SOCKET(9)

📦 version 12.2, in debian bookworm, debian trixie, ubuntu jammy, ubuntu noble, ubuntu questing, ubuntu resolute, ubuntu stonking

okay so welcome to SOCKET(9) bestie 💖 this one lives in the Kernel Developer's Manual and it is, like, the kernel socket interface. If you're writing kernel code that touches sockets, this page is your main character. No cap. 👑

🌸 NAME 🌸

socket — kernel socket interface 🫶

that's it, that's the whole name section, she's short and iconic

✨ SYNOPSIS ✨

first you gotta pull in the header files, obviously 🎀

#include <sys/socket.h>
#include <sys/socketvar.h>

then boom — here's the whole lineup of functions, and yes every single one of them is getting listed, we do not skip 💅

void
soabort(struct socket *so);

int
soaccept(struct socket *so, struct sockaddr **nam);

int
socheckuid(struct socket *so, uid_t uid);

int
sobind(struct socket *so, struct sockaddr *nam, struct thread *td);

void
soclose(struct socket *so);

int
soconnect(struct socket *so, struct sockaddr *nam, struct thread *td);

int
socreate(int dom, struct socket **aso, int type, int proto,
    struct ucred *cred, struct thread *td);

int
sodisconnect(struct socket *so);

void
sodtor_set(struct socket *so, void (*func)(struct socket *));

struct sockaddr *
sodupsockaddr(const struct sockaddr *sa, int mflags);

void
sofree(struct socket *so);

void
sohasoutofband(struct socket *so);

int
solisten(struct socket *so, int backlog, struct thread *td);

void
solisten_proto(struct socket *so, int backlog);

int
solisten_proto_check(struct socket *so);

struct socket *
sonewconn(struct socket *head, int connstatus);

int
sopoll(struct socket *so, int events, struct ucred *active_cred,
    struct thread *td);

int
sopoll_generic(struct socket *so, int events, struct ucred *active_cred,
    struct thread *td);

int
soreceive(struct socket *so, struct sockaddr **psa, struct uio *uio,
    struct mbuf **mp0, struct mbuf **controlp, int *flagsp);

int
soreceive_stream(struct socket *so, struct sockaddr **paddr,
    struct uio *uio, struct mbuf **mp0, struct mbuf **controlp,
    int *flagsp);

int
soreceive_dgram(struct socket *so, struct sockaddr **paddr,
    struct uio *uio, struct mbuf **mp0, struct mbuf **controlp,
    int *flagsp);

int
soreceive_generic(struct socket *so, struct sockaddr **paddr,
    struct uio *uio, struct mbuf **mp0, struct mbuf **controlp,
    int *flagsp);

int
soreserve(struct socket *so, u_long sndcc, u_long rcvcc);

void
sorflush(struct socket *so);

int
sosend(struct socket *so, struct sockaddr *addr, struct uio *uio,
    struct mbuf *top, struct mbuf *control, int flags,
    struct thread *td);

int
sosend_dgram(struct socket *so, struct sockaddr *addr, struct uio *uio,
    struct mbuf *top, struct mbuf *control, int flags,
    struct thread *td);

int
sosend_generic(struct socket *so, struct sockaddr *addr,
    struct uio *uio, struct mbuf *top, struct mbuf *control, int flags,
    struct thread *td);

int
soshutdown(struct socket *so, int how);

void
sotoxsocket(struct socket *so, struct xsocket *xso);

void
soupcall_clear(struct socket *so, int which);

void
soupcall_set(struct socket *so, int which,
    int (*func)(struct socket *, void *, int), void *arg);

void
sowakeup(struct socket *so, struct sockbuf *sb);

and then there's a whole second header for the sockopt girlies, because of course there is 😭

#include <sys/sockopt.h>
int
sosetopt(struct socket *so, struct sockopt *sopt);

int
sogetopt(struct socket *so, struct sockopt *sopt);

int
sooptcopyin(struct sockopt *sopt, void *buf, size_t len, size_t minlen);

int
sooptcopyout(struct sockopt *sopt, const void *buf, size_t len);

so yeah that's the full cast list 🧚 all thirty-something of them, all declared, all accounted for. the way this synopsis just keeps going?? it's giving ensemble piece. ⭐

and that's just the opening number, bestie — the DESCRIPTION is where it gets juicy, so keep reading 💜

💖 DESCRIPTION 💖

Okay bestie, gather round, because this is the kernel-side socket tea and it's lowkey iconic. 🫖✨

The kernel socket programming interface lets in-kernel consumers vibe with local and network socket objects pretty much the same way the socket(2) user API does. It's giving "same energy, different door." These interfaces are meant for distributed file systems and other network-aware kernel services — the cool kids who need sockets but live in the kernel.

Here's the glow-up difference: the user API operates on file descriptors, while the kernel interfaces operate directly on struct socket pointers. No fd middleman, no cap. 💅

Some parts of the kernel API literally exist only to implement the user API, and kernel code isn't expected to touch those. And the parts of the socket API used by socket consumers vs. implementations of network protocols? Totally different vibes. Some routines are only useful for protocol implementors — iykyk.

⚠️ Except where otherwise indicated, socket functions may sleep, and are not appropriate for use in an ithread(9) context or while holding non-sleepable kernel locks. Like, do not do that. Fr fr.

🎀 Creating and Destroying Sockets 🎀

New socket? Call socreate(). Just like socket(2), the arguments specify the requested domain, type, and protocol via dom, type, and proto. On success the socket comes back through aso. Bonus: the credential used to authorize operations associated with the socket gets passed via cred (and it's cached for the lifetime of the socket 🫶), and the thread doing the operation comes in via td.

⚠️ Warning: authorization of the socket creation operation will be performed using the thread credential for some protocols (such as raw sockets). Yes, for real. 😭

Sockets get closed and freed with soclose(), which has similar semantics to close(2). Classic.

Sometimes you gotta destroy a socket without waiting for it to disconnect, and that's what soabort() is for. But bestie, read the fine print:

  • This is only appropriate for incoming connections which are in a partially connected state.
  • It must be called on an unreferenced socket, by the thread which removed the socket from its listen queue, to prevent races.
  • It will call into protocol code, so no socket locks may be held over the call.
  • The caller of soabort() is responsible for setting the VNET context.

The normal path to freeing a socket is sofree(), which handles reference counting on the socket. It should be called whenever a reference is released, and also whenever reference flags are cleared in socket or protocol code.

🚨 Calls to sofree() should not be made from outside the socket layer; outside callers should use soclose() instead. Periodt.

🌸 Connections and Addresses 🌸

s bind() — wait no, sobind() — is equivalent to the bind(2) system call, and binds the socket so to the address nam. The operation would be authorized using the credential on thread td.

soconnect() is equivalent to the connect(2) system call, and initiates a connection on the socket so to the address nam. The operation will be authorized using the credential on thread td.

But here's the twist, bestie: unlike the user system call, soconnect() returns immediately. 😳 The caller may msleep(9) on so->so_timeo while holding the socket mutex and waiting for the SS_ISCONNECTING flag to clear or so->so_error to become non-zero.

If soconnect() fails, the caller must manually clear the SS_ISCONNECTING flag. No one else is gonna do it for you, babe.

A call to sodisconnect() disconnects the socket without closing it. Situationship behavior, honestly. 🙈

soshutdown() is equivalent to the shutdown(2) system call, and causes part or all of a connection on a socket to be closed down.

And sockets get transitioned from non-listening status to listening with solisten(). Slay. 👑

💅 Socket Options 💅

sogetopt() is equivalent to the getsockopt(2) system call, and retrieves a socket option on socket so. sosetopt() is equivalent to the setsockopt(2) system call, and sets a socket option on socket so.

The second argument in both sogetopt() and sosetopt() is the sopt pointer to a struct sopt describing the socket option operation. The caller-allocated structure must be zeroed, and then have its fields initialized to specify socket option operation arguments:

  • sopt_dir — Set to SOPT_SET or SOPT_GET depending on whether this is a get or set operation.
  • sopt_level — Specify the level in the network stack the operation is targeted at; for example, SOL_SOCKET.
  • sopt_name — Specify the name of the socket option to set.
  • sopt_val — Kernel space pointer to the argument value for the socket option.
  • sopt_valsize — Size of the argument value in bytes.

Zero it out first, bestie. The struct does not appreciate being half-initialized. 🎀

🦋 Socket Upcalls 🦋

So the owner of a socket wants to be notified when the socket is ready to send or receive data? Register an upcall on the socket, babe. ✨ The upcall is a function that will be called by the socket framework when a socket buffer associated with the given socket is ready for reading or writing.

soupcall_set() is used to register a socket upcall. The function func is registered, and the pointer arg will be passed as its second argument when it is called by the framework. The possible values for which are SO_RCV and SO_SND, which register upcalls for receive and send events, respectively.

The upcall function func() must return either SU_OK or SU_ISCONNECTED, depending on whether or not a call to soisconnected should be made by the socket framework after the upcall returns.

🚨 The upcall func cannot call soisconnected itself due to lock ordering with the socket buffer lock.

Also important:

  • Only SO_RCV upcalls should return SU_ISCONNECTED.
  • When a SO_RCV upcall returns SU_ISCONNECTED, the upcall will be removed from the socket.

Upcalls are removed from their socket by soupcall_clear(). The which argument again specifies whether the sending or receiving upcall is to be cleared, with SO_RCV or SO_SND.

🧚 Socket Destructor Callback 🧚

A kernel system can use the sodtor_set() function to set a destructor for a socket. The destructor is called when the socket is about to be freed. It's called before the protocol detach routine. Think of it as a little callback to kick off additional cleanup actions. 🌈

🔥 Socket I/O 🔥

soreceive() is equivalent to the recvmsg(2) system call, and attempts to receive bytes of data from the socket so, optionally blocking awaiting for data if none is ready to read. Data may be retrieved:

  • directly to kernel or user memory via the uio argument, or
  • as an mbuf chain returned to the caller via mp0, avoiding a data copy.

Details, because details matter:

  • The uio must always be non-NULL.
  • If mp0 is non-NULL, only the uio_resid of uio is used.
  • The caller may optionally retrieve a socket address on a protocol with the PR_ADDR capability by providing storage via a non-NULL psa argument.
  • The caller may optionally retrieve control data mbufs via a non-NULL controlp argument.
  • Optional flags may be passed to soreceive() via a non-NULL flagsp argument, and use the same flag name space as the recvmsg(2) system call.

sosend() is equivalent to the sendmsg(2) system call, and attempts to send bytes of data via the socket so, optionally blocking if data cannot be immediately sent. Data may be sent:

  • directly from kernel or user memory via the uio argument, or
  • as an mbuf chain via top, avoiding a data copy.
Only one of the uio or top pointers may be non-NULL. Pick a lane, bestie. 💀

More on sosend():

  • An optional destination address may be specified via a non-NULL addr argument, which may result in an implicit connect if supported by the protocol.
  • The caller may optionally send control data mbufs via a non-NULL control argument.
  • Flags may be passed to sosend() using the flags argument, and use the same flag name space as the sendmsg(2) system call.
Kernel callers running in ithread(9) context, or with a mutex held, will wish to use non-blocking sockets and pass the MSG_DONTWAIT flag in order to prevent these functions from sleeping. Don't let them nap on you. 😴🚫

A socket can be queried for readability, writability, out-of-band data, or end-of-file using sopoll(). The possible values for events are as for poll(2), with symbolic values POLLIN, POLLPRI, POLLOUT, POLLRDNORM, POLLWRNORM, POLLRDBAND, and POLLINGEOF taken from <sys/poll.h>.

Calls to soaccept() pass through to the protocol's accept routine to accept an incoming connection. 🤝

⭐ Socket Utility Functions ⭐

  • The uid of a socket's credential may be compared against a uid with socheckuid().
  • A copy of an existing struct sockaddr may be made using sodupsockaddr().
  • Protocol implementations notify the socket layer of the arrival of out-of-band data using sohasoutofband(), so that the socket layer can notify socket consumers of the available data.
  • An "external-format" version of a struct socket can be created using sotoxsocket(), suitable for isolating user code from changes in the kernel structure.

👑 Protocol Implementations 👑

Protocols must supply an implementation for solisten(); such protocol implementations can call back into the socket layer using solisten_proto_check() and solisten_proto() to check and set the socket-layer listen state. These callbacks are provided so that the protocol implementation can order the socket layer and protocol locks as necessary. Protocols must supply an implementation of soreceive(); the functions soreceive_stream(), soreceive_dgram(), and soreceive_generic() are supplied for use by such implementations.

Protocol implementations can use sonewconn() to create a socket and attach protocol state to that socket. This can be used to create new sockets available for soaccept() on a listen socket.

The returned socket has a reference count of zero. Don't forget that.

Protocols must supply an implementation for sopoll(); sopoll_generic() is provided for the use by protocol implementations.

The functions sosend_dgram() and sosend_generic() are supplied to assist in protocol implementations of sosend().

When a protocol creates a new socket structure, it is necessary to reserve socket buffer space for that socket, by calling soreserve(). The rough inverse of this reservation is performed by sorflush(), which is called automatically by the socket framework. 🪄

When a protocol needs to wake up threads waiting for the socket to become ready to read or write, variants of sowakeup() are used.

sowakeup() should not be called directly by protocol code. Instead use the wrappers sorwakeup(), sorwakeup_locked(), sowwakeup(), and sowwakeup_locked() for readers and writers, with the corresponding socket buffer lock not already locked, or already held, respectively.

The functions sooptcopyin() and sooptcopyout() are useful for transferring struct sockopt data between user and kernel code.

🌈 SEE ALSO 🌈

bind(2), close(2), connect(2), getsockopt(2), recv(2), send(2), setsockopt(2), shutdown(2), socket(2), ng_ksocket(4), ithread(9), msleep(9), ucred(9)

📜 HISTORY 📜

The socket(2) system call appeared in 4.2BSD. This manual page was introduced in FreeBSD 7.0. Iconic lineage, honestly. 💖

🫶 AUTHORS 🫶

This manual page was written by Robert Watson and Benjamin Kaduk. Legends, your faves could never. ✨

💀 BUGS 💀

okay bestie, sit down, because this is the part where we spill the tea on all the messy little gremlins living in this codebase 🫖✨

  • the whole credential situation is lowkey a mess ngl 😭 the use of explicitly passed credentials, credentials hung from explicitly passed threads, the credential on curthread, and the cached credential from socket creation time is inconsistent, and it may lead to unexpected behaviour. it's possible that several of the td arguments should be cred arguments, or simply not be present at all 👀 fr fr, nobody's sure, and that's the vibe we're shipping with 💅
  • the caller may need to manually clear SS_ISCONNECTING if soconnect() returns an error. yes, you, personally, by hand, with your own two hands 🙈
  • the MSG_DONTWAIT flag is not implemented for sosend(), and may not always work with soreceive() when zero copy sockets are enabled. it's giving "we said what we said" 💀
  • this manual page does not describe how to register socket upcalls or monitor a socket for readability/writability without using blocking I/O. so if that's what you came here for... bestie, wrong page, but ily 🫶
  • the soref() and sorele() functions are not described, and in most cases should not be used, due to confusing and potentially incorrect interactions when sorele() is last called after soclose(). genuinely, don't. it's not worth it. put it down 🚫
tl;dr — credentials are chaotic, SS_ISCONNECTING is your problem now, MSG_DONTWAIT is a lie sometimes, upcalls are undocumented, and soref()/sorele() are giving danger. proceed with main character energy and a healthy amount of fear 😌💖

and that's a wrap on SOCKET(9), bestie!! 🎀 this lil page came from the Debian fam, dated October 18, 2018 (so yes, it's been serving cunt since 2018 💅), and it goes by the very chic name SOCKET(9). go forth, write your kernel sockets, and remember: the facts did not change, only the aura ✨💜

📦 where this page comes from