cSPawel Biernacki     CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
17484d61770SRobert Watson     "SOCK_SEQPACKET");
175e4445a03SRobert Watson 
1767e711c3aSRobert Watson SYSCTL_ULONG(_net_local_stream, OID_AUTO, sendspace, CTLFLAG_RW,
177be6b1304STom Rhodes 	   &unpst_sendspace, 0, "Default stream send space.");
1787e711c3aSRobert Watson SYSCTL_ULONG(_net_local_stream, OID_AUTO, recvspace, CTLFLAG_RW,
179be6b1304STom Rhodes 	   &unpst_recvspace, 0, "Default stream receive space.");
1807e711c3aSRobert Watson SYSCTL_ULONG(_net_local_dgram, OID_AUTO, maxdgram, CTLFLAG_RW,
181be6b1304STom Rhodes 	   &unpdg_sendspace, 0, "Default datagram send space.");
1827e711c3aSRobert Watson SYSCTL_ULONG(_net_local_dgram, OID_AUTO, recvspace, CTLFLAG_RW,
183be6b1304STom Rhodes 	   &unpdg_recvspace, 0, "Default datagram receive space.");
18484d61770SRobert Watson SYSCTL_ULONG(_net_local_seqpacket, OID_AUTO, maxseqpacket, CTLFLAG_RW,
18584d61770SRobert Watson 	   &unpsp_sendspace, 0, "Default seqpacket send space.");
18684d61770SRobert Watson SYSCTL_ULONG(_net_local_seqpacket, OID_AUTO, recvspace, CTLFLAG_RW,
18784d61770SRobert Watson 	   &unpsp_recvspace, 0, "Default seqpacket receive space.");
188be6b1304STom Rhodes SYSCTL_INT(_net_local, OID_AUTO, inflight, CTLFLAG_RD, &unp_rights, 0,
189be6b1304STom Rhodes     "File descriptors in flight.");
1900cb64678SKonstantin Belousov SYSCTL_INT(_net_local, OID_AUTO, deferred, CTLFLAG_RD,
1910cb64678SKonstantin Belousov     &unp_defers_count, 0,
1920cb64678SKonstantin Belousov     "File descriptors deferred to taskqueue for close.");
1937e711c3aSRobert Watson 
194175389cfSEdward Tomasz Napierala /*
195e7c33e29SRobert Watson  * Locking and synchronization:
196ce5f32deSRobert Watson  *
197d5cbccecSMark Johnston  * Several types of locks exist in the local domain socket implementation:
198d5cbccecSMark Johnston  * - a global linkage lock
199d5cbccecSMark Johnston  * - a global connection list lock
200d5cbccecSMark Johnston  * - the mtxpool lock
201d5cbccecSMark Johnston  * - per-unpcb mutexes
202d5cbccecSMark Johnston  *
203d5cbccecSMark Johnston  * The linkage lock protects the global socket lists, the generation number
204d5cbccecSMark Johnston  * counter and garbage collector state.
205d5cbccecSMark Johnston  *
206d5cbccecSMark Johnston  * The connection list lock protects the list of referring sockets in a datagram
207d5cbccecSMark Johnston  * socket PCB.  This lock is also overloaded to protect a global list of
208d5cbccecSMark Johnston  * sockets whose buffers contain socket references in the form of SCM_RIGHTS
209d5cbccecSMark Johnston  * messages.  To avoid recursion, such references are released by a dedicated
210d5cbccecSMark Johnston  * thread.
21175a67bf3SMatt Macy  *
21275a67bf3SMatt Macy  * The mtxpool lock protects the vnode from being modified while referenced.
213d5cbccecSMark Johnston  * Lock ordering rules require that it be acquired before any PCB locks.
21475a67bf3SMatt Macy  *
215d5cbccecSMark Johnston  * The unpcb lock (unp_mtx) protects the most commonly referenced fields in the
216d5cbccecSMark Johnston  * unpcb.  This includes the unp_conn field, which either links two connected
217d5cbccecSMark Johnston  * PCBs together (for connected socket types) or points at the destination
218d5cbccecSMark Johnston  * socket (for connectionless socket types).  The operations of creating or
219d5cbccecSMark Johnston  * destroying a connection therefore involve locking multiple PCBs.  To avoid
220d5cbccecSMark Johnston  * lock order reversals, in some cases this involves dropping a PCB lock and
221d5cbccecSMark Johnston  * using a reference counter to maintain liveness.
222ce5f32deSRobert Watson  *
223e7c33e29SRobert Watson  * UNIX domain sockets each have an unpcb hung off of their so_pcb pointer,
224e7c33e29SRobert Watson  * allocated in pru_attach() and freed in pru_detach().  The validity of that
225e7c33e29SRobert Watson  * pointer is an invariant, so no lock is required to dereference the so_pcb
226e7c33e29SRobert Watson  * pointer if a valid socket reference is held by the caller.  In practice,
227e7c33e29SRobert Watson  * this is always true during operations performed on a socket.  Each unpcb
228e7c33e29SRobert Watson  * has a back-pointer to its socket, unp_socket, which will be stable under
229e7c33e29SRobert Watson  * the same circumstances.
230e7c33e29SRobert Watson  *
231e7c33e29SRobert Watson  * This pointer may only be safely dereferenced as long as a valid reference
232e7c33e29SRobert Watson  * to the unpcb is held.  Typically, this reference will be from the socket,
233e7c33e29SRobert Watson  * or from another unpcb when the referring unpcb's lock is held (in order
234e7c33e29SRobert Watson  * that the reference not be invalidated during use).  For example, to follow
23575a67bf3SMatt Macy  * unp->unp_conn->unp_socket, you need to hold a lock on unp_conn to guarantee
23675a67bf3SMatt Macy  * that detach is not run clearing unp_socket.
237e7c33e29SRobert Watson  *
238e7c33e29SRobert Watson  * Blocking with UNIX domain sockets is a tricky issue: unlike most network
239e7c33e29SRobert Watson  * protocols, bind() is a non-atomic operation, and connect() requires
240e7c33e29SRobert Watson  * potential sleeping in the protocol, due to potentially waiting on local or
241e7c33e29SRobert Watson  * distributed file systems.  We try to separate "lookup" operations, which
242e7c33e29SRobert Watson  * may sleep, and the IPC operations themselves, which typically can occur
243e7c33e29SRobert Watson  * with relative atomicity as locks can be held over the entire operation.
244e7c33e29SRobert Watson  *
245e7c33e29SRobert Watson  * Another tricky issue is simultaneous multi-threaded or multi-process
246e7c33e29SRobert Watson  * access to a single UNIX domain socket.  These are handled by the flags
247e7c33e29SRobert Watson  * UNP_CONNECTING and UNP_BINDING, which prevent concurrent connecting or
248e7c33e29SRobert Watson  * binding, both of which involve dropping UNIX domain socket locks in order
249e7c33e29SRobert Watson  * to perform namei() and other file system operations.
250ce5f32deSRobert Watson  */
2513dab55bcSRobert Watson static struct rwlock	unp_link_rwlock;
2520cb64678SKonstantin Belousov static struct mtx	unp_defers_lock;
253e7c33e29SRobert Watson 
2543dab55bcSRobert Watson #define	UNP_LINK_LOCK_INIT()		rw_init(&unp_link_rwlock,	\
2553dab55bcSRobert Watson 					    "unp_link_rwlock")
256e7c33e29SRobert Watson 
2573dab55bcSRobert Watson #define	UNP_LINK_LOCK_ASSERT()		rw_assert(&unp_link_rwlock,	\
258e7c33e29SRobert Watson 					    RA_LOCKED)
2593dab55bcSRobert Watson #define	UNP_LINK_UNLOCK_ASSERT()	rw_assert(&unp_link_rwlock,	\
260e7c33e29SRobert Watson 					    RA_UNLOCKED)
261e7c33e29SRobert Watson 
2623dab55bcSRobert Watson #define	UNP_LINK_RLOCK()		rw_rlock(&unp_link_rwlock)
2633dab55bcSRobert Watson #define	UNP_LINK_RUNLOCK()		rw_runlock(&unp_link_rwlock)
2643dab55bcSRobert Watson #define	UNP_LINK_WLOCK()		rw_wlock(&unp_link_rwlock)
2653dab55bcSRobert Watson #define	UNP_LINK_WUNLOCK()		rw_wunlock(&unp_link_rwlock)
2663dab55bcSRobert Watson #define	UNP_LINK_WLOCK_ASSERT()		rw_assert(&unp_link_rwlock,	\
267e7c33e29SRobert Watson 					    RA_WLOCKED)
268779f106aSGleb Smirnoff #define	UNP_LINK_WOWNED()		rw_wowned(&unp_link_rwlock)
269e7c33e29SRobert Watson 
2700cb64678SKonstantin Belousov #define	UNP_DEFERRED_LOCK_INIT()	mtx_init(&unp_defers_lock, \
2710cb64678SKonstantin Belousov 					    "unp_defer", NULL, MTX_DEF)
2720cb64678SKonstantin Belousov #define	UNP_DEFERRED_LOCK()		mtx_lock(&unp_defers_lock)
2730cb64678SKonstantin Belousov #define	UNP_DEFERRED_UNLOCK()		mtx_unlock(&unp_defers_lock)
2740cb64678SKonstantin Belousov 
27575a67bf3SMatt Macy #define UNP_REF_LIST_LOCK()		UNP_DEFERRED_LOCK();
27675a67bf3SMatt Macy #define UNP_REF_LIST_UNLOCK()		UNP_DEFERRED_UNLOCK();
27775a67bf3SMatt Macy 
278e7c33e29SRobert Watson #define UNP_PCB_LOCK_INIT(unp)		mtx_init(&(unp)->unp_mtx,	\
279d9525340SMatt Macy 					    "unp", "unp",	\
28075a67bf3SMatt Macy 					    MTX_DUPOK|MTX_DEF)
281e7c33e29SRobert Watson #define	UNP_PCB_LOCK_DESTROY(unp)	mtx_destroy(&(unp)->unp_mtx)
282ccdadf1aSMark Johnston #define	UNP_PCB_LOCKPTR(unp)		(&(unp)->unp_mtx)
283e7c33e29SRobert Watson #define	UNP_PCB_LOCK(unp)		mtx_lock(&(unp)->unp_mtx)
28475a67bf3SMatt Macy #define	UNP_PCB_TRYLOCK(unp)		mtx_trylock(&(unp)->unp_mtx)
285e7c33e29SRobert Watson #define	UNP_PCB_UNLOCK(unp)		mtx_unlock(&(unp)->unp_mtx)
28675a67bf3SMatt Macy #define	UNP_PCB_OWNED(unp)		mtx_owned(&(unp)->unp_mtx)
287e7c33e29SRobert Watson #define	UNP_PCB_LOCK_ASSERT(unp)	mtx_assert(&(unp)->unp_mtx, MA_OWNED)
28875a67bf3SMatt Macy #define	UNP_PCB_UNLOCK_ASSERT(unp)	mtx_assert(&(unp)->unp_mtx, MA_NOTOWNED)
2890d9ce3a1SRobert Watson 
2902c899584SRobert Watson static int	uipc_connect2(struct socket *, struct socket *);
2910b36cd25SRobert Watson static int	uipc_ctloutput(struct socket *, struct sockopt *);
292aea52f1bSRobert Watson static int	unp_connect(struct socket *, struct sockaddr *,
293aea52f1bSRobert Watson 		    struct thread *);
2947493f24eSPawel Jakub Dawidek static int	unp_connectat(int, struct socket *, struct sockaddr *,
2957493f24eSPawel Jakub Dawidek 		    struct thread *);
2966a2989fdSMatthew N. Dodd static int	unp_connect2(struct socket *so, struct socket *so2, int);
297e7c33e29SRobert Watson static void	unp_disconnect(struct unpcb *unp, struct unpcb *unp2);
29899ab95dbSMark Johnston static void	unp_dispose(struct socket *so);
29999ab95dbSMark Johnston static void	unp_dispose_mbuf(struct mbuf *);
3004d77a549SAlfred Perlstein static void	unp_shutdown(struct unpcb *);
301afc055d9SEd Schouten static void	unp_drop(struct unpcb *);
302a0ec558aSRobert Watson static void	unp_gc(__unused void *, int);
303be26ba7cSPawel Jakub Dawidek static void	unp_scan(struct mbuf *, void (*)(struct filedescent **, int));
3044d77a549SAlfred Perlstein static void	unp_discard(struct file *);
3058cb539f1SPawel Jakub Dawidek static void	unp_freerights(struct filedescent **, int);
3060b36cd25SRobert Watson static void	unp_init(void);
3074d77a549SAlfred Perlstein static int	unp_internalize(struct mbuf **, struct thread *);
308397c19d1SJeff Roberson static void	unp_internalize_fp(struct file *);
309c2e3c52eSJilles Tjoelker static int	unp_externalize(struct mbuf *, struct mbuf **, int);
3100cb64678SKonstantin Belousov static int	unp_externalize_fp(struct file *);
311ede4af47SConrad Meyer static struct mbuf	*unp_addsockcred(struct thread *, struct mbuf *, int);
3120cb64678SKonstantin Belousov static void	unp_process_defers(void * __unused, int);
313f708ef1bSPoul-Henning Kamp 
31475a67bf3SMatt Macy static void
31575a67bf3SMatt Macy unp_pcb_hold(struct unpcb *unp)
31675a67bf3SMatt Macy {
3175362170dSMark Johnston 	u_int old __unused;
3185362170dSMark Johnston 
3195362170dSMark Johnston 	old = refcount_acquire(&unp->unp_refcount);
3205362170dSMark Johnston 	KASSERT(old > 0, ("%s: unpcb %p has no references", __func__, unp));
32175a67bf3SMatt Macy }
32275a67bf3SMatt Macy 
3235362170dSMark Johnston static __result_use_check bool
32475a67bf3SMatt Macy unp_pcb_rele(struct unpcb *unp)
32575a67bf3SMatt Macy {
3265362170dSMark Johnston 	bool ret;
32775a67bf3SMatt Macy 
32875a67bf3SMatt Macy 	UNP_PCB_LOCK_ASSERT(unp);
3295362170dSMark Johnston 
3305362170dSMark Johnston 	if ((ret = refcount_release(&unp->unp_refcount))) {
33175a67bf3SMatt Macy 		UNP_PCB_UNLOCK(unp);
33275a67bf3SMatt Macy 		UNP_PCB_LOCK_DESTROY(unp);
33375a67bf3SMatt Macy 		uma_zfree(unp_zone, unp);
33475a67bf3SMatt Macy 	}
3355362170dSMark Johnston 	return (ret);
33675a67bf3SMatt Macy }
33775a67bf3SMatt Macy 
33875a67bf3SMatt Macy static void
339f0317f86SMark Johnston unp_pcb_rele_notlast(struct unpcb *unp)
340f0317f86SMark Johnston {
341f0317f86SMark Johnston 	bool ret __unused;
342f0317f86SMark Johnston 
343f0317f86SMark Johnston 	ret = refcount_release(&unp->unp_refcount);
344f0317f86SMark Johnston 	KASSERT(!ret, ("%s: unpcb %p has no references", __func__, unp));
345f0317f86SMark Johnston }
346f0317f86SMark Johnston 
347f0317f86SMark Johnston static void
3484820bf6aSMark Johnston unp_pcb_lock_pair(struct unpcb *unp, struct unpcb *unp2)
34975a67bf3SMatt Macy {
35075a67bf3SMatt Macy 	UNP_PCB_UNLOCK_ASSERT(unp);
35175a67bf3SMatt Macy 	UNP_PCB_UNLOCK_ASSERT(unp2);
3524820bf6aSMark Johnston 
3534820bf6aSMark Johnston 	if (unp == unp2) {
3544820bf6aSMark Johnston 		UNP_PCB_LOCK(unp);
3554820bf6aSMark Johnston 	} else if ((uintptr_t)unp2 > (uintptr_t)unp) {
35675a67bf3SMatt Macy 		UNP_PCB_LOCK(unp);
35775a67bf3SMatt Macy 		UNP_PCB_LOCK(unp2);
35875a67bf3SMatt Macy 	} else {
35975a67bf3SMatt Macy 		UNP_PCB_LOCK(unp2);
36075a67bf3SMatt Macy 		UNP_PCB_LOCK(unp);
36175a67bf3SMatt Macy 	}
36275a67bf3SMatt Macy }
36375a67bf3SMatt Macy 
3644820bf6aSMark Johnston static void
3654820bf6aSMark Johnston unp_pcb_unlock_pair(struct unpcb *unp, struct unpcb *unp2)
3664820bf6aSMark Johnston {
3674820bf6aSMark Johnston 	UNP_PCB_UNLOCK(unp);
3684820bf6aSMark Johnston 	if (unp != unp2)
3694820bf6aSMark Johnston 		UNP_PCB_UNLOCK(unp2);
3704820bf6aSMark Johnston }
3714820bf6aSMark Johnston 
372ccdadf1aSMark Johnston /*
373ccdadf1aSMark Johnston  * Try to lock the connected peer of an already locked socket.  In some cases
374ccdadf1aSMark Johnston  * this requires that we unlock the current socket.  The pairbusy counter is
375ccdadf1aSMark Johnston  * used to block concurrent connection attempts while the lock is dropped.  The
376ccdadf1aSMark Johnston  * caller must be careful to revalidate PCB state.
377ccdadf1aSMark Johnston  */
378ccdadf1aSMark Johnston static struct unpcb *
379ccdadf1aSMark Johnston unp_pcb_lock_peer(struct unpcb *unp)
38075a67bf3SMatt Macy {
38175a67bf3SMatt Macy 	struct unpcb *unp2;
38275a67bf3SMatt Macy 
383ccdadf1aSMark Johnston 	UNP_PCB_LOCK_ASSERT(unp);
384ccdadf1aSMark Johnston 	unp2 = unp->unp_conn;
3856404d7ffSMateusz Guzik 	if (unp2 == NULL)
386ccdadf1aSMark Johnston 		return (NULL);
387ccdadf1aSMark Johnston 	if (__predict_false(unp == unp2))
388ccdadf1aSMark Johnston 		return (unp);
389ccdadf1aSMark Johnston 
390ccdadf1aSMark Johnston 	UNP_PCB_UNLOCK_ASSERT(unp2);
391ccdadf1aSMark Johnston 
392ccdadf1aSMark Johnston 	if (__predict_true(UNP_PCB_TRYLOCK(unp2)))
393ccdadf1aSMark Johnston 		return (unp2);
394ccdadf1aSMark Johnston 	if ((uintptr_t)unp2 > (uintptr_t)unp) {
395ccdadf1aSMark Johnston 		UNP_PCB_LOCK(unp2);
396ccdadf1aSMark Johnston 		return (unp2);
397ccdadf1aSMark Johnston 	}
398ccdadf1aSMark Johnston 	unp->unp_pairbusy++;
399e62ca80bSMark Johnston 	unp_pcb_hold(unp2);
400e62ca80bSMark Johnston 	UNP_PCB_UNLOCK(unp);
401ccdadf1aSMark Johnston 
402e62ca80bSMark Johnston 	UNP_PCB_LOCK(unp2);
403e62ca80bSMark Johnston 	UNP_PCB_LOCK(unp);
404ccdadf1aSMark Johnston 	KASSERT(unp->unp_conn == unp2 || unp->unp_conn == NULL,
405ccdadf1aSMark Johnston 	    ("%s: socket %p was reconnected", __func__, unp));
406ccdadf1aSMark Johnston 	if (--unp->unp_pairbusy == 0 && (unp->unp_flags & UNP_WAITING) != 0) {
407ccdadf1aSMark Johnston 		unp->unp_flags &= ~UNP_WAITING;
408ccdadf1aSMark Johnston 		wakeup(unp);
40975a67bf3SMatt Macy 	}
410ccdadf1aSMark Johnston 	if (unp_pcb_rele(unp2)) {
411ccdadf1aSMark Johnston 		/* unp2 is unlocked. */
412ccdadf1aSMark Johnston 		return (NULL);
413ccdadf1aSMark Johnston 	}
414ccdadf1aSMark Johnston 	if (unp->unp_conn == NULL) {
415ccdadf1aSMark Johnston 		UNP_PCB_UNLOCK(unp2);
416ccdadf1aSMark Johnston 		return (NULL);
417ccdadf1aSMark Johnston 	}
418ccdadf1aSMark Johnston 	return (unp2);
419ccdadf1aSMark Johnston }
42075a67bf3SMatt Macy 
421e4445a03SRobert Watson /*
422e4445a03SRobert Watson  * Definitions of protocols supported in the LOCAL domain.
423e4445a03SRobert Watson  */
424e4445a03SRobert Watson static struct domain localdomain;
425fa9402f2SRobert Watson static struct pr_usrreqs uipc_usrreqs_dgram, uipc_usrreqs_stream;
42684d61770SRobert Watson static struct pr_usrreqs uipc_usrreqs_seqpacket;
427e4445a03SRobert Watson static struct protosw localsw[] = {
428e4445a03SRobert Watson {
429e4445a03SRobert Watson 	.pr_type =		SOCK_STREAM,
430e4445a03SRobert Watson 	.pr_domain =		&localdomain,
431e4445a03SRobert Watson 	.pr_flags =		PR_CONNREQUIRED|PR_WANTRCVD|PR_RIGHTS,
432e4445a03SRobert Watson 	.pr_ctloutput =		&uipc_ctloutput,
433fa9402f2SRobert Watson 	.pr_usrreqs =		&uipc_usrreqs_stream
434e4445a03SRobert Watson },
435e4445a03SRobert Watson {
436e4445a03SRobert Watson 	.pr_type =		SOCK_DGRAM,
437e4445a03SRobert Watson 	.pr_domain =		&localdomain,
438e4445a03SRobert Watson 	.pr_flags =		PR_ATOMIC|PR_ADDR|PR_RIGHTS,
439aaf63435SGleb Smirnoff 	.pr_ctloutput =		&uipc_ctloutput,
440fa9402f2SRobert Watson 	.pr_usrreqs =		&uipc_usrreqs_dgram
441e4445a03SRobert Watson },
44284d61770SRobert Watson {
44384d61770SRobert Watson 	.pr_type =		SOCK_SEQPACKET,
44484d61770SRobert Watson 	.pr_domain =		&localdomain,
44584d61770SRobert Watson 
44684d61770SRobert Watson 	/*
44784d61770SRobert Watson 	 * XXXRW: For now, PR_ADDR because soreceive will bump into them
44884d61770SRobert Watson 	 * due to our use of sbappendaddr.  A new sbappend variants is needed
44984d61770SRobert Watson 	 * that supports both atomic record writes and control data.
45084d61770SRobert Watson 	 */
45184d61770SRobert Watson 	.pr_flags =		PR_ADDR|PR_ATOMIC|PR_CONNREQUIRED|PR_WANTRCVD|
45284d61770SRobert Watson 				    PR_RIGHTS,
453e0643280SGleb Smirnoff 	.pr_ctloutput =		&uipc_ctloutput,
45484d61770SRobert Watson 	.pr_usrreqs =		&uipc_usrreqs_seqpacket,
45584d61770SRobert Watson },
456e4445a03SRobert Watson };
457e4445a03SRobert Watson 
458e4445a03SRobert Watson static struct domain localdomain = {
459e4445a03SRobert Watson 	.dom_family =		AF_LOCAL,
460e4445a03SRobert Watson 	.dom_name =		"local",
461e4445a03SRobert Watson 	.dom_init =		unp_init,
462e4445a03SRobert Watson 	.dom_externalize =	unp_externalize,
46399ab95dbSMark Johnston 	.dom_dispose =		unp_dispose,
464e4445a03SRobert Watson 	.dom_protosw =		localsw,
46502abd400SPedro F. Giffuni 	.dom_protoswNPROTOSW =	&localsw[nitems(localsw)]
466e4445a03SRobert Watson };
467e4445a03SRobert Watson DOMAIN_SET(local);
468e4445a03SRobert Watson 
469ac45e92fSRobert Watson static void
470a29f300eSGarrett Wollman uipc_abort(struct socket *so)
471df8bae1dSRodney W. Grimes {
472e7c33e29SRobert Watson 	struct unpcb *unp, *unp2;
473df8bae1dSRodney W. Grimes 
47440f2ac28SRobert Watson 	unp = sotounpcb(so);
4754d4b555eSRobert Watson 	KASSERT(unp != NULL, ("uipc_abort: unp == NULL"));
47675a67bf3SMatt Macy 	UNP_PCB_UNLOCK_ASSERT(unp);
477e7c33e29SRobert Watson 
478e7c33e29SRobert Watson 	UNP_PCB_LOCK(unp);
479e7c33e29SRobert Watson 	unp2 = unp->unp_conn;
480e7c33e29SRobert Watson 	if (unp2 != NULL) {
48175a67bf3SMatt Macy 		unp_pcb_hold(unp2);
482e7c33e29SRobert Watson 		UNP_PCB_UNLOCK(unp);
48375a67bf3SMatt Macy 		unp_drop(unp2);
48475a67bf3SMatt Macy 	} else
48575a67bf3SMatt Macy 		UNP_PCB_UNLOCK(unp);
486df8bae1dSRodney W. Grimes }
487df8bae1dSRodney W. Grimes 
488a29f300eSGarrett Wollman static int
48957bf258eSGarrett Wollman uipc_accept(struct socket *so, struct sockaddr **nam)
490a29f300eSGarrett Wollman {
491e7c33e29SRobert Watson 	struct unpcb *unp, *unp2;
4920d9ce3a1SRobert Watson 	const struct sockaddr *sa;
493df8bae1dSRodney W. Grimes 
494df8bae1dSRodney W. Grimes 	/*
4951c381b19SRobert Watson 	 * Pass back name of connected socket, if it was bound and we are
4961c381b19SRobert Watson 	 * still connected (our peer may have closed already!).
497df8bae1dSRodney W. Grimes 	 */
4984d4b555eSRobert Watson 	unp = sotounpcb(so);
4994d4b555eSRobert Watson 	KASSERT(unp != NULL, ("uipc_accept: unp == NULL"));
500e7c33e29SRobert Watson 
5010d9ce3a1SRobert Watson 	*nam = malloc(sizeof(struct sockaddr_un), M_SONAME, M_WAITOK);
50244800027SMark Johnston 	UNP_PCB_LOCK(unp);
50344800027SMark Johnston 	unp2 = unp_pcb_lock_peer(unp);
50444800027SMark Johnston 	if (unp2 != NULL && unp2->unp_addr != NULL)
505e7c33e29SRobert Watson 		sa = (struct sockaddr *)unp2->unp_addr;
50644800027SMark Johnston 	else
5070d9ce3a1SRobert Watson 		sa = &sun_noname;
5080d9ce3a1SRobert Watson 	bcopy(sa, *nam, sa->sa_len);
509b4e07e3dSMark Johnston 	if (unp2 != NULL)
51044800027SMark Johnston 		unp_pcb_unlock_pair(unp, unp2);
511b4e07e3dSMark Johnston 	else
512b4e07e3dSMark Johnston 		UNP_PCB_UNLOCK(unp);
513e5aeaa0cSDag-Erling Smørgrav 	return (0);
514a29f300eSGarrett Wollman }
515df8bae1dSRodney W. Grimes 
516a29f300eSGarrett Wollman static int
517b40ce416SJulian Elischer uipc_attach(struct socket *so, int proto, struct thread *td)
518a29f300eSGarrett Wollman {
519e7c33e29SRobert Watson 	u_long sendspace, recvspace;
5206d32873cSRobert Watson 	struct unpcb *unp;
5213dab55bcSRobert Watson 	int error;
522779f106aSGleb Smirnoff 	bool locked;
523df8bae1dSRodney W. Grimes 
5246d32873cSRobert Watson 	KASSERT(so->so_pcb == NULL, ("uipc_attach: so_pcb != NULL"));
5256d32873cSRobert Watson 	if (so->so_snd.sb_hiwat == 0 || so->so_rcv.sb_hiwat == 0) {
5266d32873cSRobert Watson 		switch (so->so_type) {
5276d32873cSRobert Watson 		case SOCK_STREAM:
528e7c33e29SRobert Watson 			sendspace = unpst_sendspace;
529e7c33e29SRobert Watson 			recvspace = unpst_recvspace;
5306d32873cSRobert Watson 			break;
5316d32873cSRobert Watson 
5326d32873cSRobert Watson 		case SOCK_DGRAM:
533e7c33e29SRobert Watson 			sendspace = unpdg_sendspace;
534e7c33e29SRobert Watson 			recvspace = unpdg_recvspace;
5356d32873cSRobert Watson 			break;
5366d32873cSRobert Watson 
53784d61770SRobert Watson 		case SOCK_SEQPACKET:
53884d61770SRobert Watson 			sendspace = unpsp_sendspace;
53984d61770SRobert Watson 			recvspace = unpsp_recvspace;
54084d61770SRobert Watson 			break;
54184d61770SRobert Watson 
5426d32873cSRobert Watson 		default:
543e7c33e29SRobert Watson 			panic("uipc_attach");
5446d32873cSRobert Watson 		}
545e7c33e29SRobert Watson 		error = soreserve(so, sendspace, recvspace);
5466d32873cSRobert Watson 		if (error)
5476d32873cSRobert Watson 			return (error);
5486d32873cSRobert Watson 	}
54946a1d9bfSRobert Watson 	unp = uma_zalloc(unp_zone, M_NOWAIT | M_ZERO);
5506d32873cSRobert Watson 	if (unp == NULL)
5516d32873cSRobert Watson 		return (ENOBUFS);
5526d32873cSRobert Watson 	LIST_INIT(&unp->unp_refs);
553e7c33e29SRobert Watson 	UNP_PCB_LOCK_INIT(unp);
5546d32873cSRobert Watson 	unp->unp_socket = so;
5556d32873cSRobert Watson 	so->so_pcb = unp;
5565362170dSMark Johnston 	refcount_init(&unp->unp_refcount, 1);
557e7c33e29SRobert Watson 
558779f106aSGleb Smirnoff 	if ((locked = UNP_LINK_WOWNED()) == false)
559779f106aSGleb Smirnoff 		UNP_LINK_WLOCK();
560779f106aSGleb Smirnoff 
5616d32873cSRobert Watson 	unp->unp_gencnt = ++unp_gencnt;
562f218ac50SMateusz Guzik 	unp->unp_ino = ++unp_ino;
5636d32873cSRobert Watson 	unp_count++;
56484d61770SRobert Watson 	switch (so->so_type) {
56584d61770SRobert Watson 	case SOCK_STREAM:
56684d61770SRobert Watson 		LIST_INSERT_HEAD(&unp_shead, unp, unp_link);
56784d61770SRobert Watson 		break;
56884d61770SRobert Watson 
56984d61770SRobert Watson 	case SOCK_DGRAM:
57084d61770SRobert Watson 		LIST_INSERT_HEAD(&unp_dhead, unp, unp_link);
57184d61770SRobert Watson 		break;
57284d61770SRobert Watson 
57384d61770SRobert Watson 	case SOCK_SEQPACKET:
57484d61770SRobert Watson 		LIST_INSERT_HEAD(&unp_sphead, unp, unp_link);
57584d61770SRobert Watson 		break;
57684d61770SRobert Watson 
57784d61770SRobert Watson 	default:
57884d61770SRobert Watson 		panic("uipc_attach");
57984d61770SRobert Watson 	}
580779f106aSGleb Smirnoff 
581779f106aSGleb Smirnoff 	if (locked == false)
582779f106aSGleb Smirnoff 		UNP_LINK_WUNLOCK();
5836d32873cSRobert Watson 
5846d32873cSRobert Watson 	return (0);
585a29f300eSGarrett Wollman }
586a29f300eSGarrett Wollman 
587a29f300eSGarrett Wollman static int
5887493f24eSPawel Jakub Dawidek uipc_bindat(int fd, struct socket *so, struct sockaddr *nam, struct thread *td)
589a29f300eSGarrett Wollman {
590dd47f5caSRobert Watson 	struct sockaddr_un *soun = (struct sockaddr_un *)nam;
591dd47f5caSRobert Watson 	struct vattr vattr;
5925050aa86SKonstantin Belousov 	int error, namelen;
593dd47f5caSRobert Watson 	struct nameidata nd;
59440f2ac28SRobert Watson 	struct unpcb *unp;
595dd47f5caSRobert Watson 	struct vnode *vp;
596dd47f5caSRobert Watson 	struct mount *mp;
5977008be5bSPawel Jakub Dawidek 	cap_rights_t rights;
598dd47f5caSRobert Watson 	char *buf;
599a29f300eSGarrett Wollman 
600cb7df69bSKevin Lo 	if (nam->sa_family != AF_UNIX)
601cb7df69bSKevin Lo 		return (EAFNOSUPPORT);
602cb7df69bSKevin Lo 
60340f2ac28SRobert Watson 	unp = sotounpcb(so);
6044d4b555eSRobert Watson 	KASSERT(unp != NULL, ("uipc_bind: unp == NULL"));
6054f1f0ef5SRobert Watson 
606a06534c3SBjoern A. Zeeb 	if (soun->sun_len > sizeof(struct sockaddr_un))
607a06534c3SBjoern A. Zeeb 		return (EINVAL);
6084f1f0ef5SRobert Watson 	namelen = soun->sun_len - offsetof(struct sockaddr_un, sun_path);
6094f1f0ef5SRobert Watson 	if (namelen <= 0)
6104f1f0ef5SRobert Watson 		return (EINVAL);
611dd47f5caSRobert Watson 
612dd47f5caSRobert Watson 	/*
6134f1f0ef5SRobert Watson 	 * We don't allow simultaneous bind() calls on a single UNIX domain
6144f1f0ef5SRobert Watson 	 * socket, so flag in-progress operations, and return an error if an
6154f1f0ef5SRobert Watson 	 * operation is already in progress.
6164f1f0ef5SRobert Watson 	 *
6174f1f0ef5SRobert Watson 	 * Historically, we have not allowed a socket to be rebound, so this
618d7924b70SRobert Watson 	 * also returns an error.  Not allowing re-binding simplifies the
619d7924b70SRobert Watson 	 * implementation and avoids a great many possible failure modes.
620dd47f5caSRobert Watson 	 */
621e7c33e29SRobert Watson 	UNP_PCB_LOCK(unp);
622dd47f5caSRobert Watson 	if (unp->unp_vnode != NULL) {
623e7c33e29SRobert Watson 		UNP_PCB_UNLOCK(unp);
624dd47f5caSRobert Watson 		return (EINVAL);
625dd47f5caSRobert Watson 	}
6264f1f0ef5SRobert Watson 	if (unp->unp_flags & UNP_BINDING) {
627e7c33e29SRobert Watson 		UNP_PCB_UNLOCK(unp);
6284f1f0ef5SRobert Watson 		return (EALREADY);
629dd47f5caSRobert Watson 	}
6304f1f0ef5SRobert Watson 	unp->unp_flags |= UNP_BINDING;
631e7c33e29SRobert Watson 	UNP_PCB_UNLOCK(unp);
632dd47f5caSRobert Watson 
633dd47f5caSRobert Watson 	buf = malloc(namelen + 1, M_TEMP, M_WAITOK);
6347928893dSEd Maste 	bcopy(soun->sun_path, buf, namelen);
6357928893dSEd Maste 	buf[namelen] = 0;
636dd47f5caSRobert Watson 
637dd47f5caSRobert Watson restart:
6386c21f6edSKonstantin Belousov 	NDINIT_ATRIGHTS(&nd, CREATE, NOFOLLOW | LOCKPARENT | SAVENAME | NOCACHE,
6396b3a9a0fSMateusz Guzik 	    UIO_SYSSPACE, buf, fd, cap_rights_init_one(&rights, CAP_BINDAT),
6406b3a9a0fSMateusz Guzik 	    td);
641dd47f5caSRobert Watson /* SHOULD BE ABLE TO ADOPT EXISTING AND wakeup() ALA FIFO's */
642dd47f5caSRobert Watson 	error = namei(&nd);
643dd47f5caSRobert Watson 	if (error)
6444f1f0ef5SRobert Watson 		goto error;
645dd47f5caSRobert Watson 	vp = nd.ni_vp;
646dd47f5caSRobert Watson 	if (vp != NULL || vn_start_write(nd.ni_dvp, &mp, V_NOWAIT) != 0) {
647dd47f5caSRobert Watson 		NDFREE(&nd, NDF_ONLY_PNBUF);
648dd47f5caSRobert Watson 		if (nd.ni_dvp == vp)
649dd47f5caSRobert Watson 			vrele(nd.ni_dvp);
650dd47f5caSRobert Watson 		else
651dd47f5caSRobert Watson 			vput(nd.ni_dvp);
652dd47f5caSRobert Watson 		if (vp != NULL) {
653dd47f5caSRobert Watson 			vrele(vp);
654dd47f5caSRobert Watson 			error = EADDRINUSE;
6554f1f0ef5SRobert Watson 			goto error;
656dd47f5caSRobert Watson 		}
657dd47f5caSRobert Watson 		error = vn_start_write(NULL, &mp, V_XSLEEP | PCATCH);
658dd47f5caSRobert Watson 		if (error)
6594f1f0ef5SRobert Watson 			goto error;
660dd47f5caSRobert Watson 		goto restart;
661dd47f5caSRobert Watson 	}
662dd47f5caSRobert Watson 	VATTR_NULL(&vattr);
663dd47f5caSRobert Watson 	vattr.va_type = VSOCK;
66485078b85SConrad Meyer 	vattr.va_mode = (ACCESSPERMS & ~td->td_proc->p_pd->pd_cmask);
665dd47f5caSRobert Watson #ifdef MAC
66630d239bcSRobert Watson 	error = mac_vnode_check_create(td->td_ucred, nd.ni_dvp, &nd.ni_cnd,
667dd47f5caSRobert Watson 	    &vattr);
668dd47f5caSRobert Watson #endif
669885868cdSRobert Watson 	if (error == 0)
670dd47f5caSRobert Watson 		error = VOP_CREATE(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd, &vattr);
671dd47f5caSRobert Watson 	NDFREE(&nd, NDF_ONLY_PNBUF);
672dd47f5caSRobert Watson 	if (error) {
6733b2aa360SKonstantin Belousov 		VOP_VPUT_PAIR(nd.ni_dvp, NULL, true);
674dd47f5caSRobert Watson 		vn_finished_write(mp);
675441eb16aSKonstantin Belousov 		if (error == ERELOOKUP)
676441eb16aSKonstantin Belousov 			goto restart;
6774f1f0ef5SRobert Watson 		goto error;
678dd47f5caSRobert Watson 	}
679dd47f5caSRobert Watson 	vp = nd.ni_vp;
68057fd3d55SPawel Jakub Dawidek 	ASSERT_VOP_ELOCKED(vp, "uipc_bind");
681dd47f5caSRobert Watson 	soun = (struct sockaddr_un *)sodupsockaddr(nam, M_WAITOK);
682e7c33e29SRobert Watson 
683e7c33e29SRobert Watson 	UNP_PCB_LOCK(unp);
6840c3c207fSGleb Smirnoff 	VOP_UNP_BIND(vp, unp);
685dd47f5caSRobert Watson 	unp->unp_vnode = vp;
686dd47f5caSRobert Watson 	unp->unp_addr = soun;
6874f1f0ef5SRobert Watson 	unp->unp_flags &= ~UNP_BINDING;
688e7c33e29SRobert Watson 	UNP_PCB_UNLOCK(unp);
6893b2aa360SKonstantin Belousov 	vref(vp);
6903b2aa360SKonstantin Belousov 	VOP_VPUT_PAIR(nd.ni_dvp, &vp, true);
691dd47f5caSRobert Watson 	vn_finished_write(mp);
6924f1f0ef5SRobert Watson 	free(buf, M_TEMP);
6934f1f0ef5SRobert Watson 	return (0);
694e7c33e29SRobert Watson 
6954f1f0ef5SRobert Watson error:
696e7c33e29SRobert Watson 	UNP_PCB_LOCK(unp);
6974f1f0ef5SRobert Watson 	unp->unp_flags &= ~UNP_BINDING;
698e7c33e29SRobert Watson 	UNP_PCB_UNLOCK(unp);
699dd47f5caSRobert Watson 	free(buf, M_TEMP);
70040f2ac28SRobert Watson 	return (error);
701a29f300eSGarrett Wollman }
702a29f300eSGarrett Wollman 
703a29f300eSGarrett Wollman static int
7047493f24eSPawel Jakub Dawidek uipc_bind(struct socket *so, struct sockaddr *nam, struct thread *td)
7057493f24eSPawel Jakub Dawidek {
7067493f24eSPawel Jakub Dawidek 
7077493f24eSPawel Jakub Dawidek 	return (uipc_bindat(AT_FDCWD, so, nam, td));
7087493f24eSPawel Jakub Dawidek }
7097493f24eSPawel Jakub Dawidek 
7107493f24eSPawel Jakub Dawidek static int
711b40ce416SJulian Elischer uipc_connect(struct socket *so, struct sockaddr *nam, struct thread *td)
712a29f300eSGarrett Wollman {
7130d9ce3a1SRobert Watson 	int error;
714a29f300eSGarrett Wollman 
715fd179ee9SRobert Watson 	KASSERT(td == curthread, ("uipc_connect: td != curthread"));
716fd179ee9SRobert Watson 	error = unp_connect(so, nam, td);
7170d9ce3a1SRobert Watson 	return (error);
718a29f300eSGarrett Wollman }
719a29f300eSGarrett Wollman 
7207493f24eSPawel Jakub Dawidek static int
7217493f24eSPawel Jakub Dawidek uipc_connectat(int fd, struct socket *so, struct sockaddr *nam,
7227493f24eSPawel Jakub Dawidek     struct thread *td)
7237493f24eSPawel Jakub Dawidek {
7247493f24eSPawel Jakub Dawidek 	int error;
7257493f24eSPawel Jakub Dawidek 
7267493f24eSPawel Jakub Dawidek 	KASSERT(td == curthread, ("uipc_connectat: td != curthread"));
7277493f24eSPawel Jakub Dawidek 	error = unp_connectat(fd, so, nam, td);
7287493f24eSPawel Jakub Dawidek 	return (error);
7297493f24eSPawel Jakub Dawidek }
7307493f24eSPawel Jakub Dawidek 
731a152f8a3SRobert Watson static void
732a152f8a3SRobert Watson uipc_close(struct socket *so)
733a152f8a3SRobert Watson {
734e7c33e29SRobert Watson 	struct unpcb *unp, *unp2;
735779f106aSGleb Smirnoff 	struct vnode *vp = NULL;
73675a67bf3SMatt Macy 	struct mtx *vplock;
737ccdadf1aSMark Johnston 
738a152f8a3SRobert Watson 	unp = sotounpcb(so);
739a152f8a3SRobert Watson 	KASSERT(unp != NULL, ("uipc_close: unp == NULL"));
740e7c33e29SRobert Watson 
74175a67bf3SMatt Macy 	vplock = NULL;
74275a67bf3SMatt Macy 	if ((vp = unp->unp_vnode) != NULL) {
74375a67bf3SMatt Macy 		vplock = mtx_pool_find(mtxpool_sleep, vp);
74475a67bf3SMatt Macy 		mtx_lock(vplock);
745e7c33e29SRobert Watson 	}
74675a67bf3SMatt Macy 	UNP_PCB_LOCK(unp);
74775a67bf3SMatt Macy 	if (vp && unp->unp_vnode == NULL) {
74875a67bf3SMatt Macy 		mtx_unlock(vplock);
74975a67bf3SMatt Macy 		vp = NULL;
75075a67bf3SMatt Macy 	}
75175a67bf3SMatt Macy 	if (vp != NULL) {
752779f106aSGleb Smirnoff 		VOP_UNP_DETACH(vp);
753779f106aSGleb Smirnoff 		unp->unp_vnode = NULL;
754779f106aSGleb Smirnoff 	}
755ccdadf1aSMark Johnston 	if ((unp2 = unp_pcb_lock_peer(unp)) != NULL)
756acf9fd05SMatt Macy 		unp_disconnect(unp, unp2);
757ccdadf1aSMark Johnston 	else
758e7c33e29SRobert Watson 		UNP_PCB_UNLOCK(unp);
75975a67bf3SMatt Macy 	if (vp) {
76075a67bf3SMatt Macy 		mtx_unlock(vplock);
761779f106aSGleb Smirnoff 		vrele(vp);
762a152f8a3SRobert Watson 	}
76375a67bf3SMatt Macy }
764a152f8a3SRobert Watson 
7652c899584SRobert Watson static int
766a29f300eSGarrett Wollman uipc_connect2(struct socket *so1, struct socket *so2)
767a29f300eSGarrett Wollman {
768e7c33e29SRobert Watson 	struct unpcb *unp, *unp2;
7690d9ce3a1SRobert Watson 	int error;
770a29f300eSGarrett Wollman 
771e7c33e29SRobert Watson 	unp = so1->so_pcb;
7724d4b555eSRobert Watson 	KASSERT(unp != NULL, ("uipc_connect2: unp == NULL"));
773e7c33e29SRobert Watson 	unp2 = so2->so_pcb;
774e7c33e29SRobert Watson 	KASSERT(unp2 != NULL, ("uipc_connect2: unp2 == NULL"));
7754820bf6aSMark Johnston 	unp_pcb_lock_pair(unp, unp2);
7766a2989fdSMatthew N. Dodd 	error = unp_connect2(so1, so2, PRU_CONNECT2);
7774820bf6aSMark Johnston 	unp_pcb_unlock_pair(unp, unp2);
7780d9ce3a1SRobert Watson 	return (error);
779a29f300eSGarrett Wollman }
780a29f300eSGarrett Wollman 
781bc725eafSRobert Watson static void
782a29f300eSGarrett Wollman uipc_detach(struct socket *so)
783a29f300eSGarrett Wollman {
784e7c33e29SRobert Watson 	struct unpcb *unp, *unp2;
78575a67bf3SMatt Macy 	struct mtx *vplock;
7866d32873cSRobert Watson 	struct vnode *vp;
787ccdadf1aSMark Johnston 	int local_unp_rights;
788a29f300eSGarrett Wollman 
78940f2ac28SRobert Watson 	unp = sotounpcb(so);
7904d4b555eSRobert Watson 	KASSERT(unp != NULL, ("uipc_detach: unp == NULL"));
791e7c33e29SRobert Watson 
792434ac8b6SMark Johnston 	vp = NULL;
793c0874c34SMatt Macy 	vplock = NULL;
794434ac8b6SMark Johnston 
795a50b1900SMark Johnston 	SOCK_LOCK(so);
796a50b1900SMark Johnston 	if (!SOLISTENING(so)) {
797a50b1900SMark Johnston 		/*
798a50b1900SMark Johnston 		 * Once the socket is removed from the global lists,
799a50b1900SMark Johnston 		 * uipc_ready() will not be able to locate its socket buffer, so
800a50b1900SMark Johnston 		 * clear the buffer now.  At this point internalized rights have
801a50b1900SMark Johnston 		 * already been disposed of.
802a50b1900SMark Johnston 		 */
803a50b1900SMark Johnston 		sbrelease(&so->so_rcv, so);
804a50b1900SMark Johnston 	}
805a50b1900SMark Johnston 	SOCK_UNLOCK(so);
806a50b1900SMark Johnston 
807779f106aSGleb Smirnoff 	UNP_LINK_WLOCK();
8086d32873cSRobert Watson 	LIST_REMOVE(unp, unp_link);
809a9aa06f7SJason A. Harmening 	if (unp->unp_gcflag & UNPGC_DEAD)
810a9aa06f7SJason A. Harmening 		LIST_REMOVE(unp, unp_dead);
8116d32873cSRobert Watson 	unp->unp_gencnt = ++unp_gencnt;
8126d32873cSRobert Watson 	--unp_count;
81375a67bf3SMatt Macy 	UNP_LINK_WUNLOCK();
814434ac8b6SMark Johnston 
81575a67bf3SMatt Macy 	UNP_PCB_UNLOCK_ASSERT(unp);
81675a67bf3SMatt Macy  restart:
81775a67bf3SMatt Macy 	if ((vp = unp->unp_vnode) != NULL) {
81875a67bf3SMatt Macy 		vplock = mtx_pool_find(mtxpool_sleep, vp);
81975a67bf3SMatt Macy 		mtx_lock(vplock);
82075a67bf3SMatt Macy 	}
82175a67bf3SMatt Macy 	UNP_PCB_LOCK(unp);
822db38b699SMark Johnston 	if (unp->unp_vnode != vp && unp->unp_vnode != NULL) {
823c0874c34SMatt Macy 		if (vplock)
82475a67bf3SMatt Macy 			mtx_unlock(vplock);
82575a67bf3SMatt Macy 		UNP_PCB_UNLOCK(unp);
82675a67bf3SMatt Macy 		goto restart;
82775a67bf3SMatt Macy 	}
8286d32873cSRobert Watson 	if ((vp = unp->unp_vnode) != NULL) {
829c7e41c8bSMikolaj Golub 		VOP_UNP_DETACH(vp);
8306d32873cSRobert Watson 		unp->unp_vnode = NULL;
8316d32873cSRobert Watson 	}
832ccdadf1aSMark Johnston 	if ((unp2 = unp_pcb_lock_peer(unp)) != NULL)
833e7c33e29SRobert Watson 		unp_disconnect(unp, unp2);
834f0317f86SMark Johnston 	else
83575a67bf3SMatt Macy 		UNP_PCB_UNLOCK(unp);
836ccdadf1aSMark Johnston 
83775a67bf3SMatt Macy 	UNP_REF_LIST_LOCK();
8386d32873cSRobert Watson 	while (!LIST_EMPTY(&unp->unp_refs)) {
8396d32873cSRobert Watson 		struct unpcb *ref = LIST_FIRST(&unp->unp_refs);
840e7c33e29SRobert Watson 
84175a67bf3SMatt Macy 		unp_pcb_hold(ref);
84275a67bf3SMatt Macy 		UNP_REF_LIST_UNLOCK();
84375a67bf3SMatt Macy 
84475a67bf3SMatt Macy 		MPASS(ref != unp);
84575a67bf3SMatt Macy 		UNP_PCB_UNLOCK_ASSERT(ref);
846afc055d9SEd Schouten 		unp_drop(ref);
84775a67bf3SMatt Macy 		UNP_REF_LIST_LOCK();
8486d32873cSRobert Watson 	}
84975a67bf3SMatt Macy 	UNP_REF_LIST_UNLOCK();
850ccdadf1aSMark Johnston 
85175a67bf3SMatt Macy 	UNP_PCB_LOCK(unp);
852397c19d1SJeff Roberson 	local_unp_rights = unp_rights;
8536d32873cSRobert Watson 	unp->unp_socket->so_pcb = NULL;
85475a67bf3SMatt Macy 	unp->unp_socket = NULL;
855db38b699SMark Johnston 	free(unp->unp_addr, M_SONAME);
856db38b699SMark Johnston 	unp->unp_addr = NULL;
857db38b699SMark Johnston 	if (!unp_pcb_rele(unp))
8586e2faa24SRobert Watson 		UNP_PCB_UNLOCK(unp);
85975a67bf3SMatt Macy 	if (vp) {
86075a67bf3SMatt Macy 		mtx_unlock(vplock);
8616d32873cSRobert Watson 		vrele(vp);
86275a67bf3SMatt Macy 	}
8636d32873cSRobert Watson 	if (local_unp_rights)
864daee0f0bSKonstantin Belousov 		taskqueue_enqueue_timeout(taskqueue_thread, &unp_gc_task, -1);
865a29f300eSGarrett Wollman }
866a29f300eSGarrett Wollman 
867a29f300eSGarrett Wollman static int
868a29f300eSGarrett Wollman uipc_disconnect(struct socket *so)
869a29f300eSGarrett Wollman {
870e7c33e29SRobert Watson 	struct unpcb *unp, *unp2;
871a29f300eSGarrett Wollman 
87240f2ac28SRobert Watson 	unp = sotounpcb(so);
8734d4b555eSRobert Watson 	KASSERT(unp != NULL, ("uipc_disconnect: unp == NULL"));
874e7c33e29SRobert Watson 
875e7c33e29SRobert Watson 	UNP_PCB_LOCK(unp);
876ccdadf1aSMark Johnston 	if ((unp2 = unp_pcb_lock_peer(unp)) != NULL)
87775a67bf3SMatt Macy 		unp_disconnect(unp, unp2);
878ccdadf1aSMark Johnston 	else
879ccdadf1aSMark Johnston 		UNP_PCB_UNLOCK(unp);
880e5aeaa0cSDag-Erling Smørgrav 	return (0);
881a29f300eSGarrett Wollman }
882a29f300eSGarrett Wollman 
883a29f300eSGarrett Wollman static int
884d374e81eSRobert Watson uipc_listen(struct socket *so, int backlog, struct thread *td)
885a29f300eSGarrett Wollman {
88640f2ac28SRobert Watson 	struct unpcb *unp;
8870d9ce3a1SRobert Watson 	int error;
888a29f300eSGarrett Wollman 
889beb4b312SGleb Smirnoff 	if (so->so_type != SOCK_STREAM && so->so_type != SOCK_SEQPACKET)
890beb4b312SGleb Smirnoff 		return (EOPNOTSUPP);
891beb4b312SGleb Smirnoff 
89240f2ac28SRobert Watson 	unp = sotounpcb(so);
8934d4b555eSRobert Watson 	KASSERT(unp != NULL, ("uipc_listen: unp == NULL"));
894e7c33e29SRobert Watson 
895e7c33e29SRobert Watson 	UNP_PCB_LOCK(unp);
8964d4b555eSRobert Watson 	if (unp->unp_vnode == NULL) {
89747a84387SEd Schouten 		/* Already connected or not bound to an address. */
89847a84387SEd Schouten 		error = unp->unp_conn != NULL ? EINVAL : EDESTADDRREQ;
899e7c33e29SRobert Watson 		UNP_PCB_UNLOCK(unp);
90047a84387SEd Schouten 		return (error);
90140f2ac28SRobert Watson 	}
902e7c33e29SRobert Watson 
903e7c33e29SRobert Watson 	SOCK_LOCK(so);
904e7c33e29SRobert Watson 	error = solisten_proto_check(so);
905e7c33e29SRobert Watson 	if (error == 0) {
906c5afec6eSDmitry Chagin 		cru2xt(td, &unp->unp_peercred);
907e7c33e29SRobert Watson 		solisten_proto(so, backlog);
908e7c33e29SRobert Watson 	}
909e7c33e29SRobert Watson 	SOCK_UNLOCK(so);
910e7c33e29SRobert Watson 	UNP_PCB_UNLOCK(unp);
9110d9ce3a1SRobert Watson 	return (error);
912a29f300eSGarrett Wollman }
913a29f300eSGarrett Wollman 
914a29f300eSGarrett Wollman static int
91557bf258eSGarrett Wollman uipc_peeraddr(struct socket *so, struct sockaddr **nam)
916a29f300eSGarrett Wollman {
917e7c33e29SRobert Watson 	struct unpcb *unp, *unp2;
9180d9ce3a1SRobert Watson 	const struct sockaddr *sa;
919a29f300eSGarrett Wollman 
9204d4b555eSRobert Watson 	unp = sotounpcb(so);
9214d4b555eSRobert Watson 	KASSERT(unp != NULL, ("uipc_peeraddr: unp == NULL"));
922e7c33e29SRobert Watson 
9230d9ce3a1SRobert Watson 	*nam = malloc(sizeof(struct sockaddr_un), M_SONAME, M_WAITOK);
924afd9f91cSJohn Baldwin 	UNP_LINK_RLOCK();
925bdc5f6a3SHajimu UMEMOTO 	/*
926e7c33e29SRobert Watson 	 * XXX: It seems that this test always fails even when connection is
927e7c33e29SRobert Watson 	 * established.  So, this else clause is added as workaround to
928e7c33e29SRobert Watson 	 * return PF_LOCAL sockaddr.
929bdc5f6a3SHajimu UMEMOTO 	 */
930e7c33e29SRobert Watson 	unp2 = unp->unp_conn;
931e7c33e29SRobert Watson 	if (unp2 != NULL) {
932e7c33e29SRobert Watson 		UNP_PCB_LOCK(unp2);
933e7c33e29SRobert Watson 		if (unp2->unp_addr != NULL)
934afd9f91cSJohn Baldwin 			sa = (struct sockaddr *) unp2->unp_addr;
935e7c33e29SRobert Watson 		else
9360d9ce3a1SRobert Watson 			sa = &sun_noname;
9370d9ce3a1SRobert Watson 		bcopy(sa, *nam, sa->sa_len);
938e7c33e29SRobert Watson 		UNP_PCB_UNLOCK(unp2);
939e7c33e29SRobert Watson 	} else {
940e7c33e29SRobert Watson 		sa = &sun_noname;
941e7c33e29SRobert Watson 		bcopy(sa, *nam, sa->sa_len);
942e7c33e29SRobert Watson 	}
943afd9f91cSJohn Baldwin 	UNP_LINK_RUNLOCK();
944e5aeaa0cSDag-Erling Smørgrav 	return (0);
945a29f300eSGarrett Wollman }
946a29f300eSGarrett Wollman 
947a29f300eSGarrett Wollman static int
948a29f300eSGarrett Wollman uipc_rcvd(struct socket *so, int flags)
949a29f300eSGarrett Wollman {
950e7c33e29SRobert Watson 	struct unpcb *unp, *unp2;
951a29f300eSGarrett Wollman 	struct socket *so2;
952337cc6b6SRobert Watson 	u_int mbcnt, sbcc;
953a29f300eSGarrett Wollman 
95440f2ac28SRobert Watson 	unp = sotounpcb(so);
9552b21d0e8SGleb Smirnoff 	KASSERT(unp != NULL, ("%s: unp == NULL", __func__));
9562b21d0e8SGleb Smirnoff 	KASSERT(so->so_type == SOCK_STREAM || so->so_type == SOCK_SEQPACKET,
9572b21d0e8SGleb Smirnoff 	    ("%s: socktype %d", __func__, so->so_type));
958e7c33e29SRobert Watson 
959df8bae1dSRodney W. Grimes 	/*
960e7c33e29SRobert Watson 	 * Adjust backpressure on sender and wakeup any waiting to write.
961e7c33e29SRobert Watson 	 *
962d7924b70SRobert Watson 	 * The unp lock is acquired to maintain the validity of the unp_conn
963d7924b70SRobert Watson 	 * pointer; no lock on unp2 is required as unp2->unp_socket will be
964d7924b70SRobert Watson 	 * static as long as we don't permit unp2 to disconnect from unp,
965d7924b70SRobert Watson 	 * which is prevented by the lock on unp.  We cache values from
966d7924b70SRobert Watson 	 * so_rcv to avoid holding the so_rcv lock over the entire
967d7924b70SRobert Watson 	 * transaction on the remote so_snd.
968df8bae1dSRodney W. Grimes 	 */
969337cc6b6SRobert Watson 	SOCKBUF_LOCK(&so->so_rcv);
970337cc6b6SRobert Watson 	mbcnt = so->so_rcv.sb_mbcnt;
9712b21d0e8SGleb Smirnoff 	sbcc = sbavail(&so->so_rcv);
972337cc6b6SRobert Watson 	SOCKBUF_UNLOCK(&so->so_rcv);
973c2090e73SAlan Somers 	/*
974c2090e73SAlan Somers 	 * There is a benign race condition at this point.  If we're planning to
975c2090e73SAlan Somers 	 * clear SB_STOP, but uipc_send is called on the connected socket at
976c2090e73SAlan Somers 	 * this instant, it might add data to the sockbuf and set SB_STOP.  Then
977c2090e73SAlan Somers 	 * we would erroneously clear SB_STOP below, even though the sockbuf is
978c2090e73SAlan Somers 	 * full.  The race is benign because the only ill effect is to allow the
979c2090e73SAlan Somers 	 * sockbuf to exceed its size limit, and the size limits are not
980c2090e73SAlan Somers 	 * strictly guaranteed anyway.
981c2090e73SAlan Somers 	 */
982e7c33e29SRobert Watson 	UNP_PCB_LOCK(unp);
983e7c33e29SRobert Watson 	unp2 = unp->unp_conn;
984e7c33e29SRobert Watson 	if (unp2 == NULL) {
985e7c33e29SRobert Watson 		UNP_PCB_UNLOCK(unp);
986e7c33e29SRobert Watson 		return (0);
987337cc6b6SRobert Watson 	}
988e7c33e29SRobert Watson 	so2 = unp2->unp_socket;
989337cc6b6SRobert Watson 	SOCKBUF_LOCK(&so2->so_snd);
990c2090e73SAlan Somers 	if (sbcc < so2->so_snd.sb_hiwat && mbcnt < so2->so_snd.sb_mbmax)
991c2090e73SAlan Somers 		so2->so_snd.sb_flags &= ~SB_STOP;
9921e4d7da7SRobert Watson 	sowwakeup_locked(so2);
993e7c33e29SRobert Watson 	UNP_PCB_UNLOCK(unp);
994e5aeaa0cSDag-Erling Smørgrav 	return (0);
995a29f300eSGarrett Wollman }
996df8bae1dSRodney W. Grimes 
997a29f300eSGarrett Wollman static int
99857bf258eSGarrett Wollman uipc_send(struct socket *so, int flags, struct mbuf *m, struct sockaddr *nam,
999b40ce416SJulian Elischer     struct mbuf *control, struct thread *td)
1000a29f300eSGarrett Wollman {
1001f3f49bbbSRobert Watson 	struct unpcb *unp, *unp2;
1002a29f300eSGarrett Wollman 	struct socket *so2;
1003c2090e73SAlan Somers 	u_int mbcnt, sbcc;
100475a67bf3SMatt Macy 	int freed, error;
1005a29f300eSGarrett Wollman 
100640f2ac28SRobert Watson 	unp = sotounpcb(so);
10072b21d0e8SGleb Smirnoff 	KASSERT(unp != NULL, ("%s: unp == NULL", __func__));
10082b21d0e8SGleb Smirnoff 	KASSERT(so->so_type == SOCK_STREAM || so->so_type == SOCK_DGRAM ||
10092b21d0e8SGleb Smirnoff 	    so->so_type == SOCK_SEQPACKET,
10102b21d0e8SGleb Smirnoff 	    ("%s: socktype %d", __func__, so->so_type));
1011e7c33e29SRobert Watson 
101275a67bf3SMatt Macy 	freed = error = 0;
1013a29f300eSGarrett Wollman 	if (flags & PRUS_OOB) {
1014a29f300eSGarrett Wollman 		error = EOPNOTSUPP;
1015a29f300eSGarrett Wollman 		goto release;
1016a29f300eSGarrett Wollman 	}
1017fc3fcacfSRobert Watson 	if (control != NULL && (error = unp_internalize(&control, td)))
1018a29f300eSGarrett Wollman 		goto release;
101975a67bf3SMatt Macy 
102075a67bf3SMatt Macy 	unp2 = NULL;
1021a29f300eSGarrett Wollman 	switch (so->so_type) {
1022a29f300eSGarrett Wollman 	case SOCK_DGRAM:
1023a29f300eSGarrett Wollman 	{
1024e7dd9a10SRobert Watson 		const struct sockaddr *from;
1025df8bae1dSRodney W. Grimes 
1026fc3fcacfSRobert Watson 		if (nam != NULL) {
1027ccdadf1aSMark Johnston 			error = unp_connect(so, nam, td);
1028ccdadf1aSMark Johnston 			if (error != 0)
1029df8bae1dSRodney W. Grimes 				break;
1030ccdadf1aSMark Johnston 		}
103175a67bf3SMatt Macy 		UNP_PCB_LOCK(unp);
103260a5ef26SRobert Watson 
1033b5ff0914SRobert Watson 		/*
1034b5ff0914SRobert Watson 		 * Because connect() and send() are non-atomic in a sendto()
1035b5ff0914SRobert Watson 		 * with a target address, it's possible that the socket will
1036b5ff0914SRobert Watson 		 * have disconnected before the send() can run.  In that case
1037b5ff0914SRobert Watson 		 * return the slightly counter-intuitive but otherwise
1038b5ff0914SRobert Watson 		 * correct error that the socket is not connected.
1039b5ff0914SRobert Watson 		 */
1040ccdadf1aSMark Johnston 		unp2 = unp_pcb_lock_peer(unp);
1041ccdadf1aSMark Johnston 		if (unp2 == NULL) {
104275a67bf3SMatt Macy 			UNP_PCB_UNLOCK(unp);
1043b5ff0914SRobert Watson 			error = ENOTCONN;
1044b5ff0914SRobert Watson 			break;
1045b5ff0914SRobert Watson 		}
1046ccdadf1aSMark Johnston 
10472de07e40SConrad Meyer 		if (unp2->unp_flags & UNP_WANTCRED_MASK)
1048ede4af47SConrad Meyer 			control = unp_addsockcred(td, control,
1049ede4af47SConrad Meyer 			    unp2->unp_flags);
1050fc3fcacfSRobert Watson 		if (unp->unp_addr != NULL)
105157bf258eSGarrett Wollman 			from = (struct sockaddr *)unp->unp_addr;
1052df8bae1dSRodney W. Grimes 		else
1053df8bae1dSRodney W. Grimes 			from = &sun_noname;
1054ede6e136SRobert Watson 		so2 = unp2->unp_socket;
1055a34b7046SRobert Watson 		SOCKBUF_LOCK(&so2->so_rcv);
10566dde7ecbSPeter Wemm 		if (sbappendaddr_locked(&so2->so_rcv, from, m,
10578de34a88SAlan Somers 		    control)) {
10581e4d7da7SRobert Watson 			sorwakeup_locked(so2);
1059fc3fcacfSRobert Watson 			m = NULL;
1060fc3fcacfSRobert Watson 			control = NULL;
1061e5aeaa0cSDag-Erling Smørgrav 		} else {
1062924d1c9aSAlexander V. Chernikov 			SOCKBUF_UNLOCK(&so2->so_rcv);
1063df8bae1dSRodney W. Grimes 			error = ENOBUFS;
1064e5aeaa0cSDag-Erling Smørgrav 		}
106575a67bf3SMatt Macy 		if (nam != NULL)
1066e7c33e29SRobert Watson 			unp_disconnect(unp, unp2);
1067f0317f86SMark Johnston 		else
1068f0317f86SMark Johnston 			unp_pcb_unlock_pair(unp, unp2);
1069df8bae1dSRodney W. Grimes 		break;
1070df8bae1dSRodney W. Grimes 	}
1071df8bae1dSRodney W. Grimes 
107284d61770SRobert Watson 	case SOCK_SEQPACKET:
1073df8bae1dSRodney W. Grimes 	case SOCK_STREAM:
1074402cc72dSDavid Greenman 		if ((so->so_state & SS_ISCONNECTED) == 0) {
1075fc3fcacfSRobert Watson 			if (nam != NULL) {
1076ccdadf1aSMark Johnston 				error = unp_connect(so, nam, td);
1077b36871afSMark Johnston 				if (error != 0)
107875a67bf3SMatt Macy 					break;
1079402cc72dSDavid Greenman 			} else {
1080402cc72dSDavid Greenman 				error = ENOTCONN;
1081402cc72dSDavid Greenman 				break;
1082402cc72dSDavid Greenman 			}
1083b36871afSMark Johnston 		}
1084b36871afSMark Johnston 
1085ccdadf1aSMark Johnston 		UNP_PCB_LOCK(unp);
1086ccdadf1aSMark Johnston 		if ((unp2 = unp_pcb_lock_peer(unp)) == NULL) {
108775a67bf3SMatt Macy 			UNP_PCB_UNLOCK(unp);
1088b5ff0914SRobert Watson 			error = ENOTCONN;
1089b5ff0914SRobert Watson 			break;
1090b36871afSMark Johnston 		} else if (so->so_snd.sb_state & SBS_CANTSENDMORE) {
1091ccdadf1aSMark Johnston 			unp_pcb_unlock_pair(unp, unp2);
1092b36871afSMark Johnston 			error = EPIPE;
1093b36871afSMark Johnston 			break;
109475a67bf3SMatt Macy 		}
109575a67bf3SMatt Macy 		UNP_PCB_UNLOCK(unp);
109675a67bf3SMatt Macy 		if ((so2 = unp2->unp_socket) == NULL) {
109775a67bf3SMatt Macy 			UNP_PCB_UNLOCK(unp2);
109875a67bf3SMatt Macy 			error = ENOTCONN;
109975a67bf3SMatt Macy 			break;
110075a67bf3SMatt Macy 		}
1101a34b7046SRobert Watson 		SOCKBUF_LOCK(&so2->so_rcv);
11022de07e40SConrad Meyer 		if (unp2->unp_flags & UNP_WANTCRED_MASK) {
11036a2989fdSMatthew N. Dodd 			/*
11042de07e40SConrad Meyer 			 * Credentials are passed only once on SOCK_STREAM and
11052de07e40SConrad Meyer 			 * SOCK_SEQPACKET (LOCAL_CREDS => WANTCRED_ONESHOT), or
11062de07e40SConrad Meyer 			 * forever (LOCAL_CREDS_PERSISTENT => WANTCRED_ALWAYS).
11076a2989fdSMatthew N. Dodd 			 */
1108ede4af47SConrad Meyer 			control = unp_addsockcred(td, control, unp2->unp_flags);
11092de07e40SConrad Meyer 			unp2->unp_flags &= ~UNP_WANTCRED_ONESHOT;
11106a2989fdSMatthew N. Dodd 		}
11115b0480f2SMark Johnston 
1112df8bae1dSRodney W. Grimes 		/*
11135b0480f2SMark Johnston 		 * Send to paired receive port and wake up readers.  Don't
11145b0480f2SMark Johnston 		 * check for space available in the receive buffer if we're
11155b0480f2SMark Johnston 		 * attaching ancillary data; Unix domain sockets only check
11165b0480f2SMark Johnston 		 * for space in the sending sockbuf, and that check is
11175b0480f2SMark Johnston 		 * performed one level up the stack.  At that level we cannot
11185b0480f2SMark Johnston 		 * precisely account for the amount of buffer space used
11195b0480f2SMark Johnston 		 * (e.g., because control messages are not yet internalized).
1120df8bae1dSRodney W. Grimes 		 */
112184d61770SRobert Watson 		switch (so->so_type) {
112284d61770SRobert Watson 		case SOCK_STREAM:
1123fc3fcacfSRobert Watson 			if (control != NULL) {
11245b0480f2SMark Johnston 				sbappendcontrol_locked(&so2->so_rcv, m,
112525f4ddfbSMark Johnston 				    control, flags);
1126fc3fcacfSRobert Watson 				control = NULL;
1127e7c33e29SRobert Watson 			} else
1128829fae90SGleb Smirnoff 				sbappend_locked(&so2->so_rcv, m, flags);
112984d61770SRobert Watson 			break;
113084d61770SRobert Watson 
1131b36871afSMark Johnston 		case SOCK_SEQPACKET:
11328de34a88SAlan Somers 			if (sbappendaddr_nospacecheck_locked(&so2->so_rcv,
1133b36871afSMark Johnston 			    &sun_noname, m, control))
113484d61770SRobert Watson 				control = NULL;
113584d61770SRobert Watson 			break;
113684d61770SRobert Watson 		}
113784d61770SRobert Watson 
1138c2090e73SAlan Somers 		mbcnt = so2->so_rcv.sb_mbcnt;
11392b21d0e8SGleb Smirnoff 		sbcc = sbavail(&so2->so_rcv);
11402b21d0e8SGleb Smirnoff 		if (sbcc)
1141337cc6b6SRobert Watson 			sorwakeup_locked(so2);
11422b21d0e8SGleb Smirnoff 		else
11432b21d0e8SGleb Smirnoff 			SOCKBUF_UNLOCK(&so2->so_rcv);
1144337cc6b6SRobert Watson 
1145c2090e73SAlan Somers 		/*
1146c2090e73SAlan Somers 		 * The PCB lock on unp2 protects the SB_STOP flag.  Without it,
1147c2090e73SAlan Somers 		 * it would be possible for uipc_rcvd to be called at this
1148c2090e73SAlan Somers 		 * point, drain the receiving sockbuf, clear SB_STOP, and then
1149c2090e73SAlan Somers 		 * we would set SB_STOP below.  That could lead to an empty
1150c2090e73SAlan Somers 		 * sockbuf having SB_STOP set
1151c2090e73SAlan Somers 		 */
1152337cc6b6SRobert Watson 		SOCKBUF_LOCK(&so->so_snd);
1153c2090e73SAlan Somers 		if (sbcc >= so->so_snd.sb_hiwat || mbcnt >= so->so_snd.sb_mbmax)
1154c2090e73SAlan Somers 			so->so_snd.sb_flags |= SB_STOP;
11557abe2ac2SAlan Cox 		SOCKBUF_UNLOCK(&so->so_snd);
1156e7c33e29SRobert Watson 		UNP_PCB_UNLOCK(unp2);
1157fc3fcacfSRobert Watson 		m = NULL;
1158df8bae1dSRodney W. Grimes 		break;
1159df8bae1dSRodney W. Grimes 	}
1160a29f300eSGarrett Wollman 
11616b8fda4dSGarrett Wollman 	/*
116260a5ef26SRobert Watson 	 * PRUS_EOF is equivalent to pru_send followed by pru_shutdown.
11636b8fda4dSGarrett Wollman 	 */
1164a29f300eSGarrett Wollman 	if (flags & PRUS_EOF) {
1165ede6e136SRobert Watson 		UNP_PCB_LOCK(unp);
11666b8fda4dSGarrett Wollman 		socantsendmore(so);
11676b8fda4dSGarrett Wollman 		unp_shutdown(unp);
1168e7c33e29SRobert Watson 		UNP_PCB_UNLOCK(unp);
1169ede6e136SRobert Watson 	}
1170fc3fcacfSRobert Watson 	if (control != NULL && error != 0)
117199ab95dbSMark Johnston 		unp_dispose_mbuf(control);
1172bd508d39SDon Lewis 
1173a29f300eSGarrett Wollman release:
1174fc3fcacfSRobert Watson 	if (control != NULL)
1175a29f300eSGarrett Wollman 		m_freem(control);
1176100db364SGleb Smirnoff 	/*
1177100db364SGleb Smirnoff 	 * In case of PRUS_NOTREADY, uipc_ready() is responsible
1178100db364SGleb Smirnoff 	 * for freeing memory.
1179100db364SGleb Smirnoff 	 */
1180100db364SGleb Smirnoff 	if (m != NULL && (flags & PRUS_NOTREADY) == 0)
1181a29f300eSGarrett Wollman 		m_freem(m);
1182e5aeaa0cSDag-Erling Smørgrav 	return (error);
1183a29f300eSGarrett Wollman }
1184df8bae1dSRodney W. Grimes 
1185a50b1900SMark Johnston static bool
1186a50b1900SMark Johnston uipc_ready_scan(struct socket *so, struct mbuf *m, int count, int *errorp)
1187a50b1900SMark Johnston {
1188a50b1900SMark Johnston 	struct mbuf *mb, *n;
1189a50b1900SMark Johnston 	struct sockbuf *sb;
1190a50b1900SMark Johnston 
1191a50b1900SMark Johnston 	SOCK_LOCK(so);
1192a50b1900SMark Johnston 	if (SOLISTENING(so)) {
1193a50b1900SMark Johnston 		SOCK_UNLOCK(so);
1194a50b1900SMark Johnston 		return (false);
1195a50b1900SMark Johnston 	}
1196a50b1900SMark Johnston 	mb = NULL;
1197a50b1900SMark Johnston 	sb = &so->so_rcv;
1198a50b1900SMark Johnston 	SOCKBUF_LOCK(sb);
1199a50b1900SMark Johnston 	if (sb->sb_fnrdy != NULL) {
1200a50b1900SMark Johnston 		for (mb = sb->sb_mb, n = mb->m_nextpkt; mb != NULL;) {
1201a50b1900SMark Johnston 			if (mb == m) {
1202a50b1900SMark Johnston 				*errorp = sbready(sb, m, count);
1203a50b1900SMark Johnston 				break;
1204a50b1900SMark Johnston 			}
1205a50b1900SMark Johnston 			mb = mb->m_next;
1206a50b1900SMark Johnston 			if (mb == NULL) {
1207a50b1900SMark Johnston 				mb = n;
12081b778ba2SMark Johnston 				if (mb != NULL)
1209a50b1900SMark Johnston 					n = mb->m_nextpkt;
1210a50b1900SMark Johnston 			}
1211a50b1900SMark Johnston 		}
1212a50b1900SMark Johnston 	}
1213a50b1900SMark Johnston 	SOCKBUF_UNLOCK(sb);
1214a50b1900SMark Johnston 	SOCK_UNLOCK(so);
1215a50b1900SMark Johnston 	return (mb != NULL);
1216a50b1900SMark Johnston }
1217a50b1900SMark Johnston 
1218a29f300eSGarrett Wollman static int
1219c80ea19bSGleb Smirnoff uipc_ready(struct socket *so, struct mbuf *m, int count)
1220c80ea19bSGleb Smirnoff {
1221c80ea19bSGleb Smirnoff 	struct unpcb *unp, *unp2;
1222c80ea19bSGleb Smirnoff 	struct socket *so2;
1223a50b1900SMark Johnston 	int error, i;
1224c80ea19bSGleb Smirnoff 
1225c80ea19bSGleb Smirnoff 	unp = sotounpcb(so);
1226c80ea19bSGleb Smirnoff 
1227a50b1900SMark Johnston 	KASSERT(so->so_type == SOCK_STREAM,
1228a50b1900SMark Johnston 	    ("%s: unexpected socket type for %p", __func__, so));
1229a50b1900SMark Johnston 
1230a62b4665SMatt Macy 	UNP_PCB_LOCK(unp);
1231ccdadf1aSMark Johnston 	if ((unp2 = unp_pcb_lock_peer(unp)) != NULL) {
1232a62b4665SMatt Macy 		UNP_PCB_UNLOCK(unp);
1233c80ea19bSGleb Smirnoff 		so2 = unp2->unp_socket;
1234c80ea19bSGleb Smirnoff 		SOCKBUF_LOCK(&so2->so_rcv);
1235c80ea19bSGleb Smirnoff 		if ((error = sbready(&so2->so_rcv, m, count)) == 0)
1236c80ea19bSGleb Smirnoff 			sorwakeup_locked(so2);
1237c80ea19bSGleb Smirnoff 		else
1238c80ea19bSGleb Smirnoff 			SOCKBUF_UNLOCK(&so2->so_rcv);
1239c80ea19bSGleb Smirnoff 		UNP_PCB_UNLOCK(unp2);
1240c80ea19bSGleb Smirnoff 		return (error);
1241ccdadf1aSMark Johnston 	}
1242ccdadf1aSMark Johnston 	UNP_PCB_UNLOCK(unp);
1243a50b1900SMark Johnston 
1244a50b1900SMark Johnston 	/*
1245a50b1900SMark Johnston 	 * The receiving socket has been disconnected, but may still be valid.
1246a50b1900SMark Johnston 	 * In this case, the now-ready mbufs are still present in its socket
1247a50b1900SMark Johnston 	 * buffer, so perform an exhaustive search before giving up and freeing
1248a50b1900SMark Johnston 	 * the mbufs.
1249a50b1900SMark Johnston 	 */
1250a50b1900SMark Johnston 	UNP_LINK_RLOCK();
1251a50b1900SMark Johnston 	LIST_FOREACH(unp, &unp_shead, unp_link) {
1252a50b1900SMark Johnston 		if (uipc_ready_scan(unp->unp_socket, m, count, &error))
1253a50b1900SMark Johnston 			break;
1254a50b1900SMark Johnston 	}
1255a50b1900SMark Johnston 	UNP_LINK_RUNLOCK();
1256a50b1900SMark Johnston 
1257a50b1900SMark Johnston 	if (unp == NULL) {
1258a50b1900SMark Johnston 		for (i = 0; i < count; i++)
1259a62b4665SMatt Macy 			m = m_free(m);
1260a50b1900SMark Johnston 		error = ECONNRESET;
1261a50b1900SMark Johnston 	}
1262a50b1900SMark Johnston 	return (error);
1263c80ea19bSGleb Smirnoff }
1264c80ea19bSGleb Smirnoff 
1265c80ea19bSGleb Smirnoff static int
1266a29f300eSGarrett Wollman uipc_sense(struct socket *so, struct stat *sb)
1267a29f300eSGarrett Wollman {
1268c2090e73SAlan Somers 	struct unpcb *unp;
1269a29f300eSGarrett Wollman 
127040f2ac28SRobert Watson 	unp = sotounpcb(so);
12714d4b555eSRobert Watson 	KASSERT(unp != NULL, ("uipc_sense: unp == NULL"));
1272e7c33e29SRobert Watson 
1273a29f300eSGarrett Wollman 	sb->st_blksize = so->so_snd.sb_hiwat;
1274f3732fd1SPoul-Henning Kamp 	sb->st_dev = NODEV;
1275a29f300eSGarrett Wollman 	sb->st_ino = unp->unp_ino;
1276df8bae1dSRodney W. Grimes 	return (0);
1277a29f300eSGarrett Wollman }
1278df8bae1dSRodney W. Grimes 
1279a29f300eSGarrett Wollman static int
1280a29f300eSGarrett Wollman uipc_shutdown(struct socket *so)
1281a29f300eSGarrett Wollman {
128240f2ac28SRobert Watson 	struct unpcb *unp;
1283df8bae1dSRodney W. Grimes 
128440f2ac28SRobert Watson 	unp = sotounpcb(so);
12854d4b555eSRobert Watson 	KASSERT(unp != NULL, ("uipc_shutdown: unp == NULL"));
1286e7c33e29SRobert Watson 
1287e7c33e29SRobert Watson 	UNP_PCB_LOCK(unp);
1288a29f300eSGarrett Wollman 	socantsendmore(so);
1289a29f300eSGarrett Wollman 	unp_shutdown(unp);
1290e7c33e29SRobert Watson 	UNP_PCB_UNLOCK(unp);
1291e5aeaa0cSDag-Erling Smørgrav 	return (0);
1292a29f300eSGarrett Wollman }
1293df8bae1dSRodney W. Grimes 
1294a29f300eSGarrett Wollman static int
129557bf258eSGarrett Wollman uipc_sockaddr(struct socket *so, struct sockaddr **nam)
1296a29f300eSGarrett Wollman {
129740f2ac28SRobert Watson 	struct unpcb *unp;
12980d9ce3a1SRobert Watson 	const struct sockaddr *sa;
1299a29f300eSGarrett Wollman 
13004d4b555eSRobert Watson 	unp = sotounpcb(so);
13014d4b555eSRobert Watson 	KASSERT(unp != NULL, ("uipc_sockaddr: unp == NULL"));
1302e7c33e29SRobert Watson 
13030d9ce3a1SRobert Watson 	*nam = malloc(sizeof(struct sockaddr_un), M_SONAME, M_WAITOK);
1304e7c33e29SRobert Watson 	UNP_PCB_LOCK(unp);
1305fc3fcacfSRobert Watson 	if (unp->unp_addr != NULL)
13060d9ce3a1SRobert Watson 		sa = (struct sockaddr *) unp->unp_addr;
130783f3198bSThomas Moestl 	else
13080d9ce3a1SRobert Watson 		sa = &sun_noname;
13090d9ce3a1SRobert Watson 	bcopy(sa, *nam, sa->sa_len);
1310e7c33e29SRobert Watson 	UNP_PCB_UNLOCK(unp);
1311e5aeaa0cSDag-Erling Smørgrav 	return (0);
1312df8bae1dSRodney W. Grimes }
1313a29f300eSGarrett Wollman 
1314fa9402f2SRobert Watson static struct pr_usrreqs uipc_usrreqs_dgram = {
1315756d52a1SPoul-Henning Kamp 	.pru_abort = 		uipc_abort,
1316756d52a1SPoul-Henning Kamp 	.pru_accept =		uipc_accept,
1317756d52a1SPoul-Henning Kamp 	.pru_attach =		uipc_attach,
1318756d52a1SPoul-Henning Kamp 	.pru_bind =		uipc_bind,
13197493f24eSPawel Jakub Dawidek 	.pru_bindat =		uipc_bindat,
1320756d52a1SPoul-Henning Kamp 	.pru_connect =		uipc_connect,
13217493f24eSPawel Jakub Dawidek 	.pru_connectat =	uipc_connectat,
1322756d52a1SPoul-Henning Kamp 	.pru_connect2 =		uipc_connect2,
1323756d52a1SPoul-Henning Kamp 	.pru_detach =		uipc_detach,
1324756d52a1SPoul-Henning Kamp 	.pru_disconnect =	uipc_disconnect,
1325756d52a1SPoul-Henning Kamp 	.pru_listen =		uipc_listen,
1326756d52a1SPoul-Henning Kamp 	.pru_peeraddr =		uipc_peeraddr,
1327756d52a1SPoul-Henning Kamp 	.pru_rcvd =		uipc_rcvd,
1328756d52a1SPoul-Henning Kamp 	.pru_send =		uipc_send,
1329756d52a1SPoul-Henning Kamp 	.pru_sense =		uipc_sense,
1330756d52a1SPoul-Henning Kamp 	.pru_shutdown =		uipc_shutdown,
1331756d52a1SPoul-Henning Kamp 	.pru_sockaddr =		uipc_sockaddr,
1332fa9402f2SRobert Watson 	.pru_soreceive =	soreceive_dgram,
1333fa9402f2SRobert Watson 	.pru_close =		uipc_close,
1334fa9402f2SRobert Watson };
1335fa9402f2SRobert Watson 
133684d61770SRobert Watson static struct pr_usrreqs uipc_usrreqs_seqpacket = {
133784d61770SRobert Watson 	.pru_abort =		uipc_abort,
133884d61770SRobert Watson 	.pru_accept =		uipc_accept,
133984d61770SRobert Watson 	.pru_attach =		uipc_attach,
134084d61770SRobert Watson 	.pru_bind =		uipc_bind,
13417493f24eSPawel Jakub Dawidek 	.pru_bindat =		uipc_bindat,
134284d61770SRobert Watson 	.pru_connect =		uipc_connect,
13437493f24eSPawel Jakub Dawidek 	.pru_connectat =	uipc_connectat,
134484d61770SRobert Watson 	.pru_connect2 =		uipc_connect2,
134584d61770SRobert Watson 	.pru_detach =		uipc_detach,
134684d61770SRobert Watson 	.pru_disconnect =	uipc_disconnect,
134784d61770SRobert Watson 	.pru_listen =		uipc_listen,
134884d61770SRobert Watson 	.pru_peeraddr =		uipc_peeraddr,
134984d61770SRobert Watson 	.pru_rcvd =		uipc_rcvd,
135084d61770SRobert Watson 	.pru_send =		uipc_send,
135184d61770SRobert Watson 	.pru_sense =		uipc_sense,
135284d61770SRobert Watson 	.pru_shutdown =		uipc_shutdown,
135384d61770SRobert Watson 	.pru_sockaddr =		uipc_sockaddr,
135484d61770SRobert Watson 	.pru_soreceive =	soreceive_generic,	/* XXX: or...? */
135584d61770SRobert Watson 	.pru_close =		uipc_close,
135684d61770SRobert Watson };
135784d61770SRobert Watson 
1358fa9402f2SRobert Watson static struct pr_usrreqs uipc_usrreqs_stream = {
1359fa9402f2SRobert Watson 	.pru_abort = 		uipc_abort,
1360fa9402f2SRobert Watson 	.pru_accept =		uipc_accept,
1361fa9402f2SRobert Watson 	.pru_attach =		uipc_attach,
1362fa9402f2SRobert Watson 	.pru_bind =		uipc_bind,
13637493f24eSPawel Jakub Dawidek 	.pru_bindat =		uipc_bindat,
1364fa9402f2SRobert Watson 	.pru_connect =		uipc_connect,
13657493f24eSPawel Jakub Dawidek 	.pru_connectat =	uipc_connectat,
1366fa9402f2SRobert Watson 	.pru_connect2 =		uipc_connect2,
1367fa9402f2SRobert Watson 	.pru_detach =		uipc_detach,
1368fa9402f2SRobert Watson 	.pru_disconnect =	uipc_disconnect,
1369fa9402f2SRobert Watson 	.pru_listen =		uipc_listen,
1370fa9402f2SRobert Watson 	.pru_peeraddr =		uipc_peeraddr,
1371fa9402f2SRobert Watson 	.pru_rcvd =		uipc_rcvd,
1372fa9402f2SRobert Watson 	.pru_send =		uipc_send,
1373c80ea19bSGleb Smirnoff 	.pru_ready =		uipc_ready,
1374fa9402f2SRobert Watson 	.pru_sense =		uipc_sense,
1375fa9402f2SRobert Watson 	.pru_shutdown =		uipc_shutdown,
1376fa9402f2SRobert Watson 	.pru_sockaddr =		uipc_sockaddr,
1377fa9402f2SRobert Watson 	.pru_soreceive =	soreceive_generic,
1378a152f8a3SRobert Watson 	.pru_close =		uipc_close,
1379a29f300eSGarrett Wollman };
1380df8bae1dSRodney W. Grimes 
13810b36cd25SRobert Watson static int
1382892af6b9SRobert Watson uipc_ctloutput(struct socket *so, struct sockopt *sopt)
13830c1bb4fbSDima Dorfman {
138440f2ac28SRobert Watson 	struct unpcb *unp;
13850d9ce3a1SRobert Watson 	struct xucred xu;
13866a2989fdSMatthew N. Dodd 	int error, optval;
13876a2989fdSMatthew N. Dodd 
13886e0c8e1aSKonstantin Belousov 	if (sopt->sopt_level != SOL_LOCAL)
138996a041b5SMatthew N. Dodd 		return (EINVAL);
139096a041b5SMatthew N. Dodd 
13916a2989fdSMatthew N. Dodd 	unp = sotounpcb(so);
13924d4b555eSRobert Watson 	KASSERT(unp != NULL, ("uipc_ctloutput: unp == NULL"));
13936a2989fdSMatthew N. Dodd 	error = 0;
13940c1bb4fbSDima Dorfman 	switch (sopt->sopt_dir) {
13950c1bb4fbSDima Dorfman 	case SOPT_GET:
13960c1bb4fbSDima Dorfman 		switch (sopt->sopt_name) {
13970c1bb4fbSDima Dorfman 		case LOCAL_PEERCRED:
1398e7c33e29SRobert Watson 			UNP_PCB_LOCK(unp);
13990c1bb4fbSDima Dorfman 			if (unp->unp_flags & UNP_HAVEPC)
14000d9ce3a1SRobert Watson 				xu = unp->unp_peercred;
14010c1bb4fbSDima Dorfman 			else {
14020c1bb4fbSDima Dorfman 				if (so->so_type == SOCK_STREAM)
14030c1bb4fbSDima Dorfman 					error = ENOTCONN;
14040c1bb4fbSDima Dorfman 				else
14050c1bb4fbSDima Dorfman 					error = EINVAL;
14060c1bb4fbSDima Dorfman 			}
1407e7c33e29SRobert Watson 			UNP_PCB_UNLOCK(unp);
14080d9ce3a1SRobert Watson 			if (error == 0)
14090d9ce3a1SRobert Watson 				error = sooptcopyout(sopt, &xu, sizeof(xu));
14100c1bb4fbSDima Dorfman 			break;
1411e7c33e29SRobert Watson 
14126a2989fdSMatthew N. Dodd 		case LOCAL_CREDS:
1413a6357845SRobert Watson 			/* Unlocked read. */
14142de07e40SConrad Meyer 			optval = unp->unp_flags & UNP_WANTCRED_ONESHOT ? 1 : 0;
14152de07e40SConrad Meyer 			error = sooptcopyout(sopt, &optval, sizeof(optval));
14162de07e40SConrad Meyer 			break;
14172de07e40SConrad Meyer 
14182de07e40SConrad Meyer 		case LOCAL_CREDS_PERSISTENT:
14192de07e40SConrad Meyer 			/* Unlocked read. */
14202de07e40SConrad Meyer 			optval = unp->unp_flags & UNP_WANTCRED_ALWAYS ? 1 : 0;
14216a2989fdSMatthew N. Dodd 			error = sooptcopyout(sopt, &optval, sizeof(optval));
14226a2989fdSMatthew N. Dodd 			break;
1423e7c33e29SRobert Watson 
14246a2989fdSMatthew N. Dodd 		case LOCAL_CONNWAIT:
1425a6357845SRobert Watson 			/* Unlocked read. */
14266a2989fdSMatthew N. Dodd 			optval = unp->unp_flags & UNP_CONNWAIT ? 1 : 0;
14276a2989fdSMatthew N. Dodd 			error = sooptcopyout(sopt, &optval, sizeof(optval));
14286a2989fdSMatthew N. Dodd 			break;
1429e7c33e29SRobert Watson 
14300c1bb4fbSDima Dorfman 		default:
14310c1bb4fbSDima Dorfman 			error = EOPNOTSUPP;
14320c1bb4fbSDima Dorfman 			break;
14330c1bb4fbSDima Dorfman 		}
14340c1bb4fbSDima Dorfman 		break;
1435e7c33e29SRobert Watson 
14360c1bb4fbSDima Dorfman 	case SOPT_SET:
14376a2989fdSMatthew N. Dodd 		switch (sopt->sopt_name) {
14386a2989fdSMatthew N. Dodd 		case LOCAL_CREDS:
14392de07e40SConrad Meyer 		case LOCAL_CREDS_PERSISTENT:
14406a2989fdSMatthew N. Dodd 		case LOCAL_CONNWAIT:
14416a2989fdSMatthew N. Dodd 			error = sooptcopyin(sopt, &optval, sizeof(optval),
14426a2989fdSMatthew N. Dodd 					    sizeof(optval));
14436a2989fdSMatthew N. Dodd 			if (error)
14446a2989fdSMatthew N. Dodd 				break;
14456a2989fdSMatthew N. Dodd 
14462de07e40SConrad Meyer #define	OPTSET(bit, exclusive) do {					\
1447e7c33e29SRobert Watson 	UNP_PCB_LOCK(unp);						\
14482de07e40SConrad Meyer 	if (optval) {							\
14492de07e40SConrad Meyer 		if ((unp->unp_flags & (exclusive)) != 0) {		\
14502de07e40SConrad Meyer 			UNP_PCB_UNLOCK(unp);				\
14512de07e40SConrad Meyer 			error = EINVAL;					\
14522de07e40SConrad Meyer 			break;						\
14532de07e40SConrad Meyer 		}							\
14542de07e40SConrad Meyer 		unp->unp_flags |= (bit);				\
14552de07e40SConrad Meyer 	} else								\
14562de07e40SConrad Meyer 		unp->unp_flags &= ~(bit);				\
1457e7c33e29SRobert Watson 	UNP_PCB_UNLOCK(unp);						\
1458e7c33e29SRobert Watson } while (0)
14596a2989fdSMatthew N. Dodd 
14606a2989fdSMatthew N. Dodd 			switch (sopt->sopt_name) {
14616a2989fdSMatthew N. Dodd 			case LOCAL_CREDS:
14622de07e40SConrad Meyer 				OPTSET(UNP_WANTCRED_ONESHOT, UNP_WANTCRED_ALWAYS);
14632de07e40SConrad Meyer 				break;
14642de07e40SConrad Meyer 
14652de07e40SConrad Meyer 			case LOCAL_CREDS_PERSISTENT:
14662de07e40SConrad Meyer 				OPTSET(UNP_WANTCRED_ALWAYS, UNP_WANTCRED_ONESHOT);
14676a2989fdSMatthew N. Dodd 				break;
1468e7c33e29SRobert Watson 
14696a2989fdSMatthew N. Dodd 			case LOCAL_CONNWAIT:
14702de07e40SConrad Meyer 				OPTSET(UNP_CONNWAIT, 0);
14716a2989fdSMatthew N. Dodd 				break;
1472e7c33e29SRobert Watson 
14736a2989fdSMatthew N. Dodd 			default:
14746a2989fdSMatthew N. Dodd 				break;
14756a2989fdSMatthew N. Dodd 			}
14766a2989fdSMatthew N. Dodd 			break;
14776a2989fdSMatthew N. Dodd #undef	OPTSET
14786a2989fdSMatthew N. Dodd 		default:
14796a2989fdSMatthew N. Dodd 			error = ENOPROTOOPT;
14806a2989fdSMatthew N. Dodd 			break;
14816a2989fdSMatthew N. Dodd 		}
1482abb886faSMatthew N. Dodd 		break;
1483e7c33e29SRobert Watson 
14840c1bb4fbSDima Dorfman 	default:
14850c1bb4fbSDima Dorfman 		error = EOPNOTSUPP;
14860c1bb4fbSDima Dorfman 		break;
14870c1bb4fbSDima Dorfman 	}
14880c1bb4fbSDima Dorfman 	return (error);
14890c1bb4fbSDima Dorfman }
14900c1bb4fbSDima Dorfman 
1491f708ef1bSPoul-Henning Kamp static int
1492892af6b9SRobert Watson unp_connect(struct socket *so, struct sockaddr *nam, struct thread *td)
1493df8bae1dSRodney W. Grimes {
14947493f24eSPawel Jakub Dawidek 
14957493f24eSPawel Jakub Dawidek 	return (unp_connectat(AT_FDCWD, so, nam, td));
14967493f24eSPawel Jakub Dawidek }
14977493f24eSPawel Jakub Dawidek 
14987493f24eSPawel Jakub Dawidek static int
14997493f24eSPawel Jakub Dawidek unp_connectat(int fd, struct socket *so, struct sockaddr *nam,
15007493f24eSPawel Jakub Dawidek     struct thread *td)
15017493f24eSPawel Jakub Dawidek {
1502ed92e1c7SMark Johnston 	struct mtx *vplock;
1503ed92e1c7SMark Johnston 	struct sockaddr_un *soun;
1504892af6b9SRobert Watson 	struct vnode *vp;
1505779f106aSGleb Smirnoff 	struct socket *so2;
1506b295bdcdSRobert Watson 	struct unpcb *unp, *unp2, *unp3;
1507df8bae1dSRodney W. Grimes 	struct nameidata nd;
150857bf258eSGarrett Wollman 	char buf[SOCK_MAXADDRLEN];
15090d9ce3a1SRobert Watson 	struct sockaddr *sa;
15107008be5bSPawel Jakub Dawidek 	cap_rights_t rights;
1511ccdadf1aSMark Johnston 	int error, len;
1512ed92e1c7SMark Johnston 	bool connreq;
15130d9ce3a1SRobert Watson 
1514cb7df69bSKevin Lo 	if (nam->sa_family != AF_UNIX)
1515cb7df69bSKevin Lo 		return (EAFNOSUPPORT);
1516a06534c3SBjoern A. Zeeb 	if (nam->sa_len > sizeof(struct sockaddr_un))
1517a06534c3SBjoern A. Zeeb 		return (EINVAL);
151857bf258eSGarrett Wollman 	len = nam->sa_len - offsetof(struct sockaddr_un, sun_path);
151957bf258eSGarrett Wollman 	if (len <= 0)
1520e5aeaa0cSDag-Erling Smørgrav 		return (EINVAL);
1521ed92e1c7SMark Johnston 	soun = (struct sockaddr_un *)nam;
15227928893dSEd Maste 	bcopy(soun->sun_path, buf, len);
15237928893dSEd Maste 	buf[len] = 0;
1524e7c33e29SRobert Watson 
152575a67bf3SMatt Macy 	unp = sotounpcb(so);
1526e7c33e29SRobert Watson 	UNP_PCB_LOCK(unp);
1527ccdadf1aSMark Johnston 	for (;;) {
1528ccdadf1aSMark Johnston 		/*
1529ccdadf1aSMark Johnston 		 * Wait for connection state to stabilize.  If a connection
1530ccdadf1aSMark Johnston 		 * already exists, give up.  For datagram sockets, which permit
1531ccdadf1aSMark Johnston 		 * multiple consecutive connect(2) calls, upper layers are
1532ccdadf1aSMark Johnston 		 * responsible for disconnecting in advance of a subsequent
1533ccdadf1aSMark Johnston 		 * connect(2), but this is not synchronized with PCB connection
1534ccdadf1aSMark Johnston 		 * state.
1535ccdadf1aSMark Johnston 		 *
1536ccdadf1aSMark Johnston 		 * Also make sure that no threads are currently attempting to
1537ccdadf1aSMark Johnston 		 * lock the peer socket, to ensure that unp_conn cannot
1538ccdadf1aSMark Johnston 		 * transition between two valid sockets while locks are dropped.
1539ccdadf1aSMark Johnston 		 */
1540ccdadf1aSMark Johnston 		if (unp->unp_conn != NULL) {
1541ccdadf1aSMark Johnston 			UNP_PCB_UNLOCK(unp);
1542ccdadf1aSMark Johnston 			return (EISCONN);
1543ccdadf1aSMark Johnston 		}
1544ccdadf1aSMark Johnston 		if ((unp->unp_flags & UNP_CONNECTING) != 0) {
1545e7c33e29SRobert Watson 			UNP_PCB_UNLOCK(unp);
15464f1f0ef5SRobert Watson 			return (EALREADY);
15474f1f0ef5SRobert Watson 		}
1548ccdadf1aSMark Johnston 		if (unp->unp_pairbusy > 0) {
1549ccdadf1aSMark Johnston 			unp->unp_flags |= UNP_WAITING;
1550ccdadf1aSMark Johnston 			mtx_sleep(unp, UNP_PCB_LOCKPTR(unp), 0, "unpeer", 0);
1551ccdadf1aSMark Johnston 			continue;
1552ccdadf1aSMark Johnston 		}
1553ccdadf1aSMark Johnston 		break;
1554ccdadf1aSMark Johnston 	}
155505102f04SRobert Watson 	unp->unp_flags |= UNP_CONNECTING;
1556e7c33e29SRobert Watson 	UNP_PCB_UNLOCK(unp);
1557e7c33e29SRobert Watson 
1558ed92e1c7SMark Johnston 	connreq = (so->so_proto->pr_flags & PR_CONNREQUIRED) != 0;
1559ed92e1c7SMark Johnston 	if (connreq)
15600d9ce3a1SRobert Watson 		sa = malloc(sizeof(struct sockaddr_un), M_SONAME, M_WAITOK);
1561ed92e1c7SMark Johnston 	else
1562ed92e1c7SMark Johnston 		sa = NULL;
15637493f24eSPawel Jakub Dawidek 	NDINIT_ATRIGHTS(&nd, LOOKUP, FOLLOW | LOCKSHARED | LOCKLEAF,
15646b3a9a0fSMateusz Guzik 	    UIO_SYSSPACE, buf, fd, cap_rights_init_one(&rights, CAP_CONNECTAT),
15656b3a9a0fSMateusz Guzik 	    td);
1566797f2d22SPoul-Henning Kamp 	error = namei(&nd);
1567797f2d22SPoul-Henning Kamp 	if (error)
15680d9ce3a1SRobert Watson 		vp = NULL;
15690d9ce3a1SRobert Watson 	else
1570df8bae1dSRodney W. Grimes 		vp = nd.ni_vp;
15710d9ce3a1SRobert Watson 	ASSERT_VOP_LOCKED(vp, "unp_connect");
1572cdb62ab7SMateusz Guzik 	NDFREE_NOTHING(&nd);
15730d9ce3a1SRobert Watson 	if (error)
15740d9ce3a1SRobert Watson 		goto bad;
15750d9ce3a1SRobert Watson 
1576df8bae1dSRodney W. Grimes 	if (vp->v_type != VSOCK) {
1577df8bae1dSRodney W. Grimes 		error = ENOTSOCK;
1578df8bae1dSRodney W. Grimes 		goto bad;
1579df8bae1dSRodney W. Grimes 	}
15806fac927cSRobert Watson #ifdef MAC
158130d239bcSRobert Watson 	error = mac_vnode_check_open(td->td_ucred, vp, VWRITE | VREAD);
15826fac927cSRobert Watson 	if (error)
15836fac927cSRobert Watson 		goto bad;
15846fac927cSRobert Watson #endif
1585a854ed98SJohn Baldwin 	error = VOP_ACCESS(vp, VWRITE, td->td_ucred, td);
1586797f2d22SPoul-Henning Kamp 	if (error)
1587df8bae1dSRodney W. Grimes 		goto bad;
1588e7c33e29SRobert Watson 
1589b295bdcdSRobert Watson 	unp = sotounpcb(so);
15904d4b555eSRobert Watson 	KASSERT(unp != NULL, ("unp_connect: unp == NULL"));
1591e7c33e29SRobert Watson 
159275a67bf3SMatt Macy 	vplock = mtx_pool_find(mtxpool_sleep, vp);
159375a67bf3SMatt Macy 	mtx_lock(vplock);
15940c3c207fSGleb Smirnoff 	VOP_UNP_CONNECT(vp, &unp2);
15950c3c207fSGleb Smirnoff 	if (unp2 == NULL) {
1596df8bae1dSRodney W. Grimes 		error = ECONNREFUSED;
15972260c03dSRobert Watson 		goto bad2;
1598df8bae1dSRodney W. Grimes 	}
15990c3c207fSGleb Smirnoff 	so2 = unp2->unp_socket;
1600df8bae1dSRodney W. Grimes 	if (so->so_type != so2->so_type) {
1601df8bae1dSRodney W. Grimes 		error = EPROTOTYPE;
16022260c03dSRobert Watson 		goto bad2;
1603df8bae1dSRodney W. Grimes 	}
1604ed92e1c7SMark Johnston 	if (connreq) {
1605e7c33e29SRobert Watson 		if (so2->so_options & SO_ACCEPTCONN) {
16061fb51a12SBjoern A. Zeeb 			CURVNET_SET(so2->so_vnet);
1607779f106aSGleb Smirnoff 			so2 = sonewconn(so2, 0);
16081fb51a12SBjoern A. Zeeb 			CURVNET_RESTORE();
1609e7c33e29SRobert Watson 		} else
1610779f106aSGleb Smirnoff 			so2 = NULL;
1611779f106aSGleb Smirnoff 		if (so2 == NULL) {
1612df8bae1dSRodney W. Grimes 			error = ECONNREFUSED;
1613cb8f450bSMatt Macy 			goto bad2;
1614df8bae1dSRodney W. Grimes 		}
1615779f106aSGleb Smirnoff 		unp3 = sotounpcb(so2);
16164820bf6aSMark Johnston 		unp_pcb_lock_pair(unp2, unp3);
16170d9ce3a1SRobert Watson 		if (unp2->unp_addr != NULL) {
16180d9ce3a1SRobert Watson 			bcopy(unp2->unp_addr, sa, unp2->unp_addr->sun_len);
16190d9ce3a1SRobert Watson 			unp3->unp_addr = (struct sockaddr_un *) sa;
16200d9ce3a1SRobert Watson 			sa = NULL;
16210d9ce3a1SRobert Watson 		}
1622b523ec24SRobert Watson 
1623da446550SAlan Somers 		unp_copy_peercred(td, unp3, unp, unp2);
1624b523ec24SRobert Watson 
1625e7c33e29SRobert Watson 		UNP_PCB_UNLOCK(unp2);
1626779f106aSGleb Smirnoff 		unp2 = unp3;
1627ccdadf1aSMark Johnston 
1628ccdadf1aSMark Johnston 		/*
1629ccdadf1aSMark Johnston 		 * It is safe to block on the PCB lock here since unp2 is
1630ccdadf1aSMark Johnston 		 * nascent and cannot be connected to any other sockets.
1631ccdadf1aSMark Johnston 		 */
1632ccdadf1aSMark Johnston 		UNP_PCB_LOCK(unp);
1633335654d7SRobert Watson #ifdef MAC
1634779f106aSGleb Smirnoff 		mac_socketpeer_set_from_socket(so, so2);
1635779f106aSGleb Smirnoff 		mac_socketpeer_set_from_socket(so2, so);
1636335654d7SRobert Watson #endif
1637a3a73490SMatt Macy 	} else {
16384820bf6aSMark Johnston 		unp_pcb_lock_pair(unp, unp2);
1639a3a73490SMatt Macy 	}
1640779f106aSGleb Smirnoff 	KASSERT(unp2 != NULL && so2 != NULL && unp2->unp_socket == so2 &&
1641779f106aSGleb Smirnoff 	    sotounpcb(so2) == unp2,
1642779f106aSGleb Smirnoff 	    ("%s: unp2 %p so2 %p", __func__, unp2, so2));
16436a2989fdSMatthew N. Dodd 	error = unp_connect2(so, so2, PRU_CONNECT);
16444820bf6aSMark Johnston 	unp_pcb_unlock_pair(unp, unp2);
16450d9ce3a1SRobert Watson bad2:
164675a67bf3SMatt Macy 	mtx_unlock(vplock);
1647df8bae1dSRodney W. Grimes bad:
164875a67bf3SMatt Macy 	if (vp != NULL) {
1649df8bae1dSRodney W. Grimes 		vput(vp);
165075a67bf3SMatt Macy 	}
16510d9ce3a1SRobert Watson 	free(sa, M_SONAME);
1652e7c33e29SRobert Watson 	UNP_PCB_LOCK(unp);
1653ccdadf1aSMark Johnston 	KASSERT((unp->unp_flags & UNP_CONNECTING) != 0,
1654ccdadf1aSMark Johnston 	    ("%s: unp %p has UNP_CONNECTING clear", __func__, unp));
16554f1f0ef5SRobert Watson 	unp->unp_flags &= ~UNP_CONNECTING;
1656e7c33e29SRobert Watson 	UNP_PCB_UNLOCK(unp);
1657df8bae1dSRodney W. Grimes 	return (error);
1658df8bae1dSRodney W. Grimes }
1659df8bae1dSRodney W. Grimes 
1660da446550SAlan Somers /*
1661da446550SAlan Somers  * Set socket peer credentials at connection time.
1662da446550SAlan Somers  *
1663da446550SAlan Somers  * The client's PCB credentials are copied from its process structure.  The
1664da446550SAlan Somers  * server's PCB credentials are copied from the socket on which it called
1665da446550SAlan Somers  * listen(2).  uipc_listen cached that process's credentials at the time.
1666da446550SAlan Somers  */
1667da446550SAlan Somers void
1668da446550SAlan Somers unp_copy_peercred(struct thread *td, struct unpcb *client_unp,
1669da446550SAlan Somers     struct unpcb *server_unp, struct unpcb *listen_unp)
1670da446550SAlan Somers {
1671c5afec6eSDmitry Chagin 	cru2xt(td, &client_unp->unp_peercred);
1672da446550SAlan Somers 	client_unp->unp_flags |= UNP_HAVEPC;
1673da446550SAlan Somers 
1674da446550SAlan Somers 	memcpy(&server_unp->unp_peercred, &listen_unp->unp_peercred,
1675da446550SAlan Somers 	    sizeof(server_unp->unp_peercred));
1676da446550SAlan Somers 	server_unp->unp_flags |= UNP_HAVEPC;
16772de07e40SConrad Meyer 	client_unp->unp_flags |= (listen_unp->unp_flags & UNP_WANTCRED_MASK);
1678da446550SAlan Somers }
1679da446550SAlan Somers 
1680db48c0d2SRobert Watson static int
16816a2989fdSMatthew N. Dodd unp_connect2(struct socket *so, struct socket *so2, int req)
1682df8bae1dSRodney W. Grimes {
1683e7c33e29SRobert Watson 	struct unpcb *unp;
1684892af6b9SRobert Watson 	struct unpcb *unp2;
1685df8bae1dSRodney W. Grimes 
1686e7c33e29SRobert Watson 	unp = sotounpcb(so);
1687e7c33e29SRobert Watson 	KASSERT(unp != NULL, ("unp_connect2: unp == NULL"));
1688e7c33e29SRobert Watson 	unp2 = sotounpcb(so2);
1689e7c33e29SRobert Watson 	KASSERT(unp2 != NULL, ("unp_connect2: unp2 == NULL"));
1690e7c33e29SRobert Watson 
1691e7c33e29SRobert Watson 	UNP_PCB_LOCK_ASSERT(unp);
1692e7c33e29SRobert Watson 	UNP_PCB_LOCK_ASSERT(unp2);
1693ccdadf1aSMark Johnston 	KASSERT(unp->unp_conn == NULL,
1694ccdadf1aSMark Johnston 	    ("%s: socket %p is already connected", __func__, unp));
16950d9ce3a1SRobert Watson 
1696df8bae1dSRodney W. Grimes 	if (so2->so_type != so->so_type)
1697df8bae1dSRodney W. Grimes 		return (EPROTOTYPE);
1698df8bae1dSRodney W. Grimes 	unp->unp_conn = unp2;
169975a67bf3SMatt Macy 	unp_pcb_hold(unp2);
170075a67bf3SMatt Macy 	unp_pcb_hold(unp);
1701df8bae1dSRodney W. Grimes 	switch (so->so_type) {
1702df8bae1dSRodney W. Grimes 	case SOCK_DGRAM:
170375a67bf3SMatt Macy 		UNP_REF_LIST_LOCK();
170498271db4SGarrett Wollman 		LIST_INSERT_HEAD(&unp2->unp_refs, unp, unp_reflink);
170575a67bf3SMatt Macy 		UNP_REF_LIST_UNLOCK();
1706df8bae1dSRodney W. Grimes 		soisconnected(so);
1707df8bae1dSRodney W. Grimes 		break;
1708df8bae1dSRodney W. Grimes 
1709df8bae1dSRodney W. Grimes 	case SOCK_STREAM:
171084d61770SRobert Watson 	case SOCK_SEQPACKET:
1711ccdadf1aSMark Johnston 		KASSERT(unp2->unp_conn == NULL,
1712ccdadf1aSMark Johnston 		    ("%s: socket %p is already connected", __func__, unp2));
1713df8bae1dSRodney W. Grimes 		unp2->unp_conn = unp;
17146a2989fdSMatthew N. Dodd 		if (req == PRU_CONNECT &&
17156a2989fdSMatthew N. Dodd 		    ((unp->unp_flags | unp2->unp_flags) & UNP_CONNWAIT))
17166a2989fdSMatthew N. Dodd 			soisconnecting(so);
17176a2989fdSMatthew N. Dodd 		else
1718df8bae1dSRodney W. Grimes 			soisconnected(so);
1719df8bae1dSRodney W. Grimes 		soisconnected(so2);
1720df8bae1dSRodney W. Grimes 		break;
1721df8bae1dSRodney W. Grimes 
1722df8bae1dSRodney W. Grimes 	default:
1723df8bae1dSRodney W. Grimes 		panic("unp_connect2");
1724df8bae1dSRodney W. Grimes 	}
1725df8bae1dSRodney W. Grimes 	return (0);
1726df8bae1dSRodney W. Grimes }
1727df8bae1dSRodney W. Grimes 
1728f708ef1bSPoul-Henning Kamp static void
1729e7c33e29SRobert Watson unp_disconnect(struct unpcb *unp, struct unpcb *unp2)
1730df8bae1dSRodney W. Grimes {
173175a67bf3SMatt Macy 	struct socket *so, *so2;
1732f0317f86SMark Johnston #ifdef INVARIANTS
1733f0317f86SMark Johnston 	struct unpcb *unptmp;
1734f0317f86SMark Johnston #endif
17350d9ce3a1SRobert Watson 
1736e7c33e29SRobert Watson 	UNP_PCB_LOCK_ASSERT(unp);
1737e7c33e29SRobert Watson 	UNP_PCB_LOCK_ASSERT(unp2);
1738f0317f86SMark Johnston 	KASSERT(unp->unp_conn == unp2,
1739f0317f86SMark Johnston 	    ("%s: unpcb %p is not connected to %p", __func__, unp, unp2));
1740e7c33e29SRobert Watson 
1741fc3fcacfSRobert Watson 	unp->unp_conn = NULL;
174275a67bf3SMatt Macy 	so = unp->unp_socket;
174375a67bf3SMatt Macy 	so2 = unp2->unp_socket;
1744df8bae1dSRodney W. Grimes 	switch (unp->unp_socket->so_type) {
1745df8bae1dSRodney W. Grimes 	case SOCK_DGRAM:
174675a67bf3SMatt Macy 		UNP_REF_LIST_LOCK();
1747f0317f86SMark Johnston #ifdef INVARIANTS
1748f0317f86SMark Johnston 		LIST_FOREACH(unptmp, &unp2->unp_refs, unp_reflink) {
1749f0317f86SMark Johnston 			if (unptmp == unp)
1750f0317f86SMark Johnston 				break;
1751f0317f86SMark Johnston 		}
1752f0317f86SMark Johnston 		KASSERT(unptmp != NULL,
1753f0317f86SMark Johnston 		    ("%s: %p not found in reflist of %p", __func__, unp, unp2));
1754f0317f86SMark Johnston #endif
175598271db4SGarrett Wollman 		LIST_REMOVE(unp, unp_reflink);
175675a67bf3SMatt Macy 		UNP_REF_LIST_UNLOCK();
175775a67bf3SMatt Macy 		if (so) {
17581b2e3b4bSRobert Watson 			SOCK_LOCK(so);
17591b2e3b4bSRobert Watson 			so->so_state &= ~SS_ISCONNECTED;
17601b2e3b4bSRobert Watson 			SOCK_UNLOCK(so);
176175a67bf3SMatt Macy 		}
1762df8bae1dSRodney W. Grimes 		break;
1763df8bae1dSRodney W. Grimes 
1764df8bae1dSRodney W. Grimes 	case SOCK_STREAM:
176584d61770SRobert Watson 	case SOCK_SEQPACKET:
176675a67bf3SMatt Macy 		if (so)
176775a67bf3SMatt Macy 			soisdisconnected(so);
176875a67bf3SMatt Macy 		MPASS(unp2->unp_conn == unp);
1769fc3fcacfSRobert Watson 		unp2->unp_conn = NULL;
177075a67bf3SMatt Macy 		if (so2)
177175a67bf3SMatt Macy 			soisdisconnected(so2);
1772df8bae1dSRodney W. Grimes 		break;
1773df8bae1dSRodney W. Grimes 	}
1774f0317f86SMark Johnston 
1775f0317f86SMark Johnston 	if (unp == unp2) {
1776f0317f86SMark Johnston 		unp_pcb_rele_notlast(unp);
1777f0317f86SMark Johnston 		if (!unp_pcb_rele(unp))
1778f0317f86SMark Johnston 			UNP_PCB_UNLOCK(unp);
1779f0317f86SMark Johnston 	} else {
1780f0317f86SMark Johnston 		if (!unp_pcb_rele(unp))
1781f0317f86SMark Johnston 			UNP_PCB_UNLOCK(unp);
1782f0317f86SMark Johnston 		if (!unp_pcb_rele(unp2))
1783f0317f86SMark Johnston 			UNP_PCB_UNLOCK(unp2);
1784f0317f86SMark Johnston 	}
1785df8bae1dSRodney W. Grimes }
1786df8bae1dSRodney W. Grimes 
17870d9ce3a1SRobert Watson /*
1788d7924b70SRobert Watson  * unp_pcblist() walks the global list of struct unpcb's to generate a
1789d7924b70SRobert Watson  * pointer list, bumping the refcount on each unpcb.  It then copies them out
1790d7924b70SRobert Watson  * sequentially, validating the generation number on each to see if it has
1791d7924b70SRobert Watson  * been detached.  All of this is necessary because copyout() may sleep on
1792d7924b70SRobert Watson  * disk I/O.
17930d9ce3a1SRobert Watson  */
179498271db4SGarrett Wollman static int
179582d9ae4eSPoul-Henning Kamp unp_pcblist(SYSCTL_HANDLER_ARGS)
179698271db4SGarrett Wollman {
179798271db4SGarrett Wollman 	struct unpcb *unp, **unp_list;
179898271db4SGarrett Wollman 	unp_gen_t gencnt;
17998f364875SJulian Elischer 	struct xunpgen *xug;
180098271db4SGarrett Wollman 	struct unp_head *head;
18018f364875SJulian Elischer 	struct xunpcb *xu;
1802d821d364SPedro F. Giffuni 	u_int i;
18035362170dSMark Johnston 	int error, n;
180498271db4SGarrett Wollman 
180584d61770SRobert Watson 	switch ((intptr_t)arg1) {
180684d61770SRobert Watson 	case SOCK_STREAM:
180784d61770SRobert Watson 		head = &unp_shead;
180884d61770SRobert Watson 		break;
180984d61770SRobert Watson 
181084d61770SRobert Watson 	case SOCK_DGRAM:
181184d61770SRobert Watson 		head = &unp_dhead;
181284d61770SRobert Watson 		break;
181384d61770SRobert Watson 
181484d61770SRobert Watson 	case SOCK_SEQPACKET:
181584d61770SRobert Watson 		head = &unp_sphead;
181684d61770SRobert Watson 		break;
181784d61770SRobert Watson 
181884d61770SRobert Watson 	default:
1819604f19c9SRobert Watson 		panic("unp_pcblist: arg1 %d", (int)(intptr_t)arg1);
182084d61770SRobert Watson 	}
182198271db4SGarrett Wollman 
182298271db4SGarrett Wollman 	/*
182398271db4SGarrett Wollman 	 * The process of preparing the PCB list is too time-consuming and
182498271db4SGarrett Wollman 	 * resource-intensive to repeat twice on every request.
182598271db4SGarrett Wollman 	 */
1826fc3fcacfSRobert Watson 	if (req->oldptr == NULL) {
182798271db4SGarrett Wollman 		n = unp_count;
18288f364875SJulian Elischer 		req->oldidx = 2 * (sizeof *xug)
182998271db4SGarrett Wollman 			+ (n + n/8) * sizeof(struct xunpcb);
1830e5aeaa0cSDag-Erling Smørgrav 		return (0);
183198271db4SGarrett Wollman 	}
183298271db4SGarrett Wollman 
1833fc3fcacfSRobert Watson 	if (req->newptr != NULL)
1834e5aeaa0cSDag-Erling Smørgrav 		return (EPERM);
183598271db4SGarrett Wollman 
183698271db4SGarrett Wollman 	/*
183798271db4SGarrett Wollman 	 * OK, now we're committed to doing something.
183898271db4SGarrett Wollman 	 */
183979db6fe7SMark Johnston 	xug = malloc(sizeof(*xug), M_TEMP, M_WAITOK | M_ZERO);
1840779f106aSGleb Smirnoff 	UNP_LINK_RLOCK();
184198271db4SGarrett Wollman 	gencnt = unp_gencnt;
184298271db4SGarrett Wollman 	n = unp_count;
1843779f106aSGleb Smirnoff 	UNP_LINK_RUNLOCK();
184498271db4SGarrett Wollman 
18458f364875SJulian Elischer 	xug->xug_len = sizeof *xug;
18468f364875SJulian Elischer 	xug->xug_count = n;
18478f364875SJulian Elischer 	xug->xug_gen = gencnt;
18488f364875SJulian Elischer 	xug->xug_sogen = so_gencnt;
18498f364875SJulian Elischer 	error = SYSCTL_OUT(req, xug, sizeof *xug);
18508f364875SJulian Elischer 	if (error) {
18518f364875SJulian Elischer 		free(xug, M_TEMP);
1852e5aeaa0cSDag-Erling Smørgrav 		return (error);
18538f364875SJulian Elischer 	}
185498271db4SGarrett Wollman 
1855a163d034SWarner Losh 	unp_list = malloc(n * sizeof *unp_list, M_TEMP, M_WAITOK);
185698271db4SGarrett Wollman 
1857779f106aSGleb Smirnoff 	UNP_LINK_RLOCK();
18582e3c8fcbSPoul-Henning Kamp 	for (unp = LIST_FIRST(head), i = 0; unp && i < n;
18592e3c8fcbSPoul-Henning Kamp 	     unp = LIST_NEXT(unp, unp_link)) {
1860e7c33e29SRobert Watson 		UNP_PCB_LOCK(unp);
18618a7d8cc6SRobert Watson 		if (unp->unp_gencnt <= gencnt) {
1862a854ed98SJohn Baldwin 			if (cr_cansee(req->td->td_ucred,
1863e7c33e29SRobert Watson 			    unp->unp_socket->so_cred)) {
1864e7c33e29SRobert Watson 				UNP_PCB_UNLOCK(unp);
18654787fd37SPaul Saab 				continue;
1866e7c33e29SRobert Watson 			}
186798271db4SGarrett Wollman 			unp_list[i++] = unp;
186875a67bf3SMatt Macy 			unp_pcb_hold(unp);
186998271db4SGarrett Wollman 		}
1870e7c33e29SRobert Watson 		UNP_PCB_UNLOCK(unp);
18714787fd37SPaul Saab 	}
1872779f106aSGleb Smirnoff 	UNP_LINK_RUNLOCK();
18731c381b19SRobert Watson 	n = i;			/* In case we lost some during malloc. */
187498271db4SGarrett Wollman 
187598271db4SGarrett Wollman 	error = 0;
1876fe2eee82SColin Percival 	xu = malloc(sizeof(*xu), M_TEMP, M_WAITOK | M_ZERO);
187798271db4SGarrett Wollman 	for (i = 0; i < n; i++) {
187898271db4SGarrett Wollman 		unp = unp_list[i];
1879e7c33e29SRobert Watson 		UNP_PCB_LOCK(unp);
18805362170dSMark Johnston 		if (unp_pcb_rele(unp))
18815362170dSMark Johnston 			continue;
188275a67bf3SMatt Macy 
18835362170dSMark Johnston 		if (unp->unp_gencnt <= gencnt) {
18848f364875SJulian Elischer 			xu->xu_len = sizeof *xu;
18853a20f06aSBrooks Davis 			xu->xu_unpp = (uintptr_t)unp;
188698271db4SGarrett Wollman 			/*
188798271db4SGarrett Wollman 			 * XXX - need more locking here to protect against
188898271db4SGarrett Wollman 			 * connect/disconnect races for SMP.
188998271db4SGarrett Wollman 			 */
1890fc3fcacfSRobert Watson 			if (unp->unp_addr != NULL)
18918f364875SJulian Elischer 				bcopy(unp->unp_addr, &xu->xu_addr,
189298271db4SGarrett Wollman 				      unp->unp_addr->sun_len);
18930e229f34SGleb Smirnoff 			else
18940e229f34SGleb Smirnoff 				bzero(&xu->xu_addr, sizeof(xu->xu_addr));
1895fc3fcacfSRobert Watson 			if (unp->unp_conn != NULL &&
1896fc3fcacfSRobert Watson 			    unp->unp_conn->unp_addr != NULL)
189798271db4SGarrett Wollman 				bcopy(unp->unp_conn->unp_addr,
18988f364875SJulian Elischer 				      &xu->xu_caddr,
189998271db4SGarrett Wollman 				      unp->unp_conn->unp_addr->sun_len);
19000e229f34SGleb Smirnoff 			else
19010e229f34SGleb Smirnoff 				bzero(&xu->xu_caddr, sizeof(xu->xu_caddr));
19023a20f06aSBrooks Davis 			xu->unp_vnode = (uintptr_t)unp->unp_vnode;
19033a20f06aSBrooks Davis 			xu->unp_conn = (uintptr_t)unp->unp_conn;
19043a20f06aSBrooks Davis 			xu->xu_firstref = (uintptr_t)LIST_FIRST(&unp->unp_refs);
19053a20f06aSBrooks Davis 			xu->xu_nextref = (uintptr_t)LIST_NEXT(unp, unp_reflink);
19060e229f34SGleb Smirnoff 			xu->unp_gencnt = unp->unp_gencnt;
19078f364875SJulian Elischer 			sotoxsocket(unp->unp_socket, &xu->xu_socket);
1908e7c33e29SRobert Watson 			UNP_PCB_UNLOCK(unp);
19098f364875SJulian Elischer 			error = SYSCTL_OUT(req, xu, sizeof *xu);
19105362170dSMark Johnston 		} else {
1911e7c33e29SRobert Watson 			UNP_PCB_UNLOCK(unp);
1912e7c33e29SRobert Watson 		}
19135362170dSMark Johnston 	}
19148f364875SJulian Elischer 	free(xu, M_TEMP);
191598271db4SGarrett Wollman 	if (!error) {
191698271db4SGarrett Wollman 		/*
19171c381b19SRobert Watson 		 * Give the user an updated idea of our state.  If the
19181c381b19SRobert Watson 		 * generation differs from what we told her before, she knows
19191c381b19SRobert Watson 		 * that something happened while we were processing this
19201c381b19SRobert Watson 		 * request, and it might be necessary to retry.
192198271db4SGarrett Wollman 		 */
19228f364875SJulian Elischer 		xug->xug_gen = unp_gencnt;
19238f364875SJulian Elischer 		xug->xug_sogen = so_gencnt;
19248f364875SJulian Elischer 		xug->xug_count = unp_count;
19258f364875SJulian Elischer 		error = SYSCTL_OUT(req, xug, sizeof *xug);
192698271db4SGarrett Wollman 	}
192798271db4SGarrett Wollman 	free(unp_list, M_TEMP);
19288f364875SJulian Elischer 	free(xug, M_TEMP);
1929e5aeaa0cSDag-Erling Smørgrav 	return (error);
193098271db4SGarrett Wollman }
193198271db4SGarrett Wollman 
19327029da5cSPawel Biernacki SYSCTL_PROC(_net_local_dgram, OID_AUTO, pcblist,
19337029da5cSPawel Biernacki     CTLTYPE_OPAQUE | CTLFLAG_RD | CTLFLAG_MPSAFE,
19342fee06f0SMatthew D Fleming     (void *)(intptr_t)SOCK_DGRAM, 0, unp_pcblist, "S,xunpcb",
193598271db4SGarrett Wollman     "List of active local datagram sockets");
19367029da5cSPawel Biernacki SYSCTL_PROC(_net_local_stream, OID_AUTO, pcblist,
19377029da5cSPawel Biernacki     CTLTYPE_OPAQUE | CTLFLAG_RD | CTLFLAG_MPSAFE,
19382fee06f0SMatthew D Fleming     (void *)(intptr_t)SOCK_STREAM, 0, unp_pcblist, "S,xunpcb",
193998271db4SGarrett Wollman     "List of active local stream sockets");
19402fee06f0SMatthew D Fleming SYSCTL_PROC(_net_local_seqpacket, OID_AUTO, pcblist,
19417029da5cSPawel Biernacki     CTLTYPE_OPAQUE | CTLFLAG_RD | CTLFLAG_MPSAFE,
19422fee06f0SMatthew D Fleming     (void *)(intptr_t)SOCK_SEQPACKET, 0, unp_pcblist, "S,xunpcb",
194384d61770SRobert Watson     "List of active local seqpacket sockets");
194498271db4SGarrett Wollman 
1945f708ef1bSPoul-Henning Kamp static void
1946892af6b9SRobert Watson unp_shutdown(struct unpcb *unp)
1947df8bae1dSRodney W. Grimes {
1948e7c33e29SRobert Watson 	struct unpcb *unp2;
1949df8bae1dSRodney W. Grimes 	struct socket *so;
1950df8bae1dSRodney W. Grimes 
1951e7c33e29SRobert Watson 	UNP_PCB_LOCK_ASSERT(unp);
19520d9ce3a1SRobert Watson 
1953e7c33e29SRobert Watson 	unp2 = unp->unp_conn;
195484d61770SRobert Watson 	if ((unp->unp_socket->so_type == SOCK_STREAM ||
195584d61770SRobert Watson 	    (unp->unp_socket->so_type == SOCK_SEQPACKET)) && unp2 != NULL) {
1956e7c33e29SRobert Watson 		so = unp2->unp_socket;
1957e7c33e29SRobert Watson 		if (so != NULL)
1958df8bae1dSRodney W. Grimes 			socantrcvmore(so);
1959df8bae1dSRodney W. Grimes 	}
1960e7c33e29SRobert Watson }
1961df8bae1dSRodney W. Grimes 
1962f708ef1bSPoul-Henning Kamp static void
1963afc055d9SEd Schouten unp_drop(struct unpcb *unp)
1964df8bae1dSRodney W. Grimes {
1965df8bae1dSRodney W. Grimes 	struct socket *so = unp->unp_socket;
1966e7c33e29SRobert Watson 	struct unpcb *unp2;
19670d9ce3a1SRobert Watson 
1968afc055d9SEd Schouten 	/*
1969afc055d9SEd Schouten 	 * Regardless of whether the socket's peer dropped the connection
1970afc055d9SEd Schouten 	 * with this socket by aborting or disconnecting, POSIX requires
1971afc055d9SEd Schouten 	 * that ECONNRESET is returned.
1972afc055d9SEd Schouten 	 */
197375a67bf3SMatt Macy 
197475a67bf3SMatt Macy 	UNP_PCB_LOCK(unp);
197575a67bf3SMatt Macy 	if (so)
1976afc055d9SEd Schouten 		so->so_error = ECONNRESET;
1977ccdadf1aSMark Johnston 	if ((unp2 = unp_pcb_lock_peer(unp)) != NULL) {
1978f0317f86SMark Johnston 		/* Last reference dropped in unp_disconnect(). */
1979f0317f86SMark Johnston 		unp_pcb_rele_notlast(unp);
1980e7c33e29SRobert Watson 		unp_disconnect(unp, unp2);
1981f0317f86SMark Johnston 	} else if (!unp_pcb_rele(unp)) {
198275a67bf3SMatt Macy 		UNP_PCB_UNLOCK(unp);
198375a67bf3SMatt Macy 	}
1984f0317f86SMark Johnston }
1985df8bae1dSRodney W. Grimes 
19862bc21ed9SDavid Malone static void
19878cb539f1SPawel Jakub Dawidek unp_freerights(struct filedescent **fdep, int fdcount)
1988df8bae1dSRodney W. Grimes {
19892bc21ed9SDavid Malone 	struct file *fp;
19902609222aSPawel Jakub Dawidek 	int i;
1991df8bae1dSRodney W. Grimes 
199282e825c4SGleb Smirnoff 	KASSERT(fdcount > 0, ("%s: fdcount %d", __func__, fdcount));
199382e825c4SGleb Smirnoff 
19948cb539f1SPawel Jakub Dawidek 	for (i = 0; i < fdcount; i++) {
19958cb539f1SPawel Jakub Dawidek 		fp = fdep[i]->fde_file;
19968cb539f1SPawel Jakub Dawidek 		filecaps_free(&fdep[i]->fde_caps);
19978692c025SYoshinobu Inoue 		unp_discard(fp);
1998df8bae1dSRodney W. Grimes 	}
19998cb539f1SPawel Jakub Dawidek 	free(fdep[0], M_FILECAPS);
20002bc21ed9SDavid Malone }
20012bc21ed9SDavid Malone 
20020b36cd25SRobert Watson static int
2003c2e3c52eSJilles Tjoelker unp_externalize(struct mbuf *control, struct mbuf **controlp, int flags)
20042bc21ed9SDavid Malone {
20052bc21ed9SDavid Malone 	struct thread *td = curthread;		/* XXX */
20062bc21ed9SDavid Malone 	struct cmsghdr *cm = mtod(control, struct cmsghdr *);
20072bc21ed9SDavid Malone 	int i;
20082bc21ed9SDavid Malone 	int *fdp;
20092609222aSPawel Jakub Dawidek 	struct filedesc *fdesc = td->td_proc->p_fd;
2010ea31808cSMateusz Guzik 	struct filedescent **fdep;
20112bc21ed9SDavid Malone 	void *data;
20122bc21ed9SDavid Malone 	socklen_t clen = control->m_len, datalen;
20132bc21ed9SDavid Malone 	int error, newfds;
20142bc21ed9SDavid Malone 	u_int newlen;
20152bc21ed9SDavid Malone 
20163dab55bcSRobert Watson 	UNP_LINK_UNLOCK_ASSERT();
20174c5bc1caSRobert Watson 
20182bc21ed9SDavid Malone 	error = 0;
20192bc21ed9SDavid Malone 	if (controlp != NULL) /* controlp == NULL => free control messages */
20202bc21ed9SDavid Malone 		*controlp = NULL;
20212bc21ed9SDavid Malone 	while (cm != NULL) {
20222bc21ed9SDavid Malone 		if (sizeof(*cm) > clen || cm->cmsg_len > clen) {
20232bc21ed9SDavid Malone 			error = EINVAL;
20242bc21ed9SDavid Malone 			break;
20252bc21ed9SDavid Malone 		}
20262bc21ed9SDavid Malone 		data = CMSG_DATA(cm);
20272bc21ed9SDavid Malone 		datalen = (caddr_t)cm + cm->cmsg_len - (caddr_t)data;
20282bc21ed9SDavid Malone 		if (cm->cmsg_level == SOL_SOCKET
20292bc21ed9SDavid Malone 		    && cm->cmsg_type == SCM_RIGHTS) {
20302609222aSPawel Jakub Dawidek 			newfds = datalen / sizeof(*fdep);
203182e825c4SGleb Smirnoff 			if (newfds == 0)
203282e825c4SGleb Smirnoff 				goto next;
20332609222aSPawel Jakub Dawidek 			fdep = data;
20342bc21ed9SDavid Malone 
2035e2f9a08bSOlivier Houchard 			/* If we're not outputting the descriptors free them. */
20362bc21ed9SDavid Malone 			if (error || controlp == NULL) {
20372609222aSPawel Jakub Dawidek 				unp_freerights(fdep, newfds);
20382bc21ed9SDavid Malone 				goto next;
20392bc21ed9SDavid Malone 			}
20402609222aSPawel Jakub Dawidek 			FILEDESC_XLOCK(fdesc);
204160a5ef26SRobert Watson 
2042ed5b7817SJulian Elischer 			/*
20431c381b19SRobert Watson 			 * Now change each pointer to an fd in the global
20441c381b19SRobert Watson 			 * table to an integer that is the index to the local
20451c381b19SRobert Watson 			 * fd table entry that we set up to point to the
20461c381b19SRobert Watson 			 * global one we are transferring.
2047ed5b7817SJulian Elischer 			 */
20482bc21ed9SDavid Malone 			newlen = newfds * sizeof(int);
20492bc21ed9SDavid Malone 			*controlp = sbcreatecontrol(NULL, newlen,
20502bc21ed9SDavid Malone 			    SCM_RIGHTS, SOL_SOCKET);
20512bc21ed9SDavid Malone 			if (*controlp == NULL) {
20522609222aSPawel Jakub Dawidek 				FILEDESC_XUNLOCK(fdesc);
20532bc21ed9SDavid Malone 				error = E2BIG;
20542609222aSPawel Jakub Dawidek 				unp_freerights(fdep, newfds);
20552bc21ed9SDavid Malone 				goto next;
20562bc21ed9SDavid Malone 			}
20572bc21ed9SDavid Malone 
20582bc21ed9SDavid Malone 			fdp = (int *)
20592bc21ed9SDavid Malone 			    CMSG_DATA(mtod(*controlp, struct cmsghdr *));
2060db8f33fdSMateusz Guzik 			if (fdallocn(td, 0, fdp, newfds) != 0) {
20613331a33aSMateusz Guzik 				FILEDESC_XUNLOCK(fdesc);
2062db8f33fdSMateusz Guzik 				error = EMSGSIZE;
2063db8f33fdSMateusz Guzik 				unp_freerights(fdep, newfds);
2064db8f33fdSMateusz Guzik 				m_freem(*controlp);
2065db8f33fdSMateusz Guzik 				*controlp = NULL;
2066db8f33fdSMateusz Guzik 				goto next;
2067db8f33fdSMateusz Guzik 			}
20688cb539f1SPawel Jakub Dawidek 			for (i = 0; i < newfds; i++, fdp++) {
2069ea31808cSMateusz Guzik 				_finstall(fdesc, fdep[i]->fde_file, *fdp,
2070*6ceacebdSAlex Richardson 				    (flags & MSG_CMSG_CLOEXEC) != 0 ? O_CLOEXEC : 0,
2071ea31808cSMateusz Guzik 				    &fdep[i]->fde_caps);
2072ea31808cSMateusz Guzik 				unp_externalize_fp(fdep[i]->fde_file);
2073df8bae1dSRodney W. Grimes 			}
2074c7902fbeSMark Johnston 
2075c7902fbeSMark Johnston 			/*
2076c7902fbeSMark Johnston 			 * The new type indicates that the mbuf data refers to
2077c7902fbeSMark Johnston 			 * kernel resources that may need to be released before
2078c7902fbeSMark Johnston 			 * the mbuf is freed.
2079c7902fbeSMark Johnston 			 */
2080c7902fbeSMark Johnston 			m_chtype(*controlp, MT_EXTCONTROL);
20812609222aSPawel Jakub Dawidek 			FILEDESC_XUNLOCK(fdesc);
20828cb539f1SPawel Jakub Dawidek 			free(fdep[0], M_FILECAPS);
20831c381b19SRobert Watson 		} else {
20841c381b19SRobert Watson 			/* We can just copy anything else across. */
20852bc21ed9SDavid Malone 			if (error || controlp == NULL)
20862bc21ed9SDavid Malone 				goto next;
20872bc21ed9SDavid Malone 			*controlp = sbcreatecontrol(NULL, datalen,
20882bc21ed9SDavid Malone 			    cm->cmsg_type, cm->cmsg_level);
20892bc21ed9SDavid Malone 			if (*controlp == NULL) {
20902bc21ed9SDavid Malone 				error = ENOBUFS;
20912bc21ed9SDavid Malone 				goto next;
20922bc21ed9SDavid Malone 			}
20932bc21ed9SDavid Malone 			bcopy(data,
20942bc21ed9SDavid Malone 			    CMSG_DATA(mtod(*controlp, struct cmsghdr *)),
20952bc21ed9SDavid Malone 			    datalen);
20962bc21ed9SDavid Malone 		}
20972bc21ed9SDavid Malone 		controlp = &(*controlp)->m_next;
20982bc21ed9SDavid Malone 
20992bc21ed9SDavid Malone next:
21002bc21ed9SDavid Malone 		if (CMSG_SPACE(datalen) < clen) {
21012bc21ed9SDavid Malone 			clen -= CMSG_SPACE(datalen);
21022bc21ed9SDavid Malone 			cm = (struct cmsghdr *)
21032bc21ed9SDavid Malone 			    ((caddr_t)cm + CMSG_SPACE(datalen));
21048692c025SYoshinobu Inoue 		} else {
21052bc21ed9SDavid Malone 			clen = 0;
21062bc21ed9SDavid Malone 			cm = NULL;
21078692c025SYoshinobu Inoue 		}
21088692c025SYoshinobu Inoue 	}
21098692c025SYoshinobu Inoue 
21102bc21ed9SDavid Malone 	m_freem(control);
21112bc21ed9SDavid Malone 	return (error);
2112df8bae1dSRodney W. Grimes }
2113df8bae1dSRodney W. Grimes 
21144f590175SPaul Saab static void
21154f590175SPaul Saab unp_zone_change(void *tag)
21164f590175SPaul Saab {
21174f590175SPaul Saab 
21184f590175SPaul Saab 	uma_zone_set_max(unp_zone, maxsockets);
21194f590175SPaul Saab }
21204f590175SPaul Saab 
21215362170dSMark Johnston #ifdef INVARIANTS
21225362170dSMark Johnston static void
21235362170dSMark Johnston unp_zdtor(void *mem, int size __unused, void *arg __unused)
21245362170dSMark Johnston {
21255362170dSMark Johnston 	struct unpcb *unp;
21265362170dSMark Johnston 
21275362170dSMark Johnston 	unp = mem;
21285362170dSMark Johnston 
21295362170dSMark Johnston 	KASSERT(LIST_EMPTY(&unp->unp_refs),
21305362170dSMark Johnston 	    ("%s: unpcb %p has lingering refs", __func__, unp));
21315362170dSMark Johnston 	KASSERT(unp->unp_socket == NULL,
21325362170dSMark Johnston 	    ("%s: unpcb %p has socket backpointer", __func__, unp));
21335362170dSMark Johnston 	KASSERT(unp->unp_vnode == NULL,
21345362170dSMark Johnston 	    ("%s: unpcb %p has vnode references", __func__, unp));
21355362170dSMark Johnston 	KASSERT(unp->unp_conn == NULL,
21365362170dSMark Johnston 	    ("%s: unpcb %p is still connected", __func__, unp));
21375362170dSMark Johnston 	KASSERT(unp->unp_addr == NULL,
21385362170dSMark Johnston 	    ("%s: unpcb %p has leaked addr", __func__, unp));
21395362170dSMark Johnston }
21405362170dSMark Johnston #endif
21415362170dSMark Johnston 
21420b36cd25SRobert Watson static void
214398271db4SGarrett Wollman unp_init(void)
214498271db4SGarrett Wollman {
21455362170dSMark Johnston 	uma_dtor dtor;
21461c381b19SRobert Watson 
214721ca7b57SMarko Zec #ifdef VIMAGE
214821ca7b57SMarko Zec 	if (!IS_DEFAULT_VNET(curvnet))
214921ca7b57SMarko Zec 		return;
215021ca7b57SMarko Zec #endif
21515362170dSMark Johnston 
21525362170dSMark Johnston #ifdef INVARIANTS
21535362170dSMark Johnston 	dtor = unp_zdtor;
21545362170dSMark Johnston #else
21555362170dSMark Johnston 	dtor = NULL;
21565362170dSMark Johnston #endif
21575362170dSMark Johnston 	unp_zone = uma_zcreate("unpcb", sizeof(struct unpcb), NULL, dtor,
215875a67bf3SMatt Macy 	    NULL, NULL, UMA_ALIGN_CACHE, 0);
21594f590175SPaul Saab 	uma_zone_set_max(unp_zone, maxsockets);
21606e0b6746SPawel Jakub Dawidek 	uma_zone_set_warning(unp_zone, "kern.ipc.maxsockets limit reached");
21614f590175SPaul Saab 	EVENTHANDLER_REGISTER(maxsockets_change, unp_zone_change,
21624f590175SPaul Saab 	    NULL, EVENTHANDLER_PRI_ANY);
216398271db4SGarrett Wollman 	LIST_INIT(&unp_dhead);
216498271db4SGarrett Wollman 	LIST_INIT(&unp_shead);
216584d61770SRobert Watson 	LIST_INIT(&unp_sphead);
21660cb64678SKonstantin Belousov 	SLIST_INIT(&unp_defers);
2167daee0f0bSKonstantin Belousov 	TIMEOUT_TASK_INIT(taskqueue_thread, &unp_gc_task, 0, unp_gc, NULL);
21680cb64678SKonstantin Belousov 	TASK_INIT(&unp_defer_task, 0, unp_process_defers, NULL);
21693dab55bcSRobert Watson 	UNP_LINK_LOCK_INIT();
21700cb64678SKonstantin Belousov 	UNP_DEFERRED_LOCK_INIT();
217198271db4SGarrett Wollman }
217298271db4SGarrett Wollman 
217347c3450eSKonstantin Belousov static void
217447c3450eSKonstantin Belousov unp_internalize_cleanup_rights(struct mbuf *control)
217547c3450eSKonstantin Belousov {
217647c3450eSKonstantin Belousov 	struct cmsghdr *cp;
217747c3450eSKonstantin Belousov 	struct mbuf *m;
217847c3450eSKonstantin Belousov 	void *data;
217947c3450eSKonstantin Belousov 	socklen_t datalen;
218047c3450eSKonstantin Belousov 
218147c3450eSKonstantin Belousov 	for (m = control; m != NULL; m = m->m_next) {
218247c3450eSKonstantin Belousov 		cp = mtod(m, struct cmsghdr *);
218347c3450eSKonstantin Belousov 		if (cp->cmsg_level != SOL_SOCKET ||
218447c3450eSKonstantin Belousov 		    cp->cmsg_type != SCM_RIGHTS)
218547c3450eSKonstantin Belousov 			continue;
218647c3450eSKonstantin Belousov 		data = CMSG_DATA(cp);
218747c3450eSKonstantin Belousov 		datalen = (caddr_t)cp + cp->cmsg_len - (caddr_t)data;
218847c3450eSKonstantin Belousov 		unp_freerights(data, datalen / sizeof(struct filedesc *));
218947c3450eSKonstantin Belousov 	}
219047c3450eSKonstantin Belousov }
219147c3450eSKonstantin Belousov 
2192f708ef1bSPoul-Henning Kamp static int
2193892af6b9SRobert Watson unp_internalize(struct mbuf **controlp, struct thread *td)
2194df8bae1dSRodney W. Grimes {
219547c3450eSKonstantin Belousov 	struct mbuf *control, **initial_controlp;
219647c3450eSKonstantin Belousov 	struct proc *p;
219747c3450eSKonstantin Belousov 	struct filedesc *fdesc;
2198ab15d803SSergey Kandaurov 	struct bintime *bt;
219947c3450eSKonstantin Belousov 	struct cmsghdr *cm;
22002bc21ed9SDavid Malone 	struct cmsgcred *cmcred;
22018cb539f1SPawel Jakub Dawidek 	struct filedescent *fde, **fdep, *fdev;
22022bc21ed9SDavid Malone 	struct file *fp;
22032bc21ed9SDavid Malone 	struct timeval *tv;
2204339efd75SMaxim Sobolev 	struct timespec *ts;
22052bc21ed9SDavid Malone 	void *data;
220647c3450eSKonstantin Belousov 	socklen_t clen, datalen;
2207f1cf2b9dSKonstantin Belousov 	int i, j, error, *fdp, oldfds;
22088692c025SYoshinobu Inoue 	u_int newlen;
2209df8bae1dSRodney W. Grimes 
22103dab55bcSRobert Watson 	UNP_LINK_UNLOCK_ASSERT();
22114c5bc1caSRobert Watson 
221247c3450eSKonstantin Belousov 	p = td->td_proc;
221347c3450eSKonstantin Belousov 	fdesc = p->p_fd;
22142bc21ed9SDavid Malone 	error = 0;
221547c3450eSKonstantin Belousov 	control = *controlp;
221647c3450eSKonstantin Belousov 	clen = control->m_len;
22172bc21ed9SDavid Malone 	*controlp = NULL;
221847c3450eSKonstantin Belousov 	initial_controlp = controlp;
221947c3450eSKonstantin Belousov 	for (cm = mtod(control, struct cmsghdr *); cm != NULL;) {
22202bc21ed9SDavid Malone 		if (sizeof(*cm) > clen || cm->cmsg_level != SOL_SOCKET
2221de966666SMateusz Guzik 		    || cm->cmsg_len > clen || cm->cmsg_len < sizeof(*cm)) {
22222bc21ed9SDavid Malone 			error = EINVAL;
22232bc21ed9SDavid Malone 			goto out;
22242bc21ed9SDavid Malone 		}
22252bc21ed9SDavid Malone 		data = CMSG_DATA(cm);
22262bc21ed9SDavid Malone 		datalen = (caddr_t)cm + cm->cmsg_len - (caddr_t)data;
22272bc21ed9SDavid Malone 
22282bc21ed9SDavid Malone 		switch (cm->cmsg_type) {
22290b788fa1SBill Paul 		/*
22300b788fa1SBill Paul 		 * Fill in credential information.
22310b788fa1SBill Paul 		 */
22322bc21ed9SDavid Malone 		case SCM_CREDS:
22332bc21ed9SDavid Malone 			*controlp = sbcreatecontrol(NULL, sizeof(*cmcred),
22342bc21ed9SDavid Malone 			    SCM_CREDS, SOL_SOCKET);
22352bc21ed9SDavid Malone 			if (*controlp == NULL) {
22362bc21ed9SDavid Malone 				error = ENOBUFS;
22372bc21ed9SDavid Malone 				goto out;
22382bc21ed9SDavid Malone 			}
22392bc21ed9SDavid Malone 			cmcred = (struct cmsgcred *)
22402bc21ed9SDavid Malone 			    CMSG_DATA(mtod(*controlp, struct cmsghdr *));
22410b788fa1SBill Paul 			cmcred->cmcred_pid = p->p_pid;
2242a854ed98SJohn Baldwin 			cmcred->cmcred_uid = td->td_ucred->cr_ruid;
2243a854ed98SJohn Baldwin 			cmcred->cmcred_gid = td->td_ucred->cr_rgid;
2244a854ed98SJohn Baldwin 			cmcred->cmcred_euid = td->td_ucred->cr_uid;
2245a854ed98SJohn Baldwin 			cmcred->cmcred_ngroups = MIN(td->td_ucred->cr_ngroups,
22460b788fa1SBill Paul 			    CMGROUP_MAX);
22470b788fa1SBill Paul 			for (i = 0; i < cmcred->cmcred_ngroups; i++)
22482bc21ed9SDavid Malone 				cmcred->cmcred_groups[i] =
2249a854ed98SJohn Baldwin 				    td->td_ucred->cr_groups[i];
22502bc21ed9SDavid Malone 			break;
22510b788fa1SBill Paul 
22522bc21ed9SDavid Malone 		case SCM_RIGHTS:
22532bc21ed9SDavid Malone 			oldfds = datalen / sizeof (int);
225482e825c4SGleb Smirnoff 			if (oldfds == 0)
225582e825c4SGleb Smirnoff 				break;
2256ed5b7817SJulian Elischer 			/*
22571c381b19SRobert Watson 			 * Check that all the FDs passed in refer to legal
22581c381b19SRobert Watson 			 * files.  If not, reject the entire operation.
2259ed5b7817SJulian Elischer 			 */
22602bc21ed9SDavid Malone 			fdp = data;
22612609222aSPawel Jakub Dawidek 			FILEDESC_SLOCK(fdesc);
22626a1cf96bSMateusz Guzik 			for (i = 0; i < oldfds; i++, fdp++) {
22636a1cf96bSMateusz Guzik 				fp = fget_locked(fdesc, *fdp);
22646a1cf96bSMateusz Guzik 				if (fp == NULL) {
22652609222aSPawel Jakub Dawidek 					FILEDESC_SUNLOCK(fdesc);
22662bc21ed9SDavid Malone 					error = EBADF;
22672bc21ed9SDavid Malone 					goto out;
22682bc21ed9SDavid Malone 				}
2269e7d6662fSAlfred Perlstein 				if (!(fp->f_ops->fo_flags & DFLAG_PASSABLE)) {
22702609222aSPawel Jakub Dawidek 					FILEDESC_SUNLOCK(fdesc);
2271e7d6662fSAlfred Perlstein 					error = EOPNOTSUPP;
2272e7d6662fSAlfred Perlstein 					goto out;
2273e7d6662fSAlfred Perlstein 				}
2274df8bae1dSRodney W. Grimes 			}
22755e3f7694SRobert Watson 
2276ed5b7817SJulian Elischer 			/*
22770b36cd25SRobert Watson 			 * Now replace the integer FDs with pointers to the
22782609222aSPawel Jakub Dawidek 			 * file structure and capability rights.
2279ed5b7817SJulian Elischer 			 */
22808cb539f1SPawel Jakub Dawidek 			newlen = oldfds * sizeof(fdep[0]);
22812bc21ed9SDavid Malone 			*controlp = sbcreatecontrol(NULL, newlen,
22822bc21ed9SDavid Malone 			    SCM_RIGHTS, SOL_SOCKET);
22832bc21ed9SDavid Malone 			if (*controlp == NULL) {
22842609222aSPawel Jakub Dawidek 				FILEDESC_SUNLOCK(fdesc);
22852bc21ed9SDavid Malone 				error = E2BIG;
22862bc21ed9SDavid Malone 				goto out;
22878692c025SYoshinobu Inoue 			}
22882bc21ed9SDavid Malone 			fdp = data;
2289f1cf2b9dSKonstantin Belousov 			for (i = 0; i < oldfds; i++, fdp++) {
2290f1cf2b9dSKonstantin Belousov 				if (!fhold(fdesc->fd_ofiles[*fdp].fde_file)) {
2291f1cf2b9dSKonstantin Belousov 					fdp = data;
2292f1cf2b9dSKonstantin Belousov 					for (j = 0; j < i; j++, fdp++) {
2293f1cf2b9dSKonstantin Belousov 						fdrop(fdesc->fd_ofiles[*fdp].
2294f1cf2b9dSKonstantin Belousov 						    fde_file, td);
2295f1cf2b9dSKonstantin Belousov 					}
2296f1cf2b9dSKonstantin Belousov 					FILEDESC_SUNLOCK(fdesc);
2297f1cf2b9dSKonstantin Belousov 					error = EBADF;
2298f1cf2b9dSKonstantin Belousov 					goto out;
2299f1cf2b9dSKonstantin Belousov 				}
2300f1cf2b9dSKonstantin Belousov 			}
2301f1cf2b9dSKonstantin Belousov 			fdp = data;
23028cb539f1SPawel Jakub Dawidek 			fdep = (struct filedescent **)
23032bc21ed9SDavid Malone 			    CMSG_DATA(mtod(*controlp, struct cmsghdr *));
23048cb539f1SPawel Jakub Dawidek 			fdev = malloc(sizeof(*fdev) * oldfds, M_FILECAPS,
23058cb539f1SPawel Jakub Dawidek 			    M_WAITOK);
23068cb539f1SPawel Jakub Dawidek 			for (i = 0; i < oldfds; i++, fdev++, fdp++) {
23072609222aSPawel Jakub Dawidek 				fde = &fdesc->fd_ofiles[*fdp];
23088cb539f1SPawel Jakub Dawidek 				fdep[i] = fdev;
23098cb539f1SPawel Jakub Dawidek 				fdep[i]->fde_file = fde->fde_file;
23108cb539f1SPawel Jakub Dawidek 				filecaps_copy(&fde->fde_caps,
2311d7832811SMateusz Guzik 				    &fdep[i]->fde_caps, true);
23128cb539f1SPawel Jakub Dawidek 				unp_internalize_fp(fdep[i]->fde_file);
2313df8bae1dSRodney W. Grimes 			}
23142609222aSPawel Jakub Dawidek 			FILEDESC_SUNLOCK(fdesc);
23152bc21ed9SDavid Malone 			break;
23162bc21ed9SDavid Malone 
23172bc21ed9SDavid Malone 		case SCM_TIMESTAMP:
23182bc21ed9SDavid Malone 			*controlp = sbcreatecontrol(NULL, sizeof(*tv),
23192bc21ed9SDavid Malone 			    SCM_TIMESTAMP, SOL_SOCKET);
23202bc21ed9SDavid Malone 			if (*controlp == NULL) {
23212bc21ed9SDavid Malone 				error = ENOBUFS;
23222bc21ed9SDavid Malone 				goto out;
23238692c025SYoshinobu Inoue 			}
23242bc21ed9SDavid Malone 			tv = (struct timeval *)
23252bc21ed9SDavid Malone 			    CMSG_DATA(mtod(*controlp, struct cmsghdr *));
23262bc21ed9SDavid Malone 			microtime(tv);
23272bc21ed9SDavid Malone 			break;
23282bc21ed9SDavid Malone 
2329ab15d803SSergey Kandaurov 		case SCM_BINTIME:
2330ab15d803SSergey Kandaurov 			*controlp = sbcreatecontrol(NULL, sizeof(*bt),
2331ab15d803SSergey Kandaurov 			    SCM_BINTIME, SOL_SOCKET);
2332ab15d803SSergey Kandaurov 			if (*controlp == NULL) {
2333ab15d803SSergey Kandaurov 				error = ENOBUFS;
2334ab15d803SSergey Kandaurov 				goto out;
2335ab15d803SSergey Kandaurov 			}
2336ab15d803SSergey Kandaurov 			bt = (struct bintime *)
2337ab15d803SSergey Kandaurov 			    CMSG_DATA(mtod(*controlp, struct cmsghdr *));
2338ab15d803SSergey Kandaurov 			bintime(bt);
2339ab15d803SSergey Kandaurov 			break;
2340ab15d803SSergey Kandaurov 
2341339efd75SMaxim Sobolev 		case SCM_REALTIME:
2342339efd75SMaxim Sobolev 			*controlp = sbcreatecontrol(NULL, sizeof(*ts),
2343339efd75SMaxim Sobolev 			    SCM_REALTIME, SOL_SOCKET);
2344339efd75SMaxim Sobolev 			if (*controlp == NULL) {
2345339efd75SMaxim Sobolev 				error = ENOBUFS;
2346339efd75SMaxim Sobolev 				goto out;
2347339efd75SMaxim Sobolev 			}
2348339efd75SMaxim Sobolev 			ts = (struct timespec *)
2349339efd75SMaxim Sobolev 			    CMSG_DATA(mtod(*controlp, struct cmsghdr *));
2350339efd75SMaxim Sobolev 			nanotime(ts);
2351339efd75SMaxim Sobolev 			break;
2352339efd75SMaxim Sobolev 
2353339efd75SMaxim Sobolev 		case SCM_MONOTONIC:
2354339efd75SMaxim Sobolev 			*controlp = sbcreatecontrol(NULL, sizeof(*ts),
2355339efd75SMaxim Sobolev 			    SCM_MONOTONIC, SOL_SOCKET);
2356339efd75SMaxim Sobolev 			if (*controlp == NULL) {
2357339efd75SMaxim Sobolev 				error = ENOBUFS;
2358339efd75SMaxim Sobolev 				goto out;
2359339efd75SMaxim Sobolev 			}
2360339efd75SMaxim Sobolev 			ts = (struct timespec *)
2361339efd75SMaxim Sobolev 			    CMSG_DATA(mtod(*controlp, struct cmsghdr *));
2362339efd75SMaxim Sobolev 			nanouptime(ts);
2363339efd75SMaxim Sobolev 			break;
2364339efd75SMaxim Sobolev 
23652bc21ed9SDavid Malone 		default:
23662bc21ed9SDavid Malone 			error = EINVAL;
23672bc21ed9SDavid Malone 			goto out;
23682bc21ed9SDavid Malone 		}
23692bc21ed9SDavid Malone 
23704013d726SMark Johnston 		if (*controlp != NULL)
23712bc21ed9SDavid Malone 			controlp = &(*controlp)->m_next;
23722bc21ed9SDavid Malone 		if (CMSG_SPACE(datalen) < clen) {
23732bc21ed9SDavid Malone 			clen -= CMSG_SPACE(datalen);
23742bc21ed9SDavid Malone 			cm = (struct cmsghdr *)
23752bc21ed9SDavid Malone 			    ((caddr_t)cm + CMSG_SPACE(datalen));
23762bc21ed9SDavid Malone 		} else {
23772bc21ed9SDavid Malone 			clen = 0;
23782bc21ed9SDavid Malone 			cm = NULL;
23792bc21ed9SDavid Malone 		}
23802bc21ed9SDavid Malone 	}
23812bc21ed9SDavid Malone 
23822bc21ed9SDavid Malone out:
238347c3450eSKonstantin Belousov 	if (error != 0 && initial_controlp != NULL)
238447c3450eSKonstantin Belousov 		unp_internalize_cleanup_rights(*initial_controlp);
23852bc21ed9SDavid Malone 	m_freem(control);
23862bc21ed9SDavid Malone 	return (error);
2387df8bae1dSRodney W. Grimes }
2388df8bae1dSRodney W. Grimes 
23895b950deaSRobert Watson static struct mbuf *
2390ede4af47SConrad Meyer unp_addsockcred(struct thread *td, struct mbuf *control, int mode)
23916a2989fdSMatthew N. Dodd {
239270df31f4SMaxim Konovalov 	struct mbuf *m, *n, *n_prev;
239370df31f4SMaxim Konovalov 	const struct cmsghdr *cm;
2394ede4af47SConrad Meyer 	int ngroups, i, cmsgtype;
2395ede4af47SConrad Meyer 	size_t ctrlsz;
23966a2989fdSMatthew N. Dodd 
23976a2989fdSMatthew N. Dodd 	ngroups = MIN(td->td_ucred->cr_ngroups, CMGROUP_MAX);
2398ede4af47SConrad Meyer 	if (mode & UNP_WANTCRED_ALWAYS) {
2399ede4af47SConrad Meyer 		ctrlsz = SOCKCRED2SIZE(ngroups);
2400ede4af47SConrad Meyer 		cmsgtype = SCM_CREDS2;
2401ede4af47SConrad Meyer 	} else {
2402ede4af47SConrad Meyer 		ctrlsz = SOCKCREDSIZE(ngroups);
2403ede4af47SConrad Meyer 		cmsgtype = SCM_CREDS;
2404ede4af47SConrad Meyer 	}
2405ede4af47SConrad Meyer 
2406ede4af47SConrad Meyer 	m = sbcreatecontrol(NULL, ctrlsz, cmsgtype, SOL_SOCKET);
24076a2989fdSMatthew N. Dodd 	if (m == NULL)
24086a2989fdSMatthew N. Dodd 		return (control);
24096a2989fdSMatthew N. Dodd 
2410ede4af47SConrad Meyer 	if (mode & UNP_WANTCRED_ALWAYS) {
2411ede4af47SConrad Meyer 		struct sockcred2 *sc;
2412ede4af47SConrad Meyer 
2413ede4af47SConrad Meyer 		sc = (void *)CMSG_DATA(mtod(m, struct cmsghdr *));
2414ede4af47SConrad Meyer 		sc->sc_version = 0;
2415ede4af47SConrad Meyer 		sc->sc_pid = td->td_proc->p_pid;
24166a2989fdSMatthew N. Dodd 		sc->sc_uid = td->td_ucred->cr_ruid;
24176a2989fdSMatthew N. Dodd 		sc->sc_euid = td->td_ucred->cr_uid;
24186a2989fdSMatthew N. Dodd 		sc->sc_gid = td->td_ucred->cr_rgid;
24196a2989fdSMatthew N. Dodd 		sc->sc_egid = td->td_ucred->cr_gid;
24206a2989fdSMatthew N. Dodd 		sc->sc_ngroups = ngroups;
24216a2989fdSMatthew N. Dodd 		for (i = 0; i < sc->sc_ngroups; i++)
24226a2989fdSMatthew N. Dodd 			sc->sc_groups[i] = td->td_ucred->cr_groups[i];
2423ede4af47SConrad Meyer 	} else {
2424ede4af47SConrad Meyer 		struct sockcred *sc;
2425ede4af47SConrad Meyer 
2426ede4af47SConrad Meyer 		sc = (void *)CMSG_DATA(mtod(m, struct cmsghdr *));
2427ede4af47SConrad Meyer 		sc->sc_uid = td->td_ucred->cr_ruid;
2428ede4af47SConrad Meyer 		sc->sc_euid = td->td_ucred->cr_uid;
2429ede4af47SConrad Meyer 		sc->sc_gid = td->td_ucred->cr_rgid;
2430ede4af47SConrad Meyer 		sc->sc_egid = td->td_ucred->cr_gid;
2431ede4af47SConrad Meyer 		sc->sc_ngroups = ngroups;
2432ede4af47SConrad Meyer 		for (i = 0; i < sc->sc_ngroups; i++)
2433ede4af47SConrad Meyer 			sc->sc_groups[i] = td->td_ucred->cr_groups[i];
2434ede4af47SConrad Meyer 	}
24356a2989fdSMatthew N. Dodd 
24366a2989fdSMatthew N. Dodd 	/*
24371c381b19SRobert Watson 	 * Unlink SCM_CREDS control messages (struct cmsgcred), since just
24381c381b19SRobert Watson 	 * created SCM_CREDS control message (struct sockcred) has another
24391c381b19SRobert Watson 	 * format.
24406a2989fdSMatthew N. Dodd 	 */
2441ede4af47SConrad Meyer 	if (control != NULL && cmsgtype == SCM_CREDS)
244270df31f4SMaxim Konovalov 		for (n = control, n_prev = NULL; n != NULL;) {
244370df31f4SMaxim Konovalov 			cm = mtod(n, struct cmsghdr *);
244470df31f4SMaxim Konovalov     			if (cm->cmsg_level == SOL_SOCKET &&
244570df31f4SMaxim Konovalov 			    cm->cmsg_type == SCM_CREDS) {
244670df31f4SMaxim Konovalov     				if (n_prev == NULL)
244770df31f4SMaxim Konovalov 					control = n->m_next;
244870df31f4SMaxim Konovalov 				else
244970df31f4SMaxim Konovalov 					n_prev->m_next = n->m_next;
245070df31f4SMaxim Konovalov 				n = m_free(n);
245170df31f4SMaxim Konovalov 			} else {
245270df31f4SMaxim Konovalov 				n_prev = n;
245370df31f4SMaxim Konovalov 				n = n->m_next;
245470df31f4SMaxim Konovalov 			}
245570df31f4SMaxim Konovalov 		}
24566a2989fdSMatthew N. Dodd 
245770df31f4SMaxim Konovalov 	/* Prepend it to the head. */
245870df31f4SMaxim Konovalov 	m->m_next = control;
245970df31f4SMaxim Konovalov 	return (m);
24606a2989fdSMatthew N. Dodd }
24616a2989fdSMatthew N. Dodd 
2462397c19d1SJeff Roberson static struct unpcb *
2463397c19d1SJeff Roberson fptounp(struct file *fp)
2464397c19d1SJeff Roberson {
2465397c19d1SJeff Roberson 	struct socket *so;
2466397c19d1SJeff Roberson 
2467397c19d1SJeff Roberson 	if (fp->f_type != DTYPE_SOCKET)
2468397c19d1SJeff Roberson 		return (NULL);
2469397c19d1SJeff Roberson 	if ((so = fp->f_data) == NULL)
2470397c19d1SJeff Roberson 		return (NULL);
2471397c19d1SJeff Roberson 	if (so->so_proto->pr_domain != &localdomain)
2472397c19d1SJeff Roberson 		return (NULL);
2473397c19d1SJeff Roberson 	return sotounpcb(so);
2474397c19d1SJeff Roberson }
2475397c19d1SJeff Roberson 
2476397c19d1SJeff Roberson static void
2477397c19d1SJeff Roberson unp_discard(struct file *fp)
2478397c19d1SJeff Roberson {
24790cb64678SKonstantin Belousov 	struct unp_defer *dr;
2480397c19d1SJeff Roberson 
24810cb64678SKonstantin Belousov 	if (unp_externalize_fp(fp)) {
24820cb64678SKonstantin Belousov 		dr = malloc(sizeof(*dr), M_TEMP, M_WAITOK);
24830cb64678SKonstantin Belousov 		dr->ud_fp = fp;
24840cb64678SKonstantin Belousov 		UNP_DEFERRED_LOCK();
24850cb64678SKonstantin Belousov 		SLIST_INSERT_HEAD(&unp_defers, dr, ud_link);
24860cb64678SKonstantin Belousov 		UNP_DEFERRED_UNLOCK();
24870cb64678SKonstantin Belousov 		atomic_add_int(&unp_defers_count, 1);
24880cb64678SKonstantin Belousov 		taskqueue_enqueue(taskqueue_thread, &unp_defer_task);
24890cb64678SKonstantin Belousov 	} else
24904faa375cSMateusz Guzik 		closef_nothread(fp);
2491397c19d1SJeff Roberson }
2492397c19d1SJeff Roberson 
2493397c19d1SJeff Roberson static void
24940cb64678SKonstantin Belousov unp_process_defers(void *arg __unused, int pending)
24950cb64678SKonstantin Belousov {
24960cb64678SKonstantin Belousov 	struct unp_defer *dr;
24970cb64678SKonstantin Belousov 	SLIST_HEAD(, unp_defer) drl;
24980cb64678SKonstantin Belousov 	int count;
24990cb64678SKonstantin Belousov 
25000cb64678SKonstantin Belousov 	SLIST_INIT(&drl);
25010cb64678SKonstantin Belousov 	for (;;) {
25020cb64678SKonstantin Belousov 		UNP_DEFERRED_LOCK();
25030cb64678SKonstantin Belousov 		if (SLIST_FIRST(&unp_defers) == NULL) {
25040cb64678SKonstantin Belousov 			UNP_DEFERRED_UNLOCK();
25050cb64678SKonstantin Belousov 			break;
25060cb64678SKonstantin Belousov 		}
25070cb64678SKonstantin Belousov 		SLIST_SWAP(&unp_defers, &drl, unp_defer);
25080cb64678SKonstantin Belousov 		UNP_DEFERRED_UNLOCK();
25090cb64678SKonstantin Belousov 		count = 0;
25100cb64678SKonstantin Belousov 		while ((dr = SLIST_FIRST(&drl)) != NULL) {
25110cb64678SKonstantin Belousov 			SLIST_REMOVE_HEAD(&drl, ud_link);
25124faa375cSMateusz Guzik 			closef_nothread(dr->ud_fp);
25130cb64678SKonstantin Belousov 			free(dr, M_TEMP);
25140cb64678SKonstantin Belousov 			count++;
25150cb64678SKonstantin Belousov 		}
25160cb64678SKonstantin Belousov 		atomic_add_int(&unp_defers_count, -count);
25170cb64678SKonstantin Belousov 	}
25180cb64678SKonstantin Belousov }
25190cb64678SKonstantin Belousov 
25200cb64678SKonstantin Belousov static void
2521397c19d1SJeff Roberson unp_internalize_fp(struct file *fp)
2522397c19d1SJeff Roberson {
2523397c19d1SJeff Roberson 	struct unpcb *unp;
2524397c19d1SJeff Roberson 
25253dab55bcSRobert Watson 	UNP_LINK_WLOCK();
2526397c19d1SJeff Roberson 	if ((unp = fptounp(fp)) != NULL) {
2527397c19d1SJeff Roberson 		unp->unp_file = fp;
2528397c19d1SJeff Roberson 		unp->unp_msgcount++;
2529397c19d1SJeff Roberson 	}
2530397c19d1SJeff Roberson 	unp_rights++;
25313dab55bcSRobert Watson 	UNP_LINK_WUNLOCK();
2532397c19d1SJeff Roberson }
2533397c19d1SJeff Roberson 
25340cb64678SKonstantin Belousov static int
2535397c19d1SJeff Roberson unp_externalize_fp(struct file *fp)
2536397c19d1SJeff Roberson {
2537397c19d1SJeff Roberson 	struct unpcb *unp;
25380cb64678SKonstantin Belousov 	int ret;
2539397c19d1SJeff Roberson 
25403dab55bcSRobert Watson 	UNP_LINK_WLOCK();
25410cb64678SKonstantin Belousov 	if ((unp = fptounp(fp)) != NULL) {
2542397c19d1SJeff Roberson 		unp->unp_msgcount--;
25430cb64678SKonstantin Belousov 		ret = 1;
25440cb64678SKonstantin Belousov 	} else
25450cb64678SKonstantin Belousov 		ret = 0;
2546397c19d1SJeff Roberson 	unp_rights--;
25473dab55bcSRobert Watson 	UNP_LINK_WUNLOCK();
25480cb64678SKonstantin Belousov 	return (ret);
2549397c19d1SJeff Roberson }
2550397c19d1SJeff Roberson 
2551161a0c7cSRobert Watson /*
2552a0ec558aSRobert Watson  * unp_defer indicates whether additional work has been defered for a future
2553a0ec558aSRobert Watson  * pass through unp_gc().  It is thread local and does not require explicit
2554a0ec558aSRobert Watson  * synchronization.
2555161a0c7cSRobert Watson  */
2556397c19d1SJeff Roberson static int	unp_marked;
2557a0ec558aSRobert Watson 
2558397c19d1SJeff Roberson static void
2559a9aa06f7SJason A. Harmening unp_remove_dead_ref(struct filedescent **fdep, int fdcount)
2560397c19d1SJeff Roberson {
2561397c19d1SJeff Roberson 	struct unpcb *unp;
2562be26ba7cSPawel Jakub Dawidek 	struct file *fp;
2563be26ba7cSPawel Jakub Dawidek 	int i;
2564397c19d1SJeff Roberson 
2565a9aa06f7SJason A. Harmening 	/*
2566a9aa06f7SJason A. Harmening 	 * This function can only be called from the gc task.
2567a9aa06f7SJason A. Harmening 	 */
2568a9aa06f7SJason A. Harmening 	KASSERT(taskqueue_member(taskqueue_thread, curthread) != 0,
2569a9aa06f7SJason A. Harmening 	    ("%s: not on gc callout", __func__));
2570a9aa06f7SJason A. Harmening 	UNP_LINK_LOCK_ASSERT();
2571a9aa06f7SJason A. Harmening 
2572be26ba7cSPawel Jakub Dawidek 	for (i = 0; i < fdcount; i++) {
2573be26ba7cSPawel Jakub Dawidek 		fp = fdep[i]->fde_file;
25746f552cb0SJeff Roberson 		if ((unp = fptounp(fp)) == NULL)
2575be26ba7cSPawel Jakub Dawidek 			continue;
2576a9aa06f7SJason A. Harmening 		if ((unp->unp_gcflag & UNPGC_DEAD) == 0)
2577be26ba7cSPawel Jakub Dawidek 			continue;
2578a9aa06f7SJason A. Harmening 		unp->unp_gcrefs--;
2579a9aa06f7SJason A. Harmening 	}
2580a9aa06f7SJason A. Harmening }
2581a9aa06f7SJason A. Harmening 
2582a9aa06f7SJason A. Harmening static void
2583a9aa06f7SJason A. Harmening unp_restore_undead_ref(struct filedescent **fdep, int fdcount)
2584a9aa06f7SJason A. Harmening {
2585a9aa06f7SJason A. Harmening 	struct unpcb *unp;
2586a9aa06f7SJason A. Harmening 	struct file *fp;
2587a9aa06f7SJason A. Harmening 	int i;
2588a9aa06f7SJason A. Harmening 
2589a9aa06f7SJason A. Harmening 	/*
2590a9aa06f7SJason A. Harmening 	 * This function can only be called from the gc task.
2591a9aa06f7SJason A. Harmening 	 */
2592a9aa06f7SJason A. Harmening 	KASSERT(taskqueue_member(taskqueue_thread, curthread) != 0,
2593a9aa06f7SJason A. Harmening 	    ("%s: not on gc callout", __func__));
2594a9aa06f7SJason A. Harmening 	UNP_LINK_LOCK_ASSERT();
2595a9aa06f7SJason A. Harmening 
2596a9aa06f7SJason A. Harmening 	for (i = 0; i < fdcount; i++) {
2597a9aa06f7SJason A. Harmening 		fp = fdep[i]->fde_file;
2598a9aa06f7SJason A. Harmening 		if ((unp = fptounp(fp)) == NULL)
2599a9aa06f7SJason A. Harmening 			continue;
2600a9aa06f7SJason A. Harmening 		if ((unp->unp_gcflag & UNPGC_DEAD) == 0)
2601a9aa06f7SJason A. Harmening 			continue;
2602a9aa06f7SJason A. Harmening 		unp->unp_gcrefs++;
2603397c19d1SJeff Roberson 		unp_marked++;
2604397c19d1SJeff Roberson 	}
2605be26ba7cSPawel Jakub Dawidek }
2606397c19d1SJeff Roberson 
2607397c19d1SJeff Roberson static void
2608a9aa06f7SJason A. Harmening unp_gc_scan(struct unpcb *unp, void (*op)(struct filedescent **, int))
2609397c19d1SJeff Roberson {
2610779f106aSGleb Smirnoff 	struct socket *so, *soa;
261160a5ef26SRobert Watson 
2612397c19d1SJeff Roberson 	so = unp->unp_socket;
2613779f106aSGleb Smirnoff 	SOCK_LOCK(so);
2614779f106aSGleb Smirnoff 	if (SOLISTENING(so)) {
2615397c19d1SJeff Roberson 		/*
2616397c19d1SJeff Roberson 		 * Mark all sockets in our accept queue.
2617397c19d1SJeff Roberson 		 */
2618779f106aSGleb Smirnoff 		TAILQ_FOREACH(soa, &so->sol_comp, so_list) {
2619779f106aSGleb Smirnoff 			if (sotounpcb(soa)->unp_gcflag & UNPGC_IGNORE_RIGHTS)
26200c40f353SConrad Meyer 				continue;
2621397c19d1SJeff Roberson 			SOCKBUF_LOCK(&soa->so_rcv);
2622a9aa06f7SJason A. Harmening 			unp_scan(soa->so_rcv.sb_mb, op);
2623397c19d1SJeff Roberson 			SOCKBUF_UNLOCK(&soa->so_rcv);
2624397c19d1SJeff Roberson 		}
2625779f106aSGleb Smirnoff 	} else {
2626779f106aSGleb Smirnoff 		/*
2627779f106aSGleb Smirnoff 		 * Mark all sockets we reference with RIGHTS.
2628779f106aSGleb Smirnoff 		 */
2629779f106aSGleb Smirnoff 		if ((unp->unp_gcflag & UNPGC_IGNORE_RIGHTS) == 0) {
2630779f106aSGleb Smirnoff 			SOCKBUF_LOCK(&so->so_rcv);
2631a9aa06f7SJason A. Harmening 			unp_scan(so->so_rcv.sb_mb, op);
2632779f106aSGleb Smirnoff 			SOCKBUF_UNLOCK(&so->so_rcv);
2633779f106aSGleb Smirnoff 		}
2634779f106aSGleb Smirnoff 	}
2635779f106aSGleb Smirnoff 	SOCK_UNLOCK(so);
2636397c19d1SJeff Roberson }
2637a0ec558aSRobert Watson 
2638a0ec558aSRobert Watson static int unp_recycled;
2639be6b1304STom Rhodes SYSCTL_INT(_net_local, OID_AUTO, recycled, CTLFLAG_RD, &unp_recycled, 0,
2640be6b1304STom Rhodes     "Number of unreachable sockets claimed by the garbage collector.");
2641df8bae1dSRodney W. Grimes 
2642397c19d1SJeff Roberson static int unp_taskcount;
2643be6b1304STom Rhodes SYSCTL_INT(_net_local, OID_AUTO, taskcount, CTLFLAG_RD, &unp_taskcount, 0,
2644be6b1304STom Rhodes     "Number of times the garbage collector has run.");
2645397c19d1SJeff Roberson 
2646a9aa06f7SJason A. Harmening SYSCTL_UINT(_net_local, OID_AUTO, sockcount, CTLFLAG_RD, &unp_count, 0,
2647a9aa06f7SJason A. Harmening     "Number of active local sockets.");
2648a9aa06f7SJason A. Harmening 
2649f708ef1bSPoul-Henning Kamp static void
2650a0ec558aSRobert Watson unp_gc(__unused void *arg, int pending)
2651df8bae1dSRodney W. Grimes {
265284d61770SRobert Watson 	struct unp_head *heads[] = { &unp_dhead, &unp_shead, &unp_sphead,
265384d61770SRobert Watson 				    NULL };
2654397c19d1SJeff Roberson 	struct unp_head **head;
2655a9aa06f7SJason A. Harmening 	struct unp_head unp_deadhead;	/* List of potentially-dead sockets. */
2656f7780c61SKonstantin Belousov 	struct file *f, **unref;
2657a9aa06f7SJason A. Harmening 	struct unpcb *unp, *unptmp;
2658a9aa06f7SJason A. Harmening 	int i, total, unp_unreachable;
2659df8bae1dSRodney W. Grimes 
2660a9aa06f7SJason A. Harmening 	LIST_INIT(&unp_deadhead);
2661a0ec558aSRobert Watson 	unp_taskcount++;
2662779f106aSGleb Smirnoff 	UNP_LINK_RLOCK();
2663ed5b7817SJulian Elischer 	/*
2664a9aa06f7SJason A. Harmening 	 * First determine which sockets may be in cycles.
2665ed5b7817SJulian Elischer 	 */
2666a9aa06f7SJason A. Harmening 	unp_unreachable = 0;
2667a9aa06f7SJason A. Harmening 
2668397c19d1SJeff Roberson 	for (head = heads; *head != NULL; head++)
2669a9aa06f7SJason A. Harmening 		LIST_FOREACH(unp, *head, unp_link) {
2670a9aa06f7SJason A. Harmening 			KASSERT((unp->unp_gcflag & ~UNPGC_IGNORE_RIGHTS) == 0,
2671a9aa06f7SJason A. Harmening 			    ("%s: unp %p has unexpected gc flags 0x%x",
2672a9aa06f7SJason A. Harmening 			    __func__, unp, (unsigned int)unp->unp_gcflag));
2673a9aa06f7SJason A. Harmening 
2674a9aa06f7SJason A. Harmening 			f = unp->unp_file;
267560a5ef26SRobert Watson 
2676397c19d1SJeff Roberson 			/*
2677a9aa06f7SJason A. Harmening 			 * Check for an unreachable socket potentially in a
2678a9aa06f7SJason A. Harmening 			 * cycle.  It must be in a queue as indicated by
2679a9aa06f7SJason A. Harmening 			 * msgcount, and this must equal the file reference
2680a9aa06f7SJason A. Harmening 			 * count.  Note that when msgcount is 0 the file is
2681a9aa06f7SJason A. Harmening 			 * NULL.
2682a9aa06f7SJason A. Harmening 			 */
2683a9aa06f7SJason A. Harmening 			if (f != NULL && unp->unp_msgcount != 0 &&
26843c50616fSMateusz Guzik 			    refcount_load(&f->f_count) == unp->unp_msgcount) {
2685a9aa06f7SJason A. Harmening 				LIST_INSERT_HEAD(&unp_deadhead, unp, unp_dead);
2686a9aa06f7SJason A. Harmening 				unp->unp_gcflag |= UNPGC_DEAD;
2687a9aa06f7SJason A. Harmening 				unp->unp_gcrefs = unp->unp_msgcount;
2688a9aa06f7SJason A. Harmening 				unp_unreachable++;
2689a9aa06f7SJason A. Harmening 			}
2690a9aa06f7SJason A. Harmening 		}
2691a9aa06f7SJason A. Harmening 
2692a9aa06f7SJason A. Harmening 	/*
2693a9aa06f7SJason A. Harmening 	 * Scan all sockets previously marked as potentially being in a cycle
2694a9aa06f7SJason A. Harmening 	 * and remove the references each socket holds on any UNPGC_DEAD
2695a9aa06f7SJason A. Harmening 	 * sockets in its queue.  After this step, all remaining references on
2696a9aa06f7SJason A. Harmening 	 * sockets marked UNPGC_DEAD should not be part of any cycle.
2697a9aa06f7SJason A. Harmening 	 */
2698a9aa06f7SJason A. Harmening 	LIST_FOREACH(unp, &unp_deadhead, unp_dead)
2699a9aa06f7SJason A. Harmening 		unp_gc_scan(unp, unp_remove_dead_ref);
2700a9aa06f7SJason A. Harmening 
2701a9aa06f7SJason A. Harmening 	/*
2702a9aa06f7SJason A. Harmening 	 * If a socket still has a non-negative refcount, it cannot be in a
2703a9aa06f7SJason A. Harmening 	 * cycle.  In this case increment refcount of all children iteratively.
2704397c19d1SJeff Roberson 	 * Stop the scan once we do a complete loop without discovering
2705397c19d1SJeff Roberson 	 * a new reachable socket.
2706397c19d1SJeff Roberson 	 */
2707df8bae1dSRodney W. Grimes 	do {
2708397c19d1SJeff Roberson 		unp_marked = 0;
2709a9aa06f7SJason A. Harmening 		LIST_FOREACH_SAFE(unp, &unp_deadhead, unp_dead, unptmp)
2710a9aa06f7SJason A. Harmening 			if (unp->unp_gcrefs > 0) {
2711a9aa06f7SJason A. Harmening 				unp->unp_gcflag &= ~UNPGC_DEAD;
2712a9aa06f7SJason A. Harmening 				LIST_REMOVE(unp, unp_dead);
2713a9aa06f7SJason A. Harmening 				KASSERT(unp_unreachable > 0,
2714a9aa06f7SJason A. Harmening 				    ("%s: unp_unreachable underflow.",
2715a9aa06f7SJason A. Harmening 				    __func__));
2716a9aa06f7SJason A. Harmening 				unp_unreachable--;
2717a9aa06f7SJason A. Harmening 				unp_gc_scan(unp, unp_restore_undead_ref);
2718a9aa06f7SJason A. Harmening 			}
2719397c19d1SJeff Roberson 	} while (unp_marked);
2720a9aa06f7SJason A. Harmening 
2721779f106aSGleb Smirnoff 	UNP_LINK_RUNLOCK();
2722a9aa06f7SJason A. Harmening 
2723397c19d1SJeff Roberson 	if (unp_unreachable == 0)
2724397c19d1SJeff Roberson 		return;
272560a5ef26SRobert Watson 
2726ed5b7817SJulian Elischer 	/*
2727a9aa06f7SJason A. Harmening 	 * Allocate space for a local array of dead unpcbs.
2728a9aa06f7SJason A. Harmening 	 * TODO: can this path be simplified by instead using the local
2729a9aa06f7SJason A. Harmening 	 * dead list at unp_deadhead, after taking out references
2730a9aa06f7SJason A. Harmening 	 * on the file object and/or unpcb and dropping the link lock?
2731ed5b7817SJulian Elischer 	 */
2732397c19d1SJeff Roberson 	unref = malloc(unp_unreachable * sizeof(struct file *),
2733397c19d1SJeff Roberson 	    M_TEMP, M_WAITOK);
273460a5ef26SRobert Watson 
2735ed5b7817SJulian Elischer 	/*
2736397c19d1SJeff Roberson 	 * Iterate looking for sockets which have been specifically marked
2737a9aa06f7SJason A. Harmening 	 * as unreachable and store them locally.
2738ed5b7817SJulian Elischer 	 */
2739f7780c61SKonstantin Belousov 	UNP_LINK_RLOCK();
2740a9aa06f7SJason A. Harmening 	total = 0;
2741a9aa06f7SJason A. Harmening 	LIST_FOREACH(unp, &unp_deadhead, unp_dead) {
2742a9aa06f7SJason A. Harmening 		KASSERT((unp->unp_gcflag & UNPGC_DEAD) != 0,
2743a9aa06f7SJason A. Harmening 		    ("%s: unp %p not marked UNPGC_DEAD", __func__, unp));
2744a9aa06f7SJason A. Harmening 		unp->unp_gcflag &= ~UNPGC_DEAD;
2745f7780c61SKonstantin Belousov 		f = unp->unp_file;
2746f7780c61SKonstantin Belousov 		if (unp->unp_msgcount == 0 || f == NULL ||
27473c50616fSMateusz Guzik 		    refcount_load(&f->f_count) != unp->unp_msgcount ||
2748f1cf2b9dSKonstantin Belousov 		    !fhold(f))
2749f7780c61SKonstantin Belousov 			continue;
2750f7780c61SKonstantin Belousov 		unref[total++] = f;
2751f7780c61SKonstantin Belousov 		KASSERT(total <= unp_unreachable,
2752a9aa06f7SJason A. Harmening 		    ("%s: incorrect unreachable count.", __func__));
2753397c19d1SJeff Roberson 	}
2754f7780c61SKonstantin Belousov 	UNP_LINK_RUNLOCK();
275560a5ef26SRobert Watson 
2756ed5b7817SJulian Elischer 	/*
2757397c19d1SJeff Roberson 	 * Now flush all sockets, free'ing rights.  This will free the
2758397c19d1SJeff Roberson 	 * struct files associated with these sockets but leave each socket
2759397c19d1SJeff Roberson 	 * with one remaining ref.
2760ed5b7817SJulian Elischer 	 */
27611fb51a12SBjoern A. Zeeb 	for (i = 0; i < total; i++) {
27621fb51a12SBjoern A. Zeeb 		struct socket *so;
27631fb51a12SBjoern A. Zeeb 
27641fb51a12SBjoern A. Zeeb 		so = unref[i]->f_data;
27651fb51a12SBjoern A. Zeeb 		CURVNET_SET(so->so_vnet);
27661fb51a12SBjoern A. Zeeb 		sorflush(so);
27671fb51a12SBjoern A. Zeeb 		CURVNET_RESTORE();
27681fb51a12SBjoern A. Zeeb 	}
276960a5ef26SRobert Watson 
2770ed5b7817SJulian Elischer 	/*
2771397c19d1SJeff Roberson 	 * And finally release the sockets so they can be reclaimed.
2772ed5b7817SJulian Elischer 	 */
2773f7780c61SKonstantin Belousov 	for (i = 0; i < total; i++)
2774397c19d1SJeff Roberson 		fdrop(unref[i], NULL);
2775f7780c61SKonstantin Belousov 	unp_recycled += total;
2776397c19d1SJeff Roberson 	free(unref, M_TEMP);
2777df8bae1dSRodney W. Grimes }
2778df8bae1dSRodney W. Grimes 
27790b36cd25SRobert Watson static void
278099ab95dbSMark Johnston unp_dispose_mbuf(struct mbuf *m)
2781df8bae1dSRodney W. Grimes {
2782996c772fSJohn Dyson 
2783df8bae1dSRodney W. Grimes 	if (m)
2784be26ba7cSPawel Jakub Dawidek 		unp_scan(m, unp_freerights);
2785df8bae1dSRodney W. Grimes }
2786df8bae1dSRodney W. Grimes 
27870c40f353SConrad Meyer /*
27880c40f353SConrad Meyer  * Synchronize against unp_gc, which can trip over data as we are freeing it.
27890c40f353SConrad Meyer  */
27900c40f353SConrad Meyer static void
279199ab95dbSMark Johnston unp_dispose(struct socket *so)
27920c40f353SConrad Meyer {
27930c40f353SConrad Meyer 	struct unpcb *unp;
27940c40f353SConrad Meyer 
27950c40f353SConrad Meyer 	unp = sotounpcb(so);
2796779f106aSGleb Smirnoff 	UNP_LINK_WLOCK();
27970c40f353SConrad Meyer 	unp->unp_gcflag |= UNPGC_IGNORE_RIGHTS;
2798779f106aSGleb Smirnoff 	UNP_LINK_WUNLOCK();
2799779f106aSGleb Smirnoff 	if (!SOLISTENING(so))
280099ab95dbSMark Johnston 		unp_dispose_mbuf(so->so_rcv.sb_mb);
28010c40f353SConrad Meyer }
28020c40f353SConrad Meyer 
2803f708ef1bSPoul-Henning Kamp static void
2804be26ba7cSPawel Jakub Dawidek unp_scan(struct mbuf *m0, void (*op)(struct filedescent **, int))
2805df8bae1dSRodney W. Grimes {
28062bc21ed9SDavid Malone 	struct mbuf *m;
28072bc21ed9SDavid Malone 	struct cmsghdr *cm;
28082bc21ed9SDavid Malone 	void *data;
28092bc21ed9SDavid Malone 	socklen_t clen, datalen;
2810df8bae1dSRodney W. Grimes 
2811fc3fcacfSRobert Watson 	while (m0 != NULL) {
28122bc21ed9SDavid Malone 		for (m = m0; m; m = m->m_next) {
281312396bdcSDavid Malone 			if (m->m_type != MT_CONTROL)
2814df8bae1dSRodney W. Grimes 				continue;
28152bc21ed9SDavid Malone 
28162bc21ed9SDavid Malone 			cm = mtod(m, struct cmsghdr *);
28172bc21ed9SDavid Malone 			clen = m->m_len;
28182bc21ed9SDavid Malone 
28192bc21ed9SDavid Malone 			while (cm != NULL) {
28202bc21ed9SDavid Malone 				if (sizeof(*cm) > clen || cm->cmsg_len > clen)
28212bc21ed9SDavid Malone 					break;
28222bc21ed9SDavid Malone 
28232bc21ed9SDavid Malone 				data = CMSG_DATA(cm);
28242bc21ed9SDavid Malone 				datalen = (caddr_t)cm + cm->cmsg_len
28252bc21ed9SDavid Malone 				    - (caddr_t)data;
28262bc21ed9SDavid Malone 
28272bc21ed9SDavid Malone 				if (cm->cmsg_level == SOL_SOCKET &&
28282bc21ed9SDavid Malone 				    cm->cmsg_type == SCM_RIGHTS) {
2829be26ba7cSPawel Jakub Dawidek 					(*op)(data, datalen /
2830be26ba7cSPawel Jakub Dawidek 					    sizeof(struct filedescent *));
28312bc21ed9SDavid Malone 				}
28322bc21ed9SDavid Malone 
28332bc21ed9SDavid Malone 				if (CMSG_SPACE(datalen) < clen) {
28342bc21ed9SDavid Malone 					clen -= CMSG_SPACE(datalen);
28352bc21ed9SDavid Malone 					cm = (struct cmsghdr *)
28362bc21ed9SDavid Malone 					    ((caddr_t)cm + CMSG_SPACE(datalen));
28372bc21ed9SDavid Malone 				} else {
28382bc21ed9SDavid Malone 					clen = 0;
28392bc21ed9SDavid Malone 					cm = NULL;
28402bc21ed9SDavid Malone 				}
28412bc21ed9SDavid Malone 			}
2842df8bae1dSRodney W. Grimes 		}
2843c29a3321SKevin Lo 		m0 = m0->m_nextpkt;
2844df8bae1dSRodney W. Grimes 	}
2845df8bae1dSRodney W. Grimes }
2846df8bae1dSRodney W. Grimes 
2847662c901cSMikolaj Golub /*
2848662c901cSMikolaj Golub  * A helper function called by VFS before socket-type vnode reclamation.
2849662c901cSMikolaj Golub  * For an active vnode it clears unp_vnode pointer and decrements unp_vnode
2850662c901cSMikolaj Golub  * use count.
2851662c901cSMikolaj Golub  */
2852662c901cSMikolaj Golub void
2853662c901cSMikolaj Golub vfs_unp_reclaim(struct vnode *vp)
2854662c901cSMikolaj Golub {
2855662c901cSMikolaj Golub 	struct unpcb *unp;
2856662c901cSMikolaj Golub 	int active;
285775a67bf3SMatt Macy 	struct mtx *vplock;
2858662c901cSMikolaj Golub 
2859662c901cSMikolaj Golub 	ASSERT_VOP_ELOCKED(vp, "vfs_unp_reclaim");
2860662c901cSMikolaj Golub 	KASSERT(vp->v_type == VSOCK,
2861662c901cSMikolaj Golub 	    ("vfs_unp_reclaim: vp->v_type != VSOCK"));
2862662c901cSMikolaj Golub 
2863662c901cSMikolaj Golub 	active = 0;
286475a67bf3SMatt Macy 	vplock = mtx_pool_find(mtxpool_sleep, vp);
286575a67bf3SMatt Macy 	mtx_lock(vplock);
28660c3c207fSGleb Smirnoff 	VOP_UNP_CONNECT(vp, &unp);
2867662c901cSMikolaj Golub 	if (unp == NULL)
2868662c901cSMikolaj Golub 		goto done;
2869662c901cSMikolaj Golub 	UNP_PCB_LOCK(unp);
2870c7e41c8bSMikolaj Golub 	if (unp->unp_vnode == vp) {
2871c7e41c8bSMikolaj Golub 		VOP_UNP_DETACH(vp);
2872662c901cSMikolaj Golub 		unp->unp_vnode = NULL;
2873662c901cSMikolaj Golub 		active = 1;
2874662c901cSMikolaj Golub 	}
2875662c901cSMikolaj Golub 	UNP_PCB_UNLOCK(unp);
2876662c901cSMikolaj Golub  done:
287775a67bf3SMatt Macy 	mtx_unlock(vplock);
2878662c901cSMikolaj Golub 	if (active)
2879662c901cSMikolaj Golub 		vunref(vp);
2880662c901cSMikolaj Golub }
2881662c901cSMikolaj Golub 
288203c96c31SRobert Watson #ifdef DDB
288303c96c31SRobert Watson static void
288403c96c31SRobert Watson db_print_indent(int indent)
288503c96c31SRobert Watson {
288603c96c31SRobert Watson 	int i;
288703c96c31SRobert Watson 
288803c96c31SRobert Watson 	for (i = 0; i < indent; i++)
288903c96c31SRobert Watson 		db_printf(" ");
289003c96c31SRobert Watson }
289103c96c31SRobert Watson 
289203c96c31SRobert Watson static void
289303c96c31SRobert Watson db_print_unpflags(int unp_flags)
289403c96c31SRobert Watson {
289503c96c31SRobert Watson 	int comma;
289603c96c31SRobert Watson 
289703c96c31SRobert Watson 	comma = 0;
289803c96c31SRobert Watson 	if (unp_flags & UNP_HAVEPC) {
289903c96c31SRobert Watson 		db_printf("%sUNP_HAVEPC", comma ? ", " : "");
290003c96c31SRobert Watson 		comma = 1;
290103c96c31SRobert Watson 	}
29022de07e40SConrad Meyer 	if (unp_flags & UNP_WANTCRED_ALWAYS) {
29032de07e40SConrad Meyer 		db_printf("%sUNP_WANTCRED_ALWAYS", comma ? ", " : "");
29042de07e40SConrad Meyer 		comma = 1;
29052de07e40SConrad Meyer 	}
29062de07e40SConrad Meyer 	if (unp_flags & UNP_WANTCRED_ONESHOT) {
29072de07e40SConrad Meyer 		db_printf("%sUNP_WANTCRED_ONESHOT", comma ? ", " : "");
290803c96c31SRobert Watson 		comma = 1;
290903c96c31SRobert Watson 	}
291003c96c31SRobert Watson 	if (unp_flags & UNP_CONNWAIT) {
291103c96c31SRobert Watson 		db_printf("%sUNP_CONNWAIT", comma ? ", " : "");
291203c96c31SRobert Watson 		comma = 1;
291303c96c31SRobert Watson 	}
291403c96c31SRobert Watson 	if (unp_flags & UNP_CONNECTING) {
291503c96c31SRobert Watson 		db_printf("%sUNP_CONNECTING", comma ? ", " : "");
291603c96c31SRobert Watson 		comma = 1;
291703c96c31SRobert Watson 	}
291803c96c31SRobert Watson 	if (unp_flags & UNP_BINDING) {
291903c96c31SRobert Watson 		db_printf("%sUNP_BINDING", comma ? ", " : "");
292003c96c31SRobert Watson 		comma = 1;
292103c96c31SRobert Watson 	}
292203c96c31SRobert Watson }
292303c96c31SRobert Watson 
292403c96c31SRobert Watson static void
292503c96c31SRobert Watson db_print_xucred(int indent, struct xucred *xu)
292603c96c31SRobert Watson {
292703c96c31SRobert Watson 	int comma, i;
292803c96c31SRobert Watson 
292903c96c31SRobert Watson 	db_print_indent(indent);
2930c5afec6eSDmitry Chagin 	db_printf("cr_version: %u   cr_uid: %u   cr_pid: %d   cr_ngroups: %d\n",
2931c5afec6eSDmitry Chagin 	    xu->cr_version, xu->cr_uid, xu->cr_pid, xu->cr_ngroups);
293203c96c31SRobert Watson 	db_print_indent(indent);
293303c96c31SRobert Watson 	db_printf("cr_groups: ");
293403c96c31SRobert Watson 	comma = 0;
293503c96c31SRobert Watson 	for (i = 0; i < xu->cr_ngroups; i++) {
293603c96c31SRobert Watson 		db_printf("%s%u", comma ? ", " : "", xu->cr_groups[i]);
293703c96c31SRobert Watson 		comma = 1;
293803c96c31SRobert Watson 	}
293903c96c31SRobert Watson 	db_printf("\n");
294003c96c31SRobert Watson }
294103c96c31SRobert Watson 
294203c96c31SRobert Watson static void
294303c96c31SRobert Watson db_print_unprefs(int indent, struct unp_head *uh)
294403c96c31SRobert Watson {
294503c96c31SRobert Watson 	struct unpcb *unp;
294603c96c31SRobert Watson 	int counter;
294703c96c31SRobert Watson 
294803c96c31SRobert Watson 	counter = 0;
294903c96c31SRobert Watson 	LIST_FOREACH(unp, uh, unp_reflink) {
295003c96c31SRobert Watson 		if (counter % 4 == 0)
295103c96c31SRobert Watson 			db_print_indent(indent);
295203c96c31SRobert Watson 		db_printf("%p  ", unp);
295303c96c31SRobert Watson 		if (counter % 4 == 3)
295403c96c31SRobert Watson 			db_printf("\n");
295503c96c31SRobert Watson 		counter++;
295603c96c31SRobert Watson 	}
295703c96c31SRobert Watson 	if (counter != 0 && counter % 4 != 0)
295803c96c31SRobert Watson 		db_printf("\n");
295903c96c31SRobert Watson }
296003c96c31SRobert Watson 
296103c96c31SRobert Watson DB_SHOW_COMMAND(unpcb, db_show_unpcb)
296203c96c31SRobert Watson {
296303c96c31SRobert Watson 	struct unpcb *unp;
296403c96c31SRobert Watson 
296503c96c31SRobert Watson         if (!have_addr) {
296603c96c31SRobert Watson                 db_printf("usage: show unpcb <addr>\n");
296703c96c31SRobert Watson                 return;
296803c96c31SRobert Watson         }
296903c96c31SRobert Watson         unp = (struct unpcb *)addr;
297003c96c31SRobert Watson 
297103c96c31SRobert Watson 	db_printf("unp_socket: %p   unp_vnode: %p\n", unp->unp_socket,
297203c96c31SRobert Watson 	    unp->unp_vnode);
297303c96c31SRobert Watson 
2974fc8fdae0SMatthew D Fleming 	db_printf("unp_ino: %ju   unp_conn: %p\n", (uintmax_t)unp->unp_ino,
297503c96c31SRobert Watson 	    unp->unp_conn);
297603c96c31SRobert Watson 
297703c96c31SRobert Watson 	db_printf("unp_refs:\n");
297803c96c31SRobert Watson 	db_print_unprefs(2, &unp->unp_refs);
297903c96c31SRobert Watson 
298003c96c31SRobert Watson 	/* XXXRW: Would be nice to print the full address, if any. */
298103c96c31SRobert Watson 	db_printf("unp_addr: %p\n", unp->unp_addr);
298203c96c31SRobert Watson 
2983c2090e73SAlan Somers 	db_printf("unp_gencnt: %llu\n",
298403c96c31SRobert Watson 	    (unsigned long long)unp->unp_gencnt);
298503c96c31SRobert Watson 
298603c96c31SRobert Watson 	db_printf("unp_flags: %x (", unp->unp_flags);
298703c96c31SRobert Watson 	db_print_unpflags(unp->unp_flags);
298803c96c31SRobert Watson 	db_printf(")\n");
298903c96c31SRobert Watson 
299003c96c31SRobert Watson 	db_printf("unp_peercred:\n");
299103c96c31SRobert Watson 	db_print_xucred(2, &unp->unp_peercred);
299203c96c31SRobert Watson 
299303c96c31SRobert Watson 	db_printf("unp_refcount: %u\n", unp->unp_refcount);
299403c96c31SRobert Watson }
299503c96c31SRobert Watson #endif
2996