xref: /dragonfly/sys/netgraph7/netgraph/ng_base.c (revision eca362d0)
1 /*-
2  * Copyright (c) 1996-1999 Whistle Communications, Inc.
3  * All rights reserved.
4  *
5  * Subject to the following obligations and disclaimer of warranty, use and
6  * redistribution of this software, in source or object code forms, with or
7  * without modifications are expressly permitted by Whistle Communications;
8  * provided, however, that:
9  * 1. Any and all reproductions of the source or object code must include the
10  *    copyright notice above and the following disclaimer of warranties; and
11  * 2. No rights are granted, in any manner or form, to use Whistle
12  *    Communications, Inc. trademarks, including the mark "WHISTLE
13  *    COMMUNICATIONS" on advertising, endorsements, or otherwise except as
14  *    such appears in the above copyright notice or in the software.
15  *
16  * THIS SOFTWARE IS BEING PROVIDED BY WHISTLE COMMUNICATIONS "AS IS", AND
17  * TO THE MAXIMUM EXTENT PERMITTED BY LAW, WHISTLE COMMUNICATIONS MAKES NO
18  * REPRESENTATIONS OR WARRANTIES, EXPRESS OR IMPLIED, REGARDING THIS SOFTWARE,
19  * INCLUDING WITHOUT LIMITATION, ANY AND ALL IMPLIED WARRANTIES OF
20  * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT.
21  * WHISTLE COMMUNICATIONS DOES NOT WARRANT, GUARANTEE, OR MAKE ANY
22  * REPRESENTATIONS REGARDING THE USE OF, OR THE RESULTS OF THE USE OF THIS
23  * SOFTWARE IN TERMS OF ITS CORRECTNESS, ACCURACY, RELIABILITY OR OTHERWISE.
24  * IN NO EVENT SHALL WHISTLE COMMUNICATIONS BE LIABLE FOR ANY DAMAGES
25  * RESULTING FROM OR ARISING OUT OF ANY USE OF THIS SOFTWARE, INCLUDING
26  * WITHOUT LIMITATION, ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
27  * PUNITIVE, OR CONSEQUENTIAL DAMAGES, PROCUREMENT OF SUBSTITUTE GOODS OR
28  * SERVICES, LOSS OF USE, DATA OR PROFITS, HOWEVER CAUSED AND UNDER ANY
29  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
30  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
31  * THIS SOFTWARE, EVEN IF WHISTLE COMMUNICATIONS IS ADVISED OF THE POSSIBILITY
32  * OF SUCH DAMAGE.
33  *
34  * Authors: Julian Elischer <julian@freebsd.org>
35  *          Archie Cobbs <archie@freebsd.org>
36  *
37  * $FreeBSD: src/sys/netgraph/ng_base.c,v 1.159 2008/04/19 05:30:49 mav Exp $
38  * $Whistle: ng_base.c,v 1.39 1999/01/28 23:54:53 julian Exp $
39  */
40 
41 /*
42  * This file implements the base netgraph code.
43  */
44 
45 #include <sys/param.h>
46 #include <sys/systm.h>
47 #include <sys/ctype.h>
48 #include <sys/errno.h>
49 #include <sys/hash.h>
50 /*#include <sys/kdb.h>*/
51 #include <sys/kernel.h>
52 #include <sys/limits.h>
53 #include <sys/malloc.h>
54 #include <sys/mbuf.h>
55 #include <sys/msgport2.h>
56 #include <sys/mutex2.h>
57 #include <sys/objcache.h>
58 #include <sys/proc.h>
59 #include <sys/queue.h>
60 #include <sys/refcount.h>
61 #include <sys/sysctl.h>
62 #include <sys/syslog.h>
63 #include <machine/cpu.h>
64 
65 #include <netgraph7/netgraph.h>
66 #include <netgraph7/netgraph2.h>
67 #include <netgraph7/ng_parse.h>
68 
69 MODULE_VERSION(netgraph, NG_ABI_VERSION);
70 
71 /* Token to protect topology events. */
72 static struct lwkt_token	ng_topo_token;
73 #define	TOPOLOGY_RLOCK()	lwkt_gettoken_shared(&ng_topo_token)
74 #define	TOPOLOGY_RUNLOCK()	lwkt_reltoken(&ng_topo_token)
75 #define	TOPOLOGY_WLOCK()	lwkt_gettoken(&ng_topo_token)
76 #define	TOPOLOGY_WUNLOCK()	lwkt_reltoken(&ng_topo_token)
77 #define	TOPOLOGY_NOTOWNED()	KKASSERT(!LWKT_TOKEN_HELD_ANY(&ng_topo_token))
78 
79 #ifdef	NETGRAPH_DEBUG
80 static struct mtx	ng_nodelist_mtx; /* protects global node/hook lists */
81 static struct mtx	ngq_mtx;	/* protects the queue item list */
82 
83 static SLIST_HEAD(, ng_node) ng_allnodes;
84 static LIST_HEAD(, ng_node) ng_freenodes; /* in debug, we never free() them */
85 static SLIST_HEAD(, ng_hook) ng_allhooks;
86 static LIST_HEAD(, ng_hook) ng_freehooks; /* in debug, we never free() them */
87 
88 static void ng_dumpitems(void);
89 static void ng_dumpnodes(void);
90 static void ng_dumphooks(void);
91 
92 #endif	/* NETGRAPH_DEBUG */
93 /*
94  * DEAD versions of the structures.
95  * In order to avoid races, it is sometimes necessary to point
96  * at SOMETHING even though theoretically, the current entity is
97  * INVALID. Use these to avoid these races.
98  */
99 struct ng_type ng_deadtype = {
100 	NG_ABI_VERSION,
101 	"dead",
102 	NULL,	/* modevent */
103 	NULL,	/* constructor */
104 	NULL,	/* rcvmsg */
105 	NULL,	/* shutdown */
106 	NULL,	/* newhook */
107 	NULL,	/* findhook */
108 	NULL,	/* connect */
109 	NULL,	/* rcvdata */
110 	NULL,	/* disconnect */
111 	NULL, 	/* cmdlist */
112 };
113 
114 struct ng_node ng_deadnode = {
115 	"dead",
116 	&ng_deadtype,
117 	NGF_INVALID,
118 	0,	/* numhooks */
119 	NULL,	/* private */
120 	0,	/* ID */
121 	LIST_HEAD_INITIALIZER(ng_deadnode.hooks),
122 	{},	/* all_nodes list entry */
123 	{},	/* id hashtable list entry */
124 	{
125 		0,
126 		NULL,
127 		0,
128 		NULL,
129 	},	/* token */
130 	1,	/* refs */
131 #ifdef	NETGRAPH_DEBUG
132 	ND_MAGIC,
133 	__FILE__,
134 	__LINE__,
135 	{NULL}
136 #endif	/* NETGRAPH_DEBUG */
137 };
138 
139 struct ng_hook ng_deadhook = {
140 	"dead",
141 	NULL,		/* private */
142 	HK_INVALID | HK_DEAD,
143 	0,		/* undefined data link type */
144 	&ng_deadhook,	/* Peer is self */
145 	&ng_deadnode,	/* attached to deadnode */
146 	{},		/* hooks list */
147 	NULL,		/* override rcvmsg() */
148 	NULL,		/* override rcvdata() */
149 	1,		/* refs always >= 1 */
150 #ifdef	NETGRAPH_DEBUG
151 	HK_MAGIC,
152 	__FILE__,
153 	__LINE__,
154 	{NULL}
155 #endif	/* NETGRAPH_DEBUG */
156 };
157 
158 /*
159  * END DEAD STRUCTURES
160  */
161 
162 /* We don't want our messages to be replied. This is our panic reply port. */
163 static struct lwkt_port ng_panic_reply_port;
164 
165 /* Array of per-CPU target ports */
166 struct lwkt_port *ng_msgport[MAXCPU];
167 
168 /* List of installed types */
169 static LIST_HEAD(, ng_type) ng_typelist;
170 static struct lwkt_token	ng_typelist_token;
171 #define	TYPELIST_RLOCK()	lwkt_gettoken_shared(&ng_typelist_token)
172 #define	TYPELIST_RUNLOCK()	lwkt_reltoken(&ng_typelist_token)
173 #define	TYPELIST_WLOCK()	lwkt_gettoken(&ng_typelist_token)
174 #define	TYPELIST_WUNLOCK()	lwkt_reltoken(&ng_typelist_token)
175 
176 /* Hash related definitions */
177 LIST_HEAD(nodehash, ng_node);
178 static struct nodehash		*ng_ID_hash;
179 static u_long			 ng_ID_hmask;
180 static u_long			 ng_nodes;
181 static struct nodehash		*ng_name_hash;
182 static u_long			 ng_name_hmask;
183 static u_long			 ng_named_nodes;
184 static struct lwkt_token	 ng_idhash_token;
185 #define	IDHASH_RLOCK()		lwkt_gettoken_shared(&ng_idhash_token)
186 #define	IDHASH_RUNLOCK()	lwkt_reltoken(&ng_idhash_token)
187 #define	IDHASH_WLOCK()		lwkt_gettoken(&ng_idhash_token)
188 #define	IDHASH_WUNLOCK()	lwkt_reltoken(&ng_idhash_token)
189 #define	IDHASH_ASSERT_LOCKED()	KKASSERT(LWKT_TOKEN_HELD_ANY(&ng_idhash_token));
190 /* Method to find a node.. used twice so do it here */
191 #define NG_IDHASH_FN(ID) ((ID) % (ng_ID_hmask + 1))
192 #define NG_IDHASH_FIND(ID, node)					\
193 	do { 								\
194 		IDHASH_ASSERT_LOCKED();					\
195 		LIST_FOREACH(node, &ng_ID_hash[NG_IDHASH_FN(ID)],	\
196 						nd_idnodes) {		\
197 			if (NG_NODE_IS_VALID(node)			\
198 			&& (NG_NODE_ID(node) == ID)) {			\
199 				break;					\
200 			}						\
201 		}							\
202 	} while (0)
203 
204 static struct lwkt_token		ng_namehash_token;
205 #define	NAMEHASH_RLOCK()		lwkt_gettoken_shared(&ng_namehash_token)
206 #define	NAMEHASH_RUNLOCK()		lwkt_reltoken(&ng_namehash_token)
207 #define	NAMEHASH_WLOCK()		lwkt_gettoken(&ng_namehash_token)
208 #define	NAMEHASH_WUNLOCK()		lwkt_reltoken(&ng_namehash_token)
209 #define	NAMEHASH_ASSERT_LOCKED()	KKASSERT(LWKT_TOKEN_HELD_ANY(&ng_namehash_token));
210 
211 /* Internal functions */
212 static int	ng_add_hook(node_p node, const char *name, hook_p * hookp);
213 static int	ng_generic_msg(node_p here, item_p item, hook_p lasthook);
214 static ng_ID_t	ng_decodeidname(const char *name);
215 static int	ngb_mod_event(module_t mod, int event, void *data);
216 static void	ngthread(void *dummy);
217 static int	ng_apply_item(item_p item);
218 static node_p	ng_ID2noderef(ng_ID_t ID);
219 static int	ng_con_nodes(item_p item, node_p node, const char *name,
220 		    node_p node2, const char *name2);
221 static int	ng_con_part2(node_p node, item_p item, hook_p hook);
222 static int	ng_con_part3(node_p node, item_p item, hook_p hook);
223 static int	ng_mkpeer(node_p node, const char *name, const char *name2,
224 		    char *type);
225 static void	ng_name_rehash(void);
226 static void	ng_ID_rehash(void);
227 static boolean_t	bzero_ctor(void *obj, void *private, int ocflags);
228 
229 /* Imported, these used to be externally visible, some may go back. */
230 void	ng_destroy_hook(hook_p hook);
231 node_p	ng_name2noderef(node_p node, const char *name);
232 int	ng_path2noderef(node_p here, const char *path,
233 	node_p *dest, hook_p *lasthook);
234 int	ng_make_node(const char *type, node_p *nodepp);
235 int	ng_path_parse(char *addr, char **node, char **path, char **hook);
236 void	ng_rmnode(node_p node, hook_p dummy1, void *dummy2, int dummy3);
237 void	ng_unname(node_p node);
238 
239 
240 /* Our own netgraph malloc type */
241 MALLOC_DEFINE(M_NETGRAPH, "netgraph", "netgraph structures and ctrl messages");
242 MALLOC_DEFINE(M_NETGRAPH_HOOK, "netgraph_hook", "netgraph hook structures");
243 MALLOC_DEFINE(M_NETGRAPH_NODE, "netgraph_node", "netgraph node structures");
244 MALLOC_DEFINE(M_NETGRAPH_MSG, "netgraph_msg", "netgraph name storage");
245 MALLOC_DEFINE(M_NETGRAPH_APPLY, "netgraph_apply", "netgraph apply_info structures");
246 
247 /* Should not be visible outside this file */
248 
249 #define _NG_ALLOC_HOOK(hook) \
250 	hook = kmalloc(sizeof(*hook), M_NETGRAPH_HOOK, \
251 	    M_WAITOK | M_NULLOK | M_ZERO)
252 #define _NG_ALLOC_NODE(node) \
253 	node = kmalloc(sizeof(*node), M_NETGRAPH_NODE, \
254 	    M_WAITOK | M_NULLOK | M_ZERO)
255 
256 #ifdef NETGRAPH_DEBUG /*----------------------------------------------*/
257 /*
258  * In debug mode:
259  * In an attempt to help track reference count screwups
260  * we do not free objects back to the malloc system, but keep them
261  * in a local cache where we can examine them and keep information safely
262  * after they have been freed.
263  * We use this scheme for nodes and hooks, and to some extent for items.
264  */
265 static __inline hook_p
266 ng_alloc_hook(void)
267 {
268 	hook_p hook;
269 	SLIST_ENTRY(ng_hook) temp;
270 	mtx_lock(&ng_nodelist_mtx);
271 	hook = LIST_FIRST(&ng_freehooks);
272 	if (hook) {
273 		LIST_REMOVE(hook, hk_hooks);
274 		bcopy(&hook->hk_all, &temp, sizeof(temp));
275 		bzero(hook, sizeof(struct ng_hook));
276 		bcopy(&temp, &hook->hk_all, sizeof(temp));
277 		mtx_unlock(&ng_nodelist_mtx);
278 		hook->hk_magic = HK_MAGIC;
279 	} else {
280 		mtx_unlock(&ng_nodelist_mtx);
281 		_NG_ALLOC_HOOK(hook);
282 		if (hook) {
283 			hook->hk_magic = HK_MAGIC;
284 			mtx_lock(&ng_nodelist_mtx);
285 			SLIST_INSERT_HEAD(&ng_allhooks, hook, hk_all);
286 			mtx_unlock(&ng_nodelist_mtx);
287 		}
288 	}
289 	return (hook);
290 }
291 
292 static __inline node_p
293 ng_alloc_node(void)
294 {
295 	node_p node;
296 	SLIST_ENTRY(ng_node) temp;
297 	mtx_lock(&ng_nodelist_mtx);
298 	node = LIST_FIRST(&ng_freenodes);
299 	if (node) {
300 		LIST_REMOVE(node, nd_nodes);
301 		bcopy(&node->nd_all, &temp, sizeof(temp));
302 		bzero(node, sizeof(struct ng_node));
303 		bcopy(&temp, &node->nd_all, sizeof(temp));
304 		mtx_unlock(&ng_nodelist_mtx);
305 		node->nd_magic = ND_MAGIC;
306 	} else {
307 		mtx_unlock(&ng_nodelist_mtx);
308 		_NG_ALLOC_NODE(node);
309 		if (node) {
310 			node->nd_magic = ND_MAGIC;
311 			mtx_lock(&ng_nodelist_mtx);
312 			SLIST_INSERT_HEAD(&ng_allnodes, node, nd_all);
313 			mtx_unlock(&ng_nodelist_mtx);
314 		}
315 	}
316 	return (node);
317 }
318 
319 #define NG_ALLOC_HOOK(hook) do { (hook) = ng_alloc_hook(); } while (0)
320 #define NG_ALLOC_NODE(node) do { (node) = ng_alloc_node(); } while (0)
321 
322 
323 #define NG_FREE_HOOK(hook)						\
324 	do {								\
325 		mtx_lock(&ng_nodelist_mtx);			\
326 		LIST_INSERT_HEAD(&ng_freehooks, hook, hk_hooks);	\
327 		hook->hk_magic = 0;					\
328 		mtx_unlock(&ng_nodelist_mtx);			\
329 	} while (0)
330 
331 #define NG_FREE_NODE(node)						\
332 	do {								\
333 		mtx_lock(&ng_nodelist_mtx);			\
334 		LIST_INSERT_HEAD(&ng_freenodes, node, nd_nodes);	\
335 		node->nd_magic = 0;					\
336 		mtx_unlock(&ng_nodelist_mtx);			\
337 	} while (0)
338 
339 #else /* NETGRAPH_DEBUG */ /*----------------------------------------------*/
340 
341 #define NG_ALLOC_HOOK(hook) _NG_ALLOC_HOOK(hook)
342 #define NG_ALLOC_NODE(node) _NG_ALLOC_NODE(node)
343 
344 #define NG_FREE_HOOK(hook) do { kfree((hook), M_NETGRAPH_HOOK); } while (0)
345 #define NG_FREE_NODE(node) do { kfree((node), M_NETGRAPH_NODE); } while (0)
346 
347 #endif /* NETGRAPH_DEBUG */ /*----------------------------------------------*/
348 
349 /* Set this to kdb_enter("X") to catch all errors as they occur */
350 #ifndef TRAP_ERROR
351 #define TRAP_ERROR()
352 #endif
353 
354 static	ng_ID_t nextID = 1;
355 
356 #ifdef INVARIANTS
357 #define CHECK_DATA_MBUF(m)	do {					\
358 		struct mbuf *n;						\
359 		int total;						\
360 									\
361 		M_ASSERTPKTHDR(m);					\
362 		for (total = 0, n = (m); n != NULL; n = n->m_next) {	\
363 			total += n->m_len;				\
364 			if (n->m_nextpkt != NULL)			\
365 				panic("%s: m_nextpkt", __func__);	\
366 		}							\
367 									\
368 		if ((m)->m_pkthdr.len != total) {			\
369 			panic("%s: %d != %d",				\
370 			    __func__, (m)->m_pkthdr.len, total);	\
371 		}							\
372 	} while (0)
373 #else
374 #define CHECK_DATA_MBUF(m)
375 #endif
376 
377 #define ERROUT(x)	do { error = (x); goto done; } while (0)
378 
379 /************************************************************************
380 	Parse type definitions for generic messages
381 ************************************************************************/
382 
383 /* Handy structure parse type defining macro */
384 #define DEFINE_PARSE_STRUCT_TYPE(lo, up, args)				\
385 static const struct ng_parse_struct_field				\
386 	ng_ ## lo ## _type_fields[] = NG_GENERIC_ ## up ## _INFO args;	\
387 static const struct ng_parse_type ng_generic_ ## lo ## _type = {	\
388 	&ng_parse_struct_type,						\
389 	&ng_ ## lo ## _type_fields					\
390 }
391 
392 DEFINE_PARSE_STRUCT_TYPE(mkpeer, MKPEER, ());
393 DEFINE_PARSE_STRUCT_TYPE(connect, CONNECT, ());
394 DEFINE_PARSE_STRUCT_TYPE(name, NAME, ());
395 DEFINE_PARSE_STRUCT_TYPE(rmhook, RMHOOK, ());
396 DEFINE_PARSE_STRUCT_TYPE(nodeinfo, NODEINFO, ());
397 DEFINE_PARSE_STRUCT_TYPE(typeinfo, TYPEINFO, ());
398 DEFINE_PARSE_STRUCT_TYPE(linkinfo, LINKINFO, (&ng_generic_nodeinfo_type));
399 
400 /* Get length of an array when the length is stored as a 32 bit
401    value immediately preceding the array -- as with struct namelist
402    and struct typelist. */
403 static int
404 ng_generic_list_getLength(const struct ng_parse_type *type,
405 	const u_char *start, const u_char *buf)
406 {
407 	return *((const u_int32_t *)(buf - 4));
408 }
409 
410 /* Get length of the array of struct linkinfo inside a struct hooklist */
411 static int
412 ng_generic_linkinfo_getLength(const struct ng_parse_type *type,
413 	const u_char *start, const u_char *buf)
414 {
415 	const struct hooklist *hl = (const struct hooklist *)start;
416 
417 	return hl->nodeinfo.hooks;
418 }
419 
420 /* Array type for a variable length array of struct namelist */
421 static const struct ng_parse_array_info ng_nodeinfoarray_type_info = {
422 	&ng_generic_nodeinfo_type,
423 	&ng_generic_list_getLength
424 };
425 static const struct ng_parse_type ng_generic_nodeinfoarray_type = {
426 	&ng_parse_array_type,
427 	&ng_nodeinfoarray_type_info
428 };
429 
430 #if 0 /* unused */
431 /* Array type for a variable length array of struct typelist */
432 static const struct ng_parse_array_info ng_typeinfoarray_type_info = {
433 	&ng_generic_typeinfo_type,
434 	&ng_generic_list_getLength
435 };
436 static const struct ng_parse_type ng_generic_typeinfoarray_type = {
437 	&ng_parse_array_type,
438 	&ng_typeinfoarray_type_info
439 };
440 #endif
441 
442 /* Array type for array of struct linkinfo in struct hooklist */
443 static const struct ng_parse_array_info ng_generic_linkinfo_array_type_info = {
444 	&ng_generic_linkinfo_type,
445 	&ng_generic_linkinfo_getLength
446 };
447 static const struct ng_parse_type ng_generic_linkinfo_array_type = {
448 	&ng_parse_array_type,
449 	&ng_generic_linkinfo_array_type_info
450 };
451 
452 #if 0 /* unused */
453 DEFINE_PARSE_STRUCT_TYPE(typelist, TYPELIST, (&ng_generic_typeinfoarray_type));
454 #endif
455 DEFINE_PARSE_STRUCT_TYPE(hooklist, HOOKLIST,
456 	(&ng_generic_nodeinfo_type, &ng_generic_linkinfo_array_type));
457 DEFINE_PARSE_STRUCT_TYPE(listnodes, LISTNODES,
458 	(&ng_generic_nodeinfoarray_type));
459 
460 /* List of commands and how to convert arguments to/from ASCII */
461 static const struct ng_cmdlist ng_generic_cmds[] = {
462 	{
463 	  NGM_GENERIC_COOKIE,
464 	  NGM_SHUTDOWN,
465 	  "shutdown",
466 	  NULL,
467 	  NULL
468 	},
469 	{
470 	  NGM_GENERIC_COOKIE,
471 	  NGM_MKPEER,
472 	  "mkpeer",
473 	  &ng_generic_mkpeer_type,
474 	  NULL
475 	},
476 	{
477 	  NGM_GENERIC_COOKIE,
478 	  NGM_CONNECT,
479 	  "connect",
480 	  &ng_generic_connect_type,
481 	  NULL
482 	},
483 	{
484 	  NGM_GENERIC_COOKIE,
485 	  NGM_NAME,
486 	  "name",
487 	  &ng_generic_name_type,
488 	  NULL
489 	},
490 	{
491 	  NGM_GENERIC_COOKIE,
492 	  NGM_RMHOOK,
493 	  "rmhook",
494 	  &ng_generic_rmhook_type,
495 	  NULL
496 	},
497 	{
498 	  NGM_GENERIC_COOKIE,
499 	  NGM_NODEINFO,
500 	  "nodeinfo",
501 	  NULL,
502 	  &ng_generic_nodeinfo_type
503 	},
504 	{
505 	  NGM_GENERIC_COOKIE,
506 	  NGM_LISTHOOKS,
507 	  "listhooks",
508 	  NULL,
509 	  &ng_generic_hooklist_type
510 	},
511 	{
512 	  NGM_GENERIC_COOKIE,
513 	  NGM_LISTNAMES,
514 	  "listnames",
515 	  NULL,
516 	  &ng_generic_listnodes_type	/* same as NGM_LISTNODES */
517 	},
518 	{
519 	  NGM_GENERIC_COOKIE,
520 	  NGM_LISTNODES,
521 	  "listnodes",
522 	  NULL,
523 	  &ng_generic_listnodes_type
524 	},
525 	{
526 	  NGM_GENERIC_COOKIE,
527 	  NGM_LISTTYPES,
528 	  "listtypes",
529 	  NULL,
530 	  &ng_generic_typeinfo_type
531 	},
532 	{
533 	  NGM_GENERIC_COOKIE,
534 	  NGM_TEXT_CONFIG,
535 	  "textconfig",
536 	  NULL,
537 	  &ng_parse_string_type
538 	},
539 	{
540 	  NGM_GENERIC_COOKIE,
541 	  NGM_TEXT_STATUS,
542 	  "textstatus",
543 	  NULL,
544 	  &ng_parse_string_type
545 	},
546 	{
547 	  NGM_GENERIC_COOKIE,
548 	  NGM_ASCII2BINARY,
549 	  "ascii2binary",
550 	  &ng_parse_ng_mesg_type,
551 	  &ng_parse_ng_mesg_type
552 	},
553 	{
554 	  NGM_GENERIC_COOKIE,
555 	  NGM_BINARY2ASCII,
556 	  "binary2ascii",
557 	  &ng_parse_ng_mesg_type,
558 	  &ng_parse_ng_mesg_type
559 	},
560 	{ 0 }
561 };
562 
563 /************************************************************************
564 			Node routines
565 ************************************************************************/
566 
567 /*
568  * Instantiate a node of the requested type
569  */
570 int
571 ng_make_node(const char *typename, node_p *nodepp)
572 {
573 	struct ng_type *type;
574 	int	error;
575 
576 	/* Check that the type makes sense */
577 	if (typename == NULL) {
578 		TRAP_ERROR();
579 		return (EINVAL);
580 	}
581 
582 	/* Locate the node type. If we fail we return. Do not try to load
583 	 * module.
584 	 */
585 	if ((type = ng_findtype(typename)) == NULL)
586 		return (ENXIO);
587 
588 	/*
589 	 * If we have a constructor, then make the node and
590 	 * call the constructor to do type specific initialisation.
591 	 */
592 	if (type->constructor != NULL) {
593 		if ((error = ng_make_node_common(type, nodepp)) == 0) {
594 			if ((error = ((*type->constructor)(*nodepp))) != 0) {
595 				NG_NODE_UNREF(*nodepp);
596 			}
597 		}
598 	} else {
599 		/*
600 		 * Node has no constructor. We cannot ask for one
601 		 * to be made. It must be brought into existence by
602 		 * some external agency. The external agency should
603 		 * call ng_make_node_common() directly to get the
604 		 * netgraph part initialised.
605 		 */
606 		TRAP_ERROR();
607 		error = EINVAL;
608 	}
609 	return (error);
610 }
611 
612 /*
613  * Generic node creation. Called by node initialisation for externally
614  * instantiated nodes (e.g. hardware, sockets, etc ).
615  * The returned node has a reference count of 1.
616  */
617 int
618 ng_make_node_common(struct ng_type *type, node_p *nodepp)
619 {
620 	node_p node;
621 
622 	/* Require the node type to have been already installed */
623 	if (ng_findtype(type->name) == NULL) {
624 		TRAP_ERROR();
625 		return (EINVAL);
626 	}
627 
628 	/* Make a node and try attach it to the type */
629 	NG_ALLOC_NODE(node);
630 	if (node == NULL) {
631 		TRAP_ERROR();
632 		return (ENOMEM);
633 	}
634 	node->nd_type = type;
635 	NG_NODE_REF(node);				/* note reference */
636 	type->refs++;
637 
638 	/* Initialize the reader/writer shared token */
639 	lwkt_token_init(&node->nd_token, type->name);
640 
641 	/* Initialize hook list for new node */
642 	LIST_INIT(&node->nd_hooks);
643 
644 	/* Get an ID and put us in the hash chain. */
645 	IDHASH_WLOCK();
646 	for (;;) { /* wrap protection, even if silly */
647 		node_p node2 = NULL;
648 		node->nd_ID = nextID++; /* 137/second for 1 year before wrap */
649 
650 		/* Is there a problem with the new number? */
651 		NG_IDHASH_FIND(node->nd_ID, node2); /* already taken? */
652 		if ((node->nd_ID != 0) && (node2 == NULL)) {
653 			break;
654 		}
655 	}
656 	ng_nodes++;
657 	if (ng_nodes * 2 > ng_ID_hmask)
658 		ng_ID_rehash();
659 	LIST_INSERT_HEAD(&ng_ID_hash[NG_IDHASH_FN(node->nd_ID)], node,
660 	    nd_idnodes);
661 	IDHASH_WUNLOCK();
662 
663 	/* Done */
664 	*nodepp = node;
665 	return (0);
666 }
667 
668 /*
669  * Forceably start the shutdown process on a node. Either call
670  * its shutdown method, or do the default shutdown if there is
671  * no type-specific method.
672  *
673  * We can only be called from a shutdown message, so we know we have
674  * a writer lock, and therefore exclusive access.
675  *
676  * Persistent node types must have a type-specific method which
677  * allocates a new node in which case, this one is irretrievably going away,
678  * or cleans up anything it needs, and just makes the node valid again,
679  * in which case we allow the node to survive.
680  *
681  * XXX We need to think of how to tell a persistent node that we
682  * REALLY need to go away because the hardware has gone or we
683  * are rebooting.... etc.
684  */
685 void
686 ng_rmnode(node_p node, hook_p dummy1, void *dummy2, int dummy3)
687 {
688 	hook_p hook;
689 
690 	/* Check if it's already shutting down */
691 	if ((node->nd_flags & NGF_CLOSING) != 0)
692 		return;
693 
694 	if (node == &ng_deadnode) {
695 		kprintf ("shutdown called on deadnode\n");
696 		return;
697 	}
698 
699 	/* Add an extra reference so it doesn't go away during this */
700 	NG_NODE_REF(node);
701 
702 	/*
703 	 * Mark it invalid so any newcomers know not to try use it
704 	 * Also add our own mark so we can't recurse
705 	 * note that NGF_INVALID does not do this as it's also set during
706 	 * creation
707 	 */
708 	node->nd_flags |= NGF_INVALID|NGF_CLOSING;
709 
710 	/* If node has its pre-shutdown method, then call it first*/
711 	if (node->nd_type && node->nd_type->close)
712 		(*node->nd_type->close)(node);
713 
714 	/* Notify all remaining connected nodes to disconnect */
715 	while ((hook = LIST_FIRST(&node->nd_hooks)) != NULL)
716 		ng_destroy_hook(hook);
717 
718 	/* Ask the type if it has anything to do in this case */
719 	if (node->nd_type && node->nd_type->shutdown) {
720 		(*node->nd_type->shutdown)(node);
721 		if (NG_NODE_IS_VALID(node)) {
722 			/*
723 			 * Well, blow me down if the node code hasn't declared
724 			 * that it doesn't want to die.
725 			 * Presumably it is a persistant node.
726 			 * If we REALLY want it to go away,
727 			 *  e.g. hardware going away,
728 			 * Our caller should set NGF_REALLY_DIE in nd_flags.
729 			 */
730 			node->nd_flags &= ~(NGF_INVALID|NGF_CLOSING);
731 			NG_NODE_UNREF(node); /* Assume they still have theirs */
732 			return;
733 		}
734 	} else {				/* do the default thing */
735 		NG_NODE_UNREF(node);
736 	}
737 
738 	ng_unname(node); /* basically a NOP these days */
739 
740 	/*
741 	 * Remove extra reference, possibly the last
742 	 * Possible other holders of references may include
743 	 * timeout callouts, but theoretically the node's supposed to
744 	 * have cancelled them. Possibly hardware dependencies may
745 	 * force a driver to 'linger' with a reference.
746 	 */
747 	NG_NODE_UNREF(node);
748 }
749 
750 /*
751  * Remove a reference to the node, possibly the last.
752  * deadnode always acts as it it were the last.
753  */
754 void
755 ng_unref_node(node_p node)
756 {
757 
758 	if (node == &ng_deadnode)
759 		return;
760 
761 	if (refcount_release(&node->nd_refs)) { /* we were the last */
762 
763 		node->nd_type->refs--; /* XXX maybe should get types lock? */
764 		NAMEHASH_WLOCK();
765 		if (NG_NODE_HAS_NAME(node)) {
766 			ng_named_nodes--;
767 			LIST_REMOVE(node, nd_nodes);
768 		}
769 		NAMEHASH_WUNLOCK();
770 
771 		IDHASH_WLOCK();
772 		ng_nodes--;
773 		LIST_REMOVE(node, nd_idnodes);
774 		IDHASH_WUNLOCK();
775 
776 		NG_FREE_NODE(node);
777 	}
778 }
779 
780 /************************************************************************
781 			Node ID handling
782 ************************************************************************/
783 static node_p
784 ng_ID2noderef(ng_ID_t ID)
785 {
786 	node_p node;
787 
788 	IDHASH_RLOCK();
789 	NG_IDHASH_FIND(ID, node);
790 	if (node)
791 		NG_NODE_REF(node);
792 	IDHASH_RUNLOCK();
793 	return(node);
794 }
795 
796 ng_ID_t
797 ng_node2ID(node_p node)
798 {
799 	return (node ? NG_NODE_ID(node) : 0);
800 }
801 
802 /************************************************************************
803 			Node name handling
804 ************************************************************************/
805 
806 /*
807  * Assign a node a name.
808  */
809 int
810 ng_name_node(node_p node, const char *name)
811 {
812 	uint32_t hash;
813 	node_p node2;
814 	int i;
815 
816 	/* Check the name is valid */
817 	for (i = 0; i < NG_NODESIZ; i++) {
818 		if (name[i] == '\0' || name[i] == '.' || name[i] == ':')
819 			break;
820 	}
821 	if (i == 0 || name[i] != '\0') {
822 		TRAP_ERROR();
823 		return (EINVAL);
824 	}
825 	if (ng_decodeidname(name) != 0) { /* valid IDs not allowed here */
826 		TRAP_ERROR();
827 		return (EINVAL);
828 	}
829 
830 	NAMEHASH_WLOCK();
831 	if (ng_named_nodes * 2 > ng_name_hmask)
832 		ng_name_rehash();
833 
834 	hash = hash32_str(name, HASHINIT) & ng_name_hmask;
835 	/* Check the name isn't already being used. */
836 	LIST_FOREACH(node2, &ng_name_hash[hash], nd_nodes)
837 		if (NG_NODE_IS_VALID(node2) &&
838 		    (strcmp(NG_NODE_NAME(node2), name) == 0)) {
839 			NAMEHASH_WUNLOCK();
840 			return (EADDRINUSE);
841 		}
842 
843 	if (NG_NODE_HAS_NAME(node))
844 		LIST_REMOVE(node, nd_nodes);
845 	else
846 		ng_named_nodes++;
847 	/* Copy it. */
848 	strlcpy(NG_NODE_NAME(node), name, NG_NODESIZ);
849 
850 	/* Update name hash. */
851 	LIST_INSERT_HEAD(&ng_name_hash[hash], node, nd_nodes);
852 	NAMEHASH_WUNLOCK();
853 
854 	return (0);
855 }
856 
857 /*
858  * Find a node by absolute name. The name should NOT end with ':'
859  * The name "." means "this node" and "[xxx]" means "the node
860  * with ID (ie, at address) xxx".
861  *
862  * Returns the node if found, else NULL.
863  * Eventually should add something faster than a sequential search.
864  * Note it acquires a reference on the node so you can be sure it's still
865  * there.
866  */
867 node_p
868 ng_name2noderef(node_p here, const char *name)
869 {
870 	node_p node;
871 	ng_ID_t temp;
872 	int	hash;
873 
874 	/* "." means "this node" */
875 	if (strcmp(name, ".") == 0) {
876 		NG_NODE_REF(here);
877 		return(here);
878 	}
879 
880 	/* Check for name-by-ID */
881 	if ((temp = ng_decodeidname(name)) != 0) {
882 		return (ng_ID2noderef(temp));
883 	}
884 
885 	/* Find node by name. */
886 	hash = hash32_str(name, HASHINIT) & ng_name_hmask;
887 	NAMEHASH_RLOCK();
888 	LIST_FOREACH(node, &ng_name_hash[hash], nd_nodes)
889 		if (NG_NODE_IS_VALID(node) &&
890 		    (strcmp(NG_NODE_NAME(node), name) == 0)) {
891 			NG_NODE_REF(node);
892 			break;
893 		}
894 	NAMEHASH_RUNLOCK();
895 
896 	return (node);
897 }
898 
899 /*
900  * Decode an ID name, eg. "[f03034de]". Returns 0 if the
901  * string is not valid, otherwise returns the value.
902  */
903 static ng_ID_t
904 ng_decodeidname(const char *name)
905 {
906 	const int len = strlen(name);
907 	char *eptr;
908 	u_long val;
909 
910 	/* Check for proper length, brackets, no leading junk */
911 	if ((len < 3)
912 	|| (name[0] != '[')
913 	|| (name[len - 1] != ']')
914 	|| (!isxdigit(name[1]))) {
915 		return ((ng_ID_t)0);
916 	}
917 
918 	/* Decode number */
919 	val = strtoul(name + 1, &eptr, 16);
920 	if ((eptr - name != len - 1)
921 	|| (val == ULONG_MAX)
922 	|| (val == 0)) {
923 		return ((ng_ID_t)0);
924 	}
925 	return (ng_ID_t)val;
926 }
927 
928 /*
929  * Remove a name from a node. This should only be called
930  * when shutting down and removing the node.
931  */
932 void
933 ng_unname(node_p node)
934 {
935 }
936 
937 /*
938  * Allocate a bigger name hash.
939  */
940 static void
941 ng_name_rehash(void)
942 {
943 	struct nodehash *new;
944 	uint32_t hash;
945 	u_long hmask;
946 	node_p node, node2;
947 	int i;
948 
949 	NAMEHASH_ASSERT_LOCKED();
950 	new = hashinit((ng_name_hmask + 1) * 2, M_NETGRAPH_NODE, &hmask);
951 	if (new == NULL)
952 		return;
953 
954 	for (i = 0; i <= ng_name_hmask; i++) {
955 		LIST_FOREACH_MUTABLE(node, &ng_name_hash[i], nd_nodes, node2) {
956 #ifdef INVARIANTS
957 			LIST_REMOVE(node, nd_nodes);
958 #endif
959 			hash = hash32_str(NG_NODE_NAME(node), HASHINIT) & hmask;
960 			LIST_INSERT_HEAD(&new[hash], node, nd_nodes);
961 		}
962 	}
963 
964 	hashdestroy(ng_name_hash, M_NETGRAPH_NODE, ng_name_hmask);
965 	ng_name_hash = new;
966 	ng_name_hmask = hmask;
967 }
968 
969 /*
970  * Allocate a bigger ID hash.
971  */
972 static void
973 ng_ID_rehash(void)
974 {
975 	struct nodehash *new;
976 	uint32_t hash;
977 	u_long hmask;
978 	node_p node, node2;
979 	int i;
980 
981 	IDHASH_ASSERT_LOCKED();
982 	new = hashinit((ng_ID_hmask + 1) * 2, M_NETGRAPH_NODE, &hmask);
983 	if (new == NULL)
984 		return;
985 
986 	for (i = 0; i <= ng_ID_hmask; i++) {
987 		LIST_FOREACH_MUTABLE(node, &ng_ID_hash[i], nd_idnodes, node2) {
988 #ifdef INVARIANTS
989 			LIST_REMOVE(node, nd_idnodes);
990 #endif
991 			hash = (node->nd_ID % (hmask + 1));
992 			LIST_INSERT_HEAD(&new[hash], node, nd_idnodes);
993 		}
994 	}
995 
996 	hashdestroy(ng_ID_hash, M_NETGRAPH_NODE, ng_name_hmask);
997 	ng_ID_hash = new;
998 	ng_ID_hmask = hmask;
999 }
1000 
1001 /************************************************************************
1002 			Hook routines
1003  Names are not optional. Hooks are always connected, except for a
1004  brief moment within these routines. On invalidation or during creation
1005  they are connected to the 'dead' hook.
1006 ************************************************************************/
1007 
1008 /*
1009  * Remove a hook reference
1010  */
1011 void
1012 ng_unref_hook(hook_p hook)
1013 {
1014 	int v;
1015 
1016 	if (hook == &ng_deadhook) {
1017 		return;
1018 	}
1019 
1020 	v = atomic_fetchadd_int(&hook->hk_refs, -1);
1021 
1022 	if (v == 1) { /* we were the last */
1023 		if (_NG_HOOK_NODE(hook)) /* it'll probably be ng_deadnode */
1024 			_NG_NODE_UNREF((_NG_HOOK_NODE(hook)));
1025 		NG_FREE_HOOK(hook);
1026 	}
1027 }
1028 
1029 /*
1030  * Add an unconnected hook to a node. Only used internally.
1031  * Assumes node is locked. (XXX not yet true )
1032  */
1033 static int
1034 ng_add_hook(node_p node, const char *name, hook_p *hookp)
1035 {
1036 	hook_p hook;
1037 	int error = 0;
1038 
1039 	/* Check that the given name is good */
1040 	if (name == NULL) {
1041 		TRAP_ERROR();
1042 		return (EINVAL);
1043 	}
1044 	if (ng_findhook(node, name) != NULL) {
1045 		TRAP_ERROR();
1046 		return (EEXIST);
1047 	}
1048 
1049 	/* Allocate the hook and link it up */
1050 	NG_ALLOC_HOOK(hook);
1051 	if (hook == NULL) {
1052 		TRAP_ERROR();
1053 		return (ENOMEM);
1054 	}
1055 	hook->hk_refs = 1;		/* add a reference for us to return */
1056 	hook->hk_flags = HK_INVALID;
1057 	hook->hk_peer = &ng_deadhook;	/* start off this way */
1058 	hook->hk_node = node;
1059 	NG_NODE_REF(node);		/* each hook counts as a reference */
1060 
1061 	/* Set hook name */
1062 	strlcpy(NG_HOOK_NAME(hook), name, NG_HOOKSIZ);
1063 
1064 	/*
1065 	 * Check if the node type code has something to say about it
1066 	 * If it fails, the unref of the hook will also unref the node.
1067 	 */
1068 	if (node->nd_type->newhook != NULL) {
1069 		if ((error = (*node->nd_type->newhook)(node, hook, name))) {
1070 			NG_HOOK_UNREF(hook);	/* this frees the hook */
1071 			return (error);
1072 		}
1073 	}
1074 	/*
1075 	 * The 'type' agrees so far, so go ahead and link it in.
1076 	 * We'll ask again later when we actually connect the hooks.
1077 	 */
1078 	LIST_INSERT_HEAD(&node->nd_hooks, hook, hk_hooks);
1079 	node->nd_numhooks++;
1080 	NG_HOOK_REF(hook);	/* one for the node */
1081 
1082 	if (hookp)
1083 		*hookp = hook;
1084 	return (0);
1085 }
1086 
1087 /*
1088  * Find a hook
1089  *
1090  * Node types may supply their own optimized routines for finding
1091  * hooks.  If none is supplied, we just do a linear search.
1092  * XXX Possibly we should add a reference to the hook?
1093  */
1094 hook_p
1095 ng_findhook(node_p node, const char *name)
1096 {
1097 	hook_p hook;
1098 
1099 	if (node->nd_type->findhook != NULL)
1100 		return (*node->nd_type->findhook)(node, name);
1101 	LIST_FOREACH(hook, &node->nd_hooks, hk_hooks) {
1102 		if (NG_HOOK_IS_VALID(hook)
1103 		&& (strcmp(NG_HOOK_NAME(hook), name) == 0))
1104 			return (hook);
1105 	}
1106 	return (NULL);
1107 }
1108 
1109 /*
1110  * Destroy a hook
1111  *
1112  * As hooks are always attached, this really destroys two hooks.
1113  * The one given, and the one attached to it. Disconnect the hooks
1114  * from each other first. We reconnect the peer hook to the 'dead'
1115  * hook so that it can still exist after we depart. We then
1116  * send the peer its own destroy message. This ensures that we only
1117  * interact with the peer's structures when it is locked processing that
1118  * message. We hold a reference to the peer hook so we are guaranteed that
1119  * the peer hook and node are still going to exist until
1120  * we are finished there as the hook holds a ref on the node.
1121  * We run this same code again on the peer hook, but that time it is already
1122  * attached to the 'dead' hook.
1123  *
1124  * This routine is called at all stages of hook creation
1125  * on error detection and must be able to handle any such stage.
1126  */
1127 void
1128 ng_destroy_hook(hook_p hook)
1129 {
1130 	hook_p peer;
1131 	node_p node;
1132 
1133 	if (hook == &ng_deadhook) {	/* better safe than sorry */
1134 		kprintf("ng_destroy_hook called on deadhook\n");
1135 		return;
1136 	}
1137 
1138 	/*
1139 	 * Protect divorce process with mutex, to avoid races on
1140 	 * simultaneous disconnect.
1141 	 */
1142 	TOPOLOGY_WLOCK();
1143 
1144 	hook->hk_flags |= HK_INVALID;
1145 
1146 	peer = NG_HOOK_PEER(hook);
1147 	node = NG_HOOK_NODE(hook);
1148 
1149 	if (peer && (peer != &ng_deadhook)) {
1150 		/*
1151 		 * Set the peer to point to ng_deadhook
1152 		 * from this moment on we are effectively independent it.
1153 		 * send it an rmhook message of it's own.
1154 		 */
1155 		peer->hk_peer = &ng_deadhook;	/* They no longer know us */
1156 		hook->hk_peer = &ng_deadhook;	/* Nor us, them */
1157 		if (NG_HOOK_NODE(peer) == &ng_deadnode) {
1158 			/*
1159 			 * If it's already divorced from a node,
1160 			 * just free it.
1161 			 */
1162 			TOPOLOGY_WUNLOCK();
1163 		} else {
1164 			TOPOLOGY_WUNLOCK();
1165 			ng_rmhook_self(peer); 	/* Send it a surprise */
1166 		}
1167 		NG_HOOK_UNREF(peer);		/* account for peer link */
1168 		NG_HOOK_UNREF(hook);		/* account for peer link */
1169 	} else
1170 		TOPOLOGY_WUNLOCK();
1171 
1172 	TOPOLOGY_NOTOWNED();
1173 
1174 	/*
1175 	 * Remove the hook from the node's list to avoid possible recursion
1176 	 * in case the disconnection results in node shutdown.
1177 	 */
1178 	if (node == &ng_deadnode) { /* happens if called from ng_con_nodes() */
1179 		return;
1180 	}
1181 	LIST_REMOVE(hook, hk_hooks);
1182 	node->nd_numhooks--;
1183 	if (node->nd_type->disconnect) {
1184 		/*
1185 		 * The type handler may elect to destroy the node so don't
1186 		 * trust its existence after this point. (except
1187 		 * that we still hold a reference on it. (which we
1188 		 * inherrited from the hook we are destroying)
1189 		 */
1190 		(*node->nd_type->disconnect) (hook);
1191 	}
1192 
1193 	/*
1194 	 * Note that because we will point to ng_deadnode, the original node
1195 	 * is not decremented automatically so we do that manually.
1196 	 */
1197 	_NG_HOOK_NODE(hook) = &ng_deadnode;
1198 	NG_NODE_UNREF(node);	/* We no longer point to it so adjust count */
1199 	NG_HOOK_UNREF(hook);	/* Account for linkage (in list) to node */
1200 }
1201 
1202 /*
1203  * Take two hooks on a node and merge the connection so that the given node
1204  * is effectively bypassed.
1205  */
1206 int
1207 ng_bypass(hook_p hook1, hook_p hook2)
1208 {
1209 	if (hook1->hk_node != hook2->hk_node) {
1210 		TRAP_ERROR();
1211 		return (EINVAL);
1212 	}
1213 	hook1->hk_peer->hk_peer = hook2->hk_peer;
1214 	hook2->hk_peer->hk_peer = hook1->hk_peer;
1215 
1216 	hook1->hk_peer = &ng_deadhook;
1217 	hook2->hk_peer = &ng_deadhook;
1218 
1219 	NG_HOOK_UNREF(hook1);
1220 	NG_HOOK_UNREF(hook2);
1221 
1222 	/* XXX If we ever cache methods on hooks update them as well */
1223 	ng_destroy_hook(hook1);
1224 	ng_destroy_hook(hook2);
1225 	return (0);
1226 }
1227 
1228 /*
1229  * Install a new netgraph type
1230  */
1231 int
1232 ng_newtype(struct ng_type *tp)
1233 {
1234 	const size_t namelen = strlen(tp->name);
1235 
1236 	/* Check version and type name fields */
1237 	if ((tp->version != NG_ABI_VERSION)
1238 	|| (namelen == 0)
1239 	|| (namelen >= NG_TYPESIZ)) {
1240 		TRAP_ERROR();
1241 		if (tp->version != NG_ABI_VERSION) {
1242 			kprintf("Netgraph: Node type rejected. ABI mismatch. Suggest recompile\n");
1243 		}
1244 		return (EINVAL);
1245 	}
1246 
1247 	/* Check for name collision */
1248 	if (ng_findtype(tp->name) != NULL) {
1249 		TRAP_ERROR();
1250 		return (EEXIST);
1251 	}
1252 
1253 	/* Link in new type */
1254 	TYPELIST_WLOCK();
1255 	LIST_INSERT_HEAD(&ng_typelist, tp, types);
1256 	tp->refs = 1;	/* first ref is linked list */
1257 	TYPELIST_WUNLOCK();
1258 	return (0);
1259 }
1260 
1261 /*
1262  * unlink a netgraph type
1263  * If no examples exist
1264  */
1265 int
1266 ng_rmtype(struct ng_type *tp)
1267 {
1268 	/* Check for name collision */
1269 	if (tp->refs != 1) {
1270 		TRAP_ERROR();
1271 		return (EBUSY);
1272 	}
1273 
1274 	/* Unlink type */
1275 	TYPELIST_WLOCK();
1276 	LIST_REMOVE(tp, types);
1277 	TYPELIST_WUNLOCK();
1278 	return (0);
1279 }
1280 
1281 /*
1282  * Look for a type of the name given
1283  */
1284 struct ng_type *
1285 ng_findtype(const char *typename)
1286 {
1287 	struct ng_type *type;
1288 
1289 	TYPELIST_RLOCK();
1290 	LIST_FOREACH(type, &ng_typelist, types) {
1291 		if (strcmp(type->name, typename) == 0)
1292 			break;
1293 	}
1294 	TYPELIST_RUNLOCK();
1295 	return (type);
1296 }
1297 
1298 /************************************************************************
1299 			Composite routines
1300 ************************************************************************/
1301 /*
1302  * Connect two nodes using the specified hooks, using queued functions.
1303  */
1304 static int
1305 ng_con_part3(node_p node, item_p item, hook_p hook)
1306 {
1307 	int	error = 0;
1308 
1309 	/*
1310 	 * When we run, we know that the node 'node' is locked for us.
1311 	 * Our caller has a reference on the hook.
1312 	 * Our caller has a reference on the node.
1313 	 * (In this case our caller is ng_apply_item() ).
1314 	 * The peer hook has a reference on the hook.
1315 	 * We are all set up except for the final call to the node, and
1316 	 * the clearing of the INVALID flag.
1317 	 */
1318 	if (NG_HOOK_NODE(hook) == &ng_deadnode) {
1319 		/*
1320 		 * The node must have been freed again since we last visited
1321 		 * here. ng_destry_hook() has this effect but nothing else does.
1322 		 * We should just release our references and
1323 		 * free anything we can think of.
1324 		 * Since we know it's been destroyed, and it's our caller
1325 		 * that holds the references, just return.
1326 		 */
1327 		ERROUT(ENOENT);
1328 	}
1329 	if (hook->hk_node->nd_type->connect) {
1330 		if ((error = (*hook->hk_node->nd_type->connect) (hook))) {
1331 			ng_destroy_hook(hook);	/* also zaps peer */
1332 			kprintf("failed in ng_con_part3()\n");
1333 			ERROUT(error);
1334 		}
1335 	}
1336 	/*
1337 	 *  XXX this is wrong for SMP. Possibly we need
1338 	 * to separate out 'create' and 'invalid' flags.
1339 	 * should only set flags on hooks we have locked under our node.
1340 	 */
1341 	hook->hk_flags &= ~HK_INVALID;
1342 done:
1343 	NG_FREE_ITEM(item);
1344 	return (error);
1345 }
1346 
1347 static int
1348 ng_con_part2(node_p node, item_p item, hook_p hook)
1349 {
1350 	hook_p	peer;
1351 	int	error = 0;
1352 
1353 	/*
1354 	 * When we run, we know that the node 'node' is locked for us.
1355 	 * Our caller has a reference on the hook.
1356 	 * Our caller has a reference on the node.
1357 	 * (In this case our caller is ng_apply_item() ).
1358 	 * The peer hook has a reference on the hook.
1359 	 * our node pointer points to the 'dead' node.
1360 	 * First check the hook name is unique.
1361 	 * Should not happen because we checked before queueing this.
1362 	 */
1363 	if (ng_findhook(node, NG_HOOK_NAME(hook)) != NULL) {
1364 		TRAP_ERROR();
1365 		ng_destroy_hook(hook); /* should destroy peer too */
1366 		kprintf("failed in ng_con_part2()\n");
1367 		ERROUT(EEXIST);
1368 	}
1369 	/*
1370 	 * Check if the node type code has something to say about it
1371 	 * If it fails, the unref of the hook will also unref the attached node,
1372 	 * however since that node is 'ng_deadnode' this will do nothing.
1373 	 * The peer hook will also be destroyed.
1374 	 */
1375 	if (node->nd_type->newhook != NULL) {
1376 		if ((error = (*node->nd_type->newhook)(node, hook,
1377 		    hook->hk_name))) {
1378 			ng_destroy_hook(hook); /* should destroy peer too */
1379 			kprintf("failed in ng_con_part2()\n");
1380 			ERROUT(error);
1381 		}
1382 	}
1383 
1384 	/*
1385 	 * The 'type' agrees so far, so go ahead and link it in.
1386 	 * We'll ask again later when we actually connect the hooks.
1387 	 */
1388 	hook->hk_node = node;		/* just overwrite ng_deadnode */
1389 	NG_NODE_REF(node);		/* each hook counts as a reference */
1390 	LIST_INSERT_HEAD(&node->nd_hooks, hook, hk_hooks);
1391 	node->nd_numhooks++;
1392 	NG_HOOK_REF(hook);	/* one for the node */
1393 
1394 	/*
1395 	 * We now have a symmetrical situation, where both hooks have been
1396 	 * linked to their nodes, the newhook methods have been called
1397 	 * And the references are all correct. The hooks are still marked
1398 	 * as invalid, as we have not called the 'connect' methods
1399 	 * yet.
1400 	 * We can call the local one immediately as we have the
1401 	 * node locked, but we need to queue the remote one.
1402 	 */
1403 	if (hook->hk_node->nd_type->connect) {
1404 		if ((error = (*hook->hk_node->nd_type->connect) (hook))) {
1405 			ng_destroy_hook(hook);	/* also zaps peer */
1406 			kprintf("failed in ng_con_part2(A)\n");
1407 			ERROUT(error);
1408 		}
1409 	}
1410 
1411 	/*
1412 	 * Acquire topo token to avoid race with ng_destroy_hook().
1413 	 */
1414 	TOPOLOGY_RLOCK();
1415 	peer = hook->hk_peer;
1416 	if (peer == &ng_deadhook) {
1417 		TOPOLOGY_RUNLOCK();
1418 		kprintf("failed in ng_con_part2(B)\n");
1419 		ng_destroy_hook(hook);
1420 		ERROUT(ENOENT);
1421 	}
1422 	TOPOLOGY_RUNLOCK();
1423 
1424 	if ((error = ng_send_fn2(peer->hk_node, peer, item, &ng_con_part3,
1425 	    NULL, 0, NG_REUSE_ITEM))) {
1426 		kprintf("failed in ng_con_part2(C)\n");
1427 		ng_destroy_hook(hook);	/* also zaps peer */
1428 		return (error);		/* item was consumed. */
1429 	}
1430 	hook->hk_flags &= ~HK_INVALID; /* need both to be able to work */
1431 	return (0);			/* item was consumed. */
1432 done:
1433 	NG_FREE_ITEM(item);
1434 	return (error);
1435 }
1436 
1437 /*
1438  * Connect this node with another node. We assume that this node is
1439  * currently locked, as we are only called from an NGM_CONNECT message.
1440  */
1441 static int
1442 ng_con_nodes(item_p item, node_p node, const char *name,
1443     node_p node2, const char *name2)
1444 {
1445 	int	error;
1446 	hook_p	hook;
1447 	hook_p	hook2;
1448 
1449 	if (ng_findhook(node2, name2) != NULL) {
1450 		return(EEXIST);
1451 	}
1452 	if ((error = ng_add_hook(node, name, &hook)))  /* gives us a ref */
1453 		return (error);
1454 	/* Allocate the other hook and link it up */
1455 	NG_ALLOC_HOOK(hook2);
1456 	if (hook2 == NULL) {
1457 		TRAP_ERROR();
1458 		ng_destroy_hook(hook);	/* XXX check ref counts so far */
1459 		NG_HOOK_UNREF(hook);	/* including our ref */
1460 		return (ENOMEM);
1461 	}
1462 	hook2->hk_refs = 1;		/* start with a reference for us. */
1463 	hook2->hk_flags = HK_INVALID;
1464 	hook2->hk_peer = hook;		/* Link the two together */
1465 	hook->hk_peer = hook2;
1466 	NG_HOOK_REF(hook);		/* Add a ref for the peer to each*/
1467 	NG_HOOK_REF(hook2);
1468 	hook2->hk_node = &ng_deadnode;
1469 	strlcpy(NG_HOOK_NAME(hook2), name2, NG_HOOKSIZ);
1470 
1471 	/*
1472 	 * Queue the function above.
1473 	 * Procesing continues in that function in the lock context of
1474 	 * the other node.
1475 	 */
1476 	if ((error = ng_send_fn2(node2, hook2, item, &ng_con_part2, NULL, 0,
1477 	    NG_NOFLAGS))) {
1478 		kprintf("failed in ng_con_nodes(): %d\n", error);
1479 		ng_destroy_hook(hook);	/* also zaps peer */
1480 	}
1481 
1482 	NG_HOOK_UNREF(hook);		/* Let each hook go if it wants to */
1483 	NG_HOOK_UNREF(hook2);
1484 	return (error);
1485 }
1486 
1487 /*
1488  * Make a peer and connect.
1489  * We assume that the local node is locked.
1490  * The new node probably doesn't need a lock until
1491  * it has a hook, because it cannot really have any work until then,
1492  * but we should think about it a bit more.
1493  *
1494  * The problem may come if the other node also fires up
1495  * some hardware or a timer or some other source of activation,
1496  * also it may already get a command msg via it's ID.
1497  *
1498  * We could use the same method as ng_con_nodes() but we'd have
1499  * to add ability to remove the node when failing. (Not hard, just
1500  * make arg1 point to the node to remove).
1501  * Unless of course we just ignore failure to connect and leave
1502  * an unconnected node?
1503  */
1504 static int
1505 ng_mkpeer(node_p node, const char *name, const char *name2, char *type)
1506 {
1507 	node_p	node2;
1508 	hook_p	hook1, hook2;
1509 	int	error;
1510 
1511 	if ((error = ng_make_node(type, &node2))) {
1512 		return (error);
1513 	}
1514 
1515 	if ((error = ng_add_hook(node, name, &hook1))) { /* gives us a ref */
1516 		ng_rmnode(node2, NULL, NULL, 0);
1517 		return (error);
1518 	}
1519 
1520 	if ((error = ng_add_hook(node2, name2, &hook2))) {
1521 		ng_rmnode(node2, NULL, NULL, 0);
1522 		ng_destroy_hook(hook1);
1523 		NG_HOOK_UNREF(hook1);
1524 		return (error);
1525 	}
1526 
1527 	/*
1528 	 * Actually link the two hooks together.
1529 	 */
1530 	hook1->hk_peer = hook2;
1531 	hook2->hk_peer = hook1;
1532 
1533 	/* Each hook is referenced by the other */
1534 	NG_HOOK_REF(hook1);
1535 	NG_HOOK_REF(hook2);
1536 
1537 	/* Give each node the opportunity to veto the pending connection */
1538 	if (hook1->hk_node->nd_type->connect) {
1539 		error = (*hook1->hk_node->nd_type->connect) (hook1);
1540 	}
1541 
1542 	if ((error == 0) && hook2->hk_node->nd_type->connect) {
1543 		error = (*hook2->hk_node->nd_type->connect) (hook2);
1544 
1545 	}
1546 
1547 	/*
1548 	 * drop the references we were holding on the two hooks.
1549 	 */
1550 	if (error) {
1551 		ng_destroy_hook(hook2);	/* also zaps hook1 */
1552 		ng_rmnode(node2, NULL, NULL, 0);
1553 	} else {
1554 		/* As a last act, allow the hooks to be used */
1555 		hook1->hk_flags &= ~HK_INVALID;
1556 		hook2->hk_flags &= ~HK_INVALID;
1557 	}
1558 	NG_HOOK_UNREF(hook1);
1559 	NG_HOOK_UNREF(hook2);
1560 	return (error);
1561 }
1562 
1563 /************************************************************************
1564 		Utility routines to send self messages
1565 ************************************************************************/
1566 
1567 /* Shut this node down as soon as everyone is clear of it */
1568 /* Should add arg "immediately" to jump the queue */
1569 int
1570 ng_rmnode_self(node_p node)
1571 {
1572 	int		error;
1573 
1574 	if (node == &ng_deadnode)
1575 		return (0);
1576 	node->nd_flags |= NGF_INVALID;
1577 	if (node->nd_flags & NGF_CLOSING)
1578 		return (0);
1579 
1580 	error = ng_send_fn(node, NULL, &ng_rmnode, NULL, 0);
1581 	return (error);
1582 }
1583 
1584 static void
1585 ng_rmhook_part2(node_p node, hook_p hook, void *arg1, int arg2)
1586 {
1587 	ng_destroy_hook(hook);
1588 	return ;
1589 }
1590 
1591 int
1592 ng_rmhook_self(hook_p hook)
1593 {
1594 	int		error;
1595 	node_p node = NG_HOOK_NODE(hook);
1596 
1597 	if (node == &ng_deadnode)
1598 		return (0);
1599 
1600 	error = ng_send_fn(node, hook, &ng_rmhook_part2, NULL, 0);
1601 	return (error);
1602 }
1603 
1604 /***********************************************************************
1605  * Parse and verify a string of the form:  <NODE:><PATH>
1606  *
1607  * Such a string can refer to a specific node or a specific hook
1608  * on a specific node, depending on how you look at it. In the
1609  * latter case, the PATH component must not end in a dot.
1610  *
1611  * Both <NODE:> and <PATH> are optional. The <PATH> is a string
1612  * of hook names separated by dots. This breaks out the original
1613  * string, setting *nodep to "NODE" (or NULL if none) and *pathp
1614  * to "PATH" (or NULL if degenerate). Also, *hookp will point to
1615  * the final hook component of <PATH>, if any, otherwise NULL.
1616  *
1617  * This returns -1 if the path is malformed. The char ** are optional.
1618  ***********************************************************************/
1619 int
1620 ng_path_parse(char *addr, char **nodep, char **pathp, char **hookp)
1621 {
1622 	char	*node, *path, *hook;
1623 	int	k;
1624 
1625 	/*
1626 	 * Extract absolute NODE, if any
1627 	 */
1628 	for (path = addr; *path && *path != ':'; path++);
1629 	if (*path) {
1630 		node = addr;	/* Here's the NODE */
1631 		*path++ = '\0';	/* Here's the PATH */
1632 
1633 		/* Node name must not be empty */
1634 		if (!*node)
1635 			return -1;
1636 
1637 		/* A name of "." is OK; otherwise '.' not allowed */
1638 		if (strcmp(node, ".") != 0) {
1639 			for (k = 0; node[k]; k++)
1640 				if (node[k] == '.')
1641 					return -1;
1642 		}
1643 	} else {
1644 		node = NULL;	/* No absolute NODE */
1645 		path = addr;	/* Here's the PATH */
1646 	}
1647 
1648 	/* Snoop for illegal characters in PATH */
1649 	for (k = 0; path[k]; k++)
1650 		if (path[k] == ':')
1651 			return -1;
1652 
1653 	/* Check for no repeated dots in PATH */
1654 	for (k = 0; path[k]; k++)
1655 		if (path[k] == '.' && path[k + 1] == '.')
1656 			return -1;
1657 
1658 	/* Remove extra (degenerate) dots from beginning or end of PATH */
1659 	if (path[0] == '.')
1660 		path++;
1661 	if (*path && path[strlen(path) - 1] == '.')
1662 		path[strlen(path) - 1] = 0;
1663 
1664 	/* If PATH has a dot, then we're not talking about a hook */
1665 	if (*path) {
1666 		for (hook = path, k = 0; path[k]; k++)
1667 			if (path[k] == '.') {
1668 				hook = NULL;
1669 				break;
1670 			}
1671 	} else
1672 		path = hook = NULL;
1673 
1674 	/* Done */
1675 	if (nodep)
1676 		*nodep = node;
1677 	if (pathp)
1678 		*pathp = path;
1679 	if (hookp)
1680 		*hookp = hook;
1681 	return (0);
1682 }
1683 
1684 /*
1685  * Given a path, which may be absolute or relative, and a starting node,
1686  * return the destination node.
1687  */
1688 int
1689 ng_path2noderef(node_p here, const char *address,
1690 				node_p *destp, hook_p *lasthook)
1691 {
1692 	char    fullpath[NG_PATHSIZ];
1693 	char   *nodename, *path, pbuf[2];
1694 	node_p  node, oldnode;
1695 	char   *cp;
1696 	hook_p hook = NULL;
1697 
1698 	/* Initialize */
1699 	if (destp == NULL) {
1700 		TRAP_ERROR();
1701 		return EINVAL;
1702 	}
1703 	*destp = NULL;
1704 
1705 	/* Make a writable copy of address for ng_path_parse() */
1706 	strncpy(fullpath, address, sizeof(fullpath) - 1);
1707 	fullpath[sizeof(fullpath) - 1] = '\0';
1708 
1709 	/* Parse out node and sequence of hooks */
1710 	if (ng_path_parse(fullpath, &nodename, &path, NULL) < 0) {
1711 		TRAP_ERROR();
1712 		return EINVAL;
1713 	}
1714 	if (path == NULL) {
1715 		pbuf[0] = '.';	/* Needs to be writable */
1716 		pbuf[1] = '\0';
1717 		path = pbuf;
1718 	}
1719 
1720 	/*
1721 	 * For an absolute address, jump to the starting node.
1722 	 * Note that this holds a reference on the node for us.
1723 	 * Don't forget to drop the reference if we don't need it.
1724 	 */
1725 	if (nodename) {
1726 		node = ng_name2noderef(here, nodename);
1727 		if (node == NULL) {
1728 			TRAP_ERROR();
1729 			return (ENOENT);
1730 		}
1731 	} else {
1732 		if (here == NULL) {
1733 			TRAP_ERROR();
1734 			return (EINVAL);
1735 		}
1736 		node = here;
1737 		NG_NODE_REF(node);
1738 	}
1739 
1740 	/*
1741 	 * Now follow the sequence of hooks
1742 	 * XXX
1743 	 * We actually cannot guarantee that the sequence
1744 	 * is not being demolished as we crawl along it
1745 	 * without extra-ordinary locking etc.
1746 	 * So this is a bit dodgy to say the least.
1747 	 * We can probably hold up some things by holding
1748 	 * the nodelist mutex for the time of this
1749 	 * crawl if we wanted.. At least that way we wouldn't have to
1750 	 * worry about the nodes disappearing, but the hooks would still
1751 	 * be a problem.
1752 	 */
1753 	for (cp = path; node != NULL && *cp != '\0'; ) {
1754 		char *segment;
1755 
1756 		/*
1757 		 * Break out the next path segment. Replace the dot we just
1758 		 * found with a NUL; "cp" points to the next segment (or the
1759 		 * NUL at the end).
1760 		 */
1761 		for (segment = cp; *cp != '\0'; cp++) {
1762 			if (*cp == '.') {
1763 				*cp++ = '\0';
1764 				break;
1765 			}
1766 		}
1767 
1768 		/* Empty segment */
1769 		if (*segment == '\0')
1770 			continue;
1771 
1772 		/* We have a segment, so look for a hook by that name */
1773 		hook = ng_findhook(node, segment);
1774 
1775 		/* Can't get there from here... */
1776 		if (hook == NULL
1777 		    || NG_HOOK_PEER(hook) == NULL
1778 		    || NG_HOOK_NOT_VALID(hook)
1779 		    || NG_HOOK_NOT_VALID(NG_HOOK_PEER(hook))) {
1780 			TRAP_ERROR();
1781 			NG_NODE_UNREF(node);
1782 #if 0
1783 			kprintf("hooknotvalid %s %s %d %d %d %d ",
1784 					path,
1785 					segment,
1786 					hook == NULL,
1787 					NG_HOOK_PEER(hook) == NULL,
1788 					NG_HOOK_NOT_VALID(hook),
1789 					NG_HOOK_NOT_VALID(NG_HOOK_PEER(hook)));
1790 #endif
1791 			return (ENOENT);
1792 		}
1793 
1794 		/*
1795 		 * Hop on over to the next node
1796 		 * XXX
1797 		 * Big race conditions here as hooks and nodes go away
1798 		 * *** Idea.. store an ng_ID_t in each hook and use that
1799 		 * instead of the direct hook in this crawl?
1800 		 */
1801 		oldnode = node;
1802 		if ((node = NG_PEER_NODE(hook)))
1803 			NG_NODE_REF(node);	/* XXX RACE */
1804 		NG_NODE_UNREF(oldnode);	/* XXX another race */
1805 		if (NG_NODE_NOT_VALID(node)) {
1806 			NG_NODE_UNREF(node);	/* XXX more races */
1807 			node = NULL;
1808 		}
1809 	}
1810 
1811 	/* If node somehow missing, fail here (probably this is not needed) */
1812 	if (node == NULL) {
1813 		TRAP_ERROR();
1814 		return (ENXIO);
1815 	}
1816 
1817 	/* Done */
1818 	*destp = node;
1819 	if (lasthook != NULL)
1820 		*lasthook = (hook ? NG_HOOK_PEER(hook) : NULL);
1821 	return (0);
1822 }
1823 
1824 /*********************************************************************\
1825 * Inter-CPU node synchronization
1826 *
1827 * All activities are submitted to one of the netgraph per-CPU threads.
1828 * There is one item input queue per CPU, not one per node as in
1829 * FreeBSD.  If the item is entering netgraph for the first time, it is
1830 * queued to the thread's msgport.  Otherwise it is applied directly.
1831 * From start to finish, the item is processed on the same CPU.  Items
1832 * are distributed based on the ingress node, to keep item ordering.
1833 \***************************************************************/
1834 
1835 static __inline void	ng_acquire_read(node_p node);
1836 static __inline void	ng_acquire_write(node_p node);
1837 static __inline void	ng_leave_readwrite(node_p node);
1838 
1839 static __inline void
1840 ng_acquire_read(node_p node)
1841 {
1842 	KASSERT(node != &ng_deadnode,
1843 	    ("%s: working on deadnode", __func__));
1844 
1845 	lwkt_gettoken_shared(&node->nd_token);
1846 }
1847 
1848 /* Acquire writer lock on node. If node is busy, sleep. */
1849 static __inline void
1850 ng_acquire_write(node_p node)
1851 {
1852 	KASSERT(node != &ng_deadnode,
1853 	    ("%s: working on deadnode", __func__));
1854 
1855 	lwkt_gettoken(&node->nd_token);
1856 }
1857 
1858 /* Release reader or writer lock. */
1859 static __inline void
1860 ng_leave_readwrite(node_p node)
1861 {
1862 	lwkt_reltoken(&node->nd_token);
1863 }
1864 
1865 /***********************************************************************
1866 * Worklist routines
1867 **********************************************************************/
1868 /* NETGRAPH thread routine
1869  *
1870  * Pick an item from our thread's queue and apply it.
1871  */
1872 static void
1873 ngthread(void *dummy __unused)
1874 {
1875 	lwkt_msg_t msg;
1876 
1877 	while ((msg = lwkt_waitport(&curthread->td_msgport, 0)) != NULL) {
1878 		item_p  item = (void *)msg;
1879 
1880 		ng_apply_item(item);
1881 		/* Do not reply to the message */
1882 	}
1883 }
1884 
1885 /***********************************************************************
1886 * Externally visible method for sending or queueing messages or data.
1887 ***********************************************************************/
1888 
1889 /*
1890  * The module code should have filled out the item correctly by this stage:
1891  * Common:
1892  *    reference to destination node.
1893  *    Reference to destination rcv hook if relevant.
1894  *    apply pointer must be or NULL or reference valid struct ng_apply_info.
1895  * Data:
1896  *    pointer to mbuf
1897  * Control_Message:
1898  *    pointer to msg.
1899  *    ID of original sender node. (return address)
1900  * Function:
1901  *    Function pointer
1902  *    void * argument
1903  *    integer argument
1904  *
1905  * The nodes have several routines and macros to help with this task:
1906  */
1907 
1908 int
1909 ng_snd_item(item_p item, int flags)
1910 {
1911 	hook_p hook;
1912 	node_p node;
1913 	int error = 0;
1914 
1915 	/* We are sending item, so it must be present! */
1916 	KASSERT(item != NULL, ("ng_snd_item: item is NULL"));
1917 
1918 #ifdef	NETGRAPH_DEBUG
1919 	_ngi_check(item, __FILE__, __LINE__);
1920 #endif
1921 
1922 	/*
1923 	 * Every time an item is sent or forwarded we hold a reference on it
1924 	 * to postone the callback (if there is one) and item freedom.
1925 	 */
1926 	ng_ref_item(item);
1927 
1928 	/*
1929 	 * Node is never optional.
1930 	 */
1931 	node = NGI_NODE(item);
1932 	KASSERT(node != NULL, ("ng_snd_item: node is NULL"));
1933 
1934 	/*
1935 	 * Valid hook and mbuf are mandatory for data.
1936 	 */
1937 	hook = NGI_HOOK(item);
1938 	if ((item->el_flags & NGQF_TYPE) == NGQF_DATA) {
1939 		KASSERT(hook != NULL, ("ng_snd_item: hook for data is NULL"));
1940 		if (NGI_M(item) == NULL)
1941 			ERROUT(EINVAL);
1942 		CHECK_DATA_MBUF(NGI_M(item));
1943 	}
1944 
1945 	/*
1946 	 * Always queue items entering netgraph for the first time.
1947 	 */
1948 	if (item->refs == 1) {
1949 		struct lwkt_msg *msg = &item->el_lmsg;
1950 
1951 		lwkt_initmsg(msg, &ng_panic_reply_port, 0);
1952 		/* Always send to cpu0 for now */
1953 		lwkt_sendmsg(ng_cpuport(0), msg);
1954 
1955 		return ((flags & NG_PROGRESS) ? EINPROGRESS : 0);
1956 	}
1957 
1958 	/*
1959 	 * The item wasn't queued.  Process it synchronously.
1960 	 */
1961 	error = ng_apply_item(item);
1962 
1963 done:
1964 	return (error);
1965 }
1966 
1967 /*
1968  * We have an item that was possibly queued somewhere.
1969  * It should contain all the information needed
1970  * to run it on the appropriate node/hook.
1971  * If there is apply pointer and we own the last reference, call apply().
1972  */
1973 static int
1974 ng_apply_item(item_p item)
1975 {
1976 	hook_p  hook;
1977 	node_p	node;
1978 	ng_rcvdata_t *rcvdata;
1979 	ng_rcvmsg_t *rcvmsg;
1980 	int	error = 0;
1981 
1982 	/* Node and item are never optional. */
1983 	KASSERT(item != NULL, ("ng_apply_item: item is NULL"));
1984 	NGI_GET_NODE(item, node);		/* zaps stored node */
1985 	KASSERT(node != NULL, ("ng_apply_item: node is NULL"));
1986 	NGI_GET_HOOK(item, hook);		/* clears stored hook */
1987 
1988 	/*
1989 	 * If the item or the node specifies single threading, force
1990 	 * writer semantics. Similarly, the node may say one hook always
1991 	 * produces writers. These are overrides.
1992 	 */
1993 	if (((item->el_flags & NGQF_RW) == NGQF_WRITER) ||
1994 	    (node->nd_flags & NGF_FORCE_WRITER) ||
1995 	    (hook && (hook->hk_flags & HK_FORCE_WRITER))) {
1996 		ng_acquire_write(node);
1997 	} else {
1998 		ng_acquire_read(node);
1999 	}
2000 
2001 #ifdef	NETGRAPH_DEBUG
2002 	_ngi_check(item, __FILE__, __LINE__);
2003 #endif
2004 
2005 	switch (item->el_flags & NGQF_TYPE) {
2006 	case NGQF_DATA:
2007 		/*
2008 		 * Check things are still ok as when we were queued.
2009 		 */
2010 		KASSERT(hook != NULL, ("ng_apply_item: hook for data is NULL"));
2011 		if (NG_HOOK_NOT_VALID(hook) ||
2012 		    NG_NODE_NOT_VALID(node)) {
2013 			error = EIO;
2014 			NG_FREE_ITEM(item);
2015 			break;
2016 		}
2017 		/*
2018 		 * If no receive method, just silently drop it.
2019 		 * Give preference to the hook over-ride method
2020 		 */
2021 		if ((!(rcvdata = hook->hk_rcvdata))
2022 		&& (!(rcvdata = NG_HOOK_NODE(hook)->nd_type->rcvdata))) {
2023 			error = 0;
2024 			NG_FREE_ITEM(item);
2025 			break;
2026 		}
2027 		error = (*rcvdata)(hook, item);
2028 		break;
2029 	case NGQF_MESG:
2030 		if (hook && NG_HOOK_NOT_VALID(hook)) {
2031 			/*
2032 			 * The hook has been zapped then we can't use it.
2033 			 * Immediately drop its reference.
2034 			 * The message may not need it.
2035 			 */
2036 			NG_HOOK_UNREF(hook);
2037 			hook = NULL;
2038 		}
2039 		/*
2040 		 * Similarly, if the node is a zombie there is
2041 		 * nothing we can do with it, drop everything.
2042 		 */
2043 		if (NG_NODE_NOT_VALID(node)) {
2044 			TRAP_ERROR();
2045 			error = EINVAL;
2046 			NG_FREE_ITEM(item);
2047 			break;
2048 		}
2049 		/*
2050 		 * Call the appropriate message handler for the object.
2051 		 * It is up to the message handler to free the message.
2052 		 * If it's a generic message, handle it generically,
2053 		 * otherwise call the type's message handler (if it exists).
2054 		 * XXX (race). Remember that a queued message may
2055 		 * reference a node or hook that has just been
2056 		 * invalidated. It will exist as the queue code
2057 		 * is holding a reference, but..
2058 		 */
2059 		if ((NGI_MSG(item)->header.typecookie == NGM_GENERIC_COOKIE) &&
2060 		    ((NGI_MSG(item)->header.flags & NGF_RESP) == 0)) {
2061 			error = ng_generic_msg(node, item, hook);
2062 			break;
2063 		}
2064 		if (((!hook) || (!(rcvmsg = hook->hk_rcvmsg))) &&
2065 		    (!(rcvmsg = node->nd_type->rcvmsg))) {
2066 			TRAP_ERROR();
2067 			error = 0;
2068 			NG_FREE_ITEM(item);
2069 			break;
2070 		}
2071 		error = (*rcvmsg)(node, item, hook);
2072 		break;
2073 	case NGQF_FN:
2074 	case NGQF_FN2:
2075 		/*
2076 		 *  We have to implicitly trust the hook,
2077 		 * as some of these are used for system purposes
2078 		 * where the hook is invalid. In the case of
2079 		 * the shutdown message we allow it to hit
2080 		 * even if the node is invalid.
2081 		 */
2082 		if ((NG_NODE_NOT_VALID(node))
2083 		&& (NGI_FN(item) != &ng_rmnode)) {
2084 			TRAP_ERROR();
2085 			error = EINVAL;
2086 			NG_FREE_ITEM(item);
2087 			break;
2088 		}
2089 		if ((item->el_flags & NGQF_TYPE) == NGQF_FN) {
2090 			(*NGI_FN(item))(node, hook, NGI_ARG1(item),
2091 			    NGI_ARG2(item));
2092 			NG_FREE_ITEM(item);
2093 		} else	/* it is NGQF_FN2 */
2094 			error = (*NGI_FN2(item))(node, item, hook);
2095 		break;
2096 	}
2097 	/*
2098 	 * We held references on some of the resources
2099 	 * that we took from the item. Now that we have
2100 	 * finished doing everything, drop those references.
2101 	 */
2102 	if (hook)
2103 		NG_HOOK_UNREF(hook);
2104 
2105 	/* Release our node's token */
2106 	ng_leave_readwrite(node);
2107 
2108 	/* Free the item if we own the last reference to it. */
2109 	ng_unref_item(item, error);
2110 
2111 	NG_NODE_UNREF(node);
2112 
2113 	return (error);
2114 }
2115 
2116 /***********************************************************************
2117  * Implement the 'generic' control messages
2118  ***********************************************************************/
2119 static int
2120 ng_generic_msg(node_p here, item_p item, hook_p lasthook)
2121 {
2122 	int error = 0;
2123 	struct ng_mesg *msg;
2124 	struct ng_mesg *resp = NULL;
2125 
2126 	NGI_GET_MSG(item, msg);
2127 	if (msg->header.typecookie != NGM_GENERIC_COOKIE) {
2128 		TRAP_ERROR();
2129 		error = EINVAL;
2130 		goto out;
2131 	}
2132 	switch (msg->header.cmd) {
2133 	case NGM_SHUTDOWN:
2134 		ng_rmnode(here, NULL, NULL, 0);
2135 		break;
2136 	case NGM_MKPEER:
2137 	    {
2138 		struct ngm_mkpeer *const mkp = (struct ngm_mkpeer *) msg->data;
2139 
2140 		if (msg->header.arglen != sizeof(*mkp)) {
2141 			TRAP_ERROR();
2142 			error = EINVAL;
2143 			break;
2144 		}
2145 		mkp->type[sizeof(mkp->type) - 1] = '\0';
2146 		mkp->ourhook[sizeof(mkp->ourhook) - 1] = '\0';
2147 		mkp->peerhook[sizeof(mkp->peerhook) - 1] = '\0';
2148 		error = ng_mkpeer(here, mkp->ourhook, mkp->peerhook, mkp->type);
2149 		break;
2150 	    }
2151 	case NGM_CONNECT:
2152 	    {
2153 		struct ngm_connect *const con =
2154 			(struct ngm_connect *) msg->data;
2155 		node_p node2;
2156 
2157 		if (msg->header.arglen != sizeof(*con)) {
2158 			TRAP_ERROR();
2159 			error = EINVAL;
2160 			break;
2161 		}
2162 		con->path[sizeof(con->path) - 1] = '\0';
2163 		con->ourhook[sizeof(con->ourhook) - 1] = '\0';
2164 		con->peerhook[sizeof(con->peerhook) - 1] = '\0';
2165 		/* Don't forget we get a reference.. */
2166 		error = ng_path2noderef(here, con->path, &node2, NULL);
2167 		if (error)
2168 			break;
2169 		error = ng_con_nodes(item, here, con->ourhook,
2170 		    node2, con->peerhook);
2171 		NG_NODE_UNREF(node2);
2172 		break;
2173 	    }
2174 	case NGM_NAME:
2175 	    {
2176 		struct ngm_name *const nam = (struct ngm_name *) msg->data;
2177 
2178 		if (msg->header.arglen != sizeof(*nam)) {
2179 			TRAP_ERROR();
2180 			error = EINVAL;
2181 			break;
2182 		}
2183 		nam->name[sizeof(nam->name) - 1] = '\0';
2184 		error = ng_name_node(here, nam->name);
2185 		break;
2186 	    }
2187 	case NGM_RMHOOK:
2188 	    {
2189 		struct ngm_rmhook *const rmh = (struct ngm_rmhook *) msg->data;
2190 		hook_p hook;
2191 
2192 		if (msg->header.arglen != sizeof(*rmh)) {
2193 			TRAP_ERROR();
2194 			error = EINVAL;
2195 			break;
2196 		}
2197 		rmh->ourhook[sizeof(rmh->ourhook) - 1] = '\0';
2198 		if ((hook = ng_findhook(here, rmh->ourhook)) != NULL)
2199 			ng_destroy_hook(hook);
2200 		break;
2201 	    }
2202 	case NGM_NODEINFO:
2203 	    {
2204 		struct nodeinfo *ni;
2205 
2206 		NG_MKRESPONSE(resp, msg, sizeof(*ni), M_WAITOK | M_NULLOK);
2207 		if (resp == NULL) {
2208 			error = ENOMEM;
2209 			break;
2210 		}
2211 
2212 		/* Fill in node info */
2213 		ni = (struct nodeinfo *) resp->data;
2214 		if (NG_NODE_HAS_NAME(here))
2215 			strcpy(ni->name, NG_NODE_NAME(here));
2216 		strcpy(ni->type, here->nd_type->name);
2217 		ni->id = ng_node2ID(here);
2218 		ni->hooks = here->nd_numhooks;
2219 		break;
2220 	    }
2221 	case NGM_LISTHOOKS:
2222 	    {
2223 		const int nhooks = here->nd_numhooks;
2224 		struct hooklist *hl;
2225 		struct nodeinfo *ni;
2226 		hook_p hook;
2227 
2228 		/* Get response struct */
2229 		NG_MKRESPONSE(resp, msg, sizeof(*hl)
2230 		    + (nhooks * sizeof(struct linkinfo)), M_WAITOK | M_NULLOK);
2231 		if (resp == NULL) {
2232 			error = ENOMEM;
2233 			break;
2234 		}
2235 		hl = (struct hooklist *) resp->data;
2236 		ni = &hl->nodeinfo;
2237 
2238 		/* Fill in node info */
2239 		if (NG_NODE_HAS_NAME(here))
2240 			strcpy(ni->name, NG_NODE_NAME(here));
2241 		strcpy(ni->type, here->nd_type->name);
2242 		ni->id = ng_node2ID(here);
2243 
2244 		/* Cycle through the linked list of hooks */
2245 		ni->hooks = 0;
2246 		LIST_FOREACH(hook, &here->nd_hooks, hk_hooks) {
2247 			struct linkinfo *const link = &hl->link[ni->hooks];
2248 
2249 			if (ni->hooks >= nhooks) {
2250 				log(LOG_ERR, "%s: number of %s changed\n",
2251 				    __func__, "hooks");
2252 				break;
2253 			}
2254 			if (NG_HOOK_NOT_VALID(hook))
2255 				continue;
2256 			strcpy(link->ourhook, NG_HOOK_NAME(hook));
2257 			strcpy(link->peerhook, NG_PEER_HOOK_NAME(hook));
2258 			if (NG_PEER_NODE_NAME(hook)[0] != '\0')
2259 				strcpy(link->nodeinfo.name,
2260 				    NG_PEER_NODE_NAME(hook));
2261 			strcpy(link->nodeinfo.type,
2262 			   NG_PEER_NODE(hook)->nd_type->name);
2263 			link->nodeinfo.id = ng_node2ID(NG_PEER_NODE(hook));
2264 			link->nodeinfo.hooks = NG_PEER_NODE(hook)->nd_numhooks;
2265 			ni->hooks++;
2266 		}
2267 		break;
2268 	    }
2269 
2270 	case NGM_LISTNODES:
2271 	    {
2272 		struct namelist *nl;
2273 		node_p node;
2274 		int i;
2275 
2276 		IDHASH_RLOCK();
2277 		/* Get response struct. */
2278 		NG_MKRESPONSE(resp, msg, sizeof(*nl) +
2279 		    (ng_nodes * sizeof(struct nodeinfo)), M_NOWAIT | M_ZERO);
2280 		if (resp == NULL) {
2281 			IDHASH_RUNLOCK();
2282 			error = ENOMEM;
2283 			break;
2284 		}
2285 		nl = (struct namelist *) resp->data;
2286 
2287 		/* Cycle through the lists of nodes. */
2288 		nl->numnames = 0;
2289 		for (i = 0; i <= ng_ID_hmask; i++) {
2290 			LIST_FOREACH(node, &ng_ID_hash[i], nd_idnodes) {
2291 				struct nodeinfo *const np =
2292 				    &nl->nodeinfo[nl->numnames];
2293 
2294 				if (NG_NODE_NOT_VALID(node))
2295 					continue;
2296 				if (NG_NODE_HAS_NAME(node))
2297 					strcpy(np->name, NG_NODE_NAME(node));
2298 				strcpy(np->type, node->nd_type->name);
2299 				np->id = ng_node2ID(node);
2300 				np->hooks = node->nd_numhooks;
2301 				KASSERT(nl->numnames < ng_nodes,
2302 				    ("%s: no space", __func__));
2303 				nl->numnames++;
2304 			}
2305 		}
2306 		IDHASH_RUNLOCK();
2307 		break;
2308 	    }
2309 	case NGM_LISTNAMES:
2310 	    {
2311 		struct namelist *nl;
2312 		node_p node;
2313 		int i;
2314 
2315 		NAMEHASH_RLOCK();
2316 		/* Get response struct. */
2317 		NG_MKRESPONSE(resp, msg, sizeof(*nl) +
2318 		    (ng_named_nodes * sizeof(struct nodeinfo)), M_NOWAIT);
2319 		if (resp == NULL) {
2320 			NAMEHASH_RUNLOCK();
2321 			error = ENOMEM;
2322 			break;
2323 		}
2324 		nl = (struct namelist *) resp->data;
2325 
2326 		/* Cycle through the lists of nodes. */
2327 		nl->numnames = 0;
2328 		for (i = 0; i <= ng_name_hmask; i++) {
2329 			LIST_FOREACH(node, &ng_name_hash[i], nd_nodes) {
2330 				struct nodeinfo *const np =
2331 				    &nl->nodeinfo[nl->numnames];
2332 
2333 				if (NG_NODE_NOT_VALID(node))
2334 					continue;
2335 				strcpy(np->name, NG_NODE_NAME(node));
2336 				strcpy(np->type, node->nd_type->name);
2337 				np->id = ng_node2ID(node);
2338 				np->hooks = node->nd_numhooks;
2339 				KASSERT(nl->numnames < ng_named_nodes,
2340 				    ("%s: no space", __func__));
2341 				nl->numnames++;
2342 			}
2343 		}
2344 		NAMEHASH_RUNLOCK();
2345 		break;
2346 	    }
2347 
2348 	case NGM_LISTTYPES:
2349 	    {
2350 		struct typelist *tl;
2351 		struct ng_type *type;
2352 		int num = 0;
2353 
2354 		TYPELIST_RLOCK();
2355 		/* Count number of types */
2356 		LIST_FOREACH(type, &ng_typelist, types)
2357 			num++;
2358 
2359 		/* Get response struct */
2360 		NG_MKRESPONSE(resp, msg, sizeof(*tl)
2361 		    + (num * sizeof(struct typeinfo)), M_WAITOK | M_NULLOK);
2362 		if (resp == NULL) {
2363 			TYPELIST_RUNLOCK();
2364 			error = ENOMEM;
2365 			break;
2366 		}
2367 		tl = (struct typelist *) resp->data;
2368 
2369 		/* Cycle through the linked list of types */
2370 		tl->numtypes = 0;
2371 		LIST_FOREACH(type, &ng_typelist, types) {
2372 			struct typeinfo *const tp = &tl->typeinfo[tl->numtypes];
2373 
2374 			strcpy(tp->type_name, type->name);
2375 			tp->numnodes = type->refs - 1; /* don't count list */
2376 			KASSERT(tl->numtypes < num, ("%s: no space", __func__));
2377 			tl->numtypes++;
2378 		}
2379 		TYPELIST_RUNLOCK();
2380 		break;
2381 	    }
2382 
2383 	case NGM_BINARY2ASCII:
2384 	    {
2385 		int bufSize = 20 * 1024;	/* XXX hard coded constant */
2386 		const struct ng_parse_type *argstype;
2387 		const struct ng_cmdlist *c;
2388 		struct ng_mesg *binary, *ascii;
2389 
2390 		/* Data area must contain a valid netgraph message */
2391 		binary = (struct ng_mesg *)msg->data;
2392 		if (msg->header.arglen < sizeof(struct ng_mesg) ||
2393 		    (msg->header.arglen - sizeof(struct ng_mesg) <
2394 		    binary->header.arglen)) {
2395 			TRAP_ERROR();
2396 			error = EINVAL;
2397 			break;
2398 		}
2399 
2400 		/* Get a response message with lots of room */
2401 		NG_MKRESPONSE(resp, msg, sizeof(*ascii) + bufSize, M_WAITOK | M_NULLOK);
2402 		if (resp == NULL) {
2403 			error = ENOMEM;
2404 			break;
2405 		}
2406 		ascii = (struct ng_mesg *)resp->data;
2407 
2408 		/* Copy binary message header to response message payload */
2409 		bcopy(binary, ascii, sizeof(*binary));
2410 
2411 		/* Find command by matching typecookie and command number */
2412 		for (c = here->nd_type->cmdlist;
2413 		    c != NULL && c->name != NULL; c++) {
2414 			if (binary->header.typecookie == c->cookie
2415 			    && binary->header.cmd == c->cmd)
2416 				break;
2417 		}
2418 		if (c == NULL || c->name == NULL) {
2419 			for (c = ng_generic_cmds; c->name != NULL; c++) {
2420 				if (binary->header.typecookie == c->cookie
2421 				    && binary->header.cmd == c->cmd)
2422 					break;
2423 			}
2424 			if (c->name == NULL) {
2425 				NG_FREE_MSG(resp);
2426 				error = ENOSYS;
2427 				break;
2428 			}
2429 		}
2430 
2431 		/* Convert command name to ASCII */
2432 		ksnprintf(ascii->header.cmdstr, sizeof(ascii->header.cmdstr),
2433 		    "%s", c->name);
2434 
2435 		/* Convert command arguments to ASCII */
2436 		argstype = (binary->header.flags & NGF_RESP) ?
2437 		    c->respType : c->mesgType;
2438 		if (argstype == NULL) {
2439 			*ascii->data = '\0';
2440 		} else {
2441 			if ((error = ng_unparse(argstype,
2442 			    (u_char *)binary->data,
2443 			    ascii->data, bufSize)) != 0) {
2444 				NG_FREE_MSG(resp);
2445 				break;
2446 			}
2447 		}
2448 
2449 		/* Return the result as struct ng_mesg plus ASCII string */
2450 		bufSize = strlen(ascii->data) + 1;
2451 		ascii->header.arglen = bufSize;
2452 		resp->header.arglen = sizeof(*ascii) + bufSize;
2453 		break;
2454 	    }
2455 
2456 	case NGM_ASCII2BINARY:
2457 	    {
2458 		int bufSize = 2000;	/* XXX hard coded constant */
2459 		const struct ng_cmdlist *c;
2460 		const struct ng_parse_type *argstype;
2461 		struct ng_mesg *ascii, *binary;
2462 		int off = 0;
2463 
2464 		/* Data area must contain at least a struct ng_mesg + '\0' */
2465 		ascii = (struct ng_mesg *)msg->data;
2466 		if ((msg->header.arglen < sizeof(*ascii) + 1) ||
2467 		    (ascii->header.arglen < 1) ||
2468 		    (msg->header.arglen < sizeof(*ascii) +
2469 		    ascii->header.arglen)) {
2470 			TRAP_ERROR();
2471 			error = EINVAL;
2472 			break;
2473 		}
2474 		ascii->data[ascii->header.arglen - 1] = '\0';
2475 
2476 		/* Get a response message with lots of room */
2477 		NG_MKRESPONSE(resp, msg, sizeof(*binary) + bufSize, M_WAITOK | M_NULLOK);
2478 		if (resp == NULL) {
2479 			error = ENOMEM;
2480 			break;
2481 		}
2482 		binary = (struct ng_mesg *)resp->data;
2483 
2484 		/* Copy ASCII message header to response message payload */
2485 		bcopy(ascii, binary, sizeof(*ascii));
2486 
2487 		/* Find command by matching ASCII command string */
2488 		for (c = here->nd_type->cmdlist;
2489 		    c != NULL && c->name != NULL; c++) {
2490 			if (strcmp(ascii->header.cmdstr, c->name) == 0)
2491 				break;
2492 		}
2493 		if (c == NULL || c->name == NULL) {
2494 			for (c = ng_generic_cmds; c->name != NULL; c++) {
2495 				if (strcmp(ascii->header.cmdstr, c->name) == 0)
2496 					break;
2497 			}
2498 			if (c->name == NULL) {
2499 				NG_FREE_MSG(resp);
2500 				error = ENOSYS;
2501 				break;
2502 			}
2503 		}
2504 
2505 		/* Convert command name to binary */
2506 		binary->header.cmd = c->cmd;
2507 		binary->header.typecookie = c->cookie;
2508 
2509 		/* Convert command arguments to binary */
2510 		argstype = (binary->header.flags & NGF_RESP) ?
2511 		    c->respType : c->mesgType;
2512 		if (argstype == NULL) {
2513 			bufSize = 0;
2514 		} else {
2515 			if ((error = ng_parse(argstype, ascii->data,
2516 			    &off, (u_char *)binary->data, &bufSize)) != 0) {
2517 				NG_FREE_MSG(resp);
2518 				break;
2519 			}
2520 		}
2521 
2522 		/* Return the result */
2523 		binary->header.arglen = bufSize;
2524 		resp->header.arglen = sizeof(*binary) + bufSize;
2525 		break;
2526 	    }
2527 
2528 	case NGM_TEXT_CONFIG:
2529 	case NGM_TEXT_STATUS:
2530 		/*
2531 		 * This one is tricky as it passes the command down to the
2532 		 * actual node, even though it is a generic type command.
2533 		 * This means we must assume that the item/msg is already freed
2534 		 * when control passes back to us.
2535 		 */
2536 		if (here->nd_type->rcvmsg != NULL) {
2537 			NGI_MSG(item) = msg; /* put it back as we found it */
2538 			return((*here->nd_type->rcvmsg)(here, item, lasthook));
2539 		}
2540 		/* Fall through if rcvmsg not supported */
2541 	default:
2542 		TRAP_ERROR();
2543 		error = EINVAL;
2544 	}
2545 	/*
2546 	 * Sometimes a generic message may be statically allocated
2547 	 * to avoid problems with allocating when in tight memeory situations.
2548 	 * Don't free it if it is so.
2549 	 * I break them appart here, because erros may cause a free if the item
2550 	 * in which case we'd be doing it twice.
2551 	 * they are kept together above, to simplify freeing.
2552 	 */
2553 out:
2554 	NG_RESPOND_MSG(error, here, item, resp);
2555 	if (msg)
2556 		NG_FREE_MSG(msg);
2557 	return (error);
2558 }
2559 
2560 /************************************************************************
2561 			Queue element get/free routines
2562 ************************************************************************/
2563 
2564 static struct objcache	*ng_oc;
2565 static struct objcache	*ng_apply_oc;
2566 static int		 maxalloc = 4096; /* limit the damage of a leak */
2567 
2568 TUNABLE_INT("net.graph.maxalloc", &maxalloc);
2569 SYSCTL_INT(_net_graph, OID_AUTO, maxalloc, CTLFLAG_RD, &maxalloc,
2570     0, "Maximum number of queue items to allocate");
2571 
2572 #ifdef	NETGRAPH_DEBUG
2573 static TAILQ_HEAD(, ng_item) ng_itemlist = TAILQ_HEAD_INITIALIZER(ng_itemlist);
2574 static int			allocated;	/* number of items malloc'd */
2575 #endif
2576 
2577 /*
2578  * Get a queue entry.
2579  * This is usually called when a packet first enters netgraph.
2580  * By definition, this is usually from an interrupt, or from a user.
2581  * Users are not so important, but try be quick for the times that it's
2582  * an interrupt.
2583  */
2584 static __inline item_p
2585 ng_alloc_item(int type, int flags)
2586 {
2587 	item_p item;
2588 
2589 	KASSERT(((type & ~NGQF_TYPE) == 0),
2590 	    ("%s: incorrect item type: %d", __func__, type));
2591 
2592 	item = objcache_get(ng_oc,
2593 	    (flags & NG_WAITOK) ? M_WAITOK : M_NOWAIT );
2594 
2595 	if (item) {
2596 		item->el_flags = type;
2597 #ifdef	NETGRAPH_DEBUG
2598 		mtx_lock(&ngq_mtx);
2599 		TAILQ_INSERT_TAIL(&ng_itemlist, item, all);
2600 		allocated++;
2601 		mtx_unlock(&ngq_mtx);
2602 #endif
2603 	}
2604 
2605 	return (item);
2606 }
2607 
2608 /*
2609  * Release a queue entry
2610  */
2611 void
2612 ng_free_item(item_p item)
2613 {
2614 	/*
2615 	 * If the item still has an apply callback registered, it is
2616 	 * being freed too early.
2617 	 */
2618 	KASSERT(item->apply == NULL, ("freeing item with registered callback"));
2619 
2620 	/*
2621 	 * Make sure the reference count has reached zero.
2622 	 */
2623 	KASSERT(item->refs == 0, ("freeing item with non-zero refcount"));
2624 
2625 	/*
2626 	 * The item may hold resources on it's own. We need to free
2627 	 * these before we can free the item. What they are depends upon
2628 	 * what kind of item it is. it is important that nodes zero
2629 	 * out pointers to resources that they remove from the item
2630 	 * or we release them again here.
2631 	 */
2632 	switch (item->el_flags & NGQF_TYPE) {
2633 	case NGQF_DATA:
2634 		/* If we have an mbuf still attached.. */
2635 		NG_FREE_M(_NGI_M(item));
2636 		break;
2637 	case NGQF_MESG:
2638 		_NGI_RETADDR(item) = 0;
2639 		NG_FREE_MSG(_NGI_MSG(item));
2640 		break;
2641 	case NGQF_FN:
2642 	case NGQF_FN2:
2643 		/* nothing to free really, */
2644 		_NGI_FN(item) = NULL;
2645 		_NGI_ARG1(item) = NULL;
2646 		_NGI_ARG2(item) = 0;
2647 		break;
2648 	}
2649 	/* If we still have a node or hook referenced... */
2650 	_NGI_CLR_NODE(item);
2651 	_NGI_CLR_HOOK(item);
2652 
2653 #ifdef	NETGRAPH_DEBUG
2654 	mtx_lock(&ngq_mtx);
2655 	TAILQ_REMOVE(&ng_itemlist, item, all);
2656 	allocated--;
2657 	mtx_unlock(&ngq_mtx);
2658 #endif
2659 	/* Object must be initialized before returning to objcache */
2660 	bzero(item, sizeof(struct ng_item));
2661 	objcache_put(ng_oc, item);
2662 }
2663 
2664 /*
2665  * Change type of the queue entry.
2666  */
2667 static __inline item_p
2668 ng_realloc_item(item_p item, int type, int flags)
2669 {
2670 
2671 	KASSERT((item != NULL), ("%s: can't reallocate NULL", __func__));
2672 	KASSERT(((type & ~NGQF_TYPE) == 0),
2673 	    ("%s: incorrect item type: %d", __func__, type));
2674 
2675 	item->el_flags = (item->el_flags & ~NGQF_TYPE) | type;
2676 
2677 	return (item);
2678 }
2679 
2680 __inline apply_p
2681 ng_alloc_apply(void)
2682 {
2683 	return (objcache_get(ng_apply_oc, M_WAITOK));
2684 }
2685 
2686 __inline void
2687 ng_free_apply(apply_p apply)
2688 {
2689 	objcache_put(ng_apply_oc, apply);
2690 }
2691 
2692 /************************************************************************
2693 			Module routines
2694 ************************************************************************/
2695 
2696 /*
2697  * Handle the loading/unloading of a netgraph node type module
2698  */
2699 int
2700 ng_mod_event(module_t mod, int event, void *data)
2701 {
2702 	struct ng_type *const type = data;
2703 	int error = 0;
2704 
2705 	switch (event) {
2706 	case MOD_LOAD:
2707 
2708 		/* Register new netgraph node type */
2709 		if ((error = ng_newtype(type)) != 0) {
2710 			break;
2711 		}
2712 
2713 		/* Call type specific code */
2714 		if (type->mod_event != NULL)
2715 			if ((error = (*type->mod_event)(mod, event, data))) {
2716 				TYPELIST_WLOCK();
2717 				type->refs--;	/* undo it */
2718 				LIST_REMOVE(type, types);
2719 				TYPELIST_WUNLOCK();
2720 			}
2721 		break;
2722 
2723 	case MOD_UNLOAD:
2724 		if (type->refs > 1) {		/* make sure no nodes exist! */
2725 			error = EBUSY;
2726 		} else {
2727 			if (type->refs == 0) {
2728 				/* failed load, nothing to undo */
2729 				break;
2730 			}
2731 			if (type->mod_event != NULL) {	/* check with type */
2732 				error = (*type->mod_event)(mod, event, data);
2733 				if (error != 0) {	/* type refuses.. */
2734 					break;
2735 				}
2736 			}
2737 			TYPELIST_WLOCK();
2738 			LIST_REMOVE(type, types);
2739 			TYPELIST_WUNLOCK();
2740 		}
2741 		break;
2742 
2743 	default:
2744 		if (type->mod_event != NULL)
2745 			error = (*type->mod_event)(mod, event, data);
2746 		else
2747 			error = EOPNOTSUPP;		/* XXX ? */
2748 		break;
2749 	}
2750 	return (error);
2751 }
2752 
2753 /*
2754  * Handle loading and unloading for this code.
2755  */
2756 static int
2757 ngb_mod_event(module_t mod, int event, void *data)
2758 {
2759 	int i, error = 0;
2760 
2761 	switch (event) {
2762 	case MOD_LOAD:
2763 		/* Initialize everything. */
2764 		lwkt_token_init(&ng_typelist_token, "ng typelist");
2765 		lwkt_token_init(&ng_idhash_token, "ng idhash");
2766 		lwkt_token_init(&ng_namehash_token, "ng namehash");
2767 		lwkt_token_init(&ng_topo_token, "ng topology");
2768 #ifdef	NETGRAPH_DEBUG
2769 		mtx_init(&ng_nodelist_mtx, "ng nodelist");
2770 		mtx_init(&ngq_mtx, "ng queue");
2771 #endif
2772 		ng_oc = objcache_create_mbacked(M_NETGRAPH,
2773 			    sizeof(struct ng_item), maxalloc, 0, bzero_ctor,
2774 			    NULL, NULL);
2775 		ng_apply_oc = objcache_create_mbacked(M_NETGRAPH_APPLY,
2776 			    sizeof(struct ng_apply_info), 0, 0, bzero_ctor,
2777 			    NULL, NULL);
2778 
2779 		/* We start with small hashes, but they can grow. */
2780 		ng_ID_hash = hashinit(16, M_NETGRAPH_NODE, &ng_ID_hmask);
2781 		ng_name_hash = hashinit(16, M_NETGRAPH_NODE, &ng_name_hmask);
2782 
2783 		lwkt_initport_panic(&ng_panic_reply_port);
2784 		for (i = 0; i < ncpus; ++i) {
2785 			thread_t td;
2786 
2787 			lwkt_create(ngthread, NULL, &td,
2788 			   NULL, 0, i, "netgraph %d", i);
2789 			ng_msgport[i] = &td->td_msgport;
2790 		}
2791 		break;
2792 	case MOD_UNLOAD:
2793 #if 0
2794 		hashdestroy(V_ng_name_hash, M_NETGRAPH_NODE, V_ng_name_hmask);
2795 		hashdestroy(V_ng_ID_hash, M_NETGRAPH_NODE, V_ng_ID_hmask);
2796 
2797 		/* Destroy the lwkt threads too */
2798 
2799 		objcache_destroy(ng_apply_oc);
2800 		objcache_destroy(ng_oc);
2801 #endif
2802 		/* You can't unload it because an interface may be using it. */
2803 		error = EBUSY;
2804 		break;
2805 	default:
2806 		error = EOPNOTSUPP;
2807 		break;
2808 	}
2809 	return (error);
2810 }
2811 
2812 static moduledata_t netgraph_mod = {
2813 	"netgraph",
2814 	ngb_mod_event,
2815 	(NULL)
2816 };
2817 DECLARE_MODULE(netgraph, netgraph_mod, SI_SUB_NETGRAPH, SI_ORDER_MIDDLE);
2818 SYSCTL_NODE(_net, OID_AUTO, graph, CTLFLAG_RW, 0, "netgraph Family");
2819 SYSCTL_INT(_net_graph, OID_AUTO, abi_version, CTLFLAG_RD, 0, NG_ABI_VERSION,"");
2820 SYSCTL_INT(_net_graph, OID_AUTO, msg_version, CTLFLAG_RD, 0, NG_VERSION, "");
2821 
2822 #ifdef	NETGRAPH_DEBUG
2823 void
2824 dumphook (hook_p hook, char *file, int line)
2825 {
2826 	kprintf("hook: name %s, %d refs, Last touched:\n",
2827 		_NG_HOOK_NAME(hook), hook->hk_refs);
2828 	kprintf("	Last active @ %s, line %d\n",
2829 		hook->lastfile, hook->lastline);
2830 	if (line) {
2831 		kprintf(" problem discovered at file %s, line %d\n", file, line);
2832 	}
2833 }
2834 
2835 void
2836 dumpnode(node_p node, char *file, int line)
2837 {
2838 	kprintf("node: ID [%x]: type '%s', %d hooks, flags 0x%x, %d refs, %s:\n",
2839 		_NG_NODE_ID(node), node->nd_type->name,
2840 		node->nd_numhooks, node->nd_flags,
2841 		node->nd_refs, node->nd_name);
2842 	kprintf("	Last active @ %s, line %d\n",
2843 		node->lastfile, node->lastline);
2844 	if (line) {
2845 		kprintf(" problem discovered at file %s, line %d\n", file, line);
2846 	}
2847 }
2848 
2849 void
2850 dumpitem(item_p item, char *file, int line)
2851 {
2852 	kprintf(" ACTIVE item, last used at %s, line %d",
2853 		item->lastfile, item->lastline);
2854 	switch(item->el_flags & NGQF_TYPE) {
2855 	case NGQF_DATA:
2856 		kprintf(" - [data]\n");
2857 		break;
2858 	case NGQF_MESG:
2859 		kprintf(" - retaddr[%d]:\n", _NGI_RETADDR(item));
2860 		break;
2861 	case NGQF_FN:
2862 		kprintf(" - fn@%p (%p, %p, %p, %d (%x))\n",
2863 			_NGI_FN(item),
2864 			_NGI_NODE(item),
2865 			_NGI_HOOK(item),
2866 			item->body.fn.fn_arg1,
2867 			item->body.fn.fn_arg2,
2868 			item->body.fn.fn_arg2);
2869 		break;
2870 	case NGQF_FN2:
2871 		kprintf(" - fn2@%p (%p, %p, %p, %d (%x))\n",
2872 			_NGI_FN2(item),
2873 			_NGI_NODE(item),
2874 			_NGI_HOOK(item),
2875 			item->body.fn.fn_arg1,
2876 			item->body.fn.fn_arg2,
2877 			item->body.fn.fn_arg2);
2878 		break;
2879 	}
2880 	if (line) {
2881 		kprintf(" problem discovered at file %s, line %d\n", file, line);
2882 		if (_NGI_NODE(item)) {
2883 			kprintf("node %p ([%x])\n",
2884 				_NGI_NODE(item), ng_node2ID(_NGI_NODE(item)));
2885 		}
2886 	}
2887 }
2888 
2889 static void
2890 ng_dumpitems(void)
2891 {
2892 	item_p item;
2893 	int i = 1;
2894 	TAILQ_FOREACH(item, &ng_itemlist, all) {
2895 		kprintf("[%d] ", i++);
2896 		dumpitem(item, NULL, 0);
2897 	}
2898 }
2899 
2900 static void
2901 ng_dumpnodes(void)
2902 {
2903 	node_p node;
2904 	int i = 1;
2905 	mtx_lock(&ng_nodelist_mtx);
2906 	SLIST_FOREACH(node, &ng_allnodes, nd_all) {
2907 		kprintf("[%d] ", i++);
2908 		dumpnode(node, NULL, 0);
2909 	}
2910 	mtx_unlock(&ng_nodelist_mtx);
2911 }
2912 
2913 static void
2914 ng_dumphooks(void)
2915 {
2916 	hook_p hook;
2917 	int i = 1;
2918 	mtx_lock(&ng_nodelist_mtx);
2919 	SLIST_FOREACH(hook, &ng_allhooks, hk_all) {
2920 		kprintf("[%d] ", i++);
2921 		dumphook(hook, NULL, 0);
2922 	}
2923 	mtx_unlock(&ng_nodelist_mtx);
2924 }
2925 
2926 static int
2927 sysctl_debug_ng_dump_items(SYSCTL_HANDLER_ARGS)
2928 {
2929 	int error;
2930 	int val;
2931 
2932 	val = allocated;
2933 	error = sysctl_handle_int(oidp, &val, 0, req);
2934 	if (error != 0 || req->newptr == NULL)
2935 		return (error);
2936 	if (val == 42) {
2937 		ng_dumpitems();
2938 		ng_dumpnodes();
2939 		ng_dumphooks();
2940 	}
2941 	return (0);
2942 }
2943 
2944 SYSCTL_PROC(_debug, OID_AUTO, ng_dump_items, CTLTYPE_INT | CTLFLAG_RW,
2945     0, sizeof(int), sysctl_debug_ng_dump_items, "I", "Number of allocated items");
2946 #endif	/* NETGRAPH_DEBUG */
2947 
2948 
2949 /***********************************************************************
2950 * Externally useable functions to set up a queue item ready for sending
2951 ***********************************************************************/
2952 
2953 #ifdef	NETGRAPH_DEBUG
2954 #define	ITEM_DEBUG_CHECKS						\
2955 	do {								\
2956 		if (NGI_NODE(item) ) {					\
2957 			kprintf("item already has node");		\
2958 			kdb_enter(KDB_WHY_NETGRAPH, "has node");	\
2959 			NGI_CLR_NODE(item);				\
2960 		}							\
2961 		if (NGI_HOOK(item) ) {					\
2962 			kprintf("item already has hook");		\
2963 			kdb_enter(KDB_WHY_NETGRAPH, "has hook");	\
2964 			NGI_CLR_HOOK(item);				\
2965 		}							\
2966 	} while (0)
2967 #else
2968 #define ITEM_DEBUG_CHECKS
2969 #endif
2970 
2971 /*
2972  * Put mbuf into the item.
2973  * Hook and node references will be removed when the item is dequeued.
2974  * (or equivalent)
2975  * (XXX) Unsafe because no reference held by peer on remote node.
2976  * remote node might go away in this timescale.
2977  * We know the hooks can't go away because that would require getting
2978  * a writer item on both nodes and we must have at least a  reader
2979  * here to be able to do this.
2980  * Note that the hook loaded is the REMOTE hook.
2981  *
2982  * This is possibly in the critical path for new data.
2983  */
2984 item_p
2985 ng_package_data(struct mbuf *m, int flags)
2986 {
2987 	item_p item;
2988 
2989 	if ((item = ng_alloc_item(NGQF_DATA, flags)) == NULL) {
2990 		NG_FREE_M(m);
2991 		return (NULL);
2992 	}
2993 	ITEM_DEBUG_CHECKS;
2994 	item->el_flags |= NGQF_READER;
2995 	NGI_M(item) = m;
2996 	return (item);
2997 }
2998 
2999 /*
3000  * Allocate a queue item and put items into it..
3001  * Evaluate the address as this will be needed to queue it and
3002  * to work out what some of the fields should be.
3003  * Hook and node references will be removed when the item is dequeued.
3004  * (or equivalent)
3005  */
3006 item_p
3007 ng_package_msg(struct ng_mesg *msg, int flags)
3008 {
3009 	item_p item;
3010 
3011 	if ((item = ng_alloc_item(NGQF_MESG, flags)) == NULL) {
3012 		NG_FREE_MSG(msg);
3013 		return (NULL);
3014 	}
3015 	ITEM_DEBUG_CHECKS;
3016 	/* Messages items count as writers unless explicitly exempted. */
3017 	if (msg->header.cmd & NGM_READONLY)
3018 		item->el_flags |= NGQF_READER;
3019 	else
3020 		item->el_flags |= NGQF_WRITER;
3021 	/*
3022 	 * Set the current lasthook into the queue item
3023 	 */
3024 	NGI_MSG(item) = msg;
3025 	NGI_RETADDR(item) = 0;
3026 	return (item);
3027 }
3028 
3029 
3030 
3031 #define SET_RETADDR(item, here, retaddr)				\
3032 	do {	/* Data or fn items don't have retaddrs */		\
3033 		if ((item->el_flags & NGQF_TYPE) == NGQF_MESG) {	\
3034 			if (retaddr) {					\
3035 				NGI_RETADDR(item) = retaddr;		\
3036 			} else {					\
3037 				/*					\
3038 				 * The old return address should be ok.	\
3039 				 * If there isn't one, use the address	\
3040 				 * here.				\
3041 				 */					\
3042 				if (NGI_RETADDR(item) == 0) {		\
3043 					NGI_RETADDR(item)		\
3044 						= ng_node2ID(here);	\
3045 				}					\
3046 			}						\
3047 		}							\
3048 	} while (0)
3049 
3050 int
3051 ng_address_hook(node_p here, item_p item, hook_p hook, ng_ID_t retaddr)
3052 {
3053 	hook_p peer;
3054 	node_p peernode;
3055 	ITEM_DEBUG_CHECKS;
3056 	/*
3057 	 * Quick sanity check..
3058 	 * Since a hook holds a reference on it's node, once we know
3059 	 * that the peer is still connected (even if invalid,) we know
3060 	 * that the peer node is present, though maybe invalid.
3061 	 */
3062 	if ((hook == NULL) ||
3063 	    NG_HOOK_NOT_VALID(hook) ||
3064 	    NG_HOOK_NOT_VALID(peer = NG_HOOK_PEER(hook)) ||
3065 	    NG_NODE_NOT_VALID(peernode = NG_PEER_NODE(hook))) {
3066 		NG_FREE_ITEM(item);
3067 		TRAP_ERROR();
3068 		return (ENETDOWN);
3069 	}
3070 
3071 	/*
3072 	 * Transfer our interest to the other (peer) end.
3073 	 */
3074 	NG_HOOK_REF(peer);
3075 	NG_NODE_REF(peernode);
3076 	NGI_SET_HOOK(item, peer);
3077 	NGI_SET_NODE(item, peernode);
3078 	SET_RETADDR(item, here, retaddr);
3079 	return (0);
3080 }
3081 
3082 int
3083 ng_address_path(node_p here, item_p item, char *address, ng_ID_t retaddr)
3084 {
3085 	node_p	dest = NULL;
3086 	hook_p	hook = NULL;
3087 	int	error;
3088 
3089 	ITEM_DEBUG_CHECKS;
3090 	/*
3091 	 * Note that ng_path2noderef increments the reference count
3092 	 * on the node for us if it finds one. So we don't have to.
3093 	 */
3094 	error = ng_path2noderef(here, address, &dest, &hook);
3095 	if (error) {
3096 		NG_FREE_ITEM(item);
3097 		return (error);
3098 	}
3099 	NGI_SET_NODE(item, dest);
3100 	if ( hook) {
3101 		NG_HOOK_REF(hook);	/* don't let it go while on the queue */
3102 		NGI_SET_HOOK(item, hook);
3103 	}
3104 	SET_RETADDR(item, here, retaddr);
3105 	return (0);
3106 }
3107 
3108 int
3109 ng_address_ID(node_p here, item_p item, ng_ID_t ID, ng_ID_t retaddr)
3110 {
3111 	node_p dest;
3112 
3113 	ITEM_DEBUG_CHECKS;
3114 	/*
3115 	 * Find the target node.
3116 	 */
3117 	dest = ng_ID2noderef(ID); /* GETS REFERENCE! */
3118 	if (dest == NULL) {
3119 		NG_FREE_ITEM(item);
3120 		TRAP_ERROR();
3121 		return(EINVAL);
3122 	}
3123 	/* Fill out the contents */
3124 	NGI_SET_NODE(item, dest);
3125 	NGI_CLR_HOOK(item);
3126 	SET_RETADDR(item, here, retaddr);
3127 	return (0);
3128 }
3129 
3130 /*
3131  * special case to send a message to self (e.g. destroy node)
3132  * Possibly indicate an arrival hook too.
3133  * Useful for removing that hook :-)
3134  */
3135 item_p
3136 ng_package_msg_self(node_p here, hook_p hook, struct ng_mesg *msg)
3137 {
3138 	item_p item;
3139 
3140 	/*
3141 	 * Find the target node.
3142 	 * If there is a HOOK argument, then use that in preference
3143 	 * to the address.
3144 	 */
3145 	if ((item = ng_alloc_item(NGQF_MESG, NG_NOFLAGS)) == NULL) {
3146 		NG_FREE_MSG(msg);
3147 		return (NULL);
3148 	}
3149 
3150 	/* Fill out the contents */
3151 	item->el_flags |= NGQF_WRITER;
3152 	NG_NODE_REF(here);
3153 	NGI_SET_NODE(item, here);
3154 	if (hook) {
3155 		NG_HOOK_REF(hook);
3156 		NGI_SET_HOOK(item, hook);
3157 	}
3158 	NGI_MSG(item) = msg;
3159 	NGI_RETADDR(item) = ng_node2ID(here);
3160 	return (item);
3161 }
3162 
3163 /*
3164  * Send ng_item_fn function call to the specified node.
3165  */
3166 
3167 int
3168 ng_send_fn(node_p node, hook_p hook, ng_item_fn *fn, void * arg1, int arg2)
3169 {
3170 	return ng_send_fn1(node, hook, fn, arg1, arg2, NG_NOFLAGS);
3171 }
3172 
3173 int
3174 ng_send_fn1(node_p node, hook_p hook, ng_item_fn *fn, void * arg1, int arg2,
3175 	int flags)
3176 {
3177 	item_p item;
3178 
3179 	if ((item = ng_alloc_item(NGQF_FN, flags)) == NULL) {
3180 		return (ENOMEM);
3181 	}
3182 	item->el_flags |= NGQF_WRITER;
3183 	NG_NODE_REF(node); /* and one for the item */
3184 	NGI_SET_NODE(item, node);
3185 	if (hook) {
3186 		NG_HOOK_REF(hook);
3187 		NGI_SET_HOOK(item, hook);
3188 	}
3189 	NGI_FN(item) = fn;
3190 	NGI_ARG1(item) = arg1;
3191 	NGI_ARG2(item) = arg2;
3192 	return(ng_snd_item(item, flags));
3193 }
3194 
3195 /*
3196  * Send ng_item_fn2 function call to the specified node.
3197  *
3198  * If NG_REUSE_ITEM flag is set, no new item will be allocated,
3199  * pitem will be used instead.
3200  */
3201 int
3202 ng_send_fn2(node_p node, hook_p hook, item_p pitem, ng_item_fn2 *fn, void *arg1,
3203 	int arg2, int flags)
3204 {
3205 	item_p item;
3206 
3207 	KASSERT((pitem != NULL || (flags & NG_REUSE_ITEM) == 0),
3208 	    ("%s: NG_REUSE_ITEM but no pitem", __func__));
3209 
3210 	/*
3211 	 * Allocate a new item if no supplied or
3212 	 * if we can't use supplied one.
3213 	 */
3214 	if (pitem == NULL || (flags & NG_REUSE_ITEM) == 0) {
3215 		if ((item = ng_alloc_item(NGQF_FN2, flags)) == NULL)
3216 			return (ENOMEM);
3217 	} else {
3218 		if ((item = ng_realloc_item(pitem, NGQF_FN2, flags)) == NULL)
3219 			return (ENOMEM);
3220 	}
3221 
3222 	item->el_flags = (item->el_flags & ~NGQF_RW) | NGQF_WRITER;
3223 	NG_NODE_REF(node); /* and one for the item */
3224 	NGI_SET_NODE(item, node);
3225 	if (hook) {
3226 		NG_HOOK_REF(hook);
3227 		NGI_SET_HOOK(item, hook);
3228 	}
3229 	NGI_FN2(item) = fn;
3230 	NGI_ARG1(item) = arg1;
3231 	NGI_ARG2(item) = arg2;
3232 	return(ng_snd_item(item, flags));
3233 }
3234 
3235 /*
3236  * Official timeout routines for Netgraph nodes.
3237  */
3238 static void
3239 ng_callout_trampoline(void *arg)
3240 {
3241 	item_p item = arg;
3242 
3243 	ng_snd_item(item, 0);
3244 }
3245 
3246 
3247 int
3248 ng_callout(struct callout *c, node_p node, hook_p hook, int ticks,
3249     ng_item_fn *fn, void * arg1, int arg2)
3250 {
3251 	item_p item, oitem;
3252 
3253 	if ((item = ng_alloc_item(NGQF_FN, NG_NOFLAGS)) == NULL)
3254 		return (ENOMEM);
3255 
3256 	item->el_flags |= NGQF_WRITER;
3257 	NG_NODE_REF(node);		/* and one for the item */
3258 	NGI_SET_NODE(item, node);
3259 	if (hook) {
3260 		NG_HOOK_REF(hook);
3261 		NGI_SET_HOOK(item, hook);
3262 	}
3263 	NGI_FN(item) = fn;
3264 	NGI_ARG1(item) = arg1;
3265 	NGI_ARG2(item) = arg2;
3266 	oitem = c->c_arg;
3267 	callout_reset(c, ticks, &ng_callout_trampoline, item);
3268 	return (0);
3269 }
3270 
3271 /* A special modified version of untimeout() */
3272 int
3273 ng_uncallout(struct callout *c, node_p node)
3274 {
3275 	item_p item;
3276 	int rval;
3277 
3278 	KASSERT(c != NULL, ("ng_uncallout: NULL callout"));
3279 	KASSERT(node != NULL, ("ng_uncallout: NULL node"));
3280 
3281 	rval = callout_stop(c);
3282 	item = c->c_arg;
3283 	/* Do an extra check */
3284 	if ((rval > 0) && (c->c_func == &ng_callout_trampoline) &&
3285 	    (NGI_NODE(item) == node)) {
3286 		/*
3287 		 * We successfully removed it from the queue before it ran
3288 		 * So now we need to unreference everything that was
3289 		 * given extra references. (NG_FREE_ITEM does this).
3290 		 */
3291 		NG_FREE_ITEM(item);
3292 	}
3293 	c->c_arg = NULL;
3294 
3295 	return (rval);
3296 }
3297 
3298 /*
3299  * Set the address, if none given, give the node here.
3300  */
3301 void
3302 ng_replace_retaddr(node_p here, item_p item, ng_ID_t retaddr)
3303 {
3304 	if (retaddr) {
3305 		NGI_RETADDR(item) = retaddr;
3306 	} else {
3307 		/*
3308 		 * The old return address should be ok.
3309 		 * If there isn't one, use the address here.
3310 		 */
3311 		NGI_RETADDR(item) = ng_node2ID(here);
3312 	}
3313 }
3314 
3315 static boolean_t
3316 bzero_ctor(void *obj, void *private, int ocflags)
3317 {
3318 	struct ng_item *i = obj;
3319 
3320 	bzero(i, sizeof(struct ng_item));
3321 	return(TRUE);
3322 }
3323 
3324 #define TESTING
3325 #ifdef TESTING
3326 /* just test all the macros */
3327 void
3328 ng_macro_test(item_p item);
3329 void
3330 ng_macro_test(item_p item)
3331 {
3332 	node_p node = NULL;
3333 	hook_p hook = NULL;
3334 	struct mbuf *m;
3335 	struct ng_mesg *msg;
3336 	ng_ID_t retaddr;
3337 	int	error;
3338 
3339 	NGI_GET_M(item, m);
3340 	NGI_GET_MSG(item, msg);
3341 	retaddr = NGI_RETADDR(item);
3342 	NG_SEND_DATA(error, hook, m, NULL);
3343 	NG_SEND_DATA_ONLY(error, hook, m);
3344 	NG_FWD_NEW_DATA(error, item, hook, m);
3345 	NG_FWD_ITEM_HOOK(error, item, hook);
3346 	NG_SEND_MSG_HOOK(error, node, msg, hook, retaddr);
3347 	NG_SEND_MSG_ID(error, node, msg, retaddr, retaddr);
3348 	NG_SEND_MSG_PATH(error, node, msg, ".:", retaddr);
3349 	NG_FWD_MSG_HOOK(error, node, item, hook, retaddr);
3350 }
3351 #endif /* TESTING */
3352 
3353