1 /*- 2 * Copyright (c) 1982, 1986, 1989, 1990, 1993 3 * The Regents of the University of California. All rights reserved. 4 * 5 * sendfile(2) and related extensions: 6 * Copyright (c) 1998, David Greenman. All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 4. Neither the name of the University nor the names of its contributors 17 * may be used to endorse or promote products derived from this software 18 * without specific prior written permission. 19 * 20 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 24 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 25 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 26 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 30 * SUCH DAMAGE. 31 * 32 * @(#)uipc_syscalls.c 8.4 (Berkeley) 2/21/94 33 */ 34 35 #include <sys/cdefs.h> 36 __FBSDID("$FreeBSD$"); 37 38 #include "opt_capsicum.h" 39 #include "opt_inet.h" 40 #include "opt_inet6.h" 41 #include "opt_sctp.h" 42 #include "opt_compat.h" 43 #include "opt_ktrace.h" 44 45 #include <sys/param.h> 46 #include <sys/systm.h> 47 #include <sys/capability.h> 48 #include <sys/kernel.h> 49 #include <sys/lock.h> 50 #include <sys/mutex.h> 51 #include <sys/sysproto.h> 52 #include <sys/malloc.h> 53 #include <sys/filedesc.h> 54 #include <sys/event.h> 55 #include <sys/proc.h> 56 #include <sys/fcntl.h> 57 #include <sys/file.h> 58 #include <sys/filio.h> 59 #include <sys/jail.h> 60 #include <sys/mount.h> 61 #include <sys/mbuf.h> 62 #include <sys/protosw.h> 63 #include <sys/rwlock.h> 64 #include <sys/sf_buf.h> 65 #include <sys/sysent.h> 66 #include <sys/socket.h> 67 #include <sys/socketvar.h> 68 #include <sys/signalvar.h> 69 #include <sys/syscallsubr.h> 70 #include <sys/sysctl.h> 71 #include <sys/uio.h> 72 #include <sys/vnode.h> 73 #ifdef KTRACE 74 #include <sys/ktrace.h> 75 #endif 76 #ifdef COMPAT_FREEBSD32 77 #include <compat/freebsd32/freebsd32_util.h> 78 #endif 79 80 #include <net/vnet.h> 81 82 #include <security/audit/audit.h> 83 #include <security/mac/mac_framework.h> 84 85 #include <vm/vm.h> 86 #include <vm/vm_param.h> 87 #include <vm/vm_object.h> 88 #include <vm/vm_page.h> 89 #include <vm/vm_pageout.h> 90 #include <vm/vm_kern.h> 91 #include <vm/vm_extern.h> 92 93 #if defined(INET) || defined(INET6) 94 #ifdef SCTP 95 #include <netinet/sctp.h> 96 #include <netinet/sctp_peeloff.h> 97 #endif /* SCTP */ 98 #endif /* INET || INET6 */ 99 100 /* 101 * Flags for accept1() and kern_accept4(), in addition to SOCK_CLOEXEC 102 * and SOCK_NONBLOCK. 103 */ 104 #define ACCEPT4_INHERIT 0x1 105 #define ACCEPT4_COMPAT 0x2 106 107 static int sendit(struct thread *td, int s, struct msghdr *mp, int flags); 108 static int recvit(struct thread *td, int s, struct msghdr *mp, void *namelenp); 109 110 static int accept1(struct thread *td, int s, struct sockaddr *uname, 111 socklen_t *anamelen, int flags); 112 static int do_sendfile(struct thread *td, struct sendfile_args *uap, int compat); 113 static int getsockname1(struct thread *td, struct getsockname_args *uap, 114 int compat); 115 static int getpeername1(struct thread *td, struct getpeername_args *uap, 116 int compat); 117 118 /* 119 * NSFBUFS-related variables and associated sysctls 120 */ 121 int nsfbufs; 122 int nsfbufspeak; 123 int nsfbufsused; 124 125 SYSCTL_INT(_kern_ipc, OID_AUTO, nsfbufs, CTLFLAG_RDTUN, &nsfbufs, 0, 126 "Maximum number of sendfile(2) sf_bufs available"); 127 SYSCTL_INT(_kern_ipc, OID_AUTO, nsfbufspeak, CTLFLAG_RD, &nsfbufspeak, 0, 128 "Number of sendfile(2) sf_bufs at peak usage"); 129 SYSCTL_INT(_kern_ipc, OID_AUTO, nsfbufsused, CTLFLAG_RD, &nsfbufsused, 0, 130 "Number of sendfile(2) sf_bufs in use"); 131 132 /* 133 * Convert a user file descriptor to a kernel file entry and check if required 134 * capability rights are present. 135 * A reference on the file entry is held upon returning. 136 */ 137 static int 138 getsock_cap(struct filedesc *fdp, int fd, cap_rights_t rights, 139 struct file **fpp, u_int *fflagp) 140 { 141 struct file *fp; 142 int error; 143 144 error = fget_unlocked(fdp, fd, rights, 0, &fp, NULL); 145 if (error != 0) 146 return (error); 147 if (fp->f_type != DTYPE_SOCKET) { 148 fdrop(fp, curthread); 149 return (ENOTSOCK); 150 } 151 if (fflagp != NULL) 152 *fflagp = fp->f_flag; 153 *fpp = fp; 154 return (0); 155 } 156 157 /* 158 * System call interface to the socket abstraction. 159 */ 160 #if defined(COMPAT_43) 161 #define COMPAT_OLDSOCK 162 #endif 163 164 int 165 sys_socket(td, uap) 166 struct thread *td; 167 struct socket_args /* { 168 int domain; 169 int type; 170 int protocol; 171 } */ *uap; 172 { 173 struct socket *so; 174 struct file *fp; 175 int fd, error, type, oflag, fflag; 176 177 AUDIT_ARG_SOCKET(uap->domain, uap->type, uap->protocol); 178 179 type = uap->type; 180 oflag = 0; 181 fflag = 0; 182 if ((type & SOCK_CLOEXEC) != 0) { 183 type &= ~SOCK_CLOEXEC; 184 oflag |= O_CLOEXEC; 185 } 186 if ((type & SOCK_NONBLOCK) != 0) { 187 type &= ~SOCK_NONBLOCK; 188 fflag |= FNONBLOCK; 189 } 190 191 #ifdef MAC 192 error = mac_socket_check_create(td->td_ucred, uap->domain, type, 193 uap->protocol); 194 if (error) 195 return (error); 196 #endif 197 error = falloc(td, &fp, &fd, oflag); 198 if (error) 199 return (error); 200 /* An extra reference on `fp' has been held for us by falloc(). */ 201 error = socreate(uap->domain, &so, type, uap->protocol, 202 td->td_ucred, td); 203 if (error) { 204 fdclose(td->td_proc->p_fd, fp, fd, td); 205 } else { 206 finit(fp, FREAD | FWRITE | fflag, DTYPE_SOCKET, so, &socketops); 207 if ((fflag & FNONBLOCK) != 0) 208 (void) fo_ioctl(fp, FIONBIO, &fflag, td->td_ucred, td); 209 td->td_retval[0] = fd; 210 } 211 fdrop(fp, td); 212 return (error); 213 } 214 215 /* ARGSUSED */ 216 int 217 sys_bind(td, uap) 218 struct thread *td; 219 struct bind_args /* { 220 int s; 221 caddr_t name; 222 int namelen; 223 } */ *uap; 224 { 225 struct sockaddr *sa; 226 int error; 227 228 error = getsockaddr(&sa, uap->name, uap->namelen); 229 if (error == 0) { 230 error = kern_bind(td, uap->s, sa); 231 free(sa, M_SONAME); 232 } 233 return (error); 234 } 235 236 static int 237 kern_bindat(struct thread *td, int dirfd, int fd, struct sockaddr *sa) 238 { 239 struct socket *so; 240 struct file *fp; 241 int error; 242 243 AUDIT_ARG_FD(fd); 244 AUDIT_ARG_SOCKADDR(td, dirfd, sa); 245 error = getsock_cap(td->td_proc->p_fd, fd, CAP_BIND, &fp, NULL); 246 if (error) 247 return (error); 248 so = fp->f_data; 249 #ifdef KTRACE 250 if (KTRPOINT(td, KTR_STRUCT)) 251 ktrsockaddr(sa); 252 #endif 253 #ifdef MAC 254 error = mac_socket_check_bind(td->td_ucred, so, sa); 255 if (error == 0) { 256 #endif 257 if (dirfd == AT_FDCWD) 258 error = sobind(so, sa, td); 259 else 260 error = sobindat(dirfd, so, sa, td); 261 #ifdef MAC 262 } 263 #endif 264 fdrop(fp, td); 265 return (error); 266 } 267 268 int 269 kern_bind(struct thread *td, int fd, struct sockaddr *sa) 270 { 271 272 return (kern_bindat(td, AT_FDCWD, fd, sa)); 273 } 274 275 /* ARGSUSED */ 276 int 277 sys_bindat(td, uap) 278 struct thread *td; 279 struct bindat_args /* { 280 int fd; 281 int s; 282 caddr_t name; 283 int namelen; 284 } */ *uap; 285 { 286 struct sockaddr *sa; 287 int error; 288 289 error = getsockaddr(&sa, uap->name, uap->namelen); 290 if (error == 0) { 291 error = kern_bindat(td, uap->fd, uap->s, sa); 292 free(sa, M_SONAME); 293 } 294 return (error); 295 } 296 297 /* ARGSUSED */ 298 int 299 sys_listen(td, uap) 300 struct thread *td; 301 struct listen_args /* { 302 int s; 303 int backlog; 304 } */ *uap; 305 { 306 struct socket *so; 307 struct file *fp; 308 int error; 309 310 AUDIT_ARG_FD(uap->s); 311 error = getsock_cap(td->td_proc->p_fd, uap->s, CAP_LISTEN, &fp, NULL); 312 if (error == 0) { 313 so = fp->f_data; 314 #ifdef MAC 315 error = mac_socket_check_listen(td->td_ucred, so); 316 if (error == 0) 317 #endif 318 error = solisten(so, uap->backlog, td); 319 fdrop(fp, td); 320 } 321 return(error); 322 } 323 324 /* 325 * accept1() 326 */ 327 static int 328 accept1(td, s, uname, anamelen, flags) 329 struct thread *td; 330 int s; 331 struct sockaddr *uname; 332 socklen_t *anamelen; 333 int flags; 334 { 335 struct sockaddr *name; 336 socklen_t namelen; 337 struct file *fp; 338 int error; 339 340 if (uname == NULL) 341 return (kern_accept4(td, s, NULL, NULL, flags, NULL)); 342 343 error = copyin(anamelen, &namelen, sizeof (namelen)); 344 if (error) 345 return (error); 346 347 error = kern_accept4(td, s, &name, &namelen, flags, &fp); 348 349 /* 350 * return a namelen of zero for older code which might 351 * ignore the return value from accept. 352 */ 353 if (error) { 354 (void) copyout(&namelen, anamelen, sizeof(*anamelen)); 355 return (error); 356 } 357 358 if (error == 0 && uname != NULL) { 359 #ifdef COMPAT_OLDSOCK 360 if (flags & ACCEPT4_COMPAT) 361 ((struct osockaddr *)name)->sa_family = 362 name->sa_family; 363 #endif 364 error = copyout(name, uname, namelen); 365 } 366 if (error == 0) 367 error = copyout(&namelen, anamelen, 368 sizeof(namelen)); 369 if (error) 370 fdclose(td->td_proc->p_fd, fp, td->td_retval[0], td); 371 fdrop(fp, td); 372 free(name, M_SONAME); 373 return (error); 374 } 375 376 int 377 kern_accept(struct thread *td, int s, struct sockaddr **name, 378 socklen_t *namelen, struct file **fp) 379 { 380 return (kern_accept4(td, s, name, namelen, ACCEPT4_INHERIT, fp)); 381 } 382 383 int 384 kern_accept4(struct thread *td, int s, struct sockaddr **name, 385 socklen_t *namelen, int flags, struct file **fp) 386 { 387 struct filedesc *fdp; 388 struct file *headfp, *nfp = NULL; 389 struct sockaddr *sa = NULL; 390 int error; 391 struct socket *head, *so; 392 int fd; 393 u_int fflag; 394 pid_t pgid; 395 int tmp; 396 397 if (name) 398 *name = NULL; 399 400 AUDIT_ARG_FD(s); 401 fdp = td->td_proc->p_fd; 402 error = getsock_cap(fdp, s, CAP_ACCEPT, &headfp, &fflag); 403 if (error) 404 return (error); 405 head = headfp->f_data; 406 if ((head->so_options & SO_ACCEPTCONN) == 0) { 407 error = EINVAL; 408 goto done; 409 } 410 #ifdef MAC 411 error = mac_socket_check_accept(td->td_ucred, head); 412 if (error != 0) 413 goto done; 414 #endif 415 error = falloc(td, &nfp, &fd, (flags & SOCK_CLOEXEC) ? O_CLOEXEC : 0); 416 if (error) 417 goto done; 418 ACCEPT_LOCK(); 419 if ((head->so_state & SS_NBIO) && TAILQ_EMPTY(&head->so_comp)) { 420 ACCEPT_UNLOCK(); 421 error = EWOULDBLOCK; 422 goto noconnection; 423 } 424 while (TAILQ_EMPTY(&head->so_comp) && head->so_error == 0) { 425 if (head->so_rcv.sb_state & SBS_CANTRCVMORE) { 426 head->so_error = ECONNABORTED; 427 break; 428 } 429 error = msleep(&head->so_timeo, &accept_mtx, PSOCK | PCATCH, 430 "accept", 0); 431 if (error) { 432 ACCEPT_UNLOCK(); 433 goto noconnection; 434 } 435 } 436 if (head->so_error) { 437 error = head->so_error; 438 head->so_error = 0; 439 ACCEPT_UNLOCK(); 440 goto noconnection; 441 } 442 so = TAILQ_FIRST(&head->so_comp); 443 KASSERT(!(so->so_qstate & SQ_INCOMP), ("accept1: so SQ_INCOMP")); 444 KASSERT(so->so_qstate & SQ_COMP, ("accept1: so not SQ_COMP")); 445 446 /* 447 * Before changing the flags on the socket, we have to bump the 448 * reference count. Otherwise, if the protocol calls sofree(), 449 * the socket will be released due to a zero refcount. 450 */ 451 SOCK_LOCK(so); /* soref() and so_state update */ 452 soref(so); /* file descriptor reference */ 453 454 TAILQ_REMOVE(&head->so_comp, so, so_list); 455 head->so_qlen--; 456 if (flags & ACCEPT4_INHERIT) 457 so->so_state |= (head->so_state & SS_NBIO); 458 else 459 so->so_state |= (flags & SOCK_NONBLOCK) ? SS_NBIO : 0; 460 so->so_qstate &= ~SQ_COMP; 461 so->so_head = NULL; 462 463 SOCK_UNLOCK(so); 464 ACCEPT_UNLOCK(); 465 466 /* An extra reference on `nfp' has been held for us by falloc(). */ 467 td->td_retval[0] = fd; 468 469 /* connection has been removed from the listen queue */ 470 KNOTE_UNLOCKED(&head->so_rcv.sb_sel.si_note, 0); 471 472 if (flags & ACCEPT4_INHERIT) { 473 pgid = fgetown(&head->so_sigio); 474 if (pgid != 0) 475 fsetown(pgid, &so->so_sigio); 476 } else { 477 fflag &= ~(FNONBLOCK | FASYNC); 478 if (flags & SOCK_NONBLOCK) 479 fflag |= FNONBLOCK; 480 } 481 482 finit(nfp, fflag, DTYPE_SOCKET, so, &socketops); 483 /* Sync socket nonblocking/async state with file flags */ 484 tmp = fflag & FNONBLOCK; 485 (void) fo_ioctl(nfp, FIONBIO, &tmp, td->td_ucred, td); 486 tmp = fflag & FASYNC; 487 (void) fo_ioctl(nfp, FIOASYNC, &tmp, td->td_ucred, td); 488 sa = 0; 489 error = soaccept(so, &sa); 490 if (error) { 491 /* 492 * return a namelen of zero for older code which might 493 * ignore the return value from accept. 494 */ 495 if (name) 496 *namelen = 0; 497 goto noconnection; 498 } 499 if (sa == NULL) { 500 if (name) 501 *namelen = 0; 502 goto done; 503 } 504 AUDIT_ARG_SOCKADDR(td, AT_FDCWD, sa); 505 if (name) { 506 /* check sa_len before it is destroyed */ 507 if (*namelen > sa->sa_len) 508 *namelen = sa->sa_len; 509 #ifdef KTRACE 510 if (KTRPOINT(td, KTR_STRUCT)) 511 ktrsockaddr(sa); 512 #endif 513 *name = sa; 514 sa = NULL; 515 } 516 noconnection: 517 if (sa) 518 free(sa, M_SONAME); 519 520 /* 521 * close the new descriptor, assuming someone hasn't ripped it 522 * out from under us. 523 */ 524 if (error) 525 fdclose(fdp, nfp, fd, td); 526 527 /* 528 * Release explicitly held references before returning. We return 529 * a reference on nfp to the caller on success if they request it. 530 */ 531 done: 532 if (fp != NULL) { 533 if (error == 0) { 534 *fp = nfp; 535 nfp = NULL; 536 } else 537 *fp = NULL; 538 } 539 if (nfp != NULL) 540 fdrop(nfp, td); 541 fdrop(headfp, td); 542 return (error); 543 } 544 545 int 546 sys_accept(td, uap) 547 struct thread *td; 548 struct accept_args *uap; 549 { 550 551 return (accept1(td, uap->s, uap->name, uap->anamelen, ACCEPT4_INHERIT)); 552 } 553 554 int 555 sys_accept4(td, uap) 556 struct thread *td; 557 struct accept4_args *uap; 558 { 559 if (uap->flags & ~(SOCK_CLOEXEC | SOCK_NONBLOCK)) 560 return (EINVAL); 561 562 return (accept1(td, uap->s, uap->name, uap->anamelen, uap->flags)); 563 } 564 565 #ifdef COMPAT_OLDSOCK 566 int 567 oaccept(td, uap) 568 struct thread *td; 569 struct accept_args *uap; 570 { 571 572 return (accept1(td, uap->s, uap->name, uap->anamelen, 573 ACCEPT4_INHERIT | ACCEPT4_COMPAT)); 574 } 575 #endif /* COMPAT_OLDSOCK */ 576 577 /* ARGSUSED */ 578 int 579 sys_connect(td, uap) 580 struct thread *td; 581 struct connect_args /* { 582 int s; 583 caddr_t name; 584 int namelen; 585 } */ *uap; 586 { 587 struct sockaddr *sa; 588 int error; 589 590 error = getsockaddr(&sa, uap->name, uap->namelen); 591 if (error == 0) { 592 error = kern_connect(td, uap->s, sa); 593 free(sa, M_SONAME); 594 } 595 return (error); 596 } 597 598 static int 599 kern_connectat(struct thread *td, int dirfd, int fd, struct sockaddr *sa) 600 { 601 struct socket *so; 602 struct file *fp; 603 int error; 604 int interrupted = 0; 605 606 AUDIT_ARG_FD(fd); 607 AUDIT_ARG_SOCKADDR(td, dirfd, sa); 608 error = getsock_cap(td->td_proc->p_fd, fd, CAP_CONNECT, &fp, NULL); 609 if (error) 610 return (error); 611 so = fp->f_data; 612 if (so->so_state & SS_ISCONNECTING) { 613 error = EALREADY; 614 goto done1; 615 } 616 #ifdef KTRACE 617 if (KTRPOINT(td, KTR_STRUCT)) 618 ktrsockaddr(sa); 619 #endif 620 #ifdef MAC 621 error = mac_socket_check_connect(td->td_ucred, so, sa); 622 if (error) 623 goto bad; 624 #endif 625 if (dirfd == AT_FDCWD) 626 error = soconnect(so, sa, td); 627 else 628 error = soconnectat(dirfd, so, sa, td); 629 if (error) 630 goto bad; 631 if ((so->so_state & SS_NBIO) && (so->so_state & SS_ISCONNECTING)) { 632 error = EINPROGRESS; 633 goto done1; 634 } 635 SOCK_LOCK(so); 636 while ((so->so_state & SS_ISCONNECTING) && so->so_error == 0) { 637 error = msleep(&so->so_timeo, SOCK_MTX(so), PSOCK | PCATCH, 638 "connec", 0); 639 if (error) { 640 if (error == EINTR || error == ERESTART) 641 interrupted = 1; 642 break; 643 } 644 } 645 if (error == 0) { 646 error = so->so_error; 647 so->so_error = 0; 648 } 649 SOCK_UNLOCK(so); 650 bad: 651 if (!interrupted) 652 so->so_state &= ~SS_ISCONNECTING; 653 if (error == ERESTART) 654 error = EINTR; 655 done1: 656 fdrop(fp, td); 657 return (error); 658 } 659 660 int 661 kern_connect(struct thread *td, int fd, struct sockaddr *sa) 662 { 663 664 return (kern_connectat(td, AT_FDCWD, fd, sa)); 665 } 666 667 /* ARGSUSED */ 668 int 669 sys_connectat(td, uap) 670 struct thread *td; 671 struct connectat_args /* { 672 int fd; 673 int s; 674 caddr_t name; 675 int namelen; 676 } */ *uap; 677 { 678 struct sockaddr *sa; 679 int error; 680 681 error = getsockaddr(&sa, uap->name, uap->namelen); 682 if (error == 0) { 683 error = kern_connectat(td, uap->fd, uap->s, sa); 684 free(sa, M_SONAME); 685 } 686 return (error); 687 } 688 689 int 690 kern_socketpair(struct thread *td, int domain, int type, int protocol, 691 int *rsv) 692 { 693 struct filedesc *fdp = td->td_proc->p_fd; 694 struct file *fp1, *fp2; 695 struct socket *so1, *so2; 696 int fd, error, oflag, fflag; 697 698 AUDIT_ARG_SOCKET(domain, type, protocol); 699 700 oflag = 0; 701 fflag = 0; 702 if ((type & SOCK_CLOEXEC) != 0) { 703 type &= ~SOCK_CLOEXEC; 704 oflag |= O_CLOEXEC; 705 } 706 if ((type & SOCK_NONBLOCK) != 0) { 707 type &= ~SOCK_NONBLOCK; 708 fflag |= FNONBLOCK; 709 } 710 #ifdef MAC 711 /* We might want to have a separate check for socket pairs. */ 712 error = mac_socket_check_create(td->td_ucred, domain, type, 713 protocol); 714 if (error) 715 return (error); 716 #endif 717 error = socreate(domain, &so1, type, protocol, td->td_ucred, td); 718 if (error) 719 return (error); 720 error = socreate(domain, &so2, type, protocol, td->td_ucred, td); 721 if (error) 722 goto free1; 723 /* On success extra reference to `fp1' and 'fp2' is set by falloc. */ 724 error = falloc(td, &fp1, &fd, oflag); 725 if (error) 726 goto free2; 727 rsv[0] = fd; 728 fp1->f_data = so1; /* so1 already has ref count */ 729 error = falloc(td, &fp2, &fd, oflag); 730 if (error) 731 goto free3; 732 fp2->f_data = so2; /* so2 already has ref count */ 733 rsv[1] = fd; 734 error = soconnect2(so1, so2); 735 if (error) 736 goto free4; 737 if (type == SOCK_DGRAM) { 738 /* 739 * Datagram socket connection is asymmetric. 740 */ 741 error = soconnect2(so2, so1); 742 if (error) 743 goto free4; 744 } 745 finit(fp1, FREAD | FWRITE | fflag, DTYPE_SOCKET, fp1->f_data, 746 &socketops); 747 finit(fp2, FREAD | FWRITE | fflag, DTYPE_SOCKET, fp2->f_data, 748 &socketops); 749 if ((fflag & FNONBLOCK) != 0) { 750 (void) fo_ioctl(fp1, FIONBIO, &fflag, td->td_ucred, td); 751 (void) fo_ioctl(fp2, FIONBIO, &fflag, td->td_ucred, td); 752 } 753 fdrop(fp1, td); 754 fdrop(fp2, td); 755 return (0); 756 free4: 757 fdclose(fdp, fp2, rsv[1], td); 758 fdrop(fp2, td); 759 free3: 760 fdclose(fdp, fp1, rsv[0], td); 761 fdrop(fp1, td); 762 free2: 763 if (so2 != NULL) 764 (void)soclose(so2); 765 free1: 766 if (so1 != NULL) 767 (void)soclose(so1); 768 return (error); 769 } 770 771 int 772 sys_socketpair(struct thread *td, struct socketpair_args *uap) 773 { 774 int error, sv[2]; 775 776 error = kern_socketpair(td, uap->domain, uap->type, 777 uap->protocol, sv); 778 if (error) 779 return (error); 780 error = copyout(sv, uap->rsv, 2 * sizeof(int)); 781 if (error) { 782 (void)kern_close(td, sv[0]); 783 (void)kern_close(td, sv[1]); 784 } 785 return (error); 786 } 787 788 static int 789 sendit(td, s, mp, flags) 790 struct thread *td; 791 int s; 792 struct msghdr *mp; 793 int flags; 794 { 795 struct mbuf *control; 796 struct sockaddr *to; 797 int error; 798 799 #ifdef CAPABILITY_MODE 800 if (IN_CAPABILITY_MODE(td) && (mp->msg_name != NULL)) 801 return (ECAPMODE); 802 #endif 803 804 if (mp->msg_name != NULL) { 805 error = getsockaddr(&to, mp->msg_name, mp->msg_namelen); 806 if (error) { 807 to = NULL; 808 goto bad; 809 } 810 mp->msg_name = to; 811 } else { 812 to = NULL; 813 } 814 815 if (mp->msg_control) { 816 if (mp->msg_controllen < sizeof(struct cmsghdr) 817 #ifdef COMPAT_OLDSOCK 818 && mp->msg_flags != MSG_COMPAT 819 #endif 820 ) { 821 error = EINVAL; 822 goto bad; 823 } 824 error = sockargs(&control, mp->msg_control, 825 mp->msg_controllen, MT_CONTROL); 826 if (error) 827 goto bad; 828 #ifdef COMPAT_OLDSOCK 829 if (mp->msg_flags == MSG_COMPAT) { 830 struct cmsghdr *cm; 831 832 M_PREPEND(control, sizeof(*cm), M_WAITOK); 833 cm = mtod(control, struct cmsghdr *); 834 cm->cmsg_len = control->m_len; 835 cm->cmsg_level = SOL_SOCKET; 836 cm->cmsg_type = SCM_RIGHTS; 837 } 838 #endif 839 } else { 840 control = NULL; 841 } 842 843 error = kern_sendit(td, s, mp, flags, control, UIO_USERSPACE); 844 845 bad: 846 if (to) 847 free(to, M_SONAME); 848 return (error); 849 } 850 851 int 852 kern_sendit(td, s, mp, flags, control, segflg) 853 struct thread *td; 854 int s; 855 struct msghdr *mp; 856 int flags; 857 struct mbuf *control; 858 enum uio_seg segflg; 859 { 860 struct file *fp; 861 struct uio auio; 862 struct iovec *iov; 863 struct socket *so; 864 int i, error; 865 ssize_t len; 866 cap_rights_t rights; 867 #ifdef KTRACE 868 struct uio *ktruio = NULL; 869 #endif 870 871 AUDIT_ARG_FD(s); 872 rights = CAP_SEND; 873 if (mp->msg_name != NULL) { 874 AUDIT_ARG_SOCKADDR(td, AT_FDCWD, mp->msg_name); 875 rights |= CAP_CONNECT; 876 } 877 error = getsock_cap(td->td_proc->p_fd, s, rights, &fp, NULL); 878 if (error) 879 return (error); 880 so = (struct socket *)fp->f_data; 881 882 #ifdef KTRACE 883 if (mp->msg_name != NULL && KTRPOINT(td, KTR_STRUCT)) 884 ktrsockaddr(mp->msg_name); 885 #endif 886 #ifdef MAC 887 if (mp->msg_name != NULL) { 888 error = mac_socket_check_connect(td->td_ucred, so, 889 mp->msg_name); 890 if (error) 891 goto bad; 892 } 893 error = mac_socket_check_send(td->td_ucred, so); 894 if (error) 895 goto bad; 896 #endif 897 898 auio.uio_iov = mp->msg_iov; 899 auio.uio_iovcnt = mp->msg_iovlen; 900 auio.uio_segflg = segflg; 901 auio.uio_rw = UIO_WRITE; 902 auio.uio_td = td; 903 auio.uio_offset = 0; /* XXX */ 904 auio.uio_resid = 0; 905 iov = mp->msg_iov; 906 for (i = 0; i < mp->msg_iovlen; i++, iov++) { 907 if ((auio.uio_resid += iov->iov_len) < 0) { 908 error = EINVAL; 909 goto bad; 910 } 911 } 912 #ifdef KTRACE 913 if (KTRPOINT(td, KTR_GENIO)) 914 ktruio = cloneuio(&auio); 915 #endif 916 len = auio.uio_resid; 917 error = sosend(so, mp->msg_name, &auio, 0, control, flags, td); 918 if (error) { 919 if (auio.uio_resid != len && (error == ERESTART || 920 error == EINTR || error == EWOULDBLOCK)) 921 error = 0; 922 /* Generation of SIGPIPE can be controlled per socket */ 923 if (error == EPIPE && !(so->so_options & SO_NOSIGPIPE) && 924 !(flags & MSG_NOSIGNAL)) { 925 PROC_LOCK(td->td_proc); 926 tdsignal(td, SIGPIPE); 927 PROC_UNLOCK(td->td_proc); 928 } 929 } 930 if (error == 0) 931 td->td_retval[0] = len - auio.uio_resid; 932 #ifdef KTRACE 933 if (ktruio != NULL) { 934 ktruio->uio_resid = td->td_retval[0]; 935 ktrgenio(s, UIO_WRITE, ktruio, error); 936 } 937 #endif 938 bad: 939 fdrop(fp, td); 940 return (error); 941 } 942 943 int 944 sys_sendto(td, uap) 945 struct thread *td; 946 struct sendto_args /* { 947 int s; 948 caddr_t buf; 949 size_t len; 950 int flags; 951 caddr_t to; 952 int tolen; 953 } */ *uap; 954 { 955 struct msghdr msg; 956 struct iovec aiov; 957 int error; 958 959 msg.msg_name = uap->to; 960 msg.msg_namelen = uap->tolen; 961 msg.msg_iov = &aiov; 962 msg.msg_iovlen = 1; 963 msg.msg_control = 0; 964 #ifdef COMPAT_OLDSOCK 965 msg.msg_flags = 0; 966 #endif 967 aiov.iov_base = uap->buf; 968 aiov.iov_len = uap->len; 969 error = sendit(td, uap->s, &msg, uap->flags); 970 return (error); 971 } 972 973 #ifdef COMPAT_OLDSOCK 974 int 975 osend(td, uap) 976 struct thread *td; 977 struct osend_args /* { 978 int s; 979 caddr_t buf; 980 int len; 981 int flags; 982 } */ *uap; 983 { 984 struct msghdr msg; 985 struct iovec aiov; 986 int error; 987 988 msg.msg_name = 0; 989 msg.msg_namelen = 0; 990 msg.msg_iov = &aiov; 991 msg.msg_iovlen = 1; 992 aiov.iov_base = uap->buf; 993 aiov.iov_len = uap->len; 994 msg.msg_control = 0; 995 msg.msg_flags = 0; 996 error = sendit(td, uap->s, &msg, uap->flags); 997 return (error); 998 } 999 1000 int 1001 osendmsg(td, uap) 1002 struct thread *td; 1003 struct osendmsg_args /* { 1004 int s; 1005 caddr_t msg; 1006 int flags; 1007 } */ *uap; 1008 { 1009 struct msghdr msg; 1010 struct iovec *iov; 1011 int error; 1012 1013 error = copyin(uap->msg, &msg, sizeof (struct omsghdr)); 1014 if (error) 1015 return (error); 1016 error = copyiniov(msg.msg_iov, msg.msg_iovlen, &iov, EMSGSIZE); 1017 if (error) 1018 return (error); 1019 msg.msg_iov = iov; 1020 msg.msg_flags = MSG_COMPAT; 1021 error = sendit(td, uap->s, &msg, uap->flags); 1022 free(iov, M_IOV); 1023 return (error); 1024 } 1025 #endif 1026 1027 int 1028 sys_sendmsg(td, uap) 1029 struct thread *td; 1030 struct sendmsg_args /* { 1031 int s; 1032 caddr_t msg; 1033 int flags; 1034 } */ *uap; 1035 { 1036 struct msghdr msg; 1037 struct iovec *iov; 1038 int error; 1039 1040 error = copyin(uap->msg, &msg, sizeof (msg)); 1041 if (error) 1042 return (error); 1043 error = copyiniov(msg.msg_iov, msg.msg_iovlen, &iov, EMSGSIZE); 1044 if (error) 1045 return (error); 1046 msg.msg_iov = iov; 1047 #ifdef COMPAT_OLDSOCK 1048 msg.msg_flags = 0; 1049 #endif 1050 error = sendit(td, uap->s, &msg, uap->flags); 1051 free(iov, M_IOV); 1052 return (error); 1053 } 1054 1055 int 1056 kern_recvit(td, s, mp, fromseg, controlp) 1057 struct thread *td; 1058 int s; 1059 struct msghdr *mp; 1060 enum uio_seg fromseg; 1061 struct mbuf **controlp; 1062 { 1063 struct uio auio; 1064 struct iovec *iov; 1065 int i; 1066 ssize_t len; 1067 int error; 1068 struct mbuf *m, *control = NULL; 1069 caddr_t ctlbuf; 1070 struct file *fp; 1071 struct socket *so; 1072 struct sockaddr *fromsa = NULL; 1073 #ifdef KTRACE 1074 struct uio *ktruio = NULL; 1075 #endif 1076 1077 if (controlp != NULL) 1078 *controlp = NULL; 1079 1080 AUDIT_ARG_FD(s); 1081 error = getsock_cap(td->td_proc->p_fd, s, CAP_RECV, &fp, NULL); 1082 if (error) 1083 return (error); 1084 so = fp->f_data; 1085 1086 #ifdef MAC 1087 error = mac_socket_check_receive(td->td_ucred, so); 1088 if (error) { 1089 fdrop(fp, td); 1090 return (error); 1091 } 1092 #endif 1093 1094 auio.uio_iov = mp->msg_iov; 1095 auio.uio_iovcnt = mp->msg_iovlen; 1096 auio.uio_segflg = UIO_USERSPACE; 1097 auio.uio_rw = UIO_READ; 1098 auio.uio_td = td; 1099 auio.uio_offset = 0; /* XXX */ 1100 auio.uio_resid = 0; 1101 iov = mp->msg_iov; 1102 for (i = 0; i < mp->msg_iovlen; i++, iov++) { 1103 if ((auio.uio_resid += iov->iov_len) < 0) { 1104 fdrop(fp, td); 1105 return (EINVAL); 1106 } 1107 } 1108 #ifdef KTRACE 1109 if (KTRPOINT(td, KTR_GENIO)) 1110 ktruio = cloneuio(&auio); 1111 #endif 1112 len = auio.uio_resid; 1113 error = soreceive(so, &fromsa, &auio, NULL, 1114 (mp->msg_control || controlp) ? &control : NULL, 1115 &mp->msg_flags); 1116 if (error) { 1117 if (auio.uio_resid != len && (error == ERESTART || 1118 error == EINTR || error == EWOULDBLOCK)) 1119 error = 0; 1120 } 1121 if (fromsa != NULL) 1122 AUDIT_ARG_SOCKADDR(td, AT_FDCWD, fromsa); 1123 #ifdef KTRACE 1124 if (ktruio != NULL) { 1125 ktruio->uio_resid = len - auio.uio_resid; 1126 ktrgenio(s, UIO_READ, ktruio, error); 1127 } 1128 #endif 1129 if (error) 1130 goto out; 1131 td->td_retval[0] = len - auio.uio_resid; 1132 if (mp->msg_name) { 1133 len = mp->msg_namelen; 1134 if (len <= 0 || fromsa == NULL) 1135 len = 0; 1136 else { 1137 /* save sa_len before it is destroyed by MSG_COMPAT */ 1138 len = MIN(len, fromsa->sa_len); 1139 #ifdef COMPAT_OLDSOCK 1140 if (mp->msg_flags & MSG_COMPAT) 1141 ((struct osockaddr *)fromsa)->sa_family = 1142 fromsa->sa_family; 1143 #endif 1144 if (fromseg == UIO_USERSPACE) { 1145 error = copyout(fromsa, mp->msg_name, 1146 (unsigned)len); 1147 if (error) 1148 goto out; 1149 } else 1150 bcopy(fromsa, mp->msg_name, len); 1151 } 1152 mp->msg_namelen = len; 1153 } 1154 if (mp->msg_control && controlp == NULL) { 1155 #ifdef COMPAT_OLDSOCK 1156 /* 1157 * We assume that old recvmsg calls won't receive access 1158 * rights and other control info, esp. as control info 1159 * is always optional and those options didn't exist in 4.3. 1160 * If we receive rights, trim the cmsghdr; anything else 1161 * is tossed. 1162 */ 1163 if (control && mp->msg_flags & MSG_COMPAT) { 1164 if (mtod(control, struct cmsghdr *)->cmsg_level != 1165 SOL_SOCKET || 1166 mtod(control, struct cmsghdr *)->cmsg_type != 1167 SCM_RIGHTS) { 1168 mp->msg_controllen = 0; 1169 goto out; 1170 } 1171 control->m_len -= sizeof (struct cmsghdr); 1172 control->m_data += sizeof (struct cmsghdr); 1173 } 1174 #endif 1175 len = mp->msg_controllen; 1176 m = control; 1177 mp->msg_controllen = 0; 1178 ctlbuf = mp->msg_control; 1179 1180 while (m && len > 0) { 1181 unsigned int tocopy; 1182 1183 if (len >= m->m_len) 1184 tocopy = m->m_len; 1185 else { 1186 mp->msg_flags |= MSG_CTRUNC; 1187 tocopy = len; 1188 } 1189 1190 if ((error = copyout(mtod(m, caddr_t), 1191 ctlbuf, tocopy)) != 0) 1192 goto out; 1193 1194 ctlbuf += tocopy; 1195 len -= tocopy; 1196 m = m->m_next; 1197 } 1198 mp->msg_controllen = ctlbuf - (caddr_t)mp->msg_control; 1199 } 1200 out: 1201 fdrop(fp, td); 1202 #ifdef KTRACE 1203 if (fromsa && KTRPOINT(td, KTR_STRUCT)) 1204 ktrsockaddr(fromsa); 1205 #endif 1206 if (fromsa) 1207 free(fromsa, M_SONAME); 1208 1209 if (error == 0 && controlp != NULL) 1210 *controlp = control; 1211 else if (control) 1212 m_freem(control); 1213 1214 return (error); 1215 } 1216 1217 static int 1218 recvit(td, s, mp, namelenp) 1219 struct thread *td; 1220 int s; 1221 struct msghdr *mp; 1222 void *namelenp; 1223 { 1224 int error; 1225 1226 error = kern_recvit(td, s, mp, UIO_USERSPACE, NULL); 1227 if (error) 1228 return (error); 1229 if (namelenp) { 1230 error = copyout(&mp->msg_namelen, namelenp, sizeof (socklen_t)); 1231 #ifdef COMPAT_OLDSOCK 1232 if (mp->msg_flags & MSG_COMPAT) 1233 error = 0; /* old recvfrom didn't check */ 1234 #endif 1235 } 1236 return (error); 1237 } 1238 1239 int 1240 sys_recvfrom(td, uap) 1241 struct thread *td; 1242 struct recvfrom_args /* { 1243 int s; 1244 caddr_t buf; 1245 size_t len; 1246 int flags; 1247 struct sockaddr * __restrict from; 1248 socklen_t * __restrict fromlenaddr; 1249 } */ *uap; 1250 { 1251 struct msghdr msg; 1252 struct iovec aiov; 1253 int error; 1254 1255 if (uap->fromlenaddr) { 1256 error = copyin(uap->fromlenaddr, 1257 &msg.msg_namelen, sizeof (msg.msg_namelen)); 1258 if (error) 1259 goto done2; 1260 } else { 1261 msg.msg_namelen = 0; 1262 } 1263 msg.msg_name = uap->from; 1264 msg.msg_iov = &aiov; 1265 msg.msg_iovlen = 1; 1266 aiov.iov_base = uap->buf; 1267 aiov.iov_len = uap->len; 1268 msg.msg_control = 0; 1269 msg.msg_flags = uap->flags; 1270 error = recvit(td, uap->s, &msg, uap->fromlenaddr); 1271 done2: 1272 return(error); 1273 } 1274 1275 #ifdef COMPAT_OLDSOCK 1276 int 1277 orecvfrom(td, uap) 1278 struct thread *td; 1279 struct recvfrom_args *uap; 1280 { 1281 1282 uap->flags |= MSG_COMPAT; 1283 return (sys_recvfrom(td, uap)); 1284 } 1285 #endif 1286 1287 #ifdef COMPAT_OLDSOCK 1288 int 1289 orecv(td, uap) 1290 struct thread *td; 1291 struct orecv_args /* { 1292 int s; 1293 caddr_t buf; 1294 int len; 1295 int flags; 1296 } */ *uap; 1297 { 1298 struct msghdr msg; 1299 struct iovec aiov; 1300 int error; 1301 1302 msg.msg_name = 0; 1303 msg.msg_namelen = 0; 1304 msg.msg_iov = &aiov; 1305 msg.msg_iovlen = 1; 1306 aiov.iov_base = uap->buf; 1307 aiov.iov_len = uap->len; 1308 msg.msg_control = 0; 1309 msg.msg_flags = uap->flags; 1310 error = recvit(td, uap->s, &msg, NULL); 1311 return (error); 1312 } 1313 1314 /* 1315 * Old recvmsg. This code takes advantage of the fact that the old msghdr 1316 * overlays the new one, missing only the flags, and with the (old) access 1317 * rights where the control fields are now. 1318 */ 1319 int 1320 orecvmsg(td, uap) 1321 struct thread *td; 1322 struct orecvmsg_args /* { 1323 int s; 1324 struct omsghdr *msg; 1325 int flags; 1326 } */ *uap; 1327 { 1328 struct msghdr msg; 1329 struct iovec *iov; 1330 int error; 1331 1332 error = copyin(uap->msg, &msg, sizeof (struct omsghdr)); 1333 if (error) 1334 return (error); 1335 error = copyiniov(msg.msg_iov, msg.msg_iovlen, &iov, EMSGSIZE); 1336 if (error) 1337 return (error); 1338 msg.msg_flags = uap->flags | MSG_COMPAT; 1339 msg.msg_iov = iov; 1340 error = recvit(td, uap->s, &msg, &uap->msg->msg_namelen); 1341 if (msg.msg_controllen && error == 0) 1342 error = copyout(&msg.msg_controllen, 1343 &uap->msg->msg_accrightslen, sizeof (int)); 1344 free(iov, M_IOV); 1345 return (error); 1346 } 1347 #endif 1348 1349 int 1350 sys_recvmsg(td, uap) 1351 struct thread *td; 1352 struct recvmsg_args /* { 1353 int s; 1354 struct msghdr *msg; 1355 int flags; 1356 } */ *uap; 1357 { 1358 struct msghdr msg; 1359 struct iovec *uiov, *iov; 1360 int error; 1361 1362 error = copyin(uap->msg, &msg, sizeof (msg)); 1363 if (error) 1364 return (error); 1365 error = copyiniov(msg.msg_iov, msg.msg_iovlen, &iov, EMSGSIZE); 1366 if (error) 1367 return (error); 1368 msg.msg_flags = uap->flags; 1369 #ifdef COMPAT_OLDSOCK 1370 msg.msg_flags &= ~MSG_COMPAT; 1371 #endif 1372 uiov = msg.msg_iov; 1373 msg.msg_iov = iov; 1374 error = recvit(td, uap->s, &msg, NULL); 1375 if (error == 0) { 1376 msg.msg_iov = uiov; 1377 error = copyout(&msg, uap->msg, sizeof(msg)); 1378 } 1379 free(iov, M_IOV); 1380 return (error); 1381 } 1382 1383 /* ARGSUSED */ 1384 int 1385 sys_shutdown(td, uap) 1386 struct thread *td; 1387 struct shutdown_args /* { 1388 int s; 1389 int how; 1390 } */ *uap; 1391 { 1392 struct socket *so; 1393 struct file *fp; 1394 int error; 1395 1396 AUDIT_ARG_FD(uap->s); 1397 error = getsock_cap(td->td_proc->p_fd, uap->s, CAP_SHUTDOWN, &fp, 1398 NULL); 1399 if (error == 0) { 1400 so = fp->f_data; 1401 error = soshutdown(so, uap->how); 1402 fdrop(fp, td); 1403 } 1404 return (error); 1405 } 1406 1407 /* ARGSUSED */ 1408 int 1409 sys_setsockopt(td, uap) 1410 struct thread *td; 1411 struct setsockopt_args /* { 1412 int s; 1413 int level; 1414 int name; 1415 caddr_t val; 1416 int valsize; 1417 } */ *uap; 1418 { 1419 1420 return (kern_setsockopt(td, uap->s, uap->level, uap->name, 1421 uap->val, UIO_USERSPACE, uap->valsize)); 1422 } 1423 1424 int 1425 kern_setsockopt(td, s, level, name, val, valseg, valsize) 1426 struct thread *td; 1427 int s; 1428 int level; 1429 int name; 1430 void *val; 1431 enum uio_seg valseg; 1432 socklen_t valsize; 1433 { 1434 int error; 1435 struct socket *so; 1436 struct file *fp; 1437 struct sockopt sopt; 1438 1439 if (val == NULL && valsize != 0) 1440 return (EFAULT); 1441 if ((int)valsize < 0) 1442 return (EINVAL); 1443 1444 sopt.sopt_dir = SOPT_SET; 1445 sopt.sopt_level = level; 1446 sopt.sopt_name = name; 1447 sopt.sopt_val = val; 1448 sopt.sopt_valsize = valsize; 1449 switch (valseg) { 1450 case UIO_USERSPACE: 1451 sopt.sopt_td = td; 1452 break; 1453 case UIO_SYSSPACE: 1454 sopt.sopt_td = NULL; 1455 break; 1456 default: 1457 panic("kern_setsockopt called with bad valseg"); 1458 } 1459 1460 AUDIT_ARG_FD(s); 1461 error = getsock_cap(td->td_proc->p_fd, s, CAP_SETSOCKOPT, &fp, NULL); 1462 if (error == 0) { 1463 so = fp->f_data; 1464 error = sosetopt(so, &sopt); 1465 fdrop(fp, td); 1466 } 1467 return(error); 1468 } 1469 1470 /* ARGSUSED */ 1471 int 1472 sys_getsockopt(td, uap) 1473 struct thread *td; 1474 struct getsockopt_args /* { 1475 int s; 1476 int level; 1477 int name; 1478 void * __restrict val; 1479 socklen_t * __restrict avalsize; 1480 } */ *uap; 1481 { 1482 socklen_t valsize; 1483 int error; 1484 1485 if (uap->val) { 1486 error = copyin(uap->avalsize, &valsize, sizeof (valsize)); 1487 if (error) 1488 return (error); 1489 } 1490 1491 error = kern_getsockopt(td, uap->s, uap->level, uap->name, 1492 uap->val, UIO_USERSPACE, &valsize); 1493 1494 if (error == 0) 1495 error = copyout(&valsize, uap->avalsize, sizeof (valsize)); 1496 return (error); 1497 } 1498 1499 /* 1500 * Kernel version of getsockopt. 1501 * optval can be a userland or userspace. optlen is always a kernel pointer. 1502 */ 1503 int 1504 kern_getsockopt(td, s, level, name, val, valseg, valsize) 1505 struct thread *td; 1506 int s; 1507 int level; 1508 int name; 1509 void *val; 1510 enum uio_seg valseg; 1511 socklen_t *valsize; 1512 { 1513 int error; 1514 struct socket *so; 1515 struct file *fp; 1516 struct sockopt sopt; 1517 1518 if (val == NULL) 1519 *valsize = 0; 1520 if ((int)*valsize < 0) 1521 return (EINVAL); 1522 1523 sopt.sopt_dir = SOPT_GET; 1524 sopt.sopt_level = level; 1525 sopt.sopt_name = name; 1526 sopt.sopt_val = val; 1527 sopt.sopt_valsize = (size_t)*valsize; /* checked non-negative above */ 1528 switch (valseg) { 1529 case UIO_USERSPACE: 1530 sopt.sopt_td = td; 1531 break; 1532 case UIO_SYSSPACE: 1533 sopt.sopt_td = NULL; 1534 break; 1535 default: 1536 panic("kern_getsockopt called with bad valseg"); 1537 } 1538 1539 AUDIT_ARG_FD(s); 1540 error = getsock_cap(td->td_proc->p_fd, s, CAP_GETSOCKOPT, &fp, NULL); 1541 if (error == 0) { 1542 so = fp->f_data; 1543 error = sogetopt(so, &sopt); 1544 *valsize = sopt.sopt_valsize; 1545 fdrop(fp, td); 1546 } 1547 return (error); 1548 } 1549 1550 /* 1551 * getsockname1() - Get socket name. 1552 */ 1553 /* ARGSUSED */ 1554 static int 1555 getsockname1(td, uap, compat) 1556 struct thread *td; 1557 struct getsockname_args /* { 1558 int fdes; 1559 struct sockaddr * __restrict asa; 1560 socklen_t * __restrict alen; 1561 } */ *uap; 1562 int compat; 1563 { 1564 struct sockaddr *sa; 1565 socklen_t len; 1566 int error; 1567 1568 error = copyin(uap->alen, &len, sizeof(len)); 1569 if (error) 1570 return (error); 1571 1572 error = kern_getsockname(td, uap->fdes, &sa, &len); 1573 if (error) 1574 return (error); 1575 1576 if (len != 0) { 1577 #ifdef COMPAT_OLDSOCK 1578 if (compat) 1579 ((struct osockaddr *)sa)->sa_family = sa->sa_family; 1580 #endif 1581 error = copyout(sa, uap->asa, (u_int)len); 1582 } 1583 free(sa, M_SONAME); 1584 if (error == 0) 1585 error = copyout(&len, uap->alen, sizeof(len)); 1586 return (error); 1587 } 1588 1589 int 1590 kern_getsockname(struct thread *td, int fd, struct sockaddr **sa, 1591 socklen_t *alen) 1592 { 1593 struct socket *so; 1594 struct file *fp; 1595 socklen_t len; 1596 int error; 1597 1598 AUDIT_ARG_FD(fd); 1599 error = getsock_cap(td->td_proc->p_fd, fd, CAP_GETSOCKNAME, &fp, NULL); 1600 if (error) 1601 return (error); 1602 so = fp->f_data; 1603 *sa = NULL; 1604 CURVNET_SET(so->so_vnet); 1605 error = (*so->so_proto->pr_usrreqs->pru_sockaddr)(so, sa); 1606 CURVNET_RESTORE(); 1607 if (error) 1608 goto bad; 1609 if (*sa == NULL) 1610 len = 0; 1611 else 1612 len = MIN(*alen, (*sa)->sa_len); 1613 *alen = len; 1614 #ifdef KTRACE 1615 if (KTRPOINT(td, KTR_STRUCT)) 1616 ktrsockaddr(*sa); 1617 #endif 1618 bad: 1619 fdrop(fp, td); 1620 if (error && *sa) { 1621 free(*sa, M_SONAME); 1622 *sa = NULL; 1623 } 1624 return (error); 1625 } 1626 1627 int 1628 sys_getsockname(td, uap) 1629 struct thread *td; 1630 struct getsockname_args *uap; 1631 { 1632 1633 return (getsockname1(td, uap, 0)); 1634 } 1635 1636 #ifdef COMPAT_OLDSOCK 1637 int 1638 ogetsockname(td, uap) 1639 struct thread *td; 1640 struct getsockname_args *uap; 1641 { 1642 1643 return (getsockname1(td, uap, 1)); 1644 } 1645 #endif /* COMPAT_OLDSOCK */ 1646 1647 /* 1648 * getpeername1() - Get name of peer for connected socket. 1649 */ 1650 /* ARGSUSED */ 1651 static int 1652 getpeername1(td, uap, compat) 1653 struct thread *td; 1654 struct getpeername_args /* { 1655 int fdes; 1656 struct sockaddr * __restrict asa; 1657 socklen_t * __restrict alen; 1658 } */ *uap; 1659 int compat; 1660 { 1661 struct sockaddr *sa; 1662 socklen_t len; 1663 int error; 1664 1665 error = copyin(uap->alen, &len, sizeof (len)); 1666 if (error) 1667 return (error); 1668 1669 error = kern_getpeername(td, uap->fdes, &sa, &len); 1670 if (error) 1671 return (error); 1672 1673 if (len != 0) { 1674 #ifdef COMPAT_OLDSOCK 1675 if (compat) 1676 ((struct osockaddr *)sa)->sa_family = sa->sa_family; 1677 #endif 1678 error = copyout(sa, uap->asa, (u_int)len); 1679 } 1680 free(sa, M_SONAME); 1681 if (error == 0) 1682 error = copyout(&len, uap->alen, sizeof(len)); 1683 return (error); 1684 } 1685 1686 int 1687 kern_getpeername(struct thread *td, int fd, struct sockaddr **sa, 1688 socklen_t *alen) 1689 { 1690 struct socket *so; 1691 struct file *fp; 1692 socklen_t len; 1693 int error; 1694 1695 AUDIT_ARG_FD(fd); 1696 error = getsock_cap(td->td_proc->p_fd, fd, CAP_GETPEERNAME, &fp, NULL); 1697 if (error) 1698 return (error); 1699 so = fp->f_data; 1700 if ((so->so_state & (SS_ISCONNECTED|SS_ISCONFIRMING)) == 0) { 1701 error = ENOTCONN; 1702 goto done; 1703 } 1704 *sa = NULL; 1705 CURVNET_SET(so->so_vnet); 1706 error = (*so->so_proto->pr_usrreqs->pru_peeraddr)(so, sa); 1707 CURVNET_RESTORE(); 1708 if (error) 1709 goto bad; 1710 if (*sa == NULL) 1711 len = 0; 1712 else 1713 len = MIN(*alen, (*sa)->sa_len); 1714 *alen = len; 1715 #ifdef KTRACE 1716 if (KTRPOINT(td, KTR_STRUCT)) 1717 ktrsockaddr(*sa); 1718 #endif 1719 bad: 1720 if (error && *sa) { 1721 free(*sa, M_SONAME); 1722 *sa = NULL; 1723 } 1724 done: 1725 fdrop(fp, td); 1726 return (error); 1727 } 1728 1729 int 1730 sys_getpeername(td, uap) 1731 struct thread *td; 1732 struct getpeername_args *uap; 1733 { 1734 1735 return (getpeername1(td, uap, 0)); 1736 } 1737 1738 #ifdef COMPAT_OLDSOCK 1739 int 1740 ogetpeername(td, uap) 1741 struct thread *td; 1742 struct ogetpeername_args *uap; 1743 { 1744 1745 /* XXX uap should have type `getpeername_args *' to begin with. */ 1746 return (getpeername1(td, (struct getpeername_args *)uap, 1)); 1747 } 1748 #endif /* COMPAT_OLDSOCK */ 1749 1750 int 1751 sockargs(mp, buf, buflen, type) 1752 struct mbuf **mp; 1753 caddr_t buf; 1754 int buflen, type; 1755 { 1756 struct sockaddr *sa; 1757 struct mbuf *m; 1758 int error; 1759 1760 if (buflen > MLEN) { 1761 #ifdef COMPAT_OLDSOCK 1762 if (type == MT_SONAME && buflen <= 112) 1763 buflen = MLEN; /* unix domain compat. hack */ 1764 else 1765 #endif 1766 if (buflen > MCLBYTES) 1767 return (EINVAL); 1768 } 1769 m = m_get2(buflen, M_WAITOK, type, 0); 1770 m->m_len = buflen; 1771 error = copyin(buf, mtod(m, caddr_t), (u_int)buflen); 1772 if (error) 1773 (void) m_free(m); 1774 else { 1775 *mp = m; 1776 if (type == MT_SONAME) { 1777 sa = mtod(m, struct sockaddr *); 1778 1779 #if defined(COMPAT_OLDSOCK) && BYTE_ORDER != BIG_ENDIAN 1780 if (sa->sa_family == 0 && sa->sa_len < AF_MAX) 1781 sa->sa_family = sa->sa_len; 1782 #endif 1783 sa->sa_len = buflen; 1784 } 1785 } 1786 return (error); 1787 } 1788 1789 int 1790 getsockaddr(namp, uaddr, len) 1791 struct sockaddr **namp; 1792 caddr_t uaddr; 1793 size_t len; 1794 { 1795 struct sockaddr *sa; 1796 int error; 1797 1798 if (len > SOCK_MAXADDRLEN) 1799 return (ENAMETOOLONG); 1800 if (len < offsetof(struct sockaddr, sa_data[0])) 1801 return (EINVAL); 1802 sa = malloc(len, M_SONAME, M_WAITOK); 1803 error = copyin(uaddr, sa, len); 1804 if (error) { 1805 free(sa, M_SONAME); 1806 } else { 1807 #if defined(COMPAT_OLDSOCK) && BYTE_ORDER != BIG_ENDIAN 1808 if (sa->sa_family == 0 && sa->sa_len < AF_MAX) 1809 sa->sa_family = sa->sa_len; 1810 #endif 1811 sa->sa_len = len; 1812 *namp = sa; 1813 } 1814 return (error); 1815 } 1816 1817 #include <sys/condvar.h> 1818 1819 struct sendfile_sync { 1820 struct mtx mtx; 1821 struct cv cv; 1822 unsigned count; 1823 }; 1824 1825 /* 1826 * Detach mapped page and release resources back to the system. 1827 */ 1828 void 1829 sf_buf_mext(void *addr, void *args) 1830 { 1831 vm_page_t m; 1832 struct sendfile_sync *sfs; 1833 1834 m = sf_buf_page(args); 1835 sf_buf_free(args); 1836 vm_page_lock(m); 1837 vm_page_unwire(m, 0); 1838 /* 1839 * Check for the object going away on us. This can 1840 * happen since we don't hold a reference to it. 1841 * If so, we're responsible for freeing the page. 1842 */ 1843 if (m->wire_count == 0 && m->object == NULL) 1844 vm_page_free(m); 1845 vm_page_unlock(m); 1846 if (addr == NULL) 1847 return; 1848 sfs = addr; 1849 mtx_lock(&sfs->mtx); 1850 KASSERT(sfs->count> 0, ("Sendfile sync botchup count == 0")); 1851 if (--sfs->count == 0) 1852 cv_signal(&sfs->cv); 1853 mtx_unlock(&sfs->mtx); 1854 } 1855 1856 /* 1857 * sendfile(2) 1858 * 1859 * int sendfile(int fd, int s, off_t offset, size_t nbytes, 1860 * struct sf_hdtr *hdtr, off_t *sbytes, int flags) 1861 * 1862 * Send a file specified by 'fd' and starting at 'offset' to a socket 1863 * specified by 's'. Send only 'nbytes' of the file or until EOF if nbytes == 1864 * 0. Optionally add a header and/or trailer to the socket output. If 1865 * specified, write the total number of bytes sent into *sbytes. 1866 */ 1867 int 1868 sys_sendfile(struct thread *td, struct sendfile_args *uap) 1869 { 1870 1871 return (do_sendfile(td, uap, 0)); 1872 } 1873 1874 static int 1875 do_sendfile(struct thread *td, struct sendfile_args *uap, int compat) 1876 { 1877 struct sf_hdtr hdtr; 1878 struct uio *hdr_uio, *trl_uio; 1879 int error; 1880 1881 hdr_uio = trl_uio = NULL; 1882 1883 if (uap->hdtr != NULL) { 1884 error = copyin(uap->hdtr, &hdtr, sizeof(hdtr)); 1885 if (error) 1886 goto out; 1887 if (hdtr.headers != NULL) { 1888 error = copyinuio(hdtr.headers, hdtr.hdr_cnt, &hdr_uio); 1889 if (error) 1890 goto out; 1891 } 1892 if (hdtr.trailers != NULL) { 1893 error = copyinuio(hdtr.trailers, hdtr.trl_cnt, &trl_uio); 1894 if (error) 1895 goto out; 1896 1897 } 1898 } 1899 1900 error = kern_sendfile(td, uap, hdr_uio, trl_uio, compat); 1901 out: 1902 if (hdr_uio) 1903 free(hdr_uio, M_IOV); 1904 if (trl_uio) 1905 free(trl_uio, M_IOV); 1906 return (error); 1907 } 1908 1909 #ifdef COMPAT_FREEBSD4 1910 int 1911 freebsd4_sendfile(struct thread *td, struct freebsd4_sendfile_args *uap) 1912 { 1913 struct sendfile_args args; 1914 1915 args.fd = uap->fd; 1916 args.s = uap->s; 1917 args.offset = uap->offset; 1918 args.nbytes = uap->nbytes; 1919 args.hdtr = uap->hdtr; 1920 args.sbytes = uap->sbytes; 1921 args.flags = uap->flags; 1922 1923 return (do_sendfile(td, &args, 1)); 1924 } 1925 #endif /* COMPAT_FREEBSD4 */ 1926 1927 int 1928 kern_sendfile(struct thread *td, struct sendfile_args *uap, 1929 struct uio *hdr_uio, struct uio *trl_uio, int compat) 1930 { 1931 struct file *sock_fp; 1932 struct vnode *vp; 1933 struct vm_object *obj = NULL; 1934 struct socket *so = NULL; 1935 struct mbuf *m = NULL; 1936 struct sf_buf *sf; 1937 struct vm_page *pg; 1938 struct vattr va; 1939 off_t off, xfsize, fsbytes = 0, sbytes = 0, rem = 0; 1940 int error, hdrlen = 0, mnw = 0; 1941 int bsize; 1942 struct sendfile_sync *sfs = NULL; 1943 1944 /* 1945 * The file descriptor must be a regular file and have a 1946 * backing VM object. 1947 * File offset must be positive. If it goes beyond EOF 1948 * we send only the header/trailer and no payload data. 1949 */ 1950 AUDIT_ARG_FD(uap->fd); 1951 /* 1952 * sendfile(2) can start at any offset within a file so we require 1953 * CAP_READ+CAP_SEEK = CAP_PREAD. 1954 */ 1955 if ((error = fgetvp_read(td, uap->fd, CAP_PREAD, &vp)) != 0) 1956 goto out; 1957 vn_lock(vp, LK_SHARED | LK_RETRY); 1958 if (vp->v_type == VREG) { 1959 bsize = vp->v_mount->mnt_stat.f_iosize; 1960 if (uap->nbytes == 0) { 1961 error = VOP_GETATTR(vp, &va, td->td_ucred); 1962 if (error != 0) { 1963 VOP_UNLOCK(vp, 0); 1964 obj = NULL; 1965 goto out; 1966 } 1967 rem = va.va_size; 1968 } else 1969 rem = uap->nbytes; 1970 obj = vp->v_object; 1971 if (obj != NULL) { 1972 /* 1973 * Temporarily increase the backing VM 1974 * object's reference count so that a forced 1975 * reclamation of its vnode does not 1976 * immediately destroy it. 1977 */ 1978 VM_OBJECT_WLOCK(obj); 1979 if ((obj->flags & OBJ_DEAD) == 0) { 1980 vm_object_reference_locked(obj); 1981 VM_OBJECT_WUNLOCK(obj); 1982 } else { 1983 VM_OBJECT_WUNLOCK(obj); 1984 obj = NULL; 1985 } 1986 } 1987 } else 1988 bsize = 0; /* silence gcc */ 1989 VOP_UNLOCK(vp, 0); 1990 if (obj == NULL) { 1991 error = EINVAL; 1992 goto out; 1993 } 1994 if (uap->offset < 0) { 1995 error = EINVAL; 1996 goto out; 1997 } 1998 1999 /* 2000 * The socket must be a stream socket and connected. 2001 * Remember if it a blocking or non-blocking socket. 2002 */ 2003 if ((error = getsock_cap(td->td_proc->p_fd, uap->s, CAP_SEND, 2004 &sock_fp, NULL)) != 0) 2005 goto out; 2006 so = sock_fp->f_data; 2007 if (so->so_type != SOCK_STREAM) { 2008 error = EINVAL; 2009 goto out; 2010 } 2011 if ((so->so_state & SS_ISCONNECTED) == 0) { 2012 error = ENOTCONN; 2013 goto out; 2014 } 2015 /* 2016 * Do not wait on memory allocations but return ENOMEM for 2017 * caller to retry later. 2018 * XXX: Experimental. 2019 */ 2020 if (uap->flags & SF_MNOWAIT) 2021 mnw = 1; 2022 2023 if (uap->flags & SF_SYNC) { 2024 sfs = malloc(sizeof *sfs, M_TEMP, M_WAITOK | M_ZERO); 2025 mtx_init(&sfs->mtx, "sendfile", NULL, MTX_DEF); 2026 cv_init(&sfs->cv, "sendfile"); 2027 } 2028 2029 #ifdef MAC 2030 error = mac_socket_check_send(td->td_ucred, so); 2031 if (error) 2032 goto out; 2033 #endif 2034 2035 /* If headers are specified copy them into mbufs. */ 2036 if (hdr_uio != NULL) { 2037 hdr_uio->uio_td = td; 2038 hdr_uio->uio_rw = UIO_WRITE; 2039 if (hdr_uio->uio_resid > 0) { 2040 /* 2041 * In FBSD < 5.0 the nbytes to send also included 2042 * the header. If compat is specified subtract the 2043 * header size from nbytes. 2044 */ 2045 if (compat) { 2046 if (uap->nbytes > hdr_uio->uio_resid) 2047 uap->nbytes -= hdr_uio->uio_resid; 2048 else 2049 uap->nbytes = 0; 2050 } 2051 m = m_uiotombuf(hdr_uio, (mnw ? M_NOWAIT : M_WAITOK), 2052 0, 0, 0); 2053 if (m == NULL) { 2054 error = mnw ? EAGAIN : ENOBUFS; 2055 goto out; 2056 } 2057 hdrlen = m_length(m, NULL); 2058 } 2059 } 2060 2061 /* 2062 * Protect against multiple writers to the socket. 2063 * 2064 * XXXRW: Historically this has assumed non-interruptibility, so now 2065 * we implement that, but possibly shouldn't. 2066 */ 2067 (void)sblock(&so->so_snd, SBL_WAIT | SBL_NOINTR); 2068 2069 /* 2070 * Loop through the pages of the file, starting with the requested 2071 * offset. Get a file page (do I/O if necessary), map the file page 2072 * into an sf_buf, attach an mbuf header to the sf_buf, and queue 2073 * it on the socket. 2074 * This is done in two loops. The inner loop turns as many pages 2075 * as it can, up to available socket buffer space, without blocking 2076 * into mbufs to have it bulk delivered into the socket send buffer. 2077 * The outer loop checks the state and available space of the socket 2078 * and takes care of the overall progress. 2079 */ 2080 for (off = uap->offset; ; ) { 2081 struct mbuf *mtail; 2082 int loopbytes; 2083 int space; 2084 int done; 2085 2086 if ((uap->nbytes != 0 && uap->nbytes == fsbytes) || 2087 (uap->nbytes == 0 && va.va_size == fsbytes)) 2088 break; 2089 2090 mtail = NULL; 2091 loopbytes = 0; 2092 space = 0; 2093 done = 0; 2094 2095 /* 2096 * Check the socket state for ongoing connection, 2097 * no errors and space in socket buffer. 2098 * If space is low allow for the remainder of the 2099 * file to be processed if it fits the socket buffer. 2100 * Otherwise block in waiting for sufficient space 2101 * to proceed, or if the socket is nonblocking, return 2102 * to userland with EAGAIN while reporting how far 2103 * we've come. 2104 * We wait until the socket buffer has significant free 2105 * space to do bulk sends. This makes good use of file 2106 * system read ahead and allows packet segmentation 2107 * offloading hardware to take over lots of work. If 2108 * we were not careful here we would send off only one 2109 * sfbuf at a time. 2110 */ 2111 SOCKBUF_LOCK(&so->so_snd); 2112 if (so->so_snd.sb_lowat < so->so_snd.sb_hiwat / 2) 2113 so->so_snd.sb_lowat = so->so_snd.sb_hiwat / 2; 2114 retry_space: 2115 if (so->so_snd.sb_state & SBS_CANTSENDMORE) { 2116 error = EPIPE; 2117 SOCKBUF_UNLOCK(&so->so_snd); 2118 goto done; 2119 } else if (so->so_error) { 2120 error = so->so_error; 2121 so->so_error = 0; 2122 SOCKBUF_UNLOCK(&so->so_snd); 2123 goto done; 2124 } 2125 space = sbspace(&so->so_snd); 2126 if (space < rem && 2127 (space <= 0 || 2128 space < so->so_snd.sb_lowat)) { 2129 if (so->so_state & SS_NBIO) { 2130 SOCKBUF_UNLOCK(&so->so_snd); 2131 error = EAGAIN; 2132 goto done; 2133 } 2134 /* 2135 * sbwait drops the lock while sleeping. 2136 * When we loop back to retry_space the 2137 * state may have changed and we retest 2138 * for it. 2139 */ 2140 error = sbwait(&so->so_snd); 2141 /* 2142 * An error from sbwait usually indicates that we've 2143 * been interrupted by a signal. If we've sent anything 2144 * then return bytes sent, otherwise return the error. 2145 */ 2146 if (error) { 2147 SOCKBUF_UNLOCK(&so->so_snd); 2148 goto done; 2149 } 2150 goto retry_space; 2151 } 2152 SOCKBUF_UNLOCK(&so->so_snd); 2153 2154 /* 2155 * Reduce space in the socket buffer by the size of 2156 * the header mbuf chain. 2157 * hdrlen is set to 0 after the first loop. 2158 */ 2159 space -= hdrlen; 2160 2161 error = vn_lock(vp, LK_SHARED); 2162 if (error != 0) 2163 goto done; 2164 error = VOP_GETATTR(vp, &va, td->td_ucred); 2165 if (error != 0 || off >= va.va_size) { 2166 VOP_UNLOCK(vp, 0); 2167 goto done; 2168 } 2169 2170 /* 2171 * Loop and construct maximum sized mbuf chain to be bulk 2172 * dumped into socket buffer. 2173 */ 2174 while (space > loopbytes) { 2175 vm_pindex_t pindex; 2176 vm_offset_t pgoff; 2177 struct mbuf *m0; 2178 2179 /* 2180 * Calculate the amount to transfer. 2181 * Not to exceed a page, the EOF, 2182 * or the passed in nbytes. 2183 */ 2184 pgoff = (vm_offset_t)(off & PAGE_MASK); 2185 if (uap->nbytes) 2186 rem = (uap->nbytes - fsbytes - loopbytes); 2187 else 2188 rem = va.va_size - 2189 uap->offset - fsbytes - loopbytes; 2190 xfsize = omin(PAGE_SIZE - pgoff, rem); 2191 xfsize = omin(space - loopbytes, xfsize); 2192 if (xfsize <= 0) { 2193 done = 1; /* all data sent */ 2194 break; 2195 } 2196 2197 /* 2198 * Attempt to look up the page. Allocate 2199 * if not found or wait and loop if busy. 2200 */ 2201 pindex = OFF_TO_IDX(off); 2202 VM_OBJECT_WLOCK(obj); 2203 pg = vm_page_grab(obj, pindex, VM_ALLOC_NOBUSY | 2204 VM_ALLOC_NORMAL | VM_ALLOC_WIRED | VM_ALLOC_RETRY); 2205 2206 /* 2207 * Check if page is valid for what we need, 2208 * otherwise initiate I/O. 2209 * If we already turned some pages into mbufs, 2210 * send them off before we come here again and 2211 * block. 2212 */ 2213 if (pg->valid && vm_page_is_valid(pg, pgoff, xfsize)) 2214 VM_OBJECT_WUNLOCK(obj); 2215 else if (m != NULL) 2216 error = EAGAIN; /* send what we already got */ 2217 else if (uap->flags & SF_NODISKIO) 2218 error = EBUSY; 2219 else { 2220 ssize_t resid; 2221 2222 /* 2223 * Ensure that our page is still around 2224 * when the I/O completes. 2225 */ 2226 vm_page_io_start(pg); 2227 VM_OBJECT_WUNLOCK(obj); 2228 2229 /* 2230 * Get the page from backing store. 2231 * XXXMAC: Because we don't have fp->f_cred 2232 * here, we pass in NOCRED. This is probably 2233 * wrong, but is consistent with our original 2234 * implementation. 2235 */ 2236 error = vn_rdwr(UIO_READ, vp, NULL, MAXBSIZE, 2237 trunc_page(off), UIO_NOCOPY, IO_NODELOCKED | 2238 IO_VMIO | ((MAXBSIZE / bsize) << IO_SEQSHIFT), 2239 td->td_ucred, NOCRED, &resid, td); 2240 VM_OBJECT_WLOCK(obj); 2241 vm_page_io_finish(pg); 2242 if (!error) 2243 VM_OBJECT_WUNLOCK(obj); 2244 mbstat.sf_iocnt++; 2245 } 2246 if (error) { 2247 vm_page_lock(pg); 2248 vm_page_unwire(pg, 0); 2249 /* 2250 * See if anyone else might know about 2251 * this page. If not and it is not valid, 2252 * then free it. 2253 */ 2254 if (pg->wire_count == 0 && pg->valid == 0 && 2255 pg->busy == 0 && !(pg->oflags & VPO_BUSY)) 2256 vm_page_free(pg); 2257 vm_page_unlock(pg); 2258 VM_OBJECT_WUNLOCK(obj); 2259 if (error == EAGAIN) 2260 error = 0; /* not a real error */ 2261 break; 2262 } 2263 2264 /* 2265 * Get a sendfile buf. When allocating the 2266 * first buffer for mbuf chain, we usually 2267 * wait as long as necessary, but this wait 2268 * can be interrupted. For consequent 2269 * buffers, do not sleep, since several 2270 * threads might exhaust the buffers and then 2271 * deadlock. 2272 */ 2273 sf = sf_buf_alloc(pg, (mnw || m != NULL) ? SFB_NOWAIT : 2274 SFB_CATCH); 2275 if (sf == NULL) { 2276 mbstat.sf_allocfail++; 2277 vm_page_lock(pg); 2278 vm_page_unwire(pg, 0); 2279 KASSERT(pg->object != NULL, 2280 ("kern_sendfile: object disappeared")); 2281 vm_page_unlock(pg); 2282 if (m == NULL) 2283 error = (mnw ? EAGAIN : EINTR); 2284 break; 2285 } 2286 2287 /* 2288 * Get an mbuf and set it up as having 2289 * external storage. 2290 */ 2291 m0 = m_get((mnw ? M_NOWAIT : M_WAITOK), MT_DATA); 2292 if (m0 == NULL) { 2293 error = (mnw ? EAGAIN : ENOBUFS); 2294 sf_buf_mext(NULL, sf); 2295 break; 2296 } 2297 if (m_extadd(m0, (caddr_t )sf_buf_kva(sf), PAGE_SIZE, 2298 sf_buf_mext, sfs, sf, M_RDONLY, EXT_SFBUF, 2299 (mnw ? M_NOWAIT : M_WAITOK)) != 0) { 2300 error = (mnw ? EAGAIN : ENOBUFS); 2301 sf_buf_mext(NULL, sf); 2302 m_freem(m0); 2303 break; 2304 } 2305 m0->m_data = (char *)sf_buf_kva(sf) + pgoff; 2306 m0->m_len = xfsize; 2307 2308 /* Append to mbuf chain. */ 2309 if (mtail != NULL) 2310 mtail->m_next = m0; 2311 else if (m != NULL) 2312 m_last(m)->m_next = m0; 2313 else 2314 m = m0; 2315 mtail = m0; 2316 2317 /* Keep track of bits processed. */ 2318 loopbytes += xfsize; 2319 off += xfsize; 2320 2321 if (sfs != NULL) { 2322 mtx_lock(&sfs->mtx); 2323 sfs->count++; 2324 mtx_unlock(&sfs->mtx); 2325 } 2326 } 2327 2328 VOP_UNLOCK(vp, 0); 2329 2330 /* Add the buffer chain to the socket buffer. */ 2331 if (m != NULL) { 2332 int mlen, err; 2333 2334 mlen = m_length(m, NULL); 2335 SOCKBUF_LOCK(&so->so_snd); 2336 if (so->so_snd.sb_state & SBS_CANTSENDMORE) { 2337 error = EPIPE; 2338 SOCKBUF_UNLOCK(&so->so_snd); 2339 goto done; 2340 } 2341 SOCKBUF_UNLOCK(&so->so_snd); 2342 CURVNET_SET(so->so_vnet); 2343 /* Avoid error aliasing. */ 2344 err = (*so->so_proto->pr_usrreqs->pru_send) 2345 (so, 0, m, NULL, NULL, td); 2346 CURVNET_RESTORE(); 2347 if (err == 0) { 2348 /* 2349 * We need two counters to get the 2350 * file offset and nbytes to send 2351 * right: 2352 * - sbytes contains the total amount 2353 * of bytes sent, including headers. 2354 * - fsbytes contains the total amount 2355 * of bytes sent from the file. 2356 */ 2357 sbytes += mlen; 2358 fsbytes += mlen; 2359 if (hdrlen) { 2360 fsbytes -= hdrlen; 2361 hdrlen = 0; 2362 } 2363 } else if (error == 0) 2364 error = err; 2365 m = NULL; /* pru_send always consumes */ 2366 } 2367 2368 /* Quit outer loop on error or when we're done. */ 2369 if (done) 2370 break; 2371 if (error) 2372 goto done; 2373 } 2374 2375 /* 2376 * Send trailers. Wimp out and use writev(2). 2377 */ 2378 if (trl_uio != NULL) { 2379 sbunlock(&so->so_snd); 2380 error = kern_writev(td, uap->s, trl_uio); 2381 if (error == 0) 2382 sbytes += td->td_retval[0]; 2383 goto out; 2384 } 2385 2386 done: 2387 sbunlock(&so->so_snd); 2388 out: 2389 /* 2390 * If there was no error we have to clear td->td_retval[0] 2391 * because it may have been set by writev. 2392 */ 2393 if (error == 0) { 2394 td->td_retval[0] = 0; 2395 } 2396 if (uap->sbytes != NULL) { 2397 copyout(&sbytes, uap->sbytes, sizeof(off_t)); 2398 } 2399 if (obj != NULL) 2400 vm_object_deallocate(obj); 2401 if (vp != NULL) 2402 vrele(vp); 2403 if (so) 2404 fdrop(sock_fp, td); 2405 if (m) 2406 m_freem(m); 2407 2408 if (sfs != NULL) { 2409 mtx_lock(&sfs->mtx); 2410 if (sfs->count != 0) 2411 cv_wait(&sfs->cv, &sfs->mtx); 2412 KASSERT(sfs->count == 0, ("sendfile sync still busy")); 2413 cv_destroy(&sfs->cv); 2414 mtx_destroy(&sfs->mtx); 2415 free(sfs, M_TEMP); 2416 } 2417 2418 if (error == ERESTART) 2419 error = EINTR; 2420 2421 return (error); 2422 } 2423 2424 /* 2425 * SCTP syscalls. 2426 * Functionality only compiled in if SCTP is defined in the kernel Makefile, 2427 * otherwise all return EOPNOTSUPP. 2428 * XXX: We should make this loadable one day. 2429 */ 2430 int 2431 sys_sctp_peeloff(td, uap) 2432 struct thread *td; 2433 struct sctp_peeloff_args /* { 2434 int sd; 2435 caddr_t name; 2436 } */ *uap; 2437 { 2438 #if (defined(INET) || defined(INET6)) && defined(SCTP) 2439 struct file *nfp = NULL; 2440 int error; 2441 struct socket *head, *so; 2442 int fd; 2443 u_int fflag; 2444 2445 AUDIT_ARG_FD(uap->sd); 2446 error = fgetsock(td, uap->sd, CAP_PEELOFF, &head, &fflag); 2447 if (error) 2448 goto done2; 2449 if (head->so_proto->pr_protocol != IPPROTO_SCTP) { 2450 error = EOPNOTSUPP; 2451 goto done; 2452 } 2453 error = sctp_can_peel_off(head, (sctp_assoc_t)uap->name); 2454 if (error) 2455 goto done; 2456 /* 2457 * At this point we know we do have a assoc to pull 2458 * we proceed to get the fd setup. This may block 2459 * but that is ok. 2460 */ 2461 2462 error = falloc(td, &nfp, &fd, 0); 2463 if (error) 2464 goto done; 2465 td->td_retval[0] = fd; 2466 2467 CURVNET_SET(head->so_vnet); 2468 so = sonewconn(head, SS_ISCONNECTED); 2469 if (so == NULL) { 2470 error = ENOMEM; 2471 goto noconnection; 2472 } 2473 /* 2474 * Before changing the flags on the socket, we have to bump the 2475 * reference count. Otherwise, if the protocol calls sofree(), 2476 * the socket will be released due to a zero refcount. 2477 */ 2478 SOCK_LOCK(so); 2479 soref(so); /* file descriptor reference */ 2480 SOCK_UNLOCK(so); 2481 2482 ACCEPT_LOCK(); 2483 2484 TAILQ_REMOVE(&head->so_comp, so, so_list); 2485 head->so_qlen--; 2486 so->so_state |= (head->so_state & SS_NBIO); 2487 so->so_state &= ~SS_NOFDREF; 2488 so->so_qstate &= ~SQ_COMP; 2489 so->so_head = NULL; 2490 ACCEPT_UNLOCK(); 2491 finit(nfp, fflag, DTYPE_SOCKET, so, &socketops); 2492 error = sctp_do_peeloff(head, so, (sctp_assoc_t)uap->name); 2493 if (error) 2494 goto noconnection; 2495 if (head->so_sigio != NULL) 2496 fsetown(fgetown(&head->so_sigio), &so->so_sigio); 2497 2498 noconnection: 2499 /* 2500 * close the new descriptor, assuming someone hasn't ripped it 2501 * out from under us. 2502 */ 2503 if (error) 2504 fdclose(td->td_proc->p_fd, nfp, fd, td); 2505 2506 /* 2507 * Release explicitly held references before returning. 2508 */ 2509 CURVNET_RESTORE(); 2510 done: 2511 if (nfp != NULL) 2512 fdrop(nfp, td); 2513 fputsock(head); 2514 done2: 2515 return (error); 2516 #else /* SCTP */ 2517 return (EOPNOTSUPP); 2518 #endif /* SCTP */ 2519 } 2520 2521 int 2522 sys_sctp_generic_sendmsg (td, uap) 2523 struct thread *td; 2524 struct sctp_generic_sendmsg_args /* { 2525 int sd, 2526 caddr_t msg, 2527 int mlen, 2528 caddr_t to, 2529 __socklen_t tolen, 2530 struct sctp_sndrcvinfo *sinfo, 2531 int flags 2532 } */ *uap; 2533 { 2534 #if (defined(INET) || defined(INET6)) && defined(SCTP) 2535 struct sctp_sndrcvinfo sinfo, *u_sinfo = NULL; 2536 struct socket *so; 2537 struct file *fp = NULL; 2538 int error = 0, len; 2539 struct sockaddr *to = NULL; 2540 #ifdef KTRACE 2541 struct uio *ktruio = NULL; 2542 #endif 2543 struct uio auio; 2544 struct iovec iov[1]; 2545 cap_rights_t rights; 2546 2547 if (uap->sinfo) { 2548 error = copyin(uap->sinfo, &sinfo, sizeof (sinfo)); 2549 if (error) 2550 return (error); 2551 u_sinfo = &sinfo; 2552 } 2553 2554 rights = CAP_SEND; 2555 if (uap->tolen) { 2556 error = getsockaddr(&to, uap->to, uap->tolen); 2557 if (error) { 2558 to = NULL; 2559 goto sctp_bad2; 2560 } 2561 rights |= CAP_CONNECT; 2562 } 2563 2564 AUDIT_ARG_FD(uap->sd); 2565 error = getsock_cap(td->td_proc->p_fd, uap->sd, rights, &fp, NULL); 2566 if (error) 2567 goto sctp_bad; 2568 #ifdef KTRACE 2569 if (to && (KTRPOINT(td, KTR_STRUCT))) 2570 ktrsockaddr(to); 2571 #endif 2572 2573 iov[0].iov_base = uap->msg; 2574 iov[0].iov_len = uap->mlen; 2575 2576 so = (struct socket *)fp->f_data; 2577 if (so->so_proto->pr_protocol != IPPROTO_SCTP) { 2578 error = EOPNOTSUPP; 2579 goto sctp_bad; 2580 } 2581 #ifdef MAC 2582 error = mac_socket_check_send(td->td_ucred, so); 2583 if (error) 2584 goto sctp_bad; 2585 #endif /* MAC */ 2586 2587 auio.uio_iov = iov; 2588 auio.uio_iovcnt = 1; 2589 auio.uio_segflg = UIO_USERSPACE; 2590 auio.uio_rw = UIO_WRITE; 2591 auio.uio_td = td; 2592 auio.uio_offset = 0; /* XXX */ 2593 auio.uio_resid = 0; 2594 len = auio.uio_resid = uap->mlen; 2595 CURVNET_SET(so->so_vnet); 2596 error = sctp_lower_sosend(so, to, &auio, 2597 (struct mbuf *)NULL, (struct mbuf *)NULL, 2598 uap->flags, u_sinfo, td); 2599 CURVNET_RESTORE(); 2600 if (error) { 2601 if (auio.uio_resid != len && (error == ERESTART || 2602 error == EINTR || error == EWOULDBLOCK)) 2603 error = 0; 2604 /* Generation of SIGPIPE can be controlled per socket. */ 2605 if (error == EPIPE && !(so->so_options & SO_NOSIGPIPE) && 2606 !(uap->flags & MSG_NOSIGNAL)) { 2607 PROC_LOCK(td->td_proc); 2608 tdsignal(td, SIGPIPE); 2609 PROC_UNLOCK(td->td_proc); 2610 } 2611 } 2612 if (error == 0) 2613 td->td_retval[0] = len - auio.uio_resid; 2614 #ifdef KTRACE 2615 if (ktruio != NULL) { 2616 ktruio->uio_resid = td->td_retval[0]; 2617 ktrgenio(uap->sd, UIO_WRITE, ktruio, error); 2618 } 2619 #endif /* KTRACE */ 2620 sctp_bad: 2621 if (fp) 2622 fdrop(fp, td); 2623 sctp_bad2: 2624 if (to) 2625 free(to, M_SONAME); 2626 return (error); 2627 #else /* SCTP */ 2628 return (EOPNOTSUPP); 2629 #endif /* SCTP */ 2630 } 2631 2632 int 2633 sys_sctp_generic_sendmsg_iov(td, uap) 2634 struct thread *td; 2635 struct sctp_generic_sendmsg_iov_args /* { 2636 int sd, 2637 struct iovec *iov, 2638 int iovlen, 2639 caddr_t to, 2640 __socklen_t tolen, 2641 struct sctp_sndrcvinfo *sinfo, 2642 int flags 2643 } */ *uap; 2644 { 2645 #if (defined(INET) || defined(INET6)) && defined(SCTP) 2646 struct sctp_sndrcvinfo sinfo, *u_sinfo = NULL; 2647 struct socket *so; 2648 struct file *fp = NULL; 2649 int error=0, i; 2650 ssize_t len; 2651 struct sockaddr *to = NULL; 2652 #ifdef KTRACE 2653 struct uio *ktruio = NULL; 2654 #endif 2655 struct uio auio; 2656 struct iovec *iov, *tiov; 2657 cap_rights_t rights; 2658 2659 if (uap->sinfo) { 2660 error = copyin(uap->sinfo, &sinfo, sizeof (sinfo)); 2661 if (error) 2662 return (error); 2663 u_sinfo = &sinfo; 2664 } 2665 rights = CAP_SEND; 2666 if (uap->tolen) { 2667 error = getsockaddr(&to, uap->to, uap->tolen); 2668 if (error) { 2669 to = NULL; 2670 goto sctp_bad2; 2671 } 2672 rights |= CAP_CONNECT; 2673 } 2674 2675 AUDIT_ARG_FD(uap->sd); 2676 error = getsock_cap(td->td_proc->p_fd, uap->sd, rights, &fp, NULL); 2677 if (error) 2678 goto sctp_bad1; 2679 2680 #ifdef COMPAT_FREEBSD32 2681 if (SV_CURPROC_FLAG(SV_ILP32)) 2682 error = freebsd32_copyiniov((struct iovec32 *)uap->iov, 2683 uap->iovlen, &iov, EMSGSIZE); 2684 else 2685 #endif 2686 error = copyiniov(uap->iov, uap->iovlen, &iov, EMSGSIZE); 2687 if (error) 2688 goto sctp_bad1; 2689 #ifdef KTRACE 2690 if (to && (KTRPOINT(td, KTR_STRUCT))) 2691 ktrsockaddr(to); 2692 #endif 2693 2694 so = (struct socket *)fp->f_data; 2695 if (so->so_proto->pr_protocol != IPPROTO_SCTP) { 2696 error = EOPNOTSUPP; 2697 goto sctp_bad; 2698 } 2699 #ifdef MAC 2700 error = mac_socket_check_send(td->td_ucred, so); 2701 if (error) 2702 goto sctp_bad; 2703 #endif /* MAC */ 2704 2705 auio.uio_iov = iov; 2706 auio.uio_iovcnt = uap->iovlen; 2707 auio.uio_segflg = UIO_USERSPACE; 2708 auio.uio_rw = UIO_WRITE; 2709 auio.uio_td = td; 2710 auio.uio_offset = 0; /* XXX */ 2711 auio.uio_resid = 0; 2712 tiov = iov; 2713 for (i = 0; i <uap->iovlen; i++, tiov++) { 2714 if ((auio.uio_resid += tiov->iov_len) < 0) { 2715 error = EINVAL; 2716 goto sctp_bad; 2717 } 2718 } 2719 len = auio.uio_resid; 2720 CURVNET_SET(so->so_vnet); 2721 error = sctp_lower_sosend(so, to, &auio, 2722 (struct mbuf *)NULL, (struct mbuf *)NULL, 2723 uap->flags, u_sinfo, td); 2724 CURVNET_RESTORE(); 2725 if (error) { 2726 if (auio.uio_resid != len && (error == ERESTART || 2727 error == EINTR || error == EWOULDBLOCK)) 2728 error = 0; 2729 /* Generation of SIGPIPE can be controlled per socket */ 2730 if (error == EPIPE && !(so->so_options & SO_NOSIGPIPE) && 2731 !(uap->flags & MSG_NOSIGNAL)) { 2732 PROC_LOCK(td->td_proc); 2733 tdsignal(td, SIGPIPE); 2734 PROC_UNLOCK(td->td_proc); 2735 } 2736 } 2737 if (error == 0) 2738 td->td_retval[0] = len - auio.uio_resid; 2739 #ifdef KTRACE 2740 if (ktruio != NULL) { 2741 ktruio->uio_resid = td->td_retval[0]; 2742 ktrgenio(uap->sd, UIO_WRITE, ktruio, error); 2743 } 2744 #endif /* KTRACE */ 2745 sctp_bad: 2746 free(iov, M_IOV); 2747 sctp_bad1: 2748 if (fp) 2749 fdrop(fp, td); 2750 sctp_bad2: 2751 if (to) 2752 free(to, M_SONAME); 2753 return (error); 2754 #else /* SCTP */ 2755 return (EOPNOTSUPP); 2756 #endif /* SCTP */ 2757 } 2758 2759 int 2760 sys_sctp_generic_recvmsg(td, uap) 2761 struct thread *td; 2762 struct sctp_generic_recvmsg_args /* { 2763 int sd, 2764 struct iovec *iov, 2765 int iovlen, 2766 struct sockaddr *from, 2767 __socklen_t *fromlenaddr, 2768 struct sctp_sndrcvinfo *sinfo, 2769 int *msg_flags 2770 } */ *uap; 2771 { 2772 #if (defined(INET) || defined(INET6)) && defined(SCTP) 2773 uint8_t sockbufstore[256]; 2774 struct uio auio; 2775 struct iovec *iov, *tiov; 2776 struct sctp_sndrcvinfo sinfo; 2777 struct socket *so; 2778 struct file *fp = NULL; 2779 struct sockaddr *fromsa; 2780 int fromlen; 2781 ssize_t len; 2782 int i, msg_flags; 2783 int error = 0; 2784 #ifdef KTRACE 2785 struct uio *ktruio = NULL; 2786 #endif 2787 2788 AUDIT_ARG_FD(uap->sd); 2789 error = getsock_cap(td->td_proc->p_fd, uap->sd, CAP_RECV, &fp, NULL); 2790 if (error) { 2791 return (error); 2792 } 2793 #ifdef COMPAT_FREEBSD32 2794 if (SV_CURPROC_FLAG(SV_ILP32)) 2795 error = freebsd32_copyiniov((struct iovec32 *)uap->iov, 2796 uap->iovlen, &iov, EMSGSIZE); 2797 else 2798 #endif 2799 error = copyiniov(uap->iov, uap->iovlen, &iov, EMSGSIZE); 2800 if (error) 2801 goto out1; 2802 2803 so = fp->f_data; 2804 if (so->so_proto->pr_protocol != IPPROTO_SCTP) { 2805 error = EOPNOTSUPP; 2806 goto out; 2807 } 2808 #ifdef MAC 2809 error = mac_socket_check_receive(td->td_ucred, so); 2810 if (error) { 2811 goto out; 2812 } 2813 #endif /* MAC */ 2814 2815 if (uap->fromlenaddr) { 2816 error = copyin(uap->fromlenaddr, 2817 &fromlen, sizeof (fromlen)); 2818 if (error) { 2819 goto out; 2820 } 2821 } else { 2822 fromlen = 0; 2823 } 2824 if (uap->msg_flags) { 2825 error = copyin(uap->msg_flags, &msg_flags, sizeof (int)); 2826 if (error) { 2827 goto out; 2828 } 2829 } else { 2830 msg_flags = 0; 2831 } 2832 auio.uio_iov = iov; 2833 auio.uio_iovcnt = uap->iovlen; 2834 auio.uio_segflg = UIO_USERSPACE; 2835 auio.uio_rw = UIO_READ; 2836 auio.uio_td = td; 2837 auio.uio_offset = 0; /* XXX */ 2838 auio.uio_resid = 0; 2839 tiov = iov; 2840 for (i = 0; i <uap->iovlen; i++, tiov++) { 2841 if ((auio.uio_resid += tiov->iov_len) < 0) { 2842 error = EINVAL; 2843 goto out; 2844 } 2845 } 2846 len = auio.uio_resid; 2847 fromsa = (struct sockaddr *)sockbufstore; 2848 2849 #ifdef KTRACE 2850 if (KTRPOINT(td, KTR_GENIO)) 2851 ktruio = cloneuio(&auio); 2852 #endif /* KTRACE */ 2853 memset(&sinfo, 0, sizeof(struct sctp_sndrcvinfo)); 2854 CURVNET_SET(so->so_vnet); 2855 error = sctp_sorecvmsg(so, &auio, (struct mbuf **)NULL, 2856 fromsa, fromlen, &msg_flags, 2857 (struct sctp_sndrcvinfo *)&sinfo, 1); 2858 CURVNET_RESTORE(); 2859 if (error) { 2860 if (auio.uio_resid != len && (error == ERESTART || 2861 error == EINTR || error == EWOULDBLOCK)) 2862 error = 0; 2863 } else { 2864 if (uap->sinfo) 2865 error = copyout(&sinfo, uap->sinfo, sizeof (sinfo)); 2866 } 2867 #ifdef KTRACE 2868 if (ktruio != NULL) { 2869 ktruio->uio_resid = len - auio.uio_resid; 2870 ktrgenio(uap->sd, UIO_READ, ktruio, error); 2871 } 2872 #endif /* KTRACE */ 2873 if (error) 2874 goto out; 2875 td->td_retval[0] = len - auio.uio_resid; 2876 2877 if (fromlen && uap->from) { 2878 len = fromlen; 2879 if (len <= 0 || fromsa == 0) 2880 len = 0; 2881 else { 2882 len = MIN(len, fromsa->sa_len); 2883 error = copyout(fromsa, uap->from, (size_t)len); 2884 if (error) 2885 goto out; 2886 } 2887 error = copyout(&len, uap->fromlenaddr, sizeof (socklen_t)); 2888 if (error) { 2889 goto out; 2890 } 2891 } 2892 #ifdef KTRACE 2893 if (KTRPOINT(td, KTR_STRUCT)) 2894 ktrsockaddr(fromsa); 2895 #endif 2896 if (uap->msg_flags) { 2897 error = copyout(&msg_flags, uap->msg_flags, sizeof (int)); 2898 if (error) { 2899 goto out; 2900 } 2901 } 2902 out: 2903 free(iov, M_IOV); 2904 out1: 2905 if (fp) 2906 fdrop(fp, td); 2907 2908 return (error); 2909 #else /* SCTP */ 2910 return (EOPNOTSUPP); 2911 #endif /* SCTP */ 2912 } 2913