The Design and Implementation of the FreeBSD Operating System, Second Edition
Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]

FreeBSD/Linux Kernel Cross Reference
sys/kern/uipc_usrreq.c

Version: -  FREEBSD  -  FREEBSD-12-STABLE  -  FREEBSD-12-0  -  FREEBSD-11-STABLE  -  FREEBSD-11-2  -  FREEBSD-11-1  -  FREEBSD-11-0  -  FREEBSD-10-STABLE  -  FREEBSD-10-4  -  FREEBSD-10-3  -  FREEBSD-10-2  -  FREEBSD-10-1  -  FREEBSD-10-0  -  FREEBSD-9-STABLE  -  FREEBSD-9-3  -  FREEBSD-9-2  -  FREEBSD-9-1  -  FREEBSD-9-0  -  FREEBSD-8-STABLE  -  FREEBSD-8-4  -  FREEBSD-8-3  -  FREEBSD-8-2  -  FREEBSD-8-1  -  FREEBSD-8-0  -  FREEBSD-7-STABLE  -  FREEBSD-7-4  -  FREEBSD-7-3  -  FREEBSD-7-2  -  FREEBSD-7-1  -  FREEBSD-7-0  -  FREEBSD-6-STABLE  -  FREEBSD-6-4  -  FREEBSD-6-3  -  FREEBSD-6-2  -  FREEBSD-6-1  -  FREEBSD-6-0  -  FREEBSD-5-STABLE  -  FREEBSD-5-5  -  FREEBSD-5-4  -  FREEBSD-5-3  -  FREEBSD-5-2  -  FREEBSD-5-1  -  FREEBSD-5-0  -  FREEBSD-4-STABLE  -  FREEBSD-3-STABLE  -  FREEBSD22  -  linux-2.6  -  linux-2.4.22  -  MK83  -  MK84  -  PLAN9  -  DFBSD  -  NETBSD  -  NETBSD5  -  NETBSD4  -  NETBSD3  -  NETBSD20  -  OPENBSD  -  xnu-517  -  xnu-792  -  xnu-792.6.70  -  xnu-1228  -  xnu-1456.1.26  -  xnu-1699.24.8  -  xnu-2050.18.24  -  OPENSOLARIS  -  minix-3-1-1 
SearchContext: -  none  -  3  -  10 

    1 /*      $NetBSD: uipc_usrreq.c,v 1.74.2.1 2005/07/18 04:03:05 riz Exp $ */
    2 
    3 /*-
    4  * Copyright (c) 1998, 2000 The NetBSD Foundation, Inc.
    5  * All rights reserved.
    6  *
    7  * This code is derived from software contributed to The NetBSD Foundation
    8  * by Jason R. Thorpe of the Numerical Aerospace Simulation Facility,
    9  * NASA Ames Research Center.
   10  *
   11  * Redistribution and use in source and binary forms, with or without
   12  * modification, are permitted provided that the following conditions
   13  * are met:
   14  * 1. Redistributions of source code must retain the above copyright
   15  *    notice, this list of conditions and the following disclaimer.
   16  * 2. Redistributions in binary form must reproduce the above copyright
   17  *    notice, this list of conditions and the following disclaimer in the
   18  *    documentation and/or other materials provided with the distribution.
   19  * 3. All advertising materials mentioning features or use of this software
   20  *    must display the following acknowledgement:
   21  *      This product includes software developed by the NetBSD
   22  *      Foundation, Inc. and its contributors.
   23  * 4. Neither the name of The NetBSD Foundation nor the names of its
   24  *    contributors may be used to endorse or promote products derived
   25  *    from this software without specific prior written permission.
   26  *
   27  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
   28  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
   29  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
   30  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
   31  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
   32  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
   33  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
   34  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
   35  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
   36  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
   37  * POSSIBILITY OF SUCH DAMAGE.
   38  */
   39 
   40 /*
   41  * Copyright (c) 1982, 1986, 1989, 1991, 1993
   42  *      The Regents of the University of California.  All rights reserved.
   43  *
   44  * Redistribution and use in source and binary forms, with or without
   45  * modification, are permitted provided that the following conditions
   46  * are met:
   47  * 1. Redistributions of source code must retain the above copyright
   48  *    notice, this list of conditions and the following disclaimer.
   49  * 2. Redistributions in binary form must reproduce the above copyright
   50  *    notice, this list of conditions and the following disclaimer in the
   51  *    documentation and/or other materials provided with the distribution.
   52  * 3. Neither the name of the University nor the names of its contributors
   53  *    may be used to endorse or promote products derived from this software
   54  *    without specific prior written permission.
   55  *
   56  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
   57  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
   58  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
   59  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
   60  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
   61  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
   62  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
   63  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
   64  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
   65  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
   66  * SUCH DAMAGE.
   67  *
   68  *      @(#)uipc_usrreq.c       8.9 (Berkeley) 5/14/95
   69  */
   70 
   71 /*
   72  * Copyright (c) 1997 Christopher G. Demetriou.  All rights reserved.
   73  *
   74  * Redistribution and use in source and binary forms, with or without
   75  * modification, are permitted provided that the following conditions
   76  * are met:
   77  * 1. Redistributions of source code must retain the above copyright
   78  *    notice, this list of conditions and the following disclaimer.
   79  * 2. Redistributions in binary form must reproduce the above copyright
   80  *    notice, this list of conditions and the following disclaimer in the
   81  *    documentation and/or other materials provided with the distribution.
   82  * 3. All advertising materials mentioning features or use of this software
   83  *    must display the following acknowledgement:
   84  *      This product includes software developed by the University of
   85  *      California, Berkeley and its contributors.
   86  * 4. Neither the name of the University nor the names of its contributors
   87  *    may be used to endorse or promote products derived from this software
   88  *    without specific prior written permission.
   89  *
   90  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
   91  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
   92  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
   93  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
   94  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
   95  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
   96  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
   97  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
   98  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
   99  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  100  * SUCH DAMAGE.
  101  *
  102  *      @(#)uipc_usrreq.c       8.9 (Berkeley) 5/14/95
  103  */
  104 
  105 #include <sys/cdefs.h>
  106 __KERNEL_RCSID(0, "$NetBSD: uipc_usrreq.c,v 1.74.2.1 2005/07/18 04:03:05 riz Exp $");
  107 
  108 #include <sys/param.h>
  109 #include <sys/systm.h>
  110 #include <sys/proc.h>
  111 #include <sys/filedesc.h>
  112 #include <sys/domain.h>
  113 #include <sys/protosw.h>
  114 #include <sys/socket.h>
  115 #include <sys/socketvar.h>
  116 #include <sys/unpcb.h>
  117 #include <sys/un.h>
  118 #include <sys/namei.h>
  119 #include <sys/vnode.h>
  120 #include <sys/file.h>
  121 #include <sys/stat.h>
  122 #include <sys/mbuf.h>
  123 
  124 /*
  125  * Unix communications domain.
  126  *
  127  * TODO:
  128  *      SEQPACKET, RDM
  129  *      rethink name space problems
  130  *      need a proper out-of-band
  131  */
  132 struct  sockaddr_un sun_noname = { sizeof(sun_noname), AF_LOCAL };
  133 ino_t   unp_ino;                        /* prototype for fake inode numbers */
  134 
  135 struct mbuf *unp_addsockcred(struct proc *, struct mbuf *);
  136 
  137 int
  138 unp_output(m, control, unp, p)
  139         struct mbuf *m, *control;
  140         struct unpcb *unp;
  141         struct proc *p;
  142 {
  143         struct socket *so2;
  144         struct sockaddr_un *sun;
  145 
  146         so2 = unp->unp_conn->unp_socket;
  147         if (unp->unp_addr)
  148                 sun = unp->unp_addr;
  149         else
  150                 sun = &sun_noname;
  151         if (unp->unp_conn->unp_flags & UNP_WANTCRED)
  152                 control = unp_addsockcred(p, control);
  153         if (sbappendaddr(&so2->so_rcv, (struct sockaddr *)sun, m,
  154             control) == 0) {
  155                 m_freem(control);
  156                 m_freem(m);
  157                 return (ENOBUFS);
  158         } else {
  159                 sorwakeup(so2);
  160                 return (0);
  161         }
  162 }
  163 
  164 void
  165 unp_setsockaddr(unp, nam)
  166         struct unpcb *unp;
  167         struct mbuf *nam;
  168 {
  169         struct sockaddr_un *sun;
  170 
  171         if (unp->unp_addr)
  172                 sun = unp->unp_addr;
  173         else
  174                 sun = &sun_noname;
  175         nam->m_len = sun->sun_len;
  176         if (nam->m_len > MLEN)
  177                 MEXTMALLOC(nam, nam->m_len, M_WAITOK);
  178         memcpy(mtod(nam, caddr_t), sun, (size_t)nam->m_len);
  179 }
  180 
  181 void
  182 unp_setpeeraddr(unp, nam)
  183         struct unpcb *unp;
  184         struct mbuf *nam;
  185 {
  186         struct sockaddr_un *sun;
  187 
  188         if (unp->unp_conn && unp->unp_conn->unp_addr)
  189                 sun = unp->unp_conn->unp_addr;
  190         else
  191                 sun = &sun_noname;
  192         nam->m_len = sun->sun_len;
  193         if (nam->m_len > MLEN)
  194                 MEXTMALLOC(nam, nam->m_len, M_WAITOK);
  195         memcpy(mtod(nam, caddr_t), sun, (size_t)nam->m_len);
  196 }
  197 
  198 /*ARGSUSED*/
  199 int
  200 uipc_usrreq(so, req, m, nam, control, p)
  201         struct socket *so;
  202         int req;
  203         struct mbuf *m, *nam, *control;
  204         struct proc *p;
  205 {
  206         struct unpcb *unp = sotounpcb(so);
  207         struct socket *so2;
  208         int error = 0;
  209 
  210         if (req == PRU_CONTROL)
  211                 return (EOPNOTSUPP);
  212 
  213 #ifdef DIAGNOSTIC
  214         if (req != PRU_SEND && req != PRU_SENDOOB && control)
  215                 panic("uipc_usrreq: unexpected control mbuf");
  216 #endif
  217         if (unp == 0 && req != PRU_ATTACH) {
  218                 error = EINVAL;
  219                 goto release;
  220         }
  221 
  222         switch (req) {
  223 
  224         case PRU_ATTACH:
  225                 if (unp != 0) {
  226                         error = EISCONN;
  227                         break;
  228                 }
  229                 error = unp_attach(so);
  230                 break;
  231 
  232         case PRU_DETACH:
  233                 unp_detach(unp);
  234                 break;
  235 
  236         case PRU_BIND:
  237                 error = unp_bind(unp, nam, p);
  238                 break;
  239 
  240         case PRU_LISTEN:
  241                 if (unp->unp_vnode == 0)
  242                         error = EINVAL;
  243                 break;
  244 
  245         case PRU_CONNECT:
  246                 error = unp_connect(so, nam, p);
  247                 break;
  248 
  249         case PRU_CONNECT2:
  250                 error = unp_connect2(so, (struct socket *)nam, PRU_CONNECT2);
  251                 break;
  252 
  253         case PRU_DISCONNECT:
  254                 unp_disconnect(unp);
  255                 break;
  256 
  257         case PRU_ACCEPT:
  258                 unp_setpeeraddr(unp, nam);
  259                 /*
  260                  * Mark the initiating STREAM socket as connected *ONLY*
  261                  * after it's been accepted.  This prevents a client from
  262                  * overrunning a server and receiving ECONNREFUSED.
  263                  */
  264                 if (unp->unp_conn != NULL &&
  265                     (unp->unp_conn->unp_socket->so_state & SS_ISCONNECTING))
  266                         soisconnected(unp->unp_conn->unp_socket);
  267                 break;
  268 
  269         case PRU_SHUTDOWN:
  270                 socantsendmore(so);
  271                 unp_shutdown(unp);
  272                 break;
  273 
  274         case PRU_RCVD:
  275                 switch (so->so_type) {
  276 
  277                 case SOCK_DGRAM:
  278                         panic("uipc 1");
  279                         /*NOTREACHED*/
  280 
  281                 case SOCK_STREAM:
  282 #define rcv (&so->so_rcv)
  283 #define snd (&so2->so_snd)
  284                         if (unp->unp_conn == 0)
  285                                 break;
  286                         so2 = unp->unp_conn->unp_socket;
  287                         /*
  288                          * Adjust backpressure on sender
  289                          * and wakeup any waiting to write.
  290                          */
  291                         snd->sb_mbmax += unp->unp_mbcnt - rcv->sb_mbcnt;
  292                         unp->unp_mbcnt = rcv->sb_mbcnt;
  293                         snd->sb_hiwat += unp->unp_cc - rcv->sb_cc;
  294                         unp->unp_cc = rcv->sb_cc;
  295                         sowwakeup(so2);
  296 #undef snd
  297 #undef rcv
  298                         break;
  299 
  300                 default:
  301                         panic("uipc 2");
  302                 }
  303                 break;
  304 
  305         case PRU_SEND:
  306                 /*
  307                  * Note: unp_internalize() rejects any control message
  308                  * other than SCM_RIGHTS, and only allows one.  This
  309                  * has the side-effect of preventing a caller from
  310                  * forging SCM_CREDS.
  311                  */
  312                 if (control && (error = unp_internalize(control, p))) {
  313                         goto die;
  314                 }
  315                 switch (so->so_type) {
  316 
  317                 case SOCK_DGRAM: {
  318                         if (nam) {
  319                                 if ((so->so_state & SS_ISCONNECTED) != 0) {
  320                                         error = EISCONN;
  321                                         goto die;
  322                                 }
  323                                 error = unp_connect(so, nam, p);
  324                                 if (error) {
  325                                 die:
  326                                         m_freem(control);
  327                                         m_freem(m);
  328                                         break;
  329                                 }
  330                         } else {
  331                                 if ((so->so_state & SS_ISCONNECTED) == 0) {
  332                                         error = ENOTCONN;
  333                                         goto die;
  334                                 }
  335                         }
  336                         error = unp_output(m, control, unp, p);
  337                         if (nam)
  338                                 unp_disconnect(unp);
  339                         break;
  340                 }
  341 
  342                 case SOCK_STREAM:
  343 #define rcv (&so2->so_rcv)
  344 #define snd (&so->so_snd)
  345                         if (unp->unp_conn == 0)
  346                                 panic("uipc 3");
  347                         so2 = unp->unp_conn->unp_socket;
  348                         if (unp->unp_conn->unp_flags & UNP_WANTCRED) {
  349                                 /*
  350                                  * Credentials are passed only once on
  351                                  * SOCK_STREAM.
  352                                  */
  353                                 unp->unp_conn->unp_flags &= ~UNP_WANTCRED;
  354                                 control = unp_addsockcred(p, control);
  355                         }
  356                         /*
  357                          * Send to paired receive port, and then reduce
  358                          * send buffer hiwater marks to maintain backpressure.
  359                          * Wake up readers.
  360                          */
  361                         if (control) {
  362                                 if (sbappendcontrol(rcv, m, control) == 0)
  363                                         m_freem(control);
  364                         } else
  365                                 sbappend(rcv, m);
  366                         snd->sb_mbmax -=
  367                             rcv->sb_mbcnt - unp->unp_conn->unp_mbcnt;
  368                         unp->unp_conn->unp_mbcnt = rcv->sb_mbcnt;
  369                         snd->sb_hiwat -= rcv->sb_cc - unp->unp_conn->unp_cc;
  370                         unp->unp_conn->unp_cc = rcv->sb_cc;
  371                         sorwakeup(so2);
  372 #undef snd
  373 #undef rcv
  374                         break;
  375 
  376                 default:
  377                         panic("uipc 4");
  378                 }
  379                 break;
  380 
  381         case PRU_ABORT:
  382                 unp_drop(unp, ECONNABORTED);
  383 
  384 #ifdef DIAGNOSTIC
  385                 if (so->so_pcb == 0)
  386                         panic("uipc 5: drop killed pcb");
  387 #endif
  388                 unp_detach(unp);
  389                 break;
  390 
  391         case PRU_SENSE:
  392                 ((struct stat *) m)->st_blksize = so->so_snd.sb_hiwat;
  393                 if (so->so_type == SOCK_STREAM && unp->unp_conn != 0) {
  394                         so2 = unp->unp_conn->unp_socket;
  395                         ((struct stat *) m)->st_blksize += so2->so_rcv.sb_cc;
  396                 }
  397                 ((struct stat *) m)->st_dev = NODEV;
  398                 if (unp->unp_ino == 0)
  399                         unp->unp_ino = unp_ino++;
  400                 ((struct stat *) m)->st_atimespec =
  401                     ((struct stat *) m)->st_mtimespec =
  402                     ((struct stat *) m)->st_ctimespec = unp->unp_ctime;
  403                 ((struct stat *) m)->st_ino = unp->unp_ino;
  404                 return (0);
  405 
  406         case PRU_RCVOOB:
  407                 error = EOPNOTSUPP;
  408                 break;
  409 
  410         case PRU_SENDOOB:
  411                 m_freem(control);
  412                 m_freem(m);
  413                 error = EOPNOTSUPP;
  414                 break;
  415 
  416         case PRU_SOCKADDR:
  417                 unp_setsockaddr(unp, nam);
  418                 break;
  419 
  420         case PRU_PEERADDR:
  421                 unp_setpeeraddr(unp, nam);
  422                 break;
  423 
  424         default:
  425                 panic("piusrreq");
  426         }
  427 
  428 release:
  429         return (error);
  430 }
  431 
  432 /*
  433  * Unix domain socket option processing.
  434  */
  435 int
  436 uipc_ctloutput(op, so, level, optname, mp)
  437         int op;
  438         struct socket *so;
  439         int level, optname;
  440         struct mbuf **mp;
  441 {
  442         struct unpcb *unp = sotounpcb(so);
  443         struct mbuf *m = *mp;
  444         int optval = 0, error = 0;
  445 
  446         if (level != 0) {
  447                 error = EINVAL;
  448                 if (op == PRCO_SETOPT && m)
  449                         (void) m_free(m);
  450         } else switch (op) {
  451 
  452         case PRCO_SETOPT:
  453                 switch (optname) {
  454                 case LOCAL_CREDS:
  455                 case LOCAL_CONNWAIT:
  456                         if (m == NULL || m->m_len != sizeof(int))
  457                                 error = EINVAL;
  458                         else {
  459                                 optval = *mtod(m, int *);
  460                                 switch (optname) {
  461 #define OPTSET(bit) \
  462         if (optval) \
  463                 unp->unp_flags |= (bit); \
  464         else \
  465                 unp->unp_flags &= ~(bit);
  466 
  467                                 case LOCAL_CREDS:
  468                                         OPTSET(UNP_WANTCRED);
  469                                         break;
  470                                 case LOCAL_CONNWAIT:
  471                                         OPTSET(UNP_CONNWAIT);
  472                                         break;
  473                                 }
  474                         }
  475                         break;
  476 #undef OPTSET
  477 
  478                 default:
  479                         error = ENOPROTOOPT;
  480                         break;
  481                 }
  482                 if (m)
  483                         (void) m_free(m);
  484                 break;
  485 
  486         case PRCO_GETOPT:
  487                 switch (optname) {
  488                 case LOCAL_CREDS:
  489                         *mp = m = m_get(M_WAIT, MT_SOOPTS);
  490                         m->m_len = sizeof(int);
  491                         switch (optname) {
  492 
  493 #define OPTBIT(bit)     (unp->unp_flags & (bit) ? 1 : 0)
  494 
  495                         case LOCAL_CREDS:
  496                                 optval = OPTBIT(UNP_WANTCRED);
  497                                 break;
  498                         }
  499                         *mtod(m, int *) = optval;
  500                         break;
  501 #undef OPTBIT
  502 
  503                 default:
  504                         error = ENOPROTOOPT;
  505                         break;
  506                 }
  507                 break;
  508         }
  509         return (error);
  510 }
  511 
  512 /*
  513  * Both send and receive buffers are allocated PIPSIZ bytes of buffering
  514  * for stream sockets, although the total for sender and receiver is
  515  * actually only PIPSIZ.
  516  * Datagram sockets really use the sendspace as the maximum datagram size,
  517  * and don't really want to reserve the sendspace.  Their recvspace should
  518  * be large enough for at least one max-size datagram plus address.
  519  */
  520 #define PIPSIZ  4096
  521 u_long  unpst_sendspace = PIPSIZ;
  522 u_long  unpst_recvspace = PIPSIZ;
  523 u_long  unpdg_sendspace = 2*1024;       /* really max datagram size */
  524 u_long  unpdg_recvspace = 4*1024;
  525 
  526 int     unp_rights;                     /* file descriptors in flight */
  527 
  528 int
  529 unp_attach(so)
  530         struct socket *so;
  531 {
  532         struct unpcb *unp;
  533         struct timeval tv;
  534         int error;
  535         
  536         if (so->so_snd.sb_hiwat == 0 || so->so_rcv.sb_hiwat == 0) {
  537                 switch (so->so_type) {
  538 
  539                 case SOCK_STREAM:
  540                         error = soreserve(so, unpst_sendspace, unpst_recvspace);
  541                         break;
  542 
  543                 case SOCK_DGRAM:
  544                         error = soreserve(so, unpdg_sendspace, unpdg_recvspace);
  545                         break;
  546 
  547                 default:
  548                         panic("unp_attach");
  549                 }
  550                 if (error)
  551                         return (error);
  552         }
  553         unp = malloc(sizeof(*unp), M_PCB, M_NOWAIT);
  554         if (unp == NULL)
  555                 return (ENOBUFS);
  556         memset((caddr_t)unp, 0, sizeof(*unp));
  557         unp->unp_socket = so;
  558         so->so_pcb = unp;
  559         microtime(&tv);
  560         TIMEVAL_TO_TIMESPEC(&tv, &unp->unp_ctime);
  561         return (0);
  562 }
  563 
  564 void
  565 unp_detach(unp)
  566         struct unpcb *unp;
  567 {
  568         
  569         if (unp->unp_vnode) {
  570                 unp->unp_vnode->v_socket = 0;
  571                 vrele(unp->unp_vnode);
  572                 unp->unp_vnode = 0;
  573         }
  574         if (unp->unp_conn)
  575                 unp_disconnect(unp);
  576         while (unp->unp_refs)
  577                 unp_drop(unp->unp_refs, ECONNRESET);
  578         soisdisconnected(unp->unp_socket);
  579         unp->unp_socket->so_pcb = 0;
  580         if (unp->unp_addr)
  581                 free(unp->unp_addr, M_SONAME);
  582         if (unp_rights) {
  583                 /*
  584                  * Normally the receive buffer is flushed later,
  585                  * in sofree, but if our receive buffer holds references
  586                  * to descriptors that are now garbage, we will dispose
  587                  * of those descriptor references after the garbage collector
  588                  * gets them (resulting in a "panic: closef: count < 0").
  589                  */
  590                 sorflush(unp->unp_socket);
  591                 free(unp, M_PCB);
  592                 unp_gc();
  593         } else
  594                 free(unp, M_PCB);
  595 }
  596 
  597 int
  598 unp_bind(unp, nam, p)
  599         struct unpcb *unp;
  600         struct mbuf *nam;
  601         struct proc *p;
  602 {
  603         struct sockaddr_un *sun;
  604         struct vnode *vp;
  605         struct mount *mp;
  606         struct vattr vattr;
  607         size_t addrlen;
  608         int error;
  609         struct nameidata nd;
  610 
  611         if (unp->unp_vnode != 0)
  612                 return (EINVAL);
  613 
  614         /*
  615          * Allocate the new sockaddr.  We have to allocate one
  616          * extra byte so that we can ensure that the pathname
  617          * is nul-terminated.
  618          */
  619         addrlen = nam->m_len + 1;
  620         sun = malloc(addrlen, M_SONAME, M_WAITOK);
  621         m_copydata(nam, 0, nam->m_len, (caddr_t)sun);
  622         *(((char *)sun) + nam->m_len) = '\0';
  623 
  624 restart:
  625         NDINIT(&nd, CREATE, FOLLOW | LOCKPARENT, UIO_SYSSPACE,
  626             sun->sun_path, p);
  627 
  628 /* SHOULD BE ABLE TO ADOPT EXISTING AND wakeup() ALA FIFO's */
  629         if ((error = namei(&nd)) != 0)
  630                 goto bad;
  631         vp = nd.ni_vp;
  632         if (vp != NULL || vn_start_write(nd.ni_dvp, &mp, V_NOWAIT) != 0) {
  633                 VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
  634                 if (nd.ni_dvp == vp)
  635                         vrele(nd.ni_dvp);
  636                 else
  637                         vput(nd.ni_dvp);
  638                 vrele(vp);
  639                 if (vp != NULL) {
  640                         error = EADDRINUSE;
  641                         goto bad;
  642                 }
  643                 error = vn_start_write(NULL, &mp,
  644                     V_WAIT | V_SLEEPONLY | V_PCATCH);
  645                 if (error)
  646                         goto bad;
  647                 goto restart;
  648         }
  649         VATTR_NULL(&vattr);
  650         vattr.va_type = VSOCK;
  651         vattr.va_mode = ACCESSPERMS;
  652         VOP_LEASE(nd.ni_dvp, p, p->p_ucred, LEASE_WRITE);
  653         error = VOP_CREATE(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd, &vattr);
  654         vn_finished_write(mp, 0);
  655         if (error)
  656                 goto bad;
  657         vp = nd.ni_vp;
  658         vp->v_socket = unp->unp_socket;
  659         unp->unp_vnode = vp;
  660         unp->unp_addrlen = addrlen;
  661         unp->unp_addr = sun;
  662         VOP_UNLOCK(vp, 0);
  663         return (0);
  664 
  665  bad:
  666         free(sun, M_SONAME);
  667         return (error);
  668 }
  669 
  670 int
  671 unp_connect(so, nam, p)
  672         struct socket *so;
  673         struct mbuf *nam;
  674         struct proc *p;
  675 {
  676         struct sockaddr_un *sun;
  677         struct vnode *vp;
  678         struct socket *so2, *so3;
  679         struct unpcb *unp2, *unp3;
  680         size_t addrlen;
  681         int error;
  682         struct nameidata nd;
  683 
  684         /*
  685          * Allocate a temporary sockaddr.  We have to allocate one extra
  686          * byte so that we can ensure that the pathname is nul-terminated.
  687          * When we establish the connection, we copy the other PCB's
  688          * sockaddr to our own.
  689          */
  690         addrlen = nam->m_len + 1;
  691         sun = malloc(addrlen, M_SONAME, M_WAITOK);
  692         m_copydata(nam, 0, nam->m_len, (caddr_t)sun);
  693         *(((char *)sun) + nam->m_len) = '\0';
  694 
  695         NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF, UIO_SYSSPACE, sun->sun_path, p);
  696 
  697         if ((error = namei(&nd)) != 0)
  698                 goto bad2;
  699         vp = nd.ni_vp;
  700         if (vp->v_type != VSOCK) {
  701                 error = ENOTSOCK;
  702                 goto bad;
  703         }
  704         if ((error = VOP_ACCESS(vp, VWRITE, p->p_ucred, p)) != 0)
  705                 goto bad;
  706         so2 = vp->v_socket;
  707         if (so2 == 0) {
  708                 error = ECONNREFUSED;
  709                 goto bad;
  710         }
  711         if (so->so_type != so2->so_type) {
  712                 error = EPROTOTYPE;
  713                 goto bad;
  714         }
  715         if (so->so_proto->pr_flags & PR_CONNREQUIRED) {
  716                 if ((so2->so_options & SO_ACCEPTCONN) == 0 ||
  717                     (so3 = sonewconn(so2, 0)) == 0) {
  718                         error = ECONNREFUSED;
  719                         goto bad;
  720                 }
  721                 unp2 = sotounpcb(so2);
  722                 unp3 = sotounpcb(so3);
  723                 if (unp2->unp_addr) {
  724                         unp3->unp_addr = malloc(unp2->unp_addrlen,
  725                             M_SONAME, M_WAITOK);
  726                         memcpy(unp3->unp_addr, unp2->unp_addr,
  727                             unp2->unp_addrlen);
  728                         unp3->unp_addrlen = unp2->unp_addrlen;
  729                 }
  730                 unp3->unp_flags = unp2->unp_flags;
  731                 so2 = so3;
  732         }
  733         error = unp_connect2(so, so2, PRU_CONNECT);
  734  bad:
  735         vput(vp);
  736  bad2:
  737         free(sun, M_SONAME);
  738         return (error);
  739 }
  740 
  741 int
  742 unp_connect2(so, so2, req)
  743         struct socket *so;
  744         struct socket *so2;
  745         int req;
  746 {
  747         struct unpcb *unp = sotounpcb(so);
  748         struct unpcb *unp2;
  749 
  750         if (so2->so_type != so->so_type)
  751                 return (EPROTOTYPE);
  752         unp2 = sotounpcb(so2);
  753         unp->unp_conn = unp2;
  754         switch (so->so_type) {
  755 
  756         case SOCK_DGRAM:
  757                 unp->unp_nextref = unp2->unp_refs;
  758                 unp2->unp_refs = unp;
  759                 soisconnected(so);
  760                 break;
  761 
  762         case SOCK_STREAM:
  763                 unp2->unp_conn = unp;
  764                 if (req == PRU_CONNECT &&
  765                     ((unp->unp_flags | unp2->unp_flags) & UNP_CONNWAIT))
  766                         soisconnecting(so);
  767                 else
  768                         soisconnected(so);
  769                 soisconnected(so2);
  770                 break;
  771 
  772         default:
  773                 panic("unp_connect2");
  774         }
  775         return (0);
  776 }
  777 
  778 void
  779 unp_disconnect(unp)
  780         struct unpcb *unp;
  781 {
  782         struct unpcb *unp2 = unp->unp_conn;
  783 
  784         if (unp2 == 0)
  785                 return;
  786         unp->unp_conn = 0;
  787         switch (unp->unp_socket->so_type) {
  788 
  789         case SOCK_DGRAM:
  790                 if (unp2->unp_refs == unp)
  791                         unp2->unp_refs = unp->unp_nextref;
  792                 else {
  793                         unp2 = unp2->unp_refs;
  794                         for (;;) {
  795                                 if (unp2 == 0)
  796                                         panic("unp_disconnect");
  797                                 if (unp2->unp_nextref == unp)
  798                                         break;
  799                                 unp2 = unp2->unp_nextref;
  800                         }
  801                         unp2->unp_nextref = unp->unp_nextref;
  802                 }
  803                 unp->unp_nextref = 0;
  804                 unp->unp_socket->so_state &= ~SS_ISCONNECTED;
  805                 break;
  806 
  807         case SOCK_STREAM:
  808                 soisdisconnected(unp->unp_socket);
  809                 unp2->unp_conn = 0;
  810                 soisdisconnected(unp2->unp_socket);
  811                 break;
  812         }
  813 }
  814 
  815 #ifdef notdef
  816 unp_abort(unp)
  817         struct unpcb *unp;
  818 {
  819 
  820         unp_detach(unp);
  821 }
  822 #endif
  823 
  824 void
  825 unp_shutdown(unp)
  826         struct unpcb *unp;
  827 {
  828         struct socket *so;
  829 
  830         if (unp->unp_socket->so_type == SOCK_STREAM && unp->unp_conn &&
  831             (so = unp->unp_conn->unp_socket))
  832                 socantrcvmore(so);
  833 }
  834 
  835 void
  836 unp_drop(unp, errno)
  837         struct unpcb *unp;
  838         int errno;
  839 {
  840         struct socket *so = unp->unp_socket;
  841 
  842         so->so_error = errno;
  843         unp_disconnect(unp);
  844         if (so->so_head) {
  845                 so->so_pcb = 0;
  846                 sofree(so);
  847                 if (unp->unp_addr)
  848                         free(unp->unp_addr, M_SONAME);
  849                 free(unp, M_PCB);
  850         }
  851 }
  852 
  853 #ifdef notdef
  854 unp_drain()
  855 {
  856 
  857 }
  858 #endif
  859 
  860 int
  861 unp_externalize(rights)
  862         struct mbuf *rights;
  863 {
  864         struct proc *p = curproc;               /* XXX */
  865         struct cmsghdr *cm = mtod(rights, struct cmsghdr *);
  866         int i, *fdp;
  867         struct file **rp;
  868         struct file *fp;
  869         int nfds, error = 0;
  870 
  871         nfds = (cm->cmsg_len - CMSG_ALIGN(sizeof(*cm))) /
  872             sizeof(struct file *);
  873         rp = (struct file **)CMSG_DATA(cm);
  874 
  875         fdp = malloc(nfds * sizeof(int), M_TEMP, M_WAITOK);
  876 
  877         /* Make sure the recipient should be able to see the descriptors.. */
  878         if (p->p_cwdi->cwdi_rdir != NULL) {
  879                 rp = (struct file **)CMSG_DATA(cm);
  880                 for (i = 0; i < nfds; i++) {
  881                         fp = *rp++;
  882                         /*
  883                          * If we are in a chroot'ed directory, and
  884                          * someone wants to pass us a directory, make
  885                          * sure it's inside the subtree we're allowed
  886                          * to access.
  887                          */
  888                         if (fp->f_type == DTYPE_VNODE) {
  889                                 struct vnode *vp = (struct vnode *)fp->f_data;
  890                                 if ((vp->v_type == VDIR) &&
  891                                     !vn_isunder(vp, p->p_cwdi->cwdi_rdir, p)) {
  892                                         error = EPERM;
  893                                         break;
  894                                 }
  895                         }
  896                 }
  897         }
  898 
  899  restart:
  900         rp = (struct file **)CMSG_DATA(cm);
  901         if (error != 0) {
  902                 for (i = 0; i < nfds; i++) {
  903                         fp = *rp;
  904                         /*
  905                          * zero the pointer before calling unp_discard,
  906                          * since it may end up in unp_gc()..
  907                          */
  908                         *rp++ = 0;
  909                         unp_discard(fp);
  910                 }
  911                 goto out;
  912         }
  913 
  914         /*
  915          * First loop -- allocate file descriptor table slots for the
  916          * new descriptors.
  917          */
  918         for (i = 0; i < nfds; i++) {
  919                 fp = *rp++;
  920                 if ((error = fdalloc(p, 0, &fdp[i])) != 0) {
  921                         /*
  922                          * Back out what we've done so far.
  923                          */
  924                         for (--i; i >= 0; i--)
  925                                 fdremove(p->p_fd, fdp[i]);
  926 
  927                         if (error == ENOSPC) {
  928                                 fdexpand(p);
  929                                 error = 0;
  930                         } else {
  931                                 /*
  932                                  * This is the error that has historically
  933                                  * been returned, and some callers may
  934                                  * expect it.
  935                                  */
  936                                 error = EMSGSIZE;
  937                         }
  938                         goto restart;
  939                 }
  940 
  941                 /*
  942                  * Make the slot reference the descriptor so that
  943                  * fdalloc() works properly.. We finalize it all
  944                  * in the loop below.
  945                  */
  946                 p->p_fd->fd_ofiles[fdp[i]] = fp;
  947         }
  948 
  949         /*
  950          * Now that adding them has succeeded, update all of the
  951          * descriptor passing state.
  952          */
  953         rp = (struct file **)CMSG_DATA(cm);
  954         for (i = 0; i < nfds; i++) {
  955                 fp = *rp++;
  956                 fp->f_msgcount--;
  957                 unp_rights--;
  958         }
  959 
  960         /*
  961          * Copy temporary array to message and adjust length, in case of
  962          * transition from large struct file pointers to ints.
  963          */
  964         memcpy(CMSG_DATA(cm), fdp, nfds * sizeof(int));
  965         cm->cmsg_len = CMSG_LEN(nfds * sizeof(int));
  966         rights->m_len = CMSG_SPACE(nfds * sizeof(int));
  967  out:
  968         free(fdp, M_TEMP);
  969         return (error);
  970 }
  971 
  972 int
  973 unp_internalize(control, p)
  974         struct mbuf *control;
  975         struct proc *p;
  976 {
  977         struct filedesc *fdescp = p->p_fd;
  978         struct cmsghdr *newcm, *cm = mtod(control, struct cmsghdr *);
  979         struct file **rp, **files;
  980         struct file *fp;
  981         int i, fd, *fdp;
  982         int nfds;
  983         u_int neededspace;
  984 
  985         /* Sanity check the control message header */
  986         if (cm->cmsg_type != SCM_RIGHTS || cm->cmsg_level != SOL_SOCKET ||
  987             cm->cmsg_len != control->m_len)
  988                 return (EINVAL);
  989 
  990         /* Verify that the file descriptors are valid */
  991         nfds = (cm->cmsg_len - CMSG_ALIGN(sizeof(*cm))) / sizeof(int);
  992         fdp = (int *)CMSG_DATA(cm);
  993         for (i = 0; i < nfds; i++) {
  994                 fd = *fdp++;
  995                 if ((fp = fd_getfile(fdescp, fd)) == NULL)
  996                         return (EBADF);
  997                 simple_unlock(&fp->f_slock);
  998         }
  999 
 1000         /* Make sure we have room for the struct file pointers */
 1001         neededspace = CMSG_SPACE(nfds * sizeof(struct file *)) -
 1002             control->m_len;
 1003         if (neededspace > M_TRAILINGSPACE(control)) {
 1004 
 1005                 /* allocate new space and copy header into it */
 1006                 newcm = malloc(
 1007                     CMSG_SPACE(nfds * sizeof(struct file *)),
 1008                     M_MBUF, M_WAITOK);
 1009                 if (newcm == NULL)
 1010                         return (E2BIG);
 1011                 memcpy(newcm, cm, sizeof(struct cmsghdr));
 1012                 files = (struct file **)CMSG_DATA(newcm);               
 1013         } else {
 1014                 /* we can convert in-place */
 1015                 newcm = NULL;
 1016                 files = (struct file **)CMSG_DATA(cm);
 1017         }
 1018 
 1019         /*
 1020          * Transform the file descriptors into struct file pointers, in
 1021          * reverse order so that if pointers are bigger than ints, the
 1022          * int won't get until we're done.
 1023          */
 1024         fdp = (int *)CMSG_DATA(cm) + nfds - 1;
 1025         rp = files + nfds - 1;
 1026         for (i = 0; i < nfds; i++) {
 1027                 fp = fdescp->fd_ofiles[*fdp--];
 1028                 simple_lock(&fp->f_slock);
 1029 #ifdef DIAGNOSTIC
 1030                 if (fp->f_iflags & FIF_WANTCLOSE)
 1031                         panic("unp_internalize: file already closed");
 1032 #endif
 1033                 *rp-- = fp;
 1034                 fp->f_count++;
 1035                 fp->f_msgcount++;
 1036                 simple_unlock(&fp->f_slock);
 1037                 unp_rights++;
 1038         }
 1039 
 1040         if (newcm) {
 1041                 if (control->m_flags & M_EXT)
 1042                         MEXTREMOVE(control);
 1043                 MEXTADD(control, newcm,
 1044                     CMSG_SPACE(nfds * sizeof(struct file *)),
 1045                     M_MBUF, NULL, NULL);
 1046                 cm = newcm;
 1047         }
 1048 
 1049         /* adjust message & mbuf to note amount of space actually used. */
 1050         cm->cmsg_len = CMSG_LEN(nfds * sizeof(struct file *));
 1051         control->m_len = CMSG_SPACE(nfds * sizeof(struct file *));
 1052 
 1053         return (0);
 1054 }
 1055 
 1056 struct mbuf *
 1057 unp_addsockcred(p, control)
 1058         struct proc *p;
 1059         struct mbuf *control;
 1060 {
 1061         struct cmsghdr *cmp;
 1062         struct sockcred *sc;
 1063         struct mbuf *m, *n;
 1064         int len, space, i;
 1065 
 1066         len = CMSG_LEN(SOCKCREDSIZE(p->p_ucred->cr_ngroups));
 1067         space = CMSG_SPACE(SOCKCREDSIZE(p->p_ucred->cr_ngroups));
 1068 
 1069         m = m_get(M_WAIT, MT_CONTROL);
 1070         if (space > MLEN) {
 1071                 if (space > MCLBYTES)
 1072                         MEXTMALLOC(m, space, M_WAITOK);
 1073                 else
 1074                         m_clget(m, M_WAIT);
 1075                 if ((m->m_flags & M_EXT) == 0) {
 1076                         m_free(m);
 1077                         return (control);
 1078                 }
 1079         }
 1080 
 1081         m->m_len = space;
 1082         m->m_next = NULL;
 1083         cmp = mtod(m, struct cmsghdr *);
 1084         sc = (struct sockcred *)CMSG_DATA(cmp);
 1085         cmp->cmsg_len = len;
 1086         cmp->cmsg_level = SOL_SOCKET;
 1087         cmp->cmsg_type = SCM_CREDS;
 1088         sc->sc_uid = p->p_cred->p_ruid;
 1089         sc->sc_euid = p->p_ucred->cr_uid;
 1090         sc->sc_gid = p->p_cred->p_rgid;
 1091         sc->sc_egid = p->p_ucred->cr_gid;
 1092         sc->sc_ngroups = p->p_ucred->cr_ngroups;
 1093         for (i = 0; i < sc->sc_ngroups; i++)
 1094                 sc->sc_groups[i] = p->p_ucred->cr_groups[i];
 1095 
 1096         /*
 1097          * If a control message already exists, append us to the end.
 1098          */
 1099         if (control != NULL) {
 1100                 for (n = control; n->m_next != NULL; n = n->m_next)
 1101                         ;
 1102                 n->m_next = m;
 1103         } else
 1104                 control = m;
 1105 
 1106         return (control);
 1107 }
 1108 
 1109 int     unp_defer, unp_gcing;
 1110 extern  struct domain unixdomain;
 1111 
 1112 /*
 1113  * Comment added long after the fact explaining what's going on here.
 1114  * Do a mark-sweep GC of file descriptors on the system, to free up
 1115  * any which are caught in flight to an about-to-be-closed socket.
 1116  *
 1117  * Traditional mark-sweep gc's start at the "root", and mark
 1118  * everything reachable from the root (which, in our case would be the
 1119  * process table).  The mark bits are cleared during the sweep.
 1120  *
 1121  * XXX For some inexplicable reason (perhaps because the file
 1122  * descriptor tables used to live in the u area which could be swapped
 1123  * out and thus hard to reach), we do multiple scans over the set of
 1124  * descriptors, using use *two* mark bits per object (DEFER and MARK).
 1125  * Whenever we find a descriptor which references other descriptors,
 1126  * the ones it references are marked with both bits, and we iterate
 1127  * over the whole file table until there are no more DEFER bits set.
 1128  * We also make an extra pass *before* the GC to clear the mark bits,
 1129  * which could have been cleared at almost no cost during the previous
 1130  * sweep.
 1131  *
 1132  * XXX MP: this needs to run with locks such that no other thread of
 1133  * control can create or destroy references to file descriptors. it
 1134  * may be necessary to defer the GC until later (when the locking
 1135  * situation is more hospitable); it may be necessary to push this
 1136  * into a separate thread.
 1137  */
 1138 void
 1139 unp_gc()
 1140 {
 1141         struct file *fp, *nextfp;
 1142         struct socket *so, *so1;
 1143         struct file **extra_ref, **fpp;
 1144         int nunref, i;
 1145 
 1146         if (unp_gcing)
 1147                 return;
 1148         unp_gcing = 1;
 1149         unp_defer = 0;
 1150 
 1151         /* Clear mark bits */
 1152         LIST_FOREACH(fp, &filehead, f_list)
 1153                 fp->f_flag &= ~(FMARK|FDEFER);
 1154 
 1155         /*
 1156          * Iterate over the set of descriptors, marking ones believed
 1157          * (based on refcount) to be referenced from a process, and
 1158          * marking for rescan descriptors which are queued on a socket.
 1159          */
 1160         do {
 1161                 LIST_FOREACH(fp, &filehead, f_list) {
 1162                         if (fp->f_flag & FDEFER) {
 1163                                 fp->f_flag &= ~FDEFER;
 1164                                 unp_defer--;
 1165 #ifdef DIAGNOSTIC
 1166                                 if (fp->f_count == 0)
 1167                                         panic("unp_gc: deferred unreferenced socket");
 1168 #endif
 1169                         } else {
 1170                                 if (fp->f_count == 0)
 1171                                         continue;
 1172                                 if (fp->f_flag & FMARK)
 1173                                         continue;
 1174                                 if (fp->f_count == fp->f_msgcount)
 1175                                         continue;
 1176                         }
 1177                         fp->f_flag |= FMARK;
 1178 
 1179                         if (fp->f_type != DTYPE_SOCKET ||
 1180                             (so = (struct socket *)fp->f_data) == 0)
 1181                                 continue;
 1182                         if (so->so_proto->pr_domain != &unixdomain ||
 1183                             (so->so_proto->pr_flags&PR_RIGHTS) == 0)
 1184                                 continue;
 1185 #ifdef notdef
 1186                         if (so->so_rcv.sb_flags & SB_LOCK) {
 1187                                 /*
 1188                                  * This is problematical; it's not clear
 1189                                  * we need to wait for the sockbuf to be
 1190                                  * unlocked (on a uniprocessor, at least),
 1191                                  * and it's also not clear what to do
 1192                                  * if sbwait returns an error due to receipt
 1193                                  * of a signal.  If sbwait does return
 1194                                  * an error, we'll go into an infinite
 1195                                  * loop.  Delete all of this for now.
 1196                                  */
 1197                                 (void) sbwait(&so->so_rcv);
 1198                                 goto restart;
 1199                         }
 1200 #endif
 1201                         unp_scan(so->so_rcv.sb_mb, unp_mark, 0);
 1202                         /*
 1203                          * mark descriptors referenced from sockets queued on the accept queue as well.
 1204                          */
 1205                         if (so->so_options & SO_ACCEPTCONN) {
 1206                                 TAILQ_FOREACH(so1, &so->so_q0, so_qe) {
 1207                                         unp_scan(so1->so_rcv.sb_mb, unp_mark, 0);
 1208                                 }
 1209                                 TAILQ_FOREACH(so1, &so->so_q, so_qe) {
 1210                                         unp_scan(so1->so_rcv.sb_mb, unp_mark, 0);
 1211                                 }
 1212                         }
 1213                         
 1214                 }
 1215         } while (unp_defer);
 1216         /*
 1217          * Sweep pass.  Find unmarked descriptors, and free them.
 1218          *
 1219          * We grab an extra reference to each of the file table entries
 1220          * that are not otherwise accessible and then free the rights
 1221          * that are stored in messages on them.
 1222          *
 1223          * The bug in the original code is a little tricky, so I'll describe
 1224          * what's wrong with it here.
 1225          *
 1226          * It is incorrect to simply unp_discard each entry for f_msgcount
 1227          * times -- consider the case of sockets A and B that contain
 1228          * references to each other.  On a last close of some other socket,
 1229          * we trigger a gc since the number of outstanding rights (unp_rights)
 1230          * is non-zero.  If during the sweep phase the gc code un_discards,
 1231          * we end up doing a (full) closef on the descriptor.  A closef on A
 1232          * results in the following chain.  Closef calls soo_close, which
 1233          * calls soclose.   Soclose calls first (through the switch
 1234          * uipc_usrreq) unp_detach, which re-invokes unp_gc.  Unp_gc simply
 1235          * returns because the previous instance had set unp_gcing, and
 1236          * we return all the way back to soclose, which marks the socket
 1237          * with SS_NOFDREF, and then calls sofree.  Sofree calls sorflush
 1238          * to free up the rights that are queued in messages on the socket A,
 1239          * i.e., the reference on B.  The sorflush calls via the dom_dispose
 1240          * switch unp_dispose, which unp_scans with unp_discard.  This second
 1241          * instance of unp_discard just calls closef on B.
 1242          *
 1243          * Well, a similar chain occurs on B, resulting in a sorflush on B,
 1244          * which results in another closef on A.  Unfortunately, A is already
 1245          * being closed, and the descriptor has already been marked with
 1246          * SS_NOFDREF, and soclose panics at this point.
 1247          *
 1248          * Here, we first take an extra reference to each inaccessible
 1249          * descriptor.  Then, if the inaccessible descriptor is a
 1250          * socket, we call sorflush in case it is a Unix domain
 1251          * socket.  After we destroy all the rights carried in
 1252          * messages, we do a last closef to get rid of our extra
 1253          * reference.  This is the last close, and the unp_detach etc
 1254          * will shut down the socket.
 1255          *
 1256          * 91/09/19, bsy@cs.cmu.edu
 1257          */
 1258         extra_ref = malloc(nfiles * sizeof(struct file *), M_FILE, M_WAITOK);
 1259         for (nunref = 0, fp = LIST_FIRST(&filehead), fpp = extra_ref; fp != 0;
 1260             fp = nextfp) {
 1261                 nextfp = LIST_NEXT(fp, f_list);
 1262                 simple_lock(&fp->f_slock);
 1263                 if (fp->f_count != 0 &&
 1264                     fp->f_count == fp->f_msgcount && !(fp->f_flag & FMARK)) {
 1265                         *fpp++ = fp;
 1266                         nunref++;
 1267                         fp->f_count++;
 1268                 }
 1269                 simple_unlock(&fp->f_slock);
 1270         }
 1271         for (i = nunref, fpp = extra_ref; --i >= 0; ++fpp) {
 1272                 fp = *fpp;
 1273                 simple_lock(&fp->f_slock);
 1274                 FILE_USE(fp);
 1275                 if (fp->f_type == DTYPE_SOCKET)
 1276                         sorflush((struct socket *)fp->f_data);
 1277                 FILE_UNUSE(fp, NULL);
 1278         }
 1279         for (i = nunref, fpp = extra_ref; --i >= 0; ++fpp) {
 1280                 fp = *fpp;
 1281                 simple_lock(&fp->f_slock);
 1282                 FILE_USE(fp);
 1283                 (void) closef(fp, (struct proc *)0);
 1284         }
 1285         free((caddr_t)extra_ref, M_FILE);
 1286         unp_gcing = 0;
 1287 }
 1288 
 1289 void
 1290 unp_dispose(m)
 1291         struct mbuf *m;
 1292 {
 1293 
 1294         if (m)
 1295                 unp_scan(m, unp_discard, 1);
 1296 }
 1297 
 1298 void
 1299 unp_scan(m0, op, discard)
 1300         struct mbuf *m0;
 1301         void (*op)(struct file *);
 1302         int discard;
 1303 {
 1304         struct mbuf *m;
 1305         struct file **rp;
 1306         struct cmsghdr *cm;
 1307         int i;
 1308         int qfds;
 1309 
 1310         while (m0) {
 1311                 for (m = m0; m; m = m->m_next) {
 1312                         if (m->m_type == MT_CONTROL &&
 1313                             m->m_len >= sizeof(*cm)) {
 1314                                 cm = mtod(m, struct cmsghdr *);
 1315                                 if (cm->cmsg_level != SOL_SOCKET ||
 1316                                     cm->cmsg_type != SCM_RIGHTS)
 1317                                         continue;
 1318                                 qfds = (cm->cmsg_len - CMSG_ALIGN(sizeof(*cm)))
 1319                                     / sizeof(struct file *);
 1320                                 rp = (struct file **)CMSG_DATA(cm);
 1321                                 for (i = 0; i < qfds; i++) {
 1322                                         struct file *fp = *rp;
 1323                                         if (discard)
 1324                                                 *rp = 0;
 1325                                         (*op)(fp);
 1326                                         rp++;
 1327                                 }
 1328                                 break;          /* XXX, but saves time */
 1329                         }
 1330                 }
 1331                 m0 = m0->m_nextpkt;
 1332         }
 1333 }
 1334 
 1335 void
 1336 unp_mark(fp)
 1337         struct file *fp;
 1338 {
 1339         if (fp == NULL)
 1340                 return;
 1341         
 1342         if (fp->f_flag & FMARK)
 1343                 return;
 1344 
 1345         /* If we're already deferred, don't screw up the defer count */
 1346         if (fp->f_flag & FDEFER)
 1347                 return;
 1348 
 1349         /*
 1350          * Minimize the number of deferrals...  Sockets are the only
 1351          * type of descriptor which can hold references to another
 1352          * descriptor, so just mark other descriptors, and defer
 1353          * unmarked sockets for the next pass.
 1354          */
 1355         if (fp->f_type == DTYPE_SOCKET) {
 1356                 unp_defer++;
 1357                 if (fp->f_count == 0)
 1358                         panic("unp_mark: queued unref");
 1359                 fp->f_flag |= FDEFER;
 1360         } else {
 1361                 fp->f_flag |= FMARK;
 1362         }
 1363         return;
 1364 }
 1365 
 1366 void
 1367 unp_discard(fp)
 1368         struct file *fp;
 1369 {
 1370         if (fp == NULL)
 1371                 return;
 1372         simple_lock(&fp->f_slock);
 1373         fp->f_usecount++;       /* i.e. FILE_USE(fp) sans locking */
 1374         fp->f_msgcount--;
 1375         simple_unlock(&fp->f_slock);
 1376         unp_rights--;
 1377         (void) closef(fp, (struct proc *)0);
 1378 }

Cache object: 7f3e5e2c150687159a98c35a6ae02d72


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]


This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.