xref: /freebsd/sys/netgraph/ng_base.c (revision 7bd6fde3)
1 /*
2  * ng_base.c
3  */
4 
5 /*-
6  * Copyright (c) 1996-1999 Whistle Communications, Inc.
7  * All rights reserved.
8  *
9  * Subject to the following obligations and disclaimer of warranty, use and
10  * redistribution of this software, in source or object code forms, with or
11  * without modifications are expressly permitted by Whistle Communications;
12  * provided, however, that:
13  * 1. Any and all reproductions of the source or object code must include the
14  *    copyright notice above and the following disclaimer of warranties; and
15  * 2. No rights are granted, in any manner or form, to use Whistle
16  *    Communications, Inc. trademarks, including the mark "WHISTLE
17  *    COMMUNICATIONS" on advertising, endorsements, or otherwise except as
18  *    such appears in the above copyright notice or in the software.
19  *
20  * THIS SOFTWARE IS BEING PROVIDED BY WHISTLE COMMUNICATIONS "AS IS", AND
21  * TO THE MAXIMUM EXTENT PERMITTED BY LAW, WHISTLE COMMUNICATIONS MAKES NO
22  * REPRESENTATIONS OR WARRANTIES, EXPRESS OR IMPLIED, REGARDING THIS SOFTWARE,
23  * INCLUDING WITHOUT LIMITATION, ANY AND ALL IMPLIED WARRANTIES OF
24  * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT.
25  * WHISTLE COMMUNICATIONS DOES NOT WARRANT, GUARANTEE, OR MAKE ANY
26  * REPRESENTATIONS REGARDING THE USE OF, OR THE RESULTS OF THE USE OF THIS
27  * SOFTWARE IN TERMS OF ITS CORRECTNESS, ACCURACY, RELIABILITY OR OTHERWISE.
28  * IN NO EVENT SHALL WHISTLE COMMUNICATIONS BE LIABLE FOR ANY DAMAGES
29  * RESULTING FROM OR ARISING OUT OF ANY USE OF THIS SOFTWARE, INCLUDING
30  * WITHOUT LIMITATION, ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
31  * PUNITIVE, OR CONSEQUENTIAL DAMAGES, PROCUREMENT OF SUBSTITUTE GOODS OR
32  * SERVICES, LOSS OF USE, DATA OR PROFITS, HOWEVER CAUSED AND UNDER ANY
33  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
34  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
35  * THIS SOFTWARE, EVEN IF WHISTLE COMMUNICATIONS IS ADVISED OF THE POSSIBILITY
36  * OF SUCH DAMAGE.
37  *
38  * Authors: Julian Elischer <julian@freebsd.org>
39  *          Archie Cobbs <archie@freebsd.org>
40  *
41  * $FreeBSD$
42  * $Whistle: ng_base.c,v 1.39 1999/01/28 23:54:53 julian Exp $
43  */
44 
45 /*
46  * This file implements the base netgraph code.
47  */
48 
49 #include <sys/param.h>
50 #include <sys/systm.h>
51 #include <sys/ctype.h>
52 #include <sys/errno.h>
53 #include <sys/kdb.h>
54 #include <sys/kernel.h>
55 #include <sys/ktr.h>
56 #include <sys/limits.h>
57 #include <sys/malloc.h>
58 #include <sys/mbuf.h>
59 #include <sys/queue.h>
60 #include <sys/sysctl.h>
61 #include <sys/syslog.h>
62 
63 #include <net/netisr.h>
64 
65 #include <netgraph/ng_message.h>
66 #include <netgraph/netgraph.h>
67 #include <netgraph/ng_parse.h>
68 
69 MODULE_VERSION(netgraph, NG_ABI_VERSION);
70 
71 /* List of all active nodes */
72 static LIST_HEAD(, ng_node) ng_nodelist;
73 static struct mtx	ng_nodelist_mtx;
74 
75 /* Mutex to protect topology events. */
76 static struct mtx	ng_topo_mtx;
77 
78 #ifdef	NETGRAPH_DEBUG
79 static struct mtx	ngq_mtx;	/* protects the queue item list */
80 
81 static SLIST_HEAD(, ng_node) ng_allnodes;
82 static LIST_HEAD(, ng_node) ng_freenodes; /* in debug, we never free() them */
83 static SLIST_HEAD(, ng_hook) ng_allhooks;
84 static LIST_HEAD(, ng_hook) ng_freehooks; /* in debug, we never free() them */
85 
86 static void ng_dumpitems(void);
87 static void ng_dumpnodes(void);
88 static void ng_dumphooks(void);
89 
90 #endif	/* NETGRAPH_DEBUG */
91 /*
92  * DEAD versions of the structures.
93  * In order to avoid races, it is sometimes neccesary to point
94  * at SOMETHING even though theoretically, the current entity is
95  * INVALID. Use these to avoid these races.
96  */
97 struct ng_type ng_deadtype = {
98 	NG_ABI_VERSION,
99 	"dead",
100 	NULL,	/* modevent */
101 	NULL,	/* constructor */
102 	NULL,	/* rcvmsg */
103 	NULL,	/* shutdown */
104 	NULL,	/* newhook */
105 	NULL,	/* findhook */
106 	NULL,	/* connect */
107 	NULL,	/* rcvdata */
108 	NULL,	/* disconnect */
109 	NULL, 	/* cmdlist */
110 };
111 
112 struct ng_node ng_deadnode = {
113 	"dead",
114 	&ng_deadtype,
115 	NGF_INVALID,
116 	1,	/* refs */
117 	0,	/* numhooks */
118 	NULL,	/* private */
119 	0,	/* ID */
120 	LIST_HEAD_INITIALIZER(ng_deadnode.hooks),
121 	{},	/* all_nodes list entry */
122 	{},	/* id hashtable list entry */
123 	{},	/* workqueue entry */
124 	{	0,
125 		{}, /* should never use! (should hang) */
126 		NULL,
127 		&ng_deadnode.nd_input_queue.queue,
128 		&ng_deadnode
129 	},
130 #ifdef	NETGRAPH_DEBUG
131 	ND_MAGIC,
132 	__FILE__,
133 	__LINE__,
134 	{NULL}
135 #endif	/* NETGRAPH_DEBUG */
136 };
137 
138 struct ng_hook ng_deadhook = {
139 	"dead",
140 	NULL,		/* private */
141 	HK_INVALID | HK_DEAD,
142 	1,		/* refs always >= 1 */
143 	0,		/* undefined data link type */
144 	&ng_deadhook,	/* Peer is self */
145 	&ng_deadnode,	/* attached to deadnode */
146 	{},		/* hooks list */
147 	NULL,		/* override rcvmsg() */
148 	NULL,		/* override rcvdata() */
149 #ifdef	NETGRAPH_DEBUG
150 	HK_MAGIC,
151 	__FILE__,
152 	__LINE__,
153 	{NULL}
154 #endif	/* NETGRAPH_DEBUG */
155 };
156 
157 /*
158  * END DEAD STRUCTURES
159  */
160 /* List nodes with unallocated work */
161 static TAILQ_HEAD(, ng_node) ng_worklist = TAILQ_HEAD_INITIALIZER(ng_worklist);
162 static struct mtx	ng_worklist_mtx;   /* MUST LOCK NODE FIRST */
163 
164 /* List of installed types */
165 static LIST_HEAD(, ng_type) ng_typelist;
166 static struct mtx	ng_typelist_mtx;
167 
168 /* Hash related definitions */
169 /* XXX Don't need to initialise them because it's a LIST */
170 #define NG_ID_HASH_SIZE 32 /* most systems wont need even this many */
171 static LIST_HEAD(, ng_node) ng_ID_hash[NG_ID_HASH_SIZE];
172 static struct mtx	ng_idhash_mtx;
173 /* Method to find a node.. used twice so do it here */
174 #define NG_IDHASH_FN(ID) ((ID) % (NG_ID_HASH_SIZE))
175 #define NG_IDHASH_FIND(ID, node)					\
176 	do { 								\
177 		mtx_assert(&ng_idhash_mtx, MA_OWNED);			\
178 		LIST_FOREACH(node, &ng_ID_hash[NG_IDHASH_FN(ID)],	\
179 						nd_idnodes) {		\
180 			if (NG_NODE_IS_VALID(node)			\
181 			&& (NG_NODE_ID(node) == ID)) {			\
182 				break;					\
183 			}						\
184 		}							\
185 	} while (0)
186 
187 
188 /* Internal functions */
189 static int	ng_add_hook(node_p node, const char *name, hook_p * hookp);
190 static int	ng_generic_msg(node_p here, item_p item, hook_p lasthook);
191 static ng_ID_t	ng_decodeidname(const char *name);
192 static int	ngb_mod_event(module_t mod, int event, void *data);
193 static void	ng_worklist_remove(node_p node);
194 static void	ngintr(void);
195 static int	ng_apply_item(node_p node, item_p item, int rw);
196 static void	ng_flush_input_queue(struct ng_queue * ngq);
197 static void	ng_setisr(node_p node);
198 static node_p	ng_ID2noderef(ng_ID_t ID);
199 static int	ng_con_nodes(node_p node, const char *name, node_p node2,
200 							const char *name2);
201 static void	ng_con_part2(node_p node, hook_p hook, void *arg1, int arg2);
202 static void	ng_con_part3(node_p node, hook_p hook, void *arg1, int arg2);
203 static int	ng_mkpeer(node_p node, const char *name,
204 						const char *name2, char *type);
205 
206 /* Imported, these used to be externally visible, some may go back. */
207 void	ng_destroy_hook(hook_p hook);
208 node_p	ng_name2noderef(node_p node, const char *name);
209 int	ng_path2noderef(node_p here, const char *path,
210 	node_p *dest, hook_p *lasthook);
211 int	ng_make_node(const char *type, node_p *nodepp);
212 int	ng_path_parse(char *addr, char **node, char **path, char **hook);
213 void	ng_rmnode(node_p node, hook_p dummy1, void *dummy2, int dummy3);
214 void	ng_unname(node_p node);
215 
216 
217 /* Our own netgraph malloc type */
218 MALLOC_DEFINE(M_NETGRAPH, "netgraph", "netgraph structures and ctrl messages");
219 MALLOC_DEFINE(M_NETGRAPH_HOOK, "netgraph_hook", "netgraph hook structures");
220 MALLOC_DEFINE(M_NETGRAPH_NODE, "netgraph_node", "netgraph node structures");
221 MALLOC_DEFINE(M_NETGRAPH_ITEM, "netgraph_item", "netgraph item structures");
222 MALLOC_DEFINE(M_NETGRAPH_MSG, "netgraph_msg", "netgraph name storage");
223 
224 /* Should not be visible outside this file */
225 
226 #define _NG_ALLOC_HOOK(hook) \
227 	MALLOC(hook, hook_p, sizeof(*hook), M_NETGRAPH_HOOK, M_NOWAIT | M_ZERO)
228 #define _NG_ALLOC_NODE(node) \
229 	MALLOC(node, node_p, sizeof(*node), M_NETGRAPH_NODE, M_NOWAIT | M_ZERO)
230 
231 #ifdef NETGRAPH_DEBUG /*----------------------------------------------*/
232 /*
233  * In debug mode:
234  * In an attempt to help track reference count screwups
235  * we do not free objects back to the malloc system, but keep them
236  * in a local cache where we can examine them and keep information safely
237  * after they have been freed.
238  * We use this scheme for nodes and hooks, and to some extent for items.
239  */
240 static __inline hook_p
241 ng_alloc_hook(void)
242 {
243 	hook_p hook;
244 	SLIST_ENTRY(ng_hook) temp;
245 	mtx_lock(&ng_nodelist_mtx);
246 	hook = LIST_FIRST(&ng_freehooks);
247 	if (hook) {
248 		LIST_REMOVE(hook, hk_hooks);
249 		bcopy(&hook->hk_all, &temp, sizeof(temp));
250 		bzero(hook, sizeof(struct ng_hook));
251 		bcopy(&temp, &hook->hk_all, sizeof(temp));
252 		mtx_unlock(&ng_nodelist_mtx);
253 		hook->hk_magic = HK_MAGIC;
254 	} else {
255 		mtx_unlock(&ng_nodelist_mtx);
256 		_NG_ALLOC_HOOK(hook);
257 		if (hook) {
258 			hook->hk_magic = HK_MAGIC;
259 			mtx_lock(&ng_nodelist_mtx);
260 			SLIST_INSERT_HEAD(&ng_allhooks, hook, hk_all);
261 			mtx_unlock(&ng_nodelist_mtx);
262 		}
263 	}
264 	return (hook);
265 }
266 
267 static __inline node_p
268 ng_alloc_node(void)
269 {
270 	node_p node;
271 	SLIST_ENTRY(ng_node) temp;
272 	mtx_lock(&ng_nodelist_mtx);
273 	node = LIST_FIRST(&ng_freenodes);
274 	if (node) {
275 		LIST_REMOVE(node, nd_nodes);
276 		bcopy(&node->nd_all, &temp, sizeof(temp));
277 		bzero(node, sizeof(struct ng_node));
278 		bcopy(&temp, &node->nd_all, sizeof(temp));
279 		mtx_unlock(&ng_nodelist_mtx);
280 		node->nd_magic = ND_MAGIC;
281 	} else {
282 		mtx_unlock(&ng_nodelist_mtx);
283 		_NG_ALLOC_NODE(node);
284 		if (node) {
285 			node->nd_magic = ND_MAGIC;
286 			mtx_lock(&ng_nodelist_mtx);
287 			SLIST_INSERT_HEAD(&ng_allnodes, node, nd_all);
288 			mtx_unlock(&ng_nodelist_mtx);
289 		}
290 	}
291 	return (node);
292 }
293 
294 #define NG_ALLOC_HOOK(hook) do { (hook) = ng_alloc_hook(); } while (0)
295 #define NG_ALLOC_NODE(node) do { (node) = ng_alloc_node(); } while (0)
296 
297 
298 #define NG_FREE_HOOK(hook)						\
299 	do {								\
300 		mtx_lock(&ng_nodelist_mtx);			\
301 		LIST_INSERT_HEAD(&ng_freehooks, hook, hk_hooks);	\
302 		hook->hk_magic = 0;					\
303 		mtx_unlock(&ng_nodelist_mtx);			\
304 	} while (0)
305 
306 #define NG_FREE_NODE(node)						\
307 	do {								\
308 		mtx_lock(&ng_nodelist_mtx);			\
309 		LIST_INSERT_HEAD(&ng_freenodes, node, nd_nodes);	\
310 		node->nd_magic = 0;					\
311 		mtx_unlock(&ng_nodelist_mtx);			\
312 	} while (0)
313 
314 #else /* NETGRAPH_DEBUG */ /*----------------------------------------------*/
315 
316 #define NG_ALLOC_HOOK(hook) _NG_ALLOC_HOOK(hook)
317 #define NG_ALLOC_NODE(node) _NG_ALLOC_NODE(node)
318 
319 #define NG_FREE_HOOK(hook) do { FREE((hook), M_NETGRAPH_HOOK); } while (0)
320 #define NG_FREE_NODE(node) do { FREE((node), M_NETGRAPH_NODE); } while (0)
321 
322 #endif /* NETGRAPH_DEBUG */ /*----------------------------------------------*/
323 
324 /* Set this to kdb_enter("X") to catch all errors as they occur */
325 #ifndef TRAP_ERROR
326 #define TRAP_ERROR()
327 #endif
328 
329 static	ng_ID_t nextID = 1;
330 
331 #ifdef INVARIANTS
332 #define CHECK_DATA_MBUF(m)	do {					\
333 		struct mbuf *n;						\
334 		int total;						\
335 									\
336 		M_ASSERTPKTHDR(m);					\
337 		for (total = 0, n = (m); n != NULL; n = n->m_next) {	\
338 			total += n->m_len;				\
339 			if (n->m_nextpkt != NULL)			\
340 				panic("%s: m_nextpkt", __func__);	\
341 		}							\
342 									\
343 		if ((m)->m_pkthdr.len != total) {			\
344 			panic("%s: %d != %d",				\
345 			    __func__, (m)->m_pkthdr.len, total);	\
346 		}							\
347 	} while (0)
348 #else
349 #define CHECK_DATA_MBUF(m)
350 #endif
351 
352 
353 /************************************************************************
354 	Parse type definitions for generic messages
355 ************************************************************************/
356 
357 /* Handy structure parse type defining macro */
358 #define DEFINE_PARSE_STRUCT_TYPE(lo, up, args)				\
359 static const struct ng_parse_struct_field				\
360 	ng_ ## lo ## _type_fields[] = NG_GENERIC_ ## up ## _INFO args;	\
361 static const struct ng_parse_type ng_generic_ ## lo ## _type = {	\
362 	&ng_parse_struct_type,						\
363 	&ng_ ## lo ## _type_fields					\
364 }
365 
366 DEFINE_PARSE_STRUCT_TYPE(mkpeer, MKPEER, ());
367 DEFINE_PARSE_STRUCT_TYPE(connect, CONNECT, ());
368 DEFINE_PARSE_STRUCT_TYPE(name, NAME, ());
369 DEFINE_PARSE_STRUCT_TYPE(rmhook, RMHOOK, ());
370 DEFINE_PARSE_STRUCT_TYPE(nodeinfo, NODEINFO, ());
371 DEFINE_PARSE_STRUCT_TYPE(typeinfo, TYPEINFO, ());
372 DEFINE_PARSE_STRUCT_TYPE(linkinfo, LINKINFO, (&ng_generic_nodeinfo_type));
373 
374 /* Get length of an array when the length is stored as a 32 bit
375    value immediately preceding the array -- as with struct namelist
376    and struct typelist. */
377 static int
378 ng_generic_list_getLength(const struct ng_parse_type *type,
379 	const u_char *start, const u_char *buf)
380 {
381 	return *((const u_int32_t *)(buf - 4));
382 }
383 
384 /* Get length of the array of struct linkinfo inside a struct hooklist */
385 static int
386 ng_generic_linkinfo_getLength(const struct ng_parse_type *type,
387 	const u_char *start, const u_char *buf)
388 {
389 	const struct hooklist *hl = (const struct hooklist *)start;
390 
391 	return hl->nodeinfo.hooks;
392 }
393 
394 /* Array type for a variable length array of struct namelist */
395 static const struct ng_parse_array_info ng_nodeinfoarray_type_info = {
396 	&ng_generic_nodeinfo_type,
397 	&ng_generic_list_getLength
398 };
399 static const struct ng_parse_type ng_generic_nodeinfoarray_type = {
400 	&ng_parse_array_type,
401 	&ng_nodeinfoarray_type_info
402 };
403 
404 /* Array type for a variable length array of struct typelist */
405 static const struct ng_parse_array_info ng_typeinfoarray_type_info = {
406 	&ng_generic_typeinfo_type,
407 	&ng_generic_list_getLength
408 };
409 static const struct ng_parse_type ng_generic_typeinfoarray_type = {
410 	&ng_parse_array_type,
411 	&ng_typeinfoarray_type_info
412 };
413 
414 /* Array type for array of struct linkinfo in struct hooklist */
415 static const struct ng_parse_array_info ng_generic_linkinfo_array_type_info = {
416 	&ng_generic_linkinfo_type,
417 	&ng_generic_linkinfo_getLength
418 };
419 static const struct ng_parse_type ng_generic_linkinfo_array_type = {
420 	&ng_parse_array_type,
421 	&ng_generic_linkinfo_array_type_info
422 };
423 
424 DEFINE_PARSE_STRUCT_TYPE(typelist, TYPELIST, (&ng_generic_nodeinfoarray_type));
425 DEFINE_PARSE_STRUCT_TYPE(hooklist, HOOKLIST,
426 	(&ng_generic_nodeinfo_type, &ng_generic_linkinfo_array_type));
427 DEFINE_PARSE_STRUCT_TYPE(listnodes, LISTNODES,
428 	(&ng_generic_nodeinfoarray_type));
429 
430 /* List of commands and how to convert arguments to/from ASCII */
431 static const struct ng_cmdlist ng_generic_cmds[] = {
432 	{
433 	  NGM_GENERIC_COOKIE,
434 	  NGM_SHUTDOWN,
435 	  "shutdown",
436 	  NULL,
437 	  NULL
438 	},
439 	{
440 	  NGM_GENERIC_COOKIE,
441 	  NGM_MKPEER,
442 	  "mkpeer",
443 	  &ng_generic_mkpeer_type,
444 	  NULL
445 	},
446 	{
447 	  NGM_GENERIC_COOKIE,
448 	  NGM_CONNECT,
449 	  "connect",
450 	  &ng_generic_connect_type,
451 	  NULL
452 	},
453 	{
454 	  NGM_GENERIC_COOKIE,
455 	  NGM_NAME,
456 	  "name",
457 	  &ng_generic_name_type,
458 	  NULL
459 	},
460 	{
461 	  NGM_GENERIC_COOKIE,
462 	  NGM_RMHOOK,
463 	  "rmhook",
464 	  &ng_generic_rmhook_type,
465 	  NULL
466 	},
467 	{
468 	  NGM_GENERIC_COOKIE,
469 	  NGM_NODEINFO,
470 	  "nodeinfo",
471 	  NULL,
472 	  &ng_generic_nodeinfo_type
473 	},
474 	{
475 	  NGM_GENERIC_COOKIE,
476 	  NGM_LISTHOOKS,
477 	  "listhooks",
478 	  NULL,
479 	  &ng_generic_hooklist_type
480 	},
481 	{
482 	  NGM_GENERIC_COOKIE,
483 	  NGM_LISTNAMES,
484 	  "listnames",
485 	  NULL,
486 	  &ng_generic_listnodes_type	/* same as NGM_LISTNODES */
487 	},
488 	{
489 	  NGM_GENERIC_COOKIE,
490 	  NGM_LISTNODES,
491 	  "listnodes",
492 	  NULL,
493 	  &ng_generic_listnodes_type
494 	},
495 	{
496 	  NGM_GENERIC_COOKIE,
497 	  NGM_LISTTYPES,
498 	  "listtypes",
499 	  NULL,
500 	  &ng_generic_typeinfo_type
501 	},
502 	{
503 	  NGM_GENERIC_COOKIE,
504 	  NGM_TEXT_CONFIG,
505 	  "textconfig",
506 	  NULL,
507 	  &ng_parse_string_type
508 	},
509 	{
510 	  NGM_GENERIC_COOKIE,
511 	  NGM_TEXT_STATUS,
512 	  "textstatus",
513 	  NULL,
514 	  &ng_parse_string_type
515 	},
516 	{
517 	  NGM_GENERIC_COOKIE,
518 	  NGM_ASCII2BINARY,
519 	  "ascii2binary",
520 	  &ng_parse_ng_mesg_type,
521 	  &ng_parse_ng_mesg_type
522 	},
523 	{
524 	  NGM_GENERIC_COOKIE,
525 	  NGM_BINARY2ASCII,
526 	  "binary2ascii",
527 	  &ng_parse_ng_mesg_type,
528 	  &ng_parse_ng_mesg_type
529 	},
530 	{ 0 }
531 };
532 
533 /************************************************************************
534 			Node routines
535 ************************************************************************/
536 
537 /*
538  * Instantiate a node of the requested type
539  */
540 int
541 ng_make_node(const char *typename, node_p *nodepp)
542 {
543 	struct ng_type *type;
544 	int	error;
545 
546 	/* Check that the type makes sense */
547 	if (typename == NULL) {
548 		TRAP_ERROR();
549 		return (EINVAL);
550 	}
551 
552 	/* Locate the node type. If we fail we return. Do not try to load
553 	 * module.
554 	 */
555 	if ((type = ng_findtype(typename)) == NULL)
556 		return (ENXIO);
557 
558 	/*
559 	 * If we have a constructor, then make the node and
560 	 * call the constructor to do type specific initialisation.
561 	 */
562 	if (type->constructor != NULL) {
563 		if ((error = ng_make_node_common(type, nodepp)) == 0) {
564 			if ((error = ((*type->constructor)(*nodepp)) != 0)) {
565 				NG_NODE_UNREF(*nodepp);
566 			}
567 		}
568 	} else {
569 		/*
570 		 * Node has no constructor. We cannot ask for one
571 		 * to be made. It must be brought into existance by
572 		 * some external agency. The external agency should
573 		 * call ng_make_node_common() directly to get the
574 		 * netgraph part initialised.
575 		 */
576 		TRAP_ERROR();
577 		error = EINVAL;
578 	}
579 	return (error);
580 }
581 
582 /*
583  * Generic node creation. Called by node initialisation for externally
584  * instantiated nodes (e.g. hardware, sockets, etc ).
585  * The returned node has a reference count of 1.
586  */
587 int
588 ng_make_node_common(struct ng_type *type, node_p *nodepp)
589 {
590 	node_p node;
591 
592 	/* Require the node type to have been already installed */
593 	if (ng_findtype(type->name) == NULL) {
594 		TRAP_ERROR();
595 		return (EINVAL);
596 	}
597 
598 	/* Make a node and try attach it to the type */
599 	NG_ALLOC_NODE(node);
600 	if (node == NULL) {
601 		TRAP_ERROR();
602 		return (ENOMEM);
603 	}
604 	node->nd_type = type;
605 	NG_NODE_REF(node);				/* note reference */
606 	type->refs++;
607 
608 	mtx_init(&node->nd_input_queue.q_mtx, "ng_node", NULL, MTX_SPIN);
609 	node->nd_input_queue.queue = NULL;
610 	node->nd_input_queue.last = &node->nd_input_queue.queue;
611 	node->nd_input_queue.q_flags = 0;
612 	node->nd_input_queue.q_node = node;
613 
614 	/* Initialize hook list for new node */
615 	LIST_INIT(&node->nd_hooks);
616 
617 	/* Link us into the node linked list */
618 	mtx_lock(&ng_nodelist_mtx);
619 	LIST_INSERT_HEAD(&ng_nodelist, node, nd_nodes);
620 	mtx_unlock(&ng_nodelist_mtx);
621 
622 
623 	/* get an ID and put us in the hash chain */
624 	mtx_lock(&ng_idhash_mtx);
625 	for (;;) { /* wrap protection, even if silly */
626 		node_p node2 = NULL;
627 		node->nd_ID = nextID++; /* 137/second for 1 year before wrap */
628 
629 		/* Is there a problem with the new number? */
630 		NG_IDHASH_FIND(node->nd_ID, node2); /* already taken? */
631 		if ((node->nd_ID != 0) && (node2 == NULL)) {
632 			break;
633 		}
634 	}
635 	LIST_INSERT_HEAD(&ng_ID_hash[NG_IDHASH_FN(node->nd_ID)],
636 							node, nd_idnodes);
637 	mtx_unlock(&ng_idhash_mtx);
638 
639 	/* Done */
640 	*nodepp = node;
641 	return (0);
642 }
643 
644 /*
645  * Forceably start the shutdown process on a node. Either call
646  * it's shutdown method, or do the default shutdown if there is
647  * no type-specific method.
648  *
649  * We can only be called form a shutdown message, so we know we have
650  * a writer lock, and therefore exclusive access. It also means
651  * that we should not be on the work queue, but we check anyhow.
652  *
653  * Persistent node types must have a type-specific method which
654  * Allocates a new node in which case, this one is irretrievably going away,
655  * or cleans up anything it needs, and just makes the node valid again,
656  * in which case we allow the node to survive.
657  *
658  * XXX We need to think of how to tell a persistant node that we
659  * REALLY need to go away because the hardware has gone or we
660  * are rebooting.... etc.
661  */
662 void
663 ng_rmnode(node_p node, hook_p dummy1, void *dummy2, int dummy3)
664 {
665 	hook_p hook;
666 
667 	/* Check if it's already shutting down */
668 	if ((node->nd_flags & NGF_CLOSING) != 0)
669 		return;
670 
671 	if (node == &ng_deadnode) {
672 		printf ("shutdown called on deadnode\n");
673 		return;
674 	}
675 
676 	/* Add an extra reference so it doesn't go away during this */
677 	NG_NODE_REF(node);
678 
679 	/*
680 	 * Mark it invalid so any newcomers know not to try use it
681 	 * Also add our own mark so we can't recurse
682 	 * note that NGF_INVALID does not do this as it's also set during
683 	 * creation
684 	 */
685 	node->nd_flags |= NGF_INVALID|NGF_CLOSING;
686 
687 	/* If node has its pre-shutdown method, then call it first*/
688 	if (node->nd_type && node->nd_type->close)
689 		(*node->nd_type->close)(node);
690 
691 	/* Notify all remaining connected nodes to disconnect */
692 	while ((hook = LIST_FIRST(&node->nd_hooks)) != NULL)
693 		ng_destroy_hook(hook);
694 
695 	/*
696 	 * Drain the input queue forceably.
697 	 * it has no hooks so what's it going to do, bleed on someone?
698 	 * Theoretically we came here from a queue entry that was added
699 	 * Just before the queue was closed, so it should be empty anyway.
700 	 * Also removes us from worklist if needed.
701 	 */
702 	ng_flush_input_queue(&node->nd_input_queue);
703 
704 	/* Ask the type if it has anything to do in this case */
705 	if (node->nd_type && node->nd_type->shutdown) {
706 		(*node->nd_type->shutdown)(node);
707 		if (NG_NODE_IS_VALID(node)) {
708 			/*
709 			 * Well, blow me down if the node code hasn't declared
710 			 * that it doesn't want to die.
711 			 * Presumably it is a persistant node.
712 			 * If we REALLY want it to go away,
713 			 *  e.g. hardware going away,
714 			 * Our caller should set NGF_REALLY_DIE in nd_flags.
715 			 */
716 			node->nd_flags &= ~(NGF_INVALID|NGF_CLOSING);
717 			NG_NODE_UNREF(node); /* Assume they still have theirs */
718 			return;
719 		}
720 	} else {				/* do the default thing */
721 		NG_NODE_UNREF(node);
722 	}
723 
724 	ng_unname(node); /* basically a NOP these days */
725 
726 	/*
727 	 * Remove extra reference, possibly the last
728 	 * Possible other holders of references may include
729 	 * timeout callouts, but theoretically the node's supposed to
730 	 * have cancelled them. Possibly hardware dependencies may
731 	 * force a driver to 'linger' with a reference.
732 	 */
733 	NG_NODE_UNREF(node);
734 }
735 
736 /*
737  * Remove a reference to the node, possibly the last.
738  * deadnode always acts as it it were the last.
739  */
740 int
741 ng_unref_node(node_p node)
742 {
743 	int v;
744 
745 	if (node == &ng_deadnode) {
746 		return (0);
747 	}
748 
749 	do {
750 		v = node->nd_refs - 1;
751 	} while (! atomic_cmpset_int(&node->nd_refs, v + 1, v));
752 
753 	if (v == 0) { /* we were the last */
754 
755 		mtx_lock(&ng_nodelist_mtx);
756 		node->nd_type->refs--; /* XXX maybe should get types lock? */
757 		LIST_REMOVE(node, nd_nodes);
758 		mtx_unlock(&ng_nodelist_mtx);
759 
760 		mtx_lock(&ng_idhash_mtx);
761 		LIST_REMOVE(node, nd_idnodes);
762 		mtx_unlock(&ng_idhash_mtx);
763 
764 		mtx_destroy(&node->nd_input_queue.q_mtx);
765 		NG_FREE_NODE(node);
766 	}
767 	return (v);
768 }
769 
770 /************************************************************************
771 			Node ID handling
772 ************************************************************************/
773 static node_p
774 ng_ID2noderef(ng_ID_t ID)
775 {
776 	node_p node;
777 	mtx_lock(&ng_idhash_mtx);
778 	NG_IDHASH_FIND(ID, node);
779 	if(node)
780 		NG_NODE_REF(node);
781 	mtx_unlock(&ng_idhash_mtx);
782 	return(node);
783 }
784 
785 ng_ID_t
786 ng_node2ID(node_p node)
787 {
788 	return (node ? NG_NODE_ID(node) : 0);
789 }
790 
791 /************************************************************************
792 			Node name handling
793 ************************************************************************/
794 
795 /*
796  * Assign a node a name. Once assigned, the name cannot be changed.
797  */
798 int
799 ng_name_node(node_p node, const char *name)
800 {
801 	int i;
802 	node_p node2;
803 
804 	/* Check the name is valid */
805 	for (i = 0; i < NG_NODESIZ; i++) {
806 		if (name[i] == '\0' || name[i] == '.' || name[i] == ':')
807 			break;
808 	}
809 	if (i == 0 || name[i] != '\0') {
810 		TRAP_ERROR();
811 		return (EINVAL);
812 	}
813 	if (ng_decodeidname(name) != 0) { /* valid IDs not allowed here */
814 		TRAP_ERROR();
815 		return (EINVAL);
816 	}
817 
818 	/* Check the name isn't already being used */
819 	if ((node2 = ng_name2noderef(node, name)) != NULL) {
820 		NG_NODE_UNREF(node2);
821 		TRAP_ERROR();
822 		return (EADDRINUSE);
823 	}
824 
825 	/* copy it */
826 	strlcpy(NG_NODE_NAME(node), name, NG_NODESIZ);
827 
828 	return (0);
829 }
830 
831 /*
832  * Find a node by absolute name. The name should NOT end with ':'
833  * The name "." means "this node" and "[xxx]" means "the node
834  * with ID (ie, at address) xxx".
835  *
836  * Returns the node if found, else NULL.
837  * Eventually should add something faster than a sequential search.
838  * Note it aquires a reference on the node so you can be sure it's still there.
839  */
840 node_p
841 ng_name2noderef(node_p here, const char *name)
842 {
843 	node_p node;
844 	ng_ID_t temp;
845 
846 	/* "." means "this node" */
847 	if (strcmp(name, ".") == 0) {
848 		NG_NODE_REF(here);
849 		return(here);
850 	}
851 
852 	/* Check for name-by-ID */
853 	if ((temp = ng_decodeidname(name)) != 0) {
854 		return (ng_ID2noderef(temp));
855 	}
856 
857 	/* Find node by name */
858 	mtx_lock(&ng_nodelist_mtx);
859 	LIST_FOREACH(node, &ng_nodelist, nd_nodes) {
860 		if (NG_NODE_IS_VALID(node)
861 		&& NG_NODE_HAS_NAME(node)
862 		&& (strcmp(NG_NODE_NAME(node), name) == 0)) {
863 			break;
864 		}
865 	}
866 	if (node)
867 		NG_NODE_REF(node);
868 	mtx_unlock(&ng_nodelist_mtx);
869 	return (node);
870 }
871 
872 /*
873  * Decode an ID name, eg. "[f03034de]". Returns 0 if the
874  * string is not valid, otherwise returns the value.
875  */
876 static ng_ID_t
877 ng_decodeidname(const char *name)
878 {
879 	const int len = strlen(name);
880 	char *eptr;
881 	u_long val;
882 
883 	/* Check for proper length, brackets, no leading junk */
884 	if ((len < 3)
885 	|| (name[0] != '[')
886 	|| (name[len - 1] != ']')
887 	|| (!isxdigit(name[1]))) {
888 		return ((ng_ID_t)0);
889 	}
890 
891 	/* Decode number */
892 	val = strtoul(name + 1, &eptr, 16);
893 	if ((eptr - name != len - 1)
894 	|| (val == ULONG_MAX)
895 	|| (val == 0)) {
896 		return ((ng_ID_t)0);
897 	}
898 	return (ng_ID_t)val;
899 }
900 
901 /*
902  * Remove a name from a node. This should only be called
903  * when shutting down and removing the node.
904  * IF we allow name changing this may be more resurected.
905  */
906 void
907 ng_unname(node_p node)
908 {
909 }
910 
911 /************************************************************************
912 			Hook routines
913  Names are not optional. Hooks are always connected, except for a
914  brief moment within these routines. On invalidation or during creation
915  they are connected to the 'dead' hook.
916 ************************************************************************/
917 
918 /*
919  * Remove a hook reference
920  */
921 void
922 ng_unref_hook(hook_p hook)
923 {
924 	int v;
925 
926 	if (hook == &ng_deadhook) {
927 		return;
928 	}
929 	do {
930 		v = hook->hk_refs;
931 	} while (! atomic_cmpset_int(&hook->hk_refs, v, v - 1));
932 
933 	if (v == 1) { /* we were the last */
934 		if (_NG_HOOK_NODE(hook)) { /* it'll probably be ng_deadnode */
935 			_NG_NODE_UNREF((_NG_HOOK_NODE(hook)));
936 			hook->hk_node = NULL;
937 		}
938 		NG_FREE_HOOK(hook);
939 	}
940 }
941 
942 /*
943  * Add an unconnected hook to a node. Only used internally.
944  * Assumes node is locked. (XXX not yet true )
945  */
946 static int
947 ng_add_hook(node_p node, const char *name, hook_p *hookp)
948 {
949 	hook_p hook;
950 	int error = 0;
951 
952 	/* Check that the given name is good */
953 	if (name == NULL) {
954 		TRAP_ERROR();
955 		return (EINVAL);
956 	}
957 	if (ng_findhook(node, name) != NULL) {
958 		TRAP_ERROR();
959 		return (EEXIST);
960 	}
961 
962 	/* Allocate the hook and link it up */
963 	NG_ALLOC_HOOK(hook);
964 	if (hook == NULL) {
965 		TRAP_ERROR();
966 		return (ENOMEM);
967 	}
968 	hook->hk_refs = 1;		/* add a reference for us to return */
969 	hook->hk_flags = HK_INVALID;
970 	hook->hk_peer = &ng_deadhook;	/* start off this way */
971 	hook->hk_node = node;
972 	NG_NODE_REF(node);		/* each hook counts as a reference */
973 
974 	/* Set hook name */
975 	strlcpy(NG_HOOK_NAME(hook), name, NG_HOOKSIZ);
976 
977 	/*
978 	 * Check if the node type code has something to say about it
979 	 * If it fails, the unref of the hook will also unref the node.
980 	 */
981 	if (node->nd_type->newhook != NULL) {
982 		if ((error = (*node->nd_type->newhook)(node, hook, name))) {
983 			NG_HOOK_UNREF(hook);	/* this frees the hook */
984 			return (error);
985 		}
986 	}
987 	/*
988 	 * The 'type' agrees so far, so go ahead and link it in.
989 	 * We'll ask again later when we actually connect the hooks.
990 	 */
991 	LIST_INSERT_HEAD(&node->nd_hooks, hook, hk_hooks);
992 	node->nd_numhooks++;
993 	NG_HOOK_REF(hook);	/* one for the node */
994 
995 	if (hookp)
996 		*hookp = hook;
997 	return (0);
998 }
999 
1000 /*
1001  * Find a hook
1002  *
1003  * Node types may supply their own optimized routines for finding
1004  * hooks.  If none is supplied, we just do a linear search.
1005  * XXX Possibly we should add a reference to the hook?
1006  */
1007 hook_p
1008 ng_findhook(node_p node, const char *name)
1009 {
1010 	hook_p hook;
1011 
1012 	if (node->nd_type->findhook != NULL)
1013 		return (*node->nd_type->findhook)(node, name);
1014 	LIST_FOREACH(hook, &node->nd_hooks, hk_hooks) {
1015 		if (NG_HOOK_IS_VALID(hook)
1016 		&& (strcmp(NG_HOOK_NAME(hook), name) == 0))
1017 			return (hook);
1018 	}
1019 	return (NULL);
1020 }
1021 
1022 /*
1023  * Destroy a hook
1024  *
1025  * As hooks are always attached, this really destroys two hooks.
1026  * The one given, and the one attached to it. Disconnect the hooks
1027  * from each other first. We reconnect the peer hook to the 'dead'
1028  * hook so that it can still exist after we depart. We then
1029  * send the peer its own destroy message. This ensures that we only
1030  * interact with the peer's structures when it is locked processing that
1031  * message. We hold a reference to the peer hook so we are guaranteed that
1032  * the peer hook and node are still going to exist until
1033  * we are finished there as the hook holds a ref on the node.
1034  * We run this same code again on the peer hook, but that time it is already
1035  * attached to the 'dead' hook.
1036  *
1037  * This routine is called at all stages of hook creation
1038  * on error detection and must be able to handle any such stage.
1039  */
1040 void
1041 ng_destroy_hook(hook_p hook)
1042 {
1043 	hook_p peer;
1044 	node_p node;
1045 
1046 	if (hook == &ng_deadhook) {	/* better safe than sorry */
1047 		printf("ng_destroy_hook called on deadhook\n");
1048 		return;
1049 	}
1050 
1051 	/*
1052 	 * Protect divorce process with mutex, to avoid races on
1053 	 * simultaneous disconnect.
1054 	 */
1055 	mtx_lock(&ng_topo_mtx);
1056 
1057 	hook->hk_flags |= HK_INVALID;
1058 
1059 	peer = NG_HOOK_PEER(hook);
1060 	node = NG_HOOK_NODE(hook);
1061 
1062 	if (peer && (peer != &ng_deadhook)) {
1063 		/*
1064 		 * Set the peer to point to ng_deadhook
1065 		 * from this moment on we are effectively independent it.
1066 		 * send it an rmhook message of it's own.
1067 		 */
1068 		peer->hk_peer = &ng_deadhook;	/* They no longer know us */
1069 		hook->hk_peer = &ng_deadhook;	/* Nor us, them */
1070 		if (NG_HOOK_NODE(peer) == &ng_deadnode) {
1071 			/*
1072 			 * If it's already divorced from a node,
1073 			 * just free it.
1074 			 */
1075 			mtx_unlock(&ng_topo_mtx);
1076 		} else {
1077 			mtx_unlock(&ng_topo_mtx);
1078 			ng_rmhook_self(peer); 	/* Send it a surprise */
1079 		}
1080 		NG_HOOK_UNREF(peer);		/* account for peer link */
1081 		NG_HOOK_UNREF(hook);		/* account for peer link */
1082 	} else
1083 		mtx_unlock(&ng_topo_mtx);
1084 
1085 	mtx_assert(&ng_topo_mtx, MA_NOTOWNED);
1086 
1087 	/*
1088 	 * Remove the hook from the node's list to avoid possible recursion
1089 	 * in case the disconnection results in node shutdown.
1090 	 */
1091 	if (node == &ng_deadnode) { /* happens if called from ng_con_nodes() */
1092 		return;
1093 	}
1094 	LIST_REMOVE(hook, hk_hooks);
1095 	node->nd_numhooks--;
1096 	if (node->nd_type->disconnect) {
1097 		/*
1098 		 * The type handler may elect to destroy the node so don't
1099 		 * trust its existance after this point. (except
1100 		 * that we still hold a reference on it. (which we
1101 		 * inherrited from the hook we are destroying)
1102 		 */
1103 		(*node->nd_type->disconnect) (hook);
1104 	}
1105 
1106 	/*
1107 	 * Note that because we will point to ng_deadnode, the original node
1108 	 * is not decremented automatically so we do that manually.
1109 	 */
1110 	_NG_HOOK_NODE(hook) = &ng_deadnode;
1111 	NG_NODE_UNREF(node);	/* We no longer point to it so adjust count */
1112 	NG_HOOK_UNREF(hook);	/* Account for linkage (in list) to node */
1113 }
1114 
1115 /*
1116  * Take two hooks on a node and merge the connection so that the given node
1117  * is effectively bypassed.
1118  */
1119 int
1120 ng_bypass(hook_p hook1, hook_p hook2)
1121 {
1122 	if (hook1->hk_node != hook2->hk_node) {
1123 		TRAP_ERROR();
1124 		return (EINVAL);
1125 	}
1126 	hook1->hk_peer->hk_peer = hook2->hk_peer;
1127 	hook2->hk_peer->hk_peer = hook1->hk_peer;
1128 
1129 	hook1->hk_peer = &ng_deadhook;
1130 	hook2->hk_peer = &ng_deadhook;
1131 
1132 	NG_HOOK_UNREF(hook1);
1133 	NG_HOOK_UNREF(hook2);
1134 
1135 	/* XXX If we ever cache methods on hooks update them as well */
1136 	ng_destroy_hook(hook1);
1137 	ng_destroy_hook(hook2);
1138 	return (0);
1139 }
1140 
1141 /*
1142  * Install a new netgraph type
1143  */
1144 int
1145 ng_newtype(struct ng_type *tp)
1146 {
1147 	const size_t namelen = strlen(tp->name);
1148 
1149 	/* Check version and type name fields */
1150 	if ((tp->version != NG_ABI_VERSION)
1151 	|| (namelen == 0)
1152 	|| (namelen >= NG_TYPESIZ)) {
1153 		TRAP_ERROR();
1154 		if (tp->version != NG_ABI_VERSION) {
1155 			printf("Netgraph: Node type rejected. ABI mismatch. Suggest recompile\n");
1156 		}
1157 		return (EINVAL);
1158 	}
1159 
1160 	/* Check for name collision */
1161 	if (ng_findtype(tp->name) != NULL) {
1162 		TRAP_ERROR();
1163 		return (EEXIST);
1164 	}
1165 
1166 
1167 	/* Link in new type */
1168 	mtx_lock(&ng_typelist_mtx);
1169 	LIST_INSERT_HEAD(&ng_typelist, tp, types);
1170 	tp->refs = 1;	/* first ref is linked list */
1171 	mtx_unlock(&ng_typelist_mtx);
1172 	return (0);
1173 }
1174 
1175 /*
1176  * unlink a netgraph type
1177  * If no examples exist
1178  */
1179 int
1180 ng_rmtype(struct ng_type *tp)
1181 {
1182 	/* Check for name collision */
1183 	if (tp->refs != 1) {
1184 		TRAP_ERROR();
1185 		return (EBUSY);
1186 	}
1187 
1188 	/* Unlink type */
1189 	mtx_lock(&ng_typelist_mtx);
1190 	LIST_REMOVE(tp, types);
1191 	mtx_unlock(&ng_typelist_mtx);
1192 	return (0);
1193 }
1194 
1195 /*
1196  * Look for a type of the name given
1197  */
1198 struct ng_type *
1199 ng_findtype(const char *typename)
1200 {
1201 	struct ng_type *type;
1202 
1203 	mtx_lock(&ng_typelist_mtx);
1204 	LIST_FOREACH(type, &ng_typelist, types) {
1205 		if (strcmp(type->name, typename) == 0)
1206 			break;
1207 	}
1208 	mtx_unlock(&ng_typelist_mtx);
1209 	return (type);
1210 }
1211 
1212 /************************************************************************
1213 			Composite routines
1214 ************************************************************************/
1215 /*
1216  * Connect two nodes using the specified hooks, using queued functions.
1217  */
1218 static void
1219 ng_con_part3(node_p node, hook_p hook, void *arg1, int arg2)
1220 {
1221 
1222 	/*
1223 	 * When we run, we know that the node 'node' is locked for us.
1224 	 * Our caller has a reference on the hook.
1225 	 * Our caller has a reference on the node.
1226 	 * (In this case our caller is ng_apply_item() ).
1227 	 * The peer hook has a reference on the hook.
1228 	 * We are all set up except for the final call to the node, and
1229 	 * the clearing of the INVALID flag.
1230 	 */
1231 	if (NG_HOOK_NODE(hook) == &ng_deadnode) {
1232 		/*
1233 		 * The node must have been freed again since we last visited
1234 		 * here. ng_destry_hook() has this effect but nothing else does.
1235 		 * We should just release our references and
1236 		 * free anything we can think of.
1237 		 * Since we know it's been destroyed, and it's our caller
1238 		 * that holds the references, just return.
1239 		 */
1240 		return ;
1241 	}
1242 	if (hook->hk_node->nd_type->connect) {
1243 		if ((*hook->hk_node->nd_type->connect) (hook)) {
1244 			ng_destroy_hook(hook);	/* also zaps peer */
1245 			printf("failed in ng_con_part3()\n");
1246 			return ;
1247 		}
1248 	}
1249 	/*
1250 	 *  XXX this is wrong for SMP. Possibly we need
1251 	 * to separate out 'create' and 'invalid' flags.
1252 	 * should only set flags on hooks we have locked under our node.
1253 	 */
1254 	hook->hk_flags &= ~HK_INVALID;
1255 	return ;
1256 }
1257 
1258 static void
1259 ng_con_part2(node_p node, hook_p hook, void *arg1, int arg2)
1260 {
1261 	hook_p peer;
1262 
1263 	/*
1264 	 * When we run, we know that the node 'node' is locked for us.
1265 	 * Our caller has a reference on the hook.
1266 	 * Our caller has a reference on the node.
1267 	 * (In this case our caller is ng_apply_item() ).
1268 	 * The peer hook has a reference on the hook.
1269 	 * our node pointer points to the 'dead' node.
1270 	 * First check the hook name is unique.
1271 	 * Should not happen because we checked before queueing this.
1272 	 */
1273 	if (ng_findhook(node, NG_HOOK_NAME(hook)) != NULL) {
1274 		TRAP_ERROR();
1275 		ng_destroy_hook(hook); /* should destroy peer too */
1276 		printf("failed in ng_con_part2()\n");
1277 		return ;
1278 	}
1279 	/*
1280 	 * Check if the node type code has something to say about it
1281 	 * If it fails, the unref of the hook will also unref the attached node,
1282 	 * however since that node is 'ng_deadnode' this will do nothing.
1283 	 * The peer hook will also be destroyed.
1284 	 */
1285 	if (node->nd_type->newhook != NULL) {
1286 		if ((*node->nd_type->newhook)(node, hook, hook->hk_name)) {
1287 			ng_destroy_hook(hook); /* should destroy peer too */
1288 			printf("failed in ng_con_part2()\n");
1289 			return ;
1290 		}
1291 	}
1292 
1293 	/*
1294 	 * The 'type' agrees so far, so go ahead and link it in.
1295 	 * We'll ask again later when we actually connect the hooks.
1296 	 */
1297 	hook->hk_node = node;		/* just overwrite ng_deadnode */
1298 	NG_NODE_REF(node);		/* each hook counts as a reference */
1299 	LIST_INSERT_HEAD(&node->nd_hooks, hook, hk_hooks);
1300 	node->nd_numhooks++;
1301 	NG_HOOK_REF(hook);	/* one for the node */
1302 
1303 	/*
1304 	 * We now have a symetrical situation, where both hooks have been
1305 	 * linked to their nodes, the newhook methods have been called
1306 	 * And the references are all correct. The hooks are still marked
1307 	 * as invalid, as we have not called the 'connect' methods
1308 	 * yet.
1309 	 * We can call the local one immediatly as we have the
1310 	 * node locked, but we need to queue the remote one.
1311 	 */
1312 	if (hook->hk_node->nd_type->connect) {
1313 		if ((*hook->hk_node->nd_type->connect) (hook)) {
1314 			ng_destroy_hook(hook);	/* also zaps peer */
1315 			printf("failed in ng_con_part2(A)\n");
1316 			return ;
1317 		}
1318 	}
1319 
1320 	/*
1321 	 * Acquire topo mutex to avoid race with ng_destroy_hook().
1322 	 */
1323 	mtx_lock(&ng_topo_mtx);
1324 	peer = hook->hk_peer;
1325 	if (peer == &ng_deadhook) {
1326 		mtx_unlock(&ng_topo_mtx);
1327 		printf("failed in ng_con_part2(B)\n");
1328 		ng_destroy_hook(hook);
1329 		return ;
1330 	}
1331 	mtx_unlock(&ng_topo_mtx);
1332 
1333 	if (ng_send_fn(peer->hk_node, peer, &ng_con_part3, arg1, arg2)) {
1334 		printf("failed in ng_con_part2(C)\n");
1335 		ng_destroy_hook(hook);	/* also zaps peer */
1336 		return ;
1337 	}
1338 	hook->hk_flags &= ~HK_INVALID; /* need both to be able to work */
1339 	return ;
1340 }
1341 
1342 /*
1343  * Connect this node with another node. We assume that this node is
1344  * currently locked, as we are only called from an NGM_CONNECT message.
1345  */
1346 static int
1347 ng_con_nodes(node_p node, const char *name, node_p node2, const char *name2)
1348 {
1349 	int	error;
1350 	hook_p	hook;
1351 	hook_p	hook2;
1352 
1353 	if (ng_findhook(node2, name2) != NULL) {
1354 		return(EEXIST);
1355 	}
1356 	if ((error = ng_add_hook(node, name, &hook)))  /* gives us a ref */
1357 		return (error);
1358 	/* Allocate the other hook and link it up */
1359 	NG_ALLOC_HOOK(hook2);
1360 	if (hook2 == NULL) {
1361 		TRAP_ERROR();
1362 		ng_destroy_hook(hook);	/* XXX check ref counts so far */
1363 		NG_HOOK_UNREF(hook);	/* including our ref */
1364 		return (ENOMEM);
1365 	}
1366 	hook2->hk_refs = 1;		/* start with a reference for us. */
1367 	hook2->hk_flags = HK_INVALID;
1368 	hook2->hk_peer = hook;		/* Link the two together */
1369 	hook->hk_peer = hook2;
1370 	NG_HOOK_REF(hook);		/* Add a ref for the peer to each*/
1371 	NG_HOOK_REF(hook2);
1372 	hook2->hk_node = &ng_deadnode;
1373 	strlcpy(NG_HOOK_NAME(hook2), name2, NG_HOOKSIZ);
1374 
1375 	/*
1376 	 * Queue the function above.
1377 	 * Procesing continues in that function in the lock context of
1378 	 * the other node.
1379 	 */
1380 	ng_send_fn(node2, hook2, &ng_con_part2, NULL, 0);
1381 
1382 	NG_HOOK_UNREF(hook);		/* Let each hook go if it wants to */
1383 	NG_HOOK_UNREF(hook2);
1384 	return (0);
1385 }
1386 
1387 /*
1388  * Make a peer and connect.
1389  * We assume that the local node is locked.
1390  * The new node probably doesn't need a lock until
1391  * it has a hook, because it cannot really have any work until then,
1392  * but we should think about it a bit more.
1393  *
1394  * The problem may come if the other node also fires up
1395  * some hardware or a timer or some other source of activation,
1396  * also it may already get a command msg via it's ID.
1397  *
1398  * We could use the same method as ng_con_nodes() but we'd have
1399  * to add ability to remove the node when failing. (Not hard, just
1400  * make arg1 point to the node to remove).
1401  * Unless of course we just ignore failure to connect and leave
1402  * an unconnected node?
1403  */
1404 static int
1405 ng_mkpeer(node_p node, const char *name, const char *name2, char *type)
1406 {
1407 	node_p	node2;
1408 	hook_p	hook1, hook2;
1409 	int	error;
1410 
1411 	if ((error = ng_make_node(type, &node2))) {
1412 		return (error);
1413 	}
1414 
1415 	if ((error = ng_add_hook(node, name, &hook1))) { /* gives us a ref */
1416 		ng_rmnode(node2, NULL, NULL, 0);
1417 		return (error);
1418 	}
1419 
1420 	if ((error = ng_add_hook(node2, name2, &hook2))) {
1421 		ng_rmnode(node2, NULL, NULL, 0);
1422 		ng_destroy_hook(hook1);
1423 		NG_HOOK_UNREF(hook1);
1424 		return (error);
1425 	}
1426 
1427 	/*
1428 	 * Actually link the two hooks together.
1429 	 */
1430 	hook1->hk_peer = hook2;
1431 	hook2->hk_peer = hook1;
1432 
1433 	/* Each hook is referenced by the other */
1434 	NG_HOOK_REF(hook1);
1435 	NG_HOOK_REF(hook2);
1436 
1437 	/* Give each node the opportunity to veto the pending connection */
1438 	if (hook1->hk_node->nd_type->connect) {
1439 		error = (*hook1->hk_node->nd_type->connect) (hook1);
1440 	}
1441 
1442 	if ((error == 0) && hook2->hk_node->nd_type->connect) {
1443 		error = (*hook2->hk_node->nd_type->connect) (hook2);
1444 
1445 	}
1446 
1447 	/*
1448 	 * drop the references we were holding on the two hooks.
1449 	 */
1450 	if (error) {
1451 		ng_destroy_hook(hook2);	/* also zaps hook1 */
1452 		ng_rmnode(node2, NULL, NULL, 0);
1453 	} else {
1454 		/* As a last act, allow the hooks to be used */
1455 		hook1->hk_flags &= ~HK_INVALID;
1456 		hook2->hk_flags &= ~HK_INVALID;
1457 	}
1458 	NG_HOOK_UNREF(hook1);
1459 	NG_HOOK_UNREF(hook2);
1460 	return (error);
1461 }
1462 
1463 /************************************************************************
1464 		Utility routines to send self messages
1465 ************************************************************************/
1466 
1467 /* Shut this node down as soon as everyone is clear of it */
1468 /* Should add arg "immediatly" to jump the queue */
1469 int
1470 ng_rmnode_self(node_p node)
1471 {
1472 	int		error;
1473 
1474 	if (node == &ng_deadnode)
1475 		return (0);
1476 	node->nd_flags |= NGF_INVALID;
1477 	if (node->nd_flags & NGF_CLOSING)
1478 		return (0);
1479 
1480 	error = ng_send_fn(node, NULL, &ng_rmnode, NULL, 0);
1481 	return (error);
1482 }
1483 
1484 static void
1485 ng_rmhook_part2(node_p node, hook_p hook, void *arg1, int arg2)
1486 {
1487 	ng_destroy_hook(hook);
1488 	return ;
1489 }
1490 
1491 int
1492 ng_rmhook_self(hook_p hook)
1493 {
1494 	int		error;
1495 	node_p node = NG_HOOK_NODE(hook);
1496 
1497 	if (node == &ng_deadnode)
1498 		return (0);
1499 
1500 	error = ng_send_fn(node, hook, &ng_rmhook_part2, NULL, 0);
1501 	return (error);
1502 }
1503 
1504 /***********************************************************************
1505  * Parse and verify a string of the form:  <NODE:><PATH>
1506  *
1507  * Such a string can refer to a specific node or a specific hook
1508  * on a specific node, depending on how you look at it. In the
1509  * latter case, the PATH component must not end in a dot.
1510  *
1511  * Both <NODE:> and <PATH> are optional. The <PATH> is a string
1512  * of hook names separated by dots. This breaks out the original
1513  * string, setting *nodep to "NODE" (or NULL if none) and *pathp
1514  * to "PATH" (or NULL if degenerate). Also, *hookp will point to
1515  * the final hook component of <PATH>, if any, otherwise NULL.
1516  *
1517  * This returns -1 if the path is malformed. The char ** are optional.
1518  ***********************************************************************/
1519 int
1520 ng_path_parse(char *addr, char **nodep, char **pathp, char **hookp)
1521 {
1522 	char	*node, *path, *hook;
1523 	int	k;
1524 
1525 	/*
1526 	 * Extract absolute NODE, if any
1527 	 */
1528 	for (path = addr; *path && *path != ':'; path++);
1529 	if (*path) {
1530 		node = addr;	/* Here's the NODE */
1531 		*path++ = '\0';	/* Here's the PATH */
1532 
1533 		/* Node name must not be empty */
1534 		if (!*node)
1535 			return -1;
1536 
1537 		/* A name of "." is OK; otherwise '.' not allowed */
1538 		if (strcmp(node, ".") != 0) {
1539 			for (k = 0; node[k]; k++)
1540 				if (node[k] == '.')
1541 					return -1;
1542 		}
1543 	} else {
1544 		node = NULL;	/* No absolute NODE */
1545 		path = addr;	/* Here's the PATH */
1546 	}
1547 
1548 	/* Snoop for illegal characters in PATH */
1549 	for (k = 0; path[k]; k++)
1550 		if (path[k] == ':')
1551 			return -1;
1552 
1553 	/* Check for no repeated dots in PATH */
1554 	for (k = 0; path[k]; k++)
1555 		if (path[k] == '.' && path[k + 1] == '.')
1556 			return -1;
1557 
1558 	/* Remove extra (degenerate) dots from beginning or end of PATH */
1559 	if (path[0] == '.')
1560 		path++;
1561 	if (*path && path[strlen(path) - 1] == '.')
1562 		path[strlen(path) - 1] = 0;
1563 
1564 	/* If PATH has a dot, then we're not talking about a hook */
1565 	if (*path) {
1566 		for (hook = path, k = 0; path[k]; k++)
1567 			if (path[k] == '.') {
1568 				hook = NULL;
1569 				break;
1570 			}
1571 	} else
1572 		path = hook = NULL;
1573 
1574 	/* Done */
1575 	if (nodep)
1576 		*nodep = node;
1577 	if (pathp)
1578 		*pathp = path;
1579 	if (hookp)
1580 		*hookp = hook;
1581 	return (0);
1582 }
1583 
1584 /*
1585  * Given a path, which may be absolute or relative, and a starting node,
1586  * return the destination node.
1587  */
1588 int
1589 ng_path2noderef(node_p here, const char *address,
1590 				node_p *destp, hook_p *lasthook)
1591 {
1592 	char    fullpath[NG_PATHSIZ];
1593 	char   *nodename, *path, pbuf[2];
1594 	node_p  node, oldnode;
1595 	char   *cp;
1596 	hook_p hook = NULL;
1597 
1598 	/* Initialize */
1599 	if (destp == NULL) {
1600 		TRAP_ERROR();
1601 		return EINVAL;
1602 	}
1603 	*destp = NULL;
1604 
1605 	/* Make a writable copy of address for ng_path_parse() */
1606 	strncpy(fullpath, address, sizeof(fullpath) - 1);
1607 	fullpath[sizeof(fullpath) - 1] = '\0';
1608 
1609 	/* Parse out node and sequence of hooks */
1610 	if (ng_path_parse(fullpath, &nodename, &path, NULL) < 0) {
1611 		TRAP_ERROR();
1612 		return EINVAL;
1613 	}
1614 	if (path == NULL) {
1615 		pbuf[0] = '.';	/* Needs to be writable */
1616 		pbuf[1] = '\0';
1617 		path = pbuf;
1618 	}
1619 
1620 	/*
1621 	 * For an absolute address, jump to the starting node.
1622 	 * Note that this holds a reference on the node for us.
1623 	 * Don't forget to drop the reference if we don't need it.
1624 	 */
1625 	if (nodename) {
1626 		node = ng_name2noderef(here, nodename);
1627 		if (node == NULL) {
1628 			TRAP_ERROR();
1629 			return (ENOENT);
1630 		}
1631 	} else {
1632 		if (here == NULL) {
1633 			TRAP_ERROR();
1634 			return (EINVAL);
1635 		}
1636 		node = here;
1637 		NG_NODE_REF(node);
1638 	}
1639 
1640 	/*
1641 	 * Now follow the sequence of hooks
1642 	 * XXX
1643 	 * We actually cannot guarantee that the sequence
1644 	 * is not being demolished as we crawl along it
1645 	 * without extra-ordinary locking etc.
1646 	 * So this is a bit dodgy to say the least.
1647 	 * We can probably hold up some things by holding
1648 	 * the nodelist mutex for the time of this
1649 	 * crawl if we wanted.. At least that way we wouldn't have to
1650 	 * worry about the nodes dissappearing, but the hooks would still
1651 	 * be a problem.
1652 	 */
1653 	for (cp = path; node != NULL && *cp != '\0'; ) {
1654 		char *segment;
1655 
1656 		/*
1657 		 * Break out the next path segment. Replace the dot we just
1658 		 * found with a NUL; "cp" points to the next segment (or the
1659 		 * NUL at the end).
1660 		 */
1661 		for (segment = cp; *cp != '\0'; cp++) {
1662 			if (*cp == '.') {
1663 				*cp++ = '\0';
1664 				break;
1665 			}
1666 		}
1667 
1668 		/* Empty segment */
1669 		if (*segment == '\0')
1670 			continue;
1671 
1672 		/* We have a segment, so look for a hook by that name */
1673 		hook = ng_findhook(node, segment);
1674 
1675 		/* Can't get there from here... */
1676 		if (hook == NULL
1677 		    || NG_HOOK_PEER(hook) == NULL
1678 		    || NG_HOOK_NOT_VALID(hook)
1679 		    || NG_HOOK_NOT_VALID(NG_HOOK_PEER(hook))) {
1680 			TRAP_ERROR();
1681 			NG_NODE_UNREF(node);
1682 #if 0
1683 			printf("hooknotvalid %s %s %d %d %d %d ",
1684 					path,
1685 					segment,
1686 					hook == NULL,
1687 					NG_HOOK_PEER(hook) == NULL,
1688 					NG_HOOK_NOT_VALID(hook),
1689 					NG_HOOK_NOT_VALID(NG_HOOK_PEER(hook)));
1690 #endif
1691 			return (ENOENT);
1692 		}
1693 
1694 		/*
1695 		 * Hop on over to the next node
1696 		 * XXX
1697 		 * Big race conditions here as hooks and nodes go away
1698 		 * *** Idea.. store an ng_ID_t in each hook and use that
1699 		 * instead of the direct hook in this crawl?
1700 		 */
1701 		oldnode = node;
1702 		if ((node = NG_PEER_NODE(hook)))
1703 			NG_NODE_REF(node);	/* XXX RACE */
1704 		NG_NODE_UNREF(oldnode);	/* XXX another race */
1705 		if (NG_NODE_NOT_VALID(node)) {
1706 			NG_NODE_UNREF(node);	/* XXX more races */
1707 			node = NULL;
1708 		}
1709 	}
1710 
1711 	/* If node somehow missing, fail here (probably this is not needed) */
1712 	if (node == NULL) {
1713 		TRAP_ERROR();
1714 		return (ENXIO);
1715 	}
1716 
1717 	/* Done */
1718 	*destp = node;
1719 	if (lasthook != NULL)
1720 		*lasthook = (hook ? NG_HOOK_PEER(hook) : NULL);
1721 	return (0);
1722 }
1723 
1724 /***************************************************************\
1725 * Input queue handling.
1726 * All activities are submitted to the node via the input queue
1727 * which implements a multiple-reader/single-writer gate.
1728 * Items which cannot be handled immeditly are queued.
1729 *
1730 * read-write queue locking inline functions			*
1731 \***************************************************************/
1732 
1733 static __inline item_p ng_dequeue(struct ng_queue * ngq, int *rw);
1734 static __inline item_p ng_acquire_read(struct ng_queue * ngq,
1735 					item_p  item);
1736 static __inline item_p ng_acquire_write(struct ng_queue * ngq,
1737 					item_p  item);
1738 static __inline void	ng_leave_read(struct ng_queue * ngq);
1739 static __inline void	ng_leave_write(struct ng_queue * ngq);
1740 static __inline void	ng_queue_rw(struct ng_queue * ngq,
1741 					item_p  item, int rw);
1742 
1743 /*
1744  * Definition of the bits fields in the ng_queue flag word.
1745  * Defined here rather than in netgraph.h because no-one should fiddle
1746  * with them.
1747  *
1748  * The ordering here may be important! don't shuffle these.
1749  */
1750 /*-
1751  Safety Barrier--------+ (adjustable to suit taste) (not used yet)
1752                        |
1753                        V
1754 +-------+-------+-------+-------+-------+-------+-------+-------+
1755   | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |
1756   | |A|c|t|i|v|e| |R|e|a|d|e|r| |C|o|u|n|t| | | | | | | | | |P|A|
1757   | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |O|W|
1758 +-------+-------+-------+-------+-------+-------+-------+-------+
1759   \___________________________ ____________________________/ | |
1760                             V                                | |
1761                   [active reader count]                      | |
1762                                                              | |
1763             Operation Pending -------------------------------+ |
1764                                                                |
1765           Active Writer ---------------------------------------+
1766 
1767 
1768 */
1769 #define WRITER_ACTIVE	0x00000001
1770 #define OP_PENDING	0x00000002
1771 #define READER_INCREMENT 0x00000004
1772 #define READER_MASK	0xfffffffc	/* Not valid if WRITER_ACTIVE is set */
1773 #define SAFETY_BARRIER	0x00100000	/* 128K items queued should be enough */
1774 
1775 /* Defines of more elaborate states on the queue */
1776 /* Mask of bits a new read cares about */
1777 #define NGQ_RMASK	(WRITER_ACTIVE|OP_PENDING)
1778 
1779 /* Mask of bits a new write cares about */
1780 #define NGQ_WMASK	(NGQ_RMASK|READER_MASK)
1781 
1782 /* Test to decide if there is something on the queue. */
1783 #define QUEUE_ACTIVE(QP) ((QP)->q_flags & OP_PENDING)
1784 
1785 /* How to decide what the next queued item is. */
1786 #define HEAD_IS_READER(QP)  NGI_QUEUED_READER((QP)->queue)
1787 #define HEAD_IS_WRITER(QP)  NGI_QUEUED_WRITER((QP)->queue) /* notused */
1788 
1789 /* Read the status to decide if the next item on the queue can now run. */
1790 #define QUEUED_READER_CAN_PROCEED(QP)			\
1791 		(((QP)->q_flags & (NGQ_RMASK & ~OP_PENDING)) == 0)
1792 #define QUEUED_WRITER_CAN_PROCEED(QP)			\
1793 		(((QP)->q_flags & (NGQ_WMASK & ~OP_PENDING)) == 0)
1794 
1795 /* Is there a chance of getting ANY work off the queue? */
1796 #define NEXT_QUEUED_ITEM_CAN_PROCEED(QP)				\
1797 	(QUEUE_ACTIVE(QP) && 						\
1798 	((HEAD_IS_READER(QP)) ? QUEUED_READER_CAN_PROCEED(QP) :		\
1799 				QUEUED_WRITER_CAN_PROCEED(QP)))
1800 
1801 
1802 #define NGQRW_R 0
1803 #define NGQRW_W 1
1804 
1805 /*
1806  * Taking into account the current state of the queue and node, possibly take
1807  * the next entry off the queue and return it. Return NULL if there was
1808  * nothing we could return, either because there really was nothing there, or
1809  * because the node was in a state where it cannot yet process the next item
1810  * on the queue.
1811  *
1812  * This MUST MUST MUST be called with the mutex held.
1813  */
1814 static __inline item_p
1815 ng_dequeue(struct ng_queue *ngq, int *rw)
1816 {
1817 	item_p item;
1818 	u_int		add_arg;
1819 
1820 	mtx_assert(&ngq->q_mtx, MA_OWNED);
1821 	/*
1822 	 * If there is nothing queued, then just return.
1823 	 * No point in continuing.
1824 	 * XXXGL: assert this?
1825 	 */
1826 	if (!QUEUE_ACTIVE(ngq)) {
1827 		CTR4(KTR_NET, "%20s: node [%x] (%p) queue empty; "
1828 		    "queue flags 0x%lx", __func__,
1829 		    ngq->q_node->nd_ID, ngq->q_node, ngq->q_flags);
1830 		return (NULL);
1831 	}
1832 
1833 	/*
1834 	 * From here, we can assume there is a head item.
1835 	 * We need to find out what it is and if it can be dequeued, given
1836 	 * the current state of the node.
1837 	 */
1838 	if (HEAD_IS_READER(ngq)) {
1839 		if (!QUEUED_READER_CAN_PROCEED(ngq)) {
1840 			/*
1841 			 * It's a reader but we can't use it.
1842 			 * We are stalled so make sure we don't
1843 			 * get called again until something changes.
1844 			 */
1845 			ng_worklist_remove(ngq->q_node);
1846 			CTR4(KTR_NET, "%20s: node [%x] (%p) queued reader "
1847 			    "can't proceed; queue flags 0x%lx", __func__,
1848 			    ngq->q_node->nd_ID, ngq->q_node, ngq->q_flags);
1849 			return (NULL);
1850 		}
1851 		/*
1852 		 * Head of queue is a reader and we have no write active.
1853 		 * We don't care how many readers are already active.
1854 		 * Add the correct increment for the reader count.
1855 		 */
1856 		add_arg = READER_INCREMENT;
1857 		*rw = NGQRW_R;
1858 	} else if (QUEUED_WRITER_CAN_PROCEED(ngq)) {
1859 		/*
1860 		 * There is a pending write, no readers and no active writer.
1861 		 * This means we can go ahead with the pending writer. Note
1862 		 * the fact that we now have a writer, ready for when we take
1863 		 * it off the queue.
1864 		 *
1865 		 * We don't need to worry about a possible collision with the
1866 		 * fasttrack reader.
1867 		 *
1868 		 * The fasttrack thread may take a long time to discover that we
1869 		 * are running so we would have an inconsistent state in the
1870 		 * flags for a while. Since we ignore the reader count
1871 		 * entirely when the WRITER_ACTIVE flag is set, this should
1872 		 * not matter (in fact it is defined that way). If it tests
1873 		 * the flag before this operation, the OP_PENDING flag
1874 		 * will make it fail, and if it tests it later, the
1875 		 * WRITER_ACTIVE flag will do the same. If it is SO slow that
1876 		 * we have actually completed the operation, and neither flag
1877 		 * is set by the time that it tests the flags, then it is
1878 		 * actually ok for it to continue. If it completes and we've
1879 		 * finished and the read pending is set it still fails.
1880 		 *
1881 		 * So we can just ignore it,  as long as we can ensure that the
1882 		 * transition from WRITE_PENDING state to the WRITER_ACTIVE
1883 		 * state is atomic.
1884 		 *
1885 		 * After failing, first it will be held back by the mutex, then
1886 		 * when it can proceed, it will queue its request, then it
1887 		 * would arrive at this function. Usually it will have to
1888 		 * leave empty handed because the ACTIVE WRITER bit will be
1889 		 * set.
1890 		 *
1891 		 * Adjust the flags for the new active writer.
1892 		 */
1893 		add_arg = WRITER_ACTIVE;
1894 		*rw = NGQRW_W;
1895 		/*
1896 		 * We want to write "active writer, no readers " Now go make
1897 		 * it true. In fact there may be a number in the readers
1898 		 * count but we know it is not true and will be fixed soon.
1899 		 * We will fix the flags for the next pending entry in a
1900 		 * moment.
1901 		 */
1902 	} else {
1903 		/*
1904 		 * We can't dequeue anything.. return and say so. Probably we
1905 		 * have a write pending and the readers count is non zero. If
1906 		 * we got here because a reader hit us just at the wrong
1907 		 * moment with the fasttrack code, and put us in a strange
1908 		 * state, then it will be coming through in just a moment,
1909 		 * (just as soon as we release the mutex) and keep things
1910 		 * moving.
1911 		 * Make sure we remove ourselves from the work queue. It
1912 		 * would be a waste of effort to do all this again.
1913 		 */
1914 		ng_worklist_remove(ngq->q_node);
1915 		CTR4(KTR_NET, "%20s: node [%x] (%p) can't dequeue anything; "
1916 		    "queue flags 0x%lx", __func__,
1917 		    ngq->q_node->nd_ID, ngq->q_node, ngq->q_flags);
1918 		return (NULL);
1919 	}
1920 
1921 	/*
1922 	 * Now we dequeue the request (whatever it may be) and correct the
1923 	 * pending flags and the next and last pointers.
1924 	 */
1925 	item = ngq->queue;
1926 	ngq->queue = item->el_next;
1927 	CTR6(KTR_NET, "%20s: node [%x] (%p) dequeued item %p with flags 0x%lx; "
1928 	    "queue flags 0x%lx", __func__,
1929 	    ngq->q_node->nd_ID,ngq->q_node, item, item->el_flags, ngq->q_flags);
1930 	if (ngq->last == &(item->el_next)) {
1931 		/*
1932 		 * that was the last entry in the queue so set the 'last
1933 		 * pointer up correctly and make sure the pending flag is
1934 		 * clear.
1935 		 */
1936 		add_arg += -OP_PENDING;
1937 		ngq->last = &(ngq->queue);
1938 		/*
1939 		 * Whatever flag was set will be cleared and
1940 		 * the new acive field will be set by the add as well,
1941 		 * so we don't need to change add_arg.
1942 		 * But we know we don't need to be on the work list.
1943 		 */
1944 		atomic_add_long(&ngq->q_flags, add_arg);
1945 		ng_worklist_remove(ngq->q_node);
1946 	} else {
1947 		/*
1948 		 * Since there is still something on the queue
1949 		 * we don't need to change the PENDING flag.
1950 		 */
1951 		atomic_add_long(&ngq->q_flags, add_arg);
1952 		/*
1953 		 * If we see more doable work, make sure we are
1954 		 * on the work queue.
1955 		 */
1956 		if (NEXT_QUEUED_ITEM_CAN_PROCEED(ngq)) {
1957 			ng_setisr(ngq->q_node);
1958 		}
1959 	}
1960 	CTR6(KTR_NET, "%20s: node [%x] (%p) returning item %p as %s; "
1961 	    "queue flags 0x%lx", __func__,
1962 	    ngq->q_node->nd_ID, ngq->q_node, item, *rw ? "WRITER" : "READER" ,
1963 	    ngq->q_flags);
1964 	return (item);
1965 }
1966 
1967 /*
1968  * Queue a packet to be picked up by someone else.
1969  * We really don't care who, but we can't or don't want to hang around
1970  * to process it ourselves. We are probably an interrupt routine..
1971  * If the queue could be run, flag the netisr handler to start.
1972  */
1973 static __inline void
1974 ng_queue_rw(struct ng_queue * ngq, item_p  item, int rw)
1975 {
1976 	mtx_assert(&ngq->q_mtx, MA_OWNED);
1977 
1978 	if (rw == NGQRW_W)
1979 		NGI_SET_WRITER(item);
1980 	else
1981 		NGI_SET_READER(item);
1982 	item->el_next = NULL;	/* maybe not needed */
1983 	*ngq->last = item;
1984 	CTR5(KTR_NET, "%20s: node [%x] (%p) queued item %p as %s", __func__,
1985 	    ngq->q_node->nd_ID, ngq->q_node, item, rw ? "WRITER" : "READER" );
1986 	/*
1987 	 * If it was the first item in the queue then we need to
1988 	 * set the last pointer and the type flags.
1989 	 */
1990 	if (ngq->last == &(ngq->queue)) {
1991 		atomic_add_long(&ngq->q_flags, OP_PENDING);
1992 		CTR3(KTR_NET, "%20s: node [%x] (%p) set OP_PENDING", __func__,
1993 		    ngq->q_node->nd_ID, ngq->q_node);
1994 	}
1995 
1996 	ngq->last = &(item->el_next);
1997 	/*
1998 	 * We can take the worklist lock with the node locked
1999 	 * BUT NOT THE REVERSE!
2000 	 */
2001 	if (NEXT_QUEUED_ITEM_CAN_PROCEED(ngq))
2002 		ng_setisr(ngq->q_node);
2003 }
2004 
2005 
2006 /*
2007  * This function 'cheats' in that it first tries to 'grab' the use of the
2008  * node, without going through the mutex. We can do this becasue of the
2009  * semantics of the lock. The semantics include a clause that says that the
2010  * value of the readers count is invalid if the WRITER_ACTIVE flag is set. It
2011  * also says that the WRITER_ACTIVE flag cannot be set if the readers count
2012  * is not zero. Note that this talks about what is valid to SET the
2013  * WRITER_ACTIVE flag, because from the moment it is set, the value if the
2014  * reader count is immaterial, and not valid. The two 'pending' flags have a
2015  * similar effect, in that If they are orthogonal to the two active fields in
2016  * how they are set, but if either is set, the attempted 'grab' need to be
2017  * backed out because there is earlier work, and we maintain ordering in the
2018  * queue. The result of this is that the reader request can try obtain use of
2019  * the node with only a single atomic addition, and without any of the mutex
2020  * overhead. If this fails the operation degenerates to the same as for other
2021  * cases.
2022  *
2023  */
2024 static __inline item_p
2025 ng_acquire_read(struct ng_queue *ngq, item_p item)
2026 {
2027 	KASSERT(ngq != &ng_deadnode.nd_input_queue,
2028 	    ("%s: working on deadnode", __func__));
2029 
2030 	/* ######### Hack alert ######### */
2031 	atomic_add_long(&ngq->q_flags, READER_INCREMENT);
2032 	if ((ngq->q_flags & NGQ_RMASK) == 0) {
2033 		/* Successfully grabbed node */
2034 		CTR4(KTR_NET, "%20s: node [%x] (%p) fast acquired item %p",
2035 		    __func__, ngq->q_node->nd_ID, ngq->q_node, item);
2036 		return (item);
2037 	}
2038 	/* undo the damage if we didn't succeed */
2039 	atomic_subtract_long(&ngq->q_flags, READER_INCREMENT);
2040 
2041 	/* ######### End Hack alert ######### */
2042 	mtx_lock_spin((&ngq->q_mtx));
2043 	/*
2044 	 * Try again. Another processor (or interrupt for that matter) may
2045 	 * have removed the last queued item that was stopping us from
2046 	 * running, between the previous test, and the moment that we took
2047 	 * the mutex. (Or maybe a writer completed.)
2048 	 * Even if another fast-track reader hits during this period
2049 	 * we don't care as multiple readers is OK.
2050 	 */
2051 	if ((ngq->q_flags & NGQ_RMASK) == 0) {
2052 		atomic_add_long(&ngq->q_flags, READER_INCREMENT);
2053 		mtx_unlock_spin((&ngq->q_mtx));
2054 		CTR4(KTR_NET, "%20s: node [%x] (%p) slow acquired item %p",
2055 		    __func__, ngq->q_node->nd_ID, ngq->q_node, item);
2056 		return (item);
2057 	}
2058 
2059 	/*
2060 	 * and queue the request for later.
2061 	 */
2062 	ng_queue_rw(ngq, item, NGQRW_R);
2063 	mtx_unlock_spin(&(ngq->q_mtx));
2064 
2065 	return (NULL);
2066 }
2067 
2068 static __inline item_p
2069 ng_acquire_write(struct ng_queue *ngq, item_p item)
2070 {
2071 	KASSERT(ngq != &ng_deadnode.nd_input_queue,
2072 	    ("%s: working on deadnode", __func__));
2073 
2074 restart:
2075 	mtx_lock_spin(&(ngq->q_mtx));
2076 	/*
2077 	 * If there are no readers, no writer, and no pending packets, then
2078 	 * we can just go ahead. In all other situations we need to queue the
2079 	 * request
2080 	 */
2081 	if ((ngq->q_flags & NGQ_WMASK) == 0) {
2082 		/* collision could happen *HERE* */
2083 		atomic_add_long(&ngq->q_flags, WRITER_ACTIVE);
2084 		mtx_unlock_spin((&ngq->q_mtx));
2085 		if (ngq->q_flags & READER_MASK) {
2086 			/* Collision with fast-track reader */
2087 			atomic_subtract_long(&ngq->q_flags, WRITER_ACTIVE);
2088 			goto restart;
2089 		}
2090 		CTR4(KTR_NET, "%20s: node [%x] (%p) acquired item %p",
2091 		    __func__, ngq->q_node->nd_ID, ngq->q_node, item);
2092 		return (item);
2093 	}
2094 
2095 	/*
2096 	 * and queue the request for later.
2097 	 */
2098 	ng_queue_rw(ngq, item, NGQRW_W);
2099 	mtx_unlock_spin(&(ngq->q_mtx));
2100 
2101 	return (NULL);
2102 }
2103 
2104 static __inline void
2105 ng_leave_read(struct ng_queue *ngq)
2106 {
2107 	atomic_subtract_long(&ngq->q_flags, READER_INCREMENT);
2108 }
2109 
2110 static __inline void
2111 ng_leave_write(struct ng_queue *ngq)
2112 {
2113 	atomic_subtract_long(&ngq->q_flags, WRITER_ACTIVE);
2114 }
2115 
2116 static void
2117 ng_flush_input_queue(struct ng_queue * ngq)
2118 {
2119 	item_p item;
2120 
2121 	mtx_lock_spin(&ngq->q_mtx);
2122 	while (ngq->queue) {
2123 		item = ngq->queue;
2124 		ngq->queue = item->el_next;
2125 		if (ngq->last == &(item->el_next)) {
2126 			ngq->last = &(ngq->queue);
2127 			atomic_add_long(&ngq->q_flags, -OP_PENDING);
2128 		}
2129 		mtx_unlock_spin(&ngq->q_mtx);
2130 
2131 		/* If the item is supplying a callback, call it with an error */
2132 		if (item->apply != NULL) {
2133 			(item->apply)(item->context, ENOENT);
2134 			item->apply = NULL;
2135 		}
2136 		NG_FREE_ITEM(item);
2137 		mtx_lock_spin(&ngq->q_mtx);
2138 	}
2139 	/*
2140 	 * Take us off the work queue if we are there.
2141 	 * We definatly have no work to be done.
2142 	 */
2143 	ng_worklist_remove(ngq->q_node);
2144 	mtx_unlock_spin(&ngq->q_mtx);
2145 }
2146 
2147 /***********************************************************************
2148 * Externally visible method for sending or queueing messages or data.
2149 ***********************************************************************/
2150 
2151 /*
2152  * The module code should have filled out the item correctly by this stage:
2153  * Common:
2154  *    reference to destination node.
2155  *    Reference to destination rcv hook if relevant.
2156  * Data:
2157  *    pointer to mbuf
2158  * Control_Message:
2159  *    pointer to msg.
2160  *    ID of original sender node. (return address)
2161  * Function:
2162  *    Function pointer
2163  *    void * argument
2164  *    integer argument
2165  *
2166  * The nodes have several routines and macros to help with this task:
2167  */
2168 
2169 int
2170 ng_snd_item(item_p item, int flags)
2171 {
2172 	hook_p hook = NGI_HOOK(item);
2173 	node_p node = NGI_NODE(item);
2174 	int queue, rw;
2175 	struct ng_queue * ngq = &node->nd_input_queue;
2176 	int error = 0;
2177 
2178 #ifdef	NETGRAPH_DEBUG
2179 	_ngi_check(item, __FILE__, __LINE__);
2180 #endif
2181 
2182 	queue = (flags & NG_QUEUE) ? 1 : 0;
2183 
2184 	if (item == NULL) {
2185 		TRAP_ERROR();
2186 		return (EINVAL);	/* failed to get queue element */
2187 	}
2188 	if (node == NULL) {
2189 		NG_FREE_ITEM(item);
2190 		TRAP_ERROR();
2191 		return (EINVAL);	/* No address */
2192 	}
2193 	switch(item->el_flags & NGQF_TYPE) {
2194 	case NGQF_DATA:
2195 		/*
2196 		 * DATA MESSAGE
2197 		 * Delivered to a node via a non-optional hook.
2198 		 * Both should be present in the item even though
2199 		 * the node is derivable from the hook.
2200 		 * References are held on both by the item.
2201 		 */
2202 
2203 		/* Protect nodes from sending NULL pointers
2204 		 * to each other
2205 		 */
2206 		if (NGI_M(item) == NULL)
2207 			return (EINVAL);
2208 
2209 		CHECK_DATA_MBUF(NGI_M(item));
2210 		if (hook == NULL) {
2211 			NG_FREE_ITEM(item);
2212 			TRAP_ERROR();
2213 			return(EINVAL);
2214 		}
2215 		if ((NG_HOOK_NOT_VALID(hook))
2216 		|| (NG_NODE_NOT_VALID(NG_HOOK_NODE(hook)))) {
2217 			NG_FREE_ITEM(item);
2218 			return (ENOTCONN);
2219 		}
2220 		if ((hook->hk_flags & HK_QUEUE)) {
2221 			queue = 1;
2222 		}
2223 		break;
2224 	case NGQF_MESG:
2225 		/*
2226 		 * CONTROL MESSAGE
2227 		 * Delivered to a node.
2228 		 * Hook is optional.
2229 		 * References are held by the item on the node and
2230 		 * the hook if it is present.
2231 		 */
2232 		if (hook && (hook->hk_flags & HK_QUEUE)) {
2233 			queue = 1;
2234 		}
2235 		break;
2236 	case NGQF_FN:
2237 		break;
2238 	default:
2239 		NG_FREE_ITEM(item);
2240 		TRAP_ERROR();
2241 		return (EINVAL);
2242 	}
2243 	switch(item->el_flags & NGQF_RW) {
2244 	case NGQF_READER:
2245 		rw = NGQRW_R;
2246 		break;
2247 	case NGQF_WRITER:
2248 		rw = NGQRW_W;
2249 		break;
2250 	default:
2251 		panic("%s: invalid item flags %lx", __func__, item->el_flags);
2252 	}
2253 
2254 	/*
2255 	 * If the node specifies single threading, force writer semantics.
2256 	 * Similarly, the node may say one hook always produces writers.
2257 	 * These are overrides.
2258 	 */
2259 	if ((node->nd_flags & NGF_FORCE_WRITER)
2260 	    || (hook && (hook->hk_flags & HK_FORCE_WRITER)))
2261 			rw = NGQRW_W;
2262 
2263 	if (queue) {
2264 		/* Put it on the queue for that node*/
2265 #ifdef	NETGRAPH_DEBUG
2266 		_ngi_check(item, __FILE__, __LINE__);
2267 #endif
2268 		mtx_lock_spin(&(ngq->q_mtx));
2269 		ng_queue_rw(ngq, item, rw);
2270 		mtx_unlock_spin(&(ngq->q_mtx));
2271 
2272 		if (flags & NG_PROGRESS)
2273 			return (EINPROGRESS);
2274 		else
2275 			return (0);
2276 	}
2277 
2278 	/*
2279 	 * We already decided how we will be queueud or treated.
2280 	 * Try get the appropriate operating permission.
2281 	 */
2282  	if (rw == NGQRW_R)
2283 		item = ng_acquire_read(ngq, item);
2284 	else
2285 		item = ng_acquire_write(ngq, item);
2286 
2287 
2288 	if (item == NULL) {
2289 		if (flags & NG_PROGRESS)
2290 			return (EINPROGRESS);
2291 		else
2292 			return (0);
2293 	}
2294 
2295 #ifdef	NETGRAPH_DEBUG
2296 	_ngi_check(item, __FILE__, __LINE__);
2297 #endif
2298 
2299 	NGI_GET_NODE(item, node); /* zaps stored node */
2300 
2301 	error = ng_apply_item(node, item, rw); /* drops r/w lock when done */
2302 
2303 	/*
2304 	 * If the node goes away when we remove the reference,
2305 	 * whatever we just did caused it.. whatever we do, DO NOT
2306 	 * access the node again!
2307 	 */
2308 	if (NG_NODE_UNREF(node) == 0) {
2309 		return (error);
2310 	}
2311 
2312 	mtx_lock_spin(&(ngq->q_mtx));
2313 	if (NEXT_QUEUED_ITEM_CAN_PROCEED(ngq))
2314 		ng_setisr(ngq->q_node);
2315 	mtx_unlock_spin(&(ngq->q_mtx));
2316 
2317 	return (error);
2318 }
2319 
2320 /*
2321  * We have an item that was possibly queued somewhere.
2322  * It should contain all the information needed
2323  * to run it on the appropriate node/hook.
2324  */
2325 static int
2326 ng_apply_item(node_p node, item_p item, int rw)
2327 {
2328 	hook_p  hook;
2329 	int	error = 0;
2330 	ng_rcvdata_t *rcvdata;
2331 	ng_rcvmsg_t *rcvmsg;
2332 	ng_apply_t *apply = NULL;
2333 	void	*context = NULL;
2334 
2335 	NGI_GET_HOOK(item, hook); /* clears stored hook */
2336 #ifdef	NETGRAPH_DEBUG
2337 	_ngi_check(item, __FILE__, __LINE__);
2338 #endif
2339 
2340 	/*
2341 	 * If the item has an "apply" callback, store it.
2342 	 * Clear item's callback immediately, to avoid an extra call if
2343 	 * the item is reused by the destination node.
2344 	 */
2345 	if (item->apply != NULL) {
2346 		apply = item->apply;
2347 		context = item->context;
2348 		item->apply = NULL;
2349 	}
2350 
2351 	switch (item->el_flags & NGQF_TYPE) {
2352 	case NGQF_DATA:
2353 		/*
2354 		 * Check things are still ok as when we were queued.
2355 		 */
2356 		if ((hook == NULL)
2357 		|| NG_HOOK_NOT_VALID(hook)
2358 		|| NG_NODE_NOT_VALID(node) ) {
2359 			error = EIO;
2360 			NG_FREE_ITEM(item);
2361 			break;
2362 		}
2363 		/*
2364 		 * If no receive method, just silently drop it.
2365 		 * Give preference to the hook over-ride method
2366 		 */
2367 		if ((!(rcvdata = hook->hk_rcvdata))
2368 		&& (!(rcvdata = NG_HOOK_NODE(hook)->nd_type->rcvdata))) {
2369 			error = 0;
2370 			NG_FREE_ITEM(item);
2371 			break;
2372 		}
2373 		error = (*rcvdata)(hook, item);
2374 		break;
2375 	case NGQF_MESG:
2376 		if (hook) {
2377 			if (NG_HOOK_NOT_VALID(hook)) {
2378 				/*
2379 				 * The hook has been zapped then we can't
2380 				 * use it. Immediatly drop its reference.
2381 				 * The message may not need it.
2382 				 */
2383 				NG_HOOK_UNREF(hook);
2384 				hook = NULL;
2385 			}
2386 		}
2387 		/*
2388 		 * Similarly, if the node is a zombie there is
2389 		 * nothing we can do with it, drop everything.
2390 		 */
2391 		if (NG_NODE_NOT_VALID(node)) {
2392 			TRAP_ERROR();
2393 			error = EINVAL;
2394 			NG_FREE_ITEM(item);
2395 		} else {
2396 			/*
2397 			 * Call the appropriate message handler for the object.
2398 			 * It is up to the message handler to free the message.
2399 			 * If it's a generic message, handle it generically,
2400 			 * otherwise call the type's message handler
2401 			 * (if it exists)
2402 			 * XXX (race). Remember that a queued message may
2403 			 * reference a node or hook that has just been
2404 			 * invalidated. It will exist as the queue code
2405 			 * is holding a reference, but..
2406 			 */
2407 
2408 			struct ng_mesg *msg = NGI_MSG(item);
2409 
2410 			/*
2411 			 * check if the generic handler owns it.
2412 			 */
2413 			if ((msg->header.typecookie == NGM_GENERIC_COOKIE)
2414 			&& ((msg->header.flags & NGF_RESP) == 0)) {
2415 				error = ng_generic_msg(node, item, hook);
2416 				break;
2417 			}
2418 			/*
2419 			 * Now see if there is a handler (hook or node specific)
2420 			 * in the target node. If none, silently discard.
2421 			 */
2422 			if (((!hook) || (!(rcvmsg = hook->hk_rcvmsg)))
2423 			&& (!(rcvmsg = node->nd_type->rcvmsg))) {
2424 				TRAP_ERROR();
2425 				error = 0;
2426 				NG_FREE_ITEM(item);
2427 				break;
2428 			}
2429 			error = (*rcvmsg)(node, item, hook);
2430 		}
2431 		break;
2432 	case NGQF_FN:
2433 		/*
2434 		 *  We have to implicitly trust the hook,
2435 		 * as some of these are used for system purposes
2436 		 * where the hook is invalid. In the case of
2437 		 * the shutdown message we allow it to hit
2438 		 * even if the node is invalid.
2439 		 */
2440 		if ((NG_NODE_NOT_VALID(node))
2441 		&& (NGI_FN(item) != &ng_rmnode)) {
2442 			TRAP_ERROR();
2443 			error = EINVAL;
2444 			NG_FREE_ITEM(item);
2445 			break;
2446 		}
2447 		(*NGI_FN(item))(node, hook, NGI_ARG1(item), NGI_ARG2(item));
2448 		NG_FREE_ITEM(item);
2449 		break;
2450 
2451 	}
2452 	/*
2453 	 * We held references on some of the resources
2454 	 * that we took from the item. Now that we have
2455 	 * finished doing everything, drop those references.
2456 	 */
2457 	if (hook) {
2458 		NG_HOOK_UNREF(hook);
2459 	}
2460 
2461  	if (rw == NGQRW_R) {
2462 		ng_leave_read(&node->nd_input_queue);
2463 	} else {
2464 		ng_leave_write(&node->nd_input_queue);
2465 	}
2466 
2467 	/* Apply callback. */
2468 	if (apply != NULL)
2469 		(*apply)(context, error);
2470 
2471 	return (error);
2472 }
2473 
2474 /***********************************************************************
2475  * Implement the 'generic' control messages
2476  ***********************************************************************/
2477 static int
2478 ng_generic_msg(node_p here, item_p item, hook_p lasthook)
2479 {
2480 	int error = 0;
2481 	struct ng_mesg *msg;
2482 	struct ng_mesg *resp = NULL;
2483 
2484 	NGI_GET_MSG(item, msg);
2485 	if (msg->header.typecookie != NGM_GENERIC_COOKIE) {
2486 		TRAP_ERROR();
2487 		error = EINVAL;
2488 		goto out;
2489 	}
2490 	switch (msg->header.cmd) {
2491 	case NGM_SHUTDOWN:
2492 		ng_rmnode(here, NULL, NULL, 0);
2493 		break;
2494 	case NGM_MKPEER:
2495 	    {
2496 		struct ngm_mkpeer *const mkp = (struct ngm_mkpeer *) msg->data;
2497 
2498 		if (msg->header.arglen != sizeof(*mkp)) {
2499 			TRAP_ERROR();
2500 			error = EINVAL;
2501 			break;
2502 		}
2503 		mkp->type[sizeof(mkp->type) - 1] = '\0';
2504 		mkp->ourhook[sizeof(mkp->ourhook) - 1] = '\0';
2505 		mkp->peerhook[sizeof(mkp->peerhook) - 1] = '\0';
2506 		error = ng_mkpeer(here, mkp->ourhook, mkp->peerhook, mkp->type);
2507 		break;
2508 	    }
2509 	case NGM_CONNECT:
2510 	    {
2511 		struct ngm_connect *const con =
2512 			(struct ngm_connect *) msg->data;
2513 		node_p node2;
2514 
2515 		if (msg->header.arglen != sizeof(*con)) {
2516 			TRAP_ERROR();
2517 			error = EINVAL;
2518 			break;
2519 		}
2520 		con->path[sizeof(con->path) - 1] = '\0';
2521 		con->ourhook[sizeof(con->ourhook) - 1] = '\0';
2522 		con->peerhook[sizeof(con->peerhook) - 1] = '\0';
2523 		/* Don't forget we get a reference.. */
2524 		error = ng_path2noderef(here, con->path, &node2, NULL);
2525 		if (error)
2526 			break;
2527 		error = ng_con_nodes(here, con->ourhook, node2, con->peerhook);
2528 		NG_NODE_UNREF(node2);
2529 		break;
2530 	    }
2531 	case NGM_NAME:
2532 	    {
2533 		struct ngm_name *const nam = (struct ngm_name *) msg->data;
2534 
2535 		if (msg->header.arglen != sizeof(*nam)) {
2536 			TRAP_ERROR();
2537 			error = EINVAL;
2538 			break;
2539 		}
2540 		nam->name[sizeof(nam->name) - 1] = '\0';
2541 		error = ng_name_node(here, nam->name);
2542 		break;
2543 	    }
2544 	case NGM_RMHOOK:
2545 	    {
2546 		struct ngm_rmhook *const rmh = (struct ngm_rmhook *) msg->data;
2547 		hook_p hook;
2548 
2549 		if (msg->header.arglen != sizeof(*rmh)) {
2550 			TRAP_ERROR();
2551 			error = EINVAL;
2552 			break;
2553 		}
2554 		rmh->ourhook[sizeof(rmh->ourhook) - 1] = '\0';
2555 		if ((hook = ng_findhook(here, rmh->ourhook)) != NULL)
2556 			ng_destroy_hook(hook);
2557 		break;
2558 	    }
2559 	case NGM_NODEINFO:
2560 	    {
2561 		struct nodeinfo *ni;
2562 
2563 		NG_MKRESPONSE(resp, msg, sizeof(*ni), M_NOWAIT);
2564 		if (resp == NULL) {
2565 			error = ENOMEM;
2566 			break;
2567 		}
2568 
2569 		/* Fill in node info */
2570 		ni = (struct nodeinfo *) resp->data;
2571 		if (NG_NODE_HAS_NAME(here))
2572 			strcpy(ni->name, NG_NODE_NAME(here));
2573 		strcpy(ni->type, here->nd_type->name);
2574 		ni->id = ng_node2ID(here);
2575 		ni->hooks = here->nd_numhooks;
2576 		break;
2577 	    }
2578 	case NGM_LISTHOOKS:
2579 	    {
2580 		const int nhooks = here->nd_numhooks;
2581 		struct hooklist *hl;
2582 		struct nodeinfo *ni;
2583 		hook_p hook;
2584 
2585 		/* Get response struct */
2586 		NG_MKRESPONSE(resp, msg, sizeof(*hl)
2587 		    + (nhooks * sizeof(struct linkinfo)), M_NOWAIT);
2588 		if (resp == NULL) {
2589 			error = ENOMEM;
2590 			break;
2591 		}
2592 		hl = (struct hooklist *) resp->data;
2593 		ni = &hl->nodeinfo;
2594 
2595 		/* Fill in node info */
2596 		if (NG_NODE_HAS_NAME(here))
2597 			strcpy(ni->name, NG_NODE_NAME(here));
2598 		strcpy(ni->type, here->nd_type->name);
2599 		ni->id = ng_node2ID(here);
2600 
2601 		/* Cycle through the linked list of hooks */
2602 		ni->hooks = 0;
2603 		LIST_FOREACH(hook, &here->nd_hooks, hk_hooks) {
2604 			struct linkinfo *const link = &hl->link[ni->hooks];
2605 
2606 			if (ni->hooks >= nhooks) {
2607 				log(LOG_ERR, "%s: number of %s changed\n",
2608 				    __func__, "hooks");
2609 				break;
2610 			}
2611 			if (NG_HOOK_NOT_VALID(hook))
2612 				continue;
2613 			strcpy(link->ourhook, NG_HOOK_NAME(hook));
2614 			strcpy(link->peerhook, NG_PEER_HOOK_NAME(hook));
2615 			if (NG_PEER_NODE_NAME(hook)[0] != '\0')
2616 				strcpy(link->nodeinfo.name,
2617 				    NG_PEER_NODE_NAME(hook));
2618 			strcpy(link->nodeinfo.type,
2619 			   NG_PEER_NODE(hook)->nd_type->name);
2620 			link->nodeinfo.id = ng_node2ID(NG_PEER_NODE(hook));
2621 			link->nodeinfo.hooks = NG_PEER_NODE(hook)->nd_numhooks;
2622 			ni->hooks++;
2623 		}
2624 		break;
2625 	    }
2626 
2627 	case NGM_LISTNAMES:
2628 	case NGM_LISTNODES:
2629 	    {
2630 		const int unnamed = (msg->header.cmd == NGM_LISTNODES);
2631 		struct namelist *nl;
2632 		node_p node;
2633 		int num = 0;
2634 
2635 		mtx_lock(&ng_nodelist_mtx);
2636 		/* Count number of nodes */
2637 		LIST_FOREACH(node, &ng_nodelist, nd_nodes) {
2638 			if (NG_NODE_IS_VALID(node)
2639 			&& (unnamed || NG_NODE_HAS_NAME(node))) {
2640 				num++;
2641 			}
2642 		}
2643 		mtx_unlock(&ng_nodelist_mtx);
2644 
2645 		/* Get response struct */
2646 		NG_MKRESPONSE(resp, msg, sizeof(*nl)
2647 		    + (num * sizeof(struct nodeinfo)), M_NOWAIT);
2648 		if (resp == NULL) {
2649 			error = ENOMEM;
2650 			break;
2651 		}
2652 		nl = (struct namelist *) resp->data;
2653 
2654 		/* Cycle through the linked list of nodes */
2655 		nl->numnames = 0;
2656 		mtx_lock(&ng_nodelist_mtx);
2657 		LIST_FOREACH(node, &ng_nodelist, nd_nodes) {
2658 			struct nodeinfo *const np = &nl->nodeinfo[nl->numnames];
2659 
2660 			if (NG_NODE_NOT_VALID(node))
2661 				continue;
2662 			if (!unnamed && (! NG_NODE_HAS_NAME(node)))
2663 				continue;
2664 			if (nl->numnames >= num) {
2665 				log(LOG_ERR, "%s: number of %s changed\n",
2666 				    __func__, "nodes");
2667 				break;
2668 			}
2669 			if (NG_NODE_HAS_NAME(node))
2670 				strcpy(np->name, NG_NODE_NAME(node));
2671 			strcpy(np->type, node->nd_type->name);
2672 			np->id = ng_node2ID(node);
2673 			np->hooks = node->nd_numhooks;
2674 			nl->numnames++;
2675 		}
2676 		mtx_unlock(&ng_nodelist_mtx);
2677 		break;
2678 	    }
2679 
2680 	case NGM_LISTTYPES:
2681 	    {
2682 		struct typelist *tl;
2683 		struct ng_type *type;
2684 		int num = 0;
2685 
2686 		mtx_lock(&ng_typelist_mtx);
2687 		/* Count number of types */
2688 		LIST_FOREACH(type, &ng_typelist, types) {
2689 			num++;
2690 		}
2691 		mtx_unlock(&ng_typelist_mtx);
2692 
2693 		/* Get response struct */
2694 		NG_MKRESPONSE(resp, msg, sizeof(*tl)
2695 		    + (num * sizeof(struct typeinfo)), M_NOWAIT);
2696 		if (resp == NULL) {
2697 			error = ENOMEM;
2698 			break;
2699 		}
2700 		tl = (struct typelist *) resp->data;
2701 
2702 		/* Cycle through the linked list of types */
2703 		tl->numtypes = 0;
2704 		mtx_lock(&ng_typelist_mtx);
2705 		LIST_FOREACH(type, &ng_typelist, types) {
2706 			struct typeinfo *const tp = &tl->typeinfo[tl->numtypes];
2707 
2708 			if (tl->numtypes >= num) {
2709 				log(LOG_ERR, "%s: number of %s changed\n",
2710 				    __func__, "types");
2711 				break;
2712 			}
2713 			strcpy(tp->type_name, type->name);
2714 			tp->numnodes = type->refs - 1; /* don't count list */
2715 			tl->numtypes++;
2716 		}
2717 		mtx_unlock(&ng_typelist_mtx);
2718 		break;
2719 	    }
2720 
2721 	case NGM_BINARY2ASCII:
2722 	    {
2723 		int bufSize = 20 * 1024;	/* XXX hard coded constant */
2724 		const struct ng_parse_type *argstype;
2725 		const struct ng_cmdlist *c;
2726 		struct ng_mesg *binary, *ascii;
2727 
2728 		/* Data area must contain a valid netgraph message */
2729 		binary = (struct ng_mesg *)msg->data;
2730 		if (msg->header.arglen < sizeof(struct ng_mesg) ||
2731 		    (msg->header.arglen - sizeof(struct ng_mesg) <
2732 		    binary->header.arglen)) {
2733 			TRAP_ERROR();
2734 			error = EINVAL;
2735 			break;
2736 		}
2737 
2738 		/* Get a response message with lots of room */
2739 		NG_MKRESPONSE(resp, msg, sizeof(*ascii) + bufSize, M_NOWAIT);
2740 		if (resp == NULL) {
2741 			error = ENOMEM;
2742 			break;
2743 		}
2744 		ascii = (struct ng_mesg *)resp->data;
2745 
2746 		/* Copy binary message header to response message payload */
2747 		bcopy(binary, ascii, sizeof(*binary));
2748 
2749 		/* Find command by matching typecookie and command number */
2750 		for (c = here->nd_type->cmdlist;
2751 		    c != NULL && c->name != NULL; c++) {
2752 			if (binary->header.typecookie == c->cookie
2753 			    && binary->header.cmd == c->cmd)
2754 				break;
2755 		}
2756 		if (c == NULL || c->name == NULL) {
2757 			for (c = ng_generic_cmds; c->name != NULL; c++) {
2758 				if (binary->header.typecookie == c->cookie
2759 				    && binary->header.cmd == c->cmd)
2760 					break;
2761 			}
2762 			if (c->name == NULL) {
2763 				NG_FREE_MSG(resp);
2764 				error = ENOSYS;
2765 				break;
2766 			}
2767 		}
2768 
2769 		/* Convert command name to ASCII */
2770 		snprintf(ascii->header.cmdstr, sizeof(ascii->header.cmdstr),
2771 		    "%s", c->name);
2772 
2773 		/* Convert command arguments to ASCII */
2774 		argstype = (binary->header.flags & NGF_RESP) ?
2775 		    c->respType : c->mesgType;
2776 		if (argstype == NULL) {
2777 			*ascii->data = '\0';
2778 		} else {
2779 			if ((error = ng_unparse(argstype,
2780 			    (u_char *)binary->data,
2781 			    ascii->data, bufSize)) != 0) {
2782 				NG_FREE_MSG(resp);
2783 				break;
2784 			}
2785 		}
2786 
2787 		/* Return the result as struct ng_mesg plus ASCII string */
2788 		bufSize = strlen(ascii->data) + 1;
2789 		ascii->header.arglen = bufSize;
2790 		resp->header.arglen = sizeof(*ascii) + bufSize;
2791 		break;
2792 	    }
2793 
2794 	case NGM_ASCII2BINARY:
2795 	    {
2796 		int bufSize = 2000;	/* XXX hard coded constant */
2797 		const struct ng_cmdlist *c;
2798 		const struct ng_parse_type *argstype;
2799 		struct ng_mesg *ascii, *binary;
2800 		int off = 0;
2801 
2802 		/* Data area must contain at least a struct ng_mesg + '\0' */
2803 		ascii = (struct ng_mesg *)msg->data;
2804 		if ((msg->header.arglen < sizeof(*ascii) + 1) ||
2805 		    (ascii->header.arglen < 1) ||
2806 		    (msg->header.arglen < sizeof(*ascii) +
2807 		    ascii->header.arglen)) {
2808 			TRAP_ERROR();
2809 			error = EINVAL;
2810 			break;
2811 		}
2812 		ascii->data[ascii->header.arglen - 1] = '\0';
2813 
2814 		/* Get a response message with lots of room */
2815 		NG_MKRESPONSE(resp, msg, sizeof(*binary) + bufSize, M_NOWAIT);
2816 		if (resp == NULL) {
2817 			error = ENOMEM;
2818 			break;
2819 		}
2820 		binary = (struct ng_mesg *)resp->data;
2821 
2822 		/* Copy ASCII message header to response message payload */
2823 		bcopy(ascii, binary, sizeof(*ascii));
2824 
2825 		/* Find command by matching ASCII command string */
2826 		for (c = here->nd_type->cmdlist;
2827 		    c != NULL && c->name != NULL; c++) {
2828 			if (strcmp(ascii->header.cmdstr, c->name) == 0)
2829 				break;
2830 		}
2831 		if (c == NULL || c->name == NULL) {
2832 			for (c = ng_generic_cmds; c->name != NULL; c++) {
2833 				if (strcmp(ascii->header.cmdstr, c->name) == 0)
2834 					break;
2835 			}
2836 			if (c->name == NULL) {
2837 				NG_FREE_MSG(resp);
2838 				error = ENOSYS;
2839 				break;
2840 			}
2841 		}
2842 
2843 		/* Convert command name to binary */
2844 		binary->header.cmd = c->cmd;
2845 		binary->header.typecookie = c->cookie;
2846 
2847 		/* Convert command arguments to binary */
2848 		argstype = (binary->header.flags & NGF_RESP) ?
2849 		    c->respType : c->mesgType;
2850 		if (argstype == NULL) {
2851 			bufSize = 0;
2852 		} else {
2853 			if ((error = ng_parse(argstype, ascii->data,
2854 			    &off, (u_char *)binary->data, &bufSize)) != 0) {
2855 				NG_FREE_MSG(resp);
2856 				break;
2857 			}
2858 		}
2859 
2860 		/* Return the result */
2861 		binary->header.arglen = bufSize;
2862 		resp->header.arglen = sizeof(*binary) + bufSize;
2863 		break;
2864 	    }
2865 
2866 	case NGM_TEXT_CONFIG:
2867 	case NGM_TEXT_STATUS:
2868 		/*
2869 		 * This one is tricky as it passes the command down to the
2870 		 * actual node, even though it is a generic type command.
2871 		 * This means we must assume that the item/msg is already freed
2872 		 * when control passes back to us.
2873 		 */
2874 		if (here->nd_type->rcvmsg != NULL) {
2875 			NGI_MSG(item) = msg; /* put it back as we found it */
2876 			return((*here->nd_type->rcvmsg)(here, item, lasthook));
2877 		}
2878 		/* Fall through if rcvmsg not supported */
2879 	default:
2880 		TRAP_ERROR();
2881 		error = EINVAL;
2882 	}
2883 	/*
2884 	 * Sometimes a generic message may be statically allocated
2885 	 * to avoid problems with allocating when in tight memeory situations.
2886 	 * Don't free it if it is so.
2887 	 * I break them appart here, because erros may cause a free if the item
2888 	 * in which case we'd be doing it twice.
2889 	 * they are kept together above, to simplify freeing.
2890 	 */
2891 out:
2892 	NG_RESPOND_MSG(error, here, item, resp);
2893 	if (msg)
2894 		NG_FREE_MSG(msg);
2895 	return (error);
2896 }
2897 
2898 /************************************************************************
2899 			Queue element get/free routines
2900 ************************************************************************/
2901 
2902 uma_zone_t			ng_qzone;
2903 static int			maxalloc = 512;	/* limit the damage of a leak */
2904 
2905 TUNABLE_INT("net.graph.maxalloc", &maxalloc);
2906 SYSCTL_INT(_net_graph, OID_AUTO, maxalloc, CTLFLAG_RDTUN, &maxalloc,
2907     0, "Maximum number of queue items to allocate");
2908 
2909 #ifdef	NETGRAPH_DEBUG
2910 static TAILQ_HEAD(, ng_item) ng_itemlist = TAILQ_HEAD_INITIALIZER(ng_itemlist);
2911 static int			allocated;	/* number of items malloc'd */
2912 #endif
2913 
2914 /*
2915  * Get a queue entry.
2916  * This is usually called when a packet first enters netgraph.
2917  * By definition, this is usually from an interrupt, or from a user.
2918  * Users are not so important, but try be quick for the times that it's
2919  * an interrupt.
2920  */
2921 static __inline item_p
2922 ng_getqblk(int flags)
2923 {
2924 	item_p item = NULL;
2925 	int wait;
2926 
2927 	wait = (flags & NG_WAITOK) ? M_WAITOK : M_NOWAIT;
2928 
2929 	item = uma_zalloc(ng_qzone, wait | M_ZERO);
2930 
2931 #ifdef	NETGRAPH_DEBUG
2932 	if (item) {
2933 			mtx_lock(&ngq_mtx);
2934 			TAILQ_INSERT_TAIL(&ng_itemlist, item, all);
2935 			allocated++;
2936 			mtx_unlock(&ngq_mtx);
2937 	}
2938 #endif
2939 
2940 	return (item);
2941 }
2942 
2943 /*
2944  * Release a queue entry
2945  */
2946 void
2947 ng_free_item(item_p item)
2948 {
2949 	KASSERT(item->apply == NULL, ("%s: leaking apply callback", __func__));
2950 
2951 	/*
2952 	 * The item may hold resources on it's own. We need to free
2953 	 * these before we can free the item. What they are depends upon
2954 	 * what kind of item it is. it is important that nodes zero
2955 	 * out pointers to resources that they remove from the item
2956 	 * or we release them again here.
2957 	 */
2958 	switch (item->el_flags & NGQF_TYPE) {
2959 	case NGQF_DATA:
2960 		/* If we have an mbuf still attached.. */
2961 		NG_FREE_M(_NGI_M(item));
2962 		break;
2963 	case NGQF_MESG:
2964 		_NGI_RETADDR(item) = 0;
2965 		NG_FREE_MSG(_NGI_MSG(item));
2966 		break;
2967 	case NGQF_FN:
2968 		/* nothing to free really, */
2969 		_NGI_FN(item) = NULL;
2970 		_NGI_ARG1(item) = NULL;
2971 		_NGI_ARG2(item) = 0;
2972 	case NGQF_UNDEF:
2973 		break;
2974 	}
2975 	/* If we still have a node or hook referenced... */
2976 	_NGI_CLR_NODE(item);
2977 	_NGI_CLR_HOOK(item);
2978 
2979 #ifdef	NETGRAPH_DEBUG
2980 	mtx_lock(&ngq_mtx);
2981 	TAILQ_REMOVE(&ng_itemlist, item, all);
2982 	allocated--;
2983 	mtx_unlock(&ngq_mtx);
2984 #endif
2985 	uma_zfree(ng_qzone, item);
2986 }
2987 
2988 /************************************************************************
2989 			Module routines
2990 ************************************************************************/
2991 
2992 /*
2993  * Handle the loading/unloading of a netgraph node type module
2994  */
2995 int
2996 ng_mod_event(module_t mod, int event, void *data)
2997 {
2998 	struct ng_type *const type = data;
2999 	int s, error = 0;
3000 
3001 	switch (event) {
3002 	case MOD_LOAD:
3003 
3004 		/* Register new netgraph node type */
3005 		s = splnet();
3006 		if ((error = ng_newtype(type)) != 0) {
3007 			splx(s);
3008 			break;
3009 		}
3010 
3011 		/* Call type specific code */
3012 		if (type->mod_event != NULL)
3013 			if ((error = (*type->mod_event)(mod, event, data))) {
3014 				mtx_lock(&ng_typelist_mtx);
3015 				type->refs--;	/* undo it */
3016 				LIST_REMOVE(type, types);
3017 				mtx_unlock(&ng_typelist_mtx);
3018 			}
3019 		splx(s);
3020 		break;
3021 
3022 	case MOD_UNLOAD:
3023 		s = splnet();
3024 		if (type->refs > 1) {		/* make sure no nodes exist! */
3025 			error = EBUSY;
3026 		} else {
3027 			if (type->refs == 0) {
3028 				/* failed load, nothing to undo */
3029 				splx(s);
3030 				break;
3031 			}
3032 			if (type->mod_event != NULL) {	/* check with type */
3033 				error = (*type->mod_event)(mod, event, data);
3034 				if (error != 0) {	/* type refuses.. */
3035 					splx(s);
3036 					break;
3037 				}
3038 			}
3039 			mtx_lock(&ng_typelist_mtx);
3040 			LIST_REMOVE(type, types);
3041 			mtx_unlock(&ng_typelist_mtx);
3042 		}
3043 		splx(s);
3044 		break;
3045 
3046 	default:
3047 		if (type->mod_event != NULL)
3048 			error = (*type->mod_event)(mod, event, data);
3049 		else
3050 			error = EOPNOTSUPP;		/* XXX ? */
3051 		break;
3052 	}
3053 	return (error);
3054 }
3055 
3056 /*
3057  * Handle loading and unloading for this code.
3058  * The only thing we need to link into is the NETISR strucure.
3059  */
3060 static int
3061 ngb_mod_event(module_t mod, int event, void *data)
3062 {
3063 	int error = 0;
3064 
3065 	switch (event) {
3066 	case MOD_LOAD:
3067 		/* Initialize everything. */
3068 		mtx_init(&ng_worklist_mtx, "ng_worklist", NULL, MTX_SPIN);
3069 		mtx_init(&ng_typelist_mtx, "netgraph types mutex", NULL,
3070 		    MTX_DEF);
3071 		mtx_init(&ng_nodelist_mtx, "netgraph nodelist mutex", NULL,
3072 		    MTX_DEF);
3073 		mtx_init(&ng_idhash_mtx, "netgraph idhash mutex", NULL,
3074 		    MTX_DEF);
3075 		mtx_init(&ng_topo_mtx, "netgraph topology mutex", NULL,
3076 		    MTX_DEF);
3077 #ifdef	NETGRAPH_DEBUG
3078 		mtx_init(&ngq_mtx, "netgraph item list mutex", NULL,
3079 		    MTX_DEF);
3080 #endif
3081 		ng_qzone = uma_zcreate("NetGraph items", sizeof(struct ng_item),
3082 		    NULL, NULL, NULL, NULL, UMA_ALIGN_CACHE, 0);
3083 		uma_zone_set_max(ng_qzone, maxalloc);
3084 		netisr_register(NETISR_NETGRAPH, (netisr_t *)ngintr, NULL,
3085 		    NETISR_MPSAFE);
3086 		break;
3087 	case MOD_UNLOAD:
3088 		/* You cant unload it because an interface may be using it.  */
3089 		error = EBUSY;
3090 		break;
3091 	default:
3092 		error = EOPNOTSUPP;
3093 		break;
3094 	}
3095 	return (error);
3096 }
3097 
3098 static moduledata_t netgraph_mod = {
3099 	"netgraph",
3100 	ngb_mod_event,
3101 	(NULL)
3102 };
3103 DECLARE_MODULE(netgraph, netgraph_mod, SI_SUB_NETGRAPH, SI_ORDER_MIDDLE);
3104 SYSCTL_NODE(_net, OID_AUTO, graph, CTLFLAG_RW, 0, "netgraph Family");
3105 SYSCTL_INT(_net_graph, OID_AUTO, abi_version, CTLFLAG_RD, 0, NG_ABI_VERSION,"");
3106 SYSCTL_INT(_net_graph, OID_AUTO, msg_version, CTLFLAG_RD, 0, NG_VERSION, "");
3107 
3108 #ifdef	NETGRAPH_DEBUG
3109 void
3110 dumphook (hook_p hook, char *file, int line)
3111 {
3112 	printf("hook: name %s, %d refs, Last touched:\n",
3113 		_NG_HOOK_NAME(hook), hook->hk_refs);
3114 	printf("	Last active @ %s, line %d\n",
3115 		hook->lastfile, hook->lastline);
3116 	if (line) {
3117 		printf(" problem discovered at file %s, line %d\n", file, line);
3118 	}
3119 }
3120 
3121 void
3122 dumpnode(node_p node, char *file, int line)
3123 {
3124 	printf("node: ID [%x]: type '%s', %d hooks, flags 0x%x, %d refs, %s:\n",
3125 		_NG_NODE_ID(node), node->nd_type->name,
3126 		node->nd_numhooks, node->nd_flags,
3127 		node->nd_refs, node->nd_name);
3128 	printf("	Last active @ %s, line %d\n",
3129 		node->lastfile, node->lastline);
3130 	if (line) {
3131 		printf(" problem discovered at file %s, line %d\n", file, line);
3132 	}
3133 }
3134 
3135 void
3136 dumpitem(item_p item, char *file, int line)
3137 {
3138 	printf(" ACTIVE item, last used at %s, line %d",
3139 		item->lastfile, item->lastline);
3140 	switch(item->el_flags & NGQF_TYPE) {
3141 	case NGQF_DATA:
3142 		printf(" - [data]\n");
3143 		break;
3144 	case NGQF_MESG:
3145 		printf(" - retaddr[%d]:\n", _NGI_RETADDR(item));
3146 		break;
3147 	case NGQF_FN:
3148 		printf(" - fn@%p (%p, %p, %p, %d (%x))\n",
3149 			item->body.fn.fn_fn,
3150 			_NGI_NODE(item),
3151 			_NGI_HOOK(item),
3152 			item->body.fn.fn_arg1,
3153 			item->body.fn.fn_arg2,
3154 			item->body.fn.fn_arg2);
3155 		break;
3156 	case NGQF_UNDEF:
3157 		printf(" - UNDEFINED!\n");
3158 	}
3159 	if (line) {
3160 		printf(" problem discovered at file %s, line %d\n", file, line);
3161 		if (_NGI_NODE(item)) {
3162 			printf("node %p ([%x])\n",
3163 				_NGI_NODE(item), ng_node2ID(_NGI_NODE(item)));
3164 		}
3165 	}
3166 }
3167 
3168 static void
3169 ng_dumpitems(void)
3170 {
3171 	item_p item;
3172 	int i = 1;
3173 	TAILQ_FOREACH(item, &ng_itemlist, all) {
3174 		printf("[%d] ", i++);
3175 		dumpitem(item, NULL, 0);
3176 	}
3177 }
3178 
3179 static void
3180 ng_dumpnodes(void)
3181 {
3182 	node_p node;
3183 	int i = 1;
3184 	mtx_lock(&ng_nodelist_mtx);
3185 	SLIST_FOREACH(node, &ng_allnodes, nd_all) {
3186 		printf("[%d] ", i++);
3187 		dumpnode(node, NULL, 0);
3188 	}
3189 	mtx_unlock(&ng_nodelist_mtx);
3190 }
3191 
3192 static void
3193 ng_dumphooks(void)
3194 {
3195 	hook_p hook;
3196 	int i = 1;
3197 	mtx_lock(&ng_nodelist_mtx);
3198 	SLIST_FOREACH(hook, &ng_allhooks, hk_all) {
3199 		printf("[%d] ", i++);
3200 		dumphook(hook, NULL, 0);
3201 	}
3202 	mtx_unlock(&ng_nodelist_mtx);
3203 }
3204 
3205 static int
3206 sysctl_debug_ng_dump_items(SYSCTL_HANDLER_ARGS)
3207 {
3208 	int error;
3209 	int val;
3210 	int i;
3211 
3212 	val = allocated;
3213 	i = 1;
3214 	error = sysctl_handle_int(oidp, &val, sizeof(int), req);
3215 	if (error != 0 || req->newptr == NULL)
3216 		return (error);
3217 	if (val == 42) {
3218 		ng_dumpitems();
3219 		ng_dumpnodes();
3220 		ng_dumphooks();
3221 	}
3222 	return (0);
3223 }
3224 
3225 SYSCTL_PROC(_debug, OID_AUTO, ng_dump_items, CTLTYPE_INT | CTLFLAG_RW,
3226     0, sizeof(int), sysctl_debug_ng_dump_items, "I", "Number of allocated items");
3227 #endif	/* NETGRAPH_DEBUG */
3228 
3229 
3230 /***********************************************************************
3231 * Worklist routines
3232 **********************************************************************/
3233 /* NETISR thread enters here */
3234 /*
3235  * Pick a node off the list of nodes with work,
3236  * try get an item to process off it.
3237  * If there are no more, remove the node from the list.
3238  */
3239 static void
3240 ngintr(void)
3241 {
3242 	item_p item;
3243 	node_p  node = NULL;
3244 
3245 	for (;;) {
3246 		mtx_lock_spin(&ng_worklist_mtx);
3247 		node = TAILQ_FIRST(&ng_worklist);
3248 		if (!node) {
3249 			mtx_unlock_spin(&ng_worklist_mtx);
3250 			break;
3251 		}
3252 		node->nd_flags &= ~NGF_WORKQ;
3253 		TAILQ_REMOVE(&ng_worklist, node, nd_work);
3254 		mtx_unlock_spin(&ng_worklist_mtx);
3255 		CTR3(KTR_NET, "%20s: node [%x] (%p) taken off worklist",
3256 		    __func__, node->nd_ID, node);
3257 		/*
3258 		 * We have the node. We also take over the reference
3259 		 * that the list had on it.
3260 		 * Now process as much as you can, until it won't
3261 		 * let you have another item off the queue.
3262 		 * All this time, keep the reference
3263 		 * that lets us be sure that the node still exists.
3264 		 * Let the reference go at the last minute.
3265 		 * ng_dequeue will put us back on the worklist
3266 		 * if there is more too do. This may be of use if there
3267 		 * are Multiple Processors and multiple Net threads in the
3268 		 * future.
3269 		 */
3270 		for (;;) {
3271 			int rw;
3272 
3273 			mtx_lock_spin(&node->nd_input_queue.q_mtx);
3274 			item = ng_dequeue(&node->nd_input_queue, &rw);
3275 			if (item == NULL) {
3276 				mtx_unlock_spin(&node->nd_input_queue.q_mtx);
3277 				break; /* go look for another node */
3278 			} else {
3279 				mtx_unlock_spin(&node->nd_input_queue.q_mtx);
3280 				NGI_GET_NODE(item, node); /* zaps stored node */
3281 				ng_apply_item(node, item, rw);
3282 				NG_NODE_UNREF(node);
3283 			}
3284 		}
3285 		NG_NODE_UNREF(node);
3286 	}
3287 }
3288 
3289 static void
3290 ng_worklist_remove(node_p node)
3291 {
3292 	mtx_assert(&node->nd_input_queue.q_mtx, MA_OWNED);
3293 
3294 	mtx_lock_spin(&ng_worklist_mtx);
3295 	if (node->nd_flags & NGF_WORKQ) {
3296 		node->nd_flags &= ~NGF_WORKQ;
3297 		TAILQ_REMOVE(&ng_worklist, node, nd_work);
3298 		mtx_unlock_spin(&ng_worklist_mtx);
3299 		NG_NODE_UNREF(node);
3300 		CTR3(KTR_NET, "%20s: node [%x] (%p) removed from worklist",
3301 		    __func__, node->nd_ID, node);
3302 	} else {
3303 		mtx_unlock_spin(&ng_worklist_mtx);
3304 	}
3305 }
3306 
3307 /*
3308  * XXX
3309  * It's posible that a debugging NG_NODE_REF may need
3310  * to be outside the mutex zone
3311  */
3312 static void
3313 ng_setisr(node_p node)
3314 {
3315 
3316 	mtx_assert(&node->nd_input_queue.q_mtx, MA_OWNED);
3317 
3318 	if ((node->nd_flags & NGF_WORKQ) == 0) {
3319 		/*
3320 		 * If we are not already on the work queue,
3321 		 * then put us on.
3322 		 */
3323 		node->nd_flags |= NGF_WORKQ;
3324 		mtx_lock_spin(&ng_worklist_mtx);
3325 		TAILQ_INSERT_TAIL(&ng_worklist, node, nd_work);
3326 		mtx_unlock_spin(&ng_worklist_mtx);
3327 		NG_NODE_REF(node); /* XXX fafe in mutex? */
3328 		CTR3(KTR_NET, "%20s: node [%x] (%p) put on worklist", __func__,
3329 		    node->nd_ID, node);
3330 	} else
3331 		CTR3(KTR_NET, "%20s: node [%x] (%p) already on worklist",
3332 		    __func__, node->nd_ID, node);
3333 	schednetisr(NETISR_NETGRAPH);
3334 }
3335 
3336 
3337 /***********************************************************************
3338 * Externally useable functions to set up a queue item ready for sending
3339 ***********************************************************************/
3340 
3341 #ifdef	NETGRAPH_DEBUG
3342 #define	ITEM_DEBUG_CHECKS						\
3343 	do {								\
3344 		if (NGI_NODE(item) ) {					\
3345 			printf("item already has node");		\
3346 			kdb_enter("has node");				\
3347 			NGI_CLR_NODE(item);				\
3348 		}							\
3349 		if (NGI_HOOK(item) ) {					\
3350 			printf("item already has hook");		\
3351 			kdb_enter("has hook");				\
3352 			NGI_CLR_HOOK(item);				\
3353 		}							\
3354 	} while (0)
3355 #else
3356 #define ITEM_DEBUG_CHECKS
3357 #endif
3358 
3359 /*
3360  * Put mbuf into the item.
3361  * Hook and node references will be removed when the item is dequeued.
3362  * (or equivalent)
3363  * (XXX) Unsafe because no reference held by peer on remote node.
3364  * remote node might go away in this timescale.
3365  * We know the hooks can't go away because that would require getting
3366  * a writer item on both nodes and we must have at least a  reader
3367  * here to be able to do this.
3368  * Note that the hook loaded is the REMOTE hook.
3369  *
3370  * This is possibly in the critical path for new data.
3371  */
3372 item_p
3373 ng_package_data(struct mbuf *m, int flags)
3374 {
3375 	item_p item;
3376 
3377 	if ((item = ng_getqblk(flags)) == NULL) {
3378 		NG_FREE_M(m);
3379 		return (NULL);
3380 	}
3381 	ITEM_DEBUG_CHECKS;
3382 	item->el_flags = NGQF_DATA | NGQF_READER;
3383 	item->el_next = NULL;
3384 	NGI_M(item) = m;
3385 	return (item);
3386 }
3387 
3388 /*
3389  * Allocate a queue item and put items into it..
3390  * Evaluate the address as this will be needed to queue it and
3391  * to work out what some of the fields should be.
3392  * Hook and node references will be removed when the item is dequeued.
3393  * (or equivalent)
3394  */
3395 item_p
3396 ng_package_msg(struct ng_mesg *msg, int flags)
3397 {
3398 	item_p item;
3399 
3400 	if ((item = ng_getqblk(flags)) == NULL) {
3401 		NG_FREE_MSG(msg);
3402 		return (NULL);
3403 	}
3404 	ITEM_DEBUG_CHECKS;
3405 	/* Messages items count as writers unless explicitly exempted. */
3406 	if (msg->header.cmd & NGM_READONLY)
3407 		item->el_flags = NGQF_MESG | NGQF_READER;
3408 	else
3409 		item->el_flags = NGQF_MESG | NGQF_WRITER;
3410 	item->el_next = NULL;
3411 	/*
3412 	 * Set the current lasthook into the queue item
3413 	 */
3414 	NGI_MSG(item) = msg;
3415 	NGI_RETADDR(item) = 0;
3416 	return (item);
3417 }
3418 
3419 
3420 
3421 #define SET_RETADDR(item, here, retaddr)				\
3422 	do {	/* Data or fn items don't have retaddrs */		\
3423 		if ((item->el_flags & NGQF_TYPE) == NGQF_MESG) {	\
3424 			if (retaddr) {					\
3425 				NGI_RETADDR(item) = retaddr;		\
3426 			} else {					\
3427 				/*					\
3428 				 * The old return address should be ok.	\
3429 				 * If there isn't one, use the address	\
3430 				 * here.				\
3431 				 */					\
3432 				if (NGI_RETADDR(item) == 0) {		\
3433 					NGI_RETADDR(item)		\
3434 						= ng_node2ID(here);	\
3435 				}					\
3436 			}						\
3437 		}							\
3438 	} while (0)
3439 
3440 int
3441 ng_address_hook(node_p here, item_p item, hook_p hook, ng_ID_t retaddr)
3442 {
3443 	hook_p peer;
3444 	node_p peernode;
3445 	ITEM_DEBUG_CHECKS;
3446 	/*
3447 	 * Quick sanity check..
3448 	 * Since a hook holds a reference on it's node, once we know
3449 	 * that the peer is still connected (even if invalid,) we know
3450 	 * that the peer node is present, though maybe invalid.
3451 	 */
3452 	if ((hook == NULL)
3453 	|| NG_HOOK_NOT_VALID(hook)
3454 	|| (NG_HOOK_PEER(hook) == NULL)
3455 	|| NG_HOOK_NOT_VALID(NG_HOOK_PEER(hook))
3456 	|| NG_NODE_NOT_VALID(NG_PEER_NODE(hook))) {
3457 		NG_FREE_ITEM(item);
3458 		TRAP_ERROR();
3459 		return (ENETDOWN);
3460 	}
3461 
3462 	/*
3463 	 * Transfer our interest to the other (peer) end.
3464 	 */
3465 	peer = NG_HOOK_PEER(hook);
3466 	NG_HOOK_REF(peer);
3467 	NGI_SET_HOOK(item, peer);
3468 	peernode = NG_PEER_NODE(hook);
3469 	NG_NODE_REF(peernode);
3470 	NGI_SET_NODE(item, peernode);
3471 	SET_RETADDR(item, here, retaddr);
3472 	return (0);
3473 }
3474 
3475 int
3476 ng_address_path(node_p here, item_p item, char *address, ng_ID_t retaddr)
3477 {
3478 	node_p	dest = NULL;
3479 	hook_p	hook = NULL;
3480 	int	error;
3481 
3482 	ITEM_DEBUG_CHECKS;
3483 	/*
3484 	 * Note that ng_path2noderef increments the reference count
3485 	 * on the node for us if it finds one. So we don't have to.
3486 	 */
3487 	error = ng_path2noderef(here, address, &dest, &hook);
3488 	if (error) {
3489 		NG_FREE_ITEM(item);
3490 		return (error);
3491 	}
3492 	NGI_SET_NODE(item, dest);
3493 	if ( hook) {
3494 		NG_HOOK_REF(hook);	/* don't let it go while on the queue */
3495 		NGI_SET_HOOK(item, hook);
3496 	}
3497 	SET_RETADDR(item, here, retaddr);
3498 	return (0);
3499 }
3500 
3501 int
3502 ng_address_ID(node_p here, item_p item, ng_ID_t ID, ng_ID_t retaddr)
3503 {
3504 	node_p dest;
3505 
3506 	ITEM_DEBUG_CHECKS;
3507 	/*
3508 	 * Find the target node.
3509 	 */
3510 	dest = ng_ID2noderef(ID); /* GETS REFERENCE! */
3511 	if (dest == NULL) {
3512 		NG_FREE_ITEM(item);
3513 		TRAP_ERROR();
3514 		return(EINVAL);
3515 	}
3516 	/* Fill out the contents */
3517 	NGI_SET_NODE(item, dest);
3518 	NGI_CLR_HOOK(item);
3519 	SET_RETADDR(item, here, retaddr);
3520 	return (0);
3521 }
3522 
3523 /*
3524  * special case to send a message to self (e.g. destroy node)
3525  * Possibly indicate an arrival hook too.
3526  * Useful for removing that hook :-)
3527  */
3528 item_p
3529 ng_package_msg_self(node_p here, hook_p hook, struct ng_mesg *msg)
3530 {
3531 	item_p item;
3532 
3533 	/*
3534 	 * Find the target node.
3535 	 * If there is a HOOK argument, then use that in preference
3536 	 * to the address.
3537 	 */
3538 	if ((item = ng_getqblk(NG_NOFLAGS)) == NULL) {
3539 		NG_FREE_MSG(msg);
3540 		return (NULL);
3541 	}
3542 
3543 	/* Fill out the contents */
3544 	item->el_flags = NGQF_MESG | NGQF_WRITER;
3545 	item->el_next = NULL;
3546 	NG_NODE_REF(here);
3547 	NGI_SET_NODE(item, here);
3548 	if (hook) {
3549 		NG_HOOK_REF(hook);
3550 		NGI_SET_HOOK(item, hook);
3551 	}
3552 	NGI_MSG(item) = msg;
3553 	NGI_RETADDR(item) = ng_node2ID(here);
3554 	return (item);
3555 }
3556 
3557 int
3558 ng_send_fn1(node_p node, hook_p hook, ng_item_fn *fn, void * arg1, int arg2,
3559 	int flags)
3560 {
3561 	item_p item;
3562 
3563 	if ((item = ng_getqblk(flags)) == NULL) {
3564 		return (ENOMEM);
3565 	}
3566 	item->el_flags = NGQF_FN | NGQF_WRITER;
3567 	NG_NODE_REF(node); /* and one for the item */
3568 	NGI_SET_NODE(item, node);
3569 	if (hook) {
3570 		NG_HOOK_REF(hook);
3571 		NGI_SET_HOOK(item, hook);
3572 	}
3573 	NGI_FN(item) = fn;
3574 	NGI_ARG1(item) = arg1;
3575 	NGI_ARG2(item) = arg2;
3576 	return(ng_snd_item(item, flags));
3577 }
3578 
3579 /*
3580  * Official timeout routines for Netgraph nodes.
3581  */
3582 static void
3583 ng_callout_trampoline(void *arg)
3584 {
3585 	item_p item = arg;
3586 
3587 	ng_snd_item(item, 0);
3588 }
3589 
3590 
3591 int
3592 ng_callout(struct callout *c, node_p node, hook_p hook, int ticks,
3593     ng_item_fn *fn, void * arg1, int arg2)
3594 {
3595 	item_p item, oitem;
3596 
3597 	if ((item = ng_getqblk(NG_NOFLAGS)) == NULL)
3598 		return (ENOMEM);
3599 
3600 	item->el_flags = NGQF_FN | NGQF_WRITER;
3601 	NG_NODE_REF(node);		/* and one for the item */
3602 	NGI_SET_NODE(item, node);
3603 	if (hook) {
3604 		NG_HOOK_REF(hook);
3605 		NGI_SET_HOOK(item, hook);
3606 	}
3607 	NGI_FN(item) = fn;
3608 	NGI_ARG1(item) = arg1;
3609 	NGI_ARG2(item) = arg2;
3610 	oitem = c->c_arg;
3611 	if (callout_reset(c, ticks, &ng_callout_trampoline, item) == 1 &&
3612 	    oitem != NULL)
3613 		NG_FREE_ITEM(oitem);
3614 	return (0);
3615 }
3616 
3617 /* A special modified version of untimeout() */
3618 int
3619 ng_uncallout(struct callout *c, node_p node)
3620 {
3621 	item_p item;
3622 	int rval;
3623 
3624 	KASSERT(c != NULL, ("ng_uncallout: NULL callout"));
3625 	KASSERT(node != NULL, ("ng_uncallout: NULL node"));
3626 
3627 	rval = callout_stop(c);
3628 	item = c->c_arg;
3629 	/* Do an extra check */
3630 	if ((rval > 0) && (c->c_func == &ng_callout_trampoline) &&
3631 	    (NGI_NODE(item) == node)) {
3632 		/*
3633 		 * We successfully removed it from the queue before it ran
3634 		 * So now we need to unreference everything that was
3635 		 * given extra references. (NG_FREE_ITEM does this).
3636 		 */
3637 		NG_FREE_ITEM(item);
3638 	}
3639 	c->c_arg = NULL;
3640 
3641 	return (rval);
3642 }
3643 
3644 /*
3645  * Set the address, if none given, give the node here.
3646  */
3647 void
3648 ng_replace_retaddr(node_p here, item_p item, ng_ID_t retaddr)
3649 {
3650 	if (retaddr) {
3651 		NGI_RETADDR(item) = retaddr;
3652 	} else {
3653 		/*
3654 		 * The old return address should be ok.
3655 		 * If there isn't one, use the address here.
3656 		 */
3657 		NGI_RETADDR(item) = ng_node2ID(here);
3658 	}
3659 }
3660 
3661 #define TESTING
3662 #ifdef TESTING
3663 /* just test all the macros */
3664 void
3665 ng_macro_test(item_p item);
3666 void
3667 ng_macro_test(item_p item)
3668 {
3669 	node_p node = NULL;
3670 	hook_p hook = NULL;
3671 	struct mbuf *m;
3672 	struct ng_mesg *msg;
3673 	ng_ID_t retaddr;
3674 	int	error;
3675 
3676 	NGI_GET_M(item, m);
3677 	NGI_GET_MSG(item, msg);
3678 	retaddr = NGI_RETADDR(item);
3679 	NG_SEND_DATA(error, hook, m, NULL);
3680 	NG_SEND_DATA_ONLY(error, hook, m);
3681 	NG_FWD_NEW_DATA(error, item, hook, m);
3682 	NG_FWD_ITEM_HOOK(error, item, hook);
3683 	NG_SEND_MSG_HOOK(error, node, msg, hook, retaddr);
3684 	NG_SEND_MSG_ID(error, node, msg, retaddr, retaddr);
3685 	NG_SEND_MSG_PATH(error, node, msg, ".:", retaddr);
3686 	NG_FWD_MSG_HOOK(error, node, item, hook, retaddr);
3687 }
3688 #endif /* TESTING */
3689 
3690