xref: /freebsd/sys/netgraph/ng_base.c (revision e653b48c80fb85b2a10372d664a4b55dbdc51dae)
1 /*
2  * ng_base.c
3  *
4  * Copyright (c) 1996-1999 Whistle Communications, Inc.
5  * All rights reserved.
6  *
7  * Subject to the following obligations and disclaimer of warranty, use and
8  * redistribution of this software, in source or object code forms, with or
9  * without modifications are expressly permitted by Whistle Communications;
10  * provided, however, that:
11  * 1. Any and all reproductions of the source or object code must include the
12  *    copyright notice above and the following disclaimer of warranties; and
13  * 2. No rights are granted, in any manner or form, to use Whistle
14  *    Communications, Inc. trademarks, including the mark "WHISTLE
15  *    COMMUNICATIONS" on advertising, endorsements, or otherwise except as
16  *    such appears in the above copyright notice or in the software.
17  *
18  * THIS SOFTWARE IS BEING PROVIDED BY WHISTLE COMMUNICATIONS "AS IS", AND
19  * TO THE MAXIMUM EXTENT PERMITTED BY LAW, WHISTLE COMMUNICATIONS MAKES NO
20  * REPRESENTATIONS OR WARRANTIES, EXPRESS OR IMPLIED, REGARDING THIS SOFTWARE,
21  * INCLUDING WITHOUT LIMITATION, ANY AND ALL IMPLIED WARRANTIES OF
22  * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT.
23  * WHISTLE COMMUNICATIONS DOES NOT WARRANT, GUARANTEE, OR MAKE ANY
24  * REPRESENTATIONS REGARDING THE USE OF, OR THE RESULTS OF THE USE OF THIS
25  * SOFTWARE IN TERMS OF ITS CORRECTNESS, ACCURACY, RELIABILITY OR OTHERWISE.
26  * IN NO EVENT SHALL WHISTLE COMMUNICATIONS BE LIABLE FOR ANY DAMAGES
27  * RESULTING FROM OR ARISING OUT OF ANY USE OF THIS SOFTWARE, INCLUDING
28  * WITHOUT LIMITATION, ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
29  * PUNITIVE, OR CONSEQUENTIAL DAMAGES, PROCUREMENT OF SUBSTITUTE GOODS OR
30  * SERVICES, LOSS OF USE, DATA OR PROFITS, HOWEVER CAUSED AND UNDER ANY
31  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
32  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
33  * THIS SOFTWARE, EVEN IF WHISTLE COMMUNICATIONS IS ADVISED OF THE POSSIBILITY
34  * OF SUCH DAMAGE.
35  *
36  * Authors: Julian Elischer <julian@freebsd.org>
37  *          Archie Cobbs <archie@freebsd.org>
38  *
39  * $FreeBSD$
40  * $Whistle: ng_base.c,v 1.39 1999/01/28 23:54:53 julian Exp $
41  */
42 
43 /*
44  * This file implements the base netgraph code.
45  */
46 
47 #include <sys/param.h>
48 #include <sys/systm.h>
49 #include <sys/errno.h>
50 #include <sys/kdb.h>
51 #include <sys/kernel.h>
52 #include <sys/limits.h>
53 #include <sys/malloc.h>
54 #include <sys/syslog.h>
55 #include <sys/sysctl.h>
56 #include <sys/queue.h>
57 #include <sys/mbuf.h>
58 #include <sys/ctype.h>
59 #include <sys/sysctl.h>
60 
61 #include <net/netisr.h>
62 
63 #include <netgraph/ng_message.h>
64 #include <netgraph/netgraph.h>
65 #include <netgraph/ng_parse.h>
66 
67 MODULE_VERSION(netgraph, NG_ABI_VERSION);
68 
69 /* List of all active nodes */
70 static LIST_HEAD(, ng_node) ng_nodelist;
71 static struct mtx	ng_nodelist_mtx;
72 
73 /* Mutex that protects the free queue item list */
74 static struct mtx	ngq_mtx;
75 
76 #ifdef	NETGRAPH_DEBUG
77 
78 static SLIST_HEAD(, ng_node) ng_allnodes;
79 static LIST_HEAD(, ng_node) ng_freenodes; /* in debug, we never free() them */
80 static SLIST_HEAD(, ng_hook) ng_allhooks;
81 static LIST_HEAD(, ng_hook) ng_freehooks; /* in debug, we never free() them */
82 
83 static void ng_dumpitems(void);
84 static void ng_dumpnodes(void);
85 static void ng_dumphooks(void);
86 
87 #endif	/* NETGRAPH_DEBUG */
88 /*
89  * DEAD versions of the structures.
90  * In order to avoid races, it is sometimes neccesary to point
91  * at SOMETHING even though theoretically, the current entity is
92  * INVALID. Use these to avoid these races.
93  */
94 struct ng_type ng_deadtype = {
95 	NG_ABI_VERSION,
96 	"dead",
97 	NULL,	/* modevent */
98 	NULL,	/* constructor */
99 	NULL,	/* rcvmsg */
100 	NULL,	/* shutdown */
101 	NULL,	/* newhook */
102 	NULL,	/* findhook */
103 	NULL,	/* connect */
104 	NULL,	/* rcvdata */
105 	NULL,	/* disconnect */
106 	NULL, 	/* cmdlist */
107 };
108 
109 struct ng_node ng_deadnode = {
110 	"dead",
111 	&ng_deadtype,
112 	NGF_INVALID,
113 	1,	/* refs */
114 	0,	/* numhooks */
115 	NULL,	/* private */
116 	0,	/* ID */
117 	LIST_HEAD_INITIALIZER(ng_deadnode.hooks),
118 	{},	/* all_nodes list entry */
119 	{},	/* id hashtable list entry */
120 	{},	/* workqueue entry */
121 	{	0,
122 		{}, /* should never use! (should hang) */
123 		NULL,
124 		&ng_deadnode.nd_input_queue.queue,
125 		&ng_deadnode
126 	},
127 #ifdef	NETGRAPH_DEBUG
128 	ND_MAGIC,
129 	__FILE__,
130 	__LINE__,
131 	{NULL}
132 #endif	/* NETGRAPH_DEBUG */
133 };
134 
135 struct ng_hook ng_deadhook = {
136 	"dead",
137 	NULL,		/* private */
138 	HK_INVALID | HK_DEAD,
139 	1,		/* refs always >= 1 */
140 	&ng_deadhook,	/* Peer is self */
141 	&ng_deadnode,	/* attached to deadnode */
142 	{},		/* hooks list */
143 	NULL,		/* override rcvmsg() */
144 	NULL,		/* override rcvdata() */
145 #ifdef	NETGRAPH_DEBUG
146 	HK_MAGIC,
147 	__FILE__,
148 	__LINE__,
149 	{NULL}
150 #endif	/* NETGRAPH_DEBUG */
151 };
152 
153 /*
154  * END DEAD STRUCTURES
155  */
156 /* List nodes with unallocated work */
157 static TAILQ_HEAD(, ng_node) ng_worklist = TAILQ_HEAD_INITIALIZER(ng_worklist);
158 static struct mtx	ng_worklist_mtx;   /* MUST LOCK NODE FIRST */
159 
160 /* List of installed types */
161 static LIST_HEAD(, ng_type) ng_typelist;
162 static struct mtx	ng_typelist_mtx;
163 
164 /* Hash related definitions */
165 /* XXX Don't need to initialise them because it's a LIST */
166 #define NG_ID_HASH_SIZE 32 /* most systems wont need even this many */
167 static LIST_HEAD(, ng_node) ng_ID_hash[NG_ID_HASH_SIZE];
168 static struct mtx	ng_idhash_mtx;
169 /* Method to find a node.. used twice so do it here */
170 #define NG_IDHASH_FN(ID) ((ID) % (NG_ID_HASH_SIZE))
171 #define NG_IDHASH_FIND(ID, node)					\
172 	do { 								\
173 		mtx_assert(&ng_idhash_mtx, MA_OWNED);			\
174 		LIST_FOREACH(node, &ng_ID_hash[NG_IDHASH_FN(ID)],	\
175 						nd_idnodes) {		\
176 			if (NG_NODE_IS_VALID(node)			\
177 			&& (NG_NODE_ID(node) == ID)) {			\
178 				break;					\
179 			}						\
180 		}							\
181 	} while (0)
182 
183 
184 /* Internal functions */
185 static int	ng_add_hook(node_p node, const char *name, hook_p * hookp);
186 static int	ng_generic_msg(node_p here, item_p item, hook_p lasthook);
187 static ng_ID_t	ng_decodeidname(const char *name);
188 static int	ngb_mod_event(module_t mod, int event, void *data);
189 static void	ng_worklist_remove(node_p node);
190 static void	ngintr(void);
191 static int	ng_apply_item(node_p node, item_p item);
192 static void	ng_flush_input_queue(struct ng_queue * ngq);
193 static void	ng_setisr(node_p node);
194 static node_p	ng_ID2noderef(ng_ID_t ID);
195 static int	ng_con_nodes(node_p node, const char *name, node_p node2,
196 							const char *name2);
197 static void	ng_con_part2(node_p node, hook_p hook, void *arg1, int arg2);
198 static void	ng_con_part3(node_p node, hook_p hook, void *arg1, int arg2);
199 static int	ng_mkpeer(node_p node, const char *name,
200 						const char *name2, char *type);
201 
202 /* imported , these used to be externally visible, some may go back */
203 void	ng_destroy_hook(hook_p hook);
204 node_p	ng_name2noderef(node_p node, const char *name);
205 int	ng_path2noderef(node_p here, const char *path,
206 	node_p *dest, hook_p *lasthook);
207 int	ng_make_node(const char *type, node_p *nodepp);
208 int	ng_path_parse(char *addr, char **node, char **path, char **hook);
209 void	ng_rmnode(node_p node, hook_p dummy1, void *dummy2, int dummy3);
210 void	ng_unname(node_p node);
211 
212 
213 /* Our own netgraph malloc type */
214 MALLOC_DEFINE(M_NETGRAPH, "netgraph", "netgraph structures and ctrl messages");
215 MALLOC_DEFINE(M_NETGRAPH_HOOK, "netgraph_hook", "netgraph hook structures");
216 MALLOC_DEFINE(M_NETGRAPH_NODE, "netgraph_node", "netgraph node structures");
217 MALLOC_DEFINE(M_NETGRAPH_ITEM, "netgraph_item", "netgraph item structures");
218 MALLOC_DEFINE(M_NETGRAPH_MSG, "netgraph_msg", "netgraph name storage");
219 
220 /* Should not be visible outside this file */
221 
222 #define _NG_ALLOC_HOOK(hook) \
223 	MALLOC(hook, hook_p, sizeof(*hook), M_NETGRAPH_HOOK, M_NOWAIT | M_ZERO)
224 #define _NG_ALLOC_NODE(node) \
225 	MALLOC(node, node_p, sizeof(*node), M_NETGRAPH_NODE, M_NOWAIT | M_ZERO)
226 
227 #ifdef NETGRAPH_DEBUG /*----------------------------------------------*/
228 /*
229  * In debug mode:
230  * In an attempt to help track reference count screwups
231  * we do not free objects back to the malloc system, but keep them
232  * in a local cache where we can examine them and keep information safely
233  * after they have been freed.
234  * We use this scheme for nodes and hooks, and to some extent for items.
235  */
236 static __inline hook_p
237 ng_alloc_hook(void)
238 {
239 	hook_p hook;
240 	SLIST_ENTRY(ng_hook) temp;
241 	mtx_lock(&ng_nodelist_mtx);
242 	hook = LIST_FIRST(&ng_freehooks);
243 	if (hook) {
244 		LIST_REMOVE(hook, hk_hooks);
245 		bcopy(&hook->hk_all, &temp, sizeof(temp));
246 		bzero(hook, sizeof(struct ng_hook));
247 		bcopy(&temp, &hook->hk_all, sizeof(temp));
248 		mtx_unlock(&ng_nodelist_mtx);
249 		hook->hk_magic = HK_MAGIC;
250 	} else {
251 		mtx_unlock(&ng_nodelist_mtx);
252 		_NG_ALLOC_HOOK(hook);
253 		if (hook) {
254 			hook->hk_magic = HK_MAGIC;
255 			mtx_lock(&ng_nodelist_mtx);
256 			SLIST_INSERT_HEAD(&ng_allhooks, hook, hk_all);
257 			mtx_unlock(&ng_nodelist_mtx);
258 		}
259 	}
260 	return (hook);
261 }
262 
263 static __inline node_p
264 ng_alloc_node(void)
265 {
266 	node_p node;
267 	SLIST_ENTRY(ng_node) temp;
268 	mtx_lock(&ng_nodelist_mtx);
269 	node = LIST_FIRST(&ng_freenodes);
270 	if (node) {
271 		LIST_REMOVE(node, nd_nodes);
272 		bcopy(&node->nd_all, &temp, sizeof(temp));
273 		bzero(node, sizeof(struct ng_node));
274 		bcopy(&temp, &node->nd_all, sizeof(temp));
275 		mtx_unlock(&ng_nodelist_mtx);
276 		node->nd_magic = ND_MAGIC;
277 	} else {
278 		mtx_unlock(&ng_nodelist_mtx);
279 		_NG_ALLOC_NODE(node);
280 		if (node) {
281 			node->nd_magic = ND_MAGIC;
282 			mtx_lock(&ng_nodelist_mtx);
283 			SLIST_INSERT_HEAD(&ng_allnodes, node, nd_all);
284 			mtx_unlock(&ng_nodelist_mtx);
285 		}
286 	}
287 	return (node);
288 }
289 
290 #define NG_ALLOC_HOOK(hook) do { (hook) = ng_alloc_hook(); } while (0)
291 #define NG_ALLOC_NODE(node) do { (node) = ng_alloc_node(); } while (0)
292 
293 
294 #define NG_FREE_HOOK(hook)						\
295 	do {								\
296 		mtx_lock(&ng_nodelist_mtx);			\
297 		LIST_INSERT_HEAD(&ng_freehooks, hook, hk_hooks);	\
298 		hook->hk_magic = 0;					\
299 		mtx_unlock(&ng_nodelist_mtx);			\
300 	} while (0)
301 
302 #define NG_FREE_NODE(node)						\
303 	do {								\
304 		mtx_lock(&ng_nodelist_mtx);			\
305 		LIST_INSERT_HEAD(&ng_freenodes, node, nd_nodes);	\
306 		node->nd_magic = 0;					\
307 		mtx_unlock(&ng_nodelist_mtx);			\
308 	} while (0)
309 
310 #else /* NETGRAPH_DEBUG */ /*----------------------------------------------*/
311 
312 #define NG_ALLOC_HOOK(hook) _NG_ALLOC_HOOK(hook)
313 #define NG_ALLOC_NODE(node) _NG_ALLOC_NODE(node)
314 
315 #define NG_FREE_HOOK(hook) do { FREE((hook), M_NETGRAPH_HOOK); } while (0)
316 #define NG_FREE_NODE(node) do { FREE((node), M_NETGRAPH_NODE); } while (0)
317 
318 #endif /* NETGRAPH_DEBUG */ /*----------------------------------------------*/
319 
320 /* Warning: Generally use NG_FREE_ITEM() instead */
321 #define NG_FREE_ITEM_REAL(item) do { FREE((item), M_NETGRAPH_ITEM); } while (0)
322 
323 
324 /* Set this to kdb_enter("X") to catch all errors as they occur */
325 #ifndef TRAP_ERROR
326 #define TRAP_ERROR()
327 #endif
328 
329 static	ng_ID_t nextID = 1;
330 
331 #ifdef INVARIANTS
332 #define CHECK_DATA_MBUF(m)	do {					\
333 		struct mbuf *n;						\
334 		int total;						\
335 									\
336 		M_ASSERTPKTHDR(m);					\
337 		for (total = 0, n = (m); n != NULL; n = n->m_next)	\
338 			total += n->m_len;				\
339 		if ((m)->m_pkthdr.len != total) {			\
340 			panic("%s: %d != %d",				\
341 			    __func__, (m)->m_pkthdr.len, total);	\
342 		}							\
343 	} while (0)
344 #else
345 #define CHECK_DATA_MBUF(m)
346 #endif
347 
348 
349 /************************************************************************
350 	Parse type definitions for generic messages
351 ************************************************************************/
352 
353 /* Handy structure parse type defining macro */
354 #define DEFINE_PARSE_STRUCT_TYPE(lo, up, args)				\
355 static const struct ng_parse_struct_field				\
356 	ng_ ## lo ## _type_fields[] = NG_GENERIC_ ## up ## _INFO args;	\
357 static const struct ng_parse_type ng_generic_ ## lo ## _type = {	\
358 	&ng_parse_struct_type,						\
359 	&ng_ ## lo ## _type_fields					\
360 }
361 
362 DEFINE_PARSE_STRUCT_TYPE(mkpeer, MKPEER, ());
363 DEFINE_PARSE_STRUCT_TYPE(connect, CONNECT, ());
364 DEFINE_PARSE_STRUCT_TYPE(name, NAME, ());
365 DEFINE_PARSE_STRUCT_TYPE(rmhook, RMHOOK, ());
366 DEFINE_PARSE_STRUCT_TYPE(nodeinfo, NODEINFO, ());
367 DEFINE_PARSE_STRUCT_TYPE(typeinfo, TYPEINFO, ());
368 DEFINE_PARSE_STRUCT_TYPE(linkinfo, LINKINFO, (&ng_generic_nodeinfo_type));
369 
370 /* Get length of an array when the length is stored as a 32 bit
371    value immediately preceding the array -- as with struct namelist
372    and struct typelist. */
373 static int
374 ng_generic_list_getLength(const struct ng_parse_type *type,
375 	const u_char *start, const u_char *buf)
376 {
377 	return *((const u_int32_t *)(buf - 4));
378 }
379 
380 /* Get length of the array of struct linkinfo inside a struct hooklist */
381 static int
382 ng_generic_linkinfo_getLength(const struct ng_parse_type *type,
383 	const u_char *start, const u_char *buf)
384 {
385 	const struct hooklist *hl = (const struct hooklist *)start;
386 
387 	return hl->nodeinfo.hooks;
388 }
389 
390 /* Array type for a variable length array of struct namelist */
391 static const struct ng_parse_array_info ng_nodeinfoarray_type_info = {
392 	&ng_generic_nodeinfo_type,
393 	&ng_generic_list_getLength
394 };
395 static const struct ng_parse_type ng_generic_nodeinfoarray_type = {
396 	&ng_parse_array_type,
397 	&ng_nodeinfoarray_type_info
398 };
399 
400 /* Array type for a variable length array of struct typelist */
401 static const struct ng_parse_array_info ng_typeinfoarray_type_info = {
402 	&ng_generic_typeinfo_type,
403 	&ng_generic_list_getLength
404 };
405 static const struct ng_parse_type ng_generic_typeinfoarray_type = {
406 	&ng_parse_array_type,
407 	&ng_typeinfoarray_type_info
408 };
409 
410 /* Array type for array of struct linkinfo in struct hooklist */
411 static const struct ng_parse_array_info ng_generic_linkinfo_array_type_info = {
412 	&ng_generic_linkinfo_type,
413 	&ng_generic_linkinfo_getLength
414 };
415 static const struct ng_parse_type ng_generic_linkinfo_array_type = {
416 	&ng_parse_array_type,
417 	&ng_generic_linkinfo_array_type_info
418 };
419 
420 DEFINE_PARSE_STRUCT_TYPE(typelist, TYPELIST, (&ng_generic_nodeinfoarray_type));
421 DEFINE_PARSE_STRUCT_TYPE(hooklist, HOOKLIST,
422 	(&ng_generic_nodeinfo_type, &ng_generic_linkinfo_array_type));
423 DEFINE_PARSE_STRUCT_TYPE(listnodes, LISTNODES,
424 	(&ng_generic_nodeinfoarray_type));
425 
426 /* List of commands and how to convert arguments to/from ASCII */
427 static const struct ng_cmdlist ng_generic_cmds[] = {
428 	{
429 	  NGM_GENERIC_COOKIE,
430 	  NGM_SHUTDOWN,
431 	  "shutdown",
432 	  NULL,
433 	  NULL
434 	},
435 	{
436 	  NGM_GENERIC_COOKIE,
437 	  NGM_MKPEER,
438 	  "mkpeer",
439 	  &ng_generic_mkpeer_type,
440 	  NULL
441 	},
442 	{
443 	  NGM_GENERIC_COOKIE,
444 	  NGM_CONNECT,
445 	  "connect",
446 	  &ng_generic_connect_type,
447 	  NULL
448 	},
449 	{
450 	  NGM_GENERIC_COOKIE,
451 	  NGM_NAME,
452 	  "name",
453 	  &ng_generic_name_type,
454 	  NULL
455 	},
456 	{
457 	  NGM_GENERIC_COOKIE,
458 	  NGM_RMHOOK,
459 	  "rmhook",
460 	  &ng_generic_rmhook_type,
461 	  NULL
462 	},
463 	{
464 	  NGM_GENERIC_COOKIE,
465 	  NGM_NODEINFO,
466 	  "nodeinfo",
467 	  NULL,
468 	  &ng_generic_nodeinfo_type
469 	},
470 	{
471 	  NGM_GENERIC_COOKIE,
472 	  NGM_LISTHOOKS,
473 	  "listhooks",
474 	  NULL,
475 	  &ng_generic_hooklist_type
476 	},
477 	{
478 	  NGM_GENERIC_COOKIE,
479 	  NGM_LISTNAMES,
480 	  "listnames",
481 	  NULL,
482 	  &ng_generic_listnodes_type	/* same as NGM_LISTNODES */
483 	},
484 	{
485 	  NGM_GENERIC_COOKIE,
486 	  NGM_LISTNODES,
487 	  "listnodes",
488 	  NULL,
489 	  &ng_generic_listnodes_type
490 	},
491 	{
492 	  NGM_GENERIC_COOKIE,
493 	  NGM_LISTTYPES,
494 	  "listtypes",
495 	  NULL,
496 	  &ng_generic_typeinfo_type
497 	},
498 	{
499 	  NGM_GENERIC_COOKIE,
500 	  NGM_TEXT_CONFIG,
501 	  "textconfig",
502 	  NULL,
503 	  &ng_parse_string_type
504 	},
505 	{
506 	  NGM_GENERIC_COOKIE,
507 	  NGM_TEXT_STATUS,
508 	  "textstatus",
509 	  NULL,
510 	  &ng_parse_string_type
511 	},
512 	{
513 	  NGM_GENERIC_COOKIE,
514 	  NGM_ASCII2BINARY,
515 	  "ascii2binary",
516 	  &ng_parse_ng_mesg_type,
517 	  &ng_parse_ng_mesg_type
518 	},
519 	{
520 	  NGM_GENERIC_COOKIE,
521 	  NGM_BINARY2ASCII,
522 	  "binary2ascii",
523 	  &ng_parse_ng_mesg_type,
524 	  &ng_parse_ng_mesg_type
525 	},
526 	{ 0 }
527 };
528 
529 /************************************************************************
530 			Node routines
531 ************************************************************************/
532 
533 /*
534  * Instantiate a node of the requested type
535  */
536 int
537 ng_make_node(const char *typename, node_p *nodepp)
538 {
539 	struct ng_type *type;
540 	int	error;
541 
542 	/* Check that the type makes sense */
543 	if (typename == NULL) {
544 		TRAP_ERROR();
545 		return (EINVAL);
546 	}
547 
548 	/* Locate the node type. If we fail we return. Do not try to load
549 	 * module.
550 	 */
551 	if ((type = ng_findtype(typename)) == NULL)
552 		return (ENXIO);
553 
554 	/*
555 	 * If we have a constructor, then make the node and
556 	 * call the constructor to do type specific initialisation.
557 	 */
558 	if (type->constructor != NULL) {
559 		if ((error = ng_make_node_common(type, nodepp)) == 0) {
560 			if ((error = ((*type->constructor)(*nodepp)) != 0)) {
561 				NG_NODE_UNREF(*nodepp);
562 			}
563 		}
564 	} else {
565 		/*
566 		 * Node has no constructor. We cannot ask for one
567 		 * to be made. It must be brought into existance by
568 		 * some external agency. The external agency should
569 		 * call ng_make_node_common() directly to get the
570 		 * netgraph part initialised.
571 		 */
572 		TRAP_ERROR();
573 		error = EINVAL;
574 	}
575 	return (error);
576 }
577 
578 /*
579  * Generic node creation. Called by node initialisation for externally
580  * instantiated nodes (e.g. hardware, sockets, etc ).
581  * The returned node has a reference count of 1.
582  */
583 int
584 ng_make_node_common(struct ng_type *type, node_p *nodepp)
585 {
586 	node_p node;
587 
588 	/* Require the node type to have been already installed */
589 	if (ng_findtype(type->name) == NULL) {
590 		TRAP_ERROR();
591 		return (EINVAL);
592 	}
593 
594 	/* Make a node and try attach it to the type */
595 	NG_ALLOC_NODE(node);
596 	if (node == NULL) {
597 		TRAP_ERROR();
598 		return (ENOMEM);
599 	}
600 	node->nd_type = type;
601 	NG_NODE_REF(node);				/* note reference */
602 	type->refs++;
603 
604 	mtx_init(&node->nd_input_queue.q_mtx, "ng_node", NULL, MTX_SPIN);
605 	node->nd_input_queue.queue = NULL;
606 	node->nd_input_queue.last = &node->nd_input_queue.queue;
607 	node->nd_input_queue.q_flags = 0;
608 	node->nd_input_queue.q_node = node;
609 
610 	/* Initialize hook list for new node */
611 	LIST_INIT(&node->nd_hooks);
612 
613 	/* Link us into the node linked list */
614 	mtx_lock(&ng_nodelist_mtx);
615 	LIST_INSERT_HEAD(&ng_nodelist, node, nd_nodes);
616 	mtx_unlock(&ng_nodelist_mtx);
617 
618 
619 	/* get an ID and put us in the hash chain */
620 	mtx_lock(&ng_idhash_mtx);
621 	for (;;) { /* wrap protection, even if silly */
622 		node_p node2 = NULL;
623 		node->nd_ID = nextID++; /* 137/second for 1 year before wrap */
624 
625 		/* Is there a problem with the new number? */
626 		NG_IDHASH_FIND(node->nd_ID, node2); /* already taken? */
627 		if ((node->nd_ID != 0) && (node2 == NULL)) {
628 			break;
629 		}
630 	}
631 	LIST_INSERT_HEAD(&ng_ID_hash[NG_IDHASH_FN(node->nd_ID)],
632 							node, nd_idnodes);
633 	mtx_unlock(&ng_idhash_mtx);
634 
635 	/* Done */
636 	*nodepp = node;
637 	return (0);
638 }
639 
640 /*
641  * Forceably start the shutdown process on a node. Either call
642  * it's shutdown method, or do the default shutdown if there is
643  * no type-specific method.
644  *
645  * We can only be called form a shutdown message, so we know we have
646  * a writer lock, and therefore exclusive access. It also means
647  * that we should not be on the work queue, but we check anyhow.
648  *
649  * Persistent node types must have a type-specific method which
650  * Allocates a new node in which case, this one is irretrievably going away,
651  * or cleans up anything it needs, and just makes the node valid again,
652  * in which case we allow the node to survive.
653  *
654  * XXX We need to think of how to tell a persistant node that we
655  * REALLY need to go away because the hardware has gone or we
656  * are rebooting.... etc.
657  */
658 void
659 ng_rmnode(node_p node, hook_p dummy1, void *dummy2, int dummy3)
660 {
661 	hook_p hook;
662 
663 	/* Check if it's already shutting down */
664 	if ((node->nd_flags & NGF_CLOSING) != 0)
665 		return;
666 
667 	if (node == &ng_deadnode) {
668 		printf ("shutdown called on deadnode\n");
669 		return;
670 	}
671 
672 	/* Add an extra reference so it doesn't go away during this */
673 	NG_NODE_REF(node);
674 
675 	/*
676 	 * Mark it invalid so any newcomers know not to try use it
677 	 * Also add our own mark so we can't recurse
678 	 * note that NGF_INVALID does not do this as it's also set during
679 	 * creation
680 	 */
681 	node->nd_flags |= NGF_INVALID|NGF_CLOSING;
682 
683 	/* If node has its pre-shutdown method, then call it first*/
684 	if (node->nd_type && node->nd_type->close)
685 		(*node->nd_type->close)(node);
686 
687 	/* Notify all remaining connected nodes to disconnect */
688 	while ((hook = LIST_FIRST(&node->nd_hooks)) != NULL)
689 		ng_destroy_hook(hook);
690 
691 	/*
692 	 * Drain the input queue forceably.
693 	 * it has no hooks so what's it going to do, bleed on someone?
694 	 * Theoretically we came here from a queue entry that was added
695 	 * Just before the queue was closed, so it should be empty anyway.
696 	 * Also removes us from worklist if needed.
697 	 */
698 	ng_flush_input_queue(&node->nd_input_queue);
699 
700 	/* Ask the type if it has anything to do in this case */
701 	if (node->nd_type && node->nd_type->shutdown) {
702 		(*node->nd_type->shutdown)(node);
703 		if (NG_NODE_IS_VALID(node)) {
704 			/*
705 			 * Well, blow me down if the node code hasn't declared
706 			 * that it doesn't want to die.
707 			 * Presumably it is a persistant node.
708 			 * If we REALLY want it to go away,
709 			 *  e.g. hardware going away,
710 			 * Our caller should set NGF_REALLY_DIE in nd_flags.
711 			 */
712 			node->nd_flags &= ~(NGF_INVALID|NGF_CLOSING);
713 			NG_NODE_UNREF(node); /* Assume they still have theirs */
714 			return;
715 		}
716 	} else {				/* do the default thing */
717 		NG_NODE_UNREF(node);
718 	}
719 
720 	ng_unname(node); /* basically a NOP these days */
721 
722 	/*
723 	 * Remove extra reference, possibly the last
724 	 * Possible other holders of references may include
725 	 * timeout callouts, but theoretically the node's supposed to
726 	 * have cancelled them. Possibly hardware dependencies may
727 	 * force a driver to 'linger' with a reference.
728 	 */
729 	NG_NODE_UNREF(node);
730 }
731 
732 #ifdef	NETGRAPH_DEBUG
733 void
734 ng_ref_node(node_p node)
735 {
736 	_NG_NODE_REF(node);
737 }
738 #endif
739 
740 /*
741  * Remove a reference to the node, possibly the last.
742  * deadnode always acts as it it were the last.
743  */
744 int
745 ng_unref_node(node_p node)
746 {
747 	int     v;
748 
749 	if (node == &ng_deadnode) {
750 		return (0);
751 	}
752 
753 	do {
754 		v = node->nd_refs - 1;
755 	} while (! atomic_cmpset_int(&node->nd_refs, v + 1, v));
756 
757 	if (v == 0) { /* we were the last */
758 
759 		mtx_lock(&ng_nodelist_mtx);
760 		node->nd_type->refs--; /* XXX maybe should get types lock? */
761 		LIST_REMOVE(node, nd_nodes);
762 		mtx_unlock(&ng_nodelist_mtx);
763 
764 		mtx_lock(&ng_idhash_mtx);
765 		LIST_REMOVE(node, nd_idnodes);
766 		mtx_unlock(&ng_idhash_mtx);
767 
768 		mtx_destroy(&node->nd_input_queue.q_mtx);
769 		NG_FREE_NODE(node);
770 	}
771 	return (v);
772 }
773 
774 /************************************************************************
775 			Node ID handling
776 ************************************************************************/
777 static node_p
778 ng_ID2noderef(ng_ID_t ID)
779 {
780 	node_p node;
781 	mtx_lock(&ng_idhash_mtx);
782 	NG_IDHASH_FIND(ID, node);
783 	if(node)
784 		NG_NODE_REF(node);
785 	mtx_unlock(&ng_idhash_mtx);
786 	return(node);
787 }
788 
789 ng_ID_t
790 ng_node2ID(node_p node)
791 {
792 	return (node ? NG_NODE_ID(node) : 0);
793 }
794 
795 /************************************************************************
796 			Node name handling
797 ************************************************************************/
798 
799 /*
800  * Assign a node a name. Once assigned, the name cannot be changed.
801  */
802 int
803 ng_name_node(node_p node, const char *name)
804 {
805 	int i;
806 	node_p node2;
807 
808 	/* Check the name is valid */
809 	for (i = 0; i < NG_NODESIZ; i++) {
810 		if (name[i] == '\0' || name[i] == '.' || name[i] == ':')
811 			break;
812 	}
813 	if (i == 0 || name[i] != '\0') {
814 		TRAP_ERROR();
815 		return (EINVAL);
816 	}
817 	if (ng_decodeidname(name) != 0) { /* valid IDs not allowed here */
818 		TRAP_ERROR();
819 		return (EINVAL);
820 	}
821 
822 	/* Check the name isn't already being used */
823 	if ((node2 = ng_name2noderef(node, name)) != NULL) {
824 		NG_NODE_UNREF(node2);
825 		TRAP_ERROR();
826 		return (EADDRINUSE);
827 	}
828 
829 	/* copy it */
830 	strlcpy(NG_NODE_NAME(node), name, NG_NODESIZ);
831 
832 	return (0);
833 }
834 
835 /*
836  * Find a node by absolute name. The name should NOT end with ':'
837  * The name "." means "this node" and "[xxx]" means "the node
838  * with ID (ie, at address) xxx".
839  *
840  * Returns the node if found, else NULL.
841  * Eventually should add something faster than a sequential search.
842  * Note it aquires a reference on the node so you can be sure it's still there.
843  */
844 node_p
845 ng_name2noderef(node_p here, const char *name)
846 {
847 	node_p node;
848 	ng_ID_t temp;
849 
850 	/* "." means "this node" */
851 	if (strcmp(name, ".") == 0) {
852 		NG_NODE_REF(here);
853 		return(here);
854 	}
855 
856 	/* Check for name-by-ID */
857 	if ((temp = ng_decodeidname(name)) != 0) {
858 		return (ng_ID2noderef(temp));
859 	}
860 
861 	/* Find node by name */
862 	mtx_lock(&ng_nodelist_mtx);
863 	LIST_FOREACH(node, &ng_nodelist, nd_nodes) {
864 		if (NG_NODE_IS_VALID(node)
865 		&& NG_NODE_HAS_NAME(node)
866 		&& (strcmp(NG_NODE_NAME(node), name) == 0)) {
867 			break;
868 		}
869 	}
870 	if (node)
871 		NG_NODE_REF(node);
872 	mtx_unlock(&ng_nodelist_mtx);
873 	return (node);
874 }
875 
876 /*
877  * Decode an ID name, eg. "[f03034de]". Returns 0 if the
878  * string is not valid, otherwise returns the value.
879  */
880 static ng_ID_t
881 ng_decodeidname(const char *name)
882 {
883 	const int len = strlen(name);
884 	char *eptr;
885 	u_long val;
886 
887 	/* Check for proper length, brackets, no leading junk */
888 	if ((len < 3)
889 	|| (name[0] != '[')
890 	|| (name[len - 1] != ']')
891 	|| (!isxdigit(name[1]))) {
892 		return ((ng_ID_t)0);
893 	}
894 
895 	/* Decode number */
896 	val = strtoul(name + 1, &eptr, 16);
897 	if ((eptr - name != len - 1)
898 	|| (val == ULONG_MAX)
899 	|| (val == 0)) {
900 		return ((ng_ID_t)0);
901 	}
902 	return (ng_ID_t)val;
903 }
904 
905 /*
906  * Remove a name from a node. This should only be called
907  * when shutting down and removing the node.
908  * IF we allow name changing this may be more resurected.
909  */
910 void
911 ng_unname(node_p node)
912 {
913 }
914 
915 /************************************************************************
916 			Hook routines
917  Names are not optional. Hooks are always connected, except for a
918  brief moment within these routines. On invalidation or during creation
919  they are connected to the 'dead' hook.
920 ************************************************************************/
921 
922 /*
923  * Remove a hook reference
924  */
925 void
926 ng_unref_hook(hook_p hook)
927 {
928 	int     v;
929 
930 	if (hook == &ng_deadhook) {
931 		return;
932 	}
933 	do {
934 		v = hook->hk_refs;
935 	} while (! atomic_cmpset_int(&hook->hk_refs, v, v - 1));
936 
937 	if (v == 1) { /* we were the last */
938 		if (_NG_HOOK_NODE(hook)) { /* it'll probably be ng_deadnode */
939 			_NG_NODE_UNREF((_NG_HOOK_NODE(hook)));
940 			hook->hk_node = NULL;
941 		}
942 		NG_FREE_HOOK(hook);
943 	}
944 }
945 
946 /*
947  * Add an unconnected hook to a node. Only used internally.
948  * Assumes node is locked. (XXX not yet true )
949  */
950 static int
951 ng_add_hook(node_p node, const char *name, hook_p *hookp)
952 {
953 	hook_p hook;
954 	int error = 0;
955 
956 	/* Check that the given name is good */
957 	if (name == NULL) {
958 		TRAP_ERROR();
959 		return (EINVAL);
960 	}
961 	if (ng_findhook(node, name) != NULL) {
962 		TRAP_ERROR();
963 		return (EEXIST);
964 	}
965 
966 	/* Allocate the hook and link it up */
967 	NG_ALLOC_HOOK(hook);
968 	if (hook == NULL) {
969 		TRAP_ERROR();
970 		return (ENOMEM);
971 	}
972 	hook->hk_refs = 1;		/* add a reference for us to return */
973 	hook->hk_flags = HK_INVALID;
974 	hook->hk_peer = &ng_deadhook;	/* start off this way */
975 	hook->hk_node = node;
976 	NG_NODE_REF(node);		/* each hook counts as a reference */
977 
978 	/* Set hook name */
979 	strlcpy(NG_HOOK_NAME(hook), name, NG_HOOKSIZ);
980 
981 	/*
982 	 * Check if the node type code has something to say about it
983 	 * If it fails, the unref of the hook will also unref the node.
984 	 */
985 	if (node->nd_type->newhook != NULL) {
986 		if ((error = (*node->nd_type->newhook)(node, hook, name))) {
987 			NG_HOOK_UNREF(hook);	/* this frees the hook */
988 			return (error);
989 		}
990 	}
991 	/*
992 	 * The 'type' agrees so far, so go ahead and link it in.
993 	 * We'll ask again later when we actually connect the hooks.
994 	 */
995 	LIST_INSERT_HEAD(&node->nd_hooks, hook, hk_hooks);
996 	node->nd_numhooks++;
997 	NG_HOOK_REF(hook);	/* one for the node */
998 
999 	if (hookp)
1000 		*hookp = hook;
1001 	return (0);
1002 }
1003 
1004 /*
1005  * Find a hook
1006  *
1007  * Node types may supply their own optimized routines for finding
1008  * hooks.  If none is supplied, we just do a linear search.
1009  * XXX Possibly we should add a reference to the hook?
1010  */
1011 hook_p
1012 ng_findhook(node_p node, const char *name)
1013 {
1014 	hook_p hook;
1015 
1016 	if (node->nd_type->findhook != NULL)
1017 		return (*node->nd_type->findhook)(node, name);
1018 	LIST_FOREACH(hook, &node->nd_hooks, hk_hooks) {
1019 		if (NG_HOOK_IS_VALID(hook)
1020 		&& (strcmp(NG_HOOK_NAME(hook), name) == 0))
1021 			return (hook);
1022 	}
1023 	return (NULL);
1024 }
1025 
1026 /*
1027  * Destroy a hook
1028  *
1029  * As hooks are always attached, this really destroys two hooks.
1030  * The one given, and the one attached to it. Disconnect the hooks
1031  * from each other first. We reconnect the peer hook to the 'dead'
1032  * hook so that it can still exist after we depart. We then
1033  * send the peer its own destroy message. This ensures that we only
1034  * interact with the peer's structures when it is locked processing that
1035  * message. We hold a reference to the peer hook so we are guaranteed that
1036  * the peer hook and node are still going to exist until
1037  * we are finished there as the hook holds a ref on the node.
1038  * We run this same code again on the peer hook, but that time it is already
1039  * attached to the 'dead' hook.
1040  *
1041  * This routine is called at all stages of hook creation
1042  * on error detection and must be able to handle any such stage.
1043  */
1044 void
1045 ng_destroy_hook(hook_p hook)
1046 {
1047 	hook_p peer = NG_HOOK_PEER(hook);
1048 	node_p node = NG_HOOK_NODE(hook);
1049 
1050 	if (hook == &ng_deadhook) {	/* better safe than sorry */
1051 		printf("ng_destroy_hook called on deadhook\n");
1052 		return;
1053 	}
1054 	hook->hk_flags |= HK_INVALID;		/* as soon as possible */
1055 	if (peer && (peer != &ng_deadhook)) {
1056 		/*
1057 		 * Set the peer to point to ng_deadhook
1058 		 * from this moment on we are effectively independent it.
1059 		 * send it an rmhook message of it's own.
1060 		 */
1061 		peer->hk_peer = &ng_deadhook;	/* They no longer know us */
1062 		hook->hk_peer = &ng_deadhook;	/* Nor us, them */
1063 		if (NG_HOOK_NODE(peer) == &ng_deadnode) {
1064 			/*
1065 			 * If it's already divorced from a node,
1066 			 * just free it.
1067 			 */
1068 			/* nothing */
1069 		} else {
1070 			ng_rmhook_self(peer); 	/* Send it a surprise */
1071 		}
1072 		NG_HOOK_UNREF(peer);		/* account for peer link */
1073 		NG_HOOK_UNREF(hook);		/* account for peer link */
1074 	}
1075 
1076 	/*
1077 	 * Remove the hook from the node's list to avoid possible recursion
1078 	 * in case the disconnection results in node shutdown.
1079 	 */
1080 	if (node == &ng_deadnode) { /* happens if called from ng_con_nodes() */
1081 		return;
1082 	}
1083 	LIST_REMOVE(hook, hk_hooks);
1084 	node->nd_numhooks--;
1085 	if (node->nd_type->disconnect) {
1086 		/*
1087 		 * The type handler may elect to destroy the node so don't
1088 		 * trust its existance after this point. (except
1089 		 * that we still hold a reference on it. (which we
1090 		 * inherrited from the hook we are destroying)
1091 		 */
1092 		(*node->nd_type->disconnect) (hook);
1093 	}
1094 
1095 	/*
1096 	 * Note that because we will point to ng_deadnode, the original node
1097 	 * is not decremented automatically so we do that manually.
1098 	 */
1099 	_NG_HOOK_NODE(hook) = &ng_deadnode;
1100 	NG_NODE_UNREF(node);	/* We no longer point to it so adjust count */
1101 	NG_HOOK_UNREF(hook);	/* Account for linkage (in list) to node */
1102 }
1103 
1104 /*
1105  * Take two hooks on a node and merge the connection so that the given node
1106  * is effectively bypassed.
1107  */
1108 int
1109 ng_bypass(hook_p hook1, hook_p hook2)
1110 {
1111 	if (hook1->hk_node != hook2->hk_node) {
1112 		TRAP_ERROR();
1113 		return (EINVAL);
1114 	}
1115 	hook1->hk_peer->hk_peer = hook2->hk_peer;
1116 	hook2->hk_peer->hk_peer = hook1->hk_peer;
1117 
1118 	hook1->hk_peer = &ng_deadhook;
1119 	hook2->hk_peer = &ng_deadhook;
1120 
1121 	/* XXX If we ever cache methods on hooks update them as well */
1122 	ng_destroy_hook(hook1);
1123 	ng_destroy_hook(hook2);
1124 	return (0);
1125 }
1126 
1127 /*
1128  * Install a new netgraph type
1129  */
1130 int
1131 ng_newtype(struct ng_type *tp)
1132 {
1133 	const size_t namelen = strlen(tp->name);
1134 
1135 	/* Check version and type name fields */
1136 	if ((tp->version != NG_ABI_VERSION)
1137 	|| (namelen == 0)
1138 	|| (namelen >= NG_TYPESIZ)) {
1139 		TRAP_ERROR();
1140 		if (tp->version != NG_ABI_VERSION) {
1141 			printf("Netgraph: Node type rejected. ABI mismatch. Suggest recompile\n");
1142 		}
1143 		return (EINVAL);
1144 	}
1145 
1146 	/* Check for name collision */
1147 	if (ng_findtype(tp->name) != NULL) {
1148 		TRAP_ERROR();
1149 		return (EEXIST);
1150 	}
1151 
1152 
1153 	/* Link in new type */
1154 	mtx_lock(&ng_typelist_mtx);
1155 	LIST_INSERT_HEAD(&ng_typelist, tp, types);
1156 	tp->refs = 1;	/* first ref is linked list */
1157 	mtx_unlock(&ng_typelist_mtx);
1158 	return (0);
1159 }
1160 
1161 /*
1162  * unlink a netgraph type
1163  * If no examples exist
1164  */
1165 int
1166 ng_rmtype(struct ng_type *tp)
1167 {
1168 	/* Check for name collision */
1169 	if (tp->refs != 1) {
1170 		TRAP_ERROR();
1171 		return (EBUSY);
1172 	}
1173 
1174 	/* Unlink type */
1175 	mtx_lock(&ng_typelist_mtx);
1176 	LIST_REMOVE(tp, types);
1177 	mtx_unlock(&ng_typelist_mtx);
1178 	return (0);
1179 }
1180 
1181 /*
1182  * Look for a type of the name given
1183  */
1184 struct ng_type *
1185 ng_findtype(const char *typename)
1186 {
1187 	struct ng_type *type;
1188 
1189 	mtx_lock(&ng_typelist_mtx);
1190 	LIST_FOREACH(type, &ng_typelist, types) {
1191 		if (strcmp(type->name, typename) == 0)
1192 			break;
1193 	}
1194 	mtx_unlock(&ng_typelist_mtx);
1195 	return (type);
1196 }
1197 
1198 /************************************************************************
1199 			Composite routines
1200 ************************************************************************/
1201 /*
1202  * Connect two nodes using the specified hooks, using queued functions.
1203  */
1204 static void
1205 ng_con_part3(node_p node, hook_p hook, void *arg1, int arg2)
1206 {
1207 
1208 	/*
1209 	 * When we run, we know that the node 'node' is locked for us.
1210 	 * Our caller has a reference on the hook.
1211 	 * Our caller has a reference on the node.
1212 	 * (In this case our caller is ng_apply_item() ).
1213 	 * The peer hook has a reference on the hook.
1214 	 * We are all set up except for the final call to the node, and
1215 	 * the clearing of the INVALID flag.
1216 	 */
1217 	if (NG_HOOK_NODE(hook) == &ng_deadnode) {
1218 		/*
1219 		 * The node must have been freed again since we last visited
1220 		 * here. ng_destry_hook() has this effect but nothing else does.
1221 		 * We should just release our references and
1222 		 * free anything we can think of.
1223 		 * Since we know it's been destroyed, and it's our caller
1224 		 * that holds the references, just return.
1225 		 */
1226 		return ;
1227 	}
1228 	if (hook->hk_node->nd_type->connect) {
1229 		if ((*hook->hk_node->nd_type->connect) (hook)) {
1230 			ng_destroy_hook(hook);	/* also zaps peer */
1231 			printf("failed in ng_con_part3()\n");
1232 			return ;
1233 		}
1234 	}
1235 	/*
1236 	 *  XXX this is wrong for SMP. Possibly we need
1237 	 * to separate out 'create' and 'invalid' flags.
1238 	 * should only set flags on hooks we have locked under our node.
1239 	 */
1240 	hook->hk_flags &= ~HK_INVALID;
1241 	return ;
1242 }
1243 
1244 static void
1245 ng_con_part2(node_p node, hook_p hook, void *arg1, int arg2)
1246 {
1247 
1248 	/*
1249 	 * When we run, we know that the node 'node' is locked for us.
1250 	 * Our caller has a reference on the hook.
1251 	 * Our caller has a reference on the node.
1252 	 * (In this case our caller is ng_apply_item() ).
1253 	 * The peer hook has a reference on the hook.
1254 	 * our node pointer points to the 'dead' node.
1255 	 * First check the hook name is unique.
1256 	 * Should not happen because we checked before queueing this.
1257 	 */
1258 	if (ng_findhook(node, NG_HOOK_NAME(hook)) != NULL) {
1259 		TRAP_ERROR();
1260 		ng_destroy_hook(hook); /* should destroy peer too */
1261 		printf("failed in ng_con_part2()\n");
1262 		return ;
1263 	}
1264 	/*
1265 	 * Check if the node type code has something to say about it
1266 	 * If it fails, the unref of the hook will also unref the attached node,
1267 	 * however since that node is 'ng_deadnode' this will do nothing.
1268 	 * The peer hook will also be destroyed.
1269 	 */
1270 	if (node->nd_type->newhook != NULL) {
1271 		if ((*node->nd_type->newhook)(node, hook, hook->hk_name)) {
1272 			ng_destroy_hook(hook); /* should destroy peer too */
1273 			printf("failed in ng_con_part2()\n");
1274 			return ;
1275 		}
1276 	}
1277 
1278 	/*
1279 	 * The 'type' agrees so far, so go ahead and link it in.
1280 	 * We'll ask again later when we actually connect the hooks.
1281 	 */
1282 	hook->hk_node = node;		/* just overwrite ng_deadnode */
1283 	NG_NODE_REF(node);		/* each hook counts as a reference */
1284 	LIST_INSERT_HEAD(&node->nd_hooks, hook, hk_hooks);
1285 	node->nd_numhooks++;
1286 	NG_HOOK_REF(hook);	/* one for the node */
1287 
1288 	/*
1289 	 * We now have a symetrical situation, where both hooks have been
1290 	 * linked to their nodes, the newhook methods have been called
1291 	 * And the references are all correct. The hooks are still marked
1292 	 * as invalid, as we have not called the 'connect' methods
1293 	 * yet.
1294 	 * We can call the local one immediatly as we have the
1295 	 * node locked, but we need to queue the remote one.
1296 	 */
1297 	if (hook->hk_node->nd_type->connect) {
1298 		if ((*hook->hk_node->nd_type->connect) (hook)) {
1299 			ng_destroy_hook(hook);	/* also zaps peer */
1300 			printf("failed in ng_con_part2(A)\n");
1301 			return ;
1302 		}
1303 	}
1304 	if (ng_send_fn(hook->hk_peer->hk_node, hook->hk_peer,
1305 			&ng_con_part3, arg1, arg2)) {
1306 		printf("failed in ng_con_part2(B)");
1307 		ng_destroy_hook(hook);	/* also zaps peer */
1308 		return ;
1309 	}
1310 	hook->hk_flags &= ~HK_INVALID; /* need both to be able to work */
1311 	return ;
1312 }
1313 
1314 /*
1315  * Connect this node with another node. We assume that this node is
1316  * currently locked, as we are only called from an NGM_CONNECT message.
1317  */
1318 static int
1319 ng_con_nodes(node_p node, const char *name, node_p node2, const char *name2)
1320 {
1321 	int     error;
1322 	hook_p  hook;
1323 	hook_p  hook2;
1324 
1325 	if (ng_findhook(node2, name2) != NULL) {
1326 		return(EEXIST);
1327 	}
1328 	if ((error = ng_add_hook(node, name, &hook)))  /* gives us a ref */
1329 		return (error);
1330 	/* Allocate the other hook and link it up */
1331 	NG_ALLOC_HOOK(hook2);
1332 	if (hook == NULL) {
1333 		TRAP_ERROR();
1334 		ng_destroy_hook(hook);	/* XXX check ref counts so far */
1335 		NG_HOOK_UNREF(hook);	/* including our ref */
1336 		return (ENOMEM);
1337 	}
1338 	hook2->hk_refs = 1;		/* start with a reference for us. */
1339 	hook2->hk_flags = HK_INVALID;
1340 	hook2->hk_peer = hook;		/* Link the two together */
1341 	hook->hk_peer = hook2;
1342 	NG_HOOK_REF(hook);		/* Add a ref for the peer to each*/
1343 	NG_HOOK_REF(hook2);
1344 	hook2->hk_node = &ng_deadnode;
1345 	strlcpy(NG_HOOK_NAME(hook2), name2, NG_HOOKSIZ);
1346 
1347 	/*
1348 	 * Queue the function above.
1349 	 * Procesing continues in that function in the lock context of
1350 	 * the other node.
1351 	 */
1352 	ng_send_fn(node2, hook2, &ng_con_part2, NULL, 0);
1353 
1354 	NG_HOOK_UNREF(hook);		/* Let each hook go if it wants to */
1355 	NG_HOOK_UNREF(hook2);
1356 	return (0);
1357 }
1358 
1359 /*
1360  * Make a peer and connect.
1361  * We assume that the local node is locked.
1362  * The new node probably doesn't need a lock until
1363  * it has a hook, because it cannot really have any work until then,
1364  * but we should think about it a bit more.
1365  *
1366  * The problem may come if the other node also fires up
1367  * some hardware or a timer or some other source of activation,
1368  * also it may already get a command msg via it's ID.
1369  *
1370  * We could use the same method as ng_con_nodes() but we'd have
1371  * to add ability to remove the node when failing. (Not hard, just
1372  * make arg1 point to the node to remove).
1373  * Unless of course we just ignore failure to connect and leave
1374  * an unconnected node?
1375  */
1376 static int
1377 ng_mkpeer(node_p node, const char *name, const char *name2, char *type)
1378 {
1379 	node_p  node2;
1380 	hook_p  hook1;
1381 	hook_p  hook2;
1382 	int     error;
1383 
1384 	if ((error = ng_make_node(type, &node2))) {
1385 		return (error);
1386 	}
1387 
1388 	if ((error = ng_add_hook(node, name, &hook1))) { /* gives us a ref */
1389 		ng_rmnode(node2, NULL, NULL, 0);
1390 		return (error);
1391 	}
1392 
1393 	if ((error = ng_add_hook(node2, name2, &hook2))) {
1394 		ng_rmnode(node2, NULL, NULL, 0);
1395 		ng_destroy_hook(hook1);
1396 		NG_HOOK_UNREF(hook1);
1397 		return (error);
1398 	}
1399 
1400 	/*
1401 	 * Actually link the two hooks together.
1402 	 */
1403 	hook1->hk_peer = hook2;
1404 	hook2->hk_peer = hook1;
1405 
1406 	/* Each hook is referenced by the other */
1407 	NG_HOOK_REF(hook1);
1408 	NG_HOOK_REF(hook2);
1409 
1410 	/* Give each node the opportunity to veto the pending connection */
1411 	if (hook1->hk_node->nd_type->connect) {
1412 		error = (*hook1->hk_node->nd_type->connect) (hook1);
1413 	}
1414 
1415 	if ((error == 0) && hook2->hk_node->nd_type->connect) {
1416 		error = (*hook2->hk_node->nd_type->connect) (hook2);
1417 
1418 	}
1419 
1420 	/*
1421 	 * drop the references we were holding on the two hooks.
1422 	 */
1423 	if (error) {
1424 		ng_destroy_hook(hook2);	/* also zaps hook1 */
1425 		ng_rmnode(node2, NULL, NULL, 0);
1426 	} else {
1427 		/* As a last act, allow the hooks to be used */
1428 		hook1->hk_flags &= ~HK_INVALID;
1429 		hook2->hk_flags &= ~HK_INVALID;
1430 	}
1431 	NG_HOOK_UNREF(hook1);
1432 	NG_HOOK_UNREF(hook2);
1433 	return (error);
1434 }
1435 
1436 /************************************************************************
1437 		Utility routines to send self messages
1438 ************************************************************************/
1439 
1440 /* Shut this node down as soon as everyone is clear of it */
1441 /* Should add arg "immediatly" to jump the queue */
1442 int
1443 ng_rmnode_self(node_p node)
1444 {
1445 	int		error;
1446 
1447 	if (node == &ng_deadnode)
1448 		return (0);
1449 	node->nd_flags |= NGF_INVALID;
1450 	if (node->nd_flags & NGF_CLOSING)
1451 		return (0);
1452 
1453 	error = ng_send_fn(node, NULL, &ng_rmnode, NULL, 0);
1454 	return (error);
1455 }
1456 
1457 static void
1458 ng_rmhook_part2(node_p node, hook_p hook, void *arg1, int arg2)
1459 {
1460 	ng_destroy_hook(hook);
1461 	return ;
1462 }
1463 
1464 int
1465 ng_rmhook_self(hook_p hook)
1466 {
1467 	int		error;
1468 	node_p node = NG_HOOK_NODE(hook);
1469 
1470 	if (node == &ng_deadnode)
1471 		return (0);
1472 
1473 	error = ng_send_fn(node, hook, &ng_rmhook_part2, NULL, 0);
1474 	return (error);
1475 }
1476 
1477 /***********************************************************************
1478  * Parse and verify a string of the form:  <NODE:><PATH>
1479  *
1480  * Such a string can refer to a specific node or a specific hook
1481  * on a specific node, depending on how you look at it. In the
1482  * latter case, the PATH component must not end in a dot.
1483  *
1484  * Both <NODE:> and <PATH> are optional. The <PATH> is a string
1485  * of hook names separated by dots. This breaks out the original
1486  * string, setting *nodep to "NODE" (or NULL if none) and *pathp
1487  * to "PATH" (or NULL if degenerate). Also, *hookp will point to
1488  * the final hook component of <PATH>, if any, otherwise NULL.
1489  *
1490  * This returns -1 if the path is malformed. The char ** are optional.
1491  ***********************************************************************/
1492 int
1493 ng_path_parse(char *addr, char **nodep, char **pathp, char **hookp)
1494 {
1495 	char   *node, *path, *hook;
1496 	int     k;
1497 
1498 	/*
1499 	 * Extract absolute NODE, if any
1500 	 */
1501 	for (path = addr; *path && *path != ':'; path++);
1502 	if (*path) {
1503 		node = addr;	/* Here's the NODE */
1504 		*path++ = '\0';	/* Here's the PATH */
1505 
1506 		/* Node name must not be empty */
1507 		if (!*node)
1508 			return -1;
1509 
1510 		/* A name of "." is OK; otherwise '.' not allowed */
1511 		if (strcmp(node, ".") != 0) {
1512 			for (k = 0; node[k]; k++)
1513 				if (node[k] == '.')
1514 					return -1;
1515 		}
1516 	} else {
1517 		node = NULL;	/* No absolute NODE */
1518 		path = addr;	/* Here's the PATH */
1519 	}
1520 
1521 	/* Snoop for illegal characters in PATH */
1522 	for (k = 0; path[k]; k++)
1523 		if (path[k] == ':')
1524 			return -1;
1525 
1526 	/* Check for no repeated dots in PATH */
1527 	for (k = 0; path[k]; k++)
1528 		if (path[k] == '.' && path[k + 1] == '.')
1529 			return -1;
1530 
1531 	/* Remove extra (degenerate) dots from beginning or end of PATH */
1532 	if (path[0] == '.')
1533 		path++;
1534 	if (*path && path[strlen(path) - 1] == '.')
1535 		path[strlen(path) - 1] = 0;
1536 
1537 	/* If PATH has a dot, then we're not talking about a hook */
1538 	if (*path) {
1539 		for (hook = path, k = 0; path[k]; k++)
1540 			if (path[k] == '.') {
1541 				hook = NULL;
1542 				break;
1543 			}
1544 	} else
1545 		path = hook = NULL;
1546 
1547 	/* Done */
1548 	if (nodep)
1549 		*nodep = node;
1550 	if (pathp)
1551 		*pathp = path;
1552 	if (hookp)
1553 		*hookp = hook;
1554 	return (0);
1555 }
1556 
1557 /*
1558  * Given a path, which may be absolute or relative, and a starting node,
1559  * return the destination node.
1560  */
1561 int
1562 ng_path2noderef(node_p here, const char *address,
1563 				node_p *destp, hook_p *lasthook)
1564 {
1565 	char    fullpath[NG_PATHSIZ];
1566 	char   *nodename, *path, pbuf[2];
1567 	node_p  node, oldnode;
1568 	char   *cp;
1569 	hook_p hook = NULL;
1570 
1571 	/* Initialize */
1572 	if (destp == NULL) {
1573 		TRAP_ERROR();
1574 		return EINVAL;
1575 	}
1576 	*destp = NULL;
1577 
1578 	/* Make a writable copy of address for ng_path_parse() */
1579 	strncpy(fullpath, address, sizeof(fullpath) - 1);
1580 	fullpath[sizeof(fullpath) - 1] = '\0';
1581 
1582 	/* Parse out node and sequence of hooks */
1583 	if (ng_path_parse(fullpath, &nodename, &path, NULL) < 0) {
1584 		TRAP_ERROR();
1585 		return EINVAL;
1586 	}
1587 	if (path == NULL) {
1588 		pbuf[0] = '.';	/* Needs to be writable */
1589 		pbuf[1] = '\0';
1590 		path = pbuf;
1591 	}
1592 
1593 	/*
1594 	 * For an absolute address, jump to the starting node.
1595 	 * Note that this holds a reference on the node for us.
1596 	 * Don't forget to drop the reference if we don't need it.
1597 	 */
1598 	if (nodename) {
1599 		node = ng_name2noderef(here, nodename);
1600 		if (node == NULL) {
1601 			TRAP_ERROR();
1602 			return (ENOENT);
1603 		}
1604 	} else {
1605 		if (here == NULL) {
1606 			TRAP_ERROR();
1607 			return (EINVAL);
1608 		}
1609 		node = here;
1610 		NG_NODE_REF(node);
1611 	}
1612 
1613 	/*
1614 	 * Now follow the sequence of hooks
1615 	 * XXX
1616 	 * We actually cannot guarantee that the sequence
1617 	 * is not being demolished as we crawl along it
1618 	 * without extra-ordinary locking etc.
1619 	 * So this is a bit dodgy to say the least.
1620 	 * We can probably hold up some things by holding
1621 	 * the nodelist mutex for the time of this
1622 	 * crawl if we wanted.. At least that way we wouldn't have to
1623 	 * worry about the nodes dissappearing, but the hooks would still
1624 	 * be a problem.
1625 	 */
1626 	for (cp = path; node != NULL && *cp != '\0'; ) {
1627 		char *segment;
1628 
1629 		/*
1630 		 * Break out the next path segment. Replace the dot we just
1631 		 * found with a NUL; "cp" points to the next segment (or the
1632 		 * NUL at the end).
1633 		 */
1634 		for (segment = cp; *cp != '\0'; cp++) {
1635 			if (*cp == '.') {
1636 				*cp++ = '\0';
1637 				break;
1638 			}
1639 		}
1640 
1641 		/* Empty segment */
1642 		if (*segment == '\0')
1643 			continue;
1644 
1645 		/* We have a segment, so look for a hook by that name */
1646 		hook = ng_findhook(node, segment);
1647 
1648 		/* Can't get there from here... */
1649 		if (hook == NULL
1650 		    || NG_HOOK_PEER(hook) == NULL
1651 		    || NG_HOOK_NOT_VALID(hook)
1652 		    || NG_HOOK_NOT_VALID(NG_HOOK_PEER(hook))) {
1653 			TRAP_ERROR();
1654 			NG_NODE_UNREF(node);
1655 #if 0
1656 			printf("hooknotvalid %s %s %d %d %d %d ",
1657 					path,
1658 					segment,
1659 					hook == NULL,
1660 		     			NG_HOOK_PEER(hook) == NULL,
1661 		     			NG_HOOK_NOT_VALID(hook),
1662 		     			NG_HOOK_NOT_VALID(NG_HOOK_PEER(hook)));
1663 #endif
1664 			return (ENOENT);
1665 		}
1666 
1667 		/*
1668 		 * Hop on over to the next node
1669 		 * XXX
1670 		 * Big race conditions here as hooks and nodes go away
1671 		 * *** Idea.. store an ng_ID_t in each hook and use that
1672 		 * instead of the direct hook in this crawl?
1673 		 */
1674 		oldnode = node;
1675 		if ((node = NG_PEER_NODE(hook)))
1676 			NG_NODE_REF(node);	/* XXX RACE */
1677 		NG_NODE_UNREF(oldnode);	/* XXX another race */
1678 		if (NG_NODE_NOT_VALID(node)) {
1679 			NG_NODE_UNREF(node);	/* XXX more races */
1680 			node = NULL;
1681 		}
1682 	}
1683 
1684 	/* If node somehow missing, fail here (probably this is not needed) */
1685 	if (node == NULL) {
1686 		TRAP_ERROR();
1687 		return (ENXIO);
1688 	}
1689 
1690 	/* Done */
1691 	*destp = node;
1692 	if (lasthook != NULL)
1693 		*lasthook = (hook ? NG_HOOK_PEER(hook) : NULL);
1694 	return (0);
1695 }
1696 
1697 /***************************************************************\
1698 * Input queue handling.
1699 * All activities are submitted to the node via the input queue
1700 * which implements a multiple-reader/single-writer gate.
1701 * Items which cannot be handled immeditly are queued.
1702 *
1703 * read-write queue locking inline functions			*
1704 \***************************************************************/
1705 
1706 static __inline item_p ng_dequeue(struct ng_queue * ngq);
1707 static __inline item_p ng_acquire_read(struct ng_queue * ngq,
1708 					item_p  item);
1709 static __inline item_p ng_acquire_write(struct ng_queue * ngq,
1710 					item_p  item);
1711 static __inline void	ng_leave_read(struct ng_queue * ngq);
1712 static __inline void	ng_leave_write(struct ng_queue * ngq);
1713 static __inline void	ng_queue_rw(struct ng_queue * ngq,
1714 					item_p  item, int rw);
1715 
1716 /*
1717  * Definition of the bits fields in the ng_queue flag word.
1718  * Defined here rather than in netgraph.h because no-one should fiddle
1719  * with them.
1720  *
1721  * The ordering here may be important! don't shuffle these.
1722  */
1723 /*-
1724  Safety Barrier--------+ (adjustable to suit taste) (not used yet)
1725                        |
1726                        V
1727 +-------+-------+-------+-------+-------+-------+-------+-------+
1728 | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |
1729 | |A|c|t|i|v|e| |R|e|a|d|e|r| |C|o|u|n|t| | | | | | | | | |R|A|W|
1730 | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |P|W|P|
1731 +-------+-------+-------+-------+-------+-------+-------+-------+
1732 \___________________________ ____________________________/ | | |
1733                             V                              | | |
1734                   [active reader count]                    | | |
1735                                                            | | |
1736           Read Pending ------------------------------------+ | |
1737                                                              | |
1738           Active Writer -------------------------------------+ |
1739                                                                |
1740           Write Pending ---------------------------------------+
1741 
1742 
1743 */
1744 #define WRITE_PENDING	0x00000001
1745 #define WRITER_ACTIVE	0x00000002
1746 #define READ_PENDING	0x00000004
1747 #define READER_INCREMENT 0x00000008
1748 #define READER_MASK	0xfffffff0	/* Not valid if WRITER_ACTIVE is set */
1749 #define SAFETY_BARRIER	0x00100000	/* 64K items queued should be enough */
1750 
1751 /* Defines of more elaborate states on the queue */
1752 /* Mask of bits a read cares about */
1753 #define NGQ_RMASK	(WRITE_PENDING|WRITER_ACTIVE|READ_PENDING)
1754 
1755 /* Mask of bits a write cares about */
1756 #define NGQ_WMASK	(NGQ_RMASK|READER_MASK)
1757 
1758 /* tests to decide if we could get a read or write off the queue */
1759 #define CAN_GET_READ(flag)	((flag & NGQ_RMASK) == READ_PENDING)
1760 #define CAN_GET_WRITE(flag)	((flag & NGQ_WMASK) == WRITE_PENDING)
1761 
1762 /* Is there a chance of getting ANY work off the queue? */
1763 #define CAN_GET_WORK(flag)	(CAN_GET_READ(flag) || CAN_GET_WRITE(flag))
1764 
1765 /*
1766  * Taking into account the current state of the queue and node, possibly take
1767  * the next entry off the queue and return it. Return NULL if there was
1768  * nothing we could return, either because there really was nothing there, or
1769  * because the node was in a state where it cannot yet process the next item
1770  * on the queue.
1771  *
1772  * This MUST MUST MUST be called with the mutex held.
1773  */
1774 static __inline item_p
1775 ng_dequeue(struct ng_queue *ngq)
1776 {
1777 	item_p item;
1778 	u_int		add_arg;
1779 
1780 	mtx_assert(&ngq->q_mtx, MA_OWNED);
1781 
1782 	if (CAN_GET_READ(ngq->q_flags)) {
1783 		/*
1784 		 * Head of queue is a reader and we have no write active.
1785 		 * We don't care how many readers are already active.
1786 		 * Adjust the flags for the item we are about to dequeue.
1787 		 * Add the correct increment for the reader count as well.
1788 		 */
1789 		add_arg = (READER_INCREMENT - READ_PENDING);
1790 	} else if (CAN_GET_WRITE(ngq->q_flags)) {
1791 		/*
1792 		 * There is a pending write, no readers and no active writer.
1793 		 * This means we can go ahead with the pending writer. Note
1794 		 * the fact that we now have a writer, ready for when we take
1795 		 * it off the queue.
1796 		 *
1797 		 * We don't need to worry about a possible collision with the
1798 		 * fasttrack reader.
1799 		 *
1800 		 * The fasttrack thread may take a long time to discover that we
1801 		 * are running so we would have an inconsistent state in the
1802 		 * flags for a while. Since we ignore the reader count
1803 		 * entirely when the WRITER_ACTIVE flag is set, this should
1804 		 * not matter (in fact it is defined that way). If it tests
1805 		 * the flag before this operation, the WRITE_PENDING flag
1806 		 * will make it fail, and if it tests it later, the
1807 		 * WRITER_ACTIVE flag will do the same. If it is SO slow that
1808 		 * we have actually completed the operation, and neither flag
1809 		 * is set (nor the READ_PENDING) by the time that it tests
1810 		 * the flags, then it is actually ok for it to continue. If
1811 		 * it completes and we've finished and the read pending is
1812 		 * set it still fails.
1813 		 *
1814 		 * So we can just ignore it,  as long as we can ensure that the
1815 		 * transition from WRITE_PENDING state to the WRITER_ACTIVE
1816 		 * state is atomic.
1817 		 *
1818 		 * After failing, first it will be held back by the mutex, then
1819 		 * when it can proceed, it will queue its request, then it
1820 		 * would arrive at this function. Usually it will have to
1821 		 * leave empty handed because the ACTIVE WRITER bit will be
1822 		 * set.
1823 		 *
1824 		 * Adjust the flags for the item we are about to dequeue
1825 		 * and for the new active writer.
1826 		 */
1827 		add_arg = (WRITER_ACTIVE - WRITE_PENDING);
1828 		/*
1829 		 * We want to write "active writer, no readers " Now go make
1830 		 * it true. In fact there may be a number in the readers
1831 		 * count but we know it is not true and will be fixed soon.
1832 		 * We will fix the flags for the next pending entry in a
1833 		 * moment.
1834 		 */
1835 	} else {
1836 		/*
1837 		 * We can't dequeue anything.. return and say so. Probably we
1838 		 * have a write pending and the readers count is non zero. If
1839 		 * we got here because a reader hit us just at the wrong
1840 		 * moment with the fasttrack code, and put us in a strange
1841 		 * state, then it will be through in just a moment, (as soon
1842 		 * as we release the mutex) and keep things moving.
1843 		 * Make sure we remove ourselves from the work queue.
1844 		 */
1845 		ng_worklist_remove(ngq->q_node);
1846 		return (0);
1847 	}
1848 
1849 	/*
1850 	 * Now we dequeue the request (whatever it may be) and correct the
1851 	 * pending flags and the next and last pointers.
1852 	 */
1853 	item = ngq->queue;
1854 	ngq->queue = item->el_next;
1855 	if (ngq->last == &(item->el_next)) {
1856 		/*
1857 		 * that was the last entry in the queue so set the 'last
1858 		 * pointer up correctly and make sure the pending flags are
1859 		 * clear.
1860 		 */
1861 		ngq->last = &(ngq->queue);
1862 		/*
1863 		 * Whatever flag was set will be cleared and
1864 		 * the new acive field will be set by the add as well,
1865 		 * so we don't need to change add_arg.
1866 		 * But we know we don't need to be on the work list.
1867 		 */
1868 		atomic_add_long(&ngq->q_flags, add_arg);
1869 		ng_worklist_remove(ngq->q_node);
1870 	} else {
1871 		/*
1872 		 * Since there is something on the queue, note what it is
1873 		 * in the flags word.
1874 		 */
1875 		if ((ngq->queue->el_flags & NGQF_RW) == NGQF_READER) {
1876 			add_arg += READ_PENDING;
1877 		} else {
1878 			add_arg += WRITE_PENDING;
1879 		}
1880 		atomic_add_long(&ngq->q_flags, add_arg);
1881 		/*
1882 		 * If we see more doable work, make sure we are
1883 		 * on the work queue.
1884 		 */
1885 		if (CAN_GET_WORK(ngq->q_flags)) {
1886 			ng_setisr(ngq->q_node);
1887 		}
1888 	}
1889 	/*
1890 	 * We have successfully cleared the old pending flag, set the new one
1891 	 * if it is needed, and incremented the appropriate active field.
1892 	 * (all in one atomic addition.. )
1893 	 */
1894 	return (item);
1895 }
1896 
1897 /*
1898  * Queue a packet to be picked up by someone else.
1899  * We really don't care who, but we can't or don't want to hang around
1900  * to process it ourselves. We are probably an interrupt routine..
1901  * 1 = writer, 0 = reader
1902  */
1903 #define NGQRW_R 0
1904 #define NGQRW_W 1
1905 static __inline void
1906 ng_queue_rw(struct ng_queue * ngq, item_p  item, int rw)
1907 {
1908 	mtx_assert(&ngq->q_mtx, MA_OWNED);
1909 
1910 	item->el_next = NULL;	/* maybe not needed */
1911 	*ngq->last = item;
1912 	/*
1913 	 * If it was the first item in the queue then we need to
1914 	 * set the last pointer and the type flags.
1915 	 */
1916 	if (ngq->last == &(ngq->queue)) {
1917 		/*
1918 		 * When called with constants for rw, the optimiser will
1919 		 * remove the unneeded branch below.
1920 		 */
1921 		if (rw == NGQRW_W) {
1922 			atomic_add_long(&ngq->q_flags, WRITE_PENDING);
1923 		} else {
1924 			atomic_add_long(&ngq->q_flags, READ_PENDING);
1925 		}
1926 	}
1927 	ngq->last = &(item->el_next);
1928 }
1929 
1930 
1931 /*
1932  * This function 'cheats' in that it first tries to 'grab' the use of the
1933  * node, without going through the mutex. We can do this becasue of the
1934  * semantics of the lock. The semantics include a clause that says that the
1935  * value of the readers count is invalid if the WRITER_ACTIVE flag is set. It
1936  * also says that the WRITER_ACTIVE flag cannot be set if the readers count
1937  * is not zero. Note that this talks about what is valid to SET the
1938  * WRITER_ACTIVE flag, because from the moment it is set, the value if the
1939  * reader count is immaterial, and not valid. The two 'pending' flags have a
1940  * similar effect, in that If they are orthogonal to the two active fields in
1941  * how they are set, but if either is set, the attempted 'grab' need to be
1942  * backed out because there is earlier work, and we maintain ordering in the
1943  * queue. The result of this is that the reader request can try obtain use of
1944  * the node with only a single atomic addition, and without any of the mutex
1945  * overhead. If this fails the operation degenerates to the same as for other
1946  * cases.
1947  *
1948  */
1949 static __inline item_p
1950 ng_acquire_read(struct ng_queue *ngq, item_p item)
1951 {
1952 
1953 	/* ######### Hack alert ######### */
1954 	atomic_add_long(&ngq->q_flags, READER_INCREMENT);
1955 	if ((ngq->q_flags & NGQ_RMASK) == 0) {
1956 		/* Successfully grabbed node */
1957 		return (item);
1958 	}
1959 	/* undo the damage if we didn't succeed */
1960 	atomic_subtract_long(&ngq->q_flags, READER_INCREMENT);
1961 
1962 	/* ######### End Hack alert ######### */
1963 	mtx_lock_spin((&ngq->q_mtx));
1964 	/*
1965 	 * Try again. Another processor (or interrupt for that matter) may
1966 	 * have removed the last queued item that was stopping us from
1967 	 * running, between the previous test, and the moment that we took
1968 	 * the mutex. (Or maybe a writer completed.)
1969 	 */
1970 	if ((ngq->q_flags & NGQ_RMASK) == 0) {
1971 		atomic_add_long(&ngq->q_flags, READER_INCREMENT);
1972 		mtx_unlock_spin((&ngq->q_mtx));
1973 		return (item);
1974 	}
1975 
1976 	/*
1977 	 * and queue the request for later.
1978 	 */
1979 	item->el_flags |= NGQF_READER;
1980 	ng_queue_rw(ngq, item, NGQRW_R);
1981 
1982 	/*
1983 	 * Ok, so that's the item successfully queued for later. So now we
1984 	 * see if we can dequeue something to run instead.
1985 	 */
1986 	item = ng_dequeue(ngq);
1987 	mtx_unlock_spin(&(ngq->q_mtx));
1988 	return (item);
1989 }
1990 
1991 static __inline item_p
1992 ng_acquire_write(struct ng_queue *ngq, item_p item)
1993 {
1994 restart:
1995 	mtx_lock_spin(&(ngq->q_mtx));
1996 	/*
1997 	 * If there are no readers, no writer, and no pending packets, then
1998 	 * we can just go ahead. In all other situations we need to queue the
1999 	 * request
2000 	 */
2001 	if ((ngq->q_flags & NGQ_WMASK) == 0) {
2002 		atomic_add_long(&ngq->q_flags, WRITER_ACTIVE);
2003 		mtx_unlock_spin((&ngq->q_mtx));
2004 		if (ngq->q_flags & READER_MASK) {
2005 			/* Collision with fast-track reader */
2006 			atomic_subtract_long(&ngq->q_flags, WRITER_ACTIVE);
2007 			goto restart;
2008 		}
2009 		return (item);
2010 	}
2011 
2012 	/*
2013 	 * and queue the request for later.
2014 	 */
2015 	item->el_flags &= ~NGQF_RW;
2016 	ng_queue_rw(ngq, item, NGQRW_W);
2017 
2018 	/*
2019 	 * Ok, so that's the item successfully queued for later. So now we
2020 	 * see if we can dequeue something to run instead.
2021 	 */
2022 	item = ng_dequeue(ngq);
2023 	mtx_unlock_spin(&(ngq->q_mtx));
2024 	return (item);
2025 }
2026 
2027 static __inline void
2028 ng_leave_read(struct ng_queue *ngq)
2029 {
2030 	atomic_subtract_long(&ngq->q_flags, READER_INCREMENT);
2031 }
2032 
2033 static __inline void
2034 ng_leave_write(struct ng_queue *ngq)
2035 {
2036 	atomic_subtract_long(&ngq->q_flags, WRITER_ACTIVE);
2037 }
2038 
2039 static void
2040 ng_flush_input_queue(struct ng_queue * ngq)
2041 {
2042 	item_p item;
2043 	u_int		add_arg;
2044 	mtx_lock_spin(&ngq->q_mtx);
2045 	for (;;) {
2046 		/* Now take a look at what's on the queue */
2047 		if (ngq->q_flags & READ_PENDING) {
2048 			add_arg = -READ_PENDING;
2049 		} else if (ngq->q_flags & WRITE_PENDING) {
2050 			add_arg = -WRITE_PENDING;
2051 		} else {
2052 			break;
2053 		}
2054 
2055 		item = ngq->queue;
2056 		ngq->queue = item->el_next;
2057 		if (ngq->last == &(item->el_next)) {
2058 			ngq->last = &(ngq->queue);
2059 		} else {
2060 			if ((ngq->queue->el_flags & NGQF_RW) == NGQF_READER) {
2061 				add_arg += READ_PENDING;
2062 			} else {
2063 				add_arg += WRITE_PENDING;
2064 			}
2065 		}
2066 		atomic_add_long(&ngq->q_flags, add_arg);
2067 
2068 		mtx_unlock_spin(&ngq->q_mtx);
2069 		NG_FREE_ITEM(item);
2070 		mtx_lock_spin(&ngq->q_mtx);
2071 	}
2072 	/*
2073 	 * Take us off the work queue if we are there.
2074 	 * We definatly have no work to be done.
2075 	 */
2076 	ng_worklist_remove(ngq->q_node);
2077 	mtx_unlock_spin(&ngq->q_mtx);
2078 }
2079 
2080 /***********************************************************************
2081 * Externally visible method for sending or queueing messages or data.
2082 ***********************************************************************/
2083 
2084 /*
2085  * The module code should have filled out the item correctly by this stage:
2086  * Common:
2087  *    reference to destination node.
2088  *    Reference to destination rcv hook if relevant.
2089  * Data:
2090  *    pointer to mbuf
2091  * Control_Message:
2092  *    pointer to msg.
2093  *    ID of original sender node. (return address)
2094  * Function:
2095  *    Function pointer
2096  *    void * argument
2097  *    integer argument
2098  *
2099  * The nodes have several routines and macros to help with this task:
2100  */
2101 
2102 int
2103 ng_snd_item(item_p item, int queue)
2104 {
2105 	hook_p hook = NGI_HOOK(item);
2106 	node_p node = NGI_NODE(item);
2107 	int rw;
2108 	int error = 0, ierror;
2109 	item_p	oitem;
2110 	struct ng_queue * ngq = &node->nd_input_queue;
2111 
2112 #ifdef	NETGRAPH_DEBUG
2113         _ngi_check(item, __FILE__, __LINE__);
2114 #endif
2115 
2116 	if (item == NULL) {
2117 		TRAP_ERROR();
2118 		return (EINVAL);	/* failed to get queue element */
2119 	}
2120 	if (node == NULL) {
2121 		NG_FREE_ITEM(item);
2122 		TRAP_ERROR();
2123 		return (EINVAL);	/* No address */
2124 	}
2125 	switch(item->el_flags & NGQF_TYPE) {
2126 	case NGQF_DATA:
2127 		/*
2128 		 * DATA MESSAGE
2129 		 * Delivered to a node via a non-optional hook.
2130 		 * Both should be present in the item even though
2131 		 * the node is derivable from the hook.
2132 		 * References are held on both by the item.
2133 		 */
2134 
2135 		/* Protect nodes from sending NULL pointers
2136 		 * to each other
2137 		 */
2138 		if (NGI_M(item) == NULL)
2139 			return (EINVAL);
2140 
2141 		CHECK_DATA_MBUF(NGI_M(item));
2142 		if (hook == NULL) {
2143 			NG_FREE_ITEM(item);
2144 			TRAP_ERROR();
2145 			return(EINVAL);
2146 		}
2147 		if ((NG_HOOK_NOT_VALID(hook))
2148 		|| (NG_NODE_NOT_VALID(NG_HOOK_NODE(hook)))) {
2149 			NG_FREE_ITEM(item);
2150 			return (ENOTCONN);
2151 		}
2152 		if ((hook->hk_flags & HK_QUEUE)) {
2153 			queue = 1;
2154 		}
2155 		/* By default data is a reader in the locking scheme */
2156 		item->el_flags |= NGQF_READER;
2157 		rw = NGQRW_R;
2158 		break;
2159 	case NGQF_MESG:
2160 		/*
2161 		 * CONTROL MESSAGE
2162 		 * Delivered to a node.
2163 		 * Hook is optional.
2164 		 * References are held by the item on the node and
2165 		 * the hook if it is present.
2166 		 */
2167 		if (hook && (hook->hk_flags & HK_QUEUE)) {
2168 			queue = 1;
2169 		}
2170 		/* Data messages count as writers unles explicitly exempted */
2171 		if (NGI_MSG(item)->header.cmd & NGM_READONLY) {
2172 			item->el_flags |= NGQF_READER;
2173 			rw = NGQRW_R;
2174 		} else {
2175 			item->el_flags &= ~NGQF_RW;
2176 			rw = NGQRW_W;
2177 		}
2178 		break;
2179 	case NGQF_FN:
2180 		item->el_flags &= ~NGQF_RW;
2181 		rw = NGQRW_W;
2182 		break;
2183 	default:
2184 		NG_FREE_ITEM(item);
2185 		TRAP_ERROR();
2186 		return (EINVAL);
2187 	}
2188 	/*
2189 	 * If the node specifies single threading, force writer semantics
2190 	 * Similarly the node may say one hook always produces writers.
2191 	 * These are over-rides.
2192 	 */
2193 	if ((node->nd_flags & NGF_FORCE_WRITER)
2194 	|| (hook && (hook->hk_flags & HK_FORCE_WRITER))) {
2195 			rw = NGQRW_W;
2196 			item->el_flags &= ~NGQF_READER;
2197 	}
2198 	if (queue) {
2199 		/* Put it on the queue for that node*/
2200 #ifdef	NETGRAPH_DEBUG
2201         _ngi_check(item, __FILE__, __LINE__);
2202 #endif
2203 		mtx_lock_spin(&(ngq->q_mtx));
2204 		ng_queue_rw(ngq, item, rw);
2205 		/*
2206 		 * If there are active elements then we can rely on
2207 		 * them. if not we should not rely on another packet
2208 		 * coming here by another path,
2209 		 * so it is best to put us in the netisr list.
2210 		 * We can take the worklist lock with the node locked
2211 		 * BUT NOT THE REVERSE!
2212 		 */
2213 		if (CAN_GET_WORK(ngq->q_flags)) {
2214 			ng_setisr(node);
2215 		}
2216 		mtx_unlock_spin(&(ngq->q_mtx));
2217 		return (0);
2218 	}
2219 	/*
2220 	 * Take a queue item and a node and see if we can apply the item to
2221 	 * the node. We may end up getting a different item to apply instead.
2222 	 * Will allow for a piggyback reply only in the case where
2223 	 * there is no queueing.
2224 	 */
2225 
2226 	oitem = item;
2227 	/*
2228 	 * We already decided how we will be queueud or treated.
2229 	 * Try get the appropriate operating permission.
2230 	 */
2231  	if (rw == NGQRW_R) {
2232 		item = ng_acquire_read(ngq, item);
2233 	} else {
2234 		item = ng_acquire_write(ngq, item);
2235 	}
2236 
2237 	/*
2238 	 * May have come back with a different item.
2239 	 * or maybe none at all. The one we started with will
2240 	 * have been queued in thises cases.
2241 	 */
2242 	if (item == NULL) {
2243 		return (0);
2244 	}
2245 
2246 #ifdef	NETGRAPH_DEBUG
2247         _ngi_check(item, __FILE__, __LINE__);
2248 #endif
2249 	/*
2250 	 * Take over the reference frm the item.
2251 	 * Hold it until the called function returns.
2252 	 */
2253 	NGI_GET_NODE(item, node); /* zaps stored node */
2254 
2255 	ierror = ng_apply_item(node, item); /* drops r/w lock when done */
2256 
2257 	/* only return an error if it was our initial item.. (compat hack) */
2258 	if (oitem == item) {
2259 		error = ierror;
2260 	}
2261 
2262 	/*
2263 	 * If the node goes away when we remove the reference,
2264 	 * whatever we just did caused it.. whatever we do, DO NOT
2265 	 * access the node again!
2266 	 */
2267 	if (NG_NODE_UNREF(node) == 0) {
2268 		return (error);
2269 	}
2270 
2271 	/*
2272 	 * Now we've handled the packet we brought, (or a friend of it) let's
2273 	 * look for any other packets that may have been queued up. We hold
2274 	 * no locks, so if someone puts something in the queue after
2275 	 * we check that it is empty, it is their problem
2276 	 * to ensure it is processed. If we have the netisr thread cme in here
2277 	 * while we still say we have stuff to do, we may get a boost
2278 	 * in SMP systems. :-)
2279 	 */
2280 	for (;;) {
2281 		/*
2282 		 * dequeue acquires and adjusts the input_queue as it dequeues
2283 		 * packets. It acquires the rw lock as needed.
2284 		 */
2285 		mtx_lock_spin(&ngq->q_mtx);
2286 		item = ng_dequeue(ngq); /* fixes worklist too*/
2287 		if (!item) {
2288 			mtx_unlock_spin(&ngq->q_mtx);
2289 			return (error);
2290 		}
2291 		mtx_unlock_spin(&ngq->q_mtx);
2292 
2293 		/*
2294 		 * Take over the reference frm the item.
2295 		 * Hold it until the called function returns.
2296 		 */
2297 
2298 		NGI_GET_NODE(item, node); /* zaps stored node */
2299 
2300 		/*
2301 		 * We have the appropriate lock, so run the item.
2302 		 * When finished it will drop the lock accordingly
2303 		 */
2304 		ierror = ng_apply_item(node, item);
2305 
2306 		/*
2307 		 * only return an error if it was our initial
2308 		 * item.. (compat hack)
2309 		 */
2310 		if (oitem == item) {
2311 			error = ierror;
2312 		}
2313 
2314 		/*
2315 		 * If the node goes away when we remove the reference,
2316 		 * whatever we just did caused it.. whatever we do, DO NOT
2317 		 * access the node again!
2318 		 */
2319 		if (NG_NODE_UNREF(node) == 0) {
2320 			break;
2321 		}
2322 	}
2323 	return (error);
2324 }
2325 
2326 /*
2327  * We have an item that was possibly queued somewhere.
2328  * It should contain all the information needed
2329  * to run it on the appropriate node/hook.
2330  */
2331 static int
2332 ng_apply_item(node_p node, item_p item)
2333 {
2334 	hook_p  hook;
2335 	int	was_reader = ((item->el_flags & NGQF_RW));
2336 	int	error = 0;
2337 	ng_rcvdata_t *rcvdata;
2338 	ng_rcvmsg_t *rcvmsg;
2339 
2340 	NGI_GET_HOOK(item, hook); /* clears stored hook */
2341 #ifdef	NETGRAPH_DEBUG
2342         _ngi_check(item, __FILE__, __LINE__);
2343 #endif
2344 	switch (item->el_flags & NGQF_TYPE) {
2345 	case NGQF_DATA:
2346 		/*
2347 		 * Check things are still ok as when we were queued.
2348 		 */
2349 		if ((hook == NULL)
2350 		|| NG_HOOK_NOT_VALID(hook)
2351 		|| NG_NODE_NOT_VALID(node) ) {
2352 			error = EIO;
2353 			NG_FREE_ITEM(item);
2354 			break;
2355 		}
2356 		/*
2357 		 * If no receive method, just silently drop it.
2358 		 * Give preference to the hook over-ride method
2359 		 */
2360 		if ((!(rcvdata = hook->hk_rcvdata))
2361 		&& (!(rcvdata = NG_HOOK_NODE(hook)->nd_type->rcvdata))) {
2362 			error = 0;
2363 			NG_FREE_ITEM(item);
2364 			break;
2365 		}
2366 		error = (*rcvdata)(hook, item);
2367 		break;
2368 	case NGQF_MESG:
2369 		if (hook) {
2370 			if (NG_HOOK_NOT_VALID(hook)) {
2371 				/*
2372 				 * The hook has been zapped then we can't
2373 				 * use it. Immediatly drop its reference.
2374 				 * The message may not need it.
2375 				 */
2376 				NG_HOOK_UNREF(hook);
2377 				hook = NULL;
2378 			}
2379 		}
2380 		/*
2381 		 * Similarly, if the node is a zombie there is
2382 		 * nothing we can do with it, drop everything.
2383 		 */
2384 		if (NG_NODE_NOT_VALID(node)) {
2385 			TRAP_ERROR();
2386 			error = EINVAL;
2387 			NG_FREE_ITEM(item);
2388 		} else {
2389 			/*
2390 			 * Call the appropriate message handler for the object.
2391 			 * It is up to the message handler to free the message.
2392 			 * If it's a generic message, handle it generically,
2393 			 * otherwise call the type's message handler
2394 			 * (if it exists)
2395 			 * XXX (race). Remember that a queued message may
2396 			 * reference a node or hook that has just been
2397 			 * invalidated. It will exist as the queue code
2398 			 * is holding a reference, but..
2399 			 */
2400 
2401 			struct ng_mesg *msg = NGI_MSG(item);
2402 
2403 			/*
2404 			 * check if the generic handler owns it.
2405 			 */
2406 			if ((msg->header.typecookie == NGM_GENERIC_COOKIE)
2407 			&& ((msg->header.flags & NGF_RESP) == 0)) {
2408 				error = ng_generic_msg(node, item, hook);
2409 				break;
2410 			}
2411 			/*
2412 			 * Now see if there is a handler (hook or node specific)
2413 			 * in the target node. If none, silently discard.
2414 			 */
2415 			if (((!hook) || (!(rcvmsg = hook->hk_rcvmsg)))
2416 			&& (!(rcvmsg = node->nd_type->rcvmsg))) {
2417 				TRAP_ERROR();
2418 				error = 0;
2419 				NG_FREE_ITEM(item);
2420 				break;
2421 			}
2422 			error = (*rcvmsg)(node, item, hook);
2423 		}
2424 		break;
2425 	case NGQF_FN:
2426 		/*
2427 		 *  We have to implicitly trust the hook,
2428 		 * as some of these are used for system purposes
2429 		 * where the hook is invalid. In the case of
2430 		 * the shutdown message we allow it to hit
2431 		 * even if the node is invalid.
2432 		 */
2433 		if ((NG_NODE_NOT_VALID(node))
2434 		&& (NGI_FN(item) != &ng_rmnode)) {
2435 			TRAP_ERROR();
2436 			error = EINVAL;
2437 			break;
2438 		}
2439 		(*NGI_FN(item))(node, hook, NGI_ARG1(item), NGI_ARG2(item));
2440 		NG_FREE_ITEM(item);
2441 		break;
2442 
2443 	}
2444 	/*
2445 	 * We held references on some of the resources
2446 	 * that we took from the item. Now that we have
2447 	 * finished doing everything, drop those references.
2448 	 */
2449 	if (hook) {
2450 		NG_HOOK_UNREF(hook);
2451 	}
2452 
2453 	if (was_reader) {
2454 		ng_leave_read(&node->nd_input_queue);
2455 	} else {
2456 		ng_leave_write(&node->nd_input_queue);
2457 	}
2458 	return (error);
2459 }
2460 
2461 /***********************************************************************
2462  * Implement the 'generic' control messages
2463  ***********************************************************************/
2464 static int
2465 ng_generic_msg(node_p here, item_p item, hook_p lasthook)
2466 {
2467 	int error = 0;
2468 	struct ng_mesg *msg;
2469 	struct ng_mesg *resp = NULL;
2470 
2471 	NGI_GET_MSG(item, msg);
2472 	if (msg->header.typecookie != NGM_GENERIC_COOKIE) {
2473 		TRAP_ERROR();
2474 		error = EINVAL;
2475 		goto out;
2476 	}
2477 	switch (msg->header.cmd) {
2478 	case NGM_SHUTDOWN:
2479 		ng_rmnode(here, NULL, NULL, 0);
2480 		break;
2481 	case NGM_MKPEER:
2482 	    {
2483 		struct ngm_mkpeer *const mkp = (struct ngm_mkpeer *) msg->data;
2484 
2485 		if (msg->header.arglen != sizeof(*mkp)) {
2486 			TRAP_ERROR();
2487 			error = EINVAL;
2488 			break;
2489 		}
2490 		mkp->type[sizeof(mkp->type) - 1] = '\0';
2491 		mkp->ourhook[sizeof(mkp->ourhook) - 1] = '\0';
2492 		mkp->peerhook[sizeof(mkp->peerhook) - 1] = '\0';
2493 		error = ng_mkpeer(here, mkp->ourhook, mkp->peerhook, mkp->type);
2494 		break;
2495 	    }
2496 	case NGM_CONNECT:
2497 	    {
2498 		struct ngm_connect *const con =
2499 			(struct ngm_connect *) msg->data;
2500 		node_p node2;
2501 
2502 		if (msg->header.arglen != sizeof(*con)) {
2503 			TRAP_ERROR();
2504 			error = EINVAL;
2505 			break;
2506 		}
2507 		con->path[sizeof(con->path) - 1] = '\0';
2508 		con->ourhook[sizeof(con->ourhook) - 1] = '\0';
2509 		con->peerhook[sizeof(con->peerhook) - 1] = '\0';
2510 		/* Don't forget we get a reference.. */
2511 		error = ng_path2noderef(here, con->path, &node2, NULL);
2512 		if (error)
2513 			break;
2514 		error = ng_con_nodes(here, con->ourhook, node2, con->peerhook);
2515 		NG_NODE_UNREF(node2);
2516 		break;
2517 	    }
2518 	case NGM_NAME:
2519 	    {
2520 		struct ngm_name *const nam = (struct ngm_name *) msg->data;
2521 
2522 		if (msg->header.arglen != sizeof(*nam)) {
2523 			TRAP_ERROR();
2524 			error = EINVAL;
2525 			break;
2526 		}
2527 		nam->name[sizeof(nam->name) - 1] = '\0';
2528 		error = ng_name_node(here, nam->name);
2529 		break;
2530 	    }
2531 	case NGM_RMHOOK:
2532 	    {
2533 		struct ngm_rmhook *const rmh = (struct ngm_rmhook *) msg->data;
2534 		hook_p hook;
2535 
2536 		if (msg->header.arglen != sizeof(*rmh)) {
2537 			TRAP_ERROR();
2538 			error = EINVAL;
2539 			break;
2540 		}
2541 		rmh->ourhook[sizeof(rmh->ourhook) - 1] = '\0';
2542 		if ((hook = ng_findhook(here, rmh->ourhook)) != NULL)
2543 			ng_destroy_hook(hook);
2544 		break;
2545 	    }
2546 	case NGM_NODEINFO:
2547 	    {
2548 		struct nodeinfo *ni;
2549 
2550 		NG_MKRESPONSE(resp, msg, sizeof(*ni), M_NOWAIT);
2551 		if (resp == NULL) {
2552 			error = ENOMEM;
2553 			break;
2554 		}
2555 
2556 		/* Fill in node info */
2557 		ni = (struct nodeinfo *) resp->data;
2558 		if (NG_NODE_HAS_NAME(here))
2559 			strcpy(ni->name, NG_NODE_NAME(here));
2560 		strcpy(ni->type, here->nd_type->name);
2561 		ni->id = ng_node2ID(here);
2562 		ni->hooks = here->nd_numhooks;
2563 		break;
2564 	    }
2565 	case NGM_LISTHOOKS:
2566 	    {
2567 		const int nhooks = here->nd_numhooks;
2568 		struct hooklist *hl;
2569 		struct nodeinfo *ni;
2570 		hook_p hook;
2571 
2572 		/* Get response struct */
2573 		NG_MKRESPONSE(resp, msg, sizeof(*hl)
2574 		    + (nhooks * sizeof(struct linkinfo)), M_NOWAIT);
2575 		if (resp == NULL) {
2576 			error = ENOMEM;
2577 			break;
2578 		}
2579 		hl = (struct hooklist *) resp->data;
2580 		ni = &hl->nodeinfo;
2581 
2582 		/* Fill in node info */
2583 		if (NG_NODE_HAS_NAME(here))
2584 			strcpy(ni->name, NG_NODE_NAME(here));
2585 		strcpy(ni->type, here->nd_type->name);
2586 		ni->id = ng_node2ID(here);
2587 
2588 		/* Cycle through the linked list of hooks */
2589 		ni->hooks = 0;
2590 		LIST_FOREACH(hook, &here->nd_hooks, hk_hooks) {
2591 			struct linkinfo *const link = &hl->link[ni->hooks];
2592 
2593 			if (ni->hooks >= nhooks) {
2594 				log(LOG_ERR, "%s: number of %s changed\n",
2595 				    __func__, "hooks");
2596 				break;
2597 			}
2598 			if (NG_HOOK_NOT_VALID(hook))
2599 				continue;
2600 			strcpy(link->ourhook, NG_HOOK_NAME(hook));
2601 			strcpy(link->peerhook, NG_PEER_HOOK_NAME(hook));
2602 			if (NG_PEER_NODE_NAME(hook)[0] != '\0')
2603 				strcpy(link->nodeinfo.name,
2604 				    NG_PEER_NODE_NAME(hook));
2605 			strcpy(link->nodeinfo.type,
2606 			   NG_PEER_NODE(hook)->nd_type->name);
2607 			link->nodeinfo.id = ng_node2ID(NG_PEER_NODE(hook));
2608 			link->nodeinfo.hooks = NG_PEER_NODE(hook)->nd_numhooks;
2609 			ni->hooks++;
2610 		}
2611 		break;
2612 	    }
2613 
2614 	case NGM_LISTNAMES:
2615 	case NGM_LISTNODES:
2616 	    {
2617 		const int unnamed = (msg->header.cmd == NGM_LISTNODES);
2618 		struct namelist *nl;
2619 		node_p node;
2620 		int num = 0;
2621 
2622 		mtx_lock(&ng_nodelist_mtx);
2623 		/* Count number of nodes */
2624 		LIST_FOREACH(node, &ng_nodelist, nd_nodes) {
2625 			if (NG_NODE_IS_VALID(node)
2626 			&& (unnamed || NG_NODE_HAS_NAME(node))) {
2627 				num++;
2628 			}
2629 		}
2630 		mtx_unlock(&ng_nodelist_mtx);
2631 
2632 		/* Get response struct */
2633 		NG_MKRESPONSE(resp, msg, sizeof(*nl)
2634 		    + (num * sizeof(struct nodeinfo)), M_NOWAIT);
2635 		if (resp == NULL) {
2636 			error = ENOMEM;
2637 			break;
2638 		}
2639 		nl = (struct namelist *) resp->data;
2640 
2641 		/* Cycle through the linked list of nodes */
2642 		nl->numnames = 0;
2643 		mtx_lock(&ng_nodelist_mtx);
2644 		LIST_FOREACH(node, &ng_nodelist, nd_nodes) {
2645 			struct nodeinfo *const np = &nl->nodeinfo[nl->numnames];
2646 
2647 			if (nl->numnames >= num) {
2648 				log(LOG_ERR, "%s: number of %s changed\n",
2649 				    __func__, "nodes");
2650 				break;
2651 			}
2652 			if (NG_NODE_NOT_VALID(node))
2653 				continue;
2654 			if (!unnamed && (! NG_NODE_HAS_NAME(node)))
2655 				continue;
2656 			if (NG_NODE_HAS_NAME(node))
2657 				strcpy(np->name, NG_NODE_NAME(node));
2658 			strcpy(np->type, node->nd_type->name);
2659 			np->id = ng_node2ID(node);
2660 			np->hooks = node->nd_numhooks;
2661 			nl->numnames++;
2662 		}
2663 		mtx_unlock(&ng_nodelist_mtx);
2664 		break;
2665 	    }
2666 
2667 	case NGM_LISTTYPES:
2668 	    {
2669 		struct typelist *tl;
2670 		struct ng_type *type;
2671 		int num = 0;
2672 
2673 		mtx_lock(&ng_typelist_mtx);
2674 		/* Count number of types */
2675 		LIST_FOREACH(type, &ng_typelist, types) {
2676 			num++;
2677 		}
2678 		mtx_unlock(&ng_typelist_mtx);
2679 
2680 		/* Get response struct */
2681 		NG_MKRESPONSE(resp, msg, sizeof(*tl)
2682 		    + (num * sizeof(struct typeinfo)), M_NOWAIT);
2683 		if (resp == NULL) {
2684 			error = ENOMEM;
2685 			break;
2686 		}
2687 		tl = (struct typelist *) resp->data;
2688 
2689 		/* Cycle through the linked list of types */
2690 		tl->numtypes = 0;
2691 		mtx_lock(&ng_typelist_mtx);
2692 		LIST_FOREACH(type, &ng_typelist, types) {
2693 			struct typeinfo *const tp = &tl->typeinfo[tl->numtypes];
2694 
2695 			if (tl->numtypes >= num) {
2696 				log(LOG_ERR, "%s: number of %s changed\n",
2697 				    __func__, "types");
2698 				break;
2699 			}
2700 			strcpy(tp->type_name, type->name);
2701 			tp->numnodes = type->refs - 1; /* don't count list */
2702 			tl->numtypes++;
2703 		}
2704 		mtx_unlock(&ng_typelist_mtx);
2705 		break;
2706 	    }
2707 
2708 	case NGM_BINARY2ASCII:
2709 	    {
2710 		int bufSize = 20 * 1024;	/* XXX hard coded constant */
2711 		const struct ng_parse_type *argstype;
2712 		const struct ng_cmdlist *c;
2713 		struct ng_mesg *binary, *ascii;
2714 
2715 		/* Data area must contain a valid netgraph message */
2716 		binary = (struct ng_mesg *)msg->data;
2717 		if (msg->header.arglen < sizeof(struct ng_mesg)
2718 		    || (msg->header.arglen - sizeof(struct ng_mesg)
2719 		      < binary->header.arglen)) {
2720 			TRAP_ERROR();
2721 			error = EINVAL;
2722 			break;
2723 		}
2724 
2725 		/* Get a response message with lots of room */
2726 		NG_MKRESPONSE(resp, msg, sizeof(*ascii) + bufSize, M_NOWAIT);
2727 		if (resp == NULL) {
2728 			error = ENOMEM;
2729 			break;
2730 		}
2731 		ascii = (struct ng_mesg *)resp->data;
2732 
2733 		/* Copy binary message header to response message payload */
2734 		bcopy(binary, ascii, sizeof(*binary));
2735 
2736 		/* Find command by matching typecookie and command number */
2737 		for (c = here->nd_type->cmdlist;
2738 		    c != NULL && c->name != NULL; c++) {
2739 			if (binary->header.typecookie == c->cookie
2740 			    && binary->header.cmd == c->cmd)
2741 				break;
2742 		}
2743 		if (c == NULL || c->name == NULL) {
2744 			for (c = ng_generic_cmds; c->name != NULL; c++) {
2745 				if (binary->header.typecookie == c->cookie
2746 				    && binary->header.cmd == c->cmd)
2747 					break;
2748 			}
2749 			if (c->name == NULL) {
2750 				NG_FREE_MSG(resp);
2751 				error = ENOSYS;
2752 				break;
2753 			}
2754 		}
2755 
2756 		/* Convert command name to ASCII */
2757 		snprintf(ascii->header.cmdstr, sizeof(ascii->header.cmdstr),
2758 		    "%s", c->name);
2759 
2760 		/* Convert command arguments to ASCII */
2761 		argstype = (binary->header.flags & NGF_RESP) ?
2762 		    c->respType : c->mesgType;
2763 		if (argstype == NULL) {
2764 			*ascii->data = '\0';
2765 		} else {
2766 			if ((error = ng_unparse(argstype,
2767 			    (u_char *)binary->data,
2768 			    ascii->data, bufSize)) != 0) {
2769 				NG_FREE_MSG(resp);
2770 				break;
2771 			}
2772 		}
2773 
2774 		/* Return the result as struct ng_mesg plus ASCII string */
2775 		bufSize = strlen(ascii->data) + 1;
2776 		ascii->header.arglen = bufSize;
2777 		resp->header.arglen = sizeof(*ascii) + bufSize;
2778 		break;
2779 	    }
2780 
2781 	case NGM_ASCII2BINARY:
2782 	    {
2783 		int bufSize = 2000;	/* XXX hard coded constant */
2784 		const struct ng_cmdlist *c;
2785 		const struct ng_parse_type *argstype;
2786 		struct ng_mesg *ascii, *binary;
2787 		int off = 0;
2788 
2789 		/* Data area must contain at least a struct ng_mesg + '\0' */
2790 		ascii = (struct ng_mesg *)msg->data;
2791 		if ((msg->header.arglen < sizeof(*ascii) + 1)
2792 		    || (ascii->header.arglen < 1)
2793 		    || (msg->header.arglen
2794 		      < sizeof(*ascii) + ascii->header.arglen)) {
2795 			TRAP_ERROR();
2796 			error = EINVAL;
2797 			break;
2798 		}
2799 		ascii->data[ascii->header.arglen - 1] = '\0';
2800 
2801 		/* Get a response message with lots of room */
2802 		NG_MKRESPONSE(resp, msg, sizeof(*binary) + bufSize, M_NOWAIT);
2803 		if (resp == NULL) {
2804 			error = ENOMEM;
2805 			break;
2806 		}
2807 		binary = (struct ng_mesg *)resp->data;
2808 
2809 		/* Copy ASCII message header to response message payload */
2810 		bcopy(ascii, binary, sizeof(*ascii));
2811 
2812 		/* Find command by matching ASCII command string */
2813 		for (c = here->nd_type->cmdlist;
2814 		    c != NULL && c->name != NULL; c++) {
2815 			if (strcmp(ascii->header.cmdstr, c->name) == 0)
2816 				break;
2817 		}
2818 		if (c == NULL || c->name == NULL) {
2819 			for (c = ng_generic_cmds; c->name != NULL; c++) {
2820 				if (strcmp(ascii->header.cmdstr, c->name) == 0)
2821 					break;
2822 			}
2823 			if (c->name == NULL) {
2824 				NG_FREE_MSG(resp);
2825 				error = ENOSYS;
2826 				break;
2827 			}
2828 		}
2829 
2830 		/* Convert command name to binary */
2831 		binary->header.cmd = c->cmd;
2832 		binary->header.typecookie = c->cookie;
2833 
2834 		/* Convert command arguments to binary */
2835 		argstype = (binary->header.flags & NGF_RESP) ?
2836 		    c->respType : c->mesgType;
2837 		if (argstype == NULL) {
2838 			bufSize = 0;
2839 		} else {
2840 			if ((error = ng_parse(argstype, ascii->data,
2841 			    &off, (u_char *)binary->data, &bufSize)) != 0) {
2842 				NG_FREE_MSG(resp);
2843 				break;
2844 			}
2845 		}
2846 
2847 		/* Return the result */
2848 		binary->header.arglen = bufSize;
2849 		resp->header.arglen = sizeof(*binary) + bufSize;
2850 		break;
2851 	    }
2852 
2853 	case NGM_TEXT_CONFIG:
2854 	case NGM_TEXT_STATUS:
2855 		/*
2856 		 * This one is tricky as it passes the command down to the
2857 		 * actual node, even though it is a generic type command.
2858 		 * This means we must assume that the item/msg is already freed
2859 		 * when control passes back to us.
2860 		 */
2861 		if (here->nd_type->rcvmsg != NULL) {
2862 			NGI_MSG(item) = msg; /* put it back as we found it */
2863 			return((*here->nd_type->rcvmsg)(here, item, lasthook));
2864 		}
2865 		/* Fall through if rcvmsg not supported */
2866 	default:
2867 		TRAP_ERROR();
2868 		error = EINVAL;
2869 	}
2870 	/*
2871 	 * Sometimes a generic message may be statically allocated
2872 	 * to avoid problems with allocating when in tight memeory situations.
2873 	 * Don't free it if it is so.
2874 	 * I break them appart here, because erros may cause a free if the item
2875 	 * in which case we'd be doing it twice.
2876 	 * they are kept together above, to simplify freeing.
2877 	 */
2878 out:
2879 	NG_RESPOND_MSG(error, here, item, resp);
2880 	if (msg)
2881 		NG_FREE_MSG(msg);
2882 	return (error);
2883 }
2884 
2885 /************************************************************************
2886 			Module routines
2887 ************************************************************************/
2888 
2889 /*
2890  * Handle the loading/unloading of a netgraph node type module
2891  */
2892 int
2893 ng_mod_event(module_t mod, int event, void *data)
2894 {
2895 	struct ng_type *const type = data;
2896 	int s, error = 0;
2897 
2898 	switch (event) {
2899 	case MOD_LOAD:
2900 
2901 		/* Register new netgraph node type */
2902 		s = splnet();
2903 		if ((error = ng_newtype(type)) != 0) {
2904 			splx(s);
2905 			break;
2906 		}
2907 
2908 		/* Call type specific code */
2909 		if (type->mod_event != NULL)
2910 			if ((error = (*type->mod_event)(mod, event, data))) {
2911 				mtx_lock(&ng_typelist_mtx);
2912 				type->refs--;	/* undo it */
2913 				LIST_REMOVE(type, types);
2914 				mtx_unlock(&ng_typelist_mtx);
2915 			}
2916 		splx(s);
2917 		break;
2918 
2919 	case MOD_UNLOAD:
2920 		s = splnet();
2921 		if (type->refs > 1) {		/* make sure no nodes exist! */
2922 			error = EBUSY;
2923 		} else {
2924 			if (type->refs == 0) {
2925 				/* failed load, nothing to undo */
2926 				splx(s);
2927 				break;
2928 			}
2929 			if (type->mod_event != NULL) {	/* check with type */
2930 				error = (*type->mod_event)(mod, event, data);
2931 				if (error != 0) {	/* type refuses.. */
2932 					splx(s);
2933 					break;
2934 				}
2935 			}
2936 			mtx_lock(&ng_typelist_mtx);
2937 			LIST_REMOVE(type, types);
2938 			mtx_unlock(&ng_typelist_mtx);
2939 		}
2940 		splx(s);
2941 		break;
2942 
2943 	default:
2944 		if (type->mod_event != NULL)
2945 			error = (*type->mod_event)(mod, event, data);
2946 		else
2947 			error = EOPNOTSUPP;		/* XXX ? */
2948 		break;
2949 	}
2950 	return (error);
2951 }
2952 
2953 /*
2954  * Handle loading and unloading for this code.
2955  * The only thing we need to link into is the NETISR strucure.
2956  */
2957 static int
2958 ngb_mod_event(module_t mod, int event, void *data)
2959 {
2960 	int s, error = 0;
2961 
2962 	switch (event) {
2963 	case MOD_LOAD:
2964 		/* Register line discipline */
2965 		mtx_init(&ng_worklist_mtx, "ng_worklist", NULL, MTX_SPIN);
2966 		mtx_init(&ng_typelist_mtx, "netgraph types mutex", NULL,
2967 		    MTX_DEF);
2968 		mtx_init(&ng_nodelist_mtx, "netgraph nodelist mutex", NULL,
2969 		    MTX_DEF);
2970 		mtx_init(&ng_idhash_mtx, "netgraph idhash mutex", NULL,
2971 		    MTX_DEF);
2972 		mtx_init(&ngq_mtx, "netgraph free item list mutex", NULL,
2973 		    MTX_DEF);
2974 		s = splimp();
2975 		/* XXX could use NETISR_MPSAFE but need to verify code */
2976 		netisr_register(NETISR_NETGRAPH, (netisr_t *)ngintr, NULL, 0);
2977 		splx(s);
2978 		break;
2979 	case MOD_UNLOAD:
2980 		/* You cant unload it because an interface may be using it.  */
2981 		error = EBUSY;
2982 		break;
2983 	default:
2984 		error = EOPNOTSUPP;
2985 		break;
2986 	}
2987 	return (error);
2988 }
2989 
2990 static moduledata_t netgraph_mod = {
2991 	"netgraph",
2992 	ngb_mod_event,
2993 	(NULL)
2994 };
2995 DECLARE_MODULE(netgraph, netgraph_mod, SI_SUB_DRIVERS, SI_ORDER_MIDDLE);
2996 SYSCTL_NODE(_net, OID_AUTO, graph, CTLFLAG_RW, 0, "netgraph Family");
2997 SYSCTL_INT(_net_graph, OID_AUTO, abi_version, CTLFLAG_RD, 0, NG_ABI_VERSION,"");
2998 SYSCTL_INT(_net_graph, OID_AUTO, msg_version, CTLFLAG_RD, 0, NG_VERSION, "");
2999 
3000 /************************************************************************
3001 			Queue element get/free routines
3002 ************************************************************************/
3003 
3004 
3005 static int			allocated;	/* number of items malloc'd */
3006 
3007 static int			maxalloc = 128;	/* limit the damage of a leak */
3008 static int			ngqfreemax = 64;/* cache at most this many */
3009 
3010 TUNABLE_INT("net.graph.maxalloc", &maxalloc);
3011 SYSCTL_INT(_net_graph, OID_AUTO, maxalloc, CTLFLAG_RDTUN, &maxalloc,
3012     0, "Maximum number of queue items to allocate");
3013 
3014 TUNABLE_INT("net.graph.ngqfreemax", &ngqfreemax);
3015 SYSCTL_INT(_net_graph, OID_AUTO, ngqfreemax, CTLFLAG_RDTUN, &ngqfreemax,
3016     0, "Maximum number of free queue items to cache");
3017 
3018 static const int		ngqfreelow = 4; /* try malloc if free < this */
3019 static volatile int		ngqfreesize;	/* number of cached entries */
3020 static volatile item_p		ngqfree;	/* free ones */
3021 
3022 #ifdef	NETGRAPH_DEBUG
3023 static TAILQ_HEAD(, ng_item) ng_itemlist = TAILQ_HEAD_INITIALIZER(ng_itemlist);
3024 #endif
3025 /*
3026  * Get a queue entry
3027  * This is usually called when a packet first enters netgraph.
3028  * By definition, this is usually from an interrupt, or from a user.
3029  * Users are not so important, but try be quick for the times that it's
3030  * an interrupt.
3031  * XXX If reserve is low, we should try to get 2 from malloc as this
3032  * would indicate it often fails.
3033  */
3034 static item_p
3035 ng_getqblk(void)
3036 {
3037 	item_p item = NULL;
3038 
3039 	/*
3040 	 * Try get a cached queue block, or else allocate a new one
3041 	 * If we are less than our reserve, try malloc. If malloc
3042 	 * fails, then that's what the reserve is for...
3043 	 * We have our little reserve
3044 	 * because we use M_NOWAIT for malloc. This just helps us
3045 	 * avoid dropping packets while not increasing the time
3046 	 * we take to service the interrupt (on average) (I hope).
3047 	 */
3048 	mtx_lock(&ngq_mtx);
3049 
3050 	if ((ngqfreesize < ngqfreelow) || (ngqfree == NULL)) {
3051 		if (allocated < maxalloc) {  /* don't leak forever */
3052 			MALLOC(item, item_p ,
3053 			    sizeof(*item), M_NETGRAPH_ITEM,
3054 			    (M_NOWAIT | M_ZERO));
3055 			if (item) {
3056 #ifdef	NETGRAPH_DEBUG
3057 				TAILQ_INSERT_TAIL(&ng_itemlist, item, all);
3058 #endif	/* NETGRAPH_DEBUG */
3059 				allocated++;
3060 			}
3061 		}
3062 	}
3063 
3064 	/*
3065 	 * We didn't or couldn't malloc.
3066 	 * try get one from our cache.
3067 	 */
3068 	if (item == NULL && (item = ngqfree) != NULL) {
3069 		ngqfree = item->el_next;
3070 		ngqfreesize--;
3071 		item->el_flags &= ~NGQF_FREE;
3072 	}
3073 
3074 	mtx_unlock(&ngq_mtx);
3075 	return (item);
3076 }
3077 
3078 /*
3079  * Release a queue entry
3080  */
3081 void
3082 ng_free_item(item_p item)
3083 {
3084 
3085 	/*
3086 	 * The item may hold resources on it's own. We need to free
3087 	 * these before we can free the item. What they are depends upon
3088 	 * what kind of item it is. it is important that nodes zero
3089 	 * out pointers to resources that they remove from the item
3090 	 * or we release them again here.
3091 	 */
3092 	if (item->el_flags & NGQF_FREE) {
3093 		panic(" Freeing free queue item");
3094 	}
3095 	switch (item->el_flags & NGQF_TYPE) {
3096 	case NGQF_DATA:
3097 		/* If we have an mbuf still attached.. */
3098 		NG_FREE_M(_NGI_M(item));
3099 		break;
3100 	case NGQF_MESG:
3101 		_NGI_RETADDR(item) = 0;
3102 		NG_FREE_MSG(_NGI_MSG(item));
3103 		break;
3104 	case NGQF_FN:
3105 		/* nothing to free really, */
3106 		_NGI_FN(item) = NULL;
3107 		_NGI_ARG1(item) = NULL;
3108 		_NGI_ARG2(item) = 0;
3109 	case NGQF_UNDEF:
3110 		break;
3111 	}
3112 	/* If we still have a node or hook referenced... */
3113 	_NGI_CLR_NODE(item);
3114 	_NGI_CLR_HOOK(item);
3115 	item->el_flags |= NGQF_FREE;
3116 
3117 	mtx_lock(&ngq_mtx);
3118 	if (ngqfreesize < ngqfreemax) {
3119 		ngqfreesize++;
3120 		item->el_next = ngqfree;
3121 		ngqfree = item;
3122 	} else {
3123 #ifdef	NETGRAPH_DEBUG
3124 		TAILQ_REMOVE(&ng_itemlist, item, all);
3125 #endif	/* NETGRAPH_DEBUG */
3126 		NG_FREE_ITEM_REAL(item);
3127 		allocated--;
3128 	}
3129 	mtx_unlock(&ngq_mtx);
3130 }
3131 
3132 #ifdef	NETGRAPH_DEBUG
3133 void
3134 dumphook (hook_p hook, char *file, int line)
3135 {
3136 	printf("hook: name %s, %d refs, Last touched:\n",
3137 		_NG_HOOK_NAME(hook), hook->hk_refs);
3138 	printf("	Last active @ %s, line %d\n",
3139 		hook->lastfile, hook->lastline);
3140 	if (line) {
3141 		printf(" problem discovered at file %s, line %d\n", file, line);
3142 	}
3143 }
3144 
3145 void
3146 dumpnode(node_p node, char *file, int line)
3147 {
3148 	printf("node: ID [%x]: type '%s', %d hooks, flags 0x%x, %d refs, %s:\n",
3149 		_NG_NODE_ID(node), node->nd_type->name,
3150 		node->nd_numhooks, node->nd_flags,
3151 		node->nd_refs, node->nd_name);
3152 	printf("	Last active @ %s, line %d\n",
3153 		node->lastfile, node->lastline);
3154 	if (line) {
3155 		printf(" problem discovered at file %s, line %d\n", file, line);
3156 	}
3157 }
3158 
3159 void
3160 dumpitem(item_p item, char *file, int line)
3161 {
3162 	if (item->el_flags & NGQF_FREE) {
3163 		printf(" Free item, freed at %s, line %d\n",
3164 			item->lastfile, item->lastline);
3165 	} else {
3166 		printf(" ACTIVE item, last used at %s, line %d",
3167 			item->lastfile, item->lastline);
3168 		switch(item->el_flags & NGQF_TYPE) {
3169 		case NGQF_DATA:
3170 			printf(" - [data]\n");
3171 			break;
3172 		case NGQF_MESG:
3173 			printf(" - retaddr[%d]:\n", _NGI_RETADDR(item));
3174 			break;
3175 		case NGQF_FN:
3176 			printf(" - fn@%p (%p, %p, %p, %d (%x))\n",
3177 				item->body.fn.fn_fn,
3178 				NGI_NODE(item),
3179 				NGI_HOOK(item),
3180 				item->body.fn.fn_arg1,
3181 				item->body.fn.fn_arg2,
3182 				item->body.fn.fn_arg2);
3183 			break;
3184 		case NGQF_UNDEF:
3185 			printf(" - UNDEFINED!\n");
3186 		}
3187 	}
3188 	if (line) {
3189 		printf(" problem discovered at file %s, line %d\n", file, line);
3190 		if (NGI_NODE(item)) {
3191 			printf("node %p ([%x])\n",
3192 				NGI_NODE(item), ng_node2ID(NGI_NODE(item)));
3193 		}
3194 	}
3195 }
3196 
3197 static void
3198 ng_dumpitems(void)
3199 {
3200 	item_p item;
3201 	int i = 1;
3202 	TAILQ_FOREACH(item, &ng_itemlist, all) {
3203 		printf("[%d] ", i++);
3204 		dumpitem(item, NULL, 0);
3205 	}
3206 }
3207 
3208 static void
3209 ng_dumpnodes(void)
3210 {
3211 	node_p node;
3212 	int i = 1;
3213 	mtx_lock(&ng_nodelist_mtx);
3214 	SLIST_FOREACH(node, &ng_allnodes, nd_all) {
3215 		printf("[%d] ", i++);
3216 		dumpnode(node, NULL, 0);
3217 	}
3218 	mtx_unlock(&ng_nodelist_mtx);
3219 }
3220 
3221 static void
3222 ng_dumphooks(void)
3223 {
3224 	hook_p hook;
3225 	int i = 1;
3226 	mtx_lock(&ng_nodelist_mtx);
3227 	SLIST_FOREACH(hook, &ng_allhooks, hk_all) {
3228 		printf("[%d] ", i++);
3229 		dumphook(hook, NULL, 0);
3230 	}
3231 	mtx_unlock(&ng_nodelist_mtx);
3232 }
3233 
3234 static int
3235 sysctl_debug_ng_dump_items(SYSCTL_HANDLER_ARGS)
3236 {
3237 	int error;
3238 	int val;
3239 	int i;
3240 
3241 	val = allocated;
3242 	i = 1;
3243 	error = sysctl_handle_int(oidp, &val, sizeof(int), req);
3244 	if (error != 0 || req->newptr == NULL)
3245 		return (error);
3246 	if (val == 42) {
3247 		ng_dumpitems();
3248 		ng_dumpnodes();
3249 		ng_dumphooks();
3250 	}
3251 	return (0);
3252 }
3253 
3254 SYSCTL_PROC(_debug, OID_AUTO, ng_dump_items, CTLTYPE_INT | CTLFLAG_RW,
3255     0, sizeof(int), sysctl_debug_ng_dump_items, "I", "Number of allocated items");
3256 #endif	/* NETGRAPH_DEBUG */
3257 
3258 
3259 /***********************************************************************
3260 * Worklist routines
3261 **********************************************************************/
3262 /* NETISR thread enters here */
3263 /*
3264  * Pick a node off the list of nodes with work,
3265  * try get an item to process off it.
3266  * If there are no more, remove the node from the list.
3267  */
3268 static void
3269 ngintr(void)
3270 {
3271 	item_p item;
3272 	node_p  node = NULL;
3273 
3274 	for (;;) {
3275 		mtx_lock_spin(&ng_worklist_mtx);
3276 		node = TAILQ_FIRST(&ng_worklist);
3277 		if (!node) {
3278 			mtx_unlock_spin(&ng_worklist_mtx);
3279 			break;
3280 		}
3281 		node->nd_flags &= ~NGF_WORKQ;
3282 		TAILQ_REMOVE(&ng_worklist, node, nd_work);
3283 		mtx_unlock_spin(&ng_worklist_mtx);
3284 		/*
3285 		 * We have the node. We also take over the reference
3286 		 * that the list had on it.
3287 		 * Now process as much as you can, until it won't
3288 		 * let you have another item off the queue.
3289 		 * All this time, keep the reference
3290 		 * that lets us be sure that the node still exists.
3291 		 * Let the reference go at the last minute.
3292 		 * ng_dequeue will put us back on the worklist
3293 		 * if there is more too do. This may be of use if there
3294 		 * are Multiple Processors and multiple Net threads in the
3295 		 * future.
3296 		 */
3297 		for (;;) {
3298 			mtx_lock_spin(&node->nd_input_queue.q_mtx);
3299 			item = ng_dequeue(&node->nd_input_queue);
3300 			if (item == NULL) {
3301 				mtx_unlock_spin(&node->nd_input_queue.q_mtx);
3302 				break; /* go look for another node */
3303 			} else {
3304 				mtx_unlock_spin(&node->nd_input_queue.q_mtx);
3305 				NGI_GET_NODE(item, node); /* zaps stored node */
3306 				ng_apply_item(node, item);
3307 				NG_NODE_UNREF(node);
3308 			}
3309 		}
3310 		NG_NODE_UNREF(node);
3311 	}
3312 }
3313 
3314 static void
3315 ng_worklist_remove(node_p node)
3316 {
3317 	mtx_lock_spin(&ng_worklist_mtx);
3318 	if (node->nd_flags & NGF_WORKQ) {
3319 		node->nd_flags &= ~NGF_WORKQ;
3320 		TAILQ_REMOVE(&ng_worklist, node, nd_work);
3321 		mtx_unlock_spin(&ng_worklist_mtx);
3322 		NG_NODE_UNREF(node);
3323 	} else {
3324 		mtx_unlock_spin(&ng_worklist_mtx);
3325 	}
3326 }
3327 
3328 /*
3329  * XXX
3330  * It's posible that a debugging NG_NODE_REF may need
3331  * to be outside the mutex zone
3332  */
3333 static void
3334 ng_setisr(node_p node)
3335 {
3336 	mtx_lock_spin(&ng_worklist_mtx);
3337 	if ((node->nd_flags & NGF_WORKQ) == 0) {
3338 		/*
3339 		 * If we are not already on the work queue,
3340 		 * then put us on.
3341 		 */
3342 		node->nd_flags |= NGF_WORKQ;
3343 		TAILQ_INSERT_TAIL(&ng_worklist, node, nd_work);
3344 		NG_NODE_REF(node); /* XXX fafe in mutex? */
3345 	}
3346 	mtx_unlock_spin(&ng_worklist_mtx);
3347 	schednetisr(NETISR_NETGRAPH);
3348 }
3349 
3350 
3351 /***********************************************************************
3352 * Externally useable functions to set up a queue item ready for sending
3353 ***********************************************************************/
3354 
3355 #ifdef	NETGRAPH_DEBUG
3356 #define	ITEM_DEBUG_CHECKS						\
3357 	do {								\
3358 		if (NGI_NODE(item) ) {					\
3359 			printf("item already has node");		\
3360 			kdb_enter("has node");				\
3361 			NGI_CLR_NODE(item);				\
3362 		}							\
3363 		if (NGI_HOOK(item) ) {					\
3364 			printf("item already has hook");		\
3365 			kdb_enter("has hook");				\
3366 			NGI_CLR_HOOK(item);				\
3367 		}							\
3368 	} while (0)
3369 #else
3370 #define ITEM_DEBUG_CHECKS
3371 #endif
3372 
3373 /*
3374  * Put mbuf into the item.
3375  * Hook and node references will be removed when the item is dequeued.
3376  * (or equivalent)
3377  * (XXX) Unsafe because no reference held by peer on remote node.
3378  * remote node might go away in this timescale.
3379  * We know the hooks can't go away because that would require getting
3380  * a writer item on both nodes and we must have at least a  reader
3381  * here to eb able to do this.
3382  * Note that the hook loaded is the REMOTE hook.
3383  *
3384  * This is possibly in the critical path for new data.
3385  */
3386 item_p
3387 ng_package_data(struct mbuf *m, void *dummy)
3388 {
3389 	item_p item;
3390 
3391 	if ((item = ng_getqblk()) == NULL) {
3392 		NG_FREE_M(m);
3393 		return (NULL);
3394 	}
3395 	ITEM_DEBUG_CHECKS;
3396 	item->el_flags = NGQF_DATA;
3397 	item->el_next = NULL;
3398 	NGI_M(item) = m;
3399 	return (item);
3400 }
3401 
3402 /*
3403  * Allocate a queue item and put items into it..
3404  * Evaluate the address as this will be needed to queue it and
3405  * to work out what some of the fields should be.
3406  * Hook and node references will be removed when the item is dequeued.
3407  * (or equivalent)
3408  */
3409 item_p
3410 ng_package_msg(struct ng_mesg *msg)
3411 {
3412 	item_p item;
3413 
3414 	if ((item = ng_getqblk()) == NULL) {
3415 		NG_FREE_MSG(msg);
3416 		return (NULL);
3417 	}
3418 	ITEM_DEBUG_CHECKS;
3419 	item->el_flags = NGQF_MESG;
3420 	item->el_next = NULL;
3421 	/*
3422 	 * Set the current lasthook into the queue item
3423 	 */
3424 	NGI_MSG(item) = msg;
3425 	NGI_RETADDR(item) = 0;
3426 	return (item);
3427 }
3428 
3429 
3430 
3431 #define SET_RETADDR(item, here, retaddr)				\
3432 	do {	/* Data or fn items don't have retaddrs */		\
3433 		if ((item->el_flags & NGQF_TYPE) == NGQF_MESG) {	\
3434 			if (retaddr) {					\
3435 				NGI_RETADDR(item) = retaddr;		\
3436 			} else {					\
3437 				/*					\
3438 				 * The old return address should be ok.	\
3439 				 * If there isn't one, use the address	\
3440 				 * here.				\
3441 				 */					\
3442 				if (NGI_RETADDR(item) == 0) {		\
3443 					NGI_RETADDR(item)		\
3444 						= ng_node2ID(here);	\
3445 				}					\
3446 			}						\
3447 		}							\
3448 	} while (0)
3449 
3450 int
3451 ng_address_hook(node_p here, item_p item, hook_p hook, ng_ID_t retaddr)
3452 {
3453 	hook_p peer;
3454 	node_p peernode;
3455 	ITEM_DEBUG_CHECKS;
3456 	/*
3457 	 * Quick sanity check..
3458 	 * Since a hook holds a reference on it's node, once we know
3459 	 * that the peer is still connected (even if invalid,) we know
3460 	 * that the peer node is present, though maybe invalid.
3461 	 */
3462 	if ((hook == NULL)
3463 	|| NG_HOOK_NOT_VALID(hook)
3464 	|| (NG_HOOK_PEER(hook) == NULL)
3465 	|| NG_HOOK_NOT_VALID(NG_HOOK_PEER(hook))
3466 	|| NG_NODE_NOT_VALID(NG_PEER_NODE(hook))) {
3467 		NG_FREE_ITEM(item);
3468 		TRAP_ERROR();
3469 		return (ENETDOWN);
3470 	}
3471 
3472 	/*
3473 	 * Transfer our interest to the other (peer) end.
3474 	 */
3475 	peer = NG_HOOK_PEER(hook);
3476 	NG_HOOK_REF(peer);
3477 	NGI_SET_HOOK(item, peer);
3478 	peernode = NG_PEER_NODE(hook);
3479 	NG_NODE_REF(peernode);
3480 	NGI_SET_NODE(item, peernode);
3481 	SET_RETADDR(item, here, retaddr);
3482 	return (0);
3483 }
3484 
3485 int
3486 ng_address_path(node_p here, item_p item, char *address, ng_ID_t retaddr)
3487 {
3488 	node_p  dest = NULL;
3489 	hook_p	hook = NULL;
3490 	int     error;
3491 
3492 	ITEM_DEBUG_CHECKS;
3493 	/*
3494 	 * Note that ng_path2noderef increments the reference count
3495 	 * on the node for us if it finds one. So we don't have to.
3496 	 */
3497 	error = ng_path2noderef(here, address, &dest, &hook);
3498 	if (error) {
3499 		NG_FREE_ITEM(item);
3500 		return (error);
3501 	}
3502 	NGI_SET_NODE(item, dest);
3503 	if ( hook) {
3504 		NG_HOOK_REF(hook);	/* don't let it go while on the queue */
3505 		NGI_SET_HOOK(item, hook);
3506 	}
3507 	SET_RETADDR(item, here, retaddr);
3508 	return (0);
3509 }
3510 
3511 int
3512 ng_address_ID(node_p here, item_p item, ng_ID_t ID, ng_ID_t retaddr)
3513 {
3514 	node_p dest;
3515 
3516 	ITEM_DEBUG_CHECKS;
3517 	/*
3518 	 * Find the target node.
3519 	 */
3520 	dest = ng_ID2noderef(ID); /* GETS REFERENCE! */
3521 	if (dest == NULL) {
3522 		NG_FREE_ITEM(item);
3523 		TRAP_ERROR();
3524 		return(EINVAL);
3525 	}
3526 	/* Fill out the contents */
3527 	item->el_flags = NGQF_MESG;
3528 	item->el_next = NULL;
3529 	NGI_SET_NODE(item, dest);
3530 	NGI_CLR_HOOK(item);
3531 	SET_RETADDR(item, here, retaddr);
3532 	return (0);
3533 }
3534 
3535 /*
3536  * special case to send a message to self (e.g. destroy node)
3537  * Possibly indicate an arrival hook too.
3538  * Useful for removing that hook :-)
3539  */
3540 item_p
3541 ng_package_msg_self(node_p here, hook_p hook, struct ng_mesg *msg)
3542 {
3543 	item_p item;
3544 
3545 	/*
3546 	 * Find the target node.
3547 	 * If there is a HOOK argument, then use that in preference
3548 	 * to the address.
3549 	 */
3550 	if ((item = ng_getqblk()) == NULL) {
3551 		NG_FREE_MSG(msg);
3552 		return (NULL);
3553 	}
3554 
3555 	/* Fill out the contents */
3556 	item->el_flags = NGQF_MESG;
3557 	item->el_next = NULL;
3558 	NG_NODE_REF(here);
3559 	NGI_SET_NODE(item, here);
3560 	if (hook) {
3561 		NG_HOOK_REF(hook);
3562 		NGI_SET_HOOK(item, hook);
3563 	}
3564 	NGI_MSG(item) = msg;
3565 	NGI_RETADDR(item) = ng_node2ID(here);
3566 	return (item);
3567 }
3568 
3569 int
3570 ng_send_fn(node_p node, hook_p hook, ng_item_fn *fn, void * arg1, int arg2)
3571 {
3572 	item_p item;
3573 
3574 	if ((item = ng_getqblk()) == NULL) {
3575 		return (ENOMEM);
3576 	}
3577 	item->el_flags = NGQF_FN | NGQF_WRITER;
3578 	NG_NODE_REF(node); /* and one for the item */
3579 	NGI_SET_NODE(item, node);
3580 	if (hook) {
3581 		NG_HOOK_REF(hook);
3582 		NGI_SET_HOOK(item, hook);
3583 	}
3584 	NGI_FN(item) = fn;
3585 	NGI_ARG1(item) = arg1;
3586 	NGI_ARG2(item) = arg2;
3587 	return(ng_snd_item(item, 0));
3588 }
3589 
3590 /*
3591  * Official timeout routines for Netgraph nodes.
3592  */
3593 static void
3594 ng_callout_trapoline(void *arg)
3595 {
3596 	item_p item = arg;
3597 
3598 	ng_snd_item(item, 0);
3599 }
3600 
3601 
3602 int
3603 ng_callout(struct callout *c, node_p node, hook_p hook, int ticks,
3604     ng_item_fn *fn, void * arg1, int arg2)
3605 {
3606 	item_p item;
3607 
3608 	if ((item = ng_getqblk()) == NULL)
3609 		return (ENOMEM);
3610 
3611 	item->el_flags = NGQF_FN | NGQF_WRITER;
3612 	NG_NODE_REF(node);		/* and one for the item */
3613 	NGI_SET_NODE(item, node);
3614 	if (hook) {
3615 		NG_HOOK_REF(hook);
3616 		NGI_SET_HOOK(item, hook);
3617 	}
3618 	NGI_FN(item) = fn;
3619 	NGI_ARG1(item) = arg1;
3620 	NGI_ARG2(item) = arg2;
3621 	callout_reset(c, ticks, &ng_callout_trapoline, item);
3622 	return (0);
3623 }
3624 
3625 /* A special modified version of untimeout() */
3626 int
3627 ng_uncallout(struct callout *c, node_p node)
3628 {
3629 	item_p item;
3630 	int rval;
3631 	void *c_func;
3632 
3633 	if (c == NULL)
3634 		return (0);
3635 	/* there must be an official way to do this */
3636 	mtx_lock_spin(&callout_lock);
3637 	c_func = c->c_func;
3638 	rval = callout_stop(c);
3639 	mtx_unlock_spin(&callout_lock);
3640 	item = c->c_arg;
3641 	/* Do an extra check */
3642 	if ((rval > 0) && (c_func == &ng_callout_trapoline) &&
3643 	    (NGI_NODE(item) == node)) {
3644 		/*
3645 		 * We successfully removed it from the queue before it ran
3646 		 * So now we need to unreference everything that was
3647 		 * given extra references. (NG_FREE_ITEM does this).
3648 		 */
3649 		NG_FREE_ITEM(item);
3650 	}
3651 
3652 	return (rval);
3653 }
3654 
3655 /*
3656  * Set the address, if none given, give the node here.
3657  */
3658 void
3659 ng_replace_retaddr(node_p here, item_p item, ng_ID_t retaddr)
3660 {
3661 	if (retaddr) {
3662 		NGI_RETADDR(item) = retaddr;
3663 	} else {
3664 		/*
3665 		 * The old return address should be ok.
3666 		 * If there isn't one, use the address here.
3667 		 */
3668 		NGI_RETADDR(item) = ng_node2ID(here);
3669 	}
3670 }
3671 
3672 #define TESTING
3673 #ifdef TESTING
3674 /* just test all the macros */
3675 void
3676 ng_macro_test(item_p item);
3677 void
3678 ng_macro_test(item_p item)
3679 {
3680 	node_p node = NULL;
3681 	hook_p hook = NULL;
3682 	struct mbuf *m;
3683 	struct ng_mesg *msg;
3684 	ng_ID_t retaddr;
3685 	int	error;
3686 
3687 	NGI_GET_M(item, m);
3688 	NGI_GET_MSG(item, msg);
3689 	retaddr = NGI_RETADDR(item);
3690 	NG_SEND_DATA(error, hook, m, NULL);
3691 	NG_SEND_DATA_ONLY(error, hook, m);
3692 	NG_FWD_NEW_DATA(error, item, hook, m);
3693 	NG_FWD_ITEM_HOOK(error, item, hook);
3694 	NG_SEND_MSG_HOOK(error, node, msg, hook, retaddr);
3695 	NG_SEND_MSG_ID(error, node, msg, retaddr, retaddr);
3696 	NG_SEND_MSG_PATH(error, node, msg, ".:", retaddr);
3697 	NG_FWD_MSG_HOOK(error, node, item, hook, retaddr);
3698 }
3699 #endif /* TESTING */
3700 
3701