xref: /freebsd/sys/netgraph/ng_base.c (revision ddd5b8e9b4d8957fce018c520657cdfa4ecffad3)
1 /*-
2  * Copyright (c) 1996-1999 Whistle Communications, Inc.
3  * All rights reserved.
4  *
5  * Subject to the following obligations and disclaimer of warranty, use and
6  * redistribution of this software, in source or object code forms, with or
7  * without modifications are expressly permitted by Whistle Communications;
8  * provided, however, that:
9  * 1. Any and all reproductions of the source or object code must include the
10  *    copyright notice above and the following disclaimer of warranties; and
11  * 2. No rights are granted, in any manner or form, to use Whistle
12  *    Communications, Inc. trademarks, including the mark "WHISTLE
13  *    COMMUNICATIONS" on advertising, endorsements, or otherwise except as
14  *    such appears in the above copyright notice or in the software.
15  *
16  * THIS SOFTWARE IS BEING PROVIDED BY WHISTLE COMMUNICATIONS "AS IS", AND
17  * TO THE MAXIMUM EXTENT PERMITTED BY LAW, WHISTLE COMMUNICATIONS MAKES NO
18  * REPRESENTATIONS OR WARRANTIES, EXPRESS OR IMPLIED, REGARDING THIS SOFTWARE,
19  * INCLUDING WITHOUT LIMITATION, ANY AND ALL IMPLIED WARRANTIES OF
20  * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT.
21  * WHISTLE COMMUNICATIONS DOES NOT WARRANT, GUARANTEE, OR MAKE ANY
22  * REPRESENTATIONS REGARDING THE USE OF, OR THE RESULTS OF THE USE OF THIS
23  * SOFTWARE IN TERMS OF ITS CORRECTNESS, ACCURACY, RELIABILITY OR OTHERWISE.
24  * IN NO EVENT SHALL WHISTLE COMMUNICATIONS BE LIABLE FOR ANY DAMAGES
25  * RESULTING FROM OR ARISING OUT OF ANY USE OF THIS SOFTWARE, INCLUDING
26  * WITHOUT LIMITATION, ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
27  * PUNITIVE, OR CONSEQUENTIAL DAMAGES, PROCUREMENT OF SUBSTITUTE GOODS OR
28  * SERVICES, LOSS OF USE, DATA OR PROFITS, HOWEVER CAUSED AND UNDER ANY
29  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
30  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
31  * THIS SOFTWARE, EVEN IF WHISTLE COMMUNICATIONS IS ADVISED OF THE POSSIBILITY
32  * OF SUCH DAMAGE.
33  *
34  * Authors: Julian Elischer <julian@freebsd.org>
35  *          Archie Cobbs <archie@freebsd.org>
36  *
37  * $FreeBSD$
38  * $Whistle: ng_base.c,v 1.39 1999/01/28 23:54:53 julian Exp $
39  */
40 
41 /*
42  * This file implements the base netgraph code.
43  */
44 
45 #include <sys/param.h>
46 #include <sys/systm.h>
47 #include <sys/ctype.h>
48 #include <sys/hash.h>
49 #include <sys/kdb.h>
50 #include <sys/kernel.h>
51 #include <sys/kthread.h>
52 #include <sys/ktr.h>
53 #include <sys/limits.h>
54 #include <sys/lock.h>
55 #include <sys/malloc.h>
56 #include <sys/mbuf.h>
57 #include <sys/proc.h>
58 #include <sys/queue.h>
59 #include <sys/refcount.h>
60 #include <sys/rwlock.h>
61 #include <sys/smp.h>
62 #include <sys/sysctl.h>
63 #include <sys/syslog.h>
64 #include <sys/unistd.h>
65 #include <machine/cpu.h>
66 
67 #include <net/netisr.h>
68 #include <net/vnet.h>
69 
70 #include <netgraph/ng_message.h>
71 #include <netgraph/netgraph.h>
72 #include <netgraph/ng_parse.h>
73 
74 MODULE_VERSION(netgraph, NG_ABI_VERSION);
75 
76 /* Mutex to protect topology events. */
77 static struct mtx	ng_topo_mtx;
78 
79 #ifdef	NETGRAPH_DEBUG
80 static struct mtx	ng_nodelist_mtx; /* protects global node/hook lists */
81 static struct mtx	ngq_mtx;	/* protects the queue item list */
82 
83 static SLIST_HEAD(, ng_node) ng_allnodes;
84 static LIST_HEAD(, ng_node) ng_freenodes; /* in debug, we never free() them */
85 static SLIST_HEAD(, ng_hook) ng_allhooks;
86 static LIST_HEAD(, ng_hook) ng_freehooks; /* in debug, we never free() them */
87 
88 static void ng_dumpitems(void);
89 static void ng_dumpnodes(void);
90 static void ng_dumphooks(void);
91 
92 #endif	/* NETGRAPH_DEBUG */
93 /*
94  * DEAD versions of the structures.
95  * In order to avoid races, it is sometimes neccesary to point
96  * at SOMETHING even though theoretically, the current entity is
97  * INVALID. Use these to avoid these races.
98  */
99 struct ng_type ng_deadtype = {
100 	NG_ABI_VERSION,
101 	"dead",
102 	NULL,	/* modevent */
103 	NULL,	/* constructor */
104 	NULL,	/* rcvmsg */
105 	NULL,	/* shutdown */
106 	NULL,	/* newhook */
107 	NULL,	/* findhook */
108 	NULL,	/* connect */
109 	NULL,	/* rcvdata */
110 	NULL,	/* disconnect */
111 	NULL, 	/* cmdlist */
112 };
113 
114 struct ng_node ng_deadnode = {
115 	"dead",
116 	&ng_deadtype,
117 	NGF_INVALID,
118 	0,	/* numhooks */
119 	NULL,	/* private */
120 	0,	/* ID */
121 	LIST_HEAD_INITIALIZER(ng_deadnode.nd_hooks),
122 	{},	/* all_nodes list entry */
123 	{},	/* id hashtable list entry */
124 	{	0,
125 		0,
126 		{}, /* should never use! (should hang) */
127 		{}, /* workqueue entry */
128 		STAILQ_HEAD_INITIALIZER(ng_deadnode.nd_input_queue.queue),
129 	},
130 	1,	/* refs */
131 	NULL,	/* vnet */
132 #ifdef	NETGRAPH_DEBUG
133 	ND_MAGIC,
134 	__FILE__,
135 	__LINE__,
136 	{NULL}
137 #endif	/* NETGRAPH_DEBUG */
138 };
139 
140 struct ng_hook ng_deadhook = {
141 	"dead",
142 	NULL,		/* private */
143 	HK_INVALID | HK_DEAD,
144 	0,		/* undefined data link type */
145 	&ng_deadhook,	/* Peer is self */
146 	&ng_deadnode,	/* attached to deadnode */
147 	{},		/* hooks list */
148 	NULL,		/* override rcvmsg() */
149 	NULL,		/* override rcvdata() */
150 	1,		/* refs always >= 1 */
151 #ifdef	NETGRAPH_DEBUG
152 	HK_MAGIC,
153 	__FILE__,
154 	__LINE__,
155 	{NULL}
156 #endif	/* NETGRAPH_DEBUG */
157 };
158 
159 /*
160  * END DEAD STRUCTURES
161  */
162 /* List nodes with unallocated work */
163 static STAILQ_HEAD(, ng_node) ng_worklist = STAILQ_HEAD_INITIALIZER(ng_worklist);
164 static struct mtx	ng_worklist_mtx;   /* MUST LOCK NODE FIRST */
165 
166 /* List of installed types */
167 static LIST_HEAD(, ng_type) ng_typelist;
168 static struct rwlock	ng_typelist_lock;
169 #define	TYPELIST_RLOCK()	rw_rlock(&ng_typelist_lock)
170 #define	TYPELIST_RUNLOCK()	rw_runlock(&ng_typelist_lock)
171 #define	TYPELIST_WLOCK()	rw_wlock(&ng_typelist_lock)
172 #define	TYPELIST_WUNLOCK()	rw_wunlock(&ng_typelist_lock)
173 
174 /* Hash related definitions. */
175 LIST_HEAD(nodehash, ng_node);
176 static VNET_DEFINE(struct nodehash *, ng_ID_hash);
177 static VNET_DEFINE(u_long, ng_ID_hmask);
178 static VNET_DEFINE(u_long, ng_nodes);
179 static VNET_DEFINE(struct nodehash *, ng_name_hash);
180 static VNET_DEFINE(u_long, ng_name_hmask);
181 static VNET_DEFINE(u_long, ng_named_nodes);
182 #define	V_ng_ID_hash		VNET(ng_ID_hash)
183 #define	V_ng_ID_hmask		VNET(ng_ID_hmask)
184 #define	V_ng_nodes		VNET(ng_nodes)
185 #define	V_ng_name_hash		VNET(ng_name_hash)
186 #define	V_ng_name_hmask		VNET(ng_name_hmask)
187 #define	V_ng_named_nodes	VNET(ng_named_nodes)
188 
189 static struct rwlock	ng_idhash_lock;
190 #define	IDHASH_RLOCK()		rw_rlock(&ng_idhash_lock)
191 #define	IDHASH_RUNLOCK()	rw_runlock(&ng_idhash_lock)
192 #define	IDHASH_WLOCK()		rw_wlock(&ng_idhash_lock)
193 #define	IDHASH_WUNLOCK()	rw_wunlock(&ng_idhash_lock)
194 
195 /* Method to find a node.. used twice so do it here */
196 #define NG_IDHASH_FN(ID) ((ID) % (V_ng_ID_hmask + 1))
197 #define NG_IDHASH_FIND(ID, node)					\
198 	do { 								\
199 		rw_assert(&ng_idhash_lock, RA_LOCKED);			\
200 		LIST_FOREACH(node, &V_ng_ID_hash[NG_IDHASH_FN(ID)],	\
201 						nd_idnodes) {		\
202 			if (NG_NODE_IS_VALID(node)			\
203 			&& (NG_NODE_ID(node) == ID)) {			\
204 				break;					\
205 			}						\
206 		}							\
207 	} while (0)
208 
209 static struct rwlock	ng_namehash_lock;
210 #define	NAMEHASH_RLOCK()	rw_rlock(&ng_namehash_lock)
211 #define	NAMEHASH_RUNLOCK()	rw_runlock(&ng_namehash_lock)
212 #define	NAMEHASH_WLOCK()	rw_wlock(&ng_namehash_lock)
213 #define	NAMEHASH_WUNLOCK()	rw_wunlock(&ng_namehash_lock)
214 
215 /* Internal functions */
216 static int	ng_add_hook(node_p node, const char *name, hook_p * hookp);
217 static int	ng_generic_msg(node_p here, item_p item, hook_p lasthook);
218 static ng_ID_t	ng_decodeidname(const char *name);
219 static int	ngb_mod_event(module_t mod, int event, void *data);
220 static void	ng_worklist_add(node_p node);
221 static void	ngthread(void *);
222 static int	ng_apply_item(node_p node, item_p item, int rw);
223 static void	ng_flush_input_queue(node_p node);
224 static node_p	ng_ID2noderef(ng_ID_t ID);
225 static int	ng_con_nodes(item_p item, node_p node, const char *name,
226 		    node_p node2, const char *name2);
227 static int	ng_con_part2(node_p node, item_p item, hook_p hook);
228 static int	ng_con_part3(node_p node, item_p item, hook_p hook);
229 static int	ng_mkpeer(node_p node, const char *name, const char *name2,
230 		    char *type);
231 static void	ng_name_rehash(void);
232 static void	ng_ID_rehash(void);
233 
234 /* Imported, these used to be externally visible, some may go back. */
235 void	ng_destroy_hook(hook_p hook);
236 int	ng_path2noderef(node_p here, const char *path,
237 	node_p *dest, hook_p *lasthook);
238 int	ng_make_node(const char *type, node_p *nodepp);
239 int	ng_path_parse(char *addr, char **node, char **path, char **hook);
240 void	ng_rmnode(node_p node, hook_p dummy1, void *dummy2, int dummy3);
241 void	ng_unname(node_p node);
242 
243 /* Our own netgraph malloc type */
244 MALLOC_DEFINE(M_NETGRAPH, "netgraph", "netgraph structures and ctrl messages");
245 MALLOC_DEFINE(M_NETGRAPH_MSG, "netgraph_msg", "netgraph name storage");
246 static MALLOC_DEFINE(M_NETGRAPH_HOOK, "netgraph_hook",
247     "netgraph hook structures");
248 static MALLOC_DEFINE(M_NETGRAPH_NODE, "netgraph_node",
249     "netgraph node structures");
250 static MALLOC_DEFINE(M_NETGRAPH_ITEM, "netgraph_item",
251     "netgraph item structures");
252 
253 /* Should not be visible outside this file */
254 
255 #define _NG_ALLOC_HOOK(hook) \
256 	hook = malloc(sizeof(*hook), M_NETGRAPH_HOOK, M_NOWAIT | M_ZERO)
257 #define _NG_ALLOC_NODE(node) \
258 	node = malloc(sizeof(*node), M_NETGRAPH_NODE, M_NOWAIT | M_ZERO)
259 
260 #define	NG_QUEUE_LOCK_INIT(n)			\
261 	mtx_init(&(n)->q_mtx, "ng_node", NULL, MTX_DEF)
262 #define	NG_QUEUE_LOCK(n)			\
263 	mtx_lock(&(n)->q_mtx)
264 #define	NG_QUEUE_UNLOCK(n)			\
265 	mtx_unlock(&(n)->q_mtx)
266 #define	NG_WORKLIST_LOCK_INIT()			\
267 	mtx_init(&ng_worklist_mtx, "ng_worklist", NULL, MTX_DEF)
268 #define	NG_WORKLIST_LOCK()			\
269 	mtx_lock(&ng_worklist_mtx)
270 #define	NG_WORKLIST_UNLOCK()			\
271 	mtx_unlock(&ng_worklist_mtx)
272 #define	NG_WORKLIST_SLEEP()			\
273 	mtx_sleep(&ng_worklist, &ng_worklist_mtx, PI_NET, "sleep", 0)
274 #define	NG_WORKLIST_WAKEUP()			\
275 	wakeup_one(&ng_worklist)
276 
277 #ifdef NETGRAPH_DEBUG /*----------------------------------------------*/
278 /*
279  * In debug mode:
280  * In an attempt to help track reference count screwups
281  * we do not free objects back to the malloc system, but keep them
282  * in a local cache where we can examine them and keep information safely
283  * after they have been freed.
284  * We use this scheme for nodes and hooks, and to some extent for items.
285  */
286 static __inline hook_p
287 ng_alloc_hook(void)
288 {
289 	hook_p hook;
290 	SLIST_ENTRY(ng_hook) temp;
291 	mtx_lock(&ng_nodelist_mtx);
292 	hook = LIST_FIRST(&ng_freehooks);
293 	if (hook) {
294 		LIST_REMOVE(hook, hk_hooks);
295 		bcopy(&hook->hk_all, &temp, sizeof(temp));
296 		bzero(hook, sizeof(struct ng_hook));
297 		bcopy(&temp, &hook->hk_all, sizeof(temp));
298 		mtx_unlock(&ng_nodelist_mtx);
299 		hook->hk_magic = HK_MAGIC;
300 	} else {
301 		mtx_unlock(&ng_nodelist_mtx);
302 		_NG_ALLOC_HOOK(hook);
303 		if (hook) {
304 			hook->hk_magic = HK_MAGIC;
305 			mtx_lock(&ng_nodelist_mtx);
306 			SLIST_INSERT_HEAD(&ng_allhooks, hook, hk_all);
307 			mtx_unlock(&ng_nodelist_mtx);
308 		}
309 	}
310 	return (hook);
311 }
312 
313 static __inline node_p
314 ng_alloc_node(void)
315 {
316 	node_p node;
317 	SLIST_ENTRY(ng_node) temp;
318 	mtx_lock(&ng_nodelist_mtx);
319 	node = LIST_FIRST(&ng_freenodes);
320 	if (node) {
321 		LIST_REMOVE(node, nd_nodes);
322 		bcopy(&node->nd_all, &temp, sizeof(temp));
323 		bzero(node, sizeof(struct ng_node));
324 		bcopy(&temp, &node->nd_all, sizeof(temp));
325 		mtx_unlock(&ng_nodelist_mtx);
326 		node->nd_magic = ND_MAGIC;
327 	} else {
328 		mtx_unlock(&ng_nodelist_mtx);
329 		_NG_ALLOC_NODE(node);
330 		if (node) {
331 			node->nd_magic = ND_MAGIC;
332 			mtx_lock(&ng_nodelist_mtx);
333 			SLIST_INSERT_HEAD(&ng_allnodes, node, nd_all);
334 			mtx_unlock(&ng_nodelist_mtx);
335 		}
336 	}
337 	return (node);
338 }
339 
340 #define NG_ALLOC_HOOK(hook) do { (hook) = ng_alloc_hook(); } while (0)
341 #define NG_ALLOC_NODE(node) do { (node) = ng_alloc_node(); } while (0)
342 
343 #define NG_FREE_HOOK(hook)						\
344 	do {								\
345 		mtx_lock(&ng_nodelist_mtx);				\
346 		LIST_INSERT_HEAD(&ng_freehooks, hook, hk_hooks);	\
347 		hook->hk_magic = 0;					\
348 		mtx_unlock(&ng_nodelist_mtx);				\
349 	} while (0)
350 
351 #define NG_FREE_NODE(node)						\
352 	do {								\
353 		mtx_lock(&ng_nodelist_mtx);				\
354 		LIST_INSERT_HEAD(&ng_freenodes, node, nd_nodes);	\
355 		node->nd_magic = 0;					\
356 		mtx_unlock(&ng_nodelist_mtx);				\
357 	} while (0)
358 
359 #else /* NETGRAPH_DEBUG */ /*----------------------------------------------*/
360 
361 #define NG_ALLOC_HOOK(hook) _NG_ALLOC_HOOK(hook)
362 #define NG_ALLOC_NODE(node) _NG_ALLOC_NODE(node)
363 
364 #define NG_FREE_HOOK(hook) do { free((hook), M_NETGRAPH_HOOK); } while (0)
365 #define NG_FREE_NODE(node) do { free((node), M_NETGRAPH_NODE); } while (0)
366 
367 #endif /* NETGRAPH_DEBUG */ /*----------------------------------------------*/
368 
369 /* Set this to kdb_enter("X") to catch all errors as they occur */
370 #ifndef TRAP_ERROR
371 #define TRAP_ERROR()
372 #endif
373 
374 static VNET_DEFINE(ng_ID_t, nextID) = 1;
375 #define	V_nextID			VNET(nextID)
376 
377 #ifdef INVARIANTS
378 #define CHECK_DATA_MBUF(m)	do {					\
379 		struct mbuf *n;						\
380 		int total;						\
381 									\
382 		M_ASSERTPKTHDR(m);					\
383 		for (total = 0, n = (m); n != NULL; n = n->m_next) {	\
384 			total += n->m_len;				\
385 			if (n->m_nextpkt != NULL)			\
386 				panic("%s: m_nextpkt", __func__);	\
387 		}							\
388 									\
389 		if ((m)->m_pkthdr.len != total) {			\
390 			panic("%s: %d != %d",				\
391 			    __func__, (m)->m_pkthdr.len, total);	\
392 		}							\
393 	} while (0)
394 #else
395 #define CHECK_DATA_MBUF(m)
396 #endif
397 
398 #define ERROUT(x)	do { error = (x); goto done; } while (0)
399 
400 /************************************************************************
401 	Parse type definitions for generic messages
402 ************************************************************************/
403 
404 /* Handy structure parse type defining macro */
405 #define DEFINE_PARSE_STRUCT_TYPE(lo, up, args)				\
406 static const struct ng_parse_struct_field				\
407 	ng_ ## lo ## _type_fields[] = NG_GENERIC_ ## up ## _INFO args;	\
408 static const struct ng_parse_type ng_generic_ ## lo ## _type = {	\
409 	&ng_parse_struct_type,						\
410 	&ng_ ## lo ## _type_fields					\
411 }
412 
413 DEFINE_PARSE_STRUCT_TYPE(mkpeer, MKPEER, ());
414 DEFINE_PARSE_STRUCT_TYPE(connect, CONNECT, ());
415 DEFINE_PARSE_STRUCT_TYPE(name, NAME, ());
416 DEFINE_PARSE_STRUCT_TYPE(rmhook, RMHOOK, ());
417 DEFINE_PARSE_STRUCT_TYPE(nodeinfo, NODEINFO, ());
418 DEFINE_PARSE_STRUCT_TYPE(typeinfo, TYPEINFO, ());
419 DEFINE_PARSE_STRUCT_TYPE(linkinfo, LINKINFO, (&ng_generic_nodeinfo_type));
420 
421 /* Get length of an array when the length is stored as a 32 bit
422    value immediately preceding the array -- as with struct namelist
423    and struct typelist. */
424 static int
425 ng_generic_list_getLength(const struct ng_parse_type *type,
426 	const u_char *start, const u_char *buf)
427 {
428 	return *((const u_int32_t *)(buf - 4));
429 }
430 
431 /* Get length of the array of struct linkinfo inside a struct hooklist */
432 static int
433 ng_generic_linkinfo_getLength(const struct ng_parse_type *type,
434 	const u_char *start, const u_char *buf)
435 {
436 	const struct hooklist *hl = (const struct hooklist *)start;
437 
438 	return hl->nodeinfo.hooks;
439 }
440 
441 /* Array type for a variable length array of struct namelist */
442 static const struct ng_parse_array_info ng_nodeinfoarray_type_info = {
443 	&ng_generic_nodeinfo_type,
444 	&ng_generic_list_getLength
445 };
446 static const struct ng_parse_type ng_generic_nodeinfoarray_type = {
447 	&ng_parse_array_type,
448 	&ng_nodeinfoarray_type_info
449 };
450 
451 /* Array type for a variable length array of struct typelist */
452 static const struct ng_parse_array_info ng_typeinfoarray_type_info = {
453 	&ng_generic_typeinfo_type,
454 	&ng_generic_list_getLength
455 };
456 static const struct ng_parse_type ng_generic_typeinfoarray_type = {
457 	&ng_parse_array_type,
458 	&ng_typeinfoarray_type_info
459 };
460 
461 /* Array type for array of struct linkinfo in struct hooklist */
462 static const struct ng_parse_array_info ng_generic_linkinfo_array_type_info = {
463 	&ng_generic_linkinfo_type,
464 	&ng_generic_linkinfo_getLength
465 };
466 static const struct ng_parse_type ng_generic_linkinfo_array_type = {
467 	&ng_parse_array_type,
468 	&ng_generic_linkinfo_array_type_info
469 };
470 
471 DEFINE_PARSE_STRUCT_TYPE(typelist, TYPELIST, (&ng_generic_nodeinfoarray_type));
472 DEFINE_PARSE_STRUCT_TYPE(hooklist, HOOKLIST,
473 	(&ng_generic_nodeinfo_type, &ng_generic_linkinfo_array_type));
474 DEFINE_PARSE_STRUCT_TYPE(listnodes, LISTNODES,
475 	(&ng_generic_nodeinfoarray_type));
476 
477 /* List of commands and how to convert arguments to/from ASCII */
478 static const struct ng_cmdlist ng_generic_cmds[] = {
479 	{
480 	  NGM_GENERIC_COOKIE,
481 	  NGM_SHUTDOWN,
482 	  "shutdown",
483 	  NULL,
484 	  NULL
485 	},
486 	{
487 	  NGM_GENERIC_COOKIE,
488 	  NGM_MKPEER,
489 	  "mkpeer",
490 	  &ng_generic_mkpeer_type,
491 	  NULL
492 	},
493 	{
494 	  NGM_GENERIC_COOKIE,
495 	  NGM_CONNECT,
496 	  "connect",
497 	  &ng_generic_connect_type,
498 	  NULL
499 	},
500 	{
501 	  NGM_GENERIC_COOKIE,
502 	  NGM_NAME,
503 	  "name",
504 	  &ng_generic_name_type,
505 	  NULL
506 	},
507 	{
508 	  NGM_GENERIC_COOKIE,
509 	  NGM_RMHOOK,
510 	  "rmhook",
511 	  &ng_generic_rmhook_type,
512 	  NULL
513 	},
514 	{
515 	  NGM_GENERIC_COOKIE,
516 	  NGM_NODEINFO,
517 	  "nodeinfo",
518 	  NULL,
519 	  &ng_generic_nodeinfo_type
520 	},
521 	{
522 	  NGM_GENERIC_COOKIE,
523 	  NGM_LISTHOOKS,
524 	  "listhooks",
525 	  NULL,
526 	  &ng_generic_hooklist_type
527 	},
528 	{
529 	  NGM_GENERIC_COOKIE,
530 	  NGM_LISTNAMES,
531 	  "listnames",
532 	  NULL,
533 	  &ng_generic_listnodes_type	/* same as NGM_LISTNODES */
534 	},
535 	{
536 	  NGM_GENERIC_COOKIE,
537 	  NGM_LISTNODES,
538 	  "listnodes",
539 	  NULL,
540 	  &ng_generic_listnodes_type
541 	},
542 	{
543 	  NGM_GENERIC_COOKIE,
544 	  NGM_LISTTYPES,
545 	  "listtypes",
546 	  NULL,
547 	  &ng_generic_typeinfo_type
548 	},
549 	{
550 	  NGM_GENERIC_COOKIE,
551 	  NGM_TEXT_CONFIG,
552 	  "textconfig",
553 	  NULL,
554 	  &ng_parse_string_type
555 	},
556 	{
557 	  NGM_GENERIC_COOKIE,
558 	  NGM_TEXT_STATUS,
559 	  "textstatus",
560 	  NULL,
561 	  &ng_parse_string_type
562 	},
563 	{
564 	  NGM_GENERIC_COOKIE,
565 	  NGM_ASCII2BINARY,
566 	  "ascii2binary",
567 	  &ng_parse_ng_mesg_type,
568 	  &ng_parse_ng_mesg_type
569 	},
570 	{
571 	  NGM_GENERIC_COOKIE,
572 	  NGM_BINARY2ASCII,
573 	  "binary2ascii",
574 	  &ng_parse_ng_mesg_type,
575 	  &ng_parse_ng_mesg_type
576 	},
577 	{ 0 }
578 };
579 
580 /************************************************************************
581 			Node routines
582 ************************************************************************/
583 
584 /*
585  * Instantiate a node of the requested type
586  */
587 int
588 ng_make_node(const char *typename, node_p *nodepp)
589 {
590 	struct ng_type *type;
591 	int	error;
592 
593 	/* Check that the type makes sense */
594 	if (typename == NULL) {
595 		TRAP_ERROR();
596 		return (EINVAL);
597 	}
598 
599 	/* Locate the node type. If we fail we return. Do not try to load
600 	 * module.
601 	 */
602 	if ((type = ng_findtype(typename)) == NULL)
603 		return (ENXIO);
604 
605 	/*
606 	 * If we have a constructor, then make the node and
607 	 * call the constructor to do type specific initialisation.
608 	 */
609 	if (type->constructor != NULL) {
610 		if ((error = ng_make_node_common(type, nodepp)) == 0) {
611 			if ((error = ((*type->constructor)(*nodepp))) != 0) {
612 				NG_NODE_UNREF(*nodepp);
613 			}
614 		}
615 	} else {
616 		/*
617 		 * Node has no constructor. We cannot ask for one
618 		 * to be made. It must be brought into existence by
619 		 * some external agency. The external agency should
620 		 * call ng_make_node_common() directly to get the
621 		 * netgraph part initialised.
622 		 */
623 		TRAP_ERROR();
624 		error = EINVAL;
625 	}
626 	return (error);
627 }
628 
629 /*
630  * Generic node creation. Called by node initialisation for externally
631  * instantiated nodes (e.g. hardware, sockets, etc ).
632  * The returned node has a reference count of 1.
633  */
634 int
635 ng_make_node_common(struct ng_type *type, node_p *nodepp)
636 {
637 	node_p node;
638 
639 	/* Require the node type to have been already installed */
640 	if (ng_findtype(type->name) == NULL) {
641 		TRAP_ERROR();
642 		return (EINVAL);
643 	}
644 
645 	/* Make a node and try attach it to the type */
646 	NG_ALLOC_NODE(node);
647 	if (node == NULL) {
648 		TRAP_ERROR();
649 		return (ENOMEM);
650 	}
651 	node->nd_type = type;
652 #ifdef VIMAGE
653 	node->nd_vnet = curvnet;
654 #endif
655 	NG_NODE_REF(node);				/* note reference */
656 	type->refs++;
657 
658 	NG_QUEUE_LOCK_INIT(&node->nd_input_queue);
659 	STAILQ_INIT(&node->nd_input_queue.queue);
660 	node->nd_input_queue.q_flags = 0;
661 
662 	/* Initialize hook list for new node */
663 	LIST_INIT(&node->nd_hooks);
664 
665 	/* Get an ID and put us in the hash chain. */
666 	IDHASH_WLOCK();
667 	for (;;) { /* wrap protection, even if silly */
668 		node_p node2 = NULL;
669 		node->nd_ID = V_nextID++; /* 137/sec for 1 year before wrap */
670 
671 		/* Is there a problem with the new number? */
672 		NG_IDHASH_FIND(node->nd_ID, node2); /* already taken? */
673 		if ((node->nd_ID != 0) && (node2 == NULL)) {
674 			break;
675 		}
676 	}
677 	V_ng_nodes++;
678 	if (V_ng_nodes * 2 > V_ng_ID_hmask)
679 		ng_ID_rehash();
680 	LIST_INSERT_HEAD(&V_ng_ID_hash[NG_IDHASH_FN(node->nd_ID)], node,
681 	    nd_idnodes);
682 	IDHASH_WUNLOCK();
683 
684 	/* Done */
685 	*nodepp = node;
686 	return (0);
687 }
688 
689 /*
690  * Forceably start the shutdown process on a node. Either call
691  * its shutdown method, or do the default shutdown if there is
692  * no type-specific method.
693  *
694  * We can only be called from a shutdown message, so we know we have
695  * a writer lock, and therefore exclusive access. It also means
696  * that we should not be on the work queue, but we check anyhow.
697  *
698  * Persistent node types must have a type-specific method which
699  * allocates a new node in which case, this one is irretrievably going away,
700  * or cleans up anything it needs, and just makes the node valid again,
701  * in which case we allow the node to survive.
702  *
703  * XXX We need to think of how to tell a persistent node that we
704  * REALLY need to go away because the hardware has gone or we
705  * are rebooting.... etc.
706  */
707 void
708 ng_rmnode(node_p node, hook_p dummy1, void *dummy2, int dummy3)
709 {
710 	hook_p hook;
711 
712 	/* Check if it's already shutting down */
713 	if ((node->nd_flags & NGF_CLOSING) != 0)
714 		return;
715 
716 	if (node == &ng_deadnode) {
717 		printf ("shutdown called on deadnode\n");
718 		return;
719 	}
720 
721 	/* Add an extra reference so it doesn't go away during this */
722 	NG_NODE_REF(node);
723 
724 	/*
725 	 * Mark it invalid so any newcomers know not to try use it
726 	 * Also add our own mark so we can't recurse
727 	 * note that NGF_INVALID does not do this as it's also set during
728 	 * creation
729 	 */
730 	node->nd_flags |= NGF_INVALID|NGF_CLOSING;
731 
732 	/* If node has its pre-shutdown method, then call it first*/
733 	if (node->nd_type && node->nd_type->close)
734 		(*node->nd_type->close)(node);
735 
736 	/* Notify all remaining connected nodes to disconnect */
737 	while ((hook = LIST_FIRST(&node->nd_hooks)) != NULL)
738 		ng_destroy_hook(hook);
739 
740 	/*
741 	 * Drain the input queue forceably.
742 	 * it has no hooks so what's it going to do, bleed on someone?
743 	 * Theoretically we came here from a queue entry that was added
744 	 * Just before the queue was closed, so it should be empty anyway.
745 	 * Also removes us from worklist if needed.
746 	 */
747 	ng_flush_input_queue(node);
748 
749 	/* Ask the type if it has anything to do in this case */
750 	if (node->nd_type && node->nd_type->shutdown) {
751 		(*node->nd_type->shutdown)(node);
752 		if (NG_NODE_IS_VALID(node)) {
753 			/*
754 			 * Well, blow me down if the node code hasn't declared
755 			 * that it doesn't want to die.
756 			 * Presumably it is a persistant node.
757 			 * If we REALLY want it to go away,
758 			 *  e.g. hardware going away,
759 			 * Our caller should set NGF_REALLY_DIE in nd_flags.
760 			 */
761 			node->nd_flags &= ~(NGF_INVALID|NGF_CLOSING);
762 			NG_NODE_UNREF(node); /* Assume they still have theirs */
763 			return;
764 		}
765 	} else {				/* do the default thing */
766 		NG_NODE_UNREF(node);
767 	}
768 
769 	ng_unname(node); /* basically a NOP these days */
770 
771 	/*
772 	 * Remove extra reference, possibly the last
773 	 * Possible other holders of references may include
774 	 * timeout callouts, but theoretically the node's supposed to
775 	 * have cancelled them. Possibly hardware dependencies may
776 	 * force a driver to 'linger' with a reference.
777 	 */
778 	NG_NODE_UNREF(node);
779 }
780 
781 /*
782  * Remove a reference to the node, possibly the last.
783  * deadnode always acts as it it were the last.
784  */
785 void
786 ng_unref_node(node_p node)
787 {
788 
789 	if (node == &ng_deadnode)
790 		return;
791 
792 	if (refcount_release(&node->nd_refs)) { /* we were the last */
793 
794 		node->nd_type->refs--; /* XXX maybe should get types lock? */
795 		NAMEHASH_WLOCK();
796 		if (NG_NODE_HAS_NAME(node)) {
797 			V_ng_named_nodes--;
798 			LIST_REMOVE(node, nd_nodes);
799 		}
800 		NAMEHASH_WUNLOCK();
801 
802 		IDHASH_WLOCK();
803 		V_ng_nodes--;
804 		LIST_REMOVE(node, nd_idnodes);
805 		IDHASH_WUNLOCK();
806 
807 		mtx_destroy(&node->nd_input_queue.q_mtx);
808 		NG_FREE_NODE(node);
809 	}
810 }
811 
812 /************************************************************************
813 			Node ID handling
814 ************************************************************************/
815 static node_p
816 ng_ID2noderef(ng_ID_t ID)
817 {
818 	node_p node;
819 
820 	IDHASH_RLOCK();
821 	NG_IDHASH_FIND(ID, node);
822 	if (node)
823 		NG_NODE_REF(node);
824 	IDHASH_RUNLOCK();
825 	return(node);
826 }
827 
828 ng_ID_t
829 ng_node2ID(node_p node)
830 {
831 	return (node ? NG_NODE_ID(node) : 0);
832 }
833 
834 /************************************************************************
835 			Node name handling
836 ************************************************************************/
837 
838 /*
839  * Assign a node a name.
840  */
841 int
842 ng_name_node(node_p node, const char *name)
843 {
844 	uint32_t hash;
845 	node_p node2;
846 	int i;
847 
848 	/* Check the name is valid */
849 	for (i = 0; i < NG_NODESIZ; i++) {
850 		if (name[i] == '\0' || name[i] == '.' || name[i] == ':')
851 			break;
852 	}
853 	if (i == 0 || name[i] != '\0') {
854 		TRAP_ERROR();
855 		return (EINVAL);
856 	}
857 	if (ng_decodeidname(name) != 0) { /* valid IDs not allowed here */
858 		TRAP_ERROR();
859 		return (EINVAL);
860 	}
861 
862 	NAMEHASH_WLOCK();
863 	if (V_ng_named_nodes * 2 > V_ng_name_hmask)
864 		ng_name_rehash();
865 
866 	hash = hash32_str(name, HASHINIT) & V_ng_name_hmask;
867 	/* Check the name isn't already being used. */
868 	LIST_FOREACH(node2, &V_ng_name_hash[hash], nd_nodes)
869 		if (NG_NODE_IS_VALID(node2) &&
870 		    (strcmp(NG_NODE_NAME(node2), name) == 0)) {
871 			NAMEHASH_WUNLOCK();
872 			return (EADDRINUSE);
873 		}
874 
875 	if (NG_NODE_HAS_NAME(node))
876 		LIST_REMOVE(node, nd_nodes);
877 	else
878 		V_ng_named_nodes++;
879 	/* Copy it. */
880 	strlcpy(NG_NODE_NAME(node), name, NG_NODESIZ);
881 	/* Update name hash. */
882 	LIST_INSERT_HEAD(&V_ng_name_hash[hash], node, nd_nodes);
883 	NAMEHASH_WUNLOCK();
884 
885 	return (0);
886 }
887 
888 /*
889  * Find a node by absolute name. The name should NOT end with ':'
890  * The name "." means "this node" and "[xxx]" means "the node
891  * with ID (ie, at address) xxx".
892  *
893  * Returns the node if found, else NULL.
894  * Eventually should add something faster than a sequential search.
895  * Note it acquires a reference on the node so you can be sure it's still
896  * there.
897  */
898 node_p
899 ng_name2noderef(node_p here, const char *name)
900 {
901 	node_p node;
902 	ng_ID_t temp;
903 	int	hash;
904 
905 	/* "." means "this node" */
906 	if (strcmp(name, ".") == 0) {
907 		NG_NODE_REF(here);
908 		return(here);
909 	}
910 
911 	/* Check for name-by-ID */
912 	if ((temp = ng_decodeidname(name)) != 0) {
913 		return (ng_ID2noderef(temp));
914 	}
915 
916 	/* Find node by name. */
917 	hash = hash32_str(name, HASHINIT) & V_ng_name_hmask;
918 	NAMEHASH_RLOCK();
919 	LIST_FOREACH(node, &V_ng_name_hash[hash], nd_nodes)
920 		if (NG_NODE_IS_VALID(node) &&
921 		    (strcmp(NG_NODE_NAME(node), name) == 0)) {
922 			NG_NODE_REF(node);
923 			break;
924 		}
925 	NAMEHASH_RUNLOCK();
926 
927 	return (node);
928 }
929 
930 /*
931  * Decode an ID name, eg. "[f03034de]". Returns 0 if the
932  * string is not valid, otherwise returns the value.
933  */
934 static ng_ID_t
935 ng_decodeidname(const char *name)
936 {
937 	const int len = strlen(name);
938 	char *eptr;
939 	u_long val;
940 
941 	/* Check for proper length, brackets, no leading junk */
942 	if ((len < 3) || (name[0] != '[') || (name[len - 1] != ']') ||
943 	    (!isxdigit(name[1])))
944 		return ((ng_ID_t)0);
945 
946 	/* Decode number */
947 	val = strtoul(name + 1, &eptr, 16);
948 	if ((eptr - name != len - 1) || (val == ULONG_MAX) || (val == 0))
949 		return ((ng_ID_t)0);
950 
951 	return ((ng_ID_t)val);
952 }
953 
954 /*
955  * Remove a name from a node. This should only be called
956  * when shutting down and removing the node.
957  */
958 void
959 ng_unname(node_p node)
960 {
961 }
962 
963 /*
964  * Allocate a bigger name hash.
965  */
966 static void
967 ng_name_rehash()
968 {
969 	struct nodehash *new;
970 	uint32_t hash;
971 	u_long hmask;
972 	node_p node, node2;
973 	int i;
974 
975 	new = hashinit_flags((V_ng_name_hmask + 1) * 2, M_NETGRAPH_NODE, &hmask,
976 	    HASH_NOWAIT);
977 	if (new == NULL)
978 		return;
979 
980 	for (i = 0; i <= V_ng_name_hmask; i++)
981 		LIST_FOREACH_SAFE(node, &V_ng_name_hash[i], nd_nodes, node2) {
982 #ifdef INVARIANTS
983 			LIST_REMOVE(node, nd_nodes);
984 #endif
985 			hash = hash32_str(NG_NODE_NAME(node), HASHINIT) & hmask;
986 			LIST_INSERT_HEAD(&new[hash], node, nd_nodes);
987 		}
988 
989 	hashdestroy(V_ng_name_hash, M_NETGRAPH_NODE, V_ng_name_hmask);
990 	V_ng_name_hash = new;
991 	V_ng_name_hmask = hmask;
992 }
993 
994 /*
995  * Allocate a bigger ID hash.
996  */
997 static void
998 ng_ID_rehash()
999 {
1000 	struct nodehash *new;
1001 	uint32_t hash;
1002 	u_long hmask;
1003 	node_p node, node2;
1004 	int i;
1005 
1006 	new = hashinit_flags((V_ng_ID_hmask + 1) * 2, M_NETGRAPH_NODE, &hmask,
1007 	    HASH_NOWAIT);
1008 	if (new == NULL)
1009 		return;
1010 
1011 	for (i = 0; i <= V_ng_ID_hmask; i++)
1012 		LIST_FOREACH_SAFE(node, &V_ng_ID_hash[i], nd_idnodes, node2) {
1013 #ifdef INVARIANTS
1014 			LIST_REMOVE(node, nd_idnodes);
1015 #endif
1016 			hash = (node->nd_ID % (hmask + 1));
1017 			LIST_INSERT_HEAD(&new[hash], node, nd_idnodes);
1018 		}
1019 
1020 	hashdestroy(V_ng_ID_hash, M_NETGRAPH_NODE, V_ng_name_hmask);
1021 	V_ng_ID_hash = new;
1022 	V_ng_ID_hmask = hmask;
1023 }
1024 
1025 /************************************************************************
1026 			Hook routines
1027  Names are not optional. Hooks are always connected, except for a
1028  brief moment within these routines. On invalidation or during creation
1029  they are connected to the 'dead' hook.
1030 ************************************************************************/
1031 
1032 /*
1033  * Remove a hook reference
1034  */
1035 void
1036 ng_unref_hook(hook_p hook)
1037 {
1038 
1039 	if (hook == &ng_deadhook)
1040 		return;
1041 
1042 	if (refcount_release(&hook->hk_refs)) { /* we were the last */
1043 		if (_NG_HOOK_NODE(hook)) /* it'll probably be ng_deadnode */
1044 			_NG_NODE_UNREF((_NG_HOOK_NODE(hook)));
1045 		NG_FREE_HOOK(hook);
1046 	}
1047 }
1048 
1049 /*
1050  * Add an unconnected hook to a node. Only used internally.
1051  * Assumes node is locked. (XXX not yet true )
1052  */
1053 static int
1054 ng_add_hook(node_p node, const char *name, hook_p *hookp)
1055 {
1056 	hook_p hook;
1057 	int error = 0;
1058 
1059 	/* Check that the given name is good */
1060 	if (name == NULL) {
1061 		TRAP_ERROR();
1062 		return (EINVAL);
1063 	}
1064 	if (ng_findhook(node, name) != NULL) {
1065 		TRAP_ERROR();
1066 		return (EEXIST);
1067 	}
1068 
1069 	/* Allocate the hook and link it up */
1070 	NG_ALLOC_HOOK(hook);
1071 	if (hook == NULL) {
1072 		TRAP_ERROR();
1073 		return (ENOMEM);
1074 	}
1075 	hook->hk_refs = 1;		/* add a reference for us to return */
1076 	hook->hk_flags = HK_INVALID;
1077 	hook->hk_peer = &ng_deadhook;	/* start off this way */
1078 	hook->hk_node = node;
1079 	NG_NODE_REF(node);		/* each hook counts as a reference */
1080 
1081 	/* Set hook name */
1082 	strlcpy(NG_HOOK_NAME(hook), name, NG_HOOKSIZ);
1083 
1084 	/*
1085 	 * Check if the node type code has something to say about it
1086 	 * If it fails, the unref of the hook will also unref the node.
1087 	 */
1088 	if (node->nd_type->newhook != NULL) {
1089 		if ((error = (*node->nd_type->newhook)(node, hook, name))) {
1090 			NG_HOOK_UNREF(hook);	/* this frees the hook */
1091 			return (error);
1092 		}
1093 	}
1094 	/*
1095 	 * The 'type' agrees so far, so go ahead and link it in.
1096 	 * We'll ask again later when we actually connect the hooks.
1097 	 */
1098 	LIST_INSERT_HEAD(&node->nd_hooks, hook, hk_hooks);
1099 	node->nd_numhooks++;
1100 	NG_HOOK_REF(hook);	/* one for the node */
1101 
1102 	if (hookp)
1103 		*hookp = hook;
1104 	return (0);
1105 }
1106 
1107 /*
1108  * Find a hook
1109  *
1110  * Node types may supply their own optimized routines for finding
1111  * hooks.  If none is supplied, we just do a linear search.
1112  * XXX Possibly we should add a reference to the hook?
1113  */
1114 hook_p
1115 ng_findhook(node_p node, const char *name)
1116 {
1117 	hook_p hook;
1118 
1119 	if (node->nd_type->findhook != NULL)
1120 		return (*node->nd_type->findhook)(node, name);
1121 	LIST_FOREACH(hook, &node->nd_hooks, hk_hooks) {
1122 		if (NG_HOOK_IS_VALID(hook) &&
1123 		    (strcmp(NG_HOOK_NAME(hook), name) == 0))
1124 			return (hook);
1125 	}
1126 	return (NULL);
1127 }
1128 
1129 /*
1130  * Destroy a hook
1131  *
1132  * As hooks are always attached, this really destroys two hooks.
1133  * The one given, and the one attached to it. Disconnect the hooks
1134  * from each other first. We reconnect the peer hook to the 'dead'
1135  * hook so that it can still exist after we depart. We then
1136  * send the peer its own destroy message. This ensures that we only
1137  * interact with the peer's structures when it is locked processing that
1138  * message. We hold a reference to the peer hook so we are guaranteed that
1139  * the peer hook and node are still going to exist until
1140  * we are finished there as the hook holds a ref on the node.
1141  * We run this same code again on the peer hook, but that time it is already
1142  * attached to the 'dead' hook.
1143  *
1144  * This routine is called at all stages of hook creation
1145  * on error detection and must be able to handle any such stage.
1146  */
1147 void
1148 ng_destroy_hook(hook_p hook)
1149 {
1150 	hook_p peer;
1151 	node_p node;
1152 
1153 	if (hook == &ng_deadhook) {	/* better safe than sorry */
1154 		printf("ng_destroy_hook called on deadhook\n");
1155 		return;
1156 	}
1157 
1158 	/*
1159 	 * Protect divorce process with mutex, to avoid races on
1160 	 * simultaneous disconnect.
1161 	 */
1162 	mtx_lock(&ng_topo_mtx);
1163 
1164 	hook->hk_flags |= HK_INVALID;
1165 
1166 	peer = NG_HOOK_PEER(hook);
1167 	node = NG_HOOK_NODE(hook);
1168 
1169 	if (peer && (peer != &ng_deadhook)) {
1170 		/*
1171 		 * Set the peer to point to ng_deadhook
1172 		 * from this moment on we are effectively independent it.
1173 		 * send it an rmhook message of it's own.
1174 		 */
1175 		peer->hk_peer = &ng_deadhook;	/* They no longer know us */
1176 		hook->hk_peer = &ng_deadhook;	/* Nor us, them */
1177 		if (NG_HOOK_NODE(peer) == &ng_deadnode) {
1178 			/*
1179 			 * If it's already divorced from a node,
1180 			 * just free it.
1181 			 */
1182 			mtx_unlock(&ng_topo_mtx);
1183 		} else {
1184 			mtx_unlock(&ng_topo_mtx);
1185 			ng_rmhook_self(peer); 	/* Send it a surprise */
1186 		}
1187 		NG_HOOK_UNREF(peer);		/* account for peer link */
1188 		NG_HOOK_UNREF(hook);		/* account for peer link */
1189 	} else
1190 		mtx_unlock(&ng_topo_mtx);
1191 
1192 	mtx_assert(&ng_topo_mtx, MA_NOTOWNED);
1193 
1194 	/*
1195 	 * Remove the hook from the node's list to avoid possible recursion
1196 	 * in case the disconnection results in node shutdown.
1197 	 */
1198 	if (node == &ng_deadnode) { /* happens if called from ng_con_nodes() */
1199 		return;
1200 	}
1201 	LIST_REMOVE(hook, hk_hooks);
1202 	node->nd_numhooks--;
1203 	if (node->nd_type->disconnect) {
1204 		/*
1205 		 * The type handler may elect to destroy the node so don't
1206 		 * trust its existence after this point. (except
1207 		 * that we still hold a reference on it. (which we
1208 		 * inherrited from the hook we are destroying)
1209 		 */
1210 		(*node->nd_type->disconnect) (hook);
1211 	}
1212 
1213 	/*
1214 	 * Note that because we will point to ng_deadnode, the original node
1215 	 * is not decremented automatically so we do that manually.
1216 	 */
1217 	_NG_HOOK_NODE(hook) = &ng_deadnode;
1218 	NG_NODE_UNREF(node);	/* We no longer point to it so adjust count */
1219 	NG_HOOK_UNREF(hook);	/* Account for linkage (in list) to node */
1220 }
1221 
1222 /*
1223  * Take two hooks on a node and merge the connection so that the given node
1224  * is effectively bypassed.
1225  */
1226 int
1227 ng_bypass(hook_p hook1, hook_p hook2)
1228 {
1229 	if (hook1->hk_node != hook2->hk_node) {
1230 		TRAP_ERROR();
1231 		return (EINVAL);
1232 	}
1233 	mtx_lock(&ng_topo_mtx);
1234 	if (NG_HOOK_NOT_VALID(hook1) || NG_HOOK_NOT_VALID(hook2)) {
1235 		mtx_unlock(&ng_topo_mtx);
1236 		return (EINVAL);
1237 	}
1238 	hook1->hk_peer->hk_peer = hook2->hk_peer;
1239 	hook2->hk_peer->hk_peer = hook1->hk_peer;
1240 
1241 	hook1->hk_peer = &ng_deadhook;
1242 	hook2->hk_peer = &ng_deadhook;
1243 	mtx_unlock(&ng_topo_mtx);
1244 
1245 	NG_HOOK_UNREF(hook1);
1246 	NG_HOOK_UNREF(hook2);
1247 
1248 	/* XXX If we ever cache methods on hooks update them as well */
1249 	ng_destroy_hook(hook1);
1250 	ng_destroy_hook(hook2);
1251 	return (0);
1252 }
1253 
1254 /*
1255  * Install a new netgraph type
1256  */
1257 int
1258 ng_newtype(struct ng_type *tp)
1259 {
1260 	const size_t namelen = strlen(tp->name);
1261 
1262 	/* Check version and type name fields */
1263 	if ((tp->version != NG_ABI_VERSION) || (namelen == 0) ||
1264 	    (namelen >= NG_TYPESIZ)) {
1265 		TRAP_ERROR();
1266 		if (tp->version != NG_ABI_VERSION) {
1267 			printf("Netgraph: Node type rejected. ABI mismatch. "
1268 			    "Suggest recompile\n");
1269 		}
1270 		return (EINVAL);
1271 	}
1272 
1273 	/* Check for name collision */
1274 	if (ng_findtype(tp->name) != NULL) {
1275 		TRAP_ERROR();
1276 		return (EEXIST);
1277 	}
1278 
1279 	/* Link in new type */
1280 	TYPELIST_WLOCK();
1281 	LIST_INSERT_HEAD(&ng_typelist, tp, types);
1282 	tp->refs = 1;	/* first ref is linked list */
1283 	TYPELIST_WUNLOCK();
1284 	return (0);
1285 }
1286 
1287 /*
1288  * unlink a netgraph type
1289  * If no examples exist
1290  */
1291 int
1292 ng_rmtype(struct ng_type *tp)
1293 {
1294 	/* Check for name collision */
1295 	if (tp->refs != 1) {
1296 		TRAP_ERROR();
1297 		return (EBUSY);
1298 	}
1299 
1300 	/* Unlink type */
1301 	TYPELIST_WLOCK();
1302 	LIST_REMOVE(tp, types);
1303 	TYPELIST_WUNLOCK();
1304 	return (0);
1305 }
1306 
1307 /*
1308  * Look for a type of the name given
1309  */
1310 struct ng_type *
1311 ng_findtype(const char *typename)
1312 {
1313 	struct ng_type *type;
1314 
1315 	TYPELIST_RLOCK();
1316 	LIST_FOREACH(type, &ng_typelist, types) {
1317 		if (strcmp(type->name, typename) == 0)
1318 			break;
1319 	}
1320 	TYPELIST_RUNLOCK();
1321 	return (type);
1322 }
1323 
1324 /************************************************************************
1325 			Composite routines
1326 ************************************************************************/
1327 /*
1328  * Connect two nodes using the specified hooks, using queued functions.
1329  */
1330 static int
1331 ng_con_part3(node_p node, item_p item, hook_p hook)
1332 {
1333 	int	error = 0;
1334 
1335 	/*
1336 	 * When we run, we know that the node 'node' is locked for us.
1337 	 * Our caller has a reference on the hook.
1338 	 * Our caller has a reference on the node.
1339 	 * (In this case our caller is ng_apply_item() ).
1340 	 * The peer hook has a reference on the hook.
1341 	 * We are all set up except for the final call to the node, and
1342 	 * the clearing of the INVALID flag.
1343 	 */
1344 	if (NG_HOOK_NODE(hook) == &ng_deadnode) {
1345 		/*
1346 		 * The node must have been freed again since we last visited
1347 		 * here. ng_destry_hook() has this effect but nothing else does.
1348 		 * We should just release our references and
1349 		 * free anything we can think of.
1350 		 * Since we know it's been destroyed, and it's our caller
1351 		 * that holds the references, just return.
1352 		 */
1353 		ERROUT(ENOENT);
1354 	}
1355 	if (hook->hk_node->nd_type->connect) {
1356 		if ((error = (*hook->hk_node->nd_type->connect) (hook))) {
1357 			ng_destroy_hook(hook);	/* also zaps peer */
1358 			printf("failed in ng_con_part3()\n");
1359 			ERROUT(error);
1360 		}
1361 	}
1362 	/*
1363 	 *  XXX this is wrong for SMP. Possibly we need
1364 	 * to separate out 'create' and 'invalid' flags.
1365 	 * should only set flags on hooks we have locked under our node.
1366 	 */
1367 	hook->hk_flags &= ~HK_INVALID;
1368 done:
1369 	NG_FREE_ITEM(item);
1370 	return (error);
1371 }
1372 
1373 static int
1374 ng_con_part2(node_p node, item_p item, hook_p hook)
1375 {
1376 	hook_p	peer;
1377 	int	error = 0;
1378 
1379 	/*
1380 	 * When we run, we know that the node 'node' is locked for us.
1381 	 * Our caller has a reference on the hook.
1382 	 * Our caller has a reference on the node.
1383 	 * (In this case our caller is ng_apply_item() ).
1384 	 * The peer hook has a reference on the hook.
1385 	 * our node pointer points to the 'dead' node.
1386 	 * First check the hook name is unique.
1387 	 * Should not happen because we checked before queueing this.
1388 	 */
1389 	if (ng_findhook(node, NG_HOOK_NAME(hook)) != NULL) {
1390 		TRAP_ERROR();
1391 		ng_destroy_hook(hook); /* should destroy peer too */
1392 		printf("failed in ng_con_part2()\n");
1393 		ERROUT(EEXIST);
1394 	}
1395 	/*
1396 	 * Check if the node type code has something to say about it
1397 	 * If it fails, the unref of the hook will also unref the attached node,
1398 	 * however since that node is 'ng_deadnode' this will do nothing.
1399 	 * The peer hook will also be destroyed.
1400 	 */
1401 	if (node->nd_type->newhook != NULL) {
1402 		if ((error = (*node->nd_type->newhook)(node, hook,
1403 		    hook->hk_name))) {
1404 			ng_destroy_hook(hook); /* should destroy peer too */
1405 			printf("failed in ng_con_part2()\n");
1406 			ERROUT(error);
1407 		}
1408 	}
1409 
1410 	/*
1411 	 * The 'type' agrees so far, so go ahead and link it in.
1412 	 * We'll ask again later when we actually connect the hooks.
1413 	 */
1414 	hook->hk_node = node;		/* just overwrite ng_deadnode */
1415 	NG_NODE_REF(node);		/* each hook counts as a reference */
1416 	LIST_INSERT_HEAD(&node->nd_hooks, hook, hk_hooks);
1417 	node->nd_numhooks++;
1418 	NG_HOOK_REF(hook);	/* one for the node */
1419 
1420 	/*
1421 	 * We now have a symmetrical situation, where both hooks have been
1422 	 * linked to their nodes, the newhook methods have been called
1423 	 * And the references are all correct. The hooks are still marked
1424 	 * as invalid, as we have not called the 'connect' methods
1425 	 * yet.
1426 	 * We can call the local one immediately as we have the
1427 	 * node locked, but we need to queue the remote one.
1428 	 */
1429 	if (hook->hk_node->nd_type->connect) {
1430 		if ((error = (*hook->hk_node->nd_type->connect) (hook))) {
1431 			ng_destroy_hook(hook);	/* also zaps peer */
1432 			printf("failed in ng_con_part2(A)\n");
1433 			ERROUT(error);
1434 		}
1435 	}
1436 
1437 	/*
1438 	 * Acquire topo mutex to avoid race with ng_destroy_hook().
1439 	 */
1440 	mtx_lock(&ng_topo_mtx);
1441 	peer = hook->hk_peer;
1442 	if (peer == &ng_deadhook) {
1443 		mtx_unlock(&ng_topo_mtx);
1444 		printf("failed in ng_con_part2(B)\n");
1445 		ng_destroy_hook(hook);
1446 		ERROUT(ENOENT);
1447 	}
1448 	mtx_unlock(&ng_topo_mtx);
1449 
1450 	if ((error = ng_send_fn2(peer->hk_node, peer, item, &ng_con_part3,
1451 	    NULL, 0, NG_REUSE_ITEM))) {
1452 		printf("failed in ng_con_part2(C)\n");
1453 		ng_destroy_hook(hook);	/* also zaps peer */
1454 		return (error);		/* item was consumed. */
1455 	}
1456 	hook->hk_flags &= ~HK_INVALID; /* need both to be able to work */
1457 	return (0);			/* item was consumed. */
1458 done:
1459 	NG_FREE_ITEM(item);
1460 	return (error);
1461 }
1462 
1463 /*
1464  * Connect this node with another node. We assume that this node is
1465  * currently locked, as we are only called from an NGM_CONNECT message.
1466  */
1467 static int
1468 ng_con_nodes(item_p item, node_p node, const char *name,
1469     node_p node2, const char *name2)
1470 {
1471 	int	error;
1472 	hook_p	hook;
1473 	hook_p	hook2;
1474 
1475 	if (ng_findhook(node2, name2) != NULL) {
1476 		return(EEXIST);
1477 	}
1478 	if ((error = ng_add_hook(node, name, &hook)))  /* gives us a ref */
1479 		return (error);
1480 	/* Allocate the other hook and link it up */
1481 	NG_ALLOC_HOOK(hook2);
1482 	if (hook2 == NULL) {
1483 		TRAP_ERROR();
1484 		ng_destroy_hook(hook);	/* XXX check ref counts so far */
1485 		NG_HOOK_UNREF(hook);	/* including our ref */
1486 		return (ENOMEM);
1487 	}
1488 	hook2->hk_refs = 1;		/* start with a reference for us. */
1489 	hook2->hk_flags = HK_INVALID;
1490 	hook2->hk_peer = hook;		/* Link the two together */
1491 	hook->hk_peer = hook2;
1492 	NG_HOOK_REF(hook);		/* Add a ref for the peer to each*/
1493 	NG_HOOK_REF(hook2);
1494 	hook2->hk_node = &ng_deadnode;
1495 	strlcpy(NG_HOOK_NAME(hook2), name2, NG_HOOKSIZ);
1496 
1497 	/*
1498 	 * Queue the function above.
1499 	 * Procesing continues in that function in the lock context of
1500 	 * the other node.
1501 	 */
1502 	if ((error = ng_send_fn2(node2, hook2, item, &ng_con_part2, NULL, 0,
1503 	    NG_NOFLAGS))) {
1504 		printf("failed in ng_con_nodes(): %d\n", error);
1505 		ng_destroy_hook(hook);	/* also zaps peer */
1506 	}
1507 
1508 	NG_HOOK_UNREF(hook);		/* Let each hook go if it wants to */
1509 	NG_HOOK_UNREF(hook2);
1510 	return (error);
1511 }
1512 
1513 /*
1514  * Make a peer and connect.
1515  * We assume that the local node is locked.
1516  * The new node probably doesn't need a lock until
1517  * it has a hook, because it cannot really have any work until then,
1518  * but we should think about it a bit more.
1519  *
1520  * The problem may come if the other node also fires up
1521  * some hardware or a timer or some other source of activation,
1522  * also it may already get a command msg via it's ID.
1523  *
1524  * We could use the same method as ng_con_nodes() but we'd have
1525  * to add ability to remove the node when failing. (Not hard, just
1526  * make arg1 point to the node to remove).
1527  * Unless of course we just ignore failure to connect and leave
1528  * an unconnected node?
1529  */
1530 static int
1531 ng_mkpeer(node_p node, const char *name, const char *name2, char *type)
1532 {
1533 	node_p	node2;
1534 	hook_p	hook1, hook2;
1535 	int	error;
1536 
1537 	if ((error = ng_make_node(type, &node2))) {
1538 		return (error);
1539 	}
1540 
1541 	if ((error = ng_add_hook(node, name, &hook1))) { /* gives us a ref */
1542 		ng_rmnode(node2, NULL, NULL, 0);
1543 		return (error);
1544 	}
1545 
1546 	if ((error = ng_add_hook(node2, name2, &hook2))) {
1547 		ng_rmnode(node2, NULL, NULL, 0);
1548 		ng_destroy_hook(hook1);
1549 		NG_HOOK_UNREF(hook1);
1550 		return (error);
1551 	}
1552 
1553 	/*
1554 	 * Actually link the two hooks together.
1555 	 */
1556 	hook1->hk_peer = hook2;
1557 	hook2->hk_peer = hook1;
1558 
1559 	/* Each hook is referenced by the other */
1560 	NG_HOOK_REF(hook1);
1561 	NG_HOOK_REF(hook2);
1562 
1563 	/* Give each node the opportunity to veto the pending connection */
1564 	if (hook1->hk_node->nd_type->connect) {
1565 		error = (*hook1->hk_node->nd_type->connect) (hook1);
1566 	}
1567 
1568 	if ((error == 0) && hook2->hk_node->nd_type->connect) {
1569 		error = (*hook2->hk_node->nd_type->connect) (hook2);
1570 
1571 	}
1572 
1573 	/*
1574 	 * drop the references we were holding on the two hooks.
1575 	 */
1576 	if (error) {
1577 		ng_destroy_hook(hook2);	/* also zaps hook1 */
1578 		ng_rmnode(node2, NULL, NULL, 0);
1579 	} else {
1580 		/* As a last act, allow the hooks to be used */
1581 		hook1->hk_flags &= ~HK_INVALID;
1582 		hook2->hk_flags &= ~HK_INVALID;
1583 	}
1584 	NG_HOOK_UNREF(hook1);
1585 	NG_HOOK_UNREF(hook2);
1586 	return (error);
1587 }
1588 
1589 /************************************************************************
1590 		Utility routines to send self messages
1591 ************************************************************************/
1592 
1593 /* Shut this node down as soon as everyone is clear of it */
1594 /* Should add arg "immediately" to jump the queue */
1595 int
1596 ng_rmnode_self(node_p node)
1597 {
1598 	int		error;
1599 
1600 	if (node == &ng_deadnode)
1601 		return (0);
1602 	node->nd_flags |= NGF_INVALID;
1603 	if (node->nd_flags & NGF_CLOSING)
1604 		return (0);
1605 
1606 	error = ng_send_fn(node, NULL, &ng_rmnode, NULL, 0);
1607 	return (error);
1608 }
1609 
1610 static void
1611 ng_rmhook_part2(node_p node, hook_p hook, void *arg1, int arg2)
1612 {
1613 	ng_destroy_hook(hook);
1614 	return ;
1615 }
1616 
1617 int
1618 ng_rmhook_self(hook_p hook)
1619 {
1620 	int		error;
1621 	node_p node = NG_HOOK_NODE(hook);
1622 
1623 	if (node == &ng_deadnode)
1624 		return (0);
1625 
1626 	error = ng_send_fn(node, hook, &ng_rmhook_part2, NULL, 0);
1627 	return (error);
1628 }
1629 
1630 /***********************************************************************
1631  * Parse and verify a string of the form:  <NODE:><PATH>
1632  *
1633  * Such a string can refer to a specific node or a specific hook
1634  * on a specific node, depending on how you look at it. In the
1635  * latter case, the PATH component must not end in a dot.
1636  *
1637  * Both <NODE:> and <PATH> are optional. The <PATH> is a string
1638  * of hook names separated by dots. This breaks out the original
1639  * string, setting *nodep to "NODE" (or NULL if none) and *pathp
1640  * to "PATH" (or NULL if degenerate). Also, *hookp will point to
1641  * the final hook component of <PATH>, if any, otherwise NULL.
1642  *
1643  * This returns -1 if the path is malformed. The char ** are optional.
1644  ***********************************************************************/
1645 int
1646 ng_path_parse(char *addr, char **nodep, char **pathp, char **hookp)
1647 {
1648 	char	*node, *path, *hook;
1649 	int	k;
1650 
1651 	/*
1652 	 * Extract absolute NODE, if any
1653 	 */
1654 	for (path = addr; *path && *path != ':'; path++);
1655 	if (*path) {
1656 		node = addr;	/* Here's the NODE */
1657 		*path++ = '\0';	/* Here's the PATH */
1658 
1659 		/* Node name must not be empty */
1660 		if (!*node)
1661 			return -1;
1662 
1663 		/* A name of "." is OK; otherwise '.' not allowed */
1664 		if (strcmp(node, ".") != 0) {
1665 			for (k = 0; node[k]; k++)
1666 				if (node[k] == '.')
1667 					return -1;
1668 		}
1669 	} else {
1670 		node = NULL;	/* No absolute NODE */
1671 		path = addr;	/* Here's the PATH */
1672 	}
1673 
1674 	/* Snoop for illegal characters in PATH */
1675 	for (k = 0; path[k]; k++)
1676 		if (path[k] == ':')
1677 			return -1;
1678 
1679 	/* Check for no repeated dots in PATH */
1680 	for (k = 0; path[k]; k++)
1681 		if (path[k] == '.' && path[k + 1] == '.')
1682 			return -1;
1683 
1684 	/* Remove extra (degenerate) dots from beginning or end of PATH */
1685 	if (path[0] == '.')
1686 		path++;
1687 	if (*path && path[strlen(path) - 1] == '.')
1688 		path[strlen(path) - 1] = 0;
1689 
1690 	/* If PATH has a dot, then we're not talking about a hook */
1691 	if (*path) {
1692 		for (hook = path, k = 0; path[k]; k++)
1693 			if (path[k] == '.') {
1694 				hook = NULL;
1695 				break;
1696 			}
1697 	} else
1698 		path = hook = NULL;
1699 
1700 	/* Done */
1701 	if (nodep)
1702 		*nodep = node;
1703 	if (pathp)
1704 		*pathp = path;
1705 	if (hookp)
1706 		*hookp = hook;
1707 	return (0);
1708 }
1709 
1710 /*
1711  * Given a path, which may be absolute or relative, and a starting node,
1712  * return the destination node.
1713  */
1714 int
1715 ng_path2noderef(node_p here, const char *address, node_p *destp,
1716     hook_p *lasthook)
1717 {
1718 	char    fullpath[NG_PATHSIZ];
1719 	char   *nodename, *path;
1720 	node_p  node, oldnode;
1721 
1722 	/* Initialize */
1723 	if (destp == NULL) {
1724 		TRAP_ERROR();
1725 		return EINVAL;
1726 	}
1727 	*destp = NULL;
1728 
1729 	/* Make a writable copy of address for ng_path_parse() */
1730 	strncpy(fullpath, address, sizeof(fullpath) - 1);
1731 	fullpath[sizeof(fullpath) - 1] = '\0';
1732 
1733 	/* Parse out node and sequence of hooks */
1734 	if (ng_path_parse(fullpath, &nodename, &path, NULL) < 0) {
1735 		TRAP_ERROR();
1736 		return EINVAL;
1737 	}
1738 
1739 	/*
1740 	 * For an absolute address, jump to the starting node.
1741 	 * Note that this holds a reference on the node for us.
1742 	 * Don't forget to drop the reference if we don't need it.
1743 	 */
1744 	if (nodename) {
1745 		node = ng_name2noderef(here, nodename);
1746 		if (node == NULL) {
1747 			TRAP_ERROR();
1748 			return (ENOENT);
1749 		}
1750 	} else {
1751 		if (here == NULL) {
1752 			TRAP_ERROR();
1753 			return (EINVAL);
1754 		}
1755 		node = here;
1756 		NG_NODE_REF(node);
1757 	}
1758 
1759 	if (path == NULL) {
1760 		if (lasthook != NULL)
1761 			*lasthook = NULL;
1762 		*destp = node;
1763 		return (0);
1764 	}
1765 
1766 	/*
1767 	 * Now follow the sequence of hooks
1768 	 *
1769 	 * XXXGL: The path may demolish as we go the sequence, but if
1770 	 * we hold the topology mutex at critical places, then, I hope,
1771 	 * we would always have valid pointers in hand, although the
1772 	 * path behind us may no longer exist.
1773 	 */
1774 	for (;;) {
1775 		hook_p hook;
1776 		char *segment;
1777 
1778 		/*
1779 		 * Break out the next path segment. Replace the dot we just
1780 		 * found with a NUL; "path" points to the next segment (or the
1781 		 * NUL at the end).
1782 		 */
1783 		for (segment = path; *path != '\0'; path++) {
1784 			if (*path == '.') {
1785 				*path++ = '\0';
1786 				break;
1787 			}
1788 		}
1789 
1790 		/* We have a segment, so look for a hook by that name */
1791 		hook = ng_findhook(node, segment);
1792 
1793 		mtx_lock(&ng_topo_mtx);
1794 		/* Can't get there from here... */
1795 		if (hook == NULL || NG_HOOK_PEER(hook) == NULL ||
1796 		    NG_HOOK_NOT_VALID(hook) ||
1797 		    NG_HOOK_NOT_VALID(NG_HOOK_PEER(hook))) {
1798 			TRAP_ERROR();
1799 			NG_NODE_UNREF(node);
1800 			mtx_unlock(&ng_topo_mtx);
1801 			return (ENOENT);
1802 		}
1803 
1804 		/*
1805 		 * Hop on over to the next node
1806 		 * XXX
1807 		 * Big race conditions here as hooks and nodes go away
1808 		 * *** Idea.. store an ng_ID_t in each hook and use that
1809 		 * instead of the direct hook in this crawl?
1810 		 */
1811 		oldnode = node;
1812 		if ((node = NG_PEER_NODE(hook)))
1813 			NG_NODE_REF(node);	/* XXX RACE */
1814 		NG_NODE_UNREF(oldnode);	/* XXX another race */
1815 		if (NG_NODE_NOT_VALID(node)) {
1816 			NG_NODE_UNREF(node);	/* XXX more races */
1817 			mtx_unlock(&ng_topo_mtx);
1818 			TRAP_ERROR();
1819 			return (ENXIO);
1820 		}
1821 
1822 		if (*path == '\0') {
1823 			if (lasthook != NULL) {
1824 				if (hook != NULL) {
1825 					*lasthook = NG_HOOK_PEER(hook);
1826 					NG_HOOK_REF(*lasthook);
1827 				} else
1828 					*lasthook = NULL;
1829 			}
1830 			mtx_unlock(&ng_topo_mtx);
1831 			*destp = node;
1832 			return (0);
1833 		}
1834 		mtx_unlock(&ng_topo_mtx);
1835 	}
1836 }
1837 
1838 /***************************************************************\
1839 * Input queue handling.
1840 * All activities are submitted to the node via the input queue
1841 * which implements a multiple-reader/single-writer gate.
1842 * Items which cannot be handled immediately are queued.
1843 *
1844 * read-write queue locking inline functions			*
1845 \***************************************************************/
1846 
1847 static __inline void	ng_queue_rw(node_p node, item_p  item, int rw);
1848 static __inline item_p	ng_dequeue(node_p node, int *rw);
1849 static __inline item_p	ng_acquire_read(node_p node, item_p  item);
1850 static __inline item_p	ng_acquire_write(node_p node, item_p  item);
1851 static __inline void	ng_leave_read(node_p node);
1852 static __inline void	ng_leave_write(node_p node);
1853 
1854 /*
1855  * Definition of the bits fields in the ng_queue flag word.
1856  * Defined here rather than in netgraph.h because no-one should fiddle
1857  * with them.
1858  *
1859  * The ordering here may be important! don't shuffle these.
1860  */
1861 /*-
1862  Safety Barrier--------+ (adjustable to suit taste) (not used yet)
1863                        |
1864                        V
1865 +-------+-------+-------+-------+-------+-------+-------+-------+
1866   | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |
1867   | |A|c|t|i|v|e| |R|e|a|d|e|r| |C|o|u|n|t| | | | | | | | | |P|A|
1868   | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |O|W|
1869 +-------+-------+-------+-------+-------+-------+-------+-------+
1870   \___________________________ ____________________________/ | |
1871                             V                                | |
1872                   [active reader count]                      | |
1873                                                              | |
1874             Operation Pending -------------------------------+ |
1875                                                                |
1876           Active Writer ---------------------------------------+
1877 
1878 Node queue has such semantics:
1879 - All flags modifications are atomic.
1880 - Reader count can be incremented only if there is no writer or pending flags.
1881   As soon as this can't be done with single operation, it is implemented with
1882   spin loop and atomic_cmpset().
1883 - Writer flag can be set only if there is no any bits set.
1884   It is implemented with atomic_cmpset().
1885 - Pending flag can be set any time, but to avoid collision on queue processing
1886   all queue fields are protected by the mutex.
1887 - Queue processing thread reads queue holding the mutex, but releases it while
1888   processing. When queue is empty pending flag is removed.
1889 */
1890 
1891 #define WRITER_ACTIVE	0x00000001
1892 #define OP_PENDING	0x00000002
1893 #define READER_INCREMENT 0x00000004
1894 #define READER_MASK	0xfffffffc	/* Not valid if WRITER_ACTIVE is set */
1895 #define SAFETY_BARRIER	0x00100000	/* 128K items queued should be enough */
1896 
1897 /* Defines of more elaborate states on the queue */
1898 /* Mask of bits a new read cares about */
1899 #define NGQ_RMASK	(WRITER_ACTIVE|OP_PENDING)
1900 
1901 /* Mask of bits a new write cares about */
1902 #define NGQ_WMASK	(NGQ_RMASK|READER_MASK)
1903 
1904 /* Test to decide if there is something on the queue. */
1905 #define QUEUE_ACTIVE(QP) ((QP)->q_flags & OP_PENDING)
1906 
1907 /* How to decide what the next queued item is. */
1908 #define HEAD_IS_READER(QP)  NGI_QUEUED_READER(STAILQ_FIRST(&(QP)->queue))
1909 #define HEAD_IS_WRITER(QP)  NGI_QUEUED_WRITER(STAILQ_FIRST(&(QP)->queue)) /* notused */
1910 
1911 /* Read the status to decide if the next item on the queue can now run. */
1912 #define QUEUED_READER_CAN_PROCEED(QP)			\
1913 		(((QP)->q_flags & (NGQ_RMASK & ~OP_PENDING)) == 0)
1914 #define QUEUED_WRITER_CAN_PROCEED(QP)			\
1915 		(((QP)->q_flags & (NGQ_WMASK & ~OP_PENDING)) == 0)
1916 
1917 /* Is there a chance of getting ANY work off the queue? */
1918 #define NEXT_QUEUED_ITEM_CAN_PROCEED(QP)				\
1919 	((HEAD_IS_READER(QP)) ? QUEUED_READER_CAN_PROCEED(QP) :		\
1920 				QUEUED_WRITER_CAN_PROCEED(QP))
1921 
1922 #define NGQRW_R 0
1923 #define NGQRW_W 1
1924 
1925 #define NGQ2_WORKQ	0x00000001
1926 
1927 /*
1928  * Taking into account the current state of the queue and node, possibly take
1929  * the next entry off the queue and return it. Return NULL if there was
1930  * nothing we could return, either because there really was nothing there, or
1931  * because the node was in a state where it cannot yet process the next item
1932  * on the queue.
1933  */
1934 static __inline item_p
1935 ng_dequeue(node_p node, int *rw)
1936 {
1937 	item_p item;
1938 	struct ng_queue *ngq = &node->nd_input_queue;
1939 
1940 	/* This MUST be called with the mutex held. */
1941 	mtx_assert(&ngq->q_mtx, MA_OWNED);
1942 
1943 	/* If there is nothing queued, then just return. */
1944 	if (!QUEUE_ACTIVE(ngq)) {
1945 		CTR4(KTR_NET, "%20s: node [%x] (%p) queue empty; "
1946 		    "queue flags 0x%lx", __func__,
1947 		    node->nd_ID, node, ngq->q_flags);
1948 		return (NULL);
1949 	}
1950 
1951 	/*
1952 	 * From here, we can assume there is a head item.
1953 	 * We need to find out what it is and if it can be dequeued, given
1954 	 * the current state of the node.
1955 	 */
1956 	if (HEAD_IS_READER(ngq)) {
1957 		while (1) {
1958 			long t = ngq->q_flags;
1959 			if (t & WRITER_ACTIVE) {
1960 				/* There is writer, reader can't proceed. */
1961 				CTR4(KTR_NET, "%20s: node [%x] (%p) queued "
1962 				    "reader can't proceed; queue flags 0x%lx",
1963 				    __func__, node->nd_ID, node, t);
1964 				return (NULL);
1965 			}
1966 			if (atomic_cmpset_acq_int(&ngq->q_flags, t,
1967 			    t + READER_INCREMENT))
1968 				break;
1969 			cpu_spinwait();
1970 		}
1971 		/* We have got reader lock for the node. */
1972 		*rw = NGQRW_R;
1973 	} else if (atomic_cmpset_acq_int(&ngq->q_flags, OP_PENDING,
1974 	    OP_PENDING + WRITER_ACTIVE)) {
1975 		/* We have got writer lock for the node. */
1976 		*rw = NGQRW_W;
1977 	} else {
1978 		/* There is somebody other, writer can't proceed. */
1979 		CTR4(KTR_NET, "%20s: node [%x] (%p) queued writer can't "
1980 		    "proceed; queue flags 0x%lx", __func__, node->nd_ID, node,
1981 		    ngq->q_flags);
1982 		return (NULL);
1983 	}
1984 
1985 	/*
1986 	 * Now we dequeue the request (whatever it may be) and correct the
1987 	 * pending flags and the next and last pointers.
1988 	 */
1989 	item = STAILQ_FIRST(&ngq->queue);
1990 	STAILQ_REMOVE_HEAD(&ngq->queue, el_next);
1991 	if (STAILQ_EMPTY(&ngq->queue))
1992 		atomic_clear_int(&ngq->q_flags, OP_PENDING);
1993 	CTR6(KTR_NET, "%20s: node [%x] (%p) returning item %p as %s; queue "
1994 	    "flags 0x%lx", __func__, node->nd_ID, node, item, *rw ? "WRITER" :
1995 	    "READER", ngq->q_flags);
1996 	return (item);
1997 }
1998 
1999 /*
2000  * Queue a packet to be picked up later by someone else.
2001  * If the queue could be run now, add node to the queue handler's worklist.
2002  */
2003 static __inline void
2004 ng_queue_rw(node_p node, item_p  item, int rw)
2005 {
2006 	struct ng_queue *ngq = &node->nd_input_queue;
2007 	if (rw == NGQRW_W)
2008 		NGI_SET_WRITER(item);
2009 	else
2010 		NGI_SET_READER(item);
2011 	item->depth = 1;
2012 
2013 	NG_QUEUE_LOCK(ngq);
2014 	/* Set OP_PENDING flag and enqueue the item. */
2015 	atomic_set_int(&ngq->q_flags, OP_PENDING);
2016 	STAILQ_INSERT_TAIL(&ngq->queue, item, el_next);
2017 
2018 	CTR5(KTR_NET, "%20s: node [%x] (%p) queued item %p as %s", __func__,
2019 	    node->nd_ID, node, item, rw ? "WRITER" : "READER" );
2020 
2021 	/*
2022 	 * We can take the worklist lock with the node locked
2023 	 * BUT NOT THE REVERSE!
2024 	 */
2025 	if (NEXT_QUEUED_ITEM_CAN_PROCEED(ngq))
2026 		ng_worklist_add(node);
2027 	NG_QUEUE_UNLOCK(ngq);
2028 }
2029 
2030 /* Acquire reader lock on node. If node is busy, queue the packet. */
2031 static __inline item_p
2032 ng_acquire_read(node_p node, item_p item)
2033 {
2034 	KASSERT(node != &ng_deadnode,
2035 	    ("%s: working on deadnode", __func__));
2036 
2037 	/* Reader needs node without writer and pending items. */
2038 	for (;;) {
2039 		long t = node->nd_input_queue.q_flags;
2040 		if (t & NGQ_RMASK)
2041 			break; /* Node is not ready for reader. */
2042 		if (atomic_cmpset_acq_int(&node->nd_input_queue.q_flags, t,
2043 		    t + READER_INCREMENT)) {
2044 	    		/* Successfully grabbed node */
2045 			CTR4(KTR_NET, "%20s: node [%x] (%p) acquired item %p",
2046 			    __func__, node->nd_ID, node, item);
2047 			return (item);
2048 		}
2049 		cpu_spinwait();
2050 	};
2051 
2052 	/* Queue the request for later. */
2053 	ng_queue_rw(node, item, NGQRW_R);
2054 
2055 	return (NULL);
2056 }
2057 
2058 /* Acquire writer lock on node. If node is busy, queue the packet. */
2059 static __inline item_p
2060 ng_acquire_write(node_p node, item_p item)
2061 {
2062 	KASSERT(node != &ng_deadnode,
2063 	    ("%s: working on deadnode", __func__));
2064 
2065 	/* Writer needs completely idle node. */
2066 	if (atomic_cmpset_acq_int(&node->nd_input_queue.q_flags, 0,
2067 	    WRITER_ACTIVE)) {
2068 	    	/* Successfully grabbed node */
2069 		CTR4(KTR_NET, "%20s: node [%x] (%p) acquired item %p",
2070 		    __func__, node->nd_ID, node, item);
2071 		return (item);
2072 	}
2073 
2074 	/* Queue the request for later. */
2075 	ng_queue_rw(node, item, NGQRW_W);
2076 
2077 	return (NULL);
2078 }
2079 
2080 #if 0
2081 static __inline item_p
2082 ng_upgrade_write(node_p node, item_p item)
2083 {
2084 	struct ng_queue *ngq = &node->nd_input_queue;
2085 	KASSERT(node != &ng_deadnode,
2086 	    ("%s: working on deadnode", __func__));
2087 
2088 	NGI_SET_WRITER(item);
2089 
2090 	NG_QUEUE_LOCK(ngq);
2091 
2092 	/*
2093 	 * There will never be no readers as we are there ourselves.
2094 	 * Set the WRITER_ACTIVE flags ASAP to block out fast track readers.
2095 	 * The caller we are running from will call ng_leave_read()
2096 	 * soon, so we must account for that. We must leave again with the
2097 	 * READER lock. If we find other readers, then
2098 	 * queue the request for later. However "later" may be rignt now
2099 	 * if there are no readers. We don't really care if there are queued
2100 	 * items as we will bypass them anyhow.
2101 	 */
2102 	atomic_add_int(&ngq->q_flags, WRITER_ACTIVE - READER_INCREMENT);
2103 	if ((ngq->q_flags & (NGQ_WMASK & ~OP_PENDING)) == WRITER_ACTIVE) {
2104 		NG_QUEUE_UNLOCK(ngq);
2105 
2106 		/* It's just us, act on the item. */
2107 		/* will NOT drop writer lock when done */
2108 		ng_apply_item(node, item, 0);
2109 
2110 		/*
2111 		 * Having acted on the item, atomically
2112 		 * downgrade back to READER and finish up.
2113 	 	 */
2114 		atomic_add_int(&ngq->q_flags, READER_INCREMENT - WRITER_ACTIVE);
2115 
2116 		/* Our caller will call ng_leave_read() */
2117 		return;
2118 	}
2119 	/*
2120 	 * It's not just us active, so queue us AT THE HEAD.
2121 	 * "Why?" I hear you ask.
2122 	 * Put us at the head of the queue as we've already been
2123 	 * through it once. If there is nothing else waiting,
2124 	 * set the correct flags.
2125 	 */
2126 	if (STAILQ_EMPTY(&ngq->queue)) {
2127 		/* We've gone from, 0 to 1 item in the queue */
2128 		atomic_set_int(&ngq->q_flags, OP_PENDING);
2129 
2130 		CTR3(KTR_NET, "%20s: node [%x] (%p) set OP_PENDING", __func__,
2131 		    node->nd_ID, node);
2132 	};
2133 	STAILQ_INSERT_HEAD(&ngq->queue, item, el_next);
2134 	CTR4(KTR_NET, "%20s: node [%x] (%p) requeued item %p as WRITER",
2135 	    __func__, node->nd_ID, node, item );
2136 
2137 	/* Reverse what we did above. That downgrades us back to reader */
2138 	atomic_add_int(&ngq->q_flags, READER_INCREMENT - WRITER_ACTIVE);
2139 	if (QUEUE_ACTIVE(ngq) && NEXT_QUEUED_ITEM_CAN_PROCEED(ngq))
2140 		ng_worklist_add(node);
2141 	NG_QUEUE_UNLOCK(ngq);
2142 
2143 	return;
2144 }
2145 #endif
2146 
2147 /* Release reader lock. */
2148 static __inline void
2149 ng_leave_read(node_p node)
2150 {
2151 	atomic_subtract_rel_int(&node->nd_input_queue.q_flags, READER_INCREMENT);
2152 }
2153 
2154 /* Release writer lock. */
2155 static __inline void
2156 ng_leave_write(node_p node)
2157 {
2158 	atomic_clear_rel_int(&node->nd_input_queue.q_flags, WRITER_ACTIVE);
2159 }
2160 
2161 /* Purge node queue. Called on node shutdown. */
2162 static void
2163 ng_flush_input_queue(node_p node)
2164 {
2165 	struct ng_queue *ngq = &node->nd_input_queue;
2166 	item_p item;
2167 
2168 	NG_QUEUE_LOCK(ngq);
2169 	while ((item = STAILQ_FIRST(&ngq->queue)) != NULL) {
2170 		STAILQ_REMOVE_HEAD(&ngq->queue, el_next);
2171 		if (STAILQ_EMPTY(&ngq->queue))
2172 			atomic_clear_int(&ngq->q_flags, OP_PENDING);
2173 		NG_QUEUE_UNLOCK(ngq);
2174 
2175 		/* If the item is supplying a callback, call it with an error */
2176 		if (item->apply != NULL) {
2177 			if (item->depth == 1)
2178 				item->apply->error = ENOENT;
2179 			if (refcount_release(&item->apply->refs)) {
2180 				(*item->apply->apply)(item->apply->context,
2181 				    item->apply->error);
2182 			}
2183 		}
2184 		NG_FREE_ITEM(item);
2185 		NG_QUEUE_LOCK(ngq);
2186 	}
2187 	NG_QUEUE_UNLOCK(ngq);
2188 }
2189 
2190 /***********************************************************************
2191 * Externally visible method for sending or queueing messages or data.
2192 ***********************************************************************/
2193 
2194 /*
2195  * The module code should have filled out the item correctly by this stage:
2196  * Common:
2197  *    reference to destination node.
2198  *    Reference to destination rcv hook if relevant.
2199  *    apply pointer must be or NULL or reference valid struct ng_apply_info.
2200  * Data:
2201  *    pointer to mbuf
2202  * Control_Message:
2203  *    pointer to msg.
2204  *    ID of original sender node. (return address)
2205  * Function:
2206  *    Function pointer
2207  *    void * argument
2208  *    integer argument
2209  *
2210  * The nodes have several routines and macros to help with this task:
2211  */
2212 
2213 int
2214 ng_snd_item(item_p item, int flags)
2215 {
2216 	hook_p hook;
2217 	node_p node;
2218 	int queue, rw;
2219 	struct ng_queue *ngq;
2220 	int error = 0;
2221 
2222 	/* We are sending item, so it must be present! */
2223 	KASSERT(item != NULL, ("ng_snd_item: item is NULL"));
2224 
2225 #ifdef	NETGRAPH_DEBUG
2226 	_ngi_check(item, __FILE__, __LINE__);
2227 #endif
2228 
2229 	/* Item was sent once more, postpone apply() call. */
2230 	if (item->apply)
2231 		refcount_acquire(&item->apply->refs);
2232 
2233 	node = NGI_NODE(item);
2234 	/* Node is never optional. */
2235 	KASSERT(node != NULL, ("ng_snd_item: node is NULL"));
2236 
2237 	hook = NGI_HOOK(item);
2238 	/* Valid hook and mbuf are mandatory for data. */
2239 	if ((item->el_flags & NGQF_TYPE) == NGQF_DATA) {
2240 		KASSERT(hook != NULL, ("ng_snd_item: hook for data is NULL"));
2241 		if (NGI_M(item) == NULL)
2242 			ERROUT(EINVAL);
2243 		CHECK_DATA_MBUF(NGI_M(item));
2244 	}
2245 
2246 	/*
2247 	 * If the item or the node specifies single threading, force
2248 	 * writer semantics. Similarly, the node may say one hook always
2249 	 * produces writers. These are overrides.
2250 	 */
2251 	if (((item->el_flags & NGQF_RW) == NGQF_WRITER) ||
2252 	    (node->nd_flags & NGF_FORCE_WRITER) ||
2253 	    (hook && (hook->hk_flags & HK_FORCE_WRITER))) {
2254 		rw = NGQRW_W;
2255 	} else {
2256 		rw = NGQRW_R;
2257 	}
2258 
2259 	/*
2260 	 * If sender or receiver requests queued delivery, or call graph
2261 	 * loops back from outbound to inbound path, or stack usage
2262 	 * level is dangerous - enqueue message.
2263 	 */
2264 	if ((flags & NG_QUEUE) || (hook && (hook->hk_flags & HK_QUEUE))) {
2265 		queue = 1;
2266 	} else if (hook && (hook->hk_flags & HK_TO_INBOUND) &&
2267 	    curthread->td_ng_outbound) {
2268 		queue = 1;
2269 	} else {
2270 		queue = 0;
2271 #ifdef GET_STACK_USAGE
2272 		/*
2273 		 * Most of netgraph nodes have small stack consumption and
2274 		 * for them 25% of free stack space is more than enough.
2275 		 * Nodes/hooks with higher stack usage should be marked as
2276 		 * HI_STACK. For them 50% of stack will be guaranteed then.
2277 		 * XXX: Values 25% and 50% are completely empirical.
2278 		 */
2279 		size_t	st, su, sl;
2280 		GET_STACK_USAGE(st, su);
2281 		sl = st - su;
2282 		if ((sl * 4 < st) || ((sl * 2 < st) &&
2283 		    ((node->nd_flags & NGF_HI_STACK) || (hook &&
2284 		    (hook->hk_flags & HK_HI_STACK)))))
2285 			queue = 1;
2286 #endif
2287 	}
2288 
2289 	if (queue) {
2290 		/* Put it on the queue for that node*/
2291 		ng_queue_rw(node, item, rw);
2292 		return ((flags & NG_PROGRESS) ? EINPROGRESS : 0);
2293 	}
2294 
2295 	/*
2296 	 * We already decided how we will be queueud or treated.
2297 	 * Try get the appropriate operating permission.
2298 	 */
2299  	if (rw == NGQRW_R)
2300 		item = ng_acquire_read(node, item);
2301 	else
2302 		item = ng_acquire_write(node, item);
2303 
2304 	/* Item was queued while trying to get permission. */
2305 	if (item == NULL)
2306 		return ((flags & NG_PROGRESS) ? EINPROGRESS : 0);
2307 
2308 	NGI_GET_NODE(item, node); /* zaps stored node */
2309 
2310 	item->depth++;
2311 	error = ng_apply_item(node, item, rw); /* drops r/w lock when done */
2312 
2313 	/* If something is waiting on queue and ready, schedule it. */
2314 	ngq = &node->nd_input_queue;
2315 	if (QUEUE_ACTIVE(ngq)) {
2316 		NG_QUEUE_LOCK(ngq);
2317 		if (QUEUE_ACTIVE(ngq) && NEXT_QUEUED_ITEM_CAN_PROCEED(ngq))
2318 			ng_worklist_add(node);
2319 		NG_QUEUE_UNLOCK(ngq);
2320 	}
2321 
2322 	/*
2323 	 * Node may go away as soon as we remove the reference.
2324 	 * Whatever we do, DO NOT access the node again!
2325 	 */
2326 	NG_NODE_UNREF(node);
2327 
2328 	return (error);
2329 
2330 done:
2331 	/* If was not sent, apply callback here. */
2332 	if (item->apply != NULL) {
2333 		if (item->depth == 0 && error != 0)
2334 			item->apply->error = error;
2335 		if (refcount_release(&item->apply->refs)) {
2336 			(*item->apply->apply)(item->apply->context,
2337 			    item->apply->error);
2338 		}
2339 	}
2340 
2341 	NG_FREE_ITEM(item);
2342 	return (error);
2343 }
2344 
2345 /*
2346  * We have an item that was possibly queued somewhere.
2347  * It should contain all the information needed
2348  * to run it on the appropriate node/hook.
2349  * If there is apply pointer and we own the last reference, call apply().
2350  */
2351 static int
2352 ng_apply_item(node_p node, item_p item, int rw)
2353 {
2354 	hook_p  hook;
2355 	ng_rcvdata_t *rcvdata;
2356 	ng_rcvmsg_t *rcvmsg;
2357 	struct ng_apply_info *apply;
2358 	int	error = 0, depth;
2359 
2360 	/* Node and item are never optional. */
2361 	KASSERT(node != NULL, ("ng_apply_item: node is NULL"));
2362 	KASSERT(item != NULL, ("ng_apply_item: item is NULL"));
2363 
2364 	NGI_GET_HOOK(item, hook); /* clears stored hook */
2365 #ifdef	NETGRAPH_DEBUG
2366 	_ngi_check(item, __FILE__, __LINE__);
2367 #endif
2368 
2369 	apply = item->apply;
2370 	depth = item->depth;
2371 
2372 	switch (item->el_flags & NGQF_TYPE) {
2373 	case NGQF_DATA:
2374 		/*
2375 		 * Check things are still ok as when we were queued.
2376 		 */
2377 		KASSERT(hook != NULL, ("ng_apply_item: hook for data is NULL"));
2378 		if (NG_HOOK_NOT_VALID(hook) ||
2379 		    NG_NODE_NOT_VALID(node)) {
2380 			error = EIO;
2381 			NG_FREE_ITEM(item);
2382 			break;
2383 		}
2384 		/*
2385 		 * If no receive method, just silently drop it.
2386 		 * Give preference to the hook over-ride method.
2387 		 */
2388 		if ((!(rcvdata = hook->hk_rcvdata)) &&
2389 		    (!(rcvdata = NG_HOOK_NODE(hook)->nd_type->rcvdata))) {
2390 			error = 0;
2391 			NG_FREE_ITEM(item);
2392 			break;
2393 		}
2394 		error = (*rcvdata)(hook, item);
2395 		break;
2396 	case NGQF_MESG:
2397 		if (hook && NG_HOOK_NOT_VALID(hook)) {
2398 			/*
2399 			 * The hook has been zapped then we can't use it.
2400 			 * Immediately drop its reference.
2401 			 * The message may not need it.
2402 			 */
2403 			NG_HOOK_UNREF(hook);
2404 			hook = NULL;
2405 		}
2406 		/*
2407 		 * Similarly, if the node is a zombie there is
2408 		 * nothing we can do with it, drop everything.
2409 		 */
2410 		if (NG_NODE_NOT_VALID(node)) {
2411 			TRAP_ERROR();
2412 			error = EINVAL;
2413 			NG_FREE_ITEM(item);
2414 			break;
2415 		}
2416 		/*
2417 		 * Call the appropriate message handler for the object.
2418 		 * It is up to the message handler to free the message.
2419 		 * If it's a generic message, handle it generically,
2420 		 * otherwise call the type's message handler (if it exists).
2421 		 * XXX (race). Remember that a queued message may
2422 		 * reference a node or hook that has just been
2423 		 * invalidated. It will exist as the queue code
2424 		 * is holding a reference, but..
2425 		 */
2426 		if ((NGI_MSG(item)->header.typecookie == NGM_GENERIC_COOKIE) &&
2427 		    ((NGI_MSG(item)->header.flags & NGF_RESP) == 0)) {
2428 			error = ng_generic_msg(node, item, hook);
2429 			break;
2430 		}
2431 		if (((!hook) || (!(rcvmsg = hook->hk_rcvmsg))) &&
2432 		    (!(rcvmsg = node->nd_type->rcvmsg))) {
2433 			TRAP_ERROR();
2434 			error = 0;
2435 			NG_FREE_ITEM(item);
2436 			break;
2437 		}
2438 		error = (*rcvmsg)(node, item, hook);
2439 		break;
2440 	case NGQF_FN:
2441 	case NGQF_FN2:
2442 		/*
2443 		 * In the case of the shutdown message we allow it to hit
2444 		 * even if the node is invalid.
2445 		 */
2446 		if (NG_NODE_NOT_VALID(node) &&
2447 		    NGI_FN(item) != &ng_rmnode) {
2448 			TRAP_ERROR();
2449 			error = EINVAL;
2450 			NG_FREE_ITEM(item);
2451 			break;
2452 		}
2453 		/* Same is about some internal functions and invalid hook. */
2454 		if (hook && NG_HOOK_NOT_VALID(hook) &&
2455 		    NGI_FN2(item) != &ng_con_part2 &&
2456 		    NGI_FN2(item) != &ng_con_part3 &&
2457 		    NGI_FN(item) != &ng_rmhook_part2) {
2458 			TRAP_ERROR();
2459 			error = EINVAL;
2460 			NG_FREE_ITEM(item);
2461 			break;
2462 		}
2463 
2464 		if ((item->el_flags & NGQF_TYPE) == NGQF_FN) {
2465 			(*NGI_FN(item))(node, hook, NGI_ARG1(item),
2466 			    NGI_ARG2(item));
2467 			NG_FREE_ITEM(item);
2468 		} else	/* it is NGQF_FN2 */
2469 			error = (*NGI_FN2(item))(node, item, hook);
2470 		break;
2471 	}
2472 	/*
2473 	 * We held references on some of the resources
2474 	 * that we took from the item. Now that we have
2475 	 * finished doing everything, drop those references.
2476 	 */
2477 	if (hook)
2478 		NG_HOOK_UNREF(hook);
2479 
2480  	if (rw == NGQRW_R)
2481 		ng_leave_read(node);
2482 	else
2483 		ng_leave_write(node);
2484 
2485 	/* Apply callback. */
2486 	if (apply != NULL) {
2487 		if (depth == 1 && error != 0)
2488 			apply->error = error;
2489 		if (refcount_release(&apply->refs))
2490 			(*apply->apply)(apply->context, apply->error);
2491 	}
2492 
2493 	return (error);
2494 }
2495 
2496 /***********************************************************************
2497  * Implement the 'generic' control messages
2498  ***********************************************************************/
2499 static int
2500 ng_generic_msg(node_p here, item_p item, hook_p lasthook)
2501 {
2502 	int error = 0;
2503 	struct ng_mesg *msg;
2504 	struct ng_mesg *resp = NULL;
2505 
2506 	NGI_GET_MSG(item, msg);
2507 	if (msg->header.typecookie != NGM_GENERIC_COOKIE) {
2508 		TRAP_ERROR();
2509 		error = EINVAL;
2510 		goto out;
2511 	}
2512 	switch (msg->header.cmd) {
2513 	case NGM_SHUTDOWN:
2514 		ng_rmnode(here, NULL, NULL, 0);
2515 		break;
2516 	case NGM_MKPEER:
2517 	    {
2518 		struct ngm_mkpeer *const mkp = (struct ngm_mkpeer *) msg->data;
2519 
2520 		if (msg->header.arglen != sizeof(*mkp)) {
2521 			TRAP_ERROR();
2522 			error = EINVAL;
2523 			break;
2524 		}
2525 		mkp->type[sizeof(mkp->type) - 1] = '\0';
2526 		mkp->ourhook[sizeof(mkp->ourhook) - 1] = '\0';
2527 		mkp->peerhook[sizeof(mkp->peerhook) - 1] = '\0';
2528 		error = ng_mkpeer(here, mkp->ourhook, mkp->peerhook, mkp->type);
2529 		break;
2530 	    }
2531 	case NGM_CONNECT:
2532 	    {
2533 		struct ngm_connect *const con =
2534 			(struct ngm_connect *) msg->data;
2535 		node_p node2;
2536 
2537 		if (msg->header.arglen != sizeof(*con)) {
2538 			TRAP_ERROR();
2539 			error = EINVAL;
2540 			break;
2541 		}
2542 		con->path[sizeof(con->path) - 1] = '\0';
2543 		con->ourhook[sizeof(con->ourhook) - 1] = '\0';
2544 		con->peerhook[sizeof(con->peerhook) - 1] = '\0';
2545 		/* Don't forget we get a reference.. */
2546 		error = ng_path2noderef(here, con->path, &node2, NULL);
2547 		if (error)
2548 			break;
2549 		error = ng_con_nodes(item, here, con->ourhook,
2550 		    node2, con->peerhook);
2551 		NG_NODE_UNREF(node2);
2552 		break;
2553 	    }
2554 	case NGM_NAME:
2555 	    {
2556 		struct ngm_name *const nam = (struct ngm_name *) msg->data;
2557 
2558 		if (msg->header.arglen != sizeof(*nam)) {
2559 			TRAP_ERROR();
2560 			error = EINVAL;
2561 			break;
2562 		}
2563 		nam->name[sizeof(nam->name) - 1] = '\0';
2564 		error = ng_name_node(here, nam->name);
2565 		break;
2566 	    }
2567 	case NGM_RMHOOK:
2568 	    {
2569 		struct ngm_rmhook *const rmh = (struct ngm_rmhook *) msg->data;
2570 		hook_p hook;
2571 
2572 		if (msg->header.arglen != sizeof(*rmh)) {
2573 			TRAP_ERROR();
2574 			error = EINVAL;
2575 			break;
2576 		}
2577 		rmh->ourhook[sizeof(rmh->ourhook) - 1] = '\0';
2578 		if ((hook = ng_findhook(here, rmh->ourhook)) != NULL)
2579 			ng_destroy_hook(hook);
2580 		break;
2581 	    }
2582 	case NGM_NODEINFO:
2583 	    {
2584 		struct nodeinfo *ni;
2585 
2586 		NG_MKRESPONSE(resp, msg, sizeof(*ni), M_NOWAIT);
2587 		if (resp == NULL) {
2588 			error = ENOMEM;
2589 			break;
2590 		}
2591 
2592 		/* Fill in node info */
2593 		ni = (struct nodeinfo *) resp->data;
2594 		if (NG_NODE_HAS_NAME(here))
2595 			strcpy(ni->name, NG_NODE_NAME(here));
2596 		strcpy(ni->type, here->nd_type->name);
2597 		ni->id = ng_node2ID(here);
2598 		ni->hooks = here->nd_numhooks;
2599 		break;
2600 	    }
2601 	case NGM_LISTHOOKS:
2602 	    {
2603 		const int nhooks = here->nd_numhooks;
2604 		struct hooklist *hl;
2605 		struct nodeinfo *ni;
2606 		hook_p hook;
2607 
2608 		/* Get response struct */
2609 		NG_MKRESPONSE(resp, msg, sizeof(*hl) +
2610 		    (nhooks * sizeof(struct linkinfo)), M_NOWAIT);
2611 		if (resp == NULL) {
2612 			error = ENOMEM;
2613 			break;
2614 		}
2615 		hl = (struct hooklist *) resp->data;
2616 		ni = &hl->nodeinfo;
2617 
2618 		/* Fill in node info */
2619 		if (NG_NODE_HAS_NAME(here))
2620 			strcpy(ni->name, NG_NODE_NAME(here));
2621 		strcpy(ni->type, here->nd_type->name);
2622 		ni->id = ng_node2ID(here);
2623 
2624 		/* Cycle through the linked list of hooks */
2625 		ni->hooks = 0;
2626 		LIST_FOREACH(hook, &here->nd_hooks, hk_hooks) {
2627 			struct linkinfo *const link = &hl->link[ni->hooks];
2628 
2629 			if (ni->hooks >= nhooks) {
2630 				log(LOG_ERR, "%s: number of %s changed\n",
2631 				    __func__, "hooks");
2632 				break;
2633 			}
2634 			if (NG_HOOK_NOT_VALID(hook))
2635 				continue;
2636 			strcpy(link->ourhook, NG_HOOK_NAME(hook));
2637 			strcpy(link->peerhook, NG_PEER_HOOK_NAME(hook));
2638 			if (NG_PEER_NODE_NAME(hook)[0] != '\0')
2639 				strcpy(link->nodeinfo.name,
2640 				    NG_PEER_NODE_NAME(hook));
2641 			strcpy(link->nodeinfo.type,
2642 			   NG_PEER_NODE(hook)->nd_type->name);
2643 			link->nodeinfo.id = ng_node2ID(NG_PEER_NODE(hook));
2644 			link->nodeinfo.hooks = NG_PEER_NODE(hook)->nd_numhooks;
2645 			ni->hooks++;
2646 		}
2647 		break;
2648 	    }
2649 
2650 	case NGM_LISTNODES:
2651 	    {
2652 		struct namelist *nl;
2653 		node_p node;
2654 		int i;
2655 
2656 		IDHASH_RLOCK();
2657 		/* Get response struct. */
2658 		NG_MKRESPONSE(resp, msg, sizeof(*nl) +
2659 		    (V_ng_nodes * sizeof(struct nodeinfo)), M_NOWAIT | M_ZERO);
2660 		if (resp == NULL) {
2661 			IDHASH_RUNLOCK();
2662 			error = ENOMEM;
2663 			break;
2664 		}
2665 		nl = (struct namelist *) resp->data;
2666 
2667 		/* Cycle through the lists of nodes. */
2668 		nl->numnames = 0;
2669 		for (i = 0; i <= V_ng_ID_hmask; i++) {
2670 			LIST_FOREACH(node, &V_ng_ID_hash[i], nd_idnodes) {
2671 				struct nodeinfo *const np =
2672 				    &nl->nodeinfo[nl->numnames];
2673 
2674 				if (NG_NODE_NOT_VALID(node))
2675 					continue;
2676 				if (NG_NODE_HAS_NAME(node))
2677 					strcpy(np->name, NG_NODE_NAME(node));
2678 				strcpy(np->type, node->nd_type->name);
2679 				np->id = ng_node2ID(node);
2680 				np->hooks = node->nd_numhooks;
2681 				KASSERT(nl->numnames < V_ng_nodes,
2682 				    ("%s: no space", __func__));
2683 				nl->numnames++;
2684 			}
2685 		}
2686 		IDHASH_RUNLOCK();
2687 		break;
2688 	    }
2689 	case NGM_LISTNAMES:
2690 	    {
2691 		struct namelist *nl;
2692 		node_p node;
2693 		int i;
2694 
2695 		NAMEHASH_RLOCK();
2696 		/* Get response struct. */
2697 		NG_MKRESPONSE(resp, msg, sizeof(*nl) +
2698 		    (V_ng_named_nodes * sizeof(struct nodeinfo)), M_NOWAIT);
2699 		if (resp == NULL) {
2700 			NAMEHASH_RUNLOCK();
2701 			error = ENOMEM;
2702 			break;
2703 		}
2704 		nl = (struct namelist *) resp->data;
2705 
2706 		/* Cycle through the lists of nodes. */
2707 		nl->numnames = 0;
2708 		for (i = 0; i <= V_ng_name_hmask; i++) {
2709 			LIST_FOREACH(node, &V_ng_name_hash[i], nd_nodes) {
2710 				struct nodeinfo *const np =
2711 				    &nl->nodeinfo[nl->numnames];
2712 
2713 				if (NG_NODE_NOT_VALID(node))
2714 					continue;
2715 				strcpy(np->name, NG_NODE_NAME(node));
2716 				strcpy(np->type, node->nd_type->name);
2717 				np->id = ng_node2ID(node);
2718 				np->hooks = node->nd_numhooks;
2719 				KASSERT(nl->numnames < V_ng_named_nodes,
2720 				    ("%s: no space", __func__));
2721 				nl->numnames++;
2722 			}
2723 		}
2724 		NAMEHASH_RUNLOCK();
2725 		break;
2726 	    }
2727 
2728 	case NGM_LISTTYPES:
2729 	    {
2730 		struct typelist *tl;
2731 		struct ng_type *type;
2732 		int num = 0;
2733 
2734 		TYPELIST_RLOCK();
2735 		/* Count number of types */
2736 		LIST_FOREACH(type, &ng_typelist, types)
2737 			num++;
2738 
2739 		/* Get response struct */
2740 		NG_MKRESPONSE(resp, msg, sizeof(*tl) +
2741 		    (num * sizeof(struct typeinfo)), M_NOWAIT);
2742 		if (resp == NULL) {
2743 			TYPELIST_RUNLOCK();
2744 			error = ENOMEM;
2745 			break;
2746 		}
2747 		tl = (struct typelist *) resp->data;
2748 
2749 		/* Cycle through the linked list of types */
2750 		tl->numtypes = 0;
2751 		LIST_FOREACH(type, &ng_typelist, types) {
2752 			struct typeinfo *const tp = &tl->typeinfo[tl->numtypes];
2753 
2754 			strcpy(tp->type_name, type->name);
2755 			tp->numnodes = type->refs - 1; /* don't count list */
2756 			KASSERT(tl->numtypes < num, ("%s: no space", __func__));
2757 			tl->numtypes++;
2758 		}
2759 		TYPELIST_RUNLOCK();
2760 		break;
2761 	    }
2762 
2763 	case NGM_BINARY2ASCII:
2764 	    {
2765 		int bufSize = 20 * 1024;	/* XXX hard coded constant */
2766 		const struct ng_parse_type *argstype;
2767 		const struct ng_cmdlist *c;
2768 		struct ng_mesg *binary, *ascii;
2769 
2770 		/* Data area must contain a valid netgraph message */
2771 		binary = (struct ng_mesg *)msg->data;
2772 		if (msg->header.arglen < sizeof(struct ng_mesg) ||
2773 		    (msg->header.arglen - sizeof(struct ng_mesg) <
2774 		    binary->header.arglen)) {
2775 			TRAP_ERROR();
2776 			error = EINVAL;
2777 			break;
2778 		}
2779 
2780 		/* Get a response message with lots of room */
2781 		NG_MKRESPONSE(resp, msg, sizeof(*ascii) + bufSize, M_NOWAIT);
2782 		if (resp == NULL) {
2783 			error = ENOMEM;
2784 			break;
2785 		}
2786 		ascii = (struct ng_mesg *)resp->data;
2787 
2788 		/* Copy binary message header to response message payload */
2789 		bcopy(binary, ascii, sizeof(*binary));
2790 
2791 		/* Find command by matching typecookie and command number */
2792 		for (c = here->nd_type->cmdlist; c != NULL && c->name != NULL;
2793 		    c++) {
2794 			if (binary->header.typecookie == c->cookie &&
2795 			    binary->header.cmd == c->cmd)
2796 				break;
2797 		}
2798 		if (c == NULL || c->name == NULL) {
2799 			for (c = ng_generic_cmds; c->name != NULL; c++) {
2800 				if (binary->header.typecookie == c->cookie &&
2801 				    binary->header.cmd == c->cmd)
2802 					break;
2803 			}
2804 			if (c->name == NULL) {
2805 				NG_FREE_MSG(resp);
2806 				error = ENOSYS;
2807 				break;
2808 			}
2809 		}
2810 
2811 		/* Convert command name to ASCII */
2812 		snprintf(ascii->header.cmdstr, sizeof(ascii->header.cmdstr),
2813 		    "%s", c->name);
2814 
2815 		/* Convert command arguments to ASCII */
2816 		argstype = (binary->header.flags & NGF_RESP) ?
2817 		    c->respType : c->mesgType;
2818 		if (argstype == NULL) {
2819 			*ascii->data = '\0';
2820 		} else {
2821 			if ((error = ng_unparse(argstype,
2822 			    (u_char *)binary->data,
2823 			    ascii->data, bufSize)) != 0) {
2824 				NG_FREE_MSG(resp);
2825 				break;
2826 			}
2827 		}
2828 
2829 		/* Return the result as struct ng_mesg plus ASCII string */
2830 		bufSize = strlen(ascii->data) + 1;
2831 		ascii->header.arglen = bufSize;
2832 		resp->header.arglen = sizeof(*ascii) + bufSize;
2833 		break;
2834 	    }
2835 
2836 	case NGM_ASCII2BINARY:
2837 	    {
2838 		int bufSize = 20 * 1024;	/* XXX hard coded constant */
2839 		const struct ng_cmdlist *c;
2840 		const struct ng_parse_type *argstype;
2841 		struct ng_mesg *ascii, *binary;
2842 		int off = 0;
2843 
2844 		/* Data area must contain at least a struct ng_mesg + '\0' */
2845 		ascii = (struct ng_mesg *)msg->data;
2846 		if ((msg->header.arglen < sizeof(*ascii) + 1) ||
2847 		    (ascii->header.arglen < 1) ||
2848 		    (msg->header.arglen < sizeof(*ascii) +
2849 		    ascii->header.arglen)) {
2850 			TRAP_ERROR();
2851 			error = EINVAL;
2852 			break;
2853 		}
2854 		ascii->data[ascii->header.arglen - 1] = '\0';
2855 
2856 		/* Get a response message with lots of room */
2857 		NG_MKRESPONSE(resp, msg, sizeof(*binary) + bufSize, M_NOWAIT);
2858 		if (resp == NULL) {
2859 			error = ENOMEM;
2860 			break;
2861 		}
2862 		binary = (struct ng_mesg *)resp->data;
2863 
2864 		/* Copy ASCII message header to response message payload */
2865 		bcopy(ascii, binary, sizeof(*ascii));
2866 
2867 		/* Find command by matching ASCII command string */
2868 		for (c = here->nd_type->cmdlist;
2869 		    c != NULL && c->name != NULL; c++) {
2870 			if (strcmp(ascii->header.cmdstr, c->name) == 0)
2871 				break;
2872 		}
2873 		if (c == NULL || c->name == NULL) {
2874 			for (c = ng_generic_cmds; c->name != NULL; c++) {
2875 				if (strcmp(ascii->header.cmdstr, c->name) == 0)
2876 					break;
2877 			}
2878 			if (c->name == NULL) {
2879 				NG_FREE_MSG(resp);
2880 				error = ENOSYS;
2881 				break;
2882 			}
2883 		}
2884 
2885 		/* Convert command name to binary */
2886 		binary->header.cmd = c->cmd;
2887 		binary->header.typecookie = c->cookie;
2888 
2889 		/* Convert command arguments to binary */
2890 		argstype = (binary->header.flags & NGF_RESP) ?
2891 		    c->respType : c->mesgType;
2892 		if (argstype == NULL) {
2893 			bufSize = 0;
2894 		} else {
2895 			if ((error = ng_parse(argstype, ascii->data, &off,
2896 			    (u_char *)binary->data, &bufSize)) != 0) {
2897 				NG_FREE_MSG(resp);
2898 				break;
2899 			}
2900 		}
2901 
2902 		/* Return the result */
2903 		binary->header.arglen = bufSize;
2904 		resp->header.arglen = sizeof(*binary) + bufSize;
2905 		break;
2906 	    }
2907 
2908 	case NGM_TEXT_CONFIG:
2909 	case NGM_TEXT_STATUS:
2910 		/*
2911 		 * This one is tricky as it passes the command down to the
2912 		 * actual node, even though it is a generic type command.
2913 		 * This means we must assume that the item/msg is already freed
2914 		 * when control passes back to us.
2915 		 */
2916 		if (here->nd_type->rcvmsg != NULL) {
2917 			NGI_MSG(item) = msg; /* put it back as we found it */
2918 			return((*here->nd_type->rcvmsg)(here, item, lasthook));
2919 		}
2920 		/* Fall through if rcvmsg not supported */
2921 	default:
2922 		TRAP_ERROR();
2923 		error = EINVAL;
2924 	}
2925 	/*
2926 	 * Sometimes a generic message may be statically allocated
2927 	 * to avoid problems with allocating when in tight memory situations.
2928 	 * Don't free it if it is so.
2929 	 * I break them appart here, because erros may cause a free if the item
2930 	 * in which case we'd be doing it twice.
2931 	 * they are kept together above, to simplify freeing.
2932 	 */
2933 out:
2934 	NG_RESPOND_MSG(error, here, item, resp);
2935 	NG_FREE_MSG(msg);
2936 	return (error);
2937 }
2938 
2939 /************************************************************************
2940 			Queue element get/free routines
2941 ************************************************************************/
2942 
2943 uma_zone_t			ng_qzone;
2944 uma_zone_t			ng_qdzone;
2945 static int			numthreads = 0; /* number of queue threads */
2946 static int			maxalloc = 4096;/* limit the damage of a leak */
2947 static int			maxdata = 512;	/* limit the damage of a DoS */
2948 
2949 TUNABLE_INT("net.graph.threads", &numthreads);
2950 SYSCTL_INT(_net_graph, OID_AUTO, threads, CTLFLAG_RDTUN, &numthreads,
2951     0, "Number of queue processing threads");
2952 TUNABLE_INT("net.graph.maxalloc", &maxalloc);
2953 SYSCTL_INT(_net_graph, OID_AUTO, maxalloc, CTLFLAG_RDTUN, &maxalloc,
2954     0, "Maximum number of non-data queue items to allocate");
2955 TUNABLE_INT("net.graph.maxdata", &maxdata);
2956 SYSCTL_INT(_net_graph, OID_AUTO, maxdata, CTLFLAG_RDTUN, &maxdata,
2957     0, "Maximum number of data queue items to allocate");
2958 
2959 #ifdef	NETGRAPH_DEBUG
2960 static TAILQ_HEAD(, ng_item) ng_itemlist = TAILQ_HEAD_INITIALIZER(ng_itemlist);
2961 static int allocated;	/* number of items malloc'd */
2962 #endif
2963 
2964 /*
2965  * Get a queue entry.
2966  * This is usually called when a packet first enters netgraph.
2967  * By definition, this is usually from an interrupt, or from a user.
2968  * Users are not so important, but try be quick for the times that it's
2969  * an interrupt.
2970  */
2971 static __inline item_p
2972 ng_alloc_item(int type, int flags)
2973 {
2974 	item_p item;
2975 
2976 	KASSERT(((type & ~NGQF_TYPE) == 0),
2977 	    ("%s: incorrect item type: %d", __func__, type));
2978 
2979 	item = uma_zalloc((type == NGQF_DATA) ? ng_qdzone : ng_qzone,
2980 	    ((flags & NG_WAITOK) ? M_WAITOK : M_NOWAIT) | M_ZERO);
2981 
2982 	if (item) {
2983 		item->el_flags = type;
2984 #ifdef	NETGRAPH_DEBUG
2985 		mtx_lock(&ngq_mtx);
2986 		TAILQ_INSERT_TAIL(&ng_itemlist, item, all);
2987 		allocated++;
2988 		mtx_unlock(&ngq_mtx);
2989 #endif
2990 	}
2991 
2992 	return (item);
2993 }
2994 
2995 /*
2996  * Release a queue entry
2997  */
2998 void
2999 ng_free_item(item_p item)
3000 {
3001 	/*
3002 	 * The item may hold resources on it's own. We need to free
3003 	 * these before we can free the item. What they are depends upon
3004 	 * what kind of item it is. it is important that nodes zero
3005 	 * out pointers to resources that they remove from the item
3006 	 * or we release them again here.
3007 	 */
3008 	switch (item->el_flags & NGQF_TYPE) {
3009 	case NGQF_DATA:
3010 		/* If we have an mbuf still attached.. */
3011 		NG_FREE_M(_NGI_M(item));
3012 		break;
3013 	case NGQF_MESG:
3014 		_NGI_RETADDR(item) = 0;
3015 		NG_FREE_MSG(_NGI_MSG(item));
3016 		break;
3017 	case NGQF_FN:
3018 	case NGQF_FN2:
3019 		/* nothing to free really, */
3020 		_NGI_FN(item) = NULL;
3021 		_NGI_ARG1(item) = NULL;
3022 		_NGI_ARG2(item) = 0;
3023 		break;
3024 	}
3025 	/* If we still have a node or hook referenced... */
3026 	_NGI_CLR_NODE(item);
3027 	_NGI_CLR_HOOK(item);
3028 
3029 #ifdef	NETGRAPH_DEBUG
3030 	mtx_lock(&ngq_mtx);
3031 	TAILQ_REMOVE(&ng_itemlist, item, all);
3032 	allocated--;
3033 	mtx_unlock(&ngq_mtx);
3034 #endif
3035 	uma_zfree(((item->el_flags & NGQF_TYPE) == NGQF_DATA) ?
3036 	    ng_qdzone : ng_qzone, item);
3037 }
3038 
3039 /*
3040  * Change type of the queue entry.
3041  * Possibly reallocates it from another UMA zone.
3042  */
3043 static __inline item_p
3044 ng_realloc_item(item_p pitem, int type, int flags)
3045 {
3046 	item_p item;
3047 	int from, to;
3048 
3049 	KASSERT((pitem != NULL), ("%s: can't reallocate NULL", __func__));
3050 	KASSERT(((type & ~NGQF_TYPE) == 0),
3051 	    ("%s: incorrect item type: %d", __func__, type));
3052 
3053 	from = ((pitem->el_flags & NGQF_TYPE) == NGQF_DATA);
3054 	to = (type == NGQF_DATA);
3055 	if (from != to) {
3056 		/* If reallocation is required do it and copy item. */
3057 		if ((item = ng_alloc_item(type, flags)) == NULL) {
3058 			ng_free_item(pitem);
3059 			return (NULL);
3060 		}
3061 		*item = *pitem;
3062 		ng_free_item(pitem);
3063 	} else
3064 		item = pitem;
3065 	item->el_flags = (item->el_flags & ~NGQF_TYPE) | type;
3066 
3067 	return (item);
3068 }
3069 
3070 /************************************************************************
3071 			Module routines
3072 ************************************************************************/
3073 
3074 /*
3075  * Handle the loading/unloading of a netgraph node type module
3076  */
3077 int
3078 ng_mod_event(module_t mod, int event, void *data)
3079 {
3080 	struct ng_type *const type = data;
3081 	int error = 0;
3082 
3083 	switch (event) {
3084 	case MOD_LOAD:
3085 
3086 		/* Register new netgraph node type */
3087 		if ((error = ng_newtype(type)) != 0)
3088 			break;
3089 
3090 		/* Call type specific code */
3091 		if (type->mod_event != NULL)
3092 			if ((error = (*type->mod_event)(mod, event, data))) {
3093 				TYPELIST_WLOCK();
3094 				type->refs--;	/* undo it */
3095 				LIST_REMOVE(type, types);
3096 				TYPELIST_WUNLOCK();
3097 			}
3098 		break;
3099 
3100 	case MOD_UNLOAD:
3101 		if (type->refs > 1) {		/* make sure no nodes exist! */
3102 			error = EBUSY;
3103 		} else {
3104 			if (type->refs == 0) /* failed load, nothing to undo */
3105 				break;
3106 			if (type->mod_event != NULL) {	/* check with type */
3107 				error = (*type->mod_event)(mod, event, data);
3108 				if (error != 0)	/* type refuses.. */
3109 					break;
3110 			}
3111 			TYPELIST_WLOCK();
3112 			LIST_REMOVE(type, types);
3113 			TYPELIST_WUNLOCK();
3114 		}
3115 		break;
3116 
3117 	default:
3118 		if (type->mod_event != NULL)
3119 			error = (*type->mod_event)(mod, event, data);
3120 		else
3121 			error = EOPNOTSUPP;		/* XXX ? */
3122 		break;
3123 	}
3124 	return (error);
3125 }
3126 
3127 static void
3128 vnet_netgraph_init(const void *unused __unused)
3129 {
3130 
3131 	/* We start with small hashes, but they can grow. */
3132 	V_ng_ID_hash = hashinit(16, M_NETGRAPH_NODE, &V_ng_ID_hmask);
3133 	V_ng_name_hash = hashinit(16, M_NETGRAPH_NODE, &V_ng_name_hmask);
3134 }
3135 VNET_SYSINIT(vnet_netgraph_init, SI_SUB_NETGRAPH, SI_ORDER_FIRST,
3136     vnet_netgraph_init, NULL);
3137 
3138 #ifdef VIMAGE
3139 static void
3140 vnet_netgraph_uninit(const void *unused __unused)
3141 {
3142 	node_p node = NULL, last_killed = NULL;
3143 	int i;
3144 
3145 	do {
3146 		/* Find a node to kill */
3147 		IDHASH_RLOCK();
3148 		for (i = 0; i <= V_ng_ID_hmask; i++) {
3149 			LIST_FOREACH(node, &V_ng_ID_hash[i], nd_idnodes) {
3150 				if (node != &ng_deadnode) {
3151 					NG_NODE_REF(node);
3152 					break;
3153 				}
3154 			}
3155 			if (node != NULL)
3156 				break;
3157 		}
3158 		IDHASH_RUNLOCK();
3159 
3160 		/* Attempt to kill it only if it is a regular node */
3161 		if (node != NULL) {
3162 			if (node == last_killed) {
3163 				/* This should never happen */
3164 				printf("ng node %s needs NGF_REALLY_DIE\n",
3165 				    node->nd_name);
3166 				if (node->nd_flags & NGF_REALLY_DIE)
3167 					panic("ng node %s won't die",
3168 					    node->nd_name);
3169 				node->nd_flags |= NGF_REALLY_DIE;
3170 			}
3171 			ng_rmnode(node, NULL, NULL, 0);
3172 			NG_NODE_UNREF(node);
3173 			last_killed = node;
3174 		}
3175 	} while (node != NULL);
3176 
3177 	hashdestroy(V_ng_name_hash, M_NETGRAPH_NODE, V_ng_name_hmask);
3178 	hashdestroy(V_ng_ID_hash, M_NETGRAPH_NODE, V_ng_ID_hmask);
3179 }
3180 VNET_SYSUNINIT(vnet_netgraph_uninit, SI_SUB_NETGRAPH, SI_ORDER_FIRST,
3181     vnet_netgraph_uninit, NULL);
3182 #endif /* VIMAGE */
3183 
3184 /*
3185  * Handle loading and unloading for this code.
3186  * The only thing we need to link into is the NETISR strucure.
3187  */
3188 static int
3189 ngb_mod_event(module_t mod, int event, void *data)
3190 {
3191 	struct proc *p;
3192 	struct thread *td;
3193 	int i, error = 0;
3194 
3195 	switch (event) {
3196 	case MOD_LOAD:
3197 		/* Initialize everything. */
3198 		NG_WORKLIST_LOCK_INIT();
3199 		rw_init(&ng_typelist_lock, "netgraph types");
3200 		rw_init(&ng_idhash_lock, "netgraph idhash");
3201 		rw_init(&ng_namehash_lock, "netgraph namehash");
3202 		mtx_init(&ng_topo_mtx, "netgraph topology mutex", NULL,
3203 		    MTX_DEF);
3204 #ifdef	NETGRAPH_DEBUG
3205 		mtx_init(&ng_nodelist_mtx, "netgraph nodelist mutex", NULL,
3206 		    MTX_DEF);
3207 		mtx_init(&ngq_mtx, "netgraph item list mutex", NULL,
3208 		    MTX_DEF);
3209 #endif
3210 		ng_qzone = uma_zcreate("NetGraph items", sizeof(struct ng_item),
3211 		    NULL, NULL, NULL, NULL, UMA_ALIGN_CACHE, 0);
3212 		uma_zone_set_max(ng_qzone, maxalloc);
3213 		ng_qdzone = uma_zcreate("NetGraph data items",
3214 		    sizeof(struct ng_item), NULL, NULL, NULL, NULL,
3215 		    UMA_ALIGN_CACHE, 0);
3216 		uma_zone_set_max(ng_qdzone, maxdata);
3217 		/* Autoconfigure number of threads. */
3218 		if (numthreads <= 0)
3219 			numthreads = mp_ncpus;
3220 		/* Create threads. */
3221     		p = NULL; /* start with no process */
3222 		for (i = 0; i < numthreads; i++) {
3223 			if (kproc_kthread_add(ngthread, NULL, &p, &td,
3224 			    RFHIGHPID, 0, "ng_queue", "ng_queue%d", i)) {
3225 				numthreads = i;
3226 				break;
3227 			}
3228 		}
3229 		break;
3230 	case MOD_UNLOAD:
3231 		/* You can't unload it because an interface may be using it. */
3232 		error = EBUSY;
3233 		break;
3234 	default:
3235 		error = EOPNOTSUPP;
3236 		break;
3237 	}
3238 	return (error);
3239 }
3240 
3241 static moduledata_t netgraph_mod = {
3242 	"netgraph",
3243 	ngb_mod_event,
3244 	(NULL)
3245 };
3246 DECLARE_MODULE(netgraph, netgraph_mod, SI_SUB_NETGRAPH, SI_ORDER_FIRST);
3247 SYSCTL_NODE(_net, OID_AUTO, graph, CTLFLAG_RW, 0, "netgraph Family");
3248 SYSCTL_INT(_net_graph, OID_AUTO, abi_version, CTLFLAG_RD, 0, NG_ABI_VERSION,"");
3249 SYSCTL_INT(_net_graph, OID_AUTO, msg_version, CTLFLAG_RD, 0, NG_VERSION, "");
3250 
3251 #ifdef	NETGRAPH_DEBUG
3252 void
3253 dumphook (hook_p hook, char *file, int line)
3254 {
3255 	printf("hook: name %s, %d refs, Last touched:\n",
3256 		_NG_HOOK_NAME(hook), hook->hk_refs);
3257 	printf("	Last active @ %s, line %d\n",
3258 		hook->lastfile, hook->lastline);
3259 	if (line) {
3260 		printf(" problem discovered at file %s, line %d\n", file, line);
3261 #ifdef KDB
3262 		kdb_backtrace();
3263 #endif
3264 	}
3265 }
3266 
3267 void
3268 dumpnode(node_p node, char *file, int line)
3269 {
3270 	printf("node: ID [%x]: type '%s', %d hooks, flags 0x%x, %d refs, %s:\n",
3271 		_NG_NODE_ID(node), node->nd_type->name,
3272 		node->nd_numhooks, node->nd_flags,
3273 		node->nd_refs, node->nd_name);
3274 	printf("	Last active @ %s, line %d\n",
3275 		node->lastfile, node->lastline);
3276 	if (line) {
3277 		printf(" problem discovered at file %s, line %d\n", file, line);
3278 #ifdef KDB
3279 		kdb_backtrace();
3280 #endif
3281 	}
3282 }
3283 
3284 void
3285 dumpitem(item_p item, char *file, int line)
3286 {
3287 	printf(" ACTIVE item, last used at %s, line %d",
3288 		item->lastfile, item->lastline);
3289 	switch(item->el_flags & NGQF_TYPE) {
3290 	case NGQF_DATA:
3291 		printf(" - [data]\n");
3292 		break;
3293 	case NGQF_MESG:
3294 		printf(" - retaddr[%d]:\n", _NGI_RETADDR(item));
3295 		break;
3296 	case NGQF_FN:
3297 		printf(" - fn@%p (%p, %p, %p, %d (%x))\n",
3298 			_NGI_FN(item),
3299 			_NGI_NODE(item),
3300 			_NGI_HOOK(item),
3301 			item->body.fn.fn_arg1,
3302 			item->body.fn.fn_arg2,
3303 			item->body.fn.fn_arg2);
3304 		break;
3305 	case NGQF_FN2:
3306 		printf(" - fn2@%p (%p, %p, %p, %d (%x))\n",
3307 			_NGI_FN2(item),
3308 			_NGI_NODE(item),
3309 			_NGI_HOOK(item),
3310 			item->body.fn.fn_arg1,
3311 			item->body.fn.fn_arg2,
3312 			item->body.fn.fn_arg2);
3313 		break;
3314 	}
3315 	if (line) {
3316 		printf(" problem discovered at file %s, line %d\n", file, line);
3317 		if (_NGI_NODE(item)) {
3318 			printf("node %p ([%x])\n",
3319 				_NGI_NODE(item), ng_node2ID(_NGI_NODE(item)));
3320 		}
3321 	}
3322 }
3323 
3324 static void
3325 ng_dumpitems(void)
3326 {
3327 	item_p item;
3328 	int i = 1;
3329 	TAILQ_FOREACH(item, &ng_itemlist, all) {
3330 		printf("[%d] ", i++);
3331 		dumpitem(item, NULL, 0);
3332 	}
3333 }
3334 
3335 static void
3336 ng_dumpnodes(void)
3337 {
3338 	node_p node;
3339 	int i = 1;
3340 	mtx_lock(&ng_nodelist_mtx);
3341 	SLIST_FOREACH(node, &ng_allnodes, nd_all) {
3342 		printf("[%d] ", i++);
3343 		dumpnode(node, NULL, 0);
3344 	}
3345 	mtx_unlock(&ng_nodelist_mtx);
3346 }
3347 
3348 static void
3349 ng_dumphooks(void)
3350 {
3351 	hook_p hook;
3352 	int i = 1;
3353 	mtx_lock(&ng_nodelist_mtx);
3354 	SLIST_FOREACH(hook, &ng_allhooks, hk_all) {
3355 		printf("[%d] ", i++);
3356 		dumphook(hook, NULL, 0);
3357 	}
3358 	mtx_unlock(&ng_nodelist_mtx);
3359 }
3360 
3361 static int
3362 sysctl_debug_ng_dump_items(SYSCTL_HANDLER_ARGS)
3363 {
3364 	int error;
3365 	int val;
3366 	int i;
3367 
3368 	val = allocated;
3369 	i = 1;
3370 	error = sysctl_handle_int(oidp, &val, 0, req);
3371 	if (error != 0 || req->newptr == NULL)
3372 		return (error);
3373 	if (val == 42) {
3374 		ng_dumpitems();
3375 		ng_dumpnodes();
3376 		ng_dumphooks();
3377 	}
3378 	return (0);
3379 }
3380 
3381 SYSCTL_PROC(_debug, OID_AUTO, ng_dump_items, CTLTYPE_INT | CTLFLAG_RW,
3382     0, sizeof(int), sysctl_debug_ng_dump_items, "I", "Number of allocated items");
3383 #endif	/* NETGRAPH_DEBUG */
3384 
3385 /***********************************************************************
3386 * Worklist routines
3387 **********************************************************************/
3388 /*
3389  * Pick a node off the list of nodes with work,
3390  * try get an item to process off it. Remove the node from the list.
3391  */
3392 static void
3393 ngthread(void *arg)
3394 {
3395 	for (;;) {
3396 		node_p  node;
3397 
3398 		/* Get node from the worklist. */
3399 		NG_WORKLIST_LOCK();
3400 		while ((node = STAILQ_FIRST(&ng_worklist)) == NULL)
3401 			NG_WORKLIST_SLEEP();
3402 		STAILQ_REMOVE_HEAD(&ng_worklist, nd_input_queue.q_work);
3403 		NG_WORKLIST_UNLOCK();
3404 		CURVNET_SET(node->nd_vnet);
3405 		CTR3(KTR_NET, "%20s: node [%x] (%p) taken off worklist",
3406 		    __func__, node->nd_ID, node);
3407 		/*
3408 		 * We have the node. We also take over the reference
3409 		 * that the list had on it.
3410 		 * Now process as much as you can, until it won't
3411 		 * let you have another item off the queue.
3412 		 * All this time, keep the reference
3413 		 * that lets us be sure that the node still exists.
3414 		 * Let the reference go at the last minute.
3415 		 */
3416 		for (;;) {
3417 			item_p item;
3418 			int rw;
3419 
3420 			NG_QUEUE_LOCK(&node->nd_input_queue);
3421 			item = ng_dequeue(node, &rw);
3422 			if (item == NULL) {
3423 				node->nd_input_queue.q_flags2 &= ~NGQ2_WORKQ;
3424 				NG_QUEUE_UNLOCK(&node->nd_input_queue);
3425 				break; /* go look for another node */
3426 			} else {
3427 				NG_QUEUE_UNLOCK(&node->nd_input_queue);
3428 				NGI_GET_NODE(item, node); /* zaps stored node */
3429 				ng_apply_item(node, item, rw);
3430 				NG_NODE_UNREF(node);
3431 			}
3432 		}
3433 		NG_NODE_UNREF(node);
3434 		CURVNET_RESTORE();
3435 	}
3436 }
3437 
3438 /*
3439  * XXX
3440  * It's posible that a debugging NG_NODE_REF may need
3441  * to be outside the mutex zone
3442  */
3443 static void
3444 ng_worklist_add(node_p node)
3445 {
3446 
3447 	mtx_assert(&node->nd_input_queue.q_mtx, MA_OWNED);
3448 
3449 	if ((node->nd_input_queue.q_flags2 & NGQ2_WORKQ) == 0) {
3450 		/*
3451 		 * If we are not already on the work queue,
3452 		 * then put us on.
3453 		 */
3454 		node->nd_input_queue.q_flags2 |= NGQ2_WORKQ;
3455 		NG_NODE_REF(node); /* XXX safe in mutex? */
3456 		NG_WORKLIST_LOCK();
3457 		STAILQ_INSERT_TAIL(&ng_worklist, node, nd_input_queue.q_work);
3458 		NG_WORKLIST_UNLOCK();
3459 		CTR3(KTR_NET, "%20s: node [%x] (%p) put on worklist", __func__,
3460 		    node->nd_ID, node);
3461 		NG_WORKLIST_WAKEUP();
3462 	} else {
3463 		CTR3(KTR_NET, "%20s: node [%x] (%p) already on worklist",
3464 		    __func__, node->nd_ID, node);
3465 	}
3466 }
3467 
3468 /***********************************************************************
3469 * Externally useable functions to set up a queue item ready for sending
3470 ***********************************************************************/
3471 
3472 #ifdef	NETGRAPH_DEBUG
3473 #define	ITEM_DEBUG_CHECKS						\
3474 	do {								\
3475 		if (NGI_NODE(item) ) {					\
3476 			printf("item already has node");		\
3477 			kdb_enter(KDB_WHY_NETGRAPH, "has node");	\
3478 			NGI_CLR_NODE(item);				\
3479 		}							\
3480 		if (NGI_HOOK(item) ) {					\
3481 			printf("item already has hook");		\
3482 			kdb_enter(KDB_WHY_NETGRAPH, "has hook");	\
3483 			NGI_CLR_HOOK(item);				\
3484 		}							\
3485 	} while (0)
3486 #else
3487 #define ITEM_DEBUG_CHECKS
3488 #endif
3489 
3490 /*
3491  * Put mbuf into the item.
3492  * Hook and node references will be removed when the item is dequeued.
3493  * (or equivalent)
3494  * (XXX) Unsafe because no reference held by peer on remote node.
3495  * remote node might go away in this timescale.
3496  * We know the hooks can't go away because that would require getting
3497  * a writer item on both nodes and we must have at least a  reader
3498  * here to be able to do this.
3499  * Note that the hook loaded is the REMOTE hook.
3500  *
3501  * This is possibly in the critical path for new data.
3502  */
3503 item_p
3504 ng_package_data(struct mbuf *m, int flags)
3505 {
3506 	item_p item;
3507 
3508 	if ((item = ng_alloc_item(NGQF_DATA, flags)) == NULL) {
3509 		NG_FREE_M(m);
3510 		return (NULL);
3511 	}
3512 	ITEM_DEBUG_CHECKS;
3513 	item->el_flags |= NGQF_READER;
3514 	NGI_M(item) = m;
3515 	return (item);
3516 }
3517 
3518 /*
3519  * Allocate a queue item and put items into it..
3520  * Evaluate the address as this will be needed to queue it and
3521  * to work out what some of the fields should be.
3522  * Hook and node references will be removed when the item is dequeued.
3523  * (or equivalent)
3524  */
3525 item_p
3526 ng_package_msg(struct ng_mesg *msg, int flags)
3527 {
3528 	item_p item;
3529 
3530 	if ((item = ng_alloc_item(NGQF_MESG, flags)) == NULL) {
3531 		NG_FREE_MSG(msg);
3532 		return (NULL);
3533 	}
3534 	ITEM_DEBUG_CHECKS;
3535 	/* Messages items count as writers unless explicitly exempted. */
3536 	if (msg->header.cmd & NGM_READONLY)
3537 		item->el_flags |= NGQF_READER;
3538 	else
3539 		item->el_flags |= NGQF_WRITER;
3540 	/*
3541 	 * Set the current lasthook into the queue item
3542 	 */
3543 	NGI_MSG(item) = msg;
3544 	NGI_RETADDR(item) = 0;
3545 	return (item);
3546 }
3547 
3548 #define SET_RETADDR(item, here, retaddr)				\
3549 	do {	/* Data or fn items don't have retaddrs */		\
3550 		if ((item->el_flags & NGQF_TYPE) == NGQF_MESG) {	\
3551 			if (retaddr) {					\
3552 				NGI_RETADDR(item) = retaddr;		\
3553 			} else {					\
3554 				/*					\
3555 				 * The old return address should be ok.	\
3556 				 * If there isn't one, use the address	\
3557 				 * here.				\
3558 				 */					\
3559 				if (NGI_RETADDR(item) == 0) {		\
3560 					NGI_RETADDR(item)		\
3561 						= ng_node2ID(here);	\
3562 				}					\
3563 			}						\
3564 		}							\
3565 	} while (0)
3566 
3567 int
3568 ng_address_hook(node_p here, item_p item, hook_p hook, ng_ID_t retaddr)
3569 {
3570 	hook_p peer;
3571 	node_p peernode;
3572 	ITEM_DEBUG_CHECKS;
3573 	/*
3574 	 * Quick sanity check..
3575 	 * Since a hook holds a reference on it's node, once we know
3576 	 * that the peer is still connected (even if invalid,) we know
3577 	 * that the peer node is present, though maybe invalid.
3578 	 */
3579 	mtx_lock(&ng_topo_mtx);
3580 	if ((hook == NULL) || NG_HOOK_NOT_VALID(hook) ||
3581 	    NG_HOOK_NOT_VALID(peer = NG_HOOK_PEER(hook)) ||
3582 	    NG_NODE_NOT_VALID(peernode = NG_PEER_NODE(hook))) {
3583 		NG_FREE_ITEM(item);
3584 		TRAP_ERROR();
3585 		mtx_unlock(&ng_topo_mtx);
3586 		return (ENETDOWN);
3587 	}
3588 
3589 	/*
3590 	 * Transfer our interest to the other (peer) end.
3591 	 */
3592 	NG_HOOK_REF(peer);
3593 	NG_NODE_REF(peernode);
3594 	NGI_SET_HOOK(item, peer);
3595 	NGI_SET_NODE(item, peernode);
3596 	SET_RETADDR(item, here, retaddr);
3597 
3598 	mtx_unlock(&ng_topo_mtx);
3599 
3600 	return (0);
3601 }
3602 
3603 int
3604 ng_address_path(node_p here, item_p item, const char *address, ng_ID_t retaddr)
3605 {
3606 	node_p	dest = NULL;
3607 	hook_p	hook = NULL;
3608 	int	error;
3609 
3610 	ITEM_DEBUG_CHECKS;
3611 	/*
3612 	 * Note that ng_path2noderef increments the reference count
3613 	 * on the node for us if it finds one. So we don't have to.
3614 	 */
3615 	error = ng_path2noderef(here, address, &dest, &hook);
3616 	if (error) {
3617 		NG_FREE_ITEM(item);
3618 		return (error);
3619 	}
3620 	NGI_SET_NODE(item, dest);
3621 	if (hook)
3622 		NGI_SET_HOOK(item, hook);
3623 
3624 	SET_RETADDR(item, here, retaddr);
3625 	return (0);
3626 }
3627 
3628 int
3629 ng_address_ID(node_p here, item_p item, ng_ID_t ID, ng_ID_t retaddr)
3630 {
3631 	node_p dest;
3632 
3633 	ITEM_DEBUG_CHECKS;
3634 	/*
3635 	 * Find the target node.
3636 	 */
3637 	dest = ng_ID2noderef(ID); /* GETS REFERENCE! */
3638 	if (dest == NULL) {
3639 		NG_FREE_ITEM(item);
3640 		TRAP_ERROR();
3641 		return(EINVAL);
3642 	}
3643 	/* Fill out the contents */
3644 	NGI_SET_NODE(item, dest);
3645 	NGI_CLR_HOOK(item);
3646 	SET_RETADDR(item, here, retaddr);
3647 	return (0);
3648 }
3649 
3650 /*
3651  * special case to send a message to self (e.g. destroy node)
3652  * Possibly indicate an arrival hook too.
3653  * Useful for removing that hook :-)
3654  */
3655 item_p
3656 ng_package_msg_self(node_p here, hook_p hook, struct ng_mesg *msg)
3657 {
3658 	item_p item;
3659 
3660 	/*
3661 	 * Find the target node.
3662 	 * If there is a HOOK argument, then use that in preference
3663 	 * to the address.
3664 	 */
3665 	if ((item = ng_alloc_item(NGQF_MESG, NG_NOFLAGS)) == NULL) {
3666 		NG_FREE_MSG(msg);
3667 		return (NULL);
3668 	}
3669 
3670 	/* Fill out the contents */
3671 	item->el_flags |= NGQF_WRITER;
3672 	NG_NODE_REF(here);
3673 	NGI_SET_NODE(item, here);
3674 	if (hook) {
3675 		NG_HOOK_REF(hook);
3676 		NGI_SET_HOOK(item, hook);
3677 	}
3678 	NGI_MSG(item) = msg;
3679 	NGI_RETADDR(item) = ng_node2ID(here);
3680 	return (item);
3681 }
3682 
3683 /*
3684  * Send ng_item_fn function call to the specified node.
3685  */
3686 
3687 int
3688 ng_send_fn(node_p node, hook_p hook, ng_item_fn *fn, void * arg1, int arg2)
3689 {
3690 
3691 	return ng_send_fn1(node, hook, fn, arg1, arg2, NG_NOFLAGS);
3692 }
3693 
3694 int
3695 ng_send_fn1(node_p node, hook_p hook, ng_item_fn *fn, void * arg1, int arg2,
3696 	int flags)
3697 {
3698 	item_p item;
3699 
3700 	if ((item = ng_alloc_item(NGQF_FN, flags)) == NULL) {
3701 		return (ENOMEM);
3702 	}
3703 	item->el_flags |= NGQF_WRITER;
3704 	NG_NODE_REF(node); /* and one for the item */
3705 	NGI_SET_NODE(item, node);
3706 	if (hook) {
3707 		NG_HOOK_REF(hook);
3708 		NGI_SET_HOOK(item, hook);
3709 	}
3710 	NGI_FN(item) = fn;
3711 	NGI_ARG1(item) = arg1;
3712 	NGI_ARG2(item) = arg2;
3713 	return(ng_snd_item(item, flags));
3714 }
3715 
3716 /*
3717  * Send ng_item_fn2 function call to the specified node.
3718  *
3719  * If an optional pitem parameter is supplied, its apply
3720  * callback will be copied to the new item. If also NG_REUSE_ITEM
3721  * flag is set, no new item will be allocated, but pitem will
3722  * be used.
3723  */
3724 int
3725 ng_send_fn2(node_p node, hook_p hook, item_p pitem, ng_item_fn2 *fn, void *arg1,
3726 	int arg2, int flags)
3727 {
3728 	item_p item;
3729 
3730 	KASSERT((pitem != NULL || (flags & NG_REUSE_ITEM) == 0),
3731 	    ("%s: NG_REUSE_ITEM but no pitem", __func__));
3732 
3733 	/*
3734 	 * Allocate a new item if no supplied or
3735 	 * if we can't use supplied one.
3736 	 */
3737 	if (pitem == NULL || (flags & NG_REUSE_ITEM) == 0) {
3738 		if ((item = ng_alloc_item(NGQF_FN2, flags)) == NULL)
3739 			return (ENOMEM);
3740 		if (pitem != NULL)
3741 			item->apply = pitem->apply;
3742 	} else {
3743 		if ((item = ng_realloc_item(pitem, NGQF_FN2, flags)) == NULL)
3744 			return (ENOMEM);
3745 	}
3746 
3747 	item->el_flags = (item->el_flags & ~NGQF_RW) | NGQF_WRITER;
3748 	NG_NODE_REF(node); /* and one for the item */
3749 	NGI_SET_NODE(item, node);
3750 	if (hook) {
3751 		NG_HOOK_REF(hook);
3752 		NGI_SET_HOOK(item, hook);
3753 	}
3754 	NGI_FN2(item) = fn;
3755 	NGI_ARG1(item) = arg1;
3756 	NGI_ARG2(item) = arg2;
3757 	return(ng_snd_item(item, flags));
3758 }
3759 
3760 /*
3761  * Official timeout routines for Netgraph nodes.
3762  */
3763 static void
3764 ng_callout_trampoline(void *arg)
3765 {
3766 	item_p item = arg;
3767 
3768 	CURVNET_SET(NGI_NODE(item)->nd_vnet);
3769 	ng_snd_item(item, 0);
3770 	CURVNET_RESTORE();
3771 }
3772 
3773 int
3774 ng_callout(struct callout *c, node_p node, hook_p hook, int ticks,
3775     ng_item_fn *fn, void * arg1, int arg2)
3776 {
3777 	item_p item, oitem;
3778 
3779 	if ((item = ng_alloc_item(NGQF_FN, NG_NOFLAGS)) == NULL)
3780 		return (ENOMEM);
3781 
3782 	item->el_flags |= NGQF_WRITER;
3783 	NG_NODE_REF(node);		/* and one for the item */
3784 	NGI_SET_NODE(item, node);
3785 	if (hook) {
3786 		NG_HOOK_REF(hook);
3787 		NGI_SET_HOOK(item, hook);
3788 	}
3789 	NGI_FN(item) = fn;
3790 	NGI_ARG1(item) = arg1;
3791 	NGI_ARG2(item) = arg2;
3792 	oitem = c->c_arg;
3793 	if (callout_reset(c, ticks, &ng_callout_trampoline, item) == 1 &&
3794 	    oitem != NULL)
3795 		NG_FREE_ITEM(oitem);
3796 	return (0);
3797 }
3798 
3799 /* A special modified version of untimeout() */
3800 int
3801 ng_uncallout(struct callout *c, node_p node)
3802 {
3803 	item_p item;
3804 	int rval;
3805 
3806 	KASSERT(c != NULL, ("ng_uncallout: NULL callout"));
3807 	KASSERT(node != NULL, ("ng_uncallout: NULL node"));
3808 
3809 	rval = callout_stop(c);
3810 	item = c->c_arg;
3811 	/* Do an extra check */
3812 	if ((rval > 0) && (c->c_func == &ng_callout_trampoline) &&
3813 	    (NGI_NODE(item) == node)) {
3814 		/*
3815 		 * We successfully removed it from the queue before it ran
3816 		 * So now we need to unreference everything that was
3817 		 * given extra references. (NG_FREE_ITEM does this).
3818 		 */
3819 		NG_FREE_ITEM(item);
3820 	}
3821 	c->c_arg = NULL;
3822 
3823 	return (rval);
3824 }
3825 
3826 /*
3827  * Set the address, if none given, give the node here.
3828  */
3829 void
3830 ng_replace_retaddr(node_p here, item_p item, ng_ID_t retaddr)
3831 {
3832 	if (retaddr) {
3833 		NGI_RETADDR(item) = retaddr;
3834 	} else {
3835 		/*
3836 		 * The old return address should be ok.
3837 		 * If there isn't one, use the address here.
3838 		 */
3839 		NGI_RETADDR(item) = ng_node2ID(here);
3840 	}
3841 }
3842