xref: /openbsd-src/sys/kern/uipc_socket.c (revision 1ad61ae0a79a724d2d3ec69e69c8e1d1ff6b53a0)
1 /*	$OpenBSD: uipc_socket.c,v 1.309 2023/08/08 22:07:25 mvs Exp $	*/
2 /*	$NetBSD: uipc_socket.c,v 1.21 1996/02/04 02:17:52 christos Exp $	*/
3 
4 /*
5  * Copyright (c) 1982, 1986, 1988, 1990, 1993
6  *	The Regents of the University of California.  All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  * 3. Neither the name of the University nor the names of its contributors
17  *    may be used to endorse or promote products derived from this software
18  *    without specific prior written permission.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30  * SUCH DAMAGE.
31  *
32  *	@(#)uipc_socket.c	8.3 (Berkeley) 4/15/94
33  */
34 
35 #include <sys/param.h>
36 #include <sys/systm.h>
37 #include <sys/proc.h>
38 #include <sys/file.h>
39 #include <sys/filedesc.h>
40 #include <sys/malloc.h>
41 #include <sys/mbuf.h>
42 #include <sys/domain.h>
43 #include <sys/event.h>
44 #include <sys/protosw.h>
45 #include <sys/socket.h>
46 #include <sys/unpcb.h>
47 #include <sys/socketvar.h>
48 #include <sys/signalvar.h>
49 #include <sys/pool.h>
50 #include <sys/atomic.h>
51 #include <sys/rwlock.h>
52 #include <sys/time.h>
53 #include <sys/refcnt.h>
54 
55 #ifdef DDB
56 #include <machine/db_machdep.h>
57 #endif
58 
59 void	sbsync(struct sockbuf *, struct mbuf *);
60 
61 int	sosplice(struct socket *, int, off_t, struct timeval *);
62 void	sounsplice(struct socket *, struct socket *, int);
63 void	soidle(void *);
64 void	sotask(void *);
65 void	soreaper(void *);
66 void	soput(void *);
67 int	somove(struct socket *, int);
68 void	sorflush(struct socket *);
69 
70 void	filt_sordetach(struct knote *kn);
71 int	filt_soread(struct knote *kn, long hint);
72 void	filt_sowdetach(struct knote *kn);
73 int	filt_sowrite(struct knote *kn, long hint);
74 int	filt_soexcept(struct knote *kn, long hint);
75 int	filt_solisten(struct knote *kn, long hint);
76 int	filt_somodify(struct kevent *kev, struct knote *kn);
77 int	filt_soprocess(struct knote *kn, struct kevent *kev);
78 
79 const struct filterops solisten_filtops = {
80 	.f_flags	= FILTEROP_ISFD | FILTEROP_MPSAFE,
81 	.f_attach	= NULL,
82 	.f_detach	= filt_sordetach,
83 	.f_event	= filt_solisten,
84 	.f_modify	= filt_somodify,
85 	.f_process	= filt_soprocess,
86 };
87 
88 const struct filterops soread_filtops = {
89 	.f_flags	= FILTEROP_ISFD | FILTEROP_MPSAFE,
90 	.f_attach	= NULL,
91 	.f_detach	= filt_sordetach,
92 	.f_event	= filt_soread,
93 	.f_modify	= filt_somodify,
94 	.f_process	= filt_soprocess,
95 };
96 
97 const struct filterops sowrite_filtops = {
98 	.f_flags	= FILTEROP_ISFD | FILTEROP_MPSAFE,
99 	.f_attach	= NULL,
100 	.f_detach	= filt_sowdetach,
101 	.f_event	= filt_sowrite,
102 	.f_modify	= filt_somodify,
103 	.f_process	= filt_soprocess,
104 };
105 
106 const struct filterops soexcept_filtops = {
107 	.f_flags	= FILTEROP_ISFD | FILTEROP_MPSAFE,
108 	.f_attach	= NULL,
109 	.f_detach	= filt_sordetach,
110 	.f_event	= filt_soexcept,
111 	.f_modify	= filt_somodify,
112 	.f_process	= filt_soprocess,
113 };
114 
115 void	klist_soassertlk(void *);
116 int	klist_solock(void *);
117 void	klist_sounlock(void *, int);
118 
119 const struct klistops socket_klistops = {
120 	.klo_assertlk	= klist_soassertlk,
121 	.klo_lock	= klist_solock,
122 	.klo_unlock	= klist_sounlock,
123 };
124 
125 #ifndef SOMINCONN
126 #define SOMINCONN 80
127 #endif /* SOMINCONN */
128 
129 int	somaxconn = SOMAXCONN;
130 int	sominconn = SOMINCONN;
131 
132 struct pool socket_pool;
133 #ifdef SOCKET_SPLICE
134 struct pool sosplice_pool;
135 struct taskq *sosplice_taskq;
136 struct rwlock sosplice_lock = RWLOCK_INITIALIZER("sosplicelk");
137 #endif
138 
139 void
140 soinit(void)
141 {
142 	pool_init(&socket_pool, sizeof(struct socket), 0, IPL_SOFTNET, 0,
143 	    "sockpl", NULL);
144 #ifdef SOCKET_SPLICE
145 	pool_init(&sosplice_pool, sizeof(struct sosplice), 0, IPL_SOFTNET, 0,
146 	    "sosppl", NULL);
147 #endif
148 }
149 
150 struct socket *
151 soalloc(int wait)
152 {
153 	struct socket *so;
154 
155 	so = pool_get(&socket_pool, (wait == M_WAIT ? PR_WAITOK : PR_NOWAIT) |
156 	    PR_ZERO);
157 	if (so == NULL)
158 		return (NULL);
159 	rw_init_flags(&so->so_lock, "solock", RWL_DUPOK);
160 	refcnt_init(&so->so_refcnt);
161 	klist_init(&so->so_rcv.sb_klist, &socket_klistops, so);
162 	klist_init(&so->so_snd.sb_klist, &socket_klistops, so);
163 	sigio_init(&so->so_sigio);
164 	TAILQ_INIT(&so->so_q0);
165 	TAILQ_INIT(&so->so_q);
166 
167 	return (so);
168 }
169 
170 /*
171  * Socket operation routines.
172  * These routines are called by the routines in
173  * sys_socket.c or from a system process, and
174  * implement the semantics of socket operations by
175  * switching out to the protocol specific routines.
176  */
177 int
178 socreate(int dom, struct socket **aso, int type, int proto)
179 {
180 	struct proc *p = curproc;		/* XXX */
181 	const struct protosw *prp;
182 	struct socket *so;
183 	int error;
184 
185 	if (proto)
186 		prp = pffindproto(dom, proto, type);
187 	else
188 		prp = pffindtype(dom, type);
189 	if (prp == NULL || prp->pr_usrreqs == NULL)
190 		return (EPROTONOSUPPORT);
191 	if (prp->pr_type != type)
192 		return (EPROTOTYPE);
193 	so = soalloc(M_WAIT);
194 	so->so_type = type;
195 	if (suser(p) == 0)
196 		so->so_state = SS_PRIV;
197 	so->so_ruid = p->p_ucred->cr_ruid;
198 	so->so_euid = p->p_ucred->cr_uid;
199 	so->so_rgid = p->p_ucred->cr_rgid;
200 	so->so_egid = p->p_ucred->cr_gid;
201 	so->so_cpid = p->p_p->ps_pid;
202 	so->so_proto = prp;
203 	so->so_snd.sb_timeo_nsecs = INFSLP;
204 	so->so_rcv.sb_timeo_nsecs = INFSLP;
205 
206 	solock(so);
207 	error = pru_attach(so, proto, M_WAIT);
208 	if (error) {
209 		so->so_state |= SS_NOFDREF;
210 		/* sofree() calls sounlock(). */
211 		sofree(so, 0);
212 		return (error);
213 	}
214 	sounlock(so);
215 	*aso = so;
216 	return (0);
217 }
218 
219 int
220 sobind(struct socket *so, struct mbuf *nam, struct proc *p)
221 {
222 	soassertlocked(so);
223 	return pru_bind(so, nam, p);
224 }
225 
226 int
227 solisten(struct socket *so, int backlog)
228 {
229 	int error;
230 
231 	soassertlocked(so);
232 
233 	if (so->so_state & (SS_ISCONNECTED|SS_ISCONNECTING|SS_ISDISCONNECTING))
234 		return (EINVAL);
235 #ifdef SOCKET_SPLICE
236 	if (isspliced(so) || issplicedback(so))
237 		return (EOPNOTSUPP);
238 #endif /* SOCKET_SPLICE */
239 	error = pru_listen(so);
240 	if (error)
241 		return (error);
242 	if (TAILQ_FIRST(&so->so_q) == NULL)
243 		so->so_options |= SO_ACCEPTCONN;
244 	if (backlog < 0 || backlog > somaxconn)
245 		backlog = somaxconn;
246 	if (backlog < sominconn)
247 		backlog = sominconn;
248 	so->so_qlimit = backlog;
249 	return (0);
250 }
251 
252 #define SOSP_FREEING_READ	1
253 #define SOSP_FREEING_WRITE	2
254 void
255 sofree(struct socket *so, int keep_lock)
256 {
257 	int persocket = solock_persocket(so);
258 
259 	soassertlocked(so);
260 
261 	if (so->so_pcb || (so->so_state & SS_NOFDREF) == 0) {
262 		if (!keep_lock)
263 			sounlock(so);
264 		return;
265 	}
266 	if (so->so_head) {
267 		struct socket *head = so->so_head;
268 
269 		/*
270 		 * We must not decommission a socket that's on the accept(2)
271 		 * queue.  If we do, then accept(2) may hang after select(2)
272 		 * indicated that the listening socket was ready.
273 		 */
274 		if (so->so_onq == &head->so_q) {
275 			if (!keep_lock)
276 				sounlock(so);
277 			return;
278 		}
279 
280 		if (persocket) {
281 			/*
282 			 * Concurrent close of `head' could
283 			 * abort `so' due to re-lock.
284 			 */
285 			soref(so);
286 			soref(head);
287 			sounlock(so);
288 			solock(head);
289 			solock(so);
290 
291 			if (so->so_onq != &head->so_q0) {
292 				sounlock(head);
293 				sounlock(so);
294 				sorele(head);
295 				sorele(so);
296 				return;
297 			}
298 
299 			sorele(head);
300 			sorele(so);
301 		}
302 
303 		soqremque(so, 0);
304 
305 		if (persocket)
306 			sounlock(head);
307 	}
308 
309 	if (persocket) {
310 		sounlock(so);
311 		refcnt_finalize(&so->so_refcnt, "sofinal");
312 		solock(so);
313 	}
314 
315 	sigio_free(&so->so_sigio);
316 	klist_free(&so->so_rcv.sb_klist);
317 	klist_free(&so->so_snd.sb_klist);
318 #ifdef SOCKET_SPLICE
319 	if (issplicedback(so)) {
320 		int freeing = SOSP_FREEING_WRITE;
321 
322 		if (so->so_sp->ssp_soback == so)
323 			freeing |= SOSP_FREEING_READ;
324 		sounsplice(so->so_sp->ssp_soback, so, freeing);
325 	}
326 	if (isspliced(so)) {
327 		int freeing = SOSP_FREEING_READ;
328 
329 		if (so == so->so_sp->ssp_socket)
330 			freeing |= SOSP_FREEING_WRITE;
331 		sounsplice(so, so->so_sp->ssp_socket, freeing);
332 	}
333 #endif /* SOCKET_SPLICE */
334 	sbrelease(so, &so->so_snd);
335 	sorflush(so);
336 	if (!keep_lock)
337 		sounlock(so);
338 #ifdef SOCKET_SPLICE
339 	if (so->so_sp) {
340 		/* Reuse splice idle, sounsplice() has been called before. */
341 		timeout_set_proc(&so->so_sp->ssp_idleto, soreaper, so);
342 		timeout_add(&so->so_sp->ssp_idleto, 0);
343 	} else
344 #endif /* SOCKET_SPLICE */
345 	{
346 		pool_put(&socket_pool, so);
347 	}
348 }
349 
350 static inline uint64_t
351 solinger_nsec(struct socket *so)
352 {
353 	if (so->so_linger == 0)
354 		return INFSLP;
355 
356 	return SEC_TO_NSEC(so->so_linger);
357 }
358 
359 /*
360  * Close a socket on last file table reference removal.
361  * Initiate disconnect if connected.
362  * Free socket when disconnect complete.
363  */
364 int
365 soclose(struct socket *so, int flags)
366 {
367 	struct socket *so2;
368 	int error = 0;
369 
370 	solock(so);
371 	/* Revoke async IO early. There is a final revocation in sofree(). */
372 	sigio_free(&so->so_sigio);
373 	if (so->so_state & SS_ISCONNECTED) {
374 		if (so->so_pcb == NULL)
375 			goto discard;
376 		if ((so->so_state & SS_ISDISCONNECTING) == 0) {
377 			error = sodisconnect(so);
378 			if (error)
379 				goto drop;
380 		}
381 		if (so->so_options & SO_LINGER) {
382 			if ((so->so_state & SS_ISDISCONNECTING) &&
383 			    (flags & MSG_DONTWAIT))
384 				goto drop;
385 			while (so->so_state & SS_ISCONNECTED) {
386 				error = sosleep_nsec(so, &so->so_timeo,
387 				    PSOCK | PCATCH, "netcls",
388 				    solinger_nsec(so));
389 				if (error)
390 					break;
391 			}
392 		}
393 	}
394 drop:
395 	if (so->so_pcb) {
396 		int error2;
397 		error2 = pru_detach(so);
398 		if (error == 0)
399 			error = error2;
400 	}
401 	if (so->so_options & SO_ACCEPTCONN) {
402 		int persocket = solock_persocket(so);
403 
404 		if (persocket) {
405 			/* Wait concurrent sonewconn() threads. */
406 			while (so->so_newconn > 0) {
407 				so->so_state |= SS_NEWCONN_WAIT;
408 				sosleep_nsec(so, &so->so_newconn, PSOCK,
409 				    "newcon", INFSLP);
410 			}
411 		}
412 
413 		while ((so2 = TAILQ_FIRST(&so->so_q0)) != NULL) {
414 			if (persocket)
415 				solock(so2);
416 			(void) soqremque(so2, 0);
417 			if (persocket)
418 				sounlock(so);
419 			soabort(so2);
420 			if (persocket)
421 				solock(so);
422 		}
423 		while ((so2 = TAILQ_FIRST(&so->so_q)) != NULL) {
424 			if (persocket)
425 				solock(so2);
426 			(void) soqremque(so2, 1);
427 			if (persocket)
428 				sounlock(so);
429 			soabort(so2);
430 			if (persocket)
431 				solock(so);
432 		}
433 	}
434 discard:
435 	if (so->so_state & SS_NOFDREF)
436 		panic("soclose NOFDREF: so %p, so_type %d", so, so->so_type);
437 	so->so_state |= SS_NOFDREF;
438 	/* sofree() calls sounlock(). */
439 	sofree(so, 0);
440 	return (error);
441 }
442 
443 void
444 soabort(struct socket *so)
445 {
446 	soassertlocked(so);
447 	pru_abort(so);
448 }
449 
450 int
451 soaccept(struct socket *so, struct mbuf *nam)
452 {
453 	int error = 0;
454 
455 	soassertlocked(so);
456 
457 	if ((so->so_state & SS_NOFDREF) == 0)
458 		panic("soaccept !NOFDREF: so %p, so_type %d", so, so->so_type);
459 	so->so_state &= ~SS_NOFDREF;
460 	if ((so->so_state & SS_ISDISCONNECTED) == 0 ||
461 	    (so->so_proto->pr_flags & PR_ABRTACPTDIS) == 0)
462 		error = pru_accept(so, nam);
463 	else
464 		error = ECONNABORTED;
465 	return (error);
466 }
467 
468 int
469 soconnect(struct socket *so, struct mbuf *nam)
470 {
471 	int error;
472 
473 	soassertlocked(so);
474 
475 	if (so->so_options & SO_ACCEPTCONN)
476 		return (EOPNOTSUPP);
477 	/*
478 	 * If protocol is connection-based, can only connect once.
479 	 * Otherwise, if connected, try to disconnect first.
480 	 * This allows user to disconnect by connecting to, e.g.,
481 	 * a null address.
482 	 */
483 	if (so->so_state & (SS_ISCONNECTED|SS_ISCONNECTING) &&
484 	    ((so->so_proto->pr_flags & PR_CONNREQUIRED) ||
485 	    (error = sodisconnect(so))))
486 		error = EISCONN;
487 	else
488 		error = pru_connect(so, nam);
489 	return (error);
490 }
491 
492 int
493 soconnect2(struct socket *so1, struct socket *so2)
494 {
495 	int persocket, error;
496 
497 	if ((persocket = solock_persocket(so1)))
498 		solock_pair(so1, so2);
499 	else
500 		solock(so1);
501 
502 	error = pru_connect2(so1, so2);
503 
504 	if (persocket)
505 		sounlock(so2);
506 	sounlock(so1);
507 	return (error);
508 }
509 
510 int
511 sodisconnect(struct socket *so)
512 {
513 	int error;
514 
515 	soassertlocked(so);
516 
517 	if ((so->so_state & SS_ISCONNECTED) == 0)
518 		return (ENOTCONN);
519 	if (so->so_state & SS_ISDISCONNECTING)
520 		return (EALREADY);
521 	error = pru_disconnect(so);
522 	return (error);
523 }
524 
525 int m_getuio(struct mbuf **, int, long, struct uio *);
526 
527 #define	SBLOCKWAIT(f)	(((f) & MSG_DONTWAIT) ? 0 : SBL_WAIT)
528 /*
529  * Send on a socket.
530  * If send must go all at once and message is larger than
531  * send buffering, then hard error.
532  * Lock against other senders.
533  * If must go all at once and not enough room now, then
534  * inform user that this would block and do nothing.
535  * Otherwise, if nonblocking, send as much as possible.
536  * The data to be sent is described by "uio" if nonzero,
537  * otherwise by the mbuf chain "top" (which must be null
538  * if uio is not).  Data provided in mbuf chain must be small
539  * enough to send all at once.
540  *
541  * Returns nonzero on error, timeout or signal; callers
542  * must check for short counts if EINTR/ERESTART are returned.
543  * Data and control buffers are freed on return.
544  */
545 int
546 sosend(struct socket *so, struct mbuf *addr, struct uio *uio, struct mbuf *top,
547     struct mbuf *control, int flags)
548 {
549 	long space, clen = 0;
550 	size_t resid;
551 	int error;
552 	int atomic = sosendallatonce(so) || top;
553 
554 	if (uio)
555 		resid = uio->uio_resid;
556 	else
557 		resid = top->m_pkthdr.len;
558 	/* MSG_EOR on a SOCK_STREAM socket is invalid. */
559 	if (so->so_type == SOCK_STREAM && (flags & MSG_EOR)) {
560 		m_freem(top);
561 		m_freem(control);
562 		return (EINVAL);
563 	}
564 	if (uio && uio->uio_procp)
565 		uio->uio_procp->p_ru.ru_msgsnd++;
566 	if (control) {
567 		/*
568 		 * In theory clen should be unsigned (since control->m_len is).
569 		 * However, space must be signed, as it might be less than 0
570 		 * if we over-committed, and we must use a signed comparison
571 		 * of space and clen.
572 		 */
573 		clen = control->m_len;
574 		/* reserve extra space for AF_UNIX's internalize */
575 		if (so->so_proto->pr_domain->dom_family == AF_UNIX &&
576 		    clen >= CMSG_ALIGN(sizeof(struct cmsghdr)) &&
577 		    mtod(control, struct cmsghdr *)->cmsg_type == SCM_RIGHTS)
578 			clen = CMSG_SPACE(
579 			    (clen - CMSG_ALIGN(sizeof(struct cmsghdr))) *
580 			    (sizeof(struct fdpass) / sizeof(int)));
581 	}
582 
583 #define	snderr(errno)	{ error = errno; goto release; }
584 
585 	solock(so);
586 restart:
587 	if ((error = sblock(so, &so->so_snd, SBLOCKWAIT(flags))) != 0)
588 		goto out;
589 	so->so_snd.sb_state |= SS_ISSENDING;
590 	do {
591 		if (so->so_snd.sb_state & SS_CANTSENDMORE)
592 			snderr(EPIPE);
593 		if (so->so_error) {
594 			error = so->so_error;
595 			so->so_error = 0;
596 			snderr(error);
597 		}
598 		if ((so->so_state & SS_ISCONNECTED) == 0) {
599 			if (so->so_proto->pr_flags & PR_CONNREQUIRED) {
600 				if (!(resid == 0 && clen != 0))
601 					snderr(ENOTCONN);
602 			} else if (addr == NULL)
603 				snderr(EDESTADDRREQ);
604 		}
605 		space = sbspace(so, &so->so_snd);
606 		if (flags & MSG_OOB)
607 			space += 1024;
608 		if (so->so_proto->pr_domain->dom_family == AF_UNIX) {
609 			if (atomic && resid > so->so_snd.sb_hiwat)
610 				snderr(EMSGSIZE);
611 		} else {
612 			if (clen > so->so_snd.sb_hiwat ||
613 			    (atomic && resid > so->so_snd.sb_hiwat - clen))
614 				snderr(EMSGSIZE);
615 		}
616 		if (space < clen ||
617 		    (space - clen < resid &&
618 		    (atomic || space < so->so_snd.sb_lowat))) {
619 			if (flags & MSG_DONTWAIT)
620 				snderr(EWOULDBLOCK);
621 			sbunlock(so, &so->so_snd);
622 			error = sbwait(so, &so->so_snd);
623 			so->so_snd.sb_state &= ~SS_ISSENDING;
624 			if (error)
625 				goto out;
626 			goto restart;
627 		}
628 		space -= clen;
629 		do {
630 			if (uio == NULL) {
631 				/*
632 				 * Data is prepackaged in "top".
633 				 */
634 				resid = 0;
635 				if (flags & MSG_EOR)
636 					top->m_flags |= M_EOR;
637 			} else {
638 				sounlock(so);
639 				error = m_getuio(&top, atomic, space, uio);
640 				solock(so);
641 				if (error)
642 					goto release;
643 				space -= top->m_pkthdr.len;
644 				resid = uio->uio_resid;
645 				if (flags & MSG_EOR)
646 					top->m_flags |= M_EOR;
647 			}
648 			if (resid == 0)
649 				so->so_snd.sb_state &= ~SS_ISSENDING;
650 			if (top && so->so_options & SO_ZEROIZE)
651 				top->m_flags |= M_ZEROIZE;
652 			if (flags & MSG_OOB)
653 				error = pru_sendoob(so, top, addr, control);
654 			else
655 				error = pru_send(so, top, addr, control);
656 			clen = 0;
657 			control = NULL;
658 			top = NULL;
659 			if (error)
660 				goto release;
661 		} while (resid && space > 0);
662 	} while (resid);
663 
664 release:
665 	so->so_snd.sb_state &= ~SS_ISSENDING;
666 	sbunlock(so, &so->so_snd);
667 out:
668 	sounlock(so);
669 	m_freem(top);
670 	m_freem(control);
671 	return (error);
672 }
673 
674 int
675 m_getuio(struct mbuf **mp, int atomic, long space, struct uio *uio)
676 {
677 	struct mbuf *m, *top = NULL;
678 	struct mbuf **nextp = &top;
679 	u_long len, mlen;
680 	size_t resid = uio->uio_resid;
681 	int error;
682 
683 	do {
684 		if (top == NULL) {
685 			MGETHDR(m, M_WAIT, MT_DATA);
686 			mlen = MHLEN;
687 			m->m_pkthdr.len = 0;
688 			m->m_pkthdr.ph_ifidx = 0;
689 		} else {
690 			MGET(m, M_WAIT, MT_DATA);
691 			mlen = MLEN;
692 		}
693 		/* chain mbuf together */
694 		*nextp = m;
695 		nextp = &m->m_next;
696 
697 		resid = ulmin(resid, space);
698 		if (resid >= MINCLSIZE) {
699 			MCLGETL(m, M_NOWAIT, ulmin(resid, MAXMCLBYTES));
700 			if ((m->m_flags & M_EXT) == 0)
701 				MCLGETL(m, M_NOWAIT, MCLBYTES);
702 			if ((m->m_flags & M_EXT) == 0)
703 				goto nopages;
704 			mlen = m->m_ext.ext_size;
705 			len = ulmin(mlen, resid);
706 			/*
707 			 * For datagram protocols, leave room
708 			 * for protocol headers in first mbuf.
709 			 */
710 			if (atomic && m == top && len < mlen - max_hdr)
711 				m->m_data += max_hdr;
712 		} else {
713 nopages:
714 			len = ulmin(mlen, resid);
715 			/*
716 			 * For datagram protocols, leave room
717 			 * for protocol headers in first mbuf.
718 			 */
719 			if (atomic && m == top && len < mlen - max_hdr)
720 				m_align(m, len);
721 		}
722 
723 		error = uiomove(mtod(m, caddr_t), len, uio);
724 		if (error) {
725 			m_freem(top);
726 			return (error);
727 		}
728 
729 		/* adjust counters */
730 		resid = uio->uio_resid;
731 		space -= len;
732 		m->m_len = len;
733 		top->m_pkthdr.len += len;
734 
735 		/* Is there more space and more data? */
736 	} while (space > 0 && resid > 0);
737 
738 	*mp = top;
739 	return 0;
740 }
741 
742 /*
743  * Following replacement or removal of the first mbuf on the first
744  * mbuf chain of a socket buffer, push necessary state changes back
745  * into the socket buffer so that other consumers see the values
746  * consistently.  'nextrecord' is the callers locally stored value of
747  * the original value of sb->sb_mb->m_nextpkt which must be restored
748  * when the lead mbuf changes.  NOTE: 'nextrecord' may be NULL.
749  */
750 void
751 sbsync(struct sockbuf *sb, struct mbuf *nextrecord)
752 {
753 
754 	/*
755 	 * First, update for the new value of nextrecord.  If necessary,
756 	 * make it the first record.
757 	 */
758 	if (sb->sb_mb != NULL)
759 		sb->sb_mb->m_nextpkt = nextrecord;
760 	else
761 		sb->sb_mb = nextrecord;
762 
763 	/*
764 	 * Now update any dependent socket buffer fields to reflect
765 	 * the new state.  This is an inline of SB_EMPTY_FIXUP, with
766 	 * the addition of a second clause that takes care of the
767 	 * case where sb_mb has been updated, but remains the last
768 	 * record.
769 	 */
770 	if (sb->sb_mb == NULL) {
771 		sb->sb_mbtail = NULL;
772 		sb->sb_lastrecord = NULL;
773 	} else if (sb->sb_mb->m_nextpkt == NULL)
774 		sb->sb_lastrecord = sb->sb_mb;
775 }
776 
777 /*
778  * Implement receive operations on a socket.
779  * We depend on the way that records are added to the sockbuf
780  * by sbappend*.  In particular, each record (mbufs linked through m_next)
781  * must begin with an address if the protocol so specifies,
782  * followed by an optional mbuf or mbufs containing ancillary data,
783  * and then zero or more mbufs of data.
784  * In order to avoid blocking network for the entire time here, we release
785  * the solock() while doing the actual copy to user space.
786  * Although the sockbuf is locked, new data may still be appended,
787  * and thus we must maintain consistency of the sockbuf during that time.
788  *
789  * The caller may receive the data as a single mbuf chain by supplying
790  * an mbuf **mp0 for use in returning the chain.  The uio is then used
791  * only for the count in uio_resid.
792  */
793 int
794 soreceive(struct socket *so, struct mbuf **paddr, struct uio *uio,
795     struct mbuf **mp0, struct mbuf **controlp, int *flagsp,
796     socklen_t controllen)
797 {
798 	struct mbuf *m, **mp;
799 	struct mbuf *cm;
800 	u_long len, offset, moff;
801 	int flags, error, type, uio_error = 0;
802 	const struct protosw *pr = so->so_proto;
803 	struct mbuf *nextrecord;
804 	size_t resid, orig_resid = uio->uio_resid;
805 
806 	mp = mp0;
807 	if (paddr)
808 		*paddr = NULL;
809 	if (controlp)
810 		*controlp = NULL;
811 	if (flagsp)
812 		flags = *flagsp &~ MSG_EOR;
813 	else
814 		flags = 0;
815 	if (flags & MSG_OOB) {
816 		m = m_get(M_WAIT, MT_DATA);
817 		solock(so);
818 		error = pru_rcvoob(so, m, flags & MSG_PEEK);
819 		sounlock(so);
820 		if (error)
821 			goto bad;
822 		do {
823 			error = uiomove(mtod(m, caddr_t),
824 			    ulmin(uio->uio_resid, m->m_len), uio);
825 			m = m_free(m);
826 		} while (uio->uio_resid && error == 0 && m);
827 bad:
828 		m_freem(m);
829 		return (error);
830 	}
831 	if (mp)
832 		*mp = NULL;
833 
834 	solock_shared(so);
835 restart:
836 	if ((error = sblock(so, &so->so_rcv, SBLOCKWAIT(flags))) != 0) {
837 		sounlock_shared(so);
838 		return (error);
839 	}
840 
841 	m = so->so_rcv.sb_mb;
842 #ifdef SOCKET_SPLICE
843 	if (isspliced(so))
844 		m = NULL;
845 #endif /* SOCKET_SPLICE */
846 	/*
847 	 * If we have less data than requested, block awaiting more
848 	 * (subject to any timeout) if:
849 	 *   1. the current count is less than the low water mark,
850 	 *   2. MSG_WAITALL is set, and it is possible to do the entire
851 	 *	receive operation at once if we block (resid <= hiwat), or
852 	 *   3. MSG_DONTWAIT is not set.
853 	 * If MSG_WAITALL is set but resid is larger than the receive buffer,
854 	 * we have to do the receive in sections, and thus risk returning
855 	 * a short count if a timeout or signal occurs after we start.
856 	 */
857 	if (m == NULL || (((flags & MSG_DONTWAIT) == 0 &&
858 	    so->so_rcv.sb_cc < uio->uio_resid) &&
859 	    (so->so_rcv.sb_cc < so->so_rcv.sb_lowat ||
860 	    ((flags & MSG_WAITALL) && uio->uio_resid <= so->so_rcv.sb_hiwat)) &&
861 	    m->m_nextpkt == NULL && (pr->pr_flags & PR_ATOMIC) == 0)) {
862 #ifdef DIAGNOSTIC
863 		if (m == NULL && so->so_rcv.sb_cc)
864 #ifdef SOCKET_SPLICE
865 		    if (!isspliced(so))
866 #endif /* SOCKET_SPLICE */
867 			panic("receive 1: so %p, so_type %d, sb_cc %lu",
868 			    so, so->so_type, so->so_rcv.sb_cc);
869 #endif
870 		if (so->so_error) {
871 			if (m)
872 				goto dontblock;
873 			error = so->so_error;
874 			if ((flags & MSG_PEEK) == 0)
875 				so->so_error = 0;
876 			goto release;
877 		}
878 		if (so->so_rcv.sb_state & SS_CANTRCVMORE) {
879 			if (m)
880 				goto dontblock;
881 			else if (so->so_rcv.sb_cc == 0)
882 				goto release;
883 		}
884 		for (; m; m = m->m_next)
885 			if (m->m_type == MT_OOBDATA  || (m->m_flags & M_EOR)) {
886 				m = so->so_rcv.sb_mb;
887 				goto dontblock;
888 			}
889 		if ((so->so_state & (SS_ISCONNECTED|SS_ISCONNECTING)) == 0 &&
890 		    (so->so_proto->pr_flags & PR_CONNREQUIRED)) {
891 			error = ENOTCONN;
892 			goto release;
893 		}
894 		if (uio->uio_resid == 0 && controlp == NULL)
895 			goto release;
896 		if (flags & MSG_DONTWAIT) {
897 			error = EWOULDBLOCK;
898 			goto release;
899 		}
900 		SBLASTRECORDCHK(&so->so_rcv, "soreceive sbwait 1");
901 		SBLASTMBUFCHK(&so->so_rcv, "soreceive sbwait 1");
902 		sbunlock(so, &so->so_rcv);
903 		error = sbwait(so, &so->so_rcv);
904 		if (error) {
905 			sounlock_shared(so);
906 			return (error);
907 		}
908 		goto restart;
909 	}
910 dontblock:
911 	/*
912 	 * On entry here, m points to the first record of the socket buffer.
913 	 * From this point onward, we maintain 'nextrecord' as a cache of the
914 	 * pointer to the next record in the socket buffer.  We must keep the
915 	 * various socket buffer pointers and local stack versions of the
916 	 * pointers in sync, pushing out modifications before operations that
917 	 * may sleep, and re-reading them afterwards.
918 	 *
919 	 * Otherwise, we will race with the network stack appending new data
920 	 * or records onto the socket buffer by using inconsistent/stale
921 	 * versions of the field, possibly resulting in socket buffer
922 	 * corruption.
923 	 */
924 	if (uio->uio_procp)
925 		uio->uio_procp->p_ru.ru_msgrcv++;
926 	KASSERT(m == so->so_rcv.sb_mb);
927 	SBLASTRECORDCHK(&so->so_rcv, "soreceive 1");
928 	SBLASTMBUFCHK(&so->so_rcv, "soreceive 1");
929 	nextrecord = m->m_nextpkt;
930 	if (pr->pr_flags & PR_ADDR) {
931 #ifdef DIAGNOSTIC
932 		if (m->m_type != MT_SONAME)
933 			panic("receive 1a: so %p, so_type %d, m %p, m_type %d",
934 			    so, so->so_type, m, m->m_type);
935 #endif
936 		orig_resid = 0;
937 		if (flags & MSG_PEEK) {
938 			if (paddr)
939 				*paddr = m_copym(m, 0, m->m_len, M_NOWAIT);
940 			m = m->m_next;
941 		} else {
942 			sbfree(so, &so->so_rcv, m);
943 			if (paddr) {
944 				*paddr = m;
945 				so->so_rcv.sb_mb = m->m_next;
946 				m->m_next = NULL;
947 				m = so->so_rcv.sb_mb;
948 			} else {
949 				so->so_rcv.sb_mb = m_free(m);
950 				m = so->so_rcv.sb_mb;
951 			}
952 			sbsync(&so->so_rcv, nextrecord);
953 		}
954 	}
955 	while (m && m->m_type == MT_CONTROL && error == 0) {
956 		int skip = 0;
957 		if (flags & MSG_PEEK) {
958 			if (mtod(m, struct cmsghdr *)->cmsg_type ==
959 			    SCM_RIGHTS) {
960 				/* don't leak internalized SCM_RIGHTS msgs */
961 				skip = 1;
962 			} else if (controlp)
963 				*controlp = m_copym(m, 0, m->m_len, M_NOWAIT);
964 			m = m->m_next;
965 		} else {
966 			sbfree(so, &so->so_rcv, m);
967 			so->so_rcv.sb_mb = m->m_next;
968 			m->m_nextpkt = m->m_next = NULL;
969 			cm = m;
970 			m = so->so_rcv.sb_mb;
971 			sbsync(&so->so_rcv, nextrecord);
972 			if (controlp) {
973 				if (pr->pr_domain->dom_externalize) {
974 					sounlock_shared(so);
975 					error =
976 					    (*pr->pr_domain->dom_externalize)
977 					    (cm, controllen, flags);
978 					solock_shared(so);
979 				}
980 				*controlp = cm;
981 			} else {
982 				/*
983 				 * Dispose of any SCM_RIGHTS message that went
984 				 * through the read path rather than recv.
985 				 */
986 				if (pr->pr_domain->dom_dispose)
987 					pr->pr_domain->dom_dispose(cm);
988 				m_free(cm);
989 			}
990 		}
991 		if (m != NULL)
992 			nextrecord = so->so_rcv.sb_mb->m_nextpkt;
993 		else
994 			nextrecord = so->so_rcv.sb_mb;
995 		if (controlp && !skip)
996 			controlp = &(*controlp)->m_next;
997 		orig_resid = 0;
998 	}
999 
1000 	/* If m is non-NULL, we have some data to read. */
1001 	if (m) {
1002 		type = m->m_type;
1003 		if (type == MT_OOBDATA)
1004 			flags |= MSG_OOB;
1005 		if (m->m_flags & M_BCAST)
1006 			flags |= MSG_BCAST;
1007 		if (m->m_flags & M_MCAST)
1008 			flags |= MSG_MCAST;
1009 	}
1010 	SBLASTRECORDCHK(&so->so_rcv, "soreceive 2");
1011 	SBLASTMBUFCHK(&so->so_rcv, "soreceive 2");
1012 
1013 	moff = 0;
1014 	offset = 0;
1015 	while (m && uio->uio_resid > 0 && error == 0) {
1016 		if (m->m_type == MT_OOBDATA) {
1017 			if (type != MT_OOBDATA)
1018 				break;
1019 		} else if (type == MT_OOBDATA) {
1020 			break;
1021 		} else if (m->m_type == MT_CONTROL) {
1022 			/*
1023 			 * If there is more than one control message in the
1024 			 * stream, we do a short read.  Next can be received
1025 			 * or disposed by another system call.
1026 			 */
1027 			break;
1028 #ifdef DIAGNOSTIC
1029 		} else if (m->m_type != MT_DATA && m->m_type != MT_HEADER) {
1030 			panic("receive 3: so %p, so_type %d, m %p, m_type %d",
1031 			    so, so->so_type, m, m->m_type);
1032 #endif
1033 		}
1034 		so->so_rcv.sb_state &= ~SS_RCVATMARK;
1035 		len = uio->uio_resid;
1036 		if (so->so_oobmark && len > so->so_oobmark - offset)
1037 			len = so->so_oobmark - offset;
1038 		if (len > m->m_len - moff)
1039 			len = m->m_len - moff;
1040 		/*
1041 		 * If mp is set, just pass back the mbufs.
1042 		 * Otherwise copy them out via the uio, then free.
1043 		 * Sockbuf must be consistent here (points to current mbuf,
1044 		 * it points to next record) when we drop priority;
1045 		 * we must note any additions to the sockbuf when we
1046 		 * block interrupts again.
1047 		 */
1048 		if (mp == NULL && uio_error == 0) {
1049 			SBLASTRECORDCHK(&so->so_rcv, "soreceive uiomove");
1050 			SBLASTMBUFCHK(&so->so_rcv, "soreceive uiomove");
1051 			resid = uio->uio_resid;
1052 			sounlock_shared(so);
1053 			uio_error = uiomove(mtod(m, caddr_t) + moff, len, uio);
1054 			solock_shared(so);
1055 			if (uio_error)
1056 				uio->uio_resid = resid - len;
1057 		} else
1058 			uio->uio_resid -= len;
1059 		if (len == m->m_len - moff) {
1060 			if (m->m_flags & M_EOR)
1061 				flags |= MSG_EOR;
1062 			if (flags & MSG_PEEK) {
1063 				m = m->m_next;
1064 				moff = 0;
1065 				orig_resid = 0;
1066 			} else {
1067 				nextrecord = m->m_nextpkt;
1068 				sbfree(so, &so->so_rcv, m);
1069 				if (mp) {
1070 					*mp = m;
1071 					mp = &m->m_next;
1072 					so->so_rcv.sb_mb = m = m->m_next;
1073 					*mp = NULL;
1074 				} else {
1075 					so->so_rcv.sb_mb = m_free(m);
1076 					m = so->so_rcv.sb_mb;
1077 				}
1078 				/*
1079 				 * If m != NULL, we also know that
1080 				 * so->so_rcv.sb_mb != NULL.
1081 				 */
1082 				KASSERT(so->so_rcv.sb_mb == m);
1083 				if (m) {
1084 					m->m_nextpkt = nextrecord;
1085 					if (nextrecord == NULL)
1086 						so->so_rcv.sb_lastrecord = m;
1087 				} else {
1088 					so->so_rcv.sb_mb = nextrecord;
1089 					SB_EMPTY_FIXUP(&so->so_rcv);
1090 				}
1091 				SBLASTRECORDCHK(&so->so_rcv, "soreceive 3");
1092 				SBLASTMBUFCHK(&so->so_rcv, "soreceive 3");
1093 			}
1094 		} else {
1095 			if (flags & MSG_PEEK) {
1096 				moff += len;
1097 				orig_resid = 0;
1098 			} else {
1099 				if (mp)
1100 					*mp = m_copym(m, 0, len, M_WAIT);
1101 				m->m_data += len;
1102 				m->m_len -= len;
1103 				so->so_rcv.sb_cc -= len;
1104 				so->so_rcv.sb_datacc -= len;
1105 			}
1106 		}
1107 		if (so->so_oobmark) {
1108 			if ((flags & MSG_PEEK) == 0) {
1109 				so->so_oobmark -= len;
1110 				if (so->so_oobmark == 0) {
1111 					so->so_rcv.sb_state |= SS_RCVATMARK;
1112 					break;
1113 				}
1114 			} else {
1115 				offset += len;
1116 				if (offset == so->so_oobmark)
1117 					break;
1118 			}
1119 		}
1120 		if (flags & MSG_EOR)
1121 			break;
1122 		/*
1123 		 * If the MSG_WAITALL flag is set (for non-atomic socket),
1124 		 * we must not quit until "uio->uio_resid == 0" or an error
1125 		 * termination.  If a signal/timeout occurs, return
1126 		 * with a short count but without error.
1127 		 * Keep sockbuf locked against other readers.
1128 		 */
1129 		while (flags & MSG_WAITALL && m == NULL && uio->uio_resid > 0 &&
1130 		    !sosendallatonce(so) && !nextrecord) {
1131 			if (so->so_rcv.sb_state & SS_CANTRCVMORE ||
1132 			    so->so_error)
1133 				break;
1134 			SBLASTRECORDCHK(&so->so_rcv, "soreceive sbwait 2");
1135 			SBLASTMBUFCHK(&so->so_rcv, "soreceive sbwait 2");
1136 			error = sbwait(so, &so->so_rcv);
1137 			if (error) {
1138 				sbunlock(so, &so->so_rcv);
1139 				sounlock_shared(so);
1140 				return (0);
1141 			}
1142 			if ((m = so->so_rcv.sb_mb) != NULL)
1143 				nextrecord = m->m_nextpkt;
1144 		}
1145 	}
1146 
1147 	if (m && pr->pr_flags & PR_ATOMIC) {
1148 		flags |= MSG_TRUNC;
1149 		if ((flags & MSG_PEEK) == 0)
1150 			(void) sbdroprecord(so, &so->so_rcv);
1151 	}
1152 	if ((flags & MSG_PEEK) == 0) {
1153 		if (m == NULL) {
1154 			/*
1155 			 * First part is an inline SB_EMPTY_FIXUP().  Second
1156 			 * part makes sure sb_lastrecord is up-to-date if
1157 			 * there is still data in the socket buffer.
1158 			 */
1159 			so->so_rcv.sb_mb = nextrecord;
1160 			if (so->so_rcv.sb_mb == NULL) {
1161 				so->so_rcv.sb_mbtail = NULL;
1162 				so->so_rcv.sb_lastrecord = NULL;
1163 			} else if (nextrecord->m_nextpkt == NULL)
1164 				so->so_rcv.sb_lastrecord = nextrecord;
1165 		}
1166 		SBLASTRECORDCHK(&so->so_rcv, "soreceive 4");
1167 		SBLASTMBUFCHK(&so->so_rcv, "soreceive 4");
1168 		if (pr->pr_flags & PR_WANTRCVD)
1169 			pru_rcvd(so);
1170 	}
1171 	if (orig_resid == uio->uio_resid && orig_resid &&
1172 	    (flags & MSG_EOR) == 0 &&
1173 	    (so->so_rcv.sb_state & SS_CANTRCVMORE) == 0) {
1174 		sbunlock(so, &so->so_rcv);
1175 		goto restart;
1176 	}
1177 
1178 	if (uio_error)
1179 		error = uio_error;
1180 
1181 	if (flagsp)
1182 		*flagsp |= flags;
1183 release:
1184 	sbunlock(so, &so->so_rcv);
1185 	sounlock_shared(so);
1186 	return (error);
1187 }
1188 
1189 int
1190 soshutdown(struct socket *so, int how)
1191 {
1192 	int error = 0;
1193 
1194 	solock(so);
1195 	switch (how) {
1196 	case SHUT_RD:
1197 		sorflush(so);
1198 		break;
1199 	case SHUT_RDWR:
1200 		sorflush(so);
1201 		/* FALLTHROUGH */
1202 	case SHUT_WR:
1203 		error = pru_shutdown(so);
1204 		break;
1205 	default:
1206 		error = EINVAL;
1207 		break;
1208 	}
1209 	sounlock(so);
1210 
1211 	return (error);
1212 }
1213 
1214 void
1215 sorflush(struct socket *so)
1216 {
1217 	struct sockbuf *sb = &so->so_rcv;
1218 	struct mbuf *m;
1219 	const struct protosw *pr = so->so_proto;
1220 	int error;
1221 
1222 	error = sblock(so, sb, SBL_WAIT | SBL_NOINTR);
1223 	/* with SBL_WAIT and SLB_NOINTR sblock() must not fail */
1224 	KASSERT(error == 0);
1225 	socantrcvmore(so);
1226 	m = sb->sb_mb;
1227 	memset(&sb->sb_startzero, 0,
1228 	     (caddr_t)&sb->sb_endzero - (caddr_t)&sb->sb_startzero);
1229 	sb->sb_timeo_nsecs = INFSLP;
1230 	sbunlock(so, sb);
1231 	if (pr->pr_flags & PR_RIGHTS && pr->pr_domain->dom_dispose)
1232 		(*pr->pr_domain->dom_dispose)(m);
1233 	m_purge(m);
1234 }
1235 
1236 #ifdef SOCKET_SPLICE
1237 
1238 #define so_splicelen	so_sp->ssp_len
1239 #define so_splicemax	so_sp->ssp_max
1240 #define so_idletv	so_sp->ssp_idletv
1241 #define so_idleto	so_sp->ssp_idleto
1242 #define so_splicetask	so_sp->ssp_task
1243 
1244 int
1245 sosplice(struct socket *so, int fd, off_t max, struct timeval *tv)
1246 {
1247 	struct file	*fp;
1248 	struct socket	*sosp;
1249 	struct sosplice	*sp;
1250 	struct taskq	*tq;
1251 	int		 error = 0;
1252 
1253 	soassertlocked(so);
1254 
1255 	if (sosplice_taskq == NULL) {
1256 		rw_enter_write(&sosplice_lock);
1257 		if (sosplice_taskq == NULL) {
1258 			tq = taskq_create("sosplice", 1, IPL_SOFTNET,
1259 			    TASKQ_MPSAFE);
1260 			if (tq == NULL) {
1261 				rw_exit_write(&sosplice_lock);
1262 				return (ENOMEM);
1263 			}
1264 			/* Ensure the taskq is fully visible to other CPUs. */
1265 			membar_producer();
1266 			sosplice_taskq = tq;
1267 		}
1268 		rw_exit_write(&sosplice_lock);
1269 	} else {
1270 		/* Ensure the taskq is fully visible on this CPU. */
1271 		membar_consumer();
1272 	}
1273 
1274 	if ((so->so_proto->pr_flags & PR_SPLICE) == 0)
1275 		return (EPROTONOSUPPORT);
1276 	if (so->so_options & SO_ACCEPTCONN)
1277 		return (EOPNOTSUPP);
1278 	if ((so->so_state & (SS_ISCONNECTED|SS_ISCONNECTING)) == 0 &&
1279 	    (so->so_proto->pr_flags & PR_CONNREQUIRED))
1280 		return (ENOTCONN);
1281 	if (so->so_sp == NULL) {
1282 		sp = pool_get(&sosplice_pool, PR_WAITOK | PR_ZERO);
1283 		if (so->so_sp == NULL)
1284 			so->so_sp = sp;
1285 		else
1286 			pool_put(&sosplice_pool, sp);
1287 	}
1288 
1289 	/* If no fd is given, unsplice by removing existing link. */
1290 	if (fd < 0) {
1291 		/* Lock receive buffer. */
1292 		if ((error = sblock(so, &so->so_rcv, SBL_WAIT)) != 0) {
1293 			return (error);
1294 		}
1295 		if (so->so_sp->ssp_socket)
1296 			sounsplice(so, so->so_sp->ssp_socket, 0);
1297 		sbunlock(so, &so->so_rcv);
1298 		return (0);
1299 	}
1300 
1301 	if (max && max < 0)
1302 		return (EINVAL);
1303 
1304 	if (tv && (tv->tv_sec < 0 || !timerisvalid(tv)))
1305 		return (EINVAL);
1306 
1307 	/* Find sosp, the drain socket where data will be spliced into. */
1308 	if ((error = getsock(curproc, fd, &fp)) != 0)
1309 		return (error);
1310 	sosp = fp->f_data;
1311 	if (sosp->so_proto->pr_usrreqs->pru_send !=
1312 	    so->so_proto->pr_usrreqs->pru_send) {
1313 		error = EPROTONOSUPPORT;
1314 		goto frele;
1315 	}
1316 	if (sosp->so_sp == NULL) {
1317 		sp = pool_get(&sosplice_pool, PR_WAITOK | PR_ZERO);
1318 		if (sosp->so_sp == NULL)
1319 			sosp->so_sp = sp;
1320 		else
1321 			pool_put(&sosplice_pool, sp);
1322 	}
1323 
1324 	/* Lock both receive and send buffer. */
1325 	if ((error = sblock(so, &so->so_rcv, SBL_WAIT)) != 0) {
1326 		goto frele;
1327 	}
1328 	if ((error = sblock(so, &sosp->so_snd, SBL_WAIT)) != 0) {
1329 		sbunlock(so, &so->so_rcv);
1330 		goto frele;
1331 	}
1332 
1333 	if (so->so_sp->ssp_socket || sosp->so_sp->ssp_soback) {
1334 		error = EBUSY;
1335 		goto release;
1336 	}
1337 	if (sosp->so_options & SO_ACCEPTCONN) {
1338 		error = EOPNOTSUPP;
1339 		goto release;
1340 	}
1341 	if ((sosp->so_state & (SS_ISCONNECTED|SS_ISCONNECTING)) == 0) {
1342 		error = ENOTCONN;
1343 		goto release;
1344 	}
1345 
1346 	/* Splice so and sosp together. */
1347 	so->so_sp->ssp_socket = sosp;
1348 	sosp->so_sp->ssp_soback = so;
1349 	so->so_splicelen = 0;
1350 	so->so_splicemax = max;
1351 	if (tv)
1352 		so->so_idletv = *tv;
1353 	else
1354 		timerclear(&so->so_idletv);
1355 	timeout_set_proc(&so->so_idleto, soidle, so);
1356 	task_set(&so->so_splicetask, sotask, so);
1357 
1358 	/*
1359 	 * To prevent softnet interrupt from calling somove() while
1360 	 * we sleep, the socket buffers are not marked as spliced yet.
1361 	 */
1362 	if (somove(so, M_WAIT)) {
1363 		so->so_rcv.sb_flags |= SB_SPLICE;
1364 		sosp->so_snd.sb_flags |= SB_SPLICE;
1365 	}
1366 
1367  release:
1368 	sbunlock(sosp, &sosp->so_snd);
1369 	sbunlock(so, &so->so_rcv);
1370  frele:
1371 	/*
1372 	 * FRELE() must not be called with the socket lock held. It is safe to
1373 	 * release the lock here as long as no other operation happen on the
1374 	 * socket when sosplice() returns. The dance could be avoided by
1375 	 * grabbing the socket lock inside this function.
1376 	 */
1377 	sounlock(so);
1378 	FRELE(fp, curproc);
1379 	solock(so);
1380 	return (error);
1381 }
1382 
1383 void
1384 sounsplice(struct socket *so, struct socket *sosp, int freeing)
1385 {
1386 	soassertlocked(so);
1387 
1388 	task_del(sosplice_taskq, &so->so_splicetask);
1389 	timeout_del(&so->so_idleto);
1390 	sosp->so_snd.sb_flags &= ~SB_SPLICE;
1391 	so->so_rcv.sb_flags &= ~SB_SPLICE;
1392 	so->so_sp->ssp_socket = sosp->so_sp->ssp_soback = NULL;
1393 	/* Do not wakeup a socket that is about to be freed. */
1394 	if ((freeing & SOSP_FREEING_READ) == 0 && soreadable(so))
1395 		sorwakeup(so);
1396 	if ((freeing & SOSP_FREEING_WRITE) == 0 && sowriteable(sosp))
1397 		sowwakeup(sosp);
1398 }
1399 
1400 void
1401 soidle(void *arg)
1402 {
1403 	struct socket *so = arg;
1404 
1405 	solock(so);
1406 	if (so->so_rcv.sb_flags & SB_SPLICE) {
1407 		so->so_error = ETIMEDOUT;
1408 		sounsplice(so, so->so_sp->ssp_socket, 0);
1409 	}
1410 	sounlock(so);
1411 }
1412 
1413 void
1414 sotask(void *arg)
1415 {
1416 	struct socket *so = arg;
1417 
1418 	solock(so);
1419 	if (so->so_rcv.sb_flags & SB_SPLICE) {
1420 		/*
1421 		 * We may not sleep here as sofree() and unsplice() may be
1422 		 * called from softnet interrupt context.  This would remove
1423 		 * the socket during somove().
1424 		 */
1425 		somove(so, M_DONTWAIT);
1426 	}
1427 	sounlock(so);
1428 
1429 	/* Avoid user land starvation. */
1430 	yield();
1431 }
1432 
1433 /*
1434  * The socket splicing task or idle timeout may sleep while grabbing the net
1435  * lock.  As sofree() can be called anytime, sotask() or soidle() could access
1436  * the socket memory of a freed socket after wakeup.  So delay the pool_put()
1437  * after all pending socket splicing tasks or timeouts have finished.  Do this
1438  * by scheduling it on the same threads.
1439  */
1440 void
1441 soreaper(void *arg)
1442 {
1443 	struct socket *so = arg;
1444 
1445 	/* Reuse splice task, sounsplice() has been called before. */
1446 	task_set(&so->so_sp->ssp_task, soput, so);
1447 	task_add(sosplice_taskq, &so->so_sp->ssp_task);
1448 }
1449 
1450 void
1451 soput(void *arg)
1452 {
1453 	struct socket *so = arg;
1454 
1455 	pool_put(&sosplice_pool, so->so_sp);
1456 	pool_put(&socket_pool, so);
1457 }
1458 
1459 /*
1460  * Move data from receive buffer of spliced source socket to send
1461  * buffer of drain socket.  Try to move as much as possible in one
1462  * big chunk.  It is a TCP only implementation.
1463  * Return value 0 means splicing has been finished, 1 continue.
1464  */
1465 int
1466 somove(struct socket *so, int wait)
1467 {
1468 	struct socket	*sosp = so->so_sp->ssp_socket;
1469 	struct mbuf	*m, **mp, *nextrecord;
1470 	u_long		 len, off, oobmark;
1471 	long		 space;
1472 	int		 error = 0, maxreached = 0;
1473 	unsigned int	 rcvstate;
1474 
1475 	soassertlocked(so);
1476 
1477  nextpkt:
1478 	if (so->so_error) {
1479 		error = so->so_error;
1480 		goto release;
1481 	}
1482 	if (sosp->so_snd.sb_state & SS_CANTSENDMORE) {
1483 		error = EPIPE;
1484 		goto release;
1485 	}
1486 	if (sosp->so_error && sosp->so_error != ETIMEDOUT &&
1487 	    sosp->so_error != EFBIG && sosp->so_error != ELOOP) {
1488 		error = sosp->so_error;
1489 		goto release;
1490 	}
1491 	if ((sosp->so_state & SS_ISCONNECTED) == 0)
1492 		goto release;
1493 
1494 	/* Calculate how many bytes can be copied now. */
1495 	len = so->so_rcv.sb_datacc;
1496 	if (so->so_splicemax) {
1497 		KASSERT(so->so_splicelen < so->so_splicemax);
1498 		if (so->so_splicemax <= so->so_splicelen + len) {
1499 			len = so->so_splicemax - so->so_splicelen;
1500 			maxreached = 1;
1501 		}
1502 	}
1503 	space = sbspace(sosp, &sosp->so_snd);
1504 	if (so->so_oobmark && so->so_oobmark < len &&
1505 	    so->so_oobmark < space + 1024)
1506 		space += 1024;
1507 	if (space <= 0) {
1508 		maxreached = 0;
1509 		goto release;
1510 	}
1511 	if (space < len) {
1512 		maxreached = 0;
1513 		if (space < sosp->so_snd.sb_lowat)
1514 			goto release;
1515 		len = space;
1516 	}
1517 	sosp->so_snd.sb_state |= SS_ISSENDING;
1518 
1519 	SBLASTRECORDCHK(&so->so_rcv, "somove 1");
1520 	SBLASTMBUFCHK(&so->so_rcv, "somove 1");
1521 	m = so->so_rcv.sb_mb;
1522 	if (m == NULL)
1523 		goto release;
1524 	nextrecord = m->m_nextpkt;
1525 
1526 	/* Drop address and control information not used with splicing. */
1527 	if (so->so_proto->pr_flags & PR_ADDR) {
1528 #ifdef DIAGNOSTIC
1529 		if (m->m_type != MT_SONAME)
1530 			panic("somove soname: so %p, so_type %d, m %p, "
1531 			    "m_type %d", so, so->so_type, m, m->m_type);
1532 #endif
1533 		m = m->m_next;
1534 	}
1535 	while (m && m->m_type == MT_CONTROL)
1536 		m = m->m_next;
1537 	if (m == NULL) {
1538 		sbdroprecord(so, &so->so_rcv);
1539 		if (so->so_proto->pr_flags & PR_WANTRCVD)
1540 			pru_rcvd(so);
1541 		goto nextpkt;
1542 	}
1543 
1544 	/*
1545 	 * By splicing sockets connected to localhost, userland might create a
1546 	 * loop.  Dissolve splicing with error if loop is detected by counter.
1547 	 *
1548 	 * If we deal with looped broadcast/multicast packet we bail out with
1549 	 * no error to suppress splice termination.
1550 	 */
1551 	if ((m->m_flags & M_PKTHDR) &&
1552 	    ((m->m_pkthdr.ph_loopcnt++ >= M_MAXLOOP) ||
1553 	    ((m->m_flags & M_LOOP) && (m->m_flags & (M_BCAST|M_MCAST))))) {
1554 		error = ELOOP;
1555 		goto release;
1556 	}
1557 
1558 	if (so->so_proto->pr_flags & PR_ATOMIC) {
1559 		if ((m->m_flags & M_PKTHDR) == 0)
1560 			panic("somove !PKTHDR: so %p, so_type %d, m %p, "
1561 			    "m_type %d", so, so->so_type, m, m->m_type);
1562 		if (sosp->so_snd.sb_hiwat < m->m_pkthdr.len) {
1563 			error = EMSGSIZE;
1564 			goto release;
1565 		}
1566 		if (len < m->m_pkthdr.len)
1567 			goto release;
1568 		if (m->m_pkthdr.len < len) {
1569 			maxreached = 0;
1570 			len = m->m_pkthdr.len;
1571 		}
1572 		/*
1573 		 * Throw away the name mbuf after it has been assured
1574 		 * that the whole first record can be processed.
1575 		 */
1576 		m = so->so_rcv.sb_mb;
1577 		sbfree(so, &so->so_rcv, m);
1578 		so->so_rcv.sb_mb = m_free(m);
1579 		sbsync(&so->so_rcv, nextrecord);
1580 	}
1581 	/*
1582 	 * Throw away the control mbufs after it has been assured
1583 	 * that the whole first record can be processed.
1584 	 */
1585 	m = so->so_rcv.sb_mb;
1586 	while (m && m->m_type == MT_CONTROL) {
1587 		sbfree(so, &so->so_rcv, m);
1588 		so->so_rcv.sb_mb = m_free(m);
1589 		m = so->so_rcv.sb_mb;
1590 		sbsync(&so->so_rcv, nextrecord);
1591 	}
1592 
1593 	SBLASTRECORDCHK(&so->so_rcv, "somove 2");
1594 	SBLASTMBUFCHK(&so->so_rcv, "somove 2");
1595 
1596 	/* Take at most len mbufs out of receive buffer. */
1597 	for (off = 0, mp = &m; off <= len && *mp;
1598 	    off += (*mp)->m_len, mp = &(*mp)->m_next) {
1599 		u_long size = len - off;
1600 
1601 #ifdef DIAGNOSTIC
1602 		if ((*mp)->m_type != MT_DATA && (*mp)->m_type != MT_HEADER)
1603 			panic("somove type: so %p, so_type %d, m %p, "
1604 			    "m_type %d", so, so->so_type, *mp, (*mp)->m_type);
1605 #endif
1606 		if ((*mp)->m_len > size) {
1607 			/*
1608 			 * Move only a partial mbuf at maximum splice length or
1609 			 * if the drain buffer is too small for this large mbuf.
1610 			 */
1611 			if (!maxreached && so->so_snd.sb_datacc > 0) {
1612 				len -= size;
1613 				break;
1614 			}
1615 			*mp = m_copym(so->so_rcv.sb_mb, 0, size, wait);
1616 			if (*mp == NULL) {
1617 				len -= size;
1618 				break;
1619 			}
1620 			so->so_rcv.sb_mb->m_data += size;
1621 			so->so_rcv.sb_mb->m_len -= size;
1622 			so->so_rcv.sb_cc -= size;
1623 			so->so_rcv.sb_datacc -= size;
1624 		} else {
1625 			*mp = so->so_rcv.sb_mb;
1626 			sbfree(so, &so->so_rcv, *mp);
1627 			so->so_rcv.sb_mb = (*mp)->m_next;
1628 			sbsync(&so->so_rcv, nextrecord);
1629 		}
1630 	}
1631 	*mp = NULL;
1632 
1633 	SBLASTRECORDCHK(&so->so_rcv, "somove 3");
1634 	SBLASTMBUFCHK(&so->so_rcv, "somove 3");
1635 	SBCHECK(so, &so->so_rcv);
1636 	if (m == NULL)
1637 		goto release;
1638 	m->m_nextpkt = NULL;
1639 	if (m->m_flags & M_PKTHDR) {
1640 		m_resethdr(m);
1641 		m->m_pkthdr.len = len;
1642 	}
1643 
1644 	/* Send window update to source peer as receive buffer has changed. */
1645 	if (so->so_proto->pr_flags & PR_WANTRCVD)
1646 		pru_rcvd(so);
1647 
1648 	/* Receive buffer did shrink by len bytes, adjust oob. */
1649 	rcvstate = so->so_rcv.sb_state;
1650 	so->so_rcv.sb_state &= ~SS_RCVATMARK;
1651 	oobmark = so->so_oobmark;
1652 	so->so_oobmark = oobmark > len ? oobmark - len : 0;
1653 	if (oobmark) {
1654 		if (oobmark == len)
1655 			so->so_rcv.sb_state |= SS_RCVATMARK;
1656 		if (oobmark >= len)
1657 			oobmark = 0;
1658 	}
1659 
1660 	/*
1661 	 * Handle oob data.  If any malloc fails, ignore error.
1662 	 * TCP urgent data is not very reliable anyway.
1663 	 */
1664 	while (((rcvstate & SS_RCVATMARK) || oobmark) &&
1665 	    (so->so_options & SO_OOBINLINE)) {
1666 		struct mbuf *o = NULL;
1667 
1668 		if (rcvstate & SS_RCVATMARK) {
1669 			o = m_get(wait, MT_DATA);
1670 			rcvstate &= ~SS_RCVATMARK;
1671 		} else if (oobmark) {
1672 			o = m_split(m, oobmark, wait);
1673 			if (o) {
1674 				error = pru_send(sosp, m, NULL, NULL);
1675 				if (error) {
1676 					if (sosp->so_snd.sb_state &
1677 					    SS_CANTSENDMORE)
1678 						error = EPIPE;
1679 					m_freem(o);
1680 					goto release;
1681 				}
1682 				len -= oobmark;
1683 				so->so_splicelen += oobmark;
1684 				m = o;
1685 				o = m_get(wait, MT_DATA);
1686 			}
1687 			oobmark = 0;
1688 		}
1689 		if (o) {
1690 			o->m_len = 1;
1691 			*mtod(o, caddr_t) = *mtod(m, caddr_t);
1692 			error = pru_sendoob(sosp, o, NULL, NULL);
1693 			if (error) {
1694 				if (sosp->so_snd.sb_state & SS_CANTSENDMORE)
1695 					error = EPIPE;
1696 				m_freem(m);
1697 				goto release;
1698 			}
1699 			len -= 1;
1700 			so->so_splicelen += 1;
1701 			if (oobmark) {
1702 				oobmark -= 1;
1703 				if (oobmark == 0)
1704 					rcvstate |= SS_RCVATMARK;
1705 			}
1706 			m_adj(m, 1);
1707 		}
1708 	}
1709 
1710 	/* Append all remaining data to drain socket. */
1711 	if (so->so_rcv.sb_cc == 0 || maxreached)
1712 		sosp->so_snd.sb_state &= ~SS_ISSENDING;
1713 	error = pru_send(sosp, m, NULL, NULL);
1714 	if (error) {
1715 		if (sosp->so_snd.sb_state & SS_CANTSENDMORE)
1716 			error = EPIPE;
1717 		goto release;
1718 	}
1719 	so->so_splicelen += len;
1720 
1721 	/* Move several packets if possible. */
1722 	if (!maxreached && nextrecord)
1723 		goto nextpkt;
1724 
1725  release:
1726 	sosp->so_snd.sb_state &= ~SS_ISSENDING;
1727 	if (!error && maxreached && so->so_splicemax == so->so_splicelen)
1728 		error = EFBIG;
1729 	if (error)
1730 		so->so_error = error;
1731 	if (((so->so_rcv.sb_state & SS_CANTRCVMORE) &&
1732 	    so->so_rcv.sb_cc == 0) ||
1733 	    (sosp->so_snd.sb_state & SS_CANTSENDMORE) ||
1734 	    maxreached || error) {
1735 		sounsplice(so, sosp, 0);
1736 		return (0);
1737 	}
1738 	if (timerisset(&so->so_idletv))
1739 		timeout_add_tv(&so->so_idleto, &so->so_idletv);
1740 	return (1);
1741 }
1742 
1743 #endif /* SOCKET_SPLICE */
1744 
1745 void
1746 sorwakeup(struct socket *so)
1747 {
1748 	soassertlocked(so);
1749 
1750 #ifdef SOCKET_SPLICE
1751 	if (so->so_rcv.sb_flags & SB_SPLICE) {
1752 		/*
1753 		 * TCP has a sendbuffer that can handle multiple packets
1754 		 * at once.  So queue the stream a bit to accumulate data.
1755 		 * The sosplice thread will call somove() later and send
1756 		 * the packets calling tcp_output() only once.
1757 		 * In the UDP case, send out the packets immediately.
1758 		 * Using a thread would make things slower.
1759 		 */
1760 		if (so->so_proto->pr_flags & PR_WANTRCVD)
1761 			task_add(sosplice_taskq, &so->so_splicetask);
1762 		else
1763 			somove(so, M_DONTWAIT);
1764 	}
1765 	if (isspliced(so))
1766 		return;
1767 #endif
1768 	sowakeup(so, &so->so_rcv);
1769 	if (so->so_upcall)
1770 		(*(so->so_upcall))(so, so->so_upcallarg, M_DONTWAIT);
1771 }
1772 
1773 void
1774 sowwakeup(struct socket *so)
1775 {
1776 	soassertlocked(so);
1777 
1778 #ifdef SOCKET_SPLICE
1779 	if (so->so_snd.sb_flags & SB_SPLICE)
1780 		task_add(sosplice_taskq, &so->so_sp->ssp_soback->so_splicetask);
1781 	if (issplicedback(so))
1782 		return;
1783 #endif
1784 	sowakeup(so, &so->so_snd);
1785 }
1786 
1787 int
1788 sosetopt(struct socket *so, int level, int optname, struct mbuf *m)
1789 {
1790 	int error = 0;
1791 
1792 	if (level != SOL_SOCKET) {
1793 		if (so->so_proto->pr_ctloutput) {
1794 			solock(so);
1795 			error = (*so->so_proto->pr_ctloutput)(PRCO_SETOPT, so,
1796 			    level, optname, m);
1797 			sounlock(so);
1798 			return (error);
1799 		}
1800 		error = ENOPROTOOPT;
1801 	} else {
1802 		switch (optname) {
1803 
1804 		case SO_LINGER:
1805 			if (m == NULL || m->m_len != sizeof (struct linger) ||
1806 			    mtod(m, struct linger *)->l_linger < 0 ||
1807 			    mtod(m, struct linger *)->l_linger > SHRT_MAX)
1808 				return (EINVAL);
1809 
1810 			solock(so);
1811 			so->so_linger = mtod(m, struct linger *)->l_linger;
1812 			if (*mtod(m, int *))
1813 				so->so_options |= optname;
1814 			else
1815 				so->so_options &= ~optname;
1816 			sounlock(so);
1817 
1818 			break;
1819 		case SO_BINDANY:
1820 			if ((error = suser(curproc)) != 0)	/* XXX */
1821 				return (error);
1822 			/* FALLTHROUGH */
1823 
1824 		case SO_DEBUG:
1825 		case SO_KEEPALIVE:
1826 		case SO_USELOOPBACK:
1827 		case SO_BROADCAST:
1828 		case SO_REUSEADDR:
1829 		case SO_REUSEPORT:
1830 		case SO_OOBINLINE:
1831 		case SO_TIMESTAMP:
1832 		case SO_ZEROIZE:
1833 			if (m == NULL || m->m_len < sizeof (int))
1834 				return (EINVAL);
1835 
1836 			solock(so);
1837 			if (*mtod(m, int *))
1838 				so->so_options |= optname;
1839 			else
1840 				so->so_options &= ~optname;
1841 			sounlock(so);
1842 
1843 			break;
1844 		case SO_DONTROUTE:
1845 			if (m == NULL || m->m_len < sizeof (int))
1846 				return (EINVAL);
1847 			if (*mtod(m, int *))
1848 				error = EOPNOTSUPP;
1849 			break;
1850 
1851 		case SO_SNDBUF:
1852 		case SO_RCVBUF:
1853 		case SO_SNDLOWAT:
1854 		case SO_RCVLOWAT:
1855 		    {
1856 			struct sockbuf *sb = (optname == SO_SNDBUF ||
1857 			    optname == SO_SNDLOWAT ?
1858 			    &so->so_snd : &so->so_rcv);
1859 			u_long cnt;
1860 
1861 			if (m == NULL || m->m_len < sizeof (int))
1862 				return (EINVAL);
1863 			cnt = *mtod(m, int *);
1864 			if ((long)cnt <= 0)
1865 				cnt = 1;
1866 
1867 			solock(so);
1868 			switch (optname) {
1869 			case SO_SNDBUF:
1870 			case SO_RCVBUF:
1871 				if (sb->sb_state &
1872 				    (SS_CANTSENDMORE | SS_CANTRCVMORE)) {
1873 					error = EINVAL;
1874 					break;
1875 				}
1876 				if (sbcheckreserve(cnt, sb->sb_wat) ||
1877 				    sbreserve(so, sb, cnt)) {
1878 					error = ENOBUFS;
1879 					break;
1880 				}
1881 				sb->sb_wat = cnt;
1882 				break;
1883 			case SO_SNDLOWAT:
1884 			case SO_RCVLOWAT:
1885 				sb->sb_lowat = (cnt > sb->sb_hiwat) ?
1886 				    sb->sb_hiwat : cnt;
1887 				break;
1888 			}
1889 			sounlock(so);
1890 			break;
1891 		    }
1892 
1893 		case SO_SNDTIMEO:
1894 		case SO_RCVTIMEO:
1895 		    {
1896 			struct sockbuf *sb = (optname == SO_SNDTIMEO ?
1897 			    &so->so_snd : &so->so_rcv);
1898 			struct timeval tv;
1899 			uint64_t nsecs;
1900 
1901 			if (m == NULL || m->m_len < sizeof (tv))
1902 				return (EINVAL);
1903 			memcpy(&tv, mtod(m, struct timeval *), sizeof tv);
1904 			if (!timerisvalid(&tv))
1905 				return (EINVAL);
1906 			nsecs = TIMEVAL_TO_NSEC(&tv);
1907 			if (nsecs == UINT64_MAX)
1908 				return (EDOM);
1909 			if (nsecs == 0)
1910 				nsecs = INFSLP;
1911 
1912 			solock(so);
1913 			sb->sb_timeo_nsecs = nsecs;
1914 			sounlock(so);
1915 			break;
1916 		    }
1917 
1918 		case SO_RTABLE:
1919 			if (so->so_proto->pr_domain &&
1920 			    so->so_proto->pr_domain->dom_protosw &&
1921 			    so->so_proto->pr_ctloutput) {
1922 				const struct domain *dom =
1923 				    so->so_proto->pr_domain;
1924 
1925 				level = dom->dom_protosw->pr_protocol;
1926 				solock(so);
1927 				error = (*so->so_proto->pr_ctloutput)
1928 				    (PRCO_SETOPT, so, level, optname, m);
1929 				sounlock(so);
1930 			} else
1931 				error = ENOPROTOOPT;
1932 			break;
1933 #ifdef SOCKET_SPLICE
1934 		case SO_SPLICE:
1935 			solock(so);
1936 			if (m == NULL) {
1937 				error = sosplice(so, -1, 0, NULL);
1938 			} else if (m->m_len < sizeof(int)) {
1939 				error = EINVAL;
1940 			} else if (m->m_len < sizeof(struct splice)) {
1941 				error = sosplice(so, *mtod(m, int *), 0, NULL);
1942 			} else {
1943 				error = sosplice(so,
1944 				    mtod(m, struct splice *)->sp_fd,
1945 				    mtod(m, struct splice *)->sp_max,
1946 				   &mtod(m, struct splice *)->sp_idle);
1947 			}
1948 			sounlock(so);
1949 			break;
1950 #endif /* SOCKET_SPLICE */
1951 
1952 		default:
1953 			error = ENOPROTOOPT;
1954 			break;
1955 		}
1956 	}
1957 
1958 	return (error);
1959 }
1960 
1961 int
1962 sogetopt(struct socket *so, int level, int optname, struct mbuf *m)
1963 {
1964 	int error = 0;
1965 
1966 	if (level != SOL_SOCKET) {
1967 		if (so->so_proto->pr_ctloutput) {
1968 			m->m_len = 0;
1969 
1970 			solock(so);
1971 			error = (*so->so_proto->pr_ctloutput)(PRCO_GETOPT, so,
1972 			    level, optname, m);
1973 			sounlock(so);
1974 			return (error);
1975 		} else
1976 			return (ENOPROTOOPT);
1977 	} else {
1978 		m->m_len = sizeof (int);
1979 
1980 		switch (optname) {
1981 
1982 		case SO_LINGER:
1983 			m->m_len = sizeof (struct linger);
1984 			solock_shared(so);
1985 			mtod(m, struct linger *)->l_onoff =
1986 				so->so_options & SO_LINGER;
1987 			mtod(m, struct linger *)->l_linger = so->so_linger;
1988 			sounlock_shared(so);
1989 			break;
1990 
1991 		case SO_BINDANY:
1992 		case SO_USELOOPBACK:
1993 		case SO_DEBUG:
1994 		case SO_KEEPALIVE:
1995 		case SO_REUSEADDR:
1996 		case SO_REUSEPORT:
1997 		case SO_BROADCAST:
1998 		case SO_OOBINLINE:
1999 		case SO_TIMESTAMP:
2000 		case SO_ZEROIZE:
2001 			*mtod(m, int *) = so->so_options & optname;
2002 			break;
2003 
2004 		case SO_DONTROUTE:
2005 			*mtod(m, int *) = 0;
2006 			break;
2007 
2008 		case SO_TYPE:
2009 			*mtod(m, int *) = so->so_type;
2010 			break;
2011 
2012 		case SO_ERROR:
2013 			solock(so);
2014 			*mtod(m, int *) = so->so_error;
2015 			so->so_error = 0;
2016 			sounlock(so);
2017 
2018 			break;
2019 
2020 		case SO_DOMAIN:
2021 			*mtod(m, int *) = so->so_proto->pr_domain->dom_family;
2022 			break;
2023 
2024 		case SO_PROTOCOL:
2025 			*mtod(m, int *) = so->so_proto->pr_protocol;
2026 			break;
2027 
2028 		case SO_SNDBUF:
2029 			*mtod(m, int *) = so->so_snd.sb_hiwat;
2030 			break;
2031 
2032 		case SO_RCVBUF:
2033 			*mtod(m, int *) = so->so_rcv.sb_hiwat;
2034 			break;
2035 
2036 		case SO_SNDLOWAT:
2037 			*mtod(m, int *) = so->so_snd.sb_lowat;
2038 			break;
2039 
2040 		case SO_RCVLOWAT:
2041 			*mtod(m, int *) = so->so_rcv.sb_lowat;
2042 			break;
2043 
2044 		case SO_SNDTIMEO:
2045 		case SO_RCVTIMEO:
2046 		    {
2047 			struct sockbuf *sb = (optname == SO_SNDTIMEO ?
2048 			    &so->so_snd : &so->so_rcv);
2049 			struct timeval tv;
2050 			uint64_t nsecs;
2051 
2052 			solock_shared(so);
2053 			nsecs = sb->sb_timeo_nsecs;
2054 			sounlock_shared(so);
2055 
2056 			m->m_len = sizeof(struct timeval);
2057 			memset(&tv, 0, sizeof(tv));
2058 			if (nsecs != INFSLP)
2059 				NSEC_TO_TIMEVAL(nsecs, &tv);
2060 			memcpy(mtod(m, struct timeval *), &tv, sizeof tv);
2061 			break;
2062 		    }
2063 
2064 		case SO_RTABLE:
2065 			if (so->so_proto->pr_domain &&
2066 			    so->so_proto->pr_domain->dom_protosw &&
2067 			    so->so_proto->pr_ctloutput) {
2068 				const struct domain *dom =
2069 				    so->so_proto->pr_domain;
2070 
2071 				level = dom->dom_protosw->pr_protocol;
2072 				solock(so);
2073 				error = (*so->so_proto->pr_ctloutput)
2074 				    (PRCO_GETOPT, so, level, optname, m);
2075 				sounlock(so);
2076 				if (error)
2077 					return (error);
2078 				break;
2079 			}
2080 			return (ENOPROTOOPT);
2081 
2082 #ifdef SOCKET_SPLICE
2083 		case SO_SPLICE:
2084 		    {
2085 			off_t len;
2086 
2087 			m->m_len = sizeof(off_t);
2088 			solock_shared(so);
2089 			len = so->so_sp ? so->so_sp->ssp_len : 0;
2090 			sounlock_shared(so);
2091 			memcpy(mtod(m, off_t *), &len, sizeof(off_t));
2092 			break;
2093 		    }
2094 #endif /* SOCKET_SPLICE */
2095 
2096 		case SO_PEERCRED:
2097 			if (so->so_proto->pr_protocol == AF_UNIX) {
2098 				struct unpcb *unp = sotounpcb(so);
2099 
2100 				solock(so);
2101 				if (unp->unp_flags & UNP_FEIDS) {
2102 					m->m_len = sizeof(unp->unp_connid);
2103 					memcpy(mtod(m, caddr_t),
2104 					    &(unp->unp_connid), m->m_len);
2105 					sounlock(so);
2106 					break;
2107 				}
2108 				sounlock(so);
2109 
2110 				return (ENOTCONN);
2111 			}
2112 			return (EOPNOTSUPP);
2113 
2114 		default:
2115 			return (ENOPROTOOPT);
2116 		}
2117 		return (0);
2118 	}
2119 }
2120 
2121 void
2122 sohasoutofband(struct socket *so)
2123 {
2124 	pgsigio(&so->so_sigio, SIGURG, 0);
2125 	knote_locked(&so->so_rcv.sb_klist, 0);
2126 }
2127 
2128 int
2129 soo_kqfilter(struct file *fp, struct knote *kn)
2130 {
2131 	struct socket *so = kn->kn_fp->f_data;
2132 	struct sockbuf *sb;
2133 
2134 	solock(so);
2135 	switch (kn->kn_filter) {
2136 	case EVFILT_READ:
2137 		if (so->so_options & SO_ACCEPTCONN)
2138 			kn->kn_fop = &solisten_filtops;
2139 		else
2140 			kn->kn_fop = &soread_filtops;
2141 		sb = &so->so_rcv;
2142 		break;
2143 	case EVFILT_WRITE:
2144 		kn->kn_fop = &sowrite_filtops;
2145 		sb = &so->so_snd;
2146 		break;
2147 	case EVFILT_EXCEPT:
2148 		kn->kn_fop = &soexcept_filtops;
2149 		sb = &so->so_rcv;
2150 		break;
2151 	default:
2152 		sounlock(so);
2153 		return (EINVAL);
2154 	}
2155 
2156 	klist_insert_locked(&sb->sb_klist, kn);
2157 	sounlock(so);
2158 
2159 	return (0);
2160 }
2161 
2162 void
2163 filt_sordetach(struct knote *kn)
2164 {
2165 	struct socket *so = kn->kn_fp->f_data;
2166 
2167 	klist_remove(&so->so_rcv.sb_klist, kn);
2168 }
2169 
2170 int
2171 filt_soread(struct knote *kn, long hint)
2172 {
2173 	struct socket *so = kn->kn_fp->f_data;
2174 	int rv = 0;
2175 
2176 	soassertlocked(so);
2177 
2178 	kn->kn_data = so->so_rcv.sb_cc;
2179 #ifdef SOCKET_SPLICE
2180 	if (isspliced(so)) {
2181 		rv = 0;
2182 	} else
2183 #endif /* SOCKET_SPLICE */
2184 	if (so->so_rcv.sb_state & SS_CANTRCVMORE) {
2185 		kn->kn_flags |= EV_EOF;
2186 		if (kn->kn_flags & __EV_POLL) {
2187 			if (so->so_state & SS_ISDISCONNECTED)
2188 				kn->kn_flags |= __EV_HUP;
2189 		}
2190 		kn->kn_fflags = so->so_error;
2191 		rv = 1;
2192 	} else if (so->so_error) {	/* temporary udp error */
2193 		rv = 1;
2194 	} else if (kn->kn_sfflags & NOTE_LOWAT) {
2195 		rv = (kn->kn_data >= kn->kn_sdata);
2196 	} else {
2197 		rv = (kn->kn_data >= so->so_rcv.sb_lowat);
2198 	}
2199 
2200 	return rv;
2201 }
2202 
2203 void
2204 filt_sowdetach(struct knote *kn)
2205 {
2206 	struct socket *so = kn->kn_fp->f_data;
2207 
2208 	klist_remove(&so->so_snd.sb_klist, kn);
2209 }
2210 
2211 int
2212 filt_sowrite(struct knote *kn, long hint)
2213 {
2214 	struct socket *so = kn->kn_fp->f_data;
2215 	int rv;
2216 
2217 	soassertlocked(so);
2218 
2219 	kn->kn_data = sbspace(so, &so->so_snd);
2220 	if (so->so_snd.sb_state & SS_CANTSENDMORE) {
2221 		kn->kn_flags |= EV_EOF;
2222 		if (kn->kn_flags & __EV_POLL) {
2223 			if (so->so_state & SS_ISDISCONNECTED)
2224 				kn->kn_flags |= __EV_HUP;
2225 		}
2226 		kn->kn_fflags = so->so_error;
2227 		rv = 1;
2228 	} else if (so->so_error) {	/* temporary udp error */
2229 		rv = 1;
2230 	} else if (((so->so_state & SS_ISCONNECTED) == 0) &&
2231 	    (so->so_proto->pr_flags & PR_CONNREQUIRED)) {
2232 		rv = 0;
2233 	} else if (kn->kn_sfflags & NOTE_LOWAT) {
2234 		rv = (kn->kn_data >= kn->kn_sdata);
2235 	} else {
2236 		rv = (kn->kn_data >= so->so_snd.sb_lowat);
2237 	}
2238 
2239 	return (rv);
2240 }
2241 
2242 int
2243 filt_soexcept(struct knote *kn, long hint)
2244 {
2245 	struct socket *so = kn->kn_fp->f_data;
2246 	int rv = 0;
2247 
2248 	soassertlocked(so);
2249 
2250 #ifdef SOCKET_SPLICE
2251 	if (isspliced(so)) {
2252 		rv = 0;
2253 	} else
2254 #endif /* SOCKET_SPLICE */
2255 	if (kn->kn_sfflags & NOTE_OOB) {
2256 		if (so->so_oobmark || (so->so_rcv.sb_state & SS_RCVATMARK)) {
2257 			kn->kn_fflags |= NOTE_OOB;
2258 			kn->kn_data -= so->so_oobmark;
2259 			rv = 1;
2260 		}
2261 	}
2262 
2263 	if (kn->kn_flags & __EV_POLL) {
2264 		if (so->so_state & SS_ISDISCONNECTED) {
2265 			kn->kn_flags |= __EV_HUP;
2266 			rv = 1;
2267 		}
2268 	}
2269 
2270 	return rv;
2271 }
2272 
2273 int
2274 filt_solisten(struct knote *kn, long hint)
2275 {
2276 	struct socket *so = kn->kn_fp->f_data;
2277 	int active;
2278 
2279 	soassertlocked(so);
2280 
2281 	kn->kn_data = so->so_qlen;
2282 	active = (kn->kn_data != 0);
2283 
2284 	if (kn->kn_flags & (__EV_POLL | __EV_SELECT)) {
2285 		if (so->so_state & SS_ISDISCONNECTED) {
2286 			kn->kn_flags |= __EV_HUP;
2287 			active = 1;
2288 		} else {
2289 			active = soreadable(so);
2290 		}
2291 	}
2292 
2293 	return (active);
2294 }
2295 
2296 int
2297 filt_somodify(struct kevent *kev, struct knote *kn)
2298 {
2299 	struct socket *so = kn->kn_fp->f_data;
2300 	int rv;
2301 
2302 	solock(so);
2303 	rv = knote_modify(kev, kn);
2304 	sounlock(so);
2305 
2306 	return (rv);
2307 }
2308 
2309 int
2310 filt_soprocess(struct knote *kn, struct kevent *kev)
2311 {
2312 	struct socket *so = kn->kn_fp->f_data;
2313 	int rv;
2314 
2315 	solock(so);
2316 	rv = knote_process(kn, kev);
2317 	sounlock(so);
2318 
2319 	return (rv);
2320 }
2321 
2322 void
2323 klist_soassertlk(void *arg)
2324 {
2325 	struct socket *so = arg;
2326 
2327 	soassertlocked(so);
2328 }
2329 
2330 int
2331 klist_solock(void *arg)
2332 {
2333 	struct socket *so = arg;
2334 
2335 	solock(so);
2336 	return (1);
2337 }
2338 
2339 void
2340 klist_sounlock(void *arg, int ls)
2341 {
2342 	struct socket *so = arg;
2343 
2344 	sounlock(so);
2345 }
2346 
2347 #ifdef DDB
2348 void
2349 sobuf_print(struct sockbuf *,
2350     int (*)(const char *, ...) __attribute__((__format__(__kprintf__,1,2))));
2351 
2352 void
2353 sobuf_print(struct sockbuf *sb,
2354     int (*pr)(const char *, ...) __attribute__((__format__(__kprintf__,1,2))))
2355 {
2356 	(*pr)("\tsb_cc: %lu\n", sb->sb_cc);
2357 	(*pr)("\tsb_datacc: %lu\n", sb->sb_datacc);
2358 	(*pr)("\tsb_hiwat: %lu\n", sb->sb_hiwat);
2359 	(*pr)("\tsb_wat: %lu\n", sb->sb_wat);
2360 	(*pr)("\tsb_mbcnt: %lu\n", sb->sb_mbcnt);
2361 	(*pr)("\tsb_mbmax: %lu\n", sb->sb_mbmax);
2362 	(*pr)("\tsb_lowat: %ld\n", sb->sb_lowat);
2363 	(*pr)("\tsb_mb: %p\n", sb->sb_mb);
2364 	(*pr)("\tsb_mbtail: %p\n", sb->sb_mbtail);
2365 	(*pr)("\tsb_lastrecord: %p\n", sb->sb_lastrecord);
2366 	(*pr)("\tsb_sel: ...\n");
2367 	(*pr)("\tsb_flags: %04x\n", sb->sb_flags);
2368 	(*pr)("\tsb_state: %04x\n", sb->sb_state);
2369 	(*pr)("\tsb_timeo_nsecs: %llu\n", sb->sb_timeo_nsecs);
2370 }
2371 
2372 void
2373 so_print(void *v,
2374     int (*pr)(const char *, ...) __attribute__((__format__(__kprintf__,1,2))))
2375 {
2376 	struct socket *so = v;
2377 
2378 	(*pr)("socket %p\n", so);
2379 	(*pr)("so_type: %i\n", so->so_type);
2380 	(*pr)("so_options: 0x%04x\n", so->so_options); /* %b */
2381 	(*pr)("so_linger: %i\n", so->so_linger);
2382 	(*pr)("so_state: 0x%04x\n", so->so_state);
2383 	(*pr)("so_pcb: %p\n", so->so_pcb);
2384 	(*pr)("so_proto: %p\n", so->so_proto);
2385 	(*pr)("so_sigio: %p\n", so->so_sigio.sir_sigio);
2386 
2387 	(*pr)("so_head: %p\n", so->so_head);
2388 	(*pr)("so_onq: %p\n", so->so_onq);
2389 	(*pr)("so_q0: @%p first: %p\n", &so->so_q0, TAILQ_FIRST(&so->so_q0));
2390 	(*pr)("so_q: @%p first: %p\n", &so->so_q, TAILQ_FIRST(&so->so_q));
2391 	(*pr)("so_eq: next: %p\n", TAILQ_NEXT(so, so_qe));
2392 	(*pr)("so_q0len: %i\n", so->so_q0len);
2393 	(*pr)("so_qlen: %i\n", so->so_qlen);
2394 	(*pr)("so_qlimit: %i\n", so->so_qlimit);
2395 	(*pr)("so_timeo: %i\n", so->so_timeo);
2396 	(*pr)("so_obmark: %lu\n", so->so_oobmark);
2397 
2398 	(*pr)("so_sp: %p\n", so->so_sp);
2399 	if (so->so_sp != NULL) {
2400 		(*pr)("\tssp_socket: %p\n", so->so_sp->ssp_socket);
2401 		(*pr)("\tssp_soback: %p\n", so->so_sp->ssp_soback);
2402 		(*pr)("\tssp_len: %lld\n",
2403 		    (unsigned long long)so->so_sp->ssp_len);
2404 		(*pr)("\tssp_max: %lld\n",
2405 		    (unsigned long long)so->so_sp->ssp_max);
2406 		(*pr)("\tssp_idletv: %lld %ld\n", so->so_sp->ssp_idletv.tv_sec,
2407 		    so->so_sp->ssp_idletv.tv_usec);
2408 		(*pr)("\tssp_idleto: %spending (@%i)\n",
2409 		    timeout_pending(&so->so_sp->ssp_idleto) ? "" : "not ",
2410 		    so->so_sp->ssp_idleto.to_time);
2411 	}
2412 
2413 	(*pr)("so_rcv:\n");
2414 	sobuf_print(&so->so_rcv, pr);
2415 	(*pr)("so_snd:\n");
2416 	sobuf_print(&so->so_snd, pr);
2417 
2418 	(*pr)("so_upcall: %p so_upcallarg: %p\n",
2419 	    so->so_upcall, so->so_upcallarg);
2420 
2421 	(*pr)("so_euid: %d so_ruid: %d\n", so->so_euid, so->so_ruid);
2422 	(*pr)("so_egid: %d so_rgid: %d\n", so->so_egid, so->so_rgid);
2423 	(*pr)("so_cpid: %d\n", so->so_cpid);
2424 }
2425 #endif
2426