xref: /netbsd-src/sys/net/if_tap.c (revision 53b02e147d4ed531c0d2a5ca9b3e8026ba3e99b5)
1 /*	$NetBSD: if_tap.c,v 1.124 2021/09/26 15:58:33 thorpej Exp $	*/
2 
3 /*
4  *  Copyright (c) 2003, 2004, 2008, 2009 The NetBSD Foundation.
5  *  All rights reserved.
6  *
7  *  Redistribution and use in source and binary forms, with or without
8  *  modification, are permitted provided that the following conditions
9  *  are met:
10  *  1. Redistributions of source code must retain the above copyright
11  *     notice, this list of conditions and the following disclaimer.
12  *  2. Redistributions in binary form must reproduce the above copyright
13  *     notice, this list of conditions and the following disclaimer in the
14  *     documentation and/or other materials provided with the distribution.
15  *
16  *  THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
17  *  ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
18  *  TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
19  *  PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
20  *  BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
21  *  CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
22  *  SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
23  *  INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
24  *  CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
25  *  ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
26  *  POSSIBILITY OF SUCH DAMAGE.
27  */
28 
29 /*
30  * tap(4) is a virtual Ethernet interface.  It appears as a real Ethernet
31  * device to the system, but can also be accessed by userland through a
32  * character device interface, which allows reading and injecting frames.
33  */
34 
35 #include <sys/cdefs.h>
36 __KERNEL_RCSID(0, "$NetBSD: if_tap.c,v 1.124 2021/09/26 15:58:33 thorpej Exp $");
37 
38 #if defined(_KERNEL_OPT)
39 
40 #include "opt_modular.h"
41 #endif
42 
43 #include <sys/param.h>
44 #include <sys/atomic.h>
45 #include <sys/conf.h>
46 #include <sys/cprng.h>
47 #include <sys/device.h>
48 #include <sys/file.h>
49 #include <sys/filedesc.h>
50 #include <sys/intr.h>
51 #include <sys/kauth.h>
52 #include <sys/kernel.h>
53 #include <sys/kmem.h>
54 #include <sys/module.h>
55 #include <sys/mutex.h>
56 #include <sys/condvar.h>
57 #include <sys/poll.h>
58 #include <sys/proc.h>
59 #include <sys/select.h>
60 #include <sys/sockio.h>
61 #include <sys/stat.h>
62 #include <sys/sysctl.h>
63 #include <sys/systm.h>
64 
65 #include <net/if.h>
66 #include <net/if_dl.h>
67 #include <net/if_ether.h>
68 #include <net/if_tap.h>
69 #include <net/bpf.h>
70 
71 #include "ioconf.h"
72 
73 /*
74  * sysctl node management
75  *
76  * It's not really possible to use a SYSCTL_SETUP block with
77  * current module implementation, so it is easier to just define
78  * our own function.
79  *
80  * The handler function is a "helper" in Andrew Brown's sysctl
81  * framework terminology.  It is used as a gateway for sysctl
82  * requests over the nodes.
83  *
84  * tap_log allows the module to log creations of nodes and
85  * destroy them all at once using sysctl_teardown.
86  */
87 static int	tap_node;
88 static int	tap_sysctl_handler(SYSCTLFN_PROTO);
89 static void	sysctl_tap_setup(struct sysctllog **);
90 
91 struct tap_softc {
92 	device_t	sc_dev;
93 	struct ethercom	sc_ec;
94 	int		sc_flags;
95 #define	TAP_INUSE	0x00000001	/* tap device can only be opened once */
96 #define TAP_ASYNCIO	0x00000002	/* user is using async I/O (SIGIO) on the device */
97 #define TAP_NBIO	0x00000004	/* user wants calls to avoid blocking */
98 #define TAP_GOING	0x00000008	/* interface is being destroyed */
99 	struct selinfo	sc_rsel;
100 	pid_t		sc_pgid; /* For async. IO */
101 	kmutex_t	sc_lock;
102 	kcondvar_t	sc_cv;
103 	void		*sc_sih;
104 	struct timespec sc_atime;
105 	struct timespec sc_mtime;
106 	struct timespec sc_btime;
107 };
108 
109 /* autoconf(9) glue */
110 
111 static int	tap_match(device_t, cfdata_t, void *);
112 static void	tap_attach(device_t, device_t, void *);
113 static int	tap_detach(device_t, int);
114 
115 CFATTACH_DECL_NEW(tap, sizeof(struct tap_softc),
116     tap_match, tap_attach, tap_detach, NULL);
117 extern struct cfdriver tap_cd;
118 
119 /* Real device access routines */
120 static int	tap_dev_close(struct tap_softc *);
121 static int	tap_dev_read(int, struct uio *, int);
122 static int	tap_dev_write(int, struct uio *, int);
123 static int	tap_dev_ioctl(int, u_long, void *, struct lwp *);
124 static int	tap_dev_poll(int, int, struct lwp *);
125 static int	tap_dev_kqfilter(int, struct knote *);
126 
127 /* Fileops access routines */
128 static int	tap_fops_close(file_t *);
129 static int	tap_fops_read(file_t *, off_t *, struct uio *,
130     kauth_cred_t, int);
131 static int	tap_fops_write(file_t *, off_t *, struct uio *,
132     kauth_cred_t, int);
133 static int	tap_fops_ioctl(file_t *, u_long, void *);
134 static int	tap_fops_poll(file_t *, int);
135 static int	tap_fops_stat(file_t *, struct stat *);
136 static int	tap_fops_kqfilter(file_t *, struct knote *);
137 
138 static const struct fileops tap_fileops = {
139 	.fo_name = "tap",
140 	.fo_read = tap_fops_read,
141 	.fo_write = tap_fops_write,
142 	.fo_ioctl = tap_fops_ioctl,
143 	.fo_fcntl = fnullop_fcntl,
144 	.fo_poll = tap_fops_poll,
145 	.fo_stat = tap_fops_stat,
146 	.fo_close = tap_fops_close,
147 	.fo_kqfilter = tap_fops_kqfilter,
148 	.fo_restart = fnullop_restart,
149 };
150 
151 /* Helper for cloning open() */
152 static int	tap_dev_cloner(struct lwp *);
153 
154 /* Character device routines */
155 static int	tap_cdev_open(dev_t, int, int, struct lwp *);
156 static int	tap_cdev_close(dev_t, int, int, struct lwp *);
157 static int	tap_cdev_read(dev_t, struct uio *, int);
158 static int	tap_cdev_write(dev_t, struct uio *, int);
159 static int	tap_cdev_ioctl(dev_t, u_long, void *, int, struct lwp *);
160 static int	tap_cdev_poll(dev_t, int, struct lwp *);
161 static int	tap_cdev_kqfilter(dev_t, struct knote *);
162 
163 const struct cdevsw tap_cdevsw = {
164 	.d_open = tap_cdev_open,
165 	.d_close = tap_cdev_close,
166 	.d_read = tap_cdev_read,
167 	.d_write = tap_cdev_write,
168 	.d_ioctl = tap_cdev_ioctl,
169 	.d_stop = nostop,
170 	.d_tty = notty,
171 	.d_poll = tap_cdev_poll,
172 	.d_mmap = nommap,
173 	.d_kqfilter = tap_cdev_kqfilter,
174 	.d_discard = nodiscard,
175 	.d_flag = D_OTHER | D_MPSAFE
176 };
177 
178 #define TAP_CLONER	0xfffff		/* Maximal minor value */
179 
180 /* kqueue-related routines */
181 static void	tap_kqdetach(struct knote *);
182 static int	tap_kqread(struct knote *, long);
183 
184 /*
185  * Those are needed by the ifnet interface, and would typically be
186  * there for any network interface driver.
187  * Some other routines are optional: watchdog and drain.
188  */
189 static void	tap_start(struct ifnet *);
190 static void	tap_stop(struct ifnet *, int);
191 static int	tap_init(struct ifnet *);
192 static int	tap_ioctl(struct ifnet *, u_long, void *);
193 
194 /* Internal functions */
195 static int	tap_lifaddr(struct ifnet *, u_long, struct ifaliasreq *);
196 static void	tap_softintr(void *);
197 
198 /*
199  * tap is a clonable interface, although it is highly unrealistic for
200  * an Ethernet device.
201  *
202  * Here are the bits needed for a clonable interface.
203  */
204 static int	tap_clone_create(struct if_clone *, int);
205 static int	tap_clone_destroy(struct ifnet *);
206 
207 struct if_clone tap_cloners = IF_CLONE_INITIALIZER("tap",
208 					tap_clone_create,
209 					tap_clone_destroy);
210 
211 /* Helper functions shared by the two cloning code paths */
212 static struct tap_softc *	tap_clone_creator(int);
213 int	tap_clone_destroyer(device_t);
214 
215 static struct sysctllog *tap_sysctl_clog;
216 
217 #ifdef _MODULE
218 devmajor_t tap_bmajor = -1, tap_cmajor = -1;
219 #endif
220 
221 static u_int tap_count;
222 
223 void
224 tapattach(int n)
225 {
226 
227 	/*
228 	 * Nothing to do here, initialization is handled by the
229 	 * module initialization code in tapinit() below).
230 	 */
231 }
232 
233 static void
234 tapinit(void)
235 {
236 	int error = config_cfattach_attach(tap_cd.cd_name, &tap_ca);
237 
238 	if (error) {
239 		aprint_error("%s: unable to register cfattach\n",
240 		    tap_cd.cd_name);
241 		(void)config_cfdriver_detach(&tap_cd);
242 		return;
243 	}
244 
245 	if_clone_attach(&tap_cloners);
246 	sysctl_tap_setup(&tap_sysctl_clog);
247 #ifdef _MODULE
248 	devsw_attach("tap", NULL, &tap_bmajor, &tap_cdevsw, &tap_cmajor);
249 #endif
250 }
251 
252 static int
253 tapdetach(void)
254 {
255 	int error = 0;
256 
257 	if_clone_detach(&tap_cloners);
258 #ifdef _MODULE
259 	error = devsw_detach(NULL, &tap_cdevsw);
260 	if (error != 0)
261 		goto out2;
262 #endif
263 
264 	if (tap_count != 0) {
265 		error = EBUSY;
266 		goto out1;
267 	}
268 
269 	error = config_cfattach_detach(tap_cd.cd_name, &tap_ca);
270 	if (error != 0)
271 		goto out1;
272 
273 	sysctl_teardown(&tap_sysctl_clog);
274 
275 	return 0;
276 
277  out1:
278 #ifdef _MODULE
279 	devsw_attach("tap", NULL, &tap_bmajor, &tap_cdevsw, &tap_cmajor);
280  out2:
281 #endif
282 	if_clone_attach(&tap_cloners);
283 
284 	return error;
285 }
286 
287 /* Pretty much useless for a pseudo-device */
288 static int
289 tap_match(device_t parent, cfdata_t cfdata, void *arg)
290 {
291 
292 	return 1;
293 }
294 
295 void
296 tap_attach(device_t parent, device_t self, void *aux)
297 {
298 	struct tap_softc *sc = device_private(self);
299 	struct ifnet *ifp;
300 	const struct sysctlnode *node;
301 	int error;
302 	uint8_t enaddr[ETHER_ADDR_LEN] =
303 	    { 0xf2, 0x0b, 0xa4, 0xff, 0xff, 0xff };
304 	char enaddrstr[3 * ETHER_ADDR_LEN];
305 
306 	sc->sc_dev = self;
307 	sc->sc_sih = NULL;
308 	getnanotime(&sc->sc_btime);
309 	sc->sc_atime = sc->sc_mtime = sc->sc_btime;
310 	sc->sc_flags = 0;
311 	selinit(&sc->sc_rsel);
312 
313 	cv_init(&sc->sc_cv, "tapread");
314 	mutex_init(&sc->sc_lock, MUTEX_DEFAULT, IPL_NET);
315 
316 	if (!pmf_device_register(self, NULL, NULL))
317 		aprint_error_dev(self, "couldn't establish power handler\n");
318 
319 	/*
320 	 * In order to obtain unique initial Ethernet address on a host,
321 	 * do some randomisation.  It's not meant for anything but avoiding
322 	 * hard-coding an address.
323 	 */
324 	cprng_fast(&enaddr[3], 3);
325 
326 	aprint_verbose_dev(self, "Ethernet address %s\n",
327 	    ether_snprintf(enaddrstr, sizeof(enaddrstr), enaddr));
328 
329 	/*
330 	 * One should note that an interface must do multicast in order
331 	 * to support IPv6.
332 	 */
333 	ifp = &sc->sc_ec.ec_if;
334 	strcpy(ifp->if_xname, device_xname(self));
335 	ifp->if_softc	= sc;
336 	ifp->if_flags	= IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
337 #ifdef NET_MPSAFE
338 	ifp->if_extflags = IFEF_MPSAFE;
339 #endif
340 	ifp->if_ioctl	= tap_ioctl;
341 	ifp->if_start	= tap_start;
342 	ifp->if_stop	= tap_stop;
343 	ifp->if_init	= tap_init;
344 	IFQ_SET_READY(&ifp->if_snd);
345 
346 	sc->sc_ec.ec_capabilities = ETHERCAP_VLAN_MTU | ETHERCAP_JUMBO_MTU;
347 
348 	/* Those steps are mandatory for an Ethernet driver. */
349 	if_initialize(ifp);
350 	ifp->if_percpuq = if_percpuq_create(ifp);
351 	ether_ifattach(ifp, enaddr);
352 	/* Opening the device will bring the link state up. */
353 	ifp->if_link_state = LINK_STATE_DOWN;
354 	if_register(ifp);
355 
356 	/*
357 	 * Add a sysctl node for that interface.
358 	 *
359 	 * The pointer transmitted is not a string, but instead a pointer to
360 	 * the softc structure, which we can use to build the string value on
361 	 * the fly in the helper function of the node.  See the comments for
362 	 * tap_sysctl_handler for details.
363 	 *
364 	 * Usually sysctl_createv is called with CTL_CREATE as the before-last
365 	 * component.  However, we can allocate a number ourselves, as we are
366 	 * the only consumer of the net.link.<iface> node.  In this case, the
367 	 * unit number is conveniently used to number the node.  CTL_CREATE
368 	 * would just work, too.
369 	 */
370 	if ((error = sysctl_createv(NULL, 0, NULL,
371 	    &node, CTLFLAG_READWRITE,
372 	    CTLTYPE_STRING, device_xname(self), NULL,
373 	    tap_sysctl_handler, 0, (void *)sc, 18,
374 	    CTL_NET, AF_LINK, tap_node, device_unit(sc->sc_dev),
375 	    CTL_EOL)) != 0)
376 		aprint_error_dev(self,
377 		    "sysctl_createv returned %d, ignoring\n", error);
378 }
379 
380 /*
381  * When detaching, we do the inverse of what is done in the attach
382  * routine, in reversed order.
383  */
384 static int
385 tap_detach(device_t self, int flags)
386 {
387 	struct tap_softc *sc = device_private(self);
388 	struct ifnet *ifp = &sc->sc_ec.ec_if;
389 	int error;
390 
391 	sc->sc_flags |= TAP_GOING;
392 	tap_stop(ifp, 1);
393 	if_down(ifp);
394 
395 	if (sc->sc_sih != NULL) {
396 		softint_disestablish(sc->sc_sih);
397 		sc->sc_sih = NULL;
398 	}
399 
400 	/*
401 	 * Destroying a single leaf is a very straightforward operation using
402 	 * sysctl_destroyv.  One should be sure to always end the path with
403 	 * CTL_EOL.
404 	 */
405 	if ((error = sysctl_destroyv(NULL, CTL_NET, AF_LINK, tap_node,
406 	    device_unit(sc->sc_dev), CTL_EOL)) != 0)
407 		aprint_error_dev(self,
408 		    "sysctl_destroyv returned %d, ignoring\n", error);
409 	ether_ifdetach(ifp);
410 	if_detach(ifp);
411 	seldestroy(&sc->sc_rsel);
412 	mutex_destroy(&sc->sc_lock);
413 	cv_destroy(&sc->sc_cv);
414 
415 	pmf_device_deregister(self);
416 
417 	return 0;
418 }
419 
420 /*
421  * This is the function where we SEND packets.
422  *
423  * There is no 'receive' equivalent.  A typical driver will get
424  * interrupts from the hardware, and from there will inject new packets
425  * into the network stack.
426  *
427  * Once handled, a packet must be freed.  A real driver might not be able
428  * to fit all the pending packets into the hardware, and is allowed to
429  * return before having sent all the packets.  It should then use the
430  * if_flags flag IFF_OACTIVE to notify the upper layer.
431  *
432  * There are also other flags one should check, such as IFF_PAUSE.
433  *
434  * It is our duty to make packets available to BPF listeners.
435  *
436  * You should be aware that this function is called by the Ethernet layer
437  * at splnet().
438  *
439  * When the device is opened, we have to pass the packet(s) to the
440  * userland.  For that we stay in OACTIVE mode while the userland gets
441  * the packets, and we send a signal to the processes waiting to read.
442  *
443  * wakeup(sc) is the counterpart to the tsleep call in
444  * tap_dev_read, while selnotify() is used for kevent(2) and
445  * poll(2) (which includes select(2)) listeners.
446  */
447 static void
448 tap_start(struct ifnet *ifp)
449 {
450 	struct tap_softc *sc = (struct tap_softc *)ifp->if_softc;
451 	struct mbuf *m0;
452 
453 	mutex_enter(&sc->sc_lock);
454 	if ((sc->sc_flags & TAP_INUSE) == 0) {
455 		/* Simply drop packets */
456 		for (;;) {
457 			IFQ_DEQUEUE(&ifp->if_snd, m0);
458 			if (m0 == NULL)
459 				goto done;
460 
461 			if_statadd2(ifp, if_opackets, 1, if_obytes, m0->m_len);
462 			bpf_mtap(ifp, m0, BPF_D_OUT);
463 
464 			m_freem(m0);
465 		}
466 	} else if (!IFQ_IS_EMPTY(&ifp->if_snd)) {
467 		ifp->if_flags |= IFF_OACTIVE;
468 		cv_broadcast(&sc->sc_cv);
469 		selnotify(&sc->sc_rsel, 0, 1);
470 		if (sc->sc_flags & TAP_ASYNCIO) {
471 			kpreempt_disable();
472 			softint_schedule(sc->sc_sih);
473 			kpreempt_enable();
474 		}
475 	}
476 done:
477 	mutex_exit(&sc->sc_lock);
478 }
479 
480 static void
481 tap_softintr(void *cookie)
482 {
483 	struct tap_softc *sc;
484 	struct ifnet *ifp;
485 	int a, b;
486 
487 	sc = cookie;
488 
489 	if (sc->sc_flags & TAP_ASYNCIO) {
490 		ifp = &sc->sc_ec.ec_if;
491 		if (ifp->if_flags & IFF_RUNNING) {
492 			a = POLL_IN;
493 			b = POLLIN | POLLRDNORM;
494 		} else {
495 			a = POLL_HUP;
496 			b = 0;
497 		}
498 		fownsignal(sc->sc_pgid, SIGIO, a, b, NULL);
499 	}
500 }
501 
502 /*
503  * A typical driver will only contain the following handlers for
504  * ioctl calls, except SIOCSIFPHYADDR.
505  * The latter is a hack I used to set the Ethernet address of the
506  * faked device.
507  *
508  * Note that ether_ioctl() has to be called under splnet().
509  */
510 static int
511 tap_ioctl(struct ifnet *ifp, u_long cmd, void *data)
512 {
513 	int s, error;
514 
515 	s = splnet();
516 
517 	switch (cmd) {
518 	case SIOCSIFPHYADDR:
519 		error = tap_lifaddr(ifp, cmd, (struct ifaliasreq *)data);
520 		break;
521 	default:
522 		error = ether_ioctl(ifp, cmd, data);
523 		if (error == ENETRESET)
524 			error = 0;
525 		break;
526 	}
527 
528 	splx(s);
529 
530 	return error;
531 }
532 
533 /*
534  * Helper function to set Ethernet address.  This has been replaced by
535  * the generic SIOCALIFADDR ioctl on a PF_LINK socket.
536  */
537 static int
538 tap_lifaddr(struct ifnet *ifp, u_long cmd, struct ifaliasreq *ifra)
539 {
540 	const struct sockaddr *sa = &ifra->ifra_addr;
541 
542 	if (sa->sa_family != AF_LINK)
543 		return EINVAL;
544 
545 	if_set_sadl(ifp, sa->sa_data, ETHER_ADDR_LEN, false);
546 
547 	return 0;
548 }
549 
550 /*
551  * _init() would typically be called when an interface goes up,
552  * meaning it should configure itself into the state in which it
553  * can send packets.
554  */
555 static int
556 tap_init(struct ifnet *ifp)
557 {
558 	ifp->if_flags |= IFF_RUNNING;
559 
560 	tap_start(ifp);
561 
562 	return 0;
563 }
564 
565 /*
566  * _stop() is called when an interface goes down.  It is our
567  * responsability to validate that state by clearing the
568  * IFF_RUNNING flag.
569  *
570  * We have to wake up all the sleeping processes to have the pending
571  * read requests cancelled.
572  */
573 static void
574 tap_stop(struct ifnet *ifp, int disable)
575 {
576 	struct tap_softc *sc = (struct tap_softc *)ifp->if_softc;
577 
578 	mutex_enter(&sc->sc_lock);
579 	ifp->if_flags &= ~IFF_RUNNING;
580 	cv_broadcast(&sc->sc_cv);
581 	selnotify(&sc->sc_rsel, 0, 1);
582 	if (sc->sc_flags & TAP_ASYNCIO) {
583 		kpreempt_disable();
584 		softint_schedule(sc->sc_sih);
585 		kpreempt_enable();
586 	}
587 	mutex_exit(&sc->sc_lock);
588 }
589 
590 /*
591  * The 'create' command of ifconfig can be used to create
592  * any numbered instance of a given device.  Thus we have to
593  * make sure we have enough room in cd_devs to create the
594  * user-specified instance.  config_attach_pseudo will do this
595  * for us.
596  */
597 static int
598 tap_clone_create(struct if_clone *ifc, int unit)
599 {
600 
601 	if (tap_clone_creator(unit) == NULL) {
602 		aprint_error("%s%d: unable to attach an instance\n",
603 		    tap_cd.cd_name, unit);
604 		return ENXIO;
605 	}
606 	atomic_inc_uint(&tap_count);
607 	return 0;
608 }
609 
610 /*
611  * tap(4) can be cloned by two ways:
612  *   using 'ifconfig tap0 create', which will use the network
613  *     interface cloning API, and call tap_clone_create above.
614  *   opening the cloning device node, whose minor number is TAP_CLONER.
615  *     See below for an explanation on how this part work.
616  */
617 static struct tap_softc *
618 tap_clone_creator(int unit)
619 {
620 	cfdata_t cf;
621 
622 	cf = kmem_alloc(sizeof(*cf), KM_SLEEP);
623 	cf->cf_name = tap_cd.cd_name;
624 	cf->cf_atname = tap_ca.ca_name;
625 	if (unit == -1) {
626 		/* let autoconf find the first free one */
627 		cf->cf_unit = 0;
628 		cf->cf_fstate = FSTATE_STAR;
629 	} else {
630 		cf->cf_unit = unit;
631 		cf->cf_fstate = FSTATE_NOTFOUND;
632 	}
633 
634 	return device_private(config_attach_pseudo(cf));
635 }
636 
637 /*
638  * The clean design of if_clone and autoconf(9) makes that part
639  * really straightforward.  The second argument of config_detach
640  * means neither QUIET nor FORCED.
641  */
642 static int
643 tap_clone_destroy(struct ifnet *ifp)
644 {
645 	struct tap_softc *sc = ifp->if_softc;
646 	int error = tap_clone_destroyer(sc->sc_dev);
647 
648 	if (error == 0)
649 		atomic_dec_uint(&tap_count);
650 	return error;
651 }
652 
653 int
654 tap_clone_destroyer(device_t dev)
655 {
656 	cfdata_t cf = device_cfdata(dev);
657 	int error;
658 
659 	if ((error = config_detach(dev, 0)) != 0)
660 		aprint_error_dev(dev, "unable to detach instance\n");
661 	kmem_free(cf, sizeof(*cf));
662 
663 	return error;
664 }
665 
666 /*
667  * tap(4) is a bit of an hybrid device.  It can be used in two different
668  * ways:
669  *  1. ifconfig tapN create, then use /dev/tapN to read/write off it.
670  *  2. open /dev/tap, get a new interface created and read/write off it.
671  *     That interface is destroyed when the process that had it created exits.
672  *
673  * The first way is managed by the cdevsw structure, and you access interfaces
674  * through a (major, minor) mapping:  tap4 is obtained by the minor number
675  * 4.  The entry points for the cdevsw interface are prefixed by tap_cdev_.
676  *
677  * The second way is the so-called "cloning" device.  It's a special minor
678  * number (chosen as the maximal number, to allow as much tap devices as
679  * possible).  The user first opens the cloner (e.g., /dev/tap), and that
680  * call ends in tap_cdev_open.  The actual place where it is handled is
681  * tap_dev_cloner.
682  *
683  * An tap device cannot be opened more than once at a time, so the cdevsw
684  * part of open() does nothing but noting that the interface is being used and
685  * hence ready to actually handle packets.
686  */
687 
688 static int
689 tap_cdev_open(dev_t dev, int flags, int fmt, struct lwp *l)
690 {
691 	struct tap_softc *sc;
692 
693 	if (minor(dev) == TAP_CLONER)
694 		return tap_dev_cloner(l);
695 
696 	sc = device_lookup_private(&tap_cd, minor(dev));
697 	if (sc == NULL)
698 		return ENXIO;
699 
700 	/* The device can only be opened once */
701 	if (sc->sc_flags & TAP_INUSE)
702 		return EBUSY;
703 	sc->sc_flags |= TAP_INUSE;
704 	if_link_state_change(&sc->sc_ec.ec_if, LINK_STATE_UP);
705 
706 	return 0;
707 }
708 
709 /*
710  * There are several kinds of cloning devices, and the most simple is the one
711  * tap(4) uses.  What it does is change the file descriptor with a new one,
712  * with its own fileops structure (which maps to the various read, write,
713  * ioctl functions).  It starts allocating a new file descriptor with falloc,
714  * then actually creates the new tap devices.
715  *
716  * Once those two steps are successful, we can re-wire the existing file
717  * descriptor to its new self.  This is done with fdclone():  it fills the fp
718  * structure as needed (notably f_devunit gets filled with the fifth parameter
719  * passed, the unit of the tap device which will allows us identifying the
720  * device later), and returns EMOVEFD.
721  *
722  * That magic value is interpreted by sys_open() which then replaces the
723  * current file descriptor by the new one (through a magic member of struct
724  * lwp, l_dupfd).
725  *
726  * The tap device is flagged as being busy since it otherwise could be
727  * externally accessed through the corresponding device node with the cdevsw
728  * interface.
729  */
730 
731 static int
732 tap_dev_cloner(struct lwp *l)
733 {
734 	struct tap_softc *sc;
735 	file_t *fp;
736 	int error, fd;
737 
738 	if ((error = fd_allocfile(&fp, &fd)) != 0)
739 		return error;
740 
741 	if ((sc = tap_clone_creator(-1)) == NULL) {
742 		fd_abort(curproc, fp, fd);
743 		return ENXIO;
744 	}
745 
746 	sc->sc_flags |= TAP_INUSE;
747 
748 	return fd_clone(fp, fd, FREAD | FWRITE, &tap_fileops,
749 	    (void *)(intptr_t)device_unit(sc->sc_dev));
750 }
751 
752 /*
753  * While all other operations (read, write, ioctl, poll and kqfilter) are
754  * really the same whether we are in cdevsw or fileops mode, the close()
755  * function is slightly different in the two cases.
756  *
757  * As for the other, the core of it is shared in tap_dev_close.  What
758  * it does is sufficient for the cdevsw interface, but the cloning interface
759  * needs another thing:  the interface is destroyed when the processes that
760  * created it closes it.
761  */
762 static int
763 tap_cdev_close(dev_t dev, int flags, int fmt, struct lwp *l)
764 {
765 	struct tap_softc *sc = device_lookup_private(&tap_cd, minor(dev));
766 
767 	if (sc == NULL)
768 		return ENXIO;
769 
770 	return tap_dev_close(sc);
771 }
772 
773 /*
774  * It might happen that the administrator used ifconfig to externally destroy
775  * the interface.  In that case, tap_fops_close will be called while
776  * tap_detach is already happening.  If we called it again from here, we
777  * would dead lock.  TAP_GOING ensures that this situation doesn't happen.
778  */
779 static int
780 tap_fops_close(file_t *fp)
781 {
782 	struct tap_softc *sc;
783 	int unit = fp->f_devunit;
784 	int error;
785 
786 	sc = device_lookup_private(&tap_cd, unit);
787 	if (sc == NULL)
788 		return ENXIO;
789 
790 	/* tap_dev_close currently always succeeds, but it might not
791 	 * always be the case. */
792 	KERNEL_LOCK(1, NULL);
793 	if ((error = tap_dev_close(sc)) != 0) {
794 		KERNEL_UNLOCK_ONE(NULL);
795 		return error;
796 	}
797 
798 	/* Destroy the device now that it is no longer useful,
799 	 * unless it's already being destroyed. */
800 	if ((sc->sc_flags & TAP_GOING) != 0) {
801 		KERNEL_UNLOCK_ONE(NULL);
802 		return 0;
803 	}
804 
805 	error = tap_clone_destroyer(sc->sc_dev);
806 	KERNEL_UNLOCK_ONE(NULL);
807 	return error;
808 }
809 
810 static int
811 tap_dev_close(struct tap_softc *sc)
812 {
813 	struct ifnet *ifp;
814 	int s;
815 
816 	s = splnet();
817 	/* Let tap_start handle packets again */
818 	ifp = &sc->sc_ec.ec_if;
819 	ifp->if_flags &= ~IFF_OACTIVE;
820 
821 	/* Purge output queue */
822 	if (!(IFQ_IS_EMPTY(&ifp->if_snd))) {
823 		struct mbuf *m;
824 
825 		for (;;) {
826 			IFQ_DEQUEUE(&ifp->if_snd, m);
827 			if (m == NULL)
828 				break;
829 
830 			if_statadd2(ifp, if_opackets, 1, if_obytes, m->m_len);
831 			bpf_mtap(ifp, m, BPF_D_OUT);
832 			m_freem(m);
833 		}
834 	}
835 	splx(s);
836 
837 	if (sc->sc_sih != NULL) {
838 		softint_disestablish(sc->sc_sih);
839 		sc->sc_sih = NULL;
840 	}
841 	sc->sc_flags &= ~(TAP_INUSE | TAP_ASYNCIO);
842 	if_link_state_change(ifp, LINK_STATE_DOWN);
843 
844 	return 0;
845 }
846 
847 static int
848 tap_cdev_read(dev_t dev, struct uio *uio, int flags)
849 {
850 
851 	return tap_dev_read(minor(dev), uio, flags);
852 }
853 
854 static int
855 tap_fops_read(file_t *fp, off_t *offp, struct uio *uio,
856     kauth_cred_t cred, int flags)
857 {
858 	int error;
859 
860 	KERNEL_LOCK(1, NULL);
861 	error = tap_dev_read(fp->f_devunit, uio, flags);
862 	KERNEL_UNLOCK_ONE(NULL);
863 	return error;
864 }
865 
866 static int
867 tap_dev_read(int unit, struct uio *uio, int flags)
868 {
869 	struct tap_softc *sc = device_lookup_private(&tap_cd, unit);
870 	struct ifnet *ifp;
871 	struct mbuf *m, *n;
872 	int error = 0;
873 
874 	if (sc == NULL)
875 		return ENXIO;
876 
877 	getnanotime(&sc->sc_atime);
878 
879 	ifp = &sc->sc_ec.ec_if;
880 	if ((ifp->if_flags & IFF_UP) == 0)
881 		return EHOSTDOWN;
882 
883 	/* In the TAP_NBIO case, we have to make sure we won't be sleeping */
884 	if ((sc->sc_flags & TAP_NBIO) != 0) {
885 		if (!mutex_tryenter(&sc->sc_lock))
886 			return EWOULDBLOCK;
887 	} else
888 		mutex_enter(&sc->sc_lock);
889 
890 	if (IFQ_IS_EMPTY(&ifp->if_snd)) {
891 		ifp->if_flags &= ~IFF_OACTIVE;
892 		if (sc->sc_flags & TAP_NBIO)
893 			error = EWOULDBLOCK;
894 		else
895 			error = cv_wait_sig(&sc->sc_cv, &sc->sc_lock);
896 
897 		if (error != 0) {
898 			mutex_exit(&sc->sc_lock);
899 			return error;
900 		}
901 		/* The device might have been downed */
902 		if ((ifp->if_flags & IFF_UP) == 0) {
903 			mutex_exit(&sc->sc_lock);
904 			return EHOSTDOWN;
905 		}
906 	}
907 
908 	IFQ_DEQUEUE(&ifp->if_snd, m);
909 	mutex_exit(&sc->sc_lock);
910 
911 	ifp->if_flags &= ~IFF_OACTIVE;
912 	if (m == NULL) {
913 		error = 0;
914 		goto out;
915 	}
916 
917 	if_statadd2(ifp, if_opackets, 1,
918 	    if_obytes, m->m_len);		/* XXX only first in chain */
919 	bpf_mtap(ifp, m, BPF_D_OUT);
920 	if ((error = pfil_run_hooks(ifp->if_pfil, &m, ifp, PFIL_OUT)) != 0)
921 		goto out;
922 	if (m == NULL)
923 		goto out;
924 
925 	/*
926 	 * One read is one packet.
927 	 */
928 	do {
929 		error = uiomove(mtod(m, void *),
930 		    uimin(m->m_len, uio->uio_resid), uio);
931 		m = n = m_free(m);
932 	} while (m != NULL && uio->uio_resid > 0 && error == 0);
933 
934 	if (m != NULL)
935 		m_freem(m);
936 
937 out:
938 	return error;
939 }
940 
941 static int
942 tap_fops_stat(file_t *fp, struct stat *st)
943 {
944 	int error = 0;
945 	struct tap_softc *sc;
946 	int unit = fp->f_devunit;
947 
948 	(void)memset(st, 0, sizeof(*st));
949 
950 	KERNEL_LOCK(1, NULL);
951 	sc = device_lookup_private(&tap_cd, unit);
952 	if (sc == NULL) {
953 		error = ENXIO;
954 		goto out;
955 	}
956 
957 	st->st_dev = makedev(cdevsw_lookup_major(&tap_cdevsw), unit);
958 	st->st_atimespec = sc->sc_atime;
959 	st->st_mtimespec = sc->sc_mtime;
960 	st->st_ctimespec = st->st_birthtimespec = sc->sc_btime;
961 	st->st_uid = kauth_cred_geteuid(fp->f_cred);
962 	st->st_gid = kauth_cred_getegid(fp->f_cred);
963 out:
964 	KERNEL_UNLOCK_ONE(NULL);
965 	return error;
966 }
967 
968 static int
969 tap_cdev_write(dev_t dev, struct uio *uio, int flags)
970 {
971 
972 	return tap_dev_write(minor(dev), uio, flags);
973 }
974 
975 static int
976 tap_fops_write(file_t *fp, off_t *offp, struct uio *uio,
977     kauth_cred_t cred, int flags)
978 {
979 	int error;
980 
981 	KERNEL_LOCK(1, NULL);
982 	error = tap_dev_write(fp->f_devunit, uio, flags);
983 	KERNEL_UNLOCK_ONE(NULL);
984 	return error;
985 }
986 
987 static int
988 tap_dev_write(int unit, struct uio *uio, int flags)
989 {
990 	struct tap_softc *sc =
991 	    device_lookup_private(&tap_cd, unit);
992 	struct ifnet *ifp;
993 	struct mbuf *m, **mp;
994 	size_t len = 0;
995 	int error = 0;
996 
997 	if (sc == NULL)
998 		return ENXIO;
999 
1000 	getnanotime(&sc->sc_mtime);
1001 	ifp = &sc->sc_ec.ec_if;
1002 
1003 	/* One write, one packet, that's the rule */
1004 	MGETHDR(m, M_DONTWAIT, MT_DATA);
1005 	if (m == NULL) {
1006 		if_statinc(ifp, if_ierrors);
1007 		return ENOBUFS;
1008 	}
1009 	m->m_pkthdr.len = uio->uio_resid;
1010 
1011 	mp = &m;
1012 	while (error == 0 && uio->uio_resid > 0) {
1013 		if (*mp != m) {
1014 			MGET(*mp, M_DONTWAIT, MT_DATA);
1015 			if (*mp == NULL) {
1016 				error = ENOBUFS;
1017 				break;
1018 			}
1019 		}
1020 		(*mp)->m_len = uimin(MHLEN, uio->uio_resid);
1021 		len += (*mp)->m_len;
1022 		error = uiomove(mtod(*mp, void *), (*mp)->m_len, uio);
1023 		mp = &(*mp)->m_next;
1024 	}
1025 	if (error) {
1026 		if_statinc(ifp, if_ierrors);
1027 		m_freem(m);
1028 		return error;
1029 	}
1030 
1031 	m_set_rcvif(m, ifp);
1032 
1033 	if_statadd2(ifp, if_ipackets, 1, if_ibytes, len);
1034 	bpf_mtap(ifp, m, BPF_D_IN);
1035 	if ((error = pfil_run_hooks(ifp->if_pfil, &m, ifp, PFIL_IN)) != 0)
1036 		return error;
1037 	if (m == NULL)
1038 		return 0;
1039 
1040 	if_percpuq_enqueue(ifp->if_percpuq, m);
1041 
1042 	return 0;
1043 }
1044 
1045 static int
1046 tap_cdev_ioctl(dev_t dev, u_long cmd, void *data, int flags, struct lwp *l)
1047 {
1048 
1049 	return tap_dev_ioctl(minor(dev), cmd, data, l);
1050 }
1051 
1052 static int
1053 tap_fops_ioctl(file_t *fp, u_long cmd, void *data)
1054 {
1055 
1056 	return tap_dev_ioctl(fp->f_devunit, cmd, data, curlwp);
1057 }
1058 
1059 static int
1060 tap_dev_ioctl(int unit, u_long cmd, void *data, struct lwp *l)
1061 {
1062 	struct tap_softc *sc = device_lookup_private(&tap_cd, unit);
1063 
1064 	if (sc == NULL)
1065 		return ENXIO;
1066 
1067 	switch (cmd) {
1068 	case FIONREAD:
1069 		{
1070 			struct ifnet *ifp = &sc->sc_ec.ec_if;
1071 			struct mbuf *m;
1072 			int s;
1073 
1074 			s = splnet();
1075 			IFQ_POLL(&ifp->if_snd, m);
1076 
1077 			if (m == NULL)
1078 				*(int *)data = 0;
1079 			else
1080 				*(int *)data = m->m_pkthdr.len;
1081 			splx(s);
1082 			return 0;
1083 		}
1084 	case TIOCSPGRP:
1085 	case FIOSETOWN:
1086 		return fsetown(&sc->sc_pgid, cmd, data);
1087 	case TIOCGPGRP:
1088 	case FIOGETOWN:
1089 		return fgetown(sc->sc_pgid, cmd, data);
1090 	case FIOASYNC:
1091 		if (*(int *)data) {
1092 			if (sc->sc_sih == NULL) {
1093 				sc->sc_sih = softint_establish(SOFTINT_CLOCK,
1094 				    tap_softintr, sc);
1095 				if (sc->sc_sih == NULL)
1096 					return EBUSY; /* XXX */
1097 			}
1098 			sc->sc_flags |= TAP_ASYNCIO;
1099 		} else {
1100 			sc->sc_flags &= ~TAP_ASYNCIO;
1101 			if (sc->sc_sih != NULL) {
1102 				softint_disestablish(sc->sc_sih);
1103 				sc->sc_sih = NULL;
1104 			}
1105 		}
1106 		return 0;
1107 	case FIONBIO:
1108 		if (*(int *)data)
1109 			sc->sc_flags |= TAP_NBIO;
1110 		else
1111 			sc->sc_flags &= ~TAP_NBIO;
1112 		return 0;
1113 	case TAPGIFNAME:
1114 		{
1115 			struct ifreq *ifr = (struct ifreq *)data;
1116 			struct ifnet *ifp = &sc->sc_ec.ec_if;
1117 
1118 			strlcpy(ifr->ifr_name, ifp->if_xname, IFNAMSIZ);
1119 			return 0;
1120 		}
1121 	default:
1122 		return ENOTTY;
1123 	}
1124 }
1125 
1126 static int
1127 tap_cdev_poll(dev_t dev, int events, struct lwp *l)
1128 {
1129 
1130 	return tap_dev_poll(minor(dev), events, l);
1131 }
1132 
1133 static int
1134 tap_fops_poll(file_t *fp, int events)
1135 {
1136 
1137 	return tap_dev_poll(fp->f_devunit, events, curlwp);
1138 }
1139 
1140 static int
1141 tap_dev_poll(int unit, int events, struct lwp *l)
1142 {
1143 	struct tap_softc *sc = device_lookup_private(&tap_cd, unit);
1144 	int revents = 0;
1145 
1146 	if (sc == NULL)
1147 		return POLLERR;
1148 
1149 	if (events & (POLLIN | POLLRDNORM)) {
1150 		struct ifnet *ifp = &sc->sc_ec.ec_if;
1151 		struct mbuf *m;
1152 		int s;
1153 
1154 		s = splnet();
1155 		IFQ_POLL(&ifp->if_snd, m);
1156 
1157 		if (m != NULL)
1158 			revents |= events & (POLLIN | POLLRDNORM);
1159 		else {
1160 			mutex_spin_enter(&sc->sc_lock);
1161 			selrecord(l, &sc->sc_rsel);
1162 			mutex_spin_exit(&sc->sc_lock);
1163 		}
1164 		splx(s);
1165 	}
1166 	revents |= events & (POLLOUT | POLLWRNORM);
1167 
1168 	return revents;
1169 }
1170 
1171 static struct filterops tap_read_filterops = {
1172 	.f_flags = FILTEROP_ISFD,
1173 	.f_attach = NULL,
1174 	.f_detach = tap_kqdetach,
1175 	.f_event = tap_kqread,
1176 };
1177 
1178 static int
1179 tap_cdev_kqfilter(dev_t dev, struct knote *kn)
1180 {
1181 
1182 	return tap_dev_kqfilter(minor(dev), kn);
1183 }
1184 
1185 static int
1186 tap_fops_kqfilter(file_t *fp, struct knote *kn)
1187 {
1188 
1189 	return tap_dev_kqfilter(fp->f_devunit, kn);
1190 }
1191 
1192 static int
1193 tap_dev_kqfilter(int unit, struct knote *kn)
1194 {
1195 	struct tap_softc *sc = device_lookup_private(&tap_cd, unit);
1196 
1197 	if (sc == NULL)
1198 		return ENXIO;
1199 
1200 	switch(kn->kn_filter) {
1201 	case EVFILT_READ:
1202 		kn->kn_fop = &tap_read_filterops;
1203 		kn->kn_hook = sc;
1204 		KERNEL_LOCK(1, NULL);
1205 		mutex_spin_enter(&sc->sc_lock);
1206 		selrecord_knote(&sc->sc_rsel, kn);
1207 		mutex_spin_exit(&sc->sc_lock);
1208 		KERNEL_UNLOCK_ONE(NULL);
1209 		break;
1210 
1211 	case EVFILT_WRITE:
1212 		kn->kn_fop = &seltrue_filtops;
1213 		break;
1214 
1215 	default:
1216 		return EINVAL;
1217 	}
1218 
1219 	return 0;
1220 }
1221 
1222 static void
1223 tap_kqdetach(struct knote *kn)
1224 {
1225 	struct tap_softc *sc = (struct tap_softc *)kn->kn_hook;
1226 
1227 	KERNEL_LOCK(1, NULL);
1228 	mutex_spin_enter(&sc->sc_lock);
1229 	selremove_knote(&sc->sc_rsel, kn);
1230 	mutex_spin_exit(&sc->sc_lock);
1231 	KERNEL_UNLOCK_ONE(NULL);
1232 }
1233 
1234 static int
1235 tap_kqread(struct knote *kn, long hint)
1236 {
1237 	struct tap_softc *sc = (struct tap_softc *)kn->kn_hook;
1238 	struct ifnet *ifp = &sc->sc_ec.ec_if;
1239 	struct mbuf *m;
1240 	int s, rv;
1241 
1242 	KERNEL_LOCK(1, NULL);
1243 	s = splnet();
1244 	IFQ_POLL(&ifp->if_snd, m);
1245 
1246 	if (m == NULL)
1247 		kn->kn_data = 0;
1248 	else
1249 		kn->kn_data = m->m_pkthdr.len;
1250 	splx(s);
1251 	rv = (kn->kn_data != 0 ? 1 : 0);
1252 	KERNEL_UNLOCK_ONE(NULL);
1253 	return rv;
1254 }
1255 
1256 /*
1257  * sysctl management routines
1258  * You can set the address of an interface through:
1259  * net.link.tap.tap<number>
1260  *
1261  * Note the consistent use of tap_log in order to use
1262  * sysctl_teardown at unload time.
1263  *
1264  * In the kernel you will find a lot of SYSCTL_SETUP blocks.  Those
1265  * blocks register a function in a special section of the kernel
1266  * (called a link set) which is used at init_sysctl() time to cycle
1267  * through all those functions to create the kernel's sysctl tree.
1268  *
1269  * It is not possible to use link sets in a module, so the
1270  * easiest is to simply call our own setup routine at load time.
1271  *
1272  * In the SYSCTL_SETUP blocks you find in the kernel, nodes have the
1273  * CTLFLAG_PERMANENT flag, meaning they cannot be removed.  Once the
1274  * whole kernel sysctl tree is built, it is not possible to add any
1275  * permanent node.
1276  *
1277  * It should be noted that we're not saving the sysctlnode pointer
1278  * we are returned when creating the "tap" node.  That structure
1279  * cannot be trusted once out of the calling function, as it might
1280  * get reused.  So we just save the MIB number, and always give the
1281  * full path starting from the root for later calls to sysctl_createv
1282  * and sysctl_destroyv.
1283  */
1284 static void
1285 sysctl_tap_setup(struct sysctllog **clog)
1286 {
1287 	const struct sysctlnode *node;
1288 	int error = 0;
1289 
1290 	if ((error = sysctl_createv(clog, 0, NULL, NULL,
1291 	    CTLFLAG_PERMANENT,
1292 	    CTLTYPE_NODE, "link", NULL,
1293 	    NULL, 0, NULL, 0,
1294 	    CTL_NET, AF_LINK, CTL_EOL)) != 0)
1295 		return;
1296 
1297 	/*
1298 	 * The first four parameters of sysctl_createv are for management.
1299 	 *
1300 	 * The four that follows, here starting with a '0' for the flags,
1301 	 * describe the node.
1302 	 *
1303 	 * The next series of four set its value, through various possible
1304 	 * means.
1305 	 *
1306 	 * Last but not least, the path to the node is described.  That path
1307 	 * is relative to the given root (third argument).  Here we're
1308 	 * starting from the root.
1309 	 */
1310 	if ((error = sysctl_createv(clog, 0, NULL, &node,
1311 	    CTLFLAG_PERMANENT,
1312 	    CTLTYPE_NODE, "tap", NULL,
1313 	    NULL, 0, NULL, 0,
1314 	    CTL_NET, AF_LINK, CTL_CREATE, CTL_EOL)) != 0)
1315 		return;
1316 	tap_node = node->sysctl_num;
1317 }
1318 
1319 /*
1320  * The helper functions make Andrew Brown's interface really
1321  * shine.  It makes possible to create value on the fly whether
1322  * the sysctl value is read or written.
1323  *
1324  * As shown as an example in the man page, the first step is to
1325  * create a copy of the node to have sysctl_lookup work on it.
1326  *
1327  * Here, we have more work to do than just a copy, since we have
1328  * to create the string.  The first step is to collect the actual
1329  * value of the node, which is a convenient pointer to the softc
1330  * of the interface.  From there we create the string and use it
1331  * as the value, but only for the *copy* of the node.
1332  *
1333  * Then we let sysctl_lookup do the magic, which consists in
1334  * setting oldp and newp as required by the operation.  When the
1335  * value is read, that means that the string will be copied to
1336  * the user, and when it is written, the new value will be copied
1337  * over in the addr array.
1338  *
1339  * If newp is NULL, the user was reading the value, so we don't
1340  * have anything else to do.  If a new value was written, we
1341  * have to check it.
1342  *
1343  * If it is incorrect, we can return an error and leave 'node' as
1344  * it is:  since it is a copy of the actual node, the change will
1345  * be forgotten.
1346  *
1347  * Upon a correct input, we commit the change to the ifnet
1348  * structure of our interface.
1349  */
1350 static int
1351 tap_sysctl_handler(SYSCTLFN_ARGS)
1352 {
1353 	struct sysctlnode node;
1354 	struct tap_softc *sc;
1355 	struct ifnet *ifp;
1356 	int error;
1357 	size_t len;
1358 	char addr[3 * ETHER_ADDR_LEN];
1359 	uint8_t enaddr[ETHER_ADDR_LEN];
1360 
1361 	node = *rnode;
1362 	sc = node.sysctl_data;
1363 	ifp = &sc->sc_ec.ec_if;
1364 	(void)ether_snprintf(addr, sizeof(addr), CLLADDR(ifp->if_sadl));
1365 	node.sysctl_data = addr;
1366 	error = sysctl_lookup(SYSCTLFN_CALL(&node));
1367 	if (error || newp == NULL)
1368 		return error;
1369 
1370 	len = strlen(addr);
1371 	if (len < 11 || len > 17)
1372 		return EINVAL;
1373 
1374 	/* Commit change */
1375 	if (ether_aton_r(enaddr, sizeof(enaddr), addr) != 0)
1376 		return EINVAL;
1377 	if_set_sadl(ifp, enaddr, ETHER_ADDR_LEN, false);
1378 	return error;
1379 }
1380 
1381 /*
1382  * Module infrastructure
1383  */
1384 #include "if_module.h"
1385 
1386 IF_MODULE(MODULE_CLASS_DRIVER, tap, NULL)
1387