xref: /illumos-gate/usr/src/uts/common/io/hook.c (revision 45405cce)

/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 *
 * Copyright 2013 Joyent, Inc.  All rights reserved.
 */
#include <sys/param.h>
#include <sys/types.h>
#include <sys/systm.h>
#include <sys/errno.h>
#include <sys/kmem.h>
#include <sys/mutex.h>
#include <sys/condvar.h>
#include <sys/modctl.h>
#include <sys/hook_impl.h>
#include <sys/sdt.h>
#include <sys/cmn_err.h>

/*
 * This file provides kernel hook framework.
 */

static struct modldrv modlmisc = {
	&mod_miscops,				/* drv_modops */
	"Hooks Interface v1.0",			/* drv_linkinfo */
};

static struct modlinkage modlinkage = {
	MODREV_1,				/* ml_rev */
	&modlmisc,				/* ml_linkage */
	NULL
};

static const char *hook_hintvalue_none = "<none>";

/*
 * How it works.
 * =============
 * Use of the hook framework here is tied up with zones - when a new zone
 * is created, we create a new hook_stack_t and are open to business for
 * allowing new hook families and their events.
 *
 * A consumer of these hooks is expected to operate in this fashion:
 * 1) call hook_family_add() to create a new family of hooks. It is a
 *    current requirement that this call must be made with the value
 *    returned from hook_stack_init, by way of infrastructure elsewhere.
 * 2) add events to the registered family with calls to hook_event_add.
 *
 * At this point, the structures in place should be open to others to
 * add hooks to the event or add notifiers for when the contents of the
 * hook stack changes.
 *
 * The interesting stuff happens on teardown.
 *
 * It is a requirement that the provider of hook events work in the reverse
 * order to the above, so that the first step is:
 * 1) remove events from each hook family created earlier
 * 2) remove hook families from the hook stack.
 *
 * When doing teardown of both events and families, a check is made to see
 * if either structure is still "busy". If so then a boolean flag (FWF_DESTROY)
 * is set to say that the structure is condemned. The presence of this flag
 * being set must be checked for in _add()/_register()/ functions and a
 * failure returned if it is set. It is ignored by the _find() functions
 * because they're used by _remove()/_unregister().
 * While setting the condemned flag when trying to delete a structure would
 * normally be keyed from the presence of a reference count being greater
 * than 1, in this implementation there are no reference counts required:
 * instead the presence of objects on linked lists is taken to mean
 * something is still "busy."
 *
 * ONLY the caller that adds the family and the events ever has a direct
 * reference to the internal structures and thus ONLY it should be doing
 * the removal of either the event or family.  In practise, what this means
 * is that in ip_netinfo.c, we have calls to net_protocol_register(), followed
 * by net_event_register() (these interface to hook_family_add() and
 * hook_event_add(), respectively) that are made when we create an instance
 * of IP and when the IP instance is shutdown/destroyed, it calls
 * net_event_unregister() and net_protocol_unregister(), which in turn call
 * hook_event_remove() and hook_family_remove() respectively. Nobody else
 * is entitled to call the _unregister() functions.  It is imperative that
 * there be only one _remove() call for every _add() call.
 *
 * It is possible that code which is interfacing with this hook framework
 * won't do all the cleaning up that it needs to at the right time. While
 * we can't prevent programmers from creating memory leaks, we can synchronise
 * when we clean up data structures to prevent code accessing free'd memory.
 *
 * A simple diagram showing the ownership is as follows:
 *
 *  Owned       +--------------+
 *   by         | hook_stack_t |
 *   the        +--------------+
 *  Instance      |
 * - - - - - - - -|- - - - - - - - - - - - - - - - - -
 *                V
 *  Owned       +-------------------+     +-------------------+
 *              | hook_family_int_t |---->| hook_family_int_t |
 *   by         +-------------------+     +-------------------+
 *                | \+---------------+        \+---------------+
 *  network       |  | hook_family_t |         | hook_family_t |
 *                V  +---------------+         +---------------+
 *  protocol   +------------------+     +------------------+
 *             | hook_event_int_t |---->| hook_event_int_t |
 * (ipv4,ipv6) +------------------+     +------------------+
 *                | \+--------------+        \+--------------+
 *                |  | hook_event_t |         | hook_event_t |
 *                |  +--------------+         +--------------+
 * - - - - - - - -|- - - - - - - - - - - - - - - - - -
 *                V
 *  Owned      +------------+
 *             | hook_int_t |
 *   by        +------------+
 *                  \+--------+
 * the consumer      | hook_t |
 *                   +--------+
 *
 * The consumers, such as IPFilter, do not have any pointers or hold any
 * references to hook_int_t, hook_event_t or hook_event_int_t. By placing
 * a hook on an event through net_hook_register(), an implicit reference
 * to the hook_event_int_t is returned with a successful call.  Additionally,
 * IPFilter does not see the hook_family_int_t or hook_family_t directly.
 * Rather it is returned a net_handle_t (from net_protocol_lookup()) that
 * contains a pointer to hook_family_int_t.  The structure behind the
 * net_handle_t (struct net_data) *is* reference counted and managed
 * appropriately.
 *
 * A more detailed picture that describes how the family/event structures
 * are linked together can be found in <sys/hook_impl.h>
 *
 * Notification callbacks.
 * =======================
 * For each of the hook stack, hook family and hook event, it is possible
 * to request notificatin of change to them. Why?
 * First, lets equate the hook stack to an IP instance, a hook family to
 * a network protocol and a hook event to IP packets on the input path.
 * If a kernel module wants to apply security from the very start of
 * things, it needs to know as soon as a new instance of networking
 * is initiated. Whilst for the global zone, it is taken for granted that
 * this instance will always exist before any interaction takes place,
 * that is not true for zones running with an exclusive networking instance.
 * Thus when a local zone is started and a new instance is created to support
 * that, parties that wish to monitor it and apply a security policy from
 * the onset need to be informed as early as possible - quite probably
 * before any networking is started by the zone's boot scripts.
 * Inside each instance, it is possible to have a number of network protocols
 * (hook families) in operation. Inside the context of the global zone,
 * it is possible to have code run before the kernel module providing the
 * IP networking is loaded. From here, to apply the appropriate security,
 * it is necessary to become informed of when IP is being configured into
 * the zone and this is done by registering a notification callback with
 * the hook stack for changes to it. The next step is to know when packets
 * can be received through the physical_in, etc, events. This is achieved
 * by registering a callback with the appropriate network protocol (or in
 * this file, the correct hook family.) Thus when IP finally attaches a
 * physical_in event to inet, the module looking to enforce a security
 * policy can become aware of it being present. Of course there's no
 * requirement for such a module to be present before all of the above
 * happens and in such a case, it is reasonable for the same module to
 * work after everything has been put in place. For this reason, when
 * a notification callback is added, a series of fake callback events
 * is generated to simulate the arrival of those entities. There is one
 * final series of callbacks that can be registered - those to monitor
 * actual hooks that are added or removed from an event. In practice,
 * this is useful when there are multiple kernel modules participating
 * in the processing of packets and there are behaviour dependencies
 * involved, such that one kernel module might only register its hook
 * if another is already present and also might want to remove its hook
 * when the other disappears.
 *
 * If you know a kernel module will not be loaded before the infrastructure
 * used in this file is present then it is not necessary to use this
 * notification callback mechanism.
 */

/*
 * Locking
 * =======
 * The use of CVW_* macros to do locking is driven by the need to allow
 * recursive locking with read locks when we're processing packets. This
 * is necessary because various netinfo functions need to hold read locks,
 * by design, as they can be called in or out of packet context.
 */
/*
 * Hook internal functions
 */
static hook_int_t *hook_copy(hook_t *src);
static hook_event_int_t *hook_event_checkdup(hook_event_t *he,
    hook_stack_t *hks);
static hook_event_int_t *hook_event_copy(hook_event_t *src);
static hook_event_int_t *hook_event_find(hook_family_int_t *hfi, char *event);
static void hook_event_free(hook_event_int_t *hei, hook_family_int_t *hfi);
static hook_family_int_t *hook_family_copy(hook_family_t *src);
static hook_family_int_t *hook_family_find(char *family, hook_stack_t *hks);
static void hook_family_free(hook_family_int_t *hfi, hook_stack_t *hks);
static hook_int_t *hook_find(hook_event_int_t *hei, hook_t *h);
static void hook_int_free(hook_int_t *hi, netstackid_t);
static void hook_init(void);
static void hook_fini(void);
static void *hook_stack_init(netstackid_t stackid, netstack_t *ns);
static void hook_stack_fini(netstackid_t stackid, void *arg);
static void hook_stack_shutdown(netstackid_t stackid, void *arg);
static int hook_insert(hook_int_head_t *head, hook_int_t *new);
static void hook_insert_plain(hook_int_head_t *head, hook_int_t *new);
static int hook_insert_afterbefore(hook_int_head_t *head, hook_int_t *new);
static hook_int_t *hook_find_byname(hook_int_head_t *head, char *name);
static void hook_event_init_kstats(hook_family_int_t *, hook_event_int_t *);
static void hook_event_notify_run(hook_event_int_t *, hook_family_int_t *,
    char *event, char *name, hook_notify_cmd_t cmd);
static void hook_init_kstats(hook_family_int_t *hfi, hook_event_int_t *hei,
    hook_int_t *hi);
static int hook_notify_register(hook_notify_head_t *head,
    hook_notify_fn_t callback, void *arg);
static int hook_notify_unregister(hook_notify_head_t *head,
    hook_notify_fn_t callback, void **);
static void hook_notify_run(hook_notify_head_t *head, char *family,
    char *event, char *name, hook_notify_cmd_t cmd);
static void hook_stack_notify_run(hook_stack_t *hks, char *name,
    hook_notify_cmd_t cmd);
static void hook_stack_remove(hook_stack_t *hks);

/*
 * A list of the hook stacks is kept here because we need to enable
 * net_instance_notify_register() to be called during the creation
 * of a new instance. Previously hook_stack_get() would just use
 * the netstack functions for this work but they will return NULL
 * until the zone has been fully initialised.
 */
static hook_stack_head_t hook_stacks;
static kmutex_t hook_stack_lock;

/*
 * Module entry points.
 */
int
_init(void)
{
	int error;

	hook_init();
	error = mod_install(&modlinkage);
	if (error != 0)
		hook_fini();

	return (error);
}

int
_fini(void)
{
	int error;

	error = mod_remove(&modlinkage);
	if (error == 0)
		hook_fini();

	return (error);
}

int
_info(struct modinfo *modinfop)
{
	return (mod_info(&modlinkage, modinfop));
}

/*
 * Function:	hook_init
 * Returns:	None
 * Parameters:	None
 *
 * Initialize hooks
 */
static void
hook_init(void)
{
	mutex_init(&hook_stack_lock, NULL, MUTEX_DRIVER, NULL);
	SLIST_INIT(&hook_stacks);

	/*
	 * We want to be informed each time a stack is created or
	 * destroyed in the kernel.
	 */
	netstack_register(NS_HOOK, hook_stack_init, hook_stack_shutdown,
	    hook_stack_fini);
}

/*
 * Function:	hook_fini
 * Returns:	None
 * Parameters:	None
 *
 * Deinitialize hooks
 */
static void
hook_fini(void)
{
	netstack_unregister(NS_HOOK);

	mutex_destroy(&hook_stack_lock);
	ASSERT(SLIST_EMPTY(&hook_stacks));
}

/*
 * Function:	hook_wait_setflag
 * Returns:     -1 = setting flag is disallowed, 0 = flag set and did
 *              not have to wait (ie no lock droped), 1 = flag set but
 *              it was necessary to drop locks to set it.
 * Parameters:  waiter(I)  - control data structure
 *              busyset(I) - set of flags that we don't want set while
 *                           we are active.
 *              wanted(I)  - flag associated with newflag to indicate
 *                           what we want to do.
 *              newflag(I) - the new ACTIVE flag we want to set that
 *                           indicates what we are doing.
 *
 * The set of functions hook_wait_* implement an API that builds on top of
 * the kcondvar_t to provide controlled execution through a critical region.
 * For each flag that indicates work is being done (FWF_*_ACTIVE) there is
 * also a flag that we set to indicate that we want to do it (FWF_*_WANTED).
 * The combination of flags is required as when this function exits to do
 * the task, the structure is then free for another caller to use and
 * to indicate that it wants to do work.  The flags used when a caller wants
 * to destroy an object take precedence over those that are used for making
 * changes to it (add/remove.) In this case, we don't try to secure the
 * ability to run and return with an error.
 *
 * "wantedset" is used here to determine who has the right to clear the
 * wanted but from the fw_flags set: only he that sets the flag has the
 * right to clear it at the bottom of the loop, even if someone else
 * wants to set it.
 *
 * wanted - the FWF_*_WANTED flag that describes the action being requested
 * busyset- the set of FWF_* flags we don't want set when we run
 * newflag- the FWF_*_ACTIVE flag we will set to indicate we are busy
 */
int
hook_wait_setflag(flagwait_t *waiter, uint32_t busyset, fwflag_t wanted,
    fwflag_t newflag)
{
	boolean_t wantedset;
	int waited = 0;

	mutex_enter(&waiter->fw_lock);
	if (waiter->fw_flags & FWF_DESTROY) {
		cv_signal(&waiter->fw_cv);
		mutex_exit(&waiter->fw_lock);
		return (-1);
	}
	while (waiter->fw_flags & busyset) {
		wantedset = ((waiter->fw_flags & wanted) == wanted);
		if (!wantedset)
			waiter->fw_flags |= wanted;
		CVW_EXIT_WRITE(waiter->fw_owner);
		cv_wait(&waiter->fw_cv, &waiter->fw_lock);
		/*
		 * This lock needs to be dropped here to preserve the order
		 * of acquisition that is fw_owner followed by fw_lock, else
		 * we can deadlock.
		 */
		mutex_exit(&waiter->fw_lock);
		waited = 1;
		CVW_ENTER_WRITE(waiter->fw_owner);
		mutex_enter(&waiter->fw_lock);
		if (!wantedset)
			waiter->fw_flags &= ~wanted;
		if (waiter->fw_flags & FWF_DESTROY) {
			cv_signal(&waiter->fw_cv);
			mutex_exit(&waiter->fw_lock);
			return (-1);
		}
	}
	waiter->fw_flags &= ~wanted;
	ASSERT((waiter->fw_flags & wanted) == 0);
	ASSERT((waiter->fw_flags & newflag) == 0);
	waiter->fw_flags |= newflag;
	mutex_exit(&waiter->fw_lock);
	return (waited);
}

/*
 * Function:	hook_wait_unsetflag
 * Returns:     None
 * Parameters:  waiter(I)  - control data structure
 *              oldflag(I) - flag to reset
 *
 * Turn off the bit that we had set to run and let others know that
 * they should now check to see if they can run.
 */
void
hook_wait_unsetflag(flagwait_t *waiter, fwflag_t oldflag)
{
	mutex_enter(&waiter->fw_lock);
	waiter->fw_flags &= ~oldflag;
	cv_signal(&waiter->fw_cv);
	mutex_exit(&waiter->fw_lock);
}

/*
 * Function:	hook_wait_destroy
 * Returns:     None
 * Parameters:  waiter(I)  - control data structure
 *
 * Since outer locking (on fw_owner) should ensure that only one function
 * at a time gets to call hook_wait_destroy() on a given object, there is
 * no need to guard against setting FWF_DESTROY_WANTED already being set.
 * It is, however, necessary to wait for all activity on the owning
 * structure to cease.
 */
int
hook_wait_destroy(flagwait_t *waiter)
{
	ASSERT((waiter->fw_flags & FWF_DESTROY_WANTED) == 0);
	mutex_enter(&waiter->fw_lock);
	if (waiter->fw_flags & FWF_DESTROY_WANTED) {
		cv_signal(&waiter->fw_cv);
		mutex_exit(&waiter->fw_lock);
		return (EINPROGRESS);
	}
	waiter->fw_flags |= FWF_DESTROY_WANTED;
	while (!FWF_DESTROY_OK(waiter)) {
		CVW_EXIT_WRITE(waiter->fw_owner);
		cv_wait(&waiter->fw_cv, &waiter->fw_lock);
		CVW_ENTER_WRITE(waiter->fw_owner);
	}
	/*
	 * There should now be nothing else using "waiter" or its
	 * owner, so we can safely assign here without risk of wiiping
	 * out someone's bit.
	 */
	waiter->fw_flags = FWF_DESTROY_ACTIVE;
	cv_signal(&waiter->fw_cv);
	mutex_exit(&waiter->fw_lock);

	return (0);
}

/*
 * Function:	hook_wait_init
 * Returns:     None
 * Parameters:  waiter(I)  - control data structure
 *              ownder(I)  - pointer to lock that the owner of this
 *                           waiter uses
 *
 * "owner" gets passed in here so that when we need to call cv_wait,
 * for example in hook_wait_setflag(), we can drop the lock for the
 * next layer out, which is likely to be held in an exclusive manner.
 */
void
hook_wait_init(flagwait_t *waiter, cvwaitlock_t *owner)
{
	cv_init(&waiter->fw_cv, NULL, CV_DRIVER, NULL);
	mutex_init(&waiter->fw_lock, NULL, MUTEX_DRIVER, NULL);
	waiter->fw_flags = FWF_NONE;
	waiter->fw_owner = owner;
}

/*
 * Function:	hook_stack_init
 * Returns:     void *     - pointer to new hook stack structure
 * Parameters:  stackid(I) - identifier for the network instance that owns this
 *              ns(I)      - pointer to the network instance data structure
 *
 * Allocate and initialize the hook stack instance. This function is not
 * allowed to fail, so KM_SLEEP is used here when allocating memory. The
 * value returned is passed back into the shutdown and destroy hooks.
 */
/*ARGSUSED*/
static void *
hook_stack_init(netstackid_t stackid, netstack_t *ns)
{
	hook_stack_t	*hks;

#ifdef NS_DEBUG
	printf("hook_stack_init(stack %d)\n", stackid);
#endif

	hks = (hook_stack_t *)kmem_zalloc(sizeof (*hks), KM_SLEEP);
	hks->hks_netstack = ns;
	hks->hks_netstackid = stackid;

	CVW_INIT(&hks->hks_lock);
	TAILQ_INIT(&hks->hks_nhead);
	SLIST_INIT(&hks->hks_familylist);

	hook_wait_init(&hks->hks_waiter, &hks->hks_lock);

	mutex_enter(&hook_stack_lock);
	SLIST_INSERT_HEAD(&hook_stacks, hks, hks_entry);
	mutex_exit(&hook_stack_lock);

	return (hks);
}

/*
 * Function:	hook_stack_shutdown
 * Returns:     void
 * Parameters:  stackid(I) - identifier for the network instance that owns this
 *              arg(I)     - pointer returned by hook_stack_init
 *
 * Set the shutdown flag to indicate that we should stop accepting new
 * register calls as we're now in the cleanup process. The cleanup is a
 * two stage process and we're not required to free any memory here.
 *
 * The curious would wonder why isn't there any code that walks through
 * all of the data structures and sets the flag(s) there? The answer is
 * that it is expected that this will happen when the zone shutdown calls
 * the shutdown callbacks for other modules that they will initiate the
 * free'ing and shutdown of the hooks themselves.
 */
/*ARGSUSED*/
static void
hook_stack_shutdown(netstackid_t stackid, void *arg)
{
	hook_stack_t *hks = (hook_stack_t *)arg;

	mutex_enter(&hook_stack_lock);
	/*
	 * Once this flag gets set to one, no more additions are allowed
	 * to any of the structures that make up this stack.
	 */
	hks->hks_shutdown = 1;
	mutex_exit(&hook_stack_lock);
}

/*
 * Function:	hook_stack_destroy
 * Returns:     void
 * Parameters:  stackid(I) - identifier for the network instance that owns this
 *              arg(I)     - pointer returned by hook_stack_init
 *
 * Free the hook stack instance.
 *
 * The rationale for the shutdown being lazy (see the comment above for
 * hook_stack_shutdown) also applies to the destroy being lazy. Only if
 * the hook_stack_t data structure is unused will it go away. Else it
 * is left up to the last user of a data structure to actually free it.
 */
/*ARGSUSED*/
static void
hook_stack_fini(netstackid_t stackid, void *arg)
{
	hook_stack_t *hks = (hook_stack_t *)arg;

	mutex_enter(&hook_stack_lock);
	hks->hks_shutdown = 2;
	hook_stack_remove(hks);
	mutex_exit(&hook_stack_lock);
}

/*
 * Function:	hook_stack_remove
 * Returns:     void
 * Parameters:  hks(I) - pointer to an instance of a hook_stack_t
 *
 * This function assumes that it is called with hook_stack_lock held.
 * It functions differently to hook_family/event_remove in that it does
 * the checks to see if it can be removed. This difference exists
 * because this structure has nothing higher up that depends on it.
 */
static void
hook_stack_remove(hook_stack_t *hks)
{

	ASSERT(mutex_owned(&hook_stack_lock));

	/*
	 * Is the structure still in use?
	 */
	if (!SLIST_EMPTY(&hks->hks_familylist) ||
	    !TAILQ_EMPTY(&hks->hks_nhead))
		return;

	SLIST_REMOVE(&hook_stacks, hks, hook_stack, hks_entry);

	VERIFY(hook_wait_destroy(&hks->hks_waiter) == 0);
	CVW_DESTROY(&hks->hks_lock);
	kmem_free(hks, sizeof (*hks));
}

/*
 * Function:	hook_stack_get
 * Returns:     hook_stack_t * - NULL if not found, else matching instance
 * Parameters:  stackid(I)     - instance id to search for
 *
 * Search the list of currently active hook_stack_t structures for one that
 * has a matching netstackid_t to the value passed in. The linked list can
 * only ever have at most one match for this value.
 */
static hook_stack_t *
hook_stack_get(netstackid_t stackid)
{
	hook_stack_t *hks;

	SLIST_FOREACH(hks, &hook_stacks, hks_entry) {
		if (hks->hks_netstackid == stackid)
			break;
	}

	return (hks);
}

/*
 * Function:	hook_stack_notify_register
 * Returns:	int        - 0 = success, else failure
 * Parameters:	stackid(I) - netstack identifier
 *              callback(I)- function to be called
 *              arg(I)     - arg to provide callback when it is called
 *
 * If we're not shutting down this instance, append a new function to the
 * list of those to call when a new family of hooks is added to this stack.
 * If the function can be successfully added to the list of callbacks
 * activated when there is a change to the stack (addition or removal of
 * a hook family) then generate a fake HN_REGISTER event by directly
 * calling the callback with the relevant information for each hook
 * family that currently exists (and isn't being shutdown.)
 */
int
hook_stack_notify_register(netstackid_t stackid, hook_notify_fn_t callback,
    void *arg)
{
	hook_family_int_t *hfi;
	hook_stack_t *hks;
	boolean_t canrun;
	char buffer[16];
	int error;

	ASSERT(callback != NULL);

	canrun = B_FALSE;
	mutex_enter(&hook_stack_lock);
	hks = hook_stack_get(stackid);
	if (hks != NULL) {
		if (hks->hks_shutdown != 0) {
			error = ESHUTDOWN;
		} else {
			CVW_ENTER_WRITE(&hks->hks_lock);
			canrun = (hook_wait_setflag(&hks->hks_waiter,
			    FWF_ADD_WAIT_MASK, FWF_ADD_WANTED,
			    FWF_ADD_ACTIVE) != -1);
			error = hook_notify_register(&hks->hks_nhead,
			    callback, arg);
			CVW_EXIT_WRITE(&hks->hks_lock);
		}
	} else {
		error = ESRCH;
	}
	mutex_exit(&hook_stack_lock);

	if (error == 0 && canrun) {
		/*
		 * Generate fake register event for callback that
		 * is being added, letting it know everything that
		 * already exists.
		 */
		(void) snprintf(buffer, sizeof (buffer), "%u",
		    hks->hks_netstackid);

		SLIST_FOREACH(hfi, &hks->hks_familylist, hfi_entry) {
			if (hfi->hfi_condemned || hfi->hfi_shutdown)
				continue;
			callback(HN_REGISTER, arg, buffer, NULL,
			    hfi->hfi_family.hf_name);
		}
	}

	if (canrun)
		hook_wait_unsetflag(&hks->hks_waiter, FWF_ADD_ACTIVE);

	return (error);
}

/*
 * Function:	hook_stack_notify_unregister
 * Returns:	int         - 0 = success, else failure
 * Parameters:	stackid(I)  - netstack identifier
 *              callback(I) - function to be called
 *
 * Attempt to remove a registered function from a hook stack's list of
 * callbacks to activiate when protocols are added/deleted.
 * As with hook_stack_notify_register, if all things are going well then
 * a fake unregister event is delivered to the callback being removed
 * for each hook family that presently exists.
 */
int
hook_stack_notify_unregister(netstackid_t stackid, hook_notify_fn_t callback)
{
	hook_family_int_t *hfi;
	hook_stack_t *hks;
	boolean_t canrun;
	char buffer[16];
	void *arg;
	int error;

	mutex_enter(&hook_stack_lock);
	hks = hook_stack_get(stackid);
	if (hks != NULL) {
		CVW_ENTER_WRITE(&hks->hks_lock);
		canrun = (hook_wait_setflag(&hks->hks_waiter, FWF_ADD_WAIT_MASK,
		    FWF_ADD_WANTED, FWF_ADD_ACTIVE) != -1);

		error = hook_notify_unregister(&hks->hks_nhead, callback, &arg);
		CVW_EXIT_WRITE(&hks->hks_lock);
	} else {
		error = ESRCH;
	}
	mutex_exit(&hook_stack_lock);

	if (error == 0) {
		if (canrun) {
			/*
			 * Generate fake unregister event for callback that
			 * is being removed, letting it know everything that
			 * currently exists is now "disappearing."
			 */
			(void) snprintf(buffer, sizeof (buffer), "%u",
			    hks->hks_netstackid);

			SLIST_FOREACH(hfi, &hks->hks_familylist, hfi_entry) {
				callback(HN_UNREGISTER, arg, buffer, NULL,
				    hfi->hfi_family.hf_name);
			}

			hook_wait_unsetflag(&hks->hks_waiter, FWF_ADD_ACTIVE);
		}

		mutex_enter(&hook_stack_lock);
		hks = hook_stack_get(stackid);
		if ((error == 0) && (hks->hks_shutdown == 2))
			hook_stack_remove(hks);
		mutex_exit(&hook_stack_lock);
	}

	return (error);
}

/*
 * Function:	hook_stack_notify_run
 * Returns:	None
 * Parameters:	hks(I)  - hook stack pointer to execute callbacks for
 *              name(I) - name of a hook family
 *              cmd(I)  - either HN_UNREGISTER or HN_REGISTER
 *
 * Run through the list of callbacks on the hook stack to be called when
 * a new hook family is added
 *
 * As hook_notify_run() expects 3 names, one for the family that is associated
 * with the cmd (HN_REGISTER or HN_UNREGISTER), one for the event and one
 * for the object being introduced and we really only have one name (that
 * of the new hook family), fake the hook stack's name by converting the
 * integer to a string and for the event just pass NULL.
 */
static void
hook_stack_notify_run(hook_stack_t *hks, char *name,
    hook_notify_cmd_t cmd)
{
	char buffer[16];

	ASSERT(hks != NULL);
	ASSERT(name != NULL);

	(void) snprintf(buffer, sizeof (buffer), "%u", hks->hks_netstackid);

	hook_notify_run(&hks->hks_nhead, buffer, NULL, name, cmd);
}

/*
 * Function:	hook_run
 * Returns:	int      - return value according to callback func
 * Parameters:	token(I) - event pointer
 *		info(I)  - message
 *
 * Run hooks for specific provider.  The hooks registered are stepped through
 * until either the end of the list is reached or a hook function returns a
 * non-zero value.  If a non-zero value is returned from a hook function, we
 * return that value back to our caller.  By design, a hook function can be
 * called more than once, simultaneously.
 */
int
hook_run(hook_family_int_t *hfi, hook_event_token_t token, hook_data_t info)
{
	hook_event_int_t *hei;
	hook_int_t *hi;
	int rval = 0;

	ASSERT(token != NULL);

	hei = (hook_event_int_t *)token;
	DTRACE_PROBE2(hook__run__start,
	    hook_event_token_t, token,
	    hook_data_t, info);

	/*
	 * If we consider that this function is only called from within the
	 * stack while an instance is currently active,
	 */
	CVW_ENTER_READ(&hfi->hfi_lock);

	TAILQ_FOREACH(hi, &hei->hei_head, hi_entry) {
		ASSERT(hi->hi_hook.h_func != NULL);
		DTRACE_PROBE3(hook__func__start,
		    hook_event_token_t, token,
		    hook_data_t, info,
		    hook_int_t *, hi);
		rval = (*hi->hi_hook.h_func)(token, info, hi->hi_hook.h_arg);
		DTRACE_PROBE4(hook__func__end,
		    hook_event_token_t, token,
		    hook_data_t, info,
		    hook_int_t *, hi,
		    int, rval);
		hi->hi_kstats.hook_hits.value.ui64++;
		if (rval != 0)
			break;
	}

	hei->hei_kstats.events.value.ui64++;

	CVW_EXIT_READ(&hfi->hfi_lock);

	DTRACE_PROBE3(hook__run__end,
	    hook_event_token_t, token,
	    hook_data_t, info,
	    hook_int_t *, hi);

	return (rval);
}

/*
 * Function:	hook_family_add
 * Returns:	internal family pointer - NULL = Fail
 * Parameters:	hf(I)    - family pointer
 *              hks(I)   - pointer to an instance of a hook_stack_t
 *              store(O) - where returned pointer will be stored
 *
 * Add new family to the family list. The requirements for the addition to
 * succeed are that the family name must not already be registered and that
 * the hook stack is not being shutdown.
 * If store is non-NULL, it is expected to be a pointer to the same variable
 * that is awaiting to be assigned the return value of this function.
 * In its current use, the returned value is assigned to netd_hooks in
 * net_family_register. The use of "store" allows the return value to be
 * used before this function returns. How can this happen? Through the
 * callbacks that can be activated at the bottom of this function, when
 * hook_stack_notify_run is called.
 */
hook_family_int_t *
hook_family_add(hook_family_t *hf, hook_stack_t *hks, void **store)
{
	hook_family_int_t *hfi, *new;

	ASSERT(hf != NULL);
	ASSERT(hf->hf_name != NULL);

	new = hook_family_copy(hf);
	if (new == NULL)
		return (NULL);

	mutex_enter(&hook_stack_lock);
	CVW_ENTER_WRITE(&hks->hks_lock);

	if (hks->hks_shutdown != 0) {
		CVW_EXIT_WRITE(&hks->hks_lock);
		mutex_exit(&hook_stack_lock);
		hook_family_free(new, NULL);
		return (NULL);
	}

	/* search family list */
	hfi = hook_family_find(hf->hf_name, hks);
	if (hfi != NULL) {
		CVW_EXIT_WRITE(&hks->hks_lock);
		mutex_exit(&hook_stack_lock);
		hook_family_free(new, NULL);
		return (NULL);
	}

	/*
	 * Try and set the FWF_ADD_ACTIVE flag so that we can drop all the
	 * lock further down when calling all of the functions registered
	 * for notification when a new hook family is added.
	 */
	if (hook_wait_setflag(&hks->hks_waiter, FWF_ADD_WAIT_MASK,
	    FWF_ADD_WANTED, FWF_ADD_ACTIVE) == -1) {
		CVW_EXIT_WRITE(&hks->hks_lock);
		mutex_exit(&hook_stack_lock);
		hook_family_free(new, NULL);
		return (NULL);
	}

	CVW_INIT(&new->hfi_lock);
	SLIST_INIT(&new->hfi_head);
	TAILQ_INIT(&new->hfi_nhead);

	hook_wait_init(&new->hfi_waiter, &new->hfi_lock);

	new->hfi_stack = hks;
	if (store != NULL)
		*store = new;

	/* Add to family list head */
	SLIST_INSERT_HEAD(&hks->hks_familylist, new, hfi_entry);

	CVW_EXIT_WRITE(&hks->hks_lock);
	mutex_exit(&hook_stack_lock);

	hook_stack_notify_run(hks, hf->hf_name, HN_REGISTER);

	hook_wait_unsetflag(&hks->hks_waiter, FWF_ADD_ACTIVE);

	return (new);
}

/*
 * Function:	hook_family_remove
 * Returns:	int    - 0 = success, else = failure
 * Parameters:	hfi(I) - internal family pointer
 *
 * Remove family from family list. This function has been designed to be
 * called once and once only per hook_family_int_t. Thus when cleaning up
 * this structure as an orphan, callers should only call hook_family_free.
 */
int
hook_family_remove(hook_family_int_t *hfi)
{
	hook_stack_t *hks;
	boolean_t notifydone;

	ASSERT(hfi != NULL);
	hks = hfi->hfi_stack;

	CVW_ENTER_WRITE(&hfi->hfi_lock);
	notifydone = hfi->hfi_shutdown;
	hfi->hfi_shutdown = B_TRUE;
	CVW_EXIT_WRITE(&hfi->hfi_lock);

	CVW_ENTER_WRITE(&hks->hks_lock);

	if (hook_wait_setflag(&hks->hks_waiter, FWF_DEL_WAIT_MASK,
	    FWF_DEL_WANTED, FWF_DEL_ACTIVE) == -1) {
		/*
		 * If we're trying to destroy the hook_stack_t...
		 */
		CVW_EXIT_WRITE(&hks->hks_lock);
		return (ENXIO);
	}

	/*
	 * Check if the family is in use by the presence of either events
	 * or notify callbacks on the hook family.
	 */
	if (!SLIST_EMPTY(&hfi->hfi_head) || !TAILQ_EMPTY(&hfi->hfi_nhead)) {
		hfi->hfi_condemned = B_TRUE;
	} else {
		VERIFY(hook_wait_destroy(&hfi->hfi_waiter) == 0);
		/*
		 * Although hfi_condemned = B_FALSE is implied from creation,
		 * putting a comment here inside the else upsets lint.
		 */
		hfi->hfi_condemned = B_FALSE;
	}
	CVW_EXIT_WRITE(&hks->hks_lock);

	if (!notifydone)
		hook_stack_notify_run(hks, hfi->hfi_family.hf_name,
		    HN_UNREGISTER);

	hook_wait_unsetflag(&hks->hks_waiter, FWF_DEL_ACTIVE);

	/*
	 * If we don't have to wait for anything else to disappear from this
	 * structure then we can free it up.
	 */
	if (!hfi->hfi_condemned)
		hook_family_free(hfi, hks);

	return (0);
}


/*
 * Function:	hook_family_free
 * Returns:	None
 * Parameters:	hfi(I) - internal family pointer
 *
 * Free alloc memory for family
 */
static void
hook_family_free(hook_family_int_t *hfi, hook_stack_t *hks)
{

	/*
	 * This lock gives us possession of the hks pointer after the
	 * SLIST_REMOVE, for which it is not needed, when hks_shutdown
	 * is checked and hook_stack_remove called.
	 */
	mutex_enter(&hook_stack_lock);

	ASSERT(hfi != NULL);

	if (hks != NULL) {
		CVW_ENTER_WRITE(&hks->hks_lock);
		/* Remove from family list */
		SLIST_REMOVE(&hks->hks_familylist, hfi, hook_family_int,
		    hfi_entry);

		CVW_EXIT_WRITE(&hks->hks_lock);
	}

	/* Free name space */
	if (hfi->hfi_family.hf_name != NULL) {
		kmem_free(hfi->hfi_family.hf_name,
		    strlen(hfi->hfi_family.hf_name) + 1);
	}

	/* Free container */
	kmem_free(hfi, sizeof (*hfi));

	if (hks->hks_shutdown == 2)
		hook_stack_remove(hks);

	mutex_exit(&hook_stack_lock);
}

/*
 * Function:	hook_family_shutdown
 * Returns:	int    - 0 = success, else = failure
 * Parameters:	hfi(I) - internal family pointer
 *
 * As an alternative to removing a family, we may desire to just generate
 * a series of callbacks to indicate that we will be going away in the
 * future. The hfi_condemned flag isn't set because we aren't trying to
 * remove the structure.
 */
int
hook_family_shutdown(hook_family_int_t *hfi)
{
	hook_stack_t *hks;
	boolean_t notifydone;

	ASSERT(hfi != NULL);
	hks = hfi->hfi_stack;

	CVW_ENTER_WRITE(&hfi->hfi_lock);
	notifydone = hfi->hfi_shutdown;
	hfi->hfi_shutdown = B_TRUE;
	CVW_EXIT_WRITE(&hfi->hfi_lock);

	CVW_ENTER_WRITE(&hks->hks_lock);

	if (hook_wait_setflag(&hks->hks_waiter, FWF_DEL_WAIT_MASK,
	    FWF_DEL_WANTED, FWF_DEL_ACTIVE) == -1) {
		/*
		 * If we're trying to destroy the hook_stack_t...
		 */
		CVW_EXIT_WRITE(&hks->hks_lock);
		return (ENXIO);
	}

	CVW_EXIT_WRITE(&hks->hks_lock);

	if (!notifydone)
		hook_stack_notify_run(hks, hfi->hfi_family.hf_name,
		    HN_UNREGISTER);

	hook_wait_unsetflag(&hks->hks_waiter, FWF_DEL_ACTIVE);

	return (0);
}

/*
 * Function:	hook_family_copy
 * Returns:	internal family pointer - NULL = Failed
 * Parameters:	src(I) - family pointer
 *
 * Allocate internal family block and duplicate incoming family
 * No locks should be held across this function as it may sleep.
 */
static hook_family_int_t *
hook_family_copy(hook_family_t *src)
{
	hook_family_int_t *new;
	hook_family_t *dst;

	ASSERT(src != NULL);
	ASSERT(src->hf_name != NULL);

	new = (hook_family_int_t *)kmem_zalloc(sizeof (*new), KM_SLEEP);

	/* Copy body */
	dst = &new->hfi_family;
	*dst = *src;

	SLIST_INIT(&new->hfi_head);
	TAILQ_INIT(&new->hfi_nhead);

	/* Copy name */
	dst->hf_name = (char *)kmem_alloc(strlen(src->hf_name) + 1, KM_SLEEP);
	(void) strcpy(dst->hf_name, src->hf_name);

	return (new);
}

/*
 * Function:	hook_family_find
 * Returns:	internal family pointer - NULL = Not match
 * Parameters:	family(I) - family name string
 *
 * Search family list with family name
 * 	A lock on hfi_lock must be held when called.
 */
static hook_family_int_t *
hook_family_find(char *family, hook_stack_t *hks)
{
	hook_family_int_t *hfi = NULL;

	ASSERT(family != NULL);

	SLIST_FOREACH(hfi, &hks->hks_familylist, hfi_entry) {
		if (strcmp(hfi->hfi_family.hf_name, family) == 0)
			break;
	}
	return (hfi);
}

/*
 * Function:	hook_family_notify_register
 * Returns:	int         - 0 = success, else failure
 * Parameters:	hfi(I)      - hook family
 *              callback(I) - function to be called
 *              arg(I)      - arg to provide callback when it is called
 *
 * So long as this hook stack isn't being shut down, register a new
 * callback to be activated each time a new event is added to this
 * family.
 *
 * To call this function we must have an active handle in use on the family,
 * so if we take this into account, then neither the hook_family_int_t nor
 * the hook_stack_t that owns it can disappear. We have to put some trust
 * in the callers to be properly synchronised...
 *
 * Holding hks_lock is required to provide synchronisation for hks_shutdown.
 */
int
hook_family_notify_register(hook_family_int_t *hfi,
    hook_notify_fn_t callback, void *arg)
{
	hook_event_int_t *hei;
	hook_stack_t *hks;
	boolean_t canrun;
	int error;

	ASSERT(hfi != NULL);
	canrun = B_FALSE;
	hks = hfi->hfi_stack;

	CVW_ENTER_READ(&hks->hks_lock);

	if ((hfi->hfi_stack->hks_shutdown != 0) ||
	    hfi->hfi_condemned || hfi->hfi_shutdown) {
		CVW_EXIT_READ(&hks->hks_lock);
		return (ESHUTDOWN);
	}

	CVW_ENTER_WRITE(&hfi->hfi_lock);
	canrun = (hook_wait_setflag(&hfi->hfi_waiter, FWF_ADD_WAIT_MASK,
	    FWF_ADD_WANTED, FWF_ADD_ACTIVE) != -1);
	error = hook_notify_register(&hfi->hfi_nhead, callback, arg);
	CVW_EXIT_WRITE(&hfi->hfi_lock);

	CVW_EXIT_READ(&hks->hks_lock);

	if (error == 0 && canrun) {
		SLIST_FOREACH(hei, &hfi->hfi_head, hei_entry) {
			callback(HN_REGISTER, arg,
			    hfi->hfi_family.hf_name, NULL,
			    hei->hei_event->he_name);
		}
	}

	if (canrun)
		hook_wait_unsetflag(&hfi->hfi_waiter, FWF_ADD_ACTIVE);

	return (error);
}

/*
 * Function:	hook_family_notify_unregister
 * Returns:	int         - 0 = success, else failure
 * Parameters:	hfi(I)      - hook family
 *              callback(I) - function to be called
 *
 * Remove a callback from the list of those executed when a new event is
 * added to a hook family. If the family is not in the process of being
 * destroyed then simulate an unregister callback for each event that is
 * on the family. This pairs up with the hook_family_notify_register
 * action that simulates register events.
 * The order of what happens here is important and goes like this.
 * 1) Remove the callback from the list of functions to be called as part
 *    of the notify operation when an event is added or removed from the
 *    hook family.
 * 2) If the hook_family_int_t structure is on death row (free_family will
 *    be set to true) then there's nothing else to do than let it be free'd.
 * 3) If the structure isn't about to die, mark it up as being busy using
 *    hook_wait_setflag and then drop the lock so the loop can be run.
 * 4) if hook_wait_setflag was successful, tell all of the notify callback
 *    functions that this family has been unregistered.
 * 5) Cleanup
 */
int
hook_family_notify_unregister(hook_family_int_t *hfi,
    hook_notify_fn_t callback)
{
	hook_event_int_t *hei;
	boolean_t free_family;
	boolean_t canrun;
	int error;
	void *arg;

	canrun = B_FALSE;

	CVW_ENTER_WRITE(&hfi->hfi_lock);

	(void) hook_wait_setflag(&hfi->hfi_waiter, FWF_DEL_WAIT_MASK,
	    FWF_DEL_WANTED, FWF_DEL_ACTIVE);

	error = hook_notify_unregister(&hfi->hfi_nhead, callback, &arg);

	hook_wait_unsetflag(&hfi->hfi_waiter, FWF_DEL_ACTIVE);

	/*
	 * If hook_family_remove has been called but the structure was still
	 * "busy" ... but we might have just made it "unbusy"...
	 */
	if ((error == 0) && hfi->hfi_condemned &&
	    SLIST_EMPTY(&hfi->hfi_head) && TAILQ_EMPTY(&hfi->hfi_nhead)) {
		free_family = B_TRUE;
	} else {
		free_family = B_FALSE;
	}

	if (error == 0 && !free_family) {
		canrun = (hook_wait_setflag(&hfi->hfi_waiter, FWF_ADD_WAIT_MASK,
		    FWF_ADD_WANTED, FWF_ADD_ACTIVE) != -1);
	}

	CVW_EXIT_WRITE(&hfi->hfi_lock);

	if (canrun) {
		SLIST_FOREACH(hei, &hfi->hfi_head, hei_entry) {
			callback(HN_UNREGISTER, arg,
			    hfi->hfi_family.hf_name, NULL,
			    hei->hei_event->he_name);
		}

		hook_wait_unsetflag(&hfi->hfi_waiter, FWF_ADD_ACTIVE);
	} else if (free_family) {
		hook_family_free(hfi, hfi->hfi_stack);
	}

	return (error);
}

/*
 * Function:	hook_event_add
 * Returns:	internal event pointer - NULL = Fail
 * Parameters:	hfi(I) - internal family pointer
 *		he(I)  - event pointer
 *
 * Add new event to event list on specific family.
 * This function can fail to return successfully if (1) it cannot allocate
 * enough memory for its own internal data structures, (2) the event has
 * already been registered (for any hook family.)
 */
hook_event_int_t *
hook_event_add(hook_family_int_t *hfi, hook_event_t *he)
{
	hook_event_int_t *hei, *new;
	hook_stack_t *hks;

	ASSERT(hfi != NULL);
	ASSERT(he != NULL);
	ASSERT(he->he_name != NULL);

	new = hook_event_copy(he);
	if (new == NULL)
		return (NULL);

	hks = hfi->hfi_stack;
	CVW_ENTER_READ(&hks->hks_lock);

	hks = hfi->hfi_stack;
	if (hks->hks_shutdown != 0) {
		CVW_EXIT_READ(&hks->hks_lock);
		hook_event_free(new, NULL);
		return (NULL);
	}

	/* Check whether this event pointer is already registered */
	hei = hook_event_checkdup(he, hks);
	if (hei != NULL) {
		CVW_EXIT_READ(&hks->hks_lock);
		hook_event_free(new, NULL);
		return (NULL);
	}

	CVW_ENTER_WRITE(&hfi->hfi_lock);

	if (hfi->hfi_condemned || hfi->hfi_shutdown) {
		CVW_EXIT_WRITE(&hfi->hfi_lock);
		CVW_EXIT_READ(&hks->hks_lock);
		hook_event_free(new, NULL);
		return (NULL);
	}
	CVW_EXIT_READ(&hks->hks_lock);

	if (hook_wait_setflag(&hfi->hfi_waiter, FWF_ADD_WAIT_MASK,
	    FWF_ADD_WANTED, FWF_ADD_ACTIVE) == -1) {
		CVW_EXIT_WRITE(&hfi->hfi_lock);
		hook_event_free(new, NULL);
		return (NULL);
	}

	TAILQ_INIT(&new->hei_nhead);

	hook_event_init_kstats(hfi, new);
	hook_wait_init(&new->hei_waiter, &new->hei_lock);

	/* Add to event list head */
	SLIST_INSERT_HEAD(&hfi->hfi_head, new, hei_entry);

	CVW_EXIT_WRITE(&hfi->hfi_lock);

	hook_notify_run(&hfi->hfi_nhead,
	    hfi->hfi_family.hf_name, NULL, he->he_name, HN_REGISTER);

	hook_wait_unsetflag(&hfi->hfi_waiter, FWF_ADD_ACTIVE);

	return (new);
}

/*
 * Function:	hook_event_init_kstats
 * Returns:	None
 * Parameters:  hfi(I) - pointer to the family that owns this event.
 *              hei(I) - pointer to the hook event that needs some kstats.
 *
 * Create a set of kstats that relate to each event registered with
 * the hook framework.  A counter is kept for each time the event is
 * activated and for each time a hook is added or removed.  As the
 * kstats just count the events as they happen, the total number of
 * hooks registered must be obtained by subtractived removed from added.
 */
static void
hook_event_init_kstats(hook_family_int_t *hfi, hook_event_int_t *hei)
{
	hook_event_kstat_t template = {
		{ "hooksAdded",		KSTAT_DATA_UINT64 },
		{ "hooksRemoved",	KSTAT_DATA_UINT64 },
		{ "events",		KSTAT_DATA_UINT64 }
	};
	hook_stack_t *hks;

	hks = hfi->hfi_stack;
	hei->hei_kstatp = kstat_create_netstack(hfi->hfi_family.hf_name, 0,
	    hei->hei_event->he_name, "hook_event", KSTAT_TYPE_NAMED,
	    sizeof (hei->hei_kstats) / sizeof (kstat_named_t),
	    KSTAT_FLAG_VIRTUAL, hks->hks_netstackid);

	bcopy((char *)&template, &hei->hei_kstats, sizeof (template));

	if (hei->hei_kstatp != NULL) {
		hei->hei_kstatp->ks_data = (void *)&hei->hei_kstats;
		hei->hei_kstatp->ks_private =
		    (void *)(uintptr_t)hks->hks_netstackid;

		kstat_install(hei->hei_kstatp);
	}
}

/*
 * Function:	hook_event_remove
 * Returns:	int    - 0 = success, else = failure
 * Parameters:	hfi(I) - internal family pointer
 *		he(I)  - event pointer
 *
 * Remove event from event list on specific family
 *
 * This function assumes that the caller has received a pointer to a the
 * hook_family_int_t via a call to net_protocol_lookup or net_protocol_unreg'.
 * This the hook_family_int_t is guaranteed to be around for the life of this
 * call, unless the caller has decided to call net_protocol_release or
 * net_protocol_unregister before calling net_event_unregister - an error.
 */
int
hook_event_remove(hook_family_int_t *hfi, hook_event_t *he)
{
	boolean_t free_family;
	hook_event_int_t *hei;
	boolean_t notifydone;

	ASSERT(hfi != NULL);
	ASSERT(he != NULL);

	CVW_ENTER_WRITE(&hfi->hfi_lock);

	/*
	 * Set the flag so that we can call hook_event_notify_run without
	 * holding any locks but at the same time prevent other changes to
	 * the event at the same time.
	 */
	if (hook_wait_setflag(&hfi->hfi_waiter, FWF_DEL_WAIT_MASK,
	    FWF_DEL_WANTED, FWF_DEL_ACTIVE) == -1) {
		CVW_EXIT_WRITE(&hfi->hfi_lock);
		return (ENXIO);
	}

	hei = hook_event_find(hfi, he->he_name);
	if (hei == NULL) {
		hook_wait_unsetflag(&hfi->hfi_waiter, FWF_DEL_ACTIVE);
		CVW_EXIT_WRITE(&hfi->hfi_lock);
		return (ESRCH);
	}

	free_family = B_FALSE;

	CVW_ENTER_WRITE(&hei->hei_lock);
	/*
	 * The hei_shutdown flag is used to indicate whether or not we have
	 * done a shutdown and thus already walked through the notify list.
	 */
	notifydone = hei->hei_shutdown;
	hei->hei_shutdown = B_TRUE;
	/*
	 * If there are any hooks still registered for this event or
	 * there are any notifiers registered, return an error indicating
	 * that the event is still busy.
	 */
	if (!TAILQ_EMPTY(&hei->hei_head) || !TAILQ_EMPTY(&hei->hei_nhead)) {
		hei->hei_condemned = B_TRUE;
		CVW_EXIT_WRITE(&hei->hei_lock);
	} else {
		/* hei_condemned = B_FALSE is implied from creation */
		/*
		 * Even though we know the notify list is empty, we call
		 * hook_wait_destroy here to synchronise wait removing a
		 * hook from an event.
		 */
		VERIFY(hook_wait_destroy(&hei->hei_waiter) == 0);

		CVW_EXIT_WRITE(&hei->hei_lock);

		if (hfi->hfi_condemned && SLIST_EMPTY(&hfi->hfi_head) &&
		    TAILQ_EMPTY(&hfi->hfi_nhead))
			free_family = B_TRUE;
	}

	CVW_EXIT_WRITE(&hfi->hfi_lock);

	if (!notifydone)
		hook_notify_run(&hfi->hfi_nhead,
		    hfi->hfi_family.hf_name, NULL, he->he_name, HN_UNREGISTER);

	hook_wait_unsetflag(&hfi->hfi_waiter, FWF_DEL_ACTIVE);

	if (!hei->hei_condemned) {
		hook_event_free(hei, hfi);
		if (free_family)
			hook_family_free(hfi, hfi->hfi_stack);
	}

	return (0);
}

/*
 * Function:	hook_event_shutdown
 * Returns:	int    - 0 = success, else = failure
 * Parameters:	hfi(I) - internal family pointer
 *		he(I)  - event pointer
 *
 * As with hook_family_shutdown, we want to generate the notify callbacks
 * as if the event was being removed but not actually do the remove.
 */
int
hook_event_shutdown(hook_family_int_t *hfi, hook_event_t *he)
{
	hook_event_int_t *hei;
	boolean_t notifydone;

	ASSERT(hfi != NULL);
	ASSERT(he != NULL);

	CVW_ENTER_WRITE(&hfi->hfi_lock);

	/*
	 * Set the flag so that we can call hook_event_notify_run without
	 * holding any locks but at the same time prevent other changes to
	 * the event at the same time.
	 */
	if (hook_wait_setflag(&hfi->hfi_waiter, FWF_DEL_WAIT_MASK,
	    FWF_DEL_WANTED, FWF_DEL_ACTIVE) == -1) {
		CVW_EXIT_WRITE(&hfi->hfi_lock);
		return (ENXIO);
	}

	hei = hook_event_find(hfi, he->he_name);
	if (hei == NULL) {
		hook_wait_unsetflag(&hfi->hfi_waiter, FWF_DEL_ACTIVE);
		CVW_EXIT_WRITE(&hfi->hfi_lock);
		return (ESRCH);
	}

	CVW_ENTER_WRITE(&hei->hei_lock);
	notifydone = hei->hei_shutdown;
	hei->hei_shutdown = B_TRUE;
	CVW_EXIT_WRITE(&hei->hei_lock);

	CVW_EXIT_WRITE(&hfi->hfi_lock);

	if (!notifydone)
		hook_notify_run(&hfi->hfi_nhead,
		    hfi->hfi_family.hf_name, NULL, he->he_name, HN_UNREGISTER);

	hook_wait_unsetflag(&hfi->hfi_waiter, FWF_DEL_ACTIVE);

	return (0);
}

/*
 * Function:	hook_event_free
 * Returns:	None
 * Parameters:	hei(I) - internal event pointer
 *
 * Free alloc memory for event
 */
static void
hook_event_free(hook_event_int_t *hei, hook_family_int_t *hfi)
{
	boolean_t free_family;

	ASSERT(hei != NULL);

	if (hfi != NULL) {
		CVW_ENTER_WRITE(&hfi->hfi_lock);
		/*
		 * Remove the event from the hook family's list.
		 */
		SLIST_REMOVE(&hfi->hfi_head, hei, hook_event_int, hei_entry);
		if (hfi->hfi_condemned && SLIST_EMPTY(&hfi->hfi_head) &&
		    TAILQ_EMPTY(&hfi->hfi_nhead)) {
			free_family = B_TRUE;
		} else {
			free_family = B_FALSE;
		}
		CVW_EXIT_WRITE(&hfi->hfi_lock);
	}

	if (hei->hei_kstatp != NULL) {
		ASSERT(hfi != NULL);

		kstat_delete_netstack(hei->hei_kstatp,
		    hfi->hfi_stack->hks_netstackid);
		hei->hei_kstatp = NULL;
	}

	/* Free container */
	kmem_free(hei, sizeof (*hei));

	if (free_family)
		hook_family_free(hfi, hfi->hfi_stack);
}

/*
 * Function:    hook_event_checkdup
 * Returns:     internal event pointer - NULL = Not match
 * Parameters:  he(I) - event pointer
 *
 * Search all of the hook families to see if the event being passed in
 * has already been associated with one.
 */
static hook_event_int_t *
hook_event_checkdup(hook_event_t *he, hook_stack_t *hks)
{
	hook_family_int_t *hfi;
	hook_event_int_t *hei;

	ASSERT(he != NULL);

	CVW_ENTER_READ(&hks->hks_lock);
	SLIST_FOREACH(hfi, &hks->hks_familylist, hfi_entry) {
		SLIST_FOREACH(hei, &hfi->hfi_head, hei_entry) {
			if (hei->hei_event == he) {
				CVW_EXIT_READ(&hks->hks_lock);
				return (hei);
			}
		}
	}
	CVW_EXIT_READ(&hks->hks_lock);

	return (NULL);
}

/*
 * Function:	hook_event_copy
 * Returns:	internal event pointer - NULL = Failed
 * Parameters:	src(I) - event pointer
 *
 * Allocate internal event block and duplicate incoming event
 * No locks should be held across this function as it may sleep.
 */
static hook_event_int_t *
hook_event_copy(hook_event_t *src)
{
	hook_event_int_t *new;

	ASSERT(src != NULL);
	ASSERT(src->he_name != NULL);

	new = (hook_event_int_t *)kmem_zalloc(sizeof (*new), KM_SLEEP);

	/* Copy body */
	TAILQ_INIT(&new->hei_head);
	new->hei_event = src;

	return (new);
}

/*
 * Function:	hook_event_find
 * Returns:	internal event pointer - NULL = Not match
 * Parameters:	hfi(I)   - internal family pointer
 *		event(I) - event name string
 *
 * Search event list with event name
 * 	A lock on hfi->hfi_lock must be held when called.
 */
static hook_event_int_t *
hook_event_find(hook_family_int_t *hfi, char *event)
{
	hook_event_int_t *hei = NULL;

	ASSERT(hfi != NULL);
	ASSERT(event != NULL);

	SLIST_FOREACH(hei, &hfi->hfi_head, hei_entry) {
		if ((strcmp(hei->hei_event->he_name, event) == 0) &&
		    ((hei->hei_waiter.fw_flags & FWF_UNSAFE) == 0))
			break;
	}
	return (hei);
}

/*
 * Function:	hook_event_notify_register
 * Returns:	int         - 0 = success, else failure
 * Parameters:	hfi(I)      - hook family
 *              event(I)    - name of the event
 *              callback(I) - function to be called
 *              arg(I)      - arg to provide callback when it is called
 *
 * Adds a new callback to the event named by "event" (we must find it)
 * that will be executed each time a new hook is added to the event.
 * Of course, if the stack is being shut down, this call should fail.
 */
int
hook_event_notify_register(hook_family_int_t *hfi, char *event,
    hook_notify_fn_t callback, void *arg)
{
	hook_event_int_t *hei;
	hook_stack_t *hks;
	boolean_t canrun;
	hook_int_t *h;
	int error;

	canrun = B_FALSE;
	hks = hfi->hfi_stack;
	CVW_ENTER_READ(&hks->hks_lock);
	if (hks->hks_shutdown != 0) {
		CVW_EXIT_READ(&hks->hks_lock);
		return (ESHUTDOWN);
	}

	CVW_ENTER_READ(&hfi->hfi_lock);

	if (hfi->hfi_condemned || hfi->hfi_shutdown) {
		CVW_EXIT_READ(&hfi->hfi_lock);
		CVW_EXIT_READ(&hks->hks_lock);
		return (ESHUTDOWN);
	}

	hei = hook_event_find(hfi, event);
	if (hei == NULL) {
		CVW_EXIT_READ(&hfi->hfi_lock);
		CVW_EXIT_READ(&hks->hks_lock);
		return (ESRCH);
	}

	if (hei->hei_condemned || hei->hei_shutdown) {
		CVW_EXIT_READ(&hfi->hfi_lock);
		CVW_EXIT_READ(&hks->hks_lock);
		return (ESHUTDOWN);
	}

	CVW_ENTER_WRITE(&hei->hei_lock);
	canrun = (hook_wait_setflag(&hei->hei_waiter, FWF_ADD_WAIT_MASK,
	    FWF_ADD_WANTED, FWF_ADD_ACTIVE) != -1);
	error = hook_notify_register(&hei->hei_nhead, callback, arg);
	CVW_EXIT_WRITE(&hei->hei_lock);

	CVW_EXIT_READ(&hfi->hfi_lock);
	CVW_EXIT_READ(&hks->hks_lock);

	if (error == 0 && canrun) {
		TAILQ_FOREACH(h, &hei->hei_head, hi_entry) {
			callback(HN_REGISTER, arg,
			    hfi->hfi_family.hf_name, hei->hei_event->he_name,
			    h->hi_hook.h_name);
		}
	}

	if (canrun)
		hook_wait_unsetflag(&hei->hei_waiter, FWF_ADD_ACTIVE);

	return (error);
}

/*
 * Function:	hook_event_notify_unregister
 * Returns:	int         - 0 = success, else failure
 * Parameters:	hfi(I)      - hook family
 *              event(I)    - name of the event
 *              callback(I) - function to be called
 *
 * Remove the given callback from the named event's list of functions
 * to call when a hook is added or removed.
 */
int
hook_event_notify_unregister(hook_family_int_t *hfi, char *event,
    hook_notify_fn_t callback)
{
	hook_event_int_t *hei;
	boolean_t free_event;
	boolean_t canrun;
	hook_int_t *h;
	void *arg;
	int error;

	canrun = B_FALSE;

	CVW_ENTER_READ(&hfi->hfi_lock);

	hei = hook_event_find(hfi, event);
	if (hei == NULL) {
		CVW_EXIT_READ(&hfi->hfi_lock);
		return (ESRCH);
	}

	CVW_ENTER_WRITE(&hei->hei_lock);

	(void) hook_wait_setflag(&hei->hei_waiter, FWF_DEL_WAIT_MASK,
	    FWF_DEL_WANTED, FWF_DEL_ACTIVE);

	error = hook_notify_unregister(&hei->hei_nhead, callback, &arg);

	hook_wait_unsetflag(&hei->hei_waiter, FWF_DEL_ACTIVE);

	/*
	 * hei_condemned has been set if someone tried to remove the
	 * event but couldn't because there were still things attached to
	 * it. Now that we've done a successful remove, if it is now empty
	 * then by all rights we should be free'ing it too.  Note that the
	 * expectation is that only the caller of hook_event_add will ever
	 * call hook_event_remove.
	 */
	if ((error == 0) && hei->hei_condemned &&
	    TAILQ_EMPTY(&hei->hei_head) && TAILQ_EMPTY(&hei->hei_nhead)) {
		free_event = B_TRUE;
	} else {
		free_event = B_FALSE;
	}

	if (error == 0 && !free_event) {
		canrun = (hook_wait_setflag(&hei->hei_waiter, FWF_ADD_WAIT_MASK,
		    FWF_ADD_WANTED, FWF_ADD_ACTIVE) != -1);
	}

	CVW_EXIT_WRITE(&hei->hei_lock);
	CVW_EXIT_READ(&hfi->hfi_lock);

	if (canrun) {
		TAILQ_FOREACH(h, &hei->hei_head, hi_entry) {
			callback(HN_UNREGISTER, arg,
			    hfi->hfi_family.hf_name, hei->hei_event->he_name,
			    h->hi_hook.h_name);
		}

		hook_wait_unsetflag(&hei->hei_waiter, FWF_ADD_ACTIVE);
	}

	if (free_event) {
		/*
		 * It is safe to pass in hfi here, without a lock, because
		 * our structure (hei) is still on one of its lists and thus
		 * it won't be able to disappear yet...
		 */
		hook_event_free(hei, hfi);
	}

	return (error);
}

/*
 * Function:	hook_event_notify_run
 * Returns:	None
 * Parameters:	nrun(I) - pointer to the list of callbacks to execute
 *              hfi(I)  - hook stack pointer to execute callbacks for
 *              name(I) - name of a hook family
 *              cmd(I)  - either HN_UNREGISTER or HN_REGISTER
 *
 * Execute all of the callbacks registered for this event.
 */
static void
hook_event_notify_run(hook_event_int_t *hei, hook_family_int_t *hfi,
    char *event, char *name, hook_notify_cmd_t cmd)
{

	hook_notify_run(&hei->hei_nhead, hfi->hfi_family.hf_name,
	    event, name, cmd);
}

/*
 * Function:	hook_register
 * Returns:	int      - 0 = success, else = failure
 * Parameters:	hfi(I)   - internal family pointer
 *		event(I) - event name string
 *		h(I)     - hook pointer
 *
 * Add new hook to hook list on the specified family and event.
 */
int
hook_register(hook_family_int_t *hfi, char *event, hook_t *h)
{
	hook_event_int_t *hei;
	hook_int_t *hi, *new;
	int error;

	ASSERT(hfi != NULL);
	ASSERT(event != NULL);
	ASSERT(h != NULL);

	if (hfi->hfi_stack->hks_shutdown)
		return (NULL);

	/* Alloc hook_int_t and copy hook */
	new = hook_copy(h);
	if (new == NULL)
		return (ENOMEM);

	/*
	 * Since hook add/remove only impact event, so it is unnecessary
	 * to hold global family write lock. Just get read lock here to
	 * ensure event will not be removed when doing hooks operation
	 */
	CVW_ENTER_WRITE(&hfi->hfi_lock);

	hei = hook_event_find(hfi, event);
	if (hei == NULL) {
		CVW_EXIT_WRITE(&hfi->hfi_lock);
		hook_int_free(new, hfi->hfi_stack->hks_netstackid);
		return (ENXIO);
	}

	CVW_ENTER_WRITE(&hei->hei_lock);

	/*
	 * If we've run either the remove() or shutdown(), do not allow any
	 * more hooks to be added to this event.
	 */
	if (hei->hei_shutdown) {
		error = ESHUTDOWN;
		goto bad_add;
	}

	hi = hook_find(hei, h);
	if (hi != NULL) {
		error = EEXIST;
		goto bad_add;
	}

	if (hook_wait_setflag(&hei->hei_waiter, FWF_ADD_WAIT_MASK,
	    FWF_ADD_WANTED, FWF_ADD_ACTIVE) == -1) {
		error = ENOENT;
bad_add:
		CVW_EXIT_WRITE(&hei->hei_lock);
		CVW_EXIT_WRITE(&hfi->hfi_lock);
		hook_int_free(new, hfi->hfi_stack->hks_netstackid);
		return (error);
	}

	/* Add to hook list head */
	error = hook_insert(&hei->hei_head, new);
	if (error == 0) {
		hei->hei_event->he_interested = B_TRUE;
		hei->hei_kstats.hooks_added.value.ui64++;

		hook_init_kstats(hfi, hei, new);
	}

	CVW_EXIT_WRITE(&hei->hei_lock);
	CVW_EXIT_WRITE(&hfi->hfi_lock);

	/*
	 * Note that the name string passed through to the notify callbacks
	 * is from the original hook being registered, not the copy being
	 * inserted.
	 */
	if (error == 0)
		hook_event_notify_run(hei, hfi, event, h->h_name, HN_REGISTER);

	hook_wait_unsetflag(&hei->hei_waiter, FWF_ADD_ACTIVE);

	return (error);
}

/*
 * Function:	hook_insert
 * Returns:	int     - 0 = success, else = failure
 * Parameters:	head(I) - pointer to hook list to insert hook onto
 *		new(I)  - pointer to hook to be inserted
 *
 * Try to insert the hook onto the list of hooks according to the hints
 * given in the hook to be inserted and those that already exist on the
 * list.  For now, the implementation permits only a single hook to be
 * either first or last and names provided with before or after are only
 * loosely coupled with the action.
 */
static int
hook_insert(hook_int_head_t *head, hook_int_t *new)
{
	hook_int_t *before;
	hook_int_t *hi;
	hook_t *hih;
	hook_t *h = &new->hi_hook;

	switch (new->hi_hook.h_hint) {
	case HH_NONE :
		before = NULL;
		/*
		 * If there is no hint present (or not one that can be
		 * satisfied now) then try to at least respect the wishes
		 * of those that want to be last.  If there are none wanting
		 * to be last then add the new hook to the tail of the
		 * list - this means we keep any wanting to be first
		 * happy without having to search for HH_FIRST.
		 */
		TAILQ_FOREACH(hi, head, hi_entry) {
			hih = &hi->hi_hook;
			if ((hih->h_hint == HH_AFTER) &&
			    (strcmp(h->h_name,
			    (char *)hih->h_hintvalue) == 0)) {
				TAILQ_INSERT_BEFORE(hi, new, hi_entry);
				return (0);
			}
			if ((hih->h_hint == HH_BEFORE) && (before == NULL) &&
			    (strcmp(h->h_name,
			    (char *)hih->h_hintvalue) == 0)) {
				before = hi;
			}
		}
		if (before != NULL) {
			TAILQ_INSERT_AFTER(head, before, new, hi_entry);
			return (0);
		}
		hook_insert_plain(head, new);
		break;

	case HH_FIRST :
		hi = TAILQ_FIRST(head);
		if ((hi != NULL) && (hi->hi_hook.h_hint == HH_FIRST))
			return (EBUSY);
		TAILQ_INSERT_HEAD(head, new, hi_entry);
		break;

	case HH_LAST :
		hi = TAILQ_LAST(head, hook_int_head);
		if ((hi != NULL) && (hi->hi_hook.h_hint == HH_LAST))
			return (EBUSY);
		TAILQ_INSERT_TAIL(head, new, hi_entry);
		break;

	case HH_BEFORE :
		hi = hook_find_byname(head, (char *)new->hi_hook.h_hintvalue);
		if (hi == NULL)
			return (hook_insert_afterbefore(head, new));

		if (hi->hi_hook.h_hint == HH_FIRST)
			return (EBUSY);

		TAILQ_INSERT_BEFORE(hi, new, hi_entry);
		break;

	case HH_AFTER :
		hi = hook_find_byname(head, (char *)new->hi_hook.h_hintvalue);
		if (hi == NULL)
			return (hook_insert_afterbefore(head, new));

		if (hi->hi_hook.h_hint == HH_LAST)
			return (EBUSY);

		TAILQ_INSERT_AFTER(head, hi, new, hi_entry);
		break;

	default :
		return (EINVAL);
	}

	return (0);
}

/*
 * Function:	hook_insert_plain
 * Returns:	int     - 0 = success, else = failure
 * Parameters:	head(I) - pointer to hook list to insert hook onto
 *		new(I)  - pointer to hook to be inserted
 *
 * Insert a hook such that it respects the wishes of those that want to
 * be last.  If there are none wanting to be last then add the new hook
 * to the tail of the list - this means we keep any wanting to be first
 * happy without having to search for HH_FIRST.
 */
static void
hook_insert_plain(hook_int_head_t *head, hook_int_t *new)
{
	hook_int_t *hi;

	hi = TAILQ_FIRST(head);
	if (hi != NULL) {
		if (hi->hi_hook.h_hint == HH_LAST) {
			TAILQ_INSERT_BEFORE(hi, new, hi_entry);
		} else {
			TAILQ_INSERT_TAIL(head, new, hi_entry);
		}
	} else {
		TAILQ_INSERT_TAIL(head, new, hi_entry);
	}
}

/*
 * Function:	hook_insert_afterbefore
 * Returns:	int     - 0 = success, else = failure
 * Parameters:	head(I) - pointer to hook list to insert hook onto
 *		new(I)  - pointer to hook to be inserted
 *
 * Simple insertion of a hook specifying a HH_BEFORE or HH_AFTER was not
 * possible, so now we need to be more careful.  The first pass is to go
 * through the list and look for any other hooks that also specify the
 * same hint name as the new one.  The object of this exercise is to make
 * sure that hooks with HH_BEFORE always appear on the list before those
 * with HH_AFTER so that when said hook arrives, it can be placed in the
 * middle of the BEFOREs and AFTERs.  If this condition does not arise,
 * just use hook_insert_plain() to try and insert the hook somewhere that
 * is innocuous to existing efforts.
 */
static int
hook_insert_afterbefore(hook_int_head_t *head, hook_int_t *new)
{
	hook_int_t *hi;
	hook_t *nh;
	hook_t *h;

	nh = &new->hi_hook;
	ASSERT(new->hi_hook.h_hint != HH_NONE);
	ASSERT(new->hi_hook.h_hint != HH_LAST);
	ASSERT(new->hi_hook.h_hint != HH_FIRST);

	/*
	 * First, look through the list to see if there are any other
	 * before's or after's that have a matching hint name.
	 */
	TAILQ_FOREACH(hi, head, hi_entry) {
		h = &hi->hi_hook;
		switch (h->h_hint) {
		case HH_FIRST :
		case HH_LAST :
		case HH_NONE :
			break;
		case HH_BEFORE :
			if ((nh->h_hint == HH_BEFORE) &&
			    (strcmp((char *)h->h_hintvalue,
			    (char *)nh->h_hintvalue) == 0)) {
				TAILQ_INSERT_AFTER(head, hi, new, hi_entry);
				return (0);
			}
			if ((nh->h_hint == HH_AFTER) &&
			    (strcmp((char *)h->h_hintvalue,
			    (char *)nh->h_hintvalue) == 0)) {
				TAILQ_INSERT_BEFORE(hi, new, hi_entry);
				return (0);
			}
			break;
		case HH_AFTER :
			if ((nh->h_hint == HH_AFTER) &&
			    (strcmp((char *)h->h_hintvalue,
			    (char *)nh->h_hintvalue) == 0)) {
				TAILQ_INSERT_AFTER(head, hi, new, hi_entry);
				return (0);
			}
			if ((nh->h_hint == HH_BEFORE) &&
			    (strcmp((char *)h->h_hintvalue,
			    (char *)nh->h_hintvalue) == 0)) {
				TAILQ_INSERT_BEFORE(hi, new, hi_entry);
				return (0);
			}
			break;
		}
	}

	hook_insert_plain(head, new);

	return (0);
}

/*
 * Function:	hook_unregister
 * Returns:	int      - 0 = success, else = failure
 * Parameters:	hfi(I)   - internal family pointer
 *		event(I) - event name string
 *		h(I)     - hook pointer
 *
 * Remove hook from hook list on specific family, event
 */
int
hook_unregister(hook_family_int_t *hfi, char *event, hook_t *h)
{
	hook_event_int_t *hei;
	hook_int_t *hi;
	boolean_t free_event;

	ASSERT(hfi != NULL);
	ASSERT(h != NULL);

	CVW_ENTER_WRITE(&hfi->hfi_lock);

	hei = hook_event_find(hfi, event);
	if (hei == NULL) {
		CVW_EXIT_WRITE(&hfi->hfi_lock);
		return (ENXIO);
	}

	/* Hold write lock for event */
	CVW_ENTER_WRITE(&hei->hei_lock);

	hi = hook_find(hei, h);
	if (hi == NULL) {
		CVW_EXIT_WRITE(&hei->hei_lock);
		CVW_EXIT_WRITE(&hfi->hfi_lock);
		return (ENXIO);
	}

	if (hook_wait_setflag(&hei->hei_waiter, FWF_DEL_WAIT_MASK,
	    FWF_DEL_WANTED, FWF_DEL_ACTIVE) == -1) {
		CVW_EXIT_WRITE(&hei->hei_lock);
		CVW_EXIT_WRITE(&hfi->hfi_lock);
		return (ENOENT);
	}

	/* Remove from hook list */
	TAILQ_REMOVE(&hei->hei_head, hi, hi_entry);

	free_event = B_FALSE;
	if (TAILQ_EMPTY(&hei->hei_head)) {
		hei->hei_event->he_interested = B_FALSE;
		/*
		 * If the delete pending flag has been set and there are
		 * no notifiers on the event (and we've removed the last
		 * hook) then we need to free this event after we're done.
		 */
		if (hei->hei_condemned && TAILQ_EMPTY(&hei->hei_nhead))
			free_event = B_TRUE;
	}
	hei->hei_kstats.hooks_removed.value.ui64++;

	CVW_EXIT_WRITE(&hei->hei_lock);
	CVW_EXIT_WRITE(&hfi->hfi_lock);
	/*
	 * While the FWF_DEL_ACTIVE flag is set, the hook_event_int_t
	 * will not be free'd and thus the hook_family_int_t wil not
	 * be free'd either.
	 */
	hook_event_notify_run(hei, hfi, event, h->h_name, HN_UNREGISTER);
	hook_wait_unsetflag(&hei->hei_waiter, FWF_DEL_ACTIVE);

	hook_int_free(hi, hfi->hfi_stack->hks_netstackid);

	if (free_event)
		hook_event_free(hei, hfi);

	return (0);
}

/*
 * Function:	hook_find_byname
 * Returns:	internal hook pointer - NULL = Not match
 * Parameters:	hei(I) - internal event pointer
 *		name(I)- hook name
 *
 * Search an event's list of hooks to see if there is a hook present that
 * has a matching name to the one being looked for.
 */
static hook_int_t *
hook_find_byname(hook_int_head_t *head, char *name)
{
	hook_int_t *hi;

	TAILQ_FOREACH(hi, head, hi_entry) {
		if (strcmp(hi->hi_hook.h_name, name) == 0)
			return (hi);
	}

	return (NULL);
}

/*
 * Function:	hook_find
 * Returns:	internal hook pointer - NULL = Not match
 * Parameters:	hei(I) - internal event pointer
 *		h(I)   - hook pointer
 *
 * Search an event's list of hooks to see if there is already one that
 * matches the hook being passed in.  Currently the only criteria for a
 * successful search here is for the names to be the same.
 */
static hook_int_t *
hook_find(hook_event_int_t *hei, hook_t *h)
{

	ASSERT(hei != NULL);
	ASSERT(h != NULL);

	return (hook_find_byname(&hei->hei_head, h->h_name));
}

/*
 * Function:	hook_copy
 * Returns:	internal hook pointer - NULL = Failed
 * Parameters:	src(I) - hook pointer
 *
 * Allocate internal hook block and duplicate incoming hook.
 * No locks should be held across this function as it may sleep.
 * Because hook_copy() is responsible for the creation of the internal
 * hook structure that is used here, it takes on population the structure
 * with the kstat information.  Note that while the kstat bits are
 * seeded here, their installation of the kstats is handled elsewhere.
 */
static hook_int_t *
hook_copy(hook_t *src)
{
	hook_int_t *new;
	hook_t *dst;
	int len;

	ASSERT(src != NULL);
	ASSERT(src->h_name != NULL);

	new = (hook_int_t *)kmem_zalloc(sizeof (*new), KM_SLEEP);

	/* Copy body */
	dst = &new->hi_hook;
	*dst = *src;

	/* Copy name */
	len = strlen(src->h_name);
	dst->h_name = (char *)kmem_alloc(len + 1, KM_SLEEP);
	(void) strcpy(dst->h_name, src->h_name);

	/*
	 * This is initialised in this manner to make it safer to use the
	 * same pointer in the kstats field.
	 */
	dst->h_hintvalue = (uintptr_t)"";

	if (dst->h_hint == HH_BEFORE || dst->h_hint == HH_AFTER) {
		len = strlen((char *)src->h_hintvalue);
		if (len > 0) {
			dst->h_hintvalue = (uintptr_t)kmem_alloc(len + 1,
			    KM_SLEEP);
			(void) strcpy((char *)dst->h_hintvalue,
			    (char *)src->h_hintvalue);
		}
	}

	return (new);
}

/*
 * Function:	hook_init_kstats
 * Returns:	None
 * Parameters:  hfi(I) - pointer to the family that owns the event.
 *              hei(I) - pointer to the event that owns this hook
 *              hi(I)  - pointer to the hook for which we create kstats for
 *
 * Each hook that is registered with this framework has its own kstats
 * set up so that we can provide an easy way in which to observe the
 * look of hooks (using the kstat command.) The position is set to 0
 * here but is recalculated after we know the insertion has been a
 * success.
 */
static void
hook_init_kstats(hook_family_int_t *hfi, hook_event_int_t *hei, hook_int_t *hi)
{
	hook_hook_kstat_t template = {
		{ "version",			KSTAT_DATA_INT32 },
		{ "flags",			KSTAT_DATA_UINT32 },
		{ "hint",			KSTAT_DATA_INT32 },
		{ "hint_value",			KSTAT_DATA_STRING },
		{ "position",			KSTAT_DATA_INT32 },
		{ "hook_hits",			KSTAT_DATA_UINT64 }
	};
	hook_stack_t *hks;
	size_t kslen;
	int position;
	hook_int_t *h;

	kslen = strlen(hfi->hfi_family.hf_name) +
	    strlen(hei->hei_event->he_name) + 2;

	hi->hi_ksname = (char *)kmem_zalloc(kslen, KM_SLEEP);
	(void) snprintf(hi->hi_ksname, kslen, "%s/%s",
	    hfi->hfi_family.hf_name, hei->hei_event->he_name);

	hks = hfi->hfi_stack;
	hi->hi_kstatp = kstat_create_netstack(hi->hi_ksname, 0,
	    hi->hi_hook.h_name, "hook", KSTAT_TYPE_NAMED,
	    sizeof (hi->hi_kstats) / sizeof (kstat_named_t),
	    KSTAT_FLAG_VIRTUAL, hks->hks_netstackid);

	/* Initialise the kstats for the structure */
	bcopy(&template, &hi->hi_kstats, sizeof (template));
	hi->hi_kstats.hook_version.value.i32 = hi->hi_hook.h_version;
	hi->hi_kstats.hook_flags.value.ui32 = hi->hi_hook.h_flags;
	hi->hi_kstats.hook_hint.value.i32 = hi->hi_hook.h_hint;
	hi->hi_kstats.hook_position.value.i32 = 0;
	hi->hi_kstats.hook_hits.value.ui64 = 0;

	switch (hi->hi_hook.h_hint) {
	case HH_BEFORE :
	case HH_AFTER :
		kstat_named_setstr(&(hi->hi_kstats.hook_hintvalue),
		    (const char *)hi->hi_hook.h_hintvalue);
		break;
	default :
		kstat_named_setstr(&(hi->hi_kstats.hook_hintvalue),
		    hook_hintvalue_none);
		break;
	}

	if (hi->hi_kstatp != NULL) {
		hi->hi_kstatp->ks_data = (void *)&hi->hi_kstats;
		hi->hi_kstatp->ks_private =
		    (void *)(uintptr_t)hks->hks_netstackid;
		hi->hi_kstatp->ks_data_size +=
		    KSTAT_NAMED_STR_BUFLEN(&(hi->hi_kstats.hook_hintvalue)) + 1;

		kstat_install(hi->hi_kstatp);
	}

	position = 1;
	TAILQ_FOREACH(h, &hei->hei_head, hi_entry) {
		h->hi_kstats.hook_position.value.ui32 = position++;
	}
}

/*
 * Function:	hook_int_free
 * Returns:	None
 * Parameters:	hi(I) - internal hook pointer
 *
 * Free memory allocated to support a hook.
 */
static void
hook_int_free(hook_int_t *hi, netstackid_t stackid)
{
	int len;

	ASSERT(hi != NULL);

	/* Free name space */
	if (hi->hi_hook.h_name != NULL) {
		kmem_free(hi->hi_hook.h_name, strlen(hi->hi_hook.h_name) + 1);
	}
	if (hi->hi_ksname != NULL) {
		kmem_free(hi->hi_ksname, strlen(hi->hi_ksname) + 1);
	}

	/* Free the name used with the before/after hints. */
	switch (hi->hi_hook.h_hint) {
	case HH_BEFORE :
	case HH_AFTER :
		len = strlen((char *)hi->hi_hook.h_hintvalue);
		if (len > 0)
			kmem_free((void *)hi->hi_hook.h_hintvalue, len + 1);
		break;
	default :
		break;
	}

	if (hi->hi_kstatp != NULL)
		kstat_delete_netstack(hi->hi_kstatp, stackid);

	/* Free container */
	kmem_free(hi, sizeof (*hi));
}

/*
 * Function:	hook_alloc
 * Returns:	hook_t *   - pointer to new hook structure
 * Parameters:	version(I) - version number of the API when compiled
 *
 * This function serves as the interface for consumers to obtain a hook_t
 * structure.  At this point in time, there is only a single "version" of
 * it, leading to a straight forward function.  In a perfect world the
 * h_vesion would be a protected data structure member, but C isn't that
 * advanced...
 */
hook_t *
hook_alloc(const int h_version)
{
	hook_t *h;

	h = kmem_zalloc(sizeof (hook_t), KM_SLEEP);
	h->h_version = h_version;
	return (h);
}

/*
 * Function:	hook_free
 * Returns:	None
 * Parameters:	h(I) - external hook pointer
 *
 * This function only free's memory allocated with hook_alloc(), so that if
 * (for example) kernel memory was allocated for h_name, this needs to be
 * free'd before calling hook_free().
 */
void
hook_free(hook_t *h)
{
	kmem_free(h, sizeof (*h));
}

/*
 * Function:	hook_notify_register
 * Returns:	int         - 0 = success, else failure
 * Parameters:	head(I)     - top of the list of callbacks
 *              callback(I) - function to be called
 *              arg(I)      - arg to pass back to the function
 *
 * This function implements the modification of the list of callbacks
 * that are registered when someone wants to be advised of a change
 * that has happened.
 */
static int
hook_notify_register(hook_notify_head_t *head, hook_notify_fn_t callback,
    void *arg)
{
	hook_notify_t *hn;

	TAILQ_FOREACH(hn, head, hn_entry) {
		if (hn->hn_func == callback) {
			return (EEXIST);
		}
	}

	hn = (hook_notify_t *)kmem_alloc(sizeof (*hn), KM_SLEEP);
	hn->hn_func = callback;
	hn->hn_arg = arg;
	TAILQ_INSERT_TAIL(head, hn, hn_entry);

	return (0);
}

/*
 * Function:	hook_notify_unregister
 * Returns:	int         - 0 = success, else failure
 * Parameters:	stackid(I)  - netstack identifier
 *              callback(I) - function to be called
 *              parg(O)     - pointer to storage for pointer
 *
 * When calling this function, the provision of a valid pointer in parg
 * allows the caller to be made aware of what argument the hook function
 * was expecting. This then allows the simulation of HN_UNREGISTER events
 * when a notify-unregister is performed.
 */
static int
hook_notify_unregister(hook_notify_head_t *head,
    hook_notify_fn_t callback, void **parg)
{
	hook_notify_t *hn;

	ASSERT(parg != NULL);

	TAILQ_FOREACH(hn, head, hn_entry) {
		if (hn->hn_func == callback)
			break;
	}

	if (hn == NULL)
		return (ESRCH);

	*parg = hn->hn_arg;

	TAILQ_REMOVE(head, hn, hn_entry);

	kmem_free(hn, sizeof (*hn));

	return (0);
}

/*
 * Function:	hook_notify_run
 * Returns:	None
 * Parameters:	head(I)   - top of the list of callbacks
 *              family(I) - name of the hook family that owns the event
 *              event(I)  - name of the event being changed
 *              name(I)   - name of the object causing change
 *              cmd(I)    - either HN_UNREGISTER or HN_REGISTER
 *
 * This function walks through the list of registered callbacks and
 * executes each one, passing back the arg supplied when registered
 * and the name of the family (that owns the event), event (the thing
 * to which we're making a change) and finally a name that describes
 * what is being added or removed, as indicated by cmd.
 *
 * This function does not acquire or release any lock as it is required
 * that code calling it do so before hand.  The use of hook_notify_head_t
 * is protected by the use of flagwait_t in the structures that own this
 * list and with the use of the FWF_ADD/DEL_ACTIVE flags.
 */
static void
hook_notify_run(hook_notify_head_t *head, char *family, char *event,
    char *name, hook_notify_cmd_t cmd)
{
	hook_notify_t *hn;

	TAILQ_FOREACH(hn, head, hn_entry) {
		(*hn->hn_func)(cmd, hn->hn_arg, family, event, name);
	}
}