xref: /netbsd-src/sys/kern/uipc_usrreq.c (revision e7ac2a8b5bd66fa2e050809de09a075c36a7014d)
1 /*	$NetBSD: uipc_usrreq.c,v 1.199 2020/08/26 22:54:30 christos Exp $	*/
2 
3 /*-
4  * Copyright (c) 1998, 2000, 2004, 2008, 2009, 2020 The NetBSD Foundation, Inc.
5  * All rights reserved.
6  *
7  * This code is derived from software contributed to The NetBSD Foundation
8  * by Jason R. Thorpe of the Numerical Aerospace Simulation Facility,
9  * NASA Ames Research Center, and by Andrew Doran.
10  *
11  * Redistribution and use in source and binary forms, with or without
12  * modification, are permitted provided that the following conditions
13  * are met:
14  * 1. Redistributions of source code must retain the above copyright
15  *    notice, this list of conditions and the following disclaimer.
16  * 2. Redistributions in binary form must reproduce the above copyright
17  *    notice, this list of conditions and the following disclaimer in the
18  *    documentation and/or other materials provided with the distribution.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
21  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
22  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
23  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
24  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
25  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
26  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
27  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
28  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
29  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
30  * POSSIBILITY OF SUCH DAMAGE.
31  */
32 
33 /*
34  * Copyright (c) 1982, 1986, 1989, 1991, 1993
35  *	The Regents of the University of California.  All rights reserved.
36  *
37  * Redistribution and use in source and binary forms, with or without
38  * modification, are permitted provided that the following conditions
39  * are met:
40  * 1. Redistributions of source code must retain the above copyright
41  *    notice, this list of conditions and the following disclaimer.
42  * 2. Redistributions in binary form must reproduce the above copyright
43  *    notice, this list of conditions and the following disclaimer in the
44  *    documentation and/or other materials provided with the distribution.
45  * 3. Neither the name of the University nor the names of its contributors
46  *    may be used to endorse or promote products derived from this software
47  *    without specific prior written permission.
48  *
49  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
50  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
51  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
52  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
53  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
54  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
55  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
56  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
57  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
58  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
59  * SUCH DAMAGE.
60  *
61  *	@(#)uipc_usrreq.c	8.9 (Berkeley) 5/14/95
62  */
63 
64 /*
65  * Copyright (c) 1997 Christopher G. Demetriou.  All rights reserved.
66  *
67  * Redistribution and use in source and binary forms, with or without
68  * modification, are permitted provided that the following conditions
69  * are met:
70  * 1. Redistributions of source code must retain the above copyright
71  *    notice, this list of conditions and the following disclaimer.
72  * 2. Redistributions in binary form must reproduce the above copyright
73  *    notice, this list of conditions and the following disclaimer in the
74  *    documentation and/or other materials provided with the distribution.
75  * 3. All advertising materials mentioning features or use of this software
76  *    must display the following acknowledgement:
77  *	This product includes software developed by the University of
78  *	California, Berkeley and its contributors.
79  * 4. Neither the name of the University nor the names of its contributors
80  *    may be used to endorse or promote products derived from this software
81  *    without specific prior written permission.
82  *
83  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
84  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
85  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
86  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
87  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
88  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
89  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
90  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
91  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
92  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
93  * SUCH DAMAGE.
94  *
95  *	@(#)uipc_usrreq.c	8.9 (Berkeley) 5/14/95
96  */
97 
98 #include <sys/cdefs.h>
99 __KERNEL_RCSID(0, "$NetBSD: uipc_usrreq.c,v 1.199 2020/08/26 22:54:30 christos Exp $");
100 
101 #ifdef _KERNEL_OPT
102 #include "opt_compat_netbsd.h"
103 #endif
104 
105 #include <sys/param.h>
106 #include <sys/systm.h>
107 #include <sys/proc.h>
108 #include <sys/filedesc.h>
109 #include <sys/domain.h>
110 #include <sys/protosw.h>
111 #include <sys/socket.h>
112 #include <sys/socketvar.h>
113 #include <sys/unpcb.h>
114 #include <sys/un.h>
115 #include <sys/namei.h>
116 #include <sys/vnode.h>
117 #include <sys/file.h>
118 #include <sys/stat.h>
119 #include <sys/mbuf.h>
120 #include <sys/kauth.h>
121 #include <sys/kmem.h>
122 #include <sys/atomic.h>
123 #include <sys/uidinfo.h>
124 #include <sys/kernel.h>
125 #include <sys/kthread.h>
126 #include <sys/compat_stub.h>
127 
128 #include <compat/sys/socket.h>
129 #include <compat/net/route_70.h>
130 
131 /*
132  * Unix communications domain.
133  *
134  * TODO:
135  *	RDM
136  *	rethink name space problems
137  *	need a proper out-of-band
138  *
139  * Notes on locking:
140  *
141  * The generic rules noted in uipc_socket2.c apply.  In addition:
142  *
143  * o We have a global lock, uipc_lock.
144  *
145  * o All datagram sockets are locked by uipc_lock.
146  *
147  * o For stream socketpairs, the two endpoints are created sharing the same
148  *   independent lock.  Sockets presented to PRU_CONNECT2 must already have
149  *   matching locks.
150  *
151  * o Stream sockets created via socket() start life with their own
152  *   independent lock.
153  *
154  * o Stream connections to a named endpoint are slightly more complicated.
155  *   Sockets that have called listen() have their lock pointer mutated to
156  *   the global uipc_lock.  When establishing a connection, the connecting
157  *   socket also has its lock mutated to uipc_lock, which matches the head
158  *   (listening socket).  We create a new socket for accept() to return, and
159  *   that also shares the head's lock.  Until the connection is completely
160  *   done on both ends, all three sockets are locked by uipc_lock.  Once the
161  *   connection is complete, the association with the head's lock is broken.
162  *   The connecting socket and the socket returned from accept() have their
163  *   lock pointers mutated away from uipc_lock, and back to the connecting
164  *   socket's original, independent lock.  The head continues to be locked
165  *   by uipc_lock.
166  *
167  * o If uipc_lock is determined to be a significant source of contention,
168  *   it could easily be hashed out.  It is difficult to simply make it an
169  *   independent lock because of visibility / garbage collection issues:
170  *   if a socket has been associated with a lock at any point, that lock
171  *   must remain valid until the socket is no longer visible in the system.
172  *   The lock must not be freed or otherwise destroyed until any sockets
173  *   that had referenced it have also been destroyed.
174  */
175 const struct sockaddr_un sun_noname = {
176 	.sun_len = offsetof(struct sockaddr_un, sun_path),
177 	.sun_family = AF_LOCAL,
178 };
179 ino_t	unp_ino;			/* prototype for fake inode numbers */
180 
181 static struct mbuf * unp_addsockcred(struct lwp *, struct mbuf *);
182 static void   unp_discard_later(file_t *);
183 static void   unp_discard_now(file_t *);
184 static void   unp_disconnect1(struct unpcb *);
185 static bool   unp_drop(struct unpcb *, int);
186 static int    unp_internalize(struct mbuf **);
187 static void   unp_mark(file_t *);
188 static void   unp_scan(struct mbuf *, void (*)(file_t *), int);
189 static void   unp_shutdown1(struct unpcb *);
190 static void   unp_thread(void *);
191 static void   unp_thread_kick(void);
192 
193 static kmutex_t *uipc_lock;
194 
195 static kcondvar_t unp_thread_cv;
196 static lwp_t *unp_thread_lwp;
197 static SLIST_HEAD(,file) unp_thread_discard;
198 static int unp_defer;
199 
200 /* Compat interface */
201 
202 struct mbuf * stub_compat_70_unp_addsockcred(lwp_t *, struct mbuf *);
203 
204 struct mbuf * stub_compat_70_unp_addsockcred(struct lwp *lwp,
205     struct mbuf *control)
206 {
207 
208 /* just copy our initial argument */
209 	return control;
210 }
211 
212 bool compat70_ocreds_valid = false;
213 
214 /*
215  * Initialize Unix protocols.
216  */
217 void
218 uipc_init(void)
219 {
220 	int error;
221 
222 	uipc_lock = mutex_obj_alloc(MUTEX_DEFAULT, IPL_NONE);
223 	cv_init(&unp_thread_cv, "unpgc");
224 
225 	error = kthread_create(PRI_NONE, KTHREAD_MPSAFE, NULL, unp_thread,
226 	    NULL, &unp_thread_lwp, "unpgc");
227 	if (error != 0)
228 		panic("uipc_init %d", error);
229 }
230 
231 static void
232 unp_connid(struct lwp *l, struct unpcb *unp, int flags)
233 {
234 	unp->unp_connid.unp_pid = l->l_proc->p_pid;
235 	unp->unp_connid.unp_euid = kauth_cred_geteuid(l->l_cred);
236 	unp->unp_connid.unp_egid = kauth_cred_getegid(l->l_cred);
237 	unp->unp_flags |= flags;
238 }
239 
240 /*
241  * A connection succeeded: disassociate both endpoints from the head's
242  * lock, and make them share their own lock.  There is a race here: for
243  * a very brief time one endpoint will be locked by a different lock
244  * than the other end.  However, since the current thread holds the old
245  * lock (the listening socket's lock, the head) access can still only be
246  * made to one side of the connection.
247  */
248 static void
249 unp_setpeerlocks(struct socket *so, struct socket *so2)
250 {
251 	struct unpcb *unp;
252 	kmutex_t *lock;
253 
254 	KASSERT(solocked2(so, so2));
255 
256 	/*
257 	 * Bail out if either end of the socket is not yet fully
258 	 * connected or accepted.  We only break the lock association
259 	 * with the head when the pair of sockets stand completely
260 	 * on their own.
261 	 */
262 	KASSERT(so->so_head == NULL);
263 	if (so2->so_head != NULL)
264 		return;
265 
266 	/*
267 	 * Drop references to old lock.  A third reference (from the
268 	 * queue head) must be held as we still hold its lock.  Bonus:
269 	 * we don't need to worry about garbage collecting the lock.
270 	 */
271 	lock = so->so_lock;
272 	KASSERT(lock == uipc_lock);
273 	mutex_obj_free(lock);
274 	mutex_obj_free(lock);
275 
276 	/*
277 	 * Grab stream lock from the initiator and share between the two
278 	 * endpoints.  Issue memory barrier to ensure all modifications
279 	 * become globally visible before the lock change.  so2 is
280 	 * assumed not to have a stream lock, because it was created
281 	 * purely for the server side to accept this connection and
282 	 * started out life using the domain-wide lock.
283 	 */
284 	unp = sotounpcb(so);
285 	KASSERT(unp->unp_streamlock != NULL);
286 	KASSERT(sotounpcb(so2)->unp_streamlock == NULL);
287 	lock = unp->unp_streamlock;
288 	unp->unp_streamlock = NULL;
289 	mutex_obj_hold(lock);
290 	membar_exit();
291 	/*
292 	 * possible race if lock is not held - see comment in
293 	 * uipc_usrreq(PRU_ACCEPT).
294 	 */
295 	KASSERT(mutex_owned(lock));
296 	solockreset(so, lock);
297 	solockreset(so2, lock);
298 }
299 
300 /*
301  * Reset a socket's lock back to the domain-wide lock.
302  */
303 static void
304 unp_resetlock(struct socket *so)
305 {
306 	kmutex_t *olock, *nlock;
307 	struct unpcb *unp;
308 
309 	KASSERT(solocked(so));
310 
311 	olock = so->so_lock;
312 	nlock = uipc_lock;
313 	if (olock == nlock)
314 		return;
315 	unp = sotounpcb(so);
316 	KASSERT(unp->unp_streamlock == NULL);
317 	unp->unp_streamlock = olock;
318 	mutex_obj_hold(nlock);
319 	mutex_enter(nlock);
320 	solockreset(so, nlock);
321 	mutex_exit(olock);
322 }
323 
324 static void
325 unp_free(struct unpcb *unp)
326 {
327 	if (unp->unp_addr)
328 		free(unp->unp_addr, M_SONAME);
329 	if (unp->unp_streamlock != NULL)
330 		mutex_obj_free(unp->unp_streamlock);
331 	kmem_free(unp, sizeof(*unp));
332 }
333 
334 static int
335 unp_output(struct mbuf *m, struct mbuf *control, struct unpcb *unp)
336 {
337 	struct socket *so2;
338 	const struct sockaddr_un *sun;
339 
340 	/* XXX: server side closed the socket */
341 	if (unp->unp_conn == NULL)
342 		return ECONNREFUSED;
343 	so2 = unp->unp_conn->unp_socket;
344 
345 	KASSERT(solocked(so2));
346 
347 	if (unp->unp_addr)
348 		sun = unp->unp_addr;
349 	else
350 		sun = &sun_noname;
351 	if (unp->unp_conn->unp_flags & UNP_WANTCRED)
352 		control = unp_addsockcred(curlwp, control);
353 	if (unp->unp_conn->unp_flags & UNP_OWANTCRED)
354 		MODULE_HOOK_CALL(uipc_unp_70_hook, (curlwp, control),
355 		    stub_compat_70_unp_addsockcred(curlwp, control), control);
356 	if (sbappendaddr(&so2->so_rcv, (const struct sockaddr *)sun, m,
357 	    control) == 0) {
358 		unp_dispose(control);
359 		m_freem(control);
360 		m_freem(m);
361 		/* Don't call soroverflow because we're returning this
362 		 * error directly to the sender. */
363 		so2->so_rcv.sb_overflowed++;
364 		return ENOBUFS;
365 	} else {
366 		sorwakeup(so2);
367 		return 0;
368 	}
369 }
370 
371 static void
372 unp_setaddr(struct socket *so, struct sockaddr *nam, bool peeraddr)
373 {
374 	const struct sockaddr_un *sun = NULL;
375 	struct unpcb *unp;
376 
377 	KASSERT(solocked(so));
378 	unp = sotounpcb(so);
379 
380 	if (peeraddr) {
381 		if (unp->unp_conn && unp->unp_conn->unp_addr)
382 			sun = unp->unp_conn->unp_addr;
383 	} else {
384 		if (unp->unp_addr)
385 			sun = unp->unp_addr;
386 	}
387 	if (sun == NULL)
388 		sun = &sun_noname;
389 
390 	memcpy(nam, sun, sun->sun_len);
391 }
392 
393 static int
394 unp_rcvd(struct socket *so, int flags, struct lwp *l)
395 {
396 	struct unpcb *unp = sotounpcb(so);
397 	struct socket *so2;
398 	u_int newhiwat;
399 
400 	KASSERT(solocked(so));
401 	KASSERT(unp != NULL);
402 
403 	switch (so->so_type) {
404 
405 	case SOCK_DGRAM:
406 		panic("uipc 1");
407 		/*NOTREACHED*/
408 
409 	case SOCK_SEQPACKET: /* FALLTHROUGH */
410 	case SOCK_STREAM:
411 #define	rcv (&so->so_rcv)
412 #define snd (&so2->so_snd)
413 		if (unp->unp_conn == 0)
414 			break;
415 		so2 = unp->unp_conn->unp_socket;
416 		KASSERT(solocked2(so, so2));
417 		/*
418 		 * Adjust backpressure on sender
419 		 * and wakeup any waiting to write.
420 		 */
421 		snd->sb_mbmax += unp->unp_mbcnt - rcv->sb_mbcnt;
422 		unp->unp_mbcnt = rcv->sb_mbcnt;
423 		newhiwat = snd->sb_hiwat + unp->unp_cc - rcv->sb_cc;
424 		(void)chgsbsize(so2->so_uidinfo,
425 		    &snd->sb_hiwat, newhiwat, RLIM_INFINITY);
426 		unp->unp_cc = rcv->sb_cc;
427 		sowwakeup(so2);
428 #undef snd
429 #undef rcv
430 		break;
431 
432 	default:
433 		panic("uipc 2");
434 	}
435 
436 	return 0;
437 }
438 
439 static int
440 unp_recvoob(struct socket *so, struct mbuf *m, int flags)
441 {
442 	KASSERT(solocked(so));
443 
444 	return EOPNOTSUPP;
445 }
446 
447 static int
448 unp_send(struct socket *so, struct mbuf *m, struct sockaddr *nam,
449     struct mbuf *control, struct lwp *l)
450 {
451 	struct unpcb *unp = sotounpcb(so);
452 	int error = 0;
453 	u_int newhiwat;
454 	struct socket *so2;
455 
456 	KASSERT(solocked(so));
457 	KASSERT(unp != NULL);
458 	KASSERT(m != NULL);
459 
460 	/*
461 	 * Note: unp_internalize() rejects any control message
462 	 * other than SCM_RIGHTS, and only allows one.  This
463 	 * has the side-effect of preventing a caller from
464 	 * forging SCM_CREDS.
465 	 */
466 	if (control) {
467 		sounlock(so);
468 		error = unp_internalize(&control);
469 		solock(so);
470 		if (error != 0) {
471 			m_freem(control);
472 			m_freem(m);
473 			return error;
474 		}
475 	}
476 
477 	switch (so->so_type) {
478 
479 	case SOCK_DGRAM: {
480 		KASSERT(so->so_lock == uipc_lock);
481 		if (nam) {
482 			if ((so->so_state & SS_ISCONNECTED) != 0)
483 				error = EISCONN;
484 			else {
485 				/*
486 				 * Note: once connected, the
487 				 * socket's lock must not be
488 				 * dropped until we have sent
489 				 * the message and disconnected.
490 				 * This is necessary to prevent
491 				 * intervening control ops, like
492 				 * another connection.
493 				 */
494 				error = unp_connect(so, nam, l);
495 			}
496 		} else {
497 			if ((so->so_state & SS_ISCONNECTED) == 0)
498 				error = ENOTCONN;
499 		}
500 		if (error) {
501 			unp_dispose(control);
502 			m_freem(control);
503 			m_freem(m);
504 			return error;
505 		}
506 		error = unp_output(m, control, unp);
507 		if (nam)
508 			unp_disconnect1(unp);
509 		break;
510 	}
511 
512 	case SOCK_SEQPACKET: /* FALLTHROUGH */
513 	case SOCK_STREAM:
514 #define	rcv (&so2->so_rcv)
515 #define	snd (&so->so_snd)
516 		if (unp->unp_conn == NULL) {
517 			error = ENOTCONN;
518 			break;
519 		}
520 		so2 = unp->unp_conn->unp_socket;
521 		KASSERT(solocked2(so, so2));
522 		if (unp->unp_conn->unp_flags & UNP_WANTCRED) {
523 			/*
524 			 * Credentials are passed only once on
525 			 * SOCK_STREAM and SOCK_SEQPACKET.
526 			 */
527 			unp->unp_conn->unp_flags &= ~UNP_WANTCRED;
528 			control = unp_addsockcred(l, control);
529 		}
530 		if (unp->unp_conn->unp_flags & UNP_OWANTCRED) {
531 			/*
532 			 * Credentials are passed only once on
533 			 * SOCK_STREAM and SOCK_SEQPACKET.
534 			 */
535 			unp->unp_conn->unp_flags &= ~UNP_OWANTCRED;
536 			MODULE_HOOK_CALL(uipc_unp_70_hook, (curlwp, control),
537 			    stub_compat_70_unp_addsockcred(curlwp, control),
538 			    control);
539 		}
540 		/*
541 		 * Send to paired receive port, and then reduce
542 		 * send buffer hiwater marks to maintain backpressure.
543 		 * Wake up readers.
544 		 */
545 		if (control) {
546 			if (sbappendcontrol(rcv, m, control) != 0)
547 				control = NULL;
548 		} else {
549 			switch(so->so_type) {
550 			case SOCK_SEQPACKET:
551 				sbappendrecord(rcv, m);
552 				break;
553 			case SOCK_STREAM:
554 				sbappend(rcv, m);
555 				break;
556 			default:
557 				panic("uipc_usrreq");
558 				break;
559 			}
560 		}
561 		snd->sb_mbmax -=
562 		    rcv->sb_mbcnt - unp->unp_conn->unp_mbcnt;
563 		unp->unp_conn->unp_mbcnt = rcv->sb_mbcnt;
564 		newhiwat = snd->sb_hiwat -
565 		    (rcv->sb_cc - unp->unp_conn->unp_cc);
566 		(void)chgsbsize(so->so_uidinfo,
567 		    &snd->sb_hiwat, newhiwat, RLIM_INFINITY);
568 		unp->unp_conn->unp_cc = rcv->sb_cc;
569 		sorwakeup(so2);
570 #undef snd
571 #undef rcv
572 		if (control != NULL) {
573 			unp_dispose(control);
574 			m_freem(control);
575 		}
576 		break;
577 
578 	default:
579 		panic("uipc 4");
580 	}
581 
582 	return error;
583 }
584 
585 static int
586 unp_sendoob(struct socket *so, struct mbuf *m, struct mbuf * control)
587 {
588 	KASSERT(solocked(so));
589 
590 	m_freem(m);
591 	m_freem(control);
592 
593 	return EOPNOTSUPP;
594 }
595 
596 /*
597  * Unix domain socket option processing.
598  */
599 int
600 uipc_ctloutput(int op, struct socket *so, struct sockopt *sopt)
601 {
602 	struct unpcb *unp = sotounpcb(so);
603 	int optval = 0, error = 0;
604 
605 	KASSERT(solocked(so));
606 
607 	if (sopt->sopt_level != 0) {
608 		error = ENOPROTOOPT;
609 	} else switch (op) {
610 
611 	case PRCO_SETOPT:
612 		switch (sopt->sopt_name) {
613 		case LOCAL_OCREDS:
614 			if (!compat70_ocreds_valid)  {
615 				error = ENOPROTOOPT;
616 				break;
617 			}
618 			/* FALLTHROUGH */
619 		case LOCAL_CREDS:
620 		case LOCAL_CONNWAIT:
621 			error = sockopt_getint(sopt, &optval);
622 			if (error)
623 				break;
624 			switch (sopt->sopt_name) {
625 #define	OPTSET(bit) \
626 	if (optval) \
627 		unp->unp_flags |= (bit); \
628 	else \
629 		unp->unp_flags &= ~(bit);
630 
631 			case LOCAL_CREDS:
632 				OPTSET(UNP_WANTCRED);
633 				break;
634 			case LOCAL_CONNWAIT:
635 				OPTSET(UNP_CONNWAIT);
636 				break;
637 			case LOCAL_OCREDS:
638 				OPTSET(UNP_OWANTCRED);
639 				break;
640 			}
641 			break;
642 #undef OPTSET
643 
644 		default:
645 			error = ENOPROTOOPT;
646 			break;
647 		}
648 		break;
649 
650 	case PRCO_GETOPT:
651 		sounlock(so);
652 		switch (sopt->sopt_name) {
653 		case LOCAL_PEEREID:
654 			if (unp->unp_flags & UNP_EIDSVALID) {
655 				error = sockopt_set(sopt, &unp->unp_connid,
656 				    sizeof(unp->unp_connid));
657 			} else {
658 				error = EINVAL;
659 			}
660 			break;
661 		case LOCAL_CREDS:
662 #define	OPTBIT(bit)	(unp->unp_flags & (bit) ? 1 : 0)
663 
664 			optval = OPTBIT(UNP_WANTCRED);
665 			error = sockopt_setint(sopt, optval);
666 			break;
667 		case LOCAL_OCREDS:
668 			if (compat70_ocreds_valid) {
669 				optval = OPTBIT(UNP_OWANTCRED);
670 				error = sockopt_setint(sopt, optval);
671 				break;
672 			}
673 #undef OPTBIT
674 			/* FALLTHROUGH */
675 		default:
676 			error = ENOPROTOOPT;
677 			break;
678 		}
679 		solock(so);
680 		break;
681 	}
682 	return (error);
683 }
684 
685 /*
686  * Both send and receive buffers are allocated PIPSIZ bytes of buffering
687  * for stream sockets, although the total for sender and receiver is
688  * actually only PIPSIZ.
689  * Datagram sockets really use the sendspace as the maximum datagram size,
690  * and don't really want to reserve the sendspace.  Their recvspace should
691  * be large enough for at least one max-size datagram plus address.
692  */
693 #ifndef PIPSIZ
694 #define	PIPSIZ	8192
695 #endif
696 u_long	unpst_sendspace = PIPSIZ;
697 u_long	unpst_recvspace = PIPSIZ;
698 u_long	unpdg_sendspace = 2*1024;	/* really max datagram size */
699 u_long	unpdg_recvspace = 16*1024;
700 
701 u_int	unp_rights;			/* files in flight */
702 u_int	unp_rights_ratio = 2;		/* limit, fraction of maxfiles */
703 
704 static int
705 unp_attach(struct socket *so, int proto)
706 {
707 	struct unpcb *unp = sotounpcb(so);
708 	u_long sndspc, rcvspc;
709 	int error;
710 
711 	KASSERT(unp == NULL);
712 
713 	switch (so->so_type) {
714 	case SOCK_SEQPACKET:
715 		/* FALLTHROUGH */
716 	case SOCK_STREAM:
717 		if (so->so_lock == NULL) {
718 			so->so_lock = mutex_obj_alloc(MUTEX_DEFAULT, IPL_NONE);
719 			solock(so);
720 		}
721 		sndspc = unpst_sendspace;
722 		rcvspc = unpst_recvspace;
723 		break;
724 
725 	case SOCK_DGRAM:
726 		if (so->so_lock == NULL) {
727 			mutex_obj_hold(uipc_lock);
728 			so->so_lock = uipc_lock;
729 			solock(so);
730 		}
731 		sndspc = unpdg_sendspace;
732 		rcvspc = unpdg_recvspace;
733 		break;
734 
735 	default:
736 		panic("unp_attach");
737 	}
738 
739 	if (so->so_snd.sb_hiwat == 0 || so->so_rcv.sb_hiwat == 0) {
740 		error = soreserve(so, sndspc, rcvspc);
741 		if (error) {
742 			return error;
743 		}
744 	}
745 
746 	unp = kmem_zalloc(sizeof(*unp), KM_SLEEP);
747 	nanotime(&unp->unp_ctime);
748 	unp->unp_socket = so;
749 	so->so_pcb = unp;
750 
751 	KASSERT(solocked(so));
752 	return 0;
753 }
754 
755 static void
756 unp_detach(struct socket *so)
757 {
758 	struct unpcb *unp;
759 	vnode_t *vp;
760 
761 	unp = sotounpcb(so);
762 	KASSERT(unp != NULL);
763 	KASSERT(solocked(so));
764  retry:
765 	if ((vp = unp->unp_vnode) != NULL) {
766 		sounlock(so);
767 		/* Acquire v_interlock to protect against unp_connect(). */
768 		/* XXXAD racy */
769 		mutex_enter(vp->v_interlock);
770 		vp->v_socket = NULL;
771 		mutex_exit(vp->v_interlock);
772 		vrele(vp);
773 		solock(so);
774 		unp->unp_vnode = NULL;
775 	}
776 	if (unp->unp_conn)
777 		unp_disconnect1(unp);
778 	while (unp->unp_refs) {
779 		KASSERT(solocked2(so, unp->unp_refs->unp_socket));
780 		if (unp_drop(unp->unp_refs, ECONNRESET)) {
781 			solock(so);
782 			goto retry;
783 		}
784 	}
785 	soisdisconnected(so);
786 	so->so_pcb = NULL;
787 	if (unp_rights) {
788 		/*
789 		 * Normally the receive buffer is flushed later, in sofree,
790 		 * but if our receive buffer holds references to files that
791 		 * are now garbage, we will enqueue those file references to
792 		 * the garbage collector and kick it into action.
793 		 */
794 		sorflush(so);
795 		unp_free(unp);
796 		unp_thread_kick();
797 	} else
798 		unp_free(unp);
799 }
800 
801 static int
802 unp_accept(struct socket *so, struct sockaddr *nam)
803 {
804 	struct unpcb *unp = sotounpcb(so);
805 	struct socket *so2;
806 
807 	KASSERT(solocked(so));
808 	KASSERT(nam != NULL);
809 
810 	/* XXX code review required to determine if unp can ever be NULL */
811 	if (unp == NULL)
812 		return EINVAL;
813 
814 	KASSERT(so->so_lock == uipc_lock);
815 	/*
816 	 * Mark the initiating STREAM socket as connected *ONLY*
817 	 * after it's been accepted.  This prevents a client from
818 	 * overrunning a server and receiving ECONNREFUSED.
819 	 */
820 	if (unp->unp_conn == NULL) {
821 		/*
822 		 * This will use the empty socket and will not
823 		 * allocate.
824 		 */
825 		unp_setaddr(so, nam, true);
826 		return 0;
827 	}
828 	so2 = unp->unp_conn->unp_socket;
829 	if (so2->so_state & SS_ISCONNECTING) {
830 		KASSERT(solocked2(so, so->so_head));
831 		KASSERT(solocked2(so2, so->so_head));
832 		soisconnected(so2);
833 	}
834 	/*
835 	 * If the connection is fully established, break the
836 	 * association with uipc_lock and give the connected
837 	 * pair a separate lock to share.
838 	 * There is a race here: sotounpcb(so2)->unp_streamlock
839 	 * is not locked, so when changing so2->so_lock
840 	 * another thread can grab it while so->so_lock is still
841 	 * pointing to the (locked) uipc_lock.
842 	 * this should be harmless, except that this makes
843 	 * solocked2() and solocked() unreliable.
844 	 * Another problem is that unp_setaddr() expects the
845 	 * the socket locked. Grabing sotounpcb(so2)->unp_streamlock
846 	 * fixes both issues.
847 	 */
848 	mutex_enter(sotounpcb(so2)->unp_streamlock);
849 	unp_setpeerlocks(so2, so);
850 	/*
851 	 * Only now return peer's address, as we may need to
852 	 * block in order to allocate memory.
853 	 *
854 	 * XXX Minor race: connection can be broken while
855 	 * lock is dropped in unp_setaddr().  We will return
856 	 * error == 0 and sun_noname as the peer address.
857 	 */
858 	unp_setaddr(so, nam, true);
859 	/* so_lock now points to unp_streamlock */
860 	mutex_exit(so2->so_lock);
861 	return 0;
862 }
863 
864 static int
865 unp_ioctl(struct socket *so, u_long cmd, void *nam, struct ifnet *ifp)
866 {
867 	return EOPNOTSUPP;
868 }
869 
870 static int
871 unp_stat(struct socket *so, struct stat *ub)
872 {
873 	struct unpcb *unp;
874 	struct socket *so2;
875 
876 	KASSERT(solocked(so));
877 
878 	unp = sotounpcb(so);
879 	if (unp == NULL)
880 		return EINVAL;
881 
882 	ub->st_blksize = so->so_snd.sb_hiwat;
883 	switch (so->so_type) {
884 	case SOCK_SEQPACKET: /* FALLTHROUGH */
885 	case SOCK_STREAM:
886 		if (unp->unp_conn == 0)
887 			break;
888 
889 		so2 = unp->unp_conn->unp_socket;
890 		KASSERT(solocked2(so, so2));
891 		ub->st_blksize += so2->so_rcv.sb_cc;
892 		break;
893 	default:
894 		break;
895 	}
896 	ub->st_dev = NODEV;
897 	if (unp->unp_ino == 0)
898 		unp->unp_ino = unp_ino++;
899 	ub->st_atimespec = ub->st_mtimespec = ub->st_ctimespec = unp->unp_ctime;
900 	ub->st_ino = unp->unp_ino;
901 	ub->st_uid = so->so_uidinfo->ui_uid;
902 	ub->st_gid = so->so_egid;
903 	return (0);
904 }
905 
906 static int
907 unp_peeraddr(struct socket *so, struct sockaddr *nam)
908 {
909 	KASSERT(solocked(so));
910 	KASSERT(sotounpcb(so) != NULL);
911 	KASSERT(nam != NULL);
912 
913 	unp_setaddr(so, nam, true);
914 	return 0;
915 }
916 
917 static int
918 unp_sockaddr(struct socket *so, struct sockaddr *nam)
919 {
920 	KASSERT(solocked(so));
921 	KASSERT(sotounpcb(so) != NULL);
922 	KASSERT(nam != NULL);
923 
924 	unp_setaddr(so, nam, false);
925 	return 0;
926 }
927 
928 /*
929  * we only need to perform this allocation until syscalls other than
930  * bind are adjusted to use sockaddr_big.
931  */
932 static struct sockaddr_un *
933 makeun_sb(struct sockaddr *nam, size_t *addrlen)
934 {
935 	struct sockaddr_un *sun;
936 
937 	*addrlen = nam->sa_len + 1;
938 	sun = malloc(*addrlen, M_SONAME, M_WAITOK);
939 	memcpy(sun, nam, nam->sa_len);
940 	*(((char *)sun) + nam->sa_len) = '\0';
941 	return sun;
942 }
943 
944 static int
945 unp_bind(struct socket *so, struct sockaddr *nam, struct lwp *l)
946 {
947 	struct sockaddr_un *sun;
948 	struct unpcb *unp;
949 	vnode_t *vp;
950 	struct vattr vattr;
951 	size_t addrlen;
952 	int error;
953 	struct pathbuf *pb;
954 	struct nameidata nd;
955 	proc_t *p;
956 
957 	unp = sotounpcb(so);
958 
959 	KASSERT(solocked(so));
960 	KASSERT(unp != NULL);
961 	KASSERT(nam != NULL);
962 
963 	if (unp->unp_vnode != NULL)
964 		return (EINVAL);
965 	if ((unp->unp_flags & UNP_BUSY) != 0) {
966 		/*
967 		 * EALREADY may not be strictly accurate, but since this
968 		 * is a major application error it's hardly a big deal.
969 		 */
970 		return (EALREADY);
971 	}
972 	unp->unp_flags |= UNP_BUSY;
973 	sounlock(so);
974 
975 	p = l->l_proc;
976 	sun = makeun_sb(nam, &addrlen);
977 
978 	pb = pathbuf_create(sun->sun_path);
979 	if (pb == NULL) {
980 		error = ENOMEM;
981 		goto bad;
982 	}
983 	NDINIT(&nd, CREATE, FOLLOW | LOCKPARENT | TRYEMULROOT, pb);
984 
985 /* SHOULD BE ABLE TO ADOPT EXISTING AND wakeup() ALA FIFO's */
986 	if ((error = namei(&nd)) != 0) {
987 		pathbuf_destroy(pb);
988 		goto bad;
989 	}
990 	vp = nd.ni_vp;
991 	if (vp != NULL) {
992 		VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
993 		if (nd.ni_dvp == vp)
994 			vrele(nd.ni_dvp);
995 		else
996 			vput(nd.ni_dvp);
997 		vrele(vp);
998 		pathbuf_destroy(pb);
999 		error = EADDRINUSE;
1000 		goto bad;
1001 	}
1002 	vattr_null(&vattr);
1003 	vattr.va_type = VSOCK;
1004 	vattr.va_mode = ACCESSPERMS & ~(p->p_cwdi->cwdi_cmask);
1005 	error = VOP_CREATE(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd, &vattr);
1006 	if (error) {
1007 		vput(nd.ni_dvp);
1008 		pathbuf_destroy(pb);
1009 		goto bad;
1010 	}
1011 	vp = nd.ni_vp;
1012 	vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
1013 	solock(so);
1014 	vp->v_socket = unp->unp_socket;
1015 	unp->unp_vnode = vp;
1016 	unp->unp_addrlen = addrlen;
1017 	unp->unp_addr = sun;
1018 	VOP_UNLOCK(vp);
1019 	vput(nd.ni_dvp);
1020 	unp->unp_flags &= ~UNP_BUSY;
1021 	pathbuf_destroy(pb);
1022 	return (0);
1023 
1024  bad:
1025 	free(sun, M_SONAME);
1026 	solock(so);
1027 	unp->unp_flags &= ~UNP_BUSY;
1028 	return (error);
1029 }
1030 
1031 static int
1032 unp_listen(struct socket *so, struct lwp *l)
1033 {
1034 	struct unpcb *unp = sotounpcb(so);
1035 
1036 	KASSERT(solocked(so));
1037 	KASSERT(unp != NULL);
1038 
1039 	/*
1040 	 * If the socket can accept a connection, it must be
1041 	 * locked by uipc_lock.
1042 	 */
1043 	unp_resetlock(so);
1044 	if (unp->unp_vnode == NULL)
1045 		return EINVAL;
1046 
1047 	unp_connid(l, unp, UNP_EIDSBIND);
1048 	return 0;
1049 }
1050 
1051 static int
1052 unp_disconnect(struct socket *so)
1053 {
1054 	KASSERT(solocked(so));
1055 	KASSERT(sotounpcb(so) != NULL);
1056 
1057 	unp_disconnect1(sotounpcb(so));
1058 	return 0;
1059 }
1060 
1061 static int
1062 unp_shutdown(struct socket *so)
1063 {
1064 	KASSERT(solocked(so));
1065 	KASSERT(sotounpcb(so) != NULL);
1066 
1067 	socantsendmore(so);
1068 	unp_shutdown1(sotounpcb(so));
1069 	return 0;
1070 }
1071 
1072 static int
1073 unp_abort(struct socket *so)
1074 {
1075 	KASSERT(solocked(so));
1076 	KASSERT(sotounpcb(so) != NULL);
1077 
1078 	(void)unp_drop(sotounpcb(so), ECONNABORTED);
1079 	KASSERT(so->so_head == NULL);
1080 	KASSERT(so->so_pcb != NULL);
1081 	unp_detach(so);
1082 	return 0;
1083 }
1084 
1085 static int
1086 unp_connect1(struct socket *so, struct socket *so2, struct lwp *l)
1087 {
1088 	struct unpcb *unp = sotounpcb(so);
1089 	struct unpcb *unp2;
1090 
1091 	if (so2->so_type != so->so_type)
1092 		return EPROTOTYPE;
1093 
1094 	/*
1095 	 * All three sockets involved must be locked by same lock:
1096 	 *
1097 	 * local endpoint (so)
1098 	 * remote endpoint (so2)
1099 	 * queue head (so2->so_head, only if PR_CONNREQUIRED)
1100 	 */
1101 	KASSERT(solocked2(so, so2));
1102 	KASSERT(so->so_head == NULL);
1103 	if (so2->so_head != NULL) {
1104 		KASSERT(so2->so_lock == uipc_lock);
1105 		KASSERT(solocked2(so2, so2->so_head));
1106 	}
1107 
1108 	unp2 = sotounpcb(so2);
1109 	unp->unp_conn = unp2;
1110 
1111 	switch (so->so_type) {
1112 
1113 	case SOCK_DGRAM:
1114 		unp->unp_nextref = unp2->unp_refs;
1115 		unp2->unp_refs = unp;
1116 		soisconnected(so);
1117 		break;
1118 
1119 	case SOCK_SEQPACKET: /* FALLTHROUGH */
1120 	case SOCK_STREAM:
1121 
1122 		/*
1123 		 * SOCK_SEQPACKET and SOCK_STREAM cases are handled by callers
1124 		 * which are unp_connect() or unp_connect2().
1125 		 */
1126 
1127 		break;
1128 
1129 	default:
1130 		panic("unp_connect1");
1131 	}
1132 
1133 	return 0;
1134 }
1135 
1136 int
1137 unp_connect(struct socket *so, struct sockaddr *nam, struct lwp *l)
1138 {
1139 	struct sockaddr_un *sun;
1140 	vnode_t *vp;
1141 	struct socket *so2, *so3;
1142 	struct unpcb *unp, *unp2, *unp3;
1143 	size_t addrlen;
1144 	int error;
1145 	struct pathbuf *pb;
1146 	struct nameidata nd;
1147 
1148 	unp = sotounpcb(so);
1149 	if ((unp->unp_flags & UNP_BUSY) != 0) {
1150 		/*
1151 		 * EALREADY may not be strictly accurate, but since this
1152 		 * is a major application error it's hardly a big deal.
1153 		 */
1154 		return (EALREADY);
1155 	}
1156 	unp->unp_flags |= UNP_BUSY;
1157 	sounlock(so);
1158 
1159 	sun = makeun_sb(nam, &addrlen);
1160 	pb = pathbuf_create(sun->sun_path);
1161 	if (pb == NULL) {
1162 		error = ENOMEM;
1163 		goto bad2;
1164 	}
1165 
1166 	NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF | TRYEMULROOT, pb);
1167 
1168 	if ((error = namei(&nd)) != 0) {
1169 		pathbuf_destroy(pb);
1170 		goto bad2;
1171 	}
1172 	vp = nd.ni_vp;
1173 	pathbuf_destroy(pb);
1174 	if (vp->v_type != VSOCK) {
1175 		error = ENOTSOCK;
1176 		goto bad;
1177 	}
1178 	if ((error = VOP_ACCESS(vp, VWRITE, l->l_cred)) != 0)
1179 		goto bad;
1180 	/* Acquire v_interlock to protect against unp_detach(). */
1181 	mutex_enter(vp->v_interlock);
1182 	so2 = vp->v_socket;
1183 	if (so2 == NULL) {
1184 		mutex_exit(vp->v_interlock);
1185 		error = ECONNREFUSED;
1186 		goto bad;
1187 	}
1188 	if (so->so_type != so2->so_type) {
1189 		mutex_exit(vp->v_interlock);
1190 		error = EPROTOTYPE;
1191 		goto bad;
1192 	}
1193 	solock(so);
1194 	unp_resetlock(so);
1195 	mutex_exit(vp->v_interlock);
1196 	if ((so->so_proto->pr_flags & PR_CONNREQUIRED) != 0) {
1197 		/*
1198 		 * This may seem somewhat fragile but is OK: if we can
1199 		 * see SO_ACCEPTCONN set on the endpoint, then it must
1200 		 * be locked by the domain-wide uipc_lock.
1201 		 */
1202 		KASSERT((so2->so_options & SO_ACCEPTCONN) == 0 ||
1203 		    so2->so_lock == uipc_lock);
1204 		if ((so2->so_options & SO_ACCEPTCONN) == 0 ||
1205 		    (so3 = sonewconn(so2, false)) == NULL) {
1206 			error = ECONNREFUSED;
1207 			sounlock(so);
1208 			goto bad;
1209 		}
1210 		unp2 = sotounpcb(so2);
1211 		unp3 = sotounpcb(so3);
1212 		if (unp2->unp_addr) {
1213 			unp3->unp_addr = malloc(unp2->unp_addrlen,
1214 			    M_SONAME, M_WAITOK);
1215 			memcpy(unp3->unp_addr, unp2->unp_addr,
1216 			    unp2->unp_addrlen);
1217 			unp3->unp_addrlen = unp2->unp_addrlen;
1218 		}
1219 		unp3->unp_flags = unp2->unp_flags;
1220 		so2 = so3;
1221 		/*
1222 		 * The connector's (client's) credentials are copied from its
1223 		 * process structure at the time of connect() (which is now).
1224 		 */
1225 		unp_connid(l, unp3, UNP_EIDSVALID);
1226 		 /*
1227 		  * The receiver's (server's) credentials are copied from the
1228 		  * unp_peercred member of socket on which the former called
1229 		  * listen(); unp_listen() cached that process's credentials
1230 		  * at that time so we can use them now.
1231 		  */
1232 		if (unp2->unp_flags & UNP_EIDSBIND) {
1233 			memcpy(&unp->unp_connid, &unp2->unp_connid,
1234 			    sizeof(unp->unp_connid));
1235 			unp->unp_flags |= UNP_EIDSVALID;
1236 		}
1237 	}
1238 	error = unp_connect1(so, so2, l);
1239 	if (error) {
1240 		sounlock(so);
1241 		goto bad;
1242 	}
1243 	unp2 = sotounpcb(so2);
1244 	switch (so->so_type) {
1245 
1246 	/*
1247 	 * SOCK_DGRAM and default cases are handled in prior call to
1248 	 * unp_connect1(), do not add a default case without fixing
1249 	 * unp_connect1().
1250 	 */
1251 
1252 	case SOCK_SEQPACKET: /* FALLTHROUGH */
1253 	case SOCK_STREAM:
1254 		unp2->unp_conn = unp;
1255 		if ((unp->unp_flags | unp2->unp_flags) & UNP_CONNWAIT)
1256 			soisconnecting(so);
1257 		else
1258 			soisconnected(so);
1259 		soisconnected(so2);
1260 		/*
1261 		 * If the connection is fully established, break the
1262 		 * association with uipc_lock and give the connected
1263 		 * pair a separate lock to share.
1264 		 */
1265 		KASSERT(so2->so_head != NULL);
1266 		unp_setpeerlocks(so, so2);
1267 		break;
1268 
1269 	}
1270 	sounlock(so);
1271  bad:
1272 	vput(vp);
1273  bad2:
1274 	free(sun, M_SONAME);
1275 	solock(so);
1276 	unp->unp_flags &= ~UNP_BUSY;
1277 	return (error);
1278 }
1279 
1280 int
1281 unp_connect2(struct socket *so, struct socket *so2)
1282 {
1283 	struct unpcb *unp = sotounpcb(so);
1284 	struct unpcb *unp2;
1285 	int error = 0;
1286 
1287 	KASSERT(solocked2(so, so2));
1288 
1289 	error = unp_connect1(so, so2, curlwp);
1290 	if (error)
1291 		return error;
1292 
1293 	unp2 = sotounpcb(so2);
1294 	switch (so->so_type) {
1295 
1296 	/*
1297 	 * SOCK_DGRAM and default cases are handled in prior call to
1298 	 * unp_connect1(), do not add a default case without fixing
1299 	 * unp_connect1().
1300 	 */
1301 
1302 	case SOCK_SEQPACKET: /* FALLTHROUGH */
1303 	case SOCK_STREAM:
1304 		unp2->unp_conn = unp;
1305 		soisconnected(so);
1306 		soisconnected(so2);
1307 		break;
1308 
1309 	}
1310 	return error;
1311 }
1312 
1313 static void
1314 unp_disconnect1(struct unpcb *unp)
1315 {
1316 	struct unpcb *unp2 = unp->unp_conn;
1317 	struct socket *so;
1318 
1319 	if (unp2 == 0)
1320 		return;
1321 	unp->unp_conn = 0;
1322 	so = unp->unp_socket;
1323 	switch (so->so_type) {
1324 	case SOCK_DGRAM:
1325 		if (unp2->unp_refs == unp)
1326 			unp2->unp_refs = unp->unp_nextref;
1327 		else {
1328 			unp2 = unp2->unp_refs;
1329 			for (;;) {
1330 				KASSERT(solocked2(so, unp2->unp_socket));
1331 				if (unp2 == 0)
1332 					panic("unp_disconnect1");
1333 				if (unp2->unp_nextref == unp)
1334 					break;
1335 				unp2 = unp2->unp_nextref;
1336 			}
1337 			unp2->unp_nextref = unp->unp_nextref;
1338 		}
1339 		unp->unp_nextref = 0;
1340 		so->so_state &= ~SS_ISCONNECTED;
1341 		break;
1342 
1343 	case SOCK_SEQPACKET: /* FALLTHROUGH */
1344 	case SOCK_STREAM:
1345 		KASSERT(solocked2(so, unp2->unp_socket));
1346 		soisdisconnected(so);
1347 		unp2->unp_conn = 0;
1348 		soisdisconnected(unp2->unp_socket);
1349 		break;
1350 	}
1351 }
1352 
1353 static void
1354 unp_shutdown1(struct unpcb *unp)
1355 {
1356 	struct socket *so;
1357 
1358 	switch(unp->unp_socket->so_type) {
1359 	case SOCK_SEQPACKET: /* FALLTHROUGH */
1360 	case SOCK_STREAM:
1361 		if (unp->unp_conn && (so = unp->unp_conn->unp_socket))
1362 			socantrcvmore(so);
1363 		break;
1364 	default:
1365 		break;
1366 	}
1367 }
1368 
1369 static bool
1370 unp_drop(struct unpcb *unp, int errno)
1371 {
1372 	struct socket *so = unp->unp_socket;
1373 
1374 	KASSERT(solocked(so));
1375 
1376 	so->so_error = errno;
1377 	unp_disconnect1(unp);
1378 	if (so->so_head) {
1379 		so->so_pcb = NULL;
1380 		/* sofree() drops the socket lock */
1381 		sofree(so);
1382 		unp_free(unp);
1383 		return true;
1384 	}
1385 	return false;
1386 }
1387 
1388 #ifdef notdef
1389 unp_drain(void)
1390 {
1391 
1392 }
1393 #endif
1394 
1395 int
1396 unp_externalize(struct mbuf *rights, struct lwp *l, int flags)
1397 {
1398 	struct cmsghdr * const cm = mtod(rights, struct cmsghdr *);
1399 	struct proc * const p = l->l_proc;
1400 	file_t **rp;
1401 	int error = 0;
1402 
1403 	const size_t nfds = (cm->cmsg_len - CMSG_ALIGN(sizeof(*cm))) /
1404 	    sizeof(file_t *);
1405 	if (nfds == 0)
1406 		goto noop;
1407 
1408 	int * const fdp = kmem_alloc(nfds * sizeof(int), KM_SLEEP);
1409 	rw_enter(&p->p_cwdi->cwdi_lock, RW_READER);
1410 
1411 	/* Make sure the recipient should be able to see the files.. */
1412 	rp = (file_t **)CMSG_DATA(cm);
1413 	for (size_t i = 0; i < nfds; i++) {
1414 		file_t * const fp = *rp++;
1415 		if (fp == NULL) {
1416 			error = EINVAL;
1417 			goto out;
1418 		}
1419 		/*
1420 		 * If we are in a chroot'ed directory, and
1421 		 * someone wants to pass us a directory, make
1422 		 * sure it's inside the subtree we're allowed
1423 		 * to access.
1424 		 */
1425 		if (p->p_cwdi->cwdi_rdir != NULL && fp->f_type == DTYPE_VNODE) {
1426 			vnode_t *vp = fp->f_vnode;
1427 			if ((vp->v_type == VDIR) &&
1428 			    !vn_isunder(vp, p->p_cwdi->cwdi_rdir, l)) {
1429 				error = EPERM;
1430 				goto out;
1431 			}
1432 		}
1433 	}
1434 
1435  restart:
1436 	/*
1437 	 * First loop -- allocate file descriptor table slots for the
1438 	 * new files.
1439 	 */
1440 	for (size_t i = 0; i < nfds; i++) {
1441 		if ((error = fd_alloc(p, 0, &fdp[i])) != 0) {
1442 			/*
1443 			 * Back out what we've done so far.
1444 			 */
1445 			while (i-- > 0) {
1446 				fd_abort(p, NULL, fdp[i]);
1447 			}
1448 			if (error == ENOSPC) {
1449 				fd_tryexpand(p);
1450 				error = 0;
1451 				goto restart;
1452 			}
1453 			/*
1454 			 * This is the error that has historically
1455 			 * been returned, and some callers may
1456 			 * expect it.
1457 			 */
1458 			error = EMSGSIZE;
1459 			goto out;
1460 		}
1461 	}
1462 
1463 	/*
1464 	 * Now that adding them has succeeded, update all of the
1465 	 * file passing state and affix the descriptors.
1466 	 */
1467 	rp = (file_t **)CMSG_DATA(cm);
1468 	int *ofdp = (int *)CMSG_DATA(cm);
1469 	for (size_t i = 0; i < nfds; i++) {
1470 		file_t * const fp = *rp++;
1471 		const int fd = fdp[i];
1472 		atomic_dec_uint(&unp_rights);
1473 		fd_set_exclose(l, fd, (flags & O_CLOEXEC) != 0);
1474 		fd_affix(p, fp, fd);
1475 		/*
1476 		 * Done with this file pointer, replace it with a fd;
1477 		 */
1478 		*ofdp++ = fd;
1479 		mutex_enter(&fp->f_lock);
1480 		fp->f_msgcount--;
1481 		mutex_exit(&fp->f_lock);
1482 		/*
1483 		 * Note that fd_affix() adds a reference to the file.
1484 		 * The file may already have been closed by another
1485 		 * LWP in the process, so we must drop the reference
1486 		 * added by unp_internalize() with closef().
1487 		 */
1488 		closef(fp);
1489 	}
1490 
1491 	/*
1492 	 * Adjust length, in case of transition from large file_t
1493 	 * pointers to ints.
1494 	 */
1495 	if (sizeof(file_t *) != sizeof(int)) {
1496 		cm->cmsg_len = CMSG_LEN(nfds * sizeof(int));
1497 		rights->m_len = CMSG_SPACE(nfds * sizeof(int));
1498 	}
1499  out:
1500 	if (__predict_false(error != 0)) {
1501 		file_t **const fpp = (file_t **)CMSG_DATA(cm);
1502 		for (size_t i = 0; i < nfds; i++)
1503 			unp_discard_now(fpp[i]);
1504 		/*
1505 		 * Truncate the array so that nobody will try to interpret
1506 		 * what is now garbage in it.
1507 		 */
1508 		cm->cmsg_len = CMSG_LEN(0);
1509 		rights->m_len = CMSG_SPACE(0);
1510 	}
1511 	rw_exit(&p->p_cwdi->cwdi_lock);
1512 	kmem_free(fdp, nfds * sizeof(int));
1513 
1514  noop:
1515 	/*
1516 	 * Don't disclose kernel memory in the alignment space.
1517 	 */
1518 	KASSERT(cm->cmsg_len <= rights->m_len);
1519 	memset(&mtod(rights, char *)[cm->cmsg_len], 0, rights->m_len -
1520 	    cm->cmsg_len);
1521 	return error;
1522 }
1523 
1524 static int
1525 unp_internalize(struct mbuf **controlp)
1526 {
1527 	filedesc_t *fdescp = curlwp->l_fd;
1528 	fdtab_t *dt;
1529 	struct mbuf *control = *controlp;
1530 	struct cmsghdr *newcm, *cm = mtod(control, struct cmsghdr *);
1531 	file_t **rp, **files;
1532 	file_t *fp;
1533 	int i, fd, *fdp;
1534 	int nfds, error;
1535 	u_int maxmsg;
1536 
1537 	error = 0;
1538 	newcm = NULL;
1539 
1540 	/* Sanity check the control message header. */
1541 	if (cm->cmsg_type != SCM_RIGHTS || cm->cmsg_level != SOL_SOCKET ||
1542 	    cm->cmsg_len > control->m_len ||
1543 	    cm->cmsg_len < CMSG_ALIGN(sizeof(*cm)))
1544 		return (EINVAL);
1545 
1546 	/*
1547 	 * Verify that the file descriptors are valid, and acquire
1548 	 * a reference to each.
1549 	 */
1550 	nfds = (cm->cmsg_len - CMSG_ALIGN(sizeof(*cm))) / sizeof(int);
1551 	fdp = (int *)CMSG_DATA(cm);
1552 	maxmsg = maxfiles / unp_rights_ratio;
1553 	for (i = 0; i < nfds; i++) {
1554 		fd = *fdp++;
1555 		if (atomic_inc_uint_nv(&unp_rights) > maxmsg) {
1556 			atomic_dec_uint(&unp_rights);
1557 			nfds = i;
1558 			error = EAGAIN;
1559 			goto out;
1560 		}
1561 		if ((fp = fd_getfile(fd)) == NULL
1562 		    || fp->f_type == DTYPE_KQUEUE) {
1563 		    	if (fp)
1564 		    		fd_putfile(fd);
1565 			atomic_dec_uint(&unp_rights);
1566 			nfds = i;
1567 			error = EBADF;
1568 			goto out;
1569 		}
1570 	}
1571 
1572 	/* Allocate new space and copy header into it. */
1573 	newcm = malloc(CMSG_SPACE(nfds * sizeof(file_t *)), M_MBUF, M_WAITOK);
1574 	if (newcm == NULL) {
1575 		error = E2BIG;
1576 		goto out;
1577 	}
1578 	memcpy(newcm, cm, sizeof(struct cmsghdr));
1579 	memset(newcm + 1, 0, CMSG_LEN(0) - sizeof(struct cmsghdr));
1580 	files = (file_t **)CMSG_DATA(newcm);
1581 
1582 	/*
1583 	 * Transform the file descriptors into file_t pointers, in
1584 	 * reverse order so that if pointers are bigger than ints, the
1585 	 * int won't get until we're done.  No need to lock, as we have
1586 	 * already validated the descriptors with fd_getfile().
1587 	 */
1588 	fdp = (int *)CMSG_DATA(cm) + nfds;
1589 	rp = files + nfds;
1590 	for (i = 0; i < nfds; i++) {
1591 		dt = atomic_load_consume(&fdescp->fd_dt);
1592 		fp = atomic_load_consume(&dt->dt_ff[*--fdp]->ff_file);
1593 		KASSERT(fp != NULL);
1594 		mutex_enter(&fp->f_lock);
1595 		*--rp = fp;
1596 		fp->f_count++;
1597 		fp->f_msgcount++;
1598 		mutex_exit(&fp->f_lock);
1599 	}
1600 
1601  out:
1602  	/* Release descriptor references. */
1603 	fdp = (int *)CMSG_DATA(cm);
1604 	for (i = 0; i < nfds; i++) {
1605 		fd_putfile(*fdp++);
1606 		if (error != 0) {
1607 			atomic_dec_uint(&unp_rights);
1608 		}
1609 	}
1610 
1611 	if (error == 0) {
1612 		if (control->m_flags & M_EXT) {
1613 			m_freem(control);
1614 			*controlp = control = m_get(M_WAIT, MT_CONTROL);
1615 		}
1616 		MEXTADD(control, newcm, CMSG_SPACE(nfds * sizeof(file_t *)),
1617 		    M_MBUF, NULL, NULL);
1618 		cm = newcm;
1619 		/*
1620 		 * Adjust message & mbuf to note amount of space
1621 		 * actually used.
1622 		 */
1623 		cm->cmsg_len = CMSG_LEN(nfds * sizeof(file_t *));
1624 		control->m_len = CMSG_SPACE(nfds * sizeof(file_t *));
1625 	}
1626 
1627 	return error;
1628 }
1629 
1630 struct mbuf *
1631 unp_addsockcred(struct lwp *l, struct mbuf *control)
1632 {
1633 	struct sockcred *sc;
1634 	struct mbuf *m;
1635 	void *p;
1636 
1637 	m = sbcreatecontrol1(&p, SOCKCREDSIZE(kauth_cred_ngroups(l->l_cred)),
1638 		SCM_CREDS, SOL_SOCKET, M_WAITOK);
1639 	if (m == NULL)
1640 		return control;
1641 
1642 	sc = p;
1643 	sc->sc_pid = l->l_proc->p_pid;
1644 	sc->sc_uid = kauth_cred_getuid(l->l_cred);
1645 	sc->sc_euid = kauth_cred_geteuid(l->l_cred);
1646 	sc->sc_gid = kauth_cred_getgid(l->l_cred);
1647 	sc->sc_egid = kauth_cred_getegid(l->l_cred);
1648 	sc->sc_ngroups = kauth_cred_ngroups(l->l_cred);
1649 
1650 	for (int i = 0; i < sc->sc_ngroups; i++)
1651 		sc->sc_groups[i] = kauth_cred_group(l->l_cred, i);
1652 
1653 	return m_add(control, m);
1654 }
1655 
1656 /*
1657  * Do a mark-sweep GC of files in the system, to free up any which are
1658  * caught in flight to an about-to-be-closed socket.  Additionally,
1659  * process deferred file closures.
1660  */
1661 static void
1662 unp_gc(file_t *dp)
1663 {
1664 	extern	struct domain unixdomain;
1665 	file_t *fp, *np;
1666 	struct socket *so, *so1;
1667 	u_int i, oflags, rflags;
1668 	bool didwork;
1669 
1670 	KASSERT(curlwp == unp_thread_lwp);
1671 	KASSERT(mutex_owned(&filelist_lock));
1672 
1673 	/*
1674 	 * First, process deferred file closures.
1675 	 */
1676 	while (!SLIST_EMPTY(&unp_thread_discard)) {
1677 		fp = SLIST_FIRST(&unp_thread_discard);
1678 		KASSERT(fp->f_unpcount > 0);
1679 		KASSERT(fp->f_count > 0);
1680 		KASSERT(fp->f_msgcount > 0);
1681 		KASSERT(fp->f_count >= fp->f_unpcount);
1682 		KASSERT(fp->f_count >= fp->f_msgcount);
1683 		KASSERT(fp->f_msgcount >= fp->f_unpcount);
1684 		SLIST_REMOVE_HEAD(&unp_thread_discard, f_unplist);
1685 		i = fp->f_unpcount;
1686 		fp->f_unpcount = 0;
1687 		mutex_exit(&filelist_lock);
1688 		for (; i != 0; i--) {
1689 			unp_discard_now(fp);
1690 		}
1691 		mutex_enter(&filelist_lock);
1692 	}
1693 
1694 	/*
1695 	 * Clear mark bits.  Ensure that we don't consider new files
1696 	 * entering the file table during this loop (they will not have
1697 	 * FSCAN set).
1698 	 */
1699 	unp_defer = 0;
1700 	LIST_FOREACH(fp, &filehead, f_list) {
1701 		for (oflags = fp->f_flag;; oflags = rflags) {
1702 			rflags = atomic_cas_uint(&fp->f_flag, oflags,
1703 			    (oflags | FSCAN) & ~(FMARK|FDEFER));
1704 			if (__predict_true(oflags == rflags)) {
1705 				break;
1706 			}
1707 		}
1708 	}
1709 
1710 	/*
1711 	 * Iterate over the set of sockets, marking ones believed (based on
1712 	 * refcount) to be referenced from a process, and marking for rescan
1713 	 * sockets which are queued on a socket.  Recan continues descending
1714 	 * and searching for sockets referenced by sockets (FDEFER), until
1715 	 * there are no more socket->socket references to be discovered.
1716 	 */
1717 	do {
1718 		didwork = false;
1719 		for (fp = LIST_FIRST(&filehead); fp != NULL; fp = np) {
1720 			KASSERT(mutex_owned(&filelist_lock));
1721 			np = LIST_NEXT(fp, f_list);
1722 			mutex_enter(&fp->f_lock);
1723 			if ((fp->f_flag & FDEFER) != 0) {
1724 				atomic_and_uint(&fp->f_flag, ~FDEFER);
1725 				unp_defer--;
1726 				if (fp->f_count == 0) {
1727 					/*
1728 					 * XXX: closef() doesn't pay attention
1729 					 * to FDEFER
1730 					 */
1731 					mutex_exit(&fp->f_lock);
1732 					continue;
1733 				}
1734 			} else {
1735 				if (fp->f_count == 0 ||
1736 				    (fp->f_flag & FMARK) != 0 ||
1737 				    fp->f_count == fp->f_msgcount ||
1738 				    fp->f_unpcount != 0) {
1739 					mutex_exit(&fp->f_lock);
1740 					continue;
1741 				}
1742 			}
1743 			atomic_or_uint(&fp->f_flag, FMARK);
1744 
1745 			if (fp->f_type != DTYPE_SOCKET ||
1746 			    (so = fp->f_socket) == NULL ||
1747 			    so->so_proto->pr_domain != &unixdomain ||
1748 			    (so->so_proto->pr_flags & PR_RIGHTS) == 0) {
1749 				mutex_exit(&fp->f_lock);
1750 				continue;
1751 			}
1752 
1753 			/* Gain file ref, mark our position, and unlock. */
1754 			didwork = true;
1755 			LIST_INSERT_AFTER(fp, dp, f_list);
1756 			fp->f_count++;
1757 			mutex_exit(&fp->f_lock);
1758 			mutex_exit(&filelist_lock);
1759 
1760 			/*
1761 			 * Mark files referenced from sockets queued on the
1762 			 * accept queue as well.
1763 			 */
1764 			solock(so);
1765 			unp_scan(so->so_rcv.sb_mb, unp_mark, 0);
1766 			if ((so->so_options & SO_ACCEPTCONN) != 0) {
1767 				TAILQ_FOREACH(so1, &so->so_q0, so_qe) {
1768 					unp_scan(so1->so_rcv.sb_mb, unp_mark, 0);
1769 				}
1770 				TAILQ_FOREACH(so1, &so->so_q, so_qe) {
1771 					unp_scan(so1->so_rcv.sb_mb, unp_mark, 0);
1772 				}
1773 			}
1774 			sounlock(so);
1775 
1776 			/* Re-lock and restart from where we left off. */
1777 			closef(fp);
1778 			mutex_enter(&filelist_lock);
1779 			np = LIST_NEXT(dp, f_list);
1780 			LIST_REMOVE(dp, f_list);
1781 		}
1782 		/*
1783 		 * Bail early if we did nothing in the loop above.  Could
1784 		 * happen because of concurrent activity causing unp_defer
1785 		 * to get out of sync.
1786 		 */
1787 	} while (unp_defer != 0 && didwork);
1788 
1789 	/*
1790 	 * Sweep pass.
1791 	 *
1792 	 * We grab an extra reference to each of the files that are
1793 	 * not otherwise accessible and then free the rights that are
1794 	 * stored in messages on them.
1795 	 */
1796 	for (fp = LIST_FIRST(&filehead); fp != NULL; fp = np) {
1797 		KASSERT(mutex_owned(&filelist_lock));
1798 		np = LIST_NEXT(fp, f_list);
1799 		mutex_enter(&fp->f_lock);
1800 
1801 		/*
1802 		 * Ignore non-sockets.
1803 		 * Ignore dead sockets, or sockets with pending close.
1804 		 * Ignore sockets obviously referenced elsewhere.
1805 		 * Ignore sockets marked as referenced by our scan.
1806 		 * Ignore new sockets that did not exist during the scan.
1807 		 */
1808 		if (fp->f_type != DTYPE_SOCKET ||
1809 		    fp->f_count == 0 || fp->f_unpcount != 0 ||
1810 		    fp->f_count != fp->f_msgcount ||
1811 		    (fp->f_flag & (FMARK | FSCAN)) != FSCAN) {
1812 			mutex_exit(&fp->f_lock);
1813 			continue;
1814 		}
1815 
1816 		/* Gain file ref, mark our position, and unlock. */
1817 		LIST_INSERT_AFTER(fp, dp, f_list);
1818 		fp->f_count++;
1819 		mutex_exit(&fp->f_lock);
1820 		mutex_exit(&filelist_lock);
1821 
1822 		/*
1823 		 * Flush all data from the socket's receive buffer.
1824 		 * This will cause files referenced only by the
1825 		 * socket to be queued for close.
1826 		 */
1827 		so = fp->f_socket;
1828 		solock(so);
1829 		sorflush(so);
1830 		sounlock(so);
1831 
1832 		/* Re-lock and restart from where we left off. */
1833 		closef(fp);
1834 		mutex_enter(&filelist_lock);
1835 		np = LIST_NEXT(dp, f_list);
1836 		LIST_REMOVE(dp, f_list);
1837 	}
1838 }
1839 
1840 /*
1841  * Garbage collector thread.  While SCM_RIGHTS messages are in transit,
1842  * wake once per second to garbage collect.  Run continually while we
1843  * have deferred closes to process.
1844  */
1845 static void
1846 unp_thread(void *cookie)
1847 {
1848 	file_t *dp;
1849 
1850 	/* Allocate a dummy file for our scans. */
1851 	if ((dp = fgetdummy()) == NULL) {
1852 		panic("unp_thread");
1853 	}
1854 
1855 	mutex_enter(&filelist_lock);
1856 	for (;;) {
1857 		KASSERT(mutex_owned(&filelist_lock));
1858 		if (SLIST_EMPTY(&unp_thread_discard)) {
1859 			if (unp_rights != 0) {
1860 				(void)cv_timedwait(&unp_thread_cv,
1861 				    &filelist_lock, hz);
1862 			} else {
1863 				cv_wait(&unp_thread_cv, &filelist_lock);
1864 			}
1865 		}
1866 		unp_gc(dp);
1867 	}
1868 	/* NOTREACHED */
1869 }
1870 
1871 /*
1872  * Kick the garbage collector into action if there is something for
1873  * it to process.
1874  */
1875 static void
1876 unp_thread_kick(void)
1877 {
1878 
1879 	if (!SLIST_EMPTY(&unp_thread_discard) || unp_rights != 0) {
1880 		mutex_enter(&filelist_lock);
1881 		cv_signal(&unp_thread_cv);
1882 		mutex_exit(&filelist_lock);
1883 	}
1884 }
1885 
1886 void
1887 unp_dispose(struct mbuf *m)
1888 {
1889 
1890 	if (m)
1891 		unp_scan(m, unp_discard_later, 1);
1892 }
1893 
1894 void
1895 unp_scan(struct mbuf *m0, void (*op)(file_t *), int discard)
1896 {
1897 	struct mbuf *m;
1898 	file_t **rp, *fp;
1899 	struct cmsghdr *cm;
1900 	int i, qfds;
1901 
1902 	while (m0) {
1903 		for (m = m0; m; m = m->m_next) {
1904 			if (m->m_type != MT_CONTROL ||
1905 			    m->m_len < sizeof(*cm)) {
1906 			    	continue;
1907 			}
1908 			cm = mtod(m, struct cmsghdr *);
1909 			if (cm->cmsg_level != SOL_SOCKET ||
1910 			    cm->cmsg_type != SCM_RIGHTS)
1911 				continue;
1912 			qfds = (cm->cmsg_len - CMSG_ALIGN(sizeof(*cm)))
1913 			    / sizeof(file_t *);
1914 			rp = (file_t **)CMSG_DATA(cm);
1915 			for (i = 0; i < qfds; i++) {
1916 				fp = *rp;
1917 				if (discard) {
1918 					*rp = 0;
1919 				}
1920 				(*op)(fp);
1921 				rp++;
1922 			}
1923 		}
1924 		m0 = m0->m_nextpkt;
1925 	}
1926 }
1927 
1928 void
1929 unp_mark(file_t *fp)
1930 {
1931 
1932 	if (fp == NULL)
1933 		return;
1934 
1935 	/* If we're already deferred, don't screw up the defer count */
1936 	mutex_enter(&fp->f_lock);
1937 	if (fp->f_flag & (FMARK | FDEFER)) {
1938 		mutex_exit(&fp->f_lock);
1939 		return;
1940 	}
1941 
1942 	/*
1943 	 * Minimize the number of deferrals...  Sockets are the only type of
1944 	 * file which can hold references to another file, so just mark
1945 	 * other files, and defer unmarked sockets for the next pass.
1946 	 */
1947 	if (fp->f_type == DTYPE_SOCKET) {
1948 		unp_defer++;
1949 		KASSERT(fp->f_count != 0);
1950 		atomic_or_uint(&fp->f_flag, FDEFER);
1951 	} else {
1952 		atomic_or_uint(&fp->f_flag, FMARK);
1953 	}
1954 	mutex_exit(&fp->f_lock);
1955 }
1956 
1957 static void
1958 unp_discard_now(file_t *fp)
1959 {
1960 
1961 	if (fp == NULL)
1962 		return;
1963 
1964 	KASSERT(fp->f_count > 0);
1965 	KASSERT(fp->f_msgcount > 0);
1966 
1967 	mutex_enter(&fp->f_lock);
1968 	fp->f_msgcount--;
1969 	mutex_exit(&fp->f_lock);
1970 	atomic_dec_uint(&unp_rights);
1971 	(void)closef(fp);
1972 }
1973 
1974 static void
1975 unp_discard_later(file_t *fp)
1976 {
1977 
1978 	if (fp == NULL)
1979 		return;
1980 
1981 	KASSERT(fp->f_count > 0);
1982 	KASSERT(fp->f_msgcount > 0);
1983 
1984 	mutex_enter(&filelist_lock);
1985 	if (fp->f_unpcount++ == 0) {
1986 		SLIST_INSERT_HEAD(&unp_thread_discard, fp, f_unplist);
1987 	}
1988 	mutex_exit(&filelist_lock);
1989 }
1990 
1991 void
1992 unp_sysctl_create(struct sysctllog **clog)
1993 {
1994 	sysctl_createv(clog, 0, NULL, NULL,
1995 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
1996 		       CTLTYPE_LONG, "sendspace",
1997 		       SYSCTL_DESCR("Default stream send space"),
1998 		       NULL, 0, &unpst_sendspace, 0,
1999 		       CTL_NET, PF_LOCAL, SOCK_STREAM, CTL_CREATE, CTL_EOL);
2000 	sysctl_createv(clog, 0, NULL, NULL,
2001 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
2002 		       CTLTYPE_LONG, "recvspace",
2003 		       SYSCTL_DESCR("Default stream recv space"),
2004 		       NULL, 0, &unpst_recvspace, 0,
2005 		       CTL_NET, PF_LOCAL, SOCK_STREAM, CTL_CREATE, CTL_EOL);
2006 	sysctl_createv(clog, 0, NULL, NULL,
2007 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
2008 		       CTLTYPE_LONG, "sendspace",
2009 		       SYSCTL_DESCR("Default datagram send space"),
2010 		       NULL, 0, &unpdg_sendspace, 0,
2011 		       CTL_NET, PF_LOCAL, SOCK_DGRAM, CTL_CREATE, CTL_EOL);
2012 	sysctl_createv(clog, 0, NULL, NULL,
2013 		       CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
2014 		       CTLTYPE_LONG, "recvspace",
2015 		       SYSCTL_DESCR("Default datagram recv space"),
2016 		       NULL, 0, &unpdg_recvspace, 0,
2017 		       CTL_NET, PF_LOCAL, SOCK_DGRAM, CTL_CREATE, CTL_EOL);
2018 	sysctl_createv(clog, 0, NULL, NULL,
2019 		       CTLFLAG_PERMANENT|CTLFLAG_READONLY,
2020 		       CTLTYPE_INT, "inflight",
2021 		       SYSCTL_DESCR("File descriptors in flight"),
2022 		       NULL, 0, &unp_rights, 0,
2023 		       CTL_NET, PF_LOCAL, CTL_CREATE, CTL_EOL);
2024 	sysctl_createv(clog, 0, NULL, NULL,
2025 		       CTLFLAG_PERMANENT|CTLFLAG_READONLY,
2026 		       CTLTYPE_INT, "deferred",
2027 		       SYSCTL_DESCR("File descriptors deferred for close"),
2028 		       NULL, 0, &unp_defer, 0,
2029 		       CTL_NET, PF_LOCAL, CTL_CREATE, CTL_EOL);
2030 }
2031 
2032 const struct pr_usrreqs unp_usrreqs = {
2033 	.pr_attach	= unp_attach,
2034 	.pr_detach	= unp_detach,
2035 	.pr_accept	= unp_accept,
2036 	.pr_bind	= unp_bind,
2037 	.pr_listen	= unp_listen,
2038 	.pr_connect	= unp_connect,
2039 	.pr_connect2	= unp_connect2,
2040 	.pr_disconnect	= unp_disconnect,
2041 	.pr_shutdown	= unp_shutdown,
2042 	.pr_abort	= unp_abort,
2043 	.pr_ioctl	= unp_ioctl,
2044 	.pr_stat	= unp_stat,
2045 	.pr_peeraddr	= unp_peeraddr,
2046 	.pr_sockaddr	= unp_sockaddr,
2047 	.pr_rcvd	= unp_rcvd,
2048 	.pr_recvoob	= unp_recvoob,
2049 	.pr_send	= unp_send,
2050 	.pr_sendoob	= unp_sendoob,
2051 };
2052