xref: /freebsd/sys/kern/uipc_usrreq.c (revision cc3f4b99653c34ae64f8a1fddea370abefef680e)
1 /*-
2  * Copyright (c) 1982, 1986, 1989, 1991, 1993
3  *	The Regents of the University of California.
4  * Copyright (c) 2004-2009 Robert N. M. Watson
5  * All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  * 4. Neither the name of the University nor the names of its contributors
16  *    may be used to endorse or promote products derived from this software
17  *    without specific prior written permission.
18  *
19  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
20  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
23  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29  * SUCH DAMAGE.
30  *
31  *	From: @(#)uipc_usrreq.c	8.3 (Berkeley) 1/4/94
32  */
33 
34 /*
35  * UNIX Domain (Local) Sockets
36  *
37  * This is an implementation of UNIX (local) domain sockets.  Each socket has
38  * an associated struct unpcb (UNIX protocol control block).  Stream sockets
39  * may be connected to 0 or 1 other socket.  Datagram sockets may be
40  * connected to 0, 1, or many other sockets.  Sockets may be created and
41  * connected in pairs (socketpair(2)), or bound/connected to using the file
42  * system name space.  For most purposes, only the receive socket buffer is
43  * used, as sending on one socket delivers directly to the receive socket
44  * buffer of a second socket.
45  *
46  * The implementation is substantially complicated by the fact that
47  * "ancillary data", such as file descriptors or credentials, may be passed
48  * across UNIX domain sockets.  The potential for passing UNIX domain sockets
49  * over other UNIX domain sockets requires the implementation of a simple
50  * garbage collector to find and tear down cycles of disconnected sockets.
51  *
52  * TODO:
53  *	RDM
54  *	rethink name space problems
55  *	need a proper out-of-band
56  */
57 
58 #include <sys/cdefs.h>
59 __FBSDID("$FreeBSD$");
60 
61 #include "opt_ddb.h"
62 
63 #include <sys/param.h>
64 #include <sys/capsicum.h>
65 #include <sys/domain.h>
66 #include <sys/fcntl.h>
67 #include <sys/malloc.h>		/* XXX must be before <sys/file.h> */
68 #include <sys/eventhandler.h>
69 #include <sys/file.h>
70 #include <sys/filedesc.h>
71 #include <sys/kernel.h>
72 #include <sys/lock.h>
73 #include <sys/mbuf.h>
74 #include <sys/mount.h>
75 #include <sys/mutex.h>
76 #include <sys/namei.h>
77 #include <sys/proc.h>
78 #include <sys/protosw.h>
79 #include <sys/queue.h>
80 #include <sys/resourcevar.h>
81 #include <sys/rwlock.h>
82 #include <sys/socket.h>
83 #include <sys/socketvar.h>
84 #include <sys/signalvar.h>
85 #include <sys/stat.h>
86 #include <sys/sx.h>
87 #include <sys/sysctl.h>
88 #include <sys/systm.h>
89 #include <sys/taskqueue.h>
90 #include <sys/un.h>
91 #include <sys/unpcb.h>
92 #include <sys/vnode.h>
93 
94 #include <net/vnet.h>
95 
96 #ifdef DDB
97 #include <ddb/ddb.h>
98 #endif
99 
100 #include <security/mac/mac_framework.h>
101 
102 #include <vm/uma.h>
103 
104 MALLOC_DECLARE(M_FILECAPS);
105 
106 /*
107  * Locking key:
108  * (l)	Locked using list lock
109  * (g)	Locked using linkage lock
110  */
111 
112 static uma_zone_t	unp_zone;
113 static unp_gen_t	unp_gencnt;	/* (l) */
114 static u_int		unp_count;	/* (l) Count of local sockets. */
115 static ino_t		unp_ino;	/* Prototype for fake inode numbers. */
116 static int		unp_rights;	/* (g) File descriptors in flight. */
117 static struct unp_head	unp_shead;	/* (l) List of stream sockets. */
118 static struct unp_head	unp_dhead;	/* (l) List of datagram sockets. */
119 static struct unp_head	unp_sphead;	/* (l) List of seqpacket sockets. */
120 
121 struct unp_defer {
122 	SLIST_ENTRY(unp_defer) ud_link;
123 	struct file *ud_fp;
124 };
125 static SLIST_HEAD(, unp_defer) unp_defers;
126 static int unp_defers_count;
127 
128 static const struct sockaddr	sun_noname = { sizeof(sun_noname), AF_LOCAL };
129 
130 /*
131  * Garbage collection of cyclic file descriptor/socket references occurs
132  * asynchronously in a taskqueue context in order to avoid recursion and
133  * reentrance in the UNIX domain socket, file descriptor, and socket layer
134  * code.  See unp_gc() for a full description.
135  */
136 static struct timeout_task unp_gc_task;
137 
138 /*
139  * The close of unix domain sockets attached as SCM_RIGHTS is
140  * postponed to the taskqueue, to avoid arbitrary recursion depth.
141  * The attached sockets might have another sockets attached.
142  */
143 static struct task	unp_defer_task;
144 
145 /*
146  * Both send and receive buffers are allocated PIPSIZ bytes of buffering for
147  * stream sockets, although the total for sender and receiver is actually
148  * only PIPSIZ.
149  *
150  * Datagram sockets really use the sendspace as the maximum datagram size,
151  * and don't really want to reserve the sendspace.  Their recvspace should be
152  * large enough for at least one max-size datagram plus address.
153  */
154 #ifndef PIPSIZ
155 #define	PIPSIZ	8192
156 #endif
157 static u_long	unpst_sendspace = PIPSIZ;
158 static u_long	unpst_recvspace = PIPSIZ;
159 static u_long	unpdg_sendspace = 2*1024;	/* really max datagram size */
160 static u_long	unpdg_recvspace = 4*1024;
161 static u_long	unpsp_sendspace = PIPSIZ;	/* really max datagram size */
162 static u_long	unpsp_recvspace = PIPSIZ;
163 
164 static SYSCTL_NODE(_net, PF_LOCAL, local, CTLFLAG_RW, 0, "Local domain");
165 static SYSCTL_NODE(_net_local, SOCK_STREAM, stream, CTLFLAG_RW, 0,
166     "SOCK_STREAM");
167 static SYSCTL_NODE(_net_local, SOCK_DGRAM, dgram, CTLFLAG_RW, 0, "SOCK_DGRAM");
168 static SYSCTL_NODE(_net_local, SOCK_SEQPACKET, seqpacket, CTLFLAG_RW, 0,
169     "SOCK_SEQPACKET");
170 
171 SYSCTL_ULONG(_net_local_stream, OID_AUTO, sendspace, CTLFLAG_RW,
172 	   &unpst_sendspace, 0, "Default stream send space.");
173 SYSCTL_ULONG(_net_local_stream, OID_AUTO, recvspace, CTLFLAG_RW,
174 	   &unpst_recvspace, 0, "Default stream receive space.");
175 SYSCTL_ULONG(_net_local_dgram, OID_AUTO, maxdgram, CTLFLAG_RW,
176 	   &unpdg_sendspace, 0, "Default datagram send space.");
177 SYSCTL_ULONG(_net_local_dgram, OID_AUTO, recvspace, CTLFLAG_RW,
178 	   &unpdg_recvspace, 0, "Default datagram receive space.");
179 SYSCTL_ULONG(_net_local_seqpacket, OID_AUTO, maxseqpacket, CTLFLAG_RW,
180 	   &unpsp_sendspace, 0, "Default seqpacket send space.");
181 SYSCTL_ULONG(_net_local_seqpacket, OID_AUTO, recvspace, CTLFLAG_RW,
182 	   &unpsp_recvspace, 0, "Default seqpacket receive space.");
183 SYSCTL_INT(_net_local, OID_AUTO, inflight, CTLFLAG_RD, &unp_rights, 0,
184     "File descriptors in flight.");
185 SYSCTL_INT(_net_local, OID_AUTO, deferred, CTLFLAG_RD,
186     &unp_defers_count, 0,
187     "File descriptors deferred to taskqueue for close.");
188 
189 /*
190  * Locking and synchronization:
191  *
192  * Three types of locks exit in the local domain socket implementation: a
193  * global list mutex, a global linkage rwlock, and per-unpcb mutexes.  Of the
194  * global locks, the list lock protects the socket count, global generation
195  * number, and stream/datagram global lists.  The linkage lock protects the
196  * interconnection of unpcbs, the v_socket and unp_vnode pointers, and can be
197  * held exclusively over the acquisition of multiple unpcb locks to prevent
198  * deadlock.
199  *
200  * UNIX domain sockets each have an unpcb hung off of their so_pcb pointer,
201  * allocated in pru_attach() and freed in pru_detach().  The validity of that
202  * pointer is an invariant, so no lock is required to dereference the so_pcb
203  * pointer if a valid socket reference is held by the caller.  In practice,
204  * this is always true during operations performed on a socket.  Each unpcb
205  * has a back-pointer to its socket, unp_socket, which will be stable under
206  * the same circumstances.
207  *
208  * This pointer may only be safely dereferenced as long as a valid reference
209  * to the unpcb is held.  Typically, this reference will be from the socket,
210  * or from another unpcb when the referring unpcb's lock is held (in order
211  * that the reference not be invalidated during use).  For example, to follow
212  * unp->unp_conn->unp_socket, you need unlock the lock on unp, not unp_conn,
213  * as unp_socket remains valid as long as the reference to unp_conn is valid.
214  *
215  * Fields of unpcbss are locked using a per-unpcb lock, unp_mtx.  Individual
216  * atomic reads without the lock may be performed "lockless", but more
217  * complex reads and read-modify-writes require the mutex to be held.  No
218  * lock order is defined between unpcb locks -- multiple unpcb locks may be
219  * acquired at the same time only when holding the linkage rwlock
220  * exclusively, which prevents deadlocks.
221  *
222  * Blocking with UNIX domain sockets is a tricky issue: unlike most network
223  * protocols, bind() is a non-atomic operation, and connect() requires
224  * potential sleeping in the protocol, due to potentially waiting on local or
225  * distributed file systems.  We try to separate "lookup" operations, which
226  * may sleep, and the IPC operations themselves, which typically can occur
227  * with relative atomicity as locks can be held over the entire operation.
228  *
229  * Another tricky issue is simultaneous multi-threaded or multi-process
230  * access to a single UNIX domain socket.  These are handled by the flags
231  * UNP_CONNECTING and UNP_BINDING, which prevent concurrent connecting or
232  * binding, both of which involve dropping UNIX domain socket locks in order
233  * to perform namei() and other file system operations.
234  */
235 static struct rwlock	unp_link_rwlock;
236 static struct mtx	unp_list_lock;
237 static struct mtx	unp_defers_lock;
238 
239 #define	UNP_LINK_LOCK_INIT()		rw_init(&unp_link_rwlock,	\
240 					    "unp_link_rwlock")
241 
242 #define	UNP_LINK_LOCK_ASSERT()	rw_assert(&unp_link_rwlock,	\
243 					    RA_LOCKED)
244 #define	UNP_LINK_UNLOCK_ASSERT()	rw_assert(&unp_link_rwlock,	\
245 					    RA_UNLOCKED)
246 
247 #define	UNP_LINK_RLOCK()		rw_rlock(&unp_link_rwlock)
248 #define	UNP_LINK_RUNLOCK()		rw_runlock(&unp_link_rwlock)
249 #define	UNP_LINK_WLOCK()		rw_wlock(&unp_link_rwlock)
250 #define	UNP_LINK_WUNLOCK()		rw_wunlock(&unp_link_rwlock)
251 #define	UNP_LINK_WLOCK_ASSERT()		rw_assert(&unp_link_rwlock,	\
252 					    RA_WLOCKED)
253 
254 #define	UNP_LIST_LOCK_INIT()		mtx_init(&unp_list_lock,	\
255 					    "unp_list_lock", NULL, MTX_DEF)
256 #define	UNP_LIST_LOCK()			mtx_lock(&unp_list_lock)
257 #define	UNP_LIST_UNLOCK()		mtx_unlock(&unp_list_lock)
258 
259 #define	UNP_DEFERRED_LOCK_INIT()	mtx_init(&unp_defers_lock, \
260 					    "unp_defer", NULL, MTX_DEF)
261 #define	UNP_DEFERRED_LOCK()		mtx_lock(&unp_defers_lock)
262 #define	UNP_DEFERRED_UNLOCK()		mtx_unlock(&unp_defers_lock)
263 
264 #define UNP_PCB_LOCK_INIT(unp)		mtx_init(&(unp)->unp_mtx,	\
265 					    "unp_mtx", "unp_mtx",	\
266 					    MTX_DUPOK|MTX_DEF|MTX_RECURSE)
267 #define	UNP_PCB_LOCK_DESTROY(unp)	mtx_destroy(&(unp)->unp_mtx)
268 #define	UNP_PCB_LOCK(unp)		mtx_lock(&(unp)->unp_mtx)
269 #define	UNP_PCB_UNLOCK(unp)		mtx_unlock(&(unp)->unp_mtx)
270 #define	UNP_PCB_LOCK_ASSERT(unp)	mtx_assert(&(unp)->unp_mtx, MA_OWNED)
271 
272 static int	uipc_connect2(struct socket *, struct socket *);
273 static int	uipc_ctloutput(struct socket *, struct sockopt *);
274 static int	unp_connect(struct socket *, struct sockaddr *,
275 		    struct thread *);
276 static int	unp_connectat(int, struct socket *, struct sockaddr *,
277 		    struct thread *);
278 static int	unp_connect2(struct socket *so, struct socket *so2, int);
279 static void	unp_disconnect(struct unpcb *unp, struct unpcb *unp2);
280 static void	unp_dispose(struct mbuf *);
281 static void	unp_shutdown(struct unpcb *);
282 static void	unp_drop(struct unpcb *, int);
283 static void	unp_gc(__unused void *, int);
284 static void	unp_scan(struct mbuf *, void (*)(struct filedescent **, int));
285 static void	unp_discard(struct file *);
286 static void	unp_freerights(struct filedescent **, int);
287 static void	unp_init(void);
288 static int	unp_internalize(struct mbuf **, struct thread *);
289 static void	unp_internalize_fp(struct file *);
290 static int	unp_externalize(struct mbuf *, struct mbuf **, int);
291 static int	unp_externalize_fp(struct file *);
292 static struct mbuf	*unp_addsockcred(struct thread *, struct mbuf *);
293 static void	unp_process_defers(void * __unused, int);
294 
295 /*
296  * Definitions of protocols supported in the LOCAL domain.
297  */
298 static struct domain localdomain;
299 static struct pr_usrreqs uipc_usrreqs_dgram, uipc_usrreqs_stream;
300 static struct pr_usrreqs uipc_usrreqs_seqpacket;
301 static struct protosw localsw[] = {
302 {
303 	.pr_type =		SOCK_STREAM,
304 	.pr_domain =		&localdomain,
305 	.pr_flags =		PR_CONNREQUIRED|PR_WANTRCVD|PR_RIGHTS,
306 	.pr_ctloutput =		&uipc_ctloutput,
307 	.pr_usrreqs =		&uipc_usrreqs_stream
308 },
309 {
310 	.pr_type =		SOCK_DGRAM,
311 	.pr_domain =		&localdomain,
312 	.pr_flags =		PR_ATOMIC|PR_ADDR|PR_RIGHTS,
313 	.pr_ctloutput =		&uipc_ctloutput,
314 	.pr_usrreqs =		&uipc_usrreqs_dgram
315 },
316 {
317 	.pr_type =		SOCK_SEQPACKET,
318 	.pr_domain =		&localdomain,
319 
320 	/*
321 	 * XXXRW: For now, PR_ADDR because soreceive will bump into them
322 	 * due to our use of sbappendaddr.  A new sbappend variants is needed
323 	 * that supports both atomic record writes and control data.
324 	 */
325 	.pr_flags =		PR_ADDR|PR_ATOMIC|PR_CONNREQUIRED|PR_WANTRCVD|
326 				    PR_RIGHTS,
327 	.pr_ctloutput =		&uipc_ctloutput,
328 	.pr_usrreqs =		&uipc_usrreqs_seqpacket,
329 },
330 };
331 
332 static struct domain localdomain = {
333 	.dom_family =		AF_LOCAL,
334 	.dom_name =		"local",
335 	.dom_init =		unp_init,
336 	.dom_externalize =	unp_externalize,
337 	.dom_dispose =		unp_dispose,
338 	.dom_protosw =		localsw,
339 	.dom_protoswNPROTOSW =	&localsw[sizeof(localsw)/sizeof(localsw[0])]
340 };
341 DOMAIN_SET(local);
342 
343 static void
344 uipc_abort(struct socket *so)
345 {
346 	struct unpcb *unp, *unp2;
347 
348 	unp = sotounpcb(so);
349 	KASSERT(unp != NULL, ("uipc_abort: unp == NULL"));
350 
351 	UNP_LINK_WLOCK();
352 	UNP_PCB_LOCK(unp);
353 	unp2 = unp->unp_conn;
354 	if (unp2 != NULL) {
355 		UNP_PCB_LOCK(unp2);
356 		unp_drop(unp2, ECONNABORTED);
357 		UNP_PCB_UNLOCK(unp2);
358 	}
359 	UNP_PCB_UNLOCK(unp);
360 	UNP_LINK_WUNLOCK();
361 }
362 
363 static int
364 uipc_accept(struct socket *so, struct sockaddr **nam)
365 {
366 	struct unpcb *unp, *unp2;
367 	const struct sockaddr *sa;
368 
369 	/*
370 	 * Pass back name of connected socket, if it was bound and we are
371 	 * still connected (our peer may have closed already!).
372 	 */
373 	unp = sotounpcb(so);
374 	KASSERT(unp != NULL, ("uipc_accept: unp == NULL"));
375 
376 	*nam = malloc(sizeof(struct sockaddr_un), M_SONAME, M_WAITOK);
377 	UNP_LINK_RLOCK();
378 	unp2 = unp->unp_conn;
379 	if (unp2 != NULL && unp2->unp_addr != NULL) {
380 		UNP_PCB_LOCK(unp2);
381 		sa = (struct sockaddr *) unp2->unp_addr;
382 		bcopy(sa, *nam, sa->sa_len);
383 		UNP_PCB_UNLOCK(unp2);
384 	} else {
385 		sa = &sun_noname;
386 		bcopy(sa, *nam, sa->sa_len);
387 	}
388 	UNP_LINK_RUNLOCK();
389 	return (0);
390 }
391 
392 static int
393 uipc_attach(struct socket *so, int proto, struct thread *td)
394 {
395 	u_long sendspace, recvspace;
396 	struct unpcb *unp;
397 	int error;
398 
399 	KASSERT(so->so_pcb == NULL, ("uipc_attach: so_pcb != NULL"));
400 	if (so->so_snd.sb_hiwat == 0 || so->so_rcv.sb_hiwat == 0) {
401 		switch (so->so_type) {
402 		case SOCK_STREAM:
403 			sendspace = unpst_sendspace;
404 			recvspace = unpst_recvspace;
405 			break;
406 
407 		case SOCK_DGRAM:
408 			sendspace = unpdg_sendspace;
409 			recvspace = unpdg_recvspace;
410 			break;
411 
412 		case SOCK_SEQPACKET:
413 			sendspace = unpsp_sendspace;
414 			recvspace = unpsp_recvspace;
415 			break;
416 
417 		default:
418 			panic("uipc_attach");
419 		}
420 		error = soreserve(so, sendspace, recvspace);
421 		if (error)
422 			return (error);
423 	}
424 	unp = uma_zalloc(unp_zone, M_NOWAIT | M_ZERO);
425 	if (unp == NULL)
426 		return (ENOBUFS);
427 	LIST_INIT(&unp->unp_refs);
428 	UNP_PCB_LOCK_INIT(unp);
429 	unp->unp_socket = so;
430 	so->so_pcb = unp;
431 	unp->unp_refcount = 1;
432 
433 	UNP_LIST_LOCK();
434 	unp->unp_gencnt = ++unp_gencnt;
435 	unp_count++;
436 	switch (so->so_type) {
437 	case SOCK_STREAM:
438 		LIST_INSERT_HEAD(&unp_shead, unp, unp_link);
439 		break;
440 
441 	case SOCK_DGRAM:
442 		LIST_INSERT_HEAD(&unp_dhead, unp, unp_link);
443 		break;
444 
445 	case SOCK_SEQPACKET:
446 		LIST_INSERT_HEAD(&unp_sphead, unp, unp_link);
447 		break;
448 
449 	default:
450 		panic("uipc_attach");
451 	}
452 	UNP_LIST_UNLOCK();
453 
454 	return (0);
455 }
456 
457 static int
458 uipc_bindat(int fd, struct socket *so, struct sockaddr *nam, struct thread *td)
459 {
460 	struct sockaddr_un *soun = (struct sockaddr_un *)nam;
461 	struct vattr vattr;
462 	int error, namelen;
463 	struct nameidata nd;
464 	struct unpcb *unp;
465 	struct vnode *vp;
466 	struct mount *mp;
467 	cap_rights_t rights;
468 	char *buf;
469 
470 	unp = sotounpcb(so);
471 	KASSERT(unp != NULL, ("uipc_bind: unp == NULL"));
472 
473 	if (soun->sun_len > sizeof(struct sockaddr_un))
474 		return (EINVAL);
475 	namelen = soun->sun_len - offsetof(struct sockaddr_un, sun_path);
476 	if (namelen <= 0)
477 		return (EINVAL);
478 
479 	/*
480 	 * We don't allow simultaneous bind() calls on a single UNIX domain
481 	 * socket, so flag in-progress operations, and return an error if an
482 	 * operation is already in progress.
483 	 *
484 	 * Historically, we have not allowed a socket to be rebound, so this
485 	 * also returns an error.  Not allowing re-binding simplifies the
486 	 * implementation and avoids a great many possible failure modes.
487 	 */
488 	UNP_PCB_LOCK(unp);
489 	if (unp->unp_vnode != NULL) {
490 		UNP_PCB_UNLOCK(unp);
491 		return (EINVAL);
492 	}
493 	if (unp->unp_flags & UNP_BINDING) {
494 		UNP_PCB_UNLOCK(unp);
495 		return (EALREADY);
496 	}
497 	unp->unp_flags |= UNP_BINDING;
498 	UNP_PCB_UNLOCK(unp);
499 
500 	buf = malloc(namelen + 1, M_TEMP, M_WAITOK);
501 	bcopy(soun->sun_path, buf, namelen);
502 	buf[namelen] = 0;
503 
504 restart:
505 	NDINIT_ATRIGHTS(&nd, CREATE, NOFOLLOW | LOCKPARENT | SAVENAME,
506 	    UIO_SYSSPACE, buf, fd, cap_rights_init(&rights, CAP_BINDAT), td);
507 /* SHOULD BE ABLE TO ADOPT EXISTING AND wakeup() ALA FIFO's */
508 	error = namei(&nd);
509 	if (error)
510 		goto error;
511 	vp = nd.ni_vp;
512 	if (vp != NULL || vn_start_write(nd.ni_dvp, &mp, V_NOWAIT) != 0) {
513 		NDFREE(&nd, NDF_ONLY_PNBUF);
514 		if (nd.ni_dvp == vp)
515 			vrele(nd.ni_dvp);
516 		else
517 			vput(nd.ni_dvp);
518 		if (vp != NULL) {
519 			vrele(vp);
520 			error = EADDRINUSE;
521 			goto error;
522 		}
523 		error = vn_start_write(NULL, &mp, V_XSLEEP | PCATCH);
524 		if (error)
525 			goto error;
526 		goto restart;
527 	}
528 	VATTR_NULL(&vattr);
529 	vattr.va_type = VSOCK;
530 	vattr.va_mode = (ACCESSPERMS & ~td->td_proc->p_fd->fd_cmask);
531 #ifdef MAC
532 	error = mac_vnode_check_create(td->td_ucred, nd.ni_dvp, &nd.ni_cnd,
533 	    &vattr);
534 #endif
535 	if (error == 0)
536 		error = VOP_CREATE(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd, &vattr);
537 	NDFREE(&nd, NDF_ONLY_PNBUF);
538 	vput(nd.ni_dvp);
539 	if (error) {
540 		vn_finished_write(mp);
541 		goto error;
542 	}
543 	vp = nd.ni_vp;
544 	ASSERT_VOP_ELOCKED(vp, "uipc_bind");
545 	soun = (struct sockaddr_un *)sodupsockaddr(nam, M_WAITOK);
546 
547 	UNP_LINK_WLOCK();
548 	UNP_PCB_LOCK(unp);
549 	VOP_UNP_BIND(vp, unp->unp_socket);
550 	unp->unp_vnode = vp;
551 	unp->unp_addr = soun;
552 	unp->unp_flags &= ~UNP_BINDING;
553 	UNP_PCB_UNLOCK(unp);
554 	UNP_LINK_WUNLOCK();
555 	VOP_UNLOCK(vp, 0);
556 	vn_finished_write(mp);
557 	free(buf, M_TEMP);
558 	return (0);
559 
560 error:
561 	UNP_PCB_LOCK(unp);
562 	unp->unp_flags &= ~UNP_BINDING;
563 	UNP_PCB_UNLOCK(unp);
564 	free(buf, M_TEMP);
565 	return (error);
566 }
567 
568 static int
569 uipc_bind(struct socket *so, struct sockaddr *nam, struct thread *td)
570 {
571 
572 	return (uipc_bindat(AT_FDCWD, so, nam, td));
573 }
574 
575 static int
576 uipc_connect(struct socket *so, struct sockaddr *nam, struct thread *td)
577 {
578 	int error;
579 
580 	KASSERT(td == curthread, ("uipc_connect: td != curthread"));
581 	UNP_LINK_WLOCK();
582 	error = unp_connect(so, nam, td);
583 	UNP_LINK_WUNLOCK();
584 	return (error);
585 }
586 
587 static int
588 uipc_connectat(int fd, struct socket *so, struct sockaddr *nam,
589     struct thread *td)
590 {
591 	int error;
592 
593 	KASSERT(td == curthread, ("uipc_connectat: td != curthread"));
594 	UNP_LINK_WLOCK();
595 	error = unp_connectat(fd, so, nam, td);
596 	UNP_LINK_WUNLOCK();
597 	return (error);
598 }
599 
600 static void
601 uipc_close(struct socket *so)
602 {
603 	struct unpcb *unp, *unp2;
604 
605 	unp = sotounpcb(so);
606 	KASSERT(unp != NULL, ("uipc_close: unp == NULL"));
607 
608 	UNP_LINK_WLOCK();
609 	UNP_PCB_LOCK(unp);
610 	unp2 = unp->unp_conn;
611 	if (unp2 != NULL) {
612 		UNP_PCB_LOCK(unp2);
613 		unp_disconnect(unp, unp2);
614 		UNP_PCB_UNLOCK(unp2);
615 	}
616 	UNP_PCB_UNLOCK(unp);
617 	UNP_LINK_WUNLOCK();
618 }
619 
620 static int
621 uipc_connect2(struct socket *so1, struct socket *so2)
622 {
623 	struct unpcb *unp, *unp2;
624 	int error;
625 
626 	UNP_LINK_WLOCK();
627 	unp = so1->so_pcb;
628 	KASSERT(unp != NULL, ("uipc_connect2: unp == NULL"));
629 	UNP_PCB_LOCK(unp);
630 	unp2 = so2->so_pcb;
631 	KASSERT(unp2 != NULL, ("uipc_connect2: unp2 == NULL"));
632 	UNP_PCB_LOCK(unp2);
633 	error = unp_connect2(so1, so2, PRU_CONNECT2);
634 	UNP_PCB_UNLOCK(unp2);
635 	UNP_PCB_UNLOCK(unp);
636 	UNP_LINK_WUNLOCK();
637 	return (error);
638 }
639 
640 static void
641 uipc_detach(struct socket *so)
642 {
643 	struct unpcb *unp, *unp2;
644 	struct sockaddr_un *saved_unp_addr;
645 	struct vnode *vp;
646 	int freeunp, local_unp_rights;
647 
648 	unp = sotounpcb(so);
649 	KASSERT(unp != NULL, ("uipc_detach: unp == NULL"));
650 
651 	UNP_LINK_WLOCK();
652 	UNP_LIST_LOCK();
653 	UNP_PCB_LOCK(unp);
654 	LIST_REMOVE(unp, unp_link);
655 	unp->unp_gencnt = ++unp_gencnt;
656 	--unp_count;
657 	UNP_LIST_UNLOCK();
658 
659 	/*
660 	 * XXXRW: Should assert vp->v_socket == so.
661 	 */
662 	if ((vp = unp->unp_vnode) != NULL) {
663 		VOP_UNP_DETACH(vp);
664 		unp->unp_vnode = NULL;
665 	}
666 	unp2 = unp->unp_conn;
667 	if (unp2 != NULL) {
668 		UNP_PCB_LOCK(unp2);
669 		unp_disconnect(unp, unp2);
670 		UNP_PCB_UNLOCK(unp2);
671 	}
672 
673 	/*
674 	 * We hold the linkage lock exclusively, so it's OK to acquire
675 	 * multiple pcb locks at a time.
676 	 */
677 	while (!LIST_EMPTY(&unp->unp_refs)) {
678 		struct unpcb *ref = LIST_FIRST(&unp->unp_refs);
679 
680 		UNP_PCB_LOCK(ref);
681 		unp_drop(ref, ECONNRESET);
682 		UNP_PCB_UNLOCK(ref);
683 	}
684 	local_unp_rights = unp_rights;
685 	UNP_LINK_WUNLOCK();
686 	unp->unp_socket->so_pcb = NULL;
687 	saved_unp_addr = unp->unp_addr;
688 	unp->unp_addr = NULL;
689 	unp->unp_refcount--;
690 	freeunp = (unp->unp_refcount == 0);
691 	if (saved_unp_addr != NULL)
692 		free(saved_unp_addr, M_SONAME);
693 	if (freeunp) {
694 		UNP_PCB_LOCK_DESTROY(unp);
695 		uma_zfree(unp_zone, unp);
696 	} else
697 		UNP_PCB_UNLOCK(unp);
698 	if (vp)
699 		vrele(vp);
700 	if (local_unp_rights)
701 		taskqueue_enqueue_timeout(taskqueue_thread, &unp_gc_task, -1);
702 }
703 
704 static int
705 uipc_disconnect(struct socket *so)
706 {
707 	struct unpcb *unp, *unp2;
708 
709 	unp = sotounpcb(so);
710 	KASSERT(unp != NULL, ("uipc_disconnect: unp == NULL"));
711 
712 	UNP_LINK_WLOCK();
713 	UNP_PCB_LOCK(unp);
714 	unp2 = unp->unp_conn;
715 	if (unp2 != NULL) {
716 		UNP_PCB_LOCK(unp2);
717 		unp_disconnect(unp, unp2);
718 		UNP_PCB_UNLOCK(unp2);
719 	}
720 	UNP_PCB_UNLOCK(unp);
721 	UNP_LINK_WUNLOCK();
722 	return (0);
723 }
724 
725 static int
726 uipc_listen(struct socket *so, int backlog, struct thread *td)
727 {
728 	struct unpcb *unp;
729 	int error;
730 
731 	unp = sotounpcb(so);
732 	KASSERT(unp != NULL, ("uipc_listen: unp == NULL"));
733 
734 	UNP_PCB_LOCK(unp);
735 	if (unp->unp_vnode == NULL) {
736 		UNP_PCB_UNLOCK(unp);
737 		return (EINVAL);
738 	}
739 
740 	SOCK_LOCK(so);
741 	error = solisten_proto_check(so);
742 	if (error == 0) {
743 		cru2x(td->td_ucred, &unp->unp_peercred);
744 		unp->unp_flags |= UNP_HAVEPCCACHED;
745 		solisten_proto(so, backlog);
746 	}
747 	SOCK_UNLOCK(so);
748 	UNP_PCB_UNLOCK(unp);
749 	return (error);
750 }
751 
752 static int
753 uipc_peeraddr(struct socket *so, struct sockaddr **nam)
754 {
755 	struct unpcb *unp, *unp2;
756 	const struct sockaddr *sa;
757 
758 	unp = sotounpcb(so);
759 	KASSERT(unp != NULL, ("uipc_peeraddr: unp == NULL"));
760 
761 	*nam = malloc(sizeof(struct sockaddr_un), M_SONAME, M_WAITOK);
762 	UNP_LINK_RLOCK();
763 	/*
764 	 * XXX: It seems that this test always fails even when connection is
765 	 * established.  So, this else clause is added as workaround to
766 	 * return PF_LOCAL sockaddr.
767 	 */
768 	unp2 = unp->unp_conn;
769 	if (unp2 != NULL) {
770 		UNP_PCB_LOCK(unp2);
771 		if (unp2->unp_addr != NULL)
772 			sa = (struct sockaddr *) unp2->unp_addr;
773 		else
774 			sa = &sun_noname;
775 		bcopy(sa, *nam, sa->sa_len);
776 		UNP_PCB_UNLOCK(unp2);
777 	} else {
778 		sa = &sun_noname;
779 		bcopy(sa, *nam, sa->sa_len);
780 	}
781 	UNP_LINK_RUNLOCK();
782 	return (0);
783 }
784 
785 static int
786 uipc_rcvd(struct socket *so, int flags)
787 {
788 	struct unpcb *unp, *unp2;
789 	struct socket *so2;
790 	u_int mbcnt, sbcc;
791 
792 	unp = sotounpcb(so);
793 	KASSERT(unp != NULL, ("uipc_rcvd: unp == NULL"));
794 
795 	if (so->so_type != SOCK_STREAM && so->so_type != SOCK_SEQPACKET)
796 		panic("uipc_rcvd socktype %d", so->so_type);
797 
798 	/*
799 	 * Adjust backpressure on sender and wakeup any waiting to write.
800 	 *
801 	 * The unp lock is acquired to maintain the validity of the unp_conn
802 	 * pointer; no lock on unp2 is required as unp2->unp_socket will be
803 	 * static as long as we don't permit unp2 to disconnect from unp,
804 	 * which is prevented by the lock on unp.  We cache values from
805 	 * so_rcv to avoid holding the so_rcv lock over the entire
806 	 * transaction on the remote so_snd.
807 	 */
808 	SOCKBUF_LOCK(&so->so_rcv);
809 	mbcnt = so->so_rcv.sb_mbcnt;
810 	sbcc = so->so_rcv.sb_cc;
811 	SOCKBUF_UNLOCK(&so->so_rcv);
812 	/*
813 	 * There is a benign race condition at this point.  If we're planning to
814 	 * clear SB_STOP, but uipc_send is called on the connected socket at
815 	 * this instant, it might add data to the sockbuf and set SB_STOP.  Then
816 	 * we would erroneously clear SB_STOP below, even though the sockbuf is
817 	 * full.  The race is benign because the only ill effect is to allow the
818 	 * sockbuf to exceed its size limit, and the size limits are not
819 	 * strictly guaranteed anyway.
820 	 */
821 	UNP_PCB_LOCK(unp);
822 	unp2 = unp->unp_conn;
823 	if (unp2 == NULL) {
824 		UNP_PCB_UNLOCK(unp);
825 		return (0);
826 	}
827 	so2 = unp2->unp_socket;
828 	SOCKBUF_LOCK(&so2->so_snd);
829 	if (sbcc < so2->so_snd.sb_hiwat && mbcnt < so2->so_snd.sb_mbmax)
830 		so2->so_snd.sb_flags &= ~SB_STOP;
831 	sowwakeup_locked(so2);
832 	UNP_PCB_UNLOCK(unp);
833 	return (0);
834 }
835 
836 static int
837 uipc_send(struct socket *so, int flags, struct mbuf *m, struct sockaddr *nam,
838     struct mbuf *control, struct thread *td)
839 {
840 	struct unpcb *unp, *unp2;
841 	struct socket *so2;
842 	u_int mbcnt, sbcc;
843 	int error = 0;
844 
845 	unp = sotounpcb(so);
846 	KASSERT(unp != NULL, ("uipc_send: unp == NULL"));
847 
848 	if (flags & PRUS_OOB) {
849 		error = EOPNOTSUPP;
850 		goto release;
851 	}
852 	if (control != NULL && (error = unp_internalize(&control, td)))
853 		goto release;
854 	if ((nam != NULL) || (flags & PRUS_EOF))
855 		UNP_LINK_WLOCK();
856 	else
857 		UNP_LINK_RLOCK();
858 	switch (so->so_type) {
859 	case SOCK_DGRAM:
860 	{
861 		const struct sockaddr *from;
862 
863 		unp2 = unp->unp_conn;
864 		if (nam != NULL) {
865 			UNP_LINK_WLOCK_ASSERT();
866 			if (unp2 != NULL) {
867 				error = EISCONN;
868 				break;
869 			}
870 			error = unp_connect(so, nam, td);
871 			if (error)
872 				break;
873 			unp2 = unp->unp_conn;
874 		}
875 
876 		/*
877 		 * Because connect() and send() are non-atomic in a sendto()
878 		 * with a target address, it's possible that the socket will
879 		 * have disconnected before the send() can run.  In that case
880 		 * return the slightly counter-intuitive but otherwise
881 		 * correct error that the socket is not connected.
882 		 */
883 		if (unp2 == NULL) {
884 			error = ENOTCONN;
885 			break;
886 		}
887 		/* Lockless read. */
888 		if (unp2->unp_flags & UNP_WANTCRED)
889 			control = unp_addsockcred(td, control);
890 		UNP_PCB_LOCK(unp);
891 		if (unp->unp_addr != NULL)
892 			from = (struct sockaddr *)unp->unp_addr;
893 		else
894 			from = &sun_noname;
895 		so2 = unp2->unp_socket;
896 		SOCKBUF_LOCK(&so2->so_rcv);
897 		if (sbappendaddr_nospacecheck_locked(&so2->so_rcv, from, m,
898 		    control)) {
899 			sorwakeup_locked(so2);
900 			m = NULL;
901 			control = NULL;
902 		} else {
903 			SOCKBUF_UNLOCK(&so2->so_rcv);
904 			error = ENOBUFS;
905 		}
906 		if (nam != NULL) {
907 			UNP_LINK_WLOCK_ASSERT();
908 			UNP_PCB_LOCK(unp2);
909 			unp_disconnect(unp, unp2);
910 			UNP_PCB_UNLOCK(unp2);
911 		}
912 		UNP_PCB_UNLOCK(unp);
913 		break;
914 	}
915 
916 	case SOCK_SEQPACKET:
917 	case SOCK_STREAM:
918 		if ((so->so_state & SS_ISCONNECTED) == 0) {
919 			if (nam != NULL) {
920 				UNP_LINK_WLOCK_ASSERT();
921 				error = unp_connect(so, nam, td);
922 				if (error)
923 					break;	/* XXX */
924 			} else {
925 				error = ENOTCONN;
926 				break;
927 			}
928 		}
929 
930 		/* Lockless read. */
931 		if (so->so_snd.sb_state & SBS_CANTSENDMORE) {
932 			error = EPIPE;
933 			break;
934 		}
935 
936 		/*
937 		 * Because connect() and send() are non-atomic in a sendto()
938 		 * with a target address, it's possible that the socket will
939 		 * have disconnected before the send() can run.  In that case
940 		 * return the slightly counter-intuitive but otherwise
941 		 * correct error that the socket is not connected.
942 		 *
943 		 * Locking here must be done carefully: the linkage lock
944 		 * prevents interconnections between unpcbs from changing, so
945 		 * we can traverse from unp to unp2 without acquiring unp's
946 		 * lock.  Socket buffer locks follow unpcb locks, so we can
947 		 * acquire both remote and lock socket buffer locks.
948 		 */
949 		unp2 = unp->unp_conn;
950 		if (unp2 == NULL) {
951 			error = ENOTCONN;
952 			break;
953 		}
954 		so2 = unp2->unp_socket;
955 		UNP_PCB_LOCK(unp2);
956 		SOCKBUF_LOCK(&so2->so_rcv);
957 		if (unp2->unp_flags & UNP_WANTCRED) {
958 			/*
959 			 * Credentials are passed only once on SOCK_STREAM
960 			 * and SOCK_SEQPACKET.
961 			 */
962 			unp2->unp_flags &= ~UNP_WANTCRED;
963 			control = unp_addsockcred(td, control);
964 		}
965 		/*
966 		 * Send to paired receive port, and then reduce send buffer
967 		 * hiwater marks to maintain backpressure.  Wake up readers.
968 		 */
969 		switch (so->so_type) {
970 		case SOCK_STREAM:
971 			if (control != NULL) {
972 				if (sbappendcontrol_locked(&so2->so_rcv, m,
973 				    control))
974 					control = NULL;
975 			} else
976 				sbappend_locked(&so2->so_rcv, m);
977 			break;
978 
979 		case SOCK_SEQPACKET: {
980 			const struct sockaddr *from;
981 
982 			from = &sun_noname;
983 			/*
984 			 * Don't check for space available in so2->so_rcv.
985 			 * Unix domain sockets only check for space in the
986 			 * sending sockbuf, and that check is performed one
987 			 * level up the stack.
988 			 */
989 			if (sbappendaddr_nospacecheck_locked(&so2->so_rcv,
990 				from, m, control))
991 				control = NULL;
992 			break;
993 			}
994 		}
995 
996 		mbcnt = so2->so_rcv.sb_mbcnt;
997 		sbcc = so2->so_rcv.sb_cc;
998 		sorwakeup_locked(so2);
999 
1000 		/*
1001 		 * The PCB lock on unp2 protects the SB_STOP flag.  Without it,
1002 		 * it would be possible for uipc_rcvd to be called at this
1003 		 * point, drain the receiving sockbuf, clear SB_STOP, and then
1004 		 * we would set SB_STOP below.  That could lead to an empty
1005 		 * sockbuf having SB_STOP set
1006 		 */
1007 		SOCKBUF_LOCK(&so->so_snd);
1008 		if (sbcc >= so->so_snd.sb_hiwat || mbcnt >= so->so_snd.sb_mbmax)
1009 			so->so_snd.sb_flags |= SB_STOP;
1010 		SOCKBUF_UNLOCK(&so->so_snd);
1011 		UNP_PCB_UNLOCK(unp2);
1012 		m = NULL;
1013 		break;
1014 
1015 	default:
1016 		panic("uipc_send unknown socktype");
1017 	}
1018 
1019 	/*
1020 	 * PRUS_EOF is equivalent to pru_send followed by pru_shutdown.
1021 	 */
1022 	if (flags & PRUS_EOF) {
1023 		UNP_PCB_LOCK(unp);
1024 		socantsendmore(so);
1025 		unp_shutdown(unp);
1026 		UNP_PCB_UNLOCK(unp);
1027 	}
1028 
1029 	if ((nam != NULL) || (flags & PRUS_EOF))
1030 		UNP_LINK_WUNLOCK();
1031 	else
1032 		UNP_LINK_RUNLOCK();
1033 
1034 	if (control != NULL && error != 0)
1035 		unp_dispose(control);
1036 
1037 release:
1038 	if (control != NULL)
1039 		m_freem(control);
1040 	if (m != NULL)
1041 		m_freem(m);
1042 	return (error);
1043 }
1044 
1045 static int
1046 uipc_sense(struct socket *so, struct stat *sb)
1047 {
1048 	struct unpcb *unp;
1049 
1050 	unp = sotounpcb(so);
1051 	KASSERT(unp != NULL, ("uipc_sense: unp == NULL"));
1052 
1053 	sb->st_blksize = so->so_snd.sb_hiwat;
1054 	UNP_PCB_LOCK(unp);
1055 	sb->st_dev = NODEV;
1056 	if (unp->unp_ino == 0)
1057 		unp->unp_ino = (++unp_ino == 0) ? ++unp_ino : unp_ino;
1058 	sb->st_ino = unp->unp_ino;
1059 	UNP_PCB_UNLOCK(unp);
1060 	return (0);
1061 }
1062 
1063 static int
1064 uipc_shutdown(struct socket *so)
1065 {
1066 	struct unpcb *unp;
1067 
1068 	unp = sotounpcb(so);
1069 	KASSERT(unp != NULL, ("uipc_shutdown: unp == NULL"));
1070 
1071 	UNP_LINK_WLOCK();
1072 	UNP_PCB_LOCK(unp);
1073 	socantsendmore(so);
1074 	unp_shutdown(unp);
1075 	UNP_PCB_UNLOCK(unp);
1076 	UNP_LINK_WUNLOCK();
1077 	return (0);
1078 }
1079 
1080 static int
1081 uipc_sockaddr(struct socket *so, struct sockaddr **nam)
1082 {
1083 	struct unpcb *unp;
1084 	const struct sockaddr *sa;
1085 
1086 	unp = sotounpcb(so);
1087 	KASSERT(unp != NULL, ("uipc_sockaddr: unp == NULL"));
1088 
1089 	*nam = malloc(sizeof(struct sockaddr_un), M_SONAME, M_WAITOK);
1090 	UNP_PCB_LOCK(unp);
1091 	if (unp->unp_addr != NULL)
1092 		sa = (struct sockaddr *) unp->unp_addr;
1093 	else
1094 		sa = &sun_noname;
1095 	bcopy(sa, *nam, sa->sa_len);
1096 	UNP_PCB_UNLOCK(unp);
1097 	return (0);
1098 }
1099 
1100 static struct pr_usrreqs uipc_usrreqs_dgram = {
1101 	.pru_abort = 		uipc_abort,
1102 	.pru_accept =		uipc_accept,
1103 	.pru_attach =		uipc_attach,
1104 	.pru_bind =		uipc_bind,
1105 	.pru_bindat =		uipc_bindat,
1106 	.pru_connect =		uipc_connect,
1107 	.pru_connectat =	uipc_connectat,
1108 	.pru_connect2 =		uipc_connect2,
1109 	.pru_detach =		uipc_detach,
1110 	.pru_disconnect =	uipc_disconnect,
1111 	.pru_listen =		uipc_listen,
1112 	.pru_peeraddr =		uipc_peeraddr,
1113 	.pru_rcvd =		uipc_rcvd,
1114 	.pru_send =		uipc_send,
1115 	.pru_sense =		uipc_sense,
1116 	.pru_shutdown =		uipc_shutdown,
1117 	.pru_sockaddr =		uipc_sockaddr,
1118 	.pru_soreceive =	soreceive_dgram,
1119 	.pru_close =		uipc_close,
1120 };
1121 
1122 static struct pr_usrreqs uipc_usrreqs_seqpacket = {
1123 	.pru_abort =		uipc_abort,
1124 	.pru_accept =		uipc_accept,
1125 	.pru_attach =		uipc_attach,
1126 	.pru_bind =		uipc_bind,
1127 	.pru_bindat =		uipc_bindat,
1128 	.pru_connect =		uipc_connect,
1129 	.pru_connectat =	uipc_connectat,
1130 	.pru_connect2 =		uipc_connect2,
1131 	.pru_detach =		uipc_detach,
1132 	.pru_disconnect =	uipc_disconnect,
1133 	.pru_listen =		uipc_listen,
1134 	.pru_peeraddr =		uipc_peeraddr,
1135 	.pru_rcvd =		uipc_rcvd,
1136 	.pru_send =		uipc_send,
1137 	.pru_sense =		uipc_sense,
1138 	.pru_shutdown =		uipc_shutdown,
1139 	.pru_sockaddr =		uipc_sockaddr,
1140 	.pru_soreceive =	soreceive_generic,	/* XXX: or...? */
1141 	.pru_close =		uipc_close,
1142 };
1143 
1144 static struct pr_usrreqs uipc_usrreqs_stream = {
1145 	.pru_abort = 		uipc_abort,
1146 	.pru_accept =		uipc_accept,
1147 	.pru_attach =		uipc_attach,
1148 	.pru_bind =		uipc_bind,
1149 	.pru_bindat =		uipc_bindat,
1150 	.pru_connect =		uipc_connect,
1151 	.pru_connectat =	uipc_connectat,
1152 	.pru_connect2 =		uipc_connect2,
1153 	.pru_detach =		uipc_detach,
1154 	.pru_disconnect =	uipc_disconnect,
1155 	.pru_listen =		uipc_listen,
1156 	.pru_peeraddr =		uipc_peeraddr,
1157 	.pru_rcvd =		uipc_rcvd,
1158 	.pru_send =		uipc_send,
1159 	.pru_sense =		uipc_sense,
1160 	.pru_shutdown =		uipc_shutdown,
1161 	.pru_sockaddr =		uipc_sockaddr,
1162 	.pru_soreceive =	soreceive_generic,
1163 	.pru_close =		uipc_close,
1164 };
1165 
1166 static int
1167 uipc_ctloutput(struct socket *so, struct sockopt *sopt)
1168 {
1169 	struct unpcb *unp;
1170 	struct xucred xu;
1171 	int error, optval;
1172 
1173 	if (sopt->sopt_level != 0)
1174 		return (EINVAL);
1175 
1176 	unp = sotounpcb(so);
1177 	KASSERT(unp != NULL, ("uipc_ctloutput: unp == NULL"));
1178 	error = 0;
1179 	switch (sopt->sopt_dir) {
1180 	case SOPT_GET:
1181 		switch (sopt->sopt_name) {
1182 		case LOCAL_PEERCRED:
1183 			UNP_PCB_LOCK(unp);
1184 			if (unp->unp_flags & UNP_HAVEPC)
1185 				xu = unp->unp_peercred;
1186 			else {
1187 				if (so->so_type == SOCK_STREAM)
1188 					error = ENOTCONN;
1189 				else
1190 					error = EINVAL;
1191 			}
1192 			UNP_PCB_UNLOCK(unp);
1193 			if (error == 0)
1194 				error = sooptcopyout(sopt, &xu, sizeof(xu));
1195 			break;
1196 
1197 		case LOCAL_CREDS:
1198 			/* Unlocked read. */
1199 			optval = unp->unp_flags & UNP_WANTCRED ? 1 : 0;
1200 			error = sooptcopyout(sopt, &optval, sizeof(optval));
1201 			break;
1202 
1203 		case LOCAL_CONNWAIT:
1204 			/* Unlocked read. */
1205 			optval = unp->unp_flags & UNP_CONNWAIT ? 1 : 0;
1206 			error = sooptcopyout(sopt, &optval, sizeof(optval));
1207 			break;
1208 
1209 		default:
1210 			error = EOPNOTSUPP;
1211 			break;
1212 		}
1213 		break;
1214 
1215 	case SOPT_SET:
1216 		switch (sopt->sopt_name) {
1217 		case LOCAL_CREDS:
1218 		case LOCAL_CONNWAIT:
1219 			error = sooptcopyin(sopt, &optval, sizeof(optval),
1220 					    sizeof(optval));
1221 			if (error)
1222 				break;
1223 
1224 #define	OPTSET(bit) do {						\
1225 	UNP_PCB_LOCK(unp);						\
1226 	if (optval)							\
1227 		unp->unp_flags |= bit;					\
1228 	else								\
1229 		unp->unp_flags &= ~bit;					\
1230 	UNP_PCB_UNLOCK(unp);						\
1231 } while (0)
1232 
1233 			switch (sopt->sopt_name) {
1234 			case LOCAL_CREDS:
1235 				OPTSET(UNP_WANTCRED);
1236 				break;
1237 
1238 			case LOCAL_CONNWAIT:
1239 				OPTSET(UNP_CONNWAIT);
1240 				break;
1241 
1242 			default:
1243 				break;
1244 			}
1245 			break;
1246 #undef	OPTSET
1247 		default:
1248 			error = ENOPROTOOPT;
1249 			break;
1250 		}
1251 		break;
1252 
1253 	default:
1254 		error = EOPNOTSUPP;
1255 		break;
1256 	}
1257 	return (error);
1258 }
1259 
1260 static int
1261 unp_connect(struct socket *so, struct sockaddr *nam, struct thread *td)
1262 {
1263 
1264 	return (unp_connectat(AT_FDCWD, so, nam, td));
1265 }
1266 
1267 static int
1268 unp_connectat(int fd, struct socket *so, struct sockaddr *nam,
1269     struct thread *td)
1270 {
1271 	struct sockaddr_un *soun = (struct sockaddr_un *)nam;
1272 	struct vnode *vp;
1273 	struct socket *so2, *so3;
1274 	struct unpcb *unp, *unp2, *unp3;
1275 	struct nameidata nd;
1276 	char buf[SOCK_MAXADDRLEN];
1277 	struct sockaddr *sa;
1278 	cap_rights_t rights;
1279 	int error, len;
1280 
1281 	UNP_LINK_WLOCK_ASSERT();
1282 
1283 	unp = sotounpcb(so);
1284 	KASSERT(unp != NULL, ("unp_connect: unp == NULL"));
1285 
1286 	if (nam->sa_len > sizeof(struct sockaddr_un))
1287 		return (EINVAL);
1288 	len = nam->sa_len - offsetof(struct sockaddr_un, sun_path);
1289 	if (len <= 0)
1290 		return (EINVAL);
1291 	bcopy(soun->sun_path, buf, len);
1292 	buf[len] = 0;
1293 
1294 	UNP_PCB_LOCK(unp);
1295 	if (unp->unp_flags & UNP_CONNECTING) {
1296 		UNP_PCB_UNLOCK(unp);
1297 		return (EALREADY);
1298 	}
1299 	UNP_LINK_WUNLOCK();
1300 	unp->unp_flags |= UNP_CONNECTING;
1301 	UNP_PCB_UNLOCK(unp);
1302 
1303 	sa = malloc(sizeof(struct sockaddr_un), M_SONAME, M_WAITOK);
1304 	NDINIT_ATRIGHTS(&nd, LOOKUP, FOLLOW | LOCKSHARED | LOCKLEAF,
1305 	    UIO_SYSSPACE, buf, fd, cap_rights_init(&rights, CAP_CONNECTAT), td);
1306 	error = namei(&nd);
1307 	if (error)
1308 		vp = NULL;
1309 	else
1310 		vp = nd.ni_vp;
1311 	ASSERT_VOP_LOCKED(vp, "unp_connect");
1312 	NDFREE(&nd, NDF_ONLY_PNBUF);
1313 	if (error)
1314 		goto bad;
1315 
1316 	if (vp->v_type != VSOCK) {
1317 		error = ENOTSOCK;
1318 		goto bad;
1319 	}
1320 #ifdef MAC
1321 	error = mac_vnode_check_open(td->td_ucred, vp, VWRITE | VREAD);
1322 	if (error)
1323 		goto bad;
1324 #endif
1325 	error = VOP_ACCESS(vp, VWRITE, td->td_ucred, td);
1326 	if (error)
1327 		goto bad;
1328 
1329 	unp = sotounpcb(so);
1330 	KASSERT(unp != NULL, ("unp_connect: unp == NULL"));
1331 
1332 	/*
1333 	 * Lock linkage lock for two reasons: make sure v_socket is stable,
1334 	 * and to protect simultaneous locking of multiple pcbs.
1335 	 */
1336 	UNP_LINK_WLOCK();
1337 	VOP_UNP_CONNECT(vp, &so2);
1338 	if (so2 == NULL) {
1339 		error = ECONNREFUSED;
1340 		goto bad2;
1341 	}
1342 	if (so->so_type != so2->so_type) {
1343 		error = EPROTOTYPE;
1344 		goto bad2;
1345 	}
1346 	if (so->so_proto->pr_flags & PR_CONNREQUIRED) {
1347 		if (so2->so_options & SO_ACCEPTCONN) {
1348 			CURVNET_SET(so2->so_vnet);
1349 			so3 = sonewconn(so2, 0);
1350 			CURVNET_RESTORE();
1351 		} else
1352 			so3 = NULL;
1353 		if (so3 == NULL) {
1354 			error = ECONNREFUSED;
1355 			goto bad2;
1356 		}
1357 		unp = sotounpcb(so);
1358 		unp2 = sotounpcb(so2);
1359 		unp3 = sotounpcb(so3);
1360 		UNP_PCB_LOCK(unp);
1361 		UNP_PCB_LOCK(unp2);
1362 		UNP_PCB_LOCK(unp3);
1363 		if (unp2->unp_addr != NULL) {
1364 			bcopy(unp2->unp_addr, sa, unp2->unp_addr->sun_len);
1365 			unp3->unp_addr = (struct sockaddr_un *) sa;
1366 			sa = NULL;
1367 		}
1368 
1369 		/*
1370 		 * The connector's (client's) credentials are copied from its
1371 		 * process structure at the time of connect() (which is now).
1372 		 */
1373 		cru2x(td->td_ucred, &unp3->unp_peercred);
1374 		unp3->unp_flags |= UNP_HAVEPC;
1375 
1376 		/*
1377 		 * The receiver's (server's) credentials are copied from the
1378 		 * unp_peercred member of socket on which the former called
1379 		 * listen(); uipc_listen() cached that process's credentials
1380 		 * at that time so we can use them now.
1381 		 */
1382 		KASSERT(unp2->unp_flags & UNP_HAVEPCCACHED,
1383 		    ("unp_connect: listener without cached peercred"));
1384 		memcpy(&unp->unp_peercred, &unp2->unp_peercred,
1385 		    sizeof(unp->unp_peercred));
1386 		unp->unp_flags |= UNP_HAVEPC;
1387 		if (unp2->unp_flags & UNP_WANTCRED)
1388 			unp3->unp_flags |= UNP_WANTCRED;
1389 		UNP_PCB_UNLOCK(unp3);
1390 		UNP_PCB_UNLOCK(unp2);
1391 		UNP_PCB_UNLOCK(unp);
1392 #ifdef MAC
1393 		mac_socketpeer_set_from_socket(so, so3);
1394 		mac_socketpeer_set_from_socket(so3, so);
1395 #endif
1396 
1397 		so2 = so3;
1398 	}
1399 	unp = sotounpcb(so);
1400 	KASSERT(unp != NULL, ("unp_connect: unp == NULL"));
1401 	unp2 = sotounpcb(so2);
1402 	KASSERT(unp2 != NULL, ("unp_connect: unp2 == NULL"));
1403 	UNP_PCB_LOCK(unp);
1404 	UNP_PCB_LOCK(unp2);
1405 	error = unp_connect2(so, so2, PRU_CONNECT);
1406 	UNP_PCB_UNLOCK(unp2);
1407 	UNP_PCB_UNLOCK(unp);
1408 bad2:
1409 	UNP_LINK_WUNLOCK();
1410 bad:
1411 	if (vp != NULL)
1412 		vput(vp);
1413 	free(sa, M_SONAME);
1414 	UNP_LINK_WLOCK();
1415 	UNP_PCB_LOCK(unp);
1416 	unp->unp_flags &= ~UNP_CONNECTING;
1417 	UNP_PCB_UNLOCK(unp);
1418 	return (error);
1419 }
1420 
1421 static int
1422 unp_connect2(struct socket *so, struct socket *so2, int req)
1423 {
1424 	struct unpcb *unp;
1425 	struct unpcb *unp2;
1426 
1427 	unp = sotounpcb(so);
1428 	KASSERT(unp != NULL, ("unp_connect2: unp == NULL"));
1429 	unp2 = sotounpcb(so2);
1430 	KASSERT(unp2 != NULL, ("unp_connect2: unp2 == NULL"));
1431 
1432 	UNP_LINK_WLOCK_ASSERT();
1433 	UNP_PCB_LOCK_ASSERT(unp);
1434 	UNP_PCB_LOCK_ASSERT(unp2);
1435 
1436 	if (so2->so_type != so->so_type)
1437 		return (EPROTOTYPE);
1438 	unp->unp_conn = unp2;
1439 
1440 	switch (so->so_type) {
1441 	case SOCK_DGRAM:
1442 		LIST_INSERT_HEAD(&unp2->unp_refs, unp, unp_reflink);
1443 		soisconnected(so);
1444 		break;
1445 
1446 	case SOCK_STREAM:
1447 	case SOCK_SEQPACKET:
1448 		unp2->unp_conn = unp;
1449 		if (req == PRU_CONNECT &&
1450 		    ((unp->unp_flags | unp2->unp_flags) & UNP_CONNWAIT))
1451 			soisconnecting(so);
1452 		else
1453 			soisconnected(so);
1454 		soisconnected(so2);
1455 		break;
1456 
1457 	default:
1458 		panic("unp_connect2");
1459 	}
1460 	return (0);
1461 }
1462 
1463 static void
1464 unp_disconnect(struct unpcb *unp, struct unpcb *unp2)
1465 {
1466 	struct socket *so;
1467 
1468 	KASSERT(unp2 != NULL, ("unp_disconnect: unp2 == NULL"));
1469 
1470 	UNP_LINK_WLOCK_ASSERT();
1471 	UNP_PCB_LOCK_ASSERT(unp);
1472 	UNP_PCB_LOCK_ASSERT(unp2);
1473 
1474 	unp->unp_conn = NULL;
1475 	switch (unp->unp_socket->so_type) {
1476 	case SOCK_DGRAM:
1477 		LIST_REMOVE(unp, unp_reflink);
1478 		so = unp->unp_socket;
1479 		SOCK_LOCK(so);
1480 		so->so_state &= ~SS_ISCONNECTED;
1481 		SOCK_UNLOCK(so);
1482 		break;
1483 
1484 	case SOCK_STREAM:
1485 	case SOCK_SEQPACKET:
1486 		soisdisconnected(unp->unp_socket);
1487 		unp2->unp_conn = NULL;
1488 		soisdisconnected(unp2->unp_socket);
1489 		break;
1490 	}
1491 }
1492 
1493 /*
1494  * unp_pcblist() walks the global list of struct unpcb's to generate a
1495  * pointer list, bumping the refcount on each unpcb.  It then copies them out
1496  * sequentially, validating the generation number on each to see if it has
1497  * been detached.  All of this is necessary because copyout() may sleep on
1498  * disk I/O.
1499  */
1500 static int
1501 unp_pcblist(SYSCTL_HANDLER_ARGS)
1502 {
1503 	int error, i, n;
1504 	int freeunp;
1505 	struct unpcb *unp, **unp_list;
1506 	unp_gen_t gencnt;
1507 	struct xunpgen *xug;
1508 	struct unp_head *head;
1509 	struct xunpcb *xu;
1510 
1511 	switch ((intptr_t)arg1) {
1512 	case SOCK_STREAM:
1513 		head = &unp_shead;
1514 		break;
1515 
1516 	case SOCK_DGRAM:
1517 		head = &unp_dhead;
1518 		break;
1519 
1520 	case SOCK_SEQPACKET:
1521 		head = &unp_sphead;
1522 		break;
1523 
1524 	default:
1525 		panic("unp_pcblist: arg1 %d", (int)(intptr_t)arg1);
1526 	}
1527 
1528 	/*
1529 	 * The process of preparing the PCB list is too time-consuming and
1530 	 * resource-intensive to repeat twice on every request.
1531 	 */
1532 	if (req->oldptr == NULL) {
1533 		n = unp_count;
1534 		req->oldidx = 2 * (sizeof *xug)
1535 			+ (n + n/8) * sizeof(struct xunpcb);
1536 		return (0);
1537 	}
1538 
1539 	if (req->newptr != NULL)
1540 		return (EPERM);
1541 
1542 	/*
1543 	 * OK, now we're committed to doing something.
1544 	 */
1545 	xug = malloc(sizeof(*xug), M_TEMP, M_WAITOK);
1546 	UNP_LIST_LOCK();
1547 	gencnt = unp_gencnt;
1548 	n = unp_count;
1549 	UNP_LIST_UNLOCK();
1550 
1551 	xug->xug_len = sizeof *xug;
1552 	xug->xug_count = n;
1553 	xug->xug_gen = gencnt;
1554 	xug->xug_sogen = so_gencnt;
1555 	error = SYSCTL_OUT(req, xug, sizeof *xug);
1556 	if (error) {
1557 		free(xug, M_TEMP);
1558 		return (error);
1559 	}
1560 
1561 	unp_list = malloc(n * sizeof *unp_list, M_TEMP, M_WAITOK);
1562 
1563 	UNP_LIST_LOCK();
1564 	for (unp = LIST_FIRST(head), i = 0; unp && i < n;
1565 	     unp = LIST_NEXT(unp, unp_link)) {
1566 		UNP_PCB_LOCK(unp);
1567 		if (unp->unp_gencnt <= gencnt) {
1568 			if (cr_cansee(req->td->td_ucred,
1569 			    unp->unp_socket->so_cred)) {
1570 				UNP_PCB_UNLOCK(unp);
1571 				continue;
1572 			}
1573 			unp_list[i++] = unp;
1574 			unp->unp_refcount++;
1575 		}
1576 		UNP_PCB_UNLOCK(unp);
1577 	}
1578 	UNP_LIST_UNLOCK();
1579 	n = i;			/* In case we lost some during malloc. */
1580 
1581 	error = 0;
1582 	xu = malloc(sizeof(*xu), M_TEMP, M_WAITOK | M_ZERO);
1583 	for (i = 0; i < n; i++) {
1584 		unp = unp_list[i];
1585 		UNP_PCB_LOCK(unp);
1586 		unp->unp_refcount--;
1587 	        if (unp->unp_refcount != 0 && unp->unp_gencnt <= gencnt) {
1588 			xu->xu_len = sizeof *xu;
1589 			xu->xu_unpp = unp;
1590 			/*
1591 			 * XXX - need more locking here to protect against
1592 			 * connect/disconnect races for SMP.
1593 			 */
1594 			if (unp->unp_addr != NULL)
1595 				bcopy(unp->unp_addr, &xu->xu_addr,
1596 				      unp->unp_addr->sun_len);
1597 			if (unp->unp_conn != NULL &&
1598 			    unp->unp_conn->unp_addr != NULL)
1599 				bcopy(unp->unp_conn->unp_addr,
1600 				      &xu->xu_caddr,
1601 				      unp->unp_conn->unp_addr->sun_len);
1602 			bcopy(unp, &xu->xu_unp, sizeof *unp);
1603 			sotoxsocket(unp->unp_socket, &xu->xu_socket);
1604 			UNP_PCB_UNLOCK(unp);
1605 			error = SYSCTL_OUT(req, xu, sizeof *xu);
1606 		} else {
1607 			freeunp = (unp->unp_refcount == 0);
1608 			UNP_PCB_UNLOCK(unp);
1609 			if (freeunp) {
1610 				UNP_PCB_LOCK_DESTROY(unp);
1611 				uma_zfree(unp_zone, unp);
1612 			}
1613 		}
1614 	}
1615 	free(xu, M_TEMP);
1616 	if (!error) {
1617 		/*
1618 		 * Give the user an updated idea of our state.  If the
1619 		 * generation differs from what we told her before, she knows
1620 		 * that something happened while we were processing this
1621 		 * request, and it might be necessary to retry.
1622 		 */
1623 		xug->xug_gen = unp_gencnt;
1624 		xug->xug_sogen = so_gencnt;
1625 		xug->xug_count = unp_count;
1626 		error = SYSCTL_OUT(req, xug, sizeof *xug);
1627 	}
1628 	free(unp_list, M_TEMP);
1629 	free(xug, M_TEMP);
1630 	return (error);
1631 }
1632 
1633 SYSCTL_PROC(_net_local_dgram, OID_AUTO, pcblist, CTLTYPE_OPAQUE | CTLFLAG_RD,
1634     (void *)(intptr_t)SOCK_DGRAM, 0, unp_pcblist, "S,xunpcb",
1635     "List of active local datagram sockets");
1636 SYSCTL_PROC(_net_local_stream, OID_AUTO, pcblist, CTLTYPE_OPAQUE | CTLFLAG_RD,
1637     (void *)(intptr_t)SOCK_STREAM, 0, unp_pcblist, "S,xunpcb",
1638     "List of active local stream sockets");
1639 SYSCTL_PROC(_net_local_seqpacket, OID_AUTO, pcblist,
1640     CTLTYPE_OPAQUE | CTLFLAG_RD,
1641     (void *)(intptr_t)SOCK_SEQPACKET, 0, unp_pcblist, "S,xunpcb",
1642     "List of active local seqpacket sockets");
1643 
1644 static void
1645 unp_shutdown(struct unpcb *unp)
1646 {
1647 	struct unpcb *unp2;
1648 	struct socket *so;
1649 
1650 	UNP_LINK_WLOCK_ASSERT();
1651 	UNP_PCB_LOCK_ASSERT(unp);
1652 
1653 	unp2 = unp->unp_conn;
1654 	if ((unp->unp_socket->so_type == SOCK_STREAM ||
1655 	    (unp->unp_socket->so_type == SOCK_SEQPACKET)) && unp2 != NULL) {
1656 		so = unp2->unp_socket;
1657 		if (so != NULL)
1658 			socantrcvmore(so);
1659 	}
1660 }
1661 
1662 static void
1663 unp_drop(struct unpcb *unp, int errno)
1664 {
1665 	struct socket *so = unp->unp_socket;
1666 	struct unpcb *unp2;
1667 
1668 	UNP_LINK_WLOCK_ASSERT();
1669 	UNP_PCB_LOCK_ASSERT(unp);
1670 
1671 	so->so_error = errno;
1672 	unp2 = unp->unp_conn;
1673 	if (unp2 == NULL)
1674 		return;
1675 	UNP_PCB_LOCK(unp2);
1676 	unp_disconnect(unp, unp2);
1677 	UNP_PCB_UNLOCK(unp2);
1678 }
1679 
1680 static void
1681 unp_freerights(struct filedescent **fdep, int fdcount)
1682 {
1683 	struct file *fp;
1684 	int i;
1685 
1686 	KASSERT(fdcount > 0, ("%s: fdcount %d", __func__, fdcount));
1687 
1688 	for (i = 0; i < fdcount; i++) {
1689 		fp = fdep[i]->fde_file;
1690 		filecaps_free(&fdep[i]->fde_caps);
1691 		unp_discard(fp);
1692 	}
1693 	free(fdep[0], M_FILECAPS);
1694 }
1695 
1696 static int
1697 unp_externalize(struct mbuf *control, struct mbuf **controlp, int flags)
1698 {
1699 	struct thread *td = curthread;		/* XXX */
1700 	struct cmsghdr *cm = mtod(control, struct cmsghdr *);
1701 	int i;
1702 	int *fdp;
1703 	struct filedesc *fdesc = td->td_proc->p_fd;
1704 	struct filedescent *fde, **fdep;
1705 	void *data;
1706 	socklen_t clen = control->m_len, datalen;
1707 	int error, newfds;
1708 	u_int newlen;
1709 
1710 	UNP_LINK_UNLOCK_ASSERT();
1711 
1712 	error = 0;
1713 	if (controlp != NULL) /* controlp == NULL => free control messages */
1714 		*controlp = NULL;
1715 	while (cm != NULL) {
1716 		if (sizeof(*cm) > clen || cm->cmsg_len > clen) {
1717 			error = EINVAL;
1718 			break;
1719 		}
1720 		data = CMSG_DATA(cm);
1721 		datalen = (caddr_t)cm + cm->cmsg_len - (caddr_t)data;
1722 		if (cm->cmsg_level == SOL_SOCKET
1723 		    && cm->cmsg_type == SCM_RIGHTS) {
1724 			newfds = datalen / sizeof(*fdep);
1725 			if (newfds == 0)
1726 				goto next;
1727 			fdep = data;
1728 
1729 			/* If we're not outputting the descriptors free them. */
1730 			if (error || controlp == NULL) {
1731 				unp_freerights(fdep, newfds);
1732 				goto next;
1733 			}
1734 			FILEDESC_XLOCK(fdesc);
1735 
1736 			/*
1737 			 * Now change each pointer to an fd in the global
1738 			 * table to an integer that is the index to the local
1739 			 * fd table entry that we set up to point to the
1740 			 * global one we are transferring.
1741 			 */
1742 			newlen = newfds * sizeof(int);
1743 			*controlp = sbcreatecontrol(NULL, newlen,
1744 			    SCM_RIGHTS, SOL_SOCKET);
1745 			if (*controlp == NULL) {
1746 				FILEDESC_XUNLOCK(fdesc);
1747 				error = E2BIG;
1748 				unp_freerights(fdep, newfds);
1749 				goto next;
1750 			}
1751 
1752 			fdp = (int *)
1753 			    CMSG_DATA(mtod(*controlp, struct cmsghdr *));
1754 			if (fdallocn(td, 0, fdp, newfds) != 0) {
1755 				FILEDESC_XUNLOCK(td->td_proc->p_fd);
1756 				error = EMSGSIZE;
1757 				unp_freerights(fdep, newfds);
1758 				m_freem(*controlp);
1759 				*controlp = NULL;
1760 				goto next;
1761 			}
1762 			for (i = 0; i < newfds; i++, fdp++) {
1763 				fde = &fdesc->fd_ofiles[*fdp];
1764 				fde->fde_file = fdep[i]->fde_file;
1765 				filecaps_move(&fdep[i]->fde_caps,
1766 				    &fde->fde_caps);
1767 				if ((flags & MSG_CMSG_CLOEXEC) != 0)
1768 					fde->fde_flags |= UF_EXCLOSE;
1769 				unp_externalize_fp(fde->fde_file);
1770 			}
1771 			FILEDESC_XUNLOCK(fdesc);
1772 			free(fdep[0], M_FILECAPS);
1773 		} else {
1774 			/* We can just copy anything else across. */
1775 			if (error || controlp == NULL)
1776 				goto next;
1777 			*controlp = sbcreatecontrol(NULL, datalen,
1778 			    cm->cmsg_type, cm->cmsg_level);
1779 			if (*controlp == NULL) {
1780 				error = ENOBUFS;
1781 				goto next;
1782 			}
1783 			bcopy(data,
1784 			    CMSG_DATA(mtod(*controlp, struct cmsghdr *)),
1785 			    datalen);
1786 		}
1787 		controlp = &(*controlp)->m_next;
1788 
1789 next:
1790 		if (CMSG_SPACE(datalen) < clen) {
1791 			clen -= CMSG_SPACE(datalen);
1792 			cm = (struct cmsghdr *)
1793 			    ((caddr_t)cm + CMSG_SPACE(datalen));
1794 		} else {
1795 			clen = 0;
1796 			cm = NULL;
1797 		}
1798 	}
1799 
1800 	m_freem(control);
1801 	return (error);
1802 }
1803 
1804 static void
1805 unp_zone_change(void *tag)
1806 {
1807 
1808 	uma_zone_set_max(unp_zone, maxsockets);
1809 }
1810 
1811 static void
1812 unp_init(void)
1813 {
1814 
1815 #ifdef VIMAGE
1816 	if (!IS_DEFAULT_VNET(curvnet))
1817 		return;
1818 #endif
1819 	unp_zone = uma_zcreate("unpcb", sizeof(struct unpcb), NULL, NULL,
1820 	    NULL, NULL, UMA_ALIGN_PTR, 0);
1821 	if (unp_zone == NULL)
1822 		panic("unp_init");
1823 	uma_zone_set_max(unp_zone, maxsockets);
1824 	uma_zone_set_warning(unp_zone, "kern.ipc.maxsockets limit reached");
1825 	EVENTHANDLER_REGISTER(maxsockets_change, unp_zone_change,
1826 	    NULL, EVENTHANDLER_PRI_ANY);
1827 	LIST_INIT(&unp_dhead);
1828 	LIST_INIT(&unp_shead);
1829 	LIST_INIT(&unp_sphead);
1830 	SLIST_INIT(&unp_defers);
1831 	TIMEOUT_TASK_INIT(taskqueue_thread, &unp_gc_task, 0, unp_gc, NULL);
1832 	TASK_INIT(&unp_defer_task, 0, unp_process_defers, NULL);
1833 	UNP_LINK_LOCK_INIT();
1834 	UNP_LIST_LOCK_INIT();
1835 	UNP_DEFERRED_LOCK_INIT();
1836 }
1837 
1838 static int
1839 unp_internalize(struct mbuf **controlp, struct thread *td)
1840 {
1841 	struct mbuf *control = *controlp;
1842 	struct proc *p = td->td_proc;
1843 	struct filedesc *fdesc = p->p_fd;
1844 	struct bintime *bt;
1845 	struct cmsghdr *cm = mtod(control, struct cmsghdr *);
1846 	struct cmsgcred *cmcred;
1847 	struct filedescent *fde, **fdep, *fdev;
1848 	struct file *fp;
1849 	struct timeval *tv;
1850 	int i, fd, *fdp;
1851 	void *data;
1852 	socklen_t clen = control->m_len, datalen;
1853 	int error, oldfds;
1854 	u_int newlen;
1855 
1856 	UNP_LINK_UNLOCK_ASSERT();
1857 
1858 	error = 0;
1859 	*controlp = NULL;
1860 	while (cm != NULL) {
1861 		if (sizeof(*cm) > clen || cm->cmsg_level != SOL_SOCKET
1862 		    || cm->cmsg_len > clen) {
1863 			error = EINVAL;
1864 			goto out;
1865 		}
1866 		data = CMSG_DATA(cm);
1867 		datalen = (caddr_t)cm + cm->cmsg_len - (caddr_t)data;
1868 
1869 		switch (cm->cmsg_type) {
1870 		/*
1871 		 * Fill in credential information.
1872 		 */
1873 		case SCM_CREDS:
1874 			*controlp = sbcreatecontrol(NULL, sizeof(*cmcred),
1875 			    SCM_CREDS, SOL_SOCKET);
1876 			if (*controlp == NULL) {
1877 				error = ENOBUFS;
1878 				goto out;
1879 			}
1880 			cmcred = (struct cmsgcred *)
1881 			    CMSG_DATA(mtod(*controlp, struct cmsghdr *));
1882 			cmcred->cmcred_pid = p->p_pid;
1883 			cmcred->cmcred_uid = td->td_ucred->cr_ruid;
1884 			cmcred->cmcred_gid = td->td_ucred->cr_rgid;
1885 			cmcred->cmcred_euid = td->td_ucred->cr_uid;
1886 			cmcred->cmcred_ngroups = MIN(td->td_ucred->cr_ngroups,
1887 			    CMGROUP_MAX);
1888 			for (i = 0; i < cmcred->cmcred_ngroups; i++)
1889 				cmcred->cmcred_groups[i] =
1890 				    td->td_ucred->cr_groups[i];
1891 			break;
1892 
1893 		case SCM_RIGHTS:
1894 			oldfds = datalen / sizeof (int);
1895 			if (oldfds == 0)
1896 				break;
1897 			/*
1898 			 * Check that all the FDs passed in refer to legal
1899 			 * files.  If not, reject the entire operation.
1900 			 */
1901 			fdp = data;
1902 			FILEDESC_SLOCK(fdesc);
1903 			for (i = 0; i < oldfds; i++) {
1904 				fd = *fdp++;
1905 				if (fget_locked(fdesc, fd) == NULL) {
1906 					FILEDESC_SUNLOCK(fdesc);
1907 					error = EBADF;
1908 					goto out;
1909 				}
1910 				fp = fdesc->fd_ofiles[fd].fde_file;
1911 				if (!(fp->f_ops->fo_flags & DFLAG_PASSABLE)) {
1912 					FILEDESC_SUNLOCK(fdesc);
1913 					error = EOPNOTSUPP;
1914 					goto out;
1915 				}
1916 
1917 			}
1918 
1919 			/*
1920 			 * Now replace the integer FDs with pointers to the
1921 			 * file structure and capability rights.
1922 			 */
1923 			newlen = oldfds * sizeof(fdep[0]);
1924 			*controlp = sbcreatecontrol(NULL, newlen,
1925 			    SCM_RIGHTS, SOL_SOCKET);
1926 			if (*controlp == NULL) {
1927 				FILEDESC_SUNLOCK(fdesc);
1928 				error = E2BIG;
1929 				goto out;
1930 			}
1931 			fdp = data;
1932 			fdep = (struct filedescent **)
1933 			    CMSG_DATA(mtod(*controlp, struct cmsghdr *));
1934 			fdev = malloc(sizeof(*fdev) * oldfds, M_FILECAPS,
1935 			    M_WAITOK);
1936 			for (i = 0; i < oldfds; i++, fdev++, fdp++) {
1937 				fde = &fdesc->fd_ofiles[*fdp];
1938 				fdep[i] = fdev;
1939 				fdep[i]->fde_file = fde->fde_file;
1940 				filecaps_copy(&fde->fde_caps,
1941 				    &fdep[i]->fde_caps);
1942 				unp_internalize_fp(fdep[i]->fde_file);
1943 			}
1944 			FILEDESC_SUNLOCK(fdesc);
1945 			break;
1946 
1947 		case SCM_TIMESTAMP:
1948 			*controlp = sbcreatecontrol(NULL, sizeof(*tv),
1949 			    SCM_TIMESTAMP, SOL_SOCKET);
1950 			if (*controlp == NULL) {
1951 				error = ENOBUFS;
1952 				goto out;
1953 			}
1954 			tv = (struct timeval *)
1955 			    CMSG_DATA(mtod(*controlp, struct cmsghdr *));
1956 			microtime(tv);
1957 			break;
1958 
1959 		case SCM_BINTIME:
1960 			*controlp = sbcreatecontrol(NULL, sizeof(*bt),
1961 			    SCM_BINTIME, SOL_SOCKET);
1962 			if (*controlp == NULL) {
1963 				error = ENOBUFS;
1964 				goto out;
1965 			}
1966 			bt = (struct bintime *)
1967 			    CMSG_DATA(mtod(*controlp, struct cmsghdr *));
1968 			bintime(bt);
1969 			break;
1970 
1971 		default:
1972 			error = EINVAL;
1973 			goto out;
1974 		}
1975 
1976 		controlp = &(*controlp)->m_next;
1977 		if (CMSG_SPACE(datalen) < clen) {
1978 			clen -= CMSG_SPACE(datalen);
1979 			cm = (struct cmsghdr *)
1980 			    ((caddr_t)cm + CMSG_SPACE(datalen));
1981 		} else {
1982 			clen = 0;
1983 			cm = NULL;
1984 		}
1985 	}
1986 
1987 out:
1988 	m_freem(control);
1989 	return (error);
1990 }
1991 
1992 static struct mbuf *
1993 unp_addsockcred(struct thread *td, struct mbuf *control)
1994 {
1995 	struct mbuf *m, *n, *n_prev;
1996 	struct sockcred *sc;
1997 	const struct cmsghdr *cm;
1998 	int ngroups;
1999 	int i;
2000 
2001 	ngroups = MIN(td->td_ucred->cr_ngroups, CMGROUP_MAX);
2002 	m = sbcreatecontrol(NULL, SOCKCREDSIZE(ngroups), SCM_CREDS, SOL_SOCKET);
2003 	if (m == NULL)
2004 		return (control);
2005 
2006 	sc = (struct sockcred *) CMSG_DATA(mtod(m, struct cmsghdr *));
2007 	sc->sc_uid = td->td_ucred->cr_ruid;
2008 	sc->sc_euid = td->td_ucred->cr_uid;
2009 	sc->sc_gid = td->td_ucred->cr_rgid;
2010 	sc->sc_egid = td->td_ucred->cr_gid;
2011 	sc->sc_ngroups = ngroups;
2012 	for (i = 0; i < sc->sc_ngroups; i++)
2013 		sc->sc_groups[i] = td->td_ucred->cr_groups[i];
2014 
2015 	/*
2016 	 * Unlink SCM_CREDS control messages (struct cmsgcred), since just
2017 	 * created SCM_CREDS control message (struct sockcred) has another
2018 	 * format.
2019 	 */
2020 	if (control != NULL)
2021 		for (n = control, n_prev = NULL; n != NULL;) {
2022 			cm = mtod(n, struct cmsghdr *);
2023     			if (cm->cmsg_level == SOL_SOCKET &&
2024 			    cm->cmsg_type == SCM_CREDS) {
2025     				if (n_prev == NULL)
2026 					control = n->m_next;
2027 				else
2028 					n_prev->m_next = n->m_next;
2029 				n = m_free(n);
2030 			} else {
2031 				n_prev = n;
2032 				n = n->m_next;
2033 			}
2034 		}
2035 
2036 	/* Prepend it to the head. */
2037 	m->m_next = control;
2038 	return (m);
2039 }
2040 
2041 static struct unpcb *
2042 fptounp(struct file *fp)
2043 {
2044 	struct socket *so;
2045 
2046 	if (fp->f_type != DTYPE_SOCKET)
2047 		return (NULL);
2048 	if ((so = fp->f_data) == NULL)
2049 		return (NULL);
2050 	if (so->so_proto->pr_domain != &localdomain)
2051 		return (NULL);
2052 	return sotounpcb(so);
2053 }
2054 
2055 static void
2056 unp_discard(struct file *fp)
2057 {
2058 	struct unp_defer *dr;
2059 
2060 	if (unp_externalize_fp(fp)) {
2061 		dr = malloc(sizeof(*dr), M_TEMP, M_WAITOK);
2062 		dr->ud_fp = fp;
2063 		UNP_DEFERRED_LOCK();
2064 		SLIST_INSERT_HEAD(&unp_defers, dr, ud_link);
2065 		UNP_DEFERRED_UNLOCK();
2066 		atomic_add_int(&unp_defers_count, 1);
2067 		taskqueue_enqueue(taskqueue_thread, &unp_defer_task);
2068 	} else
2069 		(void) closef(fp, (struct thread *)NULL);
2070 }
2071 
2072 static void
2073 unp_process_defers(void *arg __unused, int pending)
2074 {
2075 	struct unp_defer *dr;
2076 	SLIST_HEAD(, unp_defer) drl;
2077 	int count;
2078 
2079 	SLIST_INIT(&drl);
2080 	for (;;) {
2081 		UNP_DEFERRED_LOCK();
2082 		if (SLIST_FIRST(&unp_defers) == NULL) {
2083 			UNP_DEFERRED_UNLOCK();
2084 			break;
2085 		}
2086 		SLIST_SWAP(&unp_defers, &drl, unp_defer);
2087 		UNP_DEFERRED_UNLOCK();
2088 		count = 0;
2089 		while ((dr = SLIST_FIRST(&drl)) != NULL) {
2090 			SLIST_REMOVE_HEAD(&drl, ud_link);
2091 			closef(dr->ud_fp, NULL);
2092 			free(dr, M_TEMP);
2093 			count++;
2094 		}
2095 		atomic_add_int(&unp_defers_count, -count);
2096 	}
2097 }
2098 
2099 static void
2100 unp_internalize_fp(struct file *fp)
2101 {
2102 	struct unpcb *unp;
2103 
2104 	UNP_LINK_WLOCK();
2105 	if ((unp = fptounp(fp)) != NULL) {
2106 		unp->unp_file = fp;
2107 		unp->unp_msgcount++;
2108 	}
2109 	fhold(fp);
2110 	unp_rights++;
2111 	UNP_LINK_WUNLOCK();
2112 }
2113 
2114 static int
2115 unp_externalize_fp(struct file *fp)
2116 {
2117 	struct unpcb *unp;
2118 	int ret;
2119 
2120 	UNP_LINK_WLOCK();
2121 	if ((unp = fptounp(fp)) != NULL) {
2122 		unp->unp_msgcount--;
2123 		ret = 1;
2124 	} else
2125 		ret = 0;
2126 	unp_rights--;
2127 	UNP_LINK_WUNLOCK();
2128 	return (ret);
2129 }
2130 
2131 /*
2132  * unp_defer indicates whether additional work has been defered for a future
2133  * pass through unp_gc().  It is thread local and does not require explicit
2134  * synchronization.
2135  */
2136 static int	unp_marked;
2137 static int	unp_unreachable;
2138 
2139 static void
2140 unp_accessable(struct filedescent **fdep, int fdcount)
2141 {
2142 	struct unpcb *unp;
2143 	struct file *fp;
2144 	int i;
2145 
2146 	for (i = 0; i < fdcount; i++) {
2147 		fp = fdep[i]->fde_file;
2148 		if ((unp = fptounp(fp)) == NULL)
2149 			continue;
2150 		if (unp->unp_gcflag & UNPGC_REF)
2151 			continue;
2152 		unp->unp_gcflag &= ~UNPGC_DEAD;
2153 		unp->unp_gcflag |= UNPGC_REF;
2154 		unp_marked++;
2155 	}
2156 }
2157 
2158 static void
2159 unp_gc_process(struct unpcb *unp)
2160 {
2161 	struct socket *soa;
2162 	struct socket *so;
2163 	struct file *fp;
2164 
2165 	/* Already processed. */
2166 	if (unp->unp_gcflag & UNPGC_SCANNED)
2167 		return;
2168 	fp = unp->unp_file;
2169 
2170 	/*
2171 	 * Check for a socket potentially in a cycle.  It must be in a
2172 	 * queue as indicated by msgcount, and this must equal the file
2173 	 * reference count.  Note that when msgcount is 0 the file is NULL.
2174 	 */
2175 	if ((unp->unp_gcflag & UNPGC_REF) == 0 && fp &&
2176 	    unp->unp_msgcount != 0 && fp->f_count == unp->unp_msgcount) {
2177 		unp->unp_gcflag |= UNPGC_DEAD;
2178 		unp_unreachable++;
2179 		return;
2180 	}
2181 
2182 	/*
2183 	 * Mark all sockets we reference with RIGHTS.
2184 	 */
2185 	so = unp->unp_socket;
2186 	SOCKBUF_LOCK(&so->so_rcv);
2187 	unp_scan(so->so_rcv.sb_mb, unp_accessable);
2188 	SOCKBUF_UNLOCK(&so->so_rcv);
2189 
2190 	/*
2191 	 * Mark all sockets in our accept queue.
2192 	 */
2193 	ACCEPT_LOCK();
2194 	TAILQ_FOREACH(soa, &so->so_comp, so_list) {
2195 		SOCKBUF_LOCK(&soa->so_rcv);
2196 		unp_scan(soa->so_rcv.sb_mb, unp_accessable);
2197 		SOCKBUF_UNLOCK(&soa->so_rcv);
2198 	}
2199 	ACCEPT_UNLOCK();
2200 	unp->unp_gcflag |= UNPGC_SCANNED;
2201 }
2202 
2203 static int unp_recycled;
2204 SYSCTL_INT(_net_local, OID_AUTO, recycled, CTLFLAG_RD, &unp_recycled, 0,
2205     "Number of unreachable sockets claimed by the garbage collector.");
2206 
2207 static int unp_taskcount;
2208 SYSCTL_INT(_net_local, OID_AUTO, taskcount, CTLFLAG_RD, &unp_taskcount, 0,
2209     "Number of times the garbage collector has run.");
2210 
2211 static void
2212 unp_gc(__unused void *arg, int pending)
2213 {
2214 	struct unp_head *heads[] = { &unp_dhead, &unp_shead, &unp_sphead,
2215 				    NULL };
2216 	struct unp_head **head;
2217 	struct file *f, **unref;
2218 	struct unpcb *unp;
2219 	int i, total;
2220 
2221 	unp_taskcount++;
2222 	UNP_LIST_LOCK();
2223 	/*
2224 	 * First clear all gc flags from previous runs.
2225 	 */
2226 	for (head = heads; *head != NULL; head++)
2227 		LIST_FOREACH(unp, *head, unp_link)
2228 			unp->unp_gcflag = 0;
2229 
2230 	/*
2231 	 * Scan marking all reachable sockets with UNPGC_REF.  Once a socket
2232 	 * is reachable all of the sockets it references are reachable.
2233 	 * Stop the scan once we do a complete loop without discovering
2234 	 * a new reachable socket.
2235 	 */
2236 	do {
2237 		unp_unreachable = 0;
2238 		unp_marked = 0;
2239 		for (head = heads; *head != NULL; head++)
2240 			LIST_FOREACH(unp, *head, unp_link)
2241 				unp_gc_process(unp);
2242 	} while (unp_marked);
2243 	UNP_LIST_UNLOCK();
2244 	if (unp_unreachable == 0)
2245 		return;
2246 
2247 	/*
2248 	 * Allocate space for a local list of dead unpcbs.
2249 	 */
2250 	unref = malloc(unp_unreachable * sizeof(struct file *),
2251 	    M_TEMP, M_WAITOK);
2252 
2253 	/*
2254 	 * Iterate looking for sockets which have been specifically marked
2255 	 * as as unreachable and store them locally.
2256 	 */
2257 	UNP_LINK_RLOCK();
2258 	UNP_LIST_LOCK();
2259 	for (total = 0, head = heads; *head != NULL; head++)
2260 		LIST_FOREACH(unp, *head, unp_link)
2261 			if ((unp->unp_gcflag & UNPGC_DEAD) != 0) {
2262 				f = unp->unp_file;
2263 				if (unp->unp_msgcount == 0 || f == NULL ||
2264 				    f->f_count != unp->unp_msgcount)
2265 					continue;
2266 				unref[total++] = f;
2267 				fhold(f);
2268 				KASSERT(total <= unp_unreachable,
2269 				    ("unp_gc: incorrect unreachable count."));
2270 			}
2271 	UNP_LIST_UNLOCK();
2272 	UNP_LINK_RUNLOCK();
2273 
2274 	/*
2275 	 * Now flush all sockets, free'ing rights.  This will free the
2276 	 * struct files associated with these sockets but leave each socket
2277 	 * with one remaining ref.
2278 	 */
2279 	for (i = 0; i < total; i++) {
2280 		struct socket *so;
2281 
2282 		so = unref[i]->f_data;
2283 		CURVNET_SET(so->so_vnet);
2284 		sorflush(so);
2285 		CURVNET_RESTORE();
2286 	}
2287 
2288 	/*
2289 	 * And finally release the sockets so they can be reclaimed.
2290 	 */
2291 	for (i = 0; i < total; i++)
2292 		fdrop(unref[i], NULL);
2293 	unp_recycled += total;
2294 	free(unref, M_TEMP);
2295 }
2296 
2297 static void
2298 unp_dispose(struct mbuf *m)
2299 {
2300 
2301 	if (m)
2302 		unp_scan(m, unp_freerights);
2303 }
2304 
2305 static void
2306 unp_scan(struct mbuf *m0, void (*op)(struct filedescent **, int))
2307 {
2308 	struct mbuf *m;
2309 	struct cmsghdr *cm;
2310 	void *data;
2311 	socklen_t clen, datalen;
2312 
2313 	while (m0 != NULL) {
2314 		for (m = m0; m; m = m->m_next) {
2315 			if (m->m_type != MT_CONTROL)
2316 				continue;
2317 
2318 			cm = mtod(m, struct cmsghdr *);
2319 			clen = m->m_len;
2320 
2321 			while (cm != NULL) {
2322 				if (sizeof(*cm) > clen || cm->cmsg_len > clen)
2323 					break;
2324 
2325 				data = CMSG_DATA(cm);
2326 				datalen = (caddr_t)cm + cm->cmsg_len
2327 				    - (caddr_t)data;
2328 
2329 				if (cm->cmsg_level == SOL_SOCKET &&
2330 				    cm->cmsg_type == SCM_RIGHTS) {
2331 					(*op)(data, datalen /
2332 					    sizeof(struct filedescent *));
2333 				}
2334 
2335 				if (CMSG_SPACE(datalen) < clen) {
2336 					clen -= CMSG_SPACE(datalen);
2337 					cm = (struct cmsghdr *)
2338 					    ((caddr_t)cm + CMSG_SPACE(datalen));
2339 				} else {
2340 					clen = 0;
2341 					cm = NULL;
2342 				}
2343 			}
2344 		}
2345 		m0 = m0->m_act;
2346 	}
2347 }
2348 
2349 /*
2350  * A helper function called by VFS before socket-type vnode reclamation.
2351  * For an active vnode it clears unp_vnode pointer and decrements unp_vnode
2352  * use count.
2353  */
2354 void
2355 vfs_unp_reclaim(struct vnode *vp)
2356 {
2357 	struct socket *so;
2358 	struct unpcb *unp;
2359 	int active;
2360 
2361 	ASSERT_VOP_ELOCKED(vp, "vfs_unp_reclaim");
2362 	KASSERT(vp->v_type == VSOCK,
2363 	    ("vfs_unp_reclaim: vp->v_type != VSOCK"));
2364 
2365 	active = 0;
2366 	UNP_LINK_WLOCK();
2367 	VOP_UNP_CONNECT(vp, &so);
2368 	if (so == NULL)
2369 		goto done;
2370 	unp = sotounpcb(so);
2371 	if (unp == NULL)
2372 		goto done;
2373 	UNP_PCB_LOCK(unp);
2374 	if (unp->unp_vnode == vp) {
2375 		VOP_UNP_DETACH(vp);
2376 		unp->unp_vnode = NULL;
2377 		active = 1;
2378 	}
2379 	UNP_PCB_UNLOCK(unp);
2380 done:
2381 	UNP_LINK_WUNLOCK();
2382 	if (active)
2383 		vunref(vp);
2384 }
2385 
2386 #ifdef DDB
2387 static void
2388 db_print_indent(int indent)
2389 {
2390 	int i;
2391 
2392 	for (i = 0; i < indent; i++)
2393 		db_printf(" ");
2394 }
2395 
2396 static void
2397 db_print_unpflags(int unp_flags)
2398 {
2399 	int comma;
2400 
2401 	comma = 0;
2402 	if (unp_flags & UNP_HAVEPC) {
2403 		db_printf("%sUNP_HAVEPC", comma ? ", " : "");
2404 		comma = 1;
2405 	}
2406 	if (unp_flags & UNP_HAVEPCCACHED) {
2407 		db_printf("%sUNP_HAVEPCCACHED", comma ? ", " : "");
2408 		comma = 1;
2409 	}
2410 	if (unp_flags & UNP_WANTCRED) {
2411 		db_printf("%sUNP_WANTCRED", comma ? ", " : "");
2412 		comma = 1;
2413 	}
2414 	if (unp_flags & UNP_CONNWAIT) {
2415 		db_printf("%sUNP_CONNWAIT", comma ? ", " : "");
2416 		comma = 1;
2417 	}
2418 	if (unp_flags & UNP_CONNECTING) {
2419 		db_printf("%sUNP_CONNECTING", comma ? ", " : "");
2420 		comma = 1;
2421 	}
2422 	if (unp_flags & UNP_BINDING) {
2423 		db_printf("%sUNP_BINDING", comma ? ", " : "");
2424 		comma = 1;
2425 	}
2426 }
2427 
2428 static void
2429 db_print_xucred(int indent, struct xucred *xu)
2430 {
2431 	int comma, i;
2432 
2433 	db_print_indent(indent);
2434 	db_printf("cr_version: %u   cr_uid: %u   cr_ngroups: %d\n",
2435 	    xu->cr_version, xu->cr_uid, xu->cr_ngroups);
2436 	db_print_indent(indent);
2437 	db_printf("cr_groups: ");
2438 	comma = 0;
2439 	for (i = 0; i < xu->cr_ngroups; i++) {
2440 		db_printf("%s%u", comma ? ", " : "", xu->cr_groups[i]);
2441 		comma = 1;
2442 	}
2443 	db_printf("\n");
2444 }
2445 
2446 static void
2447 db_print_unprefs(int indent, struct unp_head *uh)
2448 {
2449 	struct unpcb *unp;
2450 	int counter;
2451 
2452 	counter = 0;
2453 	LIST_FOREACH(unp, uh, unp_reflink) {
2454 		if (counter % 4 == 0)
2455 			db_print_indent(indent);
2456 		db_printf("%p  ", unp);
2457 		if (counter % 4 == 3)
2458 			db_printf("\n");
2459 		counter++;
2460 	}
2461 	if (counter != 0 && counter % 4 != 0)
2462 		db_printf("\n");
2463 }
2464 
2465 DB_SHOW_COMMAND(unpcb, db_show_unpcb)
2466 {
2467 	struct unpcb *unp;
2468 
2469         if (!have_addr) {
2470                 db_printf("usage: show unpcb <addr>\n");
2471                 return;
2472         }
2473         unp = (struct unpcb *)addr;
2474 
2475 	db_printf("unp_socket: %p   unp_vnode: %p\n", unp->unp_socket,
2476 	    unp->unp_vnode);
2477 
2478 	db_printf("unp_ino: %ju   unp_conn: %p\n", (uintmax_t)unp->unp_ino,
2479 	    unp->unp_conn);
2480 
2481 	db_printf("unp_refs:\n");
2482 	db_print_unprefs(2, &unp->unp_refs);
2483 
2484 	/* XXXRW: Would be nice to print the full address, if any. */
2485 	db_printf("unp_addr: %p\n", unp->unp_addr);
2486 
2487 	db_printf("unp_gencnt: %llu\n",
2488 	    (unsigned long long)unp->unp_gencnt);
2489 
2490 	db_printf("unp_flags: %x (", unp->unp_flags);
2491 	db_print_unpflags(unp->unp_flags);
2492 	db_printf(")\n");
2493 
2494 	db_printf("unp_peercred:\n");
2495 	db_print_xucred(2, &unp->unp_peercred);
2496 
2497 	db_printf("unp_refcount: %u\n", unp->unp_refcount);
2498 }
2499 #endif
2500